python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-12-28 02:46:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fixed literal expansion, allowed run length > line length

Browse Source
This commit is contained in:
wiredfool 2016-11-19 17:39:30 -08:00
parent 17d38d0905
commit 5df2851f85
1 changed files with 70 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
libImaging/SunRleDecode.c
View File

@ -24,6 +24,9 @@ ImagingSunRleDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
{
int n;
UINT8* ptr;
UINT8 extra_data = 0;
UINT8 extra_bytes = 0;
int ct_bytes = 0;
ptr = buf;
@ -39,10 +42,12 @@ ImagingSunRleDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
n = ptr[1];
if (n == 0) {
/* Literal 0x80 (2 bytes) */
n = 1;
ct_bytes += n;
state->buffer[state->x] = 0x80;
@ -55,10 +60,13 @@ ImagingSunRleDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
if (bytes < 3)
break;
ct_bytes += n;
if (state->x + n > state->bytes) {
/* FIXME: is this correct? */
state->errcode = IMAGING_CODEC_OVERRUN;
return -1;
extra_bytes = n; /* full value */
n = state->bytes - state->x;
extra_bytes -= n;
extra_data = ptr[2];
}
memset(state->buffer + state->x, ptr[2], n);
@ -70,25 +78,18 @@ ImagingSunRleDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
} else {
/* Literal (1+n bytes block) */
n = ptr[0];
/* Literal byte */
n = 1;
ct_bytes += n;
if (bytes < 1 + n)
break;
state->buffer[state->x] = ptr[0];
if (state->x + n > state->bytes) {
/* FIXME: is this correct? */
state->errcode = IMAGING_CODEC_OVERRUN;
return -1;
}
memcpy(state->buffer + state->x, ptr + 1, n);
ptr += 1 + n;
bytes -= 1 + n;
ptr += 1;
bytes -= 1;
}
for (;;) {
state->x += n;
if (state->x >= state->bytes) {
@ -102,10 +103,27 @@ ImagingSunRleDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
if (++state->y >= state->ysize) {
/* End of file (errcode = 0) */
printf("%d", ct_bytes);
return -1;
}
}
if (extra_bytes == 0) {
break;
}
if (state->x > 0) {
break; // assert
}
if (extra_bytes >= state->bytes) {
n = state->bytes;
} else {
n = extra_bytes;
}
memset(state->buffer + state->x, extra_data, n);
extra_bytes -= n;
}
}
return ptr - buf;