Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file.
cpe:2.3:a:exiv2:exiv2:0.27.1:*:*:*:*:*:*:*
9E196C7D-A075-43E0-A620-C2D7C0EB559F
OR
**Describe the bug**
An issue was discovered in Exiv2 0.27.1. There is reading beyond buffer at tEXtToDataBuf in the file pngimage.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
**To Reproduce**
Steps to reproduce the behaviour:
1. Provide image with which you observed the issue 
![image](https://user-images.githubusercontent.com/40753101/57208565-06a3f080-7007-11e9-9ad8-380ece8e678f.png)

2. Provide exact command to reproduce the issue
./exiv2 -pR poc

**Expected behavior**
Print picture information correctly without generating Segmentation fault

**Desktop (please complete the following information):**
 - OS: Ubuntu18.04 64_bit
 - Compiler & Version [gcc 7.3.0 ; g++ 7.3.0]
 - Compilation mode and/or compiler flags
cmake -DCMAKE_INSTALL_PREFIX=BuildPath -DCMAKE_BUILD_TYPE=Debug


**Additional context**
function named tEXtToDataBuf is called in pgnimage.cpp:329. 

![image](https://user-images.githubusercontent.com/40753101/57208840-6bac1600-7008-11e9-9c77-96f15331f205.png)

but argument (dataOffset-name_l) value is evalued to 0xFFFFFFFF,so that read beyond buffer in pgnimage.cpp:329.
![image](https://user-images.githubusercontent.com/40753101/57209137-de69c100-7009-11e9-83a1-4300d60e4004.png)


The POC is here:
[id^%000000,sig^%11,src^%000163,op^%flip1,pos^%1129.zip](https://github.com/Exiv2/exiv2/files/3146651/id.000000.sig.11.src.000163.op.flip1.pos.1129.zip)


Segmentation fault in pngimage.cpp:329.
This is a GitHub Issue
repo:exiv2
owner:Exiv2
Title : Segmentation fault in pngimage.cpp:329.
Issue date:

--- start body ---
**Describe the bug**
An issue was discovered in Exiv2 0.27.1. There is reading beyond buffer at tEXtToDataBuf in the file pngimage.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
**To Reproduce**
Steps to reproduce the behaviour:
1. Provide image with which you observed the issue 
![image](https://user-images.githubusercontent.com/40753101/57208565-06a3f080-7007-11e9-9ad8-380ece8e678f.png)

2. Provide exact command to reproduce the issue
./exiv2 -pR poc

**Expected behavior**
Print picture information correctly without generating Segmentation fault

**Desktop (please complete the following information):**
 - OS: Ubuntu18.04 64_bit
 - Compiler & Version [gcc 7.3.0 ; g++ 7.3.0]
 - Compilation mode and/or compiler flags
cmake -DCMAKE_INSTALL_PREFIX=BuildPath -DCMAKE_BUILD_TYPE=Debug


**Additional context**
function named tEXtToDataBuf is called in pgnimage.cpp:329. 

![image](https://user-images.githubusercontent.com/40753101/57208840-6bac1600-7008-11e9-9c77-96f15331f205.png)

but argument (dataOffset-name_l) value is evalued to 0xFFFFFFFF,so that read beyond buffer in pgnimage.cpp:329.
![image](https://user-images.githubusercontent.com/40753101/57209137-de69c100-7009-11e9-83a1-4300d60e4004.png)


The POC is here:
[id^%000000,sig^%11,src^%000163,op^%flip1,pos^%1129.zip](https://github.com/Exiv2/exiv2/files/3146651/id.000000.sig.11.src.000163.op.flip1.pos.1129.zip)


--- end body ---

comments :
--- start comments ---

--- end comments ---