From 3dfd0cd62a5cdfafb1e499f62d507911e3b4b3a7 Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Wed, 30 Sep 2009 13:38:37 -0500
Subject: [PATCH] [master] Add a test to make sure the user isn't trying to
 stuff height into

a 16-bit int (assuming height immediately follows width).
---
 pngconf.h | 15 ++++++++-------
 pngget.c  | 15 ++++++++++++++-
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/pngconf.h b/pngconf.h
index 7440d970..8c7b73e4 100644
--- a/pngconf.h
+++ b/pngconf.h
@@ -1,7 +1,7 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.2.41beta01 - September 25, 2009
+ * libpng version 1.2.41beta02 - September 30, 2009
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -787,6 +787,7 @@
 #endif
 /* end of obsolete code to be removed from libpng-1.4.0 */
 
+/* Added at libpng-1.2.0 */
 #if !defined(PNG_1_0_X)
 #if !defined(PNG_NO_USER_MEM) && !defined(PNG_USER_MEM_SUPPORTED)
 #  define PNG_USER_MEM_SUPPORTED
@@ -794,12 +795,12 @@
 #endif /* PNG_1_0_X */
 
 /* Added at libpng-1.2.6 */
-#if !defined(PNG_1_0_X)
-#ifndef PNG_SET_USER_LIMITS_SUPPORTED
-#if !defined(PNG_NO_SET_USER_LIMITS) && !defined(PNG_SET_USER_LIMITS_SUPPORTED)
-#  define PNG_SET_USER_LIMITS_SUPPORTED
-#endif
-#endif
+#ifndef PNG_1_0_X
+#  ifndef PNG_SET_USER_LIMITS_SUPPORTED
+#    ifndef PNG_NO_SET_USER_LIMITS
+#      define PNG_SET_USER_LIMITS_SUPPORTED
+#    endif
+#  endif
 #endif /* PNG_1_0_X */
 
 /* Added at libpng-1.0.16 and 1.2.6.  To accept all valid PNGS no matter
diff --git a/pngget.c b/pngget.c
index 25dc9da1..b6d87304 100644
--- a/pngget.c
+++ b/pngget.c
@@ -1,7 +1,7 @@
 
 /* pngget.c - retrieval of values from info struct
  *
- * Last changed in libpng 1.2.41 [September 25, 2009]
+ * Last changed in libpng 1.2.41 [September 30, 2009]
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -577,6 +577,19 @@ png_get_IHDR(png_structp png_ptr, png_infop info_ptr,
        height == NULL || bit_depth == NULL || color_type == NULL)
       return (0);
 
+#ifdef PNG_DEBUG
+   /* Test to make sure the user isn't trying to stuff height into
+    * a 16-bit int (assuming height immediately follows width).
+    */
+   *width = 0;
+   *height = PNG_UINT_31_MAX;
+   if (*width != 0)
+   {
+     png_warning(png_ptr,
+       "Application's height variable cannot hold a 32-bit value");
+   }
+#endif
+
    *width = info_ptr->width;
    *height = info_ptr->height;
    *bit_depth = info_ptr->bit_depth;