From a98484391d99d3ba18c9efec66c2587ddd9393a0 Mon Sep 17 00:00:00 2001 From: giraffedata Date: Mon, 26 Nov 2007 01:55:41 +0000 Subject: Release 10.35.34 git-svn-id: http://svn.code.sf.net/p/netpbm/code/stable@472 9d0c8265-081b-0410-96cb-a4ca84ce46f8 --- Makefile.version | 2 +- analyzer/pamsharpmap.c | 2 +- analyzer/pamsharpness.c | 2 +- converter/other/pamtopfm.c | 2 +- converter/other/xwdtopnm.c | 20 ++++++++++++++++++-- doc/HISTORY | 8 ++++++++ editor/pamditherbw.c | 5 +++-- 7 files changed, 33 insertions(+), 8 deletions(-) diff --git a/Makefile.version b/Makefile.version index f00a8739..661f42f4 100644 --- a/Makefile.version +++ b/Makefile.version @@ -1,3 +1,3 @@ NETPBM_MAJOR_RELEASE = 10 NETPBM_MINOR_RELEASE = 35 -NETPBM_POINT_RELEASE = 33 +NETPBM_POINT_RELEASE = 34 diff --git a/analyzer/pamsharpmap.c b/analyzer/pamsharpmap.c index 73923ab9..8a08f981 100644 --- a/analyzer/pamsharpmap.c +++ b/analyzer/pamsharpmap.c @@ -137,7 +137,7 @@ main(int argc, char **argv) { ifP = pm_openr(cmdline.inputFilespec); - tuplenarray = pnm_readpamn(ifP, &inpam, sizeof(inpam)); + tuplenarray = pnm_readpamn(ifP, &inpam, PAM_STRUCT_SIZE(tuple_type)); mappam = inpam; mappam.file = stdout; diff --git a/analyzer/pamsharpness.c b/analyzer/pamsharpness.c index 7e52a9ba..2cb5edb9 100644 --- a/analyzer/pamsharpness.c +++ b/analyzer/pamsharpness.c @@ -136,7 +136,7 @@ main(int argc, char **argv) { ifP = pm_openr(cmdline.inputFilespec); - tuplenarray = pnm_readpamn(ifP, &inpam, sizeof(inpam)); + tuplenarray = pnm_readpamn(ifP, &inpam, PAM_STRUCT_SIZE(tuple_type)); if (inpam.height < 3 || inpam.width < 3) pm_error("sharpness is undefined for an image less than 3 pixels " diff --git a/converter/other/pamtopfm.c b/converter/other/pamtopfm.c index 44a8ab08..ee44eeb5 100644 --- a/converter/other/pamtopfm.c +++ b/converter/other/pamtopfm.c @@ -279,7 +279,7 @@ main(int argc, char **argv ) { ifP = pm_openr(cmdline.inputFilespec); - tuplenArray = pnm_readpamn(ifP, &pam, sizeof(pam)); + tuplenArray = pnm_readpamn(ifP, &pam, PAM_STRUCT_SIZE(tuple_type)); writePfmHeader(stdout, makePfmHeader(&pam, cmdline.scale, cmdline.endian)); diff --git a/converter/other/xwdtopnm.c b/converter/other/xwdtopnm.c index 28c38cfc..4ff7d2ec 100644 --- a/converter/other/xwdtopnm.c +++ b/converter/other/xwdtopnm.c @@ -222,7 +222,15 @@ processX10Header(X10WDFileHeader * const h10P, /* Must be grayscale. */ *formatP = PGM_TYPE; *visualclassP = StaticGray; - *maxvalP = ( 1 << h10P->display_planes ) - 1; + if (h10P->display_planes > sizeof(*maxvalP) * 8 - 1) + pm_error("XWD header says display_planes = %u, which is " + "too large for this program to compute", + h10P->display_planes); + *maxvalP = ((xelval)1 << h10P->display_planes) - 1; + if (*maxvalP > PNM_OVERALLMAXVAL) + pm_error("XWD header says display_planes = %u, which is too " + "large for maximum maxval of %u", + h10P->display_planes, PNM_OVERALLMAXVAL); *colorsP = pnm_allocrow( *maxvalP + 1 ); for ( i = 0; i <= *maxvalP; ++i ) PNM_ASSIGN1( (*colorsP)[i], i ); @@ -520,7 +528,15 @@ processX11Header(X11WDFileHeader * const h11P, } else if ( *visualclassP == StaticGray ) { unsigned int i; *formatP = PGM_TYPE; - *maxvalP = ( 1 << h11FixedP->bits_per_pixel ) - 1; + if (h11FixedP->bits_per_pixel > sizeof(*maxvalP) * 8 - 1) + pm_error("XWD header says bits_per_pixel = %u, which is " + "too large for this program to compute", + h11FixedP->bits_per_pixel); + *maxvalP = ((xelval)1 << h11FixedP->bits_per_pixel) - 1; + if (*maxvalP > PNM_OVERALLMAXVAL) + pm_error("XWD header says bits_per_pixel = %u, which is too " + "large for maximum maxval of %u", + h11FixedP->bits_per_pixel, PNM_OVERALLMAXVAL); *colorsP = pnm_allocrow( *maxvalP + 1 ); for ( i = 0; i <= *maxvalP; ++i ) PNM_ASSIGN1( (*colorsP)[i], i ); diff --git a/doc/HISTORY b/doc/HISTORY index d9c04bd9..4256cbfa 100644 --- a/doc/HISTORY +++ b/doc/HISTORY @@ -4,6 +4,14 @@ Netpbm. CHANGE HISTORY -------------- +07.11.26 BJH Release 10.35.34 + + xwdtopnm: deal with too-large bits per pixel value in XWD + header. + + pamditherbw, pamsharpness, pamsharpmask, pamtopfm: + fix crash due to write to arbitrary memory. + 07.11.13 BJH Release 10.35.33 pnmcrop: fix -verbose message about background color with diff --git a/editor/pamditherbw.c b/editor/pamditherbw.c index 61c23103..e4c0d4c6 100644 --- a/editor/pamditherbw.c +++ b/editor/pamditherbw.c @@ -145,6 +145,7 @@ parseCommandLine(int argc, char ** argv, } + static struct pam makeOutputPam(unsigned int const width, unsigned int const height) { @@ -331,7 +332,7 @@ doHilbert(FILE * const ifP, int *x,*y; int sum; - grays = pnm_readpam(ifP, &graypam, sizeof(graypam)); + grays = pnm_readpam(ifP, &graypam, PAM_STRUCT_SIZE(tuple_type)); bitpam = makeOutputPam(graypam.width, graypam.height); @@ -693,7 +694,7 @@ main(int argc, char *argv[]) { tuple * bitrow; int row; - pnm_readpaminit(ifP, &graypam, sizeof(graypam)); + pnm_readpaminit(ifP, &graypam, PAM_STRUCT_SIZE(tuple_type)); bitpam = makeOutputPam(graypam.width, graypam.height); -- cgit 1.4.1