Fix undefined behavior in libpng

third_party/libpng/pngpread.c

 
 /* pngpread.c - read a png file in push mode
  *
  * Last changed in libpng 1.6.18 [July 23, 2015]
  * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
@@ skipping 481 matching lines @@
       old_buffer = png_ptr->save_buffer;
       png_ptr->save_buffer = (png_bytep)png_malloc_warn(png_ptr,
           (png_size_t)new_max);
 
       if (png_ptr->save_buffer == NULL)
       {
          png_free(png_ptr, old_buffer);
          png_error(png_ptr, "Insufficient memory for save_buffer");
       }
 
+#if 0
+      // This is the code checked into libpng. Calling memcpy with a null
+      // source is undefined, even if count is 0, but libpng does not
+      // currently check for null or 0. The Skia fix is below.
+      // skbug.com/5390
       memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
+#else
+      if (old_buffer)
+         memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
+      else if (png_ptr->save_buffer_size)
+         png_error(png_ptr, "save_buffer error");
+#endif
       png_free(png_ptr, old_buffer);
       png_ptr->save_buffer_max = new_max;
    }
    if (png_ptr->current_buffer_size)
    {
       memcpy(png_ptr->save_buffer + png_ptr->save_buffer_size,
          png_ptr->current_buffer_ptr, png_ptr->current_buffer_size);
       png_ptr->save_buffer_size += png_ptr->current_buffer_size;
       png_ptr->current_buffer_size = 0;
    }
@@ skipping 563 matching lines @@
 
 png_voidp PNGAPI
 png_get_progressive_ptr(png_const_structrp png_ptr)
 {
    if (png_ptr == NULL)
       return (NULL);
 
    return png_ptr->io_ptr;
 }
 #endif /* PROGRESSIVE_READ */