Attachment #198446 for bug #277722

View | Details | Raw Unified | Return to bug 277722
Collapse All | Expand All




    if (!image->Ok())
        goto error;

    // initialize all line pointers to NULL to ensure that they can be safely
    // free()d if an error occurs before all of them could be allocated
    lines = (unsigned char **)calloc(height, sizeof(unsigned char *));
    if ( !lines )
        goto error;

    for (i = 0; i < height; i++)
    {
        if ((lines[i] = (unsigned char *)malloc( (size_t)(width * (sizeof(unsigned char) * 4)))) == NULL)
        {
            for ( unsigned int n = 0; n < i; n++ )
                free( lines[n] );
            goto error;
        }
    }

    png_read_image( png_ptr, lines );




    }

    uint32 w, h;
    uint32 npixels;
    uint32 *raster;

    TIFFGetField( tif, TIFFTAG_IMAGEWIDTH, &w );

                           (samplesInfo[0] == EXTRASAMPLE_ASSOCALPHA ||
                            samplesInfo[0] == EXTRASAMPLE_UNASSALPHA));

    // guard against integer overflow during multiplication which could result
    // in allocating a too small buffer and then overflowing it
    const double bytesNeeded = (double)w * (double)h * sizeof(uint32);
    if ( bytesNeeded >= 4294967295U /* UINT32_MAX */ )
    {
        if ( verbose )
            wxLogError( _("TIFF: Image size is abnormally big.") );

        TIFFClose(tif);

        return false;
    }

    raster = (uint32*) _TIFFmalloc( bytesNeeded );

    if (!raster)
    {

Return to bug 277722

Lines 568-585 wxPNGHandler::LoadFile(wxImage *image, Link Here

(-)wxPython-src-2.8.10.1-orig/src/common/imagpng.cpp (-5 / +3 lines)
568	if (!image->Ok())	568	if (!image->Ok())
569	goto error;	569	goto error;
570		570
571	lines = (unsigned char *)malloc( (size_t)(height sizeof(unsigned char *)) );	571	// initialize all line pointers to NULL to ensure that they can be safely
		572	// free()d if an error occurs before all of them could be allocated
		573	lines = (unsigned char *)calloc(height, sizeof(unsigned char ));
572	if ( !lines )	574	if ( !lines )
573	goto error;	575	goto error;
574		576
575	for (i = 0; i < height; i++)	577	for (i = 0; i < height; i++)
576	{	578	{
577	if ((lines[i] = (unsigned char )malloc( (size_t)(width (sizeof(unsigned char) * 4)))) == NULL)	579	if ((lines[i] = (unsigned char )malloc( (size_t)(width (sizeof(unsigned char) * 4)))) == NULL)
578	{
579	for ( unsigned int n = 0; n < i; n++ )
580	free( lines[n] );
581	goto error;	580	goto error;
582	}
583	}	581	}
584		582
585	png_read_image( png_ptr, lines );	583	png_read_image( png_ptr, lines );

Lines 261-267 bool wxTIFFHandler::LoadFile( wxImage *i Link Here

(-)wxPython-src-2.8.10.1-orig/src/common/imagtiff.cpp (-3 / +13 lines)
261	}	261	}
262		262
263	uint32 w, h;	263	uint32 w, h;
264	uint32 npixels;
265	uint32 *raster;	264	uint32 *raster;
266		265
267	TIFFGetField( tif, TIFFTAG_IMAGEWIDTH, &w );	266	TIFFGetField( tif, TIFFTAG_IMAGEWIDTH, &w );
Lines 275-283 bool wxTIFFHandler::LoadFile( wxImage *i Link Here
275	(samplesInfo[0] == EXTRASAMPLE_ASSOCALPHA \|\|	274	(samplesInfo[0] == EXTRASAMPLE_ASSOCALPHA \|\|
276	samplesInfo[0] == EXTRASAMPLE_UNASSALPHA));	275	samplesInfo[0] == EXTRASAMPLE_UNASSALPHA));
277		276
278	npixels = w * h;	277	// guard against integer overflow during multiplication which could result
		278	// in allocating a too small buffer and then overflowing it
		279	const double bytesNeeded = (double)w * (double)h * sizeof(uint32);
		280	if ( bytesNeeded >= 4294967295U /* UINT32_MAX */ )
		281	{
		282	if ( verbose )
		283	wxLogError( _("TIFF: Image size is abnormally big.") );
		284
		285	TIFFClose(tif);
		286
		287	return false;
		288	}
279		289
280	raster = (uint32) _TIFFmalloc( npixels sizeof(uint32) );	290	raster = (uint32*) _TIFFmalloc( bytesNeeded );
281		291
282	if (!raster)	292	if (!raster)
283	{	293	{