rpms/libpng
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356)

Browse Source 
fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000)
Resolves: RHEL-147356
This commit is contained in:
Michal Hlavinka 2026-02-19 18:38:24 +01:00
parent 9d7ef89e97
commit e15db0d2dc
3 changed files with 76 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
libpng-1.6-cve-2026-22695.patch Normal file
View File

@ -0,0 +1,25 @@
diff --git a/pngread.c b/pngread.c
index e3426292b1..9d86b01dc0 100644
--- a/pngread.c
+++ b/pngread.c
@@ -3138,9 +3138,11 @@ png_image_read_direct_scaled(png_voidp argument)
argument);
png_imagep image = display->image;
png_structrp png_ptr = image->opaque->png_ptr;
+ png_inforp info_ptr = image->opaque->info_ptr;
png_bytep local_row = png_voidcast(png_bytep, display->local_row);
png_bytep first_row = png_voidcast(png_bytep, display->first_row);
ptrdiff_t row_bytes = display->row_bytes;
+ size_t copy_bytes = png_get_rowbytes(png_ptr, info_ptr);
int passes;
/* Handle interlacing. */
@@ -3170,7 +3172,7 @@ png_image_read_direct_scaled(png_voidp argument)
png_read_row(png_ptr, local_row, NULL);
/* Copy from local_row to user buffer. */
- memcpy(output_row, local_row, (size_t)row_bytes);
+ memcpy(output_row, local_row, copy_bytes);
output_row += row_bytes;
}
}

38
libpng-1.6-cve-2026-22801.patch Normal file
View File

@ -0,0 +1,38 @@
diff --git a/pngwrite.c b/pngwrite.c
index 08066bcc42..a95b846c8e 100644
@@ -1678,7 +1678,7 @@ png_write_image_16bit(png_voidp argument)
}
png_write_row(png_ptr, png_voidcast(png_const_bytep, display->local_row));
- input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
+ input_row += display->row_bytes / 2;
}
return 1;
@@ -1804,7 +1804,7 @@ png_write_image_8bit(png_voidp argument)
png_write_row(png_ptr, png_voidcast(png_const_bytep,
display->local_row));
- input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
+ input_row += display->row_bytes / 2;
} /* while y */
}
@@ -1829,7 +1829,7 @@ png_write_image_8bit(png_voidp argument)
}
png_write_row(png_ptr, output_row);
- input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
+ input_row += display->row_bytes / 2;
}
}
@@ -2148,7 +2148,7 @@ png_image_write_main(png_voidp argument)
ptrdiff_t row_bytes = display->row_stride;
if (linear != 0)
- row_bytes *= (sizeof (png_uint_16));
+ row_bytes *= 2;
if (row_bytes < 0)
row += (image->height-1) * (-row_bytes);

14
libpng.spec
View File

@ -4,7 +4,7 @@ Summary: A library of functions for manipulating PNG image format files
Name: libpng
Epoch: 2
Version: 1.6.37
Release: 13%{?dist}
Release: 14%{?dist}
License: zlib
URL: http://www.libpng.org/pub/png/
@ -25,6 +25,12 @@ Patch4: libpng-1.6-CVE-2025-65018_p2of2.patch
Patch5: libpng-1.6-CVE-2025-66293_p1of2.patch
# https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a
Patch6: libpng-1.6-CVE-2025-66293_p2of2.patch
# from upstream, for <1.6.54, RHEL-147356
# https://github.com/pnggroup/libpng/commit/e4f7ad4ea2
Patch7: libpng-1.6-cve-2026-22695.patch
# from upstream, for <1.6.54, RHEL-149000
# https://github.com/pnggroup/libpng/commit/cf155de014fc6c5cb199dd681dd5c8fb70429072
Patch8: libpng-1.6-cve-2026-22801.patch
BuildRequires: gcc
BuildRequires: zlib-devel
@ -82,6 +88,8 @@ cp -p %{SOURCE1} .
%patch -P 4 -p1 -b .CVE-2025-65018_p2of2
%patch -P 5 -p1 -b .CVE-2025-66293_p1of2
%patch -P 6 -p1 -b .CVE-2025-66293_p2of2
%patch -P 7 -p1 -b .cve-2026-22695
%patch -P 8 -p1 -b .cve-2026-22801
%build
autoreconf -vif
@ -122,6 +130,10 @@ make check
%{_bindir}/pngfix
%changelog
* Thu Feb 19 2026 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-14
- fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356)
- fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000)
* Wed Jan 21 2026 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-13
- CVE-2025-64720: buffer overflow (RHEL-131594)
- CVE-2025-65018: heap buffer overflow (RHEL-131603)