summaryrefslogtreecommitdiff
path: root/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c')
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c
index cd554393773..1a6f876154d 100644
--- a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c
+++ b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng-win.c
@@ -24,10 +24,11 @@
- 1.10: enabled "message window"/console (thanks to David Geldreich)
- 2.00: dual-licensed (added GNU GPL)
- 2.01: fixed improper display of usage screen on PNG error(s)
+ - 2.02: check for integer overflow (Glenn R-P)
---------------------------------------------------------------------------
- Copyright (c) 1998-2008 Greg Roelofs. All rights reserved.
+ Copyright (c) 1998-2008, 2017 Greg Roelofs. All rights reserved.
This software is provided "as is," without warranty of any kind,
express or implied. In no event shall the author or contributors
@@ -496,6 +497,12 @@ static int rpng_win_create_window(HINSTANCE hInst, int showmode)
wimage_rowbytes = ((3*image_width + 3L) >> 2) << 2;
+ /* Guard against integer overflow */
+ if (image_height > ((size_t)(-1))/wimage_rowbytes) {
+ fprintf(stderr, PROGNAME ": image_data buffer would be too large\n");
+ return 4; /* fail */
+ }
+
if (!(dib = (uch *)malloc(sizeof(BITMAPINFOHEADER) +
wimage_rowbytes*image_height)))
{