[master] Imported from libpng-1.6.20.tar

[master] Imported from libpng-1.6.19.tar
[master] Imported from libpng-1.6.18.tar
2025-07-10 18:04:09 +02:00 · 2015-12-02 22:37:04 -06:00 · 2015-11-12 07:18:03 -06:00 · 2015-07-22 22:41:05 -05:00 · 2015-03-26 08:11:22 -05:00 · 2015-01-15 12:47:40 -05:00
52 changed files with 619 additions and 447 deletions
--- a/137
+++ b/137
@@ -1,126 +1,47 @@
-Libpng 1.6.19rc03 - November 3, 2015
+Libpng 1.6.20 - December 3, 2015

-This is not intended to be a public release.  It will be replaced
-within a few weeks by a public version or by another test version.
+This is a public release of libpng, intended for use in production codes.

 Files available for download:

 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script

-   1.6.19rc03.tar.xz (LZMA-compressed, recommended)
-   1.6.19rc03.tar.gz
+   libpng-1.6.20.tar.xz (LZMA-compressed, recommended)
+   libpng-1.6.20.tar.gz

 Source files with CRLF line endings (for Windows), without the
 "configure" script

-   lp1619r03.7z  (LZMA-compressed, recommended)
-   lp1619r03.zip
+   /scratch/glennrp/Libpng16/lpng1620.7z  (LZMA-compressed, recommended)
+   /scratch/glennrp/Libpng16/lpng1620.zip

 Other information:

-   1.6.19rc03-README.txt
-   1.6.19rc03-LICENSE.txt
-   libpng-1.6.19rc03-*.asc (armored detached GPG signatures)
+   libpng-1.6.20-README.txt
+   libpng-1.6.20-LICENSE.txt
+   libpng-1.6.20-*.asc (armored detached GPG signatures)

-Changes since the last public release (1.6.18):
-
-Version 1.6.19beta01 [July 30, 2015]
-
-  Updated obsolete information about the simplified API macros in the
-    manual pages (Bug report by Arc Riley).
-  Avoid potentially dereferencing NULL info_ptr in png_info_init_3().
-  Rearranged png.h to put the major sections in the same order as
-    in libpng17.
-  Eliminated unused PNG_COST_SHIFT, PNG_WEIGHT_SHIFT, PNG_COST_FACTOR, and
-    PNG_WEIGHT_FACTOR macros.
-  Suppressed some warnings from the Borland C++ 5.5.1/5.82 compiler
-    (Bug report by Viktor Szakats).  Several warnings remain and are
-    unavoidable, where we test for overflow.
-  Fixed potential leak of png_pixels in contrib/pngminus/pnm2png.c
-  Fixed uninitialized variable in contrib/gregbook/rpng2-x.c
-
-Version 1.6.19beta02 [August 19, 2015]
-  Moved config.h.in~ from the "libpng_autotools_files" list to the
-    "libpng_autotools_extra" list in autogen.sh because it was causing a
-    false positive for missing files (bug report by Robert C. Seacord).
-  Removed unreachable "break" statements in png.c, pngread.c, and pngrtran.c
-    to suppress clang warnings (Bug report by Viktor Szakats).
-  Fixed some bad links in the man page.
-  Changed "n bit" to "n-bit" in comments.
-  Added signed/unsigned 16-bit safety net. This removes the dubious
-    0x8000 flag definitions on 16-bit systems. They aren't supported
-    yet the defs *probably* work, however it seems much safer to do this
-    and be advised if anyone, contrary to advice, is building libpng 1.6
-    on a 16-bit system. It also adds back various switch default clauses
-    for GCC; GCC errors out if they are not present (with an appropriately
-    high level of warnings).
-  Safely convert num_bytes to a png_byte in png_set_sig_bytes() (Robert
-    Seacord).
-  Fixed the recently reported 1's complement security issue by replacing
-    the value that is illegal in the PNG spec, in both signed and unsigned
-    values, with 0. Illegal unsigned values (anything greater than or equal
-    to  0x80000000) can still pass through, but since these are not illegal
-    in ANSI-C (unlike 0x80000000 in the signed case) the checking that
-    occurs later can catch them (John Bowler).
-
-Version 1.6.19beta03 [September 26, 2015]
-  Fixed png_save_int_32 when int is not 2's complement (John Bowler).
-  Updated libpng16 with all the recent test changes from libpng17,
-    including changes to pngvalid.c to ensure that the original,
-    distributed, version of contrib/visupng/cexcept.h can be used
-    (John Bowler).
-  pngvalid contains the correction to the use of SAVE/STORE_
-    UNKNOWN_CHUNKS; a bug revealed by changes in libpng 1.7. More
-    tests contain the --strict option to detect warnings and the
-    pngvalid-standard test has been corrected so that it does not
-    turn on progressive-read. There is a separate test which does
-    that. (John Bowler)
-  Also made some signed/unsigned fixes.
-  Make pngstest error limits version specific. Splitting the machine
-    generated error structs out to a file allows the values to be updated
-    without changing pngstest.c itself. Since libpng 1.6 and 1.7 have
-    slightly different error limits this simplifies maintenance. The
-    makepngs.sh script has also been updated to more accurately reflect
-    current problems in libpng 1.7 (John Bowler).
-  Incorporated new test PNG files into make check.  tests/pngstest-*
-    are changed so that the new test files are divided into 8 groups by
-    gamma and alpha channel.  These tests have considerably better code
-    and pixel-value coverage than contrib/pngsuite; however,coverage is
-    still incomplete (John Bowler).
-  Removed the '--strict' in 1.6 because of the double-gamma-correction
-    warning, updated pngstest-errors.h for the errors detected with the
-    new contrib/testspngs PNG test files (John Bowler).
-
-Version 1.6.19beta04 [October 15, 2015]
-  Worked around rgb-to-gray issues in libpng 1.6.  The previous
-    attempts to ignore the errors in the code aren't quite enough to
-    deal with the 'channel selection' encoding added to libpng 1.7; abort.
-  Fixed 'pow' macros in pngvalid.c. It is legal for 'pow' to be a
-    macro, therefore the argument list cannot contain preprocessing
-    directives.  Make sure pow is a function where this happens. This is
-    a minimal safe fix, the issue only arises in non-performance-critical
-    code (bug report by Curtis Leach, fix by John Bowler).
-  Added sPLT support to pngtest.c
-
-Version 1.6.19rc01 [October 23, 2015]
-  No changes.
-
-Version 1.6.19rc02 [October 31, 2015]
-  Prevent setting or writing over-length PLTE chunk (Cosmin Truta).
-  Silently truncate over-length PLTE chunk while reading.
-  Libpng incorrectly calculated the output rowbytes when the application
-    decreased either the number of channels or the bit depth (or both) in
-    a user transform.  This was safe; libpng overallocated buffer space
-   (potentially by quite a lot; up to 4 times the amount required) but,
-   from 1.5.4 on, resulted in a png_error (John Bowler).
-
-Version 1.6.19rc03 [November 3, 2015]
-  Fixed some inconsequential cut-and-paste typos in png_set_cHRM_XYZ_fixed().
-  Clarified COPYRIGHT information to state explicitly that versions
-    are derived from previous versions.
-  Removed much of the long list of previous versions from png.h and
-    libpng.3.
+Changes since the last public release (1.6.19):
+  Avoid potential pointer overflow/underflow in png_handle_sPLT() and
+    png_handle_pCAL() (Bug report by John Regehr).
+  Fixed incorrect implementation of png_set_PLTE() that uses png_ptr
+    not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126
+    vulnerability.
+  Backported tests from libpng-1.7.0beta69.
+  Fixed an error in handling of bad zlib CMINFO field in pngfix, found by
+    American Fuzzy Lop, reported by Brian Carpenter.  inflate() doesn't
+    immediately fault a bad CMINFO field; instead a 'too far back' error
+    happens later (at least some times).  pngfix failed to limit CMINFO to
+    the allowed values but then assumed that window_bits was in range,
+    triggering an assert. The bug is mostly harmless; the PNG file cannot
+    be fixed.
+  In libpng 1.6 zlib initialization was changed to use the window size
+    in the zlib stream, not a fixed value. This causes some invalid images,
+    where CINFO is too large, to display 'correctly' if the rest of the
+    data is valid.  This provides a workaround for zlib versions where the
+    error arises (ones that support the API change to use the window size
+    in the stream).

 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
--- a/39
+++ b/39
@@ -5407,6 +5407,45 @@ Version 1.6.19rc03 [November 3, 2015]
  Removed much of the long list of previous versions from png.h and
    libpng.3.

+Version 1.6.19rc04 [November 5, 2015]
+  Fixed new bug with CRC error after reading an over-length palette
+    (bug report by Cosmin Truta) (CVE-2015-8126).
+
+Version 1.6.19 [November 12, 2015]
+  Cleaned up coding style in png_handle_PLTE().
+
+Version 1.6.20beta01 [November 20, 2015]
+  Avoid potential pointer overflow/underflow in png_handle_sPLT() and
+    png_handle_pCAL() (Bug report by John Regehr).
+
+Version 1.6.20beta02 [November 23, 2015]
+  Fixed incorrect implementation of png_set_PLTE() that uses png_ptr
+    not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126
+    vulnerability.
+
+Version 1.6.20beta03 [November 24, 2015]
+  Backported tests from libpng-1.7.0beta69.
+
+Version 1.6.20rc01 [November 26, 2015]
+  Fixed an error in handling of bad zlib CMINFO field in pngfix, found by
+    American Fuzzy Lop, reported by Brian Carpenter.  inflate() doesn't
+    immediately fault a bad CMINFO field; instead a 'too far back' error
+    happens later (at least some times).  pngfix failed to limit CMINFO to
+    the allowed values but then assumed that window_bits was in range,
+    triggering an assert. The bug is mostly harmless; the PNG file cannot
+    be fixed.
+
+Version 1.6.20rc02 [November 29, 2015]
+  In libpng 1.6 zlib initialization was changed to use the window size
+    in the zlib stream, not a fixed value. This causes some invalid images,
+    where CINFO is too large, to display 'correctly' if the rest of the
+    data is valid.  This provides a workaround for zlib versions where the
+    error arises (ones that support the API change to use the window size
+    in the stream).
+
+Version 1.6.20 [December 3, 2015]
+  No changes.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -16,7 +16,7 @@ enable_testing()

 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 6)
-set(PNGLIB_RELEASE 19)
+set(PNGLIB_RELEASE 20)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})

@@ -261,7 +261,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW)
 # SET UP LINKS
 if(PNG_SHARED)
  set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 16.${PNGLIB_RELEASE}.1.6.19rc03
+#   VERSION 16.${PNGLIB_RELEASE}.1.6.20
    VERSION 16.${PNGLIB_RELEASE}.0
    SOVERSION 16
    CLEAN_DIRECT_OUTPUT 1)
--- a/4
+++ b/4
@@ -10,7 +10,7 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.0.7, July 1, 2000, through 1.6.19rc03, November 3, 2015, are
+libpng versions 1.0.7, July 1, 2000, through 1.6.20, December 3, 2015, are
 Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -109,4 +109,4 @@ the additional disclaimers inserted at version 1.0.7.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 3, 2015
+December 3, 2015
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-README for libpng version 1.6.19rc03 - November 3, 2015 (shared library 16.0)
+README for libpng version 1.6.20 - December 3, 2015 (shared library 16.0)
 See the note about version numbers near the top of png.h

 See INSTALL for instructions on how to install libpng.
--- a/configure.ac
+++ b/configure.ac
@@ -18,7 +18,7 @@ AC_PREREQ([2.68])

 dnl Version number stuff here:

-AC_INIT([libpng],[1.6.19rc03],[png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng],[1.6.20],[png-mng-implement@lists.sourceforge.net])
 AC_CONFIG_MACRO_DIR([scripts])

 # libpng does not follow GNU file name conventions (hence 'foreign')
@@ -39,10 +39,10 @@ dnl automake, so the following is not necessary (and is not defined anyway):
 dnl AM_PREREQ([1.11.2])
 dnl stop configure from automagically running automake

-PNGLIB_VERSION=1.6.19rc03
+PNGLIB_VERSION=1.6.20
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=6
-PNGLIB_RELEASE=19
+PNGLIB_RELEASE=20

 dnl End of version number stuff

--- a/contrib/arm-neon/linux-auxv.c
+++ b/contrib/arm-neon/linux-auxv.c
@@ -7,7 +7,7 @@
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
- * 
+ *
 * SEE contrib/arm-neon/README before reporting bugs
 *
 * STATUS: COMPILED, TESTED
--- a/contrib/arm-neon/linux.c
+++ b/contrib/arm-neon/linux.c
@@ -72,7 +72,7 @@ png_have_neon(png_structp png_ptr)
                     state = Colon;
                  break;
               }
-               
+
               /* did not match 'feature' */
               state = SkipLine;
               /* FALL THROUGH */
--- a/contrib/examples/simpleover.c
+++ b/contrib/examples/simpleover.c
@@ -136,7 +136,7 @@ sprite_op(const struct sprite *sprite, int x_offset, int y_offset,
            /* This is the optimized Porter-Duff 'Over' operation, when the
             * input alpha is 0 the output is not changed.
             */
-            if (in_alpha > 0) 
+            if (in_alpha > 0)
            {
               png_uint_16 *out_pixel = sprite->buffer +
                  ((y+y_offset) * sprite->width + (x+x_offset))*4;
@@ -184,7 +184,7 @@ sprite_op(const struct sprite *sprite, int x_offset, int y_offset,
   }
 }

-static int 
+static int
 create_sprite(struct sprite *sprite, int *argc, const char ***argv)
 {
   /* Read the arguments and create this sprite. The sprite buffer has already
@@ -415,7 +415,7 @@ simpleover_process(png_imagep output, png_bytep out_buf, int argc,
            n = sscanf(argv[0], "--sprite=%u,%u,%" str(sprite_name_chars) "s%c",
                &sprites[nsprites].width, &sprites[nsprites].height,
                sprites[nsprites].name, &tombstone);
-            
+
            if ((n == 2 || n == 3) &&
                sprites[nsprites].width > 0 && sprites[nsprites].height > 0)
            {
@@ -492,7 +492,7 @@ simpleover_process(png_imagep output, png_bytep out_buf, int argc,
               if (!add_sprite(output, out_buf, sprites+isprite, &argc, &argv))
                  goto out; /* error in add_sprite */

-               break; 
+               break;
            }
         }

--- a/contrib/gregbook/rpng2-win.c
+++ b/contrib/gregbook/rpng2-win.c
@@ -33,7 +33,7 @@
    - 2.02:  fixed improper display of usage screen on PNG error(s); fixed
              unexpected-EOF and file-read-error cases
    - 2.03:  removed runtime MMX-enabling/disabling and obsolete -mmx* options
-    - 2.04:  
+    - 2.04:
             (GR-P)

  ---------------------------------------------------------------------------
--- a/contrib/gregbook/rpng2-x.c
+++ b/contrib/gregbook/rpng2-x.c
@@ -496,12 +496,12 @@ int main(int argc, char **argv)
          "\t\t  transparent images; overrides -bgcolor\n",
          num_bgpat-1);
 #ifdef FEATURE_LOOP
-        fprintf(stderr, 
+        fprintf(stderr,
          "    -loop\tloops through background images after initial display\n"
          "\t\t  is complete (depends on -bgpat)\n"
          "    sec \tseconds to display each background image (default = 2)\n");
 #endif
-        fprintf(stderr, 
+        fprintf(stderr,
          "    dur \tduration in microseconds to wait after displaying each\n"
          "\t\t  row (for demo purposes)\n"
          "    -timing\tenables delay for every block read, to simulate modem\n"
--- a/contrib/libtests/makepng.c
+++ b/contrib/libtests/makepng.c
@@ -392,7 +392,7 @@ generate_row(png_bytep row, size_t rowbytes, unsigned int y, int color_type,
   unsigned int *colors, int small)
 {
   int filters = 0; /* file *MASK*, 0 means the default, not NONE */
-   png_uint_32 size_max = 
+   png_uint_32 size_max =
      image_size_of_type(color_type, bit_depth, colors, small)-1;
   png_uint_32 depth_max = (1U << bit_depth)-1; /* up to 65536 */

@@ -526,7 +526,7 @@ generate_row(png_bytep row, size_t rowbytes, unsigned int y, int color_type,
            assert(0/*NOT REACHED*/);
      }
   }
-      
+
   else switch (channels_of_type(color_type))
   {
   /* 1 channel: a square image with a diamond, the least luminous colors are on
@@ -1361,6 +1361,56 @@ insert_hIST(png_structp png_ptr, png_infop info_ptr, int nparams,
   png_set_hIST(png_ptr, info_ptr, freq);
 }

+static png_byte
+bval(png_const_structrp png_ptr, png_charp param, unsigned int maxval)
+{
+   char *endptr = NULL;
+   unsigned long int l = strtoul(param, &endptr, 0/*base*/);
+
+   if (param[0] && *endptr == 0 && l <= maxval)
+      return (png_byte)l;
+
+   else
+      png_error(png_ptr, "sBIT: invalid sBIT value");
+}
+
+static void
+insert_sBIT(png_structp png_ptr, png_infop info_ptr, int nparams,
+      png_charpp params)
+{
+   const int ct = png_get_color_type(png_ptr, info_ptr);
+   const int c = (ct & PNG_COLOR_MASK_COLOR ? 3 : 1) +
+      (ct & PNG_COLOR_MASK_ALPHA ? 1 : 0);
+   const unsigned int maxval =
+      ct & PNG_COLOR_MASK_PALETTE ? 8U : png_get_bit_depth(png_ptr, info_ptr);
+   png_color_8 sBIT;
+
+   if (nparams != c)
+      png_error(png_ptr, "sBIT: incorrect parameter count");
+
+   if (ct & PNG_COLOR_MASK_COLOR)
+   {
+      sBIT.red = bval(png_ptr, params[0], maxval);
+      sBIT.green = bval(png_ptr, params[1], maxval);
+      sBIT.blue = bval(png_ptr, params[2], maxval);
+      sBIT.gray = 42;
+   }
+
+   else
+   {
+      sBIT.red = sBIT.green = sBIT.blue = 42;
+      sBIT.gray = bval(png_ptr, params[0], maxval);
+   }
+
+   if (ct & PNG_COLOR_MASK_ALPHA)
+      sBIT.alpha = bval(png_ptr, params[nparams-1], maxval);
+
+   else
+      sBIT.alpha = 42;
+
+   png_set_sBIT(png_ptr, info_ptr, &sBIT);
+}
+
 #if 0
 static void
 insert_sPLT(png_structp png_ptr, png_infop info_ptr, int nparams, png_charpp params)
@@ -1488,6 +1538,11 @@ find_insert(png_const_charp what, png_charp param)
            return make_insert(what, insert_hIST, nparams, parameter_list);
         break;

+      case CHUNK(115,66,73,84): /* sBIT */
+         if (nparams <= 4)
+            return make_insert(what, insert_sBIT, nparams, parameter_list);
+         break;
+
 #if 0
      case CHUNK(115,80,76,84):  /* sPLT */
         return make_insert(what, insert_sPLT, nparams, parameter_list);
@@ -1858,7 +1913,7 @@ main(int argc, char **argv)
      };

      chunk_insert *new_insert;
-      
+
      new_insert = add_tEXt("Copyright", copyright);
      if (new_insert != NULL)
      {
--- a/contrib/libtests/pngimage.c
+++ b/contrib/libtests/pngimage.c
@@ -2,7 +2,7 @@
 *
 * Copyright (c) 2015 John Cunningham Bowler
 *
- * Last changed in libpng 1.6.19 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.20 [December 3, 2015]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -36,7 +36,8 @@
 #  include <setjmp.h> /* because png.h did *not* include this */
 #endif

-#if defined(PNG_INFO_IMAGE_SUPPORTED) && defined(PNG_SEQUENTIAL_READ_SUPPORTED)
+#if defined(PNG_INFO_IMAGE_SUPPORTED) && defined(PNG_SEQUENTIAL_READ_SUPPORTED)\
+    && (defined(PNG_READ_PNG_SUPPORTED) || PNG_LIBPNG_VER < 10700)
 /* If a transform is valid on both read and write this implies that if the
 * transform is applied to read it must also be applied on write to produce
 * meaningful data.  This is because these transforms when performed on read
@@ -947,7 +948,7 @@ update_display(struct display *dp)

         if ((transform_info[i].valid_chunks == 0 ||
               (transform_info[i].valid_chunks & chunks) != 0) &&
-            (transform_info[i].color_mask_required & ct) == 
+            (transform_info[i].color_mask_required & ct) ==
               transform_info[i].color_mask_required &&
            (transform_info[i].color_mask_absent & ct) == 0 &&
            (transform_info[i].bit_depths & bd) != 0 &&
@@ -1005,7 +1006,7 @@ compare_read(struct display *dp, int applied_transforms)
   {
      unsigned long chunks =
         png_get_valid(dp->read_pp, dp->read_ip, 0xffffffff);
-      
+
      if (chunks != dp->chunks)
         display_log(dp, APP_FAIL, "PNG chunks changed from 0x%lx to 0x%lx",
            (unsigned long)dp->chunks, chunks);
@@ -1676,7 +1677,7 @@ main(const int argc, const char * const * const argv)
      return errors != 0;
   }
 }
-#else /* !PNG_INFO_IMAGE_SUPPORTED || !PNG_READ_SUPPORTED */
+#else /* !INFO_IMAGE || !SEQUENTIAL_READ || !READ_PNG*/
 int
 main(void)
 {
--- a/contrib/libtests/pngstest.c
+++ b/contrib/libtests/pngstest.c
@@ -3130,7 +3130,7 @@ write_one_file(Image *output, Image *image, int convert_to_8bit)
        (void) unlink(tmpfile);
      }
 #endif
-      
+
      if (f != NULL)
      {
         if (png_image_write_to_stdio(&image->image, f, convert_to_8bit,
--- a/contrib/libtests/pngvalid.c
+++ b/contrib/libtests/pngvalid.c
@@ -1,7 +1,7 @@

 /* pngvalid.c - validate libpng by constructing then reading png files.
 *
- * Last changed in libpng 1.5.24 [(PENDING RELEASE)]
+ * Last changed in libpng 1.5.25 [December 3, 2015]
 * Copyright (c) 2014-2015 Glenn Randers-Pehrson
 * Written by John Cunningham Bowler
 *
@@ -116,13 +116,6 @@ typedef png_byte *png_const_bytep;
 #  define png_const_structp png_structp
 #endif

-#if PNG_LIBPNG_VER < 10700
-   /* READ_INTERLACING was used instead of READ_DEINTERLACE. */
-#  ifdef PNG_READ_INTERLACING_SUPPORTED
-#     define PNG_READ_DEINTERLACE_SUPPORTED
-#  endif
-#endif
-
 #include <float.h>  /* For floating point constants */
 #include <stdlib.h> /* For malloc */
 #include <string.h> /* For memcpy, memset */
@@ -539,7 +532,8 @@ sample(png_const_bytep row, png_byte colour_type, png_byte bit_depth,
 */
 static void
 pixel_copy(png_bytep toBuffer, png_uint_32 toIndex,
-   png_const_bytep fromBuffer, png_uint_32 fromIndex, unsigned int pixelSize)
+   png_const_bytep fromBuffer, png_uint_32 fromIndex, unsigned int pixelSize,
+   int littleendian)
 {
   /* Assume we can multiply by 'size' without overflow because we are
    * just working in a single buffer.
@@ -549,15 +543,25 @@ pixel_copy(png_bytep toBuffer, png_uint_32 toIndex,
   if (pixelSize < 8) /* Sub-byte */
   {
      /* Mask to select the location of the copied pixel: */
-      unsigned int destMask = ((1U<<pixelSize)-1) << (8-pixelSize-(toIndex&7));
+      unsigned int destMask = ((1U<<pixelSize)-1) <<
+         (littleendian ? toIndex&7 : 8-pixelSize-(toIndex&7));
      /* The following read the entire pixels and clears the extra: */
      unsigned int destByte = toBuffer[toIndex >> 3] & ~destMask;
      unsigned int sourceByte = fromBuffer[fromIndex >> 3];

      /* Don't rely on << or >> supporting '0' here, just in case: */
      fromIndex &= 7;
-      if (fromIndex > 0) sourceByte <<= fromIndex;
-      if ((toIndex & 7) > 0) sourceByte >>= toIndex & 7;
+      if (littleendian)
+      {
+         if (fromIndex > 0) sourceByte >>= fromIndex;
+         if ((toIndex & 7) > 0) sourceByte <<= toIndex & 7;
+      }
+
+      else
+      {
+         if (fromIndex > 0) sourceByte <<= fromIndex;
+         if ((toIndex & 7) > 0) sourceByte >>= toIndex & 7;
+      }

      toBuffer[toIndex >> 3] = (png_byte)(destByte | (sourceByte & destMask));
   }
@@ -570,7 +574,8 @@ pixel_copy(png_bytep toBuffer, png_uint_32 toIndex,
 * bytes at the end.
 */
 static void
-row_copy(png_bytep toBuffer, png_const_bytep fromBuffer, unsigned int bitWidth)
+row_copy(png_bytep toBuffer, png_const_bytep fromBuffer, unsigned int bitWidth,
+      int littleendian)
 {
   memcpy(toBuffer, fromBuffer, bitWidth >> 3);

@@ -580,10 +585,10 @@ row_copy(png_bytep toBuffer, png_const_bytep fromBuffer, unsigned int bitWidth)

      toBuffer += bitWidth >> 3;
      fromBuffer += bitWidth >> 3;
-      /* The remaining bits are in the top of the byte, the mask is the bits to
-       * retain.
-       */
-      mask = 0xff >> (bitWidth & 7);
+      if (littleendian)
+         mask = 0xff << (bitWidth & 7);
+      else
+         mask = 0xff >> (bitWidth & 7);
      *toBuffer = (png_byte)((*toBuffer & mask) | (*fromBuffer & ~mask));
   }
 }
@@ -3549,6 +3554,7 @@ transform_row(png_const_structp pp, png_byte buffer[TRANSFORM_ROWMAX],
 #  define INTERLACE_LAST PNG_INTERLACE_LAST
 #  define check_interlace_type(type) ((void)(type))
 #  define set_write_interlace_handling(pp,type) png_set_interlace_handling(pp)
+#  define do_own_interlace 0
 #elif PNG_LIBPNG_VER < 10700
 #  define set_write_interlace_handling(pp,type) (1)
 static void
@@ -3568,16 +3574,75 @@ check_interlace_type(int const interlace_type)
   }
 }
 #  define INTERLACE_LAST (PNG_INTERLACE_NONE+1)
+#  define do_own_interlace 0
 #else /* libpng 1.7+ */
 #  define set_write_interlace_handling(pp,type)\
      npasses_from_interlace_type(pp,type)
 #  define check_interlace_type(type) ((void)(type))
-#  define INTERLACE_LAST (PNG_INTERLACE_NONE+1)
+#  define INTERLACE_LAST PNG_INTERLACE_LAST
+#  define do_own_interlace 1
 #endif /* WRITE_INTERLACING tests */

 #define CAN_WRITE_INTERLACE\
   PNG_LIBPNG_VER >= 10700 || defined PNG_WRITE_INTERLACING_SUPPORTED

+/* Do the same thing for read interlacing; this controls whether read tests do
+ * their own de-interlace or use libpng.
+ */
+#ifdef PNG_READ_INTERLACING_SUPPORTED
+#  define do_read_interlace 0
+#else /* no libpng read interlace support */
+#  define do_read_interlace 1
+#endif
+/* The following two routines use the PNG interlace support macros from
+ * png.h to interlace or deinterlace rows.
+ */
+static void
+interlace_row(png_bytep buffer, png_const_bytep imageRow,
+   unsigned int pixel_size, png_uint_32 w, int pass, int littleendian)
+{
+   png_uint_32 xin, xout, xstep;
+
+   /* Note that this can, trivially, be optimized to a memcpy on pass 7, the
+    * code is presented this way to make it easier to understand.  In practice
+    * consult the code in the libpng source to see other ways of doing this.
+    *
+    * It is OK for buffer and imageRow to be identical, because 'xin' moves
+    * faster than 'xout' and we copy up.
+    */
+   xin = PNG_PASS_START_COL(pass);
+   xstep = 1U<<PNG_PASS_COL_SHIFT(pass);
+
+   for (xout=0; xin<w; xin+=xstep)
+   {
+      pixel_copy(buffer, xout, imageRow, xin, pixel_size, littleendian);
+      ++xout;
+   }
+}
+
+#ifdef PNG_READ_SUPPORTED
+static void
+deinterlace_row(png_bytep buffer, png_const_bytep row,
+   unsigned int pixel_size, png_uint_32 w, int pass, int littleendian)
+{
+   /* The inverse of the above, 'row' is part of row 'y' of the output image,
+    * in 'buffer'.  The image is 'w' wide and this is pass 'pass', distribute
+    * the pixels of row into buffer and return the number written (to allow
+    * this to be checked).
+    */
+   png_uint_32 xin, xout, xstep;
+
+   xout = PNG_PASS_START_COL(pass);
+   xstep = 1U<<PNG_PASS_COL_SHIFT(pass);
+
+   for (xin=0; xout<w; xout+=xstep)
+   {
+      pixel_copy(buffer, xout, row, xin, pixel_size, littleendian);
+      ++xin;
+   }
+}
+#endif /* PNG_READ_SUPPORTED */
+
 /* Make a standardized image given an image colour type, bit depth and
 * interlace type.  The standard images have a very restricted range of
 * rows and heights and are used for testing transforms rather than image
@@ -3597,7 +3662,7 @@ make_transform_image(png_store* const ps, png_byte const colour_type,
   {
      png_infop pi;
      png_structp pp = set_store_for_write(ps, &pi, name);
-      png_uint_32 h;
+      png_uint_32 h, w;

      /* In the event of a problem return control to the Catch statement below
       * to do the clean up - it is not possible to 'return' directly from a Try
@@ -3606,10 +3671,10 @@ make_transform_image(png_store* const ps, png_byte const colour_type,
      if (pp == NULL)
         Throw ps;

+      w = transform_width(pp, colour_type, bit_depth);
      h = transform_height(pp, colour_type, bit_depth);

-      png_set_IHDR(pp, pi, transform_width(pp, colour_type, bit_depth), h,
-         bit_depth, colour_type, interlace_type,
+      png_set_IHDR(pp, pi, w, h, bit_depth, colour_type, interlace_type,
         PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);

 #ifdef PNG_TEXT_SUPPORTED
@@ -3671,11 +3736,37 @@ make_transform_image(png_store* const ps, png_byte const colour_type,
         {
            png_uint_32 y;

+            /* do_own_interlace is a pre-defined boolean (a #define) which is
+             * set if we have to work out the interlaced rows here.
+             */
            for (y=0; y<h; ++y)
            {
               png_byte buffer[TRANSFORM_ROWMAX];

               transform_row(pp, buffer, colour_type, bit_depth, y);
+
+#              if do_own_interlace
+                  /* If do_own_interlace *and* the image is interlaced we need a
+                   * reduced interlace row; this may be reduced to empty.
+                   */
+                  if (interlace_type == PNG_INTERLACE_ADAM7)
+                  {
+                     /* The row must not be written if it doesn't exist, notice
+                      * that there are two conditions here, either the row isn't
+                      * ever in the pass or the row would be but isn't wide
+                      * enough to contribute any pixels.  In fact the wPass test
+                      * can be used to skip the whole y loop in this case.
+                      */
+                     if (PNG_ROW_IN_INTERLACE_PASS(y, pass) &&
+                         PNG_PASS_COLS(w, pass) > 0)
+                        interlace_row(buffer, buffer,
+                              bit_size(pp, colour_type, bit_depth), w, pass,
+                              0/*data always bigendian*/);
+                     else
+                        continue;
+                  }
+#              endif /* do_own_interlace */
+
               png_write_row(pp, buffer);
            }
         }
@@ -3745,59 +3836,13 @@ make_transform_images(png_modifier *pm)
         char name[FILE_NAME_SIZE];

         standard_name(name, sizeof name, 0, colour_type, bit_depth,
-            palette_number, interlace_type, 0, 0, 0);
+            palette_number, interlace_type, 0, 0, do_own_interlace);
         make_transform_image(&pm->this, colour_type, bit_depth, palette_number,
            interlace_type, name);
      }
   }
 }

-/* The following two routines use the PNG interlace support macros from
- * png.h to interlace or deinterlace rows.
- */
-static void
-interlace_row(png_bytep buffer, png_const_bytep imageRow,
-   unsigned int pixel_size, png_uint_32 w, int pass)
-{
-   png_uint_32 xin, xout, xstep;
-
-   /* Note that this can, trivially, be optimized to a memcpy on pass 7, the
-    * code is presented this way to make it easier to understand.  In practice
-    * consult the code in the libpng source to see other ways of doing this.
-    */
-   xin = PNG_PASS_START_COL(pass);
-   xstep = 1U<<PNG_PASS_COL_SHIFT(pass);
-
-   for (xout=0; xin<w; xin+=xstep)
-   {
-      pixel_copy(buffer, xout, imageRow, xin, pixel_size);
-      ++xout;
-   }
-}
-
-#ifdef PNG_READ_SUPPORTED
-static void
-deinterlace_row(png_bytep buffer, png_const_bytep row,
-   unsigned int pixel_size, png_uint_32 w, int pass)
-{
-   /* The inverse of the above, 'row' is part of row 'y' of the output image,
-    * in 'buffer'.  The image is 'w' wide and this is pass 'pass', distribute
-    * the pixels of row into buffer and return the number written (to allow
-    * this to be checked).
-    */
-   png_uint_32 xin, xout, xstep;
-
-   xout = PNG_PASS_START_COL(pass);
-   xstep = 1U<<PNG_PASS_COL_SHIFT(pass);
-
-   for (xin=0; xout<w; xout+=xstep)
-   {
-      pixel_copy(buffer, xout, row, xin, pixel_size);
-      ++xin;
-   }
-}
-#endif /* PNG_READ_SUPPORTED */
-
 /* Build a single row for the 'size' test images; this fills in only the
 * first bit_width bits of the sample row.
 */
@@ -3948,7 +3993,8 @@ make_size_image(png_store* const ps, png_byte const colour_type,
                      * set unset things to 0).
                      */
                     memset(tempRow, 0xff, sizeof tempRow);
-                     interlace_row(tempRow, row, pixel_size, w, pass);
+                     interlace_row(tempRow, row, pixel_size, w, pass,
+                           0/*data always bigendian*/);
                     row = tempRow;
                  }
                  else
@@ -4045,7 +4091,7 @@ make_size(png_store* const ps, png_byte const colour_type, int bdlo,
 #        endif
 #        if CAN_WRITE_INTERLACE
            /* 1.7.0 removes the hack that prevented app write of an interlaced
-             * image if WRITE_INTERLACING was not supported
+             * image if WRITE_INTERLACE was not supported
             */
            make_size_image(ps, colour_type, DEPTH(bdlo), PNG_INTERLACE_ADAM7,
               width, height, 1);
@@ -4131,7 +4177,7 @@ static const struct
       { sBIT0_error_fn, "sBIT(0): failed to detect error",
         PNG_LIBPNG_VER < 10700 },

-       { sBIT_error_fn, "sBIT(too big): failed to detect error", 
+       { sBIT_error_fn, "sBIT(too big): failed to detect error",
         PNG_LIBPNG_VER < 10700 },
    };

@@ -4147,14 +4193,18 @@ make_error(png_store* const ps, png_byte const colour_type,
   {
      png_infop pi;
      const png_structp pp = set_store_for_write(ps, &pi, name);
+      png_uint_32 w, h;
      gnu_volatile(pp)

      if (pp == NULL)
         Throw ps;

-      png_set_IHDR(pp, pi, transform_width(pp, colour_type, bit_depth),
-         transform_height(pp, colour_type, bit_depth), bit_depth, colour_type,
-         interlace_type, PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
+      w = transform_width(pp, colour_type, bit_depth);
+      gnu_volatile(w)
+      h = transform_height(pp, colour_type, bit_depth);
+      gnu_volatile(h)
+      png_set_IHDR(pp, pi, w, h, bit_depth, colour_type, interlace_type,
+            PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);

      if (colour_type == 3) /* palette */
         init_standard_palette(ps, pp, pi, 1U << bit_depth, 0/*do tRNS*/);
@@ -4206,7 +4256,6 @@ make_error(png_store* const ps, png_byte const colour_type,

      else
      {
-         png_uint_32 h = transform_height(pp, colour_type, bit_depth);
         int npasses = set_write_interlace_handling(pp, interlace_type);
         int pass;

@@ -4222,6 +4271,29 @@ make_error(png_store* const ps, png_byte const colour_type,
               png_byte buffer[TRANSFORM_ROWMAX];

               transform_row(pp, buffer, colour_type, bit_depth, y);
+
+#              if do_own_interlace
+                  /* If do_own_interlace *and* the image is interlaced we need a
+                   * reduced interlace row; this may be reduced to empty.
+                   */
+                  if (interlace_type == PNG_INTERLACE_ADAM7)
+                  {
+                     /* The row must not be written if it doesn't exist, notice
+                      * that there are two conditions here, either the row isn't
+                      * ever in the pass or the row would be but isn't wide
+                      * enough to contribute any pixels.  In fact the wPass test
+                      * can be used to skip the whole y loop in this case.
+                      */
+                     if (PNG_ROW_IN_INTERLACE_PASS(y, pass) &&
+                         PNG_PASS_COLS(w, pass) > 0)
+                        interlace_row(buffer, buffer,
+                              bit_size(pp, colour_type, bit_depth), w, pass,
+                              0/*data always bigendian*/);
+                     else
+                        continue;
+                  }
+#              endif /* do_own_interlace */
+
               png_write_row(pp, buffer);
            }
         }
@@ -4254,7 +4326,7 @@ make_errors(png_modifier* const pm, png_byte const colour_type,
         char name[FILE_NAME_SIZE];

         standard_name(name, sizeof name, 0, colour_type, 1<<bdlo, 0,
-            interlace_type, 0, 0, 0);
+            interlace_type, 0, 0, do_own_interlace);

         for (test=0; test<ARRAY_SIZE(error_test); ++test)
         {
@@ -4416,6 +4488,7 @@ typedef struct standard_display
   png_uint_32 bit_width;      /* Width of output row in bits */
   size_t      cbRow;          /* Bytes in a row of the output image */
   int         do_interlace;   /* Do interlacing internally */
+   int         littleendian;   /* App (row) data is little endian */
   int         is_transparent; /* Transparency information was present. */
   int         has_tRNS;       /* color type GRAY or RGB with a tRNS chunk. */
   int         speed;          /* Doing a speed test */
@@ -4458,6 +4531,7 @@ standard_display_init(standard_display *dp, png_store* ps, png_uint_32 id,
   dp->bit_width = 0;
   dp->cbRow = 0;
   dp->do_interlace = do_interlace;
+   dp->littleendian = 0;
   dp->is_transparent = 0;
   dp->speed = ps->speed;
   dp->use_update_info = use_update_info;
@@ -4778,8 +4852,19 @@ standard_info_part1(standard_display *dp, png_structp pp, png_infop pi)
    * turning on interlace handling (if do_interlace is not set.)
    */
   dp->npasses = npasses_from_interlace_type(pp, dp->interlace_type);
-   if (!dp->do_interlace && dp->npasses != png_set_interlace_handling(pp))
-      png_error(pp, "validate: file changed interlace type");
+   if (!dp->do_interlace)
+   {
+#     ifdef PNG_READ_INTERLACING_SUPPORTED
+         if (dp->npasses != png_set_interlace_handling(pp))
+            png_error(pp, "validate: file changed interlace type");
+#     else /* !READ_INTERLACING */
+         /* This should never happen: the relevant tests (!do_interlace) should
+          * not be run.
+          */
+         if (dp->npasses > 1)
+            png_error(pp, "validate: no libpng interlace support");
+#     endif /* !READ_INTERLACING */
+   }

   /* Caller calls png_read_update_info or png_start_read_image now, then calls
    * part2.
@@ -4885,7 +4970,7 @@ progressive_row(png_structp ppIn, png_bytep new_row, png_uint_32 y, int pass)

         if (pass != png_get_current_pass_number(pp))
            png_error(pp, "png_get_current_pass_number is broken");
-#endif
+#endif /* USER_TRANSFORM_INFO */

         y = PNG_ROW_FROM_PASS_ROW(y, pass);
      }
@@ -4897,19 +4982,20 @@ progressive_row(png_structp ppIn, png_bytep new_row, png_uint_32 y, int pass)
      row = store_image_row(dp->ps, pp, 0, y);

      /* Combine the new row into the old: */
-#ifdef PNG_READ_DEINTERLACE_SUPPORTED
+#ifdef PNG_READ_INTERLACING_SUPPORTED
      if (dp->do_interlace)
-#endif
+#endif /* READ_INTERLACING */
      {
         if (dp->interlace_type == PNG_INTERLACE_ADAM7)
-            deinterlace_row(row, new_row, dp->pixel_size, dp->w, pass);
+            deinterlace_row(row, new_row, dp->pixel_size, dp->w, pass,
+                  dp->littleendian);
         else
-            row_copy(row, new_row, dp->pixel_size * dp->w);
+            row_copy(row, new_row, dp->pixel_size * dp->w, dp->littleendian);
      }
-#ifdef PNG_READ_DEINTERLACE_SUPPORTED
+#ifdef PNG_READ_INTERLACING_SUPPORTED
      else
         png_progressive_combine_row(pp, row, new_row);
-#endif /* PNG_READ_DEINTERLACE_SUPPORTED */
+#endif /* PNG_READ_INTERLACING_SUPPORTED */
   }

   else if (dp->interlace_type == PNG_INTERLACE_ADAM7 &&
@@ -4962,11 +5048,11 @@ sequential_row(standard_display *dp, png_structp pp, png_infop pi,

               if (iImage >= 0)
                  deinterlace_row(store_image_row(ps, pp, iImage, y), row,
-                     dp->pixel_size, dp->w, pass);
+                     dp->pixel_size, dp->w, pass, dp->littleendian);

               if (iDisplay >= 0)
                  deinterlace_row(store_image_row(ps, pp, iDisplay, y), display,
-                     dp->pixel_size, dp->w, pass);
+                     dp->pixel_size, dp->w, pass, dp->littleendian);
            }
         }
         else
@@ -5130,7 +5216,7 @@ standard_row_validate(standard_display *dp, png_const_structp pp,
         dp->bit_width)) != 0)
   {
      char msg[64];
-      sprintf(msg, "display  row[%lu][%d] changed from %.2x to %.2x",
+      sprintf(msg, "display row[%lu][%d] changed from %.2x to %.2x",
         (unsigned long)y, where-1, std[where-1],
         store_image_row(dp->ps, pp, iDisplay, y)[where-1]);
      png_error(pp, msg);
@@ -5274,7 +5360,7 @@ test_standard(png_modifier* const pm, png_byte const colour_type,
           interlace_type < INTERLACE_LAST; ++interlace_type)
      {
         standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/,
-            interlace_type, 0, 0, 0), 0/*do_interlace*/, pm->use_update_info);
+            interlace_type, 0, 0, 0), do_read_interlace, pm->use_update_info);

         if (fail(pm))
            return 0;
@@ -5380,7 +5466,7 @@ test_size(png_modifier* const pm, png_byte const colour_type,

      for (h=1; h<=16; h+=hinc[bdlo]) for (w=1; w<=16; w+=winc[bdlo])
      {
-#     ifdef PNG_READ_DEINTERLACE_SUPPORTED
+#     ifdef PNG_READ_INTERLACING_SUPPORTED
         /* Test with pngvalid generated interlaced images first; we have
          * already verify these are ok (unless pngvalid has self-consistent
          * read/write errors, which is unlikely), so this detects errors in the
@@ -5394,7 +5480,7 @@ test_size(png_modifier* const pm, png_byte const colour_type,
         if (fail(pm))
            return 0;
 #     endif
-#     endif /* READ_DEINTERLACE */
+#     endif /* READ_INTERLACING */

 #     ifdef PNG_WRITE_INTERLACING_SUPPORTED
         /* Test the libpng write side against the pngvalid read side: */
@@ -5406,7 +5492,7 @@ test_size(png_modifier* const pm, png_byte const colour_type,
            return 0;
 #     endif

-#     ifdef PNG_READ_DEINTERLACE_SUPPORTED
+#     ifdef PNG_READ_INTERLACING_SUPPORTED
 #     ifdef PNG_WRITE_INTERLACING_SUPPORTED
         /* Test both together: */
         standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/,
@@ -5416,7 +5502,7 @@ test_size(png_modifier* const pm, png_byte const colour_type,
         if (fail(pm))
            return 0;
 #     endif
-#     endif /* READ_DEINTERLACE */
+#     endif /* READ_INTERLACING */
      }
   }

@@ -5803,6 +5889,7 @@ typedef struct transform_display
   /* Parameters */
   png_modifier*              pm;
   const image_transform* transform_list;
+   unsigned int max_gamma_8;

   /* Local variables */
   png_byte output_colour_type;
@@ -5979,12 +6066,13 @@ transform_display_init(transform_display *dp, png_modifier *pm, png_uint_32 id,
   memset(dp, 0, sizeof *dp);

   /* Standard fields */
-   standard_display_init(&dp->this, &pm->this, id, 0/*do_interlace*/,
+   standard_display_init(&dp->this, &pm->this, id, do_read_interlace,
      pm->use_update_info);

   /* Parameter fields */
   dp->pm = pm;
   dp->transform_list = transform_list;
+   dp->max_gamma_8 = 16;

   /* Local variable fields */
   dp->output_colour_type = 255; /* invalid */
@@ -6848,6 +6936,10 @@ image_transform_png_set_scale_16_set(const image_transform *this,
    transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_scale_16(pp);
+#  if PNG_LIBPNG_VER < 10700
+      /* libpng will limit the gamma table size: */
+      that->max_gamma_8 = PNG_MAX_GAMMA_8;
+#  endif
   this->next->set(this->next, that, pp, pi);
 }

@@ -6892,6 +6984,10 @@ image_transform_png_set_strip_16_set(const image_transform *this,
    transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_strip_16(pp);
+#  if PNG_LIBPNG_VER < 10700
+      /* libpng will limit the gamma table size: */
+      that->max_gamma_8 = PNG_MAX_GAMMA_8;
+#  endif
   this->next->set(this->next, that, pp, pi);
 }

@@ -7158,14 +7254,15 @@ image_transform_png_set_rgb_to_gray_ini(const image_transform *this,
          *  conversion adds another +/-2 in the 16-bit case and
          *  +/-(1<<(15-PNG_MAX_GAMMA_8)) in the 8-bit case.
          */
-         that->pm->limit += (pow)(
-#           if PNG_MAX_GAMMA_8 < 14
-               (that->this.bit_depth == 16 ? 8. :
-                  6. + (1<<(15-PNG_MAX_GAMMA_8)))
-#           else
-               8.
-#           endif
-               /65535, data.gamma);
+#        if PNG_LIBPNG_VER < 10700
+            if (that->this.bit_depth < 16)
+               that->max_gamma_8 = PNG_MAX_GAMMA_8;
+#        endif
+         that->pm->limit += pow(
+            (that->this.bit_depth == 16 || that->max_gamma_8 > 14 ?
+               8. :
+               6. + (1<<(15-that->max_gamma_8))
+            )/65535, data.gamma);
      }

      else
@@ -7182,7 +7279,7 @@ image_transform_png_set_rgb_to_gray_ini(const image_transform *this,
          * affects the limit used for checking for internal calculation errors,
          * not the actual limit imposed by pngvalid on the output errors.
          */
-         that->pm->limit += (pow)(
+         that->pm->limit += pow(
 #        if DIGITIZE
            1.3
 #        else
@@ -7350,9 +7447,12 @@ image_transform_png_set_rgb_to_gray_mod(const image_transform *this,
         const unsigned int sample_depth = that->sample_depth;
         const unsigned int calc_depth = (pm->assume_16_bit_calculations ? 16 :
            sample_depth);
-         const unsigned int gamma_depth = (sample_depth == 16 ?
-            PNG_MAX_GAMMA_8 :
-            (pm->assume_16_bit_calculations ? PNG_MAX_GAMMA_8 : sample_depth));
+         const unsigned int gamma_depth =
+            (sample_depth == 16 ?
+               display->max_gamma_8 :
+               (pm->assume_16_bit_calculations ?
+                  display->max_gamma_8 :
+                  sample_depth));
         int isgray;
         double r, g, b;
         double rlo, rhi, glo, ghi, blo, bhi, graylo, grayhi;
@@ -7389,7 +7489,7 @@ image_transform_png_set_rgb_to_gray_mod(const image_transform *this,
         b = blo = bhi = that->bluef;
         blo -= that->bluee;
         blo = DD(blo, calc_depth, 1/*round*/);
-         bhi += that->greene;
+         bhi += that->bluee;
         bhi = DU(bhi, calc_depth, 1/*round*/);

         isgray = r==g && g==b;
@@ -7571,7 +7671,7 @@ image_transform_png_set_rgb_to_gray_mod(const image_transform *this,
            const png_modifier *pm = display->pm;
            double in_qe = (that->sample_depth > 8 ? .5/65535 : .5/255);
            double out_qe = (that->sample_depth > 8 ? .5/65535 :
-               (pm->assume_16_bit_calculations ? .5/(1<<PNG_MAX_GAMMA_8) :
+               (pm->assume_16_bit_calculations ? .5/(1<<display->max_gamma_8) :
               .5/255));
            double rhi, ghi, bhi, grayhi;
            double g1 = 1/data.gamma;
@@ -8219,6 +8319,7 @@ image_transform_png_set_packswap_set(const image_transform *this,
    transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_packswap(pp);
+   that->this.littleendian = 1;
   this->next->set(this->next, that, pp, pi);
 }

@@ -8669,7 +8770,7 @@ gamma_display_init(gamma_display *dp, png_modifier *pm, png_uint_32 id,
    double background_gamma)
 {
   /* Standard fields */
-   standard_display_init(&dp->this, &pm->this, id, 0/*do_interlace*/,
+   standard_display_init(&dp->this, &pm->this, id, do_read_interlace,
      pm->use_update_info);

   /* Parameter fields */
@@ -8701,7 +8802,7 @@ gamma_info_imp(gamma_display *dp, png_structp pp, png_infop pi)
   /* If requested strip 16 to 8 bits - this is handled automagically below
    * because the output bit depth is read from the library.  Note that there
    * are interactions with sBIT but, internally, libpng makes sbit at most
-    * PNG_MAX_GAMMA_8 when doing the following.
+    * PNG_MAX_GAMMA_8 prior to 1.7 when doing the following.
    */
   if (dp->scale16)
 #     ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
@@ -10142,7 +10243,11 @@ static void perform_gamma_scale16_tests(png_modifier *pm)
 #  ifndef PNG_MAX_GAMMA_8
 #     define PNG_MAX_GAMMA_8 11
 #  endif
-#  define SBIT_16_TO_8 PNG_MAX_GAMMA_8
+#  if defined PNG_MAX_GAMMA_8 || PNG_LIBPNG_VER < 10700
+#     define SBIT_16_TO_8 PNG_MAX_GAMMA_8
+#  else
+#     define SBIT_16_TO_8 16
+#  endif
   /* Include the alpha cases here. Note that sbit matches the internal value
    * used by the library - otherwise we will get spurious errors from the
    * internal sbit style approximation.
@@ -10960,13 +11065,11 @@ static const color_encoding test_encodings[] =
 /*red:  */ { 0.716500716779386, 0.258728243040113, 0.000000000000000 },
 /*green:*/ { 0.101020574397477, 0.724682314948566, 0.051211818965388 },
 /*blue: */ { 0.146774385252705, 0.016589442011321, 0.773892783545073} },
-#if PNG_LIBPNG_VER >= 10700
 /* Fake encoding which selects just the green channel */
 /*gamma:*/ { 1.45/2.2, /* the 'Mac' gamma */
 /*red:  */ { 0.716500716779386, 0.000000000000000, 0.000000000000000 },
 /*green:*/ { 0.101020574397477, 1.000000000000000, 0.051211818965388 },
 /*blue: */ { 0.146774385252705, 0.000000000000000, 0.773892783545073} },
-#endif
 };

 /* signal handler
@@ -11157,7 +11260,11 @@ int main(int argc, char **argv)
   pm.maxout16 = .499;  /* Error in *encoded* value */
   pm.maxabs16 = .00005;/* 1/20000 */
   pm.maxcalc16 =1./65535;/* +/-1 in 16 bits for compose errors */
-   pm.maxcalcG = 1./((1<<PNG_MAX_GAMMA_8)-1);
+#  if PNG_LIBPNG_VER < 10700
+      pm.maxcalcG = 1./((1<<PNG_MAX_GAMMA_8)-1);
+#  else
+      pm.maxcalcG = 1./((1<<16)-1);
+#  endif

   /* NOTE: this is a reasonable perceptual limit. We assume that humans can
    * perceive light level differences of 1% over a 100:1 range, so we need to
@@ -11323,10 +11430,10 @@ int main(int argc, char **argv)
      {
 #        if CAN_WRITE_INTERLACE
            pm.interlace_type = PNG_INTERLACE_ADAM7;
-#        else
+#        else /* !CAN_WRITE_INTERLACE */
            fprintf(stderr, "pngvalid: no write interlace support\n");
            return SKIP;
-#        endif
+#        endif /* !CAN_WRITE_INTERLACE */
      }

      else if (strcmp(*argv, "--use-input-precision") == 0)
--- a/contrib/libtests/readpng.c
+++ b/contrib/libtests/readpng.c
@@ -31,13 +31,6 @@
 #  include "../../png.h"
 #endif

-#if PNG_LIBPNG_VER < 10700
-   /* READ_INTERLACING was used instead of READ_DEINTERLACE. */
-#  ifdef PNG_READ_INTERLACING_SUPPORTED
-#     define PNG_READ_DEINTERLACE_SUPPORTED
-#  endif
-#endif
-
 static int
 read_png(FILE *fp)
 {
@@ -69,6 +62,7 @@ read_png(FILE *fp)
   {
      png_size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr);

+      /* Failure to initialize these is harmless */
      row = malloc(rowbytes);
      display = malloc(rowbytes);

@@ -77,12 +71,12 @@ read_png(FILE *fp)

      {
         png_uint_32 height = png_get_image_height(png_ptr, info_ptr);
-#        ifdef PNG_READ_DEINTERLACE_SUPPORTED
+#        ifdef PNG_READ_INTERLACING_SUPPORTED
            int passes = png_set_interlace_handling(png_ptr);
-#        else
-            int passes = png_get_interlace_type(png_ptr, info_ptr) == 
+#        else /* !READ_INTERLACING */
+            int passes = png_get_interlace_type(png_ptr, info_ptr) ==
               PNG_INTERLACE_ADAM7 ? PNG_INTERLACE_ADAM7_PASSES : 1;
-#        endif
+#        endif /* !READ_INTERLACING */
         int pass;

         png_start_read_image(png_ptr);
@@ -91,10 +85,10 @@ read_png(FILE *fp)
         {
            png_uint_32 y = height;

-#           ifndef PNG_READ_DEINTERLACE_SUPPORTED
+#           ifndef PNG_READ_INTERLACING_SUPPORTED
               if (passes == PNG_INTERLACE_ADAM7_PASSES)
                  y = PNG_PASS_ROWS(y, pass);
-#           endif
+#           endif /* READ_INTERLACING */

            /* NOTE: this trashes the row each time; interlace handling won't
             * work, but this avoids memory thrashing for speed testing.
--- a/contrib/tools/genpng.c
+++ b/contrib/tools/genpng.c
@@ -324,7 +324,7 @@ alpha_calc(const struct arg *arg, double x, double y)
               {
                  double wx = bicubic[abs(dx)][0];

-                  if (wx != 0 && arg->inside_fn(arg, x+dx/16, y+dy/16)) 
+                  if (wx != 0 && arg->inside_fn(arg, x+dx/16, y+dy/16))
                     alphay += wx;
               }

@@ -565,7 +565,7 @@ line_check(double x, double y, double x1, double y1, double x2, double y2,
   /* The dot product is the distance down the line, the cross product is
    * the distance away from the line:
    *
-    *    distance = |cross| / sqrt(len2) 
+    *    distance = |cross| / sqrt(len2)
    */
   cross = x * ly - y * lx;

@@ -722,7 +722,7 @@ pixel(png_uint_16p p, struct arg *args, int nargs, double x, double y)
   /* 'a' may be negative or greater than 1; if it is, negative clamp the
    * pixel to 0 if >1 clamp r/g/b:
    */
-   if (a > 0) 
+   if (a > 0)
   {
      if (a > 1)
      {
--- a/contrib/tools/png-fix-itxt.c
+++ b/contrib/tools/png-fix-itxt.c
@@ -8,7 +8,7 @@
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
 *
- * Usage:            
+ * Usage:
 *
 *     png-fix-itxt.exe < bad.png > good.png
 *
--- a/contrib/tools/pngfix.c
+++ b/contrib/tools/pngfix.c
@@ -2,7 +2,7 @@
 *
 * Copyright (c) 2014-2015 John Cunningham Bowler
 *
- * Last changed in libpng 1.6.18 [July 23, 2015]
+ * Last changed in libpng 1.6.20 [December 3, 2015]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -2221,7 +2221,7 @@ zlib_init(struct zlib *zlib, struct IDAT *idat, struct chunk *chunk,
   /* These values are sticky across reset (in addition to the stuff in the
    * first block, which is actually constant.)
    */
-   zlib->file_bits = 16;
+   zlib->file_bits = 24;
   zlib->ok_bits = 16; /* unset */
   zlib->cksum = 0; /* set when a checksum error is detected */

@@ -2304,10 +2304,12 @@ zlib_advance(struct zlib *zlib, png_uint_32 nbytes)
               zlib->file_bits = file_bits;

               /* Check against the existing value - it may not need to be
-                * changed.
+                * changed.  Note that a bogus file_bits is allowed through once,
+                * to see if it works, but the window_bits value is set to 15,
+                * the maximum.
                */
               if (new_bits == 0) /* no change */
-                  zlib->window_bits = file_bits;
+                  zlib->window_bits = ((file_bits > 15) ? 15 : file_bits);

               else if (new_bits != file_bits) /* rewrite required */
                  bIn = (png_byte)((bIn & 0xf) + ((new_bits-8) << 4));
@@ -2328,8 +2330,7 @@ zlib_advance(struct zlib *zlib, png_uint_32 nbytes)
               if (bIn != b2)
               {
                  /* If the first byte wasn't changed this indicates an error in
-                   * the checksum calculation; signal this by setting file_bits
-                   * (not window_bits) to 0.
+                   * the checksum calculation; signal this by setting 'cksum'.
                   */
                  if (zlib->file_bits == zlib->window_bits)
                     zlib->cksum = 1;
--- a/libpng-manual.txt
+++ b/libpng-manual.txt
@@ -1,6 +1,6 @@
 libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.6.19rc03 - November 3, 2015
+ libpng version 1.6.20 - December 3, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2015 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.6.19rc03 - November 3, 2015
+ libpng versions 0.97, January 1998, through 1.6.20 - December 3, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2015 Glenn Randers-Pehrson

@@ -2960,6 +2960,7 @@ width, height, bit_depth, and color_type must be the same in each call.
                     (array of png_color)
    num_palette    - number of entries in the palette

+
    png_set_gAMA(png_ptr, info_ptr, file_gamma);
    png_set_gAMA_fixed(png_ptr, info_ptr, int_file_gamma);

@@ -4897,7 +4898,7 @@ a set of "safe" limits is applied in pngpriv.h.  These can be overridden by
 application calls to png_set_user_limits(), png_set_user_chunk_cache_max(),
 and/or png_set_user_malloc_max() that increase or decrease the limits.  Also,
 in libpng-1.5.10 the default width and height limits were increased
-from 1,000,000 to 0x7ffffff (i.e., made unlimited).  Therefore, the
+from 1,000,000 to 0x7fffffff (i.e., made unlimited).  Therefore, the
 limits are now
                               default      safe
   png_user_width_max        0x7fffffff    1,000,000
@@ -5319,13 +5320,11 @@ Other rules can be inferred by inspecting the libpng source.

 XVI. Y2K Compliance in libpng

-November 3, 2015
-
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.6.19rc03 are Y2K compliant.  It is my belief that earlier
+upward through 1.6.20 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
--- a/libpng.3
+++ b/libpng.3
@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "November 3, 2015"
+.TH LIBPNG 3 "December 3, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.19rc03
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.20
 .SH SYNOPSIS
 \fB
 #include <png.h>\fP
@@ -508,7 +508,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.6.19rc03 - November 3, 2015
+ libpng version 1.6.20 - December 3, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2015 Glenn Randers-Pehrson
@@ -519,7 +519,7 @@ libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.6.19rc03 - November 3, 2015
+ libpng versions 0.97, January 1998, through 1.6.20 - December 3, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2015 Glenn Randers-Pehrson

@@ -3468,6 +3468,7 @@ width, height, bit_depth, and color_type must be the same in each call.
                     (array of png_color)
    num_palette    - number of entries in the palette

+
    png_set_gAMA(png_ptr, info_ptr, file_gamma);
    png_set_gAMA_fixed(png_ptr, info_ptr, int_file_gamma);

@@ -5405,7 +5406,7 @@ a set of "safe" limits is applied in pngpriv.h.  These can be overridden by
 application calls to png_set_user_limits(), png_set_user_chunk_cache_max(),
 and/or png_set_user_malloc_max() that increase or decrease the limits.  Also,
 in libpng-1.5.10 the default width and height limits were increased
-from 1,000,000 to 0x7ffffff (i.e., made unlimited).  Therefore, the
+from 1,000,000 to 0x7fffffff (i.e., made unlimited).  Therefore, the
 limits are now
                               default      safe
   png_user_width_max        0x7fffffff    1,000,000
@@ -5827,13 +5828,11 @@ Other rules can be inferred by inspecting the libpng source.

 .SH XVI. Y2K Compliance in libpng

-November 3, 2015
-
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.6.19rc03 are Y2K compliant.  It is my belief that earlier
+upward through 1.6.20 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -5935,8 +5934,7 @@ the first widely used release:
 ...
 1.5.23                  15    10523  15.so.15.23[.0]
 ...
- 1.6.19beta01-04         16    10619  16.so.16.19[.0]
- 1.6.19rc01-03           16    10619  16.so.16.19[.0]
+ 1.6.20                  16    10620  16.so.16.20[.0]

 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -5992,7 +5990,7 @@ possible without all of you.

 Thanks to Frank J. T. Wojcik for helping with the documentation.

