Merge branch 'master' into merge_pfamily_binaries (#32)

source/libs/README

@@ -34,7 +34,7 @@ icu 70.1 - checked 16jan22
 libpaper 1.1.28 - checked 10sep22
   http://ftp.debian.org/debian/pool/main/libp/libpaper/
 
-libpng 1.6.38 - checked 16sep22
+libpng 1.6.39 - checked 11nov22
   https://sourceforge.net/projects/libpng/files/ - used by many
 
 lua 5.2.4 - checked 11mar15

source/libs/libpng/ChangeLog

@@ -1,3 +1,8 @@
+2022-11-21 Akira Kakuto  <[email protected]>
+
+	Import libpng-1.6.39.
+	* version.ac: Adjust.
+
 2022-09-16 Akira Kakuto  <[email protected]>
 
 	Import libpng-1.6.38.

source/libs/libpng/README

@@ -1,4 +1,4 @@
-	Building libpng-1.6.38 as part of the TL tree
+	Building libpng-1.6.39 as part of the TL tree
 	=============================================
 
 This directory libs/libpng/ uses a proxy Makefile.am to build the libpng library
@@ -14,4 +14,4 @@ copied to libs/libpng/configure.ac.
 =============================
 
 2009-07-23	Peter Breitenlohner <[email protected]>
-2022-09-16	Akira Kakuto <[email protected]>
+2022-11-21	Akira Kakuto <[email protected]>

source/libs/libpng/TLpatches/ChangeLog

@@ -1,3 +1,7 @@
+2022-11-21  Akira Kakuto <[email protected]>
+
+	Import libpng-1.6.39.
+
 2022-09-16  Akira Kakuto <[email protected]>
 
 	Import libpng-1.6.38.

source/libs/libpng/TLpatches/TL-Changes

@@ -1,5 +1,5 @@
-Changes applied to the libpng-1.6.38/ tree as obtained from:
-	https://sourceforge.net/projects/libpng/files/libpng16/1.6.38/
+Changes applied to the libpng-1.6.39/ tree as obtained from:
+	https://sourceforge.net/projects/libpng/files/libpng16/1.6.39/
 
 Copied:
 	scripts/pnglibconf.h.prebuilt -> pnglibconf.h

source/libs/libpng/configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for libpng (TeX Live) 1.6.38.
+# Generated by GNU Autoconf 2.71 for libpng (TeX Live) 1.6.39.
 #
 # Report bugs to <[email protected]>.
 #
@@ -611,8 +611,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libpng (TeX Live)'
 PACKAGE_TARNAME='libpng--tex-live-'
-PACKAGE_VERSION='1.6.38'
-PACKAGE_STRING='libpng (TeX Live) 1.6.38'
+PACKAGE_VERSION='1.6.39'
+PACKAGE_STRING='libpng (TeX Live) 1.6.39'
 PACKAGE_BUGREPORT='[email protected]'
 PACKAGE_URL=''
 
@@ -1337,7 +1337,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures libpng (TeX Live) 1.6.38 to adapt to many kinds of systems.
+\`configure' configures libpng (TeX Live) 1.6.39 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1405,7 +1405,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libpng (TeX Live) 1.6.38:";;
+     short | recursive ) echo "Configuration of libpng (TeX Live) 1.6.39:";;
    esac
   cat <<\_ACEOF
 
@@ -1525,7 +1525,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libpng (TeX Live) configure 1.6.38
+libpng (TeX Live) configure 1.6.39
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -1843,7 +1843,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libpng (TeX Live) $as_me 1.6.38, which was
+It was created by libpng (TeX Live) $as_me 1.6.39, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -4386,7 +4386,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='libpng--tex-live-'
- VERSION='1.6.38'
+ VERSION='1.6.39'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -7236,7 +7236,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libpng (TeX Live) $as_me 1.6.38, which was
+This file was extended by libpng (TeX Live) $as_me 1.6.39, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -7304,7 +7304,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-libpng (TeX Live) config.status 1.6.38
+libpng (TeX Live) config.status 1.6.39
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 

source/libs/libpng/libpng-src/ANNOUNCE

@@ -1,5 +1,5 @@
-libpng 1.6.38 - September 14, 2022
-==================================
+libpng 1.6.39 - November 20, 2022
+=================================
 
 This is a public release of libpng, intended for use in production code.
 
@@ -9,13 +9,13 @@ Files available for download
 
 Source files with LF line endings (for Unix/Linux):
 
- * libpng-1.6.38.tar.xz (LZMA-compressed, recommended)
- * libpng-1.6.38.tar.gz
+ * libpng-1.6.39.tar.xz (LZMA-compressed, recommended)
+ * libpng-1.6.39.tar.gz
 
 Source files with CRLF line endings (for Windows):
 
- * lp1638.7z (LZMA-compressed, recommended)
- * lp1638.zip
+ * lpng1639.7z (LZMA-compressed, recommended)
+ * lpng1639.zip
 
 Other information:
 
@@ -25,13 +25,19 @@ Other information:
  * TRADEMARK.md
 
 
-Changes since the previous public release (version 1.6.37)
-----------------------------------------------------------
+Changes from version 1.6.38 to version 1.6.39
+---------------------------------------------
 
- * Added configurations and scripts for continuous integration.
- * Fixed various errors in the handling of tRNS, hIST and eXIf.
- * Implemented many stability improvements across all platforms.
- * Updated the internal documentation.
+ * Changed the error handler of oversized chunks (i.e. larger than
+   PNG_USER_CHUNK_MALLOC_MAX) from png_chunk_error to png_benign_error.
+ * Fixed a buffer overflow error in contrib/tools/pngfix.
+ * Fixed a memory leak (CVE-2019-6129) in contrib/tools/pngcp.
+ * Disabled the ARM Neon optimizations by default in the CMake file,
+   following the default behavior of the configure script.
+ * Allowed configure.ac to work with the trunk version of autoconf.
+ * Removed the support for "install" targets from the legacy makefiles;
+   removed the obsolete makefile.cegcc.
+ * Cleaned up the code and updated the internal documentation.
 
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net.

source/libs/libpng/libpng-src/AUTHORS

@@ -35,9 +35,10 @@ Authors, for copyright and licensing purposes.
  * Arm Holdings
    - Richard Townsend
  * Google Inc.
+   - Dan Field
+   - Leon Scroggins III
    - Matt Sarett
    - Mike Klein
-   - Dan Field
    - Sami Boukortt
 
 The build projects, the build scripts, the test scripts, and other

source/libs/libpng/libpng-src/CHANGES

@@ -4052,7 +4052,7 @@ Version 1.6.0beta16 [March 6, 2012]
     (in fact this is harmless, but the PNG data produced may be sub-optimal).
 
 Version 1.6.0beta17 [March 10, 2012]
-  Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition. 
+  Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition.
   Reject all iCCP chunks after the first, even if the first one is invalid.
   Deflate/inflate was reworked to move common zlib calls into single
     functions [rw]util.c.  A new shared keyword check routine was also added
@@ -4962,7 +4962,7 @@ Version 1.6.13beta01 [July 4, 2014]
   Changed "if defined(__ARM_NEON__)" to
     "if (defined(__ARM_NEON__) || defined(__ARM_NEON))" (James Wu).
   Fixed clang no-warning builds: png_digit was defined but never used.
-    
+
 Version 1.6.13beta02 [July 21, 2014]
   Fixed an incorrect separator ("/" should be "\") in scripts/makefile.vcwin32
     (bug report from Wolfgang S. Kechel).  Bug was introduced in libpng-1.6.11.
@@ -5453,7 +5453,7 @@ Version 1.6.21beta01 [December 11, 2015]
 Version 1.6.21beta02 [December 14, 2015]
   Moved png_check_keyword() from pngwutil.c to pngset.c
   Removed LE/BE dependencies in pngvalid, to 'fix' the current problem
-    in the BigEndian tests by not testing it, making the BE code the same 
+    in the BigEndian tests by not testing it, making the BE code the same
     as the LE version.
   Fixes to pngvalid for various reduced build configurations (eliminate unused
     statics) and a fix for the case in rgb_to_gray when the digitize option
@@ -5517,7 +5517,7 @@ Version 1.6.22beta03 [March 9, 2016]
   Added a common-law trademark notice and export control information
     to the LICENSE file, png.h, and the man page.
   Restored "& 0xff" in png_save_uint_16() and png_save_uint_32() that
-    were accidentally removed from libpng-1.6.17. 
+    were accidentally removed from libpng-1.6.17.
   Changed PNG_INFO_cHNK and PNG_FREE_cHNK from 0xnnnn to 0xnnnnU in png.h
     (Robert C. Seacord).
   Removed dubious "#if INT_MAX" test from png.h that was added to
@@ -5950,7 +5950,7 @@ Version 1.6.32beta09 [August 3, 2017]
   Require cmake-2.8.8 in CMakeLists.txt. Revised symlink creation,
     no longer using deprecated cmake LOCATION feature (Clifford Yapp).
   Fixed five-byte error in the calculation of IDAT maximum possible size.
-  
+
 Version 1.6.32beta10 [August 5, 2017]
   Moved chunk-length check into a png_check_chunk_length() private
     function (Suggested by Max Stepin).
@@ -6109,6 +6109,18 @@ Version 1.6.38 [September 14, 2022]
   Implemented many stability improvements across all platforms.
   Updated the internal documentation.
 
+Version 1.6.39 [November 20, 2022]
+  Changed the error handler of oversized chunks (i.e. larger than
+    PNG_USER_CHUNK_MALLOC_MAX) from png_chunk_error to png_benign_error.
+  Fixed a buffer overflow error in contrib/tools/pngfix.
+  Fixed a memory leak (CVE-2019-6129) in contrib/tools/pngcp.
+  Disabled the ARM Neon optimizations by default in the CMake file,
+    following the default behavior of the configure script.
+  Allowed configure.ac to work with the trunk version of autoconf.
+  Removed the support for "install" targets from the legacy makefiles;
+    removed the obsolete makefile.cegcc.
+  Cleaned up the code and updated the internal documentation.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
 Subscription is required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement

source/libs/libpng/libpng-src/CMakeLists.txt

@@ -19,6 +19,7 @@
 # Revised by Owen Rudge, 2020
 # Revised by Gleb Mazovetskiy, 2021
 # Revised by Christopher Sean Morrison, 2022
+# Revised by Martin Storsjo, 2022
 
 # This code is released under the libpng license.
 # For conditions of distribution and use, see the disclaimer
@@ -32,7 +33,7 @@ enable_testing()
 
 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 6)
-set(PNGLIB_REVISION 38)
+set(PNGLIB_REVISION 39)
 set(PNGLIB_SUBREVISION 0)
 #set(PNGLIB_SUBREVISION "git")
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
@@ -98,8 +99,8 @@ if(TARGET_ARCH MATCHES "^arm" OR
         CACHE STRING "Enable ARM NEON optimizations: on|off; on is default")
   else()
     set(PNG_ARM_NEON_POSSIBLE_VALUES check on off)
-    set(PNG_ARM_NEON "check"
-        CACHE STRING "Enable ARM NEON optimizations: check|on|off; check is default")
+    set(PNG_ARM_NEON "off"
+        CACHE STRING "Enable ARM NEON optimizations: check|on|off; off is default")
   endif()
   set_property(CACHE PNG_ARM_NEON
                PROPERTY STRINGS ${PNG_ARM_NEON_POSSIBLE_VALUES})

source/libs/libpng/libpng-src/INSTALL

@@ -192,11 +192,11 @@ test.  For more confidence, you can run another test by typing
 Also, you can run "pngtest -m contrib/pngsuite/*.png" and compare
 your output with the result shown in contrib/pngsuite/README.
 
-Most of the makefiles will allow you to run "make install" to
-put the library in its final resting place (if you want to
-do that, run "make install" in the zlib directory first if necessary).
-Some also allow you to run "make test-installed" after you have
-run "make install".
+Most of the makefiles used to allow you to run "make install" to put
+the library in its final resting place, but that feature is no longer
+supported.  The only tested and supported manners to install libpng are
+the conventional build and install procedures driven by the configure
+script or by the CMake file.
 
 VIII. Configuring for DOS and other 16-bit platforms