[libpng17] Imported from libpng-1.7.0beta59.tar

[libpng17] Suppressed some warnings from the Borland C++ 5.5.1/5.82 compiler
(Bug report by Viktor Szaka'ts).
2025-07-10 18:04:09 +02:00 · 2015-04-19 06:32:30 -05:00 · 2015-04-04 08:45:34 -05:00 · 2015-03-30 21:32:41 -05:00 · 2015-03-25 08:26:11 -05:00 · 2015-03-25 08:26:02 -05:00
58 changed files with 3781 additions and 2585 deletions
--- a/110
+++ b/110
@@ -1,5 +1,5 @@

-Libpng 1.7.0beta48 - February 7, 2015
+Libpng 1.7.0beta59 - April 19, 2015

 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -9,20 +9,20 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script

-   1.7.0beta48.tar.xz (LZMA-compressed, recommended)
-   1.7.0beta48.tar.gz
+   1.7.0beta59.tar.xz (LZMA-compressed, recommended)
+   1.7.0beta59.tar.gz

 Source files with CRLF line endings (for Windows), without the
 "configure" script

-   lp170b48.7z  (LZMA-compressed, recommended)
-   lp170b48.zip
+   lp170b59.7z  (LZMA-compressed, recommended)
+   lp170b59.zip

 Other information:

-   1.7.0beta48-README.txt
-   1.7.0beta48-LICENSE.txt
-   libpng-1.7.0beta48-*.asc (armored detached GPG signatures)
+   1.7.0beta59-README.txt
+   1.7.0beta59-LICENSE.txt
+   libpng-1.7.0beta59-*.asc (armored detached GPG signatures)

 Changes since the last public release (1.6.0):

@@ -701,6 +701,100 @@ Version 1.7.0beta48 [February 7, 2015]
  Work around one more Coverity-scan dead-code warning.
  Do not build png_product2() when it is unused.

+Version 1.7.0beta49 [February 11, 2015]
+  Combined sub_row, up_row, avg_row, and paeth_row buffers into a
+    single try_row buffer.
+  Added PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED macro, on by default.
+  Consolidated redundant code in pngwutil.c
+  Deal with integer overflow of sum in pngwutil.c
+
+Version 1.7.0beta50 [February 15, 2015]
+  Combined sub_row, up_row, avg_row, and paeth_row buffers into a
+    single try_row buffer and in cases where two or more of those are
+    being tested, a second tst_row buffer.  This improves CPU speed
+    over that achieved by libpng-1.7.0beta49.
+
+Version 1.7.0beta51 [February 17, 2015]
+  Combined similar parts of png_write_find_filter() into a png_increase_lmins()
+    function.
+  Display user limits in the output from pngtest.
+  Replaced test for harmless integer overflow (wraparound) in pngwutil.c
+    with a method that prevents overflow and does not increase cpu usage
+    significantly.
+
+Version 1.7.0beta52 [February 21, 2015]
+  Added information about setjmp/simplified API interaction in the
+    manual page and INSTALL file. Added information about using
+    row_pointers with a single height*width*bpp allocated block
+  Rebuilt configure scripts with automake-1.15 and libtool-2.4.6
+
+Version 1.7.0beta53 [February 23, 2015]
+  Restored compiling of png_reciprocal2 with PNG_NO_16BIT.
+
+Version 1.7.0beta54 [March 4, 2015]
+  Moved png_set_filter() prototype into a PNG_WRITE_SUPPORTED block
+    of png.h.
+  Conditionally compile a small amount of code in pngwutil.c
+  Avoid runtime checks when converting integer to png_byte with
+    Visual Studio (Sergey Kosarevsky)
+  Merged pngwrite.c with libpng-1.6.17beta06/pngwrite.c
+
+Version 1.7.0beta55 [March 9, 2015]
+  Removed some comments that the configure script did not handle
+    properly from scripts/pnglibconf.dfa and pnglibconf.h.prebuilt.
+  Spelling fixes ("then", "occured") reported by Lauri Nurmi.
+  Added more error reporting in png_default_read_data().
+  Merged png_free_data() with libpng-1.6.17rc02.
+
+Version 1.7.0beta56 [March 11, 2015]
+  Updated CMakeLists.txt to add OSX framework, change YES/NO to ON/OFF
+    for consistency, and remove some useless tests (Alexey Petruchik).
+
+Version 1.7.0beta57 [March 16, 2015]
+  Remove pnglibconf.h, pnglibconf.c, and pnglibconf.out instead of
+    pnglibconf.* in "make clean" (Cosmin).
+  Fix bug in calculation of maxbits, in png_write_sBIT, introduced
+    in libpng-1.6.17beta01 (John Bowler).
+  Revert change to png_default_read_data() made in libpng-1.7.0beta55.
+
+Version 1.7.0beta58 [March 25, 2015]
+  Implemented affirm() support and usage.
+  Remove pnglibconf.dfn and pnglibconf.pre with "make clean".
+  Added byte, short and other overflow checking
+  Added 'affirm' based overflow checking for debug builds for char
+    and short assignments. Simply ignore the error in release builds
+    (a truncated value will be used without warning). Controlled by
+    PNG_RANGE_CHECK_SUPPORTED.
+  Improved some overflow handling. PNG_RELEASE_BUILD replaces tests
+    where the code depended on the build base type and can be defined on
+    the command line, allowing testing in beta builds.  Overflows previously
+    handled by png_warning in png.c have been changed to use new
+    macros/affirm functions so that beta builds will abort on overflow and
+    release builds will quietly ignore it.  This avoids release builds
+    producing warnings that are of no use to end users.
+  Check (png_uint_16) casts for overflow. Also removed png_muldiv_warn,
+    added RELEASE/!RELEASE convenience macros. png_muldiv_warn was used in
+    only one place, and the overflow condition is a genuine warning not
+    an internal error.  Four macros allow code or function parameters to be
+    condition on RELEASE (or not) builds and tidy up the #ifdef handling of
+    functions.
+
+Version 1.7.0beta59 [April 19, 2015]
+  Transformed rewrite: changed row_info, added checks. This introduces an
+    internal struct (png_transform_control) to replace row_info and uses
+    that to implement affirms correctly.  The change also adds checks on
+    the rowbytes calculation and additional checks on most transform
+    implementations.
+  Added png_uint_16 range checking, pngvalid tRNS, fixed png_uint_16:
+    review of previous checks, removal of some where SAFE. pngvalid: add
+    testing of tRNS for better code coverage pngvalid: correct rgb-to-gray
+    error calculations. Code coverage is still incomplete: see /*UNTESTED*/
+    in pngrtran.c. This fixes some arithmetic errors that caused some tests
+    to fail on some 32-bit platforms (Bug reports by Peter Breitenlohner [i686]
+    and Petr Gajdos [i586]).
+  Suppressed some warnings from the Borland C++ 5.5.1/5.82 compiler
+    (Bug report by Viktor Szaka'ts).
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
--- a/95
+++ b/95
@@ -4990,6 +4990,101 @@ Version 1.7.0beta48 [February 7, 2015]
  Work around one more Coverity-scan dead-code warning.
  Do not build png_product2() when it is unused.

+Version 1.7.0beta49 [February 11, 2015]
+  Combined sub_row, up_row, avg_row, and paeth_row buffers into a
+    single try_row buffer.
+  Added PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED macro, on by default.
+  Consolidated redundant code in pngwutil.c
+  Deal with integer overflow of sum in pngwutil.c
+
+Version 1.7.0beta50 [February 15, 2015]
+  Combined sub_row, up_row, avg_row, and paeth_row buffers into a
+    single try_row buffer and in cases where two or more of those are
+    being tested, a second tst_row buffer.  This improves CPU speed
+    over that achieved by libpng-1.7.0beta49.
+
+Version 1.7.0beta51 [February 17, 2015]
+  Combined similar parts of png_write_find_filter() into a png_increase_lmins()
+    function.
+  Display user limits in the output from pngtest.
+  Replaced test for harmless integer overflow (wraparound) in pngwutil.c
+    with a method that prevents overflow and does not increase cpu usage
+    significantly.
+
+Version 1.7.0beta52 [February 21, 2015]
+  Added information about setjmp/simplified API interaction in the
+    manual page and INSTALL file. Added information about using
+    row_pointers with a single height*width*bpp allocated block
+    to the manual page.
+  Rebuilt configure scripts with automake-1.15 and libtool-2.4.6
+
+Version 1.7.0beta53 [February 23, 2015]
+  Restored compiling of png_reciprocal2 with PNG_NO_16BIT.
+
+Version 1.7.0beta54 [March 4, 2015]
+  Moved png_set_filter() prototype into a PNG_WRITE_SUPPORTED block
+    of png.h.
+  Conditionally compile a small amount of code in pngwutil.c
+  Avoid runtime checks when converting integer to png_byte with
+    Visual Studio (Sergey Kosarevsky)
+  Merged pngwrite.c with libpng-1.6.17beta06/pngwrite.c
+
+Version 1.7.0beta55 [March 9, 2015]
+  Removed some comments that the configure script did not handle
+    properly from scripts/pnglibconf.dfa and pnglibconf.h.prebuilt.
+  Spelling fixes ("then", "occured") reported by Lauri Nurmi.
+  Added more error reporting in png_default_read_data().
+  Merged png_free_data() with libpng-1.6.17rc02.
+
+Version 1.7.0beta56 [March 11, 2015]
+  Updated CMakeLists.txt to add OSX framework, change YES/NO to ON/OFF
+    for consistency, and remove some useless tests (Alexey Petruchik).
+
+Version 1.7.0beta57 [March 16, 2015]
+  Remove pnglibconf.h, pnglibconf.c, and pnglibconf.out instead of
+    pnglibconf.* in "make clean" (Cosmin).
+  Fix bug in calculation of maxbits, in png_write_sBIT, introduced
+    in libpng-1.6.17beta01 (John Bowler).
+  Revert change to png_default_read_data() made in libpng-1.7.0beta55.
+
+Version 1.7.0beta58 [March 25, 2015]
+  Implemented affirm() support and usage.
+  Remove pnglibconf.dfn and pnglibconf.pre with "make clean".
+  Added byte, short and other overflow checking
+  Added 'affirm' based overflow checking for debug builds for char
+    and short assignments. Simply ignore the error in release builds
+    (a truncated value will be used without warning). Controlled by
+    PNG_RANGE_CHECK_SUPPORTED.
+  Improved some overflow handling. PNG_RELEASE_BUILD replaces tests
+    where the code depended on the build base type and can be defined on
+    the command line, allowing testing in beta builds.  Overflows previously
+    handled by png_warning in png.c have been changed to use new
+    macros/affirm functions so that beta builds will abort on overflow and
+    release builds will quietly ignore it.  This avoids release builds
+    producing warnings that are of no use to end users.
+  Check (png_uint_16) casts for overflow. Also removed png_muldiv_warn,
+    added RELEASE/!RELEASE convenience macros. png_muldiv_warn was used in
+    only one place, and the overflow condition is a genuine warning not
+    an internal error.  Four macros allow code or function parameters to be
+    condition on RELEASE (or not) builds and tidy up the #ifdef handling of
+    functions.
+
+Version 1.7.0beta59 [April 19, 2015]
+  Transformed rewrite: changed row_info, added checks. This introduces an
+    internal struct (png_transform_control) to replace row_info and uses
+    that to implement affirms correctly.  The change also adds checks on
+    the rowbytes calculation and additional checks on most transform
+    implementations.
+  Added png_uint_16 range checking, pngvalid tRNS, fixed png_uint_16:
+    review of previous checks, removal of some where SAFE. pngvalid: add
+    testing of tRNS for better code coverage pngvalid: correct rgb-to-gray
+    error calculations. Code coverage is still incomplete: see /*UNTESTED*/
+    in pngrtran.c. This fixes some arithmetic errors that caused some tests
+    to fail on some 32-bit platforms (Bug reports by Peter Breitenlohner [i686]
+    and Petr Gajdos [i586]).
+  Suppressed some warnings from the Borland C++ 5.5.1/5.82 compiler
+    (Bug report by Viktor Szaka'ts).
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,6 +1,6 @@
 # CMakeLists.txt

-# Copyright (C) 2007-2014 Glenn Randers-Pehrson
+# Copyright (C) 2007-2015 Glenn Randers-Pehrson

 # This code is released under the libpng license.
 # For conditions of distribution and use, see the disclaimer
@@ -30,8 +30,7 @@ if(NOT WIN32)
    PATHS /usr/lib /usr/local/lib
  )
  if(NOT M_LIBRARY)
-    message(STATUS
-      "math library 'libm' not found - floating point support disabled")
+    message(STATUS "math lib 'libm' not found; floating point support disabled")
  endif()
 else()
  # not needed on windows
@@ -39,22 +38,14 @@ else()
 endif()

 # COMMAND LINE OPTIONS
-if(DEFINED PNG_SHARED)
-  option(PNG_SHARED "Build shared lib" ${PNG_SHARED})
-else()
-  option(PNG_SHARED "Build shared lib" ON)
-endif()
-if(DEFINED PNG_STATIC)
-  option(PNG_STATIC "Build static lib" ${PNG_STATIC})
-else()
-  option(PNG_STATIC "Build static lib" ON)
-endif()
-
-option(PNG_TESTS  "Build libpng tests" YES)
+option(PNG_SHARED "Build shared lib" ON)
+option(PNG_STATIC "Build static lib" ON)
+option(PNG_TESTS  "Build libpng tests" ON)

 # Many more configuration options could be added here
-option(PNG_DEBUG         "Build with debug output" NO)
-option(PNGARG            "Disable ANSI-C prototypes" NO)
+option(PNG_FRAMEWORK "Build OS X framework" OFF)
+option(PNG_DEBUG     "Build with debug output" OFF)
+option(PNGARG        "Disable ANSI-C prototypes" OFF)

 # SET LIBNAME
 set(PNG_LIB_NAME png${PNGLIB_MAJOR}${PNGLIB_MINOR})
@@ -134,7 +125,7 @@ if(PNG_SHARED)
 endif()

 if(PNG_STATIC)
-# does not work without changing name
+  # does not work without changing name
  set(PNG_LIB_NAME_STATIC ${PNG_LIB_NAME}_static)
  add_library(${PNG_LIB_NAME_STATIC} STATIC ${libpng_sources})
  list(APPEND PNG_LIB_TARGETS ${PNG_LIB_NAME_STATIC})
@@ -145,10 +136,27 @@ if(PNG_STATIC)
  target_link_libraries(${PNG_LIB_NAME_STATIC} ${ZLIB_LIBRARY} ${M_LIBRARY})
 endif()

+if(PNG_FRAMEWORK)
+  set(PNG_LIB_NAME_FRAMEWORK ${PNG_LIB_NAME}_framework)
+  add_library(${PNG_LIB_NAME_FRAMEWORK} SHARED ${libpng_sources})
+  list(APPEND PNG_LIB_TARGETS ${PNG_LIB_NAME_FRAMEWORK})
+  set_target_properties(${PNG_LIB_NAME_FRAMEWORK} PROPERTIES
+    FRAMEWORK TRUE
+    FRAMEWORK_VERSION ${PNGLIB_VERSION}
+    MACOSX_FRAMEWORK_SHORT_VERSION_STRING ${PNGLIB_MAJOR}.${PNGLIB_MINOR}
+    MACOSX_FRAMEWORK_BUNDLE_VERSION ${PNGLIB_VERSION}
+    MACOSX_FRAMEWORK_IDENTIFIER org.libpng.libpng
+    XCODE_ATTRIBUTE_INSTALL_PATH "@rpath"
+    PUBLIC_HEADER "${libpng_public_hdrs}"
+    OUTPUT_NAME png)
+  target_link_libraries(${PNG_LIB_NAME_FRAMEWORK} ${ZLIB_LIBRARY} ${M_LIBRARY})
+endif()
+
 if(NOT PNG_LIB_TARGETS)
  message(SEND_ERROR
    "No library variant selected to build. "
-    "Please enable at least one of the following options: PNG_STATIC, PNG_SHARED")
+    "Please enable at least one of the following options: "
+    " PNG_STATIC, PNG_SHARED, PNG_FRAMEWORK")
 endif()

 if(PNG_SHARED AND WIN32)
@@ -253,7 +261,7 @@ endif(NOT WIN32 OR CYGWIN OR MINGW)
 # SET UP LINKS
 if(PNG_SHARED)
  set_target_properties(${PNG_LIB_NAME} PROPERTIES
-#   VERSION 17.${PNGLIB_RELEASE}.1.7.0beta48
+#   VERSION 17.${PNGLIB_RELEASE}.1.7.0beta59
    VERSION 17.${PNGLIB_RELEASE}.0
    SOVERSION 17
    CLEAN_DIRECT_OUTPUT 1)
@@ -284,7 +292,8 @@ if(NOT SKIP_INSTALL_LIBRARIES AND NOT SKIP_INSTALL_ALL )
      ${PNG_EXPORT_RULE}
      RUNTIME DESTINATION bin
      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
-      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR})
+      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+      FRAMEWORK DESTINATION ${CMAKE_INSTALL_LIBDIR})

  if(PNG_SHARED)
    # Create a symlink for libpng.dll.a => libpng17.dll.a on Cygwin
--- a/11
+++ b/11
@@ -17,7 +17,7 @@ VIII. Configuring libpng for 16-bit platforms
 XII. Configuring for compiler xxx:
 XIII. Removing unwanted object code
 XIV. Changes to the build and configuration of libpng in libpng-1.5.x
-  XV. Configuring libpng for multiprocessing
+  XV. Setjmp/longjmp issues
 XVI. Other sources of information about libpng

 I. Simple installation
@@ -189,7 +189,7 @@ run "make install".
 VIII. Configuring libpng for 16-bit platforms

 You will want to look into zconf.h to tell zlib (and thus libpng) that
-it cannot allocate more then 64K at a time.  Even if you can, the memory
+it cannot allocate more than 64K at a time.  Even if you can, the memory
 won't be accessible.  So limit zlib and libpng to 64K by defining MAXSEG_64K.

 IX. Configuring for DOS
@@ -362,7 +362,7 @@ $PREFIX/include directory).  Do not edit pnglibconf.h after you have built
 libpng, because than the settings would not accurately reflect the settings
 that were used to build libpng.

-XV. Configuring libpng for multiprocessing
+XV. Setjmp/longjmp issues

 Libpng uses setjmp()/longjmp() for error handling.  Unfortunately setjmp()
 is known to be not thread-safe on some platforms and we don't know of
@@ -375,6 +375,11 @@ configure libpng with PNG_NO_SETJMP in your pngusr.dfa file, with

 in your pnglibconf.h or pngusr.h.

+Starting with libpng-1.6.0, the library included a "simplified API".
+This requires setjmp/longjmp, so you must either build the library
+with PNG_SETJMP_SUPPORTED defined, or with PNG_SIMPLIFIED_READ_SUPPORTED
+and PNG_SIMPLIFIED_WRITE_SUPPORTED undefined.
+
 XVI. Other sources of information about libpng:

 Further information can be found in the README and libpng-manual.txt
--- a/6
+++ b/6
@@ -10,8 +10,8 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.2.6, August 15, 2004, through 1.7.0beta48, February 7, 2015, are
-Copyright (c) 2004, 2006-2014 Glenn Randers-Pehrson, and are
+libpng versions 1.2.6, August 15, 2004, through 1.7.0beta59, April 19, 2015, are
+Copyright (c) 2004, 2006-2015 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors

@@ -108,4 +108,4 @@ certification mark of the Open Source Initiative.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-February 7, 2015
+April 19, 2015
--- a/Makefile.am
+++ b/Makefile.am
@@ -133,7 +133,8 @@ SCRIPT_CLEANFILES=scripts/*.out scripts/*.chk scripts/pnglibconf.c

 CLEANFILES= *.tf? pngout.png libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc \
 	libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@-config libpng.vers libpng.sym \
-	check.new pnglibconf.* pngprefix.h symbols.new pngtest-log.txt \
+	check.new pnglibconf.h pngprefix.h symbols.new pngtest-log.txt \
+	pnglibconf.out pnglibconf.c pnglibconf.dfn pnglibconf.pre \
 	$(SCRIPT_CLEANFILES)

 MAINTAINERCLEANFILES = Makefile.in aclocal.m4 config.guess config.h.in \
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-README for libpng version 1.7.0beta48 - February 7, 2015 (shared library 17.0)
+README for libpng version 1.7.0beta59 - April 19, 2015 (shared library 17.0)
 See the note about version numbers near the top of png.h

 See INSTALL for instructions on how to install libpng.
--- a/arm/arm_init.c
+++ b/arm/arm_init.c
@@ -15,6 +15,7 @@
 #define _POSIX_SOURCE 1

 #include "../pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_arm_arm_init

 #ifdef PNG_READ_SUPPORTED

--- a/arm/filter_neon_intrinsics.c
+++ b/arm/filter_neon_intrinsics.c
@@ -13,6 +13,7 @@
 */

 #include "../pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_arm_filter_neon_intrinsics

 #ifdef PNG_READ_SUPPORTED

--- a/autogen.sh
+++ b/autogen.sh
@@ -73,8 +73,9 @@ done
 # present bad things are happening.
 #
 # The autotools generated files:
-libpng_autotools_files="Makefile.in aclocal.m4 config.guess config.h.in\
-   config.sub configure depcomp install-sh ltmain.sh missing test-driver"
+libpng_autotools_files="Makefile.in aclocal.m4 config.guess config.h.in
+   config.h.in~ config.sub configure depcomp install-sh ltmain.sh missing\
+   test-driver"
 #
 # Files generated by versions of configue >2.68 or automake >1.13 (i.e. later
 # versions than those required by configure.ac):
--- a/configure.ac
+++ b/configure.ac
@@ -18,7 +18,7 @@ AC_PREREQ([2.68])

 dnl Version number stuff here:

-AC_INIT([libpng],[1.7.0beta48],[png-mng-implement@lists.sourceforge.net])
+AC_INIT([libpng],[1.7.0beta59],[png-mng-implement@lists.sourceforge.net])
 AC_CONFIG_MACRO_DIR([scripts])

 # libpng does not follow GNU file name conventions (hence 'foreign')
@@ -39,7 +39,7 @@ dnl automake, so the following is not necessary (and is not defined anyway):
 dnl AM_PREREQ([1.11.2])
 dnl stop configure from automagically running automake

-PNGLIB_VERSION=1.7.0beta48
+PNGLIB_VERSION=1.7.0beta59
 PNGLIB_MAJOR=1
 PNGLIB_MINOR=7
 PNGLIB_RELEASE=0
--- a/contrib/libtests/pngvalid.c
+++ b/contrib/libtests/pngvalid.c
@@ -258,7 +258,7 @@ make_four_random_bytes(png_uint_32* seed, png_bytep bytes)
   make_random_bytes(seed, bytes, 4);
 }

-#ifdef PNG_READ_SUPPORTED
+#if defined PNG_READ_SUPPORTED || defined PNG_WRITE_tRNS_SUPPORTED
 static void
 randomize(void *pv, size_t size)
 {
@@ -267,7 +267,9 @@ randomize(void *pv, size_t size)
 }

 #define RANDOMIZE(this) randomize(&(this), sizeof (this))
+#endif /* READ || WRITE_tRNS */

+#ifdef PNG_READ_SUPPORTED
 static unsigned int
 random_mod(unsigned int max)
 {
@@ -295,7 +297,8 @@ random_choice(void)
 /* A numeric ID based on PNG file characteristics.  The 'do_interlace' field
 * simply records whether pngvalid did the interlace itself or whether it
 * was done by libpng.  Width and height must be less than 256.  'palette' is an
- * index of the palette to use for formats with a palette (0 otherwise.)
+ * index of the palette to use for formats with a palette otherwise a boolean
+ * indicating if a tRNS chunk was generated.
 */
 #define FILEID(col, depth, palette, interlace, width, height, do_interlace) \
   ((png_uint_32)((col) + ((depth)<<3) + ((palette)<<8) + ((interlace)<<13) + \
@@ -316,12 +319,16 @@ standard_name(char *buffer, size_t bufsize, size_t pos, png_byte colour_type,
    png_uint_32 w, png_uint_32 h, int do_interlace)
 {
   pos = safecat(buffer, bufsize, pos, colour_types[colour_type]);
-   if (npalette > 0)
+   if (colour_type == 3) /* must have a palette */
   {
      pos = safecat(buffer, bufsize, pos, "[");
      pos = safecatn(buffer, bufsize, pos, npalette);
      pos = safecat(buffer, bufsize, pos, "]");
   }
+
+   else if (npalette != 0)
+      pos = safecat(buffer, bufsize, pos, "+tRNS");
+
   pos = safecat(buffer, bufsize, pos, " ");
   pos = safecatn(buffer, bufsize, pos, bit_depth);
   pos = safecat(buffer, bufsize, pos, " bit");
@@ -378,25 +385,32 @@ standard_name_from_id(char *buffer, size_t bufsize, size_t pos, png_uint_32 id)

 static int
 next_format(png_bytep colour_type, png_bytep bit_depth,
-   unsigned int* palette_number, int no_low_depth_gray)
+   unsigned int* palette_number, int low_depth_gray, int tRNS)
 {
   if (*bit_depth == 0)
   {
      *colour_type = 0;
-      if (no_low_depth_gray)
-         *bit_depth = 8;
-      else
+      if (low_depth_gray)
         *bit_depth = 1;
+      else
+         *bit_depth = 8;
      *palette_number = 0;
      return 1;
   }

-   if (*colour_type == 3)
+   if  (*colour_type < 4/*no alpha channel*/)
   {
-      /* Add multiple palettes for colour type 3. */
-      if (++*palette_number < PALETTE_COUNT(*bit_depth))
+      /* Add multiple palettes for colour type 3, one image with tRNS
+       * and one without for other non-alpha formats:
+       */
+      unsigned int pn = ++*palette_number;
+      png_byte ct = *colour_type;
+
+      if (((ct == 0/*GRAY*/ || ct/*RGB*/ == 2) && tRNS && pn < 2) ||
+          (ct == 3/*PALETTE*/ && pn < PALETTE_COUNT(*bit_depth)))
         return 1;

+      /* No: next bit depth */
      *palette_number = 0;
   }

@@ -1959,6 +1973,7 @@ typedef struct png_modifier

   /* Run tests on reading with a combination of transforms, */
   unsigned int             test_transform :1;
+   unsigned int             test_tRNS :1; /* Includes tRNS images */

   /* When to use the use_input_precision option, this controls the gamma
    * validation code checks.  If set any value that is within the transformed
@@ -1990,6 +2005,16 @@ typedef struct png_modifier
   unsigned int             test_gamma_expand16 :1;
   unsigned int             test_exhaustive :1;

+   /* Whether or not to run the low-bit-depth grayscale tests.  This fail on
+    * gamma images in some cases because of gross inaccuracies in the grayscale
+    * gamma handling for low bit depth.
+    */
+   unsigned int             test_lbg :1;
+   unsigned int             test_lbg_gamma_threshold :1;
+   unsigned int             test_lbg_gamma_transform :1;
+   unsigned int             test_lbg_gamma_sbit :1;
+   unsigned int             test_lbg_gamma_composition :1;
+
   unsigned int             log :1;   /* Log max error */

   /* Buffer information, the buffer size limits the size of the chunks that can
@@ -2042,6 +2067,11 @@ modifier_init(png_modifier *pm)
   pm->test_standard = 0;
   pm->test_size = 0;
   pm->test_transform = 0;
+#  ifdef PNG_WRITE_tRNS_SUPPORTED
+      pm->test_tRNS = 1;
+#  else
+      pm->test_tRNS = 0;
+#  endif
   pm->use_input_precision = 0;
   pm->use_input_precision_sbit = 0;
   pm->use_input_precision_16to8 = 0;
@@ -2054,6 +2084,11 @@ modifier_init(png_modifier *pm)
   pm->test_gamma_background = 0;
   pm->test_gamma_alpha_mode = 0;
   pm->test_gamma_expand16 = 0;
+   pm->test_lbg = 1;
+   pm->test_lbg_gamma_threshold = 1;
+   pm->test_lbg_gamma_transform = 1;
+   pm->test_lbg_gamma_sbit = 1;
+   pm->test_lbg_gamma_composition = 1;
   pm->test_exhaustive = 0;
   pm->log = 0;

@@ -3192,6 +3227,45 @@ init_standard_palette(png_store *ps, png_structp pp, png_infop pi, int npalette,
   }
 }

+#ifdef PNG_WRITE_tRNS_SUPPORTED
+static void
+set_random_tRNS(png_structp pp, png_infop pi, PNG_CONST png_byte colour_type,
+   PNG_CONST int bit_depth)
+{
+   /* To make this useful the tRNS color needs to match at least one pixel.
+    * Random values are fine for gray, including the 16-bit case where we know
+    * that the test image contains all the gray values.  For RGB we need more
+    * method as only 65536 different RGB values are generated.
+    */
+   png_color_16 tRNS;
+   const png_uint_16 mask = (png_uint_16)((1U << bit_depth)-1);
+
+   RANDOMIZE(tRNS);
+
+   if (colour_type & 2/*RGB*/)
+   {
+      if (bit_depth == 8)
+      {
+         tRNS.blue = tRNS.red ^ tRNS.green;
+         tRNS.red &= mask;
+         tRNS.green &= mask;
+         tRNS.blue &= mask;
+      }
+
+      else /* bit_depth == 16 */
+      {
+         tRNS.green = (png_uint_16)(tRNS.red * 257);
+         tRNS.blue = (png_uint_16)(tRNS.green * 17);
+      }
+   }
+
+   else
+      tRNS.gray &= mask;
+
+   png_set_tRNS(pp, pi, NULL, 0, &tRNS);
+}
+#endif
+
 /* The number of passes is related to the interlace type. There was no libpng
 * API to determine this prior to 1.5, so we need an inquiry function:
 */
@@ -3525,6 +3599,11 @@ make_transform_image(png_store* PNG_CONST ps, png_byte PNG_CONST colour_type,
      if (colour_type == 3) /* palette */
         init_standard_palette(ps, pp, pi, 1U << bit_depth, 1/*do tRNS*/);

+#     ifdef PNG_WRITE_tRNS_SUPPORTED
+         else if (palette_number)
+            set_random_tRNS(pp, pi, colour_type, bit_depth);
+#     endif
+
      png_write_info(pp, pi);

      if (png_get_rowbytes(pp, pi) !=
@@ -3598,19 +3677,20 @@ make_transform_image(png_store* PNG_CONST ps, png_byte PNG_CONST colour_type,
 }

 static void
-make_transform_images(png_store *ps)
+make_transform_images(png_modifier *pm)
 {
   png_byte colour_type = 0;
   png_byte bit_depth = 0;
   unsigned int palette_number = 0;

   /* This is in case of errors. */
-   safecat(ps->test, sizeof ps->test, 0, "make standard images");
+   safecat(pm->this.test, sizeof pm->this.test, 0, "make standard images");

   /* Use next_format to enumerate all the combinations we test, including
-    * generating multiple low bit depth palette images.
+    * generating multiple low bit depth palette images. Non-A images (palette
+    * and direct) are created with and without tRNS chunks.
    */
-   while (next_format(&colour_type, &bit_depth, &palette_number, 0))
+   while (next_format(&colour_type, &bit_depth, &palette_number, 1, 1))
   {
      int interlace_type;

@@ -3621,7 +3701,7 @@ make_transform_images(png_store *ps)

         standard_name(name, sizeof name, 0, colour_type, bit_depth,
            palette_number, interlace_type, 0, 0, 0);
-         make_transform_image(ps, colour_type, bit_depth, palette_number,
+         make_transform_image(&pm->this, colour_type, bit_depth, palette_number,
            interlace_type, name);
      }
   }
@@ -4287,6 +4367,7 @@ typedef struct standard_display
   size_t      cbRow;          /* Bytes in a row of the output image */
   int         do_interlace;   /* Do interlacing internally */
   int         is_transparent; /* Transparency information was present. */
+   int         has_tRNS;       /* color type GRAY or RGB with a tRNS chunk. */
   int         speed;          /* Doing a speed test */
   int         use_update_info;/* Call update_info, not start_image */
   struct
@@ -4619,14 +4700,14 @@ standard_info_part1(standard_display *dp, png_structp pp, png_infop pi)
         case 0:
            dp->transparent.red = dp->transparent.green = dp->transparent.blue =
               trans_color->gray;
-            dp->is_transparent = 1;
+            dp->has_tRNS = 1;
            break;

         case 2:
            dp->transparent.red = trans_color->red;
            dp->transparent.green = trans_color->green;
            dp->transparent.blue = trans_color->blue;
-            dp->is_transparent = 1;
+            dp->has_tRNS = 1;
            break;

         case 3:
@@ -5518,7 +5599,7 @@ image_pixel_add_alpha(image_pixel *this, PNG_CONST standard_display *display)
      if (this->colour_type == PNG_COLOR_TYPE_GRAY)
      {
         if (this->bit_depth < 8)
-            this->bit_depth = 8;
+            this->bit_depth = this->sample_depth = 8;

         if (this->have_tRNS)
         {
@@ -5553,9 +5634,11 @@ image_pixel_add_alpha(image_pixel *this, PNG_CONST standard_display *display)
               this->alphaf = 0;
            else
               this->alphaf = 1;
-
-            this->colour_type = PNG_COLOR_TYPE_RGB_ALPHA;
         }
+         else
+            this->alphaf = 1;
+
+         this->colour_type = PNG_COLOR_TYPE_RGB_ALPHA;
      }

      /* The error in the alpha is zero and the sBIT value comes from the
@@ -5848,8 +5931,9 @@ transform_info_imp(transform_display *dp, png_structp pp, png_infop pi)
   /* If png_set_filler is in action then fake the output color type to include
    * an alpha channel where appropriate.
    */
-   if (dp->output_bit_depth >= 8 && (dp->output_colour_type == PNG_COLOR_TYPE_RGB ||
-       dp->output_colour_type == PNG_COLOR_TYPE_GRAY) && dp->this.filler)
+   if (dp->output_bit_depth >= 8 &&
+       (dp->output_colour_type == PNG_COLOR_TYPE_RGB ||
+        dp->output_colour_type == PNG_COLOR_TYPE_GRAY) && dp->this.filler)
       dp->output_colour_type |= 4;

   /* Validate the combination of colour type and bit depth that we are getting
@@ -6372,6 +6456,13 @@ image_transform_png_set_tRNS_to_alpha_set(PNG_CONST image_transform *this,
   transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_tRNS_to_alpha(pp);
+
+   /* If there was a tRNS chunk that would get expanded and add an alpha
+    * channel is_transparent must be updated:
+    */
+   if (that->this.has_tRNS)
+      that->this.is_transparent = 1;
+
   this->next->set(this->next, that, pp, pi);
 }

@@ -6430,6 +6521,7 @@ image_transform_png_set_gray_to_rgb_set(PNG_CONST image_transform *this,
    transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_gray_to_rgb(pp);
+   /* NOTE: this doesn't result in tRNS expansion. */
   this->next->set(this->next, that, pp, pi);
 }

@@ -6489,6 +6581,10 @@ image_transform_png_set_expand_set(PNG_CONST image_transform *this,
    transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_expand(pp);
+
+   if (that->this.has_tRNS)
+      that->this.is_transparent = 1;
+
   this->next->set(this->next, that, pp, pi);
 }

@@ -6539,6 +6635,7 @@ image_transform_png_set_expand_gray_1_2_4_to_8_set(
    png_infop pi)
 {
   png_set_expand_gray_1_2_4_to_8(pp);
+   /* NOTE: don't expect this to expand tRNS */
   this->next->set(this->next, that, pp, pi);
 }

@@ -6570,6 +6667,11 @@ image_transform_png_set_expand_16_set(PNG_CONST image_transform *this,
    transform_display *that, png_structp pp, png_infop pi)
 {
   png_set_expand_16(pp);
+
+   /* NOTE: at present libpng does SET_EXPAND as well, so tRNS is expanded. */
+   if (that->this.has_tRNS)
+      that->this.is_transparent = 1;
+
   this->next->set(this->next, that, pp, pi);
 }

@@ -6940,14 +7042,14 @@ image_transform_png_set_rgb_to_gray_ini(PNG_CONST image_transform *this,
          * When DIGITIZE is set because a pre-1.7 version of libpng is being
          * tested allow a bigger slack.
          *
-          * NOTE: this magic number was determined by experiment to be 1.25.
-          * There's no great merit to the value below, however it only affects
-          * the limit used for checking for internal calculation errors, not
-          * the actual limit imposed by pngvalid on the output errors.
+          * NOTE: this magic number was determined by experiment to be about
+          * 1.263.  There's no great merit to the value below, however it only
+          * affects the limit used for checking for internal calculation errors,
+          * not the actual limit imposed by pngvalid on the output errors.
          */
         that->pm->limit += pow(
 #        if DIGITIZE
-            1.25
+            1.3
 #        else
            1.0
 #        endif
@@ -7111,7 +7213,8 @@ image_transform_png_set_rgb_to_gray_mod(PNG_CONST image_transform *this,
         const unsigned int sample_depth = that->sample_depth;
         const unsigned int calc_depth = (pm->assume_16_bit_calculations ? 16 :
            sample_depth);
-         const unsigned int gamma_depth = (sample_depth == 16 ? 16 :
+         const unsigned int gamma_depth = (sample_depth == 16 ?
+            PNG_MAX_GAMMA_8 :
            (pm->assume_16_bit_calculations ? PNG_MAX_GAMMA_8 : sample_depth));
         int isgray;
         double r, g, b;
@@ -7125,56 +7228,73 @@ image_transform_png_set_rgb_to_gray_mod(PNG_CONST image_transform *this,
          * will be identical after this operation if there is only one
          * transform, feel free to delete the png_error checks on this below in
          * the future (this is just me trying to ensure it works!)
+          *
+          * Interval arithmetic is exact, but to implement it it must be
+          * possible to control the floating point implementation rounding mode.
+          * This cannot be done in ANSI-C, so instead I reduce the 'lo' values
+          * by DBL_EPSILON and increase the 'hi' values by the same.
          */
+#        define DD(v,d,r) (digitize(v*(1-DBL_EPSILON), d, r) * (1-DBL_EPSILON))
+#        define DU(v,d,r) (digitize(v*(1+DBL_EPSILON), d, r) * (1+DBL_EPSILON))
+
         r = rlo = rhi = that->redf;
         rlo -= that->rede;
-         rlo = digitize(rlo, calc_depth, 1/*round*/);
+         rlo = DD(rlo, calc_depth, 1/*round*/);
         rhi += that->rede;
-         rhi = digitize(rhi, calc_depth, 1/*round*/);
+         rhi = DU(rhi, calc_depth, 1/*round*/);

         g = glo = ghi = that->greenf;
         glo -= that->greene;
-         glo = digitize(glo, calc_depth, 1/*round*/);
+         glo = DD(glo, calc_depth, 1/*round*/);
         ghi += that->greene;
-         ghi = digitize(ghi, calc_depth, 1/*round*/);
+         ghi = DU(ghi, calc_depth, 1/*round*/);

         b = blo = bhi = that->bluef;
         blo -= that->bluee;
-         blo = digitize(blo, calc_depth, 1/*round*/);
+         blo = DD(blo, calc_depth, 1/*round*/);
         bhi += that->greene;
-         bhi = digitize(bhi, calc_depth, 1/*round*/);
+         bhi = DU(bhi, calc_depth, 1/*round*/);

         isgray = r==g && g==b;

         if (data.gamma != 1)
         {
            PNG_CONST double power = 1/data.gamma;
-            PNG_CONST double abse = calc_depth == 16 ? .5/65535 : .5/255;
+            PNG_CONST double abse = .5/(sample_depth == 16 ? 65535 : 255);

-            /* 'abse' is the absolute error permitted in linear calculations. It
-             * is used here to capture the error permitted in the handling
-             * (undoing) of the gamma encoding.  Once again digitization occurs
-             * to handle the upper and lower bounds of the values.  This is
-             * where the real errors are introduced.
+            /* If a gamma calculation is done it is done using lookup tables of
+             * precision gamma_depth, so the already digitized value above may
+             * need to be further digitized here.
             */
+            if (gamma_depth != calc_depth)
+            {
+               rlo = DD(rlo, gamma_depth, 0/*truncate*/);
+               rhi = DU(rhi, gamma_depth, 0/*truncate*/);
+               glo = DD(glo, gamma_depth, 0/*truncate*/);
+               ghi = DU(ghi, gamma_depth, 0/*truncate*/);
+               blo = DD(blo, gamma_depth, 0/*truncate*/);
+               bhi = DU(bhi, gamma_depth, 0/*truncate*/);
+            }
+
+            /* 'abse' is the error in the gamma table calculation itself. */
            r = pow(r, power);
-            rlo = digitize(pow(rlo, power)-abse, calc_depth, 1);
-            rhi = digitize(pow(rhi, power)+abse, calc_depth, 1);
+            rlo = DD(pow(rlo, power)-abse, calc_depth, 1);
+            rhi = DU(pow(rhi, power)+abse, calc_depth, 1);

            g = pow(g, power);
-            glo = digitize(pow(glo, power)-abse, calc_depth, 1);
-            ghi = digitize(pow(ghi, power)+abse, calc_depth, 1);
+            glo = DD(pow(glo, power)-abse, calc_depth, 1);
+            ghi = DU(pow(ghi, power)+abse, calc_depth, 1);

            b = pow(b, power);
-            blo = digitize(pow(blo, power)-abse, calc_depth, 1);
-            bhi = digitize(pow(bhi, power)+abse, calc_depth, 1);
+            blo = DD(pow(blo, power)-abse, calc_depth, 1);
+            bhi = DU(pow(bhi, power)+abse, calc_depth, 1);
         }

         /* Now calculate the actual gray values.  Although the error in the
          * coefficients depends on whether they were specified on the command
          * line (in which case truncation to 15 bits happened) or not (rounding
          * was used) the maxium error in an individual coefficient is always
-          * 1/32768, because even in the rounding case the requirement that
+          * 2/32768, because even in the rounding case the requirement that
          * coefficients add up to 32768 can cause a larger rounding error.
          *
          * The only time when rounding doesn't occur in 1.5.5 and later is when
@@ -7185,19 +7305,19 @@ image_transform_png_set_rgb_to_gray_mod(PNG_CONST image_transform *this,

         {
            PNG_CONST int do_round = data.gamma != 1 || calc_depth == 16;
-            PNG_CONST double ce = 1. / 32768;
+            PNG_CONST double ce = 2. / 32768;

-            graylo = digitize(rlo * (data.red_coefficient-ce) +
+            graylo = DD(rlo * (data.red_coefficient-ce) +
               glo * (data.green_coefficient-ce) +
-               blo * (data.blue_coefficient-ce), gamma_depth, do_round);
-            if (graylo <= 0)
-               graylo = 0;
+               blo * (data.blue_coefficient-ce), calc_depth, do_round);
+            if (graylo > gray) /* always accept the right answer */
+               graylo = gray;

-            grayhi = digitize(rhi * (data.red_coefficient+ce) +
+            grayhi = DU(rhi * (data.red_coefficient+ce) +
               ghi * (data.green_coefficient+ce) +
-               bhi * (data.blue_coefficient+ce), gamma_depth, do_round);
-            if (grayhi >= 1)
-               grayhi = 1;
+               bhi * (data.blue_coefficient+ce), calc_depth, do_round);
+            if (grayhi < gray)
+               grayhi = gray;
         }

         /* And invert the gamma. */
@@ -7205,11 +7325,25 @@ image_transform_png_set_rgb_to_gray_mod(PNG_CONST image_transform *this,
         {
            PNG_CONST double power = data.gamma;

+            /* And this happens yet again, shifting the values once more. */
+            if (gamma_depth != sample_depth)
+            {
+               rlo = DD(rlo, gamma_depth, 0/*truncate*/);
+               rhi = DU(rhi, gamma_depth, 0/*truncate*/);
+               glo = DD(glo, gamma_depth, 0/*truncate*/);
+               ghi = DU(ghi, gamma_depth, 0/*truncate*/);
+               blo = DD(blo, gamma_depth, 0/*truncate*/);
+               bhi = DU(bhi, gamma_depth, 0/*truncate*/);
+            }
+
            gray = pow(gray, power);
-            graylo = digitize(pow(graylo, power), sample_depth, 1);
-            grayhi = digitize(pow(grayhi, power), sample_depth, 1);
+            graylo = DD(pow(graylo, power), sample_depth, 1);
+            grayhi = DU(pow(grayhi, power), sample_depth, 1);
         }

+#        undef DD
+#        undef DU
+
         /* Now the error can be calculated.
          *
          * If r==g==b because there is no overall gamma correction libpng
@@ -7260,16 +7394,28 @@ image_transform_png_set_rgb_to_gray_mod(PNG_CONST image_transform *this,
         {
            /* There is no need to do the conversions to and from linear space,
             * so the calculation should be a lot more accurate.  There is a
-             * built in 1/32768 error in the coefficients because they only have
-             * 15 bits and are adjusted to make sure they add up to 32768, so
-             * the result may have an additional error up to 1/32768.  (Note
-             * that adding the 1/32768 here avoids needing to increase the
-             * global error limits to take this into account.)
+             * built in error in the coefficients because they only have 15 bits
+             * and are adjusted to make sure they add up to 32768.  This
+             * involves a integer calculation with truncation of the form:
+             *
+             *     ((int)(coefficient * 100000) * 32768)/100000
+             *
+             * This is done to the red and green coefficients (the ones
+             * provided to the API) then blue is calculated from them so the
+             * result adds up to 32768.  In the worst case this can result in
+             * a -1 error in red and green and a +2 error in blue.  Consequently
+             * the worst case in the calculation below is 2/32768 error.
+             *
+             * TODO: consider fixing this in libpng by rounding the calculation
+             * limiting the error to 1/32768.
+             *
+             * Handling this by adding 2/32768 here avoids needing to increase
+             * the global error limits to take this into account.)
             */
            gray = r * data.red_coefficient + g * data.green_coefficient +
               b * data.blue_coefficient;
            err = re * data.red_coefficient + ge * data.green_coefficient +
-               be * data.blue_coefficient + 1./32768 + gray * 5 * DBL_EPSILON;
+               be * data.blue_coefficient + 2./32768 + gray * 5 * DBL_EPSILON;
         }

         else
@@ -7304,7 +7450,7 @@ image_transform_png_set_rgb_to_gray_mod(PNG_CONST image_transform *this,
             * previously added input quantization error at this point.
             */
            gray = r * data.red_coefficient + g * data.green_coefficient +
-               b * data.blue_coefficient - 1./32768 - out_qe;
+               b * data.blue_coefficient - 2./32768 - out_qe;
            if (gray <= 0)
               gray = 0;
            else
@@ -7314,7 +7460,7 @@ image_transform_png_set_rgb_to_gray_mod(PNG_CONST image_transform *this,
            }

            grayhi = rhi * data.red_coefficient + ghi * data.green_coefficient +
-               bhi * data.blue_coefficient + 1./32768 + out_qe;
+               bhi * data.blue_coefficient + 2./32768 + out_qe;
            grayhi *= (1 + 6 * DBL_EPSILON);
            if (grayhi >= 1)
               grayhi = 1;
@@ -7429,6 +7575,9 @@ image_transform_png_set_background_set(PNG_CONST image_transform *this,

   else
   {
+      if (that->this.has_tRNS)
+         that->this.is_transparent = 1;
+
      bit_depth = that->this.bit_depth;
      expand = 1;
   }
@@ -7506,14 +7655,14 @@ image_transform_png_set_background_mod(PNG_CONST image_transform *this,
      /* Remove the alpha type and set the alpha (not in that order.) */
      that->alphaf = 1;
      that->alphae = 0;
-
-      if (that->colour_type == PNG_COLOR_TYPE_RGB_ALPHA)
-         that->colour_type = PNG_COLOR_TYPE_RGB;
-      else if (that->colour_type == PNG_COLOR_TYPE_GRAY_ALPHA)
-         that->colour_type = PNG_COLOR_TYPE_GRAY;
-      /* PNG_COLOR_TYPE_PALETTE is not changed */
   }

+   if (that->colour_type == PNG_COLOR_TYPE_RGB_ALPHA)
+      that->colour_type = PNG_COLOR_TYPE_RGB;
+   else if (that->colour_type == PNG_COLOR_TYPE_GRAY_ALPHA)
+      that->colour_type = PNG_COLOR_TYPE_GRAY;
+   /* PNG_COLOR_TYPE_PALETTE is not changed */
+
   this->next->mod(this->next, that, pp, display);
 }

@@ -8301,7 +8450,8 @@ perform_transform_test(png_modifier *pm)
   png_byte bit_depth = 0;
   unsigned int palette_number = 0;

-   while (next_format(&colour_type, &bit_depth, &palette_number, 0))
+   while (next_format(&colour_type, &bit_depth, &palette_number, pm->test_lbg,
+            pm->test_tRNS))
   {
      png_uint_32 counter = 0;
      size_t base_pos;
@@ -8604,7 +8754,9 @@ init_validate_info(validate_info *vi, gamma_display *dp, png_const_structp pp,
   vi->outlog = outlog(dp->pm, in_depth, out_depth);

   if ((dp->this.colour_type & PNG_COLOR_MASK_ALPHA) != 0 ||
-      (dp->this.colour_type == 3 && dp->this.is_transparent))
+      (dp->this.colour_type == 3 && dp->this.is_transparent) ||
+      ((dp->this.colour_type == 0 || dp->this.colour_type == 2) &&
+       dp->this.has_tRNS))
   {
      vi->do_background = dp->do_background;

@@ -8634,7 +8786,7 @@ init_validate_info(validate_info *vi, gamma_display *dp, png_const_structp pp,
         vi->background_blue = b;
      }
   }
-   else
+   else /* Do not expect any background processing */
      vi->do_background = 0;

   if (vi->do_background == 0)
@@ -9350,6 +9502,7 @@ gamma_image_validate(gamma_display *dp, png_const_structp pp,
   png_uint_32 y;
   PNG_CONST store_palette_entry *in_palette = dp->this.palette;
   PNG_CONST int in_is_transparent = dp->this.is_transparent;
+   int process_tRNS;
   int out_npalette = -1;
   int out_is_transparent = 0; /* Just refers to the palette case */
   store_palette out_palette;
@@ -9365,6 +9518,7 @@ gamma_image_validate(gamma_display *dp, png_const_structp pp,

   processing = (vi.gamma_correction > 0 && !dp->threshold_test)
      || in_bd != out_bd || in_ct != out_ct || vi.do_background;
+   process_tRNS = dp->this.has_tRNS && vi.do_background;

   /* TODO: FIX THIS: MAJOR BUG!  If the transformations all happen inside
    * the palette there is no way of finding out, because libpng fails to
@@ -9403,8 +9557,8 @@ gamma_image_validate(gamma_display *dp, png_const_structp pp,
            /* Handle input alpha - png_set_background will cause the output
             * alpha to disappear so there is nothing to check.
             */
-            if ((in_ct & PNG_COLOR_MASK_ALPHA) != 0 || (in_ct == 3 &&
-               in_is_transparent))
+            if ((in_ct & PNG_COLOR_MASK_ALPHA) != 0 ||
+                (in_ct == 3 && in_is_transparent))
            {
               PNG_CONST unsigned int input_alpha = in_ct == 3 ?
                  dp->this.palette[in_index].alpha :
@@ -9436,6 +9590,35 @@ gamma_image_validate(gamma_display *dp, png_const_structp pp,
               }
            }

+            else if (process_tRNS)
+            {
+               /* alpha needs to be set appropriately for this pixel, it is
+                * currently 1 and needs to be 0 for an input pixel which matches
+                * the values in tRNS.
+                */
+               switch (in_ct)
+               {
+                  case 0: /* gray */
+                     if (sample(std, in_ct, in_bd, x, 0, 0, 0) ==
+                           dp->this.transparent.red)
+                        alpha = 0;
+                     break;
+
+                  case 2: /* RGB */
+                     if (sample(std, in_ct, in_bd, x, 0, 0, 0) ==
+                           dp->this.transparent.red &&
+                         sample(std, in_ct, in_bd, x, 1, 0, 0) ==
+                           dp->this.transparent.green &&
+                         sample(std, in_ct, in_bd, x, 2, 0, 0) ==
+                           dp->this.transparent.blue)
+                        alpha = 0;
+                     break;
+
+                  default:
+                     break;
+               }
+            }
+
            /* Handle grayscale or RGB components. */
            if ((in_ct & PNG_COLOR_MASK_COLOR) == 0) /* grayscale */
               (void)gamma_component_validate("gray", &vi,
@@ -9545,7 +9728,7 @@ gamma_test(png_modifier *pmIn, PNG_CONST png_byte colour_typeIn,

      modification_reset(d.pm->modifications);

-      /* Get a png_struct for writing the image. */
+      /* Get a png_struct for reading the image. */
      pp = set_modifier_for_read(d.pm, &pi, d.this.id, name);
      standard_palette_init(&d.this);

@@ -9684,9 +9867,13 @@ perform_gamma_threshold_tests(png_modifier *pm)
   /* Don't test more than one instance of each palette - it's pointless, in
    * fact this test is somewhat excessive since libpng doesn't make this
    * decision based on colour type or bit depth!
+    *
+    * CHANGED: now test two palettes and, as a side effect, images with and
+    * without tRNS.
    */
-   while (next_format(&colour_type, &bit_depth, &palette_number, 1/*gamma*/))
-      if (palette_number == 0)
+   while (next_format(&colour_type, &bit_depth, &palette_number,
+                      pm->test_lbg_gamma_threshold, pm->test_tRNS))
+      if (palette_number < 2)
   {
      double test_gamma = 1.0;
      while (test_gamma >= .4)
@@ -9746,7 +9933,8 @@ static void perform_gamma_transform_tests(png_modifier *pm)
   png_byte bit_depth = 0;
   unsigned int palette_number = 0;

-   while (next_format(&colour_type, &bit_depth, &palette_number, 1/*gamma*/))
+   while (next_format(&colour_type, &bit_depth, &palette_number,
+                      pm->test_lbg_gamma_transform, pm->test_tRNS))
   {
      unsigned int i, j;

@@ -9776,7 +9964,8 @@ static void perform_gamma_sbit_tests(png_modifier *pm)
      png_byte colour_type = 0, bit_depth = 0;
      unsigned int npalette = 0;

-      while (next_format(&colour_type, &bit_depth, &npalette, 1/*gamma*/))
+      while (next_format(&colour_type, &bit_depth, &npalette,
+                         pm->test_lbg_gamma_sbit, pm->test_tRNS))
         if ((colour_type & PNG_COLOR_MASK_ALPHA) == 0 &&
            ((colour_type == 3 && sbit < 8) ||
            (colour_type != 3 && sbit < bit_depth)))
@@ -9967,8 +10156,17 @@ static void gamma_composition_test(png_modifier *pm,
   }

   background.index = 193; /* rgb(193,193,193) to detect errors */
+
   if (!(colour_type & PNG_COLOR_MASK_COLOR))
   {
+      /* Because, currently, png_set_background is always called with
+       * 'need_expand' false in this case and because the gamma test itself
+       * doesn't cause an expand to 8-bit for lower bit depths the colour must
+       * be reduced to the correct range.
+       */
+      if (bit_depth < 8)
+         background.gray &= (png_uint_16)((1U << bit_depth)-1);
+
      /* Grayscale input, we do not convert to RGB (TBD), so we must set the
       * background to gray - else libpng seems to fail.
       */
@@ -10017,9 +10215,18 @@ perform_gamma_composition_tests(png_modifier *pm, int do_background,

   /* Skip the non-alpha cases - there is no setting of a transparency colour at
    * present.
+    *
+    * TODO: incorrect; the palette case sets tRNS and, now RGB and gray do,
+    * however the palette case fails miserably so is commented out below.
    */
-   while (next_format(&colour_type, &bit_depth, &palette_number, 1/*gamma*/))
-      if ((colour_type & PNG_COLOR_MASK_ALPHA) != 0)
+   while (next_format(&colour_type, &bit_depth, &palette_number,
+                      pm->test_lbg_gamma_composition, pm->test_tRNS))
+      if ((colour_type & PNG_COLOR_MASK_ALPHA) != 0
+#if 0 /* TODO: FIXME */
+          /*TODO: FIXME: this should work */
+          || colour_type == 3
+#endif
+          || (colour_type != 3 && palette_number != 0))
   {
      unsigned int i, j;

@@ -10751,6 +10958,18 @@ int main(int argc, char **argv)
   pm.ngammas = ARRAY_SIZE(gammas);
   pm.ngamma_tests = 0; /* default to off */

+   /* Low bit depth gray images don't do well in the gamma tests, until
+    * this is fixed turn them off for some gamma cases:
+    */
+#  ifdef PNG_WRITE_tRNS_SUPPORTED
+      pm.test_tRNS = 1;
+#  endif
+   pm.test_lbg = 0;
+   pm.test_lbg_gamma_threshold = 1;
+   pm.test_lbg_gamma_transform = 0/*PNG_LIBPNG_VER >= 10700*/;
+   pm.test_lbg_gamma_sbit = 1;
+   pm.test_lbg_gamma_composition = 0;
+
   /* And the test encodings */
   pm.encodings = test_encodings;
   pm.nencodings = ARRAY_SIZE(test_encodings);
@@ -10863,7 +11082,7 @@ int main(int argc, char **argv)
         pm.test_gamma_transform = 1;
         pm.test_gamma_sbit = 1;
         pm.test_gamma_scale16 = 1;
-         pm.test_gamma_background = 1;
+         pm.test_gamma_background = 1; /* composition */
         pm.test_gamma_alpha_mode = 1;
         }

@@ -10912,6 +11131,24 @@ int main(int argc, char **argv)
      else if (strcmp(*argv, "--noexpand16") == 0)
         pm.test_gamma_expand16 = 0;

+      else if (strcmp(*argv, "--low-depth-gray") == 0)
+         pm.test_lbg = pm.test_lbg_gamma_threshold =
+            pm.test_lbg_gamma_transform = pm.test_lbg_gamma_sbit =
+            pm.test_lbg_gamma_composition = 1;
+
+      else if (strcmp(*argv, "--nolow-depth-gray") == 0)
+         pm.test_lbg = pm.test_lbg_gamma_threshold =
+            pm.test_lbg_gamma_transform = pm.test_lbg_gamma_sbit =
+            pm.test_lbg_gamma_composition = 0;
+
+#     ifdef PNG_WRITE_tRNS_SUPPORTED
+         else if (strcmp(*argv, "--tRNS") == 0)
+            pm.test_tRNS = 1;
+#     endif
+
+      else if (strcmp(*argv, "--notRNS") == 0)
+         pm.test_tRNS = 0;
+
      else if (strcmp(*argv, "--more-gammas") == 0)
         pm.ngamma_tests = 3U;

@@ -11102,7 +11339,7 @@ int main(int argc, char **argv)
   Try
   {
      /* Make useful base images */
-      make_transform_images(&pm.this);
+      make_transform_images(&pm);

      /* Perform the standard and gamma tests. */
      if (pm.test_standard)
--- a/contrib/pngminim/decoder/pngusr.h
+++ b/contrib/pngminim/decoder/pngusr.h
@@ -18,6 +18,7 @@
 * affect the API (so are not recorded in pnglibconf.h)
 */

+#define PNG_RELEASE_BUILD 1
 #define PNG_ALIGN_TYPE PNG_ALIGN_NONE

 #endif /* MINRDPNGCONF_H */
--- a/contrib/pngminim/encoder/pngusr.h
+++ b/contrib/pngminim/encoder/pngusr.h
@@ -18,6 +18,7 @@
 * affect the API (so are not recorded in pnglibconf.h)
 */

+#define PNG_RELEASE_BUILD 1
 #define PNG_ALIGN_TYPE PNG_ALIGN_NONE

 #endif /* MINWRPNGCONF_H */
--- a/contrib/pngminim/preader/pngusr.h
+++ b/contrib/pngminim/preader/pngusr.h
@@ -18,6 +18,7 @@
 * affect the API (so are not recorded in pnglibconf.h)
 */

+#define PNG_RELEASE_BUILD 1
 #define PNG_ALIGN_TYPE PNG_ALIGN_NONE

 #endif /* MINPRDPNGCONF_H */
--- a/contrib/tools/pngfix.c
+++ b/contrib/tools/pngfix.c
@@ -1,6 +1,6 @@
 /* pngfix.c
 *
- * Copyright (c) 2015 John Cunningham Bowler
+ * Copyright (c) 2014-2015 John Cunningham Bowler
 *
 * Last changed in libpng 1.6.17 [(PENDING RELEASE)]
 *
@@ -2138,7 +2138,7 @@ zlib_end(struct zlib *zlib)
          *
          * z-rc is the zlib failure code; message is the error message with
          * spaces replaced by '-'.  The compressed byte count indicates where
-          * in the zlib stream the error occured.
+          * in the zlib stream the error occurred.
          */
         type_name(zlib->chunk->chunk_type, stdout);
         printf(" SKP %s %d %s ", zlib_flevel(zlib), zlib->file_bits,
@@ -3702,21 +3702,21 @@ usage(const char *prog)
 "        gAMA, sRGB [all]: These specify the gamma encoding used for the pixel",
 "            values.",
 "        cHRM, iCCP [color]: These specify how colors are encoded.  iCCP also",
-"            specifies the exact encoding of a pixel value however in practice",
-"            most programs will ignore it.",
+"            specifies the exact encoding of a pixel value; however, in",
+"            practice most programs will ignore it.",
 "        bKGD [transform]: This is used by libpng transforms."
 "    --max=<number>:",
 "      Use IDAT chunks sized <number>.  If no number is given the the IDAT",
 "      chunks will be the maximum size permitted; 2^31-1 bytes.  If the option",
 "      is omitted the original chunk sizes will not be changed.  When the",
-"      option is given --strip=unsafe is set automatically, this may be",
+"      option is given --strip=unsafe is set automatically. This may be",
 "      cancelled if you know that all unknown unsafe-to-copy chunks really are",
 "      safe to copy across an IDAT size change.  This is true of all chunks",
 "      that have ever been formally proposed as PNG extensions.",
 "  MESSAGES",
 "      By default the program only outputs summaries for each file.",
 "    --quiet (-q):",
-"      Do not output the summaries except for files which cannot be read. With",
+"      Do not output the summaries except for files that cannot be read. With",
 "      two --quiets these are not output either.",
 "    --errors (-e):",
 "      Output errors from libpng and the program (except too-far-back).",
@@ -3749,7 +3749,7 @@ usage(const char *prog)
 "  the following codes.  Notice that the results for each file are combined",
 "  together - check one file at a time to get a meaningful error code!",
 "    0x01: The zlib too-far-back error existed in at least one chunk.",
-"    0x02: At least once chunk had a CRC error.",
+"    0x02: At least one chunk had a CRC error.",
 "    0x04: A chunk length was incorrect.",
 "    0x08: The file was truncated.",
 "  Errors less than 16 are potentially recoverable, for a single file if the",
@@ -3757,7 +3757,7 @@ usage(const char *prog)
 "  non-zero code is returned).",
 "    0x10: The file could not be read, even with corrections.",
 "    0x20: The output file could not be written.",
-"    0x40: An unexpected, potentially internal, error occured.",
+"    0x40: An unexpected, potentially internal, error occurred.",
 "  If the command line arguments are incorrect the program exits with exit",
 "  255.  Some older operating systems only support 7-bit exit codes, on those",
 "  systems it is suggested that this program is first tested by supplying",
@@ -3817,7 +3817,7 @@ usage(const char *prog)
 "          SKP: The chunk was skipped because of a zlib issue (zlib-rc) with",
 "               explanation 'message'",
 "          ERR: The read of the file was aborted.  The parameters explain why.",
-"$3 status:     For 'ERR' the accumulate status code from 'EXIT CODES' above.",
+"$3 status:     For 'ERR' the accumulated status code from 'EXIT CODES' above.",
 "               This is printed as a 2 digit hexadecimal value",
 "   comp-level: The recorded compression level (FLEVEL) of a zlib stream",
 "               expressed as a string {supfast,stdfast,default,maximum}",
--- a/libpng-manual.txt
+++ b/libpng-manual.txt
@@ -1,6 +1,6 @@
 libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.7.0beta48 - February 7, 2015
+ libpng version 1.7.0beta59 - April 19, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2015 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.7.0beta48 - February 7, 2015
+ libpng versions 0.97, January 1998, through 1.7.0beta59 - April 19, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2015 Glenn Randers-Pehrson

@@ -337,7 +337,7 @@ prediction.

 If you are intending to keep the file pointer open for use in libpng,
 you must ensure you don't read more than 8 bytes from the beginning
-of the file, and you also have to make a call to png_set_sig_bytes_read()
+of the file, and you also have to make a call to png_set_sig_bytes()
 with the number of bytes you read from the beginning.  Libpng will
 then only check the bytes (if any) that your program didn't read.

@@ -434,6 +434,10 @@ You can #define PNG_ABORT to a function or other C code that does something
 more useful than abort(), as long as your function does not
 return.

+If you do this, you cannot #define PNG_SIMPLIFIED_READ_SUPPORTED or
+PNG_SIMPLIFIED_WRITE_SUPPORTED, because the simplified API requires
+setjmp() support.
+
 Now you need to set up the input code.  The default for libpng is to
 use the C function fread().  If you use this, you will need to pass a
 valid FILE * in the function png_init_io().  Be sure that the file is
@@ -1181,7 +1185,10 @@ row_pointers prior to calling png_read_png() with
   png_set_rows(png_ptr, info_ptr, &row_pointers);

 Alternatively you could allocate your image in one big block and define
-row_pointers[i] to point into the proper places in your block.
+row_pointers[i] to point into the proper places in your block.  If
+you do this, be sure to call png_read_update_info() described below,
+to update the "rowbytes" value to account for any transformations that
+change the number of bytes per row before you use it to allocate your block.

 If you use png_set_rows(), the application is responsible for freeing
 row_pointers (and row_pointers[i], if they were separately allocated).
@@ -1266,13 +1273,13 @@ in until png_read_end() has read the chunk data following the image.
                     the PNG datastream is embedded in
                     a MNG-1.0 datastream)

-    Any or all of color_tye, bit_depth, interlace_type,
-    compression_type, or filter_method can be NULL if you
-    are not interested in their values.
+    Any of width, height, color_type, bit_depth,
+    interlace_type, compression_type, or filter_method can
+    be NULL if you are not interested in their values.

    Note that png_get_IHDR() returns png_uint_32 data into
    the application's width and height variables.
-    This is an unsafe situation if these are 16-bit
+    This is an unsafe situation if these are not png_uint_32
    variables, or if they are 32-bit variables on a 64-bit
    platform.  In such situations, the png_get_image_width()
    and png_get_image_height() functions described below are
@@ -1996,7 +2003,7 @@ value when you call it in this position:
      png_set_gamma(png_ptr, screen_gamma, 0.45455);

 If you need to reduce an RGB file to a paletted file, or if a paletted
-file has more entries then will fit on your screen, png_set_quantize()
+file has more entries than will fit on your screen, png_set_quantize()
 will do that.  Note that this is a simple match quantization that merely
 finds the closest color available.  This should work fairly well with
 optimized palettes, but fairly badly with linear color cubes.  If you
@@ -2549,7 +2556,7 @@ png_infop info_ptr;
       64K.  The library seems to run fine with sizes
       of 4K. Although you can give it much less if
       necessary (I assume you can give it chunks of
-       1 byte, I haven't tried less then 256 bytes
+       1 byte, I haven't tried less than 256 bytes
       yet).  When this function returns, you may
       want to display any rows that were generated
       in the row callback if you don't already do
@@ -5033,11 +5040,15 @@ The signatures of many exported functions were changed, such that
   png_infop became png_inforp or png_const_inforp
 where "rp" indicates a "restricted pointer".

+The support for FAR/far types has been eliminated and the definition of
+png_alloc_size_t is now controlled by a flag so that 'small size_t' systems
+can select it if necessary.
+
 Error detection in some chunks has improved; in particular the iCCP chunk
 reader now does pretty complete validation of the basic format.  Some bad
 profiles that were previously accepted are now accepted with a warning or
-rejected, depending upon the png_set_benign_errors() setting, in particular the
-very old broken Microsoft/HP 3144-byte sRGB profile.  Starting with
+rejected, depending upon the png_set_benign_errors() setting, in particular
+the very old broken Microsoft/HP 3144-byte sRGB profile.  Starting with
 libpng-1.6.11, recognizing and checking sRGB profiles can be avoided by
 means of

@@ -5048,7 +5059,7 @@ means of
    #endif

 It's not a good idea to do this if you are using the "simplified API",
-which needs to be able to recognize an sRGB profile conveyed via the iCCP
+which needs to be able to recognize sRGB profiles conveyed via the iCCP
 chunk.

 The PNG spec requirement that only grayscale profiles may appear in images
@@ -5155,6 +5166,11 @@ The 8-bit compose and rgb_to_grayscale operations were made more accurate.
 While these did not introduce API incompatibility, there may be differences
 in unit test results.

+Internal "affirm()" and "impossible()" macros were added, along with
+some internal supporting macros and functions. These are similar to the
+ANSI-C "assert()" macro but they are not affected by NDEBUG, and they are
+private (not visible to nor usable by libpng applications).
+
 XIV.  Detecting libpng

 The png_get_io_ptr() function has been present since libpng-0.88, has never
@@ -5325,13 +5341,13 @@ Other rules can be inferred by inspecting the libpng source.

 XVII. Y2K Compliance in libpng

-February 7, 2015
+April 19, 2015

 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.7.0beta48 are Y2K compliant.  It is my belief that earlier
+upward through 1.7.0beta59 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
--- a/libpng.3
+++ b/libpng.3
@@ -1,6 +1,6 @@
-.TH LIBPNG 3 "February 7, 2015"
+.TH LIBPNG 3 "April 19, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta48
+libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta59
 .SH SYNOPSIS
 \fB
 #include <png.h>\fP
@@ -494,7 +494,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng-manual.txt - A description on how to use and modify libpng

- libpng version 1.7.0beta48 - February 7, 2015
+ libpng version 1.7.0beta59 - April 19, 2015
 Updated and distributed by Glenn Randers-Pehrson
 <glennrp at users.sourceforge.net>
 Copyright (c) 1998-2015 Glenn Randers-Pehrson
@@ -505,7 +505,7 @@ libpng-manual.txt - A description on how to use and modify libpng

 Based on:

- libpng versions 0.97, January 1998, through 1.7.0beta48 - February 7, 2015
+ libpng versions 0.97, January 1998, through 1.7.0beta59 - April 19, 2015
 Updated and distributed by Glenn Randers-Pehrson
 Copyright (c) 1998-2015 Glenn Randers-Pehrson

@@ -831,7 +831,7 @@ prediction.

 If you are intending to keep the file pointer open for use in libpng,
 you must ensure you don't read more than 8 bytes from the beginning
-of the file, and you also have to make a call to png_set_sig_bytes_read()
+of the file, and you also have to make a call to png_set_sig_bytes()
 with the number of bytes you read from the beginning.  Libpng will
 then only check the bytes (if any) that your program didn't read.

@@ -928,6 +928,10 @@ You can #define PNG_ABORT to a function or other C code that does something
 more useful than abort(), as long as your function does not
 return.

+If you do this, you cannot #define PNG_SIMPLIFIED_READ_SUPPORTED or
+PNG_SIMPLIFIED_WRITE_SUPPORTED, because the simplified API requires
+setjmp() support.
+
 Now you need to set up the input code.  The default for libpng is to
 use the C function fread().  If you use this, you will need to pass a
 valid FILE * in the function png_init_io().  Be sure that the file is
@@ -1675,7 +1679,10 @@ row_pointers prior to calling png_read_png() with
   png_set_rows(png_ptr, info_ptr, &row_pointers);

 Alternatively you could allocate your image in one big block and define
-row_pointers[i] to point into the proper places in your block.
+row_pointers[i] to point into the proper places in your block.  If
+you do this, be sure to call png_read_update_info() described below,
+to update the "rowbytes" value to account for any transformations that
+change the number of bytes per row before you use it to allocate your block.

 If you use png_set_rows(), the application is responsible for freeing
 row_pointers (and row_pointers[i], if they were separately allocated).
@@ -1760,13 +1767,13 @@ in until png_read_end() has read the chunk data following the image.
                     the PNG datastream is embedded in
                     a MNG-1.0 datastream)

-    Any or all of color_tye, bit_depth, interlace_type,
-    compression_type, or filter_method can be NULL if you
-    are not interested in their values.
+    Any of width, height, color_type, bit_depth,
+    interlace_type, compression_type, or filter_method can
+    be NULL if you are not interested in their values.

