shithub: riscv

Info  •  Files  •  Log  •  Branches

jpg: missing malloc/realloc checks

--- a/sys/src/cmd/jpg/ico.c

+++ b/sys/src/cmd/jpg/ico.c

@@ -103,6 +103,8 @@

 	int i;

 	p = m = mallocz(sizeof(int)*(1<<icon->bits), 1);

+	if(m == nil)

+		sysfatal("malloc: %r");

 	for(i = 0; i < ncolor; i++){

 		*p++ = rgb2cmap(map[2], map[1], map[0]);

 		map += 4;

@@ -122,6 +124,8 @@

 	inxlen = 4*((icon->bits*icon->w+31)/32);

 	img = allocmemimage(Rect(0,0,icon->w,icon->h), chan);

+	if(img == nil)

+		return nil;

 	if(chan != CMAP8){

 		from = xor + icon->h*inxlen;

@@ -133,6 +137,11 @@

 	}

 	to = data = malloc(icon->w*icon->h);

+	if(data == nil){

+		freememimage(img);

+		return nil;

+	}

+

 	/* rotate around the y axis, go to 8 bits, and convert color */

 	mask = (1<<icon->bits)-1;

 	for(y = 0; y < icon->h; y++){

@@ -166,19 +175,20 @@

 	inxlen = 4*((icon->w+31)/32);

 	to = data = malloc(inxlen*icon->h);

+	if(data == nil)

+		return nil;

 	/* rotate around the y axis and invert bits */

 	outxlen = (icon->w+7)/8;

 	for(y = 0; y < icon->h; y++){

 		from = and + (icon->h - 1 - y)*inxlen;

-		for(x = 0; x < outxlen; x++){

+		for(x = 0; x < outxlen; x++)

 			*to++ = ~(*from++);

-		}

 	}

 	/* stick in an image */

-	img = allocmemimage(Rect(0,0,icon->w,icon->h), GREY1);

-	loadmemimage(img, Rect(0,0,icon->w,icon->h), data, icon->h*outxlen);

+	if(img = allocmemimage(Rect(0,0,icon->w,icon->h), GREY1))

+		loadmemimage(img, Rect(0,0,icon->w,icon->h), data, icon->h*outxlen);

 	free(data);

 	return img;

@@ -267,6 +277,10 @@

 	/* convert the images */

 	icon->img = xor2img(icon, chan, xor, map2map);

+	if(icon->img == nil){

+		werrstr("xor2img: %r");

+		return -1;

+	}

 	icon->mask = nil;

 	/* check for and mask */

--- a/sys/src/cmd/jpg/jpg.c

+++ b/sys/src/cmd/jpg/jpg.c

@@ -169,7 +169,7 @@

 		aao[i+1] = nil;

 		ao = aao[i] = malloc(sizeof(Rawimage));

 		if (ao == nil){

-			fprint(2, "jpg: vidmerge: realloc\n");

+			fprint(2, "jpg: vidmerge: malloc\n");

 			return nil;

 		}

 		memcpy(ao, a1, sizeof(Rawimage));

@@ -201,6 +201,10 @@

 			uchar *po, *p1, *p2;

 			ao->chans[c] = malloc(ao->chanlen);

+			if (ao->chans[c] == nil){

+				fprint(2, "jpg: vidmerge: malloc chan\n");

+				return nil;

+			}

 			po = ao->chans[c];

 			p1 = a1->chans[c];

 			p2 = a2->chans[c];

--- a/sys/src/cmd/jpg/readgif.c

+++ b/sys/src/cmd/jpg/readgif.c

@@ -156,7 +156,6 @@

 	if(h->fields & 0x80)

 		h->globalcmap = readcmap(h, (h->fields&7)+1);

-

 	array = malloc(sizeof(Rawimage**));

 	if(array == nil)

 		giferror(h, memerr);

@@ -180,8 +179,12 @@

 				new->cmaplen = 3*(1<<((new->fields&7)+1));

 				new->cmap = readcmap(h, (new->fields&7)+1);

 			}else{

+				if(h->globalcmap == nil)

+					giferror(h, "ReadGIF: globalcmap missing");

 				new->cmaplen = 3*(1<<((h->fields&7)+1));

 				new->cmap = malloc(new->cmaplen);

+				if(new->cmap == nil)

+					giferror(h, memerr);

 				memmove(new->cmap, h->globalcmap, new->cmaplen);

 			}

 			h->new = new;