From fcf71a89265c78fc26243574dda3a872574a5c02 Mon Sep 17 00:00:00 2001
From: Andrea Mazzoleni <amadvance@gmail.com>
Date: Fri, 1 Mar 2019 20:40:25 +0100
Subject: [PATCH] Fix a buffer overflow with image of invalid size

---
 doc/history.d | 4 ++--
 lib/png.c     | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

#diff --git a/doc/history.d b/doc/history.d
#index f36ca56..e842c57 100644
#--- a/doc/history.d
#+++ b/doc/history.d
#@@ -1,8 +1,8 @@
# Name
# 	advcomp - History For AdvanceCOMP
# 
#-AdvanceCOMP Version 2.2 2019/01
#-	) Fixed two crash conditions with invalid PNG/MNG files.
#+AdvanceCOMP Version 2.2 2019/03
#+	) Fixed multiple crash conditions with invalid PNG/MNG files.
# 
# AdvanceCOMP Version 2.1 2018/02
# 	) Support ZIPs with data descriptor signature.
Index: advancecomp-1.18/lib/png.c
===================================================================
--- advancecomp-1.18.orig/lib/png.c
+++ advancecomp-1.18/lib/png.c
@@ -655,6 +655,11 @@ adv_error adv_png_read_ihdr(
 	}
 	*pix_pixel = pixel;
 
+	if (width_align < width) {
+		error_unsupported_set("Invalid image size");
+		goto err;
+	}
+
 	if (data[10] != 0) { /* compression */
 		error_unsupported_set("Unsupported compression, %d instead of 0", (unsigned)data[10]);
 		goto err;
