Update to 1.6.20: Version 1.6.20beta01 [November 20, 2015] Avoid potential pointer overflow/underflow in png_handle_sPLT() and png_handle_pCAL() (Bug report by John Regehr). Version 1.6.20beta02 [November 23, 2015] Fixed incorrect implementation of png_set_PLTE() that uses png_ptr not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126 vulnerability. Version 1.6.20beta03 [November 24, 2015] Backported tests from libpng-1.7.0beta69. Version 1.6.20rc01 [November 26, 2015] Fixed an error in handling of bad zlib CMINFO field in pngfix, found by American Fuzzy Lop, reported by Brian Carpenter. inflate() doesn't immediately fault a bad CMINFO field; instead a 'too far back' error happens later (at least some times). pngfix failed to limit CMINFO to the allowed values but then assumed that window_bits was in range, triggering an assert. The bug is mostly harmless; the PNG file cannot be fixed. Version 1.6.20rc02 [November 29, 2015] In libpng 1.6 zlib initialization was changed to use the window size in the zlib stream, not a fixed value. This causes some invalid images, where CINFO is too large, to display 'correctly' if the rest of the data is valid. This provides a workaround for zlib versions where the error arises (ones that support the API change to use the window size in the stream). Version 1.6.20 [December 3, 2015] No changes.diff -r1.179 -r1.180 pkgsrc/graphics/png/Makefile
(wiz)
@@ -1,16 +1,16 @@ | @@ -1,16 +1,16 @@ | |||
1 | # $NetBSD: Makefile,v 1.179 2015/11/12 16:12:19 wiz Exp $ | 1 | # $NetBSD: Makefile,v 1.180 2015/12/03 15:17:02 wiz Exp $ | |
2 | 2 | |||
3 | DISTNAME= libpng-1.6.19 | 3 | DISTNAME= libpng-1.6.20 | |
4 | PKGNAME= ${DISTNAME:S/lib//} | 4 | PKGNAME= ${DISTNAME:S/lib//} | |
5 | CATEGORIES= graphics | 5 | CATEGORIES= graphics | |
6 | MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=libpng/} \ | 6 | MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=libpng/} \ | |
7 | ftp://ftp.fu-berlin.de/unix/graphics/png/src/libpng16/ | 7 | ftp://ftp.fu-berlin.de/unix/graphics/png/src/libpng16/ | |
8 | EXTRACT_SUFX= .tar.xz | 8 | EXTRACT_SUFX= .tar.xz | |
9 | 9 | |||
10 | MAINTAINER= wiz@NetBSD.org | 10 | MAINTAINER= wiz@NetBSD.org | |
11 | HOMEPAGE= http://www.libpng.org/pub/png/libpng.html | 11 | HOMEPAGE= http://www.libpng.org/pub/png/libpng.html | |
12 | COMMENT= Library for manipulating PNG images | 12 | COMMENT= Library for manipulating PNG images | |
13 | LICENSE= zlib | 13 | LICENSE= zlib | |
14 | 14 | |||
15 | GNU_CONFIGURE= yes | 15 | GNU_CONFIGURE= yes | |
16 | # do not create libpng.la | 16 | # do not create libpng.la |
@@ -1,6 +1,6 @@ | @@ -1,6 +1,6 @@ | |||
1 | $NetBSD: distinfo,v 1.124 2015/11/12 16:12:19 wiz Exp $ | 1 | $NetBSD: distinfo,v 1.125 2015/12/03 15:17:02 wiz Exp $ | |
2 | 2 | |||
3 | SHA1 (libpng-1.6.19.tar.xz) = 483d72ced11c9258f9d1119105273d9af9ff151c | 3 | SHA1 (libpng-1.6.20.tar.xz) = c4f02051e0b86613076ce390fd15824f3506a148 | |
4 | RMD160 (libpng-1.6.19.tar.xz) = 41242bbef461f0a495310f358df09b19028f2e2e | 4 | RMD160 (libpng-1.6.20.tar.xz) = ee597845605d91de95ded2ec0175ff0a0d701f79 | |
5 | SHA512 (libpng-1.6.19.tar.xz) = 166377ce4f8abfcae0e76bafbdbe94aebef60b9a12c1820eda392e63a8ba7a9e8d7ef4840d8d4853cd487418edd2c4515a889cd9f830d4223a13315e1db4c3b8 | 5 | SHA512 (libpng-1.6.20.tar.xz) = bbf7d9a21a13eb1fd1fa06f9761df72c0b37bd62da7049afe20ec4e63c02c3708aca8a2c2b7f2d7332f3941469b4aca1653cc8423c7fea6de8084201cb8b5f5f | |
6 | Size (libpng-1.6.19.tar.xz) = 941280 bytes | 6 | Size (libpng-1.6.20.tar.xz) = 942672 bytes |