From 668c58627e0e8b092004be91f917d5718ad238d1 Mon Sep 17 00:00:00 2001 From: Henry Eigen Date: Sun, 25 Apr 2021 04:59:49 -0500 Subject: [PATCH 1/2] Update pngpread.c --- 3rdparty/FreeImage/Source/LibPNG/pngpread.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/3rdparty/FreeImage/Source/LibPNG/pngpread.c b/3rdparty/FreeImage/Source/LibPNG/pngpread.c index c4ba51c..e9f7239 100644 --- a/3rdparty/FreeImage/Source/LibPNG/pngpread.c +++ b/3rdparty/FreeImage/Source/LibPNG/pngpread.c @@ -223,6 +223,22 @@ png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr) if ((png_ptr->mode & PNG_AFTER_IDAT) != 0) png_benign_error(png_ptr, "Too many IDATs found"); } + + else + { + png_alloc_size_t limit = PNG_SIZE_MAX; + # ifdef PNG_SET_USER_LIMITS_SUPPORTED + if (png_ptr->user_chunk_malloc_max > 0 && + png_ptr->user_chunk_malloc_max < limit) + limit = png_ptr->user_chunk_malloc_max; + # elif PNG_USER_CHUNK_MALLOC_MAX > 0 + if (PNG_USER_CHUNK_MALLOC_MAX < limit) + limit = PNG_USER_CHUNK_MALLOC_MAX; + # endif + if (png_ptr->push_length > limit) + png_chunk_error(png_ptr, "chunk data is too large"); + } + if (chunk_name == png_IHDR) { From 56c099b883b118b924d81a4478c2a429b437757f Mon Sep 17 00:00:00 2001 From: Henry Eigen Date: Sun, 25 Apr 2021 05:06:50 -0500 Subject: [PATCH 2/2] Update pngrutil.c --- 3rdparty/FreeImage/Source/LibPNG/pngrutil.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/3rdparty/FreeImage/Source/LibPNG/pngrutil.c b/3rdparty/FreeImage/Source/LibPNG/pngrutil.c index 7001f19..71ec370 100644 --- a/3rdparty/FreeImage/Source/LibPNG/pngrutil.c +++ b/3rdparty/FreeImage/Source/LibPNG/pngrutil.c @@ -183,6 +183,23 @@ png_read_chunk_header(png_structrp png_ptr) /* Check for too-large chunk length */ png_check_chunk_length(png_ptr, length); + + /* Check for too-large chunk length */ + if (png_ptr->chunk_name != png_IDAT) + { + png_alloc_size_t limit = PNG_SIZE_MAX; + # ifdef PNG_SET_USER_LIMITS_SUPPORTED + if (png_ptr->user_chunk_malloc_max > 0 && + png_ptr->user_chunk_malloc_max < limit) + limit = png_ptr->user_chunk_malloc_max; + # elif PNG_USER_CHUNK_MALLOC_MAX > 0 + if (PNG_USER_CHUNK_MALLOC_MAX < limit) + limit = PNG_USER_CHUNK_MALLOC_MAX; + # endif + if (length > limit) + png_chunk_error(png_ptr, "chunk data is too large"); + } + #ifdef PNG_IO_STATE_SUPPORTED png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;