X-Git-Url: http://git.imager.perl.org/imager.git/blobdiff_plain/ae12796a26e9881d7b0dd8382e95c1befe06fb1b..88ace6cd2a63c19eca8a45d700988495bcde5123:/bmp.c

diff --git a/bmp.c b/bmp.c
index 7986f26d..4f770b80 100644
--- a/bmp.c
+++ b/bmp.c
@@ -35,6 +35,11 @@ Reads and writes Windows BMP files.
 #define BMPRLE_ENDOFBMP 1
 #define BMPRLE_DELTA 2
 
+#define SIGNBIT32 ((i_upacked_t)1U << 31)
+#define SIGNBIT16 ((i_upacked_t)1U << 15)
+
+#define SIGNMAX32 ((1UL << 31) - 1)
+
 static int read_packed(io_glue *ig, char *format, ...);
 static int write_packed(io_glue *ig, char *format, ...);
 static int write_bmphead(io_glue *ig, i_img *im, int bit_count, 
@@ -54,6 +59,11 @@ static i_img *read_direct_bmp(io_glue *ig, int xsize, int ysize,
                               int bit_count, int clr_used, int compression,
                               long offbits, int allow_incomplete);
 
+/* used for the read_packed() and write_packed() functions, an integer
+ * type */
+typedef long i_packed_t;
+typedef unsigned long i_upacked_t;
+
 /* 
 =item i_writebmp_wiol(im, io_glue)
 
@@ -66,7 +76,6 @@ Never compresses the image.
 */
 int
 i_writebmp_wiol(i_img *im, io_glue *ig) {
-  io_glue_commit_types(ig);
   i_clear_error();
 
   /* pick a format */
@@ -103,17 +112,16 @@ BI_BITFIELDS images too, but I need a test image.
 
 i_img *
 i_readbmp_wiol(io_glue *ig, int allow_incomplete) {
-  int b_magic, m_magic, filesize, res1, res2, infohead_size;
-  int xsize, ysize, planes, bit_count, compression, size_image, xres, yres;
-  int clr_used, clr_important, offbits;
+  i_packed_t b_magic, m_magic, filesize, res1, res2, infohead_size;
+  i_packed_t xsize, ysize, planes, bit_count, compression, size_image, xres, yres;
+  i_packed_t clr_used, clr_important, offbits;
   i_img *im;
 
   mm_log((1, "i_readbmp_wiol(ig %p)\n", ig));
   
-  io_glue_commit_types(ig);
   i_clear_error();
 
-  if (!read_packed(ig, "CCVvvVVVVvvVVVVVV", &b_magic, &m_magic, &filesize, 
+  if (!read_packed(ig, "CCVvvVVV!V!vvVVVVVV", &b_magic, &m_magic, &filesize, 
 		   &res1, &res2, &offbits, &infohead_size, 
                    &xsize, &ysize, &planes,
 		   &bit_count, &compression, &size_image, &xres, &yres, 
@@ -129,9 +137,10 @@ i_readbmp_wiol(io_glue *ig, int allow_incomplete) {
 
   mm_log((1, " bmp header: filesize %d offbits %d xsize %d ysize %d planes %d "
           "bit_count %d compression %d size %d xres %d yres %d clr_used %d "
-          "clr_important %d\n", filesize, offbits, xsize, ysize, planes, 
-          bit_count, compression, size_image, xres, yres, clr_used, 
-          clr_important));
+          "clr_important %d\n", (int)filesize, (int)offbits, (int)xsize,
+	  (int)ysize, (int)planes, (int)bit_count, (int)compression, 
+	  (int)size_image, (int)xres, (int)yres, (int)clr_used, 
+          (int)clr_important));
 
   if (!i_int_check_image_file_limits(xsize, abs(ysize), 3, sizeof(i_sample_t))) {
     mm_log((1, "i_readbmp_wiol: image size exceeds limits\n"));
@@ -162,7 +171,7 @@ i_readbmp_wiol(io_glue *ig, int allow_incomplete) {
     break;
 
   default:
-    i_push_errorf(0, "unknown bit count for BMP file (%d)", bit_count);
+    i_push_errorf(0, "unknown bit count for BMP file (%d)", (int)bit_count);
     return NULL;
   }
 
@@ -206,52 +215,66 @@ Returns non-zero if all of the arguments were read.
 
 =cut
 */
-static
-int read_packed(io_glue *ig, char *format, ...) {
+static int
+read_packed(io_glue *ig, char *format, ...) {
   unsigned char buf[4];
   va_list ap;
-  int *p;
+  i_packed_t *p;
+  i_packed_t work;
+  int code;
+  int shrieking; /* format code has a ! flag */
 
   va_start(ap, format);
 
   while (*format) {
-    p = va_arg(ap, int *);
+    p = va_arg(ap, i_packed_t *);
 
-    switch (*format) {
+    code = *format++;
+    shrieking = *format == '!';
+    if (shrieking) ++format;
+
+    switch (code) {
     case 'v':
-      if (ig->readcb(ig, buf, 2) != 2)
+      if (i_io_read(ig, buf, 2) != 2)
 	return 0;
-      *p = buf[0] + (buf[1] << 8);
+      work = buf[0] + ((i_packed_t)buf[1] << 8);
+      if (shrieking)
+	*p = (work ^ SIGNBIT16) - SIGNBIT16;
+      else
+	*p = work;
       break;
 
     case 'V':
-      if (ig->readcb(ig, buf, 4) != 4)
+      if (i_io_read(ig, buf, 4) != 4)
 	return 0;
-      *p = buf[0] + (buf[1] << 8) + (buf[2] << 16) + (buf[3] << 24);
+      work = buf[0] + (buf[1] << 8) + ((i_packed_t)buf[2] << 16) + ((i_packed_t)buf[3] << 24);
+      if (shrieking)
+	*p = (work ^ SIGNBIT32) - SIGNBIT32;
+      else
+	*p = work;
       break;
 
     case 'C':
-      if (ig->readcb(ig, buf, 1) != 1)
+      if (i_io_read(ig, buf, 1) != 1)
 	return 0;
       *p = buf[0];
       break;
 
     case 'c':
-      if (ig->readcb(ig, buf, 1) != 1)
+      if (i_io_read(ig, buf, 1) != 1)
 	return 0;
       *p = (char)buf[0];
       break;
       
     case '3': /* extension - 24-bit number */
-      if (ig->readcb(ig, buf, 3) != 3)
+      if (i_io_read(ig, buf, 3) != 3)
         return 0;
-      *p = buf[0] + (buf[1] << 8) + (buf[2] << 16);
+      *p = buf[0] + (buf[1] << 8) + ((i_packed_t)buf[2] << 16);
       break;
       
     default:
-      i_fatal(1, "Unknown read_packed format code 0x%02x", *format);
+      i_fatal(1, "Unknown read_packed format code 0x%02x", code);
     }
-    ++format;
   }
   return 1;
 }
@@ -275,13 +298,13 @@ write_packed(io_glue *ig, char *format, ...) {
   va_start(ap, format);
 
   while (*format) {
-    i = va_arg(ap, unsigned int);
+    i = va_arg(ap, i_upacked_t);
 
     switch (*format) {
     case 'v':
       buf[0] = i & 255;
       buf[1] = i / 256;
-      if (ig->writecb(ig, buf, 2) == -1)
+      if (i_io_write(ig, buf, 2) == -1)
 	return 0;
       break;
 
@@ -290,14 +313,14 @@ write_packed(io_glue *ig, char *format, ...) {
       buf[1] = (i >> 8) & 0xFF;
       buf[2] = (i >> 16) & 0xFF;
       buf[3] = (i >> 24) & 0xFF;
-      if (ig->writecb(ig, buf, 4) == -1)
+      if (i_io_write(ig, buf, 4) == -1)
 	return 0;
       break;
 
     case 'C':
     case 'c':
       buf[0] = i & 0xFF;
-      if (ig->writecb(ig, buf, 1) == -1)
+      if (i_io_write(ig, buf, 1) == -1)
 	return 0;
       break;
 
