diff options
-rw-r--r-- | converter/other/cameratopam/util.c | 22 | ||||
-rw-r--r-- | doc/HISTORY | 3 |
2 files changed, 21 insertions, 4 deletions
diff --git a/converter/other/cameratopam/util.c b/converter/other/cameratopam/util.c index 8781473a..ede5ef69 100644 --- a/converter/other/cameratopam/util.c +++ b/converter/other/cameratopam/util.c @@ -1,7 +1,9 @@ #define _XOPEN_SOURCE /* Make sure unistd.h contains swab() */ #include <unistd.h> -#include "pm.h" +#include "netpbm/pm.h" +#include "netpbm/mallocvar.h" + #include "global_variables.h" #include "util.h" #include "stdio_nofail.h" @@ -49,9 +51,21 @@ get4(FILE * const ifp) void read_shorts (FILE * const ifp, unsigned short *pixel, int count) { - fread_nofail (pixel, 2, count, ifp); - if ((order == 0x4949) == (BYTE_ORDER == BIG_ENDIAN)) - swab (pixel, pixel, count*2); + unsigned short * buffer; + + MALLOCARRAY(buffer, count); + + if (!buffer) + pm_error("Failed to allocate a buffer for reading %u short " + "integers from file", count); + else { + fread_nofail(buffer, 2, count, ifp); + + if ((order == 0x4949) == (BYTE_ORDER == BIG_ENDIAN)) + swab(buffer, pixel, count*2); + + free(buffer); + } } /* diff --git a/doc/HISTORY b/doc/HISTORY index a162b45f..ed4ea102 100644 --- a/doc/HISTORY +++ b/doc/HISTORY @@ -33,6 +33,9 @@ not yet BJH Release 10.91.00 pnmtorle: Fix incorrect command and filename in header. Broken in Netpbm 10.88 (September 2019). + cameratopam: Fix undefined behavior using 'swab' to swap bytes + in place. + ppmtompeg: Fix buffer overruns with very long names in input parameter files. Always broken. Ppmtompeg was new in Netpbm 8.4 (April 2000). |