PNG reference library Changelog

What's new in PNG reference library 1.6.37

Apr 15, 2019

This is a public release of libpng, intended for use in production code.

New in PNG reference library 1.6.36 (Dec 3, 2018)

New in PNG reference library 1.6.35 (Jul 16, 2018)

New in PNG reference library 1.6.34 (Nov 3, 2017)

New in PNG reference library 1.6.29 (Apr 21, 2017)

New in PNG reference library 1.6.17 (Mar 27, 2015)

Removed duplicate PNG_SAFE_LIMITS_SUPPORTED handling from pngconf.h
Corrected the width limit calculation in png_check_IHDR().
Removed user limits from pngfix. Also pass NULL pointers to png_read_row to skip the unnecessary row de-interlace stuff.
Added testing of png_set_packing() to pngvalid.c
Regenerated configure scripts in the *.tar distributions with libtool-2.4.4
Implement previously untested cases of libpng transforms in pngvalid.c
Fixed byte order in 2-byte filler, in png_do_read_filler().
Made the check for out-of-range values in png_set_tRNS() detect values that are exactly 2^bit_depth, and work on 16-bit platforms.
Merged some parts of libpng-1.6.17beta01 and libpng-1.7.0beta47.
Added #ifndef __COVERITY__ where needed in png.c, pngrutil.c and pngset.c to avoid warnings about dead code.
Do not build png_product2() when it is unused. Display user limits in the output from pngtest.
Eliminated the PNG_SAFE_LIMITS macro and restored the 1-million-column and 1-million-row default limits in pnglibconf.dfa, that can be reset by the user at build time or run time.
This provides a more robust defense against DOS and as-yet undiscovered overflows.
Added PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED macro, on by default.
Allow user to call png_get_IHDR() with NULL arguments (Reuben Hawkins).
Rebuilt configure scripts with automake-1.15 and libtool-2.4.6
Moved png_set_filter() prototype into a PNG_WRITE_SUPPORTED block of png.h.
Avoid runtime checks when converting integer to png_byte with Visual Studio
Removed some comments that the configure script did not handle properly from scripts/pnglibconf.dfa and pnglibconf.h.prebuilt.
Free the unknown_chunks structure even when it contains no data.
Updated CMakeLists.txt to add OSX framework, change YES/NO to ON/OFF for consistency, and remove some useless tests
Remove pnglibconf.h, pnglibconf.c, pnglibconf.pre, pnglibconf.dfn, and pnglibconf.out instead of pnglibconf.* in "make clean".
Fixed simplified 8-bit-linear to sRGB alpha. The calculated alpha value was wrong. It's not clear if this affected the final stored value; in the obvious code path the upper and lower 8-bits of the alpha value were identical and the alpha was truncated to 8-bits rather than dividing by 257

New in PNG reference library 1.7.0 Beta 42 (Nov 25, 2014)

New in PNG reference library 1.6.15 RC 3 (Nov 17, 2014)

New in PNG reference library 1.6.15 RC 2 (Nov 15, 2014)

New in PNG reference library 1.6.14 (Oct 23, 2014)

New in PNG reference library 1.6.14 Beta 3 (Sep 20, 2014)

New in PNG reference library 1.6.14 Beta 2 (Sep 19, 2014)

New in PNG reference library 1.6.13 Beta 1 (Jul 5, 2014)

New in PNG reference library 1.6.12 (Jun 12, 2014)

New in PNG reference library 1.6.11 (Jun 6, 2014)

New in PNG reference library 1.6.11 Beta 6 (May 20, 2014)

New in PNG reference library 1.6.11 Beta 5 (Apr 28, 2014)

New in PNG reference library 1.6.11 Beta 4 (Apr 28, 2014)

New in PNG reference library 1.6.11 Beta 3 (Apr 28, 2014)

New in PNG reference library 1.6.11 Beta 2 (Apr 28, 2014)

New in PNG reference library 1.6.11 Beta 1 (Apr 28, 2014)

New in PNG reference library 1.6.10 (Apr 28, 2014)

Fixed a large number of instances where PNGCBAPI was omitted from function definitions.
Added pngimage test program for png_read_png() and png_write_png() with two new test scripts.
Removed dependence on !PNG_READ_EXPAND_SUPPORTED for calling png_set_packing() in png_read_png().
Fixed combination of ~alpha with shift. On read invert alpha, processing occurred after shift processing, which causes the final values to be outside the range that should be produced by the shift. Reversing the order on read makes the two transforms work together correctly and mirrors the order used on write.
Do not read invalid sBIT chunks. Previously libpng only checked sBIT values on write, so a malicious PNG writer could therefore cause the read code to return an invalid sBIT chunk, which might lead to application errors or crashes. Such chunks are now skipped (with chunk_benign_error).
Make png_read_png() and png_write_png() prototypes in png.h depend upon PNG_READ_SUPPORTED and PNG_WRITE_SUPPORTED.
Support builds with unsupported PNG_TRANSFORM_* values. All of the PNG_TRANSFORM_* values are always defined in png.h and, because they are used for both read and write in some cases, it is not reliable to #if out ones that are totally unsupported. This change adds error detection in png_read_image() and png_write_image() to do a png_app_error() if the app requests something that cannot be done and it adds corresponding code to pngimage.c to handle such options by not attempting to test them.
Moved redefines of png_error(), png_warning(), png_chunk_error(), and png_chunk_warning() from pngpriv.h to png.h to make them visible to libpng-calling applications.
Moved OS dependent code from arm/arm_init.c, to allow the included implementation of the ARM NEON discovery function to be set at build-time and provide sample implementations from the current code in the contrib/arm-neon subdirectory. The __linux__ code has also been changed to compile and link on Android by using /proc/cpuinfo, and the old linux code is in contrib/arm-neon/linux-auxv.c. The new code avoids POSIX and Linux dependencies apart from opening /proc/cpuinfo and is C90 compliant.
Check for info_ptr == NULL early in png_read_end() so we don't need to run all the png_handle_*() and depend on them to return if info_ptr == NULL. This improves the performance of png_read_end(png_ptr, NULL) and makes it more robust against future programming errors. Check for __has_extension before using it in pngconf.h, to support older Clang versions (Jeremy Sequoia).
Treat CRC error handling with png_set_crc_action(), instead of with png_set_benign_errors(), which has been the case since libpng-1.6.0beta18.
Use a user warning handler in contrib/gregbook/readpng2.c instead of default, so warnings will be put on stderr even if libpng has CONSOLE_IO disabled.
Added png_ptr->process_mode = PNG_READ_IDAT_MODE in png_push_read_chunk after recognizing the IDAT chunk, which avoids an infinite loop while reading a datastream whose first IDAT chunk is of zero-length. This fixes CERT VU#684412 and CVE-2014-0333.
Don't recognize known sRGB profiles as sRGB if they have been hacked, but don't reject them and don't issue a copyright violation warning.
Moved some documentation from png.h to libpng.3 and libpng-manual.txt
Minor editing of contrib/arm-neon/README and contrib/examples/*.c
Fixed typos in the manual and in scripts/pnglibconf.dfa (CFLAGS -> CPPFLAGS and PNG_USR_CONFIG -> PNG_USER_CONFIG).
Un-deprecated png_data_freer().

New in PNG reference library 1.6.10 Beta 2 (Mar 3, 2014)

New in PNG reference library 1.6.9 (Feb 7, 2014)

Bookkeeping: Moved functions around (no changes). Moved transform function definitions before the place where they are called so that they can be masde static. Move the intrapixel functions and the grayscale palette builder out of the png?tran.c files. The latter isn't a transform function and is no longer used internally, and the former MNG specific functions are better placed in pngread/pngwrite.c
Made transform implementation functions static. This makes the internal functions called by png_do_{read|write}_transformations static. On an x86-64 DLL build (Gentoo Linux) this reduces the size of the text segment of the DLL by 1208 bytes, about 0.6%. It also simplifies maintenance by removing the declarations from pngpriv.h and allowing easier changes to the internal interfaces.
Rebuilt configure scripts with automake-1.14.1 and autoconf-2.69 in the tar distributions.
Added checks for libpng 1.5 to pngvalid.c. This supports the use of this version of pngvalid in libpng 1.5
Merged with pngvalid.c from libpng-1.7 changes to create a single pngvalid.c
Removed #error macro from contrib/tools/pngfix.c (Thomas Klausner).
Merged pngrio.c, pngtrans.c, pngwio.c, and pngerror.c with libpng-1.7.0
Merged libpng-1.7.0 changes to make no-interlace configurations work with test programs.
Revised pngvalid.c to support libpng 1.5, which does not support the PNG_MAXIMUM_INFLATE_WINDOW option, so #define it out when appropriate in pngvalid.c
Allow unversioned links created on install to be disabled in configure. In configure builds 'make install' changes/adds links like png.h and libpng.a to point to the newly installed, versioned, files (e.g. libpng17/png.h and libpng17.a). Three new configure options and some rearrangement of Makefile.am allow creation of these links to be disabled.
Removed potentially misleading warning from png_check_IHDR().
Updated scripts/makefile.* to use CPPFLAGS (Cosmin).
Added clang attribute support (Cosmin).
Quiet an uninitialized memory warning from VC2013 in png_get_png().

New in PNG reference library 1.6.4 Beta 2 (Sep 12, 2013)

New in PNG reference library 1.6.4 Beta 1 (Sep 12, 2013)

New in PNG reference library 1.7.0 Beta 16 (Jul 25, 2013)

New in PNG reference library 1.7.0 Beta 15 (Jul 25, 2013)

New in PNG reference library 1.7.0 Beta 14 (Jul 25, 2013)

New in PNG reference library 1.6.3 (Jul 25, 2013)

New in PNG reference library 1.7.0 Beta 13 (May 21, 2013)

New in PNG reference library 1.6.3 Beta 6 (May 21, 2013)

New in PNG reference library 1.6.3 Beta 2 (Apr 27, 2013)

New in PNG reference library 1.7.0 Beta 10 (Apr 26, 2013)

New in PNG reference library 1.6.3 Beta 1 (Apr 26, 2013)

New in PNG reference library 1.6.2 (Apr 26, 2013)

New in PNG reference library 1.7.0 Beta 7 (Apr 18, 2013)

New in PNG reference library 1.6.2 RC 01 (Apr 18, 2013)

New in PNG reference library 1.6.1 (Mar 29, 2013)

Made symbol prefixing work with the ARM neon optimizations. Also allow pngpriv.h to be included for preprocessor definitions only, so it can be used in non-C/C++ files.
Back ported from libpng 1.7.
Made sRGB check numbers consistent.
Ported libpng 1.5 options.awk/dfn file handling to 1.6, fixed one bug.
Removed cc -E workround, corrected png_get_palette_max API Tested on SUN OS cc 5.9, which demonstrates the tokenization problem previously avoided by using /lib/cpp. Since all .dfn output is now protected in double quotes unless it is to be macro substituted the fix should work everywhere.
Enabled parallel tests - back ported from libpng-1.7. scripts/pnglibconf.dfa formatting improvements back ported from libpng17.
Fixed a race condition in the creation of the build 'scripts' directory while building with a parallel make.
Use approved/supported Android method to check for NEON, use Linux/POSIX 1003.1 API to check /proc/self/auxv avoiding buffer allocation and other library calls (ported from libpng15). Use parentheses more consistently in "#if defined(MACRO)" tests.
Folded long lines.
Reenabled code to allow zero length PLTE chunks for MNG. Fixed ALIGNED_MEMORY support.
Allow run-time ARM NEON checking to be disabled.
A new configure option: --enable-arm-neon=always will stop the run-time checks.
New checks within arm/arm_init.c will cause the code not to be compiled unless __ARM_NEON__ is set. This should make it fail safe (if someone asks for it on then the build will fail if it can't be done.)
Updated the INSTALL document.
Revised INSTALL to recommend using CPPFLAGS instead of INCLUDES. Revised scripts/makefile.freebsd to respect ZLIBLIB and ZLIBINC.
Revised scripts/dfn.awk to work with the buggy MSYS awk that has trouble with CRLF line endings.
Avoid a possible memory leak in contrib/gregbook/readpng.c
Better documentation of unknown handling API interactions.
Corrected Android builds and corrected libpng.vers with symbol prefixing This adds an API to set optimization options externally, providing an alternative and general solution for the non-portable run-time tests used by the ARM Neon code. It also makes those tests compile and link on Android.
The order of settings vs options in pnglibconf.h is reversed to allow settings to depend on options and options can now set (or override) the defaults for settings.
Corrected simplified API default gamma for color-mapped output, added a flag to change default. In 1.6.0 when the simplified API was used to produce color-mapped output from an input image with no gamma information the gamma assumed for the input could be different from that assumed for non-color-mapped output. In particular 16-bit depth input files were assumed to be sRGB encoded, whereas in the 'direct' case they were assumed to have linear data. This was an error. The fix makes the simplified API treat all input files the same way and adds a new flag to the png_image::flags member to allow the application/user to specify that 16-bit files contain sRGB data rather than the default linear.
Fixed bugs in the pngpixel and makepng test programs.
Fixed CMakelists.txt to allow building a single variant of the library
Introduced a PNG_LIB_TARGETS variable that lists all activated library targets. It is an error if this variable ends up empty, ie. you have to build at least one library variant.
Made the *_COPY targets only depend on library targets actually being build. Use PNG_LIB_TARGETS to unify a code path.
Changed the CREATE_SYMLINK macro to expect the full path to a file as the first argument. When symlinking the filename component of that path is determined and used as the link target. Use copy_if_different in the CREATE_SYMLINK macro.
Eliminated two warnings from the Intel C compiler. The warnings are technically valid, although a reasonable treatment of division would show it to be incorrect.

New in PNG reference library 1.7.0 Beta 6 (Mar 14, 2013)

New in PNG reference library 1.7.0 Beta 5 (Mar 5, 2013)

New in PNG reference library 1.7.0 Beta 4 (Mar 1, 2013)

New in PNG reference library 1.7.0 Beta 3 (Feb 27, 2013)

New in PNG reference library 1.7.0 Beta 2 (Feb 20, 2013)

New in PNG reference library 1.7.0 Beta 1 (Feb 18, 2013)

Enable parallel tests and rearrange TESTS order to take advantage of the massive speed improvements use a make capable of parallel builds on a multi-CPU machine and pass the right arguments to make (-j10000 for GNU make) to get the build to run in parallel.
Fixed previous support for Z_PREFIX in configure builds, corrected sCAL APIs; some of these use floating point arithmetic so need to be disabled if floating point arithmetic is switched off.
This is a quiet API change - previously it appeared that the APIs were supported if fixed point arithmetic was used internally, however they required certain APIs (floor, modf, frexp, atof) that are part of C floating point support.
Changed png_fixed and the gamma code specific version of the same to avoid floor(), which may be a library function (not an intrinsic).
Removed unused #if 0 code.
Fixed make distcheck to skip over the test result files. They were being included because the whole of the 'tests' directory is included, fixed to just include the actual test files and tests/pngstest.
Also reverted the previous erroneous change to remove the ${srcdir} from the front of contrib, scripts, projects and added an explanation of what is going on to Makefile.am
Fixed missing dependency in --prefix builds. The intermediate internal 'prefix.h' file can only be generated correctly after pnglibconf.h, however the dependency was not in Makefile.am.
The symptoms are unpredictable depending on the order make chooses to build pngprefix.h and pnglibconf.h, often the error goes unnoticed because there is a system pnglibconf.h to use instead. Accept "," as a separator in pnglibconf.dfa and allow for continuation lines.
This adds to the syntax of "option" and "chunk" lines, allowing the elements to be separated by a "," at the end of an element and interpreting a "," at end of line as a continuation - so the following line is read. The new syntax is optional and solely provided for readability.
Enclosed the new png_get_palette_max in #ifdef PNG_GET_PALETTE_MAX_SUPPORTED block, and revised pnglibconf.h and pnglibconf.h.prebuilt accordingly.

New in PNG reference library 1.6.0 (Feb 14, 2013)

Removed machine-generated configure files from the GIT repository (they will continue to appear in the tarball distributions and in the libpng15 and earlier GIT branches).
Restored the new 'simplified' API, which was started in libpng-1.5.7beta02 but later deleted from libpng-1.5.7beta05.
Added example programs and test program pngstest for the new 'simplified' API.
Added ANSI-C (C90) headers and require them, and take advantage of the change.
Also fixed some of the projects/* and contrib/* files that needed updates for libpng16 and the move of pngvalid.c. With this change the required ANSI-C header files are assumed to exist: the implementation must provide float.h, limits.h, stdarg.h and stddef.h and libpng relies on limits.h and stddef.h existing and behaving as defined (the other two required headers aren't used).
Non-ANSI systems that don't have stddef.h or limits.h will have to provide an appropriate fake containing the relevant types and #defines.
The use of FAR/far has been eliminated and the definition of png_alloc_size_t is now controlled by a flag so that 'small size_t' systems can select it if necessary.
Libpng 1.6 may not currently work on such systems -- it seems likely that it will ask 'malloc' for more than 65535 bytes with any image that has a sufficiently large row size (rather than simply failing to read such images). New tools directory containing tools used to generate libpng code.
Fixed race conditions in parallel make builds. With higher degrees of parallelism during 'make' the use of the same temporary file names such as 'dfn*' can result in a race where a temporary file from one arm of the build is deleted or overwritten in another arm. This changes the temporary files for suffix rules to always use $* and ensures that the non-suffix rules use unique file names.
Correct configure builds where build and source directories are separate. The include path of 'config.h' was erroneously made relative in pngvalid.c in libpng 1.5.7. Start-up code size improvements, error handler flexibility.
These changes alter how the tricky allocation of the initial png_struct and png_info structures are handled. png_info is now handled in pretty much the same way as everything else, except that the allocations handle NULL return silently. png_struct is changed in a similar way on allocation and on deallocation a 'safety' error handler is put in place (which should never be required).
The error handler itself is changed to permit mismatches in the application and libpng error buffer size; however, this means a silent change to the API to return the jmp_buf if the size doesn't match the size from the libpng compilation; libpng now allocates the memory and this may fail.
Overall these changes result in slight code size reductions; however, this is a reduction in code that is always executed so is particularly valuable.
Overall on a 64-bit system the libpng DLL decreases in code size by 1733 bytes. pngerror.o increases in size by about 465 bytes because of the new functionality.
Added png_convert_to_rfc1123_buffer() and deprecated png_convert_to_rfc1123() to avoid including a spurious buffer in the png_struct. Regenerated configure scripts with automake-1.11.2 Eliminated png_info_destroy(). It is now used only in png.c and only calls one other internal function and memset(). Enabled png_get_sCAL_fixed() if floating point APIs are enabled.
Previously it was disabled whenever internal fixed point arithmetic was selected, which meant it didn't exist even on systems where FP was available but not preferred.
Added pngvalid.c compile time checks for const APIs. Implemented 'restrict' for png_info and png_struct.
Because of the way libpng works both png_info and png_struct are always accessed via a single pointer. This means adding C99 'restrict' to the pointer gives the compiler some opportunity to optimize the code. This change allows that.
Moved AC_MSG_CHECKING([if libraries can be versioned]) later to the proper location in configure.ac.
Changed png_memcpy to C assignment where appropriate.
Changed all those uses of png_memcpy that were doing a simple assignment to assignments (all those cases where the thing being copied is a non-array C L-value).
Added some error checking to png_set_*() routines.
Removed the reference to the non-exported function png_memcpy() from example.c.
Fixed the Visual C 64-bit build - it requires jmp_buf to be aligned, but it had become misaligned. Revised contrib/pngminus/pnm2png.c to avoid warnings when png_uint_32 and unsigned long are of different sizes.
Updated manual with description of the simplified API.
Fix bug in pngerror.c: some long warnings were being improperly truncated (CVE-2011-3464, bug introduced in libpng-1.5.4).
Increased the formatted warning buffer to 192 bytes.
Fixed Min/GW uninstall to remove libpng.dll.a
Eliminated Intel icc/icl compiler warnings.
The Intel (GCC derived) compiler issues slightly different warnings from those issued by the current versions of GCC.
This eliminates those warnings by adding/removing casts and small code rewrites. Updated configure.ac from autoupdate: added --enable-werror option.
Also some layout regularization and removal of introduced tab characters (replaced with 3-character indentation).
Obsolete macros identified by autoupdate have been removed; the replacements are all in 2.59 so the pre-req hasn't been changed. --enable-werror checks for support for -Werror (or the given argument) in the compiler.
This mimics the gcc configure option by allowing -Werror to be turned on safely; without the option the tests written in configure itself fail compilation because they cause compiler warnings.
Rewrote autogen.sh to run autoreconf instead of running tools one-by-one.
Conditionalize the install rules for MINGW and CYGWIN in CMakeLists.txt and set CMAKE_LIBRARY_OUTPUT_DIRECTORY to "lib" on all platforms (C. Yapp). Freeze libtool files in the 'scripts' directory.
This version of autogen.sh attempts to dissuade people from running it when it is not, or should not, be necessary. In fact, autogen.sh does not work when run in a libpng directory extracted from a tar distribution anymore. You must run it in a GIT clone instead.
Added two images to contrib/pngsuite (1-bit and 2-bit transparent grayscale), and renamed three whose names were inconsistent with those in pngsuite/README.txt.
Check libtool/libtoolize version number (2.4.2) in configure.ac
Moved automake options to AM_INIT_AUTOMAKE in configure.ac
Added color-tests, silent-rules (Not yet implemented in Makefile.am) and version checking to configure.ac Cleaned up pngpriv.h to consistently declare all functions and data.
Also eliminated PNG_CONST_DATA, which is apparently not needed but we can't be sure until it is gone.
Added symbol prefixing that allows all the libpng external symbols to be prefixed. Updated "ftbb*.png" list in the owatcom and vstudio projects.
Added Z_SOLO for zlib-1.2.6+ and correct pngstest tests
Revised INSTALL information about autogen.sh. Updated list of test images in CMakeLists.txt Corrected estimate of error in libpng png_set_rgb_to_gray API.
The API is extremely inaccurate for sRGB conversions because it uses an 8-bit intermediate linear value and it does not use the sRGB transform, so it suffers from the known instability in gamma transforms for values close to 0 (see Poynton).
The net result is that the calculation has a maximum error of 14.99/255; 0.5/255^(1/2.2). pngstest now uses 15 for the permitted 8-bit error.
This may still not be enough because of arithmetic error. Removed some unused arrays (with #ifdef) from png_read_push_finish_row(). Fixed a memory overwrite bug in simplified read of RGB PNG with non-linear gamma
Also bugs in the error checking in pngread.c and changed quite a lot of the checks in pngstest.c to be correct; either correctly written or not over-optimistic.
The pngstest changes are insufficient to allow all possible RGB transforms to be passed; pngstest cmppixel needs to be rewritten to make it clearer which errors it allows and then changed to permit known inaccuracies.
Removed tests for no-longer-used *_EMPTY_PLTE_SUPPORTED from pngstruct.h
Fixed fixed/float API export conditionals. 1) If FIXED_POINT or FLOATING_POINT options were switched off, png.h ended up with lone ';' characters.
This is not valid ANSI-C outside a function. The ';' characters have been moved inside the definition of PNG_FP_EXPORT and PNG_FIXED_EXPORT. 2) If either option was switched off, the declaration of the corresponding functions were completely omitted, even though some of them are still used internally.
The result is still valid, but produces warnings from gcc with some warning options (including -Wall).
The fix is to cause png.h to declare the functions with PNG_INTERNAL_FUNCTION when png.h is included from pngpriv.h. Check for invalid palette index while reading paletted PNG.
When one is found, issue a warning.
Fixed CVE-2011-3026 buffer overrun bug. Deal more correctly with the test on iCCP chunk length.
Also removed spurious casts that may hide problems on 16-bit systems.
Eliminated redundant png_push_read_tEXt|zTXt|iTXt|unknown code from pngpread.c and use the sequential png_handle_tEXt, etc., in pngrutil.c; now that png_ptr->buffer is inaccessible to applications, the special handling is no longer useful.
Added PNG_SAFE_LIMITS feature to pnglibconf.dfa, pngpriv.h, and new pngusr.dfa to reset the user limits to safe ones if PNG_SAFE_LIMITS is defined.
To enable, use "CPPFLAGS=-DPNG_SAFE_LIMITS_SUPPORTED=1" on the configure command or put #define PNG_SAFE_LIMITS_SUPPORTED in pnglibconf.h.prebuilt and pnglibconf.h.
Added information about the new limits in the manual.
Removed unused "current_text" members of png_struct and the png_free() of png_ptr->current_text from pngread.c
Added PNG_IMAGE_FLAG_FAST for the benefit of applications that store intermediate files, or intermediate in-memory data, while processing image data with the simplified API.
The option makes the files larger but faster to write and read. pngstest now uses this by default; this can be disabled with the --slow option.
Improved pngstest fine tuning of error numbers, new test file generator.
The generator generates images that test the full range of sample values, allow the error numbers in pngstest to be tuned and checked. makepng also allows generation of images with extra chunks, although this is still work-in-progress.
Fixed some bugs in ICC profile writing. The code should now accept all potentially valid ICC profiles and reject obviously invalid ones.
It now uses png_error() to do so rather than casually writing a PNG without the necessary color data.
Removed whitespace from the end of lines in all source files and scripts.
Added tests for invalid palette index while reading and writing.
Changed png_inflate() and calling routines to avoid overflow problems. This is an intermediate check-in that solves the immediate problems and introduces one performance improvement (avoiding a copy via png_ptr->zbuf.)
Further changes will be made to make ICC profile handling more secure.
Added contrib/libtests/tarith.c to test internal arithmetic functions from png.c.
This is a libpng maintainer program used to validate changes to the internal arithmetic functions. Made read 'inflate' handling like write 'deflate' handling.
The read code now claims and releases png_ptr->zstream, like the write code.
The bug whereby the progressive reader failed to release the zstream is now fixed, all initialization is delayed, and the code checks for changed parameters on deflate rather than always calling deflatedEnd/deflateInit.
Validate the zTXt strings in pngvalid.
Added code to validate the windowBits value passed to deflateInit2(). If the call to deflateInit2() is wrong a png_warning will be issued (in fact this is harmless, but the PNG data produced may be sub-optimal).
Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition. Reject all iCCP chunks after the first, even if the first one is invalid.
Deflate/inflate was reworked to move common zlib calls into single functions [rw]util.c.
A new shared keyword check routine was also added and the 'zbuf' is no longer allocated on progressive read. It is now possible to call png_inflate() incrementally. If benign errors are disabled use maximum window on ancilliary inflate.
This works round a bug introduced in 1.5.4 where compressed ancillary chunks could end up with a too-small windowBits value in the deflate header.
Issue a png_benign_error() instead of png_warning() about bad palette index. In pngtest, treat benign errors as errors if "-strict" is present.
Fixed a compiler warning under Cygwin (Windows-7, 32-bit system)
Revised example.c to put text strings in a temporary character array instead of directly assigning string constants to png_textp members. This avoids compiler warnings when -Wwrite-strings is enabled.
Added output flushing to aid debugging under Visual Studio. Unfortunately this is necessary because the VS2010 output window otherwise simply loses the error messages on error (they weren't flushed to the window before the process exited, apparently!)
Added configuration support for benign errors and changed the read default.
Also changed some warnings in the iCCP and sRGB handling from to benign errors.
Configuration now makes read benign errors warnings and write benign errors to errors by default (thus changing the behavior on read).
The simplified API always forces read benign errors to warnings (regardless of the system default, unless this is disabled in which case the simplified API can't be built.) Work around for duplicate row start calls; added warning messages.
This turns on PNG_FLAG_DETECT_UNINITIALIZED to detect app code that fails to call one of the 'start' routines (not enabled in libpng-1.5 because it is technically an API change, since it did normally work before.)
It also makes duplicate calls to png_read_start_row (an internal function called at the start of the image read) benign, as they were before changes to use png_inflate_claim.
Somehow webkit is causing this to happen; this is probably a mis-feature in the zlib changes so this commit is only a work-round.
Removed erroneous setting of DETECT_UNINITIALIZED and added more checks.
The code now does a png_error if an attempt is made to do the row initialization twice; this is an application error and it has serious consequences because the transform data in png_struct is changed by each call.
Added application error reporting and added chunk names to read benign errors; also added --strict to pngstest - not enabled yet because a warning is produced.
Avoid the double gamma correction warning in the simplified API. This allows the --strict option to pass in the pngstest checks
Changed chunk handler warnings into benign errors, incrementally load iCCP
Added checksum-icc.c to contrib/tools Prevent PNG_EXPAND+PNG_SHIFT doing the shift twice.
Recognize known sRGB ICC profiles while reading; prefer writing the iCCP profile over writing the sRGB chunk, controlled by the PNG_sRGB_PROFILE_CHECKS option.
Revised png_set_text_2() to avoid potential memory corruption (fixes CVE-2011-3048).
Revised scripts/makefile.darwin: use system zlib; remove quotes around architecture list; add missing ppc architecture; add architecture options to shared library link; don't try to create a shared lib based on missing RELEASE variable.
Enable png_set_check_for_invalid_index() for both read and write. Removed #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED in pngpriv.h around declaration of png_handle_unknown().
Added -lssp_nonshared in a comment in scripts/makefile.freebsd and changed deprecated NOOBJ and NOPROFILE to NO_OBJ and NO_PROFILE.
Removed need for -Wno-cast-align with clang. clang correctly warns on alignment increasing pointer casts when -Wcast-align is passed.
This fixes the cases that clang warns about either by eliminating the casts from png_bytep to png_uint_16p (pngread.c), or, for pngrutil.c where the cast is previously verified or pngstest.c where it is OK, by introducing new png_aligncast macros to do the cast in a way that clang accepts.
Revised CMakeLists.txt to not attempt to make a symlink under mingw. Made fixes for new optimization warnings from gcc 4.7.0.
The compiler performs an optimization which is safe; however it then warns about it.
Changing the type of 'palette_number' in pngvalid.c removes the warning. Do not depend upon a GCC feature macro being available for use in generating the linker mapfile symbol prefix.
Improved performance of new do_check_palette_indexes() function (only update the value when it actually increases, move test for whether the check is wanted out of the function.
Don't check palette indexes if num_palette is 0 (as it can be in MNG files).
Revised png_set_keep_unknown_chunks() so num_chunks < 0 means ignore all unknown chunks and all known chunks except for IHDR, PLTE, tRNS, IDAT, and IEND.
Previously it only meant ignore all unknown chunks, the same as num_chunks == 0. Revised png_image_skip_unused_chunks() to provide a list of chunks to be processed instead of a list of chunks to ignore.
Revised contrib/gregbook/readpng2.c accordingly.
Removed scripts/makefile.cegcc from the *.zip and *.7z distributions; it depends on configure, which is not included in those archives.
Moved scripts/chkfmt to contrib/tools. Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386. Do not compile PNG_DEPRECATED, PNG_ALLOC and PNG_PRIVATE when __GNUC__ < 3. Do not use __restrict when GNUC is signature[8] from WRITE-only builds.
Add some conditions for compiling png_fixed(). This is a small function but it requires "-lm" on some platforms.
Cause pngtest --strict to fail on any warning from libpng (not just errors) and cause it not to fail at the comparison step if libpng lacks support for writing chunks that it reads from the input (currently only implemented for compressed text chunks).
Make all three "make check" test programs work without READ or WRITE support. Now "make check" will succeed even if libpng is compiled with -DPNG_NO_READ or -DPNG_NO_WRITE. The tests performed are reduced, but the basic reading and writing of a PNG file is always tested by one or more of the tests.
Consistently use strlen(), memset(), memcpy(), and memcmp() instead of the png_strlen(), png_memset(), png_memcpy(), and png_memcmp() macros.
Removed the png_sizeof(), png_strlen(), png_memset(), png_memcpy(), and png_memcmp() macros. Work around gcc 3.x and Microsoft Visual Studio 2010 complaints. Both object to the split initialization of num_chunks.
Unknown handling fixes and clean up. This adds more correct option control of the unknown handling, corrects the pre-existing bug where the per-chunk 'keep' setting is ignored and makes it possible to skip IDAT chunks in the sequential reader (broken in earlier 1.6 versions). There is a new test program, test-unknown.c, which is a work in progress (not currently part of the test suite).
Comments in the header files now explain how the unknown handling works. Allow fine grain control of unknown chunk APIs. This change allows png_set_keep_unknown_chunks() to be turned off if not required and causes both read and write to behave appropriately (on read this is only possible if the user callback is used to handle unknown chunks).
The change also removes the support for storing unknown chunks in the info_struct if the only unknown handling enabled is via the callback, allowing libpng to be configured with callback reading and none of the unnecessary code. Corrected fix for unknown handling in pngtest. This reinstates the libpng handling of unknown chunks other than vpAg and sTER (including unsafe-to-copy chunks which were dropped before) and eliminates the repositioning of vpAg and sTER in pngtest.png by changing pngtest.png (so the chunks are where libpng would put them).
Added "tunknown" test and corrected a logic error in png_handle_unknown() when SAVE support is absent.
Moved the shell test scripts for contrib/libtests from the libpng top directory to contrib/libtests. png_handle_unknown() must always read or skip the chunk, if SAVE_UNKNOWN_CHUNKS is turned off *and* the application does not set a user callback an unknown chunk will not be read, leading to a read error, which was revealed by the "tunknown" test.
Cleaned up and corrected ICC profile handling. contrib/libtests/makepng: corrected 'rgb' and 'gray' cases. profile_error messages could be truncated; made a correct buffer size calculation and adjusted pngerror.c appropriately. png_icc_check_* checking improved; changed the functions to receive the correct color type of the PNG on read or write and check that it matches the color space of the profile (despite what the comments said before, there is danger in assuming the app will cope correctly with an RGB profile on a grayscale image and, since it violates the PNG spec, allowing it is certain to produce inconsistent app behavior and might even cause app crashes.) Check that profiles contain the tags needed to process the PNG (tags all required by the ICC spec).
Removed unused PNG_STATIC from pngpriv.h.
Fixed the simplified API example programs and improved the error message if the version field is not set. Updated simplified API synopses and description of the png_image structure in the manual.
Made makepng and pngtest produce identical PNGs, add "--relaxed" option to pngtest.
The "--relaxed" option turns off the benign errors that are enabled by default in pre-RC builds. makepng can now write ICC profiles where the length has not been extended to a multiple of 4, and pngtest now intercepts all libpng errors, allowing the previously-introduced "--strict test" on no warnings to actually work.
Added a work around for GCC 4.2 optimization bug.
Marked the broken (bad white point) original HP sRGB profiles correctly and correct comments.
Added -DZ_SOLO to contrib/pngminim/*/makefile to work with zlib-1.2.7 Use /MDd for vstudio debug builds.
Also added pngunkown to the vstudio builds, fixed build errors and corrected a minor exit code error in pngvalid if the 'touch' file name is invalid.
Add updated WARNING file to projects/vstudio from libpng 1.5/vstudio
Fixed build when using #define PNG_NO_READ_GAMMA in png_do_compose() in pngrtran.c. Made pngvalid so that it will build outside the libpng source tree.
Made PNG_NO_READ_GAMMA switch off interfaces that depend on READ_GAMMA.
Prior to 1.6.0 switching off READ_GAMMA did unpredictable things to the interfaces that use it (specifically, png_do_background in 1.4 would simply display composite for grayscale images but do composition with the incorrect arithmetic for color ones).
In 1.6 the semantic of -DPNG_NO_READ_GAMMA is changed to simply disable any interface that depends on it; this obliges people who set it to consider whether they really want it off if they happen to use any of the interfaces in question (typically most users who disable it won't).
Added the ability for contrib/libtests/makepng.c to make a PNG with just one color. This is useful for debugging pngstest color inaccuracy reports.
Made png_user_version_check() ok to use with libpng version 1.10.x and later.
Fixed typo in png.c (PNG_SET_CHUNK_MALLOC_MAX should be PNG_CHUNK_MALLOC_MAX) that causes the MALLOC_MAX limit not to work
Change png_warning() to png_app_error() in pngwrite.c and comment the fall-through condition.
Change png_warning() to png_app_warning() in png_write_tRNS(). Rearranged the ARM-NEON optimizations: Isolated the machine specific code to the hardware subdirectory and added comments to pngrutil.c so that implementors of other optimizations know what to do.
Fixed cases of unquoted DESTDIR in Makefile.am
Cleaned up whitespace in the synopsis portion of the manpage "libpng.3"
Made default Zlib compression settings be configurable. This adds #defines to pnglibconf.h to control the defaults.
Fixed Windows build issues, enabled ARM compilation.
Various warnings issued by earlier versions of GCC fixed for Cygwin and Min/GW (which both use old GCCs.)
ARM support is enabled by default in zlib.props (unsupported by Microsoft) and ARM compilation is made possible by deleting the check for x86. The test programs cannot be run because they are not signed.
Discontinued distributing libpng-1.x.x.tar.bz2. Discontinued distributing libpng-1.7.0-1.6.0-diff.txt and similar.
Rebuilt Makefile.in, configure, etc., with autoconf-2.69 and automake-1.12.5.
Fixed 'make distcheck' on SUN OS - libpng.so was not being removed
Fixed conceivable but difficult to repro overflow.
Also added two test programs to generate and test a PNG which should have the problem.
Added overflow detection in png_set_sPLT() and png_set_text_2().
Use consistent handling of overflows in text, sPLT and unknown png_set_* APIs
Added png_get_palette_max() function.
Fixed missing dependency in --prefix builds
The intermediate internal 'prefix.h' file can only be generated correctly after pnglibconf.h, however the dependency was not in Makefile.am.
The symptoms are unpredictable depending on the order make chooses to build pngprefix.h and pnglibconf.h, often the error goes unnoticed because there is a system pnglibconf.h to use instead.
Enclosed the new png_get_palette_max in #ifdef PNG_GET_PALETTE_MAX_SUPPORTED block, and revised pnglibconf.h and pnglibconf.h.prebuilt accordingly.

New in PNG reference library 1.6.0 RC 8 (Feb 11, 2013)

New in PNG reference library 1.6.0 RC 7 (Feb 11, 2013)

New in PNG reference library 1.6.0 RC 6 (Feb 11, 2013)

New in PNG reference library 1.7.0 Alpha 10 (Feb 9, 2013)

New in PNG reference library 1.5.15 Beta 3 (Feb 9, 2013)

New in PNG reference library 1.5.15 Beta 2 (Feb 6, 2013)

New in PNG reference library 1.6.0 RC 2 (Feb 5, 2013)

New in PNG reference library 1.5.15 Beta 1 (Feb 5, 2013)

New in PNG reference library 1.5.14 (Jan 24, 2013)

New in PNG reference library 1.7.0 Alpha 9 (Jan 23, 2013)

New in PNG reference library 1.7.0 Alpha 8 (Jan 23, 2013)

New in PNG reference library 1.7.0 Alpha 7 (Jan 23, 2013)

New in PNG reference library 1.6.0 Beta 40 (Jan 23, 2013)

New in PNG reference library 1.6.0 Beta 39 (Jan 23, 2013)

New in PNG reference library 1.6.0 Beta 37 (Jan 23, 2013)

New in PNG reference library 1.6.0 Beta 36 (Jan 23, 2013)

New in PNG reference library 1.5.14 RC 3 (Jan 23, 2013)

New in PNG reference library 1.5.14 RC 2 (Jan 23, 2013)

New in PNG reference library 1.7.0 Alpha 4 (Dec 27, 2012)

New in PNG reference library 1.7.0 Alpha 3 (Dec 27, 2012)

New in PNG reference library 1.7.0 Alpha 2 (Dec 27, 2012)

New in PNG reference library 1.7.0 Alpha 1 (Dec 17, 2012)

New in PNG reference library 1.6.0 Beta 33 (Dec 17, 2012)

New in PNG reference library 1.5.14 Beta 3 (Dec 17, 2012)

New in PNG reference library 1.6.0 Beta 30 (Oct 25, 2012)

New in PNG reference library 1.5.14 Beta 1 (Oct 25, 2012)

New in PNG reference library 1.5.13 (Sep 27, 2012)

New in PNG reference library 1.5.13 Beta 2 (Sep 17, 2012)

New in PNG reference library 1.6.0 Beta 29 (Sep 5, 2012)

New in PNG reference library 1.6.0 Beta 28 (Aug 30, 2012)

