Fix another potential stack overflow issue in the BMP image loader (I…

…ssue #456) Deprecate BMP support and document that it is going away in a future HTMLDOC release.
michaelrsweet · Dec 18, 2021 · 753c71b · 753c71b
1 parent 48b605c
commit 753c71b
Show file tree

Hide file tree

Showing 6 changed files with 15 additions and 12 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -1,6 +1,9 @@
 # Changes in HTMLDOC v1.9.14
 
+- BMP image support is now deprecated and will be removed in a future
+  release of HTMLDOC.
 - Fixed the PDF creation date (Issue #455)
+- Fixed a potential stack overflow bug with BMP images (Issue #456)
 - Fixed a compile issue when libpng was not available (Issue #458)
 
 

diff --git a/doc/1-intro.html b/doc/1-intro.html
@@ -2,7 +2,7 @@
 <head>
 	<meta name="author" content="Michael R Sweet">
 	<meta name="copyright" content="Copyright &copy; 1997-2021, All Rights Reserved.">
-	<meta name="docversion" content="htmldoc-1.9.13">
+	<meta name="docversion" content="htmldoc-1.9.14">
 	<meta name="keywords" content="Software">
 	<title>HTMLDOC Users Manual</title>
 </head>

diff --git a/doc/2-using.html b/doc/2-using.html
@@ -109,7 +109,7 @@ <h3>Setting the Title File</h3>
 <kbd>htmldoc --titlefile filename.html ... ENTER</kbd>
 </pre>
 
-<p>HTMLDOC supports BMP, GIF, JPEG, and PNG images, as well as generic HTML or Markdown text you supply for the title page(s).</p>
+<p>HTMLDOC supports GIF, JPEG, and PNG images, as well as generic HTML or Markdown text you supply for the title page(s).</p>
 
 
 <h2><a name='CGI'>Using HTMLDOC on a Web Server</a></h2>

diff --git a/doc/3-cmdref.html b/doc/3-cmdref.html
@@ -95,7 +95,7 @@ <H3>--bodyfont typeface</H3>
 
 <H3>--bodyimage filename</H3>
 
-<P>The <CODE>--bodyimage</CODE> option specifies the background image for all pages in the document. The supported formats are BMP, GIF, JPEG, and PNG.
+<P>The <CODE>--bodyimage</CODE> option specifies the background image for all pages in the document. The supported formats are GIF, JPEG, and PNG.
 
 <H3>--book</H3>
 
@@ -384,7 +384,7 @@ <H3>--helpdir directory</H3>
 
 <h3>--hfimage<i>N</i> filename</h3>
 
-<p>The <code>--hfimage<i>N</i></code> option specifies an image to use in the header and/or footer, where N is a number from 1 to 10.  The supported formats are BMP, GIF, JPEG, and PNG.</p>
+<p>The <code>--hfimage<i>N</i></code> option specifies an image to use in the header and/or footer, where N is a number from 1 to 10.  The supported formats are GIF, JPEG, and PNG.</p>
 
 <H3>--jpeg[=quality]</H3>
 
@@ -407,7 +407,7 @@ <H3>--left margin</H3>
 <!-- NEED 5in -->
 <H3>--letterhead filename</H3>
 
-<P>The <CODE>--letterhead</CODE> option specifies the letterhead image for the page headers and footers for PostScript and PDF files. The supported formats are BMP, GIF, JPEG, and PNG.</p>
+<P>The <CODE>--letterhead</CODE> option specifies the letterhead image for the page headers and footers for PostScript and PDF files. The supported formats are GIF, JPEG, and PNG.</p>
 
 <blockquote><b>Note:</b> You need to use the <CODE>--header</CODE> and/or <CODE>--footer</CODE> options with the <CODE>L</CODE> parameter or use the corresponding HTML page comments to display the logo image in the header or footer.</blockquote>
 
@@ -426,7 +426,7 @@ <H3>--linkstyle style</H3>
 <!-- NEED 5in -->
 <H3>--logoimage filename</H3>
 
-<P>The <CODE>--logoimage</CODE> option specifies the logo image for the HTML navigation bar and page headers and footers for PostScript and PDF files. The supported formats are BMP, GIF, JPEG, and PNG.</p>
+<P>The <CODE>--logoimage</CODE> option specifies the logo image for the HTML navigation bar and page headers and footers for PostScript and PDF files. The supported formats are GIF, JPEG, and PNG.</p>
 
 <blockquote><b>Note:</b> You need to use the <CODE>--header</CODE> and/or <CODE>--footer</CODE> options with the <CODE>l</CODE> parameter or use the corresponding HTML page comments to display the logo image in the header or footer.</blockquote>
 
@@ -694,7 +694,7 @@ <H3>--titlefile filename</H3>
 
 <H3>--titleimage filename</H3>
 
-<p>The <CODE>--titleimage</CODE> option specifies the title image for the title page. The supported formats are BMP, GIF, JPEG, and PNG.
+<p>The <CODE>--titleimage</CODE> option specifies the title image for the title page. The supported formats are GIF, JPEG, and PNG.
 
 <H3>--tocfooter lcr</H3>
 

diff --git a/doc/4-htmlref.html b/doc/4-htmlref.html
@@ -476,9 +476,9 @@ <H3>Numbered Headings</H3>
 
 <H2><A NAME="IMAGES">Images</A></H2>
 
-HTMLDOC supports loading of BMP, GIF, JPEG, and PNG image files.
-EPS and other types of image files are not supported at this
-time.
+HTMLDOC supports loading of GIF, JPEG, and PNG image files.  BMP image support
+is deprecated and will be removed in a future version of HTMLDOC.  EPS and other
+types of image files are not supported at this time.
 
 <!-- NEED 2in -->
 

diff --git a/htmldoc/image.cxx b/htmldoc/image.cxx
@@ -916,7 +916,7 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
   colors_used      = (int)read_dword(fp);
   read_dword(fp);
 
-  if (img->width <= 0 || img->width > 8192 || img->height <= 0 || img->height > 8192)
+  if (img->width <= 0 || img->width > 8192 || img->height <= 0 || img->height > 8192 || info_size < 0)
     return (-1);
 
   if (info_size > 40)
@@ -928,7 +928,7 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
   // Get colormap...
   if (colors_used == 0 && depth <= 8)
     colors_used = 1 << depth;
-  else if (colors_used > 256)
+  else if (colors_used < 0 || colors_used > 256)
     return (-1);
 
   fread(colormap, (size_t)colors_used, 4, fp);