Skip to content

Commit e0c5b34

Browse files
GoeLinRealCLanger
GoeLin
authored and
RealCLanger
committed
8382047: Update Libpng to 1.6.57
Reviewed-by: andrew Backport-of: 20e8ea0e0640bf8b0727cf30ced041a1def9c350
1 parent 16a319f commit e0c5b34

9 files changed

Lines changed: 89 additions & 31 deletions

File tree

‎src/java.desktop/share/legal/libpng.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
## libpng v1.6.56
1+
## libpng v1.6.57
22

33
### libpng License
44
<pre>
@@ -180,6 +180,7 @@ Authors, for copyright and licensing purposes.
180180
* Mans Rullgard
181181
* Matt Sarett
182182
* Mike Klein
183+
* Mohammad Seet
183184
* Pascal Massimino
184185
* Paul Schmidt
185186
* Petr Simecek

‎src/java.desktop/share/native/libsplashscreen/libpng/CHANGES‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6368,6 +6368,17 @@ Version 1.6.56 [March 25, 2026]
63686368
(Contributed by Bob Friesenhahn and Philippe Antoine.)
63696369
Performed various refactorings and cleanups.
63706370

6371+
Version 1.6.57 [April 8, 2026]
6372+
Fixed CVE-2026-34757 (medium severity):
6373+
Use-after-free in `png_set_PLTE`, `png_set_tRNS` and `png_set_hIST`
6374+
leading to corrupted chunk data and potential heap information disclosure.
6375+
Also hardened the append-style setters (`png_set_text`, `png_set_sPLT`,
6376+
`png_set_unknown_chunks`) against a theoretical variant of the same
6377+
aliasing pattern.
6378+
(Reported by Iv4n <Iv4n550@users.noreply.github.com>.)
6379+
Fixed integer overflow in rowbytes computation in read transforms.
6380+
(Contributed by Mohammad Seet.)
6381+
63716382
Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
63726383
Subscription is required; visit
63736384
<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>

‎src/java.desktop/share/native/libsplashscreen/libpng/README‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
README for libpng version 1.6.56
1+
README for libpng version 1.6.57
22
================================
33

44
See the note about version numbers near the top of `png.h`.

‎src/java.desktop/share/native/libsplashscreen/libpng/png.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
#include "pngpriv.h"
4343

4444
/* Generate a compiler error if there is an old png.h in the search path. */
45-
typedef png_libpng_version_1_6_56 Your_png_h_is_not_version_1_6_56;
45+
typedef png_libpng_version_1_6_57 Your_png_h_is_not_version_1_6_57;
4646

4747
/* Sanity check the chunks definitions - PNG_KNOWN_CHUNKS from pngpriv.h and the
4848
* corresponding macro definitions. This causes a compile time failure if
@@ -849,7 +849,7 @@ png_get_copyright(png_const_structrp png_ptr)
849849
return PNG_STRING_COPYRIGHT
850850
#else
851851
return PNG_STRING_NEWLINE \
852-
"libpng version 1.6.56" PNG_STRING_NEWLINE \
852+
"libpng version 1.6.57" PNG_STRING_NEWLINE \
853853
"Copyright (c) 2018-2026 Cosmin Truta" PNG_STRING_NEWLINE \
854854
"Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson" \
855855
PNG_STRING_NEWLINE \

‎src/java.desktop/share/native/libsplashscreen/libpng/png.h‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
* However, the following notice accompanied the original version of this
3030
* file and, per its terms, should not be removed:
3131
*
32-
* libpng version 1.6.56
32+
* libpng version 1.6.57
3333
*
3434
* Copyright (c) 2018-2026 Cosmin Truta
3535
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
@@ -43,7 +43,7 @@
4343
* libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
4444
* libpng versions 0.97, January 1998, through 1.6.35, July 2018:
4545
* Glenn Randers-Pehrson
46-
* libpng versions 1.6.36, December 2018, through 1.6.56, March 2026:
46+
* libpng versions 1.6.36, December 2018, through 1.6.57, April 2026:
4747
* Cosmin Truta
4848
* See also "Contributing Authors", below.
4949
*/
@@ -267,7 +267,7 @@
267267
* ...
268268
* 1.5.30 15 10530 15.so.15.30[.0]
269269
* ...
270-
* 1.6.56 16 10656 16.so.16.56[.0]
270+
* 1.6.57 16 10657 16.so.16.57[.0]
271271
*
272272
* Henceforth the source version will match the shared-library major and
273273
* minor numbers; the shared-library major version number will be used for
@@ -303,7 +303,7 @@
303303
*/
304304

305305
/* Version information for png.h - this should match the version in png.c */
306-
#define PNG_LIBPNG_VER_STRING "1.6.56"
306+
#define PNG_LIBPNG_VER_STRING "1.6.57"
307307
#define PNG_HEADER_VERSION_STRING " libpng version " PNG_LIBPNG_VER_STRING "\n"
308308

309309
/* The versions of shared library builds should stay in sync, going forward */
@@ -314,7 +314,7 @@
314314
/* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
315315
#define PNG_LIBPNG_VER_MAJOR 1
316316
#define PNG_LIBPNG_VER_MINOR 6
317-
#define PNG_LIBPNG_VER_RELEASE 56
317+
#define PNG_LIBPNG_VER_RELEASE 57
318318

319319
/* This should be zero for a public release, or non-zero for a
320320
* development version.
@@ -345,7 +345,7 @@
345345
* From version 1.0.1 it is:
346346
* XXYYZZ, where XX=major, YY=minor, ZZ=release
347347
*/
348-
#define PNG_LIBPNG_VER 10656 /* 1.6.56 */
348+
#define PNG_LIBPNG_VER 10657 /* 1.6.57 */
349349

350350
/* Library configuration: these options cannot be changed after
351351
* the library has been built.
@@ -455,7 +455,7 @@ extern "C" {
455455
/* This triggers a compiler error in png.c, if png.c and png.h
456456
* do not agree upon the version number.
457457
*/
458-
typedef char *png_libpng_version_1_6_56;
458+
typedef char *png_libpng_version_1_6_57;
459459

460460
/* Basic control structions. Read libpng-manual.txt or libpng.3 for more info.
461461
*

‎src/java.desktop/share/native/libsplashscreen/libpng/pngconf.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
* However, the following notice accompanied the original version of this
3030
* file and, per its terms, should not be removed:
3131
*
32-
* libpng version 1.6.56
32+
* libpng version 1.6.57
3333
*
3434
* Copyright (c) 2018-2026 Cosmin Truta
3535
* Copyright (c) 1998-2002,2004,2006-2016,2018 Glenn Randers-Pehrson

‎src/java.desktop/share/native/libsplashscreen/libpng/pnglibconf.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
* However, the following notice accompanied the original version of this
3232
* file and, per its terms, should not be removed:
3333
*/
34-
/* libpng version 1.6.56 */
34+
/* libpng version 1.6.57 */
3535

3636
/* Copyright (c) 2018-2026 Cosmin Truta */
3737
/* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson */

‎src/java.desktop/share/native/libsplashscreen/libpng/pngrtran.c‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2408,7 +2408,7 @@ png_do_unpack(png_row_infop row_info, png_bytep row)
24082408
}
24092409
row_info->bit_depth = 8;
24102410
row_info->pixel_depth = (png_byte)(8 * row_info->channels);
2411-
row_info->rowbytes = row_width * row_info->channels;
2411+
row_info->rowbytes = (size_t)row_width * row_info->channels;
24122412
}
24132413
}
24142414
#endif
@@ -2610,7 +2610,7 @@ png_do_scale_16_to_8(png_row_infop row_info, png_bytep row)
26102610

26112611
row_info->bit_depth = 8;
26122612
row_info->pixel_depth = (png_byte)(8 * row_info->channels);
2613-
row_info->rowbytes = row_info->width * row_info->channels;
2613+
row_info->rowbytes = (size_t)row_info->width * row_info->channels;
26142614
}
26152615
}
26162616
#endif
@@ -2638,7 +2638,7 @@ png_do_chop(png_row_infop row_info, png_bytep row)
26382638

26392639
row_info->bit_depth = 8;
26402640
row_info->pixel_depth = (png_byte)(8 * row_info->channels);
2641-
row_info->rowbytes = row_info->width * row_info->channels;
2641+
row_info->rowbytes = (size_t)row_info->width * row_info->channels;
26422642
}
26432643
}
26442644
#endif
@@ -2874,7 +2874,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
28742874
*(--dp) = lo_filler;
28752875
row_info->channels = 2;
28762876
row_info->pixel_depth = 16;
2877-
row_info->rowbytes = row_width * 2;
2877+
row_info->rowbytes = (size_t)row_width * 2;
28782878
}
28792879

28802880
else
@@ -2889,7 +2889,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
28892889
}
28902890
row_info->channels = 2;
28912891
row_info->pixel_depth = 16;
2892-
row_info->rowbytes = row_width * 2;
2892+
row_info->rowbytes = (size_t)row_width * 2;
28932893
}
28942894
}
28952895

@@ -2912,7 +2912,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
29122912
*(--dp) = hi_filler;
29132913
row_info->channels = 2;
29142914
row_info->pixel_depth = 32;
2915-
row_info->rowbytes = row_width * 4;
2915+
row_info->rowbytes = (size_t)row_width * 4;
29162916
}
29172917

29182918
else
@@ -2929,7 +2929,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
29292929
}
29302930
row_info->channels = 2;
29312931
row_info->pixel_depth = 32;
2932-
row_info->rowbytes = row_width * 4;
2932+
row_info->rowbytes = (size_t)row_width * 4;
29332933
}
29342934
}
29352935
#endif
@@ -2953,7 +2953,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
29532953
*(--dp) = lo_filler;
29542954
row_info->channels = 4;
29552955
row_info->pixel_depth = 32;
2956-
row_info->rowbytes = row_width * 4;
2956+
row_info->rowbytes = (size_t)row_width * 4;
29572957
}
29582958

29592959
else
@@ -2970,7 +2970,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
29702970
}
29712971
row_info->channels = 4;
29722972
row_info->pixel_depth = 32;
2973-
row_info->rowbytes = row_width * 4;
2973+
row_info->rowbytes = (size_t)row_width * 4;
29742974
}
29752975
}
29762976

@@ -2997,7 +2997,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
29972997
*(--dp) = hi_filler;
29982998
row_info->channels = 4;
29992999
row_info->pixel_depth = 64;
3000-
row_info->rowbytes = row_width * 8;
3000+
row_info->rowbytes = (size_t)row_width * 8;
30013001
}
30023002

30033003
else
@@ -3019,7 +3019,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
30193019

30203020
row_info->channels = 4;
30213021
row_info->pixel_depth = 64;
3022-
row_info->rowbytes = row_width * 8;
3022+
row_info->rowbytes = (size_t)row_width * 8;
30233023
}
30243024
}
30253025
#endif
@@ -4513,15 +4513,15 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop row_info,
45134513
}
45144514
row_info->bit_depth = 8;
45154515
row_info->pixel_depth = 32;
4516-
row_info->rowbytes = row_width * 4;
4516+
row_info->rowbytes = (size_t)row_width * 4;
45174517
row_info->color_type = 6;
45184518
row_info->channels = 4;
45194519
}
45204520

45214521
else
45224522
{
45234523
sp = row + (size_t)row_width - 1;
4524-
dp = row + (size_t)(row_width * 3) - 1;
4524+
dp = row + (size_t)row_width * 3 - 1;
45254525
i = 0;
45264526
#ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE
45274527
i = png_do_expand_palette_rgb8_neon(png_ptr, row_info, row,
@@ -4540,7 +4540,7 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop row_info,
45404540

45414541
row_info->bit_depth = 8;
45424542
row_info->pixel_depth = 24;
4543-
row_info->rowbytes = row_width * 3;
4543+
row_info->rowbytes = (size_t)row_width * 3;
45444544
row_info->color_type = 2;
45454545
row_info->channels = 3;
45464546
}

0 commit comments

Comments
 (0)