From 170a44b222d56c5310bb938246c1212c30089723 Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Sun, 23 Apr 2017 17:33:10 -0500
Subject: [PATCH] [libpng16] Check for integer overflow in contrib/visupng.

---
 ANNOUNCE                    | 5 +++--
 CHANGES                     | 3 ++-
 contrib/visupng/PngFile.c   | 4 ++++
 contrib/visupng/VisualPng.c | 8 ++++++++
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/ANNOUNCE b/ANNOUNCE
index 9f7e18a37..a2797dfe5 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,4 +1,4 @@
-Libpng 1.6.30beta03 - April 22, 2017
+Libpng 1.6.30beta03 - April 23, 2017
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -38,7 +38,8 @@ Version 1.6.30beta02 [April 22, 2017]
     example.c, and in the manual (suggested by Jaeseung Choi).
   Removed reference to the obsolete PNG_SAFE_LIMITS macro in the documentation.
 
-Version 1.6.30beta03 [April 22, 2017]
+Version 1.6.30beta03 [April 23, 2017]
+  Check for integer overflow in contrib/visupng.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/CHANGES b/CHANGES
index d1ddbb45d..d28b7b200 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5833,7 +5833,8 @@ Version 1.6.30beta02 [April 22, 2017]
     example.c, and in the manual (suggested by Jaeseung Choi).
   Removed reference to the obsolete PNG_SAFE_LIMITS macro in the documentation.
 
-Version 1.6.30beta03 [April 22, 2017]
+Version 1.6.30beta03 [April 23, 2017]
+  Check for integer overflow in contrib/visupng.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/contrib/visupng/PngFile.c b/contrib/visupng/PngFile.c
index dcde18a3a..dde2a421d 100644
--- a/contrib/visupng/PngFile.c
+++ b/contrib/visupng/PngFile.c
@@ -236,6 +236,10 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData,
             free (pbImageData);
             pbImageData = NULL;
         }
+        if ((*piHeight) > ((size_t)(-1))/ulRowBytes) {
+        {
+            png_error(png_ptr, "Visual PNG: image is too big");
+        }
         if ((pbImageData = (png_byte *) malloc(ulRowBytes * (*piHeight)
                             * sizeof(png_byte))) == NULL)
         {
diff --git a/contrib/visupng/VisualPng.c b/contrib/visupng/VisualPng.c
index 236525a59..03b3d8539 100644
--- a/contrib/visupng/VisualPng.c
+++ b/contrib/visupng/VisualPng.c
@@ -726,6 +726,10 @@ BOOL DisplayImage (HWND hwnd, BYTE **ppDib,
         pDib = NULL;
     }
 
+    if (cyWinSize > ((size_t)(-1))/wDIRowBytes) {
+    {
+        MessageBox (hwnd, TEXT ("Visual PNG: image is too big");
+    }
     if (!(pDib = (BYTE *) malloc (sizeof(BITMAPINFOHEADER) +
         wDIRowBytes * cyWinSize)))
     {
@@ -847,6 +851,10 @@ BOOL FillBitmap (
             cxImgPos = (cxWinSize - cxNewSize) / 2;
         }
 
+        if (cyNewSize > ((size_t)(-1))/(cImgChannels * cxNewSize)) {
+        {
+            MessageBox (hwnd, TEXT ("Visual PNG: stretched image is too big");
+        }
         pStretchedImage = malloc (cImgChannels * cxNewSize * cyNewSize);
         pImg = pStretchedImage;