patch from Dimitri fixing crashes when decoding the invalid GIFs

[wxWidgets.git] / src / common / xpmdecod.cpp

diff --git a/src/common/xpmdecod.cpp b/src/common/xpmdecod.cpp
index 3b33170ab78a8f26b60f15a77afbe00092d54a35..6f593fc98923b4a45c587ac8de5eb425df41b438 100644 (file)
--- a/src/common/xpmdecod.cpp
+++ b/src/common/xpmdecod.cpp
@@ -114,6 +114,10 @@ license is as follows:
 #include "wx/intl.h"
 #include <string.h>
 
+#ifdef __VISUALC__
+#include <ctype.h>
+#endif
+
 #include "wx/xpmdecod.h"
 
 #if wxUSE_STREAMS
@@ -130,18 +134,22 @@ bool wxXPMDecoder::CanRead(wxInputStream& stream)
 wxImage wxXPMDecoder::ReadFile(wxInputStream& stream)
 {
     size_t length = stream.GetSize();
-    wxCHECK_MSG(length != 0, wxNullImage, wxT("Cannot read XPM from stream of unknown size"));
+    wxCHECK_MSG( length != 0, wxNullImage,
+                 wxT("Cannot read XPM from stream of unknown size") );
 
-    char *xpm_buffer = new char[length];
-    char *p, *q;
-    size_t i;
+    // use a smart buffer to be sure to free memory even when we return on
+    // error
+    wxCharBuffer buffer(length);
 
-    if ( stream.Read(xpm_buffer, length).LastError() != wxSTREAM_NO_ERROR )
-        return FALSE;
+    char *xpm_buffer = (char *)buffer.data();
+    if ( stream.Read(xpm_buffer, length).LastError() == wxSTREAM_READ_ERROR )
+        return wxNullImage;
+    xpm_buffer[length] = '\0';
 
     /*
      *  Remove comments from the file:
      */
+    char *p, *q;
     for (p = xpm_buffer; *p != '\0'; p++)
     {
         if ( (*p == '"') || (*p == '\'') )
@@ -175,7 +183,7 @@ wxImage wxXPMDecoder::ReadFile(wxInputStream& stream)
     /*
      *  Remove unquoted characters:
      */
-    i = 0;
+    size_t i = 0;
     for (p = xpm_buffer; *p != '\0'; p++)
     {
         if ( *p != '"' )
@@ -203,6 +211,12 @@ wxImage wxXPMDecoder::ReadFile(wxInputStream& stream)
             lines_cnt++;
     }
 
+    if ( !lines_cnt )
+    {
+        // this doesn't really look an XPM image
+        return wxNullImage;
+    }
+
     xpm_lines = new const char*[lines_cnt];
     xpm_lines[0] = xpm_buffer;
     line = 1;
@@ -221,12 +235,12 @@ wxImage wxXPMDecoder::ReadFile(wxInputStream& stream)
      */
     wxImage img = ReadData(xpm_lines);
 
-    delete[] xpm_buffer;
 #ifdef __WIN16__
     delete[] (char**) xpm_lines;
 #else
     delete[] xpm_lines;
 #endif
+
     return img;
 }
 #endif // wxUSE_STREAMS
@@ -523,12 +537,14 @@ static bool GetRGBFromName(const char *inname, bool *isNone,
     char *name;
     char *grey, *p;
 
-    // #rrggbb are not in database, we parse them directly
-    if ( *inname == '#' && strlen(inname) == 7 )
+    // Neither #rrggbb nor #rrrrggggbbbb are in database, we parse them directly
+    size_t inname_len = strlen(inname);
+    if ( *inname == '#' && (inname_len == 7 || inname_len == 13))
     {
+        size_t ofs = (inname_len == 7) ? 2 : 4;
         *r = ParseHexadecimal(inname[1], inname[2]);
-        *g = ParseHexadecimal(inname[3], inname[4]);
-        *b = ParseHexadecimal(inname[5], inname[6]);
+        *g = ParseHexadecimal(inname[1*ofs+1], inname[1*ofs+2]);
+        *b = ParseHexadecimal(inname[2*ofs+1], inname[2*ofs+2]);
         *isNone = FALSE;
         return TRUE;
     }
@@ -561,41 +577,47 @@ static bool GetRGBFromName(const char *inname, bool *isNone,
         grey[2] = 'a';
 
