Fix buffer overwrite in png_build_index
Fixes buffer size calculations to take possible transformations
into account. Images with less than 256 colors in the palette,
that are transformed up to 8-bit, will not overwrite memory at
the end of the buffer. Verified with a 16 color image.
Also fixes some build warnings.
Change-Id: Ib7b256ffe7816148bfd39114ab7036dcf2218023
Signed-off-by: Henrik Smiding <henrik.smiding@intel.com>
diff --git a/pngread.c b/pngread.c
index 752eac0..2ce83ed 100644
--- a/pngread.c
+++ b/pngread.c
@@ -763,7 +763,8 @@
number_rows_in_pass[0] = 8;
}
- rp = png_malloc(png_ptr, png_ptr->rowbytes);
+ // Allocate a buffer big enough for any transform.
+ rp = png_malloc(png_ptr, PNG_ROWBYTES(png_ptr->maximum_pixel_depth, png_ptr->width));
png_indexp index = png_malloc(png_ptr, sizeof(png_index));
png_ptr->index = index;
@@ -781,7 +782,7 @@
// has roughly the same size of index.
// This way, we won't consume to much memory in recording index.
index->step[p] = INDEX_SAMPLE_SIZE * (8 / number_rows_in_pass[p]);
- const int temp_size =
+ const png_uint_32 temp_size =
(png_ptr->height + index->step[p] - 1) / index->step[p];
index->pass_line_index[p] =
png_malloc(png_ptr, temp_size * sizeof(png_line_indexp));