io-png.c (png_row_callback): Check that row_num is valid.

diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index b120b2f983afcdac600f6d30ea05558aa310fb9d..0b0a71e0c445a87a7711ffbf85269d4828396b1b 100644 (file)
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,7 @@
+Thu Aug 30 08:27:37 2001  Matthias Clasen  <matthiasc@poet.de>
+
+       * io-png.c (png_row_callback): Check that row_num is valid.
+
 Tue Aug 28 21:05:26 2001  Matthias Clasen  <matthiasc@poet.de>
 
        * io-bmp.c (OneLine): Emit area_updated signal with proper

diff --git a/gdk-pixbuf/io-png.c b/gdk-pixbuf/io-png.c
index 0e582eb9068058a4817c8c03d10fe6d71e6423ce..f434e699d40bcf0a66fc9847eb484a365caca992 100644 (file)
--- a/gdk-pixbuf/io-png.c
+++ b/gdk-pixbuf/io-png.c
@@ -563,6 +563,17 @@ png_row_callback   (png_structp png_read_ptr,
         if (lc->fatal_error_occurred)
                 return;
 
+        if (row_num < 0 || row_num >= lc->pixbuf->height) {
+                lc->fatal_error_occurred = TRUE;
+                if (lc->error && *lc->error == NULL) {
+                        g_set_error (lc->error,
+                                     GDK_PIXBUF_ERROR,
+                                     GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+                                     _("Fatal error reading PNG image file"));
+                }
+                return;
+        }
+
         if (lc->first_row_seen_in_chunk < 0) {
                 lc->first_row_seen_in_chunk = row_num;
                 lc->first_pass_seen_in_chunk = pass_num;