Github search: png_get_PLTE C 48892 C++ 2916 Obj-C 36 Apple programmers aren't using it directly at least. Nor Android, which is not exploi

Github search: png_get_PLTE C 48892 C++ 2916 Obj-C 36 Apple programmers aren't using it directly at least. Nor Android, which is not exploitable[1]. Chromium also uses SKIA I believe. The C number is obviously inflated by the number of repositories that contain a copy of libpng. If everyone is using common glue code then I think it's more likely this won't be a problem since the middleware library probably noticed the bug and works around it. It's when developers hastily reinvent the wheel that sloppy validation bugs like this are problems. It's why the maxim "never write your own crypto" exists. Or as Mark Twain said[2], "put all your eggs in one basket and _watch_that_basket_." But as I said, there's no actual buffer overflow in libpng. This is a validation bug. The headline and the NVD summary are misleading. [1]https://android.googlesource.com/platform/external/skia/+/master/src/codec/SkCodec_libpng.cpp#171 https://android.googlesource.com/platform/external/skia/+/ma... [2]maybe