Enlightenment CVS committal
Author : kwo
Project : e17
Module : libs/imlib2
Dir : e17/libs/imlib2/src/modules/loaders
Modified Files:
loader_jpeg.c loader_tga.c
Log Message:
Loader fixes based on patch from Hans de Goede/Fedora.
Fix off by one error in check (tga loader).
===================================================================
RCS file: /cvs/e/e17/libs/imlib2/src/modules/loaders/loader_jpeg.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -3 -r1.6 -r1.7
--- loader_jpeg.c 18 Jun 2008 17:52:38 -0000 1.6
+++ loader_jpeg.c 18 Jun 2008 20:45:41 -0000 1.7
@@ -95,7 +95,8 @@
im->w = w = cinfo.output_width;
im->h = h = cinfo.output_height;
- if (cinfo.rec_outbuf_height > 16)
+ if ((cinfo.rec_outbuf_height > 16) ||
+ (w < 1) || (h < 1) || (w > 8192) || (h > 8192))
{
im->w = im->h = 0;
jpeg_destroy_decompress(&cinfo);
===================================================================
RCS file: /cvs/e/e17/libs/imlib2/src/modules/loaders/loader_tga.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -3 -r1.6 -r1.7
--- loader_tga.c 9 Apr 2007 12:55:29 -0000 1.6
+++ loader_tga.c 18 Jun 2008 20:45:41 -0000 1.7
@@ -350,7 +350,9 @@
else
dataptr = im->data + (y * im->w);
- for (x = 0; x < im->w; x++) /* for each pixel in the row */
+ for (x = 0;
+ (x < im->w) && (bufptr + bpp / 8 <= bufend);
+ x++) /* for each pixel in the row */
{
switch (bpp)
{
@@ -406,7 +408,7 @@
/* loop until we've got all the pixels or run out of input */
while ((dataptr < final_pixel) &&
- ((bufptr + 1 + (bpp / 8)) < bufend))
+ ((bufptr + 1 + (bpp / 8)) <= bufend))
{
int count;
-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
enlightenment-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/enlightenment-cvs
