[libpng17] Use a more generous size limit for IDAT chunks.

parenthesis in contrib/pngminus/pnm2png.c (bug report by Christian Hesse).

ANNOUNCE

@@ -1,5 +1,5 @@
 
-Libpng 1.7.0beta88 - August 6, 2017
+Libpng 1.7.0beta90 - September 3, 2017
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -9,20 +9,20 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script
 
-   1.7.0beta88.tar.xz (LZMA-compressed, recommended)
-   1.7.0beta88.tar.gz
+   1.7.0beta90.tar.xz (LZMA-compressed, recommended)
+   1.7.0beta90.tar.gz
 
 Source files with CRLF line endings (for Windows), without the
 "configure" script
 
-   /scratch/glennrp/Libpng17/lp170b88.7z  (LZMA-compressed, recommended)
-   /scratch/glennrp/Libpng17/lp170b88.zip
+   /scratch/glennrp/Libpng17/lp170b90.7z  (LZMA-compressed, recommended)
+   /scratch/glennrp/Libpng17/lp170b90.zip
 
 Other information:
 
-   1.7.0beta88-README.txt
-   1.7.0beta88-LICENSE.txt
-   libpng-1.7.0beta88-*.asc (armored detached GPG signatures)
+   1.7.0beta90-README.txt
+   1.7.0beta90-LICENSE.txt
+   libpng-1.7.0beta90-*.asc (armored detached GPG signatures)
 
 Changes since the last public release (1.6.0):
 
@@ -1431,9 +1431,19 @@ Version 1.7.0beta87 [April 1, 2017]
     makefile.linux and makefile.solaris-x86 (Cosmin).
   Merged some recent changes from libpng-1.6.30beta01.
 
-Version 1.7.0beta88 [August 6, 2017]
+Version 1.7.0beta88 [August 7. 2017]
   Added private png_check_chunk_name() and png_check_chunk_length()
-    functions.
+    functions (Fixes CVE-2017-12652).
+
+Version 1.7.0beta89 [August 19, 2017]
+  Check for 0 return from png_get_rowbytes() in contrib/pngminus/*.c to stop
+    some Coverity issues (162705, 162706, and 162707).
+
+Version 1.7.0beta90 [September 3, 2017]
+  Added PNGMINUS_UNUSED macro to contrib/pngminus/p*.c and added missing
+    parenthesis in contrib/pngminus/pnm2png.c (bug report by Christian Hesse).
+  Compute a larger limit on IDAT because some applications write a deflate
+    buffer for each row (Bug report by Andrew Church).
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit

CHANGES

@@ -5731,10 +5731,20 @@ Version 1.7.0beta87 [April 1, 2017]
     makefile.linux and makefile.solaris-x86 (Cosmin).
   Merged some recent changes from libpng-1.6.30beta01.
 
-Version 1.7.0beta88 [August 6, 2017]
+Version 1.7.0beta88 [August 7, 2017]
   Initialized btoa[] in pngstest.c
   Added private png_check_chunk_name() and png_check_chunk_length()
-    functions.
+    functions (Fixes CVE-2017-12652).
+
+Version 1.7.0beta89 [August 19, 2017]
+  Check for 0 return from png_get_rowbytes() in contrib/pngminus/*.c to stop
+    some Coverity issues (162705, 162706, and 162707).
+
+Version 1.7.0beta90 [September 3, 2017]
+  Added PNGMINUS_UNUSED macro to contrib/pngminus/p*.c and added missing
+    parenthesis in contrib/pngminus/pnm2png.c (bug report by Christian Hesse).
+  Compute a larger limit on IDAT because some applications write a deflate
+    buffer for each row (Bug report by Andrew Church).
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit

CMakeLists.txt

@@ -729,7 +729,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW)
 # SET UP LINKS
 if(PNG_SHARED)
   set_target_properties(png PROPERTIES
-#   VERSION 17.${PNGLIB_RELEASE}.1.7.0beta88
+#   VERSION 17.${PNGLIB_RELEASE}.1.7.0beta90
     VERSION 17.${PNGLIB_RELEASE}.0
     SOVERSION 17
     CLEAN_DIRECT_OUTPUT 1)

LICENSE

@@ -10,7 +10,7 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.0.7, July 1, 2000 through 1.7.0beta88, August 6, 2017 are
+libpng versions 1.0.7, July 1, 2000 through 1.7.0beta90, August 28, 2017 are
 Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -127,4 +127,4 @@ any encryption software.  See the EAR, paragraphs 734.3(b)(3) and
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-August 6, 2017
+August 28, 2017

README

@@ -1,4 +1,4 @@
-README for libpng version 1.7.0beta88 - August 6, 2017 (shared library 17.0)
+README for libpng version 1.7.0beta90 - August 28, 2017 (shared library 17.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.

configure.ac

@@ -26,7 +26,7 @@ AC_PREREQ([2.68])
 
 dnl Version number stuff here:
 
-AC_INIT([libpng],[1.7.0beta88],[png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng],[1.7.0beta90],[png-mng-implement@lists.sourceforge.net])
 AC_CONFIG_MACRO_DIR([scripts])
 
 # libpng does not follow GNU file name conventions (hence 'foreign')
@@ -48,7 +48,7 @@ dnl automake, so the following is not necessary (and is not defined anyway):
 dnl AM_PREREQ([1.11.2])
 dnl stop configure from automagically running automake
 
-PNGLIB_VERSION=1.7.0beta88
+PNGLIB_VERSION=1.7.0beta90
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=7
 PNGLIB_RELEASE=0

contrib/pngminus/png2pnm.c

@@ -1,8 +1,12 @@
 /*
  *  png2pnm.c --- conversion from PNG-file to PGM/PPM-file
- *  copyright (C) 1999 by Willem van Schaik <willem@schaik.com>
+ *  copyright (C) 1999,2017 by Willem van Schaik <willem at schaik.com>
  *
  *  version 1.0 - 1999.10.15 - First version.
+ *          1.1 - 2017.04.22 - Add buffer-size check (Glenn Randers-Pehrson)
+ *          1.2 - 2017.08.24 - Fix potential overflow in buffer-size check
+ *                             (Glenn Randers-Pehrson)
+ *          1.3 - 2017.08.28 - Add PNGMINUS_UNUSED (Christian Hesse)
  *
  *  Permission to use, copy, modify, and distribute this software and
  *  its documentation for any purpose and without fee is hereby granted,
@@ -41,6 +45,7 @@
 #define PNG_DEBUG 0
 #endif
 
+
 #include "png.h"
 
 /* Define png_jmpbuf() in case we are using a pre-1.0.6 version of libpng */
@@ -48,11 +53,20 @@
 #  define png_jmpbuf(png_ptr) ((png_ptr)->jmpbuf)
 #endif
 
+#ifndef PNGMINUS_UNUSED
+/* Unused formal parameter warnings are silenced using the following macro
+ * which is expected to have no bad effects on performance (optimizing
+ * compilers will probably remove it entirely).
+ */
+#  define PNGMINUS_UNUSED(param) (void)param
+#endif
+
 /* function prototypes */
 
 int  main (int argc, char *argv[]);
 void usage ();
-BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL alpha);
+BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw,
+   BOOL alpha);
 
 /*
  *  main
@@ -85,7 +99,8 @@ int main(int argc, char *argv[])
           if ((fp_al = fopen (argv[argi], "wb")) == NULL)
           {
             fprintf (stderr, "PNM2PNG\n");
-            fprintf (stderr, "Error:  can not create alpha-channel file %s\n", argv[argi]);
+            fprintf (stderr, "Error:  can not create alpha-channel file %s\n",
+               argv[argi]);
             exit (1);
           }
           break;
@@ -176,9 +191,11 @@ void usage()
   fprintf (stderr, "Usage:  png2pnm [options] <file>.png [<file>.pnm]\n");
   fprintf (stderr, "   or:  ... | png2pnm [options]\n");
   fprintf (stderr, "Options:\n");
-  fprintf (stderr, "   -r[aw]   write pnm-file in binary format (P4/P5/P6) (default)\n");
+  fprintf (stderr,
+     "   -r[aw]   write pnm-file in binary format (P4/P5/P6) (default)\n");
   fprintf (stderr, "   -n[oraw] write pnm-file in ascii format (P1/P2/P3)\n");
-  fprintf (stderr, "   -a[lpha] <file>.pgm write PNG alpha channel as pgm-file\n");
+  fprintf (stderr,
+     "   -a[lpha] <file>.pgm write PNG alpha channel as pgm-file\n");
   fprintf (stderr, "   -h | -?  print this help-information\n");
 }
 
@@ -186,7 +203,8 @@ void usage()
  *  png2pnm
  */
 
-BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL alpha)
+BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file,
+    volatile BOOL raw, BOOL alpha)
 {
   png_struct    *png_ptr = NULL;
   png_info        *info_ptr = NULL;
@@ -218,7 +236,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
 
   /* create png and info structures */
 
-  png_ptr = png_create_read_struct (PNG_LIBPNG_VER_STRING,
+  png_ptr = png_create_read_struct (png_get_libpng_ver(NULL),
     NULL, NULL, NULL);
   if (!png_ptr)
     return FALSE;   /* out of memory */
@@ -261,7 +279,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
     png_set_expand (png_ptr);
 
 #ifdef NJET
-  /* downgrade 16-bit images to 8 bit */
+  /* downgrade 16-bit images to 8-bit */
   if (bit_depth == 16)
     png_set_strip_16 (png_ptr);
   /* transform grayscale images into full-color */
@@ -315,12 +333,21 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
   /* row_bytes is the width x number of channels x (bit-depth / 8) */
   row_bytes = png_get_rowbytes (png_ptr, info_ptr);
 
-  if ((png_pixels = (png_byte *) malloc (row_bytes * height * sizeof (png_byte))) == NULL) {
+  if ((row_bytes == 0 || (size_t)height > ((size_t)(-1))/(size_t)row_bytes))
+  {
+    /* too big */ 
+    png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
+    return FALSE;
+  }
+  if ((png_pixels = (png_byte *)
+     malloc ((size_t)row_bytes * (size_t)height * sizeof (png_byte))) == NULL)
+  {
     png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
     return FALSE;
   }
 
-  if ((row_pointers = (png_byte **) malloc (height * sizeof (png_bytep))) == NULL)
+  if ((row_pointers = (png_byte **)
+     malloc ((size_t)height * sizeof (png_bytep))) == NULL)
   {
     png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
     free (png_pixels);
@@ -329,7 +356,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
   }
 
   /* set the individual row_pointers to point at the correct offsets */
-  for (i = 0; i < (height); i++)
+  for (i = 0; i < ((int) height); i++)
     row_pointers[i] = png_pixels + i * row_bytes;
 
   /* now we can go ahead and just read the whole image */
@@ -372,9 +399,9 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
   /* write data to PNM file */
   pix_ptr = png_pixels;
 
-  for (row = 0; row < height; row++)
+  for (row = 0; row < (int) height; row++)
   {
-    for (col = 0; col < width; col++)
+    for (col = 0; col < (int) width; col++)
     {
       for (i = 0; i < (channels - alpha_present); i++)
       {
@@ -401,7 +428,8 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
           if (raw)
             fputc ((int) *pix_ptr++ , alpha_file);
           else
-            if (bit_depth == 16){
+            if (bit_depth == 16)
+            {
               dep_16 = (long) *pix_ptr++;
               fprintf (alpha_file, "%ld ", (dep_16 << 8) + (long) *pix_ptr++);
             }
@@ -425,6 +453,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
   if (png_pixels != (unsigned char*) NULL)
     free (png_pixels);
 
+  PNGMINUS_UNUSED(raw); /* to quiet a Coverity defect */
   return TRUE;
 
 } /* end of source */

contrib/pngminus/pnm2png.c

@@ -1,9 +1,13 @@
 /*
  *  pnm2png.c --- conversion from PBM/PGM/PPM-file to PNG-file
- *  copyright (C) 1999,2015 by Willem van Schaik <willem@schaik.com>
+ *  copyright (C) 1999,2015,2017 by Willem van Schaik <willem at schaik.com>
  *
  *  version 1.0 - 1999.10.15 - First version.
  *  version 1.1 - 2015.07.29 - Fixed leaks (Glenn Randers-Pehrson)
+ *  version 1.2 - 2017.04.22 - Add buffer-size check
+ *          1.3 - 2017.08.24 - Fix potential overflow in buffer-size check
+ *                             (Glenn Randers-Pehrson)
+ *          1.4 - 2017.08.28 - Add PNGMINUS_UNUSED (Christian Hesse)
  *
  *  Permission to use, copy, modify, and distribute this software and
  *  its documentation for any purpose and without fee is hereby granted,
@@ -47,6 +51,15 @@
 #  define png_jmpbuf(png_ptr) ((png_ptr)->jmpbuf)
 #endif
 
+#ifndef PNGMINUS_UNUSED
+/* Unused formal parameter warnings are silenced using the following macro
+ * which is expected to have no bad effects on performance (optimizing
+ * compilers will probably remove it entirely).
+ */
+#  define PNGMINUS_UNUSED(param) (void)param
+#endif
+
+
 /* function prototypes */
 
 int  main (int argc, char *argv[]);
@@ -370,11 +383,16 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
     row_bytes = (width * channels * bit_depth + 7) / 8;
   else
 #endif
-    /* row_bytes is the width x number of channels x (bit-depth / 8) */
+  /* row_bytes is the width x number of channels x (bit-depth / 8) */
     row_bytes = width * channels * ((bit_depth <= 8) ? 1 : 2);
 
+  if ((row_bytes == 0 || (size_t)height > ((size_t)(-1))/(size_t)row_bytes))
+  {
+    /* too big */ 
+    return FALSE;
+  }
   if ((png_pixels = (png_byte *)
-     malloc (row_bytes * height * sizeof (png_byte))) == NULL)
+     malloc ((size_t)row_bytes * (size_t)height * sizeof (png_byte))) == NULL)
     return FALSE;
 
   /* read data from PNM file */
@@ -383,7 +401,8 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
   for (row = 0; row < (int) height; row++)
   {
 #if defined(PNG_WRITE_INVERT_SUPPORTED) || defined(PNG_WRITE_PACK_SUPPORTED)
-    if (packed_bitmap) {
+    if (packed_bitmap)
+    {
       for (i = 0; i < (int) row_bytes; i++)
         /* png supports this format natively so no conversion is needed */
         *pix_ptr++ = get_data (pnm_file, 8);
@@ -504,6 +523,8 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
   if (png_pixels != (unsigned char*) NULL)
     free (png_pixels);
 
+  PNGMINUS_UNUSED(raw); /* Quiet a Coverity defect */
+
   return TRUE;
 } /* end of pnm2png */
 
@@ -520,7 +541,8 @@ void get_token(FILE *pnm_file, char *token)
   do
   {
     ret = fgetc(pnm_file);
-    if (ret == '#') {
+    if (ret == '#')
+    {
       /* the rest of this line is a comment */
       do
       {

libpng-manual.txt

@@ -1,6 +1,6 @@
 libpng-manual.txt - A description on how to use and modify libpng
 
- libpng version 1.7.0beta88 - August 6, 2017
+ libpng version 1.7.0beta90 - August 28, 2017
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2017 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.7.0beta88 - August 6, 2017
+ libpng versions 0.97, January 1998, through 1.7.0beta90 - August 28, 2017
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2015 Glenn Randers-Pehrson
 
@@ -5367,7 +5367,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.7.0beta88 are Y2K compliant.  It is my belief that earlier
+upward through 1.7.0beta90 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has two year fields.  One is a 2-byte unsigned integer

libpng.3

@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "August 6, 2017"
+.TH LIBPNG 3 "August 28, 2017"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta88
+libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta90
 .SH SYNOPSIS
 \fB
 #include <png.h>\fP
@@ -500,7 +500,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng-manual.txt - A description on how to use and modify libpng
 
- libpng version 1.7.0beta88 - August 6, 2017
+ libpng version 1.7.0beta90 - August 28, 2017
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2017 Glenn Randers-Pehrson
@@ -511,7 +511,7 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.7.0beta88 - August 6, 2017
+ libpng versions 0.97, January 1998, through 1.7.0beta90 - August 28, 2017
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2015 Glenn Randers-Pehrson
 
@@ -5867,7 +5867,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.7.0beta88 are Y2K compliant.  It is my belief that earlier
+upward through 1.7.0beta90 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -6026,7 +6026,7 @@ possible without all of you.
 
 Thanks to Frank J. T. Wojcik for helping with the documentation.
 
-Libpng version 1.7.0beta88 - August 6, 2017:
+Libpng version 1.7.0beta90 - August 28, 2017:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).
 
@@ -6051,7 +6051,7 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.0.7, July 1, 2000 through 1.7.0beta88, August 6, 2017 are
+libpng versions 1.0.7, July 1, 2000 through 1.7.0beta90, August 28, 2017 are
 Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -6176,7 +6176,7 @@ files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31).
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-August 6, 2017
+August 28, 2017
 
 .\" end of man page
 

libpngpf.3

@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "August 6, 2017"
+.TH LIBPNGPF 3 "August 28, 2017"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta88
+libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta90
 (private functions)
 .SH SYNOPSIS
 \fB#include \fI"pngpriv.h"

png.5

@@ -1,4 +1,4 @@
-.TH PNG 5 "August 6, 2017"
+.TH PNG 5 "August 28, 2017"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION

png.c

@@ -15,7 +15,7 @@
 #define PNG_SRC_FILE PNG_SRC_FILE_png
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_7_0beta88 Your_png_h_is_not_version_1_7_0beta88;
+typedef png_libpng_version_1_7_0beta90 Your_png_h_is_not_version_1_7_0beta90;
 
 /* Tells libpng that we have already handled the first "num_bytes" bytes
  * of the PNG file signature.  If the PNG data is embedded into another
@@ -705,14 +705,14 @@ png_get_copyright(png_const_structrp png_ptr)
 #else
 #  ifdef __STDC__
    return PNG_STRING_NEWLINE \
-     "libpng version 1.7.0beta88 - August 6, 2017" PNG_STRING_NEWLINE \
+     "libpng version 1.7.0beta90 - August 28, 2017" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson" \
      PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.7.0beta88 - August 6, 2017\
+      return "libpng version 1.7.0beta90 - August 28, 2017\
       Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";

png.h

@@ -1,7 +1,7 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.7.0beta88, August 6, 2017
+ * libpng version 1.7.0beta90, August 28, 2017
  *
  * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -12,7 +12,7 @@
  * Authors and maintainers:
  *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.7.0beta88, August 6, 2017:
+ *   libpng versions 0.97, January 1998, through 1.7.0beta90, August 28, 2017:
  *     Glenn Randers-Pehrson.
  *   See also "Contributing Authors", below.
  */
@@ -25,7 +25,7 @@
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.0.7, July 1, 2000 through 1.7.0beta88, August 6, 2017 are
+ * libpng versions 1.0.7, July 1, 2000 through 1.7.0beta90, August 28, 2017 are
  * Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
  * derived from libpng-1.0.6, and are distributed according to the same
  * disclaimer and license as libpng-1.0.6 with the following individuals
@@ -241,13 +241,13 @@
  * Y2K compliance in libpng:
  * =========================
  *
- *    August 6, 2017
+ *    August 28, 2017
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.7.0beta88 are Y2K compliant.  It is my belief that
+ *    upward through 1.7.0beta90 are Y2K compliant.  It is my belief that
  *    earlier versions were also Y2K compliant.
  *
  *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -309,8 +309,8 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.7.0beta88"
-#define PNG_HEADER_VERSION_STRING " libpng version 1.7.0beta88 - August 6, 2017\n"
+#define PNG_LIBPNG_VER_STRING "1.7.0beta90"
+#define PNG_HEADER_VERSION_STRING " libpng version 1.7.0beta90 - August 28, 2017\n"
 
 #define PNG_LIBPNG_VER_SONUM   17
 #define PNG_LIBPNG_VER_DLLNUM  17
@@ -324,7 +324,7 @@
  * PNG_LIBPNG_VER_STRING, omitting any leading zero:
  */
 
-#define PNG_LIBPNG_VER_BUILD  88
+#define PNG_LIBPNG_VER_BUILD  90
 
 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -584,7 +584,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef char* png_libpng_version_1_7_0beta88;
+typedef char* png_libpng_version_1_7_0beta90;
 
