--- gdk-pixbuf/io-bmp.c 2025-09-10 13:44:57.000000000 +0200 +++ gdk-pixbuf/io-bmp.c.patched 2025-09-10 14:10:32.491445400 +0200 @@ -128,12 +128,12 @@ struct headerpair { guint32 size; - guint32 width; - guint32 height; + gint32 width; + gint32 height; guint depth; guint Negative; /* Negative = 1 -> top down BMP, Negative = 0 -> bottom up BMP */ - guint n_colors; + guint n_colors; }; /* Data needed for the "state" during decompression */ @@ -180,10 +180,10 @@ struct headerpair Header; /* Decoded (BE->CPU) header */ /* Bit masks, shift amounts, and significant bits for BI_BITFIELDS coding */ - unsigned int r_mask, r_shift, r_bits; - unsigned int g_mask, g_shift, g_bits; - unsigned int b_mask, b_shift, b_bits; - unsigned int a_mask, a_shift, a_bits; + int r_mask, r_shift, r_bits; + int g_mask, g_shift, g_bits; + int b_mask, b_shift, b_bits; + int a_mask, a_shift, a_bits; GdkPixbuf *pixbuf; /* Our "target" */ }; @@ -206,18 +206,15 @@ * Does it by hand instead of dereferencing a simple (gint *) cast due to * alignment constraints many platforms. */ -static unsigned int -lsb_32 (unsigned char *src) +static int +lsb_32 (guchar *src) { - return src[0] | - ((unsigned int) src[1] << 8) | - ((unsigned int) src[2] << 16) | - ((unsigned int) src[3] << 24); + return src[0] | (src[1] << 8) | (src[2] << 16) | (src[3] << 24); } /* Same as above, but for 16-bit little-endian integers. */ -static unsigned short -lsb_16 (unsigned char *src) +static short +lsb_16 (guchar *src) { return src[0] | (src[1] << 8); } @@ -256,15 +253,12 @@ struct bmp_progressive_state *State, GError **error); -static gboolean -DecodeHeader (unsigned char *BFH, - unsigned char *BIH, - struct bmp_progressive_state *State, - GError **error) -{ - unsigned int clrUsed; - unsigned int maxDepth; - unsigned int bytesPerPixel; +static gboolean DecodeHeader(unsigned char *BFH, unsigned char *BIH, + struct bmp_progressive_state *State, + GError **error) +{ + gint clrUsed; + guint bytesPerPixel; /* First check for the two first bytes content. A sane BMP file must start with bytes 0x42 0x4D. */ @@ -341,38 +335,35 @@ return FALSE; } - if (State->Header.depth > 32) { + if (State->Header.depth > 32) + { g_set_error_literal (error, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_CORRUPT_IMAGE, _("BMP image has unsupported depth")); State->read_state = READ_STATE_ERROR; return FALSE; - } - - maxDepth = 1UL << State->Header.depth; + } if (State->Header.size == 12) - clrUsed = maxDepth; + clrUsed = 1 << State->Header.depth; else - clrUsed = ((unsigned int) BIH[35] << 24) - + ((unsigned int) BIH[34] << 16) - + ((unsigned int) BIH[33] << 8) - + ((unsigned int) BIH[32]); + clrUsed = (int) (BIH[35] << 24) + (BIH[34] << 16) + (BIH[33] << 8) + (BIH[32]); - if (clrUsed > maxDepth) { + if (clrUsed > (1 << State->Header.depth)) + { g_set_error_literal (error, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_CORRUPT_IMAGE, _("BMP image has oversize palette")); State->read_state = READ_STATE_ERROR; return FALSE; - } + } if (clrUsed != 0) State->Header.n_colors = clrUsed; else - State->Header.n_colors = maxDepth; + State->Header.n_colors = (1 << State->Header.depth); State->Type = State->Header.depth; /* This may be less trivial someday */ @@ -632,7 +623,7 @@ /* Finds the lowest set bit and the number of set bits */ static void -find_bits (unsigned int n, unsigned int *lowest, unsigned int *n_set) +find_bits (int n, int *lowest, int *n_set) { unsigned int i; @@ -648,28 +639,18 @@ /* Decodes the bitmasks for BI_BITFIELDS coding */ static gboolean -decode_bitmasks (unsigned char *buf, +decode_bitmasks (guchar *buf, struct bmp_progressive_state *State, GError **error) { State->a_mask = State->a_shift = State->a_bits = 0; - - State->r_mask = buf[0] | - ((unsigned int) buf[1] << 8) | - ((unsigned int) buf[2] << 16) | - ((unsigned int) buf[3] << 24); + State->r_mask = buf[0] | (buf[1] << 8) | (buf[2] << 16) | (buf[3] << 24); buf += 4; - State->g_mask = buf[0] | - ((unsigned int) buf[1] << 8) | - ((unsigned int) buf[2] << 16) | - ((unsigned int) buf[3] << 24); + State->g_mask = buf[0] | (buf[1] << 8) | (buf[2] << 16) | (buf[3] << 24); buf += 4; - State->b_mask = buf[0] | - ((unsigned int) buf[1] << 8) | - ((unsigned int) buf[2] << 16) | - ((unsigned int) buf[3] << 24); + State->b_mask = buf[0] | (buf[1] << 8) | (buf[2] << 16) | (buf[3] << 24); find_bits (State->r_mask, &State->r_shift, &State->r_bits); find_bits (State->g_mask, &State->g_shift, &State->g_bits); @@ -678,10 +659,7 @@ /* extended v3, v4 and v5 have an alpha mask */ if (State->Header.size == 56 || State->Header.size == 108 || State->Header.size == 124) { buf += 4; - State->a_mask = buf[0] | - ((unsigned int) buf[1] << 8) | - ((unsigned int) buf[2] << 16) | - ((unsigned int) buf[3] << 24); + State->a_mask = buf[0] | (buf[1] << 8) | (buf[2] << 16) | (buf[3] << 24); find_bits (State->a_mask, &State->a_shift, &State->a_bits); } @@ -843,10 +821,10 @@ src = context->buff; if (context->Compressed == BI_BITFIELDS) { - unsigned int r_lshift, r_rshift; - unsigned int g_lshift, g_rshift; - unsigned int b_lshift, b_rshift; - unsigned int a_lshift, a_rshift; + int r_lshift, r_rshift; + int g_lshift, g_rshift; + int b_lshift, b_rshift; + int a_lshift, a_rshift; r_lshift = 8 - context->r_bits; g_lshift = 8 - context->g_bits; @@ -861,10 +839,7 @@ for (i = 0; i < context->Header.width; i++) { unsigned int v, r, g, b, a; - v = src[0] | - ((unsigned int) src[1] << 8) | - ((unsigned int) src[2] << 16) | - ((unsigned int) src[3] << 24); + v = src[0] | (src[1] << 8) | (src[2] << 16) | (src[3] << 24); r = (v & context->r_mask) >> context->r_shift; g = (v & context->g_mask) >> context->g_shift; @@ -875,13 +850,13 @@ *pixels++ = (g << g_lshift) | (g >> g_rshift); *pixels++ = (b << b_lshift) | (b >> b_rshift); if (context->a_bits) - *pixels++ = (a << a_lshift) | (a >> a_rshift); + *pixels++ = (a << a_lshift) | (a >> a_rshift); else - *pixels++ = 0xff; + *pixels++ = 0xff; src += 4; } - } else { + } else for (i = 0; i < context->Header.width; i++) { *pixels++ = src[2]; *pixels++ = src[1]; @@ -890,7 +865,6 @@ src += 4; } - } } static void OneLine24(struct bmp_progressive_state *context) @@ -932,9 +906,9 @@ src = context->buff; if (context->Compressed == BI_BITFIELDS) { - unsigned int r_lshift, r_rshift; - unsigned int g_lshift, g_rshift; - unsigned int b_lshift, b_rshift; + int r_lshift, r_rshift; + int g_lshift, g_rshift; + int b_lshift, b_rshift; r_lshift = 8 - context->r_bits; g_lshift = 8 - context->g_bits; @@ -945,9 +919,9 @@ b_rshift = context->b_bits - b_lshift; for (i = 0; i < context->Header.width; i++) { - unsigned int v, r, g, b; + int v, r, g, b; - v = (unsigned int) src[0] | ((unsigned int) src[1] << 8); + v = (int) src[0] | ((int) src[1] << 8); r = (v & context->r_mask) >> context->r_shift; g = (v & context->g_mask) >> context->g_shift; @@ -959,11 +933,11 @@ src += 2; } - } else { + } else for (i = 0; i < context->Header.width; i++) { - unsigned int v, r, g, b; + int v, r, g, b; - v = (unsigned int) src[0] | ((unsigned int) src[1] << 8); + v = src[0] | (src[1] << 8); r = (v >> 10) & 0x1f; g = (v >> 5) & 0x1f; @@ -975,7 +949,6 @@ src += 2; } - } } static void OneLine8(struct bmp_progressive_state *context)