From sacadmin Thu Aug 5 10:47:19 2010 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o75HlIaQ004107; Thu, 5 Aug 2010 10:47:18 -0700 (PDT) Received: (from johnf@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id o75HlIlX004103; Thu, 5 Aug 2010 10:47:18 -0700 (PDT) Date: Thu, 5 Aug 2010 10:47:18 -0700 (PDT) From: John Fischer Message-Id: <201008051747.o75HlIlX004103@sac.sfbay.sun.com> To: PSARC-record@sac.sfbay.sun.com Cc: laszlo.peter@oracle.com Subject: libpng 1.4.3 [PSARC/2010/313 Self Review] Status: RO Content-Length: 587 Template Version: @(#)sac_nextcase 1.70 03/30/10 SMI This information is Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. 1. Introduction 1.1. Project/Component Working Name: libpng 1.4.3 1.2. Name of Document Author/Supplier: Author: Laszlo Peter 1.3 Date of This Document: 05 August, 2010 4. Technical Description See the case directory for more detail 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: JDS 6.5. ARC review type: Automatic 6.6. ARC Exposure: open From johnf@sac.sfbay.sun.com Thu Aug 5 10:58:48 2010 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o75HwmcV004587 for ; Thu, 5 Aug 2010 10:58:48 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.4) with ESMTP id o75HwmKB035955 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 5 Aug 2010 11:58:48 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L6O0030DXY0BC00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Aug 2010 10:58:48 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L6O00I6JXXZO5A0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Aug 2010 10:58:47 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [10.5.240.67]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o75HwlRx001076; Thu, 05 Aug 2010 10:58:47 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o75HwlbG004584; Thu, 05 Aug 2010 10:58:47 -0700 (PDT) Received: (from johnf@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id o75Hwla3004583; Thu, 05 Aug 2010 10:58:47 -0700 (PDT) Date: Thu, 05 Aug 2010 10:58:47 -0700 (PDT) From: John Fischer Subject: Re: libpng 1.4.3 [PSARC/2010/313 Self Review] To: PSARC-ext@sun.com Cc: laszlo.peter@oracle.com Message-id: <201008051758.o75Hwla3004583@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 5105 All, I am sponsoring this case for Laszlo (Laca) Peter from the desktop group. I have made this an automatic approval if anyone is concerned with that then I'll set a timer for next week. Just let me know. The case directory contains this proposal and a couple of documents from the community describing the changes to the library. This project delivers the latest version of libpng, version 1.4.3 into Solaris. It also updates the legacy 1.2.x and 1.0.y versions to the latest micro releases: 1.2.44 and 1.0.54. Patch release binding is requested. Thanks, John Title: libpng 1.4.3 Case: PSARC/2010/313 Submitter: Laszlo Peter Owner: John Fischer Timeout: Automatic 1.0 Introduction 1.1 Project/Component Working Name: libpng 1.4.3 for Solaris 1.2 Purpose This project delivers the latest version of libpng, version 1.4.3 into Solaris. It also updates the legacy 1.2.x and 1.0.y versions to the latest micro releases: 1.2.44 and 1.0.54. Patch release binding is requested. 2.0 Description libpng is a widely used C library for working with Portable Network Graphics images. It has multiple mostly API-compatible, but ABI-incompatible branches. They are parallel installable, but one is the default for development purposes. Currently libpng 1.2.x is the default branch. This update makes the 1.4.x branch the default one. 2.1 Security Issues Addressed These libpng releases incorporate security fixes: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205 An additional memory-leak bug, involving images with malformed sCAL chunks, is also present; it could lead to an application crash (denial of service) when viewing such images. 2.2 Additional Changes The differences between the 1.4 and 1.2 branches are detailed in libpng-ANNOUNCE-1.4.1.txt in the case directory. A comprehensive list of changes from release to release is in libpng-CHANGES.txt in the case directory. 3.0 Delivery This project is targetting a Patch release of the Solaris OS. Availability and file locations: +----------------------+-----------------------------------------------+ | Package name | File locations | +----------------------+-----------------------------------------------+ | SUNWpng | /usr/lib/libpng14.so.14 | | | /usr/lib/{amd64,sparcv9}/libpng14.so.14 | | IPS: | /usr/lib/libpng12.so.0 | | image/library/libpng | /usr/lib/{amd64,sparcv9}/libpng12.so.0 | | | /usr/lib/libpng10.so.0 | | | /usr/lib/{amd64,sparcv9}/libpng10.so.0 | +----------------------+-----------------------------------------------+ | SUNWpng-devel | /usr/bin/libpng-config -> libpng14-config | | | /usr/bin/{amd64,sparcv9}/libpng-config | | IPS: | /usr/bin/libpng1[024]-config | | image/library/libpng | /usr/bin/{amd64,sparcv9}/libpng1[024]-config | | | /usr/include/libpng -> libpng14 | | | /usr/include/libpng1[024] | | | /usr/lib/pkgconfig/libpng.pc -> libpng14.pc | | | /usr/lib/pkgconfig/libpng1[024].pc | | | /usr/lib/{amd64,sparcv9}/pkgconfig/libpng.pc | | | -> libpng14.pc | | | /usr/lib/{amd64,sparcv9}/pkgconfig/ | | | libpng1[024].pc | +----------------------+-----------------------------------------------+ 4.0 Interface Classification The project exports the following interfaces: +-----------------------------------------------------------------------+ | Interfaces Exported | +------------------------------+--------------------+-------------------+ | Interface Name | Classification | Comment | +------------------------------+--------------------+-------------------+ | libpng14.so.14 | Committed | | | libpng12.so.0 | Obsolete Committed | LSARC/2003/085 | | libpng10.so.0 | Obsolete Committed | LSARC/2003/085 | +------------------------------+--------------------+-------------------+ | SUNWpng | Committed | package names | | SUNWpng-devel | Committed | | | image/library/libpng | Committed | | +------------------------------+--------------------+-------------------+ 5.0 References Original ARC case: LSARC/2003/085 Upstream Web site: http://libpng.org/