diff options
| author | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2012-02-26 20:42:28 -0600 |
|---|---|---|
| committer | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2012-02-26 20:42:28 -0600 |
| commit | d0bd02c4caf42b144fe1bec76dfbb934fd7407c2 (patch) | |
| tree | c442be34b6fcda16e99115b17053c09e32b23011 /pngrutil.c | |
| parent | 440e3a98037671db84337369eb9a8aa00ee7fd94 (diff) | |
| download | libpng-d0bd02c4caf42b144fe1bec76dfbb934fd7407c2.tar.gz | |
[libpng12] Fixed off-by-one bug in png_handle_sCAL() when using fixed point
arithmetic, causing out-of-bounds read in png_set_sCAL() because of failure
to copy the string terminators (Franke Busse).
Diffstat (limited to 'pngrutil.c')
| -rw-r--r-- | pngrutil.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/pngrutil.c b/pngrutil.c index 38a5ad6f3..7154dd63c 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -1,7 +1,7 @@ /* pngrutil.c - utilities to read a PNG file * - * Last changed in libpng 1.2.48 [February 22, 2012] + * Last changed in libpng 1.2.48 [February 27, 2012] * Copyright (c) 1998-2012 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -247,8 +247,8 @@ png_inflate(png_structp png_ptr, const png_byte *data, png_size_t size, { if (output != 0 && output_size > count) { - int copy = output_size - count; - if (avail < copy) copy = avail; + png_size_t copy = output_size - count; + if ((png_size_t) avail < copy) copy = (png_size_t) avail; png_memcpy(output + count, png_ptr->zbuf, copy); } count += avail; @@ -1858,11 +1858,11 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_ptr->chunkdata = NULL; return; } - png_memcpy(swidth, ep, (png_size_t)png_strlen(ep)); + png_memcpy(swidth, ep, (png_size_t)png_strlen(ep) + 1); #endif #endif - for (ep = png_ptr->chunkdata; *ep; ep++) + for (ep = png_ptr->chunkdata + 1; *ep; ep++) /* Empty loop */ ; ep++; @@ -1902,7 +1902,7 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) #endif return; } - png_memcpy(sheight, ep, (png_size_t)png_strlen(ep)); + png_memcpy(sheight, ep, (png_size_t)png_strlen(ep) + 1); #endif #endif |