cvs: gd /libgd NEWS gd_png.c /libgd/tests/png bug00086.c

pajoye		Thu May 17 14:49:45 2007 UTC

  Modified files:              
    /gd/libgd	NEWS gd_png.c 
    /gd/libgd/tests/png	bug00086.c 
  Log:
  - MFB: #86, Possible infinite loop in libgd/gd_png.c
  
  
http://cvs.php.net/viewvc.cgi/gd/libgd/NEWS?r1=1.5&r2=1.6&diff_format=u
Index: gd/libgd/NEWS
diff -u gd/libgd/NEWS:1.5 gd/libgd/NEWS:1.6
--- gd/libgd/NEWS:1.5	Sun May  6 19:53:05 2007
+++ gd/libgd/NEWS	Thu May 17 14:49:45 2007
@@ -18,6 +18,9 @@
 72, gdImageAALine draws axis lines with two pixels width
 73, TTF usage doesn't work properly on Netware (Guenter Knauf, Scott MacVicar)
 74, gdImageArc CPU usage with large angles
+78, gdImageFilledRectangle regression fixed when used with reversed edges
+86, Possible infinite loop in libgd/gd_png.c, flaw found by Xavier Roche
+    (Pierre)
 
 GD 2.0.34 (2007-02-07)
  3, Initialize variables in tweenColorTest, fix cache
http://cvs.php.net/viewvc.cgi/gd/libgd/gd_png.c?r1=1.22&r2=1.23&diff_format=u
Index: gd/libgd/gd_png.c
diff -u gd/libgd/gd_png.c:1.22 gd/libgd/gd_png.c:1.23
--- gd/libgd/gd_png.c:1.22	Sun May  6 18:46:45 2007
+++ gd/libgd/gd_png.c	Thu May 17 14:49:45 2007
@@ -1,4 +1,4 @@
-/* $Id: gd_png.c,v 1.22 2007/05/06 18:46:45 pajoye Exp $ */
+/* $Id: gd_png.c,v 1.23 2007/05/17 14:49:45 pajoye Exp $ */
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -81,7 +81,11 @@
 static void
 gdPngReadData (png_structp png_ptr, png_bytep data, png_size_t length)
 {
-  gdGetBuf (data, length, (gdIOCtx *) png_get_io_ptr (png_ptr));
+  int check;
+  check = gdGetBuf (data, length, (gdIOCtx *) png_get_io_ptr (png_ptr));
+  if (check != length) {
+    png_error(png_ptr, "Read Error: truncated data");
+  }
 }
 
 static void
http://cvs.php.net/viewvc.cgi/gd/libgd/tests/png/bug00086.c?r1=1.1&r2=1.2&diff_format=u
Index: gd/libgd/tests/png/bug00086.c
diff -u /dev/null gd/libgd/tests/png/bug00086.c:1.2
--- /dev/null	Thu May 17 14:49:45 2007
+++ gd/libgd/tests/png/bug00086.c	Thu May 17 14:49:45 2007
@@ -0,0 +1,33 @@
+/* $Id: bug00086.c,v 1.2 2007/05/17 14:49:45 pajoye Exp $ */
+/* id: gdbad3.c, Xavier Roche, May. 2007 */
+/* gcc gdbad3.c -o bad -lgd && ./bad */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include "gd.h"
+
+static const unsigned char pngdata[93];
+int main(void) {
+	FILE *fp;
+	gdImagePtr im;
+	int i;
+	size_t out;
+
+	if ( ( im = gdImageCreateFromPngPtr(93, (char*) &pngdata[0]) ) == NULL) {
+		fprintf(stderr, "success!\n");
+		return 0;
+	} else {
+		fprintf(stderr, "failed!\n");
+		gdImageDestroy(im);
+		return 1;
+	}
+	return 0;
+}
+
+/* PNG data */
+static const unsigned char pngdata[93] = {137,80,78,71,13,10,26,10,0,0,
+0,13,73,72,68,82,0,0,0,120,0,0,0,131,8,6,0,0,0,70,49,223,8,0,0,0,6,98,
+75,71,68,0,255,0,255,0,255,160,189,167,147,0,0,0,9,112,72,89,115,0,0,92,
+70,0,0,92,70,1,20,148,67,65,0,0,0,9,118,112,65,103,0,0,0,120,0,0,0,131,
+0,226,13,249,45};
+