| From: pstew@chromium.org |
| To: png-mng-implement@lists.sourceforge.net |
| |
| I'd like to suggest a change to the contrib pnm2png to avoid a |
| segfault if the file is empty or short while reading the header. |
| Basically " pnm2png < /dev/null" would cause a crash, which is easily |
| avoidable by checking the return value of fgetc. |
| |
| [accepted upstream] |
| |
| --- libpng-1.2.49/contrib/pngminus/pnm2png.c.orig 2013-05-07 10:35:49.117678925 -0700 |
| +++ libpng-1.2.49/contrib/pngminus/pnm2png.c 2013-05-07 10:37:46.427658862 -0700 |
| @@ -446,19 +446,24 @@ |
| void get_token(FILE *pnm_file, char *token) |
| { |
| int i = 0; |
| + int ret; |
| |
| /* remove white-space */ |
| do |
| { |
| - token[i] = (unsigned char) fgetc (pnm_file); |
| + ret = fgetc(pnm_file); |
| + if (ret == EOF) break; |
| + token[i] = (unsigned char) ret; |
| } |
| while ((token[i] == '\n') || (token[i] == '\r') || (token[i] == ' ')); |
| |
| /* read string */ |
| do |
| { |
| + ret = fgetc(pnm_file); |
| + if (ret == EOF) break; |
| i++; |
| - token[i] = (unsigned char) fgetc (pnm_file); |
| + token[i] = (unsigned char) ret; |
| } |
| while ((token[i] != '\n') && (token[i] != '\r') && (token[i] != ' ')); |
| |