mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

Fix a memory leak in png_set_tRNS

Browse Source 
This leak was discovered by OSS-Fuzz.

The old structure of the code was along the lines of:

  allocate trans_alpha;
  if (problem) {
    // Jumps away from this function
    png_warning("tRNS chunk has out-of-range samples for bit_depth");
  }
  mark trans_alpha as to-free;

Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This commit is contained in:
Sami Boukortt 2019-02-12 14:17:27 +01:00 committed by Cosmin Truta
parent 36bd1bbd54
commit 3ec225dd41
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
AUTHORS
View File

@ -36,6 +36,7 @@ Authors, for copyright and licensing purposes.
- Matt Sarett - Matt Sarett
- Mike Klein - Mike Klein
- Dan Field - Dan Field
- Sami Boukortt
The build projects, the build scripts, the test scripts, and other The build projects, the build scripts, the test scripts, and other
files in the "ci", "projects", "scripts" and "tests" directories, have files in the "ci", "projects", "scripts" and "tests" directories, have

5
pngset.c
View File

@ -1,7 +1,7 @@
/* pngset.c - storage of image information into info struct /* pngset.c - storage of image information into info struct
* *
* Copyright (c) 2018 Cosmin Truta * Copyright (c) 2018-2022 Cosmin Truta
* Copyright (c) 1998-2018 Glenn Randers-Pehrson * Copyright (c) 1998-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger * Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc. * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@ -1019,6 +1019,9 @@ png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
info_ptr->trans_alpha = png_voidcast(png_bytep, info_ptr->trans_alpha = png_voidcast(png_bytep,
png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH)); png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
memcpy(info_ptr->trans_alpha, trans_alpha, (size_t)num_trans); memcpy(info_ptr->trans_alpha, trans_alpha, (size_t)num_trans);
info_ptr->valid |= PNG_INFO_tRNS;
info_ptr->free_me |= PNG_FREE_TRNS;
} }
png_ptr->trans_alpha = info_ptr->trans_alpha; png_ptr->trans_alpha = info_ptr->trans_alpha;
} }