@@ -328,6 +351,11 @@ int write_bmphead(io_glue *ig, i_img *im, int bit_count, int data_size) {
   int colors_used = 0;
   int offset = FILEHEAD_SIZE + INFOHEAD_SIZE;
 
+  if (im->xsize > SIGNMAX32 || im->ysize > SIGNMAX32) {
+    i_push_error(0, "image too large to write to BMP");
+    return 0;
+  }
+
   got_xres = i_tags_get_float(&im->tags, "i_xres", 0, &xres);
   got_yres = i_tags_get_float(&im->tags, "i_yres", 0, &yres);
   if (!i_tags_get_int(&im->tags, "i_aspect_only", 0,&aspect_only))
@@ -365,10 +393,15 @@ int write_bmphead(io_glue *ig, i_img *im, int bit_count, int data_size) {
     offset += 4 * colors_used;
   }
 
-  if (!write_packed(ig, "CCVvvVVVVvvVVVVVV", 'B', 'M', data_size+offset, 
-		    0, 0, offset, INFOHEAD_SIZE, im->xsize, im->ysize, 1, 
-		    bit_count, BI_RGB, 0, (int)(xres+0.5), (int)(yres+0.5), 
-		    colors_used, colors_used)){
+  if (!write_packed(ig, "CCVvvVVVVvvVVVVVV", 'B', 'M', 
+		    (i_upacked_t)(data_size+offset), 
+		    (i_upacked_t)0, (i_upacked_t)0, (i_upacked_t)offset,
+		    (i_upacked_t)INFOHEAD_SIZE, (i_upacked_t)im->xsize,
+		    (i_upacked_t)im->ysize, (i_upacked_t)1, 
+		    (i_upacked_t)bit_count, (i_upacked_t)BI_RGB,
+		    (i_upacked_t)data_size, 
+		    (i_upacked_t)(xres+0.5), (i_upacked_t)(yres+0.5), 
+		    (i_upacked_t)colors_used, (i_upacked_t)colors_used)){
     i_push_error(0, "cannot write bmp header");
     return 0;
   }
@@ -379,15 +412,16 @@ int write_bmphead(io_glue *ig, i_img *im, int bit_count, int data_size) {
     for (i = 0; i < colors_used; ++i) {
       i_getcolors(im, i, &c, 1);
       if (im->channels >= 3) {
-	if (!write_packed(ig, "CCCC", c.channel[2], c.channel[1], 
-			  c.channel[0], 0)) {
+	if (!write_packed(ig, "CCCC", (i_upacked_t)(c.channel[2]), 
+			  (i_upacked_t)(c.channel[1]), 
+			  (i_upacked_t)(c.channel[0]), (i_upacked_t)0)) {
 	  i_push_error(0, "cannot write palette entry");
 	  return 0;
 	}
       }
       else {
-	if (!write_packed(ig, "CCCC", c.channel[0], c.channel[0], 
-			  c.channel[0], 0)) {
+	i_upacked_t v = c.channel[0];
+	if (!write_packed(ig, "CCCC", v, v, v, 0)) {
 	  i_push_error(0, "cannot write palette entry");
 	  return 0;
 	}
@@ -455,7 +489,7 @@ write_1bit_data(io_glue *ig, i_img *im) {
     if (mask != 0x80) {
       *out++ = byte;
     }
-    if (ig->writecb(ig, packed, line_size) < 0) {
+    if (i_io_write(ig, packed, line_size) < 0) {
       myfree(packed);
       myfree(line);
       i_push_error(0, "writing 1 bit/pixel packed data");
@@ -465,7 +499,8 @@ write_1bit_data(io_glue *ig, i_img *im) {
   myfree(packed);
   myfree(line);
 
-  ig->closecb(ig);
+  if (i_io_close(ig))
+    return 0;
 
   return 1;
 }
@@ -514,7 +549,7 @@ write_4bit_data(io_glue *ig, i_img *im) {
     for (x = 0; x < im->xsize; x += 2) {
       *out++ = (line[x] << 4) + line[x+1];
     }
-    if (ig->writecb(ig, packed, line_size) < 0) {
+    if (i_io_write(ig, packed, line_size) < 0) {
       myfree(packed);
       myfree(line);
       i_push_error(0, "writing 4 bit/pixel packed data");
@@ -524,7 +559,8 @@ write_4bit_data(io_glue *ig, i_img *im) {
   myfree(packed);
   myfree(line);
 
-  ig->closecb(ig);
+  if (i_io_close(ig))
+    return 0;
 
   return 1;
 }
@@ -562,7 +598,7 @@ write_8bit_data(io_glue *ig, i_img *im) {
   
   for (y = im->ysize-1; y >= 0; --y) {
     i_gpal(im, 0, im->xsize, y, line);
-    if (ig->writecb(ig, line, line_size) < 0) {
+    if (i_io_write(ig, line, line_size) < 0) {
       myfree(line);
       i_push_error(0, "writing 8 bit/pixel packed data");
       return 0;
@@ -570,14 +606,12 @@ write_8bit_data(io_glue *ig, i_img *im) {
   }
   myfree(line);
 
-  ig->closecb(ig);
+  if (i_io_close(ig))
+    return 0;
 
   return 1;
 }
 
-static int bgr_chans[] = { 2, 1, 0, };
-static int grey_chans[] = { 0, 0, 0, };
-
 /*
 =item write_24bit_data(ig, im)
 
@@ -589,10 +623,12 @@ Returns non-zero on success.
 */
 static int
 write_24bit_data(io_glue *ig, i_img *im) {
-  int *chans;
   unsigned char *samples;
   int y;
   int line_size = 3 * im->xsize;
+  i_color bg;
+
+  i_get_file_background(im, &bg);
 
   /* just in case we implement a direct format with 2bytes/pixel
      (unlikely though) */
@@ -605,12 +641,19 @@ write_24bit_data(io_glue *ig, i_img *im) {
   
   if (!write_bmphead(ig, im, 24, line_size * im->ysize))
     return 0;
-  chans = im->channels >= 3 ? bgr_chans : grey_chans;
-  samples = mymalloc(line_size); /* checked 29jun05 tonyc */
+  samples = mymalloc(4 * im->xsize);
   memset(samples, 0, line_size);
   for (y = im->ysize-1; y >= 0; --y) {
-    i_gsamp(im, 0, im->xsize, y, samples, chans, 3);
-    if (ig->writecb(ig, samples, line_size) < 0) {
+    unsigned char *samplep = samples;
+    int x;
+    i_gsamp_bg(im, 0, im->xsize, y, samples, 3, &bg);
+    for (x = 0; x < im->xsize; ++x) {
+      unsigned char tmp = samplep[2];
+      samplep[2] = samplep[0];
+      samplep[0] = tmp;
+      samplep += 3;
+    }
+    if (i_io_write(ig, samples, line_size) < 0) {
       i_push_error(0, "writing image data");
       myfree(samples);
       return 0;
@@ -618,7 +661,8 @@ write_24bit_data(io_glue *ig, i_img *im) {
   }
   myfree(samples);
 
-  ig->closecb(ig);
+  if (i_io_close(ig))
+    return 0;
 
   return 1;
 }
@@ -635,7 +679,7 @@ Returns non-zero on success.
 static int
 read_bmp_pal(io_glue *ig, i_img *im, int count) {
   int i;
-  int r, g, b, x;
+  i_packed_t r, g, b, x;
   i_color c;
   
