(hopefully) fixed a buffer overflow pointed

out by Oleg V. Andrjushenko <oandr@itec.cn.ua>


--Sven
This commit is contained in:
Sven Neumann 2000-04-25 12:32:10 +00:00
parent 84c7ea0507
commit 32f37d07f4
6 changed files with 146 additions and 137 deletions

View File

@ -1,3 +1,8 @@
2000-04-25 Sven Neumann <sven@gimp.org>
* app/nav_window.c: (hopefully) fixed a buffer overflow pointed
out by Oleg V. Andrjushenko <oandr@itec.cn.ua>
Tue Apr 25 03:52:43 PDT 2000 Manish Singh <yosh@gimp.org>
* plug-ins/common/png.c: fix Nick's embarassing bug found by tigert

View File

@ -408,7 +408,7 @@ nav_window_update_preview (NavWinData *iwd)
TempBuf * preview_buf_ptr;
TempBuf * preview_buf_notdot = NULL;
guchar *src, *buf, *dest;
gint x,y,has_alpha;
gint x, y;
gint pwidth, pheight;
GimpImage *gimage;
gdouble r, g, b, a, chk;
@ -457,7 +457,7 @@ nav_window_update_preview (NavWinData *iwd)
/* reset & get new preview */
if (!gdisp->dot_for_dot)
{
int loop1,loop2;
gint loop1,loop2;
gdouble x_ratio,y_ratio;
guchar *src_data;
guchar *dest_data;
@ -474,7 +474,7 @@ nav_window_update_preview (NavWinData *iwd)
for (loop1 = 0 ; loop1 < iwd->pheight ; loop1++)
for (loop2 = 0 ; loop2 < iwd->pwidth ; loop2++)
{
int i;
gint i;
guchar *src_pixel = src_data +
((gint)(loop2 * x_ratio)) * preview_buf->bytes +
((gint)(loop1 * y_ratio)) * pwidth*preview_buf->bytes;
@ -496,16 +496,15 @@ nav_window_update_preview (NavWinData *iwd)
preview_buf_ptr = preview_buf;
}
buf = g_new (gchar, iwd->nav_preview_width * 3);
has_alpha = (preview_buf_ptr->bytes == 2 || preview_buf_ptr->bytes == 4);
buf = g_new (gchar, preview_buf_ptr->width * 3);
for (y = 0; y <pheight ; y++)
for (y = 0; y < preview_buf_ptr->height ; y++)
{
dest = buf;
switch (preview_buf_ptr->bytes)
{
case 4:
for (x = 0; x < pwidth; x++)
for (x = 0; x < preview_buf_ptr->width; x++)
{
r = ((gdouble)(*(src++))) / 255.0;
g = ((gdouble)(*(src++))) / 255.0;
@ -518,7 +517,7 @@ nav_window_update_preview (NavWinData *iwd)
}
break;
case 2:
for (x = 0; x < pwidth; x++)
for (x = 0; x < preview_buf_ptr->width; x++)
{
r = ((gdouble)(*(src++))) / 255.0;
a = ((gdouble)(*(src++))) / 255.0;

View File

@ -408,7 +408,7 @@ nav_window_update_preview (NavWinData *iwd)
TempBuf * preview_buf_ptr;
TempBuf * preview_buf_notdot = NULL;
guchar *src, *buf, *dest;
gint x,y,has_alpha;
gint x, y;
gint pwidth, pheight;
GimpImage *gimage;
gdouble r, g, b, a, chk;
@ -457,7 +457,7 @@ nav_window_update_preview (NavWinData *iwd)
/* reset & get new preview */
if (!gdisp->dot_for_dot)
{
int loop1,loop2;
gint loop1,loop2;
gdouble x_ratio,y_ratio;
guchar *src_data;
guchar *dest_data;
@ -474,7 +474,7 @@ nav_window_update_preview (NavWinData *iwd)
for (loop1 = 0 ; loop1 < iwd->pheight ; loop1++)
for (loop2 = 0 ; loop2 < iwd->pwidth ; loop2++)
{
int i;
gint i;
guchar *src_pixel = src_data +
((gint)(loop2 * x_ratio)) * preview_buf->bytes +
((gint)(loop1 * y_ratio)) * pwidth*preview_buf->bytes;
@ -496,16 +496,15 @@ nav_window_update_preview (NavWinData *iwd)
preview_buf_ptr = preview_buf;
}
buf = g_new (gchar, iwd->nav_preview_width * 3);
has_alpha = (preview_buf_ptr->bytes == 2 || preview_buf_ptr->bytes == 4);
buf = g_new (gchar, preview_buf_ptr->width * 3);
for (y = 0; y <pheight ; y++)
for (y = 0; y < preview_buf_ptr->height ; y++)
{
dest = buf;
switch (preview_buf_ptr->bytes)
{
case 4:
for (x = 0; x < pwidth; x++)
for (x = 0; x < preview_buf_ptr->width; x++)
{
r = ((gdouble)(*(src++))) / 255.0;
g = ((gdouble)(*(src++))) / 255.0;
@ -518,7 +517,7 @@ nav_window_update_preview (NavWinData *iwd)
}
break;
case 2:
for (x = 0; x < pwidth; x++)
for (x = 0; x < preview_buf_ptr->width; x++)
{
r = ((gdouble)(*(src++))) / 255.0;
a = ((gdouble)(*(src++))) / 255.0;

View File

@ -408,7 +408,7 @@ nav_window_update_preview (NavWinData *iwd)
TempBuf * preview_buf_ptr;
TempBuf * preview_buf_notdot = NULL;
guchar *src, *buf, *dest;
gint x,y,has_alpha;
gint x, y;
gint pwidth, pheight;
GimpImage *gimage;
gdouble r, g, b, a, chk;
@ -457,7 +457,7 @@ nav_window_update_preview (NavWinData *iwd)
/* reset & get new preview */
if (!gdisp->dot_for_dot)
{
int loop1,loop2;
gint loop1,loop2;
gdouble x_ratio,y_ratio;
guchar *src_data;
guchar *dest_data;
@ -474,7 +474,7 @@ nav_window_update_preview (NavWinData *iwd)
for (loop1 = 0 ; loop1 < iwd->pheight ; loop1++)
for (loop2 = 0 ; loop2 < iwd->pwidth ; loop2++)
{
int i;
gint i;
guchar *src_pixel = src_data +
((gint)(loop2 * x_ratio)) * preview_buf->bytes +
((gint)(loop1 * y_ratio)) * pwidth*preview_buf->bytes;
@ -496,16 +496,15 @@ nav_window_update_preview (NavWinData *iwd)
preview_buf_ptr = preview_buf;
}
buf = g_new (gchar, iwd->nav_preview_width * 3);
has_alpha = (preview_buf_ptr->bytes == 2 || preview_buf_ptr->bytes == 4);
buf = g_new (gchar, preview_buf_ptr->width * 3);
for (y = 0; y <pheight ; y++)
for (y = 0; y < preview_buf_ptr->height ; y++)
{
dest = buf;
switch (preview_buf_ptr->bytes)
{
case 4:
for (x = 0; x < pwidth; x++)
for (x = 0; x < preview_buf_ptr->width; x++)
{
r = ((gdouble)(*(src++))) / 255.0;
g = ((gdouble)(*(src++))) / 255.0;
@ -518,7 +517,7 @@ nav_window_update_preview (NavWinData *iwd)
}
break;
case 2:
for (x = 0; x < pwidth; x++)
for (x = 0; x < preview_buf_ptr->width; x++)
{
r = ((gdouble)(*(src++))) / 255.0;
a = ((gdouble)(*(src++))) / 255.0;

View File

@ -1,3 +1,7 @@
2000-04-25 Sven Neumann <sven@gimp.org>
* de.po: updates from Felix Natter <fnatter@gmx.net>
2000-04-23 Tor Lillqvist <tml@iki.fi>
* fi.po: Fix fuzzy translations.

View File

@ -7,10 +7,10 @@
#
msgid ""
msgstr ""
"Project-Id-Version: GIMP 1.1.19\n"
"Project-Id-Version: GIMP 1.1.20\n"
"POT-Creation-Date: 2000-04-21 11:39-0700\n"
"PO-Revision-Date: 2000-04-19 15:01+02:00\n"
"Last-Translator: Sven Neumann <sven@gimp.org>\n"
"PO-Revision-Date: 2000-04-25 11:44+02:00\n"
"Last-Translator: Felix Natter <fnatter@gmx.net>\n"
"Language-Team: German <de@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=iso-8859-1\n"
@ -5032,6 +5032,8 @@ msgid ""
"%s\n"
"PNG unknown color model"
msgstr ""
"%s\n"
"PNG unbekanntes Farbmodell"
#: plug-ins/common/png.c:1029
msgid "Save as PNG"
@ -6111,13 +6113,12 @@ msgid "Pack Bits"
msgstr "Bits packen"
#: plug-ins/common/tiff.c:1493
#, fuzzy
msgid "Deflate"
msgstr "Löschen"
msgstr "Entpacken"
#: plug-ins/common/tiff.c:1494
msgid "JPEG"
msgstr ""
msgstr "JPEG"
#: plug-ins/common/tile.c:121
msgid "<Image>/Filters/Map/Tile..."
@ -7167,13 +7168,15 @@ msgstr "Gamma:"
msgid "Sample Density:"
msgstr "Stichprobendichte:"
# TODO !
#: plug-ins/flame/flame.c:1069
msgid "Spatial Oversample:"
msgstr ""
msgstr "Räumliche Hochrechnung:"
# TODO !
#: plug-ins/flame/flame.c:1079
msgid "Spatial Filter Radius:"
msgstr ""
msgstr "Räumlicher Filterradius:"
#: plug-ins/flame/flame.c:1105
msgid "Colormap:"
@ -10103,19 +10106,21 @@ msgstr "F
#: plug-ins/gfig/gfig.c:3212
msgid "Fill Opacity:"
msgstr "Füllung Deckkraft:"
msgstr "Füll-Deckkraft:"
# muss im Kontext zu "Fill after" gesehen werden!
#: plug-ins/gfig/gfig.c:3220
msgid "Each Selection"
msgstr "Jede Auswahl"
msgstr "Jeder Auswahl"
# muss im Kontext zu "Fill after" gesehen werden!
#: plug-ins/gfig/gfig.c:3221
msgid "All Selections"
msgstr "Alle Selektionen"
msgstr "Allen Selektionen"
#: plug-ins/gfig/gfig.c:3225
msgid "Fill after:"
msgstr ""
msgstr "Füllen nach:"
#: plug-ins/gfig/gfig.c:3232
msgid "Segment"
@ -10127,7 +10132,7 @@ msgstr "Sektor"
#: plug-ins/gfig/gfig.c:3237
msgid "Arc as:"
msgstr ""
msgstr "Bogen als:"
#. Put buttons in
#: plug-ins/gfig/gfig.c:3291
@ -10312,7 +10317,7 @@ msgstr "
#: plug-ins/gfig/gfig.c:4898
msgid "Gfig - GIMP plug-in"
msgstr "Gfig - GIMP Plugin"
msgstr "Gfig - GIMP Plug-in"
#: plug-ins/gfig/gfig.c:4903
msgid "Release 1.3"
@ -10320,7 +10325,7 @@ msgstr "Version 1.3"
#: plug-ins/gfig/gfig.c:4913
msgid "Email alt@picnic.demon.co.uk"
msgstr "Email alt@picnic.demon.co.uk"
msgstr "E-mail alt@picnic.demon.co.uk"
#: plug-ins/gfig/gfig.c:4923
msgid "Isometric grid By Rob Saunders"
@ -10332,11 +10337,12 @@ msgstr "Neues Gfig Objekt"
#: plug-ins/gfig/gfig.c:5082
msgid "Delete Gfig Drawing"
msgstr "Gfig Zeichnung löschen"
msgstr "Gfig-Zeichnung löschen"
# Kontext: "Filename: <NONE>"
#: plug-ins/gfig/gfig.c:5110 plug-ins/gfig/gfig.c:5150
msgid "<NONE>"
msgstr "<KEINE>"
msgstr "<Unbenannt>"
#: plug-ins/gfig/gfig.c:5188
msgid "Editing read-only object - you will not be able to save it"
@ -10593,7 +10599,7 @@ msgstr "Strahlen"
#: plug-ins/gflare/gflare.c:4002
msgid "Size Factor Gradient:"
msgstr ""
msgstr "Grössenfaktor für Gradient:"
#: plug-ins/gflare/gflare.c:4006
msgid "Probability Gradient:"
@ -10818,7 +10824,7 @@ msgstr "Abweichungs-Schwellwert:"
#: plug-ins/gimpressionist/general.c:347
msgid "A bailout-value for adaptive selections"
msgstr ""
msgstr "Ausstiegswert für anpassende Selektionen"
#: plug-ins/gimpressionist/gimp.c:105
msgid "<Image>/Filters/Artistic/GIMPressionist..."
@ -11165,7 +11171,7 @@ msgstr "Liest das Verzeichnis mit Voreinstellungen neu ein"
#: plug-ins/gimpressionist/presets.c:664
msgid "(Desc)"
msgstr ""
msgstr "(Beschr.)"
#: plug-ins/gimpressionist/presets.c:669
msgid ""
@ -13010,6 +13016,3 @@ msgstr "Fehler: Kann XJT Eigenschaften-Datei %s nicht lesen"
#, c-format
msgid "Error, XJT propertyfile %s is empty"
msgstr "Fehler: XJT Eigenschaften-Datei %s ist leer"
#~ msgid "Error opening '%.100s' could not save"
#~ msgstr "Fehler beim öffnen von '%.100s' konnte nicht gespeichert werden"