- validate chan_count for chans == NULL for each of the i_gsamp()

   implementations.

diff --git a/Changes b/Changes
index 9427270b1e4952afc525d258e8eb50c5fdb53019..ea0ad288169b50bd7466492b1b9ec4a0d85e4bc5 100644 (file)
--- a/Changes
+++ b/Changes
@@ -40,6 +40,10 @@ Bug fixes:
    under 0x10000.  This was most noticable when writing large RLE images.
    http://rt.cpan.org/Ticket/Display.html?id=30335
 
+ - validate chan_count for chans == NULL for each of the i_gsamp()
+   implementations.
+   http://rt.cpan.org/Ticket/Display.html?id=28985
+
 Imager 0.60 - 30 August 2007
 ===========
 

diff --git a/TODO b/TODO
index fe2350b45535e7c0c0273b8939c384608a9c14c4..583b2e07b9c8b837892f4574da143bcfbbbe60d7 100644 (file)
--- a/TODO
+++ b/TODO
@@ -36,7 +36,7 @@ read DIBS (#29055)
 
 library search path on 64-bit centos (#29045)
 
-i_gsamp() chan_count validation (#28985)
+i_gsamp() chan_count validation (#28985) (done)
 
 Imager::Font::Wrap doesn't correctly set savepos (#29771)
 

diff --git a/image.c b/image.c
index 76cdaf9b854aa2578c6627bbe9fc26f167e0f489..85cbb2bd645a9874d0cd34bd3f128efb862fed3f 100644 (file)
--- a/image.c
+++ b/image.c
@@ -1689,6 +1689,11 @@ i_gsamp_d(i_img *im, int l, int r, int y, i_sample_t *samps,
       }
     }
     else {
+      if (chan_count <= 0 || chan_count > im->channels) {
+       i_push_errorf(0, "chan_count %d out of range, must be >0, <= channels", 
+                     chan_count);
+       return 0;
+      }
       for (i = 0; i < w; ++i) {
         for (ch = 0; ch < chan_count; ++ch) {
           *samps++ = data[ch];
@@ -1751,6 +1756,11 @@ i_gsampf_d(i_img *im, int l, int r, int y, i_fsample_t *samps,
       }
     }
     else {
+      if (chan_count <= 0 || chan_count > im->channels) {
+       i_push_errorf(0, "chan_count %d out of range, must be >0, <= channels", 
+                     chan_count);
+       return 0;
+      }
       for (i = 0; i < w; ++i) {
         for (ch = 0; ch < chan_count; ++ch) {
           *samps++ = Sample8ToF(data[ch]);

diff --git a/img16.c b/img16.c
index 4be3416ce890fd1c6ea58fe5d06b2629e2f0fc58..e17d40d7fc42c6d1bc9dab467fe8c0598ca25a0c 100644 (file)
--- a/img16.c
+++ b/img16.c
@@ -452,6 +452,11 @@ static int i_gsamp_d16(i_img *im, int l, int r, int y, i_sample_t *samps,
       }
     }
     else {
+      if (chan_count <= 0 || chan_count > im->channels) {
+       i_push_errorf(0, "chan_count %d out of range, must be >0, <= channels", 
+                     chan_count);
+       return 0;
+      }
       for (i = 0; i < w; ++i) {
         for (ch = 0; ch < chan_count; ++ch) {
           *samps++ = GET16as8(im->idata, off+ch);
@@ -497,6 +502,11 @@ static int i_gsampf_d16(i_img *im, int l, int r, int y, i_fsample_t *samps,
       }
     }
     else {
+      if (chan_count <= 0 || chan_count > im->channels) {
+       i_push_errorf(0, "chan_count %d out of range, must be >0, <= channels", 
+                     chan_count);
+       return 0;
+      }
       for (i = 0; i < w; ++i) {
         for (ch = 0; ch < chan_count; ++ch) {
           *samps++ = Sample16ToF(GET16(im->idata, off+ch));

diff --git a/imgdouble.c b/imgdouble.c
index 435fac7f7daea19a3660b3e60f5b84cf013b3ccd..b9df1e3083a0bff855f5244fee01bf2b8d4d564d 100644 (file)
--- a/imgdouble.c
+++ b/imgdouble.c
@@ -345,6 +345,11 @@ static int i_gsamp_ddoub(i_img *im, int l, int r, int y, i_sample_t *samps,
       }
     }
     else {
+      if (chan_count <= 0 || chan_count > im->channels) {
+       i_push_errorf(0, "chan_count %d out of range, must be >0, <= channels", 
+                     chan_count);
+       return 0;
+      }
       for (i = 0; i < w; ++i) {
         for (ch = 0; ch < chan_count; ++ch) {
           *samps++ = SampleFTo8(((double *)im->idata)[off+ch]);
@@ -390,6 +395,11 @@ static int i_gsampf_ddoub(i_img *im, int l, int r, int y, i_fsample_t *samps,
       }
     }
     else {
+      if (chan_count <= 0 || chan_count > im->channels) {
+       i_push_errorf(0, "chan_count %d out of range, must be >0, <= channels", 
+                     chan_count);
+       return 0;
+      }
       for (i = 0; i < w; ++i) {
         for (ch = 0; ch < chan_count; ++ch) {
           *samps++ = ((double *)im->idata)[off+ch];

diff --git a/palimg.c b/palimg.c
index 88498333ae7e96d27ea0fd12c65b174cb22fe484..75c56ccea51fad42f993606ab7b2086812b450b6 100644 (file)
--- a/palimg.c
+++ b/palimg.c
@@ -426,6 +426,11 @@ static int i_gsamp_p(i_img *im, int l, int r, int y, i_sample_t *samps,
       }
     }
     else {
+      if (chan_count <= 0 || chan_count > im->channels) {
+       i_push_errorf(0, "chan_count %d out of range, must be >0, <= channels", 
+                     chan_count);
+       return 0;
+      }
       for (i = 0; i < w; ++i) {
         i_palidx which = *data++;
         if (which < palsize) {