From a903fe19d8ae9eff97c25f2595f17e0ed5d6bc34 Mon Sep 17 00:00:00 2001 From: Vicki Pfau Date: Thu, 25 Jun 2020 01:54:33 -0700 Subject: [PATCH] Util: Add PNGRead safety checks --- src/util/png-io.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/util/png-io.c b/src/util/png-io.c index e6c0487ca..1dbadc6e1 100644 --- a/src/util/png-io.c +++ b/src/util/png-io.c @@ -273,6 +273,10 @@ bool PNGIgnorePixels(png_structp png, png_infop info) { } bool PNGReadPixels(png_structp png, png_infop info, void* pixels, unsigned width, unsigned height, unsigned stride) { + if (png_get_channels(png, info) != 3) { + return false; + } + if (setjmp(png_jmpbuf(png))) { return false; } @@ -324,6 +328,10 @@ bool PNGReadPixels(png_structp png, png_infop info, void* pixels, unsigned width } bool PNGReadPixelsA(png_structp png, png_infop info, void* pixels, unsigned width, unsigned height, unsigned stride) { + if (png_get_channels(png, info) != 4) { + return false; + } + if (setjmp(png_jmpbuf(png))) { return false; } @@ -375,6 +383,10 @@ bool PNGReadPixelsA(png_structp png, png_infop info, void* pixels, unsigned widt } bool PNGReadPixels8(png_structp png, png_infop info, void* pixels, unsigned width, unsigned height, unsigned stride) { + if (png_get_channels(png, info) != 1) { + return false; + } + if (setjmp(png_jmpbuf(png))) { return false; }