From 3ef6c2439c016abfb212d6201df792b08df2cb15 Mon Sep 17 00:00:00 2001 From: Glenn Randers-Pehrson Date: Thu, 16 Feb 2012 21:25:58 -0600 Subject: [PATCH] [libpng14] Imported from libpng-1.4.9beta01.tar --- ANNOUNCE | 7 ++++-- CHANGES | 5 ++++- INSTALL | 2 +- LICENSE | 4 ++-- README | 2 +- libpng-1.4.9beta01.txt | 6 ++--- libpng.3 | 14 ++++++------ libpngpf.3 | 2 +- png.5 | 2 +- png.c | 4 ++-- png.h | 10 ++++----- pngconf.h | 2 +- pngpread.c | 12 +++++----- pngpriv.h | 2 +- pngrutil.c | 9 +++++--- projects/vstudio/readme.txt | 2 +- projects/vstudio/zlib.props | 2 +- scripts/README.txt | 2 +- sunfix-makefile.patch | 16 +++++++++++++ sunfix.patch | 45 +++++++++++++++++++++++++++++++++++++ 20 files changed, 110 insertions(+), 40 deletions(-) create mode 100644 sunfix-makefile.patch create mode 100644 sunfix.patch diff --git a/ANNOUNCE b/ANNOUNCE index 7138a183f..785d3ca13 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,5 +1,5 @@ -Libpng 1.4.9beta01 - September 2, 2011 +Libpng 1.4.9beta01 - February 17, 2012 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -26,11 +26,14 @@ Other information: Changes since the last public release (1.4.8): -version 1.4.9beta01 [September 2, 2011] +version 1.4.9beta01 [February 17, 2012] Added vstudio/* and CMakeLists to EXTRA_DIST in Makefile.in and Makefile.am Updated contrib/pngminus/makefile.std (Samuli Souminen) Added SunOS support to configure.ac and Makefile.am (but configure and Makefile.in were not updated) + Fixed CVE-2011-3026 buffer overrun bug. Deal more correctly with the test + on iCCP chunk length. Also removed spurious casts that may hide problems + on 16-bit systems. Send comments/corrections/commendations to glennrp at users.sourceforge.net or to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index 5c30c351c..6c53af019 100644 --- a/CHANGES +++ b/CHANGES @@ -2825,11 +2825,14 @@ version 1.4.8rc01 [June 30, 2011] version 1.4.8 [July 7, 2011] No changes. -version 1.4.9beta01 [September 2, 2011] +version 1.4.9beta01 [February 17, 2012] Added vstudio/* and CMakeLists to EXTRA_DIST in Makefile.in and Makefile.am Updated contrib/pngminus/makefile.std (Samuli Souminen) Added SunOS support to configure.ac and Makefile.am (but configure and Makefile.in were not updated) + Fixed CVE-2011-3026 buffer overrun bug. Deal more correctly with the test + on iCCP chunk length. Also removed spurious casts that may hide problems + on 16-bit systems. Send comments/corrections/commendations to glennrp at users.sourceforge.net or to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/INSTALL b/INSTALL index 7144f7303..7ab81a9d6 100644 --- a/INSTALL +++ b/INSTALL @@ -1,5 +1,5 @@ -Installing libpng version 1.4.9beta01 - July 8, 2011 +Installing libpng version 1.4.9beta01 - February 17, 2012 On Unix/Linux and similar systems, you can simply type diff --git a/LICENSE b/LICENSE index fdc1aa261..485200adb 100644 --- a/LICENSE +++ b/LICENSE @@ -10,7 +10,7 @@ this sentence. This code is released under the libpng license. -libpng versions 1.2.6, August 15, 2004, through 1.4.9beta01, July 8, 2011, are +libpng versions 1.2.6, August 15, 2004, through 1.4.9beta01, February 17, 2012, are Copyright (c) 2004, 2006-2010 Glenn Randers-Pehrson, and are distributed according to the same disclaimer and license as libpng-1.2.5 with the following individual added to the list of Contributing Authors @@ -108,4 +108,4 @@ certification mark of the Open Source Initiative. Glenn Randers-Pehrson glennrp at users.sourceforge.net -July 8, 2011 +February 17, 2012 diff --git a/README b/README index 35d06f12f..df6b413e5 100644 --- a/README +++ b/README @@ -1,4 +1,4 @@ -README for libpng version 1.4.9beta01 - July 8, 2011 (shared library 14.0) +README for libpng version 1.4.9beta01 - February 17, 2012 (shared library 14.0) See the note about version numbers near the top of png.h See INSTALL for instructions on how to install libpng. diff --git a/libpng-1.4.9beta01.txt b/libpng-1.4.9beta01.txt index 80e22ad16..98fa4282a 100644 --- a/libpng-1.4.9beta01.txt +++ b/libpng-1.4.9beta01.txt @@ -1,6 +1,6 @@ libpng.txt - A description on how to use and modify libpng - libpng version 1.4.9beta01 - July 13, 2011 + libpng version 1.4.9beta01 - February 17, 2012 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2010 Glenn Randers-Pehrson @@ -11,7 +11,7 @@ libpng.txt - A description on how to use and modify libpng Based on: - libpng versions 0.97, January 1998, through 1.4.9beta01 - July 13, 2011 + libpng versions 0.97, January 1998, through 1.4.9beta01 - February 17, 2012 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2010 Glenn Randers-Pehrson @@ -3312,7 +3312,7 @@ Other rules can be inferred by inspecting the libpng source. XIII. Y2K Compliance in libpng -July 13, 2011 +February 17, 2012 Since the PNG Development group is an ad-hoc body, we can't make an official declaration. diff --git a/libpng.3 b/libpng.3 index 86ca62066..f6472063d 100644 --- a/libpng.3 +++ b/libpng.3 @@ -1,4 +1,4 @@ -.TH LIBPNG 3 "July 13, 2011" +.TH LIBPNG 3 "February 17, 2012" .SH NAME libpng \- Portable Network Graphics (PNG) Reference Library 1.4.9beta01 .SH SYNOPSIS @@ -895,7 +895,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng. .SH LIBPNG.TXT libpng.txt - A description on how to use and modify libpng - libpng version 1.4.9beta01 - July 13, 2011 + libpng version 1.4.9beta01 - February 17, 2012 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2010 Glenn Randers-Pehrson @@ -906,7 +906,7 @@ libpng.txt - A description on how to use and modify libpng Based on: - libpng versions 0.97, January 1998, through 1.4.9beta01 - July 13, 2011 + libpng versions 0.97, January 1998, through 1.4.9beta01 - February 17, 2012 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2010 Glenn Randers-Pehrson @@ -4207,7 +4207,7 @@ Other rules can be inferred by inspecting the libpng source. .SH XIII. Y2K Compliance in libpng -July 13, 2011 +February 17, 2012 Since the PNG Development group is an ad-hoc body, we can't make an official declaration. @@ -4469,7 +4469,7 @@ possible without all of you. Thanks to Frank J. T. Wojcik for helping with the documentation. -Libpng version 1.4.9beta01 - July 13, 2011: +Libpng version 1.4.9beta01 - February 17, 2012: Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc. Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net). @@ -4492,7 +4492,7 @@ this sentence. This code is released under the libpng license. -libpng versions 1.2.6, August 15, 2004, through 1.4.9beta01, July 13, 2011, are +libpng versions 1.2.6, August 15, 2004, through 1.4.9beta01, February 17, 2012, are Copyright (c) 2004,2006-2007 Glenn Randers-Pehrson, and are distributed according to the same disclaimer and license as libpng-1.2.5 with the following individual added to the list of Contributing Authors @@ -4591,7 +4591,7 @@ certification mark of the Open Source Initiative. Glenn Randers-Pehrson glennrp at users.sourceforge.net -July 13, 2011 +February 17, 2012 .