View | Details | Raw Unified | Return to bug 11172
Collapse All | Expand All

(-)file_not_specified_in_diff (-3 / +17 lines)
Line  Link Here
0
-- xmms-1.2.10+cvs20060429.orig/xmms/bmp.c
0
++ xmms-1.2.10+cvs20060429/xmms/bmp.c
Lines 19-24 Link Here
19
 */
19
 */
20
#include "xmms.h"
20
#include "xmms.h"
21
21
22
#if HAVE_STDINT_H
23
#include <stdint.h>
24
#elif !defined(UINT32_MAX)
25
#define UINT32_MAX 0xffffffffU
26
#endif
27
22
typedef struct tagRGBQUAD
28
typedef struct tagRGBQUAD
23
{
29
{
24
	guchar rgbBlue;
30
	guchar rgbBlue;
Lines 184-190 Link Here
184
	}
190
	}
185
	else if (bitcount != 24 && bitcount != 16 && bitcount != 32)
191
	else if (bitcount != 24 && bitcount != 16 && bitcount != 32)
186
	{
192
	{
187
		gint ncols, i;
193
		guint32 ncols, i;
188
194
189
		ncols = offset - headSize - 14;
195
		ncols = offset - headSize - 14;
190
		if (headSize == 12)
196
		if (headSize == 12)
Lines 200-209 Link Here
200
		}
206
		}
201
	}
207
	}
202
	fseek(file, offset, SEEK_SET);
208
	fseek(file, offset, SEEK_SET);
209
	/* verify buffer size */
210
	if (!h || !w ||
211
	    w > (((UINT32_MAX - 3) / 3) / h) ||
212
	    h > (((UINT32_MAX - 3) / 3) / w)) {
213
		g_warning("read_bmp(): width(%u)*height(%u) too large", w, h);
214
		fclose(file);
215
		return NULL;
216
	}
217
	data = g_malloc0((w * 3 * h) + 3);	/* +3 is just for safety */
203
	buffer = g_malloc(imgsize);
218
	buffer = g_malloc(imgsize);
204
	fread(buffer, imgsize, 1, file);
219
	fread(buffer, imgsize, 1, file);
205
	fclose(file);
220
	fclose(file);
206
	data = g_malloc0((w * 3 * h) + 3);	/* +3 is just for safety */
207
221
208
	if (bitcount == 1)
222
	if (bitcount == 1)
209
		read_1b_rgb(buffer, imgsize, data, w, h, rgb_quads);
223
		read_1b_rgb(buffer, imgsize, data, w, h, rgb_quads);

Return to bug 11172