From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.1 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 25473 invoked from network); 10 Jul 2021 21:28:17 -0000 Received: from tb-ob0.topicbox.com (64.147.108.117) by inbox.vuxu.org with ESMTPUTF8; 10 Jul 2021 21:28:17 -0000 Received: from tb-mx0.topicbox.com (tb-mx0.nyi.icgroup.com [10.90.30.73]) by tb-ob0.topicbox.com (Postfix) with ESMTP id 790352A6E6 for ; Sat, 10 Jul 2021 17:28:14 -0400 (EDT) (envelope-from bounce.mMdb82973047397d68fdedb7c3.r522be890-2105-11eb-b15e-8d699134e1fa@9fans.bounce.topicbox.com) Received: by tb-mx0.topicbox.com (Postfix, from userid 1132) id 753092C6C908; Sat, 10 Jul 2021 17:28:14 -0400 (EDT) ARC-Authentication-Results: i=2; topicbox.com; arc=pass; dkim=none (no signatures found); dmarc=pass policy.published-domain-policy=quarantine policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=quarantine,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=sdf.org; spf=pass smtp.mailfrom=adr@sdf.org smtp.helo=mx.sdf.org; x-internal-arc=fail (as.1.topicbox.com=pass, ams.1.topicbox.com=fail (message has been altered)) (Message modified while forwarding at Topicbox) ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d= topicbox.com; h=date:to:message-id:mime-version:content-type :from:list-help:list-id:list-post:list-subscribe:reply-to :subject:content-transfer-encoding:list-unsubscribe; s=sysmsg-1; t=1625952494; bh=oWy05+UGjfU8KcJ9XK1j4v1uq6Hpv199lp4DEjt2hHM=; b= hVoM8T7y9xl+BjBfD9/4T0aR/Qz8eb+QwZ863ZSRVQBjUXXsp6+/6pvWkwvvq04j 087U2JGQXzyzJSWeiOd6PLSBRSpMnlUfxnDsPk5qW7kJSx5++b1SjnY6T3tdQ3aB wpMuWuY+o0DT8SydhKGfBym9KTKfCIQek6CLkk+/i+I= ARC-Seal: i=2; a=rsa-sha256; cv=pass; d=topicbox.com; s=sysmsg-1; t= 1625952494; b=HgycpmNiM3/GR5F8rCzjBr4D40FpKr4ZPuRTrIASlCIXK7QlXB fwMNFcUdIbf5jtO08n86ZHo+AuThpmi6qL8WEAWTGpFBdBlMQ7vPqM6IHB2FwgRx AomLMwnjnJG0XjbNrhFLeZItDGlwbxhYB+8/NipyjGqGjXptdsqwquCEA= Authentication-Results: topicbox.com; arc=pass; dkim=none (no signatures found); dmarc=pass policy.published-domain-policy=quarantine policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=quarantine,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=sdf.org; spf=pass smtp.mailfrom=adr@sdf.org smtp.helo=mx.sdf.org; x-internal-arc=fail (as.1.topicbox.com=pass, ams.1.topicbox.com=fail (message has been altered)) (Message modified while forwarding at Topicbox) X-Received-Authentication-Results: tb-mx0.topicbox.com; arc=none (no signatures found); bimi=none (No BIMI records found); dkim=none (no signatures found); dmarc=pass policy.published-domain-policy=quarantine policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=quarantine,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=sdf.org; iprev=pass smtp.remote-ip=205.166.94.24 (mx.sdf.org); spf=pass smtp.mailfrom=adr@sdf.org smtp.helo=mx.sdf.org; x-aligned-from=pass (Address match); x-me-sender=none; x-ptr=pass smtp.helo=mx.sdf.org policy.ptr=mx.sdf.org; x-return-mx=pass header.domain=sdf.org policy.is_org=yes (MX Records found: mx.sdf.org); x-return-mx=pass smtp.domain=sdf.org policy.is_org=yes (MX Records found: mx.sdf.org); x-tls=pass smtp.version=TLSv1.2 smtp.cipher=ECDHE-RSA-AES256-GCM-SHA384 smtp.bits=256/256; x-vs=clean score=0 state=0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=9fans.net; h=date:to :message-id:mime-version:content-type:from:list-help:list-id :list-post:list-subscribe:reply-to:subject :content-transfer-encoding:list-unsubscribe; s=dkim-1; bh=ItExF+ YYUuu2rF6LyrEuI9/0+843duZzbAoBUzez0bU=; b=g1jZ8Ta2K2TnatHHsHEVEi 0V4IkOOLW62YMAlXNcfJeVUl8SxOlITZZZZAPfV0rAMP/YqzbSpnIF/DTMei6sJZ k0p5URm9y6CktJo2M7wPBBlc21z9KBzULHjIP2Iy35FxYS0Km3AJ82OWqZwOpBqn mBZ3fzKIKJsbSbEaomcZE= Received: from tb-mx0.topicbox.com (localhost.local [127.0.0.1]) by tb-mx0.topicbox.com (Postfix) with ESMTP id 1FEE02C6C503 for <9fans@9fans.net>; Sat, 10 Jul 2021 17:28:03 -0400 (EDT) (envelope-from adr@sdf.org) Received: from tb-mx0.topicbox.com (localhost [127.0.0.1]) by tb-mx0.topicbox.com (Authentication Milter) with ESMTP id 36C164F5311; Sat, 10 Jul 2021 17:28:02 -0400 ARC-Seal: i=1; a=rsa-sha256; cv=none; d=topicbox.com; s=arcseal; t= 1625952482; b=JHf48VjZkqMfTh+4CZ1l5tEJtVHg5Bu/bHWwLbsG0kgx+UU2QH 1bm34j3a/ZT7Wo2eoEpkwyCEW58vzfkJspRC+oELEwfC1NsrNYI5EHW2AcqJe1V/ uaGTGoyYLVSyqi+z97lqb3iLTrOtjEUsx/3CMvUklGQ13vpR6tp9/iUprpb1amJD xF9Xh20cpmoSN40ArA8XcroP1zN8Nl5NeVDNvX6KCbij7R7KaOzwLqpU4Qd42jnV w1k8FInNOp27vlPrGm4vapSfD4jRfTyzpgnDgBzfTbannH2PG1fOBDyORuKN/0L+ M+oo1S8Tp0HBYSShUm7gb5r++eTgedl67Khw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= topicbox.com; h=date:from:to:subject:message-id:mime-version :content-type; s=arcseal; t=1625952482; bh=w4q9vodHiRI9AiiY61mZ1 qlV3LfLPjMj9IPqmXcwY3s=; b=wf4YtWYe3mrUoMCu9H4tOjMs6qqwSm1cHiJcI nc3KKP6QUkYfih1dac2xkJ1BbexQvU44Cqa5iXZlL/ItSfOMe0uMq+kxshka0EzP 0/dYi9kCrcL5gxpy4whfCTDKQ0uGgEgQ1PpfvoYFgG00ONcfQdVw+Pp5ekLCl+DM Knu17u1ozWkSHUy1GTQ9M1DzfGCoAZ45Rg7+LXd5xZTE8TmX6rLlsPyBL+4HLMkT SOBKP0scnGxsFdmXw73o00LLYIUbXz/6ZiPylq0phRKattD7zCs4+vANJ76S+Imz JXTyczQFMUqc2MBvL4bcVAYHR7SmkPLJyDYzTsZ0qpI6CRN8g== ARC-Authentication-Results: i=1; tb-mx0.topicbox.com; arc=none (no signatures found); bimi=none (No BIMI records found); dkim=none (no signatures found); dmarc=pass policy.published-domain-policy=quarantine policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=quarantine,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=sdf.org; iprev=pass smtp.remote-ip=205.166.94.24 (mx.sdf.org); spf=pass smtp.mailfrom=adr@sdf.org smtp.helo=mx.sdf.org; x-aligned-from=pass (Address match); x-me-sender=none; x-ptr=pass smtp.helo=mx.sdf.org policy.ptr=mx.sdf.org; x-return-mx=pass header.domain=sdf.org policy.is_org=yes (MX Records found: mx.sdf.org); x-return-mx=pass smtp.domain=sdf.org policy.is_org=yes (MX Records found: mx.sdf.org); x-tls=pass smtp.version=TLSv1.2 smtp.cipher=ECDHE-RSA-AES256-GCM-SHA384 smtp.bits=256/256; x-vs=clean score=0 state=0 X-ME-VSCause: gggruggvucftvghtrhhoucdtuddrgedvtddrtdekgddugeegucdltddurdegudelrddttd dmucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgf nhhsuhgsshgtrhhisggvpdfurfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttd enucenucfjughrpeffhffvuffkgggtugesthdtredttddtvdenucfhrhhomheprggurhes shgufhdrohhrghenucggtffrrghtthgvrhhnpeelveelhfekudeuheegheejgeeiieeuke dvteeuffegieevieetleehgedvhefggfenucfkphepvddthedrudeiiedrleegrddvgedp vddthedrudeiiedrleegrdduieenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmh epihhnvghtpedvtdehrdduieeirdelgedrvdegpdhhvghlohepmhigrdhsughfrdhorhhg pdhmrghilhhfrhhomhepoegrughrsehsughfrdhorhhgqe X-ME-VSScore: 0 X-ME-VSCategory: clean Received-SPF: pass (sdf.org: 205.166.94.24 is authorized to use 'adr@sdf.org' in 'mfrom' identity (mechanism 'ip4:205.166.94.0/24' matched)) receiver=tb-mx0.topicbox.com; identity=mailfrom; envelope-from="adr@sdf.org"; helo=mx.sdf.org; client-ip=205.166.94.24 Received: from mx.sdf.org (mx.sdf.org [205.166.94.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by tb-mx0.topicbox.com (Postfix) with ESMTPS for <9fans@9fans.net>; Sat, 10 Jul 2021 17:28:02 -0400 (EDT) (envelope-from adr@sdf.org) Received: from sdf.org (IDENT:adr@sdf.org [205.166.94.16]) by mx.sdf.org (8.15.2/8.14.5) with ESMTPS id 16ALS1te016147 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256 bits) verified NO) for <9fans@9fans.net>; Sat, 10 Jul 2021 21:28:01 GMT Received: (from adr@localhost) by sdf.org (8.15.2/8.12.8/Submit) id 16ALS11V029788 for 9fans@9fans.net; Sat, 10 Jul 2021 21:28:01 GMT Date: Sat, 10 Jul 2021 21:28:01 +0000 To: 9fans@9fans.net Message-ID: <20210710212801.dg62ekms73ev5ydm@sdf.org> Mail-Followup-To: 9fans@9fans.net MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Topicbox-Policy-Reasoning: allow: sender is a member Topicbox-Message-UUID: b8a412ba-e1c5-11eb-9916-ad77e8b1e4ab Archived-At: =?UTF-8?B?PGh0dHBzOi8vOWZhbnMudG9waWNib3guY29tL2dyb3Vwcy85?= =?UTF-8?B?ZmFucy9UNGE3MTRlZDE0YzUwNzY3YS1NZGI4Mjk3MzA0NzM5N2Q2OGZkZWRi?= =?UTF-8?B?N2MzPg==?= From: "adr via 9fans" <9fans@9fans.net> List-Help: List-Id: "9fans" <9fans.9fans.net> List-Post: List-Software: Topicbox v0 List-Subscribe: Precedence: list Reply-To: 9fans <9fans@9fans.net> Subject: [9fans] pngread: alloc chunk's length Content-Transfer-Encoding: quoted-printable List-Unsubscribe: , Topicbox-Delivery-ID: 2:9fans:437d30aa-c441-11e9-8a57-d036212d11b0:522be890-2105-11eb-b15e-8d699134e1fa:Mdb82973047397d68fdedb7c3:1:ic5isAI8_2weeC-cIbeCoRHPUGpGKt8YxtNSa2gYzyQ Hi, Png is using a fix size to allocate space for the chunks. I noticed it because it couldn't open some png files (the chunk size was bigger than IDATSIZE). This patch removes IDATSIZE and instead makes png to allocate the size of the chunk before reading it. --- sys/src/cmd/jpg/readpng.c Thu Jan 24 23:39:55 2013 +++ /sys/src/cmd/jpg/readpng.c Sat Jul 10 13:09:13 2021 @@ -10,8 +10,6 @@ =20 enum { - IDATSIZE =3D 1000000, - /* filtering algorithms */ FilterNone =3D 0, /* new[x][y] =3D buf[x][y] */ FilterSub =3D 1, /* new[x][y] =3D buf[x][y] + new[x-1][y] = */=20 @@ -51,7 +49,6 @@ struct ZlibR { Biobuf *io; /* input buffer */ - uchar *buf; /* malloc'ed staging buffer */ uchar *p; /* next byte to decompress */ uchar *e; /* end of buffer */ ZlibW *w; @@ -94,19 +91,26 @@ } =20 static int -getchunk(Biobuf *b, char *type, uchar *d, int m) +chunklen(Biobuf *b) { - uchar buf[8]; + uchar buf[4]; + + if(Bread(b, buf, 4) !=3D 4) + return -1; + return get4(buf); +} + +static int +getchunk(Biobuf *b, char *type, uchar *d, int n) +{ + uchar buf[4]; ulong crc =3D 0, crc2; - int n, nr; + int nr; =20 - if(Bread(b, buf, 8) !=3D 8) + if(Bread(b, buf, 4) !=3D 4) return -1; - n =3D get4(buf); - memmove(type, buf+4, 4); + memmove(type, buf, 4); type[4] =3D 0; - if(n > m) - sysfatal("getchunk needed %d, had %d", n, m); nr =3D Bread(b, d, n); if(nr !=3D n) sysfatal("getchunk read %d, expected %d", nr, n); @@ -117,7 +121,7 @@ crc2 =3D get4(buf); if(crc !=3D crc2) sysfatal("getchunk crc failed"); - return n; + return 0; } =20 static int @@ -129,25 +133,31 @@ =20 if(z->p >=3D z->e){ Again: - z->p =3D z->buf; + n =3D chunklen(z->io); + if(n < 0) + return -1; + z->p =3D pngmalloc(n, 0); z->e =3D z->p; - n =3D getchunk(z->io, type, z->p, IDATSIZE); - if(n < 0 || strcmp(type, "IEND") =3D=3D 0) + getchunk(z->io, type, z->p, n); + if(strcmp(type, "IEND") =3D=3D 0){ + free(z->p); return -1; + } z->e =3D z->p + n; if(!strcmp(type,"PLTE")){ if(n < 3 || n > 3*256 || n%3) sysfatal("invalid PLTE chunk len %d", n); memcpy(z->w->palette, z->p, n); z->w->palsize =3D 256; + free(z->p); goto Again; } - if(type[0] & PropertyBit) + if(type[0] & PropertyBit){ + free(z->p); goto Again; /* skip auxiliary chunks fornow */ - if(strcmp(type,"IDAT")){ - sysfatal("unrecognized mandatory chunk %s", type); - goto Again; } + if(strcmp(type,"IDAT")) + sysfatal("unrecognized mandatory chunk %s", type); } return *z->p++; } @@ -383,18 +393,23 @@ { char type[5]; int bpc, colorfmt, dx, dy, err, n, nchan, nout, useadam7; - uchar *buf, *h; + uchar *buf, *mag, *h; Rawimage *image; ZlibR zr; ZlibW zw; =20 - buf =3D pngmalloc(IDATSIZE, 0); - if(Bread(b, buf, sizeof PNGmagic) !=3D sizeof PNGmagic || - memcmp(PNGmagic, buf, sizeof PNGmagic) !=3D 0) + mag =3D pngmalloc(sizeof PNGmagic, 0); + if(Bread(b, mag, sizeof PNGmagic) !=3D sizeof PNGmagic || + memcmp(PNGmagic, mag, sizeof PNGmagic) !=3D 0) sysfatal("bad PNGmagic"); + free(mag); =20 - n =3D getchunk(b, type, buf, IDATSIZE); - if(n < 13 || strcmp(type,"IHDR") !=3D 0) + n =3D chunklen(b); + if(n < 0) + sysfatal("missing IHDR chunk"); + buf =3D pngmalloc(n, 0); + getchunk(b, type, buf, n); + if(strcmp(type,"IHDR") !=3D 0) sysfatal("missing IHDR chunk"); h =3D buf; dx =3D get4(h); @@ -460,7 +475,7 @@ memset(&zr, 0, sizeof zr); zr.w =3D &zw; zr.io =3D b; - zr.buf =3D buf; + free(buf); =20 memset(&zw, 0, sizeof zw); if(useadam7) @@ -483,7 +498,6 @@ if(err) sysfatal("inflatezlib %s\n", flateerr(err)); =20 - free(buf); free(zw.scan); free(zw.lastscan); return image; ------------------------------------------ 9fans: 9fans Permalink: https://9fans.topicbox.com/groups/9fans/T4a714ed14c50767a-Mdb829= 73047397d68fdedb7c3 Delivery options: https://9fans.topicbox.com/groups/9fans/subscription