Attachment #101331 for bug #154216

View | Details | Raw Unified | Return to bug 154216
Collapse All | Expand All




load(ImlibImage * im, ImlibProgressFunction progress,
     char progress_granularity, char immediate_load)
{
   int                 w=0, h=0, alpha=0;
   FILE               *f;

   if (im->data)

   {
      char                buf[256], buf2[256];

      memset(buf, 0, sizeof(buf));
      memset(buf2, 0, sizeof(buf));
      if (!fgets(buf, 255, f))
        {
           fclose(f);
           return 0;
        }
      sscanf(buf, "%s %i %i %i", buf2, &w, &h, &alpha);
      if (strcmp(buf2, "ARGB") || w < 1 || h < 1 || w > 16383 || h > 16383)
        {
           fclose(f);
           return 0;

Lines 95-100 Link Here

(-)imlib2-1.2.1/src/modules/loaders/loader_jpeg.c (+7 lines)
95	UNSET_FLAG(im->flags, F_HAS_ALPHA);	95	UNSET_FLAG(im->flags, F_HAS_ALPHA);
96	im->format = strdup("jpeg");	96	im->format = strdup("jpeg");
97	}	97	}
		98	if (w < 1 \|\| h < 1 \|\| w > 16383 \|\| h > 16383)
		99	{
		100	im->w = im->h = 0;
		101	jpeg_destroy_decompress(&cinfo);
		102	fclose(f);
		103	return 0;
		104	}
98	if (((!im->data) && (im->loader)) \|\| (immediate_load) \|\| (progress))	105	if (((!im->data) && (im->loader)) \|\| (immediate_load) \|\| (progress))
99	{	106	{
100	DATA8 ptr, line[16], *data;	107	DATA8 ptr, line[16], *data;

Lines 421-427 Link Here

(-)imlib2-1.2.1/src/modules/loaders/loader_lbm.c (-5 / +8 lines)
421		421
422	im->w = L2RWORD(ilbm.bmhd.data);	422	im->w = L2RWORD(ilbm.bmhd.data);
423	im->h = L2RWORD(ilbm.bmhd.data + 2);	423	im->h = L2RWORD(ilbm.bmhd.data + 2);
424	if (im->w <= 0 \|\| im->h <= 0) ok = 0;	424	if (im->w <= 0 \|\| im->h <= 0 \|\| im->w > 16383 \|\| im->h > 16383) ok = 0;
425		425
426	ilbm.depth = ilbm.bmhd.data[8];	426	ilbm.depth = ilbm.bmhd.data[8];
427	if (ilbm.depth < 1 \|\| (ilbm.depth > 8 && ilbm.depth != 24 && ilbm.depth != 32)) ok = 0; /* Only 1 to 8, 24, or 32 planes. */	427	if (ilbm.depth < 1 \|\| (ilbm.depth > 8 && ilbm.depth != 24 && ilbm.depth != 32)) ok = 0; /* Only 1 to 8, 24, or 32 planes. */
Lines 453-458 Link Here
453	}	453	}
454	}	454	}
455	if (!full \|\| !ok) {	455	if (!full \|\| !ok) {
		456	im->w = im->h = 0;
456	freeilbm(&ilbm);	457	freeilbm(&ilbm);
457	return ok;	458	return ok;
458	}	459	}
Lines 467-478 Link Here
467	cancel = 0;	468	cancel = 0;
468	plane[0] = NULL;	469	plane[0] = NULL;
469		470
		471	n = ilbm.depth;
		472	if (ilbm.mask == 1) n++;
		473
470	im->data = malloc(im->w * im->h * sizeof(DATA32));	474	im->data = malloc(im->w * im->h * sizeof(DATA32));
471	if (im->data) {	475	plane[0] = malloc(((im->w + 15) / 16) * 2 * n);
472	n = ilbm.depth;	476	if (im->data && plane[0]) {
473	if (ilbm.mask == 1) n++;
474		477
475	plane[0] = malloc(((im->w + 15) / 16) * 2 * n);
476	for (i = 1; i < n; i++) plane[i] = plane[i - 1] + ((im->w + 15) / 16) * 2;	478	for (i = 1; i < n; i++) plane[i] = plane[i - 1] + ((im->w + 15) / 16) * 2;
477		479
478	z = ((im->w + 15) / 16) * 2 * n;	480	z = ((im->w + 15) / 16) * 2 * n;
Lines 511-516 Link Here
511	* the memory for im->data.	513	* the memory for im->data.
512	----------/	514	----------/
513	if (!ok) {	515	if (!ok) {
		516	im->w = im->h = 0;
514	if (im->data) free(im->data);	517	if (im->data) free(im->data);
515	im->data = NULL;	518	im->data = NULL;
516	}	519	}

