Release 10.47.61

git-svn-id: http://svn.code.sf.net/p/netpbm/code/super_stable@2774 9d0c8265-081b-0410-96cb-a4ca84ce46f8

2 files changed, 6 insertions, 3 deletions

diff --git a/editor/pbmreduce.c b/editor/pbmreduce.c
index f49c8d9a..ee4a4fbd 100644
--- a/editor/pbmreduce.c
+++ b/editor/pbmreduce.c
@@ -10,6 +10,7 @@
 ** implied warranty.
 */
 
+#include <limits.h>
 #include "pbm.h"
 #include "mallocvar.h"
 
@@ -70,6 +71,8 @@ main( argc, argv )
 	pm_usage( usage );
     if ( n < 2 )
 	pm_error( "N must be greater than 1" );
+    if (n > INT_MAX / n)
+        pm_error("Scale argument too large.  You specified %d", n);
     ++argn;
 
     if ( argn == argc )
diff --git a/editor/pnmpaste.c b/editor/pnmpaste.c
index 33834669..123b0feb 100644
--- a/editor/pnmpaste.c
+++ b/editor/pnmpaste.c
@@ -191,8 +191,8 @@ insertShift(FILE *          const ifP,
    Same as insertDirect(), but start merging 'offset' bits from the left
    end of 'destrow'.  'offset' is less than 8.
 
-   buffer[] is wide enough to hold a packed PBM row of *ifP plus one
-   byte of margin.
+   buffer[] is wide enough to hold a packed PBM row of *ifP plus two
+   bytes of margin.
 -----------------------------------------------------------------------------*/
     unsigned int const shiftBytes = pbm_packed_bytes(cols + offset);
     unsigned int const last = shiftBytes - 1;
@@ -258,7 +258,7 @@ pastePbm(FILE *       const fpInset,
   Fast paste for PBM
 -----------------------------------------------------------------------------*/
     unsigned char * const baserow = pbm_allocrow_packed(baseCols);
-    unsigned char * const buffer = pbm_allocrow_packed(insetCols+8);
+    unsigned char * const buffer = pbm_allocrow_packed(insetCols+16);
     int const shiftBytes = insertCol / 8;
     unsigned int const shiftOffset = insertCol % 8;
     int const baseColBytes = pbm_packed_bytes(baseCols);