Attachment #36968 for bug #83496

View | Details | Raw Unified | Return to bug 83496
Collapse All | Expand All




STRLCATDEF = -DHAS_STRLCAT
#endif

#if HasSnprintf
SNPRINTFDEF = -DHAS_SNPRINTF
#else
SNPRINTFDEF = -Dsnprintf=_XpmSnprintf
SNPRINTFSRCS = snprintf.c
SNPRINTFOBJS = snprintf.o
#endif

#if defined(Win32Architecture)
ZPIPEDEF = -DNO_ZPIPE
#endif

DEFINES = $(STRDUPDEF) $(STRCASECMPDEF) $(SPRINTFDEF) $(STRLCATDEF) \
		$(SNPRINTFDEF) $(ZPIPEDEF) $(ZFILEDEF)

HEADERS = xpm.h


	 CrBufFrI.c CrDatFrP.c CrPFrBuf.c RdFToI.c WrFFrI.c \
	 CrBufFrP.c CrIFrBuf.c CrPFrDat.c RdFToP.c WrFFrP.c \
	 CrDatFrI.c CrIFrDat.c RdFToDat.c WrFFrDat.c \
	 Attrib.c CrIFrP.c CrPFrI.c Image.c Info.c RdFToBuf.c WrFFrBuf.c \
	 $(SNPRINTFSRCS)

  OBJS = data.o create.o misc.o rgb.o scan.o parse.o hashtab.o \
	 CrBufFrI.o CrDatFrP.o CrPFrBuf.o RdFToI.o WrFFrI.o \
	 CrBufFrP.o CrIFrBuf.o CrPFrDat.o RdFToP.o WrFFrP.o \
	 CrDatFrI.o CrIFrDat.o RdFToDat.o WrFFrDat.o \
	 Attrib.o CrIFrP.o CrPFrI.o Image.o Info.o RdFToBuf.o WrFFrBuf.o \
	 $(SNPRINTFOBJS)

         XPMDIR = $(TOP)/extras/Xpm
      XPMLIBDIR = $(TOP)/extras/Xpm/lib

LinkSourceFile(WrFFrBuf.c,$(XPMLIBDIR))
LinkSourceFile(xpm.h,$(XPMLIBDIR))

#if !HasSnprintf
LinkSourceFile(snprintf.c,$(LIBSRC)/misc)
#endif

DependTarget()

Lines 32-44 Link Here

(-)extras/Xpm/lib/Attrib.c (-6 / +8 lines)
32	* Developed by Arnaud Le Hors *	32	* Developed by Arnaud Le Hors *
33	\*****************************************************************************/	33	\*****************************************************************************/
34		34
		35	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		36
35	#include "XpmI.h"	37	#include "XpmI.h"
36		38
37	/* 3.2 backward compatibility code */	39	/* 3.2 backward compatibility code */
38	LFUNC(CreateOldColorTable, int, (XpmColor *ct, unsigned int ncolors,	40	LFUNC(CreateOldColorTable, int, (XpmColor *ct, unsigned int ncolors,
39	XpmColor ***oldct));	41	XpmColor ***oldct));
40		42
41	LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors));	43	LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, unsigned int ncolors));
42		44
43	/*	45	/*
44	* Create a colortable compatible with the old style colortable	46	* Create a colortable compatible with the old style colortable
Lines 50-58 Link Here
50	XpmColor ***oldct;	52	XpmColor ***oldct;
51	{	53	{
52	XpmColor colorTable, color;	54	XpmColor colorTable, color;
53	int a;	55	unsigned int a;
54		56
55	if (ncolors >= SIZE_MAX / sizeof(XpmColor *))	57	if (ncolors >= UINT_MAX / sizeof(XpmColor *))
56	return XpmNoMemory;	58	return XpmNoMemory;
57		59
58	colorTable = (XpmColor *) XpmMalloc(ncolors sizeof(XpmColor *));	60	colorTable = (XpmColor *) XpmMalloc(ncolors sizeof(XpmColor *));
Lines 69-77 Link Here
69	static void	71	static void
70	FreeOldColorTable(colorTable, ncolors)	72	FreeOldColorTable(colorTable, ncolors)
71	XpmColor **colorTable;	73	XpmColor **colorTable;
72	int ncolors;	74	unsigned int ncolors;
73	{	75	{
74	int a, b;	76	unsigned int a, b;
75	XpmColor **color;	77	XpmColor **color;
76	char **sptr;	78	char **sptr;
77		79
Lines 122-128 Link Here
122	XpmExtension *ext;	124	XpmExtension *ext;
123	char **sptr;	125	char **sptr;
124		126
125	if (extensions) {	127	if (extensions && nextensions > 0) {
126	for (i = 0, ext = extensions; i < nextensions; i++, ext++) {	128	for (i = 0, ext = extensions; i < nextensions; i++, ext++) {
127	if (ext->name)	129	if (ext->name)
128	XpmFree(ext->name);	130	XpmFree(ext->name);




*                                                                             *
*  Developed by Arnaud Le Hors                                                *
\*****************************************************************************/

/* October 2004, source code review by Thomas Biege <thomas@suse.de> */

/* $XFree86$ */

#include "XpmI.h"

			 unsigned int *used_size, XpmColor *colors,
			 unsigned int ncolors, unsigned int cpp));

LFUNC(WritePixels, void, (char *dataptr, unsigned int data_size,
			  unsigned int *used_size,
			  unsigned int width, unsigned int height,
			  unsigned int cpp, unsigned int *pixels,
			  XpmColor *colors));

LFUNC(WriteExtensions, void, (char *dataptr, unsigned int data_size,
			      unsigned int *used_size,
			      XpmExtension *ext, unsigned int num));

LFUNC(ExtensionsSize, unsigned int, (XpmExtension *ext, unsigned int num));
LFUNC(CommentsSize, int, (XpmInfo *info));

int


#undef RETURN
#define RETURN(status) \
do \
{ \
      ErrorStatus = status; \
      goto error; \
}while(0)

int
XpmCreateBufferFromXpmImage(buffer_return, image, info)

    unsigned int cmts, extensions, ext_size = 0;
    unsigned int l, cmt_size = 0;
    char *ptr = NULL, *p;
    unsigned int ptr_size, used_size, tmp;

    *buffer_return = NULL;


#ifdef VOID_SPRINTF
    used_size = strlen(buf);
#endif
    ptr_size = used_size + ext_size + cmt_size + 1; /* ptr_size can't be 0 */
    if(ptr_size <= used_size ||
       ptr_size <= ext_size  ||
       ptr_size <= cmt_size)
    {
        return XpmNoMemory;
    }
    ptr = (char *) XpmMalloc(ptr_size);
    if (!ptr)
	return XpmNoMemory;

#ifndef VOID_SPRINTF
	used_size +=
#endif
	snprintf(ptr + used_size, ptr_size-used_size, "/*%s*/\n", info->hints_cmt);
#ifdef VOID_SPRINTF
	used_size += strlen(info->hints_cmt) + 5;
#endif

#ifndef VOID_SPRINTF
	l +=
#endif
	snprintf(buf + l, sizeof(buf)-l, " %d %d", info->x_hotspot, info->y_hotspot);
#ifdef VOID_SPRINTF
	l = strlen(buf);
#endif

    l = strlen(buf);
#endif
    ptr_size += l;
    if(ptr_size <= l)
        RETURN(XpmNoMemory);
    p = (char *) XpmRealloc(ptr, ptr_size);
    if (!p)
	RETURN(XpmNoMemory);

#ifndef VOID_SPRINTF
	used_size +=
#endif
	snprintf(ptr + used_size, ptr_size-used_size, "/*%s*/\n", info->colors_cmt);
#ifdef VOID_SPRINTF
	used_size += strlen(info->colors_cmt) + 5;
#endif

     * 4 = 1 (for '"') + 3 (for '",\n')
     * 1 = - 2 (because the last line does not end with ',\n') + 3 (for '};\n')
     */
     if(image->width  > UINT_MAX / image->cpp ||
       (tmp = image->width * image->cpp + 4) <= 4 ||
        image->height > UINT_MAX / tmp ||
       (tmp = image->height * tmp + 1) <= 1 ||
       (ptr_size += tmp) <= tmp)
	RETURN(XpmNoMemory);

    p = (char *) XpmRealloc(ptr, ptr_size);
    if (!p)

#ifndef VOID_SPRINTF
	used_size +=
#endif
	snprintf(ptr + used_size, ptr_size-used_size, "/*%s*/\n", info->pixels_cmt);
#ifdef VOID_SPRINTF
	used_size += strlen(info->pixels_cmt) + 5;
#endif
    }
    WritePixels(ptr + used_size, ptr_size - used_size, &used_size, image->width, image->height,
		image->cpp, image->data, image->colorTable);

    /* print extensions */
    if (extensions)
	WriteExtensions(ptr + used_size, ptr_size-used_size, &used_size,
			info->extensions, info->nextensions);

    /* close the array */

    return (ErrorStatus);
}


static int
WriteColors(dataptr, data_size, used_size, colors, ncolors, cpp)
    char **dataptr;

    unsigned int ncolors;
    unsigned int cpp;
{
    char buf[BUFSIZ] = {0};
    unsigned int a, key, l;
    char *s, *s2;
    char **defaults;


	defaults = (char **) colors;
	s = buf + 1;
	if(cpp > (sizeof(buf) - (s-buf)))
		return(XpmNoMemory);
	strncpy(s, *defaults++, cpp);
	s += cpp;


#ifndef VOID_SPRINTF
		s +=
#endif
		/* assume C99 compliance */
		snprintf(s, sizeof(buf) - (s-buf), "\t%s %s", xpmColorKeys[key - 1], s2);
#ifdef VOID_SPRINTF
		s += strlen(s);
#endif
		/* now let's check if s points out-of-bounds */
		if((s-buf) > sizeof(buf))
			return(XpmNoMemory);
	    }
	}
	if(sizeof(buf) - (s-buf) < 4)
		return(XpmNoMemory);
	strcpy(s, "\",\n");
	l = s + 3 - buf;
	if( *data_size                   >= UINT_MAX-l ||
	    *data_size + l               <= *used_size ||
	   (*data_size + l - *used_size) <= sizeof(buf))
		return(XpmNoMemory);
	s = (char *) XpmRealloc(*dataptr, *data_size + l);
	if (!s)
	    return (XpmNoMemory);

}

static void
WritePixels(dataptr, data_size, used_size, width, height, cpp, pixels, colors)
    char *dataptr;
    unsigned int data_size;
    unsigned int *used_size;
    unsigned int width;
    unsigned int height;

    char *s = dataptr;
    unsigned int x, y, h;

    if(height <= 1)
    	return;

    h = height - 1;
    for (y = 0; y < h; y++) {
	*s++ = '"';
	for (x = 0; x < width; x++, pixels++) {
	    if(cpp >= (data_size - (s-dataptr)))
		return;
	    strncpy(s, colors[*pixels].string, cpp); /* how can we trust *pixels? :-\ */
	    s += cpp;
	}
	if((data_size - (s-dataptr)) < 4)
		return;
	strcpy(s, "\",\n");
	s += 3;
    }
    /* duplicate some code to avoid a test in the loop */
    *s++ = '"';
    for (x = 0; x < width; x++, pixels++) {
	if(cpp >= (data_size - (s-dataptr)))
	    return;
	strncpy(s, colors[*pixels].string, cpp); /* how can we trust *pixels? */
	s += cpp;
    }
    *s++ = '"';
    *used_size += s - dataptr;
}

static unsigned int
ExtensionsSize(ext, num)
    XpmExtension *ext;
    unsigned int num;

    char **line;

    size = 0;
    if(num == 0)
    	return(0); /* ok? */
    for (x = 0; x < num; x++, ext++) {
	/* 11 = 10 (for ',\n"XPMEXT ') + 1 (for '"') */
	size += strlen(ext->name) + 11;
	a = ext->nlines; /* how can we trust ext->nlines to be not out-of-bounds? */
	for (y = 0, line = ext->lines; y < a; y++, line++)
	    /* 4 = 3 (for ',\n"') + 1 (for '"') */
	    size += strlen(*line) + 4;
    }
    /* 13 is for ',\n"XPMENDEXT"' */
    if(size > UINT_MAX - 13) /* unlikely */
    	return(0);
    return size + 13;
}

static void
WriteExtensions(dataptr, data_size, used_size, ext, num)
    char *dataptr;
    unsigned int data_size;
    unsigned int *used_size;
    XpmExtension *ext;
    unsigned int num;

#ifndef VOID_SPRINTF
	s +=
#endif
	snprintf(s, data_size - (s-dataptr), ",\n\"XPMEXT %s\"", ext->name);
#ifdef VOID_SPRINTF
	s += strlen(ext->name) + 11;
#endif

#ifndef VOID_SPRINTF
	    s +=
#endif
	    snprintf(s, data_size - (s-dataptr), ",\n\"%s\"", *line);
#ifdef VOID_SPRINTF
	    s += strlen(*line) + 4;
#endif
	}
    }
    strncpy(s, ",\n\"XPMENDEXT\"", data_size - (s-dataptr)-1);
    *used_size += s - dataptr + 13;
}


    int size = 0;

    /* 5 = 2 (for "/_*") + 3 (for "*_/\n") */
    /* wrap possible but *very* unlikely */
    if (info->hints_cmt)
	size += 5 + strlen(info->hints_cmt);


Lines 33-45 Link Here

(-)extras/Xpm/lib/CrDatFrI.c (-18 / +76 lines)
33	\*****************************************************************************/	33	\*****************************************************************************/
34	/* $XFree86$ */	34	/* $XFree86$ */
35		35
		36	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		37
36	#include "XpmI.h"	38	#include "XpmI.h"
37		39
38	LFUNC(CreateColors, int, (char *dataptr, unsigned int data_size,	40	LFUNC(CreateColors, int, (char *dataptr, unsigned int data_size,
39	XpmColor *colors, unsigned int ncolors,	41	XpmColor *colors, unsigned int ncolors,
40	unsigned int cpp));	42	unsigned int cpp));
41		43
42	LFUNC(CreatePixels, void, (char **dataptr, unsigned int width,	44	LFUNC(CreatePixels, void, (char **dataptr, unsigned int data_size,
		45	unsigned int width,
43	unsigned int height, unsigned int cpp,	46	unsigned int height, unsigned int cpp,
44	unsigned int pixels, XpmColor colors));	47	unsigned int pixels, XpmColor colors));
45		48
Lines 47-53 Link Here
47	unsigned int *ext_size,	50	unsigned int *ext_size,
48	unsigned int *ext_nlines));	51	unsigned int *ext_nlines));
49		52
50	LFUNC(CreateExtensions, void, (char **dataptr, unsigned int offset,	53	LFUNC(CreateExtensions, void, (char **dataptr, unsigned int data_size,
		54	unsigned int offset,
51	XpmExtension *ext, unsigned int num,	55	XpmExtension *ext, unsigned int num,
52	unsigned int ext_nlines));	56	unsigned int ext_nlines));
53		57
Lines 88-97 Link Here
88		92
89	#undef RETURN	93	#undef RETURN
90	#define RETURN(status) \	94	#define RETURN(status) \
		95	do \
91	{ \	96	{ \
92	ErrorStatus = status; \	97	ErrorStatus = status; \
93	goto exit; \	98	goto exit; \
94	}	99	} while(0)
95		100
96	int	101	int
97	XpmCreateDataFromXpmImage(data_return, image, info)	102	XpmCreateDataFromXpmImage(data_return, image, info)
Lines 122-132 Link Here
122	* alloc a temporary array of char pointer for the header section which	127	* alloc a temporary array of char pointer for the header section which
123	* is the hints line + the color table lines	128	* is the hints line + the color table lines
124	*/	129	*/
125	header_nlines = 1 + image->ncolors;	130	header_nlines = 1 + image->ncolors; /* this may wrap and/or become 0 */
		131
		132	/* 2nd check superfluous if we do not need header_nlines any further */
		133	if(header_nlines <= image->ncolors \|\|
		134	header_nlines >= UINT_MAX / sizeof(char *))
		135	return(XpmNoMemory);
		136
126	header_size = sizeof(char ) header_nlines;	137	header_size = sizeof(char ) header_nlines;
127	if (header_size >= SIZE_MAX / sizeof(char *))	138	if (header_size >= UINT_MAX / sizeof(char *))
128	return (XpmNoMemory);	139	return (XpmNoMemory);
129	header = (char *) XpmCalloc(header_size, sizeof(char ));	140	header = (char *) XpmCalloc(header_size, sizeof(char )); /* can we trust image->ncolors */
130	if (!header)	141	if (!header)
131	return (XpmNoMemory);	142	return (XpmNoMemory);
132		143
Lines 170-177 Link Here
170		181
171	/* now we know the size needed, alloc the data and copy the header lines */	182	/* now we know the size needed, alloc the data and copy the header lines */
172	offset = image->width * image->cpp + 1;	183	offset = image->width * image->cpp + 1;
173	data_size = header_size + (image->height + ext_nlines) * sizeof(char *)	184
174	+ image->height * offset + ext_size;	185	if(offset <= image->width \|\| offset <= image->cpp)
		186	RETURN(XpmNoMemory);
		187
		188	if( (image->height + ext_nlines) >= UINT_MAX / sizeof(char *))
		189	RETURN(XpmNoMemory);
		190	data_size = (image->height + ext_nlines) * sizeof(char *);
		191
		192	if (image->height > UINT_MAX / offset \|\|
		193	image->height * offset > UINT_MAX - data_size)
		194	RETURN(XpmNoMemory);
		195	data_size += image->height * offset;
		196
		197	if( (header_size + ext_size) >= (UINT_MAX - data_size) )
		198	RETURN(XpmNoMemory);
		199	data_size += header_size + ext_size;
175		200
176	data = (char **) XpmMalloc(data_size);	201	data = (char **) XpmMalloc(data_size);
177	if (!data)	202	if (!data)
Lines 179-186 Link Here
179		204
180	data_nlines = header_nlines + image->height + ext_nlines;	205	data_nlines = header_nlines + image->height + ext_nlines;
181	data = (char ) (data + data_nlines);	206	data = (char ) (data + data_nlines);
		207
		208	/* can header have less elements then n suggests? */
182	n = image->ncolors;	209	n = image->ncolors;
183	for (l = 0, sptr = data, sptr2 = header; l <= n; l++, sptr++, sptr2++) {	210	for (l = 0, sptr = data, sptr2 = header; l <= n && sptr && sptr2; l++, sptr++, sptr2++) {
184	strcpy(sptr, sptr2);	211	strcpy(sptr, sptr2);
185	(sptr + 1) = sptr + strlen(*sptr2) + 1;	212	(sptr + 1) = sptr + strlen(*sptr2) + 1;
186	}	213	}
Lines 189-200 Link Here
189	data[header_nlines] = (char *) data + header_size	216	data[header_nlines] = (char *) data + header_size
190	+ (image->height + ext_nlines) * sizeof(char *);	217	+ (image->height + ext_nlines) * sizeof(char *);
191		218
192	CreatePixels(data + header_nlines, image->width, image->height,	219	CreatePixels(data + header_nlines, data_size-header_nlines, image->width, image->height,
193	image->cpp, image->data, image->colorTable);	220	image->cpp, image->data, image->colorTable);
194		221
195	/* print extensions */	222	/* print extensions */
196	if (extensions)	223	if (extensions)
197	CreateExtensions(data + header_nlines + image->height - 1, offset,	224	CreateExtensions(data + header_nlines + image->height - 1,
		225	data_size - header_nlines - image->height + 1, offset,
198	info->extensions, info->nextensions,	226	info->extensions, info->nextensions,
199	ext_nlines);	227	ext_nlines);
200		228
Lines 225-247 Link Here
225	char s, s2;	253	char s, s2;
226	char **defaults;	254	char **defaults;
227		255
		256	/* can ncolors be trusted here? */
228	for (a = 0; a < ncolors; a++, colors++, dataptr++) {	257	for (a = 0; a < ncolors; a++, colors++, dataptr++) {
229		258
230	defaults = (char **) colors;	259	defaults = (char **) colors;
		260	if(sizeof(buf) <= cpp)
		261	return(XpmNoMemory);
231	strncpy(buf, *defaults++, cpp);	262	strncpy(buf, *defaults++, cpp);
232	s = buf + cpp;	263	s = buf + cpp;
233		264
		265	if(sizeof(buf) <= (s-buf))
		266	return XpmNoMemory;
		267
234	for (key = 1; key <= NKEYS; key++, defaults++) {	268	for (key = 1; key <= NKEYS; key++, defaults++) {
235	if ((s2 = *defaults)) {	269	if ((s2 = *defaults)) {
236	#ifndef VOID_SPRINTF	270	#ifndef VOID_SPRINTF
237	s +=	271	s +=
238	#endif	272	#endif
239	sprintf(s, "\t%s %s", xpmColorKeys[key - 1], s2);	273	/* assume C99 compliance */
		274	snprintf(s, sizeof(buf)-(s-buf), "\t%s %s", xpmColorKeys[key - 1], s2);
240	#ifdef VOID_SPRINTF	275	#ifdef VOID_SPRINTF
241	s += strlen(s);	276	s += strlen(s);
242	#endif	277	#endif
		278	/* does s point out-of-bounds? */
		279	if(sizeof(buf) < (s-buf))
		280	return XpmNoMemory;
243	}	281	}
244	}	282	}
		283	/* what about using strdup()? */
245	l = s - buf + 1;	284	l = s - buf + 1;
246	s = (char *) XpmMalloc(l);	285	s = (char *) XpmMalloc(l);
247	if (!s)	286	if (!s)
Lines 253-260 Link Here
253	}	292	}
254		293
255	static void	294	static void
256	CreatePixels(dataptr, width, height, cpp, pixels, colors)	295	CreatePixels(dataptr, data_size, width, height, cpp, pixels, colors)
257	char **dataptr;	296	char **dataptr;
		297	unsigned int data_size;
258	unsigned int width;	298	unsigned int width;
259	unsigned int height;	299	unsigned int height;
260	unsigned int cpp;	300	unsigned int cpp;
Lines 264-284 Link Here
264	char *s;	304	char *s;
265	unsigned int x, y, h, offset;	305	unsigned int x, y, h, offset;
266		306
		307	if(height <= 1)
		308	return;
		309
267	h = height - 1;	310	h = height - 1;
		311
268	offset = width * cpp + 1;	312	offset = width * cpp + 1;
		313
		314	if(offset <= width \|\| offset <= cpp)
		315	return;
		316
		317	/* why trust h? */
269	for (y = 0; y < h; y++, dataptr++) {	318	for (y = 0; y < h; y++, dataptr++) {
270	s = *dataptr;	319	s = *dataptr;
		320	/* why trust width? */
271	for (x = 0; x < width; x++, pixels++) {	321	for (x = 0; x < width; x++, pixels++) {
272	strncpy(s, colors[*pixels].string, cpp);	322	if(cpp > (data_size - (s - *dataptr)))
		323	return;
		324	strncpy(s, colors[pixels].string, cpp); / why trust pixel? */
273	s += cpp;	325	s += cpp;
274	}	326	}
275	*s = '\0';	327	*s = '\0';
		328	if(offset > data_size)
		329	return;
276	(dataptr + 1) = dataptr + offset;	330	(dataptr + 1) = dataptr + offset;
277	}	331	}
278	/* duplicate some code to avoid a test in the loop */	332	/* duplicate some code to avoid a test in the loop */
279	s = *dataptr;	333	s = *dataptr;
		334	/* why trust width? */
280	for (x = 0; x < width; x++, pixels++) {	335	for (x = 0; x < width; x++, pixels++) {
281	strncpy(s, colors[*pixels].string, cpp);	336	if(cpp > data_size - (s - *dataptr))
		337	return;
		338	strncpy(s, colors[pixels].string, cpp); / why should we trust pixel? /
282	s += cpp;	339	s += cpp;
283	}	340	}
284	*s = '\0';	341	*s = '\0';
Lines 311-318 Link Here
311	}	368	}
312		369
313	static void	370	static void
314	CreateExtensions(dataptr, offset, ext, num, ext_nlines)	371	CreateExtensions(dataptr, data_size, offset, ext, num, ext_nlines)
315	char **dataptr;	372	char **dataptr;
		373	unsigned int data_size;
316	unsigned int offset;	374	unsigned int offset;
317	XpmExtension *ext;	375	XpmExtension *ext;
318	unsigned int num;	376	unsigned int num;
Lines 325-336 Link Here
325	dataptr++;	383	dataptr++;
326	a = 0;	384	a = 0;
327	for (x = 0; x < num; x++, ext++) {	385	for (x = 0; x < num; x++, ext++) {
328	sprintf(*dataptr, "XPMEXT %s", ext->name);	386	snprintf(*dataptr, data_size, "XPMEXT %s", ext->name);
329	a++;	387	a++;
330	if (a < ext_nlines)	388	if (a < ext_nlines)
331	(dataptr + 1) = dataptr + strlen(ext->name) + 8;	389	(dataptr + 1) = dataptr + strlen(ext->name) + 8;
332	dataptr++;	390	dataptr++;
333	b = ext->nlines;	391	b = ext->nlines; /* can we trust these values? */
334	for (y = 0, line = ext->lines; y < b; y++, line++) {	392	for (y = 0, line = ext->lines; y < b; y++, line++) {
335	strcpy(dataptr, line);	393	strcpy(dataptr, line);
336	a++;	394	a++;

Lines 37-42 Link Here

(-)extras/Xpm/lib/RdFToBuf.c (-2 / +5 lines)
37	* HeDu (hedu@cul-ipn.uni-kiel.de) 4/94	37	* HeDu (hedu@cul-ipn.uni-kiel.de) 4/94
38	*/	38	*/
39		39
		40	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		41
40	#include "XpmI.h"	42	#include "XpmI.h"
41	#include <sys/stat.h>	43	#include <sys/stat.h>
42	#if !defined(FOR_MSW) && !defined(WIN32)	44	#if !defined(FOR_MSW) && !defined(WIN32)
Lines 58-64 Link Here
58	char *filename;	60	char *filename;
59	char **buffer_return;	61	char **buffer_return;
60	{	62	{
61	int fd, fcheck, len;	63	int fd, fcheck;
		64	off_t len;
62	char *ptr;	65	char *ptr;
63	struct stat stats;	66	struct stat stats;
64	FILE *fp;	67	FILE *fp;
Lines 82-88 Link Here
82	close(fd);	85	close(fd);
83	return XpmOpenFailed;	86	return XpmOpenFailed;
84	}	87	}
85	len = (int) stats.st_size;	88	len = stats.st_size;
86	ptr = (char *) XpmMalloc(len + 1);	89	ptr = (char *) XpmMalloc(len + 1);
87	if (!ptr) {	90	if (!ptr) {
88	fclose(fp);	91	fclose(fp);

Lines 33-48 Link Here

(-)extras/Xpm/lib/RdFToI.c (-75 / +115 lines)
33	\*****************************************************************************/	33	\*****************************************************************************/
34	/* $XFree86$ */	34	/* $XFree86$ */
35		35
		36	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		37
36	#include "XpmI.h"	38	#include "XpmI.h"
37	#include <sys/stat.h>	39	#ifndef NO_ZPIPE
38	#if !defined(NO_ZPIPE) && defined(WIN32)	40	#include <fcntl.h>
39	# define popen _popen	41	#include <errno.h>
40	# define pclose _pclose	42	#include <sys/types.h>
41	# if defined(STAT_ZFILE)	43	#include <sys/wait.h>
42	# include <io.h>
43	# define stat _stat
44	# define fstat _fstat
45	# endif
46	#endif	44	#endif
47		45
48	LFUNC(OpenReadFile, int, (char filename, xpmData mdata));	46	LFUNC(OpenReadFile, int, (char filename, xpmData mdata));
Lines 120-125 Link Here
120	}	118	}
121	#endif /* CXPMPROG */	119	#endif /* CXPMPROG */
122		120
		121	#ifndef NO_ZPIPE
		122	/* Do not depend on errno after read_through */
		123	FILE*
		124	xpmPipeThrough(fd, cmd, arg1, mode)
		125	int fd;
		126	const char* cmd;
		127	const char* arg1;
		128	const char* mode;
		129	{
		130	FILE* fp;
		131	int status, fds[2], in = 0, out = 1;
		132	pid_t pid;
		133	if ( 'w' == *mode )
		134	out = 0, in = 1;
		135	if ( pipe(fds) < 0 )
		136	return NULL;
		137	pid = fork();
		138	if ( pid < 0 )
		139	goto fail1;
		140	if ( 0 == pid )
		141	{
		142	close(fds[in]);
		143	if ( dup2(fds[out], out) < 0 )
		144	goto err;
		145	close(fds[out]);
		146	if ( dup2(fd, in) < 0 )
		147	goto err;
		148	close(fd);
		149	pid = fork();
		150	if ( pid < 0 )
		151	goto err;
		152	if ( 0 == pid )
		153	{
		154	execlp(cmd, cmd, arg1, NULL);
		155	perror(cmd);
		156	goto err;
		157	}
		158	_exit(0);
		159	err:
		160	_exit(1);
		161	}
		162	close(fds[out]);
		163	/* calling process: wait for first child */
		164	while ( waitpid(pid, &status, 0) < 0 && EINTR == errno )
		165	;
		166	if ( WIFSIGNALED(status) \|\|
		167	(WIFEXITED(status) && WEXITSTATUS(status) != 0) )
		168	goto fail2;
		169	fp = fdopen(fds[in], mode);
		170	if ( !fp )
		171	goto fail2;
		172	close(fd); /* still open in 2nd child */
		173	return fp;
		174	fail1:
		175	close(fds[out]);
		176	fail2:
		177	close(fds[in]);
		178	return NULL;
		179	}
		180	#endif
		181
123	/*	182	/*
124	* open the given file to be read as an xpmData which is returned.	183	* open the given file to be read as an xpmData which is returned.
125	*/	184	*/
Lines 128-199 Link Here
128	char *filename;	187	char *filename;
129	xpmData *mdata;	188	xpmData *mdata;
130	{	189	{
131	#ifndef NO_ZPIPE
132	char buf[BUFSIZ];
133	# ifdef STAT_ZFILE
134	char *compressfile;
135	struct stat status;
136	# endif
137	#endif
138
139	if (!filename) {	190	if (!filename) {
140	mdata->stream.file = (stdin);	191	mdata->stream.file = (stdin);
141	mdata->type = XPMFILE;	192	mdata->type = XPMFILE;
142	} else {	193	} else {
143	#ifndef NO_ZPIPE	194	int fd = open(filename, O_RDONLY);
144	int len = strlen(filename);	195	#if defined(NO_ZPIPE)
145	if ((len > 2) && !strcmp(".Z", filename + (len - 2))) {	196	if ( fd < 0 )
146	mdata->type = XPMPIPE;	197	return XpmOpenFailed;
147	sprintf(buf, "uncompress -c \"%s\"", filename);	198	#else
148	if (!(mdata->stream.file = popen(buf, "r")))	199	const char* ext = NULL;
149	return (XpmOpenFailed);	200	if ( fd >= 0 )
150		201	ext = strrchr(filename, '.');
151	} else if ((len > 3) && !strcmp(".gz", filename + (len - 3))) {	202	#ifdef STAT_ZFILE /* searching for z-files if the given name not found */
152	mdata->type = XPMPIPE;	203	else
153	sprintf(buf, "gunzip -qc \"%s\"", filename);	204	{
154	if (!(mdata->stream.file = popen(buf, "r")))	205	size_t len = strlen(filename);
155	return (XpmOpenFailed);	206	char compressfile = (char ) XpmMalloc(len + 4);
156		207	if ( !compressfile )
157	} else {
158	# ifdef STAT_ZFILE
159	if (!(compressfile = (char *) XpmMalloc(len + 4)))
160	return (XpmNoMemory);	208	return (XpmNoMemory);
161		209	strcpy(compressfile, filename);
162	sprintf(compressfile, "%s.Z", filename);	210	strcpy(compressfile + len, ext = ".Z");
163	if (!stat(compressfile, &status)) {	211	fd = open(compressfile, O_RDONLY);
164	sprintf(buf, "uncompress -c \"%s\"", compressfile);	212	if ( fd < 0 )
165	if (!(mdata->stream.file = popen(buf, "r"))) {	213	{
		214	strcpy(compressfile + len, ext = ".gz");
		215	fd = open(compressfile, O_RDONLY);
		216	if ( fd < 0 )
		217	{
166	XpmFree(compressfile);	218	XpmFree(compressfile);
167	return (XpmOpenFailed);	219	return XpmOpenFailed;
168	}
169	mdata->type = XPMPIPE;
170	} else {
171	sprintf(compressfile, "%s.gz", filename);
172	if (!stat(compressfile, &status)) {
173	sprintf(buf, "gunzip -c \"%s\"", compressfile);
174	if (!(mdata->stream.file = popen(buf, "r"))) {
175	XpmFree(compressfile);
176	return (XpmOpenFailed);
177	}
178	mdata->type = XPMPIPE;
179	} else {
180	# endif
181	#endif
182	if (!(mdata->stream.file = fopen(filename, "r"))) {
183	#if !defined(NO_ZPIPE) && defined(STAT_ZFILE)
184	XpmFree(compressfile);
185	#endif
186	return (XpmOpenFailed);
187	}
188	mdata->type = XPMFILE;
189	#ifndef NO_ZPIPE
190	# ifdef STAT_ZFILE
191	}	220	}
192	}	221	}
193	XpmFree(compressfile);	222	XpmFree(compressfile);
194	# endif
195	}	223	}
196	#endif	224	#endif
		225	if ( ext && !strcmp(ext, ".Z") )
		226	{
		227	mdata->type = XPMPIPE;
		228	mdata->stream.file = xpmPipeThrough(fd, "uncompress", "-c", "r");
		229	}
		230	else if ( ext && !strcmp(ext, ".gz") )
		231	{
		232	mdata->type = XPMPIPE;
		233	mdata->stream.file = xpmPipeThrough(fd, "gunzip", "-qc", "r");
		234	}
		235	else
		236	#endif /* z-files */
		237	{
		238	mdata->type = XPMFILE;
		239	mdata->stream.file = fdopen(fd, "r");
		240	}
		241	if (!mdata->stream.file)
		242	{
		243	close(fd);
		244	return (XpmOpenFailed);
		245	}
197	}	246	}
198	mdata->CommentLength = 0;	247	mdata->CommentLength = 0;
199	#ifdef CXPMPROG	248	#ifdef CXPMPROG
Lines 210-224 Link Here
210	xpmDataClose(mdata)	259	xpmDataClose(mdata)
211	xpmData *mdata;	260	xpmData *mdata;
212	{	261	{
213	switch (mdata->type) {	262	if (mdata->stream.file != (stdin))
214	case XPMFILE:	263	fclose(mdata->stream.file);
215	if (mdata->stream.file != (stdin))
216	fclose(mdata->stream.file);
217	break;
218	#ifndef NO_ZPIPE
219	case XPMPIPE:
220	pclose(mdata->stream.file);
221	break;
222	#endif
223	}
224	}	264	}

Lines 32-37 Link Here

(-)extras/Xpm/lib/WrFFrBuf.c (-1 / +3 lines)
32	* Developed by Arnaud Le Hors *	32	* Developed by Arnaud Le Hors *
33	\*****************************************************************************/	33	\*****************************************************************************/
34		34
		35	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		36
35	#include "XpmI.h"	37	#include "XpmI.h"
36		38
37	int	39	int
Lines 49-55 Link Here
49	fcheck = fwrite(buffer, len, 1, fp);	51	fcheck = fwrite(buffer, len, 1, fp);
50	fclose(fp);	52	fclose(fp);
51	if (fcheck != 1)	53	if (fcheck != 1)
52	return XpmOpenFailed;	54	return XpmOpenFailed; /* maybe use a better return value */
53		55
54	return XpmSuccess;	56	return XpmSuccess;
55	}	57	}

Lines 39-47 Link Here

(-)extras/Xpm/lib/WrFFrI.c (-37 / +36 lines)
39	*/	39	*/
40		40
41	#include "XpmI.h"	41	#include "XpmI.h"
42	#if !defined(NO_ZPIPE) && defined(WIN32)	42
43	# define popen _popen	43	#ifndef NO_ZPIPE
44	# define pclose _pclose	44	#include "sys/wait.h"
		45	#include "sys/types.h"
		46	#include "fcntl.h"
		47	#include "unistd.h"
		48	#include "errno.h"
45	#endif	49	#endif
46		50
47	/* MS Windows define a function called WriteFile @#%#&!!! */	51	/* MS Windows define a function called WriteFile @#%#&!!! */
Lines 98-104 Link Here
98	XpmInfo *info;	102	XpmInfo *info;
99	{	103	{
100	xpmData mdata;	104	xpmData mdata;
101	char name, dot, *s, new_name[BUFSIZ];	105	char name, dot, *s, new_name[BUFSIZ] = {0};
102	int ErrorStatus;	106	int ErrorStatus;
103		107
104	/* open file to write */	108	/* open file to write */
Lines 121-127 Link Here
121	#endif	125	#endif
122	/* let's try to make a valid C syntax name */	126	/* let's try to make a valid C syntax name */
123	if (index(name, '.')) {	127	if (index(name, '.')) {
124	strcpy(new_name, name);	128	strncpy(new_name, name, sizeof(new_name));
		129	new_name[sizeof(new_name)-1] = '\0';
125	/* change '.' to '_' */	130	/* change '.' to '_' */
126	name = s = new_name;	131	name = s = new_name;
127	while ((dot = index(s, '.'))) {	132	while ((dot = index(s, '.'))) {
Lines 248-254 Link Here
248	unsigned int x, y, h;	253	unsigned int x, y, h;
249		254
250	h = height - 1;	255	h = height - 1;
251	if (cpp != 0 && width >= (SIZE_MAX - 3)/cpp)	256	if (cpp != 0 && width >= (UINT_MAX - 3)/cpp)
252	return XpmNoMemory;	257	return XpmNoMemory;
253	p = buf = (char ) XpmMalloc(width cpp + 3);	258	p = buf = (char ) XpmMalloc(width cpp + 3);
254	if (!buf)	259	if (!buf)
Lines 297-302 Link Here
297	fprintf(file, ",\n\"XPMENDEXT\"");	302	fprintf(file, ",\n\"XPMENDEXT\"");
298	}	303	}
299		304
		305
		306	#ifndef NO_ZPIPE
		307	FUNC(xpmPipeThrough, FILE*, (int fd,
		308	const char* cmd,
		309	const char* arg1,
		310	const char* mode));
		311	#endif
		312
300	/*	313	/*
301	* open the given file to be written as an xpmData which is returned	314	* open the given file to be written as an xpmData which is returned
302	*/	315	*/
Lines 305-342 Link Here
305	char *filename;	318	char *filename;
306	xpmData *mdata;	319	xpmData *mdata;
307	{	320	{
308	#ifndef NO_ZPIPE
309	char buf[BUFSIZ];
310
311	#endif
312
313	if (!filename) {	321	if (!filename) {
314	mdata->stream.file = (stdout);	322	mdata->stream.file = (stdout);
315	mdata->type = XPMFILE;	323	mdata->type = XPMFILE;
316	} else {	324	} else {
317	#ifndef NO_ZPIPE	325	#ifndef NO_ZPIPE
318	int len = strlen(filename);	326	size_t len;
		327	#endif
		328	int fd = open(filename, O_WRONLY\|O_CREAT\|O_TRUNC, 0644);
		329	if ( fd < 0 )
		330	return(XpmOpenFailed);
		331	#ifndef NO_ZPIPE
		332	len = strlen(filename);
319	if (len > 2 && !strcmp(".Z", filename + (len - 2))) {	333	if (len > 2 && !strcmp(".Z", filename + (len - 2))) {
320	sprintf(buf, "compress > \"%s\"", filename);	334	mdata->stream.file = xpmPipeThrough(fd, "compress", NULL, "w");
321	if (!(mdata->stream.file = popen(buf, "w")))
322	return (XpmOpenFailed);
323
324	mdata->type = XPMPIPE;	335	mdata->type = XPMPIPE;
325	} else if (len > 3 && !strcmp(".gz", filename + (len - 3))) {	336	} else if (len > 3 && !strcmp(".gz", filename + (len - 3))) {
326	sprintf(buf, "gzip -q > \"%s\"", filename);	337	mdata->stream.file = xpmPipeThrough(fd, "gzip", "-q", "w");
327	if (!(mdata->stream.file = popen(buf, "w")))
328	return (XpmOpenFailed);
329
330	mdata->type = XPMPIPE;	338	mdata->type = XPMPIPE;
331	} else {	339	} else
332	#endif	340	#endif
333	if (!(mdata->stream.file = fopen(filename, "w")))	341	{
334	return (XpmOpenFailed);	342	mdata->stream.file = fdopen(fd, "w");
335
336	mdata->type = XPMFILE;	343	mdata->type = XPMFILE;
337	#ifndef NO_ZPIPE
338	}	344	}
339	#endif	345	if (!mdata->stream.file)
		346	return (XpmOpenFailed);
340	}	347	}
341	return (XpmSuccess);	348	return (XpmSuccess);
342	}	349	}
Lines 348-362 Link Here
348	xpmDataClose(mdata)	355	xpmDataClose(mdata)
349	xpmData *mdata;	356	xpmData *mdata;
350	{	357	{
351	switch (mdata->type) {	358	if (mdata->stream.file != (stdout))
352	case XPMFILE:	359	fclose(mdata->stream.file);
353	if (mdata->stream.file != (stdout))
354	fclose(mdata->stream.file);
355	break;
356	#ifndef NO_ZPIPE
357	case XPMPIPE:
358	pclose(mdata->stream.file);
359	break;
360	#endif
361	}
362	}	360	}
		361

Lines 49-56 Link Here

(-)extras/Xpm/lib/XpmI.h (+2 lines)
49	* lets try to solve include files	49	* lets try to solve include files
50	*/	50	*/
51		51
		52	#include <sys/types.h>
52	#include <stdio.h>	53	#include <stdio.h>
53	#include <stdlib.h>	54	#include <stdlib.h>
		55	#include <limits.h>
54	/* stdio.h doesn't declare popen on a Sequent DYNIX OS */	56	/* stdio.h doesn't declare popen on a Sequent DYNIX OS */
55	#ifdef sequent	57	#ifdef sequent
56	extern FILE *popen();	58	extern FILE *popen();

Lines 45-50 Link Here

(-)extras/Xpm/lib/create.c (-27 / +65 lines)
45	* Lorens Younes (d93-hyo@nada.kth.se) 4/96	45	* Lorens Younes (d93-hyo@nada.kth.se) 4/96
46	*/	46	*/
47		47
		48	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		49
48	#include "XpmI.h"	50	#include "XpmI.h"
49	#include <ctype.h>	51	#include <ctype.h>
50		52
Lines 586-592 Link Here
586	*/	588	*/
587	} else {	589	} else {
588	#endif	590	#endif
589	int i;	591	unsigned int i;
590		592
591	#ifndef AMIGA	593	#ifndef AMIGA
592	ncols = visual->map_entries;	594	ncols = visual->map_entries;
Lines 746-757 Link Here
746		748
747		749
748	/* function call in case of error */	750	/* function call in case of error */
		751
749	#undef RETURN	752	#undef RETURN
750	#define RETURN(status) \	753	#define RETURN(status) \
		754	do \
751	{ \	755	{ \
752	ErrorStatus = status; \	756	ErrorStatus = status; \
753	goto error; \	757	goto error; \
754	}	758	} while(0)
755		759
756	int	760	int
757	XpmCreateImageFromXpmImage(display, image,	761	XpmCreateImageFromXpmImage(display, image,
Lines 817-823 Link Here
817		821
818	ErrorStatus = XpmSuccess;	822	ErrorStatus = XpmSuccess;
819		823
820	if (image->ncolors >= SIZE_MAX / sizeof(Pixel))	824	if (image->ncolors >= UINT_MAX / sizeof(Pixel))
821	return (XpmNoMemory);	825	return (XpmNoMemory);
822		826
823	/* malloc pixels index tables */	827	/* malloc pixels index tables */
Lines 992-1000 Link Here
992	return (XpmNoMemory);	996	return (XpmNoMemory);
993		997
994	#if !defined(FOR_MSW) && !defined(AMIGA)	998	#if !defined(FOR_MSW) && !defined(AMIGA)
995	if (height != 0 && (*image_return)->bytes_per_line >= SIZE_MAX / height)	999	if (height != 0 && (*image_return)->bytes_per_line >= INT_MAX / height) {
		1000	XDestroyImage(*image_return);
996	return XpmNoMemory;	1001	return XpmNoMemory;
		1002	}
997	/* now that bytes_per_line must have been set properly alloc data */	1003	/* now that bytes_per_line must have been set properly alloc data */
		1004	if((*image_return)->bytes_per_line == 0 \|\| height == 0)
		1005	return XpmNoMemory;
998	(*image_return)->data =	1006	(*image_return)->data =
999	(char ) XpmMalloc((image_return)->bytes_per_line * height);	1007	(char ) XpmMalloc((image_return)->bytes_per_line * height);
1000		1008
Lines 1023-1029 Link Here
1023	LFUNC(_putbits, void, (register char *src, int dstoffset,	1031	LFUNC(_putbits, void, (register char *src, int dstoffset,
1024	register int numbits, register char *dst));	1032	register int numbits, register char *dst));
1025		1033
1026	LFUNC(_XReverse_Bytes, int, (register unsigned char *bpt, register int nb));	1034	LFUNC(_XReverse_Bytes, int, (register unsigned char *bpt, register unsigned int nb));
1027		1035
1028	static unsigned char Const _reverse_byte[0x100] = {	1036	static unsigned char Const _reverse_byte[0x100] = {
1029	0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0,	1037	0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0,
Lines 1063-1074 Link Here
1063	static int	1071	static int
1064	_XReverse_Bytes(bpt, nb)	1072	_XReverse_Bytes(bpt, nb)
1065	register unsigned char *bpt;	1073	register unsigned char *bpt;
1066	register int nb;	1074	register unsigned int nb;
1067	{	1075	{
1068	do {	1076	do {
1069	bpt = _reverse_byte[bpt];	1077	bpt = _reverse_byte[bpt];
1070	bpt++;	1078	bpt++;
1071	} while (--nb > 0);	1079	} while (--nb > 0); /* is nb user-controled? */
1072	return 0;	1080	return 0;
1073	}	1081	}
1074		1082
Lines 1207-1213 Link Here
1207	register char *src;	1215	register char *src;
1208	register char *dst;	1216	register char *dst;
1209	register unsigned int *iptr;	1217	register unsigned int *iptr;
1210	register int x, y, i;	1218	register unsigned int x, y, i;
1211	register char *data;	1219	register char *data;
1212	Pixel pixel, px;	1220	Pixel pixel, px;
1213	int nbytes, depth, ibu, ibpp;	1221	int nbytes, depth, ibu, ibpp;
Lines 1217-1224 Link Here
1217	depth = image->depth;	1225	depth = image->depth;
1218	if (depth == 1) {	1226	if (depth == 1) {
1219	ibu = image->bitmap_unit;	1227	ibu = image->bitmap_unit;
1220	for (y = 0; y < height; y++)	1228	for (y = 0; y < height; y++) /* how can we trust height */
1221	for (x = 0; x < width; x++, iptr++) {	1229	for (x = 0; x < width; x++, iptr++) { /* how can we trust width */
1222	pixel = pixels[*iptr];	1230	pixel = pixels[*iptr];
1223	for (i = 0, px = pixel; i < sizeof(unsigned long);	1231	for (i = 0, px = pixel; i < sizeof(unsigned long);
1224	i++, px >>= 8)	1232	i++, px >>= 8)
Lines 1293-1304 Link Here
1293	{	1301	{
1294	unsigned char *data;	1302	unsigned char *data;
1295	unsigned int *iptr;	1303	unsigned int *iptr;
1296	int y;	1304	unsigned int y;
1297	Pixel pixel;	1305	Pixel pixel;
1298		1306
1299	#ifdef WITHOUT_SPEEDUPS	1307	#ifdef WITHOUT_SPEEDUPS
1300		1308
1301	int x;	1309	unsigned int x;
1302	unsigned char *addr;	1310	unsigned char *addr;
1303		1311
1304	data = (unsigned char *) image->data;	1312	data = (unsigned char *) image->data;
Lines 1335-1341 Link Here
1335		1343
1336	#else /* WITHOUT_SPEEDUPS */	1344	#else /* WITHOUT_SPEEDUPS */
1337		1345
1338	int bpl = image->bytes_per_line;	1346	unsigned int bpl = image->bytes_per_line;
1339	unsigned char data_ptr, max_data;	1347	unsigned char data_ptr, max_data;
1340		1348
1341	data = (unsigned char *) image->data;	1349	data = (unsigned char *) image->data;
Lines 1403-1413 Link Here
1403	{	1411	{
1404	unsigned char *data;	1412	unsigned char *data;
1405	unsigned int *iptr;	1413	unsigned int *iptr;
1406	int y;	1414	unsigned int y;
1407		1415
1408	#ifdef WITHOUT_SPEEDUPS	1416	#ifdef WITHOUT_SPEEDUPS
1409		1417
1410	int x;	1418	unsigned int x;
1411	unsigned char *addr;	1419	unsigned char *addr;
1412		1420
1413	data = (unsigned char *) image->data;	1421	data = (unsigned char *) image->data;
Lines 1431-1437 Link Here
1431		1439
1432	Pixel pixel;	1440	Pixel pixel;
1433		1441
1434	int bpl = image->bytes_per_line;	1442	unsigned int bpl = image->bytes_per_line;
1435	unsigned char data_ptr, max_data;	1443	unsigned char data_ptr, max_data;
1436		1444
1437	data = (unsigned char *) image->data;	1445	data = (unsigned char *) image->data;
Lines 1484-1494 Link Here
1484	{	1492	{
1485	char *data;	1493	char *data;
1486	unsigned int *iptr;	1494	unsigned int *iptr;
1487	int y;	1495	unsigned int y;
1488		1496
1489	#ifdef WITHOUT_SPEEDUPS	1497	#ifdef WITHOUT_SPEEDUPS
1490		1498
1491	int x;	1499	unsigned int x;
1492		1500
1493	data = image->data;	1501	data = image->data;
1494	iptr = pixelindex;	1502	iptr = pixelindex;
Lines 1498-1504 Link Here
1498		1506
1499	#else /* WITHOUT_SPEEDUPS */	1507	#else /* WITHOUT_SPEEDUPS */
1500		1508
1501	int bpl = image->bytes_per_line;	1509	unsigned int bpl = image->bytes_per_line;
1502	char data_ptr, max_data;	1510	char data_ptr, max_data;
1503		1511
1504	data = image->data;	1512	data = image->data;
Lines 1533-1544 Link Here
1533	PutImagePixels(image, width, height, pixelindex, pixels);	1541	PutImagePixels(image, width, height, pixelindex, pixels);
1534	else {	1542	else {
1535	unsigned int *iptr;	1543	unsigned int *iptr;
1536	int y;	1544	unsigned int y;
1537	char *data;	1545	char *data;
1538		1546
1539	#ifdef WITHOUT_SPEEDUPS	1547	#ifdef WITHOUT_SPEEDUPS
1540		1548
1541	int x;	1549	unsigned int x;
1542		1550
1543	data = image->data;	1551	data = image->data;
1544	iptr = pixelindex;	1552	iptr = pixelindex;
Lines 1761-1766 Link Here
1761	Pixel px;	1769	Pixel px;
1762	int nbytes;	1770	int nbytes;
1763		1771
		1772	if(x < 0 \|\| y < 0)
		1773	return 0;
		1774
1764	for (i=0, px=pixel; i<sizeof(unsigned long); i++, px>>=8)	1775	for (i=0, px=pixel; i<sizeof(unsigned long); i++, px>>=8)
1765	((unsigned char *)&pixel)[i] = px;	1776	((unsigned char *)&pixel)[i] = px;
1766	src = &ximage->data[XYINDEX(x, y, ximage)];	1777	src = &ximage->data[XYINDEX(x, y, ximage)];
Lines 1791-1797 Link Here
1791	register char *dst;	1802	register char *dst;
1792	register int i;	1803	register int i;
1793	Pixel px;	1804	Pixel px;
1794	int nbytes, ibpp;	1805	unsigned int nbytes, ibpp;
		1806
		1807	if(x < 0 \|\| y < 0)
		1808	return 0;
1795		1809
1796	ibpp = ximage->bits_per_pixel;	1810	ibpp = ximage->bits_per_pixel;
1797	if (ximage->depth == 4)	1811	if (ximage->depth == 4)
Lines 1825-1830 Link Here
1825	{	1839	{
1826	unsigned char *addr;	1840	unsigned char *addr;
1827		1841
		1842	if(x < 0 \|\| y < 0)
		1843	return 0;
		1844
1828	addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)];	1845	addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)];
1829	((unsigned long )addr) = pixel;	1846	((unsigned long )addr) = pixel;
1830	return 1;	1847	return 1;
Lines 1840-1845 Link Here
1840	{	1857	{
1841	unsigned char *addr;	1858	unsigned char *addr;
1842		1859
		1860	if(x < 0 \|\| y < 0)
		1861	return 0;
		1862
1843	addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)];	1863	addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)];
1844	addr[0] = pixel >> 24;	1864	addr[0] = pixel >> 24;
1845	addr[1] = pixel >> 16;	1865	addr[1] = pixel >> 16;
Lines 1857-1862 Link Here
1857	{	1877	{
1858	unsigned char *addr;	1878	unsigned char *addr;
1859		1879
		1880	if(x < 0 \|\| y < 0)
		1881	return 0;
		1882
1860	addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)];	1883	addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)];
1861	addr[3] = pixel >> 24;	1884	addr[3] = pixel >> 24;
1862	addr[2] = pixel >> 16;	1885	addr[2] = pixel >> 16;
Lines 1874-1879 Link Here
1874	{	1897	{
1875	unsigned char *addr;	1898	unsigned char *addr;
1876		1899
		1900	if(x < 0 \|\| y < 0)
		1901	return 0;
		1902
1877	addr = &((unsigned char *)ximage->data) [ZINDEX16(x, y, ximage)];	1903	addr = &((unsigned char *)ximage->data) [ZINDEX16(x, y, ximage)];
1878	addr[0] = pixel >> 8;	1904	addr[0] = pixel >> 8;
1879	addr[1] = pixel;	1905	addr[1] = pixel;
Lines 1889-1894 Link Here
1889	{	1915	{
1890	unsigned char *addr;	1916	unsigned char *addr;
1891		1917
		1918	if(x < 0 \|\| y < 0)
		1919	return 0;
		1920
1892	addr = &((unsigned char *)ximage->data) [ZINDEX16(x, y, ximage)];	1921	addr = &((unsigned char *)ximage->data) [ZINDEX16(x, y, ximage)];
1893	addr[1] = pixel >> 8;	1922	addr[1] = pixel >> 8;
1894	addr[0] = pixel;	1923	addr[0] = pixel;
Lines 1902-1907 Link Here
1902	int y;	1931	int y;
1903	unsigned long pixel;	1932	unsigned long pixel;
1904	{	1933	{
		1934	if(x < 0 \|\| y < 0)
		1935	return 0;
		1936
1905	ximage->data[ZINDEX8(x, y, ximage)] = pixel;	1937	ximage->data[ZINDEX8(x, y, ximage)] = pixel;
1906	return 1;	1938	return 1;
1907	}	1939	}
Lines 1913-1918 Link Here
1913	int y;	1945	int y;
1914	unsigned long pixel;	1946	unsigned long pixel;
1915	{	1947	{
		1948	if(x < 0 \|\| y < 0)
		1949	return 0;
		1950
1916	if (pixel & 1)	1951	if (pixel & 1)
1917	ximage->data[ZINDEX1(x, y, ximage)] \|= 0x80 >> (x & 7);	1952	ximage->data[ZINDEX1(x, y, ximage)] \|= 0x80 >> (x & 7);
1918	else	1953	else
Lines 1927-1932 Link Here
1927	int y;	1962	int y;
1928	unsigned long pixel;	1963	unsigned long pixel;
1929	{	1964	{
		1965	if(x < 0 \|\| y < 0)
		1966	return 0;
		1967
1930	if (pixel & 1)	1968	if (pixel & 1)
1931	ximage->data[ZINDEX1(x, y, ximage)] \|= 1 << (x & 7);	1969	ximage->data[ZINDEX1(x, y, ximage)] \|= 1 << (x & 7);
1932	else	1970	else
Lines 2061-2068 Link Here
2061	xpmGetCmt(data, &colors_cmt);	2099	xpmGetCmt(data, &colors_cmt);
2062		2100
2063	/* malloc pixels index tables */	2101	/* malloc pixels index tables */
2064	if (ncolors >= SIZE_MAX / sizeof(Pixel))	2102	if (ncolors >= UINT_MAX / sizeof(Pixel))
2065	return XpmNoMemory;	2103	RETURN(XpmNoMemory);
2066		2104
2067	image_pixels = (Pixel ) XpmMalloc(sizeof(Pixel) ncolors);	2105	image_pixels = (Pixel ) XpmMalloc(sizeof(Pixel) ncolors);
2068	if (!image_pixels)	2106	if (!image_pixels)
Lines 2174-2180 Link Here
2174	* free the hastable	2212	* free the hastable
2175	*/	2213	*/
2176	if (ErrorStatus != XpmSuccess)	2214	if (ErrorStatus != XpmSuccess)
2177	RETURN(ErrorStatus)	2215	RETURN(ErrorStatus);
2178	else if (USE_HASHTABLE)	2216	else if (USE_HASHTABLE)
2179	xpmHashTableFree(&hashtable);	2217	xpmHashTableFree(&hashtable);
2180		2218
Lines 2366-2376 Link Here
2366		2404
2367	/* array of pointers malloced by need */	2405	/* array of pointers malloced by need */
2368	unsigned short *cidx[256];	2406	unsigned short *cidx[256];
2369	int char1;	2407	unsigned int char1;
2370		2408
2371	bzero((char )cidx, 256 sizeof(unsigned short )); / init */	2409	bzero((char )cidx, 256 sizeof(unsigned short )); / init */
2372	for (a = 0; a < ncolors; a++) {	2410	for (a = 0; a < ncolors; a++) {
2373	char1 = colorTable[a].string[0];	2411	char1 = (unsigned char) colorTable[a].string[0];
2374	if (cidx[char1] == NULL) { /* get new memory */	2412	if (cidx[char1] == NULL) { /* get new memory */
2375	cidx[char1] = (unsigned short *)	2413	cidx[char1] = (unsigned short *)
2376	XpmCalloc(256, sizeof(unsigned short));	2414	XpmCalloc(256, sizeof(unsigned short));

