Fix for probably rare but potential refcount leak.

[wxWidgets.git] / src / png / example.c

diff --git a/src/png/example.c b/src/png/example.c
index 1cc450f80e7d9412ed7e8f7f5e7ead47774c4bdc..ba0ecc5b5cc600464afee3ccebc557a76c517c9b 100644 (file)
--- a/src/png/example.c
+++ b/src/png/example.c
@@ -282,7 +282,7 @@ void read_png(FILE *fp, unsigned int sig_read)  /* file is already open */
       /* This reduces the image to the palette supplied in the file */
       else if (png_get_PLTE(png_ptr, info_ptr, &palette, &num_palette))
       {
       /* This reduces the image to the palette supplied in the file */
       else if (png_get_PLTE(png_ptr, info_ptr, &palette, &num_palette))
       {

-         png_uint_16p histogram;
+         png_uint_16p histogram = NULL;

 
          png_get_hIST(png_ptr, info_ptr, &histogram);
 
 
          png_get_hIST(png_ptr, info_ptr, &histogram);
 


@@ -631,7 +631,7 @@ void write_png(char *file_name /* , ... other image information ... */)
 
    /* set the palette if there is one.  REQUIRED for indexed-color images */
    palette = (png_colorp)png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH
 
    /* set the palette if there is one.  REQUIRED for indexed-color images */
    palette = (png_colorp)png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH

-             * sizeof (png_color));
+             * png_sizeof (png_color));

    /* ... set palette colors ... */
    png_set_PLTE(png_ptr, info_ptr, palette, PNG_MAX_PALETTE_LENGTH);
    /* You must not free palette here, because png_set_PLTE only makes a link to
    /* ... set palette colors ... */
    png_set_PLTE(png_ptr, info_ptr, palette, PNG_MAX_PALETTE_LENGTH);
    /* You must not free palette here, because png_set_PLTE only makes a link to


@@ -741,6 +741,10 @@ void write_png(char *file_name /* , ... other image information ... */)
    png_uint_32 k, height, width;
    png_byte image[height][width*bytes_per_pixel];
    png_bytep row_pointers[height];
    png_uint_32 k, height, width;
    png_byte image[height][width*bytes_per_pixel];
    png_bytep row_pointers[height];

+
+   if (height > PNG_UINT_32_MAX/png_sizeof(png_bytep))
+     png_error (png_ptr, "Image is too tall to process in memory");
+

    for (k = 0; k < height; k++)
      row_pointers[k] = image + k*width*bytes_per_pixel;
 
    for (k = 0; k < height; k++)
      row_pointers[k] = image + k*width*bytes_per_pixel;