pkg://ImageMagick-5.5.6-15.src.rpm:3566406/ImageMagick-5.5.6-sgioverflow.patch  info  downloads

--- ImageMagick-5.5.6/coders/sgi.c.sgioverflow	2003-03-01 20:59:25.000000000 -0500
+++ ImageMagick-5.5.6/coders/sgi.c	2005-03-16 08:42:34.170391000 -0500
@@ -161,16 +161,19 @@
 %
 */
 
-static void SGIDecode(const unsigned long bytes_per_pixel,
+static void SGIDecode(const unsigned long width,const size_t bytes_per_pixel,
   unsigned char *max_packets,unsigned char *pixels)
 {
-  long
-    count;
-
   register unsigned char
     *p,
     *q;
 
+  register long
+    i;
+
+  ssize_t
+    count;
+
   unsigned long
     pixel;
 
@@ -178,14 +181,15 @@
   q=pixels;
   if (bytes_per_pixel == 2)
     {
-      for ( ; ; )
+      for (i=0; i < (long) width; )
       {
-        pixel=(*p++) << 8;
+        pixel=(unsigned long) (*p++) << 8;
         pixel|=(*p++);
-        count=(long) (pixel & 0x7f);
+        count=(ssize_t) (pixel & 0x7f);
+        i+=count;
         if (count == 0)
           break;
-        if (pixel & 0x80)
+        if ((pixel & 0x80) != 0)
           for ( ; count != 0; count--)
           {
             *q=(*p++);
@@ -194,7 +198,7 @@
           }
         else
           {
-            pixel=(*p++) << 8;
+            pixel=(unsigned long) (*p++) << 8;
             pixel|=(*p++);
             for ( ; count != 0; count--)
             {
@@ -206,13 +210,14 @@
       }
       return;
     }
-  for ( ; ; )
+  for (i=0; i < (long) width; )
   {
-    pixel=(*p++);
-    count=(long) (pixel & 0x7f);
+    pixel=(unsigned long) (*p++);
+    count=(ssize_t) (pixel & 0x7f);
     if (count == 0)
       break;
-    if (pixel & 0x80)
+    i+=count;
+    if ((pixel & 0x80) != 0)
       for ( ; count != 0; count--)
       {
         *q=(*p++);
@@ -220,7 +225,7 @@
       }
     else
       {
-        pixel=(*p++);
+        pixel=(unsigned long) (*p++);
         for ( ; count != 0; count--)
         {
           *q=(unsigned char) pixel;
@@ -417,13 +422,18 @@
                 (void) ReadBlob(image,runlength[y+z*iris_info.rows],
                   (char *) max_packets);
                 offset+=runlength[y+z*iris_info.rows];
-                SGIDecode(bytes_per_pixel,max_packets,p+bytes_per_pixel*z);
+                SGIDecode(iris_info.columns,bytes_per_pixel,max_packets,
+                  p+bytes_per_pixel*z);
                 p+=(iris_info.columns*4*bytes_per_pixel);
               }
             }
           }
         else
           {
+            unsigned long
+              position;
+           
+            position=TellBlob(image);
             p=iris_pixels;
             for (y=0; y < (long) iris_info.rows; y++)
             {
@@ -437,10 +447,12 @@
                 (void) ReadBlob(image,runlength[y+z*iris_info.rows],
                   (char *) max_packets);
                 offset+=runlength[y+z*iris_info.rows];
-                SGIDecode(bytes_per_pixel,max_packets,p+bytes_per_pixel*z);
+                SGIDecode(iris_info.columns,bytes_per_pixel,max_packets,
+                  p+bytes_per_pixel*z);
               }
               p+=(iris_info.columns*4*bytes_per_pixel);
             }
+            (void) SeekBlob(image,position,SEEK_SET);
           }
         LiberateMemory((void **) &runlength);
         LiberateMemory((void **) &max_packets);