Menu
▾
▴
[Libwpg-cvs] libwpg/src/lib WPG1Parser.cpp, 1.44, 1.45 WPG1Parser.h, 1.18, 1.19 WPG2Parser.cpp, 1.79, 1.80
|
From: Fridrich S. <str...@us...> - 2008-07-24 13:52:29
|
Update of /cvsroot/libwpg/libwpg/src/lib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv9974/src/lib Modified Files: WPG1Parser.cpp WPG1Parser.h WPG2Parser.cpp Log Message: adding some more robustness to the parser Index: WPG2Parser.cpp =================================================================== RCS file: /cvsroot/libwpg/libwpg/src/lib/WPG2Parser.cpp,v retrieving revision 1.79 retrieving revision 1.80 diff -u -d -r1.79 -r1.80 --- WPG2Parser.cpp 23 Jul 2008 15:05:46 -0000 1.79 +++ WPG2Parser.cpp 24 Jul 2008 13:52:24 -0000 1.80 @@ -1400,14 +1400,14 @@ { if (!m_graphicsStarted) return; - unsigned long width = readU16(); - unsigned long height = readU16(); + unsigned width = readU16(); + unsigned height = readU16(); unsigned color_format = readU8(); unsigned compression_format = readU8(); WPG_DEBUG_MSG((" dimension : %g, %g %g, %g\n", m_bitmap.x1, m_bitmap.y1, m_bitmap.x2, m_bitmap.y2)); - WPG_DEBUG_MSG((" width : %li pixels\n", width)); - WPG_DEBUG_MSG((" height : %li pixels\n", height)); + WPG_DEBUG_MSG((" width : %i pixels\n", width)); + WPG_DEBUG_MSG((" height : %i pixels\n", height)); WPG_DEBUG_MSG((" color format : %d\n", color_format)); WPG_DEBUG_MSG((" compression : %d (%s)\n", compression_format, (compression_format==0) ? "uncompressed": @@ -1415,8 +1415,8 @@ if (color_format > 12) // not documented and we are likely not knowing what to do with this return; - unsigned long tmpBufferSize; - unsigned long raster_len = width; + unsigned tmpBufferSize; + unsigned raster_len = width; if (color_format == 1) { tmpBufferSize = (width/8+1)*height; @@ -1464,7 +1464,7 @@ WPG_DEBUG_MSG(("Decoding RLE data\n")); // FIXME check for ptr, it should not go out of bound!! - while (m_input->tell() <= m_recordEnd && !m_input->atEOS()) + while (m_input->tell() <= m_recordEnd && !m_input->atEOS() && buffer.size() < tmpBufferSize) { unsigned char opcode = readU8(); // specify data size @@ -1574,7 +1574,9 @@ // current raster must be XORed with previous raster unsigned current = next_scanline - raster_len; unsigned previous = current - raster_len; - for( unsigned long r = 0; r < raster_len; r++) + if (current >= buffer.size() || previous >= buffer.size()) + return; + for( unsigned r = 0; r < raster_len; r++) buffer[current++] ^= buffer[previous++]; } @@ -1587,7 +1589,7 @@ // no buffer? format is unknown if(!buffer.size()) return; - for ( ; buffer.size() < tmpBufferSize; ) + while (buffer.size() < tmpBufferSize) buffer.push_back(0); // prepare the bitmap structure for the listener Index: WPG1Parser.h =================================================================== RCS file: /cvsroot/libwpg/libwpg/src/lib/WPG1Parser.h,v retrieving revision 1.18 retrieving revision 1.19 diff -u -d -r1.18 -r1.19 --- WPG1Parser.h 23 Jul 2008 09:53:55 -0000 1.18 +++ WPG1Parser.h 24 Jul 2008 13:52:24 -0000 1.19 @@ -55,8 +55,8 @@ void handleCurvedPolyline(); - void decodeRLE(std::vector<unsigned char>& buffer, int width, int height, int depth); - void fillPixels(libwpg::WPGBitmap& bitmap, const unsigned char* buffer, int width, int height, int depth); + void decodeRLE(std::vector<unsigned char>& buffer, unsigned width, unsigned height, unsigned depth); + void fillPixels(libwpg::WPGBitmap& bitmap, const unsigned char* buffer, unsigned width, unsigned height, unsigned depth); void handleBitmapTypeOne(); void handleBitmapTypeTwo(); void handlePostscriptTypeOne(); Index: WPG1Parser.cpp =================================================================== RCS file: /cvsroot/libwpg/libwpg/src/lib/WPG1Parser.cpp,v retrieving revision 1.44 retrieving revision 1.45 diff -u -d -r1.44 -r1.45 --- WPG1Parser.cpp 23 Jul 2008 15:05:46 -0000 1.44 +++ WPG1Parser.cpp 24 Jul 2008 13:52:24 -0000 1.45 @@ -503,21 +503,26 @@ WPG_DEBUG_MSG(("Curved Polyline\n")); } -void WPG1Parser::decodeRLE(std::vector<unsigned char>& buffer, int width, int height, int depth) +void WPG1Parser::decodeRLE(std::vector<unsigned char>& buffer, unsigned width, unsigned height, unsigned depth) { buffer.clear(); if (depth <= 0 || width <= 0 || height <= 0) return; + + // This are the known depth values for WPG1, no point to try to decode others since they are likely to indicate corruption + if (depth != 8 && depth != 4 && depth != 2 && depth != 1) + return; // round to the next byte unsigned scanline_width = (width * depth + 7)/8; unsigned tmpBufferSize = scanline_width * height; - buffer.reserve(tmpBufferSize); WPG_DEBUG_MSG(("Scanline width: %d\n", scanline_width)); WPG_DEBUG_MSG(("Output size: %d\n", scanline_width * height)); WPG_DEBUG_MSG(("Decoding RLE data\n")); - for(; m_input->tell() < m_recordEnd; ) + + buffer.reserve(tmpBufferSize); + while (m_input->tell() < m_recordEnd && !m_input->atEOS() && buffer.size() < tmpBufferSize) { unsigned char opcode = readU8(); @@ -562,11 +567,11 @@ WPG_DEBUG_MSG(("Finish decoding RLE data\n")); WPG_DEBUG_MSG(("Buffer length: %li\n", (long)buffer.size())); - for ( ; buffer.size() < tmpBufferSize ; ) + while (buffer.size() < tmpBufferSize) buffer.push_back(0); } -void WPG1Parser::fillPixels(libwpg::WPGBitmap& bitmap, const unsigned char* buffer, int width, int height, int depth) +void WPG1Parser::fillPixels(libwpg::WPGBitmap& bitmap, const unsigned char* buffer, unsigned width, unsigned height, unsigned depth) { // sanity if(!buffer) @@ -580,10 +585,10 @@ { libwpg::WPGColor black(0, 0, 0); libwpg::WPGColor white(255, 255, 255); - for(int y = 0; y < height; y++) + for(unsigned y = 0; y < height; y++) { const unsigned char* buf = buffer + y * scanline_width; - for(int x = 0; x < width; x++) + for(unsigned x = 0; x < width; x++) if(buf[x/8] & (0x80 >> (x & 7))) bitmap.setPixel(x, y, white); else @@ -593,9 +598,9 @@ // 2-bit image: 4-color bitmap (indexed) else if(depth == 2) { - int i = 0; - for (int y = 0; y < height; y++) - for (int x = 0; x < width; x++, i++) + unsigned i = 0; + for (unsigned y = 0; y < height; y++) + for (unsigned x = 0; x < width; x++, i++) { if ((x==0) && (i % 4 != 0)) i = (i/4 + 1) * 4; @@ -607,9 +612,9 @@ // 4 -bit image: 16-colour bitmap (indexed) else if(depth == 4) { - int i = 0; - for (int y = 0; y < height; y++) - for (int x = 0; x < width; x++, i++) + unsigned i = 0; + for (unsigned y = 0; y < height; y++) + for (unsigned x = 0; x < width; x++, i++) { if ((x==0) && (i % 2 != 0)) i = (i/2 + 1) * 2; @@ -621,10 +626,10 @@ // 8-bit image: 256-colour image (indexed) else if(depth == 8) { - for(int y = 0; y < height; y++) + for(unsigned y = 0; y < height; y++) { const unsigned char* buf = buffer + y * scanline_width; - for(int x = 0; x < width; x++) + for(unsigned x = 0; x < width; x++) { const libwpg::WPGColor& color = m_colorPalette[buf[x]]; bitmap.setPixel(x, y, color); @@ -636,8 +641,8 @@ // debugging only if(buffer && 0) { - for(int x = 0; x < width; x++) - for(int y = 0; y < height; y++) + for(unsigned x = 0; x < width; x++) + for(unsigned y = 0; y < height; y++) { libwpg::WPGColor color = bitmap.pixel(x,y); WPG_DEBUG_MSG((" pixel at %d, %d: %3d %3d %3d\n", x, y, color.red, color.green, color.blue)); |
