From: Steve G <linux4ever>

In the pngformatbuffer function located in pngerror.c around line 133 is the following code:

if (message == NULL) buffer[iout] = 0; else { buffer[iout++] = ':'; buffer[iout++] = ' '; pngmemcpy(buffer+iout, message, 64); buffer[iout+63] = 0; } This code is called from the pngchunkerror & pngchunkwarning functions. An example of their use would be in pngutil.c around line 119. pngchunkerror(pngptr, "CRC error"); In the above code, the message being constructed is only 10 characters long. The pngmemcpy function will unconditionally access 54 bytes beyond the message.

This could cause a carefully crafted png image to cause a denial of service.

Possibly embargoed; marking as embargoed until communicated otherwise.