---------------------------------------------------------------------------
- Copyright (c) 1998-2007 Greg Roelofs. All rights reserved.
+ Copyright (c) 1998-2007,2017 Greg Roelofs. All rights reserved.
This software is provided "as is," without warranty of any kind,
express or implied. In no event shall the author or contributors
/* could pass pointers to user-defined error handlers instead of NULLs: */
- png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
+ png_ptr = png_create_read_struct(png_get_libpng_ver(NULL), NULL, NULL,
+ NULL);
if (!png_ptr)
return 4; /* out of memory */
*pRowbytes = rowbytes = png_get_rowbytes(png_ptr, info_ptr);
*pChannels = (int)png_get_channels(png_ptr, info_ptr);
+ /* Guard against integer overflow */
+ if (height > ((size_t)(-1))/rowbytes) {
+ fprintf(stderr, "readpng: image_data buffer would be too large\n",
+ return NULL;
+ }
+
if ((image_data = (uch *)malloc(rowbytes*height)) == NULL) {
png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
return NULL;