diff --git a/pngrutil.c b/pngrutil.c

index 4ef05fe..f6f0864 100644

--- a/pngrutil.c

+++ b/pngrutil.c

@@ -596,7 +596,7 @@ void /* PRIVATE */

png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

{

png_color palette[PNG_MAX_PALETTE_LENGTH];

- int num, i;

+ int max_palette_length, num, i;

#ifdef PNG_POINTER_INDEXING_SUPPORTED

png_colorp pal_ptr;

#endif

@@ -648,9 +648,21 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

png_error(png_ptr, "Invalid palette chunk");

}

}

-

+ /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */

num = (int)length / 3;

+ /* If the palette has 256 or fewer entries but is too large for the bit

+ * depth, we don't issue an error, to preserve the behavior of previous

+ * libpng versions. We silently truncate the unused extra palette entries

+ * here.

+ */

+ if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

+ max_palette_length = (1 << png_ptr->bit_depth);

+ else

+ max_palette_length = PNG_MAX_PALETTE_LENGTH;

+ if (num > max_palette_length)

+ num = max_palette_length;

+

#ifdef PNG_POINTER_INDEXING_SUPPORTED

for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)

{

@@ -683,7 +695,7 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

#endif

{

- png_crc_finish(png_ptr, 0);

+ png_crc_finish(png_ptr, (int) length - num * 3);

}

#ifndef PNG_READ_OPT_PLTE_SUPPORTED

diff --git a/pngset.c b/pngset.c

index 8e3f39a..c252088 100644

--- a/pngset.c

+++ b/pngset.c

@@ -517,13 +517,17 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,

png_const_colorp palette, int num_palette)

{

+ png_uint_32 max_palette_length;

+

png_debug1(1, "in %s storage function", "PLTE");

if (png_ptr == NULL || info_ptr == NULL)

return;

- if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH)

- {

+ max_palette_length = (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?

+ (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;

+

+ if (num_palette < 0 || num_palette > (int) max_palette_length) {

if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

png_error(png_ptr, "Invalid palette length");

@@ -551,8 +555,8 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,

png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);

/* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead

- * of num_palette entries, in case of an invalid PNG file that has

- * too-large sample values.

+ * of num_palette entries, in case of an invalid PNG file or incorrect

+ * call to png_set_PLTE() with too-large sample values.

*/

png_ptr->palette = (png_colorp)png_calloc(png_ptr,

PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));

diff --git a/pngwutil.c b/pngwutil.c

index 19b75af..7ecaaca 100644

--- a/pngwutil.c

+++ b/pngwutil.c

@@ -896,17 +896,20 @@ void /* PRIVATE */

png_write_PLTE(png_structp png_ptr, png_const_colorp palette,

png_uint_32 num_pal)

{

- png_uint_32 i;

+ png_uint_32 max_palette_length, i;

png_const_colorp pal_ptr;

png_byte buf[3];

+ max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?

+ (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;

+

png_debug(1, "in png_write_PLTE");

if ((

#ifdef PNG_MNG_FEATURES_SUPPORTED

!(png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) &&

#endif

- num_pal == 0) || num_pal > 256)

+ num_pal == 0) || num_pal > max_palette_length)

{

if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

{