Run autogen.sh

Release libpng version 1.6.35
[libpng16] Added missing parentheses to a macro definition
2025-07-10 18:04:09 +02:00 · 2018-07-15 23:58:00 -04:00 · 2018-07-15 23:58:00 -04:00 · 2018-07-01 23:32:08 -04:00 · 2018-06-17 22:56:29 -04:00 · 2018-06-17 22:37:44 -04:00
161 changed files with 47803 additions and 1706 deletions
--- a/65
+++ b/65
@@ -1,53 +1,48 @@
-Libpng 1.6.32beta03 - August 2, 2017
+Libpng 1.6.35 - July 15, 2018

-This is not intended to be a public release. It will be replaced
-within a few weeks by a public version or by another test version.
+This is a public release of libpng, intended for use in production code.

 Files available for download:

-Source files with LF line endings (for Unix/Linux) and with a
-"configure" script
+Source files with LF line endings (for Unix/Linux):

-   1.6.32beta03.tar.xz (LZMA-compressed, recommended)
-   1.6.32beta03.tar.gz
+   libpng-1.6.35.tar.xz (LZMA-compressed, recommended)
+   libpng-1.6.35.tar.gz

-Source files with CRLF line endings (for Windows), without the
-"configure" script
+Source files with CRLF line endings (for Windows):

-   lp1632b03.7z  (LZMA-compressed, recommended)
-   lp1632b03.zip
+   lp1635.7z  (LZMA-compressed, recommended)
+   lp1635.zip

 Other information:

-   1.6.32beta03-README.txt
-   1.6.32beta03-LICENSE.txt
-   libpng-1.6.32beta03-*.asc (armored detached GPG signatures)
+   libpng-1.6.35-README.txt
+   libpng-1.6.35-LICENSE.txt

-Changes since the last public release (1.6.31):
+Changes since the last public release (1.6.34):

-Version 1.6.32beta01 [July 31, 2017]
-  Avoid possible NULL dereference in png_handle_eXIf when benign_errors
-    are allowed. Avoid leaking the input buffer "eXIf_buf".
-  Eliminated png_ptr->num_exif member from pngstruct.h and added num_exif
-    to arguments for png_get_eXIf() and png_set_eXIf().
-  Added calls to png_handle_eXIf(() in pngread.c and png_write_eXIf() in
-    pngwrite.c, and made various other fixes to png_write_eXIf().
-  Changed name of png_get_eXIF and png_set_eXIf() to png_get_eXIf_1() and
-    png_set_eXIf_1(), respectively, to avoid breaking API compatibility
-    with libpng-1.6.31.
-
-Version 1.6.32beta02 [August 1, 2017]
-  Updated contrib/libtests/pngunknown.c with eXIf chunk.
-
-Version 1.6.32beta03 [August 2, 2017]
-  Initialized btoa[] in pngstest.c
-  Stop memory leak when returning from png_handle_eXIf() with an error
-    (Bug report from the OSS-fuzz project).
+  Restored 21 of the contrib/pngsuite/i*.png, which do not cause test
+    failures. Placed the remainder in contrib/pngsuite/interlaced/i*.png.
+  Added calls to png_set_*() transforms commonly used by browsers to
+    the fuzzer.
+  Removed some unnecessary brackets in pngrtran.c
+  Fixed miscellaneous typos (Patch by github user "luzpaz").
+  Change "ASM C" to "C ASM" in CMakeLists.txt
+  Fixed incorrect handling of bKGD chunk in sub-8-bit files (Cosmin)
+  Added hardware optimization directories to zip and 7z distributions.
+  Fixed incorrect bitmask for options.
+  Fixed many spelling typos.
+  Make png_get_iCCP consistent with man page (allow compression-type argument
+    to be NULL, bug report by Lenard Szolnoki).
+  Replaced the remaining uses of png_size_t with size_t (Cosmin)
+  Fixed the calculation of row_factor in png_check_chunk_length
+    (reported by Thuan Pham in SourceForge issue #278)
+  Added missing parentheses to a macro definition
+    (suggested by "irwir" in GitHub issue #216)

 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
-to subscribe)
-or to glennrp at users.sourceforge.net
+to subscribe).

 Glenn R-P
--- a/168
+++ b/168
@@ -1,4 +1,3 @@
-#if 0
 CHANGES - changes for libpng

 version 0.1 [March 29, 1995]
@@ -833,7 +832,7 @@ Version 1.0.7beta11 [May 7, 2000]
  Removed the new PNG_CREATED_READ_STRUCT and PNG_CREATED_WRITE_STRUCT modes
    which are no longer used.
  Eliminated the three new members of png_text when PNG_LEGACY_SUPPORTED is
-    defined or when neither PNG_READ_iTXt_SUPPORTED nor PNG_WRITE_iTXT_SUPPORTED
+    defined or when neither PNG_READ_iTXt_SUPPORTED nor PNG_WRITE_iTXt_SUPPORTED
    is defined.
  Made PNG_NO_READ|WRITE_iTXt the default setting, to avoid memory
    overrun when old applications fill the info_ptr->text structure directly.
@@ -1454,7 +1453,7 @@ Version 1.2.6beta4 [July 28, 2004]
    sequential read support.
  Added some "#if PNG_WRITE_SUPPORTED" blocks.
  Added #ifdef to remove some redundancy in png_malloc_default().
-  Use png_malloc instead of png_zalloc to allocate the pallete.
+  Use png_malloc instead of png_zalloc to allocate the palette.

 Version 1.0.16rc1 and 1.2.6rc1 [August 4, 2004]
  Fixed buffer overflow vulnerability (CVE-2004-0597) in png_handle_tRNS().
@@ -3259,7 +3258,7 @@ Version 1.5.2beta01 [February 13, 2011]
  Revised PNG_EXPORTA macro to not use an empty parameter, to accommodate the
    old VisualC++ preprocessor.
  Turned on interlace handling in png_read_png().
-  Fixed gcc pendantic warnings.
+  Fixed gcc pedantic warnings.
  Handle longjmp in Cygwin.
  Fixed png_get_current_row_number() in the interlaced case.
  Cleaned up ALPHA flags and transformations.
@@ -3359,7 +3358,7 @@ Version 1.5.3beta05 [May 6, 2011]
  Pass "" instead of '\0' to png_default_error() in png_err().  This mistake
    was introduced in libpng-1.2.20beta01.  This fixes CVE-2011-2691.
  Added PNG_WRITE_OPTIMIZE_CMF_SUPPORTED macro to make the zlib "CMF" byte
-    optimization configureable.
+    optimization configurable.
  IDAT compression failed if preceded by a compressed text chunk (bug
    introduced in libpng-1.5.3beta01-02).  This was because the attempt to
    reset the zlib stream in png_write_IDAT happened after the first IDAT
@@ -3643,7 +3642,7 @@ Version 1.5.6beta05 [October 12, 2011]
  Fixed bug in png_write_chunk_header() debug print, introduced in 1.5.6beta01.

 Version 1.5.6beta06 [October 17, 2011]
-  Removed two redundant tests for unitialized row.
+  Removed two redundant tests for uninitialized row.
  Fixed a relatively harmless memory overwrite in compressed text writing
    with a 1 byte zlib buffer.
  Add ability to call png_read_update_info multiple times to pngvalid.c.
@@ -3689,7 +3688,7 @@ Version 1.5.7beta01 [November 4, 2011]
    crash.  The pngmem.c implementation of png_malloc() included a cast
    to png_size_t which would fail on large allocations on 16-bit systems.
  Fix for the preprocessor of the Intel C compiler. The preprocessor
-    splits adjacent @ signs with a space; this changes the concatentation
+    splits adjacent @ signs with a space; this changes the concatenation
    token from @-@-@ to PNG_JOIN; that should work with all compiler
    preprocessors.
  Paeth filter speed improvements from work by Siarhei Siamashka. This
@@ -3735,7 +3734,7 @@ Version 1.5.7beta03 [November 17, 2011]
    gray (on palette) itself.
  Fixes for C++ compilation using g++ When libpng source is compiled
    using g++. The compiler imposes C++ rules on the C source; thus it
-    is desireable to make the source work with either C or C++ rules
+    is desirable to make the source work with either C or C++ rules
    without throwing away useful error information.  This change adds
    png_voidcast to allow C semantic (void*) cases or the corresponding
    C++ static_cast operation, as appropriate.
@@ -4061,7 +4060,7 @@ Version 1.6.0beta17 [March 10, 2012]
    possible to call png_inflate() incrementally.  A warning is no longer
    issued if the language tag or translated keyword in the iTXt chunk
    has zero length.
-  If benign errors are disabled use maximum window on ancilliary inflate.
+  If benign errors are disabled use maximum window on ancillary inflate.
    This works round a bug introduced in 1.5.4 where compressed ancillary
    chunks could end up with a too-small windowBits value in the deflate
    header.
@@ -4176,7 +4175,7 @@ Version 1.6.0beta27 [August 11, 2012]
    declared even though the functions are never actually defined.  This
    change provides a dummy definition so that the declarations work, yet any
    implementation will fail to compile because of an incomplete type.
-  Re-eliminated the use of strcpy() in pngtest.c.  An unncessary use of
+  Re-eliminated the use of strcpy() in pngtest.c.  An unnecessary use of
    strcpy() was accidentally re-introduced in libpng16; this change replaces
    it with strncpy().
  Eliminated use of png_sizeof(); use sizeof() instead.
@@ -4309,7 +4308,7 @@ Version 1.6.0beta31 [November 1, 2012]
    resulting in VS2010 having to update the files.
  Removed non-working ICC profile support code that was mostly added to
    libpng-1.6.0beta29 and beta30. There was too much code for too little
-    gain; implementing full ICC color correction may be desireable but is left
+    gain; implementing full ICC color correction may be desirable but is left
    up to applications.

 Version 1.6.0beta32 [November 25, 2012]
@@ -4592,7 +4591,7 @@ Version 1.6.3beta07 [June 8, 2013]
    the optimizations ('check' vs 'api') are exposed in the public header files
    except that the new setting PNG_ARM_NEON_OPT documents how libpng makes the
    decision about whether or not to use the optimizations.
-  Protect symbol prefixing against CC/CPPFLAGS/CFLAGS useage.
+  Protect symbol prefixing against CC/CPPFLAGS/CFLAGS usage.
    Previous iOS/Xcode fixes for the ARM NEON optimizations moved the test
    on __ARM_NEON__ from configure time to compile time.  This breaks symbol
    prefixing because the definition of the special png_init_filter_functions
@@ -5635,7 +5634,7 @@ Version 1.6.24beta02 [June 23, 2016]
    to All and adds a list of the warnings that need to be turned off.  This is
    semi-documentary; the intent is to tell libpng users which warnings have
    been examined and judged non-fixable at present.  The warning about
-    structure padding is fixable, but it would be a signficant change (moving
+    structure padding is fixable, but it would be a significant change (moving
    structure members around).

 Version 1.6.24beta03 [July 4, 2016]
@@ -5781,7 +5780,7 @@ Version 1.6.28rc01 [January 3, 2017]
  Added option to Cmake build allowing a custom location of zlib to be
    specified in a scenario where libpng is being built as a subproject
    alongside zlib by another project (Sam Serrels).
-  Changed png_ptr->options from a png_byte to png_uint_32, to accomodate
+  Changed png_ptr->options from a png_byte to png_uint_32, to accommodate
    up to 16 options.

 Version 1.6.28rc02 [January 4, 2017]
@@ -5927,11 +5926,146 @@ Version 1.6.32beta03 [August 2, 2017]
  Stop memory leak when returning from png_handle_eXIf() with an error
    (Bug report from the OSS-fuzz project).

+Version 1.6.32beta04 [August 2, 2017]
+  Replaced local eXIf_buf with info_ptr-eXIf_buf in png_handle_eXIf().
+  Update libpng.3 and libpng-manual.txt about eXIf functions.
+
+Version 1.6.32beta05 [August 2, 2017]
+  Restored png_get_eXIf() and png_set_eXIf() to maintain API compatibility.
+
+Version 1.6.32beta06 [August 2, 2017]
+  Removed png_get_eXIf_1() and png_set_eXIf_1().
+
+Version 1.6.32beta07 [August 3, 2017]
+  Check length of all chunks except IDAT against user limit to fix an
+    OSS-fuzz issue (Fixes CVE-2017-12652).
+
+Version 1.6.32beta08 [August 3, 2017]
+  Check length of IDAT against maximum possible IDAT size, accounting
+    for height, rowbytes, interlacing and zlib/deflate overhead.
+  Restored png_get_eXIf_1() and png_set_eXIf_1(), because strlen(eXIf_buf)
+    does not work (the eXIf chunk data can contain zeroes).
+
+Version 1.6.32beta09 [August 3, 2017]
+  Require cmake-2.8.8 in CMakeLists.txt. Revised symlink creation,
+    no longer using deprecated cmake LOCATION feature (Clifford Yapp).
+  Fixed five-byte error in the calculation of IDAT maximum possible size.
+  
+Version 1.6.32beta10 [August 5, 2017]
+  Moved chunk-length check into a png_check_chunk_length() private
+    function (Suggested by Max Stepin).
+  Moved bad pngs from tests to contrib/libtests/crashers
+  Moved testing of bad pngs into a separate tests/pngtest-badpngs script
+  Added the --xfail (expected FAIL) option to pngtest.c. It writes XFAIL
+    in the output but PASS for the libpng test.
+  Require cmake-3.0.2 in CMakeLists.txt (Clifford Yapp).
+  Fix "const" declaration info_ptr argument to png_get_eXIf_1() and the
+    num_exif argument to png_get_eXIf_1() (Github Issue 171).
+
+Version 1.6.32beta11 [August 7, 2017]
+  Added "eXIf" to "chunks_to_ignore[]" in png_set_keep_unknown_chunks().
+  Added huge_IDAT.png and empty_ancillary_chunks.png to testpngs/crashers.
+  Make pngtest --strict, --relax, --xfail options imply -m (multiple).
+  Removed unused chunk_name parameter from png_check_chunk_length().
+  Relocated setting free_me for eXIf data, to stop an OSS-fuzz leak.
+  Initialize profile_header[] in png_handle_iCCP() to fix OSS-fuzz issue.
+  Initialize png_ptr->row_buf[0] to 255 in png_read_row() to fix OSS-fuzz UMR.
+  Attempt to fix a UMR in png_set_text_2() to fix OSS-fuzz issue.
+  Increase minimum zlib stream from 9 to 14 in png_handle_iCCP(), to account
+    for the minimum 'deflate' stream, and relocate the test to a point
+    after the keyword has been read.
+  Check that the eXIf chunk has at least 2 bytes and begins with "II" or "MM".
+
+Version 1.6.32rc01 [August 18, 2017]
+  Added a set of "huge_xxxx_chunk.png" files to contrib/testpngs/crashers,
+    one for each known chunk type, with length = 2GB-1.
+  Check for 0 return from png_get_rowbytes() and added some (size_t) typecasts
+    in contrib/pngminus/*.c to stop some Coverity issues (162705, 162706,
+    and 162707).
+  Renamed chunks in contrib/testpngs/crashers to avoid having files whose
+    names differ only in case; this causes problems with some platforms
+    (github issue #172).
+
+Version 1.6.32rc02 [August 22, 2017]
+  Added contrib/oss-fuzz directory which contains files used by the oss-fuzz
+    project (https://github.com/google/oss-fuzz/tree/master/projects/libpng).
+
+Version 1.6.32 [August 24, 2017]
+  No changes.
+
+Version 1.6.33beta01 [August 28, 2017]
+  Added PNGMINUS_UNUSED macro to contrib/pngminus/p*.c and added missing
+    parenthesis in contrib/pngminus/pnm2png.c (bug report by Christian Hesse).
+  Fixed off-by-one error in png_do_check_palette_indexes() (Bug report
+    by Mick P., Source Forge Issue #269).
+
+Version 1.6.33beta02 [September 3, 2017]
+  Initialize png_handler.row_ptr in contrib/oss-fuzz/libpng_read_fuzzer.cc
+    to fix shortlived oss-fuzz issue 3234.
+  Compute a larger limit on IDAT because some applications write a deflate
+    buffer for each row (Bug report by Andrew Church).
+  Use current date (DATE) instead of release-date (RDATE) in last
+    changed date of contrib/oss-fuzz files.
+  Enabled ARM support in CMakeLists.txt (Bernd Kuhls).
+
+Version 1.6.33beta03 [September 14, 2017]
+  Fixed incorrect typecast of some arguments to png_malloc() and
+    png_calloc() that were png_uint_32 instead of png_alloc_size_t
+    (Bug report by "irwir" in Github libpng issue #175).
+  Use pnglibconf.h.prebuilt when building for ANDROID with cmake (Github
+    issue 162, by rcdailey).
+
+Version 1.6.33rc01 [September 20, 2017]
+  Initialize memory allocated by png_inflate to zero, using memset, to
+    stop an oss-fuzz "use of uninitialized value" detection in png_set_text_2()
+    due to truncated iTXt or zTXt chunk.
+  Initialize memory allocated by png_read_buffer to zero, using memset, to
+    stop an oss-fuzz "use of uninitialized value" detection in
+    png_icc_check_tag_table() due to truncated iCCP chunk.
+  Removed a redundant test (suggested by "irwir" in Github issue #180).
+
+Version 1.6.33rc02 [September 23, 2017]
+  Added an interlaced version of each file in contrib/pngsuite.
+  Relocate new memset() call in pngrutil.c.
+  Removed more redundant tests (suggested by "irwir" in Github issue #180).
+  Add support for loading images with associated alpha in the Simplified
+    API (Samuel Williams).
+
+Version 1.6.33 [September 28, 2017]
+  Revert contrib/oss-fuzz/libpng_read_fuzzer.cc to libpng-1.6.32 state.
+  Initialize png_handler.row_ptr in contrib/oss-fuzz/libpng_read_fuzzer.cc
+  Add end_info structure and png_read_end() to the libpng fuzzer.
+
+Version 1.6.34 [September 29, 2017]
+  Removed contrib/pngsuite/i*.png; some of them caused test failures.
+
+Version 1.6.35beta01 [March 6, 2018]
+  Restored 21 of the contrib/pngsuite/i*.png, which do not cause test
+    failures. Placed the remainder in contrib/pngsuite/interlaced/i*.png.
+  Added calls to png_set_*() transforms commonly used by browsers to
+    the fuzzer.
+  Removed some unnecessary brackets in pngrtran.c
+  Fixed miscellaneous typos (Patch by github user "luzpaz").
+  Change "ASM C" to "C ASM" in CMakeLists.txt
+  Fixed incorrect handling of bKGD chunk in sub-8-bit files (Cosmin)
+  Added hardware optimization directories to zip and 7z distributions.
+  Fixed incorrect bitmask for options.
+  Fixed many spelling typos.
+
+Version 1.6.35beta02 [March 28, 2018]
+  Make png_get_iCCP consistent with man page (allow compression-type argument
+  to be NULL, bug report by Lenard Szolnoki).
+
+Version 1.6.35 [July 15, 2018]
+  Replaced the remaining uses of png_size_t with size_t (Cosmin)
+  Fixed the calculation of row_factor in png_check_chunk_length
+    (reported by Thuan Pham in SourceForge issue #278)
+  Added missing parentheses to a macro definition
+    (suggested by "irwir" in GitHub issue #216)
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
-to subscribe)
-or to glennrp at users.sourceforge.net
+to subscribe).

 Glenn R-P
-#endif
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,6 +1,6 @@
 # CMakeLists.txt

-# Copyright (C) 2007,2009-2017 Glenn Randers-Pehrson
+# Copyright (C) 2007,2009-2018 Glenn Randers-Pehrson
 # Written by Christian Ehrlicher, 2007
 # Revised by Roger Lowman, 2009-2010
 # Revised by Clifford Yapp, 2011-2012
@@ -11,8 +11,8 @@
 # For conditions of distribution and use, see the disclaimer
 # and license in png.h

-cmake_minimum_required(VERSION 2.8.3)
-cmake_policy(VERSION 2.8.3)
+cmake_minimum_required(VERSION 3.0.2)
+cmake_policy(VERSION 3.0.2)

 # Set MacOSX @rpath usage globally.
 if (POLICY CMP0020)
@@ -31,12 +31,12 @@ endif(POLICY CMP0054)

 set(CMAKE_CONFIGURATION_TYPES "Release;Debug;MinSizeRel;RelWithDebInfo")

-project(libpng C)
+project(libpng C ASM)
 enable_testing()

 set(PNGLIB_MAJOR 1)
 set(PNGLIB_MINOR 6)
-set(PNGLIB_RELEASE 32)
+set(PNGLIB_RELEASE 35)
 set(PNGLIB_NAME libpng${PNGLIB_MAJOR}${PNGLIB_MINOR})
 set(PNGLIB_VERSION ${PNGLIB_MAJOR}.${PNGLIB_MINOR}.${PNGLIB_RELEASE})

@@ -262,7 +262,7 @@ find_program(AWK NAMES gawk awk)

 include_directories(${CMAKE_CURRENT_BINARY_DIR})

-if(NOT AWK)
+if(NOT AWK OR ANDROID)
  # No awk available to generate sources; use pre-built pnglibconf.h
  configure_file(${CMAKE_CURRENT_SOURCE_DIR}/scripts/pnglibconf.h.prebuilt
                 ${CMAKE_CURRENT_BINARY_DIR}/pnglibconf.h)
@@ -424,7 +424,7 @@ else()
                    WORKING_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}")

  # A single target handles generation of all generated files.  If
-  # they are dependend upon separately by multiple targets, this
+  # they are depended upon separately by multiple targets, this
  # confuses parallel make (it would require a separate top-level
  # target for each file to track the dependencies properly).
  add_custom_target(genfiles DEPENDS
@@ -441,7 +441,7 @@ else()
    "${CMAKE_CURRENT_BINARY_DIR}/scripts/symbols.chk"
    "${CMAKE_CURRENT_BINARY_DIR}/scripts/symbols.out"
    "${CMAKE_CURRENT_BINARY_DIR}/scripts/vers.out")
-endif(NOT AWK)
+endif(NOT AWK OR ANDROID)

 # OUR SOURCES
 set(libpng_public_hdrs
@@ -455,7 +455,7 @@ set(libpng_private_hdrs
  pnginfo.h
  pngstruct.h
 )
-if(AWK)
+if(AWK AND NOT ANDROID)
  list(APPEND libpng_private_hdrs "${CMAKE_CURRENT_BINARY_DIR}/pngprefix.h")
 endif()
 set(libpng_sources
@@ -755,31 +755,58 @@ if(PNG_SHARED)
  list(APPEND PNG_BIN_TARGETS png-fix-itxt)
 endif()

-# Ensure the CMAKE_LIBRARY_OUTPUT_DIRECTORY is set
-IF(NOT CMAKE_LIBRARY_OUTPUT_DIRECTORY)
-  SET(CMAKE_LIBRARY_OUTPUT_DIRECTORY "lib")
-ENDIF(NOT CMAKE_LIBRARY_OUTPUT_DIRECTORY)
-
 # Set a variable with CMake code which:
 # Creates a symlink from src to dest (if possible) or alternatively
 # copies if different.
-macro(CREATE_SYMLINK SRC_FILE DEST_FILE)
-  FILE(REMOVE ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/${DEST_FILE})
-  if(CMAKE_HOST_WIN32 AND NOT CYGWIN AND NOT MSYS)
-    ADD_CUSTOM_COMMAND(
-        OUTPUT ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/${DEST_FILE}   ${CMAKE_CURRENT_BINARY_DIR}/${DEST_FILE}
-        COMMAND ${CMAKE_COMMAND} -E copy_if_different  "${SRC_FILE}" ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/${DEST_FILE}
-        COMMAND ${CMAKE_COMMAND} -E copy_if_different  "${SRC_FILE}" ${CMAKE_CURRENT_BINARY_DIR}/${DEST_FILE}
-        DEPENDS ${PNG_LIB_TARGETS}
-        )
-    ADD_CUSTOM_TARGET(${DEST_FILE}_COPY ALL DEPENDS ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/${DEST_FILE})
-  else(CMAKE_HOST_WIN32 AND NOT CYGWIN AND NOT MSYS)
-    get_filename_component(LINK_TARGET "${SRC_FILE}" NAME)
-    execute_process(COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/${CMAKE_LIBRARY_OUTPUT_DIRECTORY})
-    execute_process(COMMAND ${CMAKE_COMMAND} -E create_symlink "${LINK_TARGET}" ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/${DEST_FILE} WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
-    execute_process(COMMAND ${CMAKE_COMMAND} -E create_symlink "${LINK_TARGET}" ${DEST_FILE} WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
-  endif(CMAKE_HOST_WIN32 AND NOT CYGWIN AND NOT MSYS)
-endmacro()
+include(CMakeParseArguments)
+
+function(CREATE_SYMLINK DEST_FILE)
+
+  cmake_parse_arguments(S "" "FILE;TARGET" "" ${ARGN})
+
+  if(NOT S_TARGET AND NOT S_FILE)
+    message(FATAL_ERROR "Specify either a TARGET or a FILE for CREATE_SYMLINK to link to.")
+  endif(NOT S_TARGET AND NOT S_FILE)
+
+  if(S_TARGET AND S_FILE)
+    message(FATAL_ERROR "CREATE_SYMLINK called with both source file ${S_FILE} and build target ${S_TARGET} arguments - can only handle 1 type per call.")
+  endif(S_TARGET AND S_FILE)
+
+  if(S_FILE)
+    # If we don't need to symlink something that's coming from a build target,
+    # we can go ahead and symlink/copy at configure time.
+
+    if(CMAKE_HOST_WIN32 AND NOT CYGWIN AND NOT MSYS)
+      execute_process(
+	COMMAND "${CMAKE_COMMAND}" -E copy_if_different ${S_FILE} ${DEST_FILE}
+	WORKING_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}"
+	)
+    else(CMAKE_HOST_WIN32 AND NOT CYGWIN AND NOT MSYS)
+      execute_process(
+	COMMAND ${CMAKE_COMMAND} -E create_symlink ${S_FILE} ${DEST_FILE}
+	WORKING_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}"
+	)
+    endif(CMAKE_HOST_WIN32 AND NOT CYGWIN AND NOT MSYS)
+  endif(S_FILE)
+
+  if(S_TARGET)
+    # We need to use generator expressions, which can be a bit tricky, so for
+    # simplicity make the symlink a POST_BUILD step and use the TARGET
+    # signature of add_custom_command.
+
+    if(CMAKE_HOST_WIN32 AND NOT CYGWIN AND NOT MSYS)
+      add_custom_command(TARGET ${S_TARGET} POST_BUILD
+	COMMAND "${CMAKE_COMMAND}" -E copy_if_different $<TARGET_LINKER_FILE_NAME:${S_TARGET}> $<TARGET_LINKER_FILE_DIR:${S_TARGET}>/${DEST_FILE}
+	)
+    else(CMAKE_HOST_WIN32 AND NOT CYGWIN AND NOT MSYS)
+      add_custom_command(TARGET ${S_TARGET} POST_BUILD
+	COMMAND "${CMAKE_COMMAND}" -E create_symlink $<TARGET_LINKER_FILE_NAME:${S_TARGET}> $<TARGET_LINKER_FILE_DIR:${S_TARGET}>/${DEST_FILE}
+	)
+    endif(CMAKE_HOST_WIN32 AND NOT CYGWIN AND NOT MSYS)
+
+  endif(S_TARGET)
+
+endfunction()

 # Create source generation scripts.
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/scripts/genchk.cmake.in
@@ -807,17 +834,17 @@ if(NOT WIN32 OR CYGWIN OR MINGW)
  set(LIBS        "-lz -lm")
  configure_file(${CMAKE_CURRENT_SOURCE_DIR}/libpng.pc.in
    ${CMAKE_CURRENT_BINARY_DIR}/${PNGLIB_NAME}.pc @ONLY)
-  CREATE_SYMLINK(${PNGLIB_NAME}.pc libpng.pc)
+  CREATE_SYMLINK(libpng.pc FILE ${PNGLIB_NAME}.pc)

  configure_file(${CMAKE_CURRENT_SOURCE_DIR}/libpng-config.in
    ${CMAKE_CURRENT_BINARY_DIR}/${PNGLIB_NAME}-config @ONLY)
-  CREATE_SYMLINK(${PNGLIB_NAME}-config libpng-config)
+  CREATE_SYMLINK(libpng-config FILE ${PNGLIB_NAME}-config)
 endif(NOT WIN32 OR CYGWIN OR MINGW)

 # SET UP LINKS
 if(PNG_SHARED)
  set_target_properties(png PROPERTIES
-#   VERSION 16.${PNGLIB_RELEASE}.1.6.32beta03
+#   VERSION 16.${PNGLIB_RELEASE}.1.6.35
    VERSION 16.${PNGLIB_RELEASE}.0
    SOVERSION 16
    CLEAN_DIRECT_OUTPUT 1)
@@ -844,26 +871,20 @@ if(NOT SKIP_INSTALL_LIBRARIES AND NOT SKIP_INSTALL_ALL )
  if(PNG_SHARED)
    # Create a symlink for libpng.dll.a => libpng16.dll.a on Cygwin
    if(CYGWIN OR MINGW)
-       get_target_property(BUILD_TARGET_LOCATION png LOCATION_${CMAKE_BUILD_TYPE})
-       CREATE_SYMLINK(${BUILD_TARGET_LOCATION} libpng${CMAKE_IMPORT_LIBRARY_SUFFIX})
-       install(FILES ${CMAKE_CURRENT_BINARY_DIR}/libpng${CMAKE_IMPORT_LIBRARY_SUFFIX}
-         DESTINATION ${CMAKE_INSTALL_LIBDIR})
+      CREATE_SYMLINK(libpng${CMAKE_IMPORT_LIBRARY_SUFFIX} TARGET png)
+      install(FILES $<TARGET_LINKER_FILE_DIR:png>/libpng${CMAKE_IMPORT_LIBRARY_SUFFIX} DESTINATION ${CMAKE_INSTALL_LIBDIR})
    endif(CYGWIN OR MINGW)

    if(NOT WIN32)
-      get_target_property(BUILD_TARGET_LOCATION png LOCATION_${CMAKE_BUILD_TYPE})
-      CREATE_SYMLINK(${BUILD_TARGET_LOCATION} libpng${CMAKE_SHARED_LIBRARY_SUFFIX})
-      install(FILES ${CMAKE_CURRENT_BINARY_DIR}/libpng${CMAKE_SHARED_LIBRARY_SUFFIX}
-         DESTINATION ${CMAKE_INSTALL_LIBDIR})
+      CREATE_SYMLINK(libpng${CMAKE_SHARED_LIBRARY_SUFFIX} TARGET png)
+      install(FILES $<TARGET_LINKER_FILE_DIR:png>/libpng${CMAKE_SHARED_LIBRARY_SUFFIX} DESTINATION ${CMAKE_INSTALL_LIBDIR})
    endif(NOT WIN32)
  endif(PNG_SHARED)

  if(PNG_STATIC)
    if(NOT WIN32 OR CYGWIN OR MINGW)
-      get_target_property(BUILD_TARGET_LOCATION png_static LOCATION_${CMAKE_BUILD_TYPE})
-      CREATE_SYMLINK(${BUILD_TARGET_LOCATION} libpng${CMAKE_STATIC_LIBRARY_SUFFIX})
-      install(FILES ${CMAKE_CURRENT_BINARY_DIR}/libpng${CMAKE_STATIC_LIBRARY_SUFFIX}
-         DESTINATION ${CMAKE_INSTALL_LIBDIR})
+      CREATE_SYMLINK( libpng${CMAKE_STATIC_LIBRARY_SUFFIX} TARGET png_static)
+      install(FILES $<TARGET_LINKER_FILE_DIR:png_static>/libpng${CMAKE_STATIC_LIBRARY_SUFFIX} DESTINATION ${CMAKE_INSTALL_LIBDIR})
    endif(NOT WIN32 OR CYGWIN OR MINGW)
 endif()
 endif()
--- a/2
+++ b/2
@@ -284,7 +284,7 @@ those sections that are actually used will be loaded into memory.

 XIV. Enabling or disabling hardware optimizations

-Certain hardware capabilites, such as the Intel SSE instructions,
+Certain hardware capabilities, such as the Intel SSE instructions,
 are normally detected at run time. Enable them with configure options
 such as one of

--- a/6
+++ b/6
@@ -10,8 +10,8 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.0.7, July 1, 2000 through 1.6.32beta03, August 2, 2017 are
-Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
+libpng versions 1.0.7, July 1, 2000 through 1.6.35, July 15, 2018 are
+Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
 added to the list of Contributing Authors:
@@ -130,4 +130,4 @@ any encryption software.  See the EAR, paragraphs 734.3(b)(3) and

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-April 1, 2017
+July 15, 2018
--- a/Makefile.am
+++ b/Makefile.am
@@ -60,6 +60,7 @@ pngcp_LDADD = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.la
 # set of parameters:
 TESTS =\
   tests/pngtest\
+   tests/pngtest-badpngs\
   tests/pngvalid-gamma-16-to-8 tests/pngvalid-gamma-alpha-mode\
   tests/pngvalid-gamma-background tests/pngvalid-gamma-expand16-alpha-mode\
   tests/pngvalid-gamma-expand16-background\
--- a/Makefile.in
+++ b/Makefile.in
--- a/4
+++ b/4
@@ -1,4 +1,4 @@
-README for libpng version 1.6.32beta03 - August 2, 2017 (shared library 16.0)
+README for libpng version 1.6.35 - July 15, 2018 (shared library 16.0)
 See the note about version numbers near the top of png.h

 See INSTALL for instructions on how to install libpng.
@@ -118,7 +118,7 @@ development group.
 Send comments/corrections/commendations to png-mng-implement at
 lists.sourceforge.net (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
-to subscribe) or to glennrp at users.sourceforge.net
+to subscribe).

 You can't reach Guy, the original libpng author, at the addresses
 given in previous versions of this document.  He and Andreas will
--- a/aclocal.m4
+++ b/aclocal.m4
--- a/arm/filter_neon.S
+++ b/arm/filter_neon.S
@@ -3,7 +3,7 @@
 *
 * Copyright (c) 2014,2017 Glenn Randers-Pehrson
 * Written by Mans Rullgard, 2011.
- * Last changed in libpng 1.6.31 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.31 [July 27, 2017]
 *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
--- a/autogen.sh
+++ b/autogen.sh
@@ -194,7 +194,7 @@ case "$mode" in
      if test -d .git
      then
         exec >&2
-         echo "ERROR: running autoreconf on an initialized sytem"
+         echo "ERROR: running autoreconf on an initialized system"
         echo "  This is not necessary; it is only necessary to remake the"
         echo "  autotools generated files if Makefile.am or configure.ac"
         echo "  change and make does the right thing with:"
--- a/348
+++ b/348
@@ -0,0 +1,348 @@
+#! /bin/sh
+# Wrapper for compilers which do not understand '-c -o'.
+
+scriptversion=2018-03-07.03; # UTC
+
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Written by Tom Tromey <tromey@cygnus.com>.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2, or (at your option)
+# any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# As a special exception to the GNU General Public License, if you
+# distribute this file as part of a program that contains a
+# configuration script generated by Autoconf, you may include it under
+# the same distribution terms that you use for the rest of that program.
+
+# This file is maintained in Automake, please report
+# bugs to <bug-automake@gnu.org> or send patches to
+# <automake-patches@gnu.org>.
+
+nl='
+'
+
+# We need space, tab and new line, in precisely that order.  Quoting is
+# there to prevent tools from complaining about whitespace usage.
+IFS=" ""	$nl"
+
+file_conv=
+
+# func_file_conv build_file lazy
+# Convert a $build file to $host form and store it in $file
+# Currently only supports Windows hosts. If the determined conversion
+# type is listed in (the comma separated) LAZY, no conversion will
+# take place.
+func_file_conv ()
+{
+  file=$1
+  case $file in
+    / | /[!/]*) # absolute file, and not a UNC file
+      if test -z "$file_conv"; then
+	# lazily determine how to convert abs files
+	case `uname -s` in
+	  MINGW*)
+	    file_conv=mingw
+	    ;;
+	  CYGWIN*)
+	    file_conv=cygwin
+	    ;;
+	  *)
+	    file_conv=wine
+	    ;;
+	esac
+      fi
+      case $file_conv/,$2, in
+	*,$file_conv,*)
+	  ;;
+	mingw/*)
+	  file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'`
+	  ;;
+	cygwin/*)
+	  file=`cygpath -m "$file" || echo "$file"`
+	  ;;
+	wine/*)
+	  file=`winepath -w "$file" || echo "$file"`
+	  ;;
+      esac
+      ;;
+  esac
+}
+
+# func_cl_dashL linkdir
+# Make cl look for libraries in LINKDIR
+func_cl_dashL ()
+{
+  func_file_conv "$1"
+  if test -z "$lib_path"; then
+    lib_path=$file
+  else
+    lib_path="$lib_path;$file"
+  fi
+  linker_opts="$linker_opts -LIBPATH:$file"
+}
+
+# func_cl_dashl library
+# Do a library search-path lookup for cl
+func_cl_dashl ()
+{
+  lib=$1
+  found=no
+  save_IFS=$IFS
+  IFS=';'
+  for dir in $lib_path $LIB
+  do
+    IFS=$save_IFS
+    if $shared && test -f "$dir/$lib.dll.lib"; then
+      found=yes
+      lib=$dir/$lib.dll.lib
+      break
+    fi
+    if test -f "$dir/$lib.lib"; then
+      found=yes
+      lib=$dir/$lib.lib
+      break
+    fi
+    if test -f "$dir/lib$lib.a"; then
+      found=yes
+      lib=$dir/lib$lib.a
+      break
+    fi
+  done
+  IFS=$save_IFS
+
+  if test "$found" != yes; then
+    lib=$lib.lib
+  fi
+}
+
+# func_cl_wrapper cl arg...
+# Adjust compile command to suit cl
+func_cl_wrapper ()
+{
+  # Assume a capable shell
+  lib_path=
+  shared=:
+  linker_opts=
+  for arg
+  do
+    if test -n "$eat"; then
+      eat=
+    else
+      case $1 in
+	-o)
+	  # configure might choose to run compile as 'compile cc -o foo foo.c'.
+	  eat=1
+	  case $2 in
+	    *.o | *.[oO][bB][jJ])
+	      func_file_conv "$2"
+	      set x "$@" -Fo"$file"
+	      shift
+	      ;;
+	    *)
+	      func_file_conv "$2"
+	      set x "$@" -Fe"$file"
+	      shift
+	      ;;
+	  esac
+	  ;;
+	-I)
+	  eat=1
+	  func_file_conv "$2" mingw
+	  set x "$@" -I"$file"
+	  shift
+	  ;;
+	-I*)
+	  func_file_conv "${1#-I}" mingw
+	  set x "$@" -I"$file"
+	  shift
+	  ;;
+	-l)
+	  eat=1
+	  func_cl_dashl "$2"
+	  set x "$@" "$lib"
+	  shift
+	  ;;
+	-l*)
+	  func_cl_dashl "${1#-l}"
+	  set x "$@" "$lib"
+	  shift
+	  ;;
+	-L)
+	  eat=1
+	  func_cl_dashL "$2"
+	  ;;
+	-L*)
+	  func_cl_dashL "${1#-L}"
+	  ;;
+	-static)
+	  shared=false
+	  ;;
+	-Wl,*)
+	  arg=${1#-Wl,}
+	  save_ifs="$IFS"; IFS=','
+	  for flag in $arg; do
+	    IFS="$save_ifs"
+	    linker_opts="$linker_opts $flag"
+	  done
+	  IFS="$save_ifs"
+	  ;;
+	-Xlinker)
+	  eat=1
+	  linker_opts="$linker_opts $2"
+	  ;;
+	-*)
+	  set x "$@" "$1"
+	  shift
+	  ;;
+	*.cc | *.CC | *.cxx | *.CXX | *.[cC]++)
+	  func_file_conv "$1"
+	  set x "$@" -Tp"$file"
+	  shift
+	  ;;
+	*.c | *.cpp | *.CPP | *.lib | *.LIB | *.Lib | *.OBJ | *.obj | *.[oO])
+	  func_file_conv "$1" mingw
+	  set x "$@" "$file"
+	  shift
+	  ;;
+	*)
+	  set x "$@" "$1"
+	  shift
+	  ;;
+      esac
+    fi
+    shift
+  done
+  if test -n "$linker_opts"; then
+    linker_opts="-link$linker_opts"
+  fi
+  exec "$@" $linker_opts
+  exit 1
+}
+
+eat=
+
+case $1 in
+  '')
+     echo "$0: No command.  Try '$0 --help' for more information." 1>&2
+     exit 1;
+     ;;
+  -h | --h*)
+    cat <<\EOF
+Usage: compile [--help] [--version] PROGRAM [ARGS]
+
+Wrapper for compilers which do not understand '-c -o'.
+Remove '-o dest.o' from ARGS, run PROGRAM with the remaining
+arguments, and rename the output as expected.
+
+If you are trying to build a whole package this is not the
+right script to run: please start by reading the file 'INSTALL'.
+
+Report bugs to <bug-automake@gnu.org>.
+EOF
+    exit $?
+    ;;
+  -v | --v*)
+    echo "compile $scriptversion"
+    exit $?
+    ;;
+  cl | *[/\\]cl | cl.exe | *[/\\]cl.exe | \
+  icl | *[/\\]icl | icl.exe | *[/\\]icl.exe )
+    func_cl_wrapper "$@"      # Doesn't return...
+    ;;
+esac
+
+ofile=
+cfile=
+
+for arg
+do
+  if test -n "$eat"; then
+    eat=
+  else
+    case $1 in
+      -o)
+	# configure might choose to run compile as 'compile cc -o foo foo.c'.
+	# So we strip '-o arg' only if arg is an object.
+	eat=1
+	case $2 in
+	  *.o | *.obj)
+	    ofile=$2
+	    ;;
+	  *)
+	    set x "$@" -o "$2"
+	    shift
+	    ;;
+	esac
+	;;
+      *.c)
+	cfile=$1
+	set x "$@" "$1"
+	shift
+	;;
+      *)
+	set x "$@" "$1"
+	shift
+	;;
+    esac
+  fi
+  shift
+done
+
+if test -z "$ofile" || test -z "$cfile"; then
+  # If no '-o' option was seen then we might have been invoked from a
+  # pattern rule where we don't need one.  That is ok -- this is a
+  # normal compilation that the losing compiler can handle.  If no
+  # '.c' file was seen then we are probably linking.  That is also
+  # ok.
+  exec "$@"
+fi
+
+# Name of file we expect compiler to create.
+cofile=`echo "$cfile" | sed 's|^.*[\\/]||; s|^[a-zA-Z]:||; s/\.c$/.o/'`
+
+# Create the lock directory.
+# Note: use '[/\\:.-]' here to ensure that we don't use the same name
+# that we are using for the .o file.  Also, base the name on the expected
+# object file name, since that is what matters with a parallel build.
+lockdir=`echo "$cofile" | sed -e 's|[/\\:.-]|_|g'`.d
+while true; do
+  if mkdir "$lockdir" >/dev/null 2>&1; then
+    break
+  fi
+  sleep 1
+done
+# FIXME: race condition here if user kills between mkdir and trap.
+trap "rmdir '$lockdir'; exit 1" 1 2 15
+
+# Run the compile.
+"$@"
+ret=$?
+
+if test -f "$cofile"; then
+  test "$cofile" = "$ofile" || mv "$cofile" "$ofile"
+elif test -f "${cofile}bj"; then
+  test "${cofile}bj" = "$ofile" || mv "${cofile}bj" "$ofile"
+fi
+
+rmdir "$lockdir"
+exit $ret
+
+# Local Variables:
+# mode: shell-script
+# sh-indentation: 2
+# eval: (add-hook 'before-save-hook 'time-stamp)
+# time-stamp-start: "scriptversion="
+# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-time-zone: "UTC0"
+# time-stamp-end: "; # UTC"
+# End:
--- a/config.guess
+++ b/config.guess
--- a/config.h.in
+++ b/config.h.in
@@ -0,0 +1,129 @@
+/* config.h.in.  Generated from configure.ac by autoheader.  */
+
+/* Define to 1 if you have the <dlfcn.h> header file. */
+#undef HAVE_DLFCN_H
+
+/* Define to 1 if you have the `feenableexcept' function. */
+#undef HAVE_FEENABLEEXCEPT
+
+/* Define to 1 if you have the <inttypes.h> header file. */
+#undef HAVE_INTTYPES_H
+
+/* Define to 1 if you have the `m' library (-lm). */
+#undef HAVE_LIBM
+
+/* Define to 1 if you have the `z' library (-lz). */
+#undef HAVE_LIBZ
+
+/* Define to 1 if you have the <memory.h> header file. */
+#undef HAVE_MEMORY_H
+
+/* Define to 1 if you have the `memset' function. */
+#undef HAVE_MEMSET
+
+/* Define to 1 if you have the `pow' function. */
+#undef HAVE_POW
+
+/* Define to 1 if you have the <stdint.h> header file. */
+#undef HAVE_STDINT_H
+
+/* Define to 1 if you have the <stdlib.h> header file. */
+#undef HAVE_STDLIB_H
+
+/* Define to 1 if you have the <strings.h> header file. */
+#undef HAVE_STRINGS_H
+
+/* Define to 1 if you have the <string.h> header file. */
+#undef HAVE_STRING_H
+
+/* Define to 1 if you have the <sys/stat.h> header file. */
+#undef HAVE_SYS_STAT_H
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+#undef HAVE_SYS_TYPES_H
+
+/* Define to 1 if you have the <unistd.h> header file. */
+#undef HAVE_UNISTD_H
+
+/* Define to the sub-directory where libtool stores uninstalled libraries. */
+#undef LT_OBJDIR
+
+/* Name of package */
+#undef PACKAGE
+
+/* Define to the address where bug reports for this package should be sent. */
+#undef PACKAGE_BUGREPORT
+
+/* Define to the full name of this package. */
+#undef PACKAGE_NAME
+
+/* Define to the full name and version of this package. */
+#undef PACKAGE_STRING
+
+/* Define to the one symbol short name of this package. */
+#undef PACKAGE_TARNAME
+
+/* Define to the home page for this package. */
+#undef PACKAGE_URL
+
+/* Define to the version of this package. */
+#undef PACKAGE_VERSION
+
+/* Turn on ARM Neon optimizations at run-time */
+#undef PNG_ARM_NEON_API_SUPPORTED
+
+/* Check for ARM Neon support at run-time */
+#undef PNG_ARM_NEON_CHECK_SUPPORTED
+
+/* Enable ARM Neon optimizations */
+#undef PNG_ARM_NEON_OPT
+
+/* Enable Intel SSE optimizations */
+#undef PNG_INTEL_SSE_OPT
+
+/* Turn on MIPS MSA optimizations at run-time */
+#undef PNG_MIPS_MSA_API_SUPPORTED
+
+/* Check for MIPS MSA support at run-time */
+#undef PNG_MIPS_MSA_CHECK_SUPPORTED
+
+/* Enable MIPS MSA optimizations */
+#undef PNG_MIPS_MSA_OPT
+
+/* Turn on POWERPC VSX optimizations at run-time */
+#undef PNG_POWERPC_VSX_API_SUPPORTED
+
+/* Check for POWERPC VSX support at run-time */
+#undef PNG_POWERPC_VSX_CHECK_SUPPORTED
+
+/* Enable POWERPC VSX optimizations */
+#undef PNG_POWERPC_VSX_OPT
+
+/* Define to 1 if you have the ANSI C header files. */
+#undef STDC_HEADERS
+
+/* Define to 1 if your <sys/time.h> declares `struct tm'. */
+#undef TM_IN_SYS_TIME
+
+/* Version number of package */
+#undef VERSION
+
+/* Define to empty if `const' does not conform to ANSI C. */
+#undef const
+
+/* Define to the equivalent of the C99 'restrict' keyword, or to
+   nothing if this is not supported.  Do not define if restrict is
+   supported directly.  */
+#undef restrict
+/* Work around a bug in Sun C++: it does not support _Restrict or
+   __restrict__, even though the corresponding Sun C compiler ends up with
+   "#define restrict _Restrict" or "#define restrict __restrict__" in the
+   previous line.  Perhaps some future version of Sun C++ will work with
+   restrict; if so, hopefully it defines __RESTRICT like Sun C does.  */
+#if defined __SUNPRO_CC && !defined __RESTRICT
+# define _Restrict
+# define __restrict__
+#endif
+
+/* Define to `unsigned int' if <sys/types.h> does not define. */
+#undef size_t
--- a/config.sub
+++ b/config.sub
--- a/16129
+++ b/16129
--- a/configure.ac
+++ b/configure.ac
@@ -25,7 +25,7 @@ AC_PREREQ([2.68])

 dnl Version number stuff here:

-AC_INIT([libpng],[1.6.32beta03],[png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng],[1.6.35],[png-mng-implement@lists.sourceforge.net])
 AC_CONFIG_MACRO_DIR([scripts])

 # libpng does not follow GNU file name conventions (hence 'foreign')
@@ -46,10 +46,10 @@ dnl automake, so the following is not necessary (and is not defined anyway):
 dnl AM_PREREQ([1.11.2])
 dnl stop configure from automagically running automake

-PNGLIB_VERSION=1.6.32beta03
+PNGLIB_VERSION=1.6.35
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=6
-PNGLIB_RELEASE=32
+PNGLIB_RELEASE=35

 dnl End of version number stuff

--- a/contrib/conftest/pngcp.dfa
+++ b/contrib/conftest/pngcp.dfa
@@ -33,7 +33,7 @@ option WRITE_16BIT on
 option WRITE_FILTER on

 # pngcp needs this to preserve unknown chunks, switching all these on means that
-# pngcp can work without explicit known chunk reading suppport
+# pngcp can work without explicit known chunk reading support
 option UNKNOWN_CHUNKS on
 option SET_UNKNOWN_CHUNKS on
 option HANDLE_AS_UNKNOWN on
--- a/contrib/examples/iccfrompng.c
+++ b/contrib/examples/iccfrompng.c
@@ -10,7 +10,7 @@
 * without processing the image.  Notice that some header information may occur
 * after the image data. Textual data and comments are an example; the approach
 * in this file won't work reliably for such data because it only looks for the
- * information in the section of the file that preceeds the image data.
+ * information in the section of the file that precedes the image data.
 *
 * Compile and link against libpng and zlib, plus anything else required on the
 * system you use.
--- a/contrib/libtests/makepng.c
+++ b/contrib/libtests/makepng.c
@@ -950,7 +950,7 @@ write_png(const char **name, FILE *fp, int color_type, int bit_depth,
            int passes = 1;
 #        endif /* !WRITE_INTERLACING */
         int pass;
-         png_size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr);
+         size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr);

         row = malloc(rowbytes);

@@ -1094,7 +1094,7 @@ load_file(png_const_charp name, png_bytepp result)
   return 0;
 }

-static png_size_t
+static size_t
 load_fake(png_charp param, png_bytepp profile)
 {
   char *endptr = NULL;
@@ -1164,7 +1164,7 @@ insert_iCCP(png_structp png_ptr, png_infop info_ptr, int nparams,
   {
      case '<':
         {
-            png_size_t filelen = load_file(params[1]+1, &profile);
+            size_t filelen = load_file(params[1]+1, &profile);
            if (filelen > 0xfffffffc) /* Maximum profile length */
            {
               fprintf(stderr, "%s: file too long (%lu) for an ICC profile\n",
@@ -1179,7 +1179,7 @@ insert_iCCP(png_structp png_ptr, png_infop info_ptr, int nparams,
      case '0': case '1': case '2': case '3': case '4':
      case '5': case '6': case '7': case '8': case '9':
         {
-            png_size_t fake_len = load_fake(params[1], &profile);
+            size_t fake_len = load_fake(params[1], &profile);

            if (fake_len > 0) /* else a simple parameter */
            {
@@ -1274,7 +1274,7 @@ set_text(png_structp png_ptr, png_infop info_ptr, png_textp text,
      case '5': case '6': case '7': case '8': case '9':
         {
            png_bytep data = NULL;
-            png_size_t fake_len = load_fake(param, &data);
+            size_t fake_len = load_fake(param, &data);

            if (fake_len > 0) /* else a simple parameter */
            {
--- a/contrib/libtests/pngimage.c
+++ b/contrib/libtests/pngimage.c
@@ -551,7 +551,7 @@ struct display
   png_structp    original_pp;       /* used on the original read */
   png_infop      original_ip;       /* set by the original read */

-   png_size_t     original_rowbytes; /* of the original rows: */
+   size_t         original_rowbytes; /* of the original rows: */
   png_bytepp     original_rows;     /* from the original read */

   /* Original chunks valid */
@@ -807,7 +807,7 @@ display_cache_file(struct display *dp, const char *filename)

 static void
 buffer_read(struct display *dp, struct buffer *bp, png_bytep data,
-   png_size_t size)
+   size_t size)
 {
   struct buffer_list *last = bp->current;
   size_t read_count = bp->read_count;
@@ -855,7 +855,7 @@ buffer_read(struct display *dp, struct buffer *bp, png_bytep data,
 }

 static void PNGCBAPI
-read_function(png_structp pp, png_bytep data, png_size_t size)
+read_function(png_structp pp, png_bytep data, size_t size)
 {
   buffer_read(get_dp(pp), get_buffer(pp), data, size);
 }
@@ -927,7 +927,7 @@ update_display(struct display *dp)
   png_structp pp;
   png_infop   ip;

-   /* Now perform the initial read with a 0 tranform. */
+   /* Now perform the initial read with a 0 transform. */
   read_png(dp, &dp->original_file, "original read", 0/*no transform*/);

   /* Move the result to the 'original' fields */
@@ -1267,7 +1267,7 @@ compare_read(struct display *dp, int applied_transforms)
 #ifdef PNG_WRITE_PNG_SUPPORTED
 static void
 buffer_write(struct display *dp, struct buffer *buffer, png_bytep data,
-   png_size_t size)
+   size_t size)
   /* Generic write function used both from the write callback provided to
    * libpng and from the generic read code.
    */
@@ -1311,7 +1311,7 @@ buffer_write(struct display *dp, struct buffer *buffer, png_bytep data,
 }

 static void PNGCBAPI
-write_function(png_structp pp, png_bytep data, png_size_t size)
+write_function(png_structp pp, png_bytep data, size_t size)
 {
   buffer_write(get_dp(pp), get_buffer(pp), data, size);
 }
--- a/contrib/libtests/pngstest.c
+++ b/contrib/libtests/pngstest.c
@@ -578,11 +578,11 @@ typedef struct
   int         stride_extra;
   FILE       *input_file;
   png_voidp   input_memory;
-   png_size_t  input_memory_size;
+   size_t      input_memory_size;
   png_bytep   buffer;
   ptrdiff_t   stride;
-   png_size_t  bufsize;
-   png_size_t  allocsize;
+   size_t      bufsize;
+   size_t      allocsize;
   char        tmpfile_name[32];
   png_uint_16 colormap[256*4];
 }
@@ -665,7 +665,7 @@ static void initimage(Image *image, png_uint_32 opts, const char *file_name,
 static void
 allocbuffer(Image *image)
 {
-   png_size_t size = PNG_IMAGE_BUFFER_SIZE(image->image, image->stride);
+   size_t size = PNG_IMAGE_BUFFER_SIZE(image->image, image->stride);

   if (size+32 > image->bufsize)
   {
@@ -1142,7 +1142,7 @@ get_pixel(png_uint_32 format))(Pixel *p, png_const_voidp pb)
   }
 }

-/* Convertion between pixel formats.  The code above effectively eliminates the
+/* Conversion between pixel formats.  The code above effectively eliminates the
 * component ordering changes leaving three basic changes:
 *
 * 1) Remove an alpha channel by pre-multiplication or compositing on a
@@ -2036,7 +2036,7 @@ typedef struct
   /* Precalculated values: */
   int          in_opaque;   /* Value of input alpha that is opaque */
   int          is_palette;  /* Sample values come from the palette */
-   int          accumulate;  /* Accumlate component errors (don't log) */
+   int          accumulate;  /* Accumulate component errors (don't log) */
   int          output_8bit; /* Output is 8-bit (else 16-bit) */

   void (*in_gp)(Pixel*, png_const_voidp);
--- a/contrib/libtests/pngunknown.c
+++ b/contrib/libtests/pngunknown.c
@@ -1,7 +1,7 @@

 /* pngunknown.c - test the read side unknown chunk handling
 *
- * Last changed in libpng 1.6.32 [(PENDING RELEASE)]
+ * Last changed in libpng 1.6.32 [August 24, 2017]
 * Copyright (c) 2015,2017 Glenn Randers-Pehrson
 * Written by John Cunningham Bowler
 *
@@ -85,7 +85,7 @@ typedef png_byte *png_const_bytep;
 #define PNG_WRITE_16BIT_SUPPORTED
 #define PNG_READ_16BIT_SUPPORTED

-/* This comes from pnglibconf.h afer 1.5: */
+/* This comes from pnglibconf.h after 1.5: */
 #define PNG_FP_1 100000
 #define PNG_GAMMA_THRESHOLD_FIXED\
   ((png_fixed_point)(PNG_GAMMA_THRESHOLD * PNG_FP_1))
--- a/contrib/libtests/pngvalid.c
+++ b/contrib/libtests/pngvalid.c
@@ -102,7 +102,7 @@ typedef png_byte *png_const_bytep;
 #define PNG_WRITE_16BIT_SUPPORTED
 #define PNG_READ_16BIT_SUPPORTED

-/* This comes from pnglibconf.h afer 1.5: */
+/* This comes from pnglibconf.h after 1.5: */
 #define PNG_FP_1 100000
 #define PNG_GAMMA_THRESHOLD_FIXED\
   ((png_fixed_point)(PNG_GAMMA_THRESHOLD * PNG_FP_1))
@@ -711,7 +711,7 @@ typedef struct png_store_file
   unsigned int            IDAT_bits; /* Number of bits in IDAT size */
   png_uint_32             IDAT_size; /* Total size of IDAT data */
   png_uint_32             id;        /* must be correct (see FILEID) */
-   png_size_t              datacount; /* In this (the last) buffer */
+   size_t                  datacount; /* In this (the last) buffer */
   png_store_buffer        data;      /* Last buffer in file */
   int                     npalette;  /* Number of entries in palette */
   store_palette_entry*    palette;   /* May be NULL */
@@ -777,10 +777,10 @@ typedef struct png_store
   png_infop          piread;
   png_store_file*    current;  /* Set when reading */
   png_store_buffer*  next;     /* Set when reading */
-   png_size_t         readpos;  /* Position in *next */
+   size_t             readpos;  /* Position in *next */
   png_byte*          image;    /* Buffer for reading interlaced images */
-   png_size_t         cb_image; /* Size of this buffer */
-   png_size_t         cb_row;   /* Row size of the image(s) */
+   size_t             cb_image; /* Size of this buffer */
+   size_t             cb_row;   /* Row size of the image(s) */
   uLong              IDAT_crc;
   png_uint_32        IDAT_len; /* Used when re-chunking IDAT chunks */
   png_uint_32        IDAT_pos; /* Used when re-chunking IDAT chunks */
@@ -791,7 +791,7 @@ typedef struct png_store
   png_store_file*    saved;
   png_structp        pwrite;   /* Used when writing a new file */
   png_infop          piwrite;
-   png_size_t         writepos; /* Position in .new */
+   size_t             writepos; /* Position in .new */
   char               wname[FILE_NAME_SIZE];
   png_store_buffer   new;      /* The end of the new PNG file being written. */
   store_pool         write_memory_pool;
@@ -1125,7 +1125,7 @@ static png_bytep
 store_image_row(const png_store* ps, png_const_structp pp, int nImage,
   png_uint_32 y)
 {
-   png_size_t coffset = (nImage * ps->image_h + y) * (ps->cb_row + 5) + 2;
+   size_t coffset = (nImage * ps->image_h + y) * (ps->cb_row + 5) + 2;

   if (ps->image == NULL)
      png_error(pp, "no allocated image");
@@ -1160,9 +1160,9 @@ store_image_free(png_store *ps, png_const_structp pp)

 static void
 store_ensure_image(png_store *ps, png_const_structp pp, int nImages,
-   png_size_t cbRow, png_uint_32 cRows)
+   size_t cbRow, png_uint_32 cRows)
 {
-   png_size_t cb = nImages * cRows * (cbRow + 5);
+   size_t cb = nImages * cRows * (cbRow + 5);

   if (ps->cb_image < cb)
   {
@@ -1234,7 +1234,7 @@ store_image_check(const png_store* ps, png_const_structp pp, int iImage)
      png_error(pp, "image overwrite");
   else
   {
-      png_size_t cbRow = ps->cb_row;
+      size_t cbRow = ps->cb_row;
      png_uint_32 rows = ps->image_h;

      image += iImage * (cbRow+5) * ps->image_h;
@@ -1278,7 +1278,7 @@ valid_chunktype(png_uint_32 chunktype)
 }

 static void PNGCBAPI
-store_write(png_structp ppIn, png_bytep pb, png_size_t st)
+store_write(png_structp ppIn, png_bytep pb, size_t st)
 {
   png_const_structp pp = ppIn;
   png_store *ps = voidcast(png_store*, png_get_io_ptr(pp));
@@ -1346,13 +1346,13 @@ store_write(png_structp ppIn, png_bytep pb, png_size_t st)

      else /* chunkpos >= 8 */
      {
-         png_size_t cb = st;
+         size_t cb = st;

         if (cb > STORE_BUFFER_SIZE - writepos)
            cb = STORE_BUFFER_SIZE - writepos;

         if (cb  > chunklen - chunkpos/* bytes left in chunk*/)
-            cb = (png_size_t)/*SAFE*/(chunklen - chunkpos);
+            cb = (size_t)/*SAFE*/(chunklen - chunkpos);

         memcpy(ps->new.buffer + writepos, pb, cb);
         chunkpos += (png_uint_32)/*SAFE*/cb;
@@ -1440,7 +1440,7 @@ store_read_buffer_next(png_store *ps)
 * during progressive read, where the io_ptr is set internally by libpng.
 */
 static void
-store_read_imp(png_store *ps, png_bytep pb, png_size_t st)
+store_read_imp(png_store *ps, png_bytep pb, size_t st)
 {
   if (ps->current == NULL || ps->next == NULL)
      png_error(ps->pread, "store state damaged");
@@ -1463,14 +1463,13 @@ store_read_imp(png_store *ps, png_bytep pb, png_size_t st)
   }
 }

-static png_size_t
-store_read_chunk(png_store *ps, png_bytep pb, const png_size_t max,
-      const png_size_t min)
+static size_t
+store_read_chunk(png_store *ps, png_bytep pb, size_t max, size_t min)
 {
   png_uint_32 chunklen = ps->chunklen;
   png_uint_32 chunktype = ps->chunktype;
   png_uint_32 chunkpos = ps->chunkpos;
-   png_size_t st = max;
+   size_t st = max;

   if (st > 0) do
   {
@@ -1601,8 +1600,8 @@ store_read_chunk(png_store *ps, png_bytep pb, const png_size_t max,

               store_read_imp(ps, pb, avail);
               ps->IDAT_crc = crc32(ps->IDAT_crc, pb, avail);
-               pb += (png_size_t)/*SAFE*/avail;
-               st -= (png_size_t)/*SAFE*/avail;
+               pb += (size_t)/*SAFE*/avail;
+               st -= (size_t)/*SAFE*/avail;
               chunkpos += (png_uint_32)/*SAFE*/avail;
               IDAT_size -= (png_uint_32)/*SAFE*/avail;
               IDAT_pos += (png_uint_32)/*SAFE*/avail;
@@ -1669,10 +1668,10 @@ store_read_chunk(png_store *ps, png_bytep pb, const png_size_t max,

         else /* Return chunk bytes, including the CRC */
         {
-            png_size_t avail = st;
+            size_t avail = st;

            if (avail > chunklen - chunkpos)
-               avail = (png_size_t)/*SAFE*/(chunklen - chunkpos);
+               avail = (size_t)/*SAFE*/(chunklen - chunkpos);

            store_read_imp(ps, pb, avail);
            pb += avail;
@@ -1698,7 +1697,7 @@ store_read_chunk(png_store *ps, png_bytep pb, const png_size_t max,
 }

 static void PNGCBAPI
-store_read(png_structp ppIn, png_bytep pb, png_size_t st)
+store_read(png_structp ppIn, png_bytep pb, size_t st)
 {
   png_const_structp pp = ppIn;
   png_store *ps = voidcast(png_store*, png_get_io_ptr(pp));
@@ -1724,7 +1723,7 @@ store_progressive_read(png_store *ps, png_structp pp, png_infop pi)
   while (store_read_buffer_avail(ps) > 0)
   {
      static png_uint_32 noise = 2;
-      png_size_t cb;
+      size_t cb;
      png_byte buffer[512];

      /* Generate 15 more bits of stuff: */
@@ -2991,7 +2990,7 @@ modifier_setbuffer(png_modifier *pm)
 * png_struct.
 */
 static void
-modifier_read_imp(png_modifier *pm, png_bytep pb, png_size_t st)
+modifier_read_imp(png_modifier *pm, png_bytep pb, size_t st)
 {
   while (st > 0)
   {
@@ -3137,7 +3136,7 @@ modifier_read_imp(png_modifier *pm, png_bytep pb, png_size_t st)
             */
            if (len+12 <= sizeof pm->buffer)
            {
-               png_size_t s = len+12-pm->buffer_count;
+               size_t s = len+12-pm->buffer_count;
               store_read_chunk(&pm->this, pm->buffer+pm->buffer_count, s, s);
               pm->buffer_count = len+12;

@@ -3196,7 +3195,7 @@ modifier_read_imp(png_modifier *pm, png_bytep pb, png_size_t st)

 /* The callback: */
 static void PNGCBAPI
-modifier_read(png_structp ppIn, png_bytep pb, png_size_t st)
+modifier_read(png_structp ppIn, png_bytep pb, size_t st)
 {
   png_const_structp pp = ppIn;
   png_modifier *pm = voidcast(png_modifier*, png_get_io_ptr(pp));
@@ -3226,7 +3225,7 @@ modifier_progressive_read(png_modifier *pm, png_structp pp, png_infop pi)
   for (;;)
   {
      static png_uint_32 noise = 1;
-      png_size_t cb, cbAvail;
+      size_t cb, cbAvail;
      png_byte buffer[512];

      /* Generate 15 more bits of stuff: */
@@ -5001,7 +5000,7 @@ standard_display_init(standard_display *dp, png_store* ps, png_uint_32 id,
   dp->npalette = 0;
   /* Preset the transparent color to black: */
   memset(&dp->transparent, 0, sizeof dp->transparent);
-   /* Preset the palette to full intensity/opaque througout: */
+   /* Preset the palette to full intensity/opaque throughout: */
   memset(dp->palette, 0xff, sizeof dp->palette);
 }

@@ -5270,7 +5269,7 @@ standard_info_part1(standard_display *dp, png_structp pp, png_infop pi)
    */
   standard_palette_validate(dp, pp, pi);

-   /* In any case always check for a tranparent color (notice that the
+   /* In any case always check for a transparent color (notice that the
    * colour type 3 case must not give a successful return on the get_tRNS call
    * with these arguments!)
    */
@@ -6780,7 +6779,7 @@ transform_image_validate(transform_display *dp, png_const_structp pp,
   store_image_check(dp->this.ps, pp, 0);

   /* Read the palette corresponding to the output if the output colour type
-    * indicates a palette, othewise set out_palette to garbage.
+    * indicates a palette, otherwise set out_palette to garbage.
    */
   if (out_ct == PNG_COLOR_TYPE_PALETTE)
   {
@@ -7991,7 +7990,7 @@ image_transform_png_set_rgb_to_gray_mod(const image_transform *this,
         /* Now calculate the actual gray values.  Although the error in the
          * coefficients depends on whether they were specified on the command
          * line (in which case truncation to 15 bits happened) or not (rounding
-          * was used) the maxium error in an individual coefficient is always
+          * was used) the maximum error in an individual coefficient is always
          * 2/32768, because even in the rounding case the requirement that
          * coefficients add up to 32768 can cause a larger rounding error.
          *
@@ -8207,7 +8206,7 @@ image_transform_png_set_rgb_to_gray_mod(const image_transform *this,
      that->bluef = that->greenf = that->redf = gray;
      that->bluee = that->greene = that->rede = err;

-      /* The sBIT is the minium of the three colour channel sBITs. */
+      /* The sBIT is the minimum of the three colour channel sBITs. */
      if (that->red_sBIT > that->green_sBIT)
         that->red_sBIT = that->green_sBIT;
      if (that->red_sBIT > that->blue_sBIT)
@@ -9746,7 +9745,7 @@ gamma_component_validate(const char *name, const validate_info *vi,
       *
       * pngvalid calculations:
       *  input_sample: linear result; i linearized and composed, range 0..1
-       *  encoded_sample: encoded result; input_sample scaled to ouput bit depth
+       *  encoded_sample: encoded result; input_sample scaled to output bit depth
       *
       * libpng calculations:
       *  output: linear result; od scaled to 0..1 and linearized
@@ -10183,10 +10182,10 @@ gamma_image_validate(gamma_display *dp, png_const_structp pp,
    * Since the library must quantize the output to 8 or 16 bits there is
    * a fundamental limit on the accuracy of the output of +/-.5 - this
    * quantization limit is included in addition to the other limits
-    * specified by the paramaters to the API.  (Effectively, add .5
+    * specified by the parameters to the API.  (Effectively, add .5
    * everywhere.)
    *
-    * The behavior of the 'sbit' paramter is defined by section 12.5
+    * The behavior of the 'sbit' parameter is defined by section 12.5
    * (sample depth scaling) of the PNG spec.  That section forces the
    * decoder to assume that the PNG values have been scaled if sBIT is
    * present:
@@ -11729,7 +11728,7 @@ int main(int argc, char **argv)

   /* Some default values (set the behavior for 'make check' here).
    * These values simply control the maximum error permitted in the gamma
-    * transformations.  The practial limits for human perception are described
+    * transformations.  The practical limits for human perception are described
    * below (the setting for maxpc16), however for 8 bit encodings it isn't
    * possible to meet the accepted capabilities of human vision - i.e. 8 bit
    * images can never be good enough, regardless of encoding.
--- a/contrib/libtests/readpng.c
+++ b/contrib/libtests/readpng.c
@@ -60,7 +60,7 @@ read_png(FILE *fp)
   png_read_info(png_ptr, info_ptr);

   {
-      png_size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr);
+      size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr);

      /* Failure to initialize these is harmless */
      row = malloc(rowbytes);
--- a/contrib/libtests/tarith.c
+++ b/contrib/libtests/tarith.c
@@ -108,7 +108,7 @@ int validation_ascii_to_fp(int count, int argc, char **argv)

   do
   {
-      png_size_t index;
+      size_t index;
      int state, failed = 0;
      char buffer[64];

@@ -176,7 +176,7 @@ int validation_ascii_to_fp(int count, int argc, char **argv)
      }
      else if (PNG_FP_IS_POSITIVE(state) && !(test > 0))
      {
-         fprintf(stderr, "%g[%d] -> '%s' but postive value not so reported\n",
+         fprintf(stderr, "%g[%d] -> '%s' but positive value not so reported\n",
            test, precision, buffer);
         failed = 1;
         assert(!PNG_FP_IS_NEGATIVE(state));
@@ -329,7 +329,7 @@ static int check_one_character(checkfp_command *co, checkfp_control c, int ch)
 {
   /* Test this character (ch) to ensure the parser does the correct thing.
    */
-   png_size_t index = 0;
+   size_t index = 0;
   const char test = (char)ch;
   const int number_is_valid = png_check_fp_number(&test, 1, &c.state, &index);
   const int character_accepted = (index == 1);
--- a/contrib/libtests/timepng.c
+++ b/contrib/libtests/timepng.c
@@ -65,7 +65,7 @@ typedef struct
 }  io_data;

 static PNG_CALLBACK(void, read_and_copy,
-      (png_structp png_ptr, png_bytep buffer, png_size_t cb))
+      (png_structp png_ptr, png_bytep buffer, size_t cb))
 {
   io_data *io = (io_data*)png_get_io_ptr(png_ptr);

@@ -100,7 +100,7 @@ static void read_by_row(png_structp png_ptr, png_infop info_ptr,
   png_read_info(png_ptr, info_ptr);

   {
-      png_size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr);
+      size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr);

      row = voidcast(png_bytep,malloc(rowbytes));
      display = voidcast(png_bytep,malloc(rowbytes));
--- a/contrib/oss-fuzz/Dockerfile
+++ b/contrib/oss-fuzz/Dockerfile
@@ -0,0 +1,25 @@
+# Copyright 2016 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+FROM gcr.io/oss-fuzz-base/base-builder
+MAINTAINER glennrp@gmail.com
+RUN apt-get update && \
+    apt-get install -y make autoconf automake libtool
+
+RUN git clone --depth 1 https://github.com/madler/zlib.git
+RUN git clone --depth 1 https://github.com/glennrp/libpng.git
+RUN cp libpng/contrib/oss-fuzz/build.sh $SRC
+WORKDIR libpng
--- a/contrib/oss-fuzz/README.txt
+++ b/contrib/oss-fuzz/README.txt
@@ -0,0 +1,37 @@
+Last changed in libpng 1.6.33 [September 28, 2017]
+Copyright (c) 2017 Glenn Randers-Pehrson
+
+This code is released under the libpng license.
+For conditions of distribution and use, see the disclaimer
+and license in png.h
+
+Files in this directory are used by the oss-fuzz project
+(https://github.com/google/oss-fuzz/tree/master/projects/libpng).
+for "fuzzing" libpng.
+
+They were licensed by Google Inc, using the BSD-like Chromium license,
+which may be found at https://cs.chromium.org/chromium/src/LICENSE, or, if
+noted in the source, under the Apache-2.0 license, which may
+be found at http://www.apache.org/licenses/LICENSE-2.0 .
+If they have been modified, the derivatives are copyright Glenn Randers-Pehrson
+and are released under the same licenses as the originals.  Several of
+the original files (libpng_read_fuzzer.options, png.dict, project.yaml)
+had no licensing information; we assumed that these were under the Chromium
+license. Any new files are released under the libpng license (see png.h).
+
+The files are
+                            Original
+ Filename                   or derived   Copyright          License
+ =========================  ==========   ================   ==========
+ Dockerfile*                derived      2017, Glenn R-P    Apache 2.0
+ build.sh                   derived      2017, Glenn R-P    Apache 2.0
+ libpng_read_fuzzer.cc      derived      2017, Glenn R-P    Chromium
+ libpng_read_fuzzer.options original     2015, Chrome Devs  Chromium
+ png.dict                   original     2015, Chrome Devs  Chromium
+ README.txt (this file)     original     2017, Glenn R-P    libpng
+
+ * Dockerfile is a copy of the file used by oss-fuzz. build.sh,
+   png.dict and libpng_read_fuzzer.* are the actual files used by oss-fuzz,
+   which retrieves them from the libpng repository at Github.
+
+To do: exercise the progressive reader and the png encoder.
--- a/contrib/oss-fuzz/build.sh
+++ b/contrib/oss-fuzz/build.sh
@@ -0,0 +1,51 @@
+#!/bin/bash -eu
+# Copyright 2017-2018 Glenn Randers-Pehrson
+# Copyright 2016 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Last changed in libpng 1.6.35 [July 15, 2018]
+#
+# Revisions by Glenn Randers-Pehrson, 2017:
+# 1. Build only the library, not the tools (changed "make -j$(nproc) all" to
+#     "make -j$(nproc) libpng16.la").
+# 2. Disabled WARNING and WRITE options in pnglibconf.dfa.
+# 3. Build zlib alongside libpng
+################################################################################
+
+# Disable logging via library build configuration control.
+cat scripts/pnglibconf.dfa | \
+  sed -e "s/option STDIO/option STDIO disabled/" \
+      -e "s/option WARNING /option WARNING disabled/" \
+      -e "s/option WRITE enables WRITE_INT_FUNCTIONS/option WRITE disabled/" \
+> scripts/pnglibconf.dfa.temp
+mv scripts/pnglibconf.dfa.temp scripts/pnglibconf.dfa
+
+# build the libpng library.
+autoreconf -f -i
+./configure --with-libpng-prefix=OSS_FUZZ_
+make -j$(nproc) clean
+make -j$(nproc) libpng16.la
+
+# build libpng_read_fuzzer.
+$CXX $CXXFLAGS -std=c++11 -I. \
+     $SRC/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc \
+     -o $OUT/libpng_read_fuzzer \
+     -lFuzzingEngine .libs/libpng16.a -lz
+
+# add seed corpus.
+find $SRC/libpng -name "*.png" | grep -v crashers | \
+     xargs zip $OUT/libpng_read_fuzzer_seed_corpus.zip
+
+cp $SRC/libpng/contrib/oss-fuzz/*.dict \
+     $SRC/libpng/contrib/oss-fuzz/*.options $OUT/
--- a/contrib/oss-fuzz/libpng_read_fuzzer.cc
+++ b/contrib/oss-fuzz/libpng_read_fuzzer.cc
@@ -0,0 +1,190 @@
+
+// libpng_read_fuzzer.cc
+// Copyright 2017-2018 Glenn Randers-Pehrson
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that may
+// be found in the LICENSE file https://cs.chromium.org/chromium/src/LICENSE
+
+// Last changed in libpng 1.6.35 [July 15, 2018]
+
+// The modifications in 2017 by Glenn Randers-Pehrson include
+// 1. addition of a PNG_CLEANUP macro,
+// 2. setting the option to ignore ADLER32 checksums,
+// 3. adding "#include <string.h>" which is needed on some platforms
+//    to provide memcpy().
+// 4. adding read_end_info() and creating an end_info structure.
+// 5. adding calls to png_set_*() transforms commonly used by browsers.
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <vector>
+
+#define PNG_INTERNAL
+#include "png.h"
+
+#define PNG_CLEANUP \
+  if(png_handler.png_ptr) \
+  { \
+    if (png_handler.row_ptr) \
+      png_free(png_handler.png_ptr, png_handler.row_ptr); \
+    if (png_handler.end_info_ptr) \
+      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
+        &png_handler.end_info_ptr); \
+    else if (png_handler.info_ptr) \
+      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
+        nullptr); \
+    else \
+      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
+    png_handler.png_ptr = nullptr; \
+    png_handler.row_ptr = nullptr; \
+    png_handler.info_ptr = nullptr; \
+    png_handler.end_info_ptr = nullptr; \
+  }
+
+struct BufState {
+  const uint8_t* data;
+  size_t bytes_left;
+};
+
+struct PngObjectHandler {
+  png_infop info_ptr = nullptr;
+  png_structp png_ptr = nullptr;
+  png_infop end_info_ptr = nullptr;
+  png_voidp row_ptr = nullptr;
+  BufState* buf_state = nullptr;
+
+  ~PngObjectHandler() {
+    if (row_ptr)
+      png_free(png_ptr, row_ptr);
+    if (end_info_ptr)
+      png_destroy_read_struct(&png_ptr, &info_ptr, &end_info_ptr);
+    else if (info_ptr) 
+      png_destroy_read_struct(&png_ptr, &info_ptr, nullptr);
+    else
+      png_destroy_read_struct(&png_ptr, nullptr, nullptr);
+    delete buf_state;
+  }
+};
+
+void user_read_data(png_structp png_ptr, png_bytep data, size_t length) {
+  BufState* buf_state = static_cast<BufState*>(png_get_io_ptr(png_ptr));
+  if (length > buf_state->bytes_left) {
+    png_error(png_ptr, "read error");
+  }
+  memcpy(data, buf_state->data, length);
+  buf_state->bytes_left -= length;
+  buf_state->data += length;
+}
+
+static const int kPngHeaderSize = 8;
+
+// Entry point for LibFuzzer.
+// Roughly follows the libpng book example:
+// http://www.libpng.org/pub/png/book/chapter13.html
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size < kPngHeaderSize) {
+    return 0;
+  }
+
+  std::vector<unsigned char> v(data, data + size);
+  if (png_sig_cmp(v.data(), 0, kPngHeaderSize)) {
+    // not a PNG.
+    return 0;
+  }
+
+  PngObjectHandler png_handler;
+  png_handler.png_ptr = nullptr;
+  png_handler.row_ptr = nullptr;
+  png_handler.info_ptr = nullptr;
+  png_handler.end_info_ptr = nullptr;
+
+  png_handler.png_ptr = png_create_read_struct
+    (PNG_LIBPNG_VER_STRING, nullptr, nullptr, nullptr);
+  if (!png_handler.png_ptr) {
+    return 0;
+  }
+
+  png_handler.info_ptr = png_create_info_struct(png_handler.png_ptr);
+  if (!png_handler.info_ptr) {
+    PNG_CLEANUP
+    return 0;
+  }
+
+  png_handler.end_info_ptr = png_create_info_struct(png_handler.png_ptr);
+  if (!png_handler.end_info_ptr) {
+    PNG_CLEANUP
+    return 0;
+  }
+
+  png_set_crc_action(png_handler.png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
+#ifdef PNG_IGNORE_ADLER32
+  png_set_option(png_handler.png_ptr, PNG_IGNORE_ADLER32, PNG_OPTION_ON);
+#endif
+
+  // Setting up reading from buffer.
+  png_handler.buf_state = new BufState();
+  png_handler.buf_state->data = data + kPngHeaderSize;
+  png_handler.buf_state->bytes_left = size - kPngHeaderSize;
+  png_set_read_fn(png_handler.png_ptr, png_handler.buf_state, user_read_data);
+  png_set_sig_bytes(png_handler.png_ptr, kPngHeaderSize);
+
+  if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
+    PNG_CLEANUP
+    return 0;
+  }
+
+  // Reading.
+  png_read_info(png_handler.png_ptr, png_handler.info_ptr);
+
+  // reset error handler to put png_deleter into scope.
+  if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
+    PNG_CLEANUP
+    return 0;
+  }
+
+  png_uint_32 width, height;
+  int bit_depth, color_type, interlace_type, compression_type;
+  int filter_type;
+
+  if (!png_get_IHDR(png_handler.png_ptr, png_handler.info_ptr, &width,
+                    &height, &bit_depth, &color_type, &interlace_type,
+                    &compression_type, &filter_type)) {
+    PNG_CLEANUP
+    return 0;
+  }
+
+  // This is going to be too slow.
+  if (width && height > 100000000 / width) {
+    PNG_CLEANUP
+    return 0;
+  }
+
+  // Set several transforms that browsers typically use:
+  png_set_gray_to_rgb(png_handler.png_ptr);
+  png_set_expand(png_handler.png_ptr);
+  png_set_packing(png_handler.png_ptr);
+  png_set_scale_16(png_handler.png_ptr);
+  png_set_tRNS_to_alpha(png_handler.png_ptr);
+
+  int passes = png_set_interlace_handling(png_handler.png_ptr);
+
+  png_read_update_info(png_handler.png_ptr, png_handler.info_ptr);
+
+  png_handler.row_ptr = png_malloc(
+      png_handler.png_ptr, png_get_rowbytes(png_handler.png_ptr,
+                                            png_handler.info_ptr));
+
+  for (int pass = 0; pass < passes; ++pass) {
+    for (png_uint_32 y = 0; y < height; ++y) {
+      png_read_row(png_handler.png_ptr,
+                   static_cast<png_bytep>(png_handler.row_ptr), nullptr);
+    }
+  }
+
+  png_read_end(png_handler.png_ptr, png_handler.end_info_ptr);
+
+  PNG_CLEANUP
+  return 0;
+}
--- a/contrib/oss-fuzz/libpng_read_fuzzer.options
+++ b/contrib/oss-fuzz/libpng_read_fuzzer.options
@@ -0,0 +1,2 @@
+[libfuzzer]
+dict = png.dict
--- a/contrib/oss-fuzz/png.dict
+++ b/contrib/oss-fuzz/png.dict
@@ -0,0 +1,39 @@
+#
+# AFL dictionary for PNG images
+# -----------------------------
+#
+# Just the basic, standard-originating sections; does not include vendor
+# extensions.
+#
+# Created by Michal Zalewski <lcamtuf@google.com>
+#
+
+header_png="\x89PNG\x0d\x0a\x1a\x0a"
+
+section_IDAT="IDAT"
+section_IEND="IEND"
+section_IHDR="IHDR"
+section_PLTE="PLTE"
+section_bKGD="bKGD"
+section_cHRM="cHRM"
+section_eXIf="eXIf"
+section_fRAc="fRAc"
+section_gAMA="gAMA"
+section_gIFg="gIFg"
+section_gIFt="gIFt"
+section_gIFx="gIFx"
+section_hIST="hIST"
+section_iCCP="iCCP"
+section_iTXt="iTXt"
+section_oFFs="oFFs"
+section_pCAL="pCAL"
+section_pHYs="pHYs"
+section_sBIT="sBIT"
+section_sCAL="sCAL"
+section_sPLT="sPLT"
+section_sRGB="sRGB"
+section_sTER="sTER"
+section_tEXt="tEXt"
+section_tIME="tIME"
+section_tRNS="tRNS"
+section_zTXt="zTXt"
--- a/contrib/pngminus/README
+++ b/contrib/pngminus/README
@@ -17,7 +17,7 @@ express or implied warranty.
 Some history
 ------------
 Soon after the creation of PNG in 1995, the need was felt for a set of
-pnmtopng / pngtopnm utilities. Independantly Alexander Lehmann and I
+pnmtopng / pngtopnm utilities. Independently Alexander Lehmann and I
 (Willem van Schaik) started such a project. Luckily we discovered this
 and merged the two together into pnmtopng.tar.gz, which is available
 from a/o ftp://ftp.simplesystems.org/pub/libpng/png/.
--- a/contrib/pngminus/png2pnm.bat
+++ b/contrib/pngminus/png2pnm.bat
@@ -7,7 +7,7 @@ png2pnm.exe -noraw ..\pngsuite\basn0g16.png basn0g16.pgm
 REM -- full-color
 png2pnm.exe -noraw ..\pngsuite\basn2c08.png basn2c08.ppm
 png2pnm.exe -noraw ..\pngsuite\basn2c16.png basn2c16.ppm
-REM -- palletted
+REM -- paletted
 png2pnm.exe -noraw ..\pngsuite\basn3p01.png basn3p01.ppm
 png2pnm.exe -noraw ..\pngsuite\basn3p02.png basn3p02.ppm
 png2pnm.exe -noraw ..\pngsuite\basn3p04.png basn3p04.ppm
@@ -27,7 +27,7 @@ png2pnm.exe -raw ..\pngsuite\basn0g16.png rawn0g16.pgm
 REM -- full-color
 png2pnm.exe -raw ..\pngsuite\basn2c08.png rawn2c08.ppm
 png2pnm.exe -raw ..\pngsuite\basn2c16.png rawn2c16.ppm
-REM -- palletted
+REM -- paletted
 png2pnm.exe -raw ..\pngsuite\basn3p01.png rawn3p01.ppm
 png2pnm.exe -raw ..\pngsuite\basn3p02.png rawn3p02.ppm
 png2pnm.exe -raw ..\pngsuite\basn3p04.png rawn3p04.ppm
--- a/contrib/pngminus/png2pnm.c
+++ b/contrib/pngminus/png2pnm.c
@@ -1,9 +1,12 @@
 /*
 *  png2pnm.c --- conversion from PNG-file to PGM/PPM-file
- *  copyright (C) 1999 by Willem van Schaik <willem at schaik.com>
+ *  copyright (C) 1999,2017 by Willem van Schaik <willem at schaik.com>
 *
 *  version 1.0 - 1999.10.15 - First version.
 *          1.1 - 2017.04.22 - Add buffer-size check (Glenn Randers-Pehrson)
+ *          1.2 - 2017.08.24 - Fix potential overflow in buffer-size check
+ *                             (Glenn Randers-Pehrson)
+ *          1.3 - 2017.08.28 - Add PNGMINUS_UNUSED (Christian Hesse)
 *
 *  Permission to use, copy, modify, and distribute this software and
 *  its documentation for any purpose and without fee is hereby granted,
@@ -42,6 +45,7 @@
 #define PNG_DEBUG 0
 #endif

+
 #include "png.h"

 /* Define png_jmpbuf() in case we are using a pre-1.0.6 version of libpng */
@@ -49,6 +53,14 @@
 #  define png_jmpbuf(png_ptr) ((png_ptr)->jmpbuf)
 #endif

+#ifndef PNGMINUS_UNUSED
+/* Unused formal parameter warnings are silenced using the following macro
+ * which is expected to have no bad effects on performance (optimizing
+ * compilers will probably remove it entirely).
+ */
+#  define PNGMINUS_UNUSED(param) (void)param
+#endif
+
 /* function prototypes */

 int  main (int argc, char *argv[]);
@@ -321,18 +333,21 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file,
  /* row_bytes is the width x number of channels x (bit-depth / 8) */
  row_bytes = png_get_rowbytes (png_ptr, info_ptr);

-  if (height > ((size_t)(-1))/row_bytes) /* too big */ {
+  if ((row_bytes == 0 || (size_t)height > ((size_t)(-1))/(size_t)row_bytes))
+  {
+    /* too big */ 
    png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
    return FALSE;
  }
  if ((png_pixels = (png_byte *)
-     malloc (row_bytes * height * sizeof (png_byte))) == NULL) {
+     malloc ((size_t)row_bytes * (size_t)height * sizeof (png_byte))) == NULL)
+  {
    png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
    return FALSE;
  }

  if ((row_pointers = (png_byte **)
-     malloc (height * sizeof (png_bytep))) == NULL)
+     malloc ((size_t)height * sizeof (png_bytep))) == NULL)
  {
    png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
    free (png_pixels);
@@ -413,7 +428,8 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file,
          if (raw)
            fputc ((int) *pix_ptr++ , alpha_file);
          else
-            if (bit_depth == 16){
+            if (bit_depth == 16)
+            {
              dep_16 = (long) *pix_ptr++;
              fprintf (alpha_file, "%ld ", (dep_16 << 8) + (long) *pix_ptr++);
            }
@@ -437,6 +453,7 @@ BOOL png2pnm (FILE *png_file, FILE *pnm_file, FILE *alpha_file,
  if (png_pixels != (unsigned char*) NULL)
    free (png_pixels);

+  PNGMINUS_UNUSED(raw); /* to quiet a Coverity defect */
  return TRUE;

 } /* end of source */
--- a/contrib/pngminus/png2pnm.sh
+++ b/contrib/pngminus/png2pnm.sh
@@ -8,7 +8,7 @@
 # -- full-color
 ./png2pnm -noraw ../pngsuite/basn2c08.png basn2c08.ppm
 ./png2pnm -noraw ../pngsuite/basn2c16.png basn2c16.ppm
-# -- palletted
+# -- paletted
 ./png2pnm -noraw ../pngsuite/basn3p01.png basn3p01.ppm
 ./png2pnm -noraw ../pngsuite/basn3p02.png basn3p02.ppm
 ./png2pnm -noraw ../pngsuite/basn3p04.png basn3p04.ppm
@@ -28,7 +28,7 @@
 # -- full-color
 ./png2pnm -raw ../pngsuite/basn2c08.png rawn2c08.ppm
 ./png2pnm -raw ../pngsuite/basn2c16.png rawn2c16.ppm
-# -- palletted
+# -- paletted
 ./png2pnm -raw ../pngsuite/basn3p01.png rawn3p01.ppm
 ./png2pnm -raw ../pngsuite/basn3p02.png rawn3p02.ppm
 ./png2pnm -raw ../pngsuite/basn3p04.png rawn3p04.ppm
--- a/contrib/pngminus/pnm2png.bat
+++ b/contrib/pngminus/pnm2png.bat
@@ -7,7 +7,7 @@ pnm2png.exe basn0g16.pgm basn0g16.png
 REM -- full-color
 pnm2png.exe basn2c08.ppm basn2c08.png
 pnm2png.exe basn2c16.ppm basn2c16.png
-REM -- palletted
+REM -- paletted
 pnm2png.exe basn3p01.ppm basn3p01.png
 pnm2png.exe basn3p02.ppm basn3p02.png
 pnm2png.exe basn3p04.ppm basn3p04.png
@@ -27,7 +27,7 @@ pnm2png.exe rawn0g16.pgm rawn0g16.png
 REM -- full-color
 pnm2png.exe rawn2c08.ppm rawn2c08.png
 pnm2png.exe rawn2c16.ppm rawn2c16.png
-REM -- palletted
+REM -- paletted
 pnm2png.exe rawn3p01.ppm rawn3p01.png
 pnm2png.exe rawn3p02.ppm rawn3p02.png
 pnm2png.exe rawn3p04.ppm rawn3p04.png
--- a/contrib/pngminus/pnm2png.c
+++ b/contrib/pngminus/pnm2png.c
@@ -1,10 +1,13 @@
 /*
 *  pnm2png.c --- conversion from PBM/PGM/PPM-file to PNG-file
- *  copyright (C) 1999 by Willem van Schaik <willem at schaik.com>
+ *  copyright (C) 1999,2015,2017 by Willem van Schaik <willem at schaik.com>
 *
 *  version 1.0 - 1999.10.15 - First version.
 *  version 1.1 - 2015.07.29 - Fixed leaks (Glenn Randers-Pehrson)
 *  version 1.2 - 2017.04.22 - Add buffer-size check
+ *          1.3 - 2017.08.24 - Fix potential overflow in buffer-size check
+ *                             (Glenn Randers-Pehrson)
+ *          1.4 - 2017.08.28 - Add PNGMINUS_UNUSED (Christian Hesse)
 *
 *  Permission to use, copy, modify, and distribute this software and
 *  its documentation for any purpose and without fee is hereby granted,
@@ -48,6 +51,15 @@
 #  define png_jmpbuf(png_ptr) ((png_ptr)->jmpbuf)
 #endif

+#ifndef PNGMINUS_UNUSED
+/* Unused formal parameter warnings are silenced using the following macro
+ * which is expected to have no bad effects on performance (optimizing
+ * compilers will probably remove it entirely).
+ */
+#  define PNGMINUS_UNUSED(param) (void)param
+#endif
+
+
 /* function prototypes */

 int  main (int argc, char *argv[]);
@@ -371,14 +383,16 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
    row_bytes = (width * channels * bit_depth + 7) / 8;
  else
 #endif
-    /* row_bytes is the width x number of channels x (bit-depth / 8) */
+  /* row_bytes is the width x number of channels x (bit-depth / 8) */
    row_bytes = width * channels * ((bit_depth <= 8) ? 1 : 2);

-  if (height > ((size_t)(-1))/row_bytes) /* too big */ {
+  if ((row_bytes == 0 || (size_t)height > ((size_t)(-1))/(size_t)row_bytes))
+  {
+    /* too big */ 
    return FALSE;
  }
  if ((png_pixels = (png_byte *)
-     malloc (row_bytes * height * sizeof (png_byte))) == NULL)
+     malloc ((size_t)row_bytes * (size_t)height * sizeof (png_byte))) == NULL)
    return FALSE;

