graphics/imlib2/files/patch-security-1


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

===================================================================
RCS file: /cvsroot/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c	2004/12/14 03:50:46	1.2
+++ loaders/loader_xpm.c	2005/01/04 03:34:03	1.3
@@ -192,37 +192,37 @@
                     {
                        /* Header */
                        sscanf(line, "%i %i %i %i", &w, &h, &ncolors, &cpp);
-                       if (ncolors > 32766)
+                       if ((ncolors > 32766) || (ncolors < 1))
                          {
                             fprintf(stderr,
-                                    "IMLIB ERROR: XPM files with colors > 32766 not supported\n");
+                                    "IMLIB ERROR: XPM files with colors > 32766 or < 1 not supported\n");
                             free(line);
                             fclose(f);
                             xpm_parse_done();
                             return 0;
                          }
-                       if (cpp > 5)
+                       if ((cpp > 5) || (cpp < 1))
                          {
                             fprintf(stderr,
-                                    "IMLIB ERROR: XPM files with characters per pixel > 5 not supported\n");
+                                    "IMLIB ERROR: XPM files with characters per pixel > 5 or < 1not supported\n");
                             free(line);
                             fclose(f);
                             xpm_parse_done();
                             return 0;
                          }
-                       if (w > 32767)
+                       if ((w > 32767) || (w < 1))
                          {
                             fprintf(stderr,
-                                    "IMLIB ERROR: Image width > 32767 pixels for file\n");
+                                    "IMLIB ERROR: Image width > 32767 or < 1 pixels for file\n");
                             free(line);
                             fclose(f);
                             xpm_parse_done();
                             return 0;
                          }
-                       if (h > 32767)
+                       if ((h > 32767) || (h < 1))
                          {
                             fprintf(stderr,
-                                    "IMLIB ERROR: Image height > 32767 pixels for file\n");
+                                    "IMLIB ERROR: Image height > 32767 or < 1 pixels for file\n");
                             free(line);
                             fclose(f);
                             xpm_parse_done();
@@ -284,9 +284,14 @@
                                            if (k >= len)
                                              {
                                                 if (col[0])
-                                                   strcat(col, " ");
+						  {
+						     if (strlen(col) < ( sizeof(col) - 2))
+						       strcat(col, " ");
+						     else
+						       done = 1;
+						  }
                                                 if (strlen(col) + strlen(s) <
-                                                    sizeof(col))
+                                                    (sizeof(col) - 1))
                                                    strcat(col, s);
                                              }
                                            if (col[0])
@@ -322,9 +327,16 @@
                                         }
                                       else
                                         {
-                                           if (col[0])
-                                              strcat(col, " ");
-                                           strcat(col, s);
+					   if (col[0])
+					     {
+						if (strlen(col) < ( sizeof(col) - 2))
+						  strcat(col, " ");
+						else
+						  done = 1;
+					     }
+					   if (strlen(col) + strlen(s) <
+					       (sizeof(col) - 1))
+					     strcat(col, s);
                                         }
                                    }
                               }