mirror of
https://git.code.sf.net/p/libpng/code.git
synced 2025-07-10 18:04:09 +02:00
Imported from libpng-1.2.21rc2.tar
This commit is contained in:
20
pngrutil.c
20
pngrutil.c
@@ -1,7 +1,7 @@
|
||||
|
||||
/* pngrutil.c - utilities to read a PNG file
|
||||
*
|
||||
* Last changed in libpng 1.2.21 [September 26, 2007]
|
||||
* Last changed in libpng 1.2.21 [September 27, 2007]
|
||||
* For conditions of distribution and use, see copyright notice in png.h
|
||||
* Copyright (c) 1998-2007 Glenn Randers-Pehrson
|
||||
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
|
||||
@@ -1771,6 +1771,17 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
|
||||
/* empty loop */ ;
|
||||
ep++;
|
||||
|
||||
if (buffer + slength < ep)
|
||||
{
|
||||
png_warning(png_ptr, "Truncated sCAL chunk");
|
||||
#if defined(PNG_FIXED_POINT_SUPPORTED) && \
|
||||
!defined(PNG_FLOATING_POINT_SUPPORTED)
|
||||
png_free(png_ptr, swidth);
|
||||
#endif
|
||||
png_free(png_ptr, buffer);
|
||||
return;
|
||||
}
|
||||
|
||||
#ifdef PNG_FLOATING_POINT_SUPPORTED
|
||||
height = png_strtod(png_ptr, ep, &vp);
|
||||
if (*vp)
|
||||
@@ -2114,6 +2125,13 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
|
||||
/* empty loop */ ;
|
||||
lang_key++; /* skip NUL separator */
|
||||
|
||||
if (lang_key >= chunkdata + slength)
|
||||
{
|
||||
png_warning(png_ptr, "Truncated iTXt chunk");
|
||||
png_free(png_ptr, chunkdata);
|
||||
return;
|
||||
}
|
||||
|
||||
for (text = lang_key; *text; text++)
|
||||
/* empty loop */ ;
|
||||
text++; /* skip NUL separator */
|
||||
|
||||
Reference in New Issue
Block a user