Package Instance

NULL Pointer Dereference
The png_err function in pngerror.c in libpng  makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.

Improper Restriction of Operations within the Bounds of a Memory Buffer
The png_set_text_2 function in pngset.c in libpng  allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.

Uncontrolled Resource Consumption
The png_decompress_chunk function in pngrutil.c in libpng  does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

Improper Restriction of Operations within the Bounds of a Memory Buffer
The png_push_read_zTXt function in pngpread.c in libpng  allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.

Out-of-bounds Read
The png_format_buffer function in pngerror.c in libpng  allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer overflow in libpng , when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.

Improper Restriction of Operations within the Bounds of a Memory Buffer
The png_handle_sCAL function in pngrutil.c in libpng  does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory.

NULL Pointer Dereference
The png_set_text_2 function in libpng  allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.