code segfaults if there is missing or maliciously crafted appended png header after the file
- Dominant language
- C
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
@ext
code throws segfault if the end of file marker is maliciously modified as well as if a legitimate header is inserted after the file as the break for IEND never fires
suggest changing the loop condition in the do_png function to while (ptr <= end); as well as not parsing if there are bytes leftover past end mark as re-parsing the maliciously spliced header causes the program to loop forever searching for non existing end in second part untill it segfaults
I'm attaching two example test files that can make the program segfault as well as my proof-of-concept fix


[Superjpegsplit.c.zip](https://github.com/ext/jpegsplit/files/9096134/Superjpegsplit.c.zip)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.