configure.in acheader.h gdk/gdkwindow.c Check for Shape extension both on

Sun May  3 13:38:22 1998  Owen Taylor  <otaylor@gtk.org>

	* configure.in acheader.h gdk/gdkwindow.c
	Check for Shape extension both on the client and server
	side. (And, more importantly, check for the shape extension
	so we may include -lXext even when compiling with --disable-xshm)

	Don't set override_redirect on all shaped windows. It isn't
	necessary.

	* gdk/gdkwindow.c: Set ->colormap to NULL for root
	and foreign windows. Use this to check if we
	need to get the colormap from X.

Fri May  1 22:32:47 1998  Owen Taylor  <otaylor@gtk.org>

	* gtk/gtkbutton.c (gtk_button_paint): Draw the areas
	between the default and the button always in GTK_STATE_NORMAL.

	* gtk/gtkrange.c (gtk_range_style_set): Added a style_set
	callback.

Fri May  1 16:40:57 1998  Owen Taylor  <otaylor@gtk.org>

	* gdk/gdkpixmap.c (gdk_pixmap_colormap_create_from_xpmp[_d]):
	  Fix a buffer overflow on pixmaps that claim to have
	  more than 31 characters per pixel.

	  (gdk_pixmap_read_string): Don't wrap around strings longer
 	  than half of address space ;-)

	* gtk/gtk[vh]ruler.c gtk/gtkinputdialog.c: Expand some buffers
	that were used for printing integers.

	* */* (almost):

	Style: All
	  int foo () { ... }
	changed to
	  int foo (void) { ... }

^^^^^^^ This is why some many files changed

	Even where there were proper prototypes elsewhere.

	* gdk/gxid.c (handle_claim_device): Some extra checks.
	It isn't safe against being fed bad X id's, but at
	least it should be safe against deleting all your
	files.

1 files changed, 18 insertions, 2 deletions

diff --git a/gdk/gdkpixmap.c b/gdk/gdkpixmap.c
index a1af21542..2f2cdea4c 100644
--- a/gdk/gdkpixmap.c
+++ b/gdk/gdkpixmap.c
@@ -256,8 +256,14 @@ gdk_pixmap_read_string (FILE  *infile,
     {
       if (cnt == (*buffer_size))
 	{
-	  (*buffer_size) *= 2;
- 	  (*buffer) = (gchar *) g_realloc ((*buffer), *buffer_size);	}
+	  guint new_size = (*buffer_size) * 2;
+	  if (new_size > (*buffer_size))
+	    *buffer_size = new_size;
+	  else
+	    return FALSE;
+	  
+ 	  (*buffer) = (gchar *) g_realloc ((*buffer), *buffer_size);	
+	}
 
       if (c != '"')
         (*buffer)[cnt++] = c;
@@ -399,6 +405,11 @@ gdk_pixmap_colormap_create_from_xpm (GdkWindow   *window,
               gdk_pixmap_read_string (infile, &buffer, &buffer_size);
 
               sscanf (buffer,"%d %d %d %d", &width, &height, &num_cols, &cpp);
+	      if (cpp >= 32)
+		{
+		  g_warning ("Pixmap has more than 31 characters per color\n");
+		  return NULL;
+		}
 
               colors = g_new(_GdkPixmapColor, num_cols);
 
@@ -574,6 +585,11 @@ gdk_pixmap_colormap_create_from_xpm_d (GdkWindow  *window,
   i = 0;
   buffer = data[i++];
   sscanf (buffer,"%d %d %d %d", &width, &height, &num_cols, &cpp);
+  if (cpp >= 32)
+    {
+      g_warning ("Pixmap has more than 31 characters per color\n");
+      return NULL;
+    }
 
   colors = g_new(_GdkPixmapColor, num_cols);