diff options
Diffstat (limited to 'Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c')
-rw-r--r-- | Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c index cd554393773..1a6f876154d 100644 --- a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c +++ b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c @@ -24,10 +24,11 @@ - 1.10: enabled "message window"/console (thanks to David Geldreich) - 2.00: dual-licensed (added GNU GPL) - 2.01: fixed improper display of usage screen on PNG error(s) + - 2.02: check for integer overflow (Glenn R-P) --------------------------------------------------------------------------- - Copyright (c) 1998-2008 Greg Roelofs. All rights reserved. + Copyright (c) 1998-2008, 2017 Greg Roelofs. All rights reserved. This software is provided "as is," without warranty of any kind, express or implied. In no event shall the author or contributors @@ -496,6 +497,12 @@ static int rpng_win_create_window(HINSTANCE hInst, int showmode) wimage_rowbytes = ((3*image_width + 3L) >> 2) << 2; + /* Guard against integer overflow */ + if (image_height > ((size_t)(-1))/wimage_rowbytes) { + fprintf(stderr, PROGNAME ": image_data buffer would be too large\n"); + return 4; /* fail */ + } + if (!(dib = (uch *)malloc(sizeof(BITMAPINFOHEADER) + wimage_rowbytes*image_height))) { |