From 4748a3346e10f8ab7bacdcee95ba6a941711a01c Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Fri, 12 Feb 2010 13:55:01 -0600
Subject: [PATCH] [devel] Reset zlib datastream after detecting oversized
 compressed chunk

---
 pngrutil.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/pngrutil.c b/pngrutil.c
index a24983637..86286e4d4 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -240,15 +240,19 @@ png_measure_decompressed_chunk(png_structp png_ptr, int comp_type,
             }
             else               /* Enlarge the decompression buffer */
             {
-              text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
+               text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
 #ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
-              if (png_ptr->user_chunk_malloc_max &&
-                  (text_size >= png_ptr->user_chunk_malloc_max - 1))
+               if (png_ptr->user_chunk_malloc_max &&
+                   (text_size >= png_ptr->user_chunk_malloc_max - 1))
 #else
-              if ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
-                  text_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)
+               if ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
+                   text_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)
 #endif
-                 return 0;
+               {
+                  inflateReset(&png_ptr->zstream);
+                  png_ptr->zstream.avail_in = 0;
+                  return 0;
+               }
             }
          }
          if (ret == Z_STREAM_END)