f2ca076292
xmms 1.2.11 The '1211 days since last release' release. XMMS was 10 years old on 2007-11-15. * Make the --toggle switches take an optional value to either enable or disable the function. * New command line switches: --quit, --toggle-shuffle, --toggle-repeat, --toggle-advance, --queue * New remote commands: xmms_remote_playqueue_clear, xmms_remote_get_playqueue_pos_from_playlist_pos, xmms_remote_get_playlist_pos_from_playqueue_pos, xmms_remote_playqueue_add, xmms_remote_get_playqueue_length, xmms_remote_playqueue_remove. * Playqueue manager. Adds queue control enabling you to reorder the queue and a search like the jump to file dialog. OGG/Vorbis: * Save stream to disk adds -N if the file already exist * Don't apply the +6dB boost if replaygain information is missing Alsa: * Soft volume works without mixer Songchange: * Optional command to run at end of song. Diskwriter: * Effect plugins are applied on the saved file MPG123: * Enable shoutcast title streaming by default * CTRL-Q as default keybind to quit * Close dialogs with escape key Solaris: * Support OSS and AMD8111
40 lines
1,008 B
Text
40 lines
1,008 B
Text
$NetBSD: patch-aq,v 1.4 2007/11/29 18:36:40 wiz Exp $
|
|
|
|
--- xmms/bmp.c.orig 2006-07-16 13:40:04.000000000 +0000
|
|
+++ xmms/bmp.c
|
|
@@ -19,6 +19,12 @@
|
|
*/
|
|
#include "xmms.h"
|
|
|
|
+#if HAVE_STDINT_H
|
|
+#include <stdint.h>
|
|
+#elif !defined(UINT32_MAX)
|
|
+#define UINT32_MAX 0xffffffffU
|
|
+#endif
|
|
+
|
|
struct rgb_quad
|
|
{
|
|
guchar rgbBlue;
|
|
@@ -183,7 +189,7 @@ GdkPixmap *read_bmp(gchar * filename)
|
|
}
|
|
else if (bitcount != 24 && bitcount != 16 && bitcount != 32)
|
|
{
|
|
- gint ncols, i;
|
|
+ guint32 ncols, i;
|
|
|
|
ncols = offset - headSize - 14;
|
|
if (headSize == 12)
|
|
@@ -203,6 +209,13 @@ GdkPixmap *read_bmp(gchar * filename)
|
|
fseek(file, offset, SEEK_SET);
|
|
buffer = g_malloc(imgsize);
|
|
fread(buffer, imgsize, 1, file);
|
|
+ /* verify buffer size */
|
|
+ if (!h || !w ||
|
|
+ w > (((UINT32_MAX - 3) / 3) / h) ||
|
|
+ h > (((UINT32_MAX - 3) / 3) / w)) {
|
|
+ g_warning("read_bmp(): width(%u)*height(%u) too large", w, h);
|
|
+ goto failure;
|
|
+ }
|
|
data = g_malloc0((w * 3 * h) + 3); /* +3 is just for safety */
|
|
|
|
if (bitcount == 1)
|