From 7363babe4f18a1c14747dd720a08ab3b36c2f2ca Mon Sep 17 00:00:00 2001
From: John Bowler <jbowler@acm.org>
Date: Mon, 18 Feb 2013 21:36:25 -0600
Subject: [PATCH] [libpng17] Reenabled code to allow zero length PLTE chunks
 for MNG.

---
 ANNOUNCE |  5 +++--
 CHANGES  |  3 ++-
 pngset.c | 16 ++++++++++++++--
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/ANNOUNCE b/ANNOUNCE
index 5a9bd6693..6769cc4f2 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
 
-Libpng 1.7.0beta03 - February 18, 2013
+Libpng 1.7.0beta03 - February 19, 2013
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -177,7 +177,8 @@ Version 1.7.0beta02 [February 18, 2013]
   Use parentheses more consistently in "#if defined(MACRO)" tests.
   Folded long lines.
 
-Version 1.7.0beta03 [February 18, 2013]
+Version 1.7.0beta03 [February 19, 2013]
+  Reenabled code to allow zero length PLTE chunks for MNG.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/CHANGES b/CHANGES
index 27ecfc72d..fe43b2d1c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4464,7 +4464,8 @@ Version 1.7.0beta02 [February 18, 2013]
   Use parentheses more consistently in "#if defined(MACRO)" tests.
   Folded long lines.
 
-Version 1.7.0beta03 [February 18, 2013]
+Version 1.7.0beta03 [February 19, 2013]
+  Reenabled code to allow zero length PLTE chunks for MNG.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/pngset.c b/pngset.c
index ccab62783..5d7be8dc1 100644
--- a/pngset.c
+++ b/pngset.c
@@ -515,7 +515,7 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
 
    png_debug1(1, "in %s storage function", "PLTE");
 
-   if (png_ptr == NULL || info_ptr == NULL || palette == NULL)
+   if (png_ptr == NULL || info_ptr == NULL)
       return;
 
    if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH)
@@ -530,6 +530,17 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
       }
    }
 
+   if ((num_palette > 0 && palette == NULL) ||
+      (num_palette == 0
+#        ifdef PNG_MNG_FEATURES_SUPPORTED
+            && (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0
+#        endif
+      ))
+   {
+      png_chunk_report(png_ptr, "Invalid palette", PNG_CHUNK_ERROR);
+      return;
+   }
+
    /* It may not actually be necessary to set png_ptr->palette here;
     * we do it for backward compatibility with the way the png_handle_tRNS
     * function used to do the allocation.
@@ -546,7 +557,8 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
    png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
        PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
 
-   memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color)));
+   if (num_palette > 0)
+      memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color)));
    info_ptr->palette = png_ptr->palette;
    info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;