)]}'
{
  "commit": "a22696be0aadb185de33c152cc81df899eeefe6a",
  "tree": "93e5f9400704c5cd8b5ae349067207434e930a4f",
  "parents": [
    "6d2054b29e0e07f0def670e2f2683cc9691cbf67"
  ],
  "author": {
    "name": "Anthony Hurtado",
    "email": "amhurtado@protonmail.com",
    "time": "Thu May 28 23:32:02 2026 -0500"
  },
  "committer": {
    "name": "Cosmin Truta",
    "email": "ctruta@gmail.com",
    "time": "Mon Jun 22 19:38:52 2026 +0300"
  },
  "message": "fix: Prevent double-freeing `png_struct` members on allocation failure\n\nClear the pointers inside `png_struct` after `png_free`, following the\nexisting idiom in `png_read_buffer`, to ensure that a subsequent free\nwill be a no-op.\n\nSeveral read-side functions free a `png_struct` member and allocate\na replacement without clearing the pointer in between. When that\nallocation fails, `png_malloc` calls `png_error`, which longjmps out\nbefore the assignment, leaving the member pointing at freed memory.\nThe application\u0027s cleanup path (`png_destroy_read_struct`, then\n`png_read_destroy`) then frees it a second time.\n\nThe same defect occurs at five members across four functions:\n - `big_row_buf` and `big_prev_row` in `png_read_start_row`;\n - `palette` in `png_set_PLTE`;\n - `trans_alpha` in `png_set_tRNS`;\n - `quantize_index` in `png_set_quantize`.\n\nThis is robustness hardening, not a fix for untrusted input. Arming\nthe double-free needs a prior successful pass through the same site,\nand PNG content alone cannot deliver one: duplicate PLTE and tRNS\nchunks are rejected before their setters run, and, although APNG\nre-runs `png_read_start_row` on every frame, fcTL validation caps\neach frame to the first frame\u0027s dimensions, so the row-buffer\nreallocation guard cannot re-fire within one decode.\n\nThe trigger is an application that causes a setter to run twice on one\n`png_struct` or reuses the struct across decodes, and then meets an\nallocation failure.\n\nCo-authored-by: Cosmin Truta \u003cctruta@gmail.com\u003e\nSigned-off-by: Anthony Hurtado \u003camhurtado@pm.me\u003e\nSigned-off-by: Cosmin Truta \u003cctruta@gmail.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "291a0b73a0524c7c25486c679a03fe8575d3a479",
      "old_mode": 33188,
      "old_path": "AUTHORS.md",
      "new_id": "be1c9b650007ed0834e8e671b2a309eab3875f3d",
      "new_mode": 33188,
      "new_path": "AUTHORS.md"
    },
    {
      "type": "modify",
      "old_id": "25a333fe8acc36802b18ed519f3616311d4ac677",
      "old_mode": 33188,
      "old_path": "pngrtran.c",
      "new_id": "38a9fb9aa6b1d26fdbacc0a6547c04f1a7e935ca",
      "new_mode": 33188,
      "new_path": "pngrtran.c"
    },
    {
      "type": "modify",
      "old_id": "6d937c85b4e551464fec410f237b4d6d7a4497a3",
      "old_mode": 33188,
      "old_path": "pngrutil.c",
      "new_id": "d4260757ee639a0ed5c69d4d8d0e97f18a37e4f0",
      "new_mode": 33188,
      "new_path": "pngrutil.c"
    },
    {
      "type": "modify",
      "old_id": "773a2f82c0663ac4b8eb313a1158d95bd38ef9ba",
      "old_mode": 33188,
      "old_path": "pngset.c",
      "new_id": "10eea62e54419b17658eb697cd4f600454ff59c3",
      "new_mode": 33188,
      "new_path": "pngset.c"
    }
  ]
}