cheng/libpng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[libpng15] Validate time settings passed to pngset()

Browse Source 
and png_convert_to_rfc1123(). (Frank Busse).
This commit is contained in:
Glenn Randers-Pehrson 2011-11-19 15:08:04 -06:00
parent bd2fa5def6
commit 29fca795b9
4 changed files with 31 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ANNOUNCE
View File

@ -101,7 +101,8 @@ Version 1.5.7beta04 [November 17, 2011]
Version 1.5.7beta05 [November 19, 2011] Version 1.5.7beta05 [November 19, 2011]
Removed "zTXt" from warning in generic chunk decompression function. Removed "zTXt" from warning in generic chunk decompression function.
Validate time settings passed to pngset() and png_convert_to_rfc1123()
(Frank Busse).
Send comments/corrections/commendations to png-mng-implement at lists.sf.net: Send comments/corrections/commendations to png-mng-implement at lists.sf.net:
(subscription required; visit (subscription required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-implement https://lists.sourceforge.net/lists/listinfo/png-mng-implement

2
CHANGES
View File

@ -3746,6 +3746,8 @@ Version 1.5.7beta04 [November 17, 2011]
Version 1.5.7beta05 [November 19, 2011] Version 1.5.7beta05 [November 19, 2011]
Removed "zTXt" from warning in generic chunk decompression function. Removed "zTXt" from warning in generic chunk decompression function.
Validate time settings passed to pngset() and png_convert_to_rfc1123()
(Frank Busse).
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit

26
png.c
View File

@ -599,9 +599,19 @@ png_convert_to_rfc1123(png_structp png_ptr, png_const_timep ptime)
if (png_ptr == NULL) if (png_ptr == NULL)
return (NULL); return (NULL);
if (ptime->year > 9999 || /* RFC1123 limitation */
ptime->month == 0 || ptime->month > 12 ||
ptime->day == 0 || ptime->day > 31 ||
ptime->hour > 23 || ptime->minute > 59 ||
ptime->second > 60)
{
png_warning(png_ptr, "Ignoring invalid time value");
return (NULL);
}
{ {
size_t pos = 0; size_t pos = 0;
char number_buf[5]; /* enough for a four digit year */ char number_buf[5]; /* enough for a five-digit year */
# define APPEND_STRING(string)\ # define APPEND_STRING(string)\
pos = png_safecat(png_ptr->time_buffer, sizeof png_ptr->time_buffer,\ pos = png_safecat(png_ptr->time_buffer, sizeof png_ptr->time_buffer,\
@ -612,17 +622,17 @@ png_convert_to_rfc1123(png_structp png_ptr, png_const_timep ptime)
if (pos < (sizeof png_ptr->time_buffer)-1)\ if (pos < (sizeof png_ptr->time_buffer)-1)\
png_ptr->time_buffer[pos++] = (ch) png_ptr->time_buffer[pos++] = (ch)
APPEND_NUMBER(PNG_NUMBER_FORMAT_u, (unsigned)ptime->day % 32); APPEND_NUMBER(PNG_NUMBER_FORMAT_u, (unsigned)ptime->day);
APPEND(' '); APPEND(' ');
APPEND_STRING(short_months[(ptime->month - 1) % 12]); APPEND_STRING(short_months[(ptime->month - 1)]);
APPEND(' '); APPEND(' ');
APPEND_NUMBER(PNG_NUMBER_FORMAT_u, ptime->year); APPEND_NUMBER(PNG_NUMBER_FORMAT_u, ptime->year);
APPEND(' '); APPEND(' ');
APPEND_NUMBER(PNG_NUMBER_FORMAT_02u, (unsigned)ptime->hour % 24); APPEND_NUMBER(PNG_NUMBER_FORMAT_02u, (unsigned)ptime->hour);
APPEND(':'); APPEND(':');
APPEND_NUMBER(PNG_NUMBER_FORMAT_02u, (unsigned)ptime->minute % 60); APPEND_NUMBER(PNG_NUMBER_FORMAT_02u, (unsigned)ptime->minute);
APPEND(':'); APPEND(':');
APPEND_NUMBER(PNG_NUMBER_FORMAT_02u, (unsigned)ptime->second % 61); APPEND_NUMBER(PNG_NUMBER_FORMAT_02u, (unsigned)ptime->second);
APPEND_STRING(" +0000"); /* This reliably terminates the buffer */ APPEND_STRING(" +0000"); /* This reliably terminates the buffer */
# undef APPEND # undef APPEND
@ -645,13 +655,13 @@ png_get_copyright(png_const_structp png_ptr)
#else #else
# ifdef __STDC__ # ifdef __STDC__
return PNG_STRING_NEWLINE \ return PNG_STRING_NEWLINE \
"libpng version 1.5.7beta05 - November 18, 2011" PNG_STRING_NEWLINE \ "libpng version 1.5.7beta05 - November 19, 2011" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2011 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2011 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
"Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
PNG_STRING_NEWLINE; PNG_STRING_NEWLINE;
# else # else
return "libpng version 1.5.7beta05 - November 18, 2011\ return "libpng version 1.5.7beta05 - November 19, 2011\
Copyright (c) 1998-2011 Glenn Randers-Pehrson\ Copyright (c) 1998-2011 Glenn Randers-Pehrson\
Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1996-1997 Andreas Dilger\
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."; Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";

9
pngset.c
View File

@ -864,6 +864,15 @@ png_set_tIME(png_structp png_ptr, png_infop info_ptr, png_const_timep mod_time)
(png_ptr->mode & PNG_WROTE_tIME)) (png_ptr->mode & PNG_WROTE_tIME))
return; return;
if (mod_time->month == 0 || mod_time->month > 12 ||
mod_time->day == 0 || mod_time->day > 31 ||
mod_time->hour > 23 || mod_time->minute > 59 ||
mod_time->second > 60)
{
png_warning(png_ptr, "Ignoring invalid time value");
return;
}
png_memcpy(&(info_ptr->mod_time), mod_time, png_sizeof(png_time)); png_memcpy(&(info_ptr->mod_time), mod_time, png_sizeof(png_time));
info_ptr->valid |= PNG_INFO_tIME; info_ptr->valid |= PNG_INFO_tIME;
} }