]>
Commit | Line | Data |
---|---|---|
c45ab529 SS |
1 | diff --git a/analyzer/pgmtexture.c b/analyzer/pgmtexture.c |
2 | index 0731733..635c58b 100644 | |
3 | --- a/analyzer/pgmtexture.c | |
4 | +++ b/analyzer/pgmtexture.c | |
5 | @@ -98,6 +98,8 @@ vector(unsigned int const nl, | |
6 | ||
7 | assert(nh >= nl); | |
8 | ||
9 | + overflow_add(nh - nl, 1); | |
10 | + | |
11 | MALLOCARRAY(v, (unsigned) (nh - nl + 1)); | |
12 | ||
13 | if (v == NULL) | |
14 | @@ -129,6 +131,7 @@ matrix (unsigned int const nrl, | |
15 | assert(nrh >= nrl); | |
16 | ||
17 | /* allocate pointers to rows */ | |
18 | + overflow_add(nrh - nrl, 1); | |
19 | MALLOCARRAY(m, (unsigned) (nrh - nrl + 1)); | |
20 | if (m == NULL) | |
21 | pm_error("Unable to allocate memory for a matrix."); | |
22 | @@ -137,6 +140,7 @@ matrix (unsigned int const nrl, | |
23 | ||
24 | assert (nch >= ncl); | |
25 | ||
26 | + overflow_add(nch - ncl, 1); | |
27 | /* allocate rows and set pointers to them */ | |
28 | for (i = nrl; i <= nrh; ++i) { | |
29 | MALLOCARRAY(m[i], (unsigned) (nch - ncl + 1)); | |
30 | diff --git a/converter/other/gemtopnm.c b/converter/other/gemtopnm.c | |
31 | index aac7479..5f1a51a 100644 | |
32 | --- a/converter/other/gemtopnm.c | |
33 | +++ b/converter/other/gemtopnm.c | |
34 | @@ -106,6 +106,7 @@ main(argc, argv) | |
35 | ||
36 | pnm_writepnminit( stdout, cols, rows, MAXVAL, type, 0 ); | |
37 | ||
38 | + overflow_add(cols, padright); | |
39 | { | |
40 | /* allocate input row data structure */ | |
41 | int plane; | |
42 | diff --git a/converter/other/jpegtopnm.c b/converter/other/jpegtopnm.c | |
43 | index ab3b18e..c324b86 100644 | |
44 | --- a/converter/other/jpegtopnm.c | |
45 | +++ b/converter/other/jpegtopnm.c | |
46 | @@ -861,6 +861,8 @@ convertImage(FILE * const ofP, | |
47 | /* Calculate output image dimensions so we can allocate space */ | |
48 | jpeg_calc_output_dimensions(cinfoP); | |
49 | ||
50 | + overflow2(cinfoP->output_width, cinfoP->output_components); | |
51 | + | |
52 | /* Start decompressor */ | |
53 | jpeg_start_decompress(cinfoP); | |
54 | ||
55 | diff --git a/converter/other/pbmtopgm.c b/converter/other/pbmtopgm.c | |
56 | index 69b20fb..382a487 100644 | |
57 | --- a/converter/other/pbmtopgm.c | |
58 | +++ b/converter/other/pbmtopgm.c | |
59 | @@ -47,6 +47,7 @@ main(int argc, char *argv[]) { | |
60 | "than the image height (%u rows)", height, rows); | |
61 | ||
62 | outrow = pgm_allocrow(cols) ; | |
63 | + overflow2(width, height); | |
64 | maxval = MIN(PGM_OVERALLMAXVAL, width*height); | |
65 | pgm_writepgminit(stdout, cols, rows, maxval, 0) ; | |
66 | ||
67 | diff --git a/converter/other/pnmtoddif.c b/converter/other/pnmtoddif.c | |
68 | index ae8c852..9ee037b 100644 | |
69 | --- a/converter/other/pnmtoddif.c | |
70 | +++ b/converter/other/pnmtoddif.c | |
71 | @@ -632,6 +632,7 @@ main(int argc, char *argv[]) { | |
72 | switch (PNM_FORMAT_TYPE(format)) { | |
73 | case PBM_TYPE: | |
74 | ip.bits_per_pixel = 1; | |
75 | + overflow_add(cols, 7); | |
76 | ip.bytes_per_line = (cols + 7) / 8; | |
77 | ip.spectral = 2; | |
78 | ip.components = 1; | |
79 | @@ -647,6 +648,7 @@ main(int argc, char *argv[]) { | |
80 | ip.polarity = 2; | |
81 | break; | |
82 | case PPM_TYPE: | |
83 | + overflow2(cols, 3); | |
84 | ip.bytes_per_line = 3 * cols; | |
85 | ip.bits_per_pixel = 24; | |
86 | ip.spectral = 5; | |
87 | diff --git a/converter/other/pnmtojpeg.c b/converter/other/pnmtojpeg.c | |
88 | index ce231c9..1279040 100644 | |
89 | --- a/converter/other/pnmtojpeg.c | |
90 | +++ b/converter/other/pnmtojpeg.c | |
91 | @@ -605,7 +605,11 @@ read_scan_script(j_compress_ptr const cinfo, | |
92 | want JPOOL_PERMANENT. | |
93 | */ | |
94 | const unsigned int scan_info_size = nscans * sizeof(jpeg_scan_info); | |
95 | - jpeg_scan_info * const scan_info = | |
96 | + const jpeg_scan_info * scan_info; | |
97 | + | |
98 | + overflow2(nscans, sizeof(jpeg_scan_info)); | |
99 | + | |
100 | + scan_info = | |
101 | (jpeg_scan_info *) | |
102 | (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE, | |
103 | scan_info_size); | |
104 | @@ -937,6 +941,8 @@ compute_rescaling_array(JSAMPLE ** const rescale_p, const pixval maxval, | |
105 | const long half_maxval = maxval / 2; | |
106 | long val; | |
107 | ||
108 | + overflow_add(maxval, 1); | |
109 | + overflow2(maxval+1, sizeof(JSAMPLE)); | |
110 | *rescale_p = (JSAMPLE *) | |
111 | (cinfo.mem->alloc_small) ((j_common_ptr) &cinfo, JPOOL_IMAGE, | |
112 | (size_t) (((long) maxval + 1L) * | |
113 | @@ -1015,6 +1021,7 @@ convert_scanlines(struct jpeg_compress_struct * const cinfo_p, | |
114 | */ | |
115 | ||
116 | /* Allocate the libpnm output and compressor input buffers */ | |
117 | + overflow2(cinfo_p->image_width, cinfo_p->input_components); | |
118 | buffer = (*cinfo_p->mem->alloc_sarray) | |
119 | ((j_common_ptr) cinfo_p, JPOOL_IMAGE, | |
120 | (unsigned int) cinfo_p->image_width * cinfo_p->input_components, | |
121 | diff --git a/converter/other/pnmtops.c b/converter/other/pnmtops.c | |
122 | index 6cd6be9..8a7d25a 100644 | |
123 | --- a/converter/other/pnmtops.c | |
124 | +++ b/converter/other/pnmtops.c | |
125 | @@ -292,17 +292,21 @@ parseCommandLine(int argc, const char ** argv, | |
126 | validateCompDimension(width, 72, "-width value"); | |
127 | validateCompDimension(height, 72, "-height value"); | |
128 | ||
129 | + overflow2(width, 72); | |
130 | cmdlineP->width = width * 72; | |
131 | + overflow2(height, 72); | |
132 | cmdlineP->height = height * 72; | |
133 | ||
134 | if (imagewidthSpec) { | |
135 | validateCompDimension(imagewidth, 72, "-imagewidth value"); | |
136 | + overflow2(imagewidth, 72); | |
137 | cmdlineP->imagewidth = imagewidth * 72; | |
138 | } | |
139 | else | |
140 | cmdlineP->imagewidth = 0; | |
141 | if (imageheightSpec) { | |
142 | - validateCompDimension(imagewidth, 72, "-imageheight value"); | |
143 | + validateCompDimension(imageheight, 72, "-imageheight value"); | |
144 | + overflow2(imageheight, 72); | |
145 | cmdlineP->imageheight = imageheight * 72; | |
146 | } | |
147 | else | |
148 | diff --git a/converter/other/rletopnm.c b/converter/other/rletopnm.c | |
149 | index 9995914..058278c 100644 | |
150 | --- a/converter/other/rletopnm.c | |
151 | +++ b/converter/other/rletopnm.c | |
152 | @@ -19,6 +19,8 @@ | |
153 | * If you modify this software, you should include a notice giving the | |
154 | * name of the person performing the modification, the date of modification, | |
155 | * and the reason for such modification. | |
156 | + * | |
157 | + * 2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com> | |
158 | */ | |
159 | /* | |
160 | * rletopnm - A conversion program to convert from Utah's "rle" image format | |
161 | diff --git a/converter/other/sirtopnm.c b/converter/other/sirtopnm.c | |
162 | index fafcc91..9fe49d0 100644 | |
163 | --- a/converter/other/sirtopnm.c | |
164 | +++ b/converter/other/sirtopnm.c | |
165 | @@ -69,6 +69,7 @@ char* argv[]; | |
166 | } | |
167 | break; | |
168 | case PPM_TYPE: | |
169 | + overflow3(cols, rows, 3); | |
170 | picsize = cols * rows * 3; | |
171 | planesize = cols * rows; | |
172 | if ( !( sirarray = (unsigned char*) malloc( picsize ) ) ) | |
173 | diff --git a/converter/other/tifftopnm.c b/converter/other/tifftopnm.c | |
174 | index 0d6494f..19e9e38 100644 | |
175 | --- a/converter/other/tifftopnm.c | |
176 | +++ b/converter/other/tifftopnm.c | |
177 | @@ -1309,7 +1309,9 @@ convertRasterByRows(pnmOut * const pnmOutP, | |
178 | if (scanbuf == NULL) | |
179 | pm_error("can't allocate memory for scanline buffer"); | |
180 | ||
181 | - MALLOCARRAY(samplebuf, cols * spp); | |
182 | + /* samplebuf is unsigned int * !!! */ | |
183 | + samplebuf = (unsigned int *) malloc3(cols , sizeof(unsigned int) , spp); | |
184 | + | |
185 | if (samplebuf == NULL) | |
186 | pm_error("can't allocate memory for row buffer"); | |
187 | ||
188 | diff --git a/converter/other/xwdtopnm.c b/converter/other/xwdtopnm.c | |
189 | index 45d66b4..c914481 100644 | |
190 | --- a/converter/other/xwdtopnm.c | |
191 | +++ b/converter/other/xwdtopnm.c | |
192 | @@ -209,6 +209,10 @@ processX10Header(X10WDFileHeader * const h10P, | |
193 | *colorsP = pnm_allocrow(2); | |
194 | PNM_ASSIGN1((*colorsP)[0], 0); | |
195 | PNM_ASSIGN1((*colorsP)[1], *maxvalP); | |
196 | + overflow_add(h10P->pixmap_width, 15); | |
197 | + if(h10P->pixmap_width < 0) | |
198 | + pm_error("assert: negative width"); | |
199 | + overflow2((((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width), 8); | |
200 | *padrightP = | |
201 | (((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width) * 8; | |
202 | *bits_per_itemP = 16; | |
203 | @@ -634,6 +638,7 @@ processX11Header(X11WDFileHeader * const h11P, | |
204 | ||
205 | *colsP = h11FixedP->pixmap_width; | |
206 | *rowsP = h11FixedP->pixmap_height; | |
207 | + overflow2(h11FixedP->bytes_per_line, 8); | |
208 | *padrightP = | |
209 | h11FixedP->bytes_per_line * 8 - | |
210 | h11FixedP->pixmap_width * h11FixedP->bits_per_pixel; | |
211 | diff --git a/converter/pbm/mdatopbm.c b/converter/pbm/mdatopbm.c | |
212 | index d8e0657..12c7468 100644 | |
213 | --- a/converter/pbm/mdatopbm.c | |
214 | +++ b/converter/pbm/mdatopbm.c | |
215 | @@ -245,10 +245,13 @@ main(int argc, char **argv) { | |
216 | pm_readlittleshort(infile, &yy); nInCols = yy; | |
217 | } | |
218 | ||
219 | + overflow2(nOutCols, 8); | |
220 | nOutCols = 8 * nInCols; | |
221 | nOutRows = nInRows; | |
222 | - if (bScale) | |
223 | + if (bScale) { | |
224 | + overflow2(nOutRows, 2); | |
225 | nOutRows *= 2; | |
226 | + } | |
227 | ||
228 | data = pbm_allocarray(nOutCols, nOutRows); | |
229 | ||
230 | diff --git a/converter/pbm/mgrtopbm.c b/converter/pbm/mgrtopbm.c | |
231 | index 9f7004a..60e8477 100644 | |
232 | --- a/converter/pbm/mgrtopbm.c | |
233 | +++ b/converter/pbm/mgrtopbm.c | |
234 | @@ -65,6 +65,8 @@ readMgrHeader(FILE * const ifP, | |
235 | pad = 0; /* should never reach here */ | |
236 | } | |
237 | ||
238 | + overflow_add(*colsP, pad); | |
239 | + | |
240 | interpHdrWidth (head, colsP); | |
241 | interpHdrHeight(head, rowsP); | |
242 | ||
243 | diff --git a/converter/pbm/pbmto4425.c b/converter/pbm/pbmto4425.c | |
244 | index 1d97ac6..c4c8cbb 100644 | |
245 | --- a/converter/pbm/pbmto4425.c | |
246 | +++ b/converter/pbm/pbmto4425.c | |
247 | @@ -2,6 +2,7 @@ | |
248 | ||
249 | #include "nstring.h" | |
250 | #include "pbm.h" | |
251 | +#include <string.h> | |
252 | ||
253 | static char bit_table[2][3] = { | |
254 | {1, 4, 0x10}, | |
255 | @@ -160,7 +161,7 @@ main(int argc, char * argv[]) { | |
256 | xres = vmap_width * 2; | |
257 | yres = vmap_height * 3; | |
258 | ||
259 | - vmap = malloc(vmap_width * vmap_height * sizeof(char)); | |
260 | + vmap = malloc3(vmap_width, vmap_height, sizeof(char)); | |
261 | if(vmap == NULL) | |
262 | { | |
263 | pm_error( "Cannot allocate memory" ); | |
264 | diff --git a/converter/pbm/pbmtogem.c b/converter/pbm/pbmtogem.c | |
265 | index 9eab041..13b0257 100644 | |
266 | --- a/converter/pbm/pbmtogem.c | |
267 | +++ b/converter/pbm/pbmtogem.c | |
268 | @@ -79,6 +79,7 @@ putinit (int const rows, int const cols) | |
269 | bitsperitem = 0; | |
270 | bitshift = 7; | |
271 | outcol = 0; | |
272 | + overflow_add(cols, 7); | |
273 | outmax = (cols + 7) / 8; | |
274 | outrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char)); | |
275 | lastrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char)); | |
276 | diff --git a/converter/pbm/pbmtogo.c b/converter/pbm/pbmtogo.c | |
277 | index 23b2ee9..d2ee91f 100644 | |
278 | --- a/converter/pbm/pbmtogo.c | |
279 | +++ b/converter/pbm/pbmtogo.c | |
280 | @@ -158,6 +158,7 @@ main(int argc, | |
281 | bitrow = pbm_allocrow(cols); | |
282 | ||
283 | /* Round cols up to the nearest multiple of 8. */ | |
284 | + overflow_add(cols, 7); | |
285 | rucols = ( cols + 7 ) / 8; | |
286 | bytesperrow = rucols; /* GraphOn uses bytes */ | |
287 | rucols = rucols * 8; | |
288 | diff --git a/converter/pbm/pbmtolj.c b/converter/pbm/pbmtolj.c | |
289 | index 0cceb4f..fdab6df 100644 | |
290 | --- a/converter/pbm/pbmtolj.c | |
291 | +++ b/converter/pbm/pbmtolj.c | |
292 | @@ -120,7 +120,11 @@ parseCommandLine(int argc, char ** argv, | |
293 | static void | |
294 | allocateBuffers(unsigned int const cols) { | |
295 | ||
296 | + overflow_add(cols, 8); | |
297 | rowBufferSize = (cols + 7) / 8; | |
298 | + overflow_add(rowBufferSize, 128); | |
299 | + overflow_add(rowBufferSize, rowBufferSize+128); | |
300 | + overflow_add(rowBufferSize+10, rowBufferSize/8); | |
301 | packBufferSize = rowBufferSize + (rowBufferSize + 127) / 128 + 1; | |
302 | deltaBufferSize = rowBufferSize + rowBufferSize / 8 + 10; | |
303 | ||
304 | diff --git a/converter/pbm/pbmtomda.c b/converter/pbm/pbmtomda.c | |
305 | index 3ad5149..9efe5cf 100644 | |
306 | --- a/converter/pbm/pbmtomda.c | |
307 | +++ b/converter/pbm/pbmtomda.c | |
308 | @@ -179,6 +179,7 @@ int main(int argc, char **argv) | |
309 | ||
310 | nOutRowsUnrounded = bScale ? nInRows/2 : nInRows; | |
311 | ||
312 | + overflow_add(nOutRowsUnrounded, 3); | |
313 | nOutRows = ((nOutRowsUnrounded + 3) / 4) * 4; | |
314 | /* MDA wants rows a multiple of 4 */ | |
315 | nOutCols = nInCols / 8; | |
316 | diff --git a/converter/pbm/pbmtoppa/pbm.c b/converter/pbm/pbmtoppa/pbm.c | |
317 | index 2f8a42b..1c8d236 100644 | |
318 | --- a/converter/pbm/pbmtoppa/pbm.c | |
319 | +++ b/converter/pbm/pbmtoppa/pbm.c | |
320 | @@ -106,6 +106,7 @@ int pbm_readline(pbm_stat* pbm,unsigned char* data) | |
321 | return 0; | |
322 | ||
323 | case P4: | |
324 | + overflow_add(pbm->width, 7); | |
325 | tmp=(pbm->width+7)/8; | |
326 | tmp2=fread(data,1,tmp,pbm->fptr); | |
327 | if(tmp2 == tmp) | |
328 | @@ -130,6 +131,7 @@ void pbm_unreadline (pbm_stat *pbm, void *data) | |
329 | return; | |
330 | ||
331 | pbm->unread = 1; | |
332 | + overflow_add(pbm->width, 7); | |
333 | pbm->revdata = malloc ((pbm->width+7)/8); | |
334 | memcpy (pbm->revdata, data, (pbm->width+7)/8); | |
335 | pbm->current_line--; | |
336 | diff --git a/converter/pbm/pbmtoppa/pbmtoppa.c b/converter/pbm/pbmtoppa/pbmtoppa.c | |
337 | index f43c08a..98e0284 100644 | |
338 | --- a/converter/pbm/pbmtoppa/pbmtoppa.c | |
339 | +++ b/converter/pbm/pbmtoppa/pbmtoppa.c | |
340 | @@ -452,6 +452,7 @@ main(int argc, char *argv[]) { | |
341 | pm_error("main(): unrecognized parameter '%s'", argv[argn]); | |
342 | } | |
343 | ||
344 | + overflow_add(Width, 7); | |
345 | Pwidth=(Width+7)/8; | |
346 | printer.fptr=out; | |
347 | ||
348 | diff --git a/converter/pbm/pbmtoxbm.c b/converter/pbm/pbmtoxbm.c | |
349 | index 14c6b85..362b70e 100644 | |
350 | --- a/converter/pbm/pbmtoxbm.c | |
351 | +++ b/converter/pbm/pbmtoxbm.c | |
352 | @@ -351,6 +351,8 @@ convertRaster(FILE * const ifP, | |
353 | ||
354 | unsigned char * bitrow; | |
355 | unsigned int row; | |
356 | + | |
357 | + overflow_add(cols, padright); | |
358 | ||
359 | putinit(xbmVersion); | |
360 | ||
361 | diff --git a/converter/pbm/pktopbm.c b/converter/pbm/pktopbm.c | |
362 | index 712f339..b6fcb02 100644 | |
363 | --- a/converter/pbm/pktopbm.c | |
364 | +++ b/converter/pbm/pktopbm.c | |
365 | @@ -280,6 +280,7 @@ main(int argc, char *argv[]) { | |
366 | if (flagbyte == 7) { /* long form preamble */ | |
367 | integer packetlength = get32() ; /* character packet length */ | |
368 | car = get32() ; /* character number */ | |
369 | + overflow_add(packetlength, pktopbm_pkloc); | |
370 | endofpacket = packetlength + pktopbm_pkloc; | |
371 | /* calculate end of packet */ | |
372 | if ((car >= MAXPKCHAR) || !filename[car]) { | |
373 | diff --git a/converter/pbm/thinkjettopbm.l b/converter/pbm/thinkjettopbm.l | |
374 | index 5de4f2b..7f31de5 100644 | |
375 | --- a/converter/pbm/thinkjettopbm.l | |
376 | +++ b/converter/pbm/thinkjettopbm.l | |
377 | @@ -114,7 +114,9 @@ DIG [0-9] | |
378 | <RASTERMODE>\033\*b{DIG}+W { | |
379 | int l; | |
380 | if (rowCount >= rowCapacity) { | |
381 | - rowCapacity += 100; | |
382 | + overflow_add(rowCapacity, 100); | |
383 | + rowCapacity += 100; | |
384 | + overflow2(rowCapacity, sizeof *rows); | |
385 | rows = realloc (rows, rowCapacity * sizeof *rows); | |
386 | if (rows == NULL) | |
387 | pm_error ("Out of memory."); | |
388 | @@ -226,6 +228,8 @@ yywrap (void) | |
389 | /* | |
390 | * Quite simple since ThinkJet bit arrangement matches PBM | |
391 | */ | |
392 | + | |
393 | + overflow2(maxRowLength, 8); | |
394 | pbm_writepbminit(stdout, maxRowLength*8, rowCount, 0); | |
395 | ||
396 | packed_bitrow = malloc(maxRowLength); | |
397 | diff --git a/converter/pbm/ybmtopbm.c b/converter/pbm/ybmtopbm.c | |
398 | index 2a42908..cf1ff03 100644 | |
399 | --- a/converter/pbm/ybmtopbm.c | |
400 | +++ b/converter/pbm/ybmtopbm.c | |
401 | @@ -43,6 +43,7 @@ getinit(FILE * const ifP, | |
402 | pm_error("EOF / read error"); | |
403 | ||
404 | *depthP = 1; | |
405 | + overflow_add(*colsP, 15); | |
406 | } | |
407 | ||
408 | ||
409 | diff --git a/converter/pgm/lispmtopgm.c b/converter/pgm/lispmtopgm.c | |
410 | index 40dd3fb..b5469f7 100644 | |
411 | --- a/converter/pgm/lispmtopgm.c | |
412 | +++ b/converter/pgm/lispmtopgm.c | |
413 | @@ -58,6 +58,7 @@ main( argc, argv ) | |
414 | pm_error( "depth (%d bits) is too large", depth); | |
415 | ||
416 | pgm_writepgminit( stdout, cols, rows, (gray) maxval, 0 ); | |
417 | + overflow_add(cols, 7); | |
418 | grayrow = pgm_allocrow( ( cols + 7 ) / 8 * 8 ); | |
419 | ||
420 | for ( row = 0; row < rows; ++row ) | |
421 | @@ -102,6 +103,8 @@ getinit( file, colsP, rowsP, depthP, padrightP ) | |
422 | ||
423 | if ( *depthP == 0 ) | |
424 | *depthP = 1; /* very old file */ | |
425 | + | |
426 | + overflow_add((int)colsP, 31); | |
427 | ||
428 | *padrightP = ( ( *colsP + 31 ) / 32 ) * 32 - *colsP; | |
429 | ||
430 | diff --git a/converter/pgm/psidtopgm.c b/converter/pgm/psidtopgm.c | |
431 | index 07417d1..25bb311 100644 | |
432 | --- a/converter/pgm/psidtopgm.c | |
433 | +++ b/converter/pgm/psidtopgm.c | |
434 | @@ -78,6 +78,7 @@ main(int argc, | |
435 | pm_error("bits/sample (%d) is too large.", bitspersample); | |
436 | ||
437 | pgm_writepgminit(stdout, cols, rows, maxval, 0); | |
438 | + overflow_add(cols, 7); | |
439 | grayrow = pgm_allocrow((cols + 7) / 8 * 8); | |
440 | for (row = 0; row < rows; ++row) { | |
441 | unsigned int col; | |
442 | diff --git a/converter/ppm/Makefile b/converter/ppm/Makefile | |
443 | index 09f05cd..f68170f 100644 | |
444 | --- a/converter/ppm/Makefile | |
445 | +++ b/converter/ppm/Makefile | |
446 | @@ -11,7 +11,7 @@ SUBDIRS = hpcdtoppm | |
447 | ||
448 | PORTBINARIES = 411toppm eyuvtoppm gouldtoppm ilbmtoppm imgtoppm \ | |
449 | leaftoppm mtvtoppm neotoppm \ | |
450 | - pcxtoppm pc1toppm pi1toppm picttoppm pjtoppm \ | |
451 | + pcxtoppm pc1toppm pi1toppm pjtoppm \ | |
452 | ppmtoacad ppmtoapplevol ppmtoarbtxt ppmtoascii \ | |
453 | ppmtobmp ppmtoeyuv ppmtogif ppmtoicr ppmtoilbm \ | |
454 | ppmtoleaf ppmtolj ppmtomitsu ppmtoneo \ | |
455 | diff --git a/converter/ppm/ilbmtoppm.c b/converter/ppm/ilbmtoppm.c | |
456 | index 662be0b..2a86efc 100644 | |
457 | --- a/converter/ppm/ilbmtoppm.c | |
458 | +++ b/converter/ppm/ilbmtoppm.c | |
459 | @@ -606,6 +606,7 @@ decode_row(FILE * const ifP, | |
460 | rawtype *chp; | |
461 | ||
462 | cols = bmhdP->w; | |
463 | + overflow_add(cols, 15); | |
464 | bytes = RowBytes(cols); | |
465 | for( plane = 0; plane < nPlanes; plane++ ) { | |
466 | int mask; | |
467 | @@ -693,6 +694,23 @@ decode_mask(FILE * const ifP, | |
468 | Multipalette handling | |
469 | ****************************************************************************/ | |
470 | ||
471 | +static void * | |
472 | +xmalloc2(x, y) | |
473 | + int x; | |
474 | + int y; | |
475 | +{ | |
476 | + void *mem; | |
477 | + | |
478 | + overflow2(x,y); | |
479 | + if( x * y == 0 ) | |
480 | + return NULL; | |
481 | + | |
482 | + mem = malloc2(x,y); | |
483 | + if( mem == NULL ) | |
484 | + pm_error("out of memory allocating %d bytes", x * y); | |
485 | + return mem; | |
486 | +} | |
487 | + | |
488 | ||
489 | static void | |
490 | multi_adjust(cmap, row, palchange) | |
491 | @@ -1355,6 +1373,9 @@ dcol_to_ppm(FILE * const ifP, | |
492 | if( redmaxval != maxval || greenmaxval != maxval || bluemaxval != maxval ) | |
493 | pm_message("scaling colors to %d bits", pm_maxvaltobits(maxval)); | |
494 | ||
495 | + overflow_add(redmaxval, 1); | |
496 | + overflow_add(greenmaxval, 1); | |
497 | + overflow_add(bluemaxval, 1); | |
498 | MALLOCARRAY_NOFAIL(redtable, redmaxval +1); | |
499 | MALLOCARRAY_NOFAIL(greentable, greenmaxval +1); | |
500 | MALLOCARRAY_NOFAIL(bluetable, bluemaxval +1); | |
501 | @@ -1784,7 +1805,9 @@ PCHG_ConvertSmall(PCHG, cmap, mask, datasize) | |
502 | ChangeCount32 = *data++; | |
503 | datasize -= 2; | |
504 | ||
505 | + overflow_add(ChangeCount16, ChangeCount32); | |
506 | changes = ChangeCount16 + ChangeCount32; | |
507 | + overflow_add(changes, 1); | |
508 | for( i = 0; i < changes; i++ ) { | |
509 | if( totalchanges >= PCHG->TotalChanges ) goto fail; | |
510 | if( datasize < 2 ) goto fail; | |
511 | @@ -2049,6 +2072,9 @@ read_pchg(FILE * const ifP, | |
512 | cmap->mp_change[i] = NULL; | |
513 | if( PCHG.StartLine < 0 ) { | |
514 | int nch; | |
515 | + if(PCHG.MaxReg < PCHG.MinReg) | |
516 | + pm_error("assert: MinReg > MaxReg"); | |
517 | + overflow_add(PCHG.MaxReg-PCHG.MinReg, 2); | |
518 | nch = PCHG.MaxReg - PCHG.MinReg +1; | |
519 | MALLOCARRAY_NOFAIL(cmap->mp_init, nch + 1); | |
520 | for( i = 0; i < nch; i++ ) | |
521 | @@ -2125,6 +2151,7 @@ process_body( FILE * const ifP, | |
522 | if (typeid == ID_ILBM) { | |
523 | int isdeep; | |
524 | ||
525 | + overflow_add(bmhdP->w, 15); | |
526 | MALLOCARRAY_NOFAIL(ilbmrow, RowBytes(bmhdP->w)); | |
527 | *viewportmodesP |= fakeviewport; /* -isham/-isehb */ | |
528 | ||
529 | diff --git a/converter/ppm/imgtoppm.c b/converter/ppm/imgtoppm.c | |
530 | index 7078b88..eb8509e 100644 | |