     // check for special 'none' colour:
+    bool found;
     if ( strcmp(name, "none") == 0 )
     {
         *isNone = TRUE;
-        return TRUE;
+        found = TRUE;
     }
-
-    // binary search:
-    left = 0;
-    right = numTheRGBRecords - 1;
-    do
+    else // not "None"
     {
-        middle = (left + right) / 2;
-        cmp = strcmp(name, theRGBRecords[middle].name);
-        if ( cmp == 0 )
-        {
-            rgbVal = theRGBRecords[middle].rgb;
-            *r = (unsigned char)((rgbVal >> 16) & 0xFF);
-            *g = (unsigned char)((rgbVal >> 8) & 0xFF);
-            *b = (unsigned char)((rgbVal) & 0xFF);
-            *isNone = FALSE;
-            free(name);
-            return TRUE;
-        }
-        else if ( cmp < 0 )
+        found = FALSE;
+
+        // binary search:
+        left = 0;
+        right = numTheRGBRecords - 1;
+        do
         {
-            right = middle - 1;
-        }
-        else
-        {           // > 0
-            left = middle + 1;
-        }
-    } while (left <= right);
+            middle = (left + right) / 2;
+            cmp = strcmp(name, theRGBRecords[middle].name);
+            if ( cmp == 0 )
+            {
+                rgbVal = theRGBRecords[middle].rgb;
+                *r = (unsigned char)((rgbVal >> 16) & 0xFF);
+                *g = (unsigned char)((rgbVal >> 8) & 0xFF);
+                *b = (unsigned char)((rgbVal) & 0xFF);
+                *isNone = FALSE;
+                found = TRUE;
+                break;
+            }
+            else if ( cmp < 0 )
+            {
+                right = middle - 1;
+            }
+            else // cmp > 0
+            {
+                left = middle + 1;
+            }
+        } while (left <= right);
+    }
 
     free(name);
-    return FALSE;
+
+    return found;
 }
 
 static const char *ParseColor(const char *data)
@@ -641,8 +663,8 @@ wxImage wxXPMDecoder::ReadData(const char **xpm_data)
     wxImage img;
     int count;
     unsigned width, height, colors_cnt, chars_per_pixel;
-    unsigned i, j;
-    char key[64];
+    size_t i, j, i_key;
+    wxChar key[64];
     const char *clr_def;
     bool hasMask;
     wxXPMColourMapData *clr_data;
@@ -669,7 +691,7 @@ wxImage wxXPMDecoder::ReadData(const char **xpm_data)
     if ( !img.Ok() ) return img;
 
     img.SetMask(FALSE);
-    key[chars_per_pixel] = '\0';
+    key[chars_per_pixel] = wxT('\0');
     hasMask = FALSE;
     clr_tbl.DeleteContents(TRUE);
 
@@ -678,7 +700,8 @@ wxImage wxXPMDecoder::ReadData(const char **xpm_data)
      */
     for (i = 0; i < colors_cnt; i++)
     {
-        memcpy(key, xpm_data[1 + i], chars_per_pixel);
+        for (i_key = 0; i_key < chars_per_pixel; i_key++)
+            key[i_key] = (wxChar)xpm_data[1 + i][i_key];
         clr_def = ParseColor(xpm_data[1 + i]);
         clr_data = new wxXPMColourMapData;
 
@@ -725,9 +748,9 @@ wxImage wxXPMDecoder::ReadData(const char **xpm_data)
     {
         for (i = 0; i < width; i++, img_data += 3)
         {
-            memcpy(key,
-                   xpm_data[1 + colors_cnt + j] + chars_per_pixel * i,
-                   chars_per_pixel);
+            for (i_key = 0; i_key < chars_per_pixel; i_key++)
+                key[i_key] = (wxChar)xpm_data[1 + colors_cnt + j]
+                                             [chars_per_pixel * i + i_key];
             clr_data = (wxXPMColourMapData*) clr_tbl.Get(key);
             if ( clr_data == NULL )
             {
@@ -745,5 +768,4 @@ wxImage wxXPMDecoder::ReadData(const char **xpm_data)
     return img;
 }
 
-
 #endif // wxUSE_IMAGE && wxUSE_XPM