mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng14] Fixed undefined behavior in png_push_save_buffer(). Do not call

Browse Source 
memcpy() with a null source, even if count is zero (Leon Scroggins III).
This commit is contained in:
Glenn Randers-Pehrson 2016-06-03 21:49:27 -05:00
parent 8a1b9409b6
commit 7d9017e7c0
3 changed files with 17 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ANNOUNCE
View File

@ -1,5 +1,5 @@
Libpng 1.4.20beta01 - March 1, 2016 Libpng 1.4.20beta01 - June 4, 2016
This is not intended to be a public release. It will be replaced This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version. within a few weeks by a public version or by another test version.
@ -26,8 +26,10 @@ Other information:
Changes since the last public release (1.4.19): Changes since the last public release (1.4.19):
version 1.4.20beta01 [March 1, 2016] version 1.4.20beta01 [June 4, 2016]
Fix typos in libpng.3 synopses (Eric S. Raymond). Fix typos in libpng.3 synopses (Eric S. Raymond).
Fixed undefined behavior in png_push_save_buffer(). Do not call
memcpy() with a null source, even if count is zero (Leon Scroggins III).
Send comments/corrections/commendations to glennrp at users.sourceforge.net Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit or to png-mng-implement at lists.sf.net (subscription required; visit

9
CHANGES
View File

@ -2916,7 +2916,8 @@ version 1.4.13 [February 6, 2014]
No changes. No changes.
version 1.4.14beta01 [November 6, 2014] version 1.4.14beta01 [November 6, 2014]
Avoid out-of-bounds memory access in png_user_version_check(). Fixed an out-of-range read in png_version_check() (Bug report from
Qixue Xiao, CVE-2015-8540).
Simplified and future-proofed png_user_version_check(). Simplified and future-proofed png_user_version_check().
version 1.4.14rc01 [November 13, 2014] version 1.4.14rc01 [November 13, 2014]
@ -3030,11 +3031,13 @@ version 1.4.19rc01 [December 14, 2015]
Corrected copyright dates in source files. Corrected copyright dates in source files.
Moved png_check_keyword() from pngwutil.c to pngset.c Moved png_check_keyword() from pngwutil.c to pngset.c
version 1.4.19 [March 1, 2016] version 1.4.19 [December 17, 2015]
No changes. No changes.
version 1.4.20beta01 [March 1, 2016] version 1.4.20beta01 [June 4, 2016]
Fix typos in libpng.3 synopses (Eric S. Raymond). Fix typos in libpng.3 synopses (Eric S. Raymond).
Fixed undefined behavior in png_push_save_buffer(). Do not call
memcpy() with a null source, even if count is zero (Leon Scroggins III).
Send comments/corrections/commendations to glennrp at users.sourceforge.net Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit or to png-mng-implement at lists.sf.net (subscription required; visit

10
pngpread.c
View File

@ -1,8 +1,8 @@
/* pngpread.c - read a png file in push mode /* pngpread.c - read a png file in push mode
* *
* Last changed in libpng 1.4.10 [March 8, 2012] * Last changed in libpng 1.4.20 [(TO BE RELEASED)]
* Copyright (c) 1998-2002,2004,2006-2012 Glenn Randers-Pehrson * Copyright (c) 1998-2002,2004,2006-2012,2016 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
* *
@ -683,7 +683,11 @@ png_push_save_buffer(png_structp png_ptr)
png_free(png_ptr, old_buffer); png_free(png_ptr, old_buffer);
png_error(png_ptr, "Insufficient memory for save_buffer"); png_error(png_ptr, "Insufficient memory for save_buffer");
} }
png_memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size); if (old_buffer)
png_memcpy(png_ptr->save_buffer, old_buffer,
png_ptr->save_buffer_size);
else if (png_ptr->save_buffer_size)
png_error(png_ptr, "save_buffer error");
png_free(png_ptr, old_buffer); png_free(png_ptr, old_buffer);
png_ptr->save_buffer_max = new_max; png_ptr->save_buffer_max = new_max;
} }