X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=deanimate.c;h=2ad811ccc3cae399d0d2e5eacef1a046df8d1457;hp=59ed56e96c25bf64b84c6ea24663248f8392e3f8;hb=ea5872766ee4bb5234afccb18b783ce5da4a582b;hpb=d3b49edb39bfc457d4c9047b01e1dbcdd3cf209e diff --git a/deanimate.c b/deanimate.c index 59ed56e9..2ad811cc 100644 --- a/deanimate.c +++ b/deanimate.c @@ -1,16 +1,18 @@ -const char deanimate_rcs[] = "$Id: deanimate.c,v 1.11 2002/03/26 22:29:54 swa Exp $"; +const char deanimate_rcs[] = "$Id: deanimate.c,v 1.18 2008/03/28 15:13:38 fabiankeil Exp $"; /********************************************************************* * * File : $Source: /cvsroot/ijbswa/current/deanimate.c,v $ * - * Purpose : Declares functions to deanimate GIF images on the fly. + * Purpose : Declares functions to manipulate binary images on the + * fly. High-level functions include: + * - Deanimation of GIF images * * Functions declared include: gif_deanimate, buf_free, - * buf_copy, buf_getbyte, gif_skip_data_block, and - * gif_extract_image + * buf_copy, buf_getbyte, gif_skip_data_block + * and gif_extract_image * - * Copyright : Written by and Copyright (C) 2001 by the the SourceForge - * Privoxy team. http://www.privoxy.org/ + * Copyright : Written by and Copyright (C) 2001 - 2004, 2006 by the + * SourceForge Privoxy team. http://www.privoxy.org/ * * Based on the GIF file format specification (see * http://tronche.com/computer-graphics/gif/gif89a.html) @@ -37,6 +39,35 @@ const char deanimate_rcs[] = "$Id: deanimate.c,v 1.11 2002/03/26 22:29:54 swa Ex * * Revisions : * $Log: deanimate.c,v $ + * Revision 1.18 2008/03/28 15:13:38 fabiankeil + * Remove inspect-jpegs action. + * + * Revision 1.17 2007/08/05 13:42:22 fabiankeil + * #1763173 from Stefan Huehner: declare some more functions static. + * + * Revision 1.16 2007/07/14 08:01:58 fabiankeil + * s@failiure@failure@ + * + * Revision 1.15 2007/01/03 14:39:19 fabiankeil + * Fix a gcc43 warning and mark the binbuffer + * as immutable for buf_getbyte(). + * + * Revision 1.14 2006/07/18 14:48:45 david__schmidt + * Reorganizing the repository: swapping out what was HEAD (the old 3.1 branch) + * with what was really the latest development (the v_3_0_branch branch) + * + * Revision 1.12.2.1 2004/10/03 12:53:32 david__schmidt + * Add the ability to check jpeg images for invalid + * lengths of comment blocks. Defensive strategy + * against the exploit: + * Microsoft Security Bulletin MS04-028 + * Buffer Overrun in JPEG Processing (GDI+) Could + * Allow Code Execution (833987) + * Enabled with +inspect-jpegs in actions files. + * + * Revision 1.12 2002/05/12 21:36:29 jongfoster + * Correcting function comments + * * Revision 1.11 2002/03/26 22:29:54 swa * we have a new homepage! * @@ -80,6 +111,7 @@ const char deanimate_rcs[] = "$Id: deanimate.c,v 1.11 2002/03/26 22:29:54 swa Ex #include #include +#include "errlog.h" #include "project.h" #include "deanimate.h" #include "miscutil.h" @@ -126,10 +158,10 @@ void buf_free(struct binbuffer *buf) * 2 : length = Desired minimum size * * - * Returns : 0 on success, 1 on failiure. + * Returns : 0 on success, 1 on failure. * *********************************************************************/ -int buf_extend(struct binbuffer *buf, size_t length) +static int buf_extend(struct binbuffer *buf, size_t length) { char *newbuf; @@ -167,10 +199,10 @@ int buf_extend(struct binbuffer *buf, size_t length) * 2 : dst = Pointer to the destination binbuffer * 3 : length = Number of bytes to be copied * - * Returns : 0 on success, 1 on failiure. + * Returns : 0 on success, 1 on failure. * *********************************************************************/ -int buf_copy(struct binbuffer *src, struct binbuffer *dst, size_t length) +static int buf_copy(struct binbuffer *src, struct binbuffer *dst, size_t length) { /* @@ -213,10 +245,10 @@ int buf_copy(struct binbuffer *src, struct binbuffer *dst, size_t length) * 1 : src = Pointer to the source binbuffer * 2 : offset = Offset to the desired byte * - * Returns : The byte on success, or 0 on failiure + * Returns : The byte on success, or 0 on failure * *********************************************************************/ -unsigned char buf_getbyte(struct binbuffer *src, size_t offset) +static unsigned char buf_getbyte(const struct binbuffer *src, size_t offset) { if (src->offset + offset < src->size) { @@ -242,10 +274,10 @@ unsigned char buf_getbyte(struct binbuffer *src, size_t offset) * Parameters : * 1 : buf = Pointer to the binbuffer * - * Returns : 0 on success, or 1 on failiure + * Returns : 0 on success, or 1 on failure * *********************************************************************/ -int gif_skip_data_block(struct binbuffer *buf) +static int gif_skip_data_block(struct binbuffer *buf) { unsigned char c; @@ -256,7 +288,8 @@ int gif_skip_data_block(struct binbuffer *buf) */ while((c = buf_getbyte(buf, 0)) != '\0') { - if ((buf->offset += c + 1) >= buf->size - 1) + buf->offset += (size_t)c + 1; + if (buf->offset >= buf->size - 1) { return 1; } @@ -281,13 +314,13 @@ int gif_skip_data_block(struct binbuffer *buf) * 1 : src = Pointer to the source binbuffer * 2 : dst = Pointer to the destination binbuffer * - * Returns : 0 on success, or 1 on failiure + * Returns : 0 on success, or 1 on failure * *********************************************************************/ -int gif_extract_image(struct binbuffer *src, struct binbuffer *dst) +static int gif_extract_image(struct binbuffer *src, struct binbuffer *dst) { unsigned char c; - + /* * Remember the colormap flag and copy the image head */ @@ -302,7 +335,14 @@ int gif_extract_image(struct binbuffer *src, struct binbuffer *dst) */ if (c & 0x80) { - if (buf_copy(src, dst, (size_t) 3 * (1 << ((c & 0x07) + 1)))) + int map_length = 3 * (1 << ((c & 0x07) + 1)); + if (map_length <= 0) + { + log_error(LOG_LEVEL_DEANIMATE, + "colormap length = %d (%c)?", map_length, c); + return 1; + } + if (buf_copy(src, dst, (size_t)map_length)) { return 1; } @@ -346,7 +386,7 @@ int gif_extract_image(struct binbuffer *src, struct binbuffer *dst) * 3 : get_first_image = Flag: If set, get the first image * If unset (default), get the last * - * Returns : 0 on success, or 1 on failiure + * Returns : 0 on success, or 1 on failure * *********************************************************************/ int gif_deanimate(struct binbuffer *src, struct binbuffer *dst, int get_first_image) @@ -381,7 +421,14 @@ int gif_deanimate(struct binbuffer *src, struct binbuffer *dst, int get_first_im */ if(c & 0x80) { - if (buf_copy(src, dst, (size_t) 3 * (1 << ((c & 0x07) + 1)))) + int map_length = 3 * (1 << ((c & 0x07) + 1)); + if (map_length <= 0) + { + log_error(LOG_LEVEL_DEANIMATE, + "colormap length = %d (%c)?", map_length, c); + return 1; + } + if (buf_copy(src, dst, (size_t)map_length)) { return 1; }