diff options
| author | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-09-12 08:22:09 -0500 |
|---|---|---|
| committer | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-09-12 08:22:09 -0500 |
| commit | 61d29bfc805e95b8f62cc96b4965092cf4396371 (patch) | |
| tree | 3677bcea5e7b331569a45f9ff8c4b1da47dca91b /png.c | |
| parent | 0f2adc19eb971903fff6168a41f50e5ca362f86e (diff) | |
| download | libpng-61d29bfc805e95b8f62cc96b4965092cf4396371.tar.gz | |
[libpng16] Guard against Uninitialized Memory Read in png_check_icc_table(),
detected by the oss-fuzz project.
Diffstat (limited to 'png.c')
| -rw-r--r-- | png.c | 7 |
1 files changed, 5 insertions, 2 deletions
@@ -816,14 +816,14 @@ png_get_copyright(png_const_structrp png_ptr) #else # ifdef __STDC__ return PNG_STRING_NEWLINE \ - "libpng version 1.6.33beta03 - September 10, 2017" PNG_STRING_NEWLINE \ + "libpng version 1.6.33beta03 - September 12, 2017" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson" \ PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ PNG_STRING_NEWLINE; # else - return "libpng version 1.6.33beta03 - September 10, 2017\ + return "libpng version 1.6.33beta03 - September 12, 2017\ Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson\ Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."; @@ -2228,6 +2228,9 @@ png_icc_check_tag_table(png_const_structrp png_ptr, png_colorspacerp colorspace, /* This is a hard error; potentially it can cause read outside the * profile. */ + if (tag > profile + 11) + return png_icc_profile_error(png_ptr, colorspace, name, tag_id, + "ICC profile tag table truncated"); if (tag_start > profile_length || tag_length > profile_length - tag_start) return png_icc_profile_error(png_ptr, colorspace, name, tag_id, "ICC profile tag outside profile"); |