diff options
| author | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-08-31 11:14:23 -0500 |
|---|---|---|
| committer | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-08-31 11:14:23 -0500 |
| commit | eb2f42aa97022d4bde30ad98f2e765f14adbfc5d (patch) | |
| tree | 6813d57e39c959ba02e20de41cc9c70ddee59606 /pngrutil.c | |
| parent | 47aa798127d8d37dc4144d34cdd641d835fb9e71 (diff) | |
| download | libpng-eb2f42aa97022d4bde30ad98f2e765f14adbfc5d.tar.gz | |
[libpng16] Compute a larger limit on IDAT because some applications write a
deflate buffer for each row (Bug report by Andrew Church).
Diffstat (limited to 'pngrutil.c')
| -rw-r--r-- | pngrutil.c | 26 |
1 files changed, 13 insertions, 13 deletions
diff --git a/pngrutil.c b/pngrutil.c index a4fa71457..ccf5405e1 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -3144,28 +3144,28 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length) { png_alloc_size_t limit = PNG_UINT_31_MAX; - if (png_ptr->chunk_name != png_IDAT) - { # ifdef PNG_SET_USER_LIMITS_SUPPORTED - if (png_ptr->user_chunk_malloc_max > 0 && - png_ptr->user_chunk_malloc_max < limit) - limit = png_ptr->user_chunk_malloc_max; + if (png_ptr->user_chunk_malloc_max > 0 && + png_ptr->user_chunk_malloc_max < limit) + limit = png_ptr->user_chunk_malloc_max; # elif PNG_USER_CHUNK_MALLOC_MAX > 0 - if (PNG_USER_CHUNK_MALLOC_MAX < limit) - limit = PNG_USER_CHUNK_MALLOC_MAX; + if (PNG_USER_CHUNK_MALLOC_MAX < limit) + limit = PNG_USER_CHUNK_MALLOC_MAX; # endif - } - else + if (png_ptr->chunk_name == png_IDAT) { + png_alloc_size_t idat_limit = PNG_UINT_31_MAX; size_t row_factor = (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1) + 1 + (png_ptr->interlaced? 6: 0)); if (png_ptr->height > PNG_UINT_32_MAX/row_factor) - limit=PNG_UINT_31_MAX; + idat_limit=PNG_UINT_31_MAX; else - limit = png_ptr->height * row_factor; - limit += 6 + 5*(limit/32566+1); /* zlib+deflate overhead */ - limit=limit < PNG_UINT_31_MAX? limit : PNG_UINT_31_MAX; + idat_limit = png_ptr->height * row_factor; + row_factor = row_factor > 32566? 32566 : row_factor; + idat_limit += 6 + 5*(idat_limit/row_factor+1); /* zlib+deflate overhead */ + idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX; + limit = limit < idat_limit? idat_limit : limit; } if (length > limit) |