diff options
| author | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2016-04-24 01:51:34 +0000 |
|---|---|---|
| committer | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2016-04-24 01:51:34 +0000 |
| commit | 2ec45a90b13b406f4028963b7985f3070550e7cf (patch) | |
| tree | ce883d9b5556b5cf216959a33d667b9c4b3cfab3 /editor/pnmpaste.c | |
| parent | a8687fd4bd5b2ea6b541b5464bc7a340766e84f8 (diff) | |
| download | netpbm-mirror-2ec45a90b13b406f4028963b7985f3070550e7cf.tar.gz netpbm-mirror-2ec45a90b13b406f4028963b7985f3070550e7cf.tar.xz netpbm-mirror-2ec45a90b13b406f4028963b7985f3070550e7cf.zip | |
Fix buffer overrun
git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@2716 9d0c8265-081b-0410-96cb-a4ca84ce46f8
Diffstat (limited to 'editor/pnmpaste.c')
| -rw-r--r-- | editor/pnmpaste.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/editor/pnmpaste.c b/editor/pnmpaste.c index 1e29d933..c27e288c 100644 --- a/editor/pnmpaste.c +++ b/editor/pnmpaste.c @@ -201,8 +201,8 @@ insertShift(FILE * const ifP, Same as insertDirect(), but start merging 'offset' bits from the left end of 'destrow'. 'offset' is less than 8. - buffer[] is wide enough to hold a packed PBM row of *ifP plus one - byte of margin. + buffer[] is wide enough to hold a packed PBM row of *ifP plus two + bytes of margin. -----------------------------------------------------------------------------*/ unsigned int const shiftByteCt = pbm_packed_bytes(cols + offset); unsigned int const last = shiftByteCt - 1; @@ -268,7 +268,7 @@ pastePbm(FILE * const fpInset, Fast paste for PBM -----------------------------------------------------------------------------*/ unsigned char * const baserow = pbm_allocrow_packed(baseCols); - unsigned char * const buffer = pbm_allocrow_packed(insetCols+8); + unsigned char * const buffer = pbm_allocrow_packed(insetCols+16); unsigned int const shiftByteCt = insertCol / 8; unsigned int const shiftOffset = insertCol % 8; unsigned int const baseColByteCt = pbm_packed_bytes(baseCols); |