SIGSEGV in PngImage::readMetadata() · Issue #789 · Exiv2/exiv2 · GitHub
Skip to content

SIGSEGV in PngImage::readMetadata() #789

Description

@kevinbackhouse

There is a bug at pngimage.cpp:469. If iccOffset == 0, which happens if chunkLength == 0, then Exiv2 crashes with a SIGSEGV.

Here is the PoC, which I have tested on master (55dfdb9): poc1. You can run the PoC like this:

$ exiv2 poc1.png
Segmentation fault (core dumped)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions