[libpng17] Use "1U" not "1" in pointer calculations in png_handle_sPLT().

This commit is contained in:
John Bowler 2015-11-19 21:12:54 -06:00 committed by Glenn Randers-Pehrson
parent d3c0359b23
commit 57e92a8432

View File

@ -1530,7 +1530,7 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr)
++entry_start;
/* A sample depth should follow the separator, and we should be on it */
if (length < 2 || entry_start - buffer > length - 2)
if (length < 2 || entry_start > buffer + (length - 2U))
{
png_chunk_benign_error(png_ptr, "malformed");
return;