mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng16] Avoid a harmless potential integer overflow in png_XYZ_from_xy().

Browse Source
This commit is contained in:
Glenn Randers-Pehrson
2015-05-20 13:21:53 -05:00
parent 918d23f658
commit d46b570919
3 changed files with 33 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ANNOUNCE
View File

@@ -1,4 +1,4 @@
Libpng 1.6.18beta04 - May 9, 2015 Libpng 1.6.18beta04 - May 20, 2015
This is not intended to be a public release. It will be replaced This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version. within a few weeks by a public version or by another test version.
@@ -46,11 +46,12 @@ Version 1.6.18beta03 [May 6, 2015]
and an example PNG generation tool, contrib/examples/genpng.c and an example PNG generation tool, contrib/examples/genpng.c
(John Bowler). (John Bowler).
Version 1.6.18beta04 [May 9, 2015] Version 1.6.18beta04 [May 20, 2015]
PNG_RELEASE_BUILD replaces tests where the code depended on the build base PNG_RELEASE_BUILD replaces tests where the code depended on the build base
type and can be defined on the command line, allowing testing in beta type and can be defined on the command line, allowing testing in beta
builds (John Bowler). builds (John Bowler).
Avoid Coverity issue 80858 (REVERSE NULL) in pngtest.c Avoid Coverity issue 80858 (REVERSE NULL) in pngtest.c
Avoid a harmless potential integer overflow in png_XYZ_from_xy().
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit

35
CHANGES
View File

@@ -1,11 +1,14 @@
#if 0
CHANGES - changes for libpng CHANGES - changes for libpng
Version 0.2 version 0.1 [March 29, 1995]
initial work-in-progress release
version 0.2 [April 1, 1995]
added reader into png.h added reader into png.h
fixed small problems in stub file fixed small problems in stub file
Version 0.3 version 0.3 [April 8, 1995]
added pull reader added pull reader
split up pngwrite.c to several files split up pngwrite.c to several files
added pnglib.txt added pnglib.txt
@@ -14,9 +17,9 @@ Version 0.3
fixed some bugs in writer fixed some bugs in writer
interfaced with zlib 0.5 interfaced with zlib 0.5
added K&R support added K&R support
added check for 64 KB blocks for 16-bit machines added check for 64 KB blocks for 16 bit machines
Version 0.4 version 0.4 [April 26, 1995]
cleaned up code and commented code cleaned up code and commented code
simplified time handling into png_time simplified time handling into png_time
created png_color_16 and png_color_8 to handle color needs created png_color_16 and png_color_8 to handle color needs
@@ -27,28 +30,29 @@ Version 0.4
cleaned up zTXt reader and writer (using zlib's Reset functions) cleaned up zTXt reader and writer (using zlib's Reset functions)
split transformations into pngrtran.c and pngwtran.c split transformations into pngrtran.c and pngwtran.c
Version 0.5 version 0.5 [April 30, 1995]
interfaced with zlib 0.8 interfaced with zlib 0.8
fixed many reading and writing bugs fixed many reading and writing bugs
saved using 3 spaces instead of tabs saved using 3 spaces instead of tabs
Version 0.6 version 0.6 [May 1, 1995]
first beta release
added png_large_malloc() and png_large_free() added png_large_malloc() and png_large_free()
added png_size_t added png_size_t
cleaned up some compiler warnings cleaned up some compiler warnings
added png_start_read_image() added png_start_read_image()
Version 0.7 version 0.7 [June 24, 1995]
cleaned up lots of bugs cleaned up lots of bugs
finished dithering and other stuff finished dithering and other stuff
added test program added test program
changed name from pnglib to libpng changed name from pnglib to libpng
Version 0.71 [June, 1995] version 0.71 [June 26, 1995]
changed pngtest.png for zlib 0.93 changed pngtest.png for zlib 0.93
fixed error in libpng.txt and example.c fixed error in libpng.txt and example.c
Version 0.8 version 0.8 [August 20, 1995]
cleaned up some bugs cleaned up some bugs
added png_set_filler() added png_set_filler()
split up pngstub.c into pngmem.c, pngio.c, and pngerror.c split up pngstub.c into pngmem.c, pngio.c, and pngerror.c
@@ -1449,8 +1453,9 @@ Version 1.2.6beta4 [July 28, 2004]
Use png_malloc instead of png_zalloc to allocate the pallete. Use png_malloc instead of png_zalloc to allocate the pallete.
Version 1.0.16rc1 and 1.2.6rc1 [August 4, 2004] Version 1.0.16rc1 and 1.2.6rc1 [August 4, 2004]
Fixed buffer overflow vulnerability in png_handle_tRNS() Fixed buffer overflow vulnerability (CVE-2004-0597) in png_handle_tRNS().
Fixed integer arithmetic overflow vulnerability in png_read_png(). Fixed NULL dereference vulnerability (CVE-2004-0598) in png_handle_iCCP().
Fixed integer overflow vulnerability (CVE-2004-0599) in png_read_png().
Fixed some harmless bugs in png_handle_sBIT, etc, that would cause Fixed some harmless bugs in png_handle_sBIT, etc, that would cause
duplicate chunk types to go undetected. duplicate chunk types to go undetected.
Fixed some timestamps in the -config version Fixed some timestamps in the -config version
@@ -5226,11 +5231,12 @@ Version 1.6.18beta03 [May 6, 2015]
and an example PNG generation tool, contrib/examples/genpng.c and an example PNG generation tool, contrib/examples/genpng.c
(John Bowler). (John Bowler).
Version 1.6.18beta04 [May 9, 2015] Version 1.6.18beta04 [May 20, 2015]
PNG_RELEASE_BUILD replaces tests where the code depended on the build base PNG_RELEASE_BUILD replaces tests where the code depended on the build base
type and can be defined on the command line, allowing testing in beta type and can be defined on the command line, allowing testing in beta
builds (John Bowler). builds (John Bowler).
Avoid Coverity issue 80858 (REVERSE NULL) in pngtest.c Avoid Coverity issue 80858 (REVERSE NULL) in pngtest.c PNG_DEBUG builds.
Avoid a harmless potential integer overflow in png_XYZ_from_xy().
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit
@@ -5239,3 +5245,4 @@ to subscribe)
or to glennrp at users.sourceforge.net or to glennrp at users.sourceforge.net
Glenn R-P Glenn R-P
#endif

17
png.c
View File

@@ -766,13 +766,13 @@ png_get_copyright(png_const_structrp png_ptr)
#else #else
# ifdef __STDC__ # ifdef __STDC__
return PNG_STRING_NEWLINE \ return PNG_STRING_NEWLINE \
"libpng version 1.6.18beta04 - May 9, 2015" PNG_STRING_NEWLINE \ "libpng version 1.6.18beta04 - May 20, 2015" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
"Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
PNG_STRING_NEWLINE; PNG_STRING_NEWLINE;
# else # else
return "libpng version 1.6.18beta04 - May 9, 2015\ return "libpng version 1.6.18beta04 - May 20, 2015\
Copyright (c) 1998-2015 Glenn Randers-Pehrson\ Copyright (c) 1998-2015 Glenn Randers-Pehrson\
Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1996-1997 Andreas Dilger\
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."; Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
@@ -1235,16 +1235,17 @@ png_XYZ_from_xy(png_XYZ *XYZ, const png_xy *xy)
/* Check xy and, implicitly, z. Note that wide gamut color spaces typically /* Check xy and, implicitly, z. Note that wide gamut color spaces typically
* have end points with 0 tristimulus values (these are impossible end * have end points with 0 tristimulus values (these are impossible end
* points, but they are used to cover the possible colors.) * points, but they are used to cover the possible colors). We check
* xy->whitey against 5, not 0, to avoid a possible integer overflow.
*/ */
if (xy->redx < 0 || xy->redx > PNG_FP_1) return 1; if (xy->redx < 0 || xy->redx > PNG_FP_1) return 1;
if (xy->redy < 0 || xy->redy > PNG_FP_1-xy->redx) return 1; if (xy->redy < 0 || xy->redy > PNG_FP_1-xy->redx) return 1;
if (xy->greenx < 0 || xy->greenx > PNG_FP_1) return 1; if (xy->greenx < 0 || xy->greenx > PNG_FP_1) return 1;
if (xy->greeny < 0 || xy->greeny > PNG_FP_1-xy->greenx) return 1; if (xy->greeny < 0 || xy->greeny > PNG_FP_1-xy->greenx) return 1;
if (xy->bluex < 0 || xy->bluex > PNG_FP_1) return 1; if (xy->bluex < 0 || xy->bluex > PNG_FP_1) return 1;
if (xy->bluey < 0 || xy->bluey > PNG_FP_1-xy->bluex) return 1; if (xy->bluey < 0 || xy->bluey > PNG_FP_1-xy->bluex) return 1;
if (xy->whitex < 0 || xy->whitex > PNG_FP_1) return 1; if (xy->whitex < 0 || xy->whitex > PNG_FP_1) return 1;
if (xy->whitey < 0 || xy->whitey > PNG_FP_1-xy->whitex) return 1; if (xy->whitey < 5 || xy->whitey > PNG_FP_1-xy->whitex) return 1;
/* The reverse calculation is more difficult because the original tristimulus /* The reverse calculation is more difficult because the original tristimulus
* value had 9 independent values (red,green,blue)x(X,Y,Z) however only 8 * value had 9 independent values (red,green,blue)x(X,Y,Z) however only 8