rpms/libpng
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148328)

Browse Source 
Resolves: RHEL-148328
This commit is contained in:
Michal Hlavinka 2026-03-03 11:16:45 +01:00
parent 820229a911
commit 09498a3a8c
2 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libpng-1.6-cve-2026-25646.patch Normal file
View File

@ -0,0 +1,15 @@
diff --git a/pngrtran.c b/pngrtran.c
index fe8f9d32c9..1fce9af121 100644
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -708,8 +708,8 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,
break;
t->next = hash[d];
- t->left = (png_byte)i;
- t->right = (png_byte)j;
+ t->left = png_ptr->palette_to_index[i];
+ t->right = png_ptr->palette_to_index[j];
hash[d] = t;
}
}

9
libpng.spec
View File

@ -4,7 +4,7 @@ Summary: A library of functions for manipulating PNG image format files
Name: libpng
Epoch: 2
Version: 1.6.40
Release: 10%{?dist}
Release: 11%{?dist}
License: zlib
URL: http://www.libpng.org/pub/png/
@ -36,6 +36,9 @@ Patch8: libpng-1.6-cve-2026-22695.patch
# from upstream, for <1.6.54, RHEL-146650
# https://github.com/pnggroup/libpng/commit/cf155de014fc6c5cb199dd681dd5c8fb70429072
Patch9: libpng-1.6-cve-2026-22801.patch
# from upstream, for <1.6.55, RHEL-148328
# https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88
Patch10: libpng-1.6-cve-2026-25646.patch
BuildRequires: gcc
BuildRequires: zlib-devel
@ -96,6 +99,7 @@ cp -p %{SOURCE1} .
%patch -P 7 -p1 -b .CVE-2025-66293_p2of2
%patch -P 8 -p1 -b .cve-2026-22695
%patch -P 9 -p1 -b .cve-2026-22801
%patch -P 10 -p1 -b .cve-2026-25646
%build
autoreconf -vif
@ -136,6 +140,9 @@ make check
%{_bindir}/pngfix
%changelog
* Tue Mar 03 2026 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-11
- fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148328)
* Thu Feb 19 2026 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-10
- fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148832)
- fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146650)