Bug 1117406 - Fix handling of out-of-range PNG tRNS values. r=jmuizelaar, a=2.1+
authorGlenn Randers-Pehrson <glennrp+bmo@gmail.com>
Mon, 26 Jan 2015 16:07:00 -0500
changeset 221664 a20cbb3466e47f79c199bcac8e41ffa2376caeff
parent 221663 0ad6c4a55e181acbb82cfed6446ae546fbdb35c1
child 221665 bc93d4b84bb2ff19f3172a1088d9e4bd37271458
push id344
push userryanvm@gmail.com
push dateTue, 27 Jan 2015 03:07:58 +0000
treeherdermozilla-b2g34_v2_1@f37f23eb2ada [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjmuizelaar, 2
bugs1117406
milestone34.0
Bug 1117406 - Fix handling of out-of-range PNG tRNS values. r=jmuizelaar, a=2.1+
image/decoders/nsPNGDecoder.cpp
--- a/image/decoders/nsPNGDecoder.cpp
+++ b/image/decoders/nsPNGDecoder.cpp
@@ -526,34 +526,36 @@ nsPNGDecoder::info_callback(png_structp 
 
   if (color_type == PNG_COLOR_TYPE_PALETTE)
     png_set_expand(png_ptr);
 
   if (color_type == PNG_COLOR_TYPE_GRAY && bit_depth < 8)
     png_set_expand(png_ptr);
 
   if (png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)) {
-    int sample_max = (1 << bit_depth);
     png_color_16p trans_values;
     png_get_tRNS(png_ptr, info_ptr, &trans, &num_trans, &trans_values);
     /* libpng doesn't reject a tRNS chunk with out-of-range samples
        so we check it here to avoid setting up a useless opacity
-       channel or producing unexpected transparent pixels when using
-       libpng-1.2.19 through 1.2.26 (bug #428045) */
-    if ((color_type == PNG_COLOR_TYPE_GRAY &&
-       (int)trans_values->gray > sample_max) ||
-       (color_type == PNG_COLOR_TYPE_RGB &&
-       ((int)trans_values->red > sample_max ||
-       (int)trans_values->green > sample_max ||
-       (int)trans_values->blue > sample_max)))
+       channel or producing unexpected transparent pixels (bug #428045) */
+    if (bit_depth < 16) {
+      png_uint_16 sample_max = (1 << bit_depth) - 1;
+      if ((color_type == PNG_COLOR_TYPE_GRAY &&
+           trans_values->gray > sample_max) ||
+           (color_type == PNG_COLOR_TYPE_RGB &&
+           (trans_values->red > sample_max ||
+           trans_values->green > sample_max ||
+           trans_values->blue > sample_max)))
       {
         /* clear the tRNS valid flag and release tRNS memory */
         png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
+        num_trans = 0;
       }
-    else
+    }
+    if (num_trans != 0)
       png_set_expand(png_ptr);
   }
 
   if (bit_depth == 16)
     png_set_scale_16(png_ptr);
 
   qcms_data_type inType = QCMS_DATA_RGBA_8;
   uint32_t intent = -1;