Mirrors_UI_SDK/fltk
1
0
Fork 0
mirror of https://github.com/fltk/fltk.git synced 2026-10-02 04:22:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update bundled PNG library to version 1.6.58 dated 15-Apr-2026.

Browse Source
This commit is contained in:
ManoloFLTK
2026-07-07 17:33:17 +02:00
parent 1027f1dfc7
commit 45a7b5616c
23 changed files with 381 additions and 263 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/src/bundled-libs.dox
+1 -1
View File
@@ -28,7 +28,7 @@ Current versions of bundled libraries (as of Jul 7, 2026):
--------------------------------------------------------------------------
jpeg jpeg-10 2026-01-26 1.5.0
nanosvg 7aeda550a8 [1] 2023-12-02 1.4.0
png libpng-1.6.54 2026-01-12 1.5.0
png libpng-1.6.58 2026-04-15 1.5.0
zlib zlib-1.3.2 2026-02-17 1.5.0
libdecor c4540b4a [2] 2025-08-15 1.5.0
--------------------------------------------------------------------------
png/ANNOUNCE
+13 -15
View File
@@ -1,5 +1,5 @@
libpng 1.6.54 - January 12, 2026
================================
libpng 1.6.58 - April 15, 2026
==============================
This is a public release of libpng, intended for use in production code.
@@ -9,10 +9,10 @@ Files available for download
Source files:
* libpng-1.6.54.tar.xz (LZMA-compressed, recommended)
* libpng-1.6.54.tar.gz (deflate-compressed)
* lpng1654.7z (LZMA-compressed)
* lpng1654.zip (deflate-compressed)
* libpng-1.6.58.tar.xz (LZMA-compressed, recommended)
* libpng-1.6.58.tar.gz (deflate-compressed)
* lpng1658.7z (LZMA-compressed)
* lpng1658.zip (deflate-compressed)
Other information:
@@ -22,18 +22,16 @@ Other information:
* TRADEMARK.md
Changes from version 1.6.53 to version 1.6.54
Changes from version 1.6.57 to version 1.6.58
---------------------------------------------
* Fixed CVE-2026-22695 (medium severity):
Heap buffer over-read in `png_image_read_direct_scaled.
(Reported and fixed by Petr Simecek.)
* Fixed CVE-2026-22801 (medium severity):
Integer truncation causing heap buffer over-read in `png_image_write_*`.
* Implemented various improvements in oss-fuzz.
(Contributed by Philippe Antoine.)
* Fixed a regression introduced in version 1.6.56 that caused `png_get_PLTE`
to return stale palette data after applying gamma and background transforms
in-place.
(Reported by ralfjunker <ralfjunker@users.noreply.github.com>.)
Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
Subscription is required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-implement
<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
to subscribe.
png/CHANGES
+58 -3
View File
@@ -5988,7 +5988,7 @@ Version 1.6.32rc01 [August 18, 2017]
Version 1.6.32rc02 [August 22, 2017]
Added contrib/oss-fuzz directory which contains files used by the oss-fuzz
project (https://github.com/google/oss-fuzz/tree/master/projects/libpng).
project <https://github.com/google/oss-fuzz/tree/master/projects/libpng>.
Version 1.6.32 [August 24, 2017]
No changes.
@@ -6323,15 +6323,70 @@ Version 1.6.53 [December 5, 2025]
Version 1.6.54 [January 12, 2026]
Fixed CVE-2026-22695 (medium severity):
Heap buffer over-read in `png_image_read_direct_scaled.
Heap buffer over-read in `png_image_read_direct_scaled`.
(Reported and fixed by Petr Simecek.)
Fixed CVE-2026-22801 (medium severity):
Integer truncation causing heap buffer over-read in `png_image_write_*`.
Implemented various improvements in oss-fuzz.
(Contributed by Philippe Antoine.)
Version 1.6.55 [February 9, 2026]
Fixed CVE-2026-25646 (high severity):
Heap buffer overflow in `png_set_quantize`.
(Reported and fixed by Joshua Inscoe.)
Resolved an oss-fuzz build issue involving nalloc.
(Contributed by Philippe Antoine.)
Version 1.6.56 [March 25, 2026]
Fixed CVE-2026-33416 (high severity):
Use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`.
(Reported by Halil Oktay and Ryo Shimada;
fixed by Halil Oktay and Cosmin Truta.)
Fixed CVE-2026-33636 (high severity):
Out-of-bounds read/write in the palette expansion on ARM Neon.
(Reported by Taegu Ha; fixed by Taegu Ha and Cosmin Truta.)
Fixed uninitialized reads beyond `num_trans` in `trans_alpha` buffers.
(Contributed by Halil Oktay.)
Fixed stale `info_ptr->palette` after in-place gamma and background
transforms.
Fixed wrong channel indices in `png_image_read_and_map` RGB_ALPHA path.
(Contributed by Yuelin Wang.)
Fixed wrong background color in colormap read.
(Contributed by Yuelin Wang.)
Fixed dead loop in sPLT write.
(Contributed by Yuelin Wang.)
Added missing null pointer checks in four public API functions.
(Contributed by Yuelin Wang.)
Validated shift bit depths in `png_set_shift` to prevent infinite loop.
(Contributed by Yuelin Wang.)
Avoided undefined behavior in library and tests.
Deprecated the hardly-ever-tested POINTER_INDEXING config option.
Added negative-stride test coverage for the simplified API.
Fixed memory leaks and API misuse in oss-fuzz.
(Contributed by Owen Sanzas.)
Implemented various fixes and improvements in oss-fuzz.
(Contributed by Bob Friesenhahn and Philippe Antoine.)
Performed various refactorings and cleanups.
Version 1.6.57 [April 8, 2026]
Fixed CVE-2026-34757 (medium severity):
Use-after-free in `png_set_PLTE`, `png_set_tRNS` and `png_set_hIST`
leading to corrupted chunk data and potential heap information disclosure.
Also hardened the append-style setters (`png_set_text`, `png_set_sPLT`,
`png_set_unknown_chunks`) against a theoretical variant of the same
aliasing pattern.
(Reported by Iv4n <Iv4n550@users.noreply.github.com>.)
Fixed integer overflow in rowbytes computation in read transforms.
(Contributed by Mohammad Seet.)
Version 1.6.58 [April 15, 2026]
Fixed a regression introduced in version 1.6.56 that caused `png_get_PLTE`
to return stale palette data after applying gamma and background transforms
in-place.
(Reported by ralfjunker <ralfjunker@users.noreply.github.com>.)
Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
Subscription is required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-implement
<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
to subscribe.
png/README
+7 -7
View File
@@ -1,4 +1,4 @@
README for libpng version 1.6.54
README for libpng version 1.6.58
================================
See the note about version numbers near the top of `png.h`.
@@ -24,14 +24,14 @@ for more things than just PNG files. You can use zlib as a drop-in
replacement for `fread()` and `fwrite()`, if you are so inclined.
zlib should be available at the same place that libpng is, or at
https://zlib.net .
<https://zlib.net>.
You may also want a copy of the PNG specification. It is available
as an RFC, a W3C Recommendation, and an ISO/IEC Standard. You can find
these at http://www.libpng.org/pub/png/pngdocs.html .
these at <http://www.libpng.org/pub/png/pngdocs.html>.
This code is currently being archived at https://libpng.sourceforge.io
in the download area, and at http://libpng.download/src .
This code is currently being archived at <https://libpng.sourceforge.io>
in the download area, and at <http://libpng.download/src>.
This release, based in a large way on Glenn's, Guy's and Andreas'
earlier work, was created and will be supported by myself and the PNG
@@ -39,12 +39,12 @@ development group.
Send comments, corrections and commendations to `png-mng-implement`
at `lists.sourceforge.net`. (Subscription is required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-implement
<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
to subscribe.)
Send general questions about the PNG specification to `png-mng-misc`
at `lists.sourceforge.net`. (Subscription is required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-misc
<https://lists.sourceforge.net/lists/listinfo/png-mng-misc>
to subscribe.)
Historical notes
png/TODO
+1 -1
View File
@@ -1,5 +1,5 @@
TODO list for libpng
--------------------
====================
* Fix all defects (duh!)
* cHRM transformation.
png/arm/palette_neon_intrinsics.c
+29 -32
View File
@@ -1,6 +1,6 @@
/* palette_neon_intrinsics.c - NEON optimised palette expansion functions
*
* Copyright (c) 2018-2019 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 2017-2018 Arm Holdings. All rights reserved.
* Written by Richard Townsend <Richard.Townsend@arm.com>, February 2017.
*
@@ -48,12 +48,12 @@ png_riffle_palette_neon(png_structrp png_ptr)
w.val[0] = v.val[0];
w.val[1] = v.val[1];
w.val[2] = v.val[2];
vst4q_u8(riffled_palette + (i << 2), w);
vst4q_u8(riffled_palette + i * 4, w);
}
/* Fix up the missing transparency values. */
for (i = 0; i < num_trans; i++)
riffled_palette[(i << 2) + 3] = trans_alpha[i];
riffled_palette[i * 4 + 3] = trans_alpha[i];
}
/* Expands a palettized row into RGBA8. */
@@ -77,27 +77,26 @@ png_do_expand_palette_rgba8_neon(png_structrp png_ptr, png_row_infop row_info,
* The NEON part writes forward from a given position, so we have
* to seek this back by 4 pixels x 4 bytes.
*/
*ddp = *ddp - ((pixels_per_chunk * sizeof(png_uint_32)) - 1);
*ddp = *ddp - (pixels_per_chunk * 4 - 1);
for (i = 0; i < row_width; i += pixels_per_chunk)
for (i = 0; i + pixels_per_chunk <= row_width; i += pixels_per_chunk)
{
uint32x4_t cur;
png_bytep sp = *ssp - i, dp = *ddp - (i << 2);
png_bytep sp = *ssp - i, dp = *ddp - i * 4;
cur = vld1q_dup_u32 (riffled_palette + *(sp - 3));
cur = vld1q_lane_u32(riffled_palette + *(sp - 2), cur, 1);
cur = vld1q_lane_u32(riffled_palette + *(sp - 1), cur, 2);
cur = vld1q_lane_u32(riffled_palette + *(sp - 0), cur, 3);
vst1q_u32((void *)dp, cur);
}
if (i != row_width)
{
/* Remove the amount that wasn't processed. */
i -= pixels_per_chunk;
}
/* Decrement output pointers. */
/* Undo the pre-adjustment of *ddp before the pointer handoff,
* so the scalar fallback in pngrtran.c receives a dp that points
* to the correct position.
*/
*ddp = *ddp + (pixels_per_chunk * 4 - 1);
*ssp = *ssp - i;
*ddp = *ddp - (i << 2);
*ddp = *ddp - i * 4;
return i;
}
@@ -118,32 +117,30 @@ png_do_expand_palette_rgb8_neon(png_structrp png_ptr, png_row_infop row_info,
return 0;
/* Seeking this back by 8 pixels x 3 bytes. */
*ddp = *ddp - ((pixels_per_chunk * sizeof(png_color)) - 1);
*ddp = *ddp - (pixels_per_chunk * 3 - 1);
for (i = 0; i < row_width; i += pixels_per_chunk)
for (i = 0; i + pixels_per_chunk <= row_width; i += pixels_per_chunk)
{
uint8x8x3_t cur;
png_bytep sp = *ssp - i, dp = *ddp - ((i << 1) + i);
cur = vld3_dup_u8(palette + sizeof(png_color) * (*(sp - 7)));
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 6)), cur, 1);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 5)), cur, 2);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 4)), cur, 3);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 3)), cur, 4);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 2)), cur, 5);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 1)), cur, 6);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 0)), cur, 7);
png_bytep sp = *ssp - i, dp = *ddp - i * 3;
cur = vld3_dup_u8(palette + *(sp - 7) * 3);
cur = vld3_lane_u8(palette + *(sp - 6) * 3, cur, 1);
cur = vld3_lane_u8(palette + *(sp - 5) * 3, cur, 2);
cur = vld3_lane_u8(palette + *(sp - 4) * 3, cur, 3);
cur = vld3_lane_u8(palette + *(sp - 3) * 3, cur, 4);
cur = vld3_lane_u8(palette + *(sp - 2) * 3, cur, 5);
cur = vld3_lane_u8(palette + *(sp - 1) * 3, cur, 6);
cur = vld3_lane_u8(palette + *(sp - 0) * 3, cur, 7);
vst3_u8((void *)dp, cur);
}
if (i != row_width)
{
/* Remove the amount that wasn't processed. */
i -= pixels_per_chunk;
}
/* Decrement output pointers. */
/* Undo the pre-adjustment of *ddp before the pointer handoff,
* so the scalar fallback in pngrtran.c receives a dp that points
* to the correct position.
*/
*ddp = *ddp + (pixels_per_chunk * 3 - 1);
*ssp = *ssp - i;
*ddp = *ddp - ((i << 1) + i);
*ddp = *ddp - i * 3;
return i;
}
png/libpng-manual.txt
+6 -6
View File
@@ -1,6 +1,6 @@
libpng-manual.txt - A description on how to use and modify libpng
Copyright (c) 2018-2025 Cosmin Truta
Copyright (c) 2018-2026 Cosmin Truta
Copyright (c) 1998-2018 Glenn Randers-Pehrson
This document is released under the libpng license.
@@ -9,7 +9,7 @@ libpng-manual.txt - A description on how to use and modify libpng
Based on:
libpng version 1.6.36, December 2018, through 1.6.54 - January 2026
libpng version 1.6.36, December 2018, through 1.6.58 - April 2026
Updated and distributed by Cosmin Truta
Copyright (c) 2018-2026 Cosmin Truta
@@ -2318,7 +2318,7 @@ libpng provides two macros to help you in 1.5 and later versions:
png_uint_32 height = PNG_PASS_ROWS(image_height, pass_number);
Respectively these tell you the width and height of the sub-image
corresponding to the numbered pass. 'pass' is in in the range 0 to 6 -
corresponding to the numbered pass. 'pass' is in the range 0 to 6 -
this can be confusing because the specification refers to the same passes
as 1 to 7! Be careful, you must check both the width and height before
calling png_read_rows() and not call it for that pass if either is zero.
@@ -2457,7 +2457,7 @@ point to libpng-allocated storage with the following function:
This function may be safely called when the relevant storage has
already been freed, or has not yet been allocated, or was allocated
by the user and not by libpng, and will in those cases do nothing.
by the user and not by libpng, and will in those cases do nothing.
The "seq" parameter is ignored if only one item of the selected data
type, such as PLTE, is allowed. If "seq" is not -1, and multiple items
are allowed for the data type identified in the mask, such as text or
@@ -3292,7 +3292,7 @@ disclaimer until after, so viewers working over modem connections
don't have to wait for the disclaimer to go over the modem before
they start seeing the image. Finally, keywords should be full
words, not abbreviations. Keywords and text are in the ISO 8859-1
(Latin-1) character set (a superset of regular ASCII) and can not
(Latin-1) character set (a superset of regular ASCII) and cannot
contain NUL characters, and should not contain control or other
unprintable characters. To make the comments widely readable, stick
with basic ASCII, and avoid machine specific character set extensions
@@ -3694,7 +3694,7 @@ point to libpng-allocated storage with the following function:
This function may be safely called when the relevant storage has
already been freed, or has not yet been allocated, or was allocated
by the user and not by libpng, and will in those cases do nothing.
by the user and not by libpng, and will in those cases do nothing.
The "seq" parameter is ignored if only one item of the selected data
type, such as PLTE, is allowed. If "seq" is not -1, and multiple items
are allowed for the data type identified in the mask, such as text or
png/libpng.3
+8 -8
View File
@@ -1,6 +1,6 @@
.TH LIBPNG 3 "January 12, 2026"
.TH LIBPNG 3 "April 15, 2026"
.SH NAME
libpng \- Portable Network Graphics (PNG) Reference Library 1.6.54
libpng \- Portable Network Graphics (PNG) Reference Library 1.6.58
.SH SYNOPSIS
\fB#include <png.h>\fP
@@ -519,7 +519,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
.SH LIBPNG.TXT
libpng-manual.txt - A description on how to use and modify libpng
Copyright (c) 2018-2025 Cosmin Truta
Copyright (c) 2018-2026 Cosmin Truta
Copyright (c) 1998-2018 Glenn Randers-Pehrson
This document is released under the libpng license.
@@ -528,7 +528,7 @@ libpng-manual.txt - A description on how to use and modify libpng
Based on:
libpng version 1.6.36, December 2018, through 1.6.54 - January 2026
libpng version 1.6.36, December 2018, through 1.6.58 - April 2026
Updated and distributed by Cosmin Truta
Copyright (c) 2018-2026 Cosmin Truta
@@ -2837,7 +2837,7 @@ libpng provides two macros to help you in 1.5 and later versions:
png_uint_32 height = PNG_PASS_ROWS(image_height, pass_number);
Respectively these tell you the width and height of the sub-image
corresponding to the numbered pass. 'pass' is in in the range 0 to 6 -
corresponding to the numbered pass. 'pass' is in the range 0 to 6 -
this can be confusing because the specification refers to the same passes
as 1 to 7! Be careful, you must check both the width and height before
calling png_read_rows() and not call it for that pass if either is zero.
@@ -2976,7 +2976,7 @@ point to libpng-allocated storage with the following function:
This function may be safely called when the relevant storage has
already been freed, or has not yet been allocated, or was allocated
by the user and not by libpng, and will in those cases do nothing.
by the user and not by libpng, and will in those cases do nothing.
The "seq" parameter is ignored if only one item of the selected data
type, such as PLTE, is allowed. If "seq" is not \-1, and multiple items
are allowed for the data type identified in the mask, such as text or
@@ -3811,7 +3811,7 @@ disclaimer until after, so viewers working over modem connections
don't have to wait for the disclaimer to go over the modem before
they start seeing the image. Finally, keywords should be full
words, not abbreviations. Keywords and text are in the ISO 8859-1
(Latin-1) character set (a superset of regular ASCII) and can not
(Latin-1) character set (a superset of regular ASCII) and cannot
contain NUL characters, and should not contain control or other
unprintable characters. To make the comments widely readable, stick
with basic ASCII, and avoid machine specific character set extensions
@@ -4213,7 +4213,7 @@ point to libpng-allocated storage with the following function:
This function may be safely called when the relevant storage has
already been freed, or has not yet been allocated, or was allocated
by the user and not by libpng, and will in those cases do nothing.
by the user and not by libpng, and will in those cases do nothing.
The "seq" parameter is ignored if only one item of the selected data
type, such as PLTE, is allowed. If "seq" is not \-1, and multiple items
are allowed for the data type identified in the mask, such as text or
png/libpngpf.3
+2 -2
View File
@@ -1,6 +1,6 @@
.TH LIBPNGPF 3 "January 12, 2026"
.TH LIBPNGPF 3 "April 15, 2026"
.SH NAME
libpng \- Portable Network Graphics (PNG) Reference Library 1.6.54
libpng \- Portable Network Graphics (PNG) Reference Library 1.6.58
.SH SYNOPSIS
\fB#include "pngpriv.h"\fP
png/png.5
+1 -1
View File
@@ -1,4 +1,4 @@
.TH PNG 5 "January 12, 2026"
.TH PNG 5 "April 15, 2026"
.SH NAME
png \- Portable Network Graphics (PNG) format
png/png.c
+8 -8
View File
@@ -13,7 +13,7 @@
#include "pngpriv.h"
/* Generate a compiler error if there is an old png.h in the search path. */
typedef png_libpng_version_1_6_54 Your_png_h_is_not_version_1_6_54;
typedef png_libpng_version_1_6_58 Your_png_h_is_not_version_1_6_58;
/* Sanity check the chunks definitions - PNG_KNOWN_CHUNKS from pngpriv.h and the
* corresponding macro definitions. This causes a compile time failure if
@@ -820,7 +820,7 @@ png_get_copyright(png_const_structrp png_ptr)
return PNG_STRING_COPYRIGHT
#else
return PNG_STRING_NEWLINE \
"libpng version 1.6.54" PNG_STRING_NEWLINE \
"libpng version 1.6.58" PNG_STRING_NEWLINE \
"Copyright (c) 2018-2026 Cosmin Truta" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson" \
PNG_STRING_NEWLINE \
@@ -1170,7 +1170,7 @@ png_xy_from_XYZ(png_xy *xy, const png_XYZ *XYZ)
return 1;
/* The reference white is simply the sum of the end-point (X,Y,Z) vectors so
* the fillowing calculates (X+Y+Z) of the reference white (media white,
* the following calculates (X+Y+Z) of the reference white (media white,
* encoding white) itself:
*/
d = dblue;
@@ -1215,9 +1215,9 @@ png_XYZ_from_xy(png_XYZ *XYZ, const png_xy *xy)
* (-0.0770) because the PNG spec itself requires the xy values to be
* unsigned. whitey is also required to be 5 or more to avoid overflow.
*
* Instead the upper limits have been relaxed to accomodate ACES AP1 where
* Instead the upper limits have been relaxed to accommodate ACES AP1 where
* redz ends up as -600 (-0.006). ProPhotoRGB was already "in range."
* The new limit accomodates the AP0 and AP1 ranges for z but not AP0 redy.
* The new limit accommodates the AP0 and AP1 ranges for z but not AP0 redy.
*/
const png_fixed_point fpLimit = PNG_FP_1+(PNG_FP_1/10);
if (xy->redx < 0 || xy->redx > fpLimit) return 1;
@@ -1328,7 +1328,7 @@ png_XYZ_from_xy(png_XYZ *XYZ, const png_xy *xy)
* red-scale + green-scale + blue-scale = 1/white-y = white-scale
*
* So now we have a Cramer's rule solution where the determinants are just
* 3x3 - far more tractible. Unfortunately 3x3 determinants still involve
* 3x3 - far more tractable. Unfortunately 3x3 determinants still involve
* multiplication of three coefficients so we can't guarantee to avoid
* overflow in the libpng fixed point representation. Using Cramer's rule in
* floating point is probably a good choice here, but it's not an option for
@@ -1697,7 +1697,7 @@ png_icc_check_header(png_const_structrp png_ptr, png_const_charp name,
* into R, G and B channels.
*
* Previously it was suggested that an RGB profile on grayscale data could be
* handled. However it it is clear that using an RGB profile in this context
* handled. However it is clear that using an RGB profile in this context
* must be an error - there is no specification of what it means. Thus it is
* almost certainly more correct to ignore the profile.
*/
@@ -2915,7 +2915,7 @@ png_gamma_significant(png_fixed_point gamma_val)
*
* 2.2/(2+51/256) == 1.00035524
*
* I.e. vanishly small (<4E-4) but still detectable in 16-bit linear (+/-
* I.e. vanishingly small (<4E-4) but still detectable in 16-bit linear (+/-
* 23). Note that the Adobe choice seems to be something intended to give an
* exact number with 8 binary fractional digits - it is the closest to 2.2
* that is possible a base 2 .8p representation.
png/png.h
+8 -8
View File
@@ -1,6 +1,6 @@
/* png.h - header file for PNG reference library
*
* libpng version 1.6.54
* libpng version 1.6.58
*
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
@@ -14,7 +14,7 @@
* libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
* libpng versions 0.97, January 1998, through 1.6.35, July 2018:
* Glenn Randers-Pehrson
* libpng versions 1.6.36, December 2018, through 1.6.54, January 2026:
* libpng versions 1.6.36, December 2018, through 1.6.58, April 2026:
* Cosmin Truta
* See also "Contributing Authors", below.
*/
@@ -238,7 +238,7 @@
* ...
* 1.5.30 15 10530 15.so.15.30[.0]
* ...
* 1.6.54 16 10654 16.so.16.54[.0]
* 1.6.58 16 10658 16.so.16.58[.0]
*
* Henceforth the source version will match the shared-library major and
* minor numbers; the shared-library major version number will be used for
@@ -274,7 +274,7 @@
*/
/* Version information for png.h - this should match the version in png.c */
#define PNG_LIBPNG_VER_STRING "1.6.54"
#define PNG_LIBPNG_VER_STRING "1.6.58"
#define PNG_HEADER_VERSION_STRING " libpng version " PNG_LIBPNG_VER_STRING "\n"
/* The versions of shared library builds should stay in sync, going forward */
@@ -285,7 +285,7 @@
/* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
#define PNG_LIBPNG_VER_MAJOR 1
#define PNG_LIBPNG_VER_MINOR 6
#define PNG_LIBPNG_VER_RELEASE 54
#define PNG_LIBPNG_VER_RELEASE 58
/* This should be zero for a public release, or non-zero for a
* development version.
@@ -316,7 +316,7 @@
* From version 1.0.1 it is:
* XXYYZZ, where XX=major, YY=minor, ZZ=release
*/
#define PNG_LIBPNG_VER 10654 /* 1.6.54 */
#define PNG_LIBPNG_VER 10658 /* 1.6.58 */
/* Library configuration: these options cannot be changed after
* the library has been built.
@@ -426,7 +426,7 @@ extern "C" {
/* This triggers a compiler error in png.c, if png.c and png.h
* do not agree upon the version number.
*/
typedef char *png_libpng_version_1_6_54;
typedef char *png_libpng_version_1_6_58;
/* Basic control structions. Read libpng-manual.txt or libpng.3 for more info.
*
@@ -2341,7 +2341,7 @@ PNG_EXPORT(162, int, png_get_text,
#endif
/* Note while png_set_text() will accept a structure whose text,
* language, and translated keywords are NULL pointers, the structure
* language, and translated keywords are NULL pointers, the structure
* returned by png_get_text will always contain regular
* zero-terminated C strings. They might be empty strings but
* they will never be NULL pointers.
png/pngconf.h
+1 -1
View File
@@ -1,6 +1,6 @@
/* pngconf.h - machine-configurable file for libpng
*
* libpng version 1.6.54
* libpng version 1.6.58
*
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2016,2018 Glenn Randers-Pehrson
png/pnglibconf.h
+1 -1
View File
@@ -1,6 +1,6 @@
/* pnglibconf.h - library build configuration */
/* libpng version 1.6.54 */
/* libpng version 1.6.58 */
/* Copyright (c) 2018-2026 Cosmin Truta */
/* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson */
png/pngpriv.h
+2 -2
View File
@@ -957,7 +957,7 @@
*
* At present these index values are not exported (not part of the public API)
* so can be changed at will. For convenience the names are in lexical sort
* order but with the critical chunks at the start in the order of occurence in
* order but with the critical chunks at the start in the order of occurrence in
* a PNG.
*
* PNG_INFO_ values do not exist for every one of these chunk handles; for
@@ -2086,7 +2086,7 @@ PNG_INTERNAL_FUNCTION(void, png_ascii_from_fixed,
* not valid it will be the index of a character in the supposed number.
*
* The format of a number is defined in the PNG extensions specification
* and this API is strictly conformant to that spec, not anyone elses!
* and this API is strictly conformant to that spec, not anyone else's!
*
* The format as a regular expression is:
*
png/pngread.c
+33 -35
View File
@@ -691,7 +691,7 @@ png_read_end(png_structrp png_ptr, png_inforp info_ptr)
png_read_finish_IDAT(png_ptr);
#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
/* Report invalid palette index; added at libng-1.5.10 */
/* Report invalid palette index; added at libpng-1.5.10 */
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
png_ptr->num_palette_max >= png_ptr->num_palette)
png_benign_error(png_ptr, "Read palette index exceeding num_palette");
@@ -779,21 +779,19 @@ png_read_destroy(png_structrp png_ptr)
png_ptr->quantize_index = NULL;
#endif
if ((png_ptr->free_me & PNG_FREE_PLTE) != 0)
{
png_zfree(png_ptr, png_ptr->palette);
png_ptr->palette = NULL;
}
png_ptr->free_me &= ~PNG_FREE_PLTE;
/* png_ptr->palette is always independently allocated (not aliased
* with info_ptr->palette), so free it unconditionally.
*/
png_free(png_ptr, png_ptr->palette);
png_ptr->palette = NULL;
#if defined(PNG_tRNS_SUPPORTED) || \
defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
if ((png_ptr->free_me & PNG_FREE_TRNS) != 0)
{
png_free(png_ptr, png_ptr->trans_alpha);
png_ptr->trans_alpha = NULL;
}
png_ptr->free_me &= ~PNG_FREE_TRNS;
/* png_ptr->trans_alpha is always independently allocated (not aliased
* with info_ptr->trans_alpha), so free it unconditionally.
*/
png_free(png_ptr, png_ptr->trans_alpha);
png_ptr->trans_alpha = NULL;
#endif
inflateEnd(&png_ptr->zstream);
@@ -1256,7 +1254,7 @@ png_image_is_not_sRGB(png_const_structrp png_ptr)
* png_struct::chromaticities always exists since the simplified API
* requires rgb-to-gray. The mDCV, cICP and cHRM chunks may all set it to
* a non-sRGB value, so it needs to be checked but **only** if one of
* those chunks occured in the file.
* those chunks occurred in the file.
*/
/* Highest priority: check to be safe. */
if (png_has_chunk(png_ptr, cICP) || png_has_chunk(png_ptr, mDCV))
@@ -2596,7 +2594,7 @@ png_image_read_colormap(png_voidp argument)
{
r = back_r;
g = back_g;
b = back_g;
b = back_b;
}
/* Compare the newly-created color-map entry with the one the
@@ -2874,9 +2872,9 @@ png_image_read_and_map(png_voidp argument)
{
png_bytep inrow = png_voidcast(png_bytep, display->local_row);
png_bytep outrow = first_row + y * row_step;
png_const_bytep end_row = outrow + width;
png_const_bytep row_end = outrow + width;
/* Read read the libpng data into the temporary buffer. */
/* Read the libpng data into the temporary buffer. */
png_read_row(png_ptr, inrow, NULL);
/* Now process the row according to the processing option, note
@@ -2887,7 +2885,7 @@ png_image_read_and_map(png_voidp argument)
switch (proc)
{
case PNG_CMAP_GA:
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
/* The data is always in the PNG order */
unsigned int gray = *inrow++;
@@ -2916,7 +2914,7 @@ png_image_read_and_map(png_voidp argument)
break;
case PNG_CMAP_TRANS:
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_byte gray = *inrow++;
png_byte alpha = *inrow++;
@@ -2933,7 +2931,7 @@ png_image_read_and_map(png_voidp argument)
break;
case PNG_CMAP_RGB:
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
*outrow = PNG_RGB_INDEX(inrow[0], inrow[1], inrow[2]);
inrow += 3;
@@ -2941,7 +2939,7 @@ png_image_read_and_map(png_voidp argument)
break;
case PNG_CMAP_RGB_ALPHA:
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
unsigned int alpha = inrow[3];
@@ -2978,10 +2976,10 @@ png_image_read_and_map(png_voidp argument)
*/
if (inrow[0] & 0x80) back_i += 9; /* red */
if (inrow[0] & 0x40) back_i += 9;
if (inrow[0] & 0x80) back_i += 3; /* green */
if (inrow[0] & 0x40) back_i += 3;
if (inrow[0] & 0x80) back_i += 1; /* blue */
if (inrow[0] & 0x40) back_i += 1;
if (inrow[1] & 0x80) back_i += 3; /* green */
if (inrow[1] & 0x40) back_i += 3;
if (inrow[2] & 0x80) back_i += 1; /* blue */
if (inrow[2] & 0x40) back_i += 1;
*outrow = (png_byte)back_i;
}
@@ -3248,18 +3246,18 @@ png_image_read_composite(png_voidp argument)
{
png_bytep inrow = png_voidcast(png_bytep, display->local_row);
png_bytep outrow;
png_const_bytep end_row;
png_const_bytep row_end;
/* Read the row, which is packed: */
png_read_row(png_ptr, inrow, NULL);
outrow = png_voidcast(png_bytep, display->first_row);
outrow += y * row_step;
end_row = outrow + width * channels;
row_end = outrow + width * channels;
/* Now do the composition on each pixel in this row. */
outrow += startx;
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_byte alpha = inrow[channels];
@@ -3432,14 +3430,14 @@ png_image_read_background(png_voidp argument)
png_bytep inrow = png_voidcast(png_bytep,
display->local_row);
png_bytep outrow = first_row + y * row_step;
png_const_bytep end_row = outrow + width;
png_const_bytep row_end = outrow + width;
/* Read the row, which is packed: */
png_read_row(png_ptr, inrow, NULL);
/* Now do the composition on each pixel in this row. */
outrow += startx;
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_byte alpha = inrow[1];
@@ -3477,14 +3475,14 @@ png_image_read_background(png_voidp argument)
png_bytep inrow = png_voidcast(png_bytep,
display->local_row);
png_bytep outrow = first_row + y * row_step;
png_const_bytep end_row = outrow + width;
png_const_bytep row_end = outrow + width;
/* Read the row, which is packed: */
png_read_row(png_ptr, inrow, NULL);
/* Now do the composition on each pixel in this row. */
outrow += startx;
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_byte alpha = inrow[1];
@@ -3567,7 +3565,7 @@ png_image_read_background(png_voidp argument)
{
png_const_uint_16p inrow;
png_uint_16p outrow = first_row + y * row_step;
png_uint_16p end_row = outrow + width * outchannels;
png_uint_16p row_end = outrow + width * outchannels;
/* Read the row, which is packed: */
png_read_row(png_ptr, png_voidcast(png_bytep,
@@ -3577,7 +3575,7 @@ png_image_read_background(png_voidp argument)
/* Now do the pre-multiplication on each pixel in this row.
*/
outrow += startx;
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_uint_32 component = inrow[0];
png_uint_16 alpha = inrow[1];
@@ -4113,7 +4111,7 @@ png_image_finish_read(png_imagep image, png_const_colorp background,
row_stride = (png_int_32)/*SAFE*/png_row_stride;
if (row_stride < 0)
check = (png_uint_32)(-row_stride);
check = -(png_uint_32)row_stride;
else
check = (png_uint_32)row_stride;
png/pngrtran.c
+40 -20
View File
@@ -1,6 +1,6 @@
/* pngrtran.c - transforms the data in a row for PNG readers
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -230,7 +230,7 @@ png_set_strip_alpha(png_structrp png_ptr)
*
* Terminology (assuming power law, "gamma", encodings):
* "screen" gamma: a power law imposed by the output device when digital
* samples are converted to visible light output. The EOTF - volage to
* samples are converted to visible light output. The EOTF - voltage to
* luminance on output.
*
* "file" gamma: a power law used to encode luminance levels from the input
@@ -495,6 +495,9 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,
if (png_rtran_ok(png_ptr, 0) == 0)
return;
if (palette == NULL)
return;
png_ptr->transformations |= PNG_QUANTIZE;
if (full_quantize == 0)
@@ -708,8 +711,8 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,
break;
t->next = hash[d];
t->left = (png_byte)i;
t->right = (png_byte)j;
t->left = png_ptr->palette_to_index[i];
t->right = png_ptr->palette_to_index[j];
hash[d] = t;
}
}
@@ -811,7 +814,13 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,
}
if (png_ptr->palette == NULL)
{
png_ptr->palette = palette;
/* Allocate an owned copy rather than aliasing the caller's pointer,
* so that png_read_destroy can free png_ptr->palette unconditionally.
*/
png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
memcpy(png_ptr->palette, palette, (unsigned int)num_palette *
(sizeof (png_color)));
}
png_ptr->num_palette = (png_uint_16)num_palette;
@@ -1364,7 +1373,7 @@ png_resolve_file_gamma(png_const_structrp png_ptr)
if (file_gamma != 0)
return file_gamma;
/* If png_reciprocal oveflows it returns 0 which indicates to the caller that
/* If png_reciprocal overflows, it returns 0, indicating to the caller that
* there is no usable file gamma. (The checks added to png_set_gamma and
* png_set_alpha_mode should prevent a screen_gamma which would overflow.)
*/
@@ -2061,6 +2070,17 @@ png_read_transform_info(png_structrp png_ptr, png_inforp info_ptr)
{
png_debug(1, "in png_read_transform_info");
if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
info_ptr->palette != NULL && png_ptr->palette != NULL)
{
/* Sync info_ptr->palette with png_ptr->palette, which may
* have been modified by png_init_read_transformations
* (e.g. for gamma correction or background compositing).
*/
memcpy(info_ptr->palette, png_ptr->palette,
PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)));
}
#ifdef PNG_READ_EXPAND_SUPPORTED
if ((png_ptr->transformations & PNG_EXPAND) != 0)
{
@@ -2355,7 +2375,7 @@ png_do_unpack(png_row_infop row_info, png_bytep row)
}
row_info->bit_depth = 8;
row_info->pixel_depth = (png_byte)(8 * row_info->channels);
row_info->rowbytes = row_width * row_info->channels;
row_info->rowbytes = (size_t)row_width * row_info->channels;
}
}
#endif
@@ -2557,7 +2577,7 @@ png_do_scale_16_to_8(png_row_infop row_info, png_bytep row)
row_info->bit_depth = 8;
row_info->pixel_depth = (png_byte)(8 * row_info->channels);
row_info->rowbytes = row_info->width * row_info->channels;
row_info->rowbytes = (size_t)row_info->width * row_info->channels;
}
}
#endif
@@ -2585,7 +2605,7 @@ png_do_chop(png_row_infop row_info, png_bytep row)
row_info->bit_depth = 8;
row_info->pixel_depth = (png_byte)(8 * row_info->channels);
row_info->rowbytes = row_info->width * row_info->channels;
row_info->rowbytes = (size_t)row_info->width * row_info->channels;
}
}
#endif
@@ -2821,7 +2841,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
*(--dp) = lo_filler;
row_info->channels = 2;
row_info->pixel_depth = 16;
row_info->rowbytes = row_width * 2;
row_info->rowbytes = (size_t)row_width * 2;
}
else
@@ -2836,7 +2856,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
}
row_info->channels = 2;
row_info->pixel_depth = 16;
row_info->rowbytes = row_width * 2;
row_info->rowbytes = (size_t)row_width * 2;
}
}
@@ -2859,7 +2879,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
*(--dp) = hi_filler;
row_info->channels = 2;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
}
else
@@ -2876,7 +2896,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
}
row_info->channels = 2;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
}
}
#endif
@@ -2900,7 +2920,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
*(--dp) = lo_filler;
row_info->channels = 4;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
}
else
@@ -2917,7 +2937,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
}
row_info->channels = 4;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
}
}
@@ -2944,7 +2964,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
*(--dp) = hi_filler;
row_info->channels = 4;
row_info->pixel_depth = 64;
row_info->rowbytes = row_width * 8;
row_info->rowbytes = (size_t)row_width * 8;
}
else
@@ -2966,7 +2986,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
row_info->channels = 4;
row_info->pixel_depth = 64;
row_info->rowbytes = row_width * 8;
row_info->rowbytes = (size_t)row_width * 8;
}
}
#endif
@@ -4460,7 +4480,7 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop row_info,
}
row_info->bit_depth = 8;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
row_info->color_type = 6;
row_info->channels = 4;
}
@@ -4468,7 +4488,7 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop row_info,
else
{
sp = row + (size_t)row_width - 1;
dp = row + (size_t)(row_width * 3) - 1;
dp = row + (size_t)row_width * 3 - 1;
i = 0;
#ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE
i = png_do_expand_palette_rgb8_neon(png_ptr, row_info, row,
@@ -4487,7 +4507,7 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop row_info,
row_info->bit_depth = 8;
row_info->pixel_depth = 24;
row_info->rowbytes = row_width * 3;
row_info->rowbytes = (size_t)row_width * 3;
row_info->color_type = 2;
row_info->channels = 3;
}
png/pngrutil.c
+15 -27
View File
@@ -436,7 +436,7 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
* be gained by using this when it is known *if* the zlib stream itself does
* not record the number; however, this is an illusion: the original writer
* of the PNG may have selected a lower window size, and we really must
* follow that because, for systems with with limited capabilities, we
* follow that because, for systems with limited capabilities, we
* would otherwise reject the application's attempts to use a smaller window
* size (zlib doesn't have an interface to say "this or lower"!).
*
@@ -1006,7 +1006,7 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
* in the case of an 8-bit display with a decoder which controls the palette.
*
* The alternative here is to ignore the error and store the palette anyway;
* destroying the tRNS will definately cause problems.
* destroying the tRNS will definitely cause problems.
*
* NOTE: the case of PNG_COLOR_TYPE_PALETTE need not be considered because
* the png_handle_ routines for the three 'after PLTE' chunks tRNS, bKGD and
@@ -1053,19 +1053,6 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
/* A valid PLTE chunk has been read */
png_ptr->mode |= PNG_HAVE_PLTE;
/* TODO: png_set_PLTE has the side effect of setting png_ptr->palette to
* its own copy of the palette. This has the side effect that when
* png_start_row is called (this happens after any call to
* png_read_update_info) the info_ptr palette gets changed. This is
* extremely unexpected and confusing.
*
* REVIEW: there have been consistent bugs in the past about gamma and
* similar transforms to colour mapped images being useless because the
* modified palette cannot be accessed because of the above.
*
* CONSIDER: Fix this by not sharing the palette in this way. But does
* this completely fix the problem?
*/
png_set_PLTE(png_ptr, info_ptr, palette, num);
return handled_ok;
}
@@ -1267,7 +1254,7 @@ png_handle_cHRM(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
/* png_set_cHRM may complain about some of the values but this doesn't matter
* because it was a cHRM and it did have vaguely (if, perhaps, ridiculous)
* values. Ridiculousity will be checked if the values are used later.
* values. Ridiculosity will be checked if the values are used later.
*/
png_set_cHRM_fixed(png_ptr, info_ptr, xy.whitex, xy.whitey, xy.redx, xy.redy,
xy.greenx, xy.greeny, xy.bluex, xy.bluey);
@@ -1564,7 +1551,8 @@ static png_handle_result_code /* PRIVATE */
png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
/* Note: this does not properly handle chunks that are > 64K under DOS */
{
png_bytep entry_start, buffer;
png_bytep buffer;
png_bytep entry_start;
png_sPLT_t new_palette;
png_sPLT_entryp pp;
png_uint_32 data_length;
@@ -1771,10 +1759,6 @@ png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
return handled_error;
}
/* TODO: this is a horrible side effect in the palette case because the
* png_struct ends up with a pointer to the tRNS buffer owned by the
* png_info. Fix this.
*/
png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
&(png_ptr->trans_color));
return handled_ok;
@@ -2033,7 +2017,7 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
return handled_error;
/* PNGv3: the code used to check the byte order mark at the start for MM or
* II, however PNGv3 states that the the first 4 bytes should be checked.
* II, however PNGv3 states that the first 4 bytes should be checked.
* The caller ensures that there are four bytes available.
*/
{
@@ -2155,9 +2139,13 @@ png_handle_oFFs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
static png_handle_result_code /* PRIVATE */
png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
{
png_bytep buffer;
png_bytep buf;
png_bytep endptr;
png_int_32 X0, X1;
png_byte type, nparams;
png_bytep buffer, buf, units, endptr;
png_byte type;
png_byte nparams;
png_byte *units;
png_charpp params;
int i;
@@ -3011,7 +2999,7 @@ static const struct
png_uint_32 max_length :12; /* Length min, max in bytes */
png_uint_32 min_length :8;
/* Length errors on critical chunks have special handling to preserve the
* existing behaviour in libpng 1.6. Anciallary chunks are checked below
* existing behaviour in libpng 1.6. Ancillary chunks are checked below
* and produce a 'benign' error.
*/
png_uint_32 pos_before :4; /* PNG_HAVE_ values chunk must precede */
@@ -3019,7 +3007,7 @@ static const struct
/* NOTE: PLTE, tRNS and bKGD require special handling which depends on
* the colour type of the base image.
*/
png_uint_32 multiple :1; /* Multiple occurences permitted */
png_uint_32 multiple :1; /* Multiple occurrences permitted */
/* This is enabled for PLTE because PLTE may, in practice, be optional */
}
read_chunks[PNG_INDEX_unknown] =
@@ -3053,7 +3041,7 @@ read_chunks[PNG_INDEX_unknown] =
# define CDIHDR 13U, 13U, hIHDR, 0, 0
# define CDPLTE NoCheck, 0U, 0, hIHDR, 1
/* PLTE errors are only critical for colour-map images, consequently the
* hander does all the checks.
* handler does all the checks.
*/
# define CDIDAT NoCheck, 0U, aIDAT, hIHDR, 1
# define CDIEND NoCheck, 0U, 0, aIDAT, 0
png/pngset.c
+95 -26
View File
File diff suppressed because it is too large Load Diff
png/pngstruct.h
+3 -3
View File
@@ -1,6 +1,6 @@
/* pngstruct.h - internal structures for libpng
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -106,7 +106,7 @@ typedef enum
* TODO: C23: convert these macros to C23 inlines (which are static).
*/
#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i)))
/* The flag coresponding to the given png_index enum value. This is defined
/* The flag corresponding to the given png_index enum value. This is defined
* for png_unknown as well (until it reaches the value 32) but this should
* not be relied on.
*/
@@ -115,7 +115,7 @@ typedef enum
(((png_ptr)->chunks & png_chunk_flag_from_index(i)) != 0)
/* The chunk has been recorded in png_struct */
#define png_file_add_chunk(pnt_ptr, i)\
#define png_file_add_chunk(png_ptr, i)\
((void)((png_ptr)->chunks |= png_chunk_flag_from_index(i)))
/* Record the chunk in the png_struct */
png/pngtrans.c
+34 -6
View File
@@ -1,6 +1,6 @@
/* pngtrans.c - transforms the data in a row (used by both readers and writers)
*
* Copyright (c) 2018-2024 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -84,9 +84,38 @@ png_set_shift(png_structrp png_ptr, png_const_color_8p true_bits)
{
png_debug(1, "in png_set_shift");
if (png_ptr == NULL)
if (png_ptr == NULL || true_bits == NULL)
return;
/* Check the shift values before passing them on to png_do_shift. */
{
png_byte bit_depth = png_ptr->bit_depth;
int invalid = 0;
if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
{
if (true_bits->red == 0 || true_bits->red > bit_depth ||
true_bits->green == 0 || true_bits->green > bit_depth ||
true_bits->blue == 0 || true_bits->blue > bit_depth)
invalid = 1;
}
else
{
if (true_bits->gray == 0 || true_bits->gray > bit_depth)
invalid = 1;
}
if ((png_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0 &&
(true_bits->alpha == 0 || true_bits->alpha > bit_depth))
invalid = 1;
if (invalid)
{
png_app_error(png_ptr, "png_set_shift: invalid shift values");
return;
}
}
png_ptr->transformations |= PNG_SHIFT;
png_ptr->shift = *true_bits;
}
@@ -457,10 +486,9 @@ png_do_packswap(png_row_infop row_info, png_bytep row)
if (row_info->bit_depth < 8)
{
png_const_bytep table;
png_bytep rp;
png_const_bytep end, table;
end = row + row_info->rowbytes;
png_bytep row_end = row + row_info->rowbytes;
if (row_info->bit_depth == 1)
table = onebppswaptable;
@@ -474,7 +502,7 @@ png_do_packswap(png_row_infop row_info, png_bytep row)
else
return;
for (rp = row; rp < end; rp++)
for (rp = row; rp < row_end; rp++)
*rp = table[*rp];
}
}
png/pngwrite.c
+13 -3
View File
@@ -159,7 +159,7 @@ png_write_info_before_PLTE(png_structrp png_ptr, png_const_inforp info_ptr)
* them.
*
* PNG v3: Chunks mDCV and cLLI provide ancillary information for the
* interpretation of the colourspace chunkgs but do not require support for
* interpretation of the colourspace chunks but do not require support for
* those chunks so are outside the "COLORSPACE" check but before the write of
* the colourspace chunks themselves.
*/
@@ -1010,6 +1010,16 @@ png_write_destroy(png_structrp png_ptr)
png_ptr->chunk_list = NULL;
#endif
#if defined(PNG_tRNS_SUPPORTED)
/* Free the independent copy of trans_alpha owned by png_struct. */
png_free(png_ptr, png_ptr->trans_alpha);
png_ptr->trans_alpha = NULL;
#endif
/* Free the independent copy of the palette owned by png_struct. */
png_free(png_ptr, png_ptr->palette);
png_ptr->palette = NULL;
/* The error handling and memory handling information is left intact at this
* point: the jmp_buf may still have to be freed. See png_destroy_png_struct
* for how this happens.
@@ -2020,7 +2030,7 @@ png_image_write_main(png_voidp argument)
display->row_stride = (png_int_32)/*SAFE*/png_row_stride;
if (display->row_stride < 0)
check = (png_uint_32)(-display->row_stride);
check = -(png_uint_32)display->row_stride;
else
check = (png_uint_32)display->row_stride;
@@ -2219,7 +2229,7 @@ png_image_write_main(png_voidp argument)
static void (PNGCBAPI
image_memory_write)(png_structp png_ptr, png_bytep/*const*/ data, size_t size)
image_memory_write)(png_structp png_ptr, png_bytep data, size_t size)
{
png_image_write_control *display = png_voidcast(png_image_write_control*,
png_ptr->io_ptr/*backdoor: png_get_io_ptr(png_ptr)*/);
png/pngwutil.c
+2 -47
View File
@@ -1,6 +1,6 @@
/* pngwutil.c - utilities to write a PNG file
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -898,7 +898,6 @@ png_write_PLTE(png_structrp png_ptr, png_const_colorp palette,
png_debug1(3, "num_palette = %d", png_ptr->num_palette);
png_write_chunk_header(png_ptr, png_PLTE, (png_uint_32)(num_pal * 3));
#ifdef PNG_POINTER_INDEXING_SUPPORTED
for (i = 0, pal_ptr = palette; i < num_pal; i++, pal_ptr++)
{
@@ -908,21 +907,6 @@ png_write_PLTE(png_structrp png_ptr, png_const_colorp palette,
png_write_chunk_data(png_ptr, buf, 3);
}
#else
/* This is a little slower but some buggy compilers need to do this
* instead
*/
pal_ptr=palette;
for (i = 0; i < num_pal; i++)
{
buf[0] = pal_ptr[i].red;
buf[1] = pal_ptr[i].green;
buf[2] = pal_ptr[i].blue;
png_write_chunk_data(png_ptr, buf, 3);
}
#endif
png_write_chunk_end(png_ptr);
png_ptr->mode |= PNG_HAVE_PLTE;
}
@@ -1201,9 +1185,6 @@ png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
size_t entry_size = (spalette->depth == 8 ? 6 : 10);
size_t palette_size = entry_size * (size_t)spalette->nentries;
png_sPLT_entryp ep;
#ifndef PNG_POINTER_INDEXING_SUPPORTED
int i;
#endif
png_debug(1, "in png_write_sPLT");
@@ -1221,7 +1202,6 @@ png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
png_write_chunk_data(png_ptr, &spalette->depth, 1);
/* Loop through each palette entry, writing appropriately */
#ifdef PNG_POINTER_INDEXING_SUPPORTED
for (ep = spalette->entries; ep<spalette->entries + spalette->nentries; ep++)
{
if (spalette->depth == 8)
@@ -1244,31 +1224,6 @@ png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
png_write_chunk_data(png_ptr, entrybuf, entry_size);
}
#else
ep=spalette->entries;
for (i = 0; i>spalette->nentries; i++)
{
if (spalette->depth == 8)
{
entrybuf[0] = (png_byte)ep[i].red;
entrybuf[1] = (png_byte)ep[i].green;
entrybuf[2] = (png_byte)ep[i].blue;
entrybuf[3] = (png_byte)ep[i].alpha;
png_save_uint_16(entrybuf + 4, ep[i].frequency);
}
else
{
png_save_uint_16(entrybuf + 0, ep[i].red);
png_save_uint_16(entrybuf + 2, ep[i].green);
png_save_uint_16(entrybuf + 4, ep[i].blue);
png_save_uint_16(entrybuf + 6, ep[i].alpha);
png_save_uint_16(entrybuf + 8, ep[i].frequency);
}
png_write_chunk_data(png_ptr, entrybuf, entry_size);
}
#endif
png_write_chunk_end(png_ptr);
}
@@ -1738,7 +1693,7 @@ png_write_iTXt(png_structrp png_ptr, int compression, png_const_charp key,
}
new_key[++key_len] = PNG_COMPRESSION_TYPE_BASE;
++key_len; /* for the keywod separator */
++key_len; /* for the keyword separator */
/* We leave it to the application to meet PNG-1.0 requirements on the
* contents of the text. PNG-1.0 through PNG-1.2 discourage the use of