cheng/libpng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[master] Check for integer overflow in png_set_rgb_to_gray().

Browse Source
This commit is contained in:
Glenn Randers-Pehrson 2011-06-05 23:26:14 -05:00
parent 070434c045
commit cc1d4d0dbc
3 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ANNOUNCE
View File

@ -1,5 +1,5 @@
Libpng 1.4.8beta02 - June 5, 2011
Libpng 1.4.8beta02 - June 6, 2011
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@ -41,6 +41,9 @@ version 1.4.8beta02 [June 5, 2011]
Ported bugfix in pngrtran.c from 1.5.3: Ensure coefficients are OK for
png_rgb_to_gray_fixed().
version 1.4.8beta03 [June 6, 2011]
Check for integer overflow in png_set_rgb_to_gray().
Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-implement).

3
CHANGES
View File

@ -2809,6 +2809,9 @@ version 1.4.8beta02 [June 5, 2011]
Ported bugfix in pngrtran.c from 1.5.3: Ensure coefficients are OK for
png_rgb_to_gray_fixed().
version 1.4.8beta03 [June 6, 2011]
Check for integer overflow in png_set_rgb_to_gray().
Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-implement).

8
pngrtran.c
View File

@ -660,10 +660,14 @@ void PNGAPI
png_set_rgb_to_gray(png_structp png_ptr, int error_action, double red,
double green)
{
int red_fixed = (int)((float)red*100000.0 + 0.5);
int green_fixed = (int)((float)green*100000.0 + 0.5);
int red_fixed, green_fixed;
if (png_ptr == NULL)
return;
if (red > 21474.83647 || red < -21474.83648 ||
green > 21474.83647 || green < -21474.83648)
png_error(png_ptr, "ignoring out of range rgb_to_gray coefficients");
red_fixed = (int)((float)red*100000.0 + 0.5);
green_fixed = (int)((float)green*100000.0 + 0.5);
png_set_rgb_to_gray_fixed(png_ptr, error_action, red_fixed, green_fixed);
}
#endif