mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng14] Fixed an out-of-range read in png_check_keyword() (Bug report from

Browse Source 
Qixue Xiao).
This commit is contained in:
Glenn Randers-Pehrson 2015-12-09 09:37:20 -06:00
parent 8c12b3c2cc
commit 9d757479d1
3 changed files with 20 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
ANNOUNCE
View File

@ -1,37 +1,34 @@
Libpng 1.4.18 - December 3, 2015 Libpng 1.4.19beta01 - December 9, 2015
This is a public release of libpng, intended for use in production codes. This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version.
Files available for download: Files available for download:
Source files with LF line endings (for Unix/Linux) and with a Source files with LF line endings (for Unix/Linux) and with a
"configure" script "configure" script
libpng-1.4.18.tar.xz (LZMA-compressed, recommended) 1.4.19beta01.tar.xz (LZMA-compressed, recommended)
libpng-1.4.18.tar.gz 1.4.19beta01.tar.gz
Source files with CRLF line endings (for Windows), without the Source files with CRLF line endings (for Windows), without the
"configure" script "configure" script
lpng1418.7z (LZMA-compressed, recommended) lp1419b01.7z (LZMA-compressed, recommended)
lpng1418.zip lp1419b01.zip
Other information: Other information:
libpng-1.4.18-README.txt 1.4.19beta01-README.txt
libpng-1.4.18-LICENSE.txt 1.4.19beta01-LICENSE.txt
libpng-1.4.18-*.asc (armored detached GPG signatures) libpng-1.4.19beta01-*.asc (armored detached GPG signatures)
Changes since the last public release (1.4.17): Changes since the last public release (1.4.18):
Avoid potential pointer overflow in png_handle_iTXt(), png_handle_zTXt(), version 1.4.19 [December 9, 2015]
png_handle_sPLT(), and png_handle_pCAL() (Bug report by John Regehr). Fixed an out-of-range read in png_check_keyword() (Bug report from
Fixed incorrect implementation of png_set_PLTE() that uses png_ptr Qixue Xiao).
not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126
vulnerability.
Discontinued distributing tar.bz2 archives.
Discontinued distributing libpng-oldversion-newversion-diff.txt
Send comments/corrections/commendations to glennrp at users.sourceforge.net Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit or to png-mng-implement at lists.sf.net (subscription required; visit

6
CHANGES
View File

@ -3014,7 +3014,7 @@ version 1.4.18beta01 [November 20, 2015]
version 1.4.18beta02 [November 23, 2015] version 1.4.18beta02 [November 23, 2015]
Fixed incorrect implementation of png_set_PLTE() that uses png_ptr Fixed incorrect implementation of png_set_PLTE() that uses png_ptr
not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126 not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126
vulnerability. vulnerability. Fixes CVE-2015-8472.
version 1.4.18rc01 [November 26, 2015] version 1.4.18rc01 [November 26, 2015]
Discontinued distributing tar.bz2 archives. Discontinued distributing tar.bz2 archives.
@ -3022,6 +3022,10 @@ version 1.4.18rc01 [November 26, 2015]
version 1.4.18 [December 3, 2015] version 1.4.18 [December 3, 2015]
Discontinued distributing libpng-oldversion-newversion-diff.txt Discontinued distributing libpng-oldversion-newversion-diff.txt
version 1.4.19beta01 [December 9, 2015]
Fixed an out-of-range read in png_check_keyword() (Bug report from
Qixue Xiao).
Send comments/corrections/commendations to glennrp at users.sourceforge.net Send comments/corrections/commendations to glennrp at users.sourceforge.net
or to png-mng-implement at lists.sf.net (subscription required; visit or to png-mng-implement at lists.sf.net (subscription required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-implement). https://lists.sourceforge.net/lists/listinfo/png-mng-implement).

2
pngwutil.c
View File

@ -1303,7 +1303,7 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
{ {
png_warning(png_ptr, "trailing spaces removed from keyword"); png_warning(png_ptr, "trailing spaces removed from keyword");
while (*kp == ' ') while (key_len && *kp == ' ')
{ {
*(kp--) = '\0'; *(kp--) = '\0';
key_len--; key_len--;