diff options
-rw-r--r-- | converter/other/pnmtosgi.c | 47 | ||||
-rw-r--r-- | converter/pbm/pbmtogem.c | 252 | ||||
-rw-r--r-- | converter/pbm/pbmtoybm.c | 121 | ||||
-rw-r--r-- | converter/pgm/pgmtolispm.c | 171 | ||||
-rw-r--r-- | converter/ppm/ppmtoilbm.c | 10 | ||||
-rw-r--r-- | doc/HISTORY | 4 |
6 files changed, 316 insertions, 289 deletions
diff --git a/converter/other/pnmtosgi.c b/converter/other/pnmtosgi.c index 472b5197..169125b3 100644 --- a/converter/other/pnmtosgi.c +++ b/converter/other/pnmtosgi.c @@ -13,11 +13,16 @@ ** implied warranty. ** ** 29Jan94: first version + +** Feb 2010 afu +** Added dimension check to prevent short int from overflowing */ #include "pnm.h" #include "sgi.h" #include "mallocvar.h" + + /*#define DEBUG*/ typedef short ScanElem; @@ -42,6 +47,7 @@ static int rle_compress ARGS((ScanElem *inbuf, int cols)); #define MAXVAL_BYTE 255 #define MAXVAL_WORD 65535 +#define INT16MAX 32767 static char storage = STORAGE_RLE; static ScanLine * channel[3]; @@ -87,9 +93,7 @@ write_header(int const cols, int -main(argc, argv) - int argc; - char *argv[]; +main(int argc,char * argv[]) { FILE *ifp; int argn; @@ -131,6 +135,9 @@ main(argc, argv) pm_usage(usage); pnm_readpnminit(ifp, &cols, &rows, &maxval, &format); + if( rows>INT16MAX || cols>INT16MAX ) + pm_error ("Input image is too large."); + pnmrow = pnm_allocrow(cols); switch( PNM_FORMAT_TYPE(format) ) { @@ -172,9 +179,7 @@ main(argc, argv) static void -write_table(table, tabsize) - long *table; - int tabsize; +write_table(long * table, int const tabsize) { int i; long offset; @@ -194,9 +199,8 @@ write_table(table, tabsize) static void -write_channels(cols, rows, channels, put) - int cols, rows, channels; - void (*put) ARGS((short)); +write_channels(int const cols,int const rows, int const channels, + void (*put) (short)) { int i, row, col; @@ -214,7 +218,7 @@ write_channels(cols, rows, channels, put) } static void -put_big_short(short s) +put_big_short(short const s) { if ( pm_writebigshort( stdout, s ) == -1 ) pm_error( "write error" ); @@ -222,8 +226,7 @@ put_big_short(short s) static void -put_big_long(l) - long l; +put_big_long(long const l) { if ( pm_writebiglong( stdout, l ) == -1 ) pm_error( "write error" ); @@ -231,15 +234,16 @@ put_big_long(l) static void -put_short_as_byte(short s) +put_short_as_byte(short const s) { put_byte((unsigned char)s); } static long * -build_channels(FILE *ifp, int cols, int rows, xelval maxval, - int format, int bpc, int channels) +build_channels(FILE * const ifp, int const cols, int const rows, + xelval const maxval, int const format, + int const bpc, int const channels) { int i, row, col, sgirow; long *table = NULL; @@ -286,11 +290,10 @@ build_channels(FILE *ifp, int cols, int rows, xelval maxval, static ScanElem * -compress(temp, row, rows, cols, chan_no, table, bpc) - ScanElem *temp; - int row, rows, cols, chan_no; - long *table; - int bpc; +compress(ScanElem * temp, + int const row, int const rows, + int const cols, int const chan_no, + long * table, int const bpc) { int len, i, tabrow; ScanElem *p; @@ -323,9 +326,7 @@ slightly modified RLE algorithm from ppmtoilbm.c written by Robert A. Knop (rknop@mop.caltech.edu) */ static int -rle_compress(inbuf, size) - ScanElem *inbuf; - int size; +rle_compress(ScanElem * const inbuf, int const size) { int in, out, hold, count; ScanElem *outbuf = rletemp; diff --git a/converter/pbm/pbmtogem.c b/converter/pbm/pbmtogem.c index cefbdc95..9eab0416 100644 --- a/converter/pbm/pbmtogem.c +++ b/converter/pbm/pbmtogem.c @@ -27,17 +27,21 @@ * removed rounding of the imagewidth to the next word boundary * removed arbitrary limit to imagewidth * changed pattern length to 1 to simplify locating of compressable parts -* in real world images +* in real world images * add solid run and pattern run compression * * Deficiencies: * Compression of repeated scanlines not added * -* Johann Haider (jh@fortec.tuwien.ac.at) +* Johann Haider (jh@fortec.tuwien.ac.at) * * 94/01/31 Andreas Schwab (schwab@ls5.informatik.uni-dortmund.de) * Changed to remove architecture dependencies * Added compression of repeated scanlines +* +* Feb 2010 afu +* Added dimension check to prevent short int from overflowing +* Changed code style (ANSI-style function definitions, etc.) */ #include <stdio.h> @@ -47,59 +51,11 @@ #define SOLID_0 0 #define SOLID_1 0xff #define MINRUN 4 +#define INT16MAX 32767 + #define putsolid(v,c) putc((v&0x80)|c, stdout) #define putpattern(v,c) putc(0, stdout);putc(c, stdout);putc(v, stdout) -static void putinit ARGS ((int rows, int cols)); -static void putbit ARGS(( bit b )); -static void putitem ARGS(( void )); -static void putrow ARGS(( void )); -static void flushrow ARGS ((void)); -static void putstring ARGS((register unsigned char *p, register int n)); - -int -main( argc, argv ) - int argc; - char* argv[]; - { - FILE* ifp; - bit* bitrow; - register bit* bP; - int rows, cols, format, row, col; - - pbm_init( &argc, argv ); - - if ( argc > 2 ) - pm_usage( "[pbmfile]" ); - - if ( argc == 2 ) - ifp = pm_openr( argv[1] ); - else - ifp = stdin; - - pbm_readpbminit( ifp, &cols, &rows, &format ); - - bitrow = pbm_allocrow( cols ); - - putinit (rows, cols); - for ( row = 0; row < rows; ++row ) - { -#ifdef DEBUG - fprintf (stderr, "row %d\n", row); -#endif - pbm_readpbmrow( ifp, bitrow, cols, format ); - for ( col = 0, bP = bitrow; col < cols; ++col, ++bP ) - putbit( *bP ); - putrow( ); - } - flushrow (); - - pm_close( ifp ); - - - exit( 0 ); - } - static short item; static int outcol, outmax; static short bitsperitem, bitshift; @@ -107,9 +63,9 @@ static short linerepeat; static unsigned char *outrow, *lastrow; static void -putinit (rows, cols) - int rows, cols; +putinit (int const rows, int const cols) { + if (pm_writebigshort (stdout, (short) 1) == -1 /* Image file version */ || pm_writebigshort (stdout, (short) 8) == -1 /* Header length */ || pm_writebigshort (stdout, (short) 1) == -1 /* Number of planes */ @@ -130,17 +86,6 @@ putinit (rows, cols) } static void -putbit( bit b ) - { - if ( bitsperitem == 8 ) - putitem( ); - ++bitsperitem; - if ( b == PBM_BLACK ) - item += 1 << bitshift; - --bitshift; - } - -static void putitem( ) { outrow[outcol++] = item; @@ -149,19 +94,93 @@ putitem( ) bitshift = 7; } + +static void +putbit( bit const b ) + { + if ( bitsperitem == 8 ) + putitem( ); + ++bitsperitem; + if ( b == PBM_BLACK ) + item += 1 << bitshift; + --bitshift; + } + + static void -putstring (p, n) -register unsigned char *p; -register int n; +putstring ( unsigned char *p, int n) { #ifdef DEBUG fprintf (stderr, "Bitstring, length: %d, pos %d\n", n, outcol); #endif (void) putc((char) 0x80, stdout); /* a Bit string */ - (void) putc(n, stdout); /* count */ + (void) putc(n, stdout); /* count */ fwrite( p, n, 1, stdout ); } + +static void +flushrow( ) + { + unsigned char *outp, *p, *q; + int count; + int col = outmax; + + if (linerepeat > 1) + { + /* Put out line repeat count */ + fwrite ("\0\0\377", 3, 1, stdout); + putchar (linerepeat); + } + for (outp = p = lastrow; col > 0;) + { + for (q = p, count=0; (count < col) && (*q == *p); q++,count++); + if (count > MINRUN) + { + if (p > outp) + { + putstring (outp, p-outp); + outp = p; + } + col -= count; + switch (*p) + { + case SOLID_0: +#ifdef DEBUG +/* if (outcol > 0) */ + fprintf (stderr, "Solid run 0, length: %d\n", count); +#endif + putsolid (SOLID_0, count); + break; + + case SOLID_1: +#ifdef DEBUG + fprintf (stderr, "Solid run 1, length: %d, pos %d\n", count, outcol); +#endif + putsolid (SOLID_1, count); + break; + default: +#ifdef DEBUG + fprintf (stderr, "Pattern run, length: %d\n", count); +#endif + putpattern (*p, count); + break; + } + outp = p = q; + } + else + { + p++; + col--; + } + } + if (p > outp) + putstring (outp, p-outp); + if (ferror (stdout)) + pm_error ("write error"); +} + + static void putrow( ) { @@ -173,7 +192,7 @@ putrow( ) { unsigned char *temp; if (linerepeat != -1) /* Unless first line */ - flushrow (); + flushrow (); /* Swap the pointers */ temp = outrow; outrow = lastrow; lastrow = temp; linerepeat = 1; @@ -183,64 +202,47 @@ putrow( ) linerepeat++; } -static void -flushrow( ) - { - register unsigned char *outp, *p, *q; - register int count; - int col = outmax; - if (linerepeat > 1) - { - /* Put out line repeat count */ - fwrite ("\0\0\377", 3, 1, stdout); - putchar (linerepeat); - } - for (outp = p = lastrow; col > 0;) +int +main( int argc, char* argv[]) { - for (q = p, count=0; (count < col) && (*q == *p); q++,count++); - if (count > MINRUN) - { - if (p > outp) - { - putstring (outp, p-outp); - outp = p; - } - col -= count; - switch (*p) - { - case SOLID_0: -#ifdef DEBUG -/* if (outcol > 0) */ - fprintf (stderr, "Solid run 0, length: %d\n", count); -#endif - putsolid (SOLID_0, count); - break; + FILE* ifp; + bit* bitrow; + int rows, cols, format, row, col; - case SOLID_1: -#ifdef DEBUG - fprintf (stderr, "Solid run 1, length: %d, pos %d\n", count, outcol); -#endif - putsolid (SOLID_1, count); - break; - default: + pbm_init( &argc, argv ); + + if ( argc > 2 ) + pm_usage( "[pbmfile]" ); + + if ( argc == 2 ) + ifp = pm_openr( argv[1] ); + else + ifp = stdin; + + pbm_readpbminit( ifp, &cols, &rows, &format ); + + if( rows>INT16MAX || cols>INT16MAX ) + pm_error ("Input image is too large."); + + + bitrow = pbm_allocrow( cols ); + + putinit (rows, cols); + for ( row = 0; row < rows; ++row ) + { #ifdef DEBUG - fprintf (stderr, "Pattern run, length: %d\n", count); + fprintf (stderr, "row %d\n", row); #endif - putpattern (*p, count); - break; - } - outp = p = q; - } - else - { - p++; - col--; - } - } - if (p > outp) - putstring (outp, p-outp); - if (ferror (stdout)) - pm_error ("write error"); -} + pbm_readpbmrow( ifp, bitrow, cols, format ); + for ( col = 0; col < cols; ++col ) + putbit( bitrow[col] ); + putrow( ); + } + flushrow (); + + pm_close( ifp ); + + exit( 0 ); + } diff --git a/converter/pbm/pbmtoybm.c b/converter/pbm/pbmtoybm.c index 508e8e92..88172788 100644 --- a/converter/pbm/pbmtoybm.c +++ b/converter/pbm/pbmtoybm.c @@ -9,68 +9,33 @@ ** copyright notice and