From dc65da6b9984802cc80b7e6dd2d8107d07cdc189 Mon Sep 17 00:00:00 2001
From: giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>
Date: Wed, 13 Sep 2017 15:36:21 +0000
Subject: Fix crash when corrupt image has invalid color index

git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3058 9d0c8265-081b-0410-96cb-a4ca84ce46f8
---
 converter/other/pnmtopalm/palmtopnm.c | 32 ++++++++++++++++++++++----------
 doc/HISTORY                           |  3 +++
 2 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/converter/other/pnmtopalm/palmtopnm.c b/converter/other/pnmtopalm/palmtopnm.c
index b7e9c096..b80ef34a 100644
--- a/converter/other/pnmtopalm/palmtopnm.c
+++ b/converter/other/pnmtopalm/palmtopnm.c
@@ -686,11 +686,16 @@ doTransparent(FILE *                 const ofP,
     if (hasTransparency) {
         if (colormap) {
             Color_s const color = transparentIndex << 24;
-            Color const actualColor = (bsearch(&color,
-                                               colormap->color_entries, 
-                                               colormap->ncolors,
-                                               sizeof(color), 
-                                               palmcolor_compare_indices));
+            Color const actualColor = bsearch(&color,
+                                              colormap->color_entries, 
+                                              colormap->ncolors,
+                                              sizeof(color), 
+                                              palmcolor_compare_indices);
+            if (!actualColor)
+                pm_error("Invalid input; transparent index %u "
+                         "is not among the %u colors in the image's colormap",
+                         transparentIndex, colormap->ncolors);
+
             fprintf(ofP, "#%02x%02x%02x\n", 
                    (unsigned int) ((*actualColor >> 16) & 0xFF),
                    (unsigned int) ((*actualColor >>  8) & 0xFF), 
@@ -1025,6 +1030,13 @@ convertRowToPnmNotDirect(const unsigned char * const palmrow,
                                                 colormap->ncolors,
                                                 sizeof(color2), 
                                                 palmcolor_compare_indices);
+
+            if (!actualColor)
+                pm_error("Invalid input.  A color index in column %u "
+                         "is %u, which is not among the %u colors "
+                         "in the colormap",
+                         j, color, colormap->ncolors);
+
             PPM_ASSIGN(xelrow[j], 
                        (*actualColor >> 16) & 0xFF, 
                        (*actualColor >>  8) & 0xFF, 
@@ -1125,11 +1137,11 @@ showHistogram(unsigned int * const seen,
                        colorIndex, graymap[colorIndex], seen[colorIndex]);
         else {
             Color_s const color = colorIndex << 24;
-            Color const actualColor = (bsearch(&color,
-                                               colormap->color_entries, 
-                                               colormap->ncolors,
-                                               sizeof(color), 
-                                               palmcolor_compare_indices));
+            Color const actualColor = bsearch(&color,
+                                              colormap->color_entries, 
+                                              colormap->ncolors,
+                                              sizeof(color), 
+                                              palmcolor_compare_indices);
             if (actualColor)
                 pm_message("%.3d -> %ld,%ld,%ld:  %d", colorIndex,
                            (*actualColor >> 16) & 0xFF,
diff --git a/doc/HISTORY b/doc/HISTORY
index 50dbef6a..a36da18b 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -23,6 +23,9 @@ not yet  BJH  Release 10.80.00
               contrast images (i.e. little difference between foreground and
               background).
 
+              palmtopnm: fix crash if invalid input contains color index that
+              is not in the palette.
+
               pnmtopalm: fix incorrect output with certain input files and
               -packbits_compression.  Always broken.  -packbits_compression
               was new in Netpbm 10.27 (March 2005).
-- 
cgit 1.4.1