[libGD] #86 [Comment added] Possible infinite loop in libgd/gd_png.c (inside png_set_read_fn() callback) with truncated input

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.

The following task has a new comment added:

FS#86 - Possible infinite loop in libgd/gd_png.c (inside png_set_read_fn() callback) with truncated input
User who did this - Xavier Roche (xroche)

----------
The issue was reproduced with libpng 1.2.18.

The libpng "pngtest" example detect the truncated file, and fails (no infinite loop):

<code>
$ make pngtest
..
$ ./pngtest gdbad3.png gdbad3.png.2
Testing libpng version 1.2.18
   with zlib   version 1.2.3

 libpng version 1.2.18 - May 15, 2007
   Copyright (c) 1998-2007 Glenn Randers-Pehrson
   Copyright (c) 1996-1997 Andreas Dilger
   Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
 library (10218): libpng version 1.2.18 - May 15, 2007 (header)
 pngtest (10218): libpng version 1..2.18 - May 15, 2007 (header)
 png_sizeof(png_struct)=1240, png_sizeof(png_info)=464
libpng error: Read Error
Testing gdbad3.png:gdbad3.png -> gdbad3.png.2: libpng read error
Testing gdbad3.png: FAIL
libpng error: Read Error
Testing gdbad3.png:gdbad3.png -> gdbad3.png..2: libpng read error
Testing gdbad3.png: FAIL
libpng error: Read Error
Testing gdbad3.png:gdbad3.png -> gdbad3.png.2: libpng read error
 FAIL
libpng FAILS test
</code>

Something wicked must happend inside gdPngReadData()

----------

More information can be found at the following URL:
http://bugs.libgd.org/?do=details&task_id=86#comment263

You are receiving this message because you have requested it from the Flyspray bugtracking system.  If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.