diff --git a/pngwutil.c b/pngwutil.c index 8f669374c..755ccef39 100644 --- a/pngwutil.c +++ b/pngwutil.c @@ -1745,9 +1745,13 @@ png_write_iTXt(png_structrp png_ptr, int compression, png_const_charp key, { if (comp.input_len > PNG_UINT_31_MAX-prefix_len) png_error(png_ptr, "iTXt: uncompressed text too long"); - png_write_chunk_header(png_ptr, png_iTXt, strlen(text) + prefix_len); + + /* So the string will fit in a chunk: */ + comp.output_len = (png_uint_32)/*SAFE*/comp.input_len; } + png_write_chunk_header(png_ptr, png_iTXt, comp.output_len + prefix_len); + png_write_chunk_data(png_ptr, new_key, key_len); png_write_chunk_data(png_ptr, (png_const_bytep)lang, lang_len);