pngfix freeze about libpng HOT 6 CLOSED

png_read_info succeeds, even though there is no IDAT chunk, and then png_read_row ends up in an infinite loop reading faked 0-length IDAT chunks. pngfix should be issuing a png_error when the read fails before the first IDAT.

from libpng.

Wrong: I believed pngcheck (well, OK, I didn't pass '-f' and apparently it aborts the read on a CRC error). There are IDAT chunks. In hangs/1.hangs:

Signature
IHDR (1x1 PNG)
bKGD (valid)
pHYS (valid, but with a bad CRC)
IDAT (length 0, bad CRC)
IDAT (length 131072, truncated)

The truncated IDAT does actually contain something that sort-of looks like IEND, but basically it is truncated.

I think the problem is that pngfix isn't handling a zero-length IDAT; it goes into an infinite loop. I thought this had been fixed, but maybe the fixes were only in libpng.

from libpng.

The error occurs in the writing of the IDAT chunks. An easy work-round is to give the '--max' option, then the writing re-chunks the input IDATs and the zero length one doesn't cause a problem. This works for all the examples (well, it 'fixes' the IDAT stream; there are other errors which pngfix doesn't fix and isn't intended to fix.)

from libpng.

The code in rechunk_length is using idat_index == 0 for two different thing; indicating the first call to rechunk_length and indicating the end of a 0 length IDAT. This does not work of course. I've changed it to take the appropriate extra parameter and this seems to fix the problem. Unfortunately at the moment my ISP is down, so it may be a while before I can send the patch. It's trivial but definitely needs pre-rc review/test.

from libpng.

The following patch fixes all the hangs:

f0b453b

Please test; the logic of handling the rewrite of the PNG stream has changed very slightly but this may be enough to introduce more bugs. (It looks totally safe, but then this kind of change always does.) BTW I am pretty sure that the bug triggers on any PNG with a zero length IDAT anywhere; the pngfix code can't get beyond the first such chunk.

from libpng.

Pushed to the libpng16 and libpng17 branches of glennrp/libpng.

from libpng.