cheng/libpng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[devel] Prevent png_push_crc_skip() from hanging while reading an unknown chunk

Browse Source 
or an over-large compressed zTXt chunk with the progressive reader.
This commit is contained in:
Glenn Randers-Pehrson 2011-01-16 14:16:28 -06:00
parent c9ae31c23a
commit 1408c2afeb
3 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ANNOUNCE
View File

@ -60,6 +60,8 @@ Version 1.5.1beta05 [January 16, 2011]
changed exp() back to png_exp(). changed exp() back to png_exp().
Version 1.5.1beta06 [January 16, 2011] Version 1.5.1beta06 [January 16, 2011]
Prevent png_push_crc_skip() from hanging while reading an unknown chunk
or an over-large compressed zTXT chunk with the progressive reader.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net: Send comments/corrections/commendations to png-mng-implement at lists.sf.net:
(subscription required; visit (subscription required; visit

2
CHANGES
View File

@ -3176,6 +3176,8 @@ Version 1.5.1beta05 [January 16, 2011]
changed exp() back to png_exp(). changed exp() back to png_exp().
Version 1.5.1beta06 [January 16, 2011] Version 1.5.1beta06 [January 16, 2011]
Prevent png_push_crc_skip() from hanging while reading an unknown chunk
or an over-large compressed zTXT chunk with the progressive reader.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit

2
pngpread.c
View File

@ -582,7 +582,7 @@ png_push_crc_finish(png_structp png_ptr)
{ {
if (png_ptr->skip_length && png_ptr->save_buffer_size) if (png_ptr->skip_length && png_ptr->save_buffer_size)
{ {
png_size_t save_size = png_ptr->current_buffer_size; png_size_t save_size = png_ptr->save_buffer_size;
png_uint_32 skip_length = png_ptr->skip_length; png_uint_32 skip_length = png_ptr->skip_length;
/* We want the smaller of 'skip_length' and 'current_buffer_size', but /* We want the smaller of 'skip_length' and 'current_buffer_size', but