CVE-2019-14373
Mark Rogers <[email protected]> Tue, 6 Aug 2019 05:52:05 +0000
| Newsgroups | gmane.comp.graphics.png.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi I’ve been investigating CVE-2019-14373: https://nvd.nist.gov/vuln/detail/CVE-2019-14373 The underlying issue is here: https://github.com/FLIF-hub/FLIF/issues/541 IMO the bug is in FLIF rather than libpng - no zero terminator on the string in png_text.text for the call to png_set_text(), which is then passed to strlen() in png_set_text_2() (pngset.c line 898) https://github.com/FLIF-hub/FLIF/blob/aad2083c2508902f971b7a2aa2564eac2dbc6e3f/src/image/image-png.cpp#L415 However, I think tweaking the libpng documentation would make this less likely to happen elsewhere. I checked the libpng man page – it does say that “the structure returned by png_get_text will always contain regular zero-terminated C strings” but is silent on what gets passed to png_set_text(). There is a comment in png.h line 545, but that’s hard to find. Given there’s a png_text.text_length member which might mislead library users thinking this is a buffer+length pattern, it’s probably worth being explicit in the documentation for png_set_text that png_text.text (and other strings in png_text_struct) should be zero-terminated. Best Regards Mark -- Mark Rogers - [email protected]<mailto:[email protected]> PowerMapper Software Ltd - www.powermapper.com Registered in Scotland No 362274 Quartermile 2 Edinburgh EH3 9GL _______________________________________________ png-mng-implement mailing list png-mng-implement-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/png-mng-implement