commit 0447346b2a9d342012231b08dd9a62a630abdc3b
author Mike Lockwood <lockwood@google.com> Tue Apr 03 10:42:15 2012 -0700
committer Mike Lockwood <lockwood@google.com> Tue Apr 03 10:42:15 2012 -0700
tree 2ea44343e9c8d62a3791b01bd14e9facf889dd2d
parent ccee121fae4c60a5dee6fce51195185694c376c3
parent 97aac99763e1d3e77afe175291595c31eabd9c9f

Merge remote-tracking branch 'goog/ics-aah'

pngrutil.c

diff --git a/pngrutil.c b/pngrutil.c
index dfa2c03..d67af58 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -380,8 +380,14 @@
       {
          /* Success (maybe) - really uncompress the chunk. */
          png_size_t new_size = 0;
-         png_charp text = png_malloc_warn(png_ptr,
-                        prefix_size + expanded_size + 1);
+         png_charp text = NULL;
+
+         /* Need to check for both truncation (64-bit) and integer overflow. */
+         if (prefix_size + expanded_size > prefix_size &&
+             prefix_size + expanded_size < 0xffffffffU)
+         {
+             text = png_malloc_warn(png_ptr, prefix_size + expanded_size + 1);
+         }
 
          if (text != NULL)
          {