Wed Sep 28 05:34:09 2011 UTC ()
Update to 1.5.5 to fix CVE-2011-3328, requested by tron.

Version 1.5.5beta01 [July 13, 2011]
  Fixed some typos and made other minor changes in the manual.
  Updated contrib/pngminus/makefile.std (Samuli Souminen)

Version 1.5.5beta02 [July 14, 2011]
  Revised Makefile.am and Makefile.in to look in the right directory for
    pnglibconf.h.prebuilt

Version 1.5.5beta03 [July 27, 2011]
  Enabled compilation with g++ compiler.  This compiler does not recognize
    the file extension, so it always compiles with C++ rules.  Made minor
    changes to pngrutil.c to cast results where C++ expects it but C does not.
  Minor editing of libpng.3 and libpng-manual.txt.

Version 1.5.5beta04 [July 29, 2011]
  Revised CMakeLists.txt (Clifford Yapp)
  Updated commentary about the png_rgb_to_gray() default coefficients
    in the manual and in pngrtran.c

Version 1.5.5beta05 [August 17, 2011]
  Prevent unexpected API exports from non-libpng DLLs on Windows.  The "_DLL"
    is removed from the test of whether a DLL is being built (this erroneously
    caused the libpng APIs to be marked as DLL exports in static builds under
    Microsoft Visual Studio).  Almost all of the libpng building configuration
    is moved from pngconf.h to pngpriv.h, but PNG_DLL_EXPORT remains in
    pngconf.h, though, so that it is colocated with the import definition (it
    is no longer used anywhere in the installed headers).  The VStudio project
    definitions have been cleaned up: "_USRDLL" has been removed from the
    static library builds (this was incorrect), and PNG_USE_DLL has been added
    to pngvalid to test the functionality (pngtest does not supply it,
    deliberately).  The spurious "_EXPORTS" has been removed from the
    libpng build (all these errors were a result of copy/paste between project
    configurations.)
  Added new types and internal functions for CIE RGB end point handling to
    pngpriv.h (functions yet to be implemented).

Version 1.5.5beta06 [August 26, 2011]
  Ensure the CMAKE_LIBRARY_OUTPUT_DIRECTORY is set in CMakeLists.txt
    (Clifford Yap)
  Fixes to rgb_to_gray and cHRM XYZ APIs (John Bowler):
    The rgb_to_gray code had errors when combined with gamma correction.
    Some pixels were treated as true grey when they weren't and such pixels
    and true grey ones were not gamma corrected (the original value of the
    red component was used instead).  APIs to get and set cHRM using color
    space end points have been added and the rgb_to_gray code that defaults
    based on cHRM, and the divide-by-zero bug in png_handle_cHRM (CERT
    VU#477046, CVE-2011-3328, introduced in 1.5.4) have been corrected.
  A considerable number of tests has been added to pngvalid for the
    rgb_to_gray transform.
  Arithmetic errors in rgb_to_gray whereby the calculated gray value was
    truncated to the bit depth rather than rounded have been fixed except in
    the 8-bit non-gamma-corrected case (where consistency seems more important
    than correctness.)  The code still has considerable inaccuracies in the
    8-bit case because 8-bit linear arithmetic is used.

Version 1.5.5beta07 [September 7, 2011]
  Added "$(ARCH)" option to makefile.darwin
  Added SunOS support to configure.ac and Makefile.am
  Changed png_chunk_benign_error() to png_warning() in png.c, in
    png_XYZ_from_xy_checked().

Version 1.5.5beta08 [September 10, 2011]
  Fixed 64-bit compilation errors (gcc). The errors fixed relate
    to conditions where types that are 32 bits in the GCC 32-bit
    world (uLong and png_size_t) become 64 bits in the 64-bit
    world.  This produces potential truncation errors that the
    compiler correctly flags.
  Relocated new HAVE_SOLARIS_LD definition in configure.ac
  Constant changes for 64-bit compatibility (removal of L suffixes). The
    16-bit cases still use "L" as we don't have a 16-bit test system.

Version 1.5.5rc01 [September 17, 2011]
  Removed "L" suffixes from constants in pngpriv.h

Version 1.5.5 [September 22, 2011]
  No changes.


(wiz)
diff -r1.138 -r1.139 pkgsrc/graphics/png/Makefile
diff -r1.85 -r1.86 pkgsrc/graphics/png/distinfo

cvs diff -r1.138 -r1.139 pkgsrc/graphics/png/Makefile (expand / switch to unified diff)

--- pkgsrc/graphics/png/Makefile 2011/07/08 17:47:58 1.138
+++ pkgsrc/graphics/png/Makefile 2011/09/28 05:34:08 1.139
@@ -1,20 +1,21 @@ @@ -1,20 +1,21 @@
1# $NetBSD: Makefile,v 1.138 2011/07/08 17:47:58 wiz Exp $ 1# $NetBSD: Makefile,v 1.139 2011/09/28 05:34:08 wiz Exp $
2 2
3DISTNAME= libpng-1.5.4 3DISTNAME= libpng-1.5.5
4PKGNAME= ${DISTNAME:S/lib//} 4PKGNAME= ${DISTNAME:S/lib//}
5CATEGORIES= graphics 5CATEGORIES= graphics
6MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=libpng/} \ 6MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=libpng/} \
7 ftp://ftp.fu-berlin.de/unix/graphics/png/src/ 7 ftp://ftp.fu-berlin.de/unix/graphics/png/src/
 8EXTRACT_SUFX= .tar.bz2
8 9
9MAINTAINER= wiz@NetBSD.org 10MAINTAINER= wiz@NetBSD.org
10HOMEPAGE= http://www.libpng.org/pub/png/libpng.html 11HOMEPAGE= http://www.libpng.org/pub/png/libpng.html
11COMMENT= Library for manipulating PNG images 12COMMENT= Library for manipulating PNG images
12LICENSE= png-license 13LICENSE= png-license
13 14
14PKG_INSTALLATION_TYPES= overwrite pkgviews 15PKG_INSTALLATION_TYPES= overwrite pkgviews
15PKG_DESTDIR_SUPPORT= user-destdir 16PKG_DESTDIR_SUPPORT= user-destdir
16 17
17GNU_CONFIGURE= yes 18GNU_CONFIGURE= yes
18PKGCONFIG_OVERRIDE= scripts/libpng.pc.in libpng.pc.in 19PKGCONFIG_OVERRIDE= scripts/libpng.pc.in libpng.pc.in
19TEST_TARGET= check 20TEST_TARGET= check
20USE_LIBTOOL= yes 21USE_LIBTOOL= yes

cvs diff -r1.85 -r1.86 pkgsrc/graphics/png/distinfo (expand / switch to unified diff)

--- pkgsrc/graphics/png/distinfo 2011/07/08 17:47:58 1.85
+++ pkgsrc/graphics/png/distinfo 2011/09/28 05:34:08 1.86
@@ -1,6 +1,6 @@ @@ -1,6 +1,6 @@
1$NetBSD: distinfo,v 1.85 2011/07/08 17:47:58 wiz Exp $ 1$NetBSD: distinfo,v 1.86 2011/09/28 05:34:08 wiz Exp $
2 2
3SHA1 (libpng-1.5.4.tar.gz) = 3ff340169a74b40b299b491009f210bf5b312475 3SHA1 (libpng-1.5.5.tar.bz2) = be63517aa20e8539f0be07706326f5cb53c42e13
4RMD160 (libpng-1.5.4.tar.gz) = e625ea458c650c80a1d2097dec4536ab3896e0ce 4RMD160 (libpng-1.5.5.tar.bz2) = 9dcacbf5038c444289d03fb66436168c07298c45
5Size (libpng-1.5.4.tar.gz) = 1019446 bytes 5Size (libpng-1.5.5.tar.bz2) = 836444 bytes
6SHA1 (patch-aa) = 0c4f4e594798384079a0ce2ee5d7a45e16366b12 6SHA1 (patch-aa) = 0c4f4e594798384079a0ce2ee5d7a45e16366b12