mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[lbpng15] Rearrange terms in buffer length tests in pngrutil.c to

Browse Source 
avoid potential overflow in calculations.
This commit is contained in:
Glenn Randers-Pehrson
2015-11-19 09:12:43 -06:00
parent 8738633bd6
commit 68a6e6755b
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pngrutil.c
View File

@@ -1327,7 +1327,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* There should be at least one zero (the compression type byte) /* There should be at least one zero (the compression type byte)
* following the separator, and we should be on it * following the separator, and we should be on it
*/ */
if (slength < 1 || profile >= png_ptr->chunkdata + slength - 1) if (slength < 1 || profile - png_ptr->chunkdata >= slength - 1)
{ {
png_free(png_ptr, png_ptr->chunkdata); png_free(png_ptr, png_ptr->chunkdata);
png_ptr->chunkdata = NULL; png_ptr->chunkdata = NULL;
@@ -1476,7 +1476,7 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
++entry_start; ++entry_start;
/* A sample depth should follow the separator, and we should be on it */ /* A sample depth should follow the separator, and we should be on it */
if (slength < 2 || entry_start > (png_bytep)png_ptr->chunkdata + slength - 2) if (slength < 2 || entry_start - (png_bytep)png_ptr->chunkdata > slength - 2)
{ {
png_free(png_ptr, png_ptr->chunkdata); png_free(png_ptr, png_ptr->chunkdata);
png_ptr->chunkdata = NULL; png_ptr->chunkdata = NULL;
@@ -2005,7 +2005,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* We need to have at least 12 bytes after the purpose string /* We need to have at least 12 bytes after the purpose string
* in order to get the parameter information. * in order to get the parameter information.
*/ */
if (length < 12 || endptr <= buf + 12) if (endptr -buf <= 12)
{ {
png_warning(png_ptr, "Invalid pCAL data"); png_warning(png_ptr, "Invalid pCAL data");
png_free(png_ptr, png_ptr->chunkdata); png_free(png_ptr, png_ptr->chunkdata);
@@ -2417,7 +2417,7 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* Empty loop */ ; /* Empty loop */ ;
/* zTXt must have some text after the chunkdataword */ /* zTXt must have some text after the chunkdataword */
if (slength < 2 || text >= png_ptr->chunkdata + slength - 2) if (slength < 2 || text - png_ptr->chunkdata >= slength - 2)
{ {
png_warning(png_ptr, "Truncated zTXt chunk"); png_warning(png_ptr, "Truncated zTXt chunk");
png_free(png_ptr, png_ptr->chunkdata); png_free(png_ptr, png_ptr->chunkdata);
@@ -2554,7 +2554,7 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
* keyword * keyword
*/ */
if (slength < 3 || lang >= png_ptr->chunkdata + slength - 3) if (slength < 3 || png_ptr->chunkdata - lang >= slength - 3)
{ {
png_warning(png_ptr, "Truncated iTXt chunk"); png_warning(png_ptr, "Truncated iTXt chunk");
png_free(png_ptr, png_ptr->chunkdata); png_free(png_ptr, png_ptr->chunkdata);