# HG changeset patch
# User Jason Rumney <jasonr@gnu.org>
# Date 1206716252 0
# Node ID 296f5c781a2b6e8aff2517c286b78354d99dd2db
# Parent  e269fd8e658f0abad1330503eb0b717b75b11f8d
(pbm_load): Allow color values up to 65535.
Throw an error if max_color_idx is outside the supported range.
Report an error when image size is invalid.
Read two bytes at a time when raw images have max_color_idx above 255.

diff -r e269fd8e658f -r 296f5c781a2b src/image.c
--- a/src/image.c	Fri Mar 28 11:17:05 2008 +0000
+++ b/src/image.c	Fri Mar 28 14:57:32 2008 +0000
@@ -5776,13 +5776,18 @@
   if (type != PBM_MONO)
     {
       max_color_idx = pbm_scan_number (&p, end);
-      if (raw_p && max_color_idx > 255)
-	max_color_idx = 255;
-    }
-
-  if (!check_image_size (f, width, height)
-      || (type != PBM_MONO && max_color_idx < 0))
-    goto error;
+      if (max_color_idx > 65535 || max_color_idx < 0)
+	{
+	  image_error ("Unsupported maximum PBM color value", Qnil, Qnil);
+	  goto error;
+	}
+    }
+
+  if (!check_image_size (f, width, height))
+    {
+      image_error ("Invalid image size", Qnil, Qnil);
+      goto error;
+    }
 
   if (!x_create_x_image_and_pixmap (f, width, height, 0,
 				    &ximg, &img->pixmap))
@@ -5842,10 +5847,13 @@
     }
   else
     {
-      if (raw_p
-	  && ((type == PBM_GRAY)
-	      ? (p + height * width > end)
-	      : (p + 3 * height * width > end)))
+      int expected_size = height * width;
+      if (max_color_idx > 255)
+	expected_size *= 2;
+      if (type == PBM_COLOR)
+	expected_size *= 3;
+
+      if (raw_p && p + expected_size > end)
 	{
 	  x_destroy_x_image (ximg);
 	  x_clear_image (f, img);
@@ -5859,13 +5867,25 @@
 	  {
 	    int r, g, b;
 
-	    if (type == PBM_GRAY)
-	      r = g = b = raw_p ? *p++ : pbm_scan_number (&p, end);
+	    if (type == PBM_GRAY && raw_p)
+	      {
+		r = g = b = *p++;
+		if (max_color_idx > 255)
+		  r = g = b = r * 256 + *p++;
+	      }
+	    else if (type == PBM_GRAY)
+	      r = g = b = pbm_scan_number (&p, end);
 	    else if (raw_p)
 	      {
 		r = *p++;
+		if (max_color_idx > 255)
+		  r = r * 256 + *p++;
 		g = *p++;
+		if (max_color_idx > 255)
+		  g = g * 256 + *p++;
 		b = *p++;
+		if (max_color_idx > 255)
+		  b = b * 256 + *p++;
 	      }
 	    else
 	      {