From 83f27f018c59058bf04c890a004b0a64c9d904da Mon Sep 17 00:00:00 2001 From: Glenn Randers-Pehrson Date: Thu, 12 Oct 2017 20:10:40 -0500 Subject: [PATCH] [libpng16] Relocate png_read_update_info() wrt png_start_image() in fuzzer. --- contrib/oss-fuzz/libpng_read_fuzzer.cc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/contrib/oss-fuzz/libpng_read_fuzzer.cc b/contrib/oss-fuzz/libpng_read_fuzzer.cc index 15f149ca4..d8d8d1b46 100644 --- a/contrib/oss-fuzz/libpng_read_fuzzer.cc +++ b/contrib/oss-fuzz/libpng_read_fuzzer.cc @@ -5,7 +5,7 @@ // Use of this source code is governed by a BSD-style license that may // be found in the LICENSE file https://cs.chromium.org/chromium/src/LICENSE -// Last changed in libpng 1.6.35 [October 12, 2017] +// Last changed in libpng 1.6.35 [October 13, 2017] // The modifications in 2017 by Glenn Randers-Pehrson include // 1. addition of a PNG_CLEANUP macro, @@ -168,10 +168,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { png_set_add_alpha(png_handler.png_ptr, 0xffff, PNG_FILLER_AFTER); int passes = png_set_interlace_handling(png_handler.png_ptr); - png_start_read_image(png_handler.png_ptr); png_read_update_info(png_handler.png_ptr, png_handler.info_ptr); + png_start_read_image(png_handler.png_ptr); + png_handler.row_ptr = png_malloc( png_handler.png_ptr, png_get_rowbytes(png_handler.png_ptr, png_handler.info_ptr));