From 5f0c9fabbc1b976702d959695b15f679c4f32b76 Mon Sep 17 00:00:00 2001 From: Glenn Randers-Pehrson Date: Wed, 20 Sep 2017 15:49:00 -0500 Subject: [PATCH] [libpng16] Bump version to 1.6.33rc01 --- ANNOUNCE | 24 +++++++++++++++--------- CHANGES | 8 +++++++- CMakeLists.txt | 2 +- LICENSE | 4 ++-- README | 2 +- configure.ac | 4 ++-- contrib/oss-fuzz/libpng_read_fuzzer.cc | 2 +- libpng-manual.txt | 6 +++--- libpng.3 | 16 ++++++++-------- libpngpf.3 | 2 +- png.c | 6 +++--- png.h | 20 ++++++++++---------- pngconf.h | 2 +- pngrutil.c | 3 --- pngtest.c | 2 +- projects/vstudio/README.txt | 2 +- projects/vstudio/zlib.props | 2 +- scripts/README.txt | 12 ++++++------ scripts/def.c | 2 +- scripts/libpng-config-head.in | 2 +- scripts/libpng.pc.in | 2 +- scripts/makefile.ne12bsd | 2 +- scripts/makefile.netbsd | 2 +- scripts/makefile.openbsd | 2 +- scripts/pnglibconf.h.prebuilt | 4 ++-- scripts/symbols.def | 2 +- 26 files changed, 73 insertions(+), 64 deletions(-) diff --git a/ANNOUNCE b/ANNOUNCE index 5f68888e9..799a8f062 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,4 +1,4 @@ -Libpng 1.6.33beta04 - September 14, 2017 +Libpng 1.6.33rc01 - September 20, 2017 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -8,20 +8,20 @@ Files available for download: Source files with LF line endings (for Unix/Linux) and with a "configure" script - 1.6.33beta04.tar.xz (LZMA-compressed, recommended) - 1.6.33beta04.tar.gz + 1.6.33rc01.tar.xz (LZMA-compressed, recommended) + 1.6.33rc01.tar.gz Source files with CRLF line endings (for Windows), without the "configure" script - lp1633b04.7z (LZMA-compressed, recommended) - lp1633b04.zip + lp1633r01.7z (LZMA-compressed, recommended) + lp1633r01.zip Other information: - 1.6.33beta04-README.txt - 1.6.33beta04-LICENSE.txt - libpng-1.6.33beta04-*.asc (armored detached GPG signatures) + 1.6.33rc01-README.txt + 1.6.33rc01-LICENSE.txt + libpng-1.6.33rc01-*.asc (armored detached GPG signatures) Changes since the last public release (1.6.32): Version 1.6.33beta01 [August 28, 2017] @@ -46,7 +46,13 @@ Version 1.6.33beta03 [September 14, 2017] Use pnglibconf.h.prebuilt when building for ANDROID with cmake (Github issue 162, by rcdailey). -Version 1.6.33beta04 [September 14, 2017] +Version 1.6.33rc01 [September 20, 2017] + Initialize memory allocated by png_inflate to zero, using memset, to + stop an oss-fuzz "use of uninitialized value" detection in png_set_text_2() + due to truncated iTXT or zTXT chunk. + Initialize memory allocated by png_read_buffer to zero, using memset, to + stop an oss-fuzz "use of uninitialized value" detection in + png_icc_check_tag_table()() due to truncated iCCP chunk. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index 1ad4ca25d..eaa508a2f 100644 --- a/CHANGES +++ b/CHANGES @@ -6016,7 +6016,13 @@ Version 1.6.33beta03 [September 14, 2017] Use pnglibconf.h.prebuilt when building for ANDROID with cmake (Github issue 162, by rcdailey). -Version 1.6.33beta04 [September 14, 2017] +Version 1.6.33rc01 [September 20, 2017] + Initialize memory allocated by png_inflate to zero, using memset, to + stop an oss-fuzz "use of uninitialized value" detection in png_set_text_2() + due to truncated iTXT or zTXT chunk. + Initialize memory allocated by png_read_buffer to zero, using memset, to + stop an oss-fuzz "use of uninitialized value" detection in + png_icc_check_tag_table()() due to truncated iCCP chunk. Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CMakeLists.txt b/CMakeLists.txt index 8b3f44c85..157273c29 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -844,7 +844,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW) # SET UP LINKS if(PNG_SHARED) set_target_properties(png PROPERTIES -# VERSION 16.${PNGLIB_RELEASE}.1.6.33beta04 +# VERSION 16.${PNGLIB_RELEASE}.1.6.33rc01 VERSION 16.