From 01d03b8453eb30ade759cd45c707e5a1c7277d88 Mon Sep 17 00:00:00 2001 From: Cosmin Truta Date: Fri, 6 Feb 2026 19:11:54 +0200 Subject: [PATCH] Fix a heap buffer overflow in `png_set_quantize` The color distance hash table stored the current palette indices, but the color-pruning loop assumed the original indices. When colors were eliminated and indices changed, the stored indices became stale. This caused the loop bound `max_d` to grow past the 769-element hash array. The fix consists in storing the original indices via `palette_to_index` to match the pruning loop's expectations. Reported-by: Joshua Inscoe Co-authored-by: Joshua Inscoe Signed-off-by: Cosmin Truta CVE: CVE-2026-25646 Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88] Signed-off-by: Peter Marko --- AUTHORS | 1 + pngrtran.c | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/AUTHORS b/AUTHORS index b9c0fffcf..4094f4a57 100644 --- a/AUTHORS +++ b/AUTHORS @@ -14,6 +14,7 @@ Authors, for copyright and licensing purposes. * Guy Eric Schalnat * James Yu * John Bowler + * Joshua Inscoe * Kevin Bracey * Magnus Holmgren * Mandar Sahastrabuddhe diff --git a/pngrtran.c b/pngrtran.c index fe8f9d32c..1fce9af12 100644 --- a/pngrtran.c +++ b/pngrtran.c @@ -1,7 +1,7 @@ /* pngrtran.c - transforms the data in a row for PNG readers * - * Copyright (c) 2018-2019 Cosmin Truta + * Copyright (c) 2018-2026 Cosmin Truta * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson * Copyright (c) 1996-1997 Andreas Dilger * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc. @@ -647,8 +647,8 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette, break; t->next = hash[d]; - t->left = (png_byte)i; - t->right = (png_byte)j; + t->left = png_ptr->palette_to_index[i]; + t->right = png_ptr->palette_to_index[j]; hash[d] = t; } }