-Libpng version 1.6.19rc03 - November 3, 2015:
+Libpng version 1.6.20 - December 3, 2015:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).

@@ -6017,7 +6015,7 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.0.7, July 1, 2000, through 1.6.19rc03, November 3, 2015, are
+libpng versions 1.0.7, July 1, 2000, through 1.6.20, December 3, 2015, are
 Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -6116,7 +6114,7 @@ the additional disclaimers inserted at version 1.0.7.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 3, 2015
+December 3, 2015

 .\" end of man page

--- a/libpngpf.3
+++ b/libpngpf.3
@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "November 3, 2015"
+.TH LIBPNGPF 3 "December 3, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.19rc03
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.20
 (private functions)
 .SH SYNOPSIS
 \fB#include \fI"pngpriv.h"
--- a/png.5
+++ b/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "November 3, 2015"
+.TH PNG 5 "December 3, 2015"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
--- a/png.c
+++ b/png.c
@@ -1,7 +1,7 @@

 /* png.c - location for general purpose libpng functions
 *
- * Last changed in libpng 1.6.19 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.19 [November 12, 2015]
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -14,7 +14,7 @@
 #include "pngpriv.h"

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_19rc03 Your_png_h_is_not_version_1_6_19rc03;
+typedef png_libpng_version_1_6_20 Your_png_h_is_not_version_1_6_20;

 /* Tells libpng that we have already handled the first "num_bytes" bytes
 * of the PNG file signature.  If the PNG data is embedded into another
@@ -775,13 +775,13 @@ png_get_copyright(png_const_structrp png_ptr)
 #else
 #  ifdef __STDC__
   return PNG_STRING_NEWLINE \
-      "libpng version 1.6.19rc03 - November 3, 2015" PNG_STRING_NEWLINE \
+      "libpng version 1.6.20 - December 3, 2015" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE;
 #  else
-   return "libpng version 1.6.19rc03 - November 3, 2015\
+   return "libpng version 1.6.20 - December 3, 2015\
      Copyright (c) 1998-2015 Glenn Randers-Pehrson\
      Copyright (c) 1996-1997 Andreas Dilger\
      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
@@ -2343,7 +2343,7 @@ png_compare_ICC_profile_with_sRGB(png_const_structrp png_ptr,
          * Fall through to "no match".
          */
         png_chunk_report(png_ptr,
-             "Not recognizing known sRGB profile that has been edited", 
+             "Not recognizing known sRGB profile that has been edited",
             PNG_CHUNK_WARNING);
         break;
 # endif
--- a/png.h
+++ b/png.h
@@ -1,7 +1,7 @@

 /* png.h - header file for PNG reference library
 *
- * libpng version 1.6.19rc03, November 3, 2015
+ * libpng version 1.6.20, December 3, 2015
 *
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -12,7 +12,8 @@
 * Authors and maintainers:
 *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
 *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.6.19rc03, November 3, 2015: Glenn
+ *   libpng versions 0.97, January 1998, through 1.6.20, December 3, 2015:
+ *     Glenn Randers-Pehrson.
 *   See also "Contributing Authors", below.
 */

@@ -24,7 +25,7 @@
 *
 * This code is released under the libpng license.
 *
- * libpng versions 1.0.7, July 1, 2000, through 1.6.19rc03, November 3, 2015, are
+ * libpng versions 1.0.7, July 1, 2000, through 1.6.20, December 3, 2015, are
 * Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
 * derived from libpng-1.0.6, and are distributed according to the same
 * disclaimer and license as libpng-1.0.6 with the following individuals
@@ -185,8 +186,7 @@
 *    ...
 *    1.5.23                  15    10523  15.so.15.23[.0]
 *    ...
- *    1.6.19beta01-04         16    10619  16.so.16.19[.0]
- *    1.6.19rc01-03           16    10619  16.so.16.19[.0]
+ *    1.6.20                  16    10620  16.so.16.20[.0]
 *
 *    Henceforth the source version will match the shared-library major
 *    and minor numbers; the shared-library major version number will be
@@ -214,13 +214,13 @@
 * Y2K compliance in libpng:
 * =========================
 *
- *    November 3, 2015
+ *    December 3, 2015
 *
 *    Since the PNG Development group is an ad-hoc body, we can't make
 *    an official declaration.
 *
 *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.6.19rc03 are Y2K compliant.  It is my belief that
+ *    upward through 1.6.20 are Y2K compliant.  It is my belief that
 *    earlier versions were also Y2K compliant.
 *
 *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -282,9 +282,9 @@
 */

 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.6.19rc03"
+#define PNG_LIBPNG_VER_STRING "1.6.20"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.6.19rc03 - November 3, 2015\n"
+     " libpng version 1.6.20 - December 3, 2015\n"

 #define PNG_LIBPNG_VER_SONUM   16
 #define PNG_LIBPNG_VER_DLLNUM  16
@@ -292,13 +292,13 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   6
-#define PNG_LIBPNG_VER_RELEASE 19
+#define PNG_LIBPNG_VER_RELEASE 20

 /* This should match the numeric part of the final component of
 * PNG_LIBPNG_VER_STRING, omitting any leading zero:
 */

-#define PNG_LIBPNG_VER_BUILD  03
+#define PNG_LIBPNG_VER_BUILD  0

 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -315,7 +315,7 @@
 #define PNG_LIBPNG_BUILD_SPECIAL 32 /* Cannot be OR'ed with
                                       PNG_LIBPNG_BUILD_PRIVATE */

-#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_RC
+#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE

 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
 * We must not include leading zeros.
@@ -323,7 +323,7 @@
 * version 1.0.0 was mis-numbered 100 instead of 10000).  From
 * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
 */
-#define PNG_LIBPNG_VER 10619 /* 1.6.19 */
+#define PNG_LIBPNG_VER 10620 /* 1.6.20 */

 /* Library configuration: these options cannot be changed after
 * the library has been built.
@@ -433,7 +433,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
 * do not agree upon the version number.
 */
-typedef char* png_libpng_version_1_6_19rc03;
+typedef char* png_libpng_version_1_6_20;

 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
 *
--- a/pngconf.h
+++ b/pngconf.h
@@ -1,7 +1,7 @@

 /* pngconf.h - machine configurable file for libpng
 *
- * libpng version 1.6.19rc03, July 23, 2015
+ * libpng version 1.6.20, December 3, 2015
 *
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
--- a/pngerror.c
+++ b/pngerror.c
@@ -768,7 +768,7 @@ png_longjmp,(png_const_structrp png_ptr, int val),PNG_NORETURN)

   /* If control reaches this point, png_longjmp() must not return. The only
    * choice is to terminate the whole process (or maybe the thread); to do
-    * this the ANSI-C abort() function is used unless a different method is 
+    * this the ANSI-C abort() function is used unless a different method is
    * implemented by overriding the default configuration setting for
    * PNG_ABORT().
    */
--- a/pnginfo.h
+++ b/pnginfo.h
@@ -223,7 +223,7 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
   /* Storage for unknown chunks that the library doesn't recognize. */
   png_unknown_chunkp unknown_chunks;

-   /* The type of this field is limited by the type of 
+   /* The type of this field is limited by the type of
    * png_struct::user_chunk_cache_max, else overflow can occur.
    */
   int                unknown_chunks_num;
--- a/pngpread.c
+++ b/pngpread.c
@@ -133,7 +133,7 @@ png_process_some_data(png_structrp png_ptr, png_inforp info_ptr)
 void /* PRIVATE */
 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr)
 {
-   png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ 
+   png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */
       num_to_check = 8 - num_checked;

   if (png_ptr->buffer_size < num_to_check)
@@ -662,7 +662,7 @@ png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer,
       * change the current behavior (see comments in inflate.c
       * for why this doesn't happen at present with zlib 1.2.5).
       */
-      ret = inflate(&png_ptr->zstream, Z_SYNC_FLUSH);
+      ret = PNG_INFLATE(png_ptr, Z_SYNC_FLUSH);

      /* Check for any failure before proceeding. */
      if (ret != Z_OK && ret != Z_STREAM_END)
--- a/pngpriv.h
+++ b/pngpriv.h
@@ -1215,6 +1215,14 @@ PNG_INTERNAL_FUNCTION(void,png_read_finish_row,(png_structrp png_ptr),
 /* Initialize the row buffers, etc. */
 PNG_INTERNAL_FUNCTION(void,png_read_start_row,(png_structrp png_ptr),PNG_EMPTY);

+#if PNG_ZLIB_VERNUM >= 0x1240
+PNG_INTERNAL_FUNCTION(int,png_zlib_inflate,(png_structrp png_ptr, int flush),
+      PNG_EMPTY);
+#  define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush)
+#else /* Zlib < 1.2.4 */
+#  define PNG_INFLATE(pp, flush) inflate(&(pp)->zstream, flush)
+#endif /* Zlib < 1.2.4 */
+
 #ifdef PNG_READ_TRANSFORMS_SUPPORTED
 /* Optional call to update the users info structure */
 PNG_INTERNAL_FUNCTION(void,png_read_transform_info,(png_structrp png_ptr,
--- a/pngread.c
+++ b/pngread.c
@@ -2838,7 +2838,6 @@ png_image_read_colormap(png_voidp argument)
      default:
         png_error(png_ptr, "invalid PNG color type");
         /*NOT REACHED*/
-         break;
   }

   /* Now deal with the output processing */
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -1,7 +1,7 @@

 /* pngrtran.c - transforms the data in a row for PNG readers
 *
- * Last changed in libpng 1.6.19 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.19 [November 12, 2015]
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,7 +1,7 @@

 /* pngrutil.c - utilities to read a PNG file
 *
- * Last changed in libpng 1.6.19 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.20 [December 3, 2015]
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -377,10 +377,16 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)

      if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & 3) ==
          PNG_OPTION_ON)
+      {
         window_bits = 15;
+         png_ptr->zstream_start = 0; /* fixed window size */
+      }

      else
+      {
         window_bits = 0;
+         png_ptr->zstream_start = 1;
+      }
 # else
 #   define window_bits 0
 # endif
@@ -429,6 +435,31 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
 #endif
 }

+#if PNG_ZLIB_VERNUM >= 0x1240
+/* Handle the start of the inflate stream if we called inflateInit2(strm,0);
+ * in this case some zlib versions skip validation of the CINFO field and, in
+ * certain circumstances, libpng may end up displaying an invalid image, in
+ * contrast to implementations that call zlib in the normal way (e.g. libpng
+ * 1.5).
+ */
+int /* PRIVATE */
+png_zlib_inflate(png_structrp png_ptr, int flush)
+{
+   if (png_ptr->zstream_start && png_ptr->zstream.avail_in > 0)
+   {
+      if ((*png_ptr->zstream.next_in >> 4) > 7)
+      {
+         png_ptr->zstream.msg = "invalid window size (libpng)";
+         return Z_DATA_ERROR;
+      }
+
+      png_ptr->zstream_start = 0;
+   }
+
+   return inflate(&png_ptr->zstream, flush);
+}
+#endif /* Zlib >= 1.2.4 */
+
 #ifdef PNG_READ_COMPRESSED_TEXT_SUPPORTED
 /* png_inflate now returns zlib error codes including Z_OK and Z_STREAM_END to
 * allow the caller to do multiple calls if required.  If the 'finish' flag is
@@ -522,7 +553,7 @@ png_inflate(png_structrp png_ptr, png_uint_32 owner, int finish,
          * the previous chunk of input data.  Tell zlib if we have reached the
          * end of the output buffer.
          */
-         ret = inflate(&png_ptr->zstream, avail_out > 0 ? Z_NO_FLUSH :
+         ret = PNG_INFLATE(png_ptr, avail_out > 0 ? Z_NO_FLUSH :
             (finish ? Z_FINISH : Z_SYNC_FLUSH));
      } while (ret == Z_OK);

@@ -771,7 +802,7 @@ png_inflate_read(png_structrp png_ptr, png_bytep read_buffer, uInt read_size,
          * the available output is produced; this allows reading of truncated
          * streams.
          */
-         ret = inflate(&png_ptr->zstream,
+         ret = PNG_INFLATE(png_ptr,
            *chunk_bytes > 0 ? Z_NO_FLUSH : (finish ? Z_FINISH : Z_SYNC_FLUSH));
      }
      while (ret == Z_OK && (*out_size > 0 || png_ptr->zstream.avail_out > 0));
@@ -930,18 +961,21 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
      return;
   }

-   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
-      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
-
   /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */
   num = (int)length / 3;

-   /* If the palette has 256 or fewer entries but is too large for the bit depth,
-    * we don't issue an error, to preserve the behavior of previous libpng versions.
-    * We silently truncate the unused extra palette entries here.
+   /* If the palette has 256 or fewer entries but is too large for the bit
+    * depth, we don't issue an error, to preserve the behavior of previous
+    * libpng versions. We silently truncate the unused extra palette entries
+    * here.
    */
+   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
+      max_palette_length = (1 << png_ptr->bit_depth);
+   else
+      max_palette_length = PNG_MAX_PALETTE_LENGTH;
+
   if (num > max_palette_length)
-     num = max_palette_length;
+      num = max_palette_length;

 #ifdef PNG_POINTER_INDEXING_SUPPORTED
   for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
@@ -975,7 +1009,7 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
 #endif
   {
-      png_crc_finish(png_ptr, 0);
+      png_crc_finish(png_ptr, (int) length - num * 3);
   }

 #ifndef PNG_READ_OPT_PLTE_SUPPORTED
@@ -1667,7 +1701,7 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
   ++entry_start;

   /* A sample depth should follow the separator, and we should be on it  */
-   if (entry_start > buffer + length - 2)
+   if (length < 2U || entry_start > buffer + (length - 2U))
   {
      png_warning(png_ptr, "malformed sPLT chunk");
      return;
@@ -2171,7 +2205,7 @@ png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
   /* We need to have at least 12 bytes after the purpose string
    * in order to get the parameter information.
    */
-   if (endptr <= buf + 12)
+   if (endptr - buf <= 12)
   {
      png_chunk_benign_error(png_ptr, "invalid");
      return;
@@ -4036,7 +4070,7 @@ png_read_IDAT_data(png_structrp png_ptr, png_bytep output,
       *
       * TODO: deal more elegantly with truncated IDAT lists.
       */
-      ret = inflate(&png_ptr->zstream, Z_NO_FLUSH);
+      ret = PNG_INFLATE(png_ptr, Z_NO_FLUSH);

      /* Take the unconsumed output back. */
      if (output != NULL)
--- a/pngset.c
+++ b/pngset.c
@@ -1,7 +1,7 @@

 /* pngset.c - storage of image information into info struct
 *
- * Last changed in libpng 1.6.19 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.19 [November 12, 2015]
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -520,8 +520,8 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
   if (png_ptr == NULL || info_ptr == NULL)
      return;

-   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
-      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
+   max_palette_length = (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
+      (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;

   if (num_palette < 0 || num_palette > (int) max_palette_length)
   {
@@ -1573,7 +1573,7 @@ png_set_user_limits (png_structrp png_ptr, png_uint_32 user_width_max,
 {
   /* Images with dimensions larger than these limits will be
    * rejected by png_set_IHDR().  To accept any PNG datastream
-    * regardless of dimensions, set both limits to 0x7ffffff.
+    * regardless of dimensions, set both limits to 0x7fffffff.
    */
   if (png_ptr == NULL)
      return;
--- a/pngstruct.h
+++ b/pngstruct.h
@@ -263,6 +263,9 @@ struct png_struct_def
                              /* pixel depth used for the row buffers */
   png_byte transformed_pixel_depth;
                              /* pixel depth after read/write transforms */
+#if PNG_ZLIB_VERNUM >= 0x1240
+   png_byte zstream_start;    /* at start of an input zlib stream */
+#endif /* Zlib >= 1.2.4 */
 #if defined(PNG_READ_FILLER_SUPPORTED) || defined(PNG_WRITE_FILLER_SUPPORTED)
   png_uint_16 filler;           /* filler bytes for pixel expansion */
 #endif
--- a/pngtest.c
+++ b/pngtest.c
@@ -1,7 +1,7 @@

 /* pngtest.c - a simple test program to test libpng
 *
- * Last changed in libpng 1.6.19 [(PENDING RELEASE)]
+ * Last changed in libpng 1.5.25 [December 3, 2015]
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -60,12 +60,12 @@
   defined PNG_READ_pHYs_SUPPORTED &&\
   defined PNG_READ_sBIT_SUPPORTED &&\
   defined PNG_READ_sCAL_SUPPORTED &&\
-   defined PNG_READ_sPLT_SUPPORTED &&\
   defined PNG_READ_sRGB_SUPPORTED &&\
+   defined PNG_READ_sPLT_SUPPORTED &&\
   defined PNG_READ_tEXt_SUPPORTED &&\
   defined PNG_READ_tIME_SUPPORTED &&\
   defined PNG_READ_zTXt_SUPPORTED &&\
-   defined PNG_WRITE_INTERLACING_SUPPORTED
+   (defined PNG_WRITE_INTERLACING_SUPPORTED || PNG_LIBPNG_VER >= 10700)

 #ifdef PNG_ZLIB_HEADER
 #  include PNG_ZLIB_HEADER /* defined by pnglibconf.h from 1.7 */
@@ -102,6 +102,10 @@ typedef FILE                * png_FILE_p;
 #  define SINGLE_ROWBUF_ALLOC  /* Makes buffer overruns easier to nail */
 #endif

+#ifndef PNG_UNUSED
+#  define PNG_UNUSED(param) (void)param;
+#endif
+
 /* Turn on CPU timing
 #define PNGTEST_TIMING
 */
@@ -119,6 +123,22 @@ static float t_start, t_stop, t_decode, t_encode, t_misc;
 #define PNG_tIME_STRING_LENGTH 29
 static int tIME_chunk_present = 0;
 static char tIME_string[PNG_tIME_STRING_LENGTH] = "tIME chunk is not present";
+
+#if PNG_LIBPNG_VER < 10619
+#define png_convert_to_rfc1123_buffer(ts, t) tIME_to_str(read_ptr, ts, t)
+
+static int
+tIME_to_str(png_structp png_ptr, png_charp ts, png_const_timep t)
+{
+    png_const_charp str = png_convert_to_rfc1123(png_ptr, t);
+
+    if (str == NULL)
+        return 0;
+
+    strcpy(ts, str);
+    return 1;
+}
+#endif /* older libpng */
 #endif

 static int verbose = 0;
@@ -186,16 +206,14 @@ write_row_callback(png_structp png_ptr, png_uint_32 row_number, int pass)


 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-/* Example of using user transform callback (we don't transform anything,
- * but merely examine the row filters.  We set this to 256 rather than
- * 5 in case illegal filter values are present.)
+/* Example of using a user transform callback (doesn't do anything at present).
 */
-static png_uint_32 filters_used[256];
 static void PNGCBAPI
-count_filters(png_structp png_ptr, png_row_infop row_info, png_bytep data)
+read_user_callback(png_structp png_ptr, png_row_infop row_info, png_bytep data)
 {
-   if (png_ptr != NULL && row_info != NULL)
-      ++filters_used[*(data - 1)];
+   PNG_UNUSED(png_ptr)
+   PNG_UNUSED(row_info)
+   PNG_UNUSED(data)
 }
 #endif

@@ -793,7 +811,7 @@ write_chunks(png_structp write_ptr, int location)
 */
 #ifdef PNG_TEXT_SUPPORTED
 static void
-pngtest_check_text_support(png_const_structp png_ptr, png_textp text_ptr,
+pngtest_check_text_support(png_structp png_ptr, png_textp text_ptr,
   int num_text)
 {
   while (num_text > 0)
@@ -806,6 +824,8 @@ pngtest_check_text_support(png_const_structp png_ptr, png_textp text_ptr,
         case PNG_TEXT_COMPRESSION_zTXt:
 #           ifndef PNG_WRITE_zTXt_SUPPORTED
               ++unsupported_chunks;
+               /* In libpng 1.7 this now does an app-error, so stop it: */
+               text_ptr[num_text].compression = PNG_TEXT_COMPRESSION_NONE;
 #           endif
            break;

@@ -813,6 +833,7 @@ pngtest_check_text_support(png_const_structp png_ptr, png_textp text_ptr,
         case PNG_ITXT_COMPRESSION_zTXt:
 #           ifndef PNG_WRITE_iTXt_SUPPORTED
               ++unsupported_chunks;
+               text_ptr[num_text].compression = PNG_TEXT_COMPRESSION_NONE;
 #           endif
            break;

@@ -839,16 +860,19 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   png_structp write_ptr;
   png_infop write_info_ptr;
   png_infop write_end_info_ptr;
+#ifdef PNG_WRITE_FILTER_SUPPORTED
   int interlace_preserved = 1;
-#else
+#endif /* WRITE_FILTER */
+#else /* !WRITE */
   png_structp write_ptr = NULL;
   png_infop write_info_ptr = NULL;
   png_infop write_end_info_ptr = NULL;
-#endif
+#endif /* !WRITE */
   png_bytep row_buf;
   png_uint_32 y;
   png_uint_32 width, height;
-   int num_pass = 1, pass;
+   volatile int num_passes;
+   int pass;
   int bit_depth, color_type;

   row_buf = NULL;
@@ -1001,14 +1025,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   }

 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-   {
-      int i;
-
-      for (i = 0; i<256; i++)
-         filters_used[i] = 0;
-
-      png_set_read_user_transform_fn(read_ptr, count_filters);
-   }
+   png_set_read_user_transform_fn(read_ptr, read_user_callback);
 #endif
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
   zero_samples = 0;
@@ -1055,29 +1072,28 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      {
         png_set_IHDR(write_ptr, write_info_ptr, width, height, bit_depth,
            color_type, interlace_type, compression_type, filter_type);
-#ifndef PNG_READ_INTERLACING_SUPPORTED
-         /* num_pass will not be set below, set it here if the image is
-          * interlaced: what happens is that write interlacing is *not* turned
-          * on and the partial interlaced rows are written directly.
+         /* num_passes may not be available below if interlace support is not
+          * provided by libpng for both read and write.
          */
         switch (interlace_type)
         {
            case PNG_INTERLACE_NONE:
-               num_pass = 1;
+               num_passes = 1;
               break;

            case PNG_INTERLACE_ADAM7:
-               num_pass = 7;
-                break;
+               num_passes = 7;
+               break;

            default:
-                png_error(read_ptr, "invalid interlace type");
-                /*NOT REACHED*/
+               png_error(read_ptr, "invalid interlace type");
+               /*NOT REACHED*/
         }
-#endif
      }
-   }

+      else
+         png_error(read_ptr, "png_get_IHDR failed");
+   }
 #ifdef PNG_FIXED_POINT_SUPPORTED
 #ifdef PNG_cHRM_SUPPORTED
   {
@@ -1092,7 +1108,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_gAMA_SUPPORTED
   {
      png_fixed_point gamma;
@@ -1126,7 +1141,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif
 #endif /* Floating point */
 #endif /* Fixed point */
-
 #ifdef PNG_iCCP_SUPPORTED
   {
      png_charp name;
@@ -1142,7 +1156,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_sRGB_SUPPORTED
   {
      int intent;
@@ -1151,7 +1164,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_sRGB(write_ptr, write_info_ptr, intent);
   }
 #endif
-
   {
      png_colorp palette;
      int num_palette;
@@ -1159,7 +1171,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      if (png_get_PLTE(read_ptr, read_info_ptr, &palette, &num_palette) != 0)
         png_set_PLTE(write_ptr, write_info_ptr, palette, num_palette);
   }
-
 #ifdef PNG_bKGD_SUPPORTED
   {
      png_color_16p background;
@@ -1170,7 +1181,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_hIST_SUPPORTED
   {
      png_uint_16p hist;
@@ -1179,7 +1189,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_hIST(write_ptr, write_info_ptr, hist);
   }
 #endif
-
 #ifdef PNG_oFFs_SUPPORTED
   {
      png_int_32 offset_x, offset_y;
@@ -1192,7 +1201,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_pCAL_SUPPORTED
   {
      png_charp purpose, units;
@@ -1208,7 +1216,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      }
   }
 #endif
-
 #ifdef PNG_pHYs_SUPPORTED
   {
      png_uint_32 res_x, res_y;
@@ -1219,7 +1226,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_pHYs(write_ptr, write_info_ptr, res_x, res_y, unit_type);
   }
 #endif
-
 #ifdef PNG_sBIT_SUPPORTED
   {
      png_color_8p sig_bit;
@@ -1228,7 +1234,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_sBIT(write_ptr, write_info_ptr, sig_bit);
   }
 #endif
-
 #ifdef PNG_sCAL_SUPPORTED
 #if defined(PNG_FLOATING_POINT_SUPPORTED) && \
   defined(PNG_FLOATING_ARITHMETIC_SUPPORTED)
@@ -1255,9 +1260,9 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
             scal_height);
      }
   }
-#endif /* FIXED_POINT */
-#endif /* FLOATING_POINT */
-#endif /* sCAL */
+#endif
+#endif
+#endif

 #ifdef PNG_sPLT_SUPPORTED
   {
@@ -1269,7 +1274,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
           png_set_sPLT(write_ptr, write_info_ptr, entries, num_entries);
       }
   }
-#endif /* sPLT */
+#endif

