Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/openmotif/patches/openmotif-2.2.3-CAN-2004-0687-0688.patch

    Contents of /trunk/openmotif/patches/openmotif-2.2.3-CAN-2004-0687-0688.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 153 - (show annotations) (download)
    Tue May 8 20:52:56 2007 UTC (17 years ago) by niro
    File size: 13114 byte(s) 
    -import
    1 --- openMotif-2.2.3/lib/Xm/Xpmhashtab.c.CAN-2004-0687-0688 2004-09-30 11:52:40.176933831 +0200
    2 +++ openMotif-2.2.3/lib/Xm/Xpmhashtab.c 2004-09-30 11:53:47.288717782 +0200
    3 @@ -141,7 +141,7 @@
    4 xpmHashTable *table;
    5 {
    6 xpmHashAtom *atomTable = table->atomTable;
    7 - int size = table->size;
    8 + unsigned int size = table->size;
    9 xpmHashAtom *t, *p;
    10 int i;
    11 int oldSize = size;
    12 @@ -150,6 +150,8 @@
    13 HASH_TABLE_GROWS
    14 table->size = size;
    15 table->limit = size / 3;
    16 + if (size >= SIZE_MAX / sizeof(*atomTable))
    17 + return (XpmNoMemory);
    18 atomTable = (xpmHashAtom *) XpmMalloc(size * sizeof(*atomTable));
    19 if (!atomTable)
    20 return (XpmNoMemory);
    21 @@ -210,6 +212,8 @@
    22 table->size = INITIAL_HASH_SIZE;
    23 table->limit = table->size / 3;
    24 table->used = 0;
    25 + if (table->size >= SIZE_MAX / sizeof(*atomTable))
    26 + return (XpmNoMemory);
    27 atomTable = (xpmHashAtom *) XpmMalloc(table->size * sizeof(*atomTable));
    28 if (!atomTable)
    29 return (XpmNoMemory);
    30 --- openMotif-2.2.3/lib/Xm/XpmWrFFrI.c.CAN-2004-0687-0688 2004-09-30 11:36:04.545969020 +0200
    31 +++ openMotif-2.2.3/lib/Xm/XpmWrFFrI.c 2004-09-30 11:37:14.583312219 +0200
    32 @@ -244,6 +244,8 @@
    33 unsigned int x, y, h;
    34
    35 h = height - 1;
    36 + if (cpp != 0 && width >= (SIZE_MAX - 3)/cpp)
    37 + return (XpmNoMemory);
    38 p = buf = (char *) XpmMalloc(width * cpp + 3);
    39 if (!buf)
    40 return (XpmNoMemory);
    41 --- openMotif-2.2.3/lib/Xm/Xpmdata.c.CAN-2004-0687-0688 2004-09-30 11:51:30.712472999 +0200
    42 +++ openMotif-2.2.3/lib/Xm/Xpmdata.c 2004-09-30 11:52:26.665789239 +0200
    43 @@ -376,7 +376,7 @@
    44 {
    45 if (!mdata->type)
    46 *cmt = NULL;
    47 - else if (mdata->CommentLength) {
    48 + else if (mdata->CommentLength != 0 && mdata->CommentLength < SIZE_MAX - 1) {
    49 *cmt = (char *) XpmMalloc(mdata->CommentLength + 1);
    50 strncpy(*cmt, mdata->Comment, mdata->CommentLength);
    51 (*cmt)[mdata->CommentLength] = '\0';
    52 --- openMotif-2.2.3/lib/Xm/XpmI.h.CAN-2004-0687-0688 2004-09-30 11:38:09.358760225 +0200
    53 +++ openMotif-2.2.3/lib/Xm/XpmI.h 2004-09-30 11:39:58.498714150 +0200
    54 @@ -179,6 +179,18 @@
    55 boundCheckingCalloc((long)(nelem),(long) (elsize))
    56 #endif
    57
    58 +#if defined(SCO) || defined(__USLC__)
    59 +#include <stdint.h> /* For SIZE_MAX */
    60 +#endif
    61 +#include <limits.h>
    62 +#ifndef SIZE_MAX
    63 +# ifdef ULONG_MAX
    64 +# define SIZE_MAX ULONG_MAX
    65 +# else
    66 +# define SIZE_MAX UINT_MAX
    67 +# endif
    68 +#endif
    69 +
    70 #define XPMMAXCMTLEN BUFSIZ
    71 typedef struct {
    72 unsigned int type;
    73 @@ -276,9 +288,9 @@
    74 } *xpmHashAtom;
    75
    76 typedef struct {
    77 - int size;
    78 - int limit;
    79 - int used;
    80 + unsigned int size;
    81 + unsigned int limit;
    82 + unsigned int used;
    83 xpmHashAtom *atomTable;
    84 } xpmHashTable;
    85
    86 --- openMotif-2.2.3/lib/Xm/XpmCrDatFrI.c.CAN-2004-0687-0688 2004-09-30 11:35:18.058379165 +0200
    87 +++ openMotif-2.2.3/lib/Xm/XpmCrDatFrI.c 2004-09-30 11:35:43.951808698 +0200
    88 @@ -134,6 +134,8 @@
    89 */
    90 header_nlines = 1 + image->ncolors;
    91 header_size = sizeof(char *) * header_nlines;
    92 + if (header_size >= SIZE_MAX / sizeof(char *))
    93 + return (XpmNoMemory);
    94 header = (char **) XpmCalloc(header_size, sizeof(char *));
    95 if (!header)
    96 return (XpmNoMemory);
    97 --- openMotif-2.2.3/lib/Xm/Xpmscan.c.CAN-2004-0687-0688 2004-09-30 12:05:34.424607695 +0200
    98 +++ openMotif-2.2.3/lib/Xm/Xpmscan.c 2004-09-30 12:08:16.963282178 +0200
    99 @@ -98,7 +98,8 @@
    100 LFUNC(ScanTransparentColor, int, (XpmColor *color, unsigned int cpp,
    101 XpmAttributes *attributes));
    102
    103 -LFUNC(ScanOtherColors, int, (Display *display, XpmColor *colors, int ncolors,
    104 +LFUNC(ScanOtherColors, int, (Display *display, XpmColor *colors,
    105 + unsigned int ncolors,
    106 Pixel *pixels, unsigned int mask,
    107 unsigned int cpp, XpmAttributes *attributes));
    108
    109 @@ -225,11 +226,17 @@
    110 else
    111 cpp = 0;
    112
    113 + if ((height > 0 && width >= SIZE_MAX / height) ||
    114 + width * height >= SIZE_MAX / sizeof(unsigned int))
    115 + RETURN(XpmNoMemory);
    116 pmap.pixelindex =
    117 (unsigned int *) XpmCalloc(width * height, sizeof(unsigned int));
    118 if (!pmap.pixelindex)
    119 RETURN(XpmNoMemory);
    120
    121 + if (pmap.size >= SIZE_MAX / sizeof(Pixel))
    122 + RETURN(XpmNoMemory);
    123 +
    124 pmap.pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * pmap.size);
    125 if (!pmap.pixels)
    126 RETURN(XpmNoMemory);
    127 @@ -285,6 +292,8 @@
    128 * color
    129 */
    130
    131 + if (pmap.ncolors >= SIZE_MAX / sizeof(XpmColor))
    132 + RETURN(XpmNoMemory);
    133 colorTable = (XpmColor *) XpmCalloc(pmap.ncolors, sizeof(XpmColor));
    134 if (!colorTable)
    135 RETURN(XpmNoMemory);
    136 @@ -332,6 +341,8 @@
    137
    138 /* first get a character string */
    139 a = 0;
    140 + if (cpp >= SIZE_MAX - 1)
    141 + return (XpmNoMemory);
    142 if (!(s = color->string = (char *) XpmMalloc(cpp + 1)))
    143 return (XpmNoMemory);
    144 *s++ = printable[c = a % MAXPRINTABLE];
    145 @@ -379,7 +390,7 @@
    146 ScanOtherColors(display, colors, ncolors, pixels, mask, cpp, attributes)
    147 Display *display;
    148 XpmColor *colors;
    149 - int ncolors;
    150 + unsigned int ncolors;
    151 Pixel *pixels;
    152 unsigned int mask;
    153 unsigned int cpp;
    154 @@ -423,6 +434,8 @@
