[Png-mng-security] zTXt incorrect buffer check

[Glenn Randers-Pehrson]

At 01:44 AM 9/26/2007 +0100, Tavis Ormandy wrote:
>On Wed, Sep 26, 2007 at 12:24:24AM +0100, Tavis Ormandy wrote:
>> ...
>
>Just a note, pretty much exactly the same thing is possible in 
>png_handle_sCAL
>
>Thanks, Tavis.

There seems to be the same situation in iTXt as well (iTXt might
be ifdef'ed out of the version you are testing).  It has three of
those empty loops but only checks two of them for overflow.

Glenn