Attachment #39702 for bug #64230

Lines 330-335 DecodeHeader (guchar *Data, gint Bytes, Link Here

(-)gdk-pixbuf-0.22.0.orig/gdk-pixbuf/io-ico.c (+3 lines)
330		330
331	State->HeaderSize+=I;	331	State->HeaderSize+=I;
332		332
		333	if (State->HeaderSize < 0)
		334	return FALSE;
		335
333	if (State->HeaderSize>State->BytesInHeaderBuf) {	336	if (State->HeaderSize>State->BytesInHeaderBuf) {
334	guchar *tmp=realloc(State->HeaderBuf,State->HeaderSize);	337	guchar *tmp=realloc(State->HeaderBuf,State->HeaderSize);
335	if (!tmp)	338	if (!tmp)




			break;
		else {
			if (numnames > 0) {
				strncat (color, " ", space);
				space -= MIN (space, 1);
			}

			strncat (color, temp, space);

		return NULL;
	}
	sscanf (buffer, "%d %d %d %d", &w, &h, &n_col, &cpp);
	if (cpp <= 0 || cpp >= 32) {
		g_warning ("XPM has invalid number of chars per pixel");
		return NULL;
	}
	if (n_col <= 0 || n_col >= G_MAXINT / (cpp + 1)) {
		g_warning ("XPM file has invalid number of colors");
		return NULL;
	}

	/* The hash is used for fast lookups of color from chars */
	color_hash = g_hash_table_new (g_str_hash, g_str_equal);

	name_buf = g_try_malloc (n_col * (cpp + 1));
	if (!name_buf) {
		g_warning ("Cannot allocate memory for loading XPM image");
		g_hash_table_destroy (color_hash);
		return NULL;
	}
	colors = malloc (sizeof (_XPMColor) * n_col);
	if (!colors) {
		g_warning ("Cannot allocate memory for loading XPM image");
		g_hash_table_destroy (color_hash);
		g_free (name_buf);
		return NULL;
	}

	for (cnt = 0; cnt < n_col; cnt++) {
		gchar *color_name;

Return to bug 64230

Lines 243-250 xpm_extract_color (const gchar *buffer) Link Here

(-)gdk-pixbuf-0.22.0.orig/gdk-pixbuf/io-xpm.c (-6 / +21 lines)
243	break;	243	break;
244	else {	244	else {
245	if (numnames > 0) {	245	if (numnames > 0) {
246	space -= 1;	246	strncat (color, " ", space);
247	strcat (color, " ");	247	space -= MIN (space, 1);
248	}	248	}
249		249
250	strncat (color, temp, space);	250	strncat (color, temp, space);
Lines 352-367 pixbuf_create_from_xpm (const gchar * (* Link Here
352	return NULL;	352	return NULL;
353	}	353	}
354	sscanf (buffer, "%d %d %d %d", &w, &h, &n_col, &cpp);	354	sscanf (buffer, "%d %d %d %d", &w, &h, &n_col, &cpp);
355	if (cpp >= 32) {	355	if (cpp <= 0 \|\| cpp >= 32) {
356	g_warning ("XPM has more than 31 chars per pixel.");	356	g_warning ("XPM has invalid number of chars per pixel");
		357	return NULL;
		358	}
		359	if (n_col <= 0 \|\| n_col >= G_MAXINT / (cpp + 1)) {
		360	g_warning ("XPM file has invalid number of colors");
357	return NULL;	361	return NULL;
358	}	362	}
359		363
360	/* The hash is used for fast lookups of color from chars */	364	/* The hash is used for fast lookups of color from chars */
361	color_hash = g_hash_table_new (g_str_hash, g_str_equal);	365	color_hash = g_hash_table_new (g_str_hash, g_str_equal);
362		366
363	name_buf = g_new (gchar, n_col * (cpp + 1));	367	name_buf = g_try_malloc (n_col * (cpp + 1));
364	colors = g_new (_XPMColor, n_col);	368	if (!name_buf) {
		369	g_warning ("Cannot allocate memory for loading XPM image");
		370	g_hash_table_destroy (color_hash);
		371	return NULL;
		372	}
		373	colors = malloc (sizeof (_XPMColor) * n_col);
		374	if (!colors) {
		375	g_warning ("Cannot allocate memory for loading XPM image");
		376	g_hash_table_destroy (color_hash);
		377	g_free (name_buf);
		378	return NULL;
		379	}
365		380
366	for (cnt = 0; cnt < n_col; cnt++) {	381	for (cnt = 0; cnt < n_col; cnt++) {
367	gchar *color_name;	382	gchar *color_name;