Line
Link Here
|
|
-- xvbmp.c |
|
|
Lines 129-135
Link Here
|
129 |
/* error checking */ |
129 |
/* error checking */ |
130 |
if ((biBitCount!=1 && biBitCount!=4 && biBitCount!=8 && |
130 |
if ((biBitCount!=1 && biBitCount!=4 && biBitCount!=8 && |
131 |
biBitCount!=24 && biBitCount!=32) || |
131 |
biBitCount!=24 && biBitCount!=32) || |
132 |
biPlanes!=1 || biCompression>BI_RLE4) { |
132 |
biPlanes!=1 || biCompression>BI_RLE4 || |
|
|
133 |
biWidth<= 0 || biHeight <= 0 || |
134 |
(biClrUsed && biClrUsed > (1 << biBitCount))) { |
133 |
|
135 |
|
134 |
sprintf(buf,"Bogus BMP File! (bitCount=%d, Planes=%d, Compression=%d)", |
136 |
sprintf(buf,"Bogus BMP File! (bitCount=%d, Planes=%d, Compression=%d)", |
135 |
biBitCount, biPlanes, biCompression); |
137 |
biBitCount, biPlanes, biCompression); |
Lines 159-164
Link Here
|
159 |
|
161 |
|
160 |
bPad = bfOffBits - (biSize + 14); |
162 |
bPad = bfOffBits - (biSize + 14); |
161 |
} |
163 |
} |
|
|
164 |
|
165 |
if (biClrUsed > (1 << biBitCount)) |
166 |
biClrUsed = (1 << biBitCount); |
162 |
|
167 |
|
163 |
/* load up colormap, if any */ |
168 |
/* load up colormap, if any */ |
164 |
if (biBitCount!=24 && biBitCount!=32) { |
169 |
if (biBitCount!=24 && biBitCount!=32) { |
165 |
-- xviris.c |
|
|
Lines 267-272
Link Here
|
267 |
|
267 |
|
268 |
rlebuflen = 2 * xsize + 10; |
268 |
rlebuflen = 2 * xsize + 10; |
269 |
tablen = ysize * zsize; |
269 |
tablen = ysize * zsize; |
|
|
270 |
|
271 |
if (rlebuflen <= 0 || tablen <= 0 || (tablen * sizeof(long)) < 0) { |
272 |
loaderr = "Bogus IRIS File!"; |
273 |
return (byte *)NULL; |
274 |
} |
275 |
|
270 |
starttab = (u_long *) malloc((size_t) tablen * sizeof(long)); |
276 |
starttab = (u_long *) malloc((size_t) tablen * sizeof(long)); |
271 |
lengthtab = (u_long *) malloc((size_t) tablen * sizeof(long)); |
277 |
lengthtab = (u_long *) malloc((size_t) tablen * sizeof(long)); |
272 |
rledat = (byte *) malloc((size_t) rlebuflen); |
278 |
rledat = (byte *) malloc((size_t) rlebuflen); |
273 |
-- xvpcx.c |
|
|
Lines 222-228
Link Here
|
222 |
byte *image; |
222 |
byte *image; |
223 |
|
223 |
|
224 |
/* note: overallocation to make life easier... */ |
224 |
/* note: overallocation to make life easier... */ |
225 |
image = (byte *) malloc((size_t) (pinfo->h + 1) * pinfo->w + 16); |
225 |
int count = (pinfo->h + 1) * pinfo->w + 16; |
|
|
226 |
|
227 |
if (count <= 0 || pinfo->h <= 0 || pinfo->w <= 0) { |
228 |
pcxError(fname, "Bogus PCX file!!"); |
229 |
return (0); |
230 |
} |
231 |
|
232 |
image = (byte *) malloc((size_t) count); |
226 |
if (!image) FatalError("Can't alloc 'image' in pcxLoadImage8()"); |
233 |
if (!image) FatalError("Can't alloc 'image' in pcxLoadImage8()"); |
227 |
|
234 |
|
228 |
xvbzero((char *) image, (size_t) ((pinfo->h+1) * pinfo->w + 16)); |
235 |
xvbzero((char *) image, (size_t) ((pinfo->h+1) * pinfo->w + 16)); |
Lines 250-266
Link Here
|
250 |
{ |
257 |
{ |
251 |
byte *pix, *pic24, scale[256]; |
258 |
byte *pix, *pic24, scale[256]; |
252 |
int c, i, j, w, h, maxv, cnt, planes, bperlin, nbytes; |
259 |
int c, i, j, w, h, maxv, cnt, planes, bperlin, nbytes; |
|
|
260 |
int count; |
253 |
|
261 |
|
254 |
w = pinfo->w; h = pinfo->h; |
262 |
w = pinfo->w; h = pinfo->h; |
255 |
|
263 |
|
256 |
planes = (int) hdr[PCX_PLANES]; |
264 |
planes = (int) hdr[PCX_PLANES]; |
257 |
bperlin = hdr[PCX_BPRL] + ((int) hdr[PCX_BPRH]<<8); |
265 |
bperlin = hdr[PCX_BPRL] + ((int) hdr[PCX_BPRH]<<8); |
258 |
|
266 |
|
|
|
267 |
count = w*h*planes; |
268 |
|
269 |
if (count <= 0 || planes <= 0 || w <= 0 || h <= 0) { |
270 |
pcxError(fname, "Bogus PCX file!!"); |
271 |
return (0); |
272 |
} |
273 |
|
259 |
/* allocate 24-bit image */ |
274 |
/* allocate 24-bit image */ |
260 |
pic24 = (byte *) malloc((size_t) w*h*planes); |
275 |
pic24 = (byte *) malloc((size_t) count); |
261 |
if (!pic24) FatalError("couldn't malloc 'pic24'"); |
276 |
if (!pic24) FatalError("couldn't malloc 'pic24'"); |
262 |
|
277 |
|
263 |
xvbzero((char *) pic24, (size_t) w*h*planes); |
278 |
xvbzero((char *) pic24, (size_t) count); |
264 |
|
279 |
|
265 |
maxv = 0; |
280 |
maxv = 0; |
266 |
pix = pinfo->pic = pic24; |
281 |
pix = pinfo->pic = pic24; |
Lines 268-273
Link Here
|
268 |
j = 0; /* bytes per line, in this while loop */ |
283 |
j = 0; /* bytes per line, in this while loop */ |
269 |
nbytes = bperlin*h*planes; |
284 |
nbytes = bperlin*h*planes; |
270 |
|
285 |
|
|
|
286 |
if (nbytes < 0) { |
287 |
pcxError(fname, "Bogus PCX file!!"); |
288 |
free(pic24); |
289 |
return (0); |
290 |
} |
291 |
|
271 |
while (nbytes > 0 && (c = getc(fp)) != EOF) { |
292 |
while (nbytes > 0 && (c = getc(fp)) != EOF) { |
272 |
if ((c & 0xC0) == 0xC0) { /* have a rep. count */ |
293 |
if ((c & 0xC0) == 0xC0) { /* have a rep. count */ |
273 |
cnt = c & 0x3F; |
294 |
cnt = c & 0x3F; |
274 |
-- xvpm.c |
|
|
Lines 119-124
Link Here
|
119 |
|
119 |
|
120 |
isize = pm_isize(&thePic); |
120 |
isize = pm_isize(&thePic); |
121 |
|
121 |
|
|
|
122 |
if (isize <= 0) |
123 |
return pmError(bname, "Bogus PM file!!"); |
124 |
|
122 |
if (DEBUG) |
125 |
if (DEBUG) |
123 |
fprintf(stderr,"%s: LoadPM() - loading a %dx%d %s pic, %d planes\n", |
126 |
fprintf(stderr,"%s: LoadPM() - loading a %dx%d %s pic, %d planes\n", |
124 |
cmd, w, h, (thePic.pm_form==PM_I) ? "PM_I" : "PM_C", |
127 |
cmd, w, h, (thePic.pm_form==PM_I) ? "PM_I" : "PM_C", |
Lines 135-140
Link Here
|
135 |
return( pmError(bname, "file read error") ); |
138 |
return( pmError(bname, "file read error") ); |
136 |
} |
139 |
} |
137 |
|
140 |
|
|
|
141 |
if (thePic.pm_cmtsize+1 <= 0) |
142 |
return pmError(bname, "Bogus PM file!!"); |
138 |
|
143 |
|
139 |
/* alloc and read in comment, if any */ |
144 |
/* alloc and read in comment, if any */ |
140 |
if (thePic.pm_cmtsize>0) { |
145 |
if (thePic.pm_cmtsize>0) { |
Lines 155-160
Link Here
|
155 |
int *intptr; |
160 |
int *intptr; |
156 |
byte *pic24, *picptr; |
161 |
byte *pic24, *picptr; |
157 |
|
162 |
|
|
|
163 |
if (w <= 0 || h <= 0 || w*h*3 <= 0) |
164 |
return pmError(bname, "Bogus PM file!!"); |
165 |
|
158 |
if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) { |
166 |
if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) { |
159 |
if (thePic.pm_cmt) free(thePic.pm_cmt); |
167 |
if (thePic.pm_cmt) free(thePic.pm_cmt); |
160 |
return( pmError(bname, "unable to malloc 24-bit picture") ); |
168 |
return( pmError(bname, "unable to malloc 24-bit picture") ); |
Lines 189-194
Link Here
|
189 |
|
197 |
|
190 |
else if (thePic.pm_form == PM_C && thePic.pm_np>1) { |
198 |
else if (thePic.pm_form == PM_C && thePic.pm_np>1) { |
191 |
byte *pic24, *picptr, *rptr, *gptr, *bptr; |
199 |
byte *pic24, *picptr, *rptr, *gptr, *bptr; |
|
|
200 |
|
201 |
if (w <= 0 || h <= 0 || w*h*3 <= 0) |
202 |
return pmError(bname, "Bogus PM file!!"); |
192 |
|
203 |
|
193 |
if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) { |
204 |
if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) { |
194 |
if (thePic.pm_cmt) free(thePic.pm_cmt); |
205 |
if (thePic.pm_cmt) free(thePic.pm_cmt); |