From 8696147da438babdc30ea6fd291d1e8abb407828 Mon Sep 17 00:00:00 2001
From: Pascal Massimino <pascal.massimino@gmail.com>
Date: Fri, 8 Jan 2021 08:46:20 +0100
Subject: [PATCH] pngdec: raise memory limit if needed

Some PNG input contain chunks larger than libpng's default
memory-alloc limit (8M).
Raise this limit reasonably if it looks like the input bitstream
is larger than libpng's default limit.

BUG=webp:497

Change-Id: I2c9fbed727424042444b82cbf15e0781cefb38dc
---
 imageio/pngdec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/imageio/pngdec.c b/imageio/pngdec.c
index 054c999eb..e0b152edd 100644
--- a/imageio/pngdec.c
+++ b/imageio/pngdec.c
@@ -259,6 +259,12 @@ int ReadPNG(const uint8_t* const data, size_t data_size,
     goto End;
   }
 
+  // If it looks like the bitstream is going to need more memory than libpng's
+  // internal limit (default: 8M), try to (reasonably) raise it.
+  if (data_size > png_get_chunk_malloc_max(png) && data_size < (1u << 24)) {
+    png_set_chunk_malloc_max(png, data_size);
+  }
+
   info = png_create_info_struct(png);
   if (info == NULL) goto Error;
   end_info = png_create_info_struct(png);