cheng/libpng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[devel] Revised png_check_IHDR()

Browse Source 
to add a test for user passing a 16-bit height varible to png_get_IHDR()
which causes an overflow into the high bytes of the width variable.
This commit is contained in:
Glenn Randers-Pehrson 2009-09-30 14:58:28 -05:00
parent 6076da8079
commit dd66f3ed20
4 changed files with 23 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ANNOUNCE
View File

@ -568,6 +568,7 @@ version 1.4.0beta83 [September 25, 2009]
version 1.4.0beta84 [September 30, 2009] version 1.4.0beta84 [September 30, 2009]
Fixed some inconsistent indentation in pngconf.h Fixed some inconsistent indentation in pngconf.h
Revised png_check_IHDR() to add a test for width variable less than 32-bit.
version 1.4.0betaN [future] version 1.4.0betaN [future]
Build shared libraries with -lz and sometimes -lm. Build shared libraries with -lz and sometimes -lm.

1
CHANGES
View File

@ -2254,6 +2254,7 @@ version 1.4.0beta83 [September 25, 2009]
version 1.4.0beta84 [September 30, 2009] version 1.4.0beta84 [September 30, 2009]
Fixed some inconsistent indentation in pngconf.h Fixed some inconsistent indentation in pngconf.h
Revised png_check_IHDR() to add a test for width variable less than 32-bit.
version 1.4.0betaN [future] version 1.4.0betaN [future]
Build shared libraries with -lz and sometimes -lm. Build shared libraries with -lz and sometimes -lm.

39
png.c
View File

@ -1,7 +1,7 @@
/* png.c - location for general purpose libpng functions /* png.c - location for general purpose libpng functions
* *
* Last changed in libpng 1.4.0 [September 25, 2009] * Last changed in libpng 1.4.0 [September 30, 2009]
* Copyright (c) 1998-2009 Glenn Randers-Pehrson * Copyright (c) 1998-2009 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@ -546,13 +546,13 @@ png_get_copyright(png_structp png_ptr)
#else #else
#ifdef __STDC__ #ifdef __STDC__
return ((png_charp) PNG_STRING_NEWLINE \ return ((png_charp) PNG_STRING_NEWLINE \
"libpng version x 1.4.0beta84 - September 25, 2009" PNG_STRING_NEWLINE \ "libpng version x 1.4.0beta84 - September 30, 2009" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2009 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2009 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
"Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
PNG_STRING_NEWLINE); PNG_STRING_NEWLINE);
#else #else
return ((png_charp) "libpng version 1.4.0beta84 - September 25, 2009\ return ((png_charp) "libpng version 1.4.0beta84 - September 30, 2009\
Copyright (c) 1998-2009 Glenn Randers-Pehrson\ Copyright (c) 1998-2009 Glenn Randers-Pehrson\
Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1996-1997 Andreas Dilger\
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."); Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.");
@ -790,40 +790,41 @@ png_check_IHDR(png_structp png_ptr,
#ifdef PNG_SET_USER_LIMITS_SUPPORTED #ifdef PNG_SET_USER_LIMITS_SUPPORTED
if (width > png_ptr->user_width_max || width > PNG_USER_WIDTH_MAX) if (width > png_ptr->user_width_max || width > PNG_USER_WIDTH_MAX)
{
png_warning(png_ptr, "Image width exceeds user limit in IHDR");
error = 1;
}
if (height > png_ptr->user_height_max || height > PNG_USER_HEIGHT_MAX)
{
png_warning(png_ptr, "Image height exceeds user limit in IHDR");
error = 1;
}
#else #else
if (width > PNG_USER_WIDTH_MAX if (width > PNG_USER_WIDTH_MAX)
#endif
{ {
png_warning(png_ptr, "Image width exceeds user limit in IHDR"); png_warning(png_ptr, "Image width exceeds user limit in IHDR");
if ((width >> 16) == height)
{
/* This is likely to be caused by passing consecutive addresses
* of 16-bit width and height variables to png_get_IHDR(), which
* overflowed when we tried to fill them with 31-bit data.
*/
png_warning(png_ptr, "High bytes of width == low bytes of height");
}
error = 1; error = 1;
} }
#ifdef PNG_SET_USER_LIMITS_SUPPORTED
if (height > png_ptr->user_height_max || height > PNG_USER_HEIGHT_MAX)
#else
if (height > PNG_USER_HEIGHT_MAX) if (height > PNG_USER_HEIGHT_MAX)
#endif
{ {
png_warning(png_ptr, "Image height exceeds user limit in IHDR"); png_warning(png_ptr, "Image height exceeds user limit in IHDR");
error = 1; error = 1;
} }
#endif
if (height > PNG_UINT_31_MAX) if (width > PNG_UINT_31_MAX)
{ {
png_warning(png_ptr, "Invalid image height in IHDR"); png_warning(png_ptr, "Invalid image width in IHDR");
error = 1; error = 1;
} }
if ( height > PNG_UINT_31_MAX) if ( height > PNG_UINT_31_MAX)
{ {
png_warning(png_ptr, "Invalid image width in IHDR"); png_warning(png_ptr, "Invalid image height in IHDR");
error = 1; error = 1;
} }

2
pngget.c
View File

@ -1,7 +1,7 @@
/* pngget.c - retrieval of values from info struct /* pngget.c - retrieval of values from info struct
* *
* Last changed in libpng 1.4.0 [September 25, 2009] * Last changed in libpng 1.4.0 [September 30, 2009]
* Copyright (c) 1998-2009 Glenn Randers-Pehrson * Copyright (c) 1998-2009 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)