[libpng16] Fix potential problem with bKGD (Cosmin Truta)
diff --git a/pngrutil.c b/pngrutil.c
index 2b6645b..fafe78f 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,8 +1,8 @@
/* pngrutil.c - utilities to read a PNG file
*
- * Last changed in libpng 1.6.33 [September 28, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
@@ -1997,6 +1997,15 @@
else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) /* GRAY */
{
+ if (png_ptr->bit_depth <= 8)
+ {
+ if (buf[0] != 0 || buf[1] >= (unsigned int)(1 << png_ptr->bit_depth))
+ {
+ png_chunk_benign_error(png_ptr, "invalid gray level");
+ return;
+ }
+ }
+
background.index = 0;
background.red =
background.green =
@@ -2006,6 +2015,15 @@
else
{
+ if (png_ptr->bit_depth <= 8)
+ {
+ if (buf[0] != 0 || buf[2] != 0 || buf[4] != 0)
+ {
+ png_chunk_benign_error(png_ptr, "invalid color");
+ return;
+ }
+ }
+
background.index = 0;
background.red = png_get_uint_16(buf);
background.green = png_get_uint_16(buf + 2);
