diff options
Diffstat (limited to 'Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c')
-rw-r--r-- | Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c index 0c8ddeba223..af944c0f2bf 100644 --- a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c +++ b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c @@ -44,9 +44,11 @@ - 2.04: Added "void(foo);" statements to quiet pedantic compiler warnings about unused variables (GR-P) - 2.05: Use nanosleep() instead of usleep(), which is deprecated (GR-P). + - 2.06: check for integer overflow (Glenn R-P) --------------------------------------------------------------------------- - Copyright (c) 1998-2010, 2014-2015 Greg Roelofs. All rights reserved. + Copyright (c) 1998-2010, 2014-2015, 2017 Greg Roelofs. All rights + reserved. This software is provided "as is," without warranty of any kind, express or implied. In no event shall the author or contributors @@ -780,6 +782,13 @@ static void rpng2_x_init(void) Trace((stderr, " width = %ld\n", rpng2_info.width)) Trace((stderr, " height = %ld\n", rpng2_info.height)) + /* Guard against integer overflow */ + if (rpng2_info.height > ((size_t)(-1))/rpng2_info.rowbytes) { + fprintf(stderr, PROGNAME ": image_data buffer would be too large\n"); + readpng2_cleanup(&rpng2_info); + return; + } + rpng2_info.image_data = (uch *)malloc(rowbytes * rpng2_info.height); if (!rpng2_info.image_data) { readpng2_cleanup(&rpng2_info); |