5 changed files with 71 additions and 71 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/libpng-1.6.37.tar.gz
+SOURCES/libpng-1.6.34.tar.xz
--- a/.libpng.metadata
+++ b/.libpng.metadata
@ -1 +1 @@
-1aac0e12aa5b583f736fb6692f47dff7a3efa78b SOURCES/libpng-1.6.37.tar.gz
+45de4ec996ffcc3e18037e7c128abe95f4d0292a SOURCES/libpng-1.6.34.tar.xz
--- a/SOURCES/libpng-CVE-2018-13785.patch
+++ b/SOURCES/libpng-CVE-2018-13785.patch
@ -0,0 +1,34 @@
+From 9821583a771bfe2c75b7449d8ff83cb348291b3f Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Sun, 17 Jun 2018 22:56:29 -0400
+Subject: [PATCH] Fix the calculation of row_factor in png_check_chunk_length
+
+(Bug report by Thuan Pham, SourceForge issue #278)
+---
+ pngrutil.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/pngrutil.c b/pngrutil.c
+index 8692933..eab2973 100644
+--- a/pngrutil.c
+++ b/pngrutil.c
+@@ -3149,10 +3149,13 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
+    {
+       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
+       size_t row_factor =
+-         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
+-          + 1 + (png_ptr->interlaced? 6: 0));
+         (size_t)png_ptr->width
+         * (size_t)png_ptr->channels
+         * (png_ptr->bit_depth > 8? 2: 1)
+         + 1
+         + (png_ptr->interlaced? 6: 0);
+       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
+-         idat_limit=PNG_UINT_31_MAX;
+         idat_limit = PNG_UINT_31_MAX;
+       else
+          idat_limit = png_ptr->height * row_factor;
+       row_factor = row_factor > 32566? 32566 : row_factor;
+-- 
+2.17.1
+
--- a/SOURCES/libpng-coverity.patch
+++ b/SOURCES/libpng-coverity.patch
@ -0,0 +1,12 @@
+diff --git a/libpng-config.in b/libpng-config.in
+index 3739eb9..7f6b2cc 100644
+--- a/libpng-config.in
+++ b/libpng-config.in
+@@ -13,7 +13,6 @@
+ 
+ version=`pkg-config --modversion libpng`
+ prefix=`pkg-config --variable prefix libpng`
+-exec_prefix=`pkg-config --variable exec_prefix libpng`
+ libdir=`pkg-config --variable libdir libpng`
+ includedir=`pkg-config --variable includedir libpng`
+ libs="-lpng@PNGLIB_MAJOR@@PNGLIB_MINOR@"
--- a/SPECS/libpng.spec
+++ b/SPECS/libpng.spec
@ -1,22 +1,24 @@
-%bcond_without check
-
 Summary:       A library of functions for manipulating PNG image format files
 Name:          libpng
 Epoch:         2
-Version:       1.6.37
-Release:       12%{?dist}
+Version:       1.6.34
+Release:       5%{?dist}
 License:       zlib
+Group:         System Environment/Libraries
 URL:           http://www.libpng.org/pub/png/

-Source0:       https://github.com/glennrp/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
+# Note: non-current tarballs get moved to the history/ subdirectory,
+# so look there if you fail to retrieve the version you want
+Source0:       https://ftp-osl.osuosl.org/pub/libpng/src/libpng16/libpng-%{version}.tar.xz
 Source1:       pngusr.dfa
 Patch0:        libpng-multilib.patch
 Patch1:        libpng-fix-arm-neon.patch
+Patch2:        libpng-CVE-2018-13785.patch
+Patch3:        libpng-coverity.patch
+

-BuildRequires: gcc
 BuildRequires: zlib-devel
 BuildRequires: autoconf automake libtool
-BuildRequires: make

 %description
 The libpng package contains a library of functions for creating and
@ -30,8 +32,9 @@ files.

 %package devel
 Summary:       Development tools for programs to manipulate PNG image format files
+Group:         Development/Libraries
 Requires:      %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-Requires:      zlib-devel%{?_isa} pkgconfig
+Requires:      zlib-devel%{?_isa} pkgconfig%{?_isa}

 %description devel
 The libpng-devel package contains header files and documentation necessary
@ -43,6 +46,7 @@ the libpng package.

 %package static
 Summary:       Static PNG image format file library
+Group:         Development/Libraries
 Requires:      %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}

 %description static
@ -52,6 +56,7 @@ necessary for some boot packages.

 %package tools
 Summary:       Tools for PNG image format file library
+Group:         Development/Libraries
 Requires:      %{name}%{?_isa} = %{epoch}:%{version}-%{release}

 %description tools
@ -64,20 +69,23 @@ cp -p %{SOURCE1} .

 %patch0 -p1
 %patch1 -p1 -b .arm
+%patch2 -p1 -b .CVE-2018-13785
+%patch3 -p1 -b .coverity

 %build
 autoreconf -vif
 %configure
-%make_build DFA_XTRA=pngusr.dfa
+make %{?_smp_mflags} DFA_XTRA=pngusr.dfa

 %install
-%make_install
+make DESTDIR=$RPM_BUILD_ROOT install

 # We don't ship .la files.
 rm -f $RPM_BUILD_ROOT%{_libdir}/*.la

-%if 0%{?with_check}
 %check
+#to run make check use "--with check"
+%if %{?_with_check:1}%{!?_with_check:0}
 make check
 %endif

@ -104,65 +112,11 @@ make check
 %{_bindir}/pngfix

 %changelog
-* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2:1.6.37-12
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
-
-* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2:1.6.37-11
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
-
-* Wed Mar 24 2021 Nikola Forró <nforro@redhat.com> - 2:1.6.37-10
- Remove the aarch64 test workaround, the patches causing the failures
-  have been dropped in zlib-1.2.11-25
-
-* Thu Feb 11 2021 Nikola Forró <nforro@redhat.com> - 2:1.6.37-9
- Run %check by default
-
-* Fri Feb 05 2021 Nikola Forró <nforro@redhat.com> - 2:1.6.37-8
- Use proper pngtest.png reference image on aarch64
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Mon Nov 02 2020 Nikola Forró <nforro@redhat.com> - 2:1.6.37-6
- Remove libpng-devel dependency on arch-specific pkgconfig (#1893523)
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 2:1.6.37-4
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.37-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Wed May 22 2019 Nikola Forró <nforro@redhat.com> - 2:1.6.37-1
- New upstream release 1.6.37
-
-* Wed Feb 27 2019 Debarshi Ray <rishi@fedoraproject.org> - 2:1.6.36-1
- New upstream release 1.6.36
-
-* Fri Feb 08 2019 Nikola Forró <nforro@redhat.com> - 2:1.6.35-3
- Fix CVE-2019-7317 (#1672411)
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.35-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Wed Oct 10 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.35-1
- New upstream release 1.6.35 (#1552349)
-
-* Wed Aug 01 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.34-6
- Fix CVE-2018-13785 (#1599944)
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.34-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+* Mon Oct 15 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.34-5
+- Fix important Covscan defects (#1602588)

-* Tue Feb 20 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.34-4
- Add missing gcc build dependency
+* Wed Aug 01 2018 Nikola Forró <nforro@redhat.com> - 2:1.6.34-4
+- Fix CVE-2018-13785 (#1599952)

 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.6.34-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild