Fix arithmetic overflow with image dimensions represented by 16 bit integers

git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@1136 9d0c8265-081b-0410-96cb-a4ca84ce46f8

5 files changed, 312 insertions, 289 deletions

diff --git a/converter/other/pnmtosgi.c b/converter/other/pnmtosgi.c
index 472b5197..169125b3 100644
--- a/converter/other/pnmtosgi.c
+++ b/converter/other/pnmtosgi.c
@@ -13,11 +13,16 @@
 ** implied warranty.
 **
 ** 29Jan94: first version
+
+** Feb 2010 afu
+** Added dimension check to prevent short int from overflowing
 */
 #include "pnm.h"
 #include "sgi.h"
 #include "mallocvar.h"
 
+
+
 /*#define DEBUG*/
 
 typedef short       ScanElem;
@@ -42,6 +47,7 @@ static int rle_compress ARGS((ScanElem *inbuf, int cols));
 
 #define MAXVAL_BYTE     255
 #define MAXVAL_WORD     65535
+#define INT16MAX        32767
 
 static char storage = STORAGE_RLE;
 static ScanLine * channel[3];
@@ -87,9 +93,7 @@ write_header(int const cols,
 
 
 int
-main(argc, argv)
-    int argc;
-    char *argv[];
+main(int argc,char * argv[])
 {
     FILE *ifp;
     int argn;
@@ -131,6 +135,9 @@ main(argc, argv)
         pm_usage(usage);
 
     pnm_readpnminit(ifp, &cols, &rows, &maxval, &format);
+    if( rows>INT16MAX || cols>INT16MAX )
+      pm_error ("Input image is too large.");
+
     pnmrow = pnm_allocrow(cols);
 
     switch( PNM_FORMAT_TYPE(format) ) {
@@ -172,9 +179,7 @@ main(argc, argv)
 
 
 static void
-write_table(table, tabsize)
-    long *table;
-    int tabsize;
+write_table(long * table, int const tabsize)
 {
     int i;
     long offset;
@@ -194,9 +199,8 @@ write_table(table, tabsize)
 
 
 static void
-write_channels(cols, rows, channels, put)
-    int cols, rows, channels;
-    void (*put) ARGS((short));
+write_channels(int const cols,int const rows, int const channels,
+               void (*put) (short))
 {
     int i, row, col;
 
@@ -214,7 +218,7 @@ write_channels(cols, rows, channels, put)
 }
 
 static void
-put_big_short(short s)
+put_big_short(short const s)
 {
     if ( pm_writebigshort( stdout, s ) == -1 )
         pm_error( "write error" );
@@ -222,8 +226,7 @@ put_big_short(short s)
 
 
 static void
-put_big_long(l)
-    long l;
+put_big_long(long const l)
 {
     if ( pm_writebiglong( stdout, l ) == -1 )
         pm_error( "write error" );
@@ -231,15 +234,16 @@ put_big_long(l)
 
 
 static void
-put_short_as_byte(short s)
+put_short_as_byte(short const s)
 {
     put_byte((unsigned char)s);
 }
 
 
 static long *
-build_channels(FILE *ifp, int cols, int rows, xelval maxval, 
-               int format, int bpc, int channels)
+build_channels(FILE * const ifp, int const cols, int const rows,
+               xelval const maxval, int const format,
+               int const bpc, int const channels)
 {
     int i, row, col, sgirow;
     long *table = NULL;
@@ -286,11 +290,10 @@ build_channels(FILE *ifp, int cols, int rows, xelval maxval,
 
