commit 397c7eea385c22b6033e0310badfadbd9f578422
author Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Tue Sep 19 18:52:21 2017 -0500
committer Glenn Randers-Pehrson <glennrp at users.sourceforge.net> Tue Sep 19 18:52:21 2017 -0500
tree b51d163cff745f87bd0f22048af6df3a6ff12138
parent 066cb342681eff0a9330254d25a84aa4aa76b11c

[libpng16] Add a memset() in png_read_buffer()

pngrutil.c

diff --git a/pngrutil.c b/pngrutil.c
index 098b4e2..03b7115 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -314,6 +314,7 @@
 
       if (buffer != NULL)
       {
+         memset(buffer, 0, new_size); /* just in case */
          png_ptr->read_buffer = buffer;
          png_ptr->read_buffer_size = new_size;
       }
@@ -670,8 +671,8 @@
                    (terminate != 0);
                png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr,
                    buffer_size));
-               /* attempt to stop an oss-fuzz "use of uninitialized value"
-                * in png_set_text_2() and png_icc_check_tag_table()
+               /* Stop an oss-fuzz "use of uninitialized value" detection
+                * in png_set_text_2()
                 */
                memset(text, 0, buffer_size);
 
@@ -1480,7 +1481,7 @@
                         /* Now read the tag table; a variable size buffer is
                          * needed at this point, allocate one for the whole
                          * profile.  The header check has already validated
-                         * that none of these stuff will overflow.
+                         * that none of this stuff will overflow.
                          */
                         const png_uint_32 tag_count = png_get_uint_32(
                             profile_header+128);