Fix buffer overflow reported in RHBZ #1897485. When char is signed, casting to a (signed) int directly could produce a negative offset into the ASCII lookup table; adding an intermediate cast to uch (a typedef for unsigned char) ensures a nonnegative offset no greater than 255, which always corresponds to a valid table index. diff -Naur pngcheck-2.4.0-original/pngcheck.c pngcheck-2.4.0/pngcheck.c --- pngcheck-2.4.0-original/pngcheck.c 2020-10-31 14:59:48.000000000 -0400 +++ pngcheck-2.4.0/pngcheck.c 2020-11-13 09:51:34.834858819 -0500 @@ -4926,8 +4926,10 @@ /* GRR 20061203: now EBCDIC-safe */ int check_chunk_name(char *chunk_name, char *fname) { - if (isASCIIalpha((int)chunk_name[0]) && isASCIIalpha((int)chunk_name[1]) && - isASCIIalpha((int)chunk_name[2]) && isASCIIalpha((int)chunk_name[3])) + if (isASCIIalpha((int)(uch)chunk_name[0]) && + isASCIIalpha((int)(uch)chunk_name[1]) && + isASCIIalpha((int)(uch)chunk_name[2]) && + isASCIIalpha((int)(uch)chunk_name[3])) return 0; printf("%s%s invalid chunk name \"%.*s\" (%02x %02x %02x %02x)\n",