Ticket #88: SDL_image_XCF_fix_infinite_loop.hg.patch

File SDL_image_XCF_fix_infinite_loop.hg.patch, 2.5 KB (added by Thomas Bernard, 5 years ago)

fix for SDL_image 1.2. Avoid infinite loop in XCF loading code

  • IMG_xcf.c 

    # HG changeset patch
# User Thomas Bernard <miniupnp@free.fr>
# Date 1543572255 -3600
#      Fri Nov 30 11:04:15 2018 +0100
# Branch SDL-1.2
# Node ID 68f958f43339b1aa1ad61d470dc8a6b9ef670dcf
# Parent  89225c8816d6d487bee10642d0380442dc19490d
IMG_xcf.c: Avoid infinite loop in read_xcf_header()

diff -r 89225c8816d6 -r 68f958f43339 IMG_xcf.c
    a b  
    263263    |  ((v & 0xFF000000));
    264264}
    265265
    266 static void xcf_read_property (SDL_RWops * src, xcf_prop * prop) {
     266static int xcf_read_property (SDL_RWops * src, xcf_prop * prop) {
    267267  Uint32 len;
    268268  prop->id = SDL_ReadBE32 (src);
    269269  prop->length = SDL_ReadBE32 (src);
    270270
    271271#if DEBUG
    272   printf ("%.8X: %s: %d\n", SDL_RWtell (src), prop->id < 25 ? prop_names [prop->id] : "unknown", prop->length);
     272  printf ("%.8X: %s(%u): %u\n", SDL_RWtell (src), prop->id < 25 ? prop_names [prop->id] : "unknown", prop->id, prop->length);
    273273#endif
    274274
    275275  switch (prop->id) {
    … …  
    301301    break;
    302302  default:
    303303    //    SDL_RWread (src, &prop->data, prop->length, 1);
    304     SDL_RWseek (src, prop->length, RW_SEEK_CUR);
     304    if (SDL_RWseek (src, prop->length, RW_SEEK_CUR) < 0)
     305      return 0;  // ERROR
    305306  }
     307  return 1;  // OK
    306308}
    307309
    308310static void free_xcf_header (xcf_header * h) {
    … …  
    325327  h->width       = SDL_ReadBE32 (src);
    326328  h->height      = SDL_ReadBE32 (src);
    327329  h->image_type  = SDL_ReadBE32 (src);
     330#ifdef DEBUG
     331  printf ("XCF signature : %.14s\n", h->sign);
     332  printf (" (%u,%u) type=%u\n", h->width, h->height, h->image_type);
     333#endif
    328334
    329335  h->properties = NULL;
    330336  h->layer_file_offsets = NULL;
    … …  
    334340
    335341  // Just read, don't save
    336342  do {
    337     xcf_read_property (src, &prop);
     343    if (!xcf_read_property (src, &prop)) {
     344      free_xcf_header (h);
     345      return NULL;
     346    }
    338347    if (prop.id == PROP_COMPRESSION)
    339348      h->compr = (xcf_compr_type)prop.data.compression;
    340349    else if (prop.id == PROP_COLORMAP) {
    … …  
    378387  l->name = read_string (src);
    379388
    380389  do {
    381     xcf_read_property (src, &prop);
     390    if (!xcf_read_property (src, &prop)) {
     391      free_xcf_layer (l);
     392      return NULL;
     393    }
    382394    if (prop.id == PROP_OFFSETS) {
    383395      l->offset_x = prop.data.offset.x;
    384396      l->offset_y = prop.data.offset.y;
    … …  
    410422
    411423  l->selection = 0;
    412424  do {
    413     xcf_read_property (src, &prop);
     425    if (!xcf_read_property (src, &prop)) {
     426      free_xcf_channel (l);
     427      return NULL;
     428    }
    414429    switch (prop.id) {
    415430    case PROP_OPACITY:
    416431      l->opacity = prop.data.opacity << 24;