• https://downloads.sourceforge.net/sourceforge/libpng/ (Download)

• (2020-01-13) Updated to version: png-1.6.37
• (2017-10-27) Updated to version: png-1.6.34
• (2017-10-16) Updated to version: png-1.6.32
• (2017-08-12) Updated to version: png-1.6.31
• (2017-04-11) Updated to version: png-1.6.29
• (2017-01-19) Updated to version: png-1.6.28
• (2016-12-31) Updated to version: png-1.6.27
• (2016-11-02) Updated to version: png-1.6.26
• (2016-09-06) Updated to version: png-1.6.25
• (2016-08-21) Updated to version: png-1.6.24

Log message:
add debug for jpeg/png
okay sthen@

Log message:
replace simple PERMIT_PACKAGE_CDROM=Yes with PERMIT_PACKAGE=Yes

Log message:
security fix for CVE-2019-7317 (use-after-free in png_image_free)

Log message:
Security update of graphics/png to 1.6.37:
CVE-2019-7317: use-after-free in png_image_free()
Switch library soname from libpng16.so to libpng.so by changing the primary
name in the build.  Bump major version.
ok sthen@

Log message:
Update to png-1.6.35
ok jca@ naddy@ sthen@
patch sent upstream by tb@ to fix an implicit declaration warning

Log message:
Maintenance update to 1.6.31.  This adds eXIf chunk support.

Log message:
maintenance update to 1.6.29

Log message:
maintenance update to 1.6.28; from Brad

Log message:
security update to 1.6.27 for null pointer dereference bug

Log message:
security update to 1.6.27 for null-pointer-dereference bug; from Brad

Log message:
maintenance update to 1.6.26; from Brad

Log message:
update to libpng-1.6.25

Log message:
maintenance update to 1.6.24; from Brad

Log message:
maintenance update to 1.6.23 after Brad sent me an equivalent diff for .22

Log message:
garbage collect CONFIGURE_SHARED

Log message:
SECURITY update to 1.6.20:
Complete fix for CVE-2015-8126: buffer overflow in png_set_PLTE

Log message:
SECURITY update to 1.6.20:
Complete fix for CVE-2015-8126: buffer overflow in png_set_PLTE

Log message:
SECURITY update to 1.6.20:
Complete fix for CVE-2015-8126: buffer overflow in png_set_PLTE

Log message:
SECURITY update to 1.6.19:
Multiple buffer overflows in the png_set_PLTE and png_get_PLTE functions
CVE-2015-8126

Log message:
SECURITY update to 1.6.19:
Multiple buffer overflows in the png_set_PLTE and png_get_PLTE functions
CVE-2015-8126

Log message:
SECURITY update to 1.6.19:
Multiple buffer overflows in the png_set_PLTE and png_get_PLTE functions
CVE-2015-8126
ok sthen@

Log message:
explicitly replace symlink with file and use sed -i

Log message:
revert previous; libpng.la is a symlink and sed -i doesn't operate on these
(so build as-is fails), switching to operating on libpng16.la results in a
plist change, and the installed files from the previous package do actually
have a difference between libpng.la and libpng16.la(?!).

Log message:
sed -i

Log message:
maintenance update to 1.6.18; from Brad, carefully checked by yours truly

Log message:
maintenance update to 1.6.17; from Brad

Log message:
Update to png 1.6.16.
ok naddy@

Log message:
Update to png 1.6.15.
ok naddy@

Log message:
Update to png 1.6.14.
ok naddy@

Log message:
Update to png 1.6.13.
ok naddy@

Log message:
SECURITY update to png-1.5.4:
1. buffer overwrite in png_rgb_to_gray (CVE-2011-2690)
2. crash in png_default_error due to use of NULL Pointer (CVE-2011-2691)
3. memory corruption when handling empty sCAL chunks (CVE-2011-2692)

Log message:
Update to png 1.5.2.  Lots of improvements, but also significant
API incompatibility:
"The libpng 1.5.x series finally hides the contents of the venerable
and hoary png_struct and png_info data structures inside private
(i.e., non-installed) header files. Instead of direct struct-access,
applications should be using the various png_get_xxx() and png_set_xxx()
accessor functions, which have existed for almost as long as libpng
itself."

Log message:
Fix for CVE-2011-2501
libpng "png_format_buffer()" Denial of Service Vulnerability
from upstream git

Log message:
Fix for CVE-2011-2501
libpng "png_format_buffer()" Denial of Service Vulnerability
from upstream git

Log message:
Cope with bsd.man.mk changes and install source man pages.
While here, also update some PLISTs, fix PREFIX use, etc.
ok landry@

Log message:
ports that preformat man pages with mandoc via bsd.man.mk don't need groff

Log message:
USE_GROFF=Yes

Log message:
SECURITY FIX
Resolves CVE-2010-0205, CVE-2010-1205, and CVE-2010-2249
patches from upstream
started by stephan@ and reads fine to kili@ (thanks)

Log message:
SECRUTY update to 1.22.44
Fixes CVE-2010-1205.
ok naddy@

Log message:
maintenance update to 1.2.41

Log message:
minor maintenance update to 1.2.40

Log message:
maintenance update to 1.2.39

Log message:
security update to png-1.3.33p0; patches from debian
resolves CVE-2008-5907 and CVE-2009-0040

Log message:
Security update to 1.2.35: Fix an uninitialized data bug; CVE-2009-0040.

Log message:
update to 1.2.33, which fixes a minor memory leak

Log message:
Maintenance update to 1.2.32.
Library bump because png_struct has been extended.

Log message:
Update to 1.2.28 which fixes a number of "security and crash bugs".
Bump library version since struct png_struct has changed--this shouldn't be
used externally, but you never know.
ok bernd@

Log message:
tweak FAKE_FLAGS semantics to saner defaults.

Log message:
SECURITY update to 1.2.22.
Fixes a number of out-of-bounds reads in certain chunk-handlers.
CVE-2007-5266, CVE-2007-5267, CVE-2007-5268, CVE-2007-5269.

Log message:
maintenance update to 1.2.20

Log message:
remove surrounding quotes from COMMENT/BROKEN/PERMIT_*

Log message:
Fix a NULL pointer dereference vulnerability involving palette
images with a malformed tRNS chunk (CVE-2007-2445).
from steven

Log message:
Fix a NULL pointer dereference vulnerability involving palette
images with a malformed tRNS chunk (CVE-2007-2445).
from steven

Log message:
SECURITY update to 1.2.18:
Fix a NULL pointer dereference vulnerability involving palette
images with a malformed tRNS chunk (CVE-2007-2445).
ok steven@

Log message:
Hardcode our build options in pngconf.h so everything sees really the same
interface.  ok steven@

Log message:
base64 checksums.

Log message:
update to 1.2.16:
- minor bug fixes
- we now use the same API no matter whether asm optimizations are enabled
or not

Log message:
The libpng people re-rolled the distfile of png-1.2.14. They fixed
some fuckup in their autoconf stuff (which we don't use) and changed
dates in comments. Bump PKGNAME.
Noticed by aanriot@, thanks!

Log message:
Update to png-1.2.14.
'fine with me' steven@

Log message:
security fix
Libpng versions 1.0.6 through 1.2.12 can crash while decoding
the sPLT chunk.  This is due to an incorrect calculation of
the buffer size for storing the palette entries.
This bug has been given the identifier CVE-2006-3334.
from libpng via bernd@

Log message:
Security update to libpng-1.2.13. (CVE-2006-3334)
Libpng versions 1.0.6 through 1.2.12 can crash while decoding
the sPLT chunk.  This is due to an incorrect calculation of
the buffer size for storing the palette entries.
ok steven@

Log message:
security fix
Libpng versions 1.0.6 through 1.2.12 can crash while decoding
the sPLT chunk.  This is due to an incorrect calculation of
the buffer size for storing the palette entries.
This bug has been given the identifier CVE-2006-3334.
from libpng via bernd@

Log message:
MFC:
Fixes a buffer overflow vulnerability.
More information:
http://www.securityfocus.com/bid/18698/

Log message:
MFC:
Fixes a buffer overflow vulnerability.
More information:
http://www.securityfocus.com/bid/18698/

