diff options
| author | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-02-08 19:23:05 +0000 |
|---|---|---|
| committer | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-02-08 19:23:05 +0000 |
| commit | 6e8e1fd24400ecbf1153162e67100ad7665c2679 (patch) | |
| tree | 7fdb3c4ddf00161530d96e196c2940f95c960c75 /third_party/libpng | |
| parent | 811f5f849de53c825808f38f59c64faa7af75bfd (diff) | |
| download | chromium_src-6e8e1fd24400ecbf1153162e67100ad7665c2679.zip chromium_src-6e8e1fd24400ecbf1153162e67100ad7665c2679.tar.gz chromium_src-6e8e1fd24400ecbf1153162e67100ad7665c2679.tar.bz2 | |
Fix integer issues in a way that caters for both 32-bit and 64-bit.
BUG=112822
Review URL: http://codereview.chromium.org/9363013
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@121019 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'third_party/libpng')
| -rw-r--r-- | third_party/libpng/README.chromium | 2 | ||||
| -rw-r--r-- | third_party/libpng/pngrutil.c | 11 |
2 files changed, 11 insertions, 2 deletions
diff --git a/third_party/libpng/README.chromium b/third_party/libpng/README.chromium index 6266800..656d046 100644 --- a/third_party/libpng/README.chromium +++ b/third_party/libpng/README.chromium @@ -10,3 +10,5 @@ the wk_* names). Updated to 1.2.45, no changes to the source files but all unneeded files stripped. + +- One custom patch for bug 112822, to be sent upstream. diff --git a/third_party/libpng/pngrutil.c b/third_party/libpng/pngrutil.c index 45e7ddd..bf64644 100644 --- a/third_party/libpng/pngrutil.c +++ b/third_party/libpng/pngrutil.c @@ -363,8 +363,15 @@ png_decompress_chunk(png_structp png_ptr, int comp_type, { /* Success (maybe) - really uncompress the chunk. */ png_size_t new_size = 0; - png_charp text = png_malloc_warn(png_ptr, - prefix_size + expanded_size + 1); + png_charp text = NULL; + /* Need to check for both truncation (64-bit platforms) and integer + * overflow. + */ + if (prefix_size + expanded_size > prefix_size && + prefix_size + expanded_size < 0xffffffffU) + { + text = png_malloc_warn(png_ptr, prefix_size + expanded_size + 1); + } if (text != NULL) { |