LIBPNG is a reference library for use in applications that read

#!/usr/bin/env python3
# Check exposure to CVE-2026-34757 in libpng
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import argparse
import os
import re
import shutil
import subprocess
import sys
from ctypes.util import find_library

PATCHED_VERSION = (1, 6, 57)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v) if v else 'UNKNOWN'


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=8)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
    except Exception:
        pass
    return None


def detect_versions():
    findings = []

    # 1) explicit version argument is handled outside this function

    # 2) pkg-config
    if shutil.which('pkg-config'):
        out = run_cmd(['pkg-config', '--modversion', 'libpng'])
        v = parse_version(out)
        if v:
            findings.append(('pkg-config:libpng', v))
        else:
            out = run_cmd(['pkg-config', '--modversion', 'libpng16'])
            v = parse_version(out)
            if v:
                findings.append(('pkg-config:libpng16', v))

    # 3) libpng-config
    if shutil.which('libpng-config'):
        out = run_cmd(['libpng-config', '--version'])
        v = parse_version(out)
        if v:
            findings.append(('libpng-config', v))

    # 4) common package managers
    if shutil.which('dpkg-query'):
        for pkg in ['libpng16-16', 'libpng16-16t64', 'libpng', 'libpng-dev', 'libpng16-dev']:
            out = run_cmd(['dpkg-query', '-W', '-f=${Version}', pkg])
            v = parse_version(out)
            if v:
                findings.append((f'dpkg:{pkg}', v))

    if shutil.which('rpm'):
        for pkg in ['libpng', 'libpng16', 'libpng-devel']:
            out = run_cmd(['rpm', '-q', pkg, '--qf', '%{VERSION}-%{RELEASE}'])
            v = parse_version(out)
            if v:
                findings.append((f'rpm:{pkg}', v))

    if shutil.which('apk'):
        out = run_cmd(['apk', 'info', '-v'])
        if out:
            for line in out.splitlines():
                if line.startswith('libpng-') or line.startswith('libpng-dev-'):
                    v = parse_version(line)
                    if v:
                        findings.append((f'apk:{line.split('-')[0]}', v))

    # 5) try to infer from library filename/path
    lib = find_library('png16') or find_library('png')
    if lib:
        v = parse_version(lib)
        if v:
            findings.append((f'ctypes:{lib}', v))

    # de-duplicate while preserving order
    seen = set()
    unique = []
    for src, v in findings:
        key = (src, v)
        if key not in seen:
            seen.add(key)
            unique.append((src, v))
    return unique


def classify(version):
    # CVE affects >=1.0.9 and <1.6.57 according to upstream/NVD.
    # Note: some distros backport fixes without bumping to 1.6.57, so package-manager results may need vendor advisory confirmation.
    if version is None:
        return ('UNKNOWN', 2)
    if version < (1, 0, 9):
        return ('PATCHED', 0)
    if version < PATCHED_VERSION:
        return ('VULNERABLE', 1)
    return ('PATCHED', 0)


def main():
    ap = argparse.ArgumentParser(description='Check libpng version exposure to CVE-2026-34757')
    ap.add_argument('--version', help='Override autodetect and test a specific libpng version, e.g. 1.6.56')
    args = ap.parse_args()

    if args.version:
        v = parse_version(args.version)
        if not v:
            print('UNKNOWN - could not parse --version argument')
            sys.exit(2)
        status, code = classify(v)
        print(f'{status} - supplied version {version_to_str(v)} vs patched threshold 1.6.57')
        sys.exit(code)

    findings = detect_versions()
    if not findings:
        print('UNKNOWN - could not detect libpng version via pkg-config, libpng-config, package manager, or library path')
        sys.exit(2)

    # Prefer the highest detected semantic version as the best installed candidate.
    highest = max(v for _, v in findings)
    status, code = classify(highest)

    print(f'Detected libpng candidates:')
    for src, v in findings:
        print(f'  - {src}: {version_to_str(v)}')
    print(f'Assessment basis: highest detected version {version_to_str(highest)}; patched threshold 1.6.57')

    if code == 1:
        print('VULNERABLE - note that vendor backports may still fix this without changing the upstream version string; confirm with your distro advisory')
    elif code == 0:
        print('PATCHED')
    else:
        print('UNKNOWN')
    sys.exit(code)


if __name__ == '__main__':
    main()