From 7a68c93ec6efc9a54efadfaa7284d48877de2b55 Mon Sep 17 00:00:00 2001
From: glennrp <glennrp@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
Date: Sun, 21 Dec 2014 17:18:01 +0000
Subject: [PATCH] Impose a limit of 10 million columns or rows in an input PNG.

git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17368 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
origin:  http://trac.imagemagick.org/changeset/17368
---
 coders/png.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/coders/png.c b/coders/png.c
index dd2f3e4..ba0b621 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -1815,6 +1815,17 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
         }
       return(GetFirstImageInList(image));
     }
+
+  /* {  For navigation to end of SETJMP-protected block.  Within this
+   *    block, use png_error() instead of Throwing an Exception, to ensure
+   *    that libpng is able to clean up, and that the semaphore is unlocked.
+   */
+
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+  /* Reject images with more than 10 million rows or columns */
+  png_set_user_limits(ping, 10000000L, 10000000L);
+#endif /* PNG_SET_USER_LIMITS_SUPPORTED */
+
   /*
     Prepare PNG for reading.
   */
-- 
2.1.4