Lines 330-339
static void DecodeHeader(guchar *Data, gint Bytes,
Link Here
|
330 |
return; |
330 |
return; |
331 |
} |
331 |
} |
332 |
|
332 |
|
333 |
/* We know how many bytes are in the "header" part. */ |
333 |
/* Avoid invoking undefined behavior in the State->HeaderSize calculation below */ |
334 |
State->HeaderSize = entry->DIBoffset + INFOHEADER_SIZE; |
334 |
if (entry->DIBoffset > G_MAXINT - INFOHEADER_SIZE) { |
335 |
|
|
|
336 |
if (State->HeaderSize < 0) { |
337 |
g_set_error (error, |
335 |
g_set_error (error, |
338 |
GDK_PIXBUF_ERROR, |
336 |
GDK_PIXBUF_ERROR, |
339 |
GDK_PIXBUF_ERROR_CORRUPT_IMAGE, |
337 |
GDK_PIXBUF_ERROR_CORRUPT_IMAGE, |
Lines 341-346
static void DecodeHeader(guchar *Data, gint Bytes,
Link Here
|
341 |
return; |
339 |
return; |
342 |
} |
340 |
} |
343 |
|
341 |
|
|
|
342 |
/* We know how many bytes are in the "header" part. */ |
343 |
State->HeaderSize = entry->DIBoffset + INFOHEADER_SIZE; |
344 |
|
344 |
if (State->HeaderSize>State->BytesInHeaderBuf) { |
345 |
if (State->HeaderSize>State->BytesInHeaderBuf) { |
345 |
guchar *tmp=g_try_realloc(State->HeaderBuf,State->HeaderSize); |
346 |
guchar *tmp=g_try_realloc(State->HeaderBuf,State->HeaderSize); |
346 |
if (!tmp) { |
347 |
if (!tmp) { |