Sun May 12 20:19:20 2019 UTC ()
Pullup ticket #5955 - requested by taca
graphics/png: security update

Revisions pulled up:
- graphics/png/Makefile                                         1.198
- graphics/png/distinfo                                         1.142

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Wed Apr 17 07:05:21 UTC 2019

   Modified Files:
   	pkgsrc/graphics/png: Makefile distinfo

   Log Message:
   png: update to 1.6.37.

   This is largely a bugfix-only release. Most importantly, it contains
   a fix for a use-after-free vulnerability (CVE-2019-7317) affecting
   the simplified libpng API, and a fix for a memory leak affecting the
   ARM NEON implementation of the palette-to-RGB(A) expansion.

   To generate a diff of this commit:
   cvs rdiff -u -r1.197 -r1.198 pkgsrc/graphics/png/Makefile
   cvs rdiff -u -r1.141 -r1.142 pkgsrc/graphics/png/distinfo


(spz)
diff -r1.197 -r1.197.4.1 pkgsrc/graphics/png/Makefile
diff -r1.141 -r1.141.4.1 pkgsrc/graphics/png/distinfo
cvs diff -r1.197 -r1.197.4.1 pkgsrc/graphics/png/Makefile (expand / switch to unified diff)

--- pkgsrc/graphics/png/Makefile 2018/12/02 12:43:23 1.197
+++ pkgsrc/graphics/png/Makefile 2019/05/12 20:19:19 1.197.4.1
@@ -1,16 +1,16 @@ @@ -1,16 +1,16 @@
1# $NetBSD: Makefile,v 1.197 2018/12/02 12:43:23 wiz Exp $ 1# $NetBSD: Makefile,v 1.197.4.1 2019/05/12 20:19:19 spz Exp $
2 2
3DISTNAME= libpng-1.6.36 3DISTNAME= libpng-1.6.37
4PKGNAME= ${DISTNAME:S/lib//} 4PKGNAME= ${DISTNAME:S/lib//}
5CATEGORIES= graphics 5CATEGORIES= graphics
6MASTER_SITES= https://ftp-osl.osuosl.org/pub/libpng/src/archive/xz/libpng16/ 6MASTER_SITES= https://ftp-osl.osuosl.org/pub/libpng/src/archive/xz/libpng16/
7MASTER_SITES+= ${MASTER_SITE_SOURCEFORGE:=libpng/} 7MASTER_SITES+= ${MASTER_SITE_SOURCEFORGE:=libpng/}
8MASTER_SITES+= ftp://ftp.fu-berlin.de/unix/graphics/png/src/libpng16/ 8MASTER_SITES+= ftp://ftp.fu-berlin.de/unix/graphics/png/src/libpng16/
9EXTRACT_SUFX= .tar.xz 9EXTRACT_SUFX= .tar.xz
10 10
11MAINTAINER= wiz@NetBSD.org 11MAINTAINER= wiz@NetBSD.org
12HOMEPAGE= http://www.libpng.org/pub/png/libpng.html 12HOMEPAGE= http://www.libpng.org/pub/png/libpng.html
13COMMENT= Library for manipulating PNG images 13COMMENT= Library for manipulating PNG images
14LICENSE= zlib 14LICENSE= zlib
15 15
16USE_LIBTOOL= yes 16USE_LIBTOOL= yes
cvs diff -r1.141 -r1.141.4.1 pkgsrc/graphics/png/distinfo (expand / switch to unified diff)

--- pkgsrc/graphics/png/distinfo 2018/12/02 12:43:23 1.141
+++ pkgsrc/graphics/png/distinfo 2019/05/12 20:19:19 1.141.4.1
@@ -1,7 +1,7 @@ @@ -1,7 +1,7 @@
1$NetBSD: distinfo,v 1.141 2018/12/02 12:43:23 wiz Exp $ 1$NetBSD: distinfo,v 1.141.4.1 2019/05/12 20:19:19 spz Exp $
2 2
3SHA1 (libpng-1.6.36.tar.xz) = aec9548c8319104226cc4c31d1f5e524f1b55295 3SHA1 (libpng-1.6.37.tar.xz) = 3ab93fabbf4c27e1c4724371df408d9a1bd3f656
4RMD160 (libpng-1.6.36.tar.xz) = baafcb54ff4913da18c349b14d9a1e98973b17c0 4RMD160 (libpng-1.6.37.tar.xz) = 7d68b596480e994aeccb2794df48a3613f1de9c4
5SHA512 (libpng-1.6.36.tar.xz) = a86ee977df69748e5039fb0ead883f1d3f88b8a701fa24cf8e62dd77c5871bb46397d794fa33ec1d0be1ac488246832ad79d0e6117ac093bdce1b2a1cfcb2bb0 5SHA512 (libpng-1.6.37.tar.xz) = 59e8c1059013497ae616a14c3abbe239322d3873c6ded0912403fc62fb260561768230b6ab997e2cccc3b868c09f539fd13635616b9fa0dd6279a3f63ec7e074
6Size (libpng-1.6.36.tar.xz) = 1012544 bytes 6Size (libpng-1.6.37.tar.xz) = 1012272 bytes
7SHA1 (patch-pngpriv.h) = 3da29edb5d89ab26b9787a71b87c3fd8f451ea39 7SHA1 (patch-pngpriv.h) = 3da29edb5d89ab26b9787a71b87c3fd8f451ea39