Release libpng version 1.6.51

Author: ctruta

ANNOUNCE

@@ -1,13 +1,5 @@
-libpng 1.6.51.git
-=================
-
-This is a development version, not intended to be a public release.
-It will be replaced by a public release, or by another development
-version, at a later time.
-
-
-libpng 1.6.50 - July 1, 2025
-============================
+libpng 1.6.51 - November 21, 2025
+=================================
 
 This is a public release of libpng, intended for use in production code.
 
@@ -17,13 +9,13 @@ Files available for download
 
 Source files with LF line endings (for Unix/Linux):
 
- * libpng-1.6.50.tar.xz (LZMA-compressed, recommended)
- * libpng-1.6.50.tar.gz (deflate-compressed)
+ * libpng-1.6.51.tar.xz (LZMA-compressed, recommended)
+ * libpng-1.6.51.tar.gz (deflate-compressed)
 
 Source files with CRLF line endings (for Windows):
 
- * lpng1650.7z (LZMA-compressed, recommended)
- * lpng1650.zip (deflate-compressed)
+ * lpng1651.7z (LZMA-compressed, recommended)
+ * lpng1651.zip (deflate-compressed)
 
 Other information:
 
@@ -33,18 +25,33 @@ Other information:
  * TRADEMARK.md
 
 
-Changes from version 1.6.49 to version 1.6.50
+Changes from version 1.6.50 to version 1.6.51
 ---------------------------------------------
 
- * Improved the detection of the RVV Extension on the RISC-V platform.
-   (Contributed by Filip Wasil)
- * Replaced inline ASM with C intrinsics in the RVV code.
-   (Contributed by Filip Wasil)
- * Fixed a decoder defect in which unknown chunks trailing IDAT, set
-   to go through the unknown chunk handler, incorrectly triggered
-   out-of-place IEND errors.
-   (Contributed by John Bowler)
- * Fixed the CMake file for cross-platform builds that require `libm`.
+ * Fixed CVE-2025-64505 (moderate severity):
+   Heap buffer overflow in `png_do_quantize` via malformed palette index.
+   (Reported by Samsung; analyzed by Fabio Gritti.)
+ * Fixed CVE-2025-64506 (moderate severity):
+   Heap buffer over-read in `png_write_image_8bit` with 8-bit input and
+   `convert_to_8bit` enabled.
+   (Reported by Samsung and <[email protected]>;
+   analyzed by Fabio Gritti.)
+ * Fixed CVE-2025-64720 (high severity):
+   Buffer overflow in `png_image_read_composite` via incorrect palette
+   premultiplication.
+   (Reported by Samsung; analyzed by John Bowler.)
+ * Fixed CVE-2025-65018 (high severity):
+   Heap buffer overflow in `png_combine_row` triggered via
+   `png_image_finish_read`.
+   (Reported by <[email protected]>.)
+ * Fixed a memory leak in `png_set_quantize`.
+   (Reported by Samsung; analyzed by Fabio Gritti.)
+ * Removed the experimental and incomplete ERROR_NUMBERS code.
+   (Contributed by Tobias Stoeckmann.)
+ * Improved the RISC-V vector extension support; required RVV 1.0 or newer.
+   (Contributed by Filip Wasil.)
+ * Added GitHub Actions workflows for automated testing.
+ * Performed various refactorings and cleanups.
 
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net.

CHANGES

@@ -6278,7 +6278,31 @@ Version 1.6.50 [July 1, 2025]
     (Contributed by John Bowler)
   Fixed the CMake file for cross-platform builds that require `libm`.
 
-Version 1.6.51 [TODO]
+Version 1.6.51 [November 21, 2025]
+  Fixed CVE-2025-64505 (moderate severity):
+    Heap buffer overflow in `png_do_quantize` via malformed palette index.
+    (Reported by Samsung; analyzed by Fabio Gritti.)
+  Fixed CVE-2025-64506 (moderate severity):
+    Heap buffer over-read in `png_write_image_8bit` with 8-bit input and
+    `convert_to_8bit` enabled.
+    (Reported by Samsung and <[email protected]>;
+    analyzed by Fabio Gritti.)
+  Fixed CVE-2025-64720 (high severity):
+    Buffer overflow in `png_image_read_composite` via incorrect palette
+    premultiplication.
+    (Reported by Samsung; analyzed by John Bowler.)
+  Fixed CVE-2025-65018 (high severity):
+    Heap buffer overflow in `png_combine_row` triggered via
+    `png_image_finish_read`.
+    (Reported by <[email protected]>.)
+  Fixed a memory leak in `png_set_quantize`.
+    (Reported by Samsung; analyzed by Fabio Gritti.)
+  Removed the experimental and incomplete ERROR_NUMBERS code.
+    (Contributed by Tobias Stoeckmann.)
+  Improved the RISC-V vector extension support; required RVV 1.0 or newer.
+    (Contributed by Filip Wasil.)
+  Added GitHub Actions workflows for automated testing.
+  Performed various refactorings and cleanups.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
 Subscription is required; visit

CMakeLists.txt

@@ -19,8 +19,8 @@ cmake_minimum_required(VERSION 3.14...4.0)
 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 6)
 set(PNGLIB_REVISION 51)
-#set(PNGLIB_SUBREVISION 0)
-set(PNGLIB_SUBREVISION "git")
+set(PNGLIB_SUBREVISION 0)
+#set(PNGLIB_SUBREVISION "git")
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_REVISION})
 set(PNGLIB_ABI_VERSION ${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_SHARED_VERSION ${PNGLIB_ABI_VERSION}.${PNGLIB_REVISION}.${PNGLIB_SUBREVISION})

README

@@ -1,5 +1,5 @@
-README for libpng version 1.6.51.git
-====================================
+README for libpng version 1.6.51
+================================
 
 See the note about version numbers near the top of `png.h`.
 See `INSTALL` for instructions on how to install libpng.

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.72 for libpng 1.6.51.git.
+# Generated by GNU Autoconf 2.72 for libpng 1.6.51.
 #
 # Report bugs to <[email protected]>.
 #
@@ -614,8 +614,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libpng'
 PACKAGE_TARNAME='libpng'
-PACKAGE_VERSION='1.6.51.git'
-PACKAGE_STRING='libpng 1.6.51.git'
+PACKAGE_VERSION='1.6.51'
+PACKAGE_STRING='libpng 1.6.51'
 PACKAGE_BUGREPORT='[email protected]'
 PACKAGE_URL=''
 
@@ -1424,7 +1424,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-'configure' configures libpng 1.6.51.git to adapt to many kinds of systems.
+'configure' configures libpng 1.6.51 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1495,7 +1495,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libpng 1.6.51.git:";;
+     short | recursive ) echo "Configuration of libpng 1.6.51:";;
    esac
   cat <<\_ACEOF
 
@@ -1698,7 +1698,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libpng configure 1.6.51.git
+libpng configure 1.6.51
 generated by GNU Autoconf 2.72
 
 Copyright (C) 2023 Free Software Foundation, Inc.
@@ -1961,7 +1961,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libpng $as_me 1.6.51.git, which was
+It was created by libpng $as_me 1.6.51, which was
 generated by GNU Autoconf 2.72.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3446,7 +3446,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='libpng'
- VERSION='1.6.51.git'
+ VERSION='1.6.51'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -3665,7 +3665,7 @@ fi
 
 
 
-PNGLIB_VERSION=1.6.51.git
+PNGLIB_VERSION=1.6.51
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=6
 PNGLIB_RELEASE=51
@@ -16406,7 +16406,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libpng $as_me 1.6.51.git, which was
+This file was extended by libpng $as_me 1.6.51, which was
 generated by GNU Autoconf 2.72.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -16474,7 +16474,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-libpng config.status 1.6.51.git
+libpng config.status 1.6.51
 configured by $0, generated by GNU Autoconf 2.72,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -25,7 +25,7 @@ AC_PREREQ([2.68])
 
 dnl Version number stuff here:
 
-AC_INIT([libpng],[1.6.51.git],[[email protected]])
+AC_INIT([libpng],[1.6.51],[[email protected]])
 AC_CONFIG_MACRO_DIR([scripts/autoconf])
 
 # libpng does not follow GNU file name conventions (hence 'foreign')
@@ -46,7 +46,7 @@ dnl automake, so the following is not necessary (and is not defined anyway):
 dnl AM_PREREQ([1.11.2])
 dnl stop configure from automagically running automake
 
-PNGLIB_VERSION=1.6.51.git
+PNGLIB_VERSION=1.6.51
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=6
 PNGLIB_RELEASE=51

libpng-manual.txt

@@ -9,7 +9,7 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng version 1.6.36, December 2018, through 1.6.50 - July 2025
+ libpng version 1.6.36, December 2018, through 1.6.51 - November 2025
  Updated and distributed by Cosmin Truta
  Copyright (c) 2018-2025 Cosmin Truta
 

libpng.3

@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "September 3, 2025"
+.TH LIBPNG 3 "November 21, 2025"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.51.git
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.51
 
 .SH SYNOPSIS
 \fB#include <png.h>\fP
@@ -528,7 +528,7 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng version 1.6.36, December 2018, through 1.6.50 - July 2025
+ libpng version 1.6.36, December 2018, through 1.6.51 - November 2025
  Updated and distributed by Cosmin Truta
  Copyright (c) 2018-2025 Cosmin Truta
 

libpngpf.3

@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "July 1, 2025"
+.TH LIBPNGPF 3 "November 21, 2025"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.50
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.51
 
 .SH SYNOPSIS
 \fB#include "pngpriv.h"\fP

png.5

@@ -1,4 +1,4 @@
-.TH PNG 5 "July 14, 2025"
+.TH PNG 5 "November 21, 2025"
 .SH NAME
 png \- Portable Network Graphics (PNG) format