  /* read data from PNM file */
@@ -387,7 +401,8 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
  for (row = 0; row < (int) height; row++)
  {
 #if defined(PNG_WRITE_INVERT_SUPPORTED) || defined(PNG_WRITE_PACK_SUPPORTED)
-    if (packed_bitmap) {
+    if (packed_bitmap)
+    {
      for (i = 0; i < (int) row_bytes; i++)
        /* png supports this format natively so no conversion is needed */
        *pix_ptr++ = get_data (pnm_file, 8);
@@ -508,6 +523,8 @@ BOOL pnm2png (FILE *pnm_file, FILE *png_file, FILE *alpha_file, BOOL interlace,
  if (png_pixels != (unsigned char*) NULL)
    free (png_pixels);

+  PNGMINUS_UNUSED(raw); /* Quiet a Coverity defect */
+
  return TRUE;
 } /* end of pnm2png */

@@ -524,7 +541,8 @@ void get_token(FILE *pnm_file, char *token)
  do
  {
    ret = fgetc(pnm_file);
-    if (ret == '#') {
+    if (ret == '#')
+    {
      /* the rest of this line is a comment */
      do
      {
--- a/contrib/pngminus/pnm2png.sh
+++ b/contrib/pngminus/pnm2png.sh
@@ -8,7 +8,7 @@
 # -- full-color
 ./pnm2png basn2c08.ppm basn2c08.png
 ./pnm2png basn2c16.ppm basn2c16.png
-# -- palletted
+# -- paletted
 ./pnm2png basn3p01.ppm basn3p01.png
 ./pnm2png basn3p02.ppm basn3p02.png
 ./pnm2png basn3p04.ppm basn3p04.png
@@ -28,7 +28,7 @@
 # -- full-color
 ./pnm2png rawn2c08.ppm rawn2c08.png
 ./pnm2png rawn2c16.ppm rawn2c16.png
-# -- palletted
+# -- paletted
 ./pnm2png rawn3p01.ppm rawn3p01.png
 ./pnm2png rawn3p02.ppm rawn3p02.png
 ./pnm2png rawn3p04.ppm rawn3p04.png
--- a/contrib/pngsuite/README
+++ b/contrib/pngsuite/README
@@ -16,6 +16,8 @@ chunks, etc.
 The "ft*.png" images are "free/libre" replacements for the transparent
 corresponding t*.png images in the PngSuite.

+The "i*.png" images are the same images, but interlaced.
+
 The images in this directory represent the basic PNG color-types:
 grayscale (1-16 bit deep), full color (8 or 16 bit), paletted
 (1-8 bit) and grayscale or color images with alpha channel. You
--- a/contrib/pngsuite/bad_interlace_conversions.txt
+++ b/contrib/pngsuite/bad_interlace_conversions.txt
@@ -0,0 +1,9 @@
+basn0g01.png
+basn0g02.png
+basn0g04.png
+basn3p01.png
+basn3p02.png
+basn3p04.png
+ftbbn0g01.png
+ftbbn0g02.png
+ftbbn0g04.png
--- a/contrib/pngsuite/ibasn0g08.png
+++ b/contrib/pngsuite/ibasn0g08.png
--- a/contrib/pngsuite/ibasn0g16.png
+++ b/contrib/pngsuite/ibasn0g16.png
--- a/contrib/pngsuite/ibasn2c08.png
+++ b/contrib/pngsuite/ibasn2c08.png
--- a/contrib/pngsuite/ibasn2c16.png
+++ b/contrib/pngsuite/ibasn2c16.png
--- a/contrib/pngsuite/ibasn3p08.png
+++ b/contrib/pngsuite/ibasn3p08.png
--- a/contrib/pngsuite/ibasn4a08.png
+++ b/contrib/pngsuite/ibasn4a08.png
--- a/contrib/pngsuite/ibasn4a16.png
+++ b/contrib/pngsuite/ibasn4a16.png
--- a/contrib/pngsuite/ibasn6a08.png
+++ b/contrib/pngsuite/ibasn6a08.png
--- a/contrib/pngsuite/ibasn6a16.png
+++ b/contrib/pngsuite/ibasn6a16.png
--- a/contrib/pngsuite/iftbbn2c16.png
+++ b/contrib/pngsuite/iftbbn2c16.png
--- a/contrib/pngsuite/iftbbn3p08.png
+++ b/contrib/pngsuite/iftbbn3p08.png
--- a/contrib/pngsuite/iftbgn2c16.png
+++ b/contrib/pngsuite/iftbgn2c16.png
--- a/contrib/pngsuite/iftbgn3p08.png
+++ b/contrib/pngsuite/iftbgn3p08.png
--- a/contrib/pngsuite/iftbrn2c08.png
+++ b/contrib/pngsuite/iftbrn2c08.png
--- a/contrib/pngsuite/iftbwn0g16.png
+++ b/contrib/pngsuite/iftbwn0g16.png
--- a/contrib/pngsuite/iftbwn3p08.png
+++ b/contrib/pngsuite/iftbwn3p08.png
--- a/contrib/pngsuite/iftbyn3p08.png
+++ b/contrib/pngsuite/iftbyn3p08.png
--- a/contrib/pngsuite/iftp0n0g08.png
+++ b/contrib/pngsuite/iftp0n0g08.png
--- a/contrib/pngsuite/iftp0n2c08.png
+++ b/contrib/pngsuite/iftp0n2c08.png
--- a/contrib/pngsuite/iftp0n3p08.png
+++ b/contrib/pngsuite/iftp0n3p08.png
--- a/contrib/pngsuite/iftp1n3p08.png
+++ b/contrib/pngsuite/iftp1n3p08.png
--- a/contrib/pngsuite/interlaced/README
+++ b/contrib/pngsuite/interlaced/README
@@ -0,0 +1,2 @@
+
+These images fail the "pngimage-quick" and "pngimage-full" tests.
--- a/contrib/pngsuite/interlaced/ibasn0g01.png
+++ b/contrib/pngsuite/interlaced/ibasn0g01.png
--- a/contrib/pngsuite/interlaced/ibasn0g02.png
+++ b/contrib/pngsuite/interlaced/ibasn0g02.png
--- a/contrib/pngsuite/interlaced/ibasn0g04.png
+++ b/contrib/pngsuite/interlaced/ibasn0g04.png
--- a/contrib/pngsuite/interlaced/ibasn3p01.png
+++ b/contrib/pngsuite/interlaced/ibasn3p01.png
--- a/contrib/pngsuite/interlaced/ibasn3p02.png
+++ b/contrib/pngsuite/interlaced/ibasn3p02.png
--- a/contrib/pngsuite/interlaced/ibasn3p04.png
+++ b/contrib/pngsuite/interlaced/ibasn3p04.png
--- a/contrib/pngsuite/interlaced/iftbbn0g01.png
+++ b/contrib/pngsuite/interlaced/iftbbn0g01.png
--- a/contrib/pngsuite/interlaced/iftbbn0g02.png
+++ b/contrib/pngsuite/interlaced/iftbbn0g02.png
--- a/contrib/pngsuite/interlaced/iftbbn0g04.png
+++ b/contrib/pngsuite/interlaced/iftbbn0g04.png
--- a/contrib/powerpc-vsx/README
+++ b/contrib/powerpc-vsx/README
@@ -46,7 +46,7 @@ everything should be static.  It must define the function:

 static int png_have_vsx(png_structp png_ptr);

-That function must return 1 if ARM NEON instructions are supported, 0 if not.
+That function must return 1 if POWERPC_VSX instructions are supported, 0 if not.
 It must not execute png_error unless it detects a bug.  A png_error will prevent
 the reading of the PNG and in the future, writing too.

--- a/contrib/testpngs/crashers/bad_iCCP.png
+++ b/contrib/testpngs/crashers/bad_iCCP.png
--- a/contrib/testpngs/crashers/badadler.png
+++ b/contrib/testpngs/crashers/badadler.png
--- a/contrib/testpngs/crashers/badcrc.png
+++ b/contrib/testpngs/crashers/badcrc.png
--- a/contrib/testpngs/crashers/empty_ancillary_chunks.png
+++ b/contrib/testpngs/crashers/empty_ancillary_chunks.png
--- a/contrib/testpngs/crashers/huge_IDAT.png
+++ b/contrib/testpngs/crashers/huge_IDAT.png
--- a/contrib/testpngs/crashers/huge_bKGD_chunk.png
+++ b/contrib/testpngs/crashers/huge_bKGD_chunk.png
--- a/contrib/testpngs/crashers/huge_cHRM_chunk.png
+++ b/contrib/testpngs/crashers/huge_cHRM_chunk.png
--- a/contrib/testpngs/crashers/huge_eXIf_chunk.png
+++ b/contrib/testpngs/crashers/huge_eXIf_chunk.png
--- a/contrib/testpngs/crashers/huge_gAMA_chunk.png
+++ b/contrib/testpngs/crashers/huge_gAMA_chunk.png
--- a/contrib/testpngs/crashers/huge_hIST_chunk.png
+++ b/contrib/testpngs/crashers/huge_hIST_chunk.png
--- a/contrib/testpngs/crashers/huge_iCCP_chunk.png
+++ b/contrib/testpngs/crashers/huge_iCCP_chunk.png
--- a/contrib/testpngs/crashers/huge_iTXt_chunk.png
+++ b/contrib/testpngs/crashers/huge_iTXt_chunk.png
--- a/contrib/testpngs/crashers/huge_juNK_unsafe_to_copy.png
+++ b/contrib/testpngs/crashers/huge_juNK_unsafe_to_copy.png
--- a/contrib/testpngs/crashers/huge_juNk_safe_to_copy.png
+++ b/contrib/testpngs/crashers/huge_juNk_safe_to_copy.png
--- a/contrib/testpngs/crashers/huge_pCAL_chunk.png
+++ b/contrib/testpngs/crashers/huge_pCAL_chunk.png
--- a/contrib/testpngs/crashers/huge_pHYs_chunk.png
+++ b/contrib/testpngs/crashers/huge_pHYs_chunk.png
--- a/contrib/testpngs/crashers/huge_sCAL_chunk.png
+++ b/contrib/testpngs/crashers/huge_sCAL_chunk.png
--- a/contrib/testpngs/crashers/huge_sPLT_chunk.png
+++ b/contrib/testpngs/crashers/huge_sPLT_chunk.png
--- a/contrib/testpngs/crashers/huge_sRGB_chunk.png
+++ b/contrib/testpngs/crashers/huge_sRGB_chunk.png
--- a/contrib/testpngs/crashers/huge_sTER_chunk.png
+++ b/contrib/testpngs/crashers/huge_sTER_chunk.png
--- a/contrib/testpngs/crashers/huge_tEXt_chunk.png
+++ b/contrib/testpngs/crashers/huge_tEXt_chunk.png
--- a/contrib/testpngs/crashers/huge_tIME_chunk.png
+++ b/contrib/testpngs/crashers/huge_tIME_chunk.png
--- a/contrib/testpngs/crashers/huge_zTXt_chunk.png
+++ b/contrib/testpngs/crashers/huge_zTXt_chunk.png
--- a/contrib/testpngs/makepngs.sh
+++ b/contrib/testpngs/makepngs.sh
@@ -74,7 +74,7 @@ case "$1" in
   --coverage)
      # Comments below indicate cases known to be required and not duplicated
      # in other (required) cases; the aim is to get a minimal set that gives
-      # the maxium code coverage.
+      # the maximum code coverage.
      mpg none gray-alpha 8 # required: code coverage, sRGB opaque component
      mpg none palette 8 # required: basic palette read
      mpg 1.8 gray 2 # required: tests gamma threshold code
--- a/contrib/tools/chkfmt
+++ b/contrib/tools/chkfmt
@@ -54,7 +54,7 @@ doed(){
 }

 # In beta versions the version string which appears in files can be a little
-# long and cause spuriously overlong lines.  To avoid this subtitute the version
+# long and cause spuriously overlong lines.  To avoid this substitute the version
 # string with a 'standard' version a.b.cc before checking for long lines.
 if test -r png.h
 then
--- a/contrib/tools/pngcp.c
+++ b/contrib/tools/pngcp.c
@@ -191,7 +191,7 @@ vl_strategy[] =
   /* This controls the order of search. */
   { "huffman", Z_HUFFMAN_ONLY },
   { "RLE", Z_RLE },
-   { "fixed", Z_FIXED }, /* the remainder do window searchs */
+   { "fixed", Z_FIXED }, /* the remainder do window searches */
   { "filtered", Z_FILTERED },
   { "default", Z_DEFAULT_STRATEGY },
   { all, 0 }
@@ -336,7 +336,7 @@ static const option options[] =
 #  define VLC(name) VLCIDAT(name) VLCiCCP(name) VLCzTXt(name)

 #  ifdef PNG_SW_COMPRESS_png_level
-      /* The libpng compression level isn't searched beause it justs sets the
+      /* The libpng compression level isn't searched because it justs sets the
       * other things that are searched!
       */
      VLO("compression", compression, 0)
@@ -1725,7 +1725,7 @@ display_start_read(struct display *dp, const char *filename)
 }

 static void PNGCBAPI
-read_function(png_structp pp, png_bytep data, png_size_t size)
+read_function(png_structp pp, png_bytep data, size_t size)
 {
   struct display *dp = get_dp(pp);

@@ -1881,7 +1881,7 @@ display_start_write(struct display *dp, const char *filename)
 }

 static void PNGCBAPI
-write_function(png_structp pp, png_bytep data, png_size_t size)
+write_function(png_structp pp, png_bytep data, size_t size)
 {
   struct display *dp = get_dp(pp);

@@ -2117,7 +2117,7 @@ better_options(const struct display *dp)
    *
    * This function looks through the stack from the bottom up looking for an
    * option that does not match the current best value.  When it finds one it
-    * checks to see if it is more or less desireable and returns true or false
+    * checks to see if it is more or less desirable and returns true or false
    * as appropriate.
    *
    * Notice that this means that the order options are pushed onto the stack
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1,2 @@`

				`These images fail the "pngimage-quick" and "pngimage-full" tests.`