[libpng16] fix: Correct the function png_fp_sub in png.c

The code erroneously evaluated `addend0+addend1` in the case where
`addend1` is less than zero.  The function is meant to subtract the
second argument from the first.

This is a cherry-pick of commit 79fd6d1edc8fe8c41ed58c6318bd57761d8f007e
from branch 'libpng18'.

Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This commit is contained in:
John Bowler 2024-10-10 08:40:41 -07:00 committed by Cosmin Truta
parent 7c90057cfe
commit f14d5fcd1e

2
png.c
View File

@ -1241,7 +1241,7 @@ png_fp_sub(png_int_32 addend0, png_int_32 addend1, int *error)
else if (addend1 < 0) else if (addend1 < 0)
{ {
if (0x7fffffff + addend1 >= addend0) if (0x7fffffff + addend1 >= addend0)
return addend0+addend1; return addend0-addend1;
} }
else else
return addend0; return addend0;