cheng/libpng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[libpng16] Changed size_t to png_uint_32 in new buffer checks (John Bowler)

Browse Source
This commit is contained in:
Glenn Randers-Pehrson 2015-11-15 15:27:22 -06:00
parent 070a0eb58f
commit 9965f63a44
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pngrutil.c
View File

@ -1670,7 +1670,7 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
++entry_start; ++entry_start;
/* A sample depth should follow the separator, and we should be on it */ /* A sample depth should follow the separator, and we should be on it */
if (length < 2 || (size_t)(entry_start - buffer) > length - 2) if (length < 2 || (png_uint_32)(entry_start - buffer) > length - 2)
{ {
png_warning(png_ptr, "malformed sPLT chunk"); png_warning(png_ptr, "malformed sPLT chunk");
return; return;
@ -2174,7 +2174,7 @@ png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
/* We need to have at least 12 bytes after the purpose string /* We need to have at least 12 bytes after the purpose string
* in order to get the parameter information. * in order to get the parameter information.
*/ */
if (length < 12 || (size_t)(endptr - buf) <= 12) if (length < 12 || (png_uint_32)(endptr - buf) <= 12)
{ {
png_chunk_benign_error(png_ptr, "invalid"); png_chunk_benign_error(png_ptr, "invalid");
return; return;