)]}'
{
  "commit": "788a624d7387a758ffd5c7ab010f1870dea753a1",
  "tree": "2b4f9dfa76e3e5a68b529e12bb7636b5da0b5efa",
  "parents": [
    "cf53e54ccf631d8de68a30ebb3b8eeed1d6f1a08"
  ],
  "author": {
    "name": "Cosmin Truta",
    "email": "ctruta@gmail.com",
    "time": "Sat Nov 29 00:39:16 2025 +0200"
  },
  "committer": {
    "name": "Cosmin Truta",
    "email": "ctruta@gmail.com",
    "time": "Sat Nov 29 00:39:16 2025 +0200"
  },
  "message": "Fix an out-of-bounds read in `png_image_read_composite`\n\nAdd a defensive bounds check before calling PNG_sRGB_FROM_LINEAR to\nprevent reading up to 506 entries (1012 bytes) past `png_sRGB_base[]`.\n\nFor palette images with gamma, `png_init_read_transformations`\nclears PNG_COMPOSE after compositing on the palette, but it leaves\nPNG_FLAG_OPTIMIZE_ALPHA set. The simplified API then calls\n`png_image_read_composite` with sRGB data (not linear premultiplied),\ncausing the index to reach 1017. (The maximum valid index is 511.)\n\nNOTE:\nThis is a defensive fix that addresses the security issue (out-of-bounds\nread) but *NOT* the correctness issue (wrong output). When the clamp\ntriggers, the affected pixels are clamped to white instead of the\ncorrect composited color. Valid PNG images may render incorrectly with\nthe simplified API.\n\nTODO:\nWe already know the root cause is a flag synchronization error.\nFor palette images with gamma, `png_init_read_transformations`\nclears PNG_COMPOSE but leaves PNG_FLAG_OPTIMIZE_ALPHA set, causing\n`png_image_read_composite` to misinterpret sRGB data as linear\npremultiplied. However, we have yet to implement an architectural fix\nthat requires coordinating the simplified API with the transformation\npipeline.\n\nReported-by: flyfish101 \u003cflyfish101@users.noreply.github.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "79917daaaf988f9a9c954f5dc662dabf6da19e90",
      "old_mode": 33188,
      "old_path": "pngread.c",
      "new_id": "ab62edd9d820e55c9ebfd220db734064c5257396",
      "new_mode": 33188,
      "new_path": "pngread.c"
    }
  ]
}