In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
78819D62-25B5-4F9E-8291-2C1FD9803531
6.9.10-43
6.9.9-33
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
9C915428-2EBC-492C-89C5-55F84DECDEDB
7.0.8-43
7.0.7-23
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
902B8056-9E37-443B-8905-8AA93E2447FB
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
B620311B-34A3-48A6-82DF-6F078D7A4493
OR
### Prerequisites

- [x] I have written a descriptive issue title
- [X] I have verified that I am using the latest version of ImageMagick
- [X] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There is a heap buffer overflow vulnerability in function WritePNGImage of png.c.
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://drive.google.com/open?id=11dbKOgAj3s8BPTO4P4Xescp2-2HlQUBP)
magick convert $poc ./test.png
`=================================================================`
`==41625==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000b251 at pc 0x7f57acd61145 bp 0x7fff0c9e88f0 sp 0x7fff0c9e8098`
`READ of size 1 at 0x60200000b251 thread T0`
`    #0 0x7f57acd61144  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x4b144)`
`    #1 0x435b4e in LocaleNCompare MagickCore/locale.c:1581`
`    #2 0x76bab9 in Magick_png_write_raw_profile coders/png.c:8183`
`    #3 0x77be6c in WriteOnePNGImage coders/png.c:11083`
`    #4 0x783ffa in WritePNGImage coders/png.c:12744`
`    #5 0x849036 in WriteImage MagickCore/constitute.c:1159`
`    #6 0x849d5b in WriteImages MagickCore/constitute.c:1376`
`    #7 0xbf16d0 in ConvertImageCommand MagickWand/convert.c:3305`
`    #8 0xcdf180 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #9 0x4100a1 in MagickMain utilities/magick.c:149`
`    #10 0x410282 in main utilities/magick.c:180`
`    #11 0x7f57a860f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`
`    #12 0x40fbb8 in _start (/home/ImageMagick/utilities/magick+0x40fbb8)`
``
`0x60200000b251 is located 0 bytes to the right of 1-byte region [0x60200000b250,0x60200000b251)`
`allocated by thread T0 here:`
`    #0 0x7f57acdae602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)`
`    #1 0x44096a in AcquireMagickMemory MagickCore/memory.c:478`
`    #2 0x4409be in AcquireQuantumMemory MagickCore/memory.c:551`
`    #3 0x4c4165 in ConstantString MagickCore/string.c:713`
`    #4 0x49a6fb in CloneSplayTree MagickCore/splay-tree.c:372`
`    #5 0x487eab in CloneImageProfiles MagickCore/profile.c:190`
`    #6 0x418926 in CloneImage MagickCore/image.c:838`
`    #7 0x76d056 in WriteOnePNGImage coders/png.c:8528`
`    #8 0x783ffa in WritePNGImage coders/png.c:12744`
`    #9 0x849036 in WriteImage MagickCore/constitute.c:1159`
`    #10 0x849d5b in WriteImages MagickCore/constitute.c:1376`
`    #11 0xbf16d0 in ConvertImageCommand MagickWand/convert.c:3305`
`    #12 0xcdf180 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #13 0x4100a1 in MagickMain utilities/magick.c:149`
`    #14 0x410282 in main utilities/magick.c:180`
`    #15 0x7f57a860f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`
``
`SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 ??`
`Shadow bytes around the buggy address:`
`  0x0c047fff95f0: fa fa 07 fa fa fa 00 01 fa fa 00 fa fa fa 04 fa`
`  0x0c047fff9600: fa fa 00 03 fa fa 00 fa fa fa 00 02 fa fa 06 fa`
`  0x0c047fff9610: fa fa 00 05 fa fa 05 fa fa fa 00 fa fa fa 01 fa`
`  0x0c047fff9620: fa fa 00 02 fa fa 00 04 fa fa 00 04 fa fa 00 04`
`  0x0c047fff9630: fa fa 03 fa fa fa 00 02 fa fa 07 fa fa fa 07 fa`
`=>0x0c047fff9640: fa fa 00 01 fa fa 04 fa fa fa[01]fa fa fa 00 04`
`  0x0c047fff9650: fa fa 04 fa fa fa 04 fa fa fa 00 02 fa fa 06 fa`
`  0x0c047fff9660: fa fa 04 fa fa fa 00 02 fa fa 06 fa fa fa 04 fa`
`  0x0c047fff9670: fa fa 00 02 fa fa 06 fa fa fa 04 fa fa fa 00 02`
`  0x0c047fff9680: fa fa 06 fa fa fa 04 fa fa fa 00 02 fa fa 00 03`
`  0x0c047fff9690: fa fa 06 fa fa fa 04 fa fa fa 00 02 fa fa 05 fa`
`Shadow byte legend (one shadow byte represents 8 application bytes):`
`  Addressable:           00`
`  Partially addressable: 01 02 03 04 05 06 07 `
`  Heap left redzone:       fa`
`  Heap right redzone:      fb`
`  Freed heap region:       fd`
`  Stack left redzone:      f1`
`  Stack mid redzone:       f2`
`  Stack right redzone:     f3`
`  Stack partial redzone:   f4`
`  Stack after return:      f5`
`  Stack use after scope:   f8`
`  Global redzone:          f9`
`  Global init order:       f6`
`  Poisoned by user:        f7`
`  Container overflow:      fc`
`  Array cookie:            ac`
`  Intra object redzone:    bb`
`  ASan internal:           fe`
`==41625==ABORTING`
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
`Version: ImageMagick 7.0.8-43 Q16 x86_64 2019-04-29 https://imagemagick.org`
`Copyright: ? 1999-2019 ImageMagick Studio LLC`
`License: https://imagemagick.org/script/license.php`
`Features: Cipher DPC HDRI OpenMP(4.0) `
`Delegates (built-in): bzlib djvu fftw fontconfig freetype jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff wmf x xml zlib`
- Environment (Operating system, version and so on):
`Distributor ID:	Ubuntu`
`Description:	Ubuntu 16.04.1 LTS`
`Release:	16.04`
`Codename:	xenial`
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

heap-buffer-overflow in WritePNGImage of png.c
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : heap-buffer-overflow in WritePNGImage of png.c
Issue date:

--- start body ---
### Prerequisites

- [x] I have written a descriptive issue title
- [X] I have verified that I am using the latest version of ImageMagick
- [X] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There is a heap buffer overflow vulnerability in function WritePNGImage of png.c.
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://drive.google.com/open?id=11dbKOgAj3s8BPTO4P4Xescp2-2HlQUBP)
magick convert $poc ./test.png
`=================================================================`
`==41625==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000b251 at pc 0x7f57acd61145 bp 0x7fff0c9e88f0 sp 0x7fff0c9e8098`
`READ of size 1 at 0x60200000b251 thread T0`
`    #0 0x7f57acd61144  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x4b144)`
`    #1 0x435b4e in LocaleNCompare MagickCore/locale.c:1581`
`    #2 0x76bab9 in Magick_png_write_raw_profile coders/png.c:8183`
`    #3 0x77be6c in WriteOnePNGImage coders/png.c:11083`
`    #4 0x783ffa in WritePNGImage coders/png.c:12744`
`    #5 0x849036 in WriteImage MagickCore/constitute.c:1159`
`    #6 0x849d5b in WriteImages MagickCore/constitute.c:1376`
`    #7 0xbf16d0 in ConvertImageCommand MagickWand/convert.c:3305`
`    #8 0xcdf180 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #9 0x4100a1 in MagickMain utilities/magick.c:149`
`    #10 0x410282 in main utilities/magick.c:180`
`    #11 0x7f57a860f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`
`    #12 0x40fbb8 in _start (/home/ImageMagick/utilities/magick+0x40fbb8)`
``
`0x60200000b251 is located 0 bytes to the right of 1-byte region [0x60200000b250,0x60200000b251)`
`allocated by thread T0 here:`
`    #0 0x7f57acdae602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)`
`    #1 0x44096a in AcquireMagickMemory MagickCore/memory.c:478`
`    #2 0x4409be in AcquireQuantumMemory MagickCore/memory.c:551`
`    #3 0x4c4165 in ConstantString MagickCore/string.c:713`
`    #4 0x49a6fb in CloneSplayTree MagickCore/splay-tree.c:372`
`    #5 0x487eab in CloneImageProfiles MagickCore/profile.c:190`
`    #6 0x418926 in CloneImage MagickCore/image.c:838`
`    #7 0x76d056 in WriteOnePNGImage coders/png.c:8528`
`    #8 0x783ffa in WritePNGImage coders/png.c:12744`
`    #9 0x849036 in WriteImage MagickCore/constitute.c:1159`
`    #10 0x849d5b in WriteImages MagickCore/constitute.c:1376`
`    #11 0xbf16d0 in ConvertImageCommand MagickWand/convert.c:3305`
`    #12 0xcdf180 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #13 0x4100a1 in MagickMain utilities/magick.c:149`
`    #14 0x410282 in main utilities/magick.c:180`
`    #15 0x7f57a860f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`
``
`SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 ??`
`Shadow bytes around the buggy address:`
`  0x0c047fff95f0: fa fa 07 fa fa fa 00 01 fa fa 00 fa fa fa 04 fa`
`  0x0c047fff9600: fa fa 00 03 fa fa 00 fa fa fa 00 02 fa fa 06 fa`
`  0x0c047fff9610: fa fa 00 05 fa fa 05 fa fa fa 00 fa fa fa 01 fa`
`  0x0c047fff9620: fa fa 00 02 fa fa 00 04 fa fa 00 04 fa fa 00 04`
`  0x0c047fff9630: fa fa 03 fa fa fa 00 02 fa fa 07 fa fa fa 07 fa`
`=>0x0c047fff9640: fa fa 00 01 fa fa 04 fa fa fa[01]fa fa fa 00 04`
`  0x0c047fff9650: fa fa 04 fa fa fa 04 fa fa fa 00 02 fa fa 06 fa`
`  0x0c047fff9660: fa fa 04 fa fa fa 00 02 fa fa 06 fa fa fa 04 fa`
`  0x0c047fff9670: fa fa 00 02 fa fa 06 fa fa fa 04 fa fa fa 00 02`
`  0x0c047fff9680: fa fa 06 fa fa fa 04 fa fa fa 00 02 fa fa 00 03`
`  0x0c047fff9690: fa fa 06 fa fa fa 04 fa fa fa 00 02 fa fa 05 fa`
`Shadow byte legend (one shadow byte represents 8 application bytes):`
`  Addressable:           00`
`  Partially addressable: 01 02 03 04 05 06 07 `
`  Heap left redzone:       fa`
`  Heap right redzone:      fb`
`  Freed heap region:       fd`
`  Stack left redzone:      f1`
`  Stack mid redzone:       f2`
`  Stack right redzone:     f3`
`  Stack partial redzone:   f4`
`  Stack after return:      f5`
`  Stack use after scope:   f8`
`  Global redzone:          f9`
`  Global init order:       f6`
`  Poisoned by user:        f7`
`  Container overflow:      fc`
`  Array cookie:            ac`
`  Intra object redzone:    bb`
`  ASan internal:           fe`
`==41625==ABORTING`
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
`Version: ImageMagick 7.0.8-43 Q16 x86_64 2019-04-29 https://imagemagick.org`
`Copyright: ? 1999-2019 ImageMagick Studio LLC`
`License: https://imagemagick.org/script/license.php`
`Features: Cipher DPC HDRI OpenMP(4.0) `
`Delegates (built-in): bzlib djvu fftw fontconfig freetype jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff wmf x xml zlib`
- Environment (Operating system, version and so on):
`Distributor ID:	Ubuntu`
`Description:	Ubuntu 16.04.1 LTS`
`Release:	16.04`
`Codename:	xenial`
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

--- end body ---

comments :
--- start comments ---

--- end comments ---