summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--pngread.c5
-rw-r--r--pngrutil.c6
2 files changed, 6 insertions, 5 deletions
diff --git a/pngread.c b/pngread.c
index 752eac0..2ce83ed 100644
--- a/pngread.c
+++ b/pngread.c
@@ -763,7 +763,8 @@ png_build_index(png_structp png_ptr)
number_rows_in_pass[0] = 8;
}
- rp = png_malloc(png_ptr, png_ptr->rowbytes);
+ // Allocate a buffer big enough for any transform.
+ rp = png_malloc(png_ptr, PNG_ROWBYTES(png_ptr->maximum_pixel_depth, png_ptr->width));
png_indexp index = png_malloc(png_ptr, sizeof(png_index));
png_ptr->index = index;
@@ -781,7 +782,7 @@ png_build_index(png_structp png_ptr)
// has roughly the same size of index.
// This way, we won't consume to much memory in recording index.
index->step[p] = INDEX_SAMPLE_SIZE * (8 / number_rows_in_pass[p]);
- const int temp_size =
+ const png_uint_32 temp_size =
(png_ptr->height + index->step[p] - 1) / index->step[p];
index->pass_line_index[p] =
png_malloc(png_ptr, temp_size * sizeof(png_line_indexp));
diff --git a/pngrutil.c b/pngrutil.c
index 9638bed..381d830 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -3028,7 +3028,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
{
unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
png_const_bytep sp = png_ptr->row_buf + 1;
- png_uint_32 row_width = png_ptr->width;
+ png_alloc_size_t row_width = png_ptr->width;
unsigned int pass = png_ptr->pass;
png_bytep end_ptr = 0;
png_byte end_byte = 0;
@@ -3301,7 +3301,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
/* But don't allow this number to exceed the actual row width. */
if (bytes_to_copy > row_width)
- bytes_to_copy = row_width;
+ bytes_to_copy = (unsigned int)/*SAFE*/row_width;
}
else /* normal row; Adam7 only ever gives us one pixel to copy. */
@@ -3481,7 +3481,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
dp += bytes_to_jump;
row_width -= bytes_to_jump;
if (bytes_to_copy > row_width)
- bytes_to_copy = row_width;
+ bytes_to_copy = (unsigned int)/*SAFE*/row_width;
}
}