mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng16] Disabled new limit test on IDAT chunks. It was producing too small

Browse Source 
a limit for some files.
This commit is contained in:
Glenn Randers-Pehrson 2017-08-03 12:43:56 -05:00
parent bfdabdacff
commit 095b4ce16b
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pngpread.c
View File

@ -226,14 +226,19 @@ png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr)
if (chunk_name == png_IDAT) if (chunk_name == png_IDAT)
{ {
#if 0 /* some pngtests are failing */
size_t row_factor = size_t row_factor =
(png_ptr->rowbytes + 1 + (png_ptr->interlaced? 6: 0)); (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
+ 1 + (png_ptr->interlaced? 6: 0));
if (png_ptr->height > PNG_UINT_32_MAX/row_factor) if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
limit=PNG_UINT_31_MAX; limit=PNG_UINT_31_MAX;
else else
limit = png_ptr->height * row_factor; limit = png_ptr->height * row_factor;
limit += 6 + 5*limit/32566; /* zlib+deflate overhead */ limit += 6 + 5*limit/32566; /* zlib+deflate overhead */
limit=limit < PNG_UINT_31_MAX? limit : PNG_UINT_31_MAX; limit=limit < PNG_UINT_31_MAX? limit : PNG_UINT_31_MAX;
#else
limit=PNG_UINT_31_MAX;
#endif
} }
else else
{ {
@ -247,7 +252,11 @@ png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr)
# endif # endif
} }
if (png_ptr->push_length > limit) if (png_ptr->push_length > limit)
{
printf(" png_ptr->push_length = %lu, limit = %lu\n",
(unsigned long)png_ptr->push_length,(unsigned long)limit);
png_chunk_error(png_ptr, "chunk data is too large"); png_chunk_error(png_ptr, "chunk data is too large");
}
if (chunk_name == png_IHDR) if (chunk_name == png_IHDR)
{ {

9
pngrutil.c
View File

@ -196,18 +196,25 @@ png_read_chunk_header(png_structrp png_ptr)
} }
else else
{ {
#if 0 /* some pngtests are failing */
size_t row_factor = size_t row_factor =
(png_ptr->rowbytes + 1 + (png_ptr->interlaced? 6: 0)); (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
+ 1 + (png_ptr->interlaced? 6: 0));
if (png_ptr->height > PNG_UINT_32_MAX/row_factor) if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
limit=PNG_UINT_31_MAX; limit=PNG_UINT_31_MAX;
else else
limit = png_ptr->height * row_factor; limit = png_ptr->height * row_factor;
limit += 6 + 5*limit/32566; /* zlib+deflate overhead */ limit += 6 + 5*limit/32566; /* zlib+deflate overhead */
limit=limit < PNG_UINT_31_MAX? limit : PNG_UINT_31_MAX; limit=limit < PNG_UINT_31_MAX? limit : PNG_UINT_31_MAX;
#else
limit=PNG_UINT_31_MAX;
#endif
} }
if (length > limit) if (length > limit)
{ {
printf(" length = %lu, limit = %lu\n",
(unsigned long)length,(unsigned long)limit);
png_chunk_error(png_ptr, "chunk data is too large"); png_chunk_error(png_ptr, "chunk data is too large");
} }