[libpng15] Imported from libpng-1.5.10beta02.tar

Added information about the new limits in the manual.

ANNOUNCE

@@ -1,5 +1,5 @@
 
-Libpng 1.5.10beta01 - February 21, 2012
+Libpng 1.5.10beta02 - February 27, 2012
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -9,24 +9,24 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script
 
-   1.5.10beta01.tar.xz (LZMA-compressed, recommended)
-   1.5.10beta01.tar.gz
-   1.5.10beta01.tar.bz2
+   1.5.10beta02.tar.xz (LZMA-compressed, recommended)
+   1.5.10beta02.tar.gz
+   1.5.10beta02.tar.bz2
 
 Source files with CRLF line endings (for Windows), without the
 "configure" script
 
-   lp1510b01.7z  (LZMA-compressed, recommended)
-   lp1510b01.zip
+   lp1510b02.7z  (LZMA-compressed, recommended)
+   lp1510b02.zip
 
 Other information:
 
-   1.5.10beta01-README.txt
-   1.5.10beta01-LICENSE.txt
+   1.5.10beta02-README.txt
+   1.5.10beta02-LICENSE.txt
 
 Changes since the last public release (1.5.9):
 
-Version 1.5.10beta01 [February 21, 2012]
+Version 1.5.10beta01 [February 24, 2012]
   Removed two useless #ifdef directives from pngread.c and one from pngrutil.c
   Always put the CMAKE_LIBRARY in "lib" (removed special WIN32 case).
   Removed empty vstudio/pngstest directory (Clifford Yapp).
@@ -35,6 +35,15 @@ Version 1.5.10beta01 [February 21, 2012]
     now that png_ptr->buffer is inaccessible to applications, the special
     handling is no longer useful.
   Fixed bug with png_handle_hIST with odd chunk length (Frank Busse).
+  Added PNG_SAFE_LIMITS feature to pnglibconf.dfa and code in pngconf.h
+    to reset the user limits to safe ones if PNG_SAFE_LIMITS is defined.
+    To enable, use "CPPFLAGS=-DPNG_SAFE_LIMITS_SUPPORTED" on the configure
+    command or put "#define PNG_SAFE_LIMITS_SUPPORTED" in pnglibconf.h.
+  Revised the SAFE_LIMITS feature to be the same as the feature in libpng16.
+  Added information about the new limits in the manual.
+
+Version 1.5.10beta02 [February 27, 2012]
+  Updated Makefile.in
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net:
 (subscription required; visit

CHANGES

@@ -3803,14 +3803,15 @@ Version 1.5.9beta02 [February 16, 2012]
   Removed tests for no-longer-used *_EMPTY_PLTE_SUPPORTED from pngstruct.h
 
 Version 1.5.9rc01 [February 17, 2012]
-  Fixed CVE-2011-3026 buffer overrun bug.  Deal more correctly with the test
-    on iCCP chunk length. Also removed spurious casts that may hide problems
-    on 16-bit systems.
+  Fixed CVE-2011-3026 buffer overrun bug.  This bug was introduced when
+    iCCP chunk support was added at libpng-1.0.6. Deal more correctly with the
+    test on iCCP chunk length. Also removed spurious casts that may hide
+    problems on 16-bit systems.
 
 Version 1.5.9 [February 18, 2012]
   No changes.
 
-Version 1.5.10beta01 [February 21, 2012]
+Version 1.5.10beta01 [February 24, 2012]
   Removed two useless #ifdef directives from pngread.c and one from pngrutil.c
   Always put the CMAKE_LIBRARY in "lib" (removed special WIN32 case).
   Removed empty vstudio/pngstest directory (Clifford Yapp).
@@ -3819,6 +3820,15 @@ Version 1.5.10beta01 [February 21, 2012]
     now that png_ptr->buffer is inaccessible to applications, the special
     handling is no longer useful.
   Fixed bug with png_handle_hIST with odd chunk length (Frank Busse).
+  Added PNG_SAFE_LIMITS feature to pnglibconf.dfa and code in pngconf.h
+    to reset the user limits to safe ones if PNG_SAFE_LIMITS is defined.
+    To enable, use "CPPFLAGS=-DPNG_SAFE_LIMITS_SUPPORTED" on the configure
+    command or put "#define PNG_SAFE_LIMITS_SUPPORTED" in pnglibconf.h.
+  Revised the SAFE_LIMITS feature to be the same as the feature in libpng16.
+  Added information about the new limits in the manual.
+
+Version 1.5.10beta02 [February 27, 2012]
+  Updated Makefile.in
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit

CMakeLists.txt

@@ -225,7 +225,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW)
 # SET UP LINKS
 if(PNG_SHARED)
   set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 15.${PNGLIB_RELEASE}.1.5.10beta01
+#   VERSION 15.${PNGLIB_RELEASE}.1.5.10beta02
     VERSION 15.${PNGLIB_RELEASE}.0
     SOVERSION 15
     CLEAN_DIRECT_OUTPUT 1)

LICENSE

@@ -10,7 +10,7 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.2.6, August 15, 2004, through 1.5.10beta01, February 19, 2012, are
+libpng versions 1.2.6, August 15, 2004, through 1.5.10beta02, February 27, 2012, are
 Copyright (c) 2004, 2006-2011 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -108,4 +108,4 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-February 19, 2012
+February 27, 2012

Makefile.am

@@ -38,7 +38,7 @@ lib_LTLIBRARIES=libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.la
 libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_SOURCES = png.c pngerror.c\
 	pngget.c pngmem.c pngpread.c pngread.c pngrio.c pngrtran.c pngrutil.c\
 	pngset.c pngtrans.c pngwio.c pngwrite.c pngwtran.c pngwutil.c\
-	png.h pngconf.h pngdebug.h pnginfo.h pngpriv.h pngstruct.h
+	png.h pngconf.h pngdebug.h pnginfo.h pngpriv.h pngstruct.h pngusr.dfa
 
 if PNG_ARM_NEON
 libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_SOURCES += arm/filter_neon.S
@@ -153,11 +153,11 @@ SYMBOL_CFLAGS = -DPNGLIB_LIBNAME='PNG@PNGLIB_MAJOR@@PNGLIB_MINOR@_0'\
 	mv dfn3.out $@
 
 # The .dfn file for pnglibconf.h is machine generated
-pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h
+pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h pngusr.dfa $(DFA_XTRA)
 	rm -f $@ dfn?.out
 	$(AWK) -f ${srcdir}/scripts/options.awk out=dfn1.out version=search\
 	    ${srcdir}/pngconf.h ${srcdir}/scripts/pnglibconf.dfa\
-	    $(DFA_XTRA) 1>&2
+	    ${srcdir}/pngusr.dfa $(DFA_XTRA) 1>&2
 	$(AWK) -f ${srcdir}/scripts/options.awk out=dfn2.out dfn1.out 1>&2
 	rm dfn1.out
 	mv dfn2.out $@

Makefile.in

@@ -102,7 +102,7 @@ am__libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_SOURCES_DIST = png.c \
 	pngerror.c pngget.c pngmem.c pngpread.c pngread.c pngrio.c \
 	pngrtran.c pngrutil.c pngset.c pngtrans.c pngwio.c pngwrite.c \
 	pngwtran.c pngwutil.c png.h pngconf.h pngdebug.h pnginfo.h \
-	pngpriv.h pngstruct.h arm/filter_neon.S
+	pngpriv.h pngstruct.h arm/filter_neon.S pngusr.dfa
 @PNG_ARM_NEON_TRUE@am__objects_1 = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la-filter_neon.lo
 am_libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_OBJECTS =  \
 	libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la-png.lo \
@@ -356,7 +356,7 @@ libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_SOURCES = png.c pngerror.c \
 	pngget.c pngmem.c pngpread.c pngread.c pngrio.c pngrtran.c \
 	pngrutil.c pngset.c pngtrans.c pngwio.c pngwrite.c pngwtran.c \
 	pngwutil.c png.h pngconf.h pngdebug.h pnginfo.h pngpriv.h \
-	pngstruct.h $(am__append_1)
+	pngstruct.h pngusr.dfa $(am__append_1)
 nodist_libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_SOURCES = pnglibconf.h
 libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_CPPFLAGS = @LIBPNG_DEFINES@
 libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_LDFLAGS = -no-undefined \
@@ -1373,11 +1373,11 @@ contrib/libtests/pngvalid.o pngtest.o: pnglibconf.h
 	mv dfn3.out $@
 
