[master] Add a test to make sure the user isn't trying to stuff height into
a 16-bit int (assuming height immediately follows width).
This commit is contained in:
parent
18bd86f154
commit
3dfd0cd62a
@ -1,7 +1,7 @@
|
|||||||
|
|
||||||
/* pngconf.h - machine configurable file for libpng
|
/* pngconf.h - machine configurable file for libpng
|
||||||
*
|
*
|
||||||
* libpng version 1.2.41beta01 - September 25, 2009
|
* libpng version 1.2.41beta02 - September 30, 2009
|
||||||
* Copyright (c) 1998-2009 Glenn Randers-Pehrson
|
* Copyright (c) 1998-2009 Glenn Randers-Pehrson
|
||||||
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
|
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
|
||||||
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
|
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
|
||||||
@ -787,6 +787,7 @@
|
|||||||
#endif
|
#endif
|
||||||
/* end of obsolete code to be removed from libpng-1.4.0 */
|
/* end of obsolete code to be removed from libpng-1.4.0 */
|
||||||
|
|
||||||
|
/* Added at libpng-1.2.0 */
|
||||||
#if !defined(PNG_1_0_X)
|
#if !defined(PNG_1_0_X)
|
||||||
#if !defined(PNG_NO_USER_MEM) && !defined(PNG_USER_MEM_SUPPORTED)
|
#if !defined(PNG_NO_USER_MEM) && !defined(PNG_USER_MEM_SUPPORTED)
|
||||||
# define PNG_USER_MEM_SUPPORTED
|
# define PNG_USER_MEM_SUPPORTED
|
||||||
@ -794,9 +795,9 @@
|
|||||||
#endif /* PNG_1_0_X */
|
#endif /* PNG_1_0_X */
|
||||||
|
|
||||||
/* Added at libpng-1.2.6 */
|
/* Added at libpng-1.2.6 */
|
||||||
#if !defined(PNG_1_0_X)
|
#ifndef PNG_1_0_X
|
||||||
# ifndef PNG_SET_USER_LIMITS_SUPPORTED
|
# ifndef PNG_SET_USER_LIMITS_SUPPORTED
|
||||||
#if !defined(PNG_NO_SET_USER_LIMITS) && !defined(PNG_SET_USER_LIMITS_SUPPORTED)
|
# ifndef PNG_NO_SET_USER_LIMITS
|
||||||
# define PNG_SET_USER_LIMITS_SUPPORTED
|
# define PNG_SET_USER_LIMITS_SUPPORTED
|
||||||
# endif
|
# endif
|
||||||
# endif
|
# endif
|
||||||
|
15
pngget.c
15
pngget.c
@ -1,7 +1,7 @@
|
|||||||
|
|
||||||
/* pngget.c - retrieval of values from info struct
|
/* pngget.c - retrieval of values from info struct
|
||||||
*
|
*
|
||||||
* Last changed in libpng 1.2.41 [September 25, 2009]
|
* Last changed in libpng 1.2.41 [September 30, 2009]
|
||||||
* Copyright (c) 1998-2009 Glenn Randers-Pehrson
|
* Copyright (c) 1998-2009 Glenn Randers-Pehrson
|
||||||
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
|
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
|
||||||
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
|
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
|
||||||
@ -577,6 +577,19 @@ png_get_IHDR(png_structp png_ptr, png_infop info_ptr,
|
|||||||
height == NULL || bit_depth == NULL || color_type == NULL)
|
height == NULL || bit_depth == NULL || color_type == NULL)
|
||||||
return (0);
|
return (0);
|
||||||
|
|
||||||
|
#ifdef PNG_DEBUG
|
||||||
|
/* Test to make sure the user isn't trying to stuff height into
|
||||||
|
* a 16-bit int (assuming height immediately follows width).
|
||||||
|
*/
|
||||||
|
*width = 0;
|
||||||
|
*height = PNG_UINT_31_MAX;
|
||||||
|
if (*width != 0)
|
||||||
|
{
|
||||||
|
png_warning(png_ptr,
|
||||||
|
"Application's height variable cannot hold a 32-bit value");
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
*width = info_ptr->width;
|
*width = info_ptr->width;
|
||||||
*height = info_ptr->height;
|
*height = info_ptr->height;
|
||||||
*bit_depth = info_ptr->bit_depth;
|
*bit_depth = info_ptr->bit_depth;
|
||||||
|
Reference in New Issue
Block a user