Bug 555791 – Natuilus Crashes when opening USB MP3 Player Contents

2008-10-13  Matthias Clasen  <mclasen@redhat.com>

        Bug 555791 – Natuilus Crashes when opening USB MP3 Player Contents

        * io-tga.c (gdk_pixbuf__tga_stop_load): Don't segfault on
        short files.
        Problem reported by Pedro Villavicencio

svn path=/trunk/; revision=21643

diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index 650ca00d41b63befc1f11d32dff1e8150e0bd16d..4d88a4359e67111d767dabbef966054e69017c36 100644 (file)
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,11 @@
+2008-10-13  Matthias Clasen  <mclasen@redhat.com>
+
+       Bug 555791 – Natuilus Crashes when opening USB MP3 Player Contents
+
+       * io-tga.c (gdk_pixbuf__tga_stop_load): Don't segfault on
+       short files.
+       Problem reported by Pedro Villavicencio
+
 2008-10-01  Tor Lillqvist  <tml@novell.com>
 
        * io-icns.c: Don't #define _GNU_SOURCE on Windows as it confuses

diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c
index c35eaef916f0ab5581b89a8a99fdd9ea084b74b3..e42758c1980336d17cb13d7a8a1979c53f2adbf0 100644 (file)
--- a/gdk-pixbuf/io-tga.c
+++ b/gdk-pixbuf/io-tga.c
@@ -349,7 +349,7 @@ static gboolean fill_in_context(TGAContext *ctx, GError **err)
        }
 
        ctx->pbuf_bytes = ctx->pbuf->rowstride * ctx->pbuf->height;
-       if (ctx->hdr->flags & TGA_ORIGIN_UPPER || ctx->run_length_encoded)
+       if ((ctx->hdr->flags & TGA_ORIGIN_UPPER) || ctx->run_length_encoded)
                ctx->pptr = ctx->pbuf->pixels;
        else
                ctx->pptr = ctx->pbuf->pixels + (ctx->pbuf->height - 1)*ctx->pbuf->rowstride;
@@ -935,8 +935,10 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err)
        TGAContext *ctx = (TGAContext *) data;
        g_return_val_if_fail(ctx != NULL, FALSE);
 
-       if (!(ctx->hdr->flags & TGA_ORIGIN_UPPER) && 
-            ctx->run_length_encoded && ctx->pbuf) {
+       if (ctx->hdr &&
+            (ctx->hdr->flags & TGA_ORIGIN_UPPER) == 0 && 
+            ctx->run_length_encoded && 
+            ctx->pbuf) {
                pixbuf_flip_vertically (ctx->pbuf);
                if (ctx->ufunc)
                        (*ctx->ufunc) (ctx->pbuf, 0, 0,