mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng15] Check validity of "num_unknowns" parameter

Browse Source 
of png_set_unknown_chunks().
This commit is contained in:
Glenn Randers-Pehrson
2013-01-10 09:24:03 -06:00
parent c4b099396a
commit 1a3d6e3cf3
3 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pngset.c
View File

@@ -1039,9 +1039,16 @@ png_set_unknown_chunks(png_structp png_ptr,
if (png_ptr == NULL || info_ptr == NULL || num_unknowns == 0)
return;
np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
(png_size_t)(info_ptr->unknown_chunks_num + num_unknowns) *
png_sizeof(png_unknown_chunk));
if (num_unknowns < 0 ||
num_unknowns >= UINT_MAX-info_ptr->unknown_chunks_num ||
num_unknowns >= PNG_SIZE_MAX/png_sizeof(png_unknown_chunk)
- info_ptr->unknown_chunks_num)
np=NULL;
else
np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
(png_size_t)(info_ptr->unknown_chunks_num + num_unknowns) *
png_sizeof(png_unknown_chunk));
if (np == NULL)
{