 
 static ScanElem *
-compress(temp, row, rows, cols, chan_no, table, bpc)
-    ScanElem *temp;
-    int row, rows, cols, chan_no;
-    long *table;
-    int bpc;
+compress(ScanElem * temp,
+         int const row,  int const rows,
+         int const cols, int const chan_no,
+         long * table, int const bpc)
 {
     int len, i, tabrow;
     ScanElem *p;
@@ -323,9 +326,7 @@ slightly modified RLE algorithm from ppmtoilbm.c
 written by Robert A. Knop (rknop@mop.caltech.edu)
 */
 static int
-rle_compress(inbuf, size)
-    ScanElem *inbuf;
-    int size;
+rle_compress(ScanElem * const inbuf, int const size)
 {
     int in, out, hold, count;
     ScanElem *outbuf = rletemp;
diff --git a/converter/pbm/pbmtogem.c b/converter/pbm/pbmtogem.c
index cefbdc95..9eab0416 100644
--- a/converter/pbm/pbmtogem.c
+++ b/converter/pbm/pbmtogem.c
@@ -27,17 +27,21 @@
 *  removed rounding of the imagewidth to the next word boundary
 *  removed arbitrary limit to imagewidth
 *  changed pattern length to 1 to simplify locating of compressable parts
-*	in real world images
+*       in real world images
 *  add solid run and pattern run compression
 *
 *  Deficiencies:
 *  Compression of repeated scanlines not added
 *  
-*	Johann Haider (jh@fortec.tuwien.ac.at)
+*       Johann Haider (jh@fortec.tuwien.ac.at)
 *
 * 94/01/31 Andreas Schwab (schwab@ls5.informatik.uni-dortmund.de)
 * Changed to remove architecture dependencies
 * Added compression of repeated scanlines
+*
+* Feb 2010 afu
+* Added dimension check to prevent short int from overflowing
+* Changed code style (ANSI-style function definitions, etc.)
 */
 
 #include <stdio.h>
@@ -47,59 +51,11 @@
 #define SOLID_0 0
 #define SOLID_1 0xff
 #define MINRUN 4
+#define INT16MAX 32767
+
 #define putsolid(v,c) putc((v&0x80)|c, stdout)
 #define putpattern(v,c) putc(0, stdout);putc(c, stdout);putc(v, stdout)
 
-static void putinit ARGS ((int rows, int cols));
-static void putbit ARGS(( bit b ));
-static void putitem ARGS(( void ));
-static void putrow ARGS(( void ));
-static void flushrow ARGS ((void));
-static void putstring ARGS((register unsigned char *p, register int n));
-
-int
-main( argc, argv )
-    int argc;
-    char* argv[];
-    {
-    FILE* ifp;
-    bit* bitrow;
-    register bit* bP;
-    int rows, cols, format, row, col;
-
-    pbm_init( &argc, argv );
-
-    if ( argc > 2 )
-	pm_usage( "[pbmfile]" );
-
-    if ( argc == 2 )
-	ifp = pm_openr( argv[1] );
-    else
-	ifp = stdin;
-
-    pbm_readpbminit( ifp, &cols, &rows, &format );
-
-    bitrow = pbm_allocrow( cols );
-
-    putinit (rows, cols);
-    for ( row = 0; row < rows; ++row )
-	{
-#ifdef DEBUG
-	fprintf (stderr, "row %d\n", row);
-#endif
-	pbm_readpbmrow( ifp, bitrow, cols, format );
-        for ( col = 0, bP = bitrow; col < cols; ++col, ++bP )
-	    putbit( *bP );
-        putrow( );
-        }
-    flushrow ();
-
-    pm_close( ifp );
-
-
-    exit( 0 );
-    }
-
 static short item;
 static int outcol, outmax;
 static short bitsperitem, bitshift;
@@ -107,9 +63,9 @@ static short linerepeat;
 static unsigned char *outrow, *lastrow;
 
 static void
-putinit (rows, cols)
-     int rows, cols;
+putinit (int const rows, int const cols)
 {
+
   if (pm_writebigshort (stdout, (short) 1) == -1 /* Image file version */
       || pm_writebigshort (stdout, (short) 8) == -1 /* Header length */
       || pm_writebigshort (stdout, (short) 1) == -1 /* Number of planes */
@@ -130,17 +86,6 @@ putinit (rows, cols)
 }
 
 static void
-putbit( bit b )
-    {
-    if ( bitsperitem == 8 )
-	putitem( );
-    ++bitsperitem;
-    if ( b == PBM_BLACK )
-	item += 1 << bitshift;
-    --bitshift;
-    }
-
-static void
 putitem( )
     {
     outrow[outcol++] = item;
@@ -149,19 +94,93 @@ putitem( )
     bitshift = 7;
     }
 
