--- ray/src/common/readoct.c	1991/04/18 13:01:28	1.12
+++ ray/src/common/readoct.c	1992/03/12 12:18:18	2.3
@@ -1,4 +1,4 @@
-/* Copyright (c) 1986 Regents of the University of California */
+/* Copyright (c) 1991 Regents of the University of California */
 
 #ifndef lint
 static char SCCSid[] = "$SunId$ LBL";
@@ -18,14 +18,15 @@ static char SCCSid[] = "$SunId$ LBL";
 
 #include  "otypes.h"
 
-extern double  atof();
 static double  getflt();
 static long  getint();
 static char  *getstr();
+static int  getobj(), octerror();
 static OCTREE  getfullnode(), gettree();
 
 static char  *infn;			/* input file name */
 static FILE  *infp;			/* input file stream */
+static int  objsize;			/* size of stored OBJECT's */
 static OBJECT  objorig;			/* zeroeth object */
 static short  otypmap[NUMOTYPE+8];	/* object type map */
 
@@ -42,6 +43,7 @@ char  *ofn[];
 	int  nf;
 	OBJECT  fnobjects;
 	register int  i;
+	long  m;
 	
 	if (fname == NULL) {
 		infn = "standard input";
@@ -58,7 +60,8 @@ char  *ofn[];
 	if (checkheader(infp, OCTFMT, load&IO_INFO ? stdout : NULL) < 0)
 		octerror(USER, "not an octree");
 					/* check format */
-	if (getint(2) != OCTMAGIC)
+	if ((objsize = getint(2)-OCTMAGIC) <= 0 ||
+			objsize > MAXOBJSIZ || objsize > sizeof(long))
 		octerror(USER, "incompatible octree format");
 					/* get boundaries */
 	if (load & IO_BOUNDS) {
@@ -81,13 +84,15 @@ char  *ofn[];
 	if (load & IO_FILES)
 		ofn[nf] = NULL;
 					/* get number of objects */
-	fnobjects = getint(sizeof(OBJECT));
+	fnobjects = m = getint(objsize);
+	if (fnobjects != m)
+		octerror(USER, "too many objects");
 
 	if (load & IO_TREE) {
 						/* get the octree */
 		scene->cutree = gettree();
-						/* get the scene */
-		if (nf == 0 && load & IO_SCENE) {
+		if (load & IO_SCENE)		/* get the scene */
+		    if (nf == 0) {
 			for (i = 0; *getstr(sbuf); i++)
 				if ((otypmap[i] = otype(sbuf)) < 0) {
 					sprintf(errmsg, "unknown type \"%s\"",
@@ -96,18 +101,16 @@ char  *ofn[];
 				}
 			while (getobj() != OVOID)
 				;
-		}
-	}
-	fclose(infp);
-					/* consistency checks */
-	if (load & IO_SCENE) {
+		    } else {			/* consistency checks */
 					/* check object count */
-		if (nobjects != objorig+fnobjects)
-			octerror(USER, "bad object count; octree stale?");
+			if (nobjects != objorig+fnobjects)
+				octerror(USER, "bad object count; octree stale?");
 					/* check for non-surfaces */
-		if (nonsurfinset(objorig, fnobjects))
-			octerror(USER, "non-surface in set; octree stale?");
+			if (nonsurfinset(objorig, fnobjects))
+				octerror(USER, "modifier in tree; octree stale?");
+		    }
 	}
+	fclose(infp);
 	return(nf);
 }
 
@@ -133,12 +136,15 @@ getfullnode()			/* get a set, return fullnode */
 {
 	OBJECT  set[MAXSET+1];
 	register int  i;
+	register long  m;
 
-	set[0] = getint(sizeof(OBJECT));
-	if (set[0] > MAXSET)
+	if ((set[0] = getint(objsize)) > MAXSET)
 		octerror(USER, "bad set in getfullnode");
-	for (i = 1; i <= set[0]; i++)
-		set[i] = getint(sizeof(OBJECT)) + objorig;
+	for (i = 1; i <= set[0]; i++) {
+		m = getint(objsize) + objorig;
+		if ((set[i] = m) != m)
+			octerror(USER, "too many objects");
+	}
 	return(fullnode(set));
 }	
 
@@ -207,6 +213,7 @@ getobj()				/* get next object */
 	char  sbuf[MAXSTR];
 	int  obj;
 	register int  i;
+	register long  m;
 	register OBJREC  *objp;
 
 	i = getint(1);
@@ -217,8 +224,12 @@ getobj()				/* get next object */
 	objp = objptr(obj);
 	if ((objp->otype = otypmap[i]) < 0)
 		octerror(USER, "reference to unknown type");
-	if ((objp->omod = getint(sizeof(OBJECT))) != OVOID)
-		objp->omod += objorig;
+	if ((m = getint(objsize)) != OVOID) {
+		m += objorig;
+		if ((OBJECT)m != m)
+			octerror(USER, "too many objects");
+	}
+	objp->omod = m;
 	objp->oname = savqstr(getstr(sbuf));
 	if (objp->oargs.nsargs = getint(2)) {
 		objp->oargs.sarg = (char **)bmalloc
@@ -241,8 +252,8 @@ getobj()				/* get next object */
 		objp->oargs.iarg = NULL;
 #endif
 	if (objp->oargs.nfargs = getint(2)) {
-		objp->oargs.farg = (double *)bmalloc
-				(objp->oargs.nfargs*sizeof(double));
+		objp->oargs.farg = (FLOAT *)bmalloc
+				(objp->oargs.nfargs*sizeof(FLOAT));
 		if (objp->oargs.farg == NULL)
 			goto memerr;
 		for (i = 0; i < objp->oargs.nfargs; i++)