libpng 1.6.57 released

--===============7507616138454616168==
Content-Type: multipart/alternative; boundary="000000000000d9850c064efbdd50"

--000000000000d9850c064efbdd50
Content-Type: text/plain; charset="UTF-8"

Hello there!

Remember those load-bearing TODO comments from the 1.6.56 announcement? The
ones that said *"Fix this"* for 25 years? Well, fixing them introduced a
new problem. The irony has still not finished writing itself.

CVE-2026-34757 is a medium-severity use-after-free vulnerability in the
chunk setter API. The PLTE and tRNS variants are regressions from the
CVE-2026-33416 fix in 1.6.56. While investigating those, we found an older
variant in the histogram setter that has been present since 1.0.9. The
common pattern: passing a pointer obtained from a getter back into the
corresponding setter causes the setter to free the buffer it's about to
read from. The good news is that this one cannot be triggered by a crafted
PNG alone; it requires the application to call the getter and setter in a
specific sequence.

Many thanks to @Iv4n550 for reporting the regressions.

This release also hardens the append-style setters against a theoretical
variant of the same aliasing pattern, and fixes an integer overflow in the
rowbytes computation (contributed by Mohammad Seet).

The gory details are available at:

- https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645
- https://github.com/pnggroup/libpng/blob/v1.6.57/ANNOUNCE

---

In the good old tradition of file authentication, here are the SHA-2-256
checksums of the published archive files:

libpng-1.6.57.tar.gz
01fdab044cdc575c74a9ef62a4042fbe24fea8bedfe8aa5c89f4467b781bbb60

libpng-1.6.57.tar.xz
d10c20d7171569804cae8dfc13ba6dcd0662c41ed39d43d4d429314aafb10a80

lpng1657.7z
b43b76f1accdcead3e409058e8f5aca42a8ee620ff3fa253b5321fe592451cc7

lpng1657.zip
fa11e382323b1396bb98d0d8800bb3da33995c6bc6a11561a097056114c271dd

---

Sincerely,
Cosmin

--000000000000d9850c064efbdd50
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello there!<br><br>Remember those load-bearing TODO comme=
nts from the 1.6.56 announcement? The ones that said <i>&quot;Fix this&quot=
;</i> for 25 years? Well, fixing them introduced a new problem. The irony h=
as still not finished writing itself.<br><br>CVE-2026-34757 is a medium-sev=
erity use-after-free vulnerability in the chunk setter API. The PLTE and tR=
NS variants are regressions from the CVE-2026-33416 fix in 1.6.56. While in=
vestigating those, we found an older variant in the histogram setter that h=
as been present since 1.0.9. The common pattern: passing a pointer obtained=
 from a getter back into the corresponding setter causes the setter to free=
 the buffer it&#39;s about to read from. The good news is that this one can=
not be triggered by a crafted PNG alone; it requires the application to cal=
l the getter and setter in a specific sequence.<br><br>Many thanks to @Iv4n=
550 for reporting the regressions.<br><br>This release also hardens the app=
end-style setters against a theoretical variant of the same aliasing patter=
n, and fixes an integer overflow in the rowbytes computation (contributed b=
y Mohammad Seet).<br><br>The gory details are available at:<br><br>- <a hre=
f=3D"https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-=
v645">https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7=
-v645</a><br>- <a href=3D"https://github.com/pnggroup/libpng/blob/v1.6.57/A=
NNOUNCE">https://github.com/pnggroup/libpng/blob/v1.6.57/ANNOUNCE</a><br><b=
r>---<br><br>In the good old tradition of file authentication, here are the=
 SHA-2-256 checksums of the published archive files:<br><br>libpng-1.6.57.t=
ar.gz<br>01fdab044cdc575c74a9ef62a4042fbe24fea8bedfe8aa5c89f4467b781bbb60<b=
r><br>libpng-1.6.57.tar.xz<br>d10c20d7171569804cae8dfc13ba6dcd0662c41ed39d4=
3d4d429314aafb10a80<br><br>lpng1657.7z<br>b43b76f1accdcead3e409058e8f5aca42=
a8ee620ff3fa253b5321fe592451cc7<br><br>lpng1657.zip<br>fa11e382323b1396bb98=
d0d8800bb3da33995c6bc6a11561a097056114c271dd<br><br>---<br><br>Sincerely,<b=
r>Cosmin<br><br></div>

--000000000000d9850c064efbdd50--


--===============7507616138454616168==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============7507616138454616168==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
png-mng-announce mailing list
png-mng-announce-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/png-mng-announce

--===============7507616138454616168==--