diff options
| -rw-r--r-- | gdk-pixbuf/ChangeLog | 4 | ||||
| -rw-r--r-- | gdk-pixbuf/io-png.c | 11 |
2 files changed, 15 insertions, 0 deletions
diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog index b120b2f983..0b0a71e0c4 100644 --- a/gdk-pixbuf/ChangeLog +++ b/gdk-pixbuf/ChangeLog @@ -1,3 +1,7 @@ +Thu Aug 30 08:27:37 2001 Matthias Clasen <matthiasc@poet.de> + + * io-png.c (png_row_callback): Check that row_num is valid. + Tue Aug 28 21:05:26 2001 Matthias Clasen <matthiasc@poet.de> * io-bmp.c (OneLine): Emit area_updated signal with proper diff --git a/gdk-pixbuf/io-png.c b/gdk-pixbuf/io-png.c index 0e582eb906..f434e699d4 100644 --- a/gdk-pixbuf/io-png.c +++ b/gdk-pixbuf/io-png.c @@ -563,6 +563,17 @@ png_row_callback (png_structp png_read_ptr, if (lc->fatal_error_occurred) return; + if (row_num < 0 || row_num >= lc->pixbuf->height) { + lc->fatal_error_occurred = TRUE; + if (lc->error && *lc->error == NULL) { + g_set_error (lc->error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("Fatal error reading PNG image file")); + } + return; + } + if (lc->first_row_seen_in_chunk < 0) { lc->first_row_seen_in_chunk = row_num; lc->first_pass_seen_in_chunk = pass_num; |