[libpng17] Use "1U" not "1" in pointer calculations in png_handle_sPLT().

This commit is contained in:
John Bowler 2015-11-19 21:12:54 -06:00 committed by Glenn Randers-Pehrson
parent d3c0359b23
commit 57e92a8432

View File

@ -1530,7 +1530,7 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr)
++entry_start; ++entry_start;
/* A sample depth should follow the separator, and we should be on it */ /* A sample depth should follow the separator, and we should be on it */
if (length < 2 || entry_start - buffer > length - 2) if (length < 2 || entry_start > buffer + (length - 2U))
{ {
png_chunk_benign_error(png_ptr, "malformed"); png_chunk_benign_error(png_ptr, "malformed");
return; return;