On Tue, May 26, 2009 at 09:54:53AM +0800, Paul Wise wrote: > >At synfig.org we are getting users whining about APNG support, which I >refuse to add without a library to write the files. Since upstream >libpng is likely never going to accept APNG, how about for Debian, >compiling libpng without the patch and then in the same source package, >compile libpng with the patch into a separate binary package? This could >produce libapng-dev and libapng0d (Debian-specific SONAME) that Debian >packages could build in APNG support with. > >Is the above suggestion a proper way forward for APNG?
libpng has a history with a number of CVEs. Shipping the APNG patch may increase the risk of potential security issues. At https://bugzilla.mozilla.org/show_bug.cgi?id=257263 it reads: ------- Comment #136 From Mike Hommey 2007-03-28 07:26:08 PDT ------- There is something that I really don't like here. Mozilla is already pushing APNG with Gecko 1.9 alpha 3 and invites people to create such content. The implementation of apng seems to be done as a modification of the embedded libpng, which also means that if apng doesn't make its way to the official libpng, it will remain a maintainance hell for linux distributors... this situation sucks pretty hard. We could get stuck with an old version of libpng if the maintainer of the APNG patch takes too long to release a new version after the release of libpng. Who's the current maintainer of the APNG patch? At http://littlesvr.ca/apng/ it reads: 21 May 2008: After maintaining the patch for a year I've decided to move on to other things. Hopefully someone else will continue to update it for new versions of libpng.
signature.asc
Description: Digital signature
