[libpng15] Fix an off-by-one error in the palette index checking func…

…tion.
LuaDist · Mar 11, 2012 · d4247dd · d4247dd
1 parent 1ca16d9
commit d4247dd
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 4 deletions.
diff --git a/ANNOUNCE b/ANNOUNCE
@@ -1,5 +1,5 @@
 
-Libpng 1.5.10beta05 - March 10, 2012
+Libpng 1.5.10beta05 - March 11, 2012
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -56,9 +56,10 @@ Version 1.5.10beta04 [March 10, 2012]
   Fixed CMF optimization of non-IDAT compressed chunks, which was added at
     libpng-1.5.4.  It sometimes produced too small of a window.
 
-Version 1.5.10beta05 [March 10, 2012]
+Version 1.5.10beta05 [March 11, 2012]
   Reject all iCCP chunks after the first, even if the first one is invalid.
   Issue a png_benign_error() instead of png_warning() about bad palette index.
+  Fix an off-by-one error in the palette index checking function.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net:
 (subscription required; visit

diff --git a/CHANGES b/CHANGES
@@ -3841,9 +3841,10 @@ Version 1.5.10beta04 [March 10, 2012]
   Fixed CMF optimization of non-IDAT compressed chunks, which was added at
     libpng-1.5.4.  It sometimes produced too small of a window.
 
-Version 1.5.10beta05 [March 10, 2012]
+Version 1.5.10beta05 [March 11, 2012]
   Reject all iCCP chunks after the first, even if the first one is invalid.
   Issue a png_benign_error() instead of png_warning() about bad palette index.
+  Fix an off-by-one error in the palette index checking function.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit

diff --git a/pngtrans.c b/pngtrans.c
@@ -635,7 +635,7 @@ png_do_check_palette_indexes(png_structp png_ptr, png_row_infop row_info)
        * forms produced on either GCC or MSVC.
        */
       int padding = (-row_info->pixel_depth * row_info->width) & 7;
-      png_bytep rp = png_ptr->row_buf + 1 + row_info->rowbytes;
+      png_bytep rp = png_ptr->row_buf + row_info->rowbytes;
 
       switch (row_info->bit_depth)
       {