old
/
legacy-imlib2
3
0
Fork 4
Code Issues 3 Pull Requests Projects Releases Wiki Activity

Loader fixes based on patch from Hans de Goede/Fedora. 

Fix off by one error in check (tga loader).


SVN revision: 34855
This commit is contained in:
Kim Woelders 2008-06-18 20:45:41 +00:00
parent 00d4d6489b
commit 18a8e18546
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/modules/loaders/loader_jpeg.c
View File

@ -95,7 +95,8 @@ load(ImlibImage * im, ImlibProgressFunction progress,
im->w = w = cinfo.output_width;
im->h = h = cinfo.output_height;
if (cinfo.rec_outbuf_height > 16)
if ((cinfo.rec_outbuf_height > 16) ||
(w < 1) || (h < 1) || (w > 8192) || (h > 8192))
{
im->w = im->h = 0;
jpeg_destroy_decompress(&cinfo);

6
src/modules/loaders/loader_tga.c
View File

@ -350,7 +350,9 @@ load(ImlibImage * im, ImlibProgressFunction progress,
else
dataptr = im->data + (y * im->w);
for (x = 0; x < im->w; x++) /* for each pixel in the row */
for (x = 0;
(x < im->w) && (bufptr + bpp / 8 <= bufend);
x++) /* for each pixel in the row */
{
switch (bpp)
{
@ -406,7 +408,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
/* loop until we've got all the pixels or run out of input */
while ((dataptr < final_pixel) &&
((bufptr + 1 + (bpp / 8)) < bufend))
((bufptr + 1 + (bpp / 8)) <= bufend))
{
int count;