diff options
| author | Matthias Clasen <matthiasc@src.gnome.org> | 2002-02-10 21:06:15 +0000 |
|---|---|---|
| committer | Matthias Clasen <matthiasc@src.gnome.org> | 2002-02-10 21:06:15 +0000 |
| commit | 73aa2bfe050ec9c1ae4cb2e913d46f550ce19668 (patch) | |
| tree | 170366183831f6d7981efe75e87787910915c0c1 /gdk-pixbuf/io-tga.c | |
| parent | 8846275862f6362bfd211c53cf21ebe826da01c3 (diff) | |
| download | gdk-pixbuf-73aa2bfe050ec9c1ae4cb2e913d46f550ce19668.tar.gz | |
Enable some tests which should work now.
* test-loaders.c (main): Enable some tests which should work
now.
* io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Detect
invalid image dimensions and insufficient memory.
* io-tga.c (try_preload): Detect invalid image dimensions.
(gdk_pixbuf__tga_stop_load): Don't try to unref NULL pointers.
* io-ico.c (DecodeHeader): Detect some invalid headers and
don't segfault.
Diffstat (limited to 'gdk-pixbuf/io-tga.c')
| -rw-r--r-- | gdk-pixbuf/io-tga.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c index d8dd9c78d..1f797a3b3 100644 --- a/gdk-pixbuf/io-tga.c +++ b/gdk-pixbuf/io-tga.c @@ -611,8 +611,13 @@ static gboolean try_preload(TGAContext *ctx, GError **err) ctx->in = io_buffer_free_segment(ctx->in, sizeof(TGAHeader), err); if (!ctx->in) return FALSE; - if (!fill_in_context(ctx, err)) + if (LE16(ctx->hdr->width) == 0 || + LE16(ctx->hdr->height) == 0) { + g_set_error(err, GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("TGA image has invalid dimensions")); return FALSE; + } if (ctx->hdr->infolen > 255) { g_set_error(err, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_CORRUPT_IMAGE, @@ -628,6 +633,8 @@ static gboolean try_preload(TGAContext *ctx, GError **err) _("TGA image type not supported")); return FALSE; } + if (!fill_in_context(ctx, err)) + return FALSE; } else { return TRUE; } @@ -752,7 +759,8 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err) g_free(ctx->hdr); if (ctx->cmap) g_free(ctx->cmap); - g_object_unref(ctx->pbuf); + if (ctx->pbuf) + g_object_unref(ctx->pbuf); if (ctx->in->size) ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err); if (!ctx->in) { |