From 415856bdd4f48ab4f2732996f0bae58595092bbe Mon Sep 17 00:00:00 2001
From: Parabola <dev@list.parabolagnulinux.org>
Date: Tue, 5 Apr 2011 14:26:38 +0000
Subject: Tue Apr  5 14:26:38 UTC 2011

---
 .../gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch     | 134 +++++++++++++++++++++
 1 file changed, 134 insertions(+)
 create mode 100644 community/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch

(limited to 'community/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch')

diff --git a/community/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch b/community/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch
new file mode 100644
index 000000000..068653808
--- /dev/null
+++ b/community/gdk-pixbuf/gdk-pixbuf-0.22.0-loaders.patch
@@ -0,0 +1,134 @@
+diff -NurdB gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-ico.c
+--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c	2002-09-27 17:19:15.000000000 -0500
++++ gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-ico.c	2005-10-27 11:28:23.000000000 -0500
+@@ -330,6 +330,9 @@
+ 
+ 	State->HeaderSize+=I;
+ 
++ 	if (State->HeaderSize < 0)
++ 		return FALSE;
++ 
+  	if (State->HeaderSize>State->BytesInHeaderBuf) {
+ 		guchar *tmp=realloc(State->HeaderBuf,State->HeaderSize);
+ 		if (!tmp)
+diff -NurdB gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-xpm.c
+--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c	2001-03-01 15:16:28.000000000 -0500
++++ gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-xpm.c	2005-10-27 11:29:14.000000000 -0500
+@@ -243,8 +243,8 @@
+ 			break;
+ 		else {
+ 			if (numnames > 0) {
+-				space -= 1;
+-				strcat (color, " ");
++				strncat (color, " ", space);
++				space -= MIN (space, 1);
+ 			}
+ 
+ 			strncat (color, temp, space);
+@@ -281,7 +281,8 @@
+ 		/* Fall through to the xpm_read_string. */
+ 
+ 	case op_body:
+-		xpm_read_string (h->infile, &h->buffer, &h->buffer_size);
++		if(!xpm_read_string (h->infile, &h->buffer, &h->buffer_size))
++			return NULL;
+ 		return h->buffer;
+ 
+ 	default:
+@@ -317,13 +318,6 @@
+ 	return NULL;
+ }
+ 
+-/* Destroy notification function for the pixbuf */
+-static void
+-free_buffer (guchar *pixels, gpointer data)
+-{
+-	free (pixels);
+-}
+-
+ static gboolean
+ xpm_color_parse (const char *spec, XColor *color)
+ {
+@@ -342,7 +336,8 @@
+ 	gchar pixel_str[32];
+ 	GHashTable *color_hash;
+ 	_XPMColor *colors, *color, *fallbackcolor;
+-	guchar *pixels, *pixtmp;
++	guchar *pixtmp;
++	GdkPixbuf* pixbuf;
+ 
+ 	fallbackcolor = NULL;
+ 
+@@ -352,16 +347,33 @@
+ 		return NULL;
+ 	}
+ 	sscanf (buffer, "%d %d %d %d", &w, &h, &n_col, &cpp);
+-	if (cpp >= 32) {
+-		g_warning ("XPM has more than 31 chars per pixel.");
++	if (cpp <= 0 || cpp >= 32) {
++		g_warning ("XPM has invalid number of chars per pixel.");
+ 		return NULL;
+ 	}
++	if (n_col <= 0 ||
++	    n_col >= G_MAXINT / (cpp + 1) ||
++	    n_col >= G_MAXINT / sizeof (_XPMColor)) {
++		g_warning ("XPM file has invalid number of colors");
++  		return NULL;
++  	}
+ 
+ 	/* The hash is used for fast lookups of color from chars */
+ 	color_hash = g_hash_table_new (g_str_hash, g_str_equal);
+ 
+-	name_buf = g_new (gchar, n_col * (cpp + 1));
+-	colors = g_new (_XPMColor, n_col);
++ 	name_buf = g_new (gchar, n_col * (cpp + 1));
++ 	if (!name_buf) {
++		g_warning ("Cannot allocate memory for loading XPM image");
++ 		g_hash_table_destroy (color_hash);
++ 		return NULL;
++ 	}
++ 	colors = g_new (_XPMColor, n_col);
++ 	if (!colors) {
++		g_warning ("Cannot allocate memory for loading XPM image");
++ 		g_hash_table_destroy (color_hash);
++ 		g_free (name_buf);
++ 		return NULL;
++ 	}
+ 
+ 	for (cnt = 0; cnt < n_col; cnt++) {
+ 		gchar *color_name;
+@@ -397,12 +409,8 @@
+ 			fallbackcolor = color;
+ 	}
+ 
+-	if (is_trans)
+-		pixels = malloc (w * h * 4);
+-	else
+-		pixels = malloc (w * h * 3);
+-
+-	if (!pixels) {
++	pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, is_trans, 8, w, h);
++	if (!pixbuf) {
+ 		g_hash_table_destroy (color_hash);
+ 		g_free (colors);
+ 		g_free (name_buf);
+@@ -410,7 +418,7 @@
+ 	}
+ 
+ 	wbytes = w * cpp;
+-	pixtmp = pixels;
++	pixtmp = pixbuf->pixels;
+ 
+ 	for (ycnt = 0; ycnt < h; ycnt++) {
+ 		buffer = (*get_buf) (op_body, handle);
+@@ -443,9 +451,7 @@
+ 	g_free (colors);
+ 	g_free (name_buf);
+ 
+-	return gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, is_trans, 8,
+-					 w, h, is_trans ? (w * 4) : (w * 3),
+-					 free_buffer, NULL);
++	return pixbuf;
+ }
+ 
+ /* Shared library entry point for file loading */
-- 
cgit v1.2.3-54-g00ecf