CVS commit: pkgsrc/graphics/png

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Mon Jan 12 22:40:24 UTC 2026

Modified Files:
        pkgsrc/graphics/png: Makefile distinfo

Log Message:
png: update to 1.6.54.

Changes from version 1.6.53 to version 1.6.54
---------------------------------------------

 * Fixed CVE-2026-22695 (medium severity):
   Heap buffer over-read in `png_image_read_direct_scaled.
   (Reported and fixed by Petr Simecek.)
 * Fixed CVE-2026-22801 (medium severity):
   Integer truncation causing heap buffer over-read in `png_image_write_*`.
 * Implemented various improvements in oss-fuzz.
   (Contributed by Philippe Antoine.)


To generate a diff of this commit:
cvs rdiff -u -r1.218 -r1.219 pkgsrc/graphics/png/Makefile
cvs rdiff -u -r1.162 -r1.163 pkgsrc/graphics/png/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/png/Makefile
diff -u pkgsrc/graphics/png/Makefile:1.218 pkgsrc/graphics/png/Makefile:1.219
--- pkgsrc/graphics/png/Makefile:1.218  Tue Dec  9 10:39:35 2025
+++ pkgsrc/graphics/png/Makefile        Mon Jan 12 22:40:24 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.218 2025/12/09 10:39:35 nia Exp $
+# $NetBSD: Makefile,v 1.219 2026/01/12 22:40:24 wiz Exp $
 
-DISTNAME=      libpng-1.6.53
+DISTNAME=      libpng-1.6.54
 PKGNAME=       ${DISTNAME:S/lib//}
 CATEGORIES=    graphics
 MASTER_SITES+= ${MASTER_SITE_SOURCEFORGE:=libpng/}

Index: pkgsrc/graphics/png/distinfo
diff -u pkgsrc/graphics/png/distinfo:1.162 pkgsrc/graphics/png/distinfo:1.163
--- pkgsrc/graphics/png/distinfo:1.162  Sat Dec  6 17:35:34 2025
+++ pkgsrc/graphics/png/distinfo        Mon Jan 12 22:40:24 2026
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.162 2025/12/06 17:35:34 wiz Exp $
+$NetBSD: distinfo,v 1.163 2026/01/12 22:40:24 wiz Exp $
 
 BLAKE2s (apng-20250220.patch) = 456a8fcead8bb3fd29936de9a6288bef6769026ff2c955371db0c2098548d68b
 SHA512 (apng-20250220.patch) = 120ac618b60d5e1ff2406d241e4ddc2c1893978653adcf462ce394ce3b6b2e5847545e04b0fcb20aab563a1546017ce622d1d2dd14f89d1d594130d626f1e6eb
 Size (apng-20250220.patch) = 49281 bytes
-BLAKE2s (libpng-1.6.53.tar.xz) = db47868764d1367cf6d11a36bf8f366f50e236f849ec6e37d8e8dcfc0d9498d1
-SHA512 (libpng-1.6.53.tar.xz) = 569f81d57dcce7bb874a45fa9f8db2044585245d2eb0c0485a1b03c2e338ecaec6bfda3cb94ad2a34951997414c69fc0373c8c5852d6c313c03e8a946ff345c6
-Size (libpng-1.6.53.tar.xz) = 1063432 bytes
+BLAKE2s (libpng-1.6.54.tar.xz) = e42513eabc43dcfa49243094e41e98d5f1c7394bf37bb03347f6972595270fed
+SHA512 (libpng-1.6.54.tar.xz) = fc44530146af15c96232bf9954b9deda93d7bdd726c1a62685062f864215674fd3ae912e8eeafffc04329f2e802464262a8c4bca266ee7bc3559cdcd90eb785e
+Size (libpng-1.6.54.tar.xz) = 1064472 bytes
 SHA1 (patch-libpng-config.in) = 04f8d6af31114017ce9d1280e62f1768c35c289d
 SHA1 (patch-pngpriv.h) = 16f80df18a2f58eec784e2d821e8bb93c3e81747