    155 }
    156
    157 /* first get character strings and rgb values */
    158 + if (ncolors >= SIZE_MAX / sizeof(XColor) || cpp >= SIZE_MAX - 1)
    159 + return (XpmNoMemory);
    160 xcolors = (XColor *) XpmMalloc(sizeof(XColor) * ncolors);
    161 if (!xcolors)
    162 return (XpmNoMemory);
    163 --- openMotif-2.2.3/lib/Xm/XpmAttrib.c.CAN-2004-0687-0688 2004-09-30 11:33:10.216008908 +0200
    164 +++ openMotif-2.2.3/lib/Xm/XpmAttrib.c 2004-09-30 11:33:41.187737616 +0200
    165 @@ -41,8 +41,8 @@
    166 #include "XpmI.h"
    167
    168 /* 3.2 backward compatibility code */
    169 -LFUNC(CreateOldColorTable, int, (XpmColor *ct, int ncolors,
    170 - XpmColor ***oldct));
    171 +LFUNC(CreateOldColorTable, int, (XpmColor *ct, unsigned int ncolors,
    172 + XpmColor ***oldct));
    173
    174 LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors));
    175
    176 @@ -52,12 +52,15 @@
    177 static int
    178 CreateOldColorTable(ct, ncolors, oldct)
    179 XpmColor *ct;
    180 - int ncolors;
    181 + unsigned int ncolors;
    182 XpmColor ***oldct;
    183 {
    184 XpmColor **colorTable, **color;
    185 int a;
    186
    187 + if (ncolors >= SIZE_MAX / sizeof(XpmColor *))
    188 + return XpmNoMemory;
    189 +
    190 colorTable = (XpmColor **) XpmMalloc(ncolors * sizeof(XpmColor *));
    191 if (!colorTable) {
    192 *oldct = NULL;
    193 --- openMotif-2.2.3/lib/Xm/Xpmcreate.c.CAN-2004-0687-0688 2004-09-30 11:40:22.122457590 +0200
    194 +++ openMotif-2.2.3/lib/Xm/Xpmcreate.c 2004-09-30 12:49:44.411019183 +0200
    195 @@ -804,6 +804,9 @@
    196
    197 ErrorStatus = XpmSuccess;
    198
    199 + if (image->ncolors >= SIZE_MAX / sizeof(Pixel))
    200 + return (XpmNoMemory);
    201 +
    202 /* malloc pixels index tables */
    203 image_pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * image->ncolors);
    204 if (!image_pixels)
    205 @@ -947,6 +950,8 @@
    206 return (XpmNoMemory);
    207
    208 #ifndef FOR_MSW
    209 + if (height != 0 && (*image_return)->bytes_per_line >= SIZE_MAX / height)
    210 + return XpmNoMemory;
    211 /* now that bytes_per_line must have been set properly alloc data */
    212 (*image_return)->data =
    213 (char *) XpmMalloc((*image_return)->bytes_per_line * height);
    214 @@ -1992,6 +1997,9 @@
    215 xpmGetCmt(data, &colors_cmt);
    216
    217 /* malloc pixels index tables */
    218 + if (ncolors >= SIZE_MAX / sizeof(Pixel))
    219 + return XpmNoMemory;
    220 +
    221 image_pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * ncolors);
    222 if (!image_pixels)
    223 RETURN(XpmNoMemory);
    224 @@ -2207,6 +2215,9 @@
    225 {
    226 unsigned short colidx[256];
    227
    228 + if (ncolors > 256)
    229 + return (XpmFileInvalid);
    230 +
    231 bzero((char *)colidx, 256 * sizeof(short));
    232 for (a = 0; a < ncolors; a++)
    233 colidx[(unsigned char)colorTable[a].string[0]] = a + 1;
    234 @@ -2305,6 +2316,9 @@
    235 char *s;
    236 char buf[BUFSIZ];
    237
    238 + if (cpp >= sizeof(buf))
    239 + return (XpmFileInvalid);
    240 +
    241 buf[cpp] = '\0';
    242 if (USE_HASHTABLE) {
    243 xpmHashAtom *slot;
    244 --- openMotif-2.2.3/lib/Xm/Xpmparse.c.CAN-2004-0687-0688 2004-09-30 11:54:01.219804716 +0200
    245 +++ openMotif-2.2.3/lib/Xm/Xpmparse.c 2004-09-30 12:47:15.676480282 +0200
    246 @@ -46,6 +46,25 @@
    247
    248 #include "XpmI.h"
    249 #include <ctype.h>
    250 +#include <string.h>
    251 +
    252 +#ifdef HAS_STRLCAT
    253 +# define STRLCAT(dst, src, dstsize) { \
    254 + if (strlcat(dst, src, dstsize) >= (dstsize)) \
    255 + return (XpmFileInvalid); }
    256 +# define STRLCPY(dst, src, dstsize) { \
    257 + if (strlcpy(dst, src, dstsize) >= (dstsize)) \
    258 + return (XpmFileInvalid); }
    259 +#else
    260 +# define STRLCAT(dst, src, dstsize) { \
    261 + if ((strlen(dst) + strlen(src)) < (dstsize)) \
    262 + strcat(dst, src); \
    263 + else return (XpmFileInvalid); }
    264 +# define STRLCPY(dst, src, dstsize) { \
    265 + if (strlen(src) < (dstsize)) \
    266 + strcpy(dst, src); \
    267 + else return (XpmFileInvalid); }
    268 +#endif
    269
    270 LFUNC(ParsePixels, int, (xpmData *data, unsigned int width,
    271 unsigned int height, unsigned int ncolors,
    272 @@ -215,7 +234,7 @@
    273 unsigned int *extensions;
    274 {
    275 unsigned int l;
    276 - char buf[BUFSIZ];
    277 + char buf[BUFSIZ + 1];
    278
    279 if (!data->format) { /* XPM 2 or 3 */
    280
    281 @@ -324,10 +343,10 @@
    282 XpmColor **colorTablePtr;
    283 xpmHashTable *hashtable;
    284 {
    285 - unsigned int key, l, a, b;
    286 + unsigned int key, l, a, b, len;
    287 unsigned int curkey; /* current color key */
    288 unsigned int lastwaskey; /* key read */
    289 - char buf[BUFSIZ];
    290 + char buf[BUFSIZ + 1];
    291 char curbuf[BUFSIZ]; /* current buffer */
    292 char **sptr, *s;
    293 XpmColor *color;
    294 @@ -335,6 +354,8 @@
    295 char **defaults;
    296 int ErrorStatus;
    297
    298 + if (ncolors >= SIZE_MAX / sizeof(XpmColor))
    299 + return (XpmNoMemory);
    300 colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));
    301 if (!colorTable)
    302 return (XpmNoMemory);
    303 @@ -346,6 +367,10 @@
    304 /*
    305 * read pixel value
    306 */
    307 + if (cpp >= SIZE_MAX - 1) {
    308 + xpmFreeColorTable(colorTable, ncolors);
    309 + return (XpmNoMemory);
    310 + }
    311 color->string = (char *) XpmMalloc(cpp + 1);
    312 if (!color->string) {
    313 xpmFreeColorTable(colorTable, ncolors);
    314 @@ -383,13 +408,14 @@
    315 }
    316 if (!lastwaskey && key < NKEYS) { /* open new key */
    317 if (curkey) { /* flush string */
    318 - s = (char *) XpmMalloc(strlen(curbuf) + 1);
    319 + len = strlen(curbuf) + 1;
    320 + s = (char *) XpmMalloc(len);
    321 if (!s) {
    322 xpmFreeColorTable(colorTable, ncolors);
    323 return (XpmNoMemory);
    324 }
    325 defaults[curkey] = s;
    326 - strcpy(s, curbuf);
    327 + memcpy(s, curbuf, len);
    328 }
    329 curkey = key + 1; /* set new key */
