62 lines
1.3 KiB
Diff
62 lines
1.3 KiB
Diff
--- cups-1.3.7/filter/image-png.c.orig 2007-07-11 23:46:42.000000000 +0200
|
|
+++ cups-1.3.7/filter/image-png.c 2008-04-16 12:04:14.000000000 +0200
|
|
@@ -170,16 +170,56 @@
|
|
* Interlaced images must be loaded all at once...
|
|
*/
|
|
|
|
+ size_t bufsize; /* Size of buffer */
|
|
+
|
|
+
|
|
if (color_type == PNG_COLOR_TYPE_GRAY ||
|
|
color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
|
|
- in = malloc(img->xsize * img->ysize);
|
|
+ {
|
|
+ bufsize = img->xsize * img->ysize;
|
|
+
|
|
+ if ((bufsize / img->ysize) != img->xsize)
|
|
+ {
|
|
+ fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n",
|
|
+ (unsigned)width, (unsigned)height);
|
|
+ fclose(fp);
|
|
+ return (1);
|
|
+ }
|
|
+ }
|
|
else
|
|
- in = malloc(img->xsize * img->ysize * 3);
|
|
+ {
|
|
+ bufsize = img->xsize * img->ysize * 3;
|
|
+
|
|
+ if ((bufsize / (img->ysize * 3)) != img->xsize)
|
|
+ {
|
|
+ fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n",
|
|
+ (unsigned)width, (unsigned)height);
|
|
+ fclose(fp);
|
|
+ return (1);
|
|
+ }
|
|
+ }
|
|
+
|
|
+ in = malloc(bufsize);
|
|
}
|
|
|
|
bpp = cupsImageGetDepth(img);
|
|
out = malloc(img->xsize * bpp);
|
|
|
|
+ if (!in || !out)
|
|
+ {
|
|
+ fputs("DEBUG: Unable to allocate memory for PNG image!\n", stderr);
|
|
+
|
|
+ if (in)
|
|
+ free(in);
|
|
+
|
|
+ if (out)
|
|
+ free(out);
|
|
+
|
|
+ fclose(fp);
|
|
+
|
|
+ return (1);
|
|
+ }
|
|
+
|
|
/*
|
|
* Read the image, interlacing as needed...
|
|
*/
|