enlightenment/efl
enlightenment
/
efl
8
7
Fork 14
Code Issues 13 Pull Requests 3 Projects Releases Wiki Activity

check dimensions for safety 

SVN revision: 26954
This commit is contained in:
Carsten Haitzler 2006-11-05 05:07:53 +00:00
parent 1c6ed968fd
commit c3674c8595
9 changed files with 69 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
legacy/evas/src/modules/loaders/edb/evas_image_load_edb.c
View File

@ -57,14 +57,15 @@ evas_image_load_file_head_edb(RGBA_Image *im, const char *file, const char *key)
} }
w = header[1]; w = header[1];
h = header[2]; h = header[2];
alpha = header[3]; if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
compression = header[4];
if ((w > 8192) || (h > 8192))
{ {
free(ret); free(ret);
e_db_close(db); e_db_close(db);
return 0; return 0;
} }
alpha = header[3];
compression = header[4];
if ((compression == 0) && (size < ((w * h * 4) + 32))) if ((compression == 0) && (size < ((w * h * 4) + 32)))
{ {
free(ret); free(ret);
@ -127,14 +128,16 @@ evas_image_load_file_data_edb(RGBA_Image *im, const char *file, const char *key)
} }
w = header[1]; w = header[1];
h = header[2]; h = header[2];
alpha = header[3]; if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
compression = header[4];
if ((w > 8192) || (h > 8192))
{ {
free(ret); free(ret);
e_db_close(db); e_db_close(db);
return 0; return 0;
} }
alpha = header[3];
compression = header[4];
if ((compression == 0) && (size < ((w * h * 4) + 32))) if ((compression == 0) && (size < ((w * h * 4) + 32)))
{ {
free(ret); free(ret);

4
legacy/evas/src/modules/loaders/eet/evas_image_load_eet.c
View File

@ -32,7 +32,7 @@ evas_image_load_file_head_eet(RGBA_Image *im, const char *file, const char *key)
eet_close(ef); eet_close(ef);
return 0; return 0;
} }
if ((w > 8192) || (h > 8192)) if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
{ {
eet_close(ef); eet_close(ef);
return 0; return 0;
@ -71,7 +71,7 @@ evas_image_load_file_data_eet(RGBA_Image *im, const char *file, const char *key)
eet_close(ef); eet_close(ef);
return 0; return 0;
} }
if ((w > 8192) || (h > 8192)) if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
{ {
free(body); free(body);
eet_close(ef); eet_close(ef);

9
legacy/evas/src/modules/loaders/gif/evas_image_load_gif.c
View File

@ -67,13 +67,18 @@ evas_image_load_file_head_gif(RGBA_Image *im, const char *file, const char *key)
} }
w = gif->Image.Width; w = gif->Image.Width;
h = gif->Image.Height; h = gif->Image.Height;
done = 1; if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
{
DGifCloseFile(gif);
return 0;
}
done = 1;
} }
else if (rec == EXTENSION_RECORD_TYPE) else if (rec == EXTENSION_RECORD_TYPE)
{ {
int ext_code; int ext_code;
GifByteType *ext; GifByteType *ext;
ext = NULL; ext = NULL;
DGifGetExtension(gif, &ext_code, &ext); DGifGetExtension(gif, &ext_code, &ext);
while (ext) while (ext)

5
legacy/evas/src/modules/loaders/jpeg/evas_image_load_jpeg.c
View File

@ -101,6 +101,11 @@ evas_image_load_file_head_jpeg_internal(RGBA_Image *im, FILE *f)
} }
w = cinfo.output_width; w = cinfo.output_width;
h = cinfo.output_height; h = cinfo.output_height;
if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
{
jpeg_destroy_decompress(&cinfo);
return 0;
}
if (im->load_opts.scale_down_by > 1) if (im->load_opts.scale_down_by > 1)
{ {
w /= im->load_opts.scale_down_by; w /= im->load_opts.scale_down_by;

14
legacy/evas/src/modules/loaders/png/evas_image_load_png.c
View File

@ -71,6 +71,12 @@ evas_image_load_file_head_png(RGBA_Image *im, const char *file, const char *key)
png_get_IHDR(png_ptr, info_ptr, (png_uint_32 *) (&w32), png_get_IHDR(png_ptr, info_ptr, (png_uint_32 *) (&w32),
(png_uint_32 *) (&h32), &bit_depth, &color_type, (png_uint_32 *) (&h32), &bit_depth, &color_type,
&interlace_type, NULL, NULL); &interlace_type, NULL, NULL);
if ((w32 < 1) || (h32 < 1) || (w32 > 8192) || (h32 > 8192))
{
png_destroy_read_struct(&png_ptr, &info_ptr, (png_infopp) NULL);
fclose(f);
return 0;
}
if (!im->image) if (!im->image)
im->image = evas_common_image_surface_new(im); im->image = evas_common_image_surface_new(im);
if (!im->image) if (!im->image)
@ -152,8 +158,12 @@ evas_image_load_file_data_png(RGBA_Image *im, const char *file, const char *key)
png_get_IHDR(png_ptr, info_ptr, (png_uint_32 *) (&w32), png_get_IHDR(png_ptr, info_ptr, (png_uint_32 *) (&w32),
(png_uint_32 *) (&h32), &bit_depth, &color_type, (png_uint_32 *) (&h32), &bit_depth, &color_type,
&interlace_type, NULL, NULL); &interlace_type, NULL, NULL);
im->image->w = (int) w32; if ((w32 != im->image->w) || (h32 != im->image->h))
im->image->h = (int) h32; {
png_destroy_read_struct(&png_ptr, &info_ptr, (png_infopp) NULL);
fclose(f);
return 0;
}
if (color_type == PNG_COLOR_TYPE_PALETTE) png_set_expand(png_ptr); if (color_type == PNG_COLOR_TYPE_PALETTE) png_set_expand(png_ptr);
if (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA) hasa = 1; if (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA) hasa = 1;
if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)

12
legacy/evas/src/modules/loaders/svg/evas_image_load_svg.c
View File

@ -73,6 +73,12 @@ evas_image_load_file_head_svg(RGBA_Image *im, const char *file, const char *key)
rsvg_handle_get_dimensions(rsvg, &dim); rsvg_handle_get_dimensions(rsvg, &dim);
w = dim.width; w = dim.width;
h = dim.height; h = dim.height;
if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
{
rsvg_handle_free(rsvg);
chdir(pcwd);
return 0;
}
if (im->load_opts.scale_down_by > 1) if (im->load_opts.scale_down_by > 1)
{ {
w /= im->load_opts.scale_down_by; w /= im->load_opts.scale_down_by;
@ -143,6 +149,12 @@ evas_image_load_file_data_svg(RGBA_Image *im, const char *file, const char *key)
rsvg_handle_get_dimensions(rsvg, &dim); rsvg_handle_get_dimensions(rsvg, &dim);
w = dim.width; w = dim.width;
h = dim.height; h = dim.height;
if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
{
rsvg_handle_free(rsvg);
chdir(pcwd);
return 0;
}
if (im->load_opts.scale_down_by > 1) if (im->load_opts.scale_down_by > 1)
{ {
w /= im->load_opts.scale_down_by; w /= im->load_opts.scale_down_by;

18
legacy/evas/src/modules/loaders/tiff/evas_image_load_tiff.c
View File

@ -66,11 +66,11 @@ static void
raster(TIFFRGBAImage_Extra * img, uint32 * rast, raster(TIFFRGBAImage_Extra * img, uint32 * rast,
uint32 x, uint32 y, uint32 w, uint32 h) uint32 x, uint32 y, uint32 w, uint32 h)
{ {
uint32 image_width, image_height; int image_width, image_height;
uint32 *pixel, pixel_value; uint32 *pixel, pixel_value;
int i, j, dy, rast_offset; int i, j, dy, rast_offset;
DATA32 *buffer_pixel, *buffer = img->image->image->data; DATA32 *buffer_pixel, *buffer = img->image->image->data;
int alpha_premult = (EXTRASAMPLE_UNASSALPHA==img->rgba.alpha); int alpha_premult;
image_width = img->image->image->w; image_width = img->image->image->w;
image_height = img->image->image->h; image_height = img->image->image->h;
@ -82,6 +82,8 @@ raster(TIFFRGBAImage_Extra * img, uint32 * rast,
/* I don't understand why, but that seems to be what's going on. */ /* I don't understand why, but that seems to be what's going on. */
/* libtiff needs better docs! */ /* libtiff needs better docs! */
if (img->rgba.alpha == EXTRASAMPLE_UNASSALPHA)
alpha_premult = 1;
for (i = y, rast_offset = 0; i > dy; i--, rast_offset--) for (i = y, rast_offset = 0; i > dy; i--, rast_offset--)
{ {
pixel = rast + (rast_offset * image_width); pixel = rast + (rast_offset * image_width);
@ -166,6 +168,12 @@ evas_image_load_file_head_tiff(RGBA_Image *im, const char *file, const char *key
} }
if (tiff_image.alpha != EXTRASAMPLE_UNSPECIFIED) if (tiff_image.alpha != EXTRASAMPLE_UNSPECIFIED)
im->flags |= RGBA_IMAGE_HAS_ALPHA; im->flags |= RGBA_IMAGE_HAS_ALPHA;
if ((tiff_image.width < 1) || (tiff_image.height < 1) ||
(tiff_image.width > 8192) || (tiff_image.height > 8192))
{
TIFFClose(tif);
return 0;
}
im->image->w = tiff_image.width; im->image->w = tiff_image.width;
im->image->h = tiff_image.height; im->image->h = tiff_image.height;
@ -235,6 +243,12 @@ evas_image_load_file_data_tiff(RGBA_Image *im, const char *file, const char *key
} }
if (rgba_image.rgba.alpha != EXTRASAMPLE_UNSPECIFIED) if (rgba_image.rgba.alpha != EXTRASAMPLE_UNSPECIFIED)
im->flags |= RGBA_IMAGE_HAS_ALPHA; im->flags |= RGBA_IMAGE_HAS_ALPHA;
if ((rgba_image.rgba.width != im->image->w) ||
(rgba_image.rgba.height != im->image->h))
{
TIFFClose(tif);
return 0;
}
im->image->w = rgba_image.rgba.width; im->image->w = rgba_image.rgba.width;
im->image->h = rgba_image.rgba.height; im->image->h = rgba_image.rgba.height;
rgba_image.num_pixels = num_pixels = im->image->w * im->image->h; rgba_image.num_pixels = num_pixels = im->image->w * im->image->h;

8
legacy/evas/src/modules/loaders/xpm/evas_image_load_xpm.c
View File

@ -213,19 +213,19 @@ evas_image_load_file_xpm(RGBA_Image *im, const char *file, const char *key, int
xpm_parse_done(); xpm_parse_done();
return 0; return 0;
} }
if ((w > 32767) || (w < 1)) if ((w > 8192) || (w < 1))
{ {
fprintf(stderr, fprintf(stderr,
"XPM ERROR: Image width > 32767 or < 1 pixels for file\n"); "XPM ERROR: Image width > 8192 or < 1 pixels for file\n");
free(line); free(line);
fclose(f); fclose(f);
xpm_parse_done(); xpm_parse_done();
return 0; return 0;
} }
if ((h > 32767) || (h < 1)) if ((h > 8192) || (h < 1))
{ {
fprintf(stderr, fprintf(stderr,
"XPM ERROR: Image height > 32767 or < 1 pixels for file\n"); "XPM ERROR: Image height > 8192 or < 1 pixels for file\n");
free(line); free(line);
fclose(f); fclose(f);
xpm_parse_done(); xpm_parse_done();

3
legacy/evas/src/modules/savers/tiff/evas_image_save_tiff.c
View File

@ -49,8 +49,9 @@ save_image_tiff(RGBA_Image *im, const char *file, int compress, int interlace)
if (has_alpha) if (has_alpha)
{ {
uint16 extras[] = { EXTRASAMPLE_ASSOCALPHA };
TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 4); TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 4);
TIFFSetField(tif, TIFFTAG_EXTRASAMPLES, EXTRASAMPLE_ASSOCALPHA); TIFFSetField(tif, TIFFTAG_EXTRASAMPLES, 1, extras);
} }
else else
{ {