MESSAGE
| DATE | 2020-12-13 |
| FROM | Greg Roelofs
|
| SUBJECT | Re: [Hangout - NYLXS] [png-mng-implement] [PATCH] pngcheck: check
|
Lucy Phipps wrote:
> Sadly, after I asked John about getting it merged into the upstream, he
> said no and deleted it, but my fork of his fork is still up if you want to
> use his zTXt and iTXt code anyway.
> https://github.com/landfillbaby/pngcheck/issues/1
I don't know the reasons behind his refusal, but I chose not to include his
changes for now, both to honor his intent and in order to get this release
out with minimal risk.
Which is to say, pngcheck 3.0.0 is available, and as the "risk" part suggests,
it addresses a number of security vulnerabilities discovered by "giantbranch
of NSFOCUS Security Team" and by Ben Beasley of the Fedora Project. The jump
in the major version number is because I removed the -f ("force") option; it
was implicated in almost all of the vulnerabilities, and honestly, it's just
way too hard to reason about the program logic with that thrown in on top of
all the other PNG-chunk variations and pngcheck's own verbosity, printing, and
zlib-decoding options.
If further security issues get reported (and ideally fixed), I'll do my best
to address them in followup releases, but ideally I'll be sitting on this for
a good, long time again. :-)
Cheers,
Greg
_______________________________________________
png-mng-implement mailing list
png-mng-implement-at-lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/png-mng-implement
_______________________________________________
Hangout mailing list
Hangout-at-nylxs.com
http://lists.mrbrklyn.com/mailman/listinfo/hangout
|
|
