summaryrefslogtreecommitdiff
path: root/Build/source/libs/libpng/libpng-src/contrib
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/libpng/libpng-src/contrib')
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/libtests/pngstest.c2
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/libtests/pngunknown.c12
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/README.txt32
-rwxr-xr-xBuild/source/libs/libpng/libpng-src/contrib/oss-fuzz/build.sh47
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc154
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.options2
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/png.dict39
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/pngminus/png2pnm.c17
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/pngminus/pnm2png.c18
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/bad_iCCP.pngbin0 -> 321 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/badadler.pngbin0 -> 67 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/badcrc.pngbin0 -> 67 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/empty_ancillary_chunks.pngbin0 -> 730 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_IDAT.pngbin0 -> 79 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_bKGD_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_cHRM_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_eXIf_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_gAMA_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_hIST_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_iCCP_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_iTXt_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_juNK_unsafe_to_copy.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_juNk_safe_to_copy.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_pCAL_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_pHYs_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sCAL_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sPLT_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sRGB_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sTER_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_tEXt_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_tIME_chunk.pngbin0 -> 57 bytes
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_zTXt_chunk.pngbin0 -> 57 bytes
32 files changed, 310 insertions, 13 deletions
diff --git a/Build/source/libs/libpng/libpng-src/contrib/libtests/pngstest.c b/Build/source/libs/libpng/libpng-src/contrib/libtests/pngstest.c
index 0617dbb048c..ab450893017 100644
--- a/Build/source/libs/libpng/libpng-src/contrib/libtests/pngstest.c
+++ b/Build/source/libs/libpng/libpng-src/contrib/libtests/pngstest.c
@@ -2610,9 +2610,9 @@ compare_two_images(Image *a, Image *b, int via_linear,
const unsigned int b_sample = PNG_IMAGE_SAMPLE_SIZE(formatb);
int alpha_added, alpha_removed;
int bchannels;
- int btoa[4];
png_uint_32 y;
Transform tr;
+ int btoa[4]={0,0,0,0};
/* This should never happen: */
if (width != b->image.width || height != b->image.height)
diff --git a/Build/source/libs/libpng/libpng-src/contrib/libtests/pngunknown.c b/Build/source/libs/libpng/libpng-src/contrib/libtests/pngunknown.c
index 7bb33f829b4..12eab72584a 100644
--- a/Build/source/libs/libpng/libpng-src/contrib/libtests/pngunknown.c
+++ b/Build/source/libs/libpng/libpng-src/contrib/libtests/pngunknown.c
@@ -1,7 +1,7 @@
/* pngunknown.c - test the read side unknown chunk handling
*
- * Last changed in libpng 1.6.31 [July 27, 2017]
+ * Last changed in libpng 1.6.32 [August 24, 2017]
* Copyright (c) 2015,2017 Glenn Randers-Pehrson
* Written by John Cunningham Bowler
*
@@ -114,6 +114,7 @@ typedef png_byte *png_const_bytep;
#define png_PLTE PNG_U32( 80, 76, 84, 69)
#define png_bKGD PNG_U32( 98, 75, 71, 68)
#define png_cHRM PNG_U32( 99, 72, 82, 77)
+#define png_eXIf PNG_U32(101, 88, 73, 102) /* registered July 2017 */
#define png_fRAc PNG_U32(102, 82, 65, 99) /* registered, not defined */
#define png_gAMA PNG_U32(103, 65, 77, 65)
#define png_gIFg PNG_U32(103, 73, 70, 103)
@@ -210,6 +211,13 @@ static struct
1,
# endif
1, START, 0 },
+ { "eXIf", PNG_INFO_eXIf, png_eXIf,
+# ifdef PNG_READ_eXIf_SUPPORTED
+ 0,
+# else
+ 1,
+# endif
+ 1, END, 0 },
{ "gAMA", PNG_INFO_gAMA, png_gAMA,
# ifdef PNG_READ_gAMA_SUPPORTED
0,
@@ -1090,7 +1098,7 @@ static const char *standard_tests[] =
"sTER", "sTER=if-safe", 0,
"IDAT", "default=discard", "IDAT=save", 0,
"sAPI", "bKGD=save", "cHRM=save", "gAMA=save", "all=discard", "iCCP=save",
- "sBIT=save", "sRGB=save", 0,
+ "sBIT=save", "sRGB=save", "eXIf=save", 0,
0/*end*/
};
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/README.txt b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/README.txt
new file mode 100644
index 00000000000..a75cba487ff
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/README.txt
@@ -0,0 +1,32 @@
+Last changed in libpng 1.6.32 [August 24, 2017]
+Copyright (c) 2017 Glenn Randers-Pehrson
+
+This code is released under the libpng license.
