diff options
-rw-r--r-- | gdk-pixbuf/ChangeLog | 14 | ||||
-rw-r--r-- | gdk-pixbuf/io-ico.c | 10 | ||||
-rw-r--r-- | gdk-pixbuf/io-tga.c | 12 | ||||
-rw-r--r-- | gdk-pixbuf/io-wbmp.c | 49 | ||||
-rw-r--r-- | gdk-pixbuf/test-loaders.c | 16 |
5 files changed, 82 insertions, 19 deletions
diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog index 45f470842..c7b259670 100644 --- a/gdk-pixbuf/ChangeLog +++ b/gdk-pixbuf/ChangeLog @@ -1,3 +1,17 @@ +2002-02-10 Matthias Clasen <matthias@local> + + * test-loaders.c (main): Enable some tests which should work + now. + + * io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Detect + invalid image dimensions and insufficient memory. + + * io-tga.c (try_preload): Detect invalid image dimensions. + (gdk_pixbuf__tga_stop_load): Don't try to unref NULL pointers. + + * io-ico.c (DecodeHeader): Detect some invalid headers and + don't segfault. + Fri Feb 8 23:11:15 2002 Owen Taylor <otaylor@redhat.com> * pixops/pixops.c: Force all weight arrays to sum exactly diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c index 412ea319d..0f28ca3e0 100644 --- a/gdk-pixbuf/io-ico.c +++ b/gdk-pixbuf/io-ico.c @@ -295,7 +295,15 @@ static void DecodeHeader(guchar *Data, gint Bytes, Ptr += 16; } - + + if (State->DIBoffset < 0) { + g_set_error (error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("Invalid header in icon")); + return; + } + /* We now have a winner, pointed to in State->DIBoffset, so we know how many bytes are in the "header" part. */ diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c index d8dd9c78d..1f797a3b3 100644 --- a/gdk-pixbuf/io-tga.c +++ b/gdk-pixbuf/io-tga.c @@ -611,8 +611,13 @@ static gboolean try_preload(TGAContext *ctx, GError **err) ctx->in = io_buffer_free_segment(ctx->in, sizeof(TGAHeader), err); if (!ctx->in) return FALSE; - if (!fill_in_context(ctx, err)) + if (LE16(ctx->hdr->width) == 0 || + LE16(ctx->hdr->height) == 0) { + g_set_error(err, GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("TGA image has invalid dimensions")); return FALSE; + } if (ctx->hdr->infolen > 255) { g_set_error(err, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_CORRUPT_IMAGE, @@ -628,6 +633,8 @@ static gboolean try_preload(TGAContext *ctx, GError **err) _("TGA image type not supported")); return FALSE; } + if (!fill_in_context(ctx, err)) + return FALSE; } else { return TRUE; } @@ -752,7 +759,8 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err) g_free(ctx->hdr); if (ctx->cmap) g_free(ctx->cmap); - g_object_unref(ctx->pbuf); + if (ctx->pbuf) + g_object_unref(ctx->pbuf); if (ctx->in->size) ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err); if (!ctx->in) { diff --git a/gdk-pixbuf/io-wbmp.c b/gdk-pixbuf/io-wbmp.c index d483e360c..d4db78386 100644 --- a/gdk-pixbuf/io-wbmp.c +++ b/gdk-pixbuf/io-wbmp.c @@ -268,8 +268,19 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data, else if(context->need_width) { bv = get_mbi(context, &buf, &size, &context->width); - if(bv) + if(bv) { context->need_width = FALSE; + + if (context->width <= 0) { + g_set_error (error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("Image has zero width")); + + return FALSE; + } + } + } else if(context->need_height) { @@ -277,8 +288,26 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data, if(bv) { context->need_height = FALSE; + + if (context->height <= 0) { + g_set_error (error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("Image has zero height")); + + return FALSE; + } + context->pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, FALSE, 8, context->width, context->height); - g_assert(context->pixbuf); + + if (!context->pixbuf) { + g_set_error (error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY, + _("Not enough memory to load image")); + return FALSE; + } + if(context->prepared_func) context->prepared_func(context->pixbuf, NULL, context->user_data); @@ -324,10 +353,18 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data, } while(bv); - if(size) - return save_rest(context, buf, size); - else - return context->needmore; + if(size) { + bv = save_rest(context, buf, size); + if (!bv) { + g_set_error (error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("Couldn't save the rest")); + + return FALSE; + } + } + return TRUE; } void diff --git a/gdk-pixbuf/test-loaders.c b/gdk-pixbuf/test-loaders.c index 95c4a6ec0..49066362a 100644 --- a/gdk-pixbuf/test-loaders.c +++ b/gdk-pixbuf/test-loaders.c @@ -401,10 +401,7 @@ main (int argc, char **argv) TEST (png_test_2, FALSE); -#if 0 TEST (valid_ico_test, TRUE); -#endif - TEST (ico_test_1, FALSE); TEST (valid_jpeg_test, TRUE); @@ -417,6 +414,11 @@ main (int argc, char **argv) TEST (tga_test_1, FALSE); TEST (xpm_test_1, FALSE); + +#if 0 + TEST (wbmp_test_1, FALSE); + TEST (wbmp_test_2, FALSE); +#endif TEST_RANDOM (GIF_HEADER, 150, FALSE); TEST_RANDOM (PNG_HEADER, 1100, FALSE); @@ -431,17 +433,11 @@ main (int argc, char **argv) TEST_RANDOMLY_MODIFIED (valid_png_test, FALSE); TEST_RANDOMLY_MODIFIED (valid_tga_test, FALSE); TEST_RANDOMLY_MODIFIED (valid_jpeg_test, FALSE); /* The jpeg loader does not break */ -#if 0 - TEST_RANDOMLY_MODIFIED (valid_ico_test, TRUE); /* The ico loader does not seem to + TEST_RANDOMLY_MODIFIED (valid_ico_test, FALSE); /* The ico loader does not seem to * break, but the image tend to * mutate into a wbmp image, and * the wbmp loader is broken */ -#endif -#if 0 - TEST (wbmp_test_1, FALSE); - TEST (wbmp_test_2, FALSE); -#endif /* memory tests */ /* How do the loaders behave when memory is low? |