 # The .dfn file for pnglibconf.h is machine generated
-pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h
+pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h pngusr.dfa $(DFA_XTRA)
 	rm -f $@ dfn?.out
 	$(AWK) -f ${srcdir}/scripts/options.awk out=dfn1.out version=search\
 	    ${srcdir}/pngconf.h ${srcdir}/scripts/pnglibconf.dfa\
-	    $(DFA_XTRA) 1>&2
+	    ${srcdir}/pngusr.dfa $(DFA_XTRA) 1>&2
 	$(AWK) -f ${srcdir}/scripts/options.awk out=dfn2.out dfn1.out 1>&2
 	rm dfn1.out
 	mv dfn2.out $@

README

@@ -1,4 +1,4 @@
-README for libpng version 1.5.10beta01 - February 19, 2012 (shared library 15.0)
+README for libpng version 1.5.10beta02 - February 27, 2012 (shared library 15.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.68 for libpng 1.5.10beta01.
+# Generated by GNU Autoconf 2.68 for libpng 1.5.10beta02.
 #
 # Report bugs to <png-mng-implement@lists.sourceforge.net>.
 #
@@ -570,8 +570,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libpng'
 PACKAGE_TARNAME='libpng'
-PACKAGE_VERSION='1.5.10beta01'
-PACKAGE_STRING='libpng 1.5.10beta01'
+PACKAGE_VERSION='1.5.10beta02'
+PACKAGE_STRING='libpng 1.5.10beta02'
 PACKAGE_BUGREPORT='png-mng-implement@lists.sourceforge.net'
 PACKAGE_URL=''
 
@@ -1321,7 +1321,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures libpng 1.5.10beta01 to adapt to many kinds of systems.
+\`configure' configures libpng 1.5.10beta02 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1391,7 +1391,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libpng 1.5.10beta01:";;
+     short | recursive ) echo "Configuration of libpng 1.5.10beta02:";;
    esac
   cat <<\_ACEOF
 
@@ -1502,7 +1502,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libpng configure 1.5.10beta01
+libpng configure 1.5.10beta02
 generated by GNU Autoconf 2.68
 
 Copyright (C) 2010 Free Software Foundation, Inc.
@@ -1925,7 +1925,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libpng $as_me 1.5.10beta01, which was
+It was created by libpng $as_me 1.5.10beta02, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   $ $0 $@
@@ -2740,7 +2740,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='libpng'
- VERSION='1.5.10beta01'
+ VERSION='1.5.10beta02'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -2804,7 +2804,7 @@ fi
 
 
 
-PNGLIB_VERSION=1.5.10beta01
+PNGLIB_VERSION=1.5.10beta02
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=5
 PNGLIB_RELEASE=10
@@ -13417,7 +13417,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libpng $as_me 1.5.10beta01, which was
+This file was extended by libpng $as_me 1.5.10beta02, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -13483,7 +13483,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-libpng config.status 1.5.10beta01
+libpng config.status 1.5.10beta02
 configured by $0, generated by GNU Autoconf 2.68,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -18,12 +18,12 @@ AC_PREREQ(2.59)
 
 dnl Version number stuff here:
 
-AC_INIT([libpng], [1.5.10beta01], [png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng], [1.5.10beta02], [png-mng-implement@lists.sourceforge.net])
 AM_INIT_AUTOMAKE
 dnl stop configure from automagically running automake
 AM_MAINTAINER_MODE
 
-PNGLIB_VERSION=1.5.10beta01
+PNGLIB_VERSION=1.5.10beta02
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=5
 PNGLIB_RELEASE=10

libpng-manual.txt

@@ -1,6 +1,6 @@
 libpng-manual.txt - A description on how to use and modify libpng
 
- libpng version 1.5.10beta01 - February 19, 2012
+ libpng version 1.5.10beta02 - February 27, 2012
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2011 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.5.10beta01 - February 19, 2012
+ libpng versions 0.97, January 1998, through 1.5.10beta02 - February 27, 2012
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2011 Glenn Randers-Pehrson
 
@@ -4260,6 +4260,20 @@ PNG_USER_WIDTH_MAX and PNG_USER_HEIGHT_MAX, although this document said
 that it could be used to override them.  Now this function will reduce or
 increase the limits.
 
+Starting in libpng-1.5.10, the user limits can be set en masse with the
+configuration option PNG_SAFE_LIMITS_SUPPORTED.  If this option is enabled,
+a set of "safe" limits is applied in pngpriv.h.  These can be overridden by
+application calls to png_set_user_limits(), png_set_user_chunk_cache_max(),
+and/or png_set_user_malloc_max() that increase or decrease the limits.  Also,
+in libpng-1.5.10 the default width and height limits were increased
+from 1,000,000 to 0x7ffffff (i.e., made unlimited).  Therefore, the
+limits are now
+                               default      safe
+   png_user_width_max        0x7fffffff    1,000,000
+   png_user_height_max       0x7fffffff    1,000,000
+   png_user_chunk_cache_max  0 (unlimited)   128
+   png_user_chunk_malloc_max 0 (unlimited) 8,000,000
+
 B. Changes to the build and configuration of libpng
 
 Details of internal changes to the library code can be found in the CHANGES
@@ -4573,13 +4587,13 @@ Other rules can be inferred by inspecting the libpng source.
 
 XIV. Y2K Compliance in libpng
 
-February 19, 2012
+February 27, 2012
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.5.10beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.5.10beta02 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that

libpng.3

@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "February 19, 2012"
+.TH LIBPNG 3 "February 27, 2012"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.5.10beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.5.10beta02
 .SH SYNOPSIS
 \fI\fB
 
@@ -977,7 +977,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng-manual.txt - A description on how to use and modify libpng
 
- libpng version 1.5.10beta01 - February 19, 2012
+ libpng version 1.5.10beta02 - February 27, 2012
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2011 Glenn Randers-Pehrson
@@ -988,7 +988,7 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.5.10beta01 - February 19, 2012
+ libpng versions 0.97, January 1998, through 1.5.10beta02 - February 27, 2012
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2011 Glenn Randers-Pehrson
 
@@ -5238,6 +5238,20 @@ PNG_USER_WIDTH_MAX and PNG_USER_HEIGHT_MAX, although this document said
 that it could be used to override them.  Now this function will reduce or
 increase the limits.
 
+Starting in libpng-1.5.10, the user limits can be set en masse with the
+configuration option PNG_SAFE_LIMITS_SUPPORTED.  If this option is enabled,
+a set of "safe" limits is applied in pngpriv.h.  These can be overridden by
+application calls to png_set_user_limits(), png_set_user_chunk_cache_max(),
+and/or png_set_user_malloc_max() that increase or decrease the limits.  Also,
+in libpng-1.5.10 the default width and height limits were increased
+from 1,000,000 to 0x7ffffff (i.e., made unlimited).  Therefore, the
+limits are now
+                               default      safe
+   png_user_width_max        0x7fffffff    1,000,000
+   png_user_height_max       0x7fffffff    1,000,000
+   png_user_chunk_cache_max  0 (unlimited)   128
+   png_user_chunk_malloc_max 0 (unlimited) 8,000,000
+
 B. Changes to the build and configuration of libpng
 
 Details of internal changes to the library code can be found in the CHANGES
@@ -5551,13 +5565,13 @@ Other rules can be inferred by inspecting the libpng source.
 
 .SH XIV. Y2K Compliance in libpng
 
-February 19, 2012
+February 27, 2012
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.5.10beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.5.10beta02 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that
@@ -5768,7 +5782,7 @@ the first widely used release:
  1.5.9beta01-02      15    10509  15.so.15.9[.0]
  1.5.9rc01           15    10509  15.so.15.9[.0]
  1.5.9               15    10509  15.so.15.9[.0]
- 1.5.10beta01        15    10510  15.so.15.10[.0]
+ 1.5.10beta01-02     15    10510  15.so.15.10[.0]
 
 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -5825,7 +5839,7 @@ possible without all of you.
 
 Thanks to Frank J. T. Wojcik for helping with the documentation.
 
-Libpng version 1.5.10beta01 - February 19, 2012:
+Libpng version 1.5.10beta02 - February 27, 2012:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).
 
@@ -5848,7 +5862,7 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.2.6, August 15, 2004, through 1.5.10beta01, February 19, 2012, are
+libpng versions 1.2.6, August 15, 2004, through 1.5.10beta02, February 27, 2012, are
 Copyright (c) 2004,2006-2007 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -5947,7 +5961,7 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-February 19, 2012
+February 27, 2012
 
 .\" end of man page
 

libpngpf.3

@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "February 19, 2012"
+.TH LIBPNGPF 3 "February 27, 2012"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.5.10beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.5.10beta02
 (private functions)
 .SH SYNOPSIS
 \fB#include \fI"pngpriv.h"

png.5

@@ -1,4 +1,4 @@
-.TH PNG 5 "February 19, 2012"
+.TH PNG 5 "February 27, 2012"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION

png.c

@@ -14,7 +14,7 @@
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_10beta01 Your_png_h_is_not_version_1_5_10beta01;
+typedef png_libpng_version_1_5_10beta02 Your_png_h_is_not_version_1_5_10beta02;
 
 /* Tells libpng that we have already handled the first "num_bytes" bytes
  * of the PNG file signature.  If the PNG data is embedded into another
@@ -655,13 +655,13 @@ png_get_copyright(png_const_structp png_ptr)
 #else
 #  ifdef __STDC__
    return PNG_STRING_NEWLINE \
-     "libpng version 1.5.10beta01 - February 19, 2012" PNG_STRING_NEWLINE \
+     "libpng version 1.5.10beta02 - February 27, 2012" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2011 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.5.10beta01 - February 19, 2012\
+      return "libpng version 1.5.10beta02 - February 27, 2012\
       Copyright (c) 1998-2011 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";

png.h

@@ -1,7 +1,7 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.5.10beta01 - February 19, 2012
+ * libpng version 1.5.10beta02 - February 27, 2012
  * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -11,7 +11,7 @@
  * Authors and maintainers:
  *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *   libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.5.10beta01 - February 19, 2012: Glenn
+ *   libpng versions 0.97, January 1998, through 1.5.10beta02 - February 27, 2012: Glenn
  *   See also "Contributing Authors", below.
  *
  * Note about libpng version numbers:
@@ -172,7 +172,7 @@
  *    1.5.9beta01-02          15    10509  15.so.15.9[.0]
  *    1.5.9rc01               15    10509  15.so.15.9[.0]
  *    1.5.9                   15    10509  15.so.15.9[.0]
- *    1.5.10beta01            15    10510  15.so.15.10[.0]
+ *    1.5.10beta01-02         15    10510  15.so.15.10[.0]
  *
  *   Henceforth the source version will match the shared-library major
  *   and minor numbers; the shared-library major version number will be
@@ -204,7 +204,7 @@
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.2.6, August 15, 2004, through 1.5.10beta01, February 19, 2012, are
+ * libpng versions 1.2.6, August 15, 2004, through 1.5.10beta02, February 27, 2012, are
  * Copyright (c) 2004, 2006-2012 Glenn Randers-Pehrson, and are
  * distributed according to the same disclaimer and license as libpng-1.2.5
  * with the following individual added to the list of Contributing Authors:
@@ -316,13 +316,13 @@
  * Y2K compliance in libpng:
  * =========================
  *
- *    February 19, 2012
+ *    February 27, 2012
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.5.10beta01 are Y2K compliant.  It is my belief that
+ *    upward through 1.5.10beta02 are Y2K compliant.  It is my belief that
  *    earlier versions were also Y2K compliant.
  *
  *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -380,9 +380,9 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.5.10beta01"
+#define PNG_LIBPNG_VER_STRING "1.5.10beta02"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.5.10beta01 - February 19, 2012\n"
+     " libpng version 1.5.10beta02 - February 27, 2012\n"
 