   for (i = 0; i < count; ++i) {
@@ -731,7 +775,7 @@ read_1bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
        rare */
     char buffer;
     while (base_offset < offbits) {
-      if (ig->readcb(ig, &buffer, 1) != 1) {
+      if (i_io_read(ig, &buffer, 1) != 1) {
         i_img_destroy(im);
         i_push_error(0, "failed skipping to image data offset");
         return NULL;
@@ -745,7 +789,7 @@ read_1bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
   packed = mymalloc(line_size); /* checked 29jun05 tonyc */
   line = mymalloc(xsize+8); /* checked 29jun05 tonyc */
   while (y != lasty) {
-    if (ig->readcb(ig, packed, line_size) != line_size) {
+    if (i_io_read(ig, packed, line_size) != line_size) {
       myfree(packed);
       myfree(line);
       if (allow_incomplete) {
@@ -848,7 +892,7 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
        rare */
     char buffer;
     while (base_offset < offbits) {
-      if (ig->readcb(ig, &buffer, 1) != 1) {
+      if (i_io_read(ig, &buffer, 1) != 1) {
         i_img_destroy(im);
         i_push_error(0, "failed skipping to image data offset");
         return NULL;
@@ -866,7 +910,7 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
   if (compression == BI_RGB) {
     i_tags_add(&im->tags, "bmp_compression_name", 0, "BI_RGB", -1, 0);
     while (y != lasty) {
-      if (ig->readcb(ig, packed, line_size) != line_size) {
+      if (i_io_read(ig, packed, line_size) != line_size) {
 	myfree(packed);
 	myfree(line);
         if (allow_incomplete) {
@@ -896,12 +940,13 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
   else if (compression == BI_RLE4) {
     int read_size;
     int count;
+    i_img_dim xlimit = (xsize + 1) / 2 * 2; /* rounded up */
 
     i_tags_add(&im->tags, "bmp_compression_name", 0, "BI_RLE4", -1, 0);
     x = 0;
     while (1) {
       /* there's always at least 2 bytes in a sequence */
-      if (ig->readcb(ig, packed, 2) != 2) {
+      if (i_io_read(ig, packed, 2) != 2) {
         myfree(packed);
         myfree(line);
         if (allow_incomplete) {
@@ -916,15 +961,24 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
         }
       }
       else if (packed[0]) {
-        line[0] = packed[1] >> 4;
-        line[1] = packed[1] & 0x0F;
-        for (i = 0; i < packed[0]; i += 2) {
-          if (i < packed[0]-1) 
-            i_ppal(im, x, x+2, y, line);
-          else
-            i_ppal(im, x, x+(packed[0]-i), y, line);
-          x += 2;
-        }
+	int count = packed[0];
+	if (x + count > xlimit) {
+	  /* this file is corrupt */
+	  myfree(packed);
+	  myfree(line);
+	  i_push_error(0, "invalid data during decompression");
+	  mm_log((1, "read 4-bit: scanline overflow x %d + count %d vs xlimit %d (y %d)\n",
+		  (int)x, count, (int)xlimit, (int)y));
+	  i_img_destroy(im);
+	  return NULL;
+	}
+	/* fill in the line */
+	for (i = 0; i < count; i += 2)
+	  line[i] = packed[1] >> 4;
+	for (i = 1; i < count; i += 2)
+	  line[i] = packed[1] & 0x0F;
+	i_ppal(im, x, x+count, y, line);
+	x += count;
       } else {
         switch (packed[1]) {
         case BMPRLE_ENDOFLINE:
@@ -938,7 +992,7 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
           return im;
 
         case BMPRLE_DELTA:
-          if (ig->readcb(ig, packed, 2) != 2) {
+          if (i_io_read(ig, packed, 2) != 2) {
             myfree(packed);
             myfree(line);
             if (allow_incomplete) {
@@ -958,9 +1012,19 @@ read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
 
         default:
           count = packed[1];
+	  if (x + count > xlimit) {
+	    /* this file is corrupt */
+	    myfree(packed);
+	    myfree(line);
+	    i_push_error(0, "invalid data during decompression");
+	    mm_log((1, "read 4-bit: scanline overflow (unpacked) x %d + count %d vs xlimit %d (y %d)\n",
+		  (int)x, count, (int)xlimit, (int)y));
+	    i_img_destroy(im);
+	    return NULL;
+	  }
           size = (count + 1) / 2;
           read_size = (size+1) / 2 * 2;
-          if (ig->readcb(ig, packed, read_size) != read_size) {
+          if (i_io_read(ig, packed, read_size) != read_size) {
             myfree(packed);
             myfree(line);
             if (allow_incomplete) {
@@ -1059,7 +1123,7 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
        rare */
     char buffer;
     while (base_offset < offbits) {
-      if (ig->readcb(ig, &buffer, 1) != 1) {
+      if (i_io_read(ig, &buffer, 1) != 1) {
         i_img_destroy(im);
         i_push_error(0, "failed skipping to image data offset");
         return NULL;
@@ -1072,7 +1136,7 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
   if (compression == BI_RGB) {
     i_tags_add(&im->tags, "bmp_compression_name", 0, "BI_RGB", -1, 0);
     while (y != lasty) {
-      if (ig->readcb(ig, line, line_size) != line_size) {
+      if (i_io_read(ig, line, line_size) != line_size) {
 	myfree(line);
         if (allow_incomplete) {
           i_tags_setn(&im->tags, "i_incomplete", 1);
@@ -1099,7 +1163,7 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
     x = 0;
     while (1) {
       /* there's always at least 2 bytes in a sequence */
-      if (ig->readcb(ig, packed, 2) != 2) {
+      if (i_io_read(ig, packed, 2) != 2) {
         myfree(line);
         if (allow_incomplete) {
           i_tags_setn(&im->tags, "i_incomplete", 1);
@@ -1113,6 +1177,13 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
         }
       }
       if (packed[0]) {
+	if (x + packed[0] > xsize) {
+	  /* this file isn't incomplete, it's corrupt */
+	  myfree(line);
+	  i_push_error(0, "invalid data during decompression");
+	  i_img_destroy(im);
+	  return NULL;
+	}
         memset(line, packed[1], packed[0]);
         i_ppal(im, x, x+packed[0], y, line);
         x += packed[0];
@@ -1128,7 +1199,7 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
           return im;
 
         case BMPRLE_DELTA:
-          if (ig->readcb(ig, packed, 2) != 2) {
+          if (i_io_read(ig, packed, 2) != 2) {
             myfree(line);
             if (allow_incomplete) {
               i_tags_setn(&im->tags, "i_incomplete", 1);
@@ -1147,8 +1218,16 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
 
         default:
           count = packed[1];
+	  if (x + count > xsize) {
+	    /* runs shouldn't cross a line boundary */
+	    /* this file isn't incomplete, it's corrupt */
+	    myfree(line);
+	    i_push_error(0, "invalid data during decompression");
+	    i_img_destroy(im);
+	    return NULL;
+	  }
           read_size = (count+1) / 2 * 2;
-          if (ig->readcb(ig, line, read_size) != read_size) {
+          if (i_io_read(ig, line, read_size) != read_size) {
             myfree(line);
             if (allow_incomplete) {
               i_tags_setn(&im->tags, "i_incomplete", 1);
@@ -1181,23 +1260,42 @@ read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
 struct bm_masks {
   unsigned masks[3];
   int shifts[3];
+  int bits[3];
 };
 static struct bm_masks std_masks[] =
 {
   { /* 16-bit */
-    { 0770000, 00007700, 00000077, },
-    { 10, 4, -2, },
+    { 0076000, 00001740, 00000037, },
+    { 10, 5, 0, },
+    { 5, 5, 5, }
   },
   { /* 24-bit */
     { 0xFF0000, 0x00FF00, 0x0000FF, },
     {       16,        8,        0, },
+    {        8,        8,        8, },
   },
   { /* 32-bit */
     { 0xFF0000, 0x00FF00, 0x0000FF, },
     {       16,        8,        0, },
+    {        8,        8,        8, },
   },
 };
 
