View | Details | Raw Unified
Collapse All | Expand All

(-) file_not_specified_in_diff (-6 / +35 lines)
 Lines 7-12    Link Here  
#include <string.h>
#include <string.h>
#include <stdlib.h>
#include <stdlib.h>
/* 2.03: don't include zlib here or we can't build without PNG */
/* 2.03: don't include zlib here or we can't build without PNG */
#include <limits.h>
 
#include "gd.h"
#include "gd.h"
#include "gdhelpers.h"
#include "gdhelpers.h"

  

    

    

       Lines 74-80
       
    
  Link Here 
    

  

        
  im = (gdImage *) gdMalloc (sizeof (gdImage));
  im = (gdImage *) gdMalloc (sizeof (gdImage));

        
  memset (im, 0, sizeof (gdImage));
  memset (im, 0, sizeof (gdImage));

        
  /* Row-major ever since gd 1.3 */
  /* Row-major ever since gd 1.3 */

            

              
  im->pixels = (unsigned char **) gdMalloc (sizeof (unsigned char *) * sy);

              
  if (sy >= INT_MAX/sizeof (unsigned char *) ||

            

            

              

              
      (im->pixels = (unsigned char **) gdMalloc (sizeof (unsigned char *) * sy)) == NULL) {

            

            

              

              
    gdFree(im);

            

            

              

              
    return NULL;

            

            

              

              
  }

            

        
  im->polyInts = 0;
  im->polyInts = 0;

        
  im->polyAllocated = 0;
  im->polyAllocated = 0;

        
  im->brush = 0;
  im->brush = 0;

  

    

    

       Lines 2462-2467
       
    
  Link Here 
    

  

        
    }
    }

        
  bytes = (w * h / 8) + 1;
  bytes = (w * h / 8) + 1;

        
  im = gdImageCreate (w, h);
  im = gdImageCreate (w, h);

            

              
              
  if (!im)

            

            

              
              
    return 0;

            

        
  gdImageColorAllocate (im, 255, 255, 255);
  gdImageColorAllocate (im, 255, 255, 255);

        
  gdImageColorAllocate (im, 0, 0, 0);
  gdImageColorAllocate (im, 0, 0, 0);

        
  x = 0;
  x = 0;

  

    

    

       Lines 2600-2605
       
    
  Link Here 
    

  

        
	{
	{

        
	  im->polyAllocated *= 2;
	  im->polyAllocated *= 2;

        
	}
	}

            

              
              
      if (im->polyAllocated >= INT_MAX/sizeof (int))

            

            

              
              
	return;

            

        
      im->polyInts = (int *) gdRealloc (im->polyInts,
      im->polyInts = (int *) gdRealloc (im->polyInts,

        
					sizeof (int) * im->polyAllocated);
					sizeof (int) * im->polyAllocated);

        
    }
    }

  

    

    

       Lines 149-154
       
    
  Link Here 
    

  

        
    {
    {

        
      im = gdImageCreate (*sx, *sy);
      im = gdImageCreate (*sx, *sy);

        
    }
    }

            

              
              

            

            

              
              
  if (!im)

            

            

              
              
    goto fail1;

            

            

              
              

            

        
  if (!_gdGetColors (in, im, gd2xFlag))
  if (!_gdGetColors (in, im, gd2xFlag))

        
    {
    {

        
      goto fail2;
      goto fail2;

  

    

    

       Lines 23-28
       
    
  Link Here 
    

  

        
#include <math.h>
#include <math.h>

        
#include <string.h>
#include <string.h>

        
#include <stdlib.h>
#include <stdlib.h>

            

              
              
#include <limits.h>

            

        
#include "gd.h"
#include "gd.h"

        
#include "gdhelpers.h"
#include "gdhelpers.h"

        

  

    

    

       Lines 202-208
       
    
  Link Here 
    

  

        
      if (overflow2(dp->realSize, 2)) {
      if (overflow2(dp->realSize, 2)) {

        
        return FALSE;
        return FALSE;

        
      }
      }

            

              
      if (!gdReallocDynamic (dp, dp->realSize * 2))

              
      if (bytesNeeded >= INT_MAX/2 ||

            

            

              

              
	  !gdReallocDynamic (dp, bytesNeeded * 2))

            

