emacs/gnu.emacs
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/emacs.git synced 2026-09-10 07:46:51 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix undefined behavior in pbm_load

Browse source 
int*int problem reported by Tristan Madani in:
https://bugs.gnu.org/81344
* src/image.c (pbm_load): Avoid undefined behavior when
multiplying ints, or when adding pointer to int.
This commit is contained in:
Paul Eggert 2026-07-06 13:17:17 -07:00
parent 5404761a47
commit b07e634e4c
1 changed files with 13 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
src/image.c
View file

@ -7774,19 +7774,22 @@ pbm_load (struct frame *f, struct image *img)
}
else
{
int expected_size = height * width;
bool two_byte = 255 < max_color_idx;
if (two_byte)
expected_size *= 2;
if (type == PBM_COLOR)
expected_size *= 3;
if (raw_p && p + expected_size > end)
if (raw_p)
{
image_destroy_x_image (ximg);
image_clear_image (f, img);
image_error ("Invalid image size in image `%s'", img->spec);
goto error;
ptrdiff_t expected_size;
bool bad = ckd_mul (&expected_size, height, width);
bad |= ckd_mul (&expected_size, expected_size,
(two_byte ? 2 : 1) * (type == PBM_COLOR ? 3 : 1));
bad |= end - p < expected_size;
if (bad)
{
image_destroy_x_image (ximg);
image_clear_image (f, img);
image_error ("Invalid image size in image `%s'", img->spec);
goto error;
}
}
for (y = 0; y < height; ++y)