From b4b9388b66b7a5a9db8a9831eebdb35ae9037e45 Mon Sep 17 00:00:00 2001
From: giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>
Date: Wed, 10 Jun 2020 00:23:47 +0000
Subject: Fix for input file that has negative, zero, or missing width value

git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3858 9d0c8265-081b-0410-96cb-a4ca84ce46f8
---
 converter/ppm/pjtoppm.c | 41 ++++++++++++++++++++++++++++++-----------
 1 file changed, 30 insertions(+), 11 deletions(-)

(limited to 'converter')

diff --git a/converter/ppm/pjtoppm.c b/converter/ppm/pjtoppm.c
index 9d23d47b..e556803f 100644
--- a/converter/ppm/pjtoppm.c
+++ b/converter/ppm/pjtoppm.c
@@ -51,7 +51,11 @@ main(int argc, const char ** argv) {
 
     int cmd, val;
     char buffer[BUFSIZ];
-    int planes = 3, rows = -1, cols = -1;
+    int planes = 3;
+    unsigned int rows;
+    unsigned int rowsX;
+    unsigned int cols;
+    bool colsIsSet;
     unsigned char **image = NULL;
     int *imlen;
     FILE * ifP;
@@ -78,6 +82,8 @@ main(int argc, const char ** argv) {
     row = 0;  /* initial value */
     plane = 0;  /* initial value */
     modeIsSet = false;  /* initial value */
+    colsIsSet = false;  /* initial value */
+    rowsX = 0;  /* initial value */
 
     while ((c = fgetc(ifP)) != -1) {
         if (c != '\033')
@@ -119,10 +125,18 @@ main(int argc, const char ** argv) {
             case 'r':
                 switch (c) {
                 case 'S':   /* width */
-                    cols = val;
+                    if (val < 0)
+                        pm_error("invalid width value");
+                    else {
+                        cols = val;
+                        colsIsSet = true;
+                    }
                     break;
                 case 'T':   /* height */
-                    rows = val;
+                    if (val < 0)
+                        pm_error ("invalid height value");
+                    else
+                        rowsX = val;
                     break;
                 case 'U':   /* planes */
                     planes = val;
@@ -153,21 +167,24 @@ main(int argc, const char ** argv) {
                     break;
                 case 'V':   /* send plane */
                 case 'W':   /* send last plane */
-                    if (rows == -1 || row >= rows || image == NULL) {
-                        if (rows == -1 || row >= rows)
-                            rows += 100;
+                    if (row >= rowsX || image == NULL) {
+                        if (row >= rowsX)
+                            rowsX += 100;
                         if (image == NULL) {
-                            MALLOCARRAY(image, uintProduct(rows, planes));
-                            MALLOCARRAY(imlen, uintProduct(rows, planes));
+                            MALLOCARRAY(image, uintProduct(rowsX, planes));
+                            MALLOCARRAY(imlen, uintProduct(rowsX, planes));
                         } else {
-                            REALLOCARRAY(image, uintProduct(rows, planes));
-                            REALLOCARRAY(imlen, uintProduct(rows, planes));
+                            REALLOCARRAY(image, uintProduct(rowsX, planes));
+                            REALLOCARRAY(imlen, uintProduct(rowsX, planes));
                         }
                     }
                     if (image == NULL || imlen == NULL)
                         pm_error("out of memory");
                     if (plane >= planes)
                         pm_error("too many planes");
+                    if (!colsIsSet)
+                        pm_error("missing width value");
+
                     cols = MAX(cols, val);
                     imlen[row * planes + plane] = val;
                     MALLOCARRAY(image[row * planes + plane], val);
@@ -225,7 +242,9 @@ main(int argc, const char ** argv) {
 
     rows = row;
     if (mode == 1) {
-        int const newcols = 10240;  /* It could not be larger that that! */
+        unsigned int const newcols = 10240;
+            /* It could not be larger than that! */
+
         unsigned char * buf;
         unsigned int row;
 
-- 
cgit 1.4.1