An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset.
cpe:2.3:a:exiv2:exiv2:*:*:*:*:*:*:*:*
4BFA28DF-4BFE-4CA7-A2F7-F471F91B856E
0.27.1
OR
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
97A4B8DF-58DA-4AB6-A1F9-331B36409BA3
OR
There is a bug at [pngimage.cpp:469](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/pngimage.cpp#L469). If `iccOffset == 0`, which happens if `chunkLength == 0`, then Exiv2 crashes with a SIGSEGV.

Here is the PoC, which I have tested on master ([55dfdb9](https://github.com/Exiv2/exiv2/commit/55dfdb9ab007d6e6d1d06240048690eaac23b305)): ![poc1](https://user-images.githubusercontent.com/4358136/56672050-a24f6b80-66ad-11e9-86d9-f0af10b008c9.png). You can run the PoC like this:

```
$ exiv2 poc1.png
Segmentation fault (core dumped)
```
SIGSEGV in PngImage::readMetadata()
This is a GitHub Issue
repo:exiv2
owner:Exiv2
Title : SIGSEGV in PngImage::readMetadata()
Issue date:

--- start body ---
There is a bug at [pngimage.cpp:469](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/pngimage.cpp#L469). If `iccOffset == 0`, which happens if `chunkLength == 0`, then Exiv2 crashes with a SIGSEGV.

Here is the PoC, which I have tested on master ([55dfdb9](https://github.com/Exiv2/exiv2/commit/55dfdb9ab007d6e6d1d06240048690eaac23b305)): ![poc1](https://user-images.githubusercontent.com/4358136/56672050-a24f6b80-66ad-11e9-86d9-f0af10b008c9.png). You can run the PoC like this:

```
$ exiv2 poc1.png
Segmentation fault (core dumped)
```
--- end body ---

comments :
--- start comments ---

--- end comments ---