From 2feb141b6f74ce425fed3272286fab1f50366bb9 Mon Sep 17 00:00:00 2001
From: glennrp <glennrp@git.imagemagick.org>
Date: Tue, 22 Jan 2013 15:02:16 +0000
Subject: [PATCH] Impose a 65k limit on the number of text chunks to store.
---
coders/png.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/coders/png.c b/coders/png.c
index def0f86bd..e40c9c958 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -2287,6 +2287,13 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
png_set_read_user_chunk_fn(ping, image, read_vpag_chunk_callback);
#endif
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+ /* Limit the size of the chunk storage cache used for sPLT, text,
+ * and unknown chunks, and for expansion of iTXt, zTXt, and iCCP chunks.
+ */
+ png_set_chunk_cache_max(ping, 65536);
+#endif
+
#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
/* Disable new libpng-1.5.10 feature */
png_set_check_for_invalid_index (ping, 0);
@@ -8063,8 +8070,8 @@ static MagickBooleanType WriteOnePNGImage(MngInfo *mng_info,
/* Avoid the expensive BUILD_PALETTE operation if we're sure that we
* are not going to need the result.
*/
- image_colors=image->colors;
- number_opaque = image->colors;
+ image_colors = (int) image->colors;
+ number_opaque = (int) image->colors;
if (mng_info->write_png_colortype == 1 ||
mng_info->write_png_colortype == 5)
ping_have_color=MagickFalse;
--
2.40.0