cvs: gd /libgd gd_png.c /libgd/tests bug00011.c emptyfile

pajoye		Wed Oct 11 00:02:16 2006 UTC

  Added files:                 
    /gd/libgd/tests	bug00011.c emptyfile 

  Modified files:              
    /gd/libgd	gd_png.c 
  Log:
  - #11, gdImageCreateFromPng* possible crash with empty file
         Thanks to Antony Dovgal to have catched this bug
  
  
http://cvs.php.net/viewvc.cgi/gd/libgd/gd_png.c?r1=1.18&r2=1.19&diff_format=u
Index: gd/libgd/gd_png.c
diff -u gd/libgd/gd_png.c:1.18 gd/libgd/gd_png.c:1.19
--- gd/libgd/gd_png.c:1.18	Wed Apr  5 15:54:20 2006
+++ gd/libgd/gd_png.c	Wed Oct 11 00:02:16 2006
@@ -1,3 +1,4 @@
+/* $Id: gd_png.c,v 1.19 2006/10/11 00:02:16 pajoye Exp $ */
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -142,7 +143,10 @@
 
   /* first do a quick check that the file really is a PNG image; could
    * have used slightly more general png_sig_cmp() function instead */
-  gdGetBuf (sig, 8, infile);
+  if (gdGetBuf (sig, 8, infile) < 8) {
+	return NULL;
+  }
+
   if (!png_check_sig (sig, 8))
     return NULL;		/* bad signature */
 

http://cvs.php.net/viewvc.cgi/gd/libgd/tests/bug00011.c?view=markup&rev=1.1
Index: gd/libgd/tests/bug00011.c
+++ gd/libgd/tests/bug00011.c
/* $Id: bug00011.c,v 1.1 2006/10/11 00:02:16 pajoye Exp $ */
#include "gd.h"
#include <stdio.h>
#include <stdlib.h>

int main()
{
 	gdImagePtr im;
	FILE *fp;

	fp = fopen("emptyfile", "rb");
	if (!fp) {
		printf("failed, cannot open file\n");
	}
	im = gdImageCreateFromPng(fp);
	fclose(fp);
	if (!im) {
		printf("ok\n");
		/* Success */
		exit(0);
	}		
	printf("failed\n");
 	/* Test fails */
 	gdImageDestroy(im);

	exit(1);
}