Merge pull request pnggroup#9 from Esri/update_v1.6.39

Update v1.6.39

.appveyor.yml

@@ -0,0 +1,69 @@
+version: 1.6.x-{build}
+
+branches:
+  except:
+    - /libpng[0-1][0-7]/
+
+image:
+  - Visual Studio 2022
+
+shallow_clone: true
+
+environment:
+  matrix:
+    - TOOLCHAIN: vstudio
+      AUTOMATION: cmake
+      ARCH: x86
+    - TOOLCHAIN: vstudio
+      AUTOMATION: cmake
+      ARCH: x64
+    - TOOLCHAIN: vstudio
+      AUTOMATION: cmake
+      ARCH: arm64
+      CI_NO_TEST: 1
+    - TOOLCHAIN: msys2
+      AUTOMATION: cmake
+      ARCH: i686
+    - TOOLCHAIN: msys2
+      AUTOMATION: cmake
+      ARCH: x86_64
+    - TOOLCHAIN: msys2
+      AUTOMATION: autotools
+      ARCH: i686
+    - TOOLCHAIN: msys2
+      AUTOMATION: autotools
+      ARCH: x86_64
+    - TOOLCHAIN: msys2
+      AUTOMATION: legacy
+      ARCH: i686
+    - TOOLCHAIN: msys2
+      AUTOMATION: legacy
+      ARCH: x86_64
+
+install:
+  - 'if "%TOOLCHAIN%"=="vstudio" C:\tools\vcpkg\vcpkg.exe install zlib:%ARCH%-windows'
+  - 'if "%TOOLCHAIN%"=="vstudio" C:\tools\vcpkg\vcpkg.exe integrate install'
+
+before_build:
+  - 'if "%TOOLCHAIN%"=="vstudio" set CI_CMAKE_VARS=-DCMAKE_TOOLCHAIN_FILE=C:\tools\vcpkg\scripts\buildsystems\vcpkg.cmake'
+  - 'if "%TOOLCHAIN%"=="vstudio" set CI_CMAKE_GENERATOR=Visual Studio 17 2022'
+  - 'if "%TOOLCHAIN%"=="vstudio" if "%ARCH%"=="x86" set CI_CMAKE_GENERATOR_PLATFORM=Win32'
+  - 'if "%TOOLCHAIN%"=="vstudio" if "%ARCH%"=="x64" set CI_CMAKE_GENERATOR_PLATFORM=x64'
+  - 'if "%TOOLCHAIN%"=="vstudio" if "%ARCH%"=="arm64" set CI_CMAKE_GENERATOR_PLATFORM=ARM64'
+  - 'if "%TOOLCHAIN%"=="msys2" if "%AUTOMATION%"=="cmake" set CI_CMAKE_GENERATOR=Unix Makefiles'
+  - 'if "%TOOLCHAIN%"=="msys2" if "%ARCH%"=="i686" set PATH=C:\msys64\mingw32\bin;%PATH%'
+  - 'if "%TOOLCHAIN%"=="msys2" if "%ARCH%"=="x86_64" set PATH=C:\msys64\mingw64\bin;%PATH%'
+  - 'if "%TOOLCHAIN%"=="msys2" set CI_CC=%ARCH%-w64-mingw32-gcc'
+  - 'set CI_CMAKE_BUILD_FLAGS=--parallel 2'
+  - 'set CI_CTEST_FLAGS=--parallel 2'
+  - 'set CI_MAKE_FLAGS=-j2'
+  - 'set CI_LEGACY_MAKEFILES=scripts/makefile.gcc scripts/makefile.msys scripts/makefile.std'
+
+build_script:
+  - 'if "%TOOLCHAIN%"=="vstudio" C:\msys64\usr\bin\bash.exe -l "%APPVEYOR_BUILD_FOLDER%\ci\ci_cmake.sh"'
+  - 'if "%TOOLCHAIN%"=="msys2" if "%AUTOMATION%"=="cmake" C:\msys64\usr\bin\bash.exe -l "%APPVEYOR_BUILD_FOLDER%\ci\ci_cmake.sh"'
+  - 'if "%TOOLCHAIN%"=="msys2" if "%AUTOMATION%"=="autotools" C:\msys64\usr\bin\bash.exe -l "%APPVEYOR_BUILD_FOLDER%\ci\ci_autotools.sh"'
+  - 'if "%TOOLCHAIN%"=="msys2" if "%AUTOMATION%"=="legacy" C:\msys64\usr\bin\bash.exe -l "%APPVEYOR_BUILD_FOLDER%\ci\ci_legacy.sh"'
+
+cache:
+  - C:\tools\vcpkg\installed

