diff --git a/pngrtran.c b/pngrtran.c index 5673193..04eecee 100644 --- a/pngrtran.c +++ b/pngrtran.c @@ -1900,6 +1900,9 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr) info_ptr->bit_depth = 8; info_ptr->num_trans = 0; + + if (png_ptr->palette == NULL) + png_error (png_ptr, "Palette is NULL in indexed image"); } else { diff --git a/pngset.c b/pngset.c index 4177e62..3876103 100644 --- a/pngset.c +++ b/pngset.c @@ -524,6 +524,16 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr, return; } } + if ((num_palette > 0 && palette == NULL) || + (num_palette == 0 + # ifdef PNG_MNG_FEATURES_SUPPORTED + && (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0 + # endif + )) + { + png_error(png_ptr, "Invalid palette"); + return; + } /* It may not actually be necessary to set png_ptr->palette here; * we do it for backward compatibility with the way the png_handle_tRNS