    330 *curbuf = '\0'; /* reset curbuf */
    331 @@ -400,9 +426,9 @@
    332 return (XpmFileInvalid);
    333 }
    334 if (!lastwaskey)
    335 - strcat(curbuf, " "); /* append space */
    336 + STRLCAT(curbuf, " ", sizeof(curbuf)); /* append space */
    337 buf[l] = '\0';
    338 - strcat(curbuf, buf);/* append buf */
    339 + STRLCAT(curbuf, buf, sizeof(curbuf));/* append buf */
    340 lastwaskey = 0;
    341 }
    342 }
    343 @@ -410,12 +436,13 @@
    344 xpmFreeColorTable(colorTable, ncolors);
    345 return (XpmFileInvalid);
    346 }
    347 - s = defaults[curkey] = (char *) XpmMalloc(strlen(curbuf) + 1);
    348 + len = strlen(curbuf) + 1;
    349 + s = defaults[curkey] = (char *) XpmMalloc(len);
    350 if (!s) {
    351 xpmFreeColorTable(colorTable, ncolors);
    352 return (XpmNoMemory);
    353 }
    354 - strcpy(s, curbuf);
    355 + memcpy(s, curbuf, len);
    356 }
    357 } else { /* XPM 1 */
    358 /* get to the beginning of the first string */
    359 @@ -428,6 +455,10 @@
    360 /*
    361 * read pixel value
    362 */
    363 + if (cpp >= SIZE_MAX - 1) {
    364 + xpmFreeColorTable(colorTable, ncolors);
    365 + return (XpmNoMemory);
    366 + }
    367 color->string = (char *) XpmMalloc(cpp + 1);
    368 if (!color->string) {
    369 xpmFreeColorTable(colorTable, ncolors);
    370 @@ -456,16 +487,17 @@
    371 *curbuf = '\0'; /* init curbuf */
    372 while ((l = xpmNextWord(data, buf, BUFSIZ))) {
    373 if (*curbuf != '\0')
    374 - strcat(curbuf, " ");/* append space */
    375 + STRLCAT(curbuf, " ", sizeof(curbuf));/* append space */
    376 buf[l] = '\0';
    377 - strcat(curbuf, buf); /* append buf */
    378 + STRLCAT(curbuf, buf, sizeof(curbuf)); /* append buf */
    379 }
    380 - s = (char *) XpmMalloc(strlen(curbuf) + 1);
    381 + len = strlen(curbuf) + 1;
    382 + s = (char *) XpmMalloc(len);
    383 if (!s) {
    384 xpmFreeColorTable(colorTable, ncolors);
    385 return (XpmNoMemory);
    386 }
    387 - strcpy(s, curbuf);
    388 + memcpy(s, curbuf, len);
    389 color->c_color = s;
    390 *curbuf = '\0'; /* reset curbuf */
    391 if (a < ncolors - 1)
    392 @@ -490,6 +522,9 @@
    393 unsigned int *iptr, *iptr2;
    394 unsigned int a, x, y;
    395
    396 + if ((height > 0 && width >= SIZE_MAX / height) ||
    397 + width * height >= SIZE_MAX / sizeof(unsigned int))
    398 + return XpmNoMemory;
    399 #ifndef FOR_MSW
    400 iptr2 = (unsigned int *) XpmMalloc(sizeof(unsigned int) * width * height);
    401 #else
    402 @@ -513,6 +548,9 @@
    403 {
    404 unsigned short colidx[256];
    405
    406 + if (ncolors > 256)
    407 + return (XpmFileInvalid);
    408 +
    409 bzero((char *)colidx, 256 * sizeof(short));
    410 for (a = 0; a < ncolors; a++)
    411 colidx[(unsigned char)colorTable[a].string[0]] = a + 1;
    412 @@ -590,6 +628,9 @@
    413 char *s;
    414 char buf[BUFSIZ];
    415
    416 + if (cpp >= sizeof(buf))
    417 + return (XpmFileInvalid);
    418 +
    419 buf[cpp] = '\0';
    420 if (USE_HASHTABLE) {
    421 xpmHashAtom *slot;