Skip to content

Commit f614589

Browse files
committed
Fixing san issue on a malformed PNG file. This check wasn't accounting for the full header's size (it was off by a DWORD).
1 parent 7298d34 commit f614589

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

src/fpng.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2997,7 +2997,7 @@ do { \
29972997
const png_chunk_prefix* pChunk = reinterpret_cast<const png_chunk_prefix*>(pImage_u8);
29982998

29992999
const uint32_t chunk_len = READ_BE32(&pChunk->m_length);
3000-
if ((src_ofs + sizeof(uint32_t) + chunk_len + sizeof(uint32_t)) > image_size)
3000+
if ((src_ofs + sizeof(uint32_t) * 2 + (uint64_t)chunk_len + sizeof(uint32_t)) > image_size)
30013001
return FPNG_DECODE_FAILED_CHUNK_PARSING;
30023002

30033003
for (uint32_t i = 0; i < 4; i++)

0 commit comments

Comments
 (0)