commit 77a0a2ea113e699c7021caf1a530d2e2dd90b497
author Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Thu Jan 17 16:15:46 2013 -0600
committer Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Thu Jan 17 16:15:46 2013 -0600
tree 3269c352350ddbb1836cf0d8881156467cc65b5e
parent 798d3de5f66b6df6d6605f968da641c24725b15e

[libpng15] Check validity of "nentries" parameter of png_set_sPLT().

and check validity of "num_text" parameter of png_set_text_2().

ANNOUNCE

diff --git a/ANNOUNCE b/ANNOUNCE
index d16bf33..501a7a5 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -85,6 +85,7 @@
 
 Version 1.5.14rc03 [January 17, 2013]
   Check validity of "nentries" parameter of png_set_sPLT().
+  Check validity of "num_text" parameter of png_set_text_2().
 
   ===========================================================================
                        NOTICE November 17, 2012:

CHANGES

diff --git a/CHANGES b/CHANGES
index 4c2d767..1fc47de 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3978,6 +3978,7 @@
 
 Version 1.5.14rc03 [January 17, 2013]
   Check validity of "nentries" parameter of png_set_sPLT().
+  Check validity of "num_text" parameter of png_set_text_2().
 
   ===========================================================================
                        NOTICE November 17, 2012:

pnginfo.h

diff --git a/pnginfo.h b/pnginfo.h
index a33bfab..0e5c977 100644
--- a/pnginfo.h
+++ b/pnginfo.h
@@ -242,7 +242,7 @@
 #ifdef PNG_sPLT_SUPPORTED
    /* Data on sPLT chunks (there may be more than one). */
    png_sPLT_tp splt_palettes;
-   png_uint_32 splt_palettes_num;
+   int splt_palettes_num;
 #endif
 
 #ifdef PNG_sCAL_SUPPORTED

pngset.c

diff --git a/pngset.c b/pngset.c
index 1467690..cb14fbf 100644
--- a/pngset.c
+++ b/pngset.c
@@ -690,6 +690,17 @@
    /* Make sure we have enough space in the "text" array in info_struct
     * to hold all of the incoming text_ptr objects.
     */
+
+   if (num_text < 0 ||
+       num_text > INT_MAX - info_ptr->num_text - 8 ||
+       (unsigned int)/*SAFE*/(num_text +/*SAFE*/
+       info_ptr->num_text + 8) >=
+       PNG_SIZE_MAX/png_sizeof(png_text))
+   {
+      png_warning(png_ptr, "too many text chunks");
+      return(0);
+   }
+
    if (info_ptr->num_text + num_text > info_ptr->max_text)
    {
       int old_max_text = info_ptr->max_text;