From 85c7d19bdc8f5495a2d530fb6ab8a788877684fc Mon Sep 17 00:00:00 2001 From: Matthias Clasen Date: Thu, 3 Mar 2005 14:03:53 +0000 Subject: [PATCH] Check the number of scanned items. (#168906, Morten Welinder) 2005-03-03 Matthias Clasen * io-xpm.c (pixbuf_create_from_xpm): Check the number of scanned items. (#168906, Morten Welinder) --- gdk-pixbuf/ChangeLog | 3 +++ gdk-pixbuf/io-xpm.c | 9 +++++++++ 2 files changed, 12 insertions(+) diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog index 2f6c1d9c66..d9193d88b0 100644 --- a/gdk-pixbuf/ChangeLog +++ b/gdk-pixbuf/ChangeLog @@ -1,5 +1,8 @@ 2005-03-03 Matthias Clasen + * io-xpm.c (pixbuf_create_from_xpm): Check the number + of scanned items. (#168906, Morten Welinder) + Make the gif loader handle oom when loading animations. (#168857, Tommi Komulainen) diff --git a/gdk-pixbuf/io-xpm.c b/gdk-pixbuf/io-xpm.c index 2125b9c454..45a7cae462 100644 --- a/gdk-pixbuf/io-xpm.c +++ b/gdk-pixbuf/io-xpm.c @@ -1230,6 +1230,15 @@ pixbuf_create_from_xpm (const gchar * (*get_buf) (enum buf_op op, gpointer handl return NULL; } items = sscanf (buffer, "%d %d %d %d %d %d", &w, &h, &n_col, &cpp, &x_hot, &y_hot); + + if (items != 4 && items != 6) { + g_set_error (error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("Invalid XPM header")); + return NULL; + } + if (w <= 0) { g_set_error (error, GDK_PIXBUF_ERROR,