Attachment #48793 for bug #78111

Lines 93-99 Link Here

(-)motif/lib/Xm/Xpmscan.c.XPM (-3 / +15 lines)
93	LFUNC(ScanTransparentColor, int, (XpmColor *color, unsigned int cpp,	93	LFUNC(ScanTransparentColor, int, (XpmColor *color, unsigned int cpp,
94	XpmAttributes *attributes));	94	XpmAttributes *attributes));
95		95
96	LFUNC(ScanOtherColors, int, (Display display, XpmColor colors, int ncolors,	96	LFUNC(ScanOtherColors, int, (Display display, XpmColor colors,
		97	unsigned int ncolors,
97	Pixel *pixels, unsigned int mask,	98	Pixel *pixels, unsigned int mask,
98	unsigned int cpp, XpmAttributes *attributes));	99	unsigned int cpp, XpmAttributes *attributes));
99		100
Lines 220-230 Link Here
220	else	221	else
221	cpp = 0;	222	cpp = 0;
222		223
		224	if ((height > 0 && width >= SIZE_MAX / height) \|\|
		225	width * height >= SIZE_MAX / sizeof(unsigned int))
		226	RETURN(XpmNoMemory);
223	pmap.pixelindex =	227	pmap.pixelindex =
224	(unsigned int ) XpmCalloc(width height, sizeof(unsigned int));	228	(unsigned int ) XpmCalloc(width height, sizeof(unsigned int));
225	if (!pmap.pixelindex)	229	if (!pmap.pixelindex)
226	RETURN(XpmNoMemory);	230	RETURN(XpmNoMemory);
227		231
		232	if (pmap.size >= SIZE_MAX / sizeof(Pixel))
		233	RETURN(XpmNoMemory);
		234
228	pmap.pixels = (Pixel ) XpmMalloc(sizeof(Pixel) pmap.size);	235	pmap.pixels = (Pixel ) XpmMalloc(sizeof(Pixel) pmap.size);
229	if (!pmap.pixels)	236	if (!pmap.pixels)
230	RETURN(XpmNoMemory);	237	RETURN(XpmNoMemory);
Lines 279-285 Link Here
279	* get rgb values and a string of char, and possibly a name for each	286	* get rgb values and a string of char, and possibly a name for each
280	* color	287	* color
281	*/	288	*/
282		289	if (pmap.ncolors >= SIZE_MAX / sizeof(XpmColor))
		290	RETURN(XpmNoMemory);
283	colorTable = (XpmColor *) XpmCalloc(pmap.ncolors, sizeof(XpmColor));	291	colorTable = (XpmColor *) XpmCalloc(pmap.ncolors, sizeof(XpmColor));
284	if (!colorTable)	292	if (!colorTable)
285	RETURN(XpmNoMemory);	293	RETURN(XpmNoMemory);
Lines 327-332 Link Here
327		335
328	/* first get a character string */	336	/* first get a character string */
329	a = 0;	337	a = 0;
		338	if (cpp >= SIZE_MAX - 1)
		339	return (XpmNoMemory);
330	if (!(s = color->string = (char *) XpmMalloc(cpp + 1)))	340	if (!(s = color->string = (char *) XpmMalloc(cpp + 1)))
331	return (XpmNoMemory);	341	return (XpmNoMemory);
332	*s++ = printable[c = a % MAXPRINTABLE];	342	*s++ = printable[c = a % MAXPRINTABLE];
Lines 374-380 Link Here
374	ScanOtherColors(display, colors, ncolors, pixels, mask, cpp, attributes)	384	ScanOtherColors(display, colors, ncolors, pixels, mask, cpp, attributes)
375	Display *display;	385	Display *display;
376	XpmColor *colors;	386	XpmColor *colors;
377	int ncolors;	387	unsigned int ncolors;
378	Pixel *pixels;	388	Pixel *pixels;
379	unsigned int mask;	389	unsigned int mask;
380	unsigned int cpp;	390	unsigned int cpp;
Lines 418-423 Link Here
418	}	428	}
419		429
420	/* first get character strings and rgb values */	430	/* first get character strings and rgb values */
		431	if (ncolors >= SIZE_MAX / sizeof(XColor) \|\| cpp >= SIZE_MAX - 1)
		432	return (XpmNoMemory);
421	xcolors = (XColor ) XpmMalloc(sizeof(XColor) ncolors);	433	xcolors = (XColor ) XpmMalloc(sizeof(XColor) ncolors);
422	if (!xcolors)	434	if (!xcolors)
423	return (XpmNoMemory);	435	return (XpmNoMemory);

Lines 239-244 Link Here

(-)motif/lib/Xm/XpmWrFFrI.c.XPM (+2 lines)
239	unsigned int x, y, h;	239	unsigned int x, y, h;
240		240
241	h = height - 1;	241	h = height - 1;
		242	if (cpp != 0 && width >= (SIZE_MAX - 3)/cpp)
		243	return XpmNoMemory;
242	p = buf = (char ) XpmMalloc(width cpp + 3);	244	p = buf = (char ) XpmMalloc(width cpp + 3);
243	if (!buf)	245	if (!buf)
244	return (XpmNoMemory);	246	return (XpmNoMemory);

Lines 136-142 Link Here

(-)motif/lib/Xm/Xpmhashtab.c.XPM (-1 / +5 lines)
136	xpmHashTable *table;	136	xpmHashTable *table;
137	{	137	{
138	xpmHashAtom *atomTable = table->atomTable;	138	xpmHashAtom *atomTable = table->atomTable;
139	int size = table->size;	139	unsigned int size = table->size;
140	xpmHashAtom t, p;	140	xpmHashAtom t, p;
141	int i;	141	int i;
142	int oldSize = size;	142	int oldSize = size;
Lines 145-150 Link Here
145	HASH_TABLE_GROWS	145	HASH_TABLE_GROWS
146	table->size = size;	146	table->size = size;
147	table->limit = size / 3;	147	table->limit = size / 3;
		148	if (size >= SIZE_MAX / sizeof(*atomTable))
		149	return (XpmNoMemory);
148	atomTable = (xpmHashAtom ) XpmMalloc(size sizeof(*atomTable));	150	atomTable = (xpmHashAtom ) XpmMalloc(size sizeof(*atomTable));
149	if (!atomTable)	151	if (!atomTable)
150	return (XpmNoMemory);	152	return (XpmNoMemory);
Lines 205-210 Link Here
205	table->size = INITIAL_HASH_SIZE;	207	table->size = INITIAL_HASH_SIZE;
206	table->limit = table->size / 3;	208	table->limit = table->size / 3;
207	table->used = 0;	209	table->used = 0;
		210	if (table->size >= SIZE_MAX / sizeof(*atomTable))
		211	return (XpmNoMemory);
208	atomTable = (xpmHashAtom ) XpmMalloc(table->size sizeof(*atomTable));	212	atomTable = (xpmHashAtom ) XpmMalloc(table->size sizeof(*atomTable));
209	if (!atomTable)	213	if (!atomTable)
210	return (XpmNoMemory);	214	return (XpmNoMemory);

Lines 129-134 Link Here

(-)motif/lib/Xm/XpmCrDatFrI.c.XPM (+2 lines)
129	*/	129	*/
130	header_nlines = 1 + image->ncolors;	130	header_nlines = 1 + image->ncolors;
131	header_size = sizeof(char ) header_nlines;	131	header_size = sizeof(char ) header_nlines;
		132	if (header_size >= SIZE_MAX / sizeof(char *))
		133	return (XpmNoMemory);
132	header = (char *) XpmCalloc(header_size, sizeof(char ));	134	header = (char *) XpmCalloc(header_size, sizeof(char ));
133	if (!header)	135	if (!header)
134	return (XpmNoMemory);	136	return (XpmNoMemory);




		boundCheckingCalloc((long)(nelem),(long) (elsize))
#endif

#if defined(SCO) || defined(__USLC__)
#include <stdint.h>	/* For SIZE_MAX */
#endif
#include <limits.h>
#ifndef SIZE_MAX
# ifdef ULONG_MAX
#  define SIZE_MAX ULONG_MAX
# else 
#  define SIZE_MAX UINT_MAX
# endif
#endif

#define XPMMAXCMTLEN BUFSIZ
typedef struct {
    unsigned int type;

}      *xpmHashAtom;

typedef struct {
    unsigned int size;
    unsigned int limit;
    unsigned int used;
    xpmHashAtom *atomTable;
}      xpmHashTable;


Lines 799-804 Link Here

(-)motif/lib/Xm/Xpmcreate.c.XPM (+17 lines)
799		799
800	ErrorStatus = XpmSuccess;	800	ErrorStatus = XpmSuccess;
801		801
		802	if (image->ncolors >= SIZE_MAX / sizeof(Pixel))
		803	return (XpmNoMemory);
		804
802	/* malloc pixels index tables */	805	/* malloc pixels index tables */
803	image_pixels = (Pixel ) XpmMalloc(sizeof(Pixel) image->ncolors);	806	image_pixels = (Pixel ) XpmMalloc(sizeof(Pixel) image->ncolors);
804	if (!image_pixels)	807	if (!image_pixels)
Lines 942-947 Link Here
942	return (XpmNoMemory);	945	return (XpmNoMemory);
943		946
944	#ifndef FOR_MSW	947	#ifndef FOR_MSW
		948	if (height != 0 && (*image_return)->bytes_per_line >= SIZE_MAX / height)
		949	return XpmNoMemory;
945	/* now that bytes_per_line must have been set properly alloc data */	950	/* now that bytes_per_line must have been set properly alloc data */
946	(*image_return)->data =	951	(*image_return)->data =
947	(char ) XpmMalloc((image_return)->bytes_per_line * height);	952	(char ) XpmMalloc((image_return)->bytes_per_line * height);
Lines 1987-1992 Link Here
1987	xpmGetCmt(data, &colors_cmt);	1992	xpmGetCmt(data, &colors_cmt);
1988		1993
1989	/* malloc pixels index tables */	1994	/* malloc pixels index tables */
		1995	if (ncolors >= SIZE_MAX / sizeof(Pixel))
		1996	return XpmNoMemory;
		1997
1990	image_pixels = (Pixel ) XpmMalloc(sizeof(Pixel) ncolors);	1998	image_pixels = (Pixel ) XpmMalloc(sizeof(Pixel) ncolors);
1991	if (!image_pixels)	1999	if (!image_pixels)
1992	RETURN(XpmNoMemory);	2000	RETURN(XpmNoMemory);
Lines 2200-2205 Link Here
2200	{	2208	{
2201	unsigned short colidx[256];	2209	unsigned short colidx[256];
2202		2210
		2211	if (ncolors > 256)
		2212	return (XpmFileInvalid);
		2213
2203	bzero((char )colidx, 256 sizeof(short));	2214	bzero((char )colidx, 256 sizeof(short));
2204	for (a = 0; a < ncolors; a++)	2215	for (a = 0; a < ncolors; a++)
2205	colidx[(unsigned char)colorTable[a].string[0]] = a + 1;	2216	colidx[(unsigned char)colorTable[a].string[0]] = a + 1;
Lines 2242-2247 Link Here
2242	unsigned short *cidx[256];	2253	unsigned short *cidx[256];
2243	int char1;	2254	int char1;
2244		2255
		2256	if (ncolors > 256)
		2257	return (XpmFileInvalid);
		2258
2245	bzero((char )cidx, 256 sizeof(unsigned short )); / init */	2259	bzero((char )cidx, 256 sizeof(unsigned short )); / init */
2246	for (a = 0; a < ncolors; a++) {	2260	for (a = 0; a < ncolors; a++) {
2247	char1 = colorTable[a].string[0];	2261	char1 = colorTable[a].string[0];
Lines 2298-2303 Link Here
2298	char *s;	2312	char *s;
2299	char buf[BUFSIZ];	2313	char buf[BUFSIZ];
2300		2314
		2315	if (cpp >= sizeof(buf))
		2316	return (XpmFileInvalid);
		2317
2301	buf[cpp] = '\0';	2318	buf[cpp] = '\0';
2302	if (USE_HASHTABLE) {	2319	if (USE_HASHTABLE) {
2303	xpmHashAtom *slot;	2320	xpmHashAtom *slot;




#include "XpmI.h"

/* 3.2 backward compatibility code */
LFUNC(CreateOldColorTable, int, (XpmColor *ct, unsigned int ncolors,
				 XpmColor ***oldct));

LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors));

static int
CreateOldColorTable(ct, ncolors, oldct)
    XpmColor *ct;
    unsigned int ncolors;
    XpmColor ***oldct;
{
    XpmColor **colorTable, **color;
    int a;

    if (ncolors >= SIZE_MAX / sizeof(XpmColor *)) 
	return XpmNoMemory;

    colorTable = (XpmColor **) XpmMalloc(ncolors * sizeof(XpmColor *));
    if (!colorTable) {
	*oldct = NULL;

Lines 72-78 Link Here

(-)motif/lib/Xm/Imakefile.XPM (-1 / +5 lines)
72		72
73	LINTLIBS = $(LINTXLIB) $(LINTXTOOL)	73	LINTLIBS = $(LINTXLIB) $(LINTXTOOL)
74		74
75	DEFINES = XmDefines StrcasecmpDefines	75	DEFINES = XmDefines StrcasecmpDefines $(STRLCATDEF)
76	SRCH_DEFINES = -DLIBDIR=\"$(XPROJECTROOT)/lib/X11\" -DINCDIR=\"$(XPROJECTROOT)/include/X11\"	76	SRCH_DEFINES = -DLIBDIR=\"$(XPROJECTROOT)/lib/X11\" -DINCDIR=\"$(XPROJECTROOT)/include/X11\"
77	BINDINGS_DEF = -DXMBINDDIR_FALLBACK=\"VirtualBindingsPath\"	77	BINDINGS_DEF = -DXMBINDDIR_FALLBACK=\"VirtualBindingsPath\"
78	STRINGSABIOPTIONS = ToolkitStringsABIOptions	78	STRINGSABIOPTIONS = ToolkitStringsABIOptions
Lines 258-263 Link Here
258	UNSHAREDOBJS = XmStrDefs.o sharedlib.o	258	UNSHAREDOBJS = XmStrDefs.o sharedlib.o
259	#endif	259	#endif
260		260
		261	#if HasStrlcat
		262	STRLCATDEF = -DHAS_STRLCAT
		263	#endif
		264
261	#define LibTookitMakeStringsDependency YES	265	#define LibTookitMakeStringsDependency YES
262	#include <Library.tmpl>	266	#include <Library.tmpl>
263		267




#include "XpmI.h"
#include <ctype.h>

#ifdef HAS_STRLCAT
# define STRLCAT(dst, src, dstsize) { \
  	if (strlcat(dst, src, dstsize) >= (dstsize)) \
	    return (XpmFileInvalid); }
# define STRLCPY(dst, src, dstsize) { \
  	if (strlcpy(dst, src, dstsize) >= (dstsize)) \
	    return (XpmFileInvalid); }
#else
# define STRLCAT(dst, src, dstsize) { \
	if ((strlen(dst) + strlen(src)) < (dstsize)) \
 	    strcat(dst, src); \
	else return (XpmFileInvalid); }
# define STRLCPY(dst, src, dstsize) { \
	if (strlen(src) < (dstsize)) \
 	    strcpy(dst, src); \
	else return (XpmFileInvalid); }
#endif

LFUNC(ParsePixels, int, (xpmData *data, unsigned int width,
			 unsigned int height, unsigned int ncolors,
			 unsigned int cpp, XpmColor *colorTable,

    unsigned int *extensions;
{
    unsigned int l;
    char buf[BUFSIZ + 1];

    if (!data->format) {		/* XPM 2 or 3 */


    XpmColor **colorTablePtr;
    xpmHashTable *hashtable;
{
    unsigned int key = 0, l, a, b, len;
    unsigned int curkey;		/* current color key */
    unsigned int lastwaskey;		/* key read */
    char buf[BUFSIZ+1];
    char curbuf[BUFSIZ];		/* current buffer */
    char **sptr, *s;
    XpmColor *color;

    char **defaults;
    int ErrorStatus;

    if (ncolors >= SIZE_MAX / sizeof(XpmColor))
	return (XpmNoMemory);
    colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));
    if (!colorTable)
	return (XpmNoMemory);

	    /*
	     * read pixel value
	     */
	    if (cpp >= SIZE_MAX - 1) {
		xpmFreeColorTable(colorTable, ncolors);
		return (XpmNoMemory);
	    }
	    color->string = (char *) XpmMalloc(cpp + 1);
	    if (!color->string) {
		xpmFreeColorTable(colorTable, ncolors);

		}
		if (!lastwaskey && key < NKEYS) {	/* open new key */
		    if (curkey) {	/* flush string */
			len = strlen(curbuf) + 1;
			s = (char *) XpmMalloc(len);
			if (!s) {
			    xpmFreeColorTable(colorTable, ncolors);
			    return (XpmNoMemory);
			}
			defaults[curkey] = s;
			memcpy(s, curbuf, len);
		    }
		    curkey = key + 1;	/* set new key  */
		    *curbuf = '\0';	/* reset curbuf */

			return (XpmFileInvalid);
		    }
		    if (!lastwaskey)
			STRLCAT(curbuf, " ", sizeof(curbuf)); /* append space */
		    buf[l] = '\0';
		    STRLCAT(curbuf, buf, sizeof(curbuf));/* append buf */
		    lastwaskey = 0;
		}
	    }

		xpmFreeColorTable(colorTable, ncolors);
		return (XpmFileInvalid);
	    }
	    len = strlen(curbuf) + 1;
	    s = defaults[curkey] = (char *) XpmMalloc(len);
	    if (!s) {
		xpmFreeColorTable(colorTable, ncolors);
		return (XpmNoMemory);
	    }
	    memcpy(s, curbuf, len);
	}
    } else {				/* XPM 1 */
	/* get to the beginning of the first string */

	    /*
	     * read pixel value
	     */
	    if (cpp >= SIZE_MAX - 1) {
		xpmFreeColorTable(colorTable, ncolors);
		return (XpmNoMemory);
	    }
	    color->string = (char *) XpmMalloc(cpp + 1);
	    if (!color->string) {
		xpmFreeColorTable(colorTable, ncolors);

	    *curbuf = '\0';		/* init curbuf */
	    while (l = xpmNextWord(data, buf, BUFSIZ)) {
		if (*curbuf != '\0')
		    STRLCAT(curbuf, " ", sizeof(curbuf));/* append space */
		buf[l] = '\0';
		STRLCAT(curbuf, buf, sizeof(curbuf));	/* append buf */
	    }
	    len = strlen(curbuf) + 1;
	    s = (char *) XpmMalloc(len);
	    if (!s) {
		xpmFreeColorTable(colorTable, ncolors);
		return (XpmNoMemory);
	    }
	    memcpy(s, curbuf, len);
	    color->c_color = s;
	    *curbuf = '\0';		/* reset curbuf */
	    if (a < ncolors - 1)

    unsigned int *iptr, *iptr2;
    unsigned int a, x, y;

    if ((height > 0 && width >= SIZE_MAX / height) ||
	width * height >= SIZE_MAX / sizeof(unsigned int)) 
	return XpmNoMemory;
#ifndef FOR_MSW
    iptr2 = (unsigned int *) XpmMalloc(sizeof(unsigned int) * width * height);
#else

	{
	    unsigned short colidx[256];

	    if (ncolors > 256)
		return (XpmFileInvalid);

	    bzero((char *)colidx, 256 * sizeof(short));
	    for (a = 0; a < ncolors; a++)
		colidx[(unsigned char)colorTable[a].string[0]] = a + 1;

	    char *s;
	    char buf[BUFSIZ];

	    if (cpp >= sizeof(buf))
		return (XpmFileInvalid);

	    buf[cpp] = '\0';
	    if (USE_HASHTABLE) {
		xpmHashAtom *slot;

Return to bug 78111

Lines 179-184 Link Here

(-)motif/lib/Xm/XpmI.h.XPM (-3 / +15 lines)
179	boundCheckingCalloc((long)(nelem),(long) (elsize))	179	boundCheckingCalloc((long)(nelem),(long) (elsize))
180	#endif	180	#endif
181		181
		182	#if defined(SCO) \|\| defined(__USLC__)
		183	#include <stdint.h> /* For SIZE_MAX */
		184	#endif
		185	#include <limits.h>
		186	#ifndef SIZE_MAX
		187	# ifdef ULONG_MAX
		188	# define SIZE_MAX ULONG_MAX
		189	# else
		190	# define SIZE_MAX UINT_MAX
		191	# endif
		192	#endif
		193
182	#define XPMMAXCMTLEN BUFSIZ	194	#define XPMMAXCMTLEN BUFSIZ
183	typedef struct {	195	typedef struct {
184	unsigned int type;	196	unsigned int type;
Lines 276-284 Link Here
276	} *xpmHashAtom;	288	} *xpmHashAtom;
277		289
278	typedef struct {	290	typedef struct {
279	int size;	291	unsigned int size;
280	int limit;	292	unsigned int limit;
281	int used;	293	unsigned int used;
282	xpmHashAtom *atomTable;	294	xpmHashAtom *atomTable;
283	} xpmHashTable;	295	} xpmHashTable;
284		296

Lines 36-42 Link Here

(-)motif/lib/Xm/XpmAttrib.c.XPM (-2 / +5 lines)
36	#include "XpmI.h"	36	#include "XpmI.h"
37		37
38	/* 3.2 backward compatibility code */	38	/* 3.2 backward compatibility code */
39	LFUNC(CreateOldColorTable, int, (XpmColor *ct, int ncolors,	39	LFUNC(CreateOldColorTable, int, (XpmColor *ct, unsigned int ncolors,
40	XpmColor ***oldct));	40	XpmColor ***oldct));
41		41
42	LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors));	42	LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors));
Lines 47-58 Link Here
47	static int	47	static int
48	CreateOldColorTable(ct, ncolors, oldct)	48	CreateOldColorTable(ct, ncolors, oldct)
49	XpmColor *ct;	49	XpmColor *ct;
50	int ncolors;	50	unsigned int ncolors;
51	XpmColor ***oldct;	51	XpmColor ***oldct;
52	{	52	{
53	XpmColor colorTable, color;	53	XpmColor colorTable, color;
54	int a;	54	int a;
55		55
		56	if (ncolors >= SIZE_MAX / sizeof(XpmColor *))
		57	return XpmNoMemory;
		58
56	colorTable = (XpmColor *) XpmMalloc(ncolors sizeof(XpmColor *));	59	colorTable = (XpmColor *) XpmMalloc(ncolors sizeof(XpmColor *));
57	if (!colorTable) {	60	if (!colorTable) {
58	*oldct = NULL;	61	*oldct = NULL;

Lines 42-47 Link Here

(-)motif/lib/Xm/Xpmparse.c.XPM (-13 / +53 lines)
42	#include "XpmI.h"	42	#include "XpmI.h"
43	#include <ctype.h>	43	#include <ctype.h>
44		44
		45	#ifdef HAS_STRLCAT
		46	# define STRLCAT(dst, src, dstsize) { \
		47	if (strlcat(dst, src, dstsize) >= (dstsize)) \
		48	return (XpmFileInvalid); }
		49	# define STRLCPY(dst, src, dstsize) { \
		50	if (strlcpy(dst, src, dstsize) >= (dstsize)) \
		51	return (XpmFileInvalid); }
		52	#else
		53	# define STRLCAT(dst, src, dstsize) { \
		54	if ((strlen(dst) + strlen(src)) < (dstsize)) \
		55	strcat(dst, src); \
		56	else return (XpmFileInvalid); }
		57	# define STRLCPY(dst, src, dstsize) { \
		58	if (strlen(src) < (dstsize)) \
		59	strcpy(dst, src); \
		60	else return (XpmFileInvalid); }
		61	#endif
		62
45	LFUNC(ParsePixels, int, (xpmData *data, unsigned int width,	63	LFUNC(ParsePixels, int, (xpmData *data, unsigned int width,
46	unsigned int height, unsigned int ncolors,	64	unsigned int height, unsigned int ncolors,
47	unsigned int cpp, XpmColor *colorTable,	65	unsigned int cpp, XpmColor *colorTable,
Lines 209-215 Link Here
209	unsigned int *extensions;	227	unsigned int *extensions;
210	{	228	{
211	unsigned int l;	229	unsigned int l;
212	char buf[BUFSIZ];	230	char buf[BUFSIZ + 1];
213		231
214	if (!data->format) { /* XPM 2 or 3 */	232	if (!data->format) { /* XPM 2 or 3 */
215		233
Lines 318-327 Link Here
318	XpmColor **colorTablePtr;	336	XpmColor **colorTablePtr;
319	xpmHashTable *hashtable;	337	xpmHashTable *hashtable;
320	{	338	{
321	unsigned int key, l, a, b;	339	unsigned int key = 0, l, a, b, len;
322	unsigned int curkey; /* current color key */	340	unsigned int curkey; /* current color key */
323	unsigned int lastwaskey; /* key read */	341	unsigned int lastwaskey; /* key read */
324	char buf[BUFSIZ];	342	char buf[BUFSIZ+1];
325	char curbuf[BUFSIZ]; /* current buffer */	343	char curbuf[BUFSIZ]; /* current buffer */
326	char *sptr, s;	344	char *sptr, s;
327	XpmColor *color;	345	XpmColor *color;
Lines 329-334 Link Here
329	char **defaults;	347	char **defaults;
330	int ErrorStatus;	348	int ErrorStatus;
331		349
		350	if (ncolors >= SIZE_MAX / sizeof(XpmColor))
		351	return (XpmNoMemory);
332	colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));	352	colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));
333	if (!colorTable)	353	if (!colorTable)
334	return (XpmNoMemory);	354	return (XpmNoMemory);
Lines 340-345 Link Here
340	/*	360	/*
341	* read pixel value	361	* read pixel value
342	*/	362	*/
		363	if (cpp >= SIZE_MAX - 1) {
		364	xpmFreeColorTable(colorTable, ncolors);
		365	return (XpmNoMemory);
		366	}
343	color->string = (char *) XpmMalloc(cpp + 1);	367	color->string = (char *) XpmMalloc(cpp + 1);
344	if (!color->string) {	368	if (!color->string) {
345	xpmFreeColorTable(colorTable, ncolors);	369	xpmFreeColorTable(colorTable, ncolors);
Lines 377-389 Link Here
377	}	401	}
378	if (!lastwaskey && key < NKEYS) { /* open new key */	402	if (!lastwaskey && key < NKEYS) { /* open new key */
379	if (curkey) { /* flush string */	403	if (curkey) { /* flush string */
380	s = (char *) XpmMalloc(strlen(curbuf) + 1);	404	len = strlen(curbuf) + 1;
		405	s = (char *) XpmMalloc(len);
381	if (!s) {	406	if (!s) {
382	xpmFreeColorTable(colorTable, ncolors);	407	xpmFreeColorTable(colorTable, ncolors);
383	return (XpmNoMemory);	408	return (XpmNoMemory);
384	}	409	}
385	defaults[curkey] = s;	410	defaults[curkey] = s;
386	strcpy(s, curbuf);	411	memcpy(s, curbuf, len);
387	}	412	}
388	curkey = key + 1; /* set new key */	413	curkey = key + 1; /* set new key */
389	curbuf = '\0'; / reset curbuf */	414	curbuf = '\0'; / reset curbuf */
Lines 394-402 Link Here
394	return (XpmFileInvalid);	419	return (XpmFileInvalid);
395	}	420	}
396	if (!lastwaskey)	421	if (!lastwaskey)
397	strcat(curbuf, " "); /* append space */	422	STRLCAT(curbuf, " ", sizeof(curbuf)); /* append space */
398	buf[l] = '\0';	423	buf[l] = '\0';
399	strcat(curbuf, buf);/* append buf */	424	STRLCAT(curbuf, buf, sizeof(curbuf));/* append buf */
400	lastwaskey = 0;	425	lastwaskey = 0;
401	}	426	}
402	}	427	}
Lines 404-415 Link Here
404	xpmFreeColorTable(colorTable, ncolors);	429	xpmFreeColorTable(colorTable, ncolors);
405	return (XpmFileInvalid);	430	return (XpmFileInvalid);
406	}	431	}
407	s = defaults[curkey] = (char *) XpmMalloc(strlen(curbuf) + 1);	432	len = strlen(curbuf) + 1;
		433	s = defaults[curkey] = (char *) XpmMalloc(len);
408	if (!s) {	434	if (!s) {
409	xpmFreeColorTable(colorTable, ncolors);	435	xpmFreeColorTable(colorTable, ncolors);
410	return (XpmNoMemory);	436	return (XpmNoMemory);
411	}	437	}
412	strcpy(s, curbuf);	438	memcpy(s, curbuf, len);
413	}	439	}
414	} else { /* XPM 1 */	440	} else { /* XPM 1 */
415	/* get to the beginning of the first string */	441	/* get to the beginning of the first string */
Lines 422-427 Link Here
422	/*	448	/*
423	* read pixel value	449	* read pixel value
424	*/	450	*/
		451	if (cpp >= SIZE_MAX - 1) {
		452	xpmFreeColorTable(colorTable, ncolors);
		453	return (XpmNoMemory);
		454	}
425	color->string = (char *) XpmMalloc(cpp + 1);	455	color->string = (char *) XpmMalloc(cpp + 1);
426	if (!color->string) {	456	if (!color->string) {
427	xpmFreeColorTable(colorTable, ncolors);	457	xpmFreeColorTable(colorTable, ncolors);
Lines 450-465 Link Here
450	curbuf = '\0'; / init curbuf */	480	curbuf = '\0'; / init curbuf */
451	while (l = xpmNextWord(data, buf, BUFSIZ)) {	481	while (l = xpmNextWord(data, buf, BUFSIZ)) {
452	if (*curbuf != '\0')	482	if (*curbuf != '\0')
453	strcat(curbuf, " ");/* append space */	483	STRLCAT(curbuf, " ", sizeof(curbuf));/* append space */
454	buf[l] = '\0';	484	buf[l] = '\0';
455	strcat(curbuf, buf); /* append buf */	485	STRLCAT(curbuf, buf, sizeof(curbuf)); /* append buf */
456	}	486	}
457	s = (char *) XpmMalloc(strlen(curbuf) + 1);	487	len = strlen(curbuf) + 1;
		488	s = (char *) XpmMalloc(len);
458	if (!s) {	489	if (!s) {
459	xpmFreeColorTable(colorTable, ncolors);	490	xpmFreeColorTable(colorTable, ncolors);
460	return (XpmNoMemory);	491	return (XpmNoMemory);
461	}	492	}
462	strcpy(s, curbuf);	493	memcpy(s, curbuf, len);
463	color->c_color = s;	494	color->c_color = s;
464	curbuf = '\0'; / reset curbuf */	495	curbuf = '\0'; / reset curbuf */
465	if (a < ncolors - 1)	496	if (a < ncolors - 1)
Lines 484-489 Link Here
484	unsigned int iptr, iptr2;	515	unsigned int iptr, iptr2;
485	unsigned int a, x, y;	516	unsigned int a, x, y;
486		517
		518	if ((height > 0 && width >= SIZE_MAX / height) \|\|
		519	width * height >= SIZE_MAX / sizeof(unsigned int))
		520	return XpmNoMemory;
487	#ifndef FOR_MSW	521	#ifndef FOR_MSW
488	iptr2 = (unsigned int ) XpmMalloc(sizeof(unsigned int) width * height);	522	iptr2 = (unsigned int ) XpmMalloc(sizeof(unsigned int) width * height);
489	#else	523	#else
Lines 507-512 Link Here
507	{	541	{
508	unsigned short colidx[256];	542	unsigned short colidx[256];
509		543
		544	if (ncolors > 256)
		545	return (XpmFileInvalid);
		546
510	bzero((char )colidx, 256 sizeof(short));	547	bzero((char )colidx, 256 sizeof(short));
511	for (a = 0; a < ncolors; a++)	548	for (a = 0; a < ncolors; a++)
512	colidx[(unsigned char)colorTable[a].string[0]] = a + 1;	549	colidx[(unsigned char)colorTable[a].string[0]] = a + 1;
Lines 584-589 Link Here
584	char *s;	621	char *s;
585	char buf[BUFSIZ];	622	char buf[BUFSIZ];
586		623
		624	if (cpp >= sizeof(buf))
		625	return (XpmFileInvalid);
		626
587	buf[cpp] = '\0';	627	buf[cpp] = '\0';
588	if (USE_HASHTABLE) {	628	if (USE_HASHTABLE) {
589	xpmHashAtom *slot;	629	xpmHashAtom *slot;