Closed
Bug 392411
Opened 17 years ago
Closed 17 years ago
APNG decoder does not detect width+offset too large
Categories
(Core :: Graphics: ImageLib, defect)
Core
Graphics: ImageLib
Tracking
()
RESOLVED
FIXED
People
(Reporter: glennrp+bmo, Assigned: glennrp+bmo)
References
(Blocks 1 open bug, )
Details
Attachments
(1 file)
|
(deleted),
patch
|
asmith16
:
review+
pavlov
:
superreview+
pavlov
:
approval1.9+
|
Details | Diff | Splinter Review |
The APNG specification (see URL above) requires
`x_offset` + `width` <= `IHDR` width
`y_offset` + `height` <= `IHDR` height
But the test in png_ensure_fcTL_is_valid() in pngset.c only tests the size of `width` and `height` and not their sums with the offsets.
|
||
Comment 1•17 years ago
|
||
Comment on attachment 276891 [details] [diff] [review]
Make subimage dimensions test as stringent as the APNG spec (checked in)
It's a good fix.
Attachment #276891 -
Flags: superreview?(pavlov)
Attachment #276891 -
Flags: review+
Attachment #276891 -
Flags: approval1.9?
|
||
Updated•17 years ago
|
Attachment #276891 -
Flags: superreview?(pavlov)
Attachment #276891 -
Flags: superreview+
Attachment #276891 -
Flags: approval1.9?
Attachment #276891 -
Flags: approval1.9+
|
|
||
Updated•17 years ago
|
Keywords: checkin-needed
|
||
Updated•17 years ago
|
Assignee: nobody → glennrp
|
Assignee | |
Updated•17 years ago
|
Status: NEW → ASSIGNED
|
|
||
Comment 2•17 years ago
|
||
modules/libimg/png/pngset.c 3.15
|
|
Assignee | |
Updated•17 years ago
|
Attachment #276891 -
Attachment description: Make subimage dimensions test as stringent as the APNG spec → Make subimage dimensions test as stringent as the APNG spec (checked in)
You need to log in
before you can comment on or make changes to this bug.
Description
•