update to trunk

(bzr r13682.1.26)

1 files changed, 24 insertions, 9 deletions

diff --git a/src/trace/potrace/bitmap.h b/src/trace/potrace/bitmap.h
index 2df04b46f..086bbb046 100644
--- a/src/trace/potrace/bitmap.h
+++ b/src/trace/potrace/bitmap.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 2001-2011 Peter Selinger.
+/* Copyright (C) 2001-2015 Peter Selinger.
    This file is part of Potrace. It is free software and it is covered
    by the GNU General Public License. See the file COPYING for details. */
 
@@ -7,6 +7,7 @@
 
 #include <string.h>
 #include <stdlib.h>
+#include <errno.h>
 
 /* The bitmap type is defined in potracelib.h */
 #include "potracelib.h"
@@ -27,7 +28,7 @@
 /* macros for accessing pixel at index (x,y). U* macros omit the
    bounds check. */
 
-#define bm_scanline(bm, y) ((bm)->map + (y)*(bm)->dy)
+#define bm_scanline(bm, y) ((bm)->map + (ssize_t)(y)*(ssize_t)(bm)->dy)
 #define bm_index(bm, x, y) (&bm_scanline(bm, y)[(x)/BM_WORDBITS])
 #define bm_mask(x) (BM_HIBIT >> ((x) & (BM_WORDBITS-1)))
 #define bm_range(x, a) ((int)(x) >= 0 && (int)(x) < (a))
@@ -51,10 +52,18 @@ static inline void bm_free(potrace_bitmap_t *bm) {
   free(bm);
 }
 
-/* return new un-initialized bitmap. NULL with errno on error */
+/* return new un-initialized bitmap. NULL with errno on error.
+   Assumes w, h >= 0. */
 static inline potrace_bitmap_t *bm_new(int w, int h) {
   potrace_bitmap_t *bm;
-  int dy = (w + BM_WORDBITS - 1) / BM_WORDBITS;
+  int dy = w == 0 ? 0 : (w - 1) / BM_WORDBITS + 1;
+  ssize_t size = (ssize_t)dy * (ssize_t)h * (ssize_t)BM_WORDSIZE;
+
+  /* check for overflow error */
+  if (size < 0 || size / h / dy != BM_WORDSIZE) {
+    errno = ENOMEM;
+    return NULL;
+  }
 
   bm = (potrace_bitmap_t *) malloc(sizeof(potrace_bitmap_t));
   if (!bm) {
@@ -63,7 +72,7 @@ static inline potrace_bitmap_t *bm_new(int w, int h) {
   bm->w = w;
   bm->h = h;
   bm->dy = dy;
-  bm->map = (potrace_word *) malloc(dy * h * BM_WORDSIZE);
+  bm->map = (potrace_word *) malloc(size);
   if (!bm->map) {
     free(bm);
     return NULL;
@@ -73,23 +82,29 @@ static inline potrace_bitmap_t *bm_new(int w, int h) {
 
 /* clear the given bitmap. Set all bits to c. */
 static inline void bm_clear(potrace_bitmap_t *bm, int c) {
-  memset(bm->map, c ? -1 : 0, bm->dy * bm->h * BM_WORDSIZE);
+  /* Note: if the bitmap was created with bm_new, then it is
+     guaranteed that size will fit into the ssize_t type. */
+  ssize_t size = (ssize_t)bm->dy * (ssize_t)bm->h * (ssize_t)BM_WORDSIZE;
+  memset(bm->map, c ? -1 : 0, size);
 }
 
 /* duplicate the given bitmap. Return NULL on error with errno set. */
 static inline potrace_bitmap_t *bm_dup(const potrace_bitmap_t *bm) {
   potrace_bitmap_t *bm1 = bm_new(bm->w, bm->h);
+  ssize_t size = (ssize_t)bm->dy * (ssize_t)bm->h * (ssize_t)BM_WORDSIZE;
   if (!bm1) {
     return NULL;
   }
-  memcpy(bm1->map, bm->map, bm->dy * bm->h * BM_WORDSIZE);
+  memcpy(bm1->map, bm->map, size);
   return bm1;
 }
 
 /* invert the given bitmap. */
 static inline void bm_invert(potrace_bitmap_t *bm) {
-  int i;
-  for (i = 0; i < bm->dy * bm->h; i++) {
+  ssize_t i;
+  ssize_t size = (ssize_t)bm->dy * (ssize_t)bm->h;
+
+  for (i = 0; i < size; i++) {
     bm->map[i] ^= BM_ALLBITS;
   }
 }