lumas/luma.c: check lower bounds on input

Upper bounds are not checked yet but maybe should be.
Partially fixes these Coverity findings:

CID 709423: Untrusted value as argument (TAINTED_SCALAR) [select defect]
370                        this.w = atoi( argv[ ++ arg ] );
371                else if ( !strcmp( argv[ arg ], "-h" ) )
CID 709423: Untrusted value as argument (TAINTED_SCALAR) [select defect]
372                        this.h = atoi( argv[ ++ arg ] );
373                else if ( !strcmp( argv[ arg ], "-bands" ) )
CID 709423: Untrusted value as argument (TAINTED_SCALAR) [select defect]
374                        this.bands = atoi( argv[ ++ arg ] );

diff --git a/src/modules/lumas/luma.c b/src/modules/lumas/luma.c
index 088961229c35ab91a6fed3ad574d0c80f0b24a5c..ddd39c78e3725e930f1bc36eb82908465205d564 100644 (file)
--- a/src/modules/lumas/luma.c
+++ b/src/modules/lumas/luma.c
@@ -367,11 +367,31 @@ int main( int argc, char **argv )
                else if ( !strcmp( argv[ arg ], "-type" ) )
                        this.type = atoi( argv[ ++ arg ] );
                else if ( !strcmp( argv[ arg ], "-w" ) )
-                       this.w = atoi( argv[ ++ arg ] );
+               {
+                       int tmp = atoi( argv[ ++ arg ] );
+                       // TODO: is there an upper bound?
+                       if ( tmp )
+                               this.w = tmp;
+                       else
+                               return 1;
+               }
                else if ( !strcmp( argv[ arg ], "-h" ) )
-                       this.h = atoi( argv[ ++ arg ] );
+               {
+                       int tmp = atoi( argv[ ++ arg ] );
+                       // TODO: is there an upper bound?
+                       if ( tmp )
+                               this.h = tmp;
+                       else return 1;
+               }
                else if ( !strcmp( argv[ arg ], "-bands" ) )
-                       this.bands = atoi( argv[ ++ arg ] );
+               {
+                       int tmp = atoi( argv[ ++ arg ] );
+                       // TODO: is there an upper bound?
+                       if ( tmp >= 0 )
+                               this.bands = tmp;
+                       else
+                               return 1;
+               }
                else if ( !strcmp( argv[ arg ], "-rband" ) )
                        this.rband = atoi( argv[ ++ arg ] );
                else if ( !strcmp( argv[ arg ], "-hmirror" ) )