iliaa Tue Jun 3 19:42:31 2003 EDT
Modified files:
/php4/ext/gd/libgd gd_gif_in.c gd_png.c gdxpm.c wbmp.c
Log:
Last set of integer overflow checks.
Index: php4/ext/gd/libgd/gd_gif_in.c
diff -u php4/ext/gd/libgd/gd_gif_in.c:1.3 php4/ext/gd/libgd/gd_gif_in.c:1.4
--- php4/ext/gd/libgd/gd_gif_in.c:1.3 Sun Dec 1 06:43:54 2002
+++ php4/ext/gd/libgd/gd_gif_in.c Tue Jun 3 19:42:31 2003
@@ -299,7 +299,7 @@
rv = GetDataBlock_(fd,buf);
if (VERBOSE) {
if (rv > 0) {
- tmp = emalloc((3*sizeof(char)*rv) + 1);
+ tmp = safe_emalloc(3 * rv, sizeof(char), 1);
for (i=0;i<rv;i++) {
sprintf(&tmp[3*sizeof(char)*i], " %02x", buf[i]);
}
Index: php4/ext/gd/libgd/gd_png.c
diff -u php4/ext/gd/libgd/gd_png.c:1.13 php4/ext/gd/libgd/gd_png.c:1.14
--- php4/ext/gd/libgd/gd_png.c:1.13 Tue Apr 29 20:37:31 2003
+++ php4/ext/gd/libgd/gd_png.c Tue Jun 3 19:42:31 2003
@@ -281,9 +281,9 @@
/* allocate space for the PNG image data */
rowbytes = png_get_rowbytes(png_ptr, info_ptr);
- image_data = (png_bytep) gdMalloc (rowbytes * height);
+ image_data = (png_bytep) safe_emalloc(rowbytes, height, 0);
- row_pointers = (png_bytepp) gdMalloc (height * sizeof (png_bytep));
+ row_pointers = (png_bytepp) safe_emalloc(height, sizeof(png_bytep), 0);
/* set the individual row_pointers to point at the correct offsets */
for (h = 0; h < height; ++h) {
@@ -625,10 +625,10 @@
int channels = im->saveAlphaFlag ? 4 : 3;
/* Our little 7-bit alpha channel trick costs us a bit here. */
png_bytep *row_pointers;
- row_pointers = gdMalloc(sizeof (png_bytep) * height);
+ row_pointers = safe_emalloc(sizeof(png_bytep), height, 0);
for (j = 0; j < height; ++j) {
int bo = 0;
- row_pointers[j] = (png_bytep) gdMalloc(width * channels);
+ row_pointers[j] = (png_bytep) safe_emalloc(width, channels, 0);
for (i = 0; i < width; ++i) {
unsigned char a;
row_pointers[j][bo++] =
gdTrueColorGetRed(im->tpixels[j][i]);
@@ -659,7 +659,7 @@
} else {
if (remap) {
png_bytep *row_pointers;
- row_pointers = gdMalloc(sizeof (png_bytep) * height);
+ row_pointers = safe_emalloc(height, sizeof(png_bytep), 0);
for (j = 0; j < height; ++j) {
row_pointers[j] = (png_bytep) gdMalloc(width);
for (i = 0; i < width; ++i) {
Index: php4/ext/gd/libgd/gdxpm.c
diff -u php4/ext/gd/libgd/gdxpm.c:1.5 php4/ext/gd/libgd/gdxpm.c:1.6
--- php4/ext/gd/libgd/gdxpm.c:1.5 Tue Mar 18 13:29:10 2003
+++ php4/ext/gd/libgd/gdxpm.c Tue Jun 3 19:42:31 2003
@@ -38,7 +38,7 @@
}
number = image.ncolors;
- colors = (int *) gdMalloc (sizeof (int) * number);
+ colors = (int *) safe_emalloc(number, sizeof(int), 0);
for (i = 0; i < number; i++) {
switch (strlen (image.colorTable[i].c_color)) {
case 4:
Index: php4/ext/gd/libgd/wbmp.c
diff -u php4/ext/gd/libgd/wbmp.c:1.2 php4/ext/gd/libgd/wbmp.c:1.3
--- php4/ext/gd/libgd/wbmp.c:1.2 Sun Aug 11 09:50:27 2002
+++ php4/ext/gd/libgd/wbmp.c Tue Jun 3 19:42:31 2003
@@ -176,7 +176,7 @@
printf ("W: %d, H: %d\n", wbmp->width, wbmp->height);
#endif
- if ((wbmp->bitmap = (int *) gdMalloc (sizeof (int) * wbmp->width * wbmp->height))
== NULL)
+ if ((wbmp->bitmap = (int *) safe_emalloc(wbmp->width * wbmp->height, sizeof(int),
0)) == NULL)
{
gdFree (wbmp);
return (-1);
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
