mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng15] When png_set_filler is used to strip a filler channel during write,

Browse Source 
the code prior to 1.5 would ignore the case where the output required an
alpha channel or when the output was a palettized PNG.  In libpng-1.5 the
ignorance was lost and libpng proceeded to strip the channel resulting
in a bad (potential memory overwrite) failure later.  This reverts
the behavior to the pre-1.5 state but issues a warning. libpng-1.6 is
expected to issue an error on the erroneous png_set_filler call.
This commit is contained in:
Glenn Randers-Pehrson 2012-08-08 22:13:25 -05:00
parent 1a2606069c
commit 0054b566f4
3 changed files with 36 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ANNOUNCE
View File

@ -1,5 +1,5 @@
Libpng 1.5.13beta02 - August 8, 2012 Libpng 1.5.13beta02 - August 9, 2012
This is not intended to be a public release. It will be replaced This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version. within a few weeks by a public version or by another test version.
@ -32,7 +32,15 @@ Version 1.5.13beta01 [August 8, 2012]
Revised PNG_FP_EXPORT and PNG_FIXED_EXPORT macros to avoid generating Revised PNG_FP_EXPORT and PNG_FIXED_EXPORT macros to avoid generating
lone semicolons (patch ported from libpng-1.6.0beta11). lone semicolons (patch ported from libpng-1.6.0beta11).
Version 1.5.13beta02 [August 8, 2012] Version 1.5.13beta02 [August 9, 2012]
Corrected handling of the image array and the row_pointers array in example.c
When png_set_filler is used to strip a filler channel during write, the
code prior to 1.5 would ignore the case where the output required an
alpha channel or when the output was a palettized PNG. In libpng-1.5 the
ignorance was lost and libpng proceeded to strip the channel resulting
in a bad (potential memory overwrite) failure later. This reverts
the behavior to the pre-1.5 state but issues a warning. libpng-1.6 is
expected to issue an error on the erroneous png_set_filler call.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net: Send comments/corrections/commendations to png-mng-implement at lists.sf.net:
(subscription required; visit (subscription required; visit

11
CHANGES
View File

@ -3902,7 +3902,16 @@ Version 1.5.13beta01 [August 8, 2012]
Revised PNG_FP_EXPORT and PNG_FIXED_EXPORT macros to avoid generating Revised PNG_FP_EXPORT and PNG_FIXED_EXPORT macros to avoid generating
lone semicolons (patch ported from libpng-1.6.0beta11). lone semicolons (patch ported from libpng-1.6.0beta11).
Version 1.5.13beta02 [August 8, 2012] Version 1.5.13beta02 [August 9, 2012]
Corrected handling of the image array and the row_pointers array in example.c
When png_set_filler is used to strip a filler channel during write, the
code prior to 1.5 would ignore the case where the output required an
alpha channel or when the output was a palettized PNG. In libpng-1.5 the
ignorance was lost and libpng proceeded to strip the channel resulting
in a bad (potential memory overwrite) failure later. This reverts
the behavior to the pre-1.5 state but issues a warning. libpng-1.6 is
expected to issue an error on the erroneous png_set_filler call.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit

16
pngwtran.c
View File

@ -1,8 +1,8 @@
/* pngwtran.c - transforms the data in a row for PNG writers /* pngwtran.c - transforms the data in a row for PNG writers
* *
* Last changed in libpng 1.5.6 [November 3, 2011] * Last changed in libpng 1.5.13 [(PENDING RELEASE)]
* Copyright (c) 1998-2011 Glenn Randers-Pehrson * Copyright (c) 1998-2012 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
* *
@ -45,8 +45,20 @@ png_do_write_transformations(png_structp png_ptr, png_row_infop row_info)
#ifdef PNG_WRITE_FILLER_SUPPORTED #ifdef PNG_WRITE_FILLER_SUPPORTED
if (png_ptr->transformations & PNG_FILLER) if (png_ptr->transformations & PNG_FILLER)
{
if (png_ptr->color_type & (PNG_COLOR_MASK_ALPHA|PNG_COLOR_MASK_PALETTE))
{
/* GA, RGBA or palette; in any of these cases libpng will not do the
* the correct thing (whatever that might be).
*/
png_warning(png_ptr, "incorrect png_set_filler call ignored");
png_ptr->transformations &= ~PNG_FILLER;
}
else
png_do_strip_channel(row_info, png_ptr->row_buf + 1, png_do_strip_channel(row_info, png_ptr->row_buf + 1,
!(png_ptr->flags & PNG_FLAG_FILLER_AFTER)); !(png_ptr->flags & PNG_FLAG_FILLER_AFTER));
}
#endif #endif
#ifdef PNG_WRITE_PACKSWAP_SUPPORTED #ifdef PNG_WRITE_PACKSWAP_SUPPORTED