pkgsrc/audio/xmms/patches/patch-aq
wiz f2ca076292 Update to 1.2.11:
xmms 1.2.11

	The '1211 days since last release' release.  XMMS was 10 years
	old on 2007-11-15.

	* Make the --toggle switches take an optional value to either
	enable or disable the function.

	* New command line switches: --quit, --toggle-shuffle,
	--toggle-repeat, --toggle-advance, --queue

	* New remote commands: xmms_remote_playqueue_clear,
	xmms_remote_get_playqueue_pos_from_playlist_pos,
	xmms_remote_get_playlist_pos_from_playqueue_pos,
	xmms_remote_playqueue_add, xmms_remote_get_playqueue_length,
	xmms_remote_playqueue_remove.

	* Playqueue manager. Adds queue control enabling you to reorder
	the queue and a search like the jump to file dialog.

	OGG/Vorbis:
	* Save stream to disk adds -N if the file already exist
	* Don't apply the +6dB boost if replaygain information is missing

	Alsa:
	* Soft volume works without mixer

	Songchange:
	* Optional command to run at end of song.

	Diskwriter:
	* Effect plugins are applied on the saved file

	MPG123:
	* Enable shoutcast title streaming by default

	* CTRL-Q as default keybind to quit
	* Close dialogs with escape key

	Solaris:
	* Support OSS and AMD8111
2007-11-29 18:36:34 +00:00

40 lines
1,008 B
Text

$NetBSD: patch-aq,v 1.4 2007/11/29 18:36:40 wiz Exp $
--- xmms/bmp.c.orig 2006-07-16 13:40:04.000000000 +0000
+++ xmms/bmp.c
@@ -19,6 +19,12 @@
*/
#include "xmms.h"
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
struct rgb_quad
{
guchar rgbBlue;
@@ -183,7 +189,7 @@ GdkPixmap *read_bmp(gchar * filename)
}
else if (bitcount != 24 && bitcount != 16 && bitcount != 32)
{
- gint ncols, i;
+ guint32 ncols, i;
ncols = offset - headSize - 14;
if (headSize == 12)
@@ -203,6 +209,13 @@ GdkPixmap *read_bmp(gchar * filename)
fseek(file, offset, SEEK_SET);
buffer = g_malloc(imgsize);
fread(buffer, imgsize, 1, file);
+ /* verify buffer size */
+ if (!h || !w ||
+ w > (((UINT32_MAX - 3) / 3) / h) ||
+ h > (((UINT32_MAX - 3) / 3) / w)) {
+ g_warning("read_bmp(): width(%u)*height(%u) too large", w, h);
+ goto failure;
+ }
data = g_malloc0((w * 3 * h) + 3); /* +3 is just for safety */
if (bitcount == 1)