Fix null pointer dereference on very large images.

If xcursorgen encounters a PNG file which is larger than 32767 pixels
in width or height, a null pointer dereference occurs because the
return value of XcursorImageCreate is not checked.

The largest possible value is 32767 for libXcursor, which is a hard
coded limit due to a 16 bit integer used (0x7FFF).

Fixes: https://gitlab.freedesktop.org/xorg/app/xcursorgen/issues/1

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/xcursorgen.c b/xcursorgen.c
index f292f19..d664799 100644
--- a/xcursorgen.c
+++ b/xcursorgen.c
@@ -262,6 +262,12 @@ load_image (struct flist *list, const char *prefix)
   png_read_update_info (png, info);
 
   image = XcursorImageCreate (width, height);
+  if (image == NULL)
+    {
+      fclose (fp);
+      png_destroy_read_struct (&png, &info, NULL);
+      return NULL;
+    }
 
   image->size = list->size;
   image->xhot = list->xhot;