Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 154996 - PNGs with invalid IHDR can crash/hang browser. rs=tor

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@124357 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
tor%cs.brown.edu
2002-06-29 20:11:33 +00:00
parent ef9b5e0a82
commit bddfd612b4
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
mozilla/modules/libimg/png/MOZCHANGES
View File

@@ -14,3 +14,6 @@ Bug 81794 - crash/leak fix for pngrutil.c
Bug 135579 - small interlaced PNG images not decoded correctly.
Affected files: pngpread.c
Bug 154996 - PNG files with invalid IHDR can crash/hand browser.
Affected files: pngpread.c

7
mozilla/modules/libimg/png/pngpread.c
View File

@@ -736,6 +736,13 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
}
if (!(png_ptr->zstream.avail_out))
{
if ((
#if defined(PNG_READ_INTERLACING_SUPPORTED)
png_ptr->interlaced && png_ptr->pass > 6) ||
(!png_ptr->interlaced &&
#endif
png_ptr->row_number == png_ptr->num_rows-1))
png_error(png_ptr, "Too much data in IDAT chunks");
png_push_process_row(png_ptr);
png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
png_ptr->zstream.next_out = png_ptr->row_buf;