commit 28c2873ab1fd7f89a0b431673de14016e2038636d025253321e6a2136965b5f3 Author: OBS User unknown Date: Mon Jan 15 23:26:51 2007 +0000 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/netpbm?expand=0&rev=1 diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..9b03811 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,23 @@ +## Default LFS +*.7z filter=lfs diff=lfs merge=lfs -text +*.bsp filter=lfs diff=lfs merge=lfs -text +*.bz2 filter=lfs diff=lfs merge=lfs -text +*.gem filter=lfs diff=lfs merge=lfs -text +*.gz filter=lfs diff=lfs merge=lfs -text +*.jar filter=lfs diff=lfs merge=lfs -text +*.lz filter=lfs diff=lfs merge=lfs -text +*.lzma filter=lfs diff=lfs merge=lfs -text +*.obscpio filter=lfs diff=lfs merge=lfs -text +*.oxt filter=lfs diff=lfs merge=lfs -text +*.pdf filter=lfs diff=lfs merge=lfs -text +*.png filter=lfs diff=lfs merge=lfs -text +*.rpm filter=lfs diff=lfs merge=lfs -text +*.tbz filter=lfs diff=lfs merge=lfs -text +*.tbz2 filter=lfs diff=lfs merge=lfs -text +*.tgz filter=lfs diff=lfs merge=lfs -text +*.ttf filter=lfs diff=lfs merge=lfs -text +*.txz filter=lfs diff=lfs merge=lfs -text +*.whl filter=lfs diff=lfs merge=lfs -text +*.xz filter=lfs diff=lfs merge=lfs -text +*.zip filter=lfs diff=lfs merge=lfs -text +*.zst filter=lfs diff=lfs merge=lfs -text diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..57affb6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.osc diff --git a/netpbm-10.26.22-aliasing.patch b/netpbm-10.26.22-aliasing.patch new file mode 100644 index 0000000..bc302f3 --- /dev/null +++ b/netpbm-10.26.22-aliasing.patch @@ -0,0 +1,35 @@ +--- lib/util/mallocvar.h ++++ lib/util/mallocvar.h +@@ -12,9 +12,8 @@ + #include + #include + +-static __inline__ void +-mallocProduct(void ** const resultP, +- unsigned int const factor1, ++static __inline__ void * ++mallocProduct(unsigned int const factor1, + unsigned int const factor2) { + /*---------------------------------------------------------------------------- + malloc a space whose size in bytes is the product of 'factor1' and +@@ -30,9 +29,9 @@ + nobody really needs to allocate more than 4GB of memory. + -----------------------------------------------------------------------------*/ + if (UINT_MAX / factor2 < factor1) +- *resultP = NULL; \ ++ return NULL; + else +- *resultP = malloc(factor1 * factor2); ++ return malloc(factor1 * factor2); + } + + +@@ -51,7 +50,7 @@ + + + #define MALLOCARRAY(arrayName, nElements) \ +- mallocProduct((void **)(void *)&arrayName, nElements, sizeof(arrayName[0])) ++ (arrayName = mallocProduct(nElements, sizeof(arrayName[0]))) + + #define REALLOCARRAY(arrayName, nElements) \ + reallocProduct((void **)&arrayName, nElements, sizeof(arrayName[0])) diff --git a/netpbm-10.26.22-colornames-init.diff b/netpbm-10.26.22-colornames-init.diff new file mode 100644 index 0000000..2f7a319 --- /dev/null +++ b/netpbm-10.26.22-colornames-init.diff @@ -0,0 +1,19 @@ +--- netpbm-10.26.12/lib/libppmcolor.c ++++ netpbm-10.26.12/lib/libppmcolor.c +@@ -450,6 +450,16 @@ + + fclose(colorFile); + } ++ else { ++ /* ++ * 31.8.2004, jw: ++ * ppm_freecolornames() may be unhappy when ++ * free'ing uninitialized data. ++ */ ++ int i = MAXCOLORNAMES; ++ while (i) colornames[--i] = NULL; ++ } ++ + } + + diff --git a/netpbm-10.26.22-documentation.tar.bz2 b/netpbm-10.26.22-documentation.tar.bz2 new file mode 100644 index 0000000..a4e7483 --- /dev/null +++ b/netpbm-10.26.22-documentation.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:472e503559fc537ff1e8c8b6435a0a79a001f4da1d8b816fbfa12d376ef24ef6 +size 470787 diff --git a/netpbm-10.26.22-endian.patch b/netpbm-10.26.22-endian.patch new file mode 100644 index 0000000..4f60d4a --- /dev/null +++ b/netpbm-10.26.22-endian.patch @@ -0,0 +1,19 @@ +--- converter/other/fiasco/config.h ++++ converter/other/fiasco/config.h +@@ -23,7 +23,15 @@ + + /* Define if your processor stores words with the most significant + byte first (like Motorola and SPARC, unlike Intel and VAX). */ +-/* #undef WORDS_BIGENDIAN */ ++ ++ ++/* since we don't have autoconf... */ ++#include ++#if __BYTE_ORDER == __BIG_ENDIAN ++#define WORDS_BIGENDIAN 1 ++#endif ++ ++ + + /* Define if the X Window System is missing or not being used. */ + #define X_DISPLAY_MISSING 1 diff --git a/netpbm-10.26.22-fixes.patch b/netpbm-10.26.22-fixes.patch new file mode 100644 index 0000000..09141ab --- /dev/null +++ b/netpbm-10.26.22-fixes.patch @@ -0,0 +1,209 @@ +--- buildtools/Makefile ++++ buildtools/Makefile +@@ -33,10 +33,10 @@ + -o $@ $< + + typegen.o endiangen.o:%.o:%.c +- $(CC_FOR_BUILD) -c -o $@ $< ++ $(CC_FOR_BUILD) $(CFLAGS) -c -o $@ $< + + $(PROGS):%:%.o +- $(LD_FOR_BUILD) -o $@ $< ++ $(LD_FOR_BUILD) $(LDFLAGS) -o $@ $< + + clean: cleanlocal + .PHONY: cleanlocal +--- converter/other/fiasco/codec/coeff.c ++++ converter/other/fiasco/codec/coeff.c +@@ -14,6 +14,7 @@ + * $State: Exp $ + */ + ++#include + #include "config.h" + + #include "types.h" +--- converter/other/fiasco/codec/dfiasco.c ++++ converter/other/fiasco/codec/dfiasco.c +@@ -14,6 +14,9 @@ + * $State: Exp $ + */ + ++#include ++#include ++ + #include "config.h" + + #include "types.h" +--- converter/other/fiasco/input/basis.c ++++ converter/other/fiasco/input/basis.c +@@ -14,6 +14,7 @@ + * $State: Exp $ + */ + ++#include + #include "config.h" + + #include "types.h" +--- converter/other/jpegtopnm.c ++++ converter/other/jpegtopnm.c +@@ -511,6 +511,7 @@ + pm_error("Input JPEG image has 'unknown' color space " + "(JCS_UNKNOWN).\n" + "We cannot interpret this image."); ++ *output_type_p = PPM_TYPE; /* not reached */ + break; + case JCS_GRAYSCALE: + *output_type_p = PGM_TYPE; +@@ -538,6 +539,7 @@ + default: + pm_error("Internal error: unknown color space code %d passed " + "to set_color_spaces().", jpeg_color_space); ++ *output_type_p = PPM_TYPE; /* not reached */ + } + pm_message("WRITING %s FILE", + *output_type_p == PPM_TYPE ? "PPM" : "PGM"); +--- converter/other/pamtouil.c ++++ converter/other/pamtouil.c +@@ -377,11 +377,15 @@ + int i; + + for (i = 0; i < ncolors; ++i) { +- cixel_map const cmapEntry = cmap[i]; +- if (cmapEntry.uilname) ++ cixel_map cmapEntry = cmap[i]; ++ if (cmapEntry.uilname) { + freeString(cmapEntry.uilname); +- if (cmapEntry.rgbname) ++ cmapEntry.uilname = NULL; ++ } ++ if (cmapEntry.rgbname) { + freeString(cmapEntry.uilname); ++ cmapEntry.rgbname = NULL; ++ } + } + } + +--- converter/other/pfmtopam.c ++++ converter/other/pfmtopam.c +@@ -136,7 +136,7 @@ + Type converter + -----------------------------------------------------------------------------*/ + if (machineEndianness == pfmEndianness) { +- const float * const floatPointer = (float *)&sample; ++ const float * const floatPointer = (float *)(void *)&sample; + return *floatPointer; + } else { + unsigned char reversed[sizeof(pfmSample)]; +--- converter/other/pgmtopbm.c ++++ converter/other/pgmtopbm.c +@@ -549,6 +549,8 @@ + converter.cols = cols; + converter.convertRow = &dither8ConvertRow; + converter.destroy = NULL; ++ converter.stateP = NULL; ++ converter.maxval = 0; + + /* Scale dither matrix. */ + for (row = 0; row < 16; ++row) { +@@ -619,6 +621,7 @@ + converter.cols = cols; + converter.convertRow = &clusterConvertRow; + converter.destroy = &clusterDestroy; ++ converter.maxval = 0; + + MALLOCVAR_NOFAIL(stateP); + +--- converter/other/pnmtofits.c ++++ converter/other/pnmtofits.c +@@ -121,13 +121,13 @@ + sprintf( card, "NAXIS3 = 3 " ); + write_card( card ); ++i; + } +- sprintf( card, "BSCALE = %E ", bscale ); ++ sprintf( card, "BSCALE = %E ", bscale ); /* %E is 12 chars */ + write_card( card ); ++i; +- sprintf( card, "BZERO = %E ", fits_bzero ); ++ sprintf( card, "BZERO = %E ", fits_bzero ); + write_card( card ); ++i; +- sprintf( card, "DATAMAX = %E ", datamax ); ++ sprintf( card, "DATAMAX = %E ", datamax ); + write_card( card ); ++i; +- sprintf( card, "DATAMIN = %E ", datamin ); ++ sprintf( card, "DATAMIN = %E ", datamin ); + write_card( card ); ++i; + sprintf( card, "HISTORY Created by pnmtofits. " ); + write_card( card ); ++i; +--- converter/other/pnmtopng.c ++++ converter/other/pnmtopng.c +@@ -145,6 +145,7 @@ + retval.green = PPM_GETG(scaled); + retval.blue = PPM_GETB(scaled); + retval.gray = PNM_GET1(scaled); ++ retval.index = 0; + + return retval; + } +--- converter/other/rletopnm.c ++++ converter/other/rletopnm.c +@@ -100,7 +100,7 @@ + optStruct3 opt; + unsigned int option_def_index; + +- unsigned int alphaoutSpec; ++ unsigned int alphaoutSpec = 0; + + option_def_index = 0; /* incremented by OPTENT3 */ + OPTENT3('h', "headerdump", OPT_FLAG, +--- converter/ppm/ximtoppm.c ++++ converter/ppm/ximtoppm.c +@@ -50,7 +50,7 @@ + + unsigned int option_def_index; + +- unsigned int alphaoutSpec; ++ unsigned int alphaoutSpec = 0; + + option_def_index = 0; /* incremented by OPTENT3 */ + OPTENT3(0, "alphaout", OPT_STRING, +--- editor/pamenlarge.c ++++ editor/pamenlarge.c +@@ -52,7 +52,7 @@ + Create a tuple *outTupleRowP which is actually a row of pointers into + inTupleRow[], so as to map input pixels to output pixels by stretching. + -----------------------------------------------------------------------------*/ +- tuple * const newtuplerow; ++ tuple * newtuplerow; + int col; + + MALLOCARRAY_NOFAIL(newtuplerow, outpamP->width); +--- lib/pm.h ++++ lib/pm.h +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + #ifdef VMS + #include +--- lib/util/wordaccess.h ++++ lib/util/wordaccess.h +@@ -76,6 +76,7 @@ + return *((wordint *)bytes); + } + ++static __inline__ void + wordintToBytes(wordintBytes * const bytesP, + wordint const wordInt) { + +--- urt/rle.h ++++ urt/rle.h +@@ -36,6 +36,7 @@ + #include "rle_config.h" /* Configuration parameters. */ + + #include /* Declare FILE. */ ++#include + + #ifdef c_plusplus + #define USE_PROTOTYPES diff --git a/netpbm-10.26.22-manpages.patch b/netpbm-10.26.22-manpages.patch new file mode 100644 index 0000000..57a201c --- /dev/null +++ b/netpbm-10.26.22-manpages.patch @@ -0,0 +1,86 @@ +--- GNUmakefile ++++ GNUmakefile +@@ -64,7 +64,6 @@ + + SUBDIRS = $(PRODUCT_SUBDIRS) $(SUPPORT_SUBDIRS) + +-SCRIPTS = manweb + MANUALS1 = netpbm + NOMERGEBINARIES = netpbm + +@@ -198,11 +197,9 @@ + endif + + .PHONY: install-merge install-nonmerge +-install-merge: install.merge install.lib install.data \ +- install.manweb install.man ++install-merge: install.merge install.lib install.data + +-install-nonmerge: install.bin install.lib install.data \ +- install.manweb install.man ++install-nonmerge: install.bin install.lib install.data + + .PHONY: merge + merge: netpbm +@@ -290,17 +287,6 @@ + install.lib: + endif + +-.PHONY: install.manweb +-install.manweb: $(PKGDIR)/man/web/netpbm.url $(PKGDIR)/bin/doc.url +- +-$(PKGDIR)/man/web/netpbm.url: $(PKGDIR)/man/web +- echo "$(NETPBM_DOCURL)" > $@ +- chmod $(INSTALL_PERM_MAN) $@ +- +-$(PKGDIR)/bin/doc.url: $(PKGDIR)/bin +- echo "$(NETPBM_DOCURL)" > $@ +- chmod $(INSTALL_PERM_MAN) $@ +- + .PHONY: install-dev + # Note that you might install the development package and NOT the runtime + # package. If you have a special system for building stuff, maybe for +--- Makefile.common ++++ Makefile.common +@@ -360,31 +360,6 @@ + $(INSTALL) -c -m $(INSTALL_PERM_DATA) \ + $(SRCDIR)/$(SUBDIR)/$(@:%_installdata=%) $< + +- +-.PHONY: install.man install.man1 install.man3 install.man5 +-install.man: install.man1 install.man3 install.man5 \ +- $(SUBDIRS:%=%/install.man) +- +-MANUALS1 = $(BINARIES) $(SCRIPTS) +- +-install.man1: $(PKGDIR)/man/man1 $(MANUALS1:%=%_installman1) +- +-install.man3: $(PKGDIR)/man/man3 $(MANUALS3:%=%_installman3) +- +-install.man5: $(PKGDIR)/man/man5 $(MANUALS5:%=%_installman5) +- +-%_installman1: $(PKGDIR)/man/man1 +- perl -w $(SRCDIR)/buildtools/makepointerman $(@:%_installman1=%) \ +- $(NETPBM_DOCURL) $< 1 $(MANPAGE_FORMAT) $(INSTALL_PERM_MAN) +- +-%_installman3: $(PKGDIR)/man/man3 +- perl -w $(SRCDIR)/buildtools/makepointerman $(@:%_installman3=%) \ +- $(NETPBM_DOCURL) $< 3 $(MANPAGE_FORMAT) $(INSTALL_PERM_MAN) +- +-%_installman5: $(PKGDIR)/man/man5 +- perl -w $(SRCDIR)/buildtools/makepointerman $(@:%_installman5=%) \ +- $(NETPBM_DOCURL) $< 5 $(MANPAGE_FORMAT) $(INSTALL_PERM_MAN) +- + .PHONY: clean + + ifneq ($(EXE)x,x) +@@ -422,9 +397,6 @@ + %/install.lib: + $(MAKE) -C $(dir $@) -f $(SRCDIR)/$(SUBDIR)/$(dir $@)Makefile \ + SRCDIR=$(SRCDIR) BUILDDIR=$(BUILDDIR) $(notdir $@) +-%/install.man: +- $(MAKE) -C $(dir $@) -f $(SRCDIR)/$(SUBDIR)/$(dir $@)Makefile \ +- SRCDIR=$(SRCDIR) BUILDDIR=$(BUILDDIR) $(notdir $@) + %/install.data: + $(MAKE) -C $(dir $@) -f $(SRCDIR)/$(SUBDIR)/$(dir $@)Makefile \ + SRCDIR=$(SRCDIR) BUILDDIR=$(BUILDDIR) $(notdir $@) diff --git a/netpbm-10.26.22-manpages.tar.bz2 b/netpbm-10.26.22-manpages.tar.bz2 new file mode 100644 index 0000000..a871392 --- /dev/null +++ b/netpbm-10.26.22-manpages.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6e908d298c441959e311b588301b3c18d578a4137e1244765c41f65e543b9cd8 +size 478853 diff --git a/netpbm-10.26.22-nohpcdtoppm-nojbig.tar.bz2 b/netpbm-10.26.22-nohpcdtoppm-nojbig.tar.bz2 new file mode 100644 index 0000000..3c30b07 --- /dev/null +++ b/netpbm-10.26.22-nohpcdtoppm-nojbig.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:996db6ecd0eb2b2435105b6137e6aa4b57499f9f973f8744681288869b9ba8bc +size 2144853 diff --git a/netpbm-10.26.22-overflow.patch b/netpbm-10.26.22-overflow.patch new file mode 100644 index 0000000..73ffea3 --- /dev/null +++ b/netpbm-10.26.22-overflow.patch @@ -0,0 +1,2241 @@ +--- analyzer/pgmhist.c ++++ analyzer/pgmhist.c +@@ -45,6 +45,7 @@ + grayrow = pgm_allocrow( cols ); + + /* Build histogram. */ ++ overflow_add(maxval, 1); + MALLOCARRAY(hist, maxval + 1); + MALLOCARRAY(rcount, maxval + 1); + if ( hist == NULL || rcount == NULL ) +--- analyzer/pgmtexture.c ++++ analyzer/pgmtexture.c +@@ -74,7 +74,9 @@ + vector (int nl, int nh) + { + float *v; +- ++ overflow_add(nh, 1); ++ if(nh < nl) ++ pm_error("assert: h < l"); + MALLOCARRAY(v, (unsigned) (nh - nl + 1)); + if (v == NULL) + pm_error("Unable to allocate memory for a vector."); +@@ -91,12 +93,18 @@ + float **m; + + /* allocate pointers to rows */ ++ overflow_add(nrh, 1); ++ if(nrh < nrl) ++ pm_error("assert: nrh < nrl"); + MALLOCARRAY(m, (unsigned) (nrh - nrl + 1)); + if (m == NULL) + pm_error("Unable to allocate memory for a matrix."); + + m -= ncl; + ++ if(nch < ncl) ++ pm_error("assert: nch < ncl"); ++ overflow_add(nch, 1); + /* allocate rows and set pointers to them */ + for (i = nrl; i <= nrh; i++) + { +--- converter/other/bmptopnm.c ++++ converter/other/bmptopnm.c +@@ -550,6 +550,12 @@ + + xel * colormap; + unsigned int bytesRead; ++ ++ if (cmapsize == 0) { ++ *colormapP = NULL; ++ *bytesReadP = 0; ++ return; ++ } + + colormap = pnm_allocrow(cmapsize); + +--- converter/other/gemtopnm.c ++++ converter/other/gemtopnm.c +@@ -106,6 +106,7 @@ + + pnm_writepnminit( stdout, cols, rows, MAXVAL, type, 0 ); + ++ overflow_add(cols, padright); + { + /* allocate input row data structure */ + int plane; +--- converter/other/jpegtopnm.c ++++ converter/other/jpegtopnm.c +@@ -827,7 +827,9 @@ + + /* Calculate output image dimensions so we can allocate space */ + jpeg_calc_output_dimensions(cinfoP); +- ++ ++ overflow2(cinfoP->output_width, cinfoP->output_components); ++ + jpegbuffer = ((*cinfoP->mem->alloc_sarray) + ((j_common_ptr) cinfoP, JPOOL_IMAGE, + cinfoP->output_width * cinfoP->output_components, +--- converter/other/pamtouil.c ++++ converter/other/pamtouil.c +@@ -134,6 +134,7 @@ + int i; + + /* Allocate memory for printed number. Abort if error. */ ++ overflow_add(digits, 1); + str = (char*) malloc(digits + 1); + if (str == NULL) + pm_error("out of memory allocating number string"); +@@ -168,6 +169,7 @@ + else { + int i; + ++ overflow_add(strlen(rgbname), 5 + 1); + output = malloc(strlen(rgbname) + 5 + 1); + if (output == NULL) + pm_error( "out of memory allocating color name" ); +--- converter/other/pbmtopgm.c ++++ converter/other/pbmtopgm.c +@@ -45,6 +45,7 @@ + "than the image height (%u rows)", height, rows); + + outrow = pgm_allocrow(cols) ; ++ overflow2(width, height); + maxval = MIN(PGM_OVERALLMAXVAL, width*height); + pgm_writepgminit(stdout, cols, rows, maxval, 0) ; + +--- converter/other/pngtopnm.c ++++ converter/other/pngtopnm.c +@@ -612,18 +612,30 @@ + } + + if (info_ptr->bit_depth == 16) ++ { ++ overflow2(2, info_ptr->width); + linesize = 2 * info_ptr->width; ++ } + else + linesize = info_ptr->width; + + if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) ++ { + linesize *= 2; ++ overflow2(2, linesize); ++ } + else + if (info_ptr->color_type == PNG_COLOR_TYPE_RGB) ++ { ++ overflow2(3, linesize); + linesize *= 3; ++ } + else + if (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA) ++ { ++ overflow2(4, linesize); + linesize *= 4; ++ } + + for (y = 0 ; y < info_ptr->height ; y++) { + png_image[y] = malloc (linesize); +--- converter/other/pnmtoddif.c ++++ converter/other/pnmtoddif.c +@@ -484,6 +484,7 @@ + switch (PNM_FORMAT_TYPE(format)) { + case PBM_TYPE: + ip.bits_per_pixel = 1; ++ overflow_add(cols, 7); + ip.bytes_per_line = (cols + 7) / 8; + ip.spectral = 2; + ip.components = 1; +@@ -499,6 +500,7 @@ + ip.polarity = 2; + break; + case PPM_TYPE: ++ overflow2(cols, 3); + ip.bytes_per_line = 3 * cols; + ip.bits_per_pixel = 24; + ip.spectral = 5; +--- converter/other/pnmtojpeg.c ++++ converter/other/pnmtojpeg.c +@@ -588,6 +588,8 @@ + const long half_maxval = maxval / 2; + long val; + ++ overflow_add(maxval, 1); ++ overflow2(maxval+1, sizeof(JSAMPLE)); + *rescale_p = (JSAMPLE *) + (cinfo.mem->alloc_small) ((j_common_ptr) &cinfo, JPOOL_IMAGE, + (size_t) (((long) maxval + 1L) * +@@ -664,6 +666,7 @@ + */ + + /* Allocate the libpnm output and compressor input buffers */ ++ overflow2(cinfo_p->image_width, cinfo_p->input_components); + buffer = (*cinfo_p->mem->alloc_sarray) + ((j_common_ptr) cinfo_p, JPOOL_IMAGE, + (unsigned int) cinfo_p->image_width * cinfo_p->input_components, +@@ -935,6 +938,7 @@ + (jpeg_scan_info *) + (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE, + scan_info_size); ++ overflow2(nscans, sizeof(jpeg_scan_info)); + memcpy(scan_info, scans, scan_info_size); + cinfo->scan_info = scan_info; + cinfo->num_scans = nscans; +--- converter/other/pnmtopalm/palmcolormap.c ++++ converter/other/pnmtopalm/palmcolormap.c +@@ -232,7 +232,7 @@ + return 0; + + colormap = malloc(sizeof(Colormap_s)); +- colormap->color_entries = malloc(sizeof(Color_s) * ncolors); ++ colormap->color_entries = malloc2(sizeof(Color_s), ncolors); + colormap->nentries = ncolors; + colormap->ncolors = ncolors; + +--- converter/other/pnmtopng.c ++++ converter/other/pnmtopng.c +@@ -2010,6 +2010,7 @@ + /* Write the raster */ + + /* max: 3 color channels, one alpha channel, 16-bit */ ++ overflow2(cols, 8); + MALLOCARRAY(line, cols * 8); + if (line == NULL) + { +--- converter/other/pnmtops.c ++++ converter/other/pnmtops.c +@@ -147,16 +147,24 @@ + + cmdlineP->center = !nocenter; + cmdlineP->canturn = !noturn; +- ++ ++ overflow2(width, 72); ++ overflow2(height, 72); + cmdlineP->width = width * 72; + cmdlineP->height = height * 72; + + if (imagewidth_spec) ++ { + cmdlineP->imagewidth = imagewidth * 72; ++ overflow2(imagewidth, 72); ++ } + else + cmdlineP->imagewidth = 0; + if (imageheight_spec) ++ { ++ overflow2(imageheight, 72); + cmdlineP->imageheight = imageheight * 72; ++ } + else + cmdlineP->imageheight = 0; + +--- converter/other/pnmtorle.c ++++ converter/other/pnmtorle.c +@@ -19,6 +19,8 @@ + * If you modify this software, you should include a notice giving the + * name of the person performing the modification, the date of modification, + * and the reason for such modification. ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox + */ + /* + * pnmtorle - A program which will convert pbmplus (ppm or pgm) images +--- converter/other/pnmtosgi.c ++++ converter/other/pnmtosgi.c +@@ -250,6 +250,7 @@ + #endif + + if( storage != STORAGE_VERBATIM ) { ++ overflow2(channels, rows); + MALLOCARRAY_NOFAIL(table, channels * rows); + MALLOCARRAY_NOFAIL(rletemp, WORSTCOMPR(cols)); + } +@@ -303,6 +304,8 @@ + break; + case STORAGE_RLE: + tabrow = chan_no * rows + row; ++ overflow2(chan_no, rows); ++ overflow_add(chan_no* rows, row); + len = rle_compress(temp, cols); /* writes result into rletemp */ + channel[chan_no][row].length = len; + MALLOCARRAY(p, len); +--- converter/other/pnmtotiff.c ++++ converter/other/pnmtotiff.c +@@ -611,9 +611,12 @@ + if (*bitspersampleP < 8) { + int samplesperbyte; + samplesperbyte = 8 / *bitspersampleP; ++ overflow2(cols, *samplesperpixelP); ++ overflow_add(cols * *samplesperpixelP, samplesperbyte); + *bytesperrowP = + (cols * *samplesperpixelP + samplesperbyte-1) / samplesperbyte; + } else ++ overflow3( *samplesperpixelP, cols, *bitspersampleP); + *bytesperrowP = (cols * *samplesperpixelP * *bitspersampleP) / 8; + + if (requested_rowsperstrip == -1 ) +--- converter/other/rast.c ++++ converter/other/rast.c +@@ -46,6 +46,11 @@ + ** not to be the case. In reality, all of Sun's code rounds up to + ** a short, not a long. + */ ++ ++ overflow_add(depth,15); ++ overflow2(w, depth+15); ++ overflow2(w * depth + 15, 2); ++ + m->md_linebytes = ( w * depth + 15 ) / 16 * 2; + m->md_offset.x = 0; + m->md_offset.y = 0; +@@ -108,11 +113,14 @@ + case RT_FORMAT_RGB: + /* Ignore hP->ras_length. */ + h.ras_length = p->pr_size.y * p->pr_data->md_linebytes; ++ overflow2(p->pr_size.y, p->pr_data->md_linebytes); + break; + + case RT_BYTE_ENCODED: + size = p->pr_size.y * p->pr_data->md_linebytes; ++ overflow2(p->pr_size.y, p->pr_data->md_linebytes); + bp = p->pr_data->md_image; ++ overflow2(size, 3); + MALLOCARRAY(beimage, size * 3 / 2); /* worst case */ + if ( beimage == NULL ) + return PIX_ERR; +@@ -193,6 +201,7 @@ + switch ( colormap->type ) + { + case RMT_EQUAL_RGB: ++ overflow2(colormap->length, 3); + h.ras_maplength = colormap->length * 3; + break; + +@@ -404,6 +413,7 @@ + case RT_STANDARD: + case RT_FORMAT_RGB: + /* Ignore hP->ras_length. */ ++ overflow2(p->pr_size.y, p->pr_data->md_linebytes); + i = p->pr_size.y * p->pr_data->md_linebytes; + if ( fread( p->pr_data->md_image, 1, i, in ) != i ) + { +--- converter/other/rletopnm.c ++++ converter/other/rletopnm.c +@@ -19,6 +19,8 @@ + * If you modify this software, you should include a notice giving the + * name of the person performing the modification, the date of modification, + * and the reason for such modification. ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox + */ + /* + * rletopnm - A conversion program to convert from Utah's "rle" image format +--- converter/other/sgitopnm.c ++++ converter/other/sgitopnm.c +@@ -252,6 +252,7 @@ + + if (ochan < 0) { + maxchannel = (head->zsize < 3) ? head->zsize : 3; ++ overflow2(head->ysize, maxchannel); + MALLOCARRAY_NOFAIL(image, head->ysize * maxchannel); + } else { + maxchannel = ochan + 1; +--- converter/other/sirtopnm.c ++++ converter/other/sirtopnm.c +@@ -69,6 +69,7 @@ + } + break; + case PPM_TYPE: ++ overflow3(cols, rows, 3); + picsize = cols * rows * 3; + planesize = cols * rows; + if ( !( sirarray = (unsigned char*) malloc( picsize ) ) ) +--- converter/other/tifftopnm.c ++++ converter/other/tifftopnm.c +@@ -736,6 +736,7 @@ + if (scanbuf == NULL) + pm_error("can't allocate memory for scanline buffer"); + ++ overflow2(cols, spp); + MALLOCARRAY(samplebuf, cols * spp); + if (samplebuf == NULL) + pm_error ("can't allocate memory for row buffer"); +--- converter/pbm/atktopbm.c ++++ converter/pbm/atktopbm.c +@@ -281,7 +281,9 @@ + + *rwidth = width; + *rheight = height; ++ overflow_add(width, 7); + rowlen = (width + 7) / 8; ++ overflow2(height, rowlen); + MALLOCARRAY(*destaddrP, height * rowlen); + if (destaddrP == NULL) + pm_error("Unable to allocate %u bytes for the input image.", +--- converter/pbm/icontopbm.c ++++ converter/pbm/icontopbm.c +@@ -12,6 +12,8 @@ + + #include + ++#include ++#include + #include "pbm.h" + + /* size in bytes of a bitmap */ +@@ -86,6 +88,11 @@ + if ( *heightP <= 0 ) + pm_error( "invalid height (must be positive): %d", *heightP ); + ++ if ( *widthP > INT_MAX - 16 || *widthP < 0) ++ pm_error( "invalid width: %d", *widthP); ++ ++ overflow2(*widthP + 16, *heightP); ++ + data_length = BitmapSize( *widthP, *heightP ); + *dataP = (short unsigned int *) malloc( data_length ); + if ( *dataP == NULL ) +--- converter/pbm/mdatopbm.c ++++ converter/pbm/mdatopbm.c +@@ -245,10 +245,13 @@ + pm_readlittleshort(infile, &yy); nInCols = yy; + } + ++ overflow2(nOutCols, 8); + nOutCols = 8 * nInCols; + nOutRows = nInRows; +- if (bScale) +- nOutRows *= 2; ++ if (bScale) { ++ overflow2(nOutRows, 2); ++ nOutRows *= 2; ++ } + + data = pbm_allocarray(nOutCols, nOutRows); + +--- converter/pbm/pbmto4425.c ++++ converter/pbm/pbmto4425.c +@@ -1,6 +1,7 @@ + #include + + #include "pbm.h" ++#include + + /*extern char *sys_errlist[]; + char *malloc();*/ +@@ -72,7 +73,7 @@ + xres = vmap_width * 2; + yres = vmap_height * 3; + +- vmap = malloc(vmap_width * vmap_height * sizeof(char)); ++ vmap = malloc3(vmap_width, vmap_height, sizeof(char)); + if(vmap == NULL) + { + pm_error( "Cannot allocate memory" ); +--- converter/pbm/pbmtoascii.c ++++ converter/pbm/pbmtoascii.c +@@ -115,9 +115,11 @@ + pm_usage( usage ); + + pbm_readpbminit( ifp, &cols, &rows, &format ); ++ overflow_add(cols, gridx); + ccols = ( cols + gridx - 1 ) / gridx; + bitrow = pbm_allocrow( cols ); + sig = (int*) pm_allocrow( ccols, sizeof(int) ); ++ overflow_add(ccols, 1); + line = (char*) pm_allocrow( ccols + 1, sizeof(char) ); + + for ( row = 0; row < rows; row += gridy ) +--- converter/pbm/pbmtocmuwm.c ++++ converter/pbm/pbmtocmuwm.c +@@ -43,6 +43,7 @@ + bitrow = pbm_allocrow( cols ); + + /* Round cols up to the nearest multiple of 8. */ ++ overflow_add(cols, 7); + padright = ( ( cols + 7 ) / 8 ) * 8 - cols; + + putinit( rows, cols ); +--- converter/pbm/pbmtogem.c ++++ converter/pbm/pbmtogem.c +@@ -123,6 +123,7 @@ + bitsperitem = 0; + bitshift = 7; + outcol = 0; ++ overflow_add(cols, 7); + outmax = (cols + 7) / 8; + outrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char)); + lastrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char)); +--- converter/pbm/pbmtogo.c ++++ converter/pbm/pbmtogo.c +@@ -90,6 +90,7 @@ + bitrow = pbm_allocrow(cols); + + /* Round cols up to the nearest multiple of 8. */ ++ overflow_add(cols, 7); + rucols = ( cols + 7 ) / 8; + bytesperrow = rucols; /* GraphOn uses bytes */ + rucols = rucols * 8; +--- converter/pbm/pbmtoicon.c ++++ converter/pbm/pbmtoicon.c +@@ -42,6 +42,7 @@ + bitrow = pbm_allocrow( cols ); + + /* Round cols up to the nearest multiple of 16. */ ++ overflow_add(cols, 15); + pad = ( ( cols + 15 ) / 16 ) * 16 - cols; + padleft = pad / 2; + padright = pad - padleft; +--- converter/pbm/pbmtolj.c ++++ converter/pbm/pbmtolj.c +@@ -30,6 +30,7 @@ + #include "pbm.h" + #include + #include ++#include + + static int dpi = 75; + static int floating = 0; /* suppress the ``ESC & l 0 E'' ? */ +@@ -123,7 +124,11 @@ + pbm_readpbminit( ifp, &cols, &rows, &format ); + bitrow = pbm_allocrow( cols ); + ++ overflow_add(cols, 8); + rowBufferSize = (cols + 7) / 8; ++ overflow_add(rowBufferSize, 128); ++ overflow_add(rowBufferSize, rowBufferSize+128); ++ overflow_add(rowBufferSize+10, rowBufferSize/8); + packBufferSize = rowBufferSize + (rowBufferSize + 127) / 128 + 1; + deltaBufferSize = rowBufferSize + rowBufferSize / 8 + 10; + +--- converter/pbm/pbmtomacp.c ++++ converter/pbm/pbmtomacp.c +@@ -104,6 +104,7 @@ + if( !lflg ) + left = 0; + ++ overflow_add(left, MAX_COLS - 1); + if( rflg ) + { if( right - left >= MAX_COLS ) + right = left + MAX_COLS - 1; +@@ -114,6 +115,8 @@ + if( !tflg ) + top = 0; + ++ overflow_add(top, MAX_LINES - 1); ++ + if( bflg ) + { if( bottom - top >= MAX_LINES ) + bottom = top + MAX_LINES - 1; +--- converter/pbm/pbmtomda.c ++++ converter/pbm/pbmtomda.c +@@ -179,6 +179,7 @@ + + nOutRowsUnrounded = bScale ? nInRows/2 : nInRows; + ++ overflow_add(nOutRowsUnrounded, 3); + nOutRows = ((nOutRowsUnrounded + 3) / 4) * 4; + /* MDA wants rows a multiple of 4 */ + nOutCols = nInCols / 8; +--- converter/pbm/pbmtomgr.c ++++ converter/pbm/pbmtomgr.c +@@ -43,6 +43,7 @@ + bitrow = pbm_allocrow( cols ); + + /* Round cols up to the nearest multiple of 8. */ ++ overflow_add(cols, 7); + padright = ( ( cols + 7 ) / 8 ) * 8 - cols; + + putinit( rows, cols ); +--- converter/pbm/pbmtoppa/pbm.c ++++ converter/pbm/pbmtoppa/pbm.c +@@ -105,6 +105,7 @@ + return 0; + + case P4: ++ overflow_add(pbm->width, 7); + tmp=(pbm->width+7)/8; + tmp2=fread(data,1,tmp,pbm->fptr); + if(tmp2 == tmp) +@@ -129,7 +130,8 @@ + return; + + pbm->unread = 1; +- pbm->revdata = malloc ((pbm->width+7)/8); ++ overflow_add(pbm->width, 7); ++ pbm->revdata = malloc((pbm->width+7)/8); + memcpy (pbm->revdata, data, (pbm->width+7)/8); + pbm->current_line--; + } +--- converter/pbm/pbmtoppa/pbmtoppa.c ++++ converter/pbm/pbmtoppa/pbmtoppa.c +@@ -472,6 +472,7 @@ + } + } + ++ overflow_add(Width, 7); + Pwidth=(Width+7)/8; + printer.fptr=out; + +--- converter/pbm/pbmtox10bm.c ++++ converter/pbm/pbmtox10bm.c +@@ -57,6 +57,7 @@ + bitrow = pbm_allocrow( cols ); + + /* Compute padding to round cols up to the nearest multiple of 16. */ ++ overflow_add(cols, 15); + padright = ( ( cols + 15 ) / 16 ) * 16 - cols; + + printf( "#define %s_width %d\n", name, cols ); +--- converter/pbm/pbmtoxbm.c ++++ converter/pbm/pbmtoxbm.c +@@ -100,6 +100,8 @@ + bitrow = pbm_allocrow(cols); + + /* Compute padding to round cols up to the nearest multiple of 8. */ ++ ++ overflow_add(cols, 8); + padright = ((cols + 7)/8) * 8 - cols; + + printf("#define %s_width %d\n", name, cols); +--- converter/pbm/pbmtoybm.c ++++ converter/pbm/pbmtoybm.c +@@ -45,6 +45,7 @@ + bitrow = pbm_allocrow( cols ); + + /* Compute padding to round cols up to the nearest multiple of 16. */ ++ overflow_add(cols, 16); + padright = ( ( cols + 15 ) / 16 ) * 16 - cols; + + putinit( cols, rows ); +--- converter/pbm/pbmtozinc.c ++++ converter/pbm/pbmtozinc.c +@@ -66,6 +66,7 @@ + bitrow = pbm_allocrow( cols ); + + /* Compute padding to round cols up to the nearest multiple of 16. */ ++ overflow_add(cols, 16); + padright = ( ( cols + 15 ) / 16 ) * 16 - cols; + + printf( "USHORT %s[] = {\n",name); +--- converter/pbm/pktopbm.c ++++ converter/pbm/pktopbm.c +@@ -274,6 +274,7 @@ + if (flagbyte == 7) { /* long form preamble */ + integer packetlength = get32() ; /* character packet length */ + car = get32() ; /* character number */ ++ overflow_add(packetlength, pktopbm_pkloc); + endofpacket = packetlength + pktopbm_pkloc; + /* calculate end of packet */ + if ((car >= MAXPKCHAR) || !filename[car]) { +--- converter/pbm/thinkjettopbm.l ++++ converter/pbm/thinkjettopbm.l +@@ -90,7 +90,9 @@ + \033\*b{DIG}+W { + int l; + if (rowCount >= rowCapacity) { ++ overflow_add(rowCapacity, 100); + rowCapacity += 100; ++ overflow2(rowCapacity, sizeof *rows); + rows = realloc (rows, rowCapacity * sizeof *rows); + if (rows == NULL) + pm_error ("Out of memory."); +@@ -200,6 +202,8 @@ + /* + * Quite simple since ThinkJet bit arrangement matches PBM + */ ++ ++ overflow2(maxRowLength, 8); + pbm_writepbminit(stdout, maxRowLength*8, rowCount, 0); + + packed_bitrow = malloc(maxRowLength); +--- converter/pbm/ybmtopbm.c ++++ converter/pbm/ybmtopbm.c +@@ -88,6 +88,7 @@ + pm_error( "EOF / read error" ); + + *depthP = 1; ++ overflow_add(*colsP, 15); + *padrightP = ( ( *colsP + 15 ) / 16 ) * 16 - *colsP; + bitsperitem = 0; + } +--- converter/pgm/lispmtopgm.c ++++ converter/pgm/lispmtopgm.c +@@ -57,6 +57,7 @@ + pm_error( "depth (%d bits) is too large", depth); + + pgm_writepgminit( stdout, cols, rows, (gray) maxval, 0 ); ++ overflow_add(cols, 7); + grayrow = pgm_allocrow( ( cols + 7 ) / 8 * 8 ); + + for ( row = 0; row < rows; ++row ) +@@ -101,7 +102,9 @@ + + if ( *depthP == 0 ) + *depthP = 1; /* very old file */ +- ++ ++ overflow_add(colsP, 31); ++ + *padrightP = ( ( *colsP + 31 ) / 32 ) * 32 - *colsP; + + if ( *colsP != (cols_32 - *padrightP) ) { +--- converter/pgm/psidtopgm.c ++++ converter/pgm/psidtopgm.c +@@ -60,6 +60,7 @@ + "bits/sample (%d) is too large.", bitspersample ); + + pgm_writepgminit( stdout, cols, rows, (gray) maxval, 0 ); ++ overflow_add(cols, 7); + grayrow = pgm_allocrow( ( cols + 7 ) / 8 * 8 ); + for ( row = 0; row < rows; ++row) + { +--- converter/ppm/Makefile ++++ converter/ppm/Makefile +@@ -11,7 +11,7 @@ + + PORTBINARIES = 411toppm eyuvtoppm gouldtoppm ilbmtoppm imgtoppm \ + leaftoppm mtvtoppm neotoppm \ +- pcxtoppm pc1toppm pi1toppm picttoppm pjtoppm \ ++ pcxtoppm pc1toppm pi1toppm pjtoppm \ + ppmtoacad ppmtoarbtxt \ + ppmtobmp ppmtoeyuv ppmtogif ppmtoicr ppmtoilbm \ + ppmtoleaf ppmtolj ppmtomitsu ppmtoneo \ +--- converter/ppm/ilbmtoppm.c ++++ converter/ppm/ilbmtoppm.c +@@ -580,6 +580,7 @@ + rawtype *chp; + + cols = bmhd->w; ++ overflow_add(cols, 15); + bytes = RowBytes(cols); + for( plane = 0; plane < nPlanes; plane++ ) { + int mask; +@@ -881,6 +882,7 @@ + + col = cmap->ncolors; + ++ overflow2(col, 2); + tempcolor = ppm_allocrow(col * 2); + for( i = 0; i < col; i++ ) { + tempcolor[i] = cmap->color[i]; +@@ -1913,6 +1915,9 @@ + cmap->mp_change[i] = NULL; + if( PCHG.StartLine < 0 ) { + int nch; ++ if(PCHG.MaxReg < PCHG.MinReg) ++ pm_error("assert: MinReg > MaxReg"); ++ overflow_add(PCHG.MaxReg-PCHG.MinReg, 2); + nch = PCHG.MaxReg - PCHG.MinReg +1; + MALLOCARRAY_NOFAIL(cmap->mp_init, nch + 1); + for( i = 0; i < nch; i++ ) +--- converter/ppm/imgtoppm.c ++++ converter/ppm/imgtoppm.c +@@ -84,6 +84,7 @@ + len = atoi((char*) buf ); + if ( fread( buf, len, 1, ifp ) != 1 ) + pm_error( "bad colormap buf" ); ++ overflow2(cmaplen, 3); + if ( cmaplen * 3 != len ) + { + pm_message( +@@ -105,6 +106,7 @@ + pm_error( "bad pixel data header" ); + buf[8] = '\0'; + len = atoi((char*) buf ); ++ overflow2(cols, rows); + if ( len != cols * rows ) + pm_message( + "pixel data length (%d) does not match image size (%d)", +--- converter/ppm/pcxtoppm.c ++++ converter/ppm/pcxtoppm.c +@@ -376,6 +376,7 @@ + } + + /* BytesPerLine should be >= BitsPerPixel * cols / 8 */ ++ overflow2(BytesPerLine, 8); + rawcols = BytesPerLine * 8 / BitsPerPixel; + if( cols > rawcols ) { + pm_message("warning - BytesPerLine = %d, " +@@ -383,6 +384,7 @@ + BytesPerLine, rawcols); + cols = rawcols; + } ++ overflow2(Planes, BytesPerLine); + pcxrow = (unsigned char *) + pm_allocrow(Planes * BytesPerLine, sizeof(unsigned char)); + rawrow = (unsigned char *)pm_allocrow(rawcols, sizeof(unsigned char)); +@@ -578,6 +580,8 @@ + /* + * clear the pixel buffer + */ ++ ++ overflow2(bytesperline, 8); + npixels = (bytesperline * 8) / bitsperpixel; + p = pixels; + while (--npixels >= 0) +--- converter/ppm/picttoppm.c ++++ converter/ppm/picttoppm.c +@@ -1,3 +1,5 @@ ++#error "Unfixable. Don't ship me" ++ + /* + * picttoppm.c -- convert a MacIntosh PICT file to PPM format. + * +--- converter/ppm/pjtoppm.c ++++ converter/ppm/pjtoppm.c +@@ -127,19 +127,23 @@ + case 'V': /* send plane */ + case 'W': /* send last plane */ + if (rows == -1 || r >= rows || image == NULL) { +- if (rows == -1 || r >= rows) ++ if (rows == -1 || r >= rows) { ++ overflow_add(rows, 100); + rows += 100; ++ } + if (image == NULL) { ++ overflow2(rows, planes); + MALLOCARRAY(image, rows * planes); + MALLOCARRAY(imlen, rows * planes); + } + else { ++ overflow2(rows,planes); + image = (unsigned char **) +- realloc(image, +- rows * planes * ++ realloc2(image, ++ rows * planes, + sizeof(unsigned char *)); + imlen = (int *) +- realloc(imlen, rows * planes * sizeof(int)); ++ realloc2(imlen, rows * planes,sizeof(int)); + } + } + if (image == NULL || imlen == NULL) +@@ -215,6 +219,8 @@ + cmd >= 0 && i < newcols; cmd--, i++) + buf[i] = val; + cols = cols > i ? cols : i; ++ overflow_add(i, 1); ++ + free(image[p + r * planes]); + /* + * This is less than what we have so it realloc should +@@ -224,6 +230,7 @@ + image[p + r * planes] = (unsigned char *) realloc(buf, i); + } + } ++ overflow2(cols, 8); + cols *= 8; + } + +--- converter/ppm/ppmtoeyuv.c ++++ converter/ppm/ppmtoeyuv.c +@@ -113,6 +113,7 @@ + + int index; + ++ overflow_add(maxval, 1); + MALLOCARRAY_NOFAIL(mult299 , maxval+1); + MALLOCARRAY_NOFAIL(mult587 , maxval+1); + MALLOCARRAY_NOFAIL(mult114 , maxval+1); +--- converter/ppm/ppmtoicr.c ++++ converter/ppm/ppmtoicr.c +@@ -169,7 +169,7 @@ + + if (rleflag) { + pm_message("sending run-length encoded picture data ..." ); +- testimage = (char*) malloc(rows*cols); ++ testimage = (char*) malloc2(rows, cols); + p = testimage; + for (i=0; iorig_y = NULL; + Fsize_x = out_x; + /* Allocate new frame memory */ +- omfrw->orig_y = (uint8 **) malloc(sizeof(uint8 *) * Fsize_y); ++ omfrw->orig_y = (uint8 **) malloc2(sizeof(uint8 *) , Fsize_y); + ERRCHK(omfrw->orig_y, "malloc"); + for (y = 0; y < Fsize_y; y++) { +- omfrw->orig_y[y] = (uint8 *) malloc(sizeof(uint8) * out_x); ++ omfrw->orig_y[y] = (uint8 *) malloc2(sizeof(uint8) , out_x); + ERRCHK(omfrw->orig_y[y], "malloc"); + } + +- omfrw->orig_cr = (uint8 **) malloc(sizeof(int8 *) * Fsize_y / 2); ++ omfrw->orig_cr = (uint8 **) malloc2(sizeof(int8 *) , Fsize_y / 2); + ERRCHK(omfrw->orig_cr, "malloc"); ++ overflow2(out_x, sizeof(int8)); + for (y = 0; y < Fsize_y / 2; y++) { + omfrw->orig_cr[y] = (uint8 *) malloc(sizeof(int8) * out_x / 2); + ERRCHK(omfrw->orig_cr[y], "malloc"); +@@ -205,21 +206,23 @@ + Fsize_y = out_y; + + /* Allocate new frame memory */ +- omfrh->orig_y = (uint8 **) malloc(sizeof(uint8 *) * out_y); ++ omfrh->orig_y = (uint8 **) malloc2(sizeof(uint8 *), out_y); + ERRCHK(omfrh->orig_y, "malloc"); + for (y = 0; y < out_y; y++) { +- omfrh->orig_y[y] = (uint8 *) malloc(sizeof(uint8) * Fsize_x); ++ omfrh->orig_y[y] = (uint8 *) malloc2(sizeof(uint8) , Fsize_x); + ERRCHK(omfrh->orig_y[y], "malloc"); + } + ++ overflow2(out_y, sizeof(int8 *)); + omfrh->orig_cr = (uint8 **) malloc(sizeof(int8 *) * out_y / 2); + ERRCHK(omfrh->orig_cr, "malloc"); ++ overflow2(sizeof(int8), Fsize_x); + for (y = 0; y < out_y / 2; y++) { + omfrh->orig_cr[y] = (uint8 *) malloc(sizeof(int8) * Fsize_x / 2); + ERRCHK(omfrh->orig_cr[y], "malloc"); + } + +- omfrh->orig_cb = (uint8 **) malloc(sizeof(int8 *) * out_y / 2); ++ omfrh->orig_cb = (uint8 **) malloc2(sizeof(int8 *) , out_y / 2); + ERRCHK(omfrh->orig_cb, "malloc"); + for (y = 0; y < out_y / 2; y++) { + omfrh->orig_cb[y] = (uint8 *) malloc(sizeof(int8) * Fsize_x / 2); +@@ -522,20 +525,20 @@ + dctx = Fsize_x / DCTSIZE; + dcty = Fsize_y / DCTSIZE; + +- frame->y_blocks = (Block **) malloc(sizeof(Block *) * dcty); ++ frame->y_blocks = (Block **) malloc2(sizeof(Block *), dcty); + ERRCHK(frame->y_blocks, "malloc"); + for (i = 0; i < dcty; i++) { +- frame->y_blocks[i] = (Block *) malloc(sizeof(Block) * dctx); ++ frame->y_blocks[i] = (Block *) malloc2(sizeof(Block), dctx); + ERRCHK(frame->y_blocks[i], "malloc"); + } + +- frame->cr_blocks = (Block **) malloc(sizeof(Block *) * (dcty >> 1)); +- frame->cb_blocks = (Block **) malloc(sizeof(Block *) * (dcty >> 1)); ++ frame->cr_blocks = (Block **) malloc2(sizeof(Block *) , (dcty >> 1)); ++ frame->cb_blocks = (Block **) malloc2(sizeof(Block *) , (dcty >> 1)); + ERRCHK(frame->cr_blocks, "malloc"); + ERRCHK(frame->cb_blocks, "malloc"); + for (i = 0; i < (dcty >> 1); i++) { +- frame->cr_blocks[i] = (Block *) malloc(sizeof(Block) * (dctx >> 1)); +- frame->cb_blocks[i] = (Block *) malloc(sizeof(Block) * (dctx >> 1)); ++ frame->cr_blocks[i] = (Block *) malloc2(sizeof(Block) , (dctx >> 1)); ++ frame->cb_blocks[i] = (Block *) malloc2(sizeof(Block) , (dctx >> 1)); + ERRCHK(frame->cr_blocks[i], "malloc"); + ERRCHK(frame->cb_blocks[i], "malloc"); + } +@@ -567,10 +570,10 @@ + /* + * first, allocate tons of memory + */ +- frame->orig_y = (uint8 **) malloc(sizeof(uint8 *) * Fsize_y); ++ frame->orig_y = (uint8 **) malloc2(sizeof(uint8 *), Fsize_y); + ERRCHK(frame->orig_y, "malloc"); + for (y = 0; y < Fsize_y; y++) { +- frame->orig_y[y] = (uint8 *) malloc(sizeof(uint8) * Fsize_x); ++ frame->orig_y[y] = (uint8 *) malloc2(sizeof(uint8), Fsize_x); + ERRCHK(frame->orig_y[y], "malloc"); + } + +@@ -618,22 +621,24 @@ + return; + } + +- frame->halfX = (uint8 **) malloc(Fsize_y*sizeof(uint8 *)); ++ frame->halfX = (uint8 **) malloc2(Fsize_y, sizeof(uint8 *)); + ERRCHK(frame->halfX, "malloc"); +- frame->halfY = (uint8 **) malloc((Fsize_y-1)*sizeof(uint8 *)); ++ if(Fsize_y == 0 || Fsize_x == 0) ++ pm_error("assert: zero size"); ++ frame->halfY = (uint8 **) malloc2((Fsize_y-1), sizeof(uint8 *)); + ERRCHK(frame->halfY, "malloc"); +- frame->halfBoth = (uint8 **) malloc((Fsize_y-1)*sizeof(uint8 *)); ++ frame->halfBoth = (uint8 **) malloc2((Fsize_y-1), sizeof(uint8 *)); + ERRCHK(frame->halfBoth, "malloc"); + for ( y = 0; y < Fsize_y; y++ ) { +- frame->halfX[y] = (uint8 *) malloc((Fsize_x-1)*sizeof(uint8)); ++ frame->halfX[y] = (uint8 *) malloc2((Fsize_x-1), sizeof(uint8)); + ERRCHK(frame->halfX[y], "malloc"); + } + for ( y = 0; y < Fsize_y-1; y++ ) { +- frame->halfY[y] = (uint8 *) malloc(Fsize_x*sizeof(uint8)); ++ frame->halfY[y] = (uint8 *) malloc2(Fsize_x, sizeof(uint8)); + ERRCHK(frame->halfY[y], "malloc"); + } + for ( y = 0; y < Fsize_y-1; y++ ) { +- frame->halfBoth[y] = (uint8 *) malloc((Fsize_x-1)*sizeof(uint8)); ++ frame->halfBoth[y] = (uint8 *) malloc2((Fsize_x-1), sizeof(uint8)); + ERRCHK(frame->halfBoth[y], "malloc"); + } + } +@@ -667,24 +672,24 @@ + it for some reason, so do it this way at least for now -- more + flexible + */ +- frame->decoded_y = (uint8 **) malloc(sizeof(uint8 *) * Fsize_y); ++ frame->decoded_y = (uint8 **) malloc2(sizeof(uint8 *), Fsize_y); + ERRCHK(frame->decoded_y, "malloc"); + for (y = 0; y < Fsize_y; y++) { +- frame->decoded_y[y] = (uint8 *) malloc(sizeof(uint8) * Fsize_x); ++ frame->decoded_y[y] = (uint8 *) malloc2(sizeof(uint8), Fsize_x); + ERRCHK(frame->decoded_y[y], "malloc"); + } + +- frame->decoded_cr = (uint8 **) malloc(sizeof(int8 *) * (Fsize_y >> 1)); ++ frame->decoded_cr = (uint8 **) malloc2(sizeof(int8 *), (Fsize_y >> 1)); + ERRCHK(frame->decoded_cr, "malloc"); + for (y = 0; y < (Fsize_y >> 1); y++) { +- frame->decoded_cr[y] = (uint8 *) malloc(sizeof(uint8) * (Fsize_x >> 1)); ++ frame->decoded_cr[y] = (uint8 *) malloc2(sizeof(uint8), (Fsize_x >> 1)); + ERRCHK(frame->decoded_cr[y], "malloc"); + } + +- frame->decoded_cb = (uint8 **) malloc(sizeof(int8 *) * (Fsize_y >> 1)); ++ frame->decoded_cb = (uint8 **) malloc2(sizeof(int8 *), (Fsize_y >> 1)); + ERRCHK(frame->decoded_cb, "malloc"); + for (y = 0; y < (Fsize_y >> 1); y++) { +- frame->decoded_cb[y] = (uint8 *) malloc(sizeof(uint8) * (Fsize_x >> 1)); ++ frame->decoded_cb[y] = (uint8 *) malloc2(sizeof(uint8), (Fsize_x >> 1)); + ERRCHK(frame->decoded_cb[y], "malloc"); + } + +--- converter/ppm/ppmtompeg/iframe.c ++++ converter/ppm/ppmtompeg/iframe.c +@@ -859,6 +859,7 @@ + int ysz = (Fsize_y>>3) * sizeof(int32 *); + int xsz = (Fsize_x>>3); + ++ overflow2(Fsize_y>>3, sizeof(int32 *)); + needs_init = FALSE; + for (y=0; y<3; y++) { + varDiff[y] = ratio[y] = total[y] = 0.0; +@@ -877,6 +878,7 @@ + fprintf(stderr, "Out of memory in BlockComputeSNR\n"); + exit(-1); + } ++ overflow2(xsz, 4); + for (y = 0; y < ySize[0]>>3; y++) { + SignalY[y] = (int32 *) calloc(xsz,4); + SignalCr[y] = (int32 *) calloc(xsz,4); +@@ -1032,27 +1034,27 @@ + dctx = Fsize_x / DCTSIZE; + dcty = Fsize_y / DCTSIZE; + +- dct = (Block **) malloc(sizeof(Block *) * dcty); ++ dct = (Block **) malloc2(sizeof(Block *), dcty); + ERRCHK(dct, "malloc"); + for (i = 0; i < dcty; i++) { +- dct[i] = (Block *) malloc(sizeof(Block) * dctx); ++ dct[i] = (Block *) malloc2(sizeof(Block), dctx); + ERRCHK(dct[i], "malloc"); + } + +- dct_data = (dct_data_type **) malloc(sizeof(dct_data_type *) * dcty); ++ dct_data = (dct_data_type **) malloc2(sizeof(dct_data_type *), dcty); + ERRCHK(dct_data, "malloc"); + for (i = 0; i < dcty; i++) { +- dct_data[i] = (dct_data_type *) malloc(sizeof(dct_data_type) * dctx); ++ dct_data[i] = (dct_data_type *) malloc2(sizeof(dct_data_type),dctx); + ERRCHK(dct[i], "malloc"); + } + +- dctr = (Block **) malloc(sizeof(Block *) * (dcty >> 1)); +- dctb = (Block **) malloc(sizeof(Block *) * (dcty >> 1)); ++ dctr = (Block **) malloc2(sizeof(Block *), (dcty >> 1)); ++ dctb = (Block **) malloc2(sizeof(Block *), (dcty >> 1)); + ERRCHK(dctr, "malloc"); + ERRCHK(dctb, "malloc"); + for (i = 0; i < (dcty >> 1); i++) { +- dctr[i] = (Block *) malloc(sizeof(Block) * (dctx >> 1)); +- dctb[i] = (Block *) malloc(sizeof(Block) * (dctx >> 1)); ++ dctr[i] = (Block *) malloc2(sizeof(Block), (dctx >> 1)); ++ dctb[i] = (Block *) malloc2(sizeof(Block), (dctx >> 1)); + ERRCHK(dctr[i], "malloc"); + ERRCHK(dctb[i], "malloc"); + } +--- converter/ppm/ppmtompeg/jpeg.c ++++ converter/ppm/ppmtompeg/jpeg.c +@@ -228,7 +228,7 @@ + exit(1); + } + +- inoffsets = (int *)malloc(no_frames*sizeof(int)); ++ inoffsets = (int *)malloc2(no_frames, sizeof(int)); + + if (fread (&(width),sizeof(int),1,inFile) != 1) + { +--- converter/ppm/ppmtompeg/parallel.c ++++ converter/ppm/ppmtompeg/parallel.c +@@ -2113,6 +2113,8 @@ + + /* should keep list of port numbers to notify when frames become ready */ + ++ overflow2(numInputFiles, sizeof(int)); ++ overflow2(numInputFiles, sizeof(boolean)); + ready = (boolean *) calloc(numInputFiles, sizeof(boolean)); + waitMachine = (int *) calloc(numInputFiles, sizeof(int)); + waitPort = (int *) malloc(numMachines*sizeof(int)); +@@ -2126,7 +2128,7 @@ + + TransmitPortNum(masterHostName, masterPortNum, decodePortNum); + +- frameDone = (boolean *) malloc(numInputFiles*sizeof(boolean)); ++ frameDone = (boolean *) malloc2(numInputFiles, sizeof(boolean)); + memset((char *)frameDone, 0, numInputFiles*sizeof(boolean)); + + /* wait for ready signals and requests */ +--- converter/ppm/ppmtompeg/psearch.c ++++ converter/ppm/ppmtompeg/psearch.c +@@ -217,6 +217,13 @@ + int const max_search = max(searchRangeP, searchRangeB); + + int index; ++ ++ overflow2(searchRangeP, 2); ++ overflow2(searchRangeB, 2); ++ overflow_add(searchRangeP*2, 3); ++ overflow_add(searchRangeB*2, 3); ++ overflow2(2*searchRangeB+3, sizeof(int)); ++ overflow2(2*searchRangeP+3, sizeof(int)); + + pmvHistogram = (int **) malloc((2*searchRangeP+3)*sizeof(int *)); + bbmvHistogram = (int **) malloc((2*searchRangeB+3)*sizeof(int *)); +@@ -824,6 +831,9 @@ + int *columnTotals; + int rowTotal; + ++ overflow2(searchRangeP, 2); ++ overflow_add(searchRangeP*2, 3); ++ overflow2(searchRangeP*2+3, sizeof(int)); + columnTotals = (int *) calloc(2*searchRangeP+3, sizeof(int)); + + #ifdef COMPLETE_DISPLAY +@@ -871,6 +881,9 @@ + + fprintf(fpointer, "B-frame Backwards:\n"); + ++ overflow2(searchRangeB, 2); ++ overflow_add(searchRangeB*2, 3); ++ overflow2(searchRangeB*2+3, sizeof(int)); + columnTotals = (int *) calloc(2*searchRangeB+3, sizeof(int)); + + #ifdef COMPLETE_DISPLAY +@@ -918,6 +931,9 @@ + + fprintf(fpointer, "B-frame Forwards:\n"); + ++ overflow2(searchRangeB, 2); ++ overflow_add(searchRangeB*2, 3); ++ overflow2(searchRangeB*2+3, sizeof(int)); + columnTotals = (int *) calloc(2*searchRangeB+3, sizeof(int)); + + #ifdef COMPLETE_DISPLAY +--- converter/ppm/ppmtompeg/rgbtoycc.c ++++ converter/ppm/ppmtompeg/rgbtoycc.c +@@ -72,6 +72,8 @@ + } + table_maxval = maxval; + ++ overflow_add(table_maxval, 1); ++ overflow2(table_maxval+1, sizeof(float)); + mult299 = malloc((table_maxval+1)*sizeof(float)); + mult587 = malloc((table_maxval+1)*sizeof(float)); + mult114 = malloc((table_maxval+1)*sizeof(float)); +--- converter/ppm/ppmtopcx.c ++++ converter/ppm/ppmtopcx.c +@@ -418,6 +418,8 @@ + else Planes = 1; + } + } ++ overflow2(BitsPerPixel, cols); ++ overflow_add(BitsPerPixel * cols, 7); + BytesPerLine = ((cols * BitsPerPixel) + 7) / 8; + MALLOCARRAY_NOFAIL(indexRow, cols); + MALLOCARRAY_NOFAIL(planesrow, BytesPerLine); +--- converter/ppm/ppmtopict.c ++++ converter/ppm/ppmtopict.c +@@ -245,6 +245,8 @@ + putShort(stdout, 0); /* mode */ + + /* Finally, write out the data. */ ++ overflow_add(cols/MAX_COUNT, 1); ++ overflow_add(cols, cols/MAX_COUNT+1); + packed = (char*) malloc((unsigned)(cols+cols/MAX_COUNT+1)); + oc = 0; + for (row = 0; row < rows; row++) +--- converter/ppm/ppmtopj.c ++++ converter/ppm/ppmtopj.c +@@ -180,6 +180,7 @@ + pixels = ppm_readppm( ifp, &cols, &rows, &maxval ); + + pm_close( ifp ); ++ overflow2(cols,2); + obuf = (unsigned char *) pm_allocrow(cols, sizeof(unsigned char)); + cbuf = (unsigned char *) pm_allocrow(cols * 2, sizeof(unsigned char)); + +--- converter/ppm/ppmtopjxl.c ++++ converter/ppm/ppmtopjxl.c +@@ -273,6 +273,8 @@ + pm_error("image too large; reduce with ppmscale"); + if (maxval > PCL_MAXVAL) + pm_error("color range too large; reduce with ppmcscale"); ++ if (cols < 0 || rows < 0) ++ pm_error("negative size is not possible"); + + /* Figure out the colormap. */ + fprintf( stderr, "(Computing colormap..." ); fflush( stderr ); +@@ -293,6 +295,8 @@ + case 0: /* direct mode (no palette) */ + bpp = bitsperpixel(maxval); /* bits per pixel */ + bpg = bpp; bpb = bpp; ++ overflow2(bpp, 3); ++ overflow_add(bpp*3, 7); + bpp = (bpp*3+7)>>3; /* bytes per pixel now */ + bpr = (bpp<<3)-bpg-bpb; + bpp *= cols; /* bytes per row now */ +@@ -302,9 +306,13 @@ + case 3: case 7: pclindex++; + default: + bpp = 8/pclindex; ++ overflow_add(cols, bpp); ++ if(bpp == 0) ++ pm_error("assert: no bpp"); + bpp = (cols+bpp-1)/bpp; /* bytes per row */ + } + ++ overflow2(bpp,2); + if ((inrow = (char *)malloc((unsigned)bpp)) == NULL || + (outrow = (char *)malloc((unsigned)bpp*2)) == NULL || + (runcnt = (signed char *)malloc((unsigned)bpp)) == NULL) +--- converter/ppm/ppmtowinicon.c ++++ converter/ppm/ppmtowinicon.c +@@ -12,6 +12,7 @@ + + #include + #include ++#include + + #include "winico.h" + #include "ppm.h" +@@ -713,6 +714,12 @@ + entry->bitcount = bpp; + entry->ih = createInfoHeader(entry, xorBitmap, andBitmap); + entry->colors = palette->colors; ++ ++ overflow2(4, entry->color_count); ++ overflow_add(xorBitmap->size, andBitmap->size); ++ overflow_add(xorBitmap->size + andBitmap->size, 40); ++ overflow_add(xorBitmap->size + andBitmap->size + 40, 4 * entry->color_count); ++ + entry->size_in_bytes = + xorBitmap->size + andBitmap->size + 40 + (4 * entry->color_count); + if (verbose) +@@ -736,7 +743,7 @@ + * Perhaps I should use something that allocs a decent amount at start... + */ + MSIconData->entries = +- realloc (MSIconData->entries, MSIconData->count * sizeof(IC_Entry *)); ++ realloc2 (MSIconData->entries, MSIconData->count, sizeof(IC_Entry *)); + MSIconData->entries[MSIconData->count-1] = entry; + } + +--- converter/ppm/ppmtoxpm.c ++++ converter/ppm/ppmtoxpm.c +@@ -180,6 +180,7 @@ + int i; + + /* Allocate memory for printed number. Abort if error. */ ++ overflow_add(digits, 1); + if (!(str = (char *) malloc(digits + 1))) + pm_error("out of memory"); + +--- converter/ppm/qrttoppm.c ++++ converter/ppm/qrttoppm.c +@@ -46,7 +46,7 @@ + + ppm_writeppminit( stdout, cols, rows, maxval, 0 ); + pixelrow = ppm_allocrow( cols ); +- buf = (unsigned char *) malloc( 3 * cols ); ++ buf = (unsigned char *) malloc2( 3 , cols ); + if ( buf == (unsigned char *) 0 ) + pm_error( "out of memory" ); + +--- converter/ppm/sldtoppm.c ++++ converter/ppm/sldtoppm.c +@@ -307,6 +307,8 @@ + + /* Allocate image buffer and clear it to black. */ + ++ overflow_add(ixdots,1); ++ overflow_add(iydots,1); + pixels = ppm_allocarray(pixcols = ixdots + 1, pixrows = iydots + 1); + PPM_ASSIGN(rgbcolour, 0, 0, 0); + ppmd_filledrectangle(pixels, pixcols, pixrows, pixmaxval, 0, 0, +--- converter/ppm/ximtoppm.c ++++ converter/ppm/ximtoppm.c +@@ -283,6 +283,7 @@ + header->bits_channel = atoi(a_head.bits_per_channel); + header->alpha_flag = atoi(a_head.alpha_channel); + if (strlen(a_head.author)) { ++ overflow_add(strlen(a_head.author),1); + if (!(header->author = calloc((unsigned int)strlen(a_head.author)+1, + 1))) { + pm_message("ReadXimHeader: can't calloc author string" ); +@@ -292,6 +293,7 @@ + strncpy(header->author, a_head.author, strlen(a_head.author)); + } + if (strlen(a_head.date)) { ++ overflow_add(strlen(a_head.date),1); + if (!(header->date =calloc((unsigned int)strlen(a_head.date)+1,1))){ + pm_message("ReadXimHeader: can't calloc date string" ); + return(0); +@@ -300,6 +302,7 @@ + strncpy(header->date, a_head.date, strlen(a_head.date)); + } + if (strlen(a_head.program)) { ++ overflow_add(strlen(a_head.program),1); + if (!(header->program = calloc( + (unsigned int)strlen(a_head.program) + 1, 1))) { + pm_message("ReadXimHeader: can't calloc program string" ); +@@ -326,6 +329,7 @@ + if (header->nchannels == 3 && header->bits_channel == 8) + header->ncolors = 0; + else if (header->nchannels == 1 && header->bits_channel == 8) { ++ overflow2(header->ncolors, sizeof(Color)); + header->colors = (Color *)calloc((unsigned int)header->ncolors, + sizeof(Color)); + if (header->colors == NULL) { +--- converter/ppm/yuvtoppm.c ++++ converter/ppm/yuvtoppm.c +@@ -72,6 +72,7 @@ + + ppm_writeppminit(stdout, cols, rows, (pixval) 255, 0); + pixrow = ppm_allocrow(cols); ++ overflow_add(cols, 1); + MALLOCARRAY(yuvbuf, (cols+1)/2); + if (yuvbuf == NULL) + pm_error("Unable to allocate YUV buffer for %d columns.", cols); +--- doc/COPYRIGHT.PATENT ++++ doc/COPYRIGHT.PATENT +@@ -33,6 +33,11 @@ + all the above to be modified by "to the best of the Netpbm + maintainer's knowledge." + ++These security fixes for netpbm are (c) Copyright 2002 Red Hat Inc. ++Red Hat has not fixed those items with patent claims or commercial ++use restrictions. These changes include NO WARRANTY and are provided ++under the Open Software License v.1 (see file OPENLICENSE). ++ + + + PATENTS +--- editor/pamcut.c ++++ editor/pamcut.c +@@ -509,6 +509,8 @@ + outpam.width = rightcol-leftcol+1; + outpam.height = bottomrow-toprow+1; + ++ overflow_add(rightcol, 1); ++ overflow_add(toprow, 1); + pnm_writepaminit(&outpam); + + /* Write out top padding */ +--- editor/pamoil.c ++++ editor/pamoil.c +@@ -112,6 +112,7 @@ + tuples = pnm_readpam(ifp, &inpam, PAM_STRUCT_SIZE(tuple_type)); + pm_close(ifp); + ++ overflow_add(inpam.maxval, 1); + MALLOCARRAY(hist, inpam.maxval + 1); + if (hist == NULL) + pm_error("Unable to allocate memory for histogram."); +--- editor/pbmclean.c ++++ editor/pbmclean.c +@@ -147,7 +147,7 @@ + inrow[0] = inrow[1]; + inrow[1] = inrow[2]; + inrow[2] = shuffle ; +- if (row+1 < rows) { ++ if (row <= rows) { + /* Read the "next" row in from the file. Allocate buffer if neeeded */ + if (inrow[2] == NULL) + inrow[2] = pbm_allocrow(cols); +--- editor/pbmlife.c ++++ editor/pbmlife.c +@@ -54,7 +54,7 @@ + prevrow = thisrow; + thisrow = nextrow; + nextrow = temprow; +- if ( row < rows - 1 ) ++ if ( row <= rows ) + pbm_readpbmrow( ifp, nextrow, cols, format ); + + for ( col = 0; col < cols; ++col ) +--- editor/pbmpscale.c ++++ editor/pbmpscale.c +@@ -109,6 +109,7 @@ + inrow[0] = inrow[1] = inrow[2] = NULL; + pbm_readpbminit(ifd, &columns, &rows, &format) ; + ++ overflow2(columns, scale); + outrow = pbm_allocrow(columns*scale) ; + MALLOCARRAY(flags, columns); + if (flags == NULL) +--- editor/pbmreduce.c ++++ editor/pbmreduce.c +@@ -93,6 +93,7 @@ + + if ( halftone == QT_FS ) { + /* Initialize Floyd-Steinberg. */ ++ overflow_add(newcols, 2); + MALLOCARRAY(thiserr, newcols + 2); + MALLOCARRAY(nexterr, newcols + 2); + if ( thiserr == NULL || nexterr == NULL ) +--- editor/pnmcrop.c ++++ editor/pnmcrop.c +@@ -379,6 +379,8 @@ + + xelrow = pnm_allocrow(cols); + ++ overflow_add(right, 1); ++ overflow_add(bottom, 1); + newcols = right - left + 1; + newrows = bottom - top + 1; + pnm_writepnminit(stdout, newcols, newrows, maxval, format, 0); +--- editor/pnmcut.c ++++ editor/pnmcut.c +@@ -373,6 +373,7 @@ + toprow, leftcol, bottomrow, rightcol); + } + ++ overflow_add(rightcol, 1); + output_cols = rightcol-leftcol+1; + output_row = pnm_allocrow(output_cols); + +--- editor/pnmgamma.c ++++ editor/pnmgamma.c +@@ -280,6 +280,7 @@ + xelval **rtableP, xelval **gtableP, xelval **btableP) { + + /* Allocate space for the tables. */ ++ overflow_add(maxval, 1); + MALLOCARRAY(*rtableP, maxval+1); + MALLOCARRAY(*gtableP, maxval+1); + MALLOCARRAY(*btableP, maxval+1); +--- editor/pnmhisteq.c ++++ editor/pnmhisteq.c +@@ -210,6 +210,7 @@ + user has specified an input map file, read it in at + this point. */ + ++ overflow_add(maxval, 1); + lumahist = (long *) pm_allocrow(maxval + 1, sizeof(long)); + memset((char *) lumahist, 0, (maxval + 1) * sizeof(long)); + +--- editor/pnmindex.csh ++++ editor/pnmindex.csh +@@ -1,5 +1,8 @@ + #!/bin/csh -f + # ++echo "Unsafe code, needs debugging, do not ship" ++exit 1 ++# + # pnmindex - build a visual index of a bunch of anymaps + # + # Copyright (C) 1991 by Jef Poskanzer. +--- editor/pnmpad.c ++++ editor/pnmpad.c +@@ -356,6 +356,8 @@ + + computePadSizes(cmdline, cols, rows, &lpad, &rpad, &tpad, &bpad); + ++ overflow_add(cols, lpad); ++ overflow_add(cols + lpad, rpad); + newcols = cols + lpad + rpad; + xelrow = pnm_allocrow(newcols); + bgrow = pnm_allocrow(newcols); +--- editor/pnmpaste.c ++++ editor/pnmpaste.c +@@ -100,11 +100,16 @@ + "y is too large -- the second anymap has only %d rows", + rows2 ); + ++ overflow_add(x, cols2); ++ overflow_add(y, rows2); + if ( x < 0 ) + x += cols2; + if ( y < 0 ) + y += rows2; + ++ overflow_add(x, cols1); ++ overflow_add(y, rows1); ++ + if ( x + cols1 > cols2 ) + pm_error( "x + width is too large by %d pixels", x + cols1 - cols2 ); + if ( y + rows1 > rows2 ) +--- editor/pnmremap.c ++++ editor/pnmremap.c +@@ -228,6 +228,7 @@ + + unsigned int const fserrSize = pamP->width + 2; + ++ overflow_add(pamP->width, 2); + MALLOCARRAY(fserrP->thiserr, pamP->depth); + if (fserrP->thiserr == NULL) + pm_error("Out of memory allocating Floyd-Steinberg structures"); +@@ -267,6 +268,7 @@ + + int col; + ++ overflow_add(pamP->width, 2); + for (col = 0; col < pamP->width + 2; ++col) { + unsigned int plane; + for (plane = 0; plane < pamP->depth; ++plane) +--- editor/pnmrotate.c ++++ editor/pnmrotate.c +@@ -11,6 +11,7 @@ + */ + + #include ++#include + + #include "pnm.h" + #include "shhopt.h" +@@ -572,8 +573,16 @@ + yshearfac = sin(cmdline.angle); + if (yshearfac < 0.0) + yshearfac = -yshearfac; ++ ++ if (rows * xshearfac + cols + 0.999999 >= INT_MAX) ++ pm_error("image too large"); ++ + tempcols = rows * xshearfac + cols + 0.999999; + yshearjunk = (tempcols - cols) * yshearfac; ++ ++ if (tempcols * yshearfac + rows + 0.999999 >= INT_MAX) ++ pm_error("image too large"); ++ + newrows = tempcols * yshearfac + rows + 0.999999; + x2shearjunk = (newrows - rows - yshearjunk) * xshearfac; + newrows -= 2 * yshearjunk; +--- editor/pnmscalefixed.c ++++ editor/pnmscalefixed.c +@@ -209,6 +209,8 @@ + const int rows, const int cols, + int * newrowsP, int * newcolsP) { + ++ overflow2(rows, cols); ++ + if (cmdline.pixels) { + if (rows * cols <= cmdline.pixels) { + *newrowsP = rows; +@@ -260,6 +262,8 @@ + + if (*newcolsP < 1) *newcolsP = 1; + if (*newrowsP < 1) *newrowsP = 1; ++ ++ overflow2(*newcolsP, *newrowsP); + } + + +@@ -441,6 +445,9 @@ + unfilled. We can address that by stretching, whereas the other + case would require throwing away some of the input. + */ ++ ++ overflow2(newcols, SCALE); ++ overflow2(newrows, SCALE); + sxscale = SCALE * newcols / cols; + syscale = SCALE * newrows / rows; + +--- editor/pnmshear.c ++++ editor/pnmshear.c +@@ -12,6 +12,7 @@ + + #include + #include ++#include + + #include "pnm.h" + #include "shhopt.h" +@@ -198,6 +199,11 @@ + if ( shearfac < 0.0 ) + shearfac = -shearfac; + ++ if(rows * shearfac >= INT_MAX-1) ++ pm_error("image too large"); ++ ++ overflow_add(rows * shearfac, cols+1); ++ + newcols = rows * shearfac + cols + 0.999999; + + pnm_writepnminit( stdout, newcols, rows, newmaxval, newformat, 0 ); +--- editor/ppmdither.c ++++ editor/ppmdither.c +@@ -111,6 +111,9 @@ + (dith_dim * sizeof(int *)) + /* pointers */ + (dith_dim * dith_dim * sizeof(int)); /* data */ + ++ overflow2(dith_dim, sizeof(int *)); ++ overflow3(dith_dim, dith_dim, sizeof(int)); ++ overflow_add(dith_dim * sizeof(int *), dith_dim * dith_dim * sizeof(int)); + dith_mat = (unsigned int **) malloc(dith_mat_sz); + + if (dith_mat == NULL) +--- generator/pbmpage.c ++++ generator/pbmpage.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include "pbm.h" + + /* Support both US and A4. */ +@@ -161,6 +162,9 @@ + /* We round the allocated row space up to a multiple of 8 so the ugly + fast code below can work. + */ ++ ++ overflow_add(Width, 7); ++ + pbmrow = pbm_allocrow(((Width+7)/8)*8); + + bitmap_cursor = 0; +--- generator/pbmtext.c ++++ generator/pbmtext.c +@@ -89,12 +89,14 @@ + + for (i = 1; i < argc; i++) { + if (i > 1) { ++ overflow_add(totaltextsize, 1); + totaltextsize += 1; + text = realloc(text, totaltextsize); + if (text == NULL) + pm_error("out of memory allocating space for input text"); + strcat(text, " "); + } ++ overflow_add(totaltextsize, strlen(argv[i])); + totaltextsize += strlen(argv[i]); + text = realloc(text, totaltextsize); + if (text == NULL) +@@ -594,7 +596,9 @@ + while (fgets(buf, sizeof(buf), stdin) != NULL) { + fix_control_chars(buf, fn); + if (lineCount >= maxlines) { ++ overflow2(maxlines, 2); + maxlines *= 2; ++ overflow2(maxlines, sizeof(char*)); + text_array = (char**) realloc((char*) text_array, + maxlines * sizeof(char*)); + if (text_array == NULL) +@@ -680,6 +684,7 @@ + hmargin = fontP->maxwidth; + } else { + vmargin = fontP->maxheight; ++ overflow2(2, fontP->maxwidth); + hmargin = 2 * fontP->maxwidth; + } + } +@@ -695,12 +700,19 @@ + } else + lp = input_text; + ++ overflow2(2, vmargin); ++ overflow2(lp.lineCount, fontP->maxheight); ++ overflow_add(vmargin * 2, lp.lineCount * fontP->maxheight); ++ overflow2(lp.lineCount-1, cmdline.lspace); ++ overflow_add(2 * vmargin + lp.lineCount * fontP->maxheight, (lp.lineCount-1) * cmdline.lspace); + rows = 2 * vmargin + + lp.lineCount * fontP->maxheight + + (lp.lineCount-1) * cmdline.lspace; + + compute_image_width(lp, fontP, cmdline.space, &maxwidth, &maxleftb); + ++ overflow2(2, hmargin); ++ overflow_add(2*hmargin, maxwidth); + cols = 2 * hmargin + maxwidth; + bits = pbm_allocarray(cols, rows); + +--- generator/pgmcrater.c ++++ generator/pgmcrater.c +@@ -131,6 +131,7 @@ + /* Acquire the elevation array and initialise it to mean + surface elevation. */ + ++ overflow2(SCRX, SCRY); + MALLOCARRAY(aux, SCRX * SCRY); + if (aux == NULL) + pm_error("out of memory allocating elevation array"); +--- generator/pgmkernel.c ++++ generator/pgmkernel.c +@@ -68,6 +68,7 @@ + kycenter = (fysize - 1) / 2.0; + ixsize = fxsize + 0.999; + iysize = fysize + 0.999; ++ overflow2(ixsize, iysize); + MALLOCARRAY(fkernel, ixsize * iysize); + for (i = 0; i < iysize; i++) + for (j = 0; j < ixsize; j++) { +--- generator/ppmforge.c ++++ generator/ppmforge.c +@@ -418,7 +418,7 @@ + + if (UINT_MAX / n < n) + pm_error("arithmetic overflow squaring %u", n); +- cp = malloc(n * n); ++ cp = malloc2(n,n); + if (cp == NULL) + pm_error("Unable to allocate %u bytes for cp array", n); + +--- lib/libpam.c ++++ lib/libpam.c +@@ -273,7 +273,8 @@ + themselves. Each tuple consists of 'depth' samples. + */ + +- tuplerow = malloc(pamP->width * (sizeof(tuple *) + bytes_per_tuple)); ++ overflow_add(sizeof(tuple *), bytes_per_tuple); ++ tuplerow = malloc2(pamP->width, sizeof(tuple *) + bytes_per_tuple); + if (tuplerow == NULL) + pm_error("Out of memory allocating space for a tuple row of\n" + "%d tuples by %d samples per tuple by %d bytes per sample.", +--- lib/libpammap.c ++++ lib/libpammap.c +@@ -315,7 +315,11 @@ + as a single malloc block and suballocate internally. + */ + +- pool = malloc(mainTableSize + size * tupleIntSize); ++ overflow2(pamP->depth, sizeof(sample)); ++ overflow_add(pamP->depth*sizeof(sample), ++ sizeof(struct tupleint) - sizeof(sample)); ++ overflow_add(mainTableSize, size); ++ pool = malloc2(mainTableSize + size, tupleIntSize); + + retval = (tupletable) pool; + +--- lib/libpbm1.c ++++ lib/libpbm1.c +@@ -58,6 +58,8 @@ + pm_message("pm_filepos passed to pm_check() is %u bytes", + sizeof(pm_filepos)); + #endif ++ overflow2(bytes_per_row, rows); ++ + pm_check(file, check_type, need_raster_size, retval_p); + } + } +--- lib/libpbmvms.c ++++ lib/libpbmvms.c +@@ -1,3 +1,5 @@ ++#warning "NOT AUDITED" ++ + /*************************************************************************** + This file contains library routines needed to build Netpbm for VMS. + However, as of 2000.05.26, when these were split out of libpbm1.c +--- lib/libpm.c ++++ lib/libpm.c +@@ -35,6 +35,7 @@ + /* This makes the the x64() functions available on AIX */ + + #include ++#include + #include "version.h" + #include "compile.h" + #include "nstring.h" +@@ -122,7 +123,7 @@ + pm_allocrow(int const cols, int const size) { + char * itrow; + +- itrow = malloc( cols * size ); ++ itrow = malloc2( cols , size ); + if ( itrow == NULL ) + pm_error( "out of memory allocating a row" ); + return itrow; +@@ -158,11 +159,13 @@ + char** rowIndex; + char * rowheap; + ++ ++ overflow_add(rows, 1); + MALLOCARRAY(rowIndex, rows + 1); + if ( rowIndex == NULL ) + pm_error("out of memory allocating row index (%u rows) for an array", + rows); +- rowheap = malloc( rows * cols * size ); ++ rowheap = malloc3( rows, cols, size ); + if ( rowheap == NULL ) { + /* We couldn't get the whole heap in one block, so try fragmented + format. +@@ -1014,7 +1017,7 @@ + + long filepos; + +- pm_tell2(fileP, (pm_filepos *)&filepos, sizeof(filepos)); ++ pm_tell2(fileP, (pm_filepos *)(void *)&filepos, sizeof(filepos)); + + return filepos; + } +@@ -1171,4 +1174,53 @@ + } + + ++/* ++ * Maths wrapping ++ */ ++ ++void overflow2(int a, int b) ++{ ++ if(a < 0 || b < 0) ++ pm_error("object too large"); ++ if(b == 0) ++ return; ++ if(a > INT_MAX / b) ++ pm_error("object too large"); ++} ++ ++void overflow3(int a, int b, int c) ++{ ++ overflow2(a,b); ++ overflow2(a*b, c); ++} ++ ++void overflow_add(int a, int b) ++{ ++ if( a > INT_MAX - b) ++ pm_error("object too large"); ++} ++ ++void *malloc2(int a, int b) ++{ ++ overflow2(a, b); ++ if(a*b == 0) ++ pm_error("Zero byte allocation"); ++ return malloc(a*b); ++} ++ ++void *malloc3(int a, int b, int c) ++{ ++ overflow3(a, b, c); ++ if(a*b*c == 0) ++ pm_error("Zero byte allocation"); ++ return malloc(a*b*c); ++} ++ ++void *realloc2(void * a, int b, int c) ++{ ++ overflow2(b, c); ++ if(b*c == 0) ++ pm_error("Zero byte allocation"); ++ return realloc(a, b*c); ++} + +--- lib/pm.h ++++ lib/pm.h +@@ -161,6 +161,12 @@ + pm_closew (FILE* const f); + + ++void *malloc2(int, int); ++void *malloc3(int, int, int); ++void overflow2(int, int); ++void overflow3(int, int, int); ++void overflow_add(int, int); ++void *realloc2(void *, int, int); + + int + pm_readbigshort(FILE * const in, +--- lib/util/mallocvar.h ++++ lib/util/mallocvar.h +@@ -51,7 +51,7 @@ + + + #define MALLOCARRAY(arrayName, nElements) \ +- mallocProduct((void **)&arrayName, nElements, sizeof(arrayName[0])) ++ mallocProduct((void **)(void *)&arrayName, nElements, sizeof(arrayName[0])) + + #define REALLOCARRAY(arrayName, nElements) \ + reallocProduct((void **)&arrayName, nElements, sizeof(arrayName[0])) +--- other/pnmcolormap.c ++++ other/pnmcolormap.c +@@ -788,6 +788,7 @@ + pamP->width = intsqrt; + else + pamP->width = intsqrt + 1; ++ overflow_add(intsqrt, 1); + } + { + unsigned int const intQuotient = colormapSize / pamP->width; +--- urt/README ++++ urt/README +@@ -18,3 +18,8 @@ + defines stdout as a variable, so that wouldn't compile. So I changed + it to NULL and added a line to rle_hdr_init to set that field to + 'stdout' dynamically. 2000.06.02 BJH. ++ ++Redid the code to check for maths overflows and other crawly horrors. ++Removed pipe through and compress support (unsafe) ++ ++Alan Cox +--- urt/Runput.c ++++ urt/Runput.c +@@ -17,6 +17,8 @@ + * + * Modified at BRL 16-May-88 by Mike Muuss to avoid Alliant STDC desire + * to have all "void" functions so declared. ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox + */ + /* + * Runput.c - General purpose Run Length Encoding. +@@ -200,9 +202,11 @@ + if ( the_hdr->background != 0 ) + { + register int i; +- register rle_pixel *background = +- (rle_pixel *)malloc( (unsigned)(the_hdr->ncolors + 1) ); ++ register rle_pixel *background; + register int *bg_color; ++ ++ overflow_add(the_hdr->ncolors,1); ++ background = (rle_pixel *)malloc( (unsigned)(the_hdr->ncolors + 1) ); + /* + * If even number of bg color bytes, put out one more to get to + * 16 bit boundary. +@@ -222,7 +226,7 @@ + /* Big-endian machines are harder */ + register int i, nmap = (1 << the_hdr->cmaplen) * + the_hdr->ncmap; +- register char *h_cmap = (char *)malloc( nmap * 2 ); ++ register char *h_cmap = (char *)malloc2( nmap, 2 ); + if ( h_cmap == NULL ) + { + fprintf( stderr, +--- urt/rle.h ++++ urt/rle.h +@@ -14,6 +14,9 @@ + * If you modify this software, you should include a notice giving the + * name of the person performing the modification, the date of modification, + * and the reason for such modification. ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox ++ * Header declarations needed + */ + /* + * rle.h - Global declarations for Utah Raster Toolkit RLE programs. +@@ -169,6 +172,16 @@ + */ + extern rle_hdr rle_dflt_hdr; + ++/* ++ * Provided by pm library ++ */ ++ ++extern void overflow_add(int, int); ++extern void overflow2(int, int); ++extern void overflow3(int, int, int); ++extern void *malloc2(int, int); ++extern void *malloc3(int, int, int); ++extern void *realloc2(void *, int, int); + + /* Declare RLE library routines. */ + +--- urt/rle_addhist.c ++++ urt/rle_addhist.c +@@ -14,6 +14,8 @@ + * If you modify this software, you should include a notice giving the + * name of the person performing the modification, the date of modification, + * and the reason for such modification. ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox + */ + /* + * rle_addhist.c - Add to the HISTORY comment in header +@@ -69,18 +71,29 @@ + + length=0; + for(i=0;argv[i];i++) ++ { ++ overflow_add(length, strlen(argv[i])); ++ overflow_add(length+1, strlen(argv[i])); + length+= strlen(argv[i]) +1; /* length of each arg plus space. */ +- ++ } + (void)time (&temp); + timedate=ctime(&temp); + length+= strlen(timedate); /* length of date and time in ASCII. */ + ++ overflow_add(strlen(padding), 4); ++ overflow_add(strlen(padding) + 4, strlen(histoire)); ++ overflow_add(length, strlen(padding) + 4 + strlen(histoire)); + length+= strlen(padding) + 3 + strlen(histoire) + 1; /* length of padding, "on " and length of history name plus "="*/ + if(in_hdr) /* if we are interested in the old comments... */ + old=rle_getcom(histoire,in_hdr); /* get old comment. */ + +- if((old) && (*old)) length+= strlen(old); /* add length if there. */ ++ if((old) && (*old)) ++ { ++ overflow_add(length, strlen(old)); ++ length+= strlen(old); /* add length if there. */ ++ } + ++ overflow_add(length, 1); + length++; /*Cater for the null. */ + + if((newc=(char *)malloc((unsigned int) length)) == NULL)return; +@@ -95,5 +108,4 @@ + (void)strcat(newc,padding); /* to line up multiple histories.*/ + + (void)rle_putcom(newc,out_hdr); +- + } +--- urt/rle_getrow.c ++++ urt/rle_getrow.c +@@ -17,6 +17,8 @@ + * + * Modified at BRL 16-May-88 by Mike Muuss to avoid Alliant STDC desire + * to have all "void" functions so declared. ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox + */ + /* + * rle_getrow.c - Read an RLE file in. +--- urt/rle_hdr.c ++++ urt/rle_hdr.c +@@ -14,6 +14,8 @@ + * If you modify this software, you should include a notice giving the + * name of the person performing the modification, the date of modification, + * and the reason for such modification. ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox + */ + /* + * rle_hdr.c - Functions to manipulate rle_hdr structures. +@@ -77,7 +79,10 @@ + /* Fill in with copies of the strings. */ + if ( the_hdr->cmd != pgmname ) + { +- char *tmp = (char *)malloc( strlen( pgmname ) + 1 ); ++ char *tmp ; ++ ++ overflow_add(strlen(pgmname), 1); ++ tmp = malloc( strlen( pgmname ) + 1 ); + RLE_CHECK_ALLOC( pgmname, tmp, 0 ); + strcpy( tmp, pgmname ); + the_hdr->cmd = tmp; +@@ -85,7 +90,9 @@ + + if ( the_hdr->file_name != fname ) + { +- char *tmp = (char *)malloc( strlen( fname ) + 1 ); ++ char *tmp; ++ overflow_add(strlen(fname), 1); ++ tmp = malloc( strlen( fname ) + 1 ); + RLE_CHECK_ALLOC( pgmname, tmp, 0 ); + strcpy( tmp, fname ); + the_hdr->file_name = tmp; +@@ -150,6 +157,7 @@ + if ( to_hdr->bg_color ) + { + int size = to_hdr->ncolors * sizeof(int); ++ overflow2(to_hdr->ncolors, sizeof(int)); + to_hdr->bg_color = (int *)malloc( size ); + RLE_CHECK_ALLOC( to_hdr->cmd, to_hdr->bg_color, "background color" ); + memcpy( to_hdr->bg_color, from_hdr->bg_color, size ); +@@ -158,7 +166,7 @@ + if ( to_hdr->cmap ) + { + int size = to_hdr->ncmap * (1 << to_hdr->cmaplen) * sizeof(rle_map); +- to_hdr->cmap = (rle_map *)malloc( size ); ++ to_hdr->cmap = (rle_map *)malloc3( to_hdr->ncmap, 1<cmaplen, sizeof(rle_map)); + RLE_CHECK_ALLOC( to_hdr->cmd, to_hdr->cmap, "color map" ); + memcpy( to_hdr->cmap, from_hdr->cmap, size ); + } +@@ -171,11 +179,16 @@ + int size = 0; + CONST_DECL char **cp; + for ( cp=to_hdr->comments; *cp; cp++ ) ++ { ++ overflow_add(size, 1); + size++; /* Count the comments. */ ++ } + /* Check if there are really any comments. */ + if ( size ) + { ++ overflow_add(size, 1); + size++; /* Copy the NULL pointer, too. */ ++ overflow2(size, sizeof(char *)); + size *= sizeof(char *); + to_hdr->comments = (CONST_DECL char **)malloc( size ); + RLE_CHECK_ALLOC( to_hdr->cmd, to_hdr->comments, "comments" ); +--- urt/rle_open_f.c ++++ urt/rle_open_f.c +@@ -6,6 +6,9 @@ + * University of Michigan + * Date: 11/14/89 + * Copyright (c) 1990, University of Michigan ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox ++ * Killed of crazy unsafe pipe/compress stuff + */ + + #include "rle.h" +@@ -184,7 +187,7 @@ + + cp = file_name + strlen( (char*) file_name ) - 2; + /* Pipe case. */ +- if ( *file_name == '|' ) ++ if ( *file_name == '|' && 0 /* BOLLOCKS ARE WE DOING THIS ANY MORE */) + { + int thepid; /* PID from my_popen */ + if ( (fp = my_popen( file_name + 1, mode, &thepid )) == NULL ) +@@ -199,9 +202,10 @@ + } + + /* Compress case. */ +- else if ( cp > file_name && *cp == '.' && *(cp + 1) == 'Z' ) ++ else if (/* SMOKING SOMETHING */ 0 && cp > file_name && *cp == '.' && *(cp + 1) == 'Z' ) + { + int thepid; /* PID from my_popen. */ ++ overflow_add(20, strlen(file_name)); + combuf = (char *)malloc( 20 + strlen( file_name ) ); + if ( combuf == NULL ) + { +--- urt/rle_putcom.c ++++ urt/rle_putcom.c +@@ -14,6 +14,8 @@ + * If you modify this software, you should include a notice giving the + * name of the person performing the modification, the date of modification, + * and the reason for such modification. ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox + */ + /* + * rle_putcom.c - Add a picture comment to the header struct. +@@ -89,19 +91,22 @@ + + if ( the_hdr->comments == NULL ) + { +- the_hdr->comments = (CONST_DECL char **)malloc( 2 * sizeof(char *) ); ++ the_hdr->comments = (CONST_DECL char **)malloc2( 2, sizeof(char *) ); + the_hdr->comments[0] = value; + the_hdr->comments[1] = NULL; + } + else + { + for ( i = 2, cp = the_hdr->comments; *cp != NULL; i++, cp++ ) ++ { ++ overflow_add(i, 1); + if ( match( value, *cp ) != NULL ) + { + v = *cp; + *cp = value; + return v; + } ++ } + /* Not found */ + /* Can't realloc because somebody else might be pointing to this + * comments block. Of course, if this were true, then the +@@ -111,7 +116,7 @@ + * could copy the pointers, too. + */ + old_comments = the_hdr->comments; +- the_hdr->comments = (CONST_DECL char **)malloc(i * sizeof(char *) ); ++ the_hdr->comments = (CONST_DECL char **)malloc2(i , sizeof(char *) ); + the_hdr->comments[--i] = NULL; + the_hdr->comments[--i] = value; + for ( i--; i >= 0; i-- ) +--- urt/scanargs.c ++++ urt/scanargs.c +@@ -38,6 +38,8 @@ + * + * Modified at BRL 16-May-88 by Mike Muuss to avoid Alliant STDC desire + * to have all "void" functions so declared. ++ * ++ * 2002-12-19: Fix maths wrapping bugs. Alan Cox + */ + + #include "rle.h" +@@ -65,8 +67,8 @@ + /* + * Storage allocation macros + */ +-#define NEW( type, cnt ) (type *) malloc( (cnt) * sizeof( type ) ) +-#define RENEW( type, ptr, cnt ) (type *) realloc( ptr, (cnt) * sizeof( type ) ) ++#define NEW( type, cnt ) (type *) malloc2( (cnt) , sizeof( type ) ) ++#define RENEW( type, ptr, cnt ) (type *) realloc2( ptr, (cnt), sizeof( type ) ) + + #if defined(c_plusplus) && !defined(USE_PROTOTYPES) + #define USE_PROTOTYPES diff --git a/netpbm-10.26.22-pamtouil.patch b/netpbm-10.26.22-pamtouil.patch new file mode 100644 index 0000000..03e6293 --- /dev/null +++ b/netpbm-10.26.22-pamtouil.patch @@ -0,0 +1,11 @@ +--- converter/other/pamtouil.c ++++ converter/other/pamtouil.c +@@ -94,7 +94,7 @@ + + /* Remove trailing "_icon" */ + barPos = strrchr(cmdlineP->outname, '_'); +- if (strcmp(barPos, "_icon") == 0) ++ if (barPos && strcmp(barPos, "_icon") == 0) + *barPos = '\0'; + } else { + if (strcmp(cmdlineP->inputFilespec, "-") == 0) diff --git a/netpbm-10.26.22-pbmtext.patch b/netpbm-10.26.22-pbmtext.patch new file mode 100644 index 0000000..64544aa --- /dev/null +++ b/netpbm-10.26.22-pbmtext.patch @@ -0,0 +1,21 @@ +--- generator/pbmtext.c ++++ generator/pbmtext.c +@@ -217,7 +217,7 @@ + /* logical: we haven't seen any renderable characters yet in + the line. + */ +- struct glyph * lastGlyphP; ++ struct glyph * lastGlyphP = NULL; + /* Glyph of last character processed so far. Undefined if + 'no_chars_yet'. + */ +@@ -248,8 +248,8 @@ + *bwid_p += full_pixels; + accumulated_ics -= full_pixels; + } +- lastGlyphP = glyphP; + } ++ lastGlyphP = glyphP; + *bwid_p += glyphP->xadd; + } + } diff --git a/netpbm-10.26.22-pnmtopng-CAN-2005-2978.patch b/netpbm-10.26.22-pnmtopng-CAN-2005-2978.patch new file mode 100644 index 0000000..25b9d9e --- /dev/null +++ b/netpbm-10.26.22-pnmtopng-CAN-2005-2978.patch @@ -0,0 +1,20 @@ +--- converter/other/pnmtopng.c.pnmtopng 2004-08-28 04:53:12.000000000 +0200 ++++ converter/other/pnmtopng.c 2005-09-16 14:17:47.129390456 +0200 +@@ -159,7 +159,7 @@ + unsigned int * const bestMatchP) { + + unsigned int paletteIndex; +- unsigned int bestIndex; ++ unsigned int bestIndex = 0; + unsigned int bestMatch; + + bestMatch = UINT_MAX; +@@ -1566,7 +1566,7 @@ + /* The color part of the color/alpha palette passed to the PNG + compressor + */ +- unsigned int palette_size; ++ unsigned int palette_size = MAXCOLORS; + + gray trans_pnm[MAXCOLORS]; + png_byte trans[MAXCOLORS]; diff --git a/netpbm-10.26.22-pnmtopng-overflow.patch b/netpbm-10.26.22-pnmtopng-overflow.patch new file mode 100644 index 0000000..afe04bd --- /dev/null +++ b/netpbm-10.26.22-pnmtopng-overflow.patch @@ -0,0 +1,14 @@ +--- converter/other/pnmtopng.c ++++ converter/other/pnmtopng.c +@@ -913,9 +913,9 @@ + colorhist_vector chv; + unsigned int colors; + +- gray *alphas_of_color[MAXPALETTEENTRIES]; ++ gray *alphas_of_color[MAXPALETTEENTRIES + 1]; + unsigned int alphas_first_index[MAXPALETTEENTRIES]; +- unsigned int alphas_of_color_cnt[MAXPALETTEENTRIES]; ++ unsigned int alphas_of_color_cnt[MAXPALETTEENTRIES + 1]; + + getChv(ifP, imagepos, cols, rows, maxval, format, MAXCOLORS, + &chv, &colors); diff --git a/netpbm-10.26.22-pnmtopng-transparent.patch b/netpbm-10.26.22-pnmtopng-transparent.patch new file mode 100644 index 0000000..f1f2fc7 --- /dev/null +++ b/netpbm-10.26.22-pnmtopng-transparent.patch @@ -0,0 +1,20 @@ +--- converter/other/pnmtopng.c ++++ converter/other/pnmtopng.c +@@ -1322,7 +1322,7 @@ + computePixelWidth(PNM_FORMAT_TYPE(format), pnm_meaningful_bits, alpha, + NULL, &bitsPerPixel); + +- if (!pfP && bitsPerPixel == 1) ++ if (0/*!pfP && bitsPerPixel == 1*/) + /* No palette can beat 1 bit per pixel -- no need to waste time + counting the colors. + */ +@@ -1345,7 +1345,7 @@ + "colormapped PNG", MAXCOLORS); + } else { + /* There are few enough colors that a palette is possible */ +- if (bitsPerPixel <= paletteIndexBits(colors) && !pfP) ++ if (0/*bitsPerPixel <= paletteIndexBits(colors) && !pfP*/) + asprintfN(noColormapReasonP, + "palette index for %u colors would be " + "no smaller than the indexed value (%u bits)", diff --git a/netpbm-10.26.22-pstopnm-gs-options.patch b/netpbm-10.26.22-pstopnm-gs-options.patch new file mode 100644 index 0000000..a199fa9 --- /dev/null +++ b/netpbm-10.26.22-pstopnm-gs-options.patch @@ -0,0 +1,19 @@ +--- converter/other/pstopnm.c ++++ converter/other/pstopnm.c +@@ -702,13 +702,13 @@ + + if (verbose) { + pm_message("execing '%s' with args '%s' (arg 0), " +- "'%s', '%s', '%s', '%s', '%s', '%s', '%s'", ++ "'%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s'", + ghostscriptProg, arg0, +- deviceopt, outfileopt, gopt, ropt, "-q", "-dNOPAUSE", "-"); ++ deviceopt, outfileopt, gopt, ropt, "-q", "-dNOPAUSE", "-dSAFER", "-"); + } + + execl(ghostscriptProg, arg0, deviceopt, outfileopt, gopt, ropt, "-q", +- "-dNOPAUSE", "-", NULL); ++ "-dNOPAUSE", "-dSAFER", "-", NULL); + + pm_error("execl() of Ghostscript ('%s') failed, errno=%d (%s)", + ghostscriptProg, errno, strerror(errno)); diff --git a/netpbm-10.26.22-rgb.patch b/netpbm-10.26.22-rgb.patch new file mode 100644 index 0000000..d2ba907 --- /dev/null +++ b/netpbm-10.26.22-rgb.patch @@ -0,0 +1,11 @@ +--- pm_config.in.h ++++ pm_config.in.h +@@ -99,7 +99,7 @@ + #define RGB_DB2 "PBMplus_Dir:RGB.TXT" + #define RGB_DB3 "PBMplus_Dir:RGB.TXT" + #else +-#define RGB_DB1 "/usr/lib/X11/rgb.txt" ++#define RGB_DB1 "/usr/share/X11/rgb.txt" + #define RGB_DB2 "/usr/openwin/lib/rgb.txt" + #define RGB_DB3 "/usr/X11R6/lib/X11/rgb.txt" + #endif diff --git a/netpbm-10.26.22-tmpfile.patch b/netpbm-10.26.22-tmpfile.patch new file mode 100644 index 0000000..bf78079 --- /dev/null +++ b/netpbm-10.26.22-tmpfile.patch @@ -0,0 +1,47 @@ +--- editor/pnmindex.csh ++++ editor/pnmindex.csh +@@ -88,7 +88,7 @@ + goto usage + endif + +-set tmpfile=/tmp/pi.tmp.$$ ++set tmpfile=.pi.tmp.$$ + rm -f $tmpfile + set maxformat=PBM + +--- editor/ppmquantall.csh ++++ editor/ppmquantall.csh +@@ -34,8 +34,8 @@ + set heights=( $heights `sed '1d; s/.* //; 2q' $i` ) + end + +-set all=/tmp/pqa.all.$$ +-rm -f $all ++set all=.pqa.all.$$ ++ + pnmcat -topbottom -jleft -white $files | ppmquant -quiet $newcolors > $all + if ( $status != 0 ) exit $status + +--- generator/ppmrainbow ++++ generator/ppmrainbow +@@ -39,7 +39,13 @@ + push @colorlist, $ARGV[0]; + } + +-my $tmpprefix = $tmpdir . "/$myname.$$."; ++my $mytmpdir; ++chomp($mytmpdir = `mktemp -d $tmpdir/ppmrainbow.XXXXXX`); ++if ($? >> 8) { ++ die "Can't create tmpdir"; ++} ++ ++my $tmpprefix = $mytmpdir . "/file."; + + my $widthRemaining; + my $n; +@@ -71,4 +77,5 @@ + + END { + unlink @outlist if @outlist; ++ rmdir $mytmpdir if -d $mytmpdir; + } diff --git a/netpbm-10.26.22-ximtoppm-fixes.patch b/netpbm-10.26.22-ximtoppm-fixes.patch new file mode 100644 index 0000000..9b2364c --- /dev/null +++ b/netpbm-10.26.22-ximtoppm-fixes.patch @@ -0,0 +1,13 @@ +--- converter/ppm/ximtoppm.c ++++ converter/ppm/ximtoppm.c +@@ -56,6 +56,10 @@ + OPTENT3(0, "alphaout", OPT_STRING, + &cmdlineP->alpha_filename, &alphaoutSpec, 0); + ++ opt.opt_table = option_def; ++ opt.short_allowed = FALSE; /* We have no short (old-fashioned) options */ ++ opt.allowNegNum = FALSE; /* We may have parms that are negative numbers */ ++ + optParseOptions3(&argc, argv, opt, sizeof(opt), 0); + /* Uses and sets argc, argv, and all of *cmdlineP. */ + diff --git a/netpbm-10.26.22.dif b/netpbm-10.26.22.dif new file mode 100644 index 0000000..3a77c4a --- /dev/null +++ b/netpbm-10.26.22.dif @@ -0,0 +1,59 @@ +--- Makefile.config.in ++++ Makefile.config.in +@@ -78,7 +78,7 @@ + #OSF1: + #INSTALL = $(SRCDIR)/buildtools/installosf + #Red Hat Linux: +-#INSTALL = install ++INSTALL = install + + # STRIPFLAG is the option you pass to the above install program to make it + # strip unnecessary information out of binaries. +@@ -218,9 +218,9 @@ + # copy of Pbmtext used 16K less real memory when built with -fpic than + # when built without. 2001.06.02. + +-CFLAGS_SHLIB = ++# CFLAGS_SHLIB = + # Solaris or SunOS with gcc, and NetBSD: +-#CFLAGS_SHLIB = -fpic ++CFLAGS_SHLIB = -fPIC + #CFLAGS_SHLIB = -fPIC + # Sun compiler: + #CFLAGS_SHLIB = -Kpic +@@ -288,7 +288,7 @@ + # The TIFF library. See above. If you want to build the tiff + # converters, you must have the tiff library already installed. + +-TIFFLIB = NONE ++TIFFLIB = libtiff.so + TIFFHDR_DIR = + + #TIFFLIB = libtiff.so +@@ -318,7 +318,7 @@ + # JPEG stuff statically linked in, in which case you won't need + # JPEGLIB in order to build the Tiff converters. + +-JPEGLIB = NONE ++JPEGLIB = libjpeg.so + JPEGHDR_DIR = + #JPEGLIB = libjpeg.so + #JPEGHDR_DIR = /usr/include/jpeg +@@ -342,7 +342,7 @@ + # with names that include a version number, such as libpng10.a and header + # files in /usr/include/libpng10. + # option. +-PNGLIB = NONE ++PNGLIB = libpng.so + PNGHDR_DIR = + PNGVER = + #PNGLIB = libpng$(PNGVER).so +@@ -359,7 +359,7 @@ + # NONE for the PNG library, it doesn't matter what you specify here -- + # it won't get used. + +-ZLIB = NONE ++ZLIB = libz.so + ZHDR_DIR = + #ZLIB = libz.so + diff --git a/netpbm.changes b/netpbm.changes new file mode 100644 index 0000000..fe4ffe1 --- /dev/null +++ b/netpbm.changes @@ -0,0 +1,384 @@ +------------------------------------------------------------------- +Wed Dec 6 11:21:08 CET 2006 - prusnak@suse.cz + +- fixed pamtouil crash when -name was specified (pamtouil.patch) +- changed transparency handling (pnmtopng-transparent.patch) [#225258] + +------------------------------------------------------------------- +Thu Nov 30 17:34:42 CET 2006 - prusnak@suse.cz + +- fixed missing manpages [#224478] +- fixed segfault in pbmtext [#224420] + +------------------------------------------------------------------- +Tue Nov 14 14:52:55 CET 2006 - prusnak@suse.cz + +- fixed [#216670] + - removed man pages that pointed to online documentation (manpages.patch) + - added man pages generated from HTML documentation (manpages.tar.bz2) + +------------------------------------------------------------------- +Thu Mar 23 17:12:34 CET 2006 - nadvornik@suse.cz + +- fixed uninitialized variables [#155948] + +------------------------------------------------------------------- +Wed Jan 25 21:38:39 CET 2006 - mls@suse.de + +- converted neededforbuild to BuildRequires + +------------------------------------------------------------------- +Thu Jan 12 16:31:23 CET 2006 - nadvornik@suse.cz + +- compile with -fstack-protector + +------------------------------------------------------------------- +Thu Jan 5 17:46:45 CET 2006 - nadvornik@suse.cz + +- updated to 10.26.22 + +------------------------------------------------------------------- +Tue Nov 15 19:17:40 CET 2005 - nadvornik@suse.cz + +- fixed possible buffer overflow [#133649] + +------------------------------------------------------------------- +Thu Oct 13 11:33:28 CEST 2005 - nadvornik@suse.cz + +- fixed possible buffer overflow (CAN-2005-2978) [#119601] + +------------------------------------------------------------------- +Mon Sep 26 17:52:57 CEST 2005 - nadvornik@suse.cz + +- fixed fiasco on bigendian [#105431] + +------------------------------------------------------------------- +Tue Aug 9 17:19:09 CEST 2005 - nadvornik@suse.cz + +- call ghostscript with the -dSAFER option [#102527] + +------------------------------------------------------------------- +Mon Aug 1 10:14:20 CEST 2005 - nadvornik@suse.cz + +- fixed libnetpb.so symlink + +------------------------------------------------------------------- +Fri Jul 29 17:13:34 CEST 2005 - nadvornik@suse.cz + +- installed palm colormaps required by plucker + +------------------------------------------------------------------- +Thu Jul 28 20:58:18 CEST 2005 - nadvornik@suse.cz + +- updated to 10.26.12 + +------------------------------------------------------------------- +Wed Jun 22 16:07:55 CEST 2005 - schwab@suse.de + +- Fix aliasing bug. +- Don't strip binaries. + +------------------------------------------------------------------- +Thu Jan 6 12:31:14 CET 2005 - nadvornik@suse.cz + +- updated to 10.18.18 +- fixed tempdir handling in anytopbm [#49446] + +------------------------------------------------------------------- +Fri Nov 19 11:27:44 CET 2004 - ro@suse.de + +- fixed file list + +------------------------------------------------------------------- +Tue Aug 31 22:08:00 CEST 2004 - jw@suse.de + +- fix uninitialized colornames in libppmcolor.c, + that caused ppmtoxpm to segv on x86-64. + +------------------------------------------------------------------- +Fri Aug 27 10:19:05 CEST 2004 - kukuk@suse.de + +- Fix .so symlink + +------------------------------------------------------------------- +Thu Aug 26 16:06:55 CEST 2004 - nadvornik@suse.cz + +- updated to 10.18.15: many bugfixes, incuding pnmtopng fix [#42868] + +------------------------------------------------------------------- +Thu Mar 18 16:27:04 CET 2004 - nadvornik@suse.cz + +- do not pack /usr/bin/doc.url [#36329] + +------------------------------------------------------------------- +Fri Mar 05 14:10:33 CET 2004 - nadvornik@suse.cz + +- fixed pbmtextps [#32104] +- fixed dangerous compiler warnings + +------------------------------------------------------------------- +Mon Jan 26 17:49:30 CET 2004 - nadvornik@suse.cz + +- fixed temp files handling [#34036] + +------------------------------------------------------------------- +Sat Jan 10 16:38:36 CET 2004 - adrian@suse.de + +- add %run_ldconfig + +------------------------------------------------------------------- +Thu Sep 18 10:55:50 CEST 2003 - nadvornik@suse.cz + +- fixed tail/head syntax [#31231] + +------------------------------------------------------------------- +Wed May 28 11:59:00 CEST 2003 - nadvornik@suse.cz + +- remove unpackaged files from buildroot + +------------------------------------------------------------------- +Thu Feb 13 18:22:39 CET 2003 - ro@suse.de + +- fix symlink for libnetpbm.so + +------------------------------------------------------------------- +Tue Feb 11 18:47:07 CET 2003 - nadvornik@suse.cz + +- updated to 10.11.4 + +------------------------------------------------------------------- +Mon Aug 05 17:05:05 CEST 2002 - nadvornik@suse.cz + +- removed g3topbm again + +------------------------------------------------------------------- +Mon Jul 29 14:07:27 CEST 2002 - schwab@suse.de + +- Fix reference to perl in scripts. + +------------------------------------------------------------------- +Sat Jul 27 18:53:34 CEST 2002 - kukuk@suse.de + +- Create compatibility links for the old libraries to compile + old sources + +------------------------------------------------------------------- +Sat Jul 27 09:50:13 CEST 2002 - meissner@suse.de + +- %_lib fixes, use RPM_OPT_FLAGS and -fPIC + +------------------------------------------------------------------- +Fri Jul 26 21:39:00 CEST 2002 - adrian@suse.de + +- fix neededforbuild + +------------------------------------------------------------------- +Fri Jul 26 12:25:48 CEST 2002 - nadvornik@suse.cz + +- updated to 10.5: + - libraries libpbm, libpgm, libpnm, libppm merged to libnetpbm + - documentation is in html only + +------------------------------------------------------------------- +Tue May 14 13:40:53 CEST 2002 - nadvornik@suse.cz + +- fixed usage of the %{_libdir} macro + +------------------------------------------------------------------- +Tue Feb 26 14:56:37 CET 2002 - nadvornik@suse.cz + +- fixed "#!/bin/sh" line in ppmtomap + +------------------------------------------------------------------- +Thu Feb 7 16:37:29 CET 2002 - nadvornik@suse.cz + +- updated to 9.24 + +------------------------------------------------------------------- +Fri Feb 1 00:26:08 CET 2002 - ro@suse.de + +- changed neededforbuild to + +------------------------------------------------------------------- +Thu Jan 10 16:21:10 CET 2002 - nadvornik@suse.cz + +- update to 9.23: + - bugfix release +- patched pnmtops to accept -dpi x [bug #12591] +- used macros %{_lib} and %{_libdir} + +------------------------------------------------------------------- +Wed Dec 5 18:11:02 CET 2001 - nadvornik@suse.cz + +- update to 9.21: + - new: pamdeinterlace, pnmquant, ppmtoneo, neotoppm + +------------------------------------------------------------------- +Tue Sep 4 10:13:47 CEST 2001 - nadvornik@suse.cz + +- removed jbigtopnm and pnmtojbig because of potential patent + problems [bug #9903] +- fixed segfault in icontopnm + +------------------------------------------------------------------- +Thu Aug 23 18:48:36 CEST 2001 - ro@suse.de + +- added pm.h and pm_config.h to INTERFACE_HEADERS + (pm.h is included by pbm.h and includes pm_config.h) + +------------------------------------------------------------------- +Thu Aug 23 15:04:35 CEST 2001 - nadvornik@suse.cz + +- update to 9.16 + new: pbmtopsg3 (Postscript G3 fax), pbmtonokia, ppmrainbow + pamoil (a replacement for pgmoil) + fixes and updates: + ppmtogif, ppmtojpeg, xpmtoppm, pnmtopng/pngtopnm, + giftopnm, ppm3d, tifftopnm, pgmcrater, pnmgamma, + ppmcie, pnmscale, pnmscalefixed, ppmtoeyuv, eyuvtoppm + pstopnm +- removed hpcdtoppm from source, because selling and commercial + using is prohibited + +------------------------------------------------------------------- +Tue Jun 5 14:23:11 CEST 2001 - pblaha@suse.cz + +- upgrade on 9.14 +- add documentation and examples for ppmtompeg fix bug #8647 + +------------------------------------------------------------------- +Thu Apr 5 17:38:19 CEST 2001 - pblaha@suse.cz + +- make ln -s pnmtoplainpnm pnmnoraw and ln -s gemtopnm gemtopbm + +------------------------------------------------------------------- +Tue Apr 3 10:44:48 CEST 2001 - kukuk@suse.de + +- Remove g2topbm again due conficts with g3utils + +------------------------------------------------------------------- +Mon Mar 26 14:47:55 CEST 2001 - pblaha@suse.cz + +- update on 9.12 + +------------------------------------------------------------------- +Wed Mar 14 14:56:39 CET 2001 - pblaha@suse.cz + +- remove g3topbm due to conflict with g3utils + +------------------------------------------------------------------- +Wed Mar 7 18:04:02 CET 2001 - pblaha@suse.cz + +- update on 9.11 + +------------------------------------------------------------------- +Wed Jan 24 11:59:36 CET 2001 - pblaha@suse.cz + +- update on 9.10 + +------------------------------------------------------------------- +Fri Dec 22 00:48:09 MET 2000 - garloff@suse.de + +- Add Provides + Obsoletes: libnetpb. +- Use some more macros in spec file. +- bzip2 source. + +------------------------------------------------------------------- +Tue Dec 5 15:16:05 CET 2000 - schwab@suse.de + +- Be sure to compile with -fpic. + +------------------------------------------------------------------- +Mon Dec 4 19:10:35 CET 2000 - kukuk@suse.de + +- Fix again path to perl + +------------------------------------------------------------------- +Thu Nov 30 17:10:01 CET 2000 - pblaha@suse.cz + +- remove g3topbm and pbmtog3 for conflict with g3utils + +------------------------------------------------------------------- +Tue Nov 28 11:35:39 CET 2000 - kukuk@suse.de + +- Use /usr/bin/perl + +------------------------------------------------------------------- +Tue Nov 28 10:11:44 CET 2000 - pblaha@suse.cz + +- remove hpcdtoppm because conflict with photocd + +------------------------------------------------------------------- +Mon Oct 2 18:11:17 CEST 2000 - pblaha@suse.cz + +- update to 9.8 and rename libnetpb to libnetpbm + +------------------------------------------------------------------- +Fri Sep 29 01:24:47 CEST 2000 - ro@suse.de + +- fixed Makefile deps + +------------------------------------------------------------------- +Mon Jul 10 15:32:37 CEST 2000 - bubnikv@suse.cz + +- fixed pbmtog3 to use fixed width of fax image (standard), added + switch to allow usage of source image width +- updated man page of pbmtog3 +- changed URLs of home page and source file + +------------------------------------------------------------------- +Tue Jun 20 12:15:57 CEST 2000 - nadvornik@suse.cz + +- added shhopt.h, libshhopt.