diff options
| author | Matthias Clasen <matthiasc@src.gnome.org> | 2005-11-15 15:59:05 +0000 |
|---|---|---|
| committer | Matthias Clasen <matthiasc@src.gnome.org> | 2005-11-15 15:59:05 +0000 |
| commit | 563d32211f67004764547a54ea922a3287a19247 (patch) | |
| tree | 5cf44f0b31255a7f31f44cc6151541307863f950 /gdk-pixbuf/io-xpm.c | |
| parent | 2fc25094311eb432cebb8ca539e79e4b547a4571 (diff) | |
| download | gdk-pixbuf-563d32211f67004764547a54ea922a3287a19247.tar.gz | |
Fix integer overflows in the xpm loader
Diffstat (limited to 'gdk-pixbuf/io-xpm.c')
| -rw-r--r-- | gdk-pixbuf/io-xpm.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/gdk-pixbuf/io-xpm.c b/gdk-pixbuf/io-xpm.c index 750307005..7f020cd96 100644 --- a/gdk-pixbuf/io-xpm.c +++ b/gdk-pixbuf/io-xpm.c @@ -405,7 +405,8 @@ file_buffer (enum buf_op op, gpointer handle) /* Fall through to the xpm_read_string. */ case op_body: - xpm_read_string (h->infile, &h->buffer, &h->buffer_size); + if(!xpm_read_string (h->infile, &h->buffer, &h->buffer_size)) + return NULL; return h->buffer; default: @@ -500,7 +501,9 @@ pixbuf_create_from_xpm (const gchar * (*get_buf) (enum buf_op op, gpointer handl _("XPM has invalid number of chars per pixel")); return NULL; } - if (n_col <= 0 || n_col >= G_MAXINT / (cpp + 1)) { + if (n_col <= 0 || + n_col >= G_MAXINT / (cpp + 1) || + n_col >= G_MAXINT / sizeof (XPMColor)) { g_set_error (error, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_CORRUPT_IMAGE, |