Fix array bounds checking for tIME chunk

git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@1596 9d0c8265-081b-0410-96cb-a4ca84ce46f8

2 files changed, 16 insertions, 7 deletions

diff --git a/converter/other/pngtopam.c b/converter/other/pngtopam.c
index 21bc7f82..4789d6d8 100644
--- a/converter/other/pngtopam.c
+++ b/converter/other/pngtopam.c
@@ -573,13 +573,20 @@ showTime(struct pngx * const pngxP) {
             "July", "August", "September", "October", "November", "December"
         };
 
-        pm_message("modification time: %02d %s %d %02d:%02d:%02d",
-                   modTime.day,
-                   month[modTime.month],
-                   modTime.year,
-                   modTime.hour,
-                   modTime.minute,
-                   modTime.second);
+        if (modTime.month < 1 || modTime.month >= ARRAY_SIZE(month)) {
+            pm_message("tIME chunk in PNG input is invalid; "
+                       "modification time of image is unknown.  "
+                       "The month value, which should be in the range "
+                       "1-12, is %u", modTime.month);
+        } else {
+            pm_message("modification time: %02d %s %d %02d:%02d:%02d",
+                       modTime.day,
+                       month[modTime.month],
+                       modTime.year,
+                       modTime.hour,
+                       modTime.minute,
+                       modTime.second);
+        }
     }
 }
 
diff --git a/doc/HISTORY b/doc/HISTORY
index fc86e3a6..741df6c0 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -8,6 +8,8 @@ not yet  BJH  Release 10.57.00
 
               pnmnorm: add -midvalue, -middle .
 
+              pngtopam: fix crash with invalid tIME chunk.  Always broken.
+
               pamarith: fix wrong result with -multiply.  Broken in 10.41.
 
 11.09.28 BJH  Release 10.56.00