fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / imagbmp.cpp

diff --git a/src/common/imagbmp.cpp b/src/common/imagbmp.cpp
index bf232cd51adbd34b74d252fb13e0052e2dc9a248..f3c7f8c0407e52159932787bdc8a69a2972227e0 100644 (file)
--- a/src/common/imagbmp.cpp
+++ b/src/common/imagbmp.cpp
@@ -39,6 +39,16 @@
 // For memcpy
 #include <string.h>
 
 // For memcpy
 #include <string.h>
 

+// ----------------------------------------------------------------------------
+// private functions
+// ----------------------------------------------------------------------------
+
+#if wxUSE_ICO_CUR
+
+static bool CanReadICOOrCUR(wxInputStream *stream, wxUint16 resourceType);
+
+#endif // wxUSE_ICO_CUR
+

 //-----------------------------------------------------------------------------
 // wxBMPHandler
 //-----------------------------------------------------------------------------
 //-----------------------------------------------------------------------------
 // wxBMPHandler
 //-----------------------------------------------------------------------------


@@ -81,7 +91,7 @@ bool wxBMPHandler::SaveDib(wxImage *image,
 {
     wxCHECK_MSG( image, false, wxT("invalid pointer in wxBMPHandler::SaveFile") );
 
 {
     wxCHECK_MSG( image, false, wxT("invalid pointer in wxBMPHandler::SaveFile") );
 

-    if ( !image->Ok() )
+    if ( !image->IsOk() )

     {
         if ( verbose )
         {
     {
         if ( verbose )
         {


@@ -136,8 +146,8 @@ bool wxBMPHandler::SaveDib(wxImage *image,
     }
 
     unsigned width = image->GetWidth();
     }
 
     unsigned width = image->GetWidth();

-    unsigned row_padding = (4 - int(width*bpp/8.0) % 4) % 4; // # bytes to pad to dword
-    unsigned row_width = int(width * bpp/8.0) + row_padding; // # of bytes per row
+    unsigned row_padding = (4 - ((width * bpp + 7) / 8) % 4) % 4; // # bytes to pad to dword
+    unsigned row_width = (width * bpp + 7) / 8 + row_padding; // # of bytes per row

 
     struct
     {
 
     struct
     {


@@ -341,7 +351,7 @@ bool wxBMPHandler::SaveDib(wxImage *image,
 
     // pointer to the image data, use quantized if available
     wxUint8 *data = (wxUint8*) image->GetData();
 
     // pointer to the image data, use quantized if available
     wxUint8 *data = (wxUint8*) image->GetData();

-    if (q_image) if (q_image->Ok()) data = (wxUint8*) q_image->GetData();
+    if (q_image) if (q_image->IsOk()) data = (wxUint8*) q_image->GetData();

 
     wxUint8 *buffer = new wxUint8[row_width];
     memset(buffer, 0, row_width);
 
     wxUint8 *buffer = new wxUint8[row_width];
     memset(buffer, 0, row_width);


@@ -523,6 +533,14 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
 
     wxON_BLOCK_EXIT1(&BMPPalette::Free, cmap);
 
 
     wxON_BLOCK_EXIT1(&BMPPalette::Free, cmap);
 

+    bool isUpsideDown = true;
+
+    if (height < 0)
+    {
+        isUpsideDown = false;
+        height = -height;
+    }
+

     // destroy existing here instead of:
     image->Destroy();
     image->Create(width, height);
     // destroy existing here instead of:
     image->Destroy();
     image->Create(width, height);


@@ -599,7 +617,7 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
     {
         if ( comp == BI_BITFIELDS )
         {
     {
         if ( comp == BI_BITFIELDS )
         {

-            int bit = 0;
+            int bit;

             stream.Read(dbuf, 4 * 3);
             rmask = wxINT32_SWAP_ON_BE(dbuf[0]);
             gmask = wxINT32_SWAP_ON_BE(dbuf[1]);
             stream.Read(dbuf, 4 * 3);
             rmask = wxINT32_SWAP_ON_BE(dbuf[0]);
             gmask = wxINT32_SWAP_ON_BE(dbuf[1]);


@@ -661,8 +679,10 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
     {
         // NOTE: seeking a positive amount in wxFromCurrent mode allows us to
         //       load even non-seekable streams (see wxInputStream::SeekI docs)!
     {
         // NOTE: seeking a positive amount in wxFromCurrent mode allows us to
         //       load even non-seekable streams (see wxInputStream::SeekI docs)!

-        if (stream.SeekI(bmpOffset, wxFromCurrent) == wxInvalidOffset)
-            return false;
+        const wxFileOffset pos = stream.TellI();
+        if (pos != wxInvalidOffset && bmpOffset > pos)
+            if (stream.SeekI(bmpOffset - pos, wxFromCurrent) == wxInvalidOffset)
+                return false;

         //else: icon, just carry on
     }
 
         //else: icon, just carry on
     }
 


@@ -682,9 +702,18 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
 
     int linesize = ((width * bpp + 31) / 32) * 4;
 
 
     int linesize = ((width * bpp + 31) / 32) * 4;
 

-    /* BMPs are stored upside down */
-    for ( int line = (height - 1); line >= 0; line-- )
+    // flag indicating if we have any not fully transparent alpha values: this
+    // is used to account for the bitmaps which use 32bpp format (normally
+    // meaning that they have alpha channel) but have only zeroes in it so that
+    // without this hack they appear fully transparent -- and as this is
+    // unlikely intentional, we consider that they don't have alpha at all in
+    // this case (see #10915)
+    bool hasValidAlpha = false;
+
+    for ( int row = 0; row < height; row++ )

     {
     {

+        int line = isUpsideDown ? height - 1 - row : row;
+

         int linepos = 0;
         for ( int column = 0; column < width ; )
         {
         int linepos = 0;
         for ( int column = 0; column < width ; )
         {


@@ -714,21 +743,24 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
                         {
                             if ( aByte == 0 )
                             {
                         {
                             if ( aByte == 0 )
                             {

-                                if ( column > 0 )
-                                    column = width;
+                                // end of scanline marker
+                                column = width;
+                                row--;

                             }
                             else if ( aByte == 1 )
                             {
                             }
                             else if ( aByte == 1 )
                             {

+                                // end of RLE data marker, stop decoding

                                 column = width;
                                 column = width;

-                                line = -1;
+                                row = height;

                             }
                             else if ( aByte == 2 )
                             {
                             }
                             else if ( aByte == 2 )
                             {

+                                // delta marker, move in image

                                 aByte = stream.GetC();
                                 column += aByte;
                                 linepos = column * bpp / 4;
                                 aByte = stream.GetC();
                                 aByte = stream.GetC();
                                 column += aByte;
                                 linepos = column * bpp / 4;
                                 aByte = stream.GetC();

-                                line -= aByte; // upside down
+                                row += aByte; // upside down

                             }
                             else
                             {
                             }
                             else
                             {


@@ -776,7 +808,7 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
                     {
                         for (int nibble = 0; nibble < 2 && column < width; nibble++)
                         {
                     {
                         for (int nibble = 0; nibble < 2 && column < width; nibble++)
                         {

-                            int index = ((aByte & (0xF0 >> nibble * 4)) >> (!nibble * 4));
+                            int index = ((aByte & (0xF0 >> (nibble * 4))) >> (!nibble * 4));

                             if ( index >= 16 )
                                 index = 15;
                             ptr[poffset] = cmap[index].r;
                             if ( index >= 16 )
                                 index = 15;
                             ptr[poffset] = cmap[index].r;


@@ -797,20 +829,24 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
                         {
                             if ( aByte == 0 )
                             {
                         {
                             if ( aByte == 0 )
                             {

-                                /* column = width; */
+                                // end of scanline marker
+                                column = width;
+                                row--;

                             }
                             else if ( aByte == 1 )
                             {
                             }
                             else if ( aByte == 1 )
                             {

+                                // end of RLE data marker, stop decoding

                                 column = width;
                                 column = width;

-                                line = -1;
+                                row = height;

                             }
                             else if ( aByte == 2 )
                             {
                             }
                             else if ( aByte == 2 )
                             {

+                                // delta marker, move in image

                                 aByte = stream.GetC();
                                 column += aByte;
                                 linepos = column * bpp / 8;
                                 aByte = stream.GetC();
                                 aByte = stream.GetC();
                                 column += aByte;
                                 linepos = column * bpp / 8;
                                 aByte = stream.GetC();

-                                line += aByte;
+                                row -= aByte;

                             }
                             else
                             {
                             }
                             else
                             {


@@ -865,15 +901,15 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
                 stream.Read(&aWord, 2);
                 aWord = wxUINT16_SWAP_ON_BE(aWord);
                 linepos += 2;
                 stream.Read(&aWord, 2);
                 aWord = wxUINT16_SWAP_ON_BE(aWord);
                 linepos += 2;

-                /* use the masks and calculated amonut of shift
+                /* Use the masks and calculated amount of shift

                    to retrieve the color data out of the word.  Then
                    shift it left by (8 - number of bits) such that
                    the image has the proper dynamic range */
                    to retrieve the color data out of the word.  Then
                    shift it left by (8 - number of bits) such that
                    the image has the proper dynamic range */

-                temp = (unsigned char)((aWord & rmask) >> rshift << (8-rbits));
+                temp = (unsigned char)(((aWord & rmask) >> rshift) << (8-rbits));

                 ptr[poffset] = temp;
                 ptr[poffset] = temp;

-                temp = (unsigned char)((aWord & gmask) >> gshift << (8-gbits));
+                temp = (unsigned char)(((aWord & gmask) >> gshift) << (8-gbits));

                 ptr[poffset + 1] = temp;
                 ptr[poffset + 1] = temp;

-                temp = (unsigned char)((aWord & bmask) >> bshift << (8-bbits));
+                temp = (unsigned char)(((aWord & bmask) >> bshift) << (8-bbits));

                 ptr[poffset + 2] = temp;
                 column++;
             }
                 ptr[poffset + 2] = temp;
                 column++;
             }


@@ -893,6 +929,9 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
                 {
                     temp = (unsigned char)((aDword & amask) >> ashift);
                     alpha[line * width + column] = temp;
                 {
                     temp = (unsigned char)((aDword & amask) >> ashift);
                     alpha[line * width + column] = temp;

+
+                    if ( temp != wxALPHA_TRANSPARENT )
+                        hasValidAlpha = true;

                 }
                 column++;
             }
                 }
                 column++;
             }


@@ -908,6 +947,13 @@ bool wxBMPHandler::DoLoadDib(wxImage * image, int width, int height,
 
     image->SetMask(false);
 
 
     image->SetMask(false);
 

+    // check if we had any valid alpha values in this bitmap
+    if ( alpha && !hasValidAlpha )
+    {
+        // we didn't, so finally discard the alpha channel completely
+        image->ClearAlpha();
+    }
+

     const wxStreamError err = stream.GetLastError();
     return err == wxSTREAM_NO_ERROR || err == wxSTREAM_EOF;
 }
     const wxStreamError err = stream.GetLastError();
     return err == wxSTREAM_NO_ERROR || err == wxSTREAM_EOF;
 }


@@ -1219,7 +1265,7 @@ bool wxICOHandler::SaveFile(wxImage *image,
         // wxCountingOutputStream::IsOk() always returns true for now and this
         // "if" provokes VC++ warnings in optimized build
 #if 0
         // wxCountingOutputStream::IsOk() always returns true for now and this
         // "if" provokes VC++ warnings in optimized build
 #if 0

-        if ( !cStream.Ok() )
+        if ( !cStream.IsOk() )

         {
             if ( verbose )
             {
         {
             if ( verbose )
             {


@@ -1305,6 +1351,11 @@ bool wxICOHandler::SaveFile(wxImage *image,
 bool wxICOHandler::LoadFile(wxImage *image, wxInputStream& stream,
                             bool verbose, int index)
 {
 bool wxICOHandler::LoadFile(wxImage *image, wxInputStream& stream,
                             bool verbose, int index)
 {

+    if ( stream.IsSeekable() && stream.SeekI(0) == wxInvalidOffset )
+    {
+        return false;
+    }
+

     return DoLoadFile(image, stream, verbose, index);
 }
 
     return DoLoadFile(image, stream, verbose, index);
 }
 


@@ -1318,7 +1369,7 @@ bool wxICOHandler::DoLoadFile(wxImage *image, wxInputStream& stream,
 
     stream.Read(&IconDir, sizeof(IconDir));
     wxUint16 nIcons = wxUINT16_SWAP_ON_BE(IconDir.idCount);
 
     stream.Read(&IconDir, sizeof(IconDir));
     wxUint16 nIcons = wxUINT16_SWAP_ON_BE(IconDir.idCount);

-    
+

     // nType is 1 for Icons, 2 for Cursors:
     wxUint16 nType = wxUINT16_SWAP_ON_BE(IconDir.idType);
 
     // nType is 1 for Icons, 2 for Cursors:
     wxUint16 nType = wxUINT16_SWAP_ON_BE(IconDir.idType);
 


@@ -1331,11 +1382,11 @@ bool wxICOHandler::DoLoadFile(wxImage *image, wxInputStream& stream,
 
     // remember how many bytes we read from the stream:
     wxFileOffset alreadySeeked = sizeof(IconDir);
 
     // remember how many bytes we read from the stream:
     wxFileOffset alreadySeeked = sizeof(IconDir);

-    
+

     for (unsigned int i = 0; i < nIcons; i++ )
     {
         alreadySeeked += stream.Read(pCurrentEntry, sizeof(ICONDIRENTRY)).LastRead();
     for (unsigned int i = 0; i < nIcons; i++ )
     {
         alreadySeeked += stream.Read(pCurrentEntry, sizeof(ICONDIRENTRY)).LastRead();

-        
+

         // bHeight and bColorCount are wxUint8
         if ( pCurrentEntry->bWidth >= wMax )
         {
         // bHeight and bColorCount are wxUint8
         if ( pCurrentEntry->bWidth >= wMax )
         {


@@ -1349,7 +1400,7 @@ bool wxICOHandler::DoLoadFile(wxImage *image, wxInputStream& stream,
                 colmax = pCurrentEntry->bColorCount;
             }
         }
                 colmax = pCurrentEntry->bColorCount;
             }
         }

-        
+

         pCurrentEntry++;
     }
 
         pCurrentEntry++;
     }
 


@@ -1369,13 +1420,13 @@ bool wxICOHandler::DoLoadFile(wxImage *image, wxInputStream& stream,
     {
         // seek to selected icon:
         pCurrentEntry = pIconDirEntry + iSel;
     {
         // seek to selected icon:
         pCurrentEntry = pIconDirEntry + iSel;

-        
+

         // NOTE: seeking a positive amount in wxFromCurrent mode allows us to
         //       load even non-seekable streams (see wxInputStream::SeekI docs)!
         wxFileOffset offset = wxUINT32_SWAP_ON_BE(pCurrentEntry->dwImageOffset) - alreadySeeked;
         if (offset != 0 && stream.SeekI(offset, wxFromCurrent) == wxInvalidOffset)
             return false;
         // NOTE: seeking a positive amount in wxFromCurrent mode allows us to
         //       load even non-seekable streams (see wxInputStream::SeekI docs)!
         wxFileOffset offset = wxUINT32_SWAP_ON_BE(pCurrentEntry->dwImageOffset) - alreadySeeked;
         if (offset != 0 && stream.SeekI(offset, wxFromCurrent) == wxInvalidOffset)
             return false;

-        
+

         bResult = LoadDib(image, stream, true, IsBmp);
         bool bIsCursorType = (this->GetType() == wxBITMAP_TYPE_CUR) || (this->GetType() == wxBITMAP_TYPE_ANI);
         if ( bResult && bIsCursorType && nType == 2 )
         bResult = LoadDib(image, stream, true, IsBmp);
         bool bIsCursorType = (this->GetType() == wxBITMAP_TYPE_CUR) || (this->GetType() == wxBITMAP_TYPE_ANI);
         if ( bResult && bIsCursorType && nType == 2 )


