[libpng16] Restored previous handling of negative input to png_set_sig_bytes().

This commit is contained in:
Glenn Randers-Pehrson 2015-08-17 21:56:03 -05:00
parent 5a26171dd7
commit 6530e3898d
3 changed files with 3 additions and 8 deletions

View File

@ -5140,10 +5140,6 @@ It can be set for testing debug or beta builds to ensure that they will compile
when the build type is switched to RC or STABLE. In essence this overrides the when the build type is switched to RC or STABLE. In essence this overrides the
PNG_LIBPNG_BUILD_BASE_TYPE definition which is not directly user controllable. PNG_LIBPNG_BUILD_BASE_TYPE definition which is not directly user controllable.
Starting with libpng-1.6.19, it is an error to call png_set_sig_bytes()
with a negative number. Previously, a negative value was silently converted
to zero.
XIII. Detecting libpng XIII. Detecting libpng
The png_get_io_ptr() function has been present since libpng-0.88, has never The png_get_io_ptr() function has been present since libpng-0.88, has never

View File

@ -5648,10 +5648,6 @@ It can be set for testing debug or beta builds to ensure that they will compile
when the build type is switched to RC or STABLE. In essence this overrides the when the build type is switched to RC or STABLE. In essence this overrides the
PNG_LIBPNG_BUILD_BASE_TYPE definition which is not directly user controllable. PNG_LIBPNG_BUILD_BASE_TYPE definition which is not directly user controllable.
Starting with libpng-1.6.19, it is an error to call png_set_sig_bytes()
with a negative number. Previously, a negative value was silently converted
to zero.
.SH XIII. Detecting libpng .SH XIII. Detecting libpng
The png_get_io_ptr() function has been present since libpng-0.88, has never The png_get_io_ptr() function has been present since libpng-0.88, has never

3
png.c
View File

@ -33,6 +33,9 @@ png_set_sig_bytes(png_structrp png_ptr, int num_bytes)
if (png_ptr == NULL) if (png_ptr == NULL)
return; return;
if (num_bytes < 0)
nb = 0;
if (nb > 8) if (nb > 8)
png_error(png_ptr, "Too many bytes for PNG signature"); png_error(png_ptr, "Too many bytes for PNG signature");