From 68a6e6755bf88004ac3fa8f59c20e2cc7920cec2 Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Thu, 19 Nov 2015 09:12:43 -0600
Subject: [lbpng15] Rearrange terms in buffer length tests in pngrutil.c to

avoid potential overflow in calculations.
---
 pngrutil.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pngrutil.c b/pngrutil.c
index f212bc8f2..429214e0f 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1327,7 +1327,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    /* There should be at least one zero (the compression type byte)
     * following the separator, and we should be on it
     */
-   if (slength < 1 || profile >= png_ptr->chunkdata + slength - 1)
+   if (slength < 1 || profile - png_ptr->chunkdata >= slength - 1)
    {
       png_free(png_ptr, png_ptr->chunkdata);
       png_ptr->chunkdata = NULL;
@@ -1476,7 +1476,7 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    ++entry_start;
 
    /* A sample depth should follow the separator, and we should be on it  */
-   if (slength < 2 || entry_start > (png_bytep)png_ptr->chunkdata + slength - 2)
+   if (slength < 2 || entry_start - (png_bytep)png_ptr->chunkdata > slength - 2)
    {
       png_free(png_ptr, png_ptr->chunkdata);
       png_ptr->chunkdata = NULL;
@@ -2005,7 +2005,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    /* We need to have at least 12 bytes after the purpose string
     * in order to get the parameter information.
     */
-   if (length < 12 || endptr <= buf + 12)
+   if (endptr -buf <= 12)
    {
       png_warning(png_ptr, "Invalid pCAL data");
       png_free(png_ptr, png_ptr->chunkdata);
@@ -2417,7 +2417,7 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       /* Empty loop */ ;
 
    /* zTXt must have some text after the chunkdataword */
-   if (slength < 2 || text >= png_ptr->chunkdata + slength - 2)
+   if (slength < 2 || text - png_ptr->chunkdata >= slength - 2)
    {
       png_warning(png_ptr, "Truncated zTXt chunk");
       png_free(png_ptr, png_ptr->chunkdata);
@@ -2554,7 +2554,7 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
     * keyword
     */
 
-   if (slength < 3 || lang >= png_ptr->chunkdata + slength - 3)
+   if (slength < 3 || png_ptr->chunkdata - lang >= slength - 3)
    {
       png_warning(png_ptr, "Truncated iTXt chunk");
       png_free(png_ptr, png_ptr->chunkdata);
-- 
cgit v1.2.1