[libpng16]Revised png_check_IHDR() to use PNG_SIZE_MAX instead of
PNG_UINT_32_MAX in the test for potential overflow in PNG_ROWBYTES.
diff --git a/ANNOUNCE b/ANNOUNCE
index 4bb9c78..d980aed 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
-Libpng 1.6.9beta03 - January 1, 2014
+Libpng 1.6.9beta03 - January 10, 2014
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@@ -60,7 +60,9 @@
libpng17/png.h and libpng17.a). Three new configure options and some
rearrangement of Makefile.am allow creation of these links to be disabled.
-Version 1.6.9beta03 [January 1, 2014]
+Version 1.6.9beta03 [January 10, 2014]
+ Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX
+ in the test for potential overflow in PNG_ROWBYTES.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit
diff --git a/CHANGES b/CHANGES
index e6e9cf8..b4b3f9f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4785,7 +4785,9 @@
libpng17/png.h and libpng17.a). Three new configure options and some
rearrangement of Makefile.am allow creation of these links to be disabled.
-Version 1.6.9beta03 [January 1, 2014]
+Version 1.6.9beta03 [January 10, 2014]
+ Revised png_check_IHDR() to use PNG_SIZE_MAX instead of PNG_UINT_32_MAX
+ in the test for potential overflow in PNG_ROWBYTES.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit
diff --git a/png.c b/png.c
index 553c9d6..4e28233 100644
--- a/png.c
+++ b/png.c
@@ -773,13 +773,13 @@
#else
# ifdef __STDC__
return PNG_STRING_NEWLINE \
- "libpng version 1.6.9beta03 - January 8, 2014" PNG_STRING_NEWLINE \
+ "libpng version 1.6.9beta03 - January 10, 2014" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
"Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
PNG_STRING_NEWLINE;
# else
- return "libpng version 1.6.9beta03 - January 8, 2014\
+ return "libpng version 1.6.9beta03 - January 10, 2014\
Copyright (c) 1998-2014 Glenn Randers-Pehrson\
Copyright (c) 1996-1997 Andreas Dilger\
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
@@ -2473,12 +2473,14 @@
error = 1;
}
- if (error == 0 && width > (PNG_UINT_32_MAX
+ /* Check for potential overflow in PNG_ROWBYTES calculation */
+ if (error == 0 && width > (PNG_SIZE_MAX
>> 3) /* 8-byte RGBA pixels */
- 48 /* bigrowbuf hack */
- 1 /* filter byte */
- 7*8 /* rounding of width to multiple of 8 pixels */
- - 8) /* extra max_pixel_depth pad */
+ - 8 /* extra max_pixel_depth pad */
+ - error) /* to prevent always-false compiler warning */
png_warning(png_ptr,
"Width may be too large for libpng to process pixels");
