Commit fcde8479 authored by Manish Singh's avatar Manish Singh Committed by Manish Singh
Browse files

reject 0-sized buffers as corrupt header data. Fixes bug #171707.

Sun Mar 27 19:59:52 2005  Manish Singh  <yosh@gimp.org>

        * io-bmp.c (grow_buffer): reject 0-sized buffers as corrupt header
        data. Fixes bug #171707.
parent 4d48403b
Sun Mar 27 19:59:52 2005 Manish Singh <yosh@gimp.org>
* io-bmp.c (grow_buffer): reject 0-sized buffers as corrupt header
data. Fixes bug #171707.
2005-03-25 Matthias Clasen <mclasen@redhat.com> 2005-03-25 Matthias Clasen <mclasen@redhat.com>
* gdk-pixbuf-data.c (gdk_pixbuf_new_from_data): Use canonical * gdk-pixbuf-data.c (gdk_pixbuf_new_from_data): Use canonical
......
...@@ -219,7 +219,19 @@ lsb_16 (guchar *src) ...@@ -219,7 +219,19 @@ lsb_16 (guchar *src)
static gboolean grow_buffer (struct bmp_progressive_state *State, static gboolean grow_buffer (struct bmp_progressive_state *State,
GError **error) GError **error)
{ {
guchar *tmp = g_try_realloc (State->buff, State->BufferSize); guchar *tmp;
if (State->BufferSize == 0) {
g_set_error (error,
GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
_("BMP image has bogus header data"));
State->read_state = READ_STATE_ERROR;
return FALSE;
}
tmp = g_try_realloc (State->buff, State->BufferSize);
if (!tmp) { if (!tmp) {
g_set_error (error, g_set_error (error,
GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR,
...@@ -228,6 +240,7 @@ static gboolean grow_buffer (struct bmp_progressive_state *State, ...@@ -228,6 +240,7 @@ static gboolean grow_buffer (struct bmp_progressive_state *State,
State->read_state = READ_STATE_ERROR; State->read_state = READ_STATE_ERROR;
return FALSE; return FALSE;
} }
State->buff = tmp; State->buff = tmp;
return TRUE; return TRUE;
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment