Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 5db91295c5 | |||
| f86ee8ad91 |
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
|||||||
SOURCES/libpng-1.6.34.tar.xz
|
libpng-1.6.40.tar.gz
|
||||||
|
|||||||
@ -1 +0,0 @@
|
|||||||
45de4ec996ffcc3e18037e7c128abe95f4d0292a SOURCES/libpng-1.6.34.tar.xz
|
|
||||||
@ -1,34 +0,0 @@
|
|||||||
From 9821583a771bfe2c75b7449d8ff83cb348291b3f Mon Sep 17 00:00:00 2001
|
|
||||||
From: Cosmin Truta <ctruta@gmail.com>
|
|
||||||
Date: Sun, 17 Jun 2018 22:56:29 -0400
|
|
||||||
Subject: [PATCH] Fix the calculation of row_factor in png_check_chunk_length
|
|
||||||
|
|
||||||
(Bug report by Thuan Pham, SourceForge issue #278)
|
|
||||||
---
|
|
||||||
pngrutil.c | 9 ++++++---
|
|
||||||
1 file changed, 6 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/pngrutil.c b/pngrutil.c
|
|
||||||
index 8692933..eab2973 100644
|
|
||||||
--- a/pngrutil.c
|
|
||||||
+++ b/pngrutil.c
|
|
||||||
@@ -3149,10 +3149,13 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
|
|
||||||
{
|
|
||||||
png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
|
|
||||||
size_t row_factor =
|
|
||||||
- (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
|
|
||||||
- + 1 + (png_ptr->interlaced? 6: 0));
|
|
||||||
+ (size_t)png_ptr->width
|
|
||||||
+ * (size_t)png_ptr->channels
|
|
||||||
+ * (png_ptr->bit_depth > 8? 2: 1)
|
|
||||||
+ + 1
|
|
||||||
+ + (png_ptr->interlaced? 6: 0);
|
|
||||||
if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
|
|
||||||
- idat_limit=PNG_UINT_31_MAX;
|
|
||||||
+ idat_limit = PNG_UINT_31_MAX;
|
|
||||||
else
|
|
||||||
idat_limit = png_ptr->height * row_factor;
|
|
||||||
row_factor = row_factor > 32566? 32566 : row_factor;
|
|
||||||
--
|
|
||||||
2.17.1
|
|
||||||
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
diff --git a/libpng-config.in b/libpng-config.in
|
|
||||||
index 3739eb9..7f6b2cc 100644
|
|
||||||
--- a/libpng-config.in
|
|
||||||
+++ b/libpng-config.in
|
|
||||||
@@ -13,7 +13,6 @@
|
|
||||||
|
|
||||||
version=`pkg-config --modversion libpng`
|
|
||||||
prefix=`pkg-config --variable prefix libpng`
|
|
||||||
-exec_prefix=`pkg-config --variable exec_prefix libpng`
|
|
||||||
libdir=`pkg-config --variable libdir libpng`
|
|
||||||
includedir=`pkg-config --variable includedir libpng`
|
|
||||||
libs="-lpng@PNGLIB_MAJOR@@PNGLIB_MINOR@"
|
|
||||||
@ -1,39 +0,0 @@
|
|||||||
diff --git a/configure.ac b/configure.ac
|
|
||||||
index 4fb0778..930bf50 100644
|
|
||||||
--- a/configure.ac
|
|
||||||
+++ b/configure.ac
|
|
||||||
@@ -283,17 +283,21 @@ AC_ARG_ENABLE([arm-neon],
|
|
||||||
[case "$enableval" in
|
|
||||||
no|off)
|
|
||||||
# disable the default enabling on __ARM_NEON__ systems:
|
|
||||||
+ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
|
|
||||||
AC_DEFINE([PNG_ARM_NEON_OPT], [0],
|
|
||||||
[Disable ARM Neon optimizations])
|
|
||||||
# Prevent inclusion of the assembler files below:
|
|
||||||
enable_arm_neon=no;;
|
|
||||||
check)
|
|
||||||
+ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
|
|
||||||
AC_DEFINE([PNG_ARM_NEON_CHECK_SUPPORTED], [],
|
|
||||||
[Check for ARM Neon support at run-time]);;
|
|
||||||
api)
|
|
||||||
+ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
|
|
||||||
AC_DEFINE([PNG_ARM_NEON_API_SUPPORTED], [],
|
|
||||||
[Turn on ARM Neon optimizations at run-time]);;
|
|
||||||
yes|on)
|
|
||||||
+ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
|
|
||||||
AC_DEFINE([PNG_ARM_NEON_OPT], [2],
|
|
||||||
[Enable ARM Neon optimizations])
|
|
||||||
AC_MSG_WARN([--enable-arm-neon: please specify 'check' or 'api', if]
|
|
||||||
diff --git a/pngpriv.h b/pngpriv.h
|
|
||||||
index 1997503..789206f 100644
|
|
||||||
--- a/pngpriv.h
|
|
||||||
+++ b/pngpriv.h
|
|
||||||
@@ -125,7 +125,7 @@
|
|
||||||
* associated assembler code, pass --enable-arm-neon=no to configure
|
|
||||||
* or put -DPNG_ARM_NEON_OPT=0 in CPPFLAGS.
|
|
||||||
*/
|
|
||||||
-# if (defined(__ARM_NEON__) || defined(__ARM_NEON)) && \
|
|
||||||
+# if defined(PNG_ARM_NEON) && (defined(__ARM_NEON__) || defined(__ARM_NEON)) && \
|
|
||||||
defined(PNG_ALIGNED_MEMORY_SUPPORTED)
|
|
||||||
# define PNG_ARM_NEON_OPT 2
|
|
||||||
# else
|
|
||||||
69
libpng-1.6-CVE-2025-64720.patch
Normal file
69
libpng-1.6-CVE-2025-64720.patch
Normal file
@ -0,0 +1,69 @@
|
|||||||
|
diff --git a/pngrtran.c b/pngrtran.c
|
||||||
|
index 548780030a..2f52022551 100644
|
||||||
|
--- a/pngrtran.c
|
||||||
|
+++ b/pngrtran.c
|
||||||
|
@@ -1781,19 +1781,51 @@ png_init_read_transformations(png_structrp png_ptr)
|
||||||
|
}
|
||||||
|
else /* if (png_ptr->trans_alpha[i] != 0xff) */
|
||||||
|
{
|
||||||
|
- png_byte v, w;
|
||||||
|
-
|
||||||
|
- v = png_ptr->gamma_to_1[palette[i].red];
|
||||||
|
- png_composite(w, v, png_ptr->trans_alpha[i], back_1.red);
|
||||||
|
- palette[i].red = png_ptr->gamma_from_1[w];
|
||||||
|
-
|
||||||
|
- v = png_ptr->gamma_to_1[palette[i].green];
|
||||||
|
- png_composite(w, v, png_ptr->trans_alpha[i], back_1.green);
|
||||||
|
- palette[i].green = png_ptr->gamma_from_1[w];
|
||||||
|
-
|
||||||
|
- v = png_ptr->gamma_to_1[palette[i].blue];
|
||||||
|
- png_composite(w, v, png_ptr->trans_alpha[i], back_1.blue);
|
||||||
|
- palette[i].blue = png_ptr->gamma_from_1[w];
|
||||||
|
+ if ((png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0)
|
||||||
|
+ {
|
||||||
|
+ /* Premultiply only:
|
||||||
|
+ * component = round((component * alpha) / 255)
|
||||||
|
+ */
|
||||||
|
+ png_uint_32 component;
|
||||||
|
+
|
||||||
|
+ component = png_ptr->gamma_to_1[palette[i].red];
|
||||||
|
+ component =
|
||||||
|
+ (component * png_ptr->trans_alpha[i] + 128) / 255;
|
||||||
|
+ palette[i].red = png_ptr->gamma_from_1[component];
|
||||||
|
+
|
||||||
|
+ component = png_ptr->gamma_to_1[palette[i].green];
|
||||||
|
+ component =
|
||||||
|
+ (component * png_ptr->trans_alpha[i] + 128) / 255;
|
||||||
|
+ palette[i].green = png_ptr->gamma_from_1[component];
|
||||||
|
+
|
||||||
|
+ component = png_ptr->gamma_to_1[palette[i].blue];
|
||||||
|
+ component =
|
||||||
|
+ (component * png_ptr->trans_alpha[i] + 128) / 255;
|
||||||
|
+ palette[i].blue = png_ptr->gamma_from_1[component];
|
||||||
|
+ }
|
||||||
|
+ else
|
||||||
|
+ {
|
||||||
|
+ /* Composite with background color:
|
||||||
|
+ * component =
|
||||||
|
+ * alpha * component + (1 - alpha) * background
|
||||||
|
+ */
|
||||||
|
+ png_byte v, w;
|
||||||
|
+
|
||||||
|
+ v = png_ptr->gamma_to_1[palette[i].red];
|
||||||
|
+ png_composite(w, v,
|
||||||
|
+ png_ptr->trans_alpha[i], back_1.red);
|
||||||
|
+ palette[i].red = png_ptr->gamma_from_1[w];
|
||||||
|
+
|
||||||
|
+ v = png_ptr->gamma_to_1[palette[i].green];
|
||||||
|
+ png_composite(w, v,
|
||||||
|
+ png_ptr->trans_alpha[i], back_1.green);
|
||||||
|
+ palette[i].green = png_ptr->gamma_from_1[w];
|
||||||
|
+
|
||||||
|
+ v = png_ptr->gamma_to_1[palette[i].blue];
|
||||||
|
+ png_composite(w, v,
|
||||||
|
+ png_ptr->trans_alpha[i], back_1.blue);
|
||||||
|
+ palette[i].blue = png_ptr->gamma_from_1[w];
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
25
libpng-1.6-CVE-2025-65018_p1of2.patch
Normal file
25
libpng-1.6-CVE-2025-65018_p1of2.patch
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
diff --git a/pngread.c b/pngread.c
|
||||||
|
index 212afb7d21..92571ec335 100644
|
||||||
|
--- a/pngread.c
|
||||||
|
+++ b/pngread.c
|
||||||
|
@@ -4040,6 +4040,20 @@ png_image_finish_read(png_imagep image, png_const_colorp background,
|
||||||
|
int result;
|
||||||
|
png_image_read_control display;
|
||||||
|
|
||||||
|
+ /* Reject bit depth mismatches to avoid buffer overflows. */
|
||||||
|
+ png_uint_32 ihdr_bit_depth =
|
||||||
|
+ image->opaque->png_ptr->bit_depth;
|
||||||
|
+ int requested_linear =
|
||||||
|
+ (image->format & PNG_FORMAT_FLAG_LINEAR) != 0;
|
||||||
|
+ if (ihdr_bit_depth == 16 && !requested_linear)
|
||||||
|
+ return png_image_error(image,
|
||||||
|
+ "png_image_finish_read: "
|
||||||
|
+ "16-bit PNG must use 16-bit output format");
|
||||||
|
+ if (ihdr_bit_depth < 16 && requested_linear)
|
||||||
|
+ return png_image_error(image,
|
||||||
|
+ "png_image_finish_read: "
|
||||||
|
+ "8-bit PNG must not use 16-bit output format");
|
||||||
|
+
|
||||||
|
memset(&display, 0, (sizeof display));
|
||||||
|
display.image = image;
|
||||||
|
display.buffer = buffer;
|
||||||
130
libpng-1.6-CVE-2025-65018_p2of2.patch
Normal file
130
libpng-1.6-CVE-2025-65018_p2of2.patch
Normal file
@ -0,0 +1,130 @@
|
|||||||
|
diff --git a/pngread.c b/pngread.c
|
||||||
|
index 92571ec335..79917daaaf 100644
|
||||||
|
--- a/pngread.c
|
||||||
|
+++ b/pngread.c
|
||||||
|
@@ -3129,6 +3129,54 @@ png_image_read_colormapped(png_voidp argument)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
+/* Row reading for interlaced 16-to-8 bit depth conversion with local buffer. */
|
||||||
|
+static int
|
||||||
|
+png_image_read_direct_scaled(png_voidp argument)
|
||||||
|
+{
|
||||||
|
+ png_image_read_control *display = png_voidcast(png_image_read_control*,
|
||||||
|
+ argument);
|
||||||
|
+ png_imagep image = display->image;
|
||||||
|
+ png_structrp png_ptr = image->opaque->png_ptr;
|
||||||
|
+ png_bytep local_row = png_voidcast(png_bytep, display->local_row);
|
||||||
|
+ png_bytep first_row = png_voidcast(png_bytep, display->first_row);
|
||||||
|
+ ptrdiff_t row_bytes = display->row_bytes;
|
||||||
|
+ int passes;
|
||||||
|
+
|
||||||
|
+ /* Handle interlacing. */
|
||||||
|
+ switch (png_ptr->interlaced)
|
||||||
|
+ {
|
||||||
|
+ case PNG_INTERLACE_NONE:
|
||||||
|
+ passes = 1;
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ case PNG_INTERLACE_ADAM7:
|
||||||
|
+ passes = PNG_INTERLACE_ADAM7_PASSES;
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ default:
|
||||||
|
+ png_error(png_ptr, "unknown interlace type");
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /* Read each pass using local_row as intermediate buffer. */
|
||||||
|
+ while (--passes >= 0)
|
||||||
|
+ {
|
||||||
|
+ png_uint_32 y = image->height;
|
||||||
|
+ png_bytep output_row = first_row;
|
||||||
|
+
|
||||||
|
+ for (; y > 0; --y)
|
||||||
|
+ {
|
||||||
|
+ /* Read into local_row (gets transformed 8-bit data). */
|
||||||
|
+ png_read_row(png_ptr, local_row, NULL);
|
||||||
|
+
|
||||||
|
+ /* Copy from local_row to user buffer. */
|
||||||
|
+ memcpy(output_row, local_row, (size_t)row_bytes);
|
||||||
|
+ output_row += row_bytes;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/* Just the row reading part of png_image_read. */
|
||||||
|
static int
|
||||||
|
png_image_read_composite(png_voidp argument)
|
||||||
|
@@ -3547,6 +3595,7 @@ png_image_read_direct(png_voidp argument)
|
||||||
|
int linear = (format & PNG_FORMAT_FLAG_LINEAR) != 0;
|
||||||
|
int do_local_compose = 0;
|
||||||
|
int do_local_background = 0; /* to avoid double gamma correction bug */
|
||||||
|
+ int do_local_scale = 0; /* for interlaced 16-to-8 bit conversion */
|
||||||
|
int passes = 0;
|
||||||
|
|
||||||
|
/* Add transforms to ensure the correct output format is produced then check
|
||||||
|
@@ -3680,8 +3729,16 @@ png_image_read_direct(png_voidp argument)
|
||||||
|
png_set_expand_16(png_ptr);
|
||||||
|
|
||||||
|
else /* 8-bit output */
|
||||||
|
+ {
|
||||||
|
png_set_scale_16(png_ptr);
|
||||||
|
|
||||||
|
+ /* For interlaced images, use local_row buffer to avoid overflow
|
||||||
|
+ * in png_combine_row() which writes using IHDR bit-depth.
|
||||||
|
+ */
|
||||||
|
+ if (png_ptr->interlaced != 0)
|
||||||
|
+ do_local_scale = 1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
change &= ~PNG_FORMAT_FLAG_LINEAR;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -3957,6 +4014,24 @@ png_image_read_direct(png_voidp argument)
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ else if (do_local_scale != 0)
|
||||||
|
+ {
|
||||||
|
+ /* For interlaced 16-to-8 conversion, use an intermediate row buffer
|
||||||
|
+ * to avoid buffer overflows in png_combine_row. The local_row is sized
|
||||||
|
+ * for the transformed (8-bit) output, preventing the overflow that would
|
||||||
|
+ * occur if png_combine_row wrote 16-bit data directly to the user buffer.
|
||||||
|
+ */
|
||||||
|
+ int result;
|
||||||
|
+ png_voidp row = png_malloc(png_ptr, png_get_rowbytes(png_ptr, info_ptr));
|
||||||
|
+
|
||||||
|
+ display->local_row = row;
|
||||||
|
+ result = png_safe_execute(image, png_image_read_direct_scaled, display);
|
||||||
|
+ display->local_row = NULL;
|
||||||
|
+ png_free(png_ptr, row);
|
||||||
|
+
|
||||||
|
+ return result;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
else
|
||||||
|
{
|
||||||
|
png_alloc_size_t row_bytes = (png_alloc_size_t)display->row_bytes;
|
||||||
|
@@ -4040,20 +4115,6 @@ png_image_finish_read(png_imagep image, png_const_colorp background,
|
||||||
|
int result;
|
||||||
|
png_image_read_control display;
|
||||||
|
|
||||||
|
- /* Reject bit depth mismatches to avoid buffer overflows. */
|
||||||
|
- png_uint_32 ihdr_bit_depth =
|
||||||
|
- image->opaque->png_ptr->bit_depth;
|
||||||
|
- int requested_linear =
|
||||||
|
- (image->format & PNG_FORMAT_FLAG_LINEAR) != 0;
|
||||||
|
- if (ihdr_bit_depth == 16 && !requested_linear)
|
||||||
|
- return png_image_error(image,
|
||||||
|
- "png_image_finish_read: "
|
||||||
|
- "16-bit PNG must use 16-bit output format");
|
||||||
|
- if (ihdr_bit_depth < 16 && requested_linear)
|
||||||
|
- return png_image_error(image,
|
||||||
|
- "png_image_finish_read: "
|
||||||
|
- "8-bit PNG must not use 16-bit output format");
|
||||||
|
-
|
||||||
|
memset(&display, 0, (sizeof display));
|
||||||
|
display.image = image;
|
||||||
|
display.buffer = buffer;
|
||||||
21
libpng-1.6-CVE-2025-66293_p1of2.patch
Normal file
21
libpng-1.6-CVE-2025-66293_p1of2.patch
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
diff --git a/pngread.c b/pngread.c
|
||||||
|
index 79917daaaf..ab62edd9d8 100644
|
||||||
|
--- a/pngread.c
|
||||||
|
+++ b/pngread.c
|
||||||
|
@@ -3273,9 +3273,14 @@ png_image_read_composite(png_voidp argument)
|
||||||
|
component += (255-alpha)*png_sRGB_table[outrow[c]];
|
||||||
|
|
||||||
|
/* So 'component' is scaled by 255*65535 and is
|
||||||
|
- * therefore appropriate for the sRGB to linear
|
||||||
|
- * conversion table.
|
||||||
|
+ * therefore appropriate for the sRGB-to-linear
|
||||||
|
+ * conversion table. Clamp to the valid range
|
||||||
|
+ * as a defensive measure against an internal
|
||||||
|
+ * libpng bug where the data is sRGB rather than
|
||||||
|
+ * linear premultiplied.
|
||||||
|
*/
|
||||||
|
+ if (component > 255*65535)
|
||||||
|
+ component = 255*65535;
|
||||||
|
component = PNG_sRGB_FROM_LINEAR(component);
|
||||||
|
}
|
||||||
|
|
||||||
88
libpng-1.6-CVE-2025-66293_p2of2.patch
Normal file
88
libpng-1.6-CVE-2025-66293_p2of2.patch
Normal file
@ -0,0 +1,88 @@
|
|||||||
|
diff --git a/pngread.c b/pngread.c
|
||||||
|
index ab62edd9d8..f8ca2b7e31 100644
|
||||||
|
--- a/pngread.c
|
||||||
|
+++ b/pngread.c
|
||||||
|
@@ -3207,6 +3207,7 @@ png_image_read_composite(png_voidp argument)
|
||||||
|
ptrdiff_t step_row = display->row_bytes;
|
||||||
|
unsigned int channels =
|
||||||
|
(image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
|
||||||
|
+ int optimize_alpha = (png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0;
|
||||||
|
int pass;
|
||||||
|
|
||||||
|
for (pass = 0; pass < passes; ++pass)
|
||||||
|
@@ -3263,25 +3264,44 @@ png_image_read_composite(png_voidp argument)
|
||||||
|
|
||||||
|
if (alpha < 255) /* else just use component */
|
||||||
|
{
|
||||||
|
- /* This is PNG_OPTIMIZED_ALPHA, the component value
|
||||||
|
- * is a linear 8-bit value. Combine this with the
|
||||||
|
- * current outrow[c] value which is sRGB encoded.
|
||||||
|
- * Arithmetic here is 16-bits to preserve the output
|
||||||
|
- * values correctly.
|
||||||
|
- */
|
||||||
|
- component *= 257*255; /* =65535 */
|
||||||
|
- component += (255-alpha)*png_sRGB_table[outrow[c]];
|
||||||
|
-
|
||||||
|
- /* So 'component' is scaled by 255*65535 and is
|
||||||
|
- * therefore appropriate for the sRGB-to-linear
|
||||||
|
- * conversion table. Clamp to the valid range
|
||||||
|
- * as a defensive measure against an internal
|
||||||
|
- * libpng bug where the data is sRGB rather than
|
||||||
|
- * linear premultiplied.
|
||||||
|
- */
|
||||||
|
- if (component > 255*65535)
|
||||||
|
- component = 255*65535;
|
||||||
|
- component = PNG_sRGB_FROM_LINEAR(component);
|
||||||
|
+ if (optimize_alpha != 0)
|
||||||
|
+ {
|
||||||
|
+ /* This is PNG_OPTIMIZED_ALPHA, the component value
|
||||||
|
+ * is a linear 8-bit value. Combine this with the
|
||||||
|
+ * current outrow[c] value which is sRGB encoded.
|
||||||
|
+ * Arithmetic here is 16-bits to preserve the output
|
||||||
|
+ * values correctly.
|
||||||
|
+ */
|
||||||
|
+ component *= 257*255; /* =65535 */
|
||||||
|
+ component += (255-alpha)*png_sRGB_table[outrow[c]];
|
||||||
|
+
|
||||||
|
+ /* Clamp to the valid range to defend against
|
||||||
|
+ * unforeseen cases where the data might be sRGB
|
||||||
|
+ * instead of linear premultiplied.
|
||||||
|
+ * (Belt-and-suspenders for GitHub Issue #764.)
|
||||||
|
+ */
|
||||||
|
+ if (component > 255*65535)
|
||||||
|
+ component = 255*65535;
|
||||||
|
+
|
||||||
|
+ /* So 'component' is scaled by 255*65535 and is
|
||||||
|
+ * therefore appropriate for the sRGB-to-linear
|
||||||
|
+ * conversion table.
|
||||||
|
+ */
|
||||||
|
+ component = PNG_sRGB_FROM_LINEAR(component);
|
||||||
|
+ }
|
||||||
|
+ else
|
||||||
|
+ {
|
||||||
|
+ /* Compositing was already done on the palette
|
||||||
|
+ * entries. The data is sRGB premultiplied on black.
|
||||||
|
+ * Composite with the background in sRGB space.
|
||||||
|
+ * This is not gamma-correct, but matches what was
|
||||||
|
+ * done to the palette.
|
||||||
|
+ */
|
||||||
|
+ png_uint_32 background = outrow[c];
|
||||||
|
+ component += ((255-alpha) * background + 127) / 255;
|
||||||
|
+ if (component > 255)
|
||||||
|
+ component = 255;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
outrow[c] = (png_byte)component;
|
||||||
|
diff --git a/pngrtran.c b/pngrtran.c
|
||||||
|
index 2f52022551..507d11381e 100644
|
||||||
|
--- a/pngrtran.c
|
||||||
|
+++ b/pngrtran.c
|
||||||
|
@@ -1843,6 +1843,7 @@ png_init_read_transformations(png_structrp png_ptr)
|
||||||
|
* transformations elsewhere.
|
||||||
|
*/
|
||||||
|
png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA);
|
||||||
|
+ png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
|
||||||
|
} /* color_type == PNG_COLOR_TYPE_PALETTE */
|
||||||
|
|
||||||
|
/* if (png_ptr->background_gamma_type!=PNG_BACKGROUND_GAMMA_UNKNOWN) */
|
||||||
12
libpng-1.6.40-fix_sast.patch
Normal file
12
libpng-1.6.40-fix_sast.patch
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
diff -up libpng-1.6.40/pngrutil.c.fix_sast libpng-1.6.40/pngrutil.c
|
||||||
|
--- libpng-1.6.40/pngrutil.c.fix_sast 2024-08-06 15:35:51.789156138 +0200
|
||||||
|
+++ libpng-1.6.40/pngrutil.c 2024-08-06 15:35:51.816156415 +0200
|
||||||
|
@@ -1815,7 +1815,7 @@ png_handle_sPLT(png_structrp png_ptr, pn
|
||||||
|
void /* PRIVATE */
|
||||||
|
png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
|
||||||
|
{
|
||||||
|
- png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
|
||||||
|
+ png_byte readbuf[PNG_MAX_PALETTE_LENGTH] = {0};
|
||||||
|
|
||||||
|
png_debug(1, "in png_handle_tRNS");
|
||||||
|
|
||||||
200
libpng-1.6.40-nomore_neon_asm.patch
Normal file
200
libpng-1.6.40-nomore_neon_asm.patch
Normal file
@ -0,0 +1,200 @@
|
|||||||
|
diff -up libpng-1.6.40/CMakeLists.txt.arm libpng-1.6.40/CMakeLists.txt
|
||||||
|
--- libpng-1.6.40/CMakeLists.txt.arm 2024-08-08 08:31:00.902590808 +0200
|
||||||
|
+++ libpng-1.6.40/CMakeLists.txt 2024-08-08 08:34:50.295999649 +0200
|
||||||
|
@@ -126,7 +126,6 @@ if(TARGET_ARCH MATCHES "^arm" OR
|
||||||
|
elseif(NOT ${PNG_ARM_NEON} STREQUAL "off")
|
||||||
|
set(libpng_arm_sources
|
||||||
|
arm/arm_init.c
|
||||||
|
- arm/filter_neon.S
|
||||||
|
arm/filter_neon_intrinsics.c
|
||||||
|
arm/palette_neon_intrinsics.c)
|
||||||
|
if(${PNG_ARM_NEON} STREQUAL "on")
|
||||||
|
diff -up libpng-1.6.40/Makefile.am.arm libpng-1.6.40/Makefile.am
|
||||||
|
--- libpng-1.6.40/Makefile.am.arm 2023-06-21 21:06:40.000000000 +0200
|
||||||
|
+++ libpng-1.6.40/Makefile.am 2024-08-08 08:31:00.903590819 +0200
|
||||||
|
@@ -94,7 +94,7 @@ libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_SO
|
||||||
|
|
||||||
|
if PNG_ARM_NEON
|
||||||
|
libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_SOURCES += arm/arm_init.c\
|
||||||
|
- arm/filter_neon.S arm/filter_neon_intrinsics.c \
|
||||||
|
+ arm/filter_neon_intrinsics.c \
|
||||||
|
arm/palette_neon_intrinsics.c
|
||||||
|
endif
|
||||||
|
|
||||||
|
diff -up libpng-1.6.40/Makefile.in.arm libpng-1.6.40/Makefile.in
|
||||||
|
--- libpng-1.6.40/Makefile.in.arm 2023-06-21 21:06:40.000000000 +0200
|
||||||
|
+++ libpng-1.6.40/Makefile.in 2024-08-08 08:41:47.242186003 +0200
|
||||||
|
@@ -106,7 +106,7 @@ check_PROGRAMS = pngtest$(EXEEXT) pngunk
|
||||||
|
@HAVE_CLOCK_GETTIME_TRUE@am__append_1 = timepng
|
||||||
|
bin_PROGRAMS = pngfix$(EXEEXT) png-fix-itxt$(EXEEXT)
|
||||||
|
@PNG_ARM_NEON_TRUE@am__append_2 = arm/arm_init.c\
|
||||||
|
-@PNG_ARM_NEON_TRUE@ arm/filter_neon.S arm/filter_neon_intrinsics.c \
|
||||||
|
+@PNG_ARM_NEON_TRUE@ arm/filter_neon_intrinsics.c \
|
||||||
|
@PNG_ARM_NEON_TRUE@ arm/palette_neon_intrinsics.c
|
||||||
|
|
||||||
|
@PNG_MIPS_MSA_TRUE@am__append_3 = mips/mips_init.c\
|
||||||
|
@@ -183,13 +183,13 @@ am__libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_l
|
||||||
|
pngrtran.c pngrutil.c pngset.c pngtrans.c pngwio.c pngwrite.c \
|
||||||
|
pngwtran.c pngwutil.c png.h pngconf.h pngdebug.h pnginfo.h \
|
||||||
|
pngpriv.h pngstruct.h pngusr.dfa arm/arm_init.c \
|
||||||
|
- arm/filter_neon.S arm/filter_neon_intrinsics.c \
|
||||||
|
+ arm/filter_neon_intrinsics.c \
|
||||||
|
arm/palette_neon_intrinsics.c mips/mips_init.c \
|
||||||
|
mips/filter_msa_intrinsics.c intel/intel_init.c \
|
||||||
|
intel/filter_sse2_intrinsics.c powerpc/powerpc_init.c \
|
||||||
|
powerpc/filter_vsx_intrinsics.c
|
||||||
|
am__dirstamp = $(am__leading_dot)dirstamp
|
||||||
|
-@PNG_ARM_NEON_TRUE@am__objects_1 = arm/arm_init.lo arm/filter_neon.lo \
|
||||||
|
+@PNG_ARM_NEON_TRUE@am__objects_1 = arm/arm_init.lo \
|
||||||
|
@PNG_ARM_NEON_TRUE@ arm/filter_neon_intrinsics.lo \
|
||||||
|
@PNG_ARM_NEON_TRUE@ arm/palette_neon_intrinsics.lo
|
||||||
|
@PNG_MIPS_MSA_TRUE@am__objects_2 = mips/mips_init.lo \
|
||||||
|
@@ -267,7 +267,7 @@ am__depfiles_remade = ./$(DEPDIR)/png.Pl
|
||||||
|
./$(DEPDIR)/pngtest.Po ./$(DEPDIR)/pngtrans.Plo \
|
||||||
|
./$(DEPDIR)/pngwio.Plo ./$(DEPDIR)/pngwrite.Plo \
|
||||||
|
./$(DEPDIR)/pngwtran.Plo ./$(DEPDIR)/pngwutil.Plo \
|
||||||
|
- arm/$(DEPDIR)/arm_init.Plo arm/$(DEPDIR)/filter_neon.Plo \
|
||||||
|
+ arm/$(DEPDIR)/arm_init.Plo \
|
||||||
|
arm/$(DEPDIR)/filter_neon_intrinsics.Plo \
|
||||||
|
arm/$(DEPDIR)/palette_neon_intrinsics.Plo \
|
||||||
|
contrib/libtests/$(DEPDIR)/pngimage.Po \
|
||||||
|
@@ -285,16 +285,6 @@ am__depfiles_remade = ./$(DEPDIR)/png.Pl
|
||||||
|
powerpc/$(DEPDIR)/filter_vsx_intrinsics.Plo \
|
||||||
|
powerpc/$(DEPDIR)/powerpc_init.Plo
|
||||||
|
am__mv = mv -f
|
||||||
|
-CPPASCOMPILE = $(CCAS) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
|
||||||
|
- $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CCASFLAGS) $(CCASFLAGS)
|
||||||
|
-LTCPPASCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
|
||||||
|
- $(LIBTOOLFLAGS) --mode=compile $(CCAS) $(DEFS) \
|
||||||
|
- $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
|
||||||
|
- $(AM_CCASFLAGS) $(CCASFLAGS)
|
||||||
|
-AM_V_CPPAS = $(am__v_CPPAS_@AM_V@)
|
||||||
|
-am__v_CPPAS_ = $(am__v_CPPAS_@AM_DEFAULT_V@)
|
||||||
|
-am__v_CPPAS_0 = @echo " CPPAS " $@;
|
||||||
|
-am__v_CPPAS_1 =
|
||||||
|
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
|
||||||
|
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
|
||||||
|
LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
|
||||||
|
@@ -823,7 +813,7 @@ all: $(BUILT_SOURCES) config.h
|
||||||
|
$(MAKE) $(AM_MAKEFLAGS) all-am
|
||||||
|
|
||||||
|
.SUFFIXES:
|
||||||
|
-.SUFFIXES: .chk .out .S .c .lo .log .o .obj .test .test$(EXEEXT) .trs
|
||||||
|
+.SUFFIXES: .chk .out .c .lo .log .o .obj .test .test$(EXEEXT) .trs
|
||||||
|
am--refresh: Makefile
|
||||||
|
@:
|
||||||
|
$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps)
|
||||||
|
@@ -976,7 +966,6 @@ arm/$(DEPDIR)/$(am__dirstamp):
|
||||||
|
@$(MKDIR_P) arm/$(DEPDIR)
|
||||||
|
@: > arm/$(DEPDIR)/$(am__dirstamp)
|
||||||
|
arm/arm_init.lo: arm/$(am__dirstamp) arm/$(DEPDIR)/$(am__dirstamp)
|
||||||
|
-arm/filter_neon.lo: arm/$(am__dirstamp) arm/$(DEPDIR)/$(am__dirstamp)
|
||||||
|
arm/filter_neon_intrinsics.lo: arm/$(am__dirstamp) \
|
||||||
|
arm/$(DEPDIR)/$(am__dirstamp)
|
||||||
|
arm/palette_neon_intrinsics.lo: arm/$(am__dirstamp) \
|
||||||
|
@@ -1147,7 +1136,6 @@ distclean-compile:
|
||||||
|
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pngwtran.Plo@am__quote@ # am--include-marker
|
||||||
|
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pngwutil.Plo@am__quote@ # am--include-marker
|
||||||
|
@AMDEP_TRUE@@am__include@ @am__quote@arm/$(DEPDIR)/arm_init.Plo@am__quote@ # am--include-marker
|
||||||
|
-@AMDEP_TRUE@@am__include@ @am__quote@arm/$(DEPDIR)/filter_neon.Plo@am__quote@ # am--include-marker
|
||||||
|
@AMDEP_TRUE@@am__include@ @am__quote@arm/$(DEPDIR)/filter_neon_intrinsics.Plo@am__quote@ # am--include-marker
|
||||||
|
@AMDEP_TRUE@@am__include@ @am__quote@arm/$(DEPDIR)/palette_neon_intrinsics.Plo@am__quote@ # am--include-marker
|
||||||
|
@AMDEP_TRUE@@am__include@ @am__quote@contrib/libtests/$(DEPDIR)/pngimage.Po@am__quote@ # am--include-marker
|
||||||
|
@@ -1171,30 +1159,6 @@ $(am__depfiles_remade):
|
||||||
|
|
||||||
|
am--depfiles: $(am__depfiles_remade)
|
||||||
|
|
||||||
|
-.S.o:
|
||||||
|
-@am__fastdepCCAS_TRUE@ $(AM_V_CPPAS)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\
|
||||||
|
-@am__fastdepCCAS_TRUE@ $(CPPASCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\
|
||||||
|
-@am__fastdepCCAS_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po
|
||||||
|
-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
|
||||||
|
-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ DEPDIR=$(DEPDIR) $(CCASDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||||
|
-@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS@am__nodep@)$(CPPASCOMPILE) -c -o $@ $<
|
||||||
|
-
|
||||||
|
-.S.obj:
|
||||||
|
-@am__fastdepCCAS_TRUE@ $(AM_V_CPPAS)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.obj$$||'`;\
|
||||||
|
-@am__fastdepCCAS_TRUE@ $(CPPASCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ `$(CYGPATH_W) '$<'` &&\
|
||||||
|
-@am__fastdepCCAS_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po
|
||||||
|
-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
|
||||||
|
-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ DEPDIR=$(DEPDIR) $(CCASDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||||
|
-@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS@am__nodep@)$(CPPASCOMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
|
||||||
|
-
|
||||||
|
-.S.lo:
|
||||||
|
-@am__fastdepCCAS_TRUE@ $(AM_V_CPPAS)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.lo$$||'`;\
|
||||||
|
-@am__fastdepCCAS_TRUE@ $(LTCPPASCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\
|
||||||
|
-@am__fastdepCCAS_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Plo
|
||||||
|
-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
|
||||||
|
-@AMDEP_TRUE@@am__fastdepCCAS_FALSE@ DEPDIR=$(DEPDIR) $(CCASDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||||
|
-@am__fastdepCCAS_FALSE@ $(AM_V_CPPAS@am__nodep@)$(LTCPPASCOMPILE) -c -o $@ $<
|
||||||
|
-
|
||||||
|
.c.o:
|
||||||
|
@am__fastdepCC_TRUE@ $(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\
|
||||||
|
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\
|
||||||
|
@@ -2085,7 +2049,6 @@ distclean: distclean-am
|
||||||
|
-rm -f ./$(DEPDIR)/pngwtran.Plo
|
||||||
|
-rm -f ./$(DEPDIR)/pngwutil.Plo
|
||||||
|
-rm -f arm/$(DEPDIR)/arm_init.Plo
|
||||||
|
- -rm -f arm/$(DEPDIR)/filter_neon.Plo
|
||||||
|
-rm -f arm/$(DEPDIR)/filter_neon_intrinsics.Plo
|
||||||
|
-rm -f arm/$(DEPDIR)/palette_neon_intrinsics.Plo
|
||||||
|
-rm -f contrib/libtests/$(DEPDIR)/pngimage.Po
|
||||||
|
@@ -2170,7 +2133,6 @@ maintainer-clean: maintainer-clean-am
|
||||||
|
-rm -f ./$(DEPDIR)/pngwtran.Plo
|
||||||
|
-rm -f ./$(DEPDIR)/pngwutil.Plo
|
||||||
|
-rm -f arm/$(DEPDIR)/arm_init.Plo
|
||||||
|
- -rm -f arm/$(DEPDIR)/filter_neon.Plo
|
||||||
|
-rm -f arm/$(DEPDIR)/filter_neon_intrinsics.Plo
|
||||||
|
-rm -f arm/$(DEPDIR)/palette_neon_intrinsics.Plo
|
||||||
|
-rm -f contrib/libtests/$(DEPDIR)/pngimage.Po
|
||||||
|
diff -up libpng-1.6.40/pngpriv.h.arm libpng-1.6.40/pngpriv.h
|
||||||
|
--- libpng-1.6.40/pngpriv.h.arm 2023-06-21 21:06:40.000000000 +0200
|
||||||
|
+++ libpng-1.6.40/pngpriv.h 2024-08-08 08:31:00.904590829 +0200
|
||||||
|
@@ -140,47 +140,6 @@
|
||||||
|
* callbacks to do this.
|
||||||
|
*/
|
||||||
|
# define PNG_FILTER_OPTIMIZATIONS png_init_filter_functions_neon
|
||||||
|
-
|
||||||
|
- /* By default the 'intrinsics' code in arm/filter_neon_intrinsics.c is used
|
||||||
|
- * if possible - if __ARM_NEON__ is set and the compiler version is not known
|
||||||
|
- * to be broken. This is controlled by PNG_ARM_NEON_IMPLEMENTATION which can
|
||||||
|
- * be:
|
||||||
|
- *
|
||||||
|
- * 1 The intrinsics code (the default with __ARM_NEON__)
|
||||||
|
- * 2 The hand coded assembler (the default without __ARM_NEON__)
|
||||||
|
- *
|
||||||
|
- * It is possible to set PNG_ARM_NEON_IMPLEMENTATION in CPPFLAGS, however
|
||||||
|
- * this is *NOT* supported and may cease to work even after a minor revision
|
||||||
|
- * to libpng. It *is* valid to do this for testing purposes, e.g. speed
|
||||||
|
- * testing or a new compiler, but the results should be communicated to the
|
||||||
|
- * libpng implementation list for incorporation in the next minor release.
|
||||||
|
- */
|
||||||
|
-# ifndef PNG_ARM_NEON_IMPLEMENTATION
|
||||||
|
-# if defined(__ARM_NEON__) || defined(__ARM_NEON)
|
||||||
|
-# if defined(__clang__)
|
||||||
|
- /* At present it is unknown by the libpng developers which versions
|
||||||
|
- * of clang support the intrinsics, however some or perhaps all
|
||||||
|
- * versions do not work with the assembler so this may be
|
||||||
|
- * irrelevant, so just use the default (do nothing here.)
|
||||||
|
- */
|
||||||
|
-# elif defined(__GNUC__)
|
||||||
|
- /* GCC 4.5.4 NEON support is known to be broken. 4.6.3 is known to
|
||||||
|
- * work, so if this *is* GCC, or G++, look for a version >4.5
|
||||||
|
- */
|
||||||
|
-# if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 6)
|
||||||
|
-# define PNG_ARM_NEON_IMPLEMENTATION 2
|
||||||
|
-# endif /* no GNUC support */
|
||||||
|
-# endif /* __GNUC__ */
|
||||||
|
-# else /* !defined __ARM_NEON__ */
|
||||||
|
- /* The 'intrinsics' code simply won't compile without this -mfpu=neon:
|
||||||
|
- */
|
||||||
|
-# if !defined(__aarch64__) && !defined(_M_ARM64)
|
||||||
|
- /* The assembler code currently does not work on ARM64 */
|
||||||
|
-# define PNG_ARM_NEON_IMPLEMENTATION 2
|
||||||
|
-# endif /* __aarch64__ */
|
||||||
|
-# endif /* __ARM_NEON__ */
|
||||||
|
-# endif /* !PNG_ARM_NEON_IMPLEMENTATION */
|
||||||
|
-
|
||||||
|
# ifndef PNG_ARM_NEON_IMPLEMENTATION
|
||||||
|
/* Use the intrinsics code by default. */
|
||||||
|
# define PNG_ARM_NEON_IMPLEMENTATION 1
|
||||||
@ -1,24 +1,40 @@
|
|||||||
|
%bcond_without check
|
||||||
|
|
||||||
Summary: A library of functions for manipulating PNG image format files
|
Summary: A library of functions for manipulating PNG image format files
|
||||||
Name: libpng
|
Name: libpng
|
||||||
Epoch: 2
|
Epoch: 2
|
||||||
Version: 1.6.34
|
Version: 1.6.40
|
||||||
Release: 5%{?dist}
|
Release: 8%{?dist}.1
|
||||||
License: zlib
|
License: zlib
|
||||||
Group: System Environment/Libraries
|
|
||||||
URL: http://www.libpng.org/pub/png/
|
URL: http://www.libpng.org/pub/png/
|
||||||
|
|
||||||
# Note: non-current tarballs get moved to the history/ subdirectory,
|
Source0: https://github.com/glennrp/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
|
||||||
# so look there if you fail to retrieve the version you want
|
|
||||||
Source0: https://ftp-osl.osuosl.org/pub/libpng/src/libpng16/libpng-%{version}.tar.xz
|
|
||||||
Source1: pngusr.dfa
|
Source1: pngusr.dfa
|
||||||
Patch0: libpng-multilib.patch
|
Patch0: libpng-multilib.patch
|
||||||
Patch1: libpng-fix-arm-neon.patch
|
# from upstream, for <1.6.44, fixes annoncheck on aarch64 as noeon asm prevents some hardening protection, based on
|
||||||
Patch2: libpng-CVE-2018-13785.patch
|
# https://github.com/pnggroup/libpng/commit/9e538750d99c8f1accf7e93878e4fde47c069908
|
||||||
Patch3: libpng-coverity.patch
|
# https://github.com/pnggroup/libpng/commit/e4a31f024b6158aaaf55a43502f574d5f5d1c894
|
||||||
|
Patch1: libpng-1.6.40-nomore_neon_asm.patch
|
||||||
|
# fix static analysis findings, RHEL-44993
|
||||||
|
Patch2: libpng-1.6.40-fix_sast.patch
|
||||||
|
# from upstream, for <1.6.51, RHEL-131422
|
||||||
|
# https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643
|
||||||
|
Patch3: libpng-1.6-CVE-2025-64720.patch
|
||||||
|
# from upstream, for <1.6.51, RHEL-131435
|
||||||
|
# https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d
|
||||||
|
Patch4: libpng-1.6-CVE-2025-65018_p1of2.patch
|
||||||
|
# https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea
|
||||||
|
Patch5: libpng-1.6-CVE-2025-65018_p2of2.patch
|
||||||
|
# from upstream, for <1.6.52, RHEL-133212
|
||||||
|
# https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1
|
||||||
|
Patch6: libpng-1.6-CVE-2025-66293_p1of2.patch
|
||||||
|
# https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a
|
||||||
|
Patch7: libpng-1.6-CVE-2025-66293_p2of2.patch
|
||||||
|
|
||||||
|
BuildRequires: gcc
|
||||||
BuildRequires: zlib-devel
|
BuildRequires: zlib-devel
|
||||||
BuildRequires: autoconf automake libtool
|
BuildRequires: autoconf automake libtool
|
||||||
|
BuildRequires: make
|
||||||
|
|
||||||
%description
|
%description
|
||||||
The libpng package contains a library of functions for creating and
|
The libpng package contains a library of functions for creating and
|
||||||
@ -32,9 +48,8 @@ files.
|
|||||||
|
|
||||||
%package devel
|
%package devel
|
||||||
Summary: Development tools for programs to manipulate PNG image format files
|
Summary: Development tools for programs to manipulate PNG image format files
|
||||||
Group: Development/Libraries
|
|
||||||
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
|
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
|
||||||
Requires: zlib-devel%{?_isa} pkgconfig%{?_isa}
|
Requires: zlib-devel%{?_isa} pkgconfig
|
||||||
|
|
||||||
%description devel
|
%description devel
|
||||||
The libpng-devel package contains header files and documentation necessary
|
The libpng-devel package contains header files and documentation necessary
|
||||||
@ -46,7 +61,6 @@ the libpng package.
|
|||||||
|
|
||||||
%package static
|
%package static
|
||||||
Summary: Static PNG image format file library
|
Summary: Static PNG image format file library
|
||||||
Group: Development/Libraries
|
|
||||||
Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}
|
Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}
|
||||||
|
|
||||||
%description static
|
%description static
|
||||||
@ -56,7 +70,6 @@ necessary for some boot packages.
|
|||||||
|
|
||||||
%package tools
|
%package tools
|
||||||
Summary: Tools for PNG image format file library
|
Summary: Tools for PNG image format file library
|
||||||
Group: Development/Libraries
|
|
||||||
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
|
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
|
||||||
|
|
||||||
%description tools
|
%description tools
|
||||||
@ -67,25 +80,28 @@ The libpng-tools package contains tools used by the authors of libpng.
|
|||||||
# Provide pngusr.dfa for build.
|
# Provide pngusr.dfa for build.
|
||||||
cp -p %{SOURCE1} .
|
cp -p %{SOURCE1} .
|
||||||
|
|
||||||
%patch0 -p1
|
%patch -P 0 -p1
|
||||||
%patch1 -p1 -b .arm
|
%patch -P 1 -p1 -b .nomore_neon_asm
|
||||||
%patch2 -p1 -b .CVE-2018-13785
|
%patch -P 2 -p1 -b .fix_sast
|
||||||
%patch3 -p1 -b .coverity
|
%patch -P 3 -p1 -b .CVE-2025-64720
|
||||||
|
%patch -P 4 -p1 -b .CVE-2025-65018_p1of2
|
||||||
|
%patch -P 5 -p1 -b .CVE-2025-65018_p2of2
|
||||||
|
%patch -P 6 -p1 -b .CVE-2025-66293_p1of2
|
||||||
|
%patch -P 7 -p1 -b .CVE-2025-66293_p2of2
|
||||||
|
|
||||||
%build
|
%build
|
||||||
autoreconf -vif
|
autoreconf -vif
|
||||||
%configure
|
%configure
|
||||||
make %{?_smp_mflags} DFA_XTRA=pngusr.dfa
|
%make_build DFA_XTRA=pngusr.dfa
|
||||||
|
|
||||||
%install
|
%install
|
||||||
make DESTDIR=$RPM_BUILD_ROOT install
|
%make_install
|
||||||
|
|
||||||
# We don't ship .la files.
|
# We don't ship .la files.
|
||||||
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
|
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
|
||||||
|
|
||||||
|
%if 0%{?with_check}
|
||||||
%check
|
%check
|
||||||
#to run make check use "--with check"
|
|
||||||
%if %{?_with_check:1}%{!?_with_check:0}
|
|
||||||
make check
|
make check
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
@ -112,11 +128,103 @@ make check
|
|||||||
%{_bindir}/pngfix
|
%{_bindir}/pngfix
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Mon Oct 15 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.34-5
|
* Mon Dec 15 2025 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-8.1
|
||||||
- Fix important Covscan defects (#1602588)
|
- CVE-2025-64720: buffer overflow (RHEL-131422)
|
||||||
|
- CVE-2025-65018: heap buffer overflow (RHEL-131435)
|
||||||
|
- CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133212)
|
||||||
|
|
||||||
* Wed Aug 01 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.34-4
|
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2:1.6.40-8
|
||||||
- Fix CVE-2018-13785 (#1599952)
|
- Bump release for October 2024 mass rebuild:
|
||||||
|
Resolves: RHEL-64018
|
||||||
|
|
||||||
|
* Mon Aug 12 2024 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-7
|
||||||
|
- rebuild for rerunning tests
|
||||||
|
|
||||||
|
* Thu Aug 08 2024 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-6
|
||||||
|
- fix hardening on aarch64
|
||||||
|
|
||||||
|
* Tue Aug 06 2024 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-5
|
||||||
|
- fix static analysis findings (RHEL-44993)
|
||||||
|
|
||||||
|
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 2:1.6.40-4
|
||||||
|
- Bump release for June 2024 mass rebuild
|
||||||
|
|
||||||
|
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.40-3
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||||
|
|
||||||
|
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.40-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||||
|
|
||||||
|
* Wed Sep 20 2023 Tulio Magno Quites Machado Filho <tuliom@redhat.com> - 2:1.6.40-1
|
||||||
|
- Update to libpng 1.6.40
|
||||||
|
|
||||||
|
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-15
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-14
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-13
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-12
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-11
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||||
|
|
||||||
|
* Wed Mar 24 2021 Nikola Forró <nforro@redhat.com> - 2:1.6.37-10
|
||||||
|
- Remove the aarch64 test workaround, the patches causing the failures
|
||||||
|
have been dropped in zlib-1.2.11-25
|
||||||
|
|
||||||
|
* Thu Feb 11 2021 Nikola Forró <nforro@redhat.com> - 2:1.6.37-9
|
||||||
|
- Run %check by default
|
||||||
|
|
||||||
|
* Fri Feb 05 2021 Nikola Forró <nforro@redhat.com> - 2:1.6.37-8
|
||||||
|
- Use proper pngtest.png reference image on aarch64
|
||||||
|
|
||||||
|
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-7
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Nov 02 2020 Nikola Forró <nforro@redhat.com> - 2:1.6.37-6
|
||||||
|
- Remove libpng-devel dependency on arch-specific pkgconfig (#1893523)
|
||||||
|
|
||||||
|
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-5
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 2:1.6.37-4
|
||||||
|
- Use make macros
|
||||||
|
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
|
||||||
|
|
||||||
|
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-3
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||||
|
|
||||||
|
* Wed May 22 2019 Nikola Forró <nforro@redhat.com> - 2:1.6.37-1
|
||||||
|
- New upstream release 1.6.37
|
||||||
|
|
||||||
|
* Wed Feb 27 2019 Debarshi Ray <rishi@fedoraproject.org> - 2:1.6.36-1
|
||||||
|
- New upstream release 1.6.36
|
||||||
|
|
||||||
|
* Fri Feb 08 2019 Nikola Forró <nforro@redhat.com> - 2:1.6.35-3
|
||||||
|
- Fix CVE-2019-7317 (#1672411)
|
||||||
|
|
||||||
|
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.35-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||||
|
|
||||||
|
* Wed Oct 10 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.35-1
|
||||||
|
- New upstream release 1.6.35 (#1552349)
|
||||||
|
|
||||||
|
* Wed Aug 01 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.34-6
|
||||||
|
- Fix CVE-2018-13785 (#1599944)
|
||||||
|
|
||||||
|
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.34-5
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||||
|
|
||||||
|
* Tue Feb 20 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.34-4
|
||||||
|
- Add missing gcc build dependency
|
||||||
|
|
||||||
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.34-3
|
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.34-3
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||||
Loading…
Reference in New Issue
Block a user