diff options
| -rw-r--r-- | pngset.c | 18 |
1 files changed, 14 insertions, 4 deletions
@@ -667,22 +667,26 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr, */ if (info_ptr->num_text + num_text > info_ptr->max_text) { + int old_max_text = info_ptr->max_text; + int old_num_text = info_ptr->num_text; + if (info_ptr->text != NULL) { png_textp old_text; - int old_max; - old_max = info_ptr->max_text; info_ptr->max_text = info_ptr->num_text + num_text + 8; old_text = info_ptr->text; + info_ptr->text = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)(info_ptr->max_text * png_sizeof(png_text))); if (info_ptr->text == NULL) { - png_free(png_ptr, old_text); + /* Restore to previous condition */ + info_ptr->max_text = old_max_text; + info_ptr->text = old_text; return(1); } - png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max * + png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max_text * png_sizeof(png_text))); png_free(png_ptr, old_text); } @@ -693,7 +697,12 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr, info_ptr->text = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)(info_ptr->max_text * png_sizeof(png_text))); if (info_ptr->text == NULL) + { + /* Restore to previous condition */ + info_ptr->num_text = old_num_text; + info_ptr->max_text = old_max_text; return(1); + } #ifdef PNG_FREE_ME_SUPPORTED info_ptr->free_me |= PNG_FREE_TEXT; #endif @@ -701,6 +710,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr, png_debug1(3, "allocated %d entries for info_ptr->text", info_ptr->max_text); } + for (i = 0; i < num_text; i++) { png_size_t text_length, key_len; |