mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng16] Still another attempt to fix oss-fuzz uninitialized value

Browse Source
This commit is contained in:
Glenn Randers-Pehrson 2017-09-15 08:20:23 -05:00
parent 1c98b85886
commit d1a0937cae
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
png.c
View File

@ -2208,15 +2208,18 @@ png_icc_check_tag_table(png_const_structrp png_ptr, png_colorspacerp colorspace,
png_uint_32 tag_count = png_get_uint_32(profile+128); png_uint_32 tag_count = png_get_uint_32(profile+128);
png_uint_32 itag; png_uint_32 itag;
png_const_bytep tag = profile+132; /* The first tag */ png_const_bytep tag = profile+132; /* The first tag */
png_uint_32 tag_start = 0;
png_uint_32 tag_id = 0;
png_uint_32 tag_length = 0;
/* First scan all the tags in the table and add bits to the icc_info value /* First scan all the tags in the table and add bits to the icc_info value
* (temporarily in 'tags'). * (temporarily in 'tags').
*/ */
for (itag=0; itag < tag_count; ++itag, tag += 12) for (itag=0; itag < tag_count; ++itag, tag += 12)
{ {
png_uint_32 tag_id = png_get_uint_32(tag+0); tag_id = png_get_uint_32(tag+0);
png_uint_32 tag_start = png_get_uint_32(tag+4); /* must be aligned */ tag_length = png_get_uint_32(tag+8);/* not padded */
png_uint_32 tag_length = png_get_uint_32(tag+8);/* not padded */ tag_start = png_get_uint_32(tag+4); /* must be aligned */
/* The ICC specification does not exclude zero length tags, therefore the /* The ICC specification does not exclude zero length tags, therefore the
* start might actually be anywhere if there is no data, but this would be * start might actually be anywhere if there is no data, but this would be
@ -2226,7 +2229,7 @@ png_icc_check_tag_table(png_const_structrp png_ptr, png_colorspacerp colorspace,
*/ */
/* This is a hard error; potentially it can cause read outside the /* This is a hard error; potentially it can cause read outside the
* profile. Oss-fuzz detects a potential UMR in tag_start reference. * profile.
*/ */
if (tag_start > profile_length || tag_length > profile_length - tag_start) if (tag_start > profile_length || tag_length > profile_length - tag_start)
return png_icc_profile_error(png_ptr, colorspace, name, tag_id, return png_icc_profile_error(png_ptr, colorspace, name, tag_id,

2
pngset.c
View File

@ -881,7 +881,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
} }
# endif # endif
/* oss-fuzz detects a potential UMR here */ /* oss-fuzz detects potential use of uninitialized value here */
if (text_ptr[i].text == NULL || text_ptr[i].text[0] == '\0') if (text_ptr[i].text == NULL || text_ptr[i].text[0] == '\0')
{ {
text_length = 0; text_length = 0;