[libpng15] Imported from libpng-1.5.26.tar

[libpng15] Imported from libpng-1.5.26rc01.tar
[libpng15] Update some last-changed dates
2025-07-10 18:04:09 +02:00 · 2015-12-17 08:11:20 -06:00 · 2015-12-13 21:44:19 -06:00 · 2015-12-13 18:36:30 -06:00 · 2015-12-13 18:20:11 -06:00 · 2015-12-13 18:10:53 -06:00
52 changed files with 2625 additions and 1616 deletions
--- a/41
+++ b/41
@@ -1,5 +1,5 @@

-Libpng 1.5.23 - July 23, 2015
+Libpng 1.5.26 - December 17, 2015

 This is a public release of libpng, intended for use in production codes.

@@ -8,40 +8,27 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script

-   libpng-1.5.23.tar.xz (LZMA-compressed, recommended)
-   libpng-1.5.23.tar.gz
-   libpng-1.5.23.tar.bz2
+   libpng-1.5.26.tar.xz (LZMA-compressed, recommended)
+   libpng-1.5.26.tar.gz

 Source files with CRLF line endings (for Windows), without the
 "configure" script

-   lpng1523.7z  (LZMA-compressed, recommended)
-   lpng1523.zip
+   lpng1526.7z  (LZMA-compressed, recommended)
+   lpng1526.zip

 Other information:

-   libpng-1.5.23-README.txt
-   libpng-1.5.23-LICENSE.txt
-   libpng-1.5.23-*.asc (armored detached GPG signatures)
+   libpng-1.5.26-README.txt
+   libpng-1.5.26-LICENSE.txt
+   libpng-1.5.26-*.asc (armored detached GPG signatures)

-Changes since the last public release (1.5.22):
-  Removed unused PNG_SET_CHUNK_[CACHE|MALLOC]_LIMIT_SUPPORTED definitions
-    from pnglibconf.h.prebuilt (Andrew Church).
-  Replaced "unexpected" with an integer in pngset.c where a long was
-    expected, to avoid a compiler warning when PNG_DEBUG > 1.
-  Fix typecast in a png_debug2() statement in png_set_text_2() to
-    avoid a compiler warning in PNG_DEBUG builds.
-  Avoid Coverity issue 80858 (REVERSE NULL) in pngtest.c PNG_DEBUG builds.
-  Avoid a harmless potential integer overflow in png_XYZ_from_xy() (Bug
-    report from Christopher Ferris).
-  Removed WRITE_WEIGHTED_FILTERED code, to save a few kbytes of the
-    compiled library size. It never worked properly and as far as we can
-    tell, no one uses it. The png_set_filter_heuristics() and
-    png_set_filter_heuristics_fixed() APIs are retained but deprecated
-    and do nothing.
-  Quieted Coverity issues in pngvalid.c.
-  Removed non-working progressive reader 'skip' function.
-  Belatedly added Mans Rullgard to the list of Contributing Authors.
+Changes since the last public release (1.5.25):
+  Fixed an out-of-range read in png_check_keyword() (Bug report from
+    Qixue Xiao, CVE-2015-8540).
+  Corrected copyright dates in source files.
+  Moved png_check_keyword() from pngwutil.c to pngset.c
+  Added keyword checks to pngset.c (John Bowler).

 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
--- a/83
+++ b/83
@@ -3754,7 +3754,8 @@ Version 1.5.7beta04 [November 17, 2011]
 Version 1.5.7beta05 [November 25, 2011]
  Removed "zTXt" from warning in generic chunk decompression function.
  Validate time settings passed to pngset() and png_convert_to_rfc1123()
-    (Frank Busse).
+    (Frank Busse). Note: This prevented CVE-2015-7981 from affecting
+    libpng-1.5.7 and later.
  Added MINGW support to CMakeLists.txt
  Reject invalid compression flag or method when reading the iTXt chunk.
  Backed out 'simplified' API changes. The API seems too complex and there
@@ -4373,6 +4374,86 @@ Version 1.5.23rc03 [July 15, 2015]
 Version 1.5.23 [July 23, 2015]
  No changes.

+Version 1.5.24beta01 [August 19, 2015]
+  Avoid potentially dereferencing NULL info_ptr in png_info_init_3().
+  Eliminated unused PNG_COST_SHIFT, PNG_WEIGHT_SHIFT, PNG_COST_FACTOR, and
+    PNG_WEIGHT_FACTOR macros.
+  Fixed potential leak of png_pixels in contrib/pngminus/pnm2png.c
+  Fixed uninitialized variable in contrib/gregbook/rpng2-x.c
+  Fixed some bad links in the man page.
+  Safely convert num_bytes to a png_byte in png_set_sig_bytes() (Robert
+    Seacord).
+  Fixed the recently reported 1's complement security issue by replacing
+    the value that is illegal in the PNG spec, in both signed and unsigned
+    values, with 0. Illegal unsigned values (anything greater than or equal
+    to  0x80000000) can still pass through, but since these are not illegal
+    in ANSI-C (unlike 0x80000000 in the signed case) the checking that
+    occurs later can catch them (John Bowler).
+
+Version 1.5.24beta02 [October 15, 2015]
+  Fixed png_save_int_32 when int is not 2's complement (John Bowler).
+  Fixed byte order in png_do_read_filler() with 16-bit input (previously
+    fixed in libpng-1.6.17 and 1.7.0beta46). Previously the high and
+    low bytes of the filler, from png_set_filler() or from
+    png_set_add_alpha(), were read in the wrong order.
+  Merged pngvalid.c with version 1.6.19.
+  Added sPLT support to pngtest.c
+
+Version 1.5.24rc01 [October 31, 2015]
+  Prevent writing over-length PLTE chunk (Cosmin Truta).
+  Libpng incorrectly calculated the output rowbytes when the application
+    decreased either the number of channels or the bit depth (or both) in
+    a user transform.  This was safe; libpng overallocated buffer space
+   (potentially by quite a lot; up to 4 times the amount required) but,
+   from 1.5.4 on, resulted in a png_error (John Bowler).
+  Silently truncate over-length PLTE chunk while reading.
+
+Version 1.5.24rc02 [November 3, 2015]
+  Fixed some inconsequential cut-and-paste typos in png_set_cHRM_XYZ_fixed().
+  Clarified COPYRIGHT information to state explicitly that versions
+    are derived from previous versions.
+  Removed much of the long list of previous versions from png.h and
+    libpng.3.
+
+Version 1.5.24rc03 [omitted]
+
+Version 1.5.24rc04 [November 5, 2015]
+  Fixed new bug with CRC error after reading an over-length palette
+    (bug report by Cosmin Truta) (CVE-2015-8126).
+
+version 1.5.24 [November 12, 2015]
+  Cleaned up coding style in png_handle_PLTE().
+
+version 1.5.25beta01 [November 20, 2015]
+  Avoid potential pointer overflow in png_handle_iTXt(), png_handle_zTXt(),
+    png_handle_sPLT(), and png_handle_pCAL() (Bug report by John Regehr).
+
+version 1.5.25beta02 [November 23, 2015]
+  Fixed incorrect implementation of png_set_PLTE() that uses png_ptr
+    not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126
+    vulnerability.  Fixes CVE-2015-8472.
+
+version 1.5.25beta03 [November 24, 2015]
+  Backported tests from libpng-1.7.0beta69.
+
+version 1.5.25rc01 [November 26, 2015]
+  No changes.
+
+version 1.5.25 [December 3, 2015]
+  No changes.
+
+version 1.5.26beta01 [December 11, 2015]
+  Fixed an out-of-range read in png_check_keyword() (Bug report from
+    Qixue Xiao, CVE-2015-8540).
+
+version 1.5.26rc01 [December 14, 2015]
+  Corrected copyright dates in source files.
+  Moved png_check_keyword() from pngwutil.c to pngset.c
+  Added keyword checks to pngset.c (John Bowler).
+
+version 1.5.26 [December 17, 2015]
+  No changes.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -16,7 +16,7 @@ enable_testing()

 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 5)
-set(PNGLIB_RELEASE 23)
+set(PNGLIB_RELEASE 26)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})

@@ -224,7 +224,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW)
 # SET UP LINKS
 if(PNG_SHARED)
  set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 15.${PNGLIB_RELEASE}.1.5.23
+#   VERSION 15.${PNGLIB_RELEASE}.1.5.26
    VERSION 15.${PNGLIB_RELEASE}.0
    SOVERSION 15
    CLEAN_DIRECT_OUTPUT 1)
--- a/27
+++ b/27
@@ -10,10 +10,11 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.0.7, July 1, 2000, through 1.5.23, July 23, 2015, are
-Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, and are
-distributed according to the same disclaimer and license as libpng-1.0.6
-with the following individuals added to the list of Contributing Authors:
+libpng versions 1.0.7, July 1, 2000, through 1.5.26, December 17, 2015, are
+Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
+derived from libpng-1.0.6, and are distributed according to the same
+disclaimer and license as libpng-1.0.6 with the following individuals
+added to the list of Contributing Authors:

   Simon-Pierre Cadieux
   Eric S. Raymond
@@ -31,18 +32,20 @@ and with the following additions to the disclaimer:
   the user.

 libpng versions 0.97, January 1998, through 1.0.6, March 20, 2000, are
-Copyright (c) 1998-2000 Glenn Randers-Pehrson, and are distributed according
-to the same disclaimer and license as libpng-0.96, with the following
-individuals added to the list of Contributing Authors:
+Copyright (c) 1998-2000 Glenn Randers-Pehrson, are derived from
+libpng-0.96, and are distributed according to the same disclaimer and
+license as libpng-0.96, with the following individuals added to the list
+of Contributing Authors:

   Tom Lane
   Glenn Randers-Pehrson
   Willem van Schaik

 libpng versions 0.89, June 1996, through 0.96, May 1997, are
-Copyright (c) 1996-1997 Andreas Dilger, and are
-distributed according to the same disclaimer and license as libpng-0.88,
-with the following individuals added to the list of Contributing Authors:
+Copyright (c) 1996-1997 Andreas Dilger, are derived from libpng-0.88,
+and are distributed according to the same disclaimer and license as
+libpng-0.88, with the following individuals added to the list of
+Contributing Authors:

   John Bowler
   Kevin Bracey
@@ -89,6 +92,8 @@ supporting the PNG file format in commercial products.  If you use this
 source code in a product, acknowledgment is not required but would be
 appreciated.

+END OF COPYRIGHT NOTICE, DISCLAIMER, and LICENSE.
+
 A "png_get_copyright" function is available, for convenient use in "about"
 boxes and the like:

@@ -103,4 +108,4 @@ the additional disclaimers inserted at version 1.0.7.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-July 23, 2015
+December 17, 2015
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-README for libpng version 1.5.23 - July 23, 2015 (shared library 15.0)
+README for libpng version 1.5.26 - December 17, 2015 (shared library 15.0)
 See the note about version numbers near the top of png.h

 See INSTALL for instructions on how to install libpng.
--- a/24
+++ b/24
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for libpng 1.5.23.
+# Generated by GNU Autoconf 2.69 for libpng 1.5.26.
 #
 # Report bugs to <png-mng-implement@lists.sourceforge.net>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libpng'
 PACKAGE_TARNAME='libpng'
-PACKAGE_VERSION='1.5.23'
-PACKAGE_STRING='libpng 1.5.23'
+PACKAGE_VERSION='1.5.26'
+PACKAGE_STRING='libpng 1.5.26'
 PACKAGE_BUGREPORT='png-mng-implement@lists.sourceforge.net'
 PACKAGE_URL=''

@@ -1354,7 +1354,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures libpng 1.5.23 to adapt to many kinds of systems.
+\`configure' configures libpng 1.5.26 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1424,7 +1424,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of libpng 1.5.23:";;
+     short | recursive ) echo "Configuration of libpng 1.5.26:";;
   esac
  cat <<\_ACEOF

@@ -1579,7 +1579,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-libpng configure 1.5.23
+libpng configure 1.5.26
 generated by GNU Autoconf 2.69

 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2002,7 +2002,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by libpng $as_me 1.5.23, which was
+It was created by libpng $as_me 1.5.26, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  $ $0 $@
@@ -2865,7 +2865,7 @@ fi

 # Define the identity of the package.
 PACKAGE='libpng'
- VERSION='1.5.23'
+ VERSION='1.5.26'


 cat >>confdefs.h <<_ACEOF
@@ -2982,10 +2982,10 @@ fi



-PNGLIB_VERSION=1.5.23
+PNGLIB_VERSION=1.5.26
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=5
-PNGLIB_RELEASE=23
+PNGLIB_RELEASE=26



@@ -14124,7 +14124,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libpng $as_me 1.5.23, which was
+This file was extended by libpng $as_me 1.5.26, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -14190,7 +14190,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-libpng config.status 1.5.23
+libpng config.status 1.5.26
 configured by $0, generated by GNU Autoconf 2.69,
  with options \\"\$ac_cs_config\\"

--- a/configure.ac
+++ b/configure.ac
@@ -18,15 +18,15 @@ AC_PREREQ(2.59)

 dnl Version number stuff here:

-AC_INIT([libpng], [1.5.23], [png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng], [1.5.26], [png-mng-implement@lists.sourceforge.net])
 AM_INIT_AUTOMAKE([1.13 serial-tests subdir-objects])
 dnl stop configure from automagically running automake
 AM_MAINTAINER_MODE

-PNGLIB_VERSION=1.5.23
+PNGLIB_VERSION=1.5.26
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=5
-PNGLIB_RELEASE=23
+PNGLIB_RELEASE=26

 dnl End of version number stuff

--- a/contrib/gregbook/rpng2-x.c
+++ b/contrib/gregbook/rpng2-x.c
@@ -41,10 +41,12 @@
              unexpected-EOF and file-read-error cases; fixed Trace() cut-and-
              paste bugs
    - 2.03:  deleted runtime MMX-enabling/disabling and obsolete -mmx* options
-
+    - 2.04:  Added "void(foo);" statements to quiet pedantic compiler warnings
+             about unused variables (GR-P)
+    - 2.05:  Use nanosleep() instead of usleep(), which is deprecated (GR-P).
  ---------------------------------------------------------------------------

-      Copyright (c) 1998-2008 Greg Roelofs.  All rights reserved.
+      Copyright (c) 1998-2010, 2014-2015 Greg Roelofs.  All rights reserved.

      This software is provided "as is," without warranty of any kind,
      express or implied.  In no event shall the author or contributors
@@ -95,7 +97,7 @@

 #define PROGNAME  "rpng2-x"
 #define LONGNAME  "Progressive PNG Viewer for X"
-#define VERSION   "2.03 of 25 February 2010"
+#define VERSION   "2.04 of 15 June 2014"
 #define RESNAME   "rpng2"       /* our X resource application name */
 #define RESCLASS  "Rpng"       /* our X resource class name */

@@ -111,6 +113,19 @@
 #include <X11/Xos.h>
 #include <X11/keysym.h>   /* defines XK_* macros */

+#if _POSIX_C_SOURCE >= 199309L /* have nanosleep() */
+# undef usleep
+# define usleep(usec) {        \
+   struct timespec ts;         \
+   ts.tv_sec = 0;              \
+   ts.tv_nsec = (usec) * 1000; \
+   nanosleep(&ts, NULL); }
+#  endif
+
+#ifndef usleep /* have neither nanosleep() nor usleep() */
+#  define usleep(x) sleep(((x)+499999)/1000000)
+#endif
+
 #ifdef VMS
 #  include <unistd.h>
 #endif
@@ -456,40 +471,47 @@ int main(int argc, char **argv)
        fprintf(stderr, "\n%s %s:  %s\n\n", PROGNAME, VERSION, appname);
        readpng2_version_info();
        fprintf(stderr, "\n"
-          "Usage:  %s [-display xdpy] [-gamma exp] [-bgcolor bg | -bgpat pat]\n"
+          "Usage:   ");
+        fprintf(stderr,
+          "%s [-display xdpy] [-gamma exp] [-bgcolor bg | -bgpat pat]\n"
+          "        %*s [-usleep dur | -timing] [-pause]\n",
+          PROGNAME, (int)strlen(PROGNAME), " ");
+        fprintf(stderr,
 #ifdef FEATURE_LOOP
-          "        %*s [-usleep dur | -timing] [-pause] [-loop [sec]] file.png\n\n"
-#else
-          "        %*s [-usleep dur | -timing] [-pause] file.png\n\n"
+          "        [-loop [sec]]"
 #endif
+          " file.png\n\n");
+        fprintf(stderr,
          "    xdpy\tname of the target X display (e.g., ``hostname:0'')\n"
          "    exp \ttransfer-function exponent (``gamma'') of the display\n"
          "\t\t  system in floating-point format (e.g., ``%.1f''); equal\n"
-          "\t\t  to the product of the lookup-table exponent (varies)\n"
+          "\t\t  to the product of the lookup-table exponent (varies)\n",
+          default_display_exponent);
+        fprintf(stderr,
          "\t\t  and the CRT exponent (usually 2.2); must be positive\n"
          "    bg  \tdesired background color in 7-character hex RGB format\n"
          "\t\t  (e.g., ``#ff7700'' for orange:  same as HTML colors);\n"
          "\t\t  used with transparent images; overrides -bgpat\n"
          "    pat \tdesired background pattern number (0-%d); used with\n"
-          "\t\t  transparent images; overrides -bgcolor\n"
+          "\t\t  transparent images; overrides -bgcolor\n",
+          num_bgpat-1);
 #ifdef FEATURE_LOOP
+        fprintf(stderr,
          "    -loop\tloops through background images after initial display\n"
          "\t\t  is complete (depends on -bgpat)\n"
-          "    sec \tseconds to display each background image (default = 2)\n"
+          "    sec \tseconds to display each background image (default = 2)\n");
 #endif
+        fprintf(stderr,
          "    dur \tduration in microseconds to wait after displaying each\n"
          "\t\t  row (for demo purposes)\n"
          "    -timing\tenables delay for every block read, to simulate modem\n"
          "\t\t  download of image (~36 Kbps)\n"
          "    -pause\tpauses after displaying each pass until mouse clicked\n"
          "\nPress Q, Esc or mouse button 1 (within image window, after image\n"
-          "is displayed) to quit.\n"
-          "\n", PROGNAME,
-          (int)strlen(PROGNAME), " ", default_display_exponent, num_bgpat-1);
+          "is displayed) to quit.\n");
        exit(1);
    }

-
    if (!(infile = fopen(filename, "rb"))) {
        fprintf(stderr, PROGNAME ":  can't open PNG file [%s]\n", filename);
        ++error;
@@ -735,6 +757,8 @@ int main(int argc, char **argv)
    Trace((stderr, "about to call rpng2_x_cleanup()\n"))
    rpng2_x_cleanup();

+    (void)argc; /* Unused */
+
    return 0;
 }

@@ -1826,6 +1850,9 @@ static void rpng2_x_redisplay_image(ulg startcol, ulg startrow,
        XFlush(display);
    }

+    (void)startcol;
+    (void)width;
+
 } /* end function rpng2_x_redisplay_image() */


