We are currently migrating Bugzilla to GitHub issues.
Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.
When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.

[patch] Gracefully_handle_XCF_files_with_overly_large_colourmaps.patch

Gracefully_handle_XCF_files_with_overly_large_colourmaps.patch (text/plain), 11.03 KB, created by janisozaur on 2019-05-19 22:17:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: janisozaur

Created: 2019-05-19 22:17:11 UTC

Size: 11.03 KB

patch

obsolete

># HG changeset patch
># User MichaÅ Janiszewski <janisozaur+sdl2image@gmail.com>
># Date 1558303965 -7200
>#      Mon May 20 00:12:45 2019 +0200
># Node ID c747c6805b469e296a2592a59b94b2afcef453c2
># Parent  0d9bc49ef8392a28f19b3c742390a637c2e9ee2f
>Gracefully handle XCF files with overly large colourmaps
>
>diff -r 0d9bc49ef839 -r c747c6805b46 IMG_xcf.c
>--- a/IMG_xcf.c	Sun May 19 23:17:53 2019 +0200
>+++ b/IMG_xcf.c	Mon May 20 00:12:45 2019 +0200
>@@ -1,6 +1,6 @@
> /*
>   SDL_image:  An example image loading library for use with SDL
>-  Copyright (C) 1997-2018 Sam Lantinga <slouken@libsdl.org>
>+  Copyright (C) 1997-2019 Sam Lantinga <slouken@libsdl.org>
> 
>   This software is provided 'as-is', without any express or implied
>   warranty.  In no event will the authors be held liable for any damages
>@@ -138,9 +138,11 @@
> 
> typedef struct {
>   char   sign [14];
>+  Uint32 file_version;
>   Uint32 width;
>   Uint32 height;
>   Sint32 image_type;
>+  Uint32 precision;
>   xcf_prop * properties;
> 
>   Uint32 * layer_file_offsets;
>@@ -221,20 +223,30 @@
> }
> 
> static char * read_string (SDL_RWops * src) {
>+  Sint64 remaining;
>   Uint32 tmp;
>   char * data;
> 
>-  tmp = SDL_ReadBE32 (src);
>-  Sint64 remaining = SDL_RWsize(src) - SDL_RWtell(src);
>-  if (tmp > 0 && tmp < remaining) {
>+  tmp = SDL_ReadBE32(src);
>+  remaining = SDL_RWsize(src) - SDL_RWtell(src);
>+  if (tmp > 0 && (Sint32)tmp <= remaining) {
>     data = (char *) SDL_malloc (sizeof (char) * tmp);
>-    SDL_RWread (src, data, tmp, 1);
>+    if (data) {
>+      SDL_RWread(src, data, tmp, 1);
>+      data[tmp - 1] = '\0';
>+    }
>   }
>   else {
>     data = NULL;
>   }
>+  return data;
>+}
> 
>-  return data;
>+static Uint64 read_offset (SDL_RWops * src, const xcf_header * h) {
>+  Uint64 offset;  // starting with version 11, offsets are 64 bits
>+  offset = (h->file_version >= 11) ? (Uint64)SDL_ReadBE32 (src) << 32 : 0;
>+  offset |= SDL_ReadBE32 (src);
>+  return offset;
> }
> 
> 
>@@ -246,20 +258,26 @@
>     |  ((v & 0xFF000000));
> }
> 
>-static void xcf_read_property (SDL_RWops * src, xcf_prop * prop) {
>+static int xcf_read_property (SDL_RWops * src, xcf_prop * prop) {
>   Uint32 len;
>   prop->id = SDL_ReadBE32 (src);
>   prop->length = SDL_ReadBE32 (src);
> 
> #if DEBUG
>-  printf ("%.8X: %s: %d\n", SDL_RWtell (src), prop->id < 25 ? prop_names [prop->id] : "unknown", prop->length);
>+  printf ("%.8X: %s(%u): %u\n", SDL_RWtell (src), prop->id < 25 ? prop_names [prop->id] : "unknown", prop->id, prop->length);
> #endif
> 
>   switch (prop->id) {
>   case PROP_COLORMAP:
>     prop->data.colormap.num = SDL_ReadBE32 (src);
>     prop->data.colormap.cmap = (char *) SDL_malloc (sizeof (char) * prop->data.colormap.num * 3);
>-    SDL_RWread (src, prop->data.colormap.cmap, prop->data.colormap.num*3, 1);
>+    if (prop->data.colormap.cmap) {
>+        SDL_RWread (src, prop->data.colormap.cmap, prop->data.colormap.num*3, 1);
>+    } else {
>+        SDL_Log("Gimp image has too large colormap property (%u)\n", prop->data.colormap.num);
>+        prop->data.colormap.num = 0;
>+        SDL_RWseek(src, prop->data.colormap.num * 3, RW_SEEK_CUR);
>+    }
>     break;
> 
>   case PROP_OFFSETS:
>@@ -283,8 +301,10 @@
>     break;
>   default:
>     //    SDL_RWread (src, &prop->data, prop->length, 1);
>-    SDL_RWseek (src, prop->length, RW_SEEK_CUR);
>+    if (SDL_RWseek (src, prop->length, RW_SEEK_CUR) < 0)
>+      return 0;  // ERROR
>   }
>+  return 1;  // OK
> }
> 
> static void free_xcf_header (xcf_header * h) {
>@@ -307,6 +327,15 @@
>   h->width       = SDL_ReadBE32 (src);
>   h->height      = SDL_ReadBE32 (src);
>   h->image_type  = SDL_ReadBE32 (src);
>+  h->file_version = (h->sign[10] - '0') * 100 + (h->sign[11] - '0') * 10 + (h->sign[12] - '0');
>+#ifdef DEBUG
>+  printf ("XCF signature : %.14s (version %u)\n", h->sign, h->file_version);
>+  printf (" (%u,%u) type=%u\n", h->width, h->height, h->image_type);
>+#endif
>+  if (h->file_version >= 4)
>+    h->precision = SDL_ReadBE32 (src);
>+  else
>+    h->precision = 150;
> 
>   h->properties = NULL;
>   h->layer_file_offsets = NULL;
>@@ -316,7 +345,10 @@
> 
>   // Just read, don't save
>   do {
>-    xcf_read_property (src, &prop);
>+    if (!xcf_read_property (src, &prop)) {
>+      free_xcf_header (h);
>+      return NULL;
>+    }
>     if (prop.id == PROP_COMPRESSION)
>       h->compr = (xcf_compr_type)prop.data.compression;
>     else if (prop.id == PROP_COLORMAP) {
>@@ -348,7 +380,7 @@
>   SDL_free (l);
> }
> 
>-static xcf_layer * read_xcf_layer (SDL_RWops * src) {
>+static xcf_layer * read_xcf_layer (SDL_RWops * src, const xcf_header * h) {
>   xcf_layer * l;
>   xcf_prop    prop;
> 
>@@ -358,9 +390,15 @@
>   l->layer_type = SDL_ReadBE32 (src);
> 
>   l->name = read_string (src);
>+#ifdef DEBUG
>+  printf ("layer (%d,%d) type=%d '%s'\n", l->width, l->height, l->layer_type, l->name);
>+#endif
> 
>   do {
>-    xcf_read_property (src, &prop);
>+    if (!xcf_read_property (src, &prop)) {
>+      free_xcf_layer (l);
>+      return NULL;
>+    }
>     if (prop.id == PROP_OFFSETS) {
>       l->offset_x = prop.data.offset.x;
>       l->offset_y = prop.data.offset.y;
>@@ -369,8 +407,8 @@
>     }
>   } while (prop.id != PROP_END);
> 
>-  l->hierarchy_file_offset = SDL_ReadBE32 (src);
>-  l->layer_mask_offset     = SDL_ReadBE32 (src);
>+  l->hierarchy_file_offset = read_offset (src, h);
>+  l->layer_mask_offset     = read_offset (src, h);
> 
>   return l;
> }
>@@ -380,7 +418,7 @@
>   SDL_free (c);
> }
> 
>-static xcf_channel * read_xcf_channel (SDL_RWops * src) {
>+static xcf_channel * read_xcf_channel (SDL_RWops * src, const xcf_header * h) {
>   xcf_channel * l;
>   xcf_prop    prop;
> 
>@@ -389,10 +427,16 @@
>   l->height = SDL_ReadBE32 (src);
> 
>   l->name = read_string (src);
>+#ifdef DEBUG
>+  printf ("channel (%u,%u) '%s'\n", l->width, l->height, l->name);
>+#endif
> 
>   l->selection = 0;
>   do {
>-    xcf_read_property (src, &prop);
>+    if (!xcf_read_property (src, &prop)) {
>+      free_xcf_channel (l);
>+      return NULL;
>+    }
>     switch (prop.id) {
>     case PROP_OPACITY:
>       l->opacity = prop.data.opacity << 24;
>@@ -413,7 +457,7 @@
>     }
>   } while (prop.id != PROP_END);
> 
>-  l->hierarchy_file_offset = SDL_ReadBE32 (src);
>+  l->hierarchy_file_offset = read_offset (src, h);
> 
>   return l;
> }
>@@ -423,7 +467,7 @@
>   SDL_free (h);
> }
> 
>-static xcf_hierarchy * read_xcf_hierarchy (SDL_RWops * src) {
>+static xcf_hierarchy * read_xcf_hierarchy (SDL_RWops * src, const xcf_header * head) {
>   xcf_hierarchy * h;
>   int i;
> 
>@@ -436,7 +480,7 @@
>   i = 0;
>   do {
>     h->level_file_offsets = (Uint32 *) SDL_realloc (h->level_file_offsets, sizeof (Uint32) * (i+1));
>-    h->level_file_offsets [i] = SDL_ReadBE32 (src);
>+    h->level_file_offsets [i] = read_offset (src, head);
>   } while (h->level_file_offsets [i++]);
> 
>   return h;
>@@ -447,7 +491,7 @@
>   SDL_free (l);
> }
> 
>-static xcf_level * read_xcf_level (SDL_RWops * src) {
>+static xcf_level * read_xcf_level (SDL_RWops * src, const xcf_header * h) {
>   xcf_level * l;
>   int i;
> 
>@@ -459,7 +503,7 @@
>   i = 0;
>   do {
>     l->tile_file_offsets = (Uint32 *) SDL_realloc (l->tile_file_offsets, sizeof (Uint32) * (i+1));
>-    l->tile_file_offsets [i] = SDL_ReadBE32 (src);
>+    l->tile_file_offsets [i] = read_offset (src, h);
>   } while (l->tile_file_offsets [i++]);
> 
>   return l;
>@@ -473,7 +517,8 @@
>   unsigned char * load;
> 
>   load = (unsigned char *) SDL_malloc (len); // expect this is okay
>-  SDL_RWread (src, load, len, 1);
>+  if (load != NULL)
>+    SDL_RWread (src, load, len, 1);
> 
>   return load;
> }
>@@ -489,6 +534,8 @@
>   }
> 
>   t = load = (unsigned char *) SDL_malloc (len);
>+  if (load == NULL)
>+    return NULL;
>   reallen = SDL_RWread (src, t, 1, len);
> 
>   data = (unsigned char *) SDL_calloc (1, x*y*bpp);
>@@ -592,9 +639,10 @@
>     int            i, j;
>     Uint32         x, y, tx, ty, ox, oy;
>     Uint32         *row;
>+    Uint32         length;
> 
>     SDL_RWseek(src, layer->hierarchy_file_offset, RW_SEEK_SET);
>-    hierarchy = read_xcf_hierarchy(src);
>+    hierarchy = read_xcf_hierarchy(src, head);
> 
>     if (hierarchy->bpp > 4) {  /* unsupported. */
>         SDL_Log("Unknown Gimp image bpp (%u)\n", (unsigned int) hierarchy->bpp);
>@@ -610,20 +658,23 @@
> 
>     level = NULL;
>     for (i = 0; hierarchy->level_file_offsets[i]; i++) {
>-        SDL_RWseek(src, hierarchy->level_file_offsets[i], RW_SEEK_SET);
>-        level = read_xcf_level(src);
>+        if (SDL_RWseek(src, hierarchy->level_file_offsets[i], RW_SEEK_SET) < 0)
>+            break;
>+        if (i > 0) // skip level except the 1st one, just like GIMP does
>+            continue;
>+        level = read_xcf_level(src, head);
> 
>         ty = tx = 0;
>         for (j = 0; level->tile_file_offsets[j]; j++) {
>             SDL_RWseek(src, level->tile_file_offsets[j], RW_SEEK_SET);
>             ox = tx + 64 > level->width ? level->width % 64 : 64;
>             oy = ty + 64 > level->height ? level->height % 64 : 64;
>+            length = ox*oy*6;
> 
>-            if (level->tile_file_offsets[j + 1]) {
>-                tile = load_tile(src, level->tile_file_offsets[j + 1] - level->tile_file_offsets[j], hierarchy->bpp, ox, oy);
>-            } else {
>-                tile = load_tile(src, ox * oy * 6, hierarchy->bpp, ox, oy);
>+            if (level->tile_file_offsets[j + 1] > level->tile_file_offsets[j]) {
>+                length = level->tile_file_offsets[j + 1] - level->tile_file_offsets[j];
>             }
>+            tile = load_tile(src, length, hierarchy->bpp, ox, oy);
> 
>             if (!tile) {
>                 if (hierarchy) {
>@@ -792,7 +843,7 @@
> 
>   offsets = 0;
> 
>-  while ((offset = SDL_ReadBE32 (src))) {
>+  while ((offset = read_offset (src, head))) {
>     head->layer_file_offsets = (Uint32 *) SDL_realloc (head->layer_file_offsets, sizeof (Uint32) * (offsets+1));
>     head->layer_file_offsets [offsets] = (Uint32)offset;
>     offsets++;
>@@ -812,20 +863,22 @@
>     SDL_Rect rs, rd;
>     SDL_RWseek (src, head->layer_file_offsets [i-1], RW_SEEK_SET);
> 
>-    layer = read_xcf_layer (src);
>-    do_layer_surface (lays, src, head, layer, load_tile);
>-    rs.x = 0;
>-    rs.y = 0;
>-    rs.w = layer->width;
>-    rs.h = layer->height;
>-    rd.x = layer->offset_x;
>-    rd.y = layer->offset_y;
>-    rd.w = layer->width;
>-    rd.h = layer->height;
>+    layer = read_xcf_layer (src, head);
>+    if (layer != NULL) {
>+      do_layer_surface (lays, src, head, layer, load_tile);
>+      rs.x = 0;
>+      rs.y = 0;
>+      rs.w = layer->width;
>+      rs.h = layer->height;
>+      rd.x = layer->offset_x;
>+      rd.y = layer->offset_y;
>+      rd.w = layer->width;
>+      rd.h = layer->height;
> 
>-    if (layer->visible)
>-      SDL_BlitSurface (lays, &rs, surface, &rd);
>-    free_xcf_layer (layer);
>+      if (layer->visible)
>+        SDL_BlitSurface (lays, &rs, surface, &rd);
>+      free_xcf_layer (layer);
>+    }
>   }
> 
>   SDL_FreeSurface (lays);
>@@ -835,11 +888,13 @@
>   // read channels
>   channel = NULL;
>   chnls   = 0;
>-  while ((offset = SDL_ReadBE32 (src))) {
>+  while ((offset = read_offset (src, head))) {
>     channel = (xcf_channel **) SDL_realloc (channel, sizeof (xcf_channel *) * (chnls+1));
>     fp = SDL_RWtell (src);
>     SDL_RWseek (src, offset, RW_SEEK_SET);
>-    channel [chnls++] = (read_xcf_channel (src));
>+    channel [chnls] = (read_xcf_channel (src, head));
>+    if (channel [chnls] != NULL)
>+      chnls++;
>     SDL_RWseek (src, fp, RW_SEEK_SET);
>   }
>

Actions: View | Diff

Attachments on bug 4637: 3787

We are currently migrating Bugzilla to GitHub issues.Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.

We are currently migrating Bugzilla to GitHub issues.
Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.
When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.