old
/
legacy-imlib2
3
0
Fork 4
Code Issues 3 Pull Requests Projects Releases Wiki Activity

Relax 8192 pixel dimension limit (ticket 361). 

This time hopefully without buffer overflow issues.



SVN revision: 41516
This commit is contained in:
Kim Woelders 2009-07-27 21:05:12 +00:00
parent 02d6b0d451
commit 5619f9e257
13 changed files with 20 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/lib/Imlib2.h
View File

@ -34,9 +34,6 @@
# define DATA8 unsigned char
# endif
/* Maximum image dimension */
#define IMLIB_MAX_DIM (2 << 20)
/* opaque data types */
typedef void *Imlib_Context;
typedef void *Imlib_Image;

4
src/lib/image.h
View File

@ -188,4 +188,8 @@ __hidden void __imlib_SaveImage(ImlibImage *im, const char *file,
# define SET_FLAG(flags, f) ((flags) |= (f))
# define UNSET_FLAG(flags, f) ((flags) &= (~f))
# define IMAGE_DIMENSIONS_OK(w, h) \
( ((w) > 0) && ((h) > 0) && \
((unsigned long long)(w) * (unsigned long long)(w) <= (1ULL << 31) - 1) )
#endif

5
src/lib/rend.c
View File

@ -15,8 +15,9 @@
#include "rend.h"
#include "rotate.h"
/* Maximum pixmap dimension (65535) */
#define X_MAX_DIM ((2 << 16) - 1)
/* The maximum pixmap dimension is 65535. */
/* However, for now, use 46340 (46340^2 < 2^31) to avoid buffer overflow issues. */
#define X_MAX_DIM 46340
/* size of the lines per segment we scale / render at a time */
#define LINESIZE 16

2
src/modules/loaders/loader_argb.c
View File

@ -36,7 +36,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
fclose(f);
return 0;
}
if ((w < 1) || (h < 1) || (w > IMLIB_MAX_DIM) || (h > IMLIB_MAX_DIM))
if (!IMAGE_DIMENSIONS_OK(w, h))
{
fclose(f);
return 0;

2
src/modules/loaders/loader_bmp.c
View File

@ -193,7 +193,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
return 0;
}
if ((w < 1) || (h < 1) || (w > IMLIB_MAX_DIM) || (h > IMLIB_MAX_DIM))
if (!IMAGE_DIMENSIONS_OK(w, h))
{
fclose(f);
return 0;

3
src/modules/loaders/loader_gif.c
View File

@ -58,8 +58,7 @@ load(ImlibImage * im, ImlibProgressFunction progress, char progress_granularity,
}
w = gif->Image.Width;
h = gif->Image.Height;
if ((w < 1) || (h < 1) ||
(w > IMLIB_MAX_DIM) || (h > IMLIB_MAX_DIM))
if (!IMAGE_DIMENSIONS_OK(w, h))
{
DGifCloseFile(gif);
return 0;

4
src/modules/loaders/loader_jpeg.c
View File

@ -76,7 +76,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
{
im->w = w = cinfo.output_width;
im->h = h = cinfo.output_height;
if ((w < 1) || (h < 1) || (w > IMLIB_MAX_DIM) || (h > IMLIB_MAX_DIM))
if (!IMAGE_DIMENSIONS_OK(w, h))
{
im->w = im->h = 0;
jpeg_destroy_decompress(&cinfo);
@ -96,7 +96,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
im->h = h = cinfo.output_height;
if ((cinfo.rec_outbuf_height > 16) || (cinfo.output_components <= 0) ||
(w < 1) || (h < 1) || (w > IMLIB_MAX_DIM) || (h > IMLIB_MAX_DIM))
!IMAGE_DIMENSIONS_OK(w, h))
{
im->w = im->h = 0;
jpeg_destroy_decompress(&cinfo);

3
src/modules/loaders/loader_lbm.c
View File

@ -402,8 +402,7 @@ ILBM ilbm;
im->w = L2RWORD(ilbm.bmhd.data);
im->h = L2RWORD(ilbm.bmhd.data + 2);
if ((im->w < 1) || (im->h < 1) ||
(im->w > IMLIB_MAX_DIM) || (im->h > IMLIB_MAX_DIM))
if (!IMAGE_DIMENSIONS_OK(im->w, im->h))
{
ok = 0;
}

2
src/modules/loaders/loader_png.c
View File

@ -71,7 +71,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
&interlace_type, NULL, NULL);
im->w = (int)w32;
im->h = (int)h32;
if ((w32 < 1) || (h32 < 1) || (w32 > IMLIB_MAX_DIM) || (h32 > IMLIB_MAX_DIM))
if (!IMAGE_DIMENSIONS_OK(w32, h32))
{
png_read_end(png_ptr, info_ptr);
png_destroy_read_struct(&png_ptr, &info_ptr, (png_infopp) NULL);

2
src/modules/loaders/loader_pnm.c
View File

@ -103,7 +103,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
im->w = w;
im->h = h;
if ((w < 1) || (h < 1) || (w > IMLIB_MAX_DIM) || (h > IMLIB_MAX_DIM))
if (!IMAGE_DIMENSIONS_OK(w, h))
{
fclose(f);
return 0;

3
src/modules/loaders/loader_tga.c
View File

@ -283,8 +283,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
im->w = (header->widthHi << 8) | header->widthLo;
im->h = (header->heightHi << 8) | header->heightLo;
if ((im->w < 1) || (im->h < 1) ||
(im->w > IMLIB_MAX_DIM) || (im->h > IMLIB_MAX_DIM))
if (!IMAGE_DIMENSIONS_OK(im->w, im->h))
{
munmap(seg, ss.st_size);
close(fd);

3
src/modules/loaders/loader_tiff.c
View File

@ -184,8 +184,7 @@ load(ImlibImage * im, ImlibProgressFunction progress,
rgba_image.image = im;
im->w = width = rgba_image.rgba.width;
im->h = height = rgba_image.rgba.height;
if ((width < 1) || (height < 1) ||
(width > IMLIB_MAX_DIM) || (height > IMLIB_MAX_DIM))
if (!IMAGE_DIMENSIONS_OK(width, height))
{
TIFFRGBAImageEnd((TIFFRGBAImage *) & rgba_image);
TIFFClose(tif);

16
src/modules/loaders/loader_xpm.c
View File

@ -204,21 +204,11 @@ load(ImlibImage * im, ImlibProgressFunction progress, char progress_granularity,
xpm_parse_done();
return 0;
}
if ((w > IMLIB_MAX_DIM) || (w < 1))
if (!IMAGE_DIMENSIONS_OK(w, h))
{
fprintf(stderr,
"IMLIB ERROR: Image width > %d or < 1 pixels for file\n",
IMLIB_MAX_DIM);
free(line);
fclose(f);
xpm_parse_done();
return 0;
}
if ((h > IMLIB_MAX_DIM) || (h < 1))
{
fprintf(stderr,
"IMLIB ERROR: Image height > %d or < 1 pixels for file\n",
IMLIB_MAX_DIM);
"IMLIB ERROR: Invalid image dimension: %dx%d\n",
w, h);
free(line);
fclose(f);
xpm_parse_done();