[libpng14] Imported from libpng-1.4.21.tar

png_check_chunk_name() and png_check_chunk_length() functions
(Suggested by Max Stepin).

ANNOUNCE

@@ -1,35 +1,34 @@
 
-Libpng 1.4.18beta01 - November 20, 2015
+Libpng 1.4.21 - August 24, 2017
 
-This is not intended to be a public release.  It will be replaced
-within a few weeks by a public version or by another test version.
+This is a public release of libpng, intended for use in production codes.
 
 Files available for download:
 
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script
 
-   1.4.18beta01.tar.xz (LZMA-compressed, recommended)
-   1.4.18beta01.tar.gz
-   1.4.18beta01.tar.bz2
+   libpng-1.4.21.tar.xz (LZMA-compressed, recommended)
+   libpng-1.4.21.tar.gz
 
 Source files with CRLF line endings (for Windows), without the
 "configure" script
 
-   lp1418b01.7z (LZMA-compressed, recommended)
-   lp1418b01.zip
+   lpng1421.7z (LZMA-compressed, recommended)
+   lpng1421.zip
 
 Other information:
 
-   1.4.18beta01-README.txt
-   1.4.18beta01-LICENSE.txt
-   libpng-1.4.18beta01-*.asc (armored detached GPG signatures)
+   libpng-1.4.21-README.txt
+   libpng-1.4.21-LICENSE.txt
+   libpng-1.4.21-*.asc (armored detached GPG signatures)
 
-Changes since the last public release (1.4.17):
-
-version 1.4.18beta01 [%RDATE%]
-  Avoid potential pointer overflow in png_handle_iTXt(), png_handle_zTXt(),
-    png_handle_sPLT(), and png_handle_pCAL() (Bug report by John Regehr).
+Changes since the last public release (1.4.20):
+  Moved chunk-name and chunk-length checks into PNG_EXTERN private
+    png_check_chunk_name() and png_check_chunk_length() functions
+    (Suggested by Max Stepin).
+  Check for 0 return from png_get_rowbytes() in contrib/pngminus/*.c to stop
+    some Coverity issues (162705, 162706, and 162707).
 
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit

CHANGES

@@ -2916,7 +2916,8 @@ version 1.4.13 [February 6, 2014]
   No changes.
 
 version 1.4.14beta01 [November 6, 2014]
-  Avoid out-of-bounds memory access in png_user_version_check().
+  Fixed an out-of-range read in png_version_check() (Bug report from
+    Qixue Xiao, CVE-2015-8540).
   Simplified and future-proofed png_user_version_check().
 
 version 1.4.14rc01 [November 13, 2014]
@@ -3011,6 +3012,49 @@ version 1.4.18beta01 [November 20, 2015]
   Avoid potential pointer overflow in png_handle_iTXt(), png_handle_zTXt(),
     png_handle_sPLT(), and png_handle_pCAL() (Bug report by John Regehr).
 
+version 1.4.18beta02 [November 23, 2015]
+  Fixed incorrect implementation of png_set_PLTE() that uses png_ptr
+    not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126
+    vulnerability.  Fixes CVE-2015-8472.
+
+version 1.4.18rc01 [November 26, 2015]
+  Discontinued distributing tar.bz2 archives.
+
+version 1.4.18 [December 3, 2015]
+  Discontinued distributing libpng-oldversion-newversion-diff.txt
+
+version 1.4.19beta01 [December 11, 2015]
+  Fixed an out-of-range read in png_check_keyword() (Bug report from
+    Qixue Xiao, CVE-2015-8540).
+
+version 1.4.19rc01 [December 14, 2015]
+  Corrected copyright dates in source files.
+  Moved png_check_keyword() from pngwutil.c to pngset.c
+
+version 1.4.19 [December 17, 2015]
+  No changes.
+
+version 1.4.20rc01 [December 27, 2016]
+  Fix typos in libpng.3 synopses (Eric S. Raymond).
+  Fixed undefined behavior in png_push_save_buffer(). Do not call
+    memcpy() with a null source, even if count is zero (Leon Scroggins III).
+
+version 1.4.20 [December 29, 2016]
+  Fixed a potential null pointer dereference in png_set_text_2() (bug report
+    and patch by Patrick Keshishian, CVE-2016-10087).
+
+version 1.4.21beta [August 9, 2017]
+  Moved chunk-name and chunk-length checks into PNG_EXTERN private
+    png_check_chunk_name() and png_check_chunk_length() functions
+    (Suggested by Max Stepin).
+
+version 1.4.21rc01 [August 19, 2017]
+  Check for 0 return from png_get_rowbytes() in contrib/pngminus/*.c to stop
+    some Coverity issues (162705, 162706, and 162707).
+
+version 1.4.21 [August 24, 2017]
+  No changes.
+
 Send comments/corrections/commendations to glennrp at users.sourceforge.net
 or to png-mng-implement at lists.sf.net (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement).

CMakeLists.txt

@@ -33,7 +33,7 @@ enable_testing()
 
 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 4)
-set(PNGLIB_RELEASE 18)
+set(PNGLIB_RELEASE 21)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})
 
@@ -255,7 +255,7 @@ install(CODE ${PNG_CONFIG_INSTALL_CODE})
 # SET UP LINKS
 if(PNG_SHARED)
   set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 14.${PNGLIB_RELEASE}.1.4.18beta01
+#   VERSION 14.${PNGLIB_RELEASE}.1.4.21
     VERSION 14.${PNGLIB_RELEASE}.0
     SOVERSION 14
     CLEAN_DIRECT_OUTPUT 1)

INSTALL

@@ -1,5 +1,5 @@
 
-Installing libpng version 1.4.18beta01 - November 20, 2015
+Installing libpng version 1.4.21 - August 24, 2017
 
 On Unix/Linux and similar systems, you can simply type
 
@@ -46,7 +46,7 @@ to have access to the zlib.h and zconf.h include files that
 correspond to the version of zlib that's installed.
 
 You can rename the directories that you downloaded (they
-might be called "libpng-1.4.18beta01" or "libpng14" and "zlib-1.2.3"
+might be called "libpng-1.4.21" or "libpng14" and "zlib-1.2.3"
 or "zlib123") so that you have directories called "zlib" and "libpng".
 
 Your directory structure should look like this:

LICENSE

@@ -10,8 +10,8 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.0.7, July 1, 2000, through 1.4.18beta01, November 20, 2015, are
-Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
+libpng versions 1.0.7, July 1, 2000, through 1.4.21, August 24, 2017, are
+Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
 added to the list of Contributing Authors:
@@ -107,4 +107,4 @@ the additional disclaimers inserted at version 1.0.7.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 20, 2015
+August 24, 2017

Makefile.am

@@ -79,7 +79,7 @@ EXTRA_DIST= \
 	${srcdir}/contrib/pngsuite/* \
 	${srcdir}/contrib/visupng/* \
 	$(TESTS) \
-	example.c libpng-1.4.18beta01.txt
+	example.c libpng-1.4.21.txt
 
 CLEANFILES= pngout.png libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@-config libpng.vers \
 libpng.sym

Makefile.in

@@ -628,7 +628,7 @@ EXTRA_DIST = \
 	${srcdir}/contrib/pngsuite/* \
 	${srcdir}/contrib/visupng/* \
 	$(TESTS) \
-	example.c libpng-1.4.18beta01.txt
+	example.c libpng-1.4.21.txt
 
 CLEANFILES = pngout.png libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@-config libpng.vers \
 libpng.sym

README

@@ -1,11 +1,11 @@
-README for libpng version 1.4.18beta01 - November 20, 2015 (shared library 14.0)
+README for libpng version 1.4.21 - August 24, 2017 (shared library 14.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
 
-Libpng comes in several distribution formats.  Get libpng-*.tar.gz,
-libpng-*.tar.xz or libpng-*.tar.bz2 if you want UNIX-style line endings
-in the text files, or lpng*.zip if you want DOS-style line endings.
+Libpng comes in several distribution formats.  Get libpng-*.tar.gz or
+libpng-*.tar.xz if you want UNIX-style line endings in the text files,
+or lpng*.zip if you want DOS-style line endings.
 
 Version 0.89 was the first official release of libpng.  Don't let the
 fact that it's the first release fool you.  The libpng library has been in
@@ -187,9 +187,9 @@ Files in this distribution:
        makefile.std     =>  Generic UNIX makefile (cc, creates static
                             libpng.a)
        makefile.elf     =>  Linux/ELF makefile symbol versioning,
-                            (gcc, creates libpng14.so.14.1.4.18beta01)
+                            (gcc, creates libpng14.so.14.1.4.21)
        makefile.linux   =>  Linux/ELF makefile
-                            (gcc, creates libpng14.so.14.1.4.18beta01)
+                            (gcc, creates libpng14.so.14.1.4.21)
        makefile.gcc     =>  Generic makefile (gcc, creates static libpng.a)
        makefile.knr     =>  Archaic UNIX Makefile that converts files with
                             ansi2knr (Requires ansi2knr.c from
@@ -211,12 +211,12 @@ Files in this distribution:
        makefile.openbsd =>  OpenBSD makefile
        makefile.sgi     =>  Silicon Graphics IRIX (cc, creates static lib)
        makefile.sggcc   =>  Silicon Graphics
-                            (gcc, creates libpng14.so.14.1.4.18beta01)
+                            (gcc, creates libpng14.so.14.1.4.21)
        makefile.sunos   =>  Sun makefile
        makefile.solaris =>  Solaris 2.X makefile
-                            (gcc, creates libpng14.so.14.1.4.18beta01)
+                            (gcc, creates libpng14.so.14.1.4.21)
        makefile.so9     =>  Solaris 9 makefile
-                            (gcc, creates libpng14.so.14.1.4.18beta01)
+                            (gcc, creates libpng14.so.14.1.4.21)
        makefile.32sunu  =>  Sun Ultra 32-bit makefile
        makefile.64sunu  =>  Sun Ultra 64-bit makefile
        makefile.sco     =>  For SCO OSr5  ELF and Unixware 7 with Native cc

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for libpng 1.4.18beta01.
+# Generated by GNU Autoconf 2.69 for libpng 1.4.21.
 #
 # Report bugs to <png-mng-implement@lists.sourceforge.net>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libpng'
 PACKAGE_TARNAME='libpng'
-PACKAGE_VERSION='1.4.18beta01'
-PACKAGE_STRING='libpng 1.4.18beta01'
+PACKAGE_VERSION='1.4.21'
+PACKAGE_STRING='libpng 1.4.21'
 PACKAGE_BUGREPORT='png-mng-implement@lists.sourceforge.net'
 PACKAGE_URL=''
 
@@ -1333,7 +1333,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures libpng 1.4.18beta01 to adapt to many kinds of systems.
+\`configure' configures libpng 1.4.21 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1403,7 +1403,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libpng 1.4.18beta01:";;
+     short | recursive ) echo "Configuration of libpng 1.4.21:";;
    esac
   cat <<\_ACEOF
 
@@ -1520,7 +1520,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libpng configure 1.4.18beta01
+libpng configure 1.4.21
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1943,7 +1943,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libpng $as_me 1.4.18beta01, which was
+It was created by libpng $as_me 1.4.21, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2806,7 +2806,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='libpng'
- VERSION='1.4.18beta01'
+ VERSION='1.4.21'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -2923,10 +2923,10 @@ fi
 
 
 
-PNGLIB_VERSION=1.4.18beta01
+PNGLIB_VERSION=1.4.21
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=4
-PNGLIB_RELEASE=18
+PNGLIB_RELEASE=21
 
 
 
@@ -13615,7 +13615,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libpng $as_me 1.4.18beta01, which was
+This file was extended by libpng $as_me 1.4.21, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -13681,7 +13681,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-libpng config.status 1.4.18beta01
+libpng config.status 1.4.21
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -16,17 +16,17 @@ dnl should not be necessary to regenerate configure if the time
 dnl stamps are correct
 AC_PREREQ(2.59)
 
-AC_INIT([libpng], [1.4.18beta01], [png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng], [1.4.21], [png-mng-implement@lists.sourceforge.net])
 AM_INIT_AUTOMAKE
 dnl stop configure from automagically running automake
 AM_MAINTAINER_MODE
 
 dnl Version number stuff here:
 
-PNGLIB_VERSION=1.4.18beta01
+PNGLIB_VERSION=1.4.21
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=4
-PNGLIB_RELEASE=18
+PNGLIB_RELEASE=21
 
 dnl End of version number stuff
 

contrib/gregbook/rpng-x.c

@@ -252,8 +252,8 @@ int main(int argc, char **argv)
             else {
                 bgstr = *argv;
                 if (strlen(bgstr) != 7 || bgstr[0] != '#')
-                    ++error; 
-                else 
+                    ++error;
+                else
                     have_bg = TRUE;
             }
         } else {

contrib/gregbook/rpng2-x.c

@@ -496,12 +496,12 @@ int main(int argc, char **argv)
           "\t\t  transparent images; overrides -bgcolor\n",
           num_bgpat-1);
 #ifdef FEATURE_LOOP
-        fprintf(stderr, 
+        fprintf(stderr,
           "    -loop\tloops through background images after initial display\n"
           "\t\t  is complete (depends on -bgpat)\n"
           "    sec \tseconds to display each background image (default = 2)\n");
 #endif
-        fprintf(stderr, 
+        fprintf(stderr,
           "    dur \tduration in microseconds to wait after displaying each\n"
           "\t\t  row (for demo purposes)\n"
           "    -timing\tenables delay for every block read, to simulate modem\n"

contrib/pngminus/png2pnm.c

@@ -1,8 +1,11 @@
 /*
  *  png2pnm.c --- conversion from PNG-file to PGM/PPM-file
- *  copyright (C) 1999 by Willem van Schaik <willem@schaik.com>
+ *  copyright (C) 1999,2017 by Willem van Schaik <willem at schaik.com>
  *
  *  version 1.0 - 1999.10.15 - First version.
+ *          1.1 - 2017.04.22 - Add buffer-size check (Glenn Randers-Pehrson)
+ *          1.2 - 2017.08.24 - Fix potential overflow in buffer-size check
+                               (Glenn Randers-Pehrson)
  *
  *  Permission to use, copy, modify, and distribute this software and
  *  its documentation for any purpose and without fee is hereby granted,
@@ -18,6 +21,7 @@
 #include <mem.h>
 #include <fcntl.h>
 #endif
+#include <zlib.h>
 
 #ifndef BOOL
 #define BOOL unsigned char
@@ -51,7 +55,8 @@
 
 int  main (int argc, char *argv[]);
 void usage ();
-BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL alpha);
+BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw,
+   BOOL alpha);
 
 /*
  *  main
@@ -84,7 +89,8 @@ int main(int argc, char *argv[])
           if ((fp_al = fopen (argv[argi], "wb")) == NULL)
           {
             fprintf (stderr, "PNM2PNG\n");
-            fprintf (stderr, "Error:  can not create alpha-channel file %s\n", argv[argi]);
+            fprintf (stderr, "Error:  can not create alpha-channel file %s\n",
+               argv[argi]);
             exit (1);
           }
           break;
@@ -144,7 +150,7 @@ int main(int argc, char *argv[])
   if (png2pnm (fp_rd, fp_wr, fp_al, raw, alpha) == FALSE)
   {
     fprintf (stderr, "PNG2PNM\n");
-    fprintf (stderr, "Error:  unsuccessful convertion of PNG-image\n");
+    fprintf (stderr, "Error:  unsuccessful conversion of PNG-image\n");
     exit(1);
   }
 
@@ -175,9 +181,11 @@ void usage()
   fprintf (stderr, "Usage:  png2pnm [options] <file>.png [<file>.pnm]\n");
   fprintf (stderr, "   or:  ... | png2pnm [options]\n");
   fprintf (stderr, "Options:\n");
-  fprintf (stderr, "   -r[aw]   write pnm-file in binary format (P4/P5/P6) (default)\n");
+  fprintf (stderr,
+     "   -r[aw]   write pnm-file in binary format (P4/P5/P6) (default)\n");
   fprintf (stderr, "   -n[oraw] write pnm-file in ascii format (P1/P2/P3)\n");
-  fprintf (stderr, "   -a[lpha] <file>.pgm write PNG alpha channel as pgm-file\n");
+  fprintf (stderr,
+     "   -a[lpha] <file>.pgm write PNG alpha channel as pgm-file\n");
   fprintf (stderr, "   -h | -?  print this help-information\n");
 }
 
@@ -185,10 +193,11 @@ void usage()
  *  png2pnm
  */
 
-BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL alpha)
+BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file,
+    volatile BOOL raw, BOOL alpha)
 {
   png_struct    *png_ptr = NULL;
-  png_info	*info_ptr = NULL;
+  png_info        *info_ptr = NULL;
   png_byte      buf[8];
   png_byte      *png_pixels = NULL;
   png_byte      **row_pointers = NULL;
@@ -217,7 +226,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
 
   /* create png and info structures */
 
-  png_ptr = png_create_read_struct (PNG_LIBPNG_VER_STRING,
+  png_ptr = png_create_read_struct (png_get_libpng_ver(NULL),
     NULL, NULL, NULL);
   if (!png_ptr)
     return FALSE;   /* out of memory */
@@ -260,7 +269,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
     png_set_expand (png_ptr);
 
 #ifdef NJET
-  /* downgrade 16-bit images to 8 bit */
+  /* downgrade 16-bit images to 8-bit */
   if (bit_depth == 16)
     png_set_strip_16 (png_ptr);
   /* transform grayscale images into full-color */
@@ -314,12 +323,21 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
   /* row_bytes is the width x number of channels x (bit-depth / 8) */
   row_bytes = png_get_rowbytes (png_ptr, info_ptr);
 
-  if ((png_pixels = (png_byte *) malloc (row_bytes * height * sizeof (png_byte))) == NULL) {
+  if ((row_bytes == 0 || (size_t)height > ((size_t)(-1))/(size_t)row_bytes))
+  {
+    /* too big */ 
+    png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
+    return FALSE;
+  }
+  if ((png_pixels = (png_byte *)
+     malloc ((size_t)row_bytes * (size_t)height * sizeof (png_byte))) == NULL)
+  {
     png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
     return FALSE;
   }
 
-  if ((row_pointers = (png_byte **) malloc (height * sizeof (png_bytep))) == NULL)
+  if ((row_pointers = (png_byte **)
+     malloc ((size_t)height * sizeof (png_bytep))) == NULL)
   {
     png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
     free (png_pixels);
@@ -328,7 +346,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
   }
 
   /* set the individual row_pointers to point at the correct offsets */
-  for (i = 0; i < (height); i++)
+  for (i = 0; i < ((int) height); i++)
     row_pointers[i] = png_pixels + i * row_bytes;
 
   /* now we can go ahead and just read the whole image */
@@ -371,9 +389,9 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
   /* write data to PNM file */
   pix_ptr = png_pixels;
 
-  for (row = 0; row < height; row++)
+  for (row = 0; row < (int) height; row++)
   {
-    for (col = 0; col < width; col++)
+    for (col = 0; col < (int) width; col++)
     {
       for (i = 0; i < (channels - alpha_present); i++)
       {
@@ -381,7 +399,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
           fputc ((int) *pix_ptr++ , pnm_file);
         else
           if (bit_depth == 16){
-	    dep_16 = (long) *pix_ptr++;
+            dep_16 = (long) *pix_ptr++;
             fprintf (pnm_file, "%ld ", (dep_16 << 8) + ((long) *pix_ptr++));
           }
           else
@@ -400,10 +418,11 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
           if (raw)
             fputc ((int) *pix_ptr++ , alpha_file);
           else
-            if (bit_depth == 16){
-	      dep_16 = (long) *pix_ptr++;
+            if (bit_depth == 16)
+            {
+              dep_16 = (long) *pix_ptr++;
               fprintf (alpha_file, "%ld ", (dep_16 << 8) + (long) *pix_ptr++);
-	    }  
+            }
             else
               fprintf (alpha_file, "%ld ", (long) *pix_ptr++);
         }
@@ -424,6 +443,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file, BOOL raw, BOOL a
   if (png_pixels != (unsigned char*) NULL)
     free (png_pixels);
 
+  PNG_UNUSED(raw) /* to quiet a Coverity defect */
   return TRUE;
 
 } /* end of source */

contrib/pngminus/pnm2png.c

@@ -1,9 +1,12 @@
 /*
  *  pnm2png.c --- conversion from PBM/PGM/PPM-file to PNG-file
- *  copyright (C) 1999 by Willem van Schaik <willem@schaik.com>
+ *  copyright (C) 1999,2015,2017 by Willem van Schaik <willem at schaik.com>
  *
  *  version 1.0 - 1999.10.15 - First version.
  *  version 1.1 - 2015.07.29 - Fixed leaks (Glenn Randers-Pehrson)
+ *  version 1.2 - 2017.04.22 - Add buffer-size check
+ *          1.3 - 2017.08.24 - Fix potential overflow in buffer-size check
+ *                             (Glenn Randers-Pehrson)
  *
  *  Permission to use, copy, modify, and distribute this software and
  *  its documentation for any purpose and without fee is hereby granted,
@@ -370,9 +373,14 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
     row_bytes = (width * channels * bit_depth + 7) / 8;
   else
 #endif
-    /* row_bytes is the width x number of channels x (bit-depth / 8) */
+  /* row_bytes is the width x number of channels x (bit-depth / 8) */
     row_bytes = width * channels * ((bit_depth <= 8) ? 1 : 2);
 
+  if ((row_bytes == 0 || (size_t)height > ((size_t)(-1))/(size_t)row_bytes)
+  {
+    /* too big */ 
+    return FALSE;
+  }
   if ((png_pixels = (png_byte *)
      malloc (row_bytes * height * sizeof (png_byte))) == NULL)
     return FALSE;
@@ -383,7 +391,8 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
   for (row = 0; row < (int) height; row++)
   {
 #if defined(PNG_WRITE_INVERT_SUPPORTED) || defined(PNG_WRITE_PACK_SUPPORTED)
-    if (packed_bitmap) {
+    if (packed_bitmap)
+    {
       for (i = 0; i < (int) row_bytes; i++)
         /* png supports this format natively so no conversion is needed */
         *pix_ptr++ = get_data (pnm_file, 8);
@@ -504,6 +513,8 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
   if (png_pixels != (unsigned char*) NULL)
     free (png_pixels);
 
+  PNG_UNUSED(raw) /* Quiet a Coverity defect */
+
   return TRUE;
 } /* end of pnm2png */
 
@@ -520,7 +531,8 @@ void get_token(FILE *pnm_file, char *token)
   do
   {
     ret = fgetc(pnm_file);
-    if (ret == '#') {
+    if (ret == '#')
+    {
       /* the rest of this line is a comment */
       do
       {

contrib/visupng/PngFile.c

@@ -152,29 +152,29 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData,
 
     Try
     {
-        
+
         // initialize the png structure
-        
+
 #ifdef PNG_STDIO_SUPPORTED
         png_init_io(png_ptr, pfFile);
 #else
         png_set_read_fn(png_ptr, (png_voidp)pfFile, png_read_data);
 #endif
-        
+
         png_set_sig_bytes(png_ptr, 8);
-        
+
         // read all PNG info up to image data
-        
+
         png_read_info(png_ptr, info_ptr);
-        
+
         // get width, height, bit-depth and color-type
-        
+
         png_get_IHDR(png_ptr, info_ptr, piWidth, piHeight, &iBitDepth,
             &iColorType, NULL, NULL, NULL);
-        
+
         // expand images of all color-type and bit-depth to 3x8 bit RGB images
         // let the library process things like alpha, transparency, background
-        
+
         if (iBitDepth == 16)
             png_set_strip_16(png_ptr);
         if (iColorType == PNG_COLOR_TYPE_PALETTE)
@@ -186,7 +186,7 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData,
         if (iColorType == PNG_COLOR_TYPE_GRAY ||
             iColorType == PNG_COLOR_TYPE_GRAY_ALPHA)
             png_set_gray_to_rgb(png_ptr);
-        
+
         // set the background color to draw transparent and alpha images over.
         if (png_get_bKGD(png_ptr, info_ptr, &pBackground))
         {
@@ -199,30 +199,30 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData,
         {
             pBkgColor = NULL;
         }
-        
+
         // if required set gamma conversion
         if (png_get_gAMA(png_ptr, info_ptr, &dGamma))
             png_set_gamma(png_ptr, (double) 2.2, dGamma);
-        
+
         // after the transformations have been registered update info_ptr data
-        
+
         png_read_update_info(png_ptr, info_ptr);
-        
+
         // get again width, height and the new bit-depth and color-type
-        
+
         png_get_IHDR(png_ptr, info_ptr, piWidth, piHeight, &iBitDepth,
             &iColorType, NULL, NULL, NULL);
-        
-        
+
+
         // row_bytes is the width x number of channels
-        
+
         ulRowBytes = png_get_rowbytes(png_ptr, info_ptr);
         ulChannels = png_get_channels(png_ptr, info_ptr);
-        
+
         *piChannels = ulChannels;
-        
+
         // now we can allocate memory to store the image
-        
+
         if (pbImageData)
         {
             free (pbImageData);
@@ -234,33 +234,33 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData,
             png_error(png_ptr, "Visual PNG: out of memory");
         }
         *ppbImageData = pbImageData;
-        
+
         // and allocate memory for an array of row-pointers
-        
+
         if ((ppbRowPointers = (png_bytepp) malloc((*piHeight)
                             * sizeof(png_bytep))) == NULL)
         {
             png_error(png_ptr, "Visual PNG: out of memory");
         }
-        
+
         // set the individual row-pointers to point at the correct offsets
-        
+
         for (i = 0; i < (*piHeight); i++)
             ppbRowPointers[i] = pbImageData + i * ulRowBytes;
-        
+
         // now we can go ahead and just read the whole image
-        
+
         png_read_image(png_ptr, ppbRowPointers);
-        
+
         // read the additional chunks in the PNG file (not really needed)
-        
+
         png_read_end(png_ptr, NULL);
-        
+
         // and we're done
-        
+
         free (ppbRowPointers);
         ppbRowPointers = NULL;
-        
+
         // yepp, done
     }
 
@@ -269,7 +269,7 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData,
         png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
 
         *ppbImageData = pbImageData = NULL;
-        
+
         if(ppbRowPointers)
             free (ppbRowPointers);
 
@@ -323,58 +323,58 @@ BOOL PngSaveImage (PTSTR pstrFileName, png_byte *pDiData,
     Try
     {
         // initialize the png structure
-        
+
 #ifdef PNG_STDIO_SUPPORTED
         png_init_io(png_ptr, pfFile);
 #else
         png_set_write_fn(png_ptr, (png_voidp)pfFile, png_write_data, png_flush);
 #endif
-        
+
         // we're going to write a very simple 3x8 bit RGB image
-        
+
         png_set_IHDR(png_ptr, info_ptr, iWidth, iHeight, ciBitDepth,
             PNG_COLOR_TYPE_RGB, PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_BASE,
             PNG_FILTER_TYPE_BASE);
-        
+
         // write the file header information
-        
+
         png_write_info(png_ptr, info_ptr);
-        
+
         // swap the BGR pixels in the DiData structure to RGB
-        
+
         png_set_bgr(png_ptr);
-        
+
         // row_bytes is the width x number of channels
-        
+
         ulRowBytes = iWidth * ciChannels;
-        
+
         // we can allocate memory for an array of row-pointers
-        
+
         if ((ppbRowPointers = (png_bytepp) malloc(iHeight * sizeof(png_bytep))) == NULL)
             Throw "Visualpng: Out of memory";
-        
+
         // set the individual row-pointers to point at the correct offsets
-        
+
         for (i = 0; i < iHeight; i++)
             ppbRowPointers[i] = pDiData + i * (((ulRowBytes + 3) >> 2) << 2);
-        
+
         // write out the entire image data in one call
-        
+
         png_write_image (png_ptr, ppbRowPointers);
-        
+
         // write the additional chunks to the PNG file (not really needed)
-        
+
         png_write_end(png_ptr, info_ptr);
-        
+
         // and we're done
-        
+
         free (ppbRowPointers);
         ppbRowPointers = NULL;
-        
+
         // clean up after the write, and free any memory allocated
-        
+
         png_destroy_write_struct(&png_ptr, (png_infopp) NULL);
-        
+
         // yepp, done
     }
 
@@ -389,9 +389,9 @@ BOOL PngSaveImage (PTSTR pstrFileName, png_byte *pDiData,
 
         return FALSE;
     }
-    
+
     fclose (pfFile);
-    
+
     return TRUE;
 }
 

contrib/visupng/PngFile.h

@@ -17,7 +17,7 @@ void PngFileInitialize (HWND hwnd) ;
 BOOL PngFileOpenDlg (HWND hwnd, PTSTR pstrFileName, PTSTR pstrTitleName) ;
 BOOL PngFileSaveDlg (HWND hwnd, PTSTR pstrFileName, PTSTR pstrTitleName) ;
 
-BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData, 
+BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData,
                    int *piWidth, int *piHeight, int *piChannels, png_color *pBkgColor);
 BOOL PngSaveImage (PTSTR pstrFileName, png_byte *pDiData,
                    int iWidth, int iHeight, png_color BkgColor);

contrib/visupng/VisualPng.c

@@ -302,23 +302,23 @@ LRESULT CALLBACK WndProc (HWND hwnd, UINT message, WPARAM wParam,
             {
                 if (strcmp (szImgPathName, "") == 0)
                     return 0;
-                
+
                 // load the image from file
-                
+
                 if (!LoadImageFile (hwnd, szImgPathName, &pbImage,
                         &cxImgSize, &cyImgSize, &cImgChannels, &bkgColor))
                     return 0;
-                
+
                 // invalidate the client area for later update
-                
+
                 InvalidateRect (hwnd, NULL, TRUE);
-                
+
                 // display the PNG into the DIBitmap
-                
+
                 DisplayImage (hwnd, &pDib, &pDiData, cxWinSize, cyWinSize,
                     pbImage, cxImgSize, cyImgSize, cImgChannels, bStretched);
             }
-            
+
             return 0;
 
         case IDM_FILE_PREVIOUS:
@@ -328,22 +328,22 @@ LRESULT CALLBACK WndProc (HWND hwnd, UINT message, WPARAM wParam,
             if (SearchPngList (pPngFileList, iPngFileCount, &iPngFileIndex,
                 szImgPathName, NULL))
             {
-                
+
                 if (strcmp (szImgPathName, "") == 0)
                     return 0;
-                
+
                 // load the image from file
-                
+
                 if (!LoadImageFile (hwnd, szImgPathName, &pbImage, &cxImgSize,
                     &cyImgSize, &cImgChannels, &bkgColor))
                     return 0;
-                
+
                 // invalidate the client area for later update
-                
+
                 InvalidateRect (hwnd, NULL, TRUE);
-                
+
                 // display the PNG into the DIBitmap
-                
+
                 DisplayImage (hwnd, &pDib, &pDiData, cxWinSize, cyWinSize,
                     pbImage, cxImgSize, cyImgSize, cImgChannels, bStretched);
             }
@@ -619,29 +619,29 @@ BOOL SearchPngList (
     if (FileCount > 0)
     {
         // get previous entry
-        
+
         if (pstrPrevName != NULL)
         {
             if (*pFileIndex > 0)
                 *pFileIndex -= 1;
             else
                 *pFileIndex = FileCount - 1;
-            
+
             strcpy (pstrPrevName, pFileList + (*pFileIndex * MAX_PATH));
         }
-        
+
         // get next entry
-        
+
         if (pstrNextName != NULL)
         {
             if (*pFileIndex < FileCount - 1)
                 *pFileIndex += 1;
             else
                 *pFileIndex = 0;
-            
+
             strcpy (pstrNextName, pFileList + (*pFileIndex * MAX_PATH));
         }
-        
+
         return TRUE;
     }
     else

contrib/visupng/resource.h

@@ -12,7 +12,7 @@
 #define IDM_HELP_ABOUT                  40008
 
 // Next default values for new objects
-// 
+//
 #ifdef APSTUDIO_INVOKED
 #ifndef APSTUDIO_READONLY_SYMBOLS
 #define _APS_NEXT_RESOURCE_VALUE        113

libpng-1.4.21.txt

@@ -1,6 +1,6 @@
 libpng.txt - A description on how to use and modify libpng
 
- libpng version 1.4.18beta01 - November 20, 2015
+ libpng version 1.4.21 - August 24, 2017
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2014 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ libpng.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.4.18beta01 - November 20, 2015
+ libpng versions 0.97, January 1998, through 1.4.21 - August 24, 2017
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2014 Glenn Randers-Pehrson
 
@@ -907,7 +907,7 @@ things.
 As of libpng version 1.2.9, png_set_expand_gray_1_2_4_to_8() was
 added.  It expands the sample depth without changing tRNS to alpha.
 
-As of libpng version 1.4.18beta01, not all possible expansions are supported.
+As of libpng version 1.4.21, not all possible expansions are supported.
 
 In the following table, the 01 means grayscale with depth<8, 31 means
 indexed with depth<8, other numerals represent the color type, "T" means
@@ -1889,8 +1889,7 @@ Some of the more important parts of the png_info are:
 
 If you call png_set_IHDR(), the call must appear before any of the
 other png_set_*() functions, because they might require access to some of
-the IHDR settings.  The remaining png_set_*() functions can be called
-in any order.
+the IHDR settings.
 
 If you wish, you can reset the compression_type, interlace_type, or
 filter_method later by calling png_set_IHDR() again; if you do this, the
@@ -1902,6 +1901,12 @@ width, height, bit_depth, and color_type must be the same in each call.
                      (array of png_color)
     num_palette    - number of entries in the palette
 
+If you call png_set_PLTE(), the call must appear before either of
+png_set_tRNS() or png_set_hIST() appears, because they require access
+to the palette length.
+
+The remaining png_set_*() functions can be called in any order.
+
     png_set_gAMA(png_ptr, info_ptr, gamma);
     gamma          - the gamma the image was created
                      at (PNG_INFO_gAMA)
@@ -3293,7 +3298,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.4.18beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.4.21 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that

libpng.3

@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "November 20, 2015"
+.TH LIBPNG 3 "August 24, 2017"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.4.18beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.4.21
 .SH SYNOPSIS
 \fB
 #include <png.h>\fP
@@ -133,7 +133,9 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.4.18beta01
 
 \fBpng_uint_32 png_get_PLTE (png_const_structp \fP\fIpng_ptr\fP\fB, png_const_infop \fP\fIinfo_ptr\fP\fB, png_colorp \fP\fI*palette\fP\fB, int \fI*num_palette\fP\fB);\fP
 
-\fBpng_byte png_get_rgb_to_gray_status (png_const_structp png_ptr) png_uint_32 png_get_rowbytes (png_const_structp \fP\fIpng_ptr\fP\fB, png_const_infop \fIinfo_ptr\fP\fB);\fP
+\fBpng_byte png_get_rgb_to_gray_status (png_const_structp \fIpng_ptr\fP\fB);\fP
+
+\fBpng_uint_32 png_get_rowbytes (png_const_structp \fP\fIpng_ptr\fP\fB, png_const_infop \fIinfo_ptr\fP\fB);\fP
 
 \fBpng_bytepp png_get_rows (png_const_structp \fP\fIpng_ptr\fP\fB, png_const_infop \fIinfo_ptr\fP\fB);\fP
 
@@ -442,7 +444,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng.txt - A description on how to use and modify libpng
 
- libpng version 1.4.18beta01 - November 20, 2015
+ libpng version 1.4.21 - August 24, 2017
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2014 Glenn Randers-Pehrson
@@ -453,7 +455,7 @@ libpng.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.4.18beta01 - November 20, 2015
+ libpng versions 0.97, January 1998, through 1.4.21 - August 24, 2017
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2014 Glenn Randers-Pehrson
 
@@ -1349,7 +1351,7 @@ things.
 As of libpng version 1.2.9, png_set_expand_gray_1_2_4_to_8() was
 added.  It expands the sample depth without changing tRNS to alpha.
 
-As of libpng version 1.4.18beta01, not all possible expansions are supported.
+As of libpng version 1.4.21, not all possible expansions are supported.
 
 In the following table, the 01 means grayscale with depth<8, 31 means
 indexed with depth<8, other numerals represent the color type, "T" means
@@ -2331,8 +2333,7 @@ Some of the more important parts of the png_info are:
 
 If you call png_set_IHDR(), the call must appear before any of the
 other png_set_*() functions, because they might require access to some of
-the IHDR settings.  The remaining png_set_*() functions can be called
-in any order.
+the IHDR settings.
 
 If you wish, you can reset the compression_type, interlace_type, or
 filter_method later by calling png_set_IHDR() again; if you do this, the
@@ -2344,6 +2345,12 @@ width, height, bit_depth, and color_type must be the same in each call.
                      (array of png_color)
     num_palette    - number of entries in the palette
 
+If you call png_set_PLTE(), the call must appear before either of
+png_set_tRNS() or png_set_hIST() appears, because they require access
+to the palette length.
+
+The remaining png_set_*() functions can be called in any order.
+
     png_set_gAMA(png_ptr, info_ptr, gamma);
     gamma          - the gamma the image was created
                      at (PNG_INFO_gAMA)
@@ -3735,7 +3742,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.4.18beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.4.21 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that
@@ -3832,7 +3839,7 @@ the first widely used release:
  ...
  1.0.19                  10    10019  10.so.0.19[.0]
  ...
- 1.4.17                  14    10417  14.so.14.17[.0]
+ 1.4.20                  14    10420  14.so.14.20[.0]
 
 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -3888,7 +3895,7 @@ possible without all of you.
 
 Thanks to Frank J. T. Wojcik for helping with the documentation.
 
-Libpng version 1.4.18beta01 - November 20, 2015:
+Libpng version 1.4.21 - August 24, 2017:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).
 
@@ -3913,8 +3920,8 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.0.7, July 1, 2000, through 1.4.18beta01, November 20, 2015, are
-Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
+libpng versions 1.0.7, July 1, 2000, through 1.4.21, August 24, 2017, are
+Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
 added to the list of Contributing Authors:
@@ -4010,7 +4017,7 @@ the additional disclaimers inserted at version 1.0.7.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 20, 2015
+August 24, 2017
 
 .\" end of man page
 

libpngpf.3

@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "November 20, 2015"
+.TH LIBPNGPF 3 "August 24, 2017"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.4.18beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.4.21
 (private functions)
 .SH SYNOPSIS
 \fB#include <png.h>

png.5

@@ -1,4 +1,4 @@
-.TH PNG 5 "November 20, 2015"
+.TH PNG 5 "August 24, 2017"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
@@ -35,7 +35,7 @@ PNG 1.0 specification, October 1996:
 RFC 2083
 .IP
 .br
-ftp://ds.internic.net/rfc/rfc2083.txt
+http://www.ietf.org/rfc/rfc2083.txt
 .br
 or (as a W3C Recommendation) at
 .br

png.c

@@ -1,8 +1,8 @@
 
 /* png.c - location for general purpose libpng functions
  *
- * Last changed in libpng 1.4.15 [February 12, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.4.20 [December 29, 2016]
+ * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -17,7 +17,7 @@
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_4_18beta01 Your_png_h_is_not_version_1_4_18beta01;
+typedef version_1_4_21 Your_png_h_is_not_version_1_4_21;
 
 /* Tells libpng that we have already handled the first "num_bytes" bytes
  * of the PNG file signature.  If the PNG data is embedded into another
@@ -279,6 +279,7 @@ png_free_data(png_structp png_ptr, png_infop info_ptr, png_uint_32 mask,
          png_free(png_ptr, info_ptr->text);
          info_ptr->text = NULL;
          info_ptr->num_text=0;
+         info_ptr->max_text=0;
       }
    }
 #endif
@@ -558,14 +559,15 @@ png_get_copyright(png_const_structp png_ptr)
 #else
 #ifdef __STDC__
    return ((png_charp) PNG_STRING_NEWLINE \
-     "libpng version 1.4.18beta01 - November 20, 2015" PNG_STRING_NEWLINE \
-     "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
+     "libpng version 1.4.21 - August 24, 2017" PNG_STRING_NEWLINE \
+     "Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson" \
+     PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE);
 #else
-      return ((png_charp) "libpng version 1.4.18beta01 - November 20, 2015\
-      Copyright (c) 1998-2015 Glenn Randers-Pehrson\
+   return ((png_charp) "libpng version 1.4.21 - August 24, 2017\
+      Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.");
 #endif

png.h

@@ -1,9 +1,9 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.4.18beta01, November 20, 2015
+ * libpng version 1.4.21, August 24, 2017
  *
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -12,7 +12,7 @@
  * Authors and maintainers:
  *  libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *  libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *  libpng versions 0.97, January 1998, through 1.4.18beta01, November 20, 2015: Glenn
+ *  libpng versions 0.97, January 1998, through 1.4.21, August 24, 2017: Glenn
  *  See also "Contributing Authors", below.
  */
 
@@ -24,8 +24,8 @@
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.0.7, July 1, 2000, through 1.4.18beta01, November 20, 2015, are
- * Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
+ * libpng versions 1.0.7, July 1, 2000, through 1.4.21, August 24, 2017, are
+ * Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
  * derived from libpng-1.0.6, and are distributed according to the same
  * disclaimer and license as libpng-1.0.6 with the following individuals
  * added to the list of Contributing Authors:
@@ -179,7 +179,7 @@
  *    ...
  *    1.0.19                  10    10019  10.so.0.19[.0]
  *    ...
- *    1.4.17                  14    10417  14.so.14.17[.0]
+ *    1.4.21                  14    10421  14.so.14.21[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
@@ -207,13 +207,13 @@
  * Y2K compliance in libpng:
  * =========================
  *
- *    November 20, 2015
+ *    August 24, 2017
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.4.18beta01 are Y2K compliant.  It is my belief that earlier
+ *    upward through 1.4.21 are Y2K compliant.  It is my belief that earlier
  *    versions were also Y2K compliant.
  *
  *    Libpng only has three year fields.  One is a 2-byte unsigned integer
@@ -269,9 +269,9 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.4.18beta01"
+#define PNG_LIBPNG_VER_STRING "1.4.21"
 #define PNG_HEADER_VERSION_STRING \
-   " libpng version 1.4.18beta01 - November 20, 2015\n"
+   " libpng version 1.4.21 - August 24, 2017\n"
 
 #define PNG_LIBPNG_VER_SONUM   14
 #define PNG_LIBPNG_VER_DLLNUM  14
@@ -279,12 +279,12 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   4
-#define PNG_LIBPNG_VER_RELEASE 18
+#define PNG_LIBPNG_VER_RELEASE 21
 /* This should match the numeric part of the final component of
  * PNG_LIBPNG_VER_STRING, omitting any leading zero:
  */
 
-#define PNG_LIBPNG_VER_BUILD  01
+#define PNG_LIBPNG_VER_BUILD  0
 
 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -301,7 +301,7 @@
 #define PNG_LIBPNG_BUILD_SPECIAL 32 /* Cannot be OR'ed with
                                        PNG_LIBPNG_BUILD_PRIVATE */
 
-#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_BETA
+#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE
 
 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
  * We must not include leading zeros.
@@ -309,7 +309,7 @@
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
  * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
  */
-#define PNG_LIBPNG_VER 10418 /* 1.4.18 */
+#define PNG_LIBPNG_VER 10421 /* 1.4.21 */
 
 #ifndef PNG_VERSION_INFO_ONLY
 /* Include the compression library's header */
@@ -1378,7 +1378,7 @@ struct png_struct_def
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef png_structp version_1_4_18beta01;
+typedef png_structp version_1_4_21;
 
 typedef png_struct FAR * FAR * png_structpp;
 

pngconf.h

@@ -1,9 +1,9 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.4.18beta01, November 20, 2015
+ * libpng version 1.4.21, August 24, 2017
  *
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

pngerror.c

@@ -1,8 +1,8 @@
 
 /* pngerror.c - stub functions for i/o and memory allocation
  *
- * Last changed in libpng 1.4.8 [July 7, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Last changed in libpng 1.4.20 [December 29, 2016]
+ * Copyright (c) 1998-2002,2004,2006-2011,2016 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -150,14 +150,14 @@ png_benign_error(png_structp png_ptr, png_const_charp error_message)
  * to 63 bytes, the name characters are output as hex digits wrapped in []
  * if the character is invalid.
  */
+#define PNG_MAX_ERROR_TEXT 64
+#if defined(PNG_WARNINGS_SUPPORTED) || defined(PNG_ERROR_TEXT_SUPPORTED)
 #define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))
 static PNG_CONST char png_digit[16] = {
    '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
    'A', 'B', 'C', 'D', 'E', 'F'
 };
 
-#define PNG_MAX_ERROR_TEXT 64
-#if defined(PNG_WARNINGS_SUPPORTED) || defined(PNG_ERROR_TEXT_SUPPORTED)
 static void /* PRIVATE */
 png_format_buffer(png_structp png_ptr, png_charp buffer, png_const_charp
    error_message)

pngget.c

@@ -2,7 +2,7 @@
 /* pngget.c - retrieval of values from info struct
  *
  * Last changed in libpng 1.4.6 [April 8, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2011 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

pngmem.c

@@ -2,7 +2,7 @@
 /* pngmem.c - stub functions for memory allocation
  *
  * Last changed in libpng 1.4.6 [April 8, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2011 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

pngpread.c

@@ -1,8 +1,8 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.4.10 [March 8, 2012]
- * Copyright (c) 1998-2012 Glenn Randers-Pehrson
+ * Last changed in libpng 1.4.20 [December 28, 2016]
+ * Copyright (c) 1998-2002,2004,2006-2012,2016 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -203,6 +203,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
       png_reset_crc(png_ptr);
       png_crc_read(png_ptr, png_ptr->chunk_name, 4);
       png_check_chunk_name(png_ptr, png_ptr->chunk_name);
+      png_check_chunk_length(png_ptr, png_ptr->push_length);
       png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
    }
 
@@ -683,7 +684,11 @@ png_push_save_buffer(png_structp png_ptr)
         png_free(png_ptr, old_buffer);
         png_error(png_ptr, "Insufficient memory for save_buffer");
       }
-      png_memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
+      if (old_buffer)
+        png_memcpy(png_ptr->save_buffer, old_buffer,
+           png_ptr->save_buffer_size);
+      else if (png_ptr->save_buffer_size)
+        png_error(png_ptr, "save_buffer error");
       png_free(png_ptr, old_buffer);
       png_ptr->save_buffer_max = new_max;
    }

pngpriv.h

@@ -1,9 +1,9 @@
 
 /* pngpriv.h - private declarations for use inside libpng
  *
- * libpng version 1.4.18beta01 - November 20, 2015
+ * libpng version 1.4.21 - August 24, 2017
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014,2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -752,6 +752,9 @@ PNG_EXTERN void png_handle_unknown PNGARG((png_structp png_ptr,
 PNG_EXTERN void png_check_chunk_name PNGARG((png_structp png_ptr,
    png_bytep chunk_name));
 
+PNG_EXTERN void png_check_chunk_length PNGARG((png_structp png_ptr,
+   png_uint_32 chunk_length));
+
 /* Handle the transformations for reading and writing */
 PNG_EXTERN void png_do_read_transformations PNGARG((png_structp png_ptr));
 PNG_EXTERN void png_do_write_transformations PNGARG((png_structp png_ptr));

pngread.c

@@ -1,8 +1,8 @@
 
 /* pngread.c - read a PNG file
  *
- * Last changed in libpng 1.4.14 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.4.21 [August 24, 2017]
+ * Copyright (c) 1998-2002,2004,2006-2014,2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

pngrio.c

@@ -2,7 +2,7 @@
 /* pngrio.c - functions for data input
  *
  * Last changed in libpng 1.4.6 [January 14, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2011 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

pngrtran.c

@@ -2,7 +2,7 @@
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
  * Last changed in libpng 1.4.17 [November 12, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -1726,7 +1726,7 @@ png_do_unshift(png_row_infop row_info, png_bytep row, png_color_8p sig_bits)
       switch (row_info->bit_depth)
       {
          default:
-            break; 
+            break;
 
          case 2:
          {

pngrutil.c

@@ -1,8 +1,8 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.4.17 [November 12, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.4.21 [August 24, 2017]
+ * Copyright (c) 1998-2002,2004,2006-2015,2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -119,6 +119,74 @@ png_read_sig(png_structp png_ptr, png_infop info_ptr)
       png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
 }
 
+/* This function is called to verify that a chunk name is valid.
+   This function can't have the "critical chunk check" incorporated
+   into it, since in the future we will need to be able to call user
+   functions to handle unknown critical chunks after we check that
+   the chunk name itself is valid. */
+
+/* Bit hacking: the test for an invalid byte in the 4 byte chunk name is:
+ *
+ * ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))
+ */
+
+void /* PRIVATE */
+png_check_chunk_name(png_structp png_ptr, png_bytep chunk_name)
+{
+   int i;
+   png_uint_32 cn=chunk_name[0]<<24|chunk_name[1]<<16|chunk_name[2]<<8|
+     chunk_name[3];
+
+   png_debug(1, "in png_check_chunk_name");
+
+   for (i=1; i<=4; ++i)
+   {
+      int c = cn & 0xff;
+
+      if (c < 65 || c > 122 || (c > 90 && c < 97))
+         png_chunk_error(png_ptr, "invalid chunk type");
+
+      cn >>= 8;
+   }
+}
+
+void /* PRIVATE */
+png_check_chunk_length(png_structp png_ptr, png_uint_32 length)
+{
+   png_uint_32 limit = PNG_UINT_31_MAX;
+
+   /* if (png_ptr->chunk_name != "IDAT") */
+   if (png_ptr->chunk_name[0] != 73 || png_ptr->chunk_name[1] !=68 ||
+       png_ptr->chunk_name[2] != 65 || png_ptr->chunk_name[3] !=84)
+   {
+# ifdef PNG_SET_USER_LIMITS_SUPPORTED
+      if (png_ptr->user_chunk_malloc_max > 0 &&
+          png_ptr->user_chunk_malloc_max < limit)
+         limit = png_ptr->user_chunk_malloc_max;
+# elif PNG_USER_CHUNK_MALLOC_MAX > 0
+      if (PNG_USER_CHUNK_MALLOC_MAX < limit)
+         limit = PNG_USER_CHUNK_MALLOC_MAX;
+# endif
+   }
+   else
+   {
+      size_t row_factor =
+         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
+          + 1 + (png_ptr->interlaced? 6: 0));
+      if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
+         limit=PNG_UINT_31_MAX;
+      else
+         limit = png_ptr->height * row_factor;
+      limit += 6 + 5*(limit/32566+1); /* zlib+deflate overhead */
+      limit=limit < PNG_UINT_31_MAX? limit : PNG_UINT_31_MAX;
+   }
+   if (length > limit)
+   {
+      png_debug2(0," length = %lu, limit = %lu",
+         (unsigned long)length,(unsigned long)limit);
+      png_chunk_error(png_ptr, "chunk data is too large");
+   }
+}
 /* Read the chunk header (length + type name).
  * Put the type name into png_ptr->chunk_name, and return the length.
  */
@@ -151,6 +219,9 @@ png_read_chunk_header(png_structp png_ptr)
    /* Check to see if chunk name is valid. */
    png_check_chunk_name(png_ptr, png_ptr->chunk_name);
 
+   /* Check for too-large chunk length */
+   png_check_chunk_length(png_ptr, length);
+
 #ifdef PNG_IO_STATE_SUPPORTED
    /* It is unspecified how many I/O calls will be performed
     * during the serialization of the chunk data.
@@ -1772,7 +1843,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 
    /* We need to have at least 12 bytes after the purpose string
       in order to get the parameter information. */
-   if (slength < 12U || endptr - buf <= 12U)
+   if (slength < 12U || endptr - buf <= 12)
    {
       png_warning(png_ptr, "Invalid pCAL data");
       png_free(png_ptr, png_ptr->chunkdata);
@@ -2535,24 +2606,6 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
 }
 
-/* This function is called to verify that a chunk name is valid.
-   This function can't have the "critical chunk check" incorporated
-   into it, since in the future we will need to be able to call user
-   functions to handle unknown critical chunks after we check that
-   the chunk name itself is valid. */
-
-#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))
-
-void /* PRIVATE */
-png_check_chunk_name(png_structp png_ptr, png_bytep chunk_name)
-{
-   png_debug(1, "in png_check_chunk_name");
-   if (isnonalpha(chunk_name[0]) || isnonalpha(chunk_name[1]) ||
-       isnonalpha(chunk_name[2]) || isnonalpha(chunk_name[3]))
-   {
-      png_chunk_error(png_ptr, "invalid chunk type");
-   }
-}
 
 /* Combines the row recently read in with the existing pixels in the
    row.  This routine takes care of alpha and transparency if requested.

pngset.c

@@ -1,8 +1,8 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.4.17 [November 12, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.4.19 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -434,8 +434,8 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
-      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
+   max_palette_length = (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
+      (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
 
    if (num_palette < 0 || num_palette > (int) max_palette_length)
    {
@@ -1025,7 +1025,6 @@ png_set_unknown_chunk_location(png_structp png_ptr, png_infop info_ptr,
 }
 #endif
 
-
 #ifdef PNG_MNG_FEATURES_SUPPORTED
 png_uint_32 PNGAPI
 png_permit_mng_features(png_structp png_ptr, png_uint_32 mng_features)
@@ -1138,7 +1137,6 @@ png_set_invalid(png_structp png_ptr, png_infop info_ptr, int mask)
 }
 
 
-
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
 /* This function was added to libpng 1.2.6 */
 void PNGAPI
@@ -1188,4 +1186,135 @@ png_set_benign_errors(png_structp png_ptr, int allowed)
       png_ptr->flags &= ~PNG_FLAG_BENIGN_ERRORS_WARN;
 }
 #endif /* PNG_BENIGN_ERRORS_SUPPORTED */
-#endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */
+
+#if defined(PNG_WRITE_TEXT_SUPPORTED) || defined(PNG_WRITE_pCAL_SUPPORTED) || \
+    defined(PNG_WRITE_iCCP_SUPPORTED) || defined(PNG_WRITE_sPLT_SUPPORTED)
+/* Check that the tEXt or zTXt keyword is valid per PNG 1.0 specification,
+ * and if invalid, correct the keyword rather than discarding the entire
+ * chunk.  The PNG 1.0 specification requires keywords 1-79 characters in
+ * length, forbids leading or trailing whitespace, multiple internal spaces,
+ * and the non-break space (0x80) from ISO 8859-1.  Returns keyword length.
+ *
+ * The new_key is allocated to hold the corrected keyword and must be freed
+ * by the calling routine.  This avoids problems with trying to write to
+ * static keywords without having to have duplicate copies of the strings.
+ */
+png_size_t /* PRIVATE */
+png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
+{
+   png_size_t key_len;
+   png_charp kp, dp;
+   int kflag;
+   int kwarn=0;
+
+   png_debug(1, "in png_check_keyword");
+
+   *new_key = NULL;
+
+   if (key == NULL || (key_len = png_strlen(key)) == 0)
+   {
+      png_warning(png_ptr, "zero length keyword");
+      return ((png_size_t)0);
+   }
+
+   png_debug1(2, "Keyword to be checked is '%s'", key);
+
+   *new_key = (png_charp)png_malloc_warn(png_ptr, (png_uint_32)(key_len + 2));
+   if (*new_key == NULL)
+   {
+      png_warning(png_ptr, "Out of memory while procesing keyword");
+      return ((png_size_t)0);
+   }
+
+   /* Replace non-printing characters with a blank and print a warning */
+   for (kp = key, dp = *new_key; *kp != '\0'; kp++, dp++)
+   {
+      if ((png_byte)*kp < 0x20 ||
+         ((png_byte)*kp > 0x7E && (png_byte)*kp < 0xA1))
+      {
+#ifdef PNG_STDIO_SUPPORTED
+         char msg[40];
+
+         png_snprintf(msg, 40,
+           "invalid keyword character 0x%02X", (png_byte)*kp);
+         png_warning(png_ptr, msg);
+#else
+         png_warning(png_ptr, "invalid character in keyword");
+#endif
+         *dp = ' ';
+      }
+      else
+      {
+         *dp = *kp;
+      }
+   }
+   *dp = '\0';
+
+   /* Remove any trailing white space. */
+   kp = *new_key + key_len - 1;
+   if (*kp == ' ')
+   {
+      png_warning(png_ptr, "trailing spaces removed from keyword");
+
+      while (key_len && *kp == ' ')
+      {
+         *(kp--) = '\0';
+         key_len--;
+      }
+   }
+
+   /* Remove any leading white space. */
+   kp = *new_key;
+   if (*kp == ' ')
+   {
+      png_warning(png_ptr, "leading spaces removed from keyword");
+
+      while (*kp == ' ')
+      {
+         kp++;
+         key_len--;
+      }
+   }
+
+   png_debug1(2, "Checking for multiple internal spaces in '%s'", kp);
+
+   /* Remove multiple internal spaces. */
+   for (kflag = 0, dp = *new_key; *kp != '\0'; kp++)
+   {
+      if (*kp == ' ' && kflag == 0)
+      {
+         *(dp++) = *kp;
+         kflag = 1;
+      }
+      else if (*kp == ' ')
+      {
+         key_len--;
+         kwarn=1;
+      }
+      else
+      {
+         *(dp++) = *kp;
+         kflag = 0;
+      }
+   }
+   *dp = '\0';
+   if (kwarn)
+      png_warning(png_ptr, "extra interior spaces removed from keyword");
+
+   if (key_len == 0)
+   {
+      png_free(png_ptr, *new_key);
+      png_warning(png_ptr, "Zero length keyword");
+   }
+
+   if (key_len > 79)
+   {
+      png_warning(png_ptr, "keyword length must be 1 - 79 characters");
+      (*new_key)[79] = '\0';
+      key_len = 79;
+   }
+
+   return (key_len);
+}
+#endif /* WRITE_TEXT || WRITE_pCAL) || WRITE_iCCP || WRITE_sPLT */
+#endif /* READ || WRITE */

pngtest.c

@@ -2,7 +2,7 @@
 /* pngtest.c - a simple test program to test libpng
  *
  * Last changed in libpng 1.4.17 [November 12, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -1737,4 +1737,4 @@ main(int argc, char *argv[])
 }
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_4_18beta01 your_png_h_is_not_version_1_4_18beta01;
+typedef version_1_4_21 your_png_h_is_not_version_1_4_21;

pngtrans.c

@@ -2,7 +2,7 @@
 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
  *
  * Last changed in libpng 1.4.6 [ April 8, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2011 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

pngwio.c

@@ -2,7 +2,7 @@
 /* pngwio.c - functions for data output
  *
  * Last changed in libpng 1.4.0 [January 3, 2010]
- * Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

pngwrite.c

@@ -2,7 +2,7 @@
 /* pngwrite.c - general routines to write a PNG file
  *
  * Last changed in libpng 1.4.15 [February 12, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

pngwtran.c

@@ -2,7 +2,7 @@
 /* pngwtran.c - transforms the data in a row for PNG writers
  *
  * Last changed in libpng 1.4.1 [February 25, 2010]
- * Copyright (c) 1998-2010 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

pngwutil.c

@@ -1,8 +1,8 @@
 
 /* pngwutil.c - utilities to write a PNG file
  *
- * Last changed in libpng 1.4.17 [November 12, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.4.19 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -1234,137 +1234,6 @@ png_write_hIST(png_structp png_ptr, png_uint_16p hist, int num_hist)
 }
 #endif
 
-#if defined(PNG_WRITE_TEXT_SUPPORTED) || defined(PNG_WRITE_pCAL_SUPPORTED) || \
-    defined(PNG_WRITE_iCCP_SUPPORTED) || defined(PNG_WRITE_sPLT_SUPPORTED)
-/* Check that the tEXt or zTXt keyword is valid per PNG 1.0 specification,
- * and if invalid, correct the keyword rather than discarding the entire
- * chunk.  The PNG 1.0 specification requires keywords 1-79 characters in
- * length, forbids leading or trailing whitespace, multiple internal spaces,
- * and the non-break space (0x80) from ISO 8859-1.  Returns keyword length.
- *
- * The new_key is allocated to hold the corrected keyword and must be freed
- * by the calling routine.  This avoids problems with trying to write to
- * static keywords without having to have duplicate copies of the strings.
- */
-png_size_t /* PRIVATE */
-png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
-{
-   png_size_t key_len;
-   png_charp kp, dp;
-   int kflag;
-   int kwarn=0;
-
-   png_debug(1, "in png_check_keyword");
-
-   *new_key = NULL;
-
-   if (key == NULL || (key_len = png_strlen(key)) == 0)
-   {
-      png_warning(png_ptr, "zero length keyword");
-      return ((png_size_t)0);
-   }
-
-   png_debug1(2, "Keyword to be checked is '%s'", key);
-
-   *new_key = (png_charp)png_malloc_warn(png_ptr, (png_uint_32)(key_len + 2));
-   if (*new_key == NULL)
-   {
-      png_warning(png_ptr, "Out of memory while procesing keyword");
-      return ((png_size_t)0);
-   }
-
-   /* Replace non-printing characters with a blank and print a warning */
-   for (kp = key, dp = *new_key; *kp != '\0'; kp++, dp++)
-   {
-      if ((png_byte)*kp < 0x20 ||
-         ((png_byte)*kp > 0x7E && (png_byte)*kp < 0xA1))
-      {
-#ifdef PNG_STDIO_SUPPORTED
-         char msg[40];
-
-         png_snprintf(msg, 40,
-           "invalid keyword character 0x%02X", (png_byte)*kp);
-         png_warning(png_ptr, msg);
-#else
-         png_warning(png_ptr, "invalid character in keyword");
-#endif
-         *dp = ' ';
-      }
-      else
-      {
-         *dp = *kp;
-      }
-   }
-   *dp = '\0';
-
-   /* Remove any trailing white space. */
-   kp = *new_key + key_len - 1;
-   if (*kp == ' ')
-   {
-      png_warning(png_ptr, "trailing spaces removed from keyword");
-
-      while (*kp == ' ')
-      {
-         *(kp--) = '\0';
-         key_len--;
-      }
-   }
-
-   /* Remove any leading white space. */
-   kp = *new_key;
-   if (*kp == ' ')
-   {
-      png_warning(png_ptr, "leading spaces removed from keyword");
-
-      while (*kp == ' ')
-      {
-         kp++;
-         key_len--;
-      }
-   }
-
-   png_debug1(2, "Checking for multiple internal spaces in '%s'", kp);
-
-   /* Remove multiple internal spaces. */
-   for (kflag = 0, dp = *new_key; *kp != '\0'; kp++)
-   {
-      if (*kp == ' ' && kflag == 0)
-      {
-         *(dp++) = *kp;
-         kflag = 1;
-      }
-      else if (*kp == ' ')
-      {
-         key_len--;
-         kwarn=1;
-      }
-      else
-      {
-         *(dp++) = *kp;
-         kflag = 0;
-      }
-   }
-   *dp = '\0';
-   if (kwarn)
-      png_warning(png_ptr, "extra interior spaces removed from keyword");
-
-   if (key_len == 0)
-   {
-      png_free(png_ptr, *new_key);
-      png_warning(png_ptr, "Zero length keyword");
-   }
-
-   if (key_len > 79)
-   {
-      png_warning(png_ptr, "keyword length must be 1 - 79 characters");
-      (*new_key)[79] = '\0';
-      key_len = 79;
-   }
-
-   return (key_len);
-}
-#endif
-
 #ifdef PNG_WRITE_tEXt_SUPPORTED
 /* Write a tEXt chunk */
 void /* PRIVATE */

projects/vstudio/readme.txt

@@ -1,9 +1,9 @@
 
 VisualStudio instructions
 
-libpng version 1.4.18beta01 - November 20, 2015
+libpng version 1.4.21 - August 24, 2017
 
-Copyright (c) 1998-2010 Glenn Randers-Pehrson
+Copyright (c) 2010 Glenn Randers-Pehrson
 
 This code is released under the libpng license.
 For conditions of distribution and use, see the disclaimer

projects/vstudio/zlib.props

@@ -2,7 +2,7 @@
 <!--
  * zlib.props - location of zlib source and build
  *
- * libpng version 1.4.18beta01 - November 20, 2015
+ * libpng version 1.4.21 - August 24, 2017
  *
  * Copyright (c) 1998-2011 Glenn Randers-Pehrson
  *

scripts/README.txt

@@ -1,8 +1,8 @@
 
-Makefiles for  libpng version 1.4.18beta01 - November 20, 2015
+Makefiles for  libpng version 1.4.21 - August 24, 2017
 
  makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng14.so.14.1.4.18beta01)
+                       (gcc, creates libpng14.so.14.1.4.21)
  makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
  makefile.knr      =>  Archaic UNIX Makefile that converts files with
                        ansi2knr (Requires ansi2knr.c from
@@ -20,7 +20,7 @@ Makefiles for  libpng version 1.4.18beta01 - November 20, 2015
  makefile.dec      =>  DEC Alpha UNIX makefile
  makefile.dj2      =>  DJGPP 2 makefile
  makefile.elf      =>  Linux/ELF makefile symbol versioning,
-                       (gcc, creates libpng14.so.14.1.4.18beta01)
+                       (gcc, creates libpng14.so.14.1.4.21)
  makefile.freebsd  =>  FreeBSD makefile
  makefile.gcc      =>  Generic gcc makefile
  makefile.hpgcc    =>  HPUX makefile using gcc
@@ -36,12 +36,12 @@ Makefiles for  libpng version 1.4.18beta01 - November 20, 2015
  makefile.os2      =>  OS/2 Makefile (gcc and emx, requires pngos2.def)
  makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
  makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng14.so.14.1.4.18beta01)
+                       creates libpng14.so.14.1.4.21)
  makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
  makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng14.so.14.1.4.18beta01)
+                       creates libpng14.so.14.1.4.21)
  makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng14.so.14.1.4.18beta01)
+                       creates libpng14.so.14.1.4.21)
  makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
  makefile.sunos    =>  Sun makefile
  makefile.32sunu   =>  Sun Ultra 32-bit makefile

scripts/libpng-config-head.in

@@ -11,7 +11,7 @@
 
 # Modeled after libxml-config.
 
-version=1.4.18beta01
+version=1.4.21
 prefix=""
 libdir=""
 libs=""

scripts/libpng.pc.in

@@ -5,6 +5,6 @@ includedir=@includedir@/libpng14
 
 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.4.18beta01
+Version: 1.4.21
 Libs: -L${libdir} -lpng14
 Cflags: -I${includedir}

scripts/makefile.cegcc

@@ -23,7 +23,7 @@
 
 VERMAJ = 1
 VERMIN = 4
-VERMIC = 18
+VERMIC = 21
 VER = $(VERMAJ).$(VERMIN).$(VERMIC)
 NAME = libpng
 PACKAGE = $(NAME)-$(VER)

scripts/makefile.linux

@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng14
 PNGMAJ = 14
-RELEASE = 18
+RELEASE = 21
 
 # Shared library names:
 LIBSO=$(LIBNAME).so

scripts/makefile.ne12bsd

@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng14
 
 LIB=	png14
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.4.18beta01
+SHLIB_MINOR=	1.4.21
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c

scripts/makefile.netbsd

@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include
 
 LIB=	png
 SHLIB_MAJOR=	3
-SHLIB_MINOR=	1.4.18beta01
+SHLIB_MINOR=	1.4.21
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c

scripts/makefile.openbsd

@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat
 
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.4.18beta01
+SHLIB_MINOR=	1.4.21
 
 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \

scripts/png32ce.def

@@ -15,7 +15,7 @@ LIBRARY lpngce
  png_get_int_32
 
 EXPORTS
-;Version 1.4.18beta01
+;Version 1.4.21
   png_build_grayscale_palette  @1
 ;  png_check_sig        @2
   png_chunk_error      @3

scripts/pngos2.def

@@ -2,7 +2,7 @@
 ; PNG.LIB module definition file for OS/2
 ;----------------------------------------
 
-; Version 1.4.18beta01
+; Version 1.4.21
 
 LIBRARY		PNG
 DESCRIPTION	"PNG image compression library for OS/2"

scripts/pngwin.def

@@ -5,7 +5,7 @@
 LIBRARY
 
 EXPORTS
-;Version 1.4.18beta01
+;Version 1.4.21
   png_build_grayscale_palette
   png_chunk_error
   png_chunk_warning