mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng15] Reject all iCCP chunks after the first,

Browse Source 
even if the first one is invalid.
This commit is contained in:
Glenn Randers-Pehrson 2012-03-09 22:38:06 -06:00
parent fc9127370c
commit 0ff5150f91
4 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ANNOUNCE
View File

@ -56,6 +56,7 @@ Version 1.5.10beta04 [March 10, 2012]
libpng-1.5.4. It sometimes produced too small of a window.
Version 1.5.10beta05 [March 10, 2012]
Reject all iCCP chunks after the first, even if the first one is invalid.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net:
(subscription required; visit

1
CHANGES
View File

@ -3841,6 +3841,7 @@ Version 1.5.10beta04 [March 10, 2012]
libpng-1.5.4. It sometimes produced too small of a window.
Version 1.5.10beta05 [March 10, 2012]
Reject all iCCP chunks after the first, even if the first one is invalid.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

1
pngpriv.h
View File

@ -466,6 +466,7 @@ typedef PNG_CONST png_uint_16p FAR * png_const_uint_16pp;
#define PNG_BACKGROUND_IS_GRAY 0x800
#define PNG_HAVE_PNG_SIGNATURE 0x1000
#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000 /* Have another chunk after IDAT */
#define PNG_HAVE_iCCP 0x4000
/* Flags for the transformations the PNG library does on the image data */
#define PNG_BGR 0x0001

5
pngrutil.c
View File

@ -1257,13 +1257,16 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* Should be an error, but we can cope with it */
png_warning(png_ptr, "Out of place iCCP chunk");
if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP))
if ((png_ptr->mode & PNG_HAVE_iCCP) || (info_ptr != NULL &&
(info_ptr->valid & (PNG_INFO_iCCP|PNG_INFO_sRGB))))
{
png_warning(png_ptr, "Duplicate iCCP chunk");
png_crc_finish(png_ptr, length);
return;
}
png_ptr->mode |= PNG_HAVE_iCCP;
#ifdef PNG_MAX_MALLOC_64K
if (length > (png_uint_32)65535L)
{