https://sources.debian.org/data/main/f/freeimage/3.18.0%2Bds2-10/debian/patches/r1848-improved-PFM-plugin-against-malicious-images.patch

Origin: upstream, r1848
Index: Source/FreeImage/PluginPFM.cpp
---
diff --git a/Source/FreeImage/PluginPFM.cpp b/Source/FreeImage/PluginPFM.cpp
--- a/Source/FreeImage/PluginPFM.cpp	(revision 1847)
+++ b/Source/FreeImage/PluginPFM.cpp	(revision 1848)
@@ -23,6 +23,12 @@
 #include "Utilities.h"
 
 // ==========================================================
+// Plugin Interface
+// ==========================================================
+
+static int s_format_id;
+
+// ==========================================================
 // Internal functions
 // ==========================================================
 
@@ -59,6 +65,9 @@
 
 /**
 Get an integer value from the actual position pointed by handle
+@param io
+@param handle
+@return Returns -1 in case of failure, returns the found number otherwise
 */
 static int
 pfm_get_int(FreeImageIO *io, fi_handle handle) {
@@ -65,70 +74,72 @@
     char c = 0;
 	BOOL bFirstChar;
 
-    // skip forward to start of next number
+	try {
 
-	if(!io->read_proc(&c, 1, 1, handle)) {
-		throw FI_MSG_ERROR_PARSING;
-	}
+		// skip forward to start of next number
 
-    while (1) {
-        // eat comments
+		if (io->read_proc(&c, 1, 1, handle) != 1) {
+			throw FI_MSG_ERROR_PARSING;
+		}
 
-        if (c == '#') {
-			// if we're at a comment, read to end of line
+		while (1) {
+			// eat comments
 
-            bFirstChar = TRUE;
+			if (c == '#') {
+				// if we're at a comment, read to end of line
 
-            while (1) {
-				if(!io->read_proc(&c, 1, 1, handle)) {
-					throw FI_MSG_ERROR_PARSING;
-				}
+				bFirstChar = TRUE;
 
-				if (bFirstChar && c == ' ') {
-					// loop off 1 sp after #
-					bFirstChar = FALSE;
-				} else if (c == '\n') {
-					break;
+				while (1) {
+					if (io->read_proc(&c, 1, 1, handle) != 1) {
+						throw FI_MSG_ERROR_PARSING;
+					}
+
+					if (bFirstChar && c == ' ') {
+						// loop off 1 sp after #
+						bFirstChar = FALSE;
+					}
+					else if (c == '\n') {
+						break;
+					}
 				}
 			}
-		}
 
-        if (c >= '0' && c <='9') {
-			// we've found what we were looking for
-            break;
-		}
+			if (c >= '0' && c <= '9') {
+				// we've found what we were looking for
+				break;
+			}
 
-		if(!io->read_proc(&c, 1, 1, handle)) {
-			throw FI_MSG_ERROR_PARSING;
+			if (io->read_proc(&c, 1, 1, handle) != 1) {
+				throw FI_MSG_ERROR_PARSING;
+			}
 		}
-    }
 
-    // we're at the start of a number, continue until we hit a non-number
+		// we're at the start of a number, continue until we hit a non-number
 
-    int i = 0;
+		int i = 0;
 
-    while (1) {
-        i = (i * 10) + (c - '0');
+		while (1) {
+			i = (i * 10) + (c - '0');
 
-		if(!io->read_proc(&c, 1, 1, handle)) {
-			throw FI_MSG_ERROR_PARSING;
-		}
+			if (io->read_proc(&c, 1, 1, handle) != 1) {
+				throw FI_MSG_ERROR_PARSING;
+			}
 
-		if (c < '0' || c > '9') {
-			break;
+			if (c < '0' || c > '9') {
+				break;
+			}
 		}
-    }
 
-    return i;
+		return i;
+	}
+	catch (const char *message) {
+		FreeImage_OutputMessageProc(s_format_id, message);
+		return -1;
+	}
 }
 
 // ==========================================================
-// Plugin Interface
-// ==========================================================
-
-static int s_format_id;
-
-// ==========================================================
 // Plugin Implementation
 // ==========================================================
 
@@ -230,8 +241,12 @@
 		}
 
 		// Read the header information: width, height and the scale value
-		unsigned width  = (unsigned) pfm_get_int(io, handle);
-		unsigned height = (unsigned) pfm_get_int(io, handle);
+		int width = pfm_get_int(io, handle);
+		int height = pfm_get_int(io, handle);
+		if ((width <= 0) || (height <= 0)) {
+			throw FI_MSG_ERROR_PARSING;
+		}
+
 		float scalefactor = 1;
 
 		BOOL bResult = pfm_get_line(io, handle, line_buffer, PFM_MAXLINE);
@@ -262,7 +277,7 @@
 				throw FI_MSG_ERROR_MEMORY;
 			}
 
-			for (unsigned y = 0; y < height; y++) {	
+			for (int y = 0; y < height; y++) {	
 				FIRGBF *bits = (FIRGBF*)FreeImage_GetScanLine(dib, height - 1 - y);
 
 				if(io->read_proc(lineBuffer, sizeof(float), lineWidth, handle) != lineWidth) {
@@ -271,7 +286,7 @@
 				float *channel = lineBuffer;
 				if(scalefactor > 0) {
 					// MSB
-					for (unsigned x = 0; x < width; x++) {
+					for (int x = 0; x < width; x++) {
 						REVERSEBYTES(channel++, &bits[x].red);
 						REVERSEBYTES(channel++, &bits[x].green);
 						REVERSEBYTES(channel++, &bits[x].blue);
@@ -278,7 +293,7 @@
 					}
 				} else {
 					// LSB					
-					for (unsigned x = 0; x < width; x++) {
+					for (int x = 0; x < width; x++) {
 						bits[x].red		= *channel++;
 						bits[x].green	= *channel++;
 						bits[x].blue	= *channel++;
@@ -296,7 +311,7 @@
 				throw FI_MSG_ERROR_MEMORY;
 			}
 
-			for (unsigned y = 0; y < height; y++) {	
+			for (int y = 0; y < height; y++) {	
 				float *bits = (float*)FreeImage_GetScanLine(dib, height - 1 - y);
 
 				if(io->read_proc(lineBuffer, sizeof(float), lineWidth, handle) != lineWidth) {
@@ -305,12 +320,12 @@
 				float *channel = lineBuffer;
 				if(scalefactor > 0) {
 					// MSB - File is Big endian
-					for (unsigned x = 0; x < width; x++) {
+					for (int x = 0; x < width; x++) {
 						REVERSEBYTES(channel++, &bits[x]);
 					}
 				} else {
 					// LSB - File is Little Endian
-					for (unsigned x = 0; x < width; x++) {
+					for (int x = 0; x < width; x++) {
 						bits[x] = *channel++;
 					}
 				}
@@ -323,9 +338,12 @@
 		return dib;
 
 	} catch (const char *text)  {
-		if(lineBuffer) free(lineBuffer);
-		if(dib) FreeImage_Unload(dib);
-
+		if (lineBuffer) {
+			free(lineBuffer);
+		}
+		if (dib) {
+			FreeImage_Unload(dib);
+		}
 		if(NULL != text) {
 			FreeImage_OutputMessageProc(s_format_id, text);
 		}