mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng16] Guard against Uninitialized Memory Read in png_check_icc_table(),

Browse Source 
detected by the oss-fuzz project.
This commit is contained in:
Glenn Randers-Pehrson
2017-09-12 08:22:09 -05:00
parent 0f2adc19eb
commit 61d29bfc80
3 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
png.c
View File

@@ -816,14 +816,14 @@ png_get_copyright(png_const_structrp png_ptr)
#else
# ifdef __STDC__
return PNG_STRING_NEWLINE \
"libpng version 1.6.33beta03 - September 10, 2017" PNG_STRING_NEWLINE \
"libpng version 1.6.33beta03 - September 12, 2017" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson" \
PNG_STRING_NEWLINE \
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
"Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
PNG_STRING_NEWLINE;
# else
return "libpng version 1.6.33beta03 - September 10, 2017\
return "libpng version 1.6.33beta03 - September 12, 2017\
Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson\
Copyright (c) 1996-1997 Andreas Dilger\
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
@@ -2228,6 +2228,9 @@ png_icc_check_tag_table(png_const_structrp png_ptr, png_colorspacerp colorspace,
/* This is a hard error; potentially it can cause read outside the
* profile.
*/
if (tag > profile + 11)
return png_icc_profile_error(png_ptr, colorspace, name, tag_id,
"ICC profile tag table truncated");
if (tag_start > profile_length || tag_length > profile_length - tag_start)
return png_icc_profile_error(png_ptr, colorspace, name, tag_id,
"ICC profile tag outside profile");