Bug 1491467 - Update libpng to 1.6.35. r=aosmond
authorRyan VanderMeulen <ryanvm@gmail.com>
Tue, 18 Sep 2018 18:33:11 +0000
changeset 437000 4e5643db5a23372cc1095c5ef60eca76b958c493
parent 436999 1d61cb1fb3d24fc0032936190e75d0a44b8d05c0
child 437001 dc7813865b42a374563ad8ec320d5081cdbd93e5
push id34667
push useraiakab@mozilla.com
push dateWed, 19 Sep 2018 02:13:23 +0000
treeherdermozilla-central@3857cbe7b717 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersaosmond
bugs1491467
milestone64.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1491467 - Update libpng to 1.6.35. r=aosmond Differential Revision: https://phabricator.services.mozilla.com/D5913
media/libpng/CHANGES
media/libpng/LICENSE
media/libpng/MOZCHANGES
media/libpng/README
media/libpng/apng.patch
media/libpng/arm.patch
media/libpng/intel/filter_sse2_intrinsics.c
media/libpng/libpng-manual.txt
media/libpng/png.c
media/libpng/png.h
media/libpng/pngconf.h
media/libpng/pngget.c
media/libpng/pnginfo.h
media/libpng/pngpread.c
media/libpng/pngpriv.h
media/libpng/pngread.c
media/libpng/pngrio.c
media/libpng/pngrtran.c
media/libpng/pngrutil.c
media/libpng/pngset.c
media/libpng/pngstruct.h
media/libpng/pngtrans.c
media/libpng/pngwio.c
media/libpng/pngwrite.c
media/libpng/pngwtran.c
media/libpng/pngwutil.c
media/libpng/powerpc/filter_vsx_intrinsics.c
old-configure.in
--- a/media/libpng/CHANGES
+++ b/media/libpng/CHANGES
@@ -1,9 +1,8 @@
-#if 0
 CHANGES - changes for libpng
 
 version 0.1 [March 29, 1995]
   initial work-in-progress release
 
 version 0.2 [April 1, 1995]
   added reader into png.h
   fixed small problems in stub file
@@ -1449,17 +1448,17 @@ Version 1.2.6beta4 [July 28, 2004]
   Turn on PNG_NO_ZALLOC_ZERO by default in version 1.2.x
   Revised "clobber list" in pnggccrd.c so it will compile under gcc-3.4.
   Revised Borland portion of png_malloc() to return NULL or issue
     png_error() according to setting of PNG_FLAG_MALLOC_NULL_MEM_OK.
   Added PNG_NO_SEQUENTIAL_READ_SUPPORTED macro to conditionally remove
     sequential read support.
   Added some "#if PNG_WRITE_SUPPORTED" blocks.
   Added #ifdef to remove some redundancy in png_malloc_default().
-  Use png_malloc instead of png_zalloc to allocate the pallete.
+  Use png_malloc instead of png_zalloc to allocate the palette.
 
 Version 1.0.16rc1 and 1.2.6rc1 [August 4, 2004]
   Fixed buffer overflow vulnerability (CVE-2004-0597) in png_handle_tRNS().
   Fixed NULL dereference vulnerability (CVE-2004-0598) in png_handle_iCCP().
   Fixed integer overflow vulnerability (CVE-2004-0599) in png_read_png().
   Fixed some harmless bugs in png_handle_sBIT, etc, that would cause
     duplicate chunk types to go undetected.
   Fixed some timestamps in the -config version
@@ -3254,17 +3253,17 @@ Version 1.5.1 [February 3, 2011]
 
 Version 1.5.2beta01 [February 13, 2011]
   More -Wshadow fixes for older gcc compilers.  Older gcc versions apparently
     check formal parameters names in function declarations (as well as
     definitions) to see if they match a name in the global namespace.
   Revised PNG_EXPORTA macro to not use an empty parameter, to accommodate the
     old VisualC++ preprocessor.
   Turned on interlace handling in png_read_png().
-  Fixed gcc pendantic warnings.
+  Fixed gcc pedantic warnings.
   Handle longjmp in Cygwin.
   Fixed png_get_current_row_number() in the interlaced case.
   Cleaned up ALPHA flags and transformations.
   Implemented expansion to 16 bits.
 
 Version 1.5.2beta02 [February 19, 2011]
   Fixed mistake in the descriptions of user read_transform and write_transform
     function prototypes in the manual.  The row_info struct is png_row_infop.
@@ -3354,17 +3353,17 @@ Version 1.5.3beta05 [May 6, 2011]
   Removed png_snprintf and added formatted warning messages.  This change adds
     internal APIs to allow png_warning messages to have parameters without
     requiring the host OS to implement snprintf.  As a side effect the
     dependency of the tIME-supporting RFC1132 code on stdio is removed and
     PNG_NO_WARNINGS does actually work now.
   Pass "" instead of '\0' to png_default_error() in png_err().  This mistake
     was introduced in libpng-1.2.20beta01.  This fixes CVE-2011-2691.
   Added PNG_WRITE_OPTIMIZE_CMF_SUPPORTED macro to make the zlib "CMF" byte
-    optimization configureable.
+    optimization configurable.
   IDAT compression failed if preceded by a compressed text chunk (bug
     introduced in libpng-1.5.3beta01-02).  This was because the attempt to
     reset the zlib stream in png_write_IDAT happened after the first IDAT
     chunk had been deflated - much too late.  In this change internal
     functions were added to claim/release the z_stream and, hopefully, make
     the code more robust.  Also deflateEnd checking is added - previously
     libpng would ignore an error at the end of the stream.
 
@@ -3638,17 +3637,17 @@ Version 1.5.6beta05 [October 12, 2011]
     each row.
   Optimized png_combine_row() when rows are aligned. This gains a small
     percentage for 16-bit and 32-bit pixels in the typical case where the
     output row buffers are appropriately aligned. The optimization was not
     previously possible because the png_struct buffer was always misaligned.
   Fixed bug in png_write_chunk_header() debug print, introduced in 1.5.6beta01.
 
 Version 1.5.6beta06 [October 17, 2011]
-  Removed two redundant tests for unitialized row.
+  Removed two redundant tests for uninitialized row.
   Fixed a relatively harmless memory overwrite in compressed text writing
     with a 1 byte zlib buffer.
   Add ability to call png_read_update_info multiple times to pngvalid.c.
   Fixes for multiple calls to png_read_update_info. These fixes attend to
     most of the errors revealed in pngvalid, however doing the gamma work
     twice results in inaccuracies that can't be easily fixed.  There is now
     a warning in the code if this is going to happen.
   Turned on multiple png_read_update_info in pngvalid transform tests.
@@ -3684,17 +3683,17 @@ Version 1.5.7beta01 [November 4, 2011]
   Added support for ARM processor, when decoding all PNG up-filtered rows
     and any other-filtered rows with 3 or 4 bytes per pixel (Mans Rullgard).
   Fixed bug in pngvalid on early allocation failure; fixed type cast in
     pngmem.c; pngvalid would attempt to call png_error() if the allocation
     of a png_struct or png_info failed. This would probably have led to a
     crash.  The pngmem.c implementation of png_malloc() included a cast
     to png_size_t which would fail on large allocations on 16-bit systems.
   Fix for the preprocessor of the Intel C compiler. The preprocessor
-    splits adjacent @ signs with a space; this changes the concatentation
+    splits adjacent @ signs with a space; this changes the concatenation
     token from @-@-@ to PNG_JOIN; that should work with all compiler
     preprocessors.
   Paeth filter speed improvements from work by Siarhei Siamashka. This
     changes the 'Paeth' reconstruction function to improve the GCC code
     generation on x86. The changes are only part of the suggested ones;
     just the changes that definitely improve speed and remain simple.
     The changes also slightly increase the clarity of the code.
 
@@ -3730,17 +3729,17 @@ Version 1.5.7beta03 [November 17, 2011]
     at once - if this is tried typically the results is double gamma
     correction. Since the simplified APIs can need rgb to gray combined with
     a compose operation it is necessary to do one of these outside the main
     libpng transform code. This check-in also contains fixes to various bugs
     in the simplified APIs themselves and to some bugs in compose and rgb to
     gray (on palette) itself.
   Fixes for C++ compilation using g++ When libpng source is compiled
     using g++. The compiler imposes C++ rules on the C source; thus it
-    is desireable to make the source work with either C or C++ rules
+    is desirable to make the source work with either C or C++ rules
     without throwing away useful error information.  This change adds
     png_voidcast to allow C semantic (void*) cases or the corresponding
     C++ static_cast operation, as appropriate.
   Added --noexecstack to assembler file compilation. GCC does not set
     this on assembler compilation, even though it does on C compilation.
     This creates security issues if assembler code is enabled; the
     work-around is to set it by default in the flags for $(CCAS)
   Work around compilers that don't support declaration of const data. Some
@@ -4056,17 +4055,17 @@ Version 1.6.0beta17 [March 10, 2012]
   Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition. 
   Reject all iCCP chunks after the first, even if the first one is invalid.
   Deflate/inflate was reworked to move common zlib calls into single
     functions [rw]util.c.  A new shared keyword check routine was also added
     and the 'zbuf' is no longer allocated on progressive read.  It is now
     possible to call png_inflate() incrementally.  A warning is no longer
     issued if the language tag or translated keyword in the iTXt chunk
     has zero length.
-  If benign errors are disabled use maximum window on ancilliary inflate.
+  If benign errors are disabled use maximum window on ancillary inflate.
     This works round a bug introduced in 1.5.4 where compressed ancillary
     chunks could end up with a too-small windowBits value in the deflate
     header.
 
 Version 1.6.0beta18 [March 16, 2012]
   Issue a png_benign_error() instead of png_warning() about bad palette index.
   In pngtest, treat benign errors as errors if "-strict" is present.
   Fixed an off-by-one error in the palette index checking function.
@@ -4171,17 +4170,17 @@ Version 1.6.0beta27 [August 11, 2012]
   Removed references to png_zalloc() and png_zfree() from the manual.
   Fixed configurations where floating point is completely disabled.  Because
     of the changes to support symbol prefixing PNG_INTERNAL_FUNCTION declares
     floating point APIs during libpng builds even if they are completely
     disabled. This requires the png floating point types (png_double*) to be
     declared even though the functions are never actually defined.  This
     change provides a dummy definition so that the declarations work, yet any
     implementation will fail to compile because of an incomplete type.
-  Re-eliminated the use of strcpy() in pngtest.c.  An unncessary use of
+  Re-eliminated the use of strcpy() in pngtest.c.  An unnecessary use of
     strcpy() was accidentally re-introduced in libpng16; this change replaces
     it with strncpy().
   Eliminated use of png_sizeof(); use sizeof() instead.
   Use a consistent style for (sizeof type) and (sizeof (array))
   Cleanup of png_set_filler().  This function does very different things on
     read and write.  In libpng 1.6 the two cases can be distinguished and
     considerable code cleanup, and extra error checking, is possible.  This
     makes calls on the write side that have no effect be ignored with a
@@ -4304,17 +4303,17 @@ Version 1.6.0beta31 [November 1, 2012]
     of -DPNG_NO_READ_GAMMA is changed to simply disable any interface that
     depends on it; this obliges people who set it to consider whether they
     really want it off if they happen to use any of the interfaces in
     question (typically most users who disable it won't).
   Fixed GUIDs in projects/vstudio. Some were duplicated or missing,
     resulting in VS2010 having to update the files.
   Removed non-working ICC profile support code that was mostly added to
     libpng-1.6.0beta29 and beta30. There was too much code for too little
-    gain; implementing full ICC color correction may be desireable but is left
+    gain; implementing full ICC color correction may be desirable but is left
     up to applications.
 
 Version 1.6.0beta32 [November 25, 2012]
   Fixed an intermittent SEGV in pngstest due to an uninitialized array element.
   Added the ability for contrib/libtests/makepng.c to make a PNG with just one
     color. This is useful for debugging pngstest color inaccuracy reports.
   Fixed error checking in the simplified write API (Olaf van der Spek)
   Made png_user_version_check() ok to use with libpng version 1.10.x and later.
@@ -4587,17 +4586,17 @@ Version 1.6.3beta07 [June 8, 2013]
     using a compiler that compiles for multiple architectures at one time.
   Removed PNG_FILTER_OPTIMIZATIONS and PNG_ARM_NEON_SUPPORTED from
     pnglibconf.h, allowing more of the decisions to be made internally
     (pngpriv.h) during the compile.  Without this, symbol prefixing is broken
     under certain circumstances on ARM platforms.  Now only the API parts of
     the optimizations ('check' vs 'api') are exposed in the public header files
     except that the new setting PNG_ARM_NEON_OPT documents how libpng makes the
     decision about whether or not to use the optimizations.
-  Protect symbol prefixing against CC/CPPFLAGS/CFLAGS useage.
+  Protect symbol prefixing against CC/CPPFLAGS/CFLAGS usage.
     Previous iOS/Xcode fixes for the ARM NEON optimizations moved the test
     on __ARM_NEON__ from configure time to compile time.  This breaks symbol
     prefixing because the definition of the special png_init_filter_functions
     call was hidden at configure time if the relevant compiler arguments are
     passed in CFLAGS as opposed to CC.  This change attempts to avoid all
     the confusion that would result by declaring the init function even when
     it is not used, so that it will always get prefixed.
 
@@ -5630,17 +5629,17 @@ Version 1.6.24beta02 [June 23, 2016]
   Put the SKIP definition in the correct place. It needs to come after the
     png.h include (see all the other .c files in contrib/libtests) because it
     depends on PNG_LIBPNG_VER.
   Removed the three compile warning options from the individual project
     files into the zlib.props globals.  It increases the warning level from 4
     to All and adds a list of the warnings that need to be turned off.  This is
     semi-documentary; the intent is to tell libpng users which warnings have
     been examined and judged non-fixable at present.  The warning about
-    structure padding is fixable, but it would be a signficant change (moving
+    structure padding is fixable, but it would be a significant change (moving
     structure members around).
 
 Version 1.6.24beta03 [July 4, 2016]
   Optimized absolute value calculation in filter selection, similar to
     code in the PAETH decoder in pngrutil.c. Build with PNG_USE_ABS to
     use this.
   Added pngcp to the build together with a pngcp.dfa configuration test.
   Added high resolution timing to pngcp.
@@ -5776,17 +5775,17 @@ Version 1.6.27 [December 29, 2016]
   Fixed a potential null pointer dereference in png_set_text_2() (bug report
     and patch by Patrick Keshishian, CVE-2016-10087).
 
 Version 1.6.28rc01 [January 3, 2017]
   Fixed arm/aarch64 detection in CMakeLists.txt (Gianfranco Costamagna).
   Added option to Cmake build allowing a custom location of zlib to be
     specified in a scenario where libpng is being built as a subproject
     alongside zlib by another project (Sam Serrels).
-  Changed png_ptr->options from a png_byte to png_uint_32, to accomodate
+  Changed png_ptr->options from a png_byte to png_uint_32, to accommodate
     up to 16 options.
 
 Version 1.6.28rc02 [January 4, 2017]
   Added "include(GNUInstallDirs)" to CMakeLists.txt (Gianfranco Costamagna).
   Moved SSE2 optimization code into the main libpng source directory.
     Configure libpng with "configure --enable-intel-sse" or compile
     libpng with "-DPNG_INTEL_SSE" in CPPFLAGS to enable it.
 
@@ -5927,17 +5926,17 @@ Version 1.6.32beta03 [August 2, 2017]
   Stop memory leak when returning from png_handle_eXIf() with an error
     (Bug report from the OSS-fuzz project).
 
 Version 1.6.32beta04 [August 2, 2017]
   Replaced local eXIf_buf with info_ptr-eXIf_buf in png_handle_eXIf().
   Update libpng.3 and libpng-manual.txt about eXIf functions.
 
 Version 1.6.32beta05 [August 2, 2017]
-  Restored png_get_eXIf() and png_set_eXIf() to maintain API compatability.
+  Restored png_get_eXIf() and png_set_eXIf() to maintain API compatibility.
 
 Version 1.6.32beta06 [August 2, 2017]
   Removed png_get_eXIf_1() and png_set_eXIf_1().
 
 Version 1.6.32beta07 [August 3, 2017]
   Check length of all chunks except IDAT against user limit to fix an
     OSS-fuzz issue (Fixes CVE-2017-12652).
 
@@ -6033,19 +6032,40 @@ Version 1.6.33rc02 [September 23, 2017]
     API (Samuel Williams).
 
 Version 1.6.33 [September 28, 2017]
   Revert contrib/oss-fuzz/libpng_read_fuzzer.cc to libpng-1.6.32 state.
   Initialize png_handler.row_ptr in contrib/oss-fuzz/libpng_read_fuzzer.cc
   Add end_info structure and png_read_end() to the libpng fuzzer.
 
 Version 1.6.34 [September 29, 2017]
-  Removed contrib/pngsuite/i*.png; some of these were incorrect and caused
-    test failures.
+  Removed contrib/pngsuite/i*.png; some of them caused test failures.
+
+Version 1.6.35beta01 [March 6, 2018]
+  Restored 21 of the contrib/pngsuite/i*.png, which do not cause test
+    failures. Placed the remainder in contrib/pngsuite/interlaced/i*.png.
+  Added calls to png_set_*() transforms commonly used by browsers to
+    the fuzzer.
+  Removed some unnecessary brackets in pngrtran.c
+  Fixed miscellaneous typos (Patch by github user "luzpaz").
+  Change "ASM C" to "C ASM" in CMakeLists.txt
+  Fixed incorrect handling of bKGD chunk in sub-8-bit files (Cosmin)
+  Added hardware optimization directories to zip and 7z distributions.
+  Fixed incorrect bitmask for options.
+  Fixed many spelling typos.
+
+Version 1.6.35beta02 [March 28, 2018]
+  Make png_get_iCCP consistent with man page (allow compression-type argument
+  to be NULL, bug report by Lenard Szolnoki).
+
+Version 1.6.35 [July 15, 2018]
+  Replaced the remaining uses of png_size_t with size_t (Cosmin)
+  Fixed the calculation of row_factor in png_check_chunk_length
+    (reported by Thuan Pham in SourceForge issue #278)
+  Added missing parentheses to a macro definition
+    (suggested by "irwir" in GitHub issue #216)
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
-to subscribe)
-or to glennrp at users.sourceforge.net
+to subscribe).
 
 Glenn R-P
-#endif
--- a/media/libpng/LICENSE
+++ b/media/libpng/LICENSE
@@ -15,18 +15,18 @@ obtain one at http://mozilla.org/MPL/2.0
 This modified version of libpng code adds animated PNG support and is
 released under the libpng license described below. The modifications are
 Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2017 Max Stepin,
 and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
 surrounding them in the modified libpng source files.
 
 This code is released under the libpng license.
 
-libpng versions 1.0.7, July 1, 2000 through 1.6.34, September 29, 2017 are
-Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
+libpng versions 1.0.7, July 1, 2000 through 1.6.35, July 15, 2018 are
+Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
 added to the list of Contributing Authors:
 
    Simon-Pierre Cadieux
    Eric S. Raymond
    Mans Rullgard
    Cosmin Truta
@@ -135,9 +135,9 @@ The Copyright owner believes that the Ex
 Number (ECCN) for libpng is EAR99, which means not subject to export
 controls or International Traffic in Arms Regulations (ITAR) because
 it is open source, publicly available software, that does not contain
 any encryption software.  See the EAR, paragraphs 734.3(b)(3) and
 734.7(b).
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-September 29, 2017
+July 15, 2018
--- a/media/libpng/MOZCHANGES
+++ b/media/libpng/MOZCHANGES
@@ -1,11 +1,13 @@
 
 Changes made to pristine libpng source by mozilla.org developers.
 
+2018/09/14  -- Synced with libpng-1.6.35 (bug #1491467).
+
 2017/08/30  -- Synced with libpng-1.6.34 (bug #1402057).
 
 2017/03/18  -- Synced with libpng-1.6.31 (bug #1377118).
 
 2017/03/18  -- Synced with libpng-1.6.29 (bug #1348356).
 
 2017/01/06  -- Synced with libpng-1.6.28 (bug #1328354).
 
--- a/media/libpng/README
+++ b/media/libpng/README
@@ -1,9 +1,9 @@
-README for libpng version 1.6.34 - September 29, 2017 (shared library 16.0)
+README for libpng version 1.6.35 - July 15, 2018 (shared library 16.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
 
 Libpng comes in several distribution formats.  Get libpng-*.tar.gz or
 libpng-*.tar.xz or if you want UNIX-style line endings in the text files,
 or lpng*.7z or lpng*.zip if you want DOS-style line endings.
 
@@ -113,17 +113,17 @@ fix.  Please mention "libpng" somewhere 
 
 This release was created and will be supported by myself (of course
 based in a large way on Guy's and Andreas' earlier work), and the PNG
 development group.
 
 Send comments/corrections/commendations to png-mng-implement at
 lists.sourceforge.net (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
-to subscribe) or to glennrp at users.sourceforge.net
+to subscribe).
 
 You can't reach Guy, the original libpng author, at the addresses
 given in previous versions of this document.  He and Andreas will
 read mail addressed to the png-implement list, however.
 
 Please do not send general questions about PNG.  Send them to
 png-mng-misc at lists.sf.net (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-misc to
--- a/media/libpng/apng.patch
+++ b/media/libpng/apng.patch
@@ -1,135 +1,244 @@
-Index: LICENSE
-===================================================================
---- LICENSE
-+++ LICENSE
-@@ -8,6 +8,12 @@
+diff --git a/LICENSE b/LICENSE
+--- a/LICENSE
++++ b/LICENSE
+@@ -7,8 +7,14 @@ COPYRIGHT NOTICE, DISCLAIMER, and LICENS
+ 
  If you modify libpng you may insert additional notices immediately following
  this sentence.
  
 +This modified version of libpng code adds animated PNG support and is
 +released under the libpng license described below. The modifications are
 +Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2017 Max Stepin,
 +and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
 +surrounding them in the modified libpng source files.
 +
  This code is released under the libpng license.
  
- libpng versions 1.0.7, July 1, 2000 through 1.6.34, September 29, 2017 are
-Index: pngread.c
-===================================================================
---- pngread.c
-+++ pngread.c
-@@ -161,6 +161,9 @@
+ libpng versions 1.0.7, July 1, 2000 through 1.6.35, July 15, 2018 are
+ Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson, are
+diff --git a/png.c b/png.c
+--- a/png.c
++++ b/png.c
+@@ -815,19 +815,23 @@ png_get_copyright(png_const_structrp png
+    return PNG_STRING_COPYRIGHT
+ #else
+ #  ifdef __STDC__
+    return PNG_STRING_NEWLINE \
+-      "libpng version 1.6.35 - July 15, 2018" PNG_STRING_NEWLINE \
++      "libpng version 1.6.35+apng - July 15, 2018" PNG_STRING_NEWLINE \
+       "Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson" \
+       PNG_STRING_NEWLINE \
+       "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
+       "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
+-      PNG_STRING_NEWLINE;
++      PNG_STRING_NEWLINE \
++      "Portions Copyright (c) 2006-2007 Andrew Smith" PNG_STRING_NEWLINE \
++      "Portions Copyright (c) 2008-2018 Max Stepin" PNG_STRING_NEWLINE ;
+ #  else
+-   return "libpng version 1.6.35 - July 15, 2018\
++   return "libpng version 1.6.35+apng - July 15, 2018\
+       Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson\
+       Copyright (c) 1996-1997 Andreas Dilger\
+-      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
++      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\
++      Portions Copyright (c) 2006-2007 Andrew Smith\
++      Portions Copyright (c) 2008-2018 Max Stepin";
+ #  endif
+ #endif
+ }
  
-       else if (chunk_name == png_IDAT)
-       {
-+#ifdef PNG_READ_APNG_SUPPORTED
-+         png_have_info(png_ptr, info_ptr);
-+#endif
-          png_ptr->idat_size = length;
-          break;
-       }
-@@ -255,6 +258,17 @@
-          png_handle_iTXt(png_ptr, info_ptr, length);
+diff --git a/png.h b/png.h
+--- a/png.h
++++ b/png.h
+@@ -22,8 +22,14 @@
+  *
+  * If you modify libpng you may insert additional notices immediately following
+  * this sentence.
+  *
++ * This modified version of libpng code adds animated PNG support and is
++ * released under the libpng license described below. The modifications are
++ * Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2017 Max Stepin,
++ * and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
++ * surrounding them in the modified libpng source files.
++ *
+  * This code is released under the libpng license.
+  *
+  * libpng versions 1.0.7, July 1, 2000 through 1.6.35, July 15, 2018 are
+  * Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson, are
+@@ -308,10 +314,11 @@
+  * skip to the end of this file and read the section entitled 'simplified API'.
+  */
+ 
+ /* Version information for png.h - this should match the version in png.c */
+-#define PNG_LIBPNG_VER_STRING "1.6.35"
+-#define PNG_HEADER_VERSION_STRING " libpng version 1.6.35 - July 15, 2018\n"
++#define PNG_LIBPNG_VER_STRING "1.6.35+apng"
++#define PNG_HEADER_VERSION_STRING \
++     " libpng version 1.6.35+apng - July 15, 2018\n"
+ 
+ #define PNG_LIBPNG_VER_SONUM   16
+ #define PNG_LIBPNG_VER_DLLNUM  16
+ 
+@@ -360,8 +367,12 @@
+  */
+ #   include "pnglibconf.h"
  #endif
  
-+#ifdef PNG_READ_APNG_SUPPORTED
-+      else if (chunk_name == png_acTL)
-+         png_handle_acTL(png_ptr, info_ptr, length);
-+
-+      else if (chunk_name == png_fcTL)
-+         png_handle_fcTL(png_ptr, info_ptr, length);
++#define PNG_APNG_SUPPORTED
++#define PNG_READ_APNG_SUPPORTED
++#define PNG_WRITE_APNG_SUPPORTED
 +
-+      else if (chunk_name == png_fdAT)
-+         png_handle_fdAT(png_ptr, info_ptr, length);
-+#endif
-+
-       else
-          png_handle_unknown(png_ptr, info_ptr, length,
-              PNG_HANDLE_CHUNK_AS_DEFAULT);
-@@ -262,6 +276,72 @@
- }
- #endif /* SEQUENTIAL_READ */
+ #ifndef PNG_VERSION_INFO_ONLY
+ /* Machine specific configuration. */
+ #  include "pngconf.h"
+ #endif
+@@ -455,8 +466,19 @@ extern "C" {
+  * constants.
+  * See pngconf.h for base types that vary by machine/system
+  */
  
-+#ifdef PNG_READ_APNG_SUPPORTED
-+void PNGAPI
-+png_read_frame_head(png_structp png_ptr, png_infop info_ptr)
-+{
-+    png_byte have_chunk_after_DAT; /* after IDAT or after fdAT */
-+
-+    png_debug(0, "Reading frame head");
++#ifdef PNG_APNG_SUPPORTED
++/* dispose_op flags from inside fcTL */
++#define PNG_DISPOSE_OP_NONE        0x00
++#define PNG_DISPOSE_OP_BACKGROUND  0x01
++#define PNG_DISPOSE_OP_PREVIOUS    0x02
 +
-+    if ((png_ptr->mode & PNG_HAVE_acTL) == 0)
-+        png_error(png_ptr, "attempt to png_read_frame_head() but "
-+                           "no acTL present");
-+
-+    /* do nothing for the main IDAT */
-+    if (png_ptr->num_frames_read == 0)
-+        return;
-+
-+    png_read_reset(png_ptr);
-+    png_ptr->flags &= ~PNG_FLAG_ROW_INIT;
-+    png_ptr->mode &= ~PNG_HAVE_fcTL;
++/* blend_op flags from inside fcTL */
++#define PNG_BLEND_OP_SOURCE        0x00
++#define PNG_BLEND_OP_OVER          0x01
++#endif /* APNG */
 +
-+    have_chunk_after_DAT = 0;
-+    for (;;)
-+    {
-+        png_uint_32 length = png_read_chunk_header(png_ptr);
+ /* This triggers a compiler error in png.c, if png.c and png.h
+  * do not agree upon the version number.
+  */
+ typedef char* png_libpng_version_1_6_35;
+@@ -776,8 +798,12 @@ typedef png_unknown_chunk * * png_unknow
+ #define PNG_INFO_sPLT 0x2000U  /* ESR, 1.0.6 */
+ #define PNG_INFO_sCAL 0x4000U  /* ESR, 1.0.6 */
+ #define PNG_INFO_IDAT 0x8000U  /* ESR, 1.0.6 */
+ #define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */
++#ifdef PNG_APNG_SUPPORTED
++#define PNG_INFO_acTL 0x20000U
++#define PNG_INFO_fcTL 0x40000U
++#endif
+ 
+ /* This is used for the transformation routines, as some of them
+  * change these values for the row.  It also should enable using
+  * the routines for other purposes.
+@@ -813,8 +839,12 @@ typedef PNG_CALLBACK(void, *png_write_st
+ 
+ #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
+ typedef PNG_CALLBACK(void, *png_progressive_info_ptr, (png_structp, png_infop));
+ typedef PNG_CALLBACK(void, *png_progressive_end_ptr, (png_structp, png_infop));
++#ifdef PNG_APNG_SUPPORTED
++typedef PNG_CALLBACK(void, *png_progressive_frame_ptr, (png_structp,
++    png_uint_32));
++#endif
+ 
+ /* The following callback receives png_uint_32 row_number, int pass for the
+  * png_bytep data of the row.  When transforming an interlaced image the
+  * row number is the row number within the sub-image of the interlace pass, so
+@@ -3257,17 +3287,90 @@ PNG_EXPORT(244, int, png_set_option, (pn
+ /*******************************************************************************
+  *  END OF HARDWARE AND SOFTWARE OPTIONS
+  ******************************************************************************/
+ 
++#ifdef PNG_APNG_SUPPORTED
++PNG_EXPORT(248, png_uint_32, png_get_acTL, (png_structp png_ptr,
++   png_infop info_ptr, png_uint_32 *num_frames, png_uint_32 *num_plays));
 +
-+        if (png_ptr->chunk_name == png_IDAT)
-+        {
-+            /* discard trailing IDATs for the first frame */
-+            if (have_chunk_after_DAT != 0 || png_ptr->num_frames_read > 1)
-+                png_error(png_ptr, "png_read_frame_head(): out of place IDAT");
-+            png_crc_finish(png_ptr, length);
-+        }
++PNG_EXPORT(249, png_uint_32, png_set_acTL, (png_structp png_ptr,
++   png_infop info_ptr, png_uint_32 num_frames, png_uint_32 num_plays));
 +
-+        else if (png_ptr->chunk_name == png_fcTL)
-+        {
-+            png_handle_fcTL(png_ptr, info_ptr, length);
-+            have_chunk_after_DAT = 1;
-+        }
++PNG_EXPORT(250, png_uint_32, png_get_num_frames, (png_structp png_ptr,
++   png_infop info_ptr));
 +
-+        else if (png_ptr->chunk_name == png_fdAT)
-+        {
-+            png_ensure_sequence_number(png_ptr, length);
++PNG_EXPORT(251, png_uint_32, png_get_num_plays, (png_structp png_ptr,
++   png_infop info_ptr));
 +
-+            /* discard trailing fdATs for frames other than the first */
-+            if (have_chunk_after_DAT == 0 && png_ptr->num_frames_read > 1)
-+                png_crc_finish(png_ptr, length - 4);
-+            else if (png_ptr->mode & PNG_HAVE_fcTL)
-+            {
-+                png_ptr->idat_size = length - 4;
-+                png_ptr->mode |= PNG_HAVE_IDAT;
++PNG_EXPORT(252, png_uint_32, png_get_next_frame_fcTL,
++   (png_structp png_ptr, png_infop info_ptr, png_uint_32 *width,
++   png_uint_32 *height, png_uint_32 *x_offset, png_uint_32 *y_offset,
++   png_uint_16 *delay_num, png_uint_16 *delay_den, png_byte *dispose_op,
++   png_byte *blend_op));
++
++PNG_EXPORT(253, png_uint_32, png_set_next_frame_fcTL,
++   (png_structp png_ptr, png_infop info_ptr, png_uint_32 width,
++   png_uint_32 height, png_uint_32 x_offset, png_uint_32 y_offset,
++   png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
++   png_byte blend_op));
 +
-+                break;
-+            }
-+            else
-+                png_error(png_ptr, "png_read_frame_head(): out of place fdAT");
-+        }
-+        else
-+        {
-+            png_warning(png_ptr, "Skipped (ignored) a chunk "
-+                                 "between APNG chunks");
-+            png_crc_finish(png_ptr, length);
-+        }
-+    }
-+}
++PNG_EXPORT(254, png_uint_32, png_get_next_frame_width,
++   (png_structp png_ptr, png_infop info_ptr));
++PNG_EXPORT(255, png_uint_32, png_get_next_frame_height,
++   (png_structp png_ptr, png_infop info_ptr));
++PNG_EXPORT(256, png_uint_32, png_get_next_frame_x_offset,
++   (png_structp png_ptr, png_infop info_ptr));
++PNG_EXPORT(257, png_uint_32, png_get_next_frame_y_offset,
++   (png_structp png_ptr, png_infop info_ptr));
++PNG_EXPORT(258, png_uint_16, png_get_next_frame_delay_num,
++   (png_structp png_ptr, png_infop info_ptr));
++PNG_EXPORT(259, png_uint_16, png_get_next_frame_delay_den,
++   (png_structp png_ptr, png_infop info_ptr));
++PNG_EXPORT(260, png_byte, png_get_next_frame_dispose_op,
++   (png_structp png_ptr, png_infop info_ptr));
++PNG_EXPORT(261, png_byte, png_get_next_frame_blend_op,
++   (png_structp png_ptr, png_infop info_ptr));
++PNG_EXPORT(262, png_byte, png_get_first_frame_is_hidden,
++   (png_structp png_ptr, png_infop info_ptr));
++PNG_EXPORT(263, png_uint_32, png_set_first_frame_is_hidden,
++   (png_structp png_ptr, png_infop info_ptr, png_byte is_hidden));
++
++#ifdef PNG_READ_APNG_SUPPORTED
++PNG_EXPORT(264, void, png_read_frame_head, (png_structp png_ptr,
++   png_infop info_ptr));
++#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
++PNG_EXPORT(265, void, png_set_progressive_frame_fn, (png_structp png_ptr,
++   png_progressive_frame_ptr frame_info_fn,
++   png_progressive_frame_ptr frame_end_fn));
++#endif /* PROGRESSIVE_READ */
 +#endif /* READ_APNG */
 +
- /* Optional call to update the users info_ptr structure */
- void PNGAPI
- png_read_update_info(png_structrp png_ptr, png_inforp info_ptr)
-Index: pngget.c
-===================================================================
---- pngget.c
-+++ pngget.c
-@@ -1245,4 +1245,166 @@
++#ifdef PNG_WRITE_APNG_SUPPORTED
++PNG_EXPORT(266, void, png_write_frame_head, (png_structp png_ptr,
++   png_infop info_ptr, png_bytepp row_pointers,
++   png_uint_32 width, png_uint_32 height,
++   png_uint_32 x_offset, png_uint_32 y_offset,
++   png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
++   png_byte blend_op));
++
++PNG_EXPORT(267, void, png_write_frame_tail, (png_structp png_ptr,
++   png_infop info_ptr));
++#endif /* WRITE_APNG */
++#endif /* APNG */
++
+ /* Maintainer: Put new public prototypes here ^, in libpng.3, in project
+  * defs, and in scripts/symbols.def.
+  */
+ 
+ /* The last ordinal number (this is the *last* one already used; the next
+  * one to use is one more than this.)
+  */
+ #ifdef PNG_EXPORT_LAST_ORDINAL
++#ifdef PNG_APNG_SUPPORTED
++  PNG_EXPORT_LAST_ORDINAL(269);
++#else
+   PNG_EXPORT_LAST_ORDINAL(249);
++#endif /* APNG */
+ #endif
+ 
+ #ifdef __cplusplus
+ }
+diff --git a/pngget.c b/pngget.c
+--- a/pngget.c
++++ b/pngget.c
+@@ -1245,5 +1245,167 @@ png_get_palette_max(png_const_structp pn
+ }
  #  endif
  #endif
  
 +#ifdef PNG_APNG_SUPPORTED
 +png_uint_32 PNGAPI
 +png_get_acTL(png_structp png_ptr, png_infop info_ptr,
 +             png_uint_32 *num_frames, png_uint_32 *num_plays)
 +{
@@ -286,301 +395,21 @@ Index: pngget.c
 +       return (png_byte)(png_ptr->apng_flags & PNG_FIRST_FRAME_HIDDEN);
 +
 +    PNG_UNUSED(info_ptr)
 +
 +    return 0;
 +}
 +#endif /* APNG */
  #endif /* READ || WRITE */
-Index: png.c
-===================================================================
---- png.c
-+++ png.c
-@@ -816,17 +816,21 @@
- #else
- #  ifdef __STDC__
-    return PNG_STRING_NEWLINE \
--      "libpng version 1.6.34 - September 29, 2017" PNG_STRING_NEWLINE \
-+      "libpng version 1.6.34+apng - September 29, 2017" PNG_STRING_NEWLINE \
-       "Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson" \
-       PNG_STRING_NEWLINE \
-       "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
-       "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
--      PNG_STRING_NEWLINE;
-+      PNG_STRING_NEWLINE \
-+      "Portions Copyright (c) 2006-2007 Andrew Smith" PNG_STRING_NEWLINE \
-+      "Portions Copyright (c) 2008-2017 Max Stepin" PNG_STRING_NEWLINE ;
- #  else
--   return "libpng version 1.6.34 - September 29, 2017\
-+   return "libpng version 1.6.34+apng - September 29, 2017\
-       Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson\
-       Copyright (c) 1996-1997 Andreas Dilger\
--      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
-+      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\
-+      Portions Copyright (c) 2006-2007 Andrew Smith\
-+      Portions Copyright (c) 2008-2017 Max Stepin";
- #  endif
- #endif
- }
-Index: png.h
-===================================================================
---- png.h
-+++ png.h
-@@ -23,6 +23,12 @@
-  * If you modify libpng you may insert additional notices immediately following
-  * this sentence.
-  *
-+ * This modified version of libpng code adds animated PNG support and is
-+ * released under the libpng license described below. The modifications are
-+ * Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2017 Max Stepin,
-+ * and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
-+ * surrounding them in the modified libpng source files.
-+ *
-  * This code is released under the libpng license.
-  *
-  * libpng versions 1.0.7, July 1, 2000 through 1.6.34, September 29, 2017 are
-@@ -309,8 +315,9 @@
-  */
- 
- /* Version information for png.h - this should match the version in png.c */
--#define PNG_LIBPNG_VER_STRING "1.6.34"
--#define PNG_HEADER_VERSION_STRING " libpng version 1.6.34 - September 29, 2017\n"
-+#define PNG_LIBPNG_VER_STRING "1.6.34+apng"
-+#define PNG_HEADER_VERSION_STRING \
-+     " libpng version 1.6.34+apng - September 29, 2017\n"
- 
- #define PNG_LIBPNG_VER_SONUM   16
- #define PNG_LIBPNG_VER_DLLNUM  16
-@@ -361,6 +368,10 @@
- #   include "pnglibconf.h"
- #endif
- 
-+#define PNG_APNG_SUPPORTED
-+#define PNG_READ_APNG_SUPPORTED
-+#define PNG_WRITE_APNG_SUPPORTED
-+
- #ifndef PNG_VERSION_INFO_ONLY
- /* Machine specific configuration. */
- #  include "pngconf.h"
-@@ -456,6 +467,17 @@
-  * See pngconf.h for base types that vary by machine/system
-  */
- 
-+#ifdef PNG_APNG_SUPPORTED
-+/* dispose_op flags from inside fcTL */
-+#define PNG_DISPOSE_OP_NONE        0x00
-+#define PNG_DISPOSE_OP_BACKGROUND  0x01
-+#define PNG_DISPOSE_OP_PREVIOUS    0x02
-+
-+/* blend_op flags from inside fcTL */
-+#define PNG_BLEND_OP_SOURCE        0x00
-+#define PNG_BLEND_OP_OVER          0x01
-+#endif /* APNG */
-+
- /* This triggers a compiler error in png.c, if png.c and png.h
-  * do not agree upon the version number.
-  */
-@@ -777,6 +799,10 @@
- #define PNG_INFO_sCAL 0x4000U  /* ESR, 1.0.6 */
- #define PNG_INFO_IDAT 0x8000U  /* ESR, 1.0.6 */
- #define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */
-+#ifdef PNG_APNG_SUPPORTED
-+#define PNG_INFO_acTL 0x20000U
-+#define PNG_INFO_fcTL 0x40000U
-+#endif
- 
- /* This is used for the transformation routines, as some of them
-  * change these values for the row.  It also should enable using
-@@ -814,6 +840,10 @@
- #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
- typedef PNG_CALLBACK(void, *png_progressive_info_ptr, (png_structp, png_infop));
- typedef PNG_CALLBACK(void, *png_progressive_end_ptr, (png_structp, png_infop));
-+#ifdef PNG_APNG_SUPPORTED
-+typedef PNG_CALLBACK(void, *png_progressive_frame_ptr, (png_structp,
-+    png_uint_32));
-+#endif
- 
- /* The following callback receives png_uint_32 row_number, int pass for the
-  * png_bytep data of the row.  When transforming an interlaced image the
-@@ -3258,6 +3288,75 @@
-  *  END OF HARDWARE AND SOFTWARE OPTIONS
-  ******************************************************************************/
- 
-+#ifdef PNG_APNG_SUPPORTED
-+PNG_EXPORT(248, png_uint_32, png_get_acTL, (png_structp png_ptr,
-+   png_infop info_ptr, png_uint_32 *num_frames, png_uint_32 *num_plays));
-+
-+PNG_EXPORT(249, png_uint_32, png_set_acTL, (png_structp png_ptr,
-+   png_infop info_ptr, png_uint_32 num_frames, png_uint_32 num_plays));
-+
-+PNG_EXPORT(250, png_uint_32, png_get_num_frames, (png_structp png_ptr,
-+   png_infop info_ptr));
-+
-+PNG_EXPORT(251, png_uint_32, png_get_num_plays, (png_structp png_ptr,
-+   png_infop info_ptr));
-+
-+PNG_EXPORT(252, png_uint_32, png_get_next_frame_fcTL,
-+   (png_structp png_ptr, png_infop info_ptr, png_uint_32 *width,
-+   png_uint_32 *height, png_uint_32 *x_offset, png_uint_32 *y_offset,
-+   png_uint_16 *delay_num, png_uint_16 *delay_den, png_byte *dispose_op,
-+   png_byte *blend_op));
-+
-+PNG_EXPORT(253, png_uint_32, png_set_next_frame_fcTL,
-+   (png_structp png_ptr, png_infop info_ptr, png_uint_32 width,
-+   png_uint_32 height, png_uint_32 x_offset, png_uint_32 y_offset,
-+   png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
-+   png_byte blend_op));
-+
-+PNG_EXPORT(254, png_uint_32, png_get_next_frame_width,
-+   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(255, png_uint_32, png_get_next_frame_height,
-+   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(256, png_uint_32, png_get_next_frame_x_offset,
-+   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(257, png_uint_32, png_get_next_frame_y_offset,
-+   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(258, png_uint_16, png_get_next_frame_delay_num,
-+   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(259, png_uint_16, png_get_next_frame_delay_den,
-+   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(260, png_byte, png_get_next_frame_dispose_op,
-+   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(261, png_byte, png_get_next_frame_blend_op,
-+   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(262, png_byte, png_get_first_frame_is_hidden,
-+   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(263, png_uint_32, png_set_first_frame_is_hidden,
-+   (png_structp png_ptr, png_infop info_ptr, png_byte is_hidden));
-+
-+#ifdef PNG_READ_APNG_SUPPORTED
-+PNG_EXPORT(264, void, png_read_frame_head, (png_structp png_ptr,
-+   png_infop info_ptr));
-+#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
-+PNG_EXPORT(265, void, png_set_progressive_frame_fn, (png_structp png_ptr,
-+   png_progressive_frame_ptr frame_info_fn,
-+   png_progressive_frame_ptr frame_end_fn));
-+#endif /* PROGRESSIVE_READ */
-+#endif /* READ_APNG */
-+
-+#ifdef PNG_WRITE_APNG_SUPPORTED
-+PNG_EXPORT(266, void, png_write_frame_head, (png_structp png_ptr,
-+   png_infop info_ptr, png_bytepp row_pointers,
-+   png_uint_32 width, png_uint_32 height,
-+   png_uint_32 x_offset, png_uint_32 y_offset,
-+   png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
-+   png_byte blend_op));
-+
-+PNG_EXPORT(267, void, png_write_frame_tail, (png_structp png_ptr,
-+   png_infop info_ptr));
-+#endif /* WRITE_APNG */
-+#endif /* APNG */
-+
- /* Maintainer: Put new public prototypes here ^, in libpng.3, in project
-  * defs, and in scripts/symbols.def.
-  */
-@@ -3266,7 +3365,11 @@
-  * one to use is one more than this.)
-  */
- #ifdef PNG_EXPORT_LAST_ORDINAL
-+#ifdef PNG_APNG_SUPPORTED
-+  PNG_EXPORT_LAST_ORDINAL(269);
-+#else
-   PNG_EXPORT_LAST_ORDINAL(249);
-+#endif /* APNG */
- #endif
- 
- #ifdef __cplusplus
-Index: pngpriv.h
-===================================================================
---- pngpriv.h
-+++ pngpriv.h
-@@ -628,6 +628,10 @@
- #define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
-                    /*             0x4000U (unused) */
- #define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
-+#ifdef PNG_APNG_SUPPORTED
-+#define PNG_HAVE_acTL            0x10000U
-+#define PNG_HAVE_fcTL            0x20000U
-+#endif
- 
- /* Flags for the transformations the PNG library does on the image data */
- #define PNG_BGR                 0x0001U
-@@ -864,6 +868,16 @@
- #define png_tRNS PNG_U32(116,  82,  78,  83)
- #define png_zTXt PNG_U32(122,  84,  88, 116)
- 
-+#ifdef PNG_APNG_SUPPORTED
-+#define png_acTL PNG_U32( 97,  99,  84,  76)
-+#define png_fcTL PNG_U32(102,  99,  84,  76)
-+#define png_fdAT PNG_U32(102, 100,  65,  84)
-+
-+/* For png_struct.apng_flags: */
-+#define PNG_FIRST_FRAME_HIDDEN       0x0001U
-+#define PNG_APNG_APP                 0x0002U
-+#endif
-+
- /* The following will work on (signed char*) strings, whereas the get_uint_32
-  * macro will fail on top-bit-set values because of the sign extension.
-  */
-@@ -1615,6 +1629,49 @@
- 
- #endif /* PROGRESSIVE_READ */
- 
-+#ifdef PNG_APNG_SUPPORTED
-+PNG_INTERNAL_FUNCTION(void,png_ensure_fcTL_is_valid,(png_structp png_ptr,
-+   png_uint_32 width, png_uint_32 height,
-+   png_uint_32 x_offset, png_uint_32 y_offset,
-+   png_uint_16 delay_num, png_uint_16 delay_den,
-+   png_byte dispose_op, png_byte blend_op),PNG_EMPTY);
-+
-+#ifdef PNG_READ_APNG_SUPPORTED
-+PNG_INTERNAL_FUNCTION(void,png_handle_acTL,(png_structp png_ptr,
-+   png_infop info_ptr, png_uint_32 length),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_handle_fcTL,(png_structp png_ptr,
-+   png_infop info_ptr, png_uint_32 length),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_handle_fdAT,(png_structp png_ptr,
-+   png_infop info_ptr, png_uint_32 length),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_have_info,(png_structp png_ptr,
-+   png_infop info_ptr),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_ensure_sequence_number,(png_structp png_ptr,
-+   png_uint_32 length),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_read_reset,(png_structp png_ptr),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_read_reinit,(png_structp png_ptr,
-+   png_infop info_ptr),PNG_EMPTY);
-+#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
-+PNG_INTERNAL_FUNCTION(void,png_progressive_read_reset,(png_structp png_ptr),
-+   PNG_EMPTY);
-+#endif /* PROGRESSIVE_READ */
-+#endif /* READ_APNG */
-+
-+#ifdef PNG_WRITE_APNG_SUPPORTED
-+PNG_INTERNAL_FUNCTION(void,png_write_acTL,(png_structp png_ptr,
-+   png_uint_32 num_frames, png_uint_32 num_plays),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_write_fcTL,(png_structp png_ptr,
-+   png_uint_32 width, png_uint_32 height,
-+   png_uint_32 x_offset, png_uint_32 y_offset,
-+   png_uint_16 delay_num, png_uint_16 delay_den,
-+   png_byte dispose_op, png_byte blend_op),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_write_fdAT,(png_structp png_ptr,
-+   png_const_bytep data, png_size_t length),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_write_reset,(png_structp png_ptr),PNG_EMPTY);
-+PNG_INTERNAL_FUNCTION(void,png_write_reinit,(png_structp png_ptr,
-+   png_infop info_ptr, png_uint_32 width, png_uint_32 height),PNG_EMPTY);
-+#endif /* WRITE_APNG */
-+#endif /* APNG */
-+
- /* Added at libpng version 1.6.0 */
- #ifdef PNG_GAMMA_SUPPORTED
- PNG_INTERNAL_FUNCTION(void,png_colorspace_set_gamma,(png_const_structrp png_ptr,
-Index: pnginfo.h
-===================================================================
---- pnginfo.h
-+++ pnginfo.h
-@@ -263,5 +263,18 @@
+diff --git a/pnginfo.h b/pnginfo.h
+--- a/pnginfo.h
++++ b/pnginfo.h
+@@ -262,6 +262,19 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
+    /* Data valid if (valid & PNG_INFO_IDAT) non-zero */
     png_bytepp row_pointers;        /* the image bits */
  #endif
  
 +#ifdef PNG_APNG_SUPPORTED
 +   png_uint_32 num_frames; /* including default image */
 +   png_uint_32 num_plays;
 +   png_uint_32 next_frame_width;
 +   png_uint_32 next_frame_height;
@@ -589,123 +418,21 @@ Index: pnginfo.h
 +   png_uint_16 next_frame_delay_num;
 +   png_uint_16 next_frame_delay_den;
 +   png_byte next_frame_dispose_op;
 +   png_byte next_frame_blend_op;
 +#endif
 +
  };
  #endif /* PNGINFO_H */
-Index: pngstruct.h
-===================================================================
---- pngstruct.h
-+++ pngstruct.h
-@@ -403,6 +403,27 @@
-    png_byte filter_type;
- #endif
- 
-+#ifdef PNG_APNG_SUPPORTED
-+   png_uint_32 apng_flags;
-+   png_uint_32 next_seq_num;         /* next fcTL/fdAT chunk sequence number */
-+   png_uint_32 first_frame_width;
-+   png_uint_32 first_frame_height;
-+
-+#ifdef PNG_READ_APNG_SUPPORTED
-+   png_uint_32 num_frames_read;      /* incremented after all image data of */
-+                                     /* a frame is read */
-+#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
-+   png_progressive_frame_ptr frame_info_fn; /* frame info read callback */
-+   png_progressive_frame_ptr frame_end_fn;  /* frame data read callback */
-+#endif
-+#endif
-+
-+#ifdef PNG_WRITE_APNG_SUPPORTED
-+   png_uint_32 num_frames_to_write;
-+   png_uint_32 num_frames_written;
-+#endif
-+#endif /* APNG */
-+
- /* New members added in libpng-1.2.0 */
- 
- /* New members added in libpng-1.0.2 but first enabled by default in 1.2.0 */
-Index: pngwrite.c
-===================================================================
---- pngwrite.c
-+++ pngwrite.c
-@@ -128,6 +128,10 @@
-        * the application continues writing the PNG.  So check the 'invalid'
-        * flag here too.
-        */
-+#ifdef PNG_WRITE_APNG_SUPPORTED
-+   if ((info_ptr->valid & PNG_INFO_acTL) != 0)
-+      png_write_acTL(png_ptr, info_ptr->num_frames, info_ptr->num_plays);
-+#endif
- #ifdef PNG_GAMMA_SUPPORTED
- #  ifdef PNG_WRITE_gAMA_SUPPORTED
-       if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
-@@ -365,6 +369,11 @@
-    if ((png_ptr->mode & PNG_HAVE_IDAT) == 0)
-       png_error(png_ptr, "No IDATs written into file");
- 
-+#ifdef PNG_WRITE_APNG_SUPPORTED
-+   if (png_ptr->num_frames_written != png_ptr->num_frames_to_write)
-+      png_error(png_ptr, "Not enough frames written");
-+#endif
-+
- #ifdef PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED
-    if (png_ptr->num_palette_max > png_ptr->num_palette)
-       png_benign_error(png_ptr, "Wrote palette index exceeding num_palette");
-@@ -2393,4 +2402,42 @@
- }
- #endif /* SIMPLIFIED_WRITE_STDIO */
- #endif /* SIMPLIFIED_WRITE */
-+
-+#ifdef PNG_WRITE_APNG_SUPPORTED
-+void PNGAPI
-+png_write_frame_head(png_structp png_ptr, png_infop info_ptr,
-+    png_bytepp row_pointers, png_uint_32 width, png_uint_32 height,
-+    png_uint_32 x_offset, png_uint_32 y_offset,
-+    png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
-+    png_byte blend_op)
-+{
-+    png_debug(1, "in png_write_frame_head");
-+
-+    /* there is a chance this has been set after png_write_info was called,
-+    * so it would be set but not written. is there a way to be sure? */
-+    if ((info_ptr->valid & PNG_INFO_acTL) == 0)
-+        png_error(png_ptr, "png_write_frame_head(): acTL not set");
-+
-+    png_write_reset(png_ptr);
-+
-+    png_write_reinit(png_ptr, info_ptr, width, height);
-+
-+    if ((png_ptr->apng_flags & PNG_FIRST_FRAME_HIDDEN) == 0 ||
-+        png_ptr->num_frames_written != 0)
-+        png_write_fcTL(png_ptr, width, height, x_offset, y_offset,
-+                       delay_num, delay_den, dispose_op, blend_op);
-+
-+    PNG_UNUSED(row_pointers)
-+}
-+
-+void PNGAPI
-+png_write_frame_tail(png_structp png_ptr, png_infop info_ptr)
-+{
-+    png_debug(1, "in png_write_frame_tail");
-+
-+    png_ptr->num_frames_written++;
-+
-+    PNG_UNUSED(info_ptr)
-+}
-+#endif /* WRITE_APNG */
- #endif /* WRITE */
-Index: pngpread.c
-===================================================================
---- pngpread.c
-+++ pngpread.c
-@@ -195,6 +195,89 @@
+diff --git a/pngpread.c b/pngpread.c
+--- a/pngpread.c
++++ b/pngpread.c
+@@ -194,8 +194,91 @@ png_push_read_chunk(png_structrp png_ptr
+    }
  
     chunk_name = png_ptr->chunk_name;
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +   if (png_ptr->num_frames_read > 0 &&
 +       png_ptr->num_frames_read < info_ptr->num_frames)
 +   {
 +      if (chunk_name == png_IDAT)
@@ -785,27 +512,31 @@ Index: pngpread.c
 +
 +      return;
 +   }
 +#endif /* READ_APNG */
 +
     if (chunk_name == png_IDAT)
     {
        if ((png_ptr->mode & PNG_AFTER_IDAT) != 0)
-@@ -261,6 +344,9 @@
+          png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
+@@ -260,8 +343,11 @@ png_push_read_chunk(png_structrp png_ptr
+    }
  
     else if (chunk_name == png_IDAT)
     {
 +#ifdef PNG_READ_APNG_SUPPORTED
 +      png_have_info(png_ptr, info_ptr);
 +#endif
        png_ptr->idat_size = png_ptr->push_length;
        png_ptr->process_mode = PNG_READ_IDAT_MODE;
        png_push_have_info(png_ptr, info_ptr);
-@@ -407,6 +493,20 @@
+       png_ptr->zstream.avail_out =
+@@ -406,8 +492,22 @@ png_push_read_chunk(png_structrp png_ptr
+       png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
     }
  #endif
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +   else if (chunk_name == png_acTL)
 +   {
 +      PNG_PUSH_SAVE_BUFFER_IF_FULL
 +      png_handle_acTL(png_ptr, info_ptr, png_ptr->push_length);
@@ -816,29 +547,31 @@ Index: pngpread.c
 +      PNG_PUSH_SAVE_BUFFER_IF_FULL
 +      png_handle_fcTL(png_ptr, info_ptr, png_ptr->push_length);
 +   }
 +
 +#endif /* READ_APNG */
     else
     {
        PNG_PUSH_SAVE_BUFFER_IF_FULL
-@@ -539,7 +639,11 @@
+       png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length,
+@@ -538,27 +638,74 @@ png_push_read_IDAT(png_structrp png_ptr)
+       png_byte chunk_length[4];
        png_byte chunk_tag[4];
  
        /* TODO: this code can be commoned up with the same code in push_read */
 +#ifdef PNG_READ_APNG_SUPPORTED
 +      PNG_PUSH_SAVE_BUFFER_IF_LT(12)
 +#else
        PNG_PUSH_SAVE_BUFFER_IF_LT(8)
 +#endif
        png_push_fill_buffer(png_ptr, chunk_length, 4);
        png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
        png_reset_crc(png_ptr);
-@@ -547,17 +651,60 @@
+       png_crc_read(png_ptr, chunk_tag, 4);
        png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag);
        png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +      if (png_ptr->chunk_name != png_fdAT && png_ptr->num_frames_read > 0)
 +      {
 +          if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) != 0)
 +          {
@@ -889,34 +622,38 @@ Index: pngpread.c
 +      {
 +         png_ensure_sequence_number(png_ptr, 4);
 +         png_ptr->idat_size -= 4;
 +      }
 +#endif
     }
  
     if (png_ptr->idat_size != 0 && png_ptr->save_buffer_size != 0)
-@@ -631,6 +778,16 @@
+    {
+@@ -630,8 +777,18 @@ png_process_IDAT_data(png_structrp png_p
+    /* The caller checks for a non-zero buffer length. */
     if (!(buffer_length > 0) || buffer == NULL)
        png_error(png_ptr, "No IDAT data (internal error)");
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +   /* If the app is not APNG-aware, decode only the first frame */
 +   if ((png_ptr->apng_flags & PNG_APNG_APP) == 0 &&
 +      png_ptr->num_frames_read > 0)
 +   {
 +      png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
 +      return;
 +   }
 +#endif
 +
     /* This routine must process all the data it has been given
      * before returning, calling the row callback as required to
      * handle the uncompressed results.
-@@ -1085,6 +1242,18 @@
+     */
+@@ -1084,8 +1241,20 @@ png_set_progressive_read_fn(png_structrp
+ 
     png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
  }
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +void PNGAPI
 +png_set_progressive_frame_fn(png_structp png_ptr,
 +   png_progressive_frame_ptr frame_info_fn,
 +   png_progressive_frame_ptr frame_end_fn)
@@ -925,196 +662,231 @@ Index: pngpread.c
 +   png_ptr->frame_end_fn = frame_end_fn;
 +   png_ptr->apng_flags |= PNG_APNG_APP;
 +}
 +#endif
 +
  png_voidp PNGAPI
  png_get_progressive_ptr(png_const_structrp png_ptr)
  {
-Index: pngset.c
-===================================================================
---- pngset.c
-+++ pngset.c
-@@ -288,6 +288,11 @@
-    info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
- 
-    info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
-+
+    if (png_ptr == NULL)
+diff --git a/pngpriv.h b/pngpriv.h
+--- a/pngpriv.h
++++ b/pngpriv.h
+@@ -633,8 +633,12 @@
+ #define PNG_HAVE_PNG_SIGNATURE    0x1000U
+ #define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
+                    /*             0x4000U (unused) */
+ #define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
 +#ifdef PNG_APNG_SUPPORTED
-+   /* for non-animated png. this may be overwritten from an acTL chunk later */
-+   info_ptr->num_frames = 1;
++#define PNG_HAVE_acTL            0x10000U
++#define PNG_HAVE_fcTL            0x20000U
 +#endif
- }
+ 
+ /* Flags for the transformations the PNG library does on the image data */
+ #define PNG_BGR                 0x0001U
+ #define PNG_INTERLACE           0x0002U
+@@ -869,8 +873,18 @@
+ #define png_tIME PNG_U32(116,  73,  77,  69)
+ #define png_tRNS PNG_U32(116,  82,  78,  83)
+ #define png_zTXt PNG_U32(122,  84,  88, 116)
  
- #ifdef PNG_oFFs_SUPPORTED
-@@ -1158,6 +1163,146 @@
- }
- #endif /* sPLT */
++#ifdef PNG_APNG_SUPPORTED
++#define png_acTL PNG_U32( 97,  99,  84,  76)
++#define png_fcTL PNG_U32(102,  99,  84,  76)
++#define png_fdAT PNG_U32(102, 100,  65,  84)
++
++/* For png_struct.apng_flags: */
++#define PNG_FIRST_FRAME_HIDDEN       0x0001U
++#define PNG_APNG_APP                 0x0002U
++#endif
++
+ /* The following will work on (signed char*) strings, whereas the get_uint_32
+  * macro will fail on top-bit-set values because of the sign extension.
+  */
+ #define PNG_CHUNK_FROM_STRING(s)\
+@@ -1620,8 +1634,51 @@ PNG_INTERNAL_FUNCTION(void,png_push_read
+ #  endif
+ 
+ #endif /* PROGRESSIVE_READ */
  
 +#ifdef PNG_APNG_SUPPORTED
-+png_uint_32 PNGAPI
-+png_set_acTL(png_structp png_ptr, png_infop info_ptr,
-+    png_uint_32 num_frames, png_uint_32 num_plays)
-+{
-+    png_debug1(1, "in %s storage function", "acTL");
++PNG_INTERNAL_FUNCTION(void,png_ensure_fcTL_is_valid,(png_structp png_ptr,
++   png_uint_32 width, png_uint_32 height,
++   png_uint_32 x_offset, png_uint_32 y_offset,
++   png_uint_16 delay_num, png_uint_16 delay_den,
++   png_byte dispose_op, png_byte blend_op),PNG_EMPTY);
++
++#ifdef PNG_READ_APNG_SUPPORTED
++PNG_INTERNAL_FUNCTION(void,png_handle_acTL,(png_structp png_ptr,
++   png_infop info_ptr, png_uint_32 length),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_handle_fcTL,(png_structp png_ptr,
++   png_infop info_ptr, png_uint_32 length),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_handle_fdAT,(png_structp png_ptr,
++   png_infop info_ptr, png_uint_32 length),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_have_info,(png_structp png_ptr,
++   png_infop info_ptr),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_ensure_sequence_number,(png_structp png_ptr,
++   png_uint_32 length),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_read_reset,(png_structp png_ptr),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_read_reinit,(png_structp png_ptr,
++   png_infop info_ptr),PNG_EMPTY);
++#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
++PNG_INTERNAL_FUNCTION(void,png_progressive_read_reset,(png_structp png_ptr),
++   PNG_EMPTY);
++#endif /* PROGRESSIVE_READ */
++#endif /* READ_APNG */
 +
-+    if (png_ptr == NULL || info_ptr == NULL)
-+    {
-+        png_warning(png_ptr,
-+                    "Call to png_set_acTL() with NULL png_ptr "
-+                    "or info_ptr ignored");
-+        return (0);
-+    }
-+    if (num_frames == 0)
-+    {
-+        png_warning(png_ptr,
-+                    "Ignoring attempt to set acTL with num_frames zero");
-+        return (0);
-+    }
-+    if (num_frames > PNG_UINT_31_MAX)
-+    {
-+        png_warning(png_ptr,
-+                    "Ignoring attempt to set acTL with num_frames > 2^31-1");
-+        return (0);
-+    }
-+    if (num_plays > PNG_UINT_31_MAX)
-+    {
-+        png_warning(png_ptr,
-+                    "Ignoring attempt to set acTL with num_plays > 2^31-1");
-+        return (0);
-+    }
++#ifdef PNG_WRITE_APNG_SUPPORTED
++PNG_INTERNAL_FUNCTION(void,png_write_acTL,(png_structp png_ptr,
++   png_uint_32 num_frames, png_uint_32 num_plays),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_write_fcTL,(png_structp png_ptr,
++   png_uint_32 width, png_uint_32 height,
++   png_uint_32 x_offset, png_uint_32 y_offset,
++   png_uint_16 delay_num, png_uint_16 delay_den,
++   png_byte dispose_op, png_byte blend_op),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_write_fdAT,(png_structp png_ptr,
++   png_const_bytep data, png_size_t length),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_write_reset,(png_structp png_ptr),PNG_EMPTY);
++PNG_INTERNAL_FUNCTION(void,png_write_reinit,(png_structp png_ptr,
++   png_infop info_ptr, png_uint_32 width, png_uint_32 height),PNG_EMPTY);
++#endif /* WRITE_APNG */
++#endif /* APNG */
 +
-+    info_ptr->num_frames = num_frames;
-+    info_ptr->num_plays = num_plays;
+ /* Added at libpng version 1.6.0 */
+ #ifdef PNG_GAMMA_SUPPORTED
+ PNG_INTERNAL_FUNCTION(void,png_colorspace_set_gamma,(png_const_structrp png_ptr,
+     png_colorspacerp colorspace, png_fixed_point gAMA), PNG_EMPTY);
+diff --git a/pngread.c b/pngread.c
+--- a/pngread.c
++++ b/pngread.c
+@@ -160,8 +160,11 @@ png_read_info(png_structrp png_ptr, png_
+          png_handle_PLTE(png_ptr, info_ptr, length);
+ 
+       else if (chunk_name == png_IDAT)
+       {
++#ifdef PNG_READ_APNG_SUPPORTED
++         png_have_info(png_ptr, info_ptr);
++#endif
+          png_ptr->idat_size = length;
+          break;
+       }
+ 
+@@ -254,15 +257,92 @@ png_read_info(png_structrp png_ptr, png_
+       else if (chunk_name == png_iTXt)
+          png_handle_iTXt(png_ptr, info_ptr, length);
+ #endif
+ 
++#ifdef PNG_READ_APNG_SUPPORTED
++      else if (chunk_name == png_acTL)
++         png_handle_acTL(png_ptr, info_ptr, length);
++
++      else if (chunk_name == png_fcTL)
++         png_handle_fcTL(png_ptr, info_ptr, length);
 +
-+    info_ptr->valid |= PNG_INFO_acTL;
++      else if (chunk_name == png_fdAT)
++         png_handle_fdAT(png_ptr, info_ptr, length);
++#endif
 +
-+    return (1);
-+}
+       else
+          png_handle_unknown(png_ptr, info_ptr, length,
+              PNG_HANDLE_CHUNK_AS_DEFAULT);
+    }
+ }
+ #endif /* SEQUENTIAL_READ */
+ 
++#ifdef PNG_READ_APNG_SUPPORTED
++void PNGAPI
++png_read_frame_head(png_structp png_ptr, png_infop info_ptr)
++{
++    png_byte have_chunk_after_DAT; /* after IDAT or after fdAT */
 +
-+/* delay_num and delay_den can hold any 16-bit values including zero */
-+png_uint_32 PNGAPI
-+png_set_next_frame_fcTL(png_structp png_ptr, png_infop info_ptr,
-+    png_uint_32 width, png_uint_32 height,
-+    png_uint_32 x_offset, png_uint_32 y_offset,
-+    png_uint_16 delay_num, png_uint_16 delay_den,
-+    png_byte dispose_op, png_byte blend_op)
-+{
-+    png_debug1(1, "in %s storage function", "fcTL");
++    png_debug(0, "Reading frame head");
++
++    if ((png_ptr->mode & PNG_HAVE_acTL) == 0)
++        png_error(png_ptr, "attempt to png_read_frame_head() but "
++                           "no acTL present");
 +
-+    if (png_ptr == NULL || info_ptr == NULL)
++    /* do nothing for the main IDAT */
++    if (png_ptr->num_frames_read == 0)
++        return;
++
++    png_read_reset(png_ptr);
++    png_ptr->flags &= ~PNG_FLAG_ROW_INIT;
++    png_ptr->mode &= ~PNG_HAVE_fcTL;
++
++    have_chunk_after_DAT = 0;
++    for (;;)
 +    {
-+        png_warning(png_ptr,
-+                    "Call to png_set_fcTL() with NULL png_ptr or info_ptr "
-+                    "ignored");
-+        return (0);
-+    }
++        png_uint_32 length = png_read_chunk_header(png_ptr);
 +
-+    png_ensure_fcTL_is_valid(png_ptr, width, height, x_offset, y_offset,
-+                             delay_num, delay_den, dispose_op, blend_op);
++        if (png_ptr->chunk_name == png_IDAT)
++        {
++            /* discard trailing IDATs for the first frame */
++            if (have_chunk_after_DAT != 0 || png_ptr->num_frames_read > 1)
++                png_error(png_ptr, "png_read_frame_head(): out of place IDAT");
++            png_crc_finish(png_ptr, length);
++        }
++
++        else if (png_ptr->chunk_name == png_fcTL)
++        {
++            png_handle_fcTL(png_ptr, info_ptr, length);
++            have_chunk_after_DAT = 1;
++        }
 +
-+    if (blend_op == PNG_BLEND_OP_OVER)
-+    {
-+        if ((png_ptr->color_type & PNG_COLOR_MASK_ALPHA) == 0 &&
-+            png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS) == 0)
++        else if (png_ptr->chunk_name == png_fdAT)
 +        {
-+          png_warning(png_ptr, "PNG_BLEND_OP_OVER is meaningless "
-+                               "and wasteful for opaque images, ignored");
-+          blend_op = PNG_BLEND_OP_SOURCE;
++            png_ensure_sequence_number(png_ptr, length);
++
++            /* discard trailing fdATs for frames other than the first */
++            if (have_chunk_after_DAT == 0 && png_ptr->num_frames_read > 1)
++                png_crc_finish(png_ptr, length - 4);
++            else if (png_ptr->mode & PNG_HAVE_fcTL)
++            {
++                png_ptr->idat_size = length - 4;
++                png_ptr->mode |= PNG_HAVE_IDAT;
++
++                break;
++            }
++            else
++                png_error(png_ptr, "png_read_frame_head(): out of place fdAT");
++        }
++        else
++        {
++            png_warning(png_ptr, "Skipped (ignored) a chunk "
++                                 "between APNG chunks");
++            png_crc_finish(png_ptr, length);
 +        }
 +    }
-+
-+    info_ptr->next_frame_width = width;
-+    info_ptr->next_frame_height = height;
-+    info_ptr->next_frame_x_offset = x_offset;
-+    info_ptr->next_frame_y_offset = y_offset;
-+    info_ptr->next_frame_delay_num = delay_num;
-+    info_ptr->next_frame_delay_den = delay_den;
-+    info_ptr->next_frame_dispose_op = dispose_op;
-+    info_ptr->next_frame_blend_op = blend_op;
-+
-+    info_ptr->valid |= PNG_INFO_fcTL;
-+
-+    return (1);
 +}
-+
-+void /* PRIVATE */
-+png_ensure_fcTL_is_valid(png_structp png_ptr,
-+    png_uint_32 width, png_uint_32 height,
-+    png_uint_32 x_offset, png_uint_32 y_offset,
-+    png_uint_16 delay_num, png_uint_16 delay_den,
-+    png_byte dispose_op, png_byte blend_op)
-+{
-+    if (width == 0 || width > PNG_UINT_31_MAX)
-+        png_error(png_ptr, "invalid width in fcTL (0 or > 2^31-1)");
-+    if (height == 0 || height > PNG_UINT_31_MAX)
-+        png_error(png_ptr, "invalid height in fcTL (0 or > 2^31-1)");
-+    if (x_offset > PNG_UINT_31_MAX)
-+        png_error(png_ptr, "invalid x_offset in fcTL (> 2^31-1)");
-+    if (y_offset > PNG_UINT_31_MAX)
-+        png_error(png_ptr, "invalid y_offset in fcTL (> 2^31-1)");
-+    if (width + x_offset > png_ptr->first_frame_width ||
-+        height + y_offset > png_ptr->first_frame_height)
-+        png_error(png_ptr, "dimensions of a frame are greater than "
-+                           "the ones in IHDR");
++#endif /* READ_APNG */
 +
-+    if (dispose_op != PNG_DISPOSE_OP_NONE &&
-+        dispose_op != PNG_DISPOSE_OP_BACKGROUND &&
-+        dispose_op != PNG_DISPOSE_OP_PREVIOUS)
-+        png_error(png_ptr, "invalid dispose_op in fcTL");
-+
-+    if (blend_op != PNG_BLEND_OP_SOURCE &&
-+        blend_op != PNG_BLEND_OP_OVER)
-+        png_error(png_ptr, "invalid blend_op in fcTL");
-+
-+    PNG_UNUSED(delay_num)
-+    PNG_UNUSED(delay_den)
-+}
-+
-+png_uint_32 PNGAPI
-+png_set_first_frame_is_hidden(png_structp png_ptr, png_infop info_ptr,
-+                              png_byte is_hidden)
-+{
-+    png_debug(1, "in png_first_frame_is_hidden()");
-+
-+    if (png_ptr == NULL)
-+        return 0;
-+
-+    if (is_hidden != 0)
-+        png_ptr->apng_flags |= PNG_FIRST_FRAME_HIDDEN;
-+    else
-+        png_ptr->apng_flags &= ~PNG_FIRST_FRAME_HIDDEN;
-+
-+    PNG_UNUSED(info_ptr)
-+
-+    return 1;
-+}
-+#endif /* APNG */
-+
- #ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
- static png_byte
- check_location(png_const_structrp png_ptr, int location)
-Index: pngrutil.c
-===================================================================
---- pngrutil.c
-+++ pngrutil.c
-@@ -865,6 +865,11 @@
+ /* Optional call to update the users info_ptr structure */
+ void PNGAPI
+ png_read_update_info(png_structrp png_ptr, png_inforp info_ptr)
+ {
+diff --git a/pngrutil.c b/pngrutil.c
+--- a/pngrutil.c
++++ b/pngrutil.c
+@@ -864,8 +864,13 @@ png_handle_IHDR(png_structrp png_ptr, pn
+    compression_type = buf[10];
     filter_type = buf[11];
     interlace_type = buf[12];
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +   png_ptr->first_frame_width = width;
 +   png_ptr->first_frame_height = height;
 +#endif
 +
     /* Set internal variables */
     png_ptr->width = width;
     png_ptr->height = height;
-@@ -2840,6 +2845,180 @@
+    png_ptr->bit_depth = (png_byte)bit_depth;
+@@ -2857,8 +2862,182 @@ png_handle_iTXt(png_structrp png_ptr, pn
+       png_chunk_benign_error(png_ptr, errmsg);
  }
  #endif
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +void /* PRIVATE */
 +png_handle_acTL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 +{
 +    png_byte data[8];
@@ -1285,29 +1057,33 @@ Index: pngrutil.c
 +
 +    png_ptr->next_seq_num++;
 +}
 +#endif /* READ_APNG */
 +
  #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
  /* Utility function for png_handle_unknown; set up png_ptr::unknown_chunk */
  static int
-@@ -3145,7 +3324,11 @@
+ png_cache_unknown_chunk(png_structrp png_ptr, png_uint_32 length)
+@@ -3162,9 +3341,13 @@ png_check_chunk_length(png_const_structr
+ # elif PNG_USER_CHUNK_MALLOC_MAX > 0
     if (PNG_USER_CHUNK_MALLOC_MAX < limit)
        limit = PNG_USER_CHUNK_MALLOC_MAX;
  # endif
 +#ifdef PNG_READ_APNG_SUPPORTED
 +   if (png_ptr->chunk_name == png_IDAT || png_ptr->chunk_name == png_fdAT)
 +#else
     if (png_ptr->chunk_name == png_IDAT)
 +#endif
     {
        png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
        size_t row_factor =
-@@ -4146,6 +4329,38 @@
+          (size_t)png_ptr->width
+@@ -4166,8 +4349,40 @@ png_read_IDAT_data(png_structrp png_ptr,
+       {
           uInt avail_in;
           png_bytep buffer;
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +         png_uint_32 bytes_to_skip = 0;
 +
 +         while (png_ptr->idat_size == 0 || bytes_to_skip != 0)
 +         {
@@ -1336,35 +1112,41 @@ Index: pngrutil.c
 +
 +               png_ptr->idat_size -= 4;
 +            }
 +         }
 +#else
           while (png_ptr->idat_size == 0)
           {
              png_crc_finish(png_ptr, 0);
-@@ -4157,6 +4372,7 @@
+ 
+@@ -4177,8 +4392,9 @@ png_read_IDAT_data(png_structrp png_ptr,
+              */
              if (png_ptr->chunk_name != png_IDAT)
                 png_error(png_ptr, "Not enough image data");
           }
 +#endif /* READ_APNG */
  
           avail_in = png_ptr->IDAT_read_size;
  
-@@ -4220,6 +4436,9 @@
+          if (avail_in > png_ptr->idat_size)
+@@ -4240,8 +4456,11 @@ png_read_IDAT_data(png_structrp png_ptr,
+          png_ptr->zstream.next_out = NULL;
  
           png_ptr->mode |= PNG_AFTER_IDAT;
           png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
 +#ifdef PNG_READ_APNG_SUPPORTED
 +         png_ptr->num_frames_read++;
 +#endif
  
           if (png_ptr->zstream.avail_in > 0 || png_ptr->idat_size > 0)
              png_chunk_benign_error(png_ptr, "Extra compressed data");
-@@ -4658,4 +4877,80 @@
+          break;
+@@ -4678,5 +4897,81 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED
+       png_error(png_ptr, png_ptr->zstream.msg);
  
