[Swfdec-commits] Branch '0.6' - 2 commits - swfdec/swfdec_image.c test/image

[Benjamin Otte]

 swfdec/swfdec_image.c                       |    3 +
 test/image/Makefile.am                      |    9 +++++
 test/image/crash-0.6.4-huge-image-5.swf     |binary
 test/image/crash-0.6.4-huge-image-5.swf.png |binary
 test/image/crash-0.6.4-huge-image-6.swf     |binary
 test/image/crash-0.6.4-huge-image-6.swf.png |binary
 test/image/crash-0.6.4-huge-image-7.swf     |binary
 test/image/crash-0.6.4-huge-image-7.swf.png |binary
 test/image/crash-0.6.4-huge-image-8.swf     |binary
 test/image/crash-0.6.4-huge-image-8.swf.png |binary
 test/image/crash-0.6.4-huge-image.xml       |   45 ++++++++++++++++++++++++++++
 11 files changed, 57 insertions(+)

New commits:
commit eae9c9930fac714958c50a858ee3ae6bd25f95b7
Author: Benjamin Otte <otte at gnome.org>
Date:   Wed Apr 16 12:02:56 2008 +0200

    add test for latest fix

diff --git a/test/image/Makefile.am b/test/image/Makefile.am
index f33ab90..20d6be5 100644
--- a/test/image/Makefile.am
+++ b/test/image/Makefile.am
@@ -44,6 +44,15 @@ EXTRA_DIST = \
 	color-transform-add80.swf.png \
 	color-transform-add80-alpha.swf \
 	color-transform-add80-alpha.swf.png \
+	crash-0.6.4-huge-image-5.swf \
+	crash-0.6.4-huge-image-5.swf.png \
+	crash-0.6.4-huge-image-6.swf \
+	crash-0.6.4-huge-image-6.swf.png \
+	crash-0.6.4-huge-image-7.swf \
+	crash-0.6.4-huge-image-7.swf.png \
+	crash-0.6.4-huge-image-8.swf \
+	crash-0.6.4-huge-image-8.swf.png \
+	crash-0.6.4-huge-image.xml \
 	default.stas \
 	default.sts \
 	definebits-palette-5.swf \
diff --git a/test/image/crash-0.6.4-huge-image-5.swf b/test/image/crash-0.6.4-huge-image-5.swf
new file mode 100644
index 0000000..5100435
Binary files /dev/null and b/test/image/crash-0.6.4-huge-image-5.swf differ
diff --git a/test/image/crash-0.6.4-huge-image-5.swf.png b/test/image/crash-0.6.4-huge-image-5.swf.png
new file mode 100644
index 0000000..fca17d2
Binary files /dev/null and b/test/image/crash-0.6.4-huge-image-5.swf.png differ
diff --git a/test/image/crash-0.6.4-huge-image-6.swf b/test/image/crash-0.6.4-huge-image-6.swf
new file mode 100644
index 0000000..8d6f1f7
Binary files /dev/null and b/test/image/crash-0.6.4-huge-image-6.swf differ
diff --git a/test/image/crash-0.6.4-huge-image-6.swf.png b/test/image/crash-0.6.4-huge-image-6.swf.png
new file mode 100644
index 0000000..fca17d2
Binary files /dev/null and b/test/image/crash-0.6.4-huge-image-6.swf.png differ
diff --git a/test/image/crash-0.6.4-huge-image-7.swf b/test/image/crash-0.6.4-huge-image-7.swf
new file mode 100644
index 0000000..c2d0056
Binary files /dev/null and b/test/image/crash-0.6.4-huge-image-7.swf differ
diff --git a/test/image/crash-0.6.4-huge-image-7.swf.png b/test/image/crash-0.6.4-huge-image-7.swf.png
new file mode 100644
index 0000000..fca17d2
Binary files /dev/null and b/test/image/crash-0.6.4-huge-image-7.swf.png differ
diff --git a/test/image/crash-0.6.4-huge-image-8.swf b/test/image/crash-0.6.4-huge-image-8.swf
new file mode 100644
index 0000000..b92d00d
Binary files /dev/null and b/test/image/crash-0.6.4-huge-image-8.swf differ
diff --git a/test/image/crash-0.6.4-huge-image-8.swf.png b/test/image/crash-0.6.4-huge-image-8.swf.png
new file mode 100644
index 0000000..fca17d2
Binary files /dev/null and b/test/image/crash-0.6.4-huge-image-8.swf.png differ
diff --git a/test/image/crash-0.6.4-huge-image.xml b/test/image/crash-0.6.4-huge-image.xml
new file mode 100644
index 0000000..7d3300c
--- /dev/null
+++ b/test/image/crash-0.6.4-huge-image.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0"?>
+<swf version="7" compressed="1">
+  <Header framerate="31" frames="27">
+    <size>
+      <Rectangle left="0" right="4000" top="0" bottom="3000"/>
+    </size>
+    <tags>
+
+      <DefineBitsLossless objectID="1" format="5" width="62525" height="17173">
+        <data>
+	  <data>eNpjYGBgAAAABAABAA==</data>
+        </data>
+      </DefineBitsLossless>
+      <DefineShape objectID="2">
+        <bounds>
+          <Rectangle left="0" right="4000" top="0" bottom="3000"/>
+        </bounds>
+        <styles>
+          <StyleList>
+            <fillStyles>
+	      <ClippedBitmap objectID="1" />
+            </fillStyles>
+            <lineStyles/>
+          </StyleList>
+        </styles>
+        <shapes>
+          <Shape>
+            <edges>
+              <ShapeSetup fillStyle1="1"/>
+              <LineTo x="4000" y="0"/>
+              <LineTo x="0" y="3000"/>
+              <LineTo x="-4000" y="0"/>
+              <LineTo x="0" y="-3000"/>
+              <ShapeSetup/>
+            </edges>
+          </Shape>
+        </shapes>
+      </DefineShape>
+      <PlaceObject2 replace="0" depth="1" objectID="2" />
+
+      <ShowFrame/>
+      <End/>
+    </tags>
+  </Header>
+</swf>
commit 8e2db4e7340135fb07f42a6c1409988293d2f843
Author: Benjamin Otte <otte at gnome.org>
Date:   Wed Apr 16 12:01:52 2008 +0200

    don't parse oversized images

diff --git a/swfdec/swfdec_image.c b/swfdec/swfdec_image.c
index fc54511..beb132a 100644
--- a/swfdec/swfdec_image.c
+++ b/swfdec/swfdec_image.c
@@ -338,6 +338,9 @@ swfdec_image_lossless_load (SwfdecImage *image)
 
   if (image->width == 0 || image->height == 0)
     return;
+  if (G_MAXUINT / 4 / image->width < (guint) image->height)
+    return;
+
   swfdec_cached_load (SWFDEC_CACHED (image), 4 * image->width * image->height);
 
   if (format == 3) {