diff options
author | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2015-11-21 14:33:31 -0600 |
---|---|---|
committer | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2015-11-21 14:33:31 -0600 |
commit | 611e8de78c734eeaecb207da368bb26d5c539f81 (patch) | |
tree | 96fc4e6a626b8d4c59fcd98335cf81fbfbcda830 | |
parent | 68a6e6755bf88004ac3fa8f59c20e2cc7920cec2 (diff) | |
download | libpng-611e8de78c734eeaecb207da368bb26d5c539f81.tar.gz |
[libpng15] Use unsigned constants in buffer length comparisons
-rw-r--r-- | pngrutil.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/pngrutil.c b/pngrutil.c index 429214e0f..25b8790d3 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -1327,7 +1327,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) /* There should be at least one zero (the compression type byte) * following the separator, and we should be on it */ - if (slength < 1 || profile - png_ptr->chunkdata >= slength - 1) + if (slength < 1U || profile >= png_ptr->chunkdata + slength - 1U) { png_free(png_ptr, png_ptr->chunkdata); png_ptr->chunkdata = NULL; @@ -1476,7 +1476,8 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) ++entry_start; /* A sample depth should follow the separator, and we should be on it */ - if (slength < 2 || entry_start - (png_bytep)png_ptr->chunkdata > slength - 2) + if (slength < 2U || + entry_start > (png_bytep)png_ptr->chunkdata + slength - 2U) { png_free(png_ptr, png_ptr->chunkdata); png_ptr->chunkdata = NULL; @@ -2005,7 +2006,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) /* We need to have at least 12 bytes after the purpose string * in order to get the parameter information. */ - if (endptr -buf <= 12) + if (endptr - buf <= 12U) { png_warning(png_ptr, "Invalid pCAL data"); png_free(png_ptr, png_ptr->chunkdata); @@ -2417,7 +2418,7 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) /* Empty loop */ ; /* zTXt must have some text after the chunkdataword */ - if (slength < 2 || text - png_ptr->chunkdata >= slength - 2) + if (slength < 2U || text >= png_ptr->chunkdata + slength - 2U) { png_warning(png_ptr, "Truncated zTXt chunk"); png_free(png_ptr, png_ptr->chunkdata); @@ -2554,7 +2555,7 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) * keyword */ - if (slength < 3 || png_ptr->chunkdata - lang >= slength - 3) + if (slength < 3U || lang >= png_ptr->chunkdata + slength - 3U) { png_warning(png_ptr, "Truncated iTXt chunk"); png_free(png_ptr, png_ptr->chunkdata); |