|
Line
Link Here
|
|
-- xvbmp.c |
|
|
|
Lines 129-135
Link Here
|
| 129 |
/* error checking */ |
129 |
/* error checking */ |
| 130 |
if ((biBitCount!=1 && biBitCount!=4 && biBitCount!=8 && |
130 |
if ((biBitCount!=1 && biBitCount!=4 && biBitCount!=8 && |
| 131 |
biBitCount!=24 && biBitCount!=32) || |
131 |
biBitCount!=24 && biBitCount!=32) || |
| 132 |
biPlanes!=1 || biCompression>BI_RLE4) { |
132 |
biPlanes!=1 || biCompression>BI_RLE4 || |
|
|
133 |
biWidth<= 0 || biHeight <= 0 || |
| 134 |
(biClrUsed && biClrUsed > (1 << biBitCount))) { |
| 133 |
|
135 |
|
| 134 |
sprintf(buf,"Bogus BMP File! (bitCount=%d, Planes=%d, Compression=%d)", |
136 |
sprintf(buf,"Bogus BMP File! (bitCount=%d, Planes=%d, Compression=%d)", |
| 135 |
biBitCount, biPlanes, biCompression); |
137 |
biBitCount, biPlanes, biCompression); |
|
Lines 159-164
Link Here
|
| 159 |
|
161 |
|
| 160 |
bPad = bfOffBits - (biSize + 14); |
162 |
bPad = bfOffBits - (biSize + 14); |
| 161 |
} |
163 |
} |
|
|
164 |
|
| 165 |
if (biClrUsed > (1 << biBitCount)) |
| 166 |
biClrUsed = (1 << biBitCount); |
| 162 |
|
167 |
|
| 163 |
/* load up colormap, if any */ |
168 |
/* load up colormap, if any */ |
| 164 |
if (biBitCount!=24 && biBitCount!=32) { |
169 |
if (biBitCount!=24 && biBitCount!=32) { |
| 165 |
-- xviris.c |
|
|
|
Lines 267-272
Link Here
|
| 267 |
|
267 |
|
| 268 |
rlebuflen = 2 * xsize + 10; |
268 |
rlebuflen = 2 * xsize + 10; |
| 269 |
tablen = ysize * zsize; |
269 |
tablen = ysize * zsize; |
|
|
270 |
|
| 271 |
if (rlebuflen <= 0 || tablen <= 0 || (tablen * sizeof(long)) < 0) { |
| 272 |
loaderr = "Bogus IRIS File!"; |
| 273 |
return (byte *)NULL; |
| 274 |
} |
| 275 |
|
| 270 |
starttab = (u_long *) malloc((size_t) tablen * sizeof(long)); |
276 |
starttab = (u_long *) malloc((size_t) tablen * sizeof(long)); |
| 271 |
lengthtab = (u_long *) malloc((size_t) tablen * sizeof(long)); |
277 |
lengthtab = (u_long *) malloc((size_t) tablen * sizeof(long)); |
| 272 |
rledat = (byte *) malloc((size_t) rlebuflen); |
278 |
rledat = (byte *) malloc((size_t) rlebuflen); |
| 273 |
-- xvpcx.c |
|
|
|
Lines 222-228
Link Here
|
| 222 |
byte *image; |
222 |
byte *image; |
| 223 |
|
223 |
|
| 224 |
/* note: overallocation to make life easier... */ |
224 |
/* note: overallocation to make life easier... */ |
| 225 |
image = (byte *) malloc((size_t) (pinfo->h + 1) * pinfo->w + 16); |
225 |
int count = (pinfo->h + 1) * pinfo->w + 16; |
|
|
226 |
|
| 227 |
if (count <= 0 || pinfo->h <= 0 || pinfo->w <= 0) { |
| 228 |
pcxError(fname, "Bogus PCX file!!"); |
| 229 |
return (0); |
| 230 |
} |
| 231 |
|
| 232 |
image = (byte *) malloc((size_t) count); |
| 226 |
if (!image) FatalError("Can't alloc 'image' in pcxLoadImage8()"); |
233 |
if (!image) FatalError("Can't alloc 'image' in pcxLoadImage8()"); |
| 227 |
|
234 |
|
| 228 |
xvbzero((char *) image, (size_t) ((pinfo->h+1) * pinfo->w + 16)); |
235 |
xvbzero((char *) image, (size_t) ((pinfo->h+1) * pinfo->w + 16)); |
|
Lines 250-266
Link Here
|
| 250 |
{ |
257 |
{ |
| 251 |
byte *pix, *pic24, scale[256]; |
258 |
byte *pix, *pic24, scale[256]; |
| 252 |
int c, i, j, w, h, maxv, cnt, planes, bperlin, nbytes; |
259 |
int c, i, j, w, h, maxv, cnt, planes, bperlin, nbytes; |
|
|
260 |
int count; |
| 253 |
|
261 |
|
| 254 |
w = pinfo->w; h = pinfo->h; |
262 |
w = pinfo->w; h = pinfo->h; |
| 255 |
|
263 |
|
| 256 |
planes = (int) hdr[PCX_PLANES]; |
264 |
planes = (int) hdr[PCX_PLANES]; |
| 257 |
bperlin = hdr[PCX_BPRL] + ((int) hdr[PCX_BPRH]<<8); |
265 |
bperlin = hdr[PCX_BPRL] + ((int) hdr[PCX_BPRH]<<8); |
| 258 |
|
266 |
|
|
|
267 |
count = w*h*planes; |
| 268 |
|
| 269 |
if (count <= 0 || planes <= 0 || w <= 0 || h <= 0) { |
| 270 |
pcxError(fname, "Bogus PCX file!!"); |
| 271 |
return (0); |
| 272 |
} |
| 273 |
|
| 259 |
/* allocate 24-bit image */ |
274 |
/* allocate 24-bit image */ |
| 260 |
pic24 = (byte *) malloc((size_t) w*h*planes); |
275 |
pic24 = (byte *) malloc((size_t) count); |
| 261 |
if (!pic24) FatalError("couldn't malloc 'pic24'"); |
276 |
if (!pic24) FatalError("couldn't malloc 'pic24'"); |
| 262 |
|
277 |
|
| 263 |
xvbzero((char *) pic24, (size_t) w*h*planes); |
278 |
xvbzero((char *) pic24, (size_t) count); |
| 264 |
|
279 |
|
| 265 |
maxv = 0; |
280 |
maxv = 0; |
| 266 |
pix = pinfo->pic = pic24; |
281 |
pix = pinfo->pic = pic24; |
|
Lines 268-273
Link Here
|
| 268 |
j = 0; /* bytes per line, in this while loop */ |
283 |
j = 0; /* bytes per line, in this while loop */ |
| 269 |
nbytes = bperlin*h*planes; |
284 |
nbytes = bperlin*h*planes; |
| 270 |
|
285 |
|
|
|
286 |
if (nbytes < 0) { |
| 287 |
pcxError(fname, "Bogus PCX file!!"); |
| 288 |
free(pic24); |
| 289 |
return (0); |
| 290 |
} |
| 291 |
|
| 271 |
while (nbytes > 0 && (c = getc(fp)) != EOF) { |
292 |
while (nbytes > 0 && (c = getc(fp)) != EOF) { |
| 272 |
if ((c & 0xC0) == 0xC0) { /* have a rep. count */ |
293 |
if ((c & 0xC0) == 0xC0) { /* have a rep. count */ |
| 273 |
cnt = c & 0x3F; |
294 |
cnt = c & 0x3F; |
| 274 |
-- xvpm.c |
|
|
|
Lines 119-124
Link Here
|
| 119 |
|
119 |
|
| 120 |
isize = pm_isize(&thePic); |
120 |
isize = pm_isize(&thePic); |
| 121 |
|
121 |
|
|
|
122 |
if (isize <= 0) |
| 123 |
return pmError(bname, "Bogus PM file!!"); |
| 124 |
|
| 122 |
if (DEBUG) |
125 |
if (DEBUG) |
| 123 |
fprintf(stderr,"%s: LoadPM() - loading a %dx%d %s pic, %d planes\n", |
126 |
fprintf(stderr,"%s: LoadPM() - loading a %dx%d %s pic, %d planes\n", |
| 124 |
cmd, w, h, (thePic.pm_form==PM_I) ? "PM_I" : "PM_C", |
127 |
cmd, w, h, (thePic.pm_form==PM_I) ? "PM_I" : "PM_C", |
|
Lines 135-140
Link Here
|
| 135 |
return( pmError(bname, "file read error") ); |
138 |
return( pmError(bname, "file read error") ); |
| 136 |
} |
139 |
} |
| 137 |
|
140 |
|
|
|
141 |
if (thePic.pm_cmtsize+1 <= 0) |
| 142 |
return pmError(bname, "Bogus PM file!!"); |
| 138 |
|
143 |
|
| 139 |
/* alloc and read in comment, if any */ |
144 |
/* alloc and read in comment, if any */ |
| 140 |
if (thePic.pm_cmtsize>0) { |
145 |
if (thePic.pm_cmtsize>0) { |
|
Lines 155-160
Link Here
|
| 155 |
int *intptr; |
160 |
int *intptr; |
| 156 |
byte *pic24, *picptr; |
161 |
byte *pic24, *picptr; |
| 157 |
|
162 |
|
|
|
163 |
if (w <= 0 || h <= 0 || w*h*3 <= 0) |
| 164 |
return pmError(bname, "Bogus PM file!!"); |
| 165 |
|
| 158 |
if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) { |
166 |
if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) { |
| 159 |
if (thePic.pm_cmt) free(thePic.pm_cmt); |
167 |
if (thePic.pm_cmt) free(thePic.pm_cmt); |
| 160 |
return( pmError(bname, "unable to malloc 24-bit picture") ); |
168 |
return( pmError(bname, "unable to malloc 24-bit picture") ); |
|
Lines 189-194
Link Here
|
| 189 |
|
197 |
|
| 190 |
else if (thePic.pm_form == PM_C && thePic.pm_np>1) { |
198 |
else if (thePic.pm_form == PM_C && thePic.pm_np>1) { |
| 191 |
byte *pic24, *picptr, *rptr, *gptr, *bptr; |
199 |
byte *pic24, *picptr, *rptr, *gptr, *bptr; |
|
|
200 |
|
| 201 |
if (w <= 0 || h <= 0 || w*h*3 <= 0) |
| 202 |
return pmError(bname, "Bogus PM file!!"); |
| 192 |
|
203 |
|
| 193 |
if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) { |
204 |
if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) { |
| 194 |
if (thePic.pm_cmt) free(thePic.pm_cmt); |
205 |
if (thePic.pm_cmt) free(thePic.pm_cmt); |
