From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i586; en-US; rv:1.4.2)
Gecko/20040308

Description of problem:
During a code review I found an out of bounds access error in the
pngerror.c file. Line 139 is this:

png_memcpy(buffer+iout, message, 64);

but in pngutil.c we see this:

png_chunk_error(png_ptr, "CRC error");

The upshot is that it will copy 54 bytes past the end of the
error string. This could cause a core dump.

Version-Release number of selected component (if applicable):
libpng-1.2.2-19.1

How reproducible:
Always

Steps to Reproduce:
Found during code review
    

Additional info:

I will attach a patch that measures the message's length and adjusts
the memcpy accordingly.