diff options
| author | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-09-03 15:54:07 -0500 |
|---|---|---|
| committer | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-09-03 15:54:07 -0500 |
| commit | 1a21497f6a962fec491e727ab61f3a82ec8c30d3 (patch) | |
| tree | f3d04eafb83faf57661e7e1f165dfa9833ceba51 | |
| parent | 0d9bc0782e78e472f8426e5aeab81de623e0bd68 (diff) | |
| download | libpng-1a21497f6a962fec491e727ab61f3a82ec8c30d3.tar.gz | |
[libpng15] Fixed incorrect typecast of some arguments to png_malloc() and
png_calloc() that were png_uint_32 instead of png_alloc_size_t
(Bug report by "irwir" in Github libpng issue #175).
| -rw-r--r-- | ANNOUNCE | 3 | ||||
| -rw-r--r-- | CHANGES | 3 | ||||
| -rw-r--r-- | pngrtran.c | 12 |
3 files changed, 12 insertions, 6 deletions
@@ -35,6 +35,9 @@ Version 1.5.30beta01 [August 28, 2017] Version 1.5.30beta02 [September 3, 2017] Compute a larger limit on IDAT because some applications write a deflate buffer for each row (Bug report by Andrew Church). + Fixed incorrect typecast of some arguments to png_malloc() and + png_calloc() that were png_uint_32 instead of png_alloc_size_t + (Bug report by "irwir" in Github libpng issue #175). Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit @@ -4563,6 +4563,9 @@ Version 1.5.30beta01 [August 28, 2017] Version 1.5.30beta02 [September 3, 2017] Compute a larger limit on IDAT because some applications write a deflate buffer for each row (Bug report by Andrew Church). + Fixed incorrect typecast of some arguments to png_malloc() and + png_calloc() that were png_uint_32 instead of png_alloc_size_t + (Bug report by "irwir" in Github libpng issue #175). Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/pngrtran.c b/pngrtran.c index ad1e7a634..9889b9abb 100644 --- a/pngrtran.c +++ b/pngrtran.c @@ -396,7 +396,7 @@ png_set_quantize(png_structp png_ptr, png_colorp palette, int i; png_ptr->quantize_index = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * png_sizeof(png_byte))); + (png_alloc_size_t)(num_palette * png_sizeof(png_byte))); for (i = 0; i < num_palette; i++) png_ptr->quantize_index[i] = (png_byte)i; } @@ -413,7 +413,7 @@ png_set_quantize(png_structp png_ptr, png_colorp palette, /* Initialize an array to sort colors */ png_ptr->quantize_sort = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * png_sizeof(png_byte))); + (png_alloc_size_t)(num_palette * png_sizeof(png_byte))); /* Initialize the quantize_sort array */ for (i = 0; i < num_palette; i++) @@ -547,9 +547,9 @@ png_set_quantize(png_structp png_ptr, png_colorp palette, /* Initialize palette index arrays */ png_ptr->index_to_palette = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * png_sizeof(png_byte))); + (png_alloc_size_t)(num_palette * png_sizeof(png_byte))); png_ptr->palette_to_index = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * png_sizeof(png_byte))); + (png_alloc_size_t)(num_palette * png_sizeof(png_byte))); /* Initialize the sort array */ for (i = 0; i < num_palette; i++) @@ -589,7 +589,7 @@ png_set_quantize(png_structp png_ptr, png_colorp palette, { t = (png_dsortp)png_malloc_warn(png_ptr, - (png_uint_32)(png_sizeof(png_dsort))); + (png_alloc_size_t)(png_sizeof(png_dsort))); if (t == NULL) break; @@ -716,7 +716,7 @@ png_set_quantize(png_structp png_ptr, png_colorp palette, png_ptr->palette_lookup = (png_bytep)png_calloc(png_ptr, (png_uint_32)(num_entries * png_sizeof(png_byte))); - distance = (png_bytep)png_malloc(png_ptr, (png_uint_32)(num_entries * + distance = (png_bytep)png_malloc(png_ptr, (png_alloc_size_t)(num_entries * png_sizeof(png_byte))); png_memset(distance, 0xff, num_entries * png_sizeof(png_byte)); |