commit 1bef8e97995c33123665582e57d3ed40b57d5978
author Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Fri Oct 30 11:34:37 2015 -0500
committer Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Fri Oct 30 11:34:37 2015 -0500
tree a1c3b8a7edad9bdeb48a5a45fa7aab4e0568f049
parent a901eb3ce6087e0afeef988247f1a1aa208cb54d

[libpng16] Silently truncate over-length PLTE chunk while reading.

pngset.c

diff --git a/pngset.c b/pngset.c
index 0629d94..8dcf18a 100644
--- a/pngset.c
+++ b/pngset.c
@@ -523,7 +523,7 @@
    max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
       (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
 
-   if (num_palette < 0 || num_palette > max_palette_length)
+   if (num_palette < 0 || num_palette > (int) max_palette_length)
    {
       if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
          png_error(png_ptr, "Invalid palette length");