commit 29fca795b95011068b683df55346951aa35a09be
author Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Sat Nov 19 15:08:04 2011 -0600
committer Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Sat Nov 19 15:08:04 2011 -0600
tree 2f1c277cde242149ed85841a57252bf24c5d34fb
parent bd2fa5def6ed9d9320a7f58a3daea4eea925bccf

[libpng15] Validate time settings passed to pngset()

and png_convert_to_rfc1123(). (Frank Busse).

pngset.c

diff --git a/pngset.c b/pngset.c
index e3767f7..af5511b 100644
--- a/pngset.c
+++ b/pngset.c
@@ -864,6 +864,15 @@
        (png_ptr->mode & PNG_WROTE_tIME))
       return;
 
+   if (mod_time->month == 0   || mod_time->month > 12  ||
+       mod_time->day   == 0   || mod_time->day   > 31  ||
+       mod_time->hour  > 23   || mod_time->minute > 59 ||
+       mod_time->second > 60)
+   {
+      png_warning(png_ptr, "Ignoring invalid time value");
+      return;
+   }
+
    png_memcpy(&(info_ptr->mod_time), mod_time, png_sizeof(png_time));
    info_ptr->valid |= PNG_INFO_tIME;
 }