libpng16/libpng-1.6.20.tar.xz.asc

- update to 1.6.20: Avoid potential pointer overflow/underflow in png_handle_sPLT() and png_handle_pCAL() (Bug report by John Regehr). Fixed incorrect implementation of png_set_PLTE() that uses png_ptr not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126 vulnerability. Backported tests from libpng-1.7.0beta69. Fixed an error in handling of bad zlib CMINFO field in pngfix, found by American Fuzzy Lop, reported by Brian Carpenter. inflate() doesn't immediately fault a bad CMINFO field; instead a 'too far back' error happens later (at least some times). pngfix failed to limit CMINFO to the allowed values but then assumed that window_bits was in range, triggering an assert. The bug is mostly harmless; the PNG file cannot be fixed. In libpng 1.6 zlib initialization was changed to use the window size in the zlib stream, not a fixed value. This causes some invalid images, where CINFO is too large, to display 'correctly' if the rest of the data is valid. This provides a workaround for zlib versions where the error arises (ones that support the API change to use the window size in the stream). OBS-URL: https://build.opensuse.org/package/show/graphics/libpng16?expand=0&rev=75 2015-12-03 15:14:24 +00:00			`-----BEGIN PGP SIGNATURE-----`
			`Version: GnuPG v1`

			`iQIcBAABAgAGBQJWYEXlAAoJEPVJhL+hbGQP2YwP/02NCjKPni/pgQMTgmfs8Dgg`
			`Wsotwy5/SKmtFmGScfSyF+0UI2sVzTyy/16udNs2noyza2T0uTXk2KX2vwxB463I`
			`QRha8EZb53dwzUHJhNI6Z3UAk5uOGHUnGUysBhQ6K5DiEHAmHmGtHVchxpow0gjU`
			`DAG30+PTC57NxNWV1/qEuGM1ht+yjH4as0haxxYw46jFAuN0CQyE4SUTNgh05m7A`
			`AGmIJyE/Vi+zEfWbhofAIa6m32+LFUtq06JGK8hVcgmBLctG8BGX1RwImq7Jorin`
			`AEuB4XUk5B5a6gRTDp1UWinw1McXC6xdepfq42RhfT/mkvw2LQR7gdfPBFntj9xs`
			`OXxZCWUHfWgTgFyM1m7tjiYsM+UGO49+xELtoLj2nRFLEKFhrJ1cBZG7h0Zu5DnT`
			`+BFZI88g6Uc7YY5G2MBLHMhVSgO6cWl+VxMlpRQr9ARrMHHqv3kQzKP9cpPde24x`
			`xFQC+cZ8a0ja+rzzJPJvaSrNl9gZOL3GHDnOUThbzzP9zPRhxaaD6L6rxnMROFbE`
			`3uW16UlDeMwtpy+EQcOiEQ89PyJEvwrHnIDlgHqydFHqtf/FQbeFrTvSXD1fne8k`
			`oI/oTJRobxIAxv9ce92mFyc3FKrlalhW6lu+s0LysBwu+7Ax2+eKr92aUZ/WBj1e`
			`SVynvw5LBFVB7z8N6M+m`
			`=mMQk`
			`-----END PGP SIGNATURE-----`