diff options
author | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2018-10-06 17:04:27 +0000 |
---|---|---|
committer | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2018-10-06 17:04:27 +0000 |
commit | 678a09f9062469cdcdfd5bdb8eeb189ecaaf9691 (patch) | |
tree | 68c72713c31a6f64a6a3dc25505f06f0f118dfcd /converter/ppm | |
parent | 74856d201f2255b671904fca1fa588c107a53be5 (diff) | |
download | netpbm-mirror-678a09f9062469cdcdfd5bdb8eeb189ecaaf9691.tar.gz netpbm-mirror-678a09f9062469cdcdfd5bdb8eeb189ecaaf9691.tar.xz netpbm-mirror-678a09f9062469cdcdfd5bdb8eeb189ecaaf9691.zip |
Fix arithmetic overflow
git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3383 9d0c8265-081b-0410-96cb-a4ca84ce46f8
Diffstat (limited to 'converter/ppm')
-rw-r--r-- | converter/ppm/pjtoppm.c | 31 |
1 files changed, 20 insertions, 11 deletions
diff --git a/converter/ppm/pjtoppm.c b/converter/ppm/pjtoppm.c index 3f180267..b8b94f74 100644 --- a/converter/ppm/pjtoppm.c +++ b/converter/ppm/pjtoppm.c @@ -16,6 +16,20 @@ static char usage[] = "[paintjetfile]"; + + +static unsigned int +uintProduct(unsigned int const multiplicand, + unsigned int const multiplier) { + + if (UINT_MAX / multiplier < multiplicand) + pm_error("Airthmetic overflow"); + + return multiplicand * multiplier; +} + + + static int egetc(FILE * const ifP) { int c; @@ -138,21 +152,16 @@ main(int argc, const char ** argv) { if (rows == -1 || row >= rows) rows += 100; if (image == NULL) { - MALLOCARRAY(image, rows * planes); - MALLOCARRAY(imlen, rows * planes); - } - else { - image = (unsigned char **) - realloc(image, - rows * planes * - sizeof(unsigned char *)); - imlen = (int *) - realloc(imlen, rows * planes * sizeof(int)); + MALLOCARRAY(image, uintProduct(rows, planes)); + MALLOCARRAY(imlen, uintProduct(rows, planes)); + } else { + REALLOCARRAY(image, uintProduct(rows, planes)); + REALLOCARRAY(imlen, uintProduct(rows, planes)); } } if (image == NULL || imlen == NULL) pm_error("out of memory"); - if (plane == planes) + if (plane >= planes) pm_error("too many planes"); cols = MAX(cols, val); imlen[row * planes + plane] = val; |