summaryrefslogtreecommitdiff
path: root/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-win.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-win.c')
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-win.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-win.c b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-win.c
index c924c1c6c27..ed6b526ecb9 100644
--- a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-win.c
+++ b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-win.c
@@ -33,12 +33,11 @@
- 2.02: fixed improper display of usage screen on PNG error(s); fixed
unexpected-EOF and file-read-error cases
- 2.03: removed runtime MMX-enabling/disabling and obsolete -mmx* options
- - 2.04:
- (GR-P)
+ - 2.04: check for integer overflow (Glenn R-P)
---------------------------------------------------------------------------
- Copyright (c) 1998-2008 Greg Roelofs. All rights reserved.
+ Copyright (c) 1998-2008, 2017 Greg Roelofs. All rights reserved.
This software is provided "as is," without warranty of any kind,
express or implied. In no event shall the author or contributors
@@ -650,6 +649,13 @@ static void rpng2_win_init()
Trace((stderr, " width = %ld\n", rpng2_info.width))
Trace((stderr, " height = %ld\n", rpng2_info.height))
+ /* Guard against integer overflow */
+ if (rpng2_info.height > ((size_t)(-1))/rowbytes) {
+ fprintf(stderr, PROGNAME ": image_data buffer would be too large\n",
+ readpng2_cleanup(&rpng2_info);
+ return;
+ }
+
rpng2_info.image_data = (uch *)malloc(rowbytes * rpng2_info.height);
if (!rpng2_info.image_data) {
readpng2_cleanup(&rpng2_info);