1230757 - Update in-tree libpng to version 1.6.21

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Glenn Randers-Pehrson]

Libpng-1.6.20 was released on December 3, 2015. It's a security release to fix CVE-2015-8472; mozilla is not vulnerable to that CVE when using either the embedded libpng or the system libpng.

Comment 1

[Glenn Randers-Pehrson]

Attachment: V00 update embedded libpng to version 1.6.20 (part 01, libpng)

Comment 2

[Glenn Randers-Pehrson]

Attachment: V00 update embedded libpng to version 1.6.20 (part 02, configure.in)

Comment 3

[Glenn Randers-Pehrson]

Please "try" both patches together.

Comment 4

[Glenn Randers-Pehrson]

Libpng-1.6.21 has been released.

Comment 5

[Glenn Randers-Pehrson]

Attachment: V01 update embedded libpng to version 1.6.21 (part 01, libpng)

Comment 6

[Glenn Randers-Pehrson]

Attachment: V01 update embedded libpng to version 1.6.21 (part 02, configure.in)

Comment 7

[Glenn Randers-Pehrson]

Please "try" the v01 patches

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5b4586f49536

Comment 9

[Glenn Randers-Pehrson]

Try gave mixed results.  Three of the five Windows builds failed and some reftests failed; none seem to be related to libpng. Would it be worthwhile rerunning the Windows builds in case it was some kind of transient problem?

Comment 10

[Ryan VanderMeulen [:RyanVM]]

The reftest failures are known intermittents and the Windows build failures were a known issue that we can't easily work around without re-pushing to Try. I'm inclined to just call the run good based on the runs that did run successfully.

Comment 11

[Seth Fowler [:seth] [:s2h]]

Comment on attachment 8708689 [details] [diff] [review]
V01 update embedded libpng to version 1.6.21 (part 01, libpng)

Review of attachment 8708689 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good! Thanks for doing this, Glenn.

::: media/libpng/CHANGES
@@ +5476,5 @@
> +  In projects/vstudio, combined readme.txt and WARNING into README.txt
> +
> +Version 1.6.21rc02 [January 7, 2016]
> +  Relocated assert() in contrib/tools/pngfix.c, bug found by American
> +    Fuzzy Lop, reported by Brian Carpenter.

Heh, fun to see an acquaintance pop up in the change log.

Comment 12

[Seth Fowler [:seth] [:s2h]]

Comment on attachment 8708690 [details] [diff] [review]
V01 update embedded libpng to version 1.6.21 (part 02, configure.in)

Review of attachment 8708690 [details] [diff] [review]:
-----------------------------------------------------------------

Thumbs up.

Comment 13

[Carsten Book [:Tomcat]]

has problems to apply:

(eg '1-3,5', or 's' to toggle the sort order between id & patch description) 2
adding 1230757 to series file
renamed 1230757 -> v01-1231757-part02-configure-libpng-1.6.20.diff
applying v01-1231757-part02-configure-libpng-1.6.20.diff
patching file configure.in
Hunk #1 FAILED at 45
1 out of 1 hunks FAILED -- saving rejects to file configure.in.rej
patch failed, unable to continue (try -v)
patch failed, rejects left in working directory
errors during apply, please fix and qrefresh v01-1231757-part02-configure-libpng-1.6.20.diff

Comment 14

[Ryan VanderMeulen [:RyanVM]]

s/configure.in/old-configure.in should fix it

Comment 15

[Glenn Randers-Pehrson]

Attachment: V02 update embedded libpng to version 1.6.21 (part 02, old-configure.in)

Patch old-configure.in instead of configure.in

Comment 16

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/be199e2f9e39
https://hg.mozilla.org/integration/mozilla-inbound/rev/0b3813f906c1

Comment 17

[Glenn Randers-Pehrson]

Attachment: V03 update embedded libpng to version 1.6.21 (part 02, old-configure.in)

MOZPNG value was wrong (010622 should be 010621)

Comment 18

[Glenn Randers-Pehrson]

Please checkin v03 not v02

Comment 19

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/56a3831fbb50 (backout)
https://hg.mozilla.org/integration/mozilla-inbound/rev/ea5b889ec09d

Comment 20

[Glenn Randers-Pehrson]

Thanks, Pulsebot.

Comment 21

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/be199e2f9e39
https://hg.mozilla.org/mozilla-central/rev/ea5b889ec09d