(no commit message)

[imagemagick] / coders / sfw.c

diff --git a/coders/sfw.c b/coders/sfw.c
index d23bf4727ee521a47a2c570c34b0e9a210a86995..2cc8a37d318e9196217c348054e841cb8dc3b100 100644 (file)
--- a/coders/sfw.c
+++ b/coders/sfw.c
@@ -17,7 +17,7 @@
 %                                 July 1992                                   %
 %                                                                             %
 %                                                                             %
-%  Copyright 1999-2012 ImageMagick Studio LLC, a non-profit organization      %
+%  Copyright 1999-2013 ImageMagick Studio LLC, a non-profit organization      %
 %  dedicated to making software imaging solutions freely available.           %
 %                                                                             %
 %  You may not use this file except in compliance with the License.  You may  %
@@ -120,24 +120,22 @@ static MagickBooleanType IsSFW(const unsigned char *magick,const size_t length)
 %
 */
 
-static unsigned char *SFWScan(unsigned char *p,const unsigned char *q,
-  const unsigned char *target,const int length)
+static unsigned char *SFWScan(const unsigned char *p,const unsigned char *q,
+  const unsigned char *target,const size_t length)
 {
   register ssize_t
     i;
 
-  for ( ; p < q; p++)
-  {
-    if (*p != *target)
-      continue;
-    if (length == 1)
-      return(p);
-    for (i=1; i < length; i++)
-      if (*(p+i) != *(target+i))
-        break;
-    if (i == length)
-      return(p);
-  }
+  if ((p+length) < q)
+    while (p < q)
+    {
+      for (i=0; i < (ssize_t) length; i++)
+        if (p[i] != target[i])
+          break;
+      if (i == (ssize_t) length)
+        return((unsigned char *) p);
+      p++;
+    }
   return((unsigned char *) NULL);
 }
 
@@ -207,6 +205,7 @@ static Image *ReadSFWImage(const ImageInfo *image_info,ExceptionInfo *exception)
 
   Image
     *flipped_image,
+    *jpeg_image,
     *image;
 
   ImageInfo
@@ -252,15 +251,17 @@ static Image *ReadSFWImage(const ImageInfo *image_info,ExceptionInfo *exception)
   /*
     Read image into a buffer.
   */
+  if (GetBlobSize(image) != (size_t) GetBlobSize(image))
+    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
   buffer=(unsigned char *) AcquireQuantumMemory((size_t) GetBlobSize(image),
     sizeof(*buffer));
   if (buffer == (unsigned char *) NULL)
     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
   count=ReadBlob(image,(size_t) GetBlobSize(image),buffer);
-  if ((count == 0) || (LocaleNCompare((char *) buffer,"SFW",3) != 0))
+  if ((count != (ssize_t) GetBlobSize(image)) ||
+      (LocaleNCompare((char *) buffer,"SFW",3) != 0))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   (void) CloseBlob(image);
-  image=DestroyImage(image);
   /*
     Find the start of the JFIF data
   */
@@ -278,13 +279,18 @@ static Image *ReadSFWImage(const ImageInfo *image_info,ExceptionInfo *exception)
     Translate remaining markers.
   */
   offset=header+2;
-  offset+=(offset[2] << 8)+offset[3]+2;
+  offset+=(((unsigned int) offset[2]) << 8)+offset[3]+2;
   for ( ; ; )
   {
+    if ((offset+4) > (buffer+count-1))
+      {
+        buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      }
     TranslateSFWMarker(offset);
     if (offset[1] == 0xda)
       break;
-    offset+=(offset[2] << 8)+offset[3]+2;
+    offset+=(((unsigned int) offset[2]) << 8)+offset[3]+2;
   }
   offset--;
   data=SFWScan(offset,buffer+count-1,(const unsigned char *) "\377\311",2);
@@ -338,11 +344,18 @@ static Image *ReadSFWImage(const ImageInfo *image_info,ExceptionInfo *exception)
   /*
     Read JPEG image.
   */
-  image=ReadImage(read_info,exception);
+  jpeg_image=ReadImage(read_info,exception);
   (void) RelinquishUniqueFileResource(read_info->filename);
   read_info=DestroyImageInfo(read_info);
-  if (image == (Image *) NULL)
-    return(GetFirstImageInList(image));
+  if (jpeg_image == (Image *) NULL)
+    {
+      image=DestroyImageList(image);
+      return(jpeg_image);
+    }
+  (void) CopyMagickString(jpeg_image->filename,image->filename,MaxTextExtent);
+  (void) CopyMagickString(jpeg_image->magick,image->magick,MaxTextExtent);
+  image=DestroyImageList(image);
+  image=jpeg_image;
   /*
     Correct image orientation.
   */