Skip to content

Commit

Permalink
Fixed a bug that could cause invalid memory to be accessed
Browse files Browse the repository at this point in the history
The bug could happen when transparency is removed from an image.
Also fixed a semi-related BMP error handling logic bug.
Fixes issue #21
  • Loading branch information
jsummers committed May 11, 2017
1 parent e2f7490 commit a4f2477
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 3 deletions.
2 changes: 2 additions & 0 deletions src/imagew-bmp.c
Original file line number Diff line number Diff line change
Expand Up @@ -847,11 +847,13 @@ static int bmpr_read_rle(struct iwbmprcontext *rctx)
!(rctx->compression==IWBMP_BI_RLE4 && rctx->bitcount==4))
{
iw_set_error(rctx->ctx,"Compression type incompatible with image type");
goto done;
}

if(rctx->topdown) {
// The documentation says that top-down images may not be compressed.
iw_set_error(rctx->ctx,"Compression not allowed with top-down images");
goto done;
}

// RLE-compressed BMP images don't have to assign a color to every pixel,
Expand Down
18 changes: 15 additions & 3 deletions src/imagew-main.c
Original file line number Diff line number Diff line change
Expand Up @@ -922,8 +922,6 @@ static int iw_process_cols_to_intermediate(struct iw_context *ctx, int channel,
return retval;
}

// 'handle_alpha_flag' must be set if an alpha channel exists and this is not
// the alpha channel.
static int iw_process_rows_intermediate_to_final(struct iw_context *ctx, int intermed_channel,
const struct iw_csdescr *out_csdescr)
{
Expand Down Expand Up @@ -951,13 +949,27 @@ static int iw_process_rows_intermediate_to_final(struct iw_context *ctx, int int
iw_tmpsample *out_pix = NULL;
int num_in_pix;
int num_out_pix;
struct iw_channelinfo_out default_ci_out;

num_in_pix = ctx->intermed_canvas_width;
num_out_pix = ctx->img2.width;

int_ci = &ctx->intermed_ci[intermed_channel];
output_channel = int_ci->corresponding_output_channel;
out_ci = &ctx->img2_ci[output_channel];
if(output_channel>=0) {
out_ci = &ctx->img2_ci[output_channel];
}
else {
// If there is no output channelinfo struct, create a temporary one to
// use.
// TODO: This is admittedly ugly, but we use these settings for a few
// things even when there is no corresponding output channel, and I
// don't remember exactly why.
iw_zeromem(&default_ci_out, sizeof(struct iw_channelinfo_out));
default_ci_out.channeltype = IW_CHANNELTYPE_NONALPHA;
out_ci = &default_ci_out;
}

is_alpha_channel = (int_ci->channeltype==IW_CHANNELTYPE_ALPHA);
bkgd_has_transparency = iw_bkgd_has_transparency(ctx);

Expand Down

0 comments on commit a4f2477

Please sign in to comment.