callisto-debian/gtk3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reject 0-sized buffers as corrupt header data. Fixes bug #171707.

Browse Source 
Sun Mar 27 19:59:52 2005  Manish Singh  <yosh@gimp.org>

        * io-bmp.c (grow_buffer): reject 0-sized buffers as corrupt header
        data. Fixes bug #171707.
This commit is contained in:
Manish Singh
2005-03-28 04:01:25 +00:00
committed by Manish Singh
parent 4d48403bc6
commit fcde8479cc
2 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
gdk-pixbuf/ChangeLog
View File

@ -1,3 +1,8 @@
Sun Mar 27 19:59:52 2005 Manish Singh <yosh@gimp.org>
* io-bmp.c (grow_buffer): reject 0-sized buffers as corrupt header
data. Fixes bug #171707.
2005-03-25 Matthias Clasen <mclasen@redhat.com> 2005-03-25 Matthias Clasen <mclasen@redhat.com>
* gdk-pixbuf-data.c (gdk_pixbuf_new_from_data): Use canonical * gdk-pixbuf-data.c (gdk_pixbuf_new_from_data): Use canonical

15
gdk-pixbuf/io-bmp.c
View File

@ -219,7 +219,19 @@ lsb_16 (guchar *src)
static gboolean grow_buffer (struct bmp_progressive_state *State, static gboolean grow_buffer (struct bmp_progressive_state *State,
GError **error) GError **error)
{ {
guchar *tmp = g_try_realloc (State->buff, State->BufferSize); guchar *tmp;
if (State->BufferSize == 0) {
g_set_error (error,
GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
_("BMP image has bogus header data"));
State->read_state = READ_STATE_ERROR;
return FALSE;
}
tmp = g_try_realloc (State->buff, State->BufferSize);
if (!tmp) { if (!tmp) {
g_set_error (error, g_set_error (error,
GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR,
@ -228,6 +240,7 @@ static gboolean grow_buffer (struct bmp_progressive_state *State,
State->read_state = READ_STATE_ERROR; State->read_state = READ_STATE_ERROR;
return FALSE; return FALSE;
} }
State->buff = tmp; State->buff = tmp;
return TRUE; return TRUE;
} }