diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2018-03-26 16:12:39 +0100 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2018-03-29 13:44:03 +0100 |
| commit | bc817a3afdb932eadac17155834f89efd1c96da4 (patch) | |
| tree | 062c227faa91ada04ef0e1388befbff0bec8f116 /libpng/contrib/gregbook/wpng.c | |
| parent | 0a4ef8b01c2ea146b9dce7b80f21f6cd65420099 (diff) | |
| download | ghostpdl-bc817a3afdb932eadac17155834f89efd1c96da4.tar.gz | |
Bring libpng up to 1.6.34
Diffstat (limited to 'libpng/contrib/gregbook/wpng.c')
| -rw-r--r-- | libpng/contrib/gregbook/wpng.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/libpng/contrib/gregbook/wpng.c b/libpng/contrib/gregbook/wpng.c index a06e3529e..a8f367fb8 100644 --- a/libpng/contrib/gregbook/wpng.c +++ b/libpng/contrib/gregbook/wpng.c @@ -29,6 +29,7 @@ - 1.04: fixed DOS/OS2/Win32 detection, including partial Cygwin fix (see http://home.att.net/~perlspinr/diffs/GregBook_cygwin.diff) - 2.00: dual-licensed (added GNU GPL) + - 2.01: check for integer overflow (Glenn R-P) [REPORTED BUG (win32 only): "contrib/gregbook/wpng.c - cmd line dose not work! In order to do something useful I needed to redirect @@ -38,7 +39,7 @@ --------------------------------------------------------------------------- - Copyright (c) 1998-2007 Greg Roelofs. All rights reserved. + Copyright (c) 1998-2007, 2017 Greg Roelofs. All rights reserved. This software is provided "as is," without warranty of any kind, express or implied. In no event shall the author or contributors @@ -702,7 +703,18 @@ int main(int argc, char **argv) if (wpng_info.interlaced) { long i; ulg bytes; - ulg image_bytes = rowbytes * wpng_info.height; /* overflow? */ + ulg image_bytes; + + /* Guard against integer overflow */ + if (wpng_info_height > ((size_t)(-1)/rowbytes || + wpng_info_height > ((ulg)(-1)/rowbytes) { + fprintf(stderr, PROGNAME ": image_data buffer too large\n"); + writepng_cleanup(&wpng_info); + wpng_cleanup(); + exit(5); + } + + image_bytes = rowbytes * wpng_info.height; wpng_info.image_data = (uch *)malloc(image_bytes); wpng_info.row_pointers = (uch **)malloc(wpng_info.height*sizeof(uch *)); |