From bddfd612b40decccfedc57cb84810c30eeab993c Mon Sep 17 00:00:00 2001 From: "tor%cs.brown.edu" Date: Sat, 29 Jun 2002 20:11:33 +0000 Subject: [PATCH] Bug 154996 - PNGs with invalid IHDR can crash/hang browser. rs=tor git-svn-id: svn://10.0.0.236/trunk@124357 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/modules/libimg/png/MOZCHANGES | 3 +++ mozilla/modules/libimg/png/pngpread.c | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/mozilla/modules/libimg/png/MOZCHANGES b/mozilla/modules/libimg/png/MOZCHANGES index 8d2254f91a8..b4d122e15d5 100644 --- a/mozilla/modules/libimg/png/MOZCHANGES +++ b/mozilla/modules/libimg/png/MOZCHANGES @@ -14,3 +14,6 @@ Bug 81794 - crash/leak fix for pngrutil.c Bug 135579 - small interlaced PNG images not decoded correctly. Affected files: pngpread.c +Bug 154996 - PNG files with invalid IHDR can crash/hand browser. + Affected files: pngpread.c + diff --git a/mozilla/modules/libimg/png/pngpread.c b/mozilla/modules/libimg/png/pngpread.c index 3c8e08379f7..41ebb5e62fd 100644 --- a/mozilla/modules/libimg/png/pngpread.c +++ b/mozilla/modules/libimg/png/pngpread.c @@ -736,6 +736,13 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer, } if (!(png_ptr->zstream.avail_out)) { + if (( +#if defined(PNG_READ_INTERLACING_SUPPORTED) + png_ptr->interlaced && png_ptr->pass > 6) || + (!png_ptr->interlaced && +#endif + png_ptr->row_number == png_ptr->num_rows-1)) + png_error(png_ptr, "Too much data in IDAT chunks"); png_push_process_row(png_ptr); png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes; png_ptr->zstream.next_out = png_ptr->row_buf;