diff --git a/ANNOUNCE b/ANNOUNCE index 5f1977a17..3a6cfd85a 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -43,6 +43,7 @@ Version 1.6.15beta04 [November 4, 2014] Version 1.6.15beta05 [November 5, 2014] Use png_get_libpng_ver(NULL) instead of PNG_LIBPNG_VER_STRING in example.c, pngtest.c, and applications in the contrib directory. + Avoid out-of-bounds memory access in png_user_version_check(). Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index 00933ce6b..a153e4fab 100644 --- a/CHANGES +++ b/CHANGES @@ -5051,6 +5051,7 @@ Version 1.6.15beta04 [November 4, 2014] Version 1.6.15beta05 [November 5, 2014] Use png_get_libpng_ver(NULL) instead of PNG_LIBPNG_VER_STRING in example.c, pngtest.c, and applications in the contrib directory. + Avoid out-of-bounds memory access in png_user_version_check(). Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/png.c b/png.c index 37db7d62f..1d1bf8bdf 100644 --- a/png.c +++ b/png.c @@ -167,13 +167,14 @@ png_user_version_check(png_structrp png_ptr, png_const_charp user_png_ver) { if (user_png_ver != NULL) { - int i = 0; + int i = -1; do { + i++; if (user_png_ver[i] != png_libpng_ver[i]) png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH; - } while (png_libpng_ver[i++]); + } while (png_libpng_ver[i] != 0 && user_png_ver[i] != 0); } else @@ -771,13 +772,13 @@ png_get_copyright(png_const_structrp png_ptr) #else # ifdef __STDC__ return PNG_STRING_NEWLINE \ - "libpng version 1.6.15beta05 - November 4, 2014" PNG_STRING_NEWLINE \ + "libpng version 1.6.15beta05 - November 5, 2014" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ PNG_STRING_NEWLINE; # else - return "libpng version 1.6.15beta05 - November 4, 2014\ + return "libpng version 1.6.15beta05 - November 5, 2014\ Copyright (c) 1998-2014 Glenn Randers-Pehrson\ Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";