fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / imagpcx.cpp

diff --git a/src/common/imagpcx.cpp b/src/common/imagpcx.cpp
index f4d6852e66a0204715859e07dba3ba7678445cf2..fdbb60c16d4c1c3d5f884432a57572dd3fe474ac 100644 (file)
--- a/src/common/imagpcx.cpp
+++ b/src/common/imagpcx.cpp
@@ -1,5 +1,5 @@
 /////////////////////////////////////////////////////////////////////////////
-// Name:        imagpcx.cpp
+// Name:        src/common/imagpcx.cpp
 // Purpose:     wxImage PCX handler
 // Author:      Guillermo Rodriguez Garcia <guille@iies.es>
 // Version:     1.1
@@ -8,33 +8,27 @@
 // Licence:     wxWindows licence
 /////////////////////////////////////////////////////////////////////////////
 
-#ifdef __GNUG__
-#pragma implementation "imagpcx.h"
-#endif
-
 // For compilers that support precompilation, includes "wx.h".
 #include "wx/wxprec.h"
 
 #ifdef __BORLANDC__
-#pragma hdrstop
+    #pragma hdrstop
 #endif
 
+#if wxUSE_IMAGE && wxUSE_PCX
+
 #ifndef WX_PRECOMP
-#  include "wx/defs.h"
-#  include "wx/palette.h"
+    #include "wx/object.h"
+    #include "wx/list.h"
+    #include "wx/log.h"
+    #include "wx/intl.h"
+    #include "wx/palette.h"
+    #include "wx/hash.h"
+    #include "wx/module.h"
 #endif
 
-#if wxUSE_IMAGE && wxUSE_PCX
-
 #include "wx/imagpcx.h"
 #include "wx/wfstream.h"
-#include "wx/module.h"
-#include "wx/log.h"
-#include "wx/intl.h"
-
-#include "wx/hash.h"
-#include "wx/list.h"
-#include "wx/object.h"
 
 //-----------------------------------------------------------------------------
 // wxPCXHandler
@@ -93,22 +87,20 @@ void RLEencode(unsigned char *p, unsigned int size, wxOutputStream& s)
 
 void RLEdecode(unsigned char *p, unsigned int size, wxInputStream& s)
 {
-    unsigned int i, data, cont;
-
     // Read 'size' bytes. The PCX official specs say there will be
     // a decoding break at the end of each scanline (but not at the
     // end of each plane inside a scanline). Only use this function
     // to read one or more _complete_ scanlines. Else, more than
     // 'size' bytes might be read and the buffer might overflow.
 
-    while (size > 0)
+    while (size != 0)
     {
-        data = (unsigned char)s.GetC();
+        unsigned int data = (unsigned char)s.GetC();
 
         // If ((data & 0xC0) != 0xC0), then the value read is a data
         // byte. Else, it is a counter (cont = val & 0x3F) and the
         // next byte is the data byte.
-                 //
+
         if ((data & 0xC0) != 0xC0)
         {
             *(p++) = (unsigned char)data;
@@ -116,9 +108,11 @@ void RLEdecode(unsigned char *p, unsigned int size, wxInputStream& s)
         }
         else
         {
-            cont = data & 0x3F;
+            unsigned int cont = data & 0x3F;
+            if (cont > size) // can happen only if the file is malformed
+                break;
             data = (unsigned char)s.GetC();
-            for (i = 1; i <= cont; i++)
+            for (unsigned int i = 1; i <= cont; i++)
                 *(p++) = (unsigned char)data;
             size -= cont;
         }
@@ -220,7 +214,7 @@ int ReadPCX(wxImage *image, wxInputStream& stream)
 
     image->Create(width, height);
 
-    if (!image->Ok())
+    if (!image->IsOk())
         return wxPCX_MEMERR;
 
     if ((p = (unsigned char *) malloc(bytesperline * nplanes)) == NULL)
@@ -318,7 +312,7 @@ int SavePCX(wxImage *image, wxOutputStream& stream)
     unsigned char *src;             // pointer into wxImage data
     unsigned int width, height;     // size of the image
     unsigned int bytesperline;      // bytes per line (each plane)
-    int nplanes = 3;                // number of planes
+    unsigned char nplanes = 3;      // number of planes
     int format = wxPCX_24BIT;       // image format (8 bit, 24 bit)
     wxImageHistogram histogram;     // image histogram
     unsigned long key;              // key in the hashtable
@@ -337,7 +331,7 @@ int SavePCX(wxImage *image, wxOutputStream& stream)
     // according to PCX specs) and allocate space for one complete
     // scanline.
 
-    if (!image->Ok())
+    if (!image->IsOk())
         return wxPCX_INVFORMAT;
 
     width = image->GetWidth();
@@ -416,9 +410,9 @@ int SavePCX(wxImage *image, wxOutputStream& stream)
         memset(pal, 0, sizeof(pal));
 
         unsigned long index;
-        
+
         for (wxImageHistogram::iterator entry = histogram.begin();
-             entry != histogram.end(); entry++ )
+             entry != histogram.end(); ++entry )
         {
             key = entry->first;
             index = entry->second.index;
@@ -445,9 +439,11 @@ bool wxPCXHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbose
     if (!CanRead(stream))
     {
         if (verbose)
+        {
             wxLogError(_("PCX: this is not a PCX file."));
+        }
 
-        return FALSE;
+        return false;
     }
 
     image->Destroy();
@@ -465,10 +461,10 @@ bool wxPCXHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbose
             }
         }
         image->Destroy();
-        return FALSE;
+        return false;
     }
 
-    return TRUE;
+    return true;
 }
 
 bool wxPCXHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbose )
@@ -493,9 +489,9 @@ bool wxPCXHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbos
 
 bool wxPCXHandler::DoCanRead( wxInputStream& stream )
 {
-    unsigned char c = stream.GetC();
+    unsigned char c = stream.GetC();     // it's ok to modify the stream position here
     if ( !stream )
-        return FALSE;
+        return false;
 
     // not very safe, but this is all we can get from PCX header :-(
     return c == 10;
@@ -504,4 +500,3 @@ bool wxPCXHandler::DoCanRead( wxInputStream& stream )
 #endif // wxUSE_STREAMS
 
 #endif // wxUSE_IMAGE && wxUSE_PCX
-