Possible Windows Explorer bad PNG file preview integer overflow handling

[rocheml () httrack com]

Hi folks,

Can anyone confirm that the attached PNG file is causing Explorer to eat
100% CPU, and if this is a known issue ?

(Currently tested with an up-to-date Windows XP and Windows Vista)

The probable cause is an integer overflow in the PNG chunk size handling,
which is 32-bit large, and which can cause a 32-bit counter to overflow
when specifically designed for (the attached file contains an tEXt chunk
which is 0xfffffff4 bytes large), leading to bypass size checking and
causing counters to go backward.

(Other applications handling PNG files might be affected)


Regards,
Xavier Roche

Attachment: badlycrafted.png
Description: