CVS commit: pkgsrc/graphics/png

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Wed Dec  3 23:11:32 UTC 2025

Modified Files:
        pkgsrc/graphics/png: Makefile distinfo

Log Message:
png: update to 1.6.52.

Security fix release.

Version 1.6.52 [December 3, 2025]
  Fixed CVE-2025-66293 (high severity):
    Out-of-bounds read in `png_image_read_composite`.
    (Reported by flyfish101 <flyfish101%users.noreply.github.com@localhost>.)
  Fixed the Paeth filter handling in the RISC-V RVV implementation.
    (Reported by Filip Wasil; fixed by Liang Junzhao.)
  Improved the performance of the RISC-V RVV implementation.
    (Contributed by Liang Junzhao.)
  Added allocation failure fuzzing to oss-fuzz.
    (Contributed by Philippe Antoine.)


To generate a diff of this commit:
cvs rdiff -u -r1.215 -r1.216 pkgsrc/graphics/png/Makefile
cvs rdiff -u -r1.160 -r1.161 pkgsrc/graphics/png/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/png/Makefile
diff -u pkgsrc/graphics/png/Makefile:1.215 pkgsrc/graphics/png/Makefile:1.216
--- pkgsrc/graphics/png/Makefile:1.215  Sat Nov 22 07:06:11 2025
+++ pkgsrc/graphics/png/Makefile        Wed Dec  3 23:11:32 2025
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.215 2025/11/22 07:06:11 wiz Exp $
+# $NetBSD: Makefile,v 1.216 2025/12/03 23:11:32 wiz Exp $
 
-DISTNAME=      libpng-1.6.51
+DISTNAME=      libpng-1.6.52
 PKGNAME=       ${DISTNAME:S/lib//}
 CATEGORIES=    graphics
 MASTER_SITES+= ${MASTER_SITE_SOURCEFORGE:=libpng/}

Index: pkgsrc/graphics/png/distinfo
diff -u pkgsrc/graphics/png/distinfo:1.160 pkgsrc/graphics/png/distinfo:1.161
--- pkgsrc/graphics/png/distinfo:1.160  Sat Nov 22 07:06:11 2025
+++ pkgsrc/graphics/png/distinfo        Wed Dec  3 23:11:32 2025
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.160 2025/11/22 07:06:11 wiz Exp $
+$NetBSD: distinfo,v 1.161 2025/12/03 23:11:32 wiz Exp $
 
 BLAKE2s (apng-20250220.patch) = 456a8fcead8bb3fd29936de9a6288bef6769026ff2c955371db0c2098548d68b
 SHA512 (apng-20250220.patch) = 120ac618b60d5e1ff2406d241e4ddc2c1893978653adcf462ce394ce3b6b2e5847545e04b0fcb20aab563a1546017ce622d1d2dd14f89d1d594130d626f1e6eb
 Size (apng-20250220.patch) = 49281 bytes
-BLAKE2s (libpng-1.6.51.tar.xz) = 2b2543cdf303625b2901be987f0b6d07de849af3b9ecca3a0b14a3e35b5d21b8
-SHA512 (libpng-1.6.51.tar.xz) = c723406f050f99783b2576e7e2c84774630a7f46bb8ea82bf4932f82bbb4899f47cb1b19ff9020245a474a0b2fee82c55ac1c58db43e3888ad5cc3a1767e7433
-Size (libpng-1.6.51.tar.xz) = 1060772 bytes
+BLAKE2s (libpng-1.6.52.tar.xz) = 972ef470292507fcc7df75720624d86a66360b1d3751ebf8e5750cbcdcfd60ca
+SHA512 (libpng-1.6.52.tar.xz) = 2bb1318f36712fc007613373a44a3276b4ed129b51b908464d9577ea9704d3caa469ec5bc7ebfb8b1de57ba3998c0b3375cd105054011ec54c21e9f208ec3c8b
+Size (libpng-1.6.52.tar.xz) = 1063580 bytes
 SHA1 (patch-libpng-config.in) = 04f8d6af31114017ce9d1280e62f1768c35c289d
 SHA1 (patch-pngpriv.h) = 16f80df18a2f58eec784e2d821e8bb93c3e81747