diff --git a/ANNOUNCE b/ANNOUNCE index 9c4a3f44f..e58855b75 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,5 +1,5 @@ -Libpng 1.7.0beta69 - November 22, 2015 +Libpng 1.7.0beta69 - November 23, 2015 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -965,11 +965,13 @@ Version 1.7.0beta68 [November 12, 2015] (bug report by Cosmin Truta). Cleaned up coding style in png_handle_PLTE(). -Version 1.7.0beta69 [November 22, 2015] +Version 1.7.0beta69 [November 23, 2015] Avoid potential pointer overflow/underflow in png_handle_sPLT() and png_handle_pCAL() (Bug report by John Regehr). Avoid conditionally compiling parts of statements in png.c (suggested by flaviommedeiros). + Fixed bug recently introduced in png_set_PLTE() that uses png_ptr + not info_ptr. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index eee644282..b6e143464 100644 --- a/CHANGES +++ b/CHANGES @@ -5264,11 +5264,13 @@ Version 1.7.0beta68 [November 12, 2015] (bug report by Cosmin Truta) (CVE-2015-8126). Cleaned up coding style in png_handle_PLTE(). -Version 1.7.0beta69 [November 22, 2015] +Version 1.7.0beta69 [November 23, 2015] Avoid potential pointer overflow/underflow in png_handle_sPLT() and png_handle_pCAL() (Bug report by John Regehr). Avoid conditionally compiling parts of statements in png.c (suggested by flaviommedeiros). + Fixed bug recently introduced in png_set_PLTE() that uses png_ptr + not info_ptr. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/pngset.c b/pngset.c index d36e3d5ee..f2983e7c5 100644 --- a/pngset.c +++ b/pngset.c @@ -509,12 +509,12 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr, if (png_ptr == NULL || info_ptr == NULL) return; - max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? - (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; + max_palette_length = (info_ptr->format & PNG_FORMAT_FLAG_COLORMAP) == 0 ? + (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; if (num_palette < 0 || num_palette > (int) max_palette_length) { - if ((info_ptr->format == PNG_FORMAT_FLAG_COLORMAP) != 0) + if ((info_ptr->format & PNG_FORMAT_FLAG_COLORMAP) != 0) png_chunk_error(png_ptr, "Invalid palette length"); else