[libpng17] Fixed handling zero length IDAT in pngfix (bug report by Agostino Sarubbo,

bugfix by John Bowler).
This commit is contained in:
Glenn Randers-Pehrson 2016-09-01 17:36:36 -05:00
parent f0ada4edee
commit 07e2cf117f
3 changed files with 15 additions and 8 deletions

View File

@ -1,5 +1,5 @@
Libpng 1.7.0beta84 - August 18, 2016
Libpng 1.7.0beta84 - September 1, 2016
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@ -1396,8 +1396,11 @@ Version 1.7.0beta83 [July 23, 2016]
in reading.
Fixed debug test of output gamma.
Version 1.7.0beta84 [August 18, 2016]
Version 1.7.0beta84 [September 1, 2016]
Minor editing of INSTALL, (whitespace, added copyright line)
Don't install pngcp; it conflicts with pngcp in the pngtools package.
Fixed handling zero length IDAT in pngfix (bug report by Agostino Sarubbo,
bugfix by John Bowler).
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

View File

@ -5696,8 +5696,11 @@ Version 1.7.0beta83 [July 23, 2016]
in reading.
Fixed debug test of output gamma.
Version 1.7.0beta84 [August 18, 2016]
Version 1.7.0beta84 [September 1, 2016]
Minor editing of INSTALL, (whitespace, added copyright line)
Don't install pngcp; it conflicts with pngcp in the pngtools package.
Fixed handling zero length IDAT in pngfix (bug report by Agostino Sarubbo,
bugfix by John Bowler).
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

View File

@ -2,7 +2,7 @@
*
* Copyright (c) 2014-2016 John Cunningham Bowler
*
* Last changed in libpng 1.6.21 [January 15, 2016]
* Last changed in libpng 1.6.26 [(PENDING RELEASE)]
*
* This code is released under the libpng license.
* For conditions of distribution and use, see the disclaimer
@ -1824,7 +1824,7 @@ IDAT_init(struct IDAT * const idat, struct file * const file)
}
static png_uint_32
rechunk_length(struct IDAT *idat)
rechunk_length(struct IDAT *idat, int start)
/* Return the length for the next IDAT chunk, taking into account
* rechunking.
*/
@ -1836,7 +1836,7 @@ rechunk_length(struct IDAT *idat)
const struct IDAT_list *cur;
unsigned int count;
if (idat->idat_index == 0) /* at the new chunk (first time) */
if (start)
return idat->idat_length; /* use the cache */
/* Otherwise rechunk_length is called at the end of a chunk for the length
@ -1995,7 +1995,7 @@ process_IDAT(struct file *file)
idat->idat_index = 0; /* Index into chunk data */
/* Update the chunk length to the correct value for the IDAT chunk: */
file->chunk->chunk_length = rechunk_length(idat);
file->chunk->chunk_length = rechunk_length(idat, 1/*start*/);
/* Change the state to writing IDAT chunks */
file->state = STATE_IDAT;
@ -3473,7 +3473,8 @@ read_callback(png_structp png_ptr, png_bytep buffer, size_t count)
/* Write another IDAT chunk. Call rechunk_length to
* calculate the length required.
*/
length = chunk->chunk_length = rechunk_length(file->idat);
length = chunk->chunk_length =
rechunk_length(file->idat, 0/*end*/);
assert(type == png_IDAT);
file->write_count = 0; /* for the new chunk */
--(file->write_count); /* fake out the increment below */