blob: 2eb6fcae15ea34a3dc7d98b03b7fed634f2bdeaf [file] [log] [blame]
From: pstew@chromium.org
To: png-mng-implement@lists.sourceforge.net
I'd like to suggest a change to the contrib pnm2png to avoid a
segfault if the file is empty or short while reading the header.
Basically " pnm2png < /dev/null" would cause a crash, which is easily
avoidable by checking the return value of fgetc.
[accepted upstream]
--- libpng-1.2.49/contrib/pngminus/pnm2png.c.orig 2013-05-07 10:35:49.117678925 -0700
+++ libpng-1.2.49/contrib/pngminus/pnm2png.c 2013-05-07 10:37:46.427658862 -0700
@@ -446,19 +446,24 @@
void get_token(FILE *pnm_file, char *token)
{
int i = 0;
+ int ret;
/* remove white-space */
do
{
- token[i] = (unsigned char) fgetc (pnm_file);
+ ret = fgetc(pnm_file);
+ if (ret == EOF) break;
+ token[i] = (unsigned char) ret;
}
while ((token[i] == '\n') || (token[i] == '\r') || (token[i] == ' '));
/* read string */
do
{
+ ret = fgetc(pnm_file);
+ if (ret == EOF) break;
i++;
- token[i] = (unsigned char) fgetc (pnm_file);
+ token[i] = (unsigned char) ret;
}
while ((token[i] != '\n') && (token[i] != '\r') && (token[i] != ' '));