I now use libpng-1.4.1 .

in libpng-1.2.43: png_check_sig() is deprecated.
in libpng-1.4.1 : png_check_sig() is unknown.

in libpng-1.4.1 : setjmp(png_ptr->jmpbuf) is deprecated.

http://libpng.sourceforge.net contains a article:

   Defending Libpng Applications Against Decompression Bombs
   Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
                 February 27, 2010

This article advises to upgrade to libpng-1.2.43 or libpng-1.4.1 .

The images/libpng version is "libpng version 1.2.1 - December 12, 2001".

By the way:

The images/libjpeg version is "6b  27-Mar-1998".
But version jpeg-8.0 is out (http://www.ijg.org).

The images/zlib version is "version 1.1.4, March 11th, 2002".
But the current version is zlib-1.2.3.4 .

winfried
--- images/fl_png.cxx.v1        2010-03-04 11:19:39.000000000 +0100
+++ images/fl_png.cxx   2010-03-04 13:40:08.000000000 +0100
@@ -62,7 +62,7 @@
 #if !HAVE_LIBPNG
   return 0;
 #else
-  return png_check_sig((png_byte*)datas, (int)size)!=0;
+  return png_sig_cmp((png_byte*)datas, (png_size_t)0, 8) == 0;
 #endif
 }

@@ -113,7 +113,7 @@
     png_set_sig_bytes(png_ptr, 8);
   }

-  if (setjmp(png_ptr->jmpbuf))
+  if (setjmp(png_jmpbuf(png_ptr)))
     goto error;

   png_read_info(png_ptr, info_ptr);

_______________________________________________
fltk-bugs mailing list
[email protected]
http://lists.easysw.com/mailman/listinfo/fltk-bugs

Reply via email to