Release 10.73.07

git-svn-id: http://svn.code.sf.net/p/netpbm/code/stable@2885 9d0c8265-081b-0410-96cb-a4ca84ce46f8

2 files changed, 24 insertions, 4 deletions

diff --git a/converter/other/svgtopam.c b/converter/other/svgtopam.c
index 137f4732..58e7928f 100644
--- a/converter/other/svgtopam.c
+++ b/converter/other/svgtopam.c
@@ -102,16 +102,23 @@ parseCommandLine(int argc,
 /*============================================================================
    Wrappers for libxml2 routines.
 
-   The difference is that these use conventional C data types and have
-   shorter names.
+   The difference is that these use conventional C data types, have shorter
+   names, and abort the program instead of returning a special value when they
+   fail.
 =============================================================================*/
 
 static const char *
 getAttribute(xmlTextReaderPtr const xmlReaderP,
              const char *     const attributeName) {
 
-    return (const char *)
+    const char * const rc = (const char *)
         xmlTextReaderGetAttribute(xmlReaderP, (const xmlChar *)attributeName);
+
+    if (rc == NULL)
+        pm_error("xmlTextReaderGetAttribute(\"%.256s\") failed.  ",
+                 attributeName);
+
+    return rc;
 }
 
 
@@ -119,7 +126,13 @@ getAttribute(xmlTextReaderPtr const xmlReaderP,
 static const char *
 currentNodeName(xmlTextReaderPtr const xmlReaderP) {
 
-    return (const char *)xmlTextReaderConstName(xmlReaderP);
+    const char * const rc = (const char *)
+        xmlTextReaderConstName(xmlReaderP);
+
+    if (rc == NULL)
+        pm_error("xmlTextReaderConstName() failed.  ");
+
+    return rc;
 }
 
 
diff --git a/converter/other/tifftopnm.c b/converter/other/tifftopnm.c
index 0d6494f9..b112aa82 100644
--- a/converter/other/tifftopnm.c
+++ b/converter/other/tifftopnm.c
@@ -1498,6 +1498,13 @@ convertRasterInMemory(pnmOut *           const pnmOutP,
             /* Note that TIFFRGBAImageGet() converts any bits per sample
                to 8.  Maxval of the raster it returns is always 255.
             */
+            if (cols > UINT_MAX/rows) {
+                pm_message("%u rows of %u columns is too large to compute",
+                           rows, cols);
+                *statusP = CONV_OOM;
+                return;
+            }
+
             MALLOCARRAY(raster, cols * rows);
             if (raster == NULL) {
                 pm_message("Unable to allocate space for a raster of %u "