--- a/contrib/libtests/pngvalid.c
+++ b/contrib/libtests/pngvalid.c
--- a/contrib/pngminus/pnm2png.c
+++ b/contrib/pngminus/pnm2png.c
@@ -3,6 +3,7 @@
 *  copyright (C) 1999 by Willem van Schaik <willem@schaik.com>
 *
 *  version 1.0 - 1999.10.15 - First version.
+ *  version 1.1 - 2015.07.29 - Fixed leaks (Glenn Randers-Pehrson)
 *
 *  Permission to use, copy, modify, and distribute this software and
 *  its documentation for any purpose and without fee is hereby granted,
@@ -50,7 +51,8 @@

 int  main (int argc, char *argv[]);
 void usage ();
-BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace, BOOL alpha);
+BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
+    BOOL alpha);
 void get_token(FILE *pnm_file, char *token);
 png_uint_32 get_data (FILE *pnm_file, int depth);
 png_uint_32 get_value (FILE *pnm_file, int depth);
@@ -176,7 +178,8 @@ void usage()
  fprintf (stderr, "   or:  ... | pnm2png [options]\n");
  fprintf (stderr, "Options:\n");
  fprintf (stderr, "   -i[nterlace]   write png-file with interlacing on\n");
-  fprintf (stderr, "   -a[lpha] <file>.pgm read PNG alpha channel as pgm-file\n");
+  fprintf (stderr,
+      "   -a[lpha] <file>.pgm read PNG alpha channel as pgm-file\n");
  fprintf (stderr, "   -h | -?  print this help-information\n");
 }

@@ -184,30 +187,31 @@ void usage()
 *  pnm2png
 */

-BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace, BOOL alpha)
+BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
+     BOOL alpha)
 {
  png_struct    *png_ptr = NULL;
  png_info      *info_ptr = NULL;
  png_byte      *png_pixels = NULL;
  png_byte      **row_pointers = NULL;
  png_byte      *pix_ptr = NULL;
-  png_uint_32   row_bytes;
+  volatile png_uint_32   row_bytes;

  char          type_token[16];
  char          width_token[16];
  char          height_token[16];
  char          maxval_token[16];
-  int           color_type;
+  volatile int    color_type=1;
  unsigned long   ul_width=0, ul_alpha_width=0;
  unsigned long   ul_height=0, ul_alpha_height=0;
  unsigned long   ul_maxval=0;
-  png_uint_32   width, alpha_width;
-  png_uint_32   height, alpha_height;
+  volatile png_uint_32   width=0, height=0;
+  volatile png_uint_32   alpha_width=0, alpha_height=0;
  png_uint_32   maxval;
-  int           bit_depth = 0;
-  int           channels;
+  volatile int           bit_depth = 0;
+  int           channels=0;
  int           alpha_depth = 0;
-  int           alpha_present;
+  int           alpha_present=0;
  int           row, col;
  BOOL          raw, alpha_raw = FALSE;
 #if defined(PNG_WRITE_INVERT_SUPPORTED) || defined(PNG_WRITE_PACK_SUPPORTED)
@@ -353,8 +357,10 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
    channels = 3;
  else if (color_type == PNG_COLOR_TYPE_RGB_ALPHA)
    channels = 4;
+#if 0
  else
-    channels = 0; /* should not happen */
+    channels = 0; /* cannot happen */
+#endif

  alpha_present = (channels - 1) % 2;

@@ -367,23 +373,24 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
    /* row_bytes is the width x number of channels x (bit-depth / 8) */
    row_bytes = width * channels * ((bit_depth <= 8) ? 1 : 2);

-  if ((png_pixels = (png_byte *) malloc (row_bytes * height * sizeof (png_byte))) == NULL)
+  if ((png_pixels = (png_byte *)
+     malloc (row_bytes * height * sizeof (png_byte))) == NULL)
    return FALSE;

  /* read data from PNM file */
  pix_ptr = png_pixels;

-  for (row = 0; row < height; row++)
+  for (row = 0; row < (int) height; row++)
  {
 #if defined(PNG_WRITE_INVERT_SUPPORTED) || defined(PNG_WRITE_PACK_SUPPORTED)
    if (packed_bitmap) {
-      for (i = 0; i < row_bytes; i++)
+      for (i = 0; i < (int) row_bytes; i++)
        /* png supports this format natively so no conversion is needed */
        *pix_ptr++ = get_data (pnm_file, 8);
    } else
 #endif
    {
-      for (col = 0; col < width; col++)
+      for (col = 0; col < (int) width; col++)
      {
        for (i = 0; i < (channels - alpha_present); i++)
        {
@@ -421,15 +428,20 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
  } /* end for row */

  /* prepare the standard PNG structures */
-  png_ptr = png_create_write_struct (PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
+  png_ptr = png_create_write_struct (png_get_libpng_ver(NULL), NULL, NULL,
+      NULL);
  if (!png_ptr)
  {
+    free (png_pixels);
+    png_pixels = NULL;
    return FALSE;
  }
  info_ptr = png_create_info_struct (png_ptr);
  if (!info_ptr)
  {
    png_destroy_write_struct (&png_ptr, (png_infopp) NULL);
+    free (png_pixels);
+    png_pixels = NULL;
    return FALSE;
  }

@@ -444,7 +456,9 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
  /* setjmp() must be called in every function that calls a PNG-reading libpng function */
  if (setjmp (png_jmpbuf(png_ptr)))
  {
-    png_destroy_write_struct (&png_ptr, (png_infopp) NULL);
+    png_destroy_write_struct (&png_ptr, &info_ptr);
+    free (png_pixels);
+    png_pixels = NULL;
    return FALSE;
  }

@@ -462,25 +476,28 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
  /* if needed we will allocate memory for an new array of row-pointers */
  if (row_pointers == (unsigned char**) NULL)
  {
-    if ((row_pointers = (png_byte **) malloc (height * sizeof (png_bytep))) == NULL)
+    if ((row_pointers = (png_byte **)
+        malloc (height * sizeof (png_bytep))) == NULL)
    {
-      png_destroy_write_struct (&png_ptr, (png_infopp) NULL);
+      png_destroy_write_struct (&png_ptr, &info_ptr);
+      free (png_pixels);
+      png_pixels = NULL;
      return FALSE;
    }
  }

  /* set the individual row_pointers to point at the correct offsets */
-  for (i = 0; i < (height); i++)
+  for (i = 0; i < (int) height; i++)
    row_pointers[i] = png_pixels + i * row_bytes;

  /* write out the entire image data in one call */
  png_write_image (png_ptr, row_pointers);

-  /* write the additional chuncks to the PNG file (not really needed) */
+  /* write the additional chunks to the PNG file (not really needed) */
  png_write_end (png_ptr, info_ptr);

  /* clean up after the write, and free any memory allocated */
-  png_destroy_write_struct (&png_ptr, (png_infopp) NULL);
+  png_destroy_write_struct (&png_ptr, &info_ptr);

  if (row_pointers != (unsigned char**) NULL)
    free (row_pointers);
--- a/example.c
+++ b/example.c
@@ -89,7 +89,7 @@ void read_png(char *file_name)  /* We need to open the file */
 {
   png_structp png_ptr;
   png_infop info_ptr;
-   unsigned int sig_read = 0;
+   int sig_read = 0;
   png_uint_32 width, height;
   int bit_depth, color_type, interlace_type;
   FILE *fp;
@@ -98,7 +98,7 @@ void read_png(char *file_name)  /* We need to open the file */
      return (ERROR);

 #else no_open_file /* prototype 2 */
-void read_png(FILE *fp, unsigned int sig_read)  /* File is already open */
+void read_png(FILE *fp, int sig_read)  /* File is already open */
 {
   png_structp png_ptr;
   png_infop info_ptr;
@@ -188,7 +188,7 @@ void read_png(FILE *fp, unsigned int sig_read)  /* File is already open */
    * are mutually exclusive.
    */

-   /* Tell libpng to strip 16 bit/color files down to 8 bits/color.
+   /* Tell libpng to strip 16 bits/color files down to 8 bits/color.
    * Use accurate scaling if it's available, otherwise just chop off the
    * low byte.
    */
@@ -284,7 +284,7 @@ void read_png(FILE *fp, unsigned int sig_read)  /* File is already open */
   }

 #ifdef PNG_READ_QUANTIZE_SUPPORTED
-   /* Quantize RGB files down to 8 bit palette or reduce palettes
+   /* Quantize RGB files down to 8-bit palette or reduce palettes
    * to the number of colors available on your screen.
    */
   if (color_type & PNG_COLOR_MASK_COLOR)
@@ -336,7 +336,7 @@ void read_png(FILE *fp, unsigned int sig_read)  /* File is already open */
   /* Swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR) */
   png_set_swap_alpha(png_ptr);

-   /* Swap bytes of 16 bit files to least significant byte first */
+   /* Swap bytes of 16-bit files to least significant byte first */
   png_set_swap(png_ptr);

   /* Add filler (or alpha) byte (before/after each RGB triplet) */
@@ -784,7 +784,7 @@ void write_png(char *file_name /* , ... other image information ... */)
   /* Swap bytes of 16-bit files to most significant byte first */
   png_set_swap(png_ptr);

-   /* Swap bits of 1, 2, 4 bit packed pixel formats */
+   /* Swap bits of 1-bit, 2-bit, 4-bit packed pixel formats */
   png_set_packswap(png_ptr);

   /* Turn on interlace handling if you are not using png_write_image() */
--- a/libpng-manual.txt
+++ b/libpng-manual.txt
@@ -1,6 +1,6 @@
 Libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.5.23 - July 23, 2015
+ libpng version 1.5.26 - December 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2014 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ Libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.5.23 - July 23, 2015
+ libpng versions 0.97, January 1998, through 1.5.26 - December 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2014 Glenn Randers-Pehrson

@@ -51,15 +51,16 @@ a W3C Recommendation and as an ISO Standard (ISO/IEC 15948:2004 (E)) at
 The W3C and ISO documents have identical technical content.

 The PNG-1.2 specification is available at
-<http://www.libpng.org/pub/png/documents/>.  It is technically equivalent
+<http://png-mng.sourceforge.net/pub/png/spec/1.2/>.
+It is technically equivalent
 to the PNG specification (second edition) but has some additional material.

-The PNG-1.0 specification is available
-as RFC 2083 <http://www.libpng.org/pub/png/documents/> and as a
-W3C Recommendation <http://www.w3.org/TR/REC.png.html>.
+The PNG-1.0 specification is available as RFC 2083 
+<http://png-mng.sourceforge.net/pub/png/spec/1.0/> and as a
+W3C Recommendation <http://www.w3.org/TR/REC-png-961001>.

 Some additional chunks are described in the special-purpose public chunks
-documents at <http://www.libpng.org/pub/png/documents/>.
+documents at <http://www.libpng.org/pub/png/spec/register/>

 Other information
 about PNG, and the latest version of libpng, can be found at the PNG home
@@ -81,7 +82,7 @@ majority of the needs of its users.

 Libpng uses zlib for its compression and decompression of PNG files.
 Further information about zlib, and the latest version of zlib, can
-be found at the zlib home page, <http://www.info-zip.org/pub/infozip/zlib/>.
+be found at the zlib home page, <http://zlib.net/>.
 The zlib compression utility is a general purpose utility that is
 useful for more than PNG files, and can be used without libpng.
 See the documentation delivered with zlib for more details.
@@ -1710,9 +1711,9 @@ data for sBIT, regardless of the error_action setting.
 The default values come from the PNG file cHRM chunk if present; otherwise, the
 defaults correspond to the ITU-R recommendation 709, and also the sRGB color
 space, as recommended in the Charles Poynton's Colour FAQ,
-<http://www.poynton.com/>, in section 9:
+Copyright (c) 2006-11-28 Charles Poynton, in section 9:

-   <http://www.poynton.com/notes/colour_and_gamma/ColorFAQ.html#RTFToC9>
+<http://www.poynton.com/notes/colour_and_gamma/ColorFAQ.html#RTFToC9>

    Y = 0.2126 * R + 0.7152 * G + 0.0722 * B

@@ -2709,8 +2710,7 @@ Some of the more important parts of the png_info are:

 If you call png_set_IHDR(), the call must appear before any of the
 other png_set_*() functions, because they might require access to some of
-the IHDR settings.  The remaining png_set_*() functions can be called
-in any order.
+the IHDR settings.

 If you wish, you can reset the compression_type, interlace_type, or
 filter_method later by calling png_set_IHDR() again; if you do this, the
@@ -2723,6 +2723,12 @@ width, height, bit_depth, and color_type must be the same in each call.
                     (array of png_color)
    num_palette    - number of entries in the palette

+If you call png_set_PLTE(), the call must appear before either of
+png_set_tRNS() or png_set_hIST() appears, because they require access
+to the palette length.
+
+The remaining png_set_*() functions can be called in any order.
+
    png_set_gAMA(png_ptr, info_ptr, file_gamma);
    png_set_gAMA_fixed(png_ptr, info_ptr, int_file_gamma);

@@ -4244,7 +4250,7 @@ a set of "safe" limits is applied in pngpriv.h.  These can be overridden by
 application calls to png_set_user_limits(), png_set_user_chunk_cache_max(),
 and/or png_set_user_malloc_max() that increase or decrease the limits.  Also,
 in libpng-1.5.10 the default width and height limits were increased
-from 1,000,000 to 0x7ffffff (i.e., made unlimited).  Therefore, the
+from 1,000,000 to 0x7fffffff (i.e., made unlimited).  Therefore, the
 limits are now
                               default      safe
   png_user_width_max        0x7fffffff    1,000,000
@@ -4255,6 +4261,11 @@ limits are now
 The png_set_option() function (and the "options" member of the png struct) was
 added to libpng-1.5.15.

+Starting with libpng-1.5.24, attempting to set an over-length PLTE chunk
+is an error. Previously this requirement of the PNG specification was not
+enforced, and the palette was always limited to 256 entries. An over-length
+PLTE chunk found in an input PNG is silently truncated.
+
 The library now supports a complete fixed point implementation and can
 thus be used on systems that have no floating point support or very
 limited or slow support.  Previously gamma correction, an essential part
@@ -4500,13 +4511,11 @@ Other rules can be inferred by inspecting the libpng source.

 XIV. Y2K Compliance in libpng

-July 23, 2015
-
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.5.23 are Y2K compliant.  It is my belief that earlier
+upward through 1.5.26 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
--- a/libpng.3
+++ b/libpng.3
@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "July 23, 2015"
+.TH LIBPNG 3 "December 17, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.5.23
+libpng \- Portable Network Graphics (PNG) Reference Library 1.5.26
 .SH SYNOPSIS
 \fB
 #include <png.h>\fP
@@ -496,7 +496,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 Libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.5.23 - July 23, 2015
+ libpng version 1.5.26 - December 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2014 Glenn Randers-Pehrson
@@ -507,7 +507,7 @@ Libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.5.23 - July 23, 2015
+ libpng versions 0.97, January 1998, through 1.5.26 - December 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2014 Glenn Randers-Pehrson

@@ -547,15 +547,16 @@ a W3C Recommendation and as an ISO Standard (ISO/IEC 15948:2004 (E)) at
 The W3C and ISO documents have identical technical content.

 The PNG-1.2 specification is available at
-<http://www.libpng.org/pub/png/documents/>.  It is technically equivalent
+<http://png-mng.sourceforge.net/pub/png/spec/1.2/>.
+It is technically equivalent
 to the PNG specification (second edition) but has some additional material.

-The PNG-1.0 specification is available
-as RFC 2083 <http://www.libpng.org/pub/png/documents/> and as a
-W3C Recommendation <http://www.w3.org/TR/REC.png.html>.
+The PNG-1.0 specification is available as RFC 2083 
+<http://png-mng.sourceforge.net/pub/png/spec/1.0/> and as a
+W3C Recommendation <http://www.w3.org/TR/REC-png-961001>.

 Some additional chunks are described in the special-purpose public chunks
-documents at <http://www.libpng.org/pub/png/documents/>.
+documents at <http://www.libpng.org/pub/png/spec/register/>

 Other information
 about PNG, and the latest version of libpng, can be found at the PNG home
@@ -577,7 +578,7 @@ majority of the needs of its users.

 Libpng uses zlib for its compression and decompression of PNG files.
 Further information about zlib, and the latest version of zlib, can
-be found at the zlib home page, <http://www.info-zip.org/pub/infozip/zlib/>.
+be found at the zlib home page, <http://zlib.net/>.
 The zlib compression utility is a general purpose utility that is
 useful for more than PNG files, and can be used without libpng.
 See the documentation delivered with zlib for more details.
@@ -2206,9 +2207,9 @@ data for sBIT, regardless of the error_action setting.
 The default values come from the PNG file cHRM chunk if present; otherwise, the
 defaults correspond to the ITU-R recommendation 709, and also the sRGB color
 space, as recommended in the Charles Poynton's Colour FAQ,
-<http://www.poynton.com/>, in section 9:
+Copyright (c) 2006-11-28 Charles Poynton, in section 9:

-   <http://www.poynton.com/notes/colour_and_gamma/ColorFAQ.html#RTFToC9>
+<http://www.poynton.com/notes/colour_and_gamma/ColorFAQ.html#RTFToC9>

    Y = 0.2126 * R + 0.7152 * G + 0.0722 * B

@@ -3205,8 +3206,7 @@ Some of the more important parts of the png_info are:

 If you call png_set_IHDR(), the call must appear before any of the
 other png_set_*() functions, because they might require access to some of
-the IHDR settings.  The remaining png_set_*() functions can be called
-in any order.
+the IHDR settings.

 If you wish, you can reset the compression_type, interlace_type, or
 filter_method later by calling png_set_IHDR() again; if you do this, the
@@ -3219,6 +3219,12 @@ width, height, bit_depth, and color_type must be the same in each call.
                     (array of png_color)
    num_palette    - number of entries in the palette

+If you call png_set_PLTE(), the call must appear before either of
+png_set_tRNS() or png_set_hIST() appears, because they require access
+to the palette length.
+
+The remaining png_set_*() functions can be called in any order.
+
    png_set_gAMA(png_ptr, info_ptr, file_gamma);
    png_set_gAMA_fixed(png_ptr, info_ptr, int_file_gamma);

@@ -4740,7 +4746,7 @@ a set of "safe" limits is applied in pngpriv.h.  These can be overridden by
 application calls to png_set_user_limits(), png_set_user_chunk_cache_max(),
 and/or png_set_user_malloc_max() that increase or decrease the limits.  Also,
 in libpng-1.5.10 the default width and height limits were increased
-from 1,000,000 to 0x7ffffff (i.e., made unlimited).  Therefore, the
+from 1,000,000 to 0x7fffffff (i.e., made unlimited).  Therefore, the
 limits are now
                               default      safe
   png_user_width_max        0x7fffffff    1,000,000
@@ -4751,6 +4757,11 @@ limits are now
 The png_set_option() function (and the "options" member of the png struct) was
 added to libpng-1.5.15.

+Starting with libpng-1.5.24, attempting to set an over-length PLTE chunk
+is an error. Previously this requirement of the PNG specification was not
+enforced, and the palette was always limited to 256 entries. An over-length
+PLTE chunk found in an input PNG is silently truncated.
+
 The library now supports a complete fixed point implementation and can
 thus be used on systems that have no floating point support or very
 limited or slow support.  Previously gamma correction, an essential part
@@ -4996,13 +5007,11 @@ Other rules can be inferred by inspecting the libpng source.

 .SH XIV. Y2K Compliance in libpng

-July 23, 2015
-
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.5.23 are Y2K compliant.  It is my belief that earlier
+upward through 1.5.26 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -5063,195 +5072,45 @@ the first widely used release:
 source             png.h  png.h  shared-lib
 version            string   int  version
 -------            ------  ----- ----------
- 0.89c ("beta 3")  0.89       89  1.0.89
- 0.90  ("beta 4")  0.90       90  0.90
- 0.95  ("beta 5")  0.95       95  0.95
- 0.96  ("beta 6")  0.96       96  0.96
- 0.97b ("beta 7")  1.00.97    97  1.0.1
- 0.97c             0.97       97  2.0.97
- 0.98              0.98       98  2.0.98
- 0.99              0.99       98  2.0.99
- 0.99a-m           0.99       99  2.0.99
- 1.00              1.00      100  2.1.0
- 1.0.0             1.0.0     100  2.1.0
- 1.0.0   (from here on, the  100  2.1.0
- 1.0.1    png.h string is  10001  2.1.0
- 1.0.1a-e identical to the 10002  from here on, the
- 1.0.2    source version)  10002  shared library is 2.V
- 1.0.2a-b                  10003  where V is the source
- 1.0.1                     10001  code version except as
- 1.0.1a-e                  10002  2.1.0.1a-e   noted.
- 1.0.2                     10002  2.1.0.2
- 1.0.2a-b                  10003  2.1.0.2a-b
- 1.0.3                     10003  2.1.0.3
- 1.0.3a-d                  10004  2.1.0.3a-d
- 1.0.4                     10004  2.1.0.4
- 1.0.4a-f                  10005  2.1.0.4a-f
- 1.0.5 (+ 2 patches)       10005  2.1.0.5
- 1.0.5a-d                  10006  2.1.0.5a-d
- 1.0.5e-r                  10100  2.1.0.5e-r
- 1.0.5s-v                  10006  2.1.0.5s-v
- 1.0.6 (+ 3 patches)       10006  2.1.0.6
- 1.0.6d-g                  10007  2.1.0.6d-g
- 1.0.6h                    10007  10.6h
- 1.0.6i                    10007  10.6i
- 1.0.6j                    10007  2.1.0.6j
- 1.0.7beta11-14    DLLNUM  10007  2.1.0.7beta11-14
- 1.0.7beta15-18       1    10007  2.1.0.7beta15-18
- 1.0.7rc1-2           1    10007  2.1.0.7rc1-2
- 1.0.7                1    10007  2.1.0.7
- 1.0.8beta1-4         1    10008  2.1.0.8beta1-4
- 1.0.8rc1             1    10008  2.1.0.8rc1
- 1.0.8                1    10008  2.1.0.8
- 1.0.9beta1-6         1    10009  2.1.0.9beta1-6
- 1.0.9rc1             1    10009  2.1.0.9rc1
- 1.0.9beta7-10        1    10009  2.1.0.9beta7-10
- 1.0.9rc2             1    10009  2.1.0.9rc2
- 1.0.9                1    10009  2.1.0.9
- 1.0.10beta1          1    10010  2.1.0.10beta1
- 1.0.10rc1            1    10010  2.1.0.10rc1
- 1.0.10               1    10010  2.1.0.10
- 1.0.11beta1-3        1    10011  2.1.0.11beta1-3
- 1.0.11rc1            1    10011  2.1.0.11rc1
- 1.0.11               1    10011  2.1.0.11
- 1.0.12beta1-2        2    10012  2.1.0.12beta1-2
- 1.0.12rc1            2    10012  2.1.0.12rc1
- 1.0.12               2    10012  2.1.0.12
- 1.1.0a-f             -    10100  2.1.1.0a-f abandoned
- 1.2.0beta1-2         2    10200  2.1.2.0beta1-2
- 1.2.0beta3-5         3    10200  3.1.2.0beta3-5
- 1.2.0rc1             3    10200  3.1.2.0rc1
- 1.2.0                3    10200  3.1.2.0
- 1.2.1beta-4          3    10201  3.1.2.1beta1-4
- 1.2.1rc1-2           3    10201  3.1.2.1rc1-2
- 1.2.1                3    10201  3.1.2.1
- 1.2.2beta1-6        12    10202  12.so.0.1.2.2beta1-6
- 1.0.13beta1         10    10013  10.so.0.1.0.13beta1
- 1.0.13rc1           10    10013  10.so.0.1.0.13rc1
- 1.2.2rc1            12    10202  12.so.0.1.2.2rc1
- 1.0.13              10    10013  10.so.0.1.0.13
- 1.2.2               12    10202  12.so.0.1.2.2
- 1.2.3rc1-6          12    10203  12.so.0.1.2.3rc1-6
- 1.2.3               12    10203  12.so.0.1.2.3
- 1.2.4beta1-3        13    10204  12.so.0.1.2.4beta1-3
- 1.2.4rc1            13    10204  12.so.0.1.2.4rc1
- 1.0.14              10    10014  10.so.0.1.0.14
- 1.2.4               13    10204  12.so.0.1.2.4
- 1.2.5beta1-2        13    10205  12.so.0.1.2.5beta1-2
- 1.0.15rc1           10    10015  10.so.0.1.0.15rc1
- 1.0.15              10    10015  10.so.0.1.0.15
- 1.2.5               13    10205  12.so.0.1.2.5
- 1.2.6beta1-4        13    10206  12.so.0.1.2.6beta1-4
- 1.2.6rc1-5          13    10206  12.so.0.1.2.6rc1-5
- 1.0.16              10    10016  10.so.0.1.0.16
- 1.2.6               13    10206  12.so.0.1.2.6
- 1.2.7beta1-2        13    10207  12.so.0.1.2.7beta1-2
- 1.0.17rc1           10    10017  12.so.0.1.0.17rc1
- 1.2.7rc1            13    10207  12.so.0.1.2.7rc1
- 1.0.17              10    10017  12.so.0.1.0.17
- 1.2.7               13    10207  12.so.0.1.2.7
- 1.2.8beta1-5        13    10208  12.so.0.1.2.8beta1-5
- 1.0.18rc1-5         10    10018  12.so.0.1.0.18rc1-5
- 1.2.8rc1-5          13    10208  12.so.0.1.2.8rc1-5
- 1.0.18              10    10018  12.so.0.1.0.18
- 1.2.8               13    10208  12.so.0.1.2.8
- 1.2.9beta1-3        13    10209  12.so.0.1.2.9beta1-3
- 1.2.9beta4-11       13    10209  12.so.0.9[.0]
- 1.2.9rc1            13    10209  12.so.0.9[.0]
- 1.2.9               13    10209  12.so.0.9[.0]
- 1.2.10beta1-7       13    10210  12.so.0.10[.0]
- 1.2.10rc1-2         13    10210  12.so.0.10[.0]
- 1.2.10              13    10210  12.so.0.10[.0]
- 1.4.0beta1-6        14    10400  14.so.0.0[.0]
- 1.2.11beta1-4       13    10210  12.so.0.11[.0]
- 1.4.0beta7-8        14    10400  14.so.0.0[.0]
- 1.2.11              13    10211  12.so.0.11[.0]
- 1.2.12              13    10212  12.so.0.12[.0]
- 1.4.0beta9-14       14    10400  14.so.0.0[.0]
- 1.2.13              13    10213  12.so.0.13[.0]
- 1.4.0beta15-36      14    10400  14.so.0.0[.0]
- 1.4.0beta37-87      14    10400  14.so.14.0[.0]
- 1.4.0rc01           14    10400  14.so.14.0[.0]
- 1.4.0beta88-109     14    10400  14.so.14.0[.0]
- 1.4.0rc02-08        14    10400  14.so.14.0[.0]
- 1.4.0               14    10400  14.so.14.0[.0]
- 1.4.1beta01-03      14    10401  14.so.14.1[.0]
- 1.4.1rc01           14    10401  14.so.14.1[.0]
- 1.4.1beta04-12      14    10401  14.so.14.1[.0]
- 1.4.1               14    10401  14.so.14.1[.0]
- 1.4.2               14    10402  14.so.14.2[.0]
- 1.4.3               14    10403  14.so.14.3[.0]
- 1.4.4               14    10404  14.so.14.4[.0]
- 1.5.0beta01-58      15    10500  15.so.15.0[.0]
- 1.5.0rc01-07        15    10500  15.so.15.0[.0]
- 1.5.0               15    10500  15.so.15.0[.0]
- 1.5.1beta01-11      15    10501  15.so.15.1[.0]
- 1.5.1rc01-02        15    10501  15.so.15.1[.0]
- 1.5.1               15    10501  15.so.15.1[.0]
- 1.5.2beta01-03      15    10502  15.so.15.2[.0]
- 1.5.2rc01-03        15    10502  15.so.15.2[.0]
- 1.5.2               15    10502  15.so.15.2[.0]
- 1.5.3beta01-10      15    10503  15.so.15.3[.0]
- 1.5.3rc01-02        15    10503  15.so.15.3[.0]
- 1.5.3beta11         15    10503  15.so.15.3[.0]
- 1.5.3 [omitted]
- 1.5.4beta01-08      15    10504  15.so.15.4[.0]
- 1.5.4rc01           15    10504  15.so.15.4[.0]
- 1.5.4               15    10504  15.so.15.4[.0]
- 1.5.5beta01-08      15    10505  15.so.15.5[.0]
- 1.5.5rc01           15    10505  15.so.15.5[.0]
- 1.5.5               15    10505  15.so.15.5[.0]
- 1.5.6beta01-07      15    10506  15.so.15.6[.0]
- 1.5.6rc01-03        15    10506  15.so.15.6[.0]
- 1.5.6               15    10506  15.so.15.6[.0]
- 1.5.7beta01-05      15    10507  15.so.15.7[.0]
- 1.5.7rc01-03        15    10507  15.so.15.7[.0]
- 1.5.7               15    10507  15.so.15.7[.0]
- 1.5.8beta01         15    10508  15.so.15.8[.0]
- 1.5.8rc01           15    10508  15.so.15.8[.0]
- 1.5.8               15    10508  15.so.15.8[.0]
- 1.5.9beta01-02      15    10509  15.so.15.9[.0]
- 1.5.9rc01           15    10509  15.so.15.9[.0]
- 1.5.9               15    10509  15.so.15.9[.0]
- 1.5.10beta01-05     15    10510  15.so.15.10[.0]
- 1.5.10              15    10510  15.so.15.10[.0]
- 1.5.11beta01        15    10511  15.so.15.11[.0]
- 1.5.11rc01-05       15    10511  15.so.15.11[.0]
- 1.5.11              15    10511  15.so.15.11[.0]
- 1.5.12              15    10512  15.so.15.12[.0]
- 1.5.13beta01-02     15    10513  15.so.15.13[.0]
- 1.5.13rc01          15    10513  15.so.15.13[.0]
- 1.5.13              15    10513  15.so.15.13[.0]
- 1.5.14beta01-08     15    10514  15.so.15.14[.0]
- 1.5.14rc01-03       15    10514  15.so.15.14[.0]
- 1.5.14              15    10514  15.so.15.14[.0]
- 1.5.15beta01-09     15    10515  15.so.15.15[.0]
- 1.5.15rc01          15    10515  15.so.15.15[.0]
- 1.5.15              15    10515  15.so.15.15[.0]
- 1.5.16beta01-06     15    10516  15.so.15.16[.0]
- 1.5.16rc01          15    10516  15.so.15.16[.0]
- 1.5.16              15    10516  15.so.15.16[.0]
- 1.5.17beta01        15    10517  15.so.15.17[.0]
- 1.5.17rc01-03       15    10517  15.so.15.17[.0]
- 1.5.17              15    10517  15.so.15.17[.0]
- 1.5.18beta01-05     15    10518  15.so.15.18[.0]
- 1.5.18rc01-02       15    10518  15.so.15.18[.0]
- 1.5.18              15    10518  15.so.15.18[.0]
- 1.5.19beta01-05     15    10519  15.so.15.19[.0]
- 1.5.19rc01          15    10519  15.so.15.19[.0]
- 1.5.19              15    10519  15.so.15.19[.0]
- 1.5.20beta01-02     15    10520  15.so.15.20[.0]
- 1.5.20rc01-03       15    10520  15.so.15.20[.0]
- 1.5.20              15    10520  15.so.15.20[.0]
- 1.5.21beta01-02     15    10521  15.so.15.21[.0]
- 1.5.21rc01-03       15    10521  15.so.15.21[.0]
- 1.5.21              15    10521  15.so.15.21[.0]
- 1.5.22beta01-04     15    10522  15.so.15.22[.0]
- 1.5.22rc01-04       15    10522  15.so.15.22[.0]
- 1.5.22              15    10522  15.so.15.22[.0]
- 1.5.23beta01-02     15    10523  15.so.15.23[.0]
- 1.5.23rc01-03       15    10523  15.so.15.23[.0]
- 1.5.23              15    10523  15.so.15.23[.0]
+ 0.89c "1.0 beta 3"     0.89      89  1.0.89
+ 0.90  "1.0 beta 4"     0.90      90  0.90  [should have been 2.0.90]
+ 0.95  "1.0 beta 5"     0.95      95  0.95  [should have been 2.0.95]
+ 0.96  "1.0 beta 6"     0.96      96  0.96  [should have been 2.0.96]
+ 0.97b "1.00.97 beta 7" 1.00.97   97  1.0.1 [should have been 2.0.97]
+ 0.97c                  0.97      97  2.0.97
+ 0.98                   0.98      98  2.0.98
+ 0.99                   0.99      98  2.0.99
+ 0.99a-m                0.99      99  2.0.99
+ 1.00                   1.00     100  2.1.0 [100 should be 10000]
+ 1.0.0      (from here on, the   100  2.1.0 [100 should be 10000]
+ 1.0.1       png.h string is   10001  2.1.0
+ 1.0.1a-e    identical to the  10002  from here on, the shared library
+ 1.0.2       source version)   10002  is 2.V where V is the source code
+ 1.0.2a-b                      10003  version, except as noted.
+ 1.0.3                         10003
+ 1.0.3a-d                      10004
+ 1.0.4                         10004
+ 1.0.4a-f                      10005
+ 1.0.5 (+ 2 patches)           10005
+ 1.0.5a-d                      10006
+ 1.0.5e-r                      10100 (not source compatible)
+ 1.0.5s-v                      10006 (not binary compatible)
+ 1.0.6 (+ 3 patches)           10006 (still binary incompatible)
+ 1.0.6d-f                      10007 (still binary incompatible)
+ 1.0.6g                        10007
+ 1.0.6h                        10007  10.6h (testing xy.z so-numbering)
+ 1.0.6i                        10007  10.6i
+ 1.0.6j                        10007  2.1.0.6j (incompatible with 1.0.0)
+ 1.0.7beta11-14        DLLNUM  10007  2.1.0.7beta11-14 (binary compatible)
+ 1.0.7beta15-18           1    10007  2.1.0.7beta15-18 (binary compatible)
+ 1.0.7rc1-2               1    10007  2.1.0.7rc1-2 (binary compatible)
+ 1.0.7                    1    10007  (still compatible)
+ ...
+ 1.0.19                  10    10019  10.so.0.19[.0]
+ ...
+ 1.2.53                  13    10253  12.so.0.53[.0]
+ ...
+ 1.5.25                  15    10525  15.so.15.25[.0]

 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -5261,11 +5120,10 @@ for applications, is an unsigned integer of the form xyyzz corresponding
 to the source version x.y.z (leading zeros in y and z).  Beta versions
 were given the previous public release number plus a letter, until
 version 1.0.6j; from then on they were given the upcoming public
-release number plus "betaNN" or "rcN".
+release number plus "betaNN" or "rcNN".

 .SH "SEE ALSO"
-.BR "png"(5), " libpngpf"(3), " zlib"(3), " deflate"(5), " " and " zlib"(5)
-
+.IR libpngpf(3) ", " png(5)
 .LP
 .IR libpng :
 .IP
@@ -5288,7 +5146,7 @@ ftp://ftp.info-zip.org/pub/infozip/zlib
 .I libpng
 or at
 .br
-ftp://ds.internic.net/rfc/rfc2083.txt
+ftp://ftp.rfc-editor.org:/in-notes/rfc2083.txt
 .br
 or (as a W3C Recommendation) at
 .br
@@ -5308,7 +5166,7 @@ possible without all of you.

 Thanks to Frank J. T. Wojcik for helping with the documentation.

-Libpng version 1.5.23 - July 23, 2015:
+Libpng version 1.5.26 - December 17, 2015:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).

@@ -5320,21 +5178,24 @@ png-mng-implement at lists.sourceforge.net (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
 to subscribe).

-.SH COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
+.SH NOTICES:

-(This copy of the libpng notices is provided for your convenience.  In case of
+This copy of the libpng notices is provided for your convenience.  In case of
 any discrepancy between this copy and the notices in the file png.h that is
-included in the libpng distribution, the latter shall prevail.)
+included in the libpng distribution, the latter shall prevail.
+
+COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:

 If you modify libpng you may insert additional notices immediately following
 this sentence.

 This code is released under the libpng license.

-libpng versions 1.0.7, July 1, 2000, through 1.5.23, July 23, 2015, are
-Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, and are
-distributed according to the same disclaimer and license as libpng-1.0.6
-with the following individuals added to the list of Contributing Authors:
+libpng versions 1.0.7, July 1, 2000, through 1.5.26, December 17, 2015, are
+Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
+derived from libpng-1.0.6, and are distributed according to the same
+disclaimer and license as libpng-1.0.6 with the following individuals
+added to the list of Contributing Authors:

   Simon-Pierre Cadieux
   Eric S. Raymond
@@ -5352,18 +5213,20 @@ and with the following additions to the disclaimer:
   the user.

 libpng versions 0.97, January 1998, through 1.0.6, March 20, 2000, are
-Copyright (c) 1998-2000 Glenn Randers-Pehrson, and are distributed according
-to the same disclaimer and license as libpng-0.96, with the following
-individuals added to the list of Contributing Authors:
+Copyright (c) 1998-2000 Glenn Randers-Pehrson, are derived from
+libpng-0.96, and are distributed according to the same disclaimer and
+license as libpng-0.96, with the following individuals added to the list
+of Contributing Authors:

   Tom Lane
   Glenn Randers-Pehrson
   Willem van Schaik

 libpng versions 0.89, June 1996, through 0.96, May 1997, are
-Copyright (c) 1996-1997 Andreas Dilger, and are
-distributed according to the same disclaimer and license as libpng-0.88,
-with the following individuals added to the list of Contributing Authors:
+Copyright (c) 1996-1997 Andreas Dilger, are derived from libpng-0.88,
+and are distributed according to the same disclaimer and license as
+libpng-0.88, with the following individuals added to the list of
+Contributing Authors:

   John Bowler
   Kevin Bracey
@@ -5410,6 +5273,8 @@ supporting the PNG file format in commercial products.  If you use this
 source code in a product, acknowledgment is not required but would be
 appreciated.

