diff options
| -rw-r--r-- | pngread.c | 5 | ||||
| -rw-r--r-- | pngrutil.c | 6 |
2 files changed, 6 insertions, 5 deletions
@@ -763,7 +763,8 @@ png_build_index(png_structp png_ptr) number_rows_in_pass[0] = 8; } - rp = png_malloc(png_ptr, png_ptr->rowbytes); + // Allocate a buffer big enough for any transform. + rp = png_malloc(png_ptr, PNG_ROWBYTES(png_ptr->maximum_pixel_depth, png_ptr->width)); png_indexp index = png_malloc(png_ptr, sizeof(png_index)); png_ptr->index = index; @@ -781,7 +782,7 @@ png_build_index(png_structp png_ptr) // has roughly the same size of index. // This way, we won't consume to much memory in recording index. index->step[p] = INDEX_SAMPLE_SIZE * (8 / number_rows_in_pass[p]); - const int temp_size = + const png_uint_32 temp_size = (png_ptr->height + index->step[p] - 1) / index->step[p]; index->pass_line_index[p] = png_malloc(png_ptr, temp_size * sizeof(png_line_indexp)); @@ -3028,7 +3028,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display) { unsigned int pixel_depth = png_ptr->transformed_pixel_depth; png_const_bytep sp = png_ptr->row_buf + 1; - png_uint_32 row_width = png_ptr->width; + png_alloc_size_t row_width = png_ptr->width; unsigned int pass = png_ptr->pass; png_bytep end_ptr = 0; png_byte end_byte = 0; @@ -3301,7 +3301,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display) /* But don't allow this number to exceed the actual row width. */ if (bytes_to_copy > row_width) - bytes_to_copy = row_width; + bytes_to_copy = (unsigned int)/*SAFE*/row_width; } else /* normal row; Adam7 only ever gives us one pixel to copy. */ @@ -3481,7 +3481,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display) dp += bytes_to_jump; row_width -= bytes_to_jump; if (bytes_to_copy > row_width) - bytes_to_copy = row_width; + bytes_to_copy = (unsigned int)/*SAFE*/row_width; } } |