     png_ptr->flags |= PNG_FLAG_ROW_INIT;
  }
 +
 +#ifdef PNG_READ_APNG_SUPPORTED
 +/* This function is to be called after the main IDAT set has been read and
 + * before a new IDAT is read. It resets some parts of png_ptr
 + * to make them usable by the read functions again */
@@ -1435,33 +1217,308 @@ Index: pngrutil.c
 +    png_ptr->zstream.next_in = 0;
 +    png_ptr->zstream.next_out = png_ptr->row_buf;
 +    png_ptr->zstream.avail_out = (uInt)PNG_ROWBYTES(png_ptr->pixel_depth,
 +        png_ptr->iwidth) + 1;
 +}
 +#endif /* PROGRESSIVE_READ */
 +#endif /* READ_APNG */
  #endif /* READ */
-Index: pngwutil.c
-===================================================================
---- pngwutil.c
-+++ pngwutil.c
-@@ -822,6 +822,11 @@
+diff --git a/pngset.c b/pngset.c
+--- a/pngset.c
++++ b/pngset.c
+@@ -287,8 +287,13 @@ png_set_IHDR(png_const_structrp png_ptr,
+ 
+    info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
+ 
+    info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
++
++#ifdef PNG_APNG_SUPPORTED
++   /* for non-animated png. this may be overwritten from an acTL chunk later */
++   info_ptr->num_frames = 1;
++#endif
+ }
+ 
+ #ifdef PNG_oFFs_SUPPORTED
+ void PNGAPI
+@@ -1157,8 +1162,148 @@ png_set_sPLT(png_const_structrp png_ptr,
+       png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
+ }
+ #endif /* sPLT */
+ 
++#ifdef PNG_APNG_SUPPORTED
++png_uint_32 PNGAPI
++png_set_acTL(png_structp png_ptr, png_infop info_ptr,
++    png_uint_32 num_frames, png_uint_32 num_plays)
++{
++    png_debug1(1, "in %s storage function", "acTL");
++
++    if (png_ptr == NULL || info_ptr == NULL)
++    {
++        png_warning(png_ptr,
++                    "Call to png_set_acTL() with NULL png_ptr "
++                    "or info_ptr ignored");
++        return (0);
++    }
++    if (num_frames == 0)
++    {
++        png_warning(png_ptr,
++                    "Ignoring attempt to set acTL with num_frames zero");
++        return (0);
++    }
++    if (num_frames > PNG_UINT_31_MAX)
++    {
++        png_warning(png_ptr,
++                    "Ignoring attempt to set acTL with num_frames > 2^31-1");
++        return (0);
++    }
++    if (num_plays > PNG_UINT_31_MAX)
++    {
++        png_warning(png_ptr,
++                    "Ignoring attempt to set acTL with num_plays > 2^31-1");
++        return (0);
++    }
++
++    info_ptr->num_frames = num_frames;
++    info_ptr->num_plays = num_plays;
++
++    info_ptr->valid |= PNG_INFO_acTL;
++
++    return (1);
++}
++
++/* delay_num and delay_den can hold any 16-bit values including zero */
++png_uint_32 PNGAPI
++png_set_next_frame_fcTL(png_structp png_ptr, png_infop info_ptr,
++    png_uint_32 width, png_uint_32 height,
++    png_uint_32 x_offset, png_uint_32 y_offset,
++    png_uint_16 delay_num, png_uint_16 delay_den,
++    png_byte dispose_op, png_byte blend_op)
++{
++    png_debug1(1, "in %s storage function", "fcTL");
++
++    if (png_ptr == NULL || info_ptr == NULL)
++    {
++        png_warning(png_ptr,
++                    "Call to png_set_fcTL() with NULL png_ptr or info_ptr "
++                    "ignored");
++        return (0);
++    }
++
++    png_ensure_fcTL_is_valid(png_ptr, width, height, x_offset, y_offset,
++                             delay_num, delay_den, dispose_op, blend_op);
++
++    if (blend_op == PNG_BLEND_OP_OVER)
++    {
++        if ((png_ptr->color_type & PNG_COLOR_MASK_ALPHA) == 0 &&
++            png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS) == 0)
++        {
++          png_warning(png_ptr, "PNG_BLEND_OP_OVER is meaningless "
++                               "and wasteful for opaque images, ignored");
++          blend_op = PNG_BLEND_OP_SOURCE;
++        }
++    }
++
++    info_ptr->next_frame_width = width;
++    info_ptr->next_frame_height = height;
++    info_ptr->next_frame_x_offset = x_offset;
++    info_ptr->next_frame_y_offset = y_offset;
++    info_ptr->next_frame_delay_num = delay_num;
++    info_ptr->next_frame_delay_den = delay_den;
++    info_ptr->next_frame_dispose_op = dispose_op;
++    info_ptr->next_frame_blend_op = blend_op;
++
++    info_ptr->valid |= PNG_INFO_fcTL;
++
++    return (1);
++}
++
++void /* PRIVATE */
++png_ensure_fcTL_is_valid(png_structp png_ptr,
++    png_uint_32 width, png_uint_32 height,
++    png_uint_32 x_offset, png_uint_32 y_offset,
++    png_uint_16 delay_num, png_uint_16 delay_den,
++    png_byte dispose_op, png_byte blend_op)
++{
++    if (width == 0 || width > PNG_UINT_31_MAX)
++        png_error(png_ptr, "invalid width in fcTL (0 or > 2^31-1)");
++    if (height == 0 || height > PNG_UINT_31_MAX)
++        png_error(png_ptr, "invalid height in fcTL (0 or > 2^31-1)");
++    if (x_offset > PNG_UINT_31_MAX)
++        png_error(png_ptr, "invalid x_offset in fcTL (> 2^31-1)");
++    if (y_offset > PNG_UINT_31_MAX)
++        png_error(png_ptr, "invalid y_offset in fcTL (> 2^31-1)");
++    if (width + x_offset > png_ptr->first_frame_width ||
++        height + y_offset > png_ptr->first_frame_height)
++        png_error(png_ptr, "dimensions of a frame are greater than "
++                           "the ones in IHDR");
++
++    if (dispose_op != PNG_DISPOSE_OP_NONE &&
++        dispose_op != PNG_DISPOSE_OP_BACKGROUND &&
++        dispose_op != PNG_DISPOSE_OP_PREVIOUS)
++        png_error(png_ptr, "invalid dispose_op in fcTL");
++
++    if (blend_op != PNG_BLEND_OP_SOURCE &&
++        blend_op != PNG_BLEND_OP_OVER)
++        png_error(png_ptr, "invalid blend_op in fcTL");
++
++    PNG_UNUSED(delay_num)
++    PNG_UNUSED(delay_den)
++}
++
++png_uint_32 PNGAPI
++png_set_first_frame_is_hidden(png_structp png_ptr, png_infop info_ptr,
++                              png_byte is_hidden)
++{
++    png_debug(1, "in png_first_frame_is_hidden()");
++
++    if (png_ptr == NULL)
++        return 0;
++
++    if (is_hidden != 0)
++        png_ptr->apng_flags |= PNG_FIRST_FRAME_HIDDEN;
++    else
++        png_ptr->apng_flags &= ~PNG_FIRST_FRAME_HIDDEN;
++
++    PNG_UNUSED(info_ptr)
++
++    return 1;
++}
++#endif /* APNG */
++
+ #ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
+ static png_byte
+ check_location(png_const_structrp png_ptr, int location)
+ {
+diff --git a/pngstruct.h b/pngstruct.h
+--- a/pngstruct.h
++++ b/pngstruct.h
+@@ -402,8 +402,29 @@ struct png_struct_def
+ #ifdef PNG_MNG_FEATURES_SUPPORTED
+    png_byte filter_type;
+ #endif
+ 
++#ifdef PNG_APNG_SUPPORTED
++   png_uint_32 apng_flags;
++   png_uint_32 next_seq_num;         /* next fcTL/fdAT chunk sequence number */
++   png_uint_32 first_frame_width;
++   png_uint_32 first_frame_height;
++
++#ifdef PNG_READ_APNG_SUPPORTED
++   png_uint_32 num_frames_read;      /* incremented after all image data of */
++                                     /* a frame is read */
++#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
++   png_progressive_frame_ptr frame_info_fn; /* frame info read callback */
++   png_progressive_frame_ptr frame_end_fn;  /* frame data read callback */
++#endif
++#endif
++
++#ifdef PNG_WRITE_APNG_SUPPORTED
++   png_uint_32 num_frames_to_write;
++   png_uint_32 num_frames_written;
++#endif
++#endif /* APNG */
++
+ /* New members added in libpng-1.2.0 */
+ 
+ /* New members added in libpng-1.0.2 but first enabled by default in 1.2.0 */
+ #ifdef PNG_USER_MEM_SUPPORTED
+diff --git a/pngwrite.c b/pngwrite.c
+--- a/pngwrite.c
++++ b/pngwrite.c
+@@ -127,8 +127,12 @@ png_write_info_before_PLTE(png_structrp 
+        * an error and calls png_error while the color space is being set, yet
+        * the application continues writing the PNG.  So check the 'invalid'
+        * flag here too.
+        */
++#ifdef PNG_WRITE_APNG_SUPPORTED
++   if ((info_ptr->valid & PNG_INFO_acTL) != 0)
++      png_write_acTL(png_ptr, info_ptr->num_frames, info_ptr->num_plays);
++#endif
+ #ifdef PNG_GAMMA_SUPPORTED
+ #  ifdef PNG_WRITE_gAMA_SUPPORTED
+       if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) == 0 &&
+           (info_ptr->colorspace.flags & PNG_COLORSPACE_FROM_gAMA) != 0 &&
+@@ -364,8 +368,13 @@ png_write_end(png_structrp png_ptr, png_
+ 
+    if ((png_ptr->mode & PNG_HAVE_IDAT) == 0)
+       png_error(png_ptr, "No IDATs written into file");
+ 
++#ifdef PNG_WRITE_APNG_SUPPORTED
++   if (png_ptr->num_frames_written != png_ptr->num_frames_to_write)
++      png_error(png_ptr, "Not enough frames written");
++#endif
++
+ #ifdef PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED
+    if (png_ptr->num_palette_max > png_ptr->num_palette)
+       png_benign_error(png_ptr, "Wrote palette index exceeding num_palette");
+ #endif
+@@ -2391,5 +2400,43 @@ png_image_write_to_file(png_imagep image
+       return 0;
+ }
+ #endif /* SIMPLIFIED_WRITE_STDIO */
+ #endif /* SIMPLIFIED_WRITE */
++
++#ifdef PNG_WRITE_APNG_SUPPORTED
++void PNGAPI
++png_write_frame_head(png_structp png_ptr, png_infop info_ptr,
++    png_bytepp row_pointers, png_uint_32 width, png_uint_32 height,
++    png_uint_32 x_offset, png_uint_32 y_offset,
++    png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
++    png_byte blend_op)
++{
++    png_debug(1, "in png_write_frame_head");
++
++    /* there is a chance this has been set after png_write_info was called,
++    * so it would be set but not written. is there a way to be sure? */
++    if ((info_ptr->valid & PNG_INFO_acTL) == 0)
++        png_error(png_ptr, "png_write_frame_head(): acTL not set");
++
++    png_write_reset(png_ptr);
++
++    png_write_reinit(png_ptr, info_ptr, width, height);
++
++    if ((png_ptr->apng_flags & PNG_FIRST_FRAME_HIDDEN) == 0 ||
++        png_ptr->num_frames_written != 0)
++        png_write_fcTL(png_ptr, width, height, x_offset, y_offset,
++                       delay_num, delay_den, dispose_op, blend_op);
++
++    PNG_UNUSED(row_pointers)
++}
++
++void PNGAPI
++png_write_frame_tail(png_structp png_ptr, png_infop info_ptr)
++{
++    png_debug(1, "in png_write_frame_tail");
++
++    png_ptr->num_frames_written++;
++
++    PNG_UNUSED(info_ptr)
++}
++#endif /* WRITE_APNG */
+ #endif /* WRITE */
+diff --git a/pngwutil.c b/pngwutil.c
+--- a/pngwutil.c
++++ b/pngwutil.c
+@@ -820,8 +820,13 @@ png_write_IHDR(png_structrp png_ptr, png
+ 
     /* Write the chunk */
-    png_write_complete_chunk(png_ptr, png_IHDR, buf, (png_size_t)13);
+    png_write_complete_chunk(png_ptr, png_IHDR, buf, 13);
  
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +   png_ptr->first_frame_width = width;
 +   png_ptr->first_frame_height = height;
 +#endif
 +
     if ((png_ptr->do_filter) == PNG_NO_FILTERS)
     {
        if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE ||
-@@ -1004,7 +1009,17 @@
+           png_ptr->bit_depth < 8)
+@@ -1002,9 +1007,19 @@ png_compress_IDAT(png_structrp png_ptr, 
+                optimize_cmf(data, png_image_size(png_ptr));
  #endif
  
           if (size > 0)
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +         {
 +            if (png_ptr->num_frames_written == 0)
 +#endif
              png_write_complete_chunk(png_ptr, png_IDAT, data, size);
@@ -1469,17 +1526,19 @@ Index: pngwutil.c
 +            else
 +               png_write_fdAT(png_ptr, data, size);
 +         }
 +#endif /* WRITE_APNG */
 +
           png_ptr->mode |= PNG_HAVE_IDAT;
  
           png_ptr->zstream.next_out = data;
-@@ -1051,7 +1066,17 @@
+          png_ptr->zstream.avail_out = size;
+@@ -1049,9 +1064,19 @@ png_compress_IDAT(png_structrp png_ptr, 
+             optimize_cmf(data, png_image_size(png_ptr));
  #endif
  
           if (size > 0)
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +         {
 +            if (png_ptr->num_frames_written == 0)
 +#endif
              png_write_complete_chunk(png_ptr, png_IDAT, data, size);
@@ -1487,17 +1546,19 @@ Index: pngwutil.c
 +            else
 +               png_write_fdAT(png_ptr, data, size);
 +         }
 +#endif /* WRITE_APNG */
 +
           png_ptr->zstream.avail_out = 0;
           png_ptr->zstream.next_out = NULL;
           png_ptr->mode |= PNG_HAVE_IDAT | PNG_AFTER_IDAT;
-@@ -1887,6 +1912,82 @@
+ 
+@@ -1884,8 +1909,84 @@ png_write_tIME(png_structrp png_ptr, png
+    png_write_complete_chunk(png_ptr, png_tIME, buf, 7);
  }
  #endif
  
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +void /* PRIVATE */
 +png_write_acTL(png_structp png_ptr,
 +    png_uint_32 num_frames, png_uint_32 num_plays)
 +{
@@ -1570,17 +1631,19 @@ Index: pngwutil.c
 +
 +    png_ptr->next_seq_num++;
 +}
 +#endif /* WRITE_APNG */
 +
  /* Initializes the row writing capability of libpng */
  void /* PRIVATE */
  png_write_start_row(png_structrp png_ptr)
-@@ -2781,4 +2882,39 @@
+ {
+@@ -2777,5 +2878,40 @@ png_write_filtered_row(png_structrp png_
+       png_write_flush(png_ptr);
     }
  #endif /* WRITE_FLUSH */
  }
 +
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +void /* PRIVATE */
 +png_write_reset(png_structp png_ptr)
 +{
@@ -1610,36 +1673,8 @@ Index: pngwutil.c
 +
 +    png_ptr->width = width;
 +    png_ptr->height = height;
 +    png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, width);
 +    png_ptr->usr_width = png_ptr->width;
 +}
 +#endif /* WRITE_APNG */
  #endif /* WRITE */
-Index: scripts/symbols.def
-===================================================================
---- scripts/symbols.def
-+++ scripts/symbols.def
-@@ -254,3 +254,23 @@
-  png_set_eXIf @247
-  png_get_eXIf_1 @248
-  png_set_eXIf_1 @249
-+ png_get_acTL @250
-+ png_set_acTL @251
-+ png_get_num_frames @252
-+ png_get_num_plays @253
-+ png_get_next_frame_fcTL @254
-+ png_set_next_frame_fcTL @255
-+ png_get_next_frame_width @256
-+ png_get_next_frame_height @257
-+ png_get_next_frame_x_offset @258
-+ png_get_next_frame_y_offset @259
-+ png_get_next_frame_delay_num @260
-+ png_get_next_frame_delay_den @261
-+ png_get_next_frame_dispose_op @262
-+ png_get_next_frame_blend_op @263
-+ png_get_first_frame_is_hidden @264
-+ png_set_first_frame_is_hidden @265
-+ png_read_frame_head @266
-+ png_set_progressive_frame_fn @267
-+ png_write_frame_head @268
-+ png_write_frame_tail @269
--- a/media/libpng/arm.patch
+++ b/media/libpng/arm.patch
@@ -1,48 +1,32 @@
-diff --git ../../../libpng-1.6.16/arm/arm_init.c arm/arm_init.c
---- ../../../libpng-1.6.16/arm/arm_init.c	2014-12-21 22:08:08.000000000 -0500
-+++ arm/arm_init.c	2014-12-22 17:33:57.556305506 -0500
-@@ -29,17 +29,17 @@
-  * You may set the macro PNG_ARM_NEON_FILE to the file name of file containing
-  * a fragment of C source code which defines the png_have_neon function.  There
-  * are a number of implementations in contrib/arm-neon, but the only one that
-  * has partial support is contrib/arm-neon/linux.c - a generic Linux
+diff --git a/arm/arm_init.c b/arm/arm_init.c
+--- a/arm/arm_init.c
++++ b/arm/arm_init.c
+@@ -33,9 +33,9 @@
   * implementation which reads /proc/cpufino.
   */
  #ifndef PNG_ARM_NEON_FILE
  #  ifdef __linux__
 -#     define PNG_ARM_NEON_FILE "contrib/arm-neon/linux.c"
 +#     define PNG_ARM_NEON_FILE "linux.c"
  #  endif
  #endif
  
  #ifdef PNG_ARM_NEON_FILE
- 
- #include <signal.h> /* for sig_atomic_t */
- static int png_have_neon(png_structp png_ptr);
- #include PNG_ARM_NEON_FILE
-diff --git ../../../libpng-1.6.16/arm/filter_neon.S arm/filter_neon.S
---- ../../../libpng-1.6.16/arm/filter_neon.S	2014-12-21 22:08:08.000000000 -0500
-+++ arm/filter_neon.S	2014-12-22 17:43:31.588323649 -0500
-@@ -5,16 +5,22 @@
-  * Written by Mans Rullgard, 2011.
-  * Last changed in libpng 1.6.16 [December 22, 2014]
-  *
-  * This code is released under the libpng license.
+diff --git a/arm/filter_neon.S b/arm/filter_neon.S
+--- a/arm/filter_neon.S
++++ b/arm/filter_neon.S
+@@ -9,8 +9,14 @@
   * For conditions of distribution and use, see the disclaimer
   * and license in png.h
   */
  
 +/* These are required because Mozilla's moz.build system doesn't pass
 + * -DDefined macros to the assembler.
 + */
 +#define PNG_READ_SUPPORTED
 +#define MOZ_PNG_HAVE_ARM_NEON
 +
  /* This is required to get the symbol renames, which are #defines, and the
   * definitions (or not) of PNG_ARM_NEON_OPT and PNG_ARM_NEON_IMPLEMENTATION.
   */
  #define PNG_VERSION_INFO_ONLY
- #include "../pngpriv.h"
- 
- #if defined(__linux__) && defined(__ELF__)
- .section .note.GNU-stack,"",%progbits /* mark stack as non-executable */
--- a/media/libpng/intel/filter_sse2_intrinsics.c
+++ b/media/libpng/intel/filter_sse2_intrinsics.c
@@ -66,17 +66,17 @@ static void store3(void* p, __m128i v) {
 
 void png_read_filter_row_sub3_sse2(png_row_infop row_info, png_bytep row,
    png_const_bytep prev)
 {
    /* The Sub filter predicts each pixel as the previous pixel, a.
     * There is no pixel to the left of the first pixel.  It's encoded directly.
     * That works with our main loop if we just say that left pixel was zero.
     */
-   png_size_t rb;
+   size_t rb;
 
    __m128i a, d = _mm_setzero_si128();
 
    png_debug(1, "in png_read_filter_row_sub3_sse2");
 
    rb = row_info->rowbytes;
    while (rb >= 4) {
       a = d; d = load4(row);
@@ -99,17 +99,17 @@ void png_read_filter_row_sub3_sse2(png_r
 
 void png_read_filter_row_sub4_sse2(png_row_infop row_info, png_bytep row,
    png_const_bytep prev)
 {
    /* The Sub filter predicts each pixel as the previous pixel, a.
     * There is no pixel to the left of the first pixel.  It's encoded directly.
     * That works with our main loop if we just say that left pixel was zero.
     */
-   png_size_t rb;
+   size_t rb;
 
    __m128i a, d = _mm_setzero_si128();
 
    png_debug(1, "in png_read_filter_row_sub4_sse2");
 
    rb = row_info->rowbytes+4;
    while (rb > 4) {
       a = d; d = load4(row);
@@ -126,17 +126,17 @@ void png_read_filter_row_avg3_sse2(png_r
    png_const_bytep prev)
 {
    /* The Avg filter predicts each pixel as the (truncated) average of a and b.
     * There's no pixel to the left of the first pixel.  Luckily, it's
     * predicted to be half of the pixel above it.  So again, this works
     * perfectly with our loop if we make sure a starts at zero.
     */
 
-   png_size_t rb;
+   size_t rb;
 
    const __m128i zero = _mm_setzero_si128();
 
    __m128i    b;
    __m128i a, d = zero;
 
    png_debug(1, "in png_read_filter_row_avg3_sse2");
    rb = row_info->rowbytes;
@@ -180,17 +180,17 @@ void png_read_filter_row_avg3_sse2(png_r
 void png_read_filter_row_avg4_sse2(png_row_infop row_info, png_bytep row,
    png_const_bytep prev)
 {
    /* The Avg filter predicts each pixel as the (truncated) average of a and b.
     * There's no pixel to the left of the first pixel.  Luckily, it's
     * predicted to be half of the pixel above it.  So again, this works
     * perfectly with our loop if we make sure a starts at zero.
     */
-   png_size_t rb;
+   size_t rb;
    const __m128i zero = _mm_setzero_si128();
    __m128i    b;
    __m128i a, d = zero;
 
    png_debug(1, "in png_read_filter_row_avg4_sse2");
 
    rb = row_info->rowbytes+4;
    while (rb > 4) {
@@ -252,17 +252,17 @@ void png_read_filter_row_paeth3_sse2(png
     * p=a+b-c.
     *
     * The first pixel has no left context, and so uses an Up filter, p = b.
     * This works naturally with our main loop's p = a+b-c if we force a and c
     * to zero.
     * Here we zero b and d, which become c and a respectively at the start of
     * the loop.
     */
-   png_size_t rb;
+   size_t rb;
    const __m128i zero = _mm_setzero_si128();
    __m128i c, b = zero,
            a, d = zero;
 
    png_debug(1, "in png_read_filter_row_paeth3_sse2");
 
    rb = row_info->rowbytes;
    while (rb >= 4) {
@@ -351,17 +351,17 @@ void png_read_filter_row_paeth4_sse2(png
     * p=a+b-c.
     *
     * The first pixel has no left context, and so uses an Up filter, p = b.
     * This works naturally with our main loop's p = a+b-c if we force a and c
     * to zero.
     * Here we zero b and d, which become c and a respectively at the start of
     * the loop.
     */
-   png_size_t rb;
+   size_t rb;
    const __m128i zero = _mm_setzero_si128();
    __m128i pa,pb,pc,smallest,nearest;
    __m128i c, b = zero,
            a, d = zero;
 
    png_debug(1, "in png_read_filter_row_paeth4_sse2");
 
    rb = row_info->rowbytes+4;
--- a/media/libpng/libpng-manual.txt
+++ b/media/libpng/libpng-manual.txt
@@ -1,22 +1,21 @@
 libpng-manual.txt - A description on how to use and modify libpng
 
- libpng version 1.6.34 - September 29, 2017
+ libpng version 1.6.35 - July 15, 2018
  Updated and distributed by Glenn Randers-Pehrson
- <glennrp at users.sourceforge.net>
- Copyright (c) 1998-2017 Glenn Randers-Pehrson
+ Copyright (c) 1998-2018 Glenn Randers-Pehrson
 
  This document is released under the libpng license.
  For conditions of distribution and use, see the disclaimer
  and license in png.h
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.6.34 - September 29, 2017
+ libpng versions 0.97, January 1998, through 1.6.35 - July 15, 2018
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2017 Glenn Randers-Pehrson
 
  libpng 1.0 beta 6 - version 0.96 - May 28, 1997
  Updated and distributed by Andreas Dilger
  Copyright (c) 1996, 1997 Andreas Dilger
 
  libpng 1.0 beta 2 - version 0.88 - January 26, 1996
@@ -343,28 +342,28 @@ then only check the bytes (if any) that 
 
 (*): If you are not using the standard I/O functions, you will need
 to replace them with custom functions.  See the discussion under
 Customizing libpng.
 
     FILE *fp = fopen(file_name, "rb");
     if (!fp)
     {
-       return (ERROR);
+       return ERROR;
     }
 
     if (fread(header, 1, number, fp) != number)
     {
-       return (ERROR);
+       return ERROR;
     }
 
     is_png = !png_sig_cmp(header, 0, number);
     if (!is_png)
     {
-       return (NOT_PNG);
+       return NOT_PNG;
     }
 
 Next, png_struct and png_info need to be allocated and initialized.  In
 order to ensure that the size of these structures is correct even with a
 dynamically linked libpng, there are functions to initialize and
 allocate the structures.  We also pass the library version, optional
 pointers to error handling functions, and a pointer to a data struct for
 use by the error functions, if necessary (the pointer and functions can
@@ -373,25 +372,25 @@ on Changes to Libpng below regarding the
 The structure allocation functions quietly return NULL if they fail to
 create the structure, so your application should check for that.
 
     png_structp png_ptr = png_create_read_struct
         (PNG_LIBPNG_VER_STRING, (png_voidp)user_error_ptr,
         user_error_fn, user_warning_fn);
 
     if (!png_ptr)
-       return (ERROR);
+       return ERROR;
 
     png_infop info_ptr = png_create_info_struct(png_ptr);
 
     if (!info_ptr)
     {
        png_destroy_read_struct(&png_ptr,
            (png_infopp)NULL, (png_infopp)NULL);
-       return (ERROR);
+       return ERROR;
     }
 
 If you want to use your own memory allocation routines,
 use a libpng that was built with PNG_USER_MEM_SUPPORTED defined, and use
 png_create_read_struct_2() instead of png_create_read_struct():
 
     png_structp png_ptr = png_create_read_struct_2
         (PNG_LIBPNG_VER_STRING, (png_voidp)user_error_ptr,
@@ -416,17 +415,17 @@ on the libpng error handling.  If an err
 back to your setjmp, you will want to call png_destroy_read_struct() to
 free any memory.
 
     if (setjmp(png_jmpbuf(png_ptr)))
     {
        png_destroy_read_struct(&png_ptr, &info_ptr,
            &end_info);
        fclose(fp);
-       return (ERROR);
+       return ERROR;
     }
 
 Pass (png_infopp)NULL instead of &end_info if you didn't create
 an end_info structure.
 
 If you would rather avoid the complexity of setjmp/longjmp issues,
 you can compile libpng with PNG_NO_SETJMP, in which case
 errors will result in a call to PNG_ABORT() which defaults to abort().
@@ -498,28 +497,28 @@ input stream. You must supply the functi
          png_unknown_chunkp chunk);
     {
        /* The unknown chunk structure contains your
           chunk data, along with similar data for any other
           unknown chunks: */
 
            png_byte name[5];
            png_byte *data;
-           png_size_t size;
+           size_t size;
 
        /* Note that libpng has already taken care of
           the CRC handling */
 
        /* put your code here.  Search for your chunk in the
           unknown chunk structure, process it, and return one
           of the following: */
 
-       return (-n); /* chunk had an error */
-       return (0); /* did not recognize */
-       return (n); /* success */
+       return -n; /* chunk had an error */
+       return 0; /* did not recognize */
+       return n; /* success */
     }
 
 (You can give your function another name that you like instead of
 "read_chunk_callback")
 
 To inform libpng about your function, use
 
     png_set_read_user_chunk_fn(png_ptr, user_chunk_ptr,
@@ -998,17 +997,17 @@ Choices for the alpha_mode are
 PNG_ALPHA_PNG is the default libpng handling of the alpha channel. It is not
 pre-multiplied into the color components. In addition the call states
 that the output is for a sRGB system and causes all PNG files without gAMA
 chunks to be assumed to be encoded using sRGB.
 
     png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_GAMMA_MAC);
 
 In this case the output is assumed to be something like an sRGB conformant
-display preceeded by a power-law lookup table of power 1.45.  This is how
+display preceded by a power-law lookup table of power 1.45.  This is how
 early Mac systems behaved.
 
     png_set_alpha_mode(pp, PNG_ALPHA_STANDARD, PNG_GAMMA_LINEAR);
 
 This is the classic Jim Blinn approach and will work in academic
 environments where everything is done by the book.  It has the shortcoming
 of assuming that input PNG data with no gamma information is linear - this
 is unlikely to be correct unless the PNG files were generated locally.
@@ -1050,17 +1049,17 @@ This option will also reduce the halos, 
 halos round the opaque parts of the image where the background is light.
 In the OPTIMIZED mode the halos will be light halos where the background
 is dark.  Take your pick - the halos are unavoidable unless you can get
 your hardware/software fixed!  (The OPTIMIZED approach is slightly
 faster.)
 
 When the default gamma of PNG files doesn't match the output gamma.
 If you have PNG files with no gamma information png_set_alpha_mode allows
-you to provide a default gamma, but it also sets the ouput gamma to the
+you to provide a default gamma, but it also sets the output gamma to the
 matching value.  If you know your PNG files have a gamma that doesn't
 match the output you can take advantage of the fact that
 png_set_alpha_mode always sets the output gamma but only sets the PNG
 default if it is not already set:
 
     png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_DEFAULT_sRGB);
     png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_GAMMA_MAC);
 
@@ -2404,17 +2403,17 @@ struct if you want to keep the comments 
 separate.
 
     png_infop end_info = png_create_info_struct(png_ptr);
 
     if (!end_info)
     {
        png_destroy_read_struct(&png_ptr, &info_ptr,
            (png_infopp)NULL);
-       return (ERROR);
+       return ERROR;
     }
 
    png_read_end(png_ptr, end_info);
 
 If you are not interested, you should still call png_read_end()
 but you can pass NULL, avoiding the need to create an end_info structure.
 If you do this, libpng will not process any chunks after IDAT other than
 skipping over them and perhaps (depending on whether you have called
@@ -2544,32 +2543,32 @@ png_infop info_ptr;
  int
  initialize_png_reader()
  {
     png_ptr = png_create_read_struct
         (PNG_LIBPNG_VER_STRING, (png_voidp)user_error_ptr,
          user_error_fn, user_warning_fn);
 
     if (!png_ptr)
-        return (ERROR);
+        return ERROR;
 
     info_ptr = png_create_info_struct(png_ptr);
 
     if (!info_ptr)
     {
        png_destroy_read_struct(&png_ptr,
           (png_infopp)NULL, (png_infopp)NULL);
-       return (ERROR);
+       return ERROR;
     }
 
     if (setjmp(png_jmpbuf(png_ptr)))
     {
        png_destroy_read_struct(&png_ptr, &info_ptr,
           (png_infopp)NULL);
-       return (ERROR);
+       return ERROR;
     }
 
     /* This one's new.  You can provide functions
        to be called when the header info is valid,
        when each row is completed, and when the image
        is finished.  If you aren't using all functions,
        you can specify NULL parameters.  Even when all
        three functions are NULL, you need to call
@@ -2593,17 +2592,17 @@ png_infop info_ptr;
    of data */
  int
  process_data(png_bytep buffer, png_uint_32 length)
  {
     if (setjmp(png_jmpbuf(png_ptr)))
     {
        png_destroy_read_struct(&png_ptr, &info_ptr,
            (png_infopp)NULL);
-       return (ERROR);
+       return ERROR;
     }
 
     /* This one's new also.  Simply give it a chunk
        of data from the file stream (in order, of
        course).  On machines with segmented memory
        models machines, don't give it any more than
        64K.  The library seems to run fine with sizes
        of 4K. Although you can give it much less if
@@ -2737,39 +2736,39 @@ Setup
 You will want to do the I/O initialization before you get into libpng,
 so if it doesn't work, you don't have anything to undo. If you are not
 using the standard I/O functions, you will need to replace them with
 custom writing functions.  See the discussion under Customizing libpng.
 
     FILE *fp = fopen(file_name, "wb");
 
     if (!fp)
-       return (ERROR);
+       return ERROR;
 
 Next, png_struct and png_info need to be allocated and initialized.
 As these can be both relatively large, you may not want to store these
 on the stack, unless you have stack space to spare.  Of course, you
 will want to check if they return NULL.  If you are also reading,
 you won't want to name your read structure and your write structure
 both "png_ptr"; you can call them anything you like, such as
 "read_ptr" and "write_ptr".  Look at pngtest.c, for example.
 
     png_structp png_ptr = png_create_write_struct
        (PNG_LIBPNG_VER_STRING, (png_voidp)user_error_ptr,
         user_error_fn, user_warning_fn);
 
     if (!png_ptr)
-       return (ERROR);
+       return ERROR;
 
     png_infop info_ptr = png_create_info_struct(png_ptr);
     if (!info_ptr)
     {
        png_destroy_write_struct(&png_ptr,
            (png_infopp)NULL);
-       return (ERROR);
+       return ERROR;
     }
 
 If you want to use your own memory allocation routines,
 define PNG_USER_MEM_SUPPORTED and use
 png_create_write_struct_2() instead of png_create_write_struct():
 
     png_structp png_ptr = png_create_write_struct_2
        (PNG_LIBPNG_VER_STRING, (png_voidp)user_error_ptr,
@@ -2786,17 +2785,17 @@ call a png_*() function.  See your docum
 for your compiler for more information on setjmp/longjmp.  See
 the discussion on libpng error handling in the Customizing Libpng
 section below for more information on the libpng error handling.
 
     if (setjmp(png_jmpbuf(png_ptr)))
     {
     png_destroy_write_struct(&png_ptr, &info_ptr);
        fclose(fp);
-       return (ERROR);
+       return ERROR;
     }
     ...
     return;
 
 If you would rather avoid the complexity of setjmp/longjmp issues,
 you can compile libpng with PNG_NO_SETJMP, in which case
 errors will result in a call to PNG_ABORT() which defaults to abort().
 
@@ -3774,17 +3773,17 @@ V. Simplified API
 
 The simplified API, which became available in libpng-1.6.0, hides the details
 of both libpng and the PNG file format itself.
 It allows PNG files to be read into a very limited number of
 in-memory bitmap formats or to be written from the same formats.  If these
 formats do not accommodate your needs then you can, and should, use the more
 sophisticated APIs above - these support a wide variety of in-memory formats
 and a wide variety of sophisticated transformations to those formats as well
-as a wide variety of APIs to manipulate ancilliary information.
+as a wide variety of APIs to manipulate ancillary information.
 
 To read a PNG file using the simplified API:
 
   1) Declare a 'png_image' structure (see below) on the stack, set the
      version field to PNG_IMAGE_VERSION and the 'opaque' pointer to NULL
      (this is REQUIRED, your program may crash if you don't do it.)
 
   2) Call the appropriate png_image_begin_read... function.
@@ -4097,17 +4096,17 @@ READ APIs
      is filled in from the PNG header in the file.
 
    int png_image_begin_read_from_stdio (png_imagep image,
      FILE* file)
 
       The PNG header is read from the stdio FILE object.
 
    int png_image_begin_read_from_memory(png_imagep image,
-      png_const_voidp memory, png_size_t size)
+      png_const_voidp memory, size_t size)
 
       The PNG header is read from the given memory buffer.
 
    int png_image_finish_read(png_imagep image,
       png_colorp background, void *buffer,
       png_int_32 row_stride, void *colormap));
 
       Finish reading the image into the supplied buffer and
@@ -4250,20 +4249,20 @@ png_get_io_ptr().  For example:
         png_flush_ptr output_flush_fn);
 
     voidp read_io_ptr = png_get_io_ptr(read_ptr);
     voidp write_io_ptr = png_get_io_ptr(write_ptr);
 
 The replacement I/O functions must have prototypes as follows:
 
     void user_read_data(png_structp png_ptr,
-        png_bytep data, png_size_t length);
+        png_bytep data, size_t length);
 
     void user_write_data(png_structp png_ptr,
-        png_bytep data, png_size_t length);
+        png_bytep data, size_t length);
 
     void user_flush_data(png_structp png_ptr);
 
 The user_read_data() function is responsible for detecting and
 handling end-of-data errors.
 
 Supplying NULL for the read, write, or flush functions sets them back
 to using the default C stream functions, which expect the io_ptr to
@@ -4779,17 +4778,17 @@ This also applies to the prototype for t
 The png_calloc() function was added and is used in place of
 of "png_malloc(); memset();" except in the case in png_read_png()
 where the array consists of pointers; in this case a "for" loop is used
 after the png_malloc() to set the pointers to NULL, to give robust.
 behavior in case the application runs out of memory part-way through
 the process.
 
 We changed the prototypes of png_get_compression_buffer_size() and
-png_set_compression_buffer_size() to work with png_size_t instead of
+png_set_compression_buffer_size() to work with size_t instead of
 png_uint_32.
 
 Support for numbered error messages was removed by default, since we
 never got around to actually numbering the error messages. The function
 png_set_strip_error_numbers() was removed from the library by default.
 
 The png_zalloc() and png_zfree() functions are no longer exported.
 The png_zalloc() function no longer zeroes out the memory that it
@@ -5250,30 +5249,29 @@ at
     https://github.com/glennrp/libpng or
     https://git.code.sf.net/p/libpng/code.git
 
 or you can browse it with a web browser at
 
     https://github.com/glennrp/libpng or
     https://sourceforge.net/p/libpng/code/ci/libpng16/tree/
 
-Patches can be sent to glennrp at users.sourceforge.net or to
-png-mng-implement at lists.sourceforge.net or you can upload them to
-the libpng bug tracker at
+Patches can be sent to png-mng-implement at lists.sourceforge.net or
+you can upload them to the libpng bug tracker at
 
     https://libpng.sourceforge.io/
 
 or as a "pull request" to
 
     https://github.com/glennrp/libpng/pulls
 
 We also accept patches built from the tar or zip distributions, and
-simple verbal discriptions of bug fixes, reported either to the
+simple verbal descriptions of bug fixes, reported either to the
 SourceForge bug tracker, to the png-mng-implement at lists.sf.net
-mailing list, as github issues, or directly to glennrp.
+mailing list, as github issues.
 
 XV. Coding style
 
 Our coding style is similar to the "Allman" style
 (See https://en.wikipedia.org/wiki/Indent_style#Allman_style), with curly
 braces on separate lines:
 
     if (condition)
@@ -5284,17 +5282,17 @@ braces on separate lines:
     else if (another condition)
     {
        another action;
     }
 
 The braces can be omitted from simple one-line actions:
 
     if (condition)
-       return (0);
+       return 0;
 
 We use 3-space indentation, except for continued statements which
 are usually indented the same as the first line of the statement
 plus four more spaces.
 
 For macro definitions we use 2-space indentation, always leaving the "#"
 in the first column.
 
@@ -5409,17 +5407,17 @@ Lines do not exceed 80 characters.
 Other rules can be inferred by inspecting the libpng source.
 
 XVI. Y2K Compliance in libpng
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.6.34 are Y2K compliant.  It is my belief that earlier
+upward through 1.6.35 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has two year fields.  One is a 2-byte unsigned integer
 that will hold years up to 65535.  The other, which is deprecated,
 holds the date in text format, and will hold years up to 9999.
 
 The integer is
     "png_uint_16 year" in png_time_struct.
--- a/media/libpng/png.c
+++ b/media/libpng/png.c
@@ -1,25 +1,25 @@
 
 /* png.c - location for general purpose libpng functions
  *
- * Last changed in libpng 1.6.33 [September 28, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_34 Your_png_h_is_not_version_1_6_34;
+typedef png_libpng_version_1_6_35 Your_png_h_is_not_version_1_6_35;
 
 #ifdef __GNUC__
 /* The version tests may need to be added to, but the problem warning has
  * consistently been fixed in GCC versions which obtain wide-spread release.
  * The problem is that many versions of GCC rearrange comparison expressions in
  * the optimizer in such a way that the results of the comparison will change
  * if signed integer overflow occurs.  Such comparisons are not permitted in
  * ANSI C90, however GCC isn't clever enough to work out that that do not occur
@@ -66,17 +66,17 @@ png_set_sig_bytes(png_structrp png_ptr, 
  * checking less than the full 8-byte signature so that those apps that
  * already read the first few bytes of a file to determine the file type
  * can simply check the remaining bytes for extra assurance.  Returns
  * an integer less than, equal to, or greater than zero if sig is found,
  * respectively, to be less than, to match, or be greater than the correct
  * PNG signature (this is the same behavior as strcmp, memcmp, etc).
  */
 int PNGAPI
-png_sig_cmp(png_const_bytep sig, png_size_t start, png_size_t num_to_check)
+png_sig_cmp(png_const_bytep sig, size_t start, size_t num_to_check)
 {
    png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
 
    if (num_to_check > 8)
       num_to_check = 8;
 
    else if (num_to_check < 1)
       return (-1);
@@ -131,17 +131,17 @@ png_reset_crc(png_structrp png_ptr)
 }
 
 /* Calculate the CRC over a section of data.  We can only pass as
  * much data to this routine as the largest single buffer size.  We
  * also check that this data will actually be used before going to the
  * trouble of calculating it.
  */
 void /* PRIVATE */
-png_calculate_crc(png_structrp png_ptr, png_const_bytep ptr, png_size_t length)
+png_calculate_crc(png_structrp png_ptr, png_const_bytep ptr, size_t length)
 {
    int need_crc = 1;
 
    if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0)
    {
       if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
           (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
          need_crc = 0;
@@ -416,17 +416,17 @@ png_destroy_info_struct(png_const_struct
  * instead.  Use deprecated in 1.6.0, internal use removed (used internally it
  * is just a memset).
  *
  * NOTE: it is almost inconceivable that this API is used because it bypasses
  * the user-memory mechanism and the user error handling/warning mechanisms in
  * those cases where it does anything other than a memset.
  */
 PNG_FUNCTION(void,PNGAPI
-png_info_init_3,(png_infopp ptr_ptr, png_size_t png_info_struct_size),
+png_info_init_3,(png_infopp ptr_ptr, size_t png_info_struct_size),
     PNG_DEPRECATED)
 {
    png_inforp info_ptr = *ptr_ptr;
 
    png_debug(1, "in png_info_init_3");
 
    if (info_ptr == NULL)
       return;
@@ -811,31 +811,31 @@ png_const_charp PNGAPI
 png_get_copyright(png_const_structrp png_ptr)
 {
    PNG_UNUSED(png_ptr)  /* Silence compiler warning about unused png_ptr */
 #ifdef PNG_STRING_COPYRIGHT
    return PNG_STRING_COPYRIGHT
 #else
 #  ifdef __STDC__
    return PNG_STRING_NEWLINE \
-      "libpng version 1.6.34+apng - September 29, 2017" PNG_STRING_NEWLINE \
-      "Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson" \
+      "libpng version 1.6.35+apng - July 15, 2018" PNG_STRING_NEWLINE \
+      "Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson" \
       PNG_STRING_NEWLINE \
       "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
       "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
       PNG_STRING_NEWLINE \
       "Portions Copyright (c) 2006-2007 Andrew Smith" PNG_STRING_NEWLINE \
-      "Portions Copyright (c) 2008-2017 Max Stepin" PNG_STRING_NEWLINE ;
+      "Portions Copyright (c) 2008-2018 Max Stepin" PNG_STRING_NEWLINE ;
 #  else
-   return "libpng version 1.6.34+apng - September 29, 2017\
-      Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson\
+   return "libpng version 1.6.35+apng - July 15, 2018\
+      Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\
       Portions Copyright (c) 2006-2007 Andrew Smith\
-      Portions Copyright (c) 2008-2017 Max Stepin";
+      Portions Copyright (c) 2008-2018 Max Stepin";
 #  endif
 #endif
 }
 
 /* The following return the library version as a short string in the
  * format 1.0.0 through 99.99.99zz.  To get the version of *.h files
  * used with your application, print out PNG_LIBPNG_VER_STRING, which
  * is defined in png.h.
@@ -941,17 +941,17 @@ png_handle_as_unknown(png_const_structrp
    if (png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list == 0)
       return PNG_HANDLE_CHUNK_AS_DEFAULT;
 
    p_end = png_ptr->chunk_list;
    p = p_end + png_ptr->num_chunk_list*5; /* beyond end */
 
    /* The code is the fifth byte after each four byte string.  Historically this
     * code was always searched from the end of the list, this is no longer
-    * necessary because the 'set' routine handles duplicate entries correcty.
+    * necessary because the 'set' routine handles duplicate entries correctly.
     */
    do /* num_chunk_list > 0, so at least one */
    {
       p -= 5;
 
       if (memcmp(chunk_name, p, 4) == 0)
          return p[4];
    }
@@ -2066,17 +2066,17 @@ png_icc_check_header(png_const_structrp 
    /* At this point the tag table can't be checked because it hasn't necessarily
     * been loaded; however, various header fields can be checked.  These checks
     * are for values permitted by the PNG spec in an ICC profile; the PNG spec
     * restricts the profiles that can be passed in an iCCP chunk (they must be
     * appropriate to processing PNG data!)
     */
 
    /* Data checks (could be skipped).  These checks must be independent of the
-    * version number; however, the version number doesn't accomodate changes in
+    * version number; however, the version number doesn't accommodate changes in
     * the header fields (just the known tags and the interpretation of the
     * data.)
     */
    temp = png_get_uint_32(profile+36); /* signature 'ascp' */
    if (temp != 0x61637370)
       return png_icc_profile_error(png_ptr, colorspace, name, temp,
           "invalid signature");
 
@@ -2706,29 +2706,29 @@ png_check_IHDR(png_const_structrp png_pt
 #endif
 
    if (error == 1)
       png_error(png_ptr, "Invalid IHDR data");
 }
 
 #if defined(PNG_sCAL_SUPPORTED) || defined(PNG_pCAL_SUPPORTED)
 /* ASCII to fp functions */
-/* Check an ASCII formated floating point value, see the more detailed
+/* Check an ASCII formatted floating point value, see the more detailed
  * comments in pngpriv.h
  */
 /* The following is used internally to preserve the sticky flags */
 #define png_fp_add(state, flags) ((state) |= (flags))
 #define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
 
 int /* PRIVATE */
-png_check_fp_number(png_const_charp string, png_size_t size, int *statep,
+png_check_fp_number(png_const_charp string, size_t size, int *statep,
     png_size_tp whereami)
 {
    int state = *statep;
-   png_size_t i = *whereami;
+   size_t i = *whereami;
 
    while (i < size)
    {
       int type;
       /* First find the type of the next character */
       switch (string[i])
       {
       case 43:  type = PNG_FP_SAW_SIGN;                   break;
@@ -2841,20 +2841,20 @@ PNG_FP_End:
    *whereami = i;
 
    return (state & PNG_FP_SAW_DIGIT) != 0;
 }
 
 
 /* The same but for a complete string. */
 int
-png_check_fp_string(png_const_charp string, png_size_t size)
+png_check_fp_string(png_const_charp string, size_t size)
 {
    int        state=0;
-   png_size_t char_index=0;
+   size_t char_index=0;
 
    if (png_check_fp_number(string, size, &state, &char_index) != 0 &&
       (char_index == size || string[char_index] == 0))
       return state /* must be non-zero - see above */;
 
    return 0; /* i.e. fail */
 }
 #endif /* pCAL || sCAL */
@@ -2905,17 +2905,17 @@ png_pow10(int power)
 #pragma GCC diagnostic push
 /* The problem arises below with exp_b10, which can never overflow because it
  * comes, originally, from frexp and is therefore limited to a range which is
  * typically +/-710 (log2(DBL_MAX)/log2(DBL_MIN)).
  */
 #pragma GCC diagnostic warning "-Wstrict-overflow=2"
 #endif /* GCC_STRICT_OVERFLOW */
 void /* PRIVATE */
-png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
+png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, size_t size,
     double fp, unsigned int precision)
 {
    /* We use standard functions from math.h, but not printf because
     * that would require stdio.  The caller must supply a buffer of
     * sufficient size or we will png_error.  The tests on size and
     * the space in ascii[] consumed are indicated below.
     */
    if (precision < 1)
@@ -3236,17 +3236,17 @@ png_ascii_from_fp(png_const_structrp png
 
 #  endif /* FLOATING_POINT */
 
 #  ifdef PNG_FIXED_POINT_SUPPORTED
 /* Function to format a fixed point value in ASCII.
  */
 void /* PRIVATE */
 png_ascii_from_fixed(png_const_structrp png_ptr, png_charp ascii,
-    png_size_t size, png_fixed_point fp)
+    size_t size, png_fixed_point fp)
 {
    /* Require space for 10 decimal digits, a decimal point, a minus sign and a
     * trailing \0, 13 characters:
     */
    if (size > 12)
    {
       png_uint_32 num;
 
@@ -4343,17 +4343,17 @@ png_set_option(png_structrp png_ptr, int
 {
    if (png_ptr != NULL && option >= 0 && option < PNG_OPTION_NEXT &&
       (option & 1) == 0)
    {
       png_uint_32 mask = 3U << option;
       png_uint_32 setting = (2U + (onoff != 0)) << option;
       png_uint_32 current = png_ptr->options;
 
-      png_ptr->options = (png_uint_32)(((current & ~mask) | setting) & 0xff);
+      png_ptr->options = (png_uint_32)((current & ~mask) | setting);
 
       return (int)(current & mask) >> option;
    }
 
    return PNG_OPTION_INVALID;
 }
 #endif
 
--- a/media/libpng/png.h
+++ b/media/libpng/png.h
@@ -1,23 +1,23 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.6.34, September 29, 2017
+ * libpng version 1.6.35, July 15, 2018
  *
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license (See LICENSE, below)
  *
  * Authors and maintainers:
  *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.6.34, September 29, 2017:
+ *   libpng versions 0.97, January 1998, through 1.6.35, July 15, 2018:
  *     Glenn Randers-Pehrson.
  *   See also "Contributing Authors", below.
  */
 
 /*
  * COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
  *
  * If you modify libpng you may insert additional notices immediately following
@@ -26,18 +26,18 @@
  * This modified version of libpng code adds animated PNG support and is
  * released under the libpng license described below. The modifications are
  * Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2017 Max Stepin,
  * and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
  * surrounding them in the modified libpng source files.
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.0.7, July 1, 2000 through 1.6.34, September 29, 2017 are
- * Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
+ * libpng versions 1.0.7, July 1, 2000 through 1.6.35, July 15, 2018 are
+ * Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson, are
  * derived from libpng-1.0.6, and are distributed according to the same
  * disclaimer and license as libpng-1.0.6 with the following individuals
  * added to the list of Contributing Authors:
  *
  *    Simon-Pierre Cadieux
  *    Eric S. Raymond
  *    Mans Rullgard
  *    Cosmin Truta
@@ -214,17 +214,17 @@
  *    1.0.7                    1    10007  (still compatible)
  *    ...
  *    1.0.19                  10    10019  10.so.0.19[.0]
  *    ...
  *    1.2.59                  13    10257  12.so.0.59[.0]
  *    ...
  *    1.5.30                  15    10527  15.so.15.30[.0]
  *    ...
- *    1.6.34                  16    10633  16.so.16.34[.0]
+ *    1.6.35                  16    10635  16.so.16.35[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
  *    used for changes in backward compatibility, as it is intended.  The
  *    PNG_LIBPNG_VER macro, which is not used within libpng but is available
  *    for applications, is an unsigned integer of the form xyyzz corresponding
  *    to the source version x.y.z (leading zeros in y and z).  Beta versions
  *    were given the previous public release number plus a letter, until
@@ -242,23 +242,23 @@
  * is available as a W3C Recommendation and as an ISO Specification,
  * <https://www.w3.org/TR/2003/REC-PNG-20031110/
  */
 
 /*
  * Y2K compliance in libpng:
  * =========================
  *
- *    September 29, 2017
+ *    July 15, 2018
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.6.34 are Y2K compliant.  It is my belief that
+ *    upward through 1.6.35 are Y2K compliant.  It is my belief that
  *    earlier versions were also Y2K compliant.
  *
  *    Libpng only has two year fields.  One is a 2-byte unsigned integer
  *    that will hold years up to 65535.  The other, which is deprecated,
  *    holds the date in text format, and will hold years up to 9999.
  *
  *    The integer is
  *        "png_uint_16 year" in png_time_struct.
@@ -310,58 +310,58 @@
  * file has been stripped from your copy of libpng, you can find it at
  * <http://www.libpng.org/pub/png/libpng-manual.txt>
  *
  * If you just need to read a PNG file and don't want to read the documentation
  * skip to the end of this file and read the section entitled 'simplified API'.
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.6.34+apng"
+#define PNG_LIBPNG_VER_STRING "1.6.35+apng"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.6.34+apng - September 29, 2017\n"
+     " libpng version 1.6.35+apng - July 15, 2018\n"
 
 #define PNG_LIBPNG_VER_SONUM   16
 #define PNG_LIBPNG_VER_DLLNUM  16
 
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   6
-#define PNG_LIBPNG_VER_RELEASE 34
+#define PNG_LIBPNG_VER_RELEASE 35
 
 /* This should match the numeric part of the final component of
  * PNG_LIBPNG_VER_STRING, omitting any leading zero:
  */
 
-#define PNG_LIBPNG_VER_BUILD  0
+#define PNG_LIBPNG_VER_BUILD  02
 
 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
 #define PNG_LIBPNG_BUILD_BETA     2
 #define PNG_LIBPNG_BUILD_RC       3
 #define PNG_LIBPNG_BUILD_STABLE   4
 #define PNG_LIBPNG_BUILD_RELEASE_STATUS_MASK 7
 
 /* Release-Specific Flags */
 #define PNG_LIBPNG_BUILD_PATCH    8 /* Can be OR'ed with
                                        PNG_LIBPNG_BUILD_STABLE only */
 #define PNG_LIBPNG_BUILD_PRIVATE 16 /* Cannot be OR'ed with
                                        PNG_LIBPNG_BUILD_SPECIAL */
 #define PNG_LIBPNG_BUILD_SPECIAL 32 /* Cannot be OR'ed with
                                        PNG_LIBPNG_BUILD_PRIVATE */
 
-#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE
+#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_BETA
 
 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
  * We must not include leading zeros.
  * Versions 0.7 through 1.0.0 were in the range 0 to 100 here (only
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
  * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
  */
-#define PNG_LIBPNG_VER 10634 /* 1.6.34 */
+#define PNG_LIBPNG_VER 10635 /* 1.6.35 */
 
 /* Library configuration: these options cannot be changed after
  * the library has been built.
  */
 #ifndef PNGLCONF_H
 /* If pnglibconf.h is missing, you can
  * copy scripts/pnglibconf.h.prebuilt to pnglibconf.h
  */
@@ -476,17 +476,17 @@ extern "C" {
 /* blend_op flags from inside fcTL */
 #define PNG_BLEND_OP_SOURCE        0x00
 #define PNG_BLEND_OP_OVER          0x01
 #endif /* APNG */
 
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef char* png_libpng_version_1_6_34;
+typedef char* png_libpng_version_1_6_35;
 
 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
  *
  * png_struct is the cache of information used while reading or writing a single
  * PNG file.  One of these is always required, although the simplified API
  * (below) hides the creation and destruction of it.
  */
 typedef struct png_struct_def png_struct;
@@ -617,18 +617,18 @@ typedef struct png_text_struct
    int  compression;       /* compression value:
                              -1: tEXt, none
                               0: zTXt, deflate
                               1: iTXt, none
                               2: iTXt, deflate  */
    png_charp key;          /* keyword, 1-79 character description of "text" */
    png_charp text;         /* comment, may be an empty string (ie "")
                               or a NULL pointer */
-   png_size_t text_length; /* length of the text string */
-   png_size_t itxt_length; /* length of the itxt string */
+   size_t text_length;     /* length of the text string */
+   size_t itxt_length;     /* length of the itxt string */
    png_charp lang;         /* language code, 0-79 characters
                               or a NULL pointer */
    png_charp lang_key;     /* keyword translated UTF-8 string, 0 or more
                               chars or a NULL pointer */
 } png_text;
 typedef png_text * png_textp;
 typedef const png_text * png_const_textp;
 typedef png_text * * png_textpp;
@@ -671,17 +671,17 @@ typedef png_time * * png_timepp;
  * know about their semantics.
  *
  * The data in the structure is set by libpng on read and used on write.
  */
 typedef struct png_unknown_chunk_t
 {
    png_byte name[5]; /* Textual chunk name with '\0' terminator */
    png_byte *data;   /* Data, should not be modified on read! */
-   png_size_t size;
+   size_t size;
 
    /* On write 'location' must be set using the flag values listed below.
     * Notice that on read it is set by libpng however the values stored have
     * more bits set than are listed below.  Always treat the value as a
     * bitmask.  On write set only one bit - setting multiple bits may cause the
     * chunk to be written in multiple places.
     */
    png_byte location; /* mode of operation at read time */
@@ -696,17 +696,17 @@ typedef png_unknown_chunk * * png_unknow
 /* Flag values for the unknown chunk location byte. */
 #define PNG_HAVE_IHDR  0x01
 #define PNG_HAVE_PLTE  0x02
 #define PNG_AFTER_IDAT 0x08
 
 /* Maximum positive integer used in PNG is (2^31)-1 */
 #define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
 #define PNG_UINT_32_MAX ((png_uint_32)(-1))
-#define PNG_SIZE_MAX ((png_size_t)(-1))
+#define PNG_SIZE_MAX ((size_t)(-1))
 
 /* These are constants for fixed point values encoded in the
  * PNG specification manner (x100000)
  */
 #define PNG_FP_1    100000
 #define PNG_FP_HALF  50000
 #define PNG_FP_MAX  ((png_fixed_point)0x7fffffffL)
 #define PNG_FP_MIN  (-PNG_FP_MAX)
@@ -806,17 +806,17 @@ typedef png_unknown_chunk * * png_unknow
 
 /* This is used for the transformation routines, as some of them
  * change these values for the row.  It also should enable using
  * the routines for other purposes.
  */
 typedef struct png_row_info_struct
 {
    png_uint_32 width;    /* width of row */
-   png_size_t rowbytes;  /* number of bytes in row */
+   size_t rowbytes;      /* number of bytes in row */
    png_byte color_type;  /* color type of row */
    png_byte bit_depth;   /* bit depth of row */
    png_byte channels;    /* number of channels (1, 2, 3, or 4) */
    png_byte pixel_depth; /* bits per pixel (depth * channels) */
 } png_row_info;
 
 typedef png_row_info * png_row_infop;
 typedef png_row_info * * png_row_infopp;
@@ -825,17 +825,17 @@ typedef png_row_info * * png_row_infopp;
  * that allow the user to override the default I/O functions with his or her
  * own.  The png_error_ptr type should match that of user-supplied warning
  * and error functions, while the png_rw_ptr type should match that of the
  * user read/write data functions.  Note that the 'write' function must not
  * modify the buffer it is passed. The 'read' function, on the other hand, is
  * expected to return the read data in the buffer.
  */
 typedef PNG_CALLBACK(void, *png_error_ptr, (png_structp, png_const_charp));
-typedef PNG_CALLBACK(void, *png_rw_ptr, (png_structp, png_bytep, png_size_t));
+typedef PNG_CALLBACK(void, *png_rw_ptr, (png_structp, png_bytep, size_t));
 typedef PNG_CALLBACK(void, *png_flush_ptr, (png_structp));
 typedef PNG_CALLBACK(void, *png_read_status_ptr, (png_structp, png_uint_32,
     int));
 typedef PNG_CALLBACK(void, *png_write_status_ptr, (png_structp, png_uint_32,
     int));
 
