xc/lib/Xpm/ImakefileXORG-6_8_2XORG-6_8_1_904XORG-6_8_1_903XORG-6_8_1_902XORG-6_8_1_901XORG-6_8-branch

xc/extras/Xpm/lib/Attrib.c
xc/extras/Xpm/lib/CrBufFrI.c
xc/extras/Xpm/lib/CrDatFrI.c
xc/extras/Xpm/lib/RdFToBuf.c
xc/extras/Xpm/lib/RdFToI.c
xc/extras/Xpm/lib/WrFFrBuf.c
xc/extras/Xpm/lib/WrFFrI.c
xc/extras/Xpm/lib/XpmI.h
xc/extras/Xpm/lib/create.c
xc/extras/Xpm/lib/data.c
xc/extras/Xpm/lib/hashtab.c
xc/extras/Xpm/lib/misc.c
xc/extras/Xpm/lib/parse.c
//bugs.freedesktop.org/show_bug.cgi?id=1920) attachment #1514
    (https://bugs.freedesktop.org/attachment.cgi?id=1514): libXpm security
    fixes for CAN-2004-0914. Patch by Thomas Biege.

1 files changed, 20 insertions, 18 deletions

diff --git a/src/scan.c b/src/scan.c
index 230c7e6..69c987b 100644
--- a/src/scan.c
+++ b/src/scan.c
@@ -43,6 +43,8 @@
  * Lorens Younes (d93-hyo@nada.kth.se) 4/96
  */
 
+/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
+
 #include "XpmI.h"
 
 #define MAXPRINTABLE 92			/* number of printable ascii chars
@@ -172,10 +174,10 @@ storeMaskPixel(pixel, pmap, index_return)
 /* function call in case of error */
 #undef RETURN
 #define RETURN(status) \
-{ \
+do { \
       ErrorStatus = status; \
       goto error; \
-}
+} while(0)
 
 /*
  * This function scans the given image and stores the found informations in
@@ -233,15 +235,15 @@ XpmCreateXpmImageFromImage(display, image, shapeimage,
     else
 	cpp = 0;
 
-    if ((height > 0 && width >= SIZE_MAX / height) ||
-	width * height >= SIZE_MAX / sizeof(unsigned int))
+    if ((height > 0 && width >= UINT_MAX / height) ||
+	width * height >= UINT_MAX / sizeof(unsigned int))
 	RETURN(XpmNoMemory);
     pmap.pixelindex =
 	(unsigned int *) XpmCalloc(width * height, sizeof(unsigned int));
     if (!pmap.pixelindex)
 	RETURN(XpmNoMemory);
 
-    if (pmap.size >= SIZE_MAX / sizeof(Pixel)) 
+    if (pmap.size >= UINT_MAX / sizeof(Pixel)) 
 	RETURN(XpmNoMemory);
 
     pmap.pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * pmap.size);
@@ -308,7 +310,7 @@ XpmCreateXpmImageFromImage(display, image, shapeimage,
      * get rgb values and a string of char, and possibly a name for each
      * color
      */
-    if (pmap.ncolors >= SIZE_MAX / sizeof(XpmColor))
+    if (pmap.ncolors >= UINT_MAX / sizeof(XpmColor))
 	RETURN(XpmNoMemory);
     colorTable = (XpmColor *) XpmCalloc(pmap.ncolors, sizeof(XpmColor));
     if (!colorTable)
@@ -368,7 +370,7 @@ ScanTransparentColor(color, cpp, attributes)
 
     /* first get a character string */
     a = 0;
-    if (cpp >= SIZE_MAX - 1)
+    if (cpp >= UINT_MAX - 1)
 	return (XpmNoMemory);
     if (!(s = color->string = (char *) XpmMalloc(cpp + 1)))
 	return (XpmNoMemory);
@@ -461,7 +463,7 @@ ScanOtherColors(display, colors, ncolors, pixels, mask, cpp, attributes)
     }
 
     /* first get character strings and rgb values */
-    if (ncolors >= SIZE_MAX / sizeof(XColor) || cpp >= SIZE_MAX - 1)
+    if (ncolors >= UINT_MAX / sizeof(XColor) || cpp >= UINT_MAX - 1)
 	return (XpmNoMemory);
     xcolors = (XColor *) XpmMalloc(sizeof(XColor) * ncolors);
     if (!xcolors)
@@ -619,7 +621,7 @@ GetImagePixels(image, width, height, pmap)
     char *dst;
     unsigned int *iptr;
     char *data;
-    int x, y, i;
+    unsigned int x, y, i;
     int bits, depth, ibu, ibpp, offset;
     unsigned long lbt;
     Pixel pixel, px;
@@ -721,7 +723,7 @@ GetImagePixels32(image, width, height, pmap)
     unsigned char *addr;
     unsigned char *data;
     unsigned int *iptr;
-    int x, y;
+    unsigned int x, y;
     unsigned long lbt;
     Pixel pixel;
     int depth;
@@ -786,7 +788,7 @@ GetImagePixels16(image, width, height, pmap)
     unsigned char *addr;
     unsigned char *data;
     unsigned int *iptr;
-    int x, y;
+    unsigned int x, y;
     unsigned long lbt;
     Pixel pixel;
     int depth;
@@ -831,7 +833,7 @@ GetImagePixels8(image, width, height, pmap)
 {
     unsigned int *iptr;
     unsigned char *data;
-    int x, y;
+    unsigned int x, y;
     unsigned long lbt;
     Pixel pixel;
     int depth;
@@ -864,7 +866,7 @@ GetImagePixels1(image, width, height, pmap, storeFunc)
     storeFuncPtr storeFunc;
 {
     unsigned int *iptr;
-    int x, y;
+    unsigned int x, y;
     char *data;
     Pixel pixel;
     int xoff, yoff, offset, bpl;
@@ -900,11 +902,11 @@ GetImagePixels1(image, width, height, pmap, storeFunc)
 # else /* AMIGA */
 
 #define CLEAN_UP(status) \
-{\
+do {\
     if (pixels) XpmFree (pixels);\
     if (tmp_img) FreeXImage (tmp_img);\
     return (status);\
-}
+} while(0)
 
 static int
 AGetImagePixels (
@@ -925,7 +927,7 @@ AGetImagePixels (
     
     tmp_img = AllocXImage ((((width+15)>>4)<<4), 1, image->rp->BitMap->Depth);
     if (tmp_img == NULL)
-	CLEAN_UP (XpmNoMemory)
+	CLEAN_UP (XpmNoMemory);
     
     iptr = pmap->pixelindex;
     for (y = 0; y < height; ++y)
@@ -934,11 +936,11 @@ AGetImagePixels (
 	for (x = 0; x < width; ++x, ++iptr)
 	{
 	    if ((*storeFunc) (pixels[x], pmap, iptr))
-		CLEAN_UP (XpmNoMemory)
+		CLEAN_UP (XpmNoMemory);
 	}
     }
     
-    CLEAN_UP (XpmSuccess)
+    CLEAN_UP (XpmSuccess);
 }
 
 #undef CLEAN_UP