@@ 0,0 1,129 @@
+Copied from Debian.
+
+Description: fix integer overflow
+Origin: upstream
+ http://freeimage.cvs.sourceforge.net/viewvc/freeimage/FreeImage/Source/FreeImage/PluginPCX.cpp?view=patch&r1=1.17&r2=1.18&pathrev=MAIN
+ http://freeimage.cvs.sourceforge.net/viewvc/freeimage/FreeImage/Source/FreeImage/PluginPCX.cpp?view=patch&r1=1.18&r2=1.19&pathrev=MAIN
+Bug-Debian: https://bugs.debian.org/797165
+Last-Update: 2015-09-14
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+Index: freeimage/Source/FreeImage/PluginPCX.cpp
+===================================================================
+--- freeimage.orig/Source/FreeImage/PluginPCX.cpp
++++ freeimage/Source/FreeImage/PluginPCX.cpp
+@@ -347,12 +347,14 @@ Load(FreeImageIO *io, fi_handle handle,
+
+ try {
+ // check PCX identifier
+-
+- long start_pos = io->tell_proc(handle);
+- BOOL validated = pcx_validate(io, handle);
+- io->seek_proc(handle, start_pos, SEEK_SET);
+- if(!validated) {
+- throw FI_MSG_ERROR_MAGIC_NUMBER;
++ // (note: should have been already validated using FreeImage_GetFileType but check again)
++ {
++ long start_pos = io->tell_proc(handle);
++ BOOL validated = pcx_validate(io, handle);
++ io->seek_proc(handle, start_pos, SEEK_SET);
++ if(!validated) {
++ throw FI_MSG_ERROR_MAGIC_NUMBER;
++ }
+ }
+
+ // process the header
+@@ -366,20 +368,38 @@ Load(FreeImageIO *io, fi_handle handle,
+ SwapHeader(&header);
+ #endif
+
+- // allocate a new DIB
++ // process the window
++ const WORD *window = header.window; // left, upper, right,lower pixel coord.
++ const int left = window[0];
++ const int top = window[1];
++ const int right = window[2];
++ const int bottom = window[3];
+
+- unsigned width = header.window[2] - header.window[0] + 1;
+- unsigned height = header.window[3] - header.window[1] + 1;
+- unsigned bitcount = header.bpp * header.planes;
+-
+- if (bitcount == 24) {
+- dib = FreeImage_AllocateHeader(header_only, width, height, bitcount, FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK);
+- } else {
+- dib = FreeImage_AllocateHeader(header_only, width, height, bitcount);
++ // check image size
++ if((left >= right) || (top >= bottom)) {
++ throw FI_MSG_ERROR_PARSING;
+ }
+
+- // if the dib couldn't be allocated, throw an error
++ const unsigned width = right - left + 1;
++ const unsigned height = bottom - top + 1;
++ const unsigned bitcount = header.bpp * header.planes;
++
++ // allocate a new DIB
++ switch(bitcount) {
++ case 1:
++ case 4:
++ case 8:
++ dib = FreeImage_AllocateHeader(header_only, width, height, bitcount);
++ break;
++ case 24:
++ dib = FreeImage_AllocateHeader(header_only, width, height, bitcount, FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK);
++ break;
++ default:
++ throw FI_MSG_ERROR_DIB_MEMORY;
++ break;
++ }
+
++ // if the dib couldn't be allocated, throw an error
+ if (!dib) {
+ throw FI_MSG_ERROR_DIB_MEMORY;
+ }
+@@ -426,19 +446,23 @@ Load(FreeImageIO *io, fi_handle handle,
+
+ if (palette_id == 0x0C) {
+ BYTE *cmap = (BYTE*)malloc(768 * sizeof(BYTE));
+- io->read_proc(cmap, 768, 1, handle);
+
+- pal = FreeImage_GetPalette(dib);
+- BYTE *pColormap = &cmap[0];
++ if(cmap) {
++ io->read_proc(cmap, 768, 1, handle);
+
+- for(int i = 0; i < 256; i++) {
+- pal[i].rgbRed = pColormap[0];
+- pal[i].rgbGreen = pColormap[1];
+- pal[i].rgbBlue = pColormap[2];
+- pColormap += 3;
++ pal = FreeImage_GetPalette(dib);
++ BYTE *pColormap = &cmap[0];
++
++ for(int i = 0; i < 256; i++) {
++ pal[i].rgbRed = pColormap[0];
++ pal[i].rgbGreen = pColormap[1];
++ pal[i].rgbBlue = pColormap[2];
++ pColormap += 3;
++ }
++
++ free(cmap);
+ }
+
+- free(cmap);
+ }
+
+ // wrong palette ID, perhaps a gray scale is needed ?
+@@ -466,9 +490,9 @@ Load(FreeImageIO *io, fi_handle handle,
+ // calculate the line length for the PCX and the DIB
+
+ // length of raster line in bytes
+- unsigned linelength = header.bytes_per_line * header.planes;
++ const unsigned linelength = header.bytes_per_line * header.planes;
+ // length of DIB line (rounded to DWORD) in bytes
+- unsigned pitch = FreeImage_GetPitch(dib);
++ const unsigned pitch = FreeImage_GetPitch(dib);
+
+ // run-length encoding ?
+