change version to avoid indexer confusion

[imager.git] / bmp.c

diff --git a/bmp.c b/bmp.c
index 94fe6ffb98b8d03f8a0af72677045515b6a14ad4..8f37d32ab48d372b9c4a979fd665e335c1f4b277 100644 (file)
--- a/bmp.c
+++ b/bmp.c
@@ -45,14 +45,14 @@ static int write_8bit_data(io_glue *ig, i_img *im);
 static int write_24bit_data(io_glue *ig, i_img *im);
 static int read_bmp_pal(io_glue *ig, i_img *im, int count);
 static i_img *read_1bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used, 
-                            int compression, long offbits, int allow_partial);
+                            int compression, long offbits, int allow_incomplete);
 static i_img *read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used, 
-                            int compression, long offbits, int allow_partial);
+                            int compression, long offbits, int allow_incomplete);
 static i_img *read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used, 
-                            int compression, long offbits, int allow_partial);
+                            int compression, long offbits, int allow_incomplete);
 static i_img *read_direct_bmp(io_glue *ig, int xsize, int ysize, 
                               int bit_count, int clr_used, int compression,
-                              long offbits, int allow_partial);
+                              long offbits, int allow_incomplete);
 
 /* 
 =item i_writebmp_wiol(im, io_glue)
@@ -102,7 +102,7 @@ BI_BITFIELDS images too, but I need a test image.
 */
 
 i_img *
-i_readbmp_wiol(io_glue *ig, int allow_partial) {
+i_readbmp_wiol(io_glue *ig, int allow_incomplete) {
   int b_magic, m_magic, filesize, res1, res2, infohead_size;
   int xsize, ysize, planes, bit_count, compression, size_image, xres, yres;
   int clr_used, clr_important, offbits;
@@ -118,7 +118,7 @@ i_readbmp_wiol(io_glue *ig, int allow_partial) {
                    &xsize, &ysize, &planes,
                   &bit_count, &compression, &size_image, &xres, &yres, 
                   &clr_used, &clr_important)) {
-    i_push_error(0, "file too short");
+    i_push_error(0, "file too short to be a BMP file");
     return 0;
   }
   if (b_magic != 'B' || m_magic != 'M' || infohead_size != INFOHEAD_SIZE
@@ -133,7 +133,7 @@ i_readbmp_wiol(io_glue *ig, int allow_partial) {
           bit_count, compression, size_image, xres, yres, clr_used, 
           clr_important));
 
-  if (!i_int_check_image_file_limits(xsize, ysize, 3, sizeof(i_sample_t))) {
+  if (!i_int_check_image_file_limits(xsize, abs(ysize), 3, sizeof(i_sample_t))) {
     mm_log((1, "i_readbmp_wiol: image size exceeds limits\n"));
     return NULL;
   }
@@ -141,24 +141,24 @@ i_readbmp_wiol(io_glue *ig, int allow_partial) {
   switch (bit_count) {
   case 1:
     im = read_1bit_bmp(ig, xsize, ysize, clr_used, compression, offbits, 
-                       allow_partial);
+                       allow_incomplete);
     break;
 
   case 4:
     im = read_4bit_bmp(ig, xsize, ysize, clr_used, compression, offbits, 
-                       allow_partial);
+                       allow_incomplete);
     break;
 
   case 8:
     im = read_8bit_bmp(ig, xsize, ysize, clr_used, compression, offbits, 
-                       allow_partial);
+                       allow_incomplete);
     break;
 
   case 32:
   case 24:
   case 16:
     im = read_direct_bmp(ig, xsize, ysize, bit_count, clr_used, compression,
-                         offbits, allow_partial);
+                         offbits, allow_incomplete);
     break;
 
   default:
@@ -367,7 +367,7 @@ int write_bmphead(io_glue *ig, i_img *im, int bit_count, int data_size) {
 
   if (!write_packed(ig, "CCVvvVVVVvvVVVVVV", 'B', 'M', data_size+offset, 
                    0, 0, offset, INFOHEAD_SIZE, im->xsize, im->ysize, 1, 
-                   bit_count, BI_RGB, 0, (int)(xres+0.5), (int)(yres+0.5), 
+                   bit_count, BI_RGB, data_size, (int)(xres+0.5), (int)(yres+0.5), 
                    colors_used, colors_used)){
     i_push_error(0, "cannot write bmp header");
     return 0;
@@ -575,9 +575,6 @@ write_8bit_data(io_glue *ig, i_img *im) {
   return 1;
 }
 
-static int bgr_chans[] = { 2, 1, 0, };
-static int grey_chans[] = { 0, 0, 0, };
-
 /*
 =item write_24bit_data(ig, im)
 
@@ -589,10 +586,12 @@ Returns non-zero on success.
 */
 static int
 write_24bit_data(io_glue *ig, i_img *im) {
-  int *chans;
   unsigned char *samples;
   int y;
   int line_size = 3 * im->xsize;
+  i_color bg;
+
+  i_get_file_background(im, &bg);
 
   /* just in case we implement a direct format with 2bytes/pixel
      (unlikely though) */
@@ -605,11 +604,18 @@ write_24bit_data(io_glue *ig, i_img *im) {
   
   if (!write_bmphead(ig, im, 24, line_size * im->ysize))
     return 0;
-  chans = im->channels >= 3 ? bgr_chans : grey_chans;
-  samples = mymalloc(line_size); /* checked 29jun05 tonyc */
+  samples = mymalloc(4 * im->xsize);
   memset(samples, 0, line_size);
   for (y = im->ysize-1; y >= 0; --y) {
-    i_gsamp(im, 0, im->xsize, y, samples, chans, 3);
+    unsigned char *samplep = samples;
+    int x;
+    i_gsamp_bg(im, 0, im->xsize, y, samples, 3, &bg);
+    for (x = 0; x < im->xsize; ++x) {
+      unsigned char tmp = samplep[2];
+      samplep[2] = samplep[0];
+      samplep[0] = tmp;
+      samplep += 3;
+    }
     if (ig->writecb(ig, samples, line_size) < 0) {
       i_push_error(0, "writing image data");
       myfree(samples);
@@ -666,7 +672,7 @@ Returns the image or NULL.
 */
 static i_img *
 read_1bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used, 
-              int compression, long offbits, int allow_partial) {
+              int compression, long offbits, int allow_incomplete) {
   i_img *im;
   int x, y, lasty, yinc, start_y;
   i_palidx *line, *p;
@@ -748,7 +754,7 @@ read_1bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
     if (ig->readcb(ig, packed, line_size) != line_size) {
       myfree(packed);
       myfree(line);
-      if (allow_partial) {
+      if (allow_incomplete) {
         i_tags_setn(&im->tags, "i_incomplete", 1);
         i_tags_setn(&im->tags, "i_lines_read", abs(start_y - y));
         return im;
@@ -793,7 +799,7 @@ point.
 */
 static i_img *
 read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used, 
-              int compression, long offbits, int allow_partial) {
+              int compression, long offbits, int allow_incomplete) {
   i_img *im;
   int x, y, lasty, yinc;
   i_palidx *line, *p;
@@ -869,7 +875,7 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
       if (ig->readcb(ig, packed, line_size) != line_size) {
        myfree(packed);
        myfree(line);
-        if (allow_partial) {
+        if (allow_incomplete) {
           i_tags_setn(&im->tags, "i_incomplete", 1);
           i_tags_setn(&im->tags, "i_lines_read", abs(y - starty));
           return im;
@@ -904,7 +910,7 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
       if (ig->readcb(ig, packed, 2) != 2) {
         myfree(packed);
         myfree(line);
-        if (allow_partial) {
+        if (allow_incomplete) {
           i_tags_setn(&im->tags, "i_incomplete", 1);
           i_tags_setn(&im->tags, "i_lines_read", abs(y - starty));
           return im;
@@ -916,6 +922,14 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
         }
       }
       else if (packed[0]) {
+       if (x + packed[0] > xsize) {
+         /* this file is corrupt */
+         myfree(packed);
+         myfree(line);
+         i_push_error(0, "invalid data during decompression");
+         i_img_destroy(im);
+         return NULL;
+       }
         line[0] = packed[1] >> 4;
         line[1] = packed[1] & 0x0F;
         for (i = 0; i < packed[0]; i += 2) {
@@ -941,7 +955,7 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
           if (ig->readcb(ig, packed, 2) != 2) {
             myfree(packed);
             myfree(line);
-            if (allow_partial) {
+            if (allow_incomplete) {
               i_tags_setn(&im->tags, "i_incomplete", 1);
               i_tags_setn(&im->tags, "i_lines_read", abs(y - starty));
               return im;
@@ -958,12 +972,20 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
 
         default:
           count = packed[1];
+         if (x + count > xsize) {
+           /* this file is corrupt */
+           myfree(packed);
+           myfree(line);
+           i_push_error(0, "invalid data during decompression");
+           i_img_destroy(im);
+           return NULL;
+         }
           size = (count + 1) / 2;
           read_size = (size+1) / 2 * 2;
           if (ig->readcb(ig, packed, read_size) != read_size) {
             myfree(packed);
             myfree(line);
-            if (allow_partial) {
+            if (allow_incomplete) {
               i_tags_setn(&im->tags, "i_incomplete", 1);
               i_tags_setn(&im->tags, "i_lines_read", abs(y - starty));
               return im;
@@ -997,7 +1019,7 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
 }
 
 /*
-=item read_8bit_bmp(ig, xsize, ysize, clr_used, compression, allow_partial)
+=item read_8bit_bmp(ig, xsize, ysize, clr_used, compression, allow_incomplete)
 
 Reads in the palette and image data for a 8-bit/pixel image.
 
