diff --git a/ANNOUNCE b/ANNOUNCE index 8466ba49d..40d92e3b8 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -319,7 +319,6 @@ Version 1.6.0beta18 [March 16, 2012] this is disabled in which case the simplified API can't be built.) Version 1.6.0beta19 [March 17, 2012] - Revised png_set_text_2() to avoid potential memory corruption. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index ccd90518c..cf990b8e8 100644 --- a/CHANGES +++ b/CHANGES @@ -4070,7 +4070,6 @@ Version 1.6.0beta18 [March 16, 2012] this is disabled in which case the simplified API can't be built.) Version 1.6.0beta19 [March 17, 2012] - Revised png_set_text_2() to avoid potential memory corruption. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/pngset.c b/pngset.c index 6b74d945b..bde866f89 100644 --- a/pngset.c +++ b/pngset.c @@ -706,28 +706,24 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr, */ if (info_ptr->num_text + num_text > info_ptr->max_text) { - int old_max_text = info_ptr->max_text; - int old_num_text = info_ptr->num_text; - if (info_ptr->text != NULL) { png_textp old_text; + int old_max; + old_max = info_ptr->max_text; info_ptr->max_text = info_ptr->num_text + num_text + 8; old_text = info_ptr->text; - info_ptr->text = (png_textp)png_malloc_warn(png_ptr, (png_size_t)(info_ptr->max_text * png_sizeof(png_text))); if (info_ptr->text == NULL) { - /* Restore to previous condition */ - info_ptr->max_text = old_max_text; - info_ptr->text = old_text; + png_free(png_ptr, old_text); return(1); } - png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max_text * + png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max * png_sizeof(png_text))); png_free(png_ptr, old_text); } @@ -739,12 +735,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr, info_ptr->text = (png_textp)png_malloc_warn(png_ptr, (png_size_t)(info_ptr->max_text * png_sizeof(png_text))); if (info_ptr->text == NULL) - { - /* Restore to previous condition */ - info_ptr->num_text = old_num_text; - info_ptr->max_text = old_max_text; return(1); - } info_ptr->free_me |= PNG_FREE_TEXT; }