[gimp] pdb: set_dither_matrix(): check that the matrix array has the right size

[Michael Natterer <mitch src gnome org>]

commit 02038d5dd3092e09831f9a86cd85577bb7ce7a6d
Author: Michael Natterer <mitch gimp org>
Date:   Sat Oct 8 16:30:07 2011 +0200

    pdb: set_dither_matrix(): check that the matrix array has the right size
    
    Fixes a way to easily crash GIMP.

 app/pdb/convert-cmds.c       |   13 ++++++++++++-
 tools/pdbgen/pdb/convert.pdb |   13 +++++++++++--
 2 files changed, 23 insertions(+), 3 deletions(-)
---
diff --git a/app/pdb/convert-cmds.c b/app/pdb/convert-cmds.c
index 612cc04..9d3b8a4 100644
--- a/app/pdb/convert-cmds.c
+++ b/app/pdb/convert-cmds.c
@@ -187,15 +187,26 @@ image_convert_set_dither_matrix_invoker (GimpProcedure      *procedure,
   gboolean success = TRUE;
   gint32 width;
   gint32 height;
+  gint32 matrix_length;
   const guint8 *matrix;
 
   width = g_value_get_int (&args->values[0]);
   height = g_value_get_int (&args->values[1]);
+  matrix_length = g_value_get_int (&args->values[2]);
   matrix = gimp_value_get_int8array (&args->values[3]);
 
   if (success)
     {
-      gimp_image_convert_set_dither_matrix (matrix, width, height);
+      if (matrix_length == width * height)
+        {
+          gimp_image_convert_set_dither_matrix (matrix, width, height);
+        }
+      else
+        {
+          g_set_error_literal (error, GIMP_PDB_ERROR, GIMP_PDB_INVALID_ARGUMENT,
+                               "Dither matrix length must be width * height");
+          success = FALSE;
+        }
     }
 
   return gimp_procedure_get_return_values (procedure, success,
diff --git a/tools/pdbgen/pdb/convert.pdb b/tools/pdbgen/pdb/convert.pdb
index 016842b..9490117 100644
--- a/tools/pdbgen/pdb/convert.pdb
+++ b/tools/pdbgen/pdb/convert.pdb
@@ -193,7 +193,7 @@ HELP
 	  desc => 'Height of the matrix (0 to reset to default matrix)' },
 	{ name => 'matrix', type => 'int8array',
 	  desc => 'The matrix -- all values must be >= 1',
-	  array => { name => 'matrix_length', type => '1 <= int32 <= 1024', dead => 1,
+	  array => { name => 'matrix_length', type => '1 <= int32 <= 1024',
                      desc => "The length of 'matrix'" }
 	  },
     );
@@ -201,7 +201,16 @@ HELP
     %invoke = (
 	code => <<'CODE'
 {
-  gimp_image_convert_set_dither_matrix (matrix, width, height);
+  if (matrix_length == width * height)
+    {
+      gimp_image_convert_set_dither_matrix (matrix, width, height);
+    }
+  else
+    {
+      g_set_error_literal (error, GIMP_PDB_ERROR, GIMP_PDB_INVALID_ARGUMENT,
+                           "Dither matrix length must be width * height");
+      success = FALSE;
+    }
 }
 CODE
     );