A flaw was discovered in libpng that could result in libpng trying to free() random memory if certain unlikely error conditions occur. To quote the libpng advisory: If the application runs out of memory during the loop, some of the element pointers will be uninitialized. Libpng will then longjmp to a cleanup process that attempts to free all of the elements in the array, including the uninitialized ones. This behavior could be forced by a malevolent input.
Created attachment 332560 [details] Upstream advisory for posterity
Created attachment 332781 [details] Upstream patch to fix the issue
mingw32-libpng-1.2.35-1.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/mingw32-libpng-1.2.35-1.fc10
Thanks for the heads up on this. I have rebuilt the mingw32-libpng package in Rawhide, F-10 and EL-5.
Upstream release 1.0.43 addresses this issue for libpng10. Rawhide is already updated, and updates for F-9 and F-10 are currently in updates-testing. https://admin.fedoraproject.org/updates/F9/FEDORA-2009-2045 https://admin.fedoraproject.org/updates/F10/FEDORA-2009-1976
libpng-1.2.35-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
libpng-1.2.35-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
mingw32-libpng-1.2.35-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
libpng10-1.0.43-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
libpng10-1.0.43-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
thunderbird-2.0.0.21-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
thunderbird-2.0.0.21-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.