about summary refs log tree commit diff
path: root/converter
diff options
context:
space:
mode:
authorgiraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>2023-09-20 02:04:03 +0000
committergiraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>2023-09-20 02:04:03 +0000
commit32b7a323a63837c399e402f60657ec88431dc301 (patch)
tree9eb184361f04636291c89bfb870597788f8a490e /converter
parent27d6da036c2aa20ecee53cb77ef8aecf04fc633d (diff)
downloadnetpbm-mirror-32b7a323a63837c399e402f60657ec88431dc301.tar.gz
netpbm-mirror-32b7a323a63837c399e402f60657ec88431dc301.tar.xz
netpbm-mirror-32b7a323a63837c399e402f60657ec88431dc301.zip
Fix incorrect output with extremely long rows
git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@4669 9d0c8265-081b-0410-96cb-a4ca84ce46f8
Diffstat (limited to 'converter')
-rw-r--r--converter/pbm/thinkjettopbm.l8
1 files changed, 7 insertions, 1 deletions
diff --git a/converter/pbm/thinkjettopbm.l b/converter/pbm/thinkjettopbm.l
index 5de4f2bb..c55a0085 100644
--- a/converter/pbm/thinkjettopbm.l
+++ b/converter/pbm/thinkjettopbm.l
@@ -38,6 +38,7 @@
 #include <errno.h>
 #include <unistd.h>
 #include "pm_c_util.h"
+#include "mallocvar.h"
 #include "pbm.h"
 #include "shhopt.h"
 
@@ -114,8 +115,10 @@ DIG             [0-9]
 <RASTERMODE>\033\*b{DIG}+W  {
                             int l;
                             if (rowCount >= rowCapacity) {
+                                if (rowCapacity > INT_MAX-100)
+                                    pm_error("Too many rows to count");
                                 rowCapacity += 100;
-                                rows = realloc (rows, rowCapacity * sizeof *rows);
+                                REALLOCARRAY(rows, rowCapacity);
                                 if (rows == NULL)
                                     pm_error ("Out of memory.");
                             }
@@ -223,6 +226,9 @@ yywrap (void)
 
     debug ("Got %d rows, %d columns\n", rowCount, maxRowLength);
 
+    if (maxRowLength > INT_MAX/8)
+        pm_error("A row has an uncomputably large number of columns: %d",
+                 maxRowLength);
     /*
      * Quite simple since ThinkJet bit arrangement matches PBM
      */