minecraft-pi-reborn/libpng
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[libpng12] Issue a png_error() instead of a png_warning() when width is

Browse Source 
potentially too large for the architecture, in case the calling
application has overridden the default 1,000,000-column limit
(fixes CVE-2014-9495 and CVE-2015-0973).
This commit is contained in:
Glenn Randers-Pehrson 2015-01-31 13:08:48 -06:00
parent f34e3f4667
commit a4d40f32dd
3 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ANNOUNCE
View File

@ -44,6 +44,10 @@ Other information:
Changes since the last public release (1.2.52): Changes since the last public release (1.2.52):
version 1.2.53beta01 [RDATE%] version 1.2.53beta01 [RDATE%]
Issue a png_error() instead of a png_warning() when width is
potentially too large for the architecture, in case the calling
application has overridden the default 1,000,000-column limit
(fixes CVE-2014-9495 and CVE-2015-0973).
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit

4
CHANGES
View File

@ -2829,6 +2829,10 @@ version 1.0.62 and 1.2.52 [November 20, 2014]
No changes. No changes.
version 1.2.53beta01 [RDATE%] version 1.2.53beta01 [RDATE%]
Issue a png_error() instead of a png_warning() when width is
potentially too large for the architecture, in case the calling
application has overridden the default 1,000,000-column limit
(fixes CVE-2014-9495 and CVE-2015-0973).
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit

3
pngset.c
View File

@ -263,7 +263,10 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
- 1 /* filter byte */ - 1 /* filter byte */
- 7*8 /* rounding of width to multiple of 8 pixels */ - 7*8 /* rounding of width to multiple of 8 pixels */
- 8) /* extra max_pixel_depth pad */ - 8) /* extra max_pixel_depth pad */
{
info_ptr->rowbytes = (png_size_t)0; info_ptr->rowbytes = (png_size_t)0;
png_error(png_ptr, "Image width is too large for this architecture");
}
else else
info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width); info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
} }