mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

fix: png_write_iCCP check on profile length

Browse Source 
This is a regression of commit a8242dd947
"PNGv3 colourspace precedence rules conformance".

Previously, `png_write_iCCP` used the length from the first four bytes
of the profile set by `png_set_iCCP`, rather than the actual data length
recorded by `png_set_iCCP`.

If the profile data were less than 4 bytes long, it would have caused
a read-beyond-end-of-malloc error.  This bug was in the libpng code even
before the changes introduced in the above-mentioned commit, but it was
inaccessible.  It became accessible when we removed the pre-PNGv3 colour
space checks in `png_set_iCCP`.

Reported-by: Bob Friesenhahn <bobjfriesenhahn@gmail.com>
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This commit is contained in:
John Bowler
2025-01-29 18:42:22 -08:00
committed by Cosmin Truta
parent 8c7ed2e3b2
commit 68e090e700
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pngwrite.c
View File

@@ -196,7 +196,7 @@ png_write_info_before_PLTE(png_structrp png_ptr, png_const_inforp info_ptr)
if ((info_ptr->valid & PNG_INFO_iCCP) != 0)
{
png_write_iCCP(png_ptr, info_ptr->iccp_name,
info_ptr->iccp_profile);
info_ptr->iccp_profile, info_ptr->iccp_proflen);
}
# endif