diff options
| author | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-07-30 19:36:25 -0500 |
|---|---|---|
| committer | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-07-30 19:36:25 -0500 |
| commit | 4ab78af90a0f54665a8c1aca16745d2f641c7efb (patch) | |
| tree | 90a6aba07b9bbb36a8ccf0593821e5c2b742f973 /pngrutil.c | |
| parent | b73c8918918430058a46e676c5c5b7db1217fd42 (diff) | |
| download | libpng-4ab78af90a0f54665a8c1aca16745d2f641c7efb.tar.gz | |
[libpng16] Avoid possible NULL dereference in png_handle_eXIf when benign_errors
are allowed. Avoid leaking the input buffer "eXIf_buf".
Diffstat (limited to 'pngrutil.c')
| -rw-r--r-- | pngrutil.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/pngrutil.c b/pngrutil.c index 7fe5cd1de..c9e1dd401 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -2021,7 +2021,7 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) png_chunk_error(png_ptr, "missing IHDR"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_eXIf) != 0) + else if (info_ptr == NULL || (info_ptr->valid & PNG_INFO_eXIf) != 0) { png_crc_finish(png_ptr, length); png_chunk_benign_error(png_ptr, "duplicate"); @@ -2044,6 +2044,8 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) info_ptr->num_exif = length; png_set_eXIf(png_ptr, info_ptr, eXIf_buf); + + png_free(png_ptr, eXIf_buf); } #endif |