+END OF COPYRIGHT NOTICE, DISCLAIMER, and LICENSE.
+
 A "png_get_copyright" function is available, for convenient use in "about"
 boxes and the like:

@@ -5424,7 +5289,7 @@ the additional disclaimers inserted at version 1.0.7.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-July 23, 2015
+December 17, 2015

 .\" end of man page

--- a/libpngpf.3
+++ b/libpngpf.3
@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "July 23, 2015"
+.TH LIBPNGPF 3 "December 17, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.5.23
+libpng \- Portable Network Graphics (PNG) Reference Library 1.5.26
 (private functions)
 .SH SYNOPSIS
 \fB#include \fI"pngpriv.h"
--- a/png.5
+++ b/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "July 23, 2015"
+.TH PNG 5 "December 17, 2015"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
@@ -27,7 +27,7 @@ PNG specification (second edition), November 2003:
 PNG 1.2 specification, July 1999:
 .IP
 .br
-http://www.libpng.org/pub/png
+http://png-mng.sourceforge.net/pub/png/spec/1.2/
 .LP
 PNG 1.0 specification, October 1996:
 .IP
@@ -39,7 +39,7 @@ ftp://ds.internic.net/rfc/rfc2083.txt
 .br
 or (as a W3C Recommendation) at
 .br
-http://www.w3.org/TR/REC-png.html
+http://www.w3.org/TR/REC-png-961001
 .SH AUTHORS
 This man page: Glenn Randers-Pehrson
 .LP
--- a/png.c
+++ b/png.c
@@ -2,7 +2,7 @@
 /* png.c - location for general purpose libpng functions
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -14,7 +14,7 @@
 #include "pngpriv.h"

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_23 Your_png_h_is_not_version_1_5_23;
+typedef png_libpng_version_1_5_26 Your_png_h_is_not_version_1_5_26;

 /* Tells libpng that we have already handled the first "num_bytes" bytes
 * of the PNG file signature.  If the PNG data is embedded into another
@@ -26,15 +26,20 @@ typedef png_libpng_version_1_5_23 Your_png_h_is_not_version_1_5_23;
 void PNGAPI
 png_set_sig_bytes(png_structp png_ptr, int num_bytes)
 {
+   unsigned int nb = (unsigned int)num_bytes;
+
   png_debug(1, "in png_set_sig_bytes");

   if (png_ptr == NULL)
      return;

-   if (num_bytes > 8)
+   if (num_bytes < 0)
+      nb = 0;
+
+   if (nb > 8)
      png_error(png_ptr, "Too many bytes for PNG signature");

-   png_ptr->sig_bytes = (png_byte)(num_bytes < 0 ? 0 : num_bytes);
+   png_ptr->sig_bytes = (png_byte)nb;
 }

 /* Checks whether the supplied bytes match the PNG signature.  We allow
@@ -306,6 +311,8 @@ png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size)
      png_destroy_struct(info_ptr);
      info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO);
      *ptr_ptr = info_ptr;
+      if (info_ptr == NULL)
+         return;
   }

   /* Set everything to 0 */
@@ -648,14 +655,15 @@ png_get_copyright(png_const_structp png_ptr)
 #else
 #  ifdef __STDC__
   return PNG_STRING_NEWLINE \
-     "libpng version 1.5.23 - July 23, 2015" PNG_STRING_NEWLINE \
-     "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
+     "libpng version 1.5.26 - December 17, 2015" PNG_STRING_NEWLINE \
+     "Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson" \
+     PNG_STRING_NEWLINE \
     "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
     "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
     PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.5.23 - July 23, 2015\
-      Copyright (c) 1998-2015 Glenn Randers-Pehrson\
+      return "libpng version 1.5.26 - December 17, 2015\
+      Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson\
      Copyright (c) 1996-1997 Andreas Dilger\
      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
 #  endif
--- a/png.h
+++ b/png.h
@@ -1,9 +1,9 @@

 /* png.h - header file for PNG reference library
 *
- * libpng version 1.5.23, July 23, 2015
+ * libpng version 1.5.26, December 17, 2015
 *
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -12,227 +12,9 @@
 * Authors and maintainers:
 *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
 *   libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.5.23, July 23, 2015: Glenn
+ *   libpng versions 0.97, January 1998, through 1.5.26, December 17, 2015:
+ *     Glenn Randers-Pehrson.
 *   See also "Contributing Authors", below.
- *
- * Note about libpng version numbers:
- *
- *   Due to various miscommunications, unforeseen code incompatibilities
- *   and occasional factors outside the authors' control, version numbering
- *   on the library has not always been consistent and straightforward.
- *   The following table summarizes matters since version 0.89c, which was
- *   the first widely used release:
- *
- *    source                 png.h  png.h  shared-lib
- *    version                string   int  version
- *    -------                ------ -----  ----------
- *    0.89c "1.0 beta 3"     0.89      89  1.0.89
- *    0.90  "1.0 beta 4"     0.90      90  0.90  [should have been 2.0.90]
- *    0.95  "1.0 beta 5"     0.95      95  0.95  [should have been 2.0.95]
- *    0.96  "1.0 beta 6"     0.96      96  0.96  [should have been 2.0.96]
- *    0.97b "1.00.97 beta 7" 1.00.97   97  1.0.1 [should have been 2.0.97]
- *    0.97c                  0.97      97  2.0.97
- *    0.98                   0.98      98  2.0.98
- *    0.99                   0.99      98  2.0.99
- *    0.99a-m                0.99      99  2.0.99
- *    1.00                   1.00     100  2.1.0 [100 should be 10000]
- *    1.0.0      (from here on, the   100  2.1.0 [100 should be 10000]
- *    1.0.1       png.h string is   10001  2.1.0
- *    1.0.1a-e    identical to the  10002  from here on, the shared library
- *    1.0.2       source version)   10002  is 2.V where V is the source code
- *    1.0.2a-b                      10003  version, except as noted.
- *    1.0.3                         10003
- *    1.0.3a-d                      10004
- *    1.0.4                         10004
- *    1.0.4a-f                      10005
- *    1.0.5 (+ 2 patches)           10005
- *    1.0.5a-d                      10006
- *    1.0.5e-r                      10100 (not source compatible)
- *    1.0.5s-v                      10006 (not binary compatible)
- *    1.0.6 (+ 3 patches)           10006 (still binary incompatible)
- *    1.0.6d-f                      10007 (still binary incompatible)
- *    1.0.6g                        10007
- *    1.0.6h                        10007  10.6h (testing xy.z so-numbering)
- *    1.0.6i                        10007  10.6i
- *    1.0.6j                        10007  2.1.0.6j (incompatible with 1.0.0)
- *    1.0.7beta11-14        DLLNUM  10007  2.1.0.7beta11-14 (binary compatible)
- *    1.0.7beta15-18           1    10007  2.1.0.7beta15-18 (binary compatible)
- *    1.0.7rc1-2               1    10007  2.1.0.7rc1-2 (binary compatible)
- *    1.0.7                    1    10007  (still compatible)
- *    1.0.8beta1-4             1    10008  2.1.0.8beta1-4
- *    1.0.8rc1                 1    10008  2.1.0.8rc1
- *    1.0.8                    1    10008  2.1.0.8
- *    1.0.9beta1-6             1    10009  2.1.0.9beta1-6
- *    1.0.9rc1                 1    10009  2.1.0.9rc1
- *    1.0.9beta7-10            1    10009  2.1.0.9beta7-10
- *    1.0.9rc2                 1    10009  2.1.0.9rc2
- *    1.0.9                    1    10009  2.1.0.9
- *    1.0.10beta1              1    10010  2.1.0.10beta1
- *    1.0.10rc1                1    10010  2.1.0.10rc1
- *    1.0.10                   1    10010  2.1.0.10
- *    1.0.11beta1-3            1    10011  2.1.0.11beta1-3
- *    1.0.11rc1                1    10011  2.1.0.11rc1
- *    1.0.11                   1    10011  2.1.0.11
- *    1.0.12beta1-2            2    10012  2.1.0.12beta1-2
- *    1.0.12rc1                2    10012  2.1.0.12rc1
- *    1.0.12                   2    10012  2.1.0.12
- *    1.1.0a-f                 -    10100  2.1.1.0a-f (branch abandoned)
- *    1.2.0beta1-2             2    10200  2.1.2.0beta1-2
- *    1.2.0beta3-5             3    10200  3.1.2.0beta3-5
- *    1.2.0rc1                 3    10200  3.1.2.0rc1
- *    1.2.0                    3    10200  3.1.2.0
- *    1.2.1beta1-4             3    10201  3.1.2.1beta1-4
- *    1.2.1rc1-2               3    10201  3.1.2.1rc1-2
- *    1.2.1                    3    10201  3.1.2.1
- *    1.2.2beta1-6            12    10202  12.so.0.1.2.2beta1-6
- *    1.0.13beta1             10    10013  10.so.0.1.0.13beta1
- *    1.0.13rc1               10    10013  10.so.0.1.0.13rc1
- *    1.2.2rc1                12    10202  12.so.0.1.2.2rc1
- *    1.0.13                  10    10013  10.so.0.1.0.13
- *    1.2.2                   12    10202  12.so.0.1.2.2
- *    1.2.3rc1-6              12    10203  12.so.0.1.2.3rc1-6
- *    1.2.3                   12    10203  12.so.0.1.2.3
- *    1.2.4beta1-3            13    10204  12.so.0.1.2.4beta1-3
- *    1.0.14rc1               13    10014  10.so.0.1.0.14rc1
- *    1.2.4rc1                13    10204  12.so.0.1.2.4rc1
- *    1.0.14                  10    10014  10.so.0.1.0.14
- *    1.2.4                   13    10204  12.so.0.1.2.4
- *    1.2.5beta1-2            13    10205  12.so.0.1.2.5beta1-2
- *    1.0.15rc1-3             10    10015  10.so.0.1.0.15rc1-3
- *    1.2.5rc1-3              13    10205  12.so.0.1.2.5rc1-3
- *    1.0.15                  10    10015  10.so.0.1.0.15
- *    1.2.5                   13    10205  12.so.0.1.2.5
- *    1.2.6beta1-4            13    10206  12.so.0.1.2.6beta1-4
- *    1.0.16                  10    10016  10.so.0.1.0.16
- *    1.2.6                   13    10206  12.so.0.1.2.6
- *    1.2.7beta1-2            13    10207  12.so.0.1.2.7beta1-2
- *    1.0.17rc1               10    10017  12.so.0.1.0.17rc1
- *    1.2.7rc1                13    10207  12.so.0.1.2.7rc1
- *    1.0.17                  10    10017  12.so.0.1.0.17
- *    1.2.7                   13    10207  12.so.0.1.2.7
- *    1.2.8beta1-5            13    10208  12.so.0.1.2.8beta1-5
- *    1.0.18rc1-5             10    10018  12.so.0.1.0.18rc1-5
- *    1.2.8rc1-5              13    10208  12.so.0.1.2.8rc1-5
- *    1.0.18                  10    10018  12.so.0.1.0.18
- *    1.2.8                   13    10208  12.so.0.1.2.8
- *    1.2.9beta1-3            13    10209  12.so.0.1.2.9beta1-3
- *    1.2.9beta4-11           13    10209  12.so.0.9[.0]
- *    1.2.9rc1                13    10209  12.so.0.9[.0]
- *    1.2.9                   13    10209  12.so.0.9[.0]
- *    1.2.10beta1-7           13    10210  12.so.0.10[.0]
- *    1.2.10rc1-2             13    10210  12.so.0.10[.0]
- *    1.2.10                  13    10210  12.so.0.10[.0]
- *    1.4.0beta1-5            14    10400  14.so.0.0[.0]
- *    1.2.11beta1-4           13    10211  12.so.0.11[.0]
- *    1.4.0beta7-8            14    10400  14.so.0.0[.0]
- *    1.2.11                  13    10211  12.so.0.11[.0]
- *    1.2.12                  13    10212  12.so.0.12[.0]
- *    1.4.0beta9-14           14    10400  14.so.0.0[.0]
- *    1.2.13                  13    10213  12.so.0.13[.0]
- *    1.4.0beta15-36          14    10400  14.so.0.0[.0]
- *    1.4.0beta37-87          14    10400  14.so.14.0[.0]
- *    1.4.0rc01               14    10400  14.so.14.0[.0]
- *    1.4.0beta88-109         14    10400  14.so.14.0[.0]
- *    1.4.0rc02-08            14    10400  14.so.14.0[.0]
- *    1.4.0                   14    10400  14.so.14.0[.0]
- *    1.4.1beta01-03          14    10401  14.so.14.1[.0]
- *    1.4.1rc01               14    10401  14.so.14.1[.0]
- *    1.4.1beta04-12          14    10401  14.so.14.1[.0]
- *    1.4.1                   14    10401  14.so.14.1[.0]
- *    1.4.2                   14    10402  14.so.14.2[.0]
- *    1.4.3                   14    10403  14.so.14.3[.0]
- *    1.4.4                   14    10404  14.so.14.4[.0]
- *    1.5.0beta01-58          15    10500  15.so.15.0[.0]
- *    1.5.0rc01-07            15    10500  15.so.15.0[.0]
- *    1.5.0                   15    10500  15.so.15.0[.0]
- *    1.5.1beta01-11          15    10501  15.so.15.1[.0]
- *    1.5.1rc01-02            15    10501  15.so.15.1[.0]
- *    1.5.1                   15    10501  15.so.15.1[.0]
- *    1.5.2beta01-03          15    10502  15.so.15.2[.0]
- *    1.5.2rc01-03            15    10502  15.so.15.2[.0]
- *    1.5.2                   15    10502  15.so.15.2[.0]
- *    1.5.3beta01-10          15    10503  15.so.15.3[.0]
- *    1.5.3rc01-02            15    10503  15.so.15.3[.0]
- *    1.5.3beta11             15    10503  15.so.15.3[.0]
- *    1.5.3 [omitted]
- *    1.5.4beta01-08          15    10504  15.so.15.4[.0]
- *    1.5.4rc01               15    10504  15.so.15.4[.0]
- *    1.5.4                   15    10504  15.so.15.4[.0]
- *    1.5.5beta01-08          15    10505  15.so.15.5[.0]
- *    1.5.5rc01               15    10505  15.so.15.5[.0]
- *    1.5.5                   15    10505  15.so.15.5[.0]
- *    1.5.6beta01-07          15    10506  15.so.15.6[.0]
- *    1.5.6rc01-03            15    10506  15.so.15.6[.0]
- *    1.5.6                   15    10506  15.so.15.6[.0]
- *    1.5.7beta01-05          15    10507  15.so.15.7[.0]
- *    1.5.7rc01-03            15    10507  15.so.15.7[.0]
- *    1.5.7                   15    10507  15.so.15.7[.0]
- *    1.5.8beta01             15    10508  15.so.15.8[.0]
- *    1.5.8rc01               15    10508  15.so.15.8[.0]
- *    1.5.8                   15    10508  15.so.15.8[.0]
- *    1.5.9beta01-02          15    10509  15.so.15.9[.0]
- *    1.5.9rc01               15    10509  15.so.15.9[.0]
- *    1.5.9                   15    10509  15.so.15.9[.0]
- *    1.5.10beta01-05         15    10510  15.so.15.10[.0]
- *    1.5.10                  15    10510  15.so.15.10[.0]
- *    1.5.11beta01            15    10511  15.so.15.11[.0]
- *    1.5.11rc01-05           15    10511  15.so.15.11[.0]
- *    1.5.11                  15    10511  15.so.15.11[.0]
- *    1.5.12                  15    10512  15.so.15.12[.0]
- *    1.5.13beta01-02         15    10513  15.so.15.13[.0]
- *    1.5.13rc01              15    10513  15.so.15.13[.0]
- *    1.5.13                  15    10513  15.so.15.13[.0]
- *    1.5.14beta01-08         15    10514  15.so.15.14[.0]
- *    1.5.14rc01-03           15    10514  15.so.15.14[.0]
- *    1.5.14                  15    10514  15.so.15.14[.0]
- *    1.5.15beta01-09         15    10515  15.so.15.15[.0]
- *    1.5.15rc01              15    10515  15.so.15.15[.0]
- *    1.5.15                  15    10515  15.so.15.15[.0]
- *    1.5.16beta01-06         15    10516  15.so.15.16[.0]
- *    1.5.16rc01              15    10516  15.so.15.16[.0]
- *    1.5.16                  15    10516  15.so.15.16[.0]
- *    1.5.17beta01            15    10517  15.so.15.17[.0]
- *    1.5.17rc01-03           15    10517  15.so.15.17[.0]
- *    1.5.17                  15    10517  15.so.15.17[.0]
- *    1.5.18beta01-05         15    10518  15.so.15.18[.0]
- *    1.5.18rc01-02           15    10518  15.so.15.18[.0]
- *    1.5.18                  15    10518  15.so.15.18[.0]
- *    1.5.19beta01-05         15    10519  15.so.15.19[.0]
- *    1.5.19rc01              15    10519  15.so.15.19[.0]
- *    1.5.19                  15    10519  15.so.15.19[.0]
- *    1.5.20beta01-02         15    10520  15.so.15.20[.0]
- *    1.5.20rc01-03           15    10520  15.so.15.20[.0]
- *    1.5.20                  15    10520  15.so.15.20[.0]
- *    1.5.21beta01-02         15    10521  15.so.15.21[.0]
- *    1.5.21rc01-03           15    10521  15.so.15.21[.0]
- *    1.5.21                  15    10521  15.so.15.21[.0]
- *    1.5.22beta01-04         15    10522  15.so.15.22[.0]
- *    1.5.22rc01-04           15    10522  15.so.15.22[.0]
- *    1.5.22                  15    10522  15.so.15.22[.0]
- *    1.5.23beta01-02         15    10523  15.so.15.23[.0]
- *    1.5.23rc01-03           15    10523  15.so.15.23[.0]
- *    1.5.23                  15    10523  15.so.15.23[.0]
- *
- *   Henceforth the source version will match the shared-library major
- *   and minor numbers; the shared-library major version number will be
- *   used for changes in backward compatibility, as it is intended.  The
- *   PNG_LIBPNG_VER macro, which is not used within libpng but is available
- *   for applications, is an unsigned integer of the form xyyzz corresponding
- *   to the source version x.y.z (leading zeros in y and z).  Beta versions
- *   were given the previous public release number plus a letter, until
- *   version 1.0.6j; from then on they were given the upcoming public
- *   release number plus "betaNN" or "rcNN".
- *
- *   Binary incompatibility exists only when applications make direct access
- *   to the info_ptr or png_ptr members through png.h, and the compiled
- *   application is loaded with a different version of the library.
- *
- *   DLLNUM will change each time there are forward or backward changes
- *   in binary compatibility (e.g., when a new feature is added).
- *
- * See libpng-manual.txt or libpng.3 for more information.  The PNG
- * specification is available as a W3C Recommendation and as an ISO
- * Specification, <http://www.w3.org/TR/2003/REC-PNG-20031110/
 */

 /*
@@ -243,10 +25,11 @@
 *
 * This code is released under the libpng license.
 *
- * libpng versions 1.0.7, July 1, 2000, through 1.5.23, July 23, 2015, are
- * Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, and are
- * distributed according to the same disclaimer and license as libpng-1.0.6
- * with the following individuals added to the list of Contributing Authors:
+ * libpng versions 1.0.7, July 1, 2000, through 1.5.26, December 17, 2015, are
+ * Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
+ * derived from libpng-1.0.6, and are distributed according to the same
+ * disclaimer and license as libpng-1.0.6 with the following individuals
+ * added to the list of Contributing Authors:
 *
 *    Simon-Pierre Cadieux
 *    Eric S. Raymond
@@ -264,18 +47,20 @@
 *    the user.
 *
 * libpng versions 0.97, January 1998, through 1.0.6, March 20, 2000, are
- * Copyright (c) 1998-2000 Glenn Randers-Pehrson, and are distributed according
- * to the same disclaimer and license as libpng-0.96, with the following
- * individuals added to the list of Contributing Authors:
+ * Copyright (c) 1998-2000 Glenn Randers-Pehrson, are derived from
+ * libpng-0.96, and are distributed according to the same disclaimer and
+ * license as libpng-0.96, with the following individuals added to the list
+ * of Contributing Authors:
 *
 *    Tom Lane
 *    Glenn Randers-Pehrson
 *    Willem van Schaik
 *
 * libpng versions 0.89, June 1996, through 0.96, May 1997, are
- * Copyright (c) 1996-1997 Andreas Dilger, and are
- * distributed according to the same disclaimer and license as libpng-0.88,
- * with the following individuals added to the list of Contributing Authors:
+ * Copyright (c) 1996-1997 Andreas Dilger, are derived from libpng-0.88,
+ * and are distributed according to the same disclaimer and license as
+ * libpng-0.88, with the following individuals added to the list of
+ * Contributing Authors:
 *
 *    John Bowler
 *    Kevin Bracey
@@ -321,6 +106,8 @@
 * supporting the PNG file format in commercial products.  If you use this
 * source code in a product, acknowledgment is not required but would be
 * appreciated.
+ *
+ * END OF COPYRIGHT NOTICE, DISCLAIMER, and LICENSE.
 */

 /*
@@ -347,17 +134,90 @@
 * Thanks to Frank J. T. Wojcik for helping with the documentation.
 */

+/* Note about libpng version numbers:
+ *
+ *    Due to various miscommunications, unforeseen code incompatibilities
+ *    and occasional factors outside the authors' control, version numbering
+ *    on the library has not always been consistent and straightforward.
+ *    The following table summarizes matters since version 0.89c, which was
+ *    the first widely used release:
+ *
+ *    source                 png.h  png.h  shared-lib
+ *    version                string   int  version
+ *    -------                ------ -----  ----------
+ *    0.89c "1.0 beta 3"     0.89      89  1.0.89
+ *    0.90  "1.0 beta 4"     0.90      90  0.90  [should have been 2.0.90]
+ *    0.95  "1.0 beta 5"     0.95      95  0.95  [should have been 2.0.95]
+ *    0.96  "1.0 beta 6"     0.96      96  0.96  [should have been 2.0.96]
+ *    0.97b "1.00.97 beta 7" 1.00.97   97  1.0.1 [should have been 2.0.97]
+ *    0.97c                  0.97      97  2.0.97
+ *    0.98                   0.98      98  2.0.98
+ *    0.99                   0.99      98  2.0.99
+ *    0.99a-m                0.99      99  2.0.99
+ *    1.00                   1.00     100  2.1.0 [100 should be 10000]
+ *    1.0.0      (from here on, the   100  2.1.0 [100 should be 10000]
+ *    1.0.1       png.h string is   10001  2.1.0
+ *    1.0.1a-e    identical to the  10002  from here on, the shared library
+ *    1.0.2       source version)   10002  is 2.V where V is the source code
+ *    1.0.2a-b                      10003  version, except as noted.
+ *    1.0.3                         10003
+ *    1.0.3a-d                      10004
+ *    1.0.4                         10004
+ *    1.0.4a-f                      10005
+ *    1.0.5 (+ 2 patches)           10005
+ *    1.0.5a-d                      10006
+ *    1.0.5e-r                      10100 (not source compatible)
+ *    1.0.5s-v                      10006 (not binary compatible)
+ *    1.0.6 (+ 3 patches)           10006 (still binary incompatible)
+ *    1.0.6d-f                      10007 (still binary incompatible)
+ *    1.0.6g                        10007
+ *    1.0.6h                        10007  10.6h (testing xy.z so-numbering)
+ *    1.0.6i                        10007  10.6i
+ *    1.0.6j                        10007  2.1.0.6j (incompatible with 1.0.0)
+ *    1.0.7beta11-14        DLLNUM  10007  2.1.0.7beta11-14 (binary compatible)
+ *    1.0.7beta15-18           1    10007  2.1.0.7beta15-18 (binary compatible)
+ *    1.0.7rc1-2               1    10007  2.1.0.7rc1-2 (binary compatible)
+ *    1.0.7                    1    10007  (still compatible)
+ *    ...
+ *    1.0.19                  10    10019  10.so.0.19[.0]
+ *    ...
+ *    1.2.53                  13    10253  12.so.0.53[.0]
+ *    ...
+ *    1.5.25                  15    10525  15.so.15.25[.0]
+ *
+ *    Henceforth the source version will match the shared-library major
+ *    and minor numbers; the shared-library major version number will be
+ *    used for changes in backward compatibility, as it is intended.  The
+ *    PNG_LIBPNG_VER macro, which is not used within libpng but is available
+ *    for applications, is an unsigned integer of the form xyyzz corresponding
+ *    to the source version x.y.z (leading zeros in y and z).  Beta versions
+ *    were given the previous public release number plus a letter, until
+ *    version 1.0.6j; from then on they were given the upcoming public
+ *    release number plus "betaNN" or "rcNN".
+ *
+ *    Binary incompatibility exists only when applications make direct access
+ *    to the info_ptr or png_ptr members through png.h, and the compiled
+ *    application is loaded with a different version of the library.
+ *
+ *    DLLNUM will change each time there are forward or backward changes
+ *    in binary compatibility (e.g., when a new feature is added).
+ *
+ * See libpng.txt or libpng.3 for more information.  The PNG specification
+ * is available as a W3C Recommendation and as an ISO Specification,
+ * <http://www.w3.org/TR/2003/REC-PNG-20031110/
+ */
+
 /*
 * Y2K compliance in libpng:
 * =========================
 *
- *    July 23, 2015
+ *    December 17, 2015
 *
 *    Since the PNG Development group is an ad-hoc body, we can't make
 *    an official declaration.
 *
 *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.5.23 are Y2K compliant.  It is my belief that
+ *    upward through 1.5.26 are Y2K compliant.  It is my belief that
 *    earlier versions were also Y2K compliant.
 *
 *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -418,9 +278,9 @@
 */

 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.5.23"
+#define PNG_LIBPNG_VER_STRING "1.5.26"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.5.23 - July 23, 2015\n"
+     " libpng version 1.5.26 - December 17, 2015\n"

 #define PNG_LIBPNG_VER_SONUM   15
 #define PNG_LIBPNG_VER_DLLNUM  15
@@ -428,7 +288,7 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   5
-#define PNG_LIBPNG_VER_RELEASE 23
+#define PNG_LIBPNG_VER_RELEASE 26

 /* This should match the numeric part of the final component of
 * PNG_LIBPNG_VER_STRING, omitting any leading zero:
@@ -459,7 +319,7 @@
 * version 1.0.0 was mis-numbered 100 instead of 10000).  From
 * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
 */
-#define PNG_LIBPNG_VER 10523 /* 1.5.23 */
+#define PNG_LIBPNG_VER 10526 /* 1.5.26 */

 /* Library configuration: these options cannot be changed after
 * the library has been built.
@@ -581,7 +441,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
 * do not agree upon the version number.
 */
-typedef char* png_libpng_version_1_5_23;
+typedef char* png_libpng_version_1_5_26;

 /* Three color definitions.  The order of the red, green, and blue, (and the
 * exact size) is not important, although the size of the fields need to
@@ -2651,7 +2511,7 @@ PNG_EXPORT(207, void, png_save_uint_16, (png_bytep buf, unsigned int i));

 #  define png_get_int_32(buf) \
     ((png_int_32)((*(buf) & 0x80) \
-      ? -((png_int_32)((png_get_uint_32(buf) ^ 0xffffffffL) + 1)) \
+      ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \
      : (png_int_32)png_get_uint_32(buf)))
 #endif

--- a/pngconf.h
+++ b/pngconf.h
@@ -1,9 +1,9 @@

 /* pngconf.h - machine configurable file for libpng
 *
- * libpng version 1.5.23, July 23, 2015
+ * libpng version 1.5.26, December 17, 2015
 *
- * Copyright (c) 1998-2013 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2013 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngdebug.h
+++ b/pngdebug.h
@@ -2,7 +2,7 @@
 /* pngdebug.h - Debugging macros for libpng, also used in pngtest.c
 *
 * Last changed in libpng 1.5.18 [February 6, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngerror.c
+++ b/pngerror.c
@@ -2,7 +2,7 @@
 /* pngerror.c - stub functions for i/o and memory allocation
 *
 * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngget.c
+++ b/pngget.c
@@ -2,7 +2,7 @@
 /* pngget.c - retrieval of values from info struct
 *
 * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pnginfo.h
+++ b/pnginfo.h
@@ -2,7 +2,7 @@
 /* pnginfo.h - header file for PNG reference library
 *
 * Last changed in libpng 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2011 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngmem.c
+++ b/pngmem.c
@@ -2,7 +2,7 @@
 /* pngmem.c - stub functions for memory allocation
 *
 * Last changed in libpng 1.5.13 [September 27, 2012]
- * Copyright (c) 1998-2012 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2012 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngpread.c
+++ b/pngpread.c
@@ -2,7 +2,7 @@
 /* pngpread.c - read a png file in push mode
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -127,7 +127,7 @@ png_process_some_data(png_structp png_ptr, png_infop info_ptr)
 void /* PRIVATE */
 png_push_read_sig(png_structp png_ptr, png_infop info_ptr)
 {
-   png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ 
+   png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */
       num_to_check = 8 - num_checked;

   if (png_ptr->buffer_size < num_to_check)
--- a/pngpriv.h
+++ b/pngpriv.h
@@ -1,8 +1,8 @@

 /* pngpriv.h - private declarations for use inside libpng
 *
- * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.26 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -517,10 +517,6 @@
 #define PNG_STRUCT_PNG   0x0001
 #define PNG_STRUCT_INFO  0x0002

-/* Scaling factor for filter heuristic weighting calculations */
-#define PNG_WEIGHT_FACTOR (1<<(PNG_WEIGHT_SHIFT))
-#define PNG_COST_FACTOR (1<<(PNG_COST_SHIFT))
-
 /* Flags for the png_ptr->flags rather than declaring a byte for each one */
 #define PNG_FLAG_ZLIB_CUSTOM_STRATEGY     0x0001
 #define PNG_FLAG_ZLIB_CUSTOM_LEVEL        0x0002
@@ -905,13 +901,6 @@ PNG_EXTERN void png_write_hIST PNGARG((png_structp png_ptr,
    png_const_uint_16p hist, int num_hist));
 #endif

-/* Chunks that have keywords */
-#if defined(PNG_WRITE_TEXT_SUPPORTED) || defined(PNG_WRITE_pCAL_SUPPORTED) || \
-    defined(PNG_WRITE_iCCP_SUPPORTED) || defined(PNG_WRITE_sPLT_SUPPORTED)
-PNG_EXTERN png_size_t png_check_keyword PNGARG((png_structp png_ptr,
-    png_const_charp key, png_charpp new_key));
-#endif
-
 #ifdef PNG_WRITE_tEXt_SUPPORTED
 PNG_EXTERN void png_write_tEXt PNGARG((png_structp png_ptr, png_const_charp key,
    png_const_charp text, png_size_t text_len));
--- a/pngread.c
+++ b/pngread.c
@@ -2,7 +2,7 @@
 /* pngread.c - read a PNG file
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngrio.c
+++ b/pngrio.c
@@ -2,7 +2,7 @@
 /* pngrio.c - functions for data input
 *
 * Last changed in libpng 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2011 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -1,8 +1,8 @@

 /* pngrtran.c - transforms the data in a row for PNG readers
 *
- * Last changed in libpng 1.5.22 [March 26, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.24 [November 12, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -2056,10 +2056,10 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr)
 defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
   if (png_ptr->transformations & PNG_USER_TRANSFORM)
   {
-      if (info_ptr->bit_depth < png_ptr->user_transform_depth)
+      if (png_ptr->user_transform_depth)
         info_ptr->bit_depth = png_ptr->user_transform_depth;

-      if (info_ptr->channels < png_ptr->user_transform_channels)
+      if (png_ptr->user_transform_channels)
         info_ptr->channels = png_ptr->user_transform_channels;
   }
 #endif
@@ -2969,13 +2969,13 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
            png_bytep dp = sp  + (png_size_t)row_width * 2;
            for (i = 1; i < row_width; i++)
            {
-               *(--dp) = hi_filler;
               *(--dp) = lo_filler;
+               *(--dp) = hi_filler;
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
            }
-            *(--dp) = hi_filler;
            *(--dp) = lo_filler;
+            *(--dp) = hi_filler;
            row_info->channels = 2;
            row_info->pixel_depth = 32;
            row_info->rowbytes = row_width * 4;
@@ -2990,8 +2990,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
            {
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
-               *(--dp) = hi_filler;
               *(--dp) = lo_filler;
+               *(--dp) = hi_filler;
            }
            row_info->channels = 2;
            row_info->pixel_depth = 32;
@@ -3050,8 +3050,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
            png_bytep dp = sp  + (png_size_t)row_width * 2;
            for (i = 1; i < row_width; i++)
            {
-               *(--dp) = hi_filler;
               *(--dp) = lo_filler;
+               *(--dp) = hi_filler;
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
@@ -3059,8 +3059,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
            }
-            *(--dp) = hi_filler;
            *(--dp) = lo_filler;
+            *(--dp) = hi_filler;
            row_info->channels = 4;
            row_info->pixel_depth = 64;
            row_info->rowbytes = row_width * 8;
@@ -3079,8 +3079,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
-               *(--dp) = hi_filler;
               *(--dp) = lo_filler;
+               *(--dp) = hi_filler;
            }

            row_info->channels = 4;
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,8 +1,8 @@

 /* pngrutil.c - utilities to read a PNG file
 *
- * Last changed in libpng 1.5.22 [March 26, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.25 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -89,7 +89,13 @@ png_get_int_32)(png_const_bytep buf)
      return uval;

   uval = (uval ^ 0xffffffff) + 1;  /* 2's complement: -x = ~x+1 */
-   return -(png_int_32)uval;
+   if ((uval & 0x80000000) == 0) /* no overflow */
+       return -(png_int_32)uval;
+   /* The following has to be safe; this function only gets called on PNG data
+    * and if we get here that data is invalid.  0 is the most safe value and
+    * if not then an attacker would surely just generate a PNG with 0 instead.
+    */
+   return 0;
 }

 /* Grab an unsigned 16-bit integer from a buffer in big-endian format. */
@@ -605,7 +611,7 @@ void /* PRIVATE */
 png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
   png_color palette[PNG_MAX_PALETTE_LENGTH];
-   int num, i;
+   int max_palette_length, num, i;
 #ifdef PNG_POINTER_INDEXING_SUPPORTED
   png_colorp pal_ptr;
 #endif
@@ -658,8 +664,22 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
      }
   }

+   /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */
   num = (int)length / 3;

+   /* If the palette has 256 or fewer entries but is too large for the bit
+    * depth, we don't issue an error, to preserve the behavior of previous
+    * libpng versions. We silently truncate the unused extra palette entries
+    * here.
+    */
+   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
+      max_palette_length = (1 << png_ptr->bit_depth);
+   else
+      max_palette_length = PNG_MAX_PALETTE_LENGTH;
+
+   if (num > max_palette_length)
+      num = max_palette_length;
+
 #ifdef PNG_POINTER_INDEXING_SUPPORTED
   for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
   {
@@ -692,7 +712,7 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
 #endif
   {
-      png_crc_finish(png_ptr, 0);
+      png_crc_finish(png_ptr, (int) length - num * 3);
   }

 #ifndef PNG_READ_OPT_PLTE_SUPPORTED
@@ -1307,7 +1327,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   /* There should be at least one zero (the compression type byte)
    * following the separator, and we should be on it
    */
-   if (profile >= png_ptr->chunkdata + slength - 1)
+   if (slength < 1U || profile >= png_ptr->chunkdata + slength - 1U)
   {
      png_free(png_ptr, png_ptr->chunkdata);
      png_ptr->chunkdata = NULL;
@@ -1456,7 +1476,8 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   ++entry_start;

   /* A sample depth should follow the separator, and we should be on it  */
-   if (entry_start > (png_bytep)png_ptr->chunkdata + slength - 2)
+   if (slength < 2U ||
+       entry_start > (png_bytep)png_ptr->chunkdata + slength - 2U)
   {
      png_free(png_ptr, png_ptr->chunkdata);
      png_ptr->chunkdata = NULL;
@@ -1985,7 +2006,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   /* We need to have at least 12 bytes after the purpose string
    * in order to get the parameter information.
    */
-   if (endptr <= buf + 12)
+   if (endptr - buf <= 12)
   {
      png_warning(png_ptr, "Invalid pCAL data");
      png_free(png_ptr, png_ptr->chunkdata);
@@ -2397,7 +2418,7 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
      /* Empty loop */ ;

   /* zTXt must have some text after the chunkdataword */
-   if (text >= png_ptr->chunkdata + slength - 2)
+   if (slength < 2U || text >= png_ptr->chunkdata + slength - 2U)
   {
      png_warning(png_ptr, "Truncated zTXt chunk");
      png_free(png_ptr, png_ptr->chunkdata);
@@ -2534,7 +2555,7 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    * keyword
    */

-   if (lang >= png_ptr->chunkdata + slength - 3)
+   if (slength < 3U || lang >= png_ptr->chunkdata + slength - 3U)
   {
      png_warning(png_ptr, "Truncated iTXt chunk");
      png_free(png_ptr, png_ptr->chunkdata);
--- a/pngset.c
+++ b/pngset.c
@@ -1,8 +1,8 @@

 /* pngset.c - storage of image information into info struct
 *
- * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.26 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -20,6 +20,60 @@

 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

+#if defined(PNG_TEXT_SUPPORTED) || defined(PNG_pCAL_SUPPORTED) ||\
+    defined(PNG_iCCP_SUPPORTED) || defined(PNG_sPLT_SUPPORTED)
+/* Check that the tEXt or zTXt keyword is valid per PNG 1.0 specification,
+ * and if invalid, correct the keyword rather than discarding the entire
+ * chunk.  The PNG 1.0 specification requires keywords 1-79 characters in
+ * length, forbids leading or trailing whitespace, multiple internal spaces,
+ * and the non-break space (0x80) from ISO 8859-1.  Returns keyword length.
+ *
+ * The 'new_key' buffer must be 80 characters in size (for the keyword plus a
+ * trailing '\0').  If this routine returns 0 then there was no keyword, or a
+ * valid one could not be generated, and the caller must handle the error by not
+ * setting the keyword.
+ */
+static png_uint_32
+png_check_keyword(png_const_charp key, png_bytep new_key)
+{
+   png_uint_32 key_len = 0;
+   int space = 1;
+
+   if (key == NULL)
+   {
+      *new_key = 0;
+      return 0;
+   }
+
+   while (*key && key_len < 79)
+   {
+      png_byte ch = (png_byte)*key++;
+
+      if ((ch > 32 && ch <= 126) || (ch >= 161 /*&& ch <= 255*/))
+         *new_key++ = ch, ++key_len, space = 0;
+
+      else if (space == 0)
+      {
+         /* A space or an invalid character when one wasn't seen immediately
+          * before; output just a space.
+          */
+         *new_key++ = 32, ++key_len, space = 1;
+      }
+   }
+
+   if (key_len > 0 && space != 0) /* trailing space */
+      --key_len, --new_key;
+
+   /* Terminate the keyword */
+   *new_key = 0;
+
+   if (key_len == 0)
+      return 0;
+
+   return key_len;
+}
+#endif /* TEXT || pCAL || iCCP || sPLT */
+
 #ifdef PNG_bKGD_SUPPORTED
 void PNGAPI
 png_set_bKGD(png_structp png_ptr, png_infop info_ptr,
@@ -123,12 +177,12 @@ png_set_cHRM_XYZ(png_structp png_ptr, png_infop info_ptr, double red_X,
      png_fixed(png_ptr, red_X, "cHRM Red X"),
      png_fixed(png_ptr, red_Y, "cHRM Red Y"),
      png_fixed(png_ptr, red_Z, "cHRM Red Z"),
-      png_fixed(png_ptr, green_X, "cHRM Red X"),
-      png_fixed(png_ptr, green_Y, "cHRM Red Y"),
-      png_fixed(png_ptr, green_Z, "cHRM Red Z"),
-      png_fixed(png_ptr, blue_X, "cHRM Red X"),
-      png_fixed(png_ptr, blue_Y, "cHRM Red Y"),
-      png_fixed(png_ptr, blue_Z, "cHRM Red Z"));
+      png_fixed(png_ptr, green_X, "cHRM Green X"),
+      png_fixed(png_ptr, green_Y, "cHRM Green Y"),
+      png_fixed(png_ptr, green_Z, "cHRM Green Z"),
+      png_fixed(png_ptr, blue_X, "cHRM Blue X"),
+      png_fixed(png_ptr, blue_Y, "cHRM Blue Y"),
+      png_fixed(png_ptr, blue_Z, "cHRM Blue Z"));
 }
 #  endif /* PNG_FLOATING_POINT_SUPPORTED */

@@ -278,6 +332,7 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
    png_const_charp purpose, png_int_32 X0, png_int_32 X1, int type,
    int nparams, png_const_charp units, png_charpp params)
 {
+   png_byte new_purpose[80];
   png_size_t length;
   int i;

@@ -286,7 +341,15 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
   if (png_ptr == NULL || info_ptr == NULL)
      return;

-   length = png_strlen(purpose) + 1;
+   length = png_check_keyword(purpose, new_purpose);
+
+   if (length == 0)
+   {
+      png_warning(png_ptr, "pCAL: invalid purpose keyword");
+      return;
+   }
+      
+   ++length;
   png_debug1(3, "allocating purpose for info (%lu bytes)",
       (unsigned long)length);

@@ -309,7 +372,7 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
      return;
   }

-   png_memcpy(info_ptr->pcal_purpose, purpose, length);
+   png_memcpy(info_ptr->pcal_purpose, new_purpose, length);

   png_debug(3, "storing X0, X1, type, and nparams in info");
   info_ptr->pcal_X0 = X0;
@@ -508,12 +571,17 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
    png_const_colorp palette, int num_palette)
 {

+   png_uint_32 max_palette_length;
+
   png_debug1(1, "in %s storage function", "PLTE");

   if (png_ptr == NULL || info_ptr == NULL)
      return;

-   if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH)
+   max_palette_length = (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
+      (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
+
+   if (num_palette < 0 || num_palette > (int) max_palette_length)
   {
      if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
         png_error(png_ptr, "Invalid palette length");
@@ -532,8 +600,8 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
   png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);

   /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
-    * of num_palette entries, in case of an invalid PNG file that has
-    * too-large sample values.
+    * of num_palette entries, in case of an invalid PNG file or incorrect
+    * call to png_set_PLTE() with too-large sample values.
    */
   png_ptr->palette = (png_colorp)png_calloc(png_ptr,
       PNG_MAX_PALETTE_LENGTH * png_sizeof(png_color));
@@ -609,6 +677,7 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
    png_const_charp name, int compression_type,
    png_const_bytep profile, png_uint_32 proflen)
 {
+   png_byte new_name[80];
   png_charp new_iccp_name;
   png_bytep new_iccp_profile;
   png_size_t length;
@@ -618,7 +687,15 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
   if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL)
      return;

-   length = png_strlen(name)+1;
+   length = png_check_keyword(name, new_name);
+
+   if (length == 0)
+   {
+      png_warning(png_ptr, "iCCP: invalid keyword");
+      return;
+   }
+      
+   ++length;
   new_iccp_name = (png_charp)png_malloc_warn(png_ptr, length);

   if (new_iccp_name == NULL)
@@ -627,7 +704,7 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
      return;
   }

-   png_memcpy(new_iccp_name, name, length);
+   png_memcpy(new_iccp_name, new_name, length);
   new_iccp_profile = (png_bytep)png_malloc_warn(png_ptr, proflen);

   if (new_iccp_profile == NULL)
@@ -743,6 +820,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
   }
   for (i = 0; i < num_text; i++)
   {
+      png_byte new_key[80], new_lang[80];
      png_size_t text_length, key_len;
      png_size_t lang_len, lang_key_len;
      png_textp textp = &(info_ptr->text[info_ptr->num_text]);
@@ -757,7 +835,13 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
         continue;
      }

-      key_len = png_strlen(text_ptr[i].key);
+      key_len = png_check_keyword(text_ptr[i].key, new_key);
+
+      if (key_len == 0)
+      {
+         png_warning(png_ptr, "invalid text keyword");
+         continue;
+      }

      if (text_ptr[i].compression <= 0)
      {
@@ -770,8 +854,9 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
      {
         /* Set iTXt data */

+        /* Zero length language is OK */
         if (text_ptr[i].lang != NULL)
-            lang_len = png_strlen(text_ptr[i].lang);
+            lang_len = png_check_keyword(text_ptr[i].lang, new_lang);

         else
            lang_len = 0;
@@ -819,7 +904,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
          (key_len + lang_len + lang_key_len + text_length + 4),
          textp->key);

-      png_memcpy(textp->key, text_ptr[i].key,(png_size_t)(key_len));
+      png_memcpy(textp->key, new_key, (png_size_t)(key_len));
      *(textp->key + key_len) = '\0';

      if (text_ptr[i].compression > 0)
@@ -971,7 +1056,7 @@ png_set_sPLT(png_structp png_ptr,
 */
 {
   png_sPLT_tp np;
-   int i;
+   int i, j;
   size_t element_size;

   if (png_ptr == NULL || info_ptr == NULL)
@@ -1003,13 +1088,22 @@ png_set_sPLT(png_structp png_ptr,
   png_free(png_ptr, info_ptr->splt_palettes);
   info_ptr->splt_palettes=NULL;

-   for (i = 0; i < nentries; i++)
+   for (i = j = 0; i < nentries; i++)
   {
-      png_sPLT_tp to = np + info_ptr->splt_palettes_num + i;
+      png_sPLT_tp to = np + info_ptr->splt_palettes_num + j;
      png_const_sPLT_tp from = entries + i;
+      png_byte new_name[80];
      png_size_t length;

-      length = png_strlen(from->name) + 1;
+      length = png_check_keyword(from->name, new_name);
+
+      if (length == 0)
+      {
+         png_warning(png_ptr, "sPLT: invalid keyword");
+         continue;
+      }
+
+      ++length; /* for trailing '\0' */
      to->name = (png_charp)png_malloc_warn(png_ptr, length);

      if (to->name == NULL)
@@ -1019,7 +1113,7 @@ png_set_sPLT(png_structp png_ptr,
         continue;
      }

-      png_memcpy(to->name, from->name, length);
+      png_memcpy(to->name, new_name, length);
      to->entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
          from->nentries * png_sizeof(png_sPLT_entry));

@@ -1037,10 +1131,11 @@ png_set_sPLT(png_structp png_ptr,

      to->nentries = from->nentries;
      to->depth = from->depth;
+      ++j;
   }

   info_ptr->splt_palettes = np;
-   info_ptr->splt_palettes_num += nentries;
+   info_ptr->splt_palettes_num = j;
   info_ptr->valid |= PNG_INFO_sPLT;
   info_ptr->free_me |= PNG_FREE_SPLT;
 }
@@ -1284,7 +1379,7 @@ png_set_user_limits (png_structp png_ptr, png_uint_32 user_width_max,
 {
   /* Images with dimensions larger than these limits will be
    * rejected by png_set_IHDR().  To accept any PNG datastream
-    * regardless of dimensions, set both limits to 0x7ffffffL.
+    * regardless of dimensions, set both limits to 0x7fffffffL.
    */
   if (png_ptr == NULL)
      return;
@@ -1343,5 +1438,4 @@ png_set_check_for_invalid_index(png_structp png_ptr, int allowed)
      png_ptr->num_palette_max = -1;
 }
 #endif
-
 #endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */
--- a/pngstruct.h
+++ b/pngstruct.h
@@ -2,7 +2,7 @@
 /* pngstruct.h - header file for PNG reference library
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngtest.c
+++ b/pngtest.c
@@ -1,7 +1,8 @@
+
 /* pngtest.c - a simple test program to test libpng
 *
- * Last changed in libpng 1.5.22 [March 26, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.25 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -60,10 +61,11 @@
   defined PNG_READ_sBIT_SUPPORTED &&\
   defined PNG_READ_sCAL_SUPPORTED &&\
   defined PNG_READ_sRGB_SUPPORTED &&\
+   defined PNG_READ_sPLT_SUPPORTED &&\
   defined PNG_READ_tEXt_SUPPORTED &&\
   defined PNG_READ_tIME_SUPPORTED &&\
   defined PNG_READ_zTXt_SUPPORTED &&\
-   defined PNG_WRITE_INTERLACING_SUPPORTED
+   (defined PNG_WRITE_INTERLACING_SUPPORTED || PNG_LIBPNG_VER >= 10700)

 #ifdef PNG_ZLIB_HEADER
 #  include PNG_ZLIB_HEADER /* defined by pnglibconf.h from 1.7 */
@@ -100,6 +102,10 @@ typedef FILE                * png_FILE_p;
 #  define SINGLE_ROWBUF_ALLOC  /* Makes buffer overruns easier to nail */
 #endif

+#ifndef PNG_UNUSED
+#  define PNG_UNUSED(param) (void)param;
+#endif
+
 /* Turn on CPU timing
 #define PNGTEST_TIMING
 */
@@ -117,6 +123,22 @@ static float t_start, t_stop, t_decode, t_encode, t_misc;
 #define PNG_tIME_STRING_LENGTH 29
 static int tIME_chunk_present = 0;
 static char tIME_string[PNG_tIME_STRING_LENGTH] = "tIME chunk is not present";
+
+#if PNG_LIBPNG_VER < 10619
+#define png_convert_to_rfc1123_buffer(ts, t) tIME_to_str(read_ptr, ts, t)
+
+static int
+tIME_to_str(png_structp png_ptr, png_charp ts, png_const_timep t)
+{
+    png_const_charp str = png_convert_to_rfc1123(png_ptr, t);
+
+    if (str == NULL)
+        return 0;
+
+    strcpy(ts, str);
+    return 1;
+}
+#endif /* older libpng */
 #endif

 static int verbose = 0;
@@ -184,16 +206,14 @@ write_row_callback(png_structp png_ptr, png_uint_32 row_number, int pass)


 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-/* Example of using user transform callback (we don't transform anything,
- * but merely examine the row filters.  We set this to 256 rather than
- * 5 in case illegal filter values are present.)
+/* Example of using a user transform callback (doesn't do anything at present).
 */
-static png_uint_32 filters_used[256];
 static void PNGCBAPI
-count_filters(png_structp png_ptr, png_row_infop row_info, png_bytep data)
+read_user_callback(png_structp png_ptr, png_row_infop row_info, png_bytep data)
 {
-   if (png_ptr != NULL && row_info != NULL)
-      ++filters_used[*(data - 1)];
+   PNG_UNUSED(png_ptr)
+   PNG_UNUSED(row_info)
+   PNG_UNUSED(data)
 }
 #endif

@@ -804,6 +824,8 @@ pngtest_check_text_support(png_structp png_ptr, png_textp text_ptr,
         case PNG_TEXT_COMPRESSION_zTXt:
 #           ifndef PNG_WRITE_zTXt_SUPPORTED
               ++unsupported_chunks;
+               /* In libpng 1.7 this now does an app-error, so stop it: */
+               text_ptr[num_text].compression = PNG_TEXT_COMPRESSION_NONE;
 #           endif
            break;

@@ -811,6 +833,7 @@ pngtest_check_text_support(png_structp png_ptr, png_textp text_ptr,
         case PNG_ITXT_COMPRESSION_zTXt:
 #           ifndef PNG_WRITE_iTXt_SUPPORTED
               ++unsupported_chunks;
+               text_ptr[num_text].compression = PNG_TEXT_COMPRESSION_NONE;
 #           endif
            break;

@@ -837,16 +860,19 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   png_structp write_ptr;
   png_infop write_info_ptr;
   png_infop write_end_info_ptr;
+#ifdef PNG_WRITE_FILTER_SUPPORTED
   int interlace_preserved = 1;
-#else
+#endif /* WRITE_FILTER */
+#else /* !WRITE */
   png_structp write_ptr = NULL;
   png_infop write_info_ptr = NULL;
   png_infop write_end_info_ptr = NULL;
-#endif
+#endif /* !WRITE */
   png_bytep row_buf;
   png_uint_32 y;
   png_uint_32 width, height;
-   int num_pass = 1, pass;
+   volatile int num_passes;
+   int pass;
   int bit_depth, color_type;

   row_buf = NULL;
@@ -999,14 +1025,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   }

 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-   {
-      int i;
-
-      for (i = 0; i<256; i++)
-         filters_used[i] = 0;
-
-      png_set_read_user_transform_fn(read_ptr, count_filters);
-   }
+   png_set_read_user_transform_fn(read_ptr, read_user_callback);
 #endif
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
   zero_samples = 0;
@@ -1053,27 +1072,27 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      {
         png_set_IHDR(write_ptr, write_info_ptr, width, height, bit_depth,
            color_type, interlace_type, compression_type, filter_type);
-#ifndef PNG_READ_INTERLACING_SUPPORTED
-         /* num_pass will not be set below, set it here if the image is
-          * interlaced: what happens is that write interlacing is *not* turned
-          * on an the partial interlaced rows are written directly.
+         /* num_passes may not be available below if interlace support is not
+          * provided by libpng for both read and write.
          */
         switch (interlace_type)
         {
            case PNG_INTERLACE_NONE:
-               num_pass = 1;
+               num_passes = 1;
               break;

            case PNG_INTERLACE_ADAM7:
-               num_pass = 7;
-                break;
+               num_passes = 7;
+               break;

            default:
-                png_error(read_ptr, "invalid interlace type");
-                /*NOT REACHED*/
+               png_error(read_ptr, "invalid interlace type");
+               /*NOT REACHED*/
         }
-#endif
      }
+
+      else
+         png_error(read_ptr, "png_get_IHDR failed");
   }
 #ifdef PNG_FIXED_POINT_SUPPORTED
 #ifdef PNG_cHRM_SUPPORTED
@@ -1244,6 +1263,19 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif
 #endif
 #endif
+
+#ifdef PNG_sPLT_SUPPORTED
+   {
+       png_sPLT_tp entries;
+
+       int num_entries = (int) png_get_sPLT(read_ptr, read_info_ptr, &entries);
+       if (num_entries)
+       {
+           png_set_sPLT(write_ptr, write_info_ptr, entries, num_entries);
+       }
+   }
+#endif
+
 #ifdef PNG_TEXT_SUPPORTED
   {
      png_textp text_ptr;
@@ -1279,15 +1311,15 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      {
         png_set_tIME(write_ptr, write_info_ptr, mod_time);
 #ifdef PNG_TIME_RFC1123_SUPPORTED
-         /* We have to use memcpy instead of "=" because the string
-          * pointed to by png_convert_to_rfc1123() gets free'ed before
-          * we use it.
-          */
-         memcpy(tIME_string,
-                png_convert_to_rfc1123(read_ptr, mod_time),
-                png_sizeof(tIME_string));
+         if (png_convert_to_rfc1123_buffer(tIME_string, mod_time) != 0)
+            tIME_string[(sizeof tIME_string) - 1] = '\0';
+
+         else
+         {
+            strncpy(tIME_string, "*** invalid time ***", (sizeof tIME_string));
+            tIME_string[(sizeof tIME_string) - 1] = '\0';
+         }

-         tIME_string[png_sizeof(tIME_string) - 1] = '\0';
         tIME_chunk_present++;
 #endif /* TIME_RFC1123 */
      }
@@ -1365,21 +1397,49 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif /* SINGLE_ROWBUF_ALLOC */
   pngtest_debug("Writing row data");

-#ifdef PNG_READ_INTERLACING_SUPPORTED
-   num_pass = png_set_interlace_handling(read_ptr);
-   if (png_set_interlace_handling(write_ptr) != num_pass)
-      png_error(write_ptr, "png_set_interlace_handling: inconsistent num_pass");
-#endif
+#if defined(PNG_READ_INTERLACING_SUPPORTED) &&\
+   defined(PNG_WRITE_INTERLACING_SUPPORTED)
+   /* Both must be defined for libpng to be able to handle the interlace,
+    * otherwise it gets handled below by simply reading and writing the passes
+    * directly.
+    */
+   if (png_set_interlace_handling(read_ptr) != num_passes)
+      png_error(write_ptr,
+            "png_set_interlace_handling(read): wrong pass count ");
+   if (png_set_interlace_handling(write_ptr) != num_passes)
+      png_error(write_ptr,
+            "png_set_interlace_handling(write): wrong pass count ");
+#else /* png_set_interlace_handling not called on either read or write */
+#  define calc_pass_height
+#endif /* not using libpng interlace handling */

 #ifdef PNGTEST_TIMING
   t_stop = (float)clock();
   t_misc += (t_stop - t_start);
   t_start = t_stop;
 #endif
-   for (pass = 0; pass < num_pass; pass++)
+   for (pass = 0; pass < num_passes; pass++)
   {
+#     ifdef calc_pass_height
+         png_uint_32 pass_height;
+
+         if (num_passes == 7) /* interlaced */
+         {
+            if (PNG_PASS_COLS(width, pass) > 0)
+               pass_height = PNG_PASS_ROWS(height, pass);
+
+            else
+               pass_height = 0;
+         }
+
+         else /* not interlaced */
+            pass_height = height;
+#     else
+#        define pass_height height
+#     endif
+
      pngtest_debug1("Writing row data for pass %d", pass);
-      for (y = 0; y < height; y++)
+      for (y = 0; y < pass_height; y++)
      {
 #ifndef SINGLE_ROWBUF_ALLOC
         pngtest_debug2("Allocating row buffer (pass %d, y = %u)...", pass, y);
@@ -1462,15 +1522,15 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      {
         png_set_tIME(write_ptr, write_end_info_ptr, mod_time);
 #ifdef PNG_TIME_RFC1123_SUPPORTED
-         /* We have to use memcpy instead of "=" because the string
-          * pointed to by png_convert_to_rfc1123() gets free'ed before
-          * we use it.
-          */
-         memcpy(tIME_string,
-                png_convert_to_rfc1123(read_ptr, mod_time),
-                png_sizeof(tIME_string));
+         if (png_convert_to_rfc1123_buffer(tIME_string, mod_time) != 0)
+            tIME_string[(sizeof tIME_string) - 1] = '\0';
+
+         else
+         {
+            strncpy(tIME_string, "*** invalid time ***", sizeof tIME_string);
+            tIME_string[(sizeof tIME_string)-1] = '\0';
+         }

-         tIME_string[png_sizeof(tIME_string) - 1] = '\0';
         tIME_chunk_present++;
 #endif /* TIME_RFC1123 */
      }
@@ -1569,7 +1629,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   }

 #  ifdef PNG_WRITE_SUPPORTED
-      /* If there we no write support nothing was written! */
+      /* If there is no write support nothing was written! */
      else if (unsupported_chunks > 0)
      {
         fprintf(STDERR, "\n  %s: unsupported chunks (%d)%s",
@@ -1600,7 +1660,8 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      return (1);
   }

-#ifdef PNG_WRITE_SUPPORTED /* else nothing was written */
+#if defined (PNG_WRITE_SUPPORTED) /* else nothing was written */ &&\
+    defined (PNG_WRITE_FILTER_SUPPORTED)
   if (interlace_preserved != 0) /* else the files will be changed */
   {
      for (;;)
@@ -1677,7 +1738,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         }
      }
   }
-#endif /* WRITE */
+#endif /* WRITE && WRITE_FILTER */

   FCLOSE(fpin);
   FCLOSE(fpout);
@@ -1816,24 +1877,17 @@ main(int argc, char *argv[])
         kerror = test_one_file(argv[i], outname);
         if (kerror == 0)
         {
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-            int k;
-#endif
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
            fprintf(STDERR, "\n PASS (%lu zero samples)\n",
               (unsigned long)zero_samples);
 #else
            fprintf(STDERR, " PASS\n");
 #endif
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-            for (k = 0; k<256; k++)
-               if (filters_used[k] != 0)
-                  fprintf(STDERR, " Filter %d was used %lu times\n",
-                     k, (unsigned long)filters_used[k]);
-#endif
 #ifdef PNG_TIME_RFC1123_SUPPORTED
-             if (tIME_chunk_present != 0)
-                fprintf(STDERR, " tIME = %s\n", tIME_string);
+            if (tIME_chunk_present != 0)
+               fprintf(STDERR, " tIME = %s\n", tIME_string);
+
+            tIME_chunk_present = 0;
 #endif /* TIME_RFC1123 */
         }

@@ -1905,21 +1959,12 @@ main(int argc, char *argv[])
         {
            if (verbose == 1 || i == 2)
            {
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-                int k;
-#endif
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
                fprintf(STDERR, "\n PASS (%lu zero samples)\n",
                   (unsigned long)zero_samples);
 #else
                fprintf(STDERR, " PASS\n");
 #endif
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-                for (k = 0; k<256; k++)
-                   if (filters_used[k] != 0)
-                      fprintf(STDERR, " Filter %d was used %lu times\n",
-                         k, (unsigned long)filters_used[k]);
-#endif
 #ifdef PNG_TIME_RFC1123_SUPPORTED
             if (tIME_chunk_present != 0)
                fprintf(STDERR, " tIME = %s\n", tIME_string);
@@ -2025,4 +2070,4 @@ main(void)
 #endif

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_23 Your_png_h_is_not_version_1_5_23;
+typedef png_libpng_version_1_5_26 Your_png_h_is_not_version_1_5_26;
--- a/pngtrans.c
+++ b/pngtrans.c
@@ -2,7 +2,7 @@
 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
 *
 * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngwio.c
+++ b/pngwio.c
@@ -2,7 +2,7 @@
 /* pngwio.c - functions for data output
 *
 * Last changed in libpng 1.5.18 [February 6, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngwrite.c
+++ b/pngwrite.c
@@ -2,7 +2,7 @@
 /* pngwrite.c - general routines to write a PNG file
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngwtran.c
+++ b/pngwtran.c
@@ -1,7 +1,7 @@

 /* pngwtran.c - transforms the data in a row for PNG writers
 *
- * Last changed in libpng 1.5.13 [September 27, 2012]
+ * Copyright (c) 1998-2002,2004,2006-2012 Glenn Randers-Pehrson
 * Copyright (c) 1998-2012 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
--- a/pngwutil.c
+++ b/pngwutil.c
@@ -1,8 +1,8 @@

 /* pngwutil.c - utilities to write a PNG file
 *
- * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.26 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -30,19 +30,20 @@ png_save_uint_32(png_bytep buf, png_uint_32 i)
 }

 #ifdef PNG_SAVE_INT_32_SUPPORTED
-/* The png_save_int_32 function assumes integers are stored in two's
- * complement format.  If this isn't the case, then this routine needs to
- * be modified to write data in two's complement format.  Note that,
- * the following works correctly even if png_int_32 has more than 32 bits
- * (compare the more complex code required on read for sign extention.)
+/* PNG signed integers are saved in 32-bit 2's complement format.  ANSI C-90
+ * defines a cast of a signed integer to an unsigned integer either to preserve
+ * the value, if it is positive, or to calculate:
+ *
+ *     (UNSIGNED_MAX+1) + integer
+ *
+ * Where UNSIGNED_MAX is the appropriate maximum unsigned value, so when the
+ * negative integral value is added the result will be an unsigned value
+ * correspnding to the 2's complement representation.
 */
 void PNGAPI
 png_save_int_32(png_bytep buf, png_int_32 i)
 {
-   buf[0] = (png_byte)((i >> 24) & 0xff);
-   buf[1] = (png_byte)((i >> 16) & 0xff);
-   buf[2] = (png_byte)((i >> 8) & 0xff);
-   buf[3] = (png_byte)(i & 0xff);
+   png_save_uint_32(buf, i);
 }
 #endif

@@ -895,17 +896,20 @@ void /* PRIVATE */
 png_write_PLTE(png_structp png_ptr, png_const_colorp palette,
    png_uint_32 num_pal)
 {
-   png_uint_32 i;
+   png_uint_32 max_palette_length, i;
   png_const_colorp pal_ptr;
   png_byte buf[3];

   png_debug(1, "in png_write_PLTE");

+   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
+      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
+
   if ((
 #ifdef PNG_MNG_FEATURES_SUPPORTED
       !(png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) &&
 #endif
-       num_pal == 0) || num_pal > 256)
+       num_pal == 0) || num_pal > max_palette_length)
   {
      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
      {
@@ -1095,7 +1099,6 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
    png_const_charp profile, int profile_len)
 {
   png_size_t name_len;
-   png_charp new_name;
   compression_state comp;
   int embedded_profile_len = 0;

@@ -1107,8 +1110,7 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   comp.input = NULL;
   comp.input_len = 0;

-   if ((name_len = png_check_keyword(png_ptr, name, &new_name)) == 0)
-      return;
+   name_len = png_strlen(name);

   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
      png_warning(png_ptr, "Unknown compression type in iCCP chunk");
@@ -1127,8 +1129,6 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   {
      png_warning(png_ptr,
          "Embedded profile length in iCCP chunk is negative");
-
-      png_free(png_ptr, new_name);
      return;
   }

@@ -1136,8 +1136,6 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   {
      png_warning(png_ptr,
          "Embedded profile length too large in iCCP chunk");
-
-      png_free(png_ptr, new_name);
      return;
   }

@@ -1157,10 +1155,14 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   png_write_chunk_header(png_ptr, png_iCCP,
       (png_uint_32)(name_len + profile_len + 2));

-   new_name[name_len + 1] = 0x00;
+   png_write_chunk_data(png_ptr, (png_bytep)name, name_len);

-   png_write_chunk_data(png_ptr, (png_bytep)new_name,
-       (png_size_t)(name_len + 2));
+   {
+      png_byte buffer[2];
+      buffer[0] = 0; /* terminate name */
+      buffer[1] = 0xFFU & compression_type;
+      png_write_chunk_data(png_ptr, buffer, 2);
+   }

   if (profile_len != 0)
   {
@@ -1168,7 +1170,6 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   }

   png_write_chunk_end(png_ptr);
-   png_free(png_ptr, new_name);
 }
 #endif

@@ -1178,7 +1179,6 @@ void /* PRIVATE */
 png_write_sPLT(png_structp png_ptr, png_const_sPLT_tp spalette)
 {
   png_size_t name_len;
-   png_charp new_name;
   png_byte entrybuf[10];
   png_size_t entry_size = (spalette->depth == 8 ? 6 : 10);
   png_size_t palette_size = entry_size * spalette->nentries;
@@ -1189,14 +1189,13 @@ png_write_sPLT(png_structp png_ptr, png_const_sPLT_tp spalette)

   png_debug(1, "in png_write_sPLT");

-   if ((name_len = png_check_keyword(png_ptr,spalette->name, &new_name))==0)
-      return;
+   name_len = png_strlen(spalette->name);

   /* Make sure we include the NULL after the name */
   png_write_chunk_header(png_ptr, png_sPLT,
       (png_uint_32)(name_len + 2 + palette_size));

-   png_write_chunk_data(png_ptr, (png_bytep)new_name,
+   png_write_chunk_data(png_ptr, (png_bytep)spalette->name,
       (png_size_t)(name_len + 1));

   png_write_chunk_data(png_ptr, &spalette->depth, (png_size_t)1);
@@ -1252,7 +1251,6 @@ png_write_sPLT(png_structp png_ptr, png_const_sPLT_tp spalette)
 #endif

   png_write_chunk_end(png_ptr);
-   png_free(png_ptr, new_name);
 }
 #endif

@@ -1508,138 +1506,6 @@ png_write_hIST(png_structp png_ptr, png_const_uint_16p hist, int num_hist)
 }
 #endif

-#if defined(PNG_WRITE_TEXT_SUPPORTED) || defined(PNG_WRITE_pCAL_SUPPORTED) || \
-    defined(PNG_WRITE_iCCP_SUPPORTED) || defined(PNG_WRITE_sPLT_SUPPORTED)
-/* Check that the tEXt or zTXt keyword is valid per PNG 1.0 specification,
- * and if invalid, correct the keyword rather than discarding the entire
- * chunk.  The PNG 1.0 specification requires keywords 1-79 characters in
- * length, forbids leading or trailing whitespace, multiple internal spaces,
- * and the non-break space (0x80) from ISO 8859-1.  Returns keyword length.
- *
- * The new_key is allocated to hold the corrected keyword and must be freed
- * by the calling routine.  This avoids problems with trying to write to
- * static keywords without having to have duplicate copies of the strings.
- */
-png_size_t /* PRIVATE */
-png_check_keyword(png_structp png_ptr, png_const_charp key, png_charpp new_key)
-{
-   png_size_t key_len;
-   png_const_charp ikp;
-   png_charp kp, dp;
-   int kflag;
-   int kwarn=0;
-
-   png_debug(1, "in png_check_keyword");
-
-   *new_key = NULL;
-
-   if (key == NULL || (key_len = png_strlen(key)) == 0)
-   {
-      png_warning(png_ptr, "zero length keyword");
-      return ((png_size_t)0);
-   }
-
-   png_debug1(2, "Keyword to be checked is '%s'", key);
-
-   *new_key = (png_charp)png_malloc_warn(png_ptr, (png_uint_32)(key_len + 2));
-
-   if (*new_key == NULL)
-   {
-      png_warning(png_ptr, "Out of memory while procesing keyword");
-      return ((png_size_t)0);
-   }
-
-   /* Replace non-printing characters with a blank and print a warning */
-   for (ikp = key, dp = *new_key; *ikp != '\0'; ikp++, dp++)
-   {
-      if ((png_byte)*ikp < 0x20 ||
-         ((png_byte)*ikp > 0x7E && (png_byte)*ikp < 0xA1))
-      {
-         PNG_WARNING_PARAMETERS(p)
-
-         png_warning_parameter_unsigned(p, 1, PNG_NUMBER_FORMAT_02x,
-            (png_byte)*ikp);
-         png_formatted_warning(png_ptr, p, "invalid keyword character 0x@1");
-         *dp = ' ';
-      }
-
-      else
-      {
-         *dp = *ikp;
-      }
-   }
-   *dp = '\0';
-
-   /* Remove any trailing white space. */
-   kp = *new_key + key_len - 1;
-   if (*kp == ' ')
-   {
-      png_warning(png_ptr, "trailing spaces removed from keyword");
-
-      while (*kp == ' ')
-      {
-         *(kp--) = '\0';
-         key_len--;
-      }
-   }
-
-   /* Remove any leading white space. */
-   kp = *new_key;
-   if (*kp == ' ')
-   {
-      png_warning(png_ptr, "leading spaces removed from keyword");
-
-      while (*kp == ' ')
-      {
-         kp++;
-         key_len--;
-      }
-   }
-
-   png_debug1(2, "Checking for multiple internal spaces in '%s'", kp);
-
-   /* Remove multiple internal spaces. */
-   for (kflag = 0, dp = *new_key; *kp != '\0'; kp++)
-   {
-      if (*kp == ' ' && kflag == 0)
-      {
-         *(dp++) = *kp;
-         kflag = 1;
-      }
-
-      else if (*kp == ' ')
-      {
-         key_len--;
-         kwarn = 1;
-      }
-
-      else
-      {
-         *(dp++) = *kp;
-         kflag = 0;
-      }
-   }
-   *dp = '\0';
-   if (kwarn != 0)
-      png_warning(png_ptr, "extra interior spaces removed from keyword");
-
-   if (key_len == 0)
-   {
-      png_free(png_ptr, *new_key);
-      png_warning(png_ptr, "Zero length keyword");
-   }
-
-   if (key_len > 79)
-   {
-      png_warning(png_ptr, "keyword length must be 1 - 79 characters");
-      (*new_key)[79] = '\0';
-      key_len = 79;
-   }
-
-   return (key_len);
-}
-#endif
-
 #ifdef PNG_WRITE_tEXt_SUPPORTED
 /* Write a tEXt chunk */
 void /* PRIVATE */
@@ -1647,12 +1513,10 @@ png_write_tEXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
    png_size_t text_len)
 {
   png_size_t key_len;
-   png_charp new_key;

   png_debug(1, "in png_write_tEXt");

-   if ((key_len = png_check_keyword(png_ptr, key, &new_key))==0)
-      return;
+   key_len = strlen(key);

   if (text == NULL || *text == '\0')
      text_len = 0;
@@ -1669,7 +1533,7 @@ png_write_tEXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG will forbid them.
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
    */
-   png_write_chunk_data(png_ptr, (png_bytep)new_key,
+   png_write_chunk_data(png_ptr, (png_bytep)key,
       (png_size_t)(key_len + 1));

   if (text_len != 0)
@@ -1677,7 +1541,6 @@ png_write_tEXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
          (png_size_t)text_len);

   png_write_chunk_end(png_ptr);
-   png_free(png_ptr, new_key);
 }
 #endif

@@ -1689,7 +1552,6 @@ png_write_zTXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
 {
   png_size_t key_len;
   png_byte buf;
-   png_charp new_key;
   compression_state comp;

   png_debug(1, "in png_write_zTXt");
@@ -1700,16 +1562,11 @@ png_write_zTXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
   comp.input = NULL;
   comp.input_len = 0;

-   if ((key_len = png_check_keyword(png_ptr, key, &new_key)) == 0)
-   {
-      png_free(png_ptr, new_key);
-      return;
-   }
+   key_len = strlen(key);

   if (text == NULL || *text == '\0' || compression==PNG_TEXT_COMPRESSION_NONE)
   {
-      png_write_tEXt(png_ptr, new_key, text, (png_size_t)0);
-      png_free(png_ptr, new_key);
+      png_write_tEXt(png_ptr, key, text, (png_size_t)0);
      return;
   }

@@ -1724,11 +1581,9 @@ png_write_zTXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
       (png_uint_32)(key_len+text_len + 2));

   /* Write key */
-   png_write_chunk_data(png_ptr, (png_bytep)new_key,
+   png_write_chunk_data(png_ptr, (png_bytep)key,
       (png_size_t)(key_len + 1));

-   png_free(png_ptr, new_key);
-
   buf = (png_byte)compression;

   /* Write compression */
@@ -1749,8 +1604,6 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
    png_const_charp lang, png_const_charp lang_key, png_const_charp text)
 {
   png_size_t lang_len, key_len, lang_key_len, text_len;
-   png_charp new_lang;
-   png_charp new_key = NULL;
   png_byte cbuf[2];
   compression_state comp;

@@ -1761,15 +1614,13 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
   comp.output_ptr = NULL;
   comp.input = NULL;

-   if ((key_len = png_check_keyword(png_ptr, key, &new_key)) == 0)
-      return;
+   key_len = png_strlen(key);

-   if ((lang_len = png_check_keyword(png_ptr, lang, &new_lang)) == 0)
-   {
-      png_warning(png_ptr, "Empty language field in iTXt chunk");
-      new_lang = NULL;
+   if (lang == NULL)
      lang_len = 0;
-   }
+
+   else
+      lang_len = png_strlen(lang);

   if (lang_key == NULL)
      lang_key_len = 0;
@@ -1804,7 +1655,7 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG will forbid them.
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
    */
-   png_write_chunk_data(png_ptr, (png_bytep)new_key, (png_size_t)(key_len + 1));
+   png_write_chunk_data(png_ptr, (png_bytep)key, (png_size_t)(key_len + 1));

   /* Set the compression flag */
   if (compression == PNG_ITXT_COMPRESSION_NONE ||
@@ -1820,7 +1671,7 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
   png_write_chunk_data(png_ptr, cbuf, (png_size_t)2);

   cbuf[0] = 0;
-   png_write_chunk_data(png_ptr, (new_lang ? (png_const_bytep)new_lang : cbuf),
+   png_write_chunk_data(png_ptr, (lang ? (png_const_bytep)lang : cbuf),
       (png_size_t)(lang_len + 1));

   png_write_chunk_data(png_ptr, (lang_key ? (png_const_bytep)lang_key : cbuf),
@@ -1829,9 +1680,6 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
   png_write_compressed_data_out(png_ptr, &comp, text_len);

   png_write_chunk_end(png_ptr);
-
-   png_free(png_ptr, new_key);
-   png_free(png_ptr, new_lang);
 }
 #endif

@@ -1865,7 +1713,6 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
   png_size_t purpose_len, units_len, total_len;
   png_size_tp params_len;
   png_byte buf[10];
-   png_charp new_purpose;
   int i;

   png_debug1(1, "in png_write_pCAL (%d parameters)", nparams);
@@ -1873,7 +1720,7 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
   if (type >= PNG_EQUATION_LAST)
      png_warning(png_ptr, "Unrecognized equation type for pCAL chunk");

-   purpose_len = png_check_keyword(png_ptr, purpose, &new_purpose) + 1;
+   purpose_len = strlen(purpose) + 1;
   png_debug1(3, "pCAL purpose length = %d", (int)purpose_len);
   units_len = png_strlen(units) + (nparams == 0 ? 0 : 1);
   png_debug1(3, "pCAL units length = %d", (int)units_len);
@@ -1895,7 +1742,7 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,

   png_debug1(3, "pCAL total length = %d", (int)total_len);
   png_write_chunk_header(png_ptr, png_pCAL, (png_uint_32)total_len);
-   png_write_chunk_data(png_ptr, (png_const_bytep)new_purpose, purpose_len);
+   png_write_chunk_data(png_ptr, (png_const_bytep)purpose, purpose_len);
   png_save_int_32(buf, X0);
   png_save_int_32(buf + 4, X1);
   buf[8] = (png_byte)type;
@@ -1903,8 +1750,6 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
   png_write_chunk_data(png_ptr, buf, (png_size_t)10);
   png_write_chunk_data(png_ptr, (png_const_bytep)units, (png_size_t)units_len);

-   png_free(png_ptr, new_purpose);
-
   for (i = 0; i < nparams; i++)
   {
      png_write_chunk_data(png_ptr, (png_const_bytep)params[i], params_len[i]);
--- a/projects/vstudio/readme.txt
+++ b/projects/vstudio/readme.txt
@@ -1,7 +1,7 @@

 VisualStudio instructions

-libpng version 1.5.23 - July 23, 2015
+libpng version 1.5.26 - December 17, 2015

 Copyright (c) 1998-2010 Glenn Randers-Pehrson

--- a/projects/vstudio/zlib.props
+++ b/projects/vstudio/zlib.props
@@ -2,7 +2,7 @@
 <!--
 * zlib.props - location of zlib source
 *
- * libpng version 1.5.23 - July 23, 2015
+ * libpng version 1.5.26 - December 17, 2015
 *
 * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 *
--- a/scripts/README.txt
+++ b/scripts/README.txt
@@ -1,9 +1,9 @@

-Makefiles for  libpng version 1.5.23 - July 23, 2015
+Makefiles for  libpng version 1.5.26 - December 17, 2015

 pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng15.so.15.1.5.23)
+                       (gcc, creates libpng15.so.15.1.5.26)
 makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
 makefile.knr      =>  Archaic UNIX Makefile that converts files with
                       ansi2knr (Requires ansi2knr.c from
@@ -34,12 +34,12 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.os2      =>  OS/2 Makefile (gcc and emx, requires libpng.def)
 makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
 makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng15.so.15.1.5.23)
+                       creates libpng15.so.15.1.5.26)
 makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
 makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng15.so.15.1.5.23)
+                       creates libpng15.so.15.1.5.26)
 makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng15.so.15.1.5.23)
+                       creates libpng15.so.15.1.5.26)
 makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
 makefile.sunos    =>  Sun makefile
 makefile.32sunu   =>  Sun Ultra 32-bit makefile
--- a/scripts/def.c
+++ b/scripts/def.c
@@ -21,7 +21,7 @@ PNG_DFN "OS2 DESCRIPTION "PNG image compression library""
 PNG_DFN "OS2 CODE PRELOAD MOVEABLE DISCARDABLE"
 PNG_DFN ""
 PNG_DFN "EXPORTS"
-PNG_DFN ";Version 1.5.23"
+PNG_DFN ";Version 1.5.26"

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
        PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"
--- a/scripts/libpng-config-head.in
+++ b/scripts/libpng-config-head.in
@@ -11,7 +11,7 @@

 # Modeled after libxml-config.

-version=1.5.23
+version=1.5.26
 prefix=""
 libdir=""
 libs=""
--- a/scripts/libpng.pc.in
+++ b/scripts/libpng.pc.in
@@ -5,6 +5,6 @@ includedir=@includedir@/libpng15

 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.5.23
+Version: 1.5.26
 Libs: -L${libdir} -lpng15
 Cflags: -I${includedir}
--- a/scripts/makefile.cegcc
+++ b/scripts/makefile.cegcc
@@ -23,7 +23,7 @@

 VERMAJ = 1
 VERMIN = 5
-VERMIC = 23
+VERMIC = 26
 VER = $(VERMAJ).$(VERMIN).$(VERMIC)
 NAME = libpng
 PACKAGE = $(NAME)-$(VER)
--- a/scripts/makefile.linux
+++ b/scripts/makefile.linux
@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng15
 PNGMAJ = 15
-RELEASE = 23
+RELEASE = 26

 # Shared library names:
 LIBSO=$(LIBNAME).so
--- a/scripts/makefile.msys
+++ b/scripts/makefile.msys
@@ -18,7 +18,7 @@ exec_prefix=$(prefix)
 # Library name:
 LIBNAME = libpng15
 PNGMAJ = 15
-RELEASE = 23
+RELEASE = 26

 # Shared library names:
 LIBSO=$(LIBNAME).dll
--- a/scripts/makefile.ne12bsd
+++ b/scripts/makefile.ne12bsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng15

 LIB=	png15
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.5.23
+SHLIB_MINOR=	1.5.26
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.netbsd
+++ b/scripts/makefile.netbsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include

 LIB=	png
 SHLIB_MAJOR=	15
-SHLIB_MINOR=	1.5.23
+SHLIB_MINOR=	1.5.26
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.openbsd
+++ b/scripts/makefile.openbsd
@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat

 SHLIB_MAJOR=	15
-SHLIB_MINOR=	1.5.23
+SHLIB_MINOR=	1.5.26

 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
--- a/scripts/pnglibconf.dfa
+++ b/scripts/pnglibconf.dfa
@@ -409,9 +409,7 @@ option WRITE_USER_TRANSFORM requires WRITE_TRANSFORMS

 option WRITE_INTERLACING requires WRITE

-# The following depends, internally, on WEIGHT_SHIFT and COST_SHIFT
-# where are set below.
-
+# Deprecated, will be removed.
 option WRITE_WEIGHTED_FILTER requires WRITE

 option WRITE_FLUSH requires WRITE
@@ -511,11 +509,6 @@ setting MAX_GAMMA_8 default 11

 setting GAMMA_THRESHOLD_FIXED default 5000

-# Scaling factor for filter heuristic weighting calculations
-
-setting WEIGHT_SHIFT default 8
-setting COST_SHIFT default 3
-
 # Precision to use when converting a floating point value to a PNG
 # extension format string in an sCAL chunk (only relevant if the
 # floating point API is enabled)
--- a/scripts/pnglibconf.h.prebuilt
+++ b/scripts/pnglibconf.h.prebuilt
@@ -1,9 +1,9 @@
-/* 1.5.23 STANDARD API DEFINITION */
+/* 1.5.26 STANDARD API DEFINITION */
 /* pnglibconf.h - library build configuration */

-/* libpng version 1.5.23 - July 23, 2015 */
+/* libpng version 1.5.26 - December 17, 2015 */

-/* Copyright (c) 1998-2013 Glenn Randers-Pehrson */
+/* Copyright (c) 1998-2015 Glenn Randers-Pehrson */

 /* This code is released under the libpng license. */
 /* For conditions of distribution and use, see the disclaimer */
@@ -171,7 +171,6 @@
 /* end of options */
 /* settings */
 #define PNG_API_RULE 0
-#define PNG_COST_SHIFT 3
 #define PNG_DEFAULT_READ_MACROS 1
 #define PNG_GAMMA_THRESHOLD_FIXED 5000
 #define PNG_MAX_GAMMA_8 11
@@ -182,7 +181,6 @@
 #define PNG_USER_CHUNK_MALLOC_MAX 8000000
 #define PNG_USER_HEIGHT_MAX 1000000
 #define PNG_USER_WIDTH_MAX 1000000
-#define PNG_WEIGHT_SHIFT 8
 #define PNG_ZBUF_SIZE 8192
 #define PNG_sCAL_PRECISION 5
 /* end of settings */
--- a/scripts/symbols.def
+++ b/scripts/symbols.def
@@ -1,4 +1,4 @@
-;Version 1.5.23
+;Version 1.5.26
 ;--------------------------------------------------------------
 ; LIBPNG symbol list as a Win32 DEF file
 ; Contains all the symbols that can be exported from libpng
Author	SHA1	Message	Date
Glenn Randers-Pehrson	94322f3f8f	[libpng15] Imported from libpng-1.5.26.tar	2015-12-17 08:11:20 -06:00
Glenn Randers-Pehrson	8f1c1a6d8c	[libpng15] Imported from libpng-1.5.26rc01.tar	2015-12-13 21:44:19 -06:00
Glenn Randers-Pehrson	fd3cd9fad2	[libpng15] Update some last-changed dates	2015-12-13 18:36:30 -06:00
Glenn Randers-Pehrson	2921aa280f	Merge branch 'libpng15-20151213-keyword' of git://github.com/jbowler/libpng-1 into libpng15	2015-12-13 18:20:11 -06:00
John Bowler	e40ac66f81	[libpng15] Do png_check_keyword in png_set_*()	2015-12-13 18:10:53 -06:00
Glenn Randers-Pehrson	a510a813ef	[libpng15] Remove new redundant prototype for png_set_keyword()	2015-12-13 17:35:11 -06:00
Glenn Randers-Pehrson	ad5f16c406	[libpng15] Bump version to 1.5.26beta02	2015-12-13 16:19:49 -06:00
Glenn Randers-Pehrson	2b5be93866	[libpng15] Move png_check_keyword() from pngwutil.c to pngset.c	2015-12-13 16:18:58 -06:00
John Bowler	8d28ab2101	Move png_check_keyword to pngset.c This is a backport of the libpng16 version with the warnings switched off. Signed-off-by: John Bowler <jbowler@acm.org>	2015-12-13 13:44:34 -08:00
Glenn Randers-Pehrson	29c1086ba3	[libpng15] Imported from libpng-1.5.26beta01.tar	2015-12-11 10:20:41 -06:00
Glenn Randers-Pehrson	456d614959	[libpng15] Bump version to 1.5.26beta01	2015-12-09 09:42:49 -06:00
Glenn Randers-Pehrson	d9006f683c	[libpng15] Fixed an out-of-range read in png_check_keyword() (Bug report from Qixue Xiao).	2015-12-09 09:40:48 -06:00
Glenn Randers-Pehrson	93e111afc5	[libpng15] Imported from libpng-1.5.25.tar	2015-12-02 22:30:30 -06:00
Glenn Randers-Pehrson	3a1a5256fa	[libpng15] Imported from libpng-1.5.25rc01.tar	2015-11-26 07:04:16 -06:00
Glenn Randers-Pehrson	b5da27d211	[libpng15] Imported from libpng-1.5.25beta03.tar	2015-11-24 09:36:23 -06:00
Glenn Randers-Pehrson	11c2f47bd6	Merge branch 'libpng15-20151123' of git://github.com/jbowler/libpng-1 into libpng15	2015-11-24 09:34:59 -06:00
John Bowler	daf54fe4fc	Test backport Tests backported from the multi-version compatible ones in libpng 1.7 Signed-off-by: John Bowler <jbowler@acm.org>	2015-11-23 20:16:21 -08:00
Glenn Randers-Pehrson	17749bdd61	[libpng15] Imported from libpng-1.5.25beta02.tar	2015-11-23 09:29:33 -06:00
Glenn Randers-Pehrson	3ccfba8c28	[lbpng15] Revert 12 -> 12U change in pngrutil.c	2015-11-22 22:59:16 -06:00
Glenn Randers-Pehrson	596f052d69	[libpng15] Fixed bug recently introduced in png_set_PLTE() that uses png_ptr not info_ptr.	2015-11-22 20:47:45 -06:00
Glenn Randers-Pehrson	69ac844654	[libpng15] Bump version to 1.5.25beta02	2015-11-22 14:11:19 -06:00
Glenn Randers-Pehrson	635a8b9b84	[libpng15] Imported from libpng-1.5.25beta01.tar	2015-11-22 14:08:45 -06:00
Glenn Randers-Pehrson	611e8de78c	[libpng15] Use unsigned constants in buffer length comparisons	2015-11-21 14:33:31 -06:00
Glenn Randers-Pehrson	68a6e6755b	[lbpng15] Rearrange terms in buffer length tests in pngrutil.c to avoid potential overflow in calculations.	2015-11-19 09:12:43 -06:00
Glenn Randers-Pehrson	8738633bd6	[libpng15] Avoid potential pointer overflow in png_handle_iTXt(), png_handle_zTXt(), png_handle_sPLT(), and png_handle_pCAL() (Bug report by John Regehr).	2015-11-13 22:47:30 -06:00
Glenn Randers-Pehrson	b257d4a6a1	[libpng15] Bump version to 1.5.25beta01	2015-11-13 10:18:08 -06:00
Glenn Randers-Pehrson	df80d38897	[libpng15] Imported from libpng-1.5.24.tar	2015-11-12 07:13:10 -06:00
Glenn Randers-Pehrson	9b70e0332b	[libpng15] Clean up coding style in png_handle_PLTE()	2015-11-05 11:17:54 -06:00
Glenn Randers-Pehrson	b6ec5eb74e	[libpng15] Imported from libpng-1.5.24rc04.tar	2015-11-05 06:59:22 -06:00
Glenn Randers-Pehrson	15117f202c	[libpng15] Fixed new bug with CRC error after reading an over-length palette.	2015-11-04 23:46:24 -06:00
Glenn Randers-Pehrson	4b0a6350cd	[libpng15] Imported from libpng-1.5.24rc02.tar	2015-11-03 10:00:01 -06:00
Glenn Randers-Pehrson	e4a9c63445	[libpng15] Imported from libpng-1.5.24rc02.tar	2015-11-03 08:12:20 -06:00
Glenn Randers-Pehrson	06c1be4b28	[libpng15] Bump version to 1.5.24rc02	2015-11-03 07:51:53 -06:00
Glenn Randers-Pehrson	cd8a3ffeb1	[libpng15] Fixed some inconsequential cut-and-paste typos in png_set_cHRM_XYZ_fixed().	2015-11-01 12:40:04 -06:00
Glenn Randers-Pehrson	9db953ad5b	[libpng15] Imported from libpng-1.5.24rc01.tar	2015-10-31 08:52:12 -05:00
Glenn Randers-Pehrson	91a73053b9	[libpng15] Update manual about handling over-length PLTE chunks.	2015-10-31 08:47:32 -05:00
Glenn Randers-Pehrson	820a090567	[libpng15] Silently truncate over-length PLTE chunk while reading.	2015-10-30 13:21:32 -05:00
Glenn Randers-Pehrson	20e0daa74a	[libpng15] Update CHANGES and ANNOUNCE about rowbytes fix	2015-10-30 13:02:20 -05:00
John Bowler	8678f9c3f4	rowbytes check correction The old code incorrectly calculated the output rowbytes when the application decreased either the number of channels or the bit depth (or both) in a user transform. This was safe; libpng overallocated buffer space (potentially by quite a lot; up to 4 times the amount required) but, from 1.5.4 on, resulted in a png_error. Signed-off-by: John Bowler <jbowler@acm.org>	2015-10-29 18:12:10 -07:00
Glenn Randers-Pehrson	3a990c93f4	[libng15] Prevent writing over-length PLTE chunk (Cosmin Truta).	2015-10-29 09:56:19 -05:00
Glenn Randers-Pehrson	39f8f0e6da	[libpng15] Bump version to 1.5.24beta03	2015-10-14 22:14:22 -05:00
Glenn Randers-Pehrson	51148c5255	[libpng15] Imported from libpng-1.5.24beta02.tar	2015-10-14 22:14:13 -05:00
Glenn Randers-Pehrson	5e51957594	[libpng15] Added sPLT support to pngtest.c	2015-10-11 11:31:44 -05:00
Glenn Randers-Pehrson	2cc28ebc00	[libpng15] Merged pngvalid.c with libpng16's pngvalid.c, again.	2015-10-03 18:07:03 -05:00
Glenn Randers-Pehrson	24e485baec	[libpng15] Improve CHANGES and ANNOUNCE description of filler-byte fix.	2015-09-18 23:34:55 -05:00
Glenn Randers-Pehrson	01789a5e8e	[libpng15] Fix "last changed" line for pngvalid.c	2015-09-18 22:01:55 -05:00
Glenn Randers-Pehrson	1f4508c7e2	[libpng15] Update CHANGES and ANNOUNCE per recent pull request.	2015-09-18 21:24:29 -05:00
John Bowler	9946064745	pngvalid. copied from libpng17 This change requires the fix to png_set_filler Signed-off-by: John Bowler <jbowler@acm.org>	2015-09-18 15:49:57 -07:00
John Bowler	e87d502b16	png_set_filler with 16-bit output byte swapped the value A simple case of assigning the low and high byte in the wrong order, may cause problems for some apps if they already have a work-round. The code executes before the 16-bit byte swap so the order is always the PNG one. Signed-off-by: John Bowler <jbowler@acm.org>	2015-09-18 14:04:50 -07:00
John Bowler	8c4b258355	[libpng15] Fixed png_save_int_32 when int is not 2's complement (John Bowler).	2015-08-21 14:50:38 -05:00
Glenn Randers-Pehrson	7730265b27	[libpng15] Bump version to 1.5.24beta02	2015-08-19 12:54:33 -05:00
Glenn Randers-Pehrson	75318bc745	[libpng15] Imported from libpng-1.5.24beta01.tar	2015-08-19 12:54:24 -05:00
Glenn Randers-Pehrson	c357fb70b5	[lbipng15] Fixed the recently reported 1's complement security issue by replacing the value that is illegal in the PNG spec, in both signed and unsigned values, with 0. Illegal unsigned values (anything greater than or equal to 0x80000000) can still pass through, but since these are not illegal in ANSI-C (unlike 0x80000000 in the signed case) the checking that occurs later can catch them (John Bowler). Safely convert num_bytes to a png_byte in png_set_sig_bytes() (Robert Seacord).	2015-08-19 12:52:39 -05:00
Glenn Randers-Pehrson	a88dec67f2	[libpng15] Safely convert num_bytes to a png_byte in png_set_sig_bytes() (Robert Seacord).	2015-08-18 10:23:35 -05:00
Glenn Randers-Pehrson	357f3da6b0	[libpng15] Fix links in man page	2015-08-11 15:33:21 -05:00
Glenn Randers-Pehrson	53cabf986f	[libpng15] Fix links in man page	2015-08-11 13:03:02 -05:00
Glenn Randers-Pehrson	adef6f991f	[libpng15] Update dead link in man page	2015-08-11 12:09:06 -05:00
Glenn Randers-Pehrson	bb98fdbf31	[libpng15] Fixed potential leak of png_pixels in contrib/pngminus/pnm2png.c and fixed uninitialized variable in contrib/gregbook/rpng2-x.c	2015-07-30 11:32:56 -05:00
Glenn Randers-Pehrson	aa24431c93	[libpng15] Bump version to 1.5.24beta01	2015-07-23 20:20:39 -05:00