From 78037c5c765acf47b4bf04873997e870cba1dc99 Mon Sep 17 00:00:00 2001
From: Kim Woelders <kim@woelders.dk>
Date: Wed, 18 Jun 2008 17:52:38 +0000
Subject: [PATCH] Various loader fixes (Marcus Meissner, bug 494).

SVN revision: 34853
---
 src/modules/loaders/loader_argb.c |  4 +++-
 src/modules/loaders/loader_bmp.c  |  2 +-
 src/modules/loaders/loader_jpeg.c |  4 ++++
 src/modules/loaders/loader_lbm.c  | 10 ++++++----
 src/modules/loaders/loader_xpm.c  |  3 +++
 5 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/src/modules/loaders/loader_argb.c b/src/modules/loaders/loader_argb.c
index 9fa1b63..2300a32 100644
--- a/src/modules/loaders/loader_argb.c
+++ b/src/modules/loaders/loader_argb.c
@@ -10,7 +10,7 @@ char
 load(ImlibImage * im, ImlibProgressFunction progress,
      char progress_granularity, char immediate_load)
 {
-   int                 w, h, alpha;
+   int                 w = 0, h = 0, alpha = 0;
    FILE               *f;
 
    if (im->data)
@@ -23,11 +23,13 @@ load(ImlibImage * im, ImlibProgressFunction progress,
    {
       char                buf[256], buf2[256];
 
+      buf[0] = '\0';
       if (!fgets(buf, 255, f))
         {
            fclose(f);
            return 0;
         }
+      buf2[0] = '\0';
       sscanf(buf, "%s %i %i %i", buf2, &w, &h, &alpha);
       if (strcmp(buf2, "ARGB"))
         {
diff --git a/src/modules/loaders/loader_bmp.c b/src/modules/loaders/loader_bmp.c
index 4175cdb..b208135 100644
--- a/src/modules/loaders/loader_bmp.c
+++ b/src/modules/loaders/loader_bmp.c
@@ -565,7 +565,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
                   unsigned char *buffer_end_minus_1 = buffer_end - 1;
                   x = 0;
                   y = 0;
-                  for (i = 0; i < imgsize && buffer_ptr < buffer_end_minus_1 && g; i++)
+                  for (i = 0; i < imgsize && buffer_ptr < buffer_end_minus_1; i++)
                     {
                        byte1 = buffer_ptr[0];
                        byte2 = buffer_ptr[1];
diff --git a/src/modules/loaders/loader_jpeg.c b/src/modules/loaders/loader_jpeg.c
index 7235a71..958605f 100644
--- a/src/modules/loaders/loader_jpeg.c
+++ b/src/modules/loaders/loader_jpeg.c
@@ -78,6 +78,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
         im->h = h = cinfo.output_height;
 	if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
 	  {
+             im->w = im->h = 0;
              jpeg_destroy_decompress(&cinfo);
              fclose(f);
              return 0;
@@ -96,6 +97,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
 
         if (cinfo.rec_outbuf_height > 16)
           {
+             im->w = im->h = 0;
              jpeg_destroy_decompress(&cinfo);
              fclose(f);
              return 0;
@@ -103,6 +105,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
         data = malloc(w * 16 * 3);
         if (!data)
           {
+             im->w = im->h = 0;
              jpeg_destroy_decompress(&cinfo);
              fclose(f);
              return 0;
@@ -111,6 +114,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
         ptr2 = im->data = malloc(w * h * sizeof(DATA32));
         if (!im->data)
           {
+             im->w = im->h = 0;
              free(data);
              jpeg_destroy_decompress(&cinfo);
              fclose(f);
diff --git a/src/modules/loaders/loader_lbm.c b/src/modules/loaders/loader_lbm.c
index e02fefe..de651f7 100644
--- a/src/modules/loaders/loader_lbm.c
+++ b/src/modules/loaders/loader_lbm.c
@@ -437,6 +437,7 @@ ILBM    ilbm;
         }
     }
     if (!full || !ok) {
+        im->w = im->h = 0;
         freeilbm(&ilbm);
         return ok;
     }
@@ -452,11 +453,11 @@ ILBM    ilbm;
     plane[0] = NULL;
 
     im->data = malloc(im->w * im->h * sizeof(DATA32));
-    if (im->data) {
-        n = ilbm.depth;
+    n = ilbm.depth;
+    plane[0] = malloc(((im->w + 15) / 16) * 2 * n);
+    if (im->data && plane[0]) {
         if (ilbm.mask == 1) n++;
 
-        plane[0] = malloc(((im->w + 15) / 16) * 2 * n);
         for (i = 1; i < n; i++) plane[i] = plane[i - 1] + ((im->w + 15) / 16) * 2;
 
         z = ((im->w + 15) / 16) * 2 * n;
@@ -492,9 +493,10 @@ ILBM    ilbm;
 
   /*----------
    * We either had a successful decode, the user cancelled, or we couldn't get
-   * the memory for im->data.
+   * the memory for im->data or plane[0].
    *----------*/
     if (!ok) {
+        im->w = im->h = 0;
         if (im->data) free(im->data);
         im->data = NULL;
     }
diff --git a/src/modules/loaders/loader_xpm.c b/src/modules/loaders/loader_xpm.c
index 70ff429..978e62e 100644
--- a/src/modules/loaders/loader_xpm.c
+++ b/src/modules/loaders/loader_xpm.c
@@ -153,6 +153,9 @@ load(ImlibImage * im, ImlibProgressFunction progress, char progress_granularity,
    pixels = 0;
    count = 0;
    line = malloc(lsz);
+   if (!line)
+     return NULL;
+
    backslash = 0;
    memset(lookup, 0, sizeof(lookup));
    while (!done)