diff --git a/ANNOUNCE b/ANNOUNCE index cb17abe8af52a88244594b938590fd430907d00a..92db517b6a368c150b318e9088460c61d2ef217f 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,5 +1,5 @@ -Libpng 1.6.11beta05 - April 24, 2014 +Libpng 1.6.11beta05 - April 25, 2014 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -55,8 +55,8 @@ Version 1.6.11beta04 [April 19, 2014] when png_combine_row is not used or not built, Allow PNG_sRGB_PROFILE_CHECKING = (-1) to mean no sRGB profile checking. -Version 1.6.11beta05 [April 24, 2014] - Do not reject ICC V2 profiles that lack padding. +Version 1.6.11beta05 [April 25, 2014] + Do not reject ICC V2 profiles that lack padding (Kai-Uwe Behrmann). Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index 7027b437c643662962a672559a0dfac0ab8d49d4..1b85bb2d365a66827acc3a850c91ab39b4969801 100644 --- a/CHANGES +++ b/CHANGES @@ -4906,8 +4906,8 @@ Version 1.6.11beta04 [April 19, 2014] when png_combine_row is not used or not built, Allow PNG_sRGB_PROFILE_CHECKING = (-1) to mean no sRGB profile checking. -Version 1.6.11beta05 [April 24, 2014] - Do not reject ICC V2 profiles that lack padding. +Version 1.6.11beta05 [April 25, 2014] + Do not reject ICC V2 profiles that lack padding (Kai-Uwe Behrmann). Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/pngwutil.c b/pngwutil.c index 8bdd922de8c6e6579401b3b296458610e56da7de..f4abeba9a9e730cafd79888505c1b1f24293cd0d 100644 --- a/pngwutil.c +++ b/pngwutil.c @@ -1193,6 +1193,7 @@ png_write_iCCP(png_structrp png_ptr, png_const_charp name, png_uint_32 profile_len; png_byte new_name[81]; /* 1 byte for the compression byte */ compression_state comp; + png_uint_32 temp; png_debug(1, "in png_write_iCCP"); @@ -1207,7 +1208,8 @@ png_write_iCCP(png_structrp png_ptr, png_const_charp name, if (profile_len < 132) png_error(png_ptr, "ICC profile too short"); - if (profile_len & 0x03) + temp = (png_uint_32) (*(profile+8)); + if (temp > 3 && (profile_len & 0x03)) png_error(png_ptr, "ICC profile length invalid (not a multiple of 4)"); {