Imported from libpng-0.99c.tar
diff --git a/pngpread.c b/pngpread.c
index 647ad10..89d9226 100644
--- a/pngpread.c
+++ b/pngpread.c
@@ -1,12 +1,12 @@
/* pngpread.c - read a png file in push mode
*
- * libpng 0.99a
+ * libpng 0.99c
* For conditions of distribution and use, see copyright notice in png.h
* Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.
* Copyright (c) 1996, 1997 Andreas Dilger
* Copyright (c) 1998, Glenn Randers-Pehrson
- * January 31, 1998
+ * February 7, 1998
*/
#define PNG_INTERNAL
@@ -466,7 +466,8 @@
new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
old_buffer = png_ptr->save_buffer;
- png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, new_max);
+ png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr,
+ (png_uint_32)new_max);
png_memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
png_free(png_ptr, old_buffer);
png_ptr->save_buffer_max = new_max;
@@ -527,7 +528,12 @@
png_size_t save_size;
if (png_ptr->idat_size < (png_uint_32)png_ptr->save_buffer_size)
- save_size = png_ptr->idat_size;
+ {
+ save_size = (png_size_t)png_ptr->idat_size;
+ /* check for overflow */
+ if((png_uint_32)save_size != png_ptr->idat_size)
+ png_error(png_ptr, "save_size overflowed in pngpread");
+ }
else
save_size = png_ptr->save_buffer_size;
@@ -544,7 +550,12 @@
png_size_t save_size;
if (png_ptr->idat_size < (png_uint_32)png_ptr->current_buffer_size)
- save_size = png_ptr->idat_size;
+ {
+ save_size = (png_size_t)png_ptr->idat_size;
+ /* check for overflow */
+ if((png_uint_32)save_size != png_ptr->idat_size)
+ png_error(png_ptr, "save_size overflowed in pngpread");
+ }
else
save_size = png_ptr->current_buffer_size;
@@ -619,6 +630,7 @@
png_ptr->row_info.channels = png_ptr->channels;
png_ptr->row_info.bit_depth = png_ptr->bit_depth;
png_ptr->row_info.pixel_depth = png_ptr->pixel_depth;
+
png_ptr->row_info.rowbytes = ((png_ptr->row_info.width *
(png_uint_32)png_ptr->row_info.pixel_depth + 7) >> 3);
@@ -626,7 +638,8 @@
png_ptr->row_buf + 1, png_ptr->prev_row + 1,
(int)(png_ptr->row_buf[0]));
- png_memcpy(png_ptr->prev_row, png_ptr->row_buf, png_ptr->rowbytes + 1);
+ png_buffered_memcpy(png_ptr, png_ptr->prev_row, png_ptr->row_buf,
+ png_ptr->rowbytes + 1);
if (png_ptr->transformations)
png_do_read_transformations(png_ptr);
@@ -761,7 +774,8 @@
if (png_ptr->interlaced)
{
png_ptr->row_number = 0;
- png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
+ png_buffered_memset(png_ptr, png_ptr->prev_row, 0,
+ (png_size_t)png_ptr->rowbytes + 1);
do
{
png_ptr->pass++;
@@ -771,8 +785,7 @@
png_pass_inc[png_ptr->pass] - 1 -
png_pass_start[png_ptr->pass]) /
png_pass_inc[png_ptr->pass];
- png_ptr->irowbytes = ((png_ptr->iwidth *
- png_ptr->pixel_depth + 7) >> 3) + 1;
+ png_ptr->irowbytes = ((png_ptr->pixel_depth + 7) >> 3) + 1;
if (!(png_ptr->transformations & PNG_INTERLACE))
{
png_ptr->num_rows = (png_ptr->height +
@@ -806,11 +819,12 @@
}
#endif
- png_ptr->current_text = (png_charp)png_malloc(png_ptr, length+1);
+ png_ptr->current_text = (png_charp)png_malloc(png_ptr,
+ (png_uint_32)(length+1));
png_ptr->current_text[length] = '\0';
png_ptr->current_text_ptr = png_ptr->current_text;
- png_ptr->current_text_size = length;
- png_ptr->current_text_left = length;
+ png_ptr->current_text_size = (png_size_t)length;
+ png_ptr->current_text_left = (png_size_t)length;
png_ptr->process_mode = PNG_READ_tEXt_MODE;
}
@@ -857,7 +871,7 @@
if (text != key + png_ptr->current_text_size)
text++;
- text_ptr = (png_textp)png_malloc(png_ptr, sizeof(png_text));
+ text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
text_ptr->key = key;
text_ptr->text = text;
@@ -889,11 +903,12 @@
}
#endif
- png_ptr->current_text = (png_charp)png_malloc(png_ptr, length+1);
+ png_ptr->current_text = (png_charp)png_malloc(png_ptr,
+ (png_uint_32)(length+1));
png_ptr->current_text[length] = '\0';
png_ptr->current_text_ptr = png_ptr->current_text;
- png_ptr->current_text_size = length;
- png_ptr->current_text_left = length;
+ png_ptr->current_text_size = (png_size_t)length;
+ png_ptr->current_text_left = (png_size_t)length;
png_ptr->process_mode = PNG_READ_zTXt_MODE;
}
@@ -978,8 +993,8 @@
if (text == NULL)
{
text = (png_charp)png_malloc(png_ptr,
- png_ptr->zbuf_size - png_ptr->zstream.avail_out +
- key_size + 1);
+ (png_uint_32)(png_ptr->zbuf_size - png_ptr->zstream.avail_out +
+ key_size + 1));
png_memcpy(text + key_size, png_ptr->zbuf,
png_ptr->zbuf_size - png_ptr->zstream.avail_out);
png_memcpy(text, key, key_size);
@@ -993,7 +1008,8 @@
tmp = text;
text = (png_charp)png_malloc(png_ptr, text_size +
- png_ptr->zbuf_size - png_ptr->zstream.avail_out + 1);
+ (png_uint_32)(png_ptr->zbuf_size - png_ptr->zstream.avail_out
+ + 1));
png_memcpy(text, tmp, text_size);
png_free(png_ptr, tmp);
png_memcpy(text + text_size, png_ptr->zbuf,
@@ -1029,9 +1045,8 @@
png_free(png_ptr, key);
key = text;
text += key_size;
- text_size -= key_size;
- text_ptr = (png_textp)png_malloc(png_ptr, sizeof(png_text));
+ text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
text_ptr->key = key;
text_ptr->text = text;