\" end of man page diff --git a/libpngpf.3 b/libpngpf.3 index c6fa8281d..48549fe4e 100644 --- a/libpngpf.3 +++ b/libpngpf.3 @@ -1,4 +1,4 @@ -.TH LIBPNGPF 3 "July 8, 2011" +.TH LIBPNGPF 3 "February 17, 2012" .SH NAME libpng \- Portable Network Graphics (PNG) Reference Library 1.4.9beta01 (private functions) diff --git a/png.5 b/png.5 index c21a29674..8d8c6a168 100644 --- a/png.5 +++ b/png.5 @@ -1,4 +1,4 @@ -.TH PNG 5 "July 8, 2011" +.TH PNG 5 "February 17, 2012" .SH NAME png \- Portable Network Graphics (PNG) format .SH DESCRIPTION diff --git a/png.c b/png.c index 2defd78dc..1d860cb56 100644 --- a/png.c +++ b/png.c @@ -547,13 +547,13 @@ png_get_copyright(png_const_structp png_ptr) #else #ifdef __STDC__ return ((png_charp) PNG_STRING_NEWLINE \ - "libpng version 1.4.9beta01 - July 8, 2011" PNG_STRING_NEWLINE \ + "libpng version 1.4.9beta01 - February 17, 2012" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2010 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ PNG_STRING_NEWLINE); #else - return ((png_charp) "libpng version 1.4.9beta01 - July 8, 2011\ + return ((png_charp) "libpng version 1.4.9beta01 - February 17, 2012\ Copyright (c) 1998-2010 Glenn Randers-Pehrson\ Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."); diff --git a/png.h b/png.h index bdbe5888a..314f512ce 100644 --- a/png.h +++ b/png.h @@ -1,7 +1,7 @@ /* png.h - header file for PNG reference library * - * libpng version 1.4.9beta01 - July 8, 2011 + * libpng version 1.4.9beta01 - February 17, 2012 * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -11,7 +11,7 @@ * Authors and maintainers: * libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat * libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger - * libpng versions 0.97, January 1998, through 1.4.9beta01 - July 8, 2011: Glenn + * libpng versions 0.97, January 1998, through 1.4.9beta01 - February 17, 2012: Glenn * See also "Contributing Authors", below. * * Note about libpng version numbers: @@ -193,7 +193,7 @@ * * This code is released under the libpng license. * - * libpng versions 1.2.6, August 15, 2004, through 1.4.9beta01, July 8, 2011, are + * libpng versions 1.2.6, August 15, 2004, through 1.4.9beta01, February 17, 2012, are * Copyright (c) 2004, 2006-2010 Glenn Randers-Pehrson, and are * distributed according to the same disclaimer and license as libpng-1.2.5 * with the following individual added to the list of Contributing Authors: @@ -305,7 +305,7 @@ * Y2K compliance in libpng: * ========================= * - * July 8, 2011 + * February 17, 2012 * * Since the PNG Development group is an ad-hoc body, we can't make * an official declaration. @@ -369,7 +369,7 @@ /* Version information for png.h - this should match the version in png.c */ #define PNG_LIBPNG_VER_STRING "1.4.9beta01" #define PNG_HEADER_VERSION_STRING \ - " libpng version 1.4.9beta01 - July 8, 2011\n" + " libpng version 1.4.9beta01 - February 17, 2012\n" #define PNG_LIBPNG_VER_SONUM 14 #define PNG_LIBPNG_VER_DLLNUM 14 diff --git a/pngconf.h b/pngconf.h index 5453cfd1d..9bb15d2df 100644 --- a/pngconf.h +++ b/pngconf.h @@ -1,7 +1,7 @@ /* pngconf.h - machine configurable file for libpng * - * libpng version 1.4.9beta01 - July 8, 2011 + * libpng version 1.4.9beta01 - February 17, 2012 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) diff --git a/pngpread.c b/pngpread.c index a2d8dbf6e..47dc1ec28 100644 --- a/pngpread.c +++ b/pngpread.c @@ -701,7 +701,7 @@ png_push_save_buffer(png_structp png_ptr) new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc_warn(png_ptr, - (png_size_t)new_max); + new_max); if (png_ptr->save_buffer == NULL) { png_free(png_ptr, old_buffer); @@ -1219,7 +1219,7 @@ png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 #endif png_ptr->current_text = (png_charp)png_malloc(png_ptr, - (png_size_t)(length + 1)); + length + 1); png_ptr->current_text[length] = '\0'; png_ptr->current_text_ptr = png_ptr->current_text; png_ptr->current_text_size = (png_size_t)length; @@ -1319,7 +1319,7 @@ png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 #endif png_ptr->current_text = (png_charp)png_malloc(png_ptr, - (png_size_t)(length + 1)); + length + 1); png_ptr->current_text[length] = '\0'; png_ptr->current_text_ptr = png_ptr->current_text; png_ptr->current_text_size = (png_size_t)length; @@ -1518,7 +1518,7 @@ png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 #endif png_ptr->current_text = (png_charp)png_malloc(png_ptr, - (png_size_t)(length + 1)); + length + 1); png_ptr->current_text[length] = '\0'; png_ptr->current_text_ptr = png_ptr->current_text; png_ptr->current_text_size = (png_size_t)length; @@ -1657,7 +1657,7 @@ png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name) - 1] = '\0'; - png_ptr->unknown_chunk.size = (png_size_t)length; + png_ptr->unknown_chunk.size = length; if (length == 0) png_ptr->unknown_chunk.data = NULL; @@ -1665,7 +1665,7 @@ png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 else { png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, - (png_size_t)length); + length); png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length); } diff --git a/pngpriv.h b/pngpriv.h index e798dfe37..1a7ad0b52 100644 --- a/pngpriv.h +++ b/pngpriv.h @@ -1,7 +1,7 @@ /* pngpriv.h - private declarations for use inside libpng * - * libpng version 1.4.9beta01 - July 8, 2011 + * libpng version 1.4.9beta01 - February 17, 2012 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) diff --git a/pngrutil.c b/pngrutil.c index ac3101bfb..d8f11f03d 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -377,15 +377,18 @@ png_decompress_chunk(png_structp png_ptr, int comp_type, /* Now check the limits on this chunk - if the limit fails the * compressed data will be removed, the prefix will remain. */ + if (prefix_size >= (~(png_size_t)0) - 1 || + expanded_size >= (~(png_size_t)0) - 1 - prefix_size #ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED - if (png_ptr->user_chunk_malloc_max && + || (png_ptr->user_chunk_malloc_max && (prefix_size + expanded_size >= png_ptr->user_chunk_malloc_max - 1)) #else # ifdef PNG_USER_CHUNK_MALLOC_MAX - if ((PNG_USER_CHUNK_MALLOC_MAX > 0) && + || ((PNG_USER_CHUNK_MALLOC_MAX > 0) && prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1) # endif #endif + ) png_warning(png_ptr, "Exceeded size limit while expanding chunk"); /* If the size is zero either there was an error and a message @@ -1261,7 +1264,7 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_free(png_ptr, png_ptr->chunkdata); png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1); - slength = (png_size_t)length; + slength = length; png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength); if (png_crc_finish(png_ptr, skip)) diff --git a/projects/vstudio/readme.txt b/projects/vstudio/readme.txt index 66c4e6789..e192c4242 100644 --- a/projects/vstudio/readme.txt +++ b/projects/vstudio/readme.txt @@ -1,7 +1,7 @@ VisualStudio instructions -libpng version 1.4.9beta01 - July 8, 2011 +libpng version 1.4.9beta01 - February 17, 2012 Copyright (c) 1998-2010 Glenn Randers-Pehrson diff --git a/projects/vstudio/zlib.props b/projects/vstudio/zlib.props index 1233ea737..18670e604 100644 --- a/projects/vstudio/zlib.props +++ b/projects/vstudio/zlib.props @@ -2,7 +2,7 @@