mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng14] Fixed bug with png_handle_hIST with odd chunk length (Frank Busse).

Browse Source
This commit is contained in:
Glenn Randers-Pehrson 2012-02-21 14:57:59 -06:00
parent 53060e0c54
commit 13f1247654
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pngrutil.c
View File

@ -1,7 +1,7 @@
/* pngrutil.c - utilities to read a PNG file
*
* Last changed in libpng 1.4.10 [February 20, 2012]
* Last changed in libpng 1.4.10 [February 21, 2012]
* Copyright (c) 1998-2012 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@ -1581,15 +1581,16 @@ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
return;
}
num = length / 2 ;
if (num != (unsigned int) png_ptr->num_palette || num >
(unsigned int) PNG_MAX_PALETTE_LENGTH)
if (length > 2*PNG_MAX_PALETTE_LENGTH ||
length != (unsigned int) (2*png_ptr->num_palette))
{
png_warning(png_ptr, "Incorrect hIST chunk length");
png_crc_finish(png_ptr, length);
return;
}
num = length / 2 ;
for (i = 0; i < num; i++)
{
png_byte buf[2];