From b4c2bc864f8105cd96b9ac83bce32a9495115174 Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Mon, 10 Dec 2012 10:07:29 -0600
Subject: [PATCH] [libpng14] Ignore, with a warning, out-of-range value of
 num_trans

in png_set_tRNS().
---
 ANNOUNCE | 5 +++--
 CHANGES  | 3 ++-
 pngset.c | 8 +++++++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/ANNOUNCE b/ANNOUNCE
index ec9f92e66..6f57a4e8c 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
 
-Libpng 1.4.13beta01 - August 3, 2012
+Libpng 1.4.13beta01 - December 10, 2012
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -32,9 +32,10 @@ version 1.4.12 [July 10, 2012]
     pngsuite/README.txt.
   Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386.
 
-version 1.4.13beta01 [August 3, 2012]
+version 1.4.13beta01 [December 10, 2012]
   Do not compile PNG_DEPRECATED, PNG_ALLOC and PNG_PRIVATE when __GNUC__ < 3.
   Removed references to png_zalloc() and png_zfree() from the manual.
+  Ignore, with a warning, out-of-range value of num_trans in png_set_tRNS().
 
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit
diff --git a/CHANGES b/CHANGES
index d53c69149..e0cd9e45c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2874,9 +2874,10 @@ version 1.4.12 [July 10, 2012]
     pngsuite/README.txt.
   Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386.
 
-version 1.4.13beta01 [August 3, 2012]
+version 1.4.13beta01 [December 10, 2012]
   Do not compile PNG_DEPRECATED, PNG_ALLOC and PNG_PRIVATE when __GNUC__ < 3.
   Removed references to png_zalloc() and png_zfree() from the manual.
+  Ignore, with a warning, out-of-range value of num_trans in png_set_tRNS().
 
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit
diff --git a/pngset.c b/pngset.c
index 17ddfca29..0afe8959b 100644
--- a/pngset.c
+++ b/pngset.c
@@ -1,7 +1,7 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.4.11 [March 29, 2012]
+ * Last changed in libpng 1.4.13 [December 10, 2012]
  * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -836,6 +836,12 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
+   if (num_trans < 0 || num_trans > PNG_MAX_PALETTE_LENGTH)
+      {
+        png_warning(png_ptr, "Ignoring invalid num_trans value");
+        return;
+      }
+
    if (trans_alpha != NULL)
    {
        /* It may not actually be necessary to set png_ptr->trans_alpha here;