Enable some tests which should work now.

	* test-loaders.c (main): Enable some tests which should work
	now.

	* io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Detect
	invalid image dimensions and insufficient memory.

	* io-tga.c (try_preload): Detect invalid image dimensions.
	(gdk_pixbuf__tga_stop_load): Don't try to unref NULL pointers.

	* io-ico.c (DecodeHeader): Detect some invalid headers and
	don't segfault.

diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index 45f47084243bdfdb8539ebff11dd3f222d41cc3f..c7b259670faee9de234d9f5be5ea9b6aee2d051f 100644 (file)
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,17 @@
+2002-02-10  Matthias Clasen  <matthias@local>
+
+       * test-loaders.c (main): Enable some tests which should work
+       now.
+
+       * io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Detect
+       invalid image dimensions and insufficient memory.
+
+       * io-tga.c (try_preload): Detect invalid image dimensions.
+       (gdk_pixbuf__tga_stop_load): Don't try to unref NULL pointers.
+
+       * io-ico.c (DecodeHeader): Detect some invalid headers and
+       don't segfault.
+
 Fri Feb  8 23:11:15 2002  Owen Taylor  <otaylor@redhat.com>
 
        * pixops/pixops.c: Force all weight arrays to sum exactly

diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c
index 412ea319dacf63d1f9db23f0185db524ad79cb2f..0f28ca3e0c1faf1eb7fd9b0ffafe765da6b892eb 100644 (file)
--- a/gdk-pixbuf/io-ico.c
+++ b/gdk-pixbuf/io-ico.c
@@ -295,7 +295,15 @@ static void DecodeHeader(guchar *Data, gint Bytes,
                
                Ptr += 16;      
        } 
-               
+
+       if (State->DIBoffset < 0) {
+               g_set_error (error,
+                            GDK_PIXBUF_ERROR,
+                            GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+                            _("Invalid header in icon"));
+               return;
+       }
+
        /* We now have a winner, pointed to in State->DIBoffset,
           so we know how many bytes are in the "header" part. */
              

diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c
index d8dd9c78d58e7b73f14fe118dc254dabe333e6a0..1f797a3b3eba53db17f96aa66407a9f88a4f1b45 100644 (file)
--- a/gdk-pixbuf/io-tga.c
+++ b/gdk-pixbuf/io-tga.c
@@ -611,8 +611,13 @@ static gboolean try_preload(TGAContext *ctx, GError **err)
                        ctx->in = io_buffer_free_segment(ctx->in, sizeof(TGAHeader), err);
                        if (!ctx->in)
                                return FALSE;
-                       if (!fill_in_context(ctx, err))
+                       if (LE16(ctx->hdr->width) == 0 || 
+                           LE16(ctx->hdr->height) == 0) {
+                               g_set_error(err, GDK_PIXBUF_ERROR,
+                                           GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+                                           _("TGA image has invalid dimensions"));
                                return FALSE;
+                       }
                        if (ctx->hdr->infolen > 255) {
                                g_set_error(err, GDK_PIXBUF_ERROR,
                                            GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
@@ -628,6 +633,8 @@ static gboolean try_preload(TGAContext *ctx, GError **err)
                                            _("TGA image type not supported"));
                                return FALSE;
                        }
+                       if (!fill_in_context(ctx, err))
+                               return FALSE;
                } else {
                        return TRUE;
                }
@@ -752,7 +759,8 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err)
        g_free(ctx->hdr);
        if (ctx->cmap)
                g_free(ctx->cmap);
-       g_object_unref(ctx->pbuf);
+       if (ctx->pbuf)
+               g_object_unref(ctx->pbuf);
        if (ctx->in->size)
                ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err);
        if (!ctx->in) {

diff --git a/gdk-pixbuf/io-wbmp.c b/gdk-pixbuf/io-wbmp.c
index d483e360c195a3a9103a6795c43996e846baea1b..d4db78386dc159d4393a31f5050853adbda79c98 100644 (file)
--- a/gdk-pixbuf/io-wbmp.c
+++ b/gdk-pixbuf/io-wbmp.c
@@ -268,8 +268,19 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data,
            else if(context->need_width)
              {
                bv = get_mbi(context, &buf, &size, &context->width);
-               if(bv)
+               if(bv) {
                  context->need_width = FALSE;
+
+                  if (context->width <= 0) {
+                   g_set_error (error,
+                                GDK_PIXBUF_ERROR,
+                                GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+                                _("Image has zero width"));
+
+                   return FALSE;
+                 }
+                }
+               
              }
            else if(context->need_height)
              {
@@ -277,8 +288,26 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data,
                if(bv)
                  {
                    context->need_height = FALSE;
+
+                   if (context->height <= 0) {
+                     g_set_error (error,
+                                  GDK_PIXBUF_ERROR,
+                                  GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+                                  _("Image has zero height"));
+                     
+                     return FALSE;
+                   }
+
                    context->pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, FALSE, 8, context->width, context->height);
-                   g_assert(context->pixbuf);
+                   
+                   if (!context->pixbuf) {
+                     g_set_error (error,
+                                  GDK_PIXBUF_ERROR,
+                                  GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
+                                  _("Not enough memory to load image"));
+                     return FALSE;
+                   }
+
 
                    if(context->prepared_func)
                      context->prepared_func(context->pixbuf, NULL, context->user_data);
@@ -324,10 +353,18 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data,
 
          } while(bv);
 
-       if(size)
-         return save_rest(context, buf, size);
-       else
-         return context->needmore;
+       if(size) {
+         bv = save_rest(context, buf, size);
+         if (!bv) {
+             g_set_error (error,
+                          GDK_PIXBUF_ERROR,
+                          GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+                          _("Couldn't save the rest"));
+
+             return FALSE;
+         }
+       }
+       return TRUE;
 }
 
 void

diff --git a/gdk-pixbuf/test-loaders.c b/gdk-pixbuf/test-loaders.c
index 95c4a6ec0d4f8a430d13024888bf21a4df82f694..49066362a0378cfbf4196fe9d4532cdd10e8230f 100644 (file)
--- a/gdk-pixbuf/test-loaders.c
+++ b/gdk-pixbuf/test-loaders.c
@@ -401,10 +401,7 @@ main (int argc, char **argv)
   TEST (png_test_2, FALSE);
 
 
-#if 0
   TEST (valid_ico_test, TRUE);
-#endif
-  
   TEST (ico_test_1, FALSE);
   
   TEST (valid_jpeg_test, TRUE);
@@ -417,6 +414,11 @@ main (int argc, char **argv)
   TEST (tga_test_1, FALSE);
 
   TEST (xpm_test_1, FALSE);
+
+#if 0
+  TEST (wbmp_test_1, FALSE); 
+  TEST (wbmp_test_2, FALSE);
+#endif
   
   TEST_RANDOM (GIF_HEADER, 150, FALSE);
   TEST_RANDOM (PNG_HEADER, 1100, FALSE);
@@ -431,17 +433,11 @@ main (int argc, char **argv)
   TEST_RANDOMLY_MODIFIED (valid_png_test, FALSE);
   TEST_RANDOMLY_MODIFIED (valid_tga_test, FALSE);
   TEST_RANDOMLY_MODIFIED (valid_jpeg_test, FALSE);  /* The jpeg loader does not break */
-#if 0
-  TEST_RANDOMLY_MODIFIED (valid_ico_test, TRUE);    /* The ico loader does not seem to
+  TEST_RANDOMLY_MODIFIED (valid_ico_test, FALSE);    /* The ico loader does not seem to
                                                     * break, but the image tend to 
                                                     * mutate into a wbmp image, and
                                                     * the wbmp loader is broken
                                                     */
-#endif
-#if 0
-  TEST (wbmp_test_1, FALSE); 
-  TEST (wbmp_test_2, FALSE);
-#endif
   /* memory tests */
 
   /* How do the loaders behave when memory is low?