From 99a1345ecefc62f1ff2d0ccfe41c90abc657995c Mon Sep 17 00:00:00 2001
From: giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>
Date: Fri, 14 Feb 2020 04:27:50 +0000
Subject: Release 10.86.09

git-svn-id: http://svn.code.sf.net/p/netpbm/code/stable@3737 9d0c8265-081b-0410-96cb-a4ca84ce46f8
---
 doc/HISTORY      | 12 +++++++++++-
 editor/pamdice.c | 18 +++++++++++-------
 lib/pmfileio.c   | 24 ++++++++++++++++++++++--
 version.mk       |  2 +-
 4 files changed, 45 insertions(+), 11 deletions(-)

diff --git a/doc/HISTORY b/doc/HISTORY
index 186c5289..2b9f83aa 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,7 +4,17 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
-12.12.25 BJH  Release 10.86.08
+20.02.14 BJH  Release 10.86.09
+
+              pamdice: Fix junk output when -width or -height not specified.
+
+              libnetpbm: pm_getline, xvminitoppm, pamtris : Fix bug: crash
+              when reading empty line.
+
+              libnetpbm: pm_read_unknown_size, rawtopgm, zeisstopnm: crash
+              when out of memory
+
+19.12.25 BJH  Release 10.86.08
 
               pamrubber: Fix bug: -frame doesn't work.  Always broken.
               (Pamrubber was new in Netpbm 10.54 (March 2011).
diff --git a/editor/pamdice.c b/editor/pamdice.c
index 2c53a110..f4b05a8d 100644
--- a/editor/pamdice.c
+++ b/editor/pamdice.c
@@ -150,14 +150,15 @@ computeSliceGeometry(struct cmdlineInfo const cmdline,
             *nHorizSliceP = 1 + divup(inpam.height - cmdline.height, 
                                       cmdline.height - cmdline.voverlap);
         *sliceHeightP = cmdline.height;
+
+        *bottomSliceHeightP = 
+            inpam.height - (*nHorizSliceP-1) * (cmdline.height - cmdline.voverlap);
     } else {
         *nHorizSliceP = 1;
         *sliceHeightP = inpam.height;
+        *bottomSliceHeightP = inpam.height;
     }
 
-    *bottomSliceHeightP = 
-        inpam.height - (*nHorizSliceP-1) * (cmdline.height - cmdline.voverlap);
-
     if (cmdline.sliceVertically) {
         if (cmdline.width >= inpam.width)
             *nVertSliceP = 1;
@@ -165,14 +166,14 @@ computeSliceGeometry(struct cmdlineInfo const cmdline,
             *nVertSliceP = 1 + divup(inpam.width - cmdline.width, 
                                      cmdline.width - cmdline.hoverlap);
         *sliceWidthP = cmdline.width;
+        *rightSliceWidthP = 
+            inpam.width - (*nVertSliceP-1) * (cmdline.width - cmdline.hoverlap);
     } else {
         *nVertSliceP = 1;
         *sliceWidthP = inpam.width;
+        *rightSliceWidthP = inpam.width;
     }
 
-    *rightSliceWidthP = 
-        inpam.width - (*nVertSliceP-1) * (cmdline.width - cmdline.hoverlap);
-
     if (verbose) {
         pm_message("Creating %u images, %u across by %u down; "
                    "each %u w x %u h",
@@ -468,7 +469,10 @@ main(int argc, char ** argv) {
 
     for (horizSlice = 0; horizSlice < nHorizSlice; ++horizSlice) {
         unsigned int const thisSliceFirstRow = 
-            horizSlice * (sliceHeight - cmdline.voverlap);
+            horizSlice > 0 ? horizSlice * (sliceHeight - cmdline.voverlap) : 0;
+            /* Note that 'cmdline.voverlap' is not defined when there is only
+               one horizontal slice
+            */
         unsigned int const thisSliceHeight = 
             horizSlice < nHorizSlice-1 ? sliceHeight : bottomSliceHeight;
 
diff --git a/lib/pmfileio.c b/lib/pmfileio.c
index 33f89110..bea01abe 100644
--- a/lib/pmfileio.c
+++ b/lib/pmfileio.c
@@ -815,6 +815,10 @@ pm_read_unknown_size(FILE * const file,
     nalloc = PM_BUF_SIZE;
     MALLOCARRAY(buf, nalloc);
 
+    if (!buf)
+        pm_error("Failed to allocate %lu bytes for read buffer",
+                 (unsigned long) nalloc);
+
     eof = FALSE;  /* initial value */
 
     while(!eof) {
@@ -825,7 +829,10 @@ pm_read_unknown_size(FILE * const file,
                 nalloc += PM_MAX_BUF_INC;
             else
                 nalloc += nalloc;
-            REALLOCARRAY_NOFAIL(buf, nalloc);
+            REALLOCARRAY(buf, nalloc);
+            if (!buf)
+                pm_error("Failed to allocate %lu bytes for read buffer",
+                         (unsigned long) nalloc);
         }
 
         val = getc(file);
@@ -889,14 +896,27 @@ pm_getline(FILE *   const ifP,
                     /* + 2 = 1 for 'c', one for terminating NUL */
                     bufferSz += 128;
                     REALLOCARRAY(buffer, bufferSz);
+                    if (!buffer) {
+                        pm_error("Failed to allocate %lu bytes for buffer "
+                                 "to assemble a line of input",
+                                 (unsigned long) bufferSz);
+                    }
                 }
                 buffer[nReadSoFar++] = c;
             }
         }
     }
 
-    if (gotLine)
+    if (gotLine) {
+        bufferSz = nReadSoFar + 1;
+        REALLOCARRAY(buffer, bufferSz);
+        if (!buffer) {
+            pm_error("Failed to allocate %lu bytes for buffer "
+                     "to assemble a line of input",
+                     (unsigned long) bufferSz);
+        }
         buffer[nReadSoFar] = '\0';
+    }
 
     *eofP      = eof;
     *bufferP   = buffer;
diff --git a/version.mk b/version.mk
index b5c2c0f3..ca222f1d 100644
--- a/version.mk
+++ b/version.mk
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 86
-NETPBM_POINT_RELEASE = 8
+NETPBM_POINT_RELEASE = 9
-- 
cgit 1.4.1