From d57d230f8a9a69ccde5a850646e807f12a47dacb Mon Sep 17 00:00:00 2001 From: Cristy Date: Sat, 15 Jul 2017 08:22:46 -0400 Subject: [PATCH] ... --- coders/png.c | 131 ++++++++++++++++++++++++++++----------------------- 1 file changed, 73 insertions(+), 58 deletions(-) diff --git a/coders/png.c b/coders/png.c index 1afa80e59..42d2b26f6 100644 --- a/coders/png.c +++ b/coders/png.c @@ -728,7 +728,7 @@ typedef struct _MngInfo RenderingIntent global_srgb_intent; - unsigned int + unsigned long delay, global_plte_length, global_trns_length, @@ -768,7 +768,7 @@ typedef struct _MngInfo write_png64; #ifdef MNG_BASI_SUPPORTED - size_t + unsigned long basi_width, basi_height; @@ -1583,10 +1583,14 @@ static MngBox mng_read_box(MngBox previous_box,char delta_type, /* Read clipping boundaries from DEFI, CLIP, FRAM, or PAST chunk. */ - box.left=(ssize_t) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3]); - box.right=(ssize_t) ((p[4] << 24) | (p[5] << 16) | (p[6] << 8) | p[7]); - box.top=(ssize_t) ((p[8] << 24) | (p[9] << 16) | (p[10] << 8) | p[11]); - box.bottom=(ssize_t) ((p[12] << 24) | (p[13] << 16) | (p[14] << 8) | p[15]); + box.left=(long) (((png_uint_32) p[0] << 24) | ((png_uint_32) p[1] << 16) | + ((png_uint_32) p[2] << 8) | (png_uint_32) p[3]); + box.right=(long) (((png_uint_32) p[4] << 24) | ((png_uint_32) p[5] << 16) | + ((png_uint_32) p[6] << 8) | (png_uint_32) p[7]); + box.top=(long) (((png_uint_32) p[8] << 24) | ((png_uint_32) p[9] << 16) | + ((png_uint_32) p[10] << 8) | (png_uint_32) p[11]); + box.bottom=(long) (((png_uint_32) p[12] << 24) | ((png_uint_32) p[13] << 16) | + ((png_uint_32) p[14] << 8) | (png_uint_32) p[15]); if (delta_type != 0) { box.left+=previous_box.left; @@ -1603,12 +1607,14 @@ static MngPair mng_read_pair(MngPair previous_pair,int delta_type, { MngPair pair; + /* - Read two ssize_ts from CLON, MOVE or PAST chunk + Read two ssize_t's from CLON, MOVE or PAST chunk */ - pair.a=(long) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3]); - pair.b=(long) ((p[4] << 24) | (p[5] << 16) | (p[6] << 8) | p[7]); - + pair.a=(long) (((png_uint_32) p[0] << 24) | ((png_uint_32) p[1] << 16) | + ((png_uint_32) p[2] << 8) | (png_uint_32) p[3]); + pair.b=(long) (((png_uint_32) p[4] << 24) | ((png_uint_32) p[5] << 16) | + ((png_uint_32) p[6] << 8) | (png_uint_32) p[7]); if (delta_type != 0) { pair.a+=previous_pair.a; @@ -1620,7 +1626,8 @@ static MngPair mng_read_pair(MngPair previous_pair,int delta_type, static long mng_get_long(unsigned char *p) { - return((long) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3])); + return ((long) (((png_uint_32) p[0] << 24) | ((png_uint_32) p[1] << 16) | + ((png_uint_32) p[2] << 8) | (png_uint_32) p[3])); } typedef struct _PNGErrorInfo @@ -1926,11 +1933,14 @@ static int read_user_chunk_callback(png_struct *ping, png_unknown_chunkp chunk) image=(Image *) png_get_user_chunk_ptr(ping); - image->page.width=(size_t) ((chunk->data[0] << 24) | - (chunk->data[1] << 16) | (chunk->data[2] << 8) | chunk->data[3]); - - image->page.height=(size_t) ((chunk->data[4] << 24) | - (chunk->data[5] << 16) | (chunk->data[6] << 8) | chunk->data[7]); + image->page.width=(size_t) (((png_uint_32) chunk->data[0] << 24) | + ((png_uint_32) chunk->data[1] << 16) | + ((png_uint_32) chunk->data[2] << 8) | + (png_uint_32) chunk->data[3]); + image->page.height=(size_t) (((png_uint_32) chunk->data[4] << 24) | + ((png_uint_32) chunk->data[5] << 16) | + ((png_uint_32) chunk->data[6] << 8) | + (png_uint_32) chunk->data[7]); return(1); } @@ -1948,17 +1958,18 @@ static int read_user_chunk_callback(png_struct *ping, png_unknown_chunkp chunk) image=(Image *) png_get_user_chunk_ptr(ping); - image->page.width=(size_t) ((chunk->data[0] << 24) | - (chunk->data[1] << 16) | (chunk->data[2] << 8) | chunk->data[3]); - - image->page.height=(size_t) ((chunk->data[4] << 24) | - (chunk->data[5] << 16) | (chunk->data[6] << 8) | chunk->data[7]); - - image->page.x=(size_t) ((chunk->data[8] << 24) | - (chunk->data[9] << 16) | (chunk->data[10] << 8) | chunk->data[11]); - - image->page.y=(size_t) ((chunk->data[12] << 24) | - (chunk->data[13] << 16) | (chunk->data[14] << 8) | chunk->data[15]); + image->page.width=(size_t) (((png_uint_32) chunk->data[0] << 24) | + ((png_uint_32) chunk->data[1] << 16) | + ((png_uint_32) chunk->data[2] << 8) | (png_uint_32) chunk->data[3]); + image->page.height=(size_t) (((png_uint_32) chunk->data[4] << 24) | + ((png_uint_32) chunk->data[5] << 16) | + ((png_uint_32) chunk->data[6] << 8) | (png_uint_32) chunk->data[7]); + image->page.x=(ssize_t) (((png_uint_32) chunk->data[8] << 24) | + ((png_uint_32) chunk->data[9] << 16) | + ((png_uint_32) chunk->data[10] << 8) | (png_uint_32) chunk->data[11]); + image->page.y=(ssize_t) (((png_uint_32) chunk->data[12] << 24) | + ((png_uint_32) chunk->data[13] << 16) | + ((png_uint_32) chunk->data[14] << 8) | (png_uint_32) chunk->data[15]); return(1); } @@ -2962,7 +2973,7 @@ static Image *ReadOnePNGImage(MngInfo *mng_info, max_sample; size_t - one=1; + one = 1; if (logging != MagickFalse) (void) LogMagickEvent(CoderEvent,GetMagickModule(), @@ -3489,7 +3500,7 @@ static Image *ReadOnePNGImage(MngInfo *mng_info, quantum; if (image->colors > 256) - quantum=((*p++) << 8); + quantum=(((unsigned int) *p++) << 8); else quantum=0; @@ -3501,7 +3512,7 @@ static Image *ReadOnePNGImage(MngInfo *mng_info, if (ping_color_type == 4) { if (image->colors > 256) - quantum=((*p++) << 8); + quantum=(((unsigned int) *p++) << 8); else quantum=0; @@ -4404,10 +4415,12 @@ static Image *ReadOneJNGImage(MngInfo *mng_info, { if (length == 16) { - jng_width=(size_t) ((p[0] << 24) | (p[1] << 16) | - (p[2] << 8) | p[3]); - jng_height=(size_t) ((p[4] << 24) | (p[5] << 16) | - (p[6] << 8) | p[7]); + jng_width=(png_uint_32) (((png_uint_32) p[0] << 24) | + ((png_uint_32) p[1] << 16) | ((png_uint_32) p[2] << 8) | + (png_uint_32) p[3]); + jng_height=(png_uint_32) (((png_uint_32) p[4] << 24) | + ((png_uint_32) p[5] << 16) | ((png_uint_32) p[6] << 8) | + (png_uint_32) p[7]); if ((jng_width == 0) || (jng_height == 0)) ThrowReaderException(CorruptImageError, "NegativeOrZeroImageSize"); @@ -5326,12 +5339,12 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info, ThrowReaderException(CorruptImageError,"CorruptImage"); } - mng_info->mng_width=(size_t) ((p[0] << 24) | (p[1] << 16) | - (p[2] << 8) | p[3]); - - mng_info->mng_height=(size_t) ((p[4] << 24) | (p[5] << 16) | - (p[6] << 8) | p[7]); - + mng_info->mng_width=(unsigned long) (((png_uint_32) p[0] << 24) | + ((png_uint_32) p[1] << 16) | ((png_uint_32) p[2] << 8) | + (png_uint_32) p[3]); + mng_info->mng_height=(unsigned long) (((png_uint_32) p[4] << 24) | + ((png_uint_32) p[5] << 16) | ((png_uint_32) p[6] << 8) | + (png_uint_32) p[7]); if (logging != MagickFalse) { (void) LogMagickEvent(CoderEvent,GetMagickModule(), @@ -5487,12 +5500,12 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info, */ if (length > 11) { - mng_info->x_off[object_id]=(ssize_t) ((p[4] << 24) | - (p[5] << 16) | (p[6] << 8) | p[7]); - - mng_info->y_off[object_id]=(ssize_t) ((p[8] << 24) | - (p[9] << 16) | (p[10] << 8) | p[11]); - + mng_info->x_off[object_id]=(ssize_t) + (((png_uint_32) p[4] << 24) | ((png_uint_32) p[5] << 16) | + ((png_uint_32) p[6] << 8) | (png_uint_32) p[7]); + mng_info->y_off[object_id]=(ssize_t) + (((png_uint_32) p[8] << 24) | ((png_uint_32) p[9] << 16) | + ((png_uint_32) p[10] << 8) | (png_uint_32) p[11]); if (logging != MagickFalse) { (void) LogMagickEvent(CoderEvent,GetMagickModule(), @@ -6301,34 +6314,36 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info, mng_info->basi_warning++; #ifdef MNG_BASI_SUPPORTED - basi_width=(size_t) ((p[0] << 24) | (p[1] << 16) | - (p[2] << 8) | p[3]); - basi_height=(size_t) ((p[4] << 24) | (p[5] << 16) | - (p[6] << 8) | p[7]); + basi_width=(unsigned long) (((png_uint_32) p[0] << 24) | + ((png_uint_32) p[1] << 16) | ((png_uint_32) p[2] << 8) | + (png_uint_32) p[3]); + basi_height=(unsigned long) (((png_uint_32) p[4] << 24) | + ((png_uint_32) p[5] << 16) | ((png_uint_32) p[6] << 8) | + (png_uint_32) p[7]); basi_color_type=p[8]; basi_compression_method=p[9]; basi_filter_type=p[10]; basi_interlace_method=p[11]; if (length > 11) - basi_red=(p[12] << 8) & p[13]; + basi_red=((png_uint_32) p[12] << 8) & (png_uint_32) p[13]; else basi_red=0; if (length > 13) - basi_green=(p[14] << 8) & p[15]; + basi_green=((png_uint_32) p[14] << 8) & (png_uint_32) p[15]; else basi_green=0; if (length > 15) - basi_blue=(p[16] << 8) & p[17]; + basi_blue=((png_uint_32) p[16] << 8) & (png_uint_32) p[17]; else basi_blue=0; if (length > 17) - basi_alpha=(p[18] << 8) & p[19]; + basi_alpha=((png_uint_32) p[18] << 8) & (png_uint_32) p[19]; else { @@ -12995,10 +13010,10 @@ static MagickBooleanType WriteOneJNGImage(MngInfo *mng_info, p=blob+8; for (i=8; i<(ssize_t) length; i+=len+12) { - len=(size_t) (*p) << 24; - len|=(size_t) (*(p+1)) << 16; - len|=(size_t) (*(p+2)) << 8; - len|=(size_t) (*(p+3)); + len=(((unsigned int) *(p ) & 0xff) << 24) + + (((unsigned int) *(p + 1) & 0xff) << 16) + + (((unsigned int) *(p + 2) & 0xff) << 8) + + (((unsigned int) *(p + 3) & 0xff) ) ; p+=4; if (*(p)==73 && *(p+1)==68 && *(p+2)==65 && *(p+3)==84) /* IDAT */ -- 2.40.0