Attachment 55708 Details for Bug 129642

[patch] fix for w*h*c overflow

gdk-pixbuf-xpmintoverflow.diff (text/plain), 1.60 KB, created by Ludwig Nussel on 2005-10-27 13:38:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-10-27 13:38:48 UTC

Size: 1.60 KB

patch

obsolete

>Index: gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c
>===================================================================
>--- gdk-pixbuf-0.22.0.orig/gdk-pixbuf/io-xpm.c
>+++ gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c
>@@ -323,13 +323,6 @@ mem_buffer (enum buf_op op, gpointer han
> 	return NULL;
> }
> 
>-/* Destroy notification function for the pixbuf */
>-static void
>-free_buffer (guchar *pixels, gpointer data)
>-{
>-	free (pixels);
>-}
>-
> static gboolean
> xpm_color_parse (const char *spec, XColor *color)
> {
>@@ -348,7 +341,8 @@ pixbuf_create_from_xpm (const gchar * (*
> 	gchar pixel_str[32];
> 	GHashTable *color_hash;
> 	_XPMColor *colors, *color, *fallbackcolor;
>-	guchar *pixels, *pixtmp;
>+	guchar *pixtmp;
>+	GdkPixbuf* pixbuf;
> 
> 	fallbackcolor = NULL;
> 
>@@ -418,12 +412,8 @@ pixbuf_create_from_xpm (const gchar * (*
> 			fallbackcolor = color;
> 	}
> 
>-	if (is_trans)
>-		pixels = malloc (w * h * 4);
>-	else
>-		pixels = malloc (w * h * 3);
>-
>-	if (!pixels) {
>+	pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, is_trans, 8, w, h);
>+	if (!pixbuf) {
> 		g_hash_table_destroy (color_hash);
> 		g_free (colors);
> 		g_free (name_buf);
>@@ -431,7 +421,7 @@ pixbuf_create_from_xpm (const gchar * (*
> 	}
> 
> 	wbytes = w * cpp;
>-	pixtmp = pixels;
>+	pixtmp = pixbuf->pixels;
> 
> 	for (ycnt = 0; ycnt < h; ycnt++) {
> 		buffer = (*get_buf) (op_body, handle);
>@@ -464,9 +454,7 @@ pixbuf_create_from_xpm (const gchar * (*
> 	g_free (colors);
> 	g_free (name_buf);
> 
>-	return gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, is_trans, 8,
>-					 w, h, is_trans ? (w * 4) : (w * 3),
>-					 free_buffer, NULL);
>+	return pixbuf;
> }
> 
> /* Shared library entry point for file loading */

Actions: View | Diff

Attachments on bug 129642: 55708 | 55709