Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pnggroup/libpng
libpng18 @ d1d0abe
26
Fixes
49
CVEs
CRITICAL
Peak severity
Highlights
Memory Corruption: 5 prior fixes. Scrutinize any change in this area.
pngread.c: most-fixed (5 issues). Treat as high-risk during review.
20 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Use After Free: Getting and subsequently setting internal properties (such as palette, trans_alpha, PLTE, tRNS, or hIST) can cause libpng to free internal storage buffers before finishing copying operations. This triggers severe use-after-free conditions and memory corruption.
Integer Overflow: Image row width calculations (rowbytes) are prone to integer overflows during translation and expansion transformations when multiplying dimensions on 32-bit and 64-bit systems, which subsequently leads to undersized allocations and heap overflows.
Out-of-bounds Read/Write: SIMD-accelerated execution paths (such as the ARM NEON palette expansion logic) are prone to out-of-bounds reads and writes when loop boundaries are not strictly matched to full vector chunks.