aboutsummaryrefslogtreecommitdiffstats
path: root/graphics/xv
diff options
context:
space:
mode:
authordinoex <dinoex@FreeBSD.org>2004-10-11 12:03:13 +0800
committerdinoex <dinoex@FreeBSD.org>2004-10-11 12:03:13 +0800
commitd0abc3b47a577625dca647c24f3a38f8882e1468 (patch)
treed1c61c8cdf212f9ed3172277bc0eb657ae5905f6 /graphics/xv
parent8eaede34a3f2aa1b983e7e87c8eba8b174e488f7 (diff)
downloadfreebsd-ports-gnome-d0abc3b47a577625dca647c24f3a38f8882e1468.tar.gz
freebsd-ports-gnome-d0abc3b47a577625dca647c24f3a38f8882e1468.tar.zst
freebsd-ports-gnome-d0abc3b47a577625dca647c24f3a38f8882e1468.zip
- import securitry patches
- update FixPix4xv.patch PR: 72382 Approved by: portmgr (linimon) and shige Obtained from: SuSe
Diffstat (limited to 'graphics/xv')
-rw-r--r--graphics/xv/Makefile4
-rw-r--r--graphics/xv/files/patch-ae183
-rw-r--r--graphics/xv/files/patch-suse-2003-01-27675
-rw-r--r--graphics/xv/files/patch-suse-2004-07-28195
-rw-r--r--graphics/xv/files/patch-suse-2004-08-24138
5 files changed, 1134 insertions, 61 deletions
diff --git a/graphics/xv/Makefile b/graphics/xv/Makefile
index 7132c14c6eeb..855ed9b5667a 100644
--- a/graphics/xv/Makefile
+++ b/graphics/xv/Makefile
@@ -7,7 +7,7 @@
PORTNAME= xv
PORTVERSION= 3.10a
-PORTREVISION= 3
+PORTREVISION= 4
CATEGORIES+= graphics
MASTER_SITES= ftp://ftp.cis.upenn.edu/pub/xv/ \
${MASTER_SITE_LOCAL} \
@@ -25,8 +25,6 @@ DISTFILES= ${DISTNAME}${EXTRACT_SUFX} \
DIST_SUBDIR= ${PORTNAME}
EXTRACT_ONLY= ${DISTFILES:N*patch}
-FORBIDDEN= http://vuxml.freebsd.org/fffacc93-16cb-11d9-bc4a-000c41e2cdad.html
-
PATCH_SITES= ftp://ftp.cis.upenn.edu/pub/xv/ \
ftp://ftp.trilon.com/pub/xv/patches/
# Note: xpm.patch appears to already be in xvdir.c
diff --git a/graphics/xv/files/patch-ae b/graphics/xv/files/patch-ae
index 21d5cf583fe5..f608332c6250 100644
--- a/graphics/xv/files/patch-ae
+++ b/graphics/xv/files/patch-ae
@@ -1,11 +1,28 @@
---- xvimage.c~ Fri Jan 13 18:11:36 1995
-+++ xvimage.c Tue Oct 15 16:41:47 1996
-@@ -46,6 +46,274 @@
+--- xvimage.c
++++ xvimage.c Wed Jan 12 15:10:24 2000
+@@ -29,40 +29,302 @@
+ static void flipSel PARM((int));
+ static void do_zoom PARM((int, int));
+ static void compute_zoom_rect PARM((int, int, int*, int*, int*, int*));
+ static void do_unzoom PARM((void));
+ static void do_pan PARM((int, int));
+ static void do_pan_calc PARM((int, int, int *, int *));
+ static void crop1 PARM((int, int, int, int, int));
+ static int doAutoCrop24 PARM((void));
+ static void floydDitherize1 PARM((XImage *, byte *, int, int, int,
+ byte *, byte *,byte *));
+ static int highbit PARM((unsigned long));
+
+ static int doPadSolid PARM((char *, int, int, int, int));
+ static int doPadBggen PARM((char *, int, int, int, int));
+ static int doPadLoad PARM((char *, int, int, int, int));
+
+ static int doPadPaste PARM((byte *, int, int, int, int));
static int ReadImageFile1 PARM((char *, PICINFO *));
-+/* The following array represents the pixel values for each shade of
-+ * the primary color components.
++/* The following array represents the pixel values for each shade
++ * of the primary color components.
+ * If 'p' is a pointer to a source image rgb-byte-triplet, we can
+ * construct the output pixel value simply by 'oring' together
+ * the corresponding components:
@@ -20,7 +37,7 @@
+ * This is both efficient and generic, since the only assumption
+ * is that the primary color components have separate bits.
+ * The order and distribution of bits does not matter, and we
-+ * don't need additional vaiables and shifting/masking code.
++ * don't need additional variables and shifting/masking code.
+ * The array size is 3 KBytes total and thus very reasonable.
+ */
+
@@ -42,21 +59,14 @@
+ * The method is to draw points in a pixmap with the specified shades
+ * of primary colors and then get the corresponding XImage pixel
+ * representation.
-+ * Thus we can get away with any Bit-order/Byte-Order dependencies.
++ * Thus we can get away with any Bit-order/Byte-order dependencies.
+ *
-+ * The routine uses some global X variables: theDisp, theScreen,
-+ * and dispDEEP. Adapt these to your application as necessary.
++ * The routine uses some global X variables:
++ * theDisp, theScreen, dispDEEP, and theCmap.
++ * Adapt these to your application as necessary.
+ * I've not passed them in as parameters, since for other platforms
+ * than X these may be different (see vfixpix.c), and so the
+ * screen_init() interface is unique.
-+ *
-+ * BUG: I've read in the "Xlib Programming Manual" from O'Reilly &
-+ * Associates, that the DefaultColormap in TrueColor might not
-+ * provide the full shade representation in XAllocColor.
-+ * In this case one had to provide a 'best' colormap instead.
-+ * However, my tests with Xaccel on a Linux-Box with a Mach64
-+ * card were fully successful, so I leave that potential problem
-+ * to you at the moment and would appreciate any suggestions...
+ */
+
+static void screen_init()
@@ -73,43 +83,45 @@
+
+ check_map = XCreatePixmap(theDisp, RootWindow(theDisp,theScreen),
+ 1, 1, dispDEEP);
-+ check_gc = XCreateGC(theDisp, RootWindow(theDisp,theScreen), 0, NULL);
++ check_gc = XCreateGC(theDisp, check_map, 0, NULL);
+ for (ci = 0; ci < 3; ci++) {
+ for (i = 0; i < 256; i++) {
-+ check_col.flags = DoRed | DoGreen | DoBlue;
+ check_col.red = 0;
+ check_col.green = 0;
+ check_col.blue = 0;
+ /* Do proper upscaling from unsigned 8 bit (image data values)
+ to unsigned 16 bit (X color representation). */
+ ((unsigned short *)&check_col.red)[ci] = (unsigned short)((i << 8) | i);
-+ if (!XAllocColor(theDisp, DefaultColormap(theDisp,theScreen), &check_col))
-+ FatalError("XAllocColor in screen_init() failed"); /* shouldn't happen */
++ if (theVisual->class == TrueColor)
++ XAllocColor(theDisp, theCmap, &check_col);
++ else
++ xvAllocColor(theDisp, theCmap, &check_col);
+ screen_set[ci][i] =
+ (((unsigned short *)&check_col.red)[ci] >> 8) & 0xff;
+ XSetForeground(theDisp, check_gc, check_col.pixel);
+ XDrawPoint(theDisp, check_map, check_gc, 0, 0);
+ check_image = XGetImage(theDisp, check_map, 0, 0, 1, 1,
+ AllPlanes, ZPixmap);
-+ if (!check_image) FatalError("XGetImage in screen_init() failed");
-+ switch (check_image->bits_per_pixel) {
-+ case 8:
-+ screen_rgb[ci][i] = *(CARD8 *)check_image->data;
-+ break;
-+ case 16:
-+ screen_rgb[ci][i] = *(CARD16 *)check_image->data;
-+ break;
-+ case 24:
-+ screen_rgb[ci][i] =
-+ ((unsigned long)*(CARD8 *)check_image->data << 16) |
-+ ((unsigned long)*(CARD8 *)(check_image->data + 1) << 8) |
-+ (unsigned long)*(CARD8 *)(check_image->data + 2);
-+ break;
-+ case 32:
-+ screen_rgb[ci][i] = *(CARD32 *)check_image->data;
-+ break;
++ if (check_image) {
++ switch (check_image->bits_per_pixel) {
++ case 8:
++ screen_rgb[ci][i] = *(CARD8 *)check_image->data;
++ break;
++ case 16:
++ screen_rgb[ci][i] = *(CARD16 *)check_image->data;
++ break;
++ case 24:
++ screen_rgb[ci][i] =
++ ((unsigned long)*(CARD8 *)check_image->data << 16) |
++ ((unsigned long)*(CARD8 *)(check_image->data + 1) << 8) |
++ (unsigned long)*(CARD8 *)(check_image->data + 2);
++ break;
++ case 32:
++ screen_rgb[ci][i] = *(CARD32 *)check_image->data;
++ break;
++ }
++ XDestroyImage(check_image);
+ }
-+ XDestroyImage(check_image);
+ }
+ }
+ XFreeGC(theDisp, check_gc);
@@ -156,7 +168,6 @@
+ * current column. (If we are lucky, those variables are in registers, but
+ * even if not, they're probably cheaper to access than array elements are.)
+ *
-+ * The fserrors[] array is indexed [component#][position].
+ * We provide (#columns + 2) entries per component; the extra entry at each
+ * end saves us from special-casing the first and last pixels.
+ */
@@ -275,7 +286,41 @@
#define DO_CROP 0
#define DO_ZOOM 1
-@@ -1883,33 +2151,17 @@
+
+
+ /***********************************/
+ void Resize(w,h)
+ int w,h;
+ {
+ RANGE(w,1,maxWIDE); RANGE(h,1,maxHIGH);
+
+ if (HaveSelection()) DrawSelection(0); /* turn off old rect */
+
+ if (psUp) PSResize(); /* if PSDialog is open, mention size change */
+
+ /* if same size, and Ximage created, do nothing */
+ if (w==eWIDE && h==eHIGH && theImage!=NULL) return;
+
+ if (DEBUG) fprintf(stderr,"Resize(%d,%d) eSIZE=%d,%d cSIZE=%d,%d\n",
+ w,h,eWIDE,eHIGH,cWIDE,cHIGH);
+@@ -1866,156 +2128,145 @@
+ if (!xim) FatalError("couldn't create xim!");
+
+ imagedata = (byte *) malloc((size_t) (xim->bytes_per_line * high));
+ if (!imagedata) FatalError("couldn't malloc imagedata");
+
+ xim->data = (char *) imagedata;
+ floydDitherize1(xim, pic24,PIC24, (int) wide, (int) high, NULL,NULL,NULL);
+
+ return xim;
+ }
+
+
+
+
+ if (theVisual->class == TrueColor || theVisual->class == DirectColor) {
+
+ /************************************************************************/
/* Non-ColorMapped Visuals: TrueColor, DirectColor */
/************************************************************************/
@@ -311,7 +356,13 @@
imagedata = (byte *) malloc((size_t) (high * bperline));
if (!imagedata) FatalError("couldn't malloc imagedata");
-@@ -1923,82 +2175,87 @@
+
+ xim->data = (char *) imagedata;
+
+ if (bperpix != 8 && bperpix != 16 && bperpix != 24 && bperpix != 32) {
+ char buf[128];
+ sprintf(buf,"Sorry, no code written to handle %d-bit %s",
+ bperpix, "TrueColor/DirectColor displays!");
FatalError(buf);
}
@@ -363,19 +414,6 @@
- *ip++ = (xcol>>8) & 0xff;
- *ip++ = (xcol>>16) & 0xff;
- *ip++ = (xcol>>24) & 0xff;
-- }
-- }
--
-- else if (bperpix == 24) {
-- if (border == MSBFirst) {
-- *ip++ = (xcol>>16) & 0xff;
-- *ip++ = (xcol>>8) & 0xff;
-- *ip++ = xcol & 0xff;
-- }
-- else { /* LSBFirst */
-- *ip++ = xcol & 0xff;
-- *ip++ = (xcol>>8) & 0xff;
-- *ip++ = (xcol>>16) & 0xff;
+#ifdef DO_FIXPIX_SMOOTH
+#if 0
+ /* If we wouldn't have to save the original pic24 image data,
@@ -396,7 +434,6 @@
+ * dithering/rendering in a loop using a temporary line buffer.
+ */
+ if (bperpix < 24) {
-+ int alldone = 0;
+ FSBUF *fs = fs2_init(wide);
+ if (fs) {
+ byte *row_buf = malloc((size_t)wide * 3);
@@ -422,12 +459,25 @@
+ }
+ }
}
-+ alldone = 1;
+- }
+ free(row_buf);
++ free(fs);
+
+- else if (bperpix == 24) {
+- if (border == MSBFirst) {
+- *ip++ = (xcol>>16) & 0xff;
+- *ip++ = (xcol>>8) & 0xff;
+- *ip++ = xcol & 0xff;
+- }
+- else { /* LSBFirst */
+- *ip++ = xcol & 0xff;
+- *ip++ = (xcol>>8) & 0xff;
+- *ip++ = (xcol>>16) & 0xff;
+- }
++ return xim;
}
+ free(fs);
+ }
-+ if (alldone) return xim;
+ }
+#endif
+#endif
@@ -470,3 +520,20 @@
}
}
}
+ }
+
+ else {
+
+ /************************************************************************/
+ /* CMapped Visuals: PseudoColor, GrayScale, StaticGray, StaticColor... */
+ /************************************************************************/
+
+ byte *pic8;
+ int bwdith;
+
+ /* in all cases, make an 8-bit version of the image, either using
+ 'black' and 'white', or the stdcmap */
+
+ bwdith = 0;
+
+ if (ncols == 0 && dispDEEP != 1) { /* do 'black' and 'white' dither */
diff --git a/graphics/xv/files/patch-suse-2003-01-27 b/graphics/xv/files/patch-suse-2003-01-27
new file mode 100644
index 000000000000..60cee57cd57d
--- /dev/null
+++ b/graphics/xv/files/patch-suse-2003-01-27
@@ -0,0 +1,675 @@
+--- xv.c
++++ xv.c 2003-01-27 00:03:36.000000000 +0100
+@@ -146,9 +146,7 @@
+ rmodeset, gamset, cgamset, perfect, owncmap, rwcolor, stdcmap;
+ int nodecor;
+ double gamval, rgamval, ggamval, bgamval;
+-
+-
+-
++winRepositionningInfoST winRepositionningInfo = { 0, 0};
+
+ /*******************************************/
+ int main(argc, argv)
+@@ -2125,6 +2145,7 @@
+ /* if the file is STDIN, write it out to a temp file */
+
+ if (strcmp(filename,STDINSTR)==0) {
++ int tmpfd;
+ FILE *fp;
+
+ #ifndef VMS
+@@ -2135,11 +2156,15 @@
+ mktemp(filename);
+
+ clearerr(stdin);
+- fp = fopen(filename,"w");
++ tmpfd = open(filename,O_WRONLY|O_CREAT|O_EXCL,S_IRWUSR);
++ if (tmpfd < 0) FatalError("openPic(): can't create temporary file");
++ fp = fdopen(tmpfd,"w");
+ if (!fp) FatalError("openPic(): can't write temporary file");
+
+ while ( (i=getchar()) != EOF) putc(i,fp);
++ fflush(fp);
+ fclose(fp);
++ close(tmpfd);
+
+ /* and remove it from list, since we can never reload from stdin */
+ if (strcmp(namelist[0], STDINSTR)==0) deleteFromList(0);
+@@ -2672,7 +2697,11 @@
+ to generate the correct exposes (particularly with 'BitGravity' turned
+ on */
+
+- if (mainW && !useroot) GenExpose(mainW, 0, 0, (u_int) eWIDE, (u_int) eHIGH);
++ /*Brian T. Schellenberger: fix for X 4.2 refresh problem*/
++ if (mainW && !useroot) {
++ XSync(theDisp, False);
++ GenExpose(mainW, 0, 0, (u_int) eWIDE, (u_int) eHIGH);
++ }
+
+ return 1;
+
+@@ -2812,7 +2846,8 @@
+
+ #ifdef GS_PATH
+ else if (strncmp((char *) magicno, "%!", (size_t) 2)==0 ||
+- strncmp((char *) magicno, "\004%!", (size_t) 3)==0) rv = RFT_PS;
++ strncmp((char *) magicno, "\004%!", (size_t) 3)==0 ||
++ strncmp((char *) magicno, "%PDF", (size_t) 4)==0) rv = RFT_PS;
+ #endif
+
+ #ifdef HAVE_MAG
+@@ -2959,6 +2998,7 @@
+ returns '0' on failure */
+
+ char namez[128], *fname, buf[512];
++ int tmpfd;
+
+ fname = name;
+ namez[0] = '\0';
+@@ -3047,15 +3090,18 @@
+ char *src, *dst;
+ {
+ char tmpname[128], buffer[8192]; /* XXX */
+- int n, eof;
++ int n, eof, tmpfd;
+ FILE *sfp, *dfp;
+
+ sprintf(dst, "%s/xvmXXXXXX", tmpdir);
+ mktemp(dst);
++ tmpfd = open(dst,O_WRONLY|O_CREAT|O_EXCL,S_IRWUSR);
++ if (tmpfd < 0) FatalError("RemoveMacbinary(): can't create temporary file");
++
+ SetISTR(ISTR_INFO, "Removing MacBinary...");
+
+ sfp = xv_fopen(src, "r");
+- dfp = xv_fopen(dst, "w");
++ dfp = fdopen(tmpfd, "w");
+ if (!sfp || !dfp) {
+ SetISTR(ISTR_INFO, "Unable to remove a InfoFile header form '%s'.", src);
+ Warning();
+@@ -3067,7 +3113,9 @@
+ if (eof = feof(sfp))
+ fwrite(buffer, 1, n, dfp);
+ fclose(sfp);
++ fflush(dfp);
+ fclose(dfp);
++ close(tmpfd);
+ if (!eof) {
+ SetISTR(ISTR_INFO, "Unable to remove a InfoFile header form '%s'.", src);
+ Warning();
+@@ -3199,7 +3247,7 @@
+ */
+
+ char fullcmd[512], tmpname[64], str[512];
+- int i;
++ int i, tmpfd;
+
+ if (!cmd || (strlen(cmd) < (size_t) 2)) return 1;
+
+@@ -3210,6 +3258,9 @@
+ ErrPopUp(str, "\nHow unlikely!");
+ return 1;
+ }
++ tmpfd = open(tmpname,O_WRONLY|O_CREAT|O_EXCL,S_IRWUSR);
++ if (tmpfd < 0) FatalError("openPic(): can't create temporary file");
++ close(tmpfd);
+
+ /* build command */
+ strcpy(fullcmd, cmd+1); /* skip the leading '!' character in cmd */
+--- xv.h
++++ xv.h 2003-01-27 00:03:36.000000000 +0100
+@@ -310,7 +294,9 @@
+ # endif
+ #endif
+
+-
++#ifndef S_IRWUSR
++# define S_IRWUSR (S_IRUSR|S_IWRITE)
++#endif
+
+ #ifndef MAXPATHLEN
+ # define MAXPATHLEN 256
+@@ -813,6 +811,13 @@
+ #define WHERE
+ #endif
+
++/* Needed for repositionning with negative geometries */
++typedef struct {
++ int negativeX;
++ int negativeY;
++} winRepositionningInfoST;
++extern winRepositionningInfoST winRepositionningInfo;
++
+ typedef unsigned char byte;
+
+ typedef struct scrl {
+--- xvdir.c
++++ xvdir.c 2003-01-27 00:03:36.000000000 +0100
+@@ -80,7 +83,7 @@
+ "PIC",
+ #endif /* HAVE_PIC */
+ #ifdef HAVE_MAKI
+- "MAKI",
++ "MAKI (640x400 only)",
+ #endif /* HAVE_MAKI */
+ #ifdef HAVE_PI
+ "PI",
+--- xvevent.c
++++ xvevent.c 2003-01-27 00:03:36.000000000 +0100
+@@ -64,6 +64,8 @@
+
+ static void annotatePic PARM((void));
+
++static int debkludge_offx;
++static int debkludge_offy;
+
+ /****************/
+ int EventLoop()
+@@ -676,6 +694,29 @@
+ p_offy = xwa.y;
+ }
+
++ /* Gather info to keep right border inside */
++ {
++ Window current;
++ Window root_r;
++ Window parent_r;
++ Window *children_r;
++ int nchildren_r;
++ XWindowAttributes xwa;
++
++ parent_r=mainW;
++ current=mainW;
++ do {
++ current=parent_r;
++ XQueryTree(theDisp, current, &root_r, &parent_r,
++ &children_r, &nchildren_r);
++ if (children_r!=NULL) {
++ XFree(children_r);
++ }
++ } while(parent_r!=root_r);
++ XGetWindowAttributes(theDisp, current, &xwa);
++ debkludge_offx=eWIDE-xwa.width+p_offx;
++ debkludge_offy=eHIGH-xwa.height+p_offy;
++ }
+
+ /* move window around a bit... */
+ {
+@@ -2078,6 +2127,26 @@
+ if (xwa->width < dispWIDE && xwc.x < p_offx) xwc.x = p_offx;
+ if (xwa->height < dispHIGH && xwc.y < p_offy) xwc.y = p_offy;
+
++ /* Try to keep bottom right decorations inside */
++ if (xwc.x+eWIDE-debkludge_offx>dispWIDE) {
++ xwc.x=dispWIDE-eWIDE+debkludge_offx;
++ if (xwc.x<0) xwc.x=0;
++ }
++ if (xwc.y+eHIGH-debkludge_offy>dispHIGH) {
++ xwc.y=dispHIGH-eHIGH+debkludge_offy;
++ if (xwc.y<0) xwc.y=0;
++ }
++
++ /* In case of negative offset for first image */
++ if (winRepositionningInfo.negativeX) {
++ xwc.x+=winRepositionningInfo.negativeX;
++ winRepositionningInfo.negativeX=0;
++ }
++ if (winRepositionningInfo.negativeY) {
++ xwc.y+=winRepositionningInfo.negativeY;
++ winRepositionningInfo.negativeY=0;
++ }
++
+ xwc.width = xwa->width;
+ xwc.height = xwa->height;
+
+--- xvfits.c
++++ xvfits.c 2003-01-27 00:03:36.000000000 +0100
+@@ -14,7 +14,7 @@
+ * provided "as is" without express or implied warranty.
+ */
+
+-
++#define NEEDSDIR /* for S_IRUSR|S_IWUSR */
+ #include "xv.h"
+
+ #define NCARDS (36)
+@@ -223,7 +223,7 @@
+ * If there was a problem writing files, then a error message will be set.
+ */
+
+- int i, np=nx * ny, ioerror, nwrt;
++ int i, np=nx * ny, ioerror, nwrt, tmpfd;
+ FILE *fp;
+ char *error;
+ byte *work;
+@@ -246,7 +246,12 @@
+
+ for (i=0; i < nz && !error; i++) {
+ sprintf(filename, "%s%d", basename, i+1);
+- fp = xv_fopen(filename, "w");
++ tmpfd = open(filename,O_WRONLY|O_CREAT|O_EXCL,S_IRWUSR);
++ if (tmpfd < 0) {
++ error = "Unable to open temporary file";
++ break;
++ }
++ fp = fdopen(tmpfd, "w");
+ if (!fp) {
+ error = "Unable to open temporary file";
+ break;
+@@ -254,13 +259,17 @@
+
+ if (wrheader(fp, nx, ny, comment)) {
+ error = "I/O error writing temporary file";
++ fflush(fp);
+ fclose(fp);
++ close(tmpfd);
+ unlink(filename);
+ break;
+ }
+
+ nwrt = fwrite(image+i*np, sizeof(byte), (size_t) np, fp);
++ fflush(fp);
+ fclose(fp);
++ close(tmpfd);
+
+ if (nwrt == 0) { /* failed to write any data */
+ error = "I/O error writing temporary file";
+--- xvimage.c
++++ xvimage.c 2003-01-27 00:03:36.000000000 +0100
+@@ -21,6 +21,7 @@
+ * int LoadPad(pinfo, fname);
+ */
+
++#define NEEDSDIR /* for S_IRUSR|S_IWUSR */
+ #include "copyright.h"
+
+ #include "xv.h"
+@@ -2927,7 +2930,7 @@
+ char *str;
+ int wide, high, opaque,omode;
+ {
+- int i;
++ int i, tmpfd;
+ byte *bgpic24;
+ char syscmd[512], fname[128], errstr[512];
+ PICINFO pinfo;
+@@ -2949,6 +2952,13 @@
+ strcpy(fname, "Sys$Disk:[]xvuXXXXXX");
+ #endif
+ mktemp(fname);
++ tmpfd = open(fname, O_WRONLY|O_CREAT|O_EXCL,S_IRWUSR);
++ if (tmpfd < 0) {
++ sprintf(errstr, "Error: can't create temporary file %s", fname);
++ ErrPopUp(errstr, "\nDoh!");
++ return 0;
++ }
++ close(tmpfd);
+
+ /* run bggen to generate the background */
+ sprintf(syscmd, "bggen -g %dx%d %s > %s", wide, high, str, fname);
+--- xvmaki.c
++++ xvmaki.c 2003-01-27 00:03:36.000000000 +0100
+@@ -355,8 +355,12 @@
+ return -1;
+ }
+
+- if(w != 640 || h != 400)
++ if(w != 640 || h != 400) {
++ char str[512];
++ sprintf(str,"MAKI: %s Should be 640x400", maki_msgs[MAKI_SIZE]);
++ ErrPopUp(str, "\nBummer!");
+ maki_error(mi, MAKI_SIZE);
++ }
+
+ maki.fp = fp;
+ maki.width = w;
+@@ -669,6 +673,7 @@
+ static void maki_init_info(mi)
+ struct maki_info *mi;
+ {
++ xvbzero((char *)mi, sizeof(struct maki_info));
+ mi->fp = NULL;
+ mi->fsize = 0;
+ mi->x0 = mi->y0 = mi->x1 = mi->y1 = 0;
+--- xvpds.c
++++ xvpds.c 2003-01-27 00:03:36.000000000 +0100
+@@ -102,7 +102,7 @@
+ * This software is provided "as is" without any express or implied warranty.
+ */
+
+-
++#define NEEDSDIR /* for S_IRUSR|S_IWUSR */
+ #include "xv.h"
+
+ #ifdef HAVE_PDS
+@@ -250,7 +250,7 @@
+ {
+ /* returns '1' on success, '0' on failure */
+
+- int tempnum;
++ int tempnum, tmpfd;
+ FILE *zf;
+ static int isfixed,teco,i,j,itype,vaxbyte,
+ recsize,hrecsize,irecsize,isimage,labelrecs,labelsofar,
+@@ -690,6 +690,12 @@
+ #ifndef VMS
+ sprintf(pdsuncompfname,"%s/xvhuffXXXXXX", tmpdir);
+ mktemp(pdsuncompfname);
++ tmpfd = open(pdsuncompfname,O_WRONLY|O_CREAT|O_EXCL,S_IRWUSR);
++ if (tmpfd < 0) {
++ SetISTR(ISTR_WARNING,"Unable to create temporarly file.");
++ return 0;
++ }
++ close(tmpfd);
+ sprintf(scanbuff,"%s %s - 4 >%s",PDSUNCOMP,fname,pdsuncompfname);
+ #else
+ strcpy(pdsuncompfname,"sys$disk:[]xvhuffXXXXXX");
+--- xvps.c
++++ xvps.c 2003-01-27 00:03:36.000000000 +0100
+@@ -1564,7 +1564,7 @@
+ /* build command string */
+
+ #ifndef VMS /* VMS needs quotes around mixed case command lines */
+- sprintf(tmp, "%s -sDEVICE=%s -r%d -q -dNOPAUSE -sOutputFile=%s%%d ",
++ sprintf(tmp, "%s -sDEVICE=%s -r%d -q -dSAFER -dNOPAUSE -sOutputFile=%s%%d ",
+ GS_PATH, gsDev, gsRes, tmpname);
+ #else
+ sprintf(tmp,
+--- xvtiff.c
++++ xvtiff.c 2003-01-27 00:03:36.000000000 +0100
+@@ -5,6 +5,7 @@
+ * LoadTIFF(fname, numcols, quick) - load a TIFF file
+ */
+
++#define NEEDSDIR /* for S_IRUSR|S_IWUSR */
+ #ifndef va_start
+ # define NEEDSARGS
+ #endif
+@@ -56,7 +89,7 @@
+ return 0;
+ }
+
+- fseek(fp, 0L, 2);
++ fseek(fp, 0L, SEEK_END);
+ filesize = ftell(fp);
+ fclose(fp);
+
+@@ -1065,7 +1308,7 @@
+ int fromskew, toskew;
+ {
+ while (h-- > 0) {
+- UNROLL8(w,0, *cp++ = PALmap[*pp++][0]);
++ UNROLL8(w,, *cp++ = PALmap[*pp++][0]);
+ cp += toskew;
+ pp += fromskew;
+ }
+@@ -1262,7 +1504,7 @@
+ }
+ } else {
+ while (h-- > 0) {
+- UNROLL8(w,0,
++ UNROLL8(w,,
+ *cp++ = pp[0];
+ *cp++ = pp[1];
+ *cp++ = pp[2];
+@@ -1335,7 +1577,7 @@
+ }
+ } else {
+ while (h-- > 0) {
+- UNROLL8(w,0,
++ UNROLL8(w,,
+ *cp++ = *r++;
+ *cp++ = *g++;
+ *cp++ = *b++;
+--- xvtiffwr.c
++++ xvtiffwr.c 2003-01-27 00:03:36.000000000 +0100
+@@ -78,6 +78,9 @@
+ TIFFSetField(tif, TIFFTAG_GROUP3OPTIONS,
+ GROUP3OPT_2DENCODING+GROUP3OPT_FILLBITS);
+
++ if (comp == COMPRESSION_LZW)
++ TIFFSetField(tif, TIFFTAG_PREDICTOR, 2);
++
+ TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
+ TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 1);
+ TIFFSetField(tif, TIFFTAG_ORIENTATION, ORIENTATION_TOPLEFT);
+--- xvvd.c
++++ xvvd.c 2003-01-27 00:03:36.000000000 +0100
+@@ -793,7 +794,7 @@
+ returns '0' on failure */
+
+ char namez[128], *fname, buf[512], tmp[HEADERSIZE];
+- int n;
++ int n, tmpfd;
+ FILE *pfp, *tfp;
+
+ fname = name;
+@@ -834,10 +835,17 @@
+ Warning();
+ return 0;
+ }
+- if ((tfp = fopen(uncompname, "w")) == NULL) {
++ if ((tmpfd = open(uncompname,O_WRONLY|O_CREAT|O_EXCL,S_IRWUSR)) < 0) {
++ SetISTR(ISTR_INFO, "Unable to create temporarly file.",
++ BaseName(uncompname));
++ Warning();
++ pclose(pfp);
++ }
++ if ((tfp = fdopen(tmpfd, "w")) == NULL) {
+ SetISTR(ISTR_INFO, "Unable to create temporarly file.",
+ BaseName(uncompname));
+ Warning();
++ close(tmpfd);
+ pclose(pfp);
+ return 0;
+ }
+@@ -846,11 +854,15 @@
+ BaseName(fname));
+ Warning();
+ pclose(pfp);
++ fflush(tfp);
+ fclose(tfp);
++ close(tmpfd);
+ return 0;
+ }
+ fwrite(tmp, 1, n, tfp);
++ fflush(tfp);
+ fclose(tfp);
++ close(tmpfd);
+ pclose(pfp);
+
+ /* if we renamed the file to end with a .Z for the sake of 'uncompress',
+--- xvxpm.c
++++ xvxpm.c 2003-01-27 00:03:36.000000000 +0100
+@@ -77,96 +77,104 @@
+ hentry *clmp; /* colormap hash-table */
+ hentry *c_sptr; /* cmap hash-table search pointer*/
+ XColor col;
+-
++
+ bname = BaseName(fname);
+ fp = fopen(fname, "r");
+ if (!fp)
+ return (XpmLoadError(bname, "couldn't open file"));
+-
++
+ if (DEBUG)
+ printf("LoadXPM(): Loading xpm from %s\n", fname);
+-
++
+ fseek(fp, 0L, 2);
+ filesize = ftell(fp);
+ fseek(fp, 0L, 0);
+-
++
+ bufchar = -2;
+ in_quote = FALSE;
+-
++
+ /* Read in the values line. It is the first string in the
+ * xpm, and contains four numbers. w, h, num_colors, and
+ * chars_per_pixel. */
+-
++
+ /* First, get to the first string */
+ while (((c = XpmGetc(fp))!=EOF) && (c != '"')) ;
+ line_pos = 0;
+-
++
+ /* Now, read in the string */
+ while (((c = XpmGetc(fp))!=EOF) && (line_pos < VALUES_LEN) && (c != '"')) {
+ values[line_pos++] = c;
+ }
+ if (c != '"')
+ return (XpmLoadError(bname, "error parsing values line"));
+-
++
+ values[line_pos] = '\0';
+ sscanf(values, "%d%d%d%d", &w, &h, &nc, &cpp);
+ if (nc <= 0 || cpp <= 0)
+ return (XpmLoadError(bname, "No colours in Xpm?"));
+-
++
+ if (nc > 256)
+ pinfo->type = PIC24;
+ else
+ pinfo->type = PIC8;
+-
++
+ if (DEBUG)
+ printf("LoadXPM(): reading a %dx%d image (%d colors)\n", w, h, nc);
+-
++
+ /* We got this far... */
+ WaitCursor();
+-
++
+ if (!hash_init(nc))
+ return (XpmLoadError(bname, "Not enough memory to hash colormap"));
+-
++
+ clmp = (hentry *) malloc(nc * sizeof(hentry)); /* Holds the colormap */
+ if (pinfo->type == PIC8) pic = (byte *) malloc((size_t) (w*h));
+ else pic = (byte *) malloc((size_t) (w*h*3));
+-
++
+ if (!clmp || !pic)
+ return (XpmLoadError(bname, "Not enough memory to load pixmap"));
+-
++
+ c_sptr = clmp;
+ i_sptr = pic;
+-
++
+ /* initialize the 'hex' array for zippy ASCII-hex -> int conversion */
+-
++
+ for (i = 0 ; i < 256 ; i++) hex[i] = 0;
+ for (i = '0'; i <= '9' ; i++) hex[i] = i - '0';
+ for (i = 'a'; i <= 'f' ; i++) hex[i] = i - 'a' + 10;
+ for (i = 'A'; i <= 'F' ; i++) hex[i] = i - 'A' + 10;
+-
++
+ /* Again, we've made progress. */
+ WaitCursor();
+-
++
+ /* Now, we need to read the colormap. */
+ pinfo->colType = F_BWDITHER;
+ for (i = 0 ; i < nc ; i++) {
+ while (((c = XpmGetc(fp))!=EOF) && (c != '"')) ;
+ if (c != '"')
+ return (XpmLoadError(bname, "Error reading colormap"));
+-
++
+ for (j = 0 ; j < cpp ; j++)
+ c_sptr->token[j] = XpmGetc(fp);
+ c_sptr->token[j] = '\0';
+-
++
+ while (((c = XpmGetc(fp))!=EOF) && ((c == ' ') || (c == '\t'))) ;
+ if (c == EOF) /* The failure condition of getc() */
+ return (XpmLoadError(bname, "Error parsing colormap line"));
+-
++
+ do {
+ char key[3];
+- char color[40]; /* Need to figure a good size for this... */
++ char color[80]; /* Need to figure a good size for this... */
+ short hd; /* Hex digits per R, G, or B */
+-
++
++/*
++ * Problem with spaces in color names
++ *
++ * X s Color Name m Other Name c Last Name
++ *
++ * ... this parser doesn't find `Any Name'
++ */
++
+ for (j=0; j<2 && (c != ' ') && (c != '\t') && (c != EOF); j++) {
+ key[j] = c;
+ c = XpmGetc(fp);
+@@ -177,7 +185,7 @@
+ if (c == EOF) /* The failure condition of getc() */
+ return (XpmLoadError(bname, "Error parsing colormap line"));
+
+- for (j=0; j<39 && (c!=' ') && (c!='\t') && (c!='"') && c!=EOF; j++) {
++ for (j=0; j<79 && (c!=' ') && (c!='\t') && (c!='"') && c!=EOF; j++) {
+ color[j] = c;
+ c = XpmGetc(fp);
+ }
+@@ -236,13 +244,13 @@
+ else { /* 'None' or unrecognized color spec */
+ int rgb;
+
+- if (strcmp(color, "None") == 0) rgb = 0xb2c0dc; /* infobg */
++ if (strcasecmp(color, "None") == 0) rgb = 0xb2c0dc; /* infobg */
+ else {
+ SetISTR(ISTR_INFO, "%s: unknown color spec '%s'", bname, color);
+ Timer(1000);
+ rgb = 0x808080;
+ }
+-
++
+ if (pinfo->type == PIC8) {
+ pinfo->r[i] = (rgb>>16) & 0xff;
+ pinfo->g[i] = (rgb>> 8) & 0xff;
+@@ -309,28 +317,29 @@
+ *i_sptr++ = mapentry->cv_rgb[2];
+ }
+ } /* for ( j < w ) */
+- (void)XpmGetc(fp); /* Throw away the close " */
+-
++ while (((c = XpmGetc(fp))!=EOF) && /* Throw away the close " and */
++ (c != '"')) ; /* erase all remaining pixels */
++
+ if (!(i%7)) WaitCursor();
+ } /* for ( i < h ) */
+-
++
+ pinfo->pic = pic;
+ pinfo->normw = pinfo->w = w;
+ pinfo->normh = pinfo->h = h;
+ pinfo->frmType = F_XPM;
+
+ if (DEBUG) printf("LoadXPM(): pinfo->colType is %d\n", pinfo->colType);
+-
++
+ sprintf(pinfo->fullInfo, "Xpm v3 Pixmap (%ld bytes)", filesize);
+ sprintf(pinfo->shrtInfo, "%dx%d Xpm.", w, h);
+ pinfo->comment = (char *)NULL;
+-
++
+ hash_destroy();
+ free(clmp);
+-
++
+ if (fp != stdin)
+ fclose(fp);
+-
++
+ return(1);
+ }
+
diff --git a/graphics/xv/files/patch-suse-2004-07-28 b/graphics/xv/files/patch-suse-2004-07-28
new file mode 100644
index 000000000000..8a230f18dc43
--- /dev/null
+++ b/graphics/xv/files/patch-suse-2004-07-28
@@ -0,0 +1,195 @@
+--- xvbmp.c
++++ xvbmp.c Wed Jul 28 15:16:05 2004
+@@ -32,7 +32,7 @@
+ static int loadBMP1 PARM((FILE *, byte *, u_int, u_int));
+ static int loadBMP4 PARM((FILE *, byte *, u_int, u_int, u_int));
+ static int loadBMP8 PARM((FILE *, byte *, u_int, u_int, u_int));
+-static int loadBMP24 PARM((FILE *, byte *, u_int, u_int));
++static int loadBMP24 PARM((FILE *, byte *, u_int, u_int, u_int));
+ static u_int getshort PARM((FILE *));
+ static u_int getint PARM((FILE *));
