Commit 73aa2bfe authored by Matthias Clasen's avatar Matthias Clasen
Browse files

Enable some tests which should work now.

	* test-loaders.c (main): Enable some tests which should work
	now.

	* io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Detect
	invalid image dimensions and insufficient memory.

	* io-tga.c (try_preload): Detect invalid image dimensions.
	(gdk_pixbuf__tga_stop_load): Don't try to unref NULL pointers.

	* io-ico.c (DecodeHeader): Detect some invalid headers and
	don't segfault.
parent 88462758
2002-02-10 Matthias Clasen <matthias@local>
* test-loaders.c (main): Enable some tests which should work
now.
* io-wbmp.c (gdk_pixbuf__wbmp_image_load_increment): Detect
invalid image dimensions and insufficient memory.
* io-tga.c (try_preload): Detect invalid image dimensions.
(gdk_pixbuf__tga_stop_load): Don't try to unref NULL pointers.
* io-ico.c (DecodeHeader): Detect some invalid headers and
don't segfault.
Fri Feb 8 23:11:15 2002 Owen Taylor <otaylor@redhat.com> Fri Feb 8 23:11:15 2002 Owen Taylor <otaylor@redhat.com>
* pixops/pixops.c: Force all weight arrays to sum exactly * pixops/pixops.c: Force all weight arrays to sum exactly
......
...@@ -295,7 +295,15 @@ static void DecodeHeader(guchar *Data, gint Bytes, ...@@ -295,7 +295,15 @@ static void DecodeHeader(guchar *Data, gint Bytes,
Ptr += 16; Ptr += 16;
} }
if (State->DIBoffset < 0) {
g_set_error (error,
GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
_("Invalid header in icon"));
return;
}
/* We now have a winner, pointed to in State->DIBoffset, /* We now have a winner, pointed to in State->DIBoffset,
so we know how many bytes are in the "header" part. */ so we know how many bytes are in the "header" part. */
......
...@@ -611,8 +611,13 @@ static gboolean try_preload(TGAContext *ctx, GError **err) ...@@ -611,8 +611,13 @@ static gboolean try_preload(TGAContext *ctx, GError **err)
ctx->in = io_buffer_free_segment(ctx->in, sizeof(TGAHeader), err); ctx->in = io_buffer_free_segment(ctx->in, sizeof(TGAHeader), err);
if (!ctx->in) if (!ctx->in)
return FALSE; return FALSE;
if (!fill_in_context(ctx, err)) if (LE16(ctx->hdr->width) == 0 ||
LE16(ctx->hdr->height) == 0) {
g_set_error(err, GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
_("TGA image has invalid dimensions"));
return FALSE; return FALSE;
}
if (ctx->hdr->infolen > 255) { if (ctx->hdr->infolen > 255) {
g_set_error(err, GDK_PIXBUF_ERROR, g_set_error(err, GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE, GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
...@@ -628,6 +633,8 @@ static gboolean try_preload(TGAContext *ctx, GError **err) ...@@ -628,6 +633,8 @@ static gboolean try_preload(TGAContext *ctx, GError **err)
_("TGA image type not supported")); _("TGA image type not supported"));
return FALSE; return FALSE;
} }
if (!fill_in_context(ctx, err))
return FALSE;
} else { } else {
return TRUE; return TRUE;
} }
...@@ -752,7 +759,8 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err) ...@@ -752,7 +759,8 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err)
g_free(ctx->hdr); g_free(ctx->hdr);
if (ctx->cmap) if (ctx->cmap)
g_free(ctx->cmap); g_free(ctx->cmap);
g_object_unref(ctx->pbuf); if (ctx->pbuf)
g_object_unref(ctx->pbuf);
if (ctx->in->size) if (ctx->in->size)
ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err); ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err);
if (!ctx->in) { if (!ctx->in) {
......
...@@ -268,8 +268,19 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data, ...@@ -268,8 +268,19 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data,
else if(context->need_width) else if(context->need_width)
{ {
