diff options
author | Benjamin Otte <otte@redhat.com> | 2015-10-12 14:46:59 +0200 |
---|---|---|
committer | Benjamin Otte <otte@redhat.com> | 2015-10-13 02:56:48 +0200 |
commit | 7b10db13ff370bf2500688054249101ff175a942 (patch) | |
tree | 3b0794ae31e3d56bcd93bb64e1f6dc5ebc72fb17 | |
parent | b5fbb63fe50f719cae09743653978a03920b2a49 (diff) | |
download | gdk-pixbuf-7b10db13ff370bf2500688054249101ff175a942.tar.gz |
ico: Protect against overflow
-rw-r--r-- | gdk-pixbuf/io-ico.c | 32 |
1 files changed, 17 insertions, 15 deletions
diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c index e4faef501..c60dec224 100644 --- a/gdk-pixbuf/io-ico.c +++ b/gdk-pixbuf/io-ico.c @@ -579,11 +579,11 @@ OneLine32 (struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { Pixels[X * 4 + 0] = context->LineBuf[X * 4 + 2]; @@ -602,11 +602,11 @@ static void OneLine24(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { Pixels[X * 4 + 0] = context->LineBuf[X * 3 + 2]; @@ -626,10 +626,12 @@ OneLine16 (struct ico_progressive_state *context) if (context->Header.Negative == 0) pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); + (gsize) context->pixbuf->rowstride * + (context->Header.height - context->Lines - 1)); else pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * context->Lines); + (gsize) context->pixbuf->rowstride * + context->Lines); src = context->LineBuf; @@ -663,11 +665,11 @@ static void OneLine8(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { /* The joys of having a BGR byteorder */ @@ -688,11 +690,11 @@ static void OneLine4(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { @@ -729,11 +731,11 @@ static void OneLine1(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { int Bit; @@ -760,11 +762,11 @@ static void OneLineTransp(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (2*context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Lines-context->Header.height)); while (X < context->Header.width) { int Bit; @@ -1040,7 +1042,7 @@ fill_entry (IconEntry *icon, pixels = gdk_pixbuf_get_pixels (pixbuf); n_channels = gdk_pixbuf_get_n_channels (pixbuf); for (y = 0; y < icon->height; y++) { - p = pixels + gdk_pixbuf_get_rowstride (pixbuf) * (icon->height - 1 - y); + p = pixels + (gsize) gdk_pixbuf_get_rowstride (pixbuf) * (icon->height - 1 - y); and = icon->and + icon->and_rowstride * y; xor = icon->xor + icon->xor_rowstride * y; for (x = 0; x < icon->width; x++) { |