diff --git a/libpng-CVE-2015-8126.patch b/libpng-CVE-2015-8126.patch deleted file mode 100644 index 4b113a5..0000000 --- a/libpng-CVE-2015-8126.patch +++ /dev/null @@ -1,100 +0,0 @@ -diff --git a/pngrutil.c b/pngrutil.c -index 8f8edbc..5ca4dcb 100644 ---- a/pngrutil.c -+++ b/pngrutil.c -@@ -866,7 +866,7 @@ void /* PRIVATE */ - png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) - { - png_color palette[PNG_MAX_PALETTE_LENGTH]; -- int num, i; -+ int max_palette_length, num, i; - #ifdef PNG_POINTER_INDEXING_SUPPORTED - png_colorp pal_ptr; - #endif -@@ -927,6 +927,14 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) - /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */ - num = (int)length / 3; - -+ if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) -+ max_palette_length = (1 << png_ptr->bit_depth); -+ else -+ max_palette_length = PNG_MAX_PALETTE_LENGTH; -+ -+ if (num > max_palette_length) -+ num = max_palette_length; -+ - #ifdef PNG_POINTER_INDEXING_SUPPORTED - for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++) - { -@@ -959,7 +967,7 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) - if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) - #endif - { -- png_crc_finish(png_ptr, 0); -+ png_crc_finish(png_ptr, (int) length - num * 3); - } - - #ifndef PNG_READ_OPT_PLTE_SUPPORTED -diff --git a/pngset.c b/pngset.c -index 5f62af1..42e0dc2 100644 ---- a/pngset.c -+++ b/pngset.c -@@ -513,12 +513,17 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr, - png_const_colorp palette, int num_palette) - { - -+ png_uint_32 max_palette_length; -+ - png_debug1(1, "in %s storage function", "PLTE"); - - if (png_ptr == NULL || info_ptr == NULL) - return; - -- if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH) -+ max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? -+ (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; -+ -+ if (num_palette < 0 || num_palette > (int) max_palette_length) - { - if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) - png_error(png_ptr, "Invalid palette length"); -diff --git a/pngwrite.c b/pngwrite.c -index 3c8cbbe..39ef69e 100644 ---- a/pngwrite.c -+++ b/pngwrite.c -@@ -206,7 +206,7 @@ png_write_info(png_structrp png_ptr, png_const_inforp info_ptr) - png_write_PLTE(png_ptr, info_ptr->palette, - (png_uint_32)info_ptr->num_palette); - -- else if ((info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) !=0) -+ else if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) - png_error(png_ptr, "Valid palette required for paletted images"); - - #ifdef PNG_WRITE_tRNS_SUPPORTED -diff --git a/pngwutil.c b/pngwutil.c -index 9e6019e..01be584 100644 ---- a/pngwutil.c -+++ b/pngwutil.c -@@ -922,17 +922,20 @@ void /* PRIVATE */ - png_write_PLTE(png_structrp png_ptr, png_const_colorp palette, - png_uint_32 num_pal) - { -- png_uint_32 i; -+ png_uint_32 max_palette_length, i; - png_const_colorp pal_ptr; - png_byte buf[3]; - - png_debug(1, "in png_write_PLTE"); - -+ max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? -+ (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; -+ - if (( - #ifdef PNG_MNG_FEATURES_SUPPORTED - (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0 && - #endif -- num_pal == 0) || num_pal > 256) -+ num_pal == 0) || num_pal > max_palette_length) - { - if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) - {