+
+static void
+putbit( bit const b )
+    {
+    if ( bitsperitem == 8 )
+        putitem( );
+    ++bitsperitem;
+    if ( b == PBM_BLACK )
+        item += 1 << bitshift;
+    --bitshift;
+    }
+
+
 static void
-putstring (p, n)
-register unsigned char *p;
-register int n;
+putstring ( unsigned char *p, int n)
 {
 #ifdef DEBUG
     fprintf (stderr, "Bitstring, length: %d, pos %d\n", n, outcol);
 #endif
     (void) putc((char) 0x80, stdout);     /* a Bit string */
-    (void) putc(n, stdout);	/* count */
+    (void) putc(n, stdout);     /* count */
     fwrite( p, n, 1, stdout );
 }
 
+
+static void
+flushrow( )
+    {
+    unsigned char *outp, *p, *q;
+    int count;
+    int col = outmax;
+
+    if (linerepeat > 1)
+      {
+        /* Put out line repeat count */
+        fwrite ("\0\0\377", 3, 1, stdout);
+        putchar (linerepeat);
+      }
+    for (outp = p = lastrow; col > 0;)
+    {
+            for (q = p, count=0; (count < col) && (*q == *p); q++,count++);
+            if (count > MINRUN)
+            {
+                if (p > outp)
+                {
+                    putstring (outp, p-outp);
+                    outp = p;
+                }
+                col -= count;
+                switch (*p)
+                {
+                case SOLID_0:
+#ifdef DEBUG
+/*                      if (outcol > 0) */
+                        fprintf (stderr, "Solid run 0, length: %d\n", count);
+#endif
+                        putsolid (SOLID_0, count);
+                        break;
+
+                case SOLID_1:
+#ifdef DEBUG
+                        fprintf (stderr, "Solid run 1, length: %d, pos %d\n", count, outcol);
+#endif
+                        putsolid (SOLID_1, count);
+                        break;
+                default:
+#ifdef DEBUG
+                        fprintf (stderr, "Pattern run, length: %d\n", count);
+#endif
+                        putpattern (*p, count);
+                        break;
+                }
+                outp = p = q;
+            }
+            else
+            {
+                p++;
+                col--;
+            }
+    }           
+    if (p > outp)
+         putstring (outp, p-outp);
+    if (ferror (stdout))
+      pm_error ("write error");
+}
+
+
 static void
 putrow( )
 {
@@ -173,7 +192,7 @@ putrow( )
     {
       unsigned char *temp;
       if (linerepeat != -1) /* Unless first line */
-	flushrow ();
+        flushrow ();
       /* Swap the pointers */
       temp = outrow; outrow = lastrow; lastrow = temp;
       linerepeat = 1;
@@ -183,64 +202,47 @@ putrow( )
     linerepeat++;
 }
 
-static void
-flushrow( )
-    {
-    register unsigned char *outp, *p, *q;
-    register int count;
-    int col = outmax;
 
-    if (linerepeat > 1)
-      {
-	/* Put out line repeat count */
-	fwrite ("\0\0\377", 3, 1, stdout);
-	putchar (linerepeat);
-      }
-    for (outp = p = lastrow; col > 0;)
+int
+main( int argc, char* argv[])
     {
-	    for (q = p, count=0; (count < col) && (*q == *p); q++,count++);
-	    if (count > MINRUN)
-	    {
-		if (p > outp)
-		{
-		    putstring (outp, p-outp);
-		    outp = p;
-		}
-		col -= count;
-		switch (*p)
-		{
-		case SOLID_0:
-#ifdef DEBUG
-/*			if (outcol > 0) */
-			fprintf (stderr, "Solid run 0, length: %d\n", count);
-#endif
-			putsolid (SOLID_0, count);
-			break;
+    FILE* ifp;
+    bit* bitrow;
+    int rows, cols, format, row, col;
 
