Joined with branch XORG-6_8_2.lg3d-rel-0-6-2lg3d-masterlg3d-dev-0-7-1lg3d-dev-0-7-0lg3d-dev-0-6-2lg3d-dev-0-6-1-1

1 files changed, 29 insertions, 15 deletions

diff --git a/src/scan.c b/src/scan.c
index 4142e7f..69c987b 100644
--- a/src/scan.c
+++ b/src/scan.c
@@ -43,6 +43,8 @@
  * Lorens Younes (d93-hyo@nada.kth.se) 4/96
  */
 
+/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
+
 #include "XpmI.h"
 
 #define MAXPRINTABLE 92			/* number of printable ascii chars
@@ -107,7 +109,8 @@ LFUNC(MSWGetImagePixels, int, (Display *d, XImage *image, unsigned int width,
 LFUNC(ScanTransparentColor, int, (XpmColor *color, unsigned int cpp,
 				  XpmAttributes *attributes));
 
-LFUNC(ScanOtherColors, int, (Display *display, XpmColor *colors, int ncolors,
+LFUNC(ScanOtherColors, int, (Display *display, XpmColor *colors, 
+			     unsigned int ncolors, 
 			     Pixel *pixels, unsigned int mask,
 			     unsigned int cpp, XpmAttributes *attributes));
 
@@ -171,10 +174,10 @@ storeMaskPixel(pixel, pmap, index_return)
 /* function call in case of error */
 #undef RETURN
 #define RETURN(status) \
-{ \
+do { \
       ErrorStatus = status; \
       goto error; \
-}
+} while(0)
 
 /*
  * This function scans the given image and stores the found informations in
@@ -232,11 +235,17 @@ XpmCreateXpmImageFromImage(display, image, shapeimage,
     else
 	cpp = 0;
 
+    if ((height > 0 && width >= UINT_MAX / height) ||
+	width * height >= UINT_MAX / sizeof(unsigned int))
+	RETURN(XpmNoMemory);
     pmap.pixelindex =
 	(unsigned int *) XpmCalloc(width * height, sizeof(unsigned int));
     if (!pmap.pixelindex)
 	RETURN(XpmNoMemory);
 
+    if (pmap.size >= UINT_MAX / sizeof(Pixel)) 
+	RETURN(XpmNoMemory);
+
     pmap.pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * pmap.size);
     if (!pmap.pixels)
 	RETURN(XpmNoMemory);
@@ -301,7 +310,8 @@ XpmCreateXpmImageFromImage(display, image, shapeimage,
      * get rgb values and a string of char, and possibly a name for each
      * color
      */
-
+    if (pmap.ncolors >= UINT_MAX / sizeof(XpmColor))
+	RETURN(XpmNoMemory);
     colorTable = (XpmColor *) XpmCalloc(pmap.ncolors, sizeof(XpmColor));
     if (!colorTable)
 	RETURN(XpmNoMemory);
@@ -360,6 +370,8 @@ ScanTransparentColor(color, cpp, attributes)
 
     /* first get a character string */
     a = 0;
+    if (cpp >= UINT_MAX - 1)
+	return (XpmNoMemory);
     if (!(s = color->string = (char *) XpmMalloc(cpp + 1)))
 	return (XpmNoMemory);
     *s++ = printable[c = a % MAXPRINTABLE];
@@ -407,7 +419,7 @@ static int
 ScanOtherColors(display, colors, ncolors, pixels, mask, cpp, attributes)
     Display *display;
     XpmColor *colors;
-    int ncolors;
+    unsigned int ncolors;
     Pixel *pixels;
     unsigned int mask;
     unsigned int cpp;
@@ -451,6 +463,8 @@ ScanOtherColors(display, colors, ncolors, pixels, mask, cpp, attributes)
     }
 
     /* first get character strings and rgb values */
+    if (ncolors >= UINT_MAX / sizeof(XColor) || cpp >= UINT_MAX - 1)
+	return (XpmNoMemory);
     xcolors = (XColor *) XpmMalloc(sizeof(XColor) * ncolors);
     if (!xcolors)
 	return (XpmNoMemory);
@@ -607,7 +621,7 @@ GetImagePixels(image, width, height, pmap)
     char *dst;
     unsigned int *iptr;
     char *data;
-    int x, y, i;
+    unsigned int x, y, i;
     int bits, depth, ibu, ibpp, offset;
     unsigned long lbt;
     Pixel pixel, px;
@@ -709,7 +723,7 @@ GetImagePixels32(image, width, height, pmap)
     unsigned char *addr;
     unsigned char *data;
     unsigned int *iptr;
-    int x, y;
+    unsigned int x, y;
     unsigned long lbt;
     Pixel pixel;
     int depth;
@@ -774,7 +788,7 @@ GetImagePixels16(image, width, height, pmap)
     unsigned char *addr;
     unsigned char *data;
     unsigned int *iptr;
-    int x, y;
+    unsigned int x, y;
     unsigned long lbt;
     Pixel pixel;
     int depth;
@@ -819,7 +833,7 @@ GetImagePixels8(image, width, height, pmap)
 {
     unsigned int *iptr;
     unsigned char *data;
-    int x, y;
+    unsigned int x, y;
     unsigned long lbt;
     Pixel pixel;
     int depth;
@@ -852,7 +866,7 @@ GetImagePixels1(image, width, height, pmap, storeFunc)
     storeFuncPtr storeFunc;
 {
     unsigned int *iptr;
-    int x, y;
+    unsigned int x, y;
     char *data;
     Pixel pixel;
     int xoff, yoff, offset, bpl;
@@ -888,11 +902,11 @@ GetImagePixels1(image, width, height, pmap, storeFunc)
 # else /* AMIGA */
 
 #define CLEAN_UP(status) \
-{\
+do {\
     if (pixels) XpmFree (pixels);\
     if (tmp_img) FreeXImage (tmp_img);\
     return (status);\
-}
+} while(0)
 
 static int
 AGetImagePixels (
@@ -913,7 +927,7 @@ AGetImagePixels (
     
     tmp_img = AllocXImage ((((width+15)>>4)<<4), 1, image->rp->BitMap->Depth);
     if (tmp_img == NULL)
-	CLEAN_UP (XpmNoMemory)
+	CLEAN_UP (XpmNoMemory);
     
     iptr = pmap->pixelindex;
     for (y = 0; y < height; ++y)
@@ -922,11 +936,11 @@ AGetImagePixels (
 	for (x = 0; x < width; ++x, ++iptr)
 	{
 	    if ((*storeFunc) (pixels[x], pmap, iptr))
-		CLEAN_UP (XpmNoMemory)
+		CLEAN_UP (XpmNoMemory);
 	}
     }
     
-    CLEAN_UP (XpmSuccess)
+    CLEAN_UP (XpmSuccess);
 }
 
 #undef CLEAN_UP