diff options
| author | bsiegert <bsiegert@pkgsrc.org> | 2015-12-04 19:04:58 +0000 |
|---|---|---|
| committer | bsiegert <bsiegert@pkgsrc.org> | 2015-12-04 19:04:58 +0000 |
| commit | 37d6caa033fde4b32bb7f3e5f12feb3951970074 (patch) | |
| tree | 1eca04c9922cde131cd63d14b4f4136c240f046a | |
| parent | 0311a35411f8ad5fcd780e1369cecfca245d404a (diff) | |
| download | pkgsrc-37d6caa033fde4b32bb7f3e5f12feb3951970074.tar.gz | |
Pullup ticket #4866 - requested by wiz
graphics/png: security fix
Revisions pulled up:
- graphics/png/Makefile 1.180
- graphics/png/distinfo 1.125
---
Module Name: pkgsrc
Committed By: wiz
Date: Thu Dec 3 15:17:02 UTC 2015
Modified Files:
pkgsrc/graphics/png: Makefile distinfo
Log Message:
Update to 1.6.20:
Version 1.6.20beta01 [November 20, 2015]
Avoid potential pointer overflow/underflow in png_handle_sPLT() and
png_handle_pCAL() (Bug report by John Regehr).
Version 1.6.20beta02 [November 23, 2015]
Fixed incorrect implementation of png_set_PLTE() that uses png_ptr
not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126
vulnerability.
Version 1.6.20beta03 [November 24, 2015]
Backported tests from libpng-1.7.0beta69.
Version 1.6.20rc01 [November 26, 2015]
Fixed an error in handling of bad zlib CMINFO field in pngfix, found by
American Fuzzy Lop, reported by Brian Carpenter. inflate() doesn't
immediately fault a bad CMINFO field; instead a 'too far back' error
happens later (at least some times). pngfix failed to limit CMINFO to
the allowed values but then assumed that window_bits was in range,
triggering an assert. The bug is mostly harmless; the PNG file cannot
be fixed.
Version 1.6.20rc02 [November 29, 2015]
In libpng 1.6 zlib initialization was changed to use the window size
in the zlib stream, not a fixed value. This causes some invalid images,
where CINFO is too large, to display 'correctly' if the rest of the
data is valid. This provides a workaround for zlib versions where the
error arises (ones that support the API change to use the window size
in the stream).
Version 1.6.20 [December 3, 2015]
No changes. 'correctly' if the rest of the
data is valid. This provides a workaround for zlib versions where the
error arises (ones that support the API change to use the window size
in the stream).
Version 1.6.20 [December 3, 2015]
No changes.
| -rw-r--r-- | graphics/png/Makefile | 4 | ||||
| -rw-r--r-- | graphics/png/distinfo | 10 |
2 files changed, 7 insertions, 7 deletions
diff --git a/graphics/png/Makefile b/graphics/png/Makefile index f7b43cdac54..d4145c385a4 100644 --- a/graphics/png/Makefile +++ b/graphics/png/Makefile @@ -1,6 +1,6 @@ -# $NetBSD: Makefile,v 1.178.2.1 2015/11/20 21:00:28 bsiegert Exp $ +# $NetBSD: Makefile,v 1.178.2.2 2015/12/04 19:04:58 bsiegert Exp $ -DISTNAME= libpng-1.6.19 +DISTNAME= libpng-1.6.20 PKGNAME= ${DISTNAME:S/lib//} CATEGORIES= graphics MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=libpng/} \ diff --git a/graphics/png/distinfo b/graphics/png/distinfo index 97fe8e6c872..1a519aee429 100644 --- a/graphics/png/distinfo +++ b/graphics/png/distinfo @@ -1,6 +1,6 @@ -$NetBSD: distinfo,v 1.122.2.1 2015/11/20 21:00:28 bsiegert Exp $ +$NetBSD: distinfo,v 1.122.2.2 2015/12/04 19:04:58 bsiegert Exp $ -SHA1 (libpng-1.6.19.tar.xz) = 483d72ced11c9258f9d1119105273d9af9ff151c -RMD160 (libpng-1.6.19.tar.xz) = 41242bbef461f0a495310f358df09b19028f2e2e -SHA512 (libpng-1.6.19.tar.xz) = 166377ce4f8abfcae0e76bafbdbe94aebef60b9a12c1820eda392e63a8ba7a9e8d7ef4840d8d4853cd487418edd2c4515a889cd9f830d4223a13315e1db4c3b8 -Size (libpng-1.6.19.tar.xz) = 941280 bytes +SHA1 (libpng-1.6.20.tar.xz) = c4f02051e0b86613076ce390fd15824f3506a148 +RMD160 (libpng-1.6.20.tar.xz) = ee597845605d91de95ded2ec0175ff0a0d701f79 +SHA512 (libpng-1.6.20.tar.xz) = bbf7d9a21a13eb1fd1fa06f9761df72c0b37bd62da7049afe20ec4e63c02c3708aca8a2c2b7f2d7332f3941469b4aca1653cc8423c7fea6de8084201cb8b5f5f +Size (libpng-1.6.20.tar.xz) = 942672 bytes |