diff --git a/ANNOUNCE b/ANNOUNCE index e41c5a074..41726182f 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -107,7 +107,8 @@ Version 1.6.19rc01 [October 23, 2015] No changes. Version 1.6.19rc02 [October 30, 2015] - Prevent reading or writing over-length PLTE chunk (Cosmin Truta). + Prevent setting or writing over-length PLTE chunk (Cosmin Truta). + Silently truncate over-length PLTE chunk while reading. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index 7c9977e15..e15f58b92 100644 --- a/CHANGES +++ b/CHANGES @@ -5392,7 +5392,8 @@ Version 1.6.19rc01 [October 23, 2015] No changes. Version 1.6.19rc02 [October 30, 2015] - Prevent reading or writing over-length PLTE chunk (Cosmin Truta). + Prevent setting or writing over-length PLTE chunk (Cosmin Truta). + Silently truncate over-length PLTE chunk while reading. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/pngrutil.c b/pngrutil.c index babf5c02d..6d35445ed 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -872,7 +872,7 @@ void /* PRIVATE */ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) { png_color palette[PNG_MAX_PALETTE_LENGTH]; - int num, i; + int max_palette_length, num, i; #ifdef PNG_POINTER_INDEXING_SUPPORTED png_colorp pal_ptr; #endif @@ -930,9 +930,19 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) return; } + max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? + (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; + /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */ num = (int)length / 3; + /* If the palette has 256 or fewer entries but is too large for the bit depth, + * we don't issue an error, to preserve the behavior of previous libpng versions. + * We silently truncate the unused extra palette entries here. + */ + if (num > max_palette_length) + num = max_palette_length; + #ifdef PNG_POINTER_INDEXING_SUPPORTED for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++) { @@ -1002,9 +1012,6 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) * confusing. * * Fix this by not sharing the palette in this way. - * - * Starting with libpng-1.6.19, png_set_PLTE() also issues a png_error() when - * it attempts to set a palette length that is too large for the bit depth. */ png_set_PLTE(png_ptr, info_ptr, palette, num); diff --git a/pngset.c b/pngset.c index 0629d94e9..8dcf18afc 100644 --- a/pngset.c +++ b/pngset.c @@ -523,7 +523,7 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr, max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; - if (num_palette < 0 || num_palette > max_palette_length) + if (num_palette < 0 || num_palette > (int) max_palette_length) { if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) png_error(png_ptr, "Invalid palette length");