Fix for multiPNG handling.

If the last IDAT block had a length of exactly 4, containing only the
deflate CRC, the PNG would be badly reconstructed from the PCF.
This commit is contained in:
Deus Libri 2018-06-24 02:44:06 +02:00
parent 78b918dc18
commit 43fd8d82be

View file

@ -5904,12 +5904,12 @@ void try_decompression_png_multi(FILE* fpng, int windowbits) {
int i = 1;
int idat_pos = idat_lengths[0] - 2;
unsigned int idat_pairs_written_count = 0;
if (idat_pos <= rdres.compressed_stream_size) {
if (idat_pos < rdres.compressed_stream_size) {
do {
idat_pairs_written_count++;
idat_pos += idat_lengths[i];
if (idat_pos > rdres.compressed_stream_size) break;
if (idat_pos >= rdres.compressed_stream_size) break;
i++;
} while (i < idat_count);
@ -5924,7 +5924,7 @@ void try_decompression_png_multi(FILE* fpng, int windowbits) {
i = 1;
idat_pos = idat_lengths[0] - 2;
idat_pairs_written_count = 0;
if (idat_pos <= rdres.compressed_stream_size) {
if (idat_pos < rdres.compressed_stream_size) {
do {
fout_fput32(idat_crcs[i]);
fout_fput_vlint(idat_lengths[i]);
@ -5932,7 +5932,7 @@ void try_decompression_png_multi(FILE* fpng, int windowbits) {
idat_pairs_written_count++;
idat_pos += idat_lengths[i];
if (idat_pos > rdres.compressed_stream_size) break;
if (idat_pos >= rdres.compressed_stream_size) break;
i++;
} while (i < idat_count);