From b79e93eef34c7852ed8a1980b4d7ff0da221008d Mon Sep 17 00:00:00 2001 From: giraffedata Date: Tue, 22 Aug 2023 17:45:58 +0000 Subject: Fix incorrect random number generation, buffer overrun from failure to clip column number to width git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@4608 9d0c8265-081b-0410-96cb-a4ca84ce46f8 --- generator/ppmrough.c | 48 ++++++++++++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 18 deletions(-) (limited to 'generator') diff --git a/generator/ppmrough.c b/generator/ppmrough.c index a4a1f14d..682ac56c 100644 --- a/generator/ppmrough.c +++ b/generator/ppmrough.c @@ -97,6 +97,15 @@ parseCommandLine(int argc, const char ** argv, if (!varSpec) cmdlineP->var = 10; + if (cmdlineP->topSpec && cmdlineP->top > cmdlineP->height) + pm_error("-top value too large. Max is %u", cmdlineP->height); + if (cmdlineP->bottomSpec && cmdlineP->bottom > cmdlineP->height) + pm_error("-bottom value too large. Max is %u", cmdlineP->height); + if (cmdlineP->leftSpec && cmdlineP->left > cmdlineP->width) + pm_error("-left value too large. Max is %u", cmdlineP->width); + if (cmdlineP->rightSpec && cmdlineP->right > cmdlineP->width) + pm_error("-right value too large. Max is %u", cmdlineP->width); + if (argc-1 != 0) pm_error("There are no arguments. You specified %d.", argc-1); @@ -159,6 +168,7 @@ procLeft(pixel ** const pixels, int const r2, int const c1, int const c2, + unsigned int const width, unsigned int const var, pixel const bgcolor, struct pm_randSt * const randStP) { @@ -166,15 +176,15 @@ procLeft(pixel ** const pixels, if (r1 + 1 != r2) { int const rm = (r1 + r2) >> 1; int const cm = ((c1 + c2) >> 1) + - (int)floor(((float)pm_rand(randStP) / RAND_MAX - 0.5) * var + 0.5); + (int)floor(((float)pm_drand(randStP) - 0.5) * var + 0.5); - int c; + unsigned int c; - for (c = 0; c < cm; c++) + for (c = 0; c < MIN(width, MAX(0, cm)); c++) pixels[rm][c] = bgcolor; - procLeft(pixels, r1, rm, c1, cm, var, bgcolor, randStP); - procLeft(pixels, rm, r2, cm, c2, var, bgcolor, randStP); + procLeft(pixels, r1, rm, c1, cm, width, var, bgcolor, randStP); + procLeft(pixels, rm, r2, cm, c2, width, var, bgcolor, randStP); } } @@ -194,11 +204,11 @@ procRight(pixel ** const pixels, if (r1 + 1 != r2) { int const rm = (r1 + r2) >> 1; int const cm = ((c1 + c2) >> 1) + - (int)floor(((float)pm_rand(randStP) / RAND_MAX - 0.5) * var + 0.5); + (int)floor(((float)pm_drand(randStP) - 0.5) * var + 0.5); - int c; + unsigned int c; - for (c = cm; c < width; c++) + for (c = MAX(0, cm); c < width; c++) pixels[rm][c] = bgcolor; procRight(pixels, r1, rm, c1, cm, width, var, bgcolor, randStP); @@ -214,6 +224,7 @@ procTop(pixel ** const pixels, int const c2, int const r1, int const r2, + unsigned int const height, unsigned int const var, pixel const bgcolor, struct pm_randSt * const randStP) { @@ -221,15 +232,15 @@ procTop(pixel ** const pixels, if (c1 + 1 != c2) { int const cm = (c1 + c2) >> 1; int const rm = ((r1 + r2) >> 1) + - (int)floor(((float)pm_rand(randStP) / RAND_MAX - 0.5) * var + 0.5); + (int)floor(((float)pm_drand(randStP) - 0.5) * var + 0.5); - int r; + unsigned int r; - for (r = 0; r < rm; r++) + for (r = 0; r < MIN(height, MAX(0, rm)); r++) pixels[r][cm] = bgcolor; - procTop(pixels, c1, cm, r1, rm, var, bgcolor, randStP); - procTop(pixels, cm, c2, rm, r2, var, bgcolor, randStP); + procTop(pixels, c1, cm, r1, rm, height, var, bgcolor, randStP); + procTop(pixels, cm, c2, rm, r2, height, var, bgcolor, randStP); } } @@ -249,11 +260,11 @@ procBottom(pixel ** const pixels, if (c1 + 1 != c2) { int const cm = (c1 + c2) >> 1; int const rm = ((r1 + r2) >> 1) + - (int)floor(((float)pm_rand(randStP) / RAND_MAX - 0.5) * var + 0.5); + (int)floor(((float)pm_drand(randStP) - 0.5) * var + 0.5); - int r; + unsigned int r; - for (r = rm; r < height; ++r) + for (r = MAX(0, rm); r < height; ++r) pixels[r][cm] = bgcolor; procBottom(pixels, c1, cm, r1, rm, height, var, bgcolor, randStP); @@ -286,7 +297,7 @@ makeRaggedLeftBorder(pixel ** const pixels, for (col = 0; col < leftC2; ++col) pixels[leftR2][col] = bgcolor; - procLeft(pixels, leftR1, leftR2, leftC1, leftC2, var, + procLeft(pixels, leftR1, leftR2, leftC1, leftC2, cols, var, bgcolor, randStP); } } @@ -347,7 +358,8 @@ makeRaggedTopBorder(pixel ** const pixels, for (row = 0; row < topR2; ++row) pixels[row][topC2] = bgcolor; - procTop(pixels, topC1, topC2, topR1, topR2, var, bgcolor, randStP); + procTop(pixels, topC1, topC2, topR1, topR2, rows, + var, bgcolor, randStP); } } -- cgit 1.4.1