@@ -1007,7 +1029,7 @@ Returns the image or NULL.
 */
 static i_img *
 read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used, 
-              int compression, long offbits, int allow_partial) {
+              int compression, long offbits, int allow_incomplete) {
   i_img *im;
   int x, y, lasty, yinc, start_y;
   i_palidx *line;
@@ -1074,7 +1096,7 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
     while (y != lasty) {
       if (ig->readcb(ig, line, line_size) != line_size) {
        myfree(line);
-        if (allow_partial) {
+        if (allow_incomplete) {
           i_tags_setn(&im->tags, "i_incomplete", 1);
           i_tags_setn(&im->tags, "i_lines_read", abs(start_y - y));
           return im;
@@ -1101,7 +1123,7 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
       /* there's always at least 2 bytes in a sequence */
       if (ig->readcb(ig, packed, 2) != 2) {
         myfree(line);
-        if (allow_partial) {
+        if (allow_incomplete) {
           i_tags_setn(&im->tags, "i_incomplete", 1);
           i_tags_setn(&im->tags, "i_lines_read", abs(start_y-y));
           return im;
@@ -1113,6 +1135,13 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
         }
       }
       if (packed[0]) {
+       if (x + packed[0] > xsize) {
+         /* this file isn't incomplete, it's corrupt */
+         myfree(line);
+         i_push_error(0, "invalid data during decompression");
+         i_img_destroy(im);
+         return NULL;
+       }
         memset(line, packed[1], packed[0]);
         i_ppal(im, x, x+packed[0], y, line);
         x += packed[0];
@@ -1130,7 +1159,7 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
         case BMPRLE_DELTA:
           if (ig->readcb(ig, packed, 2) != 2) {
             myfree(line);
-            if (allow_partial) {
+            if (allow_incomplete) {
               i_tags_setn(&im->tags, "i_incomplete", 1);
               i_tags_setn(&im->tags, "i_lines_read", abs(start_y-y));
               return im;
@@ -1147,10 +1176,18 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
 
         default:
           count = packed[1];
+         if (x + count > xsize) {
+           /* runs shouldn't cross a line boundary */
+           /* this file isn't incomplete, it's corrupt */
+           myfree(line);
+           i_push_error(0, "invalid data during decompression");
+           i_img_destroy(im);
+           return NULL;
+         }
           read_size = (count+1) / 2 * 2;
           if (ig->readcb(ig, line, read_size) != read_size) {
             myfree(line);
-            if (allow_partial) {
+            if (allow_incomplete) {
               i_tags_setn(&im->tags, "i_incomplete", 1);
               i_tags_setn(&im->tags, "i_lines_read", abs(start_y-y));
               return im;
@@ -1199,7 +1236,7 @@ static struct bm_masks std_masks[] =
 };
 
 /*
-=item read_direct_bmp(ig, xsize, ysize, bit_count, clr_used, compression, allow_partial)
+=item read_direct_bmp(ig, xsize, ysize, bit_count, clr_used, compression, allow_incomplete)
 
 Skips the palette and reads in the image data for a direct colour image.
 
@@ -1210,9 +1247,9 @@ Returns the image or NULL.
 static i_img *
 read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count, 
                 int clr_used, int compression, long offbits, 
-                int allow_partial) {
+                int allow_incomplete) {
   i_img *im;
-  int x, y, lasty, yinc;
+  int x, y, starty, lasty, yinc;
   i_color *line, *p;
   int pix_size = bit_count / 8;
   int line_size = xsize * pix_size;
@@ -1232,17 +1269,18 @@ read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count,
   extras = line_size - xsize * pix_size;
 
   if (ysize > 0) {
-    y = ysize-1;
+    starty = ysize-1;
     lasty = -1;
     yinc = -1;
   }
   else {
     /* when ysize is -ve it's a top-down image */
     ysize = -ysize;
-    y = 0;
+    starty = 0;
     lasty = ysize;
     yinc = 1;
   }
+  y = starty;
   if (compression == BI_RGB) {
     compression_name = "BI_RGB";
     masks = std_masks[pix_size-2];
@@ -1282,6 +1320,11 @@ read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count,
     return NULL;
   }
 
+  if (offbits < base_offset) {
+    i_push_errorf(0, "image data offset too small (%ld)", offbits);
+    return NULL;
+  }
+
   if (offbits > base_offset) {
     /* this will be slow if the offset is large, but that should be
        rare */
@@ -1316,9 +1359,9 @@ read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count,
       unsigned pixel;
       if (!read_packed(ig, unpack_code, &pixel)) {
         myfree(line);
-        if (allow_partial) {
+        if (allow_incomplete) {
           i_tags_setn(&im->tags, "i_incomplete", 1);
-          i_tags_setn(&im->tags, "i_lines_read", lasty - y);
+          i_tags_setn(&im->tags, "i_lines_read", abs(starty - y));
           return im;
         }
         else {