Lines 33-38 Link Here

(-)extras/Xpm/lib/data.c (-4 / +7 lines)
33	\*****************************************************************************/	33	\*****************************************************************************/
34	/* $XFree86: xc/extras/Xpm/lib/data.c,v 1.3 2001/10/28 03:32:10 tsi Exp $ */	34	/* $XFree86: xc/extras/Xpm/lib/data.c,v 1.3 2001/10/28 03:32:10 tsi Exp $ */
35		35
		36	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		37
36	#ifndef CXPMPROG	38	#ifndef CXPMPROG
37	#if 0	39	#if 0
38	/* Official version number */	40	/* Official version number */
Lines 262-268 Link Here
262	}	264	}
263	Ungetc(data, c, file);	265	Ungetc(data, c, file);
264	}	266	}
265	return (n);	267	return (n); /* this returns bytes read + 1 */
266	}	268	}
267		269
268	/*	270	/*
Lines 375-382 Link Here
375	{	377	{
376	if (!data->type)	378	if (!data->type)
377	*cmt = NULL;	379	*cmt = NULL;
378	else if (data->CommentLength != 0 && data->CommentLength < SIZE_MAX - 1) {	380	else if (data->CommentLength != 0 && data->CommentLength < UINT_MAX - 1) {
379	cmt = (char ) XpmMalloc(data->CommentLength + 1);	381	if( (cmt = (char ) XpmMalloc(data->CommentLength + 1)) == NULL)
		382	return XpmNoMemory;
380	strncpy(*cmt, data->Comment, data->CommentLength);	383	strncpy(*cmt, data->Comment, data->CommentLength);
381	(*cmt)[data->CommentLength] = '\0';	384	(*cmt)[data->CommentLength] = '\0';
382	data->CommentLength = 0;	385	data->CommentLength = 0;
Lines 400-406 Link Here
400	xpmParseHeader(data)	403	xpmParseHeader(data)
401	xpmData *data;	404	xpmData *data;
402	{	405	{
403	char buf[BUFSIZ];	406	char buf[BUFSIZ+1] = {0};
404	int l, n = 0;	407	int l, n = 0;
405		408
406	if (data->type) {	409	if (data->type) {




    unsigned int size = table->size;
    xpmHashAtom *t, *p;
    int i;
    unsigned int oldSize = size;

    t = atomTable;
    HASH_TABLE_GROWS
	table->size = size;
    table->limit = size / 3;
    if (size >= UINT_MAX / sizeof(*atomTable)) 
	return (XpmNoMemory);
    atomTable = (xpmHashAtom *) XpmMalloc(size * sizeof(*atomTable));
    if (!atomTable)

    table->size = INITIAL_HASH_SIZE;
    table->limit = table->size / 3;
    table->used = 0;
    if (table->size >= UINT_MAX / sizeof(*atomTable))
	return (XpmNoMemory);
    atomTable = (xpmHashAtom *) XpmMalloc(table->size * sizeof(*atomTable));
    if (!atomTable)

Lines 44-50 Link Here

(-)extras/Xpm/lib/misc.c (-1 / +1 lines)
44	char *s1;	44	char *s1;
45	{	45	{
46	char *s2;	46	char *s2;
47	int l = strlen(s1) + 1;	47	size_t l = strlen(s1) + 1;
48		48
49	if (s2 = (char *) XpmMalloc(l))	49	if (s2 = (char *) XpmMalloc(l))
50	strcpy(s2, s1);	50	strcpy(s2, s1);




 * HeDu (hedu@cul-ipn.uni-kiel.de) 4/94
 */

/* October 2004, source code review by Thomas Biege <thomas@suse.de> */

#include "XpmI.h"
#include <ctype.h>
#include <string.h>

#ifdef HAS_STRLCAT
# define STRLCAT(dst, src, dstsize) do { \
  	if (strlcat(dst, src, dstsize) >= (dstsize)) \
	    return (XpmFileInvalid); } while(0)
# define STRLCPY(dst, src, dstsize) do { \
  	if (strlcpy(dst, src, dstsize) >= (dstsize)) \
	    return (XpmFileInvalid); } while(0)
#else
# define STRLCAT(dst, src, dstsize) do { \
	if ((strlen(dst) + strlen(src)) < (dstsize)) \
 	    strcat(dst, src); \
	else return (XpmFileInvalid); } while(0)
# define STRLCPY(dst, src, dstsize) do { \
	if (strlen(src) < (dstsize)) \
 	    strcpy(dst, src); \
	else return (XpmFileInvalid); } while(0)
#endif

LFUNC(ParsePixels, int, (xpmData *data, unsigned int width,

    char **defaults;
    int ErrorStatus;

    if (ncolors >= UINT_MAX / sizeof(XpmColor))
	return (XpmNoMemory);
    colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));
    if (!colorTable)

	    /*
	     * read pixel value
	     */
	    if (cpp >= UINT_MAX - 1) {
		xpmFreeColorTable(colorTable, ncolors);
		return (XpmNoMemory);
	    }

			return (XpmFileInvalid);
		    }
		    if (!lastwaskey)
			STRLCAT(curbuf, " ", sizeof(curbuf));/* append space */
		    buf[l] = '\0';
		    STRLCAT(curbuf, buf, sizeof(curbuf)); /* append buf */
		    lastwaskey = 0;
		}
	    }

		xpmFreeColorTable(colorTable, ncolors);
		return (XpmFileInvalid);
	    }
	    len = strlen(curbuf) + 1; /* integer overflow just theoretically possible */
	    s = defaults[curkey] = (char *) XpmMalloc(len);
	    if (!s) {
		xpmFreeColorTable(colorTable, ncolors);

	    /*
	     * read pixel value
	     */
	    if (cpp >= UINT_MAX - 1) {
		xpmFreeColorTable(colorTable, ncolors);
		return (XpmNoMemory);
	    }

	    memcpy(s, curbuf, len);
	    color->c_color = s;
	    *curbuf = '\0';		/* reset curbuf */
	    if (a < ncolors - 1)	/* can we trust ncolors -> leave data's bounds */
		xpmNextString(data);	/* get to the next string */
	}
    }

    xpmHashTable *hashtable;
    unsigned int **pixels;
{
    unsigned int *iptr, *iptr2 = NULL; /* found by Egbert Eich */
    unsigned int a, x, y;

    if ((height > 0 && width >= UINT_MAX / height) ||
	width * height >= UINT_MAX / sizeof(unsigned int)) 
	return XpmNoMemory;
#ifndef FOR_MSW
    iptr2 = (unsigned int *) XpmMalloc(sizeof(unsigned int) * width * height);

	{
	    unsigned short colidx[256];

	    if (ncolors > 256) {
		XpmFree(iptr2); /* found by Egbert Eich */
		return (XpmFileInvalid);
	    }

	    bzero((char *)colidx, 256 * sizeof(short));
	    for (a = 0; a < ncolors; a++)

	{

/* free all allocated pointers at all exits */
#define FREE_CIDX \
do \
{ \
	int f; for (f = 0; f < 256; f++) \
	if (cidx[f]) XpmFree(cidx[f]); \
} while(0)

	    /* array of pointers malloced by need */
	    unsigned short *cidx[256];
	    unsigned int char1;

	    bzero((char *)cidx, 256 * sizeof(unsigned short *)); /* init */
	    for (a = 0; a < ncolors; a++) {
		char1 = (unsigned char) colorTable[a].string[0];
		if (cidx[char1] == NULL) { /* get new memory */
		    cidx[char1] = (unsigned short *)
			XpmCalloc(256, sizeof(unsigned short));

	    char *s;
	    char buf[BUFSIZ];

	    if (cpp >= sizeof(buf)) {
		XpmFree(iptr2); /* found by Egbert Eich */
		return (XpmFileInvalid);
	    }

	    buf[cpp] = '\0';
	    if (USE_HASHTABLE) {

		    xpmNextString(data);
		    for (x = 0; x < width; x++, iptr++) {
			for (a = 0, s = buf; a < cpp; a++, s++)
			    *s = xpmGetC(data); /* int assigned to char, not a problem here */
			slot = xpmHashSlot(hashtable, buf);
			if (!*slot) {	/* no color matches */
			    XpmFree(iptr2);

		    xpmNextString(data);
		    for (x = 0; x < width; x++, iptr++) {
			for (a = 0, s = buf; a < cpp; a++, s++)
			    *s = xpmGetC(data); /* int assigned to char, not a problem here */
			for (a = 0; a < ncolors; a++)
			    if (!strcmp(colorTable[a].string, buf))
				break;

    while (!notstart && notend) {
	/* there starts an extension */
	ext = (XpmExtension *)
	    XpmRealloc(exts, (num + 1) * sizeof(XpmExtension)); /* can the loop be forced to iterate often enough to make "(num + 1) * sizeof(XpmExtension)" wrapping? */
	if (!ext) {
	    XpmFree(string);
	    XpmFreeExtensions(exts, num);

	while ((notstart = strncmp("XPMEXT", string, 6))
	       && (notend = strncmp("XPMENDEXT", string, 9))) {
	    sp = (char **)
		XpmRealloc(ext->lines, (nlines + 1) * sizeof(char *)); /* can we iterate enough for a wrapping? */
	    if (!sp) {
		XpmFree(string);
		ext->nlines = nlines;

/* function call in case of error */
#undef RETURN
#define RETURN(status) \
do { \
      goto error; \
} while(0)

/*
 * This function parses an Xpm file or data and store the found informations

Lines 43-48 Link Here

(-)extras/Xpm/lib/scan.c (-18 / +20 lines)
43	* Lorens Younes (d93-hyo@nada.kth.se) 4/96	43	* Lorens Younes (d93-hyo@nada.kth.se) 4/96
44	*/	44	*/
45		45
		46	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		47
46	#include "XpmI.h"	48	#include "XpmI.h"
47		49
48	#define MAXPRINTABLE 92 /* number of printable ascii chars	50	#define MAXPRINTABLE 92 /* number of printable ascii chars
Lines 172-181 Link Here
172	/* function call in case of error */	174	/* function call in case of error */
173	#undef RETURN	175	#undef RETURN
174	#define RETURN(status) \	176	#define RETURN(status) \
175	{ \	177	do { \
176	ErrorStatus = status; \	178	ErrorStatus = status; \
177	goto error; \	179	goto error; \
178	}	180	} while(0)
179		181
180	/*	182	/*
181	* This function scans the given image and stores the found informations in	183	* This function scans the given image and stores the found informations in
Lines 233-247 Link Here
233	else	235	else
234	cpp = 0;	236	cpp = 0;
235		237
236	if ((height > 0 && width >= SIZE_MAX / height) \|\|	238	if ((height > 0 && width >= UINT_MAX / height) \|\|
237	width * height >= SIZE_MAX / sizeof(unsigned int))	239	width * height >= UINT_MAX / sizeof(unsigned int))
238	RETURN(XpmNoMemory);	240	RETURN(XpmNoMemory);
239	pmap.pixelindex =	241	pmap.pixelindex =
240	(unsigned int ) XpmCalloc(width height, sizeof(unsigned int));	242	(unsigned int ) XpmCalloc(width height, sizeof(unsigned int));
241	if (!pmap.pixelindex)	243	if (!pmap.pixelindex)
242	RETURN(XpmNoMemory);	244	RETURN(XpmNoMemory);
243		245
244	if (pmap.size >= SIZE_MAX / sizeof(Pixel))	246	if (pmap.size >= UINT_MAX / sizeof(Pixel))
245	RETURN(XpmNoMemory);	247	RETURN(XpmNoMemory);
246		248
247	pmap.pixels = (Pixel ) XpmMalloc(sizeof(Pixel) pmap.size);	249	pmap.pixels = (Pixel ) XpmMalloc(sizeof(Pixel) pmap.size);
Lines 308-314 Link Here
308	* get rgb values and a string of char, and possibly a name for each	310	* get rgb values and a string of char, and possibly a name for each
309	* color	311	* color
310	*/	312	*/
311	if (pmap.ncolors >= SIZE_MAX / sizeof(XpmColor))	313	if (pmap.ncolors >= UINT_MAX / sizeof(XpmColor))
312	RETURN(XpmNoMemory);	314	RETURN(XpmNoMemory);
313	colorTable = (XpmColor *) XpmCalloc(pmap.ncolors, sizeof(XpmColor));	315	colorTable = (XpmColor *) XpmCalloc(pmap.ncolors, sizeof(XpmColor));
314	if (!colorTable)	316	if (!colorTable)
Lines 368-374 Link Here
368		370
369	/* first get a character string */	371	/* first get a character string */
370	a = 0;	372	a = 0;
371	if (cpp >= SIZE_MAX - 1)	373	if (cpp >= UINT_MAX - 1)
372	return (XpmNoMemory);	374	return (XpmNoMemory);
373	if (!(s = color->string = (char *) XpmMalloc(cpp + 1)))	375	if (!(s = color->string = (char *) XpmMalloc(cpp + 1)))
374	return (XpmNoMemory);	376	return (XpmNoMemory);
Lines 461-467 Link Here
461	}	463	}
462		464
463	/* first get character strings and rgb values */	465	/* first get character strings and rgb values */
464	if (ncolors >= SIZE_MAX / sizeof(XColor) \|\| cpp >= SIZE_MAX - 1)	466	if (ncolors >= UINT_MAX / sizeof(XColor) \|\| cpp >= UINT_MAX - 1)
465	return (XpmNoMemory);	467	return (XpmNoMemory);
466	xcolors = (XColor ) XpmMalloc(sizeof(XColor) ncolors);	468	xcolors = (XColor ) XpmMalloc(sizeof(XColor) ncolors);
467	if (!xcolors)	469	if (!xcolors)
Lines 619-625 Link Here
619	char *dst;	621	char *dst;
620	unsigned int *iptr;	622	unsigned int *iptr;
621	char *data;	623	char *data;
622	int x, y, i;	624	unsigned int x, y, i;
623	int bits, depth, ibu, ibpp, offset;	625	int bits, depth, ibu, ibpp, offset;
624	unsigned long lbt;	626	unsigned long lbt;
625	Pixel pixel, px;	627	Pixel pixel, px;
Lines 721-727 Link Here
721	unsigned char *addr;	723	unsigned char *addr;
722	unsigned char *data;	724	unsigned char *data;
723	unsigned int *iptr;	725	unsigned int *iptr;
724	int x, y;	726	unsigned int x, y;
725	unsigned long lbt;	727	unsigned long lbt;
726	Pixel pixel;	728	Pixel pixel;
727	int depth;	729	int depth;
Lines 786-792 Link Here
786	unsigned char *addr;	788	unsigned char *addr;
787	unsigned char *data;	789	unsigned char *data;
788	unsigned int *iptr;	790	unsigned int *iptr;
789	int x, y;	791	unsigned int x, y;
790	unsigned long lbt;	792	unsigned long lbt;
791	Pixel pixel;	793	Pixel pixel;
792	int depth;	794	int depth;
Lines 831-837 Link Here
831	{	833	{
832	unsigned int *iptr;	834	unsigned int *iptr;
833	unsigned char *data;	835	unsigned char *data;
834	int x, y;	836	unsigned int x, y;
835	unsigned long lbt;	837	unsigned long lbt;
836	Pixel pixel;	838	Pixel pixel;
837	int depth;	839	int depth;
Lines 864-870 Link Here
864	storeFuncPtr storeFunc;	866	storeFuncPtr storeFunc;
865	{	867	{
866	unsigned int *iptr;	868	unsigned int *iptr;
867	int x, y;	869	unsigned int x, y;
868	char *data;	870	char *data;
869	Pixel pixel;	871	Pixel pixel;
870	int xoff, yoff, offset, bpl;	872	int xoff, yoff, offset, bpl;
Lines 900-910 Link Here
900	# else /* AMIGA */	902	# else /* AMIGA */
901		903
902	#define CLEAN_UP(status) \	904	#define CLEAN_UP(status) \
903	{\	905	do {\
904	if (pixels) XpmFree (pixels);\	906	if (pixels) XpmFree (pixels);\
905	if (tmp_img) FreeXImage (tmp_img);\	907	if (tmp_img) FreeXImage (tmp_img);\
906	return (status);\	908	return (status);\
907	}	909	} while(0)
908		910
909	static int	911	static int
910	AGetImagePixels (	912	AGetImagePixels (
Lines 925-931 Link Here
925		927
926	tmp_img = AllocXImage ((((width+15)>>4)<<4), 1, image->rp->BitMap->Depth);	928	tmp_img = AllocXImage ((((width+15)>>4)<<4), 1, image->rp->BitMap->Depth);
927	if (tmp_img == NULL)	929	if (tmp_img == NULL)
928	CLEAN_UP (XpmNoMemory)	930	CLEAN_UP (XpmNoMemory);
929		931
930	iptr = pmap->pixelindex;	932	iptr = pmap->pixelindex;
931	for (y = 0; y < height; ++y)	933	for (y = 0; y < height; ++y)
Lines 934-944 Link Here
934	for (x = 0; x < width; ++x, ++iptr)	936	for (x = 0; x < width; ++x, ++iptr)
935	{	937	{
936	if ((*storeFunc) (pixels[x], pmap, iptr))	938	if ((*storeFunc) (pixels[x], pmap, iptr))
937	CLEAN_UP (XpmNoMemory)	939	CLEAN_UP (XpmNoMemory);
938	}	940	}
939	}	941	}
940		942
941	CLEAN_UP (XpmSuccess)	943	CLEAN_UP (XpmSuccess);
942	}	944	}
943		945
944	#undef CLEAN_UP	946	#undef CLEAN_UP

Return to bug 83496

Lines 46-57 Link Here

(-)lib/Xpm/Imakefile (-3 / +17 lines)
46	STRLCATDEF = -DHAS_STRLCAT	46	STRLCATDEF = -DHAS_STRLCAT
47	#endif	47	#endif
48		48
		49	#if HasSnprintf
		50	SNPRINTFDEF = -DHAS_SNPRINTF
		51	#else
		52	SNPRINTFDEF = -Dsnprintf=_XpmSnprintf
		53	SNPRINTFSRCS = snprintf.c
		54	SNPRINTFOBJS = snprintf.o
		55	#endif
		56
49	#if defined(Win32Architecture)	57	#if defined(Win32Architecture)
50	ZPIPEDEF = -DNO_ZPIPE	58	ZPIPEDEF = -DNO_ZPIPE
51	#endif	59	#endif
52		60
53	DEFINES = $(STRDUPDEF) $(STRCASECMPDEF) $(SPRINTFDEF) $(STRLCATDEF) \	61	DEFINES = $(STRDUPDEF) $(STRCASECMPDEF) $(SPRINTFDEF) $(STRLCATDEF) \
54	$(ZPIPEDEF) $(ZFILEDEF)	62	$(SNPRINTFDEF) $(ZPIPEDEF) $(ZFILEDEF)
55		63
56	HEADERS = xpm.h	64	HEADERS = xpm.h
57		65
Lines 59-71 Link Here
59	CrBufFrI.c CrDatFrP.c CrPFrBuf.c RdFToI.c WrFFrI.c \	67	CrBufFrI.c CrDatFrP.c CrPFrBuf.c RdFToI.c WrFFrI.c \
60	CrBufFrP.c CrIFrBuf.c CrPFrDat.c RdFToP.c WrFFrP.c \	68	CrBufFrP.c CrIFrBuf.c CrPFrDat.c RdFToP.c WrFFrP.c \
61	CrDatFrI.c CrIFrDat.c RdFToDat.c WrFFrDat.c \	69	CrDatFrI.c CrIFrDat.c RdFToDat.c WrFFrDat.c \
62	Attrib.c CrIFrP.c CrPFrI.c Image.c Info.c RdFToBuf.c WrFFrBuf.c	70	Attrib.c CrIFrP.c CrPFrI.c Image.c Info.c RdFToBuf.c WrFFrBuf.c \
		71	$(SNPRINTFSRCS)
63		72
64	OBJS = data.o create.o misc.o rgb.o scan.o parse.o hashtab.o \	73	OBJS = data.o create.o misc.o rgb.o scan.o parse.o hashtab.o \
65	CrBufFrI.o CrDatFrP.o CrPFrBuf.o RdFToI.o WrFFrI.o \	74	CrBufFrI.o CrDatFrP.o CrPFrBuf.o RdFToI.o WrFFrI.o \
66	CrBufFrP.o CrIFrBuf.o CrPFrDat.o RdFToP.o WrFFrP.o \	75	CrBufFrP.o CrIFrBuf.o CrPFrDat.o RdFToP.o WrFFrP.o \
67	CrDatFrI.o CrIFrDat.o RdFToDat.o WrFFrDat.o \	76	CrDatFrI.o CrIFrDat.o RdFToDat.o WrFFrDat.o \
68	Attrib.o CrIFrP.o CrPFrI.o Image.o Info.o RdFToBuf.o WrFFrBuf.o	77	Attrib.o CrIFrP.o CrPFrI.o Image.o Info.o RdFToBuf.o WrFFrBuf.o \
		78	$(SNPRINTFOBJS)
69		79
70	XPMDIR = $(TOP)/extras/Xpm	80	XPMDIR = $(TOP)/extras/Xpm
71	XPMLIBDIR = $(TOP)/extras/Xpm/lib	81	XPMLIBDIR = $(TOP)/extras/Xpm/lib
Lines 105-108 Link Here
105	LinkSourceFile(WrFFrBuf.c,$(XPMLIBDIR))	115	LinkSourceFile(WrFFrBuf.c,$(XPMLIBDIR))
106	LinkSourceFile(xpm.h,$(XPMLIBDIR))	116	LinkSourceFile(xpm.h,$(XPMLIBDIR))
107		117
		118	#if !HasSnprintf
		119	LinkSourceFile(snprintf.c,$(LIBSRC)/misc)
		120	#endif
		121
108	DependTarget()	122	DependTarget()

