Re: Missing patch for CVE-2017-12652

On Fri, 16 Apr 2021, Derrick McKee wrote:

> Hi,
>
> I see that commit 347538efbdc21b8df684ebd92d37400b3ce85d55 includes a
> fix for CVE-2017-12652 in pngpread.c. However, that fix appears to be
> missing starting in tag v1.6.32beta10, and no longer appears in the
> source.  Can anyone explain what happened?  Thanks.

This does sound serious and the libpng CHANGES file details 
considerable activity regarding this issue.  In the mean time the 
previous maintainer (Glenn Randers-Pehrson) died and a new maintainer 
(Cosmin Truta) stepped up to take over.  I have not seen any mail on 
this list from Cosmin for quite some time.

I assume that you are looking at Cosmin Truta's repository at 
https://github.com/ctruta/libpng?

Bob
-- 
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt