mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng14] Avoid out-of-bounds memory access in png_user_version_check().

Browse Source 
Simplified and future-proofed png_user_version_check().
This commit is contained in:
Glenn Randers-Pehrson
2014-11-06 08:12:12 -06:00
parent 852b1140b9
commit 893653512f
4 changed files with 32 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
pngread.c
View File

@@ -1,7 +1,7 @@
/* pngread.c - read a PNG file
*
* Last changed in libpng 1.4.13 [%RDATE%]
* Last changed in libpng 1.4.13 [February 6, 2014]
* Copyright (c) 1998-2014 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -53,8 +53,6 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
#endif
#endif
int i;
png_debug(1, "in png_create_read_struct");
#ifdef PNG_USER_MEM_SUPPORTED
@@ -99,14 +97,20 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
png_set_error_fn(png_ptr, error_ptr, error_fn, warn_fn);
if (user_png_ver)
{
i = 0;
do
{
if (user_png_ver[i] != png_libpng_ver[i])
png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
} while (png_libpng_ver[i++]);
if (user_png_ver != NULL)
{
int i = -1;
int found_dots = 0;
do
{
i++;
if (user_png_ver[i] != PNG_LIBPNG_VER_STRING[i])
png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
if (user_png_ver[i] == '.')
found_dots++;
} while (found_dots < 2 && user_png_ver[i] != 0 &&
PNG_LIBPNG_VER_STRING[i] != 0);
}
else
png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;