564792 - Update libpng to version 1.4.3

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Glenn Randers-Pehrson]

Libpng-1.4.2 has been released.  There are no changes of importance to mozilla, so this is a very low priority; we probably want to skip this release.

Comment 1

[Glenn Randers-Pehrson]

Libpng-1.4.3 has been released.  It fixes a vulnerability with reading PNG files that have extra data in the IDAT chunk (CVE 2010-1205) and a memory leak while reading a malformed sCAL chunk.  The PNG decoder in libpr0n already has a recently checked-in workaround for the extra-data vulnerability.  Both vulnerabilities have been publicly disclosed via the libpr0n check-ins and the libpng release.

Comment 2

[Reed Loden [:reed]]

Glenn, can you get us a patch for this?

Comment 3

[Glenn Randers-Pehrson]

I'll try to get to it tonight.  Note that we aren't vulnerable to the sCAL bug
because we treat it as an unknown chunk and don't decode it, even when we use the system library.

Comment 4

[Glenn Randers-Pehrson]

Attachment: v00: update libpng to version 1.4.3

Comment 5

[Reed Loden [:reed]]

Is there a similar bug for libpng 1.2.x on the branches that still use it?

Comment 6

[Reed Loden [:reed]]

The patch looks bigger than it actually is, as you seem to have accidentally included the .diff as part of the diff.

Comment 7

[Reed Loden [:reed]]

(yo dawg!)

Comment 8

[Glenn Randers-Pehrson]

Attachment: v01: update libpng to version 1.4.3

Removes unwanted libpng diff file created by the v00 patch

Comment 9

[Glenn Randers-Pehrson]

(In reply to comment #5)
> Is there a similar bug for libpng 1.2.x on the branches that still use it?

Yes.  The approach there will be to simply replace the IDAT-processing
function in pngpread.c.

Comment 10

[Reed Loden [:reed]]

Comment on attachment 455363 [details] [diff] [review]
v01: update libpng to version 1.4.3

Keeps us up-to-date with libpng, including a security fix (though, we've worked around it already). Makes future security upgrades easier.

Comment 11

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 455363 [details] [diff] [review]
v01: update libpng to version 1.4.3

17:17 < joe> we should probably take it, with a quick hook on backing it out

So like the man says, if this bounces, we yank it.

Comment 12

[Dão Gottwald [:dao]]

http://hg.mozilla.org/mozilla-central/rev/c338f8b7371e