From a9a06ee44e440522eaa56d4f4f300ffe91a5083d Mon Sep 17 00:00:00 2001 From: Matthias Clasen Date: Tue, 12 Feb 2002 23:28:05 +0000 Subject: Add a (#ifdef 0'ed) test provoking a segfault in TIFFReadDirectory(). * test-images.h (tiff1_test_3), test-loaders.c (main): Add a (#ifdef 0'ed) test provoking a segfault in TIFFReadDirectory(). * io-ico.c (DecodeHeader): Check that pixbuf could be allocated. * test-images.h (ico_test_2), test-loaders.c (main): Test the previous change. * io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Don't write beyond the end of buffer if width % 8 != 0. * io-tga.c (try_preload): Enforce that ctx->hdr->type is one of the supported types, otherwise parse_data_for_row () will not make any progress, leading to an infinite loop. --- gdk-pixbuf/ChangeLog | 17 +++++++++++++++++ gdk-pixbuf/gdk-pixbuf-loader.c | 3 ++- gdk-pixbuf/io-ico.c | 7 +++++++ gdk-pixbuf/io-tga.c | 14 ++++++++++++++ gdk-pixbuf/io-wbmp.c | 3 +++ gdk-pixbuf/test-images.h | 30 ++++++++++++++++++++++++++++++ gdk-pixbuf/test-loaders.c | 18 +++++++++--------- 7 files changed, 82 insertions(+), 10 deletions(-) (limited to 'gdk-pixbuf') diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog index 52461ec732..9905a93be9 100644 --- a/gdk-pixbuf/ChangeLog +++ b/gdk-pixbuf/ChangeLog @@ -1,3 +1,20 @@ +2002-02-10 Matthias Clasen + + * test-images.h (tiff1_test_3), test-loaders.c (main): Add a + (#ifdef 0'ed) test provoking a segfault in TIFFReadDirectory(). + + * io-ico.c (DecodeHeader): Check that pixbuf could be allocated. + + * test-images.h (ico_test_2), test-loaders.c (main): Test the + previous change. + + * io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Don't write + beyond the end of buffer if width % 8 != 0. + + * io-tga.c (try_preload): Enforce that ctx->hdr->type is one of + the supported types, otherwise parse_data_for_row () will not make + any progress, leading to an infinite loop. + Mon Feb 11 14:31:53 2002 Owen Taylor * pixops/pixops.c (bilinear_make_weights): Fix handing of diff --git a/gdk-pixbuf/gdk-pixbuf-loader.c b/gdk-pixbuf/gdk-pixbuf-loader.c index 8ba462a01b..94db73f47b 100644 --- a/gdk-pixbuf/gdk-pixbuf-loader.c +++ b/gdk-pixbuf/gdk-pixbuf-loader.c @@ -252,7 +252,8 @@ gdk_pixbuf_loader_load_module (GdkPixbufLoader *loader, return 0; } - + + //g_print ("\n%s\n", priv->image_module->module_name); priv->context = priv->image_module->begin_load (gdk_pixbuf_loader_prepare, gdk_pixbuf_loader_update, loader, diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c index 0f28ca3e0c..bac4d8e907 100644 --- a/gdk-pixbuf/io-ico.c +++ b/gdk-pixbuf/io-ico.c @@ -453,6 +453,13 @@ static void DecodeHeader(guchar *Data, gint Bytes, gdk_pixbuf_new(GDK_COLORSPACE_RGB, TRUE, 8, State->Header.width, State->Header.height); + if (!State->pixbuf) { + g_set_error (error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY, + _("Not enough memory to load icon")); + return; + } if (State->prepared_func != NULL) /* Notify the client that we are ready to go */ diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c index 1f797a3b3e..fb1aa75617 100644 --- a/gdk-pixbuf/io-tga.c +++ b/gdk-pixbuf/io-tga.c @@ -633,6 +633,20 @@ static gboolean try_preload(TGAContext *ctx, GError **err) _("TGA image type not supported")); return FALSE; } + switch (ctx->hdr->type) { + case TGA_TYPE_PSEUDOCOLOR: + case TGA_TYPE_TRUECOLOR: + case TGA_TYPE_GRAYSCALE: + case TGA_TYPE_RLE_PSEUDOCOLOR: + case TGA_TYPE_RLE_TRUECOLOR: + case TGA_TYPE_RLE_GRAYSCALE: + break; + default: + g_set_error(err, GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_UNKNOWN_TYPE, + _("TGA image type not supported")); + return FALSE; + } if (!fill_in_context(ctx, err)) return FALSE; } else { diff --git a/gdk-pixbuf/io-wbmp.c b/gdk-pixbuf/io-wbmp.c index d4db78386d..7bb8e11722 100644 --- a/gdk-pixbuf/io-wbmp.c +++ b/gdk-pixbuf/io-wbmp.c @@ -333,6 +333,9 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data, { guchar pixval; + if (context->curx + (7 - xoff) == context->width) + break; + if(byte & (1<