summaryrefslogtreecommitdiffstats
path: root/abs/extra-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch
diff options
context:
space:
mode:
Diffstat (limited to 'abs/extra-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch')
-rw-r--r--abs/extra-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch134
1 files changed, 134 insertions, 0 deletions
diff --git a/abs/extra-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch b/abs/extra-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch
new file mode 100644
index 0000000..0686538
--- /dev/null
+++ b/abs/extra-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch
@@ -0,0 +1,134 @@
+diff -NurdB gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-ico.c
+--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c 2002-09-27 17:19:15.000000000 -0500
++++ gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-ico.c 2005-10-27 11:28:23.000000000 -0500
+@@ -330,6 +330,9 @@
+
+ State->HeaderSize+=I;
+
++ if (State->HeaderSize < 0)
++ return FALSE;
++
+ if (State->HeaderSize>State->BytesInHeaderBuf) {
+ guchar *tmp=realloc(State->HeaderBuf,State->HeaderSize);
+ if (!tmp)
+diff -NurdB gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-xpm.c
+--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c 2001-03-01 15:16:28.000000000 -0500
++++ gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-xpm.c 2005-10-27 11:29:14.000000000 -0500
+@@ -243,8 +243,8 @@
+ break;
+ else {
+ if (numnames > 0) {
+- space -= 1;
+- strcat (color, " ");
++ strncat (color, " ", space);
++ space -= MIN (space, 1);
+ }
+
+ strncat (color, temp, space);
+@@ -281,7 +281,8 @@
+ /* Fall through to the xpm_read_string. */
+
+ case op_body:
+- xpm_read_string (h->infile, &h->buffer, &h->buffer_size);
++ if(!xpm_read_string (h->infile, &h->buffer, &h->buffer_size))
++ return NULL;
+ return h->buffer;
+
+ default:
+@@ -317,13 +318,6 @@
+ return NULL;
+ }
+
+-/* Destroy notification function for the pixbuf */
+-static void
+-free_buffer (guchar *pixels, gpointer data)
+-{
+- free (pixels);
+-}
+-
+ static gboolean
+ xpm_color_parse (const char *spec, XColor *color)
+ {
+@@ -342,7 +336,8 @@
+ gchar pixel_str[32];
+ GHashTable *color_hash;
+ _XPMColor *colors, *color, *fallbackcolor;
+- guchar *pixels, *pixtmp;
++ guchar *pixtmp;
++ GdkPixbuf* pixbuf;
+
+ fallbackcolor = NULL;
+
+@@ -352,16 +347,33 @@
+ return NULL;
+ }
+ sscanf (buffer, "%d %d %d %d", &w, &h, &n_col, &cpp);
+- if (cpp >= 32) {
+- g_warning ("XPM has more than 31 chars per pixel.");
++ if (cpp <= 0 || cpp >= 32) {
++ g_warning ("XPM has invalid number of chars per pixel.");
+ return NULL;
+ }
++ if (n_col <= 0 ||
++ n_col >= G_MAXINT / (cpp + 1) ||
++ n_col >= G_MAXINT / sizeof (_XPMColor)) {
++ g_warning ("XPM file has invalid number of colors");
++ return NULL;
++ }
+
+ /* The hash is used for fast lookups of color from chars */
+ color_hash = g_hash_table_new (g_str_hash, g_str_equal);
+
+- name_buf = g_new (gchar, n_col * (cpp + 1));
+- colors = g_new (_XPMColor, n_col);
++ name_buf = g_new (gchar, n_col * (cpp + 1));
++ if (!name_buf) {
++ g_warning ("Cannot allocate memory for loading XPM image");
++ g_hash_table_destroy (color_hash);
++ return NULL;
++ }
++ colors = g_new (_XPMColor, n_col);
++ if (!colors) {
++ g_warning ("Cannot allocate memory for loading XPM image");
++ g_hash_table_destroy (color_hash);
++ g_free (name_buf);
++ return NULL;
++ }
+
+ for (cnt = 0; cnt < n_col; cnt++) {
+ gchar *color_name;
+@@ -397,12 +409,8 @@
+ fallbackcolor = color;
+ }
+
+- if (is_trans)
+- pixels = malloc (w * h * 4);
+- else
+- pixels = malloc (w * h * 3);
+-
+- if (!pixels) {
++ pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, is_trans, 8, w, h);
++ if (!pixbuf) {
+ g_hash_table_destroy (color_hash);
+ g_free (colors);
+ g_free (name_buf);
+@@ -410,7 +418,7 @@
+ }
+
+ wbytes = w * cpp;
+- pixtmp = pixels;
++ pixtmp = pixbuf->pixels;
+
+ for (ycnt = 0; ycnt < h; ycnt++) {
+ buffer = (*get_buf) (op_body, handle);
+@@ -443,9 +451,7 @@
+ g_free (colors);
+ g_free (name_buf);
+
+- return gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, is_trans, 8,
+- w, h, is_trans ? (w * 4) : (w * 3),
+- free_buffer, NULL);
++ return pixbuf;
+ }
+
+ /* Shared library entry point for file loading */