mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng15] Silently truncate over-length PLTE chunk while reading.

Browse Source
This commit is contained in:
Glenn Randers-Pehrson 2015-10-30 13:21:32 -05:00
parent 20e0daa74a
commit 820a090567
5 changed files with 28 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ANNOUNCE
View File

@ -59,6 +59,7 @@ Version 1.5.24beta03 [October 30, 2015]
a user transform. This was safe; libpng overallocated buffer space a user transform. This was safe; libpng overallocated buffer space
(potentially by quite a lot; up to 4 times the amount required) but, (potentially by quite a lot; up to 4 times the amount required) but,
from 1.5.4 on, resulted in a png_error (John Bowler). from 1.5.4 on, resulted in a png_error (John Bowler).
Silently truncate over-length PLTE chunk while reading.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit

1
CHANGES
View File

@ -4406,6 +4406,7 @@ Version 1.5.24beta03 [October 30, 2015]
a user transform. This was safe; libpng overallocated buffer space a user transform. This was safe; libpng overallocated buffer space
(potentially by quite a lot; up to 4 times the amount required) but, (potentially by quite a lot; up to 4 times the amount required) but,
from 1.5.4 on, resulted in a png_error (John Bowler). from 1.5.4 on, resulted in a png_error (John Bowler).
Silently truncate over-length PLTE chunk while reading.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit

16
pngrutil.c
View File

@ -1,7 +1,7 @@
/* pngrutil.c - utilities to read a PNG file /* pngrutil.c - utilities to read a PNG file
* *
* Last changed in libpng 1.5.22 [March 26, 2015] * Last changed in libpng 1.5.24 [(PENDING RELEASE)]
* Copyright (c) 1998-2015 Glenn Randers-Pehrson * Copyright (c) 1998-2015 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@ -611,7 +611,7 @@ void /* PRIVATE */
png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
{ {
png_color palette[PNG_MAX_PALETTE_LENGTH]; png_color palette[PNG_MAX_PALETTE_LENGTH];
int num, i; int max_palette_length, num, i;
#ifdef PNG_POINTER_INDEXING_SUPPORTED #ifdef PNG_POINTER_INDEXING_SUPPORTED
png_colorp pal_ptr; png_colorp pal_ptr;
#endif #endif
@ -664,8 +664,20 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
} }
} }
/* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */
num = (int)length / 3; num = (int)length / 3;
/* If the palette has 256 or fewer entries but is too large for the bit depth,
* we don't issue an error, to preserve the behavior of previous libpng versions.
* We silently truncate the unused extra palette entries here.
*/
max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
(1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
if (num > max_palette_length)
num = max_palette_length;
#ifdef PNG_POINTER_INDEXING_SUPPORTED #ifdef PNG_POINTER_INDEXING_SUPPORTED
for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++) for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
{ {

13
pngset.c
View File

@ -1,7 +1,7 @@
/* pngset.c - storage of image information into info struct /* pngset.c - storage of image information into info struct
* *
* Last changed in libpng 1.5.23 [July 23, 2015] * Last changed in libpng 1.5.24 [(PENDING RELEASE)]
* Copyright (c) 1998-2015 Glenn Randers-Pehrson * Copyright (c) 1998-2015 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@ -508,12 +508,17 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
png_const_colorp palette, int num_palette) png_const_colorp palette, int num_palette)
{ {
png_uint_32 max_palette_length;
png_debug1(1, "in %s storage function", "PLTE"); png_debug1(1, "in %s storage function", "PLTE");
if (png_ptr == NULL || info_ptr == NULL) if (png_ptr == NULL || info_ptr == NULL)
return; return;
if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH) max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
(1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
if (num_palette < 0 || num_palette > (int) max_palette_length)
{ {
if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
png_error(png_ptr, "Invalid palette length"); png_error(png_ptr, "Invalid palette length");
@ -532,8 +537,8 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0); png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
/* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
* of num_palette entries, in case of an invalid PNG file that has * of num_palette entries, in case of an invalid PNG file or incorrect
* too-large sample values. * call to png_set_PLTE() with too-large sample values.
*/ */
png_ptr->palette = (png_colorp)png_calloc(png_ptr, png_ptr->palette = (png_colorp)png_calloc(png_ptr,
PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color)); PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));

6
pngwutil.c
View File

@ -896,20 +896,20 @@ void /* PRIVATE */
png_write_PLTE(png_structp png_ptr, png_const_colorp palette, png_write_PLTE(png_structp png_ptr, png_const_colorp palette,
png_uint_32 num_pal) png_uint_32 num_pal)
{ {
png_uint_32 max_num_pal, i; png_uint_32 max_palette_length, i;
png_const_colorp pal_ptr; png_const_colorp pal_ptr;
png_byte buf[3]; png_byte buf[3];
png_debug(1, "in png_write_PLTE"); png_debug(1, "in png_write_PLTE");
max_num_pal = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
(1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
if (( if ((
#ifdef PNG_MNG_FEATURES_SUPPORTED #ifdef PNG_MNG_FEATURES_SUPPORTED
!(png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) && !(png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) &&
#endif #endif
num_pal == 0) || num_pal > max_num_pal) num_pal == 0) || num_pal > max_palette_length)
{ {
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
{ {