[libpng16] If CRC handling of critical chunks has been set to PNG_CRC_QUIET_USE,

ignore the ADLER32 checksum in the IDAT chunk as well as the chunk CRCs.

ANNOUNCE

-Libpng 1.6.26beta01 - September 19, 2016
+Libpng 1.6.26beta01 - September 25, 2016
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -25,7 +25,7 @@ Other information:
 
 Changes since the last public release (1.6.25):
 
-Version 1.6.26beta01 [September 19, 2016]
+Version 1.6.26beta01 [September 25, 2016]
   Fixed handling zero length IDAT in pngfix (bug report by Agostino Sarubbo,
     bugfix by John Bowler).
   Do not issue a png_error() on read in png_set_pCAL() because png_handle_pCAL
@@ -35,6 +35,8 @@ Version 1.6.26beta01 [September 19, 2016]
     while decoding compressed data chunks.
   Changed PNG_ZLIB_VERNUM to ZLIB_VERNUM in pngpriv.h, pngstruct.h, and
     pngrutil.c.
+  If CRC handling of critical chunks has been set to PNG_CRC_QUIET_USE,
+    ignore the ADLER32 checksum in the IDAT chunk as well as the chunk CRCs.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit

CHANGES

@@ -5703,7 +5703,7 @@ Version 1.6.25rc05 [August 30, 2016]
 Version 1.6.25 [September 1, 2016]
   No changes.
 
-Version 1.6.26beta01 [September 19, 2016]
+Version 1.6.26beta01 [September 25, 2016]
   Fixed handling zero length IDAT in pngfix (bug report by Agostino Sarubbo,
     bugfix by John Bowler).
   Do not issue a png_error() on read in png_set_pCAL() because png_handle_pCAL
@@ -5713,6 +5713,8 @@ Version 1.6.26beta01 [September 19, 2016]
     while decoding compressed data chunks.
   Changed PNG_ZLIB_VERNUM to ZLIB_VERNUM in pngpriv.h, pngstruct.h, and
     pngrutil.c.
+  If CRC handling of critical chunks has been set to PNG_CRC_QUIET_USE,
+    ignore the ADLER32 checksum in the IDAT chunk as well as the chunk CRCs.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit

pngrutil.c

 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.6.25 [September 1, 2016]
+ * Last changed in libpng 1.6.26 [(PENDING RELEASE)]
  * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -371,10 +371,9 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
    {
       int ret; /* zlib return code */
 #if ZLIB_VERNUM >= 0x1240
+      int window_bits = 0;
 
 # if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW)
-      int window_bits;
-
       if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & 3) ==
           PNG_OPTION_ON)
       {
@@ -384,13 +383,11 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
 
       else
       {
-         window_bits = 0;
          png_ptr->zstream_start = 1;
       }
-# else
-#   define window_bits 0
 # endif
-#endif
+
+#endif /* ZLIB_VERNUM >= 0x1240 */
 
       /* Set this for safety, just in case the previous owner left pointers to
        * memory allocations.
@@ -402,25 +399,31 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
 
       if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
       {
-#if ZLIB_VERNUM < 0x1240
-         ret = inflateReset(&png_ptr->zstream);
-#else
+#if ZLIB_VERNUM >= 0x1240
          ret = inflateReset2(&png_ptr->zstream, window_bits);
+#else
+         ret = inflateReset(&png_ptr->zstream);
 #endif
       }
 
       else
       {
-#if ZLIB_VERNUM < 0x1240
-         ret = inflateInit(&png_ptr->zstream);
-#else
+#if ZLIB_VERNUM >= 0x1240
          ret = inflateInit2(&png_ptr->zstream, window_bits);
+#else
+         ret = inflateInit(&png_ptr->zstream);
 #endif
 
          if (ret == Z_OK)
             png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED;
       }
 
+#if ZLIB_VERNUM >= 0x1240
+      /* Turn off validation of the ADLER32 checksum */
+      if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)
+         ret = inflateReset2(&png_ptr->zstream, -window_bits);
+#endif
+
       if (ret == Z_OK)
          png_ptr->zowner = owner;
 
@@ -4103,7 +4106,10 @@ png_read_IDAT_data(png_structrp png_ptr, png_bytep output,
          if (output != NULL)
          {
             if(!strncmp(png_ptr->zstream.msg,"incorrect data check",20))
+            {
                png_chunk_benign_error(png_ptr, "ADLER32 checksum mismatch");
+               continue;
+            }
             else
                png_chunk_error(png_ptr, png_ptr->zstream.msg);
          }