From 5a1d1b5369135b13e97c5c255b1fea4467a9ea34 Mon Sep 17 00:00:00 2001 From: Glenn Randers-Pehrson Date: Thu, 24 Apr 2014 15:54:28 -0500 Subject: [PATCH] [libpng16] Do not reject ICC V2 profiles that lack padding (Kai-Uwe Behrmann). --- ANNOUNCE | 5 +++-- CHANGES | 3 ++- png.c | 17 +++++++++-------- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/ANNOUNCE b/ANNOUNCE index 46e41a987..cb17abe8a 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,5 +1,5 @@ -Libpng 1.6.11beta05 - April 21, 2014 +Libpng 1.6.11beta05 - April 24, 2014 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -55,7 +55,8 @@ Version 1.6.11beta04 [April 19, 2014] when png_combine_row is not used or not built, Allow PNG_sRGB_PROFILE_CHECKING = (-1) to mean no sRGB profile checking. -Version 1.6.11beta05 [April 21, 2014] +Version 1.6.11beta05 [April 24, 2014] + Do not reject ICC V2 profiles that lack padding. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index a890a9740..7027b437c 100644 --- a/CHANGES +++ b/CHANGES @@ -4906,7 +4906,8 @@ Version 1.6.11beta04 [April 19, 2014] when png_combine_row is not used or not built, Allow PNG_sRGB_PROFILE_CHECKING = (-1) to mean no sRGB profile checking. -Version 1.6.11beta05 [April 21, 2014] +Version 1.6.11beta05 [April 24, 2014] + Do not reject ICC V2 profiles that lack padding. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/png.c b/png.c index a3b59e3e4..9a4073e70 100644 --- a/png.c +++ b/png.c @@ -773,13 +773,13 @@ png_get_copyright(png_const_structrp png_ptr) #else # ifdef __STDC__ return PNG_STRING_NEWLINE \ - "libpng version 1.6.11beta05 - April 21, 2014" PNG_STRING_NEWLINE \ + "libpng version 1.6.11beta05 - April 24, 2014" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ PNG_STRING_NEWLINE; # else - return "libpng version 1.6.11beta05 - April 21, 2014\ + return "libpng version 1.6.11beta05 - April 24, 2014\ Copyright (c) 1998-2014 Glenn Randers-Pehrson\ Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."; @@ -1906,10 +1906,6 @@ png_icc_check_length(png_const_structrp png_ptr, png_colorspacerp colorspace, return png_icc_profile_error(png_ptr, colorspace, name, profile_length, "too short"); - if (profile_length & 3) - return png_icc_profile_error(png_ptr, colorspace, name, profile_length, - "invalid length"); - return 1; } @@ -1930,6 +1926,11 @@ png_icc_check_header(png_const_structrp png_ptr, png_colorspacerp colorspace, return png_icc_profile_error(png_ptr, colorspace, name, temp, "length does not match profile"); + temp = (png_uint_32) (*(profile+8)); + if (temp > 3 && (profile_length & 3)) + return png_icc_profile_error(png_ptr, colorspace, name, profile_length, + "invalid length"); + temp = png_get_uint_32(profile+128); /* tag count: 12 bytes/tag */ if (temp > 357913930 || /* (2^32-4-132)/12: maximum possible tag count */ profile_length < 132+12*temp) /* truncated tag table */ @@ -2044,7 +2045,7 @@ png_icc_check_header(png_const_structrp png_ptr, png_colorspacerp colorspace, "invalid embedded Abstract ICC profile"); case 0x6C696E6B: /* 'link' */ - /* DeviceLink profiles cannnot be interpreted in a non-device specific + /* DeviceLink profiles cannot be interpreted in a non-device specific * fashion, if an app uses the AToB0Tag in the profile the results are * undefined unless the result is sent to the intended device, * therefore a DeviceLink profile should not be found embedded in a @@ -2055,7 +2056,7 @@ png_icc_check_header(png_const_structrp png_ptr, png_colorspacerp colorspace, case 0x6E6D636C: /* 'nmcl' */ /* A NamedColor profile is also device specific, however it doesn't - * contain an AToB0 tag that is open to misintrepretation. Almost + * contain an AToB0 tag that is open to misinterpretation. Almost * certainly it will fail the tests below. */ (void)png_icc_profile_error(png_ptr, NULL, name, temp,