From feea64040788c124504d0d426ee7580e74ef4073 Mon Sep 17 00:00:00 2001
From: Video Wheel Control <lim@video-wheel-control.com>
Date: Tue, 28 Jul 2026 23:29:10 +0900
Subject: [PATCH] read: reject critical chunks in APNG frame data

---
 pngpread.c | 9 +++++++++
 pngread.c  | 3 +++
 pngrutil.c | 4 ++++
 3 files changed, 16 insertions(+)

diff --git a/pngpread.c b/pngpread.c
index 978559adeb..daad1f9d71 100644
--- a/pngpread.c
+++ b/pngpread.c
@@ -292,6 +292,10 @@ png_push_read_chunk(png_struct *png_ptr, png_info *info_ptr)
             png_push_save_buffer(png_ptr);
             return;
          }
+
+         if (PNG_CHUNK_CRITICAL(chunk_name))
+            png_error(png_ptr, "Unexpected critical chunk in APNG sequence");
+
          png_warning(png_ptr, "Ignoring unexpected chunk in APNG sequence");
          png_crc_finish(png_ptr, png_ptr->push_length);
          png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
@@ -571,6 +575,11 @@ png_push_read_IDAT(png_struct *png_ptr)
                png_push_save_buffer(png_ptr);
                return;
             }
+
+            if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
+               png_error(png_ptr,
+                   "Unexpected critical chunk in APNG sequence");
+
             png_warning(png_ptr, "Ignoring unexpected chunk in APNG sequence");
             png_crc_finish(png_ptr, png_ptr->push_length);
             png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
diff --git a/pngread.c b/pngread.c
index f76e44cc44..52c7967a51 100644
--- a/pngread.c
+++ b/pngread.c
@@ -248,6 +248,9 @@ png_read_frame_head(png_struct *png_ptr, png_info *info_ptr)
       }
       else
       {
+         if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
+            png_error(png_ptr, "Unexpected critical chunk in APNG sequence");
+
          png_warning(png_ptr, "Ignoring unexpected chunk in APNG sequence");
          png_crc_finish(png_ptr, length);
       }
diff --git a/pngrutil.c b/pngrutil.c
index 5dd5361671..7ca0d14091 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -4360,6 +4360,10 @@ png_read_IDAT_data(png_struct *png_ptr, png_byte *output,
                   png_error(png_ptr, "Not enough image data");
                if (png_ptr->chunk_name != png_fdAT)
                {
+                  if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
+                     png_error(png_ptr,
+                         "Unexpected critical chunk in APNG sequence");
+
                   png_warning(png_ptr,
                               "Ignoring unexpected chunk in APNG sequence");
                   bytes_to_skip = png_ptr->idat_size;