[libpng15] Imported from libpng-1.5.22beta02.tar

[libpng15] Merged pngtest.c with libpng-1.6.17/pngtest.c
Display user limits in the output from pngtest. Eliminated the PNG_SAFE_LIMITS macro and restored the 1-million-column and 1-million-row default limits in pnglibconf.dfa, that can be reset by the user at build time or run time. This provides a more robust defense against DOS and as-yet undiscovered overflows.
2025-07-10 18:04:09 +02:00 · 2015-02-17 10:51:19 -06:00 · 2015-02-16 22:56:30 -06:00 · 2015-01-28 19:42:01 -06:00 · 2015-01-28 19:34:32 -06:00 · 2015-01-13 09:39:15 -06:00
48 changed files with 6521 additions and 4278 deletions
--- a/38
+++ b/38
@@ -1,5 +1,5 @@

-Libpng 1.5.20beta01 - November 6, 2014
+Libpng 1.5.22beta02 - February 17, 2015

 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -9,29 +9,37 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script

-   1.5.20beta01.tar.xz (LZMA-compressed, recommended)
-   1.5.20beta01.tar.gz
-   1.5.20beta01.tar.bz2
+   1.5.22beta02.tar.xz (LZMA-compressed, recommended)
+   1.5.22beta02.tar.gz
+   1.5.22beta02.tar.bz2

 Source files with CRLF line endings (for Windows), without the
 "configure" script

-   lp1520b01.7z  (LZMA-compressed, recommended)
-   lp1520b01.zip
+   lp1522b02.7z  (LZMA-compressed, recommended)
+   lp1522b02.zip

 Other information:

-   1.5.20beta01-README.txt
-   1.5.20beta01-LICENSE.txt
-   libpng-1.5.20beta01-*.asc (armored detached GPG signatures)
+   1.5.22beta02-README.txt
+   1.5.22beta02-LICENSE.txt
+   libpng-1.5.22beta02-*.asc (armored detached GPG signatures)

-Changes since the last public release (1.5.19):
+Changes since the last public release (1.5.21):

-Version 1.5.20beta01 [November 6, 2014]
-  Removed "option WRITE_COMPRESSED_TEXT enables WRITE_TEXT" from pnglibconf.dfa
-  Only mark text chunks as written after successfully writing them.
-  Avoid out-of-bounds memory access in png_user_version_check().
-  Simplified and future-proofed png_user_version_check().
+Version 1.5.22beta01 [January 29, 2015]
+  Regenerated configure scripts with libtool-2.4.4
+  Made the check for out-of-range values in png_set_tRNS() detect
+    values that are exactly 2^bit_depth, and work on 16-bit platforms.
+  Quieted some warnings from Coverity-scan.
+
+Version 1.5.22beta02 [February 17, 2015]
+  Merged pngtest.c with libpng-1.6.17/pngtest.c
+  Display user limits in the output from pngtest.
+  Eliminated the PNG_SAFE_LIMITS macro and restored the 1-million-column
+    and 1-million-row default limits in pnglibconf.dfa, that can be reset
+    by the user at build time or run time.  This provides a more robust
+    defense against DOS and as-yet undiscovered overflows.

 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
--- a/53
+++ b/53
@@ -4252,6 +4252,59 @@ Version 1.5.20beta01 [November 6, 2014]
  Avoid out-of-bounds memory access in png_user_version_check().
  Simplified and future-proofed png_user_version_check().

+Version 1.5.20beta02 [November 10, 2014]
+  Quieted three "comparison is always false due to limited range" compiler
+    warnings in pngset.c
+
+Version 1.5.20rc01 [November 13, 2014]
+
+Version 1.5.20rc02 [November 14, 2014]]
+  The macros passed in the command line to Borland make were ignored if
+    similarly-named macros were already defined in makefiles. This behavior
+    is different from POSIX make and other make programs.  Surround the
+    macro definitions with ifndef guards (Cosmin).
+  Use memcpy instead of CopyMemory in the definition of png_memcpy.
+    The Borland C++ build breaks otherwise (Cosmin).
+
+Version 1.5.20rc03 [November 17, 2014]
+  Added "-D_CRT_SECURE_NO_WARNINGS" to CFLAGS in scripts/makefile.vcwin32
+  Removed the obsolete $ARCH variable from scripts/makefile.darwin.
+
+Version 1.5.20 [November 20, 2014]
+  No changes.
+
+Version 1.5.21beta01 [December 14, 2014]
+  Revised Makefile.am and scripts/*.dfn to work with MinGW/MSYS;
+    renamed scripts/*.dfn to scripts/*.c (Bob Friesenhahn and John Bowler).
+
+Version 1.5.21rc01 [December 21, 2014]
+  Restored a test on width that was removed from png.c at libpng-1.6.9
+    (Bug report by Alex Eubanks, CVE-2015-0973).
+
+Version 1.5.21rc02 [December 21, 2014]
+  Undid the update to pngrutil.c in 1.6.16rc01.
+
+Version 1.5.21rc03 [December 21, 2014]
+  Fixed an overflow in png_combine_row with very wide interlaced images
+    (Bug report and fix by John Bowler, CVE-2014-9495).
+
+Version 1.5.21 [December 22, 2014]
+  No changes.
+
+Version 1.5.22beta01 [January 29, 2015]
+  Regenerated configure scripts with libtool-2.4.4
+  Made the check for out-of-range values in png_set_tRNS() detect
+    values that are exactly 2^bit_depth, and work on 16-bit platforms.
+  Quieted some warnings from Coverity-scan.
+
+Version 1.5.22beta02 [February 17, 2015]
+  Merged pngtest.c with libpng-1.6.17/pngtest.c
+  Display user limits in the output from pngtest.
+  Eliminated the PNG_SAFE_LIMITS macro and restored the 1-million-column
+    and 1-million-row default limits in pnglibconf.dfa, that can be reset
+    by the user at build time or run time.  This provides a more robust
+    defense against DOS and as-yet undiscovered overflows.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -16,7 +16,7 @@ enable_testing()

 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 5)
-set(PNGLIB_RELEASE 20)
+set(PNGLIB_RELEASE 22)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})

@@ -219,7 +219,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW)
 # SET UP LINKS
 if(PNG_SHARED)
  set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 15.${PNGLIB_RELEASE}.1.5.20beta01
+#   VERSION 15.${PNGLIB_RELEASE}.1.5.22beta02
    VERSION 15.${PNGLIB_RELEASE}.0
    SOVERSION 15
    CLEAN_DIRECT_OUTPUT 1)
--- a/6
+++ b/6
@@ -10,8 +10,8 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.2.6, August 15, 2004, through 1.5.20beta01, November 6, 2014, are
-Copyright (c) 2004, 2006-2014 Glenn Randers-Pehrson, and are
+libpng versions 1.2.6, August 15, 2004, through 1.5.22beta02, February 17, 2015, are
+Copyright (c) 2004, 2006-2015 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors

@@ -108,4 +108,4 @@ certification mark of the Open Source Initiative.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 6, 2014
+February 17, 2015
--- a/Makefile.am
+++ b/Makefile.am
@@ -85,7 +85,7 @@ EXTRA_DIST= \
 	$(TESTS) \
 	CMakeLists.txt example.c libpng-manual.txt

-SCRIPT_CLEANFILES=scripts/*.out scripts/*.chk scripts/pnglibconf.dfn
+SCRIPT_CLEANFILES=scripts/*.out scripts/*.chk scripts/pnglibconf.c

 CLEANFILES= dfn.c dfn?.out *.out.? scripts/*.out.? pngout.png \
 	libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc \
@@ -103,7 +103,7 @@ config.sub configure depcomp install-sh ltmain.sh missing
 # checks for this and sets DFNCPP appropriately.
 DFNCPP = @DFNCPP@

-SUFFIXES = .chk .dfn .out
+SUFFIXES = .chk .out

 $(PNGLIB_BASENAME).pc: libpng.pc
 	cp libpng.pc $@
@@ -142,17 +142,18 @@ SYMBOL_CFLAGS = -DPNGLIB_LIBNAME='PNG@PNGLIB_MAJOR@@PNGLIB_MINOR@_0'\
 		-DSYMBOL_PREFIX='$(SYMBOL_PREFIX)'\
 		-DPNG_NO_USE_READ_MACROS -DPNG_BUILDING_SYMBOL_TABLE

-.dfn.out:
-	rm -f $@ $@.c $@.?
+.c.out:
+	rm -f $@ $*.tf[12]
 	test -d scripts || mkdir scripts || test -d scripts
-	echo '#include "$<"' >$@.c
-	$(DFNCPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) @LIBPNG_DEFINES@\
-	    $(CPPFLAGS) $(SYMBOL_CFLAGS) $@.c > $@.1
-	$(AWK) -f "${srcdir}/scripts/dfn.awk" out="$@.2" $@.1 1>&2
-	mv $@.2 $@
+	$(DFNCPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES)\
+	    $(CPPFLAGS) $(SYMBOL_CFLAGS) $< > $*.tf1
+	$(AWK) -f "${srcdir}/scripts/dfn.awk" out="$*.tf2" $*.tf1 1>&2
+	rm -f $*.tf1
+	mv $*.tf2 $@
+ 
+# The .c file for pnglibconf.h is machine generated
+pnglibconf.c: scripts/pnglibconf.dfa scripts/options.awk pngconf.h pngusr.dfa $(DFA_XTRA)

-# The .dfn file for pnglibconf.h is machine generated
-pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h pngusr.dfa $(DFA_XTRA)
 	rm -f $@ pnglibconf.pre $@.?
 	$(AWK) -f ${srcdir}/scripts/options.awk out="pnglibconf.pre"\
 	    version=search ${srcdir}/pngconf.h ${srcdir}/scripts/pnglibconf.dfa\
@@ -170,7 +171,7 @@ scripts/symbols.chk: scripts/checksym.awk scripts/symbols.def scripts/symbols.ou

 # used on demand to regenerate the standard header, CPPFLAGS should
 # be empty - no non-standard defines
-scripts/pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h
+scripts/pnglibconf.c: scripts/pnglibconf.dfa scripts/options.awk pngconf.h
 	rm -f $@ dfn?.out
 	test -z "$(CPPFLAGS)"
 	echo "com @PNGLIB_VERSION@ STANDARD API DEFINITION" |\
--- a/Makefile.in
+++ b/Makefile.in
@@ -505,7 +505,7 @@ EXTRA_DIST = \
 	$(TESTS) \
 	CMakeLists.txt example.c libpng-manual.txt

-SCRIPT_CLEANFILES = scripts/*.out scripts/*.chk scripts/pnglibconf.dfn
+SCRIPT_CLEANFILES = scripts/*.out scripts/*.chk scripts/pnglibconf.c
 CLEANFILES = dfn.c dfn?.out *.out.? scripts/*.out.? pngout.png \
 	libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc \
 	libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@-config libpng.vers libpng.sym \
@@ -515,7 +515,7 @@ CLEANFILES = dfn.c dfn?.out *.out.? scripts/*.out.? pngout.png \
 MAINTAINERCLEANFILES = Makefile.in aclocal.m4 config.guess config.h.in \
 config.sub configure depcomp install-sh ltmain.sh missing

-SUFFIXES = .chk .dfn .out
+SUFFIXES = .chk .out

 # We must use -DPNG_NO_USE_READ_MACROS here even when the library may actually
 # be built with PNG_USE_READ_MACROS; this prevents the read macros from
@@ -535,7 +535,7 @@ all: config.h
 	$(MAKE) $(AM_MAKEFLAGS) all-am

 .SUFFIXES:
-.SUFFIXES: .chk .dfn .out .S .c .lo .o .obj
+.SUFFIXES: .chk .out .S .c .lo .o .obj
 am--refresh: Makefile
 	@:
 $(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__configure_deps)
@@ -1559,17 +1559,18 @@ $(srcdir)/scripts/pnglibconf.h.prebuilt:
 # 'make test' is the first thing the user does.)
 contrib/libtests/pngvalid.o pngtest.o: pnglibconf.h

-.dfn.out:
-	rm -f $@ $@.c $@.?
+.c.out:
+	rm -f $@ $*.tf[12]
 	test -d scripts || mkdir scripts || test -d scripts
-	echo '#include "$<"' >$@.c
-	$(DFNCPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) @LIBPNG_DEFINES@\
-	    $(CPPFLAGS) $(SYMBOL_CFLAGS) $@.c > $@.1
-	$(AWK) -f "${srcdir}/scripts/dfn.awk" out="$@.2" $@.1 1>&2
-	mv $@.2 $@
+	$(DFNCPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES)\
+	    $(CPPFLAGS) $(SYMBOL_CFLAGS) $< > $*.tf1
+	$(AWK) -f "${srcdir}/scripts/dfn.awk" out="$*.tf2" $*.tf1 1>&2
+	rm -f $*.tf1
+	mv $*.tf2 $@
+
+# The .c file for pnglibconf.h is machine generated
+pnglibconf.c: scripts/pnglibconf.dfa scripts/options.awk pngconf.h pngusr.dfa $(DFA_XTRA)

-# The .dfn file for pnglibconf.h is machine generated
-pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h pngusr.dfa $(DFA_XTRA)
 	rm -f $@ pnglibconf.pre $@.?
 	$(AWK) -f ${srcdir}/scripts/options.awk out="pnglibconf.pre"\
 	    version=search ${srcdir}/pngconf.h ${srcdir}/scripts/pnglibconf.dfa\
@@ -1587,7 +1588,7 @@ scripts/symbols.chk: scripts/checksym.awk scripts/symbols.def scripts/symbols.ou

 # used on demand to regenerate the standard header, CPPFLAGS should
 # be empty - no non-standard defines
-scripts/pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h
+scripts/pnglibconf.c: scripts/pnglibconf.dfa scripts/options.awk pngconf.h
 	rm -f $@ dfn?.out
 	test -z "$(CPPFLAGS)"
 	echo "com @PNGLIB_VERSION@ STANDARD API DEFINITION" |\
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-README for libpng version 1.5.20beta01 - November 6, 2014 (shared library 15.0)
+README for libpng version 1.5.22beta02 - February 17, 2015 (shared library 15.0)
 See the note about version numbers near the top of png.h

 See INSTALL for instructions on how to install libpng.
--- a/aclocal.m4
+++ b/aclocal.m4
--- a/config.h.in
+++ b/config.h.in
@@ -48,8 +48,7 @@
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H

-/* Define to the sub-directory in which libtool stores uninstalled libraries.
-   */
+/* Define to the sub-directory where libtool stores uninstalled libraries. */
 #undef LT_OBJDIR

 /* Name of package */
--- a/1944
+++ b/1944
--- a/configure.ac
+++ b/configure.ac
@@ -18,15 +18,15 @@ AC_PREREQ(2.59)

 dnl Version number stuff here:

-AC_INIT([libpng], [1.5.20beta01], [png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng], [1.5.22beta02], [png-mng-implement@lists.sourceforge.net])
 AM_INIT_AUTOMAKE([1.13 serial-tests subdir-objects])
 dnl stop configure from automagically running automake
 AM_MAINTAINER_MODE

-PNGLIB_VERSION=1.5.20beta01
+PNGLIB_VERSION=1.5.22beta02
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=5
-PNGLIB_RELEASE=20
+PNGLIB_RELEASE=22

 dnl End of version number stuff

--- a/libpng-manual.txt
+++ b/libpng-manual.txt
@@ -1,6 +1,6 @@
 Libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.5.20beta01 - November 6, 2014
+ libpng version 1.5.22beta02 - February 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2014 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ Libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.5.20beta01 - November 6, 2014
+ libpng versions 0.97, January 1998, through 1.5.22beta02 - February 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2014 Glenn Randers-Pehrson

@@ -4531,13 +4531,13 @@ Other rules can be inferred by inspecting the libpng source.

 XIV. Y2K Compliance in libpng

-November 6, 2014
+February 17, 2015

 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.5.20beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.5.22beta02 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer that
--- a/libpng.3
+++ b/libpng.3
@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "November 6, 2014"
+.TH LIBPNG 3 "February 17, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.5.20beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.5.22beta02
 .SH SYNOPSIS
 \fB
 #include <png.h>\fP
@@ -492,7 +492,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 Libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.5.20beta01 - November 6, 2014
+ libpng version 1.5.22beta02 - February 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2014 Glenn Randers-Pehrson
@@ -503,7 +503,7 @@ Libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.5.20beta01 - November 6, 2014
+ libpng versions 0.97, January 1998, through 1.5.22beta02 - February 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2014 Glenn Randers-Pehrson

@@ -5023,13 +5023,13 @@ Other rules can be inferred by inspecting the libpng source.

 .SH XIV. Y2K Compliance in libpng

-November 6, 2014
+February 17, 2015

 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.5.20beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.5.22beta02 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer that
@@ -5267,7 +5267,13 @@ the first widely used release:
 1.5.19beta01-05     15    10519  15.so.15.19[.0]
 1.5.19rc01          15    10519  15.so.15.19[.0]
 1.5.19              15    10519  15.so.15.19[.0]
- 1.5.20beta01        15    10520  15.so.15.20[.0]
+ 1.5.20beta01-02     15    10520  15.so.15.20[.0]
+ 1.5.20rc01-03       15    10520  15.so.15.20[.0]
+ 1.5.20              15    10520  15.so.15.20[.0]
+ 1.5.21beta01-02     15    10521  15.so.15.21[.0]
+ 1.5.21rc01-03       15    10521  15.so.15.21[.0]
+ 1.5.21              15    10521  15.so.15.21[.0]
+ 1.5.22beta01-02     15    10522  15.so.15.22[.0]

 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -5324,7 +5330,7 @@ possible without all of you.

 Thanks to Frank J. T. Wojcik for helping with the documentation.

-Libpng version 1.5.20beta01 - November 6, 2014:
+Libpng version 1.5.22beta02 - February 17, 2015:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).

@@ -5347,7 +5353,7 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.2.6, August 15, 2004, through 1.5.20beta01, November 6, 2014, are
+libpng versions 1.2.6, August 15, 2004, through 1.5.22beta02, February 17, 2015, are
 Copyright (c) 2004,2006-20014 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -5446,7 +5452,7 @@ certification mark of the Open Source Initiative.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 6, 2014
+February 17, 2015

 .\" end of man page

--- a/libpngpf.3
+++ b/libpngpf.3
@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "November 6, 2014"
+.TH LIBPNGPF 3 "February 17, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.5.20beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.5.22beta02
 (private functions)
 .SH SYNOPSIS
 \fB#include \fI"pngpriv.h"
--- a/ltmain.sh
+++ b/ltmain.sh
--- a/png.5
+++ b/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "November 6, 2014"
+.TH PNG 5 "February 17, 2015"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
--- a/png.c
+++ b/png.c
@@ -1,8 +1,8 @@

 /* png.c - location for general purpose libpng functions
 *
- * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.22 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -14,7 +14,7 @@
 #include "pngpriv.h"

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_20beta01 Your_png_h_is_not_version_1_5_20beta01;
+typedef png_libpng_version_1_5_22beta02 Your_png_h_is_not_version_1_5_22beta02;

 /* Tells libpng that we have already handled the first "num_bytes" bytes
 * of the PNG file signature.  If the PNG data is embedded into another
@@ -149,9 +149,10 @@ png_calculate_crc(png_structp png_ptr, png_const_bytep ptr, png_size_t length)
      do
      {
         uInt safeLength = (uInt)length;
+#ifndef __COVERITY__
         if (safeLength == 0)
            safeLength = (uInt)-1; /* evil, but safe */
-
+#endif
         crc = crc32(crc, ptr, safeLength);

         /* The following should never issue compiler warnings, if they do the
@@ -660,14 +661,14 @@ png_get_copyright(png_const_structp png_ptr)
 #else
 #  ifdef __STDC__
   return PNG_STRING_NEWLINE \
-     "libpng version 1.5.20beta01 - November 6, 2014" PNG_STRING_NEWLINE \
-     "Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
+     "libpng version 1.5.22beta02 - February 17, 2015" PNG_STRING_NEWLINE \
+     "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
     "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
     "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
     PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.5.20beta01 - November 6, 2014\
-      Copyright (c) 1998-2014 Glenn Randers-Pehrson\
+      return "libpng version 1.5.22beta02 - February 17, 2015\
+      Copyright (c) 1998-2015 Glenn Randers-Pehrson\
      Copyright (c) 1996-1997 Andreas Dilger\
      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
 #  endif
@@ -1170,6 +1171,17 @@ int png_XYZ_from_xy_checked(png_structp png_ptr, png_XYZ *XYZ, png_xy xy)
 }
 #endif

+#ifdef __GNUC__
+/* This exists solely to work round a warning from GNU C. */
+static int /* PRIVATE */
+png_gt(size_t a, size_t b)
+{
+    return a > b;
+}
+#else
+#   define png_gt(a,b) ((a) > (b))
+#endif
+
 void /* PRIVATE */
 png_check_IHDR(png_structp png_ptr,
   png_uint_32 width, png_uint_32 height, int bit_depth,
@@ -1189,6 +1201,28 @@ png_check_IHDR(png_structp png_ptr,
      png_warning(png_ptr, "Invalid image width in IHDR");
      error = 1;
   }
+
+   else if (png_gt(width,
+                   (PNG_SIZE_MAX >> 3) /* 8-byte RGBA pixels */
+                   - 48                /* big_row_buf hack */
+                   - 1                 /* filter byte */
+                   - 7*8               /* rounding width to multiple of 8 pix */
+                   - 8))               /* extra max_pixel_depth pad */
+   {
+      /* The size of the row must be within the limits of this architecture.
+       * Because the read code can perform arbitrary transformations the
+       * maximum size is checked here.  Because the code in png_read_start_row
+       * adds extra space "for safety's sake" in several places a conservative
+       * limit is used here.
+       *
+       * NOTE: it would be far better to check the size that is actually used,
+       * but the effect in the real world is minor and the changes are more
+       * extensive, therefore much more dangerous and much more difficult to
+       * write in a way that avoids compiler warnings.
+       */
+      png_warning(png_ptr, "Image width is too large for this architecture");
+      error = 1;
+   }
   else
   {
 #     ifdef PNG_SET_USER_LIMITS_SUPPORTED
@@ -2048,17 +2082,20 @@ png_muldiv_warn(png_structp png_ptr, png_fixed_point a, png_int_32 times,
 png_fixed_point
 png_reciprocal(png_fixed_point a)
 {
+   if (a != 0)
+   {
 #ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
-   double r = floor(1E10/a+.5);
+     double r = floor(1E10/a+.5);

-   if (r <= 2147483647. && r >= -2147483648.)
-      return (png_fixed_point)r;
+     if (r <= 2147483647. && r >= -2147483648.)
+        return (png_fixed_point)r;
 #else
-   png_fixed_point res;
+     png_fixed_point res;

-   if (png_muldiv(&res, 100000, 100000, a))
-      return res;
+     if (png_muldiv(&res, 100000, 100000, a))
+        return res;
 #endif
+   }

   return 0; /* error/overflow */
 }
@@ -2093,23 +2130,26 @@ png_reciprocal2(png_fixed_point a, png_fixed_point b)
 {
   /* The required result is 1/a * 1/b; the following preserves accuracy. */
 #ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
-   double r = 1E15/a;
-   r /= b;
-   r = floor(r+.5);
+   if (a != 0 && b != 0)
+   {
+      double r = 1E15/a;
+      r /= b;
+      r = floor(r+.5);

-   if (r <= 2147483647. && r >= -2147483648.)
-      return (png_fixed_point)r;
+      if (r <= 2147483647. && r >= -2147483648.)
+         return (png_fixed_point)r;
 #else
-   /* This may overflow because the range of png_fixed_point isn't symmetric,
-    * but this API is only used for the product of file and screen gamma so it
-    * doesn't matter that the smallest number it can produce is 1/21474, not
-    * 1/100000
-    */
-   png_fixed_point res = png_product2(a, b);
+      /* This may overflow because the range of png_fixed_point isn't
+       * symmetric, but this API is only used for the product of file and
+       * screen gamma so it doesn't matter that the smallest number it can
+       * produce is 1/21474, not 1/100000
+       */
+      png_fixed_point res = png_product2(a, b);

-   if (res != 0)
-      return png_reciprocal(res);
+      if (res != 0)
+         return png_reciprocal(res);
 #endif
+   }

   return 0; /* overflow */
 }
--- a/png.h
+++ b/png.h
@@ -1,8 +1,8 @@

 /* png.h - header file for PNG reference library
 *
- * libpng version 1.5.20beta01 - November 6, 2014
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * libpng version 1.5.22beta02 - February 17, 2015
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -11,7 +11,7 @@
 * Authors and maintainers:
 *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
 *   libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.5.20beta01 - November 6, 2014: Glenn
+ *   libpng versions 0.97, January 1998, through 1.5.22beta02 - February 17, 2015: Glenn
 *   See also "Contributing Authors", below.
 *
 * Note about libpng version numbers:
@@ -199,7 +199,13 @@
 *    1.5.19beta01-05         15    10519  15.so.15.19[.0]
 *    1.5.19rc01              15    10519  15.so.15.19[.0]
 *    1.5.19                  15    10519  15.so.15.19[.0]
- *    1.5.20beta01            15    10520  15.so.15.20[.0]
+ *    1.5.20beta01-02         15    10520  15.so.15.20[.0]
+ *    1.5.20rc01-03           15    10520  15.so.15.20[.0]
+ *    1.5.20                  15    10520  15.so.15.20[.0]
+ *    1.5.21beta01-02         15    10521  15.so.15.21[.0]
+ *    1.5.21rc01-03           15    10521  15.so.15.21[.0]
+ *    1.5.21                  15    10521  15.so.15.21[.0]
+ *    1.5.22beta01-02         15    10522  15.so.15.22[.0]
 *
 *   Henceforth the source version will match the shared-library major
 *   and minor numbers; the shared-library major version number will be
@@ -231,8 +237,8 @@
 *
 * This code is released under the libpng license.
 *
- * libpng versions 1.2.6, August 15, 2004, through 1.5.20beta01, November 6, 2014, are
- * Copyright (c) 2004, 2006-2014 Glenn Randers-Pehrson, and are
+ * libpng versions 1.2.6, August 15, 2004, through 1.5.22beta02, February 17, 2015, are
+ * Copyright (c) 2004, 2006-2015 Glenn Randers-Pehrson, and are
 * distributed according to the same disclaimer and license as libpng-1.2.5
 * with the following individual added to the list of Contributing Authors:
 *
@@ -343,13 +349,13 @@
 * Y2K compliance in libpng:
 * =========================
 *
- *    November 6, 2014
+ *    February 17, 2015
 *
 *    Since the PNG Development group is an ad-hoc body, we can't make
 *    an official declaration.
 *
 *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.5.20beta01 are Y2K compliant.  It is my belief that
+ *    upward through 1.5.22beta02 are Y2K compliant.  It is my belief that
 *    earlier versions were also Y2K compliant.
 *
 *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -410,9 +416,9 @@
 */

 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.5.20beta01"
+#define PNG_LIBPNG_VER_STRING "1.5.22beta02"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.5.20beta01 - November 6, 2014\n"
+     " libpng version 1.5.22beta02 - February 17, 2015\n"

 #define PNG_LIBPNG_VER_SONUM   15
 #define PNG_LIBPNG_VER_DLLNUM  15
@@ -420,13 +426,13 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   5
-#define PNG_LIBPNG_VER_RELEASE 20
+#define PNG_LIBPNG_VER_RELEASE 22

 /* This should match the numeric part of the final component of
 * PNG_LIBPNG_VER_STRING, omitting any leading zero:
 */

-#define PNG_LIBPNG_VER_BUILD  01
+#define PNG_LIBPNG_VER_BUILD  02

 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -451,7 +457,7 @@
 * version 1.0.0 was mis-numbered 100 instead of 10000).  From
 * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
 */
-#define PNG_LIBPNG_VER 10520 /* 1.5.20 */
+#define PNG_LIBPNG_VER 10522 /* 1.5.22 */

 /* Library configuration: these options cannot be changed after
 * the library has been built.
@@ -573,7 +579,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
 * do not agree upon the version number.
 */
-typedef char* png_libpng_version_1_5_20beta01;
+typedef char* png_libpng_version_1_5_22beta02;

 /* Three color definitions.  The order of the red, green, and blue, (and the
 * exact size) is not important, although the size of the fields need to
--- a/pngconf.h
+++ b/pngconf.h
@@ -1,7 +1,7 @@

 /* pngconf.h - machine configurable file for libpng
 *
- * libpng version 1.5.20beta01 - November 6, 2014
+ * libpng version 1.5.22beta02 - February 17, 2015
 *
 * Copyright (c) 1998-2013 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
--- a/pngpriv.h
+++ b/pngpriv.h
@@ -188,36 +188,6 @@
 * real system capabilities.
 */

-#ifdef PNG_SAFE_LIMITS_SUPPORTED
-   /* 'safe' limits */
-#  ifndef PNG_USER_WIDTH_MAX
-#     define PNG_USER_WIDTH_MAX 1000000
-#  endif
-#  ifndef PNG_USER_HEIGHT_MAX
-#     define PNG_USER_HEIGHT_MAX 1000000
-#  endif
-#  ifndef PNG_USER_CHUNK_CACHE_MAX
-#     define PNG_USER_CHUNK_CACHE_MAX 128
-#  endif
-#  ifndef PNG_USER_CHUNK_MALLOC_MAX
-#     define PNG_USER_CHUNK_MALLOC_MAX 8000000
-#  endif
-#else
-   /* values for no limits */
-#  ifndef PNG_USER_WIDTH_MAX
-#     define PNG_USER_WIDTH_MAX 0x7fffffff
-#  endif
-#  ifndef PNG_USER_HEIGHT_MAX
-#     define PNG_USER_HEIGHT_MAX 0x7fffffff
-#  endif
-#  ifndef PNG_USER_CHUNK_CACHE_MAX
-#     define PNG_USER_CHUNK_CACHE_MAX 0
-#  endif
-#  ifndef PNG_USER_CHUNK_MALLOC_MAX
-#     define PNG_USER_CHUNK_MALLOC_MAX 0
-#  endif
-#endif
-
 /* config.h is created by and PNG_CONFIGURE_LIBPNG is set by the "configure"
 * script.  We may need it here to get the correct configuration on things
 * like limits.
@@ -228,9 +198,11 @@
 #  endif
 #endif

-/* Moved to pngpriv.h at libpng-1.5.0 */
-/* NOTE: some of these may have been used in external applications as
- * these definitions were exposed in pngconf.h prior to 1.5.
+/* SECURITY and SAFETY:
+ *
+ * libpng is built with support for internal limits on image dimensions and
+ * memory usage.  These are documented in scripts/pnglibconf.dfa of the
+ * source and recorded in the machine generated header file pnglibconf.h.
 */

 /* If you are running on a machine where you cannot allocate more
@@ -248,6 +220,11 @@
 #  define PNG_MAX_MALLOC_64K
 #endif

+/* Moved to pngpriv.h at libpng-1.5.0 */
+/* NOTE: some of these may have been used in external applications as
+ * these definitions were exposed in pngconf.h prior to 1.5.
+ */
+
 #ifndef PNG_UNUSED
 /* Unused formal parameter warnings are silenced using the following macro
 * which is expected to have no bad effects on performance (optimizing
@@ -418,7 +395,7 @@
 #    define CVT_PTR_NOCHECK(ptr) (ptr)
 #    define png_strlen  lstrlenA
 #    define png_memcmp  memcmp
-#    define png_memcpy  CopyMemory
+#    define png_memcpy  memcpy
 #    define png_memset  memset
 #  else
 #    define CVT_PTR(ptr)         (ptr)
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -1,8 +1,8 @@

 /* pngrtran.c - transforms the data in a row for PNG readers
 *
- * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.22 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -971,7 +971,7 @@ png_set_rgb_to_gray_fixed(png_structp png_ptr, int error_action,
         png_uint_16 red_int, green_int;

         /* NOTE: this calculation does not round, but this behavior is retained
-          * for consistency, the inaccuracy is very small.  The code here always
+          * for consistency; the inaccuracy is very small.  The code here always
          * overwrites the coefficients, regardless of whether they have been
          * defaulted or set already.
          */
@@ -1070,7 +1070,7 @@ png_gamma_threshold(png_fixed_point screen_gamma, png_fixed_point file_gamma)
 * the palette.
 */

-/*For the moment 'png_init_palette_transformations' and
+/* For the moment 'png_init_palette_transformations' and
 * 'png_init_rgb_transformations' only do some flag canceling optimizations.
 * The intent is that these two routines should have palette or rgb operations
 * extracted from 'png_init_read_transformations'.
@@ -1321,7 +1321,7 @@ png_init_read_transformations(png_structp png_ptr)
 #endif

   /* Certain transformations have the effect of preventing other
-    * transformations that happen afterward in png_do_read_transformations,
+    * transformations that happen afterward in png_do_read_transformations;
    * resolve the interdependencies here.  From the code of
    * png_do_read_transformations the order is:
    *
@@ -3341,11 +3341,17 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
            for (i = 0; i < row_width; i++)
            {
               png_uint_16 red, green, blue, w;
-
+#if 0 /* Coverity doesn't like this */
               red   = (png_uint_16)(((*(sp))<<8) | *(sp + 1)); sp += 2;
               green = (png_uint_16)(((*(sp))<<8) | *(sp + 1)); sp += 2;
               blue  = (png_uint_16)(((*(sp))<<8) | *(sp + 1)); sp += 2;
+#else
+               png_byte hi,lo;

+               hi=*(sp)++; lo=*(sp)++; red   = (png_uint_16)((hi << 8) | (lo));
+               hi=*(sp)++; lo=*(sp)++; green = (png_uint_16)((hi << 8) | (lo));
+               hi=*(sp)++; lo=*(sp)++; blue  = (png_uint_16)((hi << 8) | (lo));
+#endif
               if (red == green && red == blue)
               {
                  if (png_ptr->gamma_16_table != NULL)
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,8 +1,8 @@

 /* pngrutil.c - utilities to read a PNG file
 *
- * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.22 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -2549,20 +2549,23 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    * compression type]".  The compression flag shall be 0 (no compression) or
    * 1 (compressed with method 0 - deflate.)
    */
-   if (comp_flag != 0 && comp_flag != 1)
+   if (comp_flag/*compressed*/ != 0)
   {
-      png_warning(png_ptr, "invalid iTXt compression flag");
-      png_free(png_ptr, png_ptr->chunkdata);
-      png_ptr->chunkdata = NULL;
-      return;
-   }
+     if (comp_flag != 1)
+     {
+        png_warning(png_ptr, "invalid iTXt compression flag");
+        png_free(png_ptr, png_ptr->chunkdata);
+        png_ptr->chunkdata = NULL;
+        return;
+     }

-   if (comp_flag/*compressed*/ && comp_type != 0)
-   {
-      png_warning(png_ptr, "unknown iTXt compression type");
-      png_free(png_ptr, png_ptr->chunkdata);
-      png_ptr->chunkdata = NULL;
-      return;
+     if (comp_type != 0)
+     {
+        png_warning(png_ptr, "unknown iTXt compression type");
+        png_free(png_ptr, png_ptr->chunkdata);
+        png_ptr->chunkdata = NULL;
+        return;
+     }
   }

   for (lang_key = lang; *lang_key; lang_key++)
@@ -2805,7 +2808,7 @@ png_combine_row(png_structp png_ptr, png_bytep dp, int display)
 {
   unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
   png_const_bytep sp = png_ptr->row_buf + 1;
-   png_uint_32 row_width = png_ptr->width;
+   png_alloc_size_t row_width = png_ptr->width;
   unsigned int pass = png_ptr->pass;
   png_bytep end_ptr = 0;
   png_byte end_byte = 0;
@@ -3078,7 +3081,7 @@ png_combine_row(png_structp png_ptr, png_bytep dp, int display)

            /* But don't allow this number to exceed the actual row width. */
            if (bytes_to_copy > row_width)
-               bytes_to_copy = row_width;
+               bytes_to_copy = (unsigned int)/*SAFE*/row_width;
         }

         else /* normal row; Adam7 only ever gives us one pixel to copy. */
@@ -3256,7 +3259,7 @@ png_combine_row(png_structp png_ptr, png_bytep dp, int display)
                  dp += bytes_to_jump;
                  row_width -= bytes_to_jump;
                  if (bytes_to_copy > row_width)
-                     bytes_to_copy = row_width;
+                     bytes_to_copy = (unsigned int)/*SAFE*/row_width;
               }
         }

--- a/pngset.c
+++ b/pngset.c
@@ -1,8 +1,8 @@

 /* pngset.c - storage of image information into info struct
 *
- * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.22 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -671,6 +671,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
    png_const_textp text_ptr, int num_text)
 {
   int i;
+   size_t element_size;

   png_debug1(1, "in %lx storage function", png_ptr == NULL ? "unexpected" :
      (unsigned long)png_ptr->chunk_name);
@@ -682,11 +683,12 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
    * to hold all of the incoming text_ptr objects.
    */

+   element_size=png_sizeof(png_text);
   if (num_text < 0 ||
       num_text > INT_MAX - info_ptr->num_text - 8 ||
       (unsigned int)/*SAFE*/(num_text +/*SAFE*/
       info_ptr->num_text + 8) >=
-       PNG_SIZE_MAX/png_sizeof(png_text))
+       PNG_SIZE_MAX/element_size)
   {
      png_warning(png_ptr, "too many text chunks");
      return(0);
@@ -924,16 +926,19 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,

   if (trans_color != NULL)
   {
-      int sample_max = (1 << info_ptr->bit_depth);
+      if (info_ptr->bit_depth < 16)
+      {
+         unsigned int sample_max = (1U << info_ptr->bit_depth) - 1U;

-      if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY &&
-          (int)trans_color->gray > sample_max) ||
-          (info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
-          ((int)trans_color->red > sample_max ||
-          (int)trans_color->green > sample_max ||
-          (int)trans_color->blue > sample_max)))
-         png_warning(png_ptr,
-            "tRNS chunk has out-of-range samples for bit_depth");
+         if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY &&
+             trans_color->gray > sample_max) ||
+             (info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
+             (trans_color->red > sample_max ||
+             trans_color->green > sample_max ||
+             trans_color->blue > sample_max)))
+           png_warning(png_ptr,
+              "tRNS chunk has out-of-range samples for bit_depth");
+      }

      png_memcpy(&(info_ptr->trans_color), trans_color,
         png_sizeof(png_color_16));
@@ -967,15 +972,17 @@ png_set_sPLT(png_structp png_ptr,
 {
   png_sPLT_tp np;
   int i;
+   size_t element_size;

   if (png_ptr == NULL || info_ptr == NULL)
      return;

+   element_size = PNG_SIZE_MAX/png_sizeof(png_sPLT_t);
   if (nentries < 0 ||
       nentries > INT_MAX-info_ptr->splt_palettes_num ||
       (unsigned int)/*SAFE*/(nentries +/*SAFE*/
       info_ptr->splt_palettes_num) >=
-       PNG_SIZE_MAX/png_sizeof(png_sPLT_t))
+       PNG_SIZE_MAX/element_size)
      np=NULL;

   else
@@ -1046,15 +1053,17 @@ png_set_unknown_chunks(png_structp png_ptr,
 {
   png_unknown_chunkp np;
   int i;
+   size_t element_size;

   if (png_ptr == NULL || info_ptr == NULL || num_unknowns == 0)
      return;

+   element_size = PNG_SIZE_MAX/png_sizeof(png_unknown_chunk);
   if (num_unknowns < 0 ||
       num_unknowns > INT_MAX-info_ptr->unknown_chunks_num ||
       (unsigned int)/*SAFE*/(num_unknowns +/*SAFE*/
       info_ptr->unknown_chunks_num) >=
-       PNG_SIZE_MAX/png_sizeof(png_unknown_chunk))
+       PNG_SIZE_MAX/element_size)
      np=NULL;

   else
--- a/pngtest.c
+++ b/pngtest.c
@@ -1,8 +1,7 @@
-
 /* pngtest.c - a simple test program to test libpng
 *
- * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.22 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -283,7 +282,8 @@ count_zero_samples(png_structp png_ptr, png_row_infop row_info, png_bytep data)
       png_uint_32 n, nstop;
       int channel;
       int color_channels = row_info->channels;
-       if (row_info->color_type > 3)color_channels--;
+       if (row_info->color_type > 3)
+          color_channels--;

       for (n = 0, nstop=row_info->width; n<nstop; n++)
       {
@@ -310,7 +310,7 @@ count_zero_samples(png_structp png_ptr, png_row_infop row_info, png_bytep data)
       }
    }
 }
-#endif /* PNG_WRITE_USER_TRANSFORM_SUPPORTED */
+#endif /* WRITE_USER_TRANSFORM */

 #ifndef PNG_STDIO_SUPPORTED
 /* START of code to validate stdio-free compilation */
@@ -419,7 +419,7 @@ pngtest_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
   pngtest_check_io_state(png_ptr, length, PNG_IO_WRITING);
 #endif
 }
-#endif /* !PNG_STDIO_SUPPORTED */
+#endif /* !STDIO */

 /* This function is called when there is a warning, but the library thinks
 * it can continue anyway.  Replacement functions don't have to do anything
@@ -588,7 +588,7 @@ png_debug_free(png_structp png_ptr, png_voidp ptr)

         if (pinfo->next == NULL)
         {
-            fprintf(STDERR, "Pointer %x not found\n", (unsigned int)ptr);
+            fprintf(STDERR, "Pointer %p not found\n", ptr);
            break;
         }

@@ -604,7 +604,7 @@ png_debug_free(png_structp png_ptr, png_voidp ptr)
      free(ptr);
   ptr = NULL;
 }
-#endif /* PNG_USER_MEM_SUPPORTED && PNG_DEBUG */
+#endif /* USER_MEM && DEBUG */
 /* END of code to test memory allocation/deallocation */


@@ -643,7 +643,7 @@ set_location(png_structp png_ptr, struct user_chunk_data *data, int what)
 {
   int location;

-   if ((data->location[0] & what) || (data->location[1] & what))
+   if ((data->location[0] & what) != 0 || (data->location[1] & what) != 0)
      return 0; /* already have one of these */

   /* Find where we are (the code below zeroes info_ptr to indicate that the
@@ -652,7 +652,7 @@ set_location(png_structp png_ptr, struct user_chunk_data *data, int what)
   if (data->info_ptr == NULL) /* after IDAT */
      location = what | after_IDAT;

-   else if (png_get_valid(png_ptr, data->info_ptr, PNG_INFO_PLTE))
+   else if (png_get_valid(png_ptr, data->info_ptr, PNG_INFO_PLTE) != 0)
      location = what | before_IDAT;

   else
@@ -667,8 +667,8 @@ set_location(png_structp png_ptr, struct user_chunk_data *data, int what)
   return 1; /* handled */
 }

-static int PNGCBAPI read_user_chunk_callback(png_struct *png_ptr,
-   png_unknown_chunkp chunk)
+static int PNGCBAPI
+read_user_chunk_callback(png_struct *png_ptr, png_unknown_chunkp chunk)
 {
   struct user_chunk_data *my_user_chunk_data =
      (struct user_chunk_data*)png_get_user_chunk_ptr(png_ptr);
@@ -699,7 +699,7 @@ static int PNGCBAPI read_user_chunk_callback(png_struct *png_ptr,
         if (chunk->data[0] != 0 && chunk->data[0] != 1)
            return (-1);  /* Invalid mode */

-         if (set_location(png_ptr, my_user_chunk_data, have_sTER))
+         if (set_location(png_ptr, my_user_chunk_data, have_sTER) != 0)
         {
            my_user_chunk_data->sTER_mode=chunk->data[0];
            return (1);
@@ -718,7 +718,7 @@ static int PNGCBAPI read_user_chunk_callback(png_struct *png_ptr,
   if (chunk->size != 9)
      return (-1); /* Error return */

-   if (!set_location(png_ptr, my_user_chunk_data, have_vpAg))
+   if (set_location(png_ptr, my_user_chunk_data, have_vpAg) == 0)
      return (0);  /* duplicate vpAg */

   my_user_chunk_data->vpAg_width = png_get_uint_31(png_ptr, chunk->data);
@@ -779,8 +779,8 @@ write_chunks(png_structp write_ptr, int location)
         write_vpAg_chunk(write_ptr);
   }
 }
-#endif /* PNG_WRITE_SUPPORTED */
-#else /* !PNG_READ_USER_CHUNKS_SUPPORTED */
+#endif /* WRITE */
+#else /* !READ_USER_CHUNKS */
 #  define write_chunks(pp,loc) ((void)0)
 #endif
 /* END of code to demonstrate user chunk support */
@@ -1049,7 +1049,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      int interlace_type, compression_type, filter_type;

      if (png_get_IHDR(read_ptr, read_info_ptr, &width, &height, &bit_depth,
-          &color_type, &interlace_type, &compression_type, &filter_type))
+          &color_type, &interlace_type, &compression_type, &filter_type) != 0)
      {
         png_set_IHDR(write_ptr, write_info_ptr, width, height, bit_depth,
            color_type, interlace_type, compression_type, filter_type);
@@ -1082,7 +1082,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         blue_y;

      if (png_get_cHRM_fixed(read_ptr, read_info_ptr, &white_x, &white_y,
-         &red_x, &red_y, &green_x, &green_y, &blue_x, &blue_y))
+         &red_x, &red_y, &green_x, &green_y, &blue_x, &blue_y) != 0)
      {
         png_set_cHRM_fixed(write_ptr, write_info_ptr, white_x, white_y, red_x,
            red_y, green_x, green_y, blue_x, blue_y);
@@ -1093,7 +1093,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   {
      png_fixed_point gamma;

-      if (png_get_gAMA_fixed(read_ptr, read_info_ptr, &gamma))
+      if (png_get_gAMA_fixed(read_ptr, read_info_ptr, &gamma) != 0)
         png_set_gAMA_fixed(write_ptr, write_info_ptr, gamma);
   }
 #endif
@@ -1105,7 +1105,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         blue_y;

      if (png_get_cHRM(read_ptr, read_info_ptr, &white_x, &white_y, &red_x,
-         &red_y, &green_x, &green_y, &blue_x, &blue_y))
+         &red_y, &green_x, &green_y, &blue_x, &blue_y) != 0)
      {
         png_set_cHRM(write_ptr, write_info_ptr, white_x, white_y, red_x,
            red_y, green_x, green_y, blue_x, blue_y);
@@ -1116,7 +1116,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   {
      double gamma;

-      if (png_get_gAMA(read_ptr, read_info_ptr, &gamma))
+      if (png_get_gAMA(read_ptr, read_info_ptr, &gamma) != 0)
         png_set_gAMA(write_ptr, write_info_ptr, gamma);
   }
 #endif
@@ -1130,7 +1130,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      int compression_type;

      if (png_get_iCCP(read_ptr, read_info_ptr, &name, &compression_type,
-                      &profile, &proflen))
+                      &profile, &proflen) != 0)
      {
         png_set_iCCP(write_ptr, write_info_ptr, name, compression_type,
                      profile, proflen);
@@ -1141,7 +1141,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   {
      int intent;

-      if (png_get_sRGB(read_ptr, read_info_ptr, &intent))
+      if (png_get_sRGB(read_ptr, read_info_ptr, &intent) != 0)
         png_set_sRGB(write_ptr, write_info_ptr, intent);
   }
 #endif
@@ -1149,14 +1149,14 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      png_colorp palette;
      int num_palette;

-      if (png_get_PLTE(read_ptr, read_info_ptr, &palette, &num_palette))
+      if (png_get_PLTE(read_ptr, read_info_ptr, &palette, &num_palette) != 0)
         png_set_PLTE(write_ptr, write_info_ptr, palette, num_palette);
   }
 #ifdef PNG_bKGD_SUPPORTED
   {
      png_color_16p background;

-      if (png_get_bKGD(read_ptr, read_info_ptr, &background))
+      if (png_get_bKGD(read_ptr, read_info_ptr, &background) != 0)
      {
         png_set_bKGD(write_ptr, write_info_ptr, background);
      }
@@ -1166,7 +1166,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   {
      png_uint_16p hist;

-      if (png_get_hIST(read_ptr, read_info_ptr, &hist))
+      if (png_get_hIST(read_ptr, read_info_ptr, &hist) != 0)
         png_set_hIST(write_ptr, write_info_ptr, hist);
   }
 #endif
@@ -1176,7 +1176,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      int unit_type;

      if (png_get_oFFs(read_ptr, read_info_ptr, &offset_x, &offset_y,
-          &unit_type))
+          &unit_type) != 0)
      {
         png_set_oFFs(write_ptr, write_info_ptr, offset_x, offset_y, unit_type);
      }
@@ -1190,7 +1190,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      int type, nparams;

      if (png_get_pCAL(read_ptr, read_info_ptr, &purpose, &X0, &X1, &type,
-         &nparams, &units, &params))
+         &nparams, &units, &params) != 0)
      {
         png_set_pCAL(write_ptr, write_info_ptr, purpose, X0, X1, type,
            nparams, units, params);
@@ -1202,7 +1202,8 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      png_uint_32 res_x, res_y;
      int unit_type;

-      if (png_get_pHYs(read_ptr, read_info_ptr, &res_x, &res_y, &unit_type))
+      if (png_get_pHYs(read_ptr, read_info_ptr, &res_x, &res_y,
+          &unit_type) != 0)
         png_set_pHYs(write_ptr, write_info_ptr, res_x, res_y, unit_type);
   }
 #endif
@@ -1210,7 +1211,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   {
      png_color_8p sig_bit;

-      if (png_get_sBIT(read_ptr, read_info_ptr, &sig_bit))
+      if (png_get_sBIT(read_ptr, read_info_ptr, &sig_bit) != 0)
         png_set_sBIT(write_ptr, write_info_ptr, sig_bit);
   }
 #endif
@@ -1222,7 +1223,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      double scal_width, scal_height;

      if (png_get_sCAL(read_ptr, read_info_ptr, &unit, &scal_width,
-         &scal_height))
+         &scal_height) != 0)
      {
         png_set_sCAL(write_ptr, write_info_ptr, unit, scal_width, scal_height);
      }
@@ -1234,7 +1235,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      png_charp scal_width, scal_height;

      if (png_get_sCAL_s(read_ptr, read_info_ptr, &unit, &scal_width,
-          &scal_height))
+          &scal_height) != 0)
      {
         png_set_sCAL_s(write_ptr, write_info_ptr, unit, scal_width,
             scal_height);
@@ -1274,7 +1275,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   {
      png_timep mod_time;

-      if (png_get_tIME(read_ptr, read_info_ptr, &mod_time))
+      if (png_get_tIME(read_ptr, read_info_ptr, &mod_time) != 0)
      {
         png_set_tIME(write_ptr, write_info_ptr, mod_time);
 #ifdef PNG_TIME_RFC1123_SUPPORTED
@@ -1283,12 +1284,12 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
          * we use it.
          */
         memcpy(tIME_string,
-                    png_convert_to_rfc1123(read_ptr, mod_time),
-                    png_sizeof(tIME_string));
+                png_convert_to_rfc1123(read_ptr, mod_time),
+                png_sizeof(tIME_string));

         tIME_string[png_sizeof(tIME_string) - 1] = '\0';
         tIME_chunk_present++;
-#endif /* PNG_TIME_RFC1123_SUPPORTED */
+#endif /* TIME_RFC1123 */
      }
   }
 #endif
@@ -1299,7 +1300,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      png_color_16p trans_color;

      if (png_get_tRNS(read_ptr, read_info_ptr, &trans_alpha, &num_trans,
-         &trans_color))
+         &trans_color) != 0)
      {
         int sample_max = (1 << bit_depth);
         /* libpng doesn't reject a tRNS chunk with out-of-range samples */
@@ -1382,11 +1383,12 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      {
 #ifndef SINGLE_ROWBUF_ALLOC
         pngtest_debug2("Allocating row buffer (pass %d, y = %u)...", pass, y);
+
         row_buf = (png_bytep)png_malloc(read_ptr,
            png_get_rowbytes(read_ptr, read_info_ptr));

-         pngtest_debug2("\t0x%08lx (%u bytes)", (unsigned long)row_buf,
-            png_get_rowbytes(read_ptr, read_info_ptr));
+         pngtest_debug2("\t0x%08lx (%lu bytes)", (unsigned long)row_buf,
+            (unsigned long)png_get_rowbytes(read_ptr, read_info_ptr));

 #endif /* !SINGLE_ROWBUF_ALLOC */
         png_read_rows(read_ptr, (png_bytepp)&row_buf, NULL, 1);
@@ -1403,7 +1405,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         t_encode += (t_stop - t_start);
         t_start = t_stop;
 #endif
-#endif /* PNG_WRITE_SUPPORTED */
+#endif /* WRITE */

 #ifndef SINGLE_ROWBUF_ALLOC
         pngtest_debug2("Freeing row buffer (pass %d, y = %u)", pass, y);
@@ -1456,7 +1458,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   {
      png_timep mod_time;

-      if (png_get_tIME(read_ptr, end_info_ptr, &mod_time))
+      if (png_get_tIME(read_ptr, end_info_ptr, &mod_time) != 0)
      {
         png_set_tIME(write_ptr, write_end_info_ptr, mod_time);
 #ifdef PNG_TIME_RFC1123_SUPPORTED
@@ -1464,12 +1466,12 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
            pointed to by png_convert_to_rfc1123() gets free'ed before
            we use it */
         memcpy(tIME_string,
-                    png_convert_to_rfc1123(read_ptr, mod_time),
-                    png_sizeof(tIME_string));
+                png_convert_to_rfc1123(read_ptr, mod_time),
+                png_sizeof(tIME_string));

         tIME_string[png_sizeof(tIME_string) - 1] = '\0';
         tIME_chunk_present++;
-#endif /* PNG_TIME_RFC1123_SUPPORTED */
+#endif /* TIME_RFC1123 */
      }
   }
 #endif
@@ -1674,7 +1676,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         }
      }
   }
-#endif /* PNG_WRITE_SUPPORTED */
+#endif /* WRITE */

   FCLOSE(fpin);
   FCLOSE(fpout);
@@ -1697,6 +1699,8 @@ main(int argc, char *argv[])
   int multiple = 0;
   int ierror = 0;

+   png_structp dummy_ptr;
+
   fprintf(STDERR, "\n Testing libpng version %s\n", PNG_LIBPNG_VER_STRING);
   fprintf(STDERR, "   with zlib   version %s\n", ZLIB_VERSION);
   fprintf(STDERR, "%s", png_get_copyright(NULL));
@@ -1779,10 +1783,11 @@ main(int argc, char *argv[])
      }
   }

-   if (!multiple && argc == 3 + verbose)
+   if (multiple == 0 && argc == 3 + verbose)
     outname = argv[2 + verbose];

-   if ((!multiple && argc > 3 + verbose) || (multiple && argc < 2))
+   if ((multiple == 0 && argc > 3 + verbose) ||
+       (multiple != 0 && argc < 2))
   {
     fprintf(STDERR,
       "usage: %s [infile.png] [outfile.png]\n\t%s -m {infile.png}\n",
@@ -1804,6 +1809,9 @@ main(int argc, char *argv[])
      {
         int kerror;
         fprintf(STDERR, "\n Testing %s:", argv[i]);
+#if PNG_DEBUG > 0
+         fprintf(STDERR, "\n");
+#endif
         kerror = test_one_file(argv[i], outname);
         if (kerror == 0)
         {
@@ -1818,16 +1826,14 @@ main(int argc, char *argv[])
 #endif
 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
            for (k = 0; k<256; k++)
-               if (filters_used[k])
+               if (filters_used[k] != 0)
                  fprintf(STDERR, " Filter %d was used %lu times\n",
                     k, (unsigned long)filters_used[k]);
 #endif
 #ifdef PNG_TIME_RFC1123_SUPPORTED
-         if (tIME_chunk_present != 0)
-            fprintf(STDERR, " tIME = %s\n", tIME_string);
-
-         tIME_chunk_present = 0;
-#endif /* PNG_TIME_RFC1123_SUPPORTED */
+             if (tIME_chunk_present != 0)
+                fprintf(STDERR, " tIME = %s\n", tIME_string);
+#endif /* TIME_RFC1123 */
         }

         else
@@ -1849,9 +1855,9 @@ main(int argc, char *argv[])

            while (pinfo != NULL)
            {
-               fprintf(STDERR, " %lu bytes at %x\n",
+               fprintf(STDERR, " %lu bytes at %p\n",
                 (unsigned long)pinfo->size,
-                 (unsigned int)pinfo->pointer);
+                 pinfo->pointer);
               pinfo = pinfo->next;
            }
         }
@@ -1885,7 +1891,12 @@ main(int argc, char *argv[])
            status_dots_requested = 0;

         if (i == 0 || verbose == 1 || ierror != 0)
+         {
            fprintf(STDERR, "\n Testing %s:", inname);
+#if PNG_DEBUG > 0
+            fprintf(STDERR, "\n");
+#endif
+         }

         kerror = test_one_file(inname, outname);

@@ -1904,21 +1915,26 @@ main(int argc, char *argv[])
 #endif
 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
                for (k = 0; k<256; k++)
-                   if (filters_used[k])
+                   if (filters_used[k] != 0)
                      fprintf(STDERR, " Filter %d was used %lu times\n",
                         k, (unsigned long)filters_used[k]);
 #endif
 #ifdef PNG_TIME_RFC1123_SUPPORTED
             if (tIME_chunk_present != 0)
                fprintf(STDERR, " tIME = %s\n", tIME_string);
-#endif /* PNG_TIME_RFC1123_SUPPORTED */
+#endif /* TIME_RFC1123 */
            }
         }

         else
         {
            if (verbose == 0 && i != 2)
+            {
               fprintf(STDERR, "\n Testing %s:", inname);
+#if PNG_DEBUG > 0
+               fprintf(STDERR, "\n");
+#endif
+            }

            fprintf(STDERR, " FAIL\n");
            ierror += kerror;
@@ -1937,8 +1953,8 @@ main(int argc, char *argv[])

             while (pinfo != NULL)
             {
-                fprintf(STDERR, " %lu bytes at %x\n",
-                   (unsigned long)pinfo->size, (unsigned int)pinfo->pointer);
+                fprintf(STDERR, " %lu bytes at %p\n",
+                   (unsigned long)pinfo->size, pinfo->pointer);
                pinfo = pinfo->next;
             }
          }
@@ -1976,6 +1992,24 @@ main(int argc, char *argv[])
   else
      fprintf(STDERR, " libpng FAILS test\n");

+   dummy_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
+   fprintf(STDERR, " Default limits:\n");
+   fprintf(STDERR, "  width_max  = %lu\n",
+      (unsigned long) png_get_user_width_max(dummy_ptr));
+   fprintf(STDERR, "  height_max = %lu\n",
+      (unsigned long) png_get_user_height_max(dummy_ptr));
+   if (png_get_chunk_cache_max(dummy_ptr) == 0)
+      fprintf(STDERR, "  cache_max  = unlimited\n");
+   else
+      fprintf(STDERR, "  cache_max  = %lu\n",
+         (unsigned long) png_get_chunk_cache_max(dummy_ptr));
+   if (png_get_chunk_malloc_max(dummy_ptr) == 0)
+      fprintf(STDERR, "  malloc_max = unlimited\n");
+   else
+      fprintf(STDERR, "  malloc_max = %lu\n",
+         (unsigned long) png_get_chunk_malloc_max(dummy_ptr));
+   png_destroy_read_struct(&dummy_ptr, NULL, NULL);
+
   return (int)(ierror != 0);
 }
 #else
@@ -1990,4 +2024,4 @@ main(void)
 #endif

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_20beta01 Your_png_h_is_not_version_1_5_20beta01;
+typedef png_libpng_version_1_5_22beta02 Your_png_h_is_not_version_1_5_22beta02;
--- a/pngusr.dfa
+++ b/pngusr.dfa
@@ -8,7 +8,7 @@
 # here by entering the appropriate values as #defines preceded by '@' (to cause,
 # them to be passed through to the build of pnglibconf.h), for example:
 #
-# @# define PNG_USER_WIDTH_MAX 1000000
-# @# define PNG_USER_HEIGHT_MAX 1000000
-# @# define PNG_USER_CHUNK_CACHE_MAX 128
-# @# define PNG_USER_CHUNK_MALLOC_MAX 8000000
+# @# define PNG_USER_WIDTH_MAX 65535
+# @# define PNG_USER_HEIGHT_MAX 65535
+# @# define PNG_USER_CHUNK_CACHE_MAX 256
+# @# define PNG_USER_CHUNK_MALLOC_MAX 640000
--- a/projects/vstudio/readme.txt
+++ b/projects/vstudio/readme.txt
@@ -1,7 +1,7 @@

 VisualStudio instructions

-libpng version 1.5.20beta01 - November 6, 2014
+libpng version 1.5.22beta02 - February 17, 2015

 Copyright (c) 1998-2010 Glenn Randers-Pehrson

--- a/projects/vstudio/zlib.props
+++ b/projects/vstudio/zlib.props
@@ -2,7 +2,7 @@
 <!--
 * zlib.props - location of zlib source
 *
- * libpng version 1.5.20beta01 - November 6, 2014
+ * libpng version 1.5.22beta02 - February 17, 2015
 *
 * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 *
--- a/scripts/README.txt
+++ b/scripts/README.txt
@@ -1,9 +1,9 @@

-Makefiles for  libpng version 1.5.20beta01 - November 6, 2014
+Makefiles for  libpng version 1.5.22beta02 - February 17, 2015

 pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng15.so.15.1.5.20beta01)
+                       (gcc, creates libpng15.so.15.1.5.22beta02)
 makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
 makefile.knr      =>  Archaic UNIX Makefile that converts files with
                       ansi2knr (Requires ansi2knr.c from
@@ -34,12 +34,12 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.os2      =>  OS/2 Makefile (gcc and emx, requires libpng.def)
 makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
 makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng15.so.15.1.5.20beta01)
+                       creates libpng15.so.15.1.5.22beta02)
 makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
 makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng15.so.15.1.5.20beta01)
+                       creates libpng15.so.15.1.5.22beta02)
 makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng15.so.15.1.5.20beta01)
+                       creates libpng15.so.15.1.5.22beta02)
 makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
 makefile.sunos    =>  Sun makefile
 makefile.32sunu   =>  Sun Ultra 32-bit makefile
--- a/scripts/def.dfn
+++ b/scripts/def.dfn
@@ -1,7 +1,7 @@
-/* def.dfn - define format of libpng.def
+/* def.c - define format of libpng.def
 *
- * Last changed in libpng version 1.5.7 [December 15, 2011]
- * Copyright (c) 2010-2011 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2011-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -21,9 +21,9 @@ PNG_DFN "OS2 DESCRIPTION "PNG image compression library""
 PNG_DFN "OS2 CODE PRELOAD MOVEABLE DISCARDABLE"
 PNG_DFN ""
 PNG_DFN "EXPORTS"
-PNG_DFN ";Version 1.5.0beta58"
+PNG_DFN ";Version 1.5.22beta02"

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
-	PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"
+        PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"

 #include "../png.h"
--- a/scripts/libpng-config-head.in
+++ b/scripts/libpng-config-head.in
@@ -11,7 +11,7 @@

 # Modeled after libxml-config.

-version=1.5.20beta01
+version=1.5.22beta02
 prefix=""
 libdir=""
 libs=""
--- a/scripts/libpng.pc.in
+++ b/scripts/libpng.pc.in
@@ -5,6 +5,6 @@ includedir=@includedir@/libpng15

 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.5.20beta01
+Version: 1.5.22beta02
 Libs: -L${libdir} -lpng15
 Cflags: -I${includedir}
--- a/scripts/makefile.bc32
+++ b/scripts/makefile.bc32
@@ -52,7 +52,9 @@ LDFLAGS=-L$(ZLIB_DIR) -M $(LDEBUG)

 # Pre-built configuration
 # See scripts\pnglibconf.mak for more options
+!ifndef PNGLIBCONF_H_PREBUILT
 PNGLIBCONF_H_PREBUILT = scripts\pnglibconf.h.prebuilt
+!endif

 ## Variables
 OBJS = \
--- a/scripts/makefile.bor
+++ b/scripts/makefile.bor
@@ -60,7 +60,9 @@ LDFLAGS=-M -L$(ZLIB_DIR) $(MODEL_ARG) $(LDEBUG)

 # Pre-built configuration
 # See scripts\pnglibconf.mak for more options
+!ifndef PNGLIBCONF_H_PREBUILT
 PNGLIBCONF_H_PREBUILT = scripts\pnglibconf.h.prebuilt
+!endif

 ## Variables

--- a/scripts/makefile.cegcc
+++ b/scripts/makefile.cegcc
@@ -23,7 +23,7 @@

 VERMAJ = 1
 VERMIN = 5
-VERMIC = 20
+VERMIC = 22
 VER = $(VERMAJ).$(VERMIN).$(VERMIC)
 NAME = libpng
 PACKAGE = $(NAME)-$(VER)
--- a/scripts/makefile.darwin
+++ b/scripts/makefile.darwin
@@ -36,12 +36,11 @@ LN_SF=ln -sf
 RANLIB=ranlib
 CP=cp
 RM_F=/bin/rm -f
-ARCH=-arch ppc -arch i386 -arch x86_64

 CPPFLAGS=-I$(ZLIBINC)
 # CFLAGS=-W -Wall -O3 -funroll-loops
-CFLAGS=-W -Wall -O -funroll-loops $(ARCH)
-LDFLAGS=-L. -L$(ZLIBLIB) -lpng15 -lz $(ARCH)
+CFLAGS=-W -Wall -O -funroll-loops
+LDFLAGS=-L. -L$(ZLIBLIB) -lpng15 -lz

 INCPATH=$(prefix)/include
 LIBPATH=$(exec_prefix)/lib
@@ -113,7 +112,7 @@ $(LIBSOMAJ): $(OBJSDLL)
 	$(CC) -dynamiclib \
 	 -install_name $(LIBPATH)/$(LIBSOMAJ) \
 	 -current_version 15 -compatibility_version 15 \
-	 $(ARCH) -o $(LIBSOMAJ) \
+	 -o $(LIBSOMAJ) \
 	 $(OBJSDLL) -L$(ZLIBLIB) -lz

 pngtest: pngtest.o $(LIBSO)
--- a/scripts/makefile.linux
+++ b/scripts/makefile.linux
@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng15
 PNGMAJ = 15
-RELEASE = 20
+RELEASE = 22

 # Shared library names:
 LIBSO=$(LIBNAME).so
--- a/scripts/makefile.msys
+++ b/scripts/makefile.msys
@@ -18,7 +18,7 @@ exec_prefix=$(prefix)
 # Library name:
 LIBNAME = libpng15
 PNGMAJ = 15
-RELEASE = 20
+RELEASE = 22

 # Shared library names:
 LIBSO=$(LIBNAME).dll
--- a/scripts/makefile.ne12bsd
+++ b/scripts/makefile.ne12bsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng15

 LIB=	png15
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.5.20beta01
+SHLIB_MINOR=	1.5.22beta02
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.netbsd
+++ b/scripts/makefile.netbsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include

 LIB=	png
 SHLIB_MAJOR=	15
-SHLIB_MINOR=	1.5.20beta01
+SHLIB_MINOR=	1.5.22beta02
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.openbsd
+++ b/scripts/makefile.openbsd
@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat

 SHLIB_MAJOR=	15
-SHLIB_MINOR=	1.5.20beta01
+SHLIB_MINOR=	1.5.22beta02

 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
--- a/scripts/makefile.tc3
+++ b/scripts/makefile.tc3
@@ -16,7 +16,9 @@ CP=copy

 # Pre-built configuration
 # See scripts\pnglibconf.mak for more options
+!ifndef PNGLIBCONF_H_PREBUILT
 PNGLIBCONF_H_PREBUILT = scripts\pnglibconf.h.prebuilt
+!endif

 O=.obj
 E=.exe
--- a/scripts/makefile.vcwin32
+++ b/scripts/makefile.vcwin32
@@ -16,7 +16,7 @@ CC = cl
 LD = link
 AR = lib
 CPPFLAGS = -I..\zlib
-CFLAGS  = -nologo -D_CRT_SECURE_NO_DEPRECATE -MD -O2 -W3
+CFLAGS  = -nologo -D_CRT_SECURE_NO_DEPRECATE -D_CRT_SECURE_NO_WARNINGS -MD -O2 -W3
 LDFLAGS = -nologo
 ARFLAGS = -nologo
 CP = copy
--- a/scripts/pnglibconf.dfa
+++ b/scripts/pnglibconf.dfa
@@ -282,41 +282,32 @@ option IO_STATE

 #option READ_BIG_ENDIAN disabled

-# Allow users to control limits on what the READ code will
-# read:
-
-# Added at libpng-1.2.43; adds limit fields to png_struct,
-# allows some usages of these fields
-
-option USER_LIMITS
-
-# Added at libpng-1.2.6; adds setting APIs, allows additional
-# usage of this field (UTSL)
-
-option SET_USER_LIMITS requires USER_LIMITS
-
-# Feature added at libpng-1.4.0, this flag added at 1.4.1
-option SET_USER_LIMITS enables SET_CHUNK_CACHE_LIMIT
-# Feature added at libpng-1.4.1, this flag added at 1.4.1
-
-option SET_USER_LIMITS enables SET_CHUNK_MALLOC_LIMIT
-
-# Libpng limits.
+# Libpng limits: limit the size of images and data on read.
 #
-# If these settings are *not* set libpng will not limit the size of
-# images or the size of data in ancilliary chunks.  This does lead to
-# security issues if PNG files come from untrusted sources.
-setting USER_WIDTH_MAX
-setting USER_HEIGHT_MAX
-setting USER_CHUNK_CACHE_MAX
-setting USER_CHUNK_MALLOC_MAX
+# If this option is disabled all the limit checking code will be disabled:

-# To default all these settings to values that are large but probably
-# safe turn the SAFE_LIMITS option on; this will cause the value in
-# pngpriv.h to be used.  Individual values can also be set, simply set
-# them in pngusr.dfa with '@#define PNG_setting value' lines.
-option SAFE_LIMITS enables USER_LIMITS disabled
-= SAFE_LIMITS SAFE_LIMITS
+option USER_LIMITS requires READ
+
+# The default settings given below for the limits mean that libpng will
+# limit the size of images or the size of data in ancilliary chunks to less
+# than the specification or implementation limits. Settings have the
+# following interpretations:
+#
+# USER_WIDTH_MAX: maximum width of an image that will be read
+# USER_HEIGHT_MAX: maximum height
+# USER_CHUNK_MALLOC_MAX: maximum in-memory (decompressed) size of a single chunk
+# USER_CHUNK_CACHE_MAX: maximum number of chunks to be cached
+#
+# Only chunks that are variable in number are counted towards the
+# USER_CHUNK_CACHE_MAX limit
+setting USER_WIDTH_MAX default        1000000 /* Use 0x7fffffff for unlimited */
+setting USER_HEIGHT_MAX default       1000000 /* Use 0x7fffffff for unlimited */
+setting USER_CHUNK_CACHE_MAX default     1000 /* Use 0 for unlimited */
+setting USER_CHUNK_MALLOC_MAX default 8000000 /* Use 0 for unlimited */
+
+# If this option is enabled APIs to set the above limits at run time are added;
+# without this the hardwired (compile time) limits will be used.
+option SET_USER_LIMITS requires USER_LIMITS

 # All of the following options relate to code capabilities for
 # processing image data before creating a PNG or after reading one.
--- a/scripts/pnglibconf.h.prebuilt
+++ b/scripts/pnglibconf.h.prebuilt
@@ -1,7 +1,7 @@
-/* 1.5.20beta01 STANDARD API DEFINITION */
+/* 1.5.22beta02 STANDARD API DEFINITION */
 /* pnglibconf.h - library build configuration */

-/* libpng version 1.5.20beta01 - November 6, 2014 */
+/* libpng version 1.5.22beta02 - February 17, 2015 */

 /* Copyright (c) 1998-2013 Glenn Randers-Pehrson */

@@ -179,6 +179,10 @@
 #define PNG_QUANTIZE_BLUE_BITS 5
 #define PNG_QUANTIZE_GREEN_BITS 5
 #define PNG_QUANTIZE_RED_BITS 5
+#define PNG_USER_CHUNK_CACHE_MAX 1000 /* Use 0 for unlimited */
+#define PNG_USER_CHUNK_MALLOC_MAX 8000000 /* Use 0 for unlimited */
+#define PNG_USER_HEIGHT_MAX 1000000 /* Use 0x7fffffff for unlimited */
+#define PNG_USER_WIDTH_MAX 1000000 /* Use 0x7fffffff for unlimited */
 #define PNG_WEIGHT_SHIFT 8
 #define PNG_ZBUF_SIZE 8192
 #define PNG_sCAL_PRECISION 5
--- a/scripts/sym.dfn
+++ b/scripts/sym.dfn
@@ -1,8 +1,8 @@

-/* sym.dfn - define format of libpng.sym
+/* sym.c - define format of libpng.sym
 *
- * Last changed in libpng version 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2011-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -10,6 +10,6 @@
 */

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
-	PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"
+        PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"

 #include "../png.h"
--- a/scripts/symbols.dfn
+++ b/scripts/symbols.dfn
@@ -1,8 +1,8 @@

-/* symbols.dfn - find all exported symbols
+/* symbols.c - find all exported symbols
 *
- * Last changed in libpng version 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2011-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -17,11 +17,11 @@
 */

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
-	PNG_DFN "@" name "@ @@" ordinal "@"
+        PNG_DFN "@" name "@ @@" ordinal "@"
 #define PNG_REMOVED(ordinal, type, name, args, attributes)\
-	PNG_DFN "; @" name "@ @@" ordinal "@"
+        PNG_DFN "; @" name "@ @@" ordinal "@"
 #define PNG_EXPORT_LAST_ORDINAL(ordinal)\
-	PNG_DFN "; @@" ordinal "@"
+        PNG_DFN "; @@" ordinal "@"

 /* Read the defaults, but use scripts/pnglibconf.h.prebuilt; the 'standard'
 * header file.
--- a/scripts/symbols.def
+++ b/scripts/symbols.def
@@ -1,4 +1,4 @@
-;Version 1.5.20beta01
+;Version 1.5.22beta02
 ;--------------------------------------------------------------
 ; LIBPNG symbol list as a Win32 DEF file
 ; Contains all the symbols that can be exported from libpng
--- a/scripts/vers.dfn
+++ b/scripts/vers.dfn
@@ -1,8 +1,8 @@

-/* vers.dfn - define format of libpng.vers
+/* vers.c - define format of libpng.vers
 *
- * Last changed in libpng version 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2011-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -10,7 +10,7 @@
 */

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
-	PNG_DFN " @" SYMBOL_PREFIX "@@" name "@;"
+        PNG_DFN " @" SYMBOL_PREFIX "@@" name "@;"

 PNG_DFN "@" PNGLIB_LIBNAME "@ {global:"
Author	SHA1	Message	Date
Glenn Randers-Pehrson	0f97758e5f	[libpng15] Imported from libpng-1.5.22beta02.tar	2015-02-17 10:51:19 -06:00
Glenn Randers-Pehrson	8a6253ed6f	[libpng15] Merged pngtest.c with libpng-1.6.17/pngtest.c Display user limits in the output from pngtest. Eliminated the PNG_SAFE_LIMITS macro and restored the 1-million-column and 1-million-row default limits in pnglibconf.dfa, that can be reset by the user at build time or run time. This provides a more robust defense against DOS and as-yet undiscovered overflows.	2015-02-16 22:56:30 -06:00
Glenn Randers-Pehrson	c34f3658a7	[libpng15] Bump version to 1.5.22beta02	2015-01-28 19:42:01 -06:00
Glenn Randers-Pehrson	3cd4a410a5	[libpng15] Imported from libpng-1.5.22beta01.tar	2015-01-28 19:34:32 -06:00
Glenn Randers-Pehrson	747cea57e3	[libpng15] Made the check for out-of-range values in png_set_tRNS() detect values that are exactly 2^bit_depth, and work on 16-bit platforms.	2015-01-13 09:39:15 -06:00
Glenn Randers-Pehrson	ee48ecd71e	[libpng15] Update ltmain.sh to libtool-2.4.4	2015-01-11 17:29:04 -06:00
Glenn Randers-Pehrson	e621f04541	[libpng15] Regenerated configure scripts with libtool-2.4.4	2014-12-28 19:18:57 -06:00
Glenn Randers-Pehrson	beddd7ed53	[libpng15] Bump version to 1.5.22beta01	2014-12-21 22:56:23 -06:00
Glenn Randers-Pehrson	67faef917b	[libpng15] Imported from libpng-1.5.21.tar	2014-12-21 21:52:46 -06:00
Glenn Randers-Pehrson	9c526e5a5d	[libpng15] Imported from libpng-1.5.21rc03.tar	2014-12-21 16:43:48 -06:00
John Bowler	7a6bbfd649	[libpng15] Fixed an overflow in png_combine_row with very wide interlaced images.	2014-12-21 16:40:33 -06:00
Glenn Randers-Pehrson	90238dfe7a	[libpng15] Imported from libpng-1.5.21rc02.tar	2014-12-21 14:08:01 -06:00
Glenn Randers-Pehrson	fb31308aea	[libpng15] Imported from libpng-1.5.21rc01.tar	2014-12-21 09:31:27 -06:00
Glenn Randers-Pehrson	b0c2c4154a	[libpng15] Bump version to 1.5.21beta02	2014-12-18 08:51:00 -06:00
Glenn Randers-Pehrson	8eb6549dac	[libpng15] Imported from libpng-1.5.21beta01.tar	2014-12-18 08:50:49 -06:00
Glenn Randers-Pehrson	969d5a27dd	[libpng15] Revised Makefile.am and scripts/.dfn to work with MinGW/MSYS; renamed scripts/.dfn to scripts/*.c (Bob Friesenhahn and John Bowler).	2014-12-14 21:52:43 -06:00
Glenn Randers-Pehrson	394b2868f7	[libpng15] Bump version to 1.5.21beta01	2014-12-14 21:28:11 -06:00
Glenn Randers-Pehrson	82090022e7	[libpng15] Imported from libpng-1.5.20.tar	2014-11-20 10:22:49 -06:00
Glenn Randers-Pehrson	5290847c3e	[libpng15] Imported from libpng-1.5.20rc03.tar	2014-11-16 20:04:17 -06:00
Cosmin Truta	f3c2a77175	[libpng15] Added "-D_CRT_SECURE_NO_WARNINGS" to CFLAGS in scripts/makefile.vcwin32. Removed the obsolete $ARCH variable from scripts/makefile.darwin.	2014-11-16 19:42:08 -06:00
Glenn Randers-Pehrson	55246f5ed6	[libpng15] Imported from libpng-1.5.20rc02.tar	2014-11-14 09:42:39 -06:00
Cosmin Truta	7852e7786b	[libpng15] Use memcpy instead of CopyMemory in the definition of png_memcpy. The Borland C++ build breaks otherwise (Cosmin).	2014-11-14 09:41:41 -06:00
Cosmin Truta	5310158c37	[libpng15] The macros passed in the command line to Borland make were ignored if similarly-named macros are already defined in makefiles. This behavior is different from POSIX make and other make programs. Surround the macro definitions with ifndef guards (Cosmin).	2014-11-14 09:38:20 -06:00
Glenn Randers-Pehrson	6e0f47f88f	[libpng15] Imported from libpng-1.5.20rc01.tar	2014-11-13 06:46:37 -06:00
Glenn Randers-Pehrson	9e6249907b	[libpng15] Bump version to 1.5.20beta02	2014-11-09 20:29:36 -06:00
Glenn Randers-Pehrson	2ccc2774f5	[libpng15] Quieted three "comparison is always false due to limited range" compiler warnings in pngset.c	2014-11-09 20:28:12 -06:00