+/* multiplier and shift for converting from N bits to 8 bits */
+struct bm_sampconverts {
+  int mult;
+  int shift;
+};
+static struct bm_sampconverts samp_converts[] = {
+  { 0xff, 0 }, /* 1 bit samples */
+  { 0x55, 0 },
+  { 0111, 1 },
+  { 0x11, 0 },
+  { 0x21, 2 },
+  { 0x41, 4 },
+  { 0x81, 6 }  /* 7 bit samples */
+};
+
 /*
 =item read_direct_bmp(ig, xsize, ysize, bit_count, clr_used, compression, allow_incomplete)
 
@@ -1251,7 +1349,7 @@ read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count,
     /* there's a potential "palette" after the header */
     for (i = 0; i < clr_used; ++clr_used) {
       char buf[4];
-      if (ig->readcb(ig, buf, 4) != 4) {
+      if (i_io_read(ig, buf, 4) != 4) {
         i_push_error(0, "skipping colors");
         return 0;
       }
@@ -1259,24 +1357,39 @@ read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count,
     }
   }
   else if (compression == BI_BITFIELDS) {
-    int pos, bit;
+    int pos;
+    unsigned bits;
     compression_name = "BI_BITFIELDS";
 
     for (i = 0; i < 3; ++i) {
-      if (!read_packed(ig, "V", masks.masks+i)) {
+      i_packed_t rmask;
+      if (!read_packed(ig, "V", &rmask)) {
         i_push_error(0, "reading pixel masks");
         return 0;
       }
+      if (rmask == 0) {
+	i_push_errorf(0, "Zero mask for channel %d", i);
+	return NULL;
+      }
+      masks.masks[i] = rmask;
       /* work out a shift for the mask */
       pos = 0;
-      bit = masks.masks[i] & -masks.masks[i];
-      while (bit) {
+      bits = masks.masks[i];
+      while (!(bits & 1)) {
         ++pos;
-        bit >>= 1;
+        bits >>= 1;
       }
-      masks.shifts[i] = pos - 8;
+      masks.shifts[i] = pos;
+      pos = 0;
+      while (bits & 1) {
+	++pos;
+	bits >>= 1;
+      }
+      masks.bits[i] = pos;
+      /*fprintf(stderr, "%d: mask %08x shift %d bits %d\n", i, masks.masks[i], masks.shifts[i], masks.bits[i]);*/
     }
-    base_offset += 4 * 4;
+    /* account for the masks */
+    base_offset += 3 * 4;
   }
   else {
     i_push_errorf(0, "unknown 24-bit BMP compression (%d)", compression);
@@ -1293,7 +1406,7 @@ read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count,
        rare */
     char buffer;
     while (base_offset < offbits) {
-      if (ig->readcb(ig, &buffer, 1) != 1) {
+      if (i_io_read(ig, &buffer, 1) != 1) {
         i_push_error(0, "failed skipping to image data offset");
         return NULL;
       }
@@ -1319,7 +1432,7 @@ read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count,
   while (y != lasty) {
     p = line;
     for (x = 0; x < xsize; ++x) {
-      unsigned pixel;
+      i_packed_t pixel;
       if (!read_packed(ig, unpack_code, &pixel)) {
         myfree(line);
         if (allow_incomplete) {
@@ -1334,16 +1447,21 @@ read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count,
         }
       }
       for (i = 0; i < 3; ++i) {
-        if (masks.shifts[i] > 0)
-          p->channel[i] = (pixel & masks.masks[i]) >> masks.shifts[i];
-        else 
-          p->channel[i] = (pixel & masks.masks[i]) << -masks.shifts[i];
+	int sample = (pixel & masks.masks[i]) >> masks.shifts[i];
+	int bits = masks.bits[i];
+	if (bits < 8) {
+	  sample = (sample * samp_converts[bits-1].mult) >> samp_converts[bits-1].shift;
+	}
+	else if (bits) {
+	  sample >>= bits - 8;
+	}
+	p->channel[i] = sample;
       }
       ++p;
     }
     i_plin(im, 0, xsize, y, line);
     if (extras)
-      ig->readcb(ig, junk, extras);
+      i_io_read(ig, junk, extras);
     y += yinc;
   }
   myfree(line);