Attachment #39049 for bug #62487




  fread(dbuf, 4, 2, file);
  *w = (int)dbuf[0];
  *h = (int)dbuf[1];
  if ((*w < 0) || (*w > 32767))
    {
      fprintf(stderr, "IMLIB ERROR: Image width > 32767 pixels for file\n");
      return NULL;
    }
  if ((*h > 32767) || (*h < 0))
    {
      fprintf(stderr, "IMLIB ERROR: Image height > 32767 pixels for file\n");
      return NULL;

  ncolors = (int)dbuf[0];
  if (ncolors == 0)
    ncolors = 1 << bpp;

  if ((ncolors > (1 << bpp)) || (ncolors < 0))
    ncolors = 1 << bpp;

  /* some more sanity checks */
  if (((comp == BI_RLE4) && (bpp != 4)) || ((comp == BI_RLE8) && (bpp != 8)) || ((comp == BI_BITFIELDS) && (bpp != 16 && bpp != 32)))
    {

Return to bug 62487

Lines 42-53 Link Here

(-)imlib-1.9.14/gdk_imlib/io-bmp.c.fix (-2 / +6 lines)
42	fread(dbuf, 4, 2, file);	42	fread(dbuf, 4, 2, file);
43	*w = (int)dbuf[0];	43	*w = (int)dbuf[0];
44	*h = (int)dbuf[1];	44	*h = (int)dbuf[1];
45	if (*w > 32767)	45	if ((w < 0) \|\| (w > 32767))
46	{	46	{
47	fprintf(stderr, "IMLIB ERROR: Image width > 32767 pixels for file\n");	47	fprintf(stderr, "IMLIB ERROR: Image width > 32767 pixels for file\n");
48	return NULL;	48	return NULL;
49	}	49	}
50	if (*h > 32767)	50	if ((h > 32767) \|\| (h < 0))
51	{	51	{
52	fprintf(stderr, "IMLIB ERROR: Image height > 32767 pixels for file\n");	52	fprintf(stderr, "IMLIB ERROR: Image height > 32767 pixels for file\n");
53	return NULL;	53	return NULL;
Lines 72-77 Link Here
72	ncolors = (int)dbuf[0];	72	ncolors = (int)dbuf[0];
73	if (ncolors == 0)	73	if (ncolors == 0)
74	ncolors = 1 << bpp;	74	ncolors = 1 << bpp;
		75
		76	if ((ncolors > (1 << bpp)) \|\| (ncolors < 0))
		77	ncolors = 1 << bpp;
		78
75	/* some more sanity checks */	79	/* some more sanity checks */
76	if (((comp == BI_RLE4) && (bpp != 4)) \|\| ((comp == BI_RLE8) && (bpp != 8)) \|\| ((comp == BI_BITFIELDS) && (bpp != 16 && bpp != 32)))	80	if (((comp == BI_RLE4) && (bpp != 4)) \|\| ((comp == BI_RLE8) && (bpp != 8)) \|\| ((comp == BI_BITFIELDS) && (bpp != 16 && bpp != 32)))
77	{	81	{