[libpng14] Imported from libpng-1.4.13beta03.tar

directories

ANNOUNCE

@@ -1,5 +1,5 @@
 
-Libpng 1.4.9beta01 - September 2, 2011
+Libpng 1.4.13beta03 - June 18, 2013
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -9,28 +9,42 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script
 
-   1.4.9beta01.tar.xz (LZMA-compressed, recommended)
+   1.4.13beta03.tar.xz (LZMA-compressed, recommended)
-   1.4.9beta01.tar.gz
+   1.4.13beta03.tar.gz
-   1.4.9beta01.tar.bz2
+   1.4.13beta03.tar.bz2
 
 Source files with CRLF line endings (for Windows), without the
 "configure" script
 
-   lp149b01.7z (LZMA-compressed, recommended)
+   lp1413b03.7z (LZMA-compressed, recommended)
-   lp149b01.zip
+   lp1413b03.zip
 
 Other information:
 
-   1.4.9beta01-README.txt
+   1.4.13beta03-README.txt
-   1.4.9beta01-LICENSE.txt
+   1.4.13beta03-LICENSE.txt
 
-Changes since the last public release (1.4.8):
+Changes since the last public release (1.4.11):
 
-version 1.4.9beta01 [September 2, 2011]
+version 1.4.12 [July 10, 2012]
-  Added vstudio/* and CMakeLists to EXTRA_DIST in Makefile.in and Makefile.am
+  Added two images to contrib/pngsuite (1-bit and 2-bit transparent grayscale),
-  Updated contrib/pngminus/makefile.std (Samuli Souminen)
+    and renamed three whose names were inconsistent with those in
-  Added SunOS support to configure.ac and Makefile.am (but configure and
+    pngsuite/README.txt.
-    Makefile.in were not updated)
+  Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386.
+
+version 1.4.13beta01 [January 1, 2013]
+  Do not compile PNG_DEPRECATED, PNG_ALLOC and PNG_PRIVATE when __GNUC__ < 3.
+  Removed references to png_zalloc() and png_zfree() from the manual.
+  Ignore, with a warning, out-of-range value of num_trans in png_set_tRNS().
+
+version 1.4.13beta02 [January 22, 2013]
+  Replaced AM_CONFIG_HEADER(config.h) with AC_CONFIG_HEADERS([config.h])
+    in configure.ac
+  Changed default value of PNG_USER_CACHE_MAX from 0 to 32767 in pngconf.h.
+
+version 1.4.13beta03 [June 18, 2013]
+  Avoid a possible memory leak in contrib/gregbook/readpng.c
+  Removed a redundant test from png_set_IHDR().
 
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit

CHANGES

@@ -2825,12 +2825,70 @@ version 1.4.8rc01 [June 30, 2011]
 version 1.4.8 [July 7, 2011]
   No changes.
 
-version 1.4.9beta01 [September 2, 2011]
+version 1.4.9beta01 [February 16, 2012]
   Added vstudio/* and CMakeLists to EXTRA_DIST in Makefile.in and Makefile.am
   Updated contrib/pngminus/makefile.std (Samuli Souminen)
   Added SunOS support to configure.ac and Makefile.am (but configure and
     Makefile.in were not updated)
 
+version 1.4.9rc01 [February 17, 2012]
+  Fixed CVE-2011-3026 buffer overrun bug.  This bug was introduced when
+    iCCP chunk support was added at libpng-1.0.6. Deal more correctly with the
+    test on iCCP chunk length. Also removed spurious casts that may hide
+    problems on 16-bit systems.
+
+version 1.4.9 [February 18, 2012]
+  No changes.
+
+version 1.4.10beta01 [February 27, 2011]
+  Removed two useless #ifdef directives from pngread.c and one from pngrutil.c
+  Eliminated redundant png_push_read_tEXt|zTXt|iTXt|unknown code from
+    pngpread.c and use the sequential png_handle_tEXt, etc., in pngrutil.c;
+    now that png_ptr->buffer is inaccessible to applications, the special
+    handling is no longer useful.
+  Fixed bug with png_handle_hIST with odd chunk length (Frank Busse).
+  Fixed incorrect type (int copy should be png_size_t copy) in png_inflate()
+    (fixes CVE-2011-3045).
+  Fixed off-by-one bug in png_handle_sCAL() when using fixed point arithmetic,
+    causing out-of-bounds read in png_set_sCAL() because of failure to copy
+    the string terminators.  This bug was introduced in libpng-1.0.6 (Frank
+    Busse).
+
+version 1.4.10rc01 [March 2, 2012]
+  Removed the png_free() of unused png_ptr->current_text from pngread.c.
+
+version 1.4.10rc02 [March 6, 2012]
+  Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition in png.h
+
+version 1.4.10 [March 15, 2012]
+  No changes.
+
+version 1.4.11 [March 29, 2012]
+  Revised png_set_text_2() to avoid potential memory corruption (fixes
+    CVE-2011-3048, also known as CVE-2012-3425).
+  Prevent PNG_EXPAND+PNG_SHIFT doing the shift twice.
+
+version 1.4.12 [July 10, 2012]
+  Added two images to contrib/pngsuite (1-bit and 2-bit transparent grayscale),
+    and renamed three whose names were inconsistent with those in
+    pngsuite/README.txt.
+  Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386.
+
+version 1.4.13beta01 [January 1, 2013]
+  Do not compile PNG_DEPRECATED, PNG_ALLOC and PNG_PRIVATE when __GNUC__ < 3.
+  Removed references to png_zalloc() and png_zfree() from the manual.
+  Ignore, with a warning, out-of-range value of num_trans in png_set_tRNS().
+
+version 1.4.13beta02 [January 22, 2013]
+  Replaced AM_CONFIG_HEADER(config.h) with AC_CONFIG_HEADERS([config.h])
+    in configure.ac
+  Changed default value of PNG_USER_CACHE_MAX from 0 to 32767 in pngconf.h.
+
+version 1.4.13beta03 [June 18, 2013]
+  Avoid a possible memory leak in contrib/gregbook/readpng.c
+  Removed a redundant test from png_set_IHDR().
+  Revised libpng.3 so that "doclift" can process it.
+
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement).

CMakeLists.txt

@@ -33,7 +33,7 @@ enable_testing()
 
 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 4)
-set(PNGLIB_RELEASE 9)
+set(PNGLIB_RELEASE 13)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})
 
@@ -255,7 +255,7 @@ install(CODE ${PNG_CONFIG_INSTALL_CODE})
 # SET UP LINKS
 if(PNG_SHARED)
   set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 14.${PNGLIB_RELEASE}.1.4.9beta01
+#   VERSION 14.${PNGLIB_RELEASE}.1.4.13beta03
     VERSION 14.${PNGLIB_RELEASE}.0
     SOVERSION 14
     CLEAN_DIRECT_OUTPUT 1)

INSTALL

@@ -1,5 +1,5 @@
 
-Installing libpng version 1.4.9beta01 - July 8, 2011
+Installing libpng version 1.4.13beta03 - June 18, 2013
 
 On Unix/Linux and similar systems, you can simply type
 
@@ -46,7 +46,7 @@ to have access to the zlib.h and zconf.h include files that
 correspond to the version of zlib that's installed.
 
 You can rename the directories that you downloaded (they
-might be called "libpng-1.4.9beta01" or "libpng14" and "zlib-1.2.3"
+might be called "libpng-1.4.13beta03" or "libpng14" and "zlib-1.2.3"
 or "zlib123") so that you have directories called "zlib" and "libpng".
 
 Your directory structure should look like this:

LICENSE

@@ -10,7 +10,7 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.2.6, August 15, 2004, through 1.4.9beta01, July 8, 2011, are
+libpng versions 1.2.6, August 15, 2004, through 1.4.13beta03, June 18, 2013, are
 Copyright (c) 2004, 2006-2010 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -108,4 +108,4 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-July 8, 2011
+June 18, 2013

Makefile.am

@@ -79,7 +79,7 @@ EXTRA_DIST= \
 	${srcdir}/contrib/pngsuite/* \
 	${srcdir}/contrib/visupng/* \
 	$(TESTS) \
-	example.c libpng-1.4.9beta01.txt
+	example.c libpng-1.4.13beta03.txt
 
 CLEANFILES= pngout.png libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@-config libpng.vers \
 libpng.sym

Makefile.in

@@ -332,7 +332,7 @@ EXTRA_DIST = \
 	${srcdir}/contrib/pngsuite/* \
 	${srcdir}/contrib/visupng/* \
 	$(TESTS) \
-	example.c libpng-1.4.9beta01.txt
+	example.c libpng-1.4.13beta03.txt
 
 CLEANFILES = pngout.png libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@-config libpng.vers \
 libpng.sym
@@ -1003,7 +1003,7 @@ distcheck: dist
 	*.zip*) \
 	  unzip $(distdir).zip ;;\
 	esac
-	chmod -R a-w $(distdir); chmod a+w $(distdir)
+	chmod -R a-w $(distdir); chmod u+w $(distdir)
 	mkdir $(distdir)/_build
 	mkdir $(distdir)/_inst
 	chmod a-w $(distdir)

README

@@ -1,4 +1,4 @@
-README for libpng version 1.4.9beta01 - July 8, 2011 (shared library 14.0)
+README for libpng version 1.4.13beta03 - June 18, 2013 (shared library 14.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
@@ -167,24 +167,29 @@ Files in this distribution:
        gregbook         =>  source code for PNG reading and writing, from
                             Greg Roelofs' "PNG: The Definitive Guide",
                             O'Reilly, 1999
-       msvctest     =>  Builds and runs pngtest using a MSVC workspace
+       pngminim         =>  Minimal decoder, encoder, and progressive decoder
+                            programs demonstrating use of pngusr.dfa
        pngminus         =>  Simple pnm2png and png2pnm programs
        pngsuite         =>  Test images
        visupng          =>  Contains a MSVC workspace for VisualPng
       projects      =>  Contains project files and workspaces for
                         building a DLL
-       c5builder        =>  Contains a Borland workspace for building
-                            libpng and zlib
        visualc6         =>  Contains a Microsoft Visual C++ (MSVC)
                             workspace for building libpng and zlib
+       visualc71        =>  Contains a Microsoft Visual C++ (MSVC)
+                            workspace for building libpng and zlib
+       vstudio          =>  Contains a Microsoft Visual C++ (MSVC)
+                            workspace for building libpng and zlib
+       xcode            =>  Contains an Apple xcode
+                            workspace for building libpng and zlib
       scripts       =>  Directory containing scripts for building libpng:
        descrip.mms      =>  VMS makefile for MMS or MMK
        makefile.std     =>  Generic UNIX makefile (cc, creates static
                             libpng.a)
        makefile.elf     =>  Linux/ELF makefile symbol versioning,
-                            (gcc, creates libpng14.so.14.1.4.9beta01)
+                            (gcc, creates libpng14.so.14.1.4.13beta03)
        makefile.linux   =>  Linux/ELF makefile
-                            (gcc, creates libpng14.so.14.1.4.9beta01)
+                            (gcc, creates libpng14.so.14.1.4.13beta03)
        makefile.gcc     =>  Generic makefile (gcc, creates static libpng.a)
        makefile.knr     =>  Archaic UNIX Makefile that converts files with
                             ansi2knr (Requires ansi2knr.c from
@@ -206,12 +211,12 @@ Files in this distribution:
        makefile.openbsd =>  OpenBSD makefile
        makefile.sgi     =>  Silicon Graphics IRIX (cc, creates static lib)
        makefile.sggcc   =>  Silicon Graphics
-                            (gcc, creates libpng14.so.14.1.4.9beta01)
+                            (gcc, creates libpng14.so.14.1.4.13beta03)
        makefile.sunos   =>  Sun makefile
        makefile.solaris =>  Solaris 2.X makefile
-                            (gcc, creates libpng14.so.14.1.4.9beta01)
+                            (gcc, creates libpng14.so.14.1.4.13beta03)
        makefile.so9     =>  Solaris 9 makefile
-                            (gcc, creates libpng14.so.14.1.4.9beta01)
+                            (gcc, creates libpng14.so.14.1.4.13beta03)
        makefile.32sunu  =>  Sun Ultra 32-bit makefile
        makefile.64sunu  =>  Sun Ultra 64-bit makefile
        makefile.sco     =>  For SCO OSr5  ELF and Unixware 7 with Native cc

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.65 for libpng 1.4.9beta01.
+# Generated by GNU Autoconf 2.65 for libpng 1.4.13beta03.
 #
 # Report bugs to <png-mng-implement@lists.sourceforge.net>.
 #
@@ -562,8 +562,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libpng'
 PACKAGE_TARNAME='libpng'
-PACKAGE_VERSION='1.4.9beta01'
+PACKAGE_VERSION='1.4.13beta03'
-PACKAGE_STRING='libpng 1.4.9beta01'
+PACKAGE_STRING='libpng 1.4.13beta03'
 PACKAGE_BUGREPORT='png-mng-implement@lists.sourceforge.net'
 PACKAGE_URL=''
 
@@ -1292,7 +1292,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures libpng 1.4.9beta01 to adapt to many kinds of systems.
+\`configure' configures libpng 1.4.13beta03 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1362,7 +1362,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libpng 1.4.9beta01:";;
+     short | recursive ) echo "Configuration of libpng 1.4.13beta03:";;
    esac
   cat <<\_ACEOF
 
@@ -1467,7 +1467,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libpng configure 1.4.9beta01
+libpng configure 1.4.13beta03
 generated by GNU Autoconf 2.65
 
 Copyright (C) 2009 Free Software Foundation, Inc.
@@ -1892,7 +1892,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libpng $as_me 1.4.9beta01, which was
+It was created by libpng $as_me 1.4.13beta03, which was
 generated by GNU Autoconf 2.65.  Invocation command line was
 
   $ $0 $@
@@ -2700,7 +2700,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='libpng'
- VERSION='1.4.9beta01'
+ VERSION='1.4.13beta03'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -2764,10 +2764,10 @@ fi
 
 
 
-PNGLIB_VERSION=1.4.9beta01
+PNGLIB_VERSION=1.4.13beta03
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=4
-PNGLIB_RELEASE=9
+PNGLIB_RELEASE=13
 
 
 
@@ -12175,7 +12175,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libpng $as_me 1.4.9beta01, which was
+This file was extended by libpng $as_me 1.4.13beta03, which was
 generated by GNU Autoconf 2.65.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -12241,7 +12241,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-libpng config.status 1.4.9beta01
+libpng config.status 1.4.13beta03
 configured by $0, generated by GNU Autoconf 2.65,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -16,22 +16,22 @@ dnl should not be necessary to regenerate configure if the time
 dnl stamps are correct
 AC_PREREQ(2.59)
 
-AC_INIT([libpng], [1.4.9beta01], [png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng], [1.4.13beta03], [png-mng-implement@lists.sourceforge.net])
 AM_INIT_AUTOMAKE
 dnl stop configure from automagically running automake
 AM_MAINTAINER_MODE
 
 dnl Version number stuff here:
 
-PNGLIB_VERSION=1.4.9beta01
+PNGLIB_VERSION=1.4.13beta03
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=4
-PNGLIB_RELEASE=9
+PNGLIB_RELEASE=13
 
 dnl End of version number stuff
 
 AC_CONFIG_SRCDIR([pngget.c])
-AM_CONFIG_HEADER(config.h)
+AC_CONFIG_HEADERS([config.h])
 
 # Checks for programs.
 AC_PROG_CC

contrib/gregbook/readpng.c

@@ -214,6 +214,10 @@ uch *readpng_get_image(double display_exponent, int *pChannels, ulg *pRowbytes)
      * libpng function */
 
     if (setjmp(png_jmpbuf(png_ptr))) {
+        free(image_data);
+        image_data = NULL;
+        free(row_pointers);
+        row_pointers = NULL;
         png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
         return NULL;
     }

contrib/pngminim/encoder/README

@@ -1,9 +1,10 @@
 This demonstrates the use of PNG_USER_CONFIG and pngusr.h
 
-To build a minimal write-only decoder with embedded libpng and zlib, run
+The makefile builds a minimal write-only encoder with embedded libpng
+and zlib.
 
-    gather.sh  # to collect needed files from pngminus, libpng, and zlib
+Specify the location of the zlib source (1.2.1 or later) as ZLIBSRC
-    make
+on the make command line.
 
 If you prefer to use the shared libraries, go to contrib/pngminus
 and build the pnm2png application there.

contrib/pngsuite/README

@@ -1,7 +1,8 @@
 
 pngsuite
 --------
-(c) Willem van Schaik, 1999, 2011
+(c) Willem van Schaik, 1999, 2011, 2012
+Two images are by Glenn Randers-Pehrson, 2012
 
 Permission to use, copy, modify, and distribute these images for any
 purpose and without fee is hereby granted.
@@ -38,6 +39,8 @@ can use them to test the proper functioning of PNG software.
     basn6a08.png   8-bit RGBA
     basn6a16.png  16-bit RGBA
 
+    ftbbn0g01.png  1-bit grayscale, black bKGD
+    ftbbn0g02.png  2-bit grayscale, black bKGD
     ftbbn0g04.png  4-bit grayscale, black bKGD
     ftbbn2c16.png 16-bit truecolor, black bKGD
     ftbbn3p08.png  8-bit paletted, black bKGD

libpng-1.4.13beta03.txt

@@ -1,9 +1,9 @@
 libpng.txt - A description on how to use and modify libpng
 
- libpng version 1.4.9beta01 - July 13, 2011
+ libpng version 1.4.13beta03 - June 18, 2013
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
- Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ Copyright (c) 1998-2013 Glenn Randers-Pehrson
 
  This document is released under the libpng license.
  For conditions of distribution and use, see the disclaimer
@@ -11,7 +11,7 @@ libpng.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.4.9beta01 - July 13, 2011
+ libpng versions 0.97, January 1998, through 1.4.13beta03 - June 18, 2013
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2010 Glenn Randers-Pehrson
 
@@ -906,7 +906,7 @@ things.
 As of libpng version 1.2.9, png_set_expand_gray_1_2_4_to_8() was
 added.  It expands the sample depth without changing tRNS to alpha.
 
-As of libpng version 1.4.9beta01, not all possible expansions are supported.
+As of libpng version 1.4.13beta03, not all possible expansions are supported.
 
 In the following table, the 01 means grayscale with depth<8, 31 means
 indexed with depth<8, other numerals represent the color type, "T" means
@@ -1434,7 +1434,7 @@ sPLT, only the n'th item in the structure is freed, where n is "seq".
 The default behavior is only to free data that was allocated internally
 by libpng.  This can be changed, so that libpng will not free the data,
 or so that it will free data that was allocated by the user with png_malloc()
-or png_zalloc() and passed in via a png_set_*() function, with
+and passed in via a png_set_*() function, with
 
     png_data_freer(png_ptr, info_ptr, freer, mask)
     mask   - which data elements are affected
@@ -1453,7 +1453,7 @@ or png_destroy_*() is supposed to free the data.  When the user assumes
 responsibility for libpng-allocated data, the application must use
 png_free() to free it, and when the user transfers responsibility to libpng
 for data that the user has allocated, the user must have used png_malloc()
-or png_zalloc() to allocate it.
+to allocate it.
 
 If you allocated your row_pointers in a single block, as suggested above in
 the description of the high level read interface, you must not transfer
@@ -2467,7 +2467,7 @@ png_destroy_write_struct().
 The default behavior is only to free data that was allocated internally
 by libpng.  This can be changed, so that libpng will not free the data,
 or so that it will free data that was allocated by the user with png_malloc()
-or png_zalloc() and passed in via a png_set_*() function, with
+and passed in via a png_set_*() function, with
 
     png_data_freer(png_ptr, info_ptr, freer, mask)
     mask   - which data elements are affected
@@ -2500,7 +2500,7 @@ When the user assumes responsibility for libpng-allocated data, the
 application must use
 png_free() to free it, and when the user transfers responsibility to libpng
 for data that the user has allocated, the user must have used png_malloc()
-or png_zalloc() to allocate it.
+to allocate it.
 
 If you allocated text_ptr.text, text_ptr.lang, and text_ptr.translated_keyword
 separately, do not transfer responsibility for freeing text_ptr to libpng,
@@ -2877,7 +2877,7 @@ the message, "message" is the formatted string to be printed,
 and p1 and p2 are parameters that are to be embedded in the string
 according to printf-style formatting directives.  For example,
 
-   png_debug1(2, "foo=%d\n", foo);
+   png_debug1(2, "foo=%d", foo);
 
 is expanded to
 
@@ -3189,11 +3189,11 @@ control.  The git repository was built from old libpng-x.y.z.tar.gz files
 going back to version 0.70.  You can access the git repository (read only)
 at
 
-    git://libpng.git.sourceforge.net/gitroot/libpng
+    git://git.code.sf.net/p/libpng/code
 
-or you can browse it via "gitweb" at
+or you can browse it with a web browser by selecting the "code" button at
 
-    http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng
+    https://sourceforge.net/projects/libpng/
 
 Patches can be sent to glennrp at users.sourceforge.net or to
 png-mng-implement at lists.sourceforge.net or you can upload them to
@@ -3288,7 +3288,7 @@ above the comment that says
 
 To avoid polluting the global namespace, the names of all exported
 functions and variables begin with "png_", and all publicly visible C
-preprocessor macros begin with "PNG_".  We request that applications that
+preprocessor macros begin with "PNG".  We request that applications that
 use libpng *not* begin any of their own symbols with either of these strings.
 
 We put a space after each comma and after each semicolon
@@ -3312,13 +3312,13 @@ Other rules can be inferred by inspecting the libpng source.
 
 XIII. Y2K Compliance in libpng
 
-July 13, 2011
+June 18, 2013
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.4.9beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.4.13beta03 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that

libpng.3

@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "July 13, 2011"
+.TH LIBPNG 3 "June 18, 2013"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.4.9beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.4.13beta03
 .SH SYNOPSIS
 \fI\fB
 
@@ -876,14 +876,6 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.4.9beta01
 
 \fI\fB
 
-\fBvoidpf png_zalloc (voidpf \fP\fIpng_ptr\fP\fB, uInt \fP\fIitems\fP\fB, uInt \fIsize\fP\fB);\fP
-
-\fI\fB
-
-\fBvoid png_zfree (voidpf \fP\fIpng_ptr\fP\fB, voidpf \fIptr\fP\fB);\fP
-
-\fI\fB
-
 .SH DESCRIPTION
 The
 .I libpng
@@ -895,10 +887,10 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng.txt - A description on how to use and modify libpng
 
- libpng version 1.4.9beta01 - July 13, 2011
+ libpng version 1.4.13beta03 - June 18, 2013
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
- Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ Copyright (c) 1998-2013 Glenn Randers-Pehrson
 
  This document is released under the libpng license.
  For conditions of distribution and use, see the disclaimer
@@ -906,7 +898,7 @@ libpng.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.4.9beta01 - July 13, 2011
+ libpng versions 0.97, January 1998, through 1.4.13beta03 - June 18, 2013
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2010 Glenn Randers-Pehrson
 
@@ -1801,7 +1793,7 @@ things.
 As of libpng version 1.2.9, png_set_expand_gray_1_2_4_to_8() was
 added.  It expands the sample depth without changing tRNS to alpha.
 
-As of libpng version 1.4.9beta01, not all possible expansions are supported.
+As of libpng version 1.4.13beta03, not all possible expansions are supported.
 
 In the following table, the 01 means grayscale with depth<8, 31 means
 indexed with depth<8, other numerals represent the color type, "T" means
@@ -2329,7 +2321,7 @@ sPLT, only the n'th item in the structure is freed, where n is "seq".
 The default behavior is only to free data that was allocated internally
 by libpng.  This can be changed, so that libpng will not free the data,
 or so that it will free data that was allocated by the user with png_malloc()
-or png_zalloc() and passed in via a png_set_*() function, with
+and passed in via a png_set_*() function, with
 
     png_data_freer(png_ptr, info_ptr, freer, mask)
     mask   - which data elements are affected
@@ -2348,7 +2340,7 @@ or png_destroy_*() is supposed to free the data.  When the user assumes
 responsibility for libpng-allocated data, the application must use
 png_free() to free it, and when the user transfers responsibility to libpng
 for data that the user has allocated, the user must have used png_malloc()
-or png_zalloc() to allocate it.
+to allocate it.
 
 If you allocated your row_pointers in a single block, as suggested above in
 the description of the high level read interface, you must not transfer
@@ -3362,7 +3354,7 @@ png_destroy_write_struct().
 The default behavior is only to free data that was allocated internally
 by libpng.  This can be changed, so that libpng will not free the data,
 or so that it will free data that was allocated by the user with png_malloc()
-or png_zalloc() and passed in via a png_set_*() function, with
+and passed in via a png_set_*() function, with
 
     png_data_freer(png_ptr, info_ptr, freer, mask)
     mask   - which data elements are affected
@@ -3395,7 +3387,7 @@ When the user assumes responsibility for libpng-allocated data, the
 application must use
 png_free() to free it, and when the user transfers responsibility to libpng
 for data that the user has allocated, the user must have used png_malloc()
-or png_zalloc() to allocate it.
+to allocate it.
 
 If you allocated text_ptr.text, text_ptr.lang, and text_ptr.translated_keyword
 separately, do not transfer responsibility for freeing text_ptr to libpng,
@@ -3772,12 +3764,12 @@ the message, "message" is the formatted string to be printed,
 and p1 and p2 are parameters that are to be embedded in the string
 according to printf-style formatting directives.  For example,
 
-   png_debug1(2, "foo=%d\n", foo);
+   png_debug1(2, "foo=%d", foo);
 
 is expanded to
 
    if(PNG_DEBUG > 2)
-     fprintf(PNG_DEBUG_FILE, "foo=%d\n", foo);
+     fprintf(PNG_DEBUG_FILE, "foo=%d\en", foo);
 
 When PNG_DEBUG is defined but is zero, the macros aren't defined, but you
 can still use PNG_DEBUG to control your own debugging:
@@ -4084,11 +4076,11 @@ control.  The git repository was built from old libpng-x.y.z.tar.gz files
 going back to version 0.70.  You can access the git repository (read only)
 at
 
-    git://libpng.git.sourceforge.net/gitroot/libpng
+    git://git.code.sf.net/p/libpng/code
 
-or you can browse it via "gitweb" at
+or you can browse it with a web browser by selecting the "code" button at
 
-    http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng
+    https://sourceforge.net/projects/libpng/
 
 Patches can be sent to glennrp at users.sourceforge.net or to
 png-mng-implement at lists.sourceforge.net or you can upload them to
@@ -4183,7 +4175,7 @@ above the comment that says
 
 To avoid polluting the global namespace, the names of all exported
 functions and variables begin with "png_", and all publicly visible C
-preprocessor macros begin with "PNG_".  We request that applications that
+preprocessor macros begin with "PNG".  We request that applications that
 use libpng *not* begin any of their own symbols with either of these strings.
 
 We put a space after each comma and after each semicolon
@@ -4207,13 +4199,13 @@ Other rules can be inferred by inspecting the libpng source.
 
 .SH XIII. Y2K Compliance in libpng
 
-July 13, 2011
+June 18, 2013
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.4.9beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.4.13beta03 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that
@@ -4414,6 +4406,15 @@ the first widely used release:
  1.4.8rc01           14    10408  14.so.14.8[.0]
  1.4.8               14    10408  14.so.14.8[.0]
  1.4.9beta01         14    10409  14.so.14.9[.0]
+ 1.4.9rc01           14    10409  14.so.14.9[.0]
+ 1.4.9               14    10409  14.so.14.9[.0]
+ 1.4.10beta01        14    10410  14.so.14.10[.0]
+ 1.4.10rc01-02       14    10410  14.so.14.10[.0]
+ 1.4.10              14    10410  14.so.14.10[.0]
+ 1.4.11rc01          14    10411  14.so.14.11[.0]
+ 1.4.11              14    10411  14.so.14.11[.0]
+ 1.4.12              14    10412  14.so.14.12[.0]
+ 1.4.13beta01-03     14    10413  14.so.14.13[.0]
 
 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -4423,7 +4424,7 @@ for applications, is an unsigned integer of the form xyyzz corresponding
 to the source version x.y.z (leading zeros in y and z).  Beta versions
 were given the previous public release number plus a letter, until
 version 1.0.6j; from then on they were given the upcoming public
-release number plus "betaNN" or "rcN".
+release number plus "betaNN" or "rcNN".
 
 .SH "SEE ALSO"
 .BR "png"(5), " libpngpf"(3), " zlib"(3), " deflate"(5), " " and " zlib"(5)
@@ -4469,7 +4470,7 @@ possible without all of you.
 
 Thanks to Frank J. T. Wojcik for helping with the documentation.
 
-Libpng version 1.4.9beta01 - July 13, 2011:
+Libpng version 1.4.13beta03 - June 18, 2013:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).
 
@@ -4492,7 +4493,7 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.2.6, August 15, 2004, through 1.4.9beta01, July 13, 2011, are
+libpng versions 1.2.6, August 15, 2004, through 1.4.13beta03, June 18, 2013, are
 Copyright (c) 2004,2006-2007 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -4591,7 +4592,7 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-July 13, 2011
+June 18, 2013
 
 .\" end of man page
 

libpngpf.3

@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "July 8, 2011"
+.TH LIBPNGPF 3 "June 18, 2013"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.4.9beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.4.13beta03
 (private functions)
 .SH SYNOPSIS
 \fB#include <png.h>\fP

png.5

@@ -1,4 +1,4 @@
-.TH PNG 5 "July 8, 2011"
+.TH PNG 5 "June 18, 2013"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION

png.c

@@ -17,7 +17,7 @@
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_4_9beta01 Your_png_h_is_not_version_1_4_9beta01;
+typedef version_1_4_13beta03 Your_png_h_is_not_version_1_4_13beta03;
 
 /* Tells libpng that we have already handled the first "num_bytes" bytes
  * of the PNG file signature.  If the PNG data is embedded into another
@@ -547,13 +547,13 @@ png_get_copyright(png_const_structp png_ptr)
 #else
 #ifdef __STDC__
    return ((png_charp) PNG_STRING_NEWLINE \
-     "libpng version 1.4.9beta01 - July 8, 2011" PNG_STRING_NEWLINE \
+     "libpng version 1.4.13beta03 - June 18, 2013" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2010 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE);
 #else
-      return ((png_charp) "libpng version 1.4.9beta01 - July 8, 2011\
+      return ((png_charp) "libpng version 1.4.13beta03 - June 18, 2013\
       Copyright (c) 1998-2010 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.");

png.h

@@ -1,7 +1,7 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.4.9beta01 - July 8, 2011
+ * libpng version 1.4.13beta03 - June 18, 2013
  * Copyright (c) 1998-2011 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -11,7 +11,7 @@
  * Authors and maintainers:
  *  libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *  libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *  libpng versions 0.97, January 1998, through 1.4.9beta01 - July 8, 2011: Glenn
+ *  libpng versions 0.97, January 1998, through 1.4.13beta03 - June 18, 2013: Glenn
  *  See also "Contributing Authors", below.
  *
  * Note about libpng version numbers:
@@ -162,6 +162,15 @@
  *    1.4.8rc01               14    10408  14.so.14.8[.0]
  *    1.4.8                   14    10408  14.so.14.8[.0]
  *    1.4.9beta01             14    10409  14.so.14.9[.0]
+ *    1.4.9rc01               14    10409  14.so.14.9[.0]
+ *    1.4.9                   14    10409  14.so.14.9[.0]
+ *    1.4.10beta01            14    10410  14.so.14.10[.0]
+ *    1.4.10rc01-02           14    10410  14.so.14.10[.0]
+ *    1.4.10                  14    10410  14.so.14.10[.0]
+ *    1.4.11rc01              14    10411  14.so.14.11[.0]
+ *    1.4.11                  14    10411  14.so.14.11[.0]
+ *    1.4.12                  14    10412  14.so.14.12[.0]
+ *    1.4.13beta01-03         14    10413  14.so.14.13[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
@@ -171,7 +180,7 @@
  *    to the source version x.y.z (leading zeros in y and z).  Beta versions
  *    were given the previous public release number plus a letter, until
  *    version 1.0.6j; from then on they were given the upcoming public
- *    release number plus "betaNN" or "rcN".
+ *    release number plus "betaNN" or "rcNN".
  *
  *    Binary incompatibility exists only when applications make direct access
  *    to the info_ptr or png_ptr members through png.h, and the compiled
@@ -193,7 +202,7 @@
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.2.6, August 15, 2004, through 1.4.9beta01, July 8, 2011, are
+ * libpng versions 1.2.6, August 15, 2004, through 1.4.13beta03, June 18, 2013, are
  * Copyright (c) 2004, 2006-2010 Glenn Randers-Pehrson, and are
  * distributed according to the same disclaimer and license as libpng-1.2.5
  * with the following individual added to the list of Contributing Authors:
@@ -305,13 +314,13 @@
  * Y2K compliance in libpng:
  * =========================
  *
- *    July 8, 2011
+ *    June 18, 2013
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.4.9beta01 are Y2K compliant.  It is my belief that earlier
+ *    upward through 1.4.13beta03 are Y2K compliant.  It is my belief that earlier
  *    versions were also Y2K compliant.
  *
  *    Libpng only has three year fields.  One is a 2-byte unsigned integer
@@ -367,9 +376,9 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.4.9beta01"
+#define PNG_LIBPNG_VER_STRING "1.4.13beta03"
 #define PNG_HEADER_VERSION_STRING \
-   " libpng version 1.4.9beta01 - July 8, 2011\n"
+   " libpng version 1.4.13beta03 - June 18, 2013\n"
 
 #define PNG_LIBPNG_VER_SONUM   14
 #define PNG_LIBPNG_VER_DLLNUM  14
@@ -377,12 +386,12 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   4
-#define PNG_LIBPNG_VER_RELEASE 9
+#define PNG_LIBPNG_VER_RELEASE 13
 /* This should match the numeric part of the final component of
  * PNG_LIBPNG_VER_STRING, omitting any leading zero:
  */
 
-#define PNG_LIBPNG_VER_BUILD  01
+#define PNG_LIBPNG_VER_BUILD  03
 
 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -407,7 +416,7 @@
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
  * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
  */
-#define PNG_LIBPNG_VER 10409 /* 1.4.9 */
+#define PNG_LIBPNG_VER 10413 /* 1.4.13 */
 
 #ifndef PNG_VERSION_INFO_ONLY
 /* Include the compression library's header */
@@ -1493,7 +1502,7 @@ struct png_struct_def
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef png_structp version_1_4_9beta01;
+typedef png_structp version_1_4_13beta03;
 
 typedef png_struct FAR * FAR * png_structpp;
 

pngconf.h

@@ -1,7 +1,7 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.4.9beta01 - July 8, 2011
+ * libpng version 1.4.13beta03 - June 18, 2013
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2011 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -746,7 +746,7 @@
  * how large, set these two limits to 0.
  */
 #ifndef PNG_USER_CHUNK_CACHE_MAX
-#  define PNG_USER_CHUNK_CACHE_MAX 0
+#  define PNG_USER_CHUNK_CACHE_MAX 32767
 #endif
 
 /* Added at libpng-1.2.43 */
@@ -1389,19 +1389,12 @@ typedef char            FAR * FAR * FAR * png_charppp;
 #    ifndef PNG_NORETURN
 #      define PNG_NORETURN   __attribute__((__noreturn__))
 #    endif
+#    if __GNUC__ >= 3
 #      ifndef PNG_ALLOCATED
 #        define PNG_ALLOCATED  __attribute__((__malloc__))
 #      endif
 #      ifndef PNG_DEPRECATED
 #        define PNG_DEPRECATED __attribute__((__deprecated__))
-#    endif
-
-    /* This specifically protects structure members that should only be
-     * accessed from within the library, therefore should be empty during
-     * a library build.
-     */
-#    ifndef PNG_DEPSTRUCT
-#      define PNG_DEPSTRUCT  __attribute__((__deprecated__))
 #      endif
 #      ifndef PNG_PRIVATE
 #        if 0 /* Doesn't work so we use deprecated instead*/
@@ -1411,7 +1404,8 @@ typedef char            FAR * FAR * FAR * png_charppp;
 #          define PNG_PRIVATE \
             __attribute__((__deprecated__))
 #        endif
-#    endif /* PNG_PRIVATE */
+#      endif
+#    endif /*  __GNUC__ >= 3 */
 #  endif /* __GNUC__ */
 #endif /* PNG_PEDANTIC_WARNINGS */
 

pngpread.c

@@ -1,8 +1,8 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.4.6 [March 8, 2011]
+ * Last changed in libpng 1.4.10 [March 8, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -71,30 +71,6 @@ png_process_some_data(png_structp png_ptr, png_infop info_ptr)
          break;
       }
 
-#ifdef PNG_READ_tEXt_SUPPORTED
-      case PNG_READ_tEXt_MODE:
-      {
-         png_push_read_tEXt(png_ptr, info_ptr);
-         break;
-      }
-
-#endif
-#ifdef PNG_READ_zTXt_SUPPORTED
-      case PNG_READ_zTXt_MODE:
-      {
-         png_push_read_zTXt(png_ptr, info_ptr);
-         break;
-      }
-
-#endif
-#ifdef PNG_READ_iTXt_SUPPORTED
-      case PNG_READ_iTXt_MODE:
-      {
-         png_push_read_iTXt(png_ptr, info_ptr);
-         break;
-      }
-
-#endif
       case PNG_SKIP_MODE:
       {
          png_push_crc_finish(png_ptr);
@@ -527,7 +503,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          return;
       }
 
-      png_push_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
    }
 
 #endif
@@ -540,7 +516,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          return;
       }
 
-      png_push_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
    }
 
 #endif
@@ -553,7 +529,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          return;
       }
 
-      png_push_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
    }
 
 #endif
@@ -564,7 +540,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
-      png_push_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
    }
 
    png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
@@ -701,7 +677,7 @@ png_push_save_buffer(png_structp png_ptr)
       new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
       old_buffer = png_ptr->save_buffer;
       png_ptr->save_buffer = (png_bytep)png_malloc_warn(png_ptr,
-         (png_size_t)new_max);
+         new_max);
       if (png_ptr->save_buffer == NULL)
       {
         png_free(png_ptr, old_buffer);
@@ -1196,514 +1172,6 @@ png_read_push_finish_row(png_structp png_ptr)
 #endif /* PNG_READ_INTERLACING_SUPPORTED */
 }
 
-#ifdef PNG_READ_tEXt_SUPPORTED
-void /* PRIVATE */
-png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
-   length)
-{
-   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
-      {
-         png_error(png_ptr, "Out of place tEXt");
-         PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
-      }
-
-#ifdef PNG_MAX_MALLOC_64K
-   png_ptr->skip_length = 0;  /* This may not be necessary */
-
-   if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
-   {
-      png_warning(png_ptr, "tEXt chunk too large to fit in memory");
-      png_ptr->skip_length = length - (png_uint_32)65535L;
-      length = (png_uint_32)65535L;
-   }
-#endif
-
-   png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-      (png_size_t)(length + 1));
-   png_ptr->current_text[length] = '\0';
-   png_ptr->current_text_ptr = png_ptr->current_text;
-   png_ptr->current_text_size = (png_size_t)length;
-   png_ptr->current_text_left = (png_size_t)length;
-   png_ptr->process_mode = PNG_READ_tEXt_MODE;
-}
-
-void /* PRIVATE */
-png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
-{
-   if (png_ptr->buffer_size && png_ptr->current_text_left)
-   {
-      png_size_t text_size;
-
-      if (png_ptr->buffer_size < png_ptr->current_text_left)
-         text_size = png_ptr->buffer_size;
-
-      else
-         text_size = png_ptr->current_text_left;
-
-      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
-      png_ptr->current_text_left -= text_size;
-      png_ptr->current_text_ptr += text_size;
-   }
-   if (!(png_ptr->current_text_left))
-   {
-      png_textp text_ptr;
-      png_charp text;
-      png_charp key;
-      int ret;
-
-      if (png_ptr->buffer_size < 4)
-      {
-         png_push_save_buffer(png_ptr);
-         return;
-      }
-
-      png_push_crc_finish(png_ptr);
-
-#ifdef PNG_MAX_MALLOC_64K
-      if (png_ptr->skip_length)
-         return;
-#endif
-
-      key = png_ptr->current_text;
-
-      for (text = key; *text; text++)
-         /* Empty loop */ ;
-
-      if (text < key + png_ptr->current_text_size)
-         text++;
-
-      text_ptr = (png_textp)png_malloc(png_ptr,
-         png_sizeof(png_text));
-      text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
-      text_ptr->key = key;
-#ifdef PNG_iTXt_SUPPORTED
-      text_ptr->lang = NULL;
-      text_ptr->lang_key = NULL;
-#endif
-      text_ptr->text = text;
-
-      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
-
-      png_free(png_ptr, key);
-      png_free(png_ptr, text_ptr);
-      png_ptr->current_text = NULL;
-
-      if (ret)
-        png_warning(png_ptr, "Insufficient memory to store text chunk");
-   }
-}
-#endif
-
-#ifdef PNG_READ_zTXt_SUPPORTED
-void /* PRIVATE */
-png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
-   length)
-{
-   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
-      {
-         png_error(png_ptr, "Out of place zTXt");
-         PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
-      }
-
-#ifdef PNG_MAX_MALLOC_64K
-   /* We can't handle zTXt chunks > 64K, since we don't have enough space
-    * to be able to store the uncompressed data.  Actually, the threshold
-    * is probably around 32K, but it isn't as definite as 64K is.
-    */
-   if (length > (png_uint_32)65535L)
-   {
-      png_warning(png_ptr, "zTXt chunk too large to fit in memory");
-      png_push_crc_skip(png_ptr, length);
-      return;
-   }
-#endif
-
-   png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-      (png_size_t)(length + 1));
-   png_ptr->current_text[length] = '\0';
-   png_ptr->current_text_ptr = png_ptr->current_text;
-   png_ptr->current_text_size = (png_size_t)length;
-   png_ptr->current_text_left = (png_size_t)length;
-   png_ptr->process_mode = PNG_READ_zTXt_MODE;
-}
-
-void /* PRIVATE */
-png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
-{
-   if (png_ptr->buffer_size && png_ptr->current_text_left)
-   {
-      png_size_t text_size;
-
-      if (png_ptr->buffer_size < (png_uint_32)png_ptr->current_text_left)
-         text_size = png_ptr->buffer_size;
-
-      else
-         text_size = png_ptr->current_text_left;
-
-      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
-      png_ptr->current_text_left -= text_size;
-      png_ptr->current_text_ptr += text_size;
-   }
-   if (!(png_ptr->current_text_left))
-   {
-      png_textp text_ptr;
-      png_charp text;
-      png_charp key;
-      int ret;
-      png_size_t text_size, key_size;
-
-      if (png_ptr->buffer_size < 4)
-      {
-         png_push_save_buffer(png_ptr);
-         return;
-      }
-
-      png_push_crc_finish(png_ptr);
-
-      key = png_ptr->current_text;
-
-      for (text = key; *text; text++)
-         /* Empty loop */ ;
-
-      /* zTXt can't have zero text */
-      if (text >= key + png_ptr->current_text_size)
-      {
-         png_ptr->current_text = NULL;
-         png_free(png_ptr, key);
-         return;
-      }
-
-      text++;
-
-      if (*text != PNG_TEXT_COMPRESSION_zTXt) /* Check compression byte */
-      {
-         png_ptr->current_text = NULL;
-         png_free(png_ptr, key);
-         return;
-      }
-
-      text++;
-
-      png_ptr->zstream.next_in = (png_bytep )text;
-      png_ptr->zstream.avail_in = (uInt)(png_ptr->current_text_size -
-         (text - key));
-      png_ptr->zstream.next_out = png_ptr->zbuf;
-      png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
-
-      key_size = text - key;
-      text_size = 0;
-      text = NULL;
-      ret = Z_STREAM_END;
-
-      while (png_ptr->zstream.avail_in)
-      {
-         ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
-         if (ret != Z_OK && ret != Z_STREAM_END)
-         {
-            inflateReset(&png_ptr->zstream);
-            png_ptr->zstream.avail_in = 0;
-            png_ptr->current_text = NULL;
-            png_free(png_ptr, key);
-            png_free(png_ptr, text);
-            return;
-         }
-         if (!(png_ptr->zstream.avail_out) || ret == Z_STREAM_END)
-         {
-            if (text == NULL)
-            {
-               text = (png_charp)png_malloc(png_ptr,
-                     (png_ptr->zbuf_size
-                     - png_ptr->zstream.avail_out + key_size + 1));
-
-               png_memcpy(text + key_size, png_ptr->zbuf,
-                  png_ptr->zbuf_size - png_ptr->zstream.avail_out);
-
-               png_memcpy(text, key, key_size);
-
-               text_size = key_size + png_ptr->zbuf_size -
-                  png_ptr->zstream.avail_out;
-
-               *(text + text_size) = '\0';
-            }
-            else
-            {
-               png_charp tmp;
-
-               tmp = text;
-               text = (png_charp)png_malloc(png_ptr, text_size +
-                  (png_ptr->zbuf_size
-                  - png_ptr->zstream.avail_out + 1));
-
-               png_memcpy(text, tmp, text_size);
-               png_free(png_ptr, tmp);
-
-               png_memcpy(text + text_size, png_ptr->zbuf,
-                  png_ptr->zbuf_size - png_ptr->zstream.avail_out);
-
-               text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
-               *(text + text_size) = '\0';
-            }
-            if (ret != Z_STREAM_END)
-            {
-               png_ptr->zstream.next_out = png_ptr->zbuf;
-               png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
-            }
-         }
-         else
-         {
-            break;
-         }
-
-         if (ret == Z_STREAM_END)
-            break;
-      }
-
-      inflateReset(&png_ptr->zstream);
-      png_ptr->zstream.avail_in = 0;
-
-      if (ret != Z_STREAM_END)
-      {
-         png_ptr->current_text = NULL;
-         png_free(png_ptr, key);
-         png_free(png_ptr, text);
-         return;
-      }
-
-      png_ptr->current_text = NULL;
-      png_free(png_ptr, key);
-      key = text;
-      text += key_size;
-
-      text_ptr = (png_textp)png_malloc(png_ptr,
-          png_sizeof(png_text));
-      text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
-      text_ptr->key = key;
-#ifdef PNG_iTXt_SUPPORTED
-      text_ptr->lang = NULL;
-      text_ptr->lang_key = NULL;
-#endif
-      text_ptr->text = text;
-
-      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
-
-      png_free(png_ptr, key);
-      png_free(png_ptr, text_ptr);
-
-      if (ret)
-        png_warning(png_ptr, "Insufficient memory to store text chunk");
-   }
-}
-#endif
-
-#ifdef PNG_READ_iTXt_SUPPORTED
-void /* PRIVATE */
-png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
-   length)
-{
-   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
-      {
-         png_error(png_ptr, "Out of place iTXt");
-         PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
-      }
-
-#ifdef PNG_MAX_MALLOC_64K
-   png_ptr->skip_length = 0;  /* This may not be necessary */
-
-   if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
-   {
-      png_warning(png_ptr, "iTXt chunk too large to fit in memory");
-      png_ptr->skip_length = length - (png_uint_32)65535L;
-      length = (png_uint_32)65535L;
-   }
-#endif
-
-   png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-      (png_size_t)(length + 1));
-   png_ptr->current_text[length] = '\0';
-   png_ptr->current_text_ptr = png_ptr->current_text;
-   png_ptr->current_text_size = (png_size_t)length;
-   png_ptr->current_text_left = (png_size_t)length;
-   png_ptr->process_mode = PNG_READ_iTXt_MODE;
-}
-
-void /* PRIVATE */
-png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
-{
-
-   if (png_ptr->buffer_size && png_ptr->current_text_left)
-   {
-      png_size_t text_size;
-
-      if (png_ptr->buffer_size < png_ptr->current_text_left)
-         text_size = png_ptr->buffer_size;
-
-      else
-         text_size = png_ptr->current_text_left;
-
-      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
-      png_ptr->current_text_left -= text_size;
-      png_ptr->current_text_ptr += text_size;
-   }
-   if (!(png_ptr->current_text_left))
-   {
-      png_textp text_ptr;
-      png_charp key;
-      int comp_flag;
-      png_charp lang;
-      png_charp lang_key;
-      png_charp text;
-      int ret;
-
-      if (png_ptr->buffer_size < 4)
-      {
-         png_push_save_buffer(png_ptr);
-         return;
-      }
-
-      png_push_crc_finish(png_ptr);
-
-#ifdef PNG_MAX_MALLOC_64K
-      if (png_ptr->skip_length)
-         return;
-#endif
-
-      key = png_ptr->current_text;
-
-      for (lang = key; *lang; lang++)
-         /* Empty loop */ ;
-
-      if (lang < key + png_ptr->current_text_size - 3)
-         lang++;
-
-      comp_flag = *lang++;
-      lang++;     /* Skip comp_type, always zero */
-
-      for (lang_key = lang; *lang_key; lang_key++)
-         /* Empty loop */ ;
-
-      lang_key++;        /* Skip NUL separator */
-
-      text=lang_key;
-
-      if (lang_key < key + png_ptr->current_text_size - 1)
-      {
-        for (; *text; text++)
-           /* Empty loop */ ;
-      }
-
-      if (text < key + png_ptr->current_text_size)
-         text++;
-
-      text_ptr = (png_textp)png_malloc(png_ptr,
-         png_sizeof(png_text));
-
-      text_ptr->compression = comp_flag + 2;
-      text_ptr->key = key;
-      text_ptr->lang = lang;
-      text_ptr->lang_key = lang_key;
-      text_ptr->text = text;
-      text_ptr->text_length = 0;
-      text_ptr->itxt_length = png_strlen(text);
-
-      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
-
-      png_ptr->current_text = NULL;
-
-      png_free(png_ptr, text_ptr);
-      if (ret)
-         png_warning(png_ptr, "Insufficient memory to store iTXt chunk");
-   }
-}
-#endif
-
-/* This function is called when we haven't found a handler for this
- * chunk.  If there isn't a problem with the chunk itself (ie a bad chunk
- * name or a critical chunk), the chunk is (currently) silently ignored.
- */
-void /* PRIVATE */
-png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
-   length)
-{
-   png_uint_32 skip = 0;
-
-   if (!(png_ptr->chunk_name[0] & 0x20))
-   {
-#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
-      if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
-         PNG_HANDLE_CHUNK_ALWAYS
-#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
-         && png_ptr->read_user_chunk_fn == NULL
-#endif
-         )
-#endif
-         png_chunk_error(png_ptr, "unknown critical chunk");
-         PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
-   }
-
-#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
-   if (png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
-   {
-#ifdef PNG_MAX_MALLOC_64K
-      if (length > (png_uint_32)65535L)
-      {
-          png_warning(png_ptr, "unknown chunk too large to fit in memory");
-          skip = length - (png_uint_32)65535L;
-          length = (png_uint_32)65535L;
-      }
-#endif
-      png_memcpy((png_charp)png_ptr->unknown_chunk.name,
-                 (png_charp)png_ptr->chunk_name,
-                 png_sizeof(png_ptr->unknown_chunk.name));
-      png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name) - 1]
-        = '\0';
-
-      png_ptr->unknown_chunk.size = (png_size_t)length;
-
-      if (length == 0)
-         png_ptr->unknown_chunk.data = NULL;
-
-      else
-      {
-         png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr,
-            (png_size_t)length);
-         png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
-      }
-
-#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
-      if (png_ptr->read_user_chunk_fn != NULL)
-      {
-         /* Callback to user unknown chunk handler */
-         int ret;
-         ret = (*(png_ptr->read_user_chunk_fn))
-           (png_ptr, &png_ptr->unknown_chunk);
-
-         if (ret < 0)
-            png_chunk_error(png_ptr, "error in user chunk");
-
-         if (ret == 0)
-         {
-            if (!(png_ptr->chunk_name[0] & 0x20))
-               if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
-                    PNG_HANDLE_CHUNK_ALWAYS)
-                  png_chunk_error(png_ptr, "unknown critical chunk");
-            png_set_unknown_chunks(png_ptr, info_ptr,
-               &png_ptr->unknown_chunk, 1);
-         }
-      }
-
-      else
-#endif
-        png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
-      png_free(png_ptr, png_ptr->unknown_chunk.data);
-      png_ptr->unknown_chunk.data = NULL;
-   }
-
-   else
-#endif
-      skip=length;
-   png_push_crc_skip(png_ptr, skip);
-}
-
 void /* PRIVATE */
 png_push_have_info(png_structp png_ptr, png_infop info_ptr)
 {

pngpriv.h

@@ -1,7 +1,7 @@
 
 /* pngpriv.h - private declarations for use inside libpng
  *
- * libpng version 1.4.9beta01 - July 8, 2011
+ * libpng version 1.4.13beta03 - June 18, 2013
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2011 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)

pngread.c

@@ -1,8 +1,8 @@
 
 /* pngread.c - read a PNG file
  *
- * Last changed in libpng 1.4.6 [March 8, 2011]
+ * Last changed in libpng 1.4.10 [March 8, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -70,14 +70,12 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 #ifdef PNG_USER_LIMITS_SUPPORTED
    png_ptr->user_width_max = PNG_USER_WIDTH_MAX;
    png_ptr->user_height_max = PNG_USER_HEIGHT_MAX;
-#  ifdef PNG_USER_CHUNK_CACHE_MAX
+
    /* Added at libpng-1.2.43 and 1.4.0 */
    png_ptr->user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;
-#  endif
+
-#  ifdef PNG_SET_USER_CHUNK_MALLOC_MAX
+   /* Added at libpng-1.4.1 */
-   /* Added at libpng-1.2.43 and 1.4.1 */
    png_ptr->user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;
-#  endif
 #endif
 
 #ifdef PNG_SETJMP_SUPPORTED
@@ -1135,12 +1133,6 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr,
    png_free(png_ptr, png_ptr->save_buffer);
 #endif
 
-#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
-#ifdef PNG_TEXT_SUPPORTED
-   png_free(png_ptr, png_ptr->current_text);
-#endif /* PNG_TEXT_SUPPORTED */
-#endif /* PNG_PROGRESSIVE_READ_SUPPORTED */
-
    /* Save the important info out of the png_struct, in case it is
     * being used again.
     */

pngrtran.c

@@ -1,8 +1,8 @@
 
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
- * Last changed in libpng 1.4.8 [July 7, 2011]
+ * Last changed in libpng 1.4.11 [March 29, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -1159,6 +1159,7 @@ png_init_read_transformations(png_structp png_ptr)
 
 #ifdef PNG_READ_SHIFT_SUPPORTED
    if ((png_ptr->transformations & PNG_SHIFT) &&
+      !(png_ptr->transformations & PNG_EXPAND) &&
       (color_type == PNG_COLOR_TYPE_PALETTE))
    {
       png_uint_16 i;
@@ -1179,6 +1180,8 @@ png_init_read_transformations(png_structp png_ptr)
          png_ptr->palette[i].green >>= sg;
          png_ptr->palette[i].blue >>= sb;
       }
+
+      png_ptr->transformations &= ~PNG_SHIFT;
    }
 #endif  /* PNG_READ_SHIFT_SUPPORTED */
  }

pngrutil.c

@@ -1,8 +1,8 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.4.8 [July 7, 2011]
+ * Last changed in libpng 1.4.10 [March 8, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -282,8 +282,8 @@ png_inflate(png_structp png_ptr, const png_byte *data, png_size_t size,
       {
          if (output != 0 && output_size > count)
          {
-            int copy = output_size - count;
+            png_size_t copy = output_size - count;
-            if (avail < copy) copy = avail;
+            if ((png_size_t) avail < copy) copy = (png_size_t) avail;
             png_memcpy(output + count, png_ptr->zbuf, copy);
          }
 
@@ -377,15 +377,16 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
       /* Now check the limits on this chunk - if the limit fails the
        * compressed data will be removed, the prefix will remain.
        */
-#ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
+      if (prefix_size >= (~(png_size_t)0) - 1 ||
-      if (png_ptr->user_chunk_malloc_max &&
+         expanded_size >= (~(png_size_t)0) - 1 - prefix_size
+#ifdef PNG_USER_LIMITS_SUPPORTED
+         || (png_ptr->user_chunk_malloc_max &&
           (prefix_size + expanded_size >= png_ptr->user_chunk_malloc_max - 1))
 #else
-#  ifdef PNG_USER_CHUNK_MALLOC_MAX
+         || ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
-      if ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
           prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)
-#  endif
 #endif
+         )
          png_warning(png_ptr, "Exceeded size limit while expanding chunk");
 
       /* If the size is zero either there was an error and a message
@@ -393,11 +394,7 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
        * and we have nothing to do - the code will exit through the
        * error case below.
        */
-#if defined(PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED) || \
+      else if (expanded_size > 0)
-    defined(PNG_USER_CHUNK_MALLOC_MAX)
-      else
-#endif
-      if (expanded_size > 0)
       {
          /* Success (maybe) - really uncompress the chunk. */
          png_size_t new_size = 0;
@@ -1261,7 +1258,7 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 
    png_free(png_ptr, png_ptr->chunkdata);
    png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
-   slength = (png_size_t)length;
+   slength = length;
    png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
 
    if (png_crc_finish(png_ptr, skip))
@@ -1584,15 +1581,16 @@ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       return;
    }
 
-   num = length / 2 ;
+   if (length > 2*PNG_MAX_PALETTE_LENGTH ||
-   if (num != (unsigned int) png_ptr->num_palette || num >
+       length != (unsigned int) (2*png_ptr->num_palette))
-      (unsigned int) PNG_MAX_PALETTE_LENGTH)
    {
       png_warning(png_ptr, "Incorrect hIST chunk length");
       png_crc_finish(png_ptr, length);
       return;
    }
 
+   num = length / 2 ;
+
    for (i = 0; i < num; i++)
    {
       png_byte buf[2];
@@ -1911,11 +1909,11 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       png_ptr->chunkdata = NULL;
       return;
    }
-   png_memcpy(swidth, ep, png_strlen(ep));
+   png_memcpy(swidth, ep, png_strlen(ep)+1);
 #endif
 #endif
 
-   for (ep = png_ptr->chunkdata; *ep; ep++)
+   for (ep = png_ptr->chunkdata+1; *ep; ep++)
       /* Empty loop */ ;
    ep++;
 
@@ -1950,7 +1948,7 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       png_free(png_ptr, swidth);
       return;
    }
-   png_memcpy(sheight, ep, png_strlen(ep));
+   png_memcpy(sheight, ep, png_strlen(ep)+1);
 #endif
 #endif
 

pngset.c

@@ -1,8 +1,8 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.4.6 [January 14, 2011]
+ * Last changed in libpng 1.4.13 [June 18, 2013]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2013 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -250,15 +250,6 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
       info_ptr->channels++;
    info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
 
-   /* Check for potential overflow */
-   if (width > (PNG_UINT_32_MAX
-                 >> 3)      /* 8-byte RGBA pixels */
-                 - 64       /* bigrowbuf hack */
-                 - 1        /* filter byte */
-                 - 7*8      /* rounding of width to multiple of 8 pixels */
-                 - 8)       /* extra max_pixel_depth pad */
-      info_ptr->rowbytes = 0;
-   else
    info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
 }
 
@@ -649,22 +640,26 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
     */
    if (info_ptr->num_text + num_text > info_ptr->max_text)
    {
+      int old_max_text = info_ptr->max_text;
+      int old_num_text = info_ptr->num_text;
+
       if (info_ptr->text != NULL)
       {
          png_textp old_text;
-         int old_max;
 
-         old_max = info_ptr->max_text;
          info_ptr->max_text = info_ptr->num_text + num_text + 8;
          old_text = info_ptr->text;
+
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
          {
-            png_free(png_ptr, old_text);
+            /* Restore to previous condition */
+            info_ptr->max_text = old_max_text;
+            info_ptr->text = old_text;
             return(1);
          }
-         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max *
+         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max_text *
             png_sizeof(png_text)));
          png_free(png_ptr, old_text);
       }
@@ -675,7 +670,12 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
+         {
+            /* Restore to previous condition */
+            info_ptr->num_text = old_num_text;
+            info_ptr->max_text = old_max_text;
             return(1);
+         }
          info_ptr->free_me |= PNG_FREE_TEXT;
       }
       png_debug1(3, "allocated %d entries for info_ptr->text",
@@ -827,6 +827,12 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
+   if (num_trans < 0 || num_trans > PNG_MAX_PALETTE_LENGTH)
+      {
+        png_warning(png_ptr, "Ignoring invalid num_trans value");
+        return;
+      }
+
    if (trans_alpha != NULL)
    {
        /* It may not actually be necessary to set png_ptr->trans_alpha here;

pngtest.c

@@ -1702,4 +1702,4 @@ main(int argc, char *argv[])
 }
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_4_9beta01 your_png_h_is_not_version_1_4_9beta01;
+typedef version_1_4_13beta03 your_png_h_is_not_version_1_4_13beta03;

projects/vstudio/readme.txt

@@ -1,7 +1,7 @@
 
 VisualStudio instructions
 
-libpng version 1.4.9beta01 - July 8, 2011
+libpng version 1.4.13beta03 - June 18, 2013
 
