[master] Imported from libpng-1.6.25.tar

[master] Imported from libpng-1.6.24.tar
[master] Imported from libpng-1.6.23.tar
2025-07-10 18:04:09 +02:00 · 2016-08-31 22:30:55 -05:00 · 2016-08-03 21:42:00 -05:00 · 2016-06-09 07:08:36 -05:00 · 2016-05-26 07:25:22 -05:00 · 2016-01-15 14:04:53 -06:00
62 changed files with 455 additions and 596 deletions
--- a/35
+++ b/35
@@ -1,37 +1,36 @@
-Libpng 1.6.27beta01 - November 2, 2016
+Libpng 1.6.25 - September 1, 2016

-This is not intended to be a public release.  It will be replaced
-within a few weeks by a public version or by another test version.
+This is a public release of libpng, intended for use in production codes.

 Files available for download:

 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script

-   1.6.27beta01.tar.xz (LZMA-compressed, recommended)
-   1.6.27beta01.tar.gz
+   libpng-1.6.25.tar.xz (LZMA-compressed, recommended)
+   libpng-1.6.25.tar.gz

 Source files with CRLF line endings (for Windows), without the
 "configure" script

-   lp1627b01.7z  (LZMA-compressed, recommended)
-   lp1627b01.zip
+   lpng1625.7z  (LZMA-compressed, recommended)
+   lpng1625.zip

 Other information:

-   1.6.27beta01-README.txt
-   1.6.27beta01-LICENSE.txt
-   libpng-1.6.27beta01-*.asc (armored detached GPG signatures)
+   libpng-1.6.25-README.txt
+   libpng-1.6.25-LICENSE.txt
+   libpng-1.6.25-*.asc (armored detached GPG signatures)

-Changes since the last public release (1.6.26):
+Changes since the last public release (1.6.24):
+  Reject oversized iCCP profile immediately.
+  Cleaned up PNG_DEBUG compile of pngtest.c.
+  Conditionally compile png_inflate().
+  Don't install pngcp; it conflicts with pngcp in the pngtools package.
+  Minor editing of INSTALL, (whitespace, added copyright line)
+  Added MIPS support (Mandar Sahastrabuddhe <Mandar.Sahastrabuddhe@imgtec.com>).
+  Rebased contrib/intel/intel_sse.patch after the MIPS implementation.

-Version 1.6.27beta01 [November 2, 2016]
-  Restrict the new ADLER32-skipping to IDAT chunks.  It broke iCCP chunk
-    handling: an erroneous iCCP chunk would throw a png_error and reject the
-    entire PNG image instead of rejecting just the iCCP chunk with a warning,
-    if build with zlib-1.2.8.1.
-
-Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
 to subscribe)
--- a/59
+++ b/59
@@ -593,7 +593,7 @@ Version 1.0.5e [November 30, 1999]
    with trailing compressed parts easier in the future, and added new functions
    png_free_iCCP, png_free_pCAL, png_free_sPLT, png_free_text, png_get_iCCP,
    png_get_spalettes, png_set_iCCP, png_set_spalettes (Eric S. Raymond).
-    NOTE: Applications that write text chunks MUST define png_text->lang
+  NOTE: Applications that write text chunks MUST define png_text->lang
    before calling png_set_text(). It must be set to NULL if you want to
    write tEXt or zTXt chunks.  If you want your application to be able to
    run with older versions of libpng, use
@@ -5703,63 +5703,6 @@ Version 1.6.25rc05 [August 30, 2016]
 Version 1.6.25 [September 1, 2016]
  No changes.

-Version 1.6.26beta01 [September 26, 2016]
-  Fixed handling zero length IDAT in pngfix (bug report by Agostino Sarubbo,
-    bugfix by John Bowler).
-  Do not issue a png_error() on read in png_set_pCAL() because png_handle_pCAL
-    has allocated memory that libpng needs to free.
-  Conditionally compile png_set_benign_errors() in pngread.c and pngtest.c
-  Issue a png_benign_error instead of a png_error on ADLER32 mismatch
-    while decoding compressed data chunks.
-  Changed PNG_ZLIB_VERNUM to ZLIB_VERNUM in pngpriv.h, pngstruct.h, and
-    pngrutil.c.
-  If CRC handling of critical chunks has been set to PNG_CRC_QUIET_USE,
-    ignore the ADLER32 checksum in the IDAT chunk as well as the chunk CRCs.
-  Issue png_benign_error() on ADLER32 checksum mismatch instead of png_error().
-  Add tests/badcrc.png and tests/badadler.png to tests/pngtest.
-  Merged pngtest.c with libpng-1.7.0beta84/pngtest.c
-
-Version 1.6.26beta02 [October 1, 2016]
-  Updated the documentation about CRC and ADLER32 handling.
-  Quieted 117 warnings from clang-3.8 in pngtrans.c, pngread.c,
-     pngwrite.c, pngunknown.c, and pngvalid.c.
-  Quieted 58 (out of 144) -Wconversion compiler warnings by changing
-    flag definitions in pngpriv.h from 0xnnnn to 0xnnnnU and trivial changes
-    in png.c, pngread.c, and pngwutil.c.
-
-Version 1.6.26beta03 [October 2, 2016]
-  Removed contrib/libtests/*.orig and *.rej that slipped into the tarballs.
-  Quieted the 86 remaining -Wconversion compiler warnings by
-    revising the png_isaligned() macro and trivial changes in png.c,
-    pngerror.c, pngget.c, pngmem.c, pngset.c, pngrtran.c, pngrutil.c,
-    pngwtran.c, pngwrite.c, and pngwutil.c.
-
-Version 1.6.26beta04 [October 3, 2016]
-  Quieted (bogus?) clang warnings about "absolute value has no effect"
-    when PNG_USE_ABS is defined.
-  Fixed offsets in contrib/intel/intel_sse.patch
-
-Version 1.6.26beta05 [October 6, 2016]
-  Changed integer constant 4294967294 to unsigned 4294967294U in pngconf.h
-    to avoid a signed/unsigned compare in the preprocessor.
-
-Version 1.6.26beta06 [October 7, 2016]
-  Use zlib-1.2.8.1 inflateValidate() instead of inflateReset2() to
-    optionally avoid ADLER32 evaluation.
-
-Version 1.6.26rc01 [October 12, 2016]
-  No changes.
-
-Version 1.6.26 [October 20, 2016]
-  Cosmetic change, "ptr != 0" to "ptr != NULL" in png.c and pngrutil.c
-  Despammed email addresses (replaced "@" with " at ").
-
-Version 1.6.27beta01 [November 2, 2016]
-  Restrict the new ADLER32-skipping to IDAT chunks.  It broke iCCP chunk
-    handling: an erroneous iCCP chunk would throw a png_error and reject the
-    entire PNG image instead of rejecting just the iCCP chunk with a warning,
-    if build with zlib-1.2.8.1.
-
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -35,7 +35,7 @@ enable_testing()

 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 6)
-set(PNGLIB_RELEASE 27)
+set(PNGLIB_RELEASE 25)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})

@@ -696,7 +696,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW)
 # SET UP LINKS
 if(PNG_SHARED)
  set_target_properties(png PROPERTIES
-#   VERSION 16.${PNGLIB_RELEASE}.1.6.27beta01
+#   VERSION 16.${PNGLIB_RELEASE}.1.6.25
    VERSION 16.${PNGLIB_RELEASE}.0
    SOVERSION 16
    CLEAN_DIRECT_OUTPUT 1)
--- a/4
+++ b/4
@@ -10,7 +10,7 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.0.7, July 1, 2000 through 1.6.27beta01, November 2, 2016 are
+libpng versions 1.0.7, July 1, 2000 through 1.6.25, September 1, 2016 are
 Copyright (c) 2000-2002, 2004, 2006-2016 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -127,4 +127,4 @@ any encryption software.  See the EAR, paragraphs 734.3(b)(3) and

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 2, 2016
+September 1, 2016
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-README for libpng version 1.6.27beta01 - November 2, 2016 (shared library 16.0)
+README for libpng version 1.6.25 - September 1, 2016 (shared library 16.0)
 See the note about version numbers near the top of png.h

 See INSTALL for instructions on how to install libpng.
--- a/3
+++ b/3
@@ -7,7 +7,7 @@ Fix problem with C++ and EXTERN "C".
 cHRM transformation.
 Remove setjmp/longjmp usage in favor of returning error codes. As a start on
  this, minimize the use of png_error(), replacing them with
-  png_warning(); return(0); or similar.
+  png_warning(); return(0; or similar.
 Palette creation.
 Add "grayscale->palette" transformation and "palette->grayscale" detection.
 Improved dithering.
@@ -24,6 +24,7 @@ Use greater precision when changing to linear gamma for compositing against
  background and doing rgb-to-gray transformation.
 Investigate pre-incremented loop counters and other loop constructions.
 Add interpolated method of handling interlacing.
+Switch to the simpler zlib (zlib/libpng) license if legally possible.
 Extend pngvalid.c to validate more of the libpng transformations.

 */
--- a/configure.ac
+++ b/configure.ac
@@ -25,7 +25,7 @@ AC_PREREQ([2.68])

 dnl Version number stuff here:

-AC_INIT([libpng],[1.6.27beta01],[png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng],[1.6.25],[png-mng-implement@lists.sourceforge.net])
 AC_CONFIG_MACRO_DIR([scripts])

 # libpng does not follow GNU file name conventions (hence 'foreign')
@@ -46,10 +46,10 @@ dnl automake, so the following is not necessary (and is not defined anyway):
 dnl AM_PREREQ([1.11.2])
 dnl stop configure from automagically running automake

-PNGLIB_VERSION=1.6.27beta01
+PNGLIB_VERSION=1.6.25
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=6
-PNGLIB_RELEASE=27
+PNGLIB_RELEASE=25

 dnl End of version number stuff

--- a/contrib/examples/README.txt
+++ b/contrib/examples/README.txt
@@ -21,4 +21,4 @@ ORIGINAL AUTHORS
    of the people below claim any rights with regard to the contents of this
    directory.

-    John Bowler <jbowler at acm.org>
+    John Bowler <jbowler@acm.org>
--- a/contrib/gregbook/README
+++ b/contrib/gregbook/README
@@ -15,7 +15,7 @@ of PBMPLUS/NetPBM) and converts them to PNG.

 The source code for all three demo programs currently compiles under
 Unix, OpenVMS, and 32-bit Windows.  (Special thanks to Martin Zinser,
-zinser at decus.de, for making the necessary changes for OpenVMS and for
+zinser@decus.de, for making the necessary changes for OpenVMS and for
 providing an appropriate build script.)  Build instructions can be found
 below.

--- a/contrib/gregbook/rpng-win.c
+++ b/contrib/gregbook/rpng-win.c
@@ -182,7 +182,7 @@ int WINAPI WinMain(HINSTANCE hInst, HINSTANCE hPrevInst, PSTR cmd, int showmode)
 #ifndef __CYGWIN__
    /* First reenable console output, which normally goes to the bit bucket
     * for windowed apps.  Closing the console window will terminate the
-     * app.  Thanks to David.Geldreich at realviz.com for supplying the magical
+     * app.  Thanks to David.Geldreich@realviz.com for supplying the magical
     * incantation. */

    AllocConsole();
--- a/contrib/gregbook/rpng2-win.c
+++ b/contrib/gregbook/rpng2-win.c
@@ -301,7 +301,7 @@ int WINAPI WinMain(HINSTANCE hInst, HINSTANCE hPrevInst, PSTR cmd, int showmode)
 #ifndef __CYGWIN__
    /* Next reenable console output, which normally goes to the bit bucket
     * for windowed apps.  Closing the console window will terminate the
-     * app.  Thanks to David.Geldreich at realviz.com for supplying the magical
+     * app.  Thanks to David.Geldreich@realviz.com for supplying the magical
     * incantation. */

    AllocConsole();
--- a/contrib/intel/intel_sse.patch
+++ b/contrib/intel/intel_sse.patch
@@ -134,7 +134,7 @@ diff --git a/pngpriv.h b/pngpriv.h
 #        elif defined(__GNUC__)
 #           if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 7)
 #              define PNG_MIPS_MSA_IMPLEMENTATION 2
-@@ -1251,16 +1287,31 @@ PNG_INTERNAL_FUNCTION(void,png_read_filt
+@@ -1232,16 +1268,31 @@ PNG_INTERNAL_FUNCTION(void,png_read_filt
 PNG_INTERNAL_FUNCTION(void,png_read_filter_row_avg4_msa,(png_row_infop
     row_info, png_bytep row, png_const_bytep prev_row),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_read_filter_row_paeth3_msa,(png_row_infop
@@ -166,7 +166,7 @@ diff --git a/pngpriv.h b/pngpriv.h
 PNG_INTERNAL_FUNCTION(void,png_read_IDAT_data,(png_structrp png_ptr,
    png_bytep output, png_alloc_size_t avail_out),PNG_EMPTY);
    /* Read 'avail_out' bytes of data from the IDAT stream.  If the output buffer
-@@ -1986,16 +2037,21 @@ PNG_INTERNAL_FUNCTION(void, PNG_FILTER_O
+@@ -1967,16 +2018,21 @@ PNG_INTERNAL_FUNCTION(void, PNG_FILTER_O
 PNG_INTERNAL_FUNCTION(void, png_init_filter_functions_neon,
    (png_structp png_ptr, unsigned int bpp), PNG_EMPTY);
 #endif
--- a/contrib/libtests/pngunknown.c
+++ b/contrib/libtests/pngunknown.c
@@ -1,7 +1,7 @@

 /* pngunknown.c - test the read side unknown chunk handling
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.22 [May 26, 2016]
 * Copyright (c) 2015,2016 Glenn Randers-Pehrson
 * Written by John Cunningham Bowler
 *
@@ -478,7 +478,7 @@ get_valid(display *d, png_infop info_ptr)
      png_textp text;
      png_uint_32 ntext = png_get_text(d->png_ptr, info_ptr, &text, NULL);

-      while (ntext > 0) switch (text[--ntext].compression)
+      while (ntext-- > 0) switch (text[ntext].compression)
      {
         case -1:
            flags |= PNG_INFO_tEXt;
--- a/contrib/libtests/pngvalid.c
+++ b/contrib/libtests/pngvalid.c
@@ -1,8 +1,9 @@

 /* pngvalid.c - validate libpng by constructing then reading png files.
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
- * Copyright (c) 2014-2016 John Cunningham Bowler
+ * Last changed in libpng 1.6.24 [August 4, 2016]
+ * Copyright (c) 2014-2016 Glenn Randers-Pehrson
+ * Written by John Cunningham Bowler
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -1241,7 +1242,7 @@ store_image_check(const png_store* ps, png_const_structp pp, int iImage)

      image += 2; /* skip image first row markers */

-      for (; rows > 0; --rows)
+      while (rows-- > 0)
      {
         if (image[-2] != 190 || image[-1] != 239)
            png_error(pp, "row start overwritten");
@@ -11426,36 +11427,23 @@ perform_interlace_macro_validation(void)
       */
      for (v=0;;)
      {
-         /* The first two tests overflow if the pass row or column is outside
-          * the possible range for a 32-bit result.  In fact the values should
-          * never be outside the range for a 31-bit result, but checking for 32
-          * bits here ensures that if an app uses a bogus pass row or column
-          * (just so long as it fits in a 32 bit integer) it won't get a
-          * possibly dangerous overflow.
-          */
         /* First the base 0 stuff: */
-         if (v < png_pass_rows(0xFFFFFFFFU, pass))
+         m = PNG_ROW_FROM_PASS_ROW(v, pass);
+         f = png_row_from_pass_row(v, pass);
+         if (m != f)
         {
-            m = PNG_ROW_FROM_PASS_ROW(v, pass);
-            f = png_row_from_pass_row(v, pass);
-            if (m != f)
-            {
-               fprintf(stderr, "PNG_ROW_FROM_PASS_ROW(%u, %d) = %u != %x\n",
-                  v, pass, m, f);
-               exit(99);
-            }
+            fprintf(stderr, "PNG_ROW_FROM_PASS_ROW(%u, %d) = %u != %x\n",
+               v, pass, m, f);
+            exit(99);
         }

-         if (v < png_pass_cols(0xFFFFFFFFU, pass))
+         m = PNG_COL_FROM_PASS_COL(v, pass);
+         f = png_col_from_pass_col(v, pass);
+         if (m != f)
         {
-            m = PNG_COL_FROM_PASS_COL(v, pass);
-            f = png_col_from_pass_col(v, pass);
-            if (m != f)
-            {
-               fprintf(stderr, "PNG_COL_FROM_PASS_COL(%u, %d) = %u != %x\n",
-                  v, pass, m, f);
-               exit(99);
-            }
+            fprintf(stderr, "PNG_COL_FROM_PASS_COL(%u, %d) = %u != %x\n",
+               v, pass, m, f);
+            exit(99);
         }

         m = PNG_ROW_IN_INTERLACE_PASS(v, pass);
--- a/contrib/pngminus/README
+++ b/contrib/pngminus/README
@@ -146,7 +146,7 @@ The Turbo bug
 The end
 -------
 Willem van Schaik
-mailto:willem at schaik.com
+mailto:willem@schaik.com
 http://www.schaik.com/png/
 -------
 Oct 1999
--- a/contrib/pngminus/png2pnm.c
+++ b/contrib/pngminus/png2pnm.c
@@ -1,6 +1,6 @@
 /*
 *  png2pnm.c --- conversion from PNG-file to PGM/PPM-file
- *  copyright (C) 1999 by Willem van Schaik <willem at schaik.com>
+ *  copyright (C) 1999 by Willem van Schaik <willem@schaik.com>
 *
 *  version 1.0 - 1999.10.15 - First version.
 *
--- a/contrib/pngminus/pnm2png.c
+++ b/contrib/pngminus/pnm2png.c
@@ -1,6 +1,6 @@
 /*
 *  pnm2png.c --- conversion from PBM/PGM/PPM-file to PNG-file
- *  copyright (C) 1999 by Willem van Schaik <willem at schaik.com>
+ *  copyright (C) 1999 by Willem van Schaik <willem@schaik.com>
 *
 *  version 1.0 - 1999.10.15 - First version.
 *  version 1.1 - 2015.07.29 - Fixed leaks (Glenn Randers-Pehrson)
--- a/contrib/pngsuite/README
+++ b/contrib/pngsuite/README
@@ -101,5 +101,5 @@ Testing basn6a16.png: PASS (1072 zero samples)
 libpng passes test

 Willem van Schaik
-<willem at schaik.com>
+<willem@schaik.com>
 October 1999
--- a/contrib/tools/README.txt
+++ b/contrib/tools/README.txt
@@ -23,5 +23,4 @@ ORIGINAL AUTHORS
    of the people below claim any rights with regard to the contents of this
    directory.

-    John Bowler <jbowler at acm.org>
-    Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
+    John Bowler <jbowler@acm.org>
--- a/contrib/tools/pngfix.c
+++ b/contrib/tools/pngfix.c
@@ -2,7 +2,7 @@
 *
 * Copyright (c) 2014-2016 John Cunningham Bowler
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.21 [January 15, 2016]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
@@ -1824,7 +1824,7 @@ IDAT_init(struct IDAT * const idat, struct file * const file)
 }

 static png_uint_32
-rechunk_length(struct IDAT *idat, int start)
+rechunk_length(struct IDAT *idat)
   /* Return the length for the next IDAT chunk, taking into account
    * rechunking.
    */
@@ -1836,7 +1836,7 @@ rechunk_length(struct IDAT *idat, int start)
      const struct IDAT_list *cur;
      unsigned int count;

-      if (start)
+      if (idat->idat_index == 0) /* at the new chunk (first time) */
         return idat->idat_length; /* use the cache */

      /* Otherwise rechunk_length is called at the end of a chunk for the length
@@ -1995,7 +1995,7 @@ process_IDAT(struct file *file)
      idat->idat_index = 0; /* Index into chunk data */

      /* Update the chunk length to the correct value for the IDAT chunk: */
-      file->chunk->chunk_length = rechunk_length(idat, 1/*start*/);
+      file->chunk->chunk_length = rechunk_length(idat);

      /* Change the state to writing IDAT chunks */
      file->state = STATE_IDAT;
@@ -3473,8 +3473,7 @@ read_callback(png_structp png_ptr, png_bytep buffer, size_t count)
                     /* Write another IDAT chunk.  Call rechunk_length to
                      * calculate the length required.
                      */
-                     length = chunk->chunk_length =
-                         rechunk_length(file->idat, 0/*end*/);
+                     length = chunk->chunk_length = rechunk_length(file->idat);
                     assert(type == png_IDAT);
                     file->write_count = 0; /* for the new chunk */
                     --(file->write_count); /* fake out the increment below */
--- a/libpng-manual.txt
+++ b/libpng-manual.txt
@@ -1,6 +1,6 @@
 libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.6.27beta01 - November 2, 2016
+ libpng version 1.6.25 - September 1, 2016
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2016 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.6.27beta01 - November 2, 2016
+ libpng versions 0.97, January 1998, through 1.6.25 - September 1, 2016
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2016 Glenn Randers-Pehrson

@@ -467,9 +467,8 @@ the default, use

 The values for png_set_crc_action() say how libpng is to handle CRC errors in
 ancillary and critical chunks, and whether to use the data contained
-therein. Starting with libpng-1.6.26, this also governs how an ADLER32 error
-is handled while reading the IDAT chunk. Note that it is impossible to
-"discard" data in a critical chunk.
+therein.  Note that it is impossible to "discard" data in a critical
+chunk.

 Choices for (int) crit_action are
   PNG_CRC_DEFAULT      0  error/quit
@@ -486,9 +485,6 @@ Choices for (int) ancil_action are
   PNG_CRC_QUIET_USE    4  quiet/use data
   PNG_CRC_NO_CHANGE    5  use the current value

-When the setting for crit_action is PNG_CRC_QUIET_USE, the CRC and ADLER32
-checksums are not only ignored, but they are not evaluated.
-
 Setting up callback code

 You can set up a callback function to handle any unknown chunks in the
@@ -5339,9 +5335,8 @@ with an even number of lower-case hex digits, and to make them unsigned
 We prefer to use underscores rather than camelCase in names, except
 for a few type names that we inherit from zlib.h.

-We prefer "if (something != 0)" and "if (something == 0)" over
-"if (something)" and if "(!something)", respectively, and for pointers
-we prefer "if (some_pointer != NULL)" or "if (some_pointer == NULL)". 
+We prefer "if (something != 0)" and "if (something == 0)"
+over "if (something)" and if "(!something)", respectively.

 We do not use the TAB character for indentation in the C sources.

@@ -5355,7 +5350,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.6.27beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.6.25 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
--- a/libpng.3
+++ b/libpng.3
@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "November 2, 2016"
+.TH LIBPNG 3 "September 1, 2016"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.27beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.25
 .SH SYNOPSIS
 \fB
 #include <png.h>\fP
@@ -510,7 +510,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.6.27beta01 - November 2, 2016
+ libpng version 1.6.25 - September 1, 2016
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2016 Glenn Randers-Pehrson
@@ -521,7 +521,7 @@ libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.6.27beta01 - November 2, 2016
+ libpng versions 0.97, January 1998, through 1.6.25 - September 1, 2016
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2016 Glenn Randers-Pehrson

@@ -977,9 +977,8 @@ the default, use

 The values for png_set_crc_action() say how libpng is to handle CRC errors in
 ancillary and critical chunks, and whether to use the data contained
-therein. Starting with libpng-1.6.26, this also governs how an ADLER32 error
-is handled while reading the IDAT chunk. Note that it is impossible to
-"discard" data in a critical chunk.
+therein.  Note that it is impossible to "discard" data in a critical
+chunk.

 Choices for (int) crit_action are
   PNG_CRC_DEFAULT      0  error/quit
@@ -996,9 +995,6 @@ Choices for (int) ancil_action are
   PNG_CRC_QUIET_USE    4  quiet/use data
   PNG_CRC_NO_CHANGE    5  use the current value

-When the setting for crit_action is PNG_CRC_QUIET_USE, the CRC and ADLER32
-checksums are not only ignored, but they are not evaluated.
-
 .SS Setting up callback code

 You can set up a callback function to handle any unknown chunks in the
@@ -5849,9 +5845,8 @@ with an even number of lower-case hex digits, and to make them unsigned
 We prefer to use underscores rather than camelCase in names, except
 for a few type names that we inherit from zlib.h.

-We prefer "if (something != 0)" and "if (something == 0)" over
-"if (something)" and if "(!something)", respectively, and for pointers
-we prefer "if (some_pointer != NULL)" or "if (some_pointer == NULL)". 
+We prefer "if (something != 0)" and "if (something == 0)"
+over "if (something)" and if "(!something)", respectively.

 We do not use the TAB character for indentation in the C sources.

@@ -5865,7 +5860,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.6.27beta01 are Y2K compliant.  It is my belief that earlier
+upward through 1.6.25 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -5967,7 +5962,7 @@ the first widely used release:
 ...
 1.5.27                  15    10527  15.so.15.27[.0]
 ...
- 1.6.27                  16    10627  16.so.16.27[.0]
+ 1.6.25                  16    10625  16.so.16.25[.0]

 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -6023,7 +6018,7 @@ possible without all of you.

 Thanks to Frank J. T. Wojcik for helping with the documentation.

-Libpng version 1.6.27beta01 - November 2, 2016:
+Libpng version 1.6.25 - September 1, 2016:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).

@@ -6048,7 +6043,7 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.0.7, July 1, 2000 through 1.6.27beta01, November 2, 2016 are
+libpng versions 1.0.7, July 1, 2000 through 1.6.25, September 1, 2016 are
 Copyright (c) 2000-2002, 2004, 2006-2016 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -6173,7 +6168,7 @@ files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31).

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 2, 2016
+September 1, 2016

 .\" end of man page

--- a/libpngpf.3
+++ b/libpngpf.3
@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "November 2, 2016"
+.TH LIBPNGPF 3 "September 1, 2016"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.6.27beta01
+libpng \- Portable Network Graphics (PNG) Reference Library 1.6.25
 (private functions)
 .SH SYNOPSIS
 \fB#include \fI"pngpriv.h"
--- a/mips/filter_msa_intrinsics.c
+++ b/mips/filter_msa_intrinsics.c
@@ -3,7 +3,7 @@
 *
 * Copyright (c) 2016 Glenn Randers-Pehrson
 * Written by Mandar Sahastrabuddhe, August 2016.
- * Last changed in libpng 1.6.25 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.25 [September 1, 2016]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
--- a/mips/mips_init.c
+++ b/mips/mips_init.c
@@ -3,7 +3,7 @@
 *
 * Copyright (c) 2016 Glenn Randers-Pehrson
 * Written by Mandar Sahastrabuddhe, 2016.
- * Last changed in libpng 1.6.25 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.25 [September 1, 2016]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
--- a/png.5
+++ b/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "November 2, 2016"
+.TH PNG 5 "September 1, 2016"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
--- a/png.c
+++ b/png.c
@@ -1,7 +1,7 @@

 /* png.c - location for general purpose libpng functions
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.25 [September 1, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -14,7 +14,7 @@
 #include "pngpriv.h"

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_27beta01 Your_png_h_is_not_version_1_6_27beta01;
+typedef png_libpng_version_1_6_25 Your_png_h_is_not_version_1_6_25;

 /* Tells libpng that we have already handled the first "num_bytes" bytes
 * of the PNG file signature.  If the PNG data is embedded into another
@@ -458,7 +458,7 @@ png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,

 #ifdef PNG_TEXT_SUPPORTED
   /* Free text item num or (if num == -1) all text items */
-   if (info_ptr->text != NULL &&
+   if (info_ptr->text != 0 &&
       ((mask & PNG_FREE_TEXT) & info_ptr->free_me) != 0)
   {
      if (num != -1)
@@ -541,7 +541,7 @@ png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,

 #ifdef PNG_sPLT_SUPPORTED
   /* Free a given sPLT entry, or (if num == -1) all sPLT entries */
-   if (info_ptr->splt_palettes != NULL &&
+   if (info_ptr->splt_palettes != 0 &&
       ((mask & PNG_FREE_SPLT) & info_ptr->free_me) != 0)
   {
      if (num != -1)
@@ -571,7 +571,7 @@ png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,
 #endif

 #ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
-   if (info_ptr->unknown_chunks != NULL &&
+   if (info_ptr->unknown_chunks != 0 &&
       ((mask & PNG_FREE_UNKN) & info_ptr->free_me) != 0)
   {
      if (num != -1)
@@ -617,7 +617,7 @@ png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,
   /* Free any image bits attached to the info structure */
   if (((mask & PNG_FREE_ROWS) & info_ptr->free_me) != 0)
   {
-      if (info_ptr->row_pointers != NULL)
+      if (info_ptr->row_pointers != 0)
      {
         png_uint_32 row;
         for (row = 0; row < info_ptr->height; row++)
@@ -684,7 +684,7 @@ png_init_io(png_structrp png_ptr, png_FILE_p fp)
 void PNGAPI
 png_save_int_32(png_bytep buf, png_int_32 i)
 {
-   png_save_uint_32(buf, (png_uint_32)i);
+   png_save_uint_32(buf, i);
 }
 #  endif

@@ -775,14 +775,14 @@ png_get_copyright(png_const_structrp png_ptr)
 #else
 #  ifdef __STDC__
   return PNG_STRING_NEWLINE \
-      "libpng version 1.6.27beta01 - November 2, 2016" PNG_STRING_NEWLINE \
+      "libpng version 1.6.25 - September 1, 2016" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson" \
      PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE;
 #  else
-   return "libpng version 1.6.27beta01 - November 2, 2016\
+   return "libpng version 1.6.25 - September 1, 2016\
      Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson\
      Copyright (c) 1996-1997 Andreas Dilger\
      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
@@ -2529,7 +2529,7 @@ png_check_IHDR(png_const_structrp png_ptr,
      error = 1;
   }

-   if (png_gt(((width + 7) & (~7U)),
+   if (png_gt(((width + 7) & (~7)),
       ((PNG_SIZE_MAX
           - 48        /* big_row_buf hack */
           - 1)        /* filter byte */
@@ -2940,7 +2940,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
             */
            if (exp_b10 < 0 && exp_b10 > -3) /* PLUS 3 TOTAL 4 */
            {
-               czero = (unsigned int)(-exp_b10); /* PLUS 2 digits: TOTAL 3 */
+               czero = -exp_b10; /* PLUS 2 digits: TOTAL 3 */
               exp_b10 = 0;      /* Dot added below before first output. */
            }
            else
@@ -3118,11 +3118,11 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
               if (exp_b10 < 0)
               {
                  *ascii++ = 45, --size; /* '-': PLUS 1 TOTAL 3+precision */
-                  uexp_b10 = (unsigned int)(-exp_b10);
+                  uexp_b10 = -exp_b10;
               }

               else
-                  uexp_b10 = (unsigned int)exp_b10;
+                  uexp_b10 = exp_b10;

               cdigits = 0;

@@ -3184,9 +3184,9 @@ png_ascii_from_fixed(png_const_structrp png_ptr, png_charp ascii,

      /* Avoid overflow here on the minimum integer. */
      if (fp < 0)
-         *ascii++ = 45, num = (png_uint_32)(-fp);
+         *ascii++ = 45, num = -fp;
      else
-         num = (png_uint_32)fp;
+         num = fp;

      if (num <= 0x80000000) /* else overflowed */
      {
--- a/png.h
+++ b/png.h
@@ -1,7 +1,7 @@

 /* png.h - header file for PNG reference library
 *
- * libpng version 1.6.27beta01, November 2, 2016
+ * libpng version 1.6.25, September 1, 2016
 *
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -12,7 +12,7 @@
 * Authors and maintainers:
 *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
 *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.6.27beta01, November 2, 2016:
+ *   libpng versions 0.97, January 1998, through 1.6.25, September 1, 2016:
 *     Glenn Randers-Pehrson.
 *   See also "Contributing Authors", below.
 */
@@ -29,7 +29,7 @@
 * files that are distributed with libpng have other copyright owners and
 * are released under other open source licenses.
 *
- * libpng versions 1.0.7, July 1, 2000 through 1.6.27beta01, November 2, 2016 are
+ * libpng versions 1.0.7, July 1, 2000 through 1.6.25, September 1, 2016 are
 * Copyright (c) 2000-2002, 2004, 2006-2016 Glenn Randers-Pehrson, are
 * derived from libpng-1.0.6, and are distributed according to the same
 * disclaimer and license as libpng-1.0.6 with the following individuals
@@ -218,7 +218,7 @@
 *    ...
 *    1.5.27                  15    10527  15.so.15.27[.0]
 *    ...
- *    1.6.27                  16    10627  16.so.16.27[.0]
+ *    1.6.25                  16    10625  16.so.16.25[.0]
 *
 *    Henceforth the source version will match the shared-library major
 *    and minor numbers; the shared-library major version number will be
@@ -246,13 +246,13 @@
 * Y2K compliance in libpng:
 * =========================
 *
- *    November 2, 2016
+ *    September 1, 2016
 *
 *    Since the PNG Development group is an ad-hoc body, we can't make
 *    an official declaration.
 *
 *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.6.27beta01 are Y2K compliant.  It is my belief that
+ *    upward through 1.6.25 are Y2K compliant.  It is my belief that
 *    earlier versions were also Y2K compliant.
 *
 *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -314,8 +314,8 @@
 */

 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.6.27beta01"
-#define PNG_HEADER_VERSION_STRING " libpng version 1.6.27beta01 - November 2, 2016\n"
+#define PNG_LIBPNG_VER_STRING "1.6.25"
+#define PNG_HEADER_VERSION_STRING " libpng version 1.6.25 - September 1, 2016\n"

 #define PNG_LIBPNG_VER_SONUM   16
 #define PNG_LIBPNG_VER_DLLNUM  16
@@ -323,13 +323,13 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   6
-#define PNG_LIBPNG_VER_RELEASE 27
+#define PNG_LIBPNG_VER_RELEASE 25

 /* This should match the numeric part of the final component of
 * PNG_LIBPNG_VER_STRING, omitting any leading zero:
 */

-#define PNG_LIBPNG_VER_BUILD  01
+#define PNG_LIBPNG_VER_BUILD  0

 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -346,7 +346,7 @@
 #define PNG_LIBPNG_BUILD_SPECIAL 32 /* Cannot be OR'ed with
                                       PNG_LIBPNG_BUILD_PRIVATE */

-#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_BETA
+#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE

 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
 * We must not include leading zeros.
@@ -354,7 +354,7 @@
 * version 1.0.0 was mis-numbered 100 instead of 10000).  From
 * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
 */
-#define PNG_LIBPNG_VER 10627 /* 1.6.27 */
+#define PNG_LIBPNG_VER 10625 /* 1.6.25 */

 /* Library configuration: these options cannot be changed after
 * the library has been built.
@@ -464,7 +464,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
 * do not agree upon the version number.
 */
-typedef char* png_libpng_version_1_6_27beta01;
+typedef char* png_libpng_version_1_6_25;

 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
 *
--- a/pngconf.h
+++ b/pngconf.h
@@ -1,7 +1,7 @@

 /* pngconf.h - machine configurable file for libpng
 *
- * libpng version 1.6.27beta01, November 2, 2016
+ * libpng version 1.6.25, September 1, 2016
 *
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -507,9 +507,9 @@
 #  error "libpng requires a signed 32-bit (or more) type"
 #endif

-#if UINT_MAX > 4294967294U
+#if UINT_MAX > 4294967294
   typedef unsigned int png_uint_32;
-#elif ULONG_MAX > 4294967294U
+#elif ULONG_MAX > 4294967294
   typedef unsigned long int png_uint_32;
 #else
 #  error "libpng requires an unsigned 32-bit (or more) type"
--- a/pngerror.c
+++ b/pngerror.c
@@ -1,7 +1,7 @@

 /* pngerror.c - stub functions for i/o and memory allocation
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.24 [August 4, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -573,7 +573,7 @@ png_fixed_error,(png_const_structrp png_ptr, png_const_charp name),PNG_NORETURN)
 {
 #  define fixed_message "fixed point overflow in "
 #  define fixed_message_ln ((sizeof fixed_message)-1)
-   unsigned int  iin;
+   int  iin;
   char msg[fixed_message_ln+PNG_MAX_ERROR_TEXT];
   memcpy(msg, fixed_message, fixed_message_ln);
   iin = 0;
--- a/pngget.c
+++ b/pngget.c
@@ -1,7 +1,7 @@

 /* pngget.c - retrieval of values from info struct
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.24 [August 4, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -338,7 +338,7 @@ ppi_from_ppm(png_uint_32 ppm)
   png_fixed_point result;
   if (ppm <= PNG_UINT_31_MAX && png_muldiv(&result, (png_int_32)ppm, 127,
       5000) != 0)
-      return (png_uint_32)result;
+      return result;

   /* Overflow. */
   return 0;
--- a/pngmem.c
+++ b/pngmem.c
@@ -1,7 +1,7 @@

 /* pngmem.c - stub functions for memory allocation
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.24 [August 4, 2016%]
 * Copyright (c) 1998-2002,2004,2006-2014,2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -109,7 +109,7 @@ static png_voidp
 png_malloc_array_checked(png_const_structrp png_ptr, int nelements,
    size_t element_size)
 {
-   png_alloc_size_t req = (png_alloc_size_t)nelements; /* known to be > 0 */
+   png_alloc_size_t req = nelements; /* known to be > 0 */

   if (req <= PNG_SIZE_MAX/element_size)
      return png_malloc_base(png_ptr, req * element_size);
--- a/pngpread.c
+++ b/pngpread.c
@@ -684,12 +684,7 @@ png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer,
            png_warning(png_ptr, "Truncated compressed data in IDAT");

         else
-         {
-            if (ret == Z_DATA_ERROR)
-               png_benign_error(png_ptr, "IDAT: ADLER32 checksum mismatch");
-            else
-               png_error(png_ptr, "Decompression error in IDAT");
-         }
+            png_error(png_ptr, "Decompression error in IDAT");

         /* Skip the check on unprocessed input */
         return;
--- a/pngpriv.h
+++ b/pngpriv.h
@@ -1,7 +1,7 @@

 /* pngpriv.h - private declarations for use inside libpng
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.25 [September 1, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -533,8 +533,7 @@
 /* This implicitly assumes alignment is always to a power of 2. */
 #ifdef png_alignof
 #  define png_isaligned(ptr, type)\
-   (((type)((const char*)ptr-(const char*)0) & \
-   (type)(png_alignof(type)-1)) == 0)
+   ((((const char*)ptr-(const char*)0) & (png_alignof(type)-1)) == 0)
 #else
 #  define png_isaligned(ptr, type) 0
 #endif
@@ -551,92 +550,92 @@
 * are defined in png.h because they need to be visible to applications
 * that call png_set_unknown_chunk().
 */
-/* #define PNG_HAVE_IHDR            0x01U (defined in png.h) */
-/* #define PNG_HAVE_PLTE            0x02U (defined in png.h) */
-#define PNG_HAVE_IDAT               0x04U
-/* #define PNG_AFTER_IDAT           0x08U (defined in png.h) */
-#define PNG_HAVE_IEND               0x10U
-                   /*               0x20U (unused) */
-                   /*               0x40U (unused) */
-                   /*               0x80U (unused) */
-#define PNG_HAVE_CHUNK_HEADER      0x100U
-#define PNG_WROTE_tIME             0x200U
-#define PNG_WROTE_INFO_BEFORE_PLTE 0x400U
-#define PNG_BACKGROUND_IS_GRAY     0x800U
-#define PNG_HAVE_PNG_SIGNATURE    0x1000U
-#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
-                   /*             0x4000U (unused) */
-#define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
+/* #define PNG_HAVE_IHDR            0x01 (defined in png.h) */
+/* #define PNG_HAVE_PLTE            0x02 (defined in png.h) */
+#define PNG_HAVE_IDAT               0x04
+/* #define PNG_AFTER_IDAT           0x08 (defined in png.h) */
+#define PNG_HAVE_IEND               0x10
+                   /*               0x20 (unused) */
+                   /*               0x40 (unused) */
+                   /*               0x80 (unused) */
+#define PNG_HAVE_CHUNK_HEADER      0x100
+#define PNG_WROTE_tIME             0x200
+#define PNG_WROTE_INFO_BEFORE_PLTE 0x400
+#define PNG_BACKGROUND_IS_GRAY     0x800
+#define PNG_HAVE_PNG_SIGNATURE    0x1000
+#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000 /* Have another chunk after IDAT */
+                   /*             0x4000 (unused) */
+#define PNG_IS_READ_STRUCT        0x8000 /* Else is a write struct */

 /* Flags for the transformations the PNG library does on the image data */
-#define PNG_BGR                 0x0001U
-#define PNG_INTERLACE           0x0002U
-#define PNG_PACK                0x0004U
-#define PNG_SHIFT               0x0008U
-#define PNG_SWAP_BYTES          0x0010U
-#define PNG_INVERT_MONO         0x0020U
-#define PNG_QUANTIZE            0x0040U
-#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
-#define PNG_BACKGROUND_EXPAND   0x0100U
-#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
-#define PNG_16_TO_8             0x0400U    /* Becomes 'chop' in 1.5.4 */
-#define PNG_RGBA                0x0800U
-#define PNG_EXPAND              0x1000U
-#define PNG_GAMMA               0x2000U
-#define PNG_GRAY_TO_RGB         0x4000U
-#define PNG_FILLER              0x8000U
-#define PNG_PACKSWAP           0x10000U
-#define PNG_SWAP_ALPHA         0x20000U
-#define PNG_STRIP_ALPHA        0x40000U
-#define PNG_INVERT_ALPHA       0x80000U
-#define PNG_USER_TRANSFORM    0x100000U
-#define PNG_RGB_TO_GRAY_ERR   0x200000U
-#define PNG_RGB_TO_GRAY_WARN  0x400000U
-#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
-#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
-#define PNG_ADD_ALPHA        0x1000000U /* Added to libpng-1.2.7 */
-#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
-#define PNG_SCALE_16_TO_8    0x4000000U /* Added to libpng-1.5.4 */
-                       /*    0x8000000U unused */
-                       /*   0x10000000U unused */
-                       /*   0x20000000U unused */
-                       /*   0x40000000U unused */
+#define PNG_BGR                 0x0001
+#define PNG_INTERLACE           0x0002
+#define PNG_PACK                0x0004
+#define PNG_SHIFT               0x0008
+#define PNG_SWAP_BYTES          0x0010
+#define PNG_INVERT_MONO         0x0020
+#define PNG_QUANTIZE            0x0040
+#define PNG_COMPOSE             0x0080     /* Was PNG_BACKGROUND */
+#define PNG_BACKGROUND_EXPAND   0x0100
+#define PNG_EXPAND_16           0x0200     /* Added to libpng 1.5.2 */
+#define PNG_16_TO_8             0x0400     /* Becomes 'chop' in 1.5.4 */
+#define PNG_RGBA                0x0800
+#define PNG_EXPAND              0x1000
+#define PNG_GAMMA               0x2000
+#define PNG_GRAY_TO_RGB         0x4000
+#define PNG_FILLER              0x8000
+#define PNG_PACKSWAP           0x10000
+#define PNG_SWAP_ALPHA         0x20000
+#define PNG_STRIP_ALPHA        0x40000
+#define PNG_INVERT_ALPHA       0x80000
+#define PNG_USER_TRANSFORM    0x100000
+#define PNG_RGB_TO_GRAY_ERR   0x200000
+#define PNG_RGB_TO_GRAY_WARN  0x400000
+#define PNG_RGB_TO_GRAY       0x600000 /* two bits, RGB_TO_GRAY_ERR|WARN */
+#define PNG_ENCODE_ALPHA      0x800000 /* Added to libpng-1.5.4 */
+#define PNG_ADD_ALPHA        0x1000000 /* Added to libpng-1.2.7 */
+#define PNG_EXPAND_tRNS      0x2000000 /* Added to libpng-1.2.9 */
+#define PNG_SCALE_16_TO_8    0x4000000 /* Added to libpng-1.5.4 */
+                       /*    0x8000000 unused */
+                       /*   0x10000000 unused */
+                       /*   0x20000000 unused */
+                       /*   0x40000000 unused */
 /* Flags for png_create_struct */
-#define PNG_STRUCT_PNG   0x0001U
-#define PNG_STRUCT_INFO  0x0002U
+#define PNG_STRUCT_PNG   0x0001
+#define PNG_STRUCT_INFO  0x0002

 /* Flags for the png_ptr->flags rather than declaring a byte for each one */
-#define PNG_FLAG_ZLIB_CUSTOM_STRATEGY     0x0001U
-#define PNG_FLAG_ZSTREAM_INITIALIZED      0x0002U /* Added to libpng-1.6.0 */
-                                  /*      0x0004U    unused */
-#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
-                                  /*      0x0010U    unused */
-                                  /*      0x0020U    unused */
-#define PNG_FLAG_ROW_INIT                 0x0040U
-#define PNG_FLAG_FILLER_AFTER             0x0080U
-#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
-#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
-#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
-#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
-#define PNG_FLAG_ASSUME_sRGB              0x1000U /* Added to libpng-1.5.4 */
-#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
-#define PNG_FLAG_DETECT_UNINITIALIZED     0x4000U /* Added to libpng-1.5.4 */
-/* #define PNG_FLAG_KEEP_UNKNOWN_CHUNKS      0x8000U */
-/* #define PNG_FLAG_KEEP_UNSAFE_CHUNKS      0x10000U */
-#define PNG_FLAG_LIBRARY_MISMATCH        0x20000U
-#define PNG_FLAG_STRIP_ERROR_NUMBERS     0x40000U
-#define PNG_FLAG_STRIP_ERROR_TEXT        0x80000U
-#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
-#define PNG_FLAG_APP_WARNINGS_WARN      0x200000U /* Added to libpng-1.6.0 */
-#define PNG_FLAG_APP_ERRORS_WARN        0x400000U /* Added to libpng-1.6.0 */
-                                  /*    0x800000U    unused */
-                                  /*   0x1000000U    unused */
-                                  /*   0x2000000U    unused */
-                                  /*   0x4000000U    unused */
-                                  /*   0x8000000U    unused */
-                                  /*  0x10000000U    unused */
-                                  /*  0x20000000U    unused */
-                                  /*  0x40000000U    unused */
+#define PNG_FLAG_ZLIB_CUSTOM_STRATEGY     0x0001
+#define PNG_FLAG_ZSTREAM_INITIALIZED      0x0002 /* Added to libpng-1.6.0 */
+                                  /*      0x0004    unused */
+#define PNG_FLAG_ZSTREAM_ENDED            0x0008 /* Added to libpng-1.6.0 */
+                                  /*      0x0010    unused */
+                                  /*      0x0020    unused */
+#define PNG_FLAG_ROW_INIT                 0x0040
+#define PNG_FLAG_FILLER_AFTER             0x0080
+#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100
+#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200
+#define PNG_FLAG_CRC_CRITICAL_USE         0x0400
+#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800
+#define PNG_FLAG_ASSUME_sRGB              0x1000 /* Added to libpng-1.5.4 */
+#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000 /* Added to libpng-1.5.4 */
+#define PNG_FLAG_DETECT_UNINITIALIZED     0x4000 /* Added to libpng-1.5.4 */
+/* #define PNG_FLAG_KEEP_UNKNOWN_CHUNKS      0x8000 */
+/* #define PNG_FLAG_KEEP_UNSAFE_CHUNKS      0x10000 */
+#define PNG_FLAG_LIBRARY_MISMATCH        0x20000
+#define PNG_FLAG_STRIP_ERROR_NUMBERS     0x40000
+#define PNG_FLAG_STRIP_ERROR_TEXT        0x80000
+#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000 /* Added to libpng-1.4.0 */
+#define PNG_FLAG_APP_WARNINGS_WARN      0x200000 /* Added to libpng-1.6.0 */
+#define PNG_FLAG_APP_ERRORS_WARN        0x400000 /* Added to libpng-1.6.0 */
+                                  /*    0x800000    unused */
+                                  /*   0x1000000    unused */
+                                  /*   0x2000000    unused */
+                                  /*   0x4000000    unused */
+                                  /*   0x8000000    unused */
+                                  /*  0x10000000    unused */
+                                  /*  0x20000000    unused */
+                                  /*  0x40000000    unused */

 #define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
@@ -670,24 +669,6 @@
    ((png_size_t)(width) * (((png_size_t)(pixel_bits)) >> 3)) : \
    (( ((png_size_t)(width) * ((png_size_t)(pixel_bits))) + 7) >> 3) )

-/* This returns the number of trailing bits in the last byte of a row, 0 if the
- * last byte is completely full of pixels.  It is, in principle, (pixel_bits x
- * width) % 8, but that would overflow for large 'width'.  The second macro is
- * the same except that it returns the number of unused bits in the last byte;
- * (8-TRAILBITS), but 0 when TRAILBITS is 0.
- *
- * NOTE: these macros are intended to be self-evidently correct and never
- * overflow on the assumption that pixel_bits is in the range 0..255.  The
- * arguments are evaluated only once and they can be signed (e.g. as a result of
- * the integral promotions).  The result of the expression always has type
- * (png_uint_32), however the compiler always knows it is in the range 0..7.
- */
-#define PNG_TRAILBITS(pixel_bits, width) \
-    (((pixel_bits) * ((width) % (png_uint_32)8)) % 8)
-
-#define PNG_PADBITS(pixel_bits, width) \
-    ((8 - PNG_TRAILBITS(pixel_bits, width)) % 8)
-
 /* PNG_OUT_OF_RANGE returns true if value is outside the range
 * ideal-delta..ideal+delta.  Each argument is evaluated twice.
 * "ideal" and "delta" should be constants, normally simple
@@ -1282,7 +1263,7 @@ PNG_INTERNAL_FUNCTION(void,png_read_finish_row,(png_structrp png_ptr),
 /* Initialize the row buffers, etc. */
 PNG_INTERNAL_FUNCTION(void,png_read_start_row,(png_structrp png_ptr),PNG_EMPTY);

-#if ZLIB_VERNUM >= 0x1240
+#if PNG_ZLIB_VERNUM >= 0x1240
 PNG_INTERNAL_FUNCTION(int,png_zlib_inflate,(png_structrp png_ptr, int flush),
      PNG_EMPTY);
 #  define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush)
--- a/pngread.c
+++ b/pngread.c
@@ -1,7 +1,7 @@

 /* pngread.c - read a PNG file
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.24 [August 4, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -359,9 +359,9 @@ png_do_read_intrapixel(png_row_infop row_info, png_bytep row)

         for (i = 0, rp = row; i < row_width; i++, rp += bytes_per_pixel)
         {
-            png_uint_32 s0   = (png_uint_32)(*(rp    ) << 8) | *(rp + 1);
-            png_uint_32 s1   = (png_uint_32)(*(rp + 2) << 8) | *(rp + 3);
-            png_uint_32 s2   = (png_uint_32)(*(rp + 4) << 8) | *(rp + 5);
+            png_uint_32 s0   = (*(rp    ) << 8) | *(rp + 1);
+            png_uint_32 s1   = (*(rp + 2) << 8) | *(rp + 3);
+            png_uint_32 s2   = (*(rp + 4) << 8) | *(rp + 5);
            png_uint_32 red  = (s0 + s1 + 65536) & 0xffff;
            png_uint_32 blue = (s2 + s1 + 65536) & 0xffff;
            *(rp    ) = (png_byte)((red >> 8) & 0xff);
@@ -1393,9 +1393,7 @@ png_image_read_header(png_voidp argument)
   png_structrp png_ptr = image->opaque->png_ptr;
   png_inforp info_ptr = image->opaque->info_ptr;

-#ifdef PNG_BENIGN_ERRORS_SUPPORTED
   png_set_benign_errors(png_ptr, 1/*warn*/);
-#endif
   png_read_info(png_ptr, info_ptr);

   /* Do this the fast way; just read directly out of png_struct. */
@@ -1433,7 +1431,7 @@ png_image_read_header(png_voidp argument)
            break;

         case PNG_COLOR_TYPE_PALETTE:
-            cmap_entries = (png_uint_32)png_ptr->num_palette;
+            cmap_entries = png_ptr->num_palette;
            break;

         default:
@@ -1968,7 +1966,7 @@ make_gray_file_colormap(png_image_read_control *display)
   for (i=0; i<256; ++i)
      png_create_colormap_entry(display, i, i, i, i, 255, P_FILE);

-   return (int)i;
+   return i;
 }

 static int
@@ -1979,7 +1977,7 @@ make_gray_colormap(png_image_read_control *display)
   for (i=0; i<256; ++i)
      png_create_colormap_entry(display, i, i, i, i, 255, P_sRGB);

-   return (int)i;
+   return i;
 }
 #define PNG_GRAY_COLORMAP_ENTRIES 256

@@ -2033,7 +2031,7 @@ make_ga_colormap(png_image_read_control *display)
             P_sRGB);
   }

-   return (int)i;
+   return i;
 }

 #define PNG_GA_COLORMAP_ENTRIES 256
@@ -2058,7 +2056,7 @@ make_rgb_colormap(png_image_read_control *display)
      }
   }

-   return (int)i;
+   return i;
 }

 #define PNG_RGB_COLORMAP_ENTRIES 216
@@ -2251,7 +2249,7 @@ png_image_read_colormap(png_voidp argument)
            if (PNG_GRAY_COLORMAP_ENTRIES > image->colormap_entries)
               png_error(png_ptr, "gray[16] color-map: too few entries");

-            cmap_entries = (unsigned int)make_gray_colormap(display);
+            cmap_entries = make_gray_colormap(display);

            if (png_ptr->num_trans > 0)
            {
@@ -2349,7 +2347,7 @@ png_image_read_colormap(png_voidp argument)
            if (PNG_GA_COLORMAP_ENTRIES > image->colormap_entries)
               png_error(png_ptr, "gray+alpha color-map: too few entries");

-            cmap_entries = (unsigned int)make_ga_colormap(display);
+            cmap_entries = make_ga_colormap(display);

            background_index = PNG_CMAP_GA_BACKGROUND;
            output_processing = PNG_CMAP_GA;
@@ -2383,7 +2381,7 @@ png_image_read_colormap(png_voidp argument)
               if (PNG_GRAY_COLORMAP_ENTRIES > image->colormap_entries)
                  png_error(png_ptr, "gray-alpha color-map: too few entries");

-               cmap_entries = (unsigned int)make_gray_colormap(display);
+               cmap_entries = make_gray_colormap(display);

               if (output_encoding == P_LINEAR)
               {
@@ -2522,7 +2520,7 @@ png_image_read_colormap(png_voidp argument)
               if (PNG_GA_COLORMAP_ENTRIES > image->colormap_entries)
                  png_error(png_ptr, "rgb[ga] color-map: too few entries");

-               cmap_entries = (unsigned int)make_ga_colormap(display);
+               cmap_entries = make_ga_colormap(display);
               background_index = PNG_CMAP_GA_BACKGROUND;
               output_processing = PNG_CMAP_GA;
            }
@@ -2548,12 +2546,12 @@ png_image_read_colormap(png_voidp argument)
                  png_ptr->num_trans > 0) &&
                  png_gamma_not_sRGB(png_ptr->colorspace.gamma) != 0)
               {
-                  cmap_entries = (unsigned int)make_gray_file_colormap(display);
+                  cmap_entries = make_gray_file_colormap(display);
                  data_encoding = P_FILE;
               }

               else
-                  cmap_entries = (unsigned int)make_gray_colormap(display);
+                  cmap_entries = make_gray_colormap(display);

               /* But if the input has alpha or transparency it must be removed
                */
@@ -2641,7 +2639,7 @@ png_image_read_colormap(png_voidp argument)
                  if (PNG_RGB_COLORMAP_ENTRIES+1+27 > image->colormap_entries)
                     png_error(png_ptr, "rgb+alpha color-map: too few entries");

-                  cmap_entries = (unsigned int)make_rgb_colormap(display);
+                  cmap_entries = make_rgb_colormap(display);

                  /* Add a transparent entry. */
                  png_create_colormap_entry(display, cmap_entries, 255, 255,
@@ -2690,7 +2688,7 @@ png_image_read_colormap(png_voidp argument)
                  if (PNG_RGB_COLORMAP_ENTRIES+1+27 > image->colormap_entries)
                     png_error(png_ptr, "rgb-alpha color-map: too few entries");

-                  cmap_entries = (unsigned int)make_rgb_colormap(display);
+                  cmap_entries = make_rgb_colormap(display);

                  png_create_colormap_entry(display, cmap_entries, back_r,
                      back_g, back_b, 0/*unused*/, output_encoding);
@@ -2775,7 +2773,7 @@ png_image_read_colormap(png_voidp argument)
               if (PNG_RGB_COLORMAP_ENTRIES > image->colormap_entries)
                  png_error(png_ptr, "rgb color-map: too few entries");

-               cmap_entries = (unsigned int)make_rgb_colormap(display);
+               cmap_entries = make_rgb_colormap(display);
               output_processing = PNG_CMAP_RGB;
            }
         }
@@ -2799,11 +2797,11 @@ png_image_read_colormap(png_voidp argument)

            output_processing = PNG_CMAP_NONE;
            data_encoding = P_FILE; /* Don't change from color-map indices */
-            cmap_entries = (unsigned int)png_ptr->num_palette;
+            cmap_entries = png_ptr->num_palette;
            if (cmap_entries > 256)
               cmap_entries = 256;

-            if (cmap_entries > (unsigned int)image->colormap_entries)
+            if (cmap_entries > image->colormap_entries)
               png_error(png_ptr, "palette color-map: too few entries");

            for (i=0; i < cmap_entries; ++i)
@@ -2915,7 +2913,7 @@ png_image_read_colormap(png_voidp argument)
         png_error(png_ptr, "bad background index (internal error)");
   }

-   display->colormap_processing = (int)output_processing;
+   display->colormap_processing = output_processing;

   return 1/*ok*/;
 }
@@ -3224,14 +3222,14 @@ png_image_read_colormapped(png_voidp argument)

   else
   {
-      png_alloc_size_t row_bytes = (png_alloc_size_t)display->row_bytes;
+      png_alloc_size_t row_bytes = display->row_bytes;

      while (--passes >= 0)
      {
         png_uint_32      y = image->height;
         png_bytep        row = png_voidcast(png_bytep, display->first_row);

-         for (; y > 0; --y)
+         while (y-- > 0)
         {
            png_read_row(png_ptr, row, NULL);
            row += row_bytes;
@@ -3559,9 +3557,8 @@ png_image_read_background(png_voidp argument)
             * stride which was multiplied by 2 (below) to get row_bytes.
             */
            ptrdiff_t    step_row = display->row_bytes / 2;
-            unsigned int preserve_alpha = (image->format &
-                PNG_FORMAT_FLAG_ALPHA) != 0;
-            unsigned int outchannels = 1U+preserve_alpha;
+            int preserve_alpha = (image->format & PNG_FORMAT_FLAG_ALPHA) != 0;
+            unsigned int outchannels = 1+preserve_alpha;
            int swap_alpha = 0;

 #           ifdef PNG_SIMPLIFIED_READ_AFIRST_SUPPORTED
@@ -4058,14 +4055,14 @@ png_image_read_direct(png_voidp argument)

   else
   {
-      png_alloc_size_t row_bytes = (png_alloc_size_t)display->row_bytes;
+      png_alloc_size_t row_bytes = display->row_bytes;

      while (--passes >= 0)
      {
         png_uint_32      y = image->height;
         png_bytep        row = png_voidcast(png_bytep, display->first_row);

-         for (; y > 0; --y)
+         while (y-- > 0)
         {
            png_read_row(png_ptr, row, NULL);
            row += row_bytes;
@@ -4094,7 +4091,7 @@ png_image_finish_read(png_imagep image, png_const_colorp background,
       * bits; this is just to verify that the 'row_stride' argument can be
       * represented.
       */
-      if (image->width <= 0x7fffffffU/channels) /* no overflow */
+      if (image->width <= 0x7FFFFFFFU/channels) /* no overflow */
      {
         png_uint_32 check;
         const png_uint_32 png_row_stride = image->width * channels;
@@ -4103,10 +4100,10 @@ png_image_finish_read(png_imagep image, png_const_colorp background,
            row_stride = (png_int_32)/*SAFE*/png_row_stride;

         if (row_stride < 0)
-            check = (png_uint_32)(-row_stride);
+            check = -row_stride;

         else
-            check = (png_uint_32)row_stride;
+            check = row_stride;

         /* This verifies 'check', the absolute value of the actual stride
          * passed in and detects overflow in the application calculation (i.e.
@@ -4131,7 +4128,7 @@ png_image_finish_read(png_imagep image, png_const_colorp background,
             * accomodated on 64-bit systems.
             */
            if (image->height <=
-                0xffffffffU/PNG_IMAGE_PIXEL_COMPONENT_SIZE(image->format)/check)
+                0xFFFFFFFFU/PNG_IMAGE_PIXEL_COMPONENT_SIZE(image->format)/check)
            {
               if ((image->format & PNG_FORMAT_FLAG_COLORMAP) == 0 ||
                  (image->colormap_entries > 0 && colormap != NULL))
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -429,7 +429,7 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,
      int i;

      png_ptr->quantize_index = (png_bytep)png_malloc(png_ptr,
-          (png_uint_32)((png_uint_32)num_palette * (sizeof (png_byte))));
+          (png_uint_32)(num_palette * (sizeof (png_byte))));
      for (i = 0; i < num_palette; i++)
         png_ptr->quantize_index[i] = (png_byte)i;
   }
@@ -446,7 +446,7 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,

         /* Initialize an array to sort colors */
         png_ptr->quantize_sort = (png_bytep)png_malloc(png_ptr,
-             (png_uint_32)((png_uint_32)num_palette * (sizeof (png_byte))));
+             (png_uint_32)(num_palette * (sizeof (png_byte))));

         /* Initialize the quantize_sort array */
         for (i = 0; i < num_palette; i++)
@@ -580,9 +580,9 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,

         /* Initialize palette index arrays */
         png_ptr->index_to_palette = (png_bytep)png_malloc(png_ptr,
-             (png_uint_32)((png_uint_32)num_palette * (sizeof (png_byte))));
+             (png_uint_32)(num_palette * (sizeof (png_byte))));
         png_ptr->palette_to_index = (png_bytep)png_malloc(png_ptr,
-             (png_uint_32)((png_uint_32)num_palette * (sizeof (png_byte))));
+             (png_uint_32)(num_palette * (sizeof (png_byte))));

         /* Initialize the sort array */
         for (i = 0; i < num_palette; i++)
@@ -2150,7 +2150,7 @@ png_do_unpack(png_row_infop row_info, png_bytep row)
         {
            png_bytep sp = row + (png_size_t)((row_width - 1) >> 3);
            png_bytep dp = row + (png_size_t)row_width - 1;
-            png_uint_32 shift = 7U - ((row_width + 7U) & 0x07);
+            png_uint_32 shift = 7 - (int)((row_width + 7) & 0x07);
            for (i = 0; i < row_width; i++)
            {
               *dp = (png_byte)((*sp >> shift) & 0x01);
@@ -2174,7 +2174,7 @@ png_do_unpack(png_row_infop row_info, png_bytep row)

            png_bytep sp = row + (png_size_t)((row_width - 1) >> 2);
            png_bytep dp = row + (png_size_t)row_width - 1;
-            png_uint_32 shift = ((3U - ((row_width + 3U) & 0x03)) << 1);
+            png_uint_32 shift = (int)((3 - ((row_width + 3) & 0x03)) << 1);
            for (i = 0; i < row_width; i++)
            {
               *dp = (png_byte)((*sp >> shift) & 0x03);
@@ -2197,7 +2197,7 @@ png_do_unpack(png_row_infop row_info, png_bytep row)
         {
            png_bytep sp = row + (png_size_t)((row_width - 1) >> 1);
            png_bytep dp = row + (png_size_t)row_width - 1;
-            png_uint_32 shift = ((1U - ((row_width + 1U) & 0x01)) << 2);
+            png_uint_32 shift = (int)((1 - ((row_width + 1) & 0x01)) << 2);
            for (i = 0; i < row_width; i++)
            {
               *dp = (png_byte)((*sp >> shift) & 0x0f);
@@ -3223,8 +3223,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                        == png_ptr->trans_color.gray)
                     {
                        unsigned int tmp = *sp & (0x7f7f >> (7 - shift));
-                        tmp |=
-                            (unsigned int)(png_ptr->background.gray << shift);
+                        tmp |= png_ptr->background.gray << shift;
                        *sp = (png_byte)(tmp & 0xff);
                     }

@@ -3253,8 +3252,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                            == png_ptr->trans_color.gray)
                        {
                           unsigned int tmp = *sp & (0x3f3f >> (6 - shift));
-                           tmp |=
-                              (unsigned int)png_ptr->background.gray << shift;
+                           tmp |= png_ptr->background.gray << shift;
                           *sp = (png_byte)(tmp & 0xff);
                        }

@@ -3264,7 +3262,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                           unsigned int g = (gamma_table [p | (p << 2) |
                               (p << 4) | (p << 6)] >> 6) & 0x03;
                           unsigned int tmp = *sp & (0x3f3f >> (6 - shift));
-                           tmp |= (unsigned int)(g << shift);
+                           tmp |= g << shift;
                           *sp = (png_byte)(tmp & 0xff);
                        }

@@ -3290,8 +3288,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                            == png_ptr->trans_color.gray)
                        {
                           unsigned int tmp = *sp & (0x3f3f >> (6 - shift));
-                           tmp |=
-                               (unsigned int)png_ptr->background.gray << shift;
+                           tmp |= png_ptr->background.gray << shift;
                           *sp = (png_byte)(tmp & 0xff);
                        }

@@ -3321,8 +3318,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                            == png_ptr->trans_color.gray)
                        {
                           unsigned int tmp = *sp & (0x0f0f >> (4 - shift));
-                           tmp |= 
-                              (unsigned int)(png_ptr->background.gray << shift);
+                           tmp |= png_ptr->background.gray << shift;
                           *sp = (png_byte)(tmp & 0xff);
                        }

@@ -3332,7 +3328,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                           unsigned int g = (gamma_table[p | (p << 4)] >> 4) &
                              0x0f;
                           unsigned int tmp = *sp & (0x0f0f >> (4 - shift));
-                           tmp |= (unsigned int)(g << shift);
+                           tmp |= g << shift;
                           *sp = (png_byte)(tmp & 0xff);
                        }

@@ -3358,8 +3354,7 @@ png_do_compose(png_row_infop row_info, png_bytep row, png_structrp png_ptr)
                            == png_ptr->trans_color.gray)
                        {
                           unsigned int tmp = *sp & (0x0f0f >> (4 - shift));
-                           tmp |=
-                              (unsigned int)(png_ptr->background.gray << shift);
+                           tmp |= png_ptr->background.gray << shift;
                           *sp = (png_byte)(tmp & 0xff);
                        }

--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,7 +1,7 @@

 /* pngrutil.c - utilities to read a PNG file
 *
- * Last changed in libpng 1.6.27 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.25 [September 1, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -86,7 +86,7 @@ png_get_int_32)(png_const_bytep buf)
 {
   png_uint_32 uval = png_get_uint_32(buf);
   if ((uval & 0x80000000) == 0) /* non-negative */
-      return (png_int_32)uval;
+      return uval;

   uval = (uval ^ 0xffffffff) + 1;  /* 2's complement: -x = ~x+1 */
   if ((uval & 0x80000000) == 0) /* no overflow */
@@ -370,10 +370,11 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
    */
   {
      int ret; /* zlib return code */
-#if ZLIB_VERNUM >= 0x1240
-      int window_bits = 0;
+#if PNG_ZLIB_VERNUM >= 0x1240

 # if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW)
+      int window_bits;
+
      if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & 3) ==
          PNG_OPTION_ON)
      {
@@ -383,11 +384,13 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)

      else
      {
+         window_bits = 0;
         png_ptr->zstream_start = 1;
      }
+# else
+#   define window_bits 0
 # endif
-
-#endif /* ZLIB_VERNUM >= 0x1240 */
+#endif

      /* Set this for safety, just in case the previous owner left pointers to
       * memory allocations.
@@ -399,32 +402,25 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)

      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
      {
-#if ZLIB_VERNUM >= 0x1240
-         ret = inflateReset2(&png_ptr->zstream, window_bits);
-#else
+#if PNG_ZLIB_VERNUM < 0x1240
         ret = inflateReset(&png_ptr->zstream);
+#else
+         ret = inflateReset2(&png_ptr->zstream, window_bits);
 #endif
      }

      else
      {
-#if ZLIB_VERNUM >= 0x1240
-         ret = inflateInit2(&png_ptr->zstream, window_bits);
-#else
+#if PNG_ZLIB_VERNUM < 0x1240
         ret = inflateInit(&png_ptr->zstream);
+#else
+         ret = inflateInit2(&png_ptr->zstream, window_bits);
 #endif

         if (ret == Z_OK)
            png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED;
      }

-#if ZLIB_VERNUM >= 0x1281
-      /* Turn off validation of the ADLER32 checksum in IDAT chunks */
-      if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0 &&
-          png_ptr->zowner == png_IDAT)
-         ret = inflateValidate(&png_ptr->zstream, 0);
-#endif
-
      if (ret == Z_OK)
         png_ptr->zowner = owner;

@@ -439,7 +435,7 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
 #endif
 }

-#if ZLIB_VERNUM >= 0x1240
+#if PNG_ZLIB_VERNUM >= 0x1240
 /* Handle the start of the inflate stream if we called inflateInit2(strm,0);
 * in this case some zlib versions skip validation of the CINFO field and, in
 * certain circumstances, libpng may end up displaying an invalid image, in
@@ -1015,7 +1011,7 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
 #endif
   {
-      png_crc_finish(png_ptr, (png_uint_32) (length - (unsigned int)num * 3));
+      png_crc_finish(png_ptr, (int) length - num * 3);
   }

 #ifndef PNG_READ_OPT_PLTE_SUPPORTED
@@ -1721,13 +1717,13 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
   data_length = length - (png_uint_32)(entry_start - buffer);

   /* Integrity-check the data length */
-   if ((data_length % (unsigned int)entry_size) != 0)
+   if ((data_length % entry_size) != 0)
   {
      png_warning(png_ptr, "sPLT chunk has bad length");
      return;
   }

-   dl = (png_uint_32)(data_length / (unsigned int)entry_size);
+   dl = (png_int_32)(data_length / entry_size);
   max_dl = PNG_SIZE_MAX / (sizeof (png_sPLT_entry));

   if (dl > max_dl)
@@ -1736,10 +1732,10 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
      return;
   }

-   new_palette.nentries = (png_int_32)(data_length / (unsigned int)entry_size);
+   new_palette.nentries = (png_int_32)(data_length / entry_size);

-   new_palette.entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
-       (png_alloc_size_t) new_palette.nentries * (sizeof (png_sPLT_entry)));
+   new_palette.entries = (png_sPLT_entryp)png_malloc_warn(
+       png_ptr, new_palette.nentries * (sizeof (png_sPLT_entry)));

   if (new_palette.entries == NULL)
   {
@@ -3103,7 +3099,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
 #     ifdef PNG_READ_PACKSWAP_SUPPORTED
      if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
         /* little-endian byte */
-         end_mask = (unsigned int)(0xff << end_mask);
+         end_mask = 0xff << end_mask;

      else /* big-endian byte */
 #     endif
@@ -3549,7 +3545,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
 {
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
   /* Offset to next interlace block */
-   static PNG_CONST unsigned int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
+   static PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};

   png_debug(1, "in png_do_read_interlace");
   if (row != NULL && row_info != NULL)
@@ -3564,10 +3560,9 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
         {
            png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 3);
            png_bytep dp = row + (png_size_t)((final_width - 1) >> 3);
-            unsigned int sshift, dshift;
-            unsigned int s_start, s_end;
-            int s_inc;
-            int jstop = (int)png_pass_inc[pass];
+            int sshift, dshift;
+            int s_start, s_end, s_inc;
+            int jstop = png_pass_inc[pass];
            png_byte v;
            png_uint_32 i;
            int j;
@@ -3575,8 +3570,8 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
 #ifdef PNG_READ_PACKSWAP_SUPPORTED
            if ((transformations & PNG_PACKSWAP) != 0)
            {
-                sshift = ((row_info->width + 7) & 0x07);
-                dshift = ((final_width + 7) & 0x07);
+                sshift = (int)((row_info->width + 7) & 0x07);
+                dshift = (int)((final_width + 7) & 0x07);
                s_start = 7;
                s_end = 0;
                s_inc = -1;
@@ -3585,8 +3580,8 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
            else
 #endif
            {
-                sshift = 7 - ((row_info->width + 7) & 0x07);
-                dshift = 7 - ((final_width + 7) & 0x07);
+                sshift = 7 - (int)((row_info->width + 7) & 0x07);
+                dshift = 7 - (int)((final_width + 7) & 0x07);
                s_start = 0;
                s_end = 7;
                s_inc = 1;
@@ -3598,7 +3593,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
               for (j = 0; j < jstop; j++)
               {
                  unsigned int tmp = *dp & (0x7f7f >> (7 - dshift));
-                  tmp |= (unsigned int)(v << dshift);
+                  tmp |= v << dshift;
                  *dp = (png_byte)(tmp & 0xff);

                  if (dshift == s_end)
@@ -3608,7 +3603,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
                  }

                  else
-                     dshift = (unsigned int)((int)dshift + s_inc);
+                     dshift += s_inc;
               }

               if (sshift == s_end)
@@ -3618,7 +3613,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
               }

               else
-                  sshift = (unsigned int)((int)sshift + s_inc);
+                  sshift += s_inc;
            }
            break;
         }
@@ -3627,17 +3622,16 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
         {
            png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2);
            png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2);
-            unsigned int sshift, dshift;
-            unsigned int s_start, s_end;
-            int s_inc;
-            int jstop = (int)png_pass_inc[pass];
+            int sshift, dshift;
+            int s_start, s_end, s_inc;
+            int jstop = png_pass_inc[pass];
            png_uint_32 i;

 #ifdef PNG_READ_PACKSWAP_SUPPORTED
            if ((transformations & PNG_PACKSWAP) != 0)
            {
-               sshift = (((row_info->width + 3) & 0x03) << 1);
-               dshift = (((final_width + 3) & 0x03) << 1);
+               sshift = (int)(((row_info->width + 3) & 0x03) << 1);
+               dshift = (int)(((final_width + 3) & 0x03) << 1);
               s_start = 6;
               s_end = 0;
               s_inc = -2;
@@ -3646,8 +3640,8 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
            else
 #endif
            {
-               sshift = ((3 - ((row_info->width + 3) & 0x03)) << 1);
-               dshift = ((3 - ((final_width + 3) & 0x03)) << 1);
+               sshift = (int)((3 - ((row_info->width + 3) & 0x03)) << 1);
+               dshift = (int)((3 - ((final_width + 3) & 0x03)) << 1);
               s_start = 0;
               s_end = 6;
               s_inc = 2;
@@ -3662,7 +3656,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
               for (j = 0; j < jstop; j++)
               {
                  unsigned int tmp = *dp & (0x3f3f >> (6 - dshift));
-                  tmp |= (unsigned int)(v << dshift);
+                  tmp |= v << dshift;
                  *dp = (png_byte)(tmp & 0xff);

                  if (dshift == s_end)
@@ -3672,7 +3666,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
                  }

                  else
-                     dshift = (unsigned int)((int)dshift + s_inc);
+                     dshift += s_inc;
               }

               if (sshift == s_end)
@@ -3682,7 +3676,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
               }

               else
-                  sshift = (unsigned int)((int)sshift + s_inc);
+                  sshift += s_inc;
            }
            break;
         }
@@ -3691,17 +3685,16 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
         {
            png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 1);
            png_bytep dp = row + (png_size_t)((final_width - 1) >> 1);
-            unsigned int sshift, dshift;
-            unsigned int s_start, s_end;
-            int s_inc;
+            int sshift, dshift;
+            int s_start, s_end, s_inc;
            png_uint_32 i;
-            int jstop = (int)png_pass_inc[pass];
+            int jstop = png_pass_inc[pass];

 #ifdef PNG_READ_PACKSWAP_SUPPORTED
            if ((transformations & PNG_PACKSWAP) != 0)
            {
-               sshift = (((row_info->width + 1) & 0x01) << 2);
-               dshift = (((final_width + 1) & 0x01) << 2);
+               sshift = (int)(((row_info->width + 1) & 0x01) << 2);
+               dshift = (int)(((final_width + 1) & 0x01) << 2);
               s_start = 4;
               s_end = 0;
               s_inc = -4;
@@ -3710,8 +3703,8 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
            else
 #endif
            {
-               sshift = ((1 - ((row_info->width + 1) & 0x01)) << 2);
-               dshift = ((1 - ((final_width + 1) & 0x01)) << 2);
+               sshift = (int)((1 - ((row_info->width + 1) & 0x01)) << 2);
+               dshift = (int)((1 - ((final_width + 1) & 0x01)) << 2);
               s_start = 0;
               s_end = 4;
               s_inc = 4;
@@ -3725,7 +3718,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
               for (j = 0; j < jstop; j++)
               {
                  unsigned int tmp = *dp & (0xf0f >> (4 - dshift));
-                  tmp |= (unsigned int)(v << dshift);
+                  tmp |= v << dshift;
                  *dp = (png_byte)(tmp & 0xff);

                  if (dshift == s_end)
@@ -3735,7 +3728,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
                  }

                  else
-                     dshift = (unsigned int)((int)dshift + s_inc);
+                     dshift += s_inc;
               }

               if (sshift == s_end)
@@ -3745,7 +3738,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
               }

               else
-                  sshift = (unsigned int)((int)sshift + s_inc);
+                  sshift += s_inc;
            }
            break;
         }
@@ -3759,7 +3752,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,

            png_bytep dp = row + (png_size_t)(final_width - 1) * pixel_bytes;

-            int jstop = (int)png_pass_inc[pass];
+            int jstop = png_pass_inc[pass];
            png_uint_32 i;

            for (i = 0; i < row_info->width; i++)
@@ -3903,7 +3896,7 @@ static void
 png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
    png_const_bytep prev_row)
 {
-   unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
+   int bpp = (row_info->pixel_depth + 7) >> 3;
   png_bytep rp_end = row + bpp;

   /* Process the first pixel in the row completely (this is the same as 'up'
@@ -3916,7 +3909,7 @@ png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
   }

   /* Remainder */
-   rp_end = rp_end + (row_info->rowbytes - bpp);
+   rp_end += row_info->rowbytes - bpp;

   while (row < rp_end)
   {
@@ -4108,15 +4101,7 @@ png_read_IDAT_data(png_structrp png_ptr, png_bytep output,
         png_zstream_error(png_ptr, ret);

         if (output != NULL)
-         {
-            if(!strncmp(png_ptr->zstream.msg,"incorrect data check",20))
-            {
-               png_chunk_benign_error(png_ptr, "ADLER32 checksum mismatch");
-               continue;
-            }
-            else
-               png_chunk_error(png_ptr, png_ptr->zstream.msg);
-         }
+            png_chunk_error(png_ptr, png_ptr->zstream.msg);

         else /* checking */
         {
@@ -4269,7 +4254,7 @@ png_read_start_row(png_structrp png_ptr)
   /* Offset to next interlace block in the y direction */
   static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};

-   unsigned int max_pixel_depth;
+   int max_pixel_depth;
   png_size_t row_bytes;

   png_debug(1, "in png_read_start_row");
@@ -4298,7 +4283,7 @@ png_read_start_row(png_structrp png_ptr)
      png_ptr->iwidth = png_ptr->width;
   }

-   max_pixel_depth = (unsigned int)png_ptr->pixel_depth;
+   max_pixel_depth = png_ptr->pixel_depth;

   /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpler set of
    * calculations to calculate the final pixel depth, then
@@ -4433,7 +4418,7 @@ png_read_start_row(png_structrp png_ptr)
 defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
   if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
   {
-      unsigned int user_pixel_depth = png_ptr->user_transform_depth *
+      int user_pixel_depth = png_ptr->user_transform_depth *
         png_ptr->user_transform_channels;

      if (user_pixel_depth > max_pixel_depth)
@@ -4455,7 +4440,7 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
    * for safety's sake
    */
   row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
-       1 + ((max_pixel_depth + 7) >> 3U);
+       1 + ((max_pixel_depth + 7) >> 3);

 #ifdef PNG_MAX_MALLOC_64K
   if (row_bytes > (png_uint_32)65536L)
@@ -4524,7 +4509,7 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
    * does not, so free the read buffer now regardless; the sequential reader
    * reallocates it on demand.
    */
-   if (png_ptr->read_buffer != NULL)
+   if (png_ptr->read_buffer != 0)
   {
      png_bytep buffer = png_ptr->read_buffer;

--- a/pngset.c
+++ b/pngset.c
@@ -1,7 +1,7 @@

 /* pngset.c - storage of image information into info struct
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.24 [August 4, 2016]
 * Copyright (c) 1998-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -283,29 +283,17 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,

   /* Check that the type matches the specification. */
   if (type < 0 || type > 3)
-   {
-      png_chunk_report(png_ptr, "Invalid pCAL equation type",
-            PNG_CHUNK_WRITE_ERROR);
-      return;
-   }
+      png_error(png_ptr, "Invalid pCAL equation type");

   if (nparams < 0 || nparams > 255)
-   {
-      png_chunk_report(png_ptr, "Invalid pCAL parameter count",
-            PNG_CHUNK_WRITE_ERROR);
-      return;
-   }
+      png_error(png_ptr, "Invalid pCAL parameter count");

   /* Validate params[nparams] */
   for (i=0; i<nparams; ++i)
   {
      if (params[i] == NULL ||
          !png_check_fp_string(params[i], strlen(params[i])))
-      {
-         png_chunk_report(png_ptr, "Invalid format for pCAL parameter",
-               PNG_CHUNK_WRITE_ERROR);
-         return;
-      }
+         png_error(png_ptr, "Invalid format for pCAL parameter");
   }

   info_ptr->pcal_purpose = png_voidcast(png_charp,
@@ -313,8 +301,8 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,

   if (info_ptr->pcal_purpose == NULL)
   {
-      png_chunk_report(png_ptr, "Insufficient memory for pCAL purpose",
-            PNG_CHUNK_WRITE_ERROR);
+      png_warning(png_ptr, "Insufficient memory for pCAL purpose");
+
      return;
   }

@@ -343,7 +331,7 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
   memcpy(info_ptr->pcal_units, units, length);

   info_ptr->pcal_params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
-       (png_size_t)(((unsigned int)nparams + 1) * (sizeof (png_charp)))));
+       (png_size_t)((nparams + 1) * (sizeof (png_charp)))));

   if (info_ptr->pcal_params == NULL)
   {
@@ -352,8 +340,7 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
      return;
   }

-   memset(info_ptr->pcal_params, 0, ((unsigned int)nparams + 1) *
-       (sizeof (png_charp)));
+   memset(info_ptr->pcal_params, 0, (nparams + 1) * (sizeof (png_charp)));

   for (i = 0; i < nparams; i++)
   {
@@ -576,8 +563,7 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
       PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));

   if (num_palette > 0)
-      memcpy(png_ptr->palette, palette, (unsigned int)num_palette *
-          (sizeof (png_color)));
+      memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color)));
   info_ptr->palette = png_ptr->palette;
   info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;

@@ -1094,7 +1080,7 @@ png_set_sPLT(png_const_structrp png_ptr,
       * checked it when doing the allocation.
       */
      memcpy(np->entries, entries->entries,
-          (unsigned int)entries->nentries * sizeof (png_sPLT_entry));
+          entries->nentries * sizeof (png_sPLT_entry));

      /* Note that 'continue' skips the advance of the out pointer and out
       * count, so an invalid entry is not added.
@@ -1263,7 +1249,7 @@ png_set_unknown_chunk_location(png_const_structrp png_ptr, png_inforp info_ptr,
      {
         png_app_error(png_ptr, "invalid unknown chunk location");
         /* Fake out the pre 1.6.0 behavior: */
-         if (((unsigned int)location & PNG_HAVE_IDAT) != 0) /* undocumented! */
+         if ((location & PNG_HAVE_IDAT) != 0) /* undocumented! */
            location = PNG_AFTER_IDAT;

         else
@@ -1387,7 +1373,7 @@ png_set_keep_unknown_chunks(png_structrp png_ptr, int keep,
         return;
      }

-      num_chunks = (unsigned int)num_chunks_in;
+      num_chunks = num_chunks_in;
   }

   old_num_chunks = png_ptr->num_chunk_list;
@@ -1577,7 +1563,7 @@ void PNGAPI
 png_set_invalid(png_const_structrp png_ptr, png_inforp info_ptr, int mask)
 {
   if (png_ptr != NULL && info_ptr != NULL)
-      info_ptr->valid &= (unsigned int)(~mask);
+      info_ptr->valid &= ~mask;
 }


--- a/pngstruct.h
+++ b/pngstruct.h
@@ -263,7 +263,7 @@ struct png_struct_def
                              /* pixel depth used for the row buffers */
   png_byte transformed_pixel_depth;
                              /* pixel depth after read/write transforms */
-#if ZLIB_VERNUM >= 0x1240
+#if PNG_ZLIB_VERNUM >= 0x1240
   png_byte zstream_start;    /* at start of an input zlib stream */
 #endif /* Zlib >= 1.2.4 */
 #if defined(PNG_READ_FILLER_SUPPORTED) || defined(PNG_WRITE_FILLER_SUPPORTED)
--- a/pngtest.c
+++ b/pngtest.c
@@ -1,7 +1,7 @@

 /* pngtest.c - a simple test program to test libpng
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.25 [September 1, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -43,6 +43,15 @@

 #include "png.h"

+/* 1.6.1 added support for the configure test harness, which uses 77 to indicate
+ * a skipped test, in earlier versions we need to succeed on a skipped test, so:
+ */
+#if PNG_LIBPNG_VER >= 10601 && defined(HAVE_CONFIG_H)
+#  define SKIP 77
+#else
+#  define SKIP 0
+#endif
+
 /* Known chunks that exist in pngtest.png must be supported or pngtest will fail
 * simply as a result of re-ordering them.  This may be fixed in 1.7
 *
@@ -505,10 +514,10 @@ typedef struct memory_information
 typedef memory_information *memory_infop;

 static memory_infop pinformation = NULL;
-static int current_allocation = 0;
-static int maximum_allocation = 0;
-static int total_allocation = 0;
-static int num_allocations = 0;
+static png_alloc_size_t current_allocation = 0;
+static png_alloc_size_t maximum_allocation = 0;
+static png_alloc_size_t total_allocation = 0;
+static png_alloc_size_t num_allocations = 0;

 png_voidp PNGCBAPI png_debug_malloc PNGARG((png_structp png_ptr,
    png_alloc_size_t size));
@@ -595,9 +604,10 @@ png_debug_free(png_structp png_ptr, png_voidp ptr)
         if (pinfo->pointer == ptr)
         {
            *ppinfo = pinfo->next;
-            current_allocation -= pinfo->size;
-            if (current_allocation < 0)
+            if (current_allocation < pinfo->size)
               fprintf(STDERR, "Duplicate free of memory\n");
+            else
+               current_allocation -= pinfo->size;
            /* We must free the list element too, but first kill
               the memory that is to be freed. */
            memset(ptr, 0x55, pinfo->size);
@@ -929,6 +939,12 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
       read_user_chunk_callback);
 #endif

+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+#  ifdef CHUNK_LIMIT /* from the build, for testing */
+      png_set_chunk_malloc_max(read_ptr, CHUNK_LIMIT);
+#  endif /* CHUNK_LIMIT */
+#endif
+
 #ifdef PNG_SETJMP_SUPPORTED
   pngtest_debug("Setting jmpbuf for read struct");
   if (setjmp(png_jmpbuf(read_ptr)))
@@ -964,16 +980,15 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
 #endif
 #endif

-#ifdef PNG_BENIGN_ERRORS_SUPPORTED
   if (strict != 0)
   {
      /* Treat png_benign_error() as errors on read */
      png_set_benign_errors(read_ptr, 0);

-# ifdef PNG_WRITE_SUPPORTED
+#ifdef PNG_WRITE_SUPPORTED
      /* Treat them as errors on write */
      png_set_benign_errors(write_ptr, 0);
-# endif
+#endif

      /* if strict is not set, then app warnings and errors are treated as
       * warnings in release builds, but not in unstable builds; this can be
@@ -986,15 +1001,10 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
      /* Allow application (pngtest) errors and warnings to pass */
      png_set_benign_errors(read_ptr, 1);

-      /* Turn off CRC and ADLER32 checking while reading */
-      png_set_crc_action(read_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
-
-# ifdef PNG_WRITE_SUPPORTED
+#ifdef PNG_WRITE_SUPPORTED
      png_set_benign_errors(write_ptr, 1);
-# endif
-
+#endif
   }
-#endif /* BENIGN_ERRORS */

   pngtest_debug("Initializing input and output streams");
 #ifdef PNG_STDIO_SUPPORTED
@@ -1392,11 +1402,6 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)
   png_write_info(write_ptr, write_info_ptr);

   write_chunks(write_ptr, before_IDAT); /* after PLTE */
-
-#ifdef PNG_COMPRESSION_COMPAT
-   /* Test the 'compatibility' setting here, if it is available. */
-   png_set_compression(write_ptr, PNG_COMPRESSION_COMPAT);
-#endif
 #endif

 #ifdef SINGLE_ROWBUF_ALLOC
@@ -1878,7 +1883,7 @@ main(int argc, char *argv[])
   {
      int i;
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-      int allocation_now = current_allocation;
+      png_alloc_size_t allocation_now = current_allocation;
 #endif
      for (i=2; i<argc; ++i)
      {
@@ -1911,15 +1916,15 @@ main(int argc, char *argv[])
         }
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
         if (allocation_now != current_allocation)
-            fprintf(STDERR, "MEMORY ERROR: %d bytes lost\n",
-                current_allocation - allocation_now);
+            fprintf(STDERR, "MEMORY ERROR: %lu bytes lost\n",
+                (unsigned long)(current_allocation - allocation_now));

         if (current_allocation != 0)
         {
            memory_infop pinfo = pinformation;

-            fprintf(STDERR, "MEMORY ERROR: %d bytes still allocated\n",
-                current_allocation);
+            fprintf(STDERR, "MEMORY ERROR: %lu bytes still allocated\n",
+                (unsigned long)current_allocation);

            while (pinfo != NULL)
            {
@@ -1932,14 +1937,14 @@ main(int argc, char *argv[])
 #endif
      }
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-         fprintf(STDERR, " Current memory allocation: %10d bytes\n",
-             current_allocation);
-         fprintf(STDERR, " Maximum memory allocation: %10d bytes\n",
-             maximum_allocation);
-         fprintf(STDERR, " Total   memory allocation: %10d bytes\n",
-             total_allocation);
-         fprintf(STDERR, "     Number of allocations: %10d\n",
-             num_allocations);
+         fprintf(STDERR, " Current memory allocation: %20lu bytes\n",
+             (unsigned long)current_allocation);
+         fprintf(STDERR, " Maximum memory allocation: %20lu bytes\n",
+             (unsigned long) maximum_allocation);
+         fprintf(STDERR, " Total   memory allocation: %20lu bytes\n",
+             (unsigned long)total_allocation);
+         fprintf(STDERR, "     Number of allocations: %20lu\n",
+             (unsigned long)num_allocations);
 #endif
   }

@@ -1950,7 +1955,7 @@ main(int argc, char *argv[])
      {
         int kerror;
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-         int allocation_now = current_allocation;
+         png_alloc_size_t allocation_now = current_allocation;
 #endif
         if (i == 1)
            status_dots_requested = 1;
@@ -2000,15 +2005,15 @@ main(int argc, char *argv[])
         }
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
         if (allocation_now != current_allocation)
-             fprintf(STDERR, "MEMORY ERROR: %d bytes lost\n",
-                 current_allocation - allocation_now);
+             fprintf(STDERR, "MEMORY ERROR: %lu bytes lost\n",
+                 (unsigned long)(current_allocation - allocation_now));

         if (current_allocation != 0)
         {
             memory_infop pinfo = pinformation;

-             fprintf(STDERR, "MEMORY ERROR: %d bytes still allocated\n",
-                 current_allocation);
+             fprintf(STDERR, "MEMORY ERROR: %lu bytes still allocated\n",
+                 (unsigned long)current_allocation);

             while (pinfo != NULL)
             {
@@ -2020,14 +2025,14 @@ main(int argc, char *argv[])
 #endif
       }
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-       fprintf(STDERR, " Current memory allocation: %10d bytes\n",
-           current_allocation);
-       fprintf(STDERR, " Maximum memory allocation: %10d bytes\n",
-           maximum_allocation);
-       fprintf(STDERR, " Total   memory allocation: %10d bytes\n",
-           total_allocation);
-       fprintf(STDERR, "     Number of allocations: %10d\n",
-           num_allocations);
+       fprintf(STDERR, " Current memory allocation: %20lu bytes\n",
+           (unsigned long)current_allocation);
+       fprintf(STDERR, " Maximum memory allocation: %20lu bytes\n",
+           (unsigned long)maximum_allocation);
+       fprintf(STDERR, " Total   memory allocation: %20lu bytes\n",
+           (unsigned long)total_allocation);
+       fprintf(STDERR, "     Number of allocations: %20lu\n",
+           (unsigned long)num_allocations);
 #endif
   }

@@ -2078,9 +2083,9 @@ main(void)
   fprintf(STDERR,
       " test ignored because libpng was not built with read support\n");
   /* And skip this test */
-   return PNG_LIBPNG_VER < 10600 ? 0 : 77;
+   return SKIP;
 }
 #endif

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_27beta01 Your_png_h_is_not_version_1_6_27beta01;
+typedef png_libpng_version_1_6_25 Your_png_h_is_not_version_1_6_25;
--- a/pngtrans.c
+++ b/pngtrans.c
@@ -1,7 +1,7 @@

 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.24 [August 4, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -595,7 +595,7 @@ png_do_strip_channel(png_row_infop row_info, png_bytep row, int at_start)
      return; /* The filler channel has gone already */

   /* Fix the rowbytes value. */
-   row_info->rowbytes = (unsigned int)(dp-row);
+   row_info->rowbytes = dp-row;
 }
 #endif

@@ -693,7 +693,7 @@ png_do_check_palette_indexes(png_structrp png_ptr, png_row_infop row_info)
       * and this calculation is used because it avoids warnings that other
       * forms produced on either GCC or MSVC.
       */
-      int padding = PNG_PADBITS(row_info->pixel_depth, row_info->width);
+      int padding = (-row_info->pixel_depth * row_info->width) & 7;
      png_bytep rp = png_ptr->row_buf + row_info->rowbytes;

      switch (row_info->bit_depth)
--- a/pngwrite.c
+++ b/pngwrite.c
@@ -1,7 +1,7 @@

 /* pngwrite.c - general routines to write a PNG file
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.24 [August 4, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -666,9 +666,9 @@ png_do_write_intrapixel(png_row_infop row_info, png_bytep row)

         for (i = 0, rp = row; i < row_width; i++, rp += bytes_per_pixel)
         {
-            png_uint_32 s0   = (png_uint_32)(*(rp    ) << 8) | *(rp + 1);
-            png_uint_32 s1   = (png_uint_32)(*(rp + 2) << 8) | *(rp + 3);
-            png_uint_32 s2   = (png_uint_32)(*(rp + 4) << 8) | *(rp + 5);
+            png_uint_32 s0   = (*(rp    ) << 8) | *(rp + 1);
+            png_uint_32 s1   = (*(rp + 2) << 8) | *(rp + 3);
+            png_uint_32 s2   = (*(rp + 4) << 8) | *(rp + 5);
            png_uint_32 red  = (png_uint_32)((s0 - s1) & 0xffffL);
            png_uint_32 blue = (png_uint_32)((s2 - s1) & 0xffffL);
            *(rp    ) = (png_byte)(red >> 8);
@@ -901,7 +901,7 @@ png_set_flush(png_structrp png_ptr, int nrows)
   if (png_ptr == NULL)
      return;

-   png_ptr->flush_dist = (nrows < 0 ? 0 : (png_uint_32)nrows);
+   png_ptr->flush_dist = (nrows < 0 ? 0 : nrows);
 }

 /* Flush the current output buffers now */
@@ -1525,8 +1525,7 @@ png_write_image_16bit(png_voidp argument)
       display->first_row);
   png_uint_16p output_row = png_voidcast(png_uint_16p, display->local_row);
   png_uint_16p row_end;
-   const unsigned int channels = (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ?
-       3 : 1;
+   const int channels = (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
   int aindex = 0;
   png_uint_32 y = image->height;

@@ -1540,9 +1539,9 @@ png_write_image_16bit(png_voidp argument)
         ++output_row;
      }
         else
-            aindex = (int)channels;
+            aindex = channels;
 #     else
-         aindex = (int)channels;
+         aindex = channels;
 #     endif
   }

@@ -1555,7 +1554,7 @@ png_write_image_16bit(png_voidp argument)
    */
   row_end = output_row + image->width * (channels+1);

-   for (; y > 0; --y)
+   while (y-- > 0)
   {
      png_const_uint_16p in_ptr = input_row;
      png_uint_16p out_ptr = output_row;
@@ -1576,7 +1575,7 @@ png_write_image_16bit(png_voidp argument)
         if (alpha > 0 && alpha < 65535)
            reciprocal = ((0xffff<<15)+(alpha>>1))/alpha;

-         c = (int)channels;
+         c = channels;
         do /* always at least one channel */
         {
            png_uint_16 component = *in_ptr++;
@@ -1611,7 +1610,7 @@ png_write_image_16bit(png_voidp argument)
      }

      png_write_row(png_ptr, png_voidcast(png_const_bytep, display->local_row));
-      input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
+      input_row += display->row_bytes/(sizeof (png_uint_16));
   }

   return 1;
@@ -1684,8 +1683,7 @@ png_write_image_8bit(png_voidp argument)
       display->first_row);
   png_bytep output_row = png_voidcast(png_bytep, display->local_row);
   png_uint_32 y = image->height;
-   const unsigned int channels = (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ?
-       3 : 1;
+   const int channels = (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;

   if ((image->format & PNG_FORMAT_FLAG_ALPHA) != 0)
   {
@@ -1702,12 +1700,12 @@ png_write_image_8bit(png_voidp argument)

      else
 #   endif
-      aindex = (int)channels;
+      aindex = channels;

      /* Use row_end in place of a loop counter: */
      row_end = output_row + image->width * (channels+1);

-      for (; y > 0; --y)
+      while (y-- > 0)
      {
         png_const_uint_16p in_ptr = input_row;
         png_bytep out_ptr = output_row;
@@ -1725,7 +1723,7 @@ png_write_image_8bit(png_voidp argument)
            if (alphabyte > 0 && alphabyte < 255)
               reciprocal = UNP_RECIPROCAL(alpha);

-            c = (int)channels;
+            c = channels;
            do /* always at least one channel */
               *out_ptr++ = png_unpremultiply(*in_ptr++, alpha, reciprocal);
            while (--c > 0);
@@ -1737,7 +1735,7 @@ png_write_image_8bit(png_voidp argument)

         png_write_row(png_ptr, png_voidcast(png_const_bytep,
             display->local_row));
-         input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
+         input_row += display->row_bytes/(sizeof (png_uint_16));
      } /* while y */
   }

@@ -1748,7 +1746,7 @@ png_write_image_8bit(png_voidp argument)
       */
      png_bytep row_end = output_row + image->width * channels;

-      for (; y > 0; --y)
+      while (y-- > 0)
      {
         png_const_uint_16p in_ptr = input_row;
         png_bytep out_ptr = output_row;
@@ -1762,7 +1760,7 @@ png_write_image_8bit(png_voidp argument)
         }

         png_write_row(png_ptr, output_row);
-         input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
+         input_row += display->row_bytes/(sizeof (png_uint_16));
      }
   }

@@ -1779,7 +1777,7 @@ png_image_set_PLTE(png_image_write_control *display)

   /* NOTE: the caller must check for cmap != NULL and entries != 0 */
   const png_uint_32 format = image->format;
-   const unsigned int channels = PNG_IMAGE_SAMPLE_CHANNELS(format);
+   const int channels = PNG_IMAGE_SAMPLE_CHANNELS(format);

 #   if defined(PNG_FORMAT_BGR_SUPPORTED) &&\
      defined(PNG_SIMPLIFIED_WRITE_AFIRST_SUPPORTED)
@@ -1811,7 +1809,7 @@ png_image_set_PLTE(png_image_write_control *display)
      {
         png_const_uint_16p entry = png_voidcast(png_const_uint_16p, cmap);

-         entry += (unsigned int)i * channels;
+         entry += i * channels;

         if ((channels & 1) != 0) /* no alpha */
         {
@@ -1867,7 +1865,7 @@ png_image_set_PLTE(png_image_write_control *display)
      {
         png_const_bytep entry = png_voidcast(png_const_bytep, cmap);

-         entry += (unsigned int)i * channels;
+         entry += i * channels;

         switch (channels)
         {
@@ -1912,7 +1910,7 @@ png_image_set_PLTE(png_image_write_control *display)
      png_set_tRNS(image->opaque->png_ptr, image->opaque->info_ptr, tRNS,
          num_trans, NULL);

-   image->colormap_entries = (png_uint_32)entries;
+   image->colormap_entries = entries;
 }

 static int
@@ -1942,7 +1940,7 @@ png_image_write_main(png_voidp argument)
   {
      const unsigned int channels = PNG_IMAGE_PIXEL_CHANNELS(image->format);

-      if (image->width <= 0x7fffffffU/channels) /* no overflow */
+      if (image->width <= 0x7FFFFFFFU/channels) /* no overflow */
      {
         png_uint_32 check;
         const png_uint_32 png_row_stride = image->width * channels;
@@ -1951,10 +1949,10 @@ png_image_write_main(png_voidp argument)
            display->row_stride = (png_int_32)/*SAFE*/png_row_stride;

         if (display->row_stride < 0)
-            check = (png_uint_32)(-display->row_stride);
+            check = -display->row_stride;

         else
-            check = (png_uint_32)display->row_stride;
+            check = display->row_stride;

         if (check >= png_row_stride)
         {
@@ -1962,7 +1960,7 @@ png_image_write_main(png_voidp argument)
             * limits the whole image size to 32 bits for API compatibility with
             * the current, 32-bit, PNG_IMAGE_BUFFER_SIZE macro.
             */
-            if (image->height > 0xffffffffU/png_row_stride)
+            if (image->height > 0xFFFFFFFF/png_row_stride)
               png_error(image->opaque->png_ptr, "memory image too large");
         }

@@ -2138,7 +2136,7 @@ png_image_write_main(png_voidp argument)
      ptrdiff_t row_bytes = display->row_bytes;
      png_uint_32 y = image->height;

-      for (; y > 0; --y)
+      while (y-- > 0)
      {
         png_write_row(png_ptr, row);
         row += row_bytes;
--- a/pngwtran.c
+++ b/pngwtran.c
@@ -1,7 +1,7 @@

 /* pngwtran.c - transforms the data in a row for PNG writers
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.24 [August 4, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -177,7 +177,7 @@ png_do_shift(png_row_infop row_info, png_bytep row,
   if (row_info->color_type != PNG_COLOR_TYPE_PALETTE)
   {
      int shift_start[4], shift_dec[4];
-      unsigned int channels = 0;
+      int channels = 0;

      if ((row_info->color_type & PNG_COLOR_MASK_COLOR) != 0)
      {
--- a/pngwutil.c
+++ b/pngwutil.c
@@ -1,7 +1,7 @@

 /* pngwutil.c - utilities to write a PNG file
 *
- * Last changed in libpng 1.6.26 [October 20, 2016]
+ * Last changed in libpng 1.6.24 [August 4, 2016]
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -408,7 +408,7 @@ png_deflate_claim(png_structrp png_ptr, png_uint_32 owner,
      png_ptr->zstream.avail_out = 0;

      /* Now initialize if required, setting the new parameters, otherwise just
-       * do a simple reset to the previous parameters.
+       * to a simple reset to the previous parameters.
       */
      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
         ret = deflateReset(&png_ptr->zstream);
@@ -1176,7 +1176,7 @@ png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
   png_byte new_name[80];
   png_byte entrybuf[10];
   png_size_t entry_size = (spalette->depth == 8 ? 6 : 10);
-   png_size_t palette_size = entry_size * (png_size_t)spalette->nentries;
+   png_size_t palette_size = entry_size * spalette->nentries;
   png_sPLT_entryp ep;
 #ifndef PNG_POINTER_INDEXING_SUPPORTED
   int i;
@@ -1743,7 +1743,7 @@ png_write_pCAL(png_structrp png_ptr, png_charp purpose, png_int_32 X0,
   total_len = purpose_len + units_len + 10;

   params_len = (png_size_tp)png_malloc(png_ptr,
-       (png_alloc_size_t)((png_alloc_size_t)nparams * (sizeof (png_size_t))));
+       (png_alloc_size_t)(nparams * (sizeof (png_size_t))));

   /* Find the length of each parameter, making sure we don't count the
    * null terminator for the last parameter.
@@ -2255,7 +2255,7 @@ png_setup_sub_row(png_structrp png_ptr, const png_uint_32 bpp,
   png_bytep rp, dp, lp;
   png_size_t i;
   png_size_t sum = 0;
-   unsigned int v;
+   int v;

   png_ptr->try_row[0] = PNG_FILTER_VALUE_SUB;

@@ -2264,7 +2264,7 @@ png_setup_sub_row(png_structrp png_ptr, const png_uint_32 bpp,
   {
      v = *dp = *rp;
 #ifdef PNG_USE_ABS
-      sum += 128 - abs((int)v - 128);
+      sum += 128 - abs(v - 128);
 #else
      sum += (v < 128) ? v : 256 - v;
 #endif
@@ -2275,7 +2275,7 @@ png_setup_sub_row(png_structrp png_ptr, const png_uint_32 bpp,
   {
      v = *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);
 #ifdef PNG_USE_ABS
-      sum += 128 - abs((int)v - 128);
+      sum += 128 - abs(v - 128);
 #else
      sum += (v < 128) ? v : 256 - v;
 #endif
@@ -2316,7 +2316,7 @@ png_setup_up_row(png_structrp png_ptr, const png_size_t row_bytes,
   png_bytep rp, dp, pp;
   png_size_t i;
   png_size_t sum = 0;
-   unsigned int v;
+   int v;

   png_ptr->try_row[0] = PNG_FILTER_VALUE_UP;

@@ -2326,7 +2326,7 @@ png_setup_up_row(png_structrp png_ptr, const png_size_t row_bytes,
   {
      v = *dp = (png_byte)(((int)*rp - (int)*pp) & 0xff);
 #ifdef PNG_USE_ABS
-      sum += 128 - abs((int)v - 128);
+      sum += 128 - abs(v - 128);
 #else
      sum += (v < 128) ? v : 256 - v;
 #endif
@@ -2360,7 +2360,7 @@ png_setup_avg_row(png_structrp png_ptr, const png_uint_32 bpp,
   png_bytep rp, dp, pp, lp;
   png_uint_32 i;
   png_size_t sum = 0;
-   unsigned int v;
+   int v;

   png_ptr->try_row[0] = PNG_FILTER_VALUE_AVG;

@@ -2370,7 +2370,7 @@ png_setup_avg_row(png_structrp png_ptr, const png_uint_32 bpp,
      v = *dp++ = (png_byte)(((int)*rp++ - ((int)*pp++ / 2)) & 0xff);

 #ifdef PNG_USE_ABS
-      sum += 128 - abs((int)v - 128);
+      sum += 128 - abs(v - 128);
 #else
      sum += (v < 128) ? v : 256 - v;
 #endif
@@ -2382,7 +2382,7 @@ png_setup_avg_row(png_structrp png_ptr, const png_uint_32 bpp,
          & 0xff);

 #ifdef PNG_USE_ABS
-      sum += 128 - abs((int)v - 128);
+      sum += 128 - abs(v - 128);
 #else
      sum += (v < 128) ? v : 256 - v;
 #endif
@@ -2422,7 +2422,7 @@ png_setup_paeth_row(png_structrp png_ptr, const png_uint_32 bpp,
   png_bytep rp, dp, pp, cp, lp;
   png_size_t i;
   png_size_t sum = 0;
-   unsigned int v;
+   int v;

   png_ptr->try_row[0] = PNG_FILTER_VALUE_PAETH;

@@ -2432,7 +2432,7 @@ png_setup_paeth_row(png_structrp png_ptr, const png_uint_32 bpp,
      v = *dp++ = (png_byte)(((int)*rp++ - (int)*pp++) & 0xff);

 #ifdef PNG_USE_ABS
-      sum += 128 - abs((int)v - 128);
+      sum += 128 - abs(v - 128);
 #else
      sum += (v < 128) ? v : 256 - v;
 #endif
@@ -2465,7 +2465,7 @@ png_setup_paeth_row(png_structrp png_ptr, const png_uint_32 bpp,
      v = *dp++ = (png_byte)(((int)*rp++ - p) & 0xff);

 #ifdef PNG_USE_ABS
-      sum += 128 - abs((int)v - 128);
+      sum += 128 - abs(v - 128);
 #else
      sum += (v < 128) ? v : 256 - v;
 #endif
@@ -2588,14 +2588,14 @@ png_write_find_filter(png_structrp png_ptr, png_row_infop row_info)
      png_bytep rp;
      png_size_t sum = 0;
      png_size_t i;
-      unsigned int v;
+      int v;

      {
         for (i = 0, rp = row_buf + 1; i < row_bytes; i++, rp++)
         {
            v = *rp;
 #ifdef PNG_USE_ABS
-            sum += 128 - abs((int)v - 128);
+            sum += 128 - abs(v - 128);
 #else
            sum += (v < 128) ? v : 256 - v;
 #endif
--- a/projects/vstudio/README.txt
+++ b/projects/vstudio/README.txt
@@ -1,7 +1,7 @@

 VisualStudio instructions

-libpng version 1.6.27beta01 - November 2, 2016
+libpng version 1.6.25 - September 1, 2016

 Copyright (c) 2010,2013,2015 Glenn Randers-Pehrson

--- a/projects/vstudio/zlib.props
+++ b/projects/vstudio/zlib.props
@@ -2,7 +2,7 @@
 <!--
 * zlib.props - location of zlib source
 *
- * libpng version 1.6.27beta01 - November 2, 2016
+ * libpng version 1.6.25 - September 1, 2016
 *
 * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 *
--- a/scripts/README.txt
+++ b/scripts/README.txt
@@ -1,9 +1,9 @@

-Makefiles for  libpng version 1.6.27beta01 - November 2, 2016
+Makefiles for  libpng version 1.6.25 - September 1, 2016

 pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng16.so.16.1.6.27beta01)
+                       (gcc, creates libpng16.so.16.1.6.25)
 makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
 makefile.knr      =>  Archaic UNIX Makefile that converts files with
                       ansi2knr (Requires ansi2knr.c from
@@ -33,12 +33,12 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.os2      =>  OS/2 Makefile (gcc and emx, requires libpng.def)
 makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
 makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng16.so.16.1.6.27beta01)
+                       creates libpng16.so.16.1.6.25)
 makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
 makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng16.so.16.1.6.27beta01)
+                       creates libpng16.so.16.1.6.25)
 makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng16.so.16.1.6.27beta01)
+                       creates libpng16.so.16.1.6.25)
 makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
 makefile.sunos    =>  Sun makefile
 makefile.32sunu   =>  Sun Ultra 32-bit makefile
--- a/scripts/def.c
+++ b/scripts/def.c
@@ -21,7 +21,7 @@ PNG_DFN "OS2 DESCRIPTION "PNG image compression library""
 PNG_DFN "OS2 CODE PRELOAD MOVEABLE DISCARDABLE"
 PNG_DFN ""
 PNG_DFN "EXPORTS"
-PNG_DFN ";Version 1.6.27beta01"
+PNG_DFN ";Version 1.6.25"

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
        PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"
--- a/scripts/libpng-config-head.in
+++ b/scripts/libpng-config-head.in
@@ -11,7 +11,7 @@

 # Modeled after libxml-config.

-version=1.6.27beta01
+version=1.6.25
 prefix=""
 libdir=""
 libs=""
--- a/scripts/libpng.pc.in
+++ b/scripts/libpng.pc.in
@@ -5,6 +5,6 @@ includedir=@includedir@/libpng16

 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.6.27beta01
+Version: 1.6.25
 Libs: -L${libdir} -lpng16
 Cflags: -I${includedir}
--- a/scripts/makefile.cegcc
+++ b/scripts/makefile.cegcc
@@ -23,7 +23,7 @@

 VERMAJ = 1
 VERMIN = 6
-VERMIC = 27
+VERMIC = 25
 VER = $(VERMAJ).$(VERMIN).$(VERMIC)
 NAME = libpng
 PACKAGE = $(NAME)-$(VER)
--- a/scripts/makefile.linux
+++ b/scripts/makefile.linux
@@ -10,7 +10,7 @@
 # Library name:
 LIBNAME = libpng16
 PNGMAJ = 16
-RELEASE = 27
+RELEASE = 25

 # Shared library names:
 LIBSO=$(LIBNAME).so
--- a/scripts/makefile.msys
+++ b/scripts/makefile.msys
@@ -18,7 +18,7 @@ exec_prefix=$(prefix)
 # Library name:
 LIBNAME = libpng16
 PNGMAJ = 16
-RELEASE = 27
+RELEASE = 25

 # Shared library names:
 LIBSO=$(LIBNAME).dll
--- a/scripts/makefile.ne12bsd
+++ b/scripts/makefile.ne12bsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng16

 LIB=	png16
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.6.27beta01
+SHLIB_MINOR=	1.6.25
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.netbsd
+++ b/scripts/makefile.netbsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include

 LIB=	png
 SHLIB_MAJOR=	16
-SHLIB_MINOR=	1.6.27beta01
+SHLIB_MINOR=	1.6.25
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.openbsd
+++ b/scripts/makefile.openbsd
@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat

 SHLIB_MAJOR=	16
-SHLIB_MINOR=	1.6.27beta01
+SHLIB_MINOR=	1.6.25

 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
--- a/scripts/makefile.sco
+++ b/scripts/makefile.sco
@@ -1,5 +1,5 @@
 # makefile for SCO OSr5  ELF and Unixware 7 with Native cc
-# Contributed by Mike Hopkirk (hops at sco.com) modified from Makefile.lnx
+# Contributed by Mike Hopkirk (hops@sco.com) modified from Makefile.lnx
 #   force ELF build dynamic linking, SONAME setting in lib and RPATH in app
 # Copyright (C) 2002, 2006, 2010-2014 Glenn Randers-Pehrson
 # Copyright (C) 1998 Greg Roelofs
--- a/scripts/pnglibconf.h.prebuilt
+++ b/scripts/pnglibconf.h.prebuilt
@@ -1,8 +1,8 @@
-/* libpng 1.6.27beta01 STANDARD API DEFINITION */
+/* libpng 1.6.25 STANDARD API DEFINITION */

 /* pnglibconf.h - library build configuration */

-/* Libpng version 1.6.27beta01 - November 2, 2016 */
+/* Libpng version 1.6.25 - September 1, 2016 */

 /* Copyright (c) 1998-2015 Glenn Randers-Pehrson */

--- a/scripts/symbols.def
+++ b/scripts/symbols.def
@@ -1,4 +1,4 @@
-;Version 1.6.27beta01
+;Version 1.6.25
 ;--------------------------------------------------------------
 ; LIBPNG symbol list as a Win32 DEF file
 ; Contains all the symbols that can be exported from libpng
--- a/tests/badadler.png
+++ b/tests/badadler.png
--- a/tests/badcrc.png
+++ b/tests/badcrc.png
--- a/tests/pngtest
+++ b/tests/pngtest
@@ -1,4 +1,2 @@
 #!/bin/sh
-./pngtest --relaxed ${srcdir}/tests/badcrc.png
-./pngtest --relaxed ${srcdir}/tests/badadler.png
 exec ./pngtest --strict ${srcdir}/pngtest.png