lib/libpng
1
0
Fork 0
mirror of https://github.com/glennrp/libpng.git synced 2026-10-24 08:39:18 +03:00
Code Activity

fix: Sync info_ptr->palette after in-place transforms

Browse Source 
Copy `png_ptr->palette` into `info_ptr->palette` upon entering
the function that runs immediately after the in-place transforms.

The palette decoupling in the previous commit gave `png_struct`
and `png_info` independently-allocated palette buffers, fixing a
use-after-free vulnerability. However, `png_init_read_transformations`
modifies `png_ptr->palette` in place (e.g. for gamma correction or
background compositing), and the old aliasing made those modifications
visible through `png_get_PLTE`. With independent buffers,
`info_ptr->palette` retained the original values, causing our tests to
fail on indexed-colour background compositing.
This commit is contained in:
Cosmin Truta
2026-03-20 21:25:12 +02:00
parent 7ea9eea884
commit c1b0318b39
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
pngrtran.c
View File

@@ -2070,6 +2070,21 @@ png_read_transform_info(png_structrp png_ptr, png_inforp info_ptr)
{
png_debug(1, "in png_read_transform_info");
if (png_ptr->transformations != 0)
{
if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
info_ptr->palette != NULL && png_ptr->palette != NULL)
{
/* Sync info_ptr->palette with png_ptr->palette.
* The function png_init_read_transformations may have modified
* png_ptr->palette in place (e.g. for gamma correction or for
* background compositing).
*/
memcpy(info_ptr->palette, png_ptr->palette,
PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)));
}
}
#ifdef PNG_READ_EXPAND_SUPPORTED
if ((png_ptr->transformations & PNG_EXPAND) != 0)
{