Impose a 65k limit on the number of text chunks to store.

diff --git a/coders/png.c b/coders/png.c
index def0f86bd9d53180a5b4a112ea55514f963ba4ec..e40c9c95822f36a294b717374b0c86c8396dc925 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -2287,6 +2287,13 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
   png_set_read_user_chunk_fn(ping, image, read_vpag_chunk_callback);
 #endif
 
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+    /* Limit the size of the chunk storage cache used for sPLT, text,
+     * and unknown chunks, and for expansion of iTXt, zTXt, and iCCP chunks.
+     */
+    png_set_chunk_cache_max(ping, 65536);
+#endif
+
 #ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
     /* Disable new libpng-1.5.10 feature */
     png_set_check_for_invalid_index (ping, 0);
@@ -8063,8 +8070,8 @@ static MagickBooleanType WriteOnePNGImage(MngInfo *mng_info,
      /* Avoid the expensive BUILD_PALETTE operation if we're sure that we
       * are not going to need the result.
       */
-     image_colors=image->colors;
-     number_opaque = image->colors;
+     image_colors = (int) image->colors;
+     number_opaque = (int) image->colors;
      if (mng_info->write_png_colortype == 1 ||
         mng_info->write_png_colortype == 5)
        ping_have_color=MagickFalse;