mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[master] Reverted to original png_push_save_buffer() code.

Browse Source
This commit is contained in:
Glenn Randers-Pehrson 2010-02-07 23:02:42 -06:00
parent 27854a478e
commit bd209f75fa
3 changed files with 9 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ANNOUNCE
View File

@ -70,7 +70,7 @@ version 1.4.1beta08 [February 6, 2010]
Minor cleanup and updating of dates and copyright year.
version 1.4.1beta09 [February 8, 2010]
Fixed incorrect test in new png_push_save_buffer() code.
Reverted to original png_push_save_buffer() code.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

2
CHANGES
View File

@ -2503,7 +2503,7 @@ version 1.4.1beta08 [February 6, 2010]
Minor cleanup and updating of dates and copyright year.
version 1.4.1beta09 [February 8, 2010]
Fixed incorrect test in new png_push_save_buffer() code.
Reverted to original png_push_save_buffer() code.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

22
pngpread.c
View File

@ -686,27 +686,19 @@ png_push_save_buffer(png_structp png_ptr)
}
}
}
if (png_ptr->save_buffer_size >
(png_ptr->save_buffer_max - png_ptr->current_buffer_size))
if (png_ptr->save_buffer_size + png_ptr->current_buffer_size >
png_ptr->save_buffer_max)
{
png_size_t new_max;
png_bytep old_buffer;
if (png_ptr->save_buffer_max == PNG_SIZE_MAX ||
(png_ptr->save_buffer_size > PNG_SIZE_MAX -
png_ptr->current_buffer_size))
png_error(png_ptr, "Overflow of save_buffer");
if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
(png_ptr->current_buffer_size +
(png_ptr->save_buffer_size >> 3) + 256))
new_max = PNG_SIZE_MAX;
(png_ptr->current_buffer_size + 256))
{
png_error(png_ptr, "Potential overflow of save_buffer");
}
else
new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size +
(png_ptr->save_buffer_size >> 3) + 256;
new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
old_buffer = png_ptr->save_buffer;
png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr,
(png_size_t)new_max);