(pbm_load): Allow color values up to 65535.

Throw an error if max_color_idx is outside the supported range.
Report an error when image size is invalid.
Read two bytes at a time when raw images have max_color_idx above 255.

2 files changed, 38 insertions, 11 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index d54ad87e772..b0a940292e5 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,10 @@
+2008-03-28  Jason Rumney  <jasonr@gnu.org>
+
+        * image.c (pbm_load): Allow color values up to 65535.
+        Throw an error if max_color_idx is outside the supported range.
+        Report an error when image size is invalid.
+        Read two bytes at a time when raw images have max_color_idx above 255.
+
 2008-03-26  Alexandre Oliva  <aoliva@redhat.com>  (tiny change)
 
         * regex.c (EXTEND_BUFFER): Change order of pointer addition
diff --git a/src/image.c b/src/image.c
index 71a8c4b4995..16515852642 100644
--- a/src/image.c
+++ b/src/image.c
@@ -5776,13 +5776,18 @@ pbm_load (f, img)
   if (type != PBM_MONO)
     {
       max_color_idx = pbm_scan_number (&p, end);
-      if (raw_p && max_color_idx > 255)
-        max_color_idx = 255;
+      if (max_color_idx > 65535 || max_color_idx < 0)
+        {
+          image_error ("Unsupported maximum PBM color value", Qnil, Qnil);
+          goto error;
+        }
     }
 
-  if (!check_image_size (f, width, height)
-      || (type != PBM_MONO && max_color_idx < 0))
-    goto error;
+  if (!check_image_size (f, width, height))
+    {
+      image_error ("Invalid image size", Qnil, Qnil);
+      goto error;
+    }
 
   if (!x_create_x_image_and_pixmap (f, width, height, 0,
                                     &ximg, &img->pixmap))
@@ -5842,10 +5847,13 @@ pbm_load (f, img)
     }
   else
     {
-      if (raw_p
-          && ((type == PBM_GRAY)
-              ? (p + height * width > end)
-              : (p + 3 * height * width > end)))
+      int expected_size = height * width;
+      if (max_color_idx > 255)
+        expected_size *= 2;
+      if (type == PBM_COLOR)
+        expected_size *= 3;
+
+      if (raw_p && p + expected_size > end)
         {
           x_destroy_x_image (ximg);
           x_clear_image (f, img);
@@ -5859,13 +5867,25 @@ pbm_load (f, img)
           {
             int r, g, b;
 
-            if (type == PBM_GRAY)
-              r = g = b = raw_p ? *p++ : pbm_scan_number (&p, end);
+            if (type == PBM_GRAY && raw_p)
+              {
+                r = g = b = *p++;
+                if (max_color_idx > 255)
+                  r = g = b = r * 256 + *p++;
+              }
+            else if (type == PBM_GRAY)
+              r = g = b = pbm_scan_number (&p, end);
             else if (raw_p)
               {
                 r = *p++;
+                if (max_color_idx > 255)
+                  r = r * 256 + *p++;
                 g = *p++;
+                if (max_color_idx > 255)
+                  g = g * 256 + *p++;
                 b = *p++;
+                if (max_color_idx > 255)
+                  b = b * 256 + *p++;
               }
             else
               {