[devel] Fixed incorrect test in new png_push_save_buffer() code.
diff --git a/ANNOUNCE b/ANNOUNCE
index 5028687..a999161 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
-Libpng 1.5.0beta01 - February 8, 2010
+Libpng 1.5.0beta02 - February 8, 2010
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@@ -9,25 +9,29 @@
Source files with LF line endings (for Unix/Linux) and with a
"configure" script
- 1.5.0beta01.tar.xz (LZMA-compressed, recommended)
- 1.5.0beta01.tar.gz
- 1.5.0beta01.tar.bz2
+ 1.5.0beta02.tar.xz (LZMA-compressed, recommended)
+ 1.5.0beta02.tar.gz
+ 1.5.0beta02.tar.bz2
Source files with CRLF line endings (for Windows), without the
"configure" script
- lp150b01.zip
- lp150b01.7z
+ lp150b02.zip
+ lp150b02.7z
Other information:
- 1.5.0beta01-README.txt
- 1.5.0beta01-LICENSE.txt
+ 1.5.0beta02-README.txt
+ 1.5.0beta02-LICENSE.txt
Changes since the last public release (1.4.1):
-version 1.5.0beta01 [February 8, 2010]
- Moved declaration of png_struct into private pngstruct.h and png_info into pnginfo.h
+version 1.5.0beta01 [February 7, 2010]
+ Moved declaration of png_struct into private pngstruct.h and png_info
+ into pnginfo.h
+
+version 1.5.0beta02 [February 8, 2010]
+ Fixed incorrect test in new png_push_save_buffer() code.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit
diff --git a/CHANGES b/CHANGES
index e27196a..bcbf0bd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2502,8 +2502,12 @@
version 1.4.1beta08 [February 6, 2010]
Minor cleanup and updating of dates and copyright year.
-version 1.5.0beta01 [February 8, 2010]
- Moved declaration of png_struct into private pngstruct.h and png_info into pnginfo.h
+version 1.5.0beta01 [February 7, 2010]
+ Moved declaration of png_struct into private pngstruct.h and png_info
+ into pnginfo.h
+
+version 1.5.0beta02 [February 8, 2010]
+ Fixed incorrect test in new png_push_save_buffer() code.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit
diff --git a/pngpread.c b/pngpread.c
index 6d6c921..0ef012c 100644
--- a/pngpread.c
+++ b/pngpread.c
@@ -693,8 +693,10 @@
png_size_t new_max;
png_bytep old_buffer;
- if (png_ptr->save_buffer_size == PNG_SIZE_MAX)
- png_error(png_ptr, "Overflow of save_buffer");
+ if (png_ptr->save_buffer_max == PNG_SIZE_MAX ||
+ (png_ptr->save_buffer_size > PNG_SIZE_MAX -
+ png_ptr->current_buffer_size))
+ png_error(png_ptr, "Overflow of save_buffer");
if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
(png_ptr->current_buffer_size +
