From bc3dbdc4165a82f9a9da689ae24b64b76bda9f07 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 7 Apr 2026 06:32:00 -0400 Subject: [PATCH] import CS libpng-1.6.40-11.el10 --- .gitignore | 2 +- .libpng.metadata | 1 - SOURCES/libpng-CVE-2018-13785.patch | 34 --- SOURCES/libpng-coverity.patch | 12 -- SOURCES/libpng-fix-arm-neon.patch | 39 ---- ...0.patch => libpng-1.6-CVE-2025-64720.patch | 0 ...h => libpng-1.6-CVE-2025-65018_p1of2.patch | 0 ...h => libpng-1.6-CVE-2025-65018_p2of2.patch | 0 ...h => libpng-1.6-CVE-2025-66293_p1of2.patch | 0 ...h => libpng-1.6-CVE-2025-66293_p2of2.patch | 0 ...5.patch => libpng-1.6-cve-2026-22695.patch | 0 ...1.patch => libpng-1.6-cve-2026-22801.patch | 0 ...6.patch => libpng-1.6-cve-2026-25646.patch | 0 libpng-1.6.40-fix_sast.patch | 12 ++ libpng-1.6.40-nomore_neon_asm.patch | 200 ++++++++++++++++++ ...ng-multilib.patch => libpng-multilib.patch | 0 SPECS/libpng.spec => libpng.spec | 199 +++++++++++------ SOURCES/pngusr.dfa => pngusr.dfa | 0 sources | 1 + 19 files changed, 353 insertions(+), 147 deletions(-) delete mode 100644 .libpng.metadata delete mode 100644 SOURCES/libpng-CVE-2018-13785.patch delete mode 100644 SOURCES/libpng-coverity.patch delete mode 100644 SOURCES/libpng-fix-arm-neon.patch rename SOURCES/libpng-1.6-CVE-2025-64720.patch => libpng-1.6-CVE-2025-64720.patch (100%) rename SOURCES/libpng-1.6-CVE-2025-65018_p1of2.patch => libpng-1.6-CVE-2025-65018_p1of2.patch (100%) rename SOURCES/libpng-1.6-CVE-2025-65018_p2of2.patch => libpng-1.6-CVE-2025-65018_p2of2.patch (100%) rename SOURCES/libpng-1.6-CVE-2025-66293_p1of2.patch => libpng-1.6-CVE-2025-66293_p1of2.patch (100%) rename SOURCES/libpng-1.6-CVE-2025-66293_p2of2.patch => libpng-1.6-CVE-2025-66293_p2of2.patch (100%) rename SOURCES/libpng-1.6-cve-2026-22695.patch => libpng-1.6-cve-2026-22695.patch (100%) rename SOURCES/libpng-1.6-cve-2026-22801.patch => libpng-1.6-cve-2026-22801.patch (100%) rename SOURCES/libpng-1.6-cve-2026-25646.patch => libpng-1.6-cve-2026-25646.patch (100%) create mode 100644 libpng-1.6.40-fix_sast.patch create mode 100644 libpng-1.6.40-nomore_neon_asm.patch rename SOURCES/libpng-multilib.patch => libpng-multilib.patch (100%) rename SPECS/libpng.spec => libpng.spec (77%) rename SOURCES/pngusr.dfa => pngusr.dfa (100%) create mode 100644 sources diff --git a/.gitignore b/.gitignore index a0b94b9..221a626 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/libpng-1.6.34.tar.xz +libpng-1.6.40.tar.gz diff --git a/.libpng.metadata b/.libpng.metadata deleted file mode 100644 index 2ed0ef5..0000000 --- a/.libpng.metadata +++ /dev/null @@ -1 +0,0 @@ -45de4ec996ffcc3e18037e7c128abe95f4d0292a SOURCES/libpng-1.6.34.tar.xz diff --git a/SOURCES/libpng-CVE-2018-13785.patch b/SOURCES/libpng-CVE-2018-13785.patch deleted file mode 100644 index 5fee972..0000000 --- a/SOURCES/libpng-CVE-2018-13785.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 9821583a771bfe2c75b7449d8ff83cb348291b3f Mon Sep 17 00:00:00 2001 -From: Cosmin Truta -Date: Sun, 17 Jun 2018 22:56:29 -0400 -Subject: [PATCH] Fix the calculation of row_factor in png_check_chunk_length - -(Bug report by Thuan Pham, SourceForge issue #278) ---- - pngrutil.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/pngrutil.c b/pngrutil.c -index 8692933..eab2973 100644 ---- a/pngrutil.c -+++ b/pngrutil.c -@@ -3149,10 +3149,13 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length) - { - png_alloc_size_t idat_limit = PNG_UINT_31_MAX; - size_t row_factor = -- (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1) -- + 1 + (png_ptr->interlaced? 6: 0)); -+ (size_t)png_ptr->width -+ * (size_t)png_ptr->channels -+ * (png_ptr->bit_depth > 8? 