summaryrefslogtreecommitdiff
path: root/src/CrDatFrI.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/CrDatFrI.c')
-rw-r--r--src/CrDatFrI.c34
1 files changed, 25 insertions, 9 deletions
diff --git a/src/CrDatFrI.c b/src/CrDatFrI.c
index 0dacf51..6735bfc 100644
--- a/src/CrDatFrI.c
+++ b/src/CrDatFrI.c
@@ -48,7 +48,7 @@ LFUNC(CreatePixels, void, (char **dataptr, unsigned int data_size,
unsigned int height, unsigned int cpp,
unsigned int *pixels, XpmColor *colors));
-LFUNC(CountExtensions, void, (XpmExtension *ext, unsigned int num,
+LFUNC(CountExtensions, int, (XpmExtension *ext, unsigned int num,
unsigned int *ext_size,
unsigned int *ext_nlines));
@@ -122,8 +122,9 @@ XpmCreateDataFromXpmImage(
/* compute the number of extensions lines and size */
if (extensions)
- CountExtensions(info->extensions, info->nextensions,
- &ext_size, &ext_nlines);
+ if (CountExtensions(info->extensions, info->nextensions,
+ &ext_size, &ext_nlines))
+ return(XpmNoMemory);
/*
* alloc a temporary array of char pointer for the header section which
@@ -187,7 +188,8 @@ XpmCreateDataFromXpmImage(
if(offset <= image->width || offset <= image->cpp)
RETURN(XpmNoMemory);
- if( (image->height + ext_nlines) >= UINT_MAX / sizeof(char *))
+ if (image->height > UINT_MAX - ext_nlines ||
+ image->height + ext_nlines >= UINT_MAX / sizeof(char *))
RETURN(XpmNoMemory);
data_size = (image->height + ext_nlines) * sizeof(char *);
@@ -196,7 +198,8 @@ XpmCreateDataFromXpmImage(
RETURN(XpmNoMemory);
data_size += image->height * offset;
- if( (header_size + ext_size) >= (UINT_MAX - data_size) )
+ if (header_size > UINT_MAX - ext_size ||
+ header_size + ext_size >= (UINT_MAX - data_size) )
RETURN(XpmNoMemory);
data_size += header_size + ext_size;
@@ -343,13 +346,14 @@ CreatePixels(
*s = '\0';
}
-static void
+static int
CountExtensions(
XpmExtension *ext,
unsigned int num,
unsigned int *ext_size,
unsigned int *ext_nlines)
{
+ size_t len;
unsigned int x, y, a, size, nlines;
char **line;
@@ -357,16 +361,28 @@ CountExtensions(
nlines = 0;
for (x = 0; x < num; x++, ext++) {
/* 1 for the name */
+ if (ext->nlines == UINT_MAX || nlines > UINT_MAX - ext->nlines - 1)
+ return (1);
nlines += ext->nlines + 1;
/* 8 = 7 (for "XPMEXT ") + 1 (for 0) */
- size += strlen(ext->name) + 8;
+ len = strlen(ext->name) + 8;
+ if (len > UINT_MAX - size)
+ return (1);
+ size += len;
a = ext->nlines;
- for (y = 0, line = ext->lines; y < a; y++, line++)
- size += strlen(*line) + 1;
+ for (y = 0, line = ext->lines; y < a; y++, line++) {
+ len = strlen(*line) + 1;
+ if (len > UINT_MAX - size)
+ return (1);
+ size += len;
+ }
}
+ if (size > UINT_MAX - 10 || nlines > UINT_MAX - 1)
+ return (1);
/* 10 and 1 are for the ending "XPMENDEXT" */
*ext_size = size + 10;
*ext_nlines = nlines + 1;
+ return (0);
}
static void