From 1a3d6e3cf3082a0da998dbf402d384a589488859 Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Thu, 10 Jan 2013 09:24:03 -0600
Subject: [PATCH] [libpng15] Check validity of "num_unknowns" parameter

of png_set_unknown_chunks().
---
 pngset.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pngset.c b/pngset.c
index 5472d46..94e5c92 100644
--- a/pngset.c
+++ b/pngset.c
@@ -1024,9 +1024,17 @@ png_set_unknown_chunks(png_structp png_ptr,
    if (png_ptr == NULL || info_ptr == NULL || num_unknowns == 0)
       return;
 
-   np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
-       (png_uint_32)((info_ptr->unknown_chunks_num + num_unknowns) *
-       png_sizeof(png_unknown_chunk)));
+   if (num_unknowns < 0 ||
+       num_unknowns >= UINT_MAX-info_ptr->unknown_chunks_num ||
+       num_unknowns >= PNG_SIZE_MAX/png_sizeof(png_unknown_chunk)
+       - info_ptr->unknown_chunks_num)
+      np=NULL;
+
+   else
+      np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
+          (png_uint_32)(info_ptr->unknown_chunks_num + num_unknowns) *
+          png_sizeof(png_unknown_chunk));
+
    if (np == NULL)
    {
       png_warning(png_ptr,
-- 
2.23.0