[master] Check for up->location !PNG_AFTER_IDAT when writing unknown chunks

before IDAT.

3 files changed, 6 insertions, 1 deletions

diff --git a/ANNOUNCE b/ANNOUNCE
index 3e8d9f3c1..0f26e1730 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -32,6 +32,8 @@ version 1.4.8beta01 [June 4, 2011]
     "#include pngpriv.h" from pngtest.c, to avoid setting a bad example.
   Pass "" instead of '\0' to png_default_error() in png_err().  This mistake
     was introduced in libpng-1.2.20beta01.
+  Check for up->location !PNG_AFTER_IDAT when writing unknown chunks
+    before IDAT.
 
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit
diff --git a/CHANGES b/CHANGES
index ef70ac382..5081935a0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2800,6 +2800,8 @@ version 1.4.8beta01 [June 4, 2011]
     "#include pngpriv.h" from pngtest.c, to avoid setting a bad example.
   Pass "" instead of '\0' to png_default_error() in png_err().  This mistake
     was introduced in libpng-1.2.20beta01.
+  Check for up->location !PNG_AFTER_IDAT when writing unknown chunks
+    before IDAT.
 
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit
diff --git a/pngwrite.c b/pngwrite.c
index dce38459a..20f007404 100644
--- a/pngwrite.c
+++ b/pngwrite.c
@@ -295,6 +295,7 @@ png_write_info(png_structp png_ptr, png_infop info_ptr)
          if (keep != PNG_HANDLE_CHUNK_NEVER &&
             up->location && (up->location & PNG_HAVE_PLTE) &&
             !(up->location & PNG_HAVE_IDAT) &&
+            !(up->location & PNG_AFTER_IDAT) &&
             ((up->name[3] & 0x20) || keep == PNG_HANDLE_CHUNK_ALWAYS ||
             (png_ptr->flags & PNG_FLAG_KEEP_UNSAFE_CHUNKS)))
          {
@@ -1411,7 +1412,7 @@ png_write_png(png_structp png_ptr, png_infop info_ptr,
 #endif
 
 #ifdef PNG_WRITE_FILLER_SUPPORTED
-   /* Pack XRGB/RGBX/ARGB/RGBA into * RGB (4 channels -> 3 channels) */
+   /* Pack XRGB/RGBX/ARGB/RGBA into RGB (4 channels -> 3 channels) */
    if (transforms & PNG_TRANSFORM_STRIP_FILLER_AFTER)
       png_set_filler(png_ptr, 0, PNG_FILLER_AFTER);
    else if (transforms & PNG_TRANSFORM_STRIP_FILLER_BEFORE)