+ static void putshort PARM((FILE *, int));
+@@ -127,7 +127,8 @@
+
+
+ /* error checking */
+- if ((biBitCount!=1 && biBitCount!=4 && biBitCount!=8 && biBitCount!=24) ||
++ if ((biBitCount!=1 && biBitCount!=4 && biBitCount!=8 &&
++ biBitCount!=24 && biBitCount!=32) ||
+ biPlanes!=1 || biCompression>BI_RLE4) {
+
+ sprintf(buf,"Bogus BMP File! (bitCount=%d, Planes=%d, Compression=%d)",
+@@ -137,7 +138,8 @@
+ goto ERROR;
+ }
+
+- if (((biBitCount==1 || biBitCount==24) && biCompression != BI_RGB) ||
++ if (((biBitCount==1 || biBitCount==24 || biBitCount==32)
++ && biCompression != BI_RGB) ||
+ (biBitCount==4 && biCompression==BI_RLE8) ||
+ (biBitCount==8 && biCompression==BI_RLE4)) {
+
+@@ -159,7 +161,7 @@
+ }
+
+ /* load up colormap, if any */
+- if (biBitCount!=24) {
++ if (biBitCount!=24 && biBitCount!=32) {
+ int i, cmaplen;
+
+ cmaplen = (biClrUsed) ? biClrUsed : 1 << biBitCount;
+@@ -197,7 +199,7 @@
+
+ /* create pic8 or pic24 */
+
+- if (biBitCount==24) {
++ if (biBitCount==24 || biBitCount==32) {
+ pic24 = (byte *) calloc((size_t) biWidth * biHeight * 3, (size_t) 1);
+ if (!pic24) return (bmpError(bname, "couldn't malloc 'pic24'"));
+ }
+@@ -212,16 +214,18 @@
+ if (biBitCount == 1) rv = loadBMP1(fp,pic8,biWidth,biHeight);
+ else if (biBitCount == 4) rv = loadBMP4(fp,pic8,biWidth,biHeight,
+ biCompression);
+- else if (biBitCount == 8) rv = loadBMP8(fp,pic8,biWidth,biHeight,
++ else if (biBitCount == 8) rv = loadBMP8(fp,pic8,biWidth,biHeight,
+ biCompression);
+- else rv = loadBMP24(fp,pic24,biWidth,biHeight);
++ else rv = loadBMP24(fp,pic24,biWidth,biHeight,
++ biBitCount);
++
+
+ if (rv) bmpError(bname, "File appears truncated. Winging it.\n");
+
+ fclose(fp);
+
+
+- if (biBitCount == 24) {
++ if (biBitCount == 24 || biBitCount == 32) {
+ pinfo->pic = pic24;
+ pinfo->type = PIC24;
+ }
+@@ -264,12 +268,13 @@
+ u_int w,h;
+ {
+ int i,j,c,bitnum,padw;
+- byte *pp;
++ byte *pp = pic8 + ((h - 1) * w);
++ size_t l = w*h;
+
+ c = 0;
+ padw = ((w + 31)/32) * 32; /* 'w', padded to be a multiple of 32 */
+
+- for (i=h-1; i>=0; i--) {
++ for (i=h-1; i>=0 && (pp - pic8 <= l); i--) {
+ pp = pic8 + (i * w);
+ if ((i&0x3f)==0) WaitCursor();
+ for (j=bitnum=0; j<padw; j++,bitnum++) {
+@@ -298,8 +303,8 @@
+ u_int w,h,comp;
+ {
+ int i,j,c,c1,x,y,nybnum,padw,rv;
+- byte *pp;
+-
++ byte *pp = pic8 + ((h - 1) * w);
++ size_t l = w*h;
+
+ rv = 0;
+ c = c1 = 0;
+@@ -307,7 +312,7 @@
+ if (comp == BI_RGB) { /* read uncompressed data */
+ padw = ((w + 7)/8) * 8; /* 'w' padded to a multiple of 8pix (32 bits) */
+
+- for (i=h-1; i>=0; i--) {
++ for (i=h-1; i>=0 && (pp - pic8 <= l); i--) {
+ pp = pic8 + (i * w);
+ if ((i&0x3f)==0) WaitCursor();
+
+@@ -335,7 +340,7 @@
+
+ if (c) { /* encoded mode */
+ c1 = getc(fp);
+- for (i=0; i<c; i++,x++,pp++)
++ for (i=0; i<c && (pp - pic8 <= l); i++,x++,pp++)
+ *pp = (i&1) ? (c1 & 0x0f) : ((c1>>4)&0x0f);
+ }
+
+@@ -355,7 +360,7 @@
+ }
+
+ else { /* absolute mode */
+- for (i=0; i<c; i++, x++, pp++) {
++ for (i=0; i<c && (pp - pic8 <= l); i++, x++, pp++) {
+ if ((i&1) == 0) c1 = getc(fp);
+ *pp = (i&1) ? (c1 & 0x0f) : ((c1>>4)&0x0f);
+ }
+@@ -384,14 +389,15 @@
+ u_int w,h,comp;
+ {
+ int i,j,c,c1,padw,x,y,rv;
+- byte *pp;
++ byte *pp = pic8 + ((h - 1) * w);
++ size_t l = w*h;
+
+ rv = 0;
+
+ if (comp == BI_RGB) { /* read uncompressed data */
+ padw = ((w + 3)/4) * 4; /* 'w' padded to a multiple of 4pix (32 bits) */
+
+- for (i=h-1; i>=0; i--) {
++ for (i=h-1; i>=0 && (pp - pic8 <= l); i--) {
+ pp = pic8 + (i * w);
+ if ((i&0x3f)==0) WaitCursor();
+
+@@ -412,7 +418,7 @@
+
+ if (c) { /* encoded mode */
+ c1 = getc(fp);
+- for (i=0; i<c; i++,x++,pp++) *pp = c1;
++ for (i=0; i<c && (pp - pic8 <= l); i++,x++,pp++) *pp = c1;
+ }
+
+ else { /* c==0x00 : escape codes */
+@@ -431,7 +437,7 @@
+ }
+
+ else { /* absolute mode */
+- for (i=0; i<c; i++, x++, pp++) {
++ for (i=0; i<c && (pp - pic8 <= l); i++, x++, pp++) {
+ c1 = getc(fp);
+ *pp = c1;
+ }
+@@ -454,19 +460,21 @@
+
+
+ /*******************************************/
+-static int loadBMP24(fp, pic24, w, h)
++static int loadBMP24(fp, pic24, w, h, bits)
+ FILE *fp;
+ byte *pic24;
+- u_int w,h;
++ u_int w,h, bits;
+ {
+ int i,j,padb,rv;
+- byte *pp;
++ byte *pp = pic24 + ((h - 1) * w * 3);
++ size_t l = w*h*3;
+
+ rv = 0;
+
+ padb = (4 - ((w*3) % 4)) & 0x03; /* # of pad bytes to read at EOscanline */
++ if (bits==32) padb = 0;
+
+- for (i=h-1; i>=0; i--) {
++ for (i=h-1; i>=0 && (pp - pic24 <= l); i--) {
+ pp = pic24 + (i * w * 3);
+ if ((i&0x3f)==0) WaitCursor();
+
+@@ -474,6 +482,7 @@
+ pp[2] = getc(fp); /* blue */
+ pp[1] = getc(fp); /* green */
+ pp[0] = getc(fp); /* red */
++ if (bits==32) getc(fp);
+ pp += 3;
+ }
+
diff --git a/graphics/xv/files/patch-suse-2004-08-24 b/graphics/xv/files/patch-suse-2004-08-24
new file mode 100644
index 000000000000..d49f23292c91
--- /dev/null
+++ b/graphics/xv/files/patch-suse-2004-08-24
@@ -0,0 +1,138 @@
+--- xvbmp.c
++++ xvbmp.c Tue Aug 24 12:42:52 2004
+@@ -129,7 +129,9 @@
+ /* error checking */
+ if ((biBitCount!=1 && biBitCount!=4 && biBitCount!=8 &&
+ biBitCount!=24 && biBitCount!=32) ||
+- biPlanes!=1 || biCompression>BI_RLE4) {
++ biPlanes!=1 || biCompression>BI_RLE4 ||
++ biWidth<= 0 || biHeight <= 0 ||
++ (biClrUsed && biClrUsed > (1 << biBitCount))) {
+
+ sprintf(buf,"Bogus BMP File! (bitCount=%d, Planes=%d, Compression=%d)",
+ biBitCount, biPlanes, biCompression);
+@@ -159,6 +161,9 @@
+
+ bPad = bfOffBits - (biSize + 14);
+ }
++
++ if (biClrUsed > (1 << biBitCount))
++ biClrUsed = (1 << biBitCount);
+
+ /* load up colormap, if any */
+ if (biBitCount!=24 && biBitCount!=32) {
+--- xviris.c
++++ xviris.c Tue Aug 24 13:01:42 2004
+@@ -267,6 +267,12 @@
+
+ rlebuflen = 2 * xsize + 10;
+ tablen = ysize * zsize;
++
++ if (rlebuflen <= 0 || tablen <= 0 || (tablen * sizeof(long)) < 0) {
++ loaderr = "Bogus IRIS File!";
++ return (byte *)NULL;
++ }
++
+ starttab = (u_long *) malloc((size_t) tablen * sizeof(long));
+ lengthtab = (u_long *) malloc((size_t) tablen * sizeof(long));
+ rledat = (byte *) malloc((size_t) rlebuflen);
+--- xvpcx.c
++++ xvpcx.c Tue Aug 24 13:12:15 2004
+@@ -222,7 +222,14 @@
+ byte *image;
+
+ /* note: overallocation to make life easier... */
+- image = (byte *) malloc((size_t) (pinfo->h + 1) * pinfo->w + 16);
++ int count = (pinfo->h + 1) * pinfo->w + 16;
++
++ if (count <= 0 || pinfo->h <= 0 || pinfo->w <= 0) {
++ pcxError(fname, "Bogus PCX file!!");
++ return (0);
++ }
++
++ image = (byte *) malloc((size_t) count);
+ if (!image) FatalError("Can't alloc 'image' in pcxLoadImage8()");
+
+ xvbzero((char *) image, (size_t) ((pinfo->h+1) * pinfo->w + 16));
+@@ -250,17 +257,25 @@
+ {
+ byte *pix, *pic24, scale[256];
+ int c, i, j, w, h, maxv, cnt, planes, bperlin, nbytes;
++ int count;
+
+ w = pinfo->w; h = pinfo->h;
+
+ planes = (int) hdr[PCX_PLANES];
+ bperlin = hdr[PCX_BPRL] + ((int) hdr[PCX_BPRH]<<8);
+
++ count = w*h*planes;
++
++ if (count <= 0 || planes <= 0 || w <= 0 || h <= 0) {
++ pcxError(fname, "Bogus PCX file!!");
++ return (0);
++ }
++
+ /* allocate 24-bit image */
+- pic24 = (byte *) malloc((size_t) w*h*planes);
++ pic24 = (byte *) malloc((size_t) count);
+ if (!pic24) FatalError("couldn't malloc 'pic24'");
+
+- xvbzero((char *) pic24, (size_t) w*h*planes);
++ xvbzero((char *) pic24, (size_t) count);
+
+ maxv = 0;
+ pix = pinfo->pic = pic24;
+@@ -268,6 +283,12 @@
+ j = 0; /* bytes per line, in this while loop */
+ nbytes = bperlin*h*planes;
+
++ if (nbytes < 0) {
++ pcxError(fname, "Bogus PCX file!!");
++ free(pic24);
++ return (0);
++ }
++
+ while (nbytes > 0 && (c = getc(fp)) != EOF) {
+ if ((c & 0xC0) == 0xC0) { /* have a rep. count */
+ cnt = c & 0x3F;
+--- xvpm.c
++++ xvpm.c Tue Aug 24 13:16:43 2004
+@@ -119,6 +119,9 @@
+
+ isize = pm_isize(&thePic);
+
++ if (isize <= 0)
++ return pmError(bname, "Bogus PM file!!");
++
+ if (DEBUG)
+ fprintf(stderr,"%s: LoadPM() - loading a %dx%d %s pic, %d planes\n",
+ cmd, w, h, (thePic.pm_form==PM_I) ? "PM_I" : "PM_C",
+@@ -135,6 +138,8 @@
+ return( pmError(bname, "file read error") );
+ }
+
++ if (thePic.pm_cmtsize+1 <= 0)
++ return pmError(bname, "Bogus PM file!!");
+
+ /* alloc and read in comment, if any */
+ if (thePic.pm_cmtsize>0) {
+@@ -155,6 +160,9 @@
+ int *intptr;
+ byte *pic24, *picptr;
+
++ if (w <= 0 || h <= 0 || w*h*3 <= 0)
++ return pmError(bname, "Bogus PM file!!");
++
+ if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) {
+ if (thePic.pm_cmt) free(thePic.pm_cmt);
+ return( pmError(bname, "unable to malloc 24-bit picture") );
+@@ -189,6 +197,9 @@
+
+ else if (thePic.pm_form == PM_C && thePic.pm_np>1) {
+ byte *pic24, *picptr, *rptr, *gptr, *bptr;
++
++ if (w <= 0 || h <= 0 || w*h*3 <= 0)
++ return pmError(bname, "Bogus PM file!!");
+
+ if ((pic24 = (byte *) malloc((size_t) w*h*3))==NULL) {
+ if (thePic.pm_cmt) free(thePic.pm_cmt);