this permission notice appear in supporting ** documentation. This software is provided "as is" without express or ** implied warranty. +** +** Feb 2010 afu +** Added dimension check to prevent short int from overflowing +** Changed code style (ANSI-style function definitions, etc.) */ #include <stdio.h> #include "pbm.h" #define YBM_MAGIC ( ( '!' << 8 ) | '!' ) +#define INT16MAX 32767 -static void putinit ARGS(( int cols, int rows )); -static void putbit ARGS(( bit b )); -static void putrest ARGS(( void )); -static void putitem ARGS(( void )); - -int -main( argc, argv ) - int argc; - char* argv[]; - { - FILE* ifp; - bit* bitrow; - register bit* bP; - int rows, cols, format, padright, row, col; - - - pbm_init( &argc, argv ); - - if ( argc > 2 ) - pm_usage( "[pbmfile]" ); - if ( argc == 2 ) - ifp = pm_openr( argv[1] ); - else - ifp = stdin; - - pbm_readpbminit( ifp, &cols, &rows, &format ); - bitrow = pbm_allocrow( cols ); - - /* Compute padding to round cols up to the nearest multiple of 16. */ - padright = ( ( cols + 15 ) / 16 ) * 16 - cols; - - putinit( cols, rows ); - for ( row = 0; row < rows; ++row ) - { - pbm_readpbmrow( ifp, bitrow, cols, format ); - for ( col = 0, bP = bitrow; col < cols; ++col, ++bP ) - putbit( *bP ); - for ( col = 0; col < padright; ++col ) - putbit( 0 ); - } - - if ( ifp != stdin ) - fclose( ifp ); +static long item; +static int bitsperitem, bitshift; - putrest( ); - exit( 0 ); +static void +putitem( ) + { + pm_writebigshort( stdout, item ); + item = 0; + bitsperitem = 0; + bitshift = 0; } -static long item; -static int bitsperitem, bitshift; - static void -putinit( cols, rows ) - int cols, rows; +putinit(int const cols, int const rows ) { pm_writebigshort( stdout, YBM_MAGIC ); pm_writebigshort( stdout, cols ); @@ -81,13 +46,13 @@ putinit( cols, rows ) } static void -putbit( bit b ) +putbit( bit const b ) { if ( bitsperitem == 16 ) - putitem( ); + putitem( ); ++bitsperitem; if ( b == PBM_BLACK ) - item += 1 << bitshift; + item += 1 << bitshift; ++bitshift; } @@ -95,14 +60,50 @@ static void putrest( ) { if ( bitsperitem > 0 ) - putitem( ); + putitem( ); } -static void -putitem( ) + +int +main( int argc, char *argv[] ) { - pm_writebigshort( stdout, item ); - item = 0; - bitsperitem = 0; - bitshift = 0; + FILE* ifp; + bit* bitrow; + int rows, cols, format, padright, row, col; + + pbm_init( &argc, argv ); + + if ( argc > 2 ) + pm_usage( "[pbmfile]" ); + if ( argc == 2 ) + ifp = pm_openr( argv[1] ); + else + ifp = stdin; + + pbm_readpbminit( ifp, &cols, &rows, &format ); + + if( rows>INT16MAX || cols>INT16MAX ) + pm_error ("Input image is too large."); + + bitrow = pbm_allocrow( cols ); + + /* Compute padding to round cols up to the nearest multiple of 16. */ + padright = ( ( cols + 15 ) / 16 ) * 16 - cols; + + putinit( cols, rows ); + for ( row = 0; row < rows; ++row ) + { + pbm_readpbmrow( ifp, bitrow, cols, format ); + for ( col = 0; col < cols; ++col ) + putbit( bitrow[col] ); + for ( col = 0; col < padright; ++col ) + putbit( 0 ); + } + + if ( ifp != stdin ) + fclose( ifp ); + + putrest( ); + + exit( 0 ); } diff --git a/converter/pgm/pgmtolispm.c b/converter/pgm/pgmtolispm.c index abb85494..4da9ae88 100644 --- a/converter/pgm/pgmtolispm.c +++ b/converter/pgm/pgmtolispm.c @@ -14,82 +14,62 @@ ** usually a color image; but a color map is not written in the file, so we ** treat this as a graymap instead. To convert a color image to Lispm ** format, you must convert it to a pgm, and hand-edit a color map... Ick. +** +** Feb 2010 afu +** Added dimension check to prevent short int from overflowing +** Changed code style (ANSI-style function definitions, etc.) */ #include <stdio.h> #include "pgm.h" #define LISPM_MAGIC "This is a BitMap file" +#define INT16MAX 32767 -static void putinit ARGS(( int cols, int rows, int depth )); -static int depth_to_word_size ARGS(( int depth )); -static void putval ARGS(( gray b )); -static void putrest ARGS(( void )); -static void putitem ARGS(( void )); - -int -main( argc, argv ) - int argc; - char* argv[]; - { - FILE* ifp; - gray *grayrow; - register gray* gP; - int rows, cols, depth, format, padright, row, col; - gray maxval; - - - pgm_init( &argc, argv ); - - if ( argc > 2 ) - pm_usage( "[pgmfile]" ); - if ( argc == 2 ) - ifp = pm_openr( argv[1] ); - else - ifp = stdin; - - pgm_readpgminit( ifp, &cols, &rows, &maxval, &format ); - grayrow = pgm_allocrow( cols ); - depth = pm_maxvaltobits( maxval ); - - /* Compute padding to round cols up to the nearest multiple of 32. */ - padright = ( ( cols + 31 ) / 32 ) * 32 - cols; - - putinit( cols, rows, depth ); - for ( row = 0; row < rows; ++row ) - { - pgm_readpgmrow( ifp, grayrow, cols, maxval, format ); - for ( col = 0, gP = grayrow; col < cols; ++col, ++gP ) - putval( *gP ); - for ( col = 0; col < padright; ++col ) - putval( 0 ); - } - - pm_close( ifp ); - - putrest( ); - - exit( 0 ); - } static unsigned int item; static unsigned int bitsperitem, maxbitsperitem, bitshift; +static int +depth_to_word_size (int const depth) { +/* Lispm architecture specific - if a bitmap is written */ +/* out with a depth of 5, it really has a depth of 8, and */ +/* is stored that way in the file. */ + + if (depth==0 || depth==1) return ( 1); + else if (depth == 2) return ( 2); + else if (depth <= 4) return ( 4); + else if (depth <= 8) return ( 8); + else if (depth <= 16) return (16); + else if (depth <= 32) return (32); + else { + pm_error( "depth was %d, which is not in the range 1-32", depth ); + return(-1); /* Should never reach here */ + } +} + + static void -putinit( cols, rows, depth ) - int cols, rows, depth; +putinit( int const cols, int const rows, int const depth ) { int i; - int cols32 = ( ( cols + 31 ) / 32 ) * 32; /* Lispms are able to write bit files that are not mod32 wide, but we */ - /* don't. This should be ok, since bit arrays which are not mod32 wide */ - printf(LISPM_MAGIC); /* are pretty useless on a lispm (can't hand them to bitblt). */ + int const cols32 = ( ( cols + 31 ) / 32 ) * 32; + /* Lispms are able to write bit files that are not mod32 wide, but we */ + /* don't. This should be ok, since bit arrays which are not mod32 wide */ + /* are pretty useless on a lispm (can't hand them to bitblt). */ + + if( rows>INT16MAX || cols>INT16MAX || cols32>INT16MAX ) + pm_error ("Input image is too large."); + + printf(LISPM_MAGIC); + pm_writelittleshort( stdout, cols ); pm_writelittleshort( stdout, rows ); pm_writelittleshort( stdout, cols32 ); putchar(depth & 0xFF); for ( i = 0; i < 9; ++i ) - putchar( 0 ); /* pad bytes */ + putchar( 0 ); /* pad bytes */ item = 0; bitsperitem = 0; @@ -97,46 +77,75 @@ putinit( cols, rows, depth ) bitshift = 0; } -static int -depth_to_word_size (depth) /* Lispm architecture specific - if a bitmap is written */ - int depth; /* out with a depth of 5, it really has a depth of 8, and */ -{ /* is stored that way in the file. */ - if (depth==0 || depth==1) return ( 1); - else if (depth == 2) return ( 2); - else if (depth <= 4) return ( 4); - else if (depth <= 8) return ( 8); - else if (depth <= 16) return (16); - else if (depth <= 32) return (32); - else { - pm_error( "depth was %d, which is not in the range 1-32", depth ); - return(-1); /* Should never reach here */ - } -} - +static void +putitem( ) + { + pm_writelittlelong( stdout, ~item ); + item = 0; + bitsperitem = 0; + bitshift = 0; + } static void -putval( gray b ) +putval( gray const b ) { if ( bitsperitem == 32 ) - putitem( ); + putitem( ); item = item | ( b << bitshift ); bitsperitem = bitsperitem + maxbitsperitem; bitshift = bitshift + maxbitsperitem; } + + static void putrest( ) { if ( bitsperitem > 0 ) - putitem( ); + putitem( ); } -static void -putitem( ) + +int +main( int argc, char * argv[] ) { - pm_writelittlelong( stdout, ~item ); - item = 0; - bitsperitem = 0; - bitshift = 0; + FILE* ifp; + gray *grayrow; + register gray* gP; + int rows, cols, depth, format, padright, row, col; + gray maxval; + + + pgm_init( &argc, argv ); + + if ( argc > 2 ) + pm_usage( "[pgmfile]" ); + if ( argc == 2 ) + ifp = pm_openr( argv[1] ); + else + ifp = stdin; + + pgm_readpgminit( ifp, &cols, &rows, &maxval, &format ); + grayrow = pgm_allocrow( cols ); + depth = pm_maxvaltobits( maxval ); + + /* Compute padding to round cols up to the nearest multiple of 32. */ + padright = ( ( cols + 31 ) / 32 ) * 32 - cols; + + putinit( cols, rows, depth ); + for ( row = 0; row < rows; ++row ) + { + pgm_readpgmrow( ifp, grayrow, cols, maxval, format ); + for ( col = 0, gP = grayrow; col < cols; ++col, ++gP ) + putval( *gP ); + for ( col = 0; col < padright; ++col ) + putval( 0 ); + } + + pm_close( ifp ); + + putrest( ); + + exit( 0 ); } diff --git a/converter/ppm/ppmtoilbm.c b/converter/ppm/ppmtoilbm.c index 4a1b5cb7..5de167dc 100644 --- a/converter/ppm/ppmtoilbm.c +++ b/converter/ppm/ppmtoilbm.c @@ -37,6 +37,10 @@ ** - added HAM colormap "rgb4" and "rgb5" (compute with 4/5-bit table) ** - added IFF text chunks ** +** Feb 2010: afu +** Added dimension check to prevent short int from overflowing. +** +** ** TODO: ** - multipalette capability (PCHG chunk) for std and HAM ** @@ -100,6 +104,8 @@ #define DEF_DCOLPLANES 5 #define DEF_IFMODE MODE_DEEP +#define INT16MAX 32767 + static void put_big_short ARGS((short s)); static void put_big_long ARGS((long l)); #define put_byte(b) (void)(putc((unsigned char)(b), stdout)) @@ -1801,6 +1807,10 @@ init_read(fp, colsP, rowsP, maxvalP, formatP, readall) int readall; { ppm_readppminit(fp, colsP, rowsP, maxvalP, formatP); + + if( *rowsP >INT16MAX || *colsP >INT16MAX ) + pm_error ("Input image is too large."); + if( readall ) { int row; diff --git a/doc/HISTORY b/doc/HISTORY index 185d5e09..f6f1b2d4 100644 --- a/doc/HISTORY +++ b/doc/HISTORY @@ -27,6 +27,10 @@ not yet BJH Release 10.50.00 pamflip: Speed up for most images. Thanks Prophet of the Way <afu@wta.att.ne.jp>. + pbmtogem, pbmtoybm, pgmtolispm, ppmtoilbm, pnmtosgi: fix + arithmetic overflow with image dimension represented as + 16 bit integer. + pbmpage: fix garbage output. pnmhistmap: Fix crash with -width. Always broken. |