Attachment #133005 for bug #194864




   {
      png_warning(png_ptr, "Insufficient memory to process iCCP chunk.");
      return;
   }
   png_strncpy(new_iccp_name, name, png_strlen(name));
   new_iccp_name[png_strlen(name)] = '\0';
   new_iccp_profile = (png_charp)png_malloc_warn(png_ptr, proflen);
   if (new_iccp_profile == NULL)
   {
      png_free (png_ptr, new_iccp_name);

           png_warning(png_ptr,
             "Out of memory while processing sPLT chunk");
        }
        /* TODO: use png_malloc_warn */
        png_strncpy(to->name, from->name, png_strlen(from->name));
        to->name[png_strlen(from->name)] = '\0';
        to->entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
            from->nentries * png_sizeof(png_sPLT_entry));
        /* TODO: use png_malloc_warn */
        png_memcpy(to->entries, from->entries,

Return to bug 194864

Lines 689-697 Link Here

(-)libpng-1.2.21.orig/pngset.c (-2 / +4 lines)
689	{	689	{
690	png_warning(png_ptr, "Insufficient memory to process iCCP chunk.");	690	png_warning(png_ptr, "Insufficient memory to process iCCP chunk.");
691	return;	691	return;
692	}	692	}
693	png_strncpy(new_iccp_name, name, png_strlen(new_iccp_name)+1);	693	png_strncpy(new_iccp_name, name, png_strlen(name));
		694	new_iccp_name[png_strlen(name)] = '\0';
694	new_iccp_profile = (png_charp)png_malloc_warn(png_ptr, proflen);	695	new_iccp_profile = (png_charp)png_malloc_warn(png_ptr, proflen);
695	if (new_iccp_profile == NULL)	696	if (new_iccp_profile == NULL)
696	{	697	{
697	png_free (png_ptr, new_iccp_name);	698	png_free (png_ptr, new_iccp_name);
Lines 979-987 Link Here
979	png_warning(png_ptr,	980	png_warning(png_ptr,
980	"Out of memory while processing sPLT chunk");	981	"Out of memory while processing sPLT chunk");
981	}	982	}
982	/* TODO: use png_malloc_warn */	983	/* TODO: use png_malloc_warn */
983	png_strncpy(to->name, from->name, png_strlen(from->name)+1);	984	png_strncpy(to->name, from->name, png_strlen(from->name));
		985	to->name[png_strlen(from->name)] = '\0';
984	to->entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,	986	to->entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
985	from->nentries * png_sizeof(png_sPLT_entry));	987	from->nentries * png_sizeof(png_sPLT_entry));
986	/* TODO: use png_malloc_warn */	988	/* TODO: use png_malloc_warn */
987	png_memcpy(to->entries, from->entries,	989	png_memcpy(to->entries, from->entries,