Bugtraq mailing list archives
Possible Windows Explorer bad PNG file preview integer overflow handling
From: rocheml () httrack com
Date: Tue, 25 Sep 2007 11:32:37 +0200 (CEST)
Hi folks, Can anyone confirm that the attached PNG file is causing Explorer to eat 100% CPU, and if this is a known issue ? (Currently tested with an up-to-date Windows XP and Windows Vista) The probable cause is an integer overflow in the PNG chunk size handling, which is 32-bit large, and which can cause a 32-bit counter to overflow when specifically designed for (the attached file contains an tEXt chunk which is 0xfffffff4 bytes large), leading to bypass size checking and causing counters to go backward. (Other applications handling PNG files might be affected) Regards, Xavier Roche
Attachment:
badlycrafted.png
Description:
Current thread:
- Possible Windows Explorer bad PNG file preview integer overflow handling rocheml (Sep 25)
- <Possible follow-ups>
- Re: Possible Windows Explorer bad PNG file preview integer overflow handling none (Sep 27)