Skip to content

GHSA-c4v6-gxrq-6g2x

CVE Information

Summary

Three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data.

Severity

This is a medium-severity vulnerability. The practical impact depends on the application's CRC error handling configuration.

Default configuration. libpng's default behavior is to call png_error on CRC mismatches and sequence number violations. Under default settings, the smuggled data triggers a fatal parse error before it reaches the application. The image fails to load. Impact is limited to denial of service: a crafted APNG that refuses to render.

Relaxed CRC configuration. Applications that explicitly relax CRC error handling via png_set_crc_action (e.g. PNG_CRC_QUIET_USE) would silently accept the smuggled data. In this case, attacker-controlled bytes inside an ignored ancillary chunk reach the APNG sequence counter and the zlib decompressor, and are decoded as frame pixel data. No code execution results (zlib output is written into a pre-allocated row buffer), but the rendered image contains attacker-chosen content. A crafted fake length that exceeds the carrier chunk body would cause cascading desynchronization beyond the carrier chunk boundary.

The attack requires a malicious PNG delivered over the network and opened by a push-mode application. No caller contract violation is needed. Sequential-mode reading is not affected.

Affected versions

The vulnerable code originates from the third-party libpng-apng patch, which adds APNG support to libpng 1.6.x. All versions of the patch (from libpng-1.6.49-apng.patch through libpng-1.6.57-apng.patch on SourceForge) contain this defect. Applications known to apply this patch include Firefox, Thunderbird, and several Linux distributions (Gentoo, Linux From Scratch/BLFS, among others). Firefox uses push-mode reading.

libpng 1.8.0 incorporated the apng patch natively and inherited the defect. Upstream libpng 1.6.x (without the apng patch) is not affected, as it does not contain APNG support.

Downstream impact

Downstream applications that use the APNG-patched libpng 1.6.x in push mode should verify whether they call png_set_crc_action with a relaxed error handling mode. Applications using default CRC error handling will reject the malformed data via png_error and are not at risk of accepting smuggled frame data.

Workaround

Applications that use sequential reading (png_read_info / png_read_row / png_read_end) are not affected. Only push-mode applications using png_process_data are vulnerable. There is no workaround for push-mode applications short of applying the fix.

On the libpng18 branch, commit faf0692468 alone is sufficient to remediate the chunk-smuggling defect covered by this advisory. On the other hand, downstream consumers of the libpng-apng patch applied to libpng16 should also apply commit 9ec49c2d56, a sibling fix for an incorrect length value (i.e., literal 4) passed to png_ensure_sequence_number at the IDAT-trailer call site in png_push_read_chunk. The sibling fix is tracked in GitHub issue pnggroup/libpng#854; it is distinct from the fdAT-discard paths fixed here, and not covered by this advisory.

Credits

Reported by Seung Min Shin (신승민), Ajou University.

References

  • Commit faf0692468: fix on branch libpng18.
  • Commit 9ec49c2d56: sibling fix for the same push-mode fdAT path; GitHub issue pnggroup/libpng#854, no separate advisory.