mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-20 18:38:18 +00:00
Code Issues Projects Releases Wiki Activity

libpng: patch CVE-2026-33416 regression

Browse Source 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-33416

(From OE-Core rev: 333878e97547b6aeaa69691e4827af54ac838045)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Peter Marko authored and Paul Barker committed 2026-10-19 09:03:17 +01:00
1 parent c3c8f3e211
commit 25a3de31bc
2 files changed
+59
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta/recipes-multimedia/libpng/files/CVE-2026-33416-05.patch
+58
View File
@@ -0,0 +1,58 @@
From d4c4e49eb5c8981075ec2cd946428758c0cda6ac Mon Sep 17 00:00:00 2001
From: Cosmin Truta <ctruta@gmail.com>
Date: Wed, 15 Apr 2026 14:58:35 +0300
Subject: [PATCH] fix: Sync `info_ptr->palette` unconditionally after in-place
transforms
The palette sync in `png_read_transform_info` was guarded by
`if (transformations != 0)`, but the palette-modifying transforms clear
their own bits before this function gets to run. When one of these was
the sole transform, the guard was false and the sync was skipped, which
caused `png_get_PLTE` to return stale palette data.
Drop this guard.
This was a regression from commit c1b0318b39 (version 1.6.56).
Reported-by: ralfjunker <ralfjunker@users.noreply.github.com>
Resolves: https://github.com/pnggroup/libpng/issues/848
CVE: CVE-2026-33416
Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/d4c4e49eb5c8981075ec2cd946428758c0cda6ac]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
pngrtran.c | 20 ++++++++------------
1 file changed, 8 insertions(+), 12 deletions(-)
diff --git a/pngrtran.c b/pngrtran.c
index 1b04cafa5..0ac8df749 100644
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -1984,19 +1984,15 @@ png_read_transform_info(png_structrp png_ptr, png_inforp info_ptr)
{
png_debug(1, "in png_read_transform_info");
- if (png_ptr->transformations != 0)
+ if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
+ info_ptr->palette != NULL && png_ptr->palette != NULL)
{
- if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
- info_ptr->palette != NULL && png_ptr->palette != NULL)
- {
- /* Sync info_ptr->palette with png_ptr->palette.
- * The function png_init_read_transformations may have modified
- * png_ptr->palette in place (e.g. for gamma correction or for
- * background compositing).
- */
- memcpy(info_ptr->palette, png_ptr->palette,
- PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)));
- }
+ /* Sync info_ptr->palette with png_ptr->palette, which may
+ * have been modified by png_init_read_transformations
+ * (e.g. for gamma correction or background compositing).
+ */
+ memcpy(info_ptr->palette, png_ptr->palette,
+ PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)));
}
#ifdef PNG_READ_EXPAND_SUPPORTED
meta/recipes-multimedia/libpng/libpng_1.6.42.bb
+1
View File
@@ -31,6 +31,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/${BP}.tar.xz
file://CVE-2026-33416-04.patch \
file://CVE-2026-34757_p1.patch \
file://CVE-2026-34757_p2.patch \
file://CVE-2026-33416-05.patch \
"
SRC_URI[sha256sum] = "c919dbc11f4c03b05aba3f8884d8eb7adfe3572ad228af972bb60057bdb48450"