diff --git a/ANNOUNCE b/ANNOUNCE index 57834ec09..aff76daf3 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,5 +1,5 @@ -Libpng 1.6.1beta02 - February 16, 2013 +Libpng 1.6.1beta02 - February 19, 2013 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -44,7 +44,10 @@ Version 1.6.1beta01 [February 16, 2013] 1003.1 API to check /proc/self/auxv avoiding buffer allocation and other library calls (ported from libpng15). -Version 1.6.1beta02 [February 16, 2013] +Version 1.6.1beta02 [February 19, 2013] + Use parentheses more consistently in "#if defined(MACRO)" tests. + Folded long lines. + Reenabled code to allow zero length PLTE chunks for MNG. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index bdf977bd5..5970c1251 100644 --- a/CHANGES +++ b/CHANGES @@ -4401,7 +4401,10 @@ Version 1.6.1beta01 [February 16, 2013] 1003.1 API to check /proc/self/auxv avoiding buffer allocation and other library calls (ported from libpng15). -Version 1.6.1beta02 [February 16, 2013] +Version 1.6.1beta02 [February 19, 2013] + Use parentheses more consistently in "#if defined(MACRO)" tests. + Folded long lines. + Reenabled code to allow zero length PLTE chunks for MNG. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/pngset.c b/pngset.c index ac39a44b6..708199af0 100644 --- a/pngset.c +++ b/pngset.c @@ -1,7 +1,7 @@ /* pngset.c - storage of image information into info struct * - * Last changed in libpng 1.6.0 [February 14, 2013] + * Last changed in libpng 1.6.1 [(PENDING RELEASE)] * Copyright (c) 1998-2013 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -514,7 +514,7 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_debug1(1, "in %s storage function", "PLTE"); - if (png_ptr == NULL || info_ptr == NULL || palette == NULL) + if (png_ptr == NULL || info_ptr == NULL) return; if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH) @@ -529,6 +529,17 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr, } } + if ((num_palette > 0 && palette == NULL) || + (num_palette == 0 +# ifdef PNG_MNG_FEATURES_SUPPORTED + && (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0 +# endif + )) + { + png_chunk_report(png_ptr, "Invalid palette", PNG_CHUNK_ERROR); + return; + } + /* It may not actually be necessary to set png_ptr->palette here; * we do it for backward compatibility with the way the png_handle_tRNS * function used to do the allocation. @@ -545,7 +556,8 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr, PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)))); - memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color))); + if (num_palette > 0) + memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color))); info_ptr->palette = png_ptr->palette; info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;