@@ -1385,31 +1436,33 @@ bool wxICOHandler::DoLoadFile(wxImage *image, wxInputStream& stream,
             image->SetOption(wxIMAGE_OPTION_CUR_HOTSPOT_Y, wxUINT16_SWAP_ON_BE(pCurrentEntry->wBitCount));
         }
     }
             image->SetOption(wxIMAGE_OPTION_CUR_HOTSPOT_Y, wxUINT16_SWAP_ON_BE(pCurrentEntry->wBitCount));
         }
     }

-    
+

     delete [] pIconDirEntry;
     delete [] pIconDirEntry;

-    
+

     return bResult;
 }
 
 int wxICOHandler::DoGetImageCount(wxInputStream& stream)
 {
     return bResult;
 }
 
 int wxICOHandler::DoGetImageCount(wxInputStream& stream)
 {

+    // It's ok to modify the stream position in this function.
+
+    if ( stream.IsSeekable() && stream.SeekI(0) == wxInvalidOffset )
+    {
+        return 0;
+    }
+

     ICONDIR IconDir;
 
     if (stream.Read(&IconDir, sizeof(IconDir)).LastRead() != sizeof(IconDir))
     ICONDIR IconDir;
 
     if (stream.Read(&IconDir, sizeof(IconDir)).LastRead() != sizeof(IconDir))

-             // it's ok to modify the stream position here

         return 0;
         return 0;

-    
+

     return (int)wxUINT16_SWAP_ON_BE(IconDir.idCount);
 }
 
 bool wxICOHandler::DoCanRead(wxInputStream& stream)
 {
     return (int)wxUINT16_SWAP_ON_BE(IconDir.idCount);
 }
 
 bool wxICOHandler::DoCanRead(wxInputStream& stream)
 {

-    unsigned char hdr[4];
-    if ( !stream.Read(hdr, WXSIZEOF(hdr)) )     // it's ok to modify the stream position here
-        return false;
+    return CanReadICOOrCUR(&stream, 1 /*for identifying an icon*/);

 
 

-    // hdr[2] is one for an icon and two for a cursor
-    return hdr[0] == '\0' && hdr[1] == '\0' && hdr[2] == '\1' && hdr[3] == '\0';

 }
 
 #endif // wxUSE_STREAMS
 }
 
 #endif // wxUSE_STREAMS


@@ -1425,12 +1478,7 @@ IMPLEMENT_DYNAMIC_CLASS(wxCURHandler, wxICOHandler)
 
 bool wxCURHandler::DoCanRead(wxInputStream& stream)
 {
 
 bool wxCURHandler::DoCanRead(wxInputStream& stream)
 {

-    unsigned char hdr[4];
-    if ( !stream.Read(hdr, WXSIZEOF(hdr)) )     // it's ok to modify the stream position here
-        return false;
-
-    // hdr[2] is one for an icon and two for a cursor
-    return hdr[0] == '\0' && hdr[1] == '\0' && hdr[2] == '\2' && hdr[3] == '\0';
+    return CanReadICOOrCUR(&stream, 2 /*for identifying a cursor*/);

 }
 
 #endif // wxUSE_STREAMS
 }
 
 #endif // wxUSE_STREAMS


@@ -1469,6 +1517,26 @@ int wxANIHandler::DoGetImageCount(wxInputStream& stream)
     return decoder.GetFrameCount();
 }
 
     return decoder.GetFrameCount();
 }
 

+static bool CanReadICOOrCUR(wxInputStream *stream, wxUint16 resourceType)
+{
+    // It's ok to modify the stream position in this function.
+
+    if ( stream->IsSeekable() && stream->SeekI(0) == wxInvalidOffset )
+    {
+        return false;
+    }
+
+    ICONDIR iconDir;
+    if ( !stream->Read(&iconDir, sizeof(iconDir)) )
+    {
+        return false;
+    }
+
+    return !iconDir.idReserved // reserved, must be 0
+        && wxUINT16_SWAP_ON_BE(iconDir.idType) == resourceType // either 1 or 2
+        && iconDir.idCount; // must contain at least one image
+}
+

 #endif // wxUSE_STREAMS
 
 #endif // wxUSE_ICO_CUR
 #endif // wxUSE_STREAMS
 
 #endif // wxUSE_ICO_CUR