summaryrefslogtreecommitdiff
path: root/Build/source/libs/libpng/libpng-src/contrib/visupng/PngFile.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/libpng/libpng-src/contrib/visupng/PngFile.c')
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/visupng/PngFile.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/Build/source/libs/libpng/libpng-src/contrib/visupng/PngFile.c b/Build/source/libs/libpng/libpng-src/contrib/visupng/PngFile.c
index dcde18a3af4..d46318f4474 100644
--- a/Build/source/libs/libpng/libpng-src/contrib/visupng/PngFile.c
+++ b/Build/source/libs/libpng/libpng-src/contrib/visupng/PngFile.c
@@ -2,7 +2,7 @@
* PNGFILE.C -- Image File Functions
*-------------------------------------
*
- * Copyright 2000, Willem van Schaik.
+ * Copyright 2000,2017 Willem van Schaik.
*
* This code is released under the libpng license.
* For conditions of distribution and use, see the disclaimer
@@ -236,6 +236,10 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData,
free (pbImageData);
pbImageData = NULL;
}
+ if ((*piHeight) > ((size_t)(-1))/ulRowBytes) {
+ {
+ png_error(png_ptr, "Visual PNG: image is too big");
+ }
if ((pbImageData = (png_byte *) malloc(ulRowBytes * (*piHeight)
* sizeof(png_byte))) == NULL)
{