diff options
| author | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2012-08-08 22:13:25 -0500 |
|---|---|---|
| committer | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2012-08-08 22:13:25 -0500 |
| commit | 0054b566f4e0318e32ef84dde03621bdaa11f15e (patch) | |
| tree | 1595f5fc93f876e76a805822c672831c6bada2d9 /pngwtran.c | |
| parent | 1a2606069cdcc519e107c09cc320845b48e4db5c (diff) | |
| download | libpng-0054b566f4e0318e32ef84dde03621bdaa11f15e.tar.gz | |
[libpng15] When png_set_filler is used to strip a filler channel during write,
the code prior to 1.5 would ignore the case where the output required an
alpha channel or when the output was a palettized PNG. In libpng-1.5 the
ignorance was lost and libpng proceeded to strip the channel resulting
in a bad (potential memory overwrite) failure later. This reverts
the behavior to the pre-1.5 state but issues a warning. libpng-1.6 is
expected to issue an error on the erroneous png_set_filler call.
Diffstat (limited to 'pngwtran.c')
| -rw-r--r-- | pngwtran.c | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/pngwtran.c b/pngwtran.c index 96608efcb..07dcc5313 100644 --- a/pngwtran.c +++ b/pngwtran.c @@ -1,8 +1,8 @@ /* pngwtran.c - transforms the data in a row for PNG writers * - * Last changed in libpng 1.5.6 [November 3, 2011] - * Copyright (c) 1998-2011 Glenn Randers-Pehrson + * Last changed in libpng 1.5.13 [(PENDING RELEASE)] + * Copyright (c) 1998-2012 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -45,8 +45,20 @@ png_do_write_transformations(png_structp png_ptr, png_row_infop row_info) #ifdef PNG_WRITE_FILLER_SUPPORTED if (png_ptr->transformations & PNG_FILLER) - png_do_strip_channel(row_info, png_ptr->row_buf + 1, - !(png_ptr->flags & PNG_FLAG_FILLER_AFTER)); + { + if (png_ptr->color_type & (PNG_COLOR_MASK_ALPHA|PNG_COLOR_MASK_PALETTE)) + { + /* GA, RGBA or palette; in any of these cases libpng will not do the + * the correct thing (whatever that might be). + */ + png_warning(png_ptr, "incorrect png_set_filler call ignored"); + png_ptr->transformations &= ~PNG_FILLER; + } + + else + png_do_strip_channel(row_info, png_ptr->row_buf + 1, + !(png_ptr->flags & PNG_FLAG_FILLER_AFTER)); + } #endif #ifdef PNG_WRITE_PACKSWAP_SUPPORTED |