diff options
-rw-r--r-- | converter/other/bmptopnm.c | 44 | ||||
-rw-r--r-- | doc/HISTORY | 9 | ||||
-rw-r--r-- | netpbm.c | 6 | ||||
-rw-r--r-- | version.mk | 2 |
4 files changed, 49 insertions, 12 deletions
diff --git a/converter/other/bmptopnm.c b/converter/other/bmptopnm.c index 05749c27..9e476ef4 100644 --- a/converter/other/bmptopnm.c +++ b/converter/other/bmptopnm.c @@ -632,11 +632,11 @@ bmpReadinfoheader(FILE * const ifP, readWindowsInfoHeader(ifP, cInfoHeaderSize, headerP); break; case 108: - pm_error("%s: this is a Version 4 Windows BMP; " + pm_error("This is a Version 4 Windows BMP; " "this program knows only Version 1"); break; case 124: - pm_error("%s: this is a Version 5 Windows BMP; " + pm_error("This is a Version 5 Windows BMP; " "this program knows only Version 1"); break; default: @@ -835,6 +835,15 @@ convertRow32(unsigned char const bmprow[], } +static void +validateIndex(unsigned int const index, + unsigned int const cmapsize ) { + + if (index >= cmapsize) + pm_error("Error: invalid index to color palette."); +} + + static void convertRow(unsigned char const bmprow[], @@ -842,7 +851,8 @@ convertRow(unsigned char const bmprow[], int const cols, unsigned int const cBitCount, struct pixelformat const pixelformat, - xel const colormap[] + xel const colormap[], + unsigned int const cmapsize ) { /*---------------------------------------------------------------------------- Convert a row in raw BMP raster format bmprow[] to a row of xels xelrow[]. @@ -862,9 +872,12 @@ convertRow(unsigned char const bmprow[], convertRow32(bmprow, xelrow, cols, pixelformat); else if (cBitCount == 8) { /* It's a whole byte colormap index */ - unsigned int col; - for (col = 0; col < cols; ++col) - xelrow[col] = colormap[bmprow[col]]; + unsigned int col; + for (col = 0; col < cols; ++col) { + unsigned int const index = bmprow[col]; + validateIndex(index, cmapsize); + xelrow[col] = colormap[index]; + } } else if (cBitCount == 1 || cBitCount == 2 || cBitCount == 4) { /* It's a bit field color index */ unsigned char const mask = ( 1 << cBitCount ) - 1; @@ -876,6 +889,7 @@ convertRow(unsigned char const bmprow[], unsigned int const shift = 8 - ((col*cBitCount) % 8) - cBitCount; unsigned int const index = (bmprow[cursor] & (mask << shift)) >> shift; + validateIndex(index, cmapsize); xelrow[col] = colormap[index]; } } else { @@ -1338,6 +1352,7 @@ readBmp(FILE * const ifP, unsigned int * const cBitCountP, struct pixelformat * const pixelformatP, xel ** const colormapP, + unsigned int * const cmapsizeP, bool const verbose) { xel * colormap; /* malloc'ed */ @@ -1394,6 +1409,7 @@ readBmp(FILE * const ifP, *rowsP = bmpHeader.rows; *pixelformatP = bmpHeader.pixelformat; *colormapP = colormap; + *cmapsizeP = bmpHeader.cmapsize; } @@ -1405,7 +1421,8 @@ writeRasterGen(unsigned char ** const bmpRaster, int const format, unsigned int const cBitCount, struct pixelformat const pixelformat, - xel const colormap[]) { + xel const colormap[], + unsigned int const cmapsize) { /*---------------------------------------------------------------------------- Write the PNM raster to Standard Output, corresponding to the raw BMP raster bmpRaster. Write the raster assuming the PNM image has @@ -1426,7 +1443,7 @@ writeRasterGen(unsigned char ** const bmpRaster, for (row = 0; row < rows; ++row) { convertRow(bmpRaster[row], xelrow, cols, cBitCount, pixelformat, - colormap); + colormap, cmapsize); pnm_writepnmrow(stdout, xelrow, cols, bmpMaxval, format, FALSE); } pnm_freerow(xelrow); @@ -1508,6 +1525,13 @@ main(int argc, const char ** argv) { /* Malloc'ed colormap (palette) from the BMP. Contents of map undefined if not a colormapped BMP. */ + unsigned int cmapsize; + /* Number of colormap entries. Described in the BMP header. + Note that a file may be 8 bits per pixel but have less than + 256 colors. In the 1 bit per pixel case, there should be + 2 entries according to the official specification, but we + allow files with just 1. + */ pm_proginit(&argc, argv); @@ -1520,7 +1544,7 @@ main(int argc, const char ** argv) { ifname = cmdline.inputFileName; readBmp(ifP, &bmpRaster, &cols, &rows, &grayPresent, &colorPresent, - &cBitCount, &pixelformat, &colormap, + &cBitCount, &pixelformat, &colormap, &cmapsize, cmdline.verbose); pm_close(ifP); @@ -1541,7 +1565,7 @@ main(int argc, const char ** argv) { } else { pnm_writepnminit(stdout, cols, rows, bmpMaxval, outputType, FALSE); writeRasterGen(bmpRaster, cols, rows, outputType, cBitCount, - pixelformat, colormap); + pixelformat, colormap, cmapsize); } free(colormap); free(bmpRaster); diff --git a/doc/HISTORY b/doc/HISTORY index fded5db4..b34e2244 100644 --- a/doc/HISTORY +++ b/doc/HISTORY @@ -4,6 +4,15 @@ Netpbm. CHANGE HISTORY -------------- +18.11.05 BJH Release 10.73.23 + + bmptopnm: Fix array bounds violation when index value in raster + is too big. Broken after Netpbm 10.10 (October 2002) but before + 10.19 (November 2003). + + Merge build: fix so legacy program names 'pnmtopnm', 'ppmnorm', + and 'ppmtotga' work again. + 18.11.02 BJH Release 10.73.22 picttoppm: accept rectangle specifications in input that have diff --git a/netpbm.c b/netpbm.c index f647ad15..eeb82acc 100644 --- a/netpbm.c +++ b/netpbm.c @@ -80,16 +80,20 @@ main(int argc, char *argv[]) { TRY("ppmnorm", main_pnmnorm); TRY("ppmtotga", main_pamtotga); TRY("ppmtouil", main_pamtouil); + TRY("pnmtopnm", main_pamtopnm); + TRY("ppmnorm", main_pnmnorm); + TRY("ppmtotga", main_pamtotga); /* We don't do the ppmtojpeg alias because if user doesn't have a JPEG library, there is no main_pnmtojpeg library. The right way to do this is to have these TRY's generated by the subdirectory makes, which would know whether pnmtojpeg was built into the merged binary - or not. But that's too much work. Same with TIFF converters. + or not. But that's too much work. Same with TIFF and PNG converters. TRY("ppmtojpeg", main_pnmtojpeg); TRY("pngtopnm", main_pngtopam); TRY("pnmtotiff", main_pamtotiff); + TRY("pamrgbatopng", main_pamtopng); */ fprintf(stderr,"'%s' is an unknown Netpbm program name \n", cp ); diff --git a/version.mk b/version.mk index 5727e98d..528b929a 100644 --- a/version.mk +++ b/version.mk @@ -1,3 +1,3 @@ NETPBM_MAJOR_RELEASE = 10 NETPBM_MINOR_RELEASE = 73 -NETPBM_POINT_RELEASE = 22 +NETPBM_POINT_RELEASE = 23 |