[libpng14] Fixed bug recently introduced in png_set_PLTE() that uses png_ptr

not info_ptr.

3 files changed, 8 insertions, 4 deletions

diff --git a/ANNOUNCE b/ANNOUNCE
index 36386a63c..a03e24b9c 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
 
-Libpng 1.4.18beta02 - November 22, 2015
+Libpng 1.4.18beta02 - November 23, 2015
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -32,6 +32,8 @@ version 1.4.18beta01 [November 20, 2015]
     png_handle_sPLT(), and png_handle_pCAL() (Bug report by John Regehr).
 
 version 1.4.18beta02 [%RDATE%]
+  Fixed bug recently introduced in png_set_PLTE() that uses png_ptr
+    not info_ptr.
 
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit
diff --git a/CHANGES b/CHANGES
index 8cfe9363f..461b882f6 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3011,7 +3011,9 @@ version 1.4.18beta01 [November 20, 2015]
   Avoid potential pointer overflow in png_handle_iTXt(), png_handle_zTXt(),
     png_handle_sPLT(), and png_handle_pCAL() (Bug report by John Regehr).
 
-version 1.4.18beta02 [November 22, 2015]
+version 1.4.18beta02 [November 23, 2015]
+  Fixed bug recently introduced in png_set_PLTE() that uses png_ptr
+    not info_ptr.
 
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit
diff --git a/pngset.c b/pngset.c
index 90dcb2631..f6e2987e4 100644
--- a/pngset.c
+++ b/pngset.c
@@ -434,8 +434,8 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
-      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
+   max_palette_length = (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
+      (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
 
    if (num_palette < 0 || num_palette > (int) max_palette_length)
    {