From a0bb96c34e65378853ee518bac502842d26c2d1a Mon Sep 17 00:00:00 2001 From: Patrick Scott Date: Wed, 22 Jul 2009 11:50:02 -0400 Subject: Update libpng to 1.2.38 to patch a minor security issue. --- pngmem.c | 93 ++++++++++++++++++++++++++++++++++++---------------------------- 1 file changed, 52 insertions(+), 41 deletions(-) (limited to 'pngmem.c') diff --git a/pngmem.c b/pngmem.c index e28476f..e190cc3 100644 --- a/pngmem.c +++ b/pngmem.c @@ -1,12 +1,15 @@ /* pngmem.c - stub functions for memory allocation * - * Last changed in libpng 1.2.30 [August 15, 2008] - * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2008 Glenn Randers-Pehrson + * Last changed in libpng 1.2.37 [June 4, 2009] + * Copyright (c) 1998-2009 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * + * This code is released under the libpng license. + * For conditions of distribution and use, see the disclaimer + * and license in png.h + * * This file provides a location for all memory allocation. Users who * need special memory handling are expected to supply replacement * functions for png_malloc() and png_free(), and to use @@ -20,7 +23,7 @@ /* Borland DOS special memory handler */ #if defined(__TURBOC__) && !defined(_Windows) && !defined(__FLAT__) -/* if you change this, be sure to change the one in png.h also */ +/* If you change this, be sure to change the one in png.h also */ /* Allocate memory for a png_struct. The malloc and memset can be replaced by a single call to calloc() if this is thought to improve performance. */ @@ -40,11 +43,11 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr) png_voidp struct_ptr; if (type == PNG_STRUCT_INFO) - size = png_sizeof(png_info); + size = png_sizeof(png_info); else if (type == PNG_STRUCT_PNG) - size = png_sizeof(png_struct); + size = png_sizeof(png_struct); else - return (png_get_copyright(NULL)); + return (png_get_copyright(NULL)); #ifdef PNG_USER_MEM_SUPPORTED if (malloc_fn != NULL) @@ -56,7 +59,7 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr) } else #endif /* PNG_USER_MEM_SUPPORTED */ - struct_ptr = (png_voidp)farmalloc(size); + struct_ptr = (png_voidp)farmalloc(size); if (struct_ptr != NULL) png_memset(struct_ptr, 0, size); return (struct_ptr); @@ -122,9 +125,9 @@ png_malloc(png_structp png_ptr, png_uint_32 size) #ifdef PNG_USER_MEM_SUPPORTED if (png_ptr->malloc_fn != NULL) - ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size)); + ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size)); else - ret = (png_malloc_default(png_ptr, size)); + ret = (png_malloc_default(png_ptr, size)); if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out of memory!"); return (ret); @@ -149,12 +152,12 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) #endif if (size != (size_t)size) - ret = NULL; + ret = NULL; else if (size == (png_uint_32)65536L) { if (png_ptr->offset_table == NULL) { - /* try to see if we need to do any of this fancy stuff */ + /* Try to see if we need to do any of this fancy stuff */ ret = farmalloc(size); if (ret == NULL || ((png_size_t)ret & 0xffff)) { @@ -269,10 +272,10 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) return (ret); } -/* free a pointer allocated by png_malloc(). In the default - configuration, png_ptr is not used, but is passed in case it - is needed. If ptr is NULL, return without taking any action. */ - +/* Free a pointer allocated by png_malloc(). In the default + * configuration, png_ptr is not used, but is passed in case it + * is needed. If ptr is NULL, return without taking any action. + */ void PNGAPI png_free(png_structp png_ptr, png_voidp ptr) { @@ -285,7 +288,8 @@ png_free(png_structp png_ptr, png_voidp ptr) (*(png_ptr->free_fn))(png_ptr, ptr); return; } - else png_free_default(png_ptr, ptr); + else + png_free_default(png_ptr, ptr); } void PNGAPI @@ -293,7 +297,8 @@ png_free_default(png_structp png_ptr, png_voidp ptr) { #endif /* PNG_USER_MEM_SUPPORTED */ - if (png_ptr == NULL || ptr == NULL) return; + if (png_ptr == NULL || ptr == NULL) + return; if (png_ptr->offset_table != NULL) { @@ -420,10 +425,12 @@ png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn, } /* Allocate memory. For reasonable files, size should never exceed - 64K. However, zlib may allocate more then 64K if you don't tell - it not to. See zconf.h and png.h for more information. zlib does - need to allocate exactly 64K, so whatever you call here must - have the ability to do that. */ + * 64K. However, zlib may allocate more then 64K if you don't tell + * it not to. See zconf.h and png.h for more information. zlib does + * need to allocate exactly 64K, so whatever you call here must + * have the ability to do that. + */ + png_voidp PNGAPI png_malloc(png_structp png_ptr, png_uint_32 size) @@ -435,9 +442,9 @@ png_malloc(png_structp png_ptr, png_uint_32 size) return (NULL); if (png_ptr->malloc_fn != NULL) - ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size)); + ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size)); else - ret = (png_malloc_default(png_ptr, size)); + ret = (png_malloc_default(png_ptr, size)); if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out of Memory!"); return (ret); @@ -464,23 +471,23 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) } #endif - /* Check for overflow */ + /* Check for overflow */ #if defined(__TURBOC__) && !defined(__FLAT__) - if (size != (unsigned long)size) - ret = NULL; - else - ret = farmalloc(size); + if (size != (unsigned long)size) + ret = NULL; + else + ret = farmalloc(size); #else # if defined(_MSC_VER) && defined(MAXSEG_64K) - if (size != (unsigned long)size) - ret = NULL; - else - ret = halloc(size, 1); + if (size != (unsigned long)size) + ret = NULL; + else + ret = halloc(size, 1); # else - if (size != (size_t)size) - ret = NULL; - else - ret = malloc((size_t)size); + if (size != (size_t)size) + ret = NULL; + else + ret = malloc((size_t)size); # endif #endif @@ -493,7 +500,8 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) } /* Free a pointer allocated by png_malloc(). If ptr is NULL, return - without taking any action. */ + * without taking any action. + */ void PNGAPI png_free(png_structp png_ptr, png_voidp ptr) { @@ -506,7 +514,8 @@ png_free(png_structp png_ptr, png_voidp ptr) (*(png_ptr->free_fn))(png_ptr, ptr); return; } - else png_free_default(png_ptr, ptr); + else + png_free_default(png_ptr, ptr); } void PNGAPI png_free_default(png_structp png_ptr, png_voidp ptr) @@ -542,7 +551,8 @@ png_malloc_warn(png_structp png_ptr, png_uint_32 size) { png_voidp ptr; png_uint_32 save_flags; - if (png_ptr == NULL) return (NULL); + if (png_ptr == NULL) + return (NULL); save_flags = png_ptr->flags; png_ptr->flags|=PNG_FLAG_MALLOC_NULL_MEM_OK; @@ -602,7 +612,8 @@ png_set_mem_fn(png_structp png_ptr, png_voidp mem_ptr, png_malloc_ptr png_voidp PNGAPI png_get_mem_ptr(png_structp png_ptr) { - if (png_ptr == NULL) return (NULL); + if (png_ptr == NULL) + return (NULL); return ((png_voidp)png_ptr->mem_ptr); } #endif /* PNG_USER_MEM_SUPPORTED */ -- cgit v1.1