summaryrefslogtreecommitdiff
path: root/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c')
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c
index 0c8ddeba223..af944c0f2bf 100644
--- a/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c
+++ b/Build/source/libs/libpng/libpng-src/contrib/gregbook/rpng2-x.c
@@ -44,9 +44,11 @@
- 2.04: Added "void(foo);" statements to quiet pedantic compiler warnings
about unused variables (GR-P)
- 2.05: Use nanosleep() instead of usleep(), which is deprecated (GR-P).
+ - 2.06: check for integer overflow (Glenn R-P)
---------------------------------------------------------------------------
- Copyright (c) 1998-2010, 2014-2015 Greg Roelofs. All rights reserved.
+ Copyright (c) 1998-2010, 2014-2015, 2017 Greg Roelofs. All rights
+ reserved.
This software is provided "as is," without warranty of any kind,
express or implied. In no event shall the author or contributors
@@ -780,6 +782,13 @@ static void rpng2_x_init(void)
Trace((stderr, " width = %ld\n", rpng2_info.width))
Trace((stderr, " height = %ld\n", rpng2_info.height))
+ /* Guard against integer overflow */
+ if (rpng2_info.height > ((size_t)(-1))/rpng2_info.rowbytes) {
+ fprintf(stderr, PROGNAME ": image_data buffer would be too large\n");
+ readpng2_cleanup(&rpng2_info);
+ return;
+ }
+
rpng2_info.image_data = (uch *)malloc(rowbytes * rpng2_info.height);
if (!rpng2_info.image_data) {
readpng2_cleanup(&rpng2_info);