From e45308754d76449f1d60b8feb598688ad05cedfc Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 16 Jun 2026 12:26:16 -0400 Subject: [PATCH] import CS git libpng12-1.2.57-7.el8_10 --- SOURCES/libpng-1.2-CVE-2026-33416_p1of5.patch | 84 ++++++++++++++ SOURCES/libpng-1.2-CVE-2026-33416_p2of5.patch | 25 +++++ SOURCES/libpng-1.2-CVE-2026-33416_p3of5.patch | 103 ++++++++++++++++++ SOURCES/libpng-1.2-CVE-2026-33416_p4of5.patch | 24 ++++ SOURCES/libpng-1.2-CVE-2026-33416_p5of5.patch | 30 +++++ SPECS/libpng12.spec | 24 +++- 6 files changed, 289 insertions(+), 1 deletion(-) create mode 100644 SOURCES/libpng-1.2-CVE-2026-33416_p1of5.patch create mode 100644 SOURCES/libpng-1.2-CVE-2026-33416_p2of5.patch create mode 100644 SOURCES/libpng-1.2-CVE-2026-33416_p3of5.patch create mode 100644 SOURCES/libpng-1.2-CVE-2026-33416_p4of5.patch create mode 100644 SOURCES/libpng-1.2-CVE-2026-33416_p5of5.patch diff --git a/SOURCES/libpng-1.2-CVE-2026-33416_p1of5.patch b/SOURCES/libpng-1.2-CVE-2026-33416_p1of5.patch new file mode 100644 index 0000000..00b35df --- /dev/null +++ b/SOURCES/libpng-1.2-CVE-2026-33416_p1of5.patch @@ -0,0 +1,84 @@ +--- libpng-1.2.57/pngread.c 2016-12-29 03:06:29.000000000 +0100 ++++ libpng-1.2.57/pngread.c 2026-05-26 14:53:14.403162437 +0200 +@@ -1244,15 +1244,11 @@ png_read_destroy(png_structp png_ptr, pn + #endif + #if defined(PNG_tRNS_SUPPORTED) || \ + defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED) +-#ifdef PNG_FREE_ME_SUPPORTED +- if (png_ptr->free_me & PNG_FREE_TRNS) +- png_free(png_ptr, png_ptr->trans); +- png_ptr->free_me &= ~PNG_FREE_TRNS; +-#else +- if (png_ptr->flags & PNG_FLAG_FREE_TRNS) +- png_free(png_ptr, png_ptr->trans); +- png_ptr->flags &= ~PNG_FLAG_FREE_TRNS; +-#endif ++ /* png_ptr->trans is always independently allocated (not aliased ++ * with info_ptr->trans), so free it unconditionally. ++ */ ++ png_free(png_ptr, png_ptr->trans); ++ png_ptr->trans = NULL; + #endif + #ifdef PNG_READ_hIST_SUPPORTED + #ifdef PNG_FREE_ME_SUPPORTED +--- libpng-1.2.57/pngset.c 2016-12-29 03:06:29.000000000 +0100 ++++ libpng-1.2.57/pngset.c 2026-05-26 14:57:34.671384162 +0200 +@@ -874,20 +874,35 @@ png_set_tRNS(png_structp png_ptr, png_in + + if (trans != NULL) + { +- /* It may not actually be necessary to set png_ptr->trans here; +- * we do it for backward compatibility with the way the png_handle_tRNS +- * function used to do the allocation. +- */ +- + #ifdef PNG_FREE_ME_SUPPORTED + png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0); + #endif + +- /* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */ +- png_ptr->trans = info_ptr->trans = (png_bytep)png_malloc(png_ptr, +- (png_uint_32)PNG_MAX_PALETTE_LENGTH); + if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH) ++ { ++ /* Allocate info_ptr's copy of the transparency data. */ ++ info_ptr->trans = (png_bytep)png_malloc(png_ptr, ++ (png_uint_32)PNG_MAX_PALETTE_LENGTH); + png_memcpy(info_ptr->trans, trans, (png_size_t)num_trans); ++ ++ /* Allocate an independent copy for png_struct, so that the ++ * lifetime of png_ptr->trans is decoupled from the ++ * lifetime of info_ptr->trans. Previously these two ++ * pointers were aliased, which caused a use-after-free if ++ * png_free_data freed info_ptr->trans while ++ * png_ptr->trans was still in use by the row transform ++ * functions (e.g. png_do_expand_palette). ++ */ ++ png_free(png_ptr, png_ptr->trans); ++ png_ptr->trans = (png_bytep)png_malloc(png_ptr, ++ (png_uint_32)PNG_MAX_PALETTE_LENGTH); ++ png_memcpy(png_ptr->trans, trans, (png_size_t)num_trans); ++ } ++ else ++ { ++ png_free(png_ptr, png_ptr->trans); ++ png_ptr->trans = NULL; ++ } + } + + if (trans_values != NULL) +--- libpng-1.2.57/pngwrite.c 2016-12-29 03:06:30.000000000 +0100 ++++ libpng-1.2.57/pngwrite.c 2026-05-26 14:58:03.446084194 +0200 +@@ -1141,6 +1141,12 @@ png_write_destroy(png_structp png_ptr) + png_free(png_ptr, png_ptr->time_buffer); + #endif + ++#if defined(PNG_tRNS_SUPPORTED) ++ /* Free the independent copy of trans owned by png_struct. */ ++ png_free(png_ptr, png_ptr->trans); ++ png_ptr->trans = NULL; ++#endif ++ + #ifdef PNG_SETJMP_SUPPORTED + /* Reset structure */ + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof(jmp_buf)); diff --git a/SOURCES/libpng-1.2-CVE-2026-33416_p2of5.patch b/SOURCES/libpng-1.2-CVE-2026-33416_p2of5.patch new file mode 100644 index 0000000..6b8edec --- /dev/null +++ b/SOURCES/libpng-1.2-CVE-2026-33416_p2of5.patch @@ -0,0 +1,25 @@ +--- libpng-1.2.57/pngset.c 2026-05-26 14:57:34.671384162 +0200 ++++ libpng-1.2.57/pngset.c 2026-05-26 17:28:55.447465487 +0200 +@@ -880,9 +880,13 @@ png_set_tRNS(png_structp png_ptr, png_in + + if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH) + { +- /* Allocate info_ptr's copy of the transparency data. */ ++ /* Allocate info_ptr's copy of the transparency data. ++ * Initialize all entries to fully opaque (0xff), then overwrite ++ * the first num_trans entries with the actual values. ++ */ + info_ptr->trans = (png_bytep)png_malloc(png_ptr, + (png_uint_32)PNG_MAX_PALETTE_LENGTH); ++ png_memset(info_ptr->trans, 0xff, PNG_MAX_PALETTE_LENGTH); + png_memcpy(info_ptr->trans, trans, (png_size_t)num_trans); + + /* Allocate an independent copy for png_struct, so that the +@@ -896,6 +900,7 @@ png_set_tRNS(png_structp png_ptr, png_in + png_free(png_ptr, png_ptr->trans); + png_ptr->trans = (png_bytep)png_malloc(png_ptr, + (png_uint_32)PNG_MAX_PALETTE_LENGTH); ++ png_memset(png_ptr->trans, 0xff, PNG_MAX_PALETTE_LENGTH); + png_memcpy(png_ptr->trans, trans, (png_size_t)num_trans); + } + else diff --git a/SOURCES/libpng-1.2-CVE-2026-33416_p3of5.patch b/SOURCES/libpng-1.2-CVE-2026-33416_p3of5.patch new file mode 100644 index 0000000..512c6e9 --- /dev/null +++ b/SOURCES/libpng-1.2-CVE-2026-33416_p3of5.patch @@ -0,0 +1,103 @@ +--- libpng-1.2.57/pngread.c 2026-05-26 14:53:14.403162437 +0200 ++++ libpng-1.2.57/pngread.c 2026-05-26 17:29:38.291134713 +0200 +@@ -1233,15 +1233,11 @@ png_read_destroy(png_structp png_ptr, pn + png_free(png_ptr, png_ptr->gamma_from_1); + png_free(png_ptr, png_ptr->gamma_to_1); + #endif +-#ifdef PNG_FREE_ME_SUPPORTED +- if (png_ptr->free_me & PNG_FREE_PLTE) +- png_zfree(png_ptr, png_ptr->palette); +- png_ptr->free_me &= ~PNG_FREE_PLTE; +-#else +- if (png_ptr->flags & PNG_FLAG_FREE_PLTE) +- png_zfree(png_ptr, png_ptr->palette); +- png_ptr->flags &= ~PNG_FLAG_FREE_PLTE; +-#endif ++ /* png_ptr->palette is always independently allocated (not aliased ++ * with info_ptr->palette), so free it unconditionally. ++ */ ++ png_free(png_ptr, png_ptr->palette); ++ png_ptr->palette = NULL; + #if defined(PNG_tRNS_SUPPORTED) || \ + defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED) + /* png_ptr->trans is always independently allocated (not aliased +--- libpng-1.2.57/pngrtran.c 2026-05-26 13:15:00.161080295 +0200 ++++ libpng-1.2.57/pngrtran.c 2026-05-26 17:30:05.652923446 +0200 +@@ -471,7 +471,13 @@ png_set_dither(png_structp png_ptr, png_ + } + if (png_ptr->palette == NULL) + { +- png_ptr->palette = palette; ++ /* Allocate an owned copy rather than aliasing the caller's pointer, ++ * so that png_read_destroy can free png_ptr->palette unconditionally. ++ */ ++ png_ptr->palette = (png_colorp)png_calloc(png_ptr, ++ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color)); ++ png_memcpy(png_ptr->palette, palette, (unsigned int)num_palette * ++ png_sizeof(png_color)); + } + png_ptr->num_palette = (png_uint_16)num_palette; + +--- libpng-1.2.57/pngset.c 2026-05-26 17:28:55.447465487 +0200 ++++ libpng-1.2.57/pngset.c 2026-05-26 18:37:06.653725873 +0200 +@@ -470,10 +470,6 @@ png_set_PLTE(png_structp png_ptr, png_in + } + } + +- /* It may not actually be necessary to set png_ptr->palette here; +- * we do it for backward compatibility with the way the png_handle_tRNS +- * function used to do the allocation. +- */ + #ifdef PNG_FREE_ME_SUPPORTED + png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0); + #endif +@@ -481,12 +477,32 @@ png_set_PLTE(png_structp png_ptr, png_in + /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead + * of num_palette entries, in case of an invalid PNG file or incorrect + * call to png_set_PLTE() with too-large sample values. ++ * ++ * Allocate independent buffers for info_ptr and png_ptr so that the ++ * lifetime of png_ptr->palette is decoupled from the lifetime of ++ * info_ptr->palette. Previously, these two pointers were aliased, ++ * which caused a use-after-free vulnerability if png_free_data freed ++ * info_ptr->palette while png_ptr->palette was still in use by the ++ * row transform functions (e.g. png_do_expand_palette). ++ * ++ * Both buffers are allocated with png_calloc to zero-fill, because ++ * the ARM NEON palette riffle reads all 256 entries unconditionally, ++ * regardless of num_palette. + */ ++ png_free(png_ptr, png_ptr->palette); + png_ptr->palette = (png_colorp)png_calloc(png_ptr, +- PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color)); +- png_memcpy(png_ptr->palette, palette, num_palette * png_sizeof(png_color)); +- info_ptr->palette = png_ptr->palette; +- info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette; ++ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color)); ++ info_ptr->palette = (png_colorp)png_calloc(png_ptr, ++ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color)); ++ png_ptr->num_palette = info_ptr->num_palette = (png_uint_16)num_palette; ++ ++ if (num_palette > 0) ++ { ++ png_memcpy(info_ptr->palette, palette, (unsigned int)num_palette * ++ png_sizeof(png_color)); ++ png_memcpy(png_ptr->palette, palette, (unsigned int)num_palette * ++ png_sizeof(png_color)); ++ } + + #ifdef PNG_FREE_ME_SUPPORTED + info_ptr->free_me |= PNG_FREE_PLTE; +--- libpng-1.2.57/pngwrite.c 2026-05-26 14:58:03.446084194 +0200 ++++ libpng-1.2.57/pngwrite.c 2026-05-26 18:37:28.740563051 +0200 +@@ -1147,6 +1147,10 @@ png_write_destroy(png_structp png_ptr) + png_ptr->trans = NULL; + #endif + ++ /* Free the independent copy of the palette owned by png_struct. */ ++ png_free(png_ptr, png_ptr->palette); ++ png_ptr->palette = NULL; ++ + #ifdef PNG_SETJMP_SUPPORTED + /* Reset structure */ + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof(jmp_buf)); diff --git a/SOURCES/libpng-1.2-CVE-2026-33416_p4of5.patch b/SOURCES/libpng-1.2-CVE-2026-33416_p4of5.patch new file mode 100644 index 0000000..223f8c2 --- /dev/null +++ b/SOURCES/libpng-1.2-CVE-2026-33416_p4of5.patch @@ -0,0 +1,24 @@ +--- libpng-1.2.57/pngrtran.c 2026-05-26 17:30:05.652923446 +0200 ++++ libpng-1.2.57/pngrtran.c 2026-05-26 20:15:08.614074080 +0200 +@@ -1214,6 +1214,21 @@ png_read_transform_info(png_structp png_ + { + png_debug(1, "in png_read_transform_info"); + ++ if (png_ptr->transformations != 0) ++ { ++ if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE && ++ info_ptr->palette != NULL && png_ptr->palette != NULL) ++ { ++ /* Sync info_ptr->palette with png_ptr->palette. ++ * The function png_init_read_transformations may have modified ++ * png_ptr->palette in place (e.g. for gamma correction or for ++ * background compositing). ++ */ ++ png_memcpy(info_ptr->palette, png_ptr->palette, ++ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color)); ++ } ++ } ++ + #ifdef PNG_READ_EXPAND_SUPPORTED + if (png_ptr->transformations & PNG_EXPAND) + { diff --git a/SOURCES/libpng-1.2-CVE-2026-33416_p5of5.patch b/SOURCES/libpng-1.2-CVE-2026-33416_p5of5.patch new file mode 100644 index 0000000..7b87f6e --- /dev/null +++ b/SOURCES/libpng-1.2-CVE-2026-33416_p5of5.patch @@ -0,0 +1,30 @@ +--- libpng-1.2.57/pngrtran.c 2026-05-26 20:15:08.614074080 +0200 ++++ libpng-1.2.57/pngrtran.c 2026-05-26 20:19:47.900815419 +0200 +@@ -1214,19 +1214,15 @@ png_read_transform_info(png_structp png_ + { + png_debug(1, "in png_read_transform_info"); + +- if (png_ptr->transformations != 0) ++ if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE && ++ info_ptr->palette != NULL && png_ptr->palette != NULL) + { +- if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE && +- info_ptr->palette != NULL && png_ptr->palette != NULL) +- { +- /* Sync info_ptr->palette with png_ptr->palette. +- * The function png_init_read_transformations may have modified +- * png_ptr->palette in place (e.g. for gamma correction or for +- * background compositing). +- */ +- png_memcpy(info_ptr->palette, png_ptr->palette, +- PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color)); +- } ++ /* Sync info_ptr->palette with png_ptr->palette, which may ++ * have been modified by png_init_read_transformations ++ * (e.g. for gamma correction or background compositing). ++ */ ++ png_memcpy(info_ptr->palette, png_ptr->palette, ++ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color)); + } + + #ifdef PNG_READ_EXPAND_SUPPORTED diff --git a/SPECS/libpng12.spec b/SPECS/libpng12.spec index 68722fb..7dcba70 100644 --- a/SPECS/libpng12.spec +++ b/SPECS/libpng12.spec @@ -1,7 +1,7 @@ Summary: Old version of libpng, needed to run old binaries Name: libpng12 Version: 1.2.57 -Release: 6%{?dist} +Release: 7%{?dist} License: zlib URL: http://www.libpng.org/pub/png/ @@ -17,6 +17,20 @@ Patch1: libpng12-pngconf.patch # from upstream, for <= 1.6.54, RHEL-148339 # https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88 Patch2: libpng-1.6-cve-2026-25646.patch +# from upstream, for <1.6.56 (fix), for <1.6.58 (regression fix), RHEL-161345 +# https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb +Patch12: libpng-1.2-CVE-2026-33416_p1of5.patch +# https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25 +Patch13: libpng-1.2-CVE-2026-33416_p2of5.patch +# https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667 +Patch14: libpng-1.2-CVE-2026-33416_p3of5.patch +# https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1 +Patch15: libpng-1.2-CVE-2026-33416_p4of5.patch +# regression fix for 7ea9eea8 (part 3) +# https://github.com/pnggroup/libpng/commit/d4c4e49eb5c8981075ec2cd946428758c0cda6ac +Patch16: libpng-1.2-CVE-2026-33416_p5of5.patch + + BuildRequires: pkgconfig BuildRequires: zlib-devel @@ -42,6 +56,11 @@ for developing programs using libpng12. %patch -P 0 -p1 %patch -P 1 -p1 %patch -P 2 -p1 -b .cve-2026-25646 +%patch -P 12 -p1 -b .CVE-2026-33416_p1of4 +%patch -P 13 -p1 -b .CVE-2026-33416_p2of4 +%patch -P 14 -p1 -b .CVE-2026-33416_p3of5 +%patch -P 15 -p1 -b .CVE-2026-33416_p4of5 +%patch -P 16 -p1 -b .CVE-2026-33416_p5of5 %build %configure \ @@ -86,6 +105,9 @@ make check %{_libdir}/pkgconfig/libpng12.pc %changelog +* Tue May 26 2026 Michal Hlavinka - 1.2.57-7 +- fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161345) + * Fri Mar 13 2026 Michal Hlavinka - 1.2.57-6 - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148339)