 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
  *

pngconf.h

@@ -1,7 +1,7 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.7.0beta88, August 6, 2017
+ * libpng version 1.7.0beta90, August 28, 2017
  *
  * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)

pngrutil.c

@@ -2649,31 +2649,31 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
 {
    png_alloc_size_t limit = PNG_UINT_31_MAX;
 
-   if (png_ptr->chunk_name != png_IDAT)
-   {
 # ifdef PNG_SET_USER_LIMITS_SUPPORTED
-      if (png_ptr->user_chunk_malloc_max > 0 &&
-          png_ptr->user_chunk_malloc_max < limit)
-         limit = png_ptr->user_chunk_malloc_max;
+   if (png_ptr->user_chunk_malloc_max > 0 &&
+       png_ptr->user_chunk_malloc_max < limit)
+      limit = png_ptr->user_chunk_malloc_max;
 # elif PNG_USER_CHUNK_MALLOC_MAX > 0
-      if (PNG_USER_CHUNK_MALLOC_MAX < limit)
-         limit = PNG_USER_CHUNK_MALLOC_MAX;
+   if (PNG_USER_CHUNK_MALLOC_MAX < limit)
+      limit = PNG_USER_CHUNK_MALLOC_MAX;
 # endif
-   }
-   else
+   if (png_ptr->chunk_name == png_IDAT)
    {
       /* color_type   0 x 2 3 4 x 6 */
       int channels[]={1,0,3,1,2,0,4};
+      png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
       size_t row_factor =
          (png_ptr->width * channels[png_ptr->color_type] *
              (png_ptr->bit_depth > 8? 2: 1)
           + 1 + (png_ptr->interlaced? 6: 0));
       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
-         limit=PNG_UINT_31_MAX;
+         idat_limit=PNG_UINT_31_MAX;
       else
-         limit = png_ptr->height * row_factor;
-      limit += 6 + 5*(limit/32566+1); /* zlib+deflate overhead */
-      limit=limit < PNG_UINT_31_MAX? limit : PNG_UINT_31_MAX;
+         idat_limit = png_ptr->height * row_factor;
+      row_factor = row_factor > 32566? 32566 : row_factor;
+      idat_limit += 6 + 5*(idat_limit/row_factor+1); /* zlib+deflate overhead */
+      idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX;
+      limit = limit < idat_limit? idat_limit : limit;
    }
 
    if (length > limit)
@@ -4432,7 +4432,7 @@ png_read_process_IDAT(png_structrp png_ptr, png_bytep transformed_row,
          impossible("bad row state");
    } /* forever switch */
 
-   PNG_UNUSED(save_row); /* May not be used above */
+   PNG_UNUSED(save_row) /* May not be used above */
 }
 
 void /* PRIVATE */

pngtest.c

@@ -2083,4 +2083,4 @@ main(void)
 #endif
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_7_0beta88 Your_png_h_is_not_version_1_7_0beta88;
+typedef png_libpng_version_1_7_0beta90 Your_png_h_is_not_version_1_7_0beta90;

pngtrans.c

@@ -2697,7 +2697,7 @@ png_do_invert_all(png_transformp *transform, png_transform_controlp tc)
    while (png_upcast(void*,dp) < dp_end)
       *dp++ = ~*sp++;
 
-   PNG_UNUSED(transform);
+   PNG_UNUSED(transform)
 }
 
 static void
@@ -2748,7 +2748,7 @@ png_do_invert_channel(png_transformp *transform, png_transform_controlp tc)
       }
    }
 
-   PNG_UNUSED(transform);
+   PNG_UNUSED(transform)
 }
 
 static void

pngwutil.c

@@ -4894,7 +4894,7 @@ png_write_png_data(png_structrp png_ptr, png_bytep prev_pixels,
    write_unfiltered_rowbits(png_ptr, unfiltered_row, row_bits,
          x == 0 ? PNG_FILTER_VALUE_NONE : PNG_FILTER_VALUE_LAST, flush);
 
-   PNG_UNUSED(prev_pixels);
+   PNG_UNUSED(prev_pixels)
 
    /* Handle end of row: */
    if ((row_info_flags & png_row_end) != 0)

projects/vstudio/README.txt

@@ -1,7 +1,7 @@
 
 VisualStudio instructions
 
-libpng version 1.7.0beta88 - August 6, 2017
+libpng version 1.7.0beta90 - August 28, 2017
 
 Copyright (c) 2010,2013,2015 Glenn Randers-Pehrson
 

projects/vstudio/zlib.props

@@ -2,7 +2,7 @@
 <!--
  * zlib.props - location of zlib source
  *
- * libpng version 1.7.0beta88 - August 6, 2017
+ * libpng version 1.7.0beta90 - August 28, 2017
  *
  * Copyright (c) 2011,2013,2014 Glenn Randers-Pehrson
  *

scripts/README.txt

@@ -1,9 +1,9 @@
 
-Makefiles for  libpng version 1.7.0beta88 - August 6, 2017
+Makefiles for  libpng version 1.7.0beta90 - August 28, 2017
 
 pnglibconf.h.prebuilt       =>  Stores configuration settings
  makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng17.so.17.1.7.0beta88)
+                       (gcc, creates libpng17.so.17.1.7.0beta90)
  makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
  makefile.knr      =>  Archaic UNIX Makefile that converts files with
                        ansi2knr (Requires ansi2knr.c from
@@ -33,12 +33,12 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
  makefile.os2      =>  OS/2 Makefile (gcc and emx, requires libpng.def)
  makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
  makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng17.so.17.1.7.0beta88)
+                       creates libpng17.so.17.1.7.0beta90)
  makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
  makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng17.so.17.1.7.0beta88)
+                       creates libpng17.so.17.1.7.0beta90)
  makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng17.so.17.1.7.0beta88)
+                       creates libpng17.so.17.1.7.0beta90)
  makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
  makefile.sunos    =>  Sun makefile
  makefile.32sunu   =>  Sun Ultra 32-bit makefile

scripts/def.c

@@ -21,7 +21,7 @@ PNG_DFN "OS2 DESCRIPTION "PNG image compression library""
 PNG_DFN "OS2 CODE PRELOAD MOVEABLE DISCARDABLE"
 PNG_DFN ""
 PNG_DFN "EXPORTS"
-PNG_DFN ";Version 1.7.0beta88"
+PNG_DFN ";Version 1.7.0beta90"
 
 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
         PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"

scripts/libpng-config-head.in

@@ -11,7 +11,7 @@
 
 # Modeled after libxml-config.
 
-version=1.7.0beta88
+version=1.7.0beta90
 prefix=""
 libdir=""
 libs=""

scripts/libpng.pc.in

@@ -5,6 +5,6 @@ includedir=@includedir@/libpng17
 
 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.7.0beta88
+Version: 1.7.0beta90
 Libs: -L${libdir} -lpng17
 Cflags: -I${includedir}

scripts/makefile.ne12bsd

@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng17
 
 LIB=	png17
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.7.0beta88
+SHLIB_MINOR=	1.7.0beta90
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c

scripts/makefile.netbsd

@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include
 
 LIB=	png
 SHLIB_MAJOR=	17
-SHLIB_MINOR=	1.7.0beta88
+SHLIB_MINOR=	1.7.0beta90
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c

scripts/makefile.openbsd

@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat
 
 SHLIB_MAJOR=	17
-SHLIB_MINOR=	1.7.0beta88
+SHLIB_MINOR=	1.7.0beta90
 
 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \

scripts/pnglibconf.h.prebuilt

@@ -1,8 +1,8 @@
-/* libpng 1.7.0beta88 STANDARD API DEFINITION */
+/* libpng 1.7.0beta90 STANDARD API DEFINITION */
 
 /* pnglibconf.h - library build configuration */
 
-/* libpng version 1.7.0beta88, August 6, 2017 */
+/* libpng version 1.7.0beta90, August 28, 2017 */
 
 /* Copyright (c) 1998-2016 Glenn Randers-Pehrson */
 

scripts/symbols.def

@@ -1,4 +1,4 @@
-;Version 1.7.0beta88
+;Version 1.7.0beta90
 ;--------------------------------------------------------------
 ; LIBPNG symbol list as a Win32 DEF file
 ; Contains all the symbols that can be exported from libpng