[Magick-bugs] Creation of PDB fails

[1tms at gmx.de]

Dear ImageMagick Team!

This effect appeared in ImageMagick 6.3.7-2 on i686 Debian Linux/2.6.22-14.

I tried to create 4-greylevel images for a PALM handheld and encountered three problems.
This is the second:

The PDB (Palm Data Base) Reader / Writer is broken in multiple ways. I tried to fix
the things that are important for me. Now all example images that come with Image Viewer III
can be read correctly. The writer now respects the number of colors in an image.

Best,

Thomas.

---------------------------------------- cut here -------------------------------------------
$ cd coders; diff pdb.c pdb.c.new

36a37,43
>     20071202 TS * rewrote RLE decoder - old version could cause buffer overflows
>                 * failure of RLE decoding now thows error RLEDecoderError
>                 * fixed bug in RLE decoding - now all rows are decoded, not just
> 		  the first one
> 		* fixed bug in reader - record offsets now handled correctly
> 		* fixed bug in reader - only bits 0..2 indicate compression type
>                 * in writer: now using image color count instead of depth
150a158,159
> %    o length:  Number of bytes to read into buffer 'pixels'.
> %
153c162
< static MagickBooleanType DecodeImage(Image *image,unsigned char *pixels,
---
> static MagickBooleanType DecodeImage(Image *image, unsigned char *pixels,
156,184c165,195
<   long
<     pixel;
< 
<   register long
<     i;
< 
<   register unsigned char
<     *p;
< 
<   ssize_t
<     count;
< 
<   p=pixels;
<   while (p < (pixels+length))
<   {
<     pixel=ReadBlobByte(image);
<     if (pixel <= 0x80)
<       {
<         count=(ssize_t) (pixel+1);
<         for (i=0; i < (long) count; i++)
<           *p++=(unsigned char) ReadBlobByte(image);
<         continue;
<       }
<     count=(ssize_t) (pixel+1-0x80);
<     pixel=ReadBlobByte(image);
<     for (i=0; i < (long) count; i++)
<       *p++=(unsigned char) pixel;
<   }
<   return(MagickTrue);
---
> #define RLE_MODE_NONE -1
> #define RLE_MODE_COPY  0
> #define RLE_MODE_RUN   1
> 
> 	int           data = 0, count = 0;
> 	unsigned char *p;
> 	int           mode = RLE_MODE_NONE;
> 
> 	for (p = pixels; p < pixels + length; p++) {
> 		if (0 == count) {
> 			data = ReadBlobByte( image );
> 			if (-1 == data) return MagickFalse;
> 			if (data > 128) {
> 				mode  = RLE_MODE_RUN;
> 				count = data - 128 + 1;
> 				data  = ReadBlobByte( image );
> 				if (-1 == data) return MagickFalse;
> 			} else {
> 				mode  = RLE_MODE_COPY;
> 				count = data + 1;
> 			}
> 		}
> 
> 		if (RLE_MODE_COPY == mode) {
> 			data = ReadBlobByte( image );
> 			if (-1 == data) return MagickFalse;
> 		}
> 		*p = (unsigned char)data;
> 		--count;
> 	}
> 	return MagickTrue;
252,253c263,264
<   char
<     record_type,
---
>   unsigned char
>     attributes, // TS
263c274,275
<     offset,
---
>     img_offset, // TS
>     comment_offset = 0,
293a306
>     num_pad_bytes, // TS
339c352,353
<   offset=(long) ReadBlobMSBLong(image);
---
>   img_offset=(long) ReadBlobMSBLong(image); // TS
>   attributes=ReadBlobByte(image);
341,343c355
<   record_type=ReadBlobByte(image);
<   if (((record_type != 0x00) && (record_type != 0x01)) ||
<       (memcmp(tag,"\x40\x6f\x80",3) != 0))
---
>   if (count != 3  ||  memcmp(tag,"\x6f\x80\x00",3) != 0)
345,349c357
<   if ((offset-TellBlob(image)) == 6)
<     {
<       (void) ReadBlobByte(image);
<       (void) ReadBlobByte(image);
<     }
---
> 
352c360,361
<       offset=(long) ReadBlobMSBLong(image);
---
>       comment_offset=(long) ReadBlobMSBLong(image);
>       attributes=ReadBlobByte(image);
354,356c363
<       record_type=ReadBlobByte(image);
<       if (((record_type != 0x00) && (record_type != 0x01)) ||
<           (memcmp(tag,"\x40\x6f\x80",3) != 0))
---
>       if (count != 3  ||  memcmp(tag,"\x6f\x80\x01",3) != 0)
358,362d364
<       if ((offset-TellBlob(image)) == 6)
<         {
<           (void) ReadBlobByte(image);
<           (void) ReadBlobByte(image);
<         }
363a366,368
> 
>   num_pad_bytes = img_offset - TellBlob( image );
>   while (num_pad_bytes--) ReadBlobByte( image );
404c409,410
<   switch (pdb_image.version)
---
> 
>   switch (pdb_image.version & 7) // TS
409c415
<       count=(ssize_t) ReadBlob(image,packets,pixels);
---
>       count=(ssize_t) ReadBlob(image, packets * image -> rows, pixels);
415c421,422
<       (void) DecodeImage(image,pixels,packets);
---
>       if (!DecodeImage(image, pixels, packets * image -> rows))
> 	ThrowReaderException( CorruptImageError, "RLEDecoderError" ); // TS
420c427
<         "UnrecognizedImageCompressionType");
---
> 			   "UnrecognizedImageCompressionType" );
538a546
> 
543c551
<   if ((offset-TellBlob(image)) == 0)
---
>   if (pdb_info.number_records > 1) // TS
556a565,567
>       num_pad_bytes = comment_offset - TellBlob( image );
>       while (num_pad_bytes--) ReadBlobByte( image );
> 
752,756c763,773
<   bits_per_pixel=image->depth;
<   if (GetImageType(image,&image->exception) == BilevelType)
<     bits_per_pixel=1;
<   if ((bits_per_pixel != 1) && (bits_per_pixel != 2))
<     bits_per_pixel=4;
---
> 
>   if (image -> colors <= 2  ||  GetImageType( image, &image -> exception ) == BilevelType) { // TS
>     bits_per_pixel = 1;
>   } else if (image -> colors <= 4) {
>     bits_per_pixel = 2;
>   } else if (image -> colors <= 8) {
>     bits_per_pixel = 3;
>   } else {
>     bits_per_pixel = 4;
>   }
>