mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng16] Silently truncate over-length PLTE chunk while reading.

Browse Source
This commit is contained in:
Glenn Randers-Pehrson
2015-10-30 11:34:37 -05:00
parent a901eb3ce6
commit 1bef8e9799
4 changed files with 16 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pngset.c
View File

@@ -523,7 +523,7 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
(1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
if (num_palette < 0 || num_palette > max_palette_length)
if (num_palette < 0 || num_palette > (int) max_palette_length)
{
if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
png_error(png_ptr, "Invalid palette length");