diff --git a/ANNOUNCE b/ANNOUNCE index b943a5d12..469812dde 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -45,8 +45,10 @@ Version 1.6.33beta03 [September 12, 2017] (Bug report by "irwir" in Github libpng issue #175). Use pnglibconf.h.prebuilt when building for ANDROID with cmake (Github issue 162, by rcdailey). - Guard against Uninitialized Memory Read in png_check_icc_table(), detected - by the oss-fuzz project. + Guard against Uninitialized Memory Read in png_icc_check_tag_table(), + detected by the oss-fuzz project. + Attempt to debug Uninitialized Memory Read in png_set_text_2(), + detected by the oss-fuzz project. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index 95e4441ef..68aa471b7 100644 --- a/CHANGES +++ b/CHANGES @@ -6015,8 +6015,10 @@ Version 1.6.33beta03 [September 12, 2017] (Bug report by "irwir" in Github libpng issue #175). Use pnglibconf.h.prebuilt when building for ANDROID with cmake (Github issue 162, by rcdailey). - Guard against Uninitialized Memory Read in png_check_icc_table(), detected - by the oss-fuzz project. + Guard against Uninitialized Memory Read in png_icc_check_tag_table(), + detected by the oss-fuzz project. + Attempt to debug Uninitialized Memory Read in png_set_text_2(), + detected by the oss-fuzz project. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/pngset.c b/pngset.c index d5e683ba1..7498b6764 100644 --- a/pngset.c +++ b/pngset.c @@ -886,10 +886,11 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr, if (text_ptr[i].text == NULL) text_is_null=1; - else if (text_ptr[i].text[0] == '\0') + else if (text_ptr[i].text[0] == '\0') /* FIX THIS */ text_0_is_0=1; - if (text_is_null) + /* oss-fuzz complains of UMR on the reference to text_0_is_0 */ + if (text_is_null || text_0_is_0) { text_length = 0; # ifdef PNG_iTXt_SUPPORTED @@ -900,18 +901,6 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr, # endif textp->compression = PNG_TEXT_COMPRESSION_NONE; } - else if (text_0_is_0) - { - text_length = 0; -# ifdef PNG_iTXt_SUPPORTED - if (text_ptr[i].compression > 0) - textp->compression = PNG_ITXT_COMPRESSION_NONE; - - else -# endif - textp->compression = PNG_TEXT_COMPRESSION_NONE; - } - else { text_length = strlen(text_ptr[i].text);