Imported from libpng-1.0.11beta3.tar
diff --git a/pngrutil.c b/pngrutil.c
index 5b9b745..522af2a 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,7 +1,7 @@
/* pngrutil.c - utilities to read a PNG file
*
- * libpng 1.0.11beta2 - April 11, 2001
+ * libpng 1.0.11beta3 - April 15, 2001
* For conditions of distribution and use, see copyright notice in png.h
* Copyright (c) 1998-2001 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -201,15 +201,19 @@
{
text_size = prefix_size + sizeof(msg) + 1;
text = (png_charp)png_malloc(png_ptr, text_size);
- png_memcpy(text, chunkdata, prefix_size);
+ if (text != NULL)
+ png_memcpy(text, chunkdata, prefix_size);
}
- text[text_size - 1] = 0x00;
+ if (text != NULL)
+ {
+ text[text_size - 1] = 0x00;
- /* Copy what we can of the error message into the text chunk */
- text_size = (png_size_t)(chunklength - (text - chunkdata) - 1);
- text_size = sizeof(msg) > text_size ? text_size : sizeof(msg);
- png_memcpy(text + prefix_size, msg, text_size + 1);
+ /* Copy what we can of the error message into the text chunk */
+ text_size = (png_size_t)(chunklength - (text - chunkdata) - 1);
+ text_size = sizeof(msg) > text_size ? text_size : sizeof(msg);
+ png_memcpy(text + prefix_size, msg, text_size + 1);
+ }
break;
}
if (!png_ptr->zstream.avail_out || ret == Z_STREAM_END)
@@ -219,10 +223,13 @@
text_size = prefix_size +
png_ptr->zbuf_size - png_ptr->zstream.avail_out;
text = (png_charp)png_malloc(png_ptr, text_size + 1);
- png_memcpy(text + prefix_size, png_ptr->zbuf,
+ if (text != NULL)
+ {
+ png_memcpy(text + prefix_size, png_ptr->zbuf,
text_size - prefix_size);
- png_memcpy(text, chunkdata, prefix_size);
- *(text + text_size) = 0x00;
+ png_memcpy(text, chunkdata, prefix_size);
+ *(text + text_size) = 0x00;
+ }
}
else
{
@@ -231,12 +238,20 @@
tmp = text;
text = (png_charp)png_malloc(png_ptr, (png_uint_32)(text_size +
png_ptr->zbuf_size - png_ptr->zstream.avail_out + 1));
+ if (text != NULL)
+ {
png_memcpy(text, tmp, text_size);
png_free(png_ptr, tmp);
png_memcpy(text + text_size, png_ptr->zbuf,
(png_ptr->zbuf_size - png_ptr->zstream.avail_out));
text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
*(text + text_size) = 0x00;
+ }
+ else
+ {
+ png_warning (png_ptr, "Could not malloc text buffer");
+ text=tmp;
+ }
}
if (ret == Z_STREAM_END)
break;
@@ -270,9 +285,13 @@
if (text == NULL)
{
text = (png_charp)png_malloc(png_ptr, text_size+1);
- png_memcpy(text, chunkdata, prefix_size);
+ if (text != NULL)
+ png_memcpy(text, chunkdata, prefix_size);
+ else
+ png_warning(png_ptr, "Could not malloc text chunkdata");
}
- *(text + text_size) = 0x00;
+ if (text != NULL)
+ *(text + text_size) = 0x00;
}
inflateReset(&png_ptr->zstream);
@@ -983,7 +1002,14 @@
chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
slength = (png_size_t)length;
- png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+ if (chunkdata != (png_charp)NULL)
+ png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+ else
+ {
+ png_warning(png_ptr, "Could not allocate memory for iCCP chunk");
+ png_crc_finish(png_ptr, slength);
+ return;
+ }
if (png_crc_finish(png_ptr, skip))
{
@@ -1079,8 +1105,16 @@
#endif
chunkdata = (png_bytep)png_malloc(png_ptr, length + 1);
- slength = (png_size_t)length;
- png_crc_read(png_ptr, chunkdata, slength);
+ if (chunkdata != (png_bytep)NULL)
+ {
+ slength = (png_size_t)length;
+ png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+ }
+ else
+ {
+ png_warning(png_ptr, "Could not allocate memory for sPLT chunk");
+ skip = (png_size_t)length;
+ }
if (png_crc_finish(png_ptr, skip))
{
@@ -1110,12 +1144,19 @@
if (data_length % entry_size)
{
png_free(png_ptr, chunkdata);
- png_error(png_ptr, "sPLT chunk has bad length");
+ png_warning(png_ptr, "sPLT chunk has bad length");
+ return;
}
new_palette.nentries = data_length / entry_size;
new_palette.entries = (png_sPLT_entryp)png_malloc(
png_ptr, new_palette.nentries * sizeof(png_sPLT_entry));
+ if (new_palette.entries == (png_sPLT_entryp)NULL)
+ {
+ png_free(png_ptr, chunkdata);
+ png_warning (png_ptr, "Could not allocate sPLT entries");
+ return;
+ }
#ifndef PNG_NO_POINTER_INDEXING
for (i = 0; i < new_palette.nentries; i++)
@@ -1525,6 +1566,12 @@
png_debug1(2, "Allocating and reading pCAL chunk data (%lu bytes)\n",
length + 1);
purpose = (png_charp)png_malloc(png_ptr, length + 1);
+ if (purpose == (png_charp)NULL)
+ {
+ png_warning (png_ptr, "Could not allocate memory for pCAL purpose");
+ png_crc_finish(png_ptr, length);
+ return;
+ }
slength = (png_size_t)length;
png_crc_read(png_ptr, (png_bytep)purpose, slength);
@@ -1581,6 +1628,11 @@
png_debug(3, "Allocating pCAL parameters array\n");
params = (png_charpp)png_malloc(png_ptr, (png_uint_32)(nparams
*sizeof(png_charp))) ;
+ if (params == (png_charpp)NULL)
+ {
+ png_warning (png_ptr, "Could not allocate pCAL parameters array");
+ nparams=0;
+ }
/* Get pointers to the start of each parameter string. */
for (i = 0; i < (int)nparams; i++)
@@ -1645,6 +1697,12 @@
png_debug1(2, "Allocating and reading sCAL chunk data (%lu bytes)\n",
length + 1);
buffer = (png_charp)png_malloc(png_ptr, length + 1);
+ if (buffer == (png_charp)NULL)
+ {
+ png_warning (png_ptr, "Could not allocate memory for sCAL buffer");
+ png_crc_finish(png_ptr, length);
+ return;
+ }
slength = (png_size_t)length;
png_crc_read(png_ptr, (png_bytep)buffer, slength);
@@ -1668,7 +1726,8 @@
#else
#ifdef PNG_FIXED_POINT_SUPPORTED
swidth = (png_charp)png_malloc(png_ptr, png_strlen(ep) + 1);
- png_memcpy(swidth, ep, (png_size_t)png_strlen(ep));
+ if (swidth != (png_charp)NULL)
+ png_memcpy(swidth, ep, (png_size_t)png_strlen(ep));
#endif
#endif
@@ -1686,7 +1745,8 @@
#else
#ifdef PNG_FIXED_POINT_SUPPORTED
sheight = (png_charp)png_malloc(png_ptr, png_strlen(ep) + 1);
- png_memcpy(sheight, ep, (png_size_t)png_strlen(ep));
+ if (sheight != (png_charp)NULL)
+ png_memcpy(sheight, ep, (png_size_t)png_strlen(ep));
#endif
#endif
@@ -1795,7 +1855,14 @@
key = (png_charp)png_malloc(png_ptr, length + 1);
slength = (png_size_t)length;
- png_crc_read(png_ptr, (png_bytep)key, slength);
+ if (key == (png_charp)NULL)
+ {
+ png_warning (png_ptr, "Could not allocate memory for tEXt chunk");
+ png_crc_finish(png_ptr, slength);
+ return;
+ }
+ else
+ png_crc_read(png_ptr, (png_bytep)key, slength);
if (png_crc_finish(png_ptr, skip))
{
@@ -1812,6 +1879,8 @@
text++;
text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
+ if (text_ptr != (png_textp)NULL)
+ {
text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
text_ptr->key = key;
#ifdef PNG_iTXt_SUPPORTED
@@ -1824,8 +1893,11 @@
png_set_text(png_ptr, info_ptr, text_ptr, 1);
- png_free(png_ptr, key);
png_free(png_ptr, text_ptr);
+ }
+ else
+ png_warning(png_ptr, "Could not allocate iTXt pointer");
+ png_free(png_ptr, key);
}
#endif
@@ -1859,8 +1931,17 @@
#endif
chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
- slength = (png_size_t)length;
- png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+ if (chunkdata != (png_charp)NULL)
+ {
+ slength = (png_size_t)length;
+ png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+ }
+ else
+ {
+ png_warning (png_ptr, "Could not allocate memory for zTXt chunk data");
+ png_crc_finish(png_ptr, length);
+ return;
+ }
if (png_crc_finish(png_ptr, 0))
{
png_free(png_ptr, chunkdata);
@@ -1894,19 +1975,24 @@
(png_size_t)length, prefix_len, &data_len);
text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
- text_ptr->compression = comp_type;
- text_ptr->key = chunkdata;
+ if (text_ptr != (png_textp)NULL)
+ {
+ text_ptr->compression = comp_type;
+ text_ptr->key = chunkdata;
#ifdef PNG_iTXt_SUPPORTED
- text_ptr->lang = NULL;
- text_ptr->lang_key = NULL;
- text_ptr->itxt_length = 0;
+ text_ptr->lang = NULL;
+ text_ptr->lang_key = NULL;
+ text_ptr->itxt_length = 0;
#endif
- text_ptr->text = chunkdata + prefix_len;
- text_ptr->text_length = data_len;
+ text_ptr->text = chunkdata + prefix_len;
+ text_ptr->text_length = data_len;
- png_set_text(png_ptr, info_ptr, text_ptr, 1);
+ png_set_text(png_ptr, info_ptr, text_ptr, 1);
- png_free(png_ptr, text_ptr);
+ png_free(png_ptr, text_ptr);
+ }
+ else
+ png_warning (png_ptr, "Could not allocate memory for zTXt data");
png_free(png_ptr, chunkdata);
}
#endif
@@ -1943,8 +2029,17 @@
#endif
chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
- slength = (png_size_t)length;
- png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+ if (chunkdata != (png_charp)NULL)
+ {
+ slength = (png_size_t)length;
+ png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
+ }
+ else
+ {
+ png_warning (png_ptr, "Could not allocate memory for iTXt chunk data");
+ png_crc_finish(png_ptr, length);
+ return;
+ }
if (png_crc_finish(png_ptr, 0))
{
png_free(png_ptr, chunkdata);
@@ -1989,17 +2084,22 @@
else
data_len=png_strlen(chunkdata + prefix_len);
text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
- text_ptr->compression = (int)comp_flag + 1;
- text_ptr->lang_key = chunkdata+(lang_key-key);
- text_ptr->lang = chunkdata+(lang-key);
- text_ptr->itxt_length = data_len;
- text_ptr->text_length = 0;
- text_ptr->key = chunkdata;
- text_ptr->text = chunkdata + prefix_len;
+ if (text_ptr != (png_textp)NULL)
+ {
+ text_ptr->compression = (int)comp_flag + 1;
+ text_ptr->lang_key = chunkdata+(lang_key-key);
+ text_ptr->lang = chunkdata+(lang-key);
+ text_ptr->itxt_length = data_len;
+ text_ptr->text_length = 0;
+ text_ptr->key = chunkdata;
+ text_ptr->text = chunkdata + prefix_len;
- png_set_text(png_ptr, info_ptr, text_ptr, 1);
+ png_set_text(png_ptr, info_ptr, text_ptr, 1);
- png_free(png_ptr, text_ptr);
+ png_free(png_ptr, text_ptr);
+ }
+ else
+ png_warning (png_ptr, "Could not allocate memory for iTXt chunk data");
png_free(png_ptr, chunkdata);
}
#endif
@@ -2055,8 +2155,17 @@
#endif
png_strcpy((png_charp)chunk.name, (png_charp)png_ptr->chunk_name);
chunk.data = (png_bytep)png_malloc(png_ptr, length);
- png_crc_read(png_ptr, chunk.data, length);
- chunk.size = length;
+ if (chunk.data != (png_bytep)NULL)
+ {
+ chunk.size = (png_size_t)length;
+ png_crc_read(png_ptr, (png_bytep)chunk.data, length);
+ }
+ else
+ {
+ png_warning (png_ptr, "Could not allocate memory for iTXt chunk data");
+ png_crc_finish(png_ptr, length);
+ return;
+ }
#if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
if(png_ptr->read_user_chunk_fn != (png_user_chunk_ptr)NULL)
{
@@ -2963,6 +3072,8 @@
png_error(png_ptr, "This image requires a row greater than 64KB");
#endif
png_ptr->row_buf = (png_bytep)png_malloc(png_ptr, row_bytes);
+ if (png_ptr->row_buf == (png_bytep)NULL)
+ png_error (png_ptr, "Could not allocate memory for row buffer");
png_ptr->row_buf_size = row_bytes;
#ifdef PNG_MAX_MALLOC_64K
@@ -2971,6 +3082,11 @@
#endif
png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)(
png_ptr->rowbytes + 1));
+ if (png_ptr->prev_row == (png_bytep)NULL)
+ {
+ png_free (png_ptr, png_ptr->row_buf);
+ png_error (png_ptr, "Could not allocate memory for previous row buffer");
+ }
png_memset_check(png_ptr, png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
