mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng14] Fixed bug with png_handle_hIST with odd chunk length (Frank Busse).

Browse Source
This commit is contained in:
Glenn Randers-Pehrson
2012-02-21 14:57:59 -06:00
parent 53060e0c54
commit 13f1247654
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
pngrutil.c
View File

@@ -1,7 +1,7 @@
/* pngrutil.c - utilities to read a PNG file /* pngrutil.c - utilities to read a PNG file
* *
* Last changed in libpng 1.4.10 [February 20, 2012] * Last changed in libpng 1.4.10 [February 21, 2012]
* Copyright (c) 1998-2012 Glenn Randers-Pehrson * Copyright (c) 1998-2012 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -1581,15 +1581,16 @@ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
return; return;
} }
num = length / 2 ; if (length > 2*PNG_MAX_PALETTE_LENGTH ||
if (num != (unsigned int) png_ptr->num_palette || num > length != (unsigned int) (2*png_ptr->num_palette))
(unsigned int) PNG_MAX_PALETTE_LENGTH)
{ {
png_warning(png_ptr, "Incorrect hIST chunk length"); png_warning(png_ptr, "Incorrect hIST chunk length");
png_crc_finish(png_ptr, length); png_crc_finish(png_ptr, length);
return; return;
} }
num = length / 2 ;
for (i = 0; i < num; i++) for (i = 0; i < num; i++)
{ {
png_byte buf[2]; png_byte buf[2];