From 4ea97d8bc7849cde9658d21a945705656cf36112 Mon Sep 17 00:00:00 2001 From: Glenn Randers-Pehrson Date: Thu, 9 Jan 2014 11:48:23 -0600 Subject: [PATCH] [libpng16]Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX in the test for potential overflow in PNG_ROWBYTES. --- ANNOUNCE | 6 ++++-- CHANGES | 4 +++- png.c | 10 ++++++---- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/ANNOUNCE b/ANNOUNCE index 4bb9c78f1..d980aed62 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,5 +1,5 @@ -Libpng 1.6.9beta03 - January 1, 2014 +Libpng 1.6.9beta03 - January 10, 2014 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -60,7 +60,9 @@ Version 1.6.9beta02 [January 1, 2014] libpng17/png.h and libpng17.a). Three new configure options and some rearrangement of Makefile.am allow creation of these links to be disabled. -Version 1.6.9beta03 [January 1, 2014] +Version 1.6.9beta03 [January 10, 2014] + Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX + in the test for potential overflow in PNG_ROWBYTES. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index e6e9cf8f2..b4b3f9fbd 100644 --- a/CHANGES +++ b/CHANGES @@ -4785,7 +4785,9 @@ Version 1.6.9beta02 [January 1, 2014] libpng17/png.h and libpng17.a). Three new configure options and some rearrangement of Makefile.am allow creation of these links to be disabled. -Version 1.6.9beta03 [January 1, 2014] +Version 1.6.9beta03 [January 10, 2014] + Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX + in the test for potential overflow in PNG_ROWBYTES. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/png.c b/png.c index 553c9d687..4e282333e 100644 --- a/png.c +++ b/png.c @@ -773,13 +773,13 @@ png_get_copyright(png_const_structrp png_ptr) #else # ifdef __STDC__ return PNG_STRING_NEWLINE \ - "libpng version 1.6.9beta03 - January 8, 2014" PNG_STRING_NEWLINE \ + "libpng version 1.6.9beta03 - January 10, 2014" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ PNG_STRING_NEWLINE; # else - return "libpng version 1.6.9beta03 - January 8, 2014\ + return "libpng version 1.6.9beta03 - January 10, 2014\ Copyright (c) 1998-2014 Glenn Randers-Pehrson\ Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."; @@ -2473,12 +2473,14 @@ png_check_IHDR(png_const_structrp png_ptr, error = 1; } - if (error == 0 && width > (PNG_UINT_32_MAX + /* Check for potential overflow in PNG_ROWBYTES calculation */ + if (error == 0 && width > (PNG_SIZE_MAX >> 3) /* 8-byte RGBA pixels */ - 48 /* bigrowbuf hack */ - 1 /* filter byte */ - 7*8 /* rounding of width to multiple of 8 pixels */ - - 8) /* extra max_pixel_depth pad */ + - 8 /* extra max_pixel_depth pad */ + - error) /* to prevent always-false compiler warning */ png_warning(png_ptr, "Width may be too large for libpng to process pixels");