-		case SOLID_1:
-#ifdef DEBUG
-			fprintf (stderr, "Solid run 1, length: %d, pos %d\n", count, outcol);
-#endif
-			putsolid (SOLID_1, count);
-			break;
-		default:
+    pbm_init( &argc, argv );
+
+    if ( argc > 2 )
+        pm_usage( "[pbmfile]" );
+
+    if ( argc == 2 )
+        ifp = pm_openr( argv[1] );
+    else
+        ifp = stdin;
+
+    pbm_readpbminit( ifp, &cols, &rows, &format );
+
+    if( rows>INT16MAX || cols>INT16MAX )
+      pm_error ("Input image is too large.");
+
+
+    bitrow = pbm_allocrow( cols );
+
+    putinit (rows, cols);
+    for ( row = 0; row < rows; ++row )
+        {
 #ifdef DEBUG
-			fprintf (stderr, "Pattern run, length: %d\n", count);
+        fprintf (stderr, "row %d\n", row);
 #endif
-			putpattern (*p, count);
-			break;
-		}
-		outp = p = q;
-	    }
-	    else
-	    {
-		p++;
-		col--;
-	    }
-    }		
-    if (p > outp)
-         putstring (outp, p-outp);
-    if (ferror (stdout))
-      pm_error ("write error");
-}
+        pbm_readpbmrow( ifp, bitrow, cols, format );
+        for ( col = 0; col < cols; ++col )
+            putbit( bitrow[col] );
+        putrow( );
+        }
+    flushrow ();
+
+    pm_close( ifp );
 
+
+    exit( 0 );
+    }
diff --git a/converter/pbm/pbmtoybm.c b/converter/pbm/pbmtoybm.c
index 508e8e92..88172788 100644
--- a/converter/pbm/pbmtoybm.c
+++ b/converter/pbm/pbmtoybm.c
@@ -9,68 +9,33 @@
 ** copyright notice and this permission notice appear in supporting
 ** documentation.  This software is provided "as is" without express or
 ** implied warranty.
+**
+** Feb 2010 afu
+** Added dimension check to prevent short int from overflowing
+** Changed code style (ANSI-style function definitions, etc.)
 */
 
 #include <stdio.h>
 #include "pbm.h"
 
 #define YBM_MAGIC  ( ( '!' << 8 ) | '!' )
+#define INT16MAX 32767
 
-static void putinit ARGS(( int cols, int rows ));
-static void putbit ARGS(( bit b ));
-static void putrest ARGS(( void ));
-static void putitem ARGS(( void ));
-
-int
-main( argc, argv )
-    int argc;
-    char* argv[];
-    {
-    FILE* ifp;
-    bit* bitrow;
-    register bit* bP;
-    int rows, cols, format, padright, row, col;
-
-
-    pbm_init( &argc, argv );
-
-    if ( argc > 2 )
-	pm_usage( "[pbmfile]" );
-    if ( argc == 2 )
-	ifp = pm_openr( argv[1] );
-    else
-	ifp = stdin;
-
-    pbm_readpbminit( ifp, &cols, &rows, &format );
-    bitrow = pbm_allocrow( cols );
-    
-    /* Compute padding to round cols up to the nearest multiple of 16. */
-    padright = ( ( cols + 15 ) / 16 ) * 16 - cols;
-
-    putinit( cols, rows );
-    for ( row = 0; row < rows; ++row )
-	{
-	pbm_readpbmrow( ifp, bitrow, cols, format );
-        for ( col = 0, bP = bitrow; col < cols; ++col, ++bP )
-	    putbit( *bP );
-	for ( col = 0; col < padright; ++col )
-	    putbit( 0 );
-        }
-
-    if ( ifp != stdin )
-	fclose( ifp );
+static long item;
+static int bitsperitem, bitshift;
 