531 | --- a/converter/ppm/imgtoppm.c | |
532 | +++ b/converter/ppm/imgtoppm.c | |
533 | @@ -84,6 +84,7 @@ main(int argc, char ** argv) { | |
534 | len = atoi((char*) buf ); | |
535 | if ( fread( buf, len, 1, ifp ) != 1 ) | |
536 | pm_error( "bad colormap buf" ); | |
537 | + overflow2(cmaplen, 3); | |
538 | if ( cmaplen * 3 != len ) | |
539 | { | |
540 | pm_message( | |
541 | @@ -105,6 +106,7 @@ main(int argc, char ** argv) { | |
542 | pm_error( "bad pixel data header" ); | |
543 | buf[8] = '\0'; | |
544 | len = atoi((char*) buf ); | |
545 | + overflow2(cols, rows); | |
546 | if ( len != cols * rows ) | |
547 | pm_message( | |
548 | "pixel data length (%d) does not match image size (%d)", | |
549 | diff --git a/converter/ppm/pcxtoppm.c b/converter/ppm/pcxtoppm.c | |
550 | index e252ba2..270ae3b 100644 | |
551 | --- a/converter/ppm/pcxtoppm.c | |
552 | +++ b/converter/ppm/pcxtoppm.c | |
553 | @@ -409,6 +409,7 @@ pcx_planes_to_pixels(pixels, bitplanes, bytesperline, planes, bitsperpixel) | |
554 | /* | |
555 | * clear the pixel buffer | |
556 | */ | |
557 | + overflow2(bytesperline, 8); | |
558 | npixels = (bytesperline * 8) / bitsperpixel; | |
559 | p = pixels; | |
560 | while (--npixels >= 0) | |
561 | @@ -470,6 +471,7 @@ pcx_16col_to_ppm(FILE * const ifP, | |
562 | } | |
563 | ||
564 | /* BytesPerLine should be >= BitsPerPixel * cols / 8 */ | |
565 | + overflow2(BytesPerLine, 8); | |
566 | rawcols = BytesPerLine * 8 / BitsPerPixel; | |
567 | if (headerCols > rawcols) { | |
568 | pm_message("warning - BytesPerLine = %d, " | |
569 | diff --git a/converter/ppm/picttoppm.c b/converter/ppm/picttoppm.c | |
570 | index 828d527..8cdb7b3 100644 | |
571 | --- a/converter/ppm/picttoppm.c | |
572 | +++ b/converter/ppm/picttoppm.c | |
573 | @@ -1,3 +1,4 @@ | |
574 | +#error "Unfixable. Don't ship me" | |
575 | /* | |
576 | * picttoppm.c -- convert a MacIntosh PICT file to PPM format. | |
577 | * | |
578 | diff --git a/converter/ppm/pjtoppm.c b/converter/ppm/pjtoppm.c | |
579 | index 7b694fb..62ce77e 100644 | |
580 | --- a/converter/ppm/pjtoppm.c | |
581 | +++ b/converter/ppm/pjtoppm.c | |
582 | @@ -127,20 +127,22 @@ main(argc, argv) | |
583 | case 'V': /* send plane */ | |
584 | case 'W': /* send last plane */ | |
585 | if (rows == -1 || r >= rows || image == NULL) { | |
586 | - if (rows == -1 || r >= rows) | |
587 | + if (rows == -1 || r >= rows) { | |
588 | + overflow_add(rows, 100); | |
589 | rows += 100; | |
590 | + } | |
591 | + | |
592 | if (image == NULL) { | |
593 | - MALLOCARRAY(image, rows * planes); | |
594 | - MALLOCARRAY(imlen, rows * planes); | |
595 | + image = (unsigned char **) | |
596 | + malloc3(rows , planes , sizeof(unsigned char *)); | |
597 | + imlen = (int *) malloc3(rows , planes, sizeof(int)); | |
598 | } | |
599 | else { | |
600 | - image = (unsigned char **) | |
601 | - realloc(image, | |
602 | - rows * planes * | |
603 | - sizeof(unsigned char *)); | |
604 | - imlen = (int *) | |
605 | - realloc(imlen, rows * planes * sizeof(int)); | |
606 | - } | |
607 | + overflow2(rows,planes); | |
608 | + image = (unsigned char **) | |
609 | + realloc2(image, rows * planes, | |
610 | + sizeof(unsigned char *)); | |
611 | + imlen = (int *) realloc2(imlen, rows * planes, sizeof(int)); } | |
612 | } | |
613 | if (image == NULL || imlen == NULL) | |
614 | pm_error("out of memory"); | |
615 | @@ -212,8 +214,10 @@ main(argc, argv) | |
616 | for (i = 0, c = 0; c < imlen[p + r * planes]; c += 2) | |
617 | for (cmd = image[p + r * planes][c], | |
618 | val = image[p + r * planes][c+1]; | |
619 | - cmd >= 0 && i < newcols; cmd--, i++) | |
620 | + cmd >= 0 && i < newcols; cmd--, i++) { | |
621 | buf[i] = val; | |
622 | + overflow_add(i, 1); | |
623 | + } | |
624 | cols = cols > i ? cols : i; | |
625 | free(image[p + r * planes]); | |
626 | /* | |
627 | @@ -224,6 +228,7 @@ main(argc, argv) | |
628 | image[p + r * planes] = (unsigned char *) realloc(buf, i); | |
629 | } | |
630 | } | |
631 | + overflow2(cols, 8); | |
632 | cols *= 8; | |
633 | } | |
634 | ||
635 | diff --git a/converter/ppm/ppmtoeyuv.c b/converter/ppm/ppmtoeyuv.c | |
636 | index f5ce115..6f072be 100644 | |
637 | --- a/converter/ppm/ppmtoeyuv.c | |
638 | +++ b/converter/ppm/ppmtoeyuv.c | |
639 | @@ -114,6 +114,7 @@ create_multiplication_tables(const pixval maxval) { | |
640 | ||
641 | int index; | |
642 | ||
643 | + overflow_add(maxval, 1); | |
644 | MALLOCARRAY_NOFAIL(mult299 , maxval+1); | |
645 | MALLOCARRAY_NOFAIL(mult587 , maxval+1); | |
646 | MALLOCARRAY_NOFAIL(mult114 , maxval+1); | |
647 | diff --git a/converter/ppm/ppmtolj.c b/converter/ppm/ppmtolj.c | |
648 | index 7ed814e..b4e7db1 100644 | |
649 | --- a/converter/ppm/ppmtolj.c | |
650 | +++ b/converter/ppm/ppmtolj.c | |
651 | @@ -182,6 +182,7 @@ int main(int argc, char *argv[]) { | |
652 | ppm_readppminit( ifp, &cols, &rows, &maxval, &format ); | |
653 | pixelrow = ppm_allocrow( cols ); | |
654 | ||
655 | + overflow2(cols, 6); | |
656 | obuf = (unsigned char *) pm_allocrow(cols * 3, sizeof(unsigned char)); | |
657 | cbuf = (unsigned char *) pm_allocrow(cols * 6, sizeof(unsigned char)); | |
658 | if (mode == C_TRANS_MODE_DELTA) | |
659 | diff --git a/converter/ppm/ppmtomitsu.c b/converter/ppm/ppmtomitsu.c | |
660 | index e59f09b..1d2be20 100644 | |
661 | --- a/converter/ppm/ppmtomitsu.c | |
662 | +++ b/converter/ppm/ppmtomitsu.c | |
663 | @@ -685,6 +685,8 @@ main(int argc, char * argv[]) { | |
664 | medias = MSize_User; | |
665 | ||
666 | if (dpi300) { | |
667 | + overflow2(medias.maxcols, 2); | |
668 | + overflow2(medias.maxrows, 2); | |
669 | medias.maxcols *= 2; | |
670 | medias.maxrows *= 2; | |
671 | } | |
672 | diff --git a/converter/ppm/ppmtopcx.c b/converter/ppm/ppmtopcx.c | |
673 | index fa68edc..97dfb2b 100644 | |
674 | --- a/converter/ppm/ppmtopcx.c | |
675 | +++ b/converter/ppm/ppmtopcx.c | |
676 | @@ -425,6 +425,8 @@ ppmTo16ColorPcx(pixel ** const pixels, | |
677 | else Planes = 1; | |
678 | } | |
679 | } | |
680 | + overflow2(BitsPerPixel, cols); | |
681 | + overflow_add(BitsPerPixel * cols, 7); | |
682 | BytesPerLine = ((cols * BitsPerPixel) + 7) / 8; | |
683 | MALLOCARRAY_NOFAIL(indexRow, cols); | |
684 | MALLOCARRAY_NOFAIL(planesrow, BytesPerLine); | |
685 | diff --git a/converter/ppm/ppmtopict.c b/converter/ppm/ppmtopict.c | |
686 | index 034e705..4541387 100644 | |
687 | --- a/converter/ppm/ppmtopict.c | |
688 | +++ b/converter/ppm/ppmtopict.c | |
689 | @@ -450,6 +450,8 @@ main(int argc, const char ** argv) { | |
690 | putShort(stdout, 0); /* mode */ | |
691 | ||
692 | /* Finally, write out the data. */ | |
693 | + overflow_add(cols/MAX_COUNT, 1); | |
694 | + overflow_add(cols, cols/MAX_COUNT+1); | |
695 | outBuf = malloc((unsigned)(cols+cols/MAX_COUNT+1)); | |
696 | for (row = 0, oc = 0; row < rows; ++row) { | |
697 | unsigned int rowSize; | |
698 | diff --git a/converter/ppm/ppmtopj.c b/converter/ppm/ppmtopj.c | |
699 | index d116773..fc84cac 100644 | |
700 | --- a/converter/ppm/ppmtopj.c | |
701 | +++ b/converter/ppm/ppmtopj.c | |
702 | @@ -179,6 +179,7 @@ char *argv[]; | |
703 | pixels = ppm_readppm( ifp, &cols, &rows, &maxval ); | |
704 | ||
705 | pm_close( ifp ); | |
706 | + overflow2(cols,2); | |
707 | obuf = (unsigned char *) pm_allocrow(cols, sizeof(unsigned char)); | |
708 | cbuf = (unsigned char *) pm_allocrow(cols * 2, sizeof(unsigned char)); | |
709 | ||
710 | diff --git a/converter/ppm/ppmtopjxl.c b/converter/ppm/ppmtopjxl.c | |
711 | index ddf4963..b2c7e8e 100644 | |
712 | --- a/converter/ppm/ppmtopjxl.c | |
713 | +++ b/converter/ppm/ppmtopjxl.c | |
714 | @@ -306,6 +306,9 @@ main(int argc, const char * argv[]) { | |
715 | if (maxval > PCL_MAXVAL) | |
716 | pm_error("color range too large; reduce with ppmcscale"); | |
717 | ||
718 | + if (cols < 0 || rows < 0) | |
719 | + pm_error("negative size is not possible"); | |
720 | + | |
721 | /* Figure out the colormap. */ | |
722 | pm_message("Computing colormap..."); | |
723 | chv = ppm_computecolorhist(pixels, cols, rows, MAXCOLORS, &colors); | |
724 | @@ -325,6 +328,8 @@ main(int argc, const char * argv[]) { | |
725 | case 0: /* direct mode (no palette) */ | |
726 | bpp = bitsperpixel(maxval); /* bits per pixel */ | |
727 | bpg = bpp; bpb = bpp; | |
728 | + overflow2(bpp, 3); | |
729 | + overflow_add(bpp*3, 7); | |
730 | bpp = (bpp*3+7)>>3; /* bytes per pixel now */ | |
731 | bpr = (bpp<<3)-bpg-bpb; | |
732 | bpp *= cols; /* bytes per row now */ | |
733 | @@ -334,9 +339,13 @@ main(int argc, const char * argv[]) { | |
734 | case 3: case 7: pclindex++; | |
735 | default: | |
736 | bpp = 8/pclindex; | |
737 | + overflow_add(cols, bpp); | |
738 | + if(bpp == 0) | |
739 | + pm_error("assert: no bpp"); | |
740 | bpp = (cols+bpp-1)/bpp; /* bytes per row */ | |
741 | } | |
742 | } | |
743 | + overflow2(bpp,2); | |
744 | inrow = (char *)malloc((unsigned)bpp); | |
745 | outrow = (char *)malloc((unsigned)bpp*2); | |
746 | runcnt = (signed char *)malloc((unsigned)bpp); | |
747 | diff --git a/converter/ppm/ppmtowinicon.c b/converter/ppm/ppmtowinicon.c | |
748 | index c673798..af2b445 100644 | |
749 | --- a/converter/ppm/ppmtowinicon.c | |
750 | +++ b/converter/ppm/ppmtowinicon.c | |
751 | @@ -12,6 +12,7 @@ | |
752 | ||
753 | #include <math.h> | |
754 | #include <string.h> | |
755 | +#include <stdlib.h> | |
756 | ||
757 | #include "pm_c_util.h" | |
758 | #include "winico.h" | |
759 | @@ -214,6 +215,7 @@ createAndBitmap (gray ** const ba, int const cols, int const rows, | |
760 | MALLOCARRAY_NOFAIL(rowData, rows); | |
761 | icBitmap->xBytes = xBytes; | |
762 | icBitmap->data = rowData; | |
763 | + overflow2(xBytes, rows); | |
764 | icBitmap->size = xBytes * rows; | |
765 | for (y=0;y<rows;y++) { | |
766 | u1 * row; | |
767 | @@ -342,6 +344,7 @@ create4Bitmap (pixel ** const pa, int const cols, int const rows, | |
768 | MALLOCARRAY_NOFAIL(rowData, rows); | |
769 | icBitmap->xBytes = xBytes; | |
770 | icBitmap->data = rowData; | |
771 | + overflow2(xBytes, rows); | |
772 | icBitmap->size = xBytes * rows; | |
773 | ||
774 | for (y=0;y<rows;y++) { | |
775 | @@ -402,6 +405,7 @@ create8Bitmap (pixel ** const pa, int const cols, int const rows, | |
776 | MALLOCARRAY_NOFAIL(rowData, rows); | |
777 | icBitmap->xBytes = xBytes; | |
778 | icBitmap->data = rowData; | |
779 | + overflow2(xBytes, rows); | |
780 | icBitmap->size = xBytes * rows; | |
781 | ||
782 | for (y=0;y<rows;y++) { | |
783 | @@ -709,7 +713,11 @@ addEntryToIcon(MS_Ico const MSIconData, | |
784 | entry->bitcount = bpp; | |
785 | entry->ih = createInfoHeader(entry, xorBitmap, andBitmap); | |
786 | entry->colors = palette->colors; | |
787 | - entry->size_in_bytes = | |
788 | + overflow2(4, entry->color_count); | |
789 | + overflow_add(xorBitmap->size, andBitmap->size); | |
790 | + overflow_add(xorBitmap->size + andBitmap->size, 40); | |
791 | + overflow_add(xorBitmap->size + andBitmap->size + 40, 4 * entry->color_count); | |
792 | + entry->size_in_bytes = | |
793 | xorBitmap->size + andBitmap->size + 40 + (4 * entry->color_count); | |
794 | if (verbose) | |
795 | pm_message("entry->size_in_bytes = %d + %d + %d = %d", | |
796 | diff --git a/converter/ppm/ppmtoxpm.c b/converter/ppm/ppmtoxpm.c | |
797 | index 38d9997..904c98d 100644 | |
798 | --- a/converter/ppm/ppmtoxpm.c | |
799 | +++ b/converter/ppm/ppmtoxpm.c | |
800 | @@ -197,6 +197,7 @@ genNumstr(unsigned int const input, int const digits) { | |
801 | unsigned int i; | |
802 | ||
803 | /* Allocate memory for printed number. Abort if error. */ | |
804 | + overflow_add(digits, 1); | |
805 | if (!(str = (char *) malloc(digits + 1))) | |
806 | pm_error("out of memory"); | |
807 | ||
808 | @@ -314,6 +315,7 @@ genCmap(colorhist_vector const chv, | |
809 | unsigned int charsPerPixel; | |
810 | unsigned int xpmMaxval; | |
811 | ||
812 | + if (includeTransparent) overflow_add(ncolors, 1); | |
813 | MALLOCARRAY(cmap, cmapSize); | |
814 | if (cmapP == NULL) | |
815 | pm_error("Out of memory allocating %u bytes for a color map.", | |
816 | diff --git a/converter/ppm/qrttoppm.c b/converter/ppm/qrttoppm.c | |
817 | index 935463e..653084c 100644 | |
818 | --- a/converter/ppm/qrttoppm.c | |
819 | +++ b/converter/ppm/qrttoppm.c | |
820 | @@ -46,7 +46,7 @@ main( argc, argv ) | |
821 | ||
822 | ppm_writeppminit( stdout, cols, rows, maxval, 0 ); | |
823 | pixelrow = ppm_allocrow( cols ); | |
824 | - buf = (unsigned char *) malloc( 3 * cols ); | |
825 | + buf = (unsigned char *) malloc2( 3 , cols ); | |
826 | if ( buf == (unsigned char *) 0 ) | |
827 | pm_error( "out of memory" ); | |
828 | ||
829 | diff --git a/converter/ppm/sldtoppm.c b/converter/ppm/sldtoppm.c | |
830 | index 6ba4cb4..fc6a498 100644 | |
831 | --- a/converter/ppm/sldtoppm.c | |
832 | +++ b/converter/ppm/sldtoppm.c | |
833 | @@ -464,6 +464,8 @@ slider(slvecfn slvec, | |
834 | ||
835 | /* Allocate image buffer and clear it to black. */ | |
836 | ||
837 | + overflow_add(ixdots, 1); | |
838 | + overflow_add(iydots, 1); | |
839 | pixels = ppm_allocarray(pixcols = ixdots + 1, pixrows = iydots + 1); | |
840 | PPM_ASSIGN(rgbcolor, 0, 0, 0); | |
841 | ppmd_filledrectangle(pixels, pixcols, pixrows, pixmaxval, 0, 0, | |
842 | diff --git a/converter/ppm/ximtoppm.c b/converter/ppm/ximtoppm.c | |
843 | index ce5e639..a39b689 100644 | |
844 | --- a/converter/ppm/ximtoppm.c | |
845 | +++ b/converter/ppm/ximtoppm.c | |
846 | @@ -160,6 +163,7 @@ ReadXimHeader(FILE * const in_fp, | |
847 | if (header->nchannels == 3 && header->bits_channel == 8) | |
848 | header->ncolors = 0; | |
849 | else if (header->nchannels == 1 && header->bits_channel == 8) { | |
850 | + overflow2(header->ncolors, sizeof(Color)); | |
851 | header->colors = (Color *)calloc((unsigned int)header->ncolors, | |
852 | sizeof(Color)); | |
853 | if (header->colors == NULL) { | |
854 | diff --git a/editor/pamcut.c b/editor/pamcut.c | |
855 | index 7c41af3..72df687 100644 | |
856 | --- a/editor/pamcut.c | |
857 | +++ b/editor/pamcut.c | |
858 | @@ -655,6 +655,8 @@ cutOneImage(FILE * const ifP, | |
859 | ||
860 | outpam = inpam; /* Initial value -- most fields should be same */ | |
861 | outpam.file = ofP; | |
862 | + overflow_add(rightcol, 1); | |
863 | + overflow_add(bottomrow, 1); | |
864 | outpam.width = rightcol - leftcol + 1; | |
865 | outpam.height = bottomrow - toprow + 1; | |
866 | ||
867 | diff --git a/editor/pbmreduce.c b/editor/pbmreduce.c | |
868 | index f49c8d9..580e5e0 100644 | |
869 | --- a/editor/pbmreduce.c | |
870 | +++ b/editor/pbmreduce.c | |
871 | @@ -94,6 +94,7 @@ main( argc, argv ) | |
872 | if (halftone == QT_FS) { | |
873 | unsigned int col; | |
874 | /* Initialize Floyd-Steinberg. */ | |
875 | + overflow_add(newcols, 2); | |
876 | MALLOCARRAY(thiserr, newcols + 2); | |
877 | MALLOCARRAY(nexterr, newcols + 2); | |
878 | if (thiserr == NULL || nexterr == NULL) | |
879 | diff --git a/editor/pnmgamma.c b/editor/pnmgamma.c | |
880 | index b357b0d..ec612d3 100644 | |
881 | --- a/editor/pnmgamma.c | |
882 | +++ b/editor/pnmgamma.c | |
883 | @@ -596,6 +596,7 @@ createGammaTables(enum transferFunction const transferFunction, | |
884 | xelval ** const btableP) { | |
885 | ||
886 | /* Allocate space for the tables. */ | |
887 | + overflow_add(maxval, 1); | |
888 | MALLOCARRAY(*rtableP, maxval+1); | |
889 | MALLOCARRAY(*gtableP, maxval+1); | |
890 | MALLOCARRAY(*btableP, maxval+1); | |
891 | diff --git a/editor/pnmhisteq.c b/editor/pnmhisteq.c | |
892 | index 8af4201..0c8d6e5 100644 | |
893 | --- a/editor/pnmhisteq.c | |
894 | +++ b/editor/pnmhisteq.c | |
895 | @@ -107,6 +107,7 @@ computeLuminosityHistogram(xel * const * const xels, | |
896 | unsigned int pixelCount; | |
897 | unsigned int * lumahist; | |
898 | ||
899 | + overflow_add(maxval, 1); | |
900 | MALLOCARRAY(lumahist, maxval + 1); | |
901 | if (lumahist == NULL) | |
902 | pm_error("Out of storage allocating array for %u histogram elements", | |
903 | diff --git a/editor/pnmindex.csh b/editor/pnmindex.csh | |
904 | index c6f1e84..c513a84 100755 | |
905 | --- a/editor/pnmindex.csh | |
906 | +++ b/editor/pnmindex.csh | |
907 | @@ -1,5 +1,7 @@ | |
908 | #!/bin/csh -f | |
909 | # | |
910 | +echo "Unsafe code, needs debugging, do not ship" | |
911 | +exit 1 | |
912 | # pnmindex - build a visual index of a bunch of anymaps | |
913 | # | |
914 | # Copyright (C) 1991 by Jef Poskanzer. | |
915 | diff --git a/editor/pnmpad.c b/editor/pnmpad.c | |
916 | index 1904b68..0797cf1 100644 | |
917 | --- a/editor/pnmpad.c | |
918 | +++ b/editor/pnmpad.c | |
919 | @@ -527,6 +527,8 @@ main(int argc, const char ** argv) { | |
920 | ||
921 | computePadSizes(cmdline, cols, rows, &lpad, &rpad, &tpad, &bpad); | |
922 | ||
923 | + overflow_add(cols, lpad); | |
924 | + overflow_add(cols + lpad, rpad); | |
925 | newcols = cols + lpad + rpad; | |
926 | ||
927 | if (PNM_FORMAT_TYPE(format) == PBM_TYPE) | |
928 | diff --git a/editor/pnmremap.c b/editor/pnmremap.c | |
929 | index b2448cb..b924120 100644 | |
930 | --- a/editor/pnmremap.c | |
931 | +++ b/editor/pnmremap.c | |
932 | @@ -428,6 +428,7 @@ initFserr(struct pam * const pamP, | |
933 | ||
934 | unsigned int const fserrSize = pamP->width + 2; | |
935 | ||
936 | + overflow_add(pamP->width, 2); | |
937 | fserrP->width = pamP->width; | |
938 | ||
939 | MALLOCARRAY(fserrP->thiserr, pamP->depth); | |
940 | @@ -465,6 +466,7 @@ floydInitRow(struct pam * const pamP, struct fserr * const fserrP) { | |
941 | ||
942 | int col; | |
943 | ||
944 | + overflow_add(pamP->width, 2); | |
945 | for (col = 0; col < pamP->width + 2; ++col) { | |
946 | unsigned int plane; | |
947 | for (plane = 0; plane < pamP->depth; ++plane) | |
948 | diff --git a/editor/pnmscalefixed.c b/editor/pnmscalefixed.c | |
949 | index 884ca31..747cd8f 100644 | |
950 | --- a/editor/pnmscalefixed.c | |
951 | +++ b/editor/pnmscalefixed.c | |
952 | @@ -214,6 +214,7 @@ compute_output_dimensions(const struct cmdline_info cmdline, | |
953 | const int rows, const int cols, | |
954 | int * newrowsP, int * newcolsP) { | |
955 | ||
956 | + overflow2(rows, cols); | |
957 | if (cmdline.pixels) { | |
958 | if (rows * cols <= cmdline.pixels) { | |
959 | *newrowsP = rows; | |
960 | @@ -265,6 +266,8 @@ compute_output_dimensions(const struct cmdline_info cmdline, | |
961 | ||
962 | if (*newcolsP < 1) *newcolsP = 1; | |
963 | if (*newrowsP < 1) *newrowsP = 1; | |
964 | + | |
965 | + overflow2(*newcolsP, *newrowsP); | |
966 | } | |
967 | ||
968 | ||
969 | @@ -446,6 +449,9 @@ main(int argc, char **argv ) { | |
970 | unfilled. We can address that by stretching, whereas the other | |
971 | case would require throwing away some of the input. | |
972 | */ | |
973 | + | |
974 | + overflow2(newcols, SCALE); | |
975 | + overflow2(newrows, SCALE); | |
976 | sxscale = SCALE * newcols / cols; | |
977 | syscale = SCALE * newrows / rows; | |
978 | ||
979 | diff --git a/editor/ppmdither.c b/editor/ppmdither.c | |
980 | index ec1b977..e701e09 100644 | |
981 | --- a/editor/ppmdither.c | |
982 | +++ b/editor/ppmdither.c | |
983 | @@ -356,6 +356,11 @@ dithMatrix(unsigned int const dithPower) { | |
984 | (dithDim * sizeof(*dithMat)) + /* pointers */ | |
985 | (dithDim * dithDim * sizeof(**dithMat)); /* data */ | |
986 | ||
987 | + | |
988 | + overflow2(dithDim, sizeof(*dithMat)); | |
989 | + overflow3(dithDim, dithDim, sizeof(**dithMat)); | |
990 | + overflow_add(dithDim * sizeof(*dithMat), dithDim * dithDim * sizeof(**dithMat)); | |
991 | + | |
992 | dithMat = malloc(dithMatSize); | |
993 | ||
994 | if (dithMat == NULL) | |
995 | diff --git a/editor/specialty/pamoil.c b/editor/specialty/pamoil.c | |
996 | index 6cb8d3a..6f4bde9 100644 | |
997 | --- a/editor/specialty/pamoil.c | |
998 | +++ b/editor/specialty/pamoil.c | |
999 | @@ -112,6 +112,7 @@ main(int argc, char *argv[] ) { | |
1000 | tuples = pnm_readpam(ifp, &inpam, PAM_STRUCT_SIZE(tuple_type)); | |
1001 | pm_close(ifp); | |
1002 | ||
1003 | + overflow_add(inpam.maxval, 1); | |
1004 | MALLOCARRAY(hist, inpam.maxval + 1); | |
1005 | if (hist == NULL) | |
1006 | pm_error("Unable to allocate memory for histogram."); | |
1007 | diff --git a/generator/pbmtext.c b/generator/pbmtext.c | |
1008 | index 9f4366d..445d718 100644 | |
1009 | --- a/generator/pbmtext.c | |
1010 | +++ b/generator/pbmtext.c | |
1011 | @@ -96,12 +96,14 @@ parseCommandLine(int argc, const char ** argv, | |
1012 | ||
1013 | for (i = 1; i < argc; ++i) { | |
1014 | if (i > 1) { | |
1015 | + overflow_add(totaltextsize, 1); | |
1016 | totaltextsize += 1; | |
1017 | text = realloc(text, totaltextsize); | |
1018 | if (text == NULL) | |
1019 | pm_error("out of memory allocating space for input text"); | |
1020 | strcat(text, " "); | |
1021 | - } | |
1022 | + } | |
1023 | + overflow_add(totaltextsize, strlen(argv[i])); | |
1024 | totaltextsize += strlen(argv[i]); | |
1025 | text = realloc(text, totaltextsize); | |
1026 | if (text == NULL) | |
1027 | @@ -712,6 +714,7 @@ getText(const char cmdline_text[], | |
1028 | pm_error("A line of input text is longer than %u characters." | |
1029 | "Cannot process.", (unsigned)sizeof(buf)-1); | |
1030 | if (lineCount >= maxlines) { | |
1031 | + overflow2(maxlines, 2); | |
1032 | maxlines *= 2; | |
1033 | REALLOCARRAY(text_array, maxlines); | |
1034 | if (text_array == NULL) | |
1035 | @@ -832,6 +835,7 @@ main(int argc, const char *argv[]) { | |
1036 | hmargin = fontP->maxwidth; | |
1037 | } else { | |
1038 | vmargin = fontP->maxheight; | |
1039 | + overflow2(2, fontP->maxwidth); | |
1040 | hmargin = 2 * fontP->maxwidth; | |
1041 | } | |
1042 | } | |
1043 | diff --git a/lib/libpam.c b/lib/libpam.c | |
1044 | index cc6368e..4e10572 100644 | |
1045 | --- a/lib/libpam.c | |
1046 | +++ b/lib/libpam.c | |
1047 | @@ -224,8 +224,9 @@ allocPamRow(const struct pam * const pamP) { | |
1048 | unsigned int const bytesPerTuple = allocationDepth(pamP) * sizeof(sample); | |
1049 | tuple * tuplerow; | |
1050 | ||
1051 | - tuplerow = malloc(pamP->width * (sizeof(tuple *) + bytesPerTuple)); | |
1052 | - | |
1053 | + overflow_add(sizeof(tuple *), bytesPerTuple); | |
1054 | + tuplerow = malloc2(pamP->width, (sizeof(tuple *) + bytesPerTuple)); | |
1055 | + | |
1056 | if (tuplerow != NULL) { | |
1057 | /* Now we initialize the pointers to the individual tuples | |
1058 | to make this a regulation C two dimensional array. | |
1059 | diff --git a/lib/libpammap.c b/lib/libpammap.c | |
1060 | index 55e1d3f..04b1ba3 100644 | |
1061 | --- a/lib/libpammap.c | |
1062 | +++ b/lib/libpammap.c | |
1063 | @@ -108,7 +108,9 @@ allocTupleIntListItem(struct pam * const pamP) { | |
1064 | */ | |
1065 | struct tupleint_list_item * retval; | |
1066 | ||
1067 | - unsigned int const size = | |
1068 | + overflow2(pamP->depth, sizeof(sample)); | |
1069 | + overflow_add(sizeof(*retval)-sizeof(retval->tupleint.tuple), pamP->depth*sizeof(sample)); | |
1070 | + unsigned int const size = | |
1071 | sizeof(*retval) - sizeof(retval->tupleint.tuple) | |
1072 | + pamP->depth * sizeof(sample); | |
1073 | ||
1074 | diff --git a/lib/libpm.c b/lib/libpm.c | |
1075 | index 4374bbe..5ab7f83 100644 | |
1076 | --- a/lib/libpm.c | |
1077 | +++ b/lib/libpm.c | |
1078 | @@ -841,5 +841,53 @@ pm_parse_height(const char * const arg) { | |
1079 | return height; | |
1080 | } | |
1081 | ||
1082 | +/* | |
1083 | + * Maths wrapping | |
1084 | + */ | |
1085 | ||
1086 | +void __overflow2(int a, int b) | |
1087 | +{ | |
1088 | + if(a < 0 || b < 0) | |
1089 | + pm_error("object too large"); | |
1090 | + if(b == 0) | |
1091 | + return; | |
1092 | + if(a > INT_MAX / b) | |
1093 | + pm_error("object too large"); | |
1094 | +} | |
1095 | + | |
1096 | +void overflow3(int a, int b, int c) | |
1097 | +{ | |
1098 | + overflow2(a,b); | |
1099 | + overflow2(a*b, c); | |
1100 | +} | |
1101 | + | |
1102 | +void overflow_add(int a, int b) | |
1103 | +{ | |
1104 | + if( a > INT_MAX - b) | |
1105 | + pm_error("object too large"); | |
1106 | +} | |
1107 | + | |
1108 | +void *malloc2(int a, int b) | |
1109 | +{ | |
1110 | + overflow2(a, b); | |
1111 | + if(a*b == 0) | |
1112 | + pm_error("Zero byte allocation"); | |
1113 | + return malloc(a*b); | |
1114 | +} | |
1115 | + | |
1116 | +void *malloc3(int a, int b, int c) | |
1117 | +{ | |
1118 | + overflow3(a, b, c); | |
1119 | + if(a*b*c == 0) | |
1120 | + pm_error("Zero byte allocation"); | |
1121 | + return malloc(a*b*c); | |
1122 | +} | |
1123 | + | |
1124 | +void *realloc2(void * a, int b, int c) | |
1125 | +{ | |
1126 | + overflow2(b, c); | |
1127 | + if(b*c == 0) | |
1128 | + pm_error("Zero byte allocation"); | |
1129 | + return realloc(a, b*c); | |
1130 | +} | |
1131 | ||
1132 | diff --git a/lib/pm.h b/lib/pm.h | |
1133 | index e9f1405..da54391 100644 | |
1134 | --- a/lib/pm.h | |
1135 | +++ b/lib/pm.h | |
1136 | @@ -435,5 +435,12 @@ pm_parse_height(const char * const arg); | |
1137 | } | |
1138 | #endif | |
1139 | ||
1140 | +void *malloc2(int, int); | |
1141 | +void *malloc3(int, int, int); | |
1142 | +#define overflow2(a,b) __overflow2(a,b) | |
1143 | +void __overflow2(int, int); | |
1144 | +void overflow3(int, int, int); | |
1145 | +void overflow_add(int, int); | |
1146 | + | |
1147 | ||
1148 | #endif | |
1149 | diff --git a/other/pnmcolormap.c b/other/pnmcolormap.c | |
1150 | index 57db432..7195295 100644 | |
1151 | --- a/other/pnmcolormap.c | |
1152 | +++ b/other/pnmcolormap.c | |
1153 | @@ -840,6 +840,7 @@ colormapToSquare(struct pam * const pamP, | |
1154 | pamP->width = intsqrt; | |
1155 | else | |
1156 | pamP->width = intsqrt + 1; | |
1157 | + overflow_add(intsqrt, 1); | |
1158 | } | |
1159 | { | |
1160 | unsigned int const intQuotient = colormap.size / pamP->width; | |
1161 | diff --git a/urt/Runput.c b/urt/Runput.c | |
1162 | index 3bc562a..645a376 100644 | |
1163 | --- a/urt/Runput.c | |
1164 | +++ b/urt/Runput.c | |
1165 | @@ -202,10 +202,11 @@ RunSetup(rle_hdr * the_hdr) | |
1166 | if ( the_hdr->background != 0 ) | |
1167 | { | |
1168 | register int i; | |
1169 | - register rle_pixel *background = | |
1170 | - (rle_pixel *)malloc( (unsigned)(the_hdr->ncolors + 1) ); | |
1171 | - register int *bg_color; | |
1172 | - /* | |
1173 | + register rle_pixel *background; | |
1174 | + register int *bg_color; | |
1175 | + | |
1176 | + overflow_add(the_hdr->ncolors,1); | |
1177 | + background = (rle_pixel *)malloc( (unsigned)(the_hdr->ncolors + 1) ); /* | |
1178 | * If even number of bg color bytes, put out one more to get to | |
1179 | * 16 bit boundary. | |
1180 | */ | |
1181 | @@ -224,7 +225,7 @@ RunSetup(rle_hdr * the_hdr) | |
1182 | /* Big-endian machines are harder */ | |
1183 | register int i, nmap = (1 << the_hdr->cmaplen) * | |
1184 | the_hdr->ncmap; | |
1185 | - register char *h_cmap = (char *)malloc( nmap * 2 ); | |
1186 | + register char *h_cmap = (char *)malloc2( nmap, 2 ); | |
1187 | if ( h_cmap == NULL ) | |
1188 | { | |
1189 | fprintf( stderr, | |
1190 | diff --git a/urt/rle.h b/urt/rle.h | |
1191 | index 8d72cb9..ac65b94 100644 | |
1192 | --- a/urt/rle.h | |
1193 | +++ b/urt/rle.h | |
1194 | @@ -161,6 +161,17 @@ rle_hdr /* End of typedef. */ | |
1195 | */ | |
1196 | extern rle_hdr rle_dflt_hdr; | |
1197 | ||
1198 | +/* | |
1199 | + * Provided by pm library | |
1200 | + */ | |
1201 | + | |
1202 | +extern void overflow_add(int, int); | |
1203 | +#define overflow2(a,b) __overflow2(a,b) | |
1204 | +extern void __overflow2(int, int); | |
1205 | +extern void overflow3(int, int, int); | |
1206 | +extern void *malloc2(int, int); | |
1207 | +extern void *malloc3(int, int, int); | |
1208 | +extern void *realloc2(void *, int, int); | |
1209 | ||
1210 | /* Declare RLE library routines. */ | |
1211 | ||
1212 | diff --git a/urt/rle_addhist.c b/urt/rle_addhist.c | |
1213 | index b165175..e09ed94 100644 | |
1214 | --- a/urt/rle_addhist.c | |
1215 | +++ b/urt/rle_addhist.c | |
1216 | @@ -70,13 +70,18 @@ rle_addhist(char * argv[], | |
1217 | return; | |
1218 | ||
1219 | length = 0; | |
1220 | - for (i = 0; argv[i]; ++i) | |
1221 | + for (i = 0; argv[i]; ++i) { | |
1222 | + overflow_add(length, strlen(argv[i])); | |
1223 | + overflow_add(length+1, strlen(argv[i])); | |
1224 | length += strlen(argv[i]) +1; /* length of each arg plus space. */ | |
1225 | + } | |
1226 | ||
1227 | time(&temp); | |
1228 | timedate = ctime(&temp); | |
1229 | length += strlen(timedate); /* length of date and time in ASCII. */ | |
1230 | - | |
1231 | + overflow_add(strlen(padding), 4); | |
1232 | + overflow_add(strlen(histoire), strlen(padding) + 4); | |
1233 | + overflow_add(length, strlen(histoire) + strlen(padding) + 4); | |
1234 | length += strlen(padding) + 3 + strlen(histoire) + 1; | |
1235 | /* length of padding, "on " and length of history name plus "="*/ | |
1236 | if (in_hdr) /* if we are interested in the old comments... */ | |
1237 | @@ -84,8 +89,10 @@ rle_addhist(char * argv[], | |
1238 | else | |
1239 | old = NULL; | |
1240 | ||
1241 | - if (old && *old) | |
1242 | + if (old && *old) { | |
1243 | + overflow_add(length, strlen(old)); | |
1244 | length += strlen(old); /* add length if there. */ | |
1245 | + } | |
1246 | ||
1247 | ++length; /*Cater for the null. */ | |
1248 | ||
1249 | diff --git a/urt/rle_getrow.c b/urt/rle_getrow.c | |
1250 | index bd7d1c8..bd05698 100644 | |
1251 | --- a/urt/rle_getrow.c | |
1252 | +++ b/urt/rle_getrow.c | |
1253 | @@ -168,6 +168,7 @@ rle_get_setup(rle_hdr * const the_hdr) { | |
1254 | char * cp; | |
1255 | ||
1256 | VAXSHORT(comlen, infile); /* get comment length */ | |
1257 | + overflow_add(comlen, 1); | |
1258 | evenlen = (comlen + 1) & ~1; /* make it even */ | |
1259 | if (evenlen) { | |
1260 | MALLOCARRAY(comment_buf, evenlen); | |
1261 | diff --git a/urt/rle_hdr.c b/urt/rle_hdr.c | |
1262 | index 1611324..7c9c010 100644 | |
1263 | --- a/urt/rle_hdr.c | |
1264 | +++ b/urt/rle_hdr.c | |
1265 | @@ -80,7 +80,10 @@ int img_num; | |
1266 | /* Fill in with copies of the strings. */ | |
1267 | if ( the_hdr->cmd != pgmname ) | |
1268 | { | |
1269 | - char *tmp = (char *)malloc( strlen( pgmname ) + 1 ); | |
1270 | + char *tmp; | |
1271 | + | |
1272 | + overflow_add(strlen(pgmname), 1); | |
1273 | + tmp = malloc( strlen(pgmname) + 1 ); | |
1274 | RLE_CHECK_ALLOC( pgmname, tmp, 0 ); | |
1275 | strcpy( tmp, pgmname ); | |
1276 | the_hdr->cmd = tmp; | |
1277 | @@ -88,8 +91,10 @@ int img_num; | |
1278 | ||
1279 | if ( the_hdr->file_name != fname ) | |
1280 | { | |
1281 | - char *tmp = (char *)malloc( strlen( fname ) + 1 ); | |
1282 | - RLE_CHECK_ALLOC( pgmname, tmp, 0 ); | |
1283 | + char *tmp; | |
1284 | + overflow_add(strlen(fname), 1); | |
1285 | + tmp = malloc( strlen( fname ) + 1 ); | |
1286 | + RLE_CHECK_ALLOC( pgmname, tmp, 0 ); | |
1287 | strcpy( tmp, fname ); | |
1288 | the_hdr->file_name = tmp; | |
1289 | } | |
1290 | @@ -153,6 +158,7 @@ rle_hdr *from_hdr, *to_hdr; | |
1291 | if ( to_hdr->bg_color ) | |
1292 | { | |
1293 | int size = to_hdr->ncolors * sizeof(int); | |
1294 | + overflow2(to_hdr->ncolors, sizeof(int)); | |
1295 | to_hdr->bg_color = (int *)malloc( size ); | |
1296 | RLE_CHECK_ALLOC( to_hdr->cmd, to_hdr->bg_color, "background color" ); | |
1297 | memcpy( to_hdr->bg_color, from_hdr->bg_color, size ); | |
1298 | @@ -161,7 +167,7 @@ rle_hdr *from_hdr, *to_hdr; | |
1299 | if ( to_hdr->cmap ) | |
1300 | { | |
1301 | int size = to_hdr->ncmap * (1 << to_hdr->cmaplen) * sizeof(rle_map); | |
1302 | - to_hdr->cmap = (rle_map *)malloc( size ); | |
1303 | + to_hdr->cmap = (rle_map *)malloc3( to_hdr->ncmap, 1<<to_hdr->cmaplen, sizeof(rle_map)); | |
1304 | RLE_CHECK_ALLOC( to_hdr->cmd, to_hdr->cmap, "color map" ); | |
1305 | memcpy( to_hdr->cmap, from_hdr->cmap, size ); | |
1306 | } | |
1307 | @@ -173,12 +179,17 @@ rle_hdr *from_hdr, *to_hdr; | |
1308 | { | |
1309 | int size = 0; | |
1310 | CONST_DECL char **cp; | |
1311 | - for ( cp=to_hdr->comments; *cp; cp++ ) | |
1312 | + for ( cp=to_hdr->comments; *cp; cp++ ) | |
1313 | + { | |
1314 | + overflow_add(size, 1); | |
1315 | size++; /* Count the comments. */ | |
1316 | + } | |
1317 | /* Check if there are really any comments. */ | |
1318 | if ( size ) | |
1319 | { | |
1320 | + overflow_add(size, 1); | |
1321 | size++; /* Copy the NULL pointer, too. */ | |
1322 | + overflow2(size, sizeof(char *)); | |
1323 | size *= sizeof(char *); | |
1324 | to_hdr->comments = (CONST_DECL char **)malloc( size ); | |
1325 | RLE_CHECK_ALLOC( to_hdr->cmd, to_hdr->comments, "comments" ); | |
1326 | diff --git a/urt/rle_open_f.c b/urt/rle_open_f.c | |
1327 | index ae8548b..c2ef37d 100644 | |
1328 | --- a/urt/rle_open_f.c | |
1329 | +++ b/urt/rle_open_f.c | |
1330 | @@ -163,65 +163,7 @@ dealWithSubprocess(const char * const file_name, | |
1331 | FILE ** const fpP, | |
1332 | bool * const noSubprocessP, | |
1333 | const char ** const errorP) { | |
1334 | - | |
1335 | -#ifdef NO_OPEN_PIPES | |
1336 | *noSubprocessP = TRUE; | |
1337 | -#else | |
1338 | - const char *cp; | |
1339 | - | |
1340 | - reapChildren(catchingChildrenP, pids); | |
1341 | - | |
1342 | - /* Real file, not stdin or stdout. If name ends in ".Z", | |
1343 | - * pipe from/to un/compress (depending on r/w mode). | |
1344 | - * | |
1345 | - * If it starts with "|", popen that command. | |
1346 | - */ | |
1347 | - | |
1348 | - cp = file_name + strlen(file_name) - 2; | |
1349 | - /* Pipe case. */ | |
1350 | - if (file_name[0] == '|') { | |
1351 | - pid_t thepid; /* PID from my_popen */ | |
1352 | - | |
1353 | - *noSubprocessP = FALSE; | |
1354 | - | |
1355 | - *fpP = my_popen(file_name + 1, mode, &thepid); | |
1356 | - if (*fpP == NULL) | |
1357 | - *errorP = "%s: can't invoke <<%s>> for %s: "; | |
1358 | - else { | |
1359 | - /* One more child to catch, eventually. */ | |
1360 | - if (*catchingChildrenP < MAX_CHILDREN) | |
1361 | - pids[(*catchingChildrenP)++] = thepid; | |
1362 | - } | |
1363 | - } else if (cp > file_name && *cp == '.' && *(cp + 1) == 'Z' ) { | |
1364 | - /* Compress case. */ | |
1365 | - pid_t thepid; /* PID from my_popen. */ | |
1366 | - const char * command; | |
1367 | - | |
1368 | - *noSubprocessP = FALSE; | |
1369 | - | |
1370 | - if (*mode == 'w') | |
1371 | - pm_asprintf(&command, "compress > %s", file_name); | |
1372 | - else if (*mode == 'a') | |
1373 | - pm_asprintf(&command, "compress >> %s", file_name); | |
1374 | - else | |
1375 | - pm_asprintf(&command, "compress -d < %s", file_name); | |
1376 | - | |
1377 | - *fpP = my_popen(command, mode, &thepid); | |
1378 | - | |
1379 | - if (*fpP == NULL) | |
1380 | - *errorP = "%s: can't invoke 'compress' program, " | |
1381 | - "trying to open %s for %s"; | |
1382 | - else { | |
1383 | - /* One more child to catch, eventually. */ | |
1384 | - if (*catchingChildrenP < MAX_CHILDREN) | |
1385 | - pids[(*catchingChildrenP)++] = thepid; | |
1386 | - } | |
1387 | - pm_strfree(command); | |
1388 | - } else { | |
1389 | - *noSubprocessP = TRUE; | |
1390 | - *errorP = NULL; | |
1391 | - } | |
1392 | -#endif | |
1393 | } | |
1394 | ||
1395 | ||
1396 | diff --git a/urt/rle_putcom.c b/urt/rle_putcom.c | |
1397 | index ab2eb20..f6a6ff7 100644 | |
1398 | --- a/urt/rle_putcom.c | |
1399 | +++ b/urt/rle_putcom.c | |
1400 | @@ -98,12 +98,14 @@ rle_putcom(const char * const value, | |
1401 | const char * v; | |
1402 | const char ** old_comments; | |
1403 | int i; | |
1404 | - for (i = 2, cp = the_hdr->comments; *cp != NULL; ++i, ++cp) | |
1405 | + for (i = 2, cp = the_hdr->comments; *cp != NULL; ++i, ++cp) { | |
1406 | + overflow_add(i, 1); | |
1407 | if (match(value, *cp) != NULL) { | |
1408 | v = *cp; | |
1409 | *cp = value; | |
1410 | return v; | |
1411 | } | |
1412 | + } | |
1413 | /* Not found */ | |
1414 | /* Can't realloc because somebody else might be pointing to this | |
1415 | * comments block. Of course, if this were true, then the | |
1416 | diff --git a/urt/scanargs.c b/urt/scanargs.c | |
1417 | index f3af334..5e114bb 100644 | |
1418 | --- a/urt/scanargs.c | |
1419 | +++ b/urt/scanargs.c | |
1420 | @@ -62,9 +62,8 @@ typedef int *ptr; | |
1421 | /* | |
1422 | * Storage allocation macros | |
1423 | */ | |
1424 | -#define NEW( type, cnt ) (type *) malloc( (cnt) * sizeof( type ) ) | |
1425 | -#define RENEW( type, ptr, cnt ) (type *) realloc( ptr, (cnt) * sizeof( type ) ) | |
1426 | - | |
1427 | +#define NEW( type, cnt ) (type *) malloc2( (cnt) , sizeof( type ) ) | |
1428 | +#define RENEW( type, ptr, cnt ) (type *) realloc2( ptr, (cnt), sizeof( type ) ) | |
1429 | static CONST_DECL char * prformat( CONST_DECL char *, int ); | |
1430 | static int isnum( CONST_DECL char *, int, int ); | |
1431 | static int _do_scanargs( int argc, char **argv, CONST_DECL char *format, | |
1432 |