mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng15] Revised png_check_IHDR() to use PNG_SIZE_MAX instead of

Browse Source 
PNG_UINT_32_MAX in the test for potential overflow in PNG_ROWBYTES.
This commit is contained in:
Glenn Randers-Pehrson 2014-01-09 19:20:11 -06:00
parent ea9249fe5b
commit a951c329bd
3 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ANNOUNCE
View File

@ -1,5 +1,5 @@
Libpng 1.5.18beta04 - January 1, 2014
Libpng 1.5.18beta04 - January 10, 2014
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@ -64,7 +64,9 @@ Version 1.5.18beta03 [January 1, 2014]
libpng17/png.h and libpng17.a). Three new configure options and some
rearrangement of Makefile.am allow creation of these links to be disabled.
Version 1.5.18beta04 [January 1, 2014]
Version 1.5.18beta04 [January 10, 2014]
Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX
in the test for potential overflow in PNG_ROWBYTES.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

4
CHANGES
View File

@ -4188,7 +4188,9 @@ Version 1.5.18beta03 [January 1, 2014]
libpng17/png.h and libpng17.a). Three new configure options and some
rearrangement of Makefile.am allow creation of these links to be disabled.
Version 1.5.18beta04 [January 1, 2014]
Version 1.5.18beta04 [January 10, 2014]
Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX
in the test for potential overflow in PNG_ROWBYTES.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

10
png.c
View File

@ -658,13 +658,13 @@ png_get_copyright(png_const_structp png_ptr)
#else
# ifdef __STDC__
return PNG_STRING_NEWLINE \
"libpng version 1.5.18beta04 - January 8, 2014" PNG_STRING_NEWLINE \
"libpng version 1.5.18beta04 - January 10, 2014" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
"Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
PNG_STRING_NEWLINE;
# else
return "libpng version 1.5.18beta04 - January 8, 2014\
return "libpng version 1.5.18beta04 - January 10, 2014\
Copyright (c) 1998-2014 Glenn Randers-Pehrson\
Copyright (c) 1996-1997 Andreas Dilger\
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
@ -1222,12 +1222,14 @@ png_check_IHDR(png_structp png_ptr,
error = 1;
}
if (error == 0 && width > (PNG_UINT_32_MAX
/* Check for potential overflow in PNG_ROWBYTES calculation */
if (error == 0 && width > (PNG_SIZE_MAX
>> 3) /* 8-byte RGBA pixels */
- 48 /* bigrowbuf hack */
- 1 /* filter byte */
- 7*8 /* rounding of width to multiple of 8 pixels */
- 8) /* extra max_pixel_depth pad */
- 8 /* extra max_pixel_depth pad */
- error) /* to prevent always-false compiler warning */
png_warning(png_ptr,
"Width may be too large for libpng to process pixels");