2: 1) -+ + 1 -+ + (png_ptr->interlaced? 6: 0); - if (png_ptr->height > PNG_UINT_32_MAX/row_factor) -- idat_limit=PNG_UINT_31_MAX; -+ idat_limit = PNG_UINT_31_MAX; - else - idat_limit = png_ptr->height * row_factor; - row_factor = row_factor > 32566? 32566 : row_factor; --- -2.17.1 - diff --git a/SOURCES/libpng-coverity.patch b/SOURCES/libpng-coverity.patch deleted file mode 100644 index 053a954..0000000 --- a/SOURCES/libpng-coverity.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/libpng-config.in b/libpng-config.in -index 3739eb9..7f6b2cc 100644 ---- a/libpng-config.in -+++ b/libpng-config.in -@@ -13,7 +13,6 @@ - - version=`pkg-config --modversion libpng` - prefix=`pkg-config --variable prefix libpng` --exec_prefix=`pkg-config --variable exec_prefix libpng` - libdir=`pkg-config --variable libdir libpng` - includedir=`pkg-config --variable includedir libpng` - libs="-lpng@PNGLIB_MAJOR@@PNGLIB_MINOR@" diff --git a/SOURCES/libpng-fix-arm-neon.patch b/SOURCES/libpng-fix-arm-neon.patch deleted file mode 100644 index e424957..0000000 --- a/SOURCES/libpng-fix-arm-neon.patch +++ /dev/null @@ -1,39 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 4fb0778..930bf50 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -283,17 +283,21 @@ AC_ARG_ENABLE([arm-neon], - [case "$enableval" in - no|off) - # disable the default enabling on __ARM_NEON__ systems: -+ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support]) - AC_DEFINE([PNG_ARM_NEON_OPT], [0], - [Disable ARM Neon optimizations]) - # Prevent inclusion of the assembler files below: - enable_arm_neon=no;; - check) -+ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support]) - AC_DEFINE([PNG_ARM_NEON_CHECK_SUPPORTED], [], - [Check for ARM Neon support at run-time]);; - api) -+ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support]) - AC_DEFINE([PNG_ARM_NEON_API_SUPPORTED], [], - [Turn on ARM Neon optimizations at run-time]);; - yes|on) -+ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support]) - AC_DEFINE([PNG_ARM_NEON_OPT], [2], - [Enable ARM Neon optimizations]) - AC_MSG_WARN([--enable-arm-neon: please specify 'check' or 'api', if] -diff --git a/pngpriv.h b/pngpriv.h -index 1997503..789206f 100644 ---- a/pngpriv.h -+++ b/pngpriv.h -@@ -125,7 +125,7 @@ - * associated assembler code, pass --enable-arm-neon=no to configure - * or put -DPNG_ARM_NEON_OPT=0 in CPPFLAGS. - */ --# if (defined(__ARM_NEON__) || defined(__ARM_NEON)) && \ -+# if defined(PNG_ARM_NEON) && (defined(__ARM_NEON__) || defined(__ARM_NEON)) && \ - defined(PNG_ALIGNED_MEMORY_SUPPORTED) - # define PNG_ARM_NEON_OPT 2 - # else diff --git a/SOURCES/libpng-1.6-CVE-2025-64720.patch b/libpng-1.6-CVE-2025-64720.patch similarity index 100% rename from SOURCES/libpng-1.6-CVE-2025-64720.patch rename to libpng-1.6-CVE-2025-64720.patch diff --git a/SOURCES/libpng-1.6-CVE-2025-65018_p1of2.patch b/libpng-1.6-CVE-2025-65018_p1of2.patch similarity index 100% rename from SOURCES/libpng-1.6-CVE-2025-65018_p1of2.patch rename to libpng-1.6-CVE-2025-65018_p1of2.patch diff --git a/SOURCES/libpng-1.6-CVE-2025-65018_p2of2.patch b/libpng-1.6-CVE-2025-65018_p2of2.patch similarity index 100% rename from SOURCES/libpng-1.6-CVE-2025-65018_p2of2.patch rename to libpng-1.6-CVE-2025-65018_p2of2.patch diff --git a/SOURCES/libpng-1.6-CVE-2025-66293_p1of2.patch b/libpng-1.6-CVE-2025-66293_p1of2.patch similarity index 100% rename from SOURCES/libpng-1.6-CVE-2025-66293_p1of2.patch rename to libpng-1.6-CVE-2025-66293_p1of2.patch diff --git a/SOURCES/libpng-1.6-CVE-2025-66293_p2of2.patch b/libpng-1.6-CVE-2025-66293_p2of2.patch similarity index 100% rename from SOURCES/libpng-1.6-CVE-2025-66293_p2of2.patch rename to libpng-1.6-CVE-2025-66293_p2of2.patch diff --git a/SOURCES/libpng-1.6-cve-2026-22695.patch b/libpng-1.6-cve-2026-22695.patch similarity index 100% rename from SOURCES/libpng-1.6-cve-2026-22695.patch rename to libpng-1.6-cve-2026-22695.patch diff --git a/SOURCES/libpng-1.6-cve-2026-22801.patch b/libpng-1.6-cve-2026-22801.patch similarity index 100% rename from SOURCES/libpng-1.6-cve-2026-22801.patch rename to libpng-1.6-cve-2026-22801.patch diff --git a/SOURCES/libpng-1.6-cve-2026-25646.patch b/libpng-1.6-cve-2026-25646.patch similarity index 100% rename from SOURCES/libpng-1.6-cve-2026-25646.patch rename to libpng-1.6-cve-2026-25646.patch diff --git a/libpng-1.6.40-fix_sast.patch b/libpng-1.6.40-fix_sast.patch new file mode 100644 index 0000000..5b4daa7 --- /dev/null +++ b/libpng-1.6.40-fix_sast.patch @@ -0,0 +1,12 @@ +diff -up libpng-1.6.40/pngrutil.c.fix_sast libpng-1.6.40/pngrutil.c +--- libpng-1.6.40/pngrutil.c.fix_sast 2024-08-06 15:35:51.789156138 +0200 ++++ libpng-1.6.40/pngrutil.c 2024-08-06 15:35:51.816156415 +0200 +@@ -1815,7 +1815,7 @@ png_handle_sPLT(png_structrp png_ptr, pn + void /* PRIVATE */ + png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) + { +- png_byte readbuf[PNG_MAX_PALETTE_LENGTH]; ++ png_byte readbuf[PNG_MAX_PALETTE_LENGTH] = {0}; + + png_debug(1, "in png_handle_tRNS"); + diff --git a/libpng-1.6.40-nomore_neon_asm.patch b/libpng-1.6.40-nomore_neon_asm.patch new file mode 100644 index 0000000..3e0c439 --- /dev/null +++ b/libpng-1.6.40-nomore_neon_asm.patch @@ -0,0 +1,200 @@ +diff -up libpng-1.6.40/CMakeLists.txt.arm libpng-1.6.40/CMakeLists.txt +--- libpng-1.6.40/CMakeLists.txt.arm 2024-08-08 08:31:00.902590808 +0200 ++++ libpng-1.6.40/CMakeLists.txt 2024-08-08 08:34:50.295999649 +0200 +@@ -126,7 +126,6 @@ if(TARGET_ARCH MATCHES "^arm" OR + elseif(NOT ${PNG_ARM_NEON} STREQUAL "off") + set(libpng_arm_sources + arm/arm_init.c +- arm/filter_neon.S + arm/filter_neon_intrinsics.c + arm/palette_neon_intrinsics.c) + if(${PNG_ARM_NEON} STREQUAL "on") +diff -up libpng-1.6.40/Makefile.am.arm libpng-1.6.40/Makefile.am +--- libpng-1.6.40/Makefile.am.arm 2023-06-21 21:06:40.000000000 +0200 ++++ libpng-1.6.40/Makefile.am 2024-08-08 08:31:00.903590819 +0200 +@@ -94,7 +94,7 @@ libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_SO + + if PNG_ARM_NEON + libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_SOURCES += arm/arm_init.c\ +- arm/filter_neon.S arm/filter_neon_intrinsics.c \ ++ arm/filter_neon_intrinsics.c \ + arm/palette_neon_intrinsics.c + endif + +diff -up libpng-1.6.40/Makefile.in.arm libpng-1.6.40/Makefile.in +--- libpng-1.6.40/Makefile.in.arm 2023-06-21 21:06:40.000000000 +0200 ++++ libpng-1.6.40/Makefile.in 2024-08-08 08:41:47.242186003 +0200 +@@ -106,7 +106,7 @@ check_PROGRAMS = pngtest$(EXEEXT) pngunk + @HAVE_CLOCK_GETTIME_TRUE@am__append_1 = timepng + bin_PROGRAMS = pngfix$(EXEEXT) png-fix-itxt$(EXEEXT) + @PNG_ARM_NEON_TRUE@am__append_2 = arm/arm_init.c\ +-@PNG_ARM_NEON_TRUE@ arm/filter_neon.S arm/filter_neon_intrinsics.c \ ++@PNG_ARM_NEON_TRUE@ arm/filter_neon_intrinsics.c \ + @PNG_ARM_NEON_TRUE@ arm/palette_neon_intrinsics.c + + @PNG_MIPS_MSA_TRUE@am__append_3 = mips/mips_init.c\ +@@ -183,13 +183,13 @@ am__libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_l + pngrtran.c pngrutil.c pngset.c pngtrans.c pngwio.c pngwrite.c \ + pngwtran.c pngwutil.c png.h pngconf.h pngdebug.h pnginfo.h \ + pngpriv.h pngstruct.h pngusr.dfa arm/arm_init.c \ +- arm/filter_neon.S arm/filter_neon_intrinsics.c \ ++ arm/filter_neon_intrinsics.c \ + arm/palette_neon_intrinsics.c mips/mips_init.c \ + mips/filter_msa_intrinsics.c intel/intel_init.c \ + intel/filter_sse2_intrinsics.c powerpc/powerpc_init.c \ + powerpc/filter_vsx_intrinsics.c + am__dirstamp = $(am__leading_dot)dirstamp +-@PNG_ARM_NEON_TRUE@am__objects_1 = arm/arm_init.lo arm/filter_neon.lo \ ++@PNG_ARM_NEON_TRUE@am__objects_1 = arm/arm_init.lo \ + @PNG_ARM_NEON_TRUE@ arm/filter_neon_intrinsics.lo \ + @PNG_ARM_NEON_TRUE@ arm/palette_neon_intrinsics.lo + @PNG_MIPS_MSA_TRUE@am__objects_2 = mips/mips_init.lo \ +@@ -267,7 +267,7 @@ am__depfiles_remade = ./$(DEPDIR)/png.Pl + ./$(DEPDIR)/pngtest.Po ./$(DEPDIR)/pngtrans.Plo \ + ./$(DEPDIR)/pngwio.Plo ./$(DEPDIR)/pngwrite.Plo \ + ./$(DEPDIR)/pngwtran.Plo ./$(DEPDIR)/pngwutil.Plo \ +- arm/$(DEPDIR)/arm_init.Plo arm/$(DEPDIR)/filter_neon.Plo \ ++ arm/$(DEPDIR)/arm_init.Plo \ + arm/$(DEPDIR)/filter_neon_intrinsics.Plo \ + arm/$(DEPDIR)/palette_neon_intrinsics.Plo \ + contrib/libtests/$(DEPDIR)/pngimage.Po \ +@@ -285,16 +285,6 @@ am__depfiles_remade = ./$(DEPDIR)/png.Pl + powerpc/$(DEPDIR)/filter_vsx_intrinsics.Plo \ + powerpc/$(DEPDIR)/powerpc_init.Plo + am__mv = mv -f +-CPPASCOMPILE = $(CCAS) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ +- $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CCASFLAGS) $(CCASFLAGS) +-LTCPPASCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ +- $(LIBTOOLFLAGS) --mode=compile $(CCAS) $(DEFS) \ +- $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ +- $(AM_CCASFLAGS) $(CCASFLAGS) +-AM_V_CPPAS = $(am__v_CPPAS_@AM_V@) +-am__v_CPPAS_ = $(am__v_CPPAS_@AM_DEFAULT_V@) +-am__v_CPPAS_0 = @echo " CPPAS " $@; +-am__v_CPPAS_1 = + COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ + $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) + LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ +@@ -823,7 +813,7 @@ all: $(BUILT_SOURCES) config.h + $(MAKE) $(AM_MAKEFLAGS) all-am + + .SUFFIXES: +-.SUFFIXES: .chk .out .S .c .lo .log .o .obj .test .test$(EXEEXT) .trs ++.SUFFIXES: .chk .out .c .lo .log .o .obj .test .test$(EXEEXT) .trs + am--refresh: Makefile + @: + $(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps) +@@ -976,7 +966,6 @@ arm/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) arm/$(DEPDIR) + @: > arm/$(DEPDIR)/$(am__dirstamp) + arm/arm_init.lo: arm/$(am__dirstamp) arm/$(DEPDIR)/$(am__dirstamp) +-arm/filter_neon.lo: arm/$(am__dirstamp) arm/$(DEPDIR)/$(am__dirstamp) + arm/filter_neon_intrinsics.lo: arm/$(am__dirstamp) \ + arm/$(DEPDIR)/$(am__dirstamp) + arm/palette_neon_intrinsics.lo: arm/$(am__dirstamp) \ +@@ -1147,7 +1136,6 @@ distclean-compile: + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pngwtran.Plo@am__quote@ # am--include-marker + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pngwutil.Plo@am__quote@ # am--include-marker + @AMDEP_TRUE@@am__include@ @am__quote@arm/$(DEPDIR)/arm_init.Plo@am__quote@ # am--include-marker +-@AMDEP_TRUE@@am__include@ @am__quote@arm/$(DEPDIR)/filter_neon.Plo@am__quote@ # am--include-marker + @AMDEP_TRUE@@am__include@ @am__quote@arm/$(DEPDIR)/filter_neon_intrinsics.Plo@am__quote@ # am--include-marker + @AMDEP_TRUE@@am__include@ @am__quote@arm/$(DEPDIR)/palette_neon_intrinsics.Plo@am__quote@ # am--include-marker + @AMDEP_TRUE@@am__include@ @am__quote@contrib/libtests/$(DEPDIR)/pngimage.Po@am__quote@ # am--include-marker +@@ -1171,30 +1159,6 @@ $(am__depfiles_remade): + + am--depfiles: $(am__depfiles_remade) + +-.S.o: +-@am__fastdepCCAS_TRUE@ $(AM_V_CPPAS)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\ +-@am__fastdepCCAS_TRUE@ $(CPPASCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\ +-@am__fastdepCCAS_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po +-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ DEPDIR=$(DEPDIR) $(CCASDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +-@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS@am__nodep@)$(CPPASCOMPILE) -c -o $@ $< +- +-.S.obj: +-@am__fastdepCCAS_TRUE@ $(AM_V_CPPAS)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.obj$$||'`;\ +-@am__fastdepCCAS_TRUE@ $(CPPASCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ `$(CYGPATH_W) '$<'` &&\ +-@am__fastdepCCAS_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po +-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ DEPDIR=$(DEPDIR) $(CCASDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +-@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS@am__nodep@)$(CPPASCOMPILE) -c -o $@ `$(CYGPATH_W) '$<'` +- +-.S.lo: +-@am__fastdepCCAS_TRUE@ $(AM_V_CPPAS)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.lo$$||'`;\ +-@am__fastdepCCAS_TRUE@ $(LTCPPASCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\ +-@am__fastdepCCAS_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Plo +-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ DEPDIR=$(DEPDIR) $(CCASDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +-@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS@am__nodep@)$(LTCPPASCOMPILE) -c -o $@ $< +- + .c.o: + @am__fastdepCC_TRUE@ $(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\ + @am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\ +@@ -2085,7 +2049,6 @@ distclean: distclean-am + -rm -f ./$(DEPDIR)/pngwtran.Plo + -rm -f ./$(DEPDIR)/pngwutil.Plo + -rm -f arm/$(DEPDIR)/arm_init.Plo +- -rm -f arm/$(DEPDIR)/filter_neon.Plo + -rm -f arm/$(DEPDIR)/filter_neon_intrinsics.Plo + -rm -f arm/$(DEPDIR)/palette_neon_intrinsics.Plo + -rm -f contrib/libtests/$(DEPDIR)/pngimage.Po +@@ -2170,7 +2133,6 @@ maintainer-clean: maintainer-clean-am + -rm -f ./$(DEPDIR)/pngwtran.Plo + -rm -f ./$(DEPDIR)/pngwutil.Plo + -rm -f arm/$(DEPDIR)/arm_init.Plo +- -rm -f arm/$(DEPDIR)/filter_neon.Plo + -rm -f arm/$(DEPDIR)/filter_neon_intrinsics.Plo + -rm -f arm/$(DEPDIR)/palette_neon_intrinsics.Plo + -rm -f contrib/libtests/$(DEPDIR)/pngimage.Po +diff -up libpng-1.6.40/pngpriv.h.arm libpng-1.6.40/pngpriv.h +--- libpng-1.6.40/pngpriv.h.arm 2023-06-21 21:06:40.000000000 +0200 ++++ libpng-1.6.40/pngpriv.h 2024-08-08 08:31:00.904590829 +0200 +@@ -140,47 +140,6 @@ + * callbacks to do this. + */ + # define PNG_FILTER_OPTIMIZATIONS png_init_filter_functions_neon +- +- /* By default the 'intrinsics' code in arm/filter_neon_intrinsics.c is used +- * if possible - if __ARM_NEON__ is set and the compiler version is not known +- * to be broken. This is controlled by PNG_ARM_NEON_IMPLEMENTATION which can +- * be: +- * +- * 1 The intrinsics code (the default with __ARM_NEON__) +- * 2 The hand coded assembler (the default without __ARM_NEON__) +- * +- * It is possible to set PNG_ARM_NEON_IMPLEMENTATION in CPPFLAGS, however +- * this is *NOT* supported and may cease to work even after a minor revision +- * to libpng. It *is* valid to do this for testing purposes, e.g. speed +- * testing or a new compiler, but the results should be communicated to the +- * libpng implementation list for incorporation in the next minor release. +- */ +-# ifndef PNG_ARM_NEON_IMPLEMENTATION +-# if defined(__ARM_NEON__) || defined(__ARM_NEON) +-# if defined(__clang__) +- /* At present it is unknown by the libpng developers which versions +- * of clang support the intrinsics, however some or perhaps all +- * versions do not work with the assembler so this may be +- * irrelevant, so just use the default (do nothing here.) +- */ +-# elif defined(__GNUC__) +- /* GCC 4.5.4 NEON support is known to be broken. 4.6.3 is known to +- * work, so if this *is* GCC, or G++, look for a version >4.5 +- */ +-# if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 6) +-# define PNG_ARM_NEON_IMPLEMENTATION 2 +-# endif /* no GNUC support */ +-# endif /* __GNUC__ */ +-# else /* !defined __ARM_NEON__ */ +- /* The 'intrinsics' code simply won't compile without this -mfpu=neon: +- */ +-# if !defined(__aarch64__) && !defined(_M_ARM64) +- /* The assembler code currently does not work on ARM64 */ +-# define PNG_ARM_NEON_IMPLEMENTATION 2 +-# endif /* __aarch64__ */ +-# endif /* __ARM_NEON__ */ +-# endif /* !PNG_ARM_NEON_IMPLEMENTATION */ +- + # ifndef PNG_ARM_NEON_IMPLEMENTATION + /* Use the intrinsics code by default. */ + # define PNG_ARM_NEON_IMPLEMENTATION 1 diff --git a/SOURCES/libpng-multilib.patch b/libpng-multilib.patch similarity index 100% rename from SOURCES/libpng-multilib.patch rename to libpng-multilib.patch diff --git a/SPECS/libpng.spec b/libpng.spec similarity index 77% rename from SPECS/libpng.spec rename to libpng.spec index 211df44..16ecff4 100644 --- a/SPECS/libpng.spec +++ b/libpng.spec @@ -1,45 +1,49 @@ +%bcond_without check + Summary: A library of functions for manipulating PNG image format files Name: libpng Epoch: 2 -Version: 1.6.34 -Release: 10%{?dist} +Version: 1.6.40 +Release: 11%{?dist} License: zlib -Group: System Environment/Libraries URL: http://www.libpng.org/pub/png/ -# Note: non-current tarballs get moved to the history/ subdirectory, -# so look there if you fail to retrieve the version you want -Source0: https://ftp-osl.osuosl.org/pub/libpng/src/libpng16/libpng-%{version}.tar.xz +Source0: https://github.com/glennrp/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz Source1: pngusr.dfa Patch0: libpng-multilib.patch -Patch1: libpng-fix-arm-neon.patch -Patch2: libpng-CVE-2018-13785.patch -Patch3: libpng-coverity.patch -# from upstream, for <1.6.51, RHEL-131422 +# from upstream, for <1.6.44, fixes annoncheck on aarch64 as noeon asm prevents some hardening protection, based on +# https://github.com/pnggroup/libpng/commit/9e538750d99c8f1accf7e93878e4fde47c069908 +# https://github.com/pnggroup/libpng/commit/e4a31f024b6158aaaf55a43502f574d5f5d1c894 +Patch1: libpng-1.6.40-nomore_neon_asm.patch +# fix static analysis findings, RHEL-44993 +Patch2: libpng-1.6.40-fix_sast.patch +# from upstream, for <1.6.51, RHEL-131432 # https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643 -Patch4: libpng-1.6-CVE-2025-64720.patch -# from upstream, for <1.6.51, RHEL-131435 +Patch3: libpng-1.6-CVE-2025-64720.patch +# from upstream, for <1.6.51, RHEL-131445 # https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d -Patch5: libpng-1.6-CVE-2025-65018_p1of2.patch +Patch4: libpng-1.6-CVE-2025-65018_p1of2.patch # https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea -Patch6: libpng-1.6-CVE-2025-65018_p2of2.patch -# from upstream, for <1.6.52, RHEL-133212 +Patch5: libpng-1.6-CVE-2025-65018_p2of2.patch +# from upstream, for <1.6.52, RHEL-133216 # https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1 -Patch7: libpng-1.6-CVE-2025-66293_p1of2.patch +Patch6: libpng-1.6-CVE-2025-66293_p1of2.patch # https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a -Patch8: libpng-1.6-CVE-2025-66293_p2of2.patch -# from upstream, for <1.6.54, RHEL-148852 +Patch7: libpng-1.6-CVE-2025-66293_p2of2.patch +# from upstream, for <1.6.54, RHEL-148832 # https://github.com/pnggroup/libpng/commit/e4f7ad4ea2 -Patch9: libpng-1.6-cve-2026-22695.patch -# from upstream, for <1.6.54, RHEL-146659 +Patch8: libpng-1.6-cve-2026-22695.patch +# from upstream, for <1.6.54, RHEL-146650 # https://github.com/pnggroup/libpng/commit/cf155de014fc6c5cb199dd681dd5c8fb70429072 -Patch10: libpng-1.6-cve-2026-22801.patch -# from upstream, for <1.6.55, RHEL-148338 +Patch9: libpng-1.6-cve-2026-22801.patch +# from upstream, for <1.6.55, RHEL-148328 # https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88 -Patch11: libpng-1.6-cve-2026-25646.patch +Patch10: libpng-1.6-cve-2026-25646.patch +BuildRequires: gcc BuildRequires: zlib-devel BuildRequires: autoconf automake libtool +BuildRequires: make %description The libpng package contains a library of functions for creating and @@ -53,9 +57,8 @@ files. %package devel Summary: Development tools for programs to manipulate PNG image format files -Group: Development/Libraries Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} -Requires: zlib-devel%{?_isa} pkgconfig%{?_isa} +Requires: zlib-devel%{?_isa} pkgconfig %description devel The libpng-devel package contains header files and documentation necessary @@ -67,7 +70,6 @@ the libpng package. %package static Summary: Static PNG image format file library -Group: Development/Libraries Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release} %description static @@ -77,7 +79,6 @@ necessary for some boot packages. %package tools Summary: Tools for PNG image format file library -Group: Development/Libraries Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} %description tools @@ -89,32 +90,30 @@ The libpng-tools package contains tools used by the authors of libpng. cp -p %{SOURCE1} . %patch -P 0 -p1 -%patch -P 1 -p1 -b .arm -%patch -P 2 -p1 -b .CVE-2018-13785 -%patch -P 3 -p1 -b .coverity -%patch -P 4 -p1 -b .CVE-2025-64720 -%patch -P 5 -p1 -b .CVE-2025-65018_p1of2 -%patch -P 6 -p1 -b .CVE-2025-65018_p2of2 -%patch -P 7 -p1 -b .CVE-2025-66293_p1of2 -%patch -P 8 -p1 -b .CVE-2025-66293_p2of2 -%patch -P 9 -p1 -b .cve-2026-22695 -%patch -P 10 -p1 -b .cve-2026-22801 -%patch -P 11 -p1 -b .cve-2026-25646 +%patch -P 1 -p1 -b .nomore_neon_asm +%patch -P 2 -p1 -b .fix_sast +%patch -P 3 -p1 -b .CVE-2025-64720 +%patch -P 4 -p1 -b .CVE-2025-65018_p1of2 +%patch -P 5 -p1 -b .CVE-2025-65018_p2of2 +%patch -P 6 -p1 -b .CVE-2025-66293_p1of2 +%patch -P 7 -p1 -b .CVE-2025-66293_p2of2 +%patch -P 8 -p1 -b .cve-2026-22695 +%patch -P 9 -p1 -b .cve-2026-22801 +%patch -P 10 -p1 -b .cve-2026-25646 %build autoreconf -vif %configure -make %{?_smp_mflags} DFA_XTRA=pngusr.dfa +%make_build DFA_XTRA=pngusr.dfa %install -make DESTDIR=$RPM_BUILD_ROOT install +%make_install # We don't ship .la files. rm -f $RPM_BUILD_ROOT%{_libdir}/*.la +%if 0%{?with_check} %check -#to run make check use "--with check" -%if %{?_with_check:1}%{!?_with_check:0} make check %endif @@ -141,30 +140,110 @@ make check %{_bindir}/pngfix %changelog -* Thu Mar 05 2026 Michal Hlavinka - 2:1.6.34-10 -- fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148338) -- fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148852) -- fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146659) +* Tue Mar 03 2026 Michal Hlavinka - 2:1.6.40-11 +- fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148328) -* Tue Dec 16 2025 Michal Hlavinka - 2:1.6.34-9 -- CVE-2025-64720: buffer overflow (RHEL-131452) -- CVE-2025-65018: heap buffer overflow (RHEL-131465) -- CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133226) +* Thu Feb 19 2026 Michal Hlavinka - 2:1.6.40-10 +- fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148832) +- fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146650) -* Thu Nov 28 2019 Nikola Forró - 2:1.6.34-8 -- Remove redundant fix for CVE-2017-12652 +* Tue Jan 20 2026 Michal Hlavinka - 2:1.6.40-9 +- CVE-2025-64720: buffer overflow (RHEL-131432) +- CVE-2025-65018: heap buffer overflow (RHEL-131445) +- CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133216) -* Tue Nov 26 2019 Nikola Forró - 2:1.6.34-7 -- Add upstream test suite and enable it in gating +* Tue Oct 29 2024 Troy Dawson - 2:1.6.40-8 +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 -* Fri Nov 22 2019 Nikola Forró - 2:1.6.34-6 -- Fix CVE-2017-12652 (#1744871) +* Mon Aug 12 2024 Michal Hlavinka - 2:1.6.40-7 +- rebuild for rerunning tests -* Mon Oct 15 2018 Nikola Forró - 2:1.6.34-5 -- Fix important Covscan defects (#1602588) +* Thu Aug 08 2024 Michal Hlavinka - 2:1.6.40-6 +- fix hardening on aarch64 -* Wed Aug 01 2018 Nikola Forró - 2:1.6.34-4 -- Fix CVE-2018-13785 (#1599952) +* Tue Aug 06 2024 Michal Hlavinka - 2:1.6.40-5 +- fix static analysis findings (RHEL-44993) + +* Mon Jun 24 2024 Troy Dawson - 2:1.6.40-4 +- Bump release for June 2024 mass rebuild + +* Thu Jan 25 2024 Fedora Release Engineering - 2:1.6.40-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 2:1.6.40-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Sep 20 2023 Tulio Magno Quites Machado Filho - 2:1.6.40-1 +- Update to libpng 1.6.40 + +* Thu Jul 20 2023 Fedora Release Engineering - 2:1.6.37-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Thu Jan 19 2023 Fedora Release Engineering - 2:1.6.37-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Thu Jul 21 2022 Fedora Release Engineering - 2:1.6.37-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jan 20 2022 Fedora Release Engineering - 2:1.6.37-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Jul 22 2021 Fedora Release Engineering - 2:1.6.37-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Mar 24 2021 Nikola Forró - 2:1.6.37-10 +- Remove the aarch64 test workaround, the patches causing the failures + have been dropped in zlib-1.2.11-25 + +* Thu Feb 11 2021 Nikola Forró - 2:1.6.37-9 +- Run %check by default + +* Fri Feb 05 2021 Nikola Forró - 2:1.6.37-8 +- Use proper pngtest.png reference image on aarch64 + +* Tue Jan 26 2021 Fedora Release Engineering - 2:1.6.37-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Mon Nov 02 2020 Nikola Forró - 2:1.6.37-6 +- Remove libpng-devel dependency on arch-specific pkgconfig (#1893523) + +* Tue Jul 28 2020 Fedora Release Engineering - 2:1.6.37-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jul 13 2020 Tom Stellard - 2:1.6.37-4 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + +* Wed Jan 29 2020 Fedora Release Engineering - 2:1.6.37-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Thu Jul 25 2019 Fedora Release Engineering - 2:1.6.37-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Wed May 22 2019 Nikola Forró - 2:1.6.37-1 +- New upstream release 1.6.37 + +* Wed Feb 27 2019 Debarshi Ray - 2:1.6.36-1 +- New upstream release 1.6.36 + +* Fri Feb 08 2019 Nikola Forró - 2:1.6.35-3 +- Fix CVE-2019-7317 (#1672411) + +* Fri Feb 01 2019 Fedora Release Engineering - 2:1.6.35-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Wed Oct 10 2018 Nikola Forró - 2:1.6.35-1 +- New upstream release 1.6.35 (#1552349) + +* Wed Aug 01 2018 Nikola Forró - 2:1.6.34-6 +- Fix CVE-2018-13785 (#1599944) + +* Fri Jul 13 2018 Fedora Release Engineering - 2:1.6.34-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Tue Feb 20 2018 Nikola Forró - 2:1.6.34-4 +- Add missing gcc build dependency * Wed Feb 07 2018 Fedora Release Engineering - 2:1.6.34-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild diff --git a/SOURCES/pngusr.dfa b/pngusr.dfa similarity index 100% rename from SOURCES/pngusr.dfa rename to pngusr.dfa diff --git a/sources b/sources new file mode 100644 index 0000000..35a99f2 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (libpng-1.6.40.tar.gz) = 5f36a145c7d41f1c417d5f4e03be0155dae3499d72e67170acaad92c1af418c0bb6bc508e9b4b27ef4206bf0074cbf74978bade3bff28bc291867b8f8c2a38cf