Enable some tests which should work now.

	* test-loaders.c (main): Enable some tests which should work
	now.

	* io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Detect
	invalid image dimensions and insufficient memory.

	* io-tga.c (try_preload): Detect invalid image dimensions.
	(gdk_pixbuf__tga_stop_load): Don't try to unref NULL pointers.

	* io-ico.c (DecodeHeader): Detect some invalid headers and
	don't segfault.

5 files changed, 82 insertions, 19 deletions

diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index 45f470842..c7b259670 100644
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,17 @@
+2002-02-10  Matthias Clasen  <matthias@local>
+
+	* test-loaders.c (main): Enable some tests which should work
+	now.
+
+	* io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Detect
+	invalid image dimensions and insufficient memory.
+
+	* io-tga.c (try_preload): Detect invalid image dimensions.
+	(gdk_pixbuf__tga_stop_load): Don't try to unref NULL pointers.
+
+	* io-ico.c (DecodeHeader): Detect some invalid headers and
+	don't segfault.
+
 Fri Feb  8 23:11:15 2002  Owen Taylor  <otaylor@redhat.com>
 
 	* pixops/pixops.c: Force all weight arrays to sum exactly
diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c
index 412ea319d..0f28ca3e0 100644
--- a/gdk-pixbuf/io-ico.c
+++ b/gdk-pixbuf/io-ico.c
@@ -295,7 +295,15 @@ static void DecodeHeader(guchar *Data, gint Bytes,
 		
 		Ptr += 16;	
 	} 
-		
+
+	if (State->DIBoffset < 0) {
+		g_set_error (error,
+			     GDK_PIXBUF_ERROR,
+			     GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+			     _("Invalid header in icon"));
+		return;
+	}
+
 	/* We now have a winner, pointed to in State->DIBoffset,
 	   so we know how many bytes are in the "header" part. */
 	      
diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c
index d8dd9c78d..1f797a3b3 100644
--- a/gdk-pixbuf/io-tga.c
+++ b/gdk-pixbuf/io-tga.c
@@ -611,8 +611,13 @@ static gboolean try_preload(TGAContext *ctx, GError **err)
 			ctx->in = io_buffer_free_segment(ctx->in, sizeof(TGAHeader), err);
 			if (!ctx->in)
 				return FALSE;
-			if (!fill_in_context(ctx, err))
+			if (LE16(ctx->hdr->width) == 0 || 
+			    LE16(ctx->hdr->height) == 0) {
+				g_set_error(err, GDK_PIXBUF_ERROR,
+					    GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+					    _("TGA image has invalid dimensions"));
 				return FALSE;
+			}
 			if (ctx->hdr->infolen > 255) {
 				g_set_error(err, GDK_PIXBUF_ERROR,
 					    GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
@@ -628,6 +633,8 @@ static gboolean try_preload(TGAContext *ctx, GError **err)
 					    _("TGA image type not supported"));
 				return FALSE;
 			}
+			if (!fill_in_context(ctx, err))
+				return FALSE;
 		} else {
 			return TRUE;
 		}
@@ -752,7 +759,8 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err)
 	g_free(ctx->hdr);
 	if (ctx->cmap)
 		g_free(ctx->cmap);
-	g_object_unref(ctx->pbuf);
+	if (ctx->pbuf)
+		g_object_unref(ctx->pbuf);
 	if (ctx->in->size)
 		ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err);
 	if (!ctx->in) {
diff --git a/gdk-pixbuf/io-wbmp.c b/gdk-pixbuf/io-wbmp.c
index d483e360c..d4db78386 100644
--- a/gdk-pixbuf/io-wbmp.c
+++ b/gdk-pixbuf/io-wbmp.c
@@ -268,8 +268,19 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data,
 	    else if(context->need_width)
 	      {
 		bv = get_mbi(context, &buf, &size, &context->width);
-		if(bv)
+		if(bv) {
 		  context->need_width = FALSE;
+
+                  if (context->width <= 0) {
+		    g_set_error (error,
+				 GDK_PIXBUF_ERROR,
+				 GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+				 _("Image has zero width"));
+
+		    return FALSE;
+		  }
+                }
+		
 	      }
 	    else if(context->need_height)
 	      {
@@ -277,8 +288,26 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data,
 		if(bv)
 		  {
 		    context->need_height = FALSE;
+
+		    if (context->height <= 0) {
+		      g_set_error (error,
+				   GDK_PIXBUF_ERROR,
+				   GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+				   _("Image has zero height"));
+		      
+		      return FALSE;
+		    }
+
 		    context->pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, FALSE, 8, context->width, context->height);
-		    g_assert(context->pixbuf);
+		    
+		    if (!context->pixbuf) {
+		      g_set_error (error,
+				   GDK_PIXBUF_ERROR,
+				   GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
+				   _("Not enough memory to load image"));
+		      return FALSE;
+		    }
+
 
 		    if(context->prepared_func)
 		      context->prepared_func(context->pixbuf, NULL, context->user_data);
@@ -324,10 +353,18 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data,
 
 	  } while(bv);
 
-	if(size)
-	  return save_rest(context, buf, size);
-	else
-	  return context->needmore;
+	if(size) {
+	  bv = save_rest(context, buf, size);
+	  if (!bv) {
+	      g_set_error (error,
+			   GDK_PIXBUF_ERROR,
+			   GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+			   _("Couldn't save the rest"));
+
+	      return FALSE;
+	  }
+	}
+	return TRUE;
 }
 
 void
diff --git a/gdk-pixbuf/test-loaders.c b/gdk-pixbuf/test-loaders.c
index 95c4a6ec0..49066362a 100644
--- a/gdk-pixbuf/test-loaders.c
+++ b/gdk-pixbuf/test-loaders.c
@@ -401,10 +401,7 @@ main (int argc, char **argv)
   TEST (png_test_2, FALSE);
 
 
-#if 0
   TEST (valid_ico_test, TRUE);
-#endif
-  
   TEST (ico_test_1, FALSE);
   
   TEST (valid_jpeg_test, TRUE);
@@ -417,6 +414,11 @@ main (int argc, char **argv)
   TEST (tga_test_1, FALSE);
 
   TEST (xpm_test_1, FALSE);
+
+#if 0
+  TEST (wbmp_test_1, FALSE); 
+  TEST (wbmp_test_2, FALSE);
+#endif
   
   TEST_RANDOM (GIF_HEADER, 150, FALSE);
   TEST_RANDOM (PNG_HEADER, 1100, FALSE);
@@ -431,17 +433,11 @@ main (int argc, char **argv)
   TEST_RANDOMLY_MODIFIED (valid_png_test, FALSE);
   TEST_RANDOMLY_MODIFIED (valid_tga_test, FALSE);
   TEST_RANDOMLY_MODIFIED (valid_jpeg_test, FALSE);  /* The jpeg loader does not break */
-#if 0
-  TEST_RANDOMLY_MODIFIED (valid_ico_test, TRUE);    /* The ico loader does not seem to
+  TEST_RANDOMLY_MODIFIED (valid_ico_test, FALSE);    /* The ico loader does not seem to
 						     * break, but the image tend to 
 						     * mutate into a wbmp image, and
 						     * the wbmp loader is broken
 						     */
-#endif
-#if 0
-  TEST (wbmp_test_1, FALSE); 
-  TEST (wbmp_test_2, FALSE);
-#endif
   /* memory tests */
 
   /* How do the loaders behave when memory is low?