[w3m-dev 03436] Check image size

* file.c (process_img): check w > MAX_IMAGE_SIZE
	(HTMLlineproc2body): check w,h > MAX_IMAGE_SIZE
* fm.h (MAX_IMAGE_SIZE): added
* image.c (getImageSize): check w,h,width,height > MAX_IMAGE_SIZE
From: Hiroyuki Ito <hito@crl.go.jp>

4 files changed, 25 insertions, 10 deletions

diff --git a/ChangeLog b/ChangeLog
index c370b9c..70920f4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2002-11-16  Hiroyuki Ito <hito@crl.go.jp>
+
+	* [w3m-dev 03436] Check image size
+	* file.c (process_img): check w > MAX_IMAGE_SIZE
+		(HTMLlineproc2body): check w,h > MAX_IMAGE_SIZE
+	* fm.h (MAX_IMAGE_SIZE): added
+	* image.c (getImageSize): check w,h,width,height > MAX_IMAGE_SIZE
+
 2002-11-16  Hironori SAKAMOTO <hsaka@mth.biglobe.ne.jp>
 
 	* [w3m-dev 03435] save image with SAVE
@@ -4766,4 +4774,4 @@ a	* [w3m-dev 03276] compile error on EWS4800
 	* release-0-2-1
 	* import w3m-0.2.1
 
-$Id: ChangeLog,v 1.519 2002/11/15 15:51:23 ukai Exp $
+$Id: ChangeLog,v 1.520 2002/11/15 15:56:36 ukai Exp $
diff --git a/file.c b/file.c
index e4a723f..c4eaa09 100644
--- a/file.c
+++ b/file.c
@@ -1,4 +1,4 @@
-/* $Id: file.c,v 1.118 2002/11/15 15:51:23 ukai Exp $ */
+/* $Id: file.c,v 1.119 2002/11/15 15:56:36 ukai Exp $ */
 #include "fm.h"
 #include <sys/types.h>
 #include "myctype.h"
@@ -2926,6 +2926,8 @@ process_img(struct parsed_tag *tag, int width)
 		w = (int)(w * image_scale / 100 + 0.5);
 		if (w == 0)
 		    w = 1;
+		else if (w > MAX_IMAGE_SIZE)
+		    w = MAX_IMAGE_SIZE;
 	    }
 	}
 #endif
@@ -2938,6 +2940,8 @@ process_img(struct parsed_tag *tag, int width)
 		i = (int)(i * image_scale / 100 + 0.5);
 		if (i == 0)
 		    i = 1;
+		else if (i > MAX_IMAGE_SIZE)
+		    i = MAX_IMAGE_SIZE;
 	    }
 	    else {
 		i = -1;
@@ -4949,8 +4953,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
 			    image->url = parsedURL2Str(&u)->ptr;
 			    image->ext = filename_extension(u.file, TRUE);
 			    image->cache = NULL;
-			    image->width = w;
-			    image->height = h;
+			    image->width = (w > MAX_IMAGE_SIZE) ? MAX_IMAGE_SIZE: w;
+			    image->height = (h > MAX_IMAGE_SIZE) ? MAX_IMAGE_SIZE: h;
 			    image->xoffset = xoffset;
 			    image->yoffset = yoffset;
 			    image->y = currentLn(buf) - top;
diff --git a/fm.h b/fm.h
index 6bac9ba..a9229d3 100644
--- a/fm.h
+++ b/fm.h
@@ -1,4 +1,4 @@
-/* $Id: fm.h,v 1.78 2002/11/15 15:51:24 ukai Exp $ */
+/* $Id: fm.h,v 1.79 2002/11/15 15:56:36 ukai Exp $ */
 /* 
  * w3m: WWW wo Miru utility
  * 
@@ -77,6 +77,7 @@ void bzero(void *, int);
 
 #ifdef USE_IMAGE
 #define MAX_IMAGE 1000
+#define MAX_IMAGE_SIZE 10000
 
 #define DEFAULT_PIXEL_PER_CHAR  7.0	/* arbitrary */
 #define DEFAULT_PIXEL_PER_LINE  14.0	/* arbitrary */
diff --git a/image.c b/image.c
index 1c56c92..4868900 100644
--- a/image.c
+++ b/image.c
@@ -1,4 +1,4 @@
-/* $Id: image.c,v 1.17 2002/11/15 15:51:24 ukai Exp $ */
+/* $Id: image.c,v 1.18 2002/11/15 15:56:36 ukai Exp $ */
 
 #include "fm.h"
 #include <sys/types.h>
@@ -630,14 +630,16 @@ getImageSize(ImageCache * cache)
     if (h == 0)
 	h = 1;
     if (cache->width < 0 && cache->height < 0) {
-	cache->width = w;
-	cache->height = h;
+	cache->width = (w > MAX_IMAGE_SIZE) ? MAX_IMAGE_SIZE: w;
+	cache->height = (h > MAX_IMAGE_SIZE) ? MAX_IMAGE_SIZE: h;
     }
     else if (cache->width < 0) {
-	cache->width = (int)((double)cache->height * w / h + 0.5);
+        int tmp = (int)((double)cache->height * w / h + 0.5);
+	cache->width = (tmp > MAX_IMAGE_SIZE) ? MAX_IMAGE_SIZE: tmp;
     }
     else if (cache->height < 0) {
-	cache->height = (int)((double)cache->width * h / w + 0.5);
+        int tmp = (int)((double)cache->width * h / w + 0.5);
+	cache->height = (tmp > MAX_IMAGE_SIZE) ? MAX_IMAGE_SIZE: tmp;
     }
     if (cache->width == 0)
 	cache->width = 1;