forked from old/legacy-imlib2
Loader fixes based on patch from Hans de Goede/Fedora.
Fix off by one error in check (tga loader). SVN revision: 34855
This commit is contained in:
parent
00d4d6489b
commit
18a8e18546
|
@ -95,7 +95,8 @@ load(ImlibImage * im, ImlibProgressFunction progress,
|
|||
im->w = w = cinfo.output_width;
|
||||
im->h = h = cinfo.output_height;
|
||||
|
||||
if (cinfo.rec_outbuf_height > 16)
|
||||
if ((cinfo.rec_outbuf_height > 16) ||
|
||||
(w < 1) || (h < 1) || (w > 8192) || (h > 8192))
|
||||
{
|
||||
im->w = im->h = 0;
|
||||
jpeg_destroy_decompress(&cinfo);
|
||||
|
|
|
@ -350,7 +350,9 @@ load(ImlibImage * im, ImlibProgressFunction progress,
|
|||
else
|
||||
dataptr = im->data + (y * im->w);
|
||||
|
||||
for (x = 0; x < im->w; x++) /* for each pixel in the row */
|
||||
for (x = 0;
|
||||
(x < im->w) && (bufptr + bpp / 8 <= bufend);
|
||||
x++) /* for each pixel in the row */
|
||||
{
|
||||
switch (bpp)
|
||||
{
|
||||
|
@ -406,7 +408,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
|
|||
|
||||
/* loop until we've got all the pixels or run out of input */
|
||||
while ((dataptr < final_pixel) &&
|
||||
((bufptr + 1 + (bpp / 8)) < bufend))
|
||||
((bufptr + 1 + (bpp / 8)) <= bufend))
|
||||
{
|
||||
int count;
|
||||
|
||||
|
|
Loading…
Reference in New Issue