cheng/libpng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[libpng16] Fix potential problem with bKGD (Cosmin Truta)

Browse Source
This commit is contained in:
Glenn Randers-Pehrson 2018-01-07 17:43:09 -06:00
parent 28d0ee757d
commit 84e6e35675
1 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
pngrutil.c
View File

@ -1,8 +1,8 @@
/* pngrutil.c - utilities to read a PNG file /* pngrutil.c - utilities to read a PNG file
* *
* Last changed in libpng 1.6.33 [September 28, 2017] * Last changed in libpng 1.6.35 [(PENDING RELEASE)]
* Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
* *
@ -1997,6 +1997,15 @@ png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) /* GRAY */ else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) /* GRAY */
{ {
if (png_ptr->bit_depth <= 8)
{
if (buf[0] != 0 || buf[1] >= (unsigned int)(1 << png_ptr->bit_depth))
{
png_chunk_benign_error(png_ptr, "invalid gray level");
return;
}
}
background.index = 0; background.index = 0;
background.red = background.red =
background.green = background.green =
@ -2006,6 +2015,15 @@ png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
else else
{ {
if (png_ptr->bit_depth <= 8)
{
if (buf[0] != 0 || buf[2] != 0 || buf[4] != 0)
{
png_chunk_benign_error(png_ptr, "invalid color");
return;
}
}
background.index = 0; background.index = 0;
background.red = png_get_uint_16(buf); background.red = png_get_uint_16(buf);
background.green = png_get_uint_16(buf + 2); background.green = png_get_uint_16(buf + 2);