-    putrest( );
 
-    exit( 0 );
+static void
+putitem( )
+    {
+    pm_writebigshort( stdout, item );
+    item = 0;
+    bitsperitem = 0;
+    bitshift = 0;
     }
 
-static long item;
-static int bitsperitem, bitshift;
-
 static void
-putinit( cols, rows )
-    int cols, rows;
+putinit(int const cols, int const rows )
     {
     pm_writebigshort( stdout, YBM_MAGIC );
     pm_writebigshort( stdout, cols );
@@ -81,13 +46,13 @@ putinit( cols, rows )
     }
 
 static void
-putbit( bit b )
+putbit( bit const b )
     {
     if ( bitsperitem == 16 )
-	putitem( );
+        putitem( );
     ++bitsperitem;
     if ( b == PBM_BLACK )
-	item += 1 << bitshift;
+        item += 1 << bitshift;
     ++bitshift;
     }
 
@@ -95,14 +60,50 @@ static void
 putrest( )
     {
     if ( bitsperitem > 0 )
-	putitem( );
+        putitem( );
     }
 
-static void
-putitem( )
+
+int
+main( int argc, char *argv[] )
     {
-    pm_writebigshort( stdout, item );
-    item = 0;
-    bitsperitem = 0;
-    bitshift = 0;
+    FILE* ifp;
+    bit* bitrow;
+    int rows, cols, format, padright, row, col;
+
+    pbm_init( &argc, argv );
+
+    if ( argc > 2 )
+        pm_usage( "[pbmfile]" );
+    if ( argc == 2 )
+        ifp = pm_openr( argv[1] );
+    else
+        ifp = stdin;
+
+    pbm_readpbminit( ifp, &cols, &rows, &format );
+
+    if( rows>INT16MAX || cols>INT16MAX )
+      pm_error ("Input image is too large.");
+
+    bitrow = pbm_allocrow( cols );
+    
+    /* Compute padding to round cols up to the nearest multiple of 16. */
+    padright = ( ( cols + 15 ) / 16 ) * 16 - cols;
+
+    putinit( cols, rows );
+    for ( row = 0; row < rows; ++row )
+        {
+        pbm_readpbmrow( ifp, bitrow, cols, format );
+        for ( col = 0; col < cols; ++col )
+            putbit(  bitrow[col] );
+        for ( col = 0; col < padright; ++col )
+            putbit( 0 );
+        }
+
+    if ( ifp != stdin )
+        fclose( ifp );
+
+    putrest( );
+
+    exit( 0 );
     }
diff --git a/converter/pgm/pgmtolispm.c b/converter/pgm/pgmtolispm.c
index abb85494..4da9ae88 100644
--- a/converter/pgm/pgmtolispm.c
+++ b/converter/pgm/pgmtolispm.c
@@ -14,82 +14,62 @@
 **   usually a color image; but a color map is not written in the file, so we
 **   treat this as a graymap instead.  To convert a color image to Lispm 
 **   format, you must convert it to a pgm, and hand-edit a color map...  Ick.
+**
+** Feb 2010 afu
+** Added dimension check to prevent short int from overflowing
+** Changed code style (ANSI-style function definitions, etc.)
 */
 
 #include <stdio.h>
 #include "pgm.h"
 
