rpms/libpng12
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

merge into: rpms:c8
Branches Tags
rpms:c8
rpms:c8s
rpms:c10s
rpms:c8-beta
rpms:imports/c8/libpng12-1.2.57-7.el8_10
rpms:imports/c8/libpng12-1.2.57-6.el8_10
rpms:imports/c10s/libpng12-1.2.57-5.el10
rpms:imports/c8-beta/libpng12-1.2.57-5.el8
rpms:imports/c8/libpng12-1.2.57-5.el8
...
pull from: rpms:c8-beta
Branches Tags
rpms:c8
rpms:c8s
rpms:c10s
rpms:c8-beta
rpms:imports/c8/libpng12-1.2.57-7.el8_10
rpms:imports/c8/libpng12-1.2.57-6.el8_10
rpms:imports/c10s/libpng12-1.2.57-5.el10
rpms:imports/c8-beta/libpng12-1.2.57-5.el8
rpms:imports/c8/libpng12-1.2.57-5.el8

No commits in common. "c8" and "c8-beta" have entirely different histories.
c8 ... c8-beta

7 changed files with 3 additions and 313 deletions
Show Stats Expand all files Collapse all files

84
SOURCES/libpng-1.2-CVE-2026-33416_p1of5.patch
View File

@ -1,84 +0,0 @@
--- libpng-1.2.57/pngread.c 2016-12-29 03:06:29.000000000 +0100
+++ libpng-1.2.57/pngread.c 2026-05-26 14:53:14.403162437 +0200
@@ -1244,15 +1244,11 @@ png_read_destroy(png_structp png_ptr, pn
#endif
#if defined(PNG_tRNS_SUPPORTED) || \
defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
-#ifdef PNG_FREE_ME_SUPPORTED
- if (png_ptr->free_me & PNG_FREE_TRNS)
- png_free(png_ptr, png_ptr->trans);
- png_ptr->free_me &= ~PNG_FREE_TRNS;
-#else
- if (png_ptr->flags & PNG_FLAG_FREE_TRNS)
- png_free(png_ptr, png_ptr->trans);
- png_ptr->flags &= ~PNG_FLAG_FREE_TRNS;
-#endif
+ /* png_ptr->trans is always independently allocated (not aliased
+ * with info_ptr->trans), so free it unconditionally.
+ */
+ png_free(png_ptr, png_ptr->trans);
+ png_ptr->trans = NULL;
#endif
#ifdef PNG_READ_hIST_SUPPORTED
#ifdef PNG_FREE_ME_SUPPORTED
--- libpng-1.2.57/pngset.c 2016-12-29 03:06:29.000000000 +0100
+++ libpng-1.2.57/pngset.c 2026-05-26 14:57:34.671384162 +0200
@@ -874,20 +874,35 @@ png_set_tRNS(png_structp png_ptr, png_in
if (trans != NULL)
{
- /* It may not actually be necessary to set png_ptr->trans here;
- * we do it for backward compatibility with the way the png_handle_tRNS
- * function used to do the allocation.
- */
-
#ifdef PNG_FREE_ME_SUPPORTED
png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
#endif
- /* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */
- png_ptr->trans = info_ptr->trans = (png_bytep)png_malloc(png_ptr,
- (png_uint_32)PNG_MAX_PALETTE_LENGTH);
if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
+ {
+ /* Allocate info_ptr's copy of the transparency data. */
+ info_ptr->trans = (png_bytep)png_malloc(png_ptr,
+ (png_uint_32)PNG_MAX_PALETTE_LENGTH);
png_memcpy(info_ptr->trans, trans, (png_size_t)num_trans);
+
+ /* Allocate an independent copy for png_struct, so that the
+ * lifetime of png_ptr->trans is decoupled from the
+ * lifetime of info_ptr->trans. Previously these two
+ * pointers were aliased, which caused a use-after-free if
+ * png_free_data freed info_ptr->trans while
+ * png_ptr->trans was still in use by the row transform
+ * functions (e.g. png_do_expand_palette).
+ */
+ png_free(png_ptr, png_ptr->trans);
+ png_ptr->trans = (png_bytep)png_malloc(png_ptr,
+ (png_uint_32)PNG_MAX_PALETTE_LENGTH);
+ png_memcpy(png_ptr->trans, trans, (png_size_t)num_trans);
+ }
+ else
+ {
+ png_free(png_ptr, png_ptr->trans);
+ png_ptr->trans = NULL;
+ }
}
if (trans_values != NULL)
--- libpng-1.2.57/pngwrite.c 2016-12-29 03:06:30.000000000 +0100
+++ libpng-1.2.57/pngwrite.c 2026-05-26 14:58:03.446084194 +0200
@@ -1141,6 +1141,12 @@ png_write_destroy(png_structp png_ptr)
png_free(png_ptr, png_ptr->time_buffer);
#endif
+#if defined(PNG_tRNS_SUPPORTED)
+ /* Free the independent copy of trans owned by png_struct. */
+ png_free(png_ptr, png_ptr->trans);
+ png_ptr->trans = NULL;
+#endif
+
#ifdef PNG_SETJMP_SUPPORTED
/* Reset structure */
png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof(jmp_buf));

25
SOURCES/libpng-1.2-CVE-2026-33416_p2of5.patch
View File

@ -1,25 +0,0 @@
--- libpng-1.2.57/pngset.c 2026-05-26 14:57:34.671384162 +0200
+++ libpng-1.2.57/pngset.c 2026-05-26 17:28:55.447465487 +0200
@@ -880,9 +880,13 @@ png_set_tRNS(png_structp png_ptr, png_in
if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
{
- /* Allocate info_ptr's copy of the transparency data. */
+ /* Allocate info_ptr's copy of the transparency data.
+ * Initialize all entries to fully opaque (0xff), then overwrite
+ * the first num_trans entries with the actual values.
+ */
info_ptr->trans = (png_bytep)png_malloc(png_ptr,
(png_uint_32)PNG_MAX_PALETTE_LENGTH);
+ png_memset(info_ptr->trans, 0xff, PNG_MAX_PALETTE_LENGTH);
png_memcpy(info_ptr->trans, trans, (png_size_t)num_trans);
/* Allocate an independent copy for png_struct, so that the
@@ -896,6 +900,7 @@ png_set_tRNS(png_structp png_ptr, png_in
png_free(png_ptr, png_ptr->trans);
png_ptr->trans = (png_bytep)png_malloc(png_ptr,
(png_uint_32)PNG_MAX_PALETTE_LENGTH);
+ png_memset(png_ptr->trans, 0xff, PNG_MAX_PALETTE_LENGTH);
png_memcpy(png_ptr->trans, trans, (png_size_t)num_trans);
}
else

103
SOURCES/libpng-1.2-CVE-2026-33416_p3of5.patch
View File

@ -1,103 +0,0 @@
--- libpng-1.2.57/pngread.c 2026-05-26 14:53:14.403162437 +0200
+++ libpng-1.2.57/pngread.c 2026-05-26 17:29:38.291134713 +0200
@@ -1233,15 +1233,11 @@ png_read_destroy(png_structp png_ptr, pn
png_free(png_ptr, png_ptr->gamma_from_1);
png_free(png_ptr, png_ptr->gamma_to_1);
#endif
-#ifdef PNG_FREE_ME_SUPPORTED
- if (png_ptr->free_me & PNG_FREE_PLTE)
- png_zfree(png_ptr, png_ptr->palette);
- png_ptr->free_me &= ~PNG_FREE_PLTE;
-#else
- if (png_ptr->flags & PNG_FLAG_FREE_PLTE)
- png_zfree(png_ptr, png_ptr->palette);
- png_ptr->flags &= ~PNG_FLAG_FREE_PLTE;
-#endif
+ /* png_ptr->palette is always independently allocated (not aliased
+ * with info_ptr->palette), so free it unconditionally.
+ */
+ png_free(png_ptr, png_ptr->palette);
+ png_ptr->palette = NULL;
#if defined(PNG_tRNS_SUPPORTED) || \
defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
/* png_ptr->trans is always independently allocated (not aliased
--- libpng-1.2.57/pngrtran.c 2026-05-26 13:15:00.161080295 +0200
+++ libpng-1.2.57/pngrtran.c 2026-05-26 17:30:05.652923446 +0200
@@ -471,7 +471,13 @@ png_set_dither(png_structp png_ptr, png_
}
if (png_ptr->palette == NULL)
{
- png_ptr->palette = palette;
+ /* Allocate an owned copy rather than aliasing the caller's pointer,
+ * so that png_read_destroy can free png_ptr->palette unconditionally.
+ */
+ png_ptr->palette = (png_colorp)png_calloc(png_ptr,
+ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));
+ png_memcpy(png_ptr->palette, palette, (unsigned int)num_palette *
+ png_sizeof(png_color));
}
png_ptr->num_palette = (png_uint_16)num_palette;
--- libpng-1.2.57/pngset.c 2026-05-26 17:28:55.447465487 +0200
+++ libpng-1.2.57/pngset.c 2026-05-26 18:37:06.653725873 +0200
@@ -470,10 +470,6 @@ png_set_PLTE(png_structp png_ptr, png_in
}
}
- /* It may not actually be necessary to set png_ptr->palette here;
- * we do it for backward compatibility with the way the png_handle_tRNS
- * function used to do the allocation.
- */
#ifdef PNG_FREE_ME_SUPPORTED
png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
#endif
@@ -481,12 +477,32 @@ png_set_PLTE(png_structp png_ptr, png_in
/* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
* of num_palette entries, in case of an invalid PNG file or incorrect
* call to png_set_PLTE() with too-large sample values.
+ *
+ * Allocate independent buffers for info_ptr and png_ptr so that the
+ * lifetime of png_ptr->palette is decoupled from the lifetime of
+ * info_ptr->palette. Previously, these two pointers were aliased,
+ * which caused a use-after-free vulnerability if png_free_data freed
+ * info_ptr->palette while png_ptr->palette was still in use by the
+ * row transform functions (e.g. png_do_expand_palette).
+ *
+ * Both buffers are allocated with png_calloc to zero-fill, because
+ * the ARM NEON palette riffle reads all 256 entries unconditionally,
+ * regardless of num_palette.
*/
+ png_free(png_ptr, png_ptr->palette);
png_ptr->palette = (png_colorp)png_calloc(png_ptr,
- PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));
- png_memcpy(png_ptr->palette, palette, num_palette * png_sizeof(png_color));
- info_ptr->palette = png_ptr->palette;
- info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;
+ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));
+ info_ptr->palette = (png_colorp)png_calloc(png_ptr,
+ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));
+ png_ptr->num_palette = info_ptr->num_palette = (png_uint_16)num_palette;
+
+ if (num_palette > 0)
+ {
+ png_memcpy(info_ptr->palette, palette, (unsigned int)num_palette *
+ png_sizeof(png_color));
+ png_memcpy(png_ptr->palette, palette, (unsigned int)num_palette *
+ png_sizeof(png_color));
+ }
#ifdef PNG_FREE_ME_SUPPORTED
info_ptr->free_me |= PNG_FREE_PLTE;
--- libpng-1.2.57/pngwrite.c 2026-05-26 14:58:03.446084194 +0200
+++ libpng-1.2.57/pngwrite.c 2026-05-26 18:37:28.740563051 +0200
@@ -1147,6 +1147,10 @@ png_write_destroy(png_structp png_ptr)
png_ptr->trans = NULL;
#endif
+ /* Free the independent copy of the palette owned by png_struct. */
+ png_free(png_ptr, png_ptr->palette);
+ png_ptr->palette = NULL;
+
#ifdef PNG_SETJMP_SUPPORTED
/* Reset structure */
png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof(jmp_buf));

24
SOURCES/libpng-1.2-CVE-2026-33416_p4of5.patch
View File

@ -1,24 +0,0 @@
--- libpng-1.2.57/pngrtran.c 2026-05-26 17:30:05.652923446 +0200
+++ libpng-1.2.57/pngrtran.c 2026-05-26 20:15:08.614074080 +0200
@@ -1214,6 +1214,21 @@ png_read_transform_info(png_structp png_
{
png_debug(1, "in png_read_transform_info");
+ if (png_ptr->transformations != 0)
+ {
+ if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
+ info_ptr->palette != NULL && png_ptr->palette != NULL)
+ {
+ /* Sync info_ptr->palette with png_ptr->palette.
+ * The function png_init_read_transformations may have modified
+ * png_ptr->palette in place (e.g. for gamma correction or for
+ * background compositing).
+ */
+ png_memcpy(info_ptr->palette, png_ptr->palette,
+ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));
+ }
+ }
+
#ifdef PNG_READ_EXPAND_SUPPORTED
if (png_ptr->transformations & PNG_EXPAND)
{

30
SOURCES/libpng-1.2-CVE-2026-33416_p5of5.patch
View File

@ -1,30 +0,0 @@
--- libpng-1.2.57/pngrtran.c 2026-05-26 20:15:08.614074080 +0200
+++ libpng-1.2.57/pngrtran.c 2026-05-26 20:19:47.900815419 +0200
@@ -1214,19 +1214,15 @@ png_read_transform_info(png_structp png_
{
png_debug(1, "in png_read_transform_info");
- if (png_ptr->transformations != 0)
+ if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
+ info_ptr->palette != NULL && png_ptr->palette != NULL)
{
- if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
- info_ptr->palette != NULL && png_ptr->palette != NULL)
- {
- /* Sync info_ptr->palette with png_ptr->palette.
- * The function png_init_read_transformations may have modified
- * png_ptr->palette in place (e.g. for gamma correction or for
- * background compositing).
- */
- png_memcpy(info_ptr->palette, png_ptr->palette,
- PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));
- }
+ /* Sync info_ptr->palette with png_ptr->palette, which may
+ * have been modified by png_init_read_transformations
+ * (e.g. for gamma correction or background compositing).
+ */
+ png_memcpy(info_ptr->palette, png_ptr->palette,
+ PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));
}
#ifdef PNG_READ_EXPAND_SUPPORTED

15
SOURCES/libpng-1.6-cve-2026-25646.patch
View File

@ -1,15 +0,0 @@
diff --git a/pngrtran.c b/pngrtran.c
index fe8f9d32c9..1fce9af121 100644
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -371,8 +371,8 @@ png_set_dither(png_structrp png_ptr, png_colorp palette,
if (t == NULL)
break;
t->next = hash[d];
- t->left = (png_byte)i;
- t->right = (png_byte)j;
+ t->left = png_ptr->palette_to_index[i];
+ t->right = png_ptr->palette_to_index[j];
hash[d] = t;
}
}

35
SPECS/libpng12.spec
View File

@ -1,7 +1,7 @@
Summary: Old version of libpng, needed to run old binaries
Name: libpng12
Version: 1.2.57
Release: 7%{?dist}
Release: 5%{?dist}
License: zlib
URL: http://www.libpng.org/pub/png/
@ -14,23 +14,6 @@ Source0: https://ftp-osl.osuosl.org/pub/libpng/src/libpng12/libpng-%{version}.ta
Patch0: libpng12-multilib.patch
Patch1: libpng12-pngconf.patch
# from upstream, for <= 1.6.54, RHEL-148339
# https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88
Patch2: libpng-1.6-cve-2026-25646.patch
# from upstream, for <1.6.56 (fix), for <1.6.58 (regression fix), RHEL-161345
# https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb
Patch12: libpng-1.2-CVE-2026-33416_p1of5.patch
# https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25
Patch13: libpng-1.2-CVE-2026-33416_p2of5.patch
# https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667
Patch14: libpng-1.2-CVE-2026-33416_p3of5.patch
# https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1
Patch15: libpng-1.2-CVE-2026-33416_p4of5.patch
# regression fix for 7ea9eea8 (part 3)
# https://github.com/pnggroup/libpng/commit/d4c4e49eb5c8981075ec2cd946428758c0cda6ac
Patch16: libpng-1.2-CVE-2026-33416_p5of5.patch
BuildRequires: pkgconfig
BuildRequires: zlib-devel
@ -53,14 +36,8 @@ for developing programs using libpng12.
%prep
%setup -q -n libpng-%{version}
%patch -P 0 -p1
%patch -P 1 -p1
%patch -P 2 -p1 -b .cve-2026-25646
%patch -P 12 -p1 -b .CVE-2026-33416_p1of4
%patch -P 13 -p1 -b .CVE-2026-33416_p2of4
%patch -P 14 -p1 -b .CVE-2026-33416_p3of5
%patch -P 15 -p1 -b .CVE-2026-33416_p4of5
%patch -P 16 -p1 -b .CVE-2026-33416_p5of5
%patch0 -p1
%patch1 -p1
%build
%configure \
@ -105,12 +82,6 @@ make check
%{_libdir}/pkgconfig/libpng12.pc
%changelog
* Tue May 26 2026 Michal Hlavinka <mhlavink@redhat.com> - 1.2.57-7
- fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161345)
* Fri Mar 13 2026 Michal Hlavinka <mhlavink@redhat.com> - 1.2.57-6
- fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148339)
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.57-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild