1 files changed, 21 insertions, 24 deletions

diff --git a/miscutils/fbsplash.c b/miscutils/fbsplash.c
index 330dd4d1d..a0f7d0dc2 100644
--- a/miscutils/fbsplash.c
+++ b/miscutils/fbsplash.c
@@ -216,36 +216,36 @@ static void fb_drawprogressbar(unsigned percent)
  */
 static void fb_drawimage(void)
 {
-	RESERVE_CONFIG_BUFFER(head, 256);
-	RESERVE_CONFIG_BUFFER(s, 80);
-	int theme_file;
+	char *head, *ptr;
+	FILE *theme_file;
 	unsigned char *pixline;
 	unsigned i, j, width, height, line_size;
 
-	memset(head, 0, sizeof(head));
-	theme_file = open_or_warn_stdin(G.image_filename);
+	theme_file = xfopen_stdin(G.image_filename);
+	head = xmalloc(256);
 
 	// parse ppm header
 	while (1) {
-		if (safe_read(theme_file, s, sizeof(s)) <= 0)
-			bb_error_msg_and_die("bad PPM file '%s'", G.image_filename);
-
-		if (s[0] == '#')
-			continue;
-
-		if (strlen(head) + strlen(s) >= sizeof(head))
-			bb_error_msg_and_die("bad PPM file '%s'", G.image_filename);
-
-		strcat(head, s);
-		if (head[0] != 'P' || head[1] != '6')
+		if (fgets(head, 256, theme_file) == NULL
+			/* do not overrun the buffer */
+			|| strlen(bb_common_bufsiz1) >= sizeof(bb_common_bufsiz1) - 256)
 			bb_error_msg_and_die("bad PPM file '%s'", G.image_filename);
 
+		ptr = memchr(head, '#', 256);
+		if (ptr != NULL)
+			*ptr = 0; /* ignore comments */
+		strcat(bb_common_bufsiz1, head);
 		// width, height, max_color_val
-		if (sscanf(head, "P6 %u %u %u", &width, &height, &i) == 3)
+		if (sscanf(bb_common_bufsiz1, "P6 %u %u %u", &width, &height, &i) == 3
+			&& i <= 255)
 			break;
-// TODO: i must be <= 255!
+		/* If we do not find a signature throughout the whole file then
+		   we will diagnose this via EOF on read in the head of the loop.  */
 	}
 
+	if (ENABLE_FEATURE_CLEAN_UP)
+		free(head);
+
 	line_size = width*3;
 	if (width > G.scr_var.xres)
 		width = G.scr_var.xres;
@@ -257,7 +257,7 @@ static void fb_drawimage(void)
 		unsigned char *pixel = pixline;
 		DATA *src = (DATA *)(G.addr + j * G.scr_fix.line_length);
 
-		if (safe_read(theme_file, pixline, line_size) != line_size)
+		if (fread(pixline, 1, line_size, theme_file) != line_size)
 			bb_error_msg_and_die("bad PPM file '%s'", G.image_filename);
 		for (i = 0; i < width; i++) {
 			unsigned thispix;
@@ -268,12 +268,9 @@ static void fb_drawimage(void)
 			pixel += 3;
 		}
 	}
-	if (ENABLE_FEATURE_CLEAN_UP) {
+	if (ENABLE_FEATURE_CLEAN_UP)
 		free(pixline);
-		RELEASE_CONFIG_BUFFER(s);
-		RELEASE_CONFIG_BUFFER(head);
-	}
-	close(theme_file);
+	fclose(theme_file);
 }