Make loading only the palette from a PNG a bit safer
This doesn't fix any actual bug; it just helps me sleep better at night.
There is no code path in the engine that calls readpng() with buf=NULL
and nonzero width/height, but if there were, it would be fixed by this
change.
@@ -476,7 +476,8 @@ static int readpng(unsigned char *buf, unsigned char *pal, int width, int height
{
unsigned char *png_data = NULL, *png_data_ptr;
unsigned char *inflated_data = NULL;
- z_stream zlib_stream = {.zalloc = Z_NULL, .zfree = Z_NULL, .opaque = Z_NULL, .avail_in = 0, .next_in = Z_NULL};
+ z_stream zlib_stream = {.zalloc = Z_NULL, .zfree = Z_NULL, .opaque = Z_NULL, .avail_in = 0, .next_in = Z_NULL,
+ .avail_out = 0, .next_out = Z_NULL};
if (inflateInit(&zlib_stream) != Z_OK)
{
@@ -499,6 +500,8 @@ static int readpng(unsigned char *buf, unsigned char *pal, int width, int height
}
png_data_ptr = png_data;
+ if (buf)
+ {
// the "+1"s are because each scanline has an extra byte denoting the filter type
size_t inflated_size;
if (png_is_interlaced)
@@ -518,6 +521,7 @@ static int readpng(unsigned char *buf, unsigned char *pal, int width, int height
inflated_data = malloc(inflated_size);
zlib_stream.avail_out = inflated_size;
zlib_stream.next_out = inflated_data;
+ }
// Now read the remaining chunks of the file
while (png_data_ptr < (png_data + data_size))
@@ -567,6 +571,8 @@ static int readpng(unsigned char *buf, unsigned char *pal, int width, int height
}
}
+ if (buf)
+ {
if (zlib_stream.avail_out != 0)
{
printf("error: incomplete compressed stream\n");
@@ -581,6 +587,7 @@ static int readpng(unsigned char *buf, unsigned char *pal, int width, int height
{
png_decode_regular(buf, inflated_data, width, height);
}
+ }
inflateEnd(&zlib_stream);
free(inflated_data);
