cheng/libpng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[libpng16] Guard against Uninitialized Memory Read in png_check_icc_table(),

Browse Source 
detected by the oss-fuzz project.
This commit is contained in:
Glenn Randers-Pehrson 2017-09-12 08:22:09 -05:00
parent 0f2adc19eb
commit 61d29bfc80
3 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ANNOUNCE
View File

@ -1,4 +1,4 @@
Libpng 1.6.33beta03 - September 8, 2017
Libpng 1.6.33beta03 - September 12, 2017
This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
@ -39,12 +39,14 @@ Version 1.6.33beta02 [September 3, 2017]
changed date of contrib/oss-fuzz files.
Enabled ARM support in CMakeLists.txt (Bernd Kuhls).
Version 1.6.33beta03 [September 8, 2017]
Version 1.6.33beta03 [September 12, 2017]
Fixed incorrect typecast of some arguments to png_malloc() and
png_calloc() that were png_uint_32 instead of png_alloc_size_t
(Bug report by "irwir" in Github libpng issue #175).
Use pnglibconf.h.prebuilt when building for ANDROID with cmake (Github
issue 162, by rcdailey).
Guard against Uninitialized Memory Read in png_check_icc_table(), detected
by the oss-fuzz project.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

4
CHANGES
View File

@ -6009,12 +6009,14 @@ Version 1.6.33beta02 [September 3, 2017]
changed date of contrib/oss-fuzz files.
Enabled ARM support in CMakeLists.txt (Bernd Kuhls).
Version 1.6.33beta03 [September 8, 2017]
Version 1.6.33beta03 [September 12, 2017]
Fixed incorrect typecast of some arguments to png_malloc() and
png_calloc() that were png_uint_32 instead of png_alloc_size_t
(Bug report by "irwir" in Github libpng issue #175).
Use pnglibconf.h.prebuilt when building for ANDROID with cmake (Github
issue 162, by rcdailey).
Guard against Uninitialized Memory Read in png_check_icc_table(), detected
by the oss-fuzz project.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit

7
png.c
View File

@ -816,14 +816,14 @@ png_get_copyright(png_const_structrp png_ptr)
#else
# ifdef __STDC__
return PNG_STRING_NEWLINE \
"libpng version 1.6.33beta03 - September 10, 2017" PNG_STRING_NEWLINE \
"libpng version 1.6.33beta03 - September 12, 2017" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson" \
PNG_STRING_NEWLINE \
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
"Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
PNG_STRING_NEWLINE;
# else
return "libpng version 1.6.33beta03 - September 10, 2017\
return "libpng version 1.6.33beta03 - September 12, 2017\
Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson\
Copyright (c) 1996-1997 Andreas Dilger\
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
@ -2228,6 +2228,9 @@ png_icc_check_tag_table(png_const_structrp png_ptr, png_colorspacerp colorspace,
/* This is a hard error; potentially it can cause read outside the
* profile.
*/
if (tag > profile + 11)
return png_icc_profile_error(png_ptr, colorspace, name, tag_id,
"ICC profile tag table truncated");
if (tag_start > profile_length || tag_length > profile_length - tag_start)
return png_icc_profile_error(png_ptr, colorspace, name, tag_id,
"ICC profile tag outside profile");