diff --git a/ANNOUNCE b/ANNOUNCE index 900ccf0ed..c21334e7c 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,5 +1,5 @@ -Libpng 1.7.0beta27 - January 1, 2014 +Libpng 1.7.0beta27 - January 10, 2014 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -486,7 +486,9 @@ Version 1.7.0beta26 [January 1, 2014] libpng17/png.h and libpng17.a). Three new configure options and some rearrangement of Makefile.am allow creation of these links to be disabled. -Version 1.7.0beta27 [January 1, 2014] +Version 1.7.0beta27 [January 10, 2014] + Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX + in the test for potential overflow in PNG_ROWBYTES. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index 70c2e3b3a..62b9547fb 100644 --- a/CHANGES +++ b/CHANGES @@ -4775,7 +4775,9 @@ Version 1.7.0beta26 [January 1, 2014] libpng17/png.h and libpng17.a). Three new configure options and some rearrangement of Makefile.am allow creation of these links to be disabled. -Version 1.7.0beta27 [January 1, 2014] +Version 1.7.0beta27 [January 10, 2014] + Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX + in the test for potential overflow in PNG_ROWBYTES. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/png.c b/png.c index c11d13a4d..ea11d1b36 100644 --- a/png.c +++ b/png.c @@ -696,13 +696,13 @@ png_get_copyright(png_const_structrp png_ptr) #else # ifdef __STDC__ return PNG_STRING_NEWLINE \ - "libpng version 1.7.0beta27 - January 8, 2014" PNG_STRING_NEWLINE \ + "libpng version 1.7.0beta27 - January 10, 2014" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ PNG_STRING_NEWLINE; # else - return "libpng version 1.7.0beta27 - January 8, 2014\ + return "libpng version 1.7.0beta27 - January 10, 2014\ Copyright (c) 1998-2014 Glenn Randers-Pehrson\ Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."; @@ -2381,12 +2381,14 @@ png_check_IHDR(png_const_structrp png_ptr, error = 1; } - if (error == 0 && width > (PNG_UINT_32_MAX + /* Check for potential overflow in PNG_ROWBYTES calculation */ + if (error == 0 && width > (PNG_SIZE_MAX >> 3) /* 8-byte RGBA pixels */ - 48 /* bigrowbuf hack */ - 1 /* filter byte */ - 7*8 /* rounding of width to multiple of 8 pixels */ - - 8) /* extra max_pixel_depth pad */ + - 8 /* extra max_pixel_depth pad */ + - error) /* to prevent always-false compiler warning */ png_warning(png_ptr, "Width may be too large for libpng to process pixels");