- Update from version 1.6.37 to 1.6.39
- Update of rootfile
- Changelog
Version 1.6.39 [November 20, 2022]
Changed the error handler of oversized chunks (i.e. larger than
PNG_USER_CHUNK_MALLOC_MAX) from png_chunk_error to png_benign_error.
Fixed a buffer overflow error in contrib/tools/pngfix.
Fixed a memory leak (CVE-2019-6129) in contrib/tools/pngcp.
Disabled the ARM Neon optimizations by default in the CMake file,
following the default behavior of the configure script.
Allowed configure.ac to work with the trunk version of autoconf.
Removed the support for "install" targets from the legacy makefiles;
removed the obsolete makefile.cegcc.
Cleaned up the code and updated the internal documentation.
Version 1.6.38 [September 14, 2022]
Added configurations and scripts for continuous integration.
Fixed various errors in the handling of tRNS, hIST and eXIf.
Implemented many stability improvements across all platforms.
Updated the internal documentation.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
These all fix a potential "NULL dereference" bug that has existed in libpng
since version 0.71 of June 26, 1995. To be vulnerable, an application
has to load a text chunk into the png structure, then delete all text, then
add another text chunk to the same png structure, which seems to be
an unlikely sequence, but it has happened.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