 #define PNG_LIBPNG_VER_SONUM   15
 #define PNG_LIBPNG_VER_DLLNUM  15
@@ -396,7 +396,7 @@
  * PNG_LIBPNG_VER_STRING, omitting any leading zero:
  */
 
-#define PNG_LIBPNG_VER_BUILD  01
+#define PNG_LIBPNG_VER_BUILD  02
 
 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -543,7 +543,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef char* png_libpng_version_1_5_10beta01;
+typedef char* png_libpng_version_1_5_10beta02;
 
 /* Three color definitions.  The order of the red, green, and blue, (and the
  * exact size) is not important, although the size of the fields need to

pngconf.h

@@ -1,7 +1,7 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.5.10beta01 - February 19, 2012
+ * libpng version 1.5.10beta02 - February 27, 2012
  *
  * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)

pngpriv.h

@@ -133,6 +133,46 @@
 #  define PNG_DLL_EXPORT
 #endif
 
+/* SECURITY and SAFETY:
+ *
+ * By default libpng is built without any internal limits on image size,
+ * individual heap (png_malloc) allocations or the total amount of memory used.
+ * If PNG_SAFE_LIMITS_SUPPORTED is defined, however, the limits below are used
+ * (unless individually overridden).  These limits are believed to be fairly
+ * safe, but builders of secure systems should verify the values against the
+ * real system capabilities.
+ */
+
+#ifdef PNG_SAFE_LIMITS_SUPPORTED
+   /* 'safe' limits */
+#  ifndef PNG_USER_WIDTH_MAX
+#     define PNG_USER_WIDTH_MAX 1000000
+#  endif
+#  ifndef PNG_USER_HEIGHT_MAX
+#     define PNG_USER_HEIGHT_MAX 1000000
+#  endif
+#  ifndef PNG_USER_CHUNK_CACHE_MAX
+#     define PNG_USER_CHUNK_CACHE_MAX 128
+#  endif
+#  ifndef PNG_USER_CHUNK_MALLOC_MAX
+#     define PNG_USER_CHUNK_MALLOC_MAX 8000000
+#  endif
+#else
+   /* values for no limits */
+#  ifndef PNG_USER_WIDTH_MAX
+#     define PNG_USER_WIDTH_MAX 0x7fffffff
+#  endif
+#  ifndef PNG_USER_HEIGHT_MAX
+#     define PNG_USER_HEIGHT_MAX 0x7fffffff
+#  endif
+#  ifndef PNG_USER_CHUNK_CACHE_MAX
+#     define PNG_USER_CHUNK_CACHE_MAX 0
+#  endif
+#  ifndef PNG_USER_CHUNK_MALLOC_MAX
+#     define PNG_USER_CHUNK_MALLOC_MAX 0
+#  endif
+#endif
+
 /* This is used for 16 bit gamma tables - only the top level pointers are const,
  * this could be changed:
  */

pngtest.c

@@ -1817,4 +1817,4 @@ main(int argc, char *argv[])
 }
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_10beta01 Your_png_h_is_not_version_1_5_10beta01;
+typedef png_libpng_version_1_5_10beta02 Your_png_h_is_not_version_1_5_10beta02;

pngusr.dfa

@@ -0,0 +1,14 @@
+# pngusr.dfa
+#
+# Build time configuration of libpng
+#
+# Enter build configuration options in this file
+#
+# Security settings: by default these limits are unset, you can change them
+# here by entering the appropriate values as #defines preceded by '@' (to cause,
+# them to be passed through to the build of pnglibconf.h), for example:
+#
+# @# define PNG_USER_WIDTH_MAX 1000000
+# @# define PNG_USER_HEIGHT_MAX 1000000
+# @# define PNG_USER_CHUNK_CACHE_MAX 128
+# @# define PNG_USER_CHUNK_MALLOC_MAX 8000000

projects/vstudio/readme.txt

@@ -1,7 +1,7 @@
 
 VisualStudio instructions
 
-libpng version 1.5.10beta01 - February 19, 2012
+libpng version 1.5.10beta02 - February 27, 2012
 
 Copyright (c) 1998-2010 Glenn Randers-Pehrson
 

projects/vstudio/zlib.props

@@ -2,7 +2,7 @@
 <!--
  * zlib.props - location of zlib source
  *
- * libpng version 1.5.10beta01 - February 19, 2012
+ * libpng version 1.5.10beta02 - February 27, 2012
  *
  * Copyright (c) 1998-2011 Glenn Randers-Pehrson
  *

scripts/README.txt

@@ -1,9 +1,9 @@
 
-Makefiles for  libpng version 1.5.10beta01 - February 19, 2012
+Makefiles for  libpng version 1.5.10beta02 - February 27, 2012
 
 pnglibconf.h.prebuilt       =>  Stores configuration settings
  makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng15.so.15.1.5.10beta01)
+                       (gcc, creates libpng15.so.15.1.5.10beta02)
  makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
  makefile.knr      =>  Archaic UNIX Makefile that converts files with
                        ansi2knr (Requires ansi2knr.c from
@@ -20,7 +20,7 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
  makefile.dec      =>  DEC Alpha UNIX makefile
  makefile.dj2      =>  DJGPP 2 makefile
  makefile.elf      =>  Linux/ELF makefile symbol versioning,
-                       (gcc, creates libpng15.so.15.1.5.10beta01)
+                       (gcc, creates libpng15.so.15.1.5.10beta02)
  makefile.freebsd  =>  FreeBSD makefile
  makefile.gcc      =>  Generic gcc makefile
  makefile.hpgcc    =>  HPUX makefile using gcc
@@ -35,12 +35,12 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
  makefile.os2      =>  OS/2 Makefile (gcc and emx, requires libpng.def)
  makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
  makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng15.so.15.1.5.10beta01)
+                       creates libpng15.so.15.1.5.10beta02)
  makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
  makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng15.so.15.1.5.10beta01)
+                       creates libpng15.so.15.1.5.10beta02)
  makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng15.so.15.1.5.10beta01)
+                       creates libpng15.so.15.1.5.10beta02)
  makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
  makefile.sunos    =>  Sun makefile
  makefile.32sunu   =>  Sun Ultra 32-bit makefile

scripts/libpng-config-head.in

@@ -11,7 +11,7 @@
 
 # Modeled after libxml-config.
 
-version=1.5.10beta01
+version=1.5.10beta02
 prefix=""
 libdir=""
 libs=""

scripts/libpng.pc.in

@@ -5,6 +5,6 @@ includedir=@includedir@/libpng15
 
 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.5.10beta01
+Version: 1.5.10beta02
 Libs: -L${libdir} -lpng15
 Cflags: -I${includedir}

scripts/makefile.ne12bsd

@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng15
 
 LIB=	png15
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.5.10beta01
+SHLIB_MINOR=	1.5.10beta02
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c

scripts/makefile.netbsd

@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include
 
 LIB=	png
 SHLIB_MAJOR=	15
-SHLIB_MINOR=	1.5.10beta01
+SHLIB_MINOR=	1.5.10beta02
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c

scripts/makefile.openbsd

@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat
 
 SHLIB_MAJOR=	15
-SHLIB_MINOR=	1.5.10beta01
+SHLIB_MINOR=	1.5.10beta02
 
 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \

scripts/options.awk

@@ -42,7 +42,7 @@ BEGIN{
    comment=start cx             # Comment start
    cend="*/" end                # Comment end
    def=start "#define PNG_" ct  # Arbitrary define
-   sup=ct "_SUPPORTED" end      # end supported option
+   sup=ct "_SUPPORTED 1" end    # end supported option
    und=comment "#undef PNG_" ct # Unsupported option
    une=ct "_SUPPORTED" cend     # end unsupported option
    error=start "ERROR:"         # error message

scripts/pnglibconf.dfa

@@ -27,7 +27,7 @@ file pnglibconf.h scripts/pnglibconf.dfa PNGLCONF_H
 # The syntax is detailed in scripts/options.awk, this is a summary
 # only:
 #
-# setting <name> [requires ...] [default]
+# setting <name> [default]
 #    #define PNG_<name> <value>  /* value comes from current setting */
 # option <name> [requires ...] [if ...] [enables ...] [disabled]
 #    #define PNG_<name>_SUPPORTED if the requirements are met and
@@ -266,20 +266,22 @@ option SET_USER_LIMITS enables SET_CHUNK_CACHE_LIMIT
 
 option SET_USER_LIMITS enables SET_CHUNK_MALLOC_LIMIT
 
-# Added at libpng-1.0.16 and 1.2.6.  To accept all valid PNGs no matter
-# how large, set these two limits to 0x7fffffff
+# Libpng limits.
+#
+# If these settings are *not* set libpng will not limit the size of
+# images or the size of data in ancilliary chunks.  This does lead to
+# security issues if PNG files come from untrusted sources.
+setting USER_WIDTH_MAX
+setting USER_HEIGHT_MAX
+setting USER_CHUNK_CACHE_MAX
+setting USER_CHUNK_MALLOC_MAX
 
-setting USER_WIDTH_MAX default 1000000
-setting USER_HEIGHT_MAX default 1000000
-
-# Added at libpng-1.2.43.  To accept all valid PNGs no matter
-# how large, set these two limits to 0.
-
-setting USER_CHUNK_CACHE_MAX default 0
-
-# Added at libpng-1.2.43
-
-setting USER_CHUNK_MALLOC_MAX default 0
+# To default all these settings to values that are large but probably
+# safe turn the SAFE_LIMITS option on; this will cause the value in
+# pngpriv.h to be used.  Individual values can also be set, simply set
+# them in pngusr.dfa with '@#define PNG_setting value' lines.
+option SAFE_LIMITS enables USER_LIMITS disabled
+= SAFE_LIMITS SAFE_LIMITS
 
 # All of the following options relate to code capabilities for
 # processing image data before creating a PNG or after reading one.

scripts/pnglibconf.h.prebuilt

@@ -3,7 +3,7 @@
 
 /* pnglibconf.h - library build configuration */
 
-/* Libpng 1.5.10beta01 - February 19, 2012 */
+/* Libpng 1.5.10beta02 - February 27, 2012 */
 
 /* Copyright (c) 1998-2011 Glenn Randers-Pehrson */
 
@@ -31,10 +31,6 @@
 #define PNG_QUANTIZE_GREEN_BITS 5
 #define PNG_QUANTIZE_RED_BITS 5
 #define PNG_sCAL_PRECISION 5
-#define PNG_USER_CHUNK_CACHE_MAX 0
-#define PNG_USER_CHUNK_MALLOC_MAX 0
-#define PNG_USER_HEIGHT_MAX 1000000
-#define PNG_USER_WIDTH_MAX 1000000
 #define PNG_WEIGHT_SHIFT 8
 #define PNG_ZBUF_SIZE 8192
 /* end of settings */

scripts/symbols.def

@@ -5,7 +5,7 @@
 LIBRARY
 
 EXPORTS
-;Version 1.5.10beta01
+;Version 1.5.10beta02
  png_access_version_number @1
  png_set_sig_bytes @2
  png_sig_cmp @3