commit f5dcba6b9bcd0495c544daea73e64bebfbe08faf
author Glenn Randers-Pehrson <glennrp@shaggy.simplesystems.org> Sat Mar 17 00:21:45 2012 -0500
committer Glenn Randers-Pehrson <glennrp@shaggy.simplesystems.org> Sat Mar 17 00:21:45 2012 -0500
tree ae25b49c69ee609ef08a4e8ad5048487822cfc8e
parent c26d6e9aac5681aa00024d223cc0033f6dbb3a2d

[libpng16] Never mind, undid previous change.

ANNOUNCE

diff --git a/ANNOUNCE b/ANNOUNCE
index 8466ba4..40d92e3 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -319,7 +319,6 @@
     this is disabled in which case the simplified API can't be built.)
 
 Version 1.6.0beta19 [March 17, 2012]
-  Revised png_set_text_2() to avoid potential memory corruption.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit

CHANGES

diff --git a/CHANGES b/CHANGES
index ccd9051..cf990b8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4070,7 +4070,6 @@
     this is disabled in which case the simplified API can't be built.)
 
 Version 1.6.0beta19 [March 17, 2012]
-  Revised png_set_text_2() to avoid potential memory corruption.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit

pngset.c

diff --git a/pngset.c b/pngset.c
index 6b74d94..bde866f 100644
--- a/pngset.c
+++ b/pngset.c
@@ -706,28 +706,24 @@
     */
    if (info_ptr->num_text + num_text > info_ptr->max_text)
    {
-      int old_max_text = info_ptr->max_text;
-      int old_num_text = info_ptr->num_text;
-
       if (info_ptr->text != NULL)
       {
          png_textp old_text;
+         int old_max;
 
+         old_max = info_ptr->max_text;
          info_ptr->max_text = info_ptr->num_text + num_text + 8;
          old_text = info_ptr->text;
-
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
 
          if (info_ptr->text == NULL)
          {
-            /* Restore to previous condition */
-            info_ptr->max_text = old_max_text;
-            info_ptr->text = old_text;
+            png_free(png_ptr, old_text);
             return(1);
          }
 
-         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max_text *
+         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max *
              png_sizeof(png_text)));
          png_free(png_ptr, old_text);
       }
@@ -739,12 +735,7 @@
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
              (png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
-         {
-            /* Restore to previous condition */
-            info_ptr->num_text = old_num_text;
-            info_ptr->max_text = old_max_text;
             return(1);
-         }
          info_ptr->free_me |= PNG_FREE_TEXT;
       }