From 4db481e68527c938dfbc216165f8fe64e1cd79a1 Mon Sep 17 00:00:00 2001 From: giraffedata Date: Mon, 23 Oct 2006 05:23:18 +0000 Subject: pnm_readpaminit() fail instead of crash with width == 0 git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@106 9d0c8265-081b-0410-96cb-a4ca84ce46f8 --- lib/libpam.c | 44 ++++++++++++++++++++++++++------------------ 1 file changed, 26 insertions(+), 18 deletions(-) (limited to 'lib/libpam.c') diff --git a/lib/libpam.c b/lib/libpam.c index 6d2acba7..8ab8f4ef 100644 --- a/lib/libpam.c +++ b/lib/libpam.c @@ -86,24 +86,32 @@ validateComputableSize(struct pam * const pamP) { Another common operation is adding 1 or 2 to the highest row, column, or plane number in the image, so we make sure that's possible. -----------------------------------------------------------------------------*/ - unsigned int const depth = allocationDepth(pamP); - - if (depth > INT_MAX/sizeof(sample)) - pm_error("image depth (%u) too large to be processed", depth); - else if (depth * sizeof(sample) > INT_MAX/pamP->width) - pm_error("image width and depth (%u, %u) too large " - "to be processed.", pamP->width, depth); - else if (pamP->width * (depth * sizeof(sample)) > - INT_MAX - depth * sizeof(tuple *)) - pm_error("image width and depth (%u, %u) too large " - "to be processed.", pamP->width, depth); - - if (depth > INT_MAX - 2) - pm_error("image depth (%u) too large to be processed", depth); - if (pamP->width > INT_MAX - 2) - pm_error("image width (%u) too large to be processed", pamP->width); - if (pamP->height > INT_MAX - 2) - pm_error("image height (%u) too large to be processed", pamP->height); + if (pamP->width == 0) + pm_error("Width is zero. Image must be at least one pixel wide"); + else if (pamP->height == 0) + pm_error("Height is zero. Image must be at least one pixel high"); + else { + unsigned int const depth = allocationDepth(pamP); + + if (depth > INT_MAX/sizeof(sample)) + pm_error("image depth (%u) too large to be processed", depth); + else if (depth * sizeof(sample) > INT_MAX/pamP->width) + pm_error("image width and depth (%u, %u) too large " + "to be processed.", pamP->width, depth); + else if (pamP->width * (depth * sizeof(sample)) > + INT_MAX - depth * sizeof(tuple *)) + pm_error("image width and depth (%u, %u) too large " + "to be processed.", pamP->width, depth); + + if (depth > INT_MAX - 2) + pm_error("image depth (%u) too large to be processed", depth); + if (pamP->width > INT_MAX - 2) + pm_error("image width (%u) too large to be processed", + pamP->width); + if (pamP->height > INT_MAX - 2) + pm_error("image height (%u) too large to be processed", + pamP->height); + } } -- cgit 1.4.1