diff options
Diffstat (limited to 'Build/source/libs/gd/libgd-src/src/gd_gd2.c')
-rw-r--r-- | Build/source/libs/gd/libgd-src/src/gd_gd2.c | 45 |
1 files changed, 28 insertions, 17 deletions
diff --git a/Build/source/libs/gd/libgd-src/src/gd_gd2.c b/Build/source/libs/gd/libgd-src/src/gd_gd2.c index 85106bc9273..760e85b9fd9 100644 --- a/Build/source/libs/gd/libgd-src/src/gd_gd2.c +++ b/Build/source/libs/gd/libgd-src/src/gd_gd2.c @@ -47,16 +47,18 @@ * offset - 1 dword * size - 1 dword * - * There are x_chunk_count * y_chunk_count chunk headers. + * There are x_chunk_count * y_chunk_count chunk headers. * * Truecolor image color header: * truecolor - 1 byte (always "\001") - * transparent - 1 dword (ARGB color) + * transparent - 1 dword (ARGB color); "\377\377\377\377" means that no + * transparent color is set * * Palette image color header: * truecolor - 1 byte (always "\0") * count - 1 word (the number of used palette colors) - * transparent - 1 dword (ARGB color) + * transparent - 1 dword (palette index); "\377\377\377\377" means that no + * transparent color is set * palette - 256 dwords (RGBA colors) * * Chunk structure: @@ -83,7 +85,7 @@ /* 2.03: gd2 is no longer mandatory */ /* JCE - test after including gd.h so that HAVE_LIBZ can be set in * a config.h file included by gd.h */ -#ifdef HAVE_LIBZ +#if defined(HAVE_LIBZ) && ENABLE_GD_FORMATS #include <zlib.h> #define TRUE 1 @@ -210,7 +212,7 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy, GD2_DBG (printf ("%d Chunks vertically\n", *ncy)); if (gd2_compressed (*fmt)) { - if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) { + if (overflow2(*ncx, *ncy)) { GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy)); goto fail1; } @@ -236,7 +238,7 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy, if (gdGetInt (&cidx[i].size, in) != 1) { goto fail2; }; - if (cidx[i].offset < 0 || cidx[i].size < 0) + if (cidx[i].offset < 0 || cidx[i].size < 0 || cidx[i].size == INT_MAX) goto fail2; }; *chunkIdx = cidx; @@ -405,7 +407,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2Ptr (int size, void *data) Function: gdImageCreateFromGd2Ctx Reads in a GD2 image via a <gdIOCtx> struct. See - <gdImageCreateFromGd2>. + <gdImageCreateFromGd2>. */ BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2Ctx (gdIOCtxPtr in) { @@ -436,8 +438,13 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2Ctx (gdIOCtxPtr in) } bytesPerPixel = im->trueColor ? 4 : 1; + if (overflow2(ncx, ncy)) + goto fail; nc = ncx * ncy; + if (overflow2(ncy, cs) || overflow2(ncx, cs) || overflow2(bytesPerPixel, cs)) + goto fail; + if (gd2_compressed (fmt)) { /* Find the maximum compressed chunk size. */ compMax = 0; @@ -1127,57 +1134,61 @@ BGD_DECLARE(void *) gdImageGd2Ptr (gdImagePtr im, int cs, int fmt, int *size) return rv; } -#else /* no HAVE_LIBZ */ -static void _noLibzError (void) +#else /* no HAVE_LIBZ or !ENABLE_GD_FORMATS */ +static void _noGd2Error (void) { +#if !ENABLE_GD_FORMATS + gd_error("GD2 image support has been disabled\n"); +#else gd_error("GD2 support is not available - no libz\n"); +#endif } BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2 (FILE * inFile) { - _noLibzError(); + _noGd2Error(); return NULL; } BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2Ctx (gdIOCtxPtr in) { - _noLibzError(); + _noGd2Error(); return NULL; } BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2Part (FILE * inFile, int srcx, int srcy, int w, int h) { - _noLibzError(); + _noGd2Error(); return NULL; } BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2Ptr (int size, void *data) { - _noLibzError(); + _noGd2Error(); return NULL; } BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2PartCtx (gdIOCtx * in, int srcx, int srcy, int w, int h) { - _noLibzError(); + _noGd2Error(); return NULL; } BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2PartPtr (int size, void *data, int srcx, int srcy, int w, int h) { - _noLibzError(); + _noGd2Error(); return NULL; } BGD_DECLARE(void) gdImageGd2 (gdImagePtr im, FILE * outFile, int cs, int fmt) { - _noLibzError(); + _noGd2Error(); } BGD_DECLARE(void *) gdImageGd2Ptr (gdImagePtr im, int cs, int fmt, int *size) { - _noLibzError(); + _noGd2Error(); return NULL; } #endif /* HAVE_LIBZ */ |