From 99d760c5aa3dac7cbde58d10c7b0a9213602d7ad Mon Sep 17 00:00:00 2001
From: giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>
Date: Thu, 26 Mar 2020 02:06:57 +0000
Subject: Release 10.86.11

git-svn-id: http://svn.code.sf.net/p/netpbm/code/stable@3775 9d0c8265-081b-0410-96cb-a4ca84ce46f8
---
 converter/other/pbmtopgm.c |  8 +++++++-
 doc/HISTORY                | 13 +++++++++++++
 editor/pnmshear.c          |  8 +++++++-
 version.mk                 |  2 +-
 4 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/converter/other/pbmtopgm.c b/converter/other/pbmtopgm.c
index 69b20fb2..c35e1cbe 100644
--- a/converter/other/pbmtopgm.c
+++ b/converter/other/pbmtopgm.c
@@ -3,6 +3,7 @@
  */
 
 #include <stdio.h>
+#include <limits.h>
 
 #include "pm_c_util.h"
 #include "pgm.h"
@@ -29,8 +30,13 @@ main(int argc, char *argv[]) {
     height = atoi(argv[2]);
     if (width < 1 || height < 1)
         pm_error("width and height must be > 0");
+    if (width > INT_MAX / height)
+        /* prevent overflow of "value" below */
+        pm_error("sample area (%u columns %u rows) too large",
+                 width, height);
+
     left=width/2; right=width-left;
-    up=width/2; down=height-up;
+    up=height/2; down=height-up;
 
     if (argc == 4)
         ifd = pm_openr(argv[3]);
diff --git a/doc/HISTORY b/doc/HISTORY
index 8955dccd..01288125 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,19 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+20.03.26 BJH  Release 10.86.11
+
+              pbmtopgm: Fix incorrect output when convolution area is not
+              square.  Always broken.  pbmtopgm was in primordial Netpbm,
+              ca 1991.
+
+              pbmtopgm: Fix crash when convolution matrix too large for word
+              size.  Always broken.  pbmtopgm was in primordial Netpbm, ca
+              1991.
+
+              pnmshear: Fix arithmetic overflow with shear angle near +/- 90
+              degrees.
+
 20.03.15 BJH  Release 10.86.10
 
               pamdice: Fix crash when -width or -height is zero.
diff --git a/editor/pnmshear.c b/editor/pnmshear.c
index 1c330bb7..c705c261 100644
--- a/editor/pnmshear.c
+++ b/editor/pnmshear.c
@@ -217,6 +217,7 @@ main(int argc, const char * argv[]) {
     int row;
     xelval maxval, newmaxval;
     double shearfac;
+    double newcolsD;
 
     struct CmdlineInfo cmdline;
 
@@ -242,7 +243,12 @@ main(int argc, const char * argv[]) {
 
     shearfac = fabs(tan(cmdline.angle));
 
-    newcols = rows * shearfac + cols + 0.999999;
+    newcolsD = (double) rows * shearfac + cols + 0.999999;
+    if (newcolsD > INT_MAX-2)
+        pm_error("angle is too close to +/-90 degrees; "
+                 "output image too wide for computation");
+    else
+        newcols = (int) newcolsD;
 
     pnm_writepnminit(stdout, newcols, rows, newmaxval, newformat, 0);
     newxelrow = pnm_allocrow(newcols);
diff --git a/version.mk b/version.mk
index 4e02899e..272904e5 100644
--- a/version.mk
+++ b/version.mk
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 86
-NETPBM_POINT_RELEASE = 10
+NETPBM_POINT_RELEASE = 11
-- 
cgit 1.4.1