AuroraMiddleware/libpng
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[libpng16] Never mind, undid previous change.

Browse Source
This commit is contained in:
Glenn Randers-Pehrson 2012-03-17 00:21:45 -05:00
parent c26d6e9aac
commit f5dcba6b9b
3 changed files with 4 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ANNOUNCE
View File

@ -319,7 +319,6 @@ Version 1.6.0beta18 [March 16, 2012]
this is disabled in which case the simplified API can't be built.)
Version 1.6.0beta19 [March 17, 2012]
Revised png_set_text_2() to avoid potential memory corruption.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

1
CHANGES
View File

@ -4070,7 +4070,6 @@ Version 1.6.0beta18 [March 16, 2012]
this is disabled in which case the simplified API can't be built.)
Version 1.6.0beta19 [March 17, 2012]
Revised png_set_text_2() to avoid potential memory corruption.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

17
pngset.c
View File

@ -706,28 +706,24 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
*/
if (info_ptr->num_text + num_text > info_ptr->max_text)
{
int old_max_text = info_ptr->max_text;
int old_num_text = info_ptr->num_text;
if (info_ptr->text != NULL)
{
png_textp old_text;
int old_max;
old_max = info_ptr->max_text;
info_ptr->max_text = info_ptr->num_text + num_text + 8;
old_text = info_ptr->text;
info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
(png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
if (info_ptr->text == NULL)
{
/* Restore to previous condition */
info_ptr->max_text = old_max_text;
info_ptr->text = old_text;
png_free(png_ptr, old_text);
return(1);
}
png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max_text *
png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max *
png_sizeof(png_text)));
png_free(png_ptr, old_text);
}
@ -739,12 +735,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
(png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
if (info_ptr->text == NULL)
{
/* Restore to previous condition */
info_ptr->num_text = old_num_text;
info_ptr->max_text = old_max_text;
return(1);
}
info_ptr->free_me |= PNG_FREE_TEXT;
}