* + +------------------------------------------------------------------- +Fri May 26 16:11:40 CEST 2000 - bubnikv@suse.cz + +- sorted + +------------------------------------------------------------------- +Fri May 19 16:43:31 CEST 2000 - nadvornik@suse.cz + +- fixed Imakefile + +------------------------------------------------------------------- +Tue May 16 12:09:10 CEST 2000 - nadvornik@suse.cz + +- update to 8.4 +- added BuildRoot + +------------------------------------------------------------------- +Fri May 12 13:47:13 CEST 2000 - schwab@suse.de + +- pbmplus.h: fix linux configuration. + +------------------------------------------------------------------- +Tue Feb 29 16:23:26 CET 2000 - kukuk@suse.de + +- Let ldconfig create correct links for shared libraries and add + them to file list + +------------------------------------------------------------------- +Mon Sep 13 17:23:57 CEST 1999 - bs@suse.de + +- ran old prepare_spec on spec file to switch to new prepare_spec. + +------------------------------------------------------------------- +Thu Jan 14 00:25:12 MET 1999 - ro@suse.de + +- pbmplus.h: don't redeclare write on alpha + +------------------------------------------------------------------- +Wed Jun 17 16:33:08 MEST 1998 - ro@suse.de + +- patched to build for libc5 and glibc + +------------------------------------------------------------------- +Thu May 14 14:25:59 MEST 1998 - ro@suse.de + +- added patch to build pbmtosff from Christian Lademann + +------------------------------------------------------------------- +Tue May 12 18:21:56 MEST 1998 - ro@suse.de + +- extracted package from libgr / build from own sources diff --git a/netpbm.spec b/netpbm.spec new file mode 100644 index 0000000..0f36bde --- /dev/null +++ b/netpbm.spec @@ -0,0 +1,367 @@ +# +# spec file for package netpbm (Version 10.26.22) +# +# Copyright (c) 2006 SUSE LINUX Products GmbH, Nuernberg, Germany. +# This file and all modifications and additions to the pristine +# package are under the same license as the package itself. +# +# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# + +# norootforbuild + +Name: netpbm +BuildRequires: libpng-devel libtiff-devel +License: Artistic License, Other License(s), see package +Group: Productivity/Graphics/Convertors +Provides: pbmplus +Autoreqprov: on +Version: 10.26.22 +Release: 33 +Summary: A Powerful Graphics Conversion Package +Source: netpbm-%{version}-nohpcdtoppm-nojbig.tar.bz2 +Source1: netpbm-%{version}-documentation.tar.bz2 +Source2: netpbm-%{version}-manpages.tar.bz2 +Source3: prepare-src-tarball +Patch: netpbm-%{version}.dif +Patch2: netpbm-%{version}-manpages.patch +Patch4: netpbm-%{version}-overflow.patch +Patch5: netpbm-%{version}-aliasing.patch +Patch6: netpbm-%{version}-tmpfile.patch +Patch7: netpbm-%{version}-colornames-init.diff +Patch8: netpbm-%{version}-fixes.patch +Patch9: netpbm-%{version}-pstopnm-gs-options.patch +Patch10: netpbm-%{version}-endian.patch +Patch11: netpbm-%{version}-pnmtopng-CAN-2005-2978.patch +Patch12: netpbm-%{version}-pnmtopng-overflow.patch +Patch13: netpbm-%{version}-ximtoppm-fixes.patch +Patch14: netpbm-%{version}-pbmtext.patch +Patch15: netpbm-%{version}-rgb.patch +Patch16: netpbm-%{version}-pamtouil.patch +Patch17: netpbm-%{version}-pnmtopng-transparent.patch +URL: http://netpbm.sourceforge.net +BuildRoot: %{_tmppath}/%{name}-%{version}-build + +%description +The latest version of the Portable Bitmap Plus Utilities. This large +package, which is by now available for all hardware platforms, provides +tools for graphics conversion. Using these tools, images can be +converted from virtually any format into any other format. A few of the +supported formats include: GIF, PC-Paintbrush, IFF ILBM, Gould Scanner +file, MTV ray tracer, Atari Degas .pi1 and .pi3, Macintosh PICT, HP +Paintjet file, QRT raytracer, AUTOCAD slide, Atari Spectrum (compressed +and uncompressed), Andrew Toolkit raster object, and many more. On top +of that, man pages are included for all tools. + + + +Authors: +-------- + Alberto Accomazzi + Andre Beck + Angus Duggan + Arnaud Le Hors + Arthur David Olson + Burkhard Neidecker-Lutz + Daniel Briggs + David Beckemeyer + David Koblas + Diomidis D. Spinellis + George Phillips + Graeme W. Gill + Hadmut Danisch + Ingo Wilken + James Darrell McCauley + John Tiller + John Walker + Kanthan Pillay + Ken Yap + Lyle Rains + Marcel Wijkstra + Marc Boucher + Oliver Trepte + Patrick J. Naughton + Paul Haeberli + Paul Breslaw + S.Petra Zeidler + Steve Belczyk + Warren Toomey + Wilson H. Bent. Jr. + Wolfgang Stuerzlinger + +%package -n libnetpbm +Version: 1.0.0 +Release: 676 +License: GNU Library General Public License v. 2.0 and 2.1 (LGPL), Other License(s), see package +Summary: Libraries for the NetPBM (NetPortableBitmap) Graphic Formats +Group: System/Libraries +Autoreqprov: on +Provides: libnetpb +Obsoletes: libnetpb + +%description -n libnetpbm +These are the libs for the netpbm graphic formats. The tools can be +found in the netpbm package. The sources are contained in the netpbm +source package. + + + +Authors: +-------- + Rob Hooft + Michael Mauldin + +%prep +%setup +%setup -D -q -a 1 +%setup -D -q -a 2 +rm -rf libtiff +%patch +%patch2 +%patch4 +%patch5 +%patch6 +%patch7 -p1 +%patch8 +%patch9 +%patch10 +%patch11 +%patch12 +%patch13 +%patch14 +%patch15 +%patch16 +%patch17 +# for ppmtompeg +rm -fr ppmtompeg +mkdir -p ppmtompeg +mkdir -p pnmtopalm +cd ppmtompeg +cp -v ../converter/ppm/ppmtompeg/BUGS . +cp -v ../converter/ppm/ppmtompeg/CHANGES . +cp -vr ../converter/ppm/ppmtompeg/docs/ . +cp -vr ../converter/ppm/ppmtompeg/examples/ . +cd ../pnmtopalm +cp -v ../converter/other/pnmtopalm/LICENSE . +cp -v ../converter/other/pnmtopalm/README . + +%build +cp Makefile.config.in Makefile.config +make CFLAGS="$RPM_OPT_FLAGS -fPIC -fstack-protector" + +%install +mkdir -p $RPM_BUILD_ROOT/usr/{bin,include,%_lib,share/man} +make pkgdir=`pwd`/package package STRIPFLAG= +cp -prd package/bin $RPM_BUILD_ROOT/usr +cp -pd package/{lib,link}/* $RPM_BUILD_ROOT/usr/%_lib +ln -sf libnetpbm.so.10.26 $RPM_BUILD_ROOT/usr/%_lib/libnetpbm.so +ln -sf libnetpbm.so $RPM_BUILD_ROOT/usr/%_lib/libpbm.so +ln -sf libnetpbm.so $RPM_BUILD_ROOT/usr/%_lib/libpgm.so +ln -sf libnetpbm.so $RPM_BUILD_ROOT/usr/%_lib/libpnm.so +ln -sf libnetpbm.so $RPM_BUILD_ROOT/usr/%_lib/libppm.so +cp -pd package/include/* $RPM_BUILD_ROOT/usr/include +cp -prd man/* $RPM_BUILD_ROOT/usr/share/man +mkdir -p $RPM_BUILD_ROOT/usr/share/netpbm +install -m 644 converter/other/pnmtopalm/*.map $RPM_BUILD_ROOT/usr/share/netpbm +rm $RPM_BUILD_ROOT/usr/bin/g3topbm #conflict with g3utils + +%clean +rm -rf $RPM_BUILD_ROOT + +%post -n libnetpbm +%run_ldconfig + +%postun -n libnetpbm +%run_ldconfig + +%files +%defattr(-,root,root) +%doc README doc/* netpbm.sourceforge.net/doc +%doc ppmtompeg/ pnmtopalm/ +%doc %{_mandir}/man1/*.gz +%doc %{_mandir}/man3/*.gz +%doc %{_mandir}/man5/*.gz +/usr/bin/* +/usr/share/netpbm + +%files -n libnetpbm +%defattr(-,root,root) +/usr/include/* +%{_libdir}/lib* + +%changelog -n netpbm +* Wed Dec 06 2006 - prusnak@suse.cz +- fixed pamtouil crash when -name was specified (pamtouil.patch) +- changed transparency handling (pnmtopng-transparent.patch) [#225258] +* Thu Nov 30 2006 - prusnak@suse.cz +- fixed missing manpages [#224478] +- fixed segfault in pbmtext [#224420] +* Tue Nov 14 2006 - prusnak@suse.cz +- fixed [#216670] + - removed man pages that pointed to online documentation (manpages.patch) + - added man pages generated from HTML documentation (manpages.tar.bz2) +* Thu Mar 23 2006 - nadvornik@suse.cz +- fixed uninitialized variables [#155948] +* Wed Jan 25 2006 - mls@suse.de +- converted neededforbuild to BuildRequires +* Thu Jan 12 2006 - nadvornik@suse.cz +- compile with -fstack-protector +* Thu Jan 05 2006 - nadvornik@suse.cz +- updated to 10.26.22 +* Tue Nov 15 2005 - nadvornik@suse.cz +- fixed possible buffer overflow [#133649] +* Thu Oct 13 2005 - nadvornik@suse.cz +- fixed possible buffer overflow (CAN-2005-2978) [#119601] +* Mon Sep 26 2005 - nadvornik@suse.cz +- fixed fiasco on bigendian [#105431] +* Tue Aug 09 2005 - nadvornik@suse.cz +- call ghostscript with the -dSAFER option [#102527] +* Mon Aug 01 2005 - nadvornik@suse.cz +- fixed libnetpb.so symlink +* Fri Jul 29 2005 - nadvornik@suse.cz +- installed palm colormaps required by plucker +* Thu Jul 28 2005 - nadvornik@suse.cz +- updated to 10.26.12 +* Wed Jun 22 2005 - schwab@suse.de +- Fix aliasing bug. +- Don't strip binaries. +* Thu Jan 06 2005 - nadvornik@suse.cz +- updated to 10.18.18 +- fixed tempdir handling in anytopbm [#49446] +* Fri Nov 19 2004 - ro@suse.de +- fixed file list +* Tue Aug 31 2004 - jw@suse.de +- fix uninitialized colornames in libppmcolor.c, + that caused ppmtoxpm to segv on x86-64. +* Fri Aug 27 2004 - kukuk@suse.de +- Fix .so symlink +* Thu Aug 26 2004 - nadvornik@suse.cz +- updated to 10.18.15: many bugfixes, incuding pnmtopng fix [#42868] +* Thu Mar 18 2004 - nadvornik@suse.cz +- do not pack /usr/bin/doc.url [#36329] +* Fri Mar 05 2004 - nadvornik@suse.cz +- fixed pbmtextps [#32104] +- fixed dangerous compiler warnings +* Mon Jan 26 2004 - nadvornik@suse.cz +- fixed temp files handling [#34036] +* Sat Jan 10 2004 - adrian@suse.de +- add %%run_ldconfig +* Thu Sep 18 2003 - nadvornik@suse.cz +- fixed tail/head syntax [#31231] +* Wed May 28 2003 - nadvornik@suse.cz +- remove unpackaged files from buildroot +* Thu Feb 13 2003 - ro@suse.de +- fix symlink for libnetpbm.so +* Tue Feb 11 2003 - nadvornik@suse.cz +- updated to 10.11.4 +* Mon Aug 05 2002 - nadvornik@suse.cz +- removed g3topbm again +* Mon Jul 29 2002 - schwab@suse.de +- Fix reference to perl in scripts. +* Sat Jul 27 2002 - kukuk@suse.de +- Create compatibility links for the old libraries to compile + old sources +* Sat Jul 27 2002 - meissner@suse.de +- %%_lib fixes, use RPM_OPT_FLAGS and -fPIC +* Fri Jul 26 2002 - adrian@suse.de +- fix neededforbuild +* Fri Jul 26 2002 - nadvornik@suse.cz +- updated to 10.5: + - libraries libpbm, libpgm, libpnm, libppm merged to libnetpbm + - documentation is in html only +* Tue May 14 2002 - nadvornik@suse.cz +- fixed usage of the %%{_libdir} macro +* Tue Feb 26 2002 - nadvornik@suse.cz +- fixed "#!/bin/sh" line in ppmtomap +* Thu Feb 07 2002 - nadvornik@suse.cz +- updated to 9.24 +* Fri Feb 01 2002 - ro@suse.de +- changed neededforbuild to +* Thu Jan 10 2002 - nadvornik@suse.cz +- update to 9.23: + - bugfix release +- patched pnmtops to accept -dpi x [bug #12591] +- used macros %%{_lib} and %%{_libdir} +* Wed Dec 05 2001 - nadvornik@suse.cz +- update to 9.21: + - new: pamdeinterlace, pnmquant, ppmtoneo, neotoppm +* Tue Sep 04 2001 - nadvornik@suse.cz +- removed jbigtopnm and pnmtojbig because of potential patent + problems [bug #9903] +- fixed segfault in icontopnm +* Thu Aug 23 2001 - ro@suse.de +- added pm.h and pm_config.h to INTERFACE_HEADERS + (pm.h is included by pbm.h and includes pm_config.h) +* Thu Aug 23 2001 - nadvornik@suse.cz +- update to 9.16 + new: pbmtopsg3 (Postscript G3 fax), pbmtonokia, ppmrainbow + pamoil (a replacement for pgmoil) + fixes and updates: + ppmtogif, ppmtojpeg, xpmtoppm, pnmtopng/pngtopnm, + giftopnm, ppm3d, tifftopnm, pgmcrater, pnmgamma, + ppmcie, pnmscale, pnmscalefixed, ppmtoeyuv, eyuvtoppm + pstopnm +- removed hpcdtoppm from source, because selling and commercial + using is prohibited +* Tue Jun 05 2001 - pblaha@suse.cz +- upgrade on 9.14 +- add documentation and examples for ppmtompeg fix bug #8647 +* Thu Apr 05 2001 - pblaha@suse.cz +- make ln -s pnmtoplainpnm pnmnoraw and ln -s gemtopnm gemtopbm +* Tue Apr 03 2001 - kukuk@suse.de +- Remove g2topbm again due conficts with g3utils +* Mon Mar 26 2001 - pblaha@suse.cz +- update on 9.12 +* Wed Mar 14 2001 - pblaha@suse.cz +- remove g3topbm due to conflict with g3utils +* Wed Mar 07 2001 - pblaha@suse.cz +- update on 9.11 +* Wed Jan 24 2001 - pblaha@suse.cz +- update on 9.10 +* Fri Dec 22 2000 - garloff@suse.de +- Add Provides + Obsoletes: libnetpb. +- Use some more macros in spec file. +- bzip2 source. +* Tue Dec 05 2000 - schwab@suse.de +- Be sure to compile with -fpic. +* Mon Dec 04 2000 - kukuk@suse.de +- Fix again path to perl +* Thu Nov 30 2000 - pblaha@suse.cz +- remove g3topbm and pbmtog3 for conflict with g3utils +* Tue Nov 28 2000 - kukuk@suse.de +- Use /usr/bin/perl +* Tue Nov 28 2000 - pblaha@suse.cz +- remove hpcdtoppm because conflict with photocd +* Mon Oct 02 2000 - pblaha@suse.cz +- update to 9.8 and rename libnetpb to libnetpbm +* Fri Sep 29 2000 - ro@suse.de +- fixed Makefile deps +* Mon Jul 10 2000 - bubnikv@suse.cz +- fixed pbmtog3 to use fixed width of fax image (standard), added + switch to allow usage of source image width +- updated man page of pbmtog3 +- changed URLs of home page and source file +* Tue Jun 20 2000 - nadvornik@suse.cz +- added shhopt.h, libshhopt.* +* Fri May 26 2000 - bubnikv@suse.cz +- sorted +* Fri May 19 2000 - nadvornik@suse.cz +- fixed Imakefile +* Tue May 16 2000 - nadvornik@suse.cz +- update to 8.4 +- added BuildRoot +* Fri May 12 2000 - schwab@suse.de +- pbmplus.h: fix linux configuration. +* Tue Feb 29 2000 - kukuk@suse.de +- Let ldconfig create correct links for shared libraries and add + them to file list +* Mon Sep 13 1999 - bs@suse.de +- ran old prepare_spec on spec file to switch to new prepare_spec. +* Thu Jan 14 1999 - ro@suse.de +- pbmplus.h: don't redeclare write on alpha +* Wed Jun 17 1998 - ro@suse.de +- patched to build for libc5 and glibc +* Thu May 14 1998 - ro@suse.de +- added patch to build pbmtosff from Christian Lademann +* Tue May 12 1998 - ro@suse.de +- extracted package from libgr / build from own sources diff --git a/prepare-src-tarball b/prepare-src-tarball new file mode 100644 index 0000000..46d3391 --- /dev/null +++ b/prepare-src-tarball @@ -0,0 +1,35 @@ +#!/bin/sh -x + +#This script is used to create netpbm-$VER-nohpcdtoppm-nojbig.tar.bz2 +#from netpbm-$VER.tgz +#netpbm-$VER.tgz can be found at http://sourceforge.net/projects/netpbm/ + + +VER=10.26.22 +rm -rf REMOVE +mkdir REMOVE +cd REMOVE +tar xzf ../netpbm-$VER.tgz + +cd netpbm*/converter/ppm/hpcdtoppm || exit 1 +rm -rf * +echo all: >> Makefile +echo install.bin: >> Makefile +echo install.man: >> Makefile +echo install.data: >> Makefile +echo clean: >> Makefile +cd ../../../.. + +cd netpbm*/converter/other/jbig || exit 1 +rm -rf * +echo all: >> Makefile +echo install.bin: >> Makefile +echo install.man: >> Makefile +echo install.data: >> Makefile +echo clean: >> Makefile +cd ../../../.. + + +tar cjf ../netpbm-$VER-nohpcdtoppm-nojbig.tar.bz2 * + + diff --git a/ready b/ready new file mode 100644 index 0000000..473a0f4