bv = get_mbi(context, &buf, &size, &context->width); bv = get_mbi(context, &buf, &size, &context->width);
if(bv) if(bv) {
context->need_width = FALSE; context->need_width = FALSE;
if (context->width <= 0) {
g_set_error (error,
GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
_("Image has zero width"));
return FALSE;
}
}
} }
else if(context->need_height) else if(context->need_height)
{ {
...@@ -277,8 +288,26 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data, ...@@ -277,8 +288,26 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data,
if(bv) if(bv)
{ {
context->need_height = FALSE; context->need_height = FALSE;
if (context->height <= 0) {
g_set_error (error,
GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
_("Image has zero height"));
return FALSE;
}
context->pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, FALSE, 8, context->width, context->height); context->pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, FALSE, 8, context->width, context->height);
g_assert(context->pixbuf);
if (!context->pixbuf) {
g_set_error (error,
GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
_("Not enough memory to load image"));
return FALSE;
}
if(context->prepared_func) if(context->prepared_func)
context->prepared_func(context->pixbuf, NULL, context->user_data); context->prepared_func(context->pixbuf, NULL, context->user_data);
...@@ -324,10 +353,18 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data, ...@@ -324,10 +353,18 @@ static gboolean gdk_pixbuf__wbmp_image_load_increment(gpointer data,
} while(bv); } while(bv);
if(size) if(size) {
return save_rest(context, buf, size); bv = save_rest(context, buf, size);
else if (!bv) {
return context->needmore; g_set_error (error,
GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
_("Couldn't save the rest"));
return FALSE;
}
}
return TRUE;
} }
void void
......
...@@ -401,10 +401,7 @@ main (int argc, char **argv) ...@@ -401,10 +401,7 @@ main (int argc, char **argv)
TEST (png_test_2, FALSE); TEST (png_test_2, FALSE);
#if 0
TEST (valid_ico_test, TRUE); TEST (valid_ico_test, TRUE);
#endif
TEST (ico_test_1, FALSE); TEST (ico_test_1, FALSE);
TEST (valid_jpeg_test, TRUE); TEST (valid_jpeg_test, TRUE);
...@@ -417,6 +414,11 @@ main (int argc, char **argv) ...@@ -417,6 +414,11 @@ main (int argc, char **argv)
TEST (tga_test_1, FALSE); TEST (tga_test_1, FALSE);
TEST (xpm_test_1, FALSE); TEST (xpm_test_1, FALSE);
#if 0
TEST (wbmp_test_1, FALSE);
TEST (wbmp_test_2, FALSE);
#endif
TEST_RANDOM (GIF_HEADER, 150, FALSE); TEST_RANDOM (GIF_HEADER, 150, FALSE);
TEST_RANDOM (PNG_HEADER, 1100, FALSE); TEST_RANDOM (PNG_HEADER, 1100, FALSE);
...@@ -431,17 +433,11 @@ main (int argc, char **argv) ...@@ -431,17 +433,11 @@ main (int argc, char **argv)
TEST_RANDOMLY_MODIFIED (valid_png_test, FALSE); TEST_RANDOMLY_MODIFIED (valid_png_test, FALSE);
TEST_RANDOMLY_MODIFIED (valid_tga_test, FALSE); TEST_RANDOMLY_MODIFIED (valid_tga_test, FALSE);
TEST_RANDOMLY_MODIFIED (valid_jpeg_test, FALSE); /* The jpeg loader does not break */ TEST_RANDOMLY_MODIFIED (valid_jpeg_test, FALSE); /* The jpeg loader does not break */
#if 0 TEST_RANDOMLY_MODIFIED (valid_ico_test, FALSE); /* The ico loader does not seem to
TEST_RANDOMLY_MODIFIED (valid_ico_test, TRUE); /* The ico loader does not seem to
* break, but the image tend to * break, but the image tend to
* mutate into a wbmp image, and * mutate into a wbmp image, and
* the wbmp loader is broken * the wbmp loader is broken
*/ */
#endif
#if 0
TEST (wbmp_test_1, FALSE);
TEST (wbmp_test_2, FALSE);
#endif
/* memory tests */ /* memory tests */
/* How do the loaders behave when memory is low? /* How do the loaders behave when memory is low?
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment