The attached file causes a `std::bad_alloc` exception in `exiv2`.  The bug is that there is no bounds check on the value of `length` at [pngchunk_int.cpp:669](https://github.com/Exiv2/exiv2/blob/f4a37c63f2f890c16ff7192fc89a75a7c34ae82b/src/pngchunk_int.cpp#L669). Reproducible on the 0.27-maintenance branch ([f4a37c6](https://github.com/Exiv2/exiv2/commit/f4a37c63f2f890c16ff7192fc89a75a7c34ae82b)): ``` exiv2 issue_845_poc.png ```
The attached file causes a
std::bad_allocexception inexiv2.The bug is that there is no bounds check on the value of
lengthat pngchunk_int.cpp:669.Reproducible on the 0.27-maintenance branch (f4a37c6):