This is an automated email from the git hooks/post-receive script.
git pushed a commit to branch master
in repository legacy-imlib2.
View the commit online.
commit 85813cf94c4e964613df2fd5960625ba7a48f169
Author: Acts1631 <[email protected]>
AuthorDate: Sat Jul 18 09:05:12 2026 -0400
png: validate APNG IHDR length
APNG frame loading copied an attacker-provided IHDR chunk length
into a fixed-size stack buffer. A malformed frame could corrupt
process memory.
Require the PNG-mandated 13-byte IHDR payload and copy the fixed
25-byte chunk record when constructing the frame header.
---
src/modules/loaders/loader_png.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/modules/loaders/loader_png.c b/src/modules/loaders/loader_png.c
index 4aa8fcf..c5dd95e 100644
--- a/src/modules/loaders/loader_png.c
+++ b/src/modules/loaders/loader_png.c
@@ -448,6 +448,8 @@ _load(ImlibImage *im, int load_data)
{
case PNG_TYPE_IHDR:
#define P (&chunk->ihdr)
+ if (len != 13)
+ QUIT_WITH_RC(LOAD_BADIMAGE);
w = htonl(P->w);
h = htonl(P->h);
if (!ctx.pch_fctl)
@@ -492,11 +494,11 @@ _load(ImlibImage *im, int load_data)
break; /* Process actual IHDR chunk */
/* Process fake IHDR for frame */
- memcpy(&cbuf, fptr, len + 12);
+ memcpy(&cbuf, fptr, _PNG_IHDR_SIZE);
cbuf.ihdr.w = pfctl->w;
cbuf.ihdr.h = pfctl->h;
png_set_crc_action(png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
- png_process_data(png_ptr, info_ptr, (void *)&cbuf, len + 12);
+ png_process_data(png_ptr, info_ptr, (void *)&cbuf, _PNG_IHDR_SIZE);
png_set_crc_action(png_ptr, PNG_CRC_DEFAULT, PNG_CRC_DEFAULT);
continue;
#undef P
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
