Google Git
Sign in
flutter/third_party/libpng/refs/tags/upstream/v1.6.52^!/.
commit
fbed16182b92eeb3a06d96e49f0836d450318098
[log]
author
Cosmin Truta <ctruta@gmail.com>
Wed Dec 03 21:48:14 2025 +0200
committer
Cosmin Truta <ctruta@gmail.com>
Wed Dec 03 21:48:14 2025 +0200
tree
ec164a949da4508da420fecfcd4d43fbe1f315cc
parent
5c7d02d73b12aa96ff5bc27f3695d3fe3c6b1dd7 [diff]
Release libpng version 1.6.52

diff --git a/ANNOUNCE b/ANNOUNCE
index baaf275..10dee70 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE

@@ -1,13 +1,5 @@
-libpng 1.6.52.git
-=================
-
-This is a development version, not intended to be a public release.
-It will be replaced by a public release, or by another development
-version, at a later time.
-
-
-libpng 1.6.51 - November 21, 2025
-=================================
+libpng 1.6.52 - December 3, 2025
+================================
 
 This is a public release of libpng, intended for use in production code.
 
@@ -15,15 +7,12 @@
 Files available for download
 ----------------------------
 
-Source files with LF line endings (for Unix/Linux):
+Source files:
 
- * libpng-1.6.51.tar.xz (LZMA-compressed, recommended)
- * libpng-1.6.51.tar.gz (deflate-compressed)
-
-Source files with CRLF line endings (for Windows):
-
- * lpng1651.7z (LZMA-compressed, recommended)
- * lpng1651.zip (deflate-compressed)
+ * libpng-1.6.52.tar.xz (LZMA-compressed, recommended)
+ * libpng-1.6.52.tar.gz (deflate-compressed)
+ * lpng1652.7z (LZMA-compressed)
+ * lpng1652.zip (deflate-compressed)
 
 Other information:
 
@@ -33,33 +22,18 @@
  * TRADEMARK.md
 
 
-Changes from version 1.6.50 to version 1.6.51
+Changes from version 1.6.51 to version 1.6.52
 ---------------------------------------------
 
- * Fixed CVE-2025-64505 (moderate severity):
-   Heap buffer overflow in `png_do_quantize` via malformed palette index.
-   (Reported by Samsung; analyzed by Fabio Gritti.)
- * Fixed CVE-2025-64506 (moderate severity):
-   Heap buffer over-read in `png_write_image_8bit` with 8-bit input and
-   `convert_to_8bit` enabled.
-   (Reported by Samsung and <weijinjinnihao@users.noreply.github.com>;
-   analyzed by Fabio Gritti.)
- * Fixed CVE-2025-64720 (high severity):
-   Buffer overflow in `png_image_read_composite` via incorrect palette
-   premultiplication.
-   (Reported by Samsung; analyzed by John Bowler.)
- * Fixed CVE-2025-65018 (high severity):
-   Heap buffer overflow in `png_combine_row` triggered via
-   `png_image_finish_read`.
-   (Reported by <yosiimich@users.noreply.github.com>.)
- * Fixed a memory leak in `png_set_quantize`.
-   (Reported by Samsung; analyzed by Fabio Gritti.)
- * Removed the experimental and incomplete ERROR_NUMBERS code.
-   (Contributed by Tobias Stoeckmann.)
- * Improved the RISC-V vector extension support; required RVV 1.0 or newer.
-   (Contributed by Filip Wasil.)
- * Added GitHub Actions workflows for automated testing.
- * Performed various refactorings and cleanups.
+ * Fixed CVE-2025-66293 (high severity):
+   Out-of-bounds read in `png_image_read_composite`.
+   (Reported by flyfish101 <flyfish101@users.noreply.github.com>.)
+ * Fixed the Paeth filter handling in the RISC-V RVV implementation.
+   (Reported by Filip Wasil; fixed by Liang Junzhao.)
+ * Improved the performance of the RISC-V RVV implementation.
+   (Contributed by Liang Junzhao.)
+ * Added allocation failure fuzzing to oss-fuzz.
+   (Contributed by Philippe Antoine.)
 
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net.

diff --git a/CHANGES b/CHANGES
index 09450fb..f8ad74b 100644
--- a/CHANGES
+++ b/CHANGES

@@ -6304,7 +6304,16 @@
   Added GitHub Actions workflows for automated testing.
   Performed various refactorings and cleanups.
 
-Version 1.6.52 [TODO]
+Version 1.6.52 [December 3, 2025]
+  Fixed CVE-2025-66293 (high severity):
+    Out-of-bounds read in `png_image_read_composite`.
+    (Reported by flyfish101 <flyfish101@users.noreply.github.com>.)
+  Fixed the Paeth filter handling in the RISC-V RVV implementation.
+    (Reported by Filip Wasil; fixed by Liang Junzhao.)
+  Improved the performance of the RISC-V RVV implementation.
+    (Contributed by Liang Junzhao.)
+  Added allocation failure fuzzing to oss-fuzz.
+    (Contributed by Philippe Antoine.)
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
 Subscription is required; visit

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8a6ebe5..9959c85 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt

@@ -19,8 +19,8 @@
 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 6)
 set(PNGLIB_REVISION 52)
-#set(PNGLIB_SUBREVISION 0)
-set(PNGLIB_SUBREVISION "git")
+set(PNGLIB_SUBREVISION 0)
+#set(PNGLIB_SUBREVISION "git")
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_REVISION})
 set(PNGLIB_ABI_VERSION ${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_SHARED_VERSION ${PNGLIB_ABI_VERSION}.${PNGLIB_REVISION}.${PNGLIB_SUBREVISION})

diff --git a/README b/README
index 5c71971..87e5f8b 100644
--- a/README
+++ b/README

@@ -1,5 +1,5 @@
-README for libpng version 1.6.52.git
-====================================
+README for libpng version 1.6.52
+================================
 
 See the note about version numbers near the top of `png.h`.
 See `INSTALL` for instructions on how to install libpng.

diff --git a/configure b/configure
index ae31008..f41863e 100755
--- a/configure
+++ b/configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.72 for libpng 1.6.52.git.
+# Generated by GNU Autoconf 2.72 for libpng 1.6.52.
 #
 # Report bugs to <png-mng-implement@lists.sourceforge.net>.
 #
@@ -614,8 +614,8 @@
 # Identity of this package.
 PACKAGE_NAME='libpng'
 PACKAGE_TARNAME='libpng'
-PACKAGE_VERSION='1.6.52.git'
-PACKAGE_STRING='libpng 1.6.52.git'
+PACKAGE_VERSION='1.6.52'
+PACKAGE_STRING='libpng 1.6.52'
 PACKAGE_BUGREPORT='png-mng-implement@lists.sourceforge.net'
 PACKAGE_URL=''
 
@@ -1424,7 +1424,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-'configure' configures libpng 1.6.52.git to adapt to many kinds of systems.
+'configure' configures libpng 1.6.52 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1495,7 +1495,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libpng 1.6.52.git:";;
+     short | recursive ) echo "Configuration of libpng 1.6.52:";;
    esac
   cat <<\_ACEOF
 
@@ -1698,7 +1698,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libpng configure 1.6.52.git
+libpng configure 1.6.52
 generated by GNU Autoconf 2.72
 
 Copyright (C) 2023 Free Software Foundation, Inc.
@@ -1961,7 +1961,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libpng $as_me 1.6.52.git, which was
+It was created by libpng $as_me 1.6.52, which was
 generated by GNU Autoconf 2.72.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3446,7 +3446,7 @@
 
 # Define the identity of the package.
  PACKAGE='libpng'
- VERSION='1.6.52.git'
+ VERSION='1.6.52'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -3665,7 +3665,7 @@
 
 
 
-PNGLIB_VERSION=1.6.52.git
+PNGLIB_VERSION=1.6.52
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=6
 PNGLIB_RELEASE=52
@@ -16406,7 +16406,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libpng $as_me 1.6.52.git, which was
+This file was extended by libpng $as_me 1.6.52, which was
 generated by GNU Autoconf 2.72.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -16474,7 +16474,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-libpng config.status 1.6.52.git
+libpng config.status 1.6.52
 configured by $0, generated by GNU Autoconf 2.72,
   with options \\"\$ac_cs_config\\"
 

diff --git a/configure.ac b/configure.ac
index b03cba9..80c15de 100644
--- a/configure.ac
+++ b/configure.ac

