From 9eab7ed6ece1d8881bb23eb30af723493e9b6659 Mon Sep 17 00:00:00 2001
From: giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>
Date: Sun, 22 Mar 2020 17:54:49 +0000
Subject: Fix bugs: incorrect height of convolution matrix, arithmetic overflow

git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3770 9d0c8265-081b-0410-96cb-a4ca84ce46f8
---
 converter/other/pbmtopgm.c | 28 ++++++++++++++++++++--------
 doc/HISTORY                | 11 ++++++++++-
 2 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/converter/other/pbmtopgm.c b/converter/other/pbmtopgm.c
index 69b20fb2..6acec7a9 100644
--- a/converter/other/pbmtopgm.c
+++ b/converter/other/pbmtopgm.c
@@ -3,6 +3,7 @@
  */
 
 #include <stdio.h>
+#include <limits.h>
 
 #include "pm_c_util.h"
 #include "pgm.h"
@@ -16,21 +17,23 @@ main(int argc, char *argv[]) {
     int rows, cols;
     FILE *ifd;
     int row;
-    int width, height;
+    unsigned int width, height;
     const char * const usage = "<w> <h> [pbmfile]";
-   
+    const char * error; /* error message of pm_string_to_uint */      
 
     pgm_init( &argc, argv );
 
     if (argc > 4 || argc < 3)
         pm_usage(usage);
 
-    width = atoi(argv[1]);
-    height = atoi(argv[2]);
+    pm_string_to_uint(argv[1], &width, &error);
+    if (error)
+        pm_error("Invalid width argument: ", error);
+    pm_string_to_uint(argv[2], &height, &error);
+    if (error)
+        pm_error("Invalid height argument: ", error);
     if (width < 1 || height < 1)
         pm_error("width and height must be > 0");
-    left=width/2; right=width-left;
-    up=width/2; down=height-up;
 
     if (argc == 4)
         ifd = pm_openr(argv[3]);
@@ -45,6 +48,15 @@ main(int argc, char *argv[]) {
     if (height > rows)
         pm_error("You specified a sample height (%u rows) which is greater "
                  "than the image height (%u rows)", height, rows);
+    if (width > INT_MAX / height)
+        /* prevent overflow of "value" below */
+        pm_error("sample area (%u columns %u rows) too large",
+                 width, height);
+
+    left = width  / 2;  right = width  - left;
+    up   = height / 2;  down  = height - up;
+
+
 
     outrow = pgm_allocrow(cols) ;
     maxval = MIN(PGM_OVERALLMAXVAL, width*height);
@@ -59,7 +71,7 @@ main(int argc, char *argv[]) {
             int const l = (col > left) ? (col-left) : 0;
             int const r = (col+right < cols) ? (col+right) : cols;
             int const onh = width - (l-col+left) - (col+right-r);
-            int value;
+            int value;  /* See above */
             int x;
 
             value = 0;  /* initial value */
@@ -70,7 +82,7 @@ main(int argc, char *argv[]) {
                     if (inbits[y][x] == PBM_WHITE) 
                         ++value;
             }
-            outrow[col] = maxval*value/(onh*onv);
+            outrow[col] = (gray) ((double) maxval*value/(onh*onv));
         }
         pgm_writepgmrow(stdout, outrow, cols, maxval, 0) ;
     }
diff --git a/doc/HISTORY b/doc/HISTORY
index fdd55a42..05a8045f 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -17,8 +17,17 @@ not yet  BJH  Release 10.90.00
               pamcut: Improve error messages for legacy command line
               arguments.
 
+              pbmtopgm: Fix incorrect output when convolution area is not
+              square.  Always broken.  pbmtopgm was in primordial Netpbm,
+              ca 1991.
+
+              pbmtopgm: Fix crash when convolution matrix too large for word
+              size.  Always broken.  pbmtopgm was in primordial Netpbm, ca
+              1991.
+
               pnmshear: Fix arithmetic overflow with shear angle near +/- 90
-              degrees.
+              degrees.  Always broken; pnmshear was in primordial Netpbm,
+              ca. 1989.
 
               pamditherbw: Fix bug: issue error message instead of just
               ignoring one of the options when you specify -hilbert and
-- 
cgit 1.4.1