Lines 31-36 Link Here

(-)extras/Xpm/lib/CrBufFrI.c (-24 / +72 lines)
31	* *	31	* *
32	* Developed by Arnaud Le Hors *	32	* Developed by Arnaud Le Hors *
33	\*****************************************************************************/	33	\*****************************************************************************/
		34
		35	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		36
34	/* $XFree86$ */	37	/* $XFree86$ */
35		38
36	#include "XpmI.h"	39	#include "XpmI.h"
Lines 39-53 Link Here
39	unsigned int used_size, XpmColor colors,	42	unsigned int used_size, XpmColor colors,
40	unsigned int ncolors, unsigned int cpp));	43	unsigned int ncolors, unsigned int cpp));
41		44
42	LFUNC(WritePixels, void, (char dataptr, unsigned int used_size,	45	LFUNC(WritePixels, void, (char *dataptr, unsigned int data_size,
		46	unsigned int *used_size,
43	unsigned int width, unsigned int height,	47	unsigned int width, unsigned int height,
44	unsigned int cpp, unsigned int *pixels,	48	unsigned int cpp, unsigned int *pixels,
45	XpmColor *colors));	49	XpmColor *colors));
46		50
47	LFUNC(WriteExtensions, void, (char dataptr, unsigned int used_size,	51	LFUNC(WriteExtensions, void, (char *dataptr, unsigned int data_size,
		52	unsigned int *used_size,
48	XpmExtension *ext, unsigned int num));	53	XpmExtension *ext, unsigned int num));
49		54
50	LFUNC(ExtensionsSize, int, (XpmExtension *ext, unsigned int num));	55	LFUNC(ExtensionsSize, unsigned int, (XpmExtension *ext, unsigned int num));
51	LFUNC(CommentsSize, int, (XpmInfo *info));	56	LFUNC(CommentsSize, int, (XpmInfo *info));
52		57
53	int	58	int
Lines 90-99 Link Here
90		95
91	#undef RETURN	96	#undef RETURN
92	#define RETURN(status) \	97	#define RETURN(status) \
		98	do \
93	{ \	99	{ \
94	ErrorStatus = status; \	100	ErrorStatus = status; \
95	goto error; \	101	goto error; \
96	}	102	}while(0)
97		103
98	int	104	int
99	XpmCreateBufferFromXpmImage(buffer_return, image, info)	105	XpmCreateBufferFromXpmImage(buffer_return, image, info)
Lines 107-113 Link Here
107	unsigned int cmts, extensions, ext_size = 0;	113	unsigned int cmts, extensions, ext_size = 0;
108	unsigned int l, cmt_size = 0;	114	unsigned int l, cmt_size = 0;
109	char ptr = NULL, p;	115	char ptr = NULL, p;
110	unsigned int ptr_size, used_size;	116	unsigned int ptr_size, used_size, tmp;
111		117
112	*buffer_return = NULL;	118	*buffer_return = NULL;
113		119
Lines 129-135 Link Here
129	#ifdef VOID_SPRINTF	135	#ifdef VOID_SPRINTF
130	used_size = strlen(buf);	136	used_size = strlen(buf);
131	#endif	137	#endif
132	ptr_size = used_size + ext_size + cmt_size + 1;	138	ptr_size = used_size + ext_size + cmt_size + 1; /* ptr_size can't be 0 */
		139	if(ptr_size <= used_size \|\|
		140	ptr_size <= ext_size \|\|
		141	ptr_size <= cmt_size)
		142	{
		143	return XpmNoMemory;
		144	}
133	ptr = (char *) XpmMalloc(ptr_size);	145	ptr = (char *) XpmMalloc(ptr_size);
134	if (!ptr)	146	if (!ptr)
135	return XpmNoMemory;	147	return XpmNoMemory;
Lines 140-146 Link Here
140	#ifndef VOID_SPRINTF	152	#ifndef VOID_SPRINTF
141	used_size +=	153	used_size +=
142	#endif	154	#endif
143	sprintf(ptr + used_size, "/%s/\n", info->hints_cmt);	155	snprintf(ptr + used_size, ptr_size-used_size, "/%s/\n", info->hints_cmt);
144	#ifdef VOID_SPRINTF	156	#ifdef VOID_SPRINTF
145	used_size += strlen(info->hints_cmt) + 5;	157	used_size += strlen(info->hints_cmt) + 5;
146	#endif	158	#endif
Lines 158-164 Link Here
158	#ifndef VOID_SPRINTF	170	#ifndef VOID_SPRINTF
159	l +=	171	l +=
160	#endif	172	#endif
161	sprintf(buf + l, " %d %d", info->x_hotspot, info->y_hotspot);	173	snprintf(buf + l, sizeof(buf)-l, " %d %d", info->x_hotspot, info->y_hotspot);
162	#ifdef VOID_SPRINTF	174	#ifdef VOID_SPRINTF
163	l = strlen(buf);	175	l = strlen(buf);
164	#endif	176	#endif
Lines 180-185 Link Here
180	l = strlen(buf);	192	l = strlen(buf);
181	#endif	193	#endif
182	ptr_size += l;	194	ptr_size += l;
		195	if(ptr_size <= l)
		196	RETURN(XpmNoMemory);
183	p = (char *) XpmRealloc(ptr, ptr_size);	197	p = (char *) XpmRealloc(ptr, ptr_size);
184	if (!p)	198	if (!p)
185	RETURN(XpmNoMemory);	199	RETURN(XpmNoMemory);
Lines 192-198 Link Here
192	#ifndef VOID_SPRINTF	206	#ifndef VOID_SPRINTF
193	used_size +=	207	used_size +=
194	#endif	208	#endif
195	sprintf(ptr + used_size, "/%s/\n", info->colors_cmt);	209	snprintf(ptr + used_size, ptr_size-used_size, "/%s/\n", info->colors_cmt);
196	#ifdef VOID_SPRINTF	210	#ifdef VOID_SPRINTF
197	used_size += strlen(info->colors_cmt) + 5;	211	used_size += strlen(info->colors_cmt) + 5;
198	#endif	212	#endif
Lines 208-214 Link Here
208	* 4 = 1 (for '"') + 3 (for '",\n')	222	* 4 = 1 (for '"') + 3 (for '",\n')
209	* 1 = - 2 (because the last line does not end with ',\n') + 3 (for '};\n')	223	* 1 = - 2 (because the last line does not end with ',\n') + 3 (for '};\n')
210	*/	224	*/
211	ptr_size += image->height * (image->width * image->cpp + 4) + 1;	225	if(image->width > UINT_MAX / image->cpp \|\|
		226	(tmp = image->width * image->cpp + 4) <= 4 \|\|
		227	image->height > UINT_MAX / tmp \|\|
		228	(tmp = image->height * tmp + 1) <= 1 \|\|
		229	(ptr_size += tmp) <= tmp)
		230	RETURN(XpmNoMemory);
212		231
213	p = (char *) XpmRealloc(ptr, ptr_size);	232	p = (char *) XpmRealloc(ptr, ptr_size);
214	if (!p)	233	if (!p)
Lines 220-236 Link Here
220	#ifndef VOID_SPRINTF	239	#ifndef VOID_SPRINTF
221	used_size +=	240	used_size +=
222	#endif	241	#endif
223	sprintf(ptr + used_size, "/%s/\n", info->pixels_cmt);	242	snprintf(ptr + used_size, ptr_size-used_size, "/%s/\n", info->pixels_cmt);
224	#ifdef VOID_SPRINTF	243	#ifdef VOID_SPRINTF
225	used_size += strlen(info->pixels_cmt) + 5;	244	used_size += strlen(info->pixels_cmt) + 5;
226	#endif	245	#endif
227	}	246	}
228	WritePixels(ptr + used_size, &used_size, image->width, image->height,	247	WritePixels(ptr + used_size, ptr_size - used_size, &used_size, image->width, image->height,
229	image->cpp, image->data, image->colorTable);	248	image->cpp, image->data, image->colorTable);
230		249
231	/* print extensions */	250	/* print extensions */
232	if (extensions)	251	if (extensions)
233	WriteExtensions(ptr + used_size, &used_size,	252	WriteExtensions(ptr + used_size, ptr_size-used_size, &used_size,
234	info->extensions, info->nextensions);	253	info->extensions, info->nextensions);
235		254
236	/* close the array */	255	/* close the array */
Lines 247-252 Link Here
247	return (ErrorStatus);	266	return (ErrorStatus);
248	}	267	}
249		268
		269
250	static int	270	static int
251	WriteColors(dataptr, data_size, used_size, colors, ncolors, cpp)	271	WriteColors(dataptr, data_size, used_size, colors, ncolors, cpp)
252	char **dataptr;	272	char **dataptr;
Lines 256-262 Link Here
256	unsigned int ncolors;	276	unsigned int ncolors;
257	unsigned int cpp;	277	unsigned int cpp;
258	{	278	{
259	char buf[BUFSIZ];	279	char buf[BUFSIZ] = {0};
260	unsigned int a, key, l;	280	unsigned int a, key, l;
261	char s, s2;	281	char s, s2;
262	char **defaults;	282	char **defaults;
Lines 266-271 Link Here
266		286
267	defaults = (char **) colors;	287	defaults = (char **) colors;
268	s = buf + 1;	288	s = buf + 1;
		289	if(cpp > (sizeof(buf) - (s-buf)))
		290	return(XpmNoMemory);
269	strncpy(s, *defaults++, cpp);	291	strncpy(s, *defaults++, cpp);
270	s += cpp;	292	s += cpp;
271		293
Lines 274-287 Link Here
274	#ifndef VOID_SPRINTF	296	#ifndef VOID_SPRINTF
275	s +=	297	s +=
276	#endif	298	#endif
277	sprintf(s, "\t%s %s", xpmColorKeys[key - 1], s2);	299	/* assume C99 compliance */
		300	snprintf(s, sizeof(buf) - (s-buf), "\t%s %s", xpmColorKeys[key - 1], s2);
278	#ifdef VOID_SPRINTF	301	#ifdef VOID_SPRINTF
279	s += strlen(s);	302	s += strlen(s);
280	#endif	303	#endif
		304	/* now let's check if s points out-of-bounds */
		305	if((s-buf) > sizeof(buf))
		306	return(XpmNoMemory);
281	}	307	}
282	}	308	}
		309	if(sizeof(buf) - (s-buf) < 4)
		310	return(XpmNoMemory);
283	strcpy(s, "\",\n");	311	strcpy(s, "\",\n");
284	l = s + 3 - buf;	312	l = s + 3 - buf;
		313	if( *data_size >= UINT_MAX-l \|\|
		314	data_size + l <= used_size \|\|
		315	(data_size + l - used_size) <= sizeof(buf))
		316	return(XpmNoMemory);
285	s = (char ) XpmRealloc(dataptr, *data_size + l);	317	s = (char ) XpmRealloc(dataptr, *data_size + l);
286	if (!s)	318	if (!s)
287	return (XpmNoMemory);	319	return (XpmNoMemory);
Lines 294-301 Link Here
294	}	326	}
295		327
296	static void	328	static void
297	WritePixels(dataptr, used_size, width, height, cpp, pixels, colors)	329	WritePixels(dataptr, data_size, used_size, width, height, cpp, pixels, colors)
298	char *dataptr;	330	char *dataptr;
		331	unsigned int data_size;
299	unsigned int *used_size;	332	unsigned int *used_size;
300	unsigned int width;	333	unsigned int width;
301	unsigned int height;	334	unsigned int height;
Lines 306-332 Link Here
306	char *s = dataptr;	339	char *s = dataptr;
307	unsigned int x, y, h;	340	unsigned int x, y, h;
308		341
		342	if(height <= 1)
		343	return;
		344
309	h = height - 1;	345	h = height - 1;
310	for (y = 0; y < h; y++) {	346	for (y = 0; y < h; y++) {
311	*s++ = '"';	347	*s++ = '"';
312	for (x = 0; x < width; x++, pixels++) {	348	for (x = 0; x < width; x++, pixels++) {
313	strncpy(s, colors[*pixels].string, cpp);	349	if(cpp >= (data_size - (s-dataptr)))
		350	return;
		351	strncpy(s, colors[pixels].string, cpp); / how can we trust pixels? :-\ /
314	s += cpp;	352	s += cpp;
315	}	353	}
		354	if((data_size - (s-dataptr)) < 4)
		355	return;
316	strcpy(s, "\",\n");	356	strcpy(s, "\",\n");
317	s += 3;	357	s += 3;
318	}	358	}
319	/* duplicate some code to avoid a test in the loop */	359	/* duplicate some code to avoid a test in the loop */
320	*s++ = '"';	360	*s++ = '"';
321	for (x = 0; x < width; x++, pixels++) {	361	for (x = 0; x < width; x++, pixels++) {
322	strncpy(s, colors[*pixels].string, cpp);	362	if(cpp >= (data_size - (s-dataptr)))
		363	return;
		364	strncpy(s, colors[pixels].string, cpp); / how can we trust pixels? /
323	s += cpp;	365	s += cpp;
324	}	366	}
325	*s++ = '"';	367	*s++ = '"';
326	*used_size += s - dataptr;	368	*used_size += s - dataptr;
327	}	369	}
328		370
329	static int	371	static unsigned int
330	ExtensionsSize(ext, num)	372	ExtensionsSize(ext, num)
331	XpmExtension *ext;	373	XpmExtension *ext;
332	unsigned int num;	374	unsigned int num;
Lines 335-355 Link Here
335	char **line;	377	char **line;
336		378
337	size = 0;	379	size = 0;
		380	if(num == 0)
		381	return(0); /* ok? */
338	for (x = 0; x < num; x++, ext++) {	382	for (x = 0; x < num; x++, ext++) {
339	/* 11 = 10 (for ',\n"XPMEXT ') + 1 (for '"') */	383	/* 11 = 10 (for ',\n"XPMEXT ') + 1 (for '"') */
340	size += strlen(ext->name) + 11;	384	size += strlen(ext->name) + 11;
341	a = ext->nlines;	385	a = ext->nlines; /* how can we trust ext->nlines to be not out-of-bounds? */
342	for (y = 0, line = ext->lines; y < a; y++, line++)	386	for (y = 0, line = ext->lines; y < a; y++, line++)
343	/* 4 = 3 (for ',\n"') + 1 (for '"') */	387	/* 4 = 3 (for ',\n"') + 1 (for '"') */
344	size += strlen(*line) + 4;	388	size += strlen(*line) + 4;
345	}	389	}
346	/* 13 is for ',\n"XPMENDEXT"' */	390	/* 13 is for ',\n"XPMENDEXT"' */
		391	if(size > UINT_MAX - 13) /* unlikely */
		392	return(0);
347	return size + 13;	393	return size + 13;
348	}	394	}
349		395
350	static void	396	static void
351	WriteExtensions(dataptr, used_size, ext, num)	397	WriteExtensions(dataptr, data_size, used_size, ext, num)
352	char *dataptr;	398	char *dataptr;
		399	unsigned int data_size;
353	unsigned int *used_size;	400	unsigned int *used_size;
354	XpmExtension *ext;	401	XpmExtension *ext;
355	unsigned int num;	402	unsigned int num;
Lines 362-368 Link Here
362	#ifndef VOID_SPRINTF	409	#ifndef VOID_SPRINTF
363	s +=	410	s +=
364	#endif	411	#endif
365	sprintf(s, ",\n\"XPMEXT %s\"", ext->name);	412	snprintf(s, data_size - (s-dataptr), ",\n\"XPMEXT %s\"", ext->name);
366	#ifdef VOID_SPRINTF	413	#ifdef VOID_SPRINTF
367	s += strlen(ext->name) + 11;	414	s += strlen(ext->name) + 11;
368	#endif	415	#endif
Lines 371-383 Link Here
371	#ifndef VOID_SPRINTF	418	#ifndef VOID_SPRINTF
372	s +=	419	s +=
373	#endif	420	#endif
374	sprintf(s, ",\n\"%s\"", *line);	421	snprintf(s, data_size - (s-dataptr), ",\n\"%s\"", *line);
375	#ifdef VOID_SPRINTF	422	#ifdef VOID_SPRINTF
376	s += strlen(*line) + 4;	423	s += strlen(*line) + 4;
377	#endif	424	#endif
378	}	425	}
379	}	426	}
380	strcpy(s, ",\n\"XPMENDEXT\"");	427	strncpy(s, ",\n\"XPMENDEXT\"", data_size - (s-dataptr)-1);
381	*used_size += s - dataptr + 13;	428	*used_size += s - dataptr + 13;
382	}	429	}
383		430
Lines 388-393 Link Here
388	int size = 0;	435	int size = 0;
389		436
390	/* 5 = 2 (for "/_") + 3 (for "_/\n") */	437	/* 5 = 2 (for "/_") + 3 (for "_/\n") */
		438	/* wrap possible but very unlikely */
391	if (info->hints_cmt)	439	if (info->hints_cmt)
392	size += 5 + strlen(info->hints_cmt);	440	size += 5 + strlen(info->hints_cmt);
393		441

Lines 138-150 Link Here

(-)extras/Xpm/lib/hashtab.c (-3 / +3 lines)
138	unsigned int size = table->size;	138	unsigned int size = table->size;
139	xpmHashAtom t, p;	139	xpmHashAtom t, p;
140	int i;	140	int i;
141	int oldSize = size;	141	unsigned int oldSize = size;
142		142
143	t = atomTable;	143	t = atomTable;
144	HASH_TABLE_GROWS	144	HASH_TABLE_GROWS
145	table->size = size;	145	table->size = size;
146	table->limit = size / 3;	146	table->limit = size / 3;
147	if (size >= SIZE_MAX / sizeof(*atomTable))	147	if (size >= UINT_MAX / sizeof(*atomTable))
148	return (XpmNoMemory);	148	return (XpmNoMemory);
149	atomTable = (xpmHashAtom ) XpmMalloc(size sizeof(*atomTable));	149	atomTable = (xpmHashAtom ) XpmMalloc(size sizeof(*atomTable));
150	if (!atomTable)	150	if (!atomTable)
Lines 206-212 Link Here
206	table->size = INITIAL_HASH_SIZE;	206	table->size = INITIAL_HASH_SIZE;
207	table->limit = table->size / 3;	207	table->limit = table->size / 3;
208	table->used = 0;	208	table->used = 0;
209	if (table->size >= SIZE_MAX / sizeof(*atomTable))	209	if (table->size >= UINT_MAX / sizeof(*atomTable))
210	return (XpmNoMemory);	210	return (XpmNoMemory);
211	atomTable = (xpmHashAtom ) XpmMalloc(table->size sizeof(*atomTable));	211	atomTable = (xpmHashAtom ) XpmMalloc(table->size sizeof(*atomTable));
212	if (!atomTable)	212	if (!atomTable)

Lines 41-66 Link Here

(-)extras/Xpm/lib/parse.c (-30 / +40 lines)
41	* HeDu (hedu@cul-ipn.uni-kiel.de) 4/94	41	* HeDu (hedu@cul-ipn.uni-kiel.de) 4/94
42	*/	42	*/
43		43
		44	/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
		45
44	#include "XpmI.h"	46	#include "XpmI.h"
45	#include <ctype.h>	47	#include <ctype.h>
46	#include <string.h>	48	#include <string.h>
47		49
48	#ifdef HAS_STRLCAT	50	#ifdef HAS_STRLCAT
49	# define STRLCAT(dst, src, dstsize) { \	51	# define STRLCAT(dst, src, dstsize) do { \
50	if (strlcat(dst, src, dstsize) >= (dstsize)) \	52	if (strlcat(dst, src, dstsize) >= (dstsize)) \
51	return (XpmFileInvalid); }	53	return (XpmFileInvalid); } while(0)
52	# define STRLCPY(dst, src, dstsize) { \	54	# define STRLCPY(dst, src, dstsize) do { \
53	if (strlcpy(dst, src, dstsize) >= (dstsize)) \	55	if (strlcpy(dst, src, dstsize) >= (dstsize)) \
54	return (XpmFileInvalid); }	56	return (XpmFileInvalid); } while(0)
55	#else	57	#else
56	# define STRLCAT(dst, src, dstsize) { \	58	# define STRLCAT(dst, src, dstsize) do { \
57	if ((strlen(dst) + strlen(src)) < (dstsize)) \	59	if ((strlen(dst) + strlen(src)) < (dstsize)) \
58	strcat(dst, src); \	60	strcat(dst, src); \
59	else return (XpmFileInvalid); }	61	else return (XpmFileInvalid); } while(0)
60	# define STRLCPY(dst, src, dstsize) { \	62	# define STRLCPY(dst, src, dstsize) do { \
61	if (strlen(src) < (dstsize)) \	63	if (strlen(src) < (dstsize)) \
62	strcpy(dst, src); \	64	strcpy(dst, src); \
63	else return (XpmFileInvalid); }	65	else return (XpmFileInvalid); } while(0)
64	#endif	66	#endif
65		67
66	LFUNC(ParsePixels, int, (xpmData *data, unsigned int width,	68	LFUNC(ParsePixels, int, (xpmData *data, unsigned int width,
Lines 205-211 Link Here
205	char **defaults;	207	char **defaults;
206	int ErrorStatus;	208	int ErrorStatus;
207		209
208	if (ncolors >= SIZE_MAX / sizeof(XpmColor))	210	if (ncolors >= UINT_MAX / sizeof(XpmColor))
209	return (XpmNoMemory);	211	return (XpmNoMemory);
210	colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));	212	colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));
211	if (!colorTable)	213	if (!colorTable)
Lines 218-224 Link Here
218	/*	220	/*
219	* read pixel value	221	* read pixel value
220	*/	222	*/
221	if (cpp >= SIZE_MAX - 1) {	223	if (cpp >= UINT_MAX - 1) {
222	xpmFreeColorTable(colorTable, ncolors);	224	xpmFreeColorTable(colorTable, ncolors);
223	return (XpmNoMemory);	225	return (XpmNoMemory);
224	}	226	}
Lines 277-285 Link Here
277	return (XpmFileInvalid);	279	return (XpmFileInvalid);
278	}	280	}
279	if (!lastwaskey)	281	if (!lastwaskey)
280	STRLCAT(curbuf, " ", sizeof(curbuf)); /* append space */	282	STRLCAT(curbuf, " ", sizeof(curbuf));/* append space */
281	buf[l] = '\0';	283	buf[l] = '\0';
282	STRLCAT(curbuf, buf, sizeof(curbuf));/* append buf */	284	STRLCAT(curbuf, buf, sizeof(curbuf)); /* append buf */
283	lastwaskey = 0;	285	lastwaskey = 0;
284	}	286	}
285	}	287	}
Lines 287-293 Link Here
287	xpmFreeColorTable(colorTable, ncolors);	289	xpmFreeColorTable(colorTable, ncolors);
288	return (XpmFileInvalid);	290	return (XpmFileInvalid);
289	}	291	}
290	len = strlen(curbuf) + 1;	292	len = strlen(curbuf) + 1; /* integer overflow just theoretically possible */
291	s = defaults[curkey] = (char *) XpmMalloc(len);	293	s = defaults[curkey] = (char *) XpmMalloc(len);
292	if (!s) {	294	if (!s) {
293	xpmFreeColorTable(colorTable, ncolors);	295	xpmFreeColorTable(colorTable, ncolors);
Lines 306-312 Link Here
306	/*	308	/*
307	* read pixel value	309	* read pixel value
308	*/	310	*/
309	if (cpp >= SIZE_MAX - 1) {	311	if (cpp >= UINT_MAX - 1) {
310	xpmFreeColorTable(colorTable, ncolors);	312	xpmFreeColorTable(colorTable, ncolors);
311	return (XpmNoMemory);	313	return (XpmNoMemory);
312	}	314	}
Lines 351-357 Link Here
351	memcpy(s, curbuf, len);	353	memcpy(s, curbuf, len);
352	color->c_color = s;	354	color->c_color = s;
353	curbuf = '\0'; / reset curbuf */	355	curbuf = '\0'; / reset curbuf */
354	if (a < ncolors - 1)	356	if (a < ncolors - 1) /* can we trust ncolors -> leave data's bounds */
355	xpmNextString(data); /* get to the next string */	357	xpmNextString(data); /* get to the next string */
356	}	358	}
357	}	359	}
Lines 370-380 Link Here
370	xpmHashTable *hashtable;	372	xpmHashTable *hashtable;
371	unsigned int **pixels;	373	unsigned int **pixels;
372	{	374	{
373	unsigned int iptr, iptr2;	375	unsigned int iptr, iptr2 = NULL; /* found by Egbert Eich */
374	unsigned int a, x, y;	376	unsigned int a, x, y;
375		377
376	if ((height > 0 && width >= SIZE_MAX / height) \|\|	378	if ((height > 0 && width >= UINT_MAX / height) \|\|
377	width * height >= SIZE_MAX / sizeof(unsigned int))	379	width * height >= UINT_MAX / sizeof(unsigned int))
378	return XpmNoMemory;	380	return XpmNoMemory;
379	#ifndef FOR_MSW	381	#ifndef FOR_MSW
380	iptr2 = (unsigned int ) XpmMalloc(sizeof(unsigned int) width * height);	382	iptr2 = (unsigned int ) XpmMalloc(sizeof(unsigned int) width * height);
Lines 399-406 Link Here
399	{	401	{
400	unsigned short colidx[256];	402	unsigned short colidx[256];
401		403
402	if (ncolors > 256)	404	if (ncolors > 256) {
		405	XpmFree(iptr2); /* found by Egbert Eich */
403	return (XpmFileInvalid);	406	return (XpmFileInvalid);
		407	}
404		408
405	bzero((char )colidx, 256 sizeof(short));	409	bzero((char )colidx, 256 sizeof(short));
406	for (a = 0; a < ncolors; a++)	410	for (a = 0; a < ncolors; a++)
Lines 427-442 Link Here
427	{	431	{
428		432
429	/* free all allocated pointers at all exits */	433	/* free all allocated pointers at all exits */
430	#define FREE_CIDX {int f; for (f = 0; f < 256; f++) \	434	#define FREE_CIDX \
431	if (cidx[f]) XpmFree(cidx[f]);}	435	do \
		436	{ \
		437	int f; for (f = 0; f < 256; f++) \
		438	if (cidx[f]) XpmFree(cidx[f]); \
		439	} while(0)
432		440
433	/* array of pointers malloced by need */	441	/* array of pointers malloced by need */
434	unsigned short *cidx[256];	442	unsigned short *cidx[256];
435	int char1;	443	unsigned int char1;
436		444
437	bzero((char )cidx, 256 sizeof(unsigned short )); / init */	445	bzero((char )cidx, 256 sizeof(unsigned short )); / init */
438	for (a = 0; a < ncolors; a++) {	446	for (a = 0; a < ncolors; a++) {
439	char1 = colorTable[a].string[0];	447	char1 = (unsigned char) colorTable[a].string[0];
440	if (cidx[char1] == NULL) { /* get new memory */	448	if (cidx[char1] == NULL) { /* get new memory */
441	cidx[char1] = (unsigned short *)	449	cidx[char1] = (unsigned short *)
442	XpmCalloc(256, sizeof(unsigned short));	450	XpmCalloc(256, sizeof(unsigned short));
Lines 480-487 Link Here
480	char *s;	488	char *s;
481	char buf[BUFSIZ];	489	char buf[BUFSIZ];
482		490
483	if (cpp >= sizeof(buf))	491	if (cpp >= sizeof(buf)) {
		492	XpmFree(iptr2); /* found by Egbert Eich */
484	return (XpmFileInvalid);	493	return (XpmFileInvalid);
		494	}
485		495
486	buf[cpp] = '\0';	496	buf[cpp] = '\0';
487	if (USE_HASHTABLE) {	497	if (USE_HASHTABLE) {
Lines 491-497 Link Here
491	xpmNextString(data);	501	xpmNextString(data);
492	for (x = 0; x < width; x++, iptr++) {	502	for (x = 0; x < width; x++, iptr++) {
493	for (a = 0, s = buf; a < cpp; a++, s++)	503	for (a = 0, s = buf; a < cpp; a++, s++)
494	*s = xpmGetC(data);	504	s = xpmGetC(data); / int assigned to char, not a problem here */
495	slot = xpmHashSlot(hashtable, buf);	505	slot = xpmHashSlot(hashtable, buf);
496	if (!slot) { / no color matches */	506	if (!slot) { / no color matches */
497	XpmFree(iptr2);	507	XpmFree(iptr2);
Lines 505-511 Link Here
505	xpmNextString(data);	515	xpmNextString(data);
506	for (x = 0; x < width; x++, iptr++) {	516	for (x = 0; x < width; x++, iptr++) {
507	for (a = 0, s = buf; a < cpp; a++, s++)	517	for (a = 0, s = buf; a < cpp; a++, s++)
508	*s = xpmGetC(data);	518	s = xpmGetC(data); / int assigned to char, not a problem here */
509	for (a = 0; a < ncolors; a++)	519	for (a = 0; a < ncolors; a++)
510	if (!strcmp(colorTable[a].string, buf))	520	if (!strcmp(colorTable[a].string, buf))
511	break;	521	break;
Lines 560-566 Link Here
560	while (!notstart && notend) {	570	while (!notstart && notend) {
561	/* there starts an extension */	571	/* there starts an extension */
562	ext = (XpmExtension *)	572	ext = (XpmExtension *)
563	XpmRealloc(exts, (num + 1) * sizeof(XpmExtension));	573	XpmRealloc(exts, (num + 1) * sizeof(XpmExtension)); /* can the loop be forced to iterate often enough to make "(num + 1) * sizeof(XpmExtension)" wrapping? */
564	if (!ext) {	574	if (!ext) {
565	XpmFree(string);	575	XpmFree(string);
566	XpmFreeExtensions(exts, num);	576	XpmFreeExtensions(exts, num);
Lines 597-603 Link Here
597	while ((notstart = strncmp("XPMEXT", string, 6))	607	while ((notstart = strncmp("XPMEXT", string, 6))
598	&& (notend = strncmp("XPMENDEXT", string, 9))) {	608	&& (notend = strncmp("XPMENDEXT", string, 9))) {
599	sp = (char **)	609	sp = (char **)
600	XpmRealloc(ext->lines, (nlines + 1) * sizeof(char *));	610	XpmRealloc(ext->lines, (nlines + 1) * sizeof(char )); / can we iterate enough for a wrapping? */
601	if (!sp) {	611	if (!sp) {
602	XpmFree(string);	612	XpmFree(string);
603	ext->nlines = nlines;	613	ext->nlines = nlines;
Lines 637-645 Link Here
637	/* function call in case of error */	647	/* function call in case of error */
638	#undef RETURN	648	#undef RETURN
639	#define RETURN(status) \	649	#define RETURN(status) \
640	{ \	650	do { \
641	goto error; \	651	goto error; \
642	}	652	} while(0)
643		653
644	/*	654	/*
645	* This function parses an Xpm file or data and store the found informations	655	* This function parses an Xpm file or data and store the found informations