mirror of
https://git.code.sf.net/p/libpng/code.git
synced 2025-07-10 18:04:09 +02:00
Imported from libpng-1.2.6beta4.tar
This commit is contained in:
21
pngpread.c
21
pngpread.c
@@ -1,7 +1,7 @@
|
||||
|
||||
/* pngpread.c - read a png file in push mode
|
||||
*
|
||||
* libpng 1.2.6beta3 - July 18, 2004
|
||||
* libpng version 1.2.6beta4 - July 28, 2004
|
||||
* For conditions of distribution and use, see copyright notice in png.h
|
||||
* Copyright (c) 1998-2004 Glenn Randers-Pehrson
|
||||
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
|
||||
@@ -208,7 +208,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
|
||||
}
|
||||
|
||||
png_push_fill_buffer(png_ptr, chunk_length, 4);
|
||||
png_ptr->push_length = png_get_uint_32(chunk_length);
|
||||
png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length);
|
||||
png_reset_crc(png_ptr);
|
||||
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
|
||||
png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
|
||||
@@ -591,6 +591,11 @@ png_push_save_buffer(png_structp png_ptr)
|
||||
png_size_t new_max;
|
||||
png_bytep old_buffer;
|
||||
|
||||
if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
|
||||
(png_ptr->current_buffer_size + 256))
|
||||
{
|
||||
png_error(png_ptr, "Potential overflow of save_buffer");
|
||||
}
|
||||
new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
|
||||
old_buffer = png_ptr->save_buffer;
|
||||
png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr,
|
||||
@@ -637,8 +642,7 @@ png_push_read_IDAT(png_structp png_ptr)
|
||||
}
|
||||
|
||||
png_push_fill_buffer(png_ptr, chunk_length, 4);
|
||||
png_ptr->push_length = png_get_uint_32(chunk_length);
|
||||
|
||||
png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length);
|
||||
png_reset_crc(png_ptr);
|
||||
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
|
||||
png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
|
||||
@@ -1094,7 +1098,8 @@ png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
|
||||
if (text != key + png_ptr->current_text_size)
|
||||
text++;
|
||||
|
||||
text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
|
||||
text_ptr = (png_textp)png_malloc(png_ptr,
|
||||
(png_uint_32)png_sizeof(png_text));
|
||||
text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
|
||||
text_ptr->key = key;
|
||||
#ifdef PNG_iTXt_SUPPORTED
|
||||
@@ -1287,7 +1292,8 @@ png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
|
||||
key = text;
|
||||
text += key_size;
|
||||
|
||||
text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
|
||||
text_ptr = (png_textp)png_malloc(png_ptr,
|
||||
(png_uint_32)png_sizeof(png_text));
|
||||
text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
|
||||
text_ptr->key = key;
|
||||
#ifdef PNG_iTXt_SUPPORTED
|
||||
@@ -1399,7 +1405,8 @@ png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
|
||||
if (text != key + png_ptr->current_text_size)
|
||||
text++;
|
||||
|
||||
text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
|
||||
text_ptr = (png_textp)png_malloc(png_ptr,
|
||||
(png_uint_32)png_sizeof(png_text));
|
||||
text_ptr->compression = comp_flag + 2;
|
||||
text_ptr->key = key;
|
||||
text_ptr->lang = lang;
|
||||
|
||||
Reference in New Issue
Block a user