CVE-2026-40930: Apng Unconsumed Chunk Smugglingcve-2026-40930-apng-unconsumed-chunk-smuggling
A chunk discard path in the push-mode parser clears the PNG_HAVE_CHUNK_HEADER state without calling png_crc_finish() or consuming the chunk payload. This leaves raw unconsumed bytes in the stream, parsing them as a new chunk on the next iteration and enabling chunk smuggling. Ensure the chunk body and CRC are consumed before clearing the state flag.