.travis.yml

@@ -0,0 +1,45 @@
+branches:
+  except:
+    - /libpng[0-1][0-7]/
+
+language: c
+
+os:
+  - freebsd
+  - linux
+  - osx
+
+compiler:
+  - clang
+  - gcc
+
+env:
+  - AUTOMATION=cmake CI_NO_TEST=1
+  - AUTOMATION=cmake CI_CMAKE_VARS="-DPNG_HARDWARE_OPTIMIZATIONS=ON" CI_SANITIZERS="address,undefined"
+  - AUTOMATION=cmake CI_CMAKE_VARS="-DPNG_HARDWARE_OPTIMIZATIONS=OFF" CI_SANITIZERS="address,undefined"
+  - AUTOMATION=autotools CI_NO_TEST=1
+  - AUTOMATION=autotools CI_CONFIGURE_FLAGS="--enable-hardware-optimizations"
+  - AUTOMATION=autotools CI_CONFIGURE_FLAGS="--disable-hardware-optimizations"
+  - AUTOMATION=legacy CI_NO_TEST=1
+  - AUTOMATION=legacy CI_SANITIZERS="address,undefined"
+
+matrix:
+  include:
+    - os: osx
+      compiler: cc
+      env: AUTOMATION=cmake CI_CMAKE_GENERATOR=Xcode
+  exclude:
+    - os: freebsd
+      compiler: gcc
+    - os: osx
+      compiler: gcc
+
+before_script:
+  - 'export CI_CMAKE_BUILD_FLAGS="--parallel 2"'
+  - 'export CI_CTEST_FLAGS="--parallel 2"'
+  - 'export CI_MAKE_FLAGS=-j2'
+  - 'export CI_CC=$TRAVIS_COMPILER'
+  - 'export CI_LEGACY_MAKEFILES="scripts/makefile.$TRAVIS_COMPILER scripts/makefile.std"'
+
+script:
+  - './ci/ci_$AUTOMATION.sh'

ANNOUNCE

@@ -1,5 +1,5 @@
-libpng 1.6.37 - April 14, 2019
-==============================
+libpng 1.6.39 - November 20, 2022
+=================================
 
 This is a public release of libpng, intended for use in production code.
 
@@ -9,13 +9,13 @@ Files available for download
 
 Source files with LF line endings (for Unix/Linux):
 
- * libpng-1.6.37.tar.xz (LZMA-compressed, recommended)
- * libpng-1.6.37.tar.gz
+ * libpng-1.6.39.tar.xz (LZMA-compressed, recommended)
+ * libpng-1.6.39.tar.gz
 
 Source files with CRLF line endings (for Windows):
 
- * lp1637.7z (LZMA-compressed, recommended)
- * lp1637.zip
+ * lpng1639.7z (LZMA-compressed, recommended)
+ * lpng1639.zip
 
 Other information:
 
@@ -25,20 +25,19 @@ Other information:
  * TRADEMARK.md
 
 
-Changes since the previous public release (version 1.6.36)
-----------------------------------------------------------
-
- * Fixed a use-after-free vulnerability (CVE-2019-7317) in png_image_free.
- * Fixed a memory leak in the ARM NEON implementation of png_do_expand_palette.
- * Fixed a memory leak in pngtest.c.
- * Fixed two vulnerabilities (CVE-2018-14048, CVE-2018-14550) in
-   contrib/pngminus; refactor.
- * Changed the license of contrib/pngminus to MIT; refresh makefile and docs.
-   (Contributed by Willem van Schaik)
- * Fixed a typo in the libpng license v2.
-   (Contributed by Miguel Ojeda)
- * Added makefiles for AddressSanitizer-enabled builds.
- * Cleaned up various makefiles.
+Changes from version 1.6.38 to version 1.6.39
+---------------------------------------------
+
+ * Changed the error handler of oversized chunks (i.e. larger than
+   PNG_USER_CHUNK_MALLOC_MAX) from png_chunk_error to png_benign_error.
+ * Fixed a buffer overflow error in contrib/tools/pngfix.
+ * Fixed a memory leak (CVE-2019-6129) in contrib/tools/pngcp.
+ * Disabled the ARM Neon optimizations by default in the CMake file,
+   following the default behavior of the configure script.
+ * Allowed configure.ac to work with the trunk version of autoconf.
+ * Removed the support for "install" targets from the legacy makefiles;
+   removed the obsolete makefile.cegcc.
+ * Cleaned up the code and updated the internal documentation.
 
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net.

AUTHORS

@@ -20,7 +20,9 @@ Authors, for copyright and licensing purposes.
  * Mans Rullgard
  * Matt Sarett
  * Mike Klein
+ * Pascal Massimino
  * Paul Schmidt
+ * Qiang Zhou
  * Sam Bushell
  * Samuel Williams
  * Simon-Pierre Cadieux
@@ -33,12 +35,15 @@ Authors, for copyright and licensing purposes.
  * Arm Holdings
    - Richard Townsend
  * Google Inc.
+   - Dan Field
+   - Leon Scroggins III
    - Matt Sarett
    - Mike Klein
+   - Sami Boukortt
 
 The build projects, the build scripts, the test scripts, and other
-files in the "projects", "scripts" and "tests" directories, have other
-copyright owners, but are released under the libpng license.
+files in the "ci", "projects", "scripts" and "tests" directories, have
+other copyright owners, but are released under the libpng license.
 