 #ifdef PNG_TEXT_SUPPORTED
   {
@@ -1297,8 +1302,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         png_set_text(write_ptr, write_info_ptr, text_ptr, num_text);
      }
   }
-#endif /* TEXT */
-
+#endif
 #ifdef PNG_tIME_SUPPORTED
   {
      png_timep mod_time;
@@ -1320,8 +1324,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif /* TIME_RFC1123 */
      }
   }
-#endif /* tIME */
-
+#endif
 #ifdef PNG_tRNS_SUPPORTED
   {
      png_bytep trans_alpha;
@@ -1343,8 +1346,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
               trans_color);
      }
   }
-#endif /* tRNS */
-
+#endif
 #ifdef PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED
   {
      png_unknown_chunkp unknowns;
@@ -1395,21 +1397,49 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif /* SINGLE_ROWBUF_ALLOC */
   pngtest_debug("Writing row data");

-#ifdef PNG_READ_INTERLACING_SUPPORTED
-   num_pass = png_set_interlace_handling(read_ptr);
-   if (png_set_interlace_handling(write_ptr) != num_pass)
-      png_error(write_ptr, "png_set_interlace_handling: inconsistent num_pass");
-#endif
+#if defined(PNG_READ_INTERLACING_SUPPORTED) &&\
+   defined(PNG_WRITE_INTERLACING_SUPPORTED)
+   /* Both must be defined for libpng to be able to handle the interlace,
+    * otherwise it gets handled below by simply reading and writing the passes
+    * directly.
+    */
+   if (png_set_interlace_handling(read_ptr) != num_passes)
+      png_error(write_ptr,
+            "png_set_interlace_handling(read): wrong pass count ");
+   if (png_set_interlace_handling(write_ptr) != num_passes)
+      png_error(write_ptr,
+            "png_set_interlace_handling(write): wrong pass count ");
+#else /* png_set_interlace_handling not called on either read or write */
+#  define calc_pass_height
+#endif /* not using libpng interlace handling */

 #ifdef PNGTEST_TIMING
   t_stop = (float)clock();
   t_misc += (t_stop - t_start);
   t_start = t_stop;
 #endif
-   for (pass = 0; pass < num_pass; pass++)
+   for (pass = 0; pass < num_passes; pass++)
   {
+#     ifdef calc_pass_height
+         png_uint_32 pass_height;
+
+         if (num_passes == 7) /* interlaced */
+         {
+            if (PNG_PASS_COLS(width, pass) > 0)
+               pass_height = PNG_PASS_ROWS(height, pass);
+
+            else
+               pass_height = 0;
+         }
+
+         else /* not interlaced */
+            pass_height = height;
+#     else
+#        define pass_height height
+#     endif
+
      pngtest_debug1("Writing row data for pass %d", pass);
-      for (y = 0; y < height; y++)
+      for (y = 0; y < pass_height; y++)
      {
 #ifndef SINGLE_ROWBUF_ALLOC
         pngtest_debug2("Allocating row buffer (pass %d, y = %u)...", pass, y);
@@ -1599,7 +1629,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   }

 #  ifdef PNG_WRITE_SUPPORTED
-      /* If there we no write support nothing was written! */
+      /* If there is no write support nothing was written! */
      else if (unsupported_chunks > 0)
      {
         fprintf(STDERR, "\n  %s: unsupported chunks (%d)%s",
@@ -1630,7 +1660,8 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      return (1);
   }

-#ifdef PNG_WRITE_SUPPORTED /* else nothing was written */
+#if defined (PNG_WRITE_SUPPORTED) /* else nothing was written */ &&\
+    defined (PNG_WRITE_FILTER_SUPPORTED)
   if (interlace_preserved != 0) /* else the files will be changed */
   {
      for (;;)
@@ -1707,7 +1738,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
         }
      }
   }
-#endif /* WRITE */
+#endif /* WRITE && WRITE_FILTER */

   FCLOSE(fpin);
   FCLOSE(fpout);
@@ -1846,21 +1877,12 @@ main(int argc, char *argv[])
         kerror = test_one_file(argv[i], outname);
         if (kerror == 0)
         {
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-            int k;
-#endif
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
            fprintf(STDERR, "\n PASS (%lu zero samples)\n",
               (unsigned long)zero_samples);
 #else
            fprintf(STDERR, " PASS\n");
 #endif
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-            for (k = 0; k<256; k++)
-               if (filters_used[k] != 0)
-                  fprintf(STDERR, " Filter %d was used %lu times\n",
-                     k, (unsigned long)filters_used[k]);
-#endif
 #ifdef PNG_TIME_RFC1123_SUPPORTED
            if (tIME_chunk_present != 0)
               fprintf(STDERR, " tIME = %s\n", tIME_string);
@@ -1937,21 +1959,12 @@ main(int argc, char *argv[])
         {
            if (verbose == 1 || i == 2)
            {
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-                int k;
-#endif
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
                fprintf(STDERR, "\n PASS (%lu zero samples)\n",
                   (unsigned long)zero_samples);
 #else
                fprintf(STDERR, " PASS\n");
 #endif
-#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-                for (k = 0; k<256; k++)
-                   if (filters_used[k] != 0)
-                      fprintf(STDERR, " Filter %d was used %lu times\n",
-                         k, (unsigned long)filters_used[k]);
-#endif
 #ifdef PNG_TIME_RFC1123_SUPPORTED
             if (tIME_chunk_present != 0)
                fprintf(STDERR, " tIME = %s\n", tIME_string);
@@ -2057,4 +2070,4 @@ main(void)
 #endif

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_19rc03 Your_png_h_is_not_version_1_6_19rc03;
+typedef png_libpng_version_1_6_20 Your_png_h_is_not_version_1_6_20;
--- a/pngwrite.c
+++ b/pngwrite.c
@@ -1,7 +1,7 @@

 /* pngwrite.c - general routines to write a PNG file
 *
- * Last changed in libpng 1.6.19 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.19 [November 12, 2015]
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
--- a/pngwutil.c
+++ b/pngwutil.c
@@ -1,7 +1,7 @@

 /* pngwutil.c - utilities to write a PNG file
 *
- * Last changed in libpng 1.6.19 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.19 [November 12, 2015]
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -2563,7 +2563,7 @@ png_write_find_filter(png_structrp png_ptr, png_row_infop row_info)
   if (filter_to_do == PNG_FILTER_SUB)
   /* It's the only filter so no testing is needed */
   {
-      (void) png_setup_sub_row(png_ptr, bpp, row_bytes, mins); 
+      (void) png_setup_sub_row(png_ptr, bpp, row_bytes, mins);
      best_row = png_ptr->try_row;
   }

@@ -2572,7 +2572,7 @@ png_write_find_filter(png_structrp png_ptr, png_row_infop row_info)
      png_size_t sum;
      png_size_t lmins = mins;

-      sum = png_setup_sub_row(png_ptr, bpp, row_bytes, lmins); 
+      sum = png_setup_sub_row(png_ptr, bpp, row_bytes, lmins);

      if (sum < mins)
      {
@@ -2598,7 +2598,7 @@ png_write_find_filter(png_structrp png_ptr, png_row_infop row_info)
      png_size_t sum;
      png_size_t lmins = mins;

-      sum = png_setup_up_row(png_ptr, row_bytes, lmins); 
+      sum = png_setup_up_row(png_ptr, row_bytes, lmins);

      if (sum < mins)
      {
--- a/projects/vstudio/readme.txt
+++ b/projects/vstudio/readme.txt
@@ -1,7 +1,7 @@

 VisualStudio instructions

-libpng version 1.6.19rc03 - November 3, 2015
+libpng version 1.6.20 - December 3, 2015

 Copyright (c) 1998-2010 Glenn Randers-Pehrson

--- a/projects/vstudio/zlib.props
+++ b/projects/vstudio/zlib.props
@@ -2,7 +2,7 @@
 <!--
 * zlib.props - location of zlib source
 *
- * libpng version 1.6.19rc03 - November 3, 2015
+ * libpng version 1.6.20 - December 3, 2015
 *
 * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 *
--- a/scripts/README.txt
+++ b/scripts/README.txt
@@ -1,9 +1,9 @@

-Makefiles for  libpng version 1.6.19rc03 - November 3, 2015
+Makefiles for  libpng version 1.6.20 - December 3, 2015

 pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng16.so.16.1.6.19rc03)
+                       (gcc, creates libpng16.so.16.1.6.20)
 makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
 makefile.knr      =>  Archaic UNIX Makefile that converts files with
                       ansi2knr (Requires ansi2knr.c from
@@ -33,12 +33,12 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.os2      =>  OS/2 Makefile (gcc and emx, requires libpng.def)
 makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
 makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng16.so.16.1.6.19rc03)
+                       creates libpng16.so.16.1.6.20)
 makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
 makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng16.so.16.1.6.19rc03)
+                       creates libpng16.so.16.1.6.20)
 makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng16.so.16.1.6.19rc03)
+                       creates libpng16.so.16.1.6.20)
 makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
 makefile.sunos    =>  Sun makefile
 makefile.32sunu   =>  Sun Ultra 32-bit makefile
--- a/scripts/def.c
+++ b/scripts/def.c
@@ -21,7 +21,7 @@ PNG_DFN "OS2 DESCRIPTION "PNG image compression library""
 PNG_DFN "OS2 CODE PRELOAD MOVEABLE DISCARDABLE"
 PNG_DFN ""
 PNG_DFN "EXPORTS"
-PNG_DFN ";Version 1.6.19rc03"
+PNG_DFN ";Version 1.6.20"

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
        PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"
--- a/scripts/libpng-config-head.in
+++ b/scripts/libpng-config-head.in
@@ -11,7 +11,7 @@

 # Modeled after libxml-config.

-version=1.6.19rc03
+version=1.6.20
 prefix=""
 libdir=""
 libs=""
--- a/scripts/libpng.pc.in
+++ b/scripts/libpng.pc.in
@@ -5,6 +5,6 @@ includedir=@includedir@/libpng16

 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.6.19rc03
+Version: 1.6.20
 Libs: -L${libdir} -lpng16
 Cflags: -I${includedir}
--- a/scripts/makefile.cegcc
+++ b/scripts/makefile.cegcc
@@ -23,7 +23,7 @@

 VERMAJ = 1
 VERMIN = 6
-VERMIC = 19
+VERMIC = 20
 VER = $(VERMAJ).$(VERMIN).$(VERMIC)
 NAME = libpng
 PACKAGE = $(NAME)-$(VER)
--- a/scripts/makefile.linux
+++ b/scripts/makefile.linux
@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng16
 PNGMAJ = 16
-RELEASE = 19
+RELEASE = 20

 # Shared library names:
 LIBSO=$(LIBNAME).so
--- a/scripts/makefile.msys
+++ b/scripts/makefile.msys
@@ -18,7 +18,7 @@ exec_prefix=$(prefix)
 # Library name:
 LIBNAME = libpng16
 PNGMAJ = 16
-RELEASE = 19
+RELEASE = 20

 # Shared library names:
 LIBSO=$(LIBNAME).dll
--- a/scripts/makefile.ne12bsd
+++ b/scripts/makefile.ne12bsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng16

 LIB=	png16
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.6.19rc03
+SHLIB_MINOR=	1.6.20
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.netbsd
+++ b/scripts/makefile.netbsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include

 LIB=	png
 SHLIB_MAJOR=	16
-SHLIB_MINOR=	1.6.19rc03
+SHLIB_MINOR=	1.6.20
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.openbsd
+++ b/scripts/makefile.openbsd
@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat

 SHLIB_MAJOR=	16
-SHLIB_MINOR=	1.6.19rc03
+SHLIB_MINOR=	1.6.20

 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
--- a/scripts/pnglibconf.h.prebuilt
+++ b/scripts/pnglibconf.h.prebuilt
@@ -1,10 +1,10 @@
-/* libpng 1.6.19rc03 STANDARD API DEFINITION */
+/* libpng 1.6.20 STANDARD API DEFINITION */

 /* pnglibconf.h - library build configuration */

-/* Libpng version 1.6.19rc03 - November 3, 2015 */
+/* Libpng version 1.6.20 - December 3, 2015 */

-/* Copyright (c) 1998-2014 Glenn Randers-Pehrson */
+/* Copyright (c) 1998-2015 Glenn Randers-Pehrson */

 /* This code is released under the libpng license. */
 /* For conditions of distribution and use, see the disclaimer */
--- a/scripts/symbols.def
+++ b/scripts/symbols.def
@@ -1,4 +1,4 @@
-;Version 1.6.19rc03
+;Version 1.6.20
 ;--------------------------------------------------------------
 ; LIBPNG symbol list as a Win32 DEF file
 ; Contains all the symbols that can be exported from libpng