 #define LISPM_MAGIC  "This is a BitMap file"
+#define INT16MAX 32767
 
-static void putinit ARGS(( int cols, int rows, int depth ));
-static int depth_to_word_size ARGS(( int depth ));
-static void putval ARGS(( gray b ));
-static void putrest ARGS(( void ));
-static void putitem ARGS(( void ));
-
-int
-main( argc, argv )
-    int argc;
-    char* argv[];
-    {
-    FILE* ifp;
-    gray *grayrow;
-    register gray* gP;
-    int rows, cols, depth, format, padright, row, col;
-    gray maxval;
-
-
-    pgm_init( &argc, argv );
-
-    if ( argc > 2 )
-	pm_usage( "[pgmfile]" );
-    if ( argc == 2 )
-	ifp = pm_openr( argv[1] );
-    else
-	ifp = stdin;
-
-    pgm_readpgminit( ifp, &cols, &rows, &maxval, &format );
-    grayrow = pgm_allocrow( cols );
-    depth = pm_maxvaltobits( maxval );
-
-    /* Compute padding to round cols up to the nearest multiple of 32. */
-    padright = ( ( cols + 31 ) / 32 ) * 32 - cols;
-
-    putinit( cols, rows, depth );
-    for ( row = 0; row < rows; ++row )
-	{
-	pgm_readpgmrow( ifp, grayrow, cols, maxval, format );
-        for ( col = 0, gP = grayrow; col < cols; ++col, ++gP )
-	    putval( *gP );
-	for ( col = 0; col < padright; ++col )
-	    putval( 0 );
-        }
-
-    pm_close( ifp );
-
-    putrest( );
-
-    exit( 0 );
-    }
 
 static unsigned int item;
 static unsigned int bitsperitem, maxbitsperitem, bitshift;
 
+static int
+depth_to_word_size (int const depth) {
+/* Lispm architecture specific - if a bitmap is written    */
+/* out with a depth of 5, it really has a depth of 8, and  */
+/* is stored that way in the file.                         */
+
+    if (depth==0 || depth==1)   return ( 1);
+    else if (depth ==  2)       return ( 2);
+    else if (depth <=  4)       return ( 4);
+    else if (depth <=  8)       return ( 8);
+    else if (depth <= 16)       return (16);
+    else if (depth <= 32)       return (32);
+    else {
+      pm_error( "depth was %d, which is not in the range 1-32", depth );
+      return(-1);  /* Should never reach here */
+  }
+}
+
+
 static void
-putinit( cols, rows, depth )
-    int cols, rows, depth;
+putinit( int const cols, int const rows, int const depth )
     {
     int i;
-    int cols32 = ( ( cols + 31 ) / 32 ) * 32;	/* Lispms are able to write bit files that are not mod32 wide, but we   */
-						/* don't.  This should be ok, since bit arrays which are not mod32 wide */
-    printf(LISPM_MAGIC);			/* are pretty useless on a lispm (can't hand them to bitblt).		*/
+    int const cols32 = ( ( cols + 31 ) / 32 ) * 32;
+  /* Lispms are able to write bit files that are not mod32 wide, but we   */
+  /* don't.  This should be ok, since bit arrays which are not mod32 wide */
+  /* are pretty useless on a lispm (can't hand them to bitblt).           */
+
+    if( rows>INT16MAX || cols>INT16MAX || cols32>INT16MAX )
+      pm_error ("Input image is too large.");
+
+    printf(LISPM_MAGIC);
+
     pm_writelittleshort( stdout, cols );
     pm_writelittleshort( stdout, rows );
     pm_writelittleshort( stdout, cols32 );
     putchar(depth & 0xFF);
 
     for ( i = 0; i < 9; ++i )
-	putchar( 0 );	/* pad bytes */
+        putchar( 0 );   /* pad bytes */
 
     item = 0;
     bitsperitem = 0;
@@ -97,46 +77,75 @@ putinit( cols, rows, depth )
     bitshift = 0;
     }
 
-static int
-depth_to_word_size (depth)	/* Lispm architecture specific - if a bitmap is written    */
-  int depth;			/* out with a depth of 5, it really has a depth of 8, and  */
-{				/* is stored that way in the file.			   */
-    if (depth==0 || depth==1)	return ( 1);
-    else if (depth ==  2)	return ( 2);
-    else if (depth <=  4)	return ( 4);
-    else if (depth <=  8)	return ( 8);
-    else if (depth <= 16)	return (16);
-    else if (depth <= 32)	return (32);
-    else {
-      pm_error( "depth was %d, which is not in the range 1-32", depth );
-      return(-1);  /* Should never reach here */
-  }
-}
-
+static void
+putitem( )
+    {
+    pm_writelittlelong( stdout, ~item );
+    item = 0;
+    bitsperitem = 0;
+    bitshift = 0;
+    }
 
 
 static void
-putval( gray b )
+putval( gray const b )
     {
     if ( bitsperitem == 32 )
-	putitem( );
+        putitem( );
     item = item | ( b << bitshift );
     bitsperitem = bitsperitem + maxbitsperitem;
     bitshift = bitshift + maxbitsperitem;
     }
 
+
+
 static void
 putrest( )
     {
     if ( bitsperitem > 0 )
-	putitem( );
+        putitem( );
     }
 
-static void
-putitem( )
+
+int
+main( int argc, char * argv[] )
     {
-    pm_writelittlelong( stdout, ~item );
-    item = 0;
-    bitsperitem = 0;
-    bitshift = 0;
+    FILE* ifp;
+    gray *grayrow;
+    register gray* gP;
+    int rows, cols, depth, format, padright, row, col;
+    gray maxval;
+
+
+    pgm_init( &argc, argv );
+
+    if ( argc > 2 )
+        pm_usage( "[pgmfile]" );
+    if ( argc == 2 )
+        ifp = pm_openr( argv[1] );
+    else
+        ifp = stdin;
+
+    pgm_readpgminit( ifp, &cols, &rows, &maxval, &format );
+    grayrow = pgm_allocrow( cols );
+    depth = pm_maxvaltobits( maxval );
+
+    /* Compute padding to round cols up to the nearest multiple of 32. */
+    padright = ( ( cols + 31 ) / 32 ) * 32 - cols;
+
+    putinit( cols, rows, depth );
+    for ( row = 0; row < rows; ++row )
+        {
+        pgm_readpgmrow( ifp, grayrow, cols, maxval, format );
+        for ( col = 0, gP = grayrow; col < cols; ++col, ++gP )
+            putval( *gP );
+        for ( col = 0; col < padright; ++col )
+            putval( 0 );
+        }
+
+    pm_close( ifp );
+
+    putrest( );
+
+    exit( 0 );
     }
diff --git a/converter/ppm/ppmtoilbm.c b/converter/ppm/ppmtoilbm.c
index 4a1b5cb7..5de167dc 100644
--- a/converter/ppm/ppmtoilbm.c
+++ b/converter/ppm/ppmtoilbm.c
@@ -37,6 +37,10 @@
 **  - added HAM colormap "rgb4" and "rgb5" (compute with 4/5-bit table)
 **  - added IFF text chunks
 **
+**  Feb 2010: afu
+**  Added dimension check to prevent short int from overflowing.
+**  
+**
 **  TODO:
 **  - multipalette capability (PCHG chunk) for std and HAM
 **
@@ -100,6 +104,8 @@
 #define DEF_DCOLPLANES  5
 #define DEF_IFMODE      MODE_DEEP
 
+#define INT16MAX 32767
+
 static void put_big_short ARGS((short s));
 static void put_big_long ARGS((long l));
 #define put_byte(b)     (void)(putc((unsigned char)(b), stdout))
@@ -1801,6 +1807,10 @@ init_read(fp, colsP, rowsP, maxvalP, formatP, readall)
     int readall;
 {
     ppm_readppminit(fp, colsP, rowsP, maxvalP, formatP);
+
+    if( *rowsP >INT16MAX || *colsP >INT16MAX )
+      pm_error ("Input image is too large.");
+
     if( readall ) {
         int row;