[libpng15] Imported from libpng-1.5.26.tar

[libpng15] Imported from libpng-1.5.26rc01.tar
[libpng15] Update some last-changed dates
2025-07-10 18:04:09 +02:00 · 2015-12-17 08:11:20 -06:00 · 2015-12-13 21:44:19 -06:00 · 2015-12-13 18:36:30 -06:00 · 2015-12-13 18:20:11 -06:00 · 2015-12-13 18:10:53 -06:00
49 changed files with 650 additions and 602 deletions
--- a/74
+++ b/74
@@ -1,78 +1,34 @@

-Libpng 1.5.24rc04 - November 5, 2015
+Libpng 1.5.26 - December 17, 2015

-This is not intended to be a public release.  It will be replaced
-within a few weeks by a public version or by another test version.
+This is a public release of libpng, intended for use in production codes.

 Files available for download:

 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script

-   1.5.24rc04.tar.xz (LZMA-compressed, recommended)
-   1.5.24rc04.tar.gz
-   1.5.24rc04.tar.bz2
+   libpng-1.5.26.tar.xz (LZMA-compressed, recommended)
+   libpng-1.5.26.tar.gz

 Source files with CRLF line endings (for Windows), without the
 "configure" script

-   lp1524r04.7z  (LZMA-compressed, recommended)
-   lp1524r04.zip
+   lpng1526.7z  (LZMA-compressed, recommended)
+   lpng1526.zip

 Other information:

-   1.5.24rc04-README.txt
-   1.5.24rc04-LICENSE.txt
-   libpng-1.5.24rc04-*.asc (armored detached GPG signatures)
+   libpng-1.5.26-README.txt
+   libpng-1.5.26-LICENSE.txt
+   libpng-1.5.26-*.asc (armored detached GPG signatures)

-Changes since the last public release (1.5.23):
-
-Version 1.5.24beta01 [August 19, 2015]
-  Avoid potentially dereferencing NULL info_ptr in png_info_init_3().
-  Eliminated unused PNG_COST_SHIFT, PNG_WEIGHT_SHIFT, PNG_COST_FACTOR, and
-    PNG_WEIGHT_FACTOR macros.
-  Fixed potential leak of png_pixels in contrib/pngminus/pnm2png.c
-  Fixed uninitialized variable in contrib/gregbook/rpng2-x.c
-  Fixed some bad links in the man page.
-  Safely convert num_bytes to a png_byte in png_set_sig_bytes() (Robert
-    Seacord).
-  Fixed the recently reported 1's complement security issue by replacing
-    the value that is illegal in the PNG spec, in both signed and unsigned
-    values, with 0. Illegal unsigned values (anything greater than or equal
-    to  0x80000000) can still pass through, but since these are not illegal
-    in ANSI-C (unlike 0x80000000 in the signed case) the checking that
-    occurs later can catch them (John Bowler).
-
-Version 1.5.24beta02 [October 15, 2015]
-  Fixed png_save_int_32 when int is not 2's complement (John Bowler).
-  Fixed byte order in png_do_read_filler() with 16-bit input (previously
-    fixed in libpng-1.6.17 and 1.7.0beta46). Previously the high and
-    low bytes of the filler, from png_set_filler() or from
-    png_set_add_alpha(), were read in the wrong order.
-  Merged pngvalid.c with version 1.6.19.
-  Added sPLT support to pngtest.c
-
-Version 1.5.24rc01 [October 31, 2015]
-  Prevent writing over-length PLTE chunk (Cosmin Truta).
-  Libpng incorrectly calculated the output rowbytes when the application
-    decreased either the number of channels or the bit depth (or both) in
-    a user transform.  This was safe; libpng overallocated buffer space
-   (potentially by quite a lot; up to 4 times the amount required) but,
-   from 1.5.4 on, resulted in a png_error (John Bowler).
-  Silently truncate over-length PLTE chunk while reading.
-
-Version 1.5.24rc02 [November 3, 2015]
-  Fixed some inconsequential cut-and-paste typos in png_set_cHRM_XYZ_fixed().
-  Clarified COPYRIGHT information to state explicitly that versions
-    are derived from previous versions.
-  Removed much of the long list of previous versions from png.h and
-    libpng.3.
-
-Version 1.5.24rc03 [omitted]
-
-Version 1.5.24rc04 [November 5, 2015]
-  Fixed new bug with CRC error after reading an over-length palette
-    (bug report by Cosmin Truta).
+Changes since the last public release (1.5.25):
+  Fixed an out-of-range read in png_check_keyword() (Bug report from
+    Qixue Xiao, CVE-2015-8540).
+  Corrected copyright dates in source files.
+  Moved png_check_keyword() from pngwutil.c to pngset.c
+  Added keyword checks to pngset.c (John Bowler).

 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
--- a/35
+++ b/35
@@ -4419,7 +4419,40 @@ Version 1.5.24rc03 [omitted]

 Version 1.5.24rc04 [November 5, 2015]
  Fixed new bug with CRC error after reading an over-length palette
-    (bug report by Cosmin Truta).
+    (bug report by Cosmin Truta) (CVE-2015-8126).
+
+version 1.5.24 [November 12, 2015]
+  Cleaned up coding style in png_handle_PLTE().
+
+version 1.5.25beta01 [November 20, 2015]
+  Avoid potential pointer overflow in png_handle_iTXt(), png_handle_zTXt(),
+    png_handle_sPLT(), and png_handle_pCAL() (Bug report by John Regehr).
+
+version 1.5.25beta02 [November 23, 2015]
+  Fixed incorrect implementation of png_set_PLTE() that uses png_ptr
+    not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126
+    vulnerability.  Fixes CVE-2015-8472.
+
+version 1.5.25beta03 [November 24, 2015]
+  Backported tests from libpng-1.7.0beta69.
+
+version 1.5.25rc01 [November 26, 2015]
+  No changes.
+
+version 1.5.25 [December 3, 2015]
+  No changes.
+
+version 1.5.26beta01 [December 11, 2015]
+  Fixed an out-of-range read in png_check_keyword() (Bug report from
+    Qixue Xiao, CVE-2015-8540).
+
+version 1.5.26rc01 [December 14, 2015]
+  Corrected copyright dates in source files.
+  Moved png_check_keyword() from pngwutil.c to pngset.c
+  Added keyword checks to pngset.c (John Bowler).
+
+version 1.5.26 [December 17, 2015]
+  No changes.

 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -16,7 +16,7 @@ enable_testing()

 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 5)
-set(PNGLIB_RELEASE 24)
+set(PNGLIB_RELEASE 26)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})

@@ -224,7 +224,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW)
 # SET UP LINKS
 if(PNG_SHARED)
  set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 15.${PNGLIB_RELEASE}.1.5.24rc04
+#   VERSION 15.${PNGLIB_RELEASE}.1.5.26
    VERSION 15.${PNGLIB_RELEASE}.0
    SOVERSION 15
    CLEAN_DIRECT_OUTPUT 1)
--- a/4
+++ b/4
@@ -10,7 +10,7 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.0.7, July 1, 2000, through 1.5.24rc04, November 5, 2015, are
+libpng versions 1.0.7, July 1, 2000, through 1.5.26, December 17, 2015, are
 Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -108,4 +108,4 @@ the additional disclaimers inserted at version 1.0.7.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 5, 2015
+December 17, 2015
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-README for libpng version 1.5.24rc04 - November 5, 2015 (shared library 15.0)
+README for libpng version 1.5.26 - December 17, 2015 (shared library 15.0)
 See the note about version numbers near the top of png.h

 See INSTALL for instructions on how to install libpng.
--- a/24
+++ b/24
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for libpng 1.5.24rc04.
+# Generated by GNU Autoconf 2.69 for libpng 1.5.26.
 #
 # Report bugs to <png-mng-implement@lists.sourceforge.net>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libpng'
 PACKAGE_TARNAME='libpng'
-PACKAGE_VERSION='1.5.24rc04'
-PACKAGE_STRING='libpng 1.5.24rc04'
+PACKAGE_VERSION='1.5.26'
+PACKAGE_STRING='libpng 1.5.26'
 PACKAGE_BUGREPORT='png-mng-implement@lists.sourceforge.net'
 PACKAGE_URL=''

@@ -1354,7 +1354,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures libpng 1.5.24rc04 to adapt to many kinds of systems.
+\`configure' configures libpng 1.5.26 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1424,7 +1424,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of libpng 1.5.24rc04:";;
+     short | recursive ) echo "Configuration of libpng 1.5.26:";;
   esac
  cat <<\_ACEOF

@@ -1579,7 +1579,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-libpng configure 1.5.24rc04
+libpng configure 1.5.26
 generated by GNU Autoconf 2.69

 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2002,7 +2002,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by libpng $as_me 1.5.24rc04, which was
+It was created by libpng $as_me 1.5.26, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  $ $0 $@
@@ -2865,7 +2865,7 @@ fi

 # Define the identity of the package.
 PACKAGE='libpng'
- VERSION='1.5.24rc04'
+ VERSION='1.5.26'


 cat >>confdefs.h <<_ACEOF
@@ -2982,10 +2982,10 @@ fi



-PNGLIB_VERSION=1.5.24rc04
+PNGLIB_VERSION=1.5.26
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=5
-PNGLIB_RELEASE=24
+PNGLIB_RELEASE=26



@@ -14124,7 +14124,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libpng $as_me 1.5.24rc04, which was
+This file was extended by libpng $as_me 1.5.26, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -14190,7 +14190,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-libpng config.status 1.5.24rc04
+libpng config.status 1.5.26
 configured by $0, generated by GNU Autoconf 2.69,
  with options \\"\$ac_cs_config\\"

--- a/configure.ac
+++ b/configure.ac
@@ -18,15 +18,15 @@ AC_PREREQ(2.59)

 dnl Version number stuff here:

-AC_INIT([libpng], [1.5.24rc04], [png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng], [1.5.26], [png-mng-implement@lists.sourceforge.net])
 AM_INIT_AUTOMAKE([1.13 serial-tests subdir-objects])
 dnl stop configure from automagically running automake
 AM_MAINTAINER_MODE

-PNGLIB_VERSION=1.5.24rc04
+PNGLIB_VERSION=1.5.26
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=5
-PNGLIB_RELEASE=24
+PNGLIB_RELEASE=26

 dnl End of version number stuff

--- a/contrib/gregbook/rpng2-x.c
+++ b/contrib/gregbook/rpng2-x.c
@@ -496,12 +496,12 @@ int main(int argc, char **argv)
          "\t\t  transparent images; overrides -bgcolor\n",
          num_bgpat-1);
 #ifdef FEATURE_LOOP
-        fprintf(stderr, 
+        fprintf(stderr,
          "    -loop\tloops through background images after initial display\n"
          "\t\t  is complete (depends on -bgpat)\n"
          "    sec \tseconds to display each background image (default = 2)\n");
 #endif
-        fprintf(stderr, 
+        fprintf(stderr,
          "    dur \tduration in microseconds to wait after displaying each\n"
          "\t\t  row (for demo purposes)\n"
          "    -timing\tenables delay for every block read, to simulate modem\n"
--- a/contrib/libtests/pngvalid.c
+++ b/contrib/libtests/pngvalid.c
@@ -1,7 +1,7 @@

 /* pngvalid.c - validate libpng by constructing then reading png files.
 *
- * Last changed in libpng 1.5.24 [(PENDING RELEASE)]
+ * Last changed in libpng 1.5.25 [December 17, 2015]
 * Copyright (c) 2014-2015 Glenn Randers-Pehrson
 * Written by John Cunningham Bowler
 *
@@ -116,13 +116,6 @@ typedef png_byte *png_const_bytep;
 #  define png_const_structp png_structp
 #endif

-#if PNG_LIBPNG_VER < 10700
-   /* READ_INTERLACING was used instead of READ_DEINTERLACE. */
-#  ifdef PNG_READ_INTERLACING_SUPPORTED
-#     define PNG_READ_DEINTERLACE_SUPPORTED
-#  endif
-#endif
-
 #include <float.h>  /* For floating point constants */
 #include <stdlib.h> /* For malloc */
 #include <string.h> /* For memcpy, memset */
@@ -539,7 +532,8 @@ sample(png_const_bytep row, png_byte colour_type, png_byte bit_depth,
 */
 static void
 pixel_copy(png_bytep toBuffer, png_uint_32 toIndex,
-   png_const_bytep fromBuffer, png_uint_32 fromIndex, unsigned int pixelSize)
+   png_const_bytep fromBuffer, png_uint_32 fromIndex, unsigned int pixelSize,
+   int littleendian)
 {
   /* Assume we can multiply by 'size' without overflow because we are
    * just working in a single buffer.
@@ -549,15 +543,25 @@ pixel_copy(png_bytep toBuffer, png_uint_32 toIndex,
   if (pixelSize < 8) /* Sub-byte */
   {
      /* Mask to select the location of the copied pixel: */
-      unsigned int destMask = ((1U<<pixelSize)-1) << (8-pixelSize-(toIndex&7));
+      unsigned int destMask = ((1U<<pixelSize)-1) <<
+         (littleendian ? toIndex&7 : 8-pixelSize-(toIndex&7));
      /* The following read the entire pixels and clears the extra: */
      unsigned int destByte = toBuffer[toIndex >> 3] & ~destMask;
      unsigned int sourceByte = fromBuffer[fromIndex >> 3];

      /* Don't rely on << or >> supporting '0' here, just in case: */
      fromIndex &= 7;
-      if (fromIndex > 0) sourceByte <<= fromIndex;
-      if ((toIndex & 7) > 0) sourceByte >>= toIndex & 7;
+      if (littleendian)
+      {
+         if (fromIndex > 0) sourceByte >>= fromIndex;
+         if ((toIndex & 7) > 0) sourceByte <<= toIndex & 7;
+      }
+
+      else
+      {
+         if (fromIndex > 0) sourceByte <<= fromIndex;
+         if ((toIndex & 7) > 0) sourceByte >>= toIndex & 7;
+      }

      toBuffer[toIndex >> 3] = (png_byte)(destByte | (sourceByte & destMask));
   }
@@ -570,7 +574,8 @@ pixel_copy(png_bytep toBuffer, png_uint_32 toIndex,
 * bytes at the end.
 */
 static void
-row_copy(png_bytep toBuffer, png_const_bytep fromBuffer, unsigned int bitWidth)
+row_copy(png_bytep toBuffer, png_const_bytep fromBuffer, unsigned int bitWidth,
+      int littleendian)
 {
   memcpy(toBuffer, fromBuffer, bitWidth >> 3);

@@ -580,10 +585,10 @@ row_copy(png_bytep toBuffer, png_const_bytep fromBuffer, unsigned int bitWidth)

      toBuffer += bitWidth >> 3;
      fromBuffer += bitWidth >> 3;
-      /* The remaining bits are in the top of the byte, the mask is the bits to
-       * retain.
-       */
-      mask = 0xff >> (bitWidth & 7);
+      if (littleendian)
+         mask = 0xff << (bitWidth & 7);
+      else
+         mask = 0xff >> (bitWidth & 7);
      *toBuffer = (png_byte)((*toBuffer & mask) | (*fromBuffer & ~mask));
   }
 }
@@ -3549,6 +3554,7 @@ transform_row(png_const_structp pp, png_byte buffer[TRANSFORM_ROWMAX],
 #  define INTERLACE_LAST PNG_INTERLACE_LAST
 #  define check_interlace_type(type) ((void)(type))
 #  define set_write_interlace_handling(pp,type) png_set_interlace_handling(pp)
+#  define do_own_interlace 0
 #elif PNG_LIBPNG_VER < 10700
 #  define set_write_interlace_handling(pp,type) (1)
 static void
@@ -3568,16 +3574,75 @@ check_interlace_type(int const interlace_type)
   }
 }
 #  define INTERLACE_LAST (PNG_INTERLACE_NONE+1)
+#  define do_own_interlace 0
 #else /* libpng 1.7+ */
 #  define set_write_interlace_handling(pp,type)\
      npasses_from_interlace_type(pp,type)
 #  define check_interlace_type(type) ((void)(type))
-#  define INTERLACE_LAST (PNG_INTERLACE_NONE+1)
+#  define INTERLACE_LAST PNG_INTERLACE_LAST
+#  define do_own_interlace 1
 #endif /* WRITE_INTERLACING tests */

 #define CAN_WRITE_INTERLACE\
   PNG_LIBPNG_VER >= 10700 || defined PNG_WRITE_INTERLACING_SUPPORTED

+/* Do the same thing for read interlacing; this controls whether read tests do
+ * their own de-interlace or use libpng.
+ */
+#ifdef PNG_READ_INTERLACING_SUPPORTED
+#  define do_read_interlace 0
+#else /* no libpng read interlace support */
+#  define do_read_interlace 1
+#endif
+/* The following two routines use the PNG interlace support macros from
+ * png.h to interlace or deinterlace rows.
+ */
+static void
+interlace_row(png_bytep buffer, png_const_bytep imageRow,
+   unsigned int pixel_size, png_uint_32 w, int pass, int littleendian)
+{
+   png_uint_32 xin, xout, xstep;
+
+   /* Note that this can, trivially, be optimized to a memcpy on pass 7, the
+    * code is presented this way to make it easier to understand.  In practice
+    * consult the code in the libpng source to see other ways of doing this.
+    *
+    * It is OK for buffer and imageRow to be identical, because 'xin' moves
+    * faster than 'xout' and we copy up.
+    */
+   xin = PNG_PASS_START_COL(pass);
+   xstep = 1U<<PNG_PASS_COL_SHIFT(pass);
+
+   for (xout=0; xin<w; xin+=xstep)
+   {
+      pixel_copy(buffer, xout, imageRow, xin, pixel_size, littleendian);
+      ++xout;
+   }
+}
+
+#ifdef PNG_READ_SUPPORTED
+static void
+deinterlace_row(png_bytep buffer, png_const_bytep row,
+   unsigned int pixel_size, png_uint_32 w, int pass, int littleendian)
+{
+   /* The inverse of the above, 'row' is part of row 'y' of the output image,
+    * in 'buffer'.  The image is 'w' wide and this is pass 'pass', distribute
+    * the pixels of row into buffer and return the number written (to allow
+    * this to be checked).
+    */
+   png_uint_32 xin, xout, xstep;
+
+   xout = PNG_PASS_START_COL(pass);
+   xstep = 1U<<PNG_PASS_COL_SHIFT(pass);
+
+   for (xin=0; xout<w; xout+=xstep)
+   {
+      pixel_copy(buffer, xout, row, xin, pixel_size, littleendian);
+      ++xin;
+   }
+}
+#endif /* PNG_READ_SUPPORTED */
+
 /* Make a standardized image given an image colour type, bit depth and
 * interlace type.  The standard images have a very restricted range of
 * rows and heights and are used for testing transforms rather than image
@@ -3597,7 +3662,7 @@ make_transform_image(png_store* const ps, png_byte const colour_type,
   {
      png_infop pi;
      png_structp pp = set_store_for_write(ps, &pi, name);
-      png_uint_32 h;
+      png_uint_32 h, w;

      /* In the event of a problem return control to the Catch statement below
       * to do the clean up - it is not possible to 'return' directly from a Try
@@ -3606,10 +3671,10 @@ make_transform_image(png_store* const ps, png_byte const colour_type,
      if (pp == NULL)
         Throw ps;

+      w = transform_width(pp, colour_type, bit_depth);
      h = transform_height(pp, colour_type, bit_depth);

-      png_set_IHDR(pp, pi, transform_width(pp, colour_type, bit_depth), h,
-         bit_depth, colour_type, interlace_type,
+      png_set_IHDR(pp, pi, w, h, bit_depth, colour_type, interlace_type,
         PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);

 #ifdef PNG_TEXT_SUPPORTED
@@ -3671,11 +3736,37 @@ make_transform_image(png_store* const ps, png_byte const colour_type,
         {
            png_uint_32 y;

+            /* do_own_interlace is a pre-defined boolean (a #define) which is
+             * set if we have to work out the interlaced rows here.
+             */
            for (y=0; y<h; ++y)
            {
               png_byte buffer[TRANSFORM_ROWMAX];

               transform_row(pp, buffer, colour_type, bit_depth, y);
+
+#              if do_own_interlace
+                  /* If do_own_interlace *and* the image is interlaced we need a
+                   * reduced interlace row; this may be reduced to empty.
+                   */
+                  if (interlace_type == PNG_INTERLACE_ADAM7)
+                  {
+                     /* The row must not be written if it doesn't exist, notice
+                      * that there are two conditions here, either the row isn't
+                      * ever in the pass or the row would be but isn't wide
+                      * enough to contribute any pixels.  In fact the wPass test
+                      * can be used to skip the whole y loop in this case.
+                      */
+                     if (PNG_ROW_IN_INTERLACE_PASS(y, pass) &&
+                         PNG_PASS_COLS(w, pass) > 0)
+                        interlace_row(buffer, buffer,
+                              bit_size(pp, colour_type, bit_depth), w, pass,
+                              0/*data always bigendian*/);
+                     else
+                        continue;
+                  }
+#              endif /* do_own_interlace */
+
               png_write_row(pp, buffer);
            }
         }
@@ -3745,59 +3836,13 @@ make_transform_images(png_modifier *pm)
         char name[FILE_NAME_SIZE];

         standard_name(name, sizeof name, 0, colour_type, bit_depth,
-            palette_number, interlace_type, 0, 0, 0);
+            palette_number, interlace_type, 0, 0, do_own_interlace);
         make_transform_image(&pm->this, colour_type, bit_depth, palette_number,
            interlace_type, name);
      }
   }
 }

-/* The following two routines use the PNG interlace support macros from
- * png.h to interlace or deinterlace rows.
- */
-static void
-interlace_row(png_bytep buffer, png_const_bytep imageRow,
-   unsigned int pixel_size, png_uint_32 w, int pass)
-{
-   png_uint_32 xin, xout, xstep;
-
-   /* Note that this can, trivially, be optimized to a memcpy on pass 7, the
-    * code is presented this way to make it easier to understand.  In practice
-    * consult the code in the libpng source to see other ways of doing this.
-    */
-   xin = PNG_PASS_START_COL(pass);
-   xstep = 1U<<PNG_PASS_COL_SHIFT(pass);
-
-   for (xout=0; xin<w; xin+=xstep)
-   {
-      pixel_copy(buffer, xout, imageRow, xin, pixel_size);
-      ++xout;
-   }
-}
-
-#ifdef PNG_READ_SUPPORTED
-static void
-deinterlace_row(png_bytep buffer, png_const_bytep row,
-   unsigned int pixel_size, png_uint_32 w, int pass)
-{
-   /* The inverse of the above, 'row' is part of row 'y' of the output image,
-    * in 'buffer'.  The image is 'w' wide and this is pass 'pass', distribute
-    * the pixels of row into buffer and return the number written (to allow
-    * this to be checked).
-    */
-   png_uint_32 xin, xout, xstep;
-
-   xout = PNG_PASS_START_COL(pass);
-   xstep = 1U<<PNG_PASS_COL_SHIFT(pass);
-
-   for (xin=0; xout<w; xout+=xstep)
-   {
-      pixel_copy(buffer, xout, row, xin, pixel_size);
-      ++xin;
-   }
-}
-#endif /* PNG_READ_SUPPORTED */
-
 /* Build a single row for the 'size' test images; this fills in only the
 * first bit_width bits of the sample row.
 */
@@ -3948,7 +3993,8 @@ make_size_image(png_store* const ps, png_byte const colour_type,
                      * set unset things to 0).
                      */
                     memset(tempRow, 0xff, sizeof tempRow);
-                     interlace_row(tempRow, row, pixel_size, w, pass);
+                     interlace_row(tempRow, row, pixel_size, w, pass,
+                           0/*data always bigendian*/);
                     row = tempRow;
                  }
                  else
@@ -4045,7 +4091,7 @@ make_size(png_store* const ps, png_byte const colour_type, int bdlo,
 #        endif
 #        if CAN_WRITE_INTERLACE
            /* 1.7.0 removes the hack that prevented app write of an interlaced
-             * image if WRITE_INTERLACING was not supported
+             * image if WRITE_INTERLACE was not supported
             */
            make_size_image(ps, colour_type, DEPTH(bdlo), PNG_INTERLACE_ADAM7,
               width, height, 1);
@@ -4131,7 +4177,7 @@ static const struct
       { sBIT0_error_fn, "sBIT(0): failed to detect error",
         PNG_LIBPNG_VER < 10700 },

-       { sBIT_error_fn, "sBIT(too big): failed to detect error", 
+       { sBIT_error_fn, "sBIT(too big): failed to detect error",
         PNG_LIBPNG_VER < 10700 },
    };

@@ -4147,14 +4193,18 @@ make_error(png_store* const ps, png_byte const colour_type,
   {
      png_infop pi;
      const png_structp pp = set_store_for_write(ps, &pi, name);
+      png_uint_32 w, h;
      gnu_volatile(pp)

      if (pp == NULL)
         Throw ps;

-      png_set_IHDR(pp, pi, transform_width(pp, colour_type, bit_depth),
-         transform_height(pp, colour_type, bit_depth), bit_depth, colour_type,
-         interlace_type, PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
+      w = transform_width(pp, colour_type, bit_depth);
+      gnu_volatile(w)
+      h = transform_height(pp, colour_type, bit_depth);
+      gnu_volatile(h)
+      png_set_IHDR(pp, pi, w, h, bit_depth, colour_type, interlace_type,
+            PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);

      if (colour_type == 3) /* palette */
         init_standard_palette(ps, pp, pi, 1U << bit_depth, 0/*do tRNS*/);
@@ -4206,7 +4256,6 @@ make_error(png_store* const ps, png_byte const colour_type,

      else
      {
-         png_uint_32 h = transform_height(pp, colour_type, bit_depth);
         int npasses = set_write_interlace_handling(pp, interlace_type);
         int pass;

@@ -4222,6 +4271,29 @@ make_error(png_store* const ps, png_byte const colour_type,
               png_byte buffer[TRANSFORM_ROWMAX];

               transform_row(pp, buffer, colour_type, bit_depth, y);
+
+#              if do_own_interlace
+                  /* If do_own_interlace *and* the image is interlaced we need a
+                   * reduced interlace row; this may be reduced to empty.
+                   */
+                  if (interlace_type == PNG_INTERLACE_ADAM7)
+                  {
+                     /* The row must not be written if it doesn't exist, notice
+                      * that there are two conditions here, either the row isn't
+                      * ever in the pass or the row would be but isn't wide
+                      * enough to contribute any pixels.  In fact the wPass test
+                      * can be used to skip the whole y loop in this case.
+                      */
+                     if (PNG_ROW_IN_INTERLACE_PASS(y, pass) &&
+                         PNG_PASS_COLS(w, pass) > 0)
+                        interlace_row(buffer, buffer,
+                              bit_size(pp, colour_type, bit_depth), w, pass,
+                              0/*data always bigendian*/);
+                     else
+                        continue;
+                  }
+#              endif /* do_own_interlace */
+
               png_write_row(pp, buffer);
            }
         }
@@ -4254,7 +4326,7 @@ make_errors(png_modifier* const pm, png_byte const colour_type,
         char name[FILE_NAME_SIZE];

         standard_name(name, sizeof name, 0, colour_type, 1<<bdlo, 0,
-            interlace_type, 0, 0, 0);
+            interlace_type, 0, 0, do_own_interlace);

         for (test=0; test<ARRAY_SIZE(error_test); ++test)
         {
@@ -4416,6 +4488,7 @@ typedef struct standard_display
   png_uint_32 bit_width;      /* Width of output row in bits */
   size_t      cbRow;          /* Bytes in a row of the output image */
   int         do_interlace;   /* Do interlacing internally */
+   int         littleendian;   /* App (row) data is little endian */
   int         is_transparent; /* Transparency information was present. */
   int         has_tRNS;       /* color type GRAY or RGB with a tRNS chunk. */
   int         speed;          /* Doing a speed test */
@@ -4458,6 +4531,7 @@ standard_display_init(standard_display *dp, png_store* ps, png_uint_32 id,
   dp->bit_width = 0;
   dp->cbRow = 0;
   dp->do_interlace = do_interlace;
+   dp->littleendian = 0;
   dp->is_transparent = 0;
   dp->speed = ps->speed;
   dp->use_update_info = use_update_info;
@@ -4778,8 +4852,19 @@ standard_info_part1(standard_display *dp, png_structp pp, png_infop pi)
    * turning on interlace handling (if do_interlace is not set.)
    */
   dp->npasses = npasses_from_interlace_type(pp, dp->interlace_type);
-   if (!dp->do_interlace && dp->npasses != png_set_interlace_handling(pp))
-      png_error(pp, "validate: file changed interlace type");
+   if (!dp->do_interlace)
+   {
+#     ifdef PNG_READ_INTERLACING_SUPPORTED
+         if (dp->npasses != png_set_interlace_handling(pp))
+            png_error(pp, "validate: file changed interlace type");
+#     else /* !READ_INTERLACING */
+         /* This should never happen: the relevant tests (!do_interlace) should
+          * not be run.
+          */
+         if (dp->npasses > 1)
+            png_error(pp, "validate: no libpng interlace support");
+#     endif /* !READ_INTERLACING */
+   }

   /* Caller calls png_read_update_info or png_start_read_image now, then calls
    * part2.
@@ -4885,7 +4970,7 @@ progressive_row(png_structp ppIn, png_bytep new_row, png_uint_32 y, int pass)

         if (pass != png_get_current_pass_number(pp))
            png_error(pp, "png_get_current_pass_number is broken");
-#endif
+#endif /* USER_TRANSFORM_INFO */

         y = PNG_ROW_FROM_PASS_ROW(y, pass);
      }
@@ -4897,19 +4982,20 @@ progressive_row(png_structp ppIn, png_bytep new_row, png_uint_32 y, int pass)
      row = store_image_row(dp->ps, pp, 0, y);

      /* Combine the new row into the old: */
-#ifdef PNG_READ_DEINTERLACE_SUPPORTED
+#ifdef PNG_READ_INTERLACING_SUPPORTED
      if (dp->do_interlace)
-#endif
+#endif /* READ_INTERLACING */
      {
         if (dp->interlace_type == PNG_INTERLACE_ADAM7)
-            deinterlace_row(row, new_row, dp->pixel_size, dp->w, pass);
+            deinterlace_row(row, new_row, dp->pixel_size, dp->w, pass,
+                  dp->littleendian);
         else
-            row_copy(row, new_row, dp->pixel_size * dp->w);
+            row_copy(row, new_row, dp->pixel_size * dp->w, dp->littleendian);
      }
-#ifdef PNG_READ_DEINTERLACE_SUPPORTED
+#ifdef PNG_READ_INTERLACING_SUPPORTED
      else
         png_progressive_combine_row(pp, row, new_row);
-#endif /* PNG_READ_DEINTERLACE_SUPPORTED */
+#endif /* PNG_READ_INTERLACING_SUPPORTED */
   }

   else if (dp->interlace_type == PNG_INTERLACE_ADAM7 &&
@@ -4962,11 +5048,11 @@ sequential_row(standard_display *dp, png_structp pp, png_infop pi,

               if (iImage >= 0)
                  deinterlace_row(store_image_row(ps, pp, iImage, y), row,
-                     dp->pixel_size, dp->w, pass);
+                     dp->pixel_size, dp->w, pass, dp->littleendian);

               if (iDisplay >= 0)
                  deinterlace_row(store_image_row(ps, pp, iDisplay, y), display,
-                     dp->pixel_size, dp->w, pass);
+                     dp->pixel_size, dp->w, pass, dp->littleendian);
            }
         }
         else
@@ -5130,7 +5216,7 @@ standard_row_validate(standard_display *dp, png_const_structp pp,
         dp->bit_width)) != 0)
   {
      char msg[64];
-      sprintf(msg, "display  row[%lu][%d] changed from %.2x to %.2x",
+      sprintf(msg, "display row[%lu][%d] changed from %.2x to %.2x",
         (unsigned long)y, where-1, std[where-1],
         store_image_row(dp->ps, pp, iDisplay, y)[where-1]);
      png_error(pp, msg);
@@ -5274,7 +5360,7 @@ test_standard(png_modifier* const pm, png_byte const colour_type,
           interlace_type < INTERLACE_LAST; ++interlace_type)
      {
         standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/,
-            interlace_type, 0, 0, 0), 0/*do_interlace*/, pm->use_update_info);
+            interlace_type, 0, 0, 0), do_read_interlace, pm->use_update_info);

         if (fail(pm))
            return 0;
@@ -5380,7 +5466,7 @@ test_size(png_modifier* const pm, png_byte const colour_type,

      for (h=1; h<=16; h+=hinc[bdlo]) for (w=1; w<=16; w+=winc[bdlo])
      {
-#     ifdef PNG_READ_DEINTERLACE_SUPPORTED
+#     ifdef PNG_READ_INTERLACING_SUPPORTED
         /* Test with pngvalid generated interlaced images first; we have
          * already verify these are ok (unless pngvalid has self-consistent
          * read/write errors, which is unlikely), so this detects errors in the
@@ -5394,7 +5480,7 @@ test_size(png_modifier* const pm, png_byte const colour_type,
         if (fail(pm))
            return 0;
 #     endif
-#     endif /* READ_DEINTERLACE */
+#     endif /* READ_INTERLACING */

 #     ifdef PNG_WRITE_INTERLACING_SUPPORTED
         /* Test the libpng write side against the pngvalid read side: */
@@ -5406,7 +5492,7 @@ test_size(png_modifier* const pm, png_byte const colour_type,
            return 0;
 #     endif

-#     ifdef PNG_READ_DEINTERLACE_SUPPORTED
+#     ifdef PNG_READ_INTERLACING_SUPPORTED
 #     ifdef PNG_WRITE_INTERLACING_SUPPORTED
         /* Test both together: */
         standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/,
@@ -5416,7 +5502,7 @@ test_size(png_modifier* const pm, png_byte const colour_type,
         if (fail(pm))
            return 0;
 #     endif
-#     endif /* READ_DEINTERLACE */
+#     endif /* READ_INTERLACING */
      }
   }

@@ -5803,6 +5889,7 @@ typedef struct transform_display
   /* Parameters */
   png_modifier*              pm;
   const image_transform* transform_list;
+   unsigned int max_gamma_8;

   /* Local variables */
   png_byte output_colour_type;
@@ -5979,12 +6066,13 @@ transform_display_init(transform_display *dp, png_modifier *pm, png_uint_32 id,
   memset(dp, 0, sizeof *dp);

   /* Standard fields */
-   standard_display_init(&dp->this, &pm->this, id, 0/*do_interlace*/,
+   standard_display_init(&dp->this, &pm->this, id, do_read_interlace,
      pm->use_update_info);

   /* Parameter fields */
   dp->pm = pm;
   dp->transform_list = transform_list;
+   dp->max_gamma_8 = 16;

   /* Local variable fields */
   dp->output_colour_type = 255; /* invalid */
@@ -6848,6 +6936,10 @@ image_transform_png_set_scale_16_set(const image_transform *this,
    transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_scale_16(pp);
+#  if PNG_LIBPNG_VER < 10700
+      /* libpng will limit the gamma table size: */
+      that->max_gamma_8 = PNG_MAX_GAMMA_8;
+#  endif
   this->next->set(this->next, that, pp, pi);
 }

@@ -6892,6 +6984,10 @@ image_transform_png_set_strip_16_set(const image_transform *this,
    transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_strip_16(pp);
+#  if PNG_LIBPNG_VER < 10700
+      /* libpng will limit the gamma table size: */
+      that->max_gamma_8 = PNG_MAX_GAMMA_8;
+#  endif
   this->next->set(this->next, that, pp, pi);
 }

@@ -7158,14 +7254,15 @@ image_transform_png_set_rgb_to_gray_ini(const image_transform *this,
          *  conversion adds another +/-2 in the 16-bit case and
          *  +/-(1<<(15-PNG_MAX_GAMMA_8)) in the 8-bit case.
          */
-         that->pm->limit += (pow)(
-#           if PNG_MAX_GAMMA_8 < 14
-               (that->this.bit_depth == 16 ? 8. :
-                  6. + (1<<(15-PNG_MAX_GAMMA_8)))
-#           else
-               8.
-#           endif
-               /65535, data.gamma);
+#        if PNG_LIBPNG_VER < 10700
+            if (that->this.bit_depth < 16)
+               that->max_gamma_8 = PNG_MAX_GAMMA_8;
+#        endif
+         that->pm->limit += pow(
+            (that->this.bit_depth == 16 || that->max_gamma_8 > 14 ?
+               8. :
+               6. + (1<<(15-that->max_gamma_8))
+            )/65535, data.gamma);
      }

      else
@@ -7182,7 +7279,7 @@ image_transform_png_set_rgb_to_gray_ini(const image_transform *this,
          * affects the limit used for checking for internal calculation errors,
          * not the actual limit imposed by pngvalid on the output errors.
          */
-         that->pm->limit += (pow)(
+         that->pm->limit += pow(
 #        if DIGITIZE
            1.3
 #        else
@@ -7350,9 +7447,12 @@ image_transform_png_set_rgb_to_gray_mod(const image_transform *this,
         const unsigned int sample_depth = that->sample_depth;
         const unsigned int calc_depth = (pm->assume_16_bit_calculations ? 16 :
            sample_depth);
-         const unsigned int gamma_depth = (sample_depth == 16 ?
-            PNG_MAX_GAMMA_8 :
-            (pm->assume_16_bit_calculations ? PNG_MAX_GAMMA_8 : sample_depth));
+         const unsigned int gamma_depth =
+            (sample_depth == 16 ?
+               display->max_gamma_8 :
+               (pm->assume_16_bit_calculations ?
+                  display->max_gamma_8 :
+                  sample_depth));
         int isgray;
         double r, g, b;
         double rlo, rhi, glo, ghi, blo, bhi, graylo, grayhi;
@@ -7389,7 +7489,7 @@ image_transform_png_set_rgb_to_gray_mod(const image_transform *this,
         b = blo = bhi = that->bluef;
         blo -= that->bluee;
         blo = DD(blo, calc_depth, 1/*round*/);
-         bhi += that->greene;
+         bhi += that->bluee;
         bhi = DU(bhi, calc_depth, 1/*round*/);

         isgray = r==g && g==b;
@@ -7571,7 +7671,7 @@ image_transform_png_set_rgb_to_gray_mod(const image_transform *this,
            const png_modifier *pm = display->pm;
            double in_qe = (that->sample_depth > 8 ? .5/65535 : .5/255);
            double out_qe = (that->sample_depth > 8 ? .5/65535 :
-               (pm->assume_16_bit_calculations ? .5/(1<<PNG_MAX_GAMMA_8) :
+               (pm->assume_16_bit_calculations ? .5/(1<<display->max_gamma_8) :
               .5/255));
            double rhi, ghi, bhi, grayhi;
            double g1 = 1/data.gamma;
@@ -8219,6 +8319,7 @@ image_transform_png_set_packswap_set(const image_transform *this,
    transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_packswap(pp);
+   that->this.littleendian = 1;
   this->next->set(this->next, that, pp, pi);
 }

@@ -8669,7 +8770,7 @@ gamma_display_init(gamma_display *dp, png_modifier *pm, png_uint_32 id,
    double background_gamma)
 {
   /* Standard fields */
-   standard_display_init(&dp->this, &pm->this, id, 0/*do_interlace*/,
+   standard_display_init(&dp->this, &pm->this, id, do_read_interlace,
      pm->use_update_info);

   /* Parameter fields */
@@ -8701,7 +8802,7 @@ gamma_info_imp(gamma_display *dp, png_structp pp, png_infop pi)
   /* If requested strip 16 to 8 bits - this is handled automagically below
    * because the output bit depth is read from the library.  Note that there
    * are interactions with sBIT but, internally, libpng makes sbit at most
-    * PNG_MAX_GAMMA_8 when doing the following.
+    * PNG_MAX_GAMMA_8 prior to 1.7 when doing the following.
    */
   if (dp->scale16)
 #     ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
@@ -10142,7 +10243,11 @@ static void perform_gamma_scale16_tests(png_modifier *pm)
 #  ifndef PNG_MAX_GAMMA_8
 #     define PNG_MAX_GAMMA_8 11
 #  endif
-#  define SBIT_16_TO_8 PNG_MAX_GAMMA_8
+#  if defined PNG_MAX_GAMMA_8 || PNG_LIBPNG_VER < 10700
+#     define SBIT_16_TO_8 PNG_MAX_GAMMA_8
+#  else
+#     define SBIT_16_TO_8 16
+#  endif
   /* Include the alpha cases here. Note that sbit matches the internal value
    * used by the library - otherwise we will get spurious errors from the
    * internal sbit style approximation.
@@ -10960,13 +11065,11 @@ static const color_encoding test_encodings[] =
 /*red:  */ { 0.716500716779386, 0.258728243040113, 0.000000000000000 },
 /*green:*/ { 0.101020574397477, 0.724682314948566, 0.051211818965388 },
 /*blue: */ { 0.146774385252705, 0.016589442011321, 0.773892783545073} },
-#if PNG_LIBPNG_VER >= 10700
 /* Fake encoding which selects just the green channel */
 /*gamma:*/ { 1.45/2.2, /* the 'Mac' gamma */
 /*red:  */ { 0.716500716779386, 0.000000000000000, 0.000000000000000 },
 /*green:*/ { 0.101020574397477, 1.000000000000000, 0.051211818965388 },
 /*blue: */ { 0.146774385252705, 0.000000000000000, 0.773892783545073} },
-#endif
 };

 /* signal handler
@@ -11157,7 +11260,11 @@ int main(int argc, char **argv)
   pm.maxout16 = .499;  /* Error in *encoded* value */
   pm.maxabs16 = .00005;/* 1/20000 */
   pm.maxcalc16 =1./65535;/* +/-1 in 16 bits for compose errors */
-   pm.maxcalcG = 1./((1<<PNG_MAX_GAMMA_8)-1);
+#  if PNG_LIBPNG_VER < 10700
+      pm.maxcalcG = 1./((1<<PNG_MAX_GAMMA_8)-1);
+#  else
+      pm.maxcalcG = 1./((1<<16)-1);
+#  endif

   /* NOTE: this is a reasonable perceptual limit. We assume that humans can
    * perceive light level differences of 1% over a 100:1 range, so we need to
@@ -11323,10 +11430,10 @@ int main(int argc, char **argv)
      {
 #        if CAN_WRITE_INTERLACE
            pm.interlace_type = PNG_INTERLACE_ADAM7;
-#        else
+#        else /* !CAN_WRITE_INTERLACE */
            fprintf(stderr, "pngvalid: no write interlace support\n");
            return SKIP;
-#        endif
+#        endif /* !CAN_WRITE_INTERLACE */
      }

      else if (strcmp(*argv, "--use-input-precision") == 0)
--- a/libpng-manual.txt
+++ b/libpng-manual.txt
@@ -1,6 +1,6 @@
 Libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.5.24rc04 - November 5, 2015
+ libpng version 1.5.26 - December 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2014 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ Libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.5.24rc04 - November 5, 2015
+ libpng versions 0.97, January 1998, through 1.5.26 - December 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2014 Glenn Randers-Pehrson

@@ -2710,8 +2710,7 @@ Some of the more important parts of the png_info are:

 If you call png_set_IHDR(), the call must appear before any of the
 other png_set_*() functions, because they might require access to some of
-the IHDR settings.  The remaining png_set_*() functions can be called
-in any order.
+the IHDR settings.

 If you wish, you can reset the compression_type, interlace_type, or
 filter_method later by calling png_set_IHDR() again; if you do this, the
@@ -2724,6 +2723,12 @@ width, height, bit_depth, and color_type must be the same in each call.
                     (array of png_color)
    num_palette    - number of entries in the palette

+If you call png_set_PLTE(), the call must appear before either of
+png_set_tRNS() or png_set_hIST() appears, because they require access
+to the palette length.
+
+The remaining png_set_*() functions can be called in any order.
+
    png_set_gAMA(png_ptr, info_ptr, file_gamma);
    png_set_gAMA_fixed(png_ptr, info_ptr, int_file_gamma);

@@ -4245,7 +4250,7 @@ a set of "safe" limits is applied in pngpriv.h.  These can be overridden by
 application calls to png_set_user_limits(), png_set_user_chunk_cache_max(),
 and/or png_set_user_malloc_max() that increase or decrease the limits.  Also,
 in libpng-1.5.10 the default width and height limits were increased
-from 1,000,000 to 0x7ffffff (i.e., made unlimited).  Therefore, the
+from 1,000,000 to 0x7fffffff (i.e., made unlimited).  Therefore, the
 limits are now
                               default      safe
   png_user_width_max        0x7fffffff    1,000,000
@@ -4510,7 +4515,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.5.24rc04 are Y2K compliant.  It is my belief that earlier
+upward through 1.5.26 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
--- a/libpng.3
+++ b/libpng.3
@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "November 5, 2015"
+.TH LIBPNG 3 "December 17, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.5.24rc04
+libpng \- Portable Network Graphics (PNG) Reference Library 1.5.26
 .SH SYNOPSIS
 \fB
 #include <png.h>\fP
@@ -496,7 +496,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 Libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.5.24rc04 - November 5, 2015
+ libpng version 1.5.26 - December 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2014 Glenn Randers-Pehrson
@@ -507,7 +507,7 @@ Libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.5.24rc04 - November 5, 2015
+ libpng versions 0.97, January 1998, through 1.5.26 - December 17, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2014 Glenn Randers-Pehrson

@@ -3206,8 +3206,7 @@ Some of the more important parts of the png_info are:

 If you call png_set_IHDR(), the call must appear before any of the
 other png_set_*() functions, because they might require access to some of
-the IHDR settings.  The remaining png_set_*() functions can be called
-in any order.
+the IHDR settings.

 If you wish, you can reset the compression_type, interlace_type, or
 filter_method later by calling png_set_IHDR() again; if you do this, the
@@ -3220,6 +3219,12 @@ width, height, bit_depth, and color_type must be the same in each call.
                     (array of png_color)
    num_palette    - number of entries in the palette

+If you call png_set_PLTE(), the call must appear before either of
+png_set_tRNS() or png_set_hIST() appears, because they require access
+to the palette length.
+
+The remaining png_set_*() functions can be called in any order.
+
    png_set_gAMA(png_ptr, info_ptr, file_gamma);
    png_set_gAMA_fixed(png_ptr, info_ptr, int_file_gamma);

@@ -4741,7 +4746,7 @@ a set of "safe" limits is applied in pngpriv.h.  These can be overridden by
 application calls to png_set_user_limits(), png_set_user_chunk_cache_max(),
 and/or png_set_user_malloc_max() that increase or decrease the limits.  Also,
 in libpng-1.5.10 the default width and height limits were increased
-from 1,000,000 to 0x7ffffff (i.e., made unlimited).  Therefore, the
+from 1,000,000 to 0x7fffffff (i.e., made unlimited).  Therefore, the
 limits are now
                               default      safe
   png_user_width_max        0x7fffffff    1,000,000
@@ -5006,7 +5011,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.5.24rc04 are Y2K compliant.  It is my belief that earlier
+upward through 1.5.26 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -5105,7 +5110,7 @@ the first widely used release:
 ...
 1.2.53                  13    10253  12.so.0.53[.0]
 ...
- 1.5.24                  15    10524  15.so.15.24[.0]
+ 1.5.25                  15    10525  15.so.15.25[.0]

 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -5161,7 +5166,7 @@ possible without all of you.

 Thanks to Frank J. T. Wojcik for helping with the documentation.

-Libpng version 1.5.24rc04 - November 5, 2015:
+Libpng version 1.5.26 - December 17, 2015:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).

@@ -5186,7 +5191,7 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.0.7, July 1, 2000, through 1.5.24rc04, November 5, 2015, are
+libpng versions 1.0.7, July 1, 2000, through 1.5.26, December 17, 2015, are
 Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -5284,7 +5289,7 @@ the additional disclaimers inserted at version 1.0.7.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 5, 2015
+December 17, 2015

 .\" end of man page

--- a/libpngpf.3
+++ b/libpngpf.3
@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "November 5, 2015"
+.TH LIBPNGPF 3 "December 17, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.5.24rc04
+libpng \- Portable Network Graphics (PNG) Reference Library 1.5.26
 (private functions)
 .SH SYNOPSIS
 \fB#include \fI"pngpriv.h"
--- a/png.5
+++ b/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "November 5, 2015"
+.TH PNG 5 "December 17, 2015"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
--- a/png.c
+++ b/png.c
@@ -2,7 +2,7 @@
 /* png.c - location for general purpose libpng functions
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -14,7 +14,7 @@
 #include "pngpriv.h"

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_24rc04 Your_png_h_is_not_version_1_5_24rc04;
+typedef png_libpng_version_1_5_26 Your_png_h_is_not_version_1_5_26;

 /* Tells libpng that we have already handled the first "num_bytes" bytes
 * of the PNG file signature.  If the PNG data is embedded into another
@@ -655,14 +655,15 @@ png_get_copyright(png_const_structp png_ptr)
 #else
 #  ifdef __STDC__
   return PNG_STRING_NEWLINE \
-     "libpng version 1.5.24rc04 - November 5, 2015" PNG_STRING_NEWLINE \
-     "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
+     "libpng version 1.5.26 - December 17, 2015" PNG_STRING_NEWLINE \
+     "Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson" \
+     PNG_STRING_NEWLINE \
     "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
     "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
     PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.5.24rc04 - November 5, 2015\
-      Copyright (c) 1998-2015 Glenn Randers-Pehrson\
+      return "libpng version 1.5.26 - December 17, 2015\
+      Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson\
      Copyright (c) 1996-1997 Andreas Dilger\
      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
 #  endif
--- a/png.h
+++ b/png.h
@@ -1,9 +1,9 @@

 /* png.h - header file for PNG reference library
 *
- * libpng version 1.5.24rc04, November 5, 2015
+ * libpng version 1.5.26, December 17, 2015
 *
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -12,7 +12,8 @@
 * Authors and maintainers:
 *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
 *   libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.5.24rc04, November 5, 2015: Glenn
+ *   libpng versions 0.97, January 1998, through 1.5.26, December 17, 2015:
+ *     Glenn Randers-Pehrson.
 *   See also "Contributing Authors", below.
 */

@@ -24,7 +25,7 @@
 *
 * This code is released under the libpng license.
 *
- * libpng versions 1.0.7, July 1, 2000, through 1.5.24rc04, November 5, 2015, are
+ * libpng versions 1.0.7, July 1, 2000, through 1.5.26, December 17, 2015, are
 * Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
 * derived from libpng-1.0.6, and are distributed according to the same
 * disclaimer and license as libpng-1.0.6 with the following individuals
@@ -182,7 +183,7 @@
 *    ...
 *    1.2.53                  13    10253  12.so.0.53[.0]
 *    ...
- *    1.5.24                  15    10524  15.so.15.24[.0]
+ *    1.5.25                  15    10525  15.so.15.25[.0]
 *
 *    Henceforth the source version will match the shared-library major
 *    and minor numbers; the shared-library major version number will be
@@ -210,13 +211,13 @@
 * Y2K compliance in libpng:
 * =========================
 *
- *    November 5, 2015
+ *    December 17, 2015
 *
 *    Since the PNG Development group is an ad-hoc body, we can't make
 *    an official declaration.
 *
 *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.5.24rc04 are Y2K compliant.  It is my belief that
+ *    upward through 1.5.26 are Y2K compliant.  It is my belief that
 *    earlier versions were also Y2K compliant.
 *
 *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -277,9 +278,9 @@
 */

 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.5.24rc04"
+#define PNG_LIBPNG_VER_STRING "1.5.26"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.5.24rc04 - November 5, 2015\n"
+     " libpng version 1.5.26 - December 17, 2015\n"

 #define PNG_LIBPNG_VER_SONUM   15
 #define PNG_LIBPNG_VER_DLLNUM  15
@@ -287,13 +288,13 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   5
-#define PNG_LIBPNG_VER_RELEASE 24
+#define PNG_LIBPNG_VER_RELEASE 26

 /* This should match the numeric part of the final component of
 * PNG_LIBPNG_VER_STRING, omitting any leading zero:
 */

-#define PNG_LIBPNG_VER_BUILD  04
+#define PNG_LIBPNG_VER_BUILD  0

 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -310,7 +311,7 @@
 #define PNG_LIBPNG_BUILD_SPECIAL 32 /* Cannot be OR'ed with
                                       PNG_LIBPNG_BUILD_PRIVATE */

-#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_RC
+#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE

 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
 * We must not include leading zeros.
@@ -318,7 +319,7 @@
 * version 1.0.0 was mis-numbered 100 instead of 10000).  From
 * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
 */
-#define PNG_LIBPNG_VER 10524 /* 1.5.24 */
+#define PNG_LIBPNG_VER 10526 /* 1.5.26 */

 /* Library configuration: these options cannot be changed after
 * the library has been built.
@@ -440,7 +441,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
 * do not agree upon the version number.
 */
-typedef char* png_libpng_version_1_5_24rc04;
+typedef char* png_libpng_version_1_5_26;

 /* Three color definitions.  The order of the red, green, and blue, (and the
 * exact size) is not important, although the size of the fields need to
--- a/pngconf.h
+++ b/pngconf.h
@@ -1,9 +1,9 @@

 /* pngconf.h - machine configurable file for libpng
 *
- * libpng version 1.5.24rc04, November 5, 2015
+ * libpng version 1.5.26, December 17, 2015
 *
- * Copyright (c) 1998-2013 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2013 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngdebug.h
+++ b/pngdebug.h
@@ -2,7 +2,7 @@
 /* pngdebug.h - Debugging macros for libpng, also used in pngtest.c
 *
 * Last changed in libpng 1.5.18 [February 6, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngerror.c
+++ b/pngerror.c
@@ -2,7 +2,7 @@
 /* pngerror.c - stub functions for i/o and memory allocation
 *
 * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngget.c
+++ b/pngget.c
@@ -2,7 +2,7 @@
 /* pngget.c - retrieval of values from info struct
 *
 * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pnginfo.h
+++ b/pnginfo.h
@@ -2,7 +2,7 @@
 /* pnginfo.h - header file for PNG reference library
 *
 * Last changed in libpng 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2011 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngmem.c
+++ b/pngmem.c
@@ -2,7 +2,7 @@
 /* pngmem.c - stub functions for memory allocation
 *
 * Last changed in libpng 1.5.13 [September 27, 2012]
- * Copyright (c) 1998-2012 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2012 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngpread.c
+++ b/pngpread.c
@@ -2,7 +2,7 @@
 /* pngpread.c - read a png file in push mode
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -127,7 +127,7 @@ png_process_some_data(png_structp png_ptr, png_infop info_ptr)
 void /* PRIVATE */
 png_push_read_sig(png_structp png_ptr, png_infop info_ptr)
 {
-   png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ 
+   png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */
       num_to_check = 8 - num_checked;

   if (png_ptr->buffer_size < num_to_check)
--- a/pngpriv.h
+++ b/pngpriv.h
@@ -1,8 +1,8 @@

 /* pngpriv.h - private declarations for use inside libpng
 *
- * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.26 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -901,13 +901,6 @@ PNG_EXTERN void png_write_hIST PNGARG((png_structp png_ptr,
    png_const_uint_16p hist, int num_hist));
 #endif

-/* Chunks that have keywords */
-#if defined(PNG_WRITE_TEXT_SUPPORTED) || defined(PNG_WRITE_pCAL_SUPPORTED) || \
-    defined(PNG_WRITE_iCCP_SUPPORTED) || defined(PNG_WRITE_sPLT_SUPPORTED)
-PNG_EXTERN png_size_t png_check_keyword PNGARG((png_structp png_ptr,
-    png_const_charp key, png_charpp new_key));
-#endif
-
 #ifdef PNG_WRITE_tEXt_SUPPORTED
 PNG_EXTERN void png_write_tEXt PNGARG((png_structp png_ptr, png_const_charp key,
    png_const_charp text, png_size_t text_len));
--- a/pngread.c
+++ b/pngread.c
@@ -2,7 +2,7 @@
 /* pngread.c - read a PNG file
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngrio.c
+++ b/pngrio.c
@@ -2,7 +2,7 @@
 /* pngrio.c - functions for data input
 *
 * Last changed in libpng 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2011 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -1,8 +1,8 @@

 /* pngrtran.c - transforms the data in a row for PNG readers
 *
- * Last changed in libpng 1.5.24 [(PENDING RELEASE)]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.24 [November 12, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,8 +1,8 @@

 /* pngrutil.c - utilities to read a PNG file
 *
- * Last changed in libpng 1.5.24 [(PENDING RELEASE)]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.25 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -667,16 +667,18 @@ png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */
   num = (int)length / 3;

-   /* If the palette has 256 or fewer entries but is too large for the bit depth,
-    * we don't issue an error, to preserve the behavior of previous libpng versions.
-    * We silently truncate the unused extra palette entries here.
+   /* If the palette has 256 or fewer entries but is too large for the bit
+    * depth, we don't issue an error, to preserve the behavior of previous
+    * libpng versions. We silently truncate the unused extra palette entries
+    * here.
    */
-
-   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
-      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
+   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
+      max_palette_length = (1 << png_ptr->bit_depth);
+   else
+      max_palette_length = PNG_MAX_PALETTE_LENGTH;

   if (num > max_palette_length)
-     num = max_palette_length;
+      num = max_palette_length;

 #ifdef PNG_POINTER_INDEXING_SUPPORTED
   for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
@@ -1325,7 +1327,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   /* There should be at least one zero (the compression type byte)
    * following the separator, and we should be on it
    */
-   if (profile >= png_ptr->chunkdata + slength - 1)
+   if (slength < 1U || profile >= png_ptr->chunkdata + slength - 1U)
   {
      png_free(png_ptr, png_ptr->chunkdata);
      png_ptr->chunkdata = NULL;
@@ -1474,7 +1476,8 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   ++entry_start;

   /* A sample depth should follow the separator, and we should be on it  */
-   if (entry_start > (png_bytep)png_ptr->chunkdata + slength - 2)
+   if (slength < 2U ||
+       entry_start > (png_bytep)png_ptr->chunkdata + slength - 2U)
   {
      png_free(png_ptr, png_ptr->chunkdata);
      png_ptr->chunkdata = NULL;
@@ -2003,7 +2006,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
   /* We need to have at least 12 bytes after the purpose string
    * in order to get the parameter information.
    */
-   if (endptr <= buf + 12)
+   if (endptr - buf <= 12)
   {
      png_warning(png_ptr, "Invalid pCAL data");
      png_free(png_ptr, png_ptr->chunkdata);
@@ -2415,7 +2418,7 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
      /* Empty loop */ ;

   /* zTXt must have some text after the chunkdataword */
-   if (text >= png_ptr->chunkdata + slength - 2)
+   if (slength < 2U || text >= png_ptr->chunkdata + slength - 2U)
   {
      png_warning(png_ptr, "Truncated zTXt chunk");
      png_free(png_ptr, png_ptr->chunkdata);
@@ -2552,7 +2555,7 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    * keyword
    */

-   if (lang >= png_ptr->chunkdata + slength - 3)
+   if (slength < 3U || lang >= png_ptr->chunkdata + slength - 3U)
   {
      png_warning(png_ptr, "Truncated iTXt chunk");
      png_free(png_ptr, png_ptr->chunkdata);
--- a/pngset.c
+++ b/pngset.c
@@ -1,8 +1,8 @@

 /* pngset.c - storage of image information into info struct
 *
- * Last changed in libpng 1.5.24 [(PENDING RELEASE)]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.26 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -20,6 +20,60 @@

 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

+#if defined(PNG_TEXT_SUPPORTED) || defined(PNG_pCAL_SUPPORTED) ||\
+    defined(PNG_iCCP_SUPPORTED) || defined(PNG_sPLT_SUPPORTED)
+/* Check that the tEXt or zTXt keyword is valid per PNG 1.0 specification,
+ * and if invalid, correct the keyword rather than discarding the entire
+ * chunk.  The PNG 1.0 specification requires keywords 1-79 characters in
+ * length, forbids leading or trailing whitespace, multiple internal spaces,
+ * and the non-break space (0x80) from ISO 8859-1.  Returns keyword length.
+ *
+ * The 'new_key' buffer must be 80 characters in size (for the keyword plus a
+ * trailing '\0').  If this routine returns 0 then there was no keyword, or a
+ * valid one could not be generated, and the caller must handle the error by not
+ * setting the keyword.
+ */
+static png_uint_32
+png_check_keyword(png_const_charp key, png_bytep new_key)
+{
+   png_uint_32 key_len = 0;
+   int space = 1;
+
+   if (key == NULL)
+   {
+      *new_key = 0;
+      return 0;
+   }
+
+   while (*key && key_len < 79)
+   {
+      png_byte ch = (png_byte)*key++;
+
+      if ((ch > 32 && ch <= 126) || (ch >= 161 /*&& ch <= 255*/))
+         *new_key++ = ch, ++key_len, space = 0;
+
+      else if (space == 0)
+      {
+         /* A space or an invalid character when one wasn't seen immediately
+          * before; output just a space.
+          */
+         *new_key++ = 32, ++key_len, space = 1;
+      }
+   }
+
+   if (key_len > 0 && space != 0) /* trailing space */
+      --key_len, --new_key;
+
+   /* Terminate the keyword */
+   *new_key = 0;
+
+   if (key_len == 0)
+      return 0;
+
+   return key_len;
+}
+#endif /* TEXT || pCAL || iCCP || sPLT */
+
 #ifdef PNG_bKGD_SUPPORTED
 void PNGAPI
 png_set_bKGD(png_structp png_ptr, png_infop info_ptr,
@@ -278,6 +332,7 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
    png_const_charp purpose, png_int_32 X0, png_int_32 X1, int type,
    int nparams, png_const_charp units, png_charpp params)
 {
+   png_byte new_purpose[80];
   png_size_t length;
   int i;

@@ -286,7 +341,15 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
   if (png_ptr == NULL || info_ptr == NULL)
      return;

-   length = png_strlen(purpose) + 1;
+   length = png_check_keyword(purpose, new_purpose);
+
+   if (length == 0)
+   {
+      png_warning(png_ptr, "pCAL: invalid purpose keyword");
+      return;
+   }
+      
+   ++length;
   png_debug1(3, "allocating purpose for info (%lu bytes)",
       (unsigned long)length);

@@ -309,7 +372,7 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
      return;
   }

-   png_memcpy(info_ptr->pcal_purpose, purpose, length);
+   png_memcpy(info_ptr->pcal_purpose, new_purpose, length);

   png_debug(3, "storing X0, X1, type, and nparams in info");
   info_ptr->pcal_X0 = X0;
@@ -515,8 +578,8 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
   if (png_ptr == NULL || info_ptr == NULL)
      return;

-   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
-      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
+   max_palette_length = (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
+      (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;

   if (num_palette < 0 || num_palette > (int) max_palette_length)
   {
@@ -614,6 +677,7 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
    png_const_charp name, int compression_type,
    png_const_bytep profile, png_uint_32 proflen)
 {
+   png_byte new_name[80];
   png_charp new_iccp_name;
   png_bytep new_iccp_profile;
   png_size_t length;
@@ -623,7 +687,15 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
   if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL)
      return;

-   length = png_strlen(name)+1;
+   length = png_check_keyword(name, new_name);
+
+   if (length == 0)
+   {
+      png_warning(png_ptr, "iCCP: invalid keyword");
+      return;
+   }
+      
+   ++length;
   new_iccp_name = (png_charp)png_malloc_warn(png_ptr, length);

   if (new_iccp_name == NULL)
@@ -632,7 +704,7 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
      return;
   }

-   png_memcpy(new_iccp_name, name, length);
+   png_memcpy(new_iccp_name, new_name, length);
   new_iccp_profile = (png_bytep)png_malloc_warn(png_ptr, proflen);

   if (new_iccp_profile == NULL)
@@ -748,6 +820,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
   }
   for (i = 0; i < num_text; i++)
   {
+      png_byte new_key[80], new_lang[80];
      png_size_t text_length, key_len;
      png_size_t lang_len, lang_key_len;
      png_textp textp = &(info_ptr->text[info_ptr->num_text]);
@@ -762,7 +835,13 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
         continue;
      }

-      key_len = png_strlen(text_ptr[i].key);
+      key_len = png_check_keyword(text_ptr[i].key, new_key);
+
+      if (key_len == 0)
+      {
+         png_warning(png_ptr, "invalid text keyword");
+         continue;
+      }

      if (text_ptr[i].compression <= 0)
      {
@@ -775,8 +854,9 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
      {
         /* Set iTXt data */

+        /* Zero length language is OK */
         if (text_ptr[i].lang != NULL)
-            lang_len = png_strlen(text_ptr[i].lang);
+            lang_len = png_check_keyword(text_ptr[i].lang, new_lang);

         else
            lang_len = 0;
@@ -824,7 +904,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
          (key_len + lang_len + lang_key_len + text_length + 4),
          textp->key);

-      png_memcpy(textp->key, text_ptr[i].key,(png_size_t)(key_len));
+      png_memcpy(textp->key, new_key, (png_size_t)(key_len));
      *(textp->key + key_len) = '\0';

      if (text_ptr[i].compression > 0)
@@ -976,7 +1056,7 @@ png_set_sPLT(png_structp png_ptr,
 */
 {
   png_sPLT_tp np;
-   int i;
+   int i, j;
   size_t element_size;

   if (png_ptr == NULL || info_ptr == NULL)
@@ -1008,13 +1088,22 @@ png_set_sPLT(png_structp png_ptr,
   png_free(png_ptr, info_ptr->splt_palettes);
   info_ptr->splt_palettes=NULL;

-   for (i = 0; i < nentries; i++)
+   for (i = j = 0; i < nentries; i++)
   {
-      png_sPLT_tp to = np + info_ptr->splt_palettes_num + i;
+      png_sPLT_tp to = np + info_ptr->splt_palettes_num + j;
      png_const_sPLT_tp from = entries + i;
+      png_byte new_name[80];
      png_size_t length;

-      length = png_strlen(from->name) + 1;
+      length = png_check_keyword(from->name, new_name);
+
+      if (length == 0)
+      {
+         png_warning(png_ptr, "sPLT: invalid keyword");
+         continue;
+      }
+
+      ++length; /* for trailing '\0' */
      to->name = (png_charp)png_malloc_warn(png_ptr, length);

      if (to->name == NULL)
@@ -1024,7 +1113,7 @@ png_set_sPLT(png_structp png_ptr,
         continue;
      }

-      png_memcpy(to->name, from->name, length);
+      png_memcpy(to->name, new_name, length);
      to->entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
          from->nentries * png_sizeof(png_sPLT_entry));

@@ -1042,10 +1131,11 @@ png_set_sPLT(png_structp png_ptr,

      to->nentries = from->nentries;
      to->depth = from->depth;
+      ++j;
   }

   info_ptr->splt_palettes = np;
-   info_ptr->splt_palettes_num += nentries;
+   info_ptr->splt_palettes_num = j;
   info_ptr->valid |= PNG_INFO_sPLT;
   info_ptr->free_me |= PNG_FREE_SPLT;
 }
@@ -1289,7 +1379,7 @@ png_set_user_limits (png_structp png_ptr, png_uint_32 user_width_max,
 {
   /* Images with dimensions larger than these limits will be
    * rejected by png_set_IHDR().  To accept any PNG datastream
-    * regardless of dimensions, set both limits to 0x7ffffffL.
+    * regardless of dimensions, set both limits to 0x7fffffffL.
    */
   if (png_ptr == NULL)
      return;
@@ -1348,5 +1438,4 @@ png_set_check_for_invalid_index(png_structp png_ptr, int allowed)
      png_ptr->num_palette_max = -1;
 }
 #endif
-
 #endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */
--- a/pngstruct.h
+++ b/pngstruct.h
@@ -2,7 +2,7 @@
 /* pngstruct.h - header file for PNG reference library
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngtest.c
+++ b/pngtest.c
@@ -1,7 +1,8 @@
+
 /* pngtest.c - a simple test program to test libpng
 *
- * Last changed in libpng 1.5.22 [March 26, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.25 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -59,12 +60,12 @@
   defined PNG_READ_pHYs_SUPPORTED &&\
   defined PNG_READ_sBIT_SUPPORTED &&\
   defined PNG_READ_sCAL_SUPPORTED &&\
-   defined PNG_READ_sPLT_SUPPORTED &&\
   defined PNG_READ_sRGB_SUPPORTED &&\
+   defined PNG_READ_sPLT_SUPPORTED &&\
   defined PNG_READ_tEXt_SUPPORTED &&\
   defined PNG_READ_tIME_SUPPORTED &&\
   defined PNG_READ_zTXt_SUPPORTED &&\
-   defined PNG_WRITE_INTERLACING_SUPPORTED
+   (defined PNG_WRITE_INTERLACING_SUPPORTED || PNG_LIBPNG_VER >= 10700)

