mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

Fix error in handling of bad zlib CMINFO field

Browse Source 
Signed-off-by: John Bowler <jbowler@acm.org>
This commit is contained in:
John Bowler 2015-11-25 12:59:42 -08:00
parent 92ec30a3b1
commit f5778c8fbb
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
contrib/tools/pngfix.c
View File

@ -2221,7 +2221,7 @@ zlib_init(struct zlib *zlib, struct IDAT *idat, struct chunk *chunk,
/* These values are sticky across reset (in addition to the stuff in the /* These values are sticky across reset (in addition to the stuff in the
* first block, which is actually constant.) * first block, which is actually constant.)
*/ */
zlib->file_bits = 16; zlib->file_bits = 24;
zlib->ok_bits = 16; /* unset */ zlib->ok_bits = 16; /* unset */
zlib->cksum = 0; /* set when a checksum error is detected */ zlib->cksum = 0; /* set when a checksum error is detected */
@ -2304,10 +2304,12 @@ zlib_advance(struct zlib *zlib, png_uint_32 nbytes)
zlib->file_bits = file_bits; zlib->file_bits = file_bits;
/* Check against the existing value - it may not need to be /* Check against the existing value - it may not need to be
* changed. * changed. Note that a bogus file_bits is allowed through once,
* to see if it works, but the window_bits value is set to 15,
* the maximum.
*/ */
if (new_bits == 0) /* no change */ if (new_bits == 0) /* no change */
zlib->window_bits = file_bits; zlib->window_bits = ((file_bits > 15) ? 15 : file_bits);
else if (new_bits != file_bits) /* rewrite required */ else if (new_bits != file_bits) /* rewrite required */
bIn = (png_byte)((bIn & 0xf) + ((new_bits-8) << 4)); bIn = (png_byte)((bIn & 0xf) + ((new_bits-8) << 4));
@ -2328,8 +2330,7 @@ zlib_advance(struct zlib *zlib, png_uint_32 nbytes)
if (bIn != b2) if (bIn != b2)
{ {
/* If the first byte wasn't changed this indicates an error in /* If the first byte wasn't changed this indicates an error in
* the checksum calculation; signal this by setting file_bits * the checksum calculation; signal this by setting 'cksum'.
* (not window_bits) to 0.
*/ */
if (zlib->file_bits == zlib->window_bits) if (zlib->file_bits == zlib->window_bits)
zlib->cksum = 1; zlib->cksum = 1;