Log message:
Security update to png-1.2.12.
Fixes a buffer overflow vulnerability.
More information:
http://www.securityfocus.com/bid/18698/
ok steven@ naddy@

Log message:
We compile png with -DPNG_NO_ASSEMBLER_CODE. Unfortunately, the libpng build
system doesn't install a pngconf.h appropriate to the options passed to the
build.
So we have to put a PNG_NO_ASSEMBLER_CODE define into pngconf.h manually.
This unbreaks (at least) ImageMagick on amd64.
Some more information about this problem can be found here:
http://sourceforge.net/mailarchive/forum.php?thread_id=10314069&forum_id=43850
Since we don't want to compile pentium specific code,
remove -DPNG_USE_PNGGCCRD.
Bump major lib version and PKGNAME.
with help & ok steven@, naddy@

Log message:
Update to png-1.2.10 and better DESCR.
ok naddy@

Log message:
SHARED_LIBS
feedback and ok naddy@

Log message:
after querying brad@ he decided to drop maintainership for these.

Log message:
upgrade to png 1.2.8
From: Simon Dassow <janus at area319 dot de>

Log message:
this stuff builds without really installing it now.

Log message:
SIZE

Log message:
install pkgconfig file for png.
From: Jacob Meuser <jakemsr at jakemsr dot com>

Log message:
bad bad me, I managed to kill the PKGNAME with the previous commit
noticed by espie@

Log message:
upgrade to png 1.2.7

Log message:
new plists

Log message:
new plists

Log message:
Add pieces of the libpng jumbo security patch not already in the port.
http://www.us-cert.gov/cas/techalerts/TA04-217A.html

Log message:
Add pieces of the libpng jumbo security patch not already in the port.
http://www.us-cert.gov/cas/techalerts/TA04-217A.html

Log message:
Add pieces of the libpng jumbo security patch not already in the port.
http://www.us-cert.gov/cas/techalerts/TA04-217A.html

Log message:
more new PLISTs

Log message:
MFC:
- fix buffer overflows with 16-bit and greyscale samples, CAN-2002-1363.
- use upstream patch for older CAN-2004-0421 issue.
http://www.openpkg.org/security/OpenPKG-SA-2003.001-png.html
http://www.openpkg.org/security/OpenPKG-SA-2004.030-png.html

Log message:
MFC:
- fix buffer overflows with 16-bit and greyscale samples, CAN-2002-1363.
- use upstream patch for older CAN-2004-0421 issue.
http://www.openpkg.org/security/OpenPKG-SA-2003.001-png.html
http://www.openpkg.org/security/OpenPKG-SA-2004.030-png.html

Log message:
use upstream patch instead.

Log message:
fix buffer overflows with 16-bit and greyscale samples.
CAN-2002-1363
http://www.openpkg.org/security/OpenPKG-SA-2003.001-png.html
http://www.openpkg.org/security/OpenPKG-SA-2004.030-png.html

Log message:
better diff from openpkg

Log message:
sync

Log message:
Log message:
Fix for CAN-2004-0421:
Steve Grubb reports a buffer read overrun in libpng's
png_format_buffer function. A specially constructed PNG image
processed by an application using libpng may trigger the buffer
read overrun and possibly result in an application crash.
bump PKGNAME; ok brad@

Log message:
Fix for CAN-2004-0421:
Steve Grubb reports a buffer read overrun in libpng's
png_format_buffer function. A specially constructed PNG image
processed by an application using libpng may trigger the buffer
read overrun and possibly result in an application crash.
bump PKGNAME; ok brad@

Log message:
Fix for CAN-2004-0421:
Steve Grubb reports a buffer read overrun in libpng's
png_format_buffer function. A specially constructed PNG image
processed by an application using libpng may trigger the buffer
read overrun and possibly result in an application crash.
ok brad@

Log message:
remove LDADD instead of leaving it empty.

Log message:
oops, check -> regress

Log message:
- add license marker
- remove REGRESS_TARGET and add a check target to the png Makefile

Log message:
Unlink png from zlib, bump major number.
Breaks lbreakout2 and pdflib, we don't really care, we'll fix them.

Log message:
remove WWW lines

Log message:
- strip out some useless docs
- install libpng-config

Log message:
upgrade to png 1.2.5