[libpng12] Imported from libpng-1.2.48beta01.tar

[libpng12] Fixed off-by-one bug in png_handle_sCAL() when using fixed point
arithmetic, causing out-of-bounds read in png_set_sCAL() because of failure to copy the string terminators (Franke Busse).
2025-07-10 18:04:09 +02:00 · 2012-02-26 22:04:24 -06:00 · 2012-02-26 20:42:28 -06:00 · 2012-02-22 07:03:52 -06:00 · 2012-02-22 07:02:38 -06:00 · 2012-02-19 22:04:56 -06:00
63 changed files with 422 additions and 863 deletions
--- a/96
+++ b/96
@@ -1,5 +1,5 @@

-Libpng 1.2.44beta03 - June 20, 2010
+Libpng 1.2.48beta01 - February 27, 2012

 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -9,88 +9,50 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script

-   libpng-1.2.44beta03.tar.xz (LZMA-compressed, recommended)
-   libpng-1.2.44beta03.tar.gz
-   libpng-1.2.44beta03.tar.bz2
+   libpng-1.2.48beta01.tar.xz (LZMA-compressed, recommended)
+   libpng-1.2.48beta01.tar.gz
+   libpng-1.2.48beta01.tar.bz2

 Source files with LF line endings (for Unix/Linux) without the
 "configure" script

-   libpng-1.2.44beta03-no-config.tar.xz (LZMA-compressed, recommended)
-   libpng-1.2.44beta03-no-config.tar.gz
-   libpng-1.2.44beta03-no-config.tar.bz2
+   libpng-1.2.48beta01-no-config.tar.xz (LZMA-compressed, recommended)
+   libpng-1.2.48beta01-no-config.tar.gz
+   libpng-1.2.48beta01-no-config.tar.bz2

 Source files with CRLF line endings (for Windows), without the
 "configure" script

-   lp1244b03.zip
-   lp1244b03.7z
-   lp1244b03.tar.bz2
+   lp1248b01.zip
+   lp1248b01.7z
+   lp1248b01.tar.bz2

 Project files

-   libpng-1.2.44beta03-project-netware.zip
-   libpng-1.2.44beta03-project-wince.zip
+   libpng-1.2.48beta01-project-netware.zip
+   libpng-1.2.48beta01-project-wince.zip

 Other information:

-   libpng-1.2.44beta03-README.txt
-   libpng-1.2.44beta03-KNOWNBUGS.txt
-   libpng-1.2.44beta03-LICENSE.txt
-   libpng-1.2.44beta03-Y2K-compliance.txt
-   libpng-1.2.44beta03-[previous version]-diff.txt
+   libpng-1.2.48beta01-README.txt
+   libpng-1.2.48beta01-KNOWNBUGS.txt
+   libpng-1.2.48beta01-LICENSE.txt
+   libpng-1.2.48beta01-Y2K-compliance.txt
+   libpng-1.2.48beta01-[previous version]-diff.txt

-Changes since the last public release (1.2.42):
+Changes since the last public release (1.2.46):

-version 1.2.43beta01 [January 27, 2010]
-  Updated CMakeLists.txt for consistent indentation and to avoid an
-    unclosed if-statement warning (Philip Lowman).
-  Removed "#ifdef PNG_1_0_X / #endif" surrounding
-    PNG_READ_16_TO_8_SUPPORTED and PNG_READ_GRAY_TO_RGB_SUPPORTED
-    in pngconf.h.  These were added in libpng-1.2.41beta08 and libpng-1.0.51,
-    which introduced a binary incompatibility with libpng-1.0.50.
-  Backported new png_decompress_chunk() algorithm from libpng-1.4.1
-
-version 1.2.43beta02 [February 1, 2010]
-  Backported two-pass png_decompress_chunk() algorithm from libpng-1.4.1
-
-version 1.2.43beta03 [February 6, 2010]
-  Backported fast png_push_save_buffer() algorithm from libpng-1.4.1
-
-version 1.2.43beta04 [February 8, 2010]
-  Reverted recent changes to png_push_save-buffer().
-  Removed PNGAPI declaration of png_calloc() and png_write_sig() in
-    1ibpng-1.2.X, introduced by mistake in libpng-1.2.41.
-  Return allocated "old_buffer" in png_push_save_buffer() before png_error(),
-    to avoid a potential memory leak.
-
-version 1.2.43beta05 [February 8, 2010]
-  Ported rewritten png_decompress_chunk() by John Bowler from libpng-1.4.1.
-
-version 1.0.53rc01 and 1.2.43rc01 [February 18, 2010]
-  No changes.
-
-version 1.0.53rc02 and 1.2.43rc02 [February 19, 2010]
-  Define _ALL_SOURCE in configure.ac, makefile.aix, and CMakeLists.txt
-    when using AIX compiler.
-
-version 1.0.53 and 1.2.43 [February 25, 2010]
-  Removed unused gzio.c from contrib/pngminim gather and makefile scripts
-
-version 1.2.44beta01 [June 18, 2010]
-  In pngpread.c: png_push_have_row() add check for new_row > height
-  Removed the now-redundant check for out-of-bounds new_row from example.c
-
-version 1.2.44beta02 [June 19, 2010]
-  In pngpread.c: png_push_process_row() add check for too many rows.
-  Removed the now-redundant check for new_row > height in png_push_have_row().
-
-version 1.2.44beta03 [June 20, 2010]
-  Rewrote png_process_IDAT_data to consistently treat extra data as warnings
-    and handle end conditions more cleanly.
-  Removed the new (beta02) check in png_push_process_row().
-
-Send comments/corrections/commendations to png-mng-implement at lists.sf.net
+version 1.2.48beta01 [February 27, 2012]
+  Removed two useless #ifdef directives from pngread.c and one from pngrutil.c
+  Eliminated redundant png_push_read_tEXt|zTXt|iTXt|unknown code from
+    pngpread.c and use the sequential png_handle_tEXt, etc., in pngrutil.c;
+    now that png_ptr->buffer is inaccessible to applications, the special
+    handling is no longer useful.
+  Fixed bug with png_handle_hIST with odd chunk length (Frank Busse).
+  Fixed incorrect type (int copy should be png_size_t copy) in png_inflate().
+  Fixed off-by-one bug in png_handle_sCAL() when using fixed point arithmetic,
+    causing out-of-bounds read in png_set_sCAL() because of failure to copy
+    the string terminators (Franke Busse).

 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
--- a/77
+++ b/77
@@ -1,4 +1,4 @@
-/*
+#if 0
 CHANGES - changes for libpng

 version 0.2
@@ -1478,7 +1478,7 @@ version 1.2.9beta5 [March 4, 2006]
  Removed trailing blanks from source files.
  Put version and date of latest change in each source file, and changed
    copyright year accordingly.
-  More cleanup of configure.ac, Makefile.ac, and associated scripts.
+  More cleanup of configure.ac, Makefile.am, and associated scripts.
  Restored scripts/makefile.elf which was inadvertently deleted.

 version 1.2.9beta6 [March 6, 2006]
@@ -2683,15 +2683,82 @@ version 1.2.44beta01 [June 18, 2010]
  In pngpread.c: png_push_have_row() add check for new_row > height
  Removed the now-redundant check for out-of-bounds new_row from example.c

-version 1.2.44beta02 [June 18, 2010]
+version 1.2.44beta02 [June 19, 2010]
  In pngpread.c: png_push_process_row() add check for too many rows.
  Removed the now-redundant check for new_row > height in png_push_have_row().

 version 1.2.44beta03 [June 20, 2010]
-  Rewrote png_process_IDAT_data to consistently treat extra data as warnings
+  Rewrote png_process_IDAT_data() to consistently treat extra data as warnings
    and handle end conditions more cleanly.
  Removed the new (beta02) check in png_push_process_row().

+version 1.2.44rc01 [June 21, 2010]
+  Revised some comments in png_process_IDAT_data().
+
+version 1.2.44rc02 [June 22, 2010]
+  Stop memory leak when reading a malformed sCAL chunk.
+
+version 1.2.44rc03 [June 23, 2010]
+  Revised pngpread.c patch of beta05 to avoid an endless loop.
+
+version 1.2.44 [June 26, 2010]
+  Updated some of the "last changed" dates.
+
+version 1.2.45beta01 [June 7, 2011]
+  Fixed uninitialized memory read in png_format_buffer() (Bug
+    report by Frank Busse, related to CVE-2004-0421).
+  Pass "" instead of '\0' to png_default_error() in png_err().  This mistake
+    was introduced in libpng-1.2.20beta01.
+  Check for up->location !PNG_AFTER_IDAT when writing unknown chunks
+    before IDAT.
+  Ported bugfix in pngrtran.c from 1.5.3: when expanding a paletted image,
+    always expand to RGBA if transparency is present.
+
+version 1.2.45beta02 [June 8, 2011]
+  Check for integer overflow in png_set_rgb_to_gray().
+
+version 1.2.45beta03 [June 19, 2011]
+  Check for sCAL chunk too short.
+
+version 1.2.45rc01 and 1.0.55rc01 [June 30, 2011]
+  Updated "last changed" dates and copyright year.
+
+version 1.2.45 and 1.0.55 [July 7, 2011]
+  No changes.
+
+version 1.2.46rc01 and 1.0.56rc01 [July 8, 2011]
+  Reverted changes to Makefile.am and Makefile.in to libpng-1.2.44 versions.
+
+version 1.2.46rc02 and 1.0.56rc02 [July 8, 2011]
+  Added CMakeLists.txt, projects/xcode, and pnggccrd.c to EXTRA_DIST in
+    Makefile.am and Makefile.in
+
+version 1.2.46 and 1.0.56 [July 9, 2011]
+  Udated copyright year to 2011.
+
+version 1.2.47beta01 [February 17, 2012]
+  Updated contrib/pngminus/makefile.std (Samuli Souminen)
+
+version 1.0.57rc01 and 1.2.47rc01 [February 17, 2012]
+  Fixed CVE-2011-3026 buffer overrun bug.
+  Fixed CVE-2011-3026 buffer overrun bug.  This bug was introduced when
+    iCCP chunk support was added at libpng-1.0.6.
+
+version 1.0.57 and 1.2.47 [February 18, 2012]
+  No changes.
+
+version 1.2.48beta01 [February 27, 2012]
+  Removed two useless #ifdef directives from pngread.c and one from pngrutil.c
+  Eliminated redundant png_push_read_tEXt|zTXt|iTXt|unknown code from
+    pngpread.c and use the sequential png_handle_tEXt, etc., in pngrutil.c;
+    now that png_ptr->buffer is inaccessible to applications, the special
+    handling is no longer useful.
+  Fixed bug with png_handle_hIST with odd chunk length (Frank Busse).
+  Fixed incorrect type (int copy should be png_size_t copy) in png_inflate().
+  Fixed off-by-one bug in png_handle_sCAL() when using fixed point arithmetic,
+    causing out-of-bounds read in png_set_sCAL() because of failure to copy
+    the string terminators (Franke Busse).
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
@@ -2699,4 +2766,4 @@ to subscribe)
 or to glennrp at users.sourceforge.net

 Glenn R-P
-*/
+#endif
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -22,7 +22,7 @@ enable_testing()

 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 2)
-set(PNGLIB_RELEASE 44)
+set(PNGLIB_RELEASE 48)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})

@@ -215,7 +215,7 @@ configure_file(${CMAKE_CURRENT_SOURCE_DIR}/scripts/libpng-config.in
 # SET UP LINKS
 if(PNG_SHARED)
  set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 0.${PNGLIB_RELEASE}.1.2.44beta03
+#   VERSION 0.${PNGLIB_RELEASE}.1.2.48beta01
    VERSION 0.${PNGLIB_RELEASE}.0
    SOVERSION 0
    CLEAN_DIRECT_OUTPUT 1)
--- a/4
+++ b/4
@@ -1,5 +1,5 @@

-Installing libpng version 1.2.44beta03 - June 20, 2010
+Installing libpng version 1.2.48beta01 - February 27, 2012

 On Unix/Linux and similar systems, you can simply type

@@ -46,7 +46,7 @@ to have access to the zlib.h and zconf.h include files that
 correspond to the version of zlib that's installed.

 You can rename the directories that you downloaded (they
-might be called "libpng-1.2.44beta03" or "libpng12" and "zlib-1.2.3"
+might be called "libpng-1.2.48beta01" or "libpng12" and "zlib-1.2.3"
 or "zlib123") so that you have directories called "zlib" and "libpng".

 Your directory structure should look like this:
--- a/15
+++ b/15
@@ -1,24 +1,17 @@

-Known bugs in libpng version 1.2.44beta03
+Known bugs in libpng version 1.2.48beta01

-1. December 4, 2009: The PNG_NO_ERROR_NUMBERS macro was inadvertently
-   defined in libpng-1.2.41/pngconf.h, which may cause a problem with
-   building a binary-compatible library.
-
-   STATUS: This will be fixed in libpng-1.2.42.  In the meantime, simply
-   delete the definition from line :
-
-2. February 23, 2006: The custom makefiles don't build libpng with -lz.
+1. February 23, 2006: The custom makefiles don't build libpng with -lz.

   STATUS: This is a subject of debate. The change will probably be made
   as a part of a major overhaul of the makefiles in libpng version 1.4.0.

-3. February 24, 2006: The Makefile generated by the "configure" script
+2. February 24, 2006: The Makefile generated by the "configure" script
   fails to install symbolic links
   libpng12.so => libpng12.so.0.1.2.9betaN
   that are generated by the custom makefiles.

-4. September 4, 2007:  There is a report that pngtest crashes on MacOS 10.
+3. September 4, 2007:  There is a report that pngtest crashes on MacOS 10.

   STATUS: workarounds are
      1) Compile without optimization (crashes are observed with
--- a/4
+++ b/4
@@ -10,7 +10,7 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.2.6, August 15, 2004, through 1.2.44beta03, June 20, 2010, are
+libpng versions 1.2.6, August 15, 2004, through 1.2.48beta01, February 27, 2012, are
 Copyright (c) 2004, 2006-2009 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -108,4 +108,4 @@ certification mark of the Open Source Initiative.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-June 20, 2010
+February 27, 2012
--- a/Makefile.am
+++ b/Makefile.am
@@ -74,19 +74,22 @@ pkgconfig_DATA = libpng12.pc
 EXTRA_DIST= \
 	ANNOUNCE CHANGES INSTALL KNOWNBUG LICENSE README TODO Y2KINFO \
 	pngtest.png pngbar.png pngnow.png pngbar.jpg autogen.sh \
+        CMakeLists.txt \
 	${srcdir}/projects/cbuilder5/* \
 	${srcdir}/projects/beos/* \
 	${srcdir}/projects/visualc6/* \
 	${srcdir}/projects/visualc71/* \
 	${srcdir}/projects/wince.txt \
 	${srcdir}/projects/netware.txt \
+	${srcdir}/projects/xcode/* \
 	${srcdir}/scripts/* \
 	${srcdir}/contrib/gregbook/* \
+	${srcdir}/contrib/pngminim/* \
 	${srcdir}/contrib/pngminus/* \
 	${srcdir}/contrib/pngsuite/* \
 	${srcdir}/contrib/visupng/* \
 	$(TESTS) \
-	example.c libpng-1.2.44beta03.txt pngvcrd.c
+	example.c libpng-1.2.48beta01.txt pnggccrd.c pngvcrd.c

 CLEANFILES= pngout.png libpng12.pc libpng12-config libpng.vers \
 libpng.sym
--- a/Makefile.in
+++ b/Makefile.in
@@ -338,20 +338,23 @@ pkgconfig_DATA = libpng12.pc
 #extra source distribution files.
 EXTRA_DIST = \
 	ANNOUNCE CHANGES INSTALL KNOWNBUG LICENSE README TODO Y2KINFO \
+        CMakeLists.txt \
 	pngtest.png pngbar.png pngnow.png pngbar.jpg autogen.sh \
 	${srcdir}/projects/cbuilder5/* \
 	${srcdir}/projects/beos/* \
 	${srcdir}/projects/visualc6/* \
 	${srcdir}/projects/visualc71/* \
 	${srcdir}/projects/wince.txt \
+	${srcdir}/projects/xcode/* \
 	${srcdir}/projects/netware.txt \
 	${srcdir}/scripts/* \
 	${srcdir}/contrib/gregbook/* \
+	${srcdir}/contrib/pngminim/* \
 	${srcdir}/contrib/pngminus/* \
 	${srcdir}/contrib/pngsuite/* \
 	${srcdir}/contrib/visupng/* \
 	$(TESTS) \
-	example.c libpng-1.2.44beta03.txt pngvcrd.c
+	example.c libpng-1.2.48beta01.txt pnggccrd.c pngvcrd.c

 CLEANFILES = pngout.png libpng12.pc libpng12-config libpng.vers \
 libpng.sym
--- a/14
+++ b/14
@@ -1,4 +1,4 @@
-README for libpng version 1.2.44beta03 - June 20, 2010 (shared library 12.0)
+README for libpng version 1.2.48beta01 - February 27, 2012 (shared library 12.0)
 See the note about version numbers near the top of png.h

 See INSTALL for instructions on how to install libpng.
@@ -199,11 +199,11 @@ Files in this distribution:
       makefile.std     =>  Generic UNIX makefile (cc, creates static
                            libpng.a)
       makefile.elf     =>  Linux/ELF gcc makefile symbol versioning,
-                            creates libpng12.so.0.1.2.44beta03)
+                            creates libpng12.so.0.1.2.48beta01)
       makefile.linux   =>  Linux/ELF makefile (gcc, creates
-                            libpng12.so.0.1.2.44beta03)
+                            libpng12.so.0.1.2.48beta01)
       makefile.gcmmx   =>  Linux/ELF makefile (gcc, creates
-                            libpng12.so.0.1.2.44beta03, previously
+                            libpng12.so.0.1.2.48beta01, previously
                            used assembler code tuned for Intel MMX
                            platform)
       makefile.gcc     =>  Generic makefile (gcc, creates static
@@ -228,12 +228,12 @@ Files in this distribution:
       makefile.openbsd =>  OpenBSD makefile
       makefile.sgi     =>  Silicon Graphics IRIX (cc, creates static lib)
       makefile.sggcc   =>  Silicon Graphics
-                            (gcc, creates libpng12.so.0.1.2.44beta03)
+                            (gcc, creates libpng12.so.0.1.2.48beta01)
       makefile.sunos   =>  Sun makefile
       makefile.solaris =>  Solaris 2.X makefile
-                            (gcc, creates libpng12.so.0.1.2.44beta03)
+                            (gcc, creates libpng12.so.0.1.2.48beta01)
       makefile.so9     =>  Solaris 9 makefile
-                            (gcc, creates libpng12.so.0.1.2.44beta03)
+                            (gcc, creates libpng12.so.0.1.2.48beta01)
       makefile.32sunu  =>  Sun Ultra 32-bit makefile
       makefile.64sunu  =>  Sun Ultra 64-bit makefile
       makefile.sco     =>  For SCO OSr5  ELF and Unixware 7 with Native cc
--- a/4
+++ b/4
@@ -1,13 +1,13 @@
   Y2K compliance in libpng:
   =========================

-      June 20, 2010
+      February 27, 2012

      Since the PNG Development group is an ad-hoc body, we can't make
      an official declaration.

      This is your unofficial assurance that libpng from version 0.71 and
-      upward through 1.2.44beta03 are Y2K compliant.  It is my belief that earlier
+      upward through 1.2.48beta01 are Y2K compliant.  It is my belief that earlier
      versions were also Y2K compliant.

      Libpng only has three year fields.  One is a 2-byte unsigned integer
--- a/24
+++ b/24
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.65 for libpng 1.2.44beta03.
+# Generated by GNU Autoconf 2.65 for libpng 1.2.48beta01.
 #
 # Report bugs to <png-mng-implement@lists.sourceforge.net>.
 #
@@ -701,8 +701,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libpng'
 PACKAGE_TARNAME='libpng'
-PACKAGE_VERSION='1.2.44beta03'
-PACKAGE_STRING='libpng 1.2.44beta03'
+PACKAGE_VERSION='1.2.48beta01'
+PACKAGE_STRING='libpng 1.2.48beta01'
 PACKAGE_BUGREPORT='png-mng-implement@lists.sourceforge.net'
 PACKAGE_URL=''

@@ -1435,7 +1435,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures libpng 1.2.44beta03 to adapt to many kinds of systems.
+\`configure' configures libpng 1.2.48beta01 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1505,7 +1505,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of libpng 1.2.44beta03:";;
+     short | recursive ) echo "Configuration of libpng 1.2.48beta01:";;
   esac
  cat <<\_ACEOF

@@ -1612,7 +1612,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-libpng configure 1.2.44beta03
+libpng configure 1.2.48beta01
 generated by GNU Autoconf 2.65

 Copyright (C) 2009 Free Software Foundation, Inc.
@@ -2037,7 +2037,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by libpng $as_me 1.2.44beta03, which was
+It was created by libpng $as_me 1.2.48beta01, which was
 generated by GNU Autoconf 2.65.  Invocation command line was

  $ $0 $@
@@ -2845,7 +2845,7 @@ fi

 # Define the identity of the package.
 PACKAGE='libpng'
- VERSION='1.2.44beta03'
+ VERSION='1.2.48beta01'


 cat >>confdefs.h <<_ACEOF
@@ -2909,10 +2909,10 @@ fi



-PNGLIB_VERSION=1.2.44beta03
+PNGLIB_VERSION=1.2.48beta01
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=2
-PNGLIB_RELEASE=44
+PNGLIB_RELEASE=48



@@ -12079,7 +12079,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libpng $as_me 1.2.44beta03, which was
+This file was extended by libpng $as_me 1.2.48beta01, which was
 generated by GNU Autoconf 2.65.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -12145,7 +12145,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-libpng config.status 1.2.44beta03
+libpng config.status 1.2.48beta01
 configured by $0, generated by GNU Autoconf 2.65,
  with options \\"\$ac_cs_config\\"

--- a/configure.ac
+++ b/configure.ac
@@ -18,15 +18,15 @@ AC_PREREQ(2.59)

 dnl Version number stuff here:

-AC_INIT([libpng], [1.2.44beta03], [png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng], [1.2.48beta01], [png-mng-implement@lists.sourceforge.net])
 AM_INIT_AUTOMAKE
 dnl stop configure from automagically running automake
 AM_MAINTAINER_MODE

-PNGLIB_VERSION=1.2.44beta03
+PNGLIB_VERSION=1.2.48beta01
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=2
-PNGLIB_RELEASE=44
+PNGLIB_RELEASE=48

 dnl End of version number stuff

--- a/contrib/pngminus/makefile.std
+++ b/contrib/pngminus/makefile.std
@@ -23,9 +23,9 @@ ZINC = -I../../../zlib
 ZLIB = -L../../../zlib -lz
 ZLIBS = ../../../zlib/libz.a

-CFLAGS=-O3 $(PNGINC) $(ZINC)
-LDFLAGS=$(PNGLIB) $(ZLIB)
-LDFLAGSS=$(PNGLIBS) $(ZLIBS)
+CFLAGS=$(PNGINC) $(ZINC)
+LDLIBS=$(PNGLIB) $(ZLIB)
+LDLIBSS=$(PNGLIBS) $(ZLIBS)
 C=.c
 O=.o
 L=.a
@@ -40,19 +40,19 @@ png2pnm$(O): png2pnm$(C)
 	$(CC) -c $(CFLAGS) png2pnm$(C)

 png2pnm$(E): png2pnm$(O)
-	$(LD) -o png2pnm$(E) png2pnm$(O) $(LDFLAGS) -lm
+	$(LD) $(LDFLAGS) -o png2pnm$(E) png2pnm$(O) $(LDLIBS) -lm

 png2pnm-static$(E): png2pnm$(O)
-	$(LD) -o png2pnm-static$(E) png2pnm$(O) $(LDFLAGSS) -lm
+	$(LD) $(LDFLAGS) -o png2pnm-static$(E) png2pnm$(O) $(LDLIBSS) -lm

 pnm2png$(O): pnm2png$(C)
 	$(CC) -c $(CFLAGS) pnm2png$(C)

 pnm2png$(E): pnm2png$(O)
-	$(LD) -o pnm2png$(E) pnm2png$(O) $(LDFLAGS) -lm
+	$(LD) $(LDFLAGS) -o pnm2png$(E) pnm2png$(O) $(LDLIBS) -lm

 pnm2png-static$(E): pnm2png$(O)
-	$(LD) -o pnm2png-static$(E) pnm2png$(O) $(LDFLAGSS) -lm
+	$(LD) $(LDFLAGS) -o pnm2png-static$(E) pnm2png$(O) $(LDLIBSS) -lm

 clean:
 	$(RM) png2pnm$(O)
--- a/libpng-1.2.48beta01.txt
+++ b/libpng-1.2.48beta01.txt
@@ -1,6 +1,6 @@
 libpng.txt - A description on how to use and modify libpng

- libpng version 1.2.44beta03 - June 20, 2010
+ libpng version 1.2.48beta01 - February 27, 2012
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2009 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ libpng.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.2.44beta03 - June 20, 2010
+ libpng versions 0.97, January 1998, through 1.2.48beta01 - February 27, 2012
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2009 Glenn Randers-Pehrson

@@ -878,7 +878,7 @@ things.
 As of libpng version 1.2.9, png_set_expand_gray_1_2_4_to_8() was
 added.  It expands the sample depth without changing tRNS to alpha.

-As of libpng version 1.2.44beta03, not all possible expansions are supported.
+As of libpng version 1.2.48beta01, not all possible expansions are supported.

 In the following table, the 01 means grayscale with depth<8, 31 means
 indexed with depth<8, other numerals represent the color type, "T" means
@@ -3179,13 +3179,13 @@ Other rules can be inferred by inspecting the libpng source.

 XIII. Y2K Compliance in libpng

-June 20, 2010
+February 27, 2012

 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.2.44beta03 are Y2K compliant.  It is my belief that earlier
+upward through 1.2.48beta01 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has three year fields.  One is a 2-byte unsigned integer that
--- a/libpng.3
+++ b/libpng.3
@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "June 20, 2010"
+.TH LIBPNG 3 "February 27, 2012"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.2.44beta03
+libpng \- Portable Network Graphics (PNG) Reference Library 1.2.48beta01
 .SH SYNOPSIS
 \fI\fB

@@ -821,7 +821,7 @@ Following is a copy of the libpng.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng.txt - A description on how to use and modify libpng

- libpng version 1.2.44beta03 - June 20, 2010
+ libpng version 1.2.48beta01 - February 27, 2012
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2009 Glenn Randers-Pehrson
@@ -832,7 +832,7 @@ libpng.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.2.44beta03 - June 20, 2010
+ libpng versions 0.97, January 1998, through 1.2.48beta01 - February 27, 2012
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2009 Glenn Randers-Pehrson

@@ -1699,7 +1699,7 @@ things.
 As of libpng version 1.2.9, png_set_expand_gray_1_2_4_to_8() was
 added.  It expands the sample depth without changing tRNS to alpha.

-As of libpng version 1.2.44beta03, not all possible expansions are supported.
+As of libpng version 1.2.48beta01, not all possible expansions are supported.

 In the following table, the 01 means grayscale with depth<8, 31 means
 indexed with depth<8, other numerals represent the color type, "T" means
@@ -4000,13 +4000,13 @@ Other rules can be inferred by inspecting the libpng source.

 .SH XIII. Y2K Compliance in libpng

-June 20, 2010
+February 27, 2012

 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.2.44beta03 are Y2K compliant.  It is my belief that earlier
+upward through 1.2.48beta01 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has three year fields.  One is a 2-byte unsigned integer that
@@ -4275,7 +4275,7 @@ the first widely used release:
 1.2.37beta01-03     13    10237  12.so.0.37[.0]
 1.2.37rc01          13    10237  12.so.0.37[.0]
 1.2.37              13    10237  12.so.0.37[.0]
- 1.2.45              10    10045  12.so.0.45[.0]
+ 1.0.45              10    10045  12.so.0.45[.0]
 1.0.46              10    10046  10.so.0.46[.0]
 1.2.38beta01        13    10238  12.so.0.38[.0]
 1.2.38rc01-03       13    10238  12.so.0.38[.0]
@@ -4305,6 +4305,22 @@ the first widely used release:
 1.0.53              10    10053  10.so.0.53[.0]
 1.2.43              13    10243  12.so.0.43[.0]
 1.2.44beta01-03     13    10244  12.so.0.44[.0]
+ 1.2.44rc01-03       13    10244  12.so.0.44[.0]
+ 1.2.44              13    10244  12.so.0.44[.0]
+ 1.2.45beta01-03     13    10245  12.so.0.45[.0]
+ 1.0.55rc01          10    10055  10.so.0.55[.0]
+ 1.2.45rc01          13    10245  12.so.0.45[.0]
+ 1.0.55              10    10055  10.so.0.55[.0]
+ 1.2.45              13    10245  12.so.0.45[.0]
+ 1.2.46rc01-02       13    10246  12.so.0.46[.0]
+ 1.0.56              10    10056  10.so.0.56[.0]
+ 1.2.46              13    10246  12.so.0.46[.0]
+ 1.2.47beta01        13    10247  12.so.0.47[.0]
+ 1.2.47rc01          13    10247  12.so.0.47[.0]
+ 1.0.57rc01          10    10057  10.so.0.57[.0]
+ 1.2.47              13    10247  12.so.0.47[.0]
+ 1.0.57              10    10057  10.so.0.57[.0]
+ 1.2.48beta01        13    10248  12.so.0.48[.0]

 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -4360,7 +4376,7 @@ possible without all of you.

 Thanks to Frank J. T. Wojcik for helping with the documentation.

-Libpng version 1.2.44beta03 - June 20, 2010:
+Libpng version 1.2.48beta01 - February 27, 2012:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).

@@ -4383,7 +4399,7 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.2.6, August 15, 2004, through 1.2.44beta03, June 20, 2010, are
+libpng versions 1.2.6, August 15, 2004, through 1.2.48beta01, February 27, 2012, are
 Copyright (c) 2004,2006-2008 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -4482,7 +4498,7 @@ certification mark of the Open Source Initiative.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-June 20, 2010
+February 27, 2012

 .\" end of man page

--- a/libpngpf.3
+++ b/libpngpf.3
@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "June 20, 2010"
+.TH LIBPNGPF 3 "February 27, 2012"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.2.44beta03
+libpng \- Portable Network Graphics (PNG) Reference Library 1.2.48beta01
 (private functions)
 .SH SYNOPSIS
 \fB#include <png.h>\fP
--- a/png.5
+++ b/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "June 20, 2010"
+.TH PNG 5 "February 27, 2012"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
--- a/png.c
+++ b/png.c
@@ -1,8 +1,8 @@

 /* png.c - location for general purpose libpng functions
 *
- * Last changed in libpng 1.2.43 [February 25, 2010]
- * Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.46 [February 25, 2011]
+ * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -17,7 +17,7 @@
 #include "png.h"

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_2_44beta03 Your_png_h_is_not_version_1_2_44beta03;
+typedef version_1_2_48beta01 Your_png_h_is_not_version_1_2_48beta01;

 /* Version information for C files.  This had better match the version
 * string defined in png.h.
@@ -724,14 +724,14 @@ png_get_copyright(png_structp png_ptr)
 #else
 #ifdef __STDC__
   return ((png_charp) PNG_STRING_NEWLINE \
-     "libpng version 1.2.44beta03 - June 20, 2010" PNG_STRING_NEWLINE \
-     "Copyright (c) 1998-2010 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
+     "libpng version 1.2.48beta01 - February 27, 2012" PNG_STRING_NEWLINE \
+     "Copyright (c) 1998-2011 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
     "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
     "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
     PNG_STRING_NEWLINE);
 #else
-      return ((png_charp) "libpng version 1.2.44beta03 - June 20, 2010\
-      Copyright (c) 1998-2010 Glenn Randers-Pehrson\
+      return ((png_charp) "libpng version 1.2.48beta01 - February 27, 2012\
+      Copyright (c) 1998-2011 Glenn Randers-Pehrson\
      Copyright (c) 1996-1997 Andreas Dilger\
      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.");
 #endif
--- a/png.h
+++ b/png.h
@@ -1,7 +1,7 @@
 /* png.h - header file for PNG reference library
 *
- * libpng version 1.2.44beta03 - June 20, 2010
- * Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ * libpng version 1.2.48beta01 - February 27, 2012
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -10,7 +10,7 @@
 * Authors and maintainers:
 *  libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
 *  libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *  libpng versions 0.97, January 1998, through 1.2.44beta03 - June 20, 2010: Glenn
+ *  libpng versions 0.97, January 1998, through 1.2.48beta01 - February 27, 2012: Glenn
 *  See also "Contributing Authors", below.
 *
 * Note about libpng version numbers:
@@ -231,7 +231,7 @@
 *    1.2.37beta01-03         13    10237  12.so.0.37[.0]
 *    1.2.37rc01              13    10237  12.so.0.37[.0]
 *    1.2.37                  13    10237  12.so.0.37[.0]
- *    1.2.45                  10    10045  12.so.0.45[.0]
+ *    1.0.45                  10    10045  12.so.0.45[.0]
 *    1.0.46                  10    10046  10.so.0.46[.0]
 *    1.2.38beta01            13    10238  12.so.0.38[.0]
 *    1.2.38rc01-03           13    10238  12.so.0.38[.0]
@@ -260,6 +260,22 @@
 *    1.0.53                  10    10053  10.so.0.53[.0]
 *    1.2.43                  13    10243  12.so.0.43[.0]
 *    1.2.44beta01-03         13    10244  12.so.0.44[.0]
+ *    1.2.44rc01-03           13    10244  12.so.0.44[.0]
+ *    1.2.44                  13    10244  12.so.0.44[.0]
+ *    1.2.45beta01-03         13    10245  12.so.0.45[.0]
+ *    1.0.55rc01              10    10055  10.so.0.55[.0]
+ *    1.2.45rc01              13    10245  12.so.0.45[.0]
+ *    1.0.55                  10    10055  10.so.0.55[.0]
+ *    1.2.45                  13    10245  12.so.0.45[.0]
+ *    1.2.46rc01-02           13    10246  12.so.0.46[.0]
+ *    1.0.56                  10    10056  10.so.0.56[.0]
+ *    1.2.46                  13    10246  12.so.0.46[.0]
+ *    1.2.47beta01            13    10247  12.so.0.47[.0]
+ *    1.2.47rc01              13    10247  12.so.0.47[.0]
+ *    1.0.57rc01              10    10057  10.so.0.57[.0]
+ *    1.2.47                  13    10247  12.so.0.47[.0]
+ *    1.0.57                  10    10057  10.so.0.57[.0]
+ *    1.2.48beta01            13    10248  12.so.0.48[.0]
 *
 *    Henceforth the source version will match the shared-library major
 *    and minor numbers; the shared-library major version number will be
@@ -291,8 +307,8 @@
 *
 * This code is released under the libpng license.
 *
- * libpng versions 1.2.6, August 15, 2004, through 1.2.44beta03, June 20, 2010, are
- * Copyright (c) 2004, 2006-2010 Glenn Randers-Pehrson, and are
+ * libpng versions 1.2.6, August 15, 2004, through 1.2.48beta01, February 27, 2012, are
+ * Copyright (c) 2004, 2006-2011 Glenn Randers-Pehrson, and are
 * distributed according to the same disclaimer and license as libpng-1.2.5
 * with the following individual added to the list of Contributing Authors:
 *
@@ -403,13 +419,13 @@
 * Y2K compliance in libpng:
 * =========================
 *
- *    June 20, 2010
+ *    February 27, 2012
 *
 *    Since the PNG Development group is an ad-hoc body, we can't make
 *    an official declaration.
 *
 *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.2.44beta03 are Y2K compliant.  It is my belief that earlier
+ *    upward through 1.2.48beta01 are Y2K compliant.  It is my belief that earlier
 *    versions were also Y2K compliant.
 *
 *    Libpng only has three year fields.  One is a 2-byte unsigned integer
@@ -465,9 +481,9 @@
 */

 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.2.44beta03"
+#define PNG_LIBPNG_VER_STRING "1.2.48beta01"
 #define PNG_HEADER_VERSION_STRING \
-   " libpng version 1.2.44beta03 - June 20, 2010\n"
+   " libpng version 1.2.48beta01 - February 27, 2012\n"

 #define PNG_LIBPNG_VER_SONUM   0
 #define PNG_LIBPNG_VER_DLLNUM  13
@@ -475,12 +491,12 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   2
-#define PNG_LIBPNG_VER_RELEASE 44
+#define PNG_LIBPNG_VER_RELEASE 48
 /* This should match the numeric part of the final component of
 * PNG_LIBPNG_VER_STRING, omitting any leading zero:
 */

-#define PNG_LIBPNG_VER_BUILD  03
+#define PNG_LIBPNG_VER_BUILD  01

 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -505,7 +521,7 @@
 * version 1.0.0 was mis-numbered 100 instead of 10000).  From
 * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
 */
-#define PNG_LIBPNG_VER 10244 /* 1.2.44 */
+#define PNG_LIBPNG_VER 10248 /* 1.2.48 */

 #ifndef PNG_VERSION_INFO_ONLY
 /* Include the compression library's header */
@@ -1545,7 +1561,7 @@ struct png_struct_def
 /* This triggers a compiler error in png.c, if png.c and png.h
 * do not agree upon the version number.
 */
-typedef png_structp version_1_2_44beta03;
+typedef png_structp version_1_2_48beta01;

 typedef png_struct FAR * FAR * png_structpp;

--- a/pngconf.h
+++ b/pngconf.h
@@ -1,8 +1,8 @@

 /* pngconf.h - machine configurable file for libpng
 *
- * libpng version 1.2.44beta03 - June 20, 2010
- * Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ * libpng version 1.2.48beta01 - February 27, 2012
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngerror.c
+++ b/pngerror.c
@@ -1,8 +1,8 @@

 /* pngerror.c - stub functions for i/o and memory allocation
 *
- * Last changed in libpng 1.2.41 [December 3, 2009]
- * Copyright (c) 1998-2009 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.45 [July 7, 2011]
+ * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -87,12 +87,17 @@ png_error(png_structp png_ptr, png_const_charp error_message)
 void PNGAPI
 png_err(png_structp png_ptr)
 {
+   /* Prior to 1.2.45 the error_fn received a NULL pointer, expressed
+    * erroneously as '\0', instead of the empty string "".  This was
+    * apparently an error, introduced in libpng-1.2.20, and png_default_error
+    * will crash in this case.
+    */
   if (png_ptr != NULL && png_ptr->error_fn != NULL)
-      (*(png_ptr->error_fn))(png_ptr, '\0');
+      (*(png_ptr->error_fn))(png_ptr, "");

   /* If the custom handler doesn't exist, or if it returns,
      use the default handler, which will not return. */
-   png_default_error(png_ptr, '\0');
+   png_default_error(png_ptr, "");
 }
 #endif /* PNG_ERROR_TEXT_SUPPORTED */

@@ -181,8 +186,13 @@ png_format_buffer(png_structp png_ptr, png_charp buffer, png_const_charp
   {
      buffer[iout++] = ':';
      buffer[iout++] = ' ';
-      png_memcpy(buffer + iout, error_message, PNG_MAX_ERROR_TEXT);
-      buffer[iout + PNG_MAX_ERROR_TEXT - 1] = '\0';
+
+      iin = 0;
+      while (iin < PNG_MAX_ERROR_TEXT-1 && error_message[iin] != '\0')
+         buffer[iout++] = error_message[iin++];
+
+      /* iin < PNG_MAX_ERROR_TEXT, so the following is safe: */
+      buffer[iout] = '\0';
   }
 }

--- a/pngmem.c
+++ b/pngmem.c
@@ -442,7 +442,7 @@ png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn,
 * have the ability to do that.
 */

-png_voidp PNGAPI
+png_voidp /* PRIVATE */
 png_calloc(png_structp png_ptr, png_uint_32 size)
 {
   png_voidp ret;
--- a/pngpread.c
+++ b/pngpread.c
@@ -1,7 +1,7 @@

 /* pngpread.c - read a png file in push mode
 *
- * Last changed in libpng 1.2.44 [June 20, 2010]
+ * Last changed in libpng 1.2.44 [June 26, 2010]
 * Copyright (c) 1998-2010 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -71,30 +71,6 @@ png_process_some_data(png_structp png_ptr, png_infop info_ptr)
         break;
      }

-#ifdef PNG_READ_tEXt_SUPPORTED
-      case PNG_READ_tEXt_MODE:
-      {
-         png_push_read_tEXt(png_ptr, info_ptr);
-         break;
-      }
-
-#endif
-#ifdef PNG_READ_zTXt_SUPPORTED
-      case PNG_READ_zTXt_MODE:
-      {
-         png_push_read_zTXt(png_ptr, info_ptr);
-         break;
-      }
-
-#endif
-#ifdef PNG_READ_iTXt_SUPPORTED
-      case PNG_READ_iTXt_MODE:
-      {
-         png_push_read_iTXt(png_ptr, info_ptr);
-         break;
-      }
-
-#endif
      case PNG_SKIP_MODE:
      {
         png_push_crc_finish(png_ptr);
@@ -529,7 +505,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
         return;
      }

-      png_push_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
   }

 #endif
@@ -542,7 +518,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
         return;
      }

-      png_push_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
   }

 #endif
@@ -555,7 +531,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
         return;
      }

-      png_push_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
   }

 #endif
@@ -566,7 +542,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
         png_push_save_buffer(png_ptr);
         return;
      }
-      png_push_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
   }

   png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
@@ -833,12 +809,12 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
   png_size_t buffer_length)
 {
   /* The caller checks for a non-zero buffer length. */
-   if (!(buffer_length > 0) || buffer == 0)
+   if (!(buffer_length > 0) || buffer == NULL)
      png_error(png_ptr, "No IDAT data (internal error)");

   /* This routine must process all the data it has been given
    * before returning, calling the row callback as required to
-    * handle the uncomrpessed results.
+    * handle the uncompressed results.
    */
   png_ptr->zstream.next_in = buffer;
   png_ptr->zstream.avail_in = (uInt)buffer_length;
@@ -853,7 +829,7 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,

      /* We have data for zlib, but we must check that zlib
       * has somewhere to put the results.  It doesn't matter
-       * if we don't expect any results - it may be the input
+       * if we don't expect any results -- it may be the input
       * data is just the LZ end code.
       */
      if (!(png_ptr->zstream.avail_out > 0))
@@ -884,9 +860,9 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
 	  */
         if (png_ptr->row_number >= png_ptr->num_rows ||
 	     png_ptr->pass > 6)
-	    png_warning(png_ptr, "Truncated compressed data");
+	    png_warning(png_ptr, "Truncated compressed data in IDAT");
 	 else
-	    png_error(png_ptr, "Decompression error");
+	    png_error(png_ptr, "Decompression error in IDAT");

 	 /* Skip the check on unprocessed input */
         return;
@@ -903,9 +879,9 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
 	     png_ptr->pass > 6)
         {
 	    /* Extra data. */
-	    png_warning(png_ptr, "Extra compressed data");
+	    png_warning(png_ptr, "Extra compressed data in IDAT");
            png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
-	    /* Do not more proecessing, skip the unprocessed
+	    /* Do no more processing; skip the unprocessed
 	     * input check below.
 	     */
            return;
@@ -914,11 +890,11 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
 	 /* Do we have a complete row? */
 	 if (png_ptr->zstream.avail_out == 0)
 	    png_push_process_row(png_ptr);
-
-	 /* And check for the end of the stream. */
-	 if (ret == Z_STREAM_END)
-            png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
      }
+
+      /* And check for the end of the stream. */
+      if (ret == Z_STREAM_END)
+	 png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
   }

   /* All the data should have been processed, if anything
@@ -1201,515 +1177,6 @@ png_read_push_finish_row(png_structp png_ptr)
 #endif /* PNG_READ_INTERLACING_SUPPORTED */
 }

-#ifdef PNG_READ_tEXt_SUPPORTED
-void /* PRIVATE */
-png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
-   length)
-{
-   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
-      {
-         png_error(png_ptr, "Out of place tEXt");
-         info_ptr = info_ptr; /* To quiet some compiler warnings */
-      }
-
-#ifdef PNG_MAX_MALLOC_64K
-   png_ptr->skip_length = 0;  /* This may not be necessary */
-
-   if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
-   {
-      png_warning(png_ptr, "tEXt chunk too large to fit in memory");
-      png_ptr->skip_length = length - (png_uint_32)65535L;
-      length = (png_uint_32)65535L;
-   }
-#endif
-
-   png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-      (png_uint_32)(length + 1));
-   png_ptr->current_text[length] = '\0';
-   png_ptr->current_text_ptr = png_ptr->current_text;
-   png_ptr->current_text_size = (png_size_t)length;
-   png_ptr->current_text_left = (png_size_t)length;
-   png_ptr->process_mode = PNG_READ_tEXt_MODE;
-}
-
-void /* PRIVATE */
-png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
-{
-   if (png_ptr->buffer_size && png_ptr->current_text_left)
-   {
-      png_size_t text_size;
-
-      if (png_ptr->buffer_size < png_ptr->current_text_left)
-         text_size = png_ptr->buffer_size;
-
-      else
-         text_size = png_ptr->current_text_left;
-
-      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
-      png_ptr->current_text_left -= text_size;
-      png_ptr->current_text_ptr += text_size;
-   }
-   if (!(png_ptr->current_text_left))
-   {
-      png_textp text_ptr;
-      png_charp text;
-      png_charp key;
-      int ret;
-
-      if (png_ptr->buffer_size < 4)
-      {
-         png_push_save_buffer(png_ptr);
-         return;
-      }
-
-      png_push_crc_finish(png_ptr);
-
-#ifdef PNG_MAX_MALLOC_64K
-      if (png_ptr->skip_length)
-         return;
-#endif
-
-      key = png_ptr->current_text;
-
-      for (text = key; *text; text++)
-         /* Empty loop */ ;
-
-      if (text < key + png_ptr->current_text_size)
-         text++;
-
-      text_ptr = (png_textp)png_malloc(png_ptr,
-         (png_uint_32)png_sizeof(png_text));
-      text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
-      text_ptr->key = key;
-#ifdef PNG_iTXt_SUPPORTED
-      text_ptr->lang = NULL;
-      text_ptr->lang_key = NULL;
-#endif
-      text_ptr->text = text;
-
-      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
-
-      png_free(png_ptr, key);
-      png_free(png_ptr, text_ptr);
-      png_ptr->current_text = NULL;
-
-      if (ret)
-        png_warning(png_ptr, "Insufficient memory to store text chunk.");
-   }
-}
-#endif
-
-#ifdef PNG_READ_zTXt_SUPPORTED
-void /* PRIVATE */
-png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
-   length)
-{
-   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
-      {
-         png_error(png_ptr, "Out of place zTXt");
-         info_ptr = info_ptr; /* To quiet some compiler warnings */
-      }
-
-#ifdef PNG_MAX_MALLOC_64K
-   /* We can't handle zTXt chunks > 64K, since we don't have enough space
-    * to be able to store the uncompressed data.  Actually, the threshold
-    * is probably around 32K, but it isn't as definite as 64K is.
-    */
-   if (length > (png_uint_32)65535L)
-   {
-      png_warning(png_ptr, "zTXt chunk too large to fit in memory");
-      png_push_crc_skip(png_ptr, length);
-      return;
-   }
-#endif
-
-   png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-      (png_uint_32)(length + 1));
-   png_ptr->current_text[length] = '\0';
-   png_ptr->current_text_ptr = png_ptr->current_text;
-   png_ptr->current_text_size = (png_size_t)length;
-   png_ptr->current_text_left = (png_size_t)length;
-   png_ptr->process_mode = PNG_READ_zTXt_MODE;
-}
-
-void /* PRIVATE */
-png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
-{
-   if (png_ptr->buffer_size && png_ptr->current_text_left)
-   {
-      png_size_t text_size;
-
-      if (png_ptr->buffer_size < (png_uint_32)png_ptr->current_text_left)
-         text_size = png_ptr->buffer_size;
-
-      else
-         text_size = png_ptr->current_text_left;
-
-      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
-      png_ptr->current_text_left -= text_size;
-      png_ptr->current_text_ptr += text_size;
-   }
-   if (!(png_ptr->current_text_left))
-   {
-      png_textp text_ptr;
-      png_charp text;
-      png_charp key;
-      int ret;
-      png_size_t text_size, key_size;
-
-      if (png_ptr->buffer_size < 4)
-      {
-         png_push_save_buffer(png_ptr);
-         return;
-      }
-
-      png_push_crc_finish(png_ptr);
-
-      key = png_ptr->current_text;
-
-      for (text = key; *text; text++)
-         /* Empty loop */ ;
-
-      /* zTXt can't have zero text */
-      if (text >= key + png_ptr->current_text_size)
-      {
-         png_ptr->current_text = NULL;
-         png_free(png_ptr, key);
-         return;
-      }
-
-      text++;
-
-      if (*text != PNG_TEXT_COMPRESSION_zTXt) /* Check compression byte */
-      {
-         png_ptr->current_text = NULL;
-         png_free(png_ptr, key);
-         return;
-      }
-
-      text++;
-
-      png_ptr->zstream.next_in = (png_bytep )text;
-      png_ptr->zstream.avail_in = (uInt)(png_ptr->current_text_size -
-         (text - key));
-      png_ptr->zstream.next_out = png_ptr->zbuf;
-      png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
-
-      key_size = text - key;
-      text_size = 0;
-      text = NULL;
-      ret = Z_STREAM_END;
-
-      while (png_ptr->zstream.avail_in)
-      {
-         ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
-         if (ret != Z_OK && ret != Z_STREAM_END)
-         {
-            inflateReset(&png_ptr->zstream);
-            png_ptr->zstream.avail_in = 0;
-            png_ptr->current_text = NULL;
-            png_free(png_ptr, key);
-            png_free(png_ptr, text);
-            return;
-         }
-         if (!(png_ptr->zstream.avail_out) || ret == Z_STREAM_END)
-         {
-            if (text == NULL)
-            {
-               text = (png_charp)png_malloc(png_ptr,
-                     (png_uint_32)(png_ptr->zbuf_size
-                     - png_ptr->zstream.avail_out + key_size + 1));
-
-               png_memcpy(text + key_size, png_ptr->zbuf,
-                  png_ptr->zbuf_size - png_ptr->zstream.avail_out);
-
-               png_memcpy(text, key, key_size);
-
-               text_size = key_size + png_ptr->zbuf_size -
-                  png_ptr->zstream.avail_out;
-
-               *(text + text_size) = '\0';
-            }
-            else
-            {
-               png_charp tmp;
-
-               tmp = text;
-               text = (png_charp)png_malloc(png_ptr, text_size +
-                  (png_uint_32)(png_ptr->zbuf_size 
-                  - png_ptr->zstream.avail_out + 1));
-
-               png_memcpy(text, tmp, text_size);
-               png_free(png_ptr, tmp);
-
-               png_memcpy(text + text_size, png_ptr->zbuf,
-                  png_ptr->zbuf_size - png_ptr->zstream.avail_out);
-
-               text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
-               *(text + text_size) = '\0';
-            }
-            if (ret != Z_STREAM_END)
-            {
-               png_ptr->zstream.next_out = png_ptr->zbuf;
-               png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
-            }
-         }
-         else
-         {
-            break;
-         }
-
-         if (ret == Z_STREAM_END)
-            break;
-      }
-
-      inflateReset(&png_ptr->zstream);
-      png_ptr->zstream.avail_in = 0;
-
-      if (ret != Z_STREAM_END)
-      {
-         png_ptr->current_text = NULL;
-         png_free(png_ptr, key);
-         png_free(png_ptr, text);
-         return;
-      }
-
-      png_ptr->current_text = NULL;
-      png_free(png_ptr, key);
-      key = text;
-      text += key_size;
-
-      text_ptr = (png_textp)png_malloc(png_ptr,
-          (png_uint_32)png_sizeof(png_text));
-      text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
-      text_ptr->key = key;
-#ifdef PNG_iTXt_SUPPORTED
-      text_ptr->lang = NULL;
-      text_ptr->lang_key = NULL;
-#endif
-      text_ptr->text = text;
-
-      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
-
-      png_free(png_ptr, key);
-      png_free(png_ptr, text_ptr);
-
-      if (ret)
-        png_warning(png_ptr, "Insufficient memory to store text chunk.");
-   }
-}
-#endif
-
-#ifdef PNG_READ_iTXt_SUPPORTED
-void /* PRIVATE */
-png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
-   length)
-{
-   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
-      {
-         png_error(png_ptr, "Out of place iTXt");
-         info_ptr = info_ptr; /* To quiet some compiler warnings */
-      }
-
-#ifdef PNG_MAX_MALLOC_64K
-   png_ptr->skip_length = 0;  /* This may not be necessary */
-
-   if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
-   {
-      png_warning(png_ptr, "iTXt chunk too large to fit in memory");
-      png_ptr->skip_length = length - (png_uint_32)65535L;
-      length = (png_uint_32)65535L;
-   }
-#endif
-
-   png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-      (png_uint_32)(length + 1));
-   png_ptr->current_text[length] = '\0';
-   png_ptr->current_text_ptr = png_ptr->current_text;
-   png_ptr->current_text_size = (png_size_t)length;
-   png_ptr->current_text_left = (png_size_t)length;
-   png_ptr->process_mode = PNG_READ_iTXt_MODE;
-}
-
-void /* PRIVATE */
-png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
-{
-
-   if (png_ptr->buffer_size && png_ptr->current_text_left)
-   {
-      png_size_t text_size;
-
-      if (png_ptr->buffer_size < png_ptr->current_text_left)
-         text_size = png_ptr->buffer_size;
-
-      else
-         text_size = png_ptr->current_text_left;
-
-      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
-      png_ptr->current_text_left -= text_size;
-      png_ptr->current_text_ptr += text_size;
-   }
-   if (!(png_ptr->current_text_left))
-   {
-      png_textp text_ptr;
-      png_charp key;
-      int comp_flag;
-      png_charp lang;
-      png_charp lang_key;
-      png_charp text;
-      int ret;
-
-      if (png_ptr->buffer_size < 4)
-      {
-         png_push_save_buffer(png_ptr);
-         return;
-      }
-
-      png_push_crc_finish(png_ptr);
-
-#ifdef PNG_MAX_MALLOC_64K
-      if (png_ptr->skip_length)
-         return;
-#endif
-
-      key = png_ptr->current_text;
-
-      for (lang = key; *lang; lang++)
-         /* Empty loop */ ;
-
-      if (lang < key + png_ptr->current_text_size - 3)
-         lang++;
-
-      comp_flag = *lang++;
-      lang++;     /* Skip comp_type, always zero */
-
-      for (lang_key = lang; *lang_key; lang_key++)
-         /* Empty loop */ ;
-
-      lang_key++;        /* Skip NUL separator */
-
-      text=lang_key;
-
-      if (lang_key < key + png_ptr->current_text_size - 1)
-      {
-        for (; *text; text++)
-           /* Empty loop */ ;
-      }
-
-      if (text < key + png_ptr->current_text_size)
-         text++;
-
-      text_ptr = (png_textp)png_malloc(png_ptr,
-         (png_uint_32)png_sizeof(png_text));
-
-      text_ptr->compression = comp_flag + 2;
-      text_ptr->key = key;
-      text_ptr->lang = lang;
-      text_ptr->lang_key = lang_key;
-      text_ptr->text = text;
-      text_ptr->text_length = 0;
-      text_ptr->itxt_length = png_strlen(text);
-
-      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
-
-      png_ptr->current_text = NULL;
-
-      png_free(png_ptr, text_ptr);
-      if (ret)
-         png_warning(png_ptr, "Insufficient memory to store iTXt chunk.");
-   }
-}
-#endif
-
-/* This function is called when we haven't found a handler for this
- * chunk.  If there isn't a problem with the chunk itself (ie a bad chunk
- * name or a critical chunk), the chunk is (currently) silently ignored.
- */
-void /* PRIVATE */
-png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
-   length)
-{
-   png_uint_32 skip = 0;
-
-   if (!(png_ptr->chunk_name[0] & 0x20))
-   {
-#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
-      if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
-         PNG_HANDLE_CHUNK_ALWAYS
-#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
-         && png_ptr->read_user_chunk_fn == NULL
-#endif
-         )
-#endif
-         png_chunk_error(png_ptr, "unknown critical chunk");
-
-      info_ptr = info_ptr; /* To quiet some compiler warnings */
-   }
-
-#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
-   if (png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
-   {
-#ifdef PNG_MAX_MALLOC_64K
-      if (length > (png_uint_32)65535L)
-      {
-          png_warning(png_ptr, "unknown chunk too large to fit in memory");
-          skip = length - (png_uint_32)65535L;
-          length = (png_uint_32)65535L;
-      }
-#endif
-      png_memcpy((png_charp)png_ptr->unknown_chunk.name,
-                 (png_charp)png_ptr->chunk_name, 
-                 png_sizeof(png_ptr->unknown_chunk.name));
-      png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name) - 1]
-        = '\0';
-
-      png_ptr->unknown_chunk.size = (png_size_t)length;
-
-      if (length == 0)
-         png_ptr->unknown_chunk.data = NULL;
-
-      else
-      {
-         png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr,
-            (png_uint_32)length);
-         png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
-      }
-
-#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
-      if (png_ptr->read_user_chunk_fn != NULL)
-      {
-         /* Callback to user unknown chunk handler */
-         int ret;
-         ret = (*(png_ptr->read_user_chunk_fn))
-           (png_ptr, &png_ptr->unknown_chunk);
-
-         if (ret < 0)
-            png_chunk_error(png_ptr, "error in user chunk");
-
-         if (ret == 0)
-         {
-            if (!(png_ptr->chunk_name[0] & 0x20))
-               if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
-                    PNG_HANDLE_CHUNK_ALWAYS)
-                  png_chunk_error(png_ptr, "unknown critical chunk");
-            png_set_unknown_chunks(png_ptr, info_ptr,
-               &png_ptr->unknown_chunk, 1);
-         }
-      }
-
-      else
-#endif
-        png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
-      png_free(png_ptr, png_ptr->unknown_chunk.data);
-      png_ptr->unknown_chunk.data = NULL;
-   }
-
-   else
-#endif
-      skip=length;
-   png_push_crc_skip(png_ptr, skip);
-}
-
 void /* PRIVATE */
 png_push_have_info(png_structp png_ptr, png_infop info_ptr)
 {
--- a/pngread.c
+++ b/pngread.c
@@ -1,8 +1,8 @@

 /* pngread.c - read a PNG file
 *
- * Last changed in libpng 1.2.44 [June 20, 2010]
- * Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.48 [February 27, 2012]
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -19,7 +19,6 @@
 #include "png.h"
 #ifdef PNG_READ_SUPPORTED

-
 /* Create a PNG structure for reading, and allocate any memory needed. */
 png_structp PNGAPI
 png_create_read_struct(png_const_charp user_png_ver, png_voidp error_ptr,
@@ -69,14 +68,8 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
 #ifdef PNG_USER_LIMITS_SUPPORTED
   png_ptr->user_width_max = PNG_USER_WIDTH_MAX;
   png_ptr->user_height_max = PNG_USER_HEIGHT_MAX;
-#  ifdef PNG_USER_CHUNK_CACHE_MAX
   /* Added at libpng-1.2.43 and 1.4.0 */
   png_ptr->user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;
-#  endif
-#  ifdef PNG_SET_USER_CHUNK_MALLOC_MAX
-   /* Added at libpng-1.2.43 and 1.4.1 */
-   png_ptr->user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;
-#  endif
 #endif

 #ifdef PNG_SETJMP_SUPPORTED
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -1,8 +1,8 @@

 /* pngrtran.c - transforms the data in a row for PNG readers
 *
- * Last changed in libpng 1.2.43 [February 25, 2010]
- * Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.45 [July 7, 2011]
+ * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -676,10 +676,21 @@ void PNGAPI
 png_set_rgb_to_gray(png_structp png_ptr, int error_action, double red,
   double green)
 {
-   int red_fixed = (int)((float)red*100000.0 + 0.5);
-   int green_fixed = (int)((float)green*100000.0 + 0.5);
+   int red_fixed, green_fixed;
   if (png_ptr == NULL)
      return;
+   if (red > 21474.83647 || red < -21474.83648 ||
+       green > 21474.83647 || green < -21474.83648)
+   {
+      png_warning(png_ptr, "ignoring out of range rgb_to_gray coefficients");
+      red_fixed = -1;
+      green_fixed = -1;
+   }
+   else
+   {
+      red_fixed = (int)((float)red*100000.0 + 0.5);
+      green_fixed = (int)((float)green*100000.0 + 0.5);
+   }
   png_set_rgb_to_gray_fixed(png_ptr, error_action, red_fixed, green_fixed);
 }
 #endif
@@ -1196,8 +1207,7 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr)
   {
      if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
      {
-         if (png_ptr->num_trans &&
-              (png_ptr->transformations & PNG_EXPAND_tRNS))
+         if (png_ptr->num_trans)
            info_ptr->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
         else
            info_ptr->color_type = PNG_COLOR_TYPE_RGB;
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,8 +1,8 @@

 /* pngrutil.c - utilities to read a PNG file
 *
- * Last changed in libpng 1.2.44 [June 20, 2010]
- * Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.48 [February 27, 2012]
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -220,7 +220,7 @@ png_crc_error(png_structp png_ptr)
    defined(PNG_READ_iCCP_SUPPORTED)
 static png_size_t
 png_inflate(png_structp png_ptr, const png_byte *data, png_size_t size,
-	png_bytep output, png_size_t output_size)
+        png_bytep output, png_size_t output_size)
 {
   png_size_t count = 0;

@@ -246,11 +246,11 @@ png_inflate(png_structp png_ptr, const png_byte *data, png_size_t size,
      if ((ret == Z_OK || ret == Z_STREAM_END) && avail > 0)
      {
         if (output != 0 && output_size > count)
-	 {
-	    int copy = output_size - count;
-	    if (avail < copy) copy = avail;
-	    png_memcpy(output + count, png_ptr->zbuf, copy);
-	 }
+         {
+            png_size_t copy = output_size - count;
+            if ((png_size_t) avail < copy) copy = (png_size_t) avail;
+            png_memcpy(output + count, png_ptr->zbuf, copy);
+         }
         count += avail;
      }

@@ -271,31 +271,33 @@ png_inflate(png_structp png_ptr, const png_byte *data, png_size_t size,
       * buffer if available.
       */
      {
-         char *msg, umsg[52];
-	 if (png_ptr->zstream.msg != 0)
-	    msg = png_ptr->zstream.msg;
-	 else
-	 {
+         PNG_CONST char *msg;
+         if (png_ptr->zstream.msg != 0)
+            msg = png_ptr->zstream.msg;
+         else
+         {
 #if defined(PNG_STDIO_SUPPORTED) && !defined(_WIN32_WCE)
-	    switch (ret)
-	    {
-	 case Z_BUF_ERROR:
-	    msg = "Buffer error in compressed datastream in %s chunk";
-	    break;
-	 case Z_DATA_ERROR:
-	    msg = "Data error in compressed datastream in %s chunk";
-	    break;
-	 default:
-	    msg = "Incomplete compressed datastream in %s chunk";
-	    break;
-	    }
+            char umsg[52];

-	    png_snprintf(umsg, sizeof umsg, msg, png_ptr->chunk_name);
-	    msg = umsg;
+            switch (ret)
+            {
+               case Z_BUF_ERROR:
+                  msg = "Buffer error in compressed datastream in %s chunk";
+                  break;
+               case Z_DATA_ERROR:
+                  msg = "Data error in compressed datastream in %s chunk";
+                  break;
+               default:
+                  msg = "Incomplete compressed datastream in %s chunk";
+                  break;
+            }
+
+            png_snprintf(umsg, sizeof umsg, msg, png_ptr->chunk_name);
+            msg = umsg;
 #else
-	    msg = "Damaged compressed datastream in chunk other than IDAT";
+            msg = "Damaged compressed datastream in chunk other than IDAT";
 #endif
-	 }
+         }

         png_warning(png_ptr, msg);
      }
@@ -330,22 +332,20 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
   else if (comp_type == PNG_COMPRESSION_TYPE_BASE)
   {
      png_size_t expanded_size = png_inflate(png_ptr,
-		(png_bytep)(png_ptr->chunkdata + prefix_size),
+                (png_bytep)(png_ptr->chunkdata + prefix_size),
                chunklength - prefix_size,
-		0/*output*/, 0/*output size*/);
+                0/*output*/, 0/*output size*/);

      /* Now check the limits on this chunk - if the limit fails the
       * compressed data will be removed, the prefix will remain.
       */
-#ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
-      if (png_ptr->user_chunk_malloc_max &&
-          (prefix_size + expanded_size >= png_ptr->user_chunk_malloc_max - 1))
-#else
-#  ifdef PNG_USER_CHUNK_MALLOC_MAX
-      if ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
+      if (prefix_size >= (~(png_size_t)0) - 1 ||
+         expanded_size >= (~(png_size_t)0) - 1 - prefix_size
+#ifdef PNG_USER_CHUNK_MALLOC_MAX
+         || ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
          prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)
-#  endif
 #endif
+          )
         png_warning(png_ptr, "Exceeded size limit while expanding chunk");

      /* If the size is zero either there was an error and a message
@@ -353,48 +353,46 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
       * and we have nothing to do - the code will exit through the
       * error case below.
       */
-#if defined(PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED) || \
-    defined(PNG_USER_CHUNK_MALLOC_MAX)
-      else
-#endif
-      if (expanded_size > 0)
+      else if (expanded_size > 0)
      {
         /* Success (maybe) - really uncompress the chunk. */
-	 png_size_t new_size = 0;
-	 png_charp text = png_malloc_warn(png_ptr,
-			prefix_size + expanded_size + 1);
+         png_size_t new_size = 0;
+
+         png_charp text = png_malloc_warn(png_ptr,
+             prefix_size + expanded_size + 1);

         if (text != NULL)
         {
-	    png_memcpy(text, png_ptr->chunkdata, prefix_size);
-	    new_size = png_inflate(png_ptr,
+            png_memcpy(text, png_ptr->chunkdata, prefix_size);
+            new_size = png_inflate(png_ptr,
                (png_bytep)(png_ptr->chunkdata + prefix_size),
-		chunklength - prefix_size,
+                chunklength - prefix_size,
                (png_bytep)(text + prefix_size), expanded_size);
-	    text[prefix_size + expanded_size] = 0; /* just in case */
+            text[prefix_size + expanded_size] = 0; /* just in case */

-	    if (new_size == expanded_size)
-	    {
-	       png_free(png_ptr, png_ptr->chunkdata);
-	       png_ptr->chunkdata = text;
-	       *newlength = prefix_size + expanded_size;
-	       return; /* The success return! */
-	    }
-      
-	    png_warning(png_ptr, "png_inflate logic error");
-	    png_free(png_ptr, text);
-	 }
-	 else
+            if (new_size == expanded_size)
+            {
+               png_free(png_ptr, png_ptr->chunkdata);
+               png_ptr->chunkdata = text;
+               *newlength = prefix_size + expanded_size;
+               return; /* The success return! */
+            }
+
+            png_warning(png_ptr, "png_inflate logic error");
+            png_free(png_ptr, text);
+         }
+         else
          png_warning(png_ptr, "Not enough memory to decompress chunk.");
      }
   }

   else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */
   {
+#if defined(PNG_STDIO_SUPPORTED) && !defined(_WIN32_WCE)
      char umsg[50];

-#if defined(PNG_STDIO_SUPPORTED) && !defined(_WIN32_WCE)
-      png_snprintf(umsg, sizeof umsg, "Unknown zTXt compression type %d", comp_type);
+      png_snprintf(umsg, sizeof umsg, "Unknown zTXt compression type %d",
+          comp_type);
      png_warning(png_ptr, umsg);
 #else
      png_warning(png_ptr, "Unknown zTXt compression type");
@@ -411,13 +409,13 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
      png_charp text = png_malloc_warn(png_ptr, prefix_size + 1);
      if (text != NULL)
      {
-	 if (prefix_size > 0)
+         if (prefix_size > 0)
            png_memcpy(text, png_ptr->chunkdata, prefix_size);
-	 png_free(png_ptr, png_ptr->chunkdata);
-	 png_ptr->chunkdata = text;
+         png_free(png_ptr, png_ptr->chunkdata);
+         png_ptr->chunkdata = text;

-	 /* This is an extra zero in the 'uncompressed' part. */
-	 *(png_ptr->chunkdata + prefix_size) = 0x00;
+         /* This is an extra zero in the 'uncompressed' part. */
+         *(png_ptr->chunkdata + prefix_size) = 0x00;
      }
      /* Ignore a malloc error here - it is safe. */
   }
@@ -913,9 +911,11 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
               green_x, green_y, blue_x, blue_y);
 #else
            fprintf(stderr, "wx=%ld, wy=%ld, rx=%ld, ry=%ld\n",
-               int_x_white, int_y_white, int_x_red, int_y_red);
+               (long)int_x_white, (long)int_y_white,
+               (long)int_x_red, (long)int_y_red);
            fprintf(stderr, "gx=%ld, gy=%ld, bx=%ld, by=%ld\n",
-               int_x_green, int_y_green, int_x_blue, int_y_blue);
+               (long)int_x_green, (long)int_y_green,
+               (long)int_x_blue, (long)int_y_blue);
 #endif
 #endif /* PNG_CONSOLE_IO_SUPPORTED */
         }
@@ -1530,15 +1530,16 @@ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
      return;
   }

-   num = length / 2 ;
-   if (num != (unsigned int) png_ptr->num_palette || num >
-      (unsigned int) PNG_MAX_PALETTE_LENGTH)
+   if (length > 2*PNG_MAX_PALETTE_LENGTH ||
+       length != (unsigned int) (2*png_ptr->num_palette))
   {
      png_warning(png_ptr, "Incorrect hIST chunk length");
      png_crc_finish(png_ptr, length);
      return;
   }

+   num = length / 2 ;
+
   for (i = 0; i < num; i++)
   {
      png_byte buf[2];
@@ -1807,12 +1808,21 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
      return;
   }

+   /* Need unit type, width, \0, height: minimum 4 bytes */
+   else if (length < 4)
+   {
+      png_warning(png_ptr, "sCAL chunk too short");
+      png_crc_finish(png_ptr, length);
+      return;
+   }
+
   png_debug1(2, "Allocating and reading sCAL chunk data (%lu bytes)",
      length + 1);
   png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
   if (png_ptr->chunkdata == NULL)
   {
      png_warning(png_ptr, "Out of memory while processing sCAL chunk");
+      png_crc_finish(png_ptr, length);
      return;
   }
   slength = (png_size_t)length;
@@ -1834,6 +1844,8 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   if (*vp)
   {
      png_warning(png_ptr, "malformed width string in sCAL chunk");
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
      return;
   }
 #else
@@ -1842,21 +1854,22 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   if (swidth == NULL)
   {
      png_warning(png_ptr, "Out of memory while processing sCAL chunk width");
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
      return;
   }
-   png_memcpy(swidth, ep, (png_size_t)png_strlen(ep));
+   png_memcpy(swidth, ep, (png_size_t)png_strlen(ep) + 1);
 #endif
 #endif

-   for (ep = png_ptr->chunkdata; *ep; ep++)
+   for (ep = png_ptr->chunkdata + 1; *ep; ep++)
      /* Empty loop */ ;
   ep++;

   if (png_ptr->chunkdata + slength < ep)
   {
      png_warning(png_ptr, "Truncated sCAL chunk");
-#if defined(PNG_FIXED_POINT_SUPPORTED) && \
-    !defined(PNG_FLOATING_POINT_SUPPORTED)
+#if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
      png_free(png_ptr, swidth);
 #endif
      png_free(png_ptr, png_ptr->chunkdata);
@@ -1869,6 +1882,11 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   if (*vp)
   {
      png_warning(png_ptr, "malformed height string in sCAL chunk");
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
+#if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
+      png_free(png_ptr, swidth);
+#endif
      return;
   }
 #else
@@ -1877,9 +1895,14 @@ png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   if (sheight == NULL)
   {
      png_warning(png_ptr, "Out of memory while processing sCAL chunk height");
+      png_free(png_ptr, png_ptr->chunkdata);
+      png_ptr->chunkdata = NULL;
+#if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
+      png_free(png_ptr, swidth);
+#endif
      return;
   }
-   png_memcpy(sheight, ep, (png_size_t)png_strlen(ep));
+   png_memcpy(sheight, ep, (png_size_t)png_strlen(ep) + 1);
 #endif
 #endif

--- a/pngtest.c
+++ b/pngtest.c
@@ -1702,4 +1702,4 @@ main(int argc, char *argv[])
 }

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_2_44beta03 your_png_h_is_not_version_1_2_44beta03;
+typedef version_1_2_48beta01 your_png_h_is_not_version_1_2_48beta01;
--- a/pngwrite.c
+++ b/pngwrite.c
@@ -1,8 +1,8 @@

 /* pngwrite.c - general routines to write a PNG file
 *
- * Last changed in libpng 1.2.42 [January 3, 2010]
- * Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.45 [July 7, 2011]
+ * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -295,6 +295,7 @@ png_write_info(png_structp png_ptr, png_infop info_ptr)
         if (keep != PNG_HANDLE_CHUNK_NEVER &&
            up->location && (up->location & PNG_HAVE_PLTE) &&
            !(up->location & PNG_HAVE_IDAT) &&
+            !(up->location & PNG_AFTER_IDAT) &&
            ((up->name[3] & 0x20) || keep == PNG_HANDLE_CHUNK_ALWAYS ||
            (png_ptr->flags & PNG_FLAG_KEEP_UNSAFE_CHUNKS)))
         {
--- a/projects/visualc6/README.txt
+++ b/projects/visualc6/README.txt
@@ -4,13 +4,11 @@ Copyright (C) 2000-2004 Simon-Pierre Cadieux.
 Copyright (C) 2004 Cosmin Truta.
 For conditions of distribution and use, see copyright notice in png.h

-
 Assumptions:
 * The libpng source files are in ..\..
 * The zlib source files are in ..\..\..\zlib
 * The zlib project files are in ..\..\..\zlib\projects\visualc6

-
 To use:

 1) On the main menu, select "File | Open Workspace".
@@ -28,7 +26,6 @@ To use:
 5) If you built the sample program (pngtest),
   select "Build | Execute ... (Ctrl+F5)".

-
 This project builds the libpng binaries as follows:

 * Win32_DLL_Release\libpng13.dll      DLL build
@@ -41,7 +38,6 @@ This project builds the libpng binaries as follows:
 * Win32_LIB_ASM_Release\libpng.lib    static build using ASM code
 * Win32_LIB_ASM_Debug\libpngd.lib     static build using ASM (debug version)

-
 Notes:

 If you change anything in the source files, or select different compiler
--- a/projects/visualc71/README_zlib.txt
+++ b/projects/visualc71/README_zlib.txt
@@ -8,7 +8,6 @@ Copyright (C) 2004 Simon-Pierre Cadieux.
 Copyright (C) 2004 Cosmin Truta.
 For conditions of distribution and use, see copyright notice in zlib.h.

-
 To use:

 1) On the main menu, select "File | Open Solution".
--- a/projects/wince.txt
+++ b/projects/wince.txt
@@ -1,6 +1,6 @@
 A set of project files is available for WinCE.  Get
-libpng-1.2.44beta03-project-wince.zip from a libpng distribution
+libpng-1.2.48beta01-project-wince.zip from a libpng distribution
 site such as http://libpng.sourceforge.net/index.html

 Put the zip file in this directory (projects) and then run
-"unzip -a libpng-1.2.44beta03-project-wince.zip"
+"unzip -a libpng-1.2.48beta01-project-wince.zip"
--- a/projects/xcode/libpng.xcodeproj/project.pbxproj
+++ b/projects/xcode/libpng.xcodeproj/project.pbxproj
@@ -222,7 +222,7 @@
 				COPY_PHASE_STRIP = NO;
 				DYLIB_COMPATIBILITY_VERSION = 3;
 				DYLIB_CURRENT_VERSION = 3;
-				FRAMEWORK_VERSION = 1.2.44beta03;
+				FRAMEWORK_VERSION = 1.2.48beta01;
 				GCC_PRECOMPILE_PREFIX_HEADER = NO;
 				GCC_PREFIX_HEADER = "";
 				INFOPLIST_FILE = Info.plist;
@@ -240,7 +240,7 @@
 			buildSettings = {
 				DYLIB_COMPATIBILITY_VERSION = 3;
 				DYLIB_CURRENT_VERSION = 3;
-				FRAMEWORK_VERSION = 1.2.44beta03;
+				FRAMEWORK_VERSION = 1.2.48beta01;
 				GCC_PRECOMPILE_PREFIX_HEADER = NO;
 				GCC_PREFIX_HEADER = "";
 				INFOPLIST_FILE = Info.plist;
--- a/scripts/README.txt
+++ b/scripts/README.txt
@@ -1,8 +1,8 @@

-Makefiles for  libpng version 1.2.44beta03 - June 20, 2010
+Makefiles for  libpng version 1.2.48beta01 - February 27, 2012

 makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng12.so.0.1.2.44beta03)
+                       (gcc, creates libpng12.so.0.1.2.48beta01)
 makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
 makefile.knr      =>  Archaic UNIX Makefile that converts files with
                       ansi2knr (Requires ansi2knr.c from
@@ -20,7 +20,7 @@ Makefiles for  libpng version 1.2.44beta03 - June 20, 2010
 makefile.dec      =>  DEC Alpha UNIX makefile
 makefile.dj2      =>  DJGPP 2 makefile
 makefile.elf      =>  Linux/ELF makefile symbol versioning,
-                       gcc, creates libpng12.so.0.1.2.44beta03)
+                       gcc, creates libpng12.so.0.1.2.48beta01)
 makefile.freebsd  =>  FreeBSD makefile
 makefile.gcc      =>  Generic gcc makefile
 makefile.gccmmx   =>  Generic gcc makefile previously using MMX code
@@ -38,14 +38,14 @@ Makefiles for  libpng version 1.2.44beta03 - June 20, 2010
 makefile.os2      =>  OS/2 Makefile (gcc and emx, requires pngos2.def)
 makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
 makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng12.so.0.1.2.44beta03)
+                       creates libpng12.so.0.1.2.48beta01)
 makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
 makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng12.so.0.1.2.44beta03)
+                       creates libpng12.so.0.1.2.48beta01)
 makefile.solaris-x86  =>  Solaris 2.X makefile (gcc, no MMX code,
-                       creates libpng12.so.0.1.2.44beta03)
+                       creates libpng12.so.0.1.2.48beta01)
 makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng12.so.0.1.2.44beta03)
+                       creates libpng12.so.0.1.2.48beta01)
 makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
 makefile.sunos    =>  Sun makefile
 makefile.32sunu   =>  Sun Ultra 32-bit makefile
--- a/scripts/libpng-config-head.in
+++ b/scripts/libpng-config-head.in
@@ -11,7 +11,7 @@

 # Modeled after libxml-config.

-version=1.2.44beta03
+version=1.2.48beta01
 prefix=""
 libdir=""
 libs=""
--- a/scripts/libpng.pc.in
+++ b/scripts/libpng.pc.in
@@ -5,6 +5,6 @@ includedir=@includedir@/libpng12

 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.2.44beta03
+Version: 1.2.48beta01
 Libs: -L${libdir} -lpng12
 Cflags: -I${includedir}
--- a/scripts/makefile.32sunu
+++ b/scripts/makefile.32sunu
@@ -11,7 +11,7 @@
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.64sunu
+++ b/scripts/makefile.64sunu
@@ -11,7 +11,7 @@
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.aix
+++ b/scripts/makefile.aix
@@ -23,7 +23,7 @@ LN_SF = ln -f -s

 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 prefix=/usr/local
--- a/scripts/makefile.beos
+++ b/scripts/makefile.beos
@@ -11,7 +11,7 @@
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.cegcc
+++ b/scripts/makefile.cegcc
@@ -23,7 +23,7 @@

 VERMAJ = 1
 VERMIN = 2
-VERMIC = 44
+VERMIC = 48
 VER = $(VERMAJ).$(VERMIN).$(VERMIC)
 NAME = libpng
 PACKAGE = $(NAME)-$(VER)
--- a/scripts/makefile.cygwin
+++ b/scripts/makefile.cygwin
@@ -77,7 +77,7 @@ CFLAGS= $(strip $(MINGW_CCFLAGS) $(addprefix -I,$(ZLIBINC)) \
 LIBNAME = libpng12
 PNGMAJ = 0
 CYGDLL = 12
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 SHAREDLIB=cygpng$(CYGDLL).dll
--- a/scripts/makefile.darwin
+++ b/scripts/makefile.darwin
@@ -22,7 +22,7 @@ ZLIBINC=../zlib
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 12
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.dec
+++ b/scripts/makefile.dec
@@ -8,7 +8,7 @@

 # Library name:
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)
 LIBNAME = libpng12

--- a/scripts/makefile.elf
+++ b/scripts/makefile.elf
@@ -16,7 +16,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.gcmmx
+++ b/scripts/makefile.gcmmx
@@ -17,7 +17,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.hp64
+++ b/scripts/makefile.hp64
@@ -21,7 +21,7 @@ ZLIBINC=/opt/zlib/include
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.hpgcc
+++ b/scripts/makefile.hpgcc
@@ -11,7 +11,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.hpux
+++ b/scripts/makefile.hpux
@@ -21,7 +21,7 @@ ZLIBINC=/opt/zlib/include
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.linux
+++ b/scripts/makefile.linux
@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.mingw
+++ b/scripts/makefile.mingw
@@ -81,7 +81,7 @@ CFLAGS= $(strip $(MINGW_CCFLAGS) $(addprefix -I,$(ZLIBINC)) \
 LIBNAME = libpng12
 PNGMAJ = 0
 MINGDLL = 12
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 SHAREDLIB=libpng$(MINGDLL).dll
--- a/scripts/makefile.ne12bsd
+++ b/scripts/makefile.ne12bsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng12

 LIB=	png12
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.2.44beta03
+SHLIB_MINOR=	1.2.48beta01
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.netbsd
+++ b/scripts/makefile.netbsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include

 LIB=	png
 SHLIB_MAJOR=	3
-SHLIB_MINOR=	1.2.44beta03
+SHLIB_MINOR=	1.2.48beta01
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.nommx
+++ b/scripts/makefile.nommx
@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.openbsd
+++ b/scripts/makefile.openbsd
@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat

 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.2.44beta03
+SHLIB_MINOR=	1.2.48beta01

 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
--- a/scripts/makefile.sco
+++ b/scripts/makefile.sco
@@ -12,7 +12,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.sggcc
+++ b/scripts/makefile.sggcc
@@ -9,7 +9,7 @@
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.sgi
+++ b/scripts/makefile.sgi
@@ -9,7 +9,7 @@
 # Library name:
 LIBNAME=libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.so9
+++ b/scripts/makefile.so9
@@ -11,7 +11,7 @@

 # Library name:
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)
 LIBNAME = libpng12

--- a/scripts/makefile.solaris
+++ b/scripts/makefile.solaris
@@ -11,7 +11,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/makefile.solaris-x86
+++ b/scripts/makefile.solaris-x86
@@ -11,7 +11,7 @@
 # Library name:
 LIBNAME = libpng12
 PNGMAJ = 0
-PNGMIN = 1.2.44beta03
+PNGMIN = 1.2.48beta01
 PNGVER = $(PNGMAJ).$(PNGMIN)

 # Shared library names:
--- a/scripts/png32ce.def
+++ b/scripts/png32ce.def
@@ -5,7 +5,7 @@
 LIBRARY lpngce

 EXPORTS
-;Version 1.2.44beta03
+;Version 1.2.48beta01
  png_build_grayscale_palette  @1
  png_check_sig        @2
  png_chunk_error      @3
--- a/scripts/pngos2.def
+++ b/scripts/pngos2.def
@@ -2,7 +2,7 @@
 ; PNG.LIB module definition file for OS/2
 ;----------------------------------------

-; Version 1.2.44beta03
+; Version 1.2.48beta01

 LIBRARY		PNG
 DESCRIPTION	"PNG image compression library for OS/2"
--- a/scripts/pngw32.def
+++ b/scripts/pngw32.def
@@ -5,7 +5,7 @@
 LIBRARY

 EXPORTS
-;Version 1.2.44beta03
+;Version 1.2.48beta01
  png_build_grayscale_palette  @1
  png_check_sig        @2
  png_chunk_error      @3
Author	SHA1	Message	Date
Glenn Randers-Pehrson	adbe2c7637	[libpng12] Imported from libpng-1.2.48beta01.tar	2012-02-26 22:04:24 -06:00
Glenn Randers-Pehrson	d0bd02c4ca	[libpng12] Fixed off-by-one bug in png_handle_sCAL() when using fixed point arithmetic, causing out-of-bounds read in png_set_sCAL() because of failure to copy the string terminators (Franke Busse).	2012-02-26 20:42:28 -06:00
Glenn Randers-Pehrson	440e3a9803	[libpng12] Fixed bug with png_handle_hIST with odd chunk length (Frank Busse).	2012-02-22 07:03:52 -06:00
Glenn Randers-Pehrson	660178760e	[libpng12] Eliminated redundant png_push_read_tEXt\|zTXt\|iTXt\|unknown code from pngpread.c and use the sequential png_handle_tEXt, etc., in pngrutil.c; now that png_ptr->buffer is inaccessible to applications, the special handling is no longer useful.	2012-02-22 07:02:38 -06:00
Glenn Randers-Pehrson	cba5be8307	[libpng12] Removed two useless #ifdef directives from pngread.c and one from pngrutil.c	2012-02-19 22:04:56 -06:00
Glenn Randers-Pehrson	e0a2c956be	[libpng12] Bump version to 1.2.48beta01	2012-02-19 21:37:11 -06:00
Glenn Randers-Pehrson	4ae1de1114	[libpng12] Imported from libpng-1.2.47.tar	2012-02-18 23:49:33 -06:00
Glenn Randers-Pehrson	e0e4104db4	[libpng12] Imported from libpng-1.2.47rc01.tar	2012-02-18 23:49:30 -06:00
Glenn Randers-Pehrson	ccb23d998d	[legacy] Deleted some extra blank lines from visualc6 and 71 README files.	2011-09-03 07:27:24 -05:00
Glenn Randers-Pehrson	808100b1a7	[legacy] Reverted non-portable GNU syntax in makefile (?=, +=)	2011-07-12 06:28:57 -05:00
Glenn Randers-Pehrson	eeb8f748aa	[legacy] Updated contrib/pngminus/makefile.std	2011-07-11 18:03:45 -05:00
Glenn Randers-Pehrson	79a5af9263	[legacy] Bump version to libpng-1.2.47beta01	2011-07-10 06:44:40 -05:00
Glenn Randers-Pehrson	e74d595ab4	[legacy] Updated ANNOUNCE	2011-07-10 06:39:27 -05:00
Glenn Randers-Pehrson	f3e8a339e9	[legacy] Imported from libpng-1.2.46.tar	2011-07-09 05:47:26 -05:00
Glenn Randers-Pehrson	3c934137f6	[legacy] Imported from libpng-1.2.46rc02.tar	2011-07-08 18:38:48 -05:00
Glenn Randers-Pehrson	b973ab0914	[legacy] Imported from libpng-1.2.46rc01.tar	2011-07-08 07:11:36 -05:00
Glenn Randers-Pehrson	3341f519f4	[legacy] Imported from libpng-1.2.45.tar	2011-07-07 06:56:45 -05:00
Glenn Randers-Pehrson	4a60a94909	[legacy] Updated KNOWNBUG file.	2011-06-30 20:23:23 -05:00
Glenn Randers-Pehrson	91a1807332	[legacy] Imported from libpng-1.2.45rc01.tar	2011-06-30 20:10:54 -05:00
Glenn Randers-Pehrson	e7fd349fd6	[legacy] Imported from libpng-1.2.45beta03.tar	2011-06-19 07:38:14 -05:00
Glenn Randers-Pehrson	e411c66e38	[legacy] Check for sCAL chunk too short.	2011-06-18 14:54:22 -05:00
Glenn Randers-Pehrson	98bdf7d5bb	[legacy] Imported from libpng-1.2.45beta03.tar	2011-06-07 19:49:24 -05:00
Glenn Randers-Pehrson	a03d7f9949	[legacy] Imported from libpng-1.2.45beta02.tar	2011-06-07 15:57:50 -05:00
Glenn Randers-Pehrson	d572394c2a	[legacy] Check for integer overflow in png_set_rgb_to_gray().	2011-06-07 15:56:02 -05:00
Glenn Randers-Pehrson	1df0788b64	[legacy] Imported from libpng-1.2.45beta01.tar	2011-06-07 15:39:19 -05:00
Glenn Randers-Pehrson	1883ec49dd	[legacy] Ported bugfix in pngrtran.c from 1.5.3: when expanding a paletted image, always expand to RGBA if transparency is present.	2011-06-07 15:36:54 -05:00
Glenn Randers-Pehrson	d13542a3ee	[legacy] Check for up->location !PNG_AFTER_IDAT when writing unknown chunks before IDAT.	2011-06-07 15:35:48 -05:00
Glenn Randers-Pehrson	950f965bca	[legacy] Fixed 1-byte uninitialized memory reference in png_format_buffer() (Bug report by Frank Busse, related to CVE-2004-0421). Pass "" instead of '\0' to png_default_error() in png_err(). This mistake was introduced in libpng-1.2.20beta01.	2011-06-07 15:17:35 -05:00
Glenn Randers-Pehrson	7bda306764	[legacy] Tag the recent releases.	2010-06-25 20:45:51 -05:00
Glenn Randers-Pehrson	72c637ec63	[legacy] Imported from libpng-1.2.44.tar	2010-06-25 20:28:26 -05:00
Glenn Randers-Pehrson	303d2490a3	[legacy] Imported from libpng-1.2.44rc03.tar	2010-06-25 20:27:51 -05:00
Glenn Randers-Pehrson	47c6e47d1f	[legacy] Imported from libpng-1.2.44rc02.tar	2010-06-25 20:27:48 -05:00
Glenn Randers-Pehrson	009516860a	[legacy] Imported from libpng-1.2.44rc01.tar	2010-06-25 20:27:45 -05:00