Fixed inconsistency in use of "row_bytes" in pngrutil.c

The memset() should use "row_bytes" instead of "png_ptr->rowbytes".
This bug was introduced in libpng-1.2.36.
This commit is contained in:
Glenn Randers-Pehrson 2009-05-12 05:49:10 -05:00
parent 031a8648cb
commit 549a5101e7
3 changed files with 11 additions and 6 deletions

View File

@ -1,5 +1,5 @@
Libpng 1.2.37beta01 - May 7, 2009
Libpng 1.2.37beta01 - May 12, 2009
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@ -43,8 +43,10 @@ Other information:
Changes since the last public release (1.2.36):
version 1.2.37beta01 [May 7, 2009]
version 1.2.37beta01 [May 12, 2009]
Fixed inconsistency in pngrutil.c, introduced in libpng-1.2.36. The
memset() was using "png_ptr->rowbytes" instead of "row_bytes", which
the corresponding png_malloc() uses (Joe Drew).
Send comments/corrections/commendations to png-mng-implement at lists.sf.net

View File

@ -2368,7 +2368,10 @@ version 1.2.36rc01 [April 30, 2009]
version 1.0.44 and 1.2.36 [May 7, 2009]
No changes.
version 1.2.37beta01 [May 7, 2009]
version 1.2.37beta01 [May 12, 2009]
Fixed inconsistency in pngrutil.c, introduced in libpng-1.2.36. The
memset() was using "png_ptr->rowbytes" instead of "row_bytes", which
the corresponding png_malloc() uses (Joe Drew).
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

View File

@ -1,7 +1,7 @@
/* pngrutil.c - utilities to read a PNG file
*
* Last changed in libpng 1.2.36 [May 7, 2009]
* Last changed in libpng 1.2.37 [May 12, 2009]
* For conditions of distribution and use, see copyright notice in png.h
* Copyright (c) 1998-2009 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@ -3189,7 +3189,7 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
png_free(png_ptr, png_ptr->big_row_buf);
png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 64);
if (png_ptr->interlaced)
png_memset(png_ptr->big_row_buf, 0, png_ptr->rowbytes + 64);
png_memset(png_ptr->big_row_buf, 0, row_bytes + 64);
png_ptr->row_buf = png_ptr->big_row_buf + 32;
png_ptr->old_big_row_buf_size = row_bytes + 64;
}