summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorbsiegert <bsiegert>2015-12-04 19:04:58 +0000
committerbsiegert <bsiegert>2015-12-04 19:04:58 +0000
commitf9e6a7750379f634c54da396ef7e2846d953c30f (patch)
tree1eca04c9922cde131cd63d14b4f4136c240f046a
parent99db57ac8db47e33dd8a2b84e5f2b755cd0d2637 (diff)
downloadpkgsrc-f9e6a7750379f634c54da396ef7e2846d953c30f.tar.gz
Pullup ticket #4866 - requested by wiz
graphics/png: security fix Revisions pulled up: - graphics/png/Makefile 1.180 - graphics/png/distinfo 1.125 --- Module Name: pkgsrc Committed By: wiz Date: Thu Dec 3 15:17:02 UTC 2015 Modified Files: pkgsrc/graphics/png: Makefile distinfo Log Message: Update to 1.6.20: Version 1.6.20beta01 [November 20, 2015] Avoid potential pointer overflow/underflow in png_handle_sPLT() and png_handle_pCAL() (Bug report by John Regehr). Version 1.6.20beta02 [November 23, 2015] Fixed incorrect implementation of png_set_PLTE() that uses png_ptr not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126 vulnerability. Version 1.6.20beta03 [November 24, 2015] Backported tests from libpng-1.7.0beta69. Version 1.6.20rc01 [November 26, 2015] Fixed an error in handling of bad zlib CMINFO field in pngfix, found by American Fuzzy Lop, reported by Brian Carpenter. inflate() doesn't immediately fault a bad CMINFO field; instead a 'too far back' error happens later (at least some times). pngfix failed to limit CMINFO to the allowed values but then assumed that window_bits was in range, triggering an assert. The bug is mostly harmless; the PNG file cannot be fixed. Version 1.6.20rc02 [November 29, 2015] In libpng 1.6 zlib initialization was changed to use the window size in the zlib stream, not a fixed value. This causes some invalid images, where CINFO is too large, to display 'correctly' if the rest of the data is valid. This provides a workaround for zlib versions where the error arises (ones that support the API change to use the window size in the stream). Version 1.6.20 [December 3, 2015] No changes. 'correctly' if the rest of the data is valid. This provides a workaround for zlib versions where the error arises (ones that support the API change to use the window size in the stream). Version 1.6.20 [December 3, 2015] No changes.
-rw-r--r--graphics/png/Makefile4
-rw-r--r--graphics/png/distinfo10
2 files changed, 7 insertions, 7 deletions
diff --git a/graphics/png/Makefile b/graphics/png/Makefile
index f7b43cdac54..d4145c385a4 100644
--- a/graphics/png/Makefile
+++ b/graphics/png/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.178.2.1 2015/11/20 21:00:28 bsiegert Exp $
+# $NetBSD: Makefile,v 1.178.2.2 2015/12/04 19:04:58 bsiegert Exp $
-DISTNAME= libpng-1.6.19
+DISTNAME= libpng-1.6.20
PKGNAME= ${DISTNAME:S/lib//}
CATEGORIES= graphics
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=libpng/} \
diff --git a/graphics/png/distinfo b/graphics/png/distinfo
index 97fe8e6c872..1a519aee429 100644
--- a/graphics/png/distinfo
+++ b/graphics/png/distinfo
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.122.2.1 2015/11/20 21:00:28 bsiegert Exp $
+$NetBSD: distinfo,v 1.122.2.2 2015/12/04 19:04:58 bsiegert Exp $
-SHA1 (libpng-1.6.19.tar.xz) = 483d72ced11c9258f9d1119105273d9af9ff151c
-RMD160 (libpng-1.6.19.tar.xz) = 41242bbef461f0a495310f358df09b19028f2e2e
-SHA512 (libpng-1.6.19.tar.xz) = 166377ce4f8abfcae0e76bafbdbe94aebef60b9a12c1820eda392e63a8ba7a9e8d7ef4840d8d4853cd487418edd2c4515a889cd9f830d4223a13315e1db4c3b8
-Size (libpng-1.6.19.tar.xz) = 941280 bytes
+SHA1 (libpng-1.6.20.tar.xz) = c4f02051e0b86613076ce390fd15824f3506a148
+RMD160 (libpng-1.6.20.tar.xz) = ee597845605d91de95ded2ec0175ff0a0d701f79
+SHA512 (libpng-1.6.20.tar.xz) = bbf7d9a21a13eb1fd1fa06f9761df72c0b37bd62da7049afe20ec4e63c02c3708aca8a2c2b7f2d7332f3941469b4aca1653cc8423c7fea6de8084201cb8b5f5f
+Size (libpng-1.6.20.tar.xz) = 942672 bytes