| @@ -1,14 +1,14 @@ | | | @@ -1,14 +1,14 @@ |
1 | $NetBSD: patch-ab,v 1.7 2011/01/23 16:16:39 wiz Exp $ | | 1 | $NetBSD: patch-ab,v 1.8 2013/08/15 16:26:36 joerg Exp $ |
2 | | | 2 | |
3 | Middle chunks: Fix build with png-1.5. | | 3 | Middle chunks: Fix build with png-1.5. |
4 | Others: ??? | | 4 | Others: ??? |
5 | | | 5 | |
6 | --- Imlib/load.c.orig 2004-09-21 00:23:20.000000000 +0000 | | 6 | --- Imlib/load.c.orig 2004-09-21 00:23:20.000000000 +0000 |
7 | +++ Imlib/load.c | | 7 | +++ Imlib/load.c |
8 | @@ -4,6 +4,8 @@ | | 8 | @@ -4,6 +4,8 @@ |
9 | #include "Imlib_private.h" | | 9 | #include "Imlib_private.h" |
10 | #include <setjmp.h> | | 10 | #include <setjmp.h> |
11 | | | 11 | |
12 | +#define G_MAXINT ((int) 0x7fffffff) | | 12 | +#define G_MAXINT ((int) 0x7fffffff) |
13 | + | | 13 | + |
14 | /* Split the ID - damages input */ | | 14 | /* Split the ID - damages input */ |
| @@ -76,26 +76,35 @@ Others: ??? | | | @@ -76,26 +76,35 @@ Others: ??? |
76 | { | | 76 | { |
77 | for (y = 0; y < *h; y++) | | 77 | for (y = 0; y < *h; y++) |
78 | @@ -360,7 +369,9 @@ _LoadTIFF(ImlibData * id, FILE *f, char | | 78 | @@ -360,7 +369,9 @@ _LoadTIFF(ImlibData * id, FILE *f, char |
79 | npix = ww * hh; | | 79 | npix = ww * hh; |
80 | *w = (int)ww; | | 80 | *w = (int)ww; |
81 | *h = (int)hh; | | 81 | *h = (int)hh; |
82 | - if(ww > 32767 || hh > 32767) | | 82 | - if(ww > 32767 || hh > 32767) |
83 | + if (ww <= 0 || ww > 32767 || | | 83 | + if (ww <= 0 || ww > 32767 || |
84 | + hh <= 0 || hh > 32767 || | | 84 | + hh <= 0 || hh > 32767 || |
85 | + hh >= (G_MAXINT/sizeof(uint32)) / ww) | | 85 | + hh >= (G_MAXINT/sizeof(uint32)) / ww) |
86 | { | | 86 | { |
87 | TIFFClose(tif); | | 87 | TIFFClose(tif); |
88 | return NULL; | | 88 | return NULL; |
| | | 89 | @@ -443,7 +454,7 @@ _LoadGIF(ImlibData * id, FILE *f, int *w |
| | | 90 | fd = fileno(f); |
| | | 91 | /* Apparently rewind(f) isn't sufficient */ |
| | | 92 | lseek(fd, (long) 0, 0); |
| | | 93 | - gif = DGifOpenFileHandle(fd); |
| | | 94 | + gif = DGifOpenFileHandle(fd, NULL); |
| | | 95 | |
| | | 96 | if (!gif) |
| | | 97 | return NULL; |
89 | @@ -463,7 +474,7 @@ _LoadGIF(ImlibData * id, FILE *f, int *w | | 98 | @@ -463,7 +474,7 @@ _LoadGIF(ImlibData * id, FILE *f, int *w |
90 | } | | 99 | } |
91 | *w = gif->Image.Width; | | 100 | *w = gif->Image.Width; |
92 | *h = gif->Image.Height; | | 101 | *h = gif->Image.Height; |
93 | - if (*h > 32767 || *w > 32767) | | 102 | - if (*h > 32767 || *w > 32767) |
94 | + if (*h <= 0 || *h > 32767 || *w <= 0 || *w > 32767) | | 103 | + if (*h <= 0 || *h > 32767 || *w <= 0 || *w > 32767) |
95 | { | | 104 | { |
96 | return NULL; | | 105 | return NULL; |
97 | } | | 106 | } |
98 | @@ -1000,7 +1011,12 @@ _LoadXPM(ImlibData * id, FILE *file, int | | 107 | @@ -1000,7 +1011,12 @@ _LoadXPM(ImlibData * id, FILE *file, int |
99 | comment = 0; | | 108 | comment = 0; |
100 | quote = 0; | | 109 | quote = 0; |
101 | context = 0; | | 110 | context = 0; |