libpng-1.6.10 is available

--===============1829227916286161475==
Content-Type: multipart/alternative; boundary=001a113a7b1e432e3904f3f5506d

--001a113a7b1e432e3904f3f5506d
Content-Type: text/plain; charset=ISO-8859-1

libpng-1.6.10 is available from
ftp://ftp.simplesystems.org/pub/png/src/libpng16
and from
http://libpng.sf.net

Changes since the last public release (1.6.9):
  Backported changes from libpng-1.7.0beta30 and beta31:
  Fixed a large number of instances where PNGCBAPI was omitted from
    function definitions.
  Added pngimage test program for png_read_png() and png_write_png()
    with two new test scripts.
  Removed dependence on !PNG_READ_EXPAND_SUPPORTED for calling
    png_set_packing() in png_read_png().
  Fixed combination of ~alpha with shift. On read invert alpha, processing
    occurred after shift processing, which causes the final values to be
    outside the range that should be produced by the shift. Reversing the
    order on read makes the two transforms work together correctly and
mirrors
    the order used on write.
  Do not read invalid sBIT chunks. Previously libpng only checked sBIT
    values on write, so a malicious PNG writer could therefore cause
    the read code to return an invalid sBIT chunk, which might lead to
    application errors or crashes.  Such chunks are now skipped (with
    chunk_benign_error).
  Make png_read_png() and png_write_png() prototypes in png.h depend
    upon PNG_READ_SUPPORTED and PNG_WRITE_SUPPORTED.
  Support builds with unsupported PNG_TRANSFORM_* values.  All of the
    PNG_TRANSFORM_* values are always defined in png.h and, because they
    are used for both read and write in some cases, it is not reliable
    to #if out ones that are totally unsupported. This change adds error
    detection in png_read_image() and png_write_image() to do a
    png_app_error() if the app requests something that cannot be done
    and it adds corresponding code to pngimage.c to handle such options
    by not attempting to test them.
  Moved redefines of png_error(), png_warning(), png_chunk_error(),
    and png_chunk_warning() from pngpriv.h to png.h to make them visible
    to libpng-calling applications.
  Moved OS dependent code from arm/arm_init.c, to allow the included
    implementation of the ARM NEON discovery function to be set at
    build-time and provide sample implementations from the current code in
the
    contrib/arm-neon subdirectory. The __linux__ code has also been changed
to
    compile and link on Android by using /proc/cpuinfo, and the old linux
code
    is in contrib/arm-neon/linux-auxv.c.  The new code avoids POSIX and
Linux
    dependencies apart from opening /proc/cpuinfo and is C90 compliant.
  Check for info_ptr == NULL early in png_read_end() so we don't need to
    run all the png_handle_*() and depend on them to return if info_ptr ==
NULL.
    This improves the performance of png_read_end(png_ptr, NULL) and makes
    it more robust against future programming errors.
  Check for __has_extension before using it in pngconf.h, to
    support older Clang versions (Jeremy Sequoia).
  Treat CRC error handling with png_set_crc_action(), instead of with
    png_set_benign_errors(), which has been the case since
libpng-1.6.0beta18.
  Use a user warning handler in contrib/gregbook/readpng2.c instead of
default,
    so warnings will be put on stderr even if libpng has CONSOLE_IO
disabled.
  Added png_ptr->process_mode = PNG_READ_IDAT_MODE in  png_push_read_chunk
    after recognizing the IDAT chunk, which avoids an infinite loop while
    reading a datastream whose first IDAT chunk is of zero-length.
    This fixes CERT VU#684412 and CVE-2014-0333.
  Don't recognize known sRGB profiles as sRGB if they have been hacked,
    but don't reject them and don't issue a copyright violation warning.
  Moved some documentation from png.h to libpng.3 and libpng-manual.txt
  Minor editing of contrib/arm-neon/README and contrib/examples/*.c
  Fixed typos in the manual and in scripts/pnglibconf.dfa (CFLAGS ->
CPPFLAGS
    and PNG_USR_CONFIG -> PNG_USER_CONFIG).
  Un-deprecated png_data_freer().

Glenn

--001a113a7b1e432e3904f3f5506d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div>libpng-1.6.10 is available from<br></div><a=
 href=3D"ftp://ftp.simplesystems.org/pub/png/src/libpng16">ftp://ftp.simple=
systems.org/pub/png/src/libpng16</a><br>and from<br></div><a href=3D"http:/=
/libpng.sf.net">http://libpng.sf.net</a><br>
<br>Changes since the last public release (1.6.9):<br>=A0 Backported change=
s from libpng-1.7.0beta30 and beta31:<br>=A0 Fixed a large number of instan=
ces where PNGCBAPI was omitted from<br>=A0=A0=A0 function definitions.<br>=
=A0 Added pngimage test program for png_read_png() and png_write_png()<br>
=A0=A0=A0 with two new test scripts.<br>=A0 Removed dependence on !PNG_READ=
_EXPAND_SUPPORTED for calling<br>=A0=A0=A0 png_set_packing() in png_read_pn=
g().<br>=A0 Fixed combination of ~alpha with shift. On read invert alpha, p=
rocessing<br>
=A0=A0=A0 occurred after shift processing, which causes the final values to=
 be<br>=A0=A0=A0 outside the range that should be produced by the shift. Re=
versing the<br>=A0=A0=A0 order on read makes the two transforms work togeth=
er correctly and mirrors<br>
=A0=A0=A0 the order used on write.<br>=A0 Do not read invalid sBIT chunks. =
Previously libpng only checked sBIT<br>=A0=A0=A0 values on write, so a mali=
cious PNG writer could therefore cause<br>=A0=A0=A0 the read code to return=
 an invalid sBIT chunk, which might lead to<br>
=A0=A0=A0 application errors or crashes.=A0 Such chunks are now skipped (wi=
th<br>=A0=A0=A0 chunk_benign_error).<br>=A0 Make png_read_png() and png_wri=
te_png() prototypes in png.h depend<br>=A0=A0=A0 upon PNG_READ_SUPPORTED an=
d PNG_WRITE_SUPPORTED.<br>
=A0 Support builds with unsupported PNG_TRANSFORM_* values.=A0 All of the<b=
r>=A0=A0=A0 PNG_TRANSFORM_* values are always defined in png.h and, because=
 they<br>=A0=A0=A0 are used for both read and write in some cases, it is no=
t reliable<br>
=A0=A0=A0 to #if out ones that are totally unsupported. This change adds er=
ror<br>=A0=A0=A0 detection in png_read_image() and png_write_image() to do =
a<br>=A0=A0=A0 png_app_error() if the app requests something that cannot be=
 done<br>=A0=A0=A0 and it adds corresponding code to pngimage.c to handle s=
uch options<br>
=A0=A0=A0 by not attempting to test them.<br>=A0 Moved redefines of png_err=
or(), png_warning(), png_chunk_error(),<br>=A0=A0=A0 and png_chunk_warning(=
) from pngpriv.h to png.h to make them visible<br>=A0=A0=A0 to libpng-calli=
ng applications.<br>
=A0 Moved OS dependent code from arm/arm_init.c, to allow the included<br>=
=A0=A0=A0 implementation of the ARM NEON discovery function to be set at<br=
>=A0=A0=A0 build-time and provide sample implementations from the current c=
ode in the<br>
=A0=A0=A0 contrib/arm-neon subdirectory. The __linux__ code has also been c=
hanged to<br>=A0=A0=A0 compile and link on Android by using /proc/cpuinfo, =
and the old linux code<br>=A0=A0=A0 is in contrib/arm-neon/linux-auxv.c.=A0=
 The new code avoids POSIX and Linux<br>
=A0=A0=A0 dependencies apart from opening /proc/cpuinfo and is C90 complian=
t.<br>=A0 Check for info_ptr =3D=3D NULL early in png_read_end() so we don&=
#39;t need to<br>=A0=A0=A0 run all the png_handle_*() and depend on them to=
 return if info_ptr =3D=3D NULL.<br>
=A0=A0=A0 This improves the performance of png_read_end(png_ptr, NULL) and =
makes<br>=A0=A0=A0 it more robust against future programming errors.<br>=A0=
 Check for __has_extension before using it in pngconf.h, to<br>=A0=A0=A0 su=
pport older Clang versions (Jeremy Sequoia).<br>
=A0 Treat CRC error handling with png_set_crc_action(), instead of with<br>=
=A0=A0=A0 png_set_benign_errors(), which has been the case since libpng-1.6=
.0beta18.<br>=A0 Use a user warning handler in contrib/gregbook/readpng2.c =
instead of default,<br>
=A0=A0=A0 so warnings will be put on stderr even if libpng has CONSOLE_IO d=
isabled.<br>=A0 Added png_ptr-&gt;process_mode =3D PNG_READ_IDAT_MODE in=A0=
 png_push_read_chunk<br>=A0=A0=A0 after recognizing the IDAT chunk, which a=
voids an infinite loop while<br>
=A0=A0=A0 reading a datastream whose first IDAT chunk is of zero-length.<br=
>=A0=A0=A0 This fixes CERT VU#684412 and CVE-2014-0333.<br>=A0 Don&#39;t re=
cognize known sRGB profiles as sRGB if they have been hacked,<br>=A0=A0=A0 =
but don&#39;t reject them and don&#39;t issue a copyright violation warning=
.<br>
=A0 Moved some documentation from png.h to libpng.3 and libpng-manual.txt<b=
r>=A0 Minor editing of contrib/arm-neon/README and contrib/examples/*.c<br>=
=A0 Fixed typos in the manual and in scripts/pnglibconf.dfa (CFLAGS -&gt; C=
PPFLAGS<br>
=A0=A0=A0 and PNG_USR_CONFIG -&gt; PNG_USER_CONFIG).<br>=A0 Un-deprecated p=
ng_data_freer().<br><br></div>Glenn<br></div>

--001a113a7b1e432e3904f3f5506d--


--===============1829227916286161475==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce.
With Perforce, you get hassle-free workflows. Merge that actually works. 
Faster operations. Version large binaries.  Built-in WAN optimization and the
freedom to use Git, Perforce or both. Make the move to Perforce.
http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk
--===============1829227916286161475==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
png-mng-announce mailing list
png-mng-announce-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/png-mng-announce

--===============1829227916286161475==--