    Note that png_get_IHDR() returns png_uint_32 data into
    the application's width and height variables.
-    This is an unsafe situation if these are 16-bit
+    This is an unsafe situation if these are not png_uint_32
    variables, or if they are 32-bit variables on a 64-bit
    platform.  In such situations, the png_get_image_width()
    and png_get_image_height() functions described below are
@@ -2490,7 +2497,7 @@ value when you call it in this position:
      png_set_gamma(png_ptr, screen_gamma, 0.45455);

 If you need to reduce an RGB file to a paletted file, or if a paletted
-file has more entries then will fit on your screen, png_set_quantize()
+file has more entries than will fit on your screen, png_set_quantize()
 will do that.  Note that this is a simple match quantization that merely
 finds the closest color available.  This should work fairly well with
 optimized palettes, but fairly badly with linear color cubes.  If you
@@ -3043,7 +3050,7 @@ png_infop info_ptr;
       64K.  The library seems to run fine with sizes
       of 4K. Although you can give it much less if
       necessary (I assume you can give it chunks of
-       1 byte, I haven't tried less then 256 bytes
+       1 byte, I haven't tried less than 256 bytes
       yet).  When this function returns, you may
       want to display any rows that were generated
       in the row callback if you don't already do
@@ -5527,11 +5534,15 @@ The signatures of many exported functions were changed, such that
   png_infop became png_inforp or png_const_inforp
 where "rp" indicates a "restricted pointer".

+The support for FAR/far types has been eliminated and the definition of
+png_alloc_size_t is now controlled by a flag so that 'small size_t' systems
+can select it if necessary.
+
 Error detection in some chunks has improved; in particular the iCCP chunk
 reader now does pretty complete validation of the basic format.  Some bad
 profiles that were previously accepted are now accepted with a warning or
-rejected, depending upon the png_set_benign_errors() setting, in particular the
-very old broken Microsoft/HP 3144-byte sRGB profile.  Starting with
+rejected, depending upon the png_set_benign_errors() setting, in particular
+the very old broken Microsoft/HP 3144-byte sRGB profile.  Starting with
 libpng-1.6.11, recognizing and checking sRGB profiles can be avoided by
 means of

@@ -5542,7 +5553,7 @@ means of
    #endif

 It's not a good idea to do this if you are using the "simplified API",
-which needs to be able to recognize an sRGB profile conveyed via the iCCP
+which needs to be able to recognize sRGB profiles conveyed via the iCCP
 chunk.

 The PNG spec requirement that only grayscale profiles may appear in images
@@ -5649,6 +5660,11 @@ The 8-bit compose and rgb_to_grayscale operations were made more accurate.
 While these did not introduce API incompatibility, there may be differences
 in unit test results.

+Internal "affirm()" and "impossible()" macros were added, along with
+some internal supporting macros and functions. These are similar to the
+ANSI-C "assert()" macro but they are not affected by NDEBUG, and they are
+private (not visible to nor usable by libpng applications).
+
 .SH XIV.  Detecting libpng

 The png_get_io_ptr() function has been present since libpng-0.88, has never
@@ -5819,13 +5835,13 @@ Other rules can be inferred by inspecting the libpng source.

 .SH XVII. Y2K Compliance in libpng

-February 7, 2015
+April 19, 2015

 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.

 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.7.0beta48 are Y2K compliant.  It is my belief that earlier
+upward through 1.7.0beta59 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.

 Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -6030,9 +6046,56 @@ the first widely used release:
 1.5.7beta01-05      15    10507  15.so.15.7[.0]
 1.5.7rc01-03        15    10507  15.so.15.7[.0]
 1.5.7               15    10507  15.so.15.7[.0]
- 1.6.0beta01-37      16    10600  16.so.16.0[.0]
+ 1.6.0beta01-40      16    10600  16.so.16.0[.0]
+ 1.6.0rc01-08        16    10600  16.so.16.0[.0]
+ 1.6.0               16    10600  16.so.16.0[.0]
+ 1.6.1beta01-09      16    10601  16.so.16.1[.0]
+ 1.6.1rc01           16    10601  16.so.16.1[.0]
+ 1.6.1               16    10601  16.so.16.1[.0]
+ 1.6.2beta01         16    10602  16.so.16.2[.0]
+ 1.6.2rc01-06        16    10602  16.so.16.2[.0]
+ 1.6.2               16    10602  16.so.16.2[.0]
+ 1.6.3beta01-11      16    10603  16.so.16.3[.0]
+ 1.6.3rc01           16    10603  16.so.16.3[.0]
+ 1.6.3               16    10603  16.so.16.3[.0]
+ 1.6.4beta01-02      16    10604  16.so.16.4[.0]
+ 1.6.4rc01           16    10604  16.so.16.4[.0]
+ 1.6.4               16    10604  16.so.16.4[.0]
+ 1.6.5               16    10605  16.so.16.5[.0]
+ 1.6.6               16    10606  16.so.16.6[.0]
+ 1.6.7beta01-04      16    10607  16.so.16.7[.0]
+ 1.6.7rc01-03        16    10607  16.so.16.7[.0]
+ 1.6.7               16    10607  16.so.16.7[.0]
+ 1.6.8beta01-02      16    10608  16.so.16.8[.0]
+ 1.6.8rc01-02        16    10608  16.so.16.8[.0]
+ 1.6.8               16    10608  16.so.16.8[.0]
+ 1.6.9beta01-04      16    10609  16.so.16.9[.0]
+ 1.6.9rc01-02        16    10609  16.so.16.9[.0]
+ 1.6.9               16    10609  16.so.16.9[.0]
+ 1.6.10beta01-03     16    10610  16.so.16.10[.0]
+ 1.6.10rc01-03       16    10610  16.so.16.10[.0]
+ 1.6.10              16    10610  16.so.16.10[.0]
+ 1.6.11beta01-06     16    10611  16.so.16.11[.0]
+ 1.6.11rc01-02       16    10611  16.so.16.11[.0]
+ 1.6.11              16    10611  16.so.16.11[.0]
+ 1.6.12rc01-03       16    10612  16.so.16.12[.0]
+ 1.6.12              16    10612  16.so.16.12[.0]
+ 1.6.13beta01-04     16    10613  16.so.16.13[.0]
+ 1.6.13rc01-02       16    10613  16.so.16.13[.0]
+ 1.6.13              16    10613  16.so.16.13[.0]
+ 1.6.14beta01-07     16    10614  16.so.16.14[.0]
+ 1.6.14rc01-02       16    10614  16.so.16.14[.0]
+ 1.6.14              16    10614  16.so.16.14[.0]
+ 1.6.15beta01-08     16    10615  16.so.16.15[.0]
+ 1.6.15rc01-03       16    10615  16.so.16.15[.0]
+ 1.6.15              16    10615  16.so.16.15[.0]
+ 1.6.16beta01-03     16    10616  16.so.16.16[.0]
+ 1.6.16rc01-02       16    10616  16.so.16.16[.0]
+ 1.6.16              16    10616  16.so.16.16[.0]
+ 1.6.17beta01-06     16    10617  16.so.16.17[.0]
+ 1.6.17rc01          16    10617  16.so.16.17[.0]
 1.7.0alpha01-10     17    10700  17.so.17.0[.0]
- 1.7.0beta01-48      17    10700  17.so.17.0[.0]
+ 1.7.0beta01-59      17    10700  17.so.17.0[.0]

 Henceforth the source version will match the shared-library minor
 and patch numbers; the shared-library major version number will be
@@ -6089,7 +6152,7 @@ possible without all of you.

 Thanks to Frank J. T. Wojcik for helping with the documentation.

-Libpng version 1.7.0beta48 - February 7, 2015:
+Libpng version 1.7.0beta59 - April 19, 2015:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).

@@ -6112,8 +6175,8 @@ this sentence.

 This code is released under the libpng license.

-libpng versions 1.2.6, August 15, 2004, through 1.7.0beta48, February 7, 2015, are
-Copyright (c) 2004,2006-2007 Glenn Randers-Pehrson, and are
+libpng versions 1.2.6, August 15, 2004, through 1.7.0beta59, April 19, 2015, are
+Copyright (c) 2004,2006-2015 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors

@@ -6211,7 +6274,7 @@ certification mark of the Open Source Initiative.

 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-February 7, 2015
+April 19, 2015

 .\" end of man page

--- a/libpngpf.3
+++ b/libpngpf.3
@@ -1,6 +1,6 @@
-.TH LIBPNGPF 3 "February 7, 2015"
+.TH LIBPNGPF 3 "April 19, 2015"
 .SH NAME
-libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta48
+libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta59
 (private functions)
 .SH SYNOPSIS
 \fB#include \fI"pngpriv.h"
--- a/png.5
+++ b/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "February 7, 2015"
+.TH PNG 5 "April 19, 2015"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
--- a/png.c
+++ b/png.c
@@ -12,9 +12,10 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_png

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_7_0beta48 Your_png_h_is_not_version_1_7_0beta48;
+typedef png_libpng_version_1_7_0beta59 Your_png_h_is_not_version_1_7_0beta59;

 /* Tells libpng that we have already handled the first "num_bytes" bytes
 * of the PNG file signature.  If the PNG data is embedded into another
@@ -34,7 +35,7 @@ png_set_sig_bytes(png_structrp png_ptr, int num_bytes)
   if (num_bytes > 8)
      png_error(png_ptr, "Too many bytes for PNG signature");

-   png_ptr->sig_bytes = (png_byte)(num_bytes < 0 ? 0 : num_bytes);
+   png_ptr->sig_bytes = png_check_byte(png_ptr, num_bytes < 0 ? 0 : num_bytes);
 }

 /* Checks whether the supplied bytes match the PNG signature.  We allow
@@ -79,7 +80,7 @@ png_zalloc,(voidpf png_ptr, uInt items, uInt size),PNG_ALLOCATED)

   if (items >= (~(png_alloc_size_t)0)/size)
   {
-      png_warning (png_voidcast(png_structrp, png_ptr),
+      png_warning(png_voidcast(png_structrp, png_ptr),
         "Potential overflow in png_zalloc()");
      return NULL;
   }
@@ -492,20 +493,17 @@ png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,

      else
      {
-         if (info_ptr->splt_palettes_num != 0)
+         int i;
+
+         for (i = 0; i < info_ptr->splt_palettes_num; i++)
         {
-            int i;
-
-            for (i = 0; i < info_ptr->splt_palettes_num; i++)
-            {
-               png_free(png_ptr, info_ptr->splt_palettes[i].name);
-               png_free(png_ptr, info_ptr->splt_palettes[i].entries);
-            }
-
-            png_free(png_ptr, info_ptr->splt_palettes);
-            info_ptr->splt_palettes = NULL;
-            info_ptr->splt_palettes_num = 0;
+            png_free(png_ptr, info_ptr->splt_palettes[i].name);
+            png_free(png_ptr, info_ptr->splt_palettes[i].entries);
         }
+
+         png_free(png_ptr, info_ptr->splt_palettes);
+         info_ptr->splt_palettes = NULL;
+         info_ptr->splt_palettes_num = 0;
         info_ptr->valid &= ~PNG_INFO_sPLT;
      }
   }
@@ -525,15 +523,12 @@ png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,
      {
         int i;

-         if (info_ptr->unknown_chunks_num != 0)
-         {
-            for (i = 0; i < info_ptr->unknown_chunks_num; i++)
-               png_free(png_ptr, info_ptr->unknown_chunks[i].data);
+         for (i = 0; i < info_ptr->unknown_chunks_num; i++)
+            png_free(png_ptr, info_ptr->unknown_chunks[i].data);

-            png_free(png_ptr, info_ptr->unknown_chunks);
-            info_ptr->unknown_chunks = NULL;
-            info_ptr->unknown_chunks_num = 0;
-         }
+         png_free(png_ptr, info_ptr->unknown_chunks);
+         info_ptr->unknown_chunks = NULL;
+         info_ptr->unknown_chunks_num = 0;
      }
   }
 #endif
@@ -694,13 +689,13 @@ png_get_copyright(png_const_structrp png_ptr)
 #else
 #  ifdef __STDC__
   return PNG_STRING_NEWLINE \
-     "libpng version 1.7.0beta48 - February 7, 2015" PNG_STRING_NEWLINE \
+     "libpng version 1.7.0beta59 - April 19, 2015" PNG_STRING_NEWLINE \
     "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
     "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
     "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
     PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.7.0beta48 - February 7, 2015\
+      return "libpng version 1.7.0beta59 - April 19, 2015\
      Copyright (c) 1998-2015 Glenn Randers-Pehrson\
      Copyright (c) 1996-1997 Andreas Dilger\
      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
@@ -758,9 +753,9 @@ void PNGAPI
 png_build_grayscale_palette(int bit_depth, png_colorp palette)
 {
   int num_palette;
-   int color_inc;
+   png_byte color_inc;
   int i;
-   int v;
+   png_byte v;

   png_debug(1, "in png_do_build_grayscale_palette");

@@ -795,12 +790,8 @@ png_build_grayscale_palette(int bit_depth, png_colorp palette)
         break;
   }

-   for (i = 0, v = 0; i < num_palette; i++, v += color_inc)
-   {
-      palette[i].red = (png_byte)v;
-      palette[i].green = (png_byte)v;
-      palette[i].blue = (png_byte)v;
-   }
+   for (i = 0, v = 0; i < num_palette; ++i, v = PNG_BYTE(v+color_inc))
+      palette[i].red = palette[i].green = palette[i].blue = v;
 }
 #endif

@@ -1616,7 +1607,7 @@ png_colorspace_set_chromaticities(png_const_structrp png_ptr,
          * want error reports so for the moment it is an error.
          */
         colorspace->flags |= PNG_COLORSPACE_INVALID;
-         png_error(png_ptr, "internal error checking chromaticities");
+         impossible("error checking chromaticities");
         break;
   }

@@ -1644,7 +1635,7 @@ png_colorspace_set_endpoints(png_const_structrp png_ptr,

      default:
         colorspace->flags |= PNG_COLORSPACE_INVALID;
-         png_error(png_ptr, "internal error checking chromaticities");
+         impossible("error checking chromaticities");
         break;
   }

@@ -1658,7 +1649,7 @@ png_icc_tag_char(png_uint_32 byte)
 {
   byte &= 0xff;
   if (byte >= 32 && byte <= 126)
-      return (char)byte;
+      return (char)/*SAFE*/byte;
   else
      return '?';
 }
@@ -1807,7 +1798,7 @@ png_colorspace_set_sRGB(png_const_structrp png_ptr, png_colorspacerp colorspace,
      2/*from sRGB*/);

   /* intent: bugs in GCC force 'int' to be used as the parameter type. */
-   colorspace->rendering_intent = (png_uint_16)intent;
+   colorspace->rendering_intent = png_check_u16(png_ptr, intent);
   colorspace->flags |= PNG_COLORSPACE_HAVE_INTENT;

   /* endpoints */
@@ -2189,7 +2180,7 @@ png_compare_ICC_profile_with_sRGB(png_const_structrp png_ptr,

         /* Length *and* intent must match */
         if (length == png_sRGB_checks[i].length &&
-            intent == png_sRGB_checks[i].intent)
+            intent == (png_uint_32) png_sRGB_checks[i].intent)
         {
            /* Now calculate the adler32 if not done already. */
            if (adler == 0)
@@ -2347,13 +2338,12 @@ png_colorspace_set_rgb_coefficients(png_structrp png_ptr)

         /* Check for an internal error. */
         if (r+g+b != 32768)
-            png_error(png_ptr,
-               "internal error handling cHRM coefficients");
+            impossible("error handling cHRM coefficients");

         else
         {
-            png_ptr->rgb_to_gray_red_coeff   = (png_uint_16)r;
-            png_ptr->rgb_to_gray_green_coeff = (png_uint_16)g;
+            png_ptr->rgb_to_gray_red_coeff   = png_check_u16(png_ptr, r);
+            png_ptr->rgb_to_gray_green_coeff = png_check_u16(png_ptr, g);
         }
      }

@@ -2362,7 +2352,7 @@ png_colorspace_set_rgb_coefficients(png_structrp png_ptr)
       * bug is fixed.
       */
      else
-         png_error(png_ptr, "internal error handling cHRM->XYZ");
+         impossible("error handling cHRM->XYZ");
   }
 }
 #endif /* READ_RGB_TO_GRAY */
@@ -2937,7 +2927,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,

                     --exp_b10;
                  }
-                  *ascii++ = (char)(48 + (int)d), ++cdigits;
+                  *ascii++ = png_check_char(png_ptr, 48 + (int)d), ++cdigits;
               }
            }
            while (cdigits+czero-clead < (int)precision && fp > DBL_MIN);
@@ -2947,7 +2937,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
            /* Check for an exponent, if we don't need one we are
             * done and just need to terminate the string.  At
             * this point exp_b10==(-1) is effectively if flag - it got
-             * to '-1' because of the decrement after outputing
+             * to '-1' because of the decrement after outputting
             * the decimal point above (the exponent required is
             * *not* -1!)
             */
@@ -2955,7 +2945,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
            {
               /* The following only happens if we didn't output the
                * leading zeros above for negative exponent, so this
-                * doest add to the digit requirement.  Note that the
+                * doesn't add to the digit requirement.  Note that the
                * two zeros here can only be output if the two leading
                * zeros were *not* output, so this doesn't increase
                * the output count.
@@ -3000,7 +2990,7 @@ png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,

               while (uexp_b10 > 0)
               {
-                  exponent[cdigits++] = (char)(48 + uexp_b10 % 10);
+                  exponent[cdigits++] = (char)/*SAFE*/(48 + uexp_b10 % 10);
                  uexp_b10 /= 10;
               }
            }
@@ -3070,7 +3060,7 @@ png_ascii_from_fixed(png_const_structrp png_ptr, png_charp ascii,
            /* Split the low digit off num: */
            unsigned int tmp = num/10;
            num -= tmp*10;
-            digits[ndigits++] = (char)(48 + num);
+            digits[ndigits++] = png_check_char(png_ptr, 48 + num);
            /* Record the first non-zero digit, note that this is a number
             * starting at 1, it's not actually the array index.
             */
@@ -3269,24 +3259,6 @@ png_muldiv(png_fixed_point_p res, png_fixed_point a, png_int_32 times,
 }
 #endif /* READ_GAMMA || INCH_CONVERSIONS */

-#if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_INCH_CONVERSIONS_SUPPORTED)
-/* The following is for when the caller doesn't much care about the
- * result.
- */
-png_fixed_point
-png_muldiv_warn(png_const_structrp png_ptr, png_fixed_point a, png_int_32 times,
-    png_int_32 divisor)
-{
-   png_fixed_point result;
-
-   if (png_muldiv(&result, a, times, divisor) != 0)
-      return result;
-
-   png_warning(png_ptr, "fixed point overflow ignored");
-   return 0;
-}
-#endif
-
 #ifdef PNG_GAMMA_SUPPORTED /* more fixed point functions for gamma */
 /* Calculate a reciprocal, return 0 on div-by-zero or overflow. */
 png_fixed_point
@@ -3319,7 +3291,6 @@ png_gamma_significant(png_fixed_point gamma_val)
 #endif

 #ifdef PNG_READ_GAMMA_SUPPORTED
-#ifdef PNG_16BIT_SUPPORTED
 #ifndef PNG_FLOATING_ARITHMETIC_SUPPORTED
 /* A local convenience routine. */
 static png_fixed_point
@@ -3334,13 +3305,11 @@ png_product2(png_fixed_point a, png_fixed_point b)
   return 0; /* overflow */
 }
 #endif /* FLOATING_ARITHMETIC */
-#endif /* 16BIT */

 /* The inverse of the above. */
 png_fixed_point
 png_reciprocal2(png_fixed_point a, png_fixed_point b)
 {
-#ifdef PNG_16BIT_SUPPORTED
   /* The required result is 1/a * 1/b; the following preserves accuracy. */
 #ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
   if (a != 0 && b != 0)
@@ -3363,7 +3332,6 @@ png_reciprocal2(png_fixed_point a, png_fixed_point b)
   if (res != 0)
      return png_reciprocal(res);
 #endif
-#endif /* 16BIT */

   return 0; /* overflow */
 }
@@ -3633,7 +3601,7 @@ png_exp(png_fixed_point x)
 }

 static png_byte
-png_exp8bit(png_fixed_point lg2)
+png_exp8bit(png_const_structrp png_ptr, png_fixed_point lg2)
 {
   /* Get a 32-bit value: */
   png_uint_32 x = png_exp(lg2);
@@ -3643,23 +3611,26 @@ png_exp8bit(png_fixed_point lg2)
    * step.
    */
   x -= x >> 8;
-   return (png_byte)((x + 0x7fffffU) >> 24);
+   return png_check_byte(png_ptr, (x + 0x7fffffU) >> 24);
+   PNG_UNUSEDRC(png_ptr)
 }

 static png_uint_16
-png_exp16bit(png_fixed_point lg2)
+png_exp16bit(png_const_structrp png_ptr, png_fixed_point lg2)
 {
   /* Get a 32-bit value: */
   png_uint_32 x = png_exp(lg2);

   /* Convert the 32-bit value to 0..65535 by multiplying by 65536-1: */
   x -= x >> 16;
-   return (png_uint_16)((x + 32767U) >> 16);
+   return png_check_u16(png_ptr, (x + 32767U) >> 16);
+   PNG_UNUSEDRC(png_ptr)
 }
 #endif /* FLOATING_ARITHMETIC */

 png_byte
-png_gamma_8bit_correct(unsigned int value, png_fixed_point gamma_val)
+png_gamma_8bit_correct(png_const_structrp png_ptr, png_uint_32 value,
+   png_fixed_point gamma_val)
 {
   if (value > 0 && value < 255)
   {
@@ -3689,24 +3660,28 @@ png_gamma_8bit_correct(unsigned int value, png_fixed_point gamma_val)
          * caller if the *argument* ('value') were to be declared (int).
          */
         double r = floor(255*pow((int)/*SAFE*/value/255.,gamma_val*.00001)+.5);
-         return (png_byte)r;
+         if (r >= 0 && r <= 255)
+             return (png_byte)/*SAFE*/r;
 #     else
         png_int_32 lg2 = png_log8bit(value);
         png_fixed_point res;

         if (png_muldiv(&res, gamma_val, lg2, PNG_FP_1) != 0)
-            return png_exp8bit(res);
-
-         /* Overflow. */
-         value = 0;
+            return png_exp8bit(png_ptr, res);
 #     endif
+
+      /* Overflow. */
+      handled("8-bit gamma overflow");
+      return 0;
   }

-   return (png_byte)value;
+   return png_check_byte(png_ptr, value);
+   PNG_UNUSED(png_ptr) /* Only used in non-release builds */
 }

 png_uint_16
-png_gamma_16bit_correct(unsigned int value, png_fixed_point gamma_val)
+png_gamma_16bit_correct(png_const_structrp png_ptr, png_uint_32 value,
+   png_fixed_point gamma_val)
 {
   if (value > 0 && value < 65535)
   {
@@ -3718,36 +3693,23 @@ png_gamma_16bit_correct(unsigned int value, png_fixed_point gamma_val)
          */
         double r = floor(65535.*pow((png_int_32)value/65535.,
                     gamma_val*.00001)+.5);
-         return (png_uint_16)r;
+         if (r >= 0 && r <= 65535)
+             return (png_uint_16)/*SAFE*/r;
 #     else
         png_int_32 lg2 = png_log16bit(value);
         png_fixed_point res;

         if (png_muldiv(&res, gamma_val, lg2, PNG_FP_1) != 0)
-            return png_exp16bit(res);
-
-         /* Overflow. */
-         value = 0;
+            return png_exp16bit(png_ptr, res);
 #     endif
+
+      /* Overflow. */
+      handled("16-bit gamma overflow");
+      return 0;
   }

-   return (png_uint_16)value;
-}
-
-/* This does the right thing based on the bit_depth field of the
- * png_struct, interpreting values as 8-bit or 16-bit.  While the result
- * is nominally a 16-bit value if bit depth is 8 then the result is
- * 8-bit (as are the arguments.)
- */
-png_uint_16 /* PRIVATE */
-png_gamma_correct(png_structrp png_ptr, unsigned int value,
-    png_fixed_point gamma_val)
-{
-   if (png_ptr->bit_depth == 8)
-      return png_gamma_8bit_correct(value, gamma_val);
-
-   else
-      return png_gamma_16bit_correct(value, gamma_val);
+   return png_check_u16(png_ptr, value);
+   PNG_UNUSED(png_ptr) /* Only used in non-release builds */
 }

 #define PNG_GAMMA_TABLE_8       0 /* 8-bit entries in png_byte */
@@ -3766,7 +3728,8 @@ typedef struct
 }  gamma_table_data;

 static unsigned int
-write_gamma_table_entry(const gamma_table_data *data, png_uint_32 i)
+write_gamma_table_entry(png_const_structrp png_ptr,
+   const gamma_table_data *data, png_uint_32 i)
   /* Calculate and write a single entry into table[i], the value of the entry
    * written is returned.
    */
@@ -3779,7 +3742,7 @@ write_gamma_table_entry(const gamma_table_data *data, png_uint_32 i)
    */
   if ((data->output == PNG_GAMMA_TABLE_8) != (data->adjust != 0))
   {
-      out = png_gamma_8bit_correct((unsigned int)in, data->gamma);
+      out = png_gamma_8bit_correct(png_ptr, in, data->gamma);

      if (data->adjust != 0)
         out *= 257U;
@@ -3787,24 +3750,25 @@ write_gamma_table_entry(const gamma_table_data *data, png_uint_32 i)

   else /* 16-bit correction */
   {
-      out = png_gamma_16bit_correct((unsigned int)in, data->gamma);
+      out = png_gamma_16bit_correct(png_ptr, in, data->gamma);

      if (data->adjust != 0)
         out = PNG_DIV257(out);
   }

+   PNG_UNUSEDRC(png_ptr)
   if (data->output == PNG_GAMMA_TABLE_8)
-      ((png_bytep)data->table)[i] = (png_byte)out;
+      png_upcast(png_bytep, data->table)[i] = png_check_byte(png_ptr, out);

   else
-      ((png_uint_16p)data->table)[i] = (png_uint_16)out;
+      png_upcast(png_uint_16p, data->table)[i] = png_check_u16(png_ptr, out);

   return out;
 }

 static void
-write_gamma_table(const gamma_table_data *data, png_uint_32 lo,
-   unsigned int loval, png_uint_32 hi, unsigned int hival)
+write_gamma_table(png_const_structrp png_ptr, const gamma_table_data *data,
+   png_uint_32 lo, unsigned int loval, png_uint_32 hi, unsigned int hival)
   /* Fill in gamma table entries between lo and hi, exclusive.  The entries at
    * table[lo] and table[hi] have already been written, the intervening entries
    * are written.
@@ -3817,33 +3781,33 @@ write_gamma_table(const gamma_table_data *data, png_uint_32 lo,
         /* All intervening entries must be the same. */
         if (data->output == PNG_GAMMA_TABLE_8)
         {
-            png_bytep table8 = ((png_bytep)data->table);
+            png_bytep table8 = png_voidcast(png_bytep, data->table);

            while (++lo < hi)
-               table8[lo] = (png_byte)loval;
+               table8[lo] = png_check_byte(png_ptr, loval);
         }

         else
         {
-            png_uint_16p table16 = ((png_uint_16p)data->table);
+            png_uint_16p table16 = png_voidcast(png_uint_16p, data->table);

            while (++lo < hi)
-               table16[lo] = (png_uint_16)loval;
+               table16[lo] = png_check_u16(png_ptr, loval);
         }
      }

      else
      {
         png_uint_32 mid = (lo+hi) >> 1;
-         unsigned int midval = write_gamma_table_entry(data, mid);
+         unsigned int midval = write_gamma_table_entry(png_ptr, data, mid);

         /* The algorithm used is to divide the entries to be written in half
          * and fill in the middle.  For all practical tables with significant
          * gamma this will result in a performance gain because the expensive
          * gamma correction arithmetic is avoided for some entries.
          */
-         write_gamma_table(data, lo, loval, mid, midval);
-         write_gamma_table(data, mid, midval, hi, hival);
+         write_gamma_table(png_ptr, data, lo, loval, mid, midval);
+         write_gamma_table(png_ptr, data, mid, midval, hi, hival);
      }
   }
 }
@@ -4039,7 +4003,7 @@ png_build_gamma_table(png_structrp png_ptr, png_fixed_point gamma_val,
   }

   if (png_gamma_significant(gamma_val) != 0)
-      write_gamma_table(&data, 0, 0, size-1, hival);
+      write_gamma_table(png_ptr, &data, 0, 0, size-1, hival);

   else /* gamma_val not significant */
   {
@@ -4050,28 +4014,29 @@ png_build_gamma_table(png_structrp png_ptr, png_fixed_point gamma_val,

         if (data.adjust)
            for (i=1; i<size-1; ++i)
-               table8[i] = (png_byte)PNG_DIV257((i * data.mult + data.add) >>
-                  data.shift);
+               table8[i] = png_check_byte(png_ptr,
+                  PNG_DIV257((i * data.mult + data.add) >> data.shift));

         else
            for (i=1; i<size-1; ++i)
-               table8[i] = (png_byte)((i * data.mult + data.add) >> data.shift);
+               table8[i] = png_check_byte(png_ptr,
+                  (i * data.mult + data.add) >> data.shift);
      }

      else
      {
         png_uint_32 i;
-         png_uint_16p table16 = ((png_uint_16p)data.table);
+         png_uint_16p table16 = (png_uint_16p)data.table;

         if (data.adjust)
            for (i=1; i<size-1; ++i)
-               table16[i] = (png_uint_16)(((i * data.mult + data.add) >>
-                  data.shift) * 257U);
+               table16[i] = png_check_u16(png_ptr,
+                  ((i * data.mult + data.add) >> data.shift) * 257U);

         else
            for (i=1; i<size-1; ++i)
-               table16[i] = (png_uint_16)((i * data.mult + data.add) >>
-                  data.shift);
+               table16[i] = png_check_u16(png_ptr,
+                  (i * data.mult + data.add) >> data.shift);
      }
   }

@@ -4181,8 +4146,9 @@ png_build_gamma_tables(png_structrp png_ptr, int bit_depth)
     else
        sig_bit = png_ptr->sig_bit.gray;

+     /* shift == insignificant bits */
     if (sig_bit > 0 && sig_bit < 16U)
-        shift = (png_byte)(16U - sig_bit); /* shift == insignificant bits */
+        shift = png_check_byte(png_ptr, 16U - sig_bit);

     else
        shift = 0; /* keep all 16 bits */
@@ -4243,7 +4209,7 @@ png_set_option(png_structrp png_ptr, int option, int onoff)
      int setting = (2 + (onoff != 0)) << option;
      int current = png_ptr->options;

-      png_ptr->options = (png_byte)((current & ~mask) | setting);
+      png_ptr->options = png_check_byte(png_ptr, (current & ~mask) | setting);

      return (current & mask) >> option;
   }
--- a/png.h
+++ b/png.h
@@ -1,7 +1,8 @@

 /* png.h - header file for PNG reference library
 *
- * libpng version 1.7.0beta48 - February 7, 2015
+ * libpng version 1.7.0beta59, April 19, 2015
+ *
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -11,7 +12,7 @@
 * Authors and maintainers:
 *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
 *   libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.7.0beta48 - February 7, 2015: Glenn
+ *   libpng versions 0.97, January 1998, through 1.7.0beta59, April 19, 2015: Glenn
 *   See also "Contributing Authors", below.
 *
 * Note about libpng version numbers:
@@ -166,9 +167,56 @@
 *    1.5.7beta01-05          15    10507  15.so.15.7[.0]
 *    1.5.7rc01-03            15    10507  15.so.15.7[.0]
 *    1.5.7                   15    10507  15.so.15.7[.0]
- *    1.6.0beta01-37          16    10600  16.so.16.0[.0]
+ *    1.6.0beta01-40          16    10600  16.so.16.0[.0]
+ *    1.6.0rc01-08            16    10600  16.so.16.0[.0]
+ *    1.6.0                   16    10600  16.so.16.0[.0]
+ *    1.6.1beta01-09          16    10601  16.so.16.1[.0]
+ *    1.6.1rc01               16    10601  16.so.16.1[.0]
+ *    1.6.1                   16    10601  16.so.16.1[.0]
+ *    1.6.2beta01             16    10602  16.so.16.2[.0]
+ *    1.6.2rc01-06            16    10602  16.so.16.2[.0]
+ *    1.6.2                   16    10602  16.so.16.2[.0]
+ *    1.6.3beta01-11          16    10603  16.so.16.3[.0]
+ *    1.6.3rc01               16    10603  16.so.16.3[.0]
+ *    1.6.3                   16    10603  16.so.16.3[.0]
+ *    1.6.4beta01-02          16    10604  16.so.16.4[.0]
+ *    1.6.4rc01               16    10604  16.so.16.4[.0]
+ *    1.6.4                   16    10604  16.so.16.4[.0]
+ *    1.6.5                   16    10605  16.so.16.5[.0]
+ *    1.6.6                   16    10606  16.so.16.6[.0]
+ *    1.6.7beta01-04          16    10607  16.so.16.7[.0]
+ *    1.6.7rc01-03            16    10607  16.so.16.7[.0]
+ *    1.6.7                   16    10607  16.so.16.7[.0]
+ *    1.6.8beta01-02          16    10608  16.so.16.8[.0]
+ *    1.6.8rc01-02            16    10608  16.so.16.8[.0]
+ *    1.6.8                   16    10608  16.so.16.8[.0]
+ *    1.6.9beta01-04          16    10609  16.so.16.9[.0]
+ *    1.6.9rc01-02            16    10609  16.so.16.9[.0]
+ *    1.6.9                   16    10609  16.so.16.9[.0]
+ *    1.6.10beta01-03         16    10610  16.so.16.10[.0]
+ *    1.6.10rc01-03           16    10610  16.so.16.10[.0]
+ *    1.6.10                  16    10610  16.so.16.10[.0]
+ *    1.6.11beta01-06         16    10611  16.so.16.11[.0]
+ *    1.6.11rc01-02           16    10611  16.so.16.11[.0]
+ *    1.6.11                  16    10611  16.so.16.11[.0]
+ *    1.6.12rc01-03           16    10612  16.so.16.12[.0]
+ *    1.6.12                  16    10612  16.so.16.12[.0]
+ *    1.6.13beta01-04         16    10613  16.so.16.13[.0]
+ *    1.6.13rc01-02           16    10613  16.so.16.13[.0]
+ *    1.6.13                  16    10613  16.so.16.13[.0]
+ *    1.6.14beta01-07         16    10614  16.so.16.14[.0]
+ *    1.6.14rc01-02           16    10614  16.so.16.14[.0]
+ *    1.6.14                  16    10614  16.so.16.14[.0]
+ *    1.6.15beta01-08         16    10615  16.so.16.15[.0]
+ *    1.6.15rc01-03           16    10615  16.so.16.15[.0]
+ *    1.6.15                  16    10615  16.so.16.15[.0]
+ *    1.6.16beta01-03         16    10616  16.so.16.16[.0]
+ *    1.6.16rc01-02           16    10616  16.so.16.16[.0]
+ *    1.6.16                  16    10616  16.so.16.16[.0]
+ *    1.6.17beta01-06         16    10617  16.so.16.17[.0]
+ *    1.6.17rc01              16    10617  16.so.16.17[.0]
 *    1.7.0alpha01-10         17    10700  17.so.17.0[.0]
- *    1.7.0beta01-48          17    10700  17.so.17.0[.0]
+ *    1.7.0beta01-59          17    10700  17.so.17.0[.0]
 *
 *   Henceforth the source version will match the shared-library major
 *   and minor numbers; the shared-library major version number will be
@@ -200,8 +248,8 @@
 *
 * This code is released under the libpng license.
 *
- * libpng versions 1.2.6, August 15, 2004, through 1.7.0beta48, February 7, 2015, are
- * Copyright (c) 2004, 2006-2013 Glenn Randers-Pehrson, and are
+ * libpng versions 1.2.6, August 15, 2004, through 1.7.0beta59, April 19, 2015, are
+ * Copyright (c) 2004, 2006-2015 Glenn Randers-Pehrson, and are
 * distributed according to the same disclaimer and license as libpng-1.2.5
 * with the following individual added to the list of Contributing Authors:
 *
@@ -312,13 +360,13 @@
 * Y2K compliance in libpng:
 * =========================
 *
- *    February 7, 2015
+ *    April 19, 2015
 *
 *    Since the PNG Development group is an ad-hoc body, we can't make
 *    an official declaration.
 *
 *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.7.0beta48 are Y2K compliant.  It is my belief that
+ *    upward through 1.7.0beta59 are Y2K compliant.  It is my belief that
 *    earlier versions were also Y2K compliant.
 *
 *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -380,9 +428,9 @@
 */

 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.7.0beta48"
+#define PNG_LIBPNG_VER_STRING "1.7.0beta59"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.7.0beta48 - February 7, 2015\n"
+     " libpng version 1.7.0beta59 - April 19, 2015\n"

 #define PNG_LIBPNG_VER_SONUM   17
 #define PNG_LIBPNG_VER_DLLNUM  17
@@ -396,7 +444,7 @@
 * PNG_LIBPNG_VER_STRING, omitting any leading zero:
 */

-#define PNG_LIBPNG_VER_BUILD  48
+#define PNG_LIBPNG_VER_BUILD  59

 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -509,9 +557,9 @@
 */
 #define PNG_u2(b1, b2) (((unsigned int)(b1) << 8) + (b2))

-#define PNG_U16(b1, b2) ((png_uint_16)PNG_u2(b1, b2))
+#define PNG_U16(b1, b2) ((png_uint_16)/*SAFE*/PNG_u2(b1, b2))
 #define PNG_U32(b1, b2, b3, b4)\
-   (((png_uint_32)PNG_u2(b1, b2) << 16) + PNG_u2(b3, b4))
+   (((png_uint_32)/*SAFE*/PNG_u2(b1, b2) << 16) + PNG_u2(b3, b4))

 /* ISO-PNG states that signed 32-bit values are stored in two's complement
 * format.  There is no guarantee that (png_int_32) is exactly 32 bits, so the
@@ -590,8 +638,10 @@
 * systems where (char) is more than 8 bits.
 */
 #define PNG_STRING_FROM_CHUNK(s,c)\
-   (void)(((char*)(s))[0]=(char)((c)>>24), ((char*)(s))[1]=(char)((c)>>16),\
-   ((char*)(s))[2]=(char)((c)>>8), ((char*)(s))[3]=(char)((c)))
+   (void)(((char*)(s))[0]=(char)(((c)>>24) & 0xff), \
+   ((char*)(s))[1]=(char)(((c)>>16) & 0xff),\
+   ((char*)(s))[2]=(char)(((c)>>8) & 0xff), \
+   ((char*)(s))[3]=(char)((c & 0xff)))

 /* Do the same but terminate with a null character. */
 #define PNG_CSTRING_FROM_CHUNK(s,c)\
@@ -647,7 +697,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
 * do not agree upon the version number.
 */
-typedef char* png_libpng_version_1_7_0beta48;
+typedef char* png_libpng_version_1_7_0beta59;

 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
 *
@@ -1658,11 +1708,13 @@ PNG_EXPORT(66, void, png_set_crc_action, (png_structrp png_ptr, int crit_action,
 * header file (zlib.h) for an explination of the compression functions.
 */

+#ifdef PNG_WRITE_SUPPORTED
 /* Set the filtering method(s) used by libpng.  Currently, the only valid
 * value for "method" is 0.
 */
 PNG_EXPORT(67, void, png_set_filter, (png_structrp png_ptr, int method,
    int filters));
+#endif /* WRITE */

 /* Filter values (not flags) - used in pngwrite.c, pngwutil.c for now.
 * These defines match the values in the PNG specification.
@@ -1694,6 +1746,7 @@ PNG_EXPORT(67, void, png_set_filter, (png_structrp png_ptr, int method,
 #define PNG_ALL_FILTERS    (PNG_FILTER_NONE | PNG_FILTER_SUB | PNG_FILTER_UP | \
   PNG_FILTER_AVG | PNG_FILTER_PAETH)

+#ifdef PNG_WRITE_SUPPORTED
 #ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED /* EXPERIMENTAL */
 /* The "heuristic_method" is given by one of the PNG_FILTER_HEURISTIC_
 * defines, either the default (minimum-sum-of-absolute-differences), or
@@ -1740,7 +1793,6 @@ PNG_FIXED_EXPORT(209, void, png_set_filter_heuristics_fixed,
 #define PNG_FILTER_HEURISTIC_WEIGHTED   2  /* Experimental feature */
 #define PNG_FILTER_HEURISTIC_LAST       3  /* Not a valid value */

-#ifdef PNG_WRITE_SUPPORTED
 /* Set the library compression level.  Currently, valid values range from
 * 0 - 9, corresponding directly to the zlib compression levels 0 - 9
 * (0 - no compression, 9 - "maximal" compression).  Note that tests have
@@ -1748,6 +1800,7 @@ PNG_FIXED_EXPORT(209, void, png_set_filter_heuristics_fixed,
 * for PNG images, and do considerably fewer caclulations.  In the future,
 * these values may not correspond directly to the zlib compression levels.
 */
+#ifdef PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED
 PNG_EXPORT(69, void, png_set_compression_level, (png_structrp png_ptr,
    int level));

@@ -1765,7 +1818,7 @@ PNG_EXPORT(72, void, png_set_compression_window_bits, (png_structrp png_ptr,

 PNG_EXPORT(73, void, png_set_compression_method, (png_structrp png_ptr,
    int method));
-#endif
+#endif /* WRITE_CUSTOMIZE_COMPRESSION */

 #ifdef PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED
 /* Also set zlib parameters for compressing non-IDAT chunks */
@@ -1787,6 +1840,7 @@ PNG_EXPORT(225, void, png_set_text_compression_window_bits,
 PNG_EXPORT(226, void, png_set_text_compression_method, (png_structrp png_ptr,
    int method));
 #endif /* WRITE_CUSTOMIZE_ZTXT_COMPRESSION */
+#endif /* WRITE */

 /* These next functions are called for input/output, memory, and error
 * handling.  They are in the file pngrio.c, pngwio.c, and pngerror.c,
@@ -1897,7 +1951,7 @@ PNG_EXPORT(218, png_byte, png_get_current_pass_number, (png_const_structrp));
 *
 * The integer return from the callback function is interpreted thus:
 *
- * negative: An error occured, png_chunk_error will be called.
+ * negative: An error occurred; png_chunk_error will be called.
 *     zero: The chunk was not handled, the default unknown handling is used
 *           (even if this was a chunk that would otherwise be known.)
 *           NOTE: prior to libpng 1.7 handling values of
--- a/pngconf.h
+++ b/pngconf.h
@@ -1,7 +1,7 @@

 /* pngconf.h - machine configurable file for libpng
 *
- * libpng version 1.7.0beta48 - February 7, 2015
+ * libpng version 1.7.0beta59, April 19, 2015
 *
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -11,9 +11,7 @@
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
 *
- */
-
-/* Any machine specific code is near the front of this file, so if you
+ * Any machine specific code is near the front of this file, so if you
 * are configuring libpng for a machine, you may want to read the section
 * starting here down to where it starts to typedef png_color, png_text,
 * and png_info.
--- a/pngdebug.h
+++ b/pngdebug.h
@@ -1,12 +1,11 @@

 /* pngdebug.h - Debugging macros for libpng, also used in pngtest.c
 *
+ * Last changed in libpng 1.6.8 [December 19, 2013]
 * Copyright (c) 1998-2013 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
- * Last changed in libpng 1.6.8 [December 19, 2013]
- *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
--- a/pngerror.c
+++ b/pngerror.c
@@ -17,6 +17,7 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_pngerror

 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

@@ -44,7 +45,7 @@ png_error,(png_const_structrp png_ptr, png_const_charp error_message),
   if (png_ptr != NULL)
   {
      if ((png_ptr->flags &
-         (PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT)) != 0
+         (PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT)) != 0)
      {
         if (*error_message == PNG_LITERAL_SHARP)
         {
@@ -129,6 +130,7 @@ png_safecat(png_charp buffer, size_t bufsize, size_t pos,
 * and end pointer (which should point just *beyond* the end of the buffer!)
 * Returns the pointer to the start of the formatted string.
 */
+#define PNG_HAVE_FORMAT_NUMBER /* for the code below */
 png_charp
 png_format_number(png_const_charp start, png_charp end, int format,
   png_alloc_size_t number)
@@ -452,7 +454,7 @@ png_format_buffer(png_const_structrp png_ptr, png_charp buffer, png_const_charp

      else
      {
-         buffer[iout++] = (char)c;
+         buffer[iout++] = png_check_char(png_ptr, c);
      }
   }

@@ -647,9 +649,9 @@ png_set_longjmp_fn(png_structrp png_ptr, png_longjmp_ptr longjmp_fn,
            /* This is an internal error in libpng: somehow we have been left
             * with a stack allocated jmp_buf when the application regained
             * control.  It's always possible to fix this up, but for the moment
-             * this is a png_error because that makes it easy to detect.
+             * this is an affirm because that makes it easy to detect.
             */
-            png_error(png_ptr, "Libpng jmp_buf still allocated");
+            impossible("Libpng jmp_buf still allocated");
            /* png_ptr->jmp_buf_ptr = &png_ptr->jmp_buf_local; */
         }
      }
@@ -970,4 +972,246 @@ png_safe_execute(png_imagep image_in, int (*function)(png_voidp), png_voidp arg)
   return result;
 }
 #endif /* SIMPLIFIED READ || SIMPLIFIED_WRITE */
+
+/* Asserts: minimal code in 'STABLE' builds to return control to the
+ * application, more verbose code followed by abort for all other builds to
+ * ensure that internal errors are detected.
+ *
+ * The code always produces a message if it is possible, regardless of the
+ * setting of PNG_ERROR_TEXT_SUPPORTED, except that in stable builds
+ * PNG_ERROR_TEXT_SUPPORTED is honoured.  See pngpriv.h for the calculation of
+ * the two control macros PNG_RELEASE_BUILD (don't abort; stable build or rc)
+ * and PNG_AFFIRM_TEXT (output text.)
+ */
+#if PNG_AFFIRM_TEXT
+#  ifdef PNG_HAVE_FORMAT_NUMBER
+static size_t
+png_affirm_number(png_charp buffer, size_t bufsize, size_t pos,
+   unsigned int number, int format)
+{
+   char numbuf[PNG_NUMBER_BUFFER_SIZE];
+   return png_safecat(buffer, bufsize, pos,
+      png_format_number(numbuf, numbuf + sizeof numbuf, format, number));
+}
+#  define affirm_number(a,b,c,d,e) png_affirm_number(a,b,c,d,e)
+#  else /* !HAVE_FORMAT_NUMBER */
+static size_t
+png_affirm_number(png_charp buffer, size_t bufsize, size_t pos,
+   unsigned int number)
+{
+   /* binhex it; highly non-portable, assumes the ASCII character set, but
+    * if warnings are turned off then it is unlikely the text will get read
+    * anyway.  This binhex variant is (48+val), where 'val' is the next 6
+    * bits of the number, so it starts as '0' (for 0) and ends at 'I' for
+    * 63.  The number is wrapped in {}, so 0 comes out as '{}' and 9 comes
+    * out as '{9}' and so on.
+    */
+   char numbuf[32];
+   int i = sizeof numbuf;
+
+   numbuf[--i] = 0;
+   numbuf[--i] = '}';
+
+   do
+   {
+      if (number > 0)
+         numbuf[--i] = (char)/*SAFE*/((number & 63) + 48), number >>= 6;
+      else
+      {
+         numbuf[--i] = '{';
+         break;
+      }
+   }
+   while (i > 0);
+
+   return png_safecat(buffer, bufsize, pos, numbuf+i);
+}
+#  define affirm_number(a,b,c,d,e) png_affirm_number(a,b,c,d)
+#endif /* !HAVE_FORMAT_NUMBER */
+
+static void
+affirm_text(png_charp buffer, size_t bufsize,
+   param_deb(png_const_charp condition) unsigned int position)
+{
+  /* Format the 'position' number and output:
+   *
+   *  "<file> <line>: affirm 'condition' failed\n"
+   *  " libpng version <version> - <date>\n"
+   *  " translated __DATE__ __TIME__"
+   *
+   * In the STABLE versions the output is the same for the last two lines
+   * but the first line becomes:
+   *
+   *  "<position>: affirm failed"
+   *
+   * If there is no number formatting the numbers just get replaced by
+   * some binhex (see the utility above).
+   */
+  size_t pos = 0;
+
+# if PNG_RELEASE_BUILD /* no 'condition' parameter: minimal text */
+     pos = affirm_number(buffer, bufsize, pos, position, PNG_NUMBER_FORMAT_x);
+     pos = png_safecat(buffer, bufsize, pos, ": affirm failed");
+# else /* !STABLE */
+     /* Break down 'position' into a file name and a line number: */
+     {
+#        define PNG_apply(f) { #f "\0", PNG_SRC_FILE_ ## f },
+#        define PNG_end      { "", PNG_SRC_FILE_LAST }
+         static struct {
+             char         filename[28]; /* GCC checks this size */
+             unsigned int base;
+         } fileinfo[] = { PNG_FILES };
+#        undef PNG_apply
+#        undef PNG_end
+
+         unsigned int i;
+         png_const_charp filename;
+
+         /* Do 'nfiles' this way to avoid problems with g++ where it whines
+          * about (size_t) being larger than (int), even though this is a
+          * compile time constant:
+          */
+#        define nfiles ((sizeof fileinfo)/(sizeof (fileinfo[0])))
+         for (i=0; i < nfiles && position > fileinfo[i].base; ++i) {}
+
+         if (i == 0 || i > nfiles)
+             filename = "UNKNOWN";
+         else
+         {
+             filename = fileinfo[i-1].filename;
+             position -= fileinfo[i-1].base;
+         }
+#        undef nfiles
+
+         pos = png_safecat(buffer, bufsize, pos, filename);
+         pos = png_safecat(buffer, bufsize, pos, ".c ");
+         pos = affirm_number(buffer, bufsize, pos, position,
+            PNG_NUMBER_FORMAT_u);
+     }
+
+     pos = png_safecat(buffer, bufsize, pos, ": affirm '");
+     pos = png_safecat(buffer, bufsize, pos, condition);
+     pos = png_safecat(buffer, bufsize, pos, "' failed\n");
+# endif /* !STABLE */
+
+  pos = png_safecat(buffer, bufsize, pos, PNG_HEADER_VERSION_STRING);
+  pos = png_safecat(buffer, bufsize, pos,
+     " translated " __DATE__ " " __TIME__);
+}
+
+#define affirm_text(b, c, p)\
+   do {\
+      (affirm_text)(b, sizeof b, param_deb(c) (p));\
+   } while (0)
+
+#endif /* AFFIRM_TEXT */
+
+PNG_FUNCTION(void, png_affirm,(png_const_structrp png_ptr,
+   param_deb(png_const_charp condition) unsigned int position), PNG_NORETURN)
+{
+#  if PNG_AFFIRM_TEXT
+      char   buffer[512];
+
+      affirm_text(buffer, condition, position);
+#  else /* !AFFIRM_TEXT */
+      PNG_UNUSED(position)
+#     if !PNG_RELEASE_BUILD
+         PNG_UNUSED(condition)
+#     endif
+#  endif /* AFFIRM_TEXT */
+
+   /* Now in STABLE do a png_error, but in other builds output the message
+    * (if possible) then abort (PNG_ABORT).
+    */
+#  if PNG_RELEASE_BUILD
+      png_error(png_ptr, buffer/*macro parameter used only if ERROR_TEXT*/);
+#  else /* !AFFIRM_ERROR */
+      /* Use console IO if possible; this is because there is no guarantee that
+       * the app 'warning' will output anything.  For certain the simplified
+       * API implementation just copies the message (truncated) to the image
+       * message buffer, which makes debugging much more difficult.
+       *
+       * Note that it is possible that neither WARNINGS nor CONSOLE_IO are
+       * supported; in that case no text will be output (and PNG_AFFIRM_TEXT
+       * will be false.)
+       */
+#     ifdef PNG_CONSOLE_IO_SUPPORTED
+         fprintf(stderr, "%s\n", buffer);
+         PNG_UNUSED(png_ptr)
+#     elif defined PNG_WARNINGS_SUPPORTED
+         if (png_ptr != NULL && png_ptr->warning_fn != NULL)
+            png_ptr->warning_fn(png_constcast(png_structrp, png_ptr), buffer);
+         /* else no way to output the text */
+#     else
+         PNG_UNUSED(png_ptr)
+#     endif
+
+      PNG_ABORT
+#  endif /* AFFIRM_ERROR */
+}
+
+#ifdef PNG_RANGE_CHECK_SUPPORTED
+/* The character/byte checking APIs. These do their own calls to png_affirm
+ * because the caller provides the position.
+ */
+char /* PRIVATE */
+png_char_affirm(png_const_structrp png_ptr, unsigned int position, int c)
+{
+   if (c >= CHAR_MIN && c <= CHAR_MAX)
+       return (char)/*SAFE*/c;
+
+   png_affirm(png_ptr, param_deb("(char) range") position);
+}
+
+png_byte /* PRIVATE */
+png_byte_affirm(png_const_structrp png_ptr, unsigned int position, int b)
+{
+   /* For the type png_byte the limits.h values are ignored and we check
+    * against the values PNG expects to store in a byte:
+    */
+   if (b >= 0 && b <= 255)
+       return (png_byte)/*SAFE*/b;
+
+   png_affirm(png_ptr, param_deb("PNG byte range") position);
+}
+
+#if INT_MAX >= 65535
+png_uint_16 /* PRIVATE */
+png_u16_affirm(png_const_structrp png_ptr, unsigned int position, int b)
+{
+   /* Check against the PNG 16-bit limit, as with png_byte. */
+   if (b >= 0 && b <= 65535)
+       return (png_uint_16)/*SAFE*/b;
+
+   png_affirm(png_ptr, param_deb("PNG 16-bit range") position);
+}
+#endif /* INT_MAX >= 65535 */
+
+void /* PRIVATE */
+png_handled_affirm(png_const_structrp png_ptr, png_const_charp message,
+   unsigned int position)
+{
+#  if PNG_RELEASE_BUILD
+      /* testing in RC: we want to return control to the caller, so do not
+       * use png_affirm.
+       */
+      char   buffer[512];
+
+      affirm_text(buffer, message, position);
+
+#     ifdef PNG_CONSOLE_IO_SUPPORTED
+         fprintf(stderr, "%s\n", buffer);
+#     elif defined PNG_WARNINGS_SUPPORTED
+         if (png_ptr != NULL && png_ptr->warning_fn != NULL)
+            png_ptr->warning_fn(png_constcast(png_structrp, png_ptr), buffer);
+         /* else no way to output the text */
+#     else
+         PNG_UNUSED(png_ptr)
+#     endif
+#  else
+      png_affirm(png_ptr, message, position);
+#  endif
+}
+
+#endif /* RANGE_CHECK */
 #endif /* READ || WRITE */
--- a/pngget.c
+++ b/pngget.c
@@ -13,6 +13,7 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_pngget

 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

@@ -365,14 +366,25 @@ png_get_y_pixels_per_inch(png_const_structrp png_ptr, png_const_inforp info_ptr)

 #ifdef PNG_FIXED_POINT_SUPPORTED
 static png_fixed_point
-png_fixed_inches_from_microns(png_const_structrp png_ptr, png_int_32 microns)
+png_fixed_inches_from_microns(png_const_structrp png_ptr,
+   png_int_32 microns)
 {
   /* Convert from metres * 1,000,000 to inches * 100,000, meters to
    * inches is simply *(100/2.54), so we want *(10/2.54) == 500/127.
    * Notice that this can overflow - a warning is output and 0 is
    * returned.
    */
-   return png_muldiv_warn(png_ptr, microns, 500, 127);
+   png_fixed_point result;
+
+   if (png_muldiv(&result, microns, 500, 127) != 0)
+      return result;
+
+   /* TODO: review this, png_error might be better. */
+   png_warning(png_ptr, "inch to microns overflow");
+   return 0;
+#  ifndef PNG_WARNINGS_SUPPORTED
+      PNG_UNUSED(png_ptr)
+#  endif
 }

 png_fixed_point PNGAPI
@@ -382,9 +394,7 @@ png_get_x_offset_inches_fixed(png_const_structrp png_ptr,
   return png_fixed_inches_from_microns(png_ptr,
       png_get_x_offset_microns(png_ptr, info_ptr));
 }
-#endif

-#ifdef PNG_FIXED_POINT_SUPPORTED
 png_fixed_point PNGAPI
 png_get_y_offset_inches_fixed(png_const_structrp png_ptr,
    png_const_inforp info_ptr)
@@ -392,7 +402,7 @@ png_get_y_offset_inches_fixed(png_const_structrp png_ptr,
   return png_fixed_inches_from_microns(png_ptr,
       png_get_y_offset_microns(png_ptr, info_ptr));
 }
-#endif
+#endif /* FIXED_POINT */

 #ifdef PNG_FLOATING_POINT_SUPPORTED
 float PNGAPI
@@ -1116,7 +1126,7 @@ png_get_unknown_chunks(png_const_structrp png_ptr, png_inforp info_ptr,
      return info_ptr->unknown_chunks_num;
   }

-   return (0);
+   return 0;
 }
 #endif

@@ -1124,7 +1134,9 @@ png_get_unknown_chunks(png_const_structrp png_ptr, png_inforp info_ptr,
 png_byte PNGAPI
 png_get_rgb_to_gray_status (png_const_structrp png_ptr)
 {
-   return (png_byte)(png_ptr ? png_ptr->rgb_to_gray_status : 0);
+   if (png_ptr)
+      return png_ptr->rgb_to_gray_status;
+   return 0;
 }
 #endif

@@ -1132,7 +1144,9 @@ png_get_rgb_to_gray_status (png_const_structrp png_ptr)
 png_voidp PNGAPI
 png_get_user_chunk_ptr(png_const_structrp png_ptr)
 {
-   return (png_ptr ? png_ptr->user_chunk_ptr : NULL);
+   if (png_ptr)
+      return png_ptr->user_chunk_ptr;
+   return NULL;
 }
 #endif

--- a/pnginfo.h
+++ b/pnginfo.h
@@ -1,12 +1,11 @@

 /* pnginfo.h - header file for PNG reference library
 *
+ * Last changed in libpng 1.6.1 [March 28, 2013]
 * Copyright (c) 1998-2013 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
- * Last changed in libpng 1.6.1 [March 28, 2013]
- *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
--- a/pngmem.c
+++ b/pngmem.c
@@ -18,6 +18,7 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_pngmem

 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
 /* Free a png_struct */
@@ -41,7 +42,7 @@ png_destroy_png_struct(png_structrp png_ptr)
 }

 /* Allocate memory.  For reasonable files, size should never exceed
- * 64K.  However, zlib may allocate more then 64K if you don't tell
+ * 64K.  However, zlib may allocate more than 64K if you don't tell
 * it not to.  See zconf.h and png.h for more information.  zlib does
 * need to allocate exactly 64K, so whatever you call here must
 * have the ability to do that.
@@ -77,6 +78,9 @@ png_malloc_base,(png_const_structrp png_ptr, png_alloc_size_t size),
   PNG_UNUSED(png_ptr)
 #endif

+   /* Some compilers complain that this is always true.  However, it
+    * can be false when integer overflow happens.
+    */
   if (size > 0 && size <= PNG_SIZE_MAX
 #     ifdef PNG_MAX_MALLOC_64K
         && size <= 65536U
@@ -119,9 +123,7 @@ PNG_FUNCTION(png_voidp /* PRIVATE */,
 png_malloc_array,(png_const_structrp png_ptr, int nelements,
   size_t element_size),PNG_ALLOCATED)
 {
-   if (nelements <= 0 || element_size == 0)
-      png_error(png_ptr, "internal error: array alloc");
-
+   affirm(nelements > 0 && element_size > 0);
   return png_malloc_array_checked(png_ptr, nelements, element_size);
 }

@@ -130,9 +132,8 @@ png_realloc_array,(png_structrp png_ptr, png_const_voidp old_array,
   int old_elements, int add_elements, size_t element_size),PNG_ALLOCATED)
 {
   /* These are internal errors: */
-   if (add_elements <= 0 || element_size == 0 || old_elements < 0 ||
-      (old_array == NULL && old_elements > 0))
-      png_error(png_ptr, "internal error: array realloc");
+   affirm(add_elements > 0 && element_size > 0 && old_elements >= 0 &&
+      (old_array != NULL || old_elements == 0));

   /* Check for overflow on the elements count (so the caller does not have to
    * check.)
--- a/pngpread.c
+++ b/pngpread.c
@@ -12,6 +12,7 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_pngpread

 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED

@@ -158,17 +159,16 @@ png_process_some_data(png_structrp png_ptr, png_inforp info_ptr)
 void /* PRIVATE */
 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr)
 {
-   png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ 
-             num_to_check = 8 - num_checked;
+   unsigned int num_checked = png_ptr->sig_bytes;
+   unsigned int num_to_check = 8 - num_checked;

   if (png_ptr->buffer_size < num_to_check)
-   {
-      num_to_check = png_ptr->buffer_size;
-   }
+      num_to_check = (int)/*SAFE*/png_ptr->buffer_size;

   png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]),
       num_to_check);
-   png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check);
+   png_ptr->sig_bytes = png_check_byte(png_ptr,
+       png_ptr->sig_bytes + num_to_check);

   if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))
   {
@@ -584,13 +584,11 @@ png_push_save_buffer(png_structrp png_ptr)
      if (png_ptr->save_buffer == NULL)
      {
         png_free(png_ptr, old_buffer);
-         old_buffer = NULL;
         png_error(png_ptr, "Insufficient memory for save_buffer");
      }

      memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
      png_free(png_ptr, old_buffer);
-      old_buffer = NULL;
      png_ptr->save_buffer_max = new_max;
   }
   if (png_ptr->current_buffer_size)
@@ -711,8 +709,7 @@ png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer,
   png_size_t buffer_length)
 {
   /* The caller checks for a non-zero buffer length. */
-   if (!(buffer_length > 0) || buffer == NULL)
-      png_error(png_ptr, "No IDAT data (internal error)");
+   affirm(buffer_length > 0 && buffer != NULL);

   /* This routine must process all the data it has been given
    * before returning, calling the row callback as required to
--- a/pngpriv.h
+++ b/pngpriv.h
@@ -1,13 +1,11 @@

 /* pngpriv.h - private declarations for use inside libpng
 *
- * For conditions of distribution and use, see copyright notice in png.h
+ * Last changed in libpng 1.7.0 [(PENDING RELEASE)]
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
- * Last changed in libpng 1.7.0 [(PENDING RELEASE)]
- *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
@@ -334,15 +332,212 @@
 #  define PNG_DLL_EXPORT
 #endif

-/* asserts are turned off in release code, but are in even in release candidates
- * because often system builders only check future libpng releases when a
- * release candidate is available.
+/* This is a global switch to set the compilation for an installed system
+ * (a release build).  It can be set for testing debug builds to ensure that
+ * they will compile when the build type is switched to RC or STABLE, the
+ * default is just to use PNG_LIBPNG_BUILD_BASE_TYPE.  Set this in CPPFLAGS
+ * with either:
+ *
+ *   -DPNG_RELEASE_BUILD Turns on the release compile path
+ *   -DPNG_RELEASE_BUILD=0 Turns it off
+ * or in your pngusr.h with
+ *   #define PNG_RELEASE_BUILD=1 Turns on the release compile path
+ *   #define PNG_RELEASE_BUILD=0 Turns it off
 */
-#if PNG_LIBPNG_BUILD_BASE_TYPE == PNG_LIBPNG_BUILD_STABLE
-#  define NDEBUG
+#ifndef PNG_RELEASE_BUILD
+#  define PNG_RELEASE_BUILD (PNG_LIBPNG_BUILD_BASE_TYPE >= PNG_LIBPNG_BUILD_RC)
 #endif
-#ifndef PNG_VERSION_INFO_ONLY
-#  include <assert.h>
+
+/* General purpose macros avoid the need to put #if PNG_RELEASE_BUILD
+ * macro blocks around function declarations and definitions when the
+ * parameter number varies.  Using these results in slightly cleaner code.
+ */
+#if PNG_RELEASE_BUILD
+#  define only_rel(text) text
+#  define only_deb(text)
+#  define param_rel(param) param,
+#  define param_deb(param)
+#else
+#  define only_rel(text)
+#  define only_deb(text) text
+#  define param_rel(param)
+#  define param_deb(param) param,
+#endif
+
+/* The affirm mechanism results in a minimal png_error in released versions
+ * ('STABLE' versions) and a more descriptive abort in all other cases.
+ * The macros rely on the naming convention throughout this code - png_ptr
+ * exists and is of type png_const_structrp or a compatible type - and the
+ * presence in each file of a uniquely defined macro PNG_SRC_FILE; a number
+ * indicating which file this is (this is to save space in released versions).
+ *
+ * 'affirm' is intended to look like the ANSI-C <assert.h> macro; note that
+ * this macro can coexist with the assert macro if <assert.h> is
+ * included.
+ *
+ * PNG_SRC_LINE is the position of the affirm macro.  There are currently 15
+ * main source files (4 bits) and the biggest (pngrtran.c) has more than 4095
+ * lines (12 bits).  However, to ensure the number will fit into 16-bits in the
+ * future and to allow hardware files to use affirm, the encoding is a bit-wise
+ * encoding based on the current number of lines.
+ *
+ * The following works out the value for two numeric #defines:
+ *
+ *  PNG_RELEASE_BUILD: Set to 1 if affirm should png_error (or png_err) rather
+ *                     than abort.  The png_error text is the minimal (file
+ *                     location) text in this case, if it is produced.  This
+ *                     flag indicates a STABLE (or RC) build.
+ *  PNG_AFFIRM_TEXT:   Set to 1 if affirm text should be produced, either the
+ *                     minimal text or, if PNG_RELEASE_BUILD is 0, the more
+ *                     verbose text including the 'condition' string.  This
+ *                     value depends on whether the build supports an
+ *                     appropriate way of outputting the message.
+ *
+ * Note that these are not configurable: this is just the affirm code; there's
+ * no reason to allow configuration of these options.
+ *
+ * 'debug' is a version of 'affirm' that is completely removed from RELEASE
+ * builds.  This is used when either an unexpected condition is completely
+ * handled or when it can't be handled even by png_error, for example after a
+ * memory overwrite.
+ *
+ * UNTESTED is used to mark code that has not been tested; it causes an assert
+ * if the code is executed and (therefore) tested.  UNTESTED should not remain
+ * in release candidate code.
+ */
+#define PNG_AFFIRM_TEXT (PNG_RELEASE_BUILD ?\
+         (defined PNG_ERROR_TEXT_SUPPORTED) :\
+         (defined PNG_WARNINGS_SUPPORTED) || (defined PNG_CONSOLE_IO_SUPPORTED))
+
+#define PNG_SRC_LINE (PNG_SRC_FILE + __LINE__)
+
+/* png_affirmpp and png_impossiblepp are macros to make the correct call to the
+ * png_affirm function; these macros do not assume that the png_structp is
+ * called png_ptr.
+ */
+#if PNG_RELEASE_BUILD
+#  define png_affirmpp(pp, cond)\
+      do\
+         if (!(cond)) png_affirm(pp, PNG_SRC_LINE);\
+      while (0)
+#  define png_impossiblepp(pp, reason) png_affirm(pp, PNG_SRC_LINE)
+
+#  define debug(cond) do {} while (0)
+#  if PNG_LIBPNG_BUILD_BASE_TYPE >= PNG_LIBPNG_BUILD_RC
+     /* Make sure there are no 'UNTESTED' macros in released code: */
+#    define UNTESTED libpng untested code
+#  endif
+#else
+#  define png_affirmpp(pp, cond)\
+      do\
+         if (!(cond)) png_affirm(pp, #cond, PNG_SRC_LINE);\
+      while (0)
+#  define png_impossiblepp(pp, reason) png_affirm(pp, reason, PNG_SRC_LINE)
+
+#  define debug(cond) png_affirmpp(png_ptr, cond)
+#  define UNTESTED png_affirm(png_ptr, "untested code", PNG_SRC_LINE);
+#endif
+
+#define affirm(cond) png_affirmpp(png_ptr, cond)
+#define impossible(cond) png_impossiblepp(png_ptr, cond)
+
+/* The defines for PNG_SRC_FILE: */
+#define PNG_SRC_FILE_(f,lines) PNG_SRC_FILE_ ## f + lines
+
+#define PNG_SRC_FILE_png      0
+#define PNG_SRC_FILE_pngerror (PNG_SRC_FILE_png      +8192)
+#define PNG_SRC_FILE_pngget   (PNG_SRC_FILE_pngerror +2048)
+#define PNG_SRC_FILE_pngmem   (PNG_SRC_FILE_pngget   +2048)
+#define PNG_SRC_FILE_pngpread (PNG_SRC_FILE_pngmem   +1024)
+#define PNG_SRC_FILE_pngread  (PNG_SRC_FILE_pngpread +2048)
+#define PNG_SRC_FILE_pngrio   (PNG_SRC_FILE_pngread  +8192)
+#define PNG_SRC_FILE_pngrtran (PNG_SRC_FILE_pngrio   +1024)
+#define PNG_SRC_FILE_pngrutil (PNG_SRC_FILE_pngrtran +8192)
+#define PNG_SRC_FILE_pngset   (PNG_SRC_FILE_pngrutil +8192)
+#define PNG_SRC_FILE_pngtrans (PNG_SRC_FILE_pngset   +2048)
+#define PNG_SRC_FILE_pngwio   (PNG_SRC_FILE_pngtrans +2048)
+#define PNG_SRC_FILE_pngwrite (PNG_SRC_FILE_pngwio   +1024)
+#define PNG_SRC_FILE_pngwtran (PNG_SRC_FILE_pngwrite +4096)
+#define PNG_SRC_FILE_pngwutil (PNG_SRC_FILE_pngwtran +1024)
+
+#define PNG_SRC_FILE_arm_arm_init (PNG_SRC_FILE_pngwutil +4096)
+#define PNG_SRC_FILE_arm_filter_neon_intrinsics\
+             (PNG_SRC_FILE_arm_arm_init +1024)
+
+/* Add new files by changing the following line: */
+#define PNG_SRC_FILE_LAST (PNG_SRC_FILE_arm_filter_neon_intrinsics +1024)
+
+/* The following #define must list the files in exactly the same order as
+ * the above.
+ */
+#define PNG_FILES\
+   PNG_apply(png)\
+   PNG_apply(pngerror)\
+   PNG_apply(pngget)\
+   PNG_apply(pngmem)\
+   PNG_apply(pngpread)\
+   PNG_apply(pngread)\
+   PNG_apply(pngrio)\
+   PNG_apply(pngrtran)\
+   PNG_apply(pngrutil)\
+   PNG_apply(pngset)\
+   PNG_apply(pngtrans)\
+   PNG_apply(pngwio)\
+   PNG_apply(pngwrite)\
+   PNG_apply(pngwtran)\
+   PNG_apply(pngwutil)\
+   PNG_apply(arm_arm_init)\
+   PNG_apply(arm_filter_neon_intrinsics)\
+   PNG_end
+
+/* GCC complains about assignments of an (int) expression to a (char) even when
+ * it can readily determine that the value is in range.  This makes arithmetic
+ * on (char) or (png_byte) values tedious.  The warning is not issued by
+ * default, but libpng coding rules require no warnings leading to excessive,
+ * ridiculous and dangerous expressions of the form:
+ *
+ *     <char> = (char)(expression & 0xff)
+ *
+ * They are dangerous because they hide the warning, which might actually be
+ * valid, and therefore merely enable introduction of undetected overflows when
+ * code is modified.
+ *
+ * The following macros exist to reliably detect any overflow in non-release
+ * builds.  The theory here is that we really want to know about overflows, not
+ * merely hide a basically flawed compiler warning by throwing unnecessary casts
+ * into the code.  The warnings disappear in RC builds so that the released
+ * (STABLE) version just assigns the value (with, possibly, a warning if someone
+ * turns on the -Wconversion GCC warning.)
+ *
+ * Doing it this way ensures that the code meets two very important aims:
+ *
+ * 1) Overflows are detected in pre-release tests; previously versions of libpng
+ *    have been released that really did have overflows in the RGB calculations.
+ * 2) In release builds GCC specific operations, which may reduce the ability
+ *    of other compilers and even GCC to optimize the code, are avoided.
+ *
+ * There is one important extra consequence for pre-release code; it is
+ * performing a lot of checks in pixel arithmetic that the release code won't
+ * perform.  As a consequence a build time option, RANGE_CHECK, is provided
+ * to allow the checks to be turned off in pre-release when building for
+ * performance testing.  This is a standard "_SUPPORTED" option except that it
+ * cannot be set in the system configuration (pnglibconf.h, pnglibconf.dfa).
+ *
+ * A separate macro PNG_BYTE() is provided to safely convert an unsigned value
+ * to the PNG byte range 0..255.  This handles the fact that, technically,
+ * an ANSI-C (unsigned char), hence a (png_byte), may be able to store values
+ * outside this range.  Note that if you are building on a system where this is
+ * true libpng is almost certainly going to produce errors; it has never been
+ * tested on such a system.  For the moment pngconf.h ensures that this will
+ * not happen.
+ *
+ * PNG_UINT_16 does the same thing for a 16-bit value passed in an (int) or
+ * (png_uint_32) (where checking is not expected.)
+ */
+#if !PNG_RELEASE_BUILD
+#  ifndef PNG_NO_RANGE_CHECK /* Turn off even in pre-release */
+#     define PNG_RANGE_CHECK_SUPPORTED
+#  endif
 #endif

 /* SECURITY and SAFETY:
@@ -377,6 +572,11 @@
 #  define PNG_UNUSED(param) (void)param;
 #endif

+/* This is a convenience for parameters which are not used in release
+ * builds.
+ */
+#define PNG_UNUSEDRC(param) only_rel(PNG_UNUSED(param))
+
 /* Just a little check that someone hasn't tried to define something
 * contradictory.
 */
@@ -409,6 +609,7 @@
 */
 #ifdef __cplusplus
 #  define png_voidcast(type, value) static_cast<type>(value)
+#  define png_upcast(type, value) static_cast<type>(value)
 #  define png_constcast(type, value) const_cast<type>(value)
 #  define png_aligncast(type, value) \
   static_cast<type>(static_cast<void*>(value))
@@ -416,6 +617,7 @@
   static_cast<type>(static_cast<const void*>(value))
 #else
 #  define png_voidcast(type, value) (value)
+#  define png_upcast(type, value) ((type)(value))
 #  define png_constcast(type, value) ((type)(value))
 #  define png_aligncast(type, value) ((void*)(value))
 #  define png_aligncastconst(type, value) ((const void*)(value))
@@ -597,8 +799,9 @@
 #if defined(PNG_SIMPLIFIED_READ_SUPPORTED) ||\
   defined(PNG_SIMPLIFIED_WRITE_SUPPORTED)
 /* See below for the definitions of the tables used in these macros */
-#define PNG_sRGB_FROM_LINEAR(linear) ((png_byte)((png_sRGB_base[(linear)>>15] +\
-   ((((linear)&0x7fff)*png_sRGB_delta[(linear)>>15])>>12)) >> 8))
+#define PNG_sRGB_FROM_LINEAR(pp, linear) png_check_byte(pp,\
+   (png_sRGB_base[(linear)>>15] +\
+    ((((linear)&0x7fff)*png_sRGB_delta[(linear)>>15])>>12)) >> 8)
   /* Given a value 'linear' in the range 0..255*65535 calculate the 8-bit sRGB
    * encoded value with maximum error 0.646365.  Note that the input is not a
    * 16-bit value; it has been multiplied by 255! */
@@ -724,11 +927,124 @@ PNG_INTERNAL_DATA(const png_byte, png_sRGB_delta, [512]);
 extern "C" {
 #endif /* __cplusplus */

+#if defined (PNG_READ_TRANSFORMS_SUPPORTED) ||\
+    defined (PNG_WRITE_TRANSFORMS_SUPPORTED)
+/* Transform support.  Prior to 1.7.0 the internal transform routines (not the
+ * APIs) took a png_row_infop, like the user transform function, but without
+ * the png_ptr because it was never used.  In 1.7.0 a separate internal
+ * structure is used in place of this to allow both future development to
+ * change the structure.
+ *
+ * The values in this structure will normally be changed by transformation
+ * implementations.
+ */
+typedef struct
+{
+   png_const_structrp png_ptr;   /* png_struct for error handling and some
+                                  * transform parameters.
+                                  */
+   png_uint_32        width;     /* width of row */
+   unsigned int       channels;  /* number of channels (1, 2, 3, or 4) */
+   unsigned int       bit_depth; /* bit depth of row */
+   unsigned int       flags;     /* As below */
+#  define PNG_INDEXED          1 /* Indexed/palette PNG */
+#  define PNG_RGB_SWAPPED      2 /* as in the PNG_BGR transformation */
+#  define PNG_FILLER_IN_ALPHA  4 /* 'alpha' channel is really just a filler */
+#  define PNG_ALPHA_SWAPPED    8 /* Alpha is in the first channel */
+#  define PNG_ALPHA_INVERTED  16 /* Alpha values inverted */
+#  define PNG_INVERTED        32 /* grayscale channel inverted */
+#  define PNG_BITS_SHIFTED    64 /* Channels not in range 1..(bit_depth-1) */
+#  define PNG_BYTE_SWAPPED   128 /* 'swab', i.e. pairs of bytes swapped */
+#  define PNG_PIXEL_SWAPPED  256 /* pixels swapped within bytes */
+#  define PNG_BAD_INDEX      512 /* Bad palette image index */
+} png_transform_control, *png_transform_controlp;
+
+/* Validation: channels and bit_depth can be set to anything required by
+ * the transform, but the result may not be encodable in PNG.  PNG_USURPED
+ * must be set in this case.  This macro detects the detectably unrepresentable
+ * case channels case.
+ *
+ * Channels: must be 1 when PNG_INDEXED is set, must be 1-4 otherwise, so:
+ *
+ *    (channels-1) <= (((flags & PNG_INDEXED)-1) & 3)
+ */
+#define PNG_VALID_CHANNELS(ri)\
+   (((ri)->channels-1) <= ((((ri)->flags & PNG_INDEXED)-1) & 3))
+
+typedef const png_transform_control *png_const_transform_controlp;
+typedef const png_row_info *png_const_row_infop;
+#endif /* TRANSFORMS */
+
 /* Internal functions; these are not exported from a DLL however because they
 * are used within several of the C source files they have to be C extern.
 *
 * All of these functions must be declared with PNG_INTERNAL_FUNCTION.
 */
+/* Affirm handling */
+PNG_INTERNAL_FUNCTION(void, png_affirm,(png_const_structrp png_ptr,
+    param_deb(png_const_charp condition) unsigned int position), PNG_NORETURN);
+
+/* Character/byte range checking. */
+#ifdef PNG_RANGE_CHECK_SUPPORTED
+PNG_INTERNAL_FUNCTION(char, png_char_affirm,(png_const_structrp png_ptr,
+      unsigned int position, int c), PNG_EMPTY);
+
+PNG_INTERNAL_FUNCTION(png_byte, png_byte_affirm,(png_const_structrp png_ptr,
+      unsigned int position, int b), PNG_EMPTY);
+
+PNG_INTERNAL_FUNCTION(void, png_handled_affirm,(png_const_structrp png_ptr,
+      png_const_charp message, unsigned int position), PNG_EMPTY);
+   /* This is not marked PNG_NORETURN because in PNG_RELEASE_BUILD it will
+    * disappear and control will pass through it.
+    */
+
+#if INT_MAX >= 65535
+PNG_INTERNAL_FUNCTION(png_uint_16, png_u16_affirm,(png_const_structrp png_ptr,
+      unsigned int position, int u), PNG_EMPTY);
+#  define png_check_u16(pp, u) (png_u16_affirm((pp), PNG_SRC_LINE, (u)))
+#else
+   /* (int) cannot hold a (png_uint_16) so the above function just won't
+    * compile correctly, for the moment just do this:
+    */
+#  define png_check_u16(pp, u) (u)
+#endif
+
+#  define png_check_char(pp, c) (png_char_affirm((pp), PNG_SRC_LINE, (c)))
+#  define png_check_byte(pp, b) (png_byte_affirm((pp), PNG_SRC_LINE, (b)))
+#  define PNG_BYTE(b)           ((png_byte)((b) & 0xff))
+#  define PNG_UINT_16(u)        ((png_uint_16)((u) & 0xffff))
+#  define png_handled(pp, m)    (png_handled_affirm((pp), (m), PNG_SRC_LINE))
+#elif !(defined PNG_REMOVE_CASTS)
+#  define png_check_char(pp, c) ((char)(c))
+#  define png_check_byte(pp, b) ((png_byte)(b))
+#  define png_check_u16(pp, u)  ((png_uint_16)(u))
+#  define png_handled(pp, m)    ((void)0)
+#  define PNG_BYTE(b)           ((png_byte)((b) & 0xff))
+#  define PNG_UINT_16(u)        ((png_uint_16)((u) & 0xffff))
+#else
+   /* This is somewhat trust-me-it-works: if PNG_REMOVE_CASTS is defined then
+    * the casts, which might otherwise change the values, are completely
+    * removed.  Use this to test your compiler to see if it makes *any*
+    * difference (code size or speed.)  Currently NOT SUPPORTED.
+    *
+    * It also makes the PNG_BYTE and PNG_UINT_16 macros do nothing either
+    * NOTE: this seems safe at present but might lead to unexpected results
+    * if someone writes code to depend on the truncation.
+    */
+#  define png_check_char(pp, c) (c)
+#  define png_check_byte(pp, b) (b)
+#  define png_check_u16(pp, u)  (u)
+#  define png_handled(pp, m)    ((void)0)
+#  define PNG_BYTE(b)           (b)
+#  define PNG_UINT_16(b)        (u)
+#endif
+
+/* Utility macro to mark a handled error condition ; when control reaches this
+ * there has been an arithmetic overflow but it is being handled.  Use the
+ * png_check_ macros above where control should leave the code for
+ * safety/security reasons.
+ */
+#define handled(m) png_handled(png_ptr, (m))

 /* Zlib support */
 #define PNG_UNEXPECTED_ZLIB_RETURN (-7)
@@ -1114,30 +1430,30 @@ PNG_INTERNAL_FUNCTION(void,png_read_transform_info,(png_structrp png_ptr,
 /* Shared transform functions, defined in pngtran.c */
 #if defined(PNG_WRITE_FILLER_SUPPORTED) || \
    defined(PNG_READ_STRIP_ALPHA_SUPPORTED)
-PNG_INTERNAL_FUNCTION(void,png_do_strip_channel,(png_row_infop row_info,
-    png_bytep row, int at_start),PNG_EMPTY);
+PNG_INTERNAL_FUNCTION(void,png_do_strip_channel,(
+    png_transform_controlp row_info, png_bytep row, int at_start),PNG_EMPTY);
 #endif

 #ifdef PNG_16BIT_SUPPORTED
 #if defined(PNG_READ_SWAP_SUPPORTED) || defined(PNG_WRITE_SWAP_SUPPORTED)
-PNG_INTERNAL_FUNCTION(void,png_do_swap,(png_row_infop row_info,
+PNG_INTERNAL_FUNCTION(void,png_do_swap,(png_transform_controlp row_info,
    png_bytep row),PNG_EMPTY);
 #endif
 #endif

 #if defined(PNG_READ_PACKSWAP_SUPPORTED) || \
    defined(PNG_WRITE_PACKSWAP_SUPPORTED)
-PNG_INTERNAL_FUNCTION(void,png_do_packswap,(png_row_infop row_info,
+PNG_INTERNAL_FUNCTION(void,png_do_packswap,(png_transform_controlp row_info,
    png_bytep row),PNG_EMPTY);
 #endif

 #if defined(PNG_READ_INVERT_SUPPORTED) || defined(PNG_WRITE_INVERT_SUPPORTED)
-PNG_INTERNAL_FUNCTION(void,png_do_invert,(png_row_infop row_info,
+PNG_INTERNAL_FUNCTION(void,png_do_invert,(png_transform_controlp row_info,
    png_bytep row),PNG_EMPTY);
 #endif

 #if defined(PNG_READ_BGR_SUPPORTED) || defined(PNG_WRITE_BGR_SUPPORTED)
-PNG_INTERNAL_FUNCTION(void,png_do_bgr,(png_row_infop row_info,
+PNG_INTERNAL_FUNCTION(void,png_do_bgr,(png_transform_controlp row_info,
    png_bytep row),PNG_EMPTY);
 #endif

@@ -1259,6 +1575,24 @@ PNG_INTERNAL_FUNCTION(int,png_chunk_unknown_handling,
 #endif /* READ_UNKNOWN_CHUNKS || HANDLE_AS_UNKNOWN */

 /* Handle the transformations for reading and writing */
+#if defined(PNG_READ_TRANSFORMS_SUPPORTED) ||\
+    defined(PNG_WRITE_TRANSFORMS_SUPPORTED)
+/* Utility functions: */
+PNG_INTERNAL_FUNCTION(void,png_init_transform_control,(
+   png_const_structrp png_ptr, png_transform_controlp out,
+   png_const_row_infop in),
+   PNG_EMPTY);
+
+/* This function exists to ensure that overflow cannot happen even if there
+ * are bugs in the transforms or calculation of maximum_pixel_depth.
+ */
+PNG_INTERNAL_FUNCTION(size_t,png_transform_rowbytes,(
+   png_const_transform_controlp row_info),PNG_EMPTY);
+
+PNG_INTERNAL_FUNCTION(void,png_end_transform_control,(png_row_infop out,
+   png_const_transform_controlp in), PNG_EMPTY);
+#endif /* TRANSFORMS */
+
 #ifdef PNG_READ_TRANSFORMS_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_do_read_transformations,(png_structrp png_ptr,
   png_row_infop row_info),PNG_EMPTY);
@@ -1418,7 +1752,7 @@ PNG_INTERNAL_FUNCTION(void,png_check_IHDR,(png_const_structrp png_ptr,
 #if defined(PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED) || \
    defined(PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED)
 PNG_INTERNAL_FUNCTION(void,png_do_check_palette_indexes,
-   (png_structrp png_ptr, png_row_infop row_info),PNG_EMPTY);
+   (png_structrp png_ptr, png_transform_controlp row_info),PNG_EMPTY);
 #endif

 #if defined(PNG_FLOATING_POINT_SUPPORTED) && defined(PNG_ERROR_TEXT_SUPPORTED)
@@ -1680,13 +2014,6 @@ PNG_INTERNAL_FUNCTION(int,png_muldiv,(png_fixed_point_p res, png_fixed_point a,
   png_int_32 multiplied_by, png_int_32 divided_by),PNG_EMPTY);
 #endif

-#if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_INCH_CONVERSIONS_SUPPORTED)
-/* Same deal, but issue a warning on overflow and return 0. */
-PNG_INTERNAL_FUNCTION(png_fixed_point,png_muldiv_warn,
-   (png_const_structrp png_ptr, png_fixed_point a, png_int_32 multiplied_by,
-   png_int_32 divided_by),PNG_EMPTY);
-#endif
-
 #ifdef PNG_GAMMA_SUPPORTED
 /* Calculate a reciprocal - used for gamma values.  This returns
 * 0 if the argument is 0 in order to maintain an undefined value;
@@ -1717,12 +2044,12 @@ PNG_INTERNAL_FUNCTION(int,png_gamma_significant,(png_fixed_point gamma_value),
 * While the input is an 'unsigned' value it must actually be the
 * correct bit value - 0..255 or 0..65535 as required.
 */
-PNG_INTERNAL_FUNCTION(png_uint_16,png_gamma_correct,(png_structrp png_ptr,
-   unsigned int value, png_fixed_point gamma_value),PNG_EMPTY);
-PNG_INTERNAL_FUNCTION(png_uint_16,png_gamma_16bit_correct,(unsigned int value,
-   png_fixed_point gamma_value),PNG_EMPTY);
-PNG_INTERNAL_FUNCTION(png_byte,png_gamma_8bit_correct,(unsigned int value,
-   png_fixed_point gamma_value),PNG_EMPTY);
+PNG_INTERNAL_FUNCTION(png_uint_16,png_gamma_16bit_correct,(
+   png_const_structrp png_ptr, png_uint_32 value, png_fixed_point gamma_value),
+   PNG_EMPTY);
+PNG_INTERNAL_FUNCTION(png_byte,png_gamma_8bit_correct,(
+   png_const_structrp png_ptr, png_uint_32 value, png_fixed_point gamma_value),
+   PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_destroy_gamma_table,(png_structrp png_ptr),
   PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_build_gamma_tables,(png_structrp png_ptr,
--- a/pngread.c
+++ b/pngread.c
@@ -18,6 +18,7 @@
 #if defined(PNG_SIMPLIFIED_READ_SUPPORTED) && defined(PNG_STDIO_SUPPORTED)
 #  include <errno.h>
 #endif
+#define PNG_SRC_FILE PNG_SRC_FILE_pngread

 #ifdef PNG_READ_SUPPORTED

@@ -63,7 +64,7 @@ png_create_read_struct_2,(png_const_charp user_png_ver, png_voidp error_ptr,
         /* In stable builds only warn if an application error can be completely
          * handled.
          */
-#        if PNG_LIBPNG_BUILD_BASE_TYPE >= PNG_LIBPNG_BUILD_RC
+#        if PNG_RELEASE_BUILD
            png_ptr->flags |= PNG_FLAG_APP_WARNINGS_WARN;
 #        endif
 #     endif
@@ -336,6 +337,7 @@ png_do_read_intrapixel(png_row_infop row_info, png_bytep row)

         for (i = 0, rp = row; i < row_width; i++, rp += bytes_per_pixel)
         {
+            /* TODO: explain the +256 */
            *(rp) = (png_byte)((256 + *rp + *(rp + 1)) & 0xff);
            *(rp+2) = (png_byte)((256 + *(rp + 2) + *(rp + 1)) & 0xff);
         }
@@ -359,6 +361,7 @@ png_do_read_intrapixel(png_row_infop row_info, png_bytep row)
            png_uint_32 s0   = (*(rp    ) << 8) | *(rp + 1);
            png_uint_32 s1   = (*(rp + 2) << 8) | *(rp + 3);
            png_uint_32 s2   = (*(rp + 4) << 8) | *(rp + 5);
+            /* TODO: explain the +65536 */
            png_uint_32 red  = (s0 + s1 + 65536) & 0xffff;
            png_uint_32 blue = (s2 + s1 + 65536) & 0xffff;
            *(rp    ) = (png_byte)((red >> 8) & 0xff);
@@ -945,15 +948,12 @@ png_read_destroy(png_structrp png_ptr)
   }
   png_ptr->free_me &= ~PNG_FREE_PLTE;

-#if defined(PNG_tRNS_SUPPORTED) || \
-    defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
   if ((png_ptr->free_me & PNG_FREE_TRNS) != 0)
   {
      png_free(png_ptr, png_ptr->trans_alpha);
      png_ptr->trans_alpha = NULL;
   }
   png_ptr->free_me &= ~PNG_FREE_TRNS;
-#endif

   inflateEnd(&png_ptr->zstream);

@@ -1669,7 +1669,8 @@ decode_gamma(png_image_read_control *display, png_uint_32 value, int encoding)
   switch (encoding)
   {
      case P_FILE:
-         value = png_gamma_16bit_correct(value*257, display->gamma_to_linear);
+         value = png_gamma_16bit_correct(display->image->opaque->png_ptr,
+            value*257, display->gamma_to_linear);
         break;

      case P_sRGB:
@@ -1684,8 +1685,8 @@ decode_gamma(png_image_read_control *display, png_uint_32 value, int encoding)
         break;

      default:
-         png_error(display->image->opaque->png_ptr,
-            "unexpected encoding (internal error)");
+         png_impossiblepp(display->image->opaque->png_ptr,
+            "unexpected encoding");
         break;
   }

@@ -1721,7 +1722,7 @@ png_colormap_compose(png_image_read_control *display,
   }

   else /* P_sRGB */
-      f = PNG_sRGB_FROM_LINEAR(f);
+      f = PNG_sRGB_FROM_LINEAR(display->image->opaque->png_ptr, f);

   return f;
 }
@@ -1735,13 +1736,14 @@ png_create_colormap_entry(png_image_read_control *display,
   png_uint_32 alpha, int encoding)
 {
   png_imagep image = display->image;
+#  define png_ptr image->opaque->png_ptr /* for error messages */
   const int output_encoding = (image->format & PNG_FORMAT_FLAG_LINEAR) != 0 ?
      P_LINEAR : P_sRGB;
   const int convert_to_Y = (image->format & PNG_FORMAT_FLAG_COLOR) == 0 &&
      (red != green || green != blue);

   if (ip > 255)
-      png_error(image->opaque->png_ptr, "color-map index out of range");
+      png_error(png_ptr, "color-map index out of range");

   /* Update the cache with whether the file gamma is significantly different
    * from sRGB.
@@ -1761,9 +1763,9 @@ png_create_colormap_entry(png_image_read_control *display,
   {
      png_fixed_point g = display->gamma_to_linear;

-      red = png_gamma_16bit_correct(red*257, g);
-      green = png_gamma_16bit_correct(green*257, g);
-      blue = png_gamma_16bit_correct(blue*257, g);
+      red = png_gamma_16bit_correct(png_ptr, red*257, g);
+      green = png_gamma_16bit_correct(png_ptr, green*257, g);
+      blue = png_gamma_16bit_correct(png_ptr, blue*257, g);

      if (convert_to_Y != 0 || output_encoding == P_LINEAR)
      {
@@ -1773,9 +1775,9 @@ png_create_colormap_entry(png_image_read_control *display,

      else
      {
-         red = PNG_sRGB_FROM_LINEAR(red * 255);
-         green = PNG_sRGB_FROM_LINEAR(green * 255);
-         blue = PNG_sRGB_FROM_LINEAR(blue * 255);
+         red = PNG_sRGB_FROM_LINEAR(png_ptr, red * 255);
+         green = PNG_sRGB_FROM_LINEAR(png_ptr, green * 255);
+         blue = PNG_sRGB_FROM_LINEAR(png_ptr, blue * 255);
         encoding = P_sRGB;
      }
   }
@@ -1793,7 +1795,7 @@ png_create_colormap_entry(png_image_read_control *display,
   }

   else if (encoding == P_sRGB &&
-       (convert_to_Y  != 0 || output_encoding == P_LINEAR))
+       (convert_to_Y != 0 || output_encoding == P_LINEAR))
   {
      /* The values are 8-bit sRGB values, but must be converted to 16-bit
       * linear.
@@ -1811,8 +1813,7 @@ png_create_colormap_entry(png_image_read_control *display,
      if (convert_to_Y != 0)
      {
         /* NOTE: these values are copied from png_do_rgb_to_gray */
-         png_uint_32 y = (png_uint_32)6968 * red  + (png_uint_32)23434 * green +
-            (png_uint_32)2366 * blue;
+         png_uint_32 y = 6968 * red  + 23434 * green + 2366 * blue;

         if (output_encoding == P_LINEAR)
            y = (y + 16384) >> 15;
@@ -1822,7 +1823,8 @@ png_create_colormap_entry(png_image_read_control *display,
            /* y is scaled by 32768, we need it scaled by 255: */
            y = (y + 128) >> 8;
            y *= 255;
-            y = PNG_sRGB_FROM_LINEAR((y + 64) >> 7);
+            y = PNG_sRGB_FROM_LINEAR(png_ptr, (y + 64) >> 7);
+            alpha = PNG_DIV257(alpha);
            encoding = P_sRGB;
         }

@@ -1831,16 +1833,16 @@ png_create_colormap_entry(png_image_read_control *display,

      else if (output_encoding == P_sRGB)
      {
-         red = PNG_sRGB_FROM_LINEAR(red * 255);
-         green = PNG_sRGB_FROM_LINEAR(green * 255);
-         blue = PNG_sRGB_FROM_LINEAR(blue * 255);
+         red = PNG_sRGB_FROM_LINEAR(png_ptr, red * 255);
+         green = PNG_sRGB_FROM_LINEAR(png_ptr, green * 255);
+         blue = PNG_sRGB_FROM_LINEAR(png_ptr, blue * 255);
         alpha = PNG_DIV257(alpha);
         encoding = P_sRGB;
      }
   }

   if (encoding != output_encoding)
-      png_error(image->opaque->png_ptr, "bad encoding (internal error)");
+      png_impossiblepp(png_ptr, "bad encoding");

   /* Store the value. */
   {
@@ -1869,7 +1871,7 @@ png_create_colormap_entry(png_image_read_control *display,
         switch (PNG_IMAGE_SAMPLE_CHANNELS(image->format))
         {
            case 4:
-               entry[afirst ? 0 : 3] = (png_uint_16)alpha;
+               entry[afirst ? 0 : 3] = png_check_u16(png_ptr, alpha);
               /* FALL THROUGH */

            case 3:
@@ -1885,13 +1887,13 @@ png_create_colormap_entry(png_image_read_control *display,
                  else
                     red = green = blue = 0;
               }
-               entry[afirst + (2 ^ bgr)] = (png_uint_16)blue;
-               entry[afirst + 1] = (png_uint_16)green;
-               entry[afirst + bgr] = (png_uint_16)red;
+               entry[afirst + (2 ^ bgr)] = png_check_u16(png_ptr, blue);
+               entry[afirst + 1] = png_check_u16(png_ptr, green);
+               entry[afirst + bgr] = png_check_u16(png_ptr, red);
               break;

            case 2:
-               entry[1 ^ afirst] = (png_uint_16)alpha;
+               entry[1 ^ afirst] = png_check_u16(png_ptr, alpha);
               /* FALL THROUGH */

            case 1:
@@ -1903,7 +1905,7 @@ png_create_colormap_entry(png_image_read_control *display,
                  else
                     green = 0;
               }
-               entry[afirst] = (png_uint_16)green;
+               entry[afirst] = png_check_u16(png_ptr, green);
               break;

            default:
@@ -1917,20 +1919,24 @@ png_create_colormap_entry(png_image_read_control *display,

         entry += ip * PNG_IMAGE_SAMPLE_CHANNELS(image->format);

+         png_affirmpp(png_ptr, output_encoding == P_sRGB);
+
         switch (PNG_IMAGE_SAMPLE_CHANNELS(image->format))
         {
            case 4:
-               entry[afirst ? 0 : 3] = (png_byte)alpha;
+               entry[afirst ? 0 : 3] = png_check_byte(png_ptr, alpha);
+
            case 3:
-               entry[afirst + (2 ^ bgr)] = (png_byte)blue;
-               entry[afirst + 1] = (png_byte)green;
-               entry[afirst + bgr] = (png_byte)red;
+               entry[afirst + (2 ^ bgr)] = png_check_byte(png_ptr, blue);
+               entry[afirst + 1] = png_check_byte(png_ptr, green);
+               entry[afirst + bgr] = png_check_byte(png_ptr, red);
               break;

            case 2:
-               entry[1 ^ afirst] = (png_byte)alpha;
+               entry[1 ^ afirst] = png_check_byte(png_ptr, alpha);
+
            case 1:
-               entry[afirst] = (png_byte)green;
+               entry[afirst] = png_check_byte(png_ptr, green);
               break;

            default:
@@ -1945,6 +1951,8 @@ png_create_colormap_entry(png_image_read_control *display,
 #        undef bgr
 #     endif
   }
+
+#  undef png_ptr
 }

 static int
@@ -2052,7 +2060,8 @@ make_rgb_colormap(png_image_read_control *display)

 /* Return a palette index to the above palette given three 8-bit sRGB values. */
 #define PNG_RGB_INDEX(r,g,b) \
-   ((png_byte)(6 * (6 * PNG_DIV51(r) + PNG_DIV51(g)) + PNG_DIV51(b)))
+   (png_check_byte(image->opaque->png_ptr,\
+                   6 * (6 * PNG_DIV51(r) + PNG_DIV51(g)) + PNG_DIV51(b)))

 static int
 png_image_read_colormap(png_voidp argument)
@@ -2259,7 +2268,7 @@ png_image_read_colormap(png_voidp argument)

                     if (output_encoding == P_LINEAR)
                     {
-                        gray = PNG_sRGB_FROM_LINEAR(gray * 255);
+                        gray = PNG_sRGB_FROM_LINEAR(png_ptr, gray * 255);

                        /* And make sure the corresponding palette entry
                         * matches.
@@ -2272,7 +2281,8 @@ png_image_read_colormap(png_voidp argument)
                      * sRGB value.
                      */
                     c.index = 0; /*unused*/
-                     c.gray = c.red = c.green = c.blue = (png_uint_16)gray;
+                     c.gray = c.red = c.green = c.blue =
+                        png_check_u16(png_ptr, gray);

                     /* NOTE: does this work without expanding tRNS to alpha?
                      * It should be the color->gray case below apparently
@@ -2374,7 +2384,7 @@ png_image_read_colormap(png_voidp argument)

               if (output_encoding == P_LINEAR)
               {
-                  gray = PNG_sRGB_FROM_LINEAR(gray * 255);
+                  gray = PNG_sRGB_FROM_LINEAR(png_ptr, gray * 255);

                  /* And make sure the corresponding palette entry matches. */
                  png_create_colormap_entry(display, gray, back_g, back_g,
@@ -2385,7 +2395,7 @@ png_image_read_colormap(png_voidp argument)
                * value.
                */
               c.index = 0; /*unused*/
-               c.gray = c.red = c.green = c.blue = (png_uint_16)gray;
+               c.gray = c.red = c.green = c.blue = png_check_u16(png_ptr, gray);

               png_set_background_fixed(png_ptr, &c,
                  PNG_BACKGROUND_GAMMA_SCREEN, 0/*need_expand*/,
@@ -2462,9 +2472,10 @@ png_image_read_colormap(png_voidp argument)
                     png_uint_32 gray = png_sRGB_table[g*51] * alpha;

                     png_create_colormap_entry(display, i++,
-                        PNG_sRGB_FROM_LINEAR(gray + back_rx),
-                        PNG_sRGB_FROM_LINEAR(gray + back_gx),
-                        PNG_sRGB_FROM_LINEAR(gray + back_bx), 255, P_sRGB);
+                        PNG_sRGB_FROM_LINEAR(png_ptr, gray + back_rx),
+                        PNG_sRGB_FROM_LINEAR(png_ptr, gray + back_gx),
+                        PNG_sRGB_FROM_LINEAR(png_ptr, gray + back_bx),
+                        255, P_sRGB);
                  }
               }

@@ -2565,7 +2576,7 @@ png_image_read_colormap(png_voidp argument)
                     if (output_encoding == P_sRGB)
                        gray = png_sRGB_table[gray]; /* now P_LINEAR */

-                     gray = PNG_DIV257(png_gamma_16bit_correct(gray,
+                     gray = PNG_DIV257(png_gamma_16bit_correct(png_ptr, gray,
                        png_ptr->colorspace.gamma)); /* now P_FILE */

                     /* And make sure the corresponding palette entry contains
@@ -2577,7 +2588,7 @@ png_image_read_colormap(png_voidp argument)

                  else if (output_encoding == P_LINEAR)
                  {
-                     gray = PNG_sRGB_FROM_LINEAR(gray * 255);
+                     gray = PNG_sRGB_FROM_LINEAR(png_ptr, gray * 255);

                     /* And make sure the corresponding palette entry matches.
                      */
@@ -2589,7 +2600,8 @@ png_image_read_colormap(png_voidp argument)
                   * output (normally sRGB) value.
                   */
                  c.index = 0; /*unused*/
-                  c.gray = c.red = c.green = c.blue = (png_uint_16)gray;
+                  c.gray = c.red = c.green = c.blue =
+                     png_check_u16(png_ptr, gray);

                  /* NOTE: the following is apparently a bug in libpng. Without
                   * it the transparent color recognition in
@@ -2684,9 +2696,9 @@ png_image_read_colormap(png_voidp argument)

                  if (output_encoding == P_LINEAR)
                  {
-                     r = PNG_sRGB_FROM_LINEAR(back_r * 255);
-                     g = PNG_sRGB_FROM_LINEAR(back_g * 255);
-                     b = PNG_sRGB_FROM_LINEAR(back_b * 255);
+                     r = PNG_sRGB_FROM_LINEAR(png_ptr, back_r * 255);
+                     g = PNG_sRGB_FROM_LINEAR(png_ptr, back_g * 255);
+                     b = PNG_sRGB_FROM_LINEAR(png_ptr, back_b * 255);
                  }

                  else
@@ -2741,9 +2753,9 @@ png_image_read_colormap(png_voidp argument)
                     png_color_16 c;

                     c.index = 0; /*unused*/
-                     c.red = (png_uint_16)back_r;
-                     c.gray = c.green = (png_uint_16)back_g;
-                     c.blue = (png_uint_16)back_b;
+                     c.red = png_check_u16(png_ptr, back_r);
+                     c.gray = c.green = png_check_u16(png_ptr, back_g);
+                     c.blue = png_check_u16(png_ptr, back_b);

                     png_set_background_fixed(png_ptr, &c,
                        PNG_BACKGROUND_GAMMA_SCREEN, 0/*need_expand*/,
@@ -2847,7 +2859,7 @@ png_image_read_colormap(png_voidp argument)
   switch (data_encoding)
   {
      default:
-         png_error(png_ptr, "bad data option (internal error)");
+         impossible("bad data option");
         break;

      case P_sRGB:
@@ -2861,8 +2873,7 @@ png_image_read_colormap(png_voidp argument)
         break;
   }

-   if (cmap_entries > 256 || cmap_entries > image->colormap_entries)
-      png_error(png_ptr, "color map overflow (BAD internal error)");
+   affirm(cmap_entries <= 256 && cmap_entries <= image->colormap_entries);

   image->colormap_entries = cmap_entries;

@@ -2896,10 +2907,10 @@ png_image_read_colormap(png_voidp argument)
         break;

      default:
-         png_error(png_ptr, "bad processing option (internal error)");
+         impossible("bad processing option");

      bad_background:
-         png_error(png_ptr, "bad background index (internal error)");
+         impossible("bad background index");
   }

   display->colormap_processing = output_processing;
@@ -3008,7 +3019,7 @@ png_image_read_and_map(png_voidp argument)
                        entry = 226 + 6 * PNG_DIV51(alpha) + PNG_DIV51(gray);
                     }

-                     *outrow = (png_byte)entry;
+                     *outrow = png_check_byte(png_ptr, entry);
                  }
                  break;

@@ -3025,7 +3036,7 @@ png_image_read_and_map(png_voidp argument)
                        *outrow = gray;

                     else
-                        *outrow = (png_byte)(PNG_CMAP_TRANS_BACKGROUND+1);
+                        *outrow = PNG_CMAP_TRANS_BACKGROUND+1;
                  }
                  break;

@@ -3080,7 +3091,7 @@ png_image_read_and_map(png_voidp argument)
                        if (inrow[0] & 0x80) back_i += 1; /* blue */
                        if (inrow[0] & 0x40) back_i += 1;

-                        *outrow = (png_byte)back_i;
+                        *outrow = png_check_byte(png_ptr, back_i);
                     }

                     inrow += 4;
@@ -3171,7 +3182,7 @@ png_image_read_colormapped(png_voidp argument)

      default:
      bad_output:
-         png_error(png_ptr, "bad color-map processing (internal error)");
+         impossible("bad color-map processing");
   }

   /* Now read the rows.  Do this here if it is possible to read directly into
@@ -3328,10 +3339,11 @@ png_image_read_composite(png_voidp argument)
                         * therefore appropriate for the sRGB to linear
                         * conversion table.
                         */
-                        component = PNG_sRGB_FROM_LINEAR(component);
+                        component =
+                           PNG_sRGB_FROM_LINEAR(png_ptr, component);
                     }

-                     outrow[c] = (png_byte)component;
+                     outrow[c] = png_check_byte(png_ptr, component);
                  }
               }

@@ -3480,10 +3492,11 @@ png_image_read_background(png_voidp argument)
                              component = png_sRGB_table[component] * alpha;
                              component += png_sRGB_table[outrow[0]] *
                                 (255-alpha);
-                              component = PNG_sRGB_FROM_LINEAR(component);
+                              component =
+                                 PNG_sRGB_FROM_LINEAR(png_ptr, component);
                           }

-                           outrow[0] = (png_byte)component;
+                           outrow[0] = png_check_byte(png_ptr, component);
                        }

                        inrow += 2; /* gray and alpha channel */
@@ -3520,10 +3533,11 @@ png_image_read_background(png_voidp argument)
                           {
                              component = png_sRGB_table[component] * alpha;
                              component += background * (255-alpha);
-                              component = PNG_sRGB_FROM_LINEAR(component);
+                              component =
+                                 PNG_sRGB_FROM_LINEAR(png_ptr, component);
                           }

-                           outrow[0] = (png_byte)component;
+                           outrow[0] = png_check_byte(png_ptr, component);
                        }

                        else
@@ -3620,7 +3634,8 @@ png_image_read_background(png_voidp argument)
                     else
                        component = 0;

-                     outrow[swap_alpha] = (png_uint_16)component;
+                     outrow[swap_alpha] =
+                        png_check_u16(png_ptr, component);
                     if (preserve_alpha != 0)
                        outrow[1 ^ swap_alpha] = alpha;

@@ -3956,8 +3971,8 @@ png_image_read_direct(png_voidp argument)
         }
      }

-      else if (do_local_compose != 0) /* internal error */
-         png_error(png_ptr, "png_image_read: alpha channel lost");
+      else
+         affirm(do_local_compose == 0 /* else alpha channel lost */);

      if (info_ptr->bit_depth == 16)
         info_format |= PNG_FORMAT_FLAG_LINEAR;
@@ -3986,8 +4001,7 @@ png_image_read_direct(png_voidp argument)
 #     endif

      /* This is actually an internal error. */
-      if (info_format != format)
-         png_error(png_ptr, "png_read_image: invalid transformations");
+      affirm(info_format == format /* else unimplemented transformations */);
   }

   /* Now read the rows.  If do_local_compose is set then it is necessary to use
--- a/pngrio.c
+++ b/pngrio.c
@@ -1,8 +1,8 @@

 /* pngrio.c - functions for data input
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.17 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -19,6 +19,7 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_rio

 #ifdef PNG_READ_SUPPORTED

@@ -26,7 +27,7 @@
 * reads from a file pointer.  Note that this routine sometimes gets called
 * with very small lengths, so you should implement some kind of simple
 * buffering if you are using unbuffered reads.  This should never be asked
- * to read more then 64K on a 16 bit machine.
+ * to read more than 64K on a 16 bit machine.
 */
 void /* PRIVATE */
 png_read_data(png_structrp png_ptr, png_bytep data, png_size_t length)
--- a/pngrtran.c
+++ b/pngrtran.c
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -2,7 +2,7 @@
 /* pngrutil.c - utilities to read a PNG file
 *
 * Last changed in libpng 1.7.0 [(PENDING RELEASE)]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -15,6 +15,7 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_pngrutil

 #ifdef PNG_READ_SUPPORTED

@@ -324,7 +325,7 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
       * are minimal.
       */
      (void)png_safecat(msg, (sizeof msg), 4, " using zstream");
-#     if PNG_LIBPNG_BUILD_BASE_TYPE >= PNG_LIBPNG_BUILD_RC
+#     if PNG_RELEASE_BUILD
         png_chunk_warning(png_ptr, msg);
         png_ptr->zowner = 0;
 #     else
@@ -776,8 +777,8 @@ png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
 {
   png_byte buf[13];
   png_uint_32 width, height;
-   int bit_depth, color_type, compression_type, filter_type;
-   int interlace_type;
+   png_byte bit_depth, color_type, compression_type, filter_type;
+   png_byte interlace_type;

   png_debug(1, "in png_handle_IHDR");

@@ -804,13 +805,13 @@ png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
   /* Set internal variables */
   png_ptr->width = width;
   png_ptr->height = height;
-   png_ptr->bit_depth = (png_byte)bit_depth;
-   png_ptr->interlaced = (png_byte)interlace_type;
-   png_ptr->color_type = (png_byte)color_type;
+   png_ptr->bit_depth = bit_depth;
+   png_ptr->interlaced = interlace_type;
+   png_ptr->color_type = color_type;
 #ifdef PNG_MNG_FEATURES_SUPPORTED
-   png_ptr->filter_type = (png_byte)filter_type;
+   png_ptr->filter_type = filter_type;
 #endif
-   png_ptr->compression_type = (png_byte)compression_type;
+   png_ptr->compression_type = compression_type;

   /* Find number of channels */
   switch (png_ptr->color_type)
@@ -835,8 +836,8 @@ png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
   }

   /* Set up other useful info */
-   png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *
-   png_ptr->channels);
+   png_ptr->pixel_depth = png_check_byte(png_ptr, png_ptr->bit_depth *
+           png_ptr->channels);
   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
   png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);
   png_debug1(3, "channels = %d", png_ptr->channels);
@@ -1316,7 +1317,7 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
   }

   /* If a colorspace error has already been output skip this chunk */
-   if (png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID)
+   if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0)
   {
      png_crc_finish(png_ptr, length);
      return;
@@ -1802,7 +1803,8 @@ png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
         return;
      }

-      if (length > png_ptr->num_palette || length > PNG_MAX_PALETTE_LENGTH ||
+      if (length > png_ptr->num_palette ||
+         length > (unsigned int) PNG_MAX_PALETTE_LENGTH ||
         length == 0)
      {
         png_crc_finish(png_ptr, length);
@@ -1811,7 +1813,7 @@ png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
      }

      png_crc_read(png_ptr, readbuf, length);
-      png_ptr->num_trans = (png_uint_16)length;
+      png_ptr->num_trans = png_check_u16(png_ptr, length);
   }

   else
@@ -1906,9 +1908,11 @@ png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
            return;
         }

-         background.red = (png_uint_16)png_ptr->palette[buf[0]].red;
-         background.green = (png_uint_16)png_ptr->palette[buf[0]].green;
-         background.blue = (png_uint_16)png_ptr->palette[buf[0]].blue;
+         background.red = png_check_u16(png_ptr, png_ptr->palette[buf[0]].red);
+         background.green =
+            png_check_u16(png_ptr, png_ptr->palette[buf[0]].green);
+         background.blue =
+            png_check_u16(png_ptr, png_ptr->palette[buf[0]].blue);
      }

      else
@@ -2716,9 +2720,9 @@ png_cache_unknown_chunk(png_structrp png_ptr, png_uint_32 length)
   {
      PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
      /* The following is safe because of the PNG_SIZE_MAX init above */
-      png_ptr->unknown_chunk.size = (png_size_t)length/*SAFE*/;
+      png_ptr->unknown_chunk.size = (png_size_t)/*SAFE*/length;
      /* 'mode' is a flag array, only the bottom four bits matter here */
-      png_ptr->unknown_chunk.location = (png_byte)png_ptr->mode/*SAFE*/;
+      png_ptr->unknown_chunk.location = PNG_BYTE(png_ptr->mode & 0xf);

      if (length == 0)
         png_ptr->unknown_chunk.data = NULL;
@@ -2793,7 +2797,7 @@ png_handle_unknown(png_structrp png_ptr, png_inforp info_ptr,
               &png_ptr->unknown_chunk);

            /* ret is:
-             * negative: An error occured, png_chunk_error will be called.
+             * negative: An error occurred; png_chunk_error will be called.
             *     zero: The chunk was not handled, the chunk will be discarded
             *           unless png_set_keep_unknown_chunks has been used to set
             *           a 'keep' behavior for this particular chunk, in which
@@ -3198,7 +3202,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
            if (m != 0) /* something to copy */
            {
               if (m != 0xff)
-                  *dp = (png_byte)((*dp & ~m) | (*sp & m));
+                  *dp = png_check_byte(png_ptr, (*dp & ~m) | (*sp & m));
               else
                  *dp = *sp;
            }
@@ -3450,7 +3454,8 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)

   /* Restore the overwritten bits from the last byte if necessary. */
   if (end_ptr != NULL)
-      *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask));
+      *end_ptr = png_check_byte(png_ptr,
+         (end_byte & end_mask) | (*end_ptr & ~end_mask));
 }

 #ifdef PNG_READ_INTERLACING_SUPPORTED
@@ -3504,12 +3509,12 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,

            for (i = 0; i < row_info->width; i++)
            {
-               v = (png_byte)((*sp >> sshift) & 0x01);
+               v = PNG_BYTE((*sp >> sshift) & 0x01);
               for (j = 0; j < jstop; j++)
               {
                  unsigned int tmp = *dp & (0x7f7f >> (7 - dshift));
                  tmp |= v << dshift;
-                  *dp = (png_byte)(tmp & 0xff);
+                  *dp = png_check_byte(0/*TODO:fixme*/, tmp);

                  if (dshift == s_end)
                  {
@@ -3567,12 +3572,12 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
               png_byte v;
               int j;

-               v = (png_byte)((*sp >> sshift) & 0x03);
+               v = PNG_BYTE((*sp >> sshift) & 0x03);
               for (j = 0; j < jstop; j++)
               {
                  unsigned int tmp = *dp & (0x3f3f >> (6 - dshift));
                  tmp |= v << dshift;
-                  *dp = (png_byte)(tmp & 0xff);
+                  *dp = PNG_BYTE(tmp);

                  if (dshift == s_end)
                  {
@@ -3627,14 +3632,14 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,

            for (i = 0; i < row_info->width; i++)
            {
-               png_byte v = (png_byte)((*sp >> sshift) & 0x0f);
+               png_byte v = PNG_BYTE((*sp >> sshift) & 0x0f);
               int j;

               for (j = 0; j < jstop; j++)
               {
                  unsigned int tmp = *dp & (0xf0f >> (4 - dshift));
                  tmp |= v << dshift;
-                  *dp = (png_byte)(tmp & 0xff);
+                  *dp = png_check_byte(0/*TODO:fixme*/, tmp);

                  if (dshift == s_end)
                  {
@@ -3820,7 +3825,7 @@ png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
   while (row < rp_end)
   {
      int a = *row + *prev_row++;
-      *row++ = (png_byte)a;
+      *row++ = (png_byte)(a&0xFF);
   }

   /* Remainder */
@@ -3851,7 +3856,7 @@ png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
      if (pc < pa) a = c;

      a += *row;
-      *row++ = (png_byte)a;
+      *row++ = (png_byte)(a&0xFF);
   }
 }

@@ -4175,7 +4180,7 @@ png_read_start_row(png_structrp png_ptr)
   static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
 #endif

-   int max_pixel_depth;
+   unsigned int max_pixel_depth;
   png_size_t row_bytes;

   png_debug(1, "in png_read_start_row");
@@ -4340,7 +4345,7 @@ png_read_start_row(png_structrp png_ptr)
 defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
   if (png_ptr->transformations & PNG_USER_TRANSFORM)
   {
-      int user_pixel_depth = png_ptr->user_transform_depth *
+      unsigned int user_pixel_depth = png_ptr->user_transform_depth *
         png_ptr->user_transform_channels;

      if (user_pixel_depth > max_pixel_depth)
@@ -4351,7 +4356,7 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
   /* This value is stored in png_struct and double checked in the row read
    * code.
    */
-   png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;
+   png_ptr->maximum_pixel_depth = max_pixel_depth;
   png_ptr->transformed_pixel_depth = 0; /* calculated on demand */

   /* Align the width on the next larger 8 pixels.  Mainly used
--- a/pngset.c
+++ b/pngset.c
@@ -17,6 +17,7 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_pngset

 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

@@ -216,11 +217,11 @@ png_set_IHDR(png_const_structrp png_ptr, png_inforp info_ptr,

   info_ptr->width = width;
   info_ptr->height = height;
-   info_ptr->bit_depth = (png_byte)bit_depth;
-   info_ptr->color_type = (png_byte)color_type;
-   info_ptr->compression_type = (png_byte)compression_type;
-   info_ptr->filter_type = (png_byte)filter_type;
-   info_ptr->interlace_type = (png_byte)interlace_type;
+   info_ptr->bit_depth = png_check_byte(png_ptr, bit_depth);
+   info_ptr->color_type = png_check_byte(png_ptr, color_type);
+   info_ptr->compression_type = png_check_byte(png_ptr, compression_type);
+   info_ptr->filter_type = png_check_byte(png_ptr, filter_type);
+   info_ptr->interlace_type = png_check_byte(png_ptr, interlace_type);

   png_check_IHDR (png_ptr, info_ptr->width, info_ptr->height,
       info_ptr->bit_depth, info_ptr->color_type, info_ptr->interlace_type,
@@ -238,7 +239,8 @@ png_set_IHDR(png_const_structrp png_ptr, png_inforp info_ptr,
   if ((info_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)
      info_ptr->channels++;

-   info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
+   info_ptr->pixel_depth = png_check_byte(png_ptr, info_ptr->channels *
+           info_ptr->bit_depth);

   info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
 }
@@ -255,7 +257,7 @@ png_set_oFFs(png_const_structrp png_ptr, png_inforp info_ptr,

   info_ptr->x_offset = offset_x;
   info_ptr->y_offset = offset_y;
-   info_ptr->offset_unit_type = (png_byte)unit_type;
+   info_ptr->offset_unit_type = png_check_byte(png_ptr, unit_type);
   info_ptr->valid |= PNG_INFO_oFFs;
 }
 #endif
@@ -311,8 +313,8 @@ png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
   png_debug(3, "storing X0, X1, type, and nparams in info");
   info_ptr->pcal_X0 = X0;
   info_ptr->pcal_X1 = X1;
-   info_ptr->pcal_type = (png_byte)type;
-   info_ptr->pcal_nparams = (png_byte)nparams;
+   info_ptr->pcal_type = png_check_byte(png_ptr, type);
+   info_ptr->pcal_nparams = png_check_byte(png_ptr, nparams);

   length = strlen(units) + 1;
   png_debug1(3, "allocating units for info (%lu bytes)",
@@ -391,7 +393,7 @@ png_set_sCAL_s(png_const_structrp png_ptr, png_inforp info_ptr,
       sheight[0] == 45 /* '-' */ || !png_check_fp_string(sheight, lengthh))
      png_error(png_ptr, "Invalid sCAL height");

-   info_ptr->scal_unit = (png_byte)unit;
+   info_ptr->scal_unit = png_check_byte(png_ptr, unit);

   ++lengthw;

@@ -504,7 +506,7 @@ png_set_pHYs(png_const_structrp png_ptr, png_inforp info_ptr,

   info_ptr->x_pixels_per_unit = res_x;
   info_ptr->y_pixels_per_unit = res_y;
-   info_ptr->phys_unit_type = (png_byte)unit_type;
+   info_ptr->phys_unit_type = png_check_byte(png_ptr, unit_type);
   info_ptr->valid |= PNG_INFO_pHYs;
 }
 #endif
@@ -561,7 +563,8 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
   if (num_palette > 0)
      memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color)));
   info_ptr->palette = png_ptr->palette;
-   info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;
+   info_ptr->num_palette = png_ptr->num_palette =
+      png_check_u16(png_ptr, num_palette);

   info_ptr->free_me |= PNG_FREE_PLTE;

@@ -674,7 +677,6 @@ png_set_iCCP(png_const_structrp png_ptr, png_inforp info_ptr,
   if (new_iccp_profile == NULL)
   {
      png_free(png_ptr, new_iccp_name);
-      new_iccp_name = NULL;
      png_benign_error(png_ptr,
          "Insufficient memory to process iCCP profile");

@@ -986,7 +988,7 @@ png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
         memcpy(info_ptr->trans_alpha, trans_alpha,
            (unsigned)/*SAFE*/num_trans);
         info_ptr->valid |= PNG_INFO_tRNS;
-         info_ptr->num_trans = (png_uint_16)num_trans; /* SAFE */
+         info_ptr->num_trans = png_check_u16(png_ptr, num_trans);
      }
   }

@@ -1139,7 +1141,7 @@ check_location(png_const_structrp png_ptr, int location)
      png_app_warning(png_ptr,
         "png_set_unknown_chunks now expects a valid location");
      /* Use the old behavior */
-      location = (png_byte)(png_ptr->mode &
+      location = png_check_byte(png_ptr, png_ptr->mode &
         (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT));
   }

@@ -1158,7 +1160,7 @@ check_location(png_const_structrp png_ptr, int location)
   /* The cast is safe because 'location' is a bit mask and only the low four
    * bits are significant.
    */
-   return (png_byte)location;
+   return png_check_byte(png_ptr, location);
 }

 void PNGAPI
@@ -1289,8 +1291,7 @@ png_set_unknown_chunk_location(png_const_structrp png_ptr, png_inforp info_ptr,
   else if (png_ptr != NULL)
      png_app_warning(png_ptr, "unknown chunk index out of range");
 }
-#endif
-
+#endif /* STORE_UNKNOWN_CHUNKS */

 #ifdef PNG_MNG_FEATURES_SUPPORTED
 png_uint_32 PNGAPI
@@ -1309,7 +1310,8 @@ png_permit_mng_features (png_structrp png_ptr, png_uint_32 mng_features)

 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 static unsigned int
-add_one_chunk(png_bytep list, unsigned int count, png_const_bytep add, int keep)
+add_one_chunk(png_const_structrp png_ptr, png_bytep list, unsigned int count,
+   png_const_bytep add, int keep)
 {
   unsigned int i;

@@ -1320,7 +1322,7 @@ add_one_chunk(png_bytep list, unsigned int count, png_const_bytep add, int keep)
   {
      if (memcmp(list, add, 4) == 0)
      {
-         list[4] = (png_byte)keep;
+         list[4] = png_check_byte(png_ptr, keep);

         return count;
      }
@@ -1330,10 +1332,11 @@ add_one_chunk(png_bytep list, unsigned int count, png_const_bytep add, int keep)
   {
      ++count;
      memcpy(list, add, 4);
-      list[4] = (png_byte)keep;
+      list[4] = png_check_byte(png_ptr, keep);
   }

   return count;
+   PNG_UNUSEDRC(png_ptr)
 }

 void PNGAPI
@@ -1451,7 +1454,7 @@ png_set_keep_unknown_chunks(png_structrp png_ptr, int keep,

      for (i=0; i<num_chunks; ++i)
      {
-         old_num_chunks = add_one_chunk(new_list, old_num_chunks,
+         old_num_chunks = add_one_chunk(png_ptr, new_list, old_num_chunks,
            chunk_list+5*i, keep);
      }

@@ -1558,6 +1561,9 @@ png_set_compression_buffer_size(png_structrp png_ptr, png_size_t size)
         }

 #ifndef __COVERITY__
+         /* Some compilers complain that this is always false.  However, it
+          * can be true when integer overflow happens.
+          */
         if (size > ZLIB_IO_MAX)
         {
            png_warning(png_ptr,
--- a/pngstruct.h
+++ b/pngstruct.h
@@ -1,12 +1,11 @@

 /* pngstruct.h - header file for PNG reference library
 *
+ * Last changed in libpng 1.7.0 [(PENDING RELEASE)]
 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
- * Last changed in libpng 1.7.0 [(PENDING RELEASE)]
- *
 * This code is released under the libpng license.
 * For conditions of distribution and use, see the disclaimer
 * and license in png.h
@@ -166,11 +165,16 @@ struct png_struct_def
    * and faster.
    */
   png_colorp  palette;        /* palette from the input file */
+   png_bytep   trans_alpha;    /* alpha values for paletted files */
+
   size_t      rowbytes;       /* size of row in bytes */
   size_t      info_rowbytes;  /* cache of updated row bytes */
   png_uint_32 width;          /* width of image in pixels */
   png_uint_32 height;         /* height of image in pixels */
   png_uint_32 num_rows;       /* number of rows in current pass */
+   /* TODO: usr_width is used in write, iwidth is used in read, the two fields
+    * could be made one.
+    */
   png_uint_32 usr_width;      /* width of row at start of write */
   png_uint_32 iwidth;         /* width of current interlaced row in pixels */
   png_uint_32 row_number;     /* current row in interlace pass */
@@ -182,7 +186,7 @@ struct png_struct_def
   png_uint_32 zowner;         /* ID (chunk type) of zstream owner, 0 if none */
   png_uint_32 free_me;        /* items libpng is responsible for freeing */

-   int         maximum_pixel_depth; /* pixel depth used for the row buffers */
+   unsigned int maximum_pixel_depth; /* pixel depth used for the row buffers */
 #ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
   int         num_palette_max;     /* maximum palette index found in IDAT */
 #endif
@@ -341,17 +345,9 @@ struct png_struct_def
   size_t    big_row_buf_size; /* Actual size of both */
 #endif

-#ifdef PNG_WRITE_SUPPORTED
-   /* This is somewhat excessive, there is no obvious reason on write to
-    * allocate a buffer for each possible filtered row, only for the one being
-    * tested and the current best.
-    *
-    * TODO: fix this
-    */
-   png_bytep sub_row;         /* buffer to save "sub" row when filtering */
-   png_bytep up_row;          /* buffer to save "up" row when filtering */
-   png_bytep avg_row;         /* buffer to save "avg" row when filtering */
-   png_bytep paeth_row;       /* buffer to save "Paeth" row when filtering */
+#ifdef PNG_WRITE_FILTER_SUPPORTED
+   png_bytep try_row;    /* buffer to save trial row when filtering */
+   png_bytep tst_row;    /* buffer to save best trial row when filtering */
 #endif

   /* UNKNOWN CHUNK HANDLING */
@@ -430,12 +426,6 @@ struct png_struct_def
 #endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */
 #endif /* READ_GAMMA */

-#if defined(PNG_READ_tRNS_SUPPORTED) || \
-   defined(PNG_READ_BACKGROUND_SUPPORTED) || \
-   defined(PNG_READ_EXPAND_SUPPORTED)
-   png_bytep trans_alpha;           /* alpha values for paletted files */
-#endif
-
   /* Integer values */
 #if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\
   defined(PNG_READ_ALPHA_MODE_SUPPORTED)
--- a/pngtest.c
+++ b/pngtest.c
@@ -1,8 +1,8 @@

 /* pngtest.c - a simple test program to test libpng
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.17 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -1701,6 +1701,8 @@ main(int argc, char *argv[])
   int multiple = 0;
   int ierror = 0;

+   png_structp dummy_ptr;
+
   fprintf(STDERR, "\n Testing libpng version %s\n", PNG_LIBPNG_VER_STRING);
   fprintf(STDERR, "   with zlib   version %s\n", ZLIB_VERSION);
   fprintf(STDERR, "%s", png_get_copyright(NULL));
@@ -1994,6 +1996,24 @@ main(int argc, char *argv[])
   else
      fprintf(STDERR, " libpng FAILS test\n");

+   dummy_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
+   fprintf(STDERR, " Default limits:\n");
+   fprintf(STDERR, "  width_max  = %lu\n",
+      (unsigned long) png_get_user_width_max(dummy_ptr));
+   fprintf(STDERR, "  height_max = %lu\n",
+      (unsigned long) png_get_user_height_max(dummy_ptr));
+   if (png_get_chunk_cache_max(dummy_ptr) == 0)
+      fprintf(STDERR, "  cache_max  = unlimited\n");
+   else
+      fprintf(STDERR, "  cache_max  = %lu\n",
+         (unsigned long) png_get_chunk_cache_max(dummy_ptr));
+   if (png_get_chunk_malloc_max(dummy_ptr) == 0)
+      fprintf(STDERR, "  malloc_max = unlimited\n");
+   else
+      fprintf(STDERR, "  malloc_max = %lu\n",
+         (unsigned long) png_get_chunk_malloc_max(dummy_ptr));
+   png_destroy_read_struct(&dummy_ptr, NULL, NULL);
+
   return (int)(ierror != 0);
 }
 #else
@@ -2008,4 +2028,4 @@ main(void)
 #endif

 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_7_0beta48 Your_png_h_is_not_version_1_7_0beta48;
+typedef png_libpng_version_1_7_0beta59 Your_png_h_is_not_version_1_7_0beta59;
--- a/pngtrans.c
+++ b/pngtrans.c
@@ -1,8 +1,8 @@

 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.17 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -12,6 +12,7 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_pngtrans

 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

@@ -138,7 +139,7 @@ png_set_filler(png_structrp png_ptr, png_uint_32 filler, int filler_loc)
          * NOTE: usr_channels is not used by the read code!  (This has led to
          * confusion in the past.)  The filler is only used in the read code.
          */
-         png_ptr->filler = (png_uint_16)filler;
+         png_ptr->filler = PNG_UINT_16(filler); /* Max bit depth is 16 */
 #     else
         png_app_error(png_ptr, "png_set_filler not supported on read");
         PNG_UNUSED(filler) /* not used in the write case */
@@ -258,90 +259,89 @@ png_set_invert_mono(png_structrp png_ptr)

 /* Invert monochrome grayscale data */
 void /* PRIVATE */
-png_do_invert(png_row_infop row_info, png_bytep row)
+png_do_invert(png_transform_controlp row_info, png_bytep row)
 {
   png_debug(1, "in png_do_invert");

+#  define png_ptr row_info->png_ptr
+
  /* This test removed from libpng version 1.0.13 and 1.2.0:
   *   if (row_info->bit_depth == 1 &&
   */
-   if (row_info->color_type == PNG_COLOR_TYPE_GRAY)
+   if (row_info->channels == 1)
   {
-      png_bytep rp = row;
-      png_size_t i;
-      png_size_t istop = row_info->rowbytes;
-
-      for (i = 0; i < istop; i++)
+      if (!(row_info->flags & PNG_INDEXED)) /* GRAY */
      {
-         *rp = (png_byte)(~(*rp));
-         rp++;
+         png_bytep rp = row + png_transform_rowbytes(row_info);
+
+         /* Don't care about the bit depth: */
+         while (rp > row)
+            *--rp ^= 0xff;
+
+         row_info->flags |= PNG_INVERTED;
      }
   }

-   else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA &&
-      row_info->bit_depth == 8)
+   else if (row_info->channels == 2) /* GRAY ALPHA */
   {
-      png_bytep rp = row;
-      png_size_t i;
-      png_size_t istop = row_info->rowbytes;
-
-      for (i = 0; i < istop; i += 2)
+      if (row_info->bit_depth == 8)
      {
-         *rp = (png_byte)(~(*rp));
-         rp += 2;
+         png_bytep rp;
+
+         row_info->flags |= PNG_INVERTED;
+         rp = row + png_transform_rowbytes(row_info);
+
+         /* Go backwards, so rp[-1] is alpha and rp[-2] is gray: */
+         while (rp >= row+2)
+            rp -= 2, *rp ^= 0xff;
      }
-   }

-#ifdef PNG_16BIT_SUPPORTED
-   else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA &&
-      row_info->bit_depth == 16)
-   {
-      png_bytep rp = row;
-      png_size_t i;
-      png_size_t istop = row_info->rowbytes;
-
-      for (i = 0; i < istop; i += 4)
+#  ifdef PNG_16BIT_SUPPORTED
+      else if (row_info->bit_depth == 16)
      {
-         *rp = (png_byte)(~(*rp));
-         *(rp + 1) = (png_byte)(~(*(rp + 1)));
-         rp += 4;
+         png_bytep rp;
+
+         row_info->flags |= PNG_INVERTED;
+         rp = row + png_transform_rowbytes(row_info);
+
+         /* The same, but now we have GGAA: */
+         while (rp >= row+4)
+            rp -= 3, *rp ^= 0xff, *--rp ^= 0xff;
      }
+#  endif
   }
-#endif
+#  undef png_ptr
 }
-#endif
+#endif /* READ_INVERT || WRITE_INVERT */

 #ifdef PNG_16BIT_SUPPORTED
 #if defined(PNG_READ_SWAP_SUPPORTED) || defined(PNG_WRITE_SWAP_SUPPORTED)
 /* Swaps byte order on 16 bit depth images */
 void /* PRIVATE */
-png_do_swap(png_row_infop row_info, png_bytep row)
+png_do_swap(png_transform_controlp row_info, png_bytep row)
 {
   png_debug(1, "in png_do_swap");

+#  define png_ptr row_info->png_ptr
+
   if (row_info->bit_depth == 16)
   {
-      png_bytep rp = row;
-      png_uint_32 i;
-      png_uint_32 istop= row_info->width * row_info->channels;
+      png_bytep rp;

-      for (i = 0; i < istop; i++, rp += 2)
+      row_info->flags |= PNG_BYTE_SWAPPED;
+      rp = row + png_transform_rowbytes(row_info);
+
+      while (rp >= row+2)
      {
-#ifdef PNG_BUILTIN_BSWAP16_SUPPORTED
-         /* Feature added to libpng-1.6.11 for testing purposes, not
-          * enabled by default.
-          */
-         *(png_uint_16*)rp = __builtin_bswap16(*(png_uint_16*)rp);
-#else
-         png_byte t = *rp;
-         *rp = *(rp + 1);
-         *(rp + 1) = t;
-#endif
+         png_byte save = *--rp;
+         *rp = rp[-1], --rp;
+         *rp = save;
      }
   }
+#  undef png_ptr
 }
-#endif
-#endif
+#endif /* READ_SWAP || WRITE_SWAP */
+#endif /* 16_BIT */

 #if defined(PNG_READ_PACKSWAP_SUPPORTED)||defined(PNG_WRITE_PACKSWAP_SUPPORTED)
 static PNG_CONST png_byte onebppswaptable[256] = {
@@ -451,16 +451,16 @@ static PNG_CONST png_byte fourbppswaptable[256] = {

 /* Swaps pixel packing order within bytes */
 void /* PRIVATE */
-png_do_packswap(png_row_infop row_info, png_bytep row)
+png_do_packswap(png_transform_controlp row_info, png_bytep row)
 {
   png_debug(1, "in png_do_packswap");

+#  define png_ptr row_info->png_ptr
+
   if (row_info->bit_depth < 8)
   {
-      png_bytep rp;
-      png_const_bytep end, table;
-
-      end = row + row_info->rowbytes;
+      png_bytep ep;
+      png_const_bytep table;

      if (row_info->bit_depth == 1)
         table = onebppswaptable;
@@ -474,11 +474,15 @@ png_do_packswap(png_row_infop row_info, png_bytep row)
      else
         return;

-      for (rp = row; rp < end; rp++)
-         *rp = table[*rp];
+      row_info->flags |= PNG_PIXEL_SWAPPED;
+      ep = row + png_transform_rowbytes(row_info);
+
+      while (row < ep)
+         *row = table[*row], ++row;
   }
+#  undef png_ptr
 }
-#endif /* PACKSWAP || WRITE_PACKSWAP */
+#endif /* READ_PACKSWAP || WRITE_PACKSWAP */

 #if defined(PNG_WRITE_FILLER_SUPPORTED) || \
    defined(PNG_READ_STRIP_ALPHA_SUPPORTED)
@@ -491,11 +495,14 @@ png_do_packswap(png_row_infop row_info, png_bytep row)
 * end (not in the middle) of each pixel.
 */
 void /* PRIVATE */
-png_do_strip_channel(png_row_infop row_info, png_bytep row, int at_start)
+png_do_strip_channel(png_transform_controlp row_info, png_bytep row,
+   int at_start)
 {
-   png_bytep sp = row; /* source pointer */
-   png_bytep dp = row; /* destination pointer */
-   png_bytep ep = row + row_info->rowbytes; /* One beyond end of row */
+   png_const_bytep sp = row; /* source pointer */
+   png_bytep       dp = row; /* destination pointer */
+   png_const_bytep ep = row + png_transform_rowbytes(row_info); /* beyond end */
+
+#  define png_ptr row_info->png_ptr

   /* At the start sp will point to the first byte to copy and dp to where
    * it is copied to.  ep always points just beyond the end of the row, so
@@ -518,8 +525,6 @@ png_do_strip_channel(png_row_infop row_info, png_bytep row, int at_start)
         /* For a 1 pixel wide image there is nothing to do */
         while (sp < ep)
            *dp++ = *sp, sp += 2;
-
-         row_info->pixel_depth = 8;
      }

      else if (row_info->bit_depth == 16)
@@ -531,18 +536,13 @@ png_do_strip_channel(png_row_infop row_info, png_bytep row, int at_start)

         while (sp < ep)
            *dp++ = *sp++, *dp++ = *sp, sp += 3;
-
-         row_info->pixel_depth = 16;
      }

      else
         return; /* bad bit depth */

      row_info->channels = 1;
-
-      /* Finally fix the color type if it records an alpha channel */
-      if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
-         row_info->color_type = PNG_COLOR_TYPE_GRAY;
+      debug(dp == row + png_transform_rowbytes(row_info));
   }

   /* RGBA, RGBX, XRGB cases */
@@ -558,8 +558,6 @@ png_do_strip_channel(png_row_infop row_info, png_bytep row, int at_start)
         /* Note that the loop adds 3 to dp and 4 to sp each time. */
         while (sp < ep)
            *dp++ = *sp++, *dp++ = *sp++, *dp++ = *sp, sp += 2;
-
-         row_info->pixel_depth = 24;
      }

      else if (row_info->bit_depth == 16)
@@ -576,104 +574,80 @@ png_do_strip_channel(png_row_infop row_info, png_bytep row, int at_start)
            *dp++ = *sp++, *dp++ = *sp++;
            *dp++ = *sp++, *dp++ = *sp, sp += 3;
         }
-
-         row_info->pixel_depth = 48;
      }

      else
         return; /* bad bit depth */

      row_info->channels = 3;
-
-      /* Finally fix the color type if it records an alpha channel */
-      if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
-         row_info->color_type = PNG_COLOR_TYPE_RGB;
+      debug(dp == row + png_transform_rowbytes(row_info));
   }

   else
      return; /* The filler channel has gone already */
-
-   /* Fix the rowbytes value. */
-   row_info->rowbytes = dp-row;
+#  undef png_ptr
 }
-#endif
+#endif /* WRITE_FILLER || READ_STRIP_ALPHA */

 #if defined(PNG_READ_BGR_SUPPORTED) || defined(PNG_WRITE_BGR_SUPPORTED)
 /* Swaps red and blue bytes within a pixel */
 void /* PRIVATE */
-png_do_bgr(png_row_infop row_info, png_bytep row)
+png_do_bgr(png_transform_controlp row_info, png_bytep row)
 {
+   unsigned int channels;
+
   png_debug(1, "in png_do_bgr");

-   if ((row_info->color_type & PNG_COLOR_MASK_COLOR) != 0)
+#  define png_ptr row_info->png_ptr
+
+   channels = row_info->channels;
+
+   if (channels == 3 || channels == 4)
   {
-      png_uint_32 row_width = row_info->width;
+      png_const_bytep ep = row + png_transform_rowbytes(row_info);
+
      if (row_info->bit_depth == 8)
      {
-         if (row_info->color_type == PNG_COLOR_TYPE_RGB)
-         {
-            png_bytep rp;
-            png_uint_32 i;
+         ep -= channels; /* Last pixel */
+         row_info->flags ^= PNG_RGB_SWAPPED;

-            for (i = 0, rp = row; i < row_width; i++, rp += 3)
-            {
-               png_byte save = *rp;
-               *rp = *(rp + 2);
-               *(rp + 2) = save;
-            }
+         while (row <= ep)
+         {
+            png_byte save = row[0];
+            row[0] = row[2];
+            row[2] = save;
+            row += channels;
         }

-         else if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
-         {
-            png_bytep rp;
-            png_uint_32 i;
-
-            for (i = 0, rp = row; i < row_width; i++, rp += 4)
-            {
-               png_byte save = *rp;
-               *rp = *(rp + 2);
-               *(rp + 2) = save;
-            }
-         }
+         debug(row == ep+channels);
      }

-#ifdef PNG_16BIT_SUPPORTED
-      else if (row_info->bit_depth == 16)
-      {
-         if (row_info->color_type == PNG_COLOR_TYPE_RGB)
+#     ifdef PNG_16BIT_SUPPORTED
+         else if (row_info->bit_depth == 16)
         {
-            png_bytep rp;
-            png_uint_32 i;
+            channels *= 2; /* now in bytes */

-            for (i = 0, rp = row; i < row_width; i++, rp += 6)
+            ep -= channels; /* Last pixel */
+            row_info->flags |= PNG_RGB_SWAPPED;
+
+            while (row <= ep)
            {
-               png_byte save = *rp;
-               *rp = *(rp + 4);
-               *(rp + 4) = save;
-               save = *(rp + 1);
-               *(rp + 1) = *(rp + 5);
-               *(rp + 5) = save;
-            }
-         }
+               png_byte save = row[0];
+               row[0] = row[4];
+               row[4] = save;

-         else if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
-         {
-            png_bytep rp;
-            png_uint_32 i;
+               save = row[1];
+               row[1] = row[5];
+               row[5] = save;

-            for (i = 0, rp = row; i < row_width; i++, rp += 8)
-            {
-               png_byte save = *rp;
-               *rp = *(rp + 4);
-               *(rp + 4) = save;
-               save = *(rp + 1);
-               *(rp + 1) = *(rp + 5);
-               *(rp + 5) = save;
+               row += channels;
            }
+
+            debug(row == ep+channels);
         }
-      }
-#endif
+#     endif
   }
+#  undef png_ptr
 }
 #endif /* READ_BGR || WRITE_BGR */

@@ -681,19 +655,24 @@ png_do_bgr(png_row_infop row_info, png_bytep row)
    defined(PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED)
 /* Added at libpng-1.5.10 */
 void /* PRIVATE */
-png_do_check_palette_indexes(png_structrp png_ptr, png_row_infop row_info)
+png_do_check_palette_indexes(png_structrp png_ptr,
+   png_transform_controlp row_info)
 {
   if (png_ptr->num_palette < (1 << row_info->bit_depth) &&
      png_ptr->num_palette > 0) /* num_palette can be 0 in MNG files */
   {
-      /* Calculations moved outside switch in an attempt to stop different
-       * compiler warnings.  'padding' is in *bits* within the last byte, it is
-       * an 'int' because pixel_depth becomes an 'int' in the expression below,
-       * and this calculation is used because it avoids warnings that other
-       * forms produced on either GCC or MSVC.
+      /* Padding is the unused bits in the last byte: 8 - bits-in-last-byte,
+       * which reduces to 7 & (-total_bits), so we don't care about overflow
+       * in the unsigned calculation here:
+       */
+      unsigned int padding =
+         7 & -(row_info->bit_depth * row_info->channels * row_info->width);
+      png_bytep rp = png_ptr->row_buf + png_transform_rowbytes(row_info);
+
+      /* Note that png_ptr->row_buf starts with a filter byte, so rp is
+       * currently pointing to the last byte in the row, not just after
+       * it.
       */
-      int padding = (-row_info->pixel_depth * row_info->width) & 7;
-      png_bytep rp = png_ptr->row_buf + row_info->rowbytes;

      switch (row_info->bit_depth)
      {
@@ -704,7 +683,7 @@ png_do_check_palette_indexes(png_structrp png_ptr, png_row_infop row_info)
             */
            for (; rp > png_ptr->row_buf; rp--)
            {
-              if (*rp >> padding != 0)
+              if ((*rp >> padding) != 0)
                 png_ptr->num_palette_max = 1;
              padding = 0;
            }
@@ -780,6 +759,136 @@ png_do_check_palette_indexes(png_structrp png_ptr, png_row_infop row_info)
 }
 #endif /* CHECK_FOR_INVALID_INDEX */

+#if defined(PNG_READ_TRANSFORMS_SUPPORTED) ||\
+    defined(PNG_WRITE_TRANSFORMS_SUPPORTED)
+/* Utility functions: */
+void
+png_init_transform_control(png_const_structrp png_ptr,
+   png_transform_controlp out, png_const_row_infop row_info)
+{
+   out->png_ptr = png_ptr;
+
+   /* At the start expect row_info to be consistent with png_ptr: */
+   if (png_ptr->mode & PNG_IS_READ_STRUCT)
+   {
+      debug(png_ptr->iwidth == row_info->width);
+      debug(png_ptr->color_type == row_info->color_type);
+      debug(png_ptr->bit_depth == row_info->bit_depth);
+   }
+
+   out->width = row_info->width;
+   out->flags = 0;
+   out->bit_depth = row_info->bit_depth;
+
+   switch (row_info->color_type)
+   {
+      case PNG_COLOR_TYPE_GRAY:
+         out->channels = 1;
+         break;
+
+      case PNG_COLOR_TYPE_GRAY_ALPHA:
+         out->channels = 2;
+         break;
+
+      case PNG_COLOR_TYPE_PALETTE:
+         affirm(!(png_ptr->mode & PNG_IS_READ_STRUCT) ||
+            png_ptr->palette != NULL);
+         out->flags |= PNG_INDEXED;
+         out->channels = 1;
+         break;
+
+      case PNG_COLOR_TYPE_RGB:
+         out->channels = 3;
+         break;
+
+      case PNG_COLOR_TYPE_RGB_ALPHA:
+         out->channels = 4;
+         break;
+
+      default:
+         impossible("invalid PNG color type");
+   } 
+}
+
+size_t
+png_transform_rowbytes(png_const_transform_controlp row_info)
+{
+#  define png_ptr row_info->png_ptr
+   /* For this not to overflow the pixel depth calculation must not overflow
+    * and the pixel depth must be less than maximum_pixel_depth.
+    */
+   /* The release code uses PNG_ROWBYTES, so make sure that it will not
+    * overflow.  To test this it is necessary to generate some very wide
+    * images and ensure that the code errors out before getting here.
+    */
+   unsigned int channels = row_info->channels;
+   unsigned int bit_depth = row_info->bit_depth;
+   unsigned int pixel_bits = channels * bit_depth;
+   size_t width = row_info->width;
+
+   affirm(bit_depth < 256 && channels < 256 &&
+      pixel_bits <= png_ptr->maximum_pixel_depth);
+
+   return PNG_ROWBYTES(pixel_bits, width);
+#  undef png_ptr
+}
+
+static unsigned int
+transform_color_type(png_const_transform_controlp row_info)
+{
+   const unsigned int ch = row_info->channels - 1;
+   const unsigned int indexed = row_info->flags & PNG_INDEXED;
+
+   /* That is 0, 1, 2, 3 for G/PALETTE, GA, RGB, RGBA.  Check the
+    * numbers:
+    */
+#  if PNG_INDEXED != PNG_COLOR_MASK_PALETTE ||\
+      PNG_FILLER_IN_ALPHA != PNG_COLOR_MASK_ALPHA ||\
+      PNG_COLOR_MASK_PALETTE != 1 ||\
+      PNG_COLOR_MASK_COLOR != 2 ||\
+      PNG_COLOR_MASK_ALPHA != 4
+#     error Unexpected PNG color type defines
+#  endif
+
+   /* The following preserves all the bits in row_info->channels except the
+    * top bit and generates a correct PNG color type for the defined values
+    * and an incorrect one for all undefined cases.
+    *
+    * Note that when PNG_FILLER_IN_ALPHA is set in the flags
+    */
+   return indexed /*PALETTE*/ |
+          ((ch & 2) ^ (indexed << 1) /*COLOR*/) |
+          (((ch & 1) << 2/*ALPHA*/) & ~row_info->flags) |
+          ((ch & ~3) << 1 /*INVALID*/);
+}
+
+void
+png_end_transform_control(png_row_infop out, png_const_transform_controlp in)
+{
+#  define png_ptr in->png_ptr /* for affirm/impossible */
+   out->width = in->width;
+   out->rowbytes = png_transform_rowbytes(in);
+
+   out->color_type = png_check_byte(png_ptr, transform_color_type(in));
+   out->bit_depth = png_check_byte(png_ptr, in->bit_depth);
+   out->channels = png_check_byte(png_ptr, in->channels);
+   out->pixel_depth = png_check_byte(png_ptr, in->channels * in->bit_depth);
+
+#  ifdef PNG_WARNINGS_SUPPORTED
+      if ((in->flags & PNG_BAD_INDEX) != 0)
+         png_warning(png_ptr, "palette image had bad index");
+#  endif
+
+   /* At the end expect row_info to be consistent with png_ptr: */
+   if (!(png_ptr->mode & PNG_IS_READ_STRUCT))
+   {
+      debug(png_ptr->color_type == out->color_type);
+      debug(png_ptr->bit_depth == out->bit_depth);
+   }
+#  undef png_ptr
+}
+#endif /* READ_TRANSFORMS | WRITE_TRANSFORMS */
+
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
    defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
 #ifdef PNG_USER_TRANSFORM_PTR_SUPPORTED
@@ -803,8 +912,10 @@ png_set_user_transform_info(png_structrp png_ptr, png_voidp
 #endif

   png_ptr->user_transform_ptr = user_transform_ptr;
-   png_ptr->user_transform_depth = (png_byte)user_transform_depth;
-   png_ptr->user_transform_channels = (png_byte)user_transform_channels;
+   png_ptr->user_transform_depth = png_check_byte(png_ptr,
+      user_transform_depth);
+   png_ptr->user_transform_channels = png_check_byte(png_ptr,
+      user_transform_channels);
 }
 #endif

--- a/pngusr.dfa
+++ b/pngusr.dfa
@@ -12,4 +12,4 @@
 # @# define PNG_USER_WIDTH_MAX 65535
 # @# define PNG_USER_HEIGHT_MAX 65535
 # @# define PNG_USER_CHUNK_CACHE_MAX 256
-# @# define PNG_USER_CHUNK_MALLOC_MAX 1000000
+# @# define PNG_USER_CHUNK_MALLOC_MAX 640000
--- a/pngwio.c
+++ b/pngwio.c
@@ -19,6 +19,7 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_pngwio

 #ifdef PNG_WRITE_SUPPORTED

--- a/pngwrite.c
+++ b/pngwrite.c
@@ -2,7 +2,7 @@
 /* pngwrite.c - general routines to write a PNG file
 *
 * Last changed in libpng 1.7.0 [(PENDING RELEASE)]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -15,6 +15,7 @@
 #if defined(PNG_SIMPLIFIED_WRITE_SUPPORTED) && defined(PNG_STDIO_SUPPORTED)
 #  include <errno.h>
 #endif
+#define PNG_SRC_FILE PNG_SRC_FILE_pngwrite

 #ifdef PNG_WRITE_SUPPORTED

@@ -224,7 +225,7 @@ png_write_info(png_structrp png_ptr, png_const_inforp info_ptr)

         for (j = 0; j<jend; ++j)
            info_ptr->trans_alpha[j] =
-               (png_byte)(255 - info_ptr->trans_alpha[j]);
+               png_check_byte(png_ptr, 255 - info_ptr->trans_alpha[j]);
      }
 #endif
      png_write_tRNS(png_ptr, info_ptr->trans_alpha, &(info_ptr->trans_color),
@@ -460,12 +461,12 @@ png_convert_from_struct_tm(png_timep ptime, PNG_CONST struct tm * ttime)
 {
   png_debug(1, "in png_convert_from_struct_tm");

-   ptime->year = (png_uint_16)(1900 + ttime->tm_year);
-   ptime->month = (png_byte)(ttime->tm_mon + 1);
-   ptime->day = (png_byte)ttime->tm_mday;
-   ptime->hour = (png_byte)ttime->tm_hour;
-   ptime->minute = (png_byte)ttime->tm_min;
-   ptime->second = (png_byte)ttime->tm_sec;
+   ptime->year = png_check_u16(0/*TODO: fixme*/, 1900 + ttime->tm_year);
+   ptime->month = png_check_byte(0/*TODO: fixme*/, ttime->tm_mon + 1);
+   ptime->day = png_check_byte(0/*TODO: fixme*/, ttime->tm_mday);
+   ptime->hour = png_check_byte(0/*TODO: fixme*/, ttime->tm_hour);
+   ptime->minute = png_check_byte(0/*TODO: fixme*/, ttime->tm_min);
+   ptime->second = png_check_byte(0/*TODO: fixme*/, ttime->tm_sec);
 }

 void PNGAPI
@@ -487,7 +488,7 @@ png_create_write_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
 {
 #ifndef PNG_USER_MEM_SUPPORTED
   png_structrp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
-      error_fn, warn_fn, NULL, NULL, NULL);
+       error_fn, warn_fn, NULL, NULL, NULL);
 #else
   return png_create_write_struct_2(user_png_ver, error_ptr, error_fn,
       warn_fn, NULL, NULL, NULL);
@@ -500,7 +501,7 @@ png_create_write_struct_2,(png_const_charp user_png_ver, png_voidp error_ptr,
    png_malloc_ptr malloc_fn, png_free_ptr free_fn),PNG_ALLOCATED)
 {
   png_structrp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
-      error_fn, warn_fn, mem_ptr, malloc_fn, free_fn);
+       error_fn, warn_fn, mem_ptr, malloc_fn, free_fn);
 #endif /* USER_MEM */

   if (png_ptr != NULL)
@@ -534,17 +535,17 @@ png_create_write_struct_2,(png_const_charp user_png_ver, png_voidp error_ptr,
       * applications that must not fail to write at all costs!
       */
 #ifdef PNG_BENIGN_WRITE_ERRORS_SUPPORTED
-      png_ptr->flags |= PNG_FLAG_BENIGN_ERRORS_WARN;
      /* In stable builds only warn if an application error can be completely
       * handled.
       */
+      png_ptr->flags |= PNG_FLAG_BENIGN_ERRORS_WARN;
 #endif

      /* App warnings are warnings in release (or release candidate) builds but
       * are errors during development.
       */
-#if PNG_LIBPNG_BUILD_BASE_TYPE >= PNG_LIBPNG_BUILD_RC
-         png_ptr->flags |= PNG_FLAG_APP_WARNINGS_WARN;
+#if PNG_RELEASE_BUILD
+      png_ptr->flags |= PNG_FLAG_APP_WARNINGS_WARN;
 #endif

      /* TODO: delay this, it can be done in png_init_io() (if the app doesn't
@@ -668,12 +669,12 @@ png_do_write_intrapixel(png_row_infop row_info, png_bytep row)
            png_uint_32 s0   = (*(rp    ) << 8) | *(rp + 1);
            png_uint_32 s1   = (*(rp + 2) << 8) | *(rp + 3);
            png_uint_32 s2   = (*(rp + 4) << 8) | *(rp + 5);
-            png_uint_32 red  = (png_uint_32)((s0 - s1) & 0xffffL);
-            png_uint_32 blue = (png_uint_32)((s2 - s1) & 0xffffL);
-            *(rp    ) = (png_byte)((red >> 8) & 0xff);
-            *(rp + 1) = (png_byte)(red & 0xff);
-            *(rp + 4) = (png_byte)((blue >> 8) & 0xff);
-            *(rp + 5) = (png_byte)(blue & 0xff);
+            png_uint_32 red  = (s0 - s1) & 0xffff;
+            png_uint_32 blue = (s2 - s1) & 0xffff;
+            *(rp    ) = png_check_byte(0/*TODO: fixme*/, red >> 8);
+            *(rp + 1) = PNG_BYTE(red);
+            *(rp + 4) = png_check_byte(0/*TODO: fixme*/, blue >> 8);
+            *(rp + 5) = PNG_BYTE(blue);
         }
      }
 #endif /* WRITE_16BIT */
@@ -816,7 +817,8 @@ png_write_row(png_structrp png_ptr, png_const_bytep row)
   row_info.width = png_ptr->usr_width;
   row_info.channels = png_ptr->usr_channels;
   row_info.bit_depth = png_ptr->usr_bit_depth;
-   row_info.pixel_depth = (png_byte)(row_info.bit_depth * row_info.channels);
+   row_info.pixel_depth =
+       png_check_byte(png_ptr, row_info.bit_depth * row_info.channels);
   row_info.rowbytes = PNG_ROWBYTES(row_info.pixel_depth, row_info.width);

   png_debug1(3, "row_info->color_type = %d", row_info.color_type);
@@ -880,7 +882,12 @@ png_write_row(png_structrp png_ptr, png_const_bytep row)
   /* Check for out-of-range palette index */
   if (row_info.color_type == PNG_COLOR_TYPE_PALETTE &&
       png_ptr->num_palette_max >= 0)
-      png_do_check_palette_indexes(png_ptr, &row_info);
+   {
+      png_transform_control display;
+
+      png_init_transform_control(png_ptr, &display, &row_info);
+      png_do_check_palette_indexes(png_ptr, &display);
+   }
 #endif

   /* Find a filter if necessary, filter the row and write it out. */
@@ -942,15 +949,11 @@ png_write_destroy(png_structrp png_ptr)
   png_ptr->row_buf = NULL;
 #ifdef PNG_WRITE_FILTER_SUPPORTED
   png_free(png_ptr, png_ptr->prev_row);
-   png_free(png_ptr, png_ptr->sub_row);
-   png_free(png_ptr, png_ptr->up_row);
-   png_free(png_ptr, png_ptr->avg_row);
-   png_free(png_ptr, png_ptr->paeth_row);
+   png_free(png_ptr, png_ptr->try_row);
+   png_free(png_ptr, png_ptr->tst_row);
   png_ptr->prev_row = NULL;
-   png_ptr->sub_row = NULL;
-   png_ptr->up_row = NULL;
-   png_ptr->avg_row = NULL;
-   png_ptr->paeth_row = NULL;
+   png_ptr->try_row = NULL;
+   png_ptr->tst_row = NULL;
 #endif

 #ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED
@@ -1065,8 +1068,8 @@ png_set_filter(png_structrp png_ptr, int method, int filters)
       * it is too late to start using the filters that need it, since we
       * will be missing the data in the previous row.  If an application
       * wants to start and stop using particular filters during compression,
-       * it should start out with all of the filters, and then add and
-       * remove them after the start of compression.
+       * it should start out with all of the filters, and then remove them
+       * or add them back after the start of compression.
       *
       * NOTE: this is a nasty constraint on the code, because it means that the
       * prev_row buffer must be maintained even if there are currently no
@@ -1105,7 +1108,7 @@ png_set_filter(png_structrp png_ptr, int method, int filters)
    * TODO: this field could probably be removed if neither READ nor
    * WRITE_FILTER are supported.
    */
-   png_ptr->do_filter = (png_byte)filters; /* SAFE: checked above */
+   png_ptr->do_filter = png_check_byte(png_ptr, filters);
 }

 /* This allows us to influence the way in which libpng chooses the "best"
@@ -1192,7 +1195,7 @@ png_init_filter_heuristics(png_structrp png_ptr, int heuristic_method,
         }

         /* Safe to set this now */
-         png_ptr->num_prev_filters = (png_byte)num_weights;
+         png_ptr->num_prev_filters = png_check_byte(png_ptr, num_weights);
      }

      /* If, in the future, there are other filter methods, this would
@@ -1233,6 +1236,20 @@ png_init_filter_heuristics(png_structrp png_ptr, int heuristic_method,

 /* Provide floating and fixed point APIs */
 #ifdef PNG_FLOATING_POINT_SUPPORTED
+static png_uint_16
+u16_from_fp(png_const_structrp png_ptr, int position, double fp)
+{
+    /* Utility: given a double make sure it fits into a PNG 16-bit unsigned
+     * value.
+     */
+    if (fp >= 0 && fp < 65536)
+        return (png_uint_16)/*SAFE*/fp;
+
+    png_affirm(png_ptr, param_deb("fp to u16 overflow") position);
+}
+
+#define u16_from_fp(pp, fp) (u16_from_fp((pp), PNG_SRC_LINE, (fp)))
+
 void PNGAPI
 png_set_filter_heuristics(png_structrp png_ptr, int heuristic_method,
    int num_weights, png_const_doublep filter_weights,
@@ -1261,10 +1278,10 @@ png_set_filter_heuristics(png_structrp png_ptr, int heuristic_method,
         else
         {
            png_ptr->inv_filter_weights[i] =
-                (png_uint_16)(PNG_WEIGHT_FACTOR*filter_weights[i]+.5);
+                u16_from_fp(png_ptr, PNG_WEIGHT_FACTOR*filter_weights[i]+.5);

            png_ptr->filter_weights[i] =
-                (png_uint_16)(PNG_WEIGHT_FACTOR/filter_weights[i]+.5);
+                u16_from_fp(png_ptr, PNG_WEIGHT_FACTOR/filter_weights[i]+.5);
         }
      }

@@ -1278,10 +1295,10 @@ png_set_filter_heuristics(png_structrp png_ptr, int heuristic_method,
      for (i = 0; i < PNG_FILTER_VALUE_LAST; i++) if (filter_costs[i] >= 1.0)
      {
         png_ptr->inv_filter_costs[i] =
-             (png_uint_16)(PNG_COST_FACTOR / filter_costs[i] + .5);
+             u16_from_fp(png_ptr, PNG_COST_FACTOR / filter_costs[i] + .5);

         png_ptr->filter_costs[i] =
-             (png_uint_16)(PNG_COST_FACTOR * filter_costs[i] + .5);
+             u16_from_fp(png_ptr, PNG_COST_FACTOR * filter_costs[i] + .5);
      }
   }
 }
@@ -1315,11 +1332,12 @@ png_set_filter_heuristics_fixed(png_structrp png_ptr, int heuristic_method,

         else
         {
-            png_ptr->inv_filter_weights[i] = (png_uint_16)
-               ((PNG_WEIGHT_FACTOR*filter_weights[i]+PNG_FP_HALF)/PNG_FP_1);
+            png_ptr->inv_filter_weights[i] = png_check_u16(png_ptr,
+               (PNG_WEIGHT_FACTOR*filter_weights[i]+PNG_FP_HALF)/PNG_FP_1);

-            png_ptr->filter_weights[i] = (png_uint_16)((PNG_WEIGHT_FACTOR*
-               PNG_FP_1+(filter_weights[i]/2))/filter_weights[i]);
+            png_ptr->filter_weights[i] = png_check_u16(png_ptr,
+               (PNG_WEIGHT_FACTOR*PNG_FP_1+(filter_weights[i]/2))/
+                  filter_weights[i]);
         }
      }

@@ -1342,18 +1360,19 @@ png_set_filter_heuristics_fixed(png_structrp png_ptr, int heuristic_method,
         tmp = PNG_COST_FACTOR*PNG_FP_1 + (filter_costs[i]/2);
         tmp /= filter_costs[i];

-         png_ptr->inv_filter_costs[i] = (png_uint_16)tmp;
+         png_ptr->inv_filter_costs[i] = png_check_u16(png_ptr, tmp);

         tmp = PNG_COST_FACTOR * filter_costs[i] + PNG_FP_HALF;
         tmp /= PNG_FP_1;

-         png_ptr->filter_costs[i] = (png_uint_16)tmp;
+         png_ptr->filter_costs[i] = png_check_u16(png_ptr, tmp);
      }
   }
 }
 #endif /* FIXED_POINT */
 #endif /* WRITE_WEIGHTED_FILTER */

+#ifdef PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED
 void PNGAPI
 png_set_compression_level(png_structrp png_ptr, int level)
 {
@@ -1399,8 +1418,8 @@ png_set_compression_window_bits(png_structrp png_ptr, int window_bits)
   if (png_ptr == NULL)
      return;

-   /* Prior to 1.6.0 this would warn but then set the window_bits value, this
-    * meant that negative window bits values could be selected which would cause
+   /* Prior to 1.6.0 this would warn but then set the window_bits value. This
+    * meant that negative window bits values could be selected that would cause
    * libpng to write a non-standard PNG file with raw deflate or gzip
    * compressed IDAT or ancillary chunks.  Such files can be read and there is
    * no warning on read, so this seems like a very bad idea.
@@ -1436,6 +1455,7 @@ png_set_compression_method(png_structrp png_ptr, int method)

   png_ptr->zlib_method = method;
 }
+#endif /* WRITE_CUSTOMIZE_COMPRESSION */

 /* The following were added to libpng-1.5.4 */
 #ifdef PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED
@@ -1732,7 +1752,7 @@ png_write_image_16bit(png_voidp argument)
      display->first_row);
   png_uint_16p output_row = png_voidcast(png_uint_16p, display->local_row);
   png_uint_16p row_end;
-   const int channels = (image->format & PNG_FORMAT_FLAG_COLOR) ? 3 : 1;
+   const int channels = (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
   int aindex = 0;
   png_uint_32 y = image->height;

@@ -1803,7 +1823,7 @@ png_write_image_16bit(png_voidp argument)
            {
               png_uint_32 calc = component * reciprocal;
               calc += 16384; /* round to nearest */
-               component = (png_uint_16)(calc >> 15);
+               component = png_check_u16(png_ptr, calc >> 15);
            }

            *out_ptr++ = component;
@@ -1833,8 +1853,8 @@ png_write_image_16bit(png_voidp argument)
 #define UNP_RECIPROCAL(alpha) ((((0xffff*0xff)<<7)+(alpha>>1))/alpha)

 static png_byte
-png_unpremultiply(png_uint_32 component, png_uint_32 alpha,
-   png_uint_32 reciprocal/*from the above macro*/)
+png_unpremultiply(png_const_structrp png_ptr, png_uint_32 component,
+   png_uint_32 alpha, png_uint_32 reciprocal/*from the above macro*/)
 {
   /* The following gives 1.0 for an alpha of 0, which is fine, otherwise if 0/0
    * is represented as some other value there is more likely to be a
@@ -1870,11 +1890,13 @@ png_unpremultiply(png_uint_32 component, png_uint_32 alpha,
         component *= 255;

      /* Convert the component to sRGB. */
-      return (png_byte)PNG_sRGB_FROM_LINEAR(component);
+      return PNG_sRGB_FROM_LINEAR(png_ptr, component);
   }

   else
      return 0;
+
+   PNG_UNUSEDRC(png_ptr)
 }

 static int
@@ -1889,7 +1911,7 @@ png_write_image_8bit(png_voidp argument)
      display->first_row);
   png_bytep output_row = png_voidcast(png_bytep, display->local_row);
   png_uint_32 y = image->height;
-   const int channels = (image->format & PNG_FORMAT_FLAG_COLOR) ? 3 : 1;
+   const int channels = (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;

   if ((image->format & PNG_FORMAT_FLAG_ALPHA) != 0)
   {
@@ -1919,7 +1941,7 @@ png_write_image_8bit(png_voidp argument)
         while (out_ptr < row_end)
         {
            png_uint_16 alpha = in_ptr[aindex];
-            png_byte alphabyte = (png_byte)PNG_DIV257(alpha);
+            png_byte alphabyte = png_check_byte(png_ptr, PNG_DIV257(alpha));
            png_uint_32 reciprocal = 0;
            int c;

@@ -1931,7 +1953,8 @@ png_write_image_8bit(png_voidp argument)

            c = channels;
            do /* always at least one channel */
-               *out_ptr++ = png_unpremultiply(*in_ptr++, alpha, reciprocal);
+               *out_ptr++ = png_unpremultiply(png_ptr, *in_ptr++, alpha,
+                  reciprocal);
            while (--c > 0);

            /* Skip to next component (skip the intervening alpha channel) */
@@ -1962,7 +1985,7 @@ png_write_image_8bit(png_voidp argument)
            png_uint_32 component = *in_ptr++;

            component *= 255;
-            *out_ptr++ = (png_byte)PNG_sRGB_FROM_LINEAR(component);
+            *out_ptr++ = PNG_sRGB_FROM_LINEAR(png_ptr, component);
         }

         png_write_row(png_ptr, output_row);
@@ -1994,7 +2017,7 @@ png_image_set_PLTE(png_image_write_control *display)
 #  endif

 #  ifdef PNG_FORMAT_BGR_SUPPORTED
-      const int bgr = (format & PNG_FORMAT_FLAG_BGR) ? 2 : 0;
+      const int bgr = (format & PNG_FORMAT_FLAG_BGR) != 0 ? 2 : 0;
 #  else
 #     define bgr 0
 #  endif
@@ -2021,23 +2044,25 @@ png_image_set_PLTE(png_image_write_control *display)
         {
            if (channels >= 3) /* RGB */
            {
-               palette[i].blue = (png_byte)PNG_sRGB_FROM_LINEAR(255 *
-                  entry[(2 ^ bgr)]);
-               palette[i].green = (png_byte)PNG_sRGB_FROM_LINEAR(255 *
-                  entry[1]);
-               palette[i].red = (png_byte)PNG_sRGB_FROM_LINEAR(255 *
-                  entry[bgr]);
+               palette[i].blue = PNG_sRGB_FROM_LINEAR(
+                  display->image->opaque->png_ptr, 255 * entry[(2 ^ bgr)]);
+               palette[i].green = PNG_sRGB_FROM_LINEAR(
+                  display->image->opaque->png_ptr, 255 * entry[1]);
+               palette[i].red = PNG_sRGB_FROM_LINEAR(
+                  display->image->opaque->png_ptr, 255 * entry[bgr]);
            }

            else /* Gray */
               palette[i].blue = palette[i].red = palette[i].green =
-                  (png_byte)PNG_sRGB_FROM_LINEAR(255 * *entry);
+                  PNG_sRGB_FROM_LINEAR(display->image->opaque->png_ptr,
+                     255 * *entry);
         }

         else /* alpha */
         {
            png_uint_16 alpha = entry[afirst ? 0 : channels-1];
-            png_byte alphabyte = (png_byte)PNG_DIV257(alpha);
+            png_byte alphabyte = png_check_byte(
+               display->image->opaque->png_ptr, PNG_DIV257(alpha));
            png_uint_32 reciprocal = 0;

            /* Calculate a reciprocal, as in the png_write_image_8bit code above
@@ -2053,17 +2078,21 @@ png_image_set_PLTE(png_image_write_control *display)

            if (channels >= 3) /* RGB */
            {
-               palette[i].blue = png_unpremultiply(entry[afirst + (2 ^ bgr)],
+               palette[i].blue = png_unpremultiply(
+                  display->image->opaque->png_ptr, entry[afirst + (2 ^ bgr)],
                  alpha, reciprocal);
-               palette[i].green = png_unpremultiply(entry[afirst + 1], alpha,
+               palette[i].green = png_unpremultiply(
+                  display->image->opaque->png_ptr, entry[afirst + 1], alpha,
                  reciprocal);
-               palette[i].red = png_unpremultiply(entry[afirst + bgr], alpha,
+               palette[i].red = png_unpremultiply(
+                  display->image->opaque->png_ptr, entry[afirst + bgr], alpha,
                  reciprocal);
            }

            else /* gray */
               palette[i].blue = palette[i].red = palette[i].green =
-                  png_unpremultiply(entry[afirst], alpha, reciprocal);
+                  png_unpremultiply(display->image->opaque->png_ptr,
+                     entry[afirst], alpha, reciprocal);
         }
      }

@@ -2129,10 +2158,11 @@ png_image_write_main(png_voidp argument)
   png_inforp info_ptr = image->opaque->info_ptr;
   png_uint_32 format = image->format;

-   int colormap = (format & PNG_FORMAT_FLAG_COLORMAP) != 0;
-   int linear = !colormap && (format & PNG_FORMAT_FLAG_LINEAR) != 0; /* input */
-   int alpha = !colormap && (format & PNG_FORMAT_FLAG_ALPHA) != 0;
-   int write_16bit = linear && !colormap && !display->convert_to_8bit;
+   /* The following four ints are actually booleans */
+   int colormap = (format & PNG_FORMAT_FLAG_COLORMAP);
+   int linear = !colormap && (format & PNG_FORMAT_FLAG_LINEAR); /* input */
+   int alpha = !colormap && (format & PNG_FORMAT_FLAG_ALPHA);
+   int write_16bit = linear && !colormap && (display->convert_to_8bit == 0);

 #  ifdef PNG_BENIGN_ERRORS_SUPPORTED
      /* Make sure we error out on any bad situation */
@@ -2219,7 +2249,7 @@ png_image_write_main(png_voidp argument)
 #  ifdef PNG_SIMPLIFIED_WRITE_BGR_SUPPORTED
      if ((format & PNG_FORMAT_FLAG_BGR) != 0)
      {
-         if (!colormap && (format & PNG_FORMAT_FLAG_COLOR) != 0)
+         if (colormap == 0 && (format & PNG_FORMAT_FLAG_COLOR) != 0)
            png_set_bgr(png_ptr);
         format &= ~PNG_FORMAT_FLAG_BGR;
      }
@@ -2228,7 +2258,7 @@ png_image_write_main(png_voidp argument)
 #  ifdef PNG_SIMPLIFIED_WRITE_AFIRST_SUPPORTED
      if ((format & PNG_FORMAT_FLAG_AFIRST) != 0)
      {
-         if (!colormap && (format & PNG_FORMAT_FLAG_ALPHA) != 0)
+         if (colormap == 0 && (format & PNG_FORMAT_FLAG_ALPHA) != 0)
            png_set_swap_alpha(png_ptr);
         format &= ~PNG_FORMAT_FLAG_AFIRST;
      }
@@ -2268,14 +2298,17 @@ png_image_write_main(png_voidp argument)
       * it about 50 times.  The speed-up in pngstest was about 10-20% of the
       * total (user) time on a heavily loaded system.
       */
+#ifdef PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED
      png_set_compression_level(png_ptr, 3);
+#endif
   }

   /* Check for the cases that currently require a pre-transform on the row
    * before it is written.  This only applies when the input is 16-bit and
    * either there is an alpha channel or it is converted to 8-bit.
    */
-   if ((linear && alpha) || (!colormap && display->convert_to_8bit))
+   if ((linear != 0 && alpha != 0 ) ||
+       (colormap == 0 && display->convert_to_8bit != 0))
   {
      png_bytep row = png_voidcast(png_bytep, png_malloc(png_ptr,
         png_get_rowbytes(png_ptr, info_ptr)));
--- a/pngwtran.c
+++ b/pngwtran.c
@@ -1,8 +1,8 @@

 /* pngwtran.c - transforms the data in a row for PNG writers
 *
- * Last changed in libpng 1.6.15 [November 20, 2014]
- * Copyright (c) 1998-2014 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.17 [(PENDING RELEASE)]
+ * Copyright (c) 1998-2015 Glenn Randers-Pehrson
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
 *
@@ -12,149 +12,116 @@
 */

 #include "pngpriv.h"
+#define PNG_SRC_FILE PNG_SRC_FILE_pngwtran

 #ifdef PNG_WRITE_SUPPORTED
 #ifdef PNG_WRITE_TRANSFORMS_SUPPORTED

 #ifdef PNG_WRITE_PACK_SUPPORTED
-/* Pack pixels into bytes.  Pass the true bit depth in bit_depth.  The
+/* Pack pixels into bytes.  Get the true bit depth from png_ptr.  The
 * row_info bit depth should be 8 (one pixel per byte).  The channels
 * should be 1 (this only happens on grayscale and paletted images).
 */
 static void
-png_do_pack(png_row_infop row_info, png_bytep row, png_uint_32 bit_depth)
+png_do_pack(png_transform_controlp row_info, png_bytep row)
 {
   png_debug(1, "in png_do_pack");

-   if (row_info->bit_depth == 8 &&
-      row_info->channels == 1)
+#  define png_ptr row_info->png_ptr
+
+   /* The comment suggests the following must be true.
+    * TODO: test this.
+    */
+   affirm(row_info->bit_depth == 8 && row_info->channels == 1);
+
   {
-      switch ((int)bit_depth)
+      switch (png_ptr->bit_depth)
      {
         case 1:
         {
-            png_bytep sp, dp;
-            int mask, v;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info);
+            png_bytep dp = row;
+            unsigned int mask = 0x80, v = 0;

-            sp = row;
-            dp = row;
-            mask = 0x80;
-            v = 0;
-
-            for (i = 0; i < row_width; i++)
+            while (row < ep)
            {
-               if (*sp != 0)
+               if (*row++ != 0)
                  v |= mask;

-               sp++;
+               mask >>= 1;

-               if (mask > 1)
-                  mask >>= 1;
-
-               else
+               if (mask == 0)
               {
                  mask = 0x80;
-                  *dp = (png_byte)v;
-                  dp++;
+                  *dp++ = (png_byte)/*SAFE*/v;
                  v = 0;
               }
            }

            if (mask != 0x80)
-               *dp = (png_byte)v;
+               *dp++ = (png_byte)/*SAFE*/v;

+            row_info->bit_depth = 1;
            break;
         }

         case 2:
         {
-            png_bytep sp, dp;
-            int shift, v;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info);
+            png_bytep dp = row;
+            unsigned int shift = 8, v = 0;

-            sp = row;
-            dp = row;
-            shift = 6;
-            v = 0;
-
-            for (i = 0; i < row_width; i++)
+            while (row < ep)
            {
-               png_byte value;
-
-               value = (png_byte)(*sp & 0x03);
-               v |= (value << shift);
+               shift -= 2;
+               v |= (*row++ & 0x3) << shift;

               if (shift == 0)
               {
-                  shift = 6;
-                  *dp = (png_byte)v;
-                  dp++;
+                  shift = 8;
+                  *dp++ = png_check_byte(png_ptr, v);
                  v = 0;
               }
-
-               else
-                  shift -= 2;
-
-               sp++;
            }

-            if (shift != 6)
-               *dp = (png_byte)v;
+            if (shift != 8)
+               *dp++ = png_check_byte(png_ptr, v);

+            row_info->bit_depth = 2;
            break;
         }

         case 4:
         {
-            png_bytep sp, dp;
-            int shift, v;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info);
+            png_bytep dp = row;
+            unsigned int shift = 8, v = 0;

-            sp = row;
-            dp = row;
-            shift = 4;
-            v = 0;
-
-            for (i = 0; i < row_width; i++)
+            while (row < ep)
            {
-               png_byte value;
-
-               value = (png_byte)(*sp & 0x0f);
-               v |= (value << shift);
+               shift -= 4;
+               v |= ((*row++ & 0xf) << shift);

               if (shift == 0)
               {
-                  shift = 4;
-                  *dp = (png_byte)v;
-                  dp++;
+                  shift = 8;
+                  *dp++ = png_check_byte(png_ptr, v);
                  v = 0;
               }
-
-               else
-                  shift -= 4;
-
-               sp++;
            }

-            if (shift != 4)
-               *dp = (png_byte)v;
+            if (shift != 8)
+               *dp++ = png_check_byte(png_ptr, v);

+            row_info->bit_depth = 4;
            break;
         }

         default:
            break;
      }
-
-      row_info->bit_depth = (png_byte)bit_depth;
-      row_info->pixel_depth = (png_byte)(bit_depth * row_info->channels);
-      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
-          row_info->width);
   }
+#  undef png_ptr
 }
 #endif

@@ -165,19 +132,26 @@ png_do_pack(png_row_infop row_info, png_bytep row, png_uint_32 bit_depth)
 * bit depth 4, but the pixels only had values from 0 to 7, you
 * would pass 3 as bit_depth, and this routine would translate the
 * data to 0 to 15.
+ *
+ * NOTE: this is horrible complexity for no value.  Once people suggested they
+ * were selling 16-bit displays with 5:6:5 bits spread R:G:B but so far as I
+ * could determine these displays produced intermediate grey (uncolored) colors,
+ * which is impossible with a true 5:6:5, so most likely 5:6:5 was marketing.
 */
 static void
-png_do_shift(png_row_infop row_info, png_bytep row,
-    png_const_color_8p bit_depth)
+png_do_shift(png_transform_controlp row_info, png_bytep row)
 {
   png_debug(1, "in png_do_shift");

-   if (row_info->color_type != PNG_COLOR_TYPE_PALETTE)
+#  define png_ptr row_info->png_ptr
+
+   if (!(row_info->flags & PNG_INDEXED) && (row_info->channels-1) <= 3)
   {
+      png_const_color_8p bit_depth = &png_ptr->shift;
      int shift_start[4], shift_dec[4];
      int channels = 0;

-      if ((row_info->color_type & PNG_COLOR_MASK_COLOR) != 0)
+      if (row_info->channels == 3 || row_info->channels == 4)
      {
         shift_start[channels] = row_info->bit_depth - bit_depth->red;
         shift_dec[channels] = bit_depth->red;
@@ -192,27 +166,29 @@ png_do_shift(png_row_infop row_info, png_bytep row,
         channels++;
      }

-      else
+      else /* 1 or 2 channels */
      {
         shift_start[channels] = row_info->bit_depth - bit_depth->gray;
         shift_dec[channels] = bit_depth->gray;
         channels++;
      }

-      if ((row_info->color_type & PNG_COLOR_MASK_ALPHA) != 0)
+      if (row_info->channels == 2 || row_info->channels == 4)
      {
         shift_start[channels] = row_info->bit_depth - bit_depth->alpha;
         shift_dec[channels] = bit_depth->alpha;
         channels++;
      }

-      /* With low row depths, could only be grayscale, so one channel */
+      /* With low res depths, could only be grayscale, so one channel */
      if (row_info->bit_depth < 8)
      {
         png_bytep bp = row;
         png_size_t i;
         unsigned int mask;
-         png_size_t row_bytes = row_info->rowbytes;
+         size_t row_bytes = png_transform_rowbytes(row_info);
+
+         affirm(row_info->channels == 1);

         if (bit_depth->gray == 1 && row_info->bit_depth == 2)
            mask = 0x55;
@@ -240,7 +216,7 @@ png_do_shift(png_row_infop row_info, png_bytep row,
                  out |= (v >> (-j)) & mask;
            }

-            *bp = (png_byte)(out & 0xff);
+            *bp = png_check_byte(png_ptr, out);
         }
      }

@@ -269,7 +245,7 @@ png_do_shift(png_row_infop row_info, png_bytep row,
                  out |= v >> (-j);
            }

-            *bp = (png_byte)(out & 0xff);
+            *bp = png_check_byte(png_ptr, out);
         }
      }

@@ -296,200 +272,174 @@ png_do_shift(png_row_infop row_info, png_bytep row,
               else
                  value |= v >> (-j);
            }
-            *bp++ = (png_byte)((value >> 8) & 0xff);
-            *bp++ = (png_byte)(value & 0xff);
+            *bp++ = png_check_byte(png_ptr, value >> 8);
+            *bp++ = PNG_BYTE(value);
         }
      }
   }
+
+#  undef png_ptr
 }
 #endif

 #ifdef PNG_WRITE_SWAP_ALPHA_SUPPORTED
 static void
-png_do_write_swap_alpha(png_row_infop row_info, png_bytep row)
+png_do_write_swap_alpha(png_transform_controlp row_info, png_bytep row)
 {
   png_debug(1, "in png_do_write_swap_alpha");

+#  define png_ptr row_info->png_ptr
   {
-      if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
+      if (row_info->channels == 4)
      {
         if (row_info->bit_depth == 8)
         {
-            /* This converts from ARGB to RGBA */
-            png_bytep sp, dp;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info) - 4;

-            for (i = 0, sp = dp = row; i < row_width; i++)
+            /* This converts from ARGB to RGBA */
+            while (row <= ep)
            {
-               png_byte save = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = save;
+               png_byte save = row[0];
+               row[0] = row[1];
+               row[1] = row[2];
+               row[2] = row[3];
+               row[3] = save;
+               row += 4;
            }
+
+            debug(row == ep+4);
         }

 #ifdef PNG_WRITE_16BIT_SUPPORTED
-         else
+         else if (row_info->bit_depth == 16)
         {
            /* This converts from AARRGGBB to RRGGBBAA */
-            png_bytep sp, dp;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info) - 8;

-            for (i = 0, sp = dp = row; i < row_width; i++)
+            while (row <= ep)
            {
-               png_byte save[2];
-               save[0] = *(sp++);
-               save[1] = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = save[0];
-               *(dp++) = save[1];
+               png_byte s0 = row[0];
+               png_byte s1 = row[1];
+               memmove(row, row+2, 6);
+               row[6] = s0;
+               row[7] = s1;
+               row += 8;
            }
+
+            debug(row == ep+8);
         }
 #endif /* WRITE_16BIT */
      }

-      else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
+      else if (row_info->channels == 2)
      {
         if (row_info->bit_depth == 8)
         {
            /* This converts from AG to GA */
-            png_bytep sp, dp;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info) - 2;

-            for (i = 0, sp = dp = row; i < row_width; i++)
+            /* This converts from ARGB to RGBA */
+            while (row <= ep)
            {
-               png_byte save = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = save;
+               png_byte save = *row;
+               *row = row[1], ++row;
+               *row++ = save;
            }
+
+            debug(row == ep+2);
         }

 #ifdef PNG_WRITE_16BIT_SUPPORTED
         else
         {
            /* This converts from AAGG to GGAA */
-            png_bytep sp, dp;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info) - 4;

-            for (i = 0, sp = dp = row; i < row_width; i++)
+            while (row <= ep)
            {
-               png_byte save[2];
-               save[0] = *(sp++);
-               save[1] = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = save[0];
-               *(dp++) = save[1];
+               png_byte save = row[0];
+               row[0] = row[2];
+               row[2] = save;
+
+               save = row[1];
+               row[1] = row[3];
+               row[3] = save;
+
+               row += 4;
            }
+
+            debug(row == ep+4);
         }
 #endif /* WRITE_16BIT */
      }
   }
+
+#  undef png_ptr
 }
 #endif

 #ifdef PNG_WRITE_INVERT_ALPHA_SUPPORTED
 static void
-png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
+png_do_write_invert_alpha(png_transform_controlp row_info, png_bytep row)
 {
   png_debug(1, "in png_do_write_invert_alpha");

+#  define png_ptr row_info->png_ptr
   {
-      if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
+      if (row_info->channels == 4)
      {
         if (row_info->bit_depth == 8)
         {
            /* This inverts the alpha channel in RGBA */
-            png_bytep sp, dp;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info) - 1;

-            for (i = 0, sp = dp = row; i < row_width; i++)
-            {
-               /* Does nothing
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               */
-               sp+=3; dp = sp;
-               *(dp++) = (png_byte)(255 - *(sp++));
-            }
+            row += 3; /* alpha channel */
+            while (row <= ep)
+               *row ^= 0xff, row += 4;
         }

 #ifdef PNG_WRITE_16BIT_SUPPORTED
-         else
+         else if (row_info->bit_depth == 16)
         {
            /* This inverts the alpha channel in RRGGBBAA */
-            png_bytep sp, dp;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info) - 2;

-            for (i = 0, sp = dp = row; i < row_width; i++)
-            {
-               /* Does nothing
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               */
-               sp+=6; dp = sp;
-               *(dp++) = (png_byte)(255 - *(sp++));
-               *(dp++) = (png_byte)(255 - *(sp++));
-            }
+            row += 6;
+
+            while (row <= ep)
+               row[0] ^= 0xff, row[1] ^= 0xff, row += 8;
         }
 #endif /* WRITE_16BIT */
      }

-      else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
+      else if (row_info->channels == 2)
      {
         if (row_info->bit_depth == 8)
         {
            /* This inverts the alpha channel in GA */
-            png_bytep sp, dp;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info) - 1;

-            for (i = 0, sp = dp = row; i < row_width; i++)
-            {
-               *(dp++) = *(sp++);
-               *(dp++) = (png_byte)(255 - *(sp++));
-            }
+            ++row;
+
+            while (row <= ep)
+               *row ^= 0xff, row += 2;
         }

 #ifdef PNG_WRITE_16BIT_SUPPORTED
         else
         {
            /* This inverts the alpha channel in GGAA */
-            png_bytep sp, dp;
-            png_uint_32 i;
-            png_uint_32 row_width = row_info->width;
+            png_const_bytep ep = row + png_transform_rowbytes(row_info) - 2;

-            for (i = 0, sp = dp = row; i < row_width; i++)
-            {
-               /* Does nothing
-               *(dp++) = *(sp++);
-               *(dp++) = *(sp++);
-               */
-               sp+=2; dp = sp;
-               *(dp++) = (png_byte)(255 - *(sp++));
-               *(dp++) = (png_byte)(255 - *(sp++));
-            }
+            row += 2;
+
+            while (row <= ep)
+               row[0] ^= 0xff, row[1] ^= 0xff, row += 4;
         }
 #endif /* WRITE_16BIT */
      }
   }
+#  undef png_ptr
 }
 #endif

@@ -497,8 +447,10 @@ png_do_write_invert_alpha(png_row_infop row_info, png_bytep row)
 * transformations is significant.
 */
 void /* PRIVATE */
-png_do_write_transformations(png_structrp png_ptr, png_row_infop row_info)
+png_do_write_transformations(png_structrp png_ptr, png_row_infop row_info_in)
 {
+   png_transform_control display;
+
   png_debug(1, "in png_do_write_transformations");

   if (png_ptr == NULL)
@@ -510,7 +462,7 @@ png_do_write_transformations(png_structrp png_ptr, png_row_infop row_info)
         (*(png_ptr->write_user_transform_fn)) /* User write transform
                                                 function */
             (png_ptr,  /* png_ptr */
-             row_info,  /* row_info: */
+              row_info_in,  /* row_info: */
                /*  png_uint_32 width;       width of row */
                /*  png_size_t rowbytes;     number of bytes in row */
                /*  png_byte color_type;     color type of pixels */
@@ -520,55 +472,65 @@ png_do_write_transformations(png_structrp png_ptr, png_row_infop row_info)
             png_ptr->row_buf + 1);      /* start of pixel data for row */
 #endif

+   png_init_transform_control(png_ptr, &display, row_info_in);
+
 #ifdef PNG_WRITE_FILLER_SUPPORTED
   if ((png_ptr->transformations & PNG_FILLER) != 0)
-      png_do_strip_channel(row_info, png_ptr->row_buf + 1,
+      png_do_strip_channel(&display, png_ptr->row_buf + 1,
         !(png_ptr->flags & PNG_FLAG_FILLER_AFTER));
 #endif

 #ifdef PNG_WRITE_PACKSWAP_SUPPORTED
   if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
-      png_do_packswap(row_info, png_ptr->row_buf + 1);
+      png_do_packswap(&display, png_ptr->row_buf + 1);
 #endif

 #ifdef PNG_WRITE_PACK_SUPPORTED
   if ((png_ptr->transformations & PNG_PACK) != 0)
-      png_do_pack(row_info, png_ptr->row_buf + 1,
-          (png_uint_32)png_ptr->bit_depth);
+      png_do_pack(&display, png_ptr->row_buf + 1);
 #endif

 #ifdef PNG_WRITE_SWAP_SUPPORTED
 #  ifdef PNG_16BIT_SUPPORTED
   if ((png_ptr->transformations & PNG_SWAP_BYTES) != 0)
-      png_do_swap(row_info, png_ptr->row_buf + 1);
+      png_do_swap(&display, png_ptr->row_buf + 1);
 #  endif
 #endif

 #ifdef PNG_WRITE_SHIFT_SUPPORTED
   if ((png_ptr->transformations & PNG_SHIFT) != 0)
-      png_do_shift(row_info, png_ptr->row_buf + 1,
-          &(png_ptr->shift));
+      png_do_shift(&display, png_ptr->row_buf + 1);
 #endif

 #ifdef PNG_WRITE_SWAP_ALPHA_SUPPORTED
   if ((png_ptr->transformations & PNG_SWAP_ALPHA) != 0)
-      png_do_write_swap_alpha(row_info, png_ptr->row_buf + 1);
+      png_do_write_swap_alpha(&display, png_ptr->row_buf + 1);
 #endif

 #ifdef PNG_WRITE_INVERT_ALPHA_SUPPORTED
   if ((png_ptr->transformations & PNG_INVERT_ALPHA) != 0)
-      png_do_write_invert_alpha(row_info, png_ptr->row_buf + 1);
+      png_do_write_invert_alpha(&display, png_ptr->row_buf + 1);
 #endif

 #ifdef PNG_WRITE_BGR_SUPPORTED
   if ((png_ptr->transformations & PNG_BGR) != 0)
-      png_do_bgr(row_info, png_ptr->row_buf + 1);
+      png_do_bgr(&display, png_ptr->row_buf + 1);
 #endif

 #ifdef PNG_WRITE_INVERT_SUPPORTED
   if ((png_ptr->transformations & PNG_INVERT_MONO) != 0)
-      png_do_invert(row_info, png_ptr->row_buf + 1);
+      png_do_invert(&display, png_ptr->row_buf + 1);
 #endif
+
+   /* Clear the flags; they are irrelevant because the write code is
+    * reversing transformations to get PNG data but the shared transformation
+    * code assumes input PNG data.  Only PNG_INDEXED is required.
+    */
+   if ((display.flags & PNG_BAD_INDEX) != 0)
+      png_error(png_ptr, "palette data has out of range index");
+
+   display.flags &= PNG_INDEXED;
+   png_end_transform_control(row_info_in, &display);
 }
 #endif /* WRITE_TRANSFORMS */
 #endif /* WRITE */
--- a/pngwutil.c
+++ b/pngwutil.c
--- a/projects/vstudio/readme.txt
+++ b/projects/vstudio/readme.txt
@@ -1,7 +1,7 @@

 VisualStudio instructions

-libpng version 1.7.0beta48 - February 7, 2015
+libpng version 1.7.0beta59 - April 19, 2015

 Copyright (c) 1998-2010 Glenn Randers-Pehrson

--- a/projects/vstudio/zlib.props
+++ b/projects/vstudio/zlib.props
@@ -2,7 +2,7 @@
 <!--
 * zlib.props - location of zlib source
 *
- * libpng version 1.7.0beta48 - February 7, 2015
+ * libpng version 1.7.0beta59 - April 19, 2015
 *
 * Copyright (c) 1998-2011 Glenn Randers-Pehrson
 *
--- a/scripts/README.txt
+++ b/scripts/README.txt
@@ -1,9 +1,9 @@

-Makefiles for  libpng version 1.7.0beta48 - February 7, 2015
+Makefiles for  libpng version 1.7.0beta59 - April 19, 2015

 pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.linux    =>  Linux/ELF makefile
-                       (gcc, creates libpng17.so.17.1.7.0beta48)
+                       (gcc, creates libpng17.so.17.1.7.0beta59)
 makefile.gcc      =>  Generic makefile (gcc, creates static libpng.a)
 makefile.knr      =>  Archaic UNIX Makefile that converts files with
                       ansi2knr (Requires ansi2knr.c from
@@ -33,12 +33,12 @@ pnglibconf.h.prebuilt       =>  Stores configuration settings
 makefile.os2      =>  OS/2 Makefile (gcc and emx, requires libpng.def)
 makefile.sco      =>  For SCO OSr5  ELF and Unixware 7 with Native cc
 makefile.sggcc    =>  Silicon Graphics (gcc,
-                       creates libpng17.so.17.1.7.0beta48)
+                       creates libpng17.so.17.1.7.0beta59)
 makefile.sgi      =>  Silicon Graphics IRIX makefile (cc, creates static lib)
 makefile.solaris  =>  Solaris 2.X makefile (gcc,
-                       creates libpng17.so.17.1.7.0beta48)
+                       creates libpng17.so.17.1.7.0beta59)
 makefile.so9      =>  Solaris 9 makefile (gcc,
-                       creates libpng17.so.17.1.7.0beta48)
+                       creates libpng17.so.17.1.7.0beta59)
 makefile.std      =>  Generic UNIX makefile (cc, creates static libpng.a)
 makefile.sunos    =>  Sun makefile
 makefile.32sunu   =>  Sun Ultra 32-bit makefile
--- a/scripts/def.c
+++ b/scripts/def.c
@@ -21,7 +21,7 @@ PNG_DFN "OS2 DESCRIPTION "PNG image compression library""
 PNG_DFN "OS2 CODE PRELOAD MOVEABLE DISCARDABLE"
 PNG_DFN ""
 PNG_DFN "EXPORTS"
-PNG_DFN ";Version 1.7.0beta48"
+PNG_DFN ";Version 1.7.0beta59"

 #define PNG_EXPORTA(ordinal, type, name, args, attributes)\
        PNG_DFN "@" SYMBOL_PREFIX "@@" name "@"
--- a/scripts/dfn.awk
+++ b/scripts/dfn.awk
@@ -17,7 +17,7 @@
 BEGIN{
   out="/dev/null"       # as a flag
   out_count=0           # count of output lines
-   err=0                 # set if an error occured
+   err=0                 # set if an error occurred
   sort=0                # sort the output
   array[""]=""
 }
--- a/scripts/libpng-config-head.in
+++ b/scripts/libpng-config-head.in
@@ -11,7 +11,7 @@

 # Modeled after libxml-config.

-version=1.7.0beta48
+version=1.7.0beta59
 prefix=""
 libdir=""
 libs=""
--- a/scripts/libpng.pc.in
+++ b/scripts/libpng.pc.in
@@ -5,6 +5,6 @@ includedir=@includedir@/libpng17

 Name: libpng
 Description: Loads and saves PNG files
-Version: 1.7.0beta48
+Version: 1.7.0beta59
 Libs: -L${libdir} -lpng17
 Cflags: -I${includedir}
--- a/scripts/makefile.ne12bsd
+++ b/scripts/makefile.ne12bsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include/libpng17

 LIB=	png17
 SHLIB_MAJOR=	0
-SHLIB_MINOR=	1.7.0beta48
+SHLIB_MINOR=	1.7.0beta59
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.netbsd
+++ b/scripts/makefile.netbsd
@@ -17,7 +17,7 @@ INCSDIR=${LOCALBASE}/include

 LIB=	png
 SHLIB_MAJOR=	17
-SHLIB_MINOR=	1.7.0beta48
+SHLIB_MINOR=	1.7.0beta59
 SRCS=	png.c pngset.c pngget.c pngrutil.c pngtrans.c pngwutil.c \
 	pngread.c pngrio.c pngwio.c pngwrite.c pngrtran.c \
 	pngwtran.c pngmem.c pngerror.c pngpread.c
--- a/scripts/makefile.openbsd
+++ b/scripts/makefile.openbsd
@@ -11,7 +11,7 @@ LIBDIR=	${PREFIX}/lib
 MANDIR= ${PREFIX}/man/cat

 SHLIB_MAJOR=	17
-SHLIB_MINOR=	1.7.0beta48
+SHLIB_MINOR=	1.7.0beta59

 LIB=	png
 SRCS=	png.c pngerror.c pngget.c pngmem.c pngpread.c \
--- a/scripts/makefile.std
+++ b/scripts/makefile.std
@@ -106,7 +106,8 @@ install: libpng.a pnglibconf.h
 	chmod 644 $(DESTDIR)$(LIBPATH)/libpng.a

 clean:
-	$(RM_F) *.o libpng.a pngtest pngout.png pnglibconf.*
+	$(RM_F) *.o libpng.a pngtest pngout.png pnglibconf.h pnglibconf.c \
+	pnglibconf.out

 DOCS = ANNOUNCE CHANGES INSTALL KNOWNBUG LICENSE README TODO Y2KINFO
 writelock:
--- a/scripts/pnglibconf.dfa
+++ b/scripts/pnglibconf.dfa
@@ -8,7 +8,7 @@ com pnglibconf.h - library build configuration
 com
 version
 com
-com Copyright (c) 1998-2014 Glenn Randers-Pehrson
+com Copyright (c) 1998-2015 Glenn Randers-Pehrson
 com
 com This code is released under the libpng license.
 com For conditions of distribution and use, see the disclaimer
@@ -393,10 +393,14 @@ option USER_LIMITS requires READ
 #
 # Only chunks that are variable in number are counted towards the
 # USER_CHUNK_CACHE_MAX limit
-setting USER_WIDTH_MAX default        1000000 /* Use 0x7fffffff for unlimited */
-setting USER_HEIGHT_MAX default       1000000 /* Use 0x7fffffff for unlimited */
-setting USER_CHUNK_CACHE_MAX default      128 /* Use 0 for unlimited */
-setting USER_CHUNK_MALLOC_MAX default 8000000 /* Use 0 for unlimited */
+
+# Use 0x7fffffff for unlimited
+setting USER_WIDTH_MAX default        1000000
+setting USER_HEIGHT_MAX default       1000000
+
+# Use 0 for unlimited
+setting USER_CHUNK_CACHE_MAX default     1000
+setting USER_CHUNK_MALLOC_MAX default 8000000

 # If this option is enabled APIs to set the above limits at run time are added;
 # without this the hardwired (compile time) limits will be used.
@@ -542,6 +546,7 @@ option USER_TRANSFORM_INFO if READ_USER_TRANSFORM, WRITE_USER_TRANSFORM
 # non-IDAT chunks (zTXt, iTXt, iCCP, and unknown chunks).  This feature
 # was added at libpng-1.5.3.
 option WRITE_CUSTOMIZE_ZTXT_COMPRESSION requires WRITE
+option WRITE_CUSTOMIZE_COMPRESSION requires WRITE

 # Any chunks you are not interested in, you can undef here.  The
 # ones that allocate memory may be expecially important (hIST,
--- a/scripts/pnglibconf.h.prebuilt
+++ b/scripts/pnglibconf.h.prebuilt
@@ -1,8 +1,8 @@
-/* libpng 1.7.0beta48 STANDARD API DEFINITION */
+/* libpng 1.7.0beta59 STANDARD API DEFINITION */

 /* pnglibconf.h - library build configuration */

-/* Libpng version 1.7.0beta48 - February 7, 2015 */
+/* Libpng version 1.7.0beta59 - April 19, 2015 */

 /* Copyright (c) 1998-2014 Glenn Randers-Pehrson */

@@ -126,6 +126,7 @@
 #define PNG_WRITE_BGR_SUPPORTED
 #define PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED
 #define PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
+#define PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED
 #define PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED
 #define PNG_WRITE_FILLER_SUPPORTED
 #define PNG_WRITE_FILTER_SUPPORTED
@@ -196,10 +197,10 @@
 #define PNG_QUANTIZE_RED_BITS 5
 #define PNG_TEXT_Z_DEFAULT_COMPRESSION (-1)
 #define PNG_TEXT_Z_DEFAULT_STRATEGY 0
-#define PNG_USER_CHUNK_CACHE_MAX 128 /* Use 0 for unlimited */
-#define PNG_USER_CHUNK_MALLOC_MAX 8000000 /* Use 0 for unlimited */
-#define PNG_USER_HEIGHT_MAX 1000000 /* Use 0x7fffffff for unlimited */
-#define PNG_USER_WIDTH_MAX 1000000 /* Use 0x7fffffff for unlimited */
+#define PNG_USER_CHUNK_CACHE_MAX 1000
+#define PNG_USER_CHUNK_MALLOC_MAX 8000000
+#define PNG_USER_HEIGHT_MAX 1000000
+#define PNG_USER_WIDTH_MAX 1000000
 #define PNG_WEIGHT_SHIFT 8
 #define PNG_ZBUF_SIZE 8192
 #define PNG_ZLIB_HEADER <zlib.h>
--- a/scripts/pnglibconf.mak
+++ b/scripts/pnglibconf.mak
@@ -49,6 +49,7 @@ pnglibconf.dfn: $(srcdir)/scripts/pnglibconf.dfa $(srcdir)/scripts/options.awk $
 	$(MOVE) pnglibconf.tmp $@

 clean-pnglibconf:
-	$(DELETE) pnglibconf.*
+	$(DELETE) pnglibconf.h pnglibconf.c pnglibconf.out pnglibconf.pre \
+	pnglibconf.dfn

 clean: clean-pnglibconf
--- a/scripts/symbols.def
+++ b/scripts/symbols.def
@@ -1,4 +1,4 @@
-;Version 1.7.0beta48
+;Version 1.7.0beta59
 ;--------------------------------------------------------------
 ; LIBPNG symbol list as a Win32 DEF file
 ; Contains all the symbols that can be exported from libpng
Author	SHA1	Message	Date
Glenn Randers-Pehrson	01358ecec2	[libpng17] Imported from libpng-1.7.0beta59.tar	2015-04-19 06:32:30 -05:00
Glenn Randers-Pehrson	7a35bcac1a	[libpng17] Suppressed some warnings from the Borland C++ 5.5.1/5.82 compiler (Bug report by Viktor Szaka'ts).	2015-04-04 08:45:34 -05:00
John Bowler	673ae608ab	[libpng17] Transformed rewrite: changed row_info, added checks. This introduces an internal struct (png_transform_control) to replace row_info and uses that to implement affirms correctly. The change also adds checks on the rowbytes calculation and additional checks on most transform implementations. Added png_uint_16 range checking, pngvalid tRNS, fixed png_uint_16: review of previous checks, removal of some where SAFE. pngvalid: add testing of tRNS for better code coverage pngvalid: correct rgb-to-gray error calculations. Code coverage is still incomplete: see /UNTESTED/ in pngrtran.c	2015-03-30 21:32:41 -05:00
Glenn Randers-Pehrson	73ea393ab2	[libpng17] Bump version to 1.7.0beta59	2015-03-25 08:26:11 -05:00
Glenn Randers-Pehrson	dff4a834ce	[libpng17] Imported from libpng-1.7.0beta58.tar	2015-03-25 08:26:02 -05:00
Glenn Randers-Pehrson	ad817b9b2b	[libpng17] Revised comment about PNG_RELEASE_BUILD in pngpriv.h, to say Use -DPNG_RELEASE_BUILD in CFLAGS or "#define PNG_RELEASE_BUILD 1" in pngusr.h to turn on the release compile path.	2015-03-23 11:11:08 -05:00
Glenn Randers-Pehrson	218b2d7c70	[libpng17] Comment that PNG_RELEASE_BUILD has to be 0 or 1; illustrate usage in contrib/pngminim/*/pngusr.h	2015-03-23 10:02:56 -05:00
Glenn Randers-Pehrson	67890a19f3	[libpng17] Committed pngvalid.c omitted from previous commit; fix trivial typos	2015-03-22 21:01:48 -05:00
John Bowler	53097f5bbb	[libpng17] Check (png_uint_16) casts for overflow. Also removed png_muldiv_warn, added RELEASE/!RELEASE convenience macros. png_muldiv_warn was used in only one place, and the overflow condition is a genuine warning not an internal error. Four macros allow code or function parameters to be condition on RELEASE (or not) builds and tidy up the #ifdef handling of functions.	2015-03-22 20:26:13 -05:00
John Bowler	36562c1032	[libpng17] Improved some overflow handling. PNG_RELEASE_BUILD replaces tests where the code depended on the build base type and can be defined on the command line, allowing testing in beta builds. Overflows previously handled by png_warning in png.c have been changed to use new macros/affirm functions so that beta builds will abort on overflow and release builds will quietly ignore it. This avoids release builds producing warnings that are of no use to end users.	2015-03-22 16:05:56 -05:00
John Bowler	82fa6aed0e	[libpng17] Added byte, short and other overflow checking Added 'assert' based overflow checking for debug builds for char and short assignments. Simply ignore the error in release builds (a truncated value will be used without warning). Controlled by PNG_RANGE_CHECK_SUPPORTED.	2015-03-22 15:57:53 -05:00
Glenn Randers-Pehrson	382de60042	[libpng17] Document affirm() and impossible() in the manual page.	2015-03-21 21:46:00 -05:00
Glenn Randers-Pehrson	06963c7841	[libpng16] Renamed "assert" to "affirm", not affected by NDEBUG.	2015-03-21 21:33:42 -05:00
Glenn Randers-Pehrson	9f2fb72c67	[libpng16] Made assert (and impossible) removeable by defining NDEBUG.	2015-03-21 16:04:23 -05:00
Glenn Randers-Pehrson	10ea5caef2	[libpng17] Remove pnglibconf.dfn and pnglibconf.pre with "make clean".	2015-03-21 15:57:21 -05:00
John Bowler	2460d9494d	[libpng17] Implemented assert support and usage.	2015-03-20 16:39:56 -05:00
Glenn Randers-Pehrson	e8e7b6681e	[libpng17] Restore missing ")" in pngerror.c	2015-03-18 14:34:47 -05:00
Glenn Randers-Pehrson	033dd3f20a	[libpng17] Bump version to 1.7.0beta58	2015-03-17 08:13:42 -05:00
Glenn Randers-Pehrson	341e23c009	[libpng17] Imported from libpng-1.7.0beta57.tar	2015-03-17 08:00:27 -05:00
John Bowler	e4521a073c	[libpng17] Revert change to png_default_read_data() made in libpng-1.7.0beta55.	2015-03-16 19:41:43 -05:00
Glenn Randers-Pehrson	5ff2d472e8	[libpng17] Also remove pnglibconf.c and pnglibconf.out	2015-03-15 16:55:42 -05:00
Cosmin Truta	f8eeac2b11	[libpng17] Remove pnglibconf.h, not pnglibconf.* in "make clean" (Cosmin).	2015-03-15 16:27:11 -05:00
Glenn Randers-Pehrson	e57ab4311b	[libpng17] Bump version to 1.7.0beta57	2015-03-11 18:14:01 -05:00
Glenn Randers-Pehrson	9015c44736	[libpng17] Imported from libpng-1.7.0beta56.tar	2015-03-11 17:50:01 -05:00
Glenn Randers-Pehrson	1d7f037627	[libpng17] Updated CMakeLists.txt to add OSX framework, change YES/NO to ON/OFF for consistency (Alexey Petruchik).	2015-03-11 11:37:59 -05:00
Glenn Randers-Pehrson	c4c28d7251	[libpng17] Bump version to 1.7.0beta56	2015-03-09 09:28:06 -05:00
Glenn Randers-Pehrson	0fba15c567	[libpng17] Imported from libpng-1.7.0beta55.tar	2015-03-09 09:16:18 -05:00
Glenn Randers-Pehrson	c062330846	[libpng16] Free the unknown_chunks structure even when it contains no data.	2015-03-09 09:05:39 -05:00
Glenn Randers-Pehrson	0448d90f01	[libpng17] Merged png_free_data() with libpng-1.6.17rc02.	2015-03-09 09:04:02 -05:00
Glenn Randers-Pehrson	127bede89c	[libpng17] Reverted incorrect test on unknown chunk location.	2015-03-08 08:15:19 -05:00
Glenn Randers-Pehrson	3e4bd8c261	[libpng17] Spelling fixes ("then", "occured") reported by Lauri Nurmi.	2015-03-07 14:00:13 -06:00
Glenn Randers-Pehrson	cc085343ec	[libpng17] Stopped a potential memory leak in png_set_unknown_chunks(). Breaks tests/pngunknown-sAPI so it's temporarily marked SKIP.	2015-03-07 12:24:35 -06:00
Glenn Randers-Pehrson	ea0197a3e3	[libpng17] Removed some comments that the configure script did not handle properly from scripts/pnglibconf.dfa and pnglibconf.h.prebuilt.	2015-03-05 21:20:32 -06:00
Glenn Randers-Pehrson	c2f0c9683f	[libpng17] Work in progress, merging with libpng-1.6.17rc01.	2015-03-04 14:24:54 -06:00
Glenn Randers-Pehrson	79a332afd0	[libpng17] Bump version to 1.7.0beta55	2015-03-04 11:25:05 -06:00
Glenn Randers-Pehrson	352e2fe4c7	[libpng17] Imported from libpng-1.7.0beta54.tar	2015-03-04 11:19:43 -06:00
Glenn Randers-Pehrson	3077b5e049	[libpng17] Merged pngwrite.c with libpng-1.6.17beta06/pngwrite.c	2015-03-04 08:50:20 -06:00
Sergey Kosarevsky	98043c79a2	[libpng17] Avoid runtime checks when converting integer to png_byte with Visual Studio (Sergey Kosarevsky)	2015-02-27 19:22:27 -06:00
Glenn Randers-Pehrson	2bf96d75ec	[libpng17] Fixed some typos in the pngfix usage message.	2015-02-26 10:35:25 -06:00
Glenn Randers-Pehrson	678020ae18	[libpng17] Bump version to 1.7.0beta54	2015-02-25 15:42:29 -06:00
Glenn Randers-Pehrson	58e69e45ff	[libpng17] Imported from libpng-1.7.0beta53.tar	2015-02-25 15:17:50 -06:00
Glenn Randers-Pehrson	7b51b8c13b	[libng17] Put #ifdef/#endif around png_set_compression_level in pngwrite.c	2015-02-22 19:37:34 -06:00
Glenn Randers-Pehrson	5f7e71fa78	[libpng17] Restored compiling of png_reciprocal2 with PNG_NO_16BIT.	2015-02-22 16:42:54 -06:00
Glenn Randers-Pehrson	0cd3d25ae8	[libpng17] Bump version to 1.7.0beta53	2015-02-21 12:50:08 -06:00
Glenn Randers-Pehrson	83a2959908	[libpng17] Imported from libpng-1.7.0beta52.tar	2015-02-21 12:49:54 -06:00
Glenn Randers-Pehrson	ab2ef2ceb1	[libpng17] Minor editing of man page	2015-02-18 12:22:13 -06:00
Glenn Randers-Pehrson	f0341bae80	[libpng17] Corrected information recently added to the man page about row pointer usage.	2015-02-17 21:29:22 -06:00
Glenn Randers-Pehrson	ed3543679a	[libpng17] Added information about setjmp/simplified API interaction in the manual page and INSTALL file. Added information about using row_pointers with a single heightwidthbpp allocated block	2015-02-17 20:15:21 -06:00
Glenn Randers-Pehrson	9c7aee825c	[libpng17] Bump version to 1.7.0beta52	2015-02-17 10:52:59 -06:00
Glenn Randers-Pehrson	d8055d7123	[libpng17] Imported from libpng-1.7.0beta51.tar	2015-02-17 10:52:45 -06:00
Glenn Randers-Pehrson	92ef42d5e1	[libpng17] Display user limits in the output from pngtest.	2015-02-16 22:46:16 -06:00
Glenn Randers-Pehrson	1d3a1e36a7	[libpng17] Revised overflow detection in pngwutil.c	2015-02-16 22:43:52 -06:00
Glenn Randers-Pehrson	d368235da4	[libpng17] Bump version to 1.7.0beta51	2015-02-15 14:27:48 -06:00
Glenn Randers-Pehrson	06b0c83920	[libpng17] Imported from libpng-1.7.0beta50.tar	2015-02-15 13:20:53 -06:00
Glenn Randers-Pehrson	2130a3cd20	[libpng17] Combined several redundant lines of code in pngwutil.c	2015-02-15 13:18:50 -06:00
Glenn Randers-Pehrson	f1e4acb5b1	[libpng17] Combined sub_row, up_row, avg_row, and paeth_row buffers into a single try_row buffer and in cases where two or more of those are being tested, a second tst_row buffer. This improves CPU speed over that achieved by libpng-1.7.0beta49.	2015-02-15 12:44:16 -06:00
Glenn Randers-Pehrson	7e56f5858d	[libpng17] Bump version to 1.7.0beta50	2015-02-11 07:25:31 -06:00
Glenn Randers-Pehrson	82fca45d27	[libpng17] Imported from libpng-1.7.0beta49.tar	2015-02-11 07:25:24 -06:00
Glenn Randers-Pehrson	f55ee011a2	[libpng17] Make some parameters "const" in new functions.	2015-02-11 06:18:30 -06:00
Glenn Randers-Pehrson	9c9009ec7d	[libpng17] Deal with integer overflow of sum in pngwutil.c	2015-02-11 06:09:54 -06:00
Glenn Randers-Pehrson	01d91b4370	[libpng17] Consolidated redundant code in pngwutil.c	2015-02-10 22:49:31 -06:00
Glenn Randers-Pehrson	1fd10de101	[libpng17] Removed now-obsolete comments.	2015-02-10 19:55:20 -06:00
Glenn Randers-Pehrson	9149259041	[libpng17] Added PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED macro, on by default.	2015-02-10 17:09:48 -06:00
Glenn Randers-Pehrson	8bc832389a	[libpng17] Combined sub_row, up_row, avg_row, and paeth_row buffers into a single try_row buffer.	2015-02-10 17:03:27 -06:00
Glenn Randers-Pehrson	ba22b208ed	[libpng17] Bump version to 1.7.0beta49	2015-02-07 09:16:28 -06:00