libpng-1.0.2 broken

[Andreas Tille <tille@physik.uni-halle.de>]

Hello,

due to problems with the latest libpng which I call from ImLib
I wrote to rasterman (author of ImLib).  Because it seems me to be
importand I enclose his private mail here (hoping that he hasn't
any objections against this ...).

R> Date: Thu, 22 Oct 1998 14:03:41 -0400 (EDT)
R> From: "The Rasterman (Carsten Haitzler)" <raster@redhat.com>
R> To: Andreas Tille <tille@physik.uni-halle.de>
R> Subject: Re: ImLib can't read all png files with libpng 1.0.2
R> 
R> On Thu, 22 Oct 1998, Andreas Tille wrote:
R> 
R> > Hello,
R> > 
R> > I updated to libpng-1.0.2 (... may be this was my fault :-().
R> 
R> 1.0.2 has bugs - downgrade to 1.0.1
R> 
R> > Now some png files aren't read correctly by ImLib.
R> > I tested it with your very simple example from the tutorial.
R> > I attached one of the files, which ImLib isn't able to load.
R> > 
R> > I looked some hours on the code but couldn't detect the problem.
R> 
R> That's cause its a libpng bug.

I've done some further investigation which showed at least the reason
*why* some of my files can't be read correctly.  The allocation of
png_ptr->zbuf changes the value of png_ptr->time_buffer (please don't
ask me why.  Later on freeing of png_ptr->time_buffer breaks the
program with SIG_SEGV or may be libpng creates a scrambled pixmap.

In the following patch I marked the critical parts of pngread.c:

-----------------------------------------------------------------------
--- pngread.c	Sun Jun 14 21:43:31 1998
+++ pngread.c.new	Thu Oct 22 22:16:19 1998
@@ -81,8 +81,10 @@
 
    /* initialize zbuf - compression buffer */
    png_ptr->zbuf_size = PNG_ZBUF_SIZE;
+printf("%s(%i) png_ptr->time_buffer = %p\n", __FILE__, __LINE__, png_ptr->time_buffer);
    png_ptr->zbuf = (png_bytep)png_malloc(png_ptr,
      (png_uint_32)png_ptr->zbuf_size);
+printf("%s(%i) png_ptr->time_buffer = %p\n", __FILE__, __LINE__, png_ptr->time_buffer);
    png_ptr->zstream.zalloc = png_zalloc;
    png_ptr->zstream.zfree = png_zfree;
    png_ptr->zstream.opaque = (voidpf)png_ptr;
@@ -846,7 +848,9 @@
 #endif
 #endif
 #if defined(PNG_TIME_RFC1123_SUPPORTED)
-   png_free(png_ptr, png_ptr->time_buffer);
+printf("%s(%i) next line was commented out to avoid crash (png_ptr->time_buffer = %p)\n",
+       __FILE__, __LINE__, png_ptr->time_buffer);
+/* png_free(png_ptr, png_ptr->time_buffer); */
 #endif /* PNG_TIME_RFC1123_SUPPORTED */
 
    inflateEnd(&png_ptr->zstream);
-----------------------------------------------------------------------------

Note: This patch does NOT SOLVE the problem but gives a pointer to the
location, where it has to be solved!!  I'm not so familiar with libpng
that I could do the job but I want it to make someone else easyer.

I decided to report this to the list give a reasonable warning and the
chance to give the maintainer more help.

If someone can't reproduce the problem I can support some files that
break when using the simplest viewer I can imagine: some code snipped
from the ImLib tutorial.

Should we follow the suggestion of "The Rasterman" to downgrade or
should we fix the bug(s???).

In the case we decide to fix it I'm afraid that we have to do it
ourselves.  In former times I wanted to support the libpng authors
by some autoconf/automake stuff I've written to cope with several
machines (If there is any interest I can ship it to an apropriate
location, may be the maintainer??).  In my opinion it would be a case
of fairness to give any answer (may be:  We don't need your nonsense.)
but ignoring it completely wasn't the way I expected...


Kind regards

          Andreas.