[libpng14] Ignore, with a warning, out-of-range value of num_trans
in png_set_tRNS().
diff --git a/ANNOUNCE b/ANNOUNCE
index ec9f92e..6f57a4e 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
-Libpng 1.4.13beta01 - August 3, 2012
+Libpng 1.4.13beta01 - December 10, 2012
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@@ -32,9 +32,10 @@
pngsuite/README.txt.
Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386.
-version 1.4.13beta01 [August 3, 2012]
+version 1.4.13beta01 [December 10, 2012]
Do not compile PNG_DEPRECATED, PNG_ALLOC and PNG_PRIVATE when __GNUC__ < 3.
Removed references to png_zalloc() and png_zfree() from the manual.
+ Ignore, with a warning, out-of-range value of num_trans in png_set_tRNS().
Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit
diff --git a/CHANGES b/CHANGES
index d53c691..e0cd9e4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2874,9 +2874,10 @@
pngsuite/README.txt.
Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386.
-version 1.4.13beta01 [August 3, 2012]
+version 1.4.13beta01 [December 10, 2012]
Do not compile PNG_DEPRECATED, PNG_ALLOC and PNG_PRIVATE when __GNUC__ < 3.
Removed references to png_zalloc() and png_zfree() from the manual.
+ Ignore, with a warning, out-of-range value of num_trans in png_set_tRNS().
Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit
diff --git a/pngset.c b/pngset.c
index 17ddfca..0afe895 100644
--- a/pngset.c
+++ b/pngset.c
@@ -1,7 +1,7 @@
/* pngset.c - storage of image information into info struct
*
- * Last changed in libpng 1.4.11 [March 29, 2012]
+ * Last changed in libpng 1.4.13 [December 10, 2012]
* Copyright (c) 1998-2012 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -836,6 +836,12 @@
if (png_ptr == NULL || info_ptr == NULL)
return;
+ if (num_trans < 0 || num_trans > PNG_MAX_PALETTE_LENGTH)
+ {
+ png_warning(png_ptr, "Ignoring invalid num_trans value");
+ return;
+ }
+
if (trans_alpha != NULL)
{
/* It may not actually be necessary to set png_ptr->trans_alpha here;