${PNGLIB_RELEASE}.0 SOVERSION 16 CLEAN_DIRECT_OUTPUT 1) diff --git a/LICENSE b/LICENSE index cbdbca3cd..094015339 100644 --- a/LICENSE +++ b/LICENSE @@ -10,7 +10,7 @@ this sentence. This code is released under the libpng license. -libpng versions 1.0.7, July 1, 2000 through 1.6.33beta04, September 14, 2017 are +libpng versions 1.0.7, July 1, 2000 through 1.6.33rc01, September 20, 2017 are Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are derived from libpng-1.0.6, and are distributed according to the same disclaimer and license as libpng-1.0.6 with the following individuals @@ -130,4 +130,4 @@ any encryption software. See the EAR, paragraphs 734.3(b)(3) and Glenn Randers-Pehrson glennrp at users.sourceforge.net -September 14, 2017 +September 20, 2017 diff --git a/README b/README index e0512899a..8a7d46ed8 100644 --- a/README +++ b/README @@ -1,4 +1,4 @@ -README for libpng version 1.6.33beta04 - September 14, 2017 (shared library 16.0) +README for libpng version 1.6.33rc01 - September 20, 2017 (shared library 16.0) See the note about version numbers near the top of png.h See INSTALL for instructions on how to install libpng. diff --git a/configure.ac b/configure.ac index 3b142ddd6..dab6b181f 100644 --- a/configure.ac +++ b/configure.ac @@ -25,7 +25,7 @@ AC_PREREQ([2.68]) dnl Version number stuff here: -AC_INIT([libpng],[1.6.33beta04],[png-mng-implement@lists.sourceforge.net]) +AC_INIT([libpng],[1.6.33rc01],[png-mng-implement@lists.sourceforge.net]) AC_CONFIG_MACRO_DIR([scripts]) # libpng does not follow GNU file name conventions (hence 'foreign') @@ -46,7 +46,7 @@ dnl automake, so the following is not necessary (and is not defined anyway): dnl AM_PREREQ([1.11.2]) dnl stop configure from automagically running automake -PNGLIB_VERSION=1.6.33beta04 +PNGLIB_VERSION=1.6.33rc01 PNGLIB_MAJOR=1 PNGLIB_MINOR=6 PNGLIB_RELEASE=33 diff --git a/contrib/oss-fuzz/libpng_read_fuzzer.cc b/contrib/oss-fuzz/libpng_read_fuzzer.cc index d39135d84..b17681b40 100644 --- a/contrib/oss-fuzz/libpng_read_fuzzer.cc +++ b/contrib/oss-fuzz/libpng_read_fuzzer.cc @@ -5,7 +5,7 @@ // Use of this source code is governed by a BSD-style license that may // be found in the LICENSE file https://cs.chromium.org/chromium/src/LICENSE -// Last changed in libpng 1.6.33beta03 [September 14, 2017] +// Last changed in libpng 1.6.33beta03 [September 20, 2017] // The modifications in 2017 by Glenn Randers-Pehrson include // 1. addition of a PNG_CLEANUP macro, diff --git a/libpng-manual.txt b/libpng-manual.txt index 42e88f944..7bc606ad1 100644 --- a/libpng-manual.txt +++ b/libpng-manual.txt @@ -1,6 +1,6 @@ libpng-manual.txt - A description on how to use and modify libpng - libpng version 1.6.33beta04 - September 14, 2017 + libpng version 1.6.33rc01 - September 20, 2017 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2017 Glenn Randers-Pehrson @@ -11,7 +11,7 @@ libpng-manual.txt - A description on how to use and modify libpng Based on: - libpng versions 0.97, January 1998, through 1.6.33beta04 - September 14, 2017 + libpng versions 0.97, January 1998, through 1.6.33rc01 - September 20, 2017 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2017 Glenn Randers-Pehrson @@ -5405,7 +5405,7 @@ Since the PNG Development group is an ad-hoc body, we can't make an official declaration. This is your unofficial assurance that libpng from version 0.71 and -upward through 1.6.33beta04 are Y2K compliant. It is my belief that earlier +upward through 1.6.33rc01 are Y2K compliant. It is my belief that earlier versions were also Y2K compliant. Libpng only has two year fields. One is a 2-byte unsigned integer diff --git a/libpng.3 b/libpng.3 index 688562566..5a12145be 100644 --- a/libpng.3 +++ b/libpng.3 @@ -1,6 +1,6 @@ -.TH LIBPNG 3 "September 14, 2017" +.TH LIBPNG 3 "September 20, 2017" .SH NAME -libpng \- Portable Network Graphics (PNG) Reference Library 1.6.33beta04 +libpng \- Portable Network Graphics (PNG) Reference Library 1.6.33rc01 .SH SYNOPSIS \fB #include \fP @@ -518,7 +518,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng. .SH LIBPNG.TXT libpng-manual.txt - A description on how to use and modify libpng - libpng version 1.6.33beta04 - September 14, 2017 + libpng version 1.6.33rc01 - September 20, 2017 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2017 Glenn Randers-Pehrson @@ -529,7 +529,7 @@ libpng-manual.txt - A description on how to use and modify libpng Based on: - libpng versions 0.97, January 1998, through 1.6.33beta04 - September 14, 2017 + libpng versions 0.97, January 1998, through 1.6.33rc01 - September 20, 2017 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2017 Glenn Randers-Pehrson @@ -5923,7 +5923,7 @@ Since the PNG Development group is an ad-hoc body, we can't make an official declaration. This is your unofficial assurance that libpng from version 0.71 and -upward through 1.6.33beta04 are Y2K compliant. It is my belief that earlier +upward through 1.6.33rc01 are Y2K compliant. It is my belief that earlier versions were also Y2K compliant. Libpng only has two year fields. One is a 2-byte unsigned integer @@ -6081,7 +6081,7 @@ possible without all of you. Thanks to Frank J. T. Wojcik for helping with the documentation. -Libpng version 1.6.33beta04 - September 14, 2017: +Libpng version 1.6.33rc01 - September 20, 2017: Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc. Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net). @@ -6106,7 +6106,7 @@ this sentence. This code is released under the libpng license. -libpng versions 1.0.7, July 1, 2000 through 1.6.33beta04, September 14, 2017 are +libpng versions 1.0.7, July 1, 2000 through 1.6.33rc01, September 20, 2017 are Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are derived from libpng-1.0.6, and are distributed according to the same disclaimer and license as libpng-1.0.6 with the following individuals @@ -6234,7 +6234,7 @@ files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31). Glenn Randers-Pehrson glennrp at users.sourceforge.net -September 14, 2017 +September 20, 2017 .\" end of man page diff --git a/libpngpf.3 b/libpngpf.3 index 6eae4cff1..2b7c384aa 100644 --- a/libpngpf.3 +++ b/libpngpf.3 @@ -1,6 +1,6 @@ .TH LIBPNGPF 3 "April 1, 2017" .SH NAME -libpng \- Portable Network Graphics (PNG) Reference Library 1.6.33beta04 +libpng \- Portable Network Graphics (PNG) Reference Library 1.6.33rc01 (private functions) .SH SYNOPSIS \fB\fB#include \fI\fI"pngpriv.h" diff --git a/png.c b/png.c index 487fb7e2a..9fcbcc6d5 100644 --- a/png.c +++ b/png.c @@ -14,7 +14,7 @@ #include "pngpriv.h" /* Generate a compiler error if there is an old png.h in the search path. */ -typedef png_libpng_version_1_6_33beta04 Your_png_h_is_not_version_1_6_33beta04; +typedef png_libpng_version_1_6_33rc01 Your_png_h_is_not_version_1_6_33rc01; #ifdef __GNUC__ /* The version tests may need to be added to, but the problem warning has @@ -816,14 +816,14 @@ png_get_copyright(png_const_structrp png_ptr) #else # ifdef __STDC__ return PNG_STRING_NEWLINE \ - "libpng version 1.6.33beta04 - September 19, 2017" PNG_STRING_NEWLINE \ + "libpng version 1.6.33rc01 - September 20, 2017" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson" \ PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ PNG_STRING_NEWLINE; # else - return "libpng version 1.6.33beta04 - September 19, 2017\ + return "libpng version 1.6.33rc01 - September 20, 2017\ Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson\ Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."; diff --git a/png.h b/png.h index ba31c138a..e8a398990 100644 --- a/png.h +++ b/png.h @@ -1,7 +1,7 @@ /* png.h - header file for PNG reference library * - * libpng version 1.6.33beta04, September 14, 2017 + * libpng version 1.6.33rc01, September 20, 2017 * * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -12,7 +12,7 @@ * Authors and maintainers: * libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat * libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger - * libpng versions 0.97, January 1998, through 1.6.33beta04, September 14, 2017: + * libpng versions 0.97, January 1998, through 1.6.33rc01, September 20, 2017: * Glenn Randers-Pehrson. * See also "Contributing Authors", below. */ @@ -25,7 +25,7 @@ * * This code is released under the libpng license. * - * libpng versions 1.0.7, July 1, 2000 through 1.6.33beta04, September 14, 2017 are + * libpng versions 1.0.7, July 1, 2000 through 1.6.33rc01, September 20, 2017 are * Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are * derived from libpng-1.0.6, and are distributed according to the same * disclaimer and license as libpng-1.0.6 with the following individuals @@ -241,13 +241,13 @@ * Y2K compliance in libpng: * ========================= * - * September 14, 2017 + * September 20, 2017 * * Since the PNG Development group is an ad-hoc body, we can't make * an official declaration. * * This is your unofficial assurance that libpng from version 0.71 and - * upward through 1.6.33beta04 are Y2K compliant. It is my belief that + * upward through 1.6.33rc01 are Y2K compliant. It is my belief that * earlier versions were also Y2K compliant. * * Libpng only has two year fields. One is a 2-byte unsigned integer @@ -309,8 +309,8 @@ */ /* Version information for png.h - this should match the version in png.c */ -#define PNG_LIBPNG_VER_STRING "1.6.33beta04" -#define PNG_HEADER_VERSION_STRING " libpng version 1.6.33beta04 - September 14, 2017\n" +#define PNG_LIBPNG_VER_STRING "1.6.33rc01" +#define PNG_HEADER_VERSION_STRING " libpng version 1.6.33rc01 - September 20, 2017\n" #define PNG_LIBPNG_VER_SONUM 16 #define PNG_LIBPNG_VER_DLLNUM 16 @@ -324,7 +324,7 @@ * PNG_LIBPNG_VER_STRING, omitting any leading zero: */ -#define PNG_LIBPNG_VER_BUILD 04 +#define PNG_LIBPNG_VER_BUILD 01 /* Release Status */ #define PNG_LIBPNG_BUILD_ALPHA 1 @@ -341,7 +341,7 @@ #define PNG_LIBPNG_BUILD_SPECIAL 32 /* Cannot be OR'ed with PNG_LIBPNG_BUILD_PRIVATE */ -#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_BETA +#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_RC /* Careful here. At one time, Guy wanted to use 082, but that would be octal. * We must not include leading zeros. @@ -459,7 +459,7 @@ extern "C" { /* This triggers a compiler error in png.c, if png.c and png.h * do not agree upon the version number. */ -typedef char* png_libpng_version_1_6_33beta04; +typedef char* png_libpng_version_1_6_33rc01; /* Basic control structions. Read libpng-manual.txt or libpng.3 for more info. * diff --git a/pngconf.h b/pngconf.h index 20e36c0c1..b99444310 100644 --- a/pngconf.h +++ b/pngconf.h @@ -1,7 +1,7 @@ /* pngconf.h - machine configurable file for libpng * - * libpng version 1.6.33beta04, September 14, 2017 + * libpng version 1.6.33rc01, September 20, 2017 * * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) diff --git a/pngrutil.c b/pngrutil.c index 03b711599..61b22cd1e 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -671,9 +671,6 @@ png_decompress_chunk(png_structrp png_ptr, (terminate != 0); png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr, buffer_size)); - /* Stop an oss-fuzz "use of uninitialized value" detection - * in png_set_text_2() - */ memset(text, 0, buffer_size); if (text != NULL) diff --git a/pngtest.c b/pngtest.c index 3c04849e6..1277ea78e 100644 --- a/pngtest.c +++ b/pngtest.c @@ -2153,4 +2153,4 @@ main(void) #endif /* Generate a compiler error if there is an old png.h in the search path. */ -typedef png_libpng_version_1_6_33beta04 Your_png_h_is_not_version_1_6_33beta04; +typedef png_libpng_version_1_6_33rc01 Your_png_h_is_not_version_1_6_33rc01; diff --git a/projects/vstudio/README.txt b/projects/vstudio/README.txt index 39e8cb9fa..1c659cd21 100644 --- a/projects/vstudio/README.txt +++ b/projects/vstudio/README.txt @@ -1,7 +1,7 @@ VisualStudio instructions -libpng version 1.6.33beta04 - September 14, 2017 +libpng version 1.6.33rc01 - September 20, 2017 Copyright (c) 2010,2013,2015 Glenn Randers-Pehrson diff --git a/projects/vstudio/zlib.props b/projects/vstudio/zlib.props index 2038e696d..004e49c23 100644 --- a/projects/vstudio/zlib.props +++ b/projects/vstudio/zlib.props @@ -2,7 +2,7 @@