Check for overflow. (#306394, Morten Welinder)

2005-06-08  Matthias Clasen  <mclasen@redhat.com>

	* io-pnm.c (pnm_read_next_value): Check for overflow.
	(#306394, Morten Welinder)

diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index 2a0d75a8fd81e9151a9a180ea699da6d178edce5..8972c30d9fa924778757e20ca511236d1b727668 100644 (file)
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,8 @@
+2005-06-08  Matthias Clasen  <mclasen@redhat.com>
+
+       * io-pnm.c (pnm_read_next_value): Check for overflow.
+       (#306394, Morten Welinder)
+
 2005-05-27  Matthias Clasen  <mclasen@redhat.com>
 
        * io-bmp.c: Accept the 108 byte header of BMP v4.  (#168799)

diff --git a/gdk-pixbuf/io-pnm.c b/gdk-pixbuf/io-pnm.c
index b568b4bccc357efff5c8062764f3dfdce1e100fd..81e50a7f79d2fb539766f7480e4353b3b36e65e4 100644 (file)
--- a/gdk-pixbuf/io-pnm.c
+++ b/gdk-pixbuf/io-pnm.c
@@ -245,7 +245,7 @@ pnm_read_next_value (PnmIOBuffer *inbuf, gint max_length, guint *value, GError *
        
        /* get the value */
        result = strtol (buf, &endptr, 10);
-       if (*endptr != '\0' || result < 0) {
+       if (*endptr != '\0' || result < 0 || result > G_MAXUINT) {
                g_set_error (error,
                             GDK_PIXBUF_ERROR,
                             GDK_PIXBUF_ERROR_CORRUPT_IMAGE,