← Back to branch summary

~ubuntu-branches/ubuntu/precise/gdk-pixbuf/precise-updates

« back to all changes in this revision

Viewing changes to gdk-pixbuf/io-xbm.c

  • Committer: Package Import Robot
  • Author(s): Martin Pitt
  • Date: 2012-04-16 07:21:41 UTC
  • mfrom: (33.1.4 sid)
  • Revision ID: package-import@ubuntu.com-20120416072141-v2cvte6tr0cv58x4
Tags: 2.26.1-1
https://launchpad.net/bugs/681150
http://bugs.debian.org/662344
* New upstream bug fix release:
  - Fix srcdir != builddir build.
  - Avoid an integer overflow in the xbm loader. (LP: #681150)
  - Translation updates.
* debian/control.in: Prefer building against libpng-dev over libpng12-dev,
  to be prepared for the libpng 1.5 transition. (Closes: #662344)
* debian/control.in: Bump Standards-Version to 3.9.3 (no changes necessary).

Show diffs side-by-side

added added

removed removed

Lines of Context:
gdk-pixbuf/io-xbm.c
183
183
                                type++;
184
184
                        }
185
185
 
186
 
                        if (!strcmp ("width", type))
 
186
                        if (!strcmp ("width", type)) {
 
187
                                if (value <= 0)
 
188
                                        RETURN (FALSE);
187
189
                                ww = (unsigned int) value;
188
 
                        if (!strcmp ("height", type))
 
190
                        }
 
191
                        if (!strcmp ("height", type)) {
 
192
                                if (value <= 0)
 
193
                                        RETURN (FALSE);
189
194
                                hh = (unsigned int) value;
 
195
                        }
190
196
                        if (!strcmp ("hot", type)) {
191
197
                                if (type-- == name_and_type
192
198
                                    || type-- == name_and_type)
231
237
                bytes_per_line = (ww+7)/8 + padding;
232
238
 
233
239
                size = bytes_per_line * hh;
 
240
                if (size / bytes_per_line != hh) /* overflow */
 
241
                        RETURN (FALSE);
234
242
                bits = g_malloc (size);
235
243
 
236
244
                if (version10p) {