Re: [png-mng-implement] Fwd: [libpng:bugs] #207 libpng-1.6.x is unable to use some libkdcraw-4.10.2 profiles

[John B. <joh...@gm...>]

ICC profiles are required to have a length which is a multiple of 4, so the
profile in question is broken.

I believe there was (and maybe is) an app that was writing text strings at
the end of the profile and, if the text string was not a multiple of 4 in
length, it would produce a bad profile.  Those profiles are easy to recover
- just pad the string with \0 - but other bugs where the profile length is
calculated wrong may result in serious errors.  (libpng does go on to
validate the length, but when the length is detectably broken it simply
rejects the profile.)

This is a benign error on read and the profile will be ignored (along with
any other colorspace information in the PNG) but on write it gets converted
into an application error - we don't want to write PNGs with detectably
broken profiles, something else may crash!
​