+For conditions of distribution and use, see the disclaimer
+and license in png.h
+
+Files in this directory are used by the oss-fuzz project
+(https://github.com/google/oss-fuzz/tree/master/projects/libpng).
+for "fuzzing" libpng.
+
+They were licensed by Google Inc, using the BSD-like Chromium license,
+which may be found at https://cs.chromium.org/chromium/src/LICENSE, or, if
+noted in the source, under the Apache-2.0 license, which may
+be found at http://www.apache.org/licenses/LICENSE-2.0 .
+If they have been modified, the derivatives are copyright Glenn Randers-Pehson
+and are released under the same licenses as the originals. Several of
+the original files (libpng_read_fuzzer.options, png.dict, project.yaml)
+had no licensing information; we assumed that these were under the Chromium
+license. Any new files are released under the libpng license (see png.h).
+
+The files are
+ Original
+ Filename or derived Copyright License
+ ========================= ========== ================ ==========
+ build.sh derived 2017, Glenn R-P Apache 2.0
+ libpng_read_fuzzer.cc derived 2017, Glenn R-P Chromium
+ libpng_read_fuzzer.options original 2015, Chrome Devs Chromium
+ png.dict original 2015, Chrome Devs Chromium
+ README.txt (this file) original 2017, GLenn R-P libpng
+
+To do: exercise the progressive reader.
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/build.sh b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/build.sh
new file mode 100755
index 00000000000..cf5a9dad507
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/build.sh
@@ -0,0 +1,47 @@
+#!/bin/bash -eu
+# Copyright 2017 Glenn Randers-Pehrson
+# Copyright 2016 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Last changed in libpng 1.6.32 [August 24, 2017]
+#
+# Revisions by Glenn Randers-Pehson, 2017:
+# 1. Build only the library, not the tools (changed "make -j$(nproc) all" to
+# "make -j$(nproc) libpng16.la").
+# 2. Disabled WARNING and WRITE options in pnglibconf.dfa.
+################################################################################
+
+# Disable logging via library build configuration control.
+cat scripts/pnglibconf.dfa | \
+ sed -e "s/option STDIO/option STDIO disabled/" \
+ -e "s/option WARNING /option WARNING disabled/" \
+ -e "s/option WRITE enables WRITE_INT_FUNCTIONS/option WRITE disabled/" \
+> scripts/pnglibconf.dfa.temp
+mv scripts/pnglibconf.dfa.temp scripts/pnglibconf.dfa
+
+# build the library.
+autoreconf -f -i
+./configure
+make -j$(nproc) clean
+make -j$(nproc) libpng16.la
+
+# build libpng_read_fuzzer.
+$CXX $CXXFLAGS -std=c++11 -I. \
+ $SRC/libpng_read_fuzzer.cc -o $OUT/libpng_read_fuzzer \
+ -lFuzzingEngine .libs/libpng16.a -lz
+
+# add seed corpus.
+find $SRC/libpng/contrib/pngsuite -name "*.png" | xargs zip $OUT/libpng_read_fuzzer_seed_corpus.zip
+
+cp $SRC/*.dict $SRC/*.options $OUT/
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc
new file mode 100644
index 00000000000..c1b16249db0
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc
@@ -0,0 +1,154 @@
+
+// libpng_read_fuzzer.cc
+// Copyright 2017 Glenn Randers-Pehrson
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that may
+// be found in the LICENSE file https://cs.chromium.org/chromium/src/LICENSE
+
+// Last changed in libpng 1.6.32 [August 24, 2017]
+
+// The modifications in 2017 by Glenn Randers-Pehrson include
+// 1. addition of a PNG_CLEANUP macro,
+// 2. setting the option to ignore ADLER32 checksums,
+// 3. adding "#include <string.h>" which is needed on some platforms
+// to provide memcpy().
