Package: libimlib2
Version: 1.3.0.0debian1

I find that the loader_pnm.c file in the source package has bugs which
manifest themselves while reading ascii PNM files. To be specific the
data is read using a char buffer and fgets(). When the buffer ends in
the middle of a number which is more than 1 character long, the parser
splits that number into two.

I have corrected two instances f this mistake in loader_pnm.c.mine

I have attached the output of
diff imlib2-1.3.0.0debian1/src/modules/loaders/loader_pnm.c
imlib2-1.3.0.0debian1/src/modules/loaders/loader_pnm.c.mine

This is an important bug as applications like feh use this to load
images and PNM format images are used extensively in research.

Thanks,
Aravind.
244,245c244,261
<                          while (buf[i] && !isspace(buf[i]))
<                             buf2[j++] = buf[i++];
---
>                                                while (!isspace(buf[i]))
>                                                {
>                                                        if (buf[i]) 
>                                                        {
>                                                                buf2[j++] = 
> buf[i++];
>                                                        }
>                                                        else 
>                                                        {
>                                                                if 
> (!fgets(buf, 255, f))
>                                                                {
>                                                                        break;
>                                                                }
>                                                                else 
>                                                                {
>                                                                        i = 0;
>                                                                }
>                                                        }
>                                                }
338,339c354,371
<                          while (buf[i] && !isspace(buf[i]))
<                             buf2[j++] = buf[i++];
---
>                                                while (!isspace(buf[i]))
>                                                {
>                                                        if (buf[i]) 
>                                                        {
>                                                                buf2[j++] = 
> buf[i++];
>                                                        }
>                                                        else 
>                                                        {
>                                                                if 
> (!fgets(buf, 255, f))
>                                                                {
>                                                                        break;
>                                                                }
>                                                                else 
>                                                                {
>                                                                        i = 0;
>                                                                }
>                                                        }
>                                                }

Reply via email to