mirror of
https://git.code.sf.net/p/libpng/code.git
synced 2025-07-10 18:04:09 +02:00
[libpng16] Document need to check for integer overflow when allocating a pixel
buffer for multiple rows in contrib/gregbook, contrib/pngminus, example.c, and in the manual (suggested by Jaeseung Choi).
This commit is contained in:
@@ -496,6 +496,12 @@ static int rpng_win_create_window(HINSTANCE hInst, int showmode)
|
||||
|
||||
wimage_rowbytes = ((3*image_width + 3L) >> 2) << 2;
|
||||
|
||||
/* Guard against integer overflow */
|
||||
if (image_height > ((size_t)(-1))/wimage_rowbytes) {
|
||||
fprintf(stderr, PROGNAME ": image_data buffer would be too large\n",
|
||||
return 4; /* fail */
|
||||
}
|
||||
|
||||
if (!(dib = (uch *)malloc(sizeof(BITMAPINFOHEADER) +
|
||||
wimage_rowbytes*image_height)))
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user