From 645f0c53de127d127a801826321da805fda4abbf Mon Sep 17 00:00:00 2001 From: James Zern Date: Wed, 10 May 2017 19:15:50 -0400 Subject: [PATCH] pnmdec,PAM: set bytes_per_px based on depth when missing this avoids setting bytes_per_px < depth causing an undersized allocation for rgb import resulting in a crash. BUG=b/37930872 Change-Id: I32a86f91528acc084a53d08c9fde9f2f1270a603 --- imageio/pnmdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/imageio/pnmdec.c b/imageio/pnmdec.c index 3fa0b78e..6ec8a57a 100644 --- a/imageio/pnmdec.c +++ b/imageio/pnmdec.c @@ -113,7 +113,7 @@ static size_t ReadPAMFields(PNMInfo* const info, size_t off) { } if (!(info->seen_flags & TUPLE_FLAG)) { info->seen_flags |= TUPLE_FLAG; - info->bytes_per_px = 3; + info->bytes_per_px = info->depth * (info->max_value > 255 ? 2 : 1); } if (info->seen_flags != ALL_NEEDED_FLAGS) { fprintf(stderr, "PAM: incomplete header.\n"); @@ -156,6 +156,7 @@ static size_t ReadHeader(PNMInfo* const info) { if (info->width <= 0 || info->height <= 0 || info->type <= 0 || info->type >= 9 || info->depth <= 0 || info->depth > 4 || + info->bytes_per_px < info->depth || info->max_value <= 0 || info->max_value >= 65536) { return 0; }