fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / imagpnm.cpp

diff --git a/src/common/imagpnm.cpp b/src/common/imagpnm.cpp
index ce31404d45c9721dcf6275eea4418a805fd398d8..731220450b67e54121d9216ecd872b9528666191 100644 (file)
--- a/src/common/imagpnm.cpp
+++ b/src/common/imagpnm.cpp
@@ -1,5 +1,5 @@
 /////////////////////////////////////////////////////////////////////////////
-// Name:        imagpnm.cpp
+// Name:        src/common/imagpnm.cpp
 // Purpose:     wxImage PNM handler
 // Author:      Sylvain Bougnoux
 // RCS-ID:      $Id$
@@ -7,26 +7,22 @@
 // Licence:     wxWindows licence
 /////////////////////////////////////////////////////////////////////////////
 
-#if defined(__GNUG__) && !defined(NO_GCC_PRAGMA)
-#pragma implementation "imagpnm.h"
-#endif
-
 // For compilers that support precompilation, includes "wx.h".
 #include "wx/wxprec.h"
 
 #ifdef __BORLANDC__
-#pragma hdrstop
-#endif
-
-#ifndef WX_PRECOMP
-#  include "wx/setup.h"
+    #pragma hdrstop
 #endif
 
 #if wxUSE_IMAGE && wxUSE_PNM
 
 #include "wx/imagpnm.h"
-#include "wx/log.h"
-#include "wx/intl.h"
+
+#ifndef WX_PRECOMP
+    #include "wx/intl.h"
+    #include "wx/log.h"
+#endif
+
 #include "wx/txtstrm.h"
 
 //-----------------------------------------------------------------------------
@@ -68,12 +64,15 @@ bool wxPNMHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbose
 
     switch (c)
     {
-        case wxT('2'): // ASCII Grey 
+        case wxT('2'): // ASCII Grey
         case wxT('3'): // ASCII RGB
         case wxT('5'): // RAW Grey
         case wxT('6'): break;
         default:
-            if (verbose) wxLogError(_("PNM: File format is not recognized."));
+            if (verbose)
+            {
+                wxLogError(_("PNM: File format is not recognized."));
+            }
             return false;
     }
 
@@ -89,63 +88,88 @@ bool wxPNMHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbose
     if (!ptr)
     {
         if (verbose)
+        {
            wxLogError( _("PNM: Couldn't allocate memory.") );
+        }
         return false;
     }
 
 
-    if (c=='2') // Ascii GREY 
-    {    
+    if (c=='2') // Ascii GREY
+    {
         wxUint32 value, size=width*height;
         for (wxUint32 i=0; i<size; ++i)
         {
             value=text_stream.Read32();
+            if ( maxval != 255 )
+                value = (255 * value)/maxval;
             *ptr++=(unsigned char)value; // R
-            *ptr++=(unsigned char)value; // G 
+            *ptr++=(unsigned char)value; // G
             *ptr++=(unsigned char)value; // B
             if ( !buf_stream )
             {
-                if (verbose) wxLogError(_("PNM: File seems truncated."));
+                if (verbose)
+                {
+                    wxLogError(_("PNM: File seems truncated."));
+                }
                 return false;
             }
         }
     }
-   if (c=='3') // Ascii RBG
-      {
+    if (c=='3') // Ascii RBG
+    {
         wxUint32 value, size=3*width*height;
         for (wxUint32 i=0; i<size; ++i)
           {
             //this is very slow !!!
             //I wonder how we can make any better ?
             value=text_stream.Read32();
+            if ( maxval != 255 )
+                value = (255 * value)/maxval;
             *ptr++=(unsigned char)value;
 
             if ( !buf_stream )
               {
-                if (verbose) wxLogError(_("PNM: File seems truncated."));
+                if (verbose)
+                {
+                    wxLogError(_("PNM: File seems truncated."));
+                }
                 return false;
               }
           }
-      }
-   if (c=='5') // Raw GREY
-    {    
+    }
+    if (c=='5') // Raw GREY
+    {
         wxUint32 size=width*height;
         unsigned char value;
         for (wxUint32 i=0; i<size; ++i)
         {
             buf_stream.Read(&value,1);
+            if ( maxval != 255 )
+                value = (255 * value)/maxval;
             *ptr++=value; // R
             *ptr++=value; // G
-            *ptr++=value; // B 
+            *ptr++=value; // B
             if ( !buf_stream )
             {
-                if (verbose) wxLogError(_("PNM: File seems truncated."));
+                if (verbose)
+                {
+                    wxLogError(_("PNM: File seems truncated."));
+                }
                 return false;
             }
         }
     }
-    if (c=='6') // Raw RGB
-      buf_stream.Read( ptr, 3*width*height );
+
+    if ( c=='6' ) // Raw RGB
+    {
+        buf_stream.Read(ptr, 3*width*height);
+        if ( maxval != 255 )
+        {
+            for ( unsigned i = 0; i < 3*width*height; i++ )
+                ptr[i] = (255 * ptr[i])/maxval;
+        }
+    }
 
     image->SetMask( false );
 
@@ -170,12 +194,15 @@ bool wxPNMHandler::DoCanRead( wxInputStream& stream )
 {
     Skip_Comment(stream);
 
+    // it's ok to modify the stream position here
     if ( stream.GetC() == 'P' )
     {
-        switch (stream.GetC())
+        switch ( stream.GetC() )
         {
-            case '3':
-            case '6':
+            case '2': // ASCII Grey
+            case '3': // ASCII RGB
+            case '5': // RAW Grey
+            case '6': // RAW RGB
                 return true;
         }
     }
@@ -186,4 +213,4 @@ bool wxPNMHandler::DoCanRead( wxInputStream& stream )
 
 #endif // wxUSE_STREAMS
 
-#endif // wxUSE_PNM
+#endif // wxUSE_IMAGE && wxUSE_PNM