gimp/gimp-sunras-overflow.patch

64 lines
1.9 KiB
Diff

------------------------------------------------------------------------
r22356 | neo | 2007-04-27 13:50:58 +0200 (Pá, 27 dub 2007) | 8 lines
2007-04-27 Sven Neumann <sven@gimp.org>
Merged from trunk:
* plug-ins/common/sunras.c (set_color_table): guard against a
possible stack overflow.
------------------------------------------------------------------------
Index: sunras.c
===================================================================
--- plug-ins/common/sunras.c (revision 22355)
+++ plug-ins/common/sunras.c (revision 22356)
@@ -102,8 +102,7 @@
gint32 image_ID,
gint32 drawable_ID);
-static void set_color_table (gint32, L_SUNFILEHEADER *, unsigned char *);
-
+static void set_color_table (gint32, L_SUNFILEHEADER *, const guchar *);
static gint32 create_new_image (const gchar *filename,
guint width,
guint height,
@@ -865,19 +864,20 @@
static void
set_color_table (gint32 image_ID,
L_SUNFILEHEADER *sunhdr,
- guchar *suncolmap)
+ const guchar *suncolmap)
{
- int ncols, j;
- guchar ColorMap[256*3];
+ guchar ColorMap[256 * 3];
+ gint ncols, j;
ncols = sunhdr->l_ras_maplength / 3;
- if (ncols <= 0) return;
+ if (ncols <= 0)
+ return;
- for (j = 0; j < ncols; j++)
+ for (j = 0; j < MIN (ncols, 256); j++)
{
- ColorMap[j*3] = suncolmap[j];
- ColorMap[j*3+1] = suncolmap[j+ncols];
- ColorMap[j*3+2] = suncolmap[j+2*ncols];
+ ColorMap[j * 3 + 0] = suncolmap[j];
+ ColorMap[j * 3 + 1] = suncolmap[j + ncols];
+ ColorMap[j * 3 + 2] = suncolmap[j + 2 * ncols];
}
#ifdef DEBUG
@@ -886,6 +886,7 @@
printf ("%3d: 0x%02x 0x%02x 0x%02x\n", j,
ColorMap[j*3], ColorMap[j*3+1], ColorMap[j*3+2]);
#endif
+
gimp_image_set_colormap (image_ID, ColorMap, ncols);
}