From 1b2ae5110dfc68a50ab4b6e653e1f2f2883c5230 Mon Sep 17 00:00:00 2001
From: Dirk Lemstra <dirk@git.imagemagick.org>
Date: Tue, 19 Jun 2018 07:16:50 +0200
Subject: [PATCH] Added options to set png_set_chunk_cache_max and
 png_set_chunk_malloc_max.

---
 coders/png.c | 40 +++++++++++++++++++++++++---------------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/coders/png.c b/coders/png.c
index 058594e13..8547cad3e 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -2426,12 +2426,31 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
 #endif
 
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
-  /* Reject images with too many rows or columns */
-  png_set_user_limits(ping,
-    (png_uint_32) MagickMin(0x7fffffffL,
-        GetMagickResourceLimit(WidthResource)),
-    (png_uint_32) MagickMin(0x7fffffffL,
-        GetMagickResourceLimit(HeightResource)));
+  {
+    const char
+      *option;
+
+    /* Reject images with too many rows or columns */
+    png_set_user_limits(ping,(png_uint_32) MagickMin(PNG_UINT_31_MAX,
+      GetMagickResourceLimit(WidthResource)),(png_uint_32)
+      MagickMin(PNG_UINT_31_MAX,GetMagickResourceLimit(HeightResource)));
+
+#if (PNG_LIBPNG_VER >= 10400)
+    option=GetImageOption(image_info,"png:chunk-cache-max");
+    if (option != (const char *) NULL)
+      png_set_chunk_cache_max(ping,(png_uint_32) MagickMin(PNG_UINT_32_MAX,
+        StringToLong(option)));
+    else
+      png_set_chunk_cache_max(ping,32767);
+#endif
+
+#if (PNG_LIBPNG_VER >= 10401)
+    option=GetImageOption(image_info,"png:chunk-malloc-max");
+    if (option != (const char *) NULL)
+      png_set_chunk_malloc_max(ping,(png_alloc_size_t) MagickMin(PNG_SIZE_MAX,
+        StringToLong(option)));
+#endif
+  }
 #endif /* PNG_SET_USER_LIMITS_SUPPORTED */
 
   /*
@@ -2522,15 +2541,6 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
   png_set_read_user_chunk_fn(ping, image, read_user_chunk_callback);
 #endif
 
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
-#  if (PNG_LIBPNG_VER >= 10400)
-    /* Limit the size of the chunk storage cache used for sPLT, text,
-     * and unknown chunks.
-     */
-    png_set_chunk_cache_max(ping, 32767);
-#  endif
-#endif
-
 #ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
     /* Disable new libpng-1.5.10 feature */
     png_set_check_for_invalid_index (ping, 0);
-- 
2.40.0