mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[master] Imported from libpng-1.5.14.tar

Browse Source
This commit is contained in:
Glenn Randers-Pehrson
2013-01-23 20:59:12 -06:00
parent c2ac10b502
commit d14caad2e9
62 changed files with 2504 additions and 1868 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
pngset.c
View File

@@ -1,8 +1,8 @@
/* pngset.c - storage of image information into info struct
*
* Last changed in libpng 1.5.11 [June 14, 2012]
* Copyright (c) 1998-2012 Glenn Randers-Pehrson
* Last changed in libpng 1.5.14 [January 24, 2013]
* Copyright (c) 1998-2013 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
@@ -690,6 +690,17 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
/* Make sure we have enough space in the "text" array in info_struct
* to hold all of the incoming text_ptr objects.
*/
if (num_text < 0 ||
num_text > INT_MAX - info_ptr->num_text - 8 ||
(unsigned int)/*SAFE*/(num_text +/*SAFE*/
info_ptr->num_text + 8) >=
PNG_SIZE_MAX/png_sizeof(png_text))
{
png_warning(png_ptr, "too many text chunks");
return(0);
}
if (info_ptr->num_text + num_text > info_ptr->max_text)
{
int old_max_text = info_ptr->max_text;
@@ -897,6 +908,12 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
if (png_ptr == NULL || info_ptr == NULL)
return;
if (num_trans < 0 || num_trans > PNG_MAX_PALETTE_LENGTH)
{
png_warning(png_ptr, "Ignoring invalid num_trans value");
return;
}
if (trans_alpha != NULL)
{
/* It may not actually be necessary to set png_ptr->trans_alpha here;
@@ -963,9 +980,18 @@ png_set_sPLT(png_structp png_ptr,
if (png_ptr == NULL || info_ptr == NULL)
return;
np = (png_sPLT_tp)png_malloc_warn(png_ptr,
(info_ptr->splt_palettes_num + nentries) *
(png_size_t)png_sizeof(png_sPLT_t));
if (nentries < 0 ||
nentries > INT_MAX-info_ptr->splt_palettes_num ||
(unsigned int)/*SAFE*/(nentries +/*SAFE*/
info_ptr->splt_palettes_num) >=
PNG_SIZE_MAX/png_sizeof(png_sPLT_t))
np=NULL;
else
np = (png_sPLT_tp)png_malloc_warn(png_ptr,
(info_ptr->splt_palettes_num + nentries) *
(png_size_t)png_sizeof(png_sPLT_t));
if (np == NULL)
{
@@ -1033,9 +1059,17 @@ png_set_unknown_chunks(png_structp png_ptr,
if (png_ptr == NULL || info_ptr == NULL || num_unknowns == 0)
return;
np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
(png_size_t)(info_ptr->unknown_chunks_num + num_unknowns) *
png_sizeof(png_unknown_chunk));
if (num_unknowns < 0 ||
num_unknowns > INT_MAX-info_ptr->unknown_chunks_num ||
(unsigned int)/*SAFE*/(num_unknowns +/*SAFE*/
info_ptr->unknown_chunks_num) >=
PNG_SIZE_MAX/png_sizeof(png_unknown_chunk))
np=NULL;
else
np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
(png_size_t)(info_ptr->unknown_chunks_num + num_unknowns) *
png_sizeof(png_unknown_chunk));
if (np == NULL)
{