[legacy] Fixed incorrect test in new png_push_save_buffer() code.

This commit is contained in:
Glenn Randers-Pehrson
2010-02-07 19:56:19 -06:00
parent bc4873c665
commit 6328fc1321
3 changed files with 30 additions and 22 deletions

View File

@@ -1,7 +1,7 @@
/* pngpread.c - read a png file in push mode
*
* Last changed in libpng 1.2.43 [February 7, 2010]
* Last changed in libpng 1.2.43 [February 8, 2010]
* Copyright (c) 1998-2010 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -694,8 +694,10 @@ png_push_save_buffer(png_structp png_ptr)
png_size_t new_max;
png_bytep old_buffer;
if (png_ptr->save_buffer_size == PNG_SIZE_MAX)
png_error(png_ptr, "Overflow of save_buffer");
if (png_ptr->save_buffer_max == PNG_SIZE_MAX ||
(png_ptr->save_buffer_size > PNG_SIZE_MAX -
png_ptr->current_buffer_size))
png_error(png_ptr, "Overflow of save_buffer");
if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
(png_ptr->current_buffer_size +