X-Git-Url: https://git.saurik.com/wxWidgets.git/blobdiff_plain/02761f6cd478e3c2c97cf6f93442747f7b029833..2e14066008229145e2da7b9f05a478ce38631f83:/src/common/imagpcx.cpp

diff --git a/src/common/imagpcx.cpp b/src/common/imagpcx.cpp
index 69b04d1ea7..fdbb60c16d 100644
--- a/src/common/imagpcx.cpp
+++ b/src/common/imagpcx.cpp
@@ -87,17 +87,15 @@ void RLEencode(unsigned char *p, unsigned int size, wxOutputStream& s)
 
 void RLEdecode(unsigned char *p, unsigned int size, wxInputStream& s)
 {
-    unsigned int i, data, cont;
-
     // Read 'size' bytes. The PCX official specs say there will be
     // a decoding break at the end of each scanline (but not at the
     // end of each plane inside a scanline). Only use this function
     // to read one or more _complete_ scanlines. Else, more than
     // 'size' bytes might be read and the buffer might overflow.
 
-    while (size > 0)
+    while (size != 0)
     {
-        data = (unsigned char)s.GetC();
+        unsigned int data = (unsigned char)s.GetC();
 
         // If ((data & 0xC0) != 0xC0), then the value read is a data
         // byte. Else, it is a counter (cont = val & 0x3F) and the
@@ -110,9 +108,11 @@ void RLEdecode(unsigned char *p, unsigned int size, wxInputStream& s)
         }
         else
         {
-            cont = data & 0x3F;
+            unsigned int cont = data & 0x3F;
+            if (cont > size) // can happen only if the file is malformed
+                break;
             data = (unsigned char)s.GetC();
-            for (i = 1; i <= cont; i++)
+            for (unsigned int i = 1; i <= cont; i++)
                 *(p++) = (unsigned char)data;
             size -= cont;
         }
@@ -214,7 +214,7 @@ int ReadPCX(wxImage *image, wxInputStream& stream)
 
     image->Create(width, height);
 
-    if (!image->Ok())
+    if (!image->IsOk())
         return wxPCX_MEMERR;
 
     if ((p = (unsigned char *) malloc(bytesperline * nplanes)) == NULL)
@@ -331,7 +331,7 @@ int SavePCX(wxImage *image, wxOutputStream& stream)
     // according to PCX specs) and allocate space for one complete
     // scanline.
 
-    if (!image->Ok())
+    if (!image->IsOk())
         return wxPCX_INVFORMAT;
 
     width = image->GetWidth();
@@ -439,7 +439,9 @@ bool wxPCXHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbose
     if (!CanRead(stream))
     {
         if (verbose)
+        {
             wxLogError(_("PCX: this is not a PCX file."));
+        }
 
         return false;
     }
@@ -487,7 +489,7 @@ bool wxPCXHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbos
 
 bool wxPCXHandler::DoCanRead( wxInputStream& stream )
 {
-    unsigned char c = stream.GetC();
+    unsigned char c = stream.GetC();     // it's ok to modify the stream position here
     if ( !stream )
         return false;