101 lines
3.3 KiB
Diff
101 lines
3.3 KiB
Diff
diff --git a/pngrutil.c b/pngrutil.c
|
|
index 8f8edbc..5ca4dcb 100644
|
|
--- a/pngrutil.c
|
|
+++ b/pngrutil.c
|
|
@@ -866,7 +866,7 @@ void /* PRIVATE */
|
|
png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
|
|
{
|
|
png_color palette[PNG_MAX_PALETTE_LENGTH];
|
|
- int num, i;
|
|
+ int max_palette_length, num, i;
|
|
#ifdef PNG_POINTER_INDEXING_SUPPORTED
|
|
png_colorp pal_ptr;
|
|
#endif
|
|
@@ -927,6 +927,14 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
|
|
/* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */
|
|
num = (int)length / 3;
|
|
|
|
+ if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
|
|
+ max_palette_length = (1 << png_ptr->bit_depth);
|
|
+ else
|
|
+ max_palette_length = PNG_MAX_PALETTE_LENGTH;
|
|
+
|
|
+ if (num > max_palette_length)
|
|
+ num = max_palette_length;
|
|
+
|
|
#ifdef PNG_POINTER_INDEXING_SUPPORTED
|
|
for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
|
|
{
|
|
@@ -959,7 +967,7 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
|
|
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
|
|
#endif
|
|
{
|
|
- png_crc_finish(png_ptr, 0);
|
|
+ png_crc_finish(png_ptr, (int) length - num * 3);
|
|
}
|
|
|
|
#ifndef PNG_READ_OPT_PLTE_SUPPORTED
|
|
diff --git a/pngset.c b/pngset.c
|
|
index 5f62af1..42e0dc2 100644
|
|
--- a/pngset.c
|
|
+++ b/pngset.c
|
|
@@ -513,12 +513,17 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
|
|
png_const_colorp palette, int num_palette)
|
|
{
|
|
|
|
+ png_uint_32 max_palette_length;
|
|
+
|
|
png_debug1(1, "in %s storage function", "PLTE");
|
|
|
|
if (png_ptr == NULL || info_ptr == NULL)
|
|
return;
|
|
|
|
- if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH)
|
|
+ max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
|
|
+ (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
|
|
+
|
|
+ if (num_palette < 0 || num_palette > (int) max_palette_length)
|
|
{
|
|
if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
|
|
png_error(png_ptr, "Invalid palette length");
|
|
diff --git a/pngwrite.c b/pngwrite.c
|
|
index 3c8cbbe..39ef69e 100644
|
|
--- a/pngwrite.c
|
|
+++ b/pngwrite.c
|
|
@@ -206,7 +206,7 @@ png_write_info(png_structrp png_ptr, png_const_inforp info_ptr)
|
|
png_write_PLTE(png_ptr, info_ptr->palette,
|
|
(png_uint_32)info_ptr->num_palette);
|
|
|
|
- else if ((info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) !=0)
|
|
+ else if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
|
|
png_error(png_ptr, "Valid palette required for paletted images");
|
|
|
|
#ifdef PNG_WRITE_tRNS_SUPPORTED
|
|
diff --git a/pngwutil.c b/pngwutil.c
|
|
index 9e6019e..01be584 100644
|
|
--- a/pngwutil.c
|
|
+++ b/pngwutil.c
|
|
@@ -922,17 +922,20 @@ void /* PRIVATE */
|
|
png_write_PLTE(png_structrp png_ptr, png_const_colorp palette,
|
|
png_uint_32 num_pal)
|
|
{
|
|
- png_uint_32 i;
|
|
+ png_uint_32 max_palette_length, i;
|
|
png_const_colorp pal_ptr;
|
|
png_byte buf[3];
|
|
|
|
png_debug(1, "in png_write_PLTE");
|
|
|
|
+ max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
|
|
+ (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
|
|
+
|
|
if ((
|
|
#ifdef PNG_MNG_FEATURES_SUPPORTED
|
|
(png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0 &&
|
|
#endif
|
|
- num_pal == 0) || num_pal > 256)
|
|
+ num_pal == 0) || num_pal > max_palette_length)
|
|
{
|
|
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
|
|
{
|