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <vector>
+
+#define PNG_INTERNAL
+#include "png.h"
+
+#define PNG_CLEANUP \
+ if(png_handler.png_ptr) \
+ { \
+ if (png_handler.info_ptr) \
+ png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
+ nullptr); \
+ else \
+ png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
+ }
+
+struct BufState {
+ const uint8_t* data;
+ size_t bytes_left;
+};
+
+struct PngObjectHandler {
+ png_infop info_ptr = nullptr;
+ png_structp png_ptr = nullptr;
+ png_voidp row_ptr = nullptr;
+ BufState* buf_state = nullptr;
+
+ ~PngObjectHandler() {
+ if (row_ptr && png_ptr) {
+ png_free(png_ptr, row_ptr);
+ }
+ if (png_ptr && info_ptr) {
+ png_destroy_read_struct(&png_ptr, &info_ptr, nullptr);
+ }
+ delete buf_state;
+ }
+};
+
+void user_read_data(png_structp png_ptr, png_bytep data, png_size_t length) {
+ BufState* buf_state = static_cast<BufState*>(png_get_io_ptr(png_ptr));
+ if (length > buf_state->bytes_left) {
+ png_error(png_ptr, "read error");
+ }
+ memcpy(data, buf_state->data, length);
+ buf_state->bytes_left -= length;
+ buf_state->data += length;
+}
+
+static const int kPngHeaderSize = 8;
+
+// Entry point for LibFuzzer.
+// Roughly follows the libpng book example:
+// http://www.libpng.org/pub/png/book/chapter13.html
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ if (size < kPngHeaderSize) {
+ return 0;
+ }
+
+ std::vector<unsigned char> v(data, data + size);
+ if (png_sig_cmp(v.data(), 0, kPngHeaderSize)) {
+ // not a PNG.
+ return 0;
+ }
+
+ PngObjectHandler png_handler;
+ png_handler.png_ptr = png_create_read_struct
+ (PNG_LIBPNG_VER_STRING, nullptr, nullptr, nullptr);
+ if (!png_handler.png_ptr) {
+ return 0;
+ }
+
+ png_handler.info_ptr = png_create_info_struct(png_handler.png_ptr);
+ if (!png_handler.info_ptr) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ png_set_crc_action(png_handler.png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
+#ifdef PNG_IGNORE_ADLER32
+ png_set_option(png_handler.png_ptr, PNG_IGNORE_ADLER32, PNG_OPTION_ON);
+#endif
+
+ // Setting up reading from buffer.
+ png_handler.buf_state = new BufState();
+ png_handler.buf_state->data = data + kPngHeaderSize;
+ png_handler.buf_state->bytes_left = size - kPngHeaderSize;
+ png_set_read_fn(png_handler.png_ptr, png_handler.buf_state, user_read_data);
+ png_set_sig_bytes(png_handler.png_ptr, kPngHeaderSize);
+
+ if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ // Reading.
+ png_read_info(png_handler.png_ptr, png_handler.info_ptr);
+ png_handler.row_ptr = png_malloc(
+ png_handler.png_ptr, png_get_rowbytes(png_handler.png_ptr,
+ png_handler.info_ptr));
+
+ // reset error handler to put png_deleter into scope.
+ if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ png_uint_32 width, height;
+ int bit_depth, color_type, interlace_type, compression_type;
+ int filter_type;
+
+ if (!png_get_IHDR(png_handler.png_ptr, png_handler.info_ptr, &width,
+ &height, &bit_depth, &color_type, &interlace_type,
+ &compression_type, &filter_type)) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ // This is going to be too slow.
+ if (width && height > 100000000 / width) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ int passes = png_set_interlace_handling(png_handler.png_ptr);
+ png_start_read_image(png_handler.png_ptr);
+
+ for (int pass = 0; pass < passes; ++pass) {
+ for (png_uint_32 y = 0; y < height; ++y) {
+ png_read_row(png_handler.png_ptr,
+ static_cast<png_bytep>(png_handler.row_ptr), nullptr);
+ }
+ }
+
+ PNG_CLEANUP
+ return 0;
+}
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.options b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.options
new file mode 100644
index 00000000000..2005291a0f7
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.options
@@ -0,0 +1,2 @@
+[libfuzzer]
+dict = png.dict
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/png.dict b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/png.dict
new file mode 100644
index 00000000000..3a8a113830f
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/png.dict
@@ -0,0 +1,39 @@
+#
+# AFL dictionary for PNG images
+# -----------------------------
+#
+# Just the basic, standard-originating sections; does not include vendor
+# extensions.
