1 2Libpng 1.6.10 - March 6, 2014 3 4This is a public release of libpng, intended for use in production codes. 5 6Files available for download: 7 8Source files with LF line endings (for Unix/Linux) and with a 9"configure" script 10 11 libpng-1.6.10.tar.xz (LZMA-compressed, recommended) 12 libpng-1.6.10.tar.gz 13 14Source files with CRLF line endings (for Windows), without the 15"configure" script 16 17 lpng1610.7z (LZMA-compressed, recommended) 18 lpng1610.zip 19 20Other information: 21 22 libpng-1.6.10-README.txt 23 libpng-1.6.10-LICENSE.txt 24 libpng-1.6.10-*.asc (armored detached GPG signatures) 25 26Changes since the last public release (1.6.9): 27 Backported changes from libpng-1.7.0beta30 and beta31: 28 Fixed a large number of instances where PNGCBAPI was omitted from 29 function definitions. 30 Added pngimage test program for png_read_png() and png_write_png() 31 with two new test scripts. 32 Removed dependence on !PNG_READ_EXPAND_SUPPORTED for calling 33 png_set_packing() in png_read_png(). 34 Fixed combination of ~alpha with shift. On read invert alpha, processing 35 occurred after shift processing, which causes the final values to be 36 outside the range that should be produced by the shift. Reversing the 37 order on read makes the two transforms work together correctly and mirrors 38 the order used on write. 39 Do not read invalid sBIT chunks. Previously libpng only checked sBIT 40 values on write, so a malicious PNG writer could therefore cause 41 the read code to return an invalid sBIT chunk, which might lead to 42 application errors or crashes. Such chunks are now skipped (with 43 chunk_benign_error). 44 Make png_read_png() and png_write_png() prototypes in png.h depend 45 upon PNG_READ_SUPPORTED and PNG_WRITE_SUPPORTED. 46 Support builds with unsupported PNG_TRANSFORM_* values. All of the 47 PNG_TRANSFORM_* values are always defined in png.h and, because they 48 are used for both read and write in some cases, it is not reliable 49 to #if out ones that are totally unsupported. This change adds error 50 detection in png_read_image() and png_write_image() to do a 51 png_app_error() if the app requests something that cannot be done 52 and it adds corresponding code to pngimage.c to handle such options 53 by not attempting to test them. 54 Moved redefines of png_error(), png_warning(), png_chunk_error(), 55 and png_chunk_warning() from pngpriv.h to png.h to make them visible 56 to libpng-calling applications. 57 Moved OS dependent code from arm/arm_init.c, to allow the included 58 implementation of the ARM NEON discovery function to be set at 59 build-time and provide sample implementations from the current code in the 60 contrib/arm-neon subdirectory. The __linux__ code has also been changed to 61 compile and link on Android by using /proc/cpuinfo, and the old linux code 62 is in contrib/arm-neon/linux-auxv.c. The new code avoids POSIX and Linux 63 dependencies apart from opening /proc/cpuinfo and is C90 compliant. 64 Check for info_ptr == NULL early in png_read_end() so we don't need to 65 run all the png_handle_*() and depend on them to return if info_ptr == NULL. 66 This improves the performance of png_read_end(png_ptr, NULL) and makes 67 it more robust against future programming errors. 68 Check for __has_extension before using it in pngconf.h, to 69 support older Clang versions (Jeremy Sequoia). 70 Treat CRC error handling with png_set_crc_action(), instead of with 71 png_set_benign_errors(), which has been the case since libpng-1.6.0beta18. 72 Use a user warning handler in contrib/gregbook/readpng2.c instead of default, 73 so warnings will be put on stderr even if libpng has CONSOLE_IO disabled. 74 Added png_ptr->process_mode = PNG_READ_IDAT_MODE in png_push_read_chunk 75 after recognizing the IDAT chunk, which avoids an infinite loop while 76 reading a datastream whose first IDAT chunk is of zero-length. 77 This fixes CERT VU#684412 and CVE-2014-0333. 78 Don't recognize known sRGB profiles as sRGB if they have been hacked, 79 but don't reject them and don't issue a copyright violation warning. 80 Moved some documentation from png.h to libpng.3 and libpng-manual.txt 81 Minor editing of contrib/arm-neon/README and contrib/examples/*.c 82 Fixed typos in the manual and in scripts/pnglibconf.dfa (CFLAGS -> CPPFLAGS 83 and PNG_USR_CONFIG -> PNG_USER_CONFIG). 84 Un-deprecated png_data_freer(). 85 86Send comments/corrections/commendations to png-mng-implement at lists.sf.net 87(subscription required; visit 88https://lists.sourceforge.net/lists/listinfo/png-mng-implement 89to subscribe) 90or to glennrp at users.sourceforge.net 91 92Glenn R-P 93#endif 94