 #ifdef PNG_ZLIB_HEADER
 #  include PNG_ZLIB_HEADER /* defined by pnglibconf.h from 1.7 */
@@ -101,6 +102,10 @@ typedef FILE                * png_FILE_p;
 #  define SINGLE_ROWBUF_ALLOC  /* Makes buffer overruns easier to nail */
 #endif

+#ifndef PNG_UNUSED
+#  define PNG_UNUSED(param) (void)param;
+#endif
+
 /* Turn on CPU timing
 #define PNGTEST_TIMING
 */
@@ -118,6 +123,22 @@ static float t_start, t_stop, t_decode, t_encode, t_misc;
 #define PNG_tIME_STRING_LENGTH 29
 static int tIME_chunk_present = 0;
 static char tIME_string[PNG_tIME_STRING_LENGTH] = "tIME chunk is not present";
+
+#if PNG_LIBPNG_VER < 10619
+#define png_convert_to_rfc1123_buffer(ts, t) tIME_to_str(read_ptr, ts, t)
+
+static int
+tIME_to_str(png_structp png_ptr, png_charp ts, png_const_timep t)
+{
+    png_const_charp str = png_convert_to_rfc1123(png_ptr, t);
+
+    if (str == NULL)
+        return 0;
+
+    strcpy(ts, str);
+    return 1;
+}
+#endif /* older libpng */
 #endif

 static int verbose = 0;
@@ -185,16 +206,14 @@ write_row_callback(png_structp png_ptr, png_uint_32 row_number, int pass)


 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-/* Example of using user transform callback (we don't transform anything,
- * but merely examine the row filters.  We set this to 256 rather than
- * 5 in case illegal filter values are present.)
+/* Example of using a user transform callback (doesn't do anything at present).
 */
-static png_uint_32 filters_used[256];
 static void PNGCBAPI
-count_filters(png_structp png_ptr, png_row_infop row_info, png_bytep data)
+read_user_callback(png_structp png_ptr, png_row_infop row_info, png_bytep data)
 {
-   if (png_ptr != NULL && row_info != NULL)
-      ++filters_used[*(data - 1)];
+   PNG_UNUSED(png_ptr)
+   PNG_UNUSED(row_info)
+   PNG_UNUSED(data)
 }
 #endif

@@ -805,6 +824,8 @@ pngtest_check_text_support(png_structp png_ptr, png_textp text_ptr,
         case PNG_TEXT_COMPRESSION_zTXt:
 #           ifndef PNG_WRITE_zTXt_SUPPORTED
               ++unsupported_chunks;
+               /* In libpng 1.7 this now does an app-error, so stop it: */
+               text_ptr[num_text].compression = PNG_TEXT_COMPRESSION_NONE;
 #           endif
            break;

@@ -812,6 +833,7 @@ pngtest_check_text_support(png_structp png_ptr, png_textp text_ptr,
         case PNG_ITXT_COMPRESSION_zTXt:
 #           ifndef PNG_WRITE_iTXt_SUPPORTED
               ++unsupported_chunks;
+               text_ptr[num_text].compression = PNG_TEXT_COMPRESSION_NONE;
 #           endif
            break;

@@ -838,16 +860,19 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   png_structp write_ptr;
   png_infop write_info_ptr;
   png_infop write_end_info_ptr;
+#ifdef PNG_WRITE_FILTER_SUPPORTED
   int interlace_preserved = 1;
-#else
+#endif /* WRITE_FILTER */
+#else /* !WRITE */
   png_structp write_ptr = NULL;
   png_infop write_info_ptr = NULL;
   png_infop write_end_info_ptr = NULL;
-#endif
+#endif /* !WRITE */
   png_bytep row_buf;
   png_uint_32 y;
   png_uint_32 width, height;
-   int num_pass = 1, pass;
+   volatile int num_passes;
+   int pass;
   int bit_depth, color_type;

   row_buf = NULL;
@@ -1000,14 +1025,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   }

 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-   {
-      int i;
-
-      for (i = 0; i<256; i++)
-         filters_used[i] = 0;
-
-      png_set_read_user_transform_fn(read_ptr, count_filters);
-   }
+   png_set_read_user_transform_fn(read_ptr, read_user_callback);
 #endif
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
   zero_samples = 0;
@@ -1054,29 +1072,28 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      {
         png_set_IHDR(write_ptr, write_info_ptr, width, height, bit_depth,
            color_type, interlace_type, compression_type, filter_type);
-#ifndef PNG_READ_INTERLACING_SUPPORTED
-         /* num_pass will not be set below, set it here if the image is
-          * interlaced: what happens is that write interlacing is *not* turned
-          * on and the partial interlaced rows are written directly.
+         /* num_passes may not be available below if interlace support is not
+          * provided by libpng for both read and write.
          */
         switch (interlace_type)
         {
            case PNG_INTERLACE_NONE:
-               num_pass = 1;
+               num_passes = 1;
               break;

            case PNG_INTERLACE_ADAM7:
-               num_pass = 7;
-                break;
+               num_passes = 7;
+               break;

            default:
-                png_error(read_ptr, "invalid interlace type");
-                /*NOT REACHED*/
+               png_error(read_ptr, "invalid interlace type");
+               /*NOT REACHED*/
         }
-#endif
      }
-   }

+      else
+         png_error(read_ptr, "png_get_IHDR failed");
+   }
 #ifdef PNG_FIXED_POINT_SUPPORTED
 #ifdef PNG_cHRM_SUPPORTED
   {
@@ -1091,7 +1108,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_gAMA_SUPPORTED
   {
      png_fixed_point gamma;
@@ -1100,7 +1116,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_gAMA_fixed(write_ptr, write_info_ptr, gamma);
   }
 #endif
-
 #else /* Use floating point versions */
 #ifdef PNG_FLOATING_POINT_SUPPORTED
 #ifdef PNG_cHRM_SUPPORTED
@@ -1116,7 +1131,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_gAMA_SUPPORTED
   {
      double gamma;
@@ -1127,7 +1141,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif
 #endif /* Floating point */
 #endif /* Fixed point */
-
 #ifdef PNG_iCCP_SUPPORTED
   {
      png_charp name;
@@ -1143,7 +1156,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_sRGB_SUPPORTED
   {
      int intent;
@@ -1152,7 +1164,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_sRGB(write_ptr, write_info_ptr, intent);
   }
 #endif
-
   {
      png_colorp palette;
      int num_palette;
@@ -1160,7 +1171,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      if (png_get_PLTE(read_ptr, read_info_ptr, &palette, &num_palette) != 0)
         png_set_PLTE(write_ptr, write_info_ptr, palette, num_palette);
   }
-
 #ifdef PNG_bKGD_SUPPORTED
   {
      png_color_16p background;
@@ -1171,7 +1181,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_hIST_SUPPORTED
   {
      png_uint_16p hist;
@@ -1180,7 +1189,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_hIST(write_ptr, write_info_ptr, hist);
   }
 #endif
-
 #ifdef PNG_oFFs_SUPPORTED
   {
      png_int_32 offset_x, offset_y;
@@ -1193,7 +1201,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_pCAL_SUPPORTED
   {
      png_charp purpose, units;
@@ -1209,7 +1216,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_pHYs_SUPPORTED
   {
      png_uint_32 res_x, res_y;
@@ -1220,7 +1226,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_pHYs(write_ptr, write_info_ptr, res_x, res_y, unit_type);
   }
 #endif
-
 #ifdef PNG_sBIT_SUPPORTED
   {
      png_color_8p sig_bit;
@@ -1229,7 +1234,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_sBIT(write_ptr, write_info_ptr, sig_bit);
   }
 #endif
-
 #ifdef PNG_sCAL_SUPPORTED
 #if defined(PNG_FLOATING_POINT_SUPPORTED) && \
   defined(PNG_FLOATING_ARITHMETIC_SUPPORTED)
@@ -1258,7 +1262,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   }
 #endif
 #endif
-#endif /* sCAL */
+#endif

 #ifdef PNG_sPLT_SUPPORTED
   {
@@ -1270,7 +1274,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
           png_set_sPLT(write_ptr, write_info_ptr, entries, num_entries);
       }
   }
-#endif /* sPLT */
+#endif

 #ifdef PNG_TEXT_SUPPORTED
   {
@@ -1299,7 +1303,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_tIME_SUPPORTED
   {
      png_timep mod_time;
@@ -1308,21 +1311,20 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      {
         png_set_tIME(write_ptr, write_info_ptr, mod_time);
 #ifdef PNG_TIME_RFC1123_SUPPORTED
-         /* We have to use memcpy instead of "=" because the string
-          * pointed to by png_convert_to_rfc1123() gets free'ed before
-          * we use it.
-          */
-         memcpy(tIME_string,
-                png_convert_to_rfc1123(read_ptr, mod_time),
-                png_sizeof(tIME_string));
+         if (png_convert_to_rfc1123_buffer(tIME_string, mod_time) != 0)
+            tIME_string[(sizeof tIME_string) - 1] = '\0';
+
+         else
+         {
+            strncpy(tIME_string, "*** invalid time ***", (sizeof tIME_string));
+            tIME_string[(sizeof tIME_string) - 1] = '\0';
+         }

-         tIME_string[png_sizeof(tIME_string) - 1] = '\0';
         tIME_chunk_present++;
 #endif /* TIME_RFC1123 */
      }
   }
 #endif
-
 #ifdef PNG_tRNS_SUPPORTED
   {
      png_bytep trans_alpha;
@@ -1345,7 +1347,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED
   {
      png_unknown_chunkp unknowns;
@@ -1396,21 +1397,49 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif /* SINGLE_ROWBUF_ALLOC */
   pngtest_debug("Writing row data");

-#ifdef PNG_READ_INTERLACING_SUPPORTED
-   num_pass = png_set_interlace_handling(read_ptr);
-   if (png_set_interlace_handling(write_ptr) != num_pass)
-      png_error(write_ptr, "png_set_interlace_handling: inconsistent num_pass");
-#endif
+#if defined(PNG_READ_INTERLACING_SUPPORTED) &&\
+   defined(PNG_WRITE_INTERLACING_SUPPORTED)
+   /* Both must be defined for libpng to be able to handle the interlace,
+    * otherwise it gets handled below by simply reading and writing the passes
+    * directly.
+    */
+   if (png_set_interlace_handling(read_ptr) != num_passes)
+      png_error(write_ptr,
+            "png_set_interlace_handling(read): wrong pass count ");
+   if (png_set_interlace_handling(write_ptr) != num_passes)
+      png_error(write_ptr,
+            "png_set_interlace_handling(write): wrong pass count ");
+#else /* png_set_interlace_handling not called on either read or write */
+#  define calc_pass_height
+#endif /* not using libpng interlace handling */

 #ifdef PNGTEST_TIMING
   t_stop = (float)clock();
   t_misc += (t_stop - t_start);
   t_start = t_stop;
 #endif
-   for (pass = 0; pass < num_pass; pass++)
+   for (pass = 0; pass < num_passes; pass++)
   {
+#     ifdef calc_pass_height
+         png_uint_32 pass_height;
+
+         if (num_passes == 7) /* interlaced */
+         {
+            if (PNG_PASS_COLS(width, pass) > 0)
+               pass_height = PNG_PASS_ROWS(height, pass);
+
+            else
+               pass_height = 0;
+         }
+
+         else /* not interlaced */
+            pass_height = height;
+#     else
+#        define pass_height height
+#     endif
+
      pngtest_debug1("Writing row data for pass %d", pass);
-      for (y = 0; y < height; y++)
+      for (y = 0; y < pass_height; y++)
      {
 #ifndef SINGLE_ROWBUF_ALLOC
         pngtest_debug2("Allocating row buffer (pass %d, y = %u)...", pass, y);
@@ -1493,15 +1522,15 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      {
         png_set_tIME(write_ptr, write_end_info_ptr, mod_time);
 #ifdef PNG_TIME_RFC1123_SUPPORTED
-         /* We have to use memcpy instead of "=" because the string
-          * pointed to by png_convert_to_rfc1123() gets free'ed before
-          * we use it.
-          */
-         memcpy(tIME_string,
-                png_convert_to_rfc1123(read_ptr, mod_time),
-                png_sizeof(tIME_string));
+         if (png_convert_to_rfc1123_buffer(tIME_string, mod_time) != 0)
+            tIME_string[(sizeof tIME_string) - 1] = '\0';
+
+         else
+         {
+            strncpy(tIME_string, "*** invalid time ***", sizeof tIME_string);
+            tIME_string[(sizeof tIME_string)-1] = '\0';
+         }

-         tIME_string[png_sizeof(tIME_string) - 1] = '\0';
         tIME_chunk_present++;
 #endif /* TIME_RFC1123 */
      }
@@ -1600,7 +1629,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   }

 #  ifdef PNG_WRITE_SUPPORTED
-      /* If there we no write support nothing was written! */
+      /* If there is no write support nothing was written! */
      else if (unsupported_chunks > 0)
      {
         fprintf(STDERR, "\n  %s: unsupported chunks (%d)%s",
@@ -1631,7 +1660,8 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      return (1);
   }

-#ifdef PNG_WRITE_SUPPORTED /* else nothing was written */
+#if defined (PNG_WRITE_SUPPORTED) /* else nothing was written */ &&\
+    defined (PNG_WRITE_FILTER_SUPPORTED)
   if (interlace_preserved != 0) /* else the files will be changed */
   {
      for (;;)
@@ -1708,7 +1738,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         }
      }
   }
-#endif /* WRITE */
+#endif /* WRITE && WRITE_FILTER */

   FCLOSE(fpin);
   FCLOSE(fpout);
@@ -1847,24 +1877,17 @@ main(int argc, char *argv[])
         kerror = test_one_file(argv[i], outname);
         if (kerror == 0)
         {
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-            int k;
-#endif
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
            fprintf(STDERR, "\n PASS (%lu zero samples)\n",
               (unsigned long)zero_samples);
 #else
            fprintf(STDERR, " PASS\n");
 #endif
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-            for (k = 0; k<256; k++)
-               if (filters_used[k] != 0)
-                  fprintf(STDERR, " Filter %d was used %lu times\n",
-                     k, (unsigned long)filters_used[k]);
-#endif
 #ifdef PNG_TIME_RFC1123_SUPPORTED
-             if (tIME_chunk_present != 0)
-                fprintf(STDERR, " tIME = %s\n", tIME_string);
+            if (tIME_chunk_present != 0)
+               fprintf(STDERR, " tIME = %s\n", tIME_string);
+
+            tIME_chunk_present = 0;
 #endif /* TIME_RFC1123 */
         }

@@ -1936,21 +1959,12 @@ main(int argc, char *argv[])
         {
            if (verbose == 1 || i == 2)
            {
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-                int k;
-#endif
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
                fprintf(STDERR, "\n PASS (%lu zero samples)\n",
                   (unsigned long)zero_samples);
 #else
                fprintf(STDERR, " PASS\n");
 #endif
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-                for (k = 0; k<256; k++)
-                   if (filters_used[k] != 0)
-                      fprintf(STDERR, " Filter %d was used %lu times\n",
-                         k, (unsigned long)filters_used[k]);
-#endif
 #ifdef PNG_TIME_RFC1123_SUPPORTED
             if (tIME_chunk_present != 0)
                fprintf(STDERR, " tIME = %s\n", tIME_string);
@@ -2056,4 +2070,4 @@ main(void)
 #endif

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_24rc04 Your_png_h_is_not_version_1_5_24rc04;
+typedef png_libpng_version_1_5_26 Your_png_h_is_not_version_1_5_26;
--- a/pngtrans.c
+++ b/pngtrans.c
@@ -2,7 +2,7 @@
 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
 *
 * Last changed in libpng 1.5.19 [August 21, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngwio.c
+++ b/pngwio.c
@@ -2,7 +2,7 @@
 /* pngwio.c - functions for data output
 *
 * Last changed in libpng 1.5.18 [February 6, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2014 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngwrite.c
+++ b/pngwrite.c
@@ -2,7 +2,7 @@
 /* pngwrite.c - general routines to write a PNG file
 *
 * Last changed in libpng 1.5.23 [July 23, 2015]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
--- a/pngwtran.c
+++ b/pngwtran.c
@@ -1,7 +1,7 @@

 /* pngwtran.c - transforms the data in a row for PNG writers
 *
- * Last changed in libpng 1.5.13 [September 27, 2012]
+ * Copyright (c) 1998-2002,2004,2006-2012 Glenn Randers-Pehrson
 * Copyright (c) 1998-2012 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
--- a/pngwutil.c
+++ b/pngwutil.c
@@ -1,8 +1,8 @@

 /* pngwutil.c - utilities to write a PNG file
 *
- * Last changed in libpng 1.5.24 [(PENDING RELEASE)]
- * Copyright (c) 1998-2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.5.26 [December 17, 2015]
+ * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -1099,7 +1099,6 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
    png_const_charp profile, int profile_len)
 {
   png_size_t name_len;
-   png_charp new_name;
   compression_state comp;
   int embedded_profile_len = 0;

@@ -1111,8 +1110,7 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   comp.input = NULL;
   comp.input_len = 0;

-   if ((name_len = png_check_keyword(png_ptr, name, &new_name)) == 0)
-      return;
+   name_len = png_strlen(name);

   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
      png_warning(png_ptr, "Unknown compression type in iCCP chunk");
@@ -1131,8 +1129,6 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   {
      png_warning(png_ptr,
          "Embedded profile length in iCCP chunk is negative");
-
-      png_free(png_ptr, new_name);
      return;
   }

@@ -1140,8 +1136,6 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   {
      png_warning(png_ptr,
          "Embedded profile length too large in iCCP chunk");
-
-      png_free(png_ptr, new_name);
      return;
   }

@@ -1161,10 +1155,14 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   png_write_chunk_header(png_ptr, png_iCCP,
       (png_uint_32)(name_len + profile_len + 2));

-   new_name[name_len + 1] = 0x00;
+   png_write_chunk_data(png_ptr, (png_bytep)name, name_len);

-   png_write_chunk_data(png_ptr, (png_bytep)new_name,
-       (png_size_t)(name_len + 2));
+   {
+      png_byte buffer[2];
+      buffer[0] = 0; /* terminate name */
+      buffer[1] = 0xFFU & compression_type;
+      png_write_chunk_data(png_ptr, buffer, 2);
+   }

   if (profile_len != 0)
   {
@@ -1172,7 +1170,6 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
   }

   png_write_chunk_end(png_ptr);
-   png_free(png_ptr, new_name);
 }
 #endif

@@ -1182,7 +1179,6 @@ void /* PRIVATE */
 png_write_sPLT(png_structp png_ptr, png_const_sPLT_tp spalette)
 {
   png_size_t name_len;
-   png_charp new_name;
   png_byte entrybuf[10];
   png_size_t entry_size = (spalette->depth == 8 ? 6 : 10);
   png_size_t palette_size = entry_size * spalette->nentries;
@@ -1193,14 +1189,13 @@ png_write_sPLT(png_structp png_ptr, png_const_sPLT_tp spalette)

   png_debug(1, "in png_write_sPLT");

-   if ((name_len = png_check_keyword(png_ptr,spalette->name, &new_name))==0)
-      return;
+   name_len = png_strlen(spalette->name);

   /* Make sure we include the NULL after the name */
   png_write_chunk_header(png_ptr, png_sPLT,
       (png_uint_32)(name_len + 2 + palette_size));

-   png_write_chunk_data(png_ptr, (png_bytep)new_name,
+   png_write_chunk_data(png_ptr, (png_bytep)spalette->name,
       (png_size_t)(name_len + 1));

   png_write_chunk_data(png_ptr, &spalette->depth, (png_size_t)1);
@@ -1256,7 +1251,6 @@ png_write_sPLT(png_structp png_ptr, png_const_sPLT_tp spalette)
 #endif

   png_write_chunk_end(png_ptr);
-   png_free(png_ptr, new_name);
 }
 #endif

@@ -1512,138 +1506,6 @@ png_write_hIST(png_structp png_ptr, png_const_uint_16p hist, int num_hist)
 }
 #endif

-#if defined(PNG_WRITE_TEXT_SUPPORTED) || defined(PNG_WRITE_pCAL_SUPPORTED) || \
-    defined(PNG_WRITE_iCCP_SUPPORTED) || defined(PNG_WRITE_sPLT_SUPPORTED)
-/* Check that the tEXt or zTXt keyword is valid per PNG 1.0 specification,
- * and if invalid, correct the keyword rather than discarding the entire
- * chunk.  The PNG 1.0 specification requires keywords 1-79 characters in
- * length, forbids leading or trailing whitespace, multiple internal spaces,
- * and the non-break space (0x80) from ISO 8859-1.  Returns keyword length.
- *
- * The new_key is allocated to hold the corrected keyword and must be freed
- * by the calling routine.  This avoids problems with trying to write to
- * static keywords without having to have duplicate copies of the strings.
- */
-png_size_t /* PRIVATE */
-png_check_keyword(png_structp png_ptr, png_const_charp key, png_charpp new_key)
-{
-   png_size_t key_len;
-   png_const_charp ikp;
-   png_charp kp, dp;
-   int kflag;
-   int kwarn=0;
-
-   png_debug(1, "in png_check_keyword");
-
-   *new_key = NULL;
-
-   if (key == NULL || (key_len = png_strlen(key)) == 0)
-   {
-      png_warning(png_ptr, "zero length keyword");
-      return ((png_size_t)0);
-   }
-
-   png_debug1(2, "Keyword to be checked is '%s'", key);
-
-   *new_key = (png_charp)png_malloc_warn(png_ptr, (png_uint_32)(key_len + 2));
-
-   if (*new_key == NULL)
-   {
-      png_warning(png_ptr, "Out of memory while procesing keyword");
-      return ((png_size_t)0);
-   }
-
-   /* Replace non-printing characters with a blank and print a warning */
-   for (ikp = key, dp = *new_key; *ikp != '\0'; ikp++, dp++)
-   {
-      if ((png_byte)*ikp < 0x20 ||
-         ((png_byte)*ikp > 0x7E && (png_byte)*ikp < 0xA1))
-      {
-         PNG_WARNING_PARAMETERS(p)
-
-         png_warning_parameter_unsigned(p, 1, PNG_NUMBER_FORMAT_02x,
-            (png_byte)*ikp);
-         png_formatted_warning(png_ptr, p, "invalid keyword character 0x@1");
-         *dp = ' ';
-      }
-
-      else
-      {
-         *dp = *ikp;
-      }
-   }
-   *dp = '\0';
-
-   /* Remove any trailing white space. */
-   kp = *new_key + key_len - 1;
-   if (*kp == ' ')
-   {
-      png_warning(png_ptr, "trailing spaces removed from keyword");
-
-      while (*kp == ' ')
-      {
-         *(kp--) = '\0';
-         key_len--;
-      }
-   }
-
-   /* Remove any leading white space. */
-   kp = *new_key;
-   if (*kp == ' ')
-   {
-      png_warning(png_ptr, "leading spaces removed from keyword");
-
-      while (*kp == ' ')
-      {
-         kp++;
-         key_len--;
-      }
-   }
-
-   png_debug1(2, "Checking for multiple internal spaces in '%s'", kp);
-
-   /* Remove multiple internal spaces. */
-   for (kflag = 0, dp = *new_key; *kp != '\0'; kp++)
-   {
-      if (*kp == ' ' && kflag == 0)
-      {
-         *(dp++) = *kp;
-         kflag = 1;
-      }
-
-      else if (*kp == ' ')
-      {
-         key_len--;
-         kwarn = 1;
-      }
-
-      else
-      {
-         *(dp++) = *kp;
-         kflag = 0;
-      }
-   }
-   *dp = '\0';
-   if (kwarn != 0)
-      png_warning(png_ptr, "extra interior spaces removed from keyword");
-
-   if (key_len == 0)
-   {
-      png_free(png_ptr, *new_key);
-      png_warning(png_ptr, "Zero length keyword");
-   }
-
-   if (key_len > 79)
-   {
-      png_warning(png_ptr, "keyword length must be 1 - 79 characters");
-      (*new_key)[79] = '\0';
-      key_len = 79;
-   }
-
-   return (key_len);
-}
-#endif
-
 #ifdef PNG_WRITE_tEXt_SUPPORTED
 /* Write a tEXt chunk */
 void /* PRIVATE */
@@ -1651,12 +1513,10 @@ png_write_tEXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
    png_size_t text_len)
 {
   png_size_t key_len;
-   png_charp new_key;

   png_debug(1, "in png_write_tEXt");

-   if ((key_len = png_check_keyword(png_ptr, key, &new_key))==0)
-      return;
+   key_len = strlen(key);

   if (text == NULL || *text == '\0')
      text_len = 0;
@@ -1673,7 +1533,7 @@ png_write_tEXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG will forbid them.
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
    */
-   png_write_chunk_data(png_ptr, (png_bytep)new_key,
+   png_write_chunk_data(png_ptr, (png_bytep)key,
       (png_size_t)(key_len + 1));

   if (text_len != 0)
@@ -1681,7 +1541,6 @@ png_write_tEXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
          (png_size_t)text_len);

   png_write_chunk_end(png_ptr);
-   png_free(png_ptr, new_key);
 }
 #endif

@@ -1693,7 +1552,6 @@ png_write_zTXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
 {
   png_size_t key_len;
   png_byte buf;
-   png_charp new_key;
   compression_state comp;

   png_debug(1, "in png_write_zTXt");
@@ -1704,16 +1562,11 @@ png_write_zTXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
   comp.input = NULL;
   comp.input_len = 0;

-   if ((key_len = png_check_keyword(png_ptr, key, &new_key)) == 0)
-   {
-      png_free(png_ptr, new_key);
-      return;
-   }
+   key_len = strlen(key);

   if (text == NULL || *text == '\0' || compression==PNG_TEXT_COMPRESSION_NONE)
   {
-      png_write_tEXt(png_ptr, new_key, text, (png_size_t)0);
-      png_free(png_ptr, new_key);
+      png_write_tEXt(png_ptr, key, text, (png_size_t)0);
      return;
   }

@@ -1728,11 +1581,9 @@ png_write_zTXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
       (png_uint_32)(key_len+text_len + 2));

   /* Write key */
-   png_write_chunk_data(png_ptr, (png_bytep)new_key,
+   png_write_chunk_data(png_ptr, (png_bytep)key,
       (png_size_t)(key_len + 1));

-   png_free(png_ptr, new_key);
-
   buf = (png_byte)compression;

   /* Write compression */
@@ -1753,8 +1604,6 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
    png_const_charp lang, png_const_charp lang_key, png_const_charp text)
 {
   png_size_t lang_len, key_len, lang_key_len, text_len;
-   png_charp new_lang;
-   png_charp new_key = NULL;
   png_byte cbuf[2];
   compression_state comp;

@@ -1765,15 +1614,13 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
   comp.output_ptr = NULL;
   comp.input = NULL;

-   if ((key_len = png_check_keyword(png_ptr, key, &new_key)) == 0)
-      return;
+   key_len = png_strlen(key);

-   if ((lang_len = png_check_keyword(png_ptr, lang, &new_lang)) == 0)
-   {
-      png_warning(png_ptr, "Empty language field in iTXt chunk");
-      new_lang = NULL;
+   if (lang == NULL)
      lang_len = 0;
-   }
+
+   else
+      lang_len = png_strlen(lang);

   if (lang_key == NULL)
      lang_key_len = 0;
@@ -1808,7 +1655,7 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG will forbid them.
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
    */
-   png_write_chunk_data(png_ptr, (png_bytep)new_key, (png_size_t)(key_len + 1));
+   png_write_chunk_data(png_ptr, (png_bytep)key, (png_size_t)(key_len + 1));

   /* Set the compression flag */
   if (compression == PNG_ITXT_COMPRESSION_NONE ||
@@ -1824,7 +1671,7 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
   png_write_chunk_data(png_ptr, cbuf, (png_size_t)2);

   cbuf[0] = 0;
-   png_write_chunk_data(png_ptr, (new_lang ? (png_const_bytep)new_lang : cbuf),
+   png_write_chunk_data(png_ptr, (lang ? (png_const_bytep)lang : cbuf),
       (png_size_t)(lang_len + 1));

   png_write_chunk_data(png_ptr, (lang_key ? (png_const_bytep)lang_key : cbuf),
@@ -1833,9 +1680,6 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
   png_write_compressed_data_out(png_ptr, &comp, text_len);

   png_write_chunk_end(png_ptr);
-
-   png_free(png_ptr, new_key);
-   png_free(png_ptr, new_lang);
 }
 #endif

@@ -1869,7 +1713,6 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
   png_size_t purpose_len, units_len, total_len;
   png_size_tp params_len;
   png_byte buf[10];
-   png_charp new_purpose;
   int i;

   png_debug1(1, "in png_write_pCAL (%d parameters)", nparams);
@@ -1877,7 +1720,7 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
   if (type >= PNG_EQUATION_LAST)
      png_warning(png_ptr, "Unrecognized equation type for pCAL chunk");

-   purpose_len = png_check_keyword(png_ptr, purpose, &new_purpose) + 1;
+   purpose_len = strlen(purpose) + 1;
   png_debug1(3, "pCAL purpose length = %d", (int)purpose_len);
   units_len = png_strlen(units) + (nparams == 0 ? 0 : 1);
   png_debug1(3, "pCAL units length = %d", (int)units_len);
@@ -1899,7 +1742,7 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,

   png_debug1(3, "pCAL total length = %d", (int)total_len);
   png_write_chunk_header(png_ptr, png_pCAL, (png_uint_32)total_len);
-   png_write_chunk_data(png_ptr, (png_const_bytep)new_purpose, purpose_len);
+   png_write_chunk_data(png_ptr, (png_const_bytep)purpose, purpose_len);
   png_save_int_32(buf, X0);
   png_save_int_32(buf + 4, X1);
   buf[8] = (png_byte)type;
@@ -1907,8 +1750,6 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
   png_write_chunk_data(png_ptr, buf, (png_size_t)10);
   png_write_chunk_data(png_ptr, (png_const_bytep)units, (png_size_t)units_len);

-   png_free(png_ptr, new_purpose);
-
   for (i = 0; i < nparams; i++)
   {
      png_write_chunk_data(png_ptr, (png_const_bytep)params[i], params_len[i]);
--- a/projects/vstudio/readme.txt
+++ b/projects/vstudio/readme.txt
@@ -1,7 +1,7 @@

 VisualStudio instructions

-libpng version 1.5.24rc04 - November 5, 2015
+libpng version 1.5.26 - December 17, 2015

 Copyright (c) 1998-2010 Glenn Randers-Pehrson

--- a/projects/vstudio/zlib.props
+++ b/projects/vstudio/zlib.props
@@ -2,7 +2,7 @@
 <!--
 * zlib.props - location of zlib source
 *
- * libpng version 1.5.24rc04 - November 5, 2015
+ * libpng version 1.5.26 - December 17, 2015
 *
 * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 *
--- a/scripts/README.txt
+++ b/scripts/README.txt
@@ -1,9 +1,9 @@

-Makefiles for  libpng version 1.5.24rc04 - November 5, 2015
+Makefiles for  libpng version 1.5.26 - December 17, 2015

 pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng15.so.15.1.5.24rc04)
+                       (gcc, creates libpng15.so.15.1.5.26)
 makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
 makefile.knr      =>  Archaic UNIX Makefile that converts files with
                       ansi2knr (Requires ansi2knr.c from
@@ -34,12 +34,12 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.os2      =>  OS/2 Makefile (gcc and emx, requires libpng.def)
 makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
 makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng15.so.15.1.5.24rc04)
+                       creates libpng15.so.15.1.5.26)
 makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
 makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng15.so.15.1.5.24rc04)
+                       creates libpng15.so.15.1.5.26)
 makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng15.so.15.1.5.24rc04)
+                       creates libpng15.so.15.1.5.26)
 makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
 makefile.sunos    =>  Sun makefile
 makefile.32sunu   =>  Sun Ultra 32-bit makefile
--- a/scripts/def.c
+++ b/scripts/def.c
@@ -21,7 +21,7 @@ PNG_DFN "OS2 DESCRIPTION "PNG image compression library""
 PNG_DFN "OS2 CODE PRELOAD MOVEABLE DISCARDABLE"
 PNG_DFN ""
 PNG_DFN "EXPORTS"
-PNG_DFN ";Version 1.5.24rc04"
+PNG_DFN ";Version 1.5.26"

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
        PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"
--- a/scripts/libpng-config-head.in
+++ b/scripts/libpng-config-head.in
@@ -11,7 +11,7 @@

 # Modeled after libxml-config.

-version=1.5.24rc04
+version=1.5.26
 prefix=""
 libdir=""
 libs=""
--- a/scripts/libpng.pc.in
+++ b/scripts/libpng.pc.in
@@ -5,6 +5,6 @@ includedir=@includedir@/libpng15

 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.5.24rc04
+Version: 1.5.26
 Libs: -L${libdir} -lpng15
 Cflags: -I${includedir}
--- a/scripts/makefile.cegcc
+++ b/scripts/makefile.cegcc
@@ -23,7 +23,7 @@

 VERMAJ = 1
 VERMIN = 5
-VERMIC = 24
+VERMIC = 26
 VER = $(VERMAJ).$(VERMIN).$(VERMIC)
 NAME = libpng
 PACKAGE = $(NAME)-$(VER)
--- a/scripts/makefile.linux
+++ b/scripts/makefile.linux
@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng15
 PNGMAJ = 15
-RELEASE = 24
+RELEASE = 26

 # Shared library names:
 LIBSO=$(LIBNAME).so
--- a/scripts/makefile.msys
+++ b/scripts/makefile.msys
@@ -18,7 +18,7 @@ exec_prefix=$(prefix)
 # Library name:
 LIBNAME = libpng15
 PNGMAJ = 15
-RELEASE = 24
+RELEASE = 26

 # Shared library names:
 LIBSO=$(LIBNAME).dll
--- a/scripts/makefile.ne12bsd
+++ b/scripts/makefile.ne12bsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng15

 LIB=	png15
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.5.24rc04
+SHLIB_MINOR=	1.5.26
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.netbsd
+++ b/scripts/makefile.netbsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include

 LIB=	png
 SHLIB_MAJOR=	15
-SHLIB_MINOR=	1.5.24rc04
+SHLIB_MINOR=	1.5.26
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.openbsd
+++ b/scripts/makefile.openbsd
@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat

 SHLIB_MAJOR=	15
-SHLIB_MINOR=	1.5.24rc04
+SHLIB_MINOR=	1.5.26

 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
--- a/scripts/pnglibconf.h.prebuilt
+++ b/scripts/pnglibconf.h.prebuilt
@@ -1,9 +1,9 @@
-/* 1.5.24rc04 STANDARD API DEFINITION */
+/* 1.5.26 STANDARD API DEFINITION */
 /* pnglibconf.h - library build configuration */

-/* libpng version 1.5.24rc04 - November 5, 2015 */
+/* libpng version 1.5.26 - December 17, 2015 */

-/* Copyright (c) 1998-2013 Glenn Randers-Pehrson */
+/* Copyright (c) 1998-2015 Glenn Randers-Pehrson */

 /* This code is released under the libpng license. */
 /* For conditions of distribution and use, see the disclaimer */
--- a/scripts/symbols.def
+++ b/scripts/symbols.def
@@ -1,4 +1,4 @@
-;Version 1.5.24rc04
+;Version 1.5.26
 ;--------------------------------------------------------------
 ; LIBPNG symbol list as a Win32 DEF file
 ; Contains all the symbols that can be exported from libpng
Author	SHA1	Message	Date
Glenn Randers-Pehrson	94322f3f8f	[libpng15] Imported from libpng-1.5.26.tar	2015-12-17 08:11:20 -06:00
Glenn Randers-Pehrson	8f1c1a6d8c	[libpng15] Imported from libpng-1.5.26rc01.tar	2015-12-13 21:44:19 -06:00
Glenn Randers-Pehrson	fd3cd9fad2	[libpng15] Update some last-changed dates	2015-12-13 18:36:30 -06:00
Glenn Randers-Pehrson	2921aa280f	Merge branch 'libpng15-20151213-keyword' of git://github.com/jbowler/libpng-1 into libpng15	2015-12-13 18:20:11 -06:00
John Bowler	e40ac66f81	[libpng15] Do png_check_keyword in png_set_*()	2015-12-13 18:10:53 -06:00
Glenn Randers-Pehrson	a510a813ef	[libpng15] Remove new redundant prototype for png_set_keyword()	2015-12-13 17:35:11 -06:00
Glenn Randers-Pehrson	ad5f16c406	[libpng15] Bump version to 1.5.26beta02	2015-12-13 16:19:49 -06:00
Glenn Randers-Pehrson	2b5be93866	[libpng15] Move png_check_keyword() from pngwutil.c to pngset.c	2015-12-13 16:18:58 -06:00
John Bowler	8d28ab2101	Move png_check_keyword to pngset.c This is a backport of the libpng16 version with the warnings switched off. Signed-off-by: John Bowler <jbowler@acm.org>	2015-12-13 13:44:34 -08:00
Glenn Randers-Pehrson	29c1086ba3	[libpng15] Imported from libpng-1.5.26beta01.tar	2015-12-11 10:20:41 -06:00
Glenn Randers-Pehrson	456d614959	[libpng15] Bump version to 1.5.26beta01	2015-12-09 09:42:49 -06:00
Glenn Randers-Pehrson	d9006f683c	[libpng15] Fixed an out-of-range read in png_check_keyword() (Bug report from Qixue Xiao).	2015-12-09 09:40:48 -06:00
Glenn Randers-Pehrson	93e111afc5	[libpng15] Imported from libpng-1.5.25.tar	2015-12-02 22:30:30 -06:00
Glenn Randers-Pehrson	3a1a5256fa	[libpng15] Imported from libpng-1.5.25rc01.tar	2015-11-26 07:04:16 -06:00
Glenn Randers-Pehrson	b5da27d211	[libpng15] Imported from libpng-1.5.25beta03.tar	2015-11-24 09:36:23 -06:00
Glenn Randers-Pehrson	11c2f47bd6	Merge branch 'libpng15-20151123' of git://github.com/jbowler/libpng-1 into libpng15	2015-11-24 09:34:59 -06:00
John Bowler	daf54fe4fc	Test backport Tests backported from the multi-version compatible ones in libpng 1.7 Signed-off-by: John Bowler <jbowler@acm.org>	2015-11-23 20:16:21 -08:00
Glenn Randers-Pehrson	17749bdd61	[libpng15] Imported from libpng-1.5.25beta02.tar	2015-11-23 09:29:33 -06:00
Glenn Randers-Pehrson	3ccfba8c28	[lbpng15] Revert 12 -> 12U change in pngrutil.c	2015-11-22 22:59:16 -06:00
Glenn Randers-Pehrson	596f052d69	[libpng15] Fixed bug recently introduced in png_set_PLTE() that uses png_ptr not info_ptr.	2015-11-22 20:47:45 -06:00
Glenn Randers-Pehrson	69ac844654	[libpng15] Bump version to 1.5.25beta02	2015-11-22 14:11:19 -06:00
Glenn Randers-Pehrson	635a8b9b84	[libpng15] Imported from libpng-1.5.25beta01.tar	2015-11-22 14:08:45 -06:00
Glenn Randers-Pehrson	611e8de78c	[libpng15] Use unsigned constants in buffer length comparisons	2015-11-21 14:33:31 -06:00
Glenn Randers-Pehrson	68a6e6755b	[lbpng15] Rearrange terms in buffer length tests in pngrutil.c to avoid potential overflow in calculations.	2015-11-19 09:12:43 -06:00
Glenn Randers-Pehrson	8738633bd6	[libpng15] Avoid potential pointer overflow in png_handle_iTXt(), png_handle_zTXt(), png_handle_sPLT(), and png_handle_pCAL() (Bug report by John Regehr).	2015-11-13 22:47:30 -06:00
Glenn Randers-Pehrson	b257d4a6a1	[libpng15] Bump version to 1.5.25beta01	2015-11-13 10:18:08 -06:00
Glenn Randers-Pehrson	df80d38897	[libpng15] Imported from libpng-1.5.24.tar	2015-11-12 07:13:10 -06:00
Glenn Randers-Pehrson	9b70e0332b	[libpng15] Clean up coding style in png_handle_PLTE()	2015-11-05 11:17:54 -06:00