diff --git a/ANNOUNCE b/ANNOUNCE index 340f1f050..d568bc2c7 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,5 +1,5 @@ -Libpng 1.5.0beta50 - October 8, 2010 +Libpng 1.5.0beta50 - October 12, 2010 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -226,7 +226,7 @@ version 1.5.0beta24 [May 7, 2010] offset of the png_ptr->rowbuf pointer into png_ptr->big_row_buf. Added more blank lines for readability. -version 1.5.0beta25 [October 8, 2010] +version 1.5.0beta25 [October 12, 2010] In pngpread.c: png_push_have_row() add check for new_row > height Removed the now-redundant check for out-of-bounds new_row from example.c @@ -408,9 +408,10 @@ Version 1.5.0beta48 [October 4, 2010] Version 1.5.0beta49 [October 8, 2010] Undid Makefile.am revision of 1.5.0beta48. -Version 1.5.0beta50 [October 8, 2010] +Version 1.5.0beta50 [October 12, 2010] Revised Makefile.in to account for mkinstalldirs being removed. Added some "(unsigned long)" typecasts in printf statements in pngvalid.c. + Suppressed a compiler warning in png_handle_sPLT(). Send comments/corrections/commendations to png-mng-implement at lists.sf.net: (subscription required; visit diff --git a/CHANGES b/CHANGES index 4ebb96700..2fea8a127 100644 --- a/CHANGES +++ b/CHANGES @@ -3046,9 +3046,10 @@ Version 1.5.0beta48 [October 4, 2010] Version 1.5.0beta49 [October 8, 2010] Undid Makefile.am revision of 1.5.0beta48. -Version 1.5.0beta50 [October 8, 2010] +Version 1.5.0beta50 [October 12, 2010] Revised Makefile.in to account for mkinstalldirs being removed. Added some "(unsigned long)" typecasts in printf statements in pngvalid.c. + Suppressed a compiler warning in png_handle_sPLT(). Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/pngrutil.c b/pngrutil.c index 768fa6964..221f414e9 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -1,7 +1,7 @@ /* pngrutil.c - utilities to read a PNG file * - * Last changed in libpng 1.4.1 [October 8, 2010] + * Last changed in libpng 1.4.1 [October 12, 2010] * Copyright (c) 1998-2010 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -1211,6 +1211,8 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) int entry_size, i; png_uint_32 skip = 0; png_size_t slength; + png_uint_32 dl; + png_size_t max_dl; png_debug(1, "in png_handle_sPLT"); @@ -1303,13 +1305,16 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) return; } - if ((data_length / entry_size) > (PNG_SIZE_MAX / png_sizeof(png_sPLT_entry))) + dl = (png_int_32) ( data_length / entry_size); + max_dl = PNG_SIZE_MAX / png_sizeof(png_sPLT_entry); + + if (dl > max_dl) { png_warning(png_ptr, "sPLT chunk too long"); return; } - new_palette.nentries = (png_int_32) ( data_length / entry_size); + new_palette.nentries = (png_int_32) ( data_length / entry_size); new_palette.entries = (png_sPLT_entryp)png_malloc_warn( png_ptr, new_palette.nentries * png_sizeof(png_sPLT_entry));