+#
+# Created by Michal Zalewski <lcamtuf@google.com>
+#
+
+header_png="\x89PNG\x0d\x0a\x1a\x0a"
+
+section_IDAT="IDAT"
+section_IEND="IEND"
+section_IHDR="IHDR"
+section_PLTE="PLTE"
+section_bKGD="bKGD"
+section_cHRM="cHRM"
+section_eXIf="eXIf"
+section_fRAc="fRAc"
+section_gAMA="gAMA"
+section_gIFg="gIFg"
+section_gIFt="gIFt"
+section_gIFx="gIFx"
+section_hIST="hIST"
+section_iCCP="iCCP"
+section_iTXt="iTXt"
+section_oFFs="oFFs"
+section_pCAL="pCAL"
+section_pHYs="pHYs"
+section_sBIT="sBIT"
+section_sCAL="sCAL"
+section_sPLT="sPLT"
+section_sRGB="sRGB"
+section_sTER="sTER"
+section_tEXt="tEXt"
+section_tIME="tIME"
+section_tRNS="tRNS"
+section_zTXt="zTXt"
diff --git a/Build/source/libs/libpng/libpng-src/contrib/pngminus/png2pnm.c b/Build/source/libs/libpng/libpng-src/contrib/pngminus/png2pnm.c
index c9f16237d98..39a9f4673c0 100644
--- a/Build/source/libs/libpng/libpng-src/contrib/pngminus/png2pnm.c
+++ b/Build/source/libs/libpng/libpng-src/contrib/pngminus/png2pnm.c
@@ -1,9 +1,11 @@
/*
* png2pnm.c --- conversion from PNG-file to PGM/PPM-file
- * copyright (C) 1999 by Willem van Schaik <willem at schaik.com>
+ * copyright (C) 1999,2017 by Willem van Schaik <willem at schaik.com>
*
* version 1.0 - 1999.10.15 - First version.
* 1.1 - 2017.04.22 - Add buffer-size check (Glenn Randers-Pehrson)
+ * 1.2 - 2017.08.24 - Fix potential overflow in buffer-size check
+ (Glenn Randers-Pehrson)
*
* Permission to use, copy, modify, and distribute this software and
* its documentation for any purpose and without fee is hereby granted,
@@ -321,18 +323,21 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file,
/* row_bytes is the width x number of channels x (bit-depth / 8) */
row_bytes = png_get_rowbytes (png_ptr, info_ptr);
- if (height > ((size_t)(-1))/row_bytes) /* too big */ {
+ if ((row_bytes == 0 || (size_t)height > ((size_t)(-1))/(size_t)row_bytes))
+ {
+ /* too big */
png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
return FALSE;
}
if ((png_pixels = (png_byte *)
- malloc (row_bytes * height * sizeof (png_byte))) == NULL) {
+ malloc ((size_t)row_bytes * (size_t)height * sizeof (png_byte))) == NULL)
+ {
png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
return FALSE;
}
if ((row_pointers = (png_byte **)
- malloc (height * sizeof (png_bytep))) == NULL)
+ malloc ((size_t)height * sizeof (png_bytep))) == NULL)
{
png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
free (png_pixels);
@@ -413,7 +418,8 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file,
if (raw)
fputc ((int) *pix_ptr++ , alpha_file);
else
- if (bit_depth == 16){
+ if (bit_depth == 16)
+ {
dep_16 = (long) *pix_ptr++;
fprintf (alpha_file, "%ld ", (dep_16 << 8) + (long) *pix_ptr++);
}
@@ -437,6 +443,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file,
if (png_pixels != (unsigned char*) NULL)
free (png_pixels);
+ PNG_UNUSED(raw) /* to quiet a Coverity defect */
return TRUE;
} /* end of source */
diff --git a/Build/source/libs/libpng/libpng-src/contrib/pngminus/pnm2png.c b/Build/source/libs/libpng/libpng-src/contrib/pngminus/pnm2png.c
index adc32069d05..1b550b8cf82 100644
--- a/Build/source/libs/libpng/libpng-src/contrib/pngminus/pnm2png.c
+++ b/Build/source/libs/libpng/libpng-src/contrib/pngminus/pnm2png.c
@@ -1,10 +1,12 @@
/*
* pnm2png.c --- conversion from PBM/PGM/PPM-file to PNG-file
- * copyright (C) 1999 by Willem van Schaik <willem at schaik.com>
+ * copyright (C) 1999,2015,2017 by Willem van Schaik <willem at schaik.com>
*
* version 1.0 - 1999.10.15 - First version.