Unknown handling fixes and clean up.
This adds more correct option control of the unknown handling, corrects the pre-existing bug where the per-chunk 'keep' setting is ignored and makes it possible to skip IDAT chunks in the sequential reader (broken in earlier 1.6 versions).
There is a new test program, test-unknown.c, which is a work in progress (not currently part of the test suite).
Comments in the header files now explain how the unknown handling works. Allow fine grain control of unknown chunk APIs.
This change allows png_set_keep_unknown_chunks() to be turned off if not required and causes both read and write to behave appropriately (on read this is only possible if the user callback is used to handle unknown chunks). The change also removes the support for storing unknown chunks in the info_struct if the only unknown handling enabled is via the callback, allowing libpng to be configured with callback reading and none of the unnecessary code.
Corrected fix for unknown handling in pngtest. This reinstates the libpng handling of unknown chunks other than vpAg and sTER (including unsafe-to-copy chunks which were dropped before) and eliminates the repositioning of vpAg and sTER in pngtest.png by changing pngtest.png (so the chunks are where libpng would put them).
Added "tunknown" test and corrected a logic error in png_handle_unknown() when SAVE support is absent.
Moved the shell test scripts for contrib/libtests from the libpng top directory to contrib/libtests. png_handle_unknown() must always read or skip the chunk, if SAVE_UNKNOWN_CHUNKS is turned off *and* the application does not set a user callback an unknown chunk will not be read, leading to a read error, which was revealed by the "tunknown" test.
Cleaned up and corrected ICC profile handling. contrib/libtests/makepng: corrected 'rgb' and 'gray' cases. profile_error messages could be truncated; made a correct buffer size calculation and adjusted pngerror.c appropriately. png_icc_check_* checking improved; changed the functions to receive the correct color type of the PNG on read or write and check that it matches the color space of the profile (despite what the comments said before, there is danger in assuming the app will cope correctly with an RGB profile on a grayscale image and, since it violates the PNG spec, allowing it is certain to produce inconsistent app behavior and might even cause app crashes.) Check that profiles contain the tags needed to process the PNG (tags all required by the ICC spec).
Removed unused PNG_STATIC from pngpriv.h.

New in PNG reference library 1.6.0 Beta 27 (Aug 13, 2012)

New in PNG reference library 1.5.13 Beta 1 (Aug 9, 2012)

New in PNG reference library 1.5.12 (Jul 11, 2012)

New in PNG reference library 1.6.0 Beta 26 (Jul 11, 2012)

New in PNG reference library 1.6.0 Beta 25 (Jul 2, 2012)

New in PNG reference library 1.5.11 (Jun 15, 2012)

New in PNG reference library 1.6.0 Beta 24 (Jun 8, 2012)

New in PNG reference library 1.6.0 Beta 23 (Jun 7, 2012)

New in PNG reference library 1.5.11 RC 04 (Jun 7, 2012)

New in PNG reference library 1.5.11 RC 03 (Jun 5, 2012)

New in PNG reference library 1.5.11 RC 02 (May 30, 2012)

New in PNG reference library 1.6.0 Beta 22 (May 24, 2012)

New in PNG reference library 1.6.0 Beta 21 (May 23, 2012)

New in PNG reference library 1.5.10 (Mar 30, 2012)

New in PNG reference library 1.6.0 Beta 20 (Mar 30, 2012)

New in PNG reference library 1.6.0 Beta 19 (Mar 20, 2012)

New in PNG reference library 1.5.10 Beta 5 (Mar 17, 2012)

New in PNG reference library 1.6.0 Beta 18 (Mar 17, 2012)

New in PNG reference library 1.5.10 Beta 4 (Mar 10, 2012)

New in PNG reference library 1.6.0 Beta 17 (Mar 10, 2012)

New in PNG reference library 1.5.10 Beta 3 (Mar 8, 2012)

New in PNG reference library 1.6.0 Beta 16 (Mar 6, 2012)

New in PNG reference library 1.6.0 Beta 15 (Mar 6, 2012)

New in PNG reference library 1.6.0 Beta 14 (Mar 6, 2012)

New in PNG reference library 1.5.10 Beta 2 (Feb 27, 2012)

New in PNG reference library 1.6.0 Beta 13 (Feb 25, 2012)

New in PNG reference library 1.5.10 Beta 1 (Feb 25, 2012)

New in PNG reference library 1.5.9 (Feb 20, 2012)

New in PNG reference library 1.6.0 Beta 12 (Feb 18, 2012)

New in PNG reference library 1.5.9 RC 1 (Feb 18, 2012)

New in PNG reference library 1.6.0 Beta 11 (Feb 17, 2012)

Fix character count in pngstest command in projects/owatcom/pngstest.tgt Revised test-pngstest.sh to report PASS/FAIL for each image. Updated documentation about the simplified API. Corrected estimate of error in libpng png_set_rgb_to_gray API. The API is extremely inaccurate for sRGB conversions because it uses an 8-bit intermediate linear value and it does not use the sRGB transform, so it suffers from the known instability in gamma transforms for values close to 0 (see Poynton). The net result is that the calculation has a maximum error of 14.99/255; 0.5/255^(1/2.2). pngstest now uses 15 for the permitted 8-bit error. This may still not be enough because of arithmetic error. Removed some unused arrays (with #ifdef) from png_read_push_finish_row(). Fixed a memory overwrite bug in simplified read of RGB PNG with non-linear gamma Also bugs in the error checking in pngread.c and changed quite a lot of the checks in pngstest.c to be correct; either correctly written or not over-optimistic. The pngstest changes are insufficient to allow all possible RGB transforms to be passed; pngstest cmppixel needs to be rewritten to make it clearer which errors it allows and then changed to permit known inaccuracies. Removed tests for no-longer-used *_EMPTY_PLTE_SUPPORTED from pngstruct.h Fixed fixed/float API export conditionals. 1) If FIXED_POINT or FLOATING_POINT options were switched off, png.h ended up with lone ';' characters. This is not valid ANSI-C outside a function. The ';' characters have been moved inside the definition of PNG_FP_EXPORT and PNG_FIXED_EXPORT. 2) If either option was switched off, the declaration of the corresponding functions were completely omitted, even though some of them are still used internally. The result is still valid, but produces warnings from gcc with some warning options (including -Wall). The fix is to cause png.h to declare the functions with PNG_INTERNAL_FUNCTION when png.h is included from pngpriv.h. Check for invalid palette index while reading paletted PNG. When one is found, issue a warning and increase png_ptr->num_palette accordingly. Apps are responsible for checking to see if that happened.