diff options
| author | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2023-09-20 02:04:03 +0000 |
|---|---|---|
| committer | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2023-09-20 02:04:03 +0000 |
| commit | 32b7a323a63837c399e402f60657ec88431dc301 (patch) | |
| tree | 9eb184361f04636291c89bfb870597788f8a490e /converter/pbm | |
| parent | 27d6da036c2aa20ecee53cb77ef8aecf04fc633d (diff) | |
| download | netpbm-mirror-32b7a323a63837c399e402f60657ec88431dc301.tar.gz netpbm-mirror-32b7a323a63837c399e402f60657ec88431dc301.tar.xz netpbm-mirror-32b7a323a63837c399e402f60657ec88431dc301.zip | |
Fix incorrect output with extremely long rows
git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@4669 9d0c8265-081b-0410-96cb-a4ca84ce46f8
Diffstat (limited to 'converter/pbm')
| -rw-r--r-- | converter/pbm/thinkjettopbm.l | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/converter/pbm/thinkjettopbm.l b/converter/pbm/thinkjettopbm.l index 5de4f2bb..c55a0085 100644 --- a/converter/pbm/thinkjettopbm.l +++ b/converter/pbm/thinkjettopbm.l @@ -38,6 +38,7 @@ #include <errno.h> #include <unistd.h> #include "pm_c_util.h" +#include "mallocvar.h" #include "pbm.h" #include "shhopt.h" @@ -114,8 +115,10 @@ DIG [0-9] <RASTERMODE>\033\*b{DIG}+W { int l; if (rowCount >= rowCapacity) { + if (rowCapacity > INT_MAX-100) + pm_error("Too many rows to count"); rowCapacity += 100; - rows = realloc (rows, rowCapacity * sizeof *rows); + REALLOCARRAY(rows, rowCapacity); if (rows == NULL) pm_error ("Out of memory."); } @@ -223,6 +226,9 @@ yywrap (void) debug ("Got %d rows, %d columns\n", rowCount, maxRowLength); + if (maxRowLength > INT_MAX/8) + pm_error("A row has an uncomputably large number of columns: %d", + maxRowLength); /* * Quite simple since ThinkJet bit arrangement matches PBM */ |