commit 2eff8ef5042d432d00064f7612a579cf5aff09bb
author Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Sat Apr 22 15:30:52 2017 -0500
committer Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Sat Apr 22 15:46:59 2017 -0500
tree 0c35245d92a5b8b8310d7a20ba902856c80c67cd
parent 60d8ae100307770ecd5f168e47bcb3ff6683480a

[libpng16] Imported from libpng-1.6.30beta02.tar

example.c

diff --git a/example.c b/example.c
index edc8ba2..a71000f 100644
--- a/example.c
+++ b/example.c
@@ -983,6 +983,11 @@
    png_uint_32 k, height, width;
 
    /* In this example, "image" is a one-dimensional array of bytes */
+
+   /* Guard against integer overflow */
+   if (height > PNG_SIZE_MAX/(width*bytes_per_pixel)) {
+      png_error(png_ptr, "Image_data buffer would be too large");
+   }
    png_byte image[height*width*bytes_per_pixel];
 
    png_bytep row_pointers[height];