mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng14] Revised png_check_IHDR() to use PNG_SIZE_MAX instead of

Browse Source 
PNG_UINT_32_MAX in the test for potential overflow in PNG_ROWBYTES.
This commit is contained in:
Glenn Randers-Pehrson 2014-01-09 20:02:23 -06:00
parent 5a6b2ffb4e
commit cb7e08875a
3 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ANNOUNCE
View File

@ -1,5 +1,5 @@
Libpng 1.4.13beta05 - January 1, 2014 Libpng 1.4.13beta05 - January 10, 2014
This is not intended to be a public release. It will be replaced This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version. within a few weeks by a public version or by another test version.
@ -51,8 +51,10 @@ version 1.4.13beta04 [January 1, 2014]
Changed '"%s"m' to '"%s" m' in png_debug macros to improve portability Changed '"%s"m' to '"%s" m' in png_debug macros to improve portability
among compilers. among compilers.
version 1.4.13beta05 [January 1, 2014] version 1.4.13beta05 [January 10, 2014]
Rebuilt the configure scripts with autoconf-2.69 and automake-1.14.1 Rebuilt the configure scripts with autoconf-2.69 and automake-1.14.1
Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX
in the test for potential overflow in PNG_ROWBYTES.
Send comments/corrections/commendations to glennrp at users.sourceforge.net Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit or to png-mng-implement at lists.sf.net (subscription required; visit

4
CHANGES
View File

@ -2893,8 +2893,10 @@ version 1.4.13beta04 [January 1, 2014]
Changed '"%s"m' to '"%s" m' in png_debug macros to improve portability Changed '"%s"m' to '"%s" m' in png_debug macros to improve portability
among compilers. among compilers.
version 1.4.13beta05 [January 1, 2014] version 1.4.13beta05 [January 10, 2014]
Rebuilt the configure scripts with autoconf-2.69 and automake-1.14.1 Rebuilt the configure scripts with autoconf-2.69 and automake-1.14.1
Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX
in the test for potential overflow in PNG_ROWBYTES.
Send comments/corrections/commendations to glennrp at users.sourceforge.net Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit or to png-mng-implement at lists.sf.net (subscription required; visit

13
png.c
View File

@ -547,13 +547,13 @@ png_get_copyright(png_const_structp png_ptr)
#else #else
#ifdef __STDC__ #ifdef __STDC__
return ((png_charp) PNG_STRING_NEWLINE \ return ((png_charp) PNG_STRING_NEWLINE \
"libpng version 1.4.13beta05 - January 1, 2014" PNG_STRING_NEWLINE \ "libpng version 1.4.13beta05 - January 10, 2014" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2010 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2010 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
"Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
PNG_STRING_NEWLINE); PNG_STRING_NEWLINE);
#else #else
return ((png_charp) "libpng version 1.4.13beta05 - January 1, 2014\ return ((png_charp) "libpng version 1.4.13beta05 - January 10, 2014\
Copyright (c) 1998-2010 Glenn Randers-Pehrson\ Copyright (c) 1998-2010 Glenn Randers-Pehrson\
Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1996-1997 Andreas Dilger\
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."); Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.");
@ -823,13 +823,16 @@ png_check_IHDR(png_structp png_ptr,
error = 1; error = 1;
} }
if ( width > (PNG_UINT_32_MAX /* Check for potential overflow in PNG_ROWBYTES calculation */
if (error == 0 && width > (PNG_SIZE_MAX
>> 3) /* 8-byte RGBA pixels */ >> 3) /* 8-byte RGBA pixels */
- 64 /* bigrowbuf hack */ - 64 /* bigrowbuf hack */
- 1 /* filter byte */ - 1 /* filter byte */
- 7*8 /* rounding of width to multiple of 8 pixels */ - 7*8 /* rounding of width to multiple of 8 pixels */
- 8) /* extra max_pixel_depth pad */ - 8 /* extra max_pixel_depth pad */
png_warning(png_ptr, "Width is too large for libpng to process pixels"); - error) /* to prevent always-false compiler warning */
png_warning(png_ptr,
"Width may be too large for libpng to process pixels");
/* Check other values */ /* Check other values */
if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 && if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 &&