From 32b7a323a63837c399e402f60657ec88431dc301 Mon Sep 17 00:00:00 2001 From: giraffedata Date: Wed, 20 Sep 2023 02:04:03 +0000 Subject: Fix incorrect output with extremely long rows git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@4669 9d0c8265-081b-0410-96cb-a4ca84ce46f8 --- converter/pbm/thinkjettopbm.l | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'converter/pbm') diff --git a/converter/pbm/thinkjettopbm.l b/converter/pbm/thinkjettopbm.l index 5de4f2bb..c55a0085 100644 --- a/converter/pbm/thinkjettopbm.l +++ b/converter/pbm/thinkjettopbm.l @@ -38,6 +38,7 @@ #include #include #include "pm_c_util.h" +#include "mallocvar.h" #include "pbm.h" #include "shhopt.h" @@ -114,8 +115,10 @@ DIG [0-9] \033\*b{DIG}+W { int l; if (rowCount >= rowCapacity) { + if (rowCapacity > INT_MAX-100) + pm_error("Too many rows to count"); rowCapacity += 100; - rows = realloc (rows, rowCapacity * sizeof *rows); + REALLOCARRAY(rows, rowCapacity); if (rows == NULL) pm_error ("Out of memory."); } @@ -223,6 +226,9 @@ yywrap (void) debug ("Got %d rows, %d columns\n", rowCount, maxRowLength); + if (maxRowLength > INT_MAX/8) + pm_error("A row has an uncomputably large number of columns: %d", + maxRowLength); /* * Quite simple since ThinkJet bit arrangement matches PBM */ -- cgit 1.4.1