Incrementally increase the index size based on when the data structures are allocated.
This should prevent crashes when we attempt to cleanup the codec when an image
fails to properly decode in tiled mode.
bug: 17433945
bug: 19507636
(cherry picked from commit 8594e1a8521b2cbdd941719b929b15ba943b1d4a)
Change-Id: I1b0c36905052294f28ebbf782bd93786f1c942c8
diff --git a/pngread.c b/pngread.c
index b301d41..cc213b8 100644
--- a/pngread.c
+++ b/pngread.c
@@ -1018,10 +1018,10 @@
// has roughly the same size of index.
// This way, we won't consume to much memory in recording index.
index->step[p] = INDEX_SAMPLE_SIZE * (8 / number_rows_in_pass[p]);
- index->size[p] =
+ const int temp_size =
(png_ptr->height + index->step[p] - 1) / index->step[p];
index->pass_line_index[p] =
- png_malloc(png_ptr, index->size[p] * sizeof(png_line_indexp));
+ png_malloc(png_ptr, temp_size * sizeof(png_line_indexp));
// Get the row_byte_length seen by the filter. This value may be
// different from the row_byte_length of a bitmap in the case of
@@ -1030,7 +1030,7 @@
PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1;
// Now, we record index for each indexing row.
- for (i = 0; i < index->size[p]; i++)
+ for (i = 0; i < temp_size; i++)
{
png_line_indexp line_index = png_malloc(png_ptr, sizeof(png_line_index));
index->pass_line_index[p][i] = line_index;
@@ -1043,6 +1043,11 @@
line_index->stream_idat_position = index->stream_idat_position;
line_index->bytes_left_in_idat = png_ptr->idat_size + png_ptr->zstream.avail_in;
+ // increment the size now that we have the backing data structures.
+ // This prevents a crash in the event that png_read_row fails and
+ // we need to cleanup the partially constructed png_index_struct;
+ index->size[p] += 1;
+
// Skip the "step" number of rows to the next indexing row.
for (j = 0; j < index->step[p] &&
i * index->step[p] + j < png_ptr->height; j++)