@@ -25,7 +25,7 @@
 
 dnl Version number stuff here:
 
-AC_INIT([libpng],[1.6.52.git],[png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng],[1.6.52],[png-mng-implement@lists.sourceforge.net])
 AC_CONFIG_MACRO_DIR([scripts/autoconf])
 
 # libpng does not follow GNU file name conventions (hence 'foreign')
@@ -46,7 +46,7 @@
 dnl AM_PREREQ([1.11.2])
 dnl stop configure from automagically running automake
 
-PNGLIB_VERSION=1.6.52.git
+PNGLIB_VERSION=1.6.52
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=6
 PNGLIB_RELEASE=52

diff --git a/libpng-manual.txt b/libpng-manual.txt
index f342c18..f284d98 100644
--- a/libpng-manual.txt
+++ b/libpng-manual.txt

@@ -9,7 +9,7 @@
 
  Based on:
 
- libpng version 1.6.36, December 2018, through 1.6.51 - November 2025
+ libpng version 1.6.36, December 2018, through 1.6.52 - December 2025
  Updated and distributed by Cosmin Truta
  Copyright (c) 2018-2025 Cosmin Truta
 

diff --git a/libpng.3 b/libpng.3
index 8531709..ca9020c 100644
--- a/libpng.3
+++ b/libpng.3

@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "November 21, 2025"
+.TH LIBPNG 3 "December 3, 2025"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.51
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.52
 
 .SH SYNOPSIS
 \fB#include <png.h>\fP
@@ -528,7 +528,7 @@
 
  Based on:
 
- libpng version 1.6.36, December 2018, through 1.6.51 - November 2025
+ libpng version 1.6.36, December 2018, through 1.6.52 - December 2025
  Updated and distributed by Cosmin Truta
  Copyright (c) 2018-2025 Cosmin Truta
 

diff --git a/libpngpf.3 b/libpngpf.3
index b7a6e39..a1591ee 100644
--- a/libpngpf.3
+++ b/libpngpf.3

@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "November 21, 2025"
+.TH LIBPNGPF 3 "December 3, 2025"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.51
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.52
 
 .SH SYNOPSIS
 \fB#include "pngpriv.h"\fP

diff --git a/png.5 b/png.5
index a22a33b..fbb88ab 100644
--- a/png.5
+++ b/png.5

@@ -1,4 +1,4 @@
-.TH PNG 5 "November 21, 2025"
+.TH PNG 5 "December 3, 2025"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 

diff --git a/png.c b/png.c
index a934279..11b65d1 100644
--- a/png.c
+++ b/png.c

@@ -13,7 +13,7 @@
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_52_git Your_png_h_is_not_version_1_6_52_git;
+typedef png_libpng_version_1_6_52 Your_png_h_is_not_version_1_6_52;
 
 /* Sanity check the chunks definitions - PNG_KNOWN_CHUNKS from pngpriv.h and the
  * corresponding macro definitions.  This causes a compile time failure if
@@ -817,7 +817,7 @@
    return PNG_STRING_COPYRIGHT
 #else
    return PNG_STRING_NEWLINE \
-      "libpng version 1.6.52.git" PNG_STRING_NEWLINE \
+      "libpng version 1.6.52" PNG_STRING_NEWLINE \
       "Copyright (c) 2018-2025 Cosmin Truta" PNG_STRING_NEWLINE \
       "Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson" \
       PNG_STRING_NEWLINE \

diff --git a/png.h b/png.h
index b876259..bceb9aa 100644
--- a/png.h
+++ b/png.h

@@ -1,6 +1,6 @@
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.6.52.git
+ * libpng version 1.6.52
  *
  * Copyright (c) 2018-2025 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
@@ -14,7 +14,7 @@
  *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
  *   libpng versions 0.97, January 1998, through 1.6.35, July 2018:
  *     Glenn Randers-Pehrson
- *   libpng versions 1.6.36, December 2018, through 1.6.51, November 2025:
+ *   libpng versions 1.6.36, December 2018, through 1.6.52, December 2025:
  *     Cosmin Truta
  *   See also "Contributing Authors", below.
  */
@@ -238,7 +238,7 @@
  *    ...
  *    1.5.30                  15    10530  15.so.15.30[.0]
  *    ...
- *    1.6.51                  16    10651  16.so.16.51[.0]
+ *    1.6.52                  16    10651  16.so.16.52[.0]
  *
  *    Henceforth the source version will match the shared-library major and
  *    minor numbers; the shared-library major version number will be used for
@@ -274,7 +274,7 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.6.52.git"
+#define PNG_LIBPNG_VER_STRING "1.6.52"
 #define PNG_HEADER_VERSION_STRING " libpng version " PNG_LIBPNG_VER_STRING "\n"
 
 /* The versions of shared library builds should stay in sync, going forward */
@@ -290,7 +290,7 @@
 /* This should be zero for a public release, or non-zero for a
  * development version.
  */
-#define PNG_LIBPNG_VER_BUILD 1
+#define PNG_LIBPNG_VER_BUILD 0
 
 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA               1
@@ -307,7 +307,7 @@
 #define PNG_LIBPNG_BUILD_SPECIAL 32 /* Cannot be OR'ed with
                                        PNG_LIBPNG_BUILD_PRIVATE */
 
-#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_BETA
+#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE
 
 /* Careful here.  At one time, Guy wanted to use 082, but that
  * would be octal.  We must not include leading zeros.
@@ -316,7 +316,7 @@
  * From version 1.0.1 it is:
  * XXYYZZ, where XX=major, YY=minor, ZZ=release
  */
-#define PNG_LIBPNG_VER 10652 /* 1.6.52.git */
+#define PNG_LIBPNG_VER 10652 /* 1.6.52 */
 
 /* Library configuration: these options cannot be changed after
  * the library has been built.
@@ -426,7 +426,7 @@
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef char* png_libpng_version_1_6_52_git;
+typedef char* png_libpng_version_1_6_52;
 
 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
  *

diff --git a/pngconf.h b/pngconf.h
index ce5e5e6..76b5c20 100644
--- a/pngconf.h
+++ b/pngconf.h

@@ -1,6 +1,6 @@
 /* pngconf.h - machine-configurable file for libpng
  *
- * libpng version 1.6.52.git
+ * libpng version 1.6.52
  *
  * Copyright (c) 2018-2025 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2016,2018 Glenn Randers-Pehrson

diff --git a/pngtest.c b/pngtest.c
index 3bdb285..00bc327 100644
--- a/pngtest.c
+++ b/pngtest.c

@@ -50,7 +50,7 @@
 #define STDERR stdout
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_52_git Your_png_h_is_not_version_1_6_52_git;
+typedef png_libpng_version_1_6_52 Your_png_h_is_not_version_1_6_52;
 
 /* Ensure that all version numbers in png.h are consistent with one another. */
 #if (PNG_LIBPNG_VER != PNG_LIBPNG_VER_MAJOR * 10000 + \

diff --git a/scripts/libpng-config-head.in b/scripts/libpng-config-head.in
index a40b5be..101d72e 100644
--- a/scripts/libpng-config-head.in
+++ b/scripts/libpng-config-head.in

@@ -11,7 +11,7 @@
 
 # Modeled after libxml-config.
 
-version=1.6.52.git
+version=1.6.52
 prefix=""
 libdir=""
 libs=""

diff --git a/scripts/libpng.pc.in b/scripts/libpng.pc.in
index 8a44ead..c62b525 100644
--- a/scripts/libpng.pc.in
+++ b/scripts/libpng.pc.in

@@ -5,6 +5,6 @@
 
 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.6.52.git
+Version: 1.6.52
 Libs: -L${libdir} -lpng16
 Cflags: -I${includedir}

diff --git a/scripts/pnglibconf.h.prebuilt b/scripts/pnglibconf.h.prebuilt
index 5b80dd4..f4a9934 100644
--- a/scripts/pnglibconf.h.prebuilt
+++ b/scripts/pnglibconf.h.prebuilt

@@ -1,6 +1,6 @@
 /* pnglibconf.h - library build configuration */
 
-/* libpng version 1.6.52.git */
+/* libpng version 1.6.52 */
 
 /* Copyright (c) 2018-2025 Cosmin Truta */
 /* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson */