1 --- gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c.loaders 2004-09-15 13:32:28.397302000 -0400
2 +++ gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c 2004-09-15 13:32:28.441258000 -0400
7 + if (State->HeaderSize < 0)
10 if (State->HeaderSize>State->BytesInHeaderBuf) {
11 guchar *tmp=realloc(State->HeaderBuf,State->HeaderSize);
13 --- gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c.loaders 2001-03-01 15:16:28.000000000 -0500
14 +++ gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c 2004-09-15 13:41:09.804373000 -0400
20 - strcat (color, " ");
21 + strncat (color, " ", space);
22 + space -= MIN (space, 1);
25 strncat (color, temp, space);
29 sscanf (buffer, "%d %d %d %d", &w, &h, &n_col, &cpp);
31 - g_warning ("XPM has more than 31 chars per pixel.");
32 + if (cpp <= 0 || cpp >= 32) {
33 + g_warning ("XPM has invalid number of chars per pixel.");
36 + if (n_col <= 0 || n_col >= G_MAXINT / (cpp + 1)) {
37 + g_warning ("XPM file has invalid number of colors");
41 /* The hash is used for fast lookups of color from chars */
42 color_hash = g_hash_table_new (g_str_hash, g_str_equal);
44 - name_buf = g_new (gchar, n_col * (cpp + 1));
45 - colors = g_new (_XPMColor, n_col);
46 + name_buf = malloc (n_col * (cpp + 1));
48 + g_warning ("Cannot allocate memory for loading XPM image");
49 + g_hash_table_destroy (color_hash);
52 + colors = (_XPMColor *) malloc (sizeof (_XPMColor) * n_col);
54 + g_warning ("Cannot allocate memory for loading XPM image");
55 + g_hash_table_destroy (color_hash);
60 for (cnt = 0; cnt < n_col; cnt++) {
65 g_hash_table_destroy (color_hash);
76 g_hash_table_destroy (color_hash);
82 return gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, is_trans, 8,
83 w, h, is_trans ? (w * 4) : (w * 3),