diff options
| -rw-r--r-- | pngrutil.c | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/pngrutil.c b/pngrutil.c index 6b53548fb..f5d433147 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -603,18 +603,21 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) } } - max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? - (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; - /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */ num = (int)length / 3; - /* If the palette has 256 or fewer entries but is too large for the bit depth, - * we don't issue an error, to preserve the behavior of previous libpng versions. - * We silently truncate the unused extra palette entries here. + /* If the palette has 256 or fewer entries but is too large for the bit + * depth, we don't issue an error, to preserve the behavior of previous + * libpng versions. We silently truncate the unused extra palette entries + * here. */ + if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) + max_palette_length = (1 << png_ptr->bit_depth); + else + max_palette_length = PNG_MAX_PALETTE_LENGTH; + if (num > max_palette_length) - num = max_palette_length; + num = max_palette_length; #ifdef PNG_POINTER_INDEXING_SUPPORTED for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++) |