From 97dd654ba42a698ae61941791bf99435bd30bafa Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Wed, 5 Nov 2014 09:22:19 -0600
Subject: [PATCH] [libpng16] Avoid out-of-bounds memory access in
 png_user_version_check().

---
 ANNOUNCE | 1 +
 CHANGES  | 1 +
 png.c    | 9 +++++----
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/ANNOUNCE b/ANNOUNCE
index 5f1977a17..3a6cfd85a 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -43,6 +43,7 @@ Version 1.6.15beta04 [November 4, 2014]
 Version 1.6.15beta05 [November 5, 2014]
   Use png_get_libpng_ver(NULL) instead of PNG_LIBPNG_VER_STRING in
     example.c, pngtest.c, and applications in the contrib directory.
+  Avoid out-of-bounds memory access in png_user_version_check().
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/CHANGES b/CHANGES
index 00933ce6b..a153e4fab 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5051,6 +5051,7 @@ Version 1.6.15beta04 [November 4, 2014]
 Version 1.6.15beta05 [November 5, 2014]
   Use png_get_libpng_ver(NULL) instead of PNG_LIBPNG_VER_STRING in
     example.c, pngtest.c, and applications in the contrib directory.
+  Avoid out-of-bounds memory access in png_user_version_check().
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/png.c b/png.c
index 37db7d62f..1d1bf8bdf 100644
--- a/png.c
+++ b/png.c
@@ -167,13 +167,14 @@ png_user_version_check(png_structrp png_ptr, png_const_charp user_png_ver)
 {
    if (user_png_ver != NULL)
    {
-      int i = 0;
+      int i = -1;
 
       do
       {
+         i++;
          if (user_png_ver[i] != png_libpng_ver[i])
             png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
-      } while (png_libpng_ver[i++]);
+      } while (png_libpng_ver[i] != 0 && user_png_ver[i] != 0);
    }
 
    else
@@ -771,13 +772,13 @@ png_get_copyright(png_const_structrp png_ptr)
 #else
 #  ifdef __STDC__
    return PNG_STRING_NEWLINE \
-     "libpng version 1.6.15beta05 - November 4, 2014" PNG_STRING_NEWLINE \
+     "libpng version 1.6.15beta05 - November 5, 2014" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.6.15beta05 - November 4, 2014\
+      return "libpng version 1.6.15beta05 - November 5, 2014\
       Copyright (c) 1998-2014 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";