summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch60
-rw-r--r--meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch125
-rw-r--r--meta/recipes-multimedia/libpng/libpng_1.6.39.bb2
3 files changed, 187 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch
new file mode 100644
index 0000000000..d3db455cdf
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch
@@ -0,0 +1,60 @@
1From 788a624d7387a758ffd5c7ab010f1870dea753a1 Mon Sep 17 00:00:00 2001
2From: Cosmin Truta <ctruta@gmail.com>
3Date: Sat, 29 Nov 2025 00:39:16 +0200
4Subject: [PATCH] Fix an out-of-bounds read in `png_image_read_composite`
5
6Add a defensive bounds check before calling PNG_sRGB_FROM_LINEAR to
7prevent reading up to 506 entries (1012 bytes) past `png_sRGB_base[]`.
8
9For palette images with gamma, `png_init_read_transformations`
10clears PNG_COMPOSE after compositing on the palette, but it leaves
11PNG_FLAG_OPTIMIZE_ALPHA set. The simplified API then calls
12`png_image_read_composite` with sRGB data (not linear premultiplied),
13causing the index to reach 1017. (The maximum valid index is 511.)
14
15NOTE:
16This is a defensive fix that addresses the security issue (out-of-bounds
17read) but *NOT* the correctness issue (wrong output). When the clamp
18triggers, the affected pixels are clamped to white instead of the
19correct composited color. Valid PNG images may render incorrectly with
20the simplified API.
21
22TODO:
23We already know the root cause is a flag synchronization error.
24For palette images with gamma, `png_init_read_transformations`
25clears PNG_COMPOSE but leaves PNG_FLAG_OPTIMIZE_ALPHA set, causing
26`png_image_read_composite` to misinterpret sRGB data as linear
27premultiplied. However, we have yet to implement an architectural fix
28that requires coordinating the simplified API with the transformation
29pipeline.
30
31Reported-by: flyfish101 <flyfish101@users.noreply.github.com>
32
33CVE: CVE-2025-66293
34Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1]
35Signed-off-by: Peter Marko <peter.marko@siemens.com>
36---
37 pngread.c | 9 +++++++--
38 1 file changed, 7 insertions(+), 2 deletions(-)
39
40diff --git a/pngread.c b/pngread.c
41index 79917daaa..ab62edd9d 100644
42--- a/pngread.c
43+++ b/pngread.c
44@@ -3404,9 +3404,14 @@ png_image_read_composite(png_voidp argument)
45 component += (255-alpha)*png_sRGB_table[outrow[c]];
46
47 /* So 'component' is scaled by 255*65535 and is
48- * therefore appropriate for the sRGB to linear
49- * conversion table.
50+ * therefore appropriate for the sRGB-to-linear
51+ * conversion table. Clamp to the valid range
52+ * as a defensive measure against an internal
53+ * libpng bug where the data is sRGB rather than
54+ * linear premultiplied.
55 */
56+ if (component > 255*65535)
57+ component = 255*65535;
58 component = PNG_sRGB_FROM_LINEAR(component);
59 }
60
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch
new file mode 100644
index 0000000000..e725f1e0f2
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch
@@ -0,0 +1,125 @@
1From a05a48b756de63e3234ea6b3b938b8f5f862484a Mon Sep 17 00:00:00 2001
2From: Cosmin Truta <ctruta@gmail.com>
3Date: Mon, 1 Dec 2025 22:31:54 +0200
4Subject: [PATCH] Finalize the fix for out-of-bounds read in
5 `png_image_read_composite`
6
7Following up on commit 788a624d7387a758ffd5c7ab010f1870dea753a1.
8
9The previous commit added a defensive bounds check to address the
10security issue (out-of-bounds read), but noted that the correctness
11issue remained: when the clamp triggered, the affected pixels were
12clamped to white instead of the correct composited color.
13
14This commit addresses the correctness issue by fixing the flag
15synchronization error identified in the previous commit's TODO:
16
171. In `png_init_read_transformations`:
18 Clear PNG_FLAG_OPTIMIZE_ALPHA when clearing PNG_COMPOSE for palette
19 images. This correctly signals that the data is sRGB, not linear
20 premultiplied.
21
222. In `png_image_read_composite`:
23 Check PNG_FLAG_OPTIMIZE_ALPHA and use the appropriate composition
24 formula. When set, use the existing linear composition. When cleared
25 (palette composition already done), use sRGB composition to match
26 what was done to the palette.
27
28Retain the previous clamp to the valid range as belt-and-suspenders
29protection against any other unforeseen cases.
30
31CVE: CVE-2025-66293
32Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a]
33Signed-off-by: Peter Marko <peter.marko@siemens.com>
34---
35 pngread.c | 56 ++++++++++++++++++++++++++++++++++++------------------
36 pngrtran.c | 1 +
37 2 files changed, 39 insertions(+), 18 deletions(-)
38
39diff --git a/pngread.c b/pngread.c
40index ab62edd9d..f8ca2b7e3 100644
41--- a/pngread.c
42+++ b/pngread.c
43@@ -3338,6 +3338,7 @@ png_image_read_composite(png_voidp argument)
44 ptrdiff_t step_row = display->row_bytes;
45 unsigned int channels =
46 (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
47+ int optimize_alpha = (png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0;
48 int pass;
49
50 for (pass = 0; pass < passes; ++pass)
51@@ -3394,25 +3395,44 @@ png_image_read_composite(png_voidp argument)
52
53 if (alpha < 255) /* else just use component */
54 {
55- /* This is PNG_OPTIMIZED_ALPHA, the component value
56- * is a linear 8-bit value. Combine this with the
57- * current outrow[c] value which is sRGB encoded.
58- * Arithmetic here is 16-bits to preserve the output
59- * values correctly.
60- */
61- component *= 257*255; /* =65535 */
62- component += (255-alpha)*png_sRGB_table[outrow[c]];
63+ if (optimize_alpha != 0)
64+ {
65+ /* This is PNG_OPTIMIZED_ALPHA, the component value
66+ * is a linear 8-bit value. Combine this with the
67+ * current outrow[c] value which is sRGB encoded.
68+ * Arithmetic here is 16-bits to preserve the output
69+ * values correctly.
70+ */
71+ component *= 257*255; /* =65535 */
72+ component += (255-alpha)*png_sRGB_table[outrow[c]];
73
74- /* So 'component' is scaled by 255*65535 and is
75- * therefore appropriate for the sRGB-to-linear
76- * conversion table. Clamp to the valid range
77- * as a defensive measure against an internal
78- * libpng bug where the data is sRGB rather than
79- * linear premultiplied.
80- */
81- if (component > 255*65535)
82- component = 255*65535;
83- component = PNG_sRGB_FROM_LINEAR(component);
84+ /* Clamp to the valid range to defend against
85+ * unforeseen cases where the data might be sRGB
86+ * instead of linear premultiplied.
87+ * (Belt-and-suspenders for GitHub Issue #764.)
88+ */
89+ if (component > 255*65535)
90+ component = 255*65535;
91+
92+ /* So 'component' is scaled by 255*65535 and is
93+ * therefore appropriate for the sRGB-to-linear
94+ * conversion table.
95+ */
96+ component = PNG_sRGB_FROM_LINEAR(component);
97+ }
98+ else
99+ {
100+ /* Compositing was already done on the palette
101+ * entries. The data is sRGB premultiplied on black.
102+ * Composite with the background in sRGB space.
103+ * This is not gamma-correct, but matches what was
104+ * done to the palette.
105+ */
106+ png_uint_32 background = outrow[c];
107+ component += ((255-alpha) * background + 127) / 255;
108+ if (component > 255)
109+ component = 255;
110+ }
111 }
112
113 outrow[c] = (png_byte)component;
114diff --git a/pngrtran.c b/pngrtran.c
115index 2f5202255..507d11381 100644
116--- a/pngrtran.c
117+++ b/pngrtran.c
118@@ -1760,6 +1760,7 @@ png_init_read_transformations(png_structrp png_ptr)
119 * transformations elsewhere.
120 */
121 png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA);
122+ png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
123 } /* color_type == PNG_COLOR_TYPE_PALETTE */
124
125 /* if (png_ptr->background_gamma_type!=PNG_BACKGROUND_GAMMA_UNKNOWN) */
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.39.bb b/meta/recipes-multimedia/libpng/libpng_1.6.39.bb
index 47b76a704b..70685b68e7 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.39.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.39.bb
@@ -20,6 +20,8 @@ SRC_URI = "\
20 file://CVE-2025-64720.patch \ 20 file://CVE-2025-64720.patch \
21 file://CVE-2025-65018-01.patch \ 21 file://CVE-2025-65018-01.patch \
22 file://CVE-2025-65018-02.patch \ 22 file://CVE-2025-65018-02.patch \
23 file://CVE-2025-66293-01.patch \
24 file://CVE-2025-66293-02.patch \
23" 25"
24 26
25SRC_URI[sha256sum] = "1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937" 27SRC_URI[sha256sum] = "1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-03-27 05:49:59 +0000