diff options
| author | Benjamin Otte <otte@redhat.com> | 2015-10-12 14:46:59 +0200 |
|---|---|---|
| committer | Matthias Clasen <mclasen@redhat.com> | 2015-12-14 07:01:58 -0500 |
| commit | 025c8a716af650841cae3b9e8057f242524c0b69 (patch) | |
| tree | 146cc5b40cc0c0776ede5a8a1851dace3c5c6e32 | |
| parent | 4e1f15cd3ea6e98059ef470b8253566a52575ddf (diff) | |
| download | gdk-pixbuf-025c8a716af650841cae3b9e8057f242524c0b69.tar.gz | |
ico: Protect against overflow
| -rw-r--r-- | gdk-pixbuf/io-ico.c | 32 |
1 files changed, 17 insertions, 15 deletions
diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c index e4faef501..c60dec224 100644 --- a/gdk-pixbuf/io-ico.c +++ b/gdk-pixbuf/io-ico.c @@ -579,11 +579,11 @@ OneLine32 (struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { Pixels[X * 4 + 0] = context->LineBuf[X * 4 + 2]; @@ -602,11 +602,11 @@ static void OneLine24(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { Pixels[X * 4 + 0] = context->LineBuf[X * 3 + 2]; @@ -626,10 +626,12 @@ OneLine16 (struct ico_progressive_state *context) if (context->Header.Negative == 0) pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); + (gsize) context->pixbuf->rowstride * + (context->Header.height - context->Lines - 1)); else pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * context->Lines); + (gsize) context->pixbuf->rowstride * + context->Lines); src = context->LineBuf; @@ -663,11 +665,11 @@ static void OneLine8(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { /* The joys of having a BGR byteorder */ @@ -688,11 +690,11 @@ static void OneLine4(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { @@ -729,11 +731,11 @@ static void OneLine1(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * context->Lines); while (X < context->Header.width) { int Bit; @@ -760,11 +762,11 @@ static void OneLineTransp(struct ico_progressive_state *context) X = 0; if (context->Header.Negative == 0) Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (2*context->Header.height - context->Lines - 1)); else Pixels = (context->pixbuf->pixels + - context->pixbuf->rowstride * + (gsize) context->pixbuf->rowstride * (context->Lines-context->Header.height)); while (X < context->Header.width) { int Bit; @@ -1040,7 +1042,7 @@ fill_entry (IconEntry *icon, pixels = gdk_pixbuf_get_pixels (pixbuf); n_channels = gdk_pixbuf_get_n_channels (pixbuf); for (y = 0; y < icon->height; y++) { - p = pixels + gdk_pixbuf_get_rowstride (pixbuf) * (icon->height - 1 - y); + p = pixels + (gsize) gdk_pixbuf_get_rowstride (pixbuf) * (icon->height - 1 - y); and = icon->and + icon->and_rowstride * y; xor = icon->xor + icon->xor_rowstride * y; for (x = 0; x < icon->width; x++) { |