Link Here
|
39 |
unsigned int *used_size, XpmColor *colors, |
42 |
unsigned int *used_size, XpmColor *colors, |
40 |
unsigned int ncolors, unsigned int cpp)); |
43 |
unsigned int ncolors, unsigned int cpp)); |
41 |
|
44 |
|
42 |
LFUNC(WritePixels, void, (char *dataptr, unsigned int *used_size, |
45 |
LFUNC(WritePixels, void, (char *dataptr, unsigned int data_size, |
|
|
46 |
unsigned int *used_size, |
43 |
unsigned int width, unsigned int height, |
47 |
unsigned int width, unsigned int height, |
44 |
unsigned int cpp, unsigned int *pixels, |
48 |
unsigned int cpp, unsigned int *pixels, |
45 |
XpmColor *colors)); |
49 |
XpmColor *colors)); |
46 |
|
50 |
|
47 |
LFUNC(WriteExtensions, void, (char *dataptr, unsigned int *used_size, |
51 |
LFUNC(WriteExtensions, void, (char *dataptr, unsigned int data_size, |
|
|
52 |
unsigned int *used_size, |
48 |
XpmExtension *ext, unsigned int num)); |
53 |
XpmExtension *ext, unsigned int num)); |
49 |
|
54 |
|
50 |
LFUNC(ExtensionsSize, int, (XpmExtension *ext, unsigned int num)); |
55 |
LFUNC(ExtensionsSize, unsigned int, (XpmExtension *ext, unsigned int num)); |
51 |
LFUNC(CommentsSize, int, (XpmInfo *info)); |
56 |
LFUNC(CommentsSize, int, (XpmInfo *info)); |
52 |
|
57 |
|
53 |
int |
58 |
int |
Link Here
|
90 |
|
95 |
|
91 |
#undef RETURN |
96 |
#undef RETURN |
92 |
#define RETURN(status) \ |
97 |
#define RETURN(status) \ |
|
|
98 |
do \ |
93 |
{ \ |
99 |
{ \ |
94 |
ErrorStatus = status; \ |
100 |
ErrorStatus = status; \ |
95 |
goto error; \ |
101 |
goto error; \ |
96 |
} |
102 |
}while(0) |
97 |
|
103 |
|
98 |
int |
104 |
int |
99 |
XpmCreateBufferFromXpmImage(buffer_return, image, info) |
105 |
XpmCreateBufferFromXpmImage(buffer_return, image, info) |
Link Here
|
107 |
unsigned int cmts, extensions, ext_size = 0; |
113 |
unsigned int cmts, extensions, ext_size = 0; |
108 |
unsigned int l, cmt_size = 0; |
114 |
unsigned int l, cmt_size = 0; |
109 |
char *ptr = NULL, *p; |
115 |
char *ptr = NULL, *p; |
110 |
unsigned int ptr_size, used_size; |
116 |
unsigned int ptr_size, used_size, tmp; |
111 |
|
117 |
|
112 |
*buffer_return = NULL; |
118 |
*buffer_return = NULL; |
113 |
|
119 |
|
Link Here
|
129 |
#ifdef VOID_SPRINTF |
135 |
#ifdef VOID_SPRINTF |
130 |
used_size = strlen(buf); |
136 |
used_size = strlen(buf); |
131 |
#endif |
137 |
#endif |
132 |
ptr_size = used_size + ext_size + cmt_size + 1; |
138 |
ptr_size = used_size + ext_size + cmt_size + 1; /* ptr_size can't be 0 */ |
|
|
139 |
if(ptr_size <= used_size || |
140 |
ptr_size <= ext_size || |
141 |
ptr_size <= cmt_size) |
142 |
{ |
143 |
return XpmNoMemory; |
144 |
} |
133 |
ptr = (char *) XpmMalloc(ptr_size); |
145 |
ptr = (char *) XpmMalloc(ptr_size); |
134 |
if (!ptr) |
146 |
if (!ptr) |
135 |
return XpmNoMemory; |
147 |
return XpmNoMemory; |
Link Here
|
140 |
#ifndef VOID_SPRINTF |
152 |
#ifndef VOID_SPRINTF |
141 |
used_size += |
153 |
used_size += |
142 |
#endif |
154 |
#endif |
143 |
sprintf(ptr + used_size, "/*%s*/\n", info->hints_cmt); |
155 |
snprintf(ptr + used_size, ptr_size-used_size, "/*%s*/\n", info->hints_cmt); |
144 |
#ifdef VOID_SPRINTF |
156 |
#ifdef VOID_SPRINTF |
145 |
used_size += strlen(info->hints_cmt) + 5; |
157 |
used_size += strlen(info->hints_cmt) + 5; |
146 |
#endif |
158 |
#endif |
Link Here
|
158 |
#ifndef VOID_SPRINTF |
170 |
#ifndef VOID_SPRINTF |
159 |
l += |
171 |
l += |
160 |
#endif |
172 |
#endif |
161 |
sprintf(buf + l, " %d %d", info->x_hotspot, info->y_hotspot); |
173 |
snprintf(buf + l, sizeof(buf)-l, " %d %d", info->x_hotspot, info->y_hotspot); |
162 |
#ifdef VOID_SPRINTF |
174 |
#ifdef VOID_SPRINTF |
163 |
l = strlen(buf); |
175 |
l = strlen(buf); |
164 |
#endif |
176 |
#endif |
Link Here
|
180 |
l = strlen(buf); |
192 |
l = strlen(buf); |
181 |
#endif |
193 |
#endif |
182 |
ptr_size += l; |
194 |
ptr_size += l; |
|
|
195 |
if(ptr_size <= l) |
196 |
RETURN(XpmNoMemory); |
183 |
p = (char *) XpmRealloc(ptr, ptr_size); |
197 |
p = (char *) XpmRealloc(ptr, ptr_size); |
184 |
if (!p) |
198 |
if (!p) |
185 |
RETURN(XpmNoMemory); |
199 |
RETURN(XpmNoMemory); |
Link Here
|
192 |
#ifndef VOID_SPRINTF |
206 |
#ifndef VOID_SPRINTF |
193 |
used_size += |
207 |
used_size += |
194 |
#endif |
208 |
#endif |
195 |
sprintf(ptr + used_size, "/*%s*/\n", info->colors_cmt); |
209 |
snprintf(ptr + used_size, ptr_size-used_size, "/*%s*/\n", info->colors_cmt); |
196 |
#ifdef VOID_SPRINTF |
210 |
#ifdef VOID_SPRINTF |
197 |
used_size += strlen(info->colors_cmt) + 5; |
211 |
used_size += strlen(info->colors_cmt) + 5; |
198 |
#endif |
212 |
#endif |
Link Here
|
208 |
* 4 = 1 (for '"') + 3 (for '",\n') |
222 |
* 4 = 1 (for '"') + 3 (for '",\n') |
209 |
* 1 = - 2 (because the last line does not end with ',\n') + 3 (for '};\n') |
223 |
* 1 = - 2 (because the last line does not end with ',\n') + 3 (for '};\n') |
210 |
*/ |
224 |
*/ |
211 |
ptr_size += image->height * (image->width * image->cpp + 4) + 1; |
225 |
if(image->width > UINT_MAX / image->cpp || |
|
|
226 |
(tmp = image->width * image->cpp + 4) <= 4 || |
227 |
image->height > UINT_MAX / tmp || |
228 |
(tmp = image->height * tmp + 1) <= 1 || |
229 |
(ptr_size += tmp) <= tmp) |
230 |
RETURN(XpmNoMemory); |
212 |
|
231 |
|
213 |
p = (char *) XpmRealloc(ptr, ptr_size); |
232 |
p = (char *) XpmRealloc(ptr, ptr_size); |
214 |
if (!p) |
233 |
if (!p) |
Link Here
|
220 |
#ifndef VOID_SPRINTF |
239 |
#ifndef VOID_SPRINTF |
221 |
used_size += |
240 |
used_size += |
222 |
#endif |
241 |
#endif |
223 |
sprintf(ptr + used_size, "/*%s*/\n", info->pixels_cmt); |
242 |
snprintf(ptr + used_size, ptr_size-used_size, "/*%s*/\n", info->pixels_cmt); |
224 |
#ifdef VOID_SPRINTF |
243 |
#ifdef VOID_SPRINTF |
225 |
used_size += strlen(info->pixels_cmt) + 5; |
244 |
used_size += strlen(info->pixels_cmt) + 5; |
226 |
#endif |
245 |
#endif |
227 |
} |
246 |
} |
228 |
WritePixels(ptr + used_size, &used_size, image->width, image->height, |
247 |
WritePixels(ptr + used_size, ptr_size - used_size, &used_size, image->width, image->height, |
229 |
image->cpp, image->data, image->colorTable); |
248 |
image->cpp, image->data, image->colorTable); |
230 |
|
249 |
|
231 |
/* print extensions */ |
250 |
/* print extensions */ |
232 |
if (extensions) |
251 |
if (extensions) |
233 |
WriteExtensions(ptr + used_size, &used_size, |
252 |
WriteExtensions(ptr + used_size, ptr_size-used_size, &used_size, |
234 |
info->extensions, info->nextensions); |
253 |
info->extensions, info->nextensions); |
235 |
|
254 |
|
236 |
/* close the array */ |
255 |
/* close the array */ |
Link Here
|
247 |
return (ErrorStatus); |
266 |
return (ErrorStatus); |
248 |
} |
267 |
} |
249 |
|
268 |
|
|
|
269 |
|
250 |
static int |
270 |
static int |
251 |
WriteColors(dataptr, data_size, used_size, colors, ncolors, cpp) |
271 |
WriteColors(dataptr, data_size, used_size, colors, ncolors, cpp) |
252 |
char **dataptr; |
272 |
char **dataptr; |
Link Here
|
256 |
unsigned int ncolors; |
276 |
unsigned int ncolors; |
257 |
unsigned int cpp; |
277 |
unsigned int cpp; |
258 |
{ |
278 |
{ |
259 |
char buf[BUFSIZ]; |
279 |
char buf[BUFSIZ] = {0}; |
260 |
unsigned int a, key, l; |
280 |
unsigned int a, key, l; |
261 |
char *s, *s2; |
281 |
char *s, *s2; |
262 |
char **defaults; |
282 |
char **defaults; |
Link Here
|
266 |
|
286 |
|
267 |
defaults = (char **) colors; |
287 |
defaults = (char **) colors; |
268 |
s = buf + 1; |
288 |
s = buf + 1; |
|
|
289 |
if(cpp > (sizeof(buf) - (s-buf))) |
290 |
return(XpmNoMemory); |
269 |
strncpy(s, *defaults++, cpp); |
291 |
strncpy(s, *defaults++, cpp); |
270 |
s += cpp; |
292 |
s += cpp; |
271 |
|
293 |
|
Link Here
|
274 |
#ifndef VOID_SPRINTF |
296 |
#ifndef VOID_SPRINTF |
275 |
s += |
297 |
s += |
276 |
#endif |
298 |
#endif |
277 |
sprintf(s, "\t%s %s", xpmColorKeys[key - 1], s2); |
299 |
/* assume C99 compliance */ |
|
|
300 |
snprintf(s, sizeof(buf) - (s-buf), "\t%s %s", xpmColorKeys[key - 1], s2); |
278 |
#ifdef VOID_SPRINTF |
301 |
#ifdef VOID_SPRINTF |
279 |
s += strlen(s); |
302 |
s += strlen(s); |
280 |
#endif |
303 |
#endif |
|
|
304 |
/* now let's check if s points out-of-bounds */ |
305 |
if((s-buf) > sizeof(buf)) |
306 |
return(XpmNoMemory); |
281 |
} |
307 |
} |
282 |
} |
308 |
} |
|
|
309 |
if(sizeof(buf) - (s-buf) < 4) |
310 |
return(XpmNoMemory); |
283 |
strcpy(s, "\",\n"); |
311 |
strcpy(s, "\",\n"); |
284 |
l = s + 3 - buf; |
312 |
l = s + 3 - buf; |
|
|
313 |
if( *data_size >= UINT_MAX-l || |
314 |
*data_size + l <= *used_size || |
315 |
(*data_size + l - *used_size) <= sizeof(buf)) |
316 |
return(XpmNoMemory); |
285 |
s = (char *) XpmRealloc(*dataptr, *data_size + l); |
317 |
s = (char *) XpmRealloc(*dataptr, *data_size + l); |
286 |
if (!s) |
318 |
if (!s) |
287 |
return (XpmNoMemory); |
319 |
return (XpmNoMemory); |
Link Here
|
294 |
} |
326 |
} |
295 |
|
327 |
|
296 |
static void |
328 |
static void |
297 |
WritePixels(dataptr, used_size, width, height, cpp, pixels, colors) |
329 |
WritePixels(dataptr, data_size, used_size, width, height, cpp, pixels, colors) |
298 |
char *dataptr; |
330 |
char *dataptr; |
|
|
331 |
unsigned int data_size; |
299 |
unsigned int *used_size; |
332 |
unsigned int *used_size; |
300 |
unsigned int width; |
333 |
unsigned int width; |
301 |
unsigned int height; |
334 |
unsigned int height; |
Link Here
|
306 |
char *s = dataptr; |
339 |
char *s = dataptr; |
307 |
unsigned int x, y, h; |
340 |
unsigned int x, y, h; |
308 |
|
341 |
|
|
|
342 |
if(height <= 1) |
343 |
return; |
344 |
|
309 |
h = height - 1; |
345 |
h = height - 1; |
310 |
for (y = 0; y < h; y++) { |
346 |
for (y = 0; y < h; y++) { |
311 |
*s++ = '"'; |
347 |
*s++ = '"'; |
312 |
for (x = 0; x < width; x++, pixels++) { |
348 |
for (x = 0; x < width; x++, pixels++) { |
313 |
strncpy(s, colors[*pixels].string, cpp); |
349 |
if(cpp >= (data_size - (s-dataptr))) |
|
|
350 |
return; |
351 |
strncpy(s, colors[*pixels].string, cpp); /* how can we trust *pixels? :-\ */ |
314 |
s += cpp; |
352 |
s += cpp; |
315 |
} |
353 |
} |
|
|
354 |
if((data_size - (s-dataptr)) < 4) |
355 |
return; |
316 |
strcpy(s, "\",\n"); |
356 |
strcpy(s, "\",\n"); |
317 |
s += 3; |
357 |
s += 3; |
318 |
} |
358 |
} |
319 |
/* duplicate some code to avoid a test in the loop */ |
359 |
/* duplicate some code to avoid a test in the loop */ |
320 |
*s++ = '"'; |
360 |
*s++ = '"'; |
321 |
for (x = 0; x < width; x++, pixels++) { |
361 |
for (x = 0; x < width; x++, pixels++) { |
322 |
strncpy(s, colors[*pixels].string, cpp); |
362 |
if(cpp >= (data_size - (s-dataptr))) |
|
|
363 |
return; |
364 |
strncpy(s, colors[*pixels].string, cpp); /* how can we trust *pixels? */ |
323 |
s += cpp; |
365 |
s += cpp; |
324 |
} |
366 |
} |
325 |
*s++ = '"'; |
367 |
*s++ = '"'; |
326 |
*used_size += s - dataptr; |
368 |
*used_size += s - dataptr; |
327 |
} |
369 |
} |
328 |
|
370 |
|
329 |
static int |
371 |
static unsigned int |
330 |
ExtensionsSize(ext, num) |
372 |
ExtensionsSize(ext, num) |
331 |
XpmExtension *ext; |
373 |
XpmExtension *ext; |
332 |
unsigned int num; |
374 |
unsigned int num; |
Link Here
|
335 |
char **line; |
377 |
char **line; |
336 |
|
378 |
|
337 |
size = 0; |
379 |
size = 0; |
|
|
380 |
if(num == 0) |
381 |
return(0); /* ok? */ |
338 |
for (x = 0; x < num; x++, ext++) { |
382 |
for (x = 0; x < num; x++, ext++) { |
339 |
/* 11 = 10 (for ',\n"XPMEXT ') + 1 (for '"') */ |
383 |
/* 11 = 10 (for ',\n"XPMEXT ') + 1 (for '"') */ |
340 |
size += strlen(ext->name) + 11; |
384 |
size += strlen(ext->name) + 11; |
341 |
a = ext->nlines; |
385 |
a = ext->nlines; /* how can we trust ext->nlines to be not out-of-bounds? */ |
342 |
for (y = 0, line = ext->lines; y < a; y++, line++) |
386 |
for (y = 0, line = ext->lines; y < a; y++, line++) |
343 |
/* 4 = 3 (for ',\n"') + 1 (for '"') */ |
387 |
/* 4 = 3 (for ',\n"') + 1 (for '"') */ |
344 |
size += strlen(*line) + 4; |
388 |
size += strlen(*line) + 4; |
345 |
} |
389 |
} |
346 |
/* 13 is for ',\n"XPMENDEXT"' */ |
390 |
/* 13 is for ',\n"XPMENDEXT"' */ |
|
|
391 |
if(size > UINT_MAX - 13) /* unlikely */ |
392 |
return(0); |
347 |
return size + 13; |
393 |
return size + 13; |
348 |
} |
394 |
} |
349 |
|
395 |
|
350 |
static void |
396 |
static void |
351 |
WriteExtensions(dataptr, used_size, ext, num) |
397 |
WriteExtensions(dataptr, data_size, used_size, ext, num) |
352 |
char *dataptr; |
398 |
char *dataptr; |
|
|
399 |
unsigned int data_size; |
353 |
unsigned int *used_size; |
400 |
unsigned int *used_size; |
354 |
XpmExtension *ext; |
401 |
XpmExtension *ext; |
355 |
unsigned int num; |
402 |
unsigned int num; |
Link Here
|
362 |
#ifndef VOID_SPRINTF |
409 |
#ifndef VOID_SPRINTF |
363 |
s += |
410 |
s += |
364 |
#endif |
411 |
#endif |
365 |
sprintf(s, ",\n\"XPMEXT %s\"", ext->name); |
412 |
snprintf(s, data_size - (s-dataptr), ",\n\"XPMEXT %s\"", ext->name); |
366 |
#ifdef VOID_SPRINTF |
413 |
#ifdef VOID_SPRINTF |
367 |
s += strlen(ext->name) + 11; |
414 |
s += strlen(ext->name) + 11; |
368 |
#endif |
415 |
#endif |
Link Here
|
371 |
#ifndef VOID_SPRINTF |
418 |
#ifndef VOID_SPRINTF |
372 |
s += |
419 |
s += |
373 |
#endif |
420 |
#endif |
374 |
sprintf(s, ",\n\"%s\"", *line); |
421 |
snprintf(s, data_size - (s-dataptr), ",\n\"%s\"", *line); |
375 |
#ifdef VOID_SPRINTF |
422 |
#ifdef VOID_SPRINTF |
376 |
s += strlen(*line) + 4; |
423 |
s += strlen(*line) + 4; |
377 |
#endif |
424 |
#endif |
378 |
} |
425 |
} |
379 |
} |
426 |
} |
380 |
strcpy(s, ",\n\"XPMENDEXT\""); |
427 |
strncpy(s, ",\n\"XPMENDEXT\"", data_size - (s-dataptr)-1); |
381 |
*used_size += s - dataptr + 13; |
428 |
*used_size += s - dataptr + 13; |
382 |
} |
429 |
} |
383 |
|
430 |
|
Link Here
|
388 |
int size = 0; |
435 |
int size = 0; |
389 |
|
436 |
|
390 |
/* 5 = 2 (for "/_*") + 3 (for "*_/\n") */ |
437 |
/* 5 = 2 (for "/_*") + 3 (for "*_/\n") */ |
|
|
438 |
/* wrap possible but *very* unlikely */ |
391 |
if (info->hints_cmt) |
439 |
if (info->hints_cmt) |
392 |
size += 5 + strlen(info->hints_cmt); |
440 |
size += 5 + strlen(info->hints_cmt); |
393 |
|
441 |
|