Lines 83-88 Link Here

(-)imlib2-1.2.1/src/modules/loaders/loader_png.c (+7 lines)
83	png_get_IHDR(png_ptr, info_ptr, (png_uint_32 *) (&w32),	83	png_get_IHDR(png_ptr, info_ptr, (png_uint_32 *) (&w32),
84	(png_uint_32 *) (&h32), &bit_depth, &color_type,	84	(png_uint_32 *) (&h32), &bit_depth, &color_type,
85	&interlace_type, NULL, NULL);	85	&interlace_type, NULL, NULL);
		86	if (w32 < 1 \|\| h32 < 1 \|\| w32 > 16383 \|\| h32 > 16383)
		87	{
		88	png_read_end(png_ptr, info_ptr);
		89	png_destroy_read_struct(&png_ptr, &info_ptr, (png_infopp) NULL);
		90	fclose(f);
		91	return 0;
		92	}
86	im->w = (int)w32;	93	im->w = (int)w32;
87	im->h = (int)h32;	94	im->h = (int)h32;
88	if (color_type == PNG_COLOR_TYPE_PALETTE)	95	if (color_type == PNG_COLOR_TYPE_PALETTE)

Lines 80-86 Link Here

(-)imlib2-1.2.1/src/modules/loaders/loader_pnm.c (-1 / +1 lines)
80	int i = 0;	80	int i = 0;
81		81
82	/* read numbers */	82	/* read numbers */
83	while (c != EOF && !isspace(c))	83	while (c != EOF && i+1 < sizeof(buf) && !isspace(c))
84	{	84	{
85	buf[i++] = c;	85	buf[i++] = c;
86	c = fgetc(f);	86	c = fgetc(f);

Lines 319-324 Link Here

(-)imlib2-1.2.1/src/modules/loaders/loader_tga.c (-7 / +13 lines)
319	{	319	{
320	unsigned long datasize;	320	unsigned long datasize;
321	unsigned char *bufptr;	321	unsigned char *bufptr;
		322	unsigned char *bufend;
322	DATA32 *dataptr;	323	DATA32 *dataptr;
323		324
324	int y, pl = 0;	325	int y, pl = 0;
Lines 348-353 Link Here
348	/* bufptr is the next byte to be read from the buffer */	349	/* bufptr is the next byte to be read from the buffer */
349	bufptr = filedata;	350	bufptr = filedata;
350		351
		352	/* bufend is one past the last byte to be read from the buffer */
		353	bufend = filedata + datasize;
		354
351	/* dataptr is the next 32-bit pixel to be filled in */	355	/* dataptr is the next 32-bit pixel to be filled in */
352	dataptr = im->data;	356	dataptr = im->data;
353		357
Lines 365-371 Link Here
365	else	369	else
366	dataptr = im->data + (y * im->w);	370	dataptr = im->data + (y * im->w);
367		371
368	for (x = 0; x < im->w; x++) /* for each pixel in the row */	372	for (x = 0;
		373	x < im->w && bufptr+bpp/8 < bufend;
		374	x++) /* for each pixel in the row */
369	{	375	{
370	switch (bpp)	376	switch (bpp)
371	{	377	{
Lines 422-429 Link Here
422	unsigned char curbyte, red, green, blue, alpha;	428	unsigned char curbyte, red, green, blue, alpha;
423	DATA32 final_pixel = dataptr + im->w im->h;	429	DATA32 final_pixel = dataptr + im->w im->h;
424		430
425	/* loop until we've got all the pixels */	431	/* loop until we've got all the pixels or run out of input */
426	while (dataptr < final_pixel)	432	while (dataptr < final_pixel && bufptr+1+bpp/8 < bufend)
427	{	433	{
428	int count;	434	int count;
429		435
Lines 441-447 Link Here
441	green = *bufptr++;	447	green = *bufptr++;
442	red = *bufptr++;	448	red = *bufptr++;
443	alpha = *bufptr++;	449	alpha = *bufptr++;
444	for (i = 0; i < count; i++)	450	for (i = 0; i < count && dataptr < final_pixel; i++)
445	{	451	{
446	WRITE_RGBA(dataptr, red, green, blue, alpha);	452	WRITE_RGBA(dataptr, red, green, blue, alpha);
447	dataptr++;	453	dataptr++;
Lines 452-458 Link Here
452	blue = *bufptr++;	458	blue = *bufptr++;
453	green = *bufptr++;	459	green = *bufptr++;
454	red = *bufptr++;	460	red = *bufptr++;
455	for (i = 0; i < count; i++)	461	for (i = 0; i < count && dataptr < final_pixel; i++)
456	{	462	{
457	WRITE_RGBA(dataptr, red, green, blue,	463	WRITE_RGBA(dataptr, red, green, blue,
458	(char)0xff);	464	(char)0xff);
Lines 462-468 Link Here
462		468
463	case 8:	469	case 8:
464	alpha = *bufptr++;	470	alpha = *bufptr++;
465	for (i = 0; i < count; i++)	471	for (i = 0; i < count && dataptr < final_pixel; i++)
466	{	472	{
467	WRITE_RGBA(dataptr, alpha, alpha, alpha,	473	WRITE_RGBA(dataptr, alpha, alpha, alpha,
468	(char)0xff);	474	(char)0xff);
Lines 477-483 Link Here
477	{	483	{
478	int i;	484	int i;
479		485
480	for (i = 0; i < count; i++)	486	for (i = 0; i < count && dataptr < final_pixel; i++)
481	{	487	{
482	switch (bpp)	488	switch (bpp)
483	{	489	{




raster(TIFFRGBAImage_Extra * img, uint32 * rast,
       uint32 x, uint32 y, uint32 w, uint32 h)
{
   int                image_width, image_height;
   uint32             *pixel, pixel_value;
   int                 i, j, dy, rast_offset;
   DATA32             *buffer_pixel, *buffer = img->image->data;

     }
   
   rgba_image.image = im;
   width = rgba_image.rgba.width;
   height = rgba_image.rgba.height;
   if (width < 1 || height < 1 || width >= 16384 || height >= 16384)
     {
        TIFFRGBAImageEnd((TIFFRGBAImage *) & rgba_image);
        TIFFClose(tif);
        return 0;
     }
   im->w = width;
   im->h = height;
   rgba_image.num_pixels = num_pixels = width * height;
   if (rgba_image.rgba.alpha != EXTRASAMPLE_UNSPECIFIED)
      SET_FLAG(im->flags, F_HAS_ALPHA);

Return to bug 154216

Lines 23-29 Link Here

(-)imlib2-1.2.1/src/modules/loaders/loader_argb.c (-2 / +4 lines)
23	load(ImlibImage * im, ImlibProgressFunction progress,	23	load(ImlibImage * im, ImlibProgressFunction progress,
24	char progress_granularity, char immediate_load)	24	char progress_granularity, char immediate_load)
25	{	25	{
26	int w, h, alpha;	26	int w=0, h=0, alpha=0;
27	FILE *f;	27	FILE *f;
28		28
29	if (im->data)	29	if (im->data)
Lines 36-48 Link Here
36	{	36	{
37	char buf[256], buf2[256];	37	char buf[256], buf2[256];
38		38
		39	memset(buf, 0, sizeof(buf));
		40	memset(buf2, 0, sizeof(buf));
39	if (!fgets(buf, 255, f))	41	if (!fgets(buf, 255, f))
40	{	42	{
41	fclose(f);	43	fclose(f);
42	return 0;	44	return 0;
43	}	45	}
44	sscanf(buf, "%s %i %i %i", buf2, &w, &h, &alpha);	46	sscanf(buf, "%s %i %i %i", buf2, &w, &h, &alpha);
45	if (strcmp(buf2, "ARGB"))	47	if (strcmp(buf2, "ARGB") \|\| w < 1 \|\| h < 1 \|\| w > 16383 \|\| h > 16383)
46	{	48	{
47	fclose(f);	49	fclose(f);
48	return 0;	50	return 0;

Lines 75-81 Link Here

(-)imlib2-1.2.1/src/modules/loaders/loader_tiff.c (-3 / +11 lines)
75	raster(TIFFRGBAImage_Extra * img, uint32 * rast,	75	raster(TIFFRGBAImage_Extra * img, uint32 * rast,
76	uint32 x, uint32 y, uint32 w, uint32 h)	76	uint32 x, uint32 y, uint32 w, uint32 h)
77	{	77	{
78	uint32 image_width, image_height;	78	int image_width, image_height;
79	uint32 *pixel, pixel_value;	79	uint32 *pixel, pixel_value;
80	int i, j, dy, rast_offset;	80	int i, j, dy, rast_offset;
81	DATA32 buffer_pixel, buffer = img->image->data;	81	DATA32 buffer_pixel, buffer = img->image->data;
Lines 192-199 Link Here
192	}	192	}
193		193
194	rgba_image.image = im;	194	rgba_image.image = im;
195	im->w = width = rgba_image.rgba.width;	195	width = rgba_image.rgba.width;
196	im->h = height = rgba_image.rgba.height;	196	height = rgba_image.rgba.height;
		197	if (width < 1 \|\| height < 1 \|\| width >= 16384 \|\| height >= 16384)
		198	{
		199	TIFFRGBAImageEnd((TIFFRGBAImage *) & rgba_image);
		200	TIFFClose(tif);
		201	return 0;
		202	}
		203	im->w = width;
		204	im->h = height;
197	rgba_image.num_pixels = num_pixels = width * height;	205	rgba_image.num_pixels = num_pixels = width * height;
198	if (rgba_image.rgba.alpha != EXTRASAMPLE_UNSPECIFIED)	206	if (rgba_image.rgba.alpha != EXTRASAMPLE_UNSPECIFIED)
199	SET_FLAG(im->flags, F_HAS_ALPHA);	207	SET_FLAG(im->flags, F_HAS_ALPHA);