 Copyright (c) 1998-2010 Glenn Randers-Pehrson
 

projects/vstudio/zlib.props

@@ -2,7 +2,7 @@
 <!--
  * zlib.props - location of zlib source and build
  *
- * libpng version 1.4.9beta01 - July 8, 2011
+ * libpng version 1.4.13beta03 - June 18, 2013
  *
  * Copyright (c) 1998-2011 Glenn Randers-Pehrson
  *

scripts/README.txt

@@ -1,8 +1,8 @@
 
-Makefiles for  libpng version 1.4.9beta01 - July 8, 2011
+Makefiles for  libpng version 1.4.13beta03 - June 18, 2013
 
  makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng14.so.14.1.4.9beta01)
+                       (gcc, creates libpng14.so.14.1.4.13beta03)
  makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
  makefile.knr      =>  Archaic UNIX Makefile that converts files with
                        ansi2knr (Requires ansi2knr.c from
@@ -20,7 +20,7 @@ Makefiles for  libpng version 1.4.9beta01 - July 8, 2011
  makefile.dec      =>  DEC Alpha UNIX makefile
  makefile.dj2      =>  DJGPP 2 makefile
  makefile.elf      =>  Linux/ELF makefile symbol versioning,
-                       (gcc, creates libpng14.so.14.1.4.9beta01)
+                       (gcc, creates libpng14.so.14.1.4.13beta03)
  makefile.freebsd  =>  FreeBSD makefile
  makefile.gcc      =>  Generic gcc makefile
  makefile.hpgcc    =>  HPUX makefile using gcc
@@ -36,12 +36,12 @@ Makefiles for  libpng version 1.4.9beta01 - July 8, 2011
  makefile.os2      =>  OS/2 Makefile (gcc and emx, requires pngos2.def)
  makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
  makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng14.so.14.1.4.9beta01)
+                       creates libpng14.so.14.1.4.13beta03)
  makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
  makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng14.so.14.1.4.9beta01)
+                       creates libpng14.so.14.1.4.13beta03)
  makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng14.so.14.1.4.9beta01)
+                       creates libpng14.so.14.1.4.13beta03)
  makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
  makefile.sunos    =>  Sun makefile
  makefile.32sunu   =>  Sun Ultra 32-bit makefile

scripts/libpng-config-head.in

@@ -11,7 +11,7 @@
 
 # Modeled after libxml-config.
 
-version=1.4.9beta01
+version=1.4.13beta03
 prefix=""
 libdir=""
 libs=""

scripts/libpng.pc.in

@@ -5,6 +5,6 @@ includedir=@includedir@/libpng14
 
 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.4.9beta01
+Version: 1.4.13beta03
 Libs: -L${libdir} -lpng14
 Cflags: -I${includedir}

scripts/makefile.cegcc

@@ -23,7 +23,7 @@
 
 VERMAJ = 1
 VERMIN = 4
-VERMIC = 9
+VERMIC = 13
 VER = $(VERMAJ).$(VERMIN).$(VERMIC)
 NAME = libpng
 PACKAGE = $(NAME)-$(VER)

scripts/makefile.freebsd

@@ -24,7 +24,10 @@ MAN=		libpng.3 libpngpf.3 png.5
 MANDIR=		/man/man
 SYMLINKS=       libpng/png.h ${INCSDIR}/../png.h \
 		libpng/pngconf.h ${INCSDIR}/../pngconf.h
+
 LDADD+=         -lm -lz
+# LDADD+=         -lm -lz -lssp_nonshared   # for OSVERSION >= 800000 ?
+
 DPADD+=         ${LIBM} ${LIBZ}
 
 CFLAGS+= -I.

scripts/makefile.linux

@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng14
 PNGMAJ = 14
-RELEASE = 9
+RELEASE = 13
 
 # Shared library names:
 LIBSO=$(LIBNAME).so

scripts/makefile.ne12bsd

@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng14
 
 LIB=	png14
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.4.9beta01
+SHLIB_MINOR=	1.4.13beta03
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c

scripts/makefile.netbsd

@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include
 
 LIB=	png
 SHLIB_MAJOR=	3
-SHLIB_MINOR=	1.4.9beta01
+SHLIB_MINOR=	1.4.13beta03
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c

scripts/makefile.openbsd

@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat
 
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.4.9beta01
+SHLIB_MINOR=	1.4.13beta03
 
 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \

scripts/png32ce.def

@@ -15,7 +15,7 @@ LIBRARY lpngce
  png_get_int_32
 
 EXPORTS
-;Version 1.4.9beta01
+;Version 1.4.13beta03
   png_build_grayscale_palette  @1
 ;  png_check_sig        @2
   png_chunk_error      @3

scripts/pngos2.def

@@ -2,7 +2,7 @@
 ; PNG.LIB module definition file for OS/2
 ;----------------------------------------
 
-; Version 1.4.9beta01
+; Version 1.4.13beta03
 
 LIBRARY		PNG
 DESCRIPTION	"PNG image compression library for OS/2"

scripts/pngwin.def

@@ -5,7 +5,7 @@
 LIBRARY
 
 EXPORTS
-;Version 1.4.9beta01
+;Version 1.4.13beta03
   png_build_grayscale_palette
   png_chunk_error
   png_chunk_warning

sunfix-makefile.patch

@@ -0,0 +1,16 @@
+Index: libpng-1.2.46/Makefile.am
+===================================================================
+--- libpng-1.2.46.orig/Makefile.am	2011-08-30 14:48:43.039223476 +0400
++++ libpng-1.2.46/Makefile.am	2011-08-30 15:02:18.775861919 +0400
+@@ -49,7 +49,11 @@
+ 
+ if HAVE_LD_VERSION_SCRIPT
+   # Versioned symbols and restricted exports
++if HAVE_SOLARIS_LD
++  libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_LDFLAGS += -Wl,-M Wl,libpng.vers
++else
++  libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_LDFLAGS += -Wl,--version-script=libpng.vers
++endif
+   libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_DEPENDENCIES = libpng.vers
+ else
+   # Only restricted exports when possible

sunfix.patch

@@ -0,0 +1,45 @@
+Index: libpng-1.2.46/configure.ac
+===================================================================
+--- libpng-1.2.46.orig/configure.ac	2011-08-30 14:48:43.039028289 +0400
++++ libpng-1.2.46/configure.ac	2011-08-30 14:56:09.680021389 +0400
+@@ -78,8 +78,23 @@
+ AC_SUBST(LIBPNG_DEFINES)
+ AC_SUBST(LIBPNG_NO_MMX)
+ 
++AC_MSG_CHECKING([if using Solaris linker])
++SLD=`$LD --version 2>&1 | grep Solaris`
++if test "$SLD"; then
++    have_solaris_ld=yes
++    AC_MSG_RESULT(yes)
++else
++    have_solaris_ld=no
++    AC_MSG_RESULT(no)
++fi
++AM_CONDITIONAL(HAVE_SOLARIS_LD, test "$have_solaris_ld" = "yes")
++
+ AC_MSG_CHECKING([if libraries can be versioned])
+-GLD=`$LD --help < /dev/null 2>/dev/null | grep version-script`
++if test "$have_solaris_ld" = "yes"; then
++    GLD=`$LD --help < /dev/null 2>&1 | grep 'M mapfile'`
++else
++    GLD=`$LD --help < /dev/null 2>/dev/null | grep version-script`
++fi
+ if test "$GLD"; then
+     have_ld_version_script=yes
+     AC_MSG_RESULT(yes)
+Index: libpng-1.2.46/Makefile.am
+===================================================================
+--- libpng-1.2.46.orig/Makefile.am	2011-08-30 14:48:43.039223476 +0400
++++ libpng-1.2.46/Makefile.am	2011-08-30 15:02:18.775861919 +0400
+@@ -49,7 +49,11 @@
+ 
+ if HAVE_LD_VERSION_SCRIPT
+   # Versioned symbols and restricted exports
++if HAVE_SOLARIS_LD
++  libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_LDFLAGS += -Wl,-M Wl,libpng.vers
++else
++  libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_LDFLAGS += -Wl,--version-script=libpng.vers
++endif
+   libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_DEPENDENCIES = libpng.vers
+ else
+   # Only restricted exports when possible