Backport of changes from 2.x branch to fix CVE-2009-2294

The vulnerability is triggered by HTML pages with embedded PNG images,
the Png_datainfo_callback function does not properly validate the width
and height of the image. Specific PNG images with large width and height
can be crafted to trigger the vulnerability.

http://www.ocert.org/advisories/ocert-2009-008.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2294

--- src/gif.c
+++ src/gif.c
@@ -848,6 +848,16 @@ static size_t Gif_do_img_desc(DilloGif *gif, void *Buf,
 
    gif->Width   = LM_to_uint(buf[4], buf[5]);
    gif->Height  = LM_to_uint(buf[6], buf[7]);
+
+   /* check max image size */
+   if (gif->Width <= 0 || gif->Height <= 0 ||
+       gif->Width > IMAGE_MAX_AREA / gif->Height) {
+      DEBUG_MSG(5, "Gif_do_img_desc: suspicious image size request %ux%u\n",
+      gif->Width, gif->Height);
+      gif->state = 999;
+      return 0;
+   }
+
    gif->linebuf = g_malloc(gif->Width);
 
    a_Dicache_set_parms(gif->url, gif->version, gif->Image,
--- src/html.c
+++ src/html.c
@@ -2459,8 +2459,6 @@ static DilloImage *Html_add_new_image(DilloHtml *html, char *tag,
                                       gint tagsize, DwStyle *style_attrs,
                                       gboolean add)
 {
-   const int MAX_W = 6000, MAX_H = 6000;
-
    DilloImage *Image;
    char *width_ptr, *height_ptr, *alt_ptr;
    const char *attrbuf;
@@ -2484,7 +2482,14 @@ static DilloImage *Html_add_new_image(DilloHtml *html, char *tag,
       s_h = Html_parse_length (html, height_ptr);
       h = (DW_STYLE_IS_ABS_LENGTH(s_h)) ? DW_STYLE_ABS_LENGTH_VAL(s_h) : 0;
    }
-   if (w < 0 || h < 0 || abs(w*h) > MAX_W * MAX_H) {
+   /* Check for suspicious image size request that would cause
+    * an excessive amount of memory to be allocated for the 
+    * image buffer.
+    * Be careful to avoid integer overflows during the checks.
+    */
+    if (w < 0 || h < 0 ||
+        w > IMAGE_MAX_AREA || h > IMAGE_MAX_AREA ||
+        (h > 0 &&  w > IMAGE_MAX_AREA / h)) {
       g_free(width_ptr);
       g_free(height_ptr);
       width_ptr = height_ptr = NULL;
--- src/image.h
+++ src/image.h
@@ -8,6 +8,16 @@
 #include "dw_image.h"
 #include "bitvec.h"
 
+/*
+ * Defines
+ */
+
+/* Arbitrary maximum for image size (to avoid image size-crafting attacks). */
+#define IMAGE_MAX_AREA  (6000 * 6000)
+
+/*
+ * Types
+ */
 
 typedef struct _DilloImage DilloImage;
 
--- src/jpeg.c
+++ src/jpeg.c
@@ -287,6 +287,17 @@ static void Jpeg_write(DilloJpeg *jpeg, void *Buf, guint BufSize)
          else
             DEBUG_MSG(5, "jpeg: can't handle %d component images\n",
                       jpeg->cinfo.num_components);
+
+         /* check max image size */
+         if (jpeg->cinfo.image_width <= 0 || jpeg->cinfo.image_height <= 0 ||
+             jpeg->cinfo.image_width > IMAGE_MAX_AREA / jpeg->cinfo.image_height) {
+                DEBUG_MSG(5, "Jpeg_write: suspicious image size request %ux%u\n",
+                jpeg->cinfo.image_width,
+                jpeg->cinfo.image_height);
+            jpeg->state = DILLO_JPEG_ERROR;
+            return;
+         }
+
          a_Dicache_set_parms(jpeg->url, jpeg->version, jpeg->Image,
                              (guint)jpeg->cinfo.image_width,
                              (guint)jpeg->cinfo.image_height,
--- src/png.c
+++ src/png.c
@@ -147,6 +147,15 @@ Png_datainfo_callback(png_structp png_ptr, png_infop info_ptr)
    png_get_IHDR(png_ptr, info_ptr, &png->width, &png->height,
                 &bit_depth, &color_type, &interlace_type, NULL, NULL);
 
+   /* check max image size */
+   if (png->width <= 0 || png->height <= 0 ||
+       png->width > IMAGE_MAX_AREA / png->height) {
+      DEBUG_MSG(5, "Png_datainfo_callback: suspicious image size request %ldx%ld\n",
+          png->width, png->height);
+      Png_error_handling(png_ptr, "Aborting...");
+      return; /* not reached */
+   }
+
    DEBUG_MSG(5, "Png_datainfo_callback: png->width  = %ld\n"
              "Png_datainfo_callback: png->height = %ld\n",
              png->width, png->height);