* version 1.1 - 2015.07.29 - Fixed leaks (Glenn Randers-Pehrson)
* version 1.2 - 2017.04.22 - Add buffer-size check
+ * 1.3 - 2017.08.24 - Fix potential overflow in buffer-size check
+ * (Glenn Randers-Pehrson)
*
* Permission to use, copy, modify, and distribute this software and
* its documentation for any purpose and without fee is hereby granted,
@@ -371,10 +373,12 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
row_bytes = (width * channels * bit_depth + 7) / 8;
else
#endif
- /* row_bytes is the width x number of channels x (bit-depth / 8) */
+ /* row_bytes is the width x number of channels x (bit-depth / 8) */
row_bytes = width * channels * ((bit_depth <= 8) ? 1 : 2);
- if (height > ((size_t)(-1))/row_bytes) /* too big */ {
+ if ((row_bytes == 0 || (size_t)height > ((size_t)(-1))/(size_t)row_bytes)
+ {
+ /* too big */
return FALSE;
}
if ((png_pixels = (png_byte *)
@@ -387,7 +391,8 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
for (row = 0; row < (int) height; row++)
{
#if defined(PNG_WRITE_INVERT_SUPPORTED) || defined(PNG_WRITE_PACK_SUPPORTED)
- if (packed_bitmap) {
+ if (packed_bitmap)
+ {
for (i = 0; i < (int) row_bytes; i++)
/* png supports this format natively so no conversion is needed */
*pix_ptr++ = get_data (pnm_file, 8);
@@ -508,6 +513,8 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
if (png_pixels != (unsigned char*) NULL)
free (png_pixels);
+ PNG_UNUSED(raw) /* Quiet a Coverity defect */
+
return TRUE;
} /* end of pnm2png */
@@ -524,7 +531,8 @@ void get_token(FILE *pnm_file, char *token)
do
{
ret = fgetc(pnm_file);
- if (ret == '#') {
+ if (ret == '#')
+ {
/* the rest of this line is a comment */
do
{
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/bad_iCCP.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/bad_iCCP.png
new file mode 100644
index 00000000000..0b7b863795a
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/bad_iCCP.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/badadler.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/badadler.png
new file mode 100644
index 00000000000..2bcbcc926ab
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/badadler.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/badcrc.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/badcrc.png
new file mode 100644
index 00000000000..45d02680454
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/badcrc.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/empty_ancillary_chunks.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/empty_ancillary_chunks.png
new file mode 100644
index 00000000000..d76477c6a86
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/empty_ancillary_chunks.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_IDAT.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_IDAT.png
new file mode 100644
index 00000000000..efee66cf369
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_IDAT.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_bKGD_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_bKGD_chunk.png
new file mode 100644
index 00000000000..fd571fd2c93
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_bKGD_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_cHRM_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_cHRM_chunk.png
new file mode 100644
index 00000000000..698e7c46dd7
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_cHRM_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_eXIf_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_eXIf_chunk.png
new file mode 100644
index 00000000000..7d416019668
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_eXIf_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_gAMA_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_gAMA_chunk.png
new file mode 100644
index 00000000000..b089c185971
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_gAMA_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_hIST_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_hIST_chunk.png
new file mode 100644
index 00000000000..6d6fcb53343
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_hIST_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_iCCP_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_iCCP_chunk.png
new file mode 100644
index 00000000000..fbcb7615395
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_iCCP_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_iTXt_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_iTXt_chunk.png
new file mode 100644
index 00000000000..098262017ef
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_iTXt_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_juNK_unsafe_to_copy.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_juNK_unsafe_to_copy.png
new file mode 100644
index 00000000000..0cb106f4a2b
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_juNK_unsafe_to_copy.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_juNk_safe_to_copy.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_juNk_safe_to_copy.png
new file mode 100644
index 00000000000..85252b7dc54
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_juNk_safe_to_copy.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_pCAL_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_pCAL_chunk.png
new file mode 100644
index 00000000000..bc12a8f2473
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_pCAL_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_pHYs_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_pHYs_chunk.png
new file mode 100644
index 00000000000..343b977e9df
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_pHYs_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sCAL_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sCAL_chunk.png
new file mode 100644
index 00000000000..61f2f824d1c
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sCAL_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sPLT_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sPLT_chunk.png
new file mode 100644
index 00000000000..75d383a2e47
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sPLT_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sRGB_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sRGB_chunk.png
new file mode 100644
index 00000000000..bc1db336308
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sRGB_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sTER_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sTER_chunk.png
new file mode 100644
index 00000000000..39219fed73f
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_sTER_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_tEXt_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_tEXt_chunk.png
new file mode 100644
index 00000000000..947fc373e41
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_tEXt_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_tIME_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_tIME_chunk.png
new file mode 100644
index 00000000000..16452fba26e
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_tIME_chunk.png
Binary files differ
diff --git a/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_zTXt_chunk.png b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_zTXt_chunk.png
new file mode 100644
index 00000000000..52f09530894
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/testpngs/crashers/huge_zTXt_chunk.png
Binary files differ