Fixed an overflow bug in png.c where reading images with a palette or

fewer than 8 bits per sample but no alpha channel would cause a segfault
since libpng would expand the image with alpha channel while no space
was allocated for an alpha channel.

diff --git a/png.c b/png.c
index c6560043210472991ecd98a59f969028cfc038b3..3ef0e9d868f5fa4cfbdf281d72e0070f53de5f34 100644 (file)
--- a/png.c
+++ b/png.c
@@ -129,7 +129,7 @@ i_readpng(int fd) {
   FILE *fp;
   unsigned int sig_read;
 
-  sig_read=0;
+  sig_read = 0;
 
   if ((fp = fdopen(fd,"r")) == NULL) {
     mm_log((1,"can't fdopen.\n"));
@@ -181,7 +181,7 @@ i_readpng(int fd) {
   
   mm_log((1,
          "png_get_IHDR results: width %d, height %d, bit_depth %d,color_type %d,interlace_type %d\n",
-         width,height,bit_depth,color_type,interlace_type));
+         width, height, bit_depth, color_type, interlace_type));
 
   CC2C[PNG_COLOR_TYPE_GRAY]=1;
   CC2C[PNG_COLOR_TYPE_PALETTE]=3;
@@ -191,9 +191,9 @@ i_readpng(int fd) {
 
   channels=CC2C[color_type];
   
-  mm_log((1,"channels %d\n",channels));
+  mm_log((1,"channels %d\n", channels));
   
-  im=i_img_empty_ch(NULL,width,height,channels);
+  im = i_img_empty_ch(NULL, width, height, channels);
 
   /**** Set up the data transformations you want.  Note that these are all
    **** optional.  Only call them if you want/need them.  Many of the
@@ -204,11 +204,7 @@ i_readpng(int fd) {
   /* tell libpng to strip 16 bit/color files down to 8 bits/color */
   png_set_strip_16(png_ptr);
   
-  /* Strip alpha bytes from the input data without combining with the
-   * background (not recommended).
-   */
-  /*  png_set_strip_alpha(png_ptr); */
-  
+ 
   /* Extract multiple pixels with bit depths of 1, 2, and 4 from a single
    * byte into separate bytes (useful for paletted and grayscale images).
    */
@@ -223,18 +219,33 @@ i_readpng(int fd) {
 
   /* Expand paletted or RGB images with transparency to full alpha channels
    * so the data will be available as RGBA quartets.
+   *
+   * if (png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)) png_set_expand(png_ptr);
+   * 
    */
-  if (png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)) png_set_expand(png_ptr);
   
+  /* Strip alpha bytes from the input data without combining with the
+   * background (not recommended).
+   */
+  if (color_type != PNG_COLOR_TYPE_RGB_ALPHA || color_type != PNG_COLOR_TYPE_GRAY_ALPHA) 
+    png_set_strip_alpha(png_ptr);
+
+
   number_passes = png_set_interlace_handling(png_ptr);
 
   mm_log((1,"number of passes=%d\n",number_passes));
   
   png_read_update_info(png_ptr, info_ptr);
+
   for (pass = 0; pass < number_passes; pass++)
-    for (y = 0; y < height; y++) { png_read_row(png_ptr,(png_bytep) &(im->data[channels*width*y]), NULL); }
+    for (y = 0; y < height; y++) {
+      png_read_row(png_ptr,(png_bytep) &(im->data[channels*width*y]), NULL);
+      mm_log((1, "pass = %d, row %d\n", pass, y));
+    }
   /* read rest of file, and get additional chunks in info_ptr - REQUIRED */
 
+  mm_log((1,"FOO!\n"));
+
   png_read_end(png_ptr, info_ptr); 
   /* clean up after the read, and free any memory allocated - REQUIRED */
   png_destroy_read_struct(&png_ptr, &info_ptr, (png_infopp)NULL);