From dd66f3ed20fed95f787e6a7b81a7355eb3278388 Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Wed, 30 Sep 2009 14:58:28 -0500
Subject: [PATCH] [devel] Revised png_check_IHDR()

to add a test for user passing a 16-bit height varible to png_get_IHDR()
which causes an overflow into the high bytes of the width variable.
---
 ANNOUNCE |  1 +
 CHANGES  |  1 +
 png.c    | 39 ++++++++++++++++++++-------------------
 pngget.c |  2 +-
 4 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/ANNOUNCE b/ANNOUNCE
index a842459ef..3fa4f59a2 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -568,6 +568,7 @@ version 1.4.0beta83 [September 25, 2009]
 
 version 1.4.0beta84 [September 30, 2009]
   Fixed some inconsistent indentation in pngconf.h
+  Revised png_check_IHDR() to add a test for width variable less than 32-bit.
 
 version 1.4.0betaN [future]
   Build shared libraries with -lz and sometimes -lm.
diff --git a/CHANGES b/CHANGES
index f197318b2..fb776e1a4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2254,6 +2254,7 @@ version 1.4.0beta83 [September 25, 2009]
 
 version 1.4.0beta84 [September 30, 2009]
   Fixed some inconsistent indentation in pngconf.h
+  Revised png_check_IHDR() to add a test for width variable less than 32-bit.
 
 version 1.4.0betaN [future]
   Build shared libraries with -lz and sometimes -lm.
diff --git a/png.c b/png.c
index 4a192b00b..ed4e837c5 100644
--- a/png.c
+++ b/png.c
@@ -1,7 +1,7 @@
 
 /* png.c - location for general purpose libpng functions
  *
- * Last changed in libpng 1.4.0 [September 25, 2009]
+ * Last changed in libpng 1.4.0 [September 30, 2009]
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -546,13 +546,13 @@ png_get_copyright(png_structp png_ptr)
 #else
 #ifdef __STDC__
    return ((png_charp) PNG_STRING_NEWLINE \
-     "libpng version x 1.4.0beta84 - September 25, 2009" PNG_STRING_NEWLINE \
+     "libpng version x 1.4.0beta84 - September 30, 2009" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2009 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE);
 #else
-      return ((png_charp) "libpng version 1.4.0beta84 - September 25, 2009\
+      return ((png_charp) "libpng version 1.4.0beta84 - September 30, 2009\
       Copyright (c) 1998-2009 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.");
@@ -790,40 +790,41 @@ png_check_IHDR(png_structp png_ptr,
 
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
    if (width > png_ptr->user_width_max || width > PNG_USER_WIDTH_MAX)
-   {
-      png_warning(png_ptr, "Image width exceeds user limit in IHDR");
-      error = 1;
-   }
-
-   if (height > png_ptr->user_height_max || height > PNG_USER_HEIGHT_MAX)
-   {
-      png_warning(png_ptr, "Image height exceeds user limit in IHDR");
-      error = 1;
-   }
-
 #else
-   if (width > PNG_USER_WIDTH_MAX
+   if (width > PNG_USER_WIDTH_MAX)
+#endif
    {
       png_warning(png_ptr, "Image width exceeds user limit in IHDR");
+      if ((width >> 16) == height)
+      {
+         /* This is likely to be caused by passing consecutive addresses
+          * of 16-bit width and height variables to png_get_IHDR(), which
+          * overflowed when we tried to fill them with 31-bit data.
+          */ 
+         png_warning(png_ptr, "High bytes of width == low bytes of height");
+      }
       error = 1;
    }
 
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+   if (height > png_ptr->user_height_max || height > PNG_USER_HEIGHT_MAX)
+#else
    if (height > PNG_USER_HEIGHT_MAX)
+#endif
    {
       png_warning(png_ptr, "Image height exceeds user limit in IHDR");
       error = 1;
    }
-#endif
 
-   if (height > PNG_UINT_31_MAX)
+   if (width > PNG_UINT_31_MAX)
    {
-      png_warning(png_ptr, "Invalid image height in IHDR");
+      png_warning(png_ptr, "Invalid image width in IHDR");
       error = 1;
    }
 
    if ( height > PNG_UINT_31_MAX)
    {
-      png_warning(png_ptr, "Invalid image width in IHDR");
+      png_warning(png_ptr, "Invalid image height in IHDR");
       error = 1;
    }
 
diff --git a/pngget.c b/pngget.c
index ba9fe6db5..cd9d62e3b 100644
--- a/pngget.c
+++ b/pngget.c
@@ -1,7 +1,7 @@
 
 /* pngget.c - retrieval of values from info struct
  *
- * Last changed in libpng 1.4.0 [September 25, 2009]
+ * Last changed in libpng 1.4.0 [September 30, 2009]
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)