libpng: Update to upstream 1.6.37

Fixes CVE-2019-7317.
This commit is contained in:
Rémi Verschelde
2019-04-26 10:37:13 +02:00
parent ac95466aff
commit 225b61ab2a
19 changed files with 1338 additions and 93 deletions

View File

@@ -1,7 +1,7 @@
/* pngwrite.c - general routines to write a PNG file
*
* Copyright (c) 2018 Cosmin Truta
* Copyright (c) 2018-2019 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -128,6 +128,10 @@ png_write_info_before_PLTE(png_structrp png_ptr, png_const_inforp info_ptr)
* the application continues writing the PNG. So check the 'invalid'
* flag here too.
*/
#ifdef PNG_WRITE_APNG_SUPPORTED
if (info_ptr->valid & PNG_INFO_acTL)
png_write_acTL(png_ptr, info_ptr->num_frames, info_ptr->num_plays);
#endif
#ifdef PNG_GAMMA_SUPPORTED
# ifdef PNG_WRITE_gAMA_SUPPORTED
if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
@@ -370,6 +374,11 @@ png_write_end(png_structrp png_ptr, png_inforp info_ptr)
png_benign_error(png_ptr, "Wrote palette index exceeding num_palette");
#endif
#ifdef PNG_WRITE_APNG_SUPPORTED
if (png_ptr->num_frames_written != png_ptr->num_frames_to_write)
png_error(png_ptr, "Not enough frames written");
#endif
/* See if user wants us to write information chunks */
if (info_ptr != NULL)
{
@@ -948,10 +957,6 @@ png_write_destroy(png_structrp png_ptr)
png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list);
png_free(png_ptr, png_ptr->row_buf);
png_ptr->row_buf = NULL;
#ifdef PNG_READ_EXPANDED_SUPPORTED
png_free(png_ptr, png_ptr->riffled_palette);
png_ptr->riffled_palette = NULL;
#endif
#ifdef PNG_WRITE_FILTER_SUPPORTED
png_free(png_ptr, png_ptr->prev_row);
png_free(png_ptr, png_ptr->try_row);
@@ -1465,6 +1470,43 @@ png_write_png(png_structrp png_ptr, png_inforp info_ptr,
}
#endif
#ifdef PNG_WRITE_APNG_SUPPORTED
void PNGAPI
png_write_frame_head(png_structp png_ptr, png_infop info_ptr,
png_bytepp row_pointers, png_uint_32 width, png_uint_32 height,
png_uint_32 x_offset, png_uint_32 y_offset,
png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
png_byte blend_op)
{
png_debug(1, "in png_write_frame_head");
/* there is a chance this has been set after png_write_info was called,
* so it would be set but not written. is there a way to be sure? */
if (!(info_ptr->valid & PNG_INFO_acTL))
png_error(png_ptr, "png_write_frame_head(): acTL not set");
png_write_reset(png_ptr);
png_write_reinit(png_ptr, info_ptr, width, height);
if ( !(png_ptr->num_frames_written == 0 &&
(png_ptr->apng_flags & PNG_FIRST_FRAME_HIDDEN) ) )
png_write_fcTL(png_ptr, width, height, x_offset, y_offset,
delay_num, delay_den, dispose_op, blend_op);
PNG_UNUSED(row_pointers)
}
void PNGAPI
png_write_frame_tail(png_structp png_ptr, png_infop info_ptr)
{
png_debug(1, "in png_write_frame_tail");
png_ptr->num_frames_written++;
PNG_UNUSED(info_ptr)
}
#endif /* PNG_WRITE_APNG_SUPPORTED */
#ifdef PNG_SIMPLIFIED_WRITE_SUPPORTED
/* Initialize the write structure - general purpose utility. */