        
	{
	{

        
	  dp->dataGood = FALSE;
	  dp->dataGood = FALSE;

        
	  return FALSE;
	  return FALSE;

  

    

    

       Lines 6-11
       
    
  Link Here 
    

  

        
#include <math.h>
#include <math.h>

        
#include <string.h>
#include <string.h>

        
#include <stdlib.h>
#include <stdlib.h>

            

              
              
#include <limits.h>

            

            

              
              

            

        
#include "gd.h"
#include "gd.h"

        

        
/* JCE: Arrange HAVE_LIBPNG so that it can be set in gd.h */
/* JCE: Arrange HAVE_LIBPNG so that it can be set in gd.h */

  

    

    

       Lines 188-193
       
    
  Link Here 
    

  

        

        
  png_get_IHDR (png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,
  png_get_IHDR (png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,

        
		&interlace_type, NULL, NULL);
		&interlace_type, NULL, NULL);

            

              
              
  if (width >= INT_MAX/sizeof (int) ||

            

            

              
              
      width*sizeof (int) >= INT_MAX/height)

            

            

              
              
    return NULL;

            

        
  if ((color_type == PNG_COLOR_TYPE_RGB) ||
  if ((color_type == PNG_COLOR_TYPE_RGB) ||

        
      (color_type == PNG_COLOR_TYPE_RGB_ALPHA))
      (color_type == PNG_COLOR_TYPE_RGB_ALPHA))

        
    {
    {

  

    

    

       Lines 12-17
       
    
  Link Here 
    

  

        

        
#include <stdio.h>
#include <stdio.h>

        
#include <stdlib.h>
#include <stdlib.h>

            

              
              
#include <limits.h>

            

        
#include <string.h>
#include <string.h>

        
#include "gd.h"
#include "gd.h"

        
#include "gdhelpers.h"
#include "gdhelpers.h"

  

    

    

       Lines 47-52
       
    
  Link Here 
    

  

        
    return 0;
    return 0;

        

        
  number = image.ncolors;
  number = image.ncolors;

            

              
              

            

            

              
              
  if (number >= INT_MAX/sizeof (int))

            

            

              
              
    return (0);

            

            

              
              

            

        
  colors = (int *) gdMalloc (sizeof (int) * number);
  colors = (int *) gdMalloc (sizeof (int) * number);

        
  if (colors == NULL)
  if (colors == NULL)

        
    return (0);
    return (0);

  

    

    

       Lines 17-22
       
    
  Link Here 
    

  

        
#include <stddef.h>
#include <stddef.h>

        
#include <stdlib.h>
#include <stdlib.h>

        
#include <string.h>
#include <string.h>

            

              
              
#include <limits.h>

            

        

        
#include "wbmp.h"
#include "wbmp.h"

        
#include "gd.h"
#include "gd.h"

  

    

    

       Lines 127-134
       
    
  Link Here 
    

  

        
    gdFree(wbmp);
    gdFree(wbmp);

        
    return NULL;
    return NULL;

        
  }
  }

            

              
  if ((wbmp->bitmap =

              

            

            

              
       (int *) gdMalloc (sizeof (int) * width * height)) == NULL)

              
  if (width >= INT_MAX/sizeof(int) ||

            

            

              

              
      width*sizeof(int) >= INT_MAX/height ||

            

            

              

              
      (wbmp->bitmap = (int *) gdMalloc (sizeof (int) * width * height)) == NULL)

            

        
    {
    {

        
      gdFree (wbmp);
      gdFree (wbmp);

        
      return (NULL);
      return (NULL);

  

    

    

       Lines 194-201
       
    
  Link Here 
    

  

        
      gdFree(wbmp);
      gdFree(wbmp);

        
      return (-1);
      return (-1);

        
    }
    }

            

              
  if ((wbmp->bitmap =

              
  if (wbmp->width >= INT_MAX/sizeof(int) ||

            

            

              
       (int *) gdMalloc (sizeof (int) * wbmp->width * wbmp->height)) == NULL)

              
      wbmp->width*sizeof(int) >= INT_MAX/wbmp->height ||

            

            

              

              
      (wbmp->bitmap = (int *) gdMalloc (sizeof (int) * wbmp->width * wbmp->height)) == NULL)

            

        
    {
    {

        
      gdFree (wbmp);
      gdFree (wbmp);

        
      return (-1);
      return (-1);