diff options
| author | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2015-09-26 17:52:31 +0000 |
|---|---|---|
| committer | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2015-09-26 17:52:31 +0000 |
| commit | ec90fbed51190f7829284be2cdc5e64d3edaef8d (patch) | |
| tree | 85cfb4b5b157086fc7076f3dca38bc905e61acbc /converter | |
| parent | 374fbcbcb13401d53cc4adb51a98c97fb320c387 (diff) | |
| download | netpbm-mirror-ec90fbed51190f7829284be2cdc5e64d3edaef8d.tar.gz netpbm-mirror-ec90fbed51190f7829284be2cdc5e64d3edaef8d.tar.xz netpbm-mirror-ec90fbed51190f7829284be2cdc5e64d3edaef8d.zip | |
Release 10.35.97
git-svn-id: http://svn.code.sf.net/p/netpbm/code/super_stable@2634 9d0c8265-081b-0410-96cb-a4ca84ce46f8
Diffstat (limited to 'converter')
| -rw-r--r-- | converter/other/pnmtopclxl.c | 9 | ||||
| -rw-r--r-- | converter/pgm/sbigtopgm.c | 2 | ||||
| -rw-r--r-- | converter/ppm/ppmtoilbm.c | 2 |
3 files changed, 10 insertions, 3 deletions
diff --git a/converter/other/pnmtopclxl.c b/converter/other/pnmtopclxl.c index 7c85d09c..23c7bd3a 100644 --- a/converter/other/pnmtopclxl.c +++ b/converter/other/pnmtopclxl.c @@ -250,9 +250,14 @@ out(XY_rle *rle,int count) { rle->fbpos+=count; } if(rle->fbpos+129>rle->fbufsize) { + if (rle->fbufsize > INT_MAX/1.2) + pm_error("Arithmetic overflow during attempt to expand RLE " + "output buffer beyond %u", rle->fbufsize); rle->fbufsize*=1.2; rle->fbuf=realloc(rle->fbuf,rle->fbufsize); if(rle->fbuf==NULL) { + pm_error("Out of memory while attempting to expand RLE " + "output buffer beyond %u", rle->fbufsize); rle->error=-1; rle->fbpos=0; return -1; @@ -323,7 +328,7 @@ XY_Write(int fd, const void *buf,int cnt) { while(len<cnt) { int n = write(fd,(char*)buf+len,cnt-len); if(n<=0) - return n; + pm_error("Failed to write %u bytes to fd %d", cnt - len, fd); len+=n; } return len; @@ -816,6 +821,8 @@ convertAndWriteImage(int const outFd, xl_attr_ubyte(outFd, aDestinationSize); XL_Operator(outFd, oBeginImage); + if (pclGenP->linelen > INT_MAX / 20) + pm_error("Image too big"); rle = XY_RLEnew(pclGenP->linelen*20); if (!rle) pm_error("Unable to allocate %d bytes for the RLE buffer", diff --git a/converter/pgm/sbigtopgm.c b/converter/pgm/sbigtopgm.c index c6785152..228b71b3 100644 --- a/converter/pgm/sbigtopgm.c +++ b/converter/pgm/sbigtopgm.c @@ -124,7 +124,7 @@ int main(argc, argv) } *cp = 0; if (strncmp(hdr, "ST-", 3) == 0 || - (hdr == &hdr[0] && strstr(hdr,"Image") != NULL)) { + (hdr == &header[0] && strstr(hdr,"Image") != NULL)) { char *ep = strchr(hdr + 3, ' '); if (ep != NULL) { diff --git a/converter/ppm/ppmtoilbm.c b/converter/ppm/ppmtoilbm.c index 7b38dd4d..fcc6053f 100644 --- a/converter/ppm/ppmtoilbm.c +++ b/converter/ppm/ppmtoilbm.c @@ -635,7 +635,7 @@ ppm_to_ham(fp, cols, rows, maxval, colormap, colors, cmapmaxval, hamplanes) if( DO_COMPRESS ) write_body_rows(); else - do_ham_body(fp, NULL, cols, rows, maxval, hammaxval, + do_ham_body(fp, stdout, cols, rows, maxval, hammaxval, nPlanes, colormap, colors); } |