mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

Ensure that only one eXIf chunk is written in the entire datastream

Browse Source 
EXIF data can be stored in an eXIf chunk before IDAT, or after IDAT,
but the entire PNG datastream may contain one eXIf chunk at most.

Introduce the private mode flag PNG_WROTE_eXIf, which is meant to be
used like the PNG_WROTE_tIME flag. The eXIf chunk and the tIME chunk
have the same ordering rules (i.e. no constraints are imposed), and
the same multiplicity rules (i.e. no multiples are allowed), and they
should be initialized and checked using the same algorithm.

This fixes commit cd03aaf7bf,
previously reverted in 3d57708c91.

Reported-by: Ben Bullock <benkasminbullock@gmail.com>
This commit is contained in:
Cosmin Truta
2023-06-21 16:16:07 +03:00
parent 8be5c147d5
commit e6c5bf46c4
3 changed files with 22 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
pngset.c
View File

@@ -137,44 +137,39 @@ png_set_cHRM_XYZ(png_const_structrp png_ptr, png_inforp info_ptr, double red_X,
#ifdef PNG_eXIf_SUPPORTED
void PNGAPI
png_set_eXIf(png_const_structrp png_ptr, png_inforp info_ptr,
png_bytep eXIf_buf)
png_bytep exif)
{
png_warning(png_ptr, "png_set_eXIf does not work; use png_set_eXIf_1");
PNG_UNUSED(info_ptr)
PNG_UNUSED(eXIf_buf)
PNG_UNUSED(exif)
}
void PNGAPI
png_set_eXIf_1(png_const_structrp png_ptr, png_inforp info_ptr,
png_uint_32 num_exif, png_bytep eXIf_buf)
png_uint_32 num_exif, png_bytep exif)
{
int i;
png_bytep new_exif;
png_debug1(1, "in %s storage function", "eXIf");
if (png_ptr == NULL || info_ptr == NULL)
if (png_ptr == NULL || info_ptr == NULL ||
(png_ptr->mode & PNG_WROTE_eXIf) != 0)
return;
if (info_ptr->exif)
{
png_free(png_ptr, info_ptr->exif);
info_ptr->exif = NULL;
}
new_exif = png_voidcast(png_bytep, png_malloc_warn(png_ptr, num_exif));
info_ptr->num_exif = num_exif;
info_ptr->exif = png_voidcast(png_bytep, png_malloc_warn(png_ptr,
info_ptr->num_exif));
if (info_ptr->exif == NULL)
if (new_exif == NULL)
{
png_warning(png_ptr, "Insufficient memory for eXIf chunk data");
return;
}
for (i = 0; i < (int) info_ptr->num_exif; i++)
info_ptr->exif[i] = eXIf_buf[i];
memcpy(new_exif, exif, (size_t)num_exif);
png_free_data(png_ptr, info_ptr, PNG_FREE_EXIF, 0);
info_ptr->num_exif = num_exif;
info_ptr->exif = new_exif;
info_ptr->free_me |= PNG_FREE_EXIF;
info_ptr->valid |= PNG_INFO_eXIf;
}