diff --git a/pngpread.c b/pngpread.c index 978559adeb..71a2584394 100644 --- a/pngpread.c +++ b/pngpread.c @@ -269,10 +269,16 @@ png_push_read_chunk(png_struct *png_ptr, png_info *info_ptr) png_read_reset(png_ptr); png_ptr->mode &= ~PNG_HAVE_fcTL; - png_handle_fcTL(png_ptr, info_ptr, png_ptr->push_length); - - if (!(png_ptr->mode & PNG_HAVE_fcTL)) - png_error(png_ptr, "Missing required fcTL chunk in APNG stream"); + png_handle_fcTL(png_ptr, info_ptr, png_ptr->push_length); + + /* We only get here for an fcTL chunk, so if PNG_HAVE_fcTL was not + * set above the chunk was present but rejected (e.g. an oversized + * or misplaced frame description); say that rather than claiming + * that the chunk is missing. + */ + if (!(png_ptr->mode & PNG_HAVE_fcTL)) + png_error(png_ptr, + "Invalid or misplaced fcTL chunk in APNG stream"); png_read_reinit(png_ptr, info_ptr); png_progressive_read_reset(png_ptr); diff --git a/pngrutil.c b/pngrutil.c index 5dd5361671..cff37dc4e9 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -3232,7 +3232,14 @@ read_chunks[PNG_INDEX_unknown] = /* Allocates 'length+1'; checked in the handler */ # define CDtIME 7U, 7U, 0, hIHDR, 0 # define CDacTL 8U, 8U, hIDAT, hIHDR, 0 -# define CDfcTL 25U, 26U, 0, hIHDR, 1 +# define CDfcTL 26U, 26U, 0, hIHDR, 1 + /* The minimum and maximum fcTL lengths are equal because an fcTL is + * exactly 26 bytes long: a 4-byte big-endian sequence number followed by + * 22 bytes of frame data. The earlier value of 25U for max_length was + * inconsistent with min_length=26U and would have rejected every valid + * fcTL if this table entry were ever consulted (the handler is currently + * compiled out; see the '#define png_handle_fcTL NULL' above). + */ # define CDfdAT Limit, 4U, hIDAT, hIHDR, 1 /* Supported chunks from PNG extensions 1.5.0, NYI so limit */ # define CDoFFs 9U, 9U, hIDAT, hIHDR, 0