)]}'
{
  "commit": "cae474558968f015124d7369556a4b1016276e3a",
  "tree": "5dfeede7e6eda343ee328b6921b6e9e196b7a379",
  "parents": [
    "7ed557b4a0c347ec697ea40d2a079474a740d1a9"
  ],
  "author": {
    "name": "Anthony Hurtado",
    "email": "amhurtado@protonmail.com",
    "time": "Thu May 28 23:32:02 2026 -0500"
  },
  "committer": {
    "name": "Cosmin Truta",
    "email": "ctruta@gmail.com",
    "time": "Mon Jun 22 19:38:52 2026 +0300"
  },
  "message": "fix: Prevent double-freeing `png_struct` members on allocation failure\n\nClear the pointers inside `png_struct` after `png_free`, following the\nexisting idiom in `png_read_buffer`, to ensure that a subsequent free\nwill be a no-op.\n\nSeveral read-side functions free a `png_struct` member and allocate\na replacement without clearing the pointer in between. When that\nallocation fails, `png_malloc` calls `png_error`, which longjmps out\nbefore the assignment, leaving the member pointing at freed memory.\nThe application\u0027s cleanup path (`png_destroy_read_struct`, then\n`png_read_destroy`) then frees it a second time.\n\nThe same defect occurs at five members across four functions:\n - `big_row_buf` and `big_prev_row` in `png_read_start_row`;\n - `palette` in `png_set_PLTE`;\n - `trans_alpha` in `png_set_tRNS`;\n - `quantize_index` in `png_set_quantize`.\n\nThis is robustness hardening, not a fix for untrusted input. Arming\nthe double-free needs a prior successful pass through the same site,\nand PNG content alone cannot deliver one: duplicate PLTE and tRNS\nchunks are rejected before their setters run, and within a single\ndecode the row dimensions never grow, so the row-buffer reallocation\nguard cannot re-fire.\n\nThe trigger is an application that causes a setter to run twice on one\n`png_struct` or reuses the struct across decodes, and then meets an\nallocation failure.\n\nThis is a cherry-pick of commit a22696be0aadb185de33c152cc81df899eeefe6a\nfrom branch \u0027libpng18\u0027.\n\nCo-authored-by: Cosmin Truta \u003cctruta@gmail.com\u003e\nSigned-off-by: Anthony Hurtado \u003camhurtado@pm.me\u003e\nSigned-off-by: Cosmin Truta \u003cctruta@gmail.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "6726fc6a7ce2294f049e4a39848e2282a6c6a517",
      "old_mode": 33188,
      "old_path": "AUTHORS",
      "new_id": "0aaba0c69ef3278316dddddb459ca4c355a3a59f",
      "new_mode": 33188,
      "new_path": "AUTHORS"
    },
    {
      "type": "modify",
      "old_id": "0ac8df749e9e51b8f97aa3d3c67f22c9c49269ce",
      "old_mode": 33188,
      "old_path": "pngrtran.c",
      "new_id": "28e6127c37085435f9bf0a7e560b0e4efd558774",
      "new_mode": 33188,
      "new_path": "pngrtran.c"
    },
    {
      "type": "modify",
      "old_id": "3a35fe9de2d9e09a15e1ea32a45d558f09f05952",
      "old_mode": 33188,
      "old_path": "pngrutil.c",
      "new_id": "893468439ac3716d4b147099fd5f32fc2d129942",
      "new_mode": 33188,
      "new_path": "pngrutil.c"
    },
    {
      "type": "modify",
      "old_id": "513c51eb4a8f792662f4534db6fb9f1c3bed08cf",
      "old_mode": 33188,
      "old_path": "pngset.c",
      "new_id": "f86af0f0177c2d7de441dec89068f8daeecccf85",
      "new_mode": 33188,
      "new_path": "pngset.c"
    }
  ]
}