diff options
Diffstat (limited to 'pngpread.c')
| -rw-r--r-- | pngpread.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/pngpread.c b/pngpread.c index 650ba1e23..45b23a79c 100644 --- a/pngpread.c +++ b/pngpread.c @@ -223,6 +223,21 @@ png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr) png_benign_error(png_ptr, "Too many IDATs found"); } + else + { + png_alloc_size_t limit = PNG_SIZE_MAX; +# ifdef PNG_SET_USER_LIMITS_SUPPORTED + if (png_ptr->user_chunk_malloc_max > 0 && + png_ptr->user_chunk_malloc_max < limit) + limit = png_ptr->user_chunk_malloc_max; +# elif PNG_USER_CHUNK_MALLOC_MAX > 0 + if (PNG_USER_CHUNK_MALLOC_MAX < limit) + limit = PNG_USER_CHUNK_MALLOC_MAX; +# endif + if (png_ptr->push_length > limit) + png_chunk_error(png_ptr, "chunk data is too large"); + } + if (chunk_name == png_IHDR) { if (png_ptr->push_length != 13) |