 Some files in the "contrib" directory, and some tools-generated files
 that are distributed with libpng, have other copyright owners, and are

CHANGES

@@ -2295,7 +2295,7 @@ Version 1.4.0beta58 [May 14, 2009]
   Clarified usage of sig_bit versus sig_bit_p in example.c (Vincent Torri)
 
 Version 1.4.0beta59 [May 15, 2009]
-  Reformated sources in libpng style (3-space intentation, comment format)
+  Reformated sources in libpng style (3-space indentation, comment format)
   Fixed typo in libpng docs (PNG_FILTER_AVE should be PNG_FILTER_AVG)
   Added sections about the git repository and our coding style to the
     documentation
@@ -3886,7 +3886,7 @@ Version 1.6.0beta06 [January 24, 2012]
 Version 1.6.0beta07 [January 28, 2012]
   Eliminated Intel icc/icl compiler warnings. The Intel (GCC derived)
     compiler issues slightly different warnings from those issued by the
-    current vesions of GCC. This eliminates those warnings by
+    current versions of GCC. This eliminates those warnings by
     adding/removing casts and small code rewrites.
   Updated configure.ac from autoupdate: added --enable-werror option.
     Also some layout regularization and removal of introduced tab characters
@@ -4052,7 +4052,7 @@ Version 1.6.0beta16 [March 6, 2012]
     (in fact this is harmless, but the PNG data produced may be sub-optimal).
 
 Version 1.6.0beta17 [March 10, 2012]
-  Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition. 
+  Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition.
   Reject all iCCP chunks after the first, even if the first one is invalid.
   Deflate/inflate was reworked to move common zlib calls into single
     functions [rw]util.c.  A new shared keyword check routine was also added
@@ -4962,7 +4962,7 @@ Version 1.6.13beta01 [July 4, 2014]
   Changed "if defined(__ARM_NEON__)" to
     "if (defined(__ARM_NEON__) || defined(__ARM_NEON))" (James Wu).
   Fixed clang no-warning builds: png_digit was defined but never used.
-    
+
 Version 1.6.13beta02 [July 21, 2014]
   Fixed an incorrect separator ("/" should be "\") in scripts/makefile.vcwin32
     (bug report from Wolfgang S. Kechel).  Bug was introduced in libpng-1.6.11.
@@ -5453,7 +5453,7 @@ Version 1.6.21beta01 [December 11, 2015]
 Version 1.6.21beta02 [December 14, 2015]
   Moved png_check_keyword() from pngwutil.c to pngset.c
   Removed LE/BE dependencies in pngvalid, to 'fix' the current problem
-    in the BigEndian tests by not testing it, making the BE code the same 
+    in the BigEndian tests by not testing it, making the BE code the same
     as the LE version.
   Fixes to pngvalid for various reduced build configurations (eliminate unused
     statics) and a fix for the case in rgb_to_gray when the digitize option
@@ -5517,7 +5517,7 @@ Version 1.6.22beta03 [March 9, 2016]
   Added a common-law trademark notice and export control information
     to the LICENSE file, png.h, and the man page.
   Restored "& 0xff" in png_save_uint_16() and png_save_uint_32() that
-    were accidentally removed from libpng-1.6.17. 
+    were accidentally removed from libpng-1.6.17.
   Changed PNG_INFO_cHNK and PNG_FREE_cHNK from 0xnnnn to 0xnnnnU in png.h
     (Robert C. Seacord).
   Removed dubious "#if INT_MAX" test from png.h that was added to
@@ -5950,7 +5950,7 @@ Version 1.6.32beta09 [August 3, 2017]
   Require cmake-2.8.8 in CMakeLists.txt. Revised symlink creation,
     no longer using deprecated cmake LOCATION feature (Clifford Yapp).
   Fixed five-byte error in the calculation of IDAT maximum possible size.
-  
+
 Version 1.6.32beta10 [August 5, 2017]
   Moved chunk-length check into a png_check_chunk_length() private
     function (Suggested by Max Stepin).
@@ -6103,6 +6103,24 @@ Version 1.6.37 [April 14, 2019]
   Added makefiles for AddressSanitizer-enabled builds.
   Cleaned up various makefiles.
 
+Version 1.6.38 [September 14, 2022]
+  Added configurations and scripts for continuous integration.
+  Fixed various errors in the handling of tRNS, hIST and eXIf.
+  Implemented many stability improvements across all platforms.
+  Updated the internal documentation.
+
+Version 1.6.39 [November 20, 2022]
+  Changed the error handler of oversized chunks (i.e. larger than
+    PNG_USER_CHUNK_MALLOC_MAX) from png_chunk_error to png_benign_error.
+  Fixed a buffer overflow error in contrib/tools/pngfix.
+  Fixed a memory leak (CVE-2019-6129) in contrib/tools/pngcp.
+  Disabled the ARM Neon optimizations by default in the CMake file,
+    following the default behavior of the configure script.
+  Allowed configure.ac to work with the trunk version of autoconf.
+  Removed the support for "install" targets from the legacy makefiles;
+    removed the obsolete makefile.cegcc.
+  Cleaned up the code and updated the internal documentation.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
 Subscription is required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement