diff options
| author | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2015-10-30 07:57:49 -0500 |
|---|---|---|
| committer | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2015-10-30 07:57:49 -0500 |
| commit | a901eb3ce6087e0afeef988247f1a1aa208cb54d (patch) | |
| tree | 9f59079d82106421afab2011f8095a8263144ce0 /pngwutil.c | |
| parent | 06509be841846a689039b0b353dcd26fa5f08d93 (diff) | |
| download | libpng-a901eb3ce6087e0afeef988247f1a1aa208cb54d.tar.gz | |
[libpng16] Prevent reading over-length PLTE chunk (Cosmin Truta).
Diffstat (limited to 'pngwutil.c')
| -rw-r--r-- | pngwutil.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/pngwutil.c b/pngwutil.c index 71923298f..7afefe1f9 100644 --- a/pngwutil.c +++ b/pngwutil.c @@ -922,20 +922,20 @@ void /* PRIVATE */ png_write_PLTE(png_structrp png_ptr, png_const_colorp palette, png_uint_32 num_pal) { - png_uint_32 max_num_pal, i; + png_uint_32 max_palette_length, i; png_const_colorp pal_ptr; png_byte buf[3]; png_debug(1, "in png_write_PLTE"); - max_num_pal = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? + max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; if (( #ifdef PNG_MNG_FEATURES_SUPPORTED (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0 && #endif - num_pal == 0) || num_pal > max_num_pal) + num_pal == 0) || num_pal > max_palette_length) { if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) { |