[libpng17] Transformed rewrite: changed row_info, added checks. This introduces an

internal struct (png_transform_control) to replace row_info and uses
    that to implement affirms correctly.  The change also adds checks on
    the rowbytes calculation and additional checks on most transform
    implementations.
Added png_uint_16 range checking, pngvalid tRNS, fixed png_uint_16:
    review of previous checks, removal of some where SAFE. pngvalid: add
    testing of tRNS for better code coverage pngvalid: correct rgb-to-gray
    error calculations. Code coverage is still incomplete: see /*UNTESTED*/
    in pngrtran.c
This commit is contained in:
John Bowler
2015-03-30 21:32:41 -05:00
committed by Glenn Randers-Pehrson
parent 73ea393ab2
commit 673ae608ab
14 changed files with 1812 additions and 1451 deletions

View File

@@ -4179,7 +4179,7 @@ png_read_start_row(png_structrp png_ptr)
static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
#endif
int max_pixel_depth;
unsigned int max_pixel_depth;
png_size_t row_bytes;
png_debug(1, "in png_read_start_row");
@@ -4344,7 +4344,7 @@ png_read_start_row(png_structrp png_ptr)
defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
if (png_ptr->transformations & PNG_USER_TRANSFORM)
{
int user_pixel_depth = png_ptr->user_transform_depth *
unsigned int user_pixel_depth = png_ptr->user_transform_depth *
png_ptr->user_transform_channels;
if (user_pixel_depth > max_pixel_depth)
@@ -4355,7 +4355,7 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
/* This value is stored in png_struct and double checked in the row read
* code.
*/
png_ptr->maximum_pixel_depth = png_check_byte(png_ptr, max_pixel_depth);
png_ptr->maximum_pixel_depth = max_pixel_depth;
png_ptr->transformed_pixel_depth = 0; /* calculated on demand */
/* Align the width on the next larger 8 pixels. Mainly used