libpng-1.6.27, 1.5.28, and 1.2.57 are available

--===============2551838654046444641==
Content-Type: multipart/alternative; boundary=001a114f04e0faf1cc0544cd7376

--001a114f04e0faf1cc0544cd7376
Content-Type: text/plain; charset=UTF-8

libpng-1.6.27, 1.5.28, and 1.2.57, plus legacy libpng-1.0.67 and 1.4.20, and
1.7.0beta86 are available from ftp://ftp.simplesystems.org/pub/png/src
and from http://libpng.sf.net

These all fix a potential "NULL dereference" bug that has existed in libpng
since version 0.71 of June 26, 1995.  To be vulnerable, an application
has to load a text chunk into the png structure, then delete all text, then
add another text chunk to the same png structure, which seems to be
an unlikely sequence, but it has happened.

libpng.3 synopses (Eric S. Raymond).
  Fixed undefined behavior in png_push_save_buffer(). Do not call
    memcpy() with a null source, even if count is zero (Leon Scroggins III).
  Fixed a potential null pointer dereference in png_set_text_2() (bug report
    and patch by Patrick Keshishian).

Libpng 1.4.20 - December 29, 2016

  Fix typos in libpng.3 synopses (Eric S. Raymond).
  Fixed undefined behavior in png_push_save_buffer(). Do not call
    memcpy() with a null source, even if count is zero (Leon Scroggins III).
  Fixed a potential null pointer dereference in png_set_text_2() (bug report
    and patch by Patrick Keshishian).

Libpng 1.5.28 - December 29, 2016

  Merged with current libpng16 gregbook, pngvalid.c, pngtest.c, pngminim,
    pngminus
  Added "Common linking failures" section to INSTALL.
  Fixed undefined behavior in png_push_save_buffer(). Do not call
    memcpy() with a null source, even if count is zero (Leon Scroggins III).
  Merge contrib/pngminim/*/makefile with libpng-1.6.24
  Minor editing of INSTALL, (whitespace, added copyright line)
  Removed the use of a macro containing the pre-processor 'defined'
    operator.  It is unclear whether this is valid; a macro that
    "generates" 'defined' is not permitted, but the use of the word
    "generates" within the C90 standard seems to imply more than simple
    substitution of an expression itself containing a well-formed defined
    operation.
  Previously the pngtrans.c code always resulted in an unsigned arithmetic
    overflow. This is well defined but produces errors from clang with the
    option to detect unsigned overflow. As the expression only gets
    evaluated once per row in this version of libpng it is easier just
    to rewrite it.
  The previous version of png.c produced a signed overflow as a result of
    both the "& 0xffff" on the most significant bits of a negative argument;
    this converted (-1) into 65535 which resulted in a subsequent overflow.
    Since signed overflow is undefined in C90 the code has been modified to
    correctly calculate a signed result.  This requires changing the 'hi'
    result parameter to a signed value.
  Fixed a potential null pointer dereference in png_set_text_2() (bug report
    and patch by Patrick Keshishian).

Libpng 1.6.27 - December 29, 2016

  Control ADLER32 checking with new PNG_IGNORE_ADLER32 option.
  Removed the use of a macro containing the pre-processor 'defined'
    operator.  It is unclear whether this is valid; a macro that
    "generates" 'defined' is not permitted, but the use of the word
    "generates" within the C90 standard seems to imply more than simple
    substitution of an expression itself containing a well-formed defined
    operation.
  Added ARM support to CMakeLists.txt (Andreas Franek).
  Fixed a potential null pointer dereference in png_set_text_2() (bug report
    and patch by Patrick Keshishian).

Version 1.7.0beta86 [December 29, 2016]
  Ported CMakeLists.txt from libpng-1.6.27rc01.
  Fixed a potential null pointer dereference in png_set_text_2() (bug report
    and patch by Patrick Keshishian).

Glenn

--001a114f04e0faf1cc0544cd7376
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div><div><div><div><div>libpng-1.6.27, 1.5.28, =
and 1.2.57, plus legacy libpng-1.0.67 and 1.4.20, and<br>1.7.0beta86 are av=
ailable from <a href=3D"ftp://ftp.simplesystems.org/pub/png/src">ftp://ftp.=
simplesystems.org/pub/png/src</a><br></div></div>and from <a href=3D"http:/=
/libpng.sf.net">http://libpng.sf.net</a><br></div><br></div>These all fix a=
 potential &quot;NULL dereference&quot; bug that has existed in libpng<br><=
/div>since version 0.71 of June 26, 1995.=C2=A0 To be vulnerable, an applic=
ation<br></div>has to load a text chunk into the png structure, then delete=
 all text, then<br></div>add another text chunk to the same png structure, =
which seems to be<br>an unlikely sequence, but it has happened.<br><div><di=
v><div><div><div><div><div><br>libpng.3 synopses (Eric S. Raymond).<br>=C2=
=A0 Fixed undefined behavior in png_push_save_buffer(). Do not call<br>=C2=
=A0=C2=A0=C2=A0 memcpy() with a null source, even if count is zero (Leon Sc=
roggins III).<br>=C2=A0 Fixed a potential null pointer dereference in png_s=
et_text_2() (bug report<br>=C2=A0=C2=A0=C2=A0 and patch by Patrick Keshishi=
an).<br><br>Libpng 1.4.20 - December 29, 2016<br><br>=C2=A0 Fix typos in li=
bpng.3 synopses (Eric S. Raymond).<br>=C2=A0 Fixed undefined behavior in pn=
g_push_save_buffer(). Do not call<br>=C2=A0=C2=A0=C2=A0 memcpy() with a nul=
l source, even if count is zero (Leon Scroggins III).<br>=C2=A0 Fixed a pot=
ential null pointer dereference in png_set_text_2() (bug report<br>=C2=A0=
=C2=A0=C2=A0 and patch by Patrick Keshishian).<br><br>Libpng 1.5.28 - Decem=
ber 29, 2016<br><br>=C2=A0 Merged with current libpng16 gregbook, pngvalid.=
c, pngtest.c, pngminim,<br>=C2=A0=C2=A0=C2=A0 pngminus<br>=C2=A0 Added &quo=
t;Common linking failures&quot; section to INSTALL.<br>=C2=A0 Fixed undefin=
ed behavior in png_push_save_buffer(). Do not call<br>=C2=A0=C2=A0=C2=A0 me=
mcpy() with a null source, even if count is zero (Leon Scroggins III).<br>=
=C2=A0 Merge contrib/pngminim/*/makefile with libpng-1.6.24<br>=C2=A0 Minor=
 editing of INSTALL, (whitespace, added copyright line)<br>=C2=A0 Removed t=
he use of a macro containing the pre-processor &#39;defined&#39;<br>=C2=A0=
=C2=A0=C2=A0 operator.=C2=A0 It is unclear whether this is valid; a macro t=
hat<br>=C2=A0=C2=A0=C2=A0 &quot;generates&quot; &#39;defined&#39; is not pe=
rmitted, but the use of the word<br>=C2=A0=C2=A0=C2=A0 &quot;generates&quot=
; within the C90 standard seems to imply more than simple<br>=C2=A0=C2=A0=
=C2=A0 substitution of an expression itself containing a well-formed define=
d<br>=C2=A0=C2=A0=C2=A0 operation.<br>=C2=A0 Previously the pngtrans.c code=
 always resulted in an unsigned arithmetic<br>=C2=A0=C2=A0=C2=A0 overflow. =
This is well defined but produces errors from clang with the<br>=C2=A0=C2=
=A0=C2=A0 option to detect unsigned overflow. As the expression only gets<b=
r>=C2=A0=C2=A0=C2=A0 evaluated once per row in this version of libpng it is=
 easier just<br>=C2=A0=C2=A0=C2=A0 to rewrite it.<br>=C2=A0 The previous ve=
rsion of png.c produced a signed overflow as a result of<br>=C2=A0=C2=A0=C2=
=A0 both the &quot;&amp; 0xffff&quot; on the most significant bits of a neg=
ative argument;<br>=C2=A0=C2=A0=C2=A0 this converted (-1) into 65535 which =
resulted in a subsequent overflow.<br>=C2=A0=C2=A0=C2=A0 Since signed overf=
low is undefined in C90 the code has been modified to<br>=C2=A0=C2=A0=C2=A0=
 correctly calculate a signed result.=C2=A0 This requires changing the &#39=
;hi&#39;<br>=C2=A0=C2=A0=C2=A0 result parameter to a signed value.<br>=C2=
=A0 Fixed a potential null pointer dereference in png_set_text_2() (bug rep=
ort<br>=C2=A0=C2=A0=C2=A0 and patch by Patrick Keshishian).<br><br>Libpng 1=
.6.27 - December 29, 2016<br><br>=C2=A0 Control ADLER32 checking with new P=
NG_IGNORE_ADLER32 option.<br>=C2=A0 Removed the use of a macro containing t=
he pre-processor &#39;defined&#39;<br>=C2=A0=C2=A0=C2=A0 operator.=C2=A0 It=
 is unclear whether this is valid; a macro that<br>=C2=A0=C2=A0=C2=A0 &quot=
;generates&quot; &#39;defined&#39; is not permitted, but the use of the wor=
d<br>=C2=A0=C2=A0=C2=A0 &quot;generates&quot; within the C90 standard seems=
 to imply more than simple<br>=C2=A0=C2=A0=C2=A0 substitution of an express=
ion itself containing a well-formed defined<br>=C2=A0=C2=A0=C2=A0 operation=
.<br>=C2=A0 Added ARM support to CMakeLists.txt (Andreas Franek).<br>=C2=A0=
 Fixed a potential null pointer dereference in png_set_text_2() (bug report=
<br>=C2=A0=C2=A0=C2=A0 and patch by Patrick Keshishian).<br><br>Version 1.7=
.0beta86 [December 29, 2016]<br>=C2=A0 Ported CMakeLists.txt from libpng-1.=
6.27rc01.<br>=C2=A0 Fixed a potential null pointer dereference in png_set_t=
ext_2() (bug report<br>=C2=A0=C2=A0=C2=A0 and patch by Patrick Keshishian).=
<br><br></div><div>Glenn<br></div><div><br></div></div></div></div></div></=
div></div></div>

--001a114f04e0faf1cc0544cd7376--


--===============2551838654046444641==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
--===============2551838654046444641==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
png-mng-announce mailing list
png-mng-announce-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/png-mng-announce

--===============2551838654046444641==--