Attachment #38628 for bug #61619

Lines 165-170 Link Here

(-)xv-3.10a/xvbmp.c (+5 lines)
165	int i, cmaplen;	165	int i, cmaplen;
166		166
167	cmaplen = (biClrUsed) ? biClrUsed : 1 << biBitCount;	167	cmaplen = (biClrUsed) ? biClrUsed : 1 << biBitCount;
		168
		169	/* sanity check user supplied value */
		170	if (cmaplen > 256)
		171	{ bmpError(bname,"invalid colormap length"); goto ERROR; }
		172
168	for (i=0; i<cmaplen; i++) {	173	for (i=0; i<cmaplen; i++) {
169	pinfo->b[i] = getc(fp);	174	pinfo->b[i] = getc(fp);
170	pinfo->g[i] = getc(fp);	175	pinfo->g[i] = getc(fp);

Lines 265-272 Link Here

(-)xv-3.10a/xviris.c (+10 lines)
265	byte *rledat;	265	byte *rledat;
266	u_long starttab, lengthtab;	266	u_long starttab, lengthtab;
267		267
		268	/* check they are postive */
		269	if ((xsize <= 0) \|\| (ysize <= 0) \|\| (zsize <= 0))
		270	FatalError("invalid image size supplied to LoadIRIS()");
		271
268	rlebuflen = 2 * xsize + 10;	272	rlebuflen = 2 * xsize + 10;
269	tablen = ysize * zsize;	273	tablen = ysize * zsize;
		274
		275	/* did they overflow */
		276
		277	if ((rlebuflen <= 0) \|\| (tablen <= 0))
		278	FatalError("invalid image size supplied to LoadIRIS()");
		279
270	starttab = (u_long ) malloc((size_t) tablen sizeof(long));	280	starttab = (u_long ) malloc((size_t) tablen sizeof(long));
271	lengthtab = (u_long ) malloc((size_t) tablen sizeof(long));	281	lengthtab = (u_long ) malloc((size_t) tablen sizeof(long));
272	rledat = (byte *) malloc((size_t) rlebuflen);	282	rledat = (byte *) malloc((size_t) rlebuflen);

Lines 4-9 Link Here

(-)xv-3.10a/xvpcx.c (+5 lines)
4	* LoadPCX(fname, pinfo) - loads a PCX file	4	* LoadPCX(fname, pinfo) - loads a PCX file
5	*/	5	*/
6		6
		7	#include <limits.h>
7	#include "copyright.h"	8	#include "copyright.h"
8		9
9	/*	10	/*
Lines 222-227 Link Here
222	byte *image;	223	byte *image;
223		224
224	/* note: overallocation to make life easier... */	225	/* note: overallocation to make life easier... */
		226	if ((pinfo->h <= 0) \|\| (pinfo->h > INT_MAX-1) \|\|
		227	(pinfo->w <= 0) \|\| (pinfo->w > INT_MAX-16))
		228	FatalError("bad image specs in pcxLoadImage8()");
		229
225	image = (byte ) malloc((size_t) (pinfo->h + 1) pinfo->w + 16);	230	image = (byte ) malloc((size_t) (pinfo->h + 1) pinfo->w + 16);
226	if (!image) FatalError("Can't alloc 'image' in pcxLoadImage8()");	231	if (!image) FatalError("Can't alloc 'image' in pcxLoadImage8()");
227		232

Lines 5-10 Link Here

(-)xv-3.10a/xvpm.c (-1 / +3 lines)
5	* WritePM(fp, pic, ptype, w, h, r,g,b, numcols, style, comment)	5	* WritePM(fp, pic, ptype, w, h, r,g,b, numcols, style, comment)
6	*/	6	*/
7		7
		8	#include <limits.h>
		9
8	#include "copyright.h"	10	#include "copyright.h"
9		11
10	#include "xv.h"	12	#include "xv.h"
Lines 137-143 Link Here
137		139
138		140
139	/* alloc and read in comment, if any */	141	/* alloc and read in comment, if any */
140	if (thePic.pm_cmtsize>0) {	142	if (thePic.pm_cmtsize>0 && thePic.pm_cmtsize<(INT_MAX-1)) {
141	thePic.pm_cmt = (char *) malloc((size_t) thePic.pm_cmtsize+1);	143	thePic.pm_cmt = (char *) malloc((size_t) thePic.pm_cmtsize+1);
142	if (thePic.pm_cmt) {	144	if (thePic.pm_cmt) {
143	thePic.pm_cmt[thePic.pm_cmtsize] = '\0'; /* to be safe */	145	thePic.pm_cmt[thePic.pm_cmtsize] = '\0'; /* to be safe */

Return to bug 61619