[master] Imported from libpng-1.6.18.tar

[master] Imported from libpng-1.6.17.tar
[master] Imported from libpng-1.6.16.tar
2025-07-10 18:04:09 +02:00 · 2015-07-22 22:41:05 -05:00 · 2015-03-26 08:11:22 -05:00 · 2015-01-15 12:47:40 -05:00 · 2014-11-20 10:23:30 -06:00 · 2014-10-22 19:33:27 -05:00
74 changed files with 4617 additions and 2498 deletions
--- a/84
+++ b/84
@@ -1,35 +1,85 @@
-Libpng 1.6.16beta01 - December 14, 2014
+Libpng 1.6.18 - July 23, 2015

-This is not intended to be a public release.  It will be replaced
-within a few weeks by a public version or by another test version.
+This is a public release of libpng, intended for use in production codes.

 Files available for download:

 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script

-   1.6.16beta01.tar.xz (LZMA-compressed, recommended)
-   1.6.16beta01.tar.gz
+   libpng-1.6.18.tar.xz (LZMA-compressed, recommended)
+   libpng-1.6.18.tar.gz

 Source files with CRLF line endings (for Windows), without the
 "configure" script

-   lp1616b01.7z  (LZMA-compressed, recommended)
-   lp1616b01.zip
+   lpng1618.7z  (LZMA-compressed, recommended)
+   lpng1618.zip

 Other information:

-   1.6.16beta01-README.txt
-   1.6.16beta01-LICENSE.txt
-   libpng-1.6.16beta01-*.asc (armored detached GPG signatures)
+   libpng-1.6.18-README.txt
+   libpng-1.6.18-LICENSE.txt
+   libpng-1.6.18-*.asc (armored detached GPG signatures)

-Changes since the last public release (1.6.15):
-
-Version 1.6.16beta01 [December 14, 2014]
-  Added ".align 2" to arm/filter_neon.S to support old GAS assemblers that
-    don't do alignment correctly.
-  Revised Makefile.am and scripts/symbols.dfn to work with MinGW/MSYS
-    (Bob Friesenhahn).
+Changes since the last public release (1.6.17):
+  Removed PNG_SET_CHUNK_[CACHE|MALLOC]_LIMIT_SUPPORTED macros.  They
+    have been combined with PNG_SET_USER_LIMITS_SUPPORTED (resolves
+    bug report by Andrew Church).
+  Fixed rgb_to_gray checks and added tRNS checks to pngvalid.c.  This
+    fixes some arithmetic errors that caused some tests to fail on
+    some 32-bit platforms (Bug reports by Peter Breitenlohner [i686]
+    and Petr Gajdos [i586]).
+  Suppressed some warnings from the Borland C++ 5.5.1/5.82 compiler
+    (Bug report by Viktor Szaka'ts).
+  Replaced "unexpected" with an integer (0xabadca11) in pngset.c
+    where a long was expected, to avoid a compiler warning when PNG_DEBUG > 1.
+  Added contrib/examples/simpleover.c, to demonstrate how to handle
+    alpha compositing of multiple images, using the "simplified API"
+    and an example PNG generation tool, contrib/examples/genpng.c
+    (John Bowler).
+  PNG_RELEASE_BUILD replaces tests where the code depended on the build base
+    type and can be defined on the command line, allowing testing in beta
+    builds (John Bowler).
+  Avoid Coverity issue 80858 (REVERSE NULL) in pngtest.c
+  Avoid a harmless potential integer overflow in png_XYZ_from_xy() (Bug
+    report from Christopher Ferris).
+  Backport filter selection code from libpng-1.7.0beta51, to combine
+    sub_row, up_row, avg_row, and paeth_row into try_row and tst_row.
+  Changed png_voidcast(), etc., to voidcast(), etc., in contrib/tools/pngfix.c
+    to avoid confusion with the libpng private macros.
+  Fixed old cut&paste bug in the weighted filter selection code in
+    pngwutil.c, introduced in libpng-0.95, March 1997.
+  Removed WRITE_WEIGHTED_FILTERED code, to save a few kbytes of the
+    compiled library size. It never worked properly and as far as we can
+    tell, no one uses it. The png_set_filter_heuristics() and
+    png_set_filter_heuristics_fixed() APIs are retained but deprecated
+    and do nothing.
+  Quieted some Coverity issues in pngfix.c, png-fix-itxt.c, pngvalid.c,
+    pngstest.c, and pngimage.c. Most seem harmless, but png-fix-itxt
+    would only work with iTXt chunks with length 255 or less.
+  Removed non-working progressive reader 'skip' function. This
+    function has apparently never been used. It was implemented
+    to support back-door modification of png_struct in libpng-1.4.x
+    but (because it does nothing and cannot do anything) was apparently
+    never tested (John Bowler).
+  Fixed cexcept.h in which GCC 5 now reports that one of the auto
+    variables in the Try macro needs to be volatile to prevent value
+    being lost over the setjmp (John Bowler).
+  Added #ifdef's to contrib/examples programs so people don't try
+    to compile them without the minimum required support enabled
+    (suggested by Flavio Medeiros).
+  Eliminated the final two Coverity defects (insecure temporary file
+    handling in contrib/libtests/pngstest.c; possible overflow of
+    unsigned char in contrib/tools/png-fix-itxt.c). To use the "secure"
+    file handling, define PNG_USE_MKSTEMP, otherwise "tmpfile()" will
+    be used.
+  Removed some unused WEIGHTED_FILTER macros from pngstruct.h
+  Replaced arbitrary use of 'extern' with #define PNG_LINKAGE_*.  To
+    preserve API compatibility, the new defines all default to "extern"
+    (requested by Jan Nijtmans).
+  Belatedly added Mans Rullgard and James Yu to the list of Contributing
+    Authors.

 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
--- a/261
+++ b/261
@@ -1,11 +1,14 @@
-
+#if 0
 CHANGES - changes for libpng

-Version 0.2
+version 0.1 [March 29, 1995]
+  initial work-in-progress release
+
+version 0.2 [April 1, 1995]
  added reader into png.h
  fixed small problems in stub file

-Version 0.3
+version 0.3 [April 8, 1995]
  added pull reader
  split up pngwrite.c to several files
  added pnglib.txt
@@ -14,9 +17,9 @@ Version 0.3
  fixed some bugs in writer
  interfaced with zlib 0.5
  added K&R support
-  added check for 64 KB blocks for 16-bit machines
+  added check for 64 KB blocks for 16 bit machines

-Version 0.4
+version 0.4 [April 26, 1995]
  cleaned up code and commented code
  simplified time handling into png_time
  created png_color_16 and png_color_8 to handle color needs
@@ -27,28 +30,29 @@ Version 0.4
  cleaned up zTXt reader and writer (using zlib's Reset functions)
  split transformations into pngrtran.c and pngwtran.c

-Version 0.5
+version 0.5 [April 30, 1995]
  interfaced with zlib 0.8
  fixed many reading and writing bugs
  saved using 3 spaces instead of tabs

-Version 0.6
+version 0.6 [May 1, 1995]
+  first beta release
  added png_large_malloc() and png_large_free()
  added png_size_t
  cleaned up some compiler warnings
  added png_start_read_image()

-Version 0.7
+version 0.7 [June 24, 1995]
  cleaned up lots of bugs
  finished dithering and other stuff
  added test program
  changed name from pnglib to libpng

-Version 0.71 [June, 1995]
+version 0.71 [June 26, 1995]
  changed pngtest.png for zlib 0.93
  fixed error in libpng.txt and example.c

-Version 0.8
+version 0.8 [August 20, 1995]
  cleaned up some bugs
  added png_set_filler()
  split up pngstub.c into pngmem.c, pngio.c, and pngerror.c
@@ -91,7 +95,7 @@ Version 0.88 [January, 1996]
  cleaned up documentation
  added callbacks for read/write and warning/error functions

-Version 0.89 [July, 1996]
+Version 0.89 [June 5, 1996]
  Added new initialization API to make libpng work better with shared libs
    we now have png_create_read_struct(), png_create_write_struct(),
    png_create_info_struct(), png_destroy_read_struct(), and
@@ -118,6 +122,9 @@ Version 0.89 [July, 1996]
  New pngtest image also has interlacing and zTXt
  Updated documentation to reflect new API

+Version 0.89c [June 17, 1996]
+  Bug fixes.
+
 Version 0.90 [January, 1997]
  Made CRC errors/warnings on critical and ancillary chunks configurable
  libpng will use the zlib CRC routines by (compile-time) default
@@ -158,7 +165,7 @@ Version 0.95 [March, 1997]
  Added new pCAL chunk read/write support
  Added experimental filter selection weighting (Greg Roelofs)
  Removed old png_set_rgbx() and png_set_xrgb() functions that have been
-     obsolete for about 2 years now (use png_set_filler() instead)
+    obsolete for about 2 years now (use png_set_filler() instead)
  Added macros to read 16- and 32-bit ints directly from buffer, to be
    used only on those systems that support it (namely PowerPC and 680x0)
    With some testing, this may become the default for MACOS/PPC systems.
@@ -440,7 +447,7 @@ Version 1.0.3 [January 14, 1999]

 Version 1.0.3a [August 12, 1999]
  Added check for PNG_READ_INTERLACE_SUPPORTED in pngread.c; issue a warning
-     if an attempt is made to read an interlaced image when it's not supported.
+    if an attempt is made to read an interlaced image when it's not supported.
  Added check if png_ptr->trans is defined before freeing it in pngread.c
  Modified the Y2K statement to include versions back to version 0.71
  Fixed a bug in the check for valid IHDR bit_depth/color_types in pngrutil.c
@@ -448,7 +455,7 @@ Version 1.0.3a [August 12, 1999]
  Replaced leading blanks with tab characters in makefile.hux
  Changed "dworkin.wustl.edu" to "ccrc.wustl.edu" in various documents.
  Changed (float)red and (float)green to (double)red, (double)green
-     in png_set_rgb_to_gray() to avoid "promotion" problems in AIX.
+    in png_set_rgb_to_gray() to avoid "promotion" problems in AIX.
  Fixed a bug in pngconf.h that omitted <stdio.h> when PNG_DEBUG==0 (K Bracey).
  Reformatted libpng.3 and libpngpf.3 with proper fonts (script by J. vanZandt).
  Updated documentation to refer to the PNG-1.2 specification.
@@ -491,7 +498,7 @@ Version 1.0.3d [September 4, 1999]
  Added new png_expand functions to scripts/pngdef.pas and pngos2.def
  Added a demo read_user_transform_fn that examines the row filters in pngtest.c

-Version 1.0.4 [September 24, 1999]
+Version 1.0.4 [September 24, 1999, not distributed publicly]
  Define PNG_ALWAYS_EXTERN in pngconf.h if __STDC__ is defined
  Delete #define PNG_INTERNAL and include "png.h" from pngasmrd.h
  Made several minor corrections to pngtest.c
@@ -518,6 +525,7 @@ Version 1.0.4c [October 1, 1999]
  Added a "png_check_version" function in png.c and pngtest.c that will generate
    a helpful compiler error if an old png.h is found in the search path.
  Changed type of png_user_transform_depth|channels from int to png_byte.
+  Added "Libpng is OSI Certified Open Source Software" statement to png.h

 Version 1.0.4d [October 6, 1999]
  Changed 0.45 to 0.45455 in png_set_sRGB()
@@ -904,7 +912,7 @@ Version 1.0.7 [July 1, 2000]
 Version 1.0.8beta1 [July 8, 2000]
  Added png_free(png_ptr, key) two places in pngpread.c to stop memory leaks.
  Changed PNG_NO_STDIO to PNG_NO_CONSOLE_IO, several places in pngrutil.c and
-     pngwutil.c.
+    pngwutil.c.
  Changed PNG_EXPORT_VAR to use PNG_IMPEXP, in pngconf.h.
  Removed unused "#include <assert.h>" from png.c
  Added WindowsCE support.
@@ -912,12 +920,12 @@ Version 1.0.8beta1 [July 8, 2000]

 Version 1.0.8beta2 [July 10, 2000]
  Added project files to the wince directory and made further revisions
-     of pngtest.c, pngrio.c, and pngwio.c in support of WindowsCE.
+    of pngtest.c, pngrio.c, and pngwio.c in support of WindowsCE.

 Version 1.0.8beta3 [July 11, 2000]
  Only set the PNG_FLAG_FREE_TRNS or PNG_FREE_TRNS flag in png_handle_tRNS()
-     for indexed-color input files to avoid potential double-freeing trans array
-     under some unusual conditions; problem was introduced in version 1.0.6f.
+    for indexed-color input files to avoid potential double-freeing trans array
+    under some unusual conditions; problem was introduced in version 1.0.6f.
  Further revisions to pngtest.c and files in the wince subdirectory.

 Version 1.0.8beta4 [July 14, 2000]
@@ -1089,16 +1097,16 @@ Version 1.2.0beta3 [May 17, 2001]

 Version 1.2.0beta4 [June 23, 2001]
  Check for missing profile length field in iCCP chunk and free chunk_data
-     in case of truncated iCCP chunk.
+    in case of truncated iCCP chunk.
  Bumped shared-library number to 3 in makefile.sgi and makefile.sggcc
  Bumped dll-number from 2 to 3 in makefile.cygwin
  Revised contrib/gregbook/rpng*-x.c to avoid a memory leak and to exit cleanly
-     if user attempts to run it on an 8-bit display.
+    if user attempts to run it on an 8-bit display.
  Updated contrib/gregbook
  Use png_malloc instead of png_zalloc to allocate palette in pngset.c
  Updated makefile.ibmc
  Added some typecasts to eliminate gcc 3.0 warnings.  Changed prototypes
-     of png_write_oFFS width and height from png_uint_32 to png_int_32.
+    of png_write_oFFS width and height from png_uint_32 to png_int_32.
  Updated example.c
  Revised prototypes for png_debug_malloc and png_debug_free in pngtest.c

@@ -1106,9 +1114,9 @@ Version 1.2.0beta5 [August 8, 2001]
  Revised contrib/gregbook
  Revised makefile.gcmmx
  Revised pnggccrd.c to conditionally compile some thread-unsafe code only
-     when PNG_THREAD_UNSAFE_OK is defined.
+    when PNG_THREAD_UNSAFE_OK is defined.
  Added tests to prevent pngwutil.c from writing a bKGD or tRNS chunk with
-     value exceeding 2^bit_depth-1
+    value exceeding 2^bit_depth-1
  Revised makefile.sgi and makefile.sggcc
  Replaced calls to fprintf(stderr,...) with png_warning() in pnggccrd.c
  Removed restriction that do_invert_mono only operate on 1-bit opaque files
@@ -1449,8 +1457,9 @@ Version 1.2.6beta4 [July 28, 2004]
  Use png_malloc instead of png_zalloc to allocate the pallete.

 Version 1.0.16rc1 and 1.2.6rc1 [August 4, 2004]
-  Fixed buffer overflow vulnerability in png_handle_tRNS()
-  Fixed integer arithmetic overflow vulnerability in png_read_png().
+  Fixed buffer overflow vulnerability (CVE-2004-0597) in png_handle_tRNS().
+  Fixed NULL dereference vulnerability (CVE-2004-0598) in png_handle_iCCP().
+  Fixed integer overflow vulnerability (CVE-2004-0599) in png_read_png().
  Fixed some harmless bugs in png_handle_sBIT, etc, that would cause
    duplicate chunk types to go undetected.
  Fixed some timestamps in the -config version
@@ -1493,7 +1502,7 @@ Version 1.0.16rc4 and 1.2.6rc4 [August 10, 2004]

 Version 1.0.16rc5 and 1.2.6rc5 [August 10, 2004]
  Moved  "PNG_HANDLE_CHUNK_*" macros out of PNG_ASSEMBLER_CODE_SUPPORTED
-     section of png.h where they were inadvertently placed in version rc3.
+    section of png.h where they were inadvertently placed in version rc3.

 Version 1.2.6 and 1.0.16 [August 15, 2004]
  Revised pngtest so memory allocation testing is only done when PNG_DEBUG==1.
@@ -2102,7 +2111,7 @@ Version 1.4.0beta24 [July 25, 2008]
    png_decompress_chunk(), and remove "chunkdata" from parameter list.
  Put a call to png_check_chunk_name() in png_read_chunk_header().
  Revised png_check_chunk_name() to reject a name with a lowercase 3rd byte.
-  Removed two calls to png_check_chunk_name() occuring later in the process.
+  Removed two calls to png_check_chunk_name() occurring later in the process.
  Define PNG_NO_ERROR_NUMBERS by default in pngconf.h

 Version 1.4.0beta25 [July 30, 2008]
@@ -2325,7 +2334,7 @@ Version 1.4.0beta63 [June 15, 2009]
 Version 1.4.0beta64 [June 24, 2009]
  Eliminated PNG_LEGACY_SUPPORTED code.
  Moved the various unknown chunk macro definitions outside of the
-     PNG_READ|WRITE_ANCILLARY_CHUNK_SUPPORTED blocks.
+    PNG_READ|WRITE_ANCILLARY_CHUNK_SUPPORTED blocks.

 Version 1.4.0beta65 [June 26, 2009]
  Added a reference to the libpng license in each file.
@@ -4525,7 +4534,7 @@ Version 1.6.3beta03 [April 30, 2013]
  Expanded manual paragraph about writing private chunks, particularly
    the need to call png_set_keep_unknown_chunks() when writing them.
  Avoid dereferencing NULL pointer possibly returned from
-     png_create_write_struct() (Andrew Church).
+    png_create_write_struct() (Andrew Church).

 Version 1.6.3beta05 [May 9, 2013]
  Calculate our own zlib windowBits when decoding rather than trusting the
@@ -5105,6 +5114,197 @@ Version 1.6.16beta01 [December 14, 2014]
  Revised Makefile.am and scripts/symbols.dfn to work with MinGW/MSYS
    (Bob Friesenhahn).

+Version 1.6.16beta02 [December 15, 2014]
+  Revised Makefile.am and scripts/*.dfn again to work with MinGW/MSYS;
+    renamed scripts/*.dfn to scripts/*.c (John Bowler).
+
+Version 1.6.16beta03 [December 21, 2014]
+  Quiet a "comparison always true" warning in pngstest.c (John Bowler).
+
+Version 1.6.16rc01 [December 21, 2014]
+  Restored a test on width that was removed from png.c at libpng-1.6.9
+    (Bug report by Alex Eubanks, CVE-2015-0973).
+
+Version 1.6.16rc02 [December 21, 2014]
+  Undid the update to pngrutil.c in 1.6.16rc01.
+
+Version 1.6.16rc03 [December 21, 2014]
+  Fixed an overflow in png_combine_row() with very wide interlaced images
+    (Bug report and fix by John Bowler, CVE-2014-9495).
+
+Version 1.6.16 [December 22, 2014]
+  No changes.
+
+Version 1.6.17beta01 [January 29, 2015]
+  Removed duplicate PNG_SAFE_LIMITS_SUPPORTED handling from pngconf.h
+  Corrected the width limit calculation in png_check_IHDR().
+  Removed user limits from pngfix. Also pass NULL pointers to
+    png_read_row to skip the unnecessary row de-interlace stuff.
+  Added testing of png_set_packing() to pngvalid.c
+  Regenerated configure scripts in the *.tar distributions with libtool-2.4.4
+  Implement previously untested cases of libpng transforms in pngvalid.c
+  Fixed byte order in 2-byte filler, in png_do_read_filler().
+  Made the check for out-of-range values in png_set_tRNS() detect
+    values that are exactly 2^bit_depth, and work on 16-bit platforms.
+  Merged some parts of libpng-1.6.17beta01 and libpng-1.7.0beta47.
+  Added #ifndef __COVERITY__ where needed in png.c, pngrutil.c and
+    pngset.c to avoid warnings about dead code.
+  Added "& 0xff" to many instances of expressions that are typecast
+    to (png_byte), to avoid Coverity warnings.
+
+Version 1.6.17beta02 [February 7, 2015]
+  Work around one more Coverity-scan dead-code warning.
+  Do not build png_product2() when it is unused.
+
+Version 1.6.17beta03 [February 17, 2015]
+  Display user limits in the output from pngtest.
+  Eliminated the PNG_SAFE_LIMITS macro and restored the 1-million-column
+    and 1-million-row default limits in pnglibconf.dfa, that can be reset
+    by the user at build time or run time.  This provides a more robust
+    defense against DOS and as-yet undiscovered overflows.
+
+Version 1.6.17beta04 [February 21, 2015]
+  Added PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED macro, on by default.
+  Allow user to call png_get_IHDR() with NULL arguments (Reuben Hawkins).
+  Rebuilt configure scripts with automake-1.15 and libtool-2.4.6
+
+Version 1.6.17beta05 [February 25, 2015]
+  Restored compiling of png_reciprocal2 with PNG_NO_16BIT.
+
+Version 1.6.17beta06 [February 27, 2015]
+  Moved png_set_filter() prototype into a PNG_WRITE_SUPPORTED block
+    of png.h.
+  Avoid runtime checks when converting integer to png_byte with
+    Visual Studio (Sergey Kosarevsky)
+
+Version 1.6.17rc01 [March 4, 2015]
+  No changes.
+
+Version 1.6.17rc02 [March 9, 2015]
+  Removed some comments that the configure script did not handle
+    properly from scripts/pnglibconf.dfa and pnglibconf.h.prebuilt.
+  Free the unknown_chunks structure even when it contains no data.
+
+Version 1.6.17rc03 [March 12, 2015]
+  Updated CMakeLists.txt to add OSX framework, change YES/NO to ON/OFF
+    for consistency, and remove some useless tests (Alexey Petruchik).
+
+Version 1.6.17rc04 [March 16, 2015]
+  Remove pnglibconf.h, pnglibconf.c, and pnglibconf.out instead of
+    pnglibconf.* in "make clean" (Cosmin).
+  Fix bug in calculation of maxbits, in png_write_sBIT, introduced
+    in libpng-1.6.17beta01 (John Bowler).
+
+Version 1.6.17rc05 [March 21, 2015]
+  Define PNG_FILTER_* and PNG_FILTER_VALUE_* in png.h even when WRITE
+    is not supported (John Bowler).  This fixes an error introduced in
+    libpng-1.6.17beta06.
+  Reverted "& 0xff" additions of version 1.6.17beta01. Libpng passes
+    the Coverity scan without them.
+
+Version 1.6.17rc06 [March 23, 2015]
+  Remove pnglibconf.dfn and pnglibconf.pre with "make clean".
+  Reformatted some "&0xff" instances to "& 0xff".
+  Fixed simplified 8-bit-linear to sRGB alpha. The calculated alpha
+    value was wrong.  It's not clear if this affected the final stored
+    value; in the obvious code path the upper and lower 8-bits of the
+    alpha value were identical and the alpha was truncated to 8-bits
+    rather than dividing by 257 (John Bowler).
+
+Version 1.6.17 [March 26, 2015]
+  No changes.
+
+Version 1.6.18beta01 [April 1, 2015]
+  Removed PNG_SET_CHUNK_[CACHE|MALLOC]_LIMIT_SUPPORTED macros.  They
+    have been combined with PNG_SET_USER_LIMITS_SUPPORTED (resolves
+    bug report by Andrew Church).
+  Fixed rgb_to_gray checks and added tRNS checks to pngvalid.c.  This
+    fixes some arithmetic errors that caused some tests to fail on
+    some 32-bit platforms (Bug reports by Peter Breitenlohner [i686]
+    and Petr Gajdos [i586]).
+
+Version 1.6.18beta02 [April 26, 2015]
+  Suppressed some warnings from the Borland C++ 5.5.1/5.82 compiler
+    (Bug report by Viktor Szaka'ts).
+
+Version 1.6.18beta03 [May 6, 2015]
+  Replaced "unexpected" with an integer (0xabadca11) in pngset.c
+    where a long was expected, to avoid a compiler warning when PNG_DEBUG > 1.
+  Added contrib/examples/simpleover.c, to demonstrate how to handle
+    alpha compositing of multiple images, using the "simplified API"
+    and an example PNG generation tool, contrib/examples/genpng.c
+    (John Bowler).
+
+Version 1.6.18beta04 [May 20, 2015]
+  PNG_RELEASE_BUILD replaces tests where the code depended on the build base
+    type and can be defined on the command line, allowing testing in beta
+    builds (John Bowler).
+  Avoid Coverity issue 80858 (REVERSE NULL) in pngtest.c PNG_DEBUG builds.
+  Avoid a harmless potential integer overflow in png_XYZ_from_xy() (Bug
+    report from Christopher Ferris).
+
+Version 1.6.18beta05 [May 31, 2015]
+  Backport filter selection code from libpng-1.7.0beta51, to combine
+    sub_row, up_row, avg_row, and paeth_row into try_row and tst_row.
+  Changed png_voidcast(), etc., to voidcast(), etc., in contrib/tools/pngfix.c
+    to avoid confusion with the libpng private macros.
+  Fixed old cut&paste bug in the weighted filter selection code in
+    pngwutil.c, introduced in libpng-0.95, March 1997.
+
+Version 1.6.18beta06 [June 1, 2015]
+  Removed WRITE_WEIGHTED_FILTERED code, to save a few kbytes of the
+    compiled library size. It never worked properly and as far as we can
+    tell, no one uses it. The png_set_filter_heuristics() and
+    png_set_filter_heuristics_fixed() APIs are retained but deprecated
+    and do nothing.
+
+Version 1.6.18beta07 [June 6, 2015]
+  Removed non-working progressive reader 'skip' function. This
+    function has apparently never been used. It was implemented
+    to support back-door modification of png_struct in libpng-1.4.x
+    but (because it does nothing and cannot do anything) was apparently
+    never tested (John Bowler).
+  Fixed cexcept.h in which GCC 5 now reports that one of the auto
+    variables in the Try macro needs to be volatile to prevent value
+    being lost over the setjmp (John Bowler).
+  Fixed NO_WRITE_FILTER and -Wconversion build breaks (John Bowler).
+  Fix g++ build breaks (John Bowler).
+  Quieted some Coverity issues in pngfix.c, png-fix-itxt.c, pngvalid.c,
+    pngstest.c, and pngimage.c. Most seem harmless, but png-fix-itxt
+    would only work with iTXt chunks with length 255 or less.
+  Added #ifdef's to contrib/examples programs so people don't try
+    to compile them without the minimum required support enabled
+    (suggested by Flavio Medeiros).
+
+Version 1.6.18beta08 [June 30, 2015]
+  Eliminated the final two Coverity defects (insecure temporary file
+    handling in contrib/libtests/pngstest.c; possible overflow of
+    unsigned char in contrib/tools/png-fix-itxt.c). To use the "secure"
+    file handling, define PNG_USE_MKSTEMP, otherwise "tmpfile()" will
+    be used.
+  Removed some unused WEIGHTED_FILTER macros from png.h and pngstruct.h
+
+Version 1.6.18beta09 [July 5, 2015]
+  Removed some useless typecasts from contrib/tools/png-fix-itxt.c
+  Fixed a new signed-unsigned comparison in pngrtran.c (Max Stepin).
+  Replaced arbitrary use of 'extern' with #define PNG_LINKAGE_*.  To
+    preserve API compatibility, the new defines all default to "extern"
+    (requested by Jan Nijtmans).
+
+Version 1.6.18rc01 [July 9, 2015]
+  Belatedly added Mans Rullgard and James Yu to the list of Contributing
+    Authors.
+
+Version 1.6.18rc02 [July 12, 2015]
+  Restored unused FILTER_HEURISTIC macros removed at libpng-1.6.18beta08
+    to png.h to avoid compatibility warnings.
+
+Version 1.6.18rc03 [July 15, 2015]
+  Minor changes to the man page
+
+Version 1.6.18 [July 23, 2015]
+  No changes.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
@@ -5112,3 +5312,4 @@ to subscribe)
 or to glennrp at users.sourceforge.net

 Glenn R-P
+#endif
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,6 +1,6 @@
 # CMakeLists.txt

-# Copyright (C) 2007-2014 Glenn Randers-Pehrson
+# Copyright (C) 2007-2015 Glenn Randers-Pehrson

 # This code is released under the libpng license.
 # For conditions of distribution and use, see the disclaimer
@@ -16,7 +16,7 @@ enable_testing()

 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 6)
-set(PNGLIB_RELEASE 16)
+set(PNGLIB_RELEASE 18)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})

@@ -30,8 +30,7 @@ if(NOT WIN32)
    PATHS /usr/lib /usr/local/lib
  )
  if(NOT M_LIBRARY)
-    message(STATUS
-      "math library 'libm' not found - floating point support disabled")
+    message(STATUS "math lib 'libm' not found; floating point support disabled")
  endif()
 else()
  # not needed on windows
@@ -39,22 +38,14 @@ else()
 endif()

 # COMMAND LINE OPTIONS
-if(DEFINED PNG_SHARED)
-  option(PNG_SHARED "Build shared lib" ${PNG_SHARED})
-else()
-  option(PNG_SHARED "Build shared lib" ON)
-endif()
-if(DEFINED PNG_STATIC)
-  option(PNG_STATIC "Build static lib" ${PNG_STATIC})
-else()
-  option(PNG_STATIC "Build static lib" ON)
-endif()
-
-option(PNG_TESTS  "Build libpng tests" YES)
+option(PNG_SHARED "Build shared lib" ON)
+option(PNG_STATIC "Build static lib" ON)
+option(PNG_TESTS  "Build libpng tests" ON)

 # Many more configuration options could be added here
-option(PNG_DEBUG         "Build with debug output" NO)
-option(PNGARG            "Disable ANSI-C prototypes" NO)
+option(PNG_FRAMEWORK "Build OS X framework" OFF)
+option(PNG_DEBUG     "Build with debug output" OFF)
+option(PNGARG        "Disable ANSI-C prototypes" OFF)

 # SET LIBNAME
 set(PNG_LIB_NAME png${PNGLIB_MAJOR}${PNGLIB_MINOR})
@@ -134,7 +125,7 @@ if(PNG_SHARED)
 endif()

 if(PNG_STATIC)
-# does not work without changing name
+  # does not work without changing name
  set(PNG_LIB_NAME_STATIC ${PNG_LIB_NAME}_static)
  add_library(${PNG_LIB_NAME_STATIC} STATIC ${libpng_sources})
  list(APPEND PNG_LIB_TARGETS ${PNG_LIB_NAME_STATIC})
@@ -145,10 +136,27 @@ if(PNG_STATIC)
  target_link_libraries(${PNG_LIB_NAME_STATIC} ${ZLIB_LIBRARY} ${M_LIBRARY})
 endif()

+if(PNG_FRAMEWORK)
+  set(PNG_LIB_NAME_FRAMEWORK ${PNG_LIB_NAME}_framework)
+  add_library(${PNG_LIB_NAME_FRAMEWORK} SHARED ${libpng_sources})
+  list(APPEND PNG_LIB_TARGETS ${PNG_LIB_NAME_FRAMEWORK})
+  set_target_properties(${PNG_LIB_NAME_FRAMEWORK} PROPERTIES
+    FRAMEWORK TRUE
+    FRAMEWORK_VERSION ${PNGLIB_VERSION}
+    MACOSX_FRAMEWORK_SHORT_VERSION_STRING ${PNGLIB_MAJOR}.${PNGLIB_MINOR}
+    MACOSX_FRAMEWORK_BUNDLE_VERSION ${PNGLIB_VERSION}
+    MACOSX_FRAMEWORK_IDENTIFIER org.libpng.libpng
+    XCODE_ATTRIBUTE_INSTALL_PATH "@rpath"
+    PUBLIC_HEADER "${libpng_public_hdrs}"
+    OUTPUT_NAME png)
+  target_link_libraries(${PNG_LIB_NAME_FRAMEWORK} ${ZLIB_LIBRARY} ${M_LIBRARY})
+endif()
+
 if(NOT PNG_LIB_TARGETS)
  message(SEND_ERROR
    "No library variant selected to build. "
-    "Please enable at least one of the following options: PNG_STATIC, PNG_SHARED")
+    "Please enable at least one of the following options: "
+    " PNG_STATIC, PNG_SHARED, PNG_FRAMEWORK")
 endif()

 if(PNG_SHARED AND WIN32)
@@ -253,7 +261,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW)
 # SET UP LINKS
 if(PNG_SHARED)
  set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 16.${PNGLIB_RELEASE}.1.6.16beta01
+#   VERSION 16.${PNGLIB_RELEASE}.1.6.18
    VERSION 16.${PNGLIB_RELEASE}.0
    SOVERSION 16
    CLEAN_DIRECT_OUTPUT 1)
@@ -284,7 +292,8 @@ if(NOT SKIP_INSTALL_LIBRARIES AND NOT SKIP_INSTALL_ALL )
      ${PNG_EXPORT_RULE}
      RUNTIME DESTINATION bin
      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
-      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR})
+      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+      FRAMEWORK DESTINATION ${CMAKE_INSTALL_LIBDIR})

  if(PNG_SHARED)
    # Create a symlink for libpng.dll.a => libpng16.dll.a on Cygwin
--- a/11
+++ b/11
@@ -17,7 +17,7 @@ VIII. Configuring libpng for 16-bit platforms
 XII. Configuring for compiler xxx:
 XIII. Removing unwanted object code
 XIV. Changes to the build and configuration of libpng in libpng-1.5.x
-  XV. Configuring libpng for multiprocessing
+  XV. Setjmp/longjmp issues
 XVI. Other sources of information about libpng

 I. Simple installation
@@ -189,7 +189,7 @@ run "make install".
 VIII. Configuring libpng for 16-bit platforms

 You will want to look into zconf.h to tell zlib (and thus libpng) that
-it cannot allocate more then 64K at a time.  Even if you can, the memory
+it cannot allocate more than 64K at a time.  Even if you can, the memory
 won't be accessible.  So limit zlib and libpng to 64K by defining MAXSEG_64K.

 IX. Configuring for DOS
@@ -362,7 +362,7 @@ $PREFIX/include directory).  Do not edit pnglibconf.h after you have built
 libpng, because than the settings would not accurately reflect the settings
 that were used to build libpng.

-XV. Configuring libpng for multiprocessing
+XV. Setjmp/longjmp issues

 Libpng uses setjmp()/longjmp() for error handling.  Unfortunately setjmp()
 is known to be not thread-safe on some platforms and we don't know of
@@ -375,6 +375,11 @@ configure libpng with PNG_NO_SETJMP in your pngusr.dfa file, with

 in your pnglibconf.h or pngusr.h.

+Starting with libpng-1.6.0, the library included a "simplified API".
+This requires setjmp/longjmp, so you must either build the library
+with PNG_SETJMP_SUPPORTED defined, or with PNG_SIMPLIFIED_READ_SUPPORTED
+and PNG_SIMPLIFIED_WRITE_SUPPORTED undefined.
+
 XVI. Other sources of information about libpng:

 Further information can be found in the README and libpng-manual.txt
--- a/48
+++ b/48
@@ -10,21 +10,17 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.2.6, August 15, 2004, through 1.6.16beta01, December 14, 2014, are
-Copyright (c) 2004, 2006-2014 Glenn Randers-Pehrson, and are
-distributed according to the same disclaimer and license as libpng-1.2.5
-with the following individual added to the list of Contributing Authors
-
-   Cosmin Truta
-
-libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are
-Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are
+libpng versions 1.0.7, July 1, 2000, through 1.6.18, July 23, 2015, are
+Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.0.6
-with the following individuals added to the list of Contributing Authors
+with the following individuals added to the list of Contributing Authors:

   Simon-Pierre Cadieux
   Eric S. Raymond
+   Mans Rullgard
+   Cosmin Truta
   Gilles Vollant
+   James Yu

 and with the following additions to the disclaimer:

@@ -36,17 +32,17 @@ and with the following additions to the disclaimer:
   the user.

 libpng versions 0.97, January 1998, through 1.0.6, March 20, 2000, are
-Copyright (c) 1998, 1999 Glenn Randers-Pehrson, and are
-distributed according to the same disclaimer and license as libpng-0.96,
-with the following individuals added to the list of Contributing Authors:
+Copyright (c) 1998-2000 Glenn Randers-Pehrson, and are distributed according
+to the same disclaimer and license as libpng-0.96, with the following
+individuals added to the list of Contributing Authors:

   Tom Lane
   Glenn Randers-Pehrson
   Willem van Schaik

 libpng versions 0.89, June 1996, through 0.96, May 1997, are
-Copyright (c) 1996, 1997 Andreas Dilger
-Distributed according to the same disclaimer and license as libpng-0.88,
+Copyright (c) 1996-1997 Andreas Dilger, and are
+distributed according to the same disclaimer and license as libpng-0.88,
 with the following individuals added to the list of Contributing Authors:

   John Bowler
@@ -57,7 +53,7 @@ with the following individuals added to the list of Contributing Authors:
   Tom Tanner

 libpng versions 0.5, May 1995, through 0.88, January 1996, are
-Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.
+Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.

 For the purposes of this copyright and license, "Contributing Authors"
 is defined as the following set of individuals:
@@ -80,13 +76,13 @@ Permission is hereby granted to use, copy, modify, and distribute this
 source code, or portions hereof, for any purpose, without fee, subject
 to the following restrictions:

-1. The origin of this source code must not be misrepresented.
+  1. The origin of this source code must not be misrepresented.

-2. Altered versions must be plainly marked as such and must not
-   be misrepresented as being the original source.
+  2. Altered versions must be plainly marked as such and must not
+     be misrepresented as being the original source.

-3. This Copyright notice may not be removed or altered from any
-   source or altered source distribution.
+  3. This Copyright notice may not be removed or altered from any
+     source or altered source distribution.

 The Contributing Authors and Group 42, Inc. specifically permit, without
 fee, and encourage the use of this source code as a component to
@@ -94,18 +90,18 @@ supporting the PNG file format in commercial products.  If you use this
 source code in a product, acknowledgment is not required but would be
 appreciated.

-
 A "png_get_copyright" function is available, for convenient use in "about"
 boxes and the like:

-   printf("%s",png_get_copyright(NULL));
+   printf("%s", png_get_copyright(NULL));

 Also, the PNG logo (in PNG format, of course) is supplied in the
 files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31).

-Libpng is OSI Certified Open Source Software.  OSI Certified Open Source is a
-certification mark of the Open Source Initiative.
+Libpng is OSI Certified Open Source Software.  OSI Certified Open Source is
+a certification mark of the Open Source Initiative. OSI has not addressed
+the additional disclaimers inserted at version 1.0.7.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-December 14, 2014
+July 23, 2015
--- a/Makefile.am
+++ b/Makefile.am
@@ -129,11 +129,12 @@ EXTRA_DIST= \
 	$(TESTS) $(XFAIL_TESTS) tests/pngstest \
 	CMakeLists.txt example.c libpng-manual.txt

-SCRIPT_CLEANFILES=scripts/*.out scripts/*.chk scripts/pnglibconf.dfn
+SCRIPT_CLEANFILES=scripts/*.out scripts/*.chk

 CLEANFILES= *.tf? pngout.png libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc \
 	libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@-config libpng.vers libpng.sym \
-	check.new pnglibconf.* pngprefix.h symbols.new pngtest-log.txt \
+	check.new pnglibconf.h pngprefix.h symbols.new pngtest-log.txt \
+	pnglibconf.out pnglibconf.c pnglibconf.pre pnglibconf.dfn \
 	$(SCRIPT_CLEANFILES)

 MAINTAINERCLEANFILES = Makefile.in aclocal.m4 config.guess config.h.in \
@@ -152,7 +153,7 @@ AM_CFLAGS = ${PNG_COPTS}
 # checks for this and sets DFNCPP appropriately.
 DFNCPP = @DFNCPP@

-SUFFIXES = .chk .dfn .out
+SUFFIXES = .chk .out

 $(PNGLIB_BASENAME).pc: libpng.pc
 	cp libpng.pc $@
@@ -237,18 +238,17 @@ if DO_PNG_PREFIX
 SYMBOL_CFLAGS += -DPNG_PREFIX='@PNG_PREFIX@'
 endif

-.dfn.out:
-	rm -f $@ $*.c $*.tf[12]
+.c.out:
+	rm -f $@ $*.tf[12]
 	test -d scripts || mkdir scripts || test -d scripts
-	cp "$<" $*.c
 	$(DFNCPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES)\
-	    $(CPPFLAGS) $(SYMBOL_CFLAGS) $*.c > $*.tf1
+	    $(CPPFLAGS) $(SYMBOL_CFLAGS) $< > $*.tf1
 	$(AWK) -f "${srcdir}/scripts/dfn.awk" out="$*.tf2" $*.tf1 1>&2
-	rm -f $*.c $*.tf1
+	rm -f $*.tf1
 	mv $*.tf2 $@

-# The .dfn file for pnglibconf.h is machine generated
-pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h pngusr.dfa $(DFA_XTRA)
+# The .c file for pnglibconf.h is machine generated
+pnglibconf.c: scripts/pnglibconf.dfa scripts/options.awk pngconf.h pngusr.dfa $(DFA_XTRA)
 	rm -f $@ $*.tf[45]
 	$(AWK) -f ${srcdir}/scripts/options.awk out=$*.tf4 version=search\
 	    ${srcdir}/pngconf.h ${srcdir}/scripts/pnglibconf.dfa\
@@ -268,7 +268,7 @@ scripts/symbols.chk: scripts/checksym.awk scripts/symbols.def scripts/symbols.ou

 # used on demand to regenerate the standard header, CPPFLAGS should
 # be empty - no non-standard defines
-scripts/pnglibconf.dfn: scripts/pnglibconf.dfa scripts/options.awk pngconf.h
+scripts/pnglibconf.c: scripts/pnglibconf.dfa scripts/options.awk pngconf.h
 	rm -f $@ pnglibconf.tf[67]
 	test -z "$(CPPFLAGS)"
 	echo "com @PNGLIB_VERSION@ STANDARD API DEFINITION" |\
--- a/4
+++ b/4
@@ -1,4 +1,4 @@
-README for libpng version 1.6.16beta01 - December 14, 2014 (shared library 16.0)
+README for libpng version 1.6.18 - July 23, 2015 (shared library 16.0)
 See the note about version numbers near the top of png.h

 See INSTALL for instructions on how to install libpng.
@@ -134,7 +134,7 @@ and ...".  If in doubt, send questions to me.  I'll bounce them
 to others, if necessary.

 Please do not send suggestions on how to change PNG.  We have
-been discussing PNG for nineteen years now, and it is official and
+been discussing PNG for twenty years now, and it is official and
 finished.  If you have suggestions for libpng, however, I'll
 gladly listen.  Even if your suggestion is not used immediately,
 it may be used later.
--- a/arm/arm_init.c
+++ b/arm/arm_init.c
@@ -3,7 +3,7 @@
 *
 * Copyright (c) 2014 Glenn Randers-Pehrson
 * Written by Mans Rullgard, 2011.
- * Last changed in libpng 1.6.16 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.16 [December 22, 2014]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
--- a/arm/filter_neon.S
+++ b/arm/filter_neon.S
@@ -3,7 +3,7 @@
 *
 * Copyright (c) 2014 Glenn Randers-Pehrson
 * Written by Mans Rullgard, 2011.
- * Last changed in libpng 1.6.16 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.16 [December 22, 2014]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
--- a/arm/filter_neon_intrinsics.c
+++ b/arm/filter_neon_intrinsics.c
@@ -5,7 +5,7 @@
 * Written by James Yu <james.yu at linaro.org>, October 2013.
 * Based on filter_neon.S, written by Mans Rullgard, 2011.
 *
- * Last changed in libpng 1.6.16 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.16 [December 22, 2014]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
--- a/autogen.sh
+++ b/autogen.sh
@@ -73,8 +73,9 @@ done
 # present bad things are happening.
 #
 # The autotools generated files:
-libpng_autotools_files="Makefile.in aclocal.m4 config.guess config.h.in\
-   config.sub configure depcomp install-sh ltmain.sh missing test-driver"
+libpng_autotools_files="Makefile.in aclocal.m4 config.guess config.h.in
+   config.h.in~ config.sub configure depcomp install-sh ltmain.sh missing\
+   test-driver"
 #
 # Files generated by versions of configue >2.68 or automake >1.13 (i.e. later
 # versions than those required by configure.ac):
--- a/configure.ac
+++ b/configure.ac
@@ -18,7 +18,7 @@ AC_PREREQ([2.68])

 dnl Version number stuff here:

-AC_INIT([libpng],[1.6.16beta01],[png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng],[1.6.18],[png-mng-implement@lists.sourceforge.net])
 AC_CONFIG_MACRO_DIR([scripts])

 # libpng does not follow GNU file name conventions (hence 'foreign')
@@ -39,10 +39,10 @@ dnl automake, so the following is not necessary (and is not defined anyway):
 dnl AM_PREREQ([1.11.2])
 dnl stop configure from automagically running automake

-PNGLIB_VERSION=1.6.16beta01
+PNGLIB_VERSION=1.6.18
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=6
-PNGLIB_RELEASE=16
+PNGLIB_RELEASE=18

 dnl End of version number stuff

--- a/contrib/arm-neon/README
+++ b/contrib/arm-neon/README
@@ -1,7 +1,7 @@
 OPERATING SYSTEM SPECIFIC ARM NEON DETECTION
 --------------------------------------------

-Detection of the ability to exexcute ARM NEON on an ARM processor requires
+Detection of the ability to execute ARM NEON on an ARM processor requires
 operating system support.  (The information is not available in user mode.)

 HOW TO USE THIS
--- a/contrib/arm-neon/linux.c
+++ b/contrib/arm-neon/linux.c
@@ -2,7 +2,7 @@
 *
 * Copyright (c) 2014 Glenn Randers-Pehrson
 * Written by John Bowler, 2014.
- * Last changed in libpng 1.6.16 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.16 [December 22, 2014]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
--- a/contrib/examples/iccfrompng.c
+++ b/contrib/examples/iccfrompng.c
@@ -26,6 +26,10 @@

 #include <png.h>

+#if defined(PNG_READ_SUPPORTED) && defined(PNG_STDIO_SUPPORTED) && \
+    defined (PNG_iCCP_SUPPORTED)
+
+
 static int verbose = 1;
 static png_byte no_profile[] = "no profile";

@@ -178,3 +182,4 @@ main(int argc, char **argv)
   /* Exit code is true if any extract succeeds */
   return extracted == 0;
 }
+#endif /* READ && STDIO && iCCP */
--- a/contrib/examples/pngpixel.c
+++ b/contrib/examples/pngpixel.c
@@ -27,6 +27,8 @@
 */
 #include "../../png.h"

+#if defined(PNG_READ_SUPPORTED) && defined(PNG_SEQUENTIAL_READ_SUPPORTED)
+
 /* Return component 'c' of pixel 'x' from the given row. */
 static unsigned int
 component(png_const_bytep row, png_uint_32 x, unsigned int c,
@@ -366,3 +368,4 @@ int main(int argc, const char **argv)

   return result;
 }
+#endif /* READ && SEQUENTIAL_READ */
--- a/contrib/examples/pngtopng.c
+++ b/contrib/examples/pngtopng.c
@@ -20,6 +20,8 @@
 * ensure the code picks up the local libpng implementation:
 */
 #include "../../png.h"
+#if defined(PNG_SIMPLIFIED_READ_SUPPORTED) && \
+    defined(PNG_SIMPLIFIED_WRITE_SUPPORTED)

 int main(int argc, const char **argv)
 {
@@ -90,3 +92,4 @@ int main(int argc, const char **argv)

   return result;
 }
+#endif /* READ && WRITE */
--- a/contrib/examples/simpleover.c
+++ b/contrib/examples/simpleover.c
@@ -0,0 +1,648 @@
+/*- simpleover
+ *
+ * COPYRIGHT: Written by John Cunningham Bowler, 2015.
+ * To the extent possible under law, the author has waived all copyright and
+ * related or neighboring rights to this work.  This work is published from:
+ * United States.
+ *
+ * Read several PNG files, which should have an alpha channel or transparency
+ * information, and composite them together to produce one or more 16-bit linear
+ * RGBA intermediates.  This involves doing the correct 'over' composition to
+ * combine the alpha channels and corresponding data.
+ *
+ * Finally read an output (background) PNG using the 24-bit RGB format (the
+ * PNG will be composited on green (#00ff00) by default if it has an alpha
+ * channel), and apply the intermediate image generated above to specified
+ * locations in the image.
+ *
+ * The command line has the general format:
+ *
+ *    simpleover <background.png> [output.png]
+ *        {--sprite=width,height,name {[--at=x,y] {sprite.png}}}
+ *        {--add=name {x,y}}
+ *
+ * The --sprite and --add options may occur multiple times. They are executed
+ * in order.  --add may refer to any sprite already read.
+ *
+ * This code is intended to show how to composite multiple images together
+ * correctly.  Apart from the libpng Simplified API the only work done in here
+ * is to combine multiple input PNG images into a single sprite; this involves
+ * a Porter-Duff 'over' operation and the input PNG images may, as a result,
+ * be regarded as being layered one on top of the other with the first (leftmost
+ * on the command line) being at the bottom and the last on the top.
+ */
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+#include <errno.h>
+
+/* Normally use <png.h> here to get the installed libpng, but this is done to
+ * ensure the code picks up the local libpng implementation, so long as this
+ * file is linked against a sufficiently recent libpng (1.6+) it is ok to
+ * change this to <png.h>:
+ */
+#include "../../png.h"
+
+#ifdef PNG_SIMPLIFIED_READ_SUPPORTED
+
+#define sprite_name_chars 15
+struct sprite {
+   FILE         *file;
+   png_uint_16p  buffer;
+   unsigned int  width;
+   unsigned int  height;
+   char          name[sprite_name_chars+1];
+};
+
+#if 0 /* div by 65535 test program */
+#include <math.h>
+#include <stdio.h>
+
+int main(void) {
+   double err = 0;
+   unsigned int xerr = 0;
+   unsigned int r = 32769;
+   {
+      unsigned int x = 0;
+
+      do {
+         unsigned int t = x + (x >> 16) /*+ (x >> 31)*/ + r;
+         double v = x, errtest;
+
+         if (t < x) {
+            fprintf(stderr, "overflow: %u+%u -> %u\n", x, r, t);
+            return 1;
+         }
+
+         v /= 65535;
+         errtest = v;
+         t >>= 16;
+         errtest -= t;
+
+         if (errtest > err) {
+            err = errtest;
+            xerr = x;
+
+            if (errtest >= .5) {
+               fprintf(stderr, "error: %u/65535 = %f, not %u, error %f\n",
+                     x, v, t, errtest);
+               return 0;
+            }
+         }
+      } while (++x <= 65535U*65535U);
+   }
+
+   printf("error %f @ %u\n", err, xerr);
+
+   return 0;
+}
+#endif /* div by 65535 test program */
+
+static void
+sprite_op(const struct sprite *sprite, int x_offset, int y_offset,
+   png_imagep image, const png_uint_16 *buffer)
+{
+   /* This is where the Porter-Duff 'Over' operator is evaluated; change this
+    * code to change the operator (this could be parameterized).  Any other
+    * image processing operation could be used here.
+    */
+
+
+   /* Check for an x or y offset that pushes any part of the image beyond the
+    * right or bottom of the sprite:
+    */
+   if ((y_offset < 0 || (unsigned)/*SAFE*/y_offset < sprite->height) &&
+       (x_offset < 0 || (unsigned)/*SAFE*/x_offset < sprite->width))
+   {
+      unsigned int y = 0;
+
+      if (y_offset < 0)
+         y = -y_offset; /* Skip to first visible row */
+
+      do
+      {
+         unsigned int x = 0;
+
+         if (x_offset < 0)
+            x = -x_offset;
+
+         do
+         {
+            /* In and out are RGBA values, so: */
+            const png_uint_16 *in_pixel = buffer + (y * image->width + x)*4;
+            png_uint_32 in_alpha = in_pixel[3];
+
+            /* This is the optimized Porter-Duff 'Over' operation, when the
+             * input alpha is 0 the output is not changed.
+             */
+            if (in_alpha > 0) 
+            {
+               png_uint_16 *out_pixel = sprite->buffer +
+                  ((y+y_offset) * sprite->width + (x+x_offset))*4;
+
+               /* This is the weight to apply to the output: */
+               in_alpha = 65535-in_alpha;
+
+               if (in_alpha > 0)
+               {
+                  /* The input must be composed onto the output. This means
+                   * multiplying the current output pixel value by the inverse
+                   * of the input alpha (1-alpha). A division is required but
+                   * it is by the constant 65535.  Approximate this as:
+                   *
+                   *     (x + (x >> 16) + 32769) >> 16;
+                   *
+                   * This is exact (and does not overflow) for all values of
+                   * x in the range 0..65535*65535.  (Note that the calculation
+                   * produces the closest integer; the maximum error is <0.5).
+                   */
+                  png_uint_32 tmp;
+
+#                 define compose(c)\
+                     tmp = out_pixel[c] * in_alpha;\
+                     tmp = (tmp + (tmp >> 16) + 32769) >> 16;\
+                     out_pixel[c] = tmp + in_pixel[c]
+
+                  /* The following is very vectorizable... */
+                  compose(0);
+                  compose(1);
+                  compose(2);
+                  compose(3);
+               }
+
+               else
+                  out_pixel[0] = in_pixel[0],
+                  out_pixel[1] = in_pixel[1],
+                  out_pixel[2] = in_pixel[2],
+                  out_pixel[3] = in_pixel[3];
+            }
+         }
+         while (++x < image->width);
+      }
+      while (++y < image->height);
+   }
+}
+
+static int 
+create_sprite(struct sprite *sprite, int *argc, const char ***argv)
+{
+   /* Read the arguments and create this sprite. The sprite buffer has already
+    * been allocated. This reads the input PNGs one by one in linear format,
+    * composes them onto the sprite buffer (the code in the function above)
+    * then saves the result, converting it on the fly to PNG RGBA 8-bit format.
+    */
+   while (*argc > 0)
+   {
+      char tombstone;
+      int x = 0, y = 0;
+
+      if ((*argv)[0][0] == '-' && (*argv)[0][1] == '-')
+      {
+         /* The only supported option is --at. */
+         if (sscanf((*argv)[0], "--at=%d,%d%c", &x, &y, &tombstone) != 2)
+            break; /* success; caller will parse this option */
+
+         ++*argv, --*argc;
+      }
+
+      else
+      {
+         /* The argument has to be a file name */
+         png_image image;
+
+         image.version = PNG_IMAGE_VERSION;
+         image.opaque = NULL;
+
+         if (png_image_begin_read_from_file(&image, (*argv)[0]))
+         {
+            png_uint_16p buffer;
+
+            image.format = PNG_FORMAT_LINEAR_RGB_ALPHA;
+
+            buffer = malloc(PNG_IMAGE_SIZE(image));
+
+            if (buffer != NULL)
+            {
+               if (png_image_finish_read(&image, NULL/*background*/, buffer,
+                  0/*row_stride*/,
+                  NULL/*colormap for PNG_FORMAT_FLAG_COLORMAP*/))
+               {
+                  /* This is the place where the Porter-Duff 'Over' operator
+                   * needs to be done by this code.  In fact, any image
+                   * processing required can be done here; the data is in
+                   * the correct format (linear, 16-bit) and source and
+                   * destination are in memory.
+                   */
+                  sprite_op(sprite, x, y, &image, buffer);
+                  free(buffer);
+                  ++*argv, --*argc;
+                  /* And continue to the next argument */
+                  continue;
+               }
+
+               else
+               {
+                  free(buffer);
+                  fprintf(stderr, "simpleover: read %s: %s\n", (*argv)[0],
+                      image.message);
+               }
+            }
+
+            else
+            {
+               fprintf(stderr, "simpleover: out of memory: %lu bytes\n",
+                  (unsigned long)PNG_IMAGE_SIZE(image));
+
+               /* png_image_free must be called if we abort the Simplified API
+                * read because of a problem detected in this code.  If problems
+                * are detected in the Simplified API it cleans up itself.
+                */
+               png_image_free(&image);
+            }
+         }
+
+         else
+         {
+            /* Failed to read the first argument: */
+            fprintf(stderr, "simpleover: %s: %s\n", (*argv)[0], image.message);
+         }
+
+         return 0; /* failure */
+      }
+   }
+
+   /* All the sprite operations have completed successfully. Save the RGBA
+    * buffer as a PNG using the simplified write API.
+    */
+   sprite->file = tmpfile();
+
+   if (sprite->file != NULL)
+   {
+      png_image save;
+
+      memset(&save, 0, sizeof save);
+      save.version = PNG_IMAGE_VERSION;
+      save.opaque = NULL;
+      save.width = sprite->width;
+      save.height = sprite->height;
+      save.format = PNG_FORMAT_LINEAR_RGB_ALPHA;
+      save.flags = PNG_IMAGE_FLAG_FAST;
+      save.colormap_entries = 0;
+
+      if (png_image_write_to_stdio(&save, sprite->file, 1/*convert_to_8_bit*/,
+          sprite->buffer, 0/*row_stride*/, NULL/*colormap*/))
+      {
+         /* Success; the buffer is no longer needed: */
+         free(sprite->buffer);
+         sprite->buffer = NULL;
+         return 1; /* ok */
+      }
+
+      else
+         fprintf(stderr, "simpleover: write sprite %s: %s\n", sprite->name,
+            save.message);
+   }
+
+   else
+      fprintf(stderr, "simpleover: sprite %s: could not allocate tmpfile: %s\n",
+         sprite->name, strerror(errno));
+
+   return 0; /* fail */
+}
+
+static int
+add_sprite(png_imagep output, png_bytep out_buf, struct sprite *sprite,
+   int *argc, const char ***argv)
+{
+   /* Given a --add argument naming this sprite, perform the operations listed
+    * in the following arguments.  The arguments are expected to have the form
+    * (x,y), which is just an offset at which to add the sprite to the
+    * output.
+    */
+   while (*argc > 0)
+   {
+      char tombstone;
+      int x, y;
+
+      if ((*argv)[0][0] == '-' && (*argv)[0][1] == '-')
+         return 1; /* success */
+
+      if (sscanf((*argv)[0], "%d,%d%c", &x, &y, &tombstone) == 2)
+      {
+         /* Now add the new image into the sprite data, but only if it
+          * will fit.
+          */
+         if (x < 0 || y < 0 ||
+             (unsigned)/*SAFE*/x >= output->width ||
+             (unsigned)/*SAFE*/y >= output->height ||
+             sprite->width > output->width-x ||
+             sprite->height > output->height-y)
+         {
+            fprintf(stderr, "simpleover: sprite %s @ (%d,%d) outside image\n",
+               sprite->name, x, y);
+            /* Could just skip this, but for the moment it is an error */
+            return 0; /* error */
+         }
+
+         else
+         {
+            /* Since we know the sprite fits we can just read it into the
+             * output using the simplified API.
+             */
+            png_image in;
+
+            in.version = PNG_IMAGE_VERSION;
+            rewind(sprite->file);
+
+            if (png_image_begin_read_from_stdio(&in, sprite->file))
+            {
+               in.format = PNG_FORMAT_RGB; /* force compose */
+
+               if (png_image_finish_read(&in, NULL/*background*/,
+                  out_buf + (y*output->width + x)*3/*RGB*/,
+                  output->width*3/*row_stride*/,
+                  NULL/*colormap for PNG_FORMAT_FLAG_COLORMAP*/))
+               {
+                  ++*argv, --*argc;
+                  continue;
+               }
+            }
+
+            /* The read failed: */
+            fprintf(stderr, "simpleover: add sprite %s: %s\n", sprite->name,
+                in.message);
+            return 0; /* error */
+         }
+      }
+
+      else
+      {
+         fprintf(stderr, "simpleover: --add='%s': invalid position %s\n",
+               sprite->name, (*argv)[0]);
+         return 0; /* error */
+      }
+   }
+
+   return 1; /* ok */
+}
+
+static int
+simpleover_process(png_imagep output, png_bytep out_buf, int argc,
+   const char **argv)
+{
+   int result = 1; /* success */
+#  define csprites 10/*limit*/
+#  define str(a) #a
+   int nsprites = 0;
+   struct sprite sprites[csprites];
+
+   while (argc > 0)
+   {
+      result = 0; /* fail */
+
+      if (strncmp(argv[0], "--sprite=", 9) == 0)
+      {
+         char tombstone;
+
+         if (nsprites < csprites)
+         {
+            int n;
+
+            sprites[nsprites].width = sprites[nsprites].height = 0;
+            sprites[nsprites].name[0] = 0;
+
+            n = sscanf(argv[0], "--sprite=%u,%u,%" str(sprite_name_chars) "s%c",
+                &sprites[nsprites].width, &sprites[nsprites].height,
+                sprites[nsprites].name, &tombstone);
+            
+            if ((n == 2 || n == 3) &&
+                sprites[nsprites].width > 0 && sprites[nsprites].height > 0)
+            {
+               size_t buf_size, tmp;
+
+               /* Default a name if not given. */
+               if (sprites[nsprites].name[0] == 0)
+                  sprintf(sprites[nsprites].name, "sprite-%d", nsprites+1);
+
+               /* Allocate a buffer for the sprite and calculate the buffer
+                * size:
+                */
+               buf_size = sizeof (png_uint_16 [4]);
+               buf_size *= sprites[nsprites].width;
+               buf_size *= sprites[nsprites].height;
+
+               /* This can overflow a (size_t); check for this: */
+               tmp = buf_size;
+               tmp /= sprites[nsprites].width;
+               tmp /= sprites[nsprites].height;
+
+               if (tmp == sizeof (png_uint_16 [4]))
+               {
+                  sprites[nsprites].buffer = malloc(buf_size);
+                  /* This buffer must be initialized to transparent: */
+                  memset(sprites[nsprites].buffer, 0, buf_size);
+
+                  if (sprites[nsprites].buffer != NULL)
+                  {
+                     sprites[nsprites].file = NULL;
+                     ++argv, --argc;
+
+                     if (create_sprite(sprites+nsprites++, &argc, &argv))
+                     {
+                        result = 1; /* still ok */
+                        continue;
+                     }
+
+                     break; /* error */
+                  }
+               }
+
+               /* Overflow, or OOM */
+               fprintf(stderr, "simpleover: %s: sprite too large\n", argv[0]);
+               break;
+            }
+
+            else
+            {
+               fprintf(stderr, "simpleover: %s: invalid sprite (%u,%u)\n",
+                  argv[0], sprites[nsprites].width, sprites[nsprites].height);
+               break;
+            }
+         }
+
+         else
+         {
+            fprintf(stderr, "simpleover: %s: too many sprites\n", argv[0]);
+            break;
+         }
+      }
+
+      else if (strncmp(argv[0], "--add=", 6) == 0)
+      {
+         const char *name = argv[0]+6;
+         int isprite = nsprites;
+
+         ++argv, --argc;
+
+         while (--isprite >= 0)
+         {
+            if (strcmp(sprites[isprite].name, name) == 0)
+            {
+               if (!add_sprite(output, out_buf, sprites+isprite, &argc, &argv))
+                  goto out; /* error in add_sprite */
+
+               break; 
+            }
+         }
+
+         if (isprite < 0) /* sprite not found */
+         {
+            fprintf(stderr, "simpleover: --add='%s': sprite not found\n", name);
+            break;
+         }
+      }
+
+      else
+      {
+         fprintf(stderr, "simpleover: %s: unrecognized operation\n", argv[0]);
+         break;
+      }
+
+      result = 1; /* ok  */
+   }
+
+   /* Clean up the cache of sprites: */
+out:
+   while (--nsprites >= 0)
+   {
+      if (sprites[nsprites].buffer != NULL)
+         free(sprites[nsprites].buffer);
+
+      if (sprites[nsprites].file != NULL)
+         (void)fclose(sprites[nsprites].file);
+   }
+
+   return result;
+}
+
+int main(int argc, const char **argv)
+{
+   int result = 1; /* default to fail */
+
+   if (argc >= 2)
+   {
+      int argi = 2;
+      const char *output = NULL;
+      png_image image;
+
+      if (argc > 2 && argv[2][0] != '-'/*an operation*/)
+      {
+         output = argv[2];
+         argi = 3;
+      }
+
+      image.version = PNG_IMAGE_VERSION;
+      image.opaque = NULL;
+
+      if (png_image_begin_read_from_file(&image, argv[1]))
+      {
+         png_bytep buffer;
+
+         image.format = PNG_FORMAT_RGB; /* 24-bit RGB */
+
+         buffer = malloc(PNG_IMAGE_SIZE(image));
+
+         if (buffer != NULL)
+         {
+            png_color background = {0, 0xff, 0}; /* fully saturated green */
+
+            if (png_image_finish_read(&image, &background, buffer,
+               0/*row_stride*/, NULL/*colormap for PNG_FORMAT_FLAG_COLORMAP */))
+            {
+               /* At this point png_image_finish_read has cleaned up the
+                * allocated data in png_image, and only the buffer needs to be
+                * freed.
+                *
+                * Perform the remaining operations:
+                */
+               if (simpleover_process(&image, buffer, argc-argi, argv+argi))
+               {
+                  /* Write the output: */
+                  if ((output != NULL &&
+                       png_image_write_to_file(&image, output,
+                        0/*convert_to_8bit*/, buffer, 0/*row_stride*/,
+                        NULL/*colormap*/)) ||
+                      (output == NULL &&
+                       png_image_write_to_stdio(&image, stdout,
+                        0/*convert_to_8bit*/, buffer, 0/*row_stride*/,
+                        NULL/*colormap*/)))
+                     result = 0;
+
+                  else
+                     fprintf(stderr, "simpleover: write %s: %s\n",
+                        output == NULL ? "stdout" : output, image.message);
+               }
+
+               /* else simpleover_process writes an error message */
+            }
+
+            else
+               fprintf(stderr, "simpleover: read %s: %s\n", argv[1],
+                   image.message);
+
+            free(buffer);
+         }
+
+         else
+         {
+            fprintf(stderr, "simpleover: out of memory: %lu bytes\n",
+               (unsigned long)PNG_IMAGE_SIZE(image));
+
+            /* This is the only place where a 'free' is required; libpng does
+             * the cleanup on error and success, but in this case we couldn't
+             * complete the read because of running out of memory.
+             */
+            png_image_free(&image);
+         }
+      }
+
+      else
+      {
+         /* Failed to read the first argument: */
+         fprintf(stderr, "simpleover: %s: %s\n", argv[1], image.message);
+      }
+   }
+
+   else
+   {
+      /* Usage message */
+      fprintf(stderr,
+         "simpleover: usage: simpleover background.png [output.png]\n"
+         "  Output 'background.png' as a 24-bit RGB PNG file in 'output.png'\n"
+         "   or, if not given, stdout.  'background.png' will be composited\n"
+         "   on fully saturated green.\n"
+         "\n"
+         "  Optionally, before output, process additional PNG files:\n"
+         "\n"
+         "   --sprite=width,height,name {[--at=x,y] {sprite.png}}\n"
+         "    Produce a transparent sprite of size (width,height) and with\n"
+         "     name 'name'.\n"
+         "    For each sprite.png composite it using a Porter-Duff 'Over'\n"
+         "     operation at offset (x,y) in the sprite (defaulting to (0,0)).\n"
+         "     Input PNGs will be truncated to the area of the sprite.\n"
+         "\n"
+         "   --add='name' {x,y}\n"
+         "    Optionally, before output, composite a sprite, 'name', which\n"
+         "     must have been previously produced using --sprite, at each\n"
+         "     offset (x,y) in the output image.  Each sprite must fit\n"
+         "     completely within the output image.\n"
+         "\n"
+         "  PNG files are processed in the order they occur on the command\n"
+         "  line and thus the first PNG processed appears as the bottommost\n"
+         "  in the output image.\n");
+   }
+
+   return result;
+}
+#endif /* SIMPLIFIED_READ */
--- a/contrib/libtests/pngimage.c
+++ b/contrib/libtests/pngimage.c
@@ -1,8 +1,8 @@
 /* pngimage.c
 *
- * Copyright (c) 2014 John Cunningham Bowler
+ * Copyright (c) 2015 John Cunningham Bowler
 *
- * Last changed in libpng 1.6.10 [March 6, 2014]
+ * Last changed in libpng 1.6.18 [July 23, 2015]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -1120,8 +1120,8 @@ compare_read(struct display *dp, int applied_transforms)
         {
            int b;

-            case 16: /* Two bytes per component, bit-endian */
-               for (b = (bpp >> 4); b > 0; )
+            case 16: /* Two bytes per component, big-endian */
+               for (b = (bpp >> 4); b > 0; --b)
               {
                  unsigned int sig = (unsigned int)(0xffff0000 >> sig_bits[b]);

--- a/contrib/libtests/pngstest.c
+++ b/contrib/libtests/pngstest.c
@@ -1,9 +1,9 @@
 /*-
 * pngstest.c
 *
- * Copyright (c) 2013 John Cunningham Bowler
+ * Copyright (c) 2013-2015 John Cunningham Bowler
 *
- * Last changed in libpng 1.6.8 [December 19, 2013]
+ * Last changed in libpng 1.6.18 [July 23, 2015]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -615,7 +615,7 @@ freeimage(Image *image)

   if (image->tmpfile_name[0] != 0 && (image->opts & KEEP_TMPFILES) == 0)
   {
-      remove(image->tmpfile_name);
+      (void)remove(image->tmpfile_name);
      image->tmpfile_name[0] = 0;
   }
 }
@@ -2828,7 +2828,7 @@ compare_two_images(Image *a, Image *b, int via_linear,

            else if (y >= b->image.colormap_entries)
            {
-               if ((a->opts & ACCUMULATE) == 0)
+               if ((b->opts & ACCUMULATE) == 0)
                  {
                  char pindex[9];
                  sprintf(pindex, "%lu[%lu]", (unsigned long)y,
@@ -3173,32 +3173,45 @@ read_one_file(Image *image)
            {
               long int cb = ftell(f);

-               if (cb > 0 && (unsigned long int)cb < (size_t)~(size_t)0)
+               if (cb > 0)
               {
-                  png_bytep b = voidcast(png_bytep, malloc((size_t)cb));
-
-                  if (b != NULL)
+#ifndef __COVERITY__
+                  if ((unsigned long int)cb <= (size_t)~(size_t)0)
+#endif
                  {
-                     rewind(f);
+                     png_bytep b = voidcast(png_bytep, malloc((size_t)cb));

-                     if (fread(b, (size_t)cb, 1, f) == 1)
+                     if (b != NULL)
                     {
-                        fclose(f);
-                        image->input_memory_size = cb;
-                        image->input_memory = b;
+                        rewind(f);
+
+                        if (fread(b, (size_t)cb, 1, f) == 1)
+                        {
+                           fclose(f);
+                           image->input_memory_size = cb;
+                           image->input_memory = b;
+                        }
+
+                        else
+                        {
+                           free(b);
+                           return logclose(image, f, image->file_name,
+                              ": read failed: ");
+                        }
                     }

                     else
-                     {
-                        free(b);
                        return logclose(image, f, image->file_name,
-                           ": read failed: ");
-                     }
+                           ": out of memory: ");
                  }

                  else
                     return logclose(image, f, image->file_name,
-                        ": out of memory: ");
+                        ": file too big for this architecture: ");
+                     /* cb is the length of the file as a (long) and
+                      * this is greater than the maximum amount of
+                      * memory that can be requested from malloc.
+                      */
               }

               else if (cb == 0)
@@ -3232,8 +3245,41 @@ write_one_file(Image *output, Image *image, int convert_to_8bit)

   if (image->opts & USE_STDIO)
   {
+#ifndef PNG_USE_MKSTEMP
      FILE *f = tmpfile();
-
+#else
+      /* Experimental. Coverity says tmpfile() is insecure because it
+       * generates predictable names.
+       *
+       * It is possible to satisfy Coverity by using mkstemp(); however,
+       * any platform supporting mkstemp() undoubtedly has a secure tmpfile()
+       * implementation as well, and doesn't need the fix.  Note that
+       * the fix won't work on platforms that don't support mkstemp().
+       *
+       * https://www.securecoding.cert.org/confluence/display/c/
+       * FIO21-C.+Do+not+create+temporary+files+in+shared+directories
+       * says that most historic implementations of tmpfile() provide
+       * only a limited number of possible temporary file names
+       * (usually 26) before file names are recycled. That article also
+       * provides a secure solution that unfortunately depends upon mkstemp().
+       */
+      char tmpfile[] = "pngstest-XXXXXX";
+      int filedes;
+      FILE *f;
+      umask(0177);
+      filedes = mkstemp(tmpfile);
+      if (filedes < 0)
+        f = NULL;
+      else
+      {
+        f = fdopen(filedes,"w+");
+        /* Hide the filename immediately and ensure that the file does
+         * not exist after the program ends
+         */
+        (void) unlink(tmpfile);
+      }
+#endif
+      
      if (f != NULL)
      {
         if (png_image_write_to_stdio(&image->image, f, convert_to_8bit,
@@ -3577,7 +3623,7 @@ main(int argc, char **argv)
            }

            /* Safe: checked above */
-            strcpy(tmpf, argv[c]);
+            strncpy(tmpf, argv[c], sizeof (tmpf)-1);
         }

         else
--- a/contrib/libtests/pngunknown.c
+++ b/contrib/libtests/pngunknown.c
@@ -1242,4 +1242,4 @@ main(void)
   /* So the test is skipped: */
   return 77;
 }
-#endif /* SET_UNKNOWN_CHUNKS && READ*/
+#endif /* SET_UNKNOWN_CHUNKS && READ */
--- a/contrib/libtests/pngvalid.c
+++ b/contrib/libtests/pngvalid.c
--- a/contrib/tools/genpng.c
+++ b/contrib/tools/genpng.c
@@ -0,0 +1,867 @@
+/*- genpng
+ *
+ * COPYRIGHT: Written by John Cunningham Bowler, 2015.
+ * To the extent possible under law, the author has waived all copyright and
+ * related or neighboring rights to this work.  This work is published from:
+ * United States.
+ *
+ * Generate a PNG with an alpha channel, correctly.
+ *
+ * This is a test case generator; the resultant PNG files are only of interest
+ * to those of us who care about whether the edges of circles are green, red,
+ * or yellow.
+ *
+ * The program generates an RGB+Alpha PNG of a given size containing the given
+ * shapes on a transparent background:
+ *
+ *  genpng width height { shape }
+ *    shape ::= color width shape x1 y1 x2 y2
+ *
+ * 'color' is:
+ *
+ *  black white red green yellow blue brown purple pink orange gray cyan
+ *
+ * The point is to have colors that are linguistically meaningful plus that old
+ * bugbear of the department store dress murders, Cyan, the only color we argue
+ * about.
+ *
+ * 'shape' is:
+ *
+ *  circle: an ellipse
+ *  square: a rectangle
+ *  line: a straight line
+ *
+ * Each shape is followed by four numbers, these are two points in the output
+ * coordinate space (as real numbers) which describe the circle, square, or
+ * line.  The shape is filled if it is preceded by 'filled' (not valid for
+ * 'line') or is drawn with a line, in which case the width of the line must
+ * precede the shape.
+ *
+ * The whole set of information can be repeated as many times as desired:
+ *
+ *    shape ::= color width shape x1 y1 x2 y2
+ *
+ *    color ::= black|white|red|green|yellow|blue
+ *    color ::= brown|purple|pink|orange|gray|cyan
+ *    width ::= filled
+ *    width ::= <number>
+ *    shape ::= circle|square|line
+ *    x1    ::= <number>
+ *    x2    ::= <number>
+ *    y1    ::= <number>
+ *    y2    ::= <number>
+ *
+ * The output PNG is generated by down-sampling a 4x supersampled image using
+ * a bi-cubic filter.  The bi-cubic has a 2 (output) pixel width, so an 8x8
+ * array of super-sampled points contribute to each output pixel.  The value of
+ * a super-sampled point is found using an unfiltered, aliased, infinite
+ * precision image: Each shape from the last to the first is checked to see if
+ * the point is in the drawn area and, if it is, the color of the point is the
+ * color of the shape and the alpha is 1, if not the previous shape is checked.
+ *
+ * This is an aliased algorithm because no filtering is done; a point is either
+ * inside or outside each shape and 'close' points do not contribute to the
+ * sample.  The down-sampling is relied on to correct the error of not using
+ * a filter.
+ *
+ * The line end-caps are 'flat'; they go through the points.  The square line
+ * joins are mitres; the outside of the lines are continued to the point of
+ * intersection.
+ */
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+#include <math.h>
+
+/* Normally use <png.h> here to get the installed libpng, but this is done to
+ * ensure the code picks up the local libpng implementation:
+ */
+#include "../../png.h"
+
+#if defined(PNG_SIMPLIFIED_WRITE_SUPPORTED) && defined(PNG_STDIO_SUPPORTED)
+
+static const struct color
+{
+   const char *name;
+   double      red;
+   double      green;
+   double      blue;
+} colors[] =
+/* color ::= black|white|red|green|yellow|blue
+ * color ::= brown|purple|pink|orange|gray|cyan
+ */
+{
+   { "black",   0,    0,  0 },
+   { "white",   1,    1,  1 },
+   { "red",     1,    0,  0 },
+   { "green",   0,    1,  0 },
+   { "yellow",  1,    1,  0 },
+   { "blue",    0,    0,  1 },
+   { "brown",  .5, .125,  0 },
+   { "purple",  1,    0,  1 },
+   { "pink",    1,   .5, .5 },
+   { "orange",  1,   .5,  0 },
+   { "gray",    0,   .5, .5 },
+   { "cyan",    0,    1,  1 }
+};
+#define color_count ((sizeof colors)/(sizeof colors[0]))
+
+static const struct color *
+color_of(const char *arg)
+{
+   int icolor = color_count;
+
+   while (--icolor >= 0)
+   {
+      if (strcmp(colors[icolor].name, arg) == 0)
+         return colors+icolor;
+   }
+
+   fprintf(stderr, "genpng: invalid color %s\n", arg);
+   exit(1);
+}
+
+static double
+width_of(const char *arg)
+{
+   if (strcmp(arg, "filled") == 0)
+      return 0;
+
+   else
+   {
+      char *ep = NULL;
+      double w = strtod(arg, &ep);
+
+      if (ep != NULL && *ep == 0 && w > 0)
+         return w;
+   }
+
+   fprintf(stderr, "genpng: invalid line width %s\n", arg);
+   exit(1);
+}
+
+static double
+coordinate_of(const char *arg)
+{
+   char *ep = NULL;
+   double w = strtod(arg, &ep);
+
+   if (ep != NULL && *ep == 0)
+      return w;
+
+   fprintf(stderr, "genpng: invalid coordinate value %s\n", arg);
+   exit(1);
+}
+
+struct arg; /* forward declaration */
+
+typedef int (*shape_fn_ptr)(const struct arg *arg, double x, double y);
+   /* A function to determine if (x,y) is inside the shape.
+    *
+    * There are two implementations:
+    *
+    *    inside_fn: returns true if the point is inside
+    *    check_fn:  returns;
+    *       -1: the point is outside the shape by more than the filter width (2)
+    *        0: the point may be inside the shape
+    *       +1: the point is inside the shape by more than the filter width
+    */
+#define OUTSIDE (-1)
+#define INSIDE  (1)
+
+struct arg
+{
+   const struct color *color;
+   shape_fn_ptr        inside_fn;
+   shape_fn_ptr        check_fn;
+   double              width; /* line width, 0 for 'filled' */
+   double              x1, y1, x2, y2;
+};
+
+/* IMPLEMENTATION NOTE:
+ *
+ * We want the contribution of each shape to the sample corresponding to each
+ * pixel.  This could be obtained by super sampling the image to infinite
+ * dimensions, finding each point within the shape and assigning that a value
+ * '1' while leaving every point outside the shape with value '0' then
+ * downsampling to the image size with sinc; computationally very expensive.
+ *
+ * Approximations are as follows:
+ *
+ * 1) If the pixel coordinate is within the shape assume the sample has the
+ *    shape color and is opaque, else assume there is no contribution from
+ *    the shape.
+ *
+ *    This is the equivalent of aliased rendering or resampling an image with
+ *    a block filter.  The maximum error in the calculated alpha (which will
+ *    always be 0 or 1) is 0.5.
+ *
+ * 2) If the shape is within a square of size 1x1 centered on the pixel assume
+ *    that the shape obscures an amount of the pixel equal to its area within
+ *    that square.
+ *
+ *    This is the equivalent of 'pixel coverage' alpha calculation or resampling
+ *    an image with a bi-linear filter.  The maximum error is over 0.2, but the
+ *    results are often acceptable.
+ *
+ *    This can be approximated by applying (1) to a super-sampled image then
+ *    downsampling with a bi-linear filter.  The error in the super-sampled
+ *    image is 0.5 per sample, but the resampling reduces this.
+ *
+ * 3) Use a better filter with a super-sampled image; in the limit this is the
+ *    sinc() approach.
+ *
+ * 4) Do the geometric calculation; a bivariate definite integral across the
+ *    shape, unfortunately this means evaluating Si(x), the integral of sinc(x),
+ *    which is still a lot of math.
+ *
+ * This code uses approach (3) with a bi-cubic filter and 8x super-sampling
+ * and method (1) for the super-samples.  This means that the sample is either
+ * 0 or 1, depending on whether the sub-pixel is within or outside the shape.
+ * The bi-cubic weights are also fixed and the 16 required weights are
+ * pre-computed here (note that the 'scale' setting will need to be changed if
+ * 'super' is increased).
+ *
+ * The code also calculates a sum to the edge of the filter. This is not
+ * currently used by could be used to optimize the calculation.
+ */
+#if 0 /* bc code */
+scale=10
+super=8
+define bicubic(x) {
+   if (x <= 1) return (1.5*x - 2.5)*x*x + 1;
+   if (x <  2) return (((2.5 - 0.5*x)*x - 4)*x + 2);
+   return 0;
+}
+define sum(x) {
+   auto s;
+   s = 0;
+   while (x < 2*super) {
+      s = s + bicubic(x/super);
+      x = x + 1;
+   }
+   return s;
+}
+define results(x) {
+   auto b, s;
+   b = bicubic(x/super);
+   s = sum(x);
+
+   print "   /*", x, "*/ { ", b, ", ", s, " }";
+   return 1;
+}
+x=0
+while (x<2*super) {
+   x = x + results(x)
+   if (x < 2*super) print ","
+   print "\n"
+}
+quit
+#endif
+
+#define BICUBIC1(x) /*     |x| <= 1 */ ((1.5*(x)* - 2.5)*(x)*(x) + 1)
+#define BICUBIC2(x) /* 1 < |x| <  2 */ (((2.5 - 0.5*(x))*(x) - 4)*(x) + 2)
+#define FILTER_WEIGHT 9 /* Twice the first sum below */
+#define FILTER_WIDTH  2 /* Actually half the width; -2..+2 */
+#define FILTER_STEPS  8 /* steps per filter unit */
+static const double
+bicubic[16][2] =
+{
+   /* These numbers are exact; the weight for the filter is 1/9, but this
+    * would make the numbers inexact, so it is not included here.
+    */
+   /*          bicubic      sum        */
+   /* 0*/ { 1.0000000000, 4.5000000000 },
+   /* 1*/ {  .9638671875, 3.5000000000 },
+   /* 2*/ {  .8671875000, 2.5361328125 },
+   /* 3*/ {  .7275390625, 1.6689453125 },
+   /* 4*/ {  .5625000000,  .9414062500 },
+   /* 5*/ {  .3896484375,  .3789062500 },
+   /* 6*/ {  .2265625000, -.0107421875 },
+   /* 7*/ {  .0908203125, -.2373046875 },
+   /* 8*/ {            0, -.3281250000 },
+   /* 9*/ { -.0478515625, -.3281250000 },
+   /*10*/ { -.0703125000, -.2802734375 },
+   /*11*/ { -.0732421875, -.2099609375 },
+   /*12*/ { -.0625000000, -.1367187500 },
+   /*13*/ { -.0439453125, -.0742187500 },
+   /*14*/ { -.0234375000, -.0302734375 },
+   /*15*/ { -.0068359375, -.0068359375 }
+};
+
+static double
+alpha_calc(const struct arg *arg, double x, double y)
+{
+   /* For [x-2..x+2],[y-2,y+2] calculate the weighted bicubic given a function
+    * which tells us whether a point is inside or outside the shape.  First
+    * check if we need to do this at all:
+    */
+   switch (arg->check_fn(arg, x, y))
+   {
+      case OUTSIDE:
+         return 0; /* all samples outside the shape */
+
+      case INSIDE:
+         return 1; /* all samples inside the shape */
+
+      default:
+      {
+         int dy;
+         double alpha = 0;
+
+#        define FILTER_D (FILTER_WIDTH*FILTER_STEPS-1)
+         for (dy=-FILTER_D; dy<=FILTER_D; ++dy)
+         {
+            double wy = bicubic[abs(dy)][0];
+
+            if (wy != 0)
+            {
+               double alphay = 0;
+               int dx;
+
+               for (dx=-FILTER_D; dx<=FILTER_D; ++dx)
+               {
+                  double wx = bicubic[abs(dx)][0];
+
+                  if (wx != 0 && arg->inside_fn(arg, x+dx/16, y+dy/16)) 
+                     alphay += wx;
+               }
+
+               alpha += wy * alphay;
+            }
+         }
+
+         /* This needs to be weighted for each dimension: */
+         return alpha / (FILTER_WEIGHT*FILTER_WEIGHT);
+      }
+   }
+}
+
+/* These are the shape functions. */
+/* "square",
+ * { inside_square_filled, check_square_filled },
+ * { inside_square, check_square }
+ */
+static int
+square_check(double x, double y, double x1, double y1, double x2, double y2)
+   /* Is x,y inside the square (x1,y1)..(x2,y2)? */
+{
+   /* Do a modified Cohen-Sutherland on one point, bit patterns that indicate
+    * 'outside' are:
+    *
+    *   x<x1 | x<y1 | x<x2 | x<y2
+    *    0      x      0      x     To the right
+    *    1      x      1      x     To the left
+    *    x      0      x      0     Below
+    *    x      1      x      1     Above
+    *
+    * So 'inside' is (x<x1) != (x<x2) && (y<y1) != (y<y2);
+    */
+   return ((x<x1) ^ (x<x2)) & ((y<y1) ^ (y<y2));
+}
+
+static int
+inside_square_filled(const struct arg *arg, double x, double y)
+{
+   return square_check(x, y, arg->x1, arg->y1, arg->x2, arg->y2);
+}
+
+static int
+square_check_line(const struct arg *arg, double x, double y, double w)
+   /* Check for a point being inside the boundaries implied by the given arg
+    * and assuming a width 2*w each side of the boundaries.  This returns the
+    * 'check' INSIDE/OUTSIDE/0 result but note the semantics:
+    *
+    *          +--------------+
+    *          |              |   OUTSIDE
+    *          |   INSIDE     |
+    *          |              |
+    *          +--------------+
+    *
+    * And '0' means within the line boundaries.
+    */
+{
+   double cx = (arg->x1+arg->x2)/2;
+   double wx = fabs(arg->x1-arg->x2)/2;
+   double cy = (arg->y1+arg->y2)/2;
+   double wy = fabs(arg->y1-arg->y2)/2;
+
+   if (square_check(x, y, cx-wx-w, cy-wy-w, cx+wx+w, cy+wy+w))
+   {
+      /* Inside, but maybe too far; check for the redundant case where
+       * the lines overlap:
+       */
+      wx -= w;
+      wy -= w;
+      if (wx > 0 && wy > 0 && square_check(x, y, cx-wx, cy-wy, cx+wx, cy+wy))
+         return INSIDE; /* between (inside) the boundary lines. */
+
+      return 0; /* inside the lines themselves. */
+   }
+
+   return OUTSIDE; /* outside the boundary lines. */
+}
+
+static int
+check_square_filled(const struct arg *arg, double x, double y)
+{
+   /* The filter extends +/-FILTER_WIDTH each side of each output point, so
+    * the check has to expand and contract the square by that amount; '0'
+    * means close enough to the edge of the square that the bicubic filter has
+    * to be run, OUTSIDE means alpha==0, INSIDE means alpha==1.
+    */
+   return square_check_line(arg, x, y, FILTER_WIDTH);
+}
+
+static int
+inside_square(const struct arg *arg, double x, double y)
+{
+   /* Return true if within the drawn lines, else false, no need to distinguish
+    * INSIDE vs OUTSIDE here:
+    */
+   return square_check_line(arg, x, y, arg->width/2) == 0;
+}
+
+static int
+check_square(const struct arg *arg, double x, double y)
+{
+   /* So for this function a result of 'INSIDE' means inside the actual lines.
+    */
+   double w = arg->width/2;
+
+   if (square_check_line(arg, x, y, w+FILTER_WIDTH) == 0)
+   {
+      /* Somewhere close to the boundary lines. If far enough inside one of
+       * them then we can return INSIDE:
+       */
+      w -= FILTER_WIDTH;
+
+      if (w > 0 && square_check_line(arg, x, y, w) == 0)
+         return INSIDE;
+
+      /* Point is somewhere in the filter region: */
+      return 0;
+   }
+
+   else /* Inside or outside the square by more than w+FILTER_WIDTH. */
+      return OUTSIDE;
+}
+
+/* "circle",
+ * { inside_circle_filled, check_circle_filled },
+ * { inside_circle, check_circle }
+ *
+ * The functions here are analoguous to the square ones; however, they check
+ * the corresponding ellipse as opposed to the rectangle.
+ */
+static int
+circle_check(double x, double y, double x1, double y1, double x2, double y2)
+{
+   if (square_check(x, y, x1, y1, x2, y2))
+   {
+      /* Inside the square, so maybe inside the circle too: */
+      const double cx = (x1 + x2)/2;
+      const double cy = (y1 + y2)/2;
+      const double dx = x1 - x2;
+      const double dy = y1 - y2;
+
+      x = (x - cx)/dx;
+      y = (y - cy)/dy;
+
+      /* It is outside if the distance from the center is more than half the
+       * diameter:
+       */
+      return x*x+y*y < .25;
+   }
+
+   return 0; /* outside */
+}
+
+static int
+inside_circle_filled(const struct arg *arg, double x, double y)
+{
+   return circle_check(x, y, arg->x1, arg->y1, arg->x2, arg->y2);
+}
+
+static int
+circle_check_line(const struct arg *arg, double x, double y, double w)
+   /* Check for a point being inside the boundaries implied by the given arg
+    * and assuming a width 2*w each side of the boundaries.  This function has
+    * the same semantic as square_check_line but tests the circle.
+    */
+{
+   double cx = (arg->x1+arg->x2)/2;
+   double wx = fabs(arg->x1-arg->x2)/2;
+   double cy = (arg->y1+arg->y2)/2;
+   double wy = fabs(arg->y1-arg->y2)/2;
+
+   if (circle_check(x, y, cx-wx-w, cy-wy-w, cx+wx+w, cy+wy+w))
+   {
+      /* Inside, but maybe too far; check for the redundant case where
+       * the lines overlap:
+       */
+      wx -= w;
+      wy -= w;
+      if (wx > 0 && wy > 0 && circle_check(x, y, cx-wx, cy-wy, cx+wx, cy+wy))
+         return INSIDE; /* between (inside) the boundary lines. */
+
+      return 0; /* inside the lines themselves. */
+   }
+
+   return OUTSIDE; /* outside the boundary lines. */
+}
+
+static int
+check_circle_filled(const struct arg *arg, double x, double y)
+{
+   return circle_check_line(arg, x, y, FILTER_WIDTH);
+}
+
+static int
+inside_circle(const struct arg *arg, double x, double y)
+{
+   return circle_check_line(arg, x, y, arg->width/2) == 0;
+}
+
+static int
+check_circle(const struct arg *arg, double x, double y)
+{
+   /* Exactly as the 'square' code.  */
+   double w = arg->width/2;
+
+   if (circle_check_line(arg, x, y, w+FILTER_WIDTH) == 0)
+   {
+      w -= FILTER_WIDTH;
+
+      if (w > 0 && circle_check_line(arg, x, y, w) == 0)
+         return INSIDE;
+
+      /* Point is somewhere in the filter region: */
+      return 0;
+   }
+
+   else /* Inside or outside the square by more than w+FILTER_WIDTH. */
+      return OUTSIDE;
+}
+
+/* "line",
+ * { NULL, NULL },  There is no 'filled' line.
+ * { inside_line, check_line }
+ */
+static int
+line_check(double x, double y, double x1, double y1, double x2, double y2,
+   double w, double expand)
+{
+   /* Shift all the points to (arg->x1, arg->y1) */
+   double lx = x2 - x1;
+   double ly = y2 - y1;
+   double len2 = lx*lx + ly*ly;
+   double cross, dot;
+
+   x -= x1;
+   y -= y1;
+
+   /* The dot product is the distance down the line, the cross product is
+    * the distance away from the line:
+    *
+    *    distance = |cross| / sqrt(len2) 
+    */
+   cross = x * ly - y * lx;
+
+   /* If 'distance' is more than w the point is definitely outside the line:
+    *
+    *     distance >= w
+    *     |cross|  >= w * sqrt(len2)
+    *     cross^2  >= w^2 * len2:
+    */
+   if (cross*cross >= (w+expand)*(w+expand)*len2)
+      return 0; /* outside */
+
+   /* Now find the distance *along* the line; this comes from the dot product
+    * lx.x+ly.y. The actual distance (in pixels) is:
+    *
+    *   distance = dot / sqrt(len2)
+    */
+   dot = lx * x + ly * y;
+
+   /* The test for 'outside' is:
+    *
+    *    distance < 0 || distance > sqrt(len2)
+    *                 -> dot / sqrt(len2) > sqrt(len2)
+    *                 -> dot > len2
+    *
+    * But 'expand' is used for the filter width and needs to be handled too:
+    */
+   return dot > -expand && dot < len2+expand;
+}
+
+static int
+inside_line(const struct arg *arg, double x, double y)
+{
+   return line_check(x, y, arg->x1, arg->y1, arg->x2, arg->y2, arg->width/2, 0);
+}
+
+static int
+check_line(const struct arg *arg, double x, double y)
+{
+   /* The end caps of the line must be checked too; it's not enough just to
+    * widen the line by FILTER_WIDTH; 'expand' exists for this purpose:
+    */
+   if (line_check(x, y, arg->x1, arg->y1, arg->x2, arg->y2, arg->width/2,
+       FILTER_WIDTH))
+   {
+      /* Inside the line+filter; far enough inside that the filter isn't
+       * required?
+       */
+      if (arg->width > 2*FILTER_WIDTH &&
+          line_check(x, y, arg->x1, arg->y1, arg->x2, arg->y2, arg->width/2,
+             -FILTER_WIDTH))
+         return INSIDE;
+
+      return 0;
+   }
+
+   return OUTSIDE;
+}
+
+static const struct
+{
+   const char    *name;
+   shape_fn_ptr   function[2/*fill,line*/][2];
+#  define         FN_INSIDE 0
+#  define         FN_CHECK 1
+} shape_defs[] =
+{
+   {  "square",
+      {  { inside_square_filled, check_square_filled },
+         { inside_square, check_square } }
+   },
+   {  "circle",
+      {  { inside_circle_filled, check_circle_filled },
+         { inside_circle, check_circle } }
+   },
+   {  "line",
+      {  { NULL, NULL },
+         { inside_line, check_line } }
+   }
+};
+
+#define shape_count ((sizeof shape_defs)/(sizeof shape_defs[0]))
+
+static shape_fn_ptr
+shape_of(const char *arg, double width, int f)
+{
+   unsigned int i;
+
+   for (i=0; i<shape_count; ++i) if (strcmp(shape_defs[i].name, arg) == 0)
+   {
+      shape_fn_ptr fn = shape_defs[i].function[width != 0][f];
+
+      if (fn != NULL)
+         return fn;
+
+      fprintf(stderr, "genpng: %s %s not supported\n",
+         width == 0 ? "filled" : "unfilled", arg);
+      exit(1);
+   }
+
+   fprintf(stderr, "genpng: %s: not a valid shape name\n", arg);
+   exit(1);
+}
+
+static void
+parse_arg(struct arg *arg, const char **argv/*7 arguments*/)
+{
+   /* shape ::= color width shape x1 y1 x2 y2 */
+   arg->color = color_of(argv[0]);
+   arg->width = width_of(argv[1]);
+   arg->inside_fn = shape_of(argv[2], arg->width, FN_INSIDE);
+   arg->check_fn = shape_of(argv[2], arg->width, FN_CHECK);
+   arg->x1 = coordinate_of(argv[3]);
+   arg->y1 = coordinate_of(argv[4]);
+   arg->x2 = coordinate_of(argv[5]);
+   arg->y2 = coordinate_of(argv[6]);
+}
+
+static png_uint_32
+read_wh(const char *name, const char *str)
+   /* read a PNG width or height */
+{
+   char *ep = NULL;
+   unsigned long ul = strtoul(str, &ep, 10);
+
+   if (ep != NULL && *ep == 0 && ul > 0 && ul <= 0x7fffffff)
+      return (png_uint_32)/*SAFE*/ul;
+
+   fprintf(stderr, "genpng: %s: invalid number %s\n", name, str);
+   exit(1);
+}
+
+static void
+pixel(png_uint_16p p, struct arg *args, int nargs, double x, double y)
+{
+   /* Fill in the pixel by checking each shape (args[nargs]) for effects on
+    * the corresponding sample:
+    */
+   double r=0, g=0, b=0, a=0;
+
+   while (--nargs >= 0 && a != 1)
+   {
+      /* NOTE: alpha_calc can return a value outside the range 0..1 with the
+       * bicubic filter.
+       */
+      const double alpha = alpha_calc(args+nargs, x, y) * (1-a);
+
+      r += alpha * args[nargs].color->red;
+      g += alpha * args[nargs].color->green;
+      b += alpha * args[nargs].color->blue;
+      a += alpha;
+   }
+
+   /* 'a' may be negative or greater than 1; if it is, negative clamp the
+    * pixel to 0 if >1 clamp r/g/b:
+    */
+   if (a > 0) 
+   {
+      if (a > 1)
+      {
+         if (r > 1) r = 1;
+         if (g > 1) g = 1;
+         if (b > 1) b = 1;
+         a = 1;
+      }
+
+      /* And fill in the pixel: */
+      p[0] = (png_uint_16)/*SAFE*/round(r * 65535);
+      p[1] = (png_uint_16)/*SAFE*/round(g * 65535);
+      p[2] = (png_uint_16)/*SAFE*/round(b * 65535);
+      p[3] = (png_uint_16)/*SAFE*/round(a * 65535);
+   }
+
+   else
+      p[3] = p[2] = p[1] = p[0] = 0;
+}
+
+int
+main(int argc, const char **argv)
+{
+   int convert_to_8bit = 0;
+
+   /* There is one option: --8bit: */
+   if (argc > 1 && strcmp(argv[1], "--8bit") == 0)
+      --argc, ++argv, convert_to_8bit = 1;
+
+   if (argc >= 3)
+   {
+      png_uint_16p buffer;
+      int nshapes;
+      png_image image;
+#     define max_shapes 256
+      struct arg arg_list[max_shapes];
+
+      /* The libpng Simplified API write code requires a fully initialized
+       * structure.
+       */
+      memset(&image, 0, sizeof image);
+      image.version = PNG_IMAGE_VERSION;
+      image.opaque = NULL;
+      image.width = read_wh("width", argv[1]);
+      image.height = read_wh("height", argv[2]);
+      image.format = PNG_FORMAT_LINEAR_RGB_ALPHA;
+      image.flags = 0;
+      image.colormap_entries = 0;
+
+      /* Check the remainder of the arguments */
+      for (nshapes=0; 3+7*(nshapes+1) <= argc && nshapes < max_shapes;
+           ++nshapes)
+         parse_arg(arg_list+nshapes, argv+3+7*nshapes);
+
+      if (3+7*nshapes != argc)
+      {
+         fprintf(stderr, "genpng: %s: too many arguments\n", argv[3+7*nshapes]);
+         return 1;
+      }
+
+      /* Create the buffer: */
+      buffer = malloc(PNG_IMAGE_SIZE(image));
+
+      if (buffer != NULL)
+      {
+         png_uint_32 y;
+
+         /* Write each row... */
+         for (y=0; y<image.height; ++y)
+         {
+            png_uint_32 x;
+
+            /* Each pixel in each row: */
+            for (x=0; x<image.width; ++x)
+               pixel(buffer + 4*(x + y*image.width), arg_list, nshapes, x, y);
+         }
+
+         /* Write the result (to stdout) */
+         if (png_image_write_to_stdio(&image, stdout, convert_to_8bit,
+             buffer, 0/*row_stride*/, NULL/*colormap*/))
+         {
+            free(buffer);
+            return 0; /* success */
+         }
+
+         else
+            fprintf(stderr, "genpng: write stdout: %s\n", image.message);
+
+         free(buffer);
+      }
+
+      else
+         fprintf(stderr, "genpng: out of memory: %lu bytes\n",
+               (unsigned long)PNG_IMAGE_SIZE(image));
+   }
+
+   else
+   {
+      /* Wrong number of arguments */
+      fprintf(stderr, "genpng: usage: genpng [--8bit] width height {shape}\n"
+         " Generate a transparent PNG in RGBA (truecolor+alpha) format\n"
+         " containing the given shape or shapes.  Shapes are defined:\n"
+         "\n"
+         "  shape ::= color width shape x1 y1 x2 y2\n"
+         "  color ::= black|white|red|green|yellow|blue\n"
+         "  color ::= brown|purple|pink|orange|gray|cyan\n"
+         "  width ::= filled|<number>\n"
+         "  shape ::= circle|square|line\n"
+         "  x1,x2 ::= <number>\n"
+         "  y1,y2 ::= <number>\n"
+         "\n"
+         " Numbers are floating point numbers describing points relative to\n"
+         " the top left of the output PNG as pixel coordinates.  The 'width'\n"
+         " parameter is either the width of the line (in output pixels) used\n"
+         " to draw the shape or 'filled' to indicate that the shape should\n"
+         " be filled with the color.\n"
+         "\n"
+         " Colors are interpreted loosely to give access to the eight full\n"
+         " intensity RGB values:\n"
+         "\n"
+         "  black, red, green, blue, yellow, cyan, purple, white,\n"
+         "\n"
+         " Cyan is full intensity blue+green; RGB(0,1,1), plus the following\n"
+         " lower intensity values:\n"
+         "\n"
+         "  brown:  red+orange:  RGB(0.5, 0.125, 0) (dark red+orange)\n"
+         "  pink:   red+white:   RGB(1.0, 0.5,   0.5)\n"
+         "  orange: red+yellow:  RGB(1.0, 0.5,   0)\n"
+         "  gray:   black+white: RGB(0.5, 0.5,   0.5)\n"
+         "\n"
+         " The RGB values are selected to make detection of aliasing errors\n"
+         " easy. The names are selected to make the description of errors\n"
+         " easy.\n"
+         "\n"
+         " The PNG is written to stdout, if --8bit is given a 32bpp RGBA sRGB\n"
+         " file is produced, otherwise a 64bpp RGBA linear encoded file is\n"
+         " written.\n");
+   }
+
+   return 1;
+}
+#endif /* SIMPLIFIED_WRITE && STDIO */
--- a/contrib/tools/png-fix-itxt.c
+++ b/contrib/tools/png-fix-itxt.c
@@ -1,8 +1,8 @@

 /* png-fix-itxt version 1.0.0
 *
- * Copyright 2013 Glenn Randers-Pehrson
- * Last changed in libpng 1.6.3 [July 18, 2013]
+ * Copyright 2015 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -34,8 +34,10 @@

 #define MAX_LENGTH 500000

-#define GETBREAK ((unsigned char)(inchar=getchar())); if (inchar == EOF) break
-
+/* Read one character (inchar), also return octet (c), break if EOF */
+#define GETBREAK inchar=getchar(); \
+                 c=(inchar & 0xffU);\
+                 if (inchar != c) break
 int
 main(void)
 {
@@ -48,25 +50,25 @@ main(void)
 /* Skip 8-byte signature */
   for (i=8; i; i--)
   {
-      c=GETBREAK;
+      GETBREAK;
      putchar(c);
   }

-if (inchar != EOF)
+if (inchar == c) /* !EOF */
 for (;;)
 {
   /* Read the length */
   unsigned long length; /* must be 32 bits! */
-   c=GETBREAK; buf[0] = c; length  = c; length <<= 8;
-   c=GETBREAK; buf[1] = c; length += c; length <<= 8;
-   c=GETBREAK; buf[2] = c; length += c; length <<= 8;
-   c=GETBREAK; buf[3] = c; length += c;
+   GETBREAK; buf[0] = c; length  = c; length <<= 8;
+   GETBREAK; buf[1] = c; length += c; length <<= 8;
+   GETBREAK; buf[2] = c; length += c; length <<= 8;
+   GETBREAK; buf[3] = c; length += c;

   /* Read the chunkname */
-   c=GETBREAK; buf[4] = c;
-   c=GETBREAK; buf[5] = c;
-   c=GETBREAK; buf[6] = c;
-   c=GETBREAK; buf[7] = c;
+   GETBREAK; buf[4] = c;
+   GETBREAK; buf[5] = c;
+   GETBREAK; buf[6] = c;
+   GETBREAK; buf[7] = c;


   /* The iTXt chunk type expressed as integers is (105, 84, 88, 116) */
@@ -81,19 +83,22 @@ for (;;)
      /* Copy the data bytes */
      for (i=8; i < length + 12; i++)
      {
-         c=GETBREAK; buf[i] = c;
+         GETBREAK; buf[i] = c;
      }

+      if (inchar != c) /* EOF */
+         break;
+
      /* Calculate the CRC */
      crc = crc32(crc, buf+4, (uInt)length+4);

      for (;;)
      {
        /* Check the CRC */
-        if (((crc >> 24) & 0xff) == buf[length+8] &&
-            ((crc >> 16) & 0xff) == buf[length+9] &&
-            ((crc >>  8) & 0xff) == buf[length+10] &&
-            ((crc      ) & 0xff) == buf[length+11])
+        if (((crc >> 24) & 0xffU) == buf[length+8] &&
+            ((crc >> 16) & 0xffU) == buf[length+9] &&
+            ((crc >>  8) & 0xffU) == buf[length+10] &&
+            ((crc      ) & 0xffU) == buf[length+11])
           break;

        length++;
@@ -101,18 +106,21 @@ for (;;)
        if (length >= MAX_LENGTH-12)
           break;

-        c=GETBREAK;
-        buf[length+11]=c;
+        GETBREAK;
+        buf[length+11] = c;

        /* Update the CRC */
        crc = crc32(crc, buf+7+length, 1);
      }

+      if (inchar != c) /* EOF */
+         break;
+
      /* Update length bytes */
-      buf[0] = (unsigned char)((length << 24) & 0xff);
-      buf[1] = (unsigned char)((length << 16) & 0xff);
-      buf[2] = (unsigned char)((length <<  8) & 0xff);
-      buf[3] = (unsigned char)((length      ) & 0xff);
+      buf[0] = (unsigned char)((length >> 24) & 0xffU);
+      buf[1] = (unsigned char)((length >> 16) & 0xffU);
+      buf[2] = (unsigned char)((length >>  8) & 0xffU);
+      buf[3] = (unsigned char)((length      ) & 0xffU);

      /* Write the fixed iTXt chunk (length, name, data, crc) */
      for (i=0; i<length+12; i++)
@@ -121,6 +129,9 @@ for (;;)

   else
   {
+      if (inchar != c) /* EOF */
+         break;
+
      /* Copy bytes that were already read (length and chunk name) */
      for (i=0; i<8; i++)
         putchar(buf[i]);
@@ -128,11 +139,11 @@ for (;;)
      /* Copy data bytes and CRC */
      for (i=8; i< length+12; i++)
      {
-         c=GETBREAK;
+         GETBREAK;
         putchar(c);
      }

-      if (inchar == EOF)
+      if (inchar != c) /* EOF */
      {
         break;
      }
@@ -142,7 +153,7 @@ for (;;)
         break;
   }

-   if (inchar == EOF)
+   if (inchar != c) /* EOF */
      break;

   if (buf[4] == 73 && buf[5] == 69 && buf[6] == 78 && buf[7] == 68)
--- a/contrib/tools/pngfix.c
+++ b/contrib/tools/pngfix.c
@@ -1,15 +1,15 @@
 /* pngfix.c
 *
- * Copyright (c) 2014 John Cunningham Bowler
+ * Copyright (c) 2014-2015 John Cunningham Bowler
 *
- * Last changed in libpng 1.6.14 [October 23, 2014]
+ * Last changed in libpng 1.6.18 [July 23, 2015]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
 *
- * Tool to check and fix the zlib inflate 'too far back' problem, see the usage
- * message for more information.
+ * Tool to check and fix the zlib inflate 'too far back' problem.
+ * See the usage message for more information.
 */
 #include <stdlib.h>
 #include <stdio.h>
@@ -71,8 +71,8 @@
 * with older builds.
 */
 #if ZLIB_VERNUM < 0x1260
-#  define PNGZ_MSG_CAST(s) png_constcast(char*,s)
-#  define PNGZ_INPUT_CAST(b) png_constcast(png_bytep,b)
+#  define PNGZ_MSG_CAST(s) constcast(char*,s)
+#  define PNGZ_INPUT_CAST(b) constcast(png_bytep,b)
 #else
 #  define PNGZ_MSG_CAST(s) (s)
 #  define PNGZ_INPUT_CAST(b) (b)
@@ -86,17 +86,17 @@

 /* Copied from pngpriv.h */
 #ifdef __cplusplus
-#  define png_voidcast(type, value) static_cast<type>(value)
-#  define png_constcast(type, value) const_cast<type>(value)
-#  define png_aligncast(type, value) \
+#  define voidcast(type, value) static_cast<type>(value)
+#  define constcast(type, value) const_cast<type>(value)
+#  define aligncast(type, value) \
   static_cast<type>(static_cast<void*>(value))
-#  define png_aligncastconst(type, value) \
+#  define aligncastconst(type, value) \
   static_cast<type>(static_cast<const void*>(value))
 #else
-#  define png_voidcast(type, value) (value)
-#  define png_constcast(type, value) ((type)(value))
-#  define png_aligncast(type, value) ((void*)(value))
-#  define png_aligncastconst(type, value) ((const void*)(value))
+#  define voidcast(type, value) (value)
+#  define constcast(type, value) ((type)(value))
+#  define aligncast(type, value) ((void*)(value))
+#  define aligncastconst(type, value) ((const void*)(value))
 #endif /* __cplusplus */

 #if PNG_LIBPNG_VER < 10700
@@ -446,7 +446,7 @@ static void
 make_random_bytes(png_uint_32* seed, void* pv, size_t size)
 {
   png_uint_32 u0 = seed[0], u1 = seed[1];
-   png_bytep bytes = png_voidcast(png_bytep, pv);
+   png_bytep bytes = voidcast(png_bytep, pv);

   /* There are thirty-three bits; the next bit in the sequence is bit-33 XOR
    * bit-20.  The top 1 bit is in u1, the bottom 32 are in u0.
@@ -668,7 +668,7 @@ IDAT_list_extend(struct IDAT_list *tail)
      if (length < tail->length) /* arithmetic overflow */
         length = tail->length;
            
-      next = png_voidcast(IDAT_list*, malloc(IDAT_list_size(NULL, length)));
+      next = voidcast(IDAT_list*, malloc(IDAT_list_size(NULL, length)));
      CLEAR(*next);

      /* The caller must handle this: */
@@ -2138,7 +2138,7 @@ zlib_end(struct zlib *zlib)
          *
          * z-rc is the zlib failure code; message is the error message with
          * spaces replaced by '-'.  The compressed byte count indicates where
-          * in the zlib stream the error occured.
+          * in the zlib stream the error occurred.
          */
         type_name(zlib->chunk->chunk_type, stdout);
         printf(" SKP %s %d %s ", zlib_flevel(zlib), zlib->file_bits,
@@ -3535,7 +3535,7 @@ get_control(png_const_structrp png_ptr)
   /* This just returns the (file*).  The chunk and idat control structures
    * don't always exist.
    */
-   struct control *control = png_voidcast(struct control*,
+   struct control *control = voidcast(struct control*,
      png_get_error_ptr(png_ptr));
   return &control->file;
 }
@@ -3543,7 +3543,7 @@ get_control(png_const_structrp png_ptr)
 static void
 allocate(struct file *file, int allocate_idat)
 {
-   struct control *control = png_voidcast(struct control*, file->alloc_ptr);
+   struct control *control = voidcast(struct control*, file->alloc_ptr);

   if (allocate_idat)
   {
@@ -3577,10 +3577,9 @@ read_png(struct control *control)
 {
   png_structp png_ptr;
   png_infop info_ptr = NULL;
-   volatile png_bytep row = NULL, display = NULL;
   volatile int rc;

-   png_ptr = png_create_read_struct(png_get_libpng_ver(NULL), control,
+   png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, control,
      error_handler, warning_handler);

   if (png_ptr == NULL)
@@ -3594,6 +3593,16 @@ read_png(struct control *control)
   rc = setjmp(control->file.jmpbuf);
   if (rc == 0)
   {
+#     ifdef PNG_SET_USER_LIMITS_SUPPORTED
+         /* Remove any limits on the size of PNG files that can be read,
+          * without this we may reject files based on built-in safety
+          * limits.
+          */
+         png_set_user_limits(png_ptr, 0x7fffffff, 0x7fffffff);
+         png_set_chunk_cache_max(png_ptr, 0);
+         png_set_chunk_malloc_max(png_ptr, 0);
+#     endif
+
      png_set_read_fn(png_ptr, control, read_callback);

      info_ptr = png_create_info_struct(png_ptr);
@@ -3606,32 +3615,22 @@ read_png(struct control *control)
      png_read_info(png_ptr, info_ptr);

      {
-         png_size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr);
+        png_uint_32 height = png_get_image_height(png_ptr, info_ptr);
+        int passes = png_set_interlace_handling(png_ptr);
+        int pass;

-         row = png_voidcast(png_byte*, malloc(rowbytes));
-         display = png_voidcast(png_byte*, malloc(rowbytes));
+        png_start_read_image(png_ptr);

-         if (row == NULL || display == NULL)
-            png_error(png_ptr, "OOM allocating row buffers");
+        for (pass = 0; pass < passes; ++pass)
+        {
+           png_uint_32 y = height;

-         {
-            png_uint_32 height = png_get_image_height(png_ptr, info_ptr);
-            int passes = png_set_interlace_handling(png_ptr);
-            int pass;
-
-            png_start_read_image(png_ptr);
-
-            for (pass = 0; pass < passes; ++pass)
-            {
-               png_uint_32 y = height;
-
-               /* NOTE: this trashes the row each time; interlace handling won't
-                * work, but this avoids memory thrashing for speed testing.
-                */
-               while (y-- > 0)
-                  png_read_row(png_ptr, row, display);
-            }
-         }
+           /* NOTE: this skips asking libpng to return either version of
+            * the image row, but libpng still reads the rows.
+            */
+           while (y-- > 0)
+              png_read_row(png_ptr, NULL, NULL);
+        }
      }

      if (control->file.global->verbose)
@@ -3642,8 +3641,6 @@ read_png(struct control *control)
   }

   png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
-   if (row != NULL) free(row);
-   if (display != NULL) free(display);
   return rc;
 }

@@ -3705,21 +3702,21 @@ usage(const char *prog)
 "        gAMA, sRGB [all]: These specify the gamma encoding used for the pixel",
 "            values.",
 "        cHRM, iCCP [color]: These specify how colors are encoded.  iCCP also",
-"            specifies the exact encoding of a pixel value however in practice",
-"            most programs will ignore it.",
+"            specifies the exact encoding of a pixel value; however, in",
+"            practice most programs will ignore it.",
 "        bKGD [transform]: This is used by libpng transforms."
 "    --max=<number>:",
 "      Use IDAT chunks sized <number>.  If no number is given the the IDAT",
 "      chunks will be the maximum size permitted; 2^31-1 bytes.  If the option",
 "      is omitted the original chunk sizes will not be changed.  When the",
-"      option is given --strip=unsafe is set automatically, this may be",
+"      option is given --strip=unsafe is set automatically. This may be",
 "      cancelled if you know that all unknown unsafe-to-copy chunks really are",
 "      safe to copy across an IDAT size change.  This is true of all chunks",
 "      that have ever been formally proposed as PNG extensions.",
 "  MESSAGES",
 "      By default the program only outputs summaries for each file.",
 "    --quiet (-q):",
-"      Do not output the summaries except for files which cannot be read. With",
+"      Do not output the summaries except for files that cannot be read. With",
 "      two --quiets these are not output either.",
 "    --errors (-e):",
 "      Output errors from libpng and the program (except too-far-back).",
@@ -3752,7 +3749,7 @@ usage(const char *prog)
 "  the following codes.  Notice that the results for each file are combined",
 "  together - check one file at a time to get a meaningful error code!",
 "    0x01: The zlib too-far-back error existed in at least one chunk.",
-"    0x02: At least once chunk had a CRC error.",
+"    0x02: At least one chunk had a CRC error.",
 "    0x04: A chunk length was incorrect.",
 "    0x08: The file was truncated.",
 "  Errors less than 16 are potentially recoverable, for a single file if the",
@@ -3760,7 +3757,7 @@ usage(const char *prog)
 "  non-zero code is returned).",
 "    0x10: The file could not be read, even with corrections.",
 "    0x20: The output file could not be written.",
-"    0x40: An unexpected, potentially internal, error occured.",
+"    0x40: An unexpected, potentially internal, error occurred.",
 "  If the command line arguments are incorrect the program exits with exit",
 "  255.  Some older operating systems only support 7-bit exit codes, on those",
 "  systems it is suggested that this program is first tested by supplying",
@@ -3820,7 +3817,7 @@ usage(const char *prog)
 "          SKP: The chunk was skipped because of a zlib issue (zlib-rc) with",
 "               explanation 'message'",
 "          ERR: The read of the file was aborted.  The parameters explain why.",
-"$3 status:     For 'ERR' the accumulate status code from 'EXIT CODES' above.",
+"$3 status:     For 'ERR' the accumulated status code from 'EXIT CODES' above.",
 "               This is printed as a 2 digit hexadecimal value",
 "   comp-level: The recorded compression level (FLEVEL) of a zlib stream",
 "               expressed as a string {supfast,stdfast,default,maximum}",
@@ -3856,6 +3853,7 @@ usage(const char *prog)
 int
 main(int argc, const char **argv)
 {
+   char temp_name[FILENAME_MAX+1];
   const char *  prog = *argv;
   const char *  outfile = NULL;
   const char *  suffix = NULL;
@@ -3958,7 +3956,6 @@ main(int argc, const char **argv)
      else
      {
         size_t outlen = strlen(*argv);
-         char temp_name[FILENAME_MAX+1];

         if (outfile == NULL) /* else this takes precedence */
         {
--- a/contrib/visupng/cexcept.h
+++ b/contrib/visupng/cexcept.h
@@ -1,11 +1,12 @@
 /*===
-cexcept.h 2.0.1 (2008-Jul-19-Sat)
+cexcept.h 2.0.1 (2008-Jul-19-Sat, modified 2015-Jun-03-Mon)
 http://www.nicemice.net/cexcept/
 Adam M. Costello
 http://www.nicemice.net/amc/

 An interface for exception-handling in ANSI C (C89 and subsequent ISO
-standards), developed jointly with Cosmin Truta.
+standards), developed jointly with Cosmin Truta.  Revised by John Bowler,
+June 2015, to declare exception_env and exception_prev "volatile".

    Copyright (c) 2000-2008 Adam M. Costello and Cosmin Truta.
    This software may be modified only if its author and version
@@ -210,7 +211,7 @@ struct exception_context { \

 #define Try \
  { \
-    jmp_buf *exception__prev, exception__env; \
+    jmp_buf * volatile exception__prev, exception__env; \
    exception__prev = the_exception_context->penv; \
    the_exception_context->penv = &exception__env; \
    if (setjmp(exception__env) == 0) { \
--- a/libpng-manual.txt
+++ b/libpng-manual.txt
@@ -1,9 +1,9 @@
 libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.6.16beta01 - December 14, 2014
+ libpng version 1.6.18 - July 23, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
- Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ Copyright (c) 1998-2015 Glenn Randers-Pehrson

 This document is released under the libpng license.
 For conditions of distribution and use, see the disclaimer
@@ -11,9 +11,9 @@ libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.6.16beta01 - December 14, 2014
+ libpng versions 0.97, January 1998, through 1.6.18 - July 23, 2015
 Updated and distributed by Glenn Randers-Pehrson
- Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ Copyright (c) 1998-2015 Glenn Randers-Pehrson

 libpng 1.0 beta 6 - version 0.96 - May 28, 1997
 Updated and distributed by Andreas Dilger
@@ -336,7 +336,7 @@ prediction.

 If you are intending to keep the file pointer open for use in libpng,
 you must ensure you don't read more than 8 bytes from the beginning
-of the file, and you also have to make a call to png_set_sig_bytes_read()
+of the file, and you also have to make a call to png_set_sig_bytes()
 with the number of bytes you read from the beginning.  Libpng will
 then only check the bytes (if any) that your program didn't read.

@@ -344,22 +344,23 @@ then only check the bytes (if any) that your program didn't read.
 to replace them with custom functions.  See the discussion under
 Customizing libpng.

-
    FILE *fp = fopen(file_name, "rb");
    if (!fp)
    {
       return (ERROR);
    }

-    fread(header, 1, number, fp);
-    is_png = !png_sig_cmp(header, 0, number);
+    if (fread(header, 1, number, fp) != number)
+    {
+       return (ERROR);
+    }

+    is_png = !png_sig_cmp(header, 0, number);
    if (!is_png)
    {
       return (NOT_PNG);
    }

-
 Next, png_struct and png_info need to be allocated and initialized.  In
 order to ensure that the size of these structures is correct even with a
 dynamically linked libpng, there are functions to initialize and
@@ -648,15 +649,12 @@ User limits

 The PNG specification allows the width and height of an image to be as
 large as 2^31-1 (0x7fffffff), or about 2.147 billion rows and columns.
-Since very few applications really need to process such large images,
-we have imposed an arbitrary 1-million limit on rows and columns.
 Larger images will be rejected immediately with a png_error() call. If
-you wish to change this limit, you can use
+you wish to change these limits, you can use

   png_set_user_limits(png_ptr, width_max, height_max);

-to set your own limits, or use width_max = height_max = 0x7fffffffL
-to allow all valid dimensions (libpng may reject some very large images
+to set your own limits (libpng may reject some very wide images
 anyway because of potential buffer overflow conditions).

 You should put this statement after you create the PNG structure and
@@ -1267,13 +1265,13 @@ in until png_read_end() has read the chunk data following the image.
                     the PNG datastream is embedded in
                     a MNG-1.0 datastream)

-    Any or all of interlace_type, compression_type, or
-    filter_method can be NULL if you are
-    not interested in their values.
+    Any of width, height, color_type, bit_depth,
+    interlace_type, compression_type, or filter_method can
+    be NULL if you are not interested in their values.

    Note that png_get_IHDR() returns 32-bit data into
    the application's width and height variables.
-    This is an unsafe situation if these are 16-bit
+    This is an unsafe situation if these are not png_uint_32
    variables.  In such situations, the
    png_get_image_width() and png_get_image_height()
    functions described below are safer.
@@ -1996,7 +1994,7 @@ value when you call it in this position:
      png_set_gamma(png_ptr, screen_gamma, 0.45455);

 If you need to reduce an RGB file to a paletted file, or if a paletted
-file has more entries then will fit on your screen, png_set_quantize()
+file has more entries than will fit on your screen, png_set_quantize()
 will do that.  Note that this is a simple match quantization that merely
 finds the closest color available.  This should work fairly well with
 optimized palettes, but fairly badly with linear color cubes.  If you
@@ -2549,7 +2547,7 @@ png_infop info_ptr;
       64K.  The library seems to run fine with sizes
       of 4K. Although you can give it much less if
       necessary (I assume you can give it chunks of
-       1 byte, I haven't tried less then 256 bytes
+       1 byte, I haven't tried less than 256 bytes
       yet).  When this function returns, you may
       want to display any rows that were generated
       in the row callback if you don't already do
@@ -4067,10 +4065,11 @@ a 16-bit linear encoded PNG file is written.

 With all APIs row_stride is handled as in the read APIs - it is the spacing
 from one row to the next in component sized units (float) and if negative
-indicates a bottom-up row layout in the buffer.
+indicates a bottom-up row layout in the buffer.  If you pass zero, libpng will
+calculate the row_stride for you from the width and number of channels.

 Note that the write API does not support interlacing, sub-8-bit pixels,
-and indexed (paletted) images.
+indexed (paletted) images, or most ancillary chunks.

 VI. Modifying/Customizing libpng

@@ -4358,41 +4357,6 @@ is called for the first time.)
              same as the value of filter_method used
              in png_set_IHDR().

-It is also possible to influence how libpng chooses from among the
-available filters.  This is done in one or both of two ways - by
-telling it how important it is to keep the same filter for successive
-rows, and by telling it the relative computational costs of the filters.
-
-    double weights[3] = {1.5, 1.3, 1.1},
-       costs[PNG_FILTER_VALUE_LAST] =
-       {1.0, 1.3, 1.3, 1.5, 1.7};
-
-    png_set_filter_heuristics(png_ptr,
-       PNG_FILTER_HEURISTIC_WEIGHTED, 3,
-       weights, costs);
-
-The weights are multiplying factors that indicate to libpng that the
-row filter should be the same for successive rows unless another row filter
-is that many times better than the previous filter.  In the above example,
-if the previous 3 filters were SUB, SUB, NONE, the SUB filter could have a
-"sum of absolute differences" 1.5 x 1.3 times higher than other filters
-and still be chosen, while the NONE filter could have a sum 1.1 times
-higher than other filters and still be chosen.  Unspecified weights are
-taken to be 1.0, and the specified weights should probably be declining
-like those above in order to emphasize recent filters over older filters.
-
-The filter costs specify for each filter type a relative decoding cost
-to be considered when selecting row filters.  This means that filters
-with higher costs are less likely to be chosen over filters with lower
-costs, unless their "sum of absolute differences" is that much smaller.
-The costs do not necessarily reflect the exact computational speeds of
-the various filters, since this would unduly influence the final image
-size.
-
-Note that the numbers above were invented purely for this example and
-are given only to help explain the function usage.  Little testing has
-been done to find optimum values for either the costs or the weights.
-
 Requesting debug printout

 The macro definition PNG_DEBUG can be used to request debugging
@@ -5034,11 +4998,15 @@ The signatures of many exported functions were changed, such that
   png_infop became png_inforp or png_const_inforp
 where "rp" indicates a "restricted pointer".

+The support for FAR/far types has been eliminated and the definition of
+png_alloc_size_t is now controlled by a flag so that 'small size_t' systems
+can select it if necessary.
+
 Error detection in some chunks has improved; in particular the iCCP chunk
 reader now does pretty complete validation of the basic format.  Some bad
 profiles that were previously accepted are now accepted with a warning or
-rejected, depending upon the png_set_benign_errors() setting, in particular the
-very old broken Microsoft/HP 3144-byte sRGB profile.  Starting with
+rejected, depending upon the png_set_benign_errors() setting, in particular
+the very old broken Microsoft/HP 3144-byte sRGB profile.  Starting with
 libpng-1.6.11, recognizing and checking sRGB profiles can be avoided by
 means of

@@ -5049,7 +5017,7 @@ means of
    #endif

 It's not a good idea to do this if you are using the "simplified API",
-which needs to be able to recognize an sRGB profile conveyed via the iCCP
+which needs to be able to recognize sRGB profiles conveyed via the iCCP
 chunk.

 The PNG spec requirement that only grayscale profiles may appear in images
@@ -5107,6 +5075,23 @@ length, which resulted in PNG files that cannot be read beyond the bad iTXt
 chunk.  This error was fixed in libpng-1.6.3, and a tool (called
 contrib/tools/png-fix-itxt) has been added to the libpng distribution.

+Starting with libpng-1.6.17, the PNG_SAFE_LIMITS macro was eliminated
+and safe limits are used by default (users who need larger limits
+can still override them at compile time or run time, as described above).
+
+The new limits are
+                                default   spec limit
+   png_user_width_max         1,000,000  2,147,483,647
+   png_user_height_max        1,000,000  2,147,483,647
+   png_user_chunk_cache_max         128  unlimited
+   png_user_chunk_malloc_max  8,000,000  unlimited
+
+Starting with libpng-1.6.18, a PNG_RELEASE_BUILD macro was added, which allows
+library builders to control compilation for an installed system (a release build).
+It can be set for testing debug or beta builds to ensure that they will compile
+when the build type is switched to RC or STABLE. In essence this overrides the
+PNG_LIBPNG_BUILD_BASE_TYPE definition which is not directly user controllable.
+
 XIII.  Detecting libpng

 The png_get_io_ptr() function has been present since libpng-0.88, has never
@@ -5277,13 +5262,13 @@ Other rules can be inferred by inspecting the libpng source.

 XVI. Y2K Compliance in libpng

-December 14, 2014
+July 23, 2015

 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.6.16beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.6.18 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
--- a/libpng.3
+++ b/libpng.3
@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "December 14, 2014"
+.TH LIBPNG 3 "July 23, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.16beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.18
 .SH SYNOPSIS
 \fB
 #include <png.h>\fP
@@ -119,6 +119,8 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.6.16beta01

 \fBpng_byte png_get_libpng_ver (png_const_structp \fIpng_ptr\fP\fB);\fP

+\fBint png_get_palette_max(png_const_structp \fP\fIpng_ptr\fP\fB, png_const_infop \fIinfo_ptr\fP\fB);\fP
+
 \fBpng_voidp png_get_mem_ptr (png_const_structp \fIpng_ptr\fP\fB);\fP

 \fBpng_uint_32 png_get_oFFs (png_const_structp \fP\fIpng_ptr\fP\fB, png_const_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fI*offset_x\fP\fB, png_uint_32 \fP\fI*offset_y\fP\fB, int \fI*unit_type\fP\fB);\fP
@@ -369,6 +371,8 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.6.16beta01

 \fBvoid png_set_oFFs (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, png_uint_32 \fP\fIoffset_x\fP\fB, png_uint_32 \fP\fIoffset_y\fP\fB, int \fIunit_type\fP\fB);\fP

+\fBint png_set_option(png_structrp \fP\fIpng_ptr\fP\fB, int \fP\fIoption\fP\fB, int \fIonoff\fP\fB);\fP
+
 \fBvoid png_set_packing (png_structp \fIpng_ptr\fP\fB);\fP

 \fBvoid png_set_packswap (png_structp \fIpng_ptr\fP\fB);\fP
@@ -504,10 +508,10 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.6.16beta01 - December 14, 2014
+ libpng version 1.6.18 - July 23, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
- Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ Copyright (c) 1998-2015 Glenn Randers-Pehrson

 This document is released under the libpng license.
 For conditions of distribution and use, see the disclaimer
@@ -515,9 +519,9 @@ libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.6.16beta01 - December 14, 2014
+ libpng versions 0.97, January 1998, through 1.6.18 - July 23, 2015
 Updated and distributed by Glenn Randers-Pehrson
- Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ Copyright (c) 1998-2015 Glenn Randers-Pehrson

 libpng 1.0 beta 6 - version 0.96 - May 28, 1997
 Updated and distributed by Andreas Dilger
@@ -840,7 +844,7 @@ prediction.

 If you are intending to keep the file pointer open for use in libpng,
 you must ensure you don't read more than 8 bytes from the beginning
-of the file, and you also have to make a call to png_set_sig_bytes_read()
+of the file, and you also have to make a call to png_set_sig_bytes()
 with the number of bytes you read from the beginning.  Libpng will
 then only check the bytes (if any) that your program didn't read.

@@ -848,22 +852,23 @@ then only check the bytes (if any) that your program didn't read.
 to replace them with custom functions.  See the discussion under
 Customizing libpng.

-
    FILE *fp = fopen(file_name, "rb");
    if (!fp)
    {
       return (ERROR);
    }

-    fread(header, 1, number, fp);
-    is_png = !png_sig_cmp(header, 0, number);
+    if (fread(header, 1, number, fp) != number)
+    {
+       return (ERROR);
+    }

+    is_png = !png_sig_cmp(header, 0, number);
    if (!is_png)
    {
       return (NOT_PNG);
    }

-
 Next, png_struct and png_info need to be allocated and initialized.  In
 order to ensure that the size of these structures is correct even with a
 dynamically linked libpng, there are functions to initialize and
@@ -1152,15 +1157,12 @@ callback function:

 The PNG specification allows the width and height of an image to be as
 large as 2^(31\-1 (0x7fffffff), or about 2.147 billion rows and columns.
-Since very few applications really need to process such large images,
-we have imposed an arbitrary 1-million limit on rows and columns.
 Larger images will be rejected immediately with a png_error() call. If
-you wish to change this limit, you can use
+you wish to change these limits, you can use

   png_set_user_limits(png_ptr, width_max, height_max);

-to set your own limits, or use width_max = height_max = 0x7fffffffL
-to allow all valid dimensions (libpng may reject some very large images
+to set your own limits (libpng may reject some very wide images
 anyway because of potential buffer overflow conditions).

 You should put this statement after you create the PNG structure and
@@ -1771,13 +1773,13 @@ in until png_read_end() has read the chunk data following the image.
                     the PNG datastream is embedded in
                     a MNG-1.0 datastream)

-    Any or all of interlace_type, compression_type, or
-    filter_method can be NULL if you are
-    not interested in their values.
+    Any of width, height, color_type, bit_depth,
+    interlace_type, compression_type, or filter_method can
+    be NULL if you are not interested in their values.

    Note that png_get_IHDR() returns 32-bit data into
    the application's width and height variables.
-    This is an unsafe situation if these are 16-bit
+    This is an unsafe situation if these are not png_uint_32
    variables.  In such situations, the
    png_get_image_width() and png_get_image_height()
    functions described below are safer.
@@ -2500,7 +2502,7 @@ value when you call it in this position:
      png_set_gamma(png_ptr, screen_gamma, 0.45455);

 If you need to reduce an RGB file to a paletted file, or if a paletted
-file has more entries then will fit on your screen, png_set_quantize()
+file has more entries than will fit on your screen, png_set_quantize()
 will do that.  Note that this is a simple match quantization that merely
 finds the closest color available.  This should work fairly well with
 optimized palettes, but fairly badly with linear color cubes.  If you
@@ -3053,7 +3055,7 @@ png_infop info_ptr;
       64K.  The library seems to run fine with sizes
       of 4K. Although you can give it much less if
       necessary (I assume you can give it chunks of
-       1 byte, I haven't tried less then 256 bytes
+       1 byte, I haven't tried less than 256 bytes
       yet).  When this function returns, you may
       want to display any rows that were generated
       in the row callback if you don't already do
@@ -4571,10 +4573,11 @@ a 16-bit linear encoded PNG file is written.

 With all APIs row_stride is handled as in the read APIs - it is the spacing
 from one row to the next in component sized units (float) and if negative
-indicates a bottom-up row layout in the buffer.
+indicates a bottom-up row layout in the buffer.  If you pass zero, libpng will
+calculate the row_stride for you from the width and number of channels.

 Note that the write API does not support interlacing, sub-8-bit pixels,
-and indexed (paletted) images.
+indexed (paletted) images, or most ancillary chunks.

 .SH VI. Modifying/Customizing libpng

@@ -4862,41 +4865,6 @@ is called for the first time.)
              same as the value of filter_method used
              in png_set_IHDR().

-It is also possible to influence how libpng chooses from among the
-available filters.  This is done in one or both of two ways - by
-telling it how important it is to keep the same filter for successive
-rows, and by telling it the relative computational costs of the filters.
-
-    double weights[3] = {1.5, 1.3, 1.1},
-       costs[PNG_FILTER_VALUE_LAST] =
-       {1.0, 1.3, 1.3, 1.5, 1.7};
-
-    png_set_filter_heuristics(png_ptr,
-       PNG_FILTER_HEURISTIC_WEIGHTED, 3,
-       weights, costs);
-
-The weights are multiplying factors that indicate to libpng that the
-row filter should be the same for successive rows unless another row filter
-is that many times better than the previous filter.  In the above example,
-if the previous 3 filters were SUB, SUB, NONE, the SUB filter could have a
-"sum of absolute differences" 1.5 x 1.3 times higher than other filters
-and still be chosen, while the NONE filter could have a sum 1.1 times
-higher than other filters and still be chosen.  Unspecified weights are
-taken to be 1.0, and the specified weights should probably be declining
-like those above in order to emphasize recent filters over older filters.
-
-The filter costs specify for each filter type a relative decoding cost
-to be considered when selecting row filters.  This means that filters
-with higher costs are less likely to be chosen over filters with lower
-costs, unless their "sum of absolute differences" is that much smaller.
-The costs do not necessarily reflect the exact computational speeds of
-the various filters, since this would unduly influence the final image
-size.
-
-Note that the numbers above were invented purely for this example and
-are given only to help explain the function usage.  Little testing has
-been done to find optimum values for either the costs or the weights.
-
 .SS Requesting debug printout

 The macro definition PNG_DEBUG can be used to request debugging
@@ -5538,11 +5506,15 @@ The signatures of many exported functions were changed, such that
   png_infop became png_inforp or png_const_inforp
 where "rp" indicates a "restricted pointer".

+The support for FAR/far types has been eliminated and the definition of
+png_alloc_size_t is now controlled by a flag so that 'small size_t' systems
+can select it if necessary.
+
 Error detection in some chunks has improved; in particular the iCCP chunk
 reader now does pretty complete validation of the basic format.  Some bad
 profiles that were previously accepted are now accepted with a warning or
-rejected, depending upon the png_set_benign_errors() setting, in particular the
-very old broken Microsoft/HP 3144-byte sRGB profile.  Starting with
+rejected, depending upon the png_set_benign_errors() setting, in particular
+the very old broken Microsoft/HP 3144-byte sRGB profile.  Starting with
 libpng-1.6.11, recognizing and checking sRGB profiles can be avoided by
 means of

@@ -5553,7 +5525,7 @@ means of
    #endif

 It's not a good idea to do this if you are using the "simplified API",
-which needs to be able to recognize an sRGB profile conveyed via the iCCP
+which needs to be able to recognize sRGB profiles conveyed via the iCCP
 chunk.

 The PNG spec requirement that only grayscale profiles may appear in images
@@ -5611,6 +5583,23 @@ length, which resulted in PNG files that cannot be read beyond the bad iTXt
 chunk.  This error was fixed in libpng-1.6.3, and a tool (called
 contrib/tools/png-fix-itxt) has been added to the libpng distribution.

+Starting with libpng-1.6.17, the PNG_SAFE_LIMITS macro was eliminated
+and safe limits are used by default (users who need larger limits
+can still override them at compile time or run time, as described above).
+
+The new limits are
+                                default   spec limit
+   png_user_width_max         1,000,000  2,147,483,647
+   png_user_height_max        1,000,000  2,147,483,647
+   png_user_chunk_cache_max         128  unlimited
+   png_user_chunk_malloc_max  8,000,000  unlimited
+
+Starting with libpng-1.6.18, a PNG_RELEASE_BUILD macro was added, which allows
+library builders to control compilation for an installed system (a release build).
+It can be set for testing debug or beta builds to ensure that they will compile
+when the build type is switched to RC or STABLE. In essence this overrides the
+PNG_LIBPNG_BUILD_BASE_TYPE definition which is not directly user controllable.
+
 .SH XIII.  Detecting libpng

 The png_get_io_ptr() function has been present since libpng-0.88, has never
@@ -5781,13 +5770,13 @@ Other rules can be inferred by inspecting the libpng source.

 .SH XVI. Y2K Compliance in libpng

-December 14, 2014
+July 23, 2015

 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.6.16beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.6.18 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -6036,7 +6025,15 @@ the first widely used release:
 1.6.15beta01-08     16    10615  16.so.16.15[.0]
 1.6.15rc01-03       16    10615  16.so.16.15[.0]
 1.6.15              16    10615  16.so.16.15[.0]
- 1.6.16beta01        16    10616  16.so.16.16[.0]
+ 1.6.16beta01-03     16    10616  16.so.16.16[.0]
+ 1.6.16rc01-02       16    10616  16.so.16.16[.0]
+ 1.6.16              16    10616  16.so.16.16[.0]
+ 1.6.17beta01-06     16    10617  16.so.16.17[.0]
+ 1.6.17rc01-06       16    10617  16.so.16.17[.0]
+ 1.6.17              16    10617  16.so.16.17[.0]
+ 1.6.18beta01-09     16    10618  16.so.16.18[.0]
+ 1.6.18rc01-03       16    10618  16.so.16.18[.0]
+ 1.6.18              16    10618  16.so.16.18[.0]

 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -6093,7 +6090,7 @@ possible without all of you.

 Thanks to Frank J. T. Wojcik for helping with the documentation.

-Libpng version 1.6.16beta01 - December 14, 2014:
+Libpng version 1.6.18 - July 23, 2015:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).

@@ -6116,44 +6113,39 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.2.6, August 15, 2004, through 1.6.16beta01, December 14, 2014, are
-Copyright (c) 2004,2006-2014 Glenn Randers-Pehrson, and are
-distributed according to the same disclaimer and license as libpng-1.2.5
-with the following individual added to the list of Contributing Authors
-
-   Cosmin Truta
-
-libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are
-Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are
+libpng versions 1.0.7, July 1, 2000, through 1.6.18, July 23, 2015, are
+Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.0.6
-with the following individuals added to the list of Contributing Authors
+with the following individuals added to the list of Contributing Authors:

   Simon-Pierre Cadieux
   Eric S. Raymond
+   Mans Rullgard
+   Cosmin Truta
   Gilles Vollant
+   James Yu

 and with the following additions to the disclaimer:

-   There is no warranty against interference with your
-   enjoyment of the library or against infringement.
-   There is no warranty that our efforts or the library
-   will fulfill any of your particular purposes or needs.
-   This library is provided with all faults, and the entire
-   risk of satisfactory quality, performance, accuracy, and
-   effort is with the user.
+   There is no warranty against interference with your enjoyment of the
+   library or against infringement.  There is no warranty that our
+   efforts or the library will fulfill any of your particular purposes
+   or needs.  This library is provided with all faults, and the entire
+   risk of satisfactory quality, performance, accuracy, and effort is with
+   the user.

 libpng versions 0.97, January 1998, through 1.0.6, March 20, 2000, are
-Copyright (c) 1998, 1999 Glenn Randers-Pehrson
-Distributed according to the same disclaimer and license as libpng-0.96,
-with the following individuals added to the list of Contributing Authors:
+Copyright (c) 1998-2000 Glenn Randers-Pehrson, and are distributed according
+to the same disclaimer and license as libpng-0.96, with the following
+individuals added to the list of Contributing Authors:

   Tom Lane
   Glenn Randers-Pehrson
   Willem van Schaik

 libpng versions 0.89, June 1996, through 0.96, May 1997, are
-Copyright (c) 1996, 1997 Andreas Dilger
-Distributed according to the same disclaimer and license as libpng-0.88,
+Copyright (c) 1996-1997 Andreas Dilger, and are
+distributed according to the same disclaimer and license as libpng-0.88,
 with the following individuals added to the list of Contributing Authors:

   John Bowler
@@ -6164,7 +6156,7 @@ with the following individuals added to the list of Contributing Authors:
   Tom Tanner

 libpng versions 0.5, May 1995, through 0.88, January 1996, are
-Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.
+Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.

 For the purposes of this copyright and license, "Contributing Authors"
 is defined as the following set of individuals:
@@ -6187,13 +6179,13 @@ Permission is hereby granted to use, copy, modify, and distribute this
 source code, or portions hereof, for any purpose, without fee, subject
 to the following restrictions:

-1. The origin of this source code must not be misrepresented.
+  1. The origin of this source code must not be misrepresented.

-2. Altered versions must be plainly marked as such and
-   must not be misrepresented as being the original source.
+  2. Altered versions must be plainly marked as such and must not
+     be misrepresented as being the original source.

-3. This Copyright notice may not be removed or altered from
-   any source or altered source distribution.
+  3. This Copyright notice may not be removed or altered from any
+     source or altered source distribution.

 The Contributing Authors and Group 42, Inc. specifically permit, without
 fee, and encourage the use of this source code as a component to
@@ -6201,21 +6193,21 @@ supporting the PNG file format in commercial products.  If you use this
 source code in a product, acknowledgment is not required but would be
 appreciated.

-
 A "png_get_copyright" function is available, for convenient use in "about"
 boxes and the like:

-   printf("%s",png_get_copyright(NULL));
+   printf("%s", png_get_copyright(NULL));

 Also, the PNG logo (in PNG format, of course) is supplied in the
 files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31).

-Libpng is OSI Certified Open Source Software.  OSI Certified Open Source is a
-certification mark of the Open Source Initiative.
+Libpng is OSI Certified Open Source Software.  OSI Certified Open Source is
+a certification mark of the Open Source Initiative. OSI has not addressed
+the additional disclaimers inserted at version 1.0.7.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-December 14, 2014
+July 23, 2015

 .\" end of man page

--- a/libpngpf.3
+++ b/libpngpf.3
@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "December 14, 2014"
+.TH LIBPNGPF 3 "July 23, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.16beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.18
 (private functions)
 .SH SYNOPSIS
 \fB#include \fI"pngpriv.h"
--- a/png.5
+++ b/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "December 14, 2014"
+.TH PNG 5 "July 23, 2015"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
--- a/png.c
+++ b/png.c
@@ -1,8 +1,8 @@

 /* png.c - location for general purpose libpng functions
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -14,7 +14,7 @@
 #include "pngpriv.h"

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_16beta01 Your_png_h_is_not_version_1_6_16beta01;
+typedef png_libpng_version_1_6_18 Your_png_h_is_not_version_1_6_18;

 /* Tells libpng that we have already handled the first "num_bytes" bytes
 * of the PNG file signature.  If the PNG data is embedded into another
@@ -34,7 +34,7 @@ png_set_sig_bytes(png_structrp png_ptr, int num_bytes)
   if (num_bytes > 8)
      png_error(png_ptr, "Too many bytes for PNG signature");

-   png_ptr->sig_bytes = (png_byte)(num_bytes < 0 ? 0 : num_bytes);
+   png_ptr->sig_bytes = (png_byte)((num_bytes < 0 ? 0 : num_bytes) & 0xff);
 }

 /* Checks whether the supplied bytes match the PNG signature.  We allow
@@ -101,7 +101,7 @@ png_zfree(voidpf png_ptr, voidpf ptr)
 void /* PRIVATE */
 png_reset_crc(png_structrp png_ptr)
 {
-   /* The cast is safe because the crc is a 32 bit value. */
+   /* The cast is safe because the crc is a 32-bit value. */
   png_ptr->crc = (png_uint_32)crc32(0, Z_NULL, 0);
 }

@@ -129,7 +129,7 @@ png_calculate_crc(png_structrp png_ptr, png_const_bytep ptr, png_size_t length)
   }

   /* 'uLong' is defined in zlib.h as unsigned long; this means that on some
-    * systems it is a 64 bit value.  crc32, however, returns 32 bits so the
+    * systems it is a 64-bit value.  crc32, however, returns 32 bits so the
    * following cast is safe.  'uInt' may be no more than 16 bits, so it is
    * necessary to perform a loop here.
    */
@@ -140,8 +140,10 @@ png_calculate_crc(png_structrp png_ptr, png_const_bytep ptr, png_size_t length)
      do
      {
         uInt safe_length = (uInt)length;
+#ifndef __COVERITY__
         if (safe_length == 0)
            safe_length = (uInt)-1; /* evil, but safe */
+#endif

         crc = crc32(crc, ptr, safe_length);

@@ -241,15 +243,15 @@ png_create_png_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
      create_struct.user_height_max = PNG_USER_HEIGHT_MAX;

 #     ifdef PNG_USER_CHUNK_CACHE_MAX
-         /* Added at libpng-1.2.43 and 1.4.0 */
-         create_struct.user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;
+      /* Added at libpng-1.2.43 and 1.4.0 */
+      create_struct.user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;
 #     endif

 #     ifdef PNG_USER_CHUNK_MALLOC_MAX
-         /* Added at libpng-1.2.43 and 1.4.1, required only for read but exists
-          * in png_struct regardless.
-          */
-         create_struct.user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;
+      /* Added at libpng-1.2.43 and 1.4.1, required only for read but exists
+       * in png_struct regardless.
+       */
+      create_struct.user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;
 #     endif
 #  endif

@@ -273,7 +275,9 @@ png_create_png_struct,(png_const_charp user_png_ver, png_voidp error_ptr,

 #  ifdef PNG_SETJMP_SUPPORTED
      if (!setjmp(create_jmp_buf))
+#  endif
      {
+#  ifdef PNG_SETJMP_SUPPORTED
         /* Temporarily fake out the longjmp information until we have
          * successfully completed this function.  This only works if we have
          * setjmp() support compiled in, but it is safe - this stuff should
@@ -282,8 +286,6 @@ png_create_png_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
         create_struct.jmp_buf_ptr = &create_jmp_buf;
         create_struct.jmp_buf_size = 0; /*stack allocation*/
         create_struct.longjmp_fn = longjmp;
-#  else
-      {
 #  endif
         /* Call the general version checker (shared with read and write code):
          */
@@ -302,10 +304,10 @@ png_create_png_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
               create_struct.zstream.opaque = png_ptr;

 #              ifdef PNG_SETJMP_SUPPORTED
-                  /* Eliminate the local error handling: */
-                  create_struct.jmp_buf_ptr = NULL;
-                  create_struct.jmp_buf_size = 0;
-                  create_struct.longjmp_fn = 0;
+               /* Eliminate the local error handling: */
+               create_struct.jmp_buf_ptr = NULL;
+               create_struct.jmp_buf_size = 0;
+               create_struct.longjmp_fn = 0;
 #              endif

               *png_ptr = create_struct;
@@ -476,9 +478,10 @@ png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,
   /* Free any tRNS entry */
   if (((mask & PNG_FREE_TRNS) & info_ptr->free_me) != 0)
   {
+      info_ptr->valid &= ~PNG_INFO_tRNS;
      png_free(png_ptr, info_ptr->trans_alpha);
      info_ptr->trans_alpha = NULL;
-      info_ptr->valid &= ~PNG_INFO_tRNS;
+      info_ptr->num_trans = 0;
   }
 #endif

@@ -544,20 +547,17 @@ png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,

      else
      {
-         if (info_ptr->splt_palettes_num != 0)
+         int i;
+
+         for (i = 0; i < info_ptr->splt_palettes_num; i++)
         {
-            int i;
-
-            for (i = 0; i < info_ptr->splt_palettes_num; i++)
-            {
-               png_free(png_ptr, info_ptr->splt_palettes[i].name);
-               png_free(png_ptr, info_ptr->splt_palettes[i].entries);
-            }
-
-            png_free(png_ptr, info_ptr->splt_palettes);
-            info_ptr->splt_palettes = NULL;
-            info_ptr->splt_palettes_num = 0;
+            png_free(png_ptr, info_ptr->splt_palettes[i].name);
+            png_free(png_ptr, info_ptr->splt_palettes[i].entries);
         }
+
+         png_free(png_ptr, info_ptr->splt_palettes);
+         info_ptr->splt_palettes = NULL;
+         info_ptr->splt_palettes_num = 0;
         info_ptr->valid &= ~PNG_INFO_sPLT;
      }
   }
@@ -577,15 +577,12 @@ png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,
      {
         int i;

-         if (info_ptr->unknown_chunks_num != 0)
-         {
-            for (i = 0; i < info_ptr->unknown_chunks_num; i++)
-               png_free(png_ptr, info_ptr->unknown_chunks[i].data);
+         for (i = 0; i < info_ptr->unknown_chunks_num; i++)
+            png_free(png_ptr, info_ptr->unknown_chunks[i].data);

-            png_free(png_ptr, info_ptr->unknown_chunks);
-            info_ptr->unknown_chunks = NULL;
-            info_ptr->unknown_chunks_num = 0;
-         }
+         png_free(png_ptr, info_ptr->unknown_chunks);
+         info_ptr->unknown_chunks = NULL;
+         info_ptr->unknown_chunks_num = 0;
      }
   }
 #endif
@@ -666,7 +663,7 @@ png_init_io(png_structrp png_ptr, png_FILE_p fp)
 }
 #  endif

-#ifdef PNG_SAVE_INT_32_SUPPORTED
+#  ifdef PNG_SAVE_INT_32_SUPPORTED
 /* The png_save_int_32 function assumes integers are stored in two's
 * complement format.  If this isn't the case, then this routine needs to
 * be modified to write data in two's complement format.  Note that,
@@ -681,7 +678,7 @@ png_save_int_32(png_bytep buf, png_int_32 i)
   buf[2] = (png_byte)((i >> 8) & 0xff);
   buf[3] = (png_byte)(i & 0xff);
 }
-#endif
+#  endif

 #  ifdef PNG_TIME_RFC1123_SUPPORTED
 /* Convert the supplied time into an RFC 1123 string suitable for use in
@@ -734,7 +731,7 @@ png_convert_to_rfc1123_buffer(char out[29], png_const_timep ptime)
   return 1;
 }

-#     if PNG_LIBPNG_VER < 10700
+#    if PNG_LIBPNG_VER < 10700
 /* To do: remove the following from libpng-1.7 */
 /* Original API that uses a private buffer in png_struct.
 * Deprecated because it causes png_struct to carry a spurious temporary
@@ -755,7 +752,7 @@ png_convert_to_rfc1123(png_structrp png_ptr, png_const_timep ptime)

   return NULL;
 }
-#     endif
+#    endif /* LIBPNG_VER < 10700 */
 #  endif /* TIME_RFC1123 */

 #endif /* READ || WRITE */
@@ -769,14 +766,14 @@ png_get_copyright(png_const_structrp png_ptr)
 #else
 #  ifdef __STDC__
   return PNG_STRING_NEWLINE \
-     "libpng version 1.6.16beta01 - December 14, 2014" PNG_STRING_NEWLINE \
-     "Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
-     "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
-     "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
-     PNG_STRING_NEWLINE;
+      "libpng version 1.6.18 - July 23, 2015" PNG_STRING_NEWLINE \
+      "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
+      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
+      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
+      PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.6.16beta01 - December 14, 2014\
-      Copyright (c) 1998-2014 Glenn Randers-Pehrson\
+   return "libpng version 1.6.18 - July 23, 2015\
+      Copyright (c) 1998-2015 Glenn Randers-Pehrson\
      Copyright (c) 1996-1997 Andreas Dilger\
      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
 #  endif
@@ -814,9 +811,9 @@ png_get_header_version(png_const_structrp png_ptr)
 #ifdef __STDC__
   return PNG_HEADER_VERSION_STRING
 #  ifndef PNG_READ_SUPPORTED
-   "     (NO READ SUPPORT)"
+      " (NO READ SUPPORT)"
 #  endif
-   PNG_STRING_NEWLINE;
+      PNG_STRING_NEWLINE;
 #else
   return PNG_HEADER_VERSION_STRING;
 #endif
@@ -872,9 +869,9 @@ png_build_grayscale_palette(int bit_depth, png_colorp palette)

   for (i = 0, v = 0; i < num_palette; i++, v += color_inc)
   {
-      palette[i].red = (png_byte)v;
-      palette[i].green = (png_byte)v;
-      palette[i].blue = (png_byte)v;
+      palette[i].red = (png_byte)(v & 0xff);
+      palette[i].green = (png_byte)(v & 0xff);
+      palette[i].blue = (png_byte)(v & 0xff);
   }
 }
 #endif
@@ -947,8 +944,6 @@ png_access_version_number(void)
   return((png_uint_32)PNG_LIBPNG_VER);
 }

-
-
 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
 /* Ensure that png_ptr->zstream.msg holds some appropriate error message string.
 * If it doesn't 'ret' is used to set it to something appropriate, even in cases
@@ -1075,7 +1070,7 @@ png_colorspace_set_gamma(png_const_structrp png_ptr,
   png_colorspacerp colorspace, png_fixed_point gAMA)
 {
   /* Changed in libpng-1.5.4 to limit the values to ensure overflow can't
-    * occur.  Since the fixed point representation is assymetrical it is
+    * occur.  Since the fixed point representation is asymetrical it is
    * possible for 1/gamma to overflow the limit of 21474 and this means the
    * gamma value must be at least 5/100000 and hence at most 20000.0.  For
    * safety the limits here are a little narrower.  The values are 0.00016 to
@@ -1091,10 +1086,10 @@ png_colorspace_set_gamma(png_const_structrp png_ptr,
      errmsg = "gamma value out of range";

 #  ifdef PNG_READ_gAMA_SUPPORTED
-      /* Allow the application to set the gamma value more than once */
-      else if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&
-         (colorspace->flags & PNG_COLORSPACE_FROM_gAMA) != 0)
-         errmsg = "duplicate";
+   /* Allow the application to set the gamma value more than once */
+   else if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&
+      (colorspace->flags & PNG_COLORSPACE_FROM_gAMA) != 0)
+      errmsg = "duplicate";
 #  endif

   /* Do nothing if the colorspace is already invalid */
@@ -1135,31 +1130,31 @@ png_colorspace_sync_info(png_const_structrp png_ptr, png_inforp info_ptr)
         PNG_INFO_iCCP);

 #     ifdef PNG_COLORSPACE_SUPPORTED
-         /* Clean up the iCCP profile now if it won't be used. */
-         png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, -1/*not used*/);
+      /* Clean up the iCCP profile now if it won't be used. */
+      png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, -1/*not used*/);
 #     else
-         PNG_UNUSED(png_ptr)
+      PNG_UNUSED(png_ptr)
 #     endif
   }

   else
   {
 #     ifdef PNG_COLORSPACE_SUPPORTED
-         /* Leave the INFO_iCCP flag set if the pngset.c code has already set
-          * it; this allows a PNG to contain a profile which matches sRGB and
-          * yet still have that profile retrievable by the application.
-          */
-         if ((info_ptr->colorspace.flags & PNG_COLORSPACE_MATCHES_sRGB) != 0)
-            info_ptr->valid |= PNG_INFO_sRGB;
+      /* Leave the INFO_iCCP flag set if the pngset.c code has already set
+       * it; this allows a PNG to contain a profile which matches sRGB and
+       * yet still have that profile retrievable by the application.
+       */
+      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_MATCHES_sRGB) != 0)
+         info_ptr->valid |= PNG_INFO_sRGB;

-         else
-            info_ptr->valid &= ~PNG_INFO_sRGB;
+      else
+         info_ptr->valid &= ~PNG_INFO_sRGB;

-         if ((info_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_ENDPOINTS) != 0)
-            info_ptr->valid |= PNG_INFO_cHRM;
+      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_ENDPOINTS) != 0)
+         info_ptr->valid |= PNG_INFO_cHRM;

-         else
-            info_ptr->valid &= ~PNG_INFO_cHRM;
+      else
+         info_ptr->valid &= ~PNG_INFO_cHRM;
 #     endif

      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_GAMMA) != 0)
@@ -1181,7 +1176,7 @@ png_colorspace_sync(png_const_structrp png_ptr, png_inforp info_ptr)
   png_colorspace_sync_info(png_ptr, info_ptr);
 }
 #endif
-#endif
+#endif /* GAMMA */

 #ifdef PNG_COLORSPACE_SUPPORTED
 /* Added at libpng-1.5.5 to support read and write of true CIEXYZ values for
@@ -1240,16 +1235,17 @@ png_XYZ_from_xy(png_XYZ *XYZ, const png_xy *xy)

   /* Check xy and, implicitly, z.  Note that wide gamut color spaces typically
    * have end points with 0 tristimulus values (these are impossible end
-    * points, but they are used to cover the possible colors.)
+    * points, but they are used to cover the possible colors).  We check
+    * xy->whitey against 5, not 0, to avoid a possible integer overflow.
    */
-   if (xy->redx < 0 || xy->redx > PNG_FP_1) return 1;
-   if (xy->redy < 0 || xy->redy > PNG_FP_1-xy->redx) return 1;
+   if (xy->redx   < 0 || xy->redx > PNG_FP_1) return 1;
+   if (xy->redy   < 0 || xy->redy > PNG_FP_1-xy->redx) return 1;
   if (xy->greenx < 0 || xy->greenx > PNG_FP_1) return 1;
   if (xy->greeny < 0 || xy->greeny > PNG_FP_1-xy->greenx) return 1;
-   if (xy->bluex < 0 || xy->bluex > PNG_FP_1) return 1;
-   if (xy->bluey < 0 || xy->bluey > PNG_FP_1-xy->bluex) return 1;
+   if (xy->bluex  < 0 || xy->bluex > PNG_FP_1) return 1;
+   if (xy->bluey  < 0 || xy->bluey > PNG_FP_1-xy->bluex) return 1;
   if (xy->whitex < 0 || xy->whitex > PNG_FP_1) return 1;
-   if (xy->whitey < 0 || xy->whitey > PNG_FP_1-xy->whitex) return 1;
+   if (xy->whitey < 5 || xy->whitey > PNG_FP_1-xy->whitex) return 1;

   /* The reverse calculation is more difficult because the original tristimulus
    * value had 9 independent values (red,green,blue)x(X,Y,Z) however only 8
@@ -1324,7 +1320,7 @@ png_XYZ_from_xy(png_XYZ *XYZ, const png_xy *xy)
    * (1/white-y), so we can immediately see that as white-y approaches 0 the
    * accuracy inherent in the cHRM chunk drops off substantially.
    *
-    * libpng arithmetic: a simple invertion of the above equations
+    * libpng arithmetic: a simple inversion of the above equations
    * ------------------------------------------------------------
    *
    *    white_scale = 1/white-y
@@ -1817,7 +1813,7 @@ png_icc_profile_error(png_const_structrp png_ptr, png_colorspacerp colorspace,
   PNG_UNUSED(pos)

   /* This is recoverable, but make it unconditionally an app_error on write to
-    * avoid writing invalid ICC profiles into PNG files.  (I.e.  we handle them
+    * avoid writing invalid ICC profiles into PNG files (i.e., we handle them
    * on read, with a warning, but on write unless the app turns off
    * application errors the PNG won't be written.)
    */
@@ -1836,7 +1832,7 @@ png_colorspace_set_sRGB(png_const_structrp png_ptr, png_colorspacerp colorspace,
   /* sRGB sets known gamma, end points and (from the chunk) intent. */
   /* IMPORTANT: these are not necessarily the values found in an ICC profile
    * because ICC profiles store values adapted to a D50 environment; it is
-    * expected that the ICC profile mediaWhitePointTag will be D50, see the
+    * expected that the ICC profile mediaWhitePointTag will be D50; see the
    * checks and code elsewhere to understand this better.
    *
    * These XYZ values, which are accurate to 5dp, produce rgb to gray
@@ -2166,7 +2162,8 @@ png_icc_check_tag_table(png_const_structrp png_ptr, png_colorspacerp colorspace,
   return 1; /* success, maybe with warnings */
 }

-#if defined(PNG_sRGB_SUPPORTED) && PNG_sRGB_PROFILE_CHECKS >= 0
+#ifdef PNG_sRGB_SUPPORTED
+#if PNG_sRGB_PROFILE_CHECKS >= 0
 /* Information about the known ICC sRGB profiles */
 static const struct
 {
@@ -2280,7 +2277,7 @@ png_compare_ICC_profile_with_sRGB(png_const_structrp png_ptr,

         /* Length *and* intent must match */
         if (length == png_sRGB_checks[i].length &&
-            intent == png_sRGB_checks[i].intent)
+            intent == (png_uint_32) png_sRGB_checks[i].intent)
         {
            /* Now calculate the adler32 if not done already. */
            if (adler == 0)
@@ -2324,8 +2321,8 @@ png_compare_ICC_profile_with_sRGB(png_const_structrp png_ptr,
                   */
                  else if (png_sRGB_checks[i].have_md5 == 0)
                  {
-                     png_chunk_report(png_ptr, "out-of-date sRGB profile with"
-                        " no signature",
+                     png_chunk_report(png_ptr,
+                        "out-of-date sRGB profile with no signature",
                        PNG_CHUNK_WARNING);
                  }

@@ -2338,8 +2335,8 @@ png_compare_ICC_profile_with_sRGB(png_const_structrp png_ptr,
          * way.  This probably indicates a data error or uninformed hacking.
          * Fall through to "no match".
          */
-         png_chunk_report(png_ptr, "Not recognizing known sRGB profile that"
-             " has been edited", 
+         png_chunk_report(png_ptr,
+             "Not recognizing known sRGB profile that has been edited", 
             PNG_CHUNK_WARNING);
         break;
 # endif
@@ -2349,9 +2346,8 @@ png_compare_ICC_profile_with_sRGB(png_const_structrp png_ptr,

   return 0; /* no match */
 }
-#endif
+#endif /* PNG_sRGB_PROFILE_CHECKS >= 0 */

-#ifdef PNG_sRGB_SUPPORTED
 void /* PRIVATE */
 png_icc_set_sRGB(png_const_structrp png_ptr,
   png_colorspacerp colorspace, png_const_bytep profile, uLong adler)
@@ -2365,7 +2361,7 @@ png_icc_set_sRGB(png_const_structrp png_ptr,
      (void)png_colorspace_set_sRGB(png_ptr, colorspace,
         (int)/*already checked*/png_get_uint_32(profile+64));
 }
-#endif /* READ_sRGB */
+#endif /* sRGB */

 int /* PRIVATE */
 png_colorspace_set_ICC(png_const_structrp png_ptr, png_colorspacerp colorspace,
@@ -2457,10 +2453,21 @@ png_colorspace_set_rgb_coefficients(png_structrp png_ptr)
         png_error(png_ptr, "internal error handling cHRM->XYZ");
   }
 }
-#endif
+#endif /* READ_RGB_TO_GRAY */

 #endif /* COLORSPACE */

+#ifdef __GNUC__
+/* This exists solely to work round a warning from GNU C. */
+static int /* PRIVATE */
+png_gt(size_t a, size_t b)
+{
+    return a > b;
+}
+#else
+#   define png_gt(a,b) ((a) > (b))
+#endif
+
 void /* PRIVATE */
 png_check_IHDR(png_const_structrp png_ptr,
   png_uint_32 width, png_uint_32 height, int bit_depth,
@@ -2475,22 +2482,43 @@ png_check_IHDR(png_const_structrp png_ptr,
      png_warning(png_ptr, "Image width is zero in IHDR");
      error = 1;
   }
-   else if (width > PNG_UINT_31_MAX)
+
+   if (width > PNG_UINT_31_MAX)
   {
      png_warning(png_ptr, "Invalid image width in IHDR");
      error = 1;
   }
-   else
+
+   if (png_gt(((width + 7) & (~7)),
+       ((PNG_SIZE_MAX
+           - 48        /* big_row_buf hack */
+           - 1)        /* filter byte */
+           / 8)        /* 8-byte RGBA pixels */
+           - 1))       /* extra max_pixel_depth pad */
   {
-#     ifdef PNG_SET_USER_LIMITS_SUPPORTED
-      if (width > png_ptr->user_width_max)
-#     else
-      if (width > PNG_USER_WIDTH_MAX)
-#     endif
-      {
-         png_warning(png_ptr, "Image width exceeds user limit in IHDR");
-         error = 1;
-      }
+      /* The size of the row must be within the limits of this architecture.
+       * Because the read code can perform arbitrary transformations the
+       * maximum size is checked here.  Because the code in png_read_start_row
+       * adds extra space "for safety's sake" in several places a conservative
+       * limit is used here.
+       *
+       * NOTE: it would be far better to check the size that is actually used,
+       * but the effect in the real world is minor and the changes are more
+       * extensive, therefore much more dangerous and much more difficult to
+       * write in a way that avoids compiler warnings.
+       */
+      png_warning(png_ptr, "Image width is too large for this architecture");
+      error = 1;
+   }
+
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+   if (width > png_ptr->user_width_max)
+#else
+   if (width > PNG_USER_WIDTH_MAX)
+#endif
+   {
+      png_warning(png_ptr, "Image width exceeds user limit in IHDR");
+      error = 1;
   }

   if (height == 0)
@@ -2498,22 +2526,21 @@ png_check_IHDR(png_const_structrp png_ptr,
      png_warning(png_ptr, "Image height is zero in IHDR");
      error = 1;
   }
-   else if (height > PNG_UINT_31_MAX)
+
+   if (height > PNG_UINT_31_MAX)
   {
      png_warning(png_ptr, "Invalid image height in IHDR");
      error = 1;
   }
-   else
+
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+   if (height > png_ptr->user_height_max)
+#else
+   if (height > PNG_USER_HEIGHT_MAX)
+#endif
   {
-#     ifdef PNG_SET_USER_LIMITS_SUPPORTED
-      if (height > png_ptr->user_height_max)
-#     else
-      if (height > PNG_USER_HEIGHT_MAX)
-#     endif
-      {
-         png_warning(png_ptr, "Image height exceeds user limit in IHDR");
-         error = 1;
-      }
+      png_warning(png_ptr, "Image height exceeds user limit in IHDR");
+      error = 1;
   }

   /* Check other values */
@@ -2552,7 +2579,7 @@ png_check_IHDR(png_const_structrp png_ptr,
      error = 1;
   }

-#  ifdef PNG_MNG_FEATURES_SUPPORTED
+#ifdef PNG_MNG_FEATURES_SUPPORTED
   /* Accept filter_method 64 (intrapixel differencing) only if
    * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
    * 2. Libpng did not read a PNG signature (this filter_method is only
@@ -2585,13 +2612,13 @@ png_check_IHDR(png_const_structrp png_ptr,
      }
   }

-#  else
+#else
   if (filter_type != PNG_FILTER_TYPE_BASE)
   {
      png_warning(png_ptr, "Unknown filter method in IHDR");
      error = 1;
   }
-#  endif
+#endif

   if (error == 1)
      png_error(png_ptr, "Invalid IHDR data");
@@ -2817,7 +2844,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,

      if (fp >= DBL_MIN && fp <= DBL_MAX)
      {
-         int exp_b10;       /* A base 10 exponent */
+         int exp_b10;   /* A base 10 exponent */
         double base;   /* 10^exp_b10 */

         /* First extract a base 10 exponent of the number,
@@ -2865,7 +2892,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
          */

         {
-            int czero, clead, cdigits;
+            unsigned int czero, clead, cdigits;
            char exponent[10];

            /* Allow up to two leading zeros - this will not lengthen
@@ -2895,7 +2922,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
                * of the loop don't break the number into parts so
                * that the final digit is rounded.
                */
-               if (cdigits+czero-clead+1 < (int)precision)
+               if (cdigits+czero+1 < precision+clead)
                  fp = modf(fp, &d);

               else
@@ -3001,14 +3028,14 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
                  *ascii++ = (char)(48 + (int)d), ++cdigits;
               }
            }
-            while (cdigits+czero-clead < (int)precision && fp > DBL_MIN);
+            while (cdigits+czero < precision+clead && fp > DBL_MIN);

            /* The total output count (max) is now 4+precision */

            /* Check for an exponent, if we don't need one we are
             * done and just need to terminate the string.  At
             * this point exp_b10==(-1) is effectively if flag - it got
-             * to '-1' because of the decrement after outputing
+             * to '-1' because of the decrement after outputting
             * the decimal point above (the exponent required is
             * *not* -1!)
             */
@@ -3016,7 +3043,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
            {
               /* The following only happens if we didn't output the
                * leading zeros above for negative exponent, so this
-                * doest add to the digit requirement.  Note that the
+                * doesn't add to the digit requirement.  Note that the
                * two zeros here can only be output if the two leading
                * zeros were *not* output, so this doesn't increase
                * the output count.
@@ -3069,7 +3096,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
            /* Need another size check here for the exponent digits, so
             * this need not be considered above.
             */
-            if ((int)size > cdigits)
+            if (size > cdigits)
            {
               while (cdigits > 0) *ascii++ = exponent[--cdigits];

@@ -3173,7 +3200,7 @@ png_ascii_from_fixed(png_const_structrp png_ptr, png_charp ascii,
   png_error(png_ptr, "ASCII conversion buffer too small");
 }
 #   endif /* FIXED_POINT */
-#endif /* READ_SCAL */
+#endif /* SCAL */

 #if defined(PNG_FLOATING_POINT_SUPPORTED) && \
   !defined(PNG_FIXED_POINT_MACRO_SUPPORTED) && \
@@ -3191,7 +3218,7 @@ png_fixed(png_const_structrp png_ptr, double fp, png_const_charp text)
      png_fixed_error(png_ptr, text);

 #  ifndef PNG_ERROR_TEXT_SUPPORTED
-      PNG_UNUSED(text)
+   PNG_UNUSED(text)
 #  endif

   return (png_fixed_point)r;
@@ -3372,29 +3399,29 @@ png_gamma_significant(png_fixed_point gamma_val)
 #endif

 #ifdef PNG_READ_GAMMA_SUPPORTED
-#if defined(PNG_16BIT_SUPPORTED) || !defined(PNG_FLOATING_ARITHMETIC_SUPPORTED)
+#ifdef PNG_16BIT_SUPPORTED
 /* A local convenience routine. */
 static png_fixed_point
 png_product2(png_fixed_point a, png_fixed_point b)
 {
   /* The required result is 1/a * 1/b; the following preserves accuracy. */
-#    ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
+#ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
   double r = a * 1E-5;
   r *= b;
   r = floor(r+.5);

   if (r <= 2147483647. && r >= -2147483648.)
      return (png_fixed_point)r;
-#    else
+#else
   png_fixed_point res;

   if (png_muldiv(&res, a, b, 100000) != 0)
      return res;
-#    endif
+#endif

   return 0; /* overflow */
 }
-#endif /* 16BIT || !FLOATING_ARITHMETIC */
+#endif /* 16BIT */

 /* The inverse of the above. */
 png_fixed_point
@@ -3402,12 +3429,15 @@ png_reciprocal2(png_fixed_point a, png_fixed_point b)
 {
   /* The required result is 1/a * 1/b; the following preserves accuracy. */
 #ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
-   double r = 1E15/a;
-   r /= b;
-   r = floor(r+.5);
+   if (a != 0 && b != 0)
+   {
+      double r = 1E15/a;
+      r /= b;
+      r = floor(r+.5);

-   if (r <= 2147483647. && r >= -2147483648.)
-      return (png_fixed_point)r;
+      if (r <= 2147483647. && r >= -2147483648.)
+         return (png_fixed_point)r;
+   }
 #else
   /* This may overflow because the range of png_fixed_point isn't symmetric,
    * but this API is only used for the product of file and screen gamma so it
@@ -3698,7 +3728,7 @@ png_exp8bit(png_fixed_point lg2)
    * step.
    */
   x -= x >> 8;
-   return (png_byte)((x + 0x7fffffU) >> 24);
+   return (png_byte)(((x + 0x7fffffU) >> 24) & 0xff);
 }

 #ifdef PNG_16BIT_SUPPORTED
@@ -3759,7 +3789,7 @@ png_gamma_8bit_correct(unsigned int value, png_fixed_point gamma_val)
 #     endif
   }

-   return (png_byte)value;
+   return (png_byte)(value & 0xff);
 }

 #ifdef PNG_16BIT_SUPPORTED
@@ -3981,7 +4011,7 @@ png_build_8bit_table(png_structrp png_ptr, png_bytepp ptable,

   else
      for (i=0; i<256; ++i)
-         table[i] = (png_byte)i;
+         table[i] = (png_byte)(i & 0xff);
 }

 /* Used from png_read_destroy and below to release the memory used by the gamma
@@ -4121,7 +4151,8 @@ png_build_gamma_table(png_structrp png_ptr, int bit_depth)
      *
      */
     if (sig_bit > 0 && sig_bit < 16U)
-        shift = (png_byte)(16U - sig_bit); /* shift == insignificant bits */
+        /* shift == insignificant bits */
+        shift = (png_byte)((16U - sig_bit) & 0xff);

     else
        shift = 0; /* keep all 16 bits */
@@ -4190,7 +4221,7 @@ png_set_option(png_structrp png_ptr, int option, int onoff)
      int setting = (2 + (onoff != 0)) << option;
      int current = png_ptr->options;

-      png_ptr->options = (png_byte)((current & ~mask) | setting);
+      png_ptr->options = (png_byte)(((current & ~mask) | setting) & 0xff);

      return (current & mask) >> option;
   }
@@ -4206,7 +4237,7 @@ png_set_option(png_structrp png_ptr, int option, int onoff)
 * contrib/tools/makesRGB.c.  The actual sRGB transfer curve defined in the
 * specification (see the article at http://en.wikipedia.org/wiki/SRGB)
 * is used, not the gamma=1/2.2 approximation use elsewhere in libpng.
- * The sRGB to linear table is exact (to the nearest 16 bit linear fraction).
+ * The sRGB to linear table is exact (to the nearest 16-bit linear fraction).
 * The inverse (linear to sRGB) table has accuracies as follows:
 *
 * For all possible (255*65535+1) input values:
--- a/png.h
+++ b/png.h
@@ -1,8 +1,9 @@

 /* png.h - header file for PNG reference library
 *
- * libpng version 1.6.16beta01, December 14, 2014
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * libpng version 1.6.18, July 23, 2015
+ *
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -10,8 +11,8 @@
 *
 * Authors and maintainers:
 *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
- *   libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.6.16beta01, December 14, 2014: Glenn
+ *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
+ *   libpng versions 0.97, January 1998, through 1.6.18, July 23, 2015: Glenn
 *   See also "Contributing Authors", below.
 *
 * Note about libpng version numbers:
@@ -209,7 +210,15 @@
 *    1.6.15beta01-08         16    10615  16.so.16.15[.0]
 *    1.6.15rc01-03           16    10615  16.so.16.15[.0]
 *    1.6.15                  16    10615  16.so.16.15[.0]
- *    1.6.16beta01            16    10616  16.so.16.16[.0]
+ *    1.6.16beta01-03         16    10616  16.so.16.16[.0]
+ *    1.6.16rc01-02           16    10616  16.so.16.16[.0]
+ *    1.6.16                  16    10616  16.so.16.16[.0]
+ *    1.6.17beta01-06         16    10617  16.so.16.17[.0]
+ *    1.6.17rc01-06           16    10617  16.so.16.17[.0]
+ *    1.6.17                  16    10617  16.so.16.17[.0]
+ *    1.6.18beta01-09         16    10618  16.so.16.18[.0]
+ *    1.6.18rc01-03           16    10618  16.so.16.18[.0]
+ *    1.6.18                  16    10618  16.so.16.18[.0]
 *
 *   Henceforth the source version will match the shared-library major
 *   and minor numbers; the shared-library major version number will be
@@ -241,21 +250,16 @@
 *
 * This code is released under the libpng license.
 *
- * libpng versions 1.2.6, August 15, 2004, through 1.6.16beta01, December 14, 2014, are
- * Copyright (c) 2004, 2006-2014 Glenn Randers-Pehrson, and are
- * distributed according to the same disclaimer and license as libpng-1.2.5
- * with the following individual added to the list of Contributing Authors:
- *
- *    Cosmin Truta
- *
- * libpng versions 1.0.7, July 1, 2000, through 1.2.5, October 3, 2002, are
- * Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are
+ * libpng versions 1.0.7, July 1, 2000, through 1.6.18, July 23, 2015, are
+ * Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, and are
 * distributed according to the same disclaimer and license as libpng-1.0.6
 * with the following individuals added to the list of Contributing Authors:
 *
 *    Simon-Pierre Cadieux
- *    Eric S. Raymond
+ *    Mans Rullgard
+ *    Cosmin Truta
 *    Gilles Vollant
+ *    James Yu
 *
 * and with the following additions to the disclaimer:
 *
@@ -267,17 +271,18 @@
 *    the user.
 *
 * libpng versions 0.97, January 1998, through 1.0.6, March 20, 2000, are
- * Copyright (c) 1998, 1999, 2000 Glenn Randers-Pehrson, and are
- * distributed according to the same disclaimer and license as libpng-0.96,
- * with the following individuals added to the list of Contributing Authors:
+ * Copyright (c) 1998-2000 Glenn Randers-Pehrson, and are distributed according
+ * to the same disclaimer and license as libpng-0.96, with the following
+ * individuals added to the list of Contributing Authors:
 *
 *    Tom Lane
 *    Glenn Randers-Pehrson
+ *    Eric S. Raymond
 *    Willem van Schaik
 *
 * libpng versions 0.89, June 1996, through 0.96, May 1997, are
- * Copyright (c) 1996, 1997 Andreas Dilger
- * Distributed according to the same disclaimer and license as libpng-0.88,
+ * Copyright (c) 1996-1997 Andreas Dilger, and are
+ * distributed according to the same disclaimer and license as libpng-0.88,
 * with the following individuals added to the list of Contributing Authors:
 *
 *    John Bowler
@@ -288,7 +293,7 @@
 *    Tom Tanner
 *
 * libpng versions 0.5, May 1995, through 0.88, January 1996, are
- * Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.
+ * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
 *
 * For the purposes of this copyright and license, "Contributing Authors"
 * is defined as the following set of individuals:
@@ -316,8 +321,8 @@
 *   2. Altered versions must be plainly marked as such and must not
 *      be misrepresented as being the original source.
 *
- *   3. This Copyright notice may not be removed or altered from
- *      any source or altered source distribution.
+ *   3. This Copyright notice may not be removed or altered from any
+ *      source or altered source distribution.
 *
 * The Contributing Authors and Group 42, Inc. specifically permit, without
 * fee, and encourage the use of this source code as a component to
@@ -330,15 +335,16 @@
 * A "png_get_copyright" function is available, for convenient use in "about"
 * boxes and the like:
 *
- *     printf("%s", png_get_copyright(NULL));
+ *    printf("%s", png_get_copyright(NULL));
 *
 * Also, the PNG logo (in PNG format, of course) is supplied in the
 * files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31).
 */

 /*
- * Libpng is OSI Certified Open Source Software.  OSI Certified is a
- * certification mark of the Open Source Initiative.
+ * Libpng is OSI Certified Open Source Software.  OSI Certified Open Source is
+ * a certification mark of the Open Source Initiative. OSI has not addressed
+ * the additional disclaimers inserted at version 1.0.7.
 */

 /*
@@ -353,13 +359,13 @@
 * Y2K compliance in libpng:
 * =========================
 *
- *    December 14, 2014
+ *    July 23, 2015
 *
 *    Since the PNG Development group is an ad-hoc body, we can't make
 *    an official declaration.
 *
 *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.6.16beta01 are Y2K compliant.  It is my belief that
+ *    upward through 1.6.18 are Y2K compliant.  It is my belief that
 *    earlier versions were also Y2K compliant.
 *
 *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -421,9 +427,9 @@
 */

 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.6.16beta01"
+#define PNG_LIBPNG_VER_STRING "1.6.18"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.6.16beta01 - December 14, 2014\n"
+     " libpng version 1.6.18 - July 23, 2015\n"

 #define PNG_LIBPNG_VER_SONUM   16
 #define PNG_LIBPNG_VER_DLLNUM  16
@@ -431,13 +437,13 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   6
-#define PNG_LIBPNG_VER_RELEASE 16
+#define PNG_LIBPNG_VER_RELEASE 18

 /* This should match the numeric part of the final component of
 * PNG_LIBPNG_VER_STRING, omitting any leading zero:
 */

-#define PNG_LIBPNG_VER_BUILD  01
+#define PNG_LIBPNG_VER_BUILD  0

 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -454,7 +460,7 @@
 #define PNG_LIBPNG_BUILD_SPECIAL 32 /* Cannot be OR'ed with
                                       PNG_LIBPNG_BUILD_PRIVATE */

-#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_BETA
+#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE

 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
 * We must not include leading zeros.
@@ -462,7 +468,7 @@
 * version 1.0.0 was mis-numbered 100 instead of 10000).  From
 * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
 */
-#define PNG_LIBPNG_VER 10616 /* 1.6.16 */
+#define PNG_LIBPNG_VER 10618 /* 1.6.18 */

 /* Library configuration: these options cannot be changed after
 * the library has been built.
@@ -567,7 +573,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
 * do not agree upon the version number.
 */
-typedef char* png_libpng_version_1_6_16beta01;
+typedef char* png_libpng_version_1_6_18;

 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
 *
@@ -1576,6 +1582,7 @@ PNG_EXPORT(66, void, png_set_crc_action, (png_structrp png_ptr, int crit_action,
 #define PNG_CRC_QUIET_USE     4  /* quiet/use data      quiet/use data    */
 #define PNG_CRC_NO_CHANGE     5  /* use current value   use current value */

+#ifdef PNG_WRITE_SUPPORTED
 /* These functions give the user control over the scan-line filtering in
 * libpng and the compression methods used by zlib.  These functions are
 * mainly useful for testing, as the defaults should work with most users.
@@ -1589,6 +1596,7 @@ PNG_EXPORT(66, void, png_set_crc_action, (png_structrp png_ptr, int crit_action,
 */
 PNG_EXPORT(67, void, png_set_filter, (png_structrp png_ptr, int method,
    int filters));
+#endif /* WRITE */

 /* Flags for png_set_filter() to say which filters to use.  The flags
 * are chosen so that they don't conflict with real filter types
@@ -1614,35 +1622,8 @@ PNG_EXPORT(67, void, png_set_filter, (png_structrp png_ptr, int method,
 #define PNG_FILTER_VALUE_PAETH 4
 #define PNG_FILTER_VALUE_LAST  5

-#ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED /* EXPERIMENTAL */
-/* The "heuristic_method" is given by one of the PNG_FILTER_HEURISTIC_
- * defines, either the default (minimum-sum-of-absolute-differences), or
- * the experimental method (weighted-minimum-sum-of-absolute-differences).
- *
- * Weights are factors >= 1.0, indicating how important it is to keep the
- * filter type consistent between rows.  Larger numbers mean the current
- * filter is that many times as likely to be the same as the "num_weights"
- * previous filters.  This is cumulative for each previous row with a weight.
- * There needs to be "num_weights" values in "filter_weights", or it can be
- * NULL if the weights aren't being specified.  Weights have no influence on
- * the selection of the first row filter.  Well chosen weights can (in theory)
- * improve the compression for a given image.
- *
- * Costs are factors >= 1.0 indicating the relative decoding costs of a
- * filter type.  Higher costs indicate more decoding expense, and are
- * therefore less likely to be selected over a filter with lower computational
- * costs.  There needs to be a value in "filter_costs" for each valid filter
- * type (given by PNG_FILTER_VALUE_LAST), or it can be NULL if you aren't
- * setting the costs.  Costs try to improve the speed of decompression without
- * unduly increasing the compressed image size.
- *
- * A negative weight or cost indicates the default value is to be used, and
- * values in the range [0.0, 1.0) indicate the value is to remain unchanged.
- * The default values for both weights and costs are currently 1.0, but may
- * change if good general weighting/cost heuristics can be found.  If both
- * the weights and costs are set to 1.0, this degenerates the WEIGHTED method
- * to the UNWEIGHTED method, but with added encoding time/computation.
- */
+#ifdef PNG_WRITE_SUPPORTED
+#ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED /* DEPRECATED */
 PNG_FP_EXPORT(68, void, png_set_filter_heuristics, (png_structrp png_ptr,
    int heuristic_method, int num_weights, png_const_doublep filter_weights,
    png_const_doublep filter_costs))
@@ -1652,15 +1633,12 @@ PNG_FIXED_EXPORT(209, void, png_set_filter_heuristics_fixed,
    png_const_fixed_point_p filter_costs))
 #endif /* WRITE_WEIGHTED_FILTER */

-/* Heuristic used for row filter selection.  These defines should NOT be
- * changed.
- */
+/* The following are no longer used and will be removed from libpng-1.7: */
 #define PNG_FILTER_HEURISTIC_DEFAULT    0  /* Currently "UNWEIGHTED" */
 #define PNG_FILTER_HEURISTIC_UNWEIGHTED 1  /* Used by libpng < 0.95 */
 #define PNG_FILTER_HEURISTIC_WEIGHTED   2  /* Experimental feature */
 #define PNG_FILTER_HEURISTIC_LAST       3  /* Not a valid value */

-#ifdef PNG_WRITE_SUPPORTED
 /* Set the library compression level.  Currently, valid values range from
 * 0 - 9, corresponding directly to the zlib compression levels 0 - 9
 * (0 - no compression, 9 - "maximal" compression).  Note that tests have
@@ -1668,6 +1646,7 @@ PNG_FIXED_EXPORT(209, void, png_set_filter_heuristics_fixed,
 * for PNG images, and do considerably fewer caclulations.  In the future,
 * these values may not correspond directly to the zlib compression levels.
 */
+#ifdef PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED
 PNG_EXPORT(69, void, png_set_compression_level, (png_structrp png_ptr,
    int level));

@@ -1685,7 +1664,7 @@ PNG_EXPORT(72, void, png_set_compression_window_bits, (png_structrp png_ptr,

 PNG_EXPORT(73, void, png_set_compression_method, (png_structrp png_ptr,
    int method));
-#endif
+#endif /* WRITE_CUSTOMIZE_COMPRESSION */

 #ifdef PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED
 /* Also set zlib parameters for compressing non-IDAT chunks */
@@ -1707,6 +1686,7 @@ PNG_EXPORT(225, void, png_set_text_compression_window_bits,
 PNG_EXPORT(226, void, png_set_text_compression_method, (png_structrp png_ptr,
    int method));
 #endif /* WRITE_CUSTOMIZE_ZTXT_COMPRESSION */
+#endif /* WRITE */

 /* These next functions are called for input/output, memory, and error
 * handling.  They are in the file pngrio.c, pngwio.c, and pngerror.c,
@@ -1817,7 +1797,7 @@ PNG_EXPORT(218, png_byte, png_get_current_pass_number, (png_const_structrp));
 *
 * The integer return from the callback function is interpreted thus:
 *
- * negative: An error occured, png_chunk_error will be called.
+ * negative: An error occurred; png_chunk_error will be called.
 *     zero: The chunk was not handled, the chunk will be saved. A critical
 *           chunk will cause an error at this point unless it is to be saved.
 * positive: The chunk was handled, libpng will ignore/discard it.
@@ -2662,26 +2642,28 @@ PNG_EXPORT(216, png_uint_32, png_get_io_chunk_type,
           * (png_uint_16)(alpha)                         \
           + (png_uint_16)(bg)*(png_uint_16)(255          \
           - (png_uint_16)(alpha)) + 128);                \
-       (composite) = (png_byte)((temp + (temp >> 8)) >> 8); }
+       (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); }

 #  define png_composite_16(composite, fg, alpha, bg)       \
     { png_uint_32 temp = (png_uint_32)((png_uint_32)(fg)  \
           * (png_uint_32)(alpha)                          \
           + (png_uint_32)(bg)*(65535                      \
           - (png_uint_32)(alpha)) + 32768);               \
-       (composite) = (png_uint_16)((temp + (temp >> 16)) >> 16); }
+       (composite) = (png_uint_16)(0xffff & ((temp + (temp >> 16)) >> 16)); }

 #else  /* Standard method using integer division */

-#  define png_composite(composite, fg, alpha, bg)                          \
-     (composite) = (png_byte)(((png_uint_16)(fg) * (png_uint_16)(alpha) +  \
-     (png_uint_16)(bg) * (png_uint_16)(255 - (png_uint_16)(alpha)) +       \
-     127) / 255)
+#  define png_composite(composite, fg, alpha, bg)                        \
+     (composite) =                                                       \
+         (png_byte)(0xff & (((png_uint_16)(fg) * (png_uint_16)(alpha) +  \
+         (png_uint_16)(bg) * (png_uint_16)(255 - (png_uint_16)(alpha)) + \
+         127) / 255))

 #  define png_composite_16(composite, fg, alpha, bg)                         \
-     (composite) = (png_uint_16)(((png_uint_32)(fg) * (png_uint_32)(alpha) + \
-     (png_uint_32)(bg)*(png_uint_32)(65535 - (png_uint_32)(alpha)) +         \
-     32767) / 65535)
+     (composite) =                                                           \
+         (png_uint_16)(0xffff & (((png_uint_32)(fg) * (png_uint_32)(alpha) + \
+         (png_uint_32)(bg)*(png_uint_32)(65535 - (png_uint_32)(alpha)) +     \
+         32767) / 65535))
 #endif /* READ_COMPOSITE_NODIV */

 #ifdef PNG_READ_INT_FUNCTIONS_SUPPORTED
@@ -2771,8 +2753,9 @@ PNG_EXPORT(207, void, png_save_uint_16, (png_bytep buf, unsigned int i));
 *
 * To read a PNG file using the simplified API:
 *
- * 1) Declare a 'png_image' structure (see below) on the stack and set the
- *    version field to PNG_IMAGE_VERSION.
+ * 1) Declare a 'png_image' structure (see below) on the stack, set the
+ *    version field to PNG_IMAGE_VERSION and the 'opaque' pointer to NULL
+ *    (this is REQUIRED, your program may crash if you don't do it.)
 * 2) Call the appropriate png_image_begin_read... function.
 * 3) Set the png_image 'format' member to the required sample format.
 * 4) Allocate a buffer for the image and, if required, the color-map.
@@ -3197,9 +3180,11 @@ PNG_EXPORT(240, int, png_image_write_to_stdio, (png_imagep image, FILE *file,
 *
 * With all APIs row_stride is handled as in the read APIs - it is the spacing
 * from one row to the next in component sized units (1 or 2 bytes) and if
- * negative indicates a bottom-up row layout in the buffer.
+ * negative indicates a bottom-up row layout in the buffer.  If row_stride is zero,
+ * libpng will calculate it for you from the image width and number of channels.
 *
- * Note that the write API does not support interlacing or sub-8-bit pixels.
+ * Note that the write API does not support interlacing, sub-8-bit pixels, indexed
+ * PNG (color_type 3) or most ancillary chunks.
 */
 #endif /* STDIO */
 #endif /* SIMPLIFIED_WRITE */
--- a/pngconf.h
+++ b/pngconf.h
@@ -1,9 +1,9 @@

 /* pngconf.h - machine configurable file for libpng
 *
- * libpng version 1.6.16beta01,December 14, 2014
+ * libpng version 1.6.18, July 23, 2015
 *
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -11,9 +11,7 @@
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
 *
- */
-
-/* Any machine specific code is near the front of this file, so if you
+ * Any machine specific code is near the front of this file, so if you
 * are configuring libpng for a machine, you may want to read the section
 * starting here down to where it starts to typedef png_color, png_text,
 * and png_info.
@@ -22,26 +20,6 @@
 #ifndef PNGCONF_H
 #define PNGCONF_H

-/* To do: Do all of this in scripts/pnglibconf.dfa */
-#ifdef PNG_SAFE_LIMITS_SUPPORTED
-#  ifdef PNG_USER_WIDTH_MAX
-#    undef PNG_USER_WIDTH_MAX
-#    define PNG_USER_WIDTH_MAX 1000000L
-#  endif
-#  ifdef PNG_USER_HEIGHT_MAX
-#    undef PNG_USER_HEIGHT_MAX
-#    define PNG_USER_HEIGHT_MAX 1000000L
-#  endif
-#  ifdef PNG_USER_CHUNK_MALLOC_MAX
-#    undef PNG_USER_CHUNK_MALLOC_MAX
-#    define PNG_USER_CHUNK_MALLOC_MAX 4000000L
-#  endif
-#  ifdef PNG_USER_CHUNK_CACHE_MAX
-#    undef PNG_USER_CHUNK_CACHE_MAX
-#    define PNG_USER_CHUNK_CACHE_MAX 128
-#  endif
-#endif
-
 #ifndef PNG_BUILDING_SYMBOL_TABLE /* else includes may cause problems */

 /* From libpng 1.6.0 libpng requires an ANSI X3.159-1989 ("ISOC90") compliant C
@@ -317,11 +295,11 @@
    * table entries, so we discard it here.  See the .dfn files in the
    * scripts directory.
    */
-#ifndef PNG_EXPORTA

-#  define PNG_EXPORTA(ordinal, type, name, args, attributes)\
-      PNG_FUNCTION(PNG_EXPORT_TYPE(type),(PNGAPI name),PNGARG(args), \
-        extern attributes)
+#ifndef PNG_EXPORTA
+#  define PNG_EXPORTA(ordinal, type, name, args, attributes) \
+      PNG_FUNCTION(PNG_EXPORT_TYPE(type), (PNGAPI name), PNGARG(args), \
+      PNG_LINKAGE_API attributes)
 #endif

 /* ANSI-C (C90) does not permit a macro to be invoked with an empty argument,
@@ -329,7 +307,7 @@
 */
 #define PNG_EMPTY /*empty list*/

-#define PNG_EXPORT(ordinal, type, name, args)\
+#define PNG_EXPORT(ordinal, type, name, args) \
   PNG_EXPORTA(ordinal, type, name, args, PNG_EMPTY)

 /* Use PNG_REMOVED to comment out a removed interface. */
--- a/pngdebug.h
+++ b/pngdebug.h
@@ -1,12 +1,11 @@

 /* pngdebug.h - Debugging macros for libpng, also used in pngtest.c
 *
+ * Last changed in libpng 1.6.8 [December 19, 2013]
 * Copyright (c) 1998-2013 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
- * Last changed in libpng 1.6.8 [December 19, 2013]
- *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
--- a/pngget.c
+++ b/pngget.c
@@ -1,8 +1,8 @@

 /* pngget.c - retrieval of values from info struct
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.17 [March 26, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -799,14 +799,20 @@ png_get_IHDR(png_const_structrp png_ptr, png_const_inforp info_ptr,
 {
   png_debug1(1, "in %s retrieval function", "IHDR");

-   if (png_ptr == NULL || info_ptr == NULL || width == NULL ||
-       height == NULL || bit_depth == NULL || color_type == NULL)
+   if (png_ptr == NULL || info_ptr == NULL)
      return (0);

-   *width = info_ptr->width;
-   *height = info_ptr->height;
-   *bit_depth = info_ptr->bit_depth;
-   *color_type = info_ptr->color_type;
+   if (width != NULL)
+       *width = info_ptr->width;
+
+   if (height != NULL)
+       *height = info_ptr->height;
+
+   if (bit_depth != NULL)
+       *bit_depth = info_ptr->bit_depth;
+
+   if (color_type != NULL)
+       *color_type = info_ptr->color_type;

   if (compression_type != NULL)
      *compression_type = info_ptr->compression_type;
@@ -1135,21 +1141,21 @@ png_get_compression_buffer_size(png_const_structrp png_ptr)
   if (png_ptr == NULL)
      return 0;

-#  ifdef PNG_WRITE_SUPPORTED
+#ifdef PNG_WRITE_SUPPORTED
      if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0)
-#  endif
+#endif
   {
-#     ifdef PNG_SEQUENTIAL_READ_SUPPORTED
+#ifdef PNG_SEQUENTIAL_READ_SUPPORTED
         return png_ptr->IDAT_read_size;
-#     else
+#else
         return PNG_IDAT_READ_SIZE;
-#     endif
+#endif
   }

-#  ifdef PNG_WRITE_SUPPORTED
+#ifdef PNG_WRITE_SUPPORTED
      else
         return png_ptr->zbuffer_size;
-#  endif
+#endif
 }

 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
--- a/pnginfo.h
+++ b/pnginfo.h
@@ -1,12 +1,11 @@

 /* pnginfo.h - header file for PNG reference library
 *
+ * Last changed in libpng 1.6.1 [March 28, 2013]
 * Copyright (c) 1998-2013 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
- * Last changed in libpng 1.6.1 [March 28, 2013]
- *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
--- a/pngmem.c
+++ b/pngmem.c
@@ -41,7 +41,7 @@ png_destroy_png_struct(png_structrp png_ptr)
 }

 /* Allocate memory.  For reasonable files, size should never exceed
- * 64K.  However, zlib may allocate more then 64K if you don't tell
+ * 64K.  However, zlib may allocate more than 64K if you don't tell
 * it not to.  See zconf.h and png.h for more information.  zlib does
 * need to allocate exactly 64K, so whatever you call here must
 * have the ability to do that.
@@ -77,6 +77,9 @@ png_malloc_base,(png_const_structrp png_ptr, png_alloc_size_t size),
   PNG_UNUSED(png_ptr)
 #endif

+   /* Some compilers complain that this is always true.  However, it
+    * can be false when integer overflow happens.
+    */
   if (size > 0 && size <= PNG_SIZE_MAX
 #     ifdef PNG_MAX_MALLOC_64K
         && size <= 65536U
--- a/pngpread.c
+++ b/pngpread.c
@@ -1,8 +1,8 @@

 /* pngpread.c - read a png file in push mode
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -19,7 +19,6 @@
 #define PNG_READ_SIG_MODE   0
 #define PNG_READ_CHUNK_MODE 1
 #define PNG_READ_IDAT_MODE  2
-#define PNG_SKIP_MODE       3
 #define PNG_READ_tEXt_MODE  4
 #define PNG_READ_zTXt_MODE  5
 #define PNG_READ_DONE_MODE  6
@@ -78,32 +77,14 @@ png_process_data_pause(png_structrp png_ptr, int save)
 png_uint_32 PNGAPI
 png_process_data_skip(png_structrp png_ptr)
 {
-   png_uint_32 remaining = 0;
-
-   if (png_ptr != NULL && png_ptr->process_mode == PNG_SKIP_MODE &&
-      png_ptr->skip_length > 0)
-   {
-      /* At the end of png_process_data the buffer size must be 0 (see the loop
-       * above) so we can detect a broken call here:
-       */
-      if (png_ptr->buffer_size != 0)
-         png_error(png_ptr,
-            "png_process_data_skip called inside png_process_data");
-
-      /* If is impossible for there to be a saved buffer at this point -
-       * otherwise we could not be in SKIP mode.  This will also happen if
-       * png_process_skip is called inside png_process_data (but only very
-       * rarely.)
-       */
-      if (png_ptr->save_buffer_size != 0)
-         png_error(png_ptr, "png_process_data_skip called with saved data");
-
-      remaining = png_ptr->skip_length;
-      png_ptr->skip_length = 0;
-      png_ptr->process_mode = PNG_READ_CHUNK_MODE;
-   }
-
-   return remaining;
+  /* TODO: Deprecate and remove this API.
+   * Somewhere the implementation of this seems to have been lost,
+   * or abandoned.  It was only to support some internal back-door access
+   * to png_struct) in libpng-1.4.x.
+   */
+   png_app_warning(png_ptr,
+"png_process_data_skip is not implemented in any current version of libpng");
+   return 0;
 }

 /* What we do with the incoming data depends on what we were previously
@@ -135,12 +116,6 @@ png_process_some_data(png_structrp png_ptr, png_inforp info_ptr)
         break;
      }

-      case PNG_SKIP_MODE:
-      {
-         png_push_crc_finish(png_ptr);
-         break;
-      }
-
      default:
      {
         png_ptr->buffer_size = 0;
@@ -159,7 +134,7 @@ void /* PRIVATE */
 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr)
 {
   png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ 
-             num_to_check = 8 - num_checked;
+       num_to_check = 8 - num_checked;

   if (png_ptr->buffer_size < num_to_check)
   {
@@ -439,69 +414,6 @@ png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr)
   png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
 }

-void /* PRIVATE */
-png_push_crc_skip(png_structrp png_ptr, png_uint_32 skip)
-{
-   png_ptr->process_mode = PNG_SKIP_MODE;
-   png_ptr->skip_length = skip;
-}
-
-void /* PRIVATE */
-png_push_crc_finish(png_structrp png_ptr)
-{
-   if (png_ptr->skip_length != 0 && png_ptr->save_buffer_size != 0)
-   {
-      png_size_t save_size = png_ptr->save_buffer_size;
-      png_uint_32 skip_length = png_ptr->skip_length;
-
-      /* We want the smaller of 'skip_length' and 'save_buffer_size', but
-       * they are of different types and we don't know which variable has the
-       * fewest bits.  Carefully select the smaller and cast it to the type of
-       * the larger - this cannot overflow.  Do not cast in the following test
-       * - it will break on either 16 or 64 bit platforms.
-       */
-      if (skip_length < save_size)
-         save_size = (png_size_t)skip_length;
-
-      else
-         skip_length = (png_uint_32)save_size;
-
-      png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
-
-      png_ptr->skip_length -= skip_length;
-      png_ptr->buffer_size -= save_size;
-      png_ptr->save_buffer_size -= save_size;
-      png_ptr->save_buffer_ptr += save_size;
-   }
-   if (png_ptr->skip_length != 0 && png_ptr->current_buffer_size != 0)
-   {
-      png_size_t save_size = png_ptr->current_buffer_size;
-      png_uint_32 skip_length = png_ptr->skip_length;
-
-      /* We want the smaller of 'skip_length' and 'current_buffer_size', here,
-       * the same problem exists as above and the same solution.
-       */
-      if (skip_length < save_size)
-         save_size = (png_size_t)skip_length;
-
-      else
-         skip_length = (png_uint_32)save_size;
-
-      png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
-
-      png_ptr->skip_length -= skip_length;
-      png_ptr->buffer_size -= save_size;
-      png_ptr->current_buffer_size -= save_size;
-      png_ptr->current_buffer_ptr += save_size;
-   }
-   if (png_ptr->skip_length == 0)
-   {
-      PNG_PUSH_SAVE_BUFFER_IF_LT(4)
-      png_crc_finish(png_ptr, 0);
-      png_ptr->process_mode = PNG_READ_CHUNK_MODE;
-   }
-}
-
 void PNGCBAPI
 png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
 {
@@ -584,13 +496,11 @@ png_push_save_buffer(png_structrp png_ptr)
      if (png_ptr->save_buffer == NULL)
      {
         png_free(png_ptr, old_buffer);
-         old_buffer = NULL;
         png_error(png_ptr, "Insufficient memory for save_buffer");
      }

      memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
      png_free(png_ptr, old_buffer);
-      old_buffer = NULL;
      png_ptr->save_buffer_max = new_max;
   }
   if (png_ptr->current_buffer_size)
@@ -696,6 +606,7 @@ png_push_read_IDAT(png_structrp png_ptr)
      png_ptr->current_buffer_size -= save_size;
      png_ptr->current_buffer_ptr += save_size;
   }
+
   if (png_ptr->idat_size == 0)
   {
      PNG_PUSH_SAVE_BUFFER_IF_LT(4)
@@ -726,7 +637,7 @@ png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer,
    * or the stream marked as finished.
    */
   while (png_ptr->zstream.avail_in > 0 &&
-      !(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED))
+      (png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
   {
      int ret;

@@ -1036,6 +947,7 @@ png_push_process_row(png_structrp png_ptr)
      }
   }
   else
+#endif
   {
      png_push_have_row(png_ptr, png_ptr->row_buf + 1);
      png_read_push_finish_row(png_ptr);
@@ -1045,6 +957,7 @@ png_push_process_row(png_structrp png_ptr)
 void /* PRIVATE */
 png_read_push_finish_row(png_structrp png_ptr)
 {
+#ifdef PNG_READ_INTERLACING_SUPPORTED
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */

   /* Start of interlace block */
@@ -1069,6 +982,7 @@ png_read_push_finish_row(png_structrp png_ptr)
   if (png_ptr->row_number < png_ptr->num_rows)
      return;

+#ifdef PNG_READ_INTERLACING_SUPPORTED
   if (png_ptr->interlaced != 0)
   {
      png_ptr->row_number = 0;
@@ -1103,6 +1017,7 @@ png_read_push_finish_row(png_structrp png_ptr)

      } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0);
   }
+#endif /* READ_INTERLACING */
 }

 void /* PRIVATE */
@@ -1127,6 +1042,7 @@ png_push_have_row(png_structrp png_ptr, png_bytep row)
         (int)png_ptr->pass);
 }

+#ifdef PNG_READ_INTERLACING_SUPPORTED
 void PNGAPI
 png_progressive_combine_row(png_const_structrp png_ptr, png_bytep old_row,
    png_const_bytep new_row)
@@ -1141,6 +1057,7 @@ png_progressive_combine_row(png_const_structrp png_ptr, png_bytep old_row,
   if (new_row != NULL)
      png_combine_row(png_ptr, old_row, 1/*blocky display*/);
 }
+#endif /* READ_INTERLACING */

 void PNGAPI
 png_set_progressive_read_fn(png_structrp png_ptr, png_voidp progressive_ptr,
--- a/pngpriv.h
+++ b/pngpriv.h
@@ -1,13 +1,11 @@

 /* pngpriv.h - private declarations for use inside libpng
 *
- * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
- * Last changed in libpng 1.6.10 [March 6, 1014]]
- *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
@@ -120,8 +118,12 @@
    * to compile with an appropriate #error if ALIGNED_MEMORY has been turned
    * off.
    *
-    * Note that gcc-4.9 defines __ARM_NEON instead of __ARM_NEON__, so we
-    * check both variants.
+    * Note that gcc-4.9 defines __ARM_NEON instead of the deprecated
+    * __ARM_NEON__, so we check both variants.
+    *
+    * To disable ARM_NEON optimizations entirely, and skip compiling the
+    * associated assembler code, pass --enable-arm-neon=no to configure
+    * or put -DPNG_ARM_NEON_OPT=0 in CPPFLAGS.
    */
 #  if (defined(__ARM_NEON__) || defined(__ARM_NEON)) && \
   defined(PNG_ALIGNED_MEMORY_SUPPORTED)
@@ -250,17 +252,18 @@
 * always be used to declare an extern data or function object in this file.
 */
 #ifndef PNG_INTERNAL_DATA
-#  define PNG_INTERNAL_DATA(type, name, array) extern type name array
+#  define PNG_INTERNAL_DATA(type, name, array) PNG_LINKAGE_DATA type name array
 #endif

 #ifndef PNG_INTERNAL_FUNCTION
 #  define PNG_INTERNAL_FUNCTION(type, name, args, attributes)\
-      extern PNG_FUNCTION(type, name, args, PNG_EMPTY attributes)
+      PNG_LINKAGE_FUNCTION PNG_FUNCTION(type, name, args, PNG_EMPTY attributes)
 #endif

 #ifndef PNG_INTERNAL_CALLBACK
 #  define PNG_INTERNAL_CALLBACK(type, name, args, attributes)\
-      extern PNG_FUNCTION(type, (PNGCBAPI name), args, PNG_EMPTY attributes)
+      PNG_LINKAGE_CALLBACK PNG_FUNCTION(type, (PNGCBAPI name), args,\
+         PNG_EMPTY attributes)
 #endif

 /* If floating or fixed point APIs are disabled they may still be compiled
@@ -298,48 +301,27 @@
 #  define PNG_DLL_EXPORT
 #endif

-/* SECURITY and SAFETY:
+/* This is a global switch to set the compilation for an installed system
+ * (a release build).  It can be set for testing debug builds to ensure that
+ * they will compile when the build type is switched to RC or STABLE, the
+ * default is just to use PNG_LIBPNG_BUILD_BASE_TYPE.  Set this in CPPFLAGS
+ * with either:
 *
- * By default libpng is built without any internal limits on image size,
- * individual heap (png_malloc) allocations or the total amount of memory used.
- * If PNG_SAFE_LIMITS_SUPPORTED is defined, however, the limits below are used
- * (unless individually overridden).  These limits are believed to be fairly
- * safe, but builders of secure systems should verify the values against the
- * real system capabilities.
+ *   -DPNG_RELEASE_BUILD Turns on the release compile path
+ *   -DPNG_RELEASE_BUILD=0 Turns it off
+ * or in your pngusr.h with
+ *   #define PNG_RELEASE_BUILD=1 Turns on the release compile path
+ *   #define PNG_RELEASE_BUILD=0 Turns it off
 */
-#ifdef PNG_SAFE_LIMITS_SUPPORTED
-   /* 'safe' limits */
-#  ifndef PNG_USER_WIDTH_MAX
-#     define PNG_USER_WIDTH_MAX 1000000
-#  endif
-#  ifndef PNG_USER_HEIGHT_MAX
-#     define PNG_USER_HEIGHT_MAX 1000000
-#  endif
-#  ifndef PNG_USER_CHUNK_CACHE_MAX
-#     define PNG_USER_CHUNK_CACHE_MAX 128
-#  endif
-#  ifndef PNG_USER_CHUNK_MALLOC_MAX
-#     define PNG_USER_CHUNK_MALLOC_MAX 8000000
-#  endif
-#else
-   /* values for no limits */
-#  ifndef PNG_USER_WIDTH_MAX
-#     define PNG_USER_WIDTH_MAX 0x7fffffff
-#  endif
-#  ifndef PNG_USER_HEIGHT_MAX
-#     define PNG_USER_HEIGHT_MAX 0x7fffffff
-#  endif
-#  ifndef PNG_USER_CHUNK_CACHE_MAX
-#     define PNG_USER_CHUNK_CACHE_MAX 0
-#  endif
-#  ifndef PNG_USER_CHUNK_MALLOC_MAX
-#     define PNG_USER_CHUNK_MALLOC_MAX 0
-#  endif
+#ifndef PNG_RELEASE_BUILD
+#  define PNG_RELEASE_BUILD (PNG_LIBPNG_BUILD_BASE_TYPE >= PNG_LIBPNG_BUILD_RC)
 #endif

-/* Moved to pngpriv.h at libpng-1.5.0 */
-/* NOTE: some of these may have been used in external applications as
- * these definitions were exposed in pngconf.h prior to 1.5.
+/* SECURITY and SAFETY:
+ *
+ * libpng is built with support for internal limits on image dimensions and
+ * memory usage.  These are documented in scripts/pnglibconf.dfa of the
+ * source and recorded in the machine generated header file pnglibconf.h.
 */

 /* If you are running on a machine where you cannot allocate more
@@ -582,13 +564,13 @@
 #define PNG_RGB_TO_GRAY_WARN  0x400000
 #define PNG_RGB_TO_GRAY       0x600000 /* two bits, RGB_TO_GRAY_ERR|WARN */
 #define PNG_ENCODE_ALPHA      0x800000 /* Added to libpng-1.5.4 */
-#define PNG_ADD_ALPHA         0x1000000 /* Added to libpng-1.2.7 */
-#define PNG_EXPAND_tRNS       0x2000000 /* Added to libpng-1.2.9 */
-#define PNG_SCALE_16_TO_8     0x4000000 /* Added to libpng-1.5.4 */
-                       /*   0x8000000 unused */
-                       /*  0x10000000 unused */
-                       /*  0x20000000 unused */
-                       /*  0x40000000 unused */
+#define PNG_ADD_ALPHA        0x1000000 /* Added to libpng-1.2.7 */
+#define PNG_EXPAND_tRNS      0x2000000 /* Added to libpng-1.2.9 */
+#define PNG_SCALE_16_TO_8    0x4000000 /* Added to libpng-1.5.4 */
+                       /*    0x8000000 unused */
+                       /*   0x10000000 unused */
+                       /*   0x20000000 unused */
+                       /*   0x40000000 unused */
 /* Flags for png_create_struct */
 #define PNG_STRUCT_PNG   0x0001
 #define PNG_STRUCT_INFO  0x0002
@@ -780,15 +762,17 @@
 * macro will fail on top-bit-set values because of the sign extension.
 */
 #define PNG_CHUNK_FROM_STRING(s)\
-   PNG_U32(0xff&(s)[0], 0xff&(s)[1], 0xff&(s)[2], 0xff&(s)[3])
+   PNG_U32(0xff & (s)[0], 0xff & (s)[1], 0xff & (s)[2], 0xff & (s)[3])

 /* This uses (char), not (png_byte) to avoid warnings on systems where (char) is
 * signed and the argument is a (char[])  This macro will fail miserably on
 * systems where (char) is more than 8 bits.
 */
 #define PNG_STRING_FROM_CHUNK(s,c)\
-   (void)(((char*)(s))[0]=(char)((c)>>24), ((char*)(s))[1]=(char)((c)>>16),\
-   ((char*)(s))[2]=(char)((c)>>8), ((char*)(s))[3]=(char)((c)))
+   (void)(((char*)(s))[0]=(char)(((c)>>24) & 0xff), \
+   ((char*)(s))[1]=(char)(((c)>>16) & 0xff),\
+   ((char*)(s))[2]=(char)(((c)>>8) & 0xff), \
+   ((char*)(s))[3]=(char)((c & 0xff)))

 /* Do the same but terminate with a null character. */
 #define PNG_CSTRING_FROM_CHUNK(s,c)\
@@ -850,8 +834,9 @@ PNG_INTERNAL_DATA(const png_uint_16, png_sRGB_table, [256]);
 PNG_INTERNAL_DATA(const png_uint_16, png_sRGB_base, [512]);
 PNG_INTERNAL_DATA(const png_byte, png_sRGB_delta, [512]);

-#define PNG_sRGB_FROM_LINEAR(linear) ((png_byte)((png_sRGB_base[(linear)>>15] +\
-   ((((linear)&0x7fff)*png_sRGB_delta[(linear)>>15])>>12)) >> 8))
+#define PNG_sRGB_FROM_LINEAR(linear) \
+  ((png_byte)(0xff & ((png_sRGB_base[(linear)>>15] \
+   + ((((linear) & 0x7fff)*png_sRGB_delta[(linear)>>15])>>12)) >> 8)))
   /* Given a value 'linear' in the range 0..255*65535 calculate the 8-bit sRGB
    * encoded value with maximum error 0.646365.  Note that the input is not a
    * 16-bit value; it has been multiplied by 255! */
@@ -910,7 +895,7 @@ PNG_INTERNAL_FUNCTION(png_voidp,png_malloc_base,(png_const_structrp png_ptr,
 #if defined(PNG_TEXT_SUPPORTED) || defined(PNG_sPLT_SUPPORTED) ||\
   defined(PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED)
 /* Internal array allocator, outputs no error or warning messages on failure,
- * just returns NULL.  
+ * just returns NULL.
 */
 PNG_INTERNAL_FUNCTION(png_voidp,png_malloc_array,(png_const_structrp png_ptr,
   int nelements, size_t element_size),PNG_ALLOCATED);
@@ -1408,10 +1393,6 @@ PNG_INTERNAL_FUNCTION(void,png_push_read_chunk,(png_structrp png_ptr,
 PNG_INTERNAL_FUNCTION(void,png_push_read_sig,(png_structrp png_ptr,
    png_inforp info_ptr),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_check_crc,(png_structrp png_ptr),PNG_EMPTY);
-PNG_INTERNAL_FUNCTION(void,png_push_crc_skip,(png_structrp png_ptr,
-    png_uint_32 length),PNG_EMPTY);
-PNG_INTERNAL_FUNCTION(void,png_push_crc_finish,(png_structrp png_ptr),
-    PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_save_buffer,(png_structrp png_ptr),
    PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_restore_buffer,(png_structrp png_ptr,
--- a/pngread.c
+++ b/pngread.c
@@ -1,8 +1,8 @@

 /* pngread.c - read a PNG file
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.17 [March 26, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -63,7 +63,7 @@ png_create_read_struct_2,(png_const_charp user_png_ver, png_voidp error_ptr,
         /* In stable builds only warn if an application error can be completely
          * handled.
          */
-#        if PNG_LIBPNG_BUILD_BASE_TYPE >= PNG_LIBPNG_BUILD_RC
+#        if PNG_RELEASE_BUILD
            png_ptr->flags |= PNG_FLAG_APP_WARNINGS_WARN;
 #        endif
 #     endif
@@ -814,8 +814,7 @@ png_read_end(png_structrp png_ptr, png_inforp info_ptr)
         /* Zero length IDATs are legal after the last IDAT has been
          * read, but not after other chunks have been read.
          */
-         if ((length > 0) ||
-             (png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) != 0)
+         if ((length > 0) || (png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) != 0)
            png_benign_error(png_ptr, "Too many IDATs found");

         png_crc_finish(png_ptr, length);
@@ -1044,9 +1043,9 @@ png_read_png(png_structrp png_ptr, png_inforp info_ptr,
   /* Tell libpng to strip 16-bit/color files down to 8 bits per color.
    */
   if ((transforms & PNG_TRANSFORM_SCALE_16) != 0)
-     /* Added at libpng-1.5.4. "strip_16" produces the same result that it
-      * did in earlier versions, while "scale_16" is now more accurate.
-      */
+      /* Added at libpng-1.5.4. "strip_16" produces the same result that it
+       * did in earlier versions, while "scale_16" is now more accurate.
+       */
 #ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
      png_set_scale_16(png_ptr);
 #else
@@ -1210,7 +1209,7 @@ png_read_png(png_structrp png_ptr, png_inforp info_ptr,

      for (iptr = 0; iptr < info_ptr->height; iptr++)
         info_ptr->row_pointers[iptr] = png_voidcast(png_bytep,
-            png_malloc(png_ptr, info_ptr->rowbytes));
+             png_malloc(png_ptr, info_ptr->rowbytes));
   }

   png_read_image(png_ptr, info_ptr->row_pointers);
@@ -1824,6 +1823,7 @@ png_create_colormap_entry(png_image_read_control *display,
            y = (y + 128) >> 8;
            y *= 255;
            y = PNG_sRGB_FROM_LINEAR((y + 64) >> 7);
+            alpha = PNG_DIV257(alpha);
            encoding = P_sRGB;
         }

@@ -2286,8 +2286,14 @@ png_image_read_colormap(png_voidp argument)
                     output_processing = PNG_CMAP_NONE;
                     break;
                  }
-
+#ifdef __COVERITY__
+                 /* Coverity claims that output_encoding cannot be 2 (P_LINEAR)
+                  * here.
+                  */
+                  back_alpha = 255;
+#else
                  back_alpha = output_encoding == P_LINEAR ? 65535 : 255;
+#endif
               }

               /* output_processing means that the libpng-processed row will be
@@ -2412,7 +2418,14 @@ png_image_read_colormap(png_voidp argument)
                */
               background_index = i;
               png_create_colormap_entry(display, i++, back_r, back_g, back_b,
-                  output_encoding == P_LINEAR ? 65535U : 255U, output_encoding);
+#ifdef __COVERITY__
+                 /* Coverity claims that output_encoding cannot be 2 (P_LINEAR)
+                  * here.
+                  */ 255U,
+#else
+                  output_encoding == P_LINEAR ? 65535U : 255U,
+#endif
+                  output_encoding);

               /* For non-opaque input composite on the sRGB background - this
                * requires inverting the encoding for each component.  The input
@@ -3246,7 +3259,7 @@ png_image_read_composite(png_voidp argument)
      png_uint_32  width = image->width;
      ptrdiff_t    step_row = display->row_bytes;
      unsigned int channels =
-         (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
+          (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
      int pass;

      for (pass = 0; pass < passes; ++pass)
--- a/pngrio.c
+++ b/pngrio.c
@@ -1,8 +1,8 @@

 /* pngrio.c - functions for data input
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.17 [March 26, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -26,7 +26,7 @@
 * reads from a file pointer.  Note that this routine sometimes gets called
 * with very small lengths, so you should implement some kind of simple
 * buffering if you are using unbuffered reads.  This should never be asked
- * to read more then 64K on a 16 bit machine.
+ * to read more than 64K on a 16 bit machine.
 */
 void /* PRIVATE */
 png_read_data(png_structrp png_ptr, png_bytep data, png_size_t length)
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -1,8 +1,8 @@

 /* pngrtran.c - transforms the data in a row for PNG readers
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -394,7 +394,7 @@ png_set_alpha_mode(png_structrp png_ptr, int mode, double output_gamma)
 /* Dither file to 8-bit.  Supply a palette, the current number
 * of elements in the palette, the maximum number of elements
 * allowed, and a histogram if possible.  If the current number
- * of colors is greater then the maximum number, the palette will be
+ * of colors is greater than the maximum number, the palette will be
 * modified to fit in the maximum number.  "full_quantize" indicates
 * whether we need a quantizing cube set up for RGB images, or if we
 * simply are reducing the number of colors in a paletted image.
@@ -2357,7 +2357,7 @@ png_do_unshift(png_row_infop row_info, png_bytep row,
               if (++channel >= channels)
                  channel = 0;
               *bp++ = (png_byte)(value >> 8);
-               *bp++ = (png_byte)(value & 0xff);
+               *bp++ = (png_byte)value;
            }
            break;
         }
@@ -2662,9 +2662,9 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
   png_uint_32 row_width = row_info->width;

 #ifdef PNG_READ_16BIT_SUPPORTED
-   png_byte hi_filler = (png_byte)((filler>>8) & 0xff);
+   png_byte hi_filler = (png_byte)(filler>>8);
 #endif
-   png_byte lo_filler = (png_byte)(filler & 0xff);
+   png_byte lo_filler = (png_byte)filler;

   png_debug(1, "in png_do_read_filler");

@@ -2715,13 +2715,13 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
            png_bytep dp = sp  + (png_size_t)row_width * 2;
            for (i = 1; i < row_width; i++)
            {
-               *(--dp) = hi_filler;
               *(--dp) = lo_filler;
+               *(--dp) = hi_filler;
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
            }
-            *(--dp) = hi_filler;
            *(--dp) = lo_filler;
+            *(--dp) = hi_filler;
            row_info->channels = 2;
            row_info->pixel_depth = 32;
            row_info->rowbytes = row_width * 4;
@@ -2736,8 +2736,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
            {
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
-               *(--dp) = hi_filler;
               *(--dp) = lo_filler;
+               *(--dp) = hi_filler;
            }
            row_info->channels = 2;
            row_info->pixel_depth = 32;
@@ -2796,8 +2796,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
            png_bytep dp = sp  + (png_size_t)row_width * 2;
            for (i = 1; i < row_width; i++)
            {
-               *(--dp) = hi_filler;
               *(--dp) = lo_filler;
+               *(--dp) = hi_filler;
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
@@ -2805,8 +2805,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
            }
-            *(--dp) = hi_filler;
            *(--dp) = lo_filler;
+            *(--dp) = hi_filler;
            row_info->channels = 4;
            row_info->pixel_depth = 64;
            row_info->rowbytes = row_width * 8;
@@ -2825,8 +2825,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
               *(--dp) = *(--sp);
-               *(--dp) = hi_filler;
               *(--dp) = lo_filler;
+               *(--dp) = hi_filler;
            }

            row_info->channels = 4;
@@ -3087,10 +3087,11 @@ png_do_rgb_to_gray(png_structrp png_ptr, png_row_infop row_info, png_bytep row)
            for (i = 0; i < row_width; i++)
            {
               png_uint_16 red, green, blue, w;
+               png_byte hi,lo;

-               red   = (png_uint_16)(((*(sp)) << 8) | *(sp + 1)); sp += 2;
-               green = (png_uint_16)(((*(sp)) << 8) | *(sp + 1)); sp += 2;
-               blue  = (png_uint_16)(((*(sp)) << 8) | *(sp + 1)); sp += 2;
+               hi=*(sp)++; lo=*(sp)++; red   = (png_uint_16)((hi << 8) | (lo));
+               hi=*(sp)++; lo=*(sp)++; green = (png_uint_16)((hi << 8) | (lo));
+               hi=*(sp)++; lo=*(sp)++; blue  = (png_uint_16)((hi << 8) | (lo));

               if (red == green && red == blue)
               {
@@ -3104,16 +3105,16 @@ png_do_rgb_to_gray(png_structrp png_ptr, png_row_infop row_info, png_bytep row)

               else
               {
-                  png_uint_16 red_1   = png_ptr->gamma_16_to_1[(red&0xff)
+                  png_uint_16 red_1   = png_ptr->gamma_16_to_1[(red & 0xff)
                      >> png_ptr->gamma_shift][red>>8];
                  png_uint_16 green_1 =
-                      png_ptr->gamma_16_to_1[(green&0xff) >>
+                      png_ptr->gamma_16_to_1[(green & 0xff) >>
                      png_ptr->gamma_shift][green>>8];
-                  png_uint_16 blue_1  = png_ptr->gamma_16_to_1[(blue&0xff)
+                  png_uint_16 blue_1  = png_ptr->gamma_16_to_1[(blue & 0xff)
                      >> png_ptr->gamma_shift][blue>>8];
                  png_uint_16 gray16  = (png_uint_16)((rc*red_1 + gc*green_1
                      + bc*blue_1 + 16384)>>15);
-                  w = png_ptr->gamma_16_from_1[(gray16&0xff) >>
+                  w = png_ptr->gamma_16_from_1[(gray16 & 0xff) >>
                      png_ptr->gamma_shift][gray16 >> 8];
                  rgb_error |= 1;
               }
@@ -3138,10 +3139,11 @@ png_do_rgb_to_gray(png_structrp png_ptr, png_row_infop row_info, png_bytep row)
            for (i = 0; i < row_width; i++)
            {
               png_uint_16 red, green, blue, gray16;
+               png_byte hi,lo;

-               red   = (png_uint_16)(((*(sp)) << 8) | *(sp + 1)); sp += 2;
-               green = (png_uint_16)(((*(sp)) << 8) | *(sp + 1)); sp += 2;
-               blue  = (png_uint_16)(((*(sp)) << 8) | *(sp + 1)); sp += 2;
+               hi=*(sp)++; lo=*(sp)++; red   = (png_uint_16)((hi << 8) | (lo));
+               hi=*(sp)++; lo=*(sp)++; green = (png_uint_16)((hi << 8) | (lo));
+               hi=*(sp)++; lo=*(sp)++; blue  = (png_uint_16)((hi << 8) | (lo));

               if (red != green || red != blue)
                  rgb_error |= 1;
@@ -3667,7 +3669,8 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                        if (optimize != 0)
                           w = v;
                        else
-                           w = gamma_16_from_1[(v&0xff) >> gamma_shift][v >> 8];
+                           w = gamma_16_from_1[(v & 0xff) >>
+                               gamma_shift][v >> 8];
                        *sp = (png_byte)((w >> 8) & 0xff);
                        *(sp + 1) = (png_byte)(w & 0xff);
                     }
@@ -3831,7 +3834,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                        v = gamma_16_to_1[*(sp + 1) >> gamma_shift][*sp];
                        png_composite_16(w, v, a, png_ptr->background_1.red);
                        if (optimize == 0)
-                           w = gamma_16_from_1[((w&0xff) >> gamma_shift)][w >>
+                           w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >>
                                8];
                        *sp = (png_byte)((w >> 8) & 0xff);
                        *(sp + 1) = (png_byte)(w & 0xff);
@@ -3839,7 +3842,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                        v = gamma_16_to_1[*(sp + 3) >> gamma_shift][*(sp + 2)];
                        png_composite_16(w, v, a, png_ptr->background_1.green);
                        if (optimize == 0)
-                           w = gamma_16_from_1[((w&0xff) >> gamma_shift)][w >>
+                           w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >>
                                8];

                        *(sp + 2) = (png_byte)((w >> 8) & 0xff);
@@ -3848,7 +3851,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                        v = gamma_16_to_1[*(sp + 5) >> gamma_shift][*(sp + 4)];
                        png_composite_16(w, v, a, png_ptr->background_1.blue);
                        if (optimize == 0)
-                           w = gamma_16_from_1[((w&0xff) >> gamma_shift)][w >>
+                           w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >>
                                8];

                        *(sp + 4) = (png_byte)((w >> 8) & 0xff);
@@ -4457,7 +4460,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,

               for (i = 0; i < row_width; i++)
               {
-                  if (*sp == gray)
+                  if ((*sp & 0xffU) == gray)
                     *dp-- = 0;

                  else
@@ -4475,7 +4478,8 @@ png_do_expand(png_row_infop row_info, png_bytep row,
               dp = row + (row_info->rowbytes << 1) - 1;
               for (i = 0; i < row_width; i++)
               {
-                  if (*(sp - 1) == gray_high && *(sp) == gray_low)
+                  if ((*(sp - 1) & 0xffU) == gray_high &&
+                      (*(sp) & 0xffU) == gray_low)
                  {
                     *dp-- = 0;
                     *dp-- = 0;
@@ -4837,7 +4841,7 @@ png_do_read_transformations(png_structrp png_ptr, png_row_infop row_info)
      /* Because PNG_COMPOSE does the gamma transform if there is something to
       * do (if there is an alpha channel or transparency.)
       */
-       !((png_ptr->transformations & PNG_COMPOSE) &&
+       !((png_ptr->transformations & PNG_COMPOSE) != 0 &&
       ((png_ptr->num_trans != 0) ||
       (png_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)) &&
 #endif
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,8 +1,8 @@

 /* pngrutil.c - utilities to read a PNG file
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -341,7 +341,7 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
       * are minimal.
       */
      (void)png_safecat(msg, (sizeof msg), 4, " using zstream");
-#if PNG_LIBPNG_BUILD_BASE_TYPE >= PNG_LIBPNG_BUILD_RC
+#if PNG_RELEASE_BUILD
      png_chunk_warning(png_ptr, msg);
      png_ptr->zowner = 0;
 #else
@@ -575,7 +575,7 @@ png_decompress_chunk(png_structrp png_ptr,
    */
   png_alloc_size_t limit = PNG_SIZE_MAX;

-# ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
+# ifdef PNG_SET_USER_LIMITS_SUPPORTED
   if (png_ptr->user_chunk_malloc_max > 0 &&
       png_ptr->user_chunk_malloc_max < limit)
      limit = png_ptr->user_chunk_malloc_max;
@@ -670,7 +670,6 @@ png_decompress_chunk(png_structrp png_ptr,
                   * success)
                   */
                  png_free(png_ptr, text);
-                  text = NULL;

                  /* This really is very benign, but it's still an error because
                   * the extra space may otherwise be used as a Trojan Horse.
@@ -788,6 +787,7 @@ png_inflate_read(png_structrp png_ptr, png_bytep read_buffer, uInt read_size,
 #endif

 /* Read and check the IDHR chunk */
+
 void /* PRIVATE */
 png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
 {
@@ -852,8 +852,7 @@ png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
   }

   /* Set up other useful info */
-   png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *
-   png_ptr->channels);
+   png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels);
   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
   png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);
   png_debug1(3, "channels = %d", png_ptr->channels);
@@ -1147,11 +1146,13 @@ png_handle_sBIT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
      return;

   for (i=0; i<truelen; ++i)
+   {
      if (buf[i] == 0 || buf[i] > sample_depth)
      {
         png_chunk_benign_error(png_ptr, "invalid");
         return;
      }
+   }

   if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
   {
@@ -1462,10 +1463,10 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
                                    finished = 1;

 #                                   ifdef PNG_sRGB_SUPPORTED
-                                       /* Check for a match against sRGB */
-                                       png_icc_set_sRGB(png_ptr,
-                                          &png_ptr->colorspace, profile,
-                                          png_ptr->zstream.adler);
+                                    /* Check for a match against sRGB */
+                                    png_icc_set_sRGB(png_ptr,
+                                       &png_ptr->colorspace, profile,
+                                       png_ptr->zstream.adler);
 #                                   endif

                                    /* Steal the profile for info_ptr. */
@@ -1515,8 +1516,10 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
                                 else if (size > 0)
                                    errmsg = "truncated";

+#ifndef __COVERITY__
                                 else
                                    errmsg = png_ptr->zstream.msg;
+#endif
                              }

                              /* else png_icc_check_tag_table output an error */
@@ -1673,8 +1676,8 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)

   if (dl > max_dl)
   {
-       png_warning(png_ptr, "sPLT chunk too long");
-       return;
+      png_warning(png_ptr, "sPLT chunk too long");
+      return;
   }

   new_palette.nentries = (png_int_32)(data_length / entry_size);
@@ -1684,8 +1687,8 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)

   if (new_palette.entries == NULL)
   {
-       png_warning(png_ptr, "sPLT chunk requires too much memory");
-       return;
+      png_warning(png_ptr, "sPLT chunk requires too much memory");
+      return;
   }

 #ifdef PNG_POINTER_INDEXING_SUPPORTED
@@ -1815,7 +1818,8 @@ png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
         return;
      }

-      if (length > png_ptr->num_palette || length > PNG_MAX_PALETTE_LENGTH ||
+      if (length > png_ptr->num_palette ||
+         length > (unsigned int) PNG_MAX_PALETTE_LENGTH ||
         length == 0)
      {
         png_crc_finish(png_ptr, length);
@@ -1978,7 +1982,7 @@ png_handle_hIST(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)

   num = length / 2 ;

-   if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH)
+   if (num != png_ptr->num_palette || num > (unsigned int) PNG_MAX_PALETTE_LENGTH)
   {
      png_crc_finish(png_ptr, length);
      png_chunk_benign_error(png_ptr, "invalid");
@@ -2713,14 +2717,14 @@ png_cache_unknown_chunk(png_structrp png_ptr, png_uint_32 length)
      png_ptr->unknown_chunk.data = NULL;
   }

-#  ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
-      if (png_ptr->user_chunk_malloc_max > 0 &&
-          png_ptr->user_chunk_malloc_max < limit)
-         limit = png_ptr->user_chunk_malloc_max;
+#  ifdef PNG_SET_USER_LIMITS_SUPPORTED
+   if (png_ptr->user_chunk_malloc_max > 0 &&
+       png_ptr->user_chunk_malloc_max < limit)
+      limit = png_ptr->user_chunk_malloc_max;

 #  elif PNG_USER_CHUNK_MALLOC_MAX > 0
-      if (PNG_USER_CHUNK_MALLOC_MAX < limit)
-         limit = PNG_USER_CHUNK_MALLOC_MAX;
+   if (PNG_USER_CHUNK_MALLOC_MAX < limit)
+      limit = PNG_USER_CHUNK_MALLOC_MAX;
 #  endif

   if (length <= limit)
@@ -2783,7 +2787,7 @@ png_handle_unknown(png_structrp png_ptr, png_inforp info_ptr,
    */
 #  ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 #     ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
-         keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name);
+   keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name);
 #     endif
 #  endif

@@ -2792,153 +2796,153 @@ png_handle_unknown(png_structrp png_ptr, png_inforp info_ptr,
    * PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
    */
 #  ifdef PNG_READ_USER_CHUNKS_SUPPORTED
-      /* The user callback takes precedence over the chunk keep value, but the
-       * keep value is still required to validate a save of a critical chunk.
-       */
-      if (png_ptr->read_user_chunk_fn != NULL)
+   /* The user callback takes precedence over the chunk keep value, but the
+    * keep value is still required to validate a save of a critical chunk.
+    */
+   if (png_ptr->read_user_chunk_fn != NULL)
+   {
+      if (png_cache_unknown_chunk(png_ptr, length) != 0)
      {
-         if (png_cache_unknown_chunk(png_ptr, length) != 0)
+         /* Callback to user unknown chunk handler */
+         int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr,
+            &png_ptr->unknown_chunk);
+
+         /* ret is:
+          * negative: An error occurred; png_chunk_error will be called.
+          *     zero: The chunk was not handled, the chunk will be discarded
+          *           unless png_set_keep_unknown_chunks has been used to set
+          *           a 'keep' behavior for this particular chunk, in which
+          *           case that will be used.  A critical chunk will cause an
+          *           error at this point unless it is to be saved.
+          * positive: The chunk was handled, libpng will ignore/discard it.
+          */
+         if (ret < 0)
+            png_chunk_error(png_ptr, "error in user chunk");
+
+         else if (ret == 0)
         {
-            /* Callback to user unknown chunk handler */
-            int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr,
-               &png_ptr->unknown_chunk);
-
-            /* ret is:
-             * negative: An error occured, png_chunk_error will be called.
-             *     zero: The chunk was not handled, the chunk will be discarded
-             *           unless png_set_keep_unknown_chunks has been used to set
-             *           a 'keep' behavior for this particular chunk, in which
-             *           case that will be used.  A critical chunk will cause an
-             *           error at this point unless it is to be saved.
-             * positive: The chunk was handled, libpng will ignore/discard it.
+            /* If the keep value is 'default' or 'never' override it, but
+             * still error out on critical chunks unless the keep value is
+             * 'always'  While this is weird it is the behavior in 1.4.12.
+             * A possible improvement would be to obey the value set for the
+             * chunk, but this would be an API change that would probably
+             * damage some applications.
+             *
+             * The png_app_warning below catches the case that matters, where
+             * the application has not set specific save or ignore for this
+             * chunk or global save or ignore.
             */
-            if (ret < 0)
-               png_chunk_error(png_ptr, "error in user chunk");
-
-            else if (ret == 0)
+            if (keep < PNG_HANDLE_CHUNK_IF_SAFE)
            {
-               /* If the keep value is 'default' or 'never' override it, but
-                * still error out on critical chunks unless the keep value is
-                * 'always'  While this is weird it is the behavior in 1.4.12.
-                * A possible improvement would be to obey the value set for the
-                * chunk, but this would be an API change that would probably
-                * damage some applications.
-                *
-                * The png_app_warning below catches the case that matters, where
-                * the application has not set specific save or ignore for this
-                * chunk or global save or ignore.
-                */
-               if (keep < PNG_HANDLE_CHUNK_IF_SAFE)
+#              ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
+               if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE)
               {
-#                 ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
-                     if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE)
-                     {
-                        png_chunk_warning(png_ptr, "Saving unknown chunk:");
-                        png_app_warning(png_ptr,
-                           "forcing save of an unhandled chunk;"
-                           " please call png_set_keep_unknown_chunks");
-                           /* with keep = PNG_HANDLE_CHUNK_IF_SAFE */
-                     }
-#                 endif
-                  keep = PNG_HANDLE_CHUNK_IF_SAFE;
+                  png_chunk_warning(png_ptr, "Saving unknown chunk:");
+                  png_app_warning(png_ptr,
+                     "forcing save of an unhandled chunk;"
+                     " please call png_set_keep_unknown_chunks");
+                     /* with keep = PNG_HANDLE_CHUNK_IF_SAFE */
               }
-            }
-
-            else /* chunk was handled */
-            {
-               handled = 1;
-               /* Critical chunks can be safely discarded at this point. */
-               keep = PNG_HANDLE_CHUNK_NEVER;
+#              endif
+               keep = PNG_HANDLE_CHUNK_IF_SAFE;
            }
         }

-         else
-            keep = PNG_HANDLE_CHUNK_NEVER; /* insufficient memory */
+         else /* chunk was handled */
+         {
+            handled = 1;
+            /* Critical chunks can be safely discarded at this point. */
+            keep = PNG_HANDLE_CHUNK_NEVER;
+         }
      }

      else
-         /* Use the SAVE_UNKNOWN_CHUNKS code or skip the chunk */
+         keep = PNG_HANDLE_CHUNK_NEVER; /* insufficient memory */
+   }
+
+   else
+   /* Use the SAVE_UNKNOWN_CHUNKS code or skip the chunk */
 #  endif /* READ_USER_CHUNKS */

 #  ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED
+   {
+      /* keep is currently just the per-chunk setting, if there was no
+       * setting change it to the global default now (not that this may
+       * still be AS_DEFAULT) then obtain the cache of the chunk if required,
+       * if not simply skip the chunk.
+       */
+      if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT)
+         keep = png_ptr->unknown_default;
+
+      if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
+         (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
+          PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
      {
-         /* keep is currently just the per-chunk setting, if there was no
-          * setting change it to the global default now (not that this may
-          * still be AS_DEFAULT) then obtain the cache of the chunk if required,
-          * if not simply skip the chunk.
-          */
-         if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT)
-            keep = png_ptr->unknown_default;
-
-         if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
-            (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
-             PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
-         {
-            if (png_cache_unknown_chunk(png_ptr, length) == 0)
-               keep = PNG_HANDLE_CHUNK_NEVER;
-         }
-
-         else
-            png_crc_finish(png_ptr, length);
+         if (png_cache_unknown_chunk(png_ptr, length) == 0)
+            keep = PNG_HANDLE_CHUNK_NEVER;
      }
+
+      else
+         png_crc_finish(png_ptr, length);
+   }
 #  else
 #     ifndef PNG_READ_USER_CHUNKS_SUPPORTED
 #        error no method to support READ_UNKNOWN_CHUNKS
 #     endif

-      {
-         /* If here there is no read callback pointer set and no support is
-          * compiled in to just save the unknown chunks, so simply skip this
-          * chunk.  If 'keep' is something other than AS_DEFAULT or NEVER then
-          * the app has erroneously asked for unknown chunk saving when there
-          * is no support.
-          */
-         if (keep > PNG_HANDLE_CHUNK_NEVER)
-            png_app_error(png_ptr, "no unknown chunk support available");
+   {
+      /* If here there is no read callback pointer set and no support is
+       * compiled in to just save the unknown chunks, so simply skip this
+       * chunk.  If 'keep' is something other than AS_DEFAULT or NEVER then
+       * the app has erroneously asked for unknown chunk saving when there
+       * is no support.
+       */
+      if (keep > PNG_HANDLE_CHUNK_NEVER)
+         png_app_error(png_ptr, "no unknown chunk support available");

-         png_crc_finish(png_ptr, length);
-      }
+      png_crc_finish(png_ptr, length);
+   }
 #  endif

 #  ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
-      /* Now store the chunk in the chunk list if appropriate, and if the limits
-       * permit it.
-       */
-      if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
-         (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
-          PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
+   /* Now store the chunk in the chunk list if appropriate, and if the limits
+    * permit it.
+    */
+   if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
+      (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
+       PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
+   {
+#     ifdef PNG_USER_LIMITS_SUPPORTED
+      switch (png_ptr->user_chunk_cache_max)
      {
-#     ifdef PNG_USER_LIMITS_SUPPORTED
-         switch (png_ptr->user_chunk_cache_max)
-         {
-            case 2:
-               png_ptr->user_chunk_cache_max = 1;
-               png_chunk_benign_error(png_ptr, "no space in chunk cache");
-               /* FALL THROUGH */
-            case 1:
-               /* NOTE: prior to 1.6.0 this case resulted in an unknown critical
-                * chunk being skipped, now there will be a hard error below.
-                */
-               break;
+         case 2:
+            png_ptr->user_chunk_cache_max = 1;
+            png_chunk_benign_error(png_ptr, "no space in chunk cache");
+            /* FALL THROUGH */
+         case 1:
+            /* NOTE: prior to 1.6.0 this case resulted in an unknown critical
+             * chunk being skipped, now there will be a hard error below.
+             */
+            break;

-            default: /* not at limit */
-               --(png_ptr->user_chunk_cache_max);
-               /* FALL THROUGH */
-            case 0: /* no limit */
-#     endif /* USER_LIMITS */
-               /* Here when the limit isn't reached or when limits are compiled
-                * out; store the chunk.
-                */
-               png_set_unknown_chunks(png_ptr, info_ptr,
-                  &png_ptr->unknown_chunk, 1);
-               handled = 1;
-#     ifdef PNG_USER_LIMITS_SUPPORTED
-               break;
-         }
-#     endif
+         default: /* not at limit */
+            --(png_ptr->user_chunk_cache_max);
+            /* FALL THROUGH */
+         case 0: /* no limit */
+#  endif /* USER_LIMITS */
+            /* Here when the limit isn't reached or when limits are compiled
+             * out; store the chunk.
+             */
+            png_set_unknown_chunks(png_ptr, info_ptr,
+               &png_ptr->unknown_chunk, 1);
+            handled = 1;
+#  ifdef PNG_USER_LIMITS_SUPPORTED
+            break;
      }
+#  endif
+   }
 #  else /* no store support: the chunk must be handled by the user callback */
-      PNG_UNUSED(info_ptr)
+   PNG_UNUSED(info_ptr)
 #  endif

   /* Regardless of the error handling below the cached data (if any) can be
@@ -3003,7 +3007,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
 {
   unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
   png_const_bytep sp = png_ptr->row_buf + 1;
-   png_uint_32 row_width = png_ptr->width;
+   png_alloc_size_t row_width = png_ptr->width;
   unsigned int pass = png_ptr->pass;
   png_bytep end_ptr = 0;
   png_byte end_byte = 0;
@@ -3040,13 +3044,13 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
      end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1;
      end_byte = *end_ptr;
 #     ifdef PNG_READ_PACKSWAP_SUPPORTED
-         if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
-            /* little-endian byte */
-            end_mask = 0xff << end_mask;
+      if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
+         /* little-endian byte */
+         end_mask = 0xff << end_mask;

-         else /* big-endian byte */
+      else /* big-endian byte */
 #     endif
-         end_mask = 0xff >> end_mask;
+      end_mask = 0xff >> end_mask;
      /* end_mask is now the bits to *keep* from the destination row */
   }

@@ -3204,12 +3208,12 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
         png_uint_32 mask;

 #        ifdef PNG_READ_PACKSWAP_SUPPORTED
-            if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
-               mask = MASK(pass, pixel_depth, display, 0);
+         if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
+            mask = MASK(pass, pixel_depth, display, 0);

-            else
+         else
 #        endif
-            mask = MASK(pass, pixel_depth, display, 1);
+         mask = MASK(pass, pixel_depth, display, 1);

         for (;;)
         {
@@ -3278,7 +3282,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)

            /* But don't allow this number to exceed the actual row width. */
            if (bytes_to_copy > row_width)
-               bytes_to_copy = row_width;
+               bytes_to_copy = (unsigned int)/*SAFE*/row_width;
         }

         else /* normal row; Adam7 only ever gives us one pixel to copy. */
@@ -3458,7 +3462,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
                  dp += bytes_to_jump;
                  row_width -= bytes_to_jump;
                  if (bytes_to_copy > row_width)
-                     bytes_to_copy = row_width;
+                     bytes_to_copy = (unsigned int)/*SAFE*/row_width;
               }
         }

@@ -3810,15 +3814,15 @@ png_read_filter_row_paeth_1byte_pixel(png_row_infop row_info, png_bytep row,
      p = b - c;
      pc = a - c;

-#     ifdef PNG_USE_ABS
-         pa = abs(p);
-         pb = abs(pc);
-         pc = abs(p + pc);
-#     else
-         pa = p < 0 ? -p : p;
-         pb = pc < 0 ? -pc : pc;
-         pc = (p + pc) < 0 ? -(p + pc) : p + pc;
-#     endif
+#ifdef PNG_USE_ABS
+      pa = abs(p);
+      pb = abs(pc);
+      pc = abs(p + pc);
+#else
+      pa = p < 0 ? -p : p;
+      pb = pc < 0 ? -pc : pc;
+      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
+#endif

      /* Find the best predictor, the least of pa, pb, pc favoring the earlier
       * ones in the case of a tie.
@@ -3865,15 +3869,15 @@ png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
      p = b - c;
      pc = a - c;

-#     ifdef PNG_USE_ABS
-         pa = abs(p);
-         pb = abs(pc);
-         pc = abs(p + pc);
-#     else
-         pa = p < 0 ? -p : p;
-         pb = pc < 0 ? -pc : pc;
-         pc = (p + pc) < 0 ? -(p + pc) : p + pc;
-#     endif
+#ifdef PNG_USE_ABS
+      pa = abs(p);
+      pb = abs(pc);
+      pc = abs(p + pc);
+#else
+      pa = p < 0 ? -p : p;
+      pb = pc < 0 ? -pc : pc;
+      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
+#endif

      if (pb < pa) pa = pb, a = b;
      if (pc < pa) a = c;
@@ -4228,7 +4232,7 @@ png_read_start_row(png_structrp png_ptr)

   max_pixel_depth = png_ptr->pixel_depth;

-   /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpliar set of
+   /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpler set of
    * calculations to calculate the final pixel depth, then
    * png_do_read_transforms actually does the transforms.  This means that the
    * code which effectively calculates this value is actually repeated in three
@@ -4278,18 +4282,18 @@ png_read_start_row(png_structrp png_ptr)
 #ifdef PNG_READ_EXPAND_16_SUPPORTED
   if ((png_ptr->transformations & PNG_EXPAND_16) != 0)
   {
-#     ifdef PNG_READ_EXPAND_SUPPORTED
-         /* In fact it is an error if it isn't supported, but checking is
-          * the safe way.
-          */
-         if ((png_ptr->transformations & PNG_EXPAND) != 0)
-         {
-            if (png_ptr->bit_depth < 16)
-               max_pixel_depth *= 2;
-         }
-         else
-#     endif
-         png_ptr->transformations &= ~PNG_EXPAND_16;
+#  ifdef PNG_READ_EXPAND_SUPPORTED
+      /* In fact it is an error if it isn't supported, but checking is
+       * the safe way.
+       */
+      if ((png_ptr->transformations & PNG_EXPAND) != 0)
+      {
+         if (png_ptr->bit_depth < 16)
+            max_pixel_depth *= 2;
+      }
+      else
+#  endif
+      png_ptr->transformations &= ~PNG_EXPAND_16;
   }
 #endif

--- a/pngset.c
+++ b/pngset.c
@@ -1,8 +1,8 @@

 /* pngset.c - storage of image information into info struct
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -190,6 +190,7 @@ png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
   if (info_ptr->hist == NULL)
   {
      png_warning(png_ptr, "Insufficient memory for hIST chunk data");
+
      return;
   }

@@ -271,7 +272,7 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
   png_debug1(1, "in %s storage function", "pCAL");

   if (png_ptr == NULL || info_ptr == NULL || purpose == NULL || units == NULL
-      || (nparams > 0 && params == NULL))
+       || (nparams > 0 && params == NULL))
      return;

   length = strlen(purpose) + 1;
@@ -301,6 +302,7 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
   if (info_ptr->pcal_purpose == NULL)
   {
      png_warning(png_ptr, "Insufficient memory for pCAL purpose");
+
      return;
   }

@@ -322,6 +324,7 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
   if (info_ptr->pcal_units == NULL)
   {
      png_warning(png_ptr, "Insufficient memory for pCAL units");
+
      return;
   }

@@ -333,6 +336,7 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
   if (info_ptr->pcal_params == NULL)
   {
      png_warning(png_ptr, "Insufficient memory for pCAL params");
+
      return;
   }

@@ -349,6 +353,7 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
      if (info_ptr->pcal_params[i] == NULL)
      {
         png_warning(png_ptr, "Insufficient memory for pCAL parameter");
+
         return;
      }

@@ -398,6 +403,7 @@ png_set_sCAL_s(png_const_structrp png_ptr, png_inforp info_ptr,
   if (info_ptr->scal_s_width == NULL)
   {
      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
+
      return;
   }

@@ -416,6 +422,7 @@ png_set_sCAL_s(png_const_structrp png_ptr, png_inforp info_ptr,
      info_ptr->scal_s_width = NULL;

      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
+
      return;
   }

@@ -519,6 +526,7 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
      else
      {
         png_warning(png_ptr, "Invalid palette length");
+
         return;
      }
   }
@@ -531,7 +539,6 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
      ))
   {
      png_error(png_ptr, "Invalid palette");
-      return;
   }

   /* It may not actually be necessary to set png_ptr->palette here;
@@ -655,6 +662,7 @@ png_set_iCCP(png_const_structrp png_ptr, png_inforp info_ptr,
   if (new_iccp_name == NULL)
   {
      png_benign_error(png_ptr, "Insufficient memory to process iCCP chunk");
+
      return;
   }

@@ -665,9 +673,9 @@ png_set_iCCP(png_const_structrp png_ptr, png_inforp info_ptr,
   if (new_iccp_profile == NULL)
   {
      png_free(png_ptr, new_iccp_name);
-      new_iccp_name = NULL;
      png_benign_error(png_ptr,
          "Insufficient memory to process iCCP profile");
+
      return;
   }

@@ -701,7 +709,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
 {
   int i;

-   png_debug1(1, "in %lx storage function", png_ptr == NULL ? "unexpected" :
+   png_debug1(1, "in %lx storage function", png_ptr == NULL ? 0xabadca11 :
      (unsigned long)png_ptr->chunk_name);

   if (png_ptr == NULL || info_ptr == NULL || num_text <= 0 || text_ptr == NULL)
@@ -743,6 +751,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
      {
         png_chunk_report(png_ptr, "too many text chunks",
            PNG_CHUNK_WRITE_ERROR);
+
         return 1;
      }

@@ -798,7 +807,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
         else
            lang_key_len = 0;
      }
-#  else /* PNG_iTXt_SUPPORTED */
+#  else /* iTXt */
      {
         png_chunk_report(png_ptr, "iTXt chunk not supported",
            PNG_CHUNK_WRITE_ERROR);
@@ -831,6 +840,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
      {
         png_chunk_report(png_ptr, "text chunk: out of memory",
               PNG_CHUNK_WRITE_ERROR);
+
         return 1;
      }

@@ -904,6 +914,7 @@ png_set_tIME(png_const_structrp png_ptr, png_inforp info_ptr,
       mod_time->second > 60)
   {
      png_warning(png_ptr, "Ignoring invalid time value");
+
      return;
   }

@@ -920,6 +931,7 @@ png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
   png_debug1(1, "in %s storage function", "tRNS");

   if (png_ptr == NULL || info_ptr == NULL)
+
      return;

   if (trans_alpha != NULL)
@@ -945,16 +957,21 @@ png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,

   if (trans_color != NULL)
   {
-      int sample_max = (1 << info_ptr->bit_depth);
+#ifdef PNG_WARNINGS_SUPPORTED
+      if (info_ptr->bit_depth < 16)
+      {
+         int sample_max = (1 << info_ptr->bit_depth) - 1;

-      if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY &&
-          trans_color->gray > sample_max) ||
-          (info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
-          (trans_color->red > sample_max ||
-          trans_color->green > sample_max ||
-          trans_color->blue > sample_max)))
-         png_warning(png_ptr,
-            "tRNS chunk has out-of-range samples for bit_depth");
+         if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY &&
+             trans_color->gray > sample_max) ||
+             (info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
+             (trans_color->red > sample_max ||
+             trans_color->green > sample_max ||
+             trans_color->blue > sample_max)))
+            png_warning(png_ptr,
+               "tRNS chunk has out-of-range samples for bit_depth");
+      }
+#endif

      info_ptr->trans_color = *trans_color;

@@ -1001,6 +1018,7 @@ png_set_sPLT(png_const_structrp png_ptr,
   {
      /* Out of memory or too many chunks */
      png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR);
+
      return;
   }

@@ -1116,7 +1134,7 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
   png_unknown_chunkp np;

   if (png_ptr == NULL || info_ptr == NULL || num_unknowns <= 0 ||
-      unknowns == NULL)
+       unknowns == NULL)
      return;

   /* Check for the failure cases where support has been disabled at compile
@@ -1130,6 +1148,7 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
      if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0)
      {
         png_app_error(png_ptr, "no unknown chunk support on read");
+
         return;
      }
 #  endif
@@ -1138,6 +1157,7 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
      if ((png_ptr->mode & PNG_IS_READ_STRUCT) == 0)
      {
         png_app_error(png_ptr, "no unknown chunk support on write");
+
         return;
      }
 #  endif
@@ -1155,6 +1175,7 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
   {
      png_chunk_report(png_ptr, "too many unknown chunks",
         PNG_CHUNK_WRITE_ERROR);
+
      return;
   }

@@ -1232,8 +1253,7 @@ png_set_unknown_chunk_location(png_const_structrp png_ptr, png_inforp info_ptr,
         check_location(png_ptr, location);
   }
 }
-#endif
-
+#endif /* STORE_UNKNOWN_CHUNKS */

 #ifdef PNG_MNG_FEATURES_SUPPORTED
 png_uint_32 PNGAPI
@@ -1264,6 +1284,7 @@ add_one_chunk(png_bytep list, unsigned int count, png_const_bytep add, int keep)
      if (memcmp(list, add, 4) == 0)
      {
         list[4] = (png_byte)keep;
+
         return count;
      }
   }
@@ -1291,6 +1312,7 @@ png_set_keep_unknown_chunks(png_structrp png_ptr, int keep,
   if (keep < 0 || keep >= PNG_HANDLE_CHUNK_LAST)
   {
      png_app_error(png_ptr, "png_set_keep_unknown_chunks: invalid keep");
+
      return;
   }

@@ -1340,6 +1362,7 @@ png_set_keep_unknown_chunks(png_structrp png_ptr, int keep,
          * which can be switched off.
          */
         png_app_error(png_ptr, "png_set_keep_unknown_chunks: no chunk list");
+
         return;
      }

@@ -1355,6 +1378,7 @@ png_set_keep_unknown_chunks(png_structrp png_ptr, int keep,
   if (num_chunks + old_num_chunks > UINT_MAX/5)
   {
      png_app_error(png_ptr, "png_set_keep_unknown_chunks: too many chunks");
+
      return;
   }

@@ -1492,23 +1516,30 @@ png_set_compression_buffer_size(png_structrp png_ptr, png_size_t size)
         {
            png_warning(png_ptr,
              "Compression buffer size cannot be changed because it is in use");
+
            return;
         }

+#ifndef __COVERITY__
+         /* Some compilers complain that this is always false.  However, it
+          * can be true when integer overflow happens.
+          */
         if (size > ZLIB_IO_MAX)
         {
            png_warning(png_ptr,
               "Compression buffer size limited to system maximum");
            size = ZLIB_IO_MAX; /* must fit */
         }
+#endif

-         else if (size < 6)
+         if (size < 6)
         {
            /* Deflate will potentially go into an infinite loop on a SYNC_FLUSH
             * if this is permitted.
             */
            png_warning(png_ptr,
               "Compression buffer size cannot be reduced below 6");
+
            return;
         }

@@ -1550,8 +1581,8 @@ png_set_user_limits (png_structrp png_ptr, png_uint_32 user_width_max,
 void PNGAPI
 png_set_chunk_cache_max (png_structrp png_ptr, png_uint_32 user_chunk_cache_max)
 {
-    if (png_ptr != NULL)
-       png_ptr->user_chunk_cache_max = user_chunk_cache_max;
+   if (png_ptr != NULL)
+      png_ptr->user_chunk_cache_max = user_chunk_cache_max;
 }

 /* This function was added to libpng 1.4.1 */
--- a/pngstruct.h
+++ b/pngstruct.h
@@ -1,12 +1,11 @@

 /* pngstruct.h - header file for PNG reference library
 *
- * Copyright (c) 1998-2013 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
- * Last changed in libpng 1.6.1 [March 28, 2013]
- *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
@@ -101,7 +100,7 @@ typedef struct png_XYZ
 #endif /* COLORSPACE */

 #if defined(PNG_COLORSPACE_SUPPORTED) || defined(PNG_GAMMA_SUPPORTED)
-/* A colorspace is all the above plus, potentially, profile information,
+/* A colorspace is all the above plus, potentially, profile information;
 * however at present libpng does not use the profile internally so it is only
 * stored in the png_info struct (if iCCP is supported.)  The rendering intent
 * is retained here and is checked.
@@ -220,16 +219,18 @@ struct png_struct_def
   png_uint_32 row_number;    /* current row in interlace pass */
   png_uint_32 chunk_name;    /* PNG_CHUNK() id of current chunk */
   png_bytep prev_row;        /* buffer to save previous (unfiltered) row.
-                               * This is a pointer into big_prev_row
+                               * While reading this is a pointer into
+                               * big_prev_row; while writing it is separately
+                               * allocated if needed.
                               */
   png_bytep row_buf;         /* buffer to save current (unfiltered) row.
-                               * This is a pointer into big_row_buf
+                               * While reading, this is a pointer into
+                               * big_row_buf; while writing it is separately
+                               * allocated.
                               */
-#ifdef PNG_WRITE_SUPPORTED
-   png_bytep sub_row;         /* buffer to save "sub" row when filtering */
-   png_bytep up_row;          /* buffer to save "up" row when filtering */
-   png_bytep avg_row;         /* buffer to save "avg" row when filtering */
-   png_bytep paeth_row;       /* buffer to save "Paeth" row when filtering */
+#ifdef PNG_WRITE_FILTER_SUPPORTED
+   png_bytep try_row;    /* buffer to save trial row when filtering */
+   png_bytep tst_row;    /* buffer to save best trial row when filtering */
 #endif
   png_size_t info_rowbytes;  /* Added in 1.5.4: cache of updated row bytes */

@@ -347,17 +348,7 @@ struct png_struct_def
   png_bytep quantize_index; /* index translation for palette files */
 #endif

-#ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED
-   png_byte heuristic_method;        /* heuristic for row filter selection */
-   png_byte num_prev_filters;        /* number of weights for previous rows */
-   png_bytep prev_filters;           /* filter type(s) of previous row(s) */
-   png_uint_16p filter_weights;      /* weight(s) for previous line(s) */
-   png_uint_16p inv_filter_weights;  /* 1/weight(s) for previous line(s) */
-   png_uint_16p filter_costs;        /* relative filter calculation cost */
-   png_uint_16p inv_filter_costs;    /* 1/relative filter calculation cost */
-#endif
-
-   /* Options */
+/* Options */
 #ifdef PNG_SET_OPTION_SUPPORTED
   png_byte options;           /* On/off state (up to 4 options) */
 #endif
--- a/pngtest.c
+++ b/pngtest.c
@@ -1,8 +1,8 @@

 /* pngtest.c - a simple test program to test libpng
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -469,7 +469,7 @@ pngtest_error(png_structp png_ptr, png_const_charp message)
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG

 /* Allocate memory.  For reasonable files, size should never exceed
- * 64K.  However, zlib may allocate more then 64K if you don't tell
+ * 64K.  However, zlib may allocate more than 64K if you don't tell
 * it not to.  See zconf.h and png.h for more information.  zlib does
 * need to allocate exactly 64K, so whatever you call here must
 * have the ability to do that.
@@ -565,6 +565,7 @@ png_debug_free(png_structp png_ptr, png_voidp ptr)
   }

   /* Unlink the element from the list. */
+   if (pinformation != NULL)
   {
      memory_infop *ppinfo = &pinformation;

@@ -581,8 +582,7 @@ png_debug_free(png_structp png_ptr, png_voidp ptr)
            /* We must free the list element too, but first kill
               the memory that is to be freed. */
            memset(ptr, 0x55, pinfo->size);
-            if (pinfo != NULL)
-               free(pinfo);
+            free(pinfo);
            pinfo = NULL;
            break;
         }
@@ -1701,6 +1701,8 @@ main(int argc, char *argv[])
   int multiple = 0;
   int ierror = 0;

+   png_structp dummy_ptr;
+
   fprintf(STDERR, "\n Testing libpng version %s\n", PNG_LIBPNG_VER_STRING);
   fprintf(STDERR, "   with zlib   version %s\n", ZLIB_VERSION);
   fprintf(STDERR, "%s", png_get_copyright(NULL));
@@ -1831,10 +1833,10 @@ main(int argc, char *argv[])
                     k, (unsigned long)filters_used[k]);
 #endif
 #ifdef PNG_TIME_RFC1123_SUPPORTED
-         if (tIME_chunk_present != 0)
-            fprintf(STDERR, " tIME = %s\n", tIME_string);
+            if (tIME_chunk_present != 0)
+               fprintf(STDERR, " tIME = %s\n", tIME_string);

-         tIME_chunk_present = 0;
+            tIME_chunk_present = 0;
 #endif /* TIME_RFC1123 */
         }

@@ -1994,6 +1996,24 @@ main(int argc, char *argv[])
   else
      fprintf(STDERR, " libpng FAILS test\n");

+   dummy_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
+   fprintf(STDERR, " Default limits:\n");
+   fprintf(STDERR, "  width_max  = %lu\n",
+      (unsigned long) png_get_user_width_max(dummy_ptr));
+   fprintf(STDERR, "  height_max = %lu\n",
+      (unsigned long) png_get_user_height_max(dummy_ptr));
+   if (png_get_chunk_cache_max(dummy_ptr) == 0)
+      fprintf(STDERR, "  cache_max  = unlimited\n");
+   else
+      fprintf(STDERR, "  cache_max  = %lu\n",
+         (unsigned long) png_get_chunk_cache_max(dummy_ptr));
+   if (png_get_chunk_malloc_max(dummy_ptr) == 0)
+      fprintf(STDERR, "  malloc_max = unlimited\n");
+   else
+      fprintf(STDERR, "  malloc_max = %lu\n",
+         (unsigned long) png_get_chunk_malloc_max(dummy_ptr));
+   png_destroy_read_struct(&dummy_ptr, NULL, NULL);
+
   return (int)(ierror != 0);
 }
 #else
@@ -2008,4 +2028,4 @@ main(void)
 #endif

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_16beta01 Your_png_h_is_not_version_1_6_16beta01;
+typedef png_libpng_version_1_6_18 Your_png_h_is_not_version_1_6_18;
--- a/pngtrans.c
+++ b/pngtrans.c
@@ -1,8 +1,8 @@

 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -704,7 +704,7 @@ png_do_check_palette_indexes(png_structrp png_ptr, png_row_infop row_info)
             */
            for (; rp > png_ptr->row_buf; rp--)
            {
-              if (*rp >> padding != 0)
+              if ((*rp >> padding) != 0)
                 png_ptr->num_palette_max = 1;
              padding = 0;
            }
--- a/pngusr.dfa
+++ b/pngusr.dfa
@@ -8,7 +8,7 @@
 # here by entering the appropriate values as #defines preceded by '@' (to cause,
 # them to be passed through to the build of pnglibconf.h), for example:
 #
-# @# define PNG_USER_WIDTH_MAX 1000000
-# @# define PNG_USER_HEIGHT_MAX 1000000
-# @# define PNG_USER_CHUNK_CACHE_MAX 128
-# @# define PNG_USER_CHUNK_MALLOC_MAX 8000000
+# @# define PNG_USER_WIDTH_MAX 65535
+# @# define PNG_USER_HEIGHT_MAX 65535
+# @# define PNG_USER_CHUNK_CACHE_MAX 256
+# @# define PNG_USER_CHUNK_MALLOC_MAX 640000
--- a/pngwrite.c
+++ b/pngwrite.c
@@ -1,8 +1,8 @@

 /* pngwrite.c - general routines to write a PNG file
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -90,43 +90,44 @@ png_write_info_before_PLTE(png_structrp png_ptr, png_const_inforp info_ptr)

   if ((png_ptr->mode & PNG_WROTE_INFO_BEFORE_PLTE) == 0)
   {
-   /* Write PNG signature */
-   png_write_sig(png_ptr);
+      /* Write PNG signature */
+      png_write_sig(png_ptr);

 #ifdef PNG_MNG_FEATURES_SUPPORTED
-   if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) != 0 && \
-       png_ptr->mng_features_permitted != 0)
-   {
-      png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
-      png_ptr->mng_features_permitted = 0;
-   }
+      if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) != 0 && \
+          png_ptr->mng_features_permitted != 0)
+      {
+         png_warning(png_ptr,
+             "MNG features are not allowed in a PNG datastream");
+         png_ptr->mng_features_permitted = 0;
+      }
 #endif

-   /* Write IHDR information. */
-   png_write_IHDR(png_ptr, info_ptr->width, info_ptr->height,
-       info_ptr->bit_depth, info_ptr->color_type, info_ptr->compression_type,
-       info_ptr->filter_type,
+      /* Write IHDR information. */
+      png_write_IHDR(png_ptr, info_ptr->width, info_ptr->height,
+          info_ptr->bit_depth, info_ptr->color_type, info_ptr->compression_type,
+          info_ptr->filter_type,
 #ifdef PNG_WRITE_INTERLACING_SUPPORTED
-       info_ptr->interlace_type
+          info_ptr->interlace_type
 #else
-       0
+          0
 #endif
-      );
+         );

-   /* The rest of these check to see if the valid field has the appropriate
-    * flag set, and if it does, writes the chunk.
-    *
-    * 1.6.0: COLORSPACE support controls the writing of these chunks too, and
-    * the chunks will be written if the WRITE routine is there and information
-    * is available in the COLORSPACE.  (See png_colorspace_sync_info in png.c
-    * for where the valid flags get set.)
-    *
-    * Under certain circumstances the colorspace can be invalidated without
-    * syncing the info_struct 'valid' flags; this happens if libpng detects and
-    * error and calls png_error while the color space is being set, yet the
-    * application continues writing the PNG.  So check the 'invalid' flag here
-    * too.
-    */
+      /* The rest of these check to see if the valid field has the appropriate
+       * flag set, and if it does, writes the chunk.
+       *
+       * 1.6.0: COLORSPACE support controls the writing of these chunks too, and
+       * the chunks will be written if the WRITE routine is there and
+       * information * is available in the COLORSPACE. (See
+       * png_colorspace_sync_info in png.c for where the valid flags get set.)
+       *
+       * Under certain circumstances the colorspace can be invalidated without
+       * syncing the info_struct 'valid' flags; this happens if libpng detects
+       * an error and calls png_error while the color space is being set, yet
+       * the application continues writing the PNG.  So check the 'invalid'
+       * flag here too.
+       */
 #ifdef PNG_GAMMA_SUPPORTED
 #  ifdef PNG_WRITE_gAMA_SUPPORTED
      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
@@ -137,50 +138,50 @@ png_write_info_before_PLTE(png_structrp png_ptr, png_const_inforp info_ptr)
 #endif

 #ifdef PNG_COLORSPACE_SUPPORTED
-   /* Write only one of sRGB or an ICC profile.  If a profile was supplied
-    * and it matches one of the known sRGB ones issue a warning.
-    */
+      /* Write only one of sRGB or an ICC profile.  If a profile was supplied
+       * and it matches one of the known sRGB ones issue a warning.
+       */
 #  ifdef PNG_WRITE_iCCP_SUPPORTED
-      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
-          (info_ptr->valid & PNG_INFO_iCCP) != 0)
-      {
-#        ifdef PNG_WRITE_sRGB_SUPPORTED
-            if ((info_ptr->valid & PNG_INFO_sRGB) != 0)
-               png_app_warning(png_ptr,
-                  "profile matches sRGB but writing iCCP instead");
-#        endif
+         if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
+             (info_ptr->valid & PNG_INFO_iCCP) != 0)
+         {
+#    ifdef PNG_WRITE_sRGB_SUPPORTED
+               if ((info_ptr->valid & PNG_INFO_sRGB) != 0)
+                  png_app_warning(png_ptr,
+                     "profile matches sRGB but writing iCCP instead");
+#     endif

-         png_write_iCCP(png_ptr, info_ptr->iccp_name,
-            info_ptr->iccp_profile);
-      }
+            png_write_iCCP(png_ptr, info_ptr->iccp_name,
+               info_ptr->iccp_profile);
+         }
 #     ifdef PNG_WRITE_sRGB_SUPPORTED
         else
 #     endif
 #  endif

 #  ifdef PNG_WRITE_sRGB_SUPPORTED
-      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
-          (info_ptr->valid & PNG_INFO_sRGB) != 0)
-         png_write_sRGB(png_ptr, info_ptr->colorspace.rendering_intent);
+         if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
+             (info_ptr->valid & PNG_INFO_sRGB) != 0)
+            png_write_sRGB(png_ptr, info_ptr->colorspace.rendering_intent);
 #  endif /* WRITE_sRGB */
 #endif /* COLORSPACE */

 #ifdef PNG_WRITE_sBIT_SUPPORTED
-   if ((info_ptr->valid & PNG_INFO_sBIT) != 0)
-      png_write_sBIT(png_ptr, &(info_ptr->sig_bit), info_ptr->color_type);
+         if ((info_ptr->valid & PNG_INFO_sBIT) != 0)
+            png_write_sBIT(png_ptr, &(info_ptr->sig_bit), info_ptr->color_type);
 #endif

 #ifdef PNG_COLORSPACE_SUPPORTED
 #  ifdef PNG_WRITE_cHRM_SUPPORTED
-      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
-         (info_ptr->colorspace.flags & PNG_COLORSPACE_FROM_cHRM) != 0 &&
-         (info_ptr->valid & PNG_INFO_cHRM) != 0)
-         png_write_cHRM_fixed(png_ptr, &info_ptr->colorspace.end_points_xy);
+         if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
+             (info_ptr->colorspace.flags & PNG_COLORSPACE_FROM_cHRM) != 0 &&
+             (info_ptr->valid & PNG_INFO_cHRM) != 0)
+            png_write_cHRM_fixed(png_ptr, &info_ptr->colorspace.end_points_xy);
 #  endif
 #endif

 #ifdef PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED
-      write_unknown_chunks(png_ptr, info_ptr, PNG_HAVE_IHDR);
+         write_unknown_chunks(png_ptr, info_ptr, PNG_HAVE_IHDR);
 #endif

      png_ptr->mode |= PNG_WROTE_INFO_BEFORE_PLTE;
@@ -216,8 +217,13 @@ png_write_info(png_structrp png_ptr, png_const_inforp info_ptr)
      if ((png_ptr->transformations & PNG_INVERT_ALPHA) != 0 &&
          info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
      {
-         int j;
-         for (j = 0; j<(int)info_ptr->num_trans; j++)
+         int j, jend;
+
+         jend = info_ptr->num_trans;
+         if (jend > PNG_MAX_PALETTE_LENGTH)
+            jend = PNG_MAX_PALETTE_LENGTH;
+
+         for (j = 0; j<jend; ++j)
            info_ptr->trans_alpha[j] =
               (png_byte)(255 - info_ptr->trans_alpha[j]);
      }
@@ -538,7 +544,7 @@ png_create_write_struct_2,(png_const_charp user_png_ver, png_voidp error_ptr,
      /* App warnings are warnings in release (or release candidate) builds but
       * are errors during development.
       */
-#if PNG_LIBPNG_BUILD_BASE_TYPE >= PNG_LIBPNG_BUILD_RC
+#if PNG_RELEASE_BUILD
      png_ptr->flags |= PNG_FLAG_APP_WARNINGS_WARN;
 #endif

@@ -638,8 +644,8 @@ png_do_write_intrapixel(png_row_infop row_info, png_bytep row)

         for (i = 0, rp = row; i < row_width; i++, rp += bytes_per_pixel)
         {
-            *(rp)     = (png_byte)((*rp       - *(rp + 1)) & 0xff);
-            *(rp + 2) = (png_byte)((*(rp + 2) - *(rp + 1)) & 0xff);
+            *(rp)     = (png_byte)(*rp       - *(rp + 1));
+            *(rp + 2) = (png_byte)(*(rp + 2) - *(rp + 1));
         }
      }

@@ -665,10 +671,10 @@ png_do_write_intrapixel(png_row_infop row_info, png_bytep row)
            png_uint_32 s2   = (*(rp + 4) << 8) | *(rp + 5);
            png_uint_32 red  = (png_uint_32)((s0 - s1) & 0xffffL);
            png_uint_32 blue = (png_uint_32)((s2 - s1) & 0xffffL);
-            *(rp    ) = (png_byte)((red >> 8) & 0xff);
-            *(rp + 1) = (png_byte)(red & 0xff);
-            *(rp + 4) = (png_byte)((blue >> 8) & 0xff);
-            *(rp + 5) = (png_byte)(blue & 0xff);
+            *(rp    ) = (png_byte)(red >> 8);
+            *(rp + 1) = (png_byte)red;
+            *(rp + 4) = (png_byte)(blue >> 8);
+            *(rp + 5) = (png_byte)blue;
         }
      }
 #endif /* WRITE_16BIT */
@@ -849,7 +855,7 @@ png_write_row(png_structrp png_ptr, png_const_bytep row)
    * which is also the output depth.
    */
   if (row_info.pixel_depth != png_ptr->pixel_depth ||
-      row_info.pixel_depth != png_ptr->transformed_pixel_depth)
+       row_info.pixel_depth != png_ptr->transformed_pixel_depth)
      png_error(png_ptr, "internal write transform logic error");

 #ifdef PNG_MNG_FEATURES_SUPPORTED
@@ -917,10 +923,6 @@ png_write_flush(png_structrp png_ptr)
 }
 #endif /* WRITE_FLUSH */

-#ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED
-static void png_reset_filter_heuristics(png_structrp png_ptr);/* forward decl */
-#endif
-
 /* Free any memory used in png_ptr struct without freeing the struct itself. */
 static void
 png_write_destroy(png_structrp png_ptr)
@@ -937,24 +939,11 @@ png_write_destroy(png_structrp png_ptr)
   png_ptr->row_buf = NULL;
 #ifdef PNG_WRITE_FILTER_SUPPORTED
   png_free(png_ptr, png_ptr->prev_row);
-   png_free(png_ptr, png_ptr->sub_row);
-   png_free(png_ptr, png_ptr->up_row);
-   png_free(png_ptr, png_ptr->avg_row);
-   png_free(png_ptr, png_ptr->paeth_row);
+   png_free(png_ptr, png_ptr->try_row);
+   png_free(png_ptr, png_ptr->tst_row);
   png_ptr->prev_row = NULL;
-   png_ptr->sub_row = NULL;
-   png_ptr->up_row = NULL;
-   png_ptr->avg_row = NULL;
-   png_ptr->paeth_row = NULL;
-#endif
-
-#ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED
-   /* Use this to save a little code space, it doesn't free the filter_costs */
-   png_reset_filter_heuristics(png_ptr);
-   png_free(png_ptr, png_ptr->filter_costs);
-   png_free(png_ptr, png_ptr->inv_filter_costs);
-   png_ptr->filter_costs = NULL;
-   png_ptr->inv_filter_costs = NULL;
+   png_ptr->try_row = NULL;
+   png_ptr->tst_row = NULL;
 #endif

 #ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
@@ -1044,211 +1033,85 @@ png_set_filter(png_structrp png_ptr, int method, int filters)
 #endif /* WRITE_FILTER */
      }

+#ifdef PNG_WRITE_FILTER_SUPPORTED
      /* If we have allocated the row_buf, this means we have already started
       * with the image and we should have allocated all of the filter buffers
       * that have been selected.  If prev_row isn't already allocated, then
       * it is too late to start using the filters that need it, since we
       * will be missing the data in the previous row.  If an application
       * wants to start and stop using particular filters during compression,
-       * it should start out with all of the filters, and then add and
-       * remove them after the start of compression.
+       * it should start out with all of the filters, and then remove them
+       * or add them back after the start of compression.
+       *
+       * NOTE: this is a nasty constraint on the code, because it means that the
+       * prev_row buffer must be maintained even if there are currently no
+       * 'prev_row' requiring filters active.
       */
      if (png_ptr->row_buf != NULL)
      {
-#ifdef PNG_WRITE_FILTER_SUPPORTED
-         if ((png_ptr->do_filter & PNG_FILTER_SUB) != 0 &&
-             png_ptr->sub_row == NULL)
+         int num_filters;
+         png_alloc_size_t buf_size;
+
+         /* Repeat the checks in png_write_start_row; 1 pixel high or wide
+          * images cannot benefit from certain filters.  If this isn't done here
+          * the check below will fire on 1 pixel high images.
+          */
+         if (png_ptr->height == 1)
+            filters &= ~(PNG_FILTER_UP|PNG_FILTER_AVG|PNG_FILTER_PAETH);
+
+         if (png_ptr->width == 1)
+            filters &= ~(PNG_FILTER_SUB|PNG_FILTER_AVG|PNG_FILTER_PAETH);
+
+         if ((filters & (PNG_FILTER_UP|PNG_FILTER_AVG|PNG_FILTER_PAETH)) != 0
+            && png_ptr->prev_row == NULL)
         {
-            png_ptr->sub_row = (png_bytep)png_malloc(png_ptr,
-                (png_ptr->rowbytes + 1));
-            png_ptr->sub_row[0] = PNG_FILTER_VALUE_SUB;
+            /* This is the error case, however it is benign - the previous row
+             * is not available so the filter can't be used.  Just warn here.
+             */
+            png_app_warning(png_ptr,
+               "png_set_filter: UP/AVG/PAETH cannot be added after start");
+            filters &= ~(PNG_FILTER_UP|PNG_FILTER_AVG|PNG_FILTER_PAETH);
         }

-         if ((png_ptr->do_filter & PNG_FILTER_UP) != 0 &&
-              png_ptr->up_row == NULL)
+         num_filters = 0;
+
+         if (filters & PNG_FILTER_SUB)
+            num_filters++;
+
+         if (filters & PNG_FILTER_UP)
+            num_filters++;
+
+         if (filters & PNG_FILTER_AVG)
+            num_filters++;
+
+         if (filters & PNG_FILTER_PAETH)
+            num_filters++;
+
+         /* Allocate needed row buffers if they have not already been
+          * allocated.
+          */
+         buf_size = PNG_ROWBYTES(png_ptr->usr_channels * png_ptr->usr_bit_depth,
+             png_ptr->width) + 1;
+
+         if (png_ptr->try_row == NULL)
+            png_ptr->try_row = png_voidcast(png_bytep,
+               png_malloc(png_ptr, buf_size));
+
+         if (num_filters > 1)
         {
-            if (png_ptr->prev_row == NULL)
-            {
-               png_warning(png_ptr, "Can't add Up filter after starting");
-               png_ptr->do_filter = (png_byte)(png_ptr->do_filter &
-                   ~PNG_FILTER_UP);
-            }
-
-            else
-            {
-               png_ptr->up_row = (png_bytep)png_malloc(png_ptr,
-                   (png_ptr->rowbytes + 1));
-               png_ptr->up_row[0] = PNG_FILTER_VALUE_UP;
-            }
+            if (png_ptr->tst_row == NULL)
+               png_ptr->tst_row = png_voidcast(png_bytep,
+                  png_malloc(png_ptr, buf_size));
         }
-
-         if ((png_ptr->do_filter & PNG_FILTER_AVG) != 0 &&
-              png_ptr->avg_row == NULL)
-         {
-            if (png_ptr->prev_row == NULL)
-            {
-               png_warning(png_ptr, "Can't add Average filter after starting");
-               png_ptr->do_filter = (png_byte)(png_ptr->do_filter &
-                   ~PNG_FILTER_AVG);
-            }
-
-            else
-            {
-               png_ptr->avg_row = (png_bytep)png_malloc(png_ptr,
-                   (png_ptr->rowbytes + 1));
-               png_ptr->avg_row[0] = PNG_FILTER_VALUE_AVG;
-            }
-         }
-
-         if ((png_ptr->do_filter & PNG_FILTER_PAETH) != 0 &&
-             png_ptr->paeth_row == NULL)
-         {
-            if (png_ptr->prev_row == NULL)
-            {
-               png_warning(png_ptr, "Can't add Paeth filter after starting");
-               png_ptr->do_filter &= (png_byte)(~PNG_FILTER_PAETH);
-            }
-
-            else
-            {
-               png_ptr->paeth_row = (png_bytep)png_malloc(png_ptr,
-                   (png_ptr->rowbytes + 1));
-               png_ptr->paeth_row[0] = PNG_FILTER_VALUE_PAETH;
-            }
-         }
-
-         if (png_ptr->do_filter == PNG_NO_FILTERS)
-#endif /* WRITE_FILTER */
-            png_ptr->do_filter = PNG_FILTER_NONE;
      }
+      png_ptr->do_filter = (png_byte)filters;
+#endif
   }
   else
      png_error(png_ptr, "Unknown custom filter method");
 }

-/* This allows us to influence the way in which libpng chooses the "best"
- * filter for the current scanline.  While the "minimum-sum-of-absolute-
- * differences metric is relatively fast and effective, there is some
- * question as to whether it can be improved upon by trying to keep the
- * filtered data going to zlib more consistent, hopefully resulting in
- * better compression.
- */
-#ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED      /* GRR 970116 */
-/* Convenience reset API. */
-static void
-png_reset_filter_heuristics(png_structrp png_ptr)
-{
-   /* Clear out any old values in the 'weights' - this must be done because if
-    * the app calls set_filter_heuristics multiple times with different
-    * 'num_weights' values we would otherwise potentially have wrong sized
-    * arrays.
-    */
-   png_ptr->num_prev_filters = 0;
-   png_ptr->heuristic_method = PNG_FILTER_HEURISTIC_UNWEIGHTED;
-   if (png_ptr->prev_filters != NULL)
-   {
-      png_bytep old = png_ptr->prev_filters;
-      png_ptr->prev_filters = NULL;
-      png_free(png_ptr, old);
-   }
-   if (png_ptr->filter_weights != NULL)
-   {
-      png_uint_16p old = png_ptr->filter_weights;
-      png_ptr->filter_weights = NULL;
-      png_free(png_ptr, old);
-   }
-
-   if (png_ptr->inv_filter_weights != NULL)
-   {
-      png_uint_16p old = png_ptr->inv_filter_weights;
-      png_ptr->inv_filter_weights = NULL;
-      png_free(png_ptr, old);
-   }
-
-   /* Leave the filter_costs - this array is fixed size. */
-}
-
-static int
-png_init_filter_heuristics(png_structrp png_ptr, int heuristic_method,
-   int num_weights)
-{
-   if (png_ptr == NULL)
-      return 0;
-
-   /* Clear out the arrays */
-   png_reset_filter_heuristics(png_ptr);
-
-   /* Check arguments; the 'reset' function makes the correct settings for the
-    * unweighted case, but we must handle the weight case by initializing the
-    * arrays for the caller.
-    */
-   if (heuristic_method == PNG_FILTER_HEURISTIC_WEIGHTED)
-   {
-      int i;
-
-      if (num_weights > 0)
-      {
-         png_ptr->prev_filters = (png_bytep)png_malloc(png_ptr,
-             (png_uint_32)((sizeof (png_byte)) * num_weights));
-
-         /* To make sure that the weighting starts out fairly */
-         for (i = 0; i < num_weights; i++)
-         {
-            png_ptr->prev_filters[i] = 255;
-         }
-
-         png_ptr->filter_weights = (png_uint_16p)png_malloc(png_ptr,
-             (png_uint_32)((sizeof (png_uint_16)) * num_weights));
-
-         png_ptr->inv_filter_weights = (png_uint_16p)png_malloc(png_ptr,
-             (png_uint_32)((sizeof (png_uint_16)) * num_weights));
-
-         for (i = 0; i < num_weights; i++)
-         {
-            png_ptr->inv_filter_weights[i] =
-            png_ptr->filter_weights[i] = PNG_WEIGHT_FACTOR;
-         }
-
-         /* Safe to set this now */
-         png_ptr->num_prev_filters = (png_byte)num_weights;
-      }
-
-      /* If, in the future, there are other filter methods, this would
-       * need to be based on png_ptr->filter.
-       */
-      if (png_ptr->filter_costs == NULL)
-      {
-         png_ptr->filter_costs = (png_uint_16p)png_malloc(png_ptr,
-             (png_uint_32)((sizeof (png_uint_16)) * PNG_FILTER_VALUE_LAST));
-
-         png_ptr->inv_filter_costs = (png_uint_16p)png_malloc(png_ptr,
-             (png_uint_32)((sizeof (png_uint_16)) * PNG_FILTER_VALUE_LAST));
-      }
-
-      for (i = 0; i < PNG_FILTER_VALUE_LAST; i++)
-      {
-         png_ptr->inv_filter_costs[i] =
-         png_ptr->filter_costs[i] = PNG_COST_FACTOR;
-      }
-
-      /* All the arrays are inited, safe to set this: */
-      png_ptr->heuristic_method = PNG_FILTER_HEURISTIC_WEIGHTED;
-
-      /* Return the 'ok' code. */
-      return 1;
-   }
-   else if (heuristic_method == PNG_FILTER_HEURISTIC_DEFAULT ||
-      heuristic_method == PNG_FILTER_HEURISTIC_UNWEIGHTED)
-   {
-      return 1;
-   }
-   else
-   {
-      png_warning(png_ptr, "Unknown filter heuristic method");
-      return 0;
-   }
-}
-
+#ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED /* DEPRECATED */
 /* Provide floating and fixed point APIs */
 #ifdef PNG_FLOATING_POINT_SUPPORTED
 void PNGAPI
@@ -1256,52 +1119,11 @@ png_set_filter_heuristics(png_structrp png_ptr, int heuristic_method,
    int num_weights, png_const_doublep filter_weights,
    png_const_doublep filter_costs)
 {
-   png_debug(1, "in png_set_filter_heuristics");
-
-   /* The internal API allocates all the arrays and ensures that the elements of
-    * those arrays are set to the default value.
-    */
-   if (png_init_filter_heuristics(png_ptr, heuristic_method, num_weights) == 0)
-      return;
-
-   /* If using the weighted method copy in the weights. */
-   if (heuristic_method == PNG_FILTER_HEURISTIC_WEIGHTED)
-   {
-      int i;
-      for (i = 0; i < num_weights; i++)
-      {
-         if (filter_weights[i] <= 0.0)
-         {
-            png_ptr->inv_filter_weights[i] =
-            png_ptr->filter_weights[i] = PNG_WEIGHT_FACTOR;
-         }
-
-         else
-         {
-            png_ptr->inv_filter_weights[i] =
-                (png_uint_16)(PNG_WEIGHT_FACTOR*filter_weights[i]+.5);
-
-            png_ptr->filter_weights[i] =
-                (png_uint_16)(PNG_WEIGHT_FACTOR/filter_weights[i]+.5);
-         }
-      }
-
-      /* Here is where we set the relative costs of the different filters.  We
-       * should take the desired compression level into account when setting
-       * the costs, so that Paeth, for instance, has a high relative cost at low
-       * compression levels, while it has a lower relative cost at higher
-       * compression settings.  The filter types are in order of increasing
-       * relative cost, so it would be possible to do this with an algorithm.
-       */
-      for (i = 0; i < PNG_FILTER_VALUE_LAST; i++) if (filter_costs[i] >= 1.0)
-      {
-         png_ptr->inv_filter_costs[i] =
-             (png_uint_16)(PNG_COST_FACTOR / filter_costs[i] + .5);
-
-         png_ptr->filter_costs[i] =
-             (png_uint_16)(PNG_COST_FACTOR * filter_costs[i] + .5);
-      }
-   }
+   PNG_UNUSED(png_ptr)
+   PNG_UNUSED(heuristic_method)
+   PNG_UNUSED(num_weights)
+   PNG_UNUSED(filter_weights)
+   PNG_UNUSED(filter_costs)
 }
 #endif /* FLOATING_POINT */

@@ -1311,67 +1133,16 @@ png_set_filter_heuristics_fixed(png_structrp png_ptr, int heuristic_method,
    int num_weights, png_const_fixed_point_p filter_weights,
    png_const_fixed_point_p filter_costs)
 {
-   png_debug(1, "in png_set_filter_heuristics_fixed");
-
-   /* The internal API allocates all the arrays and ensures that the elements of
-    * those arrays are set to the default value.
-    */
-   if (png_init_filter_heuristics(png_ptr, heuristic_method, num_weights) == 0)
-      return;
-
-   /* If using the weighted method copy in the weights. */
-   if (heuristic_method == PNG_FILTER_HEURISTIC_WEIGHTED)
-   {
-      int i;
-      for (i = 0; i < num_weights; i++)
-      {
-         if (filter_weights[i] <= 0)
-         {
-            png_ptr->inv_filter_weights[i] =
-            png_ptr->filter_weights[i] = PNG_WEIGHT_FACTOR;
-         }
-
-         else
-         {
-            png_ptr->inv_filter_weights[i] = (png_uint_16)
-               ((PNG_WEIGHT_FACTOR*filter_weights[i]+PNG_FP_HALF)/PNG_FP_1);
-
-            png_ptr->filter_weights[i] = (png_uint_16)((PNG_WEIGHT_FACTOR*
-               PNG_FP_1+(filter_weights[i]/2))/filter_weights[i]);
-         }
-      }
-
-      /* Here is where we set the relative costs of the different filters.  We
-       * should take the desired compression level into account when setting
-       * the costs, so that Paeth, for instance, has a high relative cost at low
-       * compression levels, while it has a lower relative cost at higher
-       * compression settings.  The filter types are in order of increasing
-       * relative cost, so it would be possible to do this with an algorithm.
-       */
-      for (i = 0; i < PNG_FILTER_VALUE_LAST; i++)
-         if (filter_costs[i] >= PNG_FP_1)
-      {
-         png_uint_32 tmp;
-
-         /* Use a 32 bit unsigned temporary here because otherwise the
-          * intermediate value will be a 32 bit *signed* integer (ANSI rules)
-          * and this will get the wrong answer on division.
-          */
-         tmp = PNG_COST_FACTOR*PNG_FP_1 + (filter_costs[i]/2);
-         tmp /= filter_costs[i];
-
-         png_ptr->inv_filter_costs[i] = (png_uint_16)tmp;
-
-         tmp = PNG_COST_FACTOR * filter_costs[i] + PNG_FP_HALF;
-         tmp /= PNG_FP_1;
-
-         png_ptr->filter_costs[i] = (png_uint_16)tmp;
-      }
-   }
+   PNG_UNUSED(png_ptr)
+   PNG_UNUSED(heuristic_method)
+   PNG_UNUSED(num_weights)
+   PNG_UNUSED(filter_weights)
+   PNG_UNUSED(filter_costs)
 }
 #endif /* FIXED_POINT */
 #endif /* WRITE_WEIGHTED_FILTER */

+#ifdef PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED
 void PNGAPI
 png_set_compression_level(png_structrp png_ptr, int level)
 {
@@ -1417,8 +1188,8 @@ png_set_compression_window_bits(png_structrp png_ptr, int window_bits)
   if (png_ptr == NULL)
      return;

-   /* Prior to 1.6.0 this would warn but then set the window_bits value, this
-    * meant that negative window bits values could be selected which would cause
+   /* Prior to 1.6.0 this would warn but then set the window_bits value. This
+    * meant that negative window bits values could be selected that would cause
    * libpng to write a non-standard PNG file with raw deflate or gzip
    * compressed IDAT or ancillary chunks.  Such files can be read and there is
    * no warning on read, so this seems like a very bad idea.
@@ -1454,6 +1225,7 @@ png_set_compression_method(png_structrp png_ptr, int method)

   png_ptr->zlib_method = method;
 }
+#endif /* WRITE_CUSTOMIZE_COMPRESSION */

 /* The following were added to libpng-1.5.4 */
 #ifdef PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED
@@ -1614,14 +1386,14 @@ png_write_png(png_structrp png_ptr, png_inforp info_ptr,
    * alpha channel.
    */
   if ((transforms & (PNG_TRANSFORM_STRIP_FILLER_AFTER|
-      PNG_TRANSFORM_STRIP_FILLER_BEFORE)) != 0)
+       PNG_TRANSFORM_STRIP_FILLER_BEFORE)) != 0)
   {
 #ifdef PNG_WRITE_FILLER_SUPPORTED
      if ((transforms & PNG_TRANSFORM_STRIP_FILLER_AFTER) != 0)
      {
         if ((transforms & PNG_TRANSFORM_STRIP_FILLER_BEFORE) != 0)
            png_app_error(png_ptr,
-               "PNG_TRANSFORM_STRIP_FILLER: BEFORE+AFTER not supported");
+                "PNG_TRANSFORM_STRIP_FILLER: BEFORE+AFTER not supported");

         /* Continue if ignored - this is the pre-1.6.10 behavior */
         png_set_filler(png_ptr, 0, PNG_FILLER_AFTER);
@@ -1680,13 +1452,13 @@ png_write_png(png_structrp png_ptr, png_inforp info_ptr,


 #ifdef PNG_SIMPLIFIED_WRITE_SUPPORTED
-#ifdef PNG_STDIO_SUPPORTED /* currently required for png_image_write_* */
+# ifdef PNG_STDIO_SUPPORTED /* currently required for png_image_write_* */
 /* Initialize the write structure - general purpose utility. */
 static int
 png_image_write_init(png_imagep image)
 {
   png_structp png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING, image,
-          png_safe_error, png_safe_warning);
+       png_safe_error, png_safe_warning);

   if (png_ptr != NULL)
   {
@@ -1695,7 +1467,7 @@ png_image_write_init(png_imagep image)
      if (info_ptr != NULL)
      {
         png_controlp control = png_voidcast(png_controlp,
-            png_malloc_warn(png_ptr, (sizeof *control)));
+             png_malloc_warn(png_ptr, (sizeof *control)));

         if (control != NULL)
         {
@@ -1742,12 +1514,12 @@ static int
 png_write_image_16bit(png_voidp argument)
 {
   png_image_write_control *display = png_voidcast(png_image_write_control*,
-      argument);
+       argument);
   png_imagep image = display->image;
   png_structrp png_ptr = image->opaque->png_ptr;

   png_const_uint_16p input_row = png_voidcast(png_const_uint_16p,
-      display->first_row);
+       display->first_row);
   png_uint_16p output_row = png_voidcast(png_uint_16p, display->local_row);
   png_uint_16p row_end;
   const int channels = (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
@@ -1756,17 +1528,18 @@ png_write_image_16bit(png_voidp argument)

   if ((image->format & PNG_FORMAT_FLAG_ALPHA) != 0)
   {
-#     ifdef PNG_SIMPLIFIED_WRITE_AFIRST_SUPPORTED
-         if ((image->format & PNG_FORMAT_FLAG_AFIRST) != 0)
-         {
-            aindex = -1;
-            ++input_row; /* To point to the first component */
-            ++output_row;
-         }
-
+#   ifdef PNG_SIMPLIFIED_WRITE_AFIRST_SUPPORTED
+      if ((image->format & PNG_FORMAT_FLAG_AFIRST) != 0)
+      {
+         aindex = -1;
+         ++input_row; /* To point to the first component */
+         ++output_row;
+      }
         else
-#     endif
+            aindex = channels;
+#     else
         aindex = channels;
+#     endif
   }

   else
@@ -1848,7 +1621,7 @@ png_write_image_16bit(png_voidp argument)
 * calculation can be done to 15 bits of accuracy; however, the output needs to
 * be scaled in the range 0..255*65535, so include that scaling here.
 */
-#define UNP_RECIPROCAL(alpha) ((((0xffff*0xff)<<7)+(alpha>>1))/alpha)
+#   define UNP_RECIPROCAL(alpha) ((((0xffff*0xff)<<7)+(alpha>>1))/alpha)

 static png_byte
 png_unpremultiply(png_uint_32 component, png_uint_32 alpha,
@@ -1899,12 +1672,12 @@ static int
 png_write_image_8bit(png_voidp argument)
 {
   png_image_write_control *display = png_voidcast(png_image_write_control*,
-      argument);
+       argument);
   png_imagep image = display->image;
   png_structrp png_ptr = image->opaque->png_ptr;

   png_const_uint_16p input_row = png_voidcast(png_const_uint_16p,
-      display->first_row);
+       display->first_row);
   png_bytep output_row = png_voidcast(png_bytep, display->local_row);
   png_uint_32 y = image->height;
   const int channels = (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
@@ -1914,17 +1687,17 @@ png_write_image_8bit(png_voidp argument)
      png_bytep row_end;
      int aindex;

-#     ifdef PNG_SIMPLIFIED_WRITE_AFIRST_SUPPORTED
-         if ((image->format & PNG_FORMAT_FLAG_AFIRST) != 0)
-         {
-            aindex = -1;
-            ++input_row; /* To point to the first component */
-            ++output_row;
-         }
+#   ifdef PNG_SIMPLIFIED_WRITE_AFIRST_SUPPORTED
+      if ((image->format & PNG_FORMAT_FLAG_AFIRST) != 0)
+      {
+         aindex = -1;
+         ++input_row; /* To point to the first component */
+         ++output_row;
+      }

-         else
-#     endif
-         aindex = channels;
+      else
+#   endif
+      aindex = channels;

      /* Use row_end in place of a loop counter: */
      row_end = output_row + image->width * (channels+1);
@@ -1958,7 +1731,7 @@ png_write_image_8bit(png_voidp argument)
         } /* while out_ptr < row_end */

         png_write_row(png_ptr, png_voidcast(png_const_bytep,
-            display->local_row));
+             display->local_row));
         input_row += display->row_bytes/(sizeof (png_uint_16));
      } /* while y */
   }
@@ -1997,25 +1770,25 @@ png_image_set_PLTE(png_image_write_control *display)
   const png_imagep image = display->image;
   const void *cmap = display->colormap;
   const int entries = image->colormap_entries > 256 ? 256 :
-      (int)image->colormap_entries;
+       (int)image->colormap_entries;

   /* NOTE: the caller must check for cmap != NULL and entries != 0 */
   const png_uint_32 format = image->format;
   const int channels = PNG_IMAGE_SAMPLE_CHANNELS(format);

-#  if defined(PNG_FORMAT_BGR_SUPPORTED) &&\
+#   if defined(PNG_FORMAT_BGR_SUPPORTED) &&\
      defined(PNG_SIMPLIFIED_WRITE_AFIRST_SUPPORTED)
      const int afirst = (format & PNG_FORMAT_FLAG_AFIRST) != 0 &&
-         (format & PNG_FORMAT_FLAG_ALPHA) != 0;
-#  else
+          (format & PNG_FORMAT_FLAG_ALPHA) != 0;
+#   else
 #     define afirst 0
-#  endif
+#   endif

-#  ifdef PNG_FORMAT_BGR_SUPPORTED
+#   ifdef PNG_FORMAT_BGR_SUPPORTED
      const int bgr = (format & PNG_FORMAT_FLAG_BGR) != 0 ? 2 : 0;
-#  else
+#   else
 #     define bgr 0
-#  endif
+#   endif

   int i, num_trans;
   png_color palette[256];
@@ -2040,11 +1813,11 @@ png_image_set_PLTE(png_image_write_control *display)
            if (channels >= 3) /* RGB */
            {
               palette[i].blue = (png_byte)PNG_sRGB_FROM_LINEAR(255 *
-                  entry[(2 ^ bgr)]);
+                   entry[(2 ^ bgr)]);
               palette[i].green = (png_byte)PNG_sRGB_FROM_LINEAR(255 *
-                  entry[1]);
+                   entry[1]);
               palette[i].red = (png_byte)PNG_sRGB_FROM_LINEAR(255 *
-                  entry[bgr]);
+                   entry[bgr]);
            }

            else /* Gray */
@@ -2120,12 +1893,12 @@ png_image_set_PLTE(png_image_write_control *display)
      }
   }

-#  ifdef afirst
+#   ifdef afirst
 #     undef afirst
-#  endif
-#  ifdef bgr
+#   endif
+#   ifdef bgr
 #     undef bgr
-#  endif
+#   endif

   png_set_PLTE(image->opaque->png_ptr, image->opaque->info_ptr, palette,
      entries);
@@ -2153,10 +1926,10 @@ png_image_write_main(png_voidp argument)
   int alpha = !colormap && (format & PNG_FORMAT_FLAG_ALPHA);
   int write_16bit = linear && !colormap && (display->convert_to_8bit == 0);

-#  ifdef PNG_BENIGN_ERRORS_SUPPORTED
+#   ifdef PNG_BENIGN_ERRORS_SUPPORTED
      /* Make sure we error out on any bad situation */
      png_set_benign_errors(png_ptr, 0/*error*/);
-#  endif
+#   endif

   /* Default the 'row_stride' parameter if required. */
   if (display->row_stride == 0)
@@ -2235,23 +2008,23 @@ png_image_write_main(png_voidp argument)
         png_set_swap(png_ptr);
   }

-#  ifdef PNG_SIMPLIFIED_WRITE_BGR_SUPPORTED
+#   ifdef PNG_SIMPLIFIED_WRITE_BGR_SUPPORTED
      if ((format & PNG_FORMAT_FLAG_BGR) != 0)
      {
         if (colormap == 0 && (format & PNG_FORMAT_FLAG_COLOR) != 0)
            png_set_bgr(png_ptr);
         format &= ~PNG_FORMAT_FLAG_BGR;
      }
-#  endif
+#   endif

-#  ifdef PNG_SIMPLIFIED_WRITE_AFIRST_SUPPORTED
+#   ifdef PNG_SIMPLIFIED_WRITE_AFIRST_SUPPORTED
      if ((format & PNG_FORMAT_FLAG_AFIRST) != 0)
      {
         if (colormap == 0 && (format & PNG_FORMAT_FLAG_ALPHA) != 0)
            png_set_swap_alpha(png_ptr);
         format &= ~PNG_FORMAT_FLAG_AFIRST;
      }
-#  endif
+#   endif

   /* If there are 16 or fewer color-map entries we wrote a lower bit depth
    * above, but the application data is still byte packed.
@@ -2287,7 +2060,9 @@ png_image_write_main(png_voidp argument)
       * it about 50 times.  The speed-up in pngstest was about 10-20% of the
       * total (user) time on a heavily loaded system.
       */
+#   ifdef PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED
      png_set_compression_level(png_ptr, 3);
+#   endif
   }

   /* Check for the cases that currently require a pre-transform on the row
@@ -2450,6 +2225,6 @@ png_image_write_to_file(png_imagep image, const char *file_name,
   else
      return 0;
 }
-#endif /* STDIO */
+# endif /* STDIO */
 #endif /* SIMPLIFIED_WRITE */
 #endif /* WRITE */
--- a/pngwtran.c
+++ b/pngwtran.c
@@ -1,8 +1,8 @@

 /* pngwtran.c - transforms the data in a row for PNG writers
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -71,7 +71,8 @@ png_do_pack(png_row_infop row_info, png_bytep row, png_uint_32 bit_depth)
         case 2:
         {
            png_bytep sp, dp;
-            int shift, v;
+            unsigned int shift;
+            int v;
            png_uint_32 i;
            png_uint_32 row_width = row_info->width;

@@ -110,7 +111,8 @@ png_do_pack(png_row_infop row_info, png_bytep row, png_uint_32 bit_depth)
         case 4:
         {
            png_bytep sp, dp;
-            int shift, v;
+            unsigned int shift;
+            int v;
            png_uint_32 i;
            png_uint_32 row_width = row_info->width;

@@ -422,7 +424,7 @@ png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
               *(dp++) = *(sp++);
               */
               sp+=3; dp = sp;
-               *(dp++) = (png_byte)(255 - *(sp++));
+               *dp = (png_byte)(255 - *(sp++));
            }
         }

@@ -446,7 +448,7 @@ png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
               */
               sp+=6; dp = sp;
               *(dp++) = (png_byte)(255 - *(sp++));
-               *(dp++) = (png_byte)(255 - *(sp++));
+               *dp     = (png_byte)(255 - *(sp++));
            }
         }
 #endif /* WRITE_16BIT */
@@ -484,7 +486,7 @@ png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
               */
               sp+=2; dp = sp;
               *(dp++) = (png_byte)(255 - *(sp++));
-               *(dp++) = (png_byte)(255 - *(sp++));
+               *dp     = (png_byte)(255 - *(sp++));
            }
         }
 #endif /* WRITE_16BIT */
--- a/pngwutil.c
+++ b/pngwutil.c
--- a/projects/vstudio/readme.txt
+++ b/projects/vstudio/readme.txt
@@ -1,7 +1,7 @@

 VisualStudio instructions

-libpng version 1.6.16beta01 - December 14, 2014
+libpng version 1.6.18 - July 23, 2015

 Copyright (c) 1998-2010 Glenn Randers-Pehrson

--- a/projects/vstudio/zlib.props
+++ b/projects/vstudio/zlib.props
@@ -2,7 +2,7 @@
 <!--
 * zlib.props - location of zlib source
 *
- * libpng version 1.6.16beta01 - December 14, 2014
+ * libpng version 1.6.18 - July 23, 2015
 *
 * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 *
--- a/scripts/README.txt
+++ b/scripts/README.txt
@@ -1,9 +1,9 @@

-Makefiles for  libpng version 1.6.16beta01 - December 14, 2014
+Makefiles for  libpng version 1.6.18 - July 23, 2015

 pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng16.so.16.1.6.16beta01)
+                       (gcc, creates libpng16.so.16.1.6.18)
 makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
 makefile.knr      =>  Archaic UNIX Makefile that converts files with
                       ansi2knr (Requires ansi2knr.c from
@@ -33,12 +33,12 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.os2      =>  OS/2 Makefile (gcc and emx, requires libpng.def)
 makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
 makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng16.so.16.1.6.16beta01)
+                       creates libpng16.so.16.1.6.18)
 makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
 makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng16.so.16.1.6.16beta01)
+                       creates libpng16.so.16.1.6.18)
 makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng16.so.16.1.6.16beta01)
+                       creates libpng16.so.16.1.6.18)
 makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
 makefile.sunos    =>  Sun makefile
 makefile.32sunu   =>  Sun Ultra 32-bit makefile
--- a/scripts/def.dfn
+++ b/scripts/def.dfn
@@ -1,7 +1,7 @@
-/* def.dfn - define format of libpng.def
+/* def.c - define format of libpng.def
 *
- * Last changed in libpng version 1.5.7 [December 15, 2011]
- * Copyright (c) 2010-2011 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2011-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -21,7 +21,7 @@ PNG_DFN "OS2 DESCRIPTION "PNG image compression library""
 PNG_DFN "OS2 CODE PRELOAD MOVEABLE DISCARDABLE"
 PNG_DFN ""
 PNG_DFN "EXPORTS"
-PNG_DFN ";Version 1.6.16beta01"
+PNG_DFN ";Version 1.6.18"

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
        PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"
--- a/scripts/dfn.awk
+++ b/scripts/dfn.awk
@@ -17,7 +17,7 @@
 BEGIN{
   out="/dev/null"       # as a flag
   out_count=0           # count of output lines
-   err=0                 # set if an error occured
+   err=0                 # set if an error occurred
   sort=0                # sort the output
   array[""]=""
 }
--- a/scripts/intprefix.dfn
+++ b/scripts/intprefix.dfn
@@ -1,8 +1,8 @@

-/* intprefix.dfn - generate an unprefixed internal symbol list
+/* intprefix.c - generate an unprefixed internal symbol list
 *
- * Last changed in libpng version 1.6.0 [January 30, 2012]
- * Copyright (c) 2012 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2013-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
--- a/scripts/libpng-config-head.in
+++ b/scripts/libpng-config-head.in
@@ -11,7 +11,7 @@

 # Modeled after libxml-config.

-version=1.6.16beta01
+version=1.6.18
 prefix=""
 libdir=""
 libs=""
--- a/scripts/libpng.pc.in
+++ b/scripts/libpng.pc.in
@@ -5,6 +5,6 @@ includedir=@includedir@/libpng16

 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.6.16beta01
+Version: 1.6.18
 Libs: -L${libdir} -lpng16
 Cflags: -I${includedir}
--- a/scripts/makefile.cegcc
+++ b/scripts/makefile.cegcc
@@ -23,7 +23,7 @@

 VERMAJ = 1
 VERMIN = 6
-VERMIC = 16
+VERMIC = 18
 VER = $(VERMAJ).$(VERMIN).$(VERMIC)
 NAME = libpng
 PACKAGE = $(NAME)-$(VER)
--- a/scripts/makefile.linux
+++ b/scripts/makefile.linux
@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng16
 PNGMAJ = 16
-RELEASE = 16
+RELEASE = 18

 # Shared library names:
 LIBSO=$(LIBNAME).so
--- a/scripts/makefile.msys
+++ b/scripts/makefile.msys
@@ -18,7 +18,7 @@ exec_prefix=$(prefix)
 # Library name:
 LIBNAME = libpng16
 PNGMAJ = 16
-RELEASE = 16
+RELEASE = 18

 # Shared library names:
 LIBSO=$(LIBNAME).dll
--- a/scripts/makefile.ne12bsd
+++ b/scripts/makefile.ne12bsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng16

 LIB=	png16
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.6.16beta01
+SHLIB_MINOR=	1.6.18
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.netbsd
+++ b/scripts/makefile.netbsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include

 LIB=	png
 SHLIB_MAJOR=	16
-SHLIB_MINOR=	1.6.16beta01
+SHLIB_MINOR=	1.6.18
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.openbsd
+++ b/scripts/makefile.openbsd
@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat

 SHLIB_MAJOR=	16
-SHLIB_MINOR=	1.6.16beta01
+SHLIB_MINOR=	1.6.18

 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
--- a/scripts/makefile.std
+++ b/scripts/makefile.std
@@ -106,7 +106,8 @@ install: libpng.a pnglibconf.h
 	chmod 644 $(DESTDIR)$(LIBPATH)/libpng.a

 clean:
-	$(RM_F) *.o libpng.a pngtest pngout.png pnglibconf.*
+	$(RM_F) *.o libpng.a pngtest pngout.png pnglibconf.h pnglibconf.c \
+	pnglibconf.out

 DOCS = ANNOUNCE CHANGES INSTALL KNOWNBUG LICENSE README TODO Y2KINFO
 writelock:
--- a/scripts/pnglibconf.dfa
+++ b/scripts/pnglibconf.dfa
@@ -222,7 +222,7 @@ option SET_OPTION disabled
 #                 with png_set_option
 # ARM_NEON_CHECK: (PNG_ARM_NEON == 1) compile a run-time check to see if Neon
 #                 extensions are supported. This is poorly supported and
-#                 deprectated - use the png_set_option API.
+#                 deprecated - use the png_set_option API.
 setting ARM_NEON_OPT
 option ARM_NEON_API disabled requires ALIGNED_MEMORY enables SET_OPTION,
   sets ARM_NEON_OPT 1
@@ -249,6 +249,17 @@ setting Z_DEFAULT_STRATEGY default @Z_FILTERED
 setting Z_DEFAULT_NOFILTER_STRATEGY default @Z_DEFAULT_STRATEGY
 setting ZLIB_VERNUM default @ZLIB_VERNUM

+# Linkage of:
+#
+#  API:      libpng API functions
+#  CALLBACK: internal non-file-local callbacks
+#  FUNCTION: internal non-file-local functions
+#  DATA:     internal non-file-local (const) data
+setting LINKAGE_API default extern
+setting LINKAGE_CALLBACK default extern
+setting LINKAGE_FUNCTION default extern
+setting LINKAGE_DATA default extern
+
 setting TEXT_Z_DEFAULT_COMPRESSION default @Z_DEFAULT_COMPRESSION
 setting TEXT_Z_DEFAULT_STRATEGY default @Z_DEFAULT_STRATEGY

@@ -303,7 +314,7 @@ option BENIGN_READ_ERRORS requires BENIGN_ERRORS
 option MNG_FEATURES

 # Arithmetic options, the first is the big switch that chooses between internal
-# floating and fixed point arithmetic implementations - it does not affect an
+# floating and fixed point arithmetic implementations - it does not affect any
 # APIs.  The second two (the _POINT settings) switch off individual APIs.
 #
 # Prior to libpng 1.6.8 one of the API (_POINT) variants had to be selected.  At
@@ -350,36 +361,15 @@ option USER_MEM

 option IO_STATE

-# This is only for PowerPC big-endian and 680x0 systems
-# some testing, not enabled by default.
-# NO LONGER USED
-
-#option READ_BIG_ENDIAN disabled
-
-# Allow users to control limits on what the READ code will
-# read:
-
-# Added at libpng-1.2.43; adds limit fields to png_struct,
-# allows some usages of these fields
-
-option USER_LIMITS
-
-# Added at libpng-1.2.6; adds setting APIs, allows additional
-# usage of this field (UTSL)
-
-option SET_USER_LIMITS requires USER_LIMITS
-
-# Feature added at libpng-1.4.0, this flag added at 1.4.1
-option SET_USER_LIMITS enables SET_CHUNK_CACHE_LIMIT
-# Feature added at libpng-1.4.1, this flag added at 1.4.1
-
-option SET_USER_LIMITS enables SET_CHUNK_MALLOC_LIMIT
-
-# Libpng limits.
+# Libpng limits: limit the size of images and data on read.
 #
-# If these settings are *not* set libpng will not limit the size of
-# images or the size of data in ancilliary chunks.  This does lead to
-# security issues if PNG files come from untrusted sources.  Settings have the
+# If this option is disabled all the limit checking code will be disabled:
+
+option USER_LIMITS requires READ
+
+# The default settings given below for the limits mean that libpng will
+# limit the size of images or the size of data in ancilliary chunks to less
+# than the specification or implementation limits. Settings have the
 # following interpretations:
 #
 # USER_WIDTH_MAX: maximum width of an image that will be read
@@ -388,18 +378,18 @@ option SET_USER_LIMITS enables SET_CHUNK_MALLOC_LIMIT
 # USER_CHUNK_CACHE_MAX: maximum number of chunks to be cached
 #
 # Only chunks that are variable in number are counted towards the
-# USER_CHUNK_CACHE_MAX limit
-setting USER_WIDTH_MAX
-setting USER_HEIGHT_MAX
-setting USER_CHUNK_CACHE_MAX
-setting USER_CHUNK_MALLOC_MAX

-# To default all these settings to values that are large but probably
-# safe turn the SAFE_LIMITS option on; this will cause the value in
-# pngpriv.h to be used.  Individual values can also be set, simply set
-# them in pngusr.dfa with '@#define PNG_setting value' lines.
-option SAFE_LIMITS enables USER_LIMITS disabled
-= SAFE_LIMITS SAFE_LIMITS
+# Use 0x7fffffff for unlimited
+setting USER_WIDTH_MAX default        1000000
+setting USER_HEIGHT_MAX default       1000000
+
+# Use 0 for unlimited
+setting USER_CHUNK_CACHE_MAX default     1000
+setting USER_CHUNK_MALLOC_MAX default 8000000
+
+# If this option is enabled APIs to set the above limits at run time are added;
+# without this the hardwired (compile time) limits will be used.
+option SET_USER_LIMITS requires USER_LIMITS

 # All of the following options relate to code capabilities for
 # processing image data before creating a PNG or after reading one.
@@ -541,6 +531,7 @@ option USER_TRANSFORM_INFO if READ_USER_TRANSFORM, WRITE_USER_TRANSFORM
 # non-IDAT chunks (zTXt, iTXt, iCCP, and unknown chunks).  This feature
 # was added at libpng-1.5.3.
 option WRITE_CUSTOMIZE_ZTXT_COMPRESSION requires WRITE
+option WRITE_CUSTOMIZE_COMPRESSION requires WRITE

 # Any chunks you are not interested in, you can undef here.  The
 # ones that allocate memory may be expecially important (hIST,
@@ -666,7 +657,7 @@ setting QUANTIZE_BLUE_BITS default 5
 # are only interested in 8 bits anyway.  Increasing this value
 # results in more memory being used, and more pow() functions
 # being called to fill in the gamma tables.  Don't set this value
-# less then 8, and even that may not work (I haven't tested it).
+# less than 8, and even that may not work (I haven't tested it).

 setting MAX_GAMMA_8 default 11

--- a/scripts/pnglibconf.h.prebuilt
+++ b/scripts/pnglibconf.h.prebuilt
@@ -1,8 +1,8 @@
-/* libpng 1.6.16beta01 STANDARD API DEFINITION */
+/* libpng 1.6.18 STANDARD API DEFINITION */

 /* pnglibconf.h - library build configuration */

-/* Libpng version 1.6.16beta01 - December 14, 2014 */
+/* Libpng version 1.6.18 - July 23, 2015 */

 /* Copyright (c) 1998-2014 Glenn Randers-Pehrson */

@@ -97,13 +97,10 @@
 #define PNG_READ_tIME_SUPPORTED
 #define PNG_READ_tRNS_SUPPORTED
 #define PNG_READ_zTXt_SUPPORTED
-/*#undef PNG_SAFE_LIMITS_SUPPORTED*/
 #define PNG_SAVE_INT_32_SUPPORTED
 #define PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED
 #define PNG_SEQUENTIAL_READ_SUPPORTED
 #define PNG_SETJMP_SUPPORTED
-#define PNG_SET_CHUNK_CACHE_LIMIT_SUPPORTED
-#define PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
 #define PNG_SET_OPTION_SUPPORTED
 #define PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
 #define PNG_SET_USER_LIMITS_SUPPORTED
@@ -129,6 +126,7 @@
 #define PNG_WRITE_BGR_SUPPORTED
 #define PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED
 #define PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
+#define PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED
 #define PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED
 #define PNG_WRITE_FILLER_SUPPORTED
 #define PNG_WRITE_FILTER_SUPPORTED
@@ -192,12 +190,20 @@
 #define PNG_GAMMA_THRESHOLD_FIXED 5000
 #define PNG_IDAT_READ_SIZE PNG_ZBUF_SIZE
 #define PNG_INFLATE_BUF_SIZE 1024
+#define PNG_LINKAGE_API extern
+#define PNG_LINKAGE_CALLBACK extern
+#define PNG_LINKAGE_DATA extern
+#define PNG_LINKAGE_FUNCTION extern
 #define PNG_MAX_GAMMA_8 11
 #define PNG_QUANTIZE_BLUE_BITS 5
 #define PNG_QUANTIZE_GREEN_BITS 5
 #define PNG_QUANTIZE_RED_BITS 5
 #define PNG_TEXT_Z_DEFAULT_COMPRESSION (-1)
 #define PNG_TEXT_Z_DEFAULT_STRATEGY 0
+#define PNG_USER_CHUNK_CACHE_MAX 1000
+#define PNG_USER_CHUNK_MALLOC_MAX 8000000
+#define PNG_USER_HEIGHT_MAX 1000000
+#define PNG_USER_WIDTH_MAX 1000000
 #define PNG_WEIGHT_SHIFT 8
 #define PNG_ZBUF_SIZE 8192
 #define PNG_ZLIB_VERNUM 0 /* unknown */
--- a/scripts/pnglibconf.mak
+++ b/scripts/pnglibconf.mak
@@ -49,6 +49,7 @@ pnglibconf.dfn: $(srcdir)/scripts/pnglibconf.dfa $(srcdir)/scripts/options.awk $
 	$(MOVE) pnglibconf.tmp $@

 clean-pnglibconf:
-	$(DELETE) pnglibconf.*
+	$(DELETE) pnglibconf.h pnglibconf.c pnglibconf.out pnglibconf.pre \
+	pnglibconf.dfn

 clean: clean-pnglibconf
--- a/scripts/prefix.dfn
+++ b/scripts/prefix.dfn
@@ -1,8 +1,8 @@

-/* prefix.dfn - generate an unprefixed symbol list
+/* prefix.c - generate an unprefixed symbol list
 *
- * Last changed in libpng version 1.6.0 [January 30, 2012]
- * Copyright (c) 2012 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2013-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
--- a/scripts/sym.dfn
+++ b/scripts/sym.dfn
@@ -1,8 +1,8 @@

-/* sym.dfn - define format of libpng.sym
+/* sym.c - define format of libpng.sym
 *
- * Last changed in libpng version 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2011-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -12,4 +12,4 @@
 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
        PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"

-#include "png.h"
+#include "../png.h"
--- a/scripts/symbols.dfn
+++ b/scripts/symbols.dfn
@@ -1,8 +1,8 @@

-/* symbols.dfn - find all exported symbols
+/* symbols.c - find all exported symbols
 *
- * Last changed in libpng version 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2011-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -26,8 +26,8 @@
 /* Read the defaults, but use scripts/pnglibconf.h.prebuilt; the 'standard'
 * header file.
 */
-#include "scripts/pnglibconf.h.prebuilt"
-#include "png.h"
+#include "pnglibconf.h.prebuilt"
+#include "../png.h"

 /* Some things are turned off by default.  Turn these things
 * on here (by hand) to get the APIs they expose and validate
@@ -45,7 +45,7 @@
 #define PNG_SET_OPTION_SUPPORTED

 #undef PNG_H
-#include "png.h"
+#include "../png.h"

 /* Finally there are a couple of places where option support
 * actually changes the APIs revealed using a #if/#else/#endif
@@ -55,4 +55,4 @@
 #undef  PNG_ERROR_TEXT_SUPPORTED     /* Exposes unsupported APIs */

 #undef PNG_H
-#include "png.h"
+#include "../png.h"
--- a/scripts/symbols.def
+++ b/scripts/symbols.def
@@ -1,4 +1,4 @@
-;Version 1.6.16beta01
+;Version 1.6.18
 ;--------------------------------------------------------------
 ; LIBPNG symbol list as a Win32 DEF file
 ; Contains all the symbols that can be exported from libpng
--- a/scripts/vers.dfn
+++ b/scripts/vers.dfn
@@ -1,8 +1,8 @@

-/* vers.dfn - define format of libpng.vers
+/* vers.c - define format of libpng.vers
 *
- * Last changed in libpng version 1.5.0 [January 6, 2011]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Last changed in libpng version 1.6.16 [December 22, 2014]
+ * Copyright (c) 2011-2014 Glenn Randers-Pehrson
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer