fix dereferencing end() iterator in ParseFormat() and constructing out of bound itera...

[wxWidgets.git] / src / common / imagpcx.cpp

diff --git a/src/common/imagpcx.cpp b/src/common/imagpcx.cpp
index 00ebb750a6a78127b2418a4be0e2870c39427ed4..05f1d66a5e5c9fc9df5d475e8f35d63b3df316bb 100644 (file)
--- a/src/common/imagpcx.cpp
+++ b/src/common/imagpcx.cpp
@@ -1,5 +1,5 @@
 /////////////////////////////////////////////////////////////////////////////
 /////////////////////////////////////////////////////////////////////////////

-// Name:        imagpcx.cpp
+// Name:        src/common/imagpcx.cpp

 // Purpose:     wxImage PCX handler
 // Author:      Guillermo Rodriguez Garcia <guille@iies.es>
 // Version:     1.1
 // Purpose:     wxImage PCX handler
 // Author:      Guillermo Rodriguez Garcia <guille@iies.es>
 // Version:     1.1


@@ -8,33 +8,27 @@
 // Licence:     wxWindows licence
 /////////////////////////////////////////////////////////////////////////////
 
 // Licence:     wxWindows licence
 /////////////////////////////////////////////////////////////////////////////
 

-#if defined(__GNUG__) && !defined(NO_GCC_PRAGMA)
-#pragma implementation "imagpcx.h"
-#endif
-

 // For compilers that support precompilation, includes "wx.h".
 #include "wx/wxprec.h"
 
 #ifdef __BORLANDC__
 // For compilers that support precompilation, includes "wx.h".
 #include "wx/wxprec.h"
 
 #ifdef __BORLANDC__

-#pragma hdrstop
+    #pragma hdrstop

 #endif
 
 #endif
 

+#if wxUSE_IMAGE && wxUSE_PCX
+

 #ifndef WX_PRECOMP
 #ifndef WX_PRECOMP

-#  include "wx/defs.h"
-#  include "wx/palette.h"
+    #include "wx/object.h"
+    #include "wx/list.h"
+    #include "wx/log.h"
+    #include "wx/intl.h"
+    #include "wx/palette.h"
+    #include "wx/hash.h"
+    #include "wx/module.h"

 #endif
 
 #endif
 

-#if wxUSE_IMAGE && wxUSE_PCX
-

 #include "wx/imagpcx.h"
 #include "wx/wfstream.h"
 #include "wx/imagpcx.h"
 #include "wx/wfstream.h"

-#include "wx/module.h"
-#include "wx/log.h"
-#include "wx/intl.h"
-
-#include "wx/hash.h"
-#include "wx/list.h"
-#include "wx/object.h"

 
 //-----------------------------------------------------------------------------
 // wxPCXHandler
 
 //-----------------------------------------------------------------------------
 // wxPCXHandler


@@ -93,17 +87,15 @@ void RLEencode(unsigned char *p, unsigned int size, wxOutputStream& s)
 
 void RLEdecode(unsigned char *p, unsigned int size, wxInputStream& s)
 {
 
 void RLEdecode(unsigned char *p, unsigned int size, wxInputStream& s)
 {

-    unsigned int i, data, cont;
-

     // Read 'size' bytes. The PCX official specs say there will be
     // a decoding break at the end of each scanline (but not at the
     // end of each plane inside a scanline). Only use this function
     // to read one or more _complete_ scanlines. Else, more than
     // 'size' bytes might be read and the buffer might overflow.
 
     // Read 'size' bytes. The PCX official specs say there will be
     // a decoding break at the end of each scanline (but not at the
     // end of each plane inside a scanline). Only use this function
     // to read one or more _complete_ scanlines. Else, more than
     // 'size' bytes might be read and the buffer might overflow.
 

-    while (size > 0)
+    while (size != 0)

     {
     {

-        data = (unsigned char)s.GetC();
+        unsigned int data = (unsigned char)s.GetC();

 
         // If ((data & 0xC0) != 0xC0), then the value read is a data
         // byte. Else, it is a counter (cont = val & 0x3F) and the
 
         // If ((data & 0xC0) != 0xC0), then the value read is a data
         // byte. Else, it is a counter (cont = val & 0x3F) and the


@@ -116,9 +108,11 @@ void RLEdecode(unsigned char *p, unsigned int size, wxInputStream& s)
         }
         else
         {
         }
         else
         {

-            cont = data & 0x3F;
+            unsigned int cont = data & 0x3F;
+            if (cont > size) // can happen only if the file is malformed
+                break;

             data = (unsigned char)s.GetC();
             data = (unsigned char)s.GetC();

-            for (i = 1; i <= cont; i++)
+            for (unsigned int i = 1; i <= cont; i++)

                 *(p++) = (unsigned char)data;
             size -= cont;
         }
                 *(p++) = (unsigned char)data;
             size -= cont;
         }


@@ -504,4 +498,3 @@ bool wxPCXHandler::DoCanRead( wxInputStream& stream )
 #endif // wxUSE_STREAMS
 
 #endif // wxUSE_IMAGE && wxUSE_PCX
 #endif // wxUSE_STREAMS
 
 #endif // wxUSE_IMAGE && wxUSE_PCX

-