mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[devel] Imported from libpng-1.5.0beta02.tar

Browse Source
This commit is contained in:
Glenn Randers-Pehrson
2010-02-07 22:42:58 -06:00
parent c40df89cef
commit e00ed36d71
30 changed files with 85 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
pngpread.c
View File

@@ -687,27 +687,19 @@ png_push_save_buffer(png_structp png_ptr)
}
}
}
if (png_ptr->save_buffer_size >
(png_ptr->save_buffer_max - png_ptr->current_buffer_size))
if (png_ptr->save_buffer_size + png_ptr->current_buffer_size >
png_ptr->save_buffer_max)
{
png_size_t new_max;
png_bytep old_buffer;
if (png_ptr->save_buffer_max == PNG_SIZE_MAX ||
(png_ptr->save_buffer_size > PNG_SIZE_MAX -
png_ptr->current_buffer_size))
png_error(png_ptr, "Overflow of save_buffer");
if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
(png_ptr->current_buffer_size +
(png_ptr->save_buffer_size >> 3) + 256))
new_max = PNG_SIZE_MAX;
(png_ptr->current_buffer_size + 256))
{
png_error(png_ptr, "Potential overflow of save_buffer");
}
else
new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size +
(png_ptr->save_buffer_size >> 3) + 256;
new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
old_buffer = png_ptr->save_buffer;
png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr,
(png_size_t)new_max);