Re: libpng-1.6.32beta02 is available

I'd like to push out libpng-1.6.32 fairly soon, because the
eXIf chunk support in 1.6.31 doesn't work and has some
security vulnerabilities (NULL dereference, out-of-bounds
memory reference).  Fortunately, because pngread.c and
pngwrite.c didn't contain calls to png_handle_eXIf or
png_write_eXIf, it's unlikely that any application would
experience those vulnerabilities.

pngtest in libpng-1.6.31 appears to handle the eXIf chunk
correctly, but that's because it is handling it with libpng's
unknown-chunk handler and not with the new eXIf handler.

Glenn


On Tue, Aug 1, 2017 at 9:13 AM, Glenn Randers-Pehrson <[email protected]> wrote:
> libpng-1.6.32beta02 is available from
> https://ftp-osl.osuosl.org/pub/libpng/src/beta/libpng16
> ftp://ftp-osl.osuosl.org/pub/libpng/src/beta/libpng16
> http://libpng.download/src/beta/libpng16
> and from
> http://libpng.sf.net
>
>
> Version 1.6.32beta01 [July 31, 2017]  (Not published as tarball)
>   Avoid possible NULL dereference in png_handle_eXIf when benign_errors
>     are allowed. Avoid leaking the input buffer "eXIf_buf".
>   Eliminated png_ptr->num_exif member from pngstruct.h and added num_exif
>     to arguments for png_get_eXIf() and png_set_eXIf().
>   Added calls to png_handle_eXIf(() in pngread.c and png_write_eXIf() in
>     pngwrite.c, and made various other fixes to png_write_eXIf().
>   Changed name of png_get_eXIF and png_set_eXIf() to png_get_eXIf_1() and
>     png_set_eXIf_1(), respectively, to avoid breaking API compatibility
>     with libpng-1.6.31.
>
> Version 1.6.32beta02 [August 1, 2017]
>   Updated contrib/libtests/pngunknown.c with eXIf chunk.
>
> Glenn

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot