cheng/libpng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[libpng16] Return NULL from png_malloc_array() with a warning instead of calling

Browse Source 
png_error() on failure.  Reject oversized iCCP profile immediately.
This commit is contained in:
Glenn Randers-Pehrson 2016-08-10 12:09:22 -05:00
parent cdc0e74ee6
commit 19fefd3a4b
4 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ANNOUNCE
View File

@ -1,4 +1,4 @@
Libpng 1.6.25beta01 - August 4, 2016
Libpng 1.6.25beta01 - August 10, 2016
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@ -25,7 +25,10 @@ Other information:
Changes since the last public release (1.6.24):
Version 1.6.25beta01 [August 4, 2016]
Version 1.6.25beta01 [August 10, 2016]
Return NULL from png_malloc_array() with a warning instead of calling
png_error() on failure.
Reject oversized iCCP profile immediately.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

5
CHANGES
View File

@ -5675,7 +5675,10 @@ Version 1.6.24rc03 [August 2, 2016]
Version 1.6.24[August 4, 2016]
No changes.
Version 1.6.24[August 4, 2016]
Version 1.6.25beta01 [August 10, 2016]
Return NULL from png_malloc_array() with a warning instead of calling
png_error() on failure.
Reject oversized iCCP profile immediately.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

7
pngmem.c
View File

@ -1,7 +1,7 @@
/* pngmem.c - stub functions for memory allocation
*
* Last changed in libpng 1.6.24 [August 4, 2016]
* Last changed in libpng 1.6.25 [(PENDING RELEASE)]
* Copyright (c) 1998-2002,2004,2006-2014,2016 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@ -123,7 +123,10 @@ png_malloc_array,(png_const_structrp png_ptr, int nelements,
size_t element_size),PNG_ALLOCATED)
{
if (nelements <= 0 || element_size == 0)
png_error(png_ptr, "internal error: array alloc");
{
png_warning(png_ptr, "internal error: array alloc");
return NULL;
}
return png_malloc_array_checked(png_ptr, nelements, element_size);
}

10
pngrutil.c
View File

@ -1,7 +1,7 @@
/* pngrutil.c - utilities to read a PNG file
*
* Last changed in libpng 1.6.24 [August 4, 2016]
* Last changed in libpng 1.6.25 [(PENDING RELEASE)]
* Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@ -307,7 +307,7 @@ png_read_buffer(png_structrp png_ptr, png_alloc_size_t new_size, int warn)
if (buffer == NULL)
{
buffer = png_voidcast(png_bytep, png_malloc_base(png_ptr, new_size));
buffer = png_voidcast(png_bytep, png_malloc_array(png_ptr, 1, new_size));
if (buffer != NULL)
{
@ -1462,7 +1462,7 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
const png_uint_32 tag_count = png_get_uint_32(
profile_header+128);
png_bytep profile = png_read_buffer(png_ptr,
profile_length, 2/*silent*/);
profile_length, 1/*warn*/);
if (profile != NULL)
{
@ -1528,8 +1528,8 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
PNG_FREE_ICCP, 0);
info_ptr->iccp_name = png_voidcast(char*,
png_malloc_base(png_ptr,
keyword_length+1));
png_malloc_array(png_ptr,
keyword_length+1, 1));
if (info_ptr->iccp_name != NULL)
{
memcpy(info_ptr->iccp_name, keyword,