lbximg: Fix wart in frame scanline header format

[liblbx.git] / src / image.c

diff --git a/src/image.c b/src/image.c
index f68f2da9f9ac4b1573e9d16ed53279ac9a236043..764f2bedfd1720ea3ac4496232547968112b9370 100644 (file)
--- a/src/image.c
+++ b/src/image.c
@@ -196,9 +196,9 @@ struct lbx_image *lbx_img_fopen(const char *file)
        return lbx_img_open(p, &lbx_pipe_fops, pipe_close);
 }
 
-static int _lbx_drawrow(int first, struct lbx_image_priv *img)
+static int _lbx_drawrow(struct lbx_image_priv *img)
 {
-       unsigned short type, count, yval, xval;
+       unsigned short length, offset;
        unsigned char buf[4];
        unsigned char *pos;
        size_t rc;
@@ -208,63 +208,47 @@ static int _lbx_drawrow(int first, struct lbx_image_priv *img)
 
        if (img->fops->read(buf, sizeof buf, img->f) != sizeof buf)
                goto readerr;
-       type = unpack_16_le(buf+0);
 
-       if (first) {
-               img->currentx = 0;
-               img->currenty = 0;
-               type = 0;
-       }
-
-       if (type == 0) {
-               yval = unpack_16_le(buf+2);
-               if (yval == 1000)
-                       return 1;
-
-               if (img->fops->read(buf, sizeof buf, img->f) != sizeof buf)
-                       goto readerr;
-               count = unpack_16_le(buf+0);
-
-               xval = unpack_16_le(buf+2);
-               if (xval == 1000)
-                       return 1;
+       length = unpack_16_le(buf+0);
+       offset = unpack_16_le(buf+2);
+       if (length == 0 && offset == 1000)
+               return 1;
 
-               /* Ensure that the row fits in the image. */
-               if (img->pub.height - img->currenty <= yval
-                   || xval >= img->pub.width) {
+       /* Length of 0 increments Y position */
+       if (!length) {
+               if (offset > img->pub.height - img->currenty) {
                        lbx_error_raise(LBX_EFORMAT);
                        return -1;
                }
 
-               img->currenty += yval;
-               img->currentx  = xval;
-       } else {
-               xval = unpack_16_le(buf+2);
-
-               if (img->pub.width - img->currentx <= xval) {
-                       lbx_error_raise(LBX_EFORMAT);
-                       return -1;
-               }
-               img->currentx += xval;
+               img->currenty += offset;
+               img->currentx  = 0;
+               return 0;
+       }
 
-               count = type;
+       /* Otherwise we read pixel data */
+       if (offset > img->pub.width - img->currentx) {
+               lbx_error_raise(LBX_EFORMAT);
+               return -1;
        }
+       img->currentx += offset;
 
-       if (count > img->pub.width - img->currentx) {
+       if (length > img->pub.width - img->currentx) {
                lbx_error_raise(LBX_EFORMAT);
                return -1;
        }
 
-       memset(&img->mask[img->currenty][img->currentx], 1, count);
+       memset(&img->mask[img->currenty][img->currentx], 1, length);
 
        pos = &img->framedata[img->currenty][img->currentx];
-       rc  = img->fops->read(pos, count, img->f);
+       rc  = img->fops->read(pos, length, img->f);
        img->currentx += rc;
 
-       if (rc < count)
+       if (rc < length)
                goto readerr;
 
-       if (count % 2) {
+       /* Skip padding byte, if any */
+       if (length % 2) {
                if (img->fops->read(buf, 1, img->f) != 1)
                        goto readerr;
        }
@@ -338,6 +322,7 @@ static unsigned char **read_raw_frame(struct lbx_image_priv *img, int frame)
 unsigned char **lbx_img_getframe(struct lbx_image *pub, int frame)
 {
        struct lbx_image_priv *img = (struct lbx_image_priv *)pub;
+       unsigned char buf[4];
 
        if (frame >= pub->frames || frame < 0) {
                lbx_error_raise(LBX_ENOENT);
@@ -380,17 +365,35 @@ unsigned char **lbx_img_getframe(struct lbx_image *pub, int frame)
        }
 
        if (img->currentframe != frame) {
-               int rc, first = 1;
+               int rc;
 
                if (img->fops->seek(img->f, img->offsets[frame], SEEK_SET)) {
                        return NULL;
                }
 
+               /* Read frame header */
+               if (img->fops->read(buf, 4, img->f) != 4) {
+                       if (img->fops->eof(img->f))
+                               lbx_error_raise(LBX_EEOF);
+                       return NULL;
+               }
+
+               if (unpack_16_le(buf) != 1) {
+                       lbx_error_raise(LBX_EFORMAT);
+                       return NULL;
+               }
+
+               img->currentx = 0;
+               img->currenty = unpack_16_le(buf+2);
+               if (img->currenty > img->pub.height) {
+                       lbx_error_raise(LBX_EFORMAT);
+                       return NULL;
+               }
+
                do {
-                       rc = _lbx_drawrow(first, img);
+                       rc = _lbx_drawrow(img);
                        if (rc == -1)
                                return NULL;
-                       first = 0;
 
                        if (img->fops->tell(img->f) > img->offsets[frame+1]) {
                                lbx_error_raise(LBX_EFORMAT);