Certain chunk handlers in libpng before 1.0.29 and 1.2.x before 1.2.21 allow remote attackers to cause a denial of service (crash) via crafted (1) pCAL (png_handle_pCAL) (2) sCAL (png_handle_sCAL) (3) tEXt (png_push_read_tEXt) (4) iTXt (png_handle_iTXt) and (5) ztXT (png_handle_ztXt) chunking in PNG images which trigger out-of-bounds read operations.