mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[devel] Improve IHDR checking and error reporting

Browse Source 
Move redundant IHDR checking into new png_check_IHDR() in png.c
and report all errors found in the IHDR data.  Report problems
with width and height separately.
This commit is contained in:
Glenn Randers-Pehrson
2009-09-24 18:10:49 -05:00
parent 3243fea0ac
commit 134bbe416d
6 changed files with 200 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
pngset.c
View File

@@ -1,7 +1,7 @@
/* pngset.c - storage of image information into info struct
*
* Last changed in libpng 1.4.0 [September 23, 2009]
* Last changed in libpng 1.4.0 [September 24, 2009]
* Copyright (c) 1998-2009 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -227,74 +227,8 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
if (png_ptr == NULL || info_ptr == NULL)
return;
/* Check for width and height valid values */
if (width == 0 || height == 0)
png_error(png_ptr, "Image width or height is zero in IHDR");
#ifdef PNG_SET_USER_LIMITS_SUPPORTED
if (width > png_ptr->user_width_max || height > png_ptr->user_height_max)
png_error(png_ptr, "image size exceeds user limits in IHDR");
#else
if (width > PNG_USER_WIDTH_MAX || height > PNG_USER_HEIGHT_MAX)
png_error(png_ptr, "image size exceeds user limits in IHDR");
#endif
if (width > PNG_UINT_31_MAX || height > PNG_UINT_31_MAX)
png_error(png_ptr, "Invalid image size in IHDR");
if ( width > (PNG_UINT_32_MAX
>> 3) /* 8-byte RGBA pixels */
- 64 /* bigrowbuf hack */
- 1 /* filter byte */
- 7*8 /* rounding of width to multiple of 8 pixels */
- 8) /* extra max_pixel_depth pad */
png_warning(png_ptr, "Width is too large for libpng to process pixels");
/* Check other values */
if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 &&
bit_depth != 8 && bit_depth != 16)
png_error(png_ptr, "Invalid bit depth in IHDR");
if (color_type < 0 || color_type == 1 ||
color_type == 5 || color_type > 6)
png_error(png_ptr, "Invalid color type in IHDR");
if (((color_type == PNG_COLOR_TYPE_PALETTE) && bit_depth > 8) ||
((color_type == PNG_COLOR_TYPE_RGB ||
color_type == PNG_COLOR_TYPE_GRAY_ALPHA ||
color_type == PNG_COLOR_TYPE_RGB_ALPHA) && bit_depth < 8))
png_error(png_ptr, "Invalid color type/bit depth combination in IHDR");
if (interlace_type >= PNG_INTERLACE_LAST)
png_error(png_ptr, "Unknown interlace method in IHDR");
if (compression_type != PNG_COMPRESSION_TYPE_BASE)
png_error(png_ptr, "Unknown compression method in IHDR");
#ifdef PNG_MNG_FEATURES_SUPPORTED
/* Accept filter_method 64 (intrapixel differencing) only if
* 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
* 2. Libpng did not read a PNG signature (this filter_method is only
* used in PNG datastreams that are embedded in MNG datastreams) and
* 3. The application called png_permit_mng_features with a mask that
* included PNG_FLAG_MNG_FILTER_64 and
* 4. The filter_method is 64 and
* 5. The color_type is RGB or RGBA
*/
if ((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE)&&png_ptr->mng_features_permitted)
png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
if (filter_type != PNG_FILTER_TYPE_BASE)
{
if (!((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
(filter_type == PNG_INTRAPIXEL_DIFFERENCING) &&
((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE) == 0) &&
(color_type == PNG_COLOR_TYPE_RGB ||
color_type == PNG_COLOR_TYPE_RGB_ALPHA)))
png_error(png_ptr, "Unknown filter method in IHDR");
if (png_ptr->mode&PNG_HAVE_PNG_SIGNATURE)
png_warning(png_ptr, "Invalid filter method in IHDR");
}
#else
if (filter_type != PNG_FILTER_TYPE_BASE)
png_error(png_ptr, "Unknown filter method in IHDR");
#endif
png_check_IHDR (png_ptr, width, height, bit_depth, color_type,
interlace_type, compression_type, filter_type);
info_ptr->width = width;
info_ptr->height = height;