mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng12] Prevent writing over-length PLTE chunk (Cosmin Truta) and

Browse Source 
silently truncate over-length PLTE chunk while reading.
This commit is contained in:
Glenn Randers-Pehrson
2015-10-31 08:39:01 -05:00
parent 856a76b285
commit 475bab6170
4 changed files with 29 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
pngwutil.c
View File

@@ -1,7 +1,7 @@
/* pngwutil.c - utilities to write a PNG file
*
* Last changed in libpng 1.2.53 [February 26, 2015]
* Last changed in libpng 1.2.54 [October 31, 2015]
* Copyright (c) 1998-2015 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -575,17 +575,20 @@ png_write_PLTE(png_structp png_ptr, png_colorp palette, png_uint_32 num_pal)
#ifdef PNG_USE_LOCAL_ARRAYS
PNG_PLTE;
#endif
png_uint_32 i;
png_uint_32 max_palette_length, i;
png_colorp pal_ptr;
png_byte buf[3];
png_debug(1, "in png_write_PLTE");
max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
(1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
if ((
#ifdef PNG_MNG_FEATURES_SUPPORTED
!(png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) &&
#endif
num_pal == 0) || num_pal > 256)
num_pal == 0) || num_pal > max_palette_length)
{
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
{