From ff719216be816682eb542add732722b45b392e5d Mon Sep 17 00:00:00 2001 From: 0xMrNiko Date: Sun, 12 Jul 2026 20:16:53 +0200 Subject: [PATCH] Validate user_transform_depth in png_set_user_transform_info png_set_user_transform_info() accepted arbitrary user_transform_depth values without validation. Depths that are not valid PNG bit depths (1, 2, 4, 8, or 16) can cause png_combine_row() to compute incorrect rowbytes and loop bounds, leading to heap buffer over-read. Reject invalid depths at the API boundary with png_app_error() before the value is stored. Fixes pnggroup/libpng#867. Signed-off-by: 0xMrNiko --- pngtrans.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pngtrans.c b/pngtrans.c index a6cab0cdf0..d8ab362d66 100644 --- a/pngtrans.c +++ b/pngtrans.c @@ -848,6 +848,16 @@ png_set_user_transform_info(png_struct *png_ptr, void *user_transform_ptr, } #endif + if (user_transform_depth != 0 && + user_transform_depth != 1 && user_transform_depth != 2 && + user_transform_depth != 4 && user_transform_depth != 8 && + user_transform_depth != 16) + { + png_app_error(png_ptr, + "png_set_user_transform_info: invalid user_transform_depth"); + return; + } + png_ptr->user_transform_ptr = user_transform_ptr; png_ptr->user_transform_depth = (png_byte)user_transform_depth; png_ptr->user_transform_channels = (png_byte)user_transform_channels;