[libpng17] Corrected previous attempt at overflow detection in
png_set_unknown_chunks().
diff --git a/ANNOUNCE b/ANNOUNCE
index c9c3bcf..ca787ba 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
-Libpng 1.7.0alpha08 - January 10, 2013
+Libpng 1.7.0alpha08 - January 17, 2013
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@@ -110,7 +110,8 @@
Fixed conceivable but difficult to repro overflow. Also added two test
programs to generate and test a PNG which should have the problem.
-Version 1.7.0alpha08 [January 10, 2013]
+Version 1.7.0alpha08 [January 17, 2013]
+ Corrected previous attempt at overflow detection in png_set_unknown_chunks().
===========================================================================
NOTICE November 17, 2012:
diff --git a/CHANGES b/CHANGES
index 320d9ce..6b4f476 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4396,7 +4396,8 @@
Fixed conceivable but difficult to repro overflow. Also added two test
programs to generate and test a PNG which should have the problem.
-Version 1.7.0alpha08 [January 10, 2013]
+Version 1.7.0alpha08 [January 17, 2013]
+ Corrected previous attempt at overflow detection in png_set_unknown_chunks().
===========================================================================
NOTICE November 17, 2012:
diff --git a/pngset.c b/pngset.c
index 70d4aa5..ea57bfa 100644
--- a/pngset.c
+++ b/pngset.c
@@ -1169,7 +1169,7 @@
* limit.
*/
if (num_unknowns > PNG_UINT_32_MAX - info_ptr->unknown_chunks_num ||
- num_unknowns > PNG_SIZE_MAX/(sizeof *np) - info_ptr->unknown_chunks_num)
+ num_unknowns + info_ptr->unknown_chunks_num > PNG_SIZE_MAX/(sizeof *np))
{
/* This is a benign read error (user limits are disabled and we are about
* to overflow 2^32 chunks) and an application write error.
@@ -1180,7 +1180,7 @@
}
np = png_voidcast(png_unknown_chunkp, png_malloc(png_ptr,
- (info_ptr->unknown_chunks_num + (unsigned int)num_unknowns) *
+ (info_ptr->unknown_chunks_num + num_unknowns) *
(sizeof (png_unknown_chunk))));
memcpy(np, info_ptr->unknown_chunks,
