From ab9736a6474a6bdd8c387a89c8c74bab5c6d5974 Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Fri, 25 Apr 2014 06:14:50 -0500
Subject: [PATCH] [libpng16] Allow writing ICC V2 profiles that lack padding
 (Kai-Uwe Behrmann).

---
 ANNOUNCE   | 6 +++---
 CHANGES    | 4 ++--
 pngwutil.c | 4 +++-
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/ANNOUNCE b/ANNOUNCE
index cb17abe8a..92db517b6 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
 
-Libpng 1.6.11beta05 - April 24, 2014
+Libpng 1.6.11beta05 - April 25, 2014
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -55,8 +55,8 @@ Version 1.6.11beta04 [April 19, 2014]
     when png_combine_row is not used or not built,
   Allow PNG_sRGB_PROFILE_CHECKING = (-1) to mean no sRGB profile checking.
 
-Version 1.6.11beta05 [April 24, 2014]
-  Do not reject ICC V2 profiles that lack padding.
+Version 1.6.11beta05 [April 25, 2014]
+  Do not reject ICC V2 profiles that lack padding (Kai-Uwe Behrmann).
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/CHANGES b/CHANGES
index 7027b437c..1b85bb2d3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4906,8 +4906,8 @@ Version 1.6.11beta04 [April 19, 2014]
     when png_combine_row is not used or not built,
   Allow PNG_sRGB_PROFILE_CHECKING = (-1) to mean no sRGB profile checking.
 
-Version 1.6.11beta05 [April 24, 2014]
-  Do not reject ICC V2 profiles that lack padding.
+Version 1.6.11beta05 [April 25, 2014]
+  Do not reject ICC V2 profiles that lack padding (Kai-Uwe Behrmann).
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/pngwutil.c b/pngwutil.c
index 8bdd922de..f4abeba9a 100644
--- a/pngwutil.c
+++ b/pngwutil.c
@@ -1193,6 +1193,7 @@ png_write_iCCP(png_structrp png_ptr, png_const_charp name,
    png_uint_32 profile_len;
    png_byte new_name[81]; /* 1 byte for the compression byte */
    compression_state comp;
+   png_uint_32 temp;
 
    png_debug(1, "in png_write_iCCP");
 
@@ -1207,7 +1208,8 @@ png_write_iCCP(png_structrp png_ptr, png_const_charp name,
    if (profile_len < 132)
       png_error(png_ptr, "ICC profile too short");
 
-   if (profile_len & 0x03)
+   temp = (png_uint_32) (*(profile+8));
+   if (temp > 3 && (profile_len & 0x03))
       png_error(png_ptr, "ICC profile length invalid (not a multiple of 4)");
 
    {