 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
 typedef PNG_CALLBACK(void, *png_progressive_info_ptr, (png_structp, png_infop));
@@ -966,18 +966,18 @@ PNG_EXPORT(1, png_uint_32, png_access_ve
  */
 PNG_EXPORT(2, void, png_set_sig_bytes, (png_structrp png_ptr, int num_bytes));
 
 /* Check sig[start] through sig[start + num_to_check - 1] to see if it's a
  * PNG file.  Returns zero if the supplied bytes match the 8-byte PNG
  * signature, and non-zero otherwise.  Having num_to_check == 0 or
  * start > 7 will always fail (ie return non-zero).
  */
-PNG_EXPORT(3, int, png_sig_cmp, (png_const_bytep sig, png_size_t start,
-    png_size_t num_to_check));
+PNG_EXPORT(3, int, png_sig_cmp, (png_const_bytep sig, size_t start,
+    size_t num_to_check));
 
 /* Simple signature checking function.  This is the same as calling
  * png_check_sig(sig, n) := !png_sig_cmp(sig, 0, n).
  */
 #define png_check_sig(sig, n) !png_sig_cmp((sig), 0, (n))
 
 /* Allocate and initialize png_ptr struct for reading, and any other memory. */
 PNG_EXPORTA(4, png_structp, png_create_read_struct,
@@ -986,21 +986,21 @@ PNG_EXPORTA(4, png_structp, png_create_r
     PNG_ALLOCATED);
 
 /* Allocate and initialize png_ptr struct for writing, and any other memory */
 PNG_EXPORTA(5, png_structp, png_create_write_struct,
     (png_const_charp user_png_ver, png_voidp error_ptr, png_error_ptr error_fn,
     png_error_ptr warn_fn),
     PNG_ALLOCATED);
 
-PNG_EXPORT(6, png_size_t, png_get_compression_buffer_size,
+PNG_EXPORT(6, size_t, png_get_compression_buffer_size,
     (png_const_structrp png_ptr));
 
 PNG_EXPORT(7, void, png_set_compression_buffer_size, (png_structrp png_ptr,
-    png_size_t size));
+    size_t size));
 
 /* Moved from pngconf.h in 1.4.0 and modified to ensure setjmp/longjmp
  * match up.
  */
 #ifdef PNG_SETJMP_SUPPORTED
 /* This function returns the jmp_buf built in to *png_ptr.  It must be
  * supplied with an appropriate 'longjmp' function to use on that jmp_buf
  * unless the default error function is overridden in which case NULL is
@@ -1043,39 +1043,39 @@ PNG_EXPORTA(12, png_structp, png_create_
     PNG_ALLOCATED);
 #endif
 
 /* Write the PNG file signature. */
 PNG_EXPORT(13, void, png_write_sig, (png_structrp png_ptr));
 
 /* Write a PNG chunk - size, type, (optional) data, CRC. */
 PNG_EXPORT(14, void, png_write_chunk, (png_structrp png_ptr, png_const_bytep
-    chunk_name, png_const_bytep data, png_size_t length));
+    chunk_name, png_const_bytep data, size_t length));
 
 /* Write the start of a PNG chunk - length and chunk name. */
 PNG_EXPORT(15, void, png_write_chunk_start, (png_structrp png_ptr,
     png_const_bytep chunk_name, png_uint_32 length));
 
 /* Write the data of a PNG chunk started with png_write_chunk_start(). */
 PNG_EXPORT(16, void, png_write_chunk_data, (png_structrp png_ptr,
-    png_const_bytep data, png_size_t length));
+    png_const_bytep data, size_t length));
 
 /* Finish a chunk started with png_write_chunk_start() (includes CRC). */
 PNG_EXPORT(17, void, png_write_chunk_end, (png_structrp png_ptr));
 
 /* Allocate and initialize the info structure */
 PNG_EXPORTA(18, png_infop, png_create_info_struct, (png_const_structrp png_ptr),
     PNG_ALLOCATED);
 
 /* DEPRECATED: this function allowed init structures to be created using the
  * default allocation method (typically malloc).  Use is deprecated in 1.6.0 and
  * the API will be removed in the future.
  */
 PNG_EXPORTA(19, void, png_info_init_3, (png_infopp info_ptr,
-    png_size_t png_info_struct_size), PNG_DEPRECATED);
+    size_t png_info_struct_size), PNG_DEPRECATED);
 
 /* Writes all the PNG information before the image. */
 PNG_EXPORT(20, void, png_write_info_before_PLTE,
     (png_structrp png_ptr, png_const_inforp info_ptr));
 PNG_EXPORT(21, void, png_write_info,
     (png_structrp png_ptr, png_const_inforp info_ptr));
 
 #ifdef PNG_SEQUENTIAL_READ_SUPPORTED
@@ -1162,17 +1162,17 @@ PNG_EXPORT(35, void, png_build_grayscale
  * datastream. The color samples in a PNG datastream are never premultiplied
  * with the alpha samples.
  *
  * The default is to return data according to the PNG specification: the alpha
  * channel is a linear measure of the contribution of the pixel to the
  * corresponding composited pixel, and the color channels are unassociated
  * (not premultiplied).  The gamma encoded color channels must be scaled
  * according to the contribution and to do this it is necessary to undo
- * the encoding, scale the color values, perform the composition and reencode
+ * the encoding, scale the color values, perform the composition and re-encode
  * the values.  This is the 'PNG' mode.
  *
  * The alternative is to 'associate' the alpha with the color information by
  * storing color channel values that have been scaled by the alpha.
  * image.  These are the 'STANDARD', 'ASSOCIATED' or 'PREMULTIPLIED' modes
  * (the latter being the two common names for associated alpha color channels).
  *
  * For the 'OPTIMIZED' mode, a pixel is treated as opaque only if the alpha
@@ -1218,17 +1218,17 @@ PNG_FIXED_EXPORT(228, void, png_set_alph
  * png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_DEFAULT_sRGB);
  *    This is the default libpng handling of the alpha channel - it is not
  *    pre-multiplied into the color components.  In addition the call states
  *    that the output is for a sRGB system and causes all PNG files without gAMA
  *    chunks to be assumed to be encoded using sRGB.
  *
  * png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_GAMMA_MAC);
  *    In this case the output is assumed to be something like an sRGB conformant
- *    display preceeded by a power-law lookup table of power 1.45.  This is how
+ *    display preceded by a power-law lookup table of power 1.45.  This is how
  *    early Mac systems behaved.
  *
  * png_set_alpha_mode(pp, PNG_ALPHA_STANDARD, PNG_GAMMA_LINEAR);
  *    This is the classic Jim Blinn approach and will work in academic
  *    environments where everything is done by the book.  It has the shortcoming
  *    of assuming that input PNG data with no gamma information is linear - this
  *    is unlikely to be correct unless the PNG files where generated locally.
  *    Most of the time the output precision will be so low as to show
@@ -1265,17 +1265,17 @@ PNG_FIXED_EXPORT(228, void, png_set_alph
  *    halos round the opaque parts of the image where the background is light.
  *    In the OPTIMIZED mode the halos will be light halos where the background
  *    is dark.  Take your pick - the halos are unavoidable unless you can get
  *    your hardware/software fixed!  (The OPTIMIZED approach is slightly
  *    faster.)
  *
  * When the default gamma of PNG files doesn't match the output gamma.
  *    If you have PNG files with no gamma information png_set_alpha_mode allows
- *    you to provide a default gamma, but it also sets the ouput gamma to the
+ *    you to provide a default gamma, but it also sets the output gamma to the
  *    matching value.  If you know your PNG files have a gamma that doesn't
  *    match the output you can take advantage of the fact that
  *    png_set_alpha_mode always sets the output gamma but only sets the PNG
  *    default if it is not already set:
  *
  * png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_DEFAULT_sRGB);
  * png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_GAMMA_MAC);
  *    The first call sets both the default and the output gamma values, the
@@ -1716,17 +1716,17 @@ PNG_EXPORT(218, png_byte, png_get_curren
  *
  * The integer return from the callback function is interpreted thus:
  *
  * negative: An error occurred; png_chunk_error will be called.
  *     zero: The chunk was not handled, the chunk will be saved. A critical
  *           chunk will cause an error at this point unless it is to be saved.
  * positive: The chunk was handled, libpng will ignore/discard it.
  *
- * See "INTERACTION WTIH USER CHUNK CALLBACKS" below for important notes about
+ * See "INTERACTION WITH USER CHUNK CALLBACKS" below for important notes about
  * how this behavior will change in libpng 1.7
  */
 PNG_EXPORT(88, void, png_set_read_user_chunk_fn, (png_structrp png_ptr,
     png_voidp user_chunk_ptr, png_user_chunk_ptr read_user_chunk_fn));
 #endif
 
 #ifdef PNG_USER_CHUNKS_SUPPORTED
 PNG_EXPORT(89, png_voidp, png_get_user_chunk_ptr, (png_const_structrp png_ptr));
@@ -1741,26 +1741,26 @@ PNG_EXPORT(90, void, png_set_progressive
     png_progressive_row_ptr row_fn, png_progressive_end_ptr end_fn));
 
 /* Returns the user pointer associated with the push read functions */
 PNG_EXPORT(91, png_voidp, png_get_progressive_ptr,
     (png_const_structrp png_ptr));
 
 /* Function to be called when data becomes available */
 PNG_EXPORT(92, void, png_process_data, (png_structrp png_ptr,
-    png_inforp info_ptr, png_bytep buffer, png_size_t buffer_size));
+    png_inforp info_ptr, png_bytep buffer, size_t buffer_size));
 
 /* A function which may be called *only* within png_process_data to stop the
  * processing of any more data.  The function returns the number of bytes
  * remaining, excluding any that libpng has cached internally.  A subsequent
  * call to png_process_data must supply these bytes again.  If the argument
  * 'save' is set to true the routine will first save all the pending data and
  * will always return 0.
  */
-PNG_EXPORT(219, png_size_t, png_process_data_pause, (png_structrp, int save));
+PNG_EXPORT(219, size_t, png_process_data_pause, (png_structrp, int save));
 
 /* A function which may be called *only* outside (after) a call to
  * png_process_data.  It returns the number of bytes of data to skip in the
  * input.  Normally it will return 0, but if it returns a non-zero value the
  * application must skip than number of bytes of input data and pass the
  * following data to the next call to png_process_data.
  */
 PNG_EXPORT(220, png_uint_32, png_process_data_skip, (png_structrp));
@@ -1895,17 +1895,17 @@ PNG_EXPORT(109, void, png_set_benign_err
  * to avoid problems with future changes in the size and internal layout of
  * png_info_struct.
  */
 /* Returns "flag" if chunk data is valid in info_ptr. */
 PNG_EXPORT(110, png_uint_32, png_get_valid, (png_const_structrp png_ptr,
     png_const_inforp info_ptr, png_uint_32 flag));
 
 /* Returns number of bytes needed to hold a transformed row. */
-PNG_EXPORT(111, png_size_t, png_get_rowbytes, (png_const_structrp png_ptr,
+PNG_EXPORT(111, size_t, png_get_rowbytes, (png_const_structrp png_ptr,
     png_const_inforp info_ptr));
 
 #ifdef PNG_INFO_IMAGE_SUPPORTED
 /* Returns row_pointers, which is an array of pointers to scanlines that was
  * returned from png_read_png().
  */
 PNG_EXPORT(112, png_bytepp, png_get_rows, (png_const_structrp png_ptr,
     png_const_inforp info_ptr));
@@ -2264,17 +2264,17 @@ PNG_EXPORT(171, void, png_set_sCAL_s, (p
  *    PNG_HANDLE_CHUNK_ALWAYS:
  *       Keep the chunk data.
  *
  * If the chunk data is saved it can be retrieved using png_get_unknown_chunks,
  * below.  Notice that specifying "AS_DEFAULT" as a global default is equivalent
  * to specifying "NEVER", however when "AS_DEFAULT" is used for specific chunks
  * it simply resets the behavior to the libpng default.
  *
- * INTERACTION WTIH USER CHUNK CALLBACKS:
+ * INTERACTION WITH USER CHUNK CALLBACKS:
  * The per-chunk handling is always used when there is a png_user_chunk_ptr
  * callback and the callback returns 0; the chunk is then always stored *unless*
  * it is critical and the per-chunk setting is other than ALWAYS.  Notice that
  * the global default is *not* used in this case.  (In effect the per-chunk
  * value is incremented to at least IF_SAFE.)
  *
  * IMPORTANT NOTE: this behavior will change in libpng 1.7 - the global and
  * per-chunk defaults will be honored.  If you want to preserve the current
@@ -2683,17 +2683,17 @@ PNG_EXPORT(243, int, png_get_palette_max
  *******************************************************************************
  *
  * Please read the documentation in libpng-manual.txt (TODO: write said
  * documentation) if you don't understand what follows.
  *
  * The simplified API hides the details of both libpng and the PNG file format
  * itself.  It allows PNG files to be read into a very limited number of
  * in-memory bitmap formats or to be written from the same formats.  If these
- * formats do not accomodate your needs then you can, and should, use the more
+ * formats do not accommodate your needs then you can, and should, use the more
  * sophisticated APIs above - these support a wide variety of in-memory formats
  * and a wide variety of sophisticated transformations to those formats as well
  * as a wide variety of APIs to manipulate ancillary information.
  *
  * To read a PNG file using the simplified API:
  *
  * 1) Declare a 'png_image' structure (see below) on the stack, set the
  *    version field to PNG_IMAGE_VERSION and the 'opaque' pointer to NULL
@@ -3045,17 +3045,17 @@ PNG_EXPORT(234, int, png_image_begin_rea
     */
 
 PNG_EXPORT(235, int, png_image_begin_read_from_stdio, (png_imagep image,
    FILE* file));
    /* The PNG header is read from the stdio FILE object. */
 #endif /* STDIO */
 
 PNG_EXPORT(236, int, png_image_begin_read_from_memory, (png_imagep image,
-   png_const_voidp memory, png_size_t size));
+   png_const_voidp memory, size_t size));
    /* The PNG header is read from the given memory buffer. */
 
 PNG_EXPORT(237, int, png_image_finish_read, (png_imagep image,
    png_const_colorp background, void *buffer, png_int_32 row_stride,
    void *colormap));
    /* Finish reading the image into the supplied buffer and clean up the
     * png_image structure.
     *
@@ -3158,17 +3158,17 @@ PNG_EXPORT(245, int, png_image_write_to_
     * If 'memory' is not NULL it must point to memory[*memory_bytes] of
     * writeable memory.
     *
     * If the function returns success memory[*memory_bytes] (if 'memory' is not
     * NULL) contains the written PNG data.  *memory_bytes will always be less
     * than or equal to the original value.
     *
     * If the function returns false and *memory_bytes was not changed an error
-    * occured during write.  If *memory_bytes was changed, or is not 0 if
+    * occurred during write.  If *memory_bytes was changed, or is not 0 if
     * 'memory' was NULL, the write would have succeeded but for the memory
     * buffer being too small.  *memory_bytes contains the required number of
     * bytes and will be bigger that the original value.
     */
 
 #define png_image_write_get_memory_size(image, size, convert_to_8_bit, buffer,\
    row_stride, colormap)\
    png_image_write_to_memory(&(image), 0, &(size), convert_to_8_bit, buffer,\
@@ -3242,17 +3242,17 @@ PNG_EXPORT(245, int, png_image_write_to_
  * Section 6: IMPLEMENTATION OPTIONS
  *******************************************************************************
  *
  * Support for arbitrary implementation-specific optimizations.  The API allows
  * particular options to be turned on or off.  'Option' is the number of the
  * option and 'onoff' is 0 (off) or non-0 (on).  The value returned is given
  * by the PNG_OPTION_ defines below.
  *
- * HARDWARE: normally hardware capabilites, such as the Intel SSE instructions,
+ * HARDWARE: normally hardware capabilities, such as the Intel SSE instructions,
  *           are detected at run time, however sometimes it may be impossible
  *           to do this in user mode, in which case it is necessary to discover
  *           the capabilities in an OS specific way.  Such capabilities are
  *           listed here when libpng has support for them and must be turned
  *           ON by the application if present.
  *
  * SOFTWARE: sometimes software optimizations actually result in performance
  *           decrease on some architectures or systems, or with some sets of
--- a/media/libpng/pngconf.h
+++ b/media/libpng/pngconf.h
@@ -1,14 +1,14 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.6.34, September 29, 2017
+ * libpng version 1.6.35, July 15, 2018
  *
- * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002,2004,2006-2016,2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * Any machine specific code is near the front of this file, so if you
@@ -122,17 +122,17 @@
  *                the 'C' calling convention (from PNGCAPI) for
  *                callbacks (PNGCBAPI).  This is no longer required
  *                in any known environment - if it has to be used
  *                please post an explanation of the problem to the
  *                libpng mailing list.
  *
  * These cases only differ if the operating system does not use the C
  * calling convention, at present this just means the above cases
- * (x86 DOS/Windows sytems) and, even then, this does not apply to
+ * (x86 DOS/Windows systems) and, even then, this does not apply to
  * Cygwin running on those systems.
  *
  * Note that the value must be defined in pnglibconf.h so that what
  * the application uses to call the library matches the conventions
  * set when building the library.
  */
 
 /* Symbol export
@@ -510,18 +510,20 @@
 #if UINT_MAX > 4294967294U
    typedef unsigned int png_uint_32;
 #elif ULONG_MAX > 4294967294U
    typedef unsigned long int png_uint_32;
 #else
 #  error "libpng requires an unsigned 32-bit (or more) type"
 #endif
 
-/* Prior to 1.6.0 it was possible to disable the use of size_t, 1.6.0, however,
- * requires an ISOC90 compiler and relies on consistent behavior of sizeof.
+/* Prior to 1.6.0, it was possible to disable the use of size_t and ptrdiff_t.
+ * From 1.6.0 onwards, an ISO C90 compiler, as well as a standard-compliant
+ * behavior of sizeof and ptrdiff_t are required.
+ * The legacy typedefs are provided here for backwards compatibility.
  */
 typedef size_t png_size_t;
 typedef ptrdiff_t png_ptrdiff_t;
 
 /* libpng needs to know the maximum value of 'size_t' and this controls the
  * definition of png_alloc_size_t, below.  This maximum value of size_t limits
  * but does not control the maximum allocations the library makes - there is
  * direct application control of this through png_set_user_limits().
@@ -532,33 +534,32 @@ typedef ptrdiff_t png_ptrdiff_t;
     * 'far' support; see above.)
     */
 #  if (defined(__TURBOC__) && !defined(__FLAT__)) ||\
    (defined(_MSC_VER) && defined(MAXSEG_64K))
 #     define PNG_SMALL_SIZE_T
 #  endif
 #endif
 
-/* png_alloc_size_t is guaranteed to be no smaller than png_size_t, and no
- * smaller than png_uint_32.  Casts from png_size_t or png_uint_32 to
- * png_alloc_size_t are not necessary; in fact, it is recommended not to use
- * them at all so that the compiler can complain when something turns out to be
- * problematic.
+/* png_alloc_size_t is guaranteed to be no smaller than size_t, and no smaller
+ * than png_uint_32.  Casts from size_t or png_uint_32 to png_alloc_size_t are
+ * not necessary; in fact, it is recommended not to use them at all, so that
+ * the compiler can complain when something turns out to be problematic.
  *
- * Casts in the other direction (from png_alloc_size_t to png_size_t or
+ * Casts in the other direction (from png_alloc_size_t to size_t or
  * png_uint_32) should be explicitly applied; however, we do not expect to
  * encounter practical situations that require such conversions.
  *
  * PNG_SMALL_SIZE_T must be defined if the maximum value of size_t is less than
  * 4294967295 - i.e. less than the maximum value of png_uint_32.
  */
 #ifdef PNG_SMALL_SIZE_T
    typedef png_uint_32 png_alloc_size_t;
 #else
-   typedef png_size_t png_alloc_size_t;
+   typedef size_t png_alloc_size_t;
 #endif
 
 /* Prior to 1.6.0 libpng offered limited support for Microsoft C compiler
  * implementations of Intel CPU specific support of user-mode segmented address
  * spaces, where 16-bit pointers address more than 65536 bytes of memory using
  * separate 'segment' registers.  The implementation requires two different
  * types of pointer (only one of which includes the segment value.)
  *
@@ -584,18 +585,18 @@ typedef const png_int_32      * png_cons
 typedef png_uint_16           * png_uint_16p;
 typedef const png_uint_16     * png_const_uint_16p;
 typedef png_int_16            * png_int_16p;
 typedef const png_int_16      * png_const_int_16p;
 typedef char                  * png_charp;
 typedef const char            * png_const_charp;
 typedef png_fixed_point       * png_fixed_point_p;
 typedef const png_fixed_point * png_const_fixed_point_p;
-typedef png_size_t            * png_size_tp;
-typedef const png_size_t      * png_const_size_tp;
+typedef size_t                * png_size_tp;
+typedef const size_t          * png_const_size_tp;
 
 #ifdef PNG_STDIO_SUPPORTED
 typedef FILE            * png_FILE_p;
 #endif
 
 #ifdef PNG_FLOATING_POINT_SUPPORTED
 typedef double       * png_doublep;
 typedef const double * png_const_doublep;
--- a/media/libpng/pngget.c
+++ b/media/libpng/pngget.c
@@ -1,13 +1,13 @@
 
 /* pngget.c - retrieval of values from info struct
  *
- * Last changed in libpng 1.6.32 [August 24, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  */
@@ -21,17 +21,17 @@ png_get_valid(png_const_structrp png_ptr
     png_uint_32 flag)
 {
    if (png_ptr != NULL && info_ptr != NULL)
       return(info_ptr->valid & flag);
 
    return(0);
 }
 
-png_size_t PNGAPI
+size_t PNGAPI
 png_get_rowbytes(png_const_structrp png_ptr, png_const_inforp info_ptr)
 {
    if (png_ptr != NULL && info_ptr != NULL)
       return(info_ptr->rowbytes);
 
    return(0);
 }
 
@@ -362,17 +362,17 @@ png_get_y_pixels_per_inch(png_const_stru
 {
    return ppi_from_ppm(png_get_y_pixels_per_meter(png_ptr, info_ptr));
 }
 
 #ifdef PNG_FIXED_POINT_SUPPORTED
 static png_fixed_point
 png_fixed_inches_from_microns(png_const_structrp png_ptr, png_int_32 microns)
 {
-   /* Convert from metres * 1,000,000 to inches * 100,000, meters to
+   /* Convert from meters * 1,000,000 to inches * 100,000, meters to
     * inches is simply *(100/2.54), so we want *(10/2.54) == 500/127.
     * Notice that this can overflow - a warning is output and 0 is
     * returned.
     */
    return png_muldiv_warn(png_ptr, microns, 500, 127);
 }
 
 png_fixed_point PNGAPI
@@ -736,30 +736,31 @@ png_uint_32 PNGAPI
 png_get_iCCP(png_const_structrp png_ptr, png_inforp info_ptr,
     png_charpp name, int *compression_type,
     png_bytepp profile, png_uint_32 *proflen)
 {
    png_debug1(1, "in %s retrieval function", "iCCP");
 
    if (png_ptr != NULL && info_ptr != NULL &&
        (info_ptr->valid & PNG_INFO_iCCP) != 0 &&
-       name != NULL && compression_type != NULL && profile != NULL &&
-           proflen != NULL)
+       name != NULL && profile != NULL && proflen != NULL)
    {
       *name = info_ptr->iccp_name;
       *profile = info_ptr->iccp_profile;
       *proflen = png_get_uint_32(info_ptr->iccp_profile);
       /* This is somewhat irrelevant since the profile data returned has
        * actually been uncompressed.
        */
-      *compression_type = PNG_COMPRESSION_TYPE_BASE;
+      if (compression_type != NULL)
+         *compression_type = PNG_COMPRESSION_TYPE_BASE;
       return (PNG_INFO_iCCP);
    }
 
    return (0);
+
 }
 #endif
 
 #ifdef PNG_sPLT_SUPPORTED
 int PNGAPI
 png_get_sPLT(png_const_structrp png_ptr, png_inforp info_ptr,
     png_sPLT_tpp spalettes)
 {
@@ -1159,17 +1160,17 @@ png_get_rgb_to_gray_status (png_const_st
 #ifdef PNG_USER_CHUNKS_SUPPORTED
 png_voidp PNGAPI
 png_get_user_chunk_ptr(png_const_structrp png_ptr)
 {
    return (png_ptr ? png_ptr->user_chunk_ptr : NULL);
 }
 #endif
 
-png_size_t PNGAPI
+size_t PNGAPI
 png_get_compression_buffer_size(png_const_structrp png_ptr)
 {
    if (png_ptr == NULL)
       return 0;
 
 #ifdef PNG_WRITE_SUPPORTED
    if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0)
 #endif
--- a/media/libpng/pnginfo.h
+++ b/media/libpng/pnginfo.h
@@ -1,13 +1,13 @@
 
 /* pnginfo.h - header file for PNG reference library
  *
- * Last changed in libpng 1.6.1 [March 28, 2013]
- * Copyright (c) 1998-2002,2004,2006-2013 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2013,2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -50,20 +50,20 @@
  * functions do not make their own copies.
  */
 #ifndef PNGINFO_H
 #define PNGINFO_H
 
 struct png_info_def
 {
    /* The following are necessary for every PNG file */
-   png_uint_32 width;  /* width of image in pixels (from IHDR) */
-   png_uint_32 height; /* height of image in pixels (from IHDR) */
-   png_uint_32 valid;  /* valid chunk data (see PNG_INFO_ below) */
-   png_size_t rowbytes; /* bytes needed to hold an untransformed row */
+   png_uint_32 width;       /* width of image in pixels (from IHDR) */
+   png_uint_32 height;      /* height of image in pixels (from IHDR) */
+   png_uint_32 valid;       /* valid chunk data (see PNG_INFO_ below) */
+   size_t rowbytes;         /* bytes needed to hold an untransformed row */
    png_colorp palette;      /* array of color values (valid & PNG_INFO_PLTE) */
    png_uint_16 num_palette; /* number of color entries in "palette" (PLTE) */
    png_uint_16 num_trans;   /* number of transparent palette color (tRNS) */
    png_byte bit_depth;      /* 1, 2, 4, 8, or 16 bits/channel (from IHDR) */
    png_byte color_type;     /* see PNG_COLOR_TYPE_ below (from IHDR) */
    /* The following three should have been named *_method not *_type */
    png_byte compression_type; /* must be PNG_COMPRESSION_TYPE_BASE (IHDR) */
    png_byte filter_type;    /* must be PNG_FILTER_TYPE_BASE (from IHDR) */
@@ -242,17 +242,17 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
    png_sPLT_tp splt_palettes;
    int         splt_palettes_num; /* Match type returned by png_get API */
 #endif
 
 #ifdef PNG_sCAL_SUPPORTED
    /* The sCAL chunk describes the actual physical dimensions of the
     * subject matter of the graphic.  The chunk contains a unit specification
     * a byte value, and two ASCII strings representing floating-point
-    * values.  The values are width and height corresponsing to one pixel
+    * values.  The values are width and height corresponding to one pixel
     * in the image.  Data values are valid if (valid & PNG_INFO_sCAL) is
     * non-zero.
     */
    png_byte scal_unit;         /* unit of physical scale */
    png_charp scal_s_width;     /* string containing height */
    png_charp scal_s_height;    /* string containing width */
 #endif
 
--- a/media/libpng/pngpread.c
+++ b/media/libpng/pngpread.c
@@ -1,13 +1,13 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.6.32 [August 24, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -29,43 +29,43 @@
 if (png_ptr->push_length + 4 > png_ptr->buffer_size) \
    { png_push_save_buffer(png_ptr); return; }
 #define PNG_PUSH_SAVE_BUFFER_IF_LT(N) \
 if (png_ptr->buffer_size < N) \
    { png_push_save_buffer(png_ptr); return; }
 
 void PNGAPI
 png_process_data(png_structrp png_ptr, png_inforp info_ptr,
-    png_bytep buffer, png_size_t buffer_size)
+    png_bytep buffer, size_t buffer_size)
 {
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
    png_push_restore_buffer(png_ptr, buffer, buffer_size);
 
    while (png_ptr->buffer_size)
    {
       png_process_some_data(png_ptr, info_ptr);
    }
 }
 
-png_size_t PNGAPI
+size_t PNGAPI
 png_process_data_pause(png_structrp png_ptr, int save)
 {
    if (png_ptr != NULL)
    {
       /* It's easiest for the caller if we do the save; then the caller doesn't
        * have to supply the same data again:
        */
       if (save != 0)
          png_push_save_buffer(png_ptr);
       else
       {
          /* This includes any pending saved bytes: */
-         png_size_t remaining = png_ptr->buffer_size;
+         size_t remaining = png_ptr->buffer_size;
          png_ptr->buffer_size = 0;
 
          /* So subtract the saved buffer size, unless all the data
           * is actually 'saved', in which case we just return 0
           */
          if (png_ptr->save_buffer_size < remaining)
             return remaining - png_ptr->save_buffer_size;
       }
@@ -128,18 +128,18 @@ png_process_some_data(png_structrp png_p
  * the correct PNG signature.  It is possible that this routine is called
  * with bytes already read from the signature, either because they have been
  * checked by the calling application, or because of multiple calls to this
  * routine.
  */
 void /* PRIVATE */
 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr)
 {
-   png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */
-       num_to_check = 8 - num_checked;
+   size_t num_checked = png_ptr->sig_bytes; /* SAFE, does not exceed 8 */
+   size_t num_to_check = 8 - num_checked;
 
    if (png_ptr->buffer_size < num_to_check)
    {
       num_to_check = png_ptr->buffer_size;
    }
 
    png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]),
        num_to_check);
@@ -513,44 +513,44 @@ png_push_read_chunk(png_structrp png_ptr
       png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length,
           PNG_HANDLE_CHUNK_AS_DEFAULT);
    }
 
    png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
 }
 
 void PNGCBAPI
-png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
+png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, size_t length)
 {
    png_bytep ptr;
 
    if (png_ptr == NULL)
       return;
 
    ptr = buffer;
    if (png_ptr->save_buffer_size != 0)
    {
-      png_size_t save_size;
+      size_t save_size;
 
       if (length < png_ptr->save_buffer_size)
          save_size = length;
 
       else
          save_size = png_ptr->save_buffer_size;
 
       memcpy(ptr, png_ptr->save_buffer_ptr, save_size);
       length -= save_size;
       ptr += save_size;
       png_ptr->buffer_size -= save_size;
       png_ptr->save_buffer_size -= save_size;
       png_ptr->save_buffer_ptr += save_size;
    }
    if (length != 0 && png_ptr->current_buffer_size != 0)
    {
-      png_size_t save_size;
+      size_t save_size;
 
       if (length < png_ptr->current_buffer_size)
          save_size = length;
 
       else
          save_size = png_ptr->current_buffer_size;
 
       memcpy(ptr, png_ptr->current_buffer_ptr, save_size);
@@ -562,44 +562,44 @@ png_push_fill_buffer(png_structp png_ptr
 
 void /* PRIVATE */
 png_push_save_buffer(png_structrp png_ptr)
 {
    if (png_ptr->save_buffer_size != 0)
    {
       if (png_ptr->save_buffer_ptr != png_ptr->save_buffer)
       {
-         png_size_t i, istop;
+         size_t i, istop;
          png_bytep sp;
          png_bytep dp;
 
          istop = png_ptr->save_buffer_size;
          for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer;
              i < istop; i++, sp++, dp++)
          {
             *dp = *sp;
          }
       }
    }
    if (png_ptr->save_buffer_size + png_ptr->current_buffer_size >
        png_ptr->save_buffer_max)
    {
-      png_size_t new_max;
+      size_t new_max;
       png_bytep old_buffer;
 
       if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
           (png_ptr->current_buffer_size + 256))
       {
          png_error(png_ptr, "Potential overflow of save_buffer");
       }
 
       new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
       old_buffer = png_ptr->save_buffer;
       png_ptr->save_buffer = (png_bytep)png_malloc_warn(png_ptr,
-          (png_size_t)new_max);
+          (size_t)new_max);
 
       if (png_ptr->save_buffer == NULL)
       {
          png_free(png_ptr, old_buffer);
          png_error(png_ptr, "Insufficient memory for save_buffer");
       }
 
       if (old_buffer)
@@ -617,17 +617,17 @@ png_push_save_buffer(png_structrp png_pt
       png_ptr->current_buffer_size = 0;
    }
    png_ptr->save_buffer_ptr = png_ptr->save_buffer;
    png_ptr->buffer_size = 0;
 }
 
 void /* PRIVATE */
 png_push_restore_buffer(png_structrp png_ptr, png_bytep buffer,
-    png_size_t buffer_length)
+    size_t buffer_length)
 {
    png_ptr->current_buffer = buffer;
    png_ptr->current_buffer_size = buffer_length;
    png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size;
    png_ptr->current_buffer_ptr = png_ptr->current_buffer;
 }
 
 void /* PRIVATE */
@@ -704,53 +704,53 @@ png_push_read_IDAT(png_structrp png_ptr)
          png_ensure_sequence_number(png_ptr, 4);
          png_ptr->idat_size -= 4;
       }
 #endif
    }
 
    if (png_ptr->idat_size != 0 && png_ptr->save_buffer_size != 0)
    {
-      png_size_t save_size = png_ptr->save_buffer_size;
+      size_t save_size = png_ptr->save_buffer_size;
       png_uint_32 idat_size = png_ptr->idat_size;
 
       /* We want the smaller of 'idat_size' and 'current_buffer_size', but they
        * are of different types and we don't know which variable has the fewest
        * bits.  Carefully select the smaller and cast it to the type of the
        * larger - this cannot overflow.  Do not cast in the following test - it
        * will break on either 16-bit or 64-bit platforms.
        */
       if (idat_size < save_size)
-         save_size = (png_size_t)idat_size;
+         save_size = (size_t)idat_size;
 
       else
          idat_size = (png_uint_32)save_size;
 
       png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
 
       png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size);
 
       png_ptr->idat_size -= idat_size;
       png_ptr->buffer_size -= save_size;
       png_ptr->save_buffer_size -= save_size;
       png_ptr->save_buffer_ptr += save_size;
    }
 
    if (png_ptr->idat_size != 0 && png_ptr->current_buffer_size != 0)
    {
-      png_size_t save_size = png_ptr->current_buffer_size;
+      size_t save_size = png_ptr->current_buffer_size;
       png_uint_32 idat_size = png_ptr->idat_size;
 
       /* We want the smaller of 'idat_size' and 'current_buffer_size', but they
        * are of different types and we don't know which variable has the fewest
        * bits.  Carefully select the smaller and cast it to the type of the
        * larger - this cannot overflow.
        */
       if (idat_size < save_size)
-         save_size = (png_size_t)idat_size;
+         save_size = (size_t)idat_size;
 
       else
          idat_size = (png_uint_32)save_size;
 
       png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
 
       png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
 
@@ -767,17 +767,17 @@ png_push_read_IDAT(png_structrp png_ptr)
       png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
       png_ptr->mode |= PNG_AFTER_IDAT;
       png_ptr->zowner = 0;
    }
 }
 
 void /* PRIVATE */
 png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer,
-    png_size_t buffer_length)
+    size_t buffer_length)
 {
    /* The caller checks for a non-zero buffer length. */
    if (!(buffer_length > 0) || buffer == NULL)
       png_error(png_ptr, "No IDAT data (internal error)");
 
 #ifdef PNG_READ_APNG_SUPPORTED
    /* If the app is not APNG-aware, decode only the first frame */
    if ((png_ptr->apng_flags & PNG_APNG_APP) == 0 &&
--- a/media/libpng/pngpriv.h
+++ b/media/libpng/pngpriv.h
@@ -1,13 +1,13 @@
 
 /* pngpriv.h - private declarations for use inside libpng
  *
- * Last changed in libpng 1.6.32 [August 24, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -205,17 +205,21 @@
       /* Only check for SSE if the build configuration has been modified to
        * enable SSE optimizations.  This means that these optimizations will
        * be off by default.  See contrib/intel for more details.
        */
 #     if defined(__SSE4_1__) || defined(__AVX__) || defined(__SSSE3__) || \
        defined(__SSE2__) || defined(_M_X64) || defined(_M_AMD64) || \
        (defined(_M_IX86_FP) && _M_IX86_FP >= 2)
 #         define PNG_INTEL_SSE_OPT 1
+#      else
+#         define PNG_INTEL_SSE_OPT 0
 #      endif
+#   else
+#      define PNG_INTEL_SSE_OPT 0
 #   endif
 #endif
 
 #if PNG_INTEL_SSE_OPT > 0
 #   ifndef PNG_INTEL_SSE_IMPLEMENTATION
 #      if defined(__SSE4_1__) || defined(__AVX__)
           /* We are not actually using AVX, but checking for AVX is the best
              way we can detect SSE4.1 and SSSE3 on MSVC.
@@ -229,16 +233,18 @@
 #      else
 #         define PNG_INTEL_SSE_IMPLEMENTATION 0
 #      endif
 #   endif
 
 #   if PNG_INTEL_SSE_IMPLEMENTATION > 0
 #      define PNG_FILTER_OPTIMIZATIONS png_init_filter_functions_sse2
 #   endif
+#else
+#   define PNG_INTEL_SSE_IMPLEMENTATION 0
 #endif
 
 #if PNG_MIPS_MSA_OPT > 0
 #  define PNG_FILTER_OPTIMIZATIONS png_init_filter_functions_msa
 #  ifndef PNG_MIPS_MSA_IMPLEMENTATION
 #     if defined(__mips_msa)
 #        if defined(__clang__)
 #        elif defined(__GNUC__)
@@ -727,18 +733,18 @@
  * only gives off-by-one errors and only for 0.5% (1 in 200) of the values.
  */
 #define PNG_DIV65535(v24) (((v24) + 32895) >> 16)
 #define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255)
 
 /* Added to libpng-1.2.6 JB */
 #define PNG_ROWBYTES(pixel_bits, width) \
     ((pixel_bits) >= 8 ? \
-    ((png_size_t)(width) * (((png_size_t)(pixel_bits)) >> 3)) : \
-    (( ((png_size_t)(width) * ((png_size_t)(pixel_bits))) + 7) >> 3) )
+    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
+    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
 
 /* This returns the number of trailing bits in the last byte of a row, 0 if the
  * last byte is completely full of pixels.  It is, in principle, (pixel_bits x
  * width) % 8, but that would overflow for large 'width'.  The second macro is
  * the same except that it returns the number of unused bits in the last byte;
  * (8-TRAILBITS), but 0 when TRAILBITS is 0.
  *
  * NOTE: these macros are intended to be self-evidently correct and never
@@ -926,17 +932,17 @@
       "-I (include path) error: see the notes in pngpriv.h"
    /* This means that when pnglibconf.h was built the copy of zlib.h that it
     * used is not the same as the one being used here.  Because the build of
     * libpng makes decisions to use inflateInit2 and inflateReset2 based on the
     * zlib version number and because this affects handling of certain broken
     * PNG files the -I directives must match.
     *
     * The most likely explanation is that you passed a -I in CFLAGS. This will
-    * not work; all the preprocessor directories and in particular all the -I
+    * not work; all the preprocessor directives and in particular all the -I
     * directives must be in CPPFLAGS.
     */
 #endif
 
 /* This is used for 16-bit gamma tables -- only the top level pointers are
  * const; this could be changed:
  */
 typedef const png_uint_16p * png_const_uint_16pp;
@@ -1055,51 +1061,51 @@ PNG_INTERNAL_FUNCTION(voidpf,png_zalloc,
 PNG_INTERNAL_FUNCTION(void,png_zfree,(voidpf png_ptr, voidpf ptr),PNG_EMPTY);
 
 /* Next four functions are used internally as callbacks.  PNGCBAPI is required
  * but not PNG_EXPORT.  PNGAPI added at libpng version 1.2.3, changed to
  * PNGCBAPI at 1.5.0
  */
 
 PNG_INTERNAL_FUNCTION(void PNGCBAPI,png_default_read_data,(png_structp png_ptr,
-    png_bytep data, png_size_t length),PNG_EMPTY);
+    png_bytep data, size_t length),PNG_EMPTY);
 
 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
 PNG_INTERNAL_FUNCTION(void PNGCBAPI,png_push_fill_buffer,(png_structp png_ptr,
-    png_bytep buffer, png_size_t length),PNG_EMPTY);
+    png_bytep buffer, size_t length),PNG_EMPTY);
 #endif
 
 PNG_INTERNAL_FUNCTION(void PNGCBAPI,png_default_write_data,(png_structp png_ptr,
-    png_bytep data, png_size_t length),PNG_EMPTY);
+    png_bytep data, size_t length),PNG_EMPTY);
 
 #ifdef PNG_WRITE_FLUSH_SUPPORTED
 #  ifdef PNG_STDIO_SUPPORTED
 PNG_INTERNAL_FUNCTION(void PNGCBAPI,png_default_flush,(png_structp png_ptr),
    PNG_EMPTY);
 #  endif
 #endif
 
 /* Reset the CRC variable */
 PNG_INTERNAL_FUNCTION(void,png_reset_crc,(png_structrp png_ptr),PNG_EMPTY);
 
 /* Write the "data" buffer to whatever output you are using */
 PNG_INTERNAL_FUNCTION(void,png_write_data,(png_structrp png_ptr,
-    png_const_bytep data, png_size_t length),PNG_EMPTY);
+    png_const_bytep data, size_t length),PNG_EMPTY);
 
 /* Read and check the PNG file signature */
 PNG_INTERNAL_FUNCTION(void,png_read_sig,(png_structrp png_ptr,
    png_inforp info_ptr),PNG_EMPTY);
 
 /* Read the chunk header (length + type name) */
 PNG_INTERNAL_FUNCTION(png_uint_32,png_read_chunk_header,(png_structrp png_ptr),
    PNG_EMPTY);
 
 /* Read data from whatever input you are using into the "data" buffer */
 PNG_INTERNAL_FUNCTION(void,png_read_data,(png_structrp png_ptr, png_bytep data,
-    png_size_t length),PNG_EMPTY);
+    size_t length),PNG_EMPTY);
 
 /* Read bytes into buf, and update png_ptr->crc */
 PNG_INTERNAL_FUNCTION(void,png_crc_read,(png_structrp png_ptr, png_bytep buf,
     png_uint_32 length),PNG_EMPTY);
 
 /* Read "skip" bytes, read the file crc, and (optionally) verify png_ptr->crc */
 PNG_INTERNAL_FUNCTION(int,png_crc_finish,(png_structrp png_ptr,
    png_uint_32 skip),PNG_EMPTY);
@@ -1107,17 +1113,17 @@ PNG_INTERNAL_FUNCTION(int,png_crc_finish
 /* Read the CRC from the file and compare it to the libpng calculated CRC */
 PNG_INTERNAL_FUNCTION(int,png_crc_error,(png_structrp png_ptr),PNG_EMPTY);
 
 /* Calculate the CRC over a section of data.  Note that we are only
  * passing a maximum of 64K on systems that have this as a memory limit,
  * since this is the maximum buffer size we can specify.
  */
 PNG_INTERNAL_FUNCTION(void,png_calculate_crc,(png_structrp png_ptr,
-   png_const_bytep ptr, png_size_t length),PNG_EMPTY);
+   png_const_bytep ptr, size_t length),PNG_EMPTY);
 
 #ifdef PNG_WRITE_FLUSH_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_flush,(png_structrp png_ptr),PNG_EMPTY);
 #endif
 
 /* Write various chunks */
 
 /* Write the IHDR chunk, and update the png_struct with the necessary
@@ -1190,17 +1196,17 @@ PNG_INTERNAL_FUNCTION(void,png_write_bKG
 #ifdef PNG_WRITE_hIST_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_write_hIST,(png_structrp png_ptr,
     png_const_uint_16p hist, int num_hist),PNG_EMPTY);
 #endif
 
 /* Chunks that have keywords */
 #ifdef PNG_WRITE_tEXt_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_write_tEXt,(png_structrp png_ptr,
-   png_const_charp key, png_const_charp text, png_size_t text_len),PNG_EMPTY);
+   png_const_charp key, png_const_charp text, size_t text_len),PNG_EMPTY);
 #endif
 
 #ifdef PNG_WRITE_zTXt_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_write_zTXt,(png_structrp png_ptr, png_const_charp
     key, png_const_charp text, int compression),PNG_EMPTY);
 #endif
 
 #ifdef PNG_WRITE_iTXt_SUPPORTED
@@ -1583,20 +1589,20 @@ PNG_INTERNAL_FUNCTION(void,png_init_read
 PNG_INTERNAL_FUNCTION(void,png_push_read_chunk,(png_structrp png_ptr,
     png_inforp info_ptr),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_read_sig,(png_structrp png_ptr,
     png_inforp info_ptr),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_check_crc,(png_structrp png_ptr),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_save_buffer,(png_structrp png_ptr),
     PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_restore_buffer,(png_structrp png_ptr,
-    png_bytep buffer, png_size_t buffer_length),PNG_EMPTY);
+    png_bytep buffer, size_t buffer_length),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_read_IDAT,(png_structrp png_ptr),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_process_IDAT_data,(png_structrp png_ptr,
-    png_bytep buffer, png_size_t buffer_length),PNG_EMPTY);
+    png_bytep buffer, size_t buffer_length),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_process_row,(png_structrp png_ptr),
     PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_handle_unknown,(png_structrp png_ptr,
    png_inforp info_ptr, png_uint_32 length),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_have_info,(png_structrp png_ptr,
    png_inforp info_ptr),PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(void,png_push_have_end,(png_structrp png_ptr,
    png_inforp info_ptr),PNG_EMPTY);
@@ -1899,23 +1905,23 @@ PNG_INTERNAL_FUNCTION(void,png_chunk_rep
  * width or height, derived from the precision (number of significant
  * digits - a build time settable option) and assumptions about the
  * maximum ridiculous exponent.
  */
 #define PNG_sCAL_MAX_DIGITS (PNG_sCAL_PRECISION+1/*.*/+1/*E*/+10/*exponent*/)
 
 #ifdef PNG_FLOATING_POINT_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_ascii_from_fp,(png_const_structrp png_ptr,
-   png_charp ascii, png_size_t size, double fp, unsigned int precision),
+   png_charp ascii, size_t size, double fp, unsigned int precision),
    PNG_EMPTY);
 #endif /* FLOATING_POINT */
 
 #ifdef PNG_FIXED_POINT_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_ascii_from_fixed,(png_const_structrp png_ptr,
-   png_charp ascii, png_size_t size, png_fixed_point fp),PNG_EMPTY);
+   png_charp ascii, size_t size, png_fixed_point fp),PNG_EMPTY);
 #endif /* FIXED_POINT */
 #endif /* sCAL */
 
 #if defined(PNG_sCAL_SUPPORTED) || defined(PNG_pCAL_SUPPORTED)
 /* An internal API to validate the format of a floating point number.
  * The result is the index of the next character.  If the number is
  * not valid it will be the index of a character in the supposed number.
  *
@@ -1998,26 +2004,26 @@ PNG_INTERNAL_FUNCTION(void,png_ascii_fro
  * a 'maybe' state even though a preceding integer.fraction is valid.
  * The PNG_FP_WAS_VALID flag indicates that a preceding substring was
  * a valid number.  It's possible to recover from this by calling
  * the parser again (from the start, with state 0) but with a string
  * that omits the last character (i.e. set the size to the index of
  * the problem character.)  This has not been tested within libpng.
  */
 PNG_INTERNAL_FUNCTION(int,png_check_fp_number,(png_const_charp string,
-   png_size_t size, int *statep, png_size_tp whereami),PNG_EMPTY);
+   size_t size, int *statep, png_size_tp whereami),PNG_EMPTY);
 
 /* This is the same but it checks a complete string and returns true
  * only if it just contains a floating point number.  As of 1.5.4 this
  * function also returns the state at the end of parsing the number if
  * it was valid (otherwise it returns 0.)  This can be used for testing
  * for negative or zero values using the sticky flag.
  */
 PNG_INTERNAL_FUNCTION(int,png_check_fp_string,(png_const_charp string,
-   png_size_t size),PNG_EMPTY);
+   size_t size),PNG_EMPTY);
 #endif /* pCAL || sCAL */
 
 #if defined(PNG_GAMMA_SUPPORTED) ||\
     defined(PNG_INCH_CONVERSIONS_SUPPORTED) || defined(PNG_READ_pHYs_SUPPORTED)
 /* Added at libpng version 1.5.0 */
 /* This is a utility to provide a*times/div (rounded) and indicate
  * if there is an overflow.  The result is a boolean - false (0)
  * for overflow, true (1) if no overflow, in which case *res
@@ -2082,17 +2088,17 @@ PNG_INTERNAL_FUNCTION(void,png_build_gam
 /* The internal structure that png_image::opaque points to. */
 typedef struct png_control
 {
    png_structp png_ptr;
    png_infop   info_ptr;
    png_voidp   error_buf;           /* Always a jmp_buf at present. */
 
    png_const_bytep memory;          /* Memory buffer. */
-   png_size_t      size;            /* Size of the memory buffer. */
+   size_t          size;            /* Size of the memory buffer. */
 
    unsigned int for_write       :1; /* Otherwise it is a read structure */
    unsigned int owned_file      :1; /* We own the file in io_ptr */
 } png_control;
 
 /* Return the pointer to the jmp_buf from a png_control: necessary because C
  * does not reveal the type of the elements of jmp_buf.
  */
--- a/media/libpng/pngread.c
+++ b/media/libpng/pngread.c
@@ -1,13 +1,13 @@
 
 /* pngread.c - read a PNG file
  *
- * Last changed in libpng 1.6.33 [September 28, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * This file contains routines that an application calls directly to
@@ -1607,28 +1607,28 @@ png_image_begin_read_from_file(png_image
       return png_image_error(image,
           "png_image_begin_read_from_file: incorrect PNG_IMAGE_VERSION");
 
    return 0;
 }
 #endif /* STDIO */
 
 static void PNGCBAPI
-png_image_memory_read(png_structp png_ptr, png_bytep out, png_size_t need)
+png_image_memory_read(png_structp png_ptr, png_bytep out, size_t need)
 {
    if (png_ptr != NULL)
    {
       png_imagep image = png_voidcast(png_imagep, png_ptr->io_ptr);
       if (image != NULL)
       {
          png_controlp cp = image->opaque;
          if (cp != NULL)
          {
             png_const_bytep memory = cp->memory;
-            png_size_t size = cp->size;
+            size_t size = cp->size;
 
             if (memory != NULL && size >= need)
             {
                memcpy(out, memory, need);
                cp->memory = memory + need;
                cp->size = size - need;
                return;
             }
@@ -1637,17 +1637,17 @@ png_image_memory_read(png_structp png_pt
          }
       }
 
       png_error(png_ptr, "invalid memory read");
    }
 }
 
 int PNGAPI png_image_begin_read_from_memory(png_imagep image,
-    png_const_voidp memory, png_size_t size)
+    png_const_voidp memory, size_t size)
 {
    if (image != NULL && image->version == PNG_IMAGE_VERSION)
    {
       if (memory != NULL && size > 0)
       {
          if (png_image_read_init(image) != 0)
          {
             /* Now set the IO functions to read from the memory buffer and
@@ -4225,17 +4225,17 @@ png_image_finish_read(png_imagep image, 
              *    (PNG_IMAGE_PIXEL_COMPONENT_SIZE(fmt)*height*(row_stride))
              *
              * And the component size is always 1 or 2, so make sure that the
              * number of *bytes* that the application is saying are available
              * does actually fit into a 32-bit number.
              *
              * NOTE: this will be changed in 1.7 because PNG_IMAGE_BUFFER_SIZE
              * will be changed to use png_alloc_size_t; bigger images can be
-             * accomodated on 64-bit systems.
+             * accommodated on 64-bit systems.
              */
             if (image->height <=
                 0xffffffffU/PNG_IMAGE_PIXEL_COMPONENT_SIZE(image->format)/check)
             {
                if ((image->format & PNG_FORMAT_FLAG_COLORMAP) == 0 ||
                   (image->colormap_entries > 0 && colormap != NULL))
                {
                   int result;
--- a/media/libpng/pngrio.c
+++ b/media/libpng/pngrio.c
@@ -1,13 +1,13 @@
 
 /* pngrio.c - functions for data input
  *
- * Last changed in libpng 1.6.24 [August 4, 2016]
- * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2016,2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * This file provides a location for all input.  Users who need
@@ -24,17 +24,17 @@
 
 /* Read the data from whatever input you are using.  The default routine
  * reads from a file pointer.  Note that this routine sometimes gets called
  * with very small lengths, so you should implement some kind of simple
  * buffering if you are using unbuffered reads.  This should never be asked
  * to read more than 64K on a 16-bit machine.
  */
 void /* PRIVATE */
-png_read_data(png_structrp png_ptr, png_bytep data, png_size_t length)
+png_read_data(png_structrp png_ptr, png_bytep data, size_t length)
 {
    png_debug1(4, "reading %d bytes", (int)length);
 
    if (png_ptr->read_data_fn != NULL)
       (*(png_ptr->read_data_fn))(png_ptr, data, length);
 
    else
       png_error(png_ptr, "Call to NULL read function");
@@ -42,24 +42,24 @@ png_read_data(png_structrp png_ptr, png_
 
 #ifdef PNG_STDIO_SUPPORTED
 /* This is the function that does the actual reading of data.  If you are
  * not reading from a standard C stream, you should create a replacement
  * read_data function and use it at run time with png_set_read_fn(), rather
  * than changing the library.
  */
 void PNGCBAPI
-png_default_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
+png_default_read_data(png_structp png_ptr, png_bytep data, size_t length)
 {
-   png_size_t check;
+   size_t check;
 
    if (png_ptr == NULL)
       return;
 
-   /* fread() returns 0 on error, so it is OK to store this in a png_size_t
+   /* fread() returns 0 on error, so it is OK to store this in a size_t
     * instead of an int, which is what fread() actually returns.
     */
    check = fread(data, 1, length, png_voidcast(png_FILE_p, png_ptr->io_ptr));
 
    if (check != length)
       png_error(png_ptr, "Read Error");
 }
 #endif
--- a/media/libpng/pngrtran.c
+++ b/media/libpng/pngrtran.c
@@ -1,13 +1,13 @@
 
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
- * Last changed in libpng 1.6.33 [September 28, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * This file contains functions optionally called by an application
@@ -287,17 +287,17 @@ png_set_alpha_mode_fixed(png_structrp pn
    output_gamma = translate_gamma_flags(png_ptr, output_gamma, 1/*screen*/);
 
    /* Validate the value to ensure it is in a reasonable range. The value
     * is expected to be 1 or greater, but this range test allows for some
     * viewing correction values.  The intent is to weed out users of this API
     * who use the inverse of the gamma value accidentally!  Since some of these
     * values are reasonable this may have to be changed:
     *
-    * 1.6.x: changed from 0.07..3 to 0.01..100 (to accomodate the optimal 16-bit
+    * 1.6.x: changed from 0.07..3 to 0.01..100 (to accommodate the optimal 16-bit
     * gamma of 36, and its reciprocal.)
     */
    if (output_gamma < 1000 || output_gamma > 10000000)
       png_error(png_ptr, "output gamma out of expected range");
 
    /* The default file gamma is the inverse of the output gamma; the output
     * gamma may be changed below so get the file value first:
     */
@@ -742,17 +742,17 @@ png_set_quantize(png_structrp png_ptr, p
    {
       int i;
       png_bytep distance;
       int total_bits = PNG_QUANTIZE_RED_BITS + PNG_QUANTIZE_GREEN_BITS +
           PNG_QUANTIZE_BLUE_BITS;
       int num_red = (1 << PNG_QUANTIZE_RED_BITS);
       int num_green = (1 << PNG_QUANTIZE_GREEN_BITS);
       int num_blue = (1 << PNG_QUANTIZE_BLUE_BITS);
-      png_size_t num_entries = ((png_size_t)1 << total_bits);
+      size_t num_entries = ((size_t)1 << total_bits);
 
       png_ptr->palette_lookup = (png_bytep)png_calloc(png_ptr,
           (png_alloc_size_t)(num_entries * (sizeof (png_byte))));
 
       distance = (png_bytep)png_malloc(png_ptr, (png_alloc_size_t)(num_entries *
           (sizeof (png_byte))));
 
       memset(distance, 0xff, num_entries * (sizeof (png_byte)));
@@ -1312,17 +1312,17 @@ png_init_read_transformations(png_struct
             /* Assume the output matches the input; a long time default behavior
              * of libpng, although the standard has nothing to say about this.
              */
             png_ptr->screen_gamma = png_reciprocal(png_ptr->colorspace.gamma);
       }
 
       else if (png_ptr->screen_gamma != 0)
          /* The converse - assume the file matches the screen, note that this
-          * perhaps undesireable default can (from 1.5.4) be changed by calling
+          * perhaps undesirable default can (from 1.5.4) be changed by calling
           * png_set_alpha_mode (even if the alpha handling mode isn't required
           * or isn't changed from the default.)
           */
          png_ptr->colorspace.gamma = png_reciprocal(png_ptr->screen_gamma);
 
       else /* neither are set */
          /* Just in case the following prevents any processing - file and screen
           * are both assumed to be linear and there is no way to introduce a
@@ -1880,17 +1880,17 @@ png_init_read_transformations(png_struct
        (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE))
    {
       int i;
       int istop = png_ptr->num_palette;
       int shift = 8 - png_ptr->sig_bit.red;
 
       png_ptr->transformations &= ~PNG_SHIFT;
 
-      /* significant bits can be in the range 1 to 7 for a meaninful result, if
+      /* significant bits can be in the range 1 to 7 for a meaningful result, if
        * the number of significant bits is 0 then no shift is done (this is an
        * error condition which is silently ignored.)
        */
       if (shift > 0 && shift < 8)
          for (i=0; i<istop; ++i)
          {
             int component = png_ptr->palette[i].red;
 
@@ -2146,18 +2146,18 @@ png_do_unpack(png_row_infop row_info, pn
    {
       png_uint_32 i;
       png_uint_32 row_width=row_info->width;
 
       switch (row_info->bit_depth)
       {
          case 1:
          {
-            png_bytep sp = row + (png_size_t)((row_width - 1) >> 3);
-            png_bytep dp = row + (png_size_t)row_width - 1;
+            png_bytep sp = row + (size_t)((row_width - 1) >> 3);
+            png_bytep dp = row + (size_t)row_width - 1;
             png_uint_32 shift = 7U - ((row_width + 7U) & 0x07);
             for (i = 0; i < row_width; i++)
             {
                *dp = (png_byte)((*sp >> shift) & 0x01);
 
                if (shift == 7)
                {
                   shift = 0;
@@ -2170,18 +2170,18 @@ png_do_unpack(png_row_infop row_info, pn
                dp--;
             }
             break;
          }
 
          case 2:
          {
 
-            png_bytep sp = row + (png_size_t)((row_width - 1) >> 2);
-            png_bytep dp = row + (png_size_t)row_width - 1;
+            png_bytep sp = row + (size_t)((row_width - 1) >> 2);
+            png_bytep dp = row + (size_t)row_width - 1;
             png_uint_32 shift = ((3U - ((row_width + 3U) & 0x03)) << 1);
             for (i = 0; i < row_width; i++)
             {
                *dp = (png_byte)((*sp >> shift) & 0x03);
 
                if (shift == 6)
                {
                   shift = 0;
@@ -2193,18 +2193,18 @@ png_do_unpack(png_row_infop row_info, pn
 
                dp--;
             }
             break;
          }
 
          case 4:
          {
-            png_bytep sp = row + (png_size_t)((row_width - 1) >> 1);
-            png_bytep dp = row + (png_size_t)row_width - 1;
+            png_bytep sp = row + (size_t)((row_width - 1) >> 1);
+            png_bytep dp = row + (size_t)row_width - 1;
             png_uint_32 shift = ((1U - ((row_width + 1U) & 0x01)) << 2);
             for (i = 0; i < row_width; i++)
             {
                *dp = (png_byte)((*sp >> shift) & 0x0f);
 
                if (shift == 4)
                {
                   shift = 0;
@@ -2458,105 +2458,104 @@ png_do_chop(png_row_infop row_info, png_
    }
 }
 #endif
 
 #ifdef PNG_READ_SWAP_ALPHA_SUPPORTED
 static void
 png_do_read_swap_alpha(png_row_infop row_info, png_bytep row)
 {
+   png_uint_32 row_width = row_info->width;
+
    png_debug(1, "in png_do_read_swap_alpha");
 
+   if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
    {
-      png_uint_32 row_width = row_info->width;
-      if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
+      /* This converts from RGBA to ARGB */
+      if (row_info->bit_depth == 8)
       {
-         /* This converts from RGBA to ARGB */
-         if (row_info->bit_depth == 8)
+         png_bytep sp = row + row_info->rowbytes;
+         png_bytep dp = sp;
+         png_byte save;
+         png_uint_32 i;
+
+         for (i = 0; i < row_width; i++)
          {
-            png_bytep sp = row + row_info->rowbytes;
-            png_bytep dp = sp;
-            png_byte save;
-            png_uint_32 i;
-
-            for (i = 0; i < row_width; i++)
-            {
-               save = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = save;
-            }
+            save = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = save;
          }
+      }
 
 #ifdef PNG_READ_16BIT_SUPPORTED
-         /* This converts from RRGGBBAA to AARRGGBB */
-         else
+      /* This converts from RRGGBBAA to AARRGGBB */
+      else
+      {
+         png_bytep sp = row + row_info->rowbytes;
+         png_bytep dp = sp;
+         png_byte save[2];
+         png_uint_32 i;
+
+         for (i = 0; i < row_width; i++)
          {
-            png_bytep sp = row + row_info->rowbytes;
-            png_bytep dp = sp;
-            png_byte save[2];
-            png_uint_32 i;
-
-            for (i = 0; i < row_width; i++)
-            {
-               save[0] = *(--sp);
-               save[1] = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = save[0];
-               *(--dp) = save[1];
-            }
+            save[0] = *(--sp);
+            save[1] = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = save[0];
+            *(--dp) = save[1];
          }
+      }
 #endif
-      }
-
-      else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
+   }
+
+   else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
+   {
+      /* This converts from GA to AG */
+      if (row_info->bit_depth == 8)
       {
-         /* This converts from GA to AG */
-         if (row_info->bit_depth == 8)
+         png_bytep sp = row + row_info->rowbytes;
+         png_bytep dp = sp;
+         png_byte save;
+         png_uint_32 i;
+
+         for (i = 0; i < row_width; i++)
          {
-            png_bytep sp = row + row_info->rowbytes;
-            png_bytep dp = sp;
-            png_byte save;
-            png_uint_32 i;
-
-            for (i = 0; i < row_width; i++)
-            {
-               save = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = save;
-            }
+            save = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = save;
          }
+      }
 
 #ifdef PNG_READ_16BIT_SUPPORTED
-         /* This converts from GGAA to AAGG */
-         else
+      /* This converts from GGAA to AAGG */
+      else
+      {
+         png_bytep sp = row + row_info->rowbytes;
+         png_bytep dp = sp;
+         png_byte save[2];
+         png_uint_32 i;
+
+         for (i = 0; i < row_width; i++)
          {
-            png_bytep sp = row + row_info->rowbytes;
-            png_bytep dp = sp;
-            png_byte save[2];
-            png_uint_32 i;
-
-            for (i = 0; i < row_width; i++)
-            {
-               save[0] = *(--sp);
-               save[1] = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = *(--sp);
-               *(--dp) = save[0];
-               *(--dp) = save[1];
-            }
+            save[0] = *(--sp);
+            save[1] = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = *(--sp);
+            *(--dp) = save[0];
+            *(--dp) = save[1];
          }
+      }
 #endif
-      }
    }
 }
 #endif
 
 #ifdef PNG_READ_INVERT_ALPHA_SUPPORTED
 static void
 png_do_read_invert_alpha(png_row_infop row_info, png_bytep row)
 {
@@ -2676,34 +2675,34 @@ png_do_read_filler(png_row_infop row_inf
    if (
        row_info->color_type == PNG_COLOR_TYPE_GRAY)
    {
       if (row_info->bit_depth == 8)
       {
          if ((flags & PNG_FLAG_FILLER_AFTER) != 0)
          {
             /* This changes the data from G to GX */
-            png_bytep sp = row + (png_size_t)row_width;
-            png_bytep dp =  sp + (png_size_t)row_width;
+            png_bytep sp = row + (size_t)row_width;
+            png_bytep dp =  sp + (size_t)row_width;
             for (i = 1; i < row_width; i++)
             {
                *(--dp) = lo_filler;
                *(--dp) = *(--sp);
             }
             *(--dp) = lo_filler;
             row_info->channels = 2;
             row_info->pixel_depth = 16;
             row_info->rowbytes = row_width * 2;
          }
 
          else
          {
             /* This changes the data from G to XG */
-            png_bytep sp = row + (png_size_t)row_width;
-            png_bytep dp = sp  + (png_size_t)row_width;
+            png_bytep sp = row + (size_t)row_width;
+            png_bytep dp = sp  + (size_t)row_width;
             for (i = 0; i < row_width; i++)
             {
                *(--dp) = *(--sp);
                *(--dp) = lo_filler;
             }
             row_info->channels = 2;
             row_info->pixel_depth = 16;
             row_info->rowbytes = row_width * 2;
@@ -2711,18 +2710,18 @@ png_do_read_filler(png_row_infop row_inf
       }
 
 #ifdef PNG_READ_16BIT_SUPPORTED
       else if (row_info->bit_depth == 16)
       {
          if ((flags & PNG_FLAG_FILLER_AFTER) != 0)
          {
             /* This changes the data from GG to GGXX */
-            png_bytep sp = row + (png_size_t)row_width * 2;
-            png_bytep dp = sp  + (png_size_t)row_width * 2;
+            png_bytep sp = row + (size_t)row_width * 2;
+            png_bytep dp = sp  + (size_t)row_width * 2;
             for (i = 1; i < row_width; i++)
             {
                *(--dp) = lo_filler;
                *(--dp) = hi_filler;
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
             }
             *(--dp) = lo_filler;
@@ -2730,18 +2729,18 @@ png_do_read_filler(png_row_infop row_inf
             row_info->channels = 2;
             row_info->pixel_depth = 32;
             row_info->rowbytes = row_width * 4;
          }
 
          else
          {
             /* This changes the data from GG to XXGG */
-            png_bytep sp = row + (png_size_t)row_width * 2;
-            png_bytep dp = sp  + (png_size_t)row_width * 2;
+            png_bytep sp = row + (size_t)row_width * 2;
+            png_bytep dp = sp  + (size_t)row_width * 2;
             for (i = 0; i < row_width; i++)
             {
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = lo_filler;
                *(--dp) = hi_filler;
             }
             row_info->channels = 2;
@@ -2753,36 +2752,36 @@ png_do_read_filler(png_row_infop row_inf
    } /* COLOR_TYPE == GRAY */
    else if (row_info->color_type == PNG_COLOR_TYPE_RGB)
    {
       if (row_info->bit_depth == 8)
       {
          if ((flags & PNG_FLAG_FILLER_AFTER) != 0)
          {
             /* This changes the data from RGB to RGBX */
-            png_bytep sp = row + (png_size_t)row_width * 3;
-            png_bytep dp = sp  + (png_size_t)row_width;
+            png_bytep sp = row + (size_t)row_width * 3;
+            png_bytep dp = sp  + (size_t)row_width;
             for (i = 1; i < row_width; i++)
             {
                *(--dp) = lo_filler;
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
             }
             *(--dp) = lo_filler;
             row_info->channels = 4;
             row_info->pixel_depth = 32;
             row_info->rowbytes = row_width * 4;
          }
 
          else
          {
             /* This changes the data from RGB to XRGB */
-            png_bytep sp = row + (png_size_t)row_width * 3;
-            png_bytep dp = sp + (png_size_t)row_width;
+            png_bytep sp = row + (size_t)row_width * 3;
+            png_bytep dp = sp + (size_t)row_width;
             for (i = 0; i < row_width; i++)
             {
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = lo_filler;
             }
             row_info->channels = 4;
@@ -2792,18 +2791,18 @@ png_do_read_filler(png_row_infop row_inf
       }
 
 #ifdef PNG_READ_16BIT_SUPPORTED
       else if (row_info->bit_depth == 16)
       {
          if ((flags & PNG_FLAG_FILLER_AFTER) != 0)
          {
             /* This changes the data from RRGGBB to RRGGBBXX */
-            png_bytep sp = row + (png_size_t)row_width * 6;
-            png_bytep dp = sp  + (png_size_t)row_width * 2;
+            png_bytep sp = row + (size_t)row_width * 6;
+            png_bytep dp = sp  + (size_t)row_width * 2;
             for (i = 1; i < row_width; i++)
             {
                *(--dp) = lo_filler;
                *(--dp) = hi_filler;
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
@@ -2815,18 +2814,18 @@ png_do_read_filler(png_row_infop row_inf
             row_info->channels = 4;
             row_info->pixel_depth = 64;
             row_info->rowbytes = row_width * 8;
          }
 
          else
          {
             /* This changes the data from RRGGBB to XXRRGGBB */
-            png_bytep sp = row + (png_size_t)row_width * 6;
-            png_bytep dp = sp  + (png_size_t)row_width * 2;
+            png_bytep sp = row + (size_t)row_width * 6;
+            png_bytep dp = sp  + (size_t)row_width * 2;
             for (i = 0; i < row_width; i++)
             {
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
                *(--dp) = *(--sp);
@@ -2857,31 +2856,31 @@ png_do_gray_to_rgb(png_row_infop row_inf
    if (row_info->bit_depth >= 8 &&
        (row_info->color_type & PNG_COLOR_MASK_COLOR) == 0)
    {
       if (row_info->color_type == PNG_COLOR_TYPE_GRAY)
       {
          if (row_info->bit_depth == 8)
          {
             /* This changes G to RGB */
-            png_bytep sp = row + (png_size_t)row_width - 1;
-            png_bytep dp = sp  + (png_size_t)row_width * 2;
+            png_bytep sp = row + (size_t)row_width - 1;
+            png_bytep dp = sp  + (size_t)row_width * 2;
             for (i = 0; i < row_width; i++)
             {
                *(dp--) = *sp;
                *(dp--) = *sp;
                *(dp--) = *(sp--);
             }
          }
 
          else
          {
             /* This changes GG to RRGGBB */
-            png_bytep sp = row + (png_size_t)row_width * 2 - 1;
-            png_bytep dp = sp  + (png_size_t)row_width * 4;
+            png_bytep sp = row + (size_t)row_width * 2 - 1;
+            png_bytep dp = sp  + (size_t)row_width * 4;
             for (i = 0; i < row_width; i++)
             {
                *(dp--) = *sp;
                *(dp--) = *(sp - 1);
                *(dp--) = *sp;
                *(dp--) = *(sp - 1);
                *(dp--) = *(sp--);
                *(dp--) = *(sp--);
@@ -2889,32 +2888,32 @@ png_do_gray_to_rgb(png_row_infop row_inf
          }
       }
 
       else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
       {
          if (row_info->bit_depth == 8)
          {
             /* This changes GA to RGBA */
-            png_bytep sp = row + (png_size_t)row_width * 2 - 1;
-            png_bytep dp = sp  + (png_size_t)row_width * 2;
+            png_bytep sp = row + (size_t)row_width * 2 - 1;
+            png_bytep dp = sp  + (size_t)row_width * 2;
             for (i = 0; i < row_width; i++)
             {
                *(dp--) = *(sp--);
                *(dp--) = *sp;
                *(dp--) = *sp;
                *(dp--) = *(sp--);
             }
          }
 
          else
          {
             /* This changes GGAA to RRGGBBAA */
-            png_bytep sp = row + (png_size_t)row_width * 4 - 1;
-            png_bytep dp = sp  + (png_size_t)row_width * 4;
+            png_bytep sp = row + (size_t)row_width * 4 - 1;
+            png_bytep dp = sp  + (size_t)row_width * 4;
             for (i = 0; i < row_width; i++)
             {
                *(dp--) = *(sp--);
                *(dp--) = *(sp--);
                *(dp--) = *sp;
                *(dp--) = *(sp - 1);
                *(dp--) = *sp;
                *(dp--) = *(sp - 1);
@@ -2975,17 +2974,17 @@ png_do_gray_to_rgb(png_row_infop row_inf
  *  (including an sRGB chunk) then the chromaticities are used to calculate the
  *  coefficients.  See the chunk handling in pngrutil.c for more information.
  *
  *  In all cases the calculation is to be done in a linear colorspace.  If no
  *  gamma information is available to correct the encoding of the original RGB
  *  values this results in an implicit assumption that the original PNG RGB
  *  values were linear.
  *
- *  Other integer coefficents can be used via png_set_rgb_to_gray().  Because
+ *  Other integer coefficients can be used via png_set_rgb_to_gray().  Because
  *  the API takes just red and green coefficients the blue coefficient is
  *  calculated to make the sum 32768.  This will result in different rounding
  *  to that used above.
  */
 static int
 png_do_rgb_to_gray(png_structrp png_ptr, png_row_infop row_info, png_bytep row)
 
 {
@@ -3204,730 +3203,728 @@ png_do_compose(png_row_infop row_info, p
 
    png_bytep sp;
    png_uint_32 i;
    png_uint_32 row_width = row_info->width;
    int shift;
 
    png_debug(1, "in png_do_compose");
 
+   switch (row_info->color_type)
    {
-      switch (row_info->color_type)
+      case PNG_COLOR_TYPE_GRAY:
       {
-         case PNG_COLOR_TYPE_GRAY:
+         switch (row_info->bit_depth)
          {
-            switch (row_info->bit_depth)
+            case 1:
             {
-               case 1:
+               sp = row;
+               shift = 7;
+               for (i = 0; i < row_width; i++)
+               {
+                  if ((png_uint_16)((*sp >> shift) & 0x01)
+                     == png_ptr->trans_color.gray)
+                  {
+                     unsigned int tmp = *sp & (0x7f7f >> (7 - shift));
+                     tmp |=
+                         (unsigned int)(png_ptr->background.gray << shift);
+                     *sp = (png_byte)(tmp & 0xff);
+                  }
+
+                  if (shift == 0)
+                  {
+                     shift = 7;
+                     sp++;
+                  }
+
+                  else
+                     shift--;
+               }
+               break;
+            }
+
+            case 2:
+            {
+#ifdef PNG_READ_GAMMA_SUPPORTED
+               if (gamma_table != NULL)
                {
                   sp = row;
-                  shift = 7;
+                  shift = 6;
                   for (i = 0; i < row_width; i++)
                   {
-                     if ((png_uint_16)((*sp >> shift) & 0x01)
-                        == png_ptr->trans_color.gray)
+                     if ((png_uint_16)((*sp >> shift) & 0x03)
+                         == png_ptr->trans_color.gray)
                      {
-                        unsigned int tmp = *sp & (0x7f7f >> (7 - shift));
+                        unsigned int tmp = *sp & (0x3f3f >> (6 - shift));
                         tmp |=
-                            (unsigned int)(png_ptr->background.gray << shift);
+                           (unsigned int)png_ptr->background.gray << shift;
+                        *sp = (png_byte)(tmp & 0xff);
+                     }
+
+                     else
+                     {
+                        unsigned int p = (*sp >> shift) & 0x03;
+                        unsigned int g = (gamma_table [p | (p << 2) |
+                            (p << 4) | (p << 6)] >> 6) & 0x03;
+                        unsigned int tmp = *sp & (0x3f3f >> (6 - shift));
+                        tmp |= (unsigned int)(g << shift);
                         *sp = (png_byte)(tmp & 0xff);
                      }
 
                      if (shift == 0)
                      {
-                        shift = 7;
+                        shift = 6;
                         sp++;
                      }
 
                      else
-                        shift--;
-                  }
-                  break;
-               }
-
-               case 2:
-               {
-#ifdef PNG_READ_GAMMA_SUPPORTED
-                  if (gamma_table != NULL)
-                  {
-                     sp = row;
-                     shift = 6;
-                     for (i = 0; i < row_width; i++)
-                     {
-                        if ((png_uint_16)((*sp >> shift) & 0x03)
-                            == png_ptr->trans_color.gray)
-                        {
-                           unsigned int tmp = *sp & (0x3f3f >> (6 - shift));
-                           tmp |=
-                              (unsigned int)png_ptr->background.gray << shift;
-                           *sp = (png_byte)(tmp & 0xff);
-                        }
-
-                        else
-                        {
-                           unsigned int p = (*sp >> shift) & 0x03;
-                           unsigned int g = (gamma_table [p | (p << 2) |
-                               (p << 4) | (p << 6)] >> 6) & 0x03;
-                           unsigned int tmp = *sp & (0x3f3f >> (6 - shift));
-                           tmp |= (unsigned int)(g << shift);
-                           *sp = (png_byte)(tmp & 0xff);
-                        }
-
-                        if (shift == 0)
-                        {
-                           shift = 6;
-                           sp++;
-                        }
-
-                        else
-                           shift -= 2;
-                     }
-                  }
-
-                  else
-#endif
-                  {
-                     sp = row;
-                     shift = 6;
-                     for (i = 0; i < row_width; i++)
-                     {
-                        if ((png_uint_16)((*sp >> shift) & 0x03)
-                            == png_ptr->trans_color.gray)
-                        {
-                           unsigned int tmp = *sp & (0x3f3f >> (6 - shift));
-                           tmp |=
-                               (unsigned int)png_ptr->background.gray << shift;
-                           *sp = (png_byte)(tmp & 0xff);
-                        }
-
-                        if (shift == 0)
-                        {
-                           shift = 6;
-                           sp++;
-                        }
-
-                        else
-                           shift -= 2;
-                     }
-                  }
-                  break;
-               }
-
-               case 4:
-               {
-#ifdef PNG_READ_GAMMA_SUPPORTED
-                  if (gamma_table != NULL)
-                  {
-                     sp = row;
-                     shift = 4;
-                     for (i = 0; i < row_width; i++)
-                     {
-                        if ((png_uint_16)((*sp >> shift) & 0x0f)
-                            == png_ptr->trans_color.gray)
-                        {
-                           unsigned int tmp = *sp & (0x0f0f >> (4 - shift));
-                           tmp |=
-                              (unsigned int)(png_ptr->background.gray << shift);
-                           *sp = (png_byte)(tmp & 0xff);
-                        }
-
-                        else
-                        {
-                           unsigned int p = (*sp >> shift) & 0x0f;
-                           unsigned int g = (gamma_table[p | (p << 4)] >> 4) &
-                              0x0f;
-                           unsigned int tmp = *sp & (0x0f0f >> (4 - shift));
-                           tmp |= (unsigned int)(g << shift);
-                           *sp = (png_byte)(tmp & 0xff);
-                        }
-
-                        if (shift == 0)
-                        {
-                           shift = 4;
-                           sp++;
-                        }
-
-                        else
-                           shift -= 4;
-                     }
-                  }
-
-                  else
-#endif
-                  {
-                     sp = row;
-                     shift = 4;
-                     for (i = 0; i < row_width; i++)
-                     {
-                        if ((png_uint_16)((*sp >> shift) & 0x0f)
-                            == png_ptr->trans_color.gray)
-                        {
-                           unsigned int tmp = *sp & (0x0f0f >> (4 - shift));
-                           tmp |=
-                              (unsigned int)(png_ptr->background.gray << shift);
-                           *sp = (png_byte)(tmp & 0xff);
-                        }
-
-                        if (shift == 0)
-                        {
-                           shift = 4;
-                           sp++;
-                        }
-
-                        else
-                           shift -= 4;
-                     }
-                  }
-                  break;
-               }
-
-               case 8:
-               {
-#ifdef PNG_READ_GAMMA_SUPPORTED
-                  if (gamma_table != NULL)
-                  {
-                     sp = row;
-                     for (i = 0; i < row_width; i++, sp++)
-                     {
-                        if (*sp == png_ptr->trans_color.gray)
-                           *sp = (png_byte)png_ptr->background.gray;
-
-                        else
-                           *sp = gamma_table[*sp];
-                     }
-                  }
-                  else
-#endif
-                  {
-                     sp = row;
-                     for (i = 0; i < row_width; i++, sp++)
-                     {
-                        if (*sp == png_ptr->trans_color.gray)
-                           *sp = (png_byte)png_ptr->background.gray;
-                     }
-                  }
-                  break;
-               }
-
-               case 16:
-               {
-#ifdef PNG_READ_GAMMA_SUPPORTED
-                  if (gamma_16 != NULL)
-                  {
-                     sp = row;
-                     for (i = 0; i < row_width; i++, sp += 2)
-                     {
-                        png_uint_16 v;
-
-                        v = (png_uint_16)(((*sp) << 8) + *(sp + 1));
-
-                        if (v == png_ptr->trans_color.gray)
-                        {
-                           /* Background is already in screen gamma */
-                           *sp = (png_byte)((png_ptr->background.gray >> 8)
-                                & 0xff);
-                           *(sp + 1) = (png_byte)(png_ptr->background.gray
-                                & 0xff);
-                        }
-
-                        else
-                        {
-                           v = gamma_16[*(sp + 1) >> gamma_shift][*sp];
-                           *sp = (png_byte)((v >> 8) & 0xff);
-                           *(sp + 1) = (png_byte)(v & 0xff);
-                        }
-                     }
-                  }
-                  else
-#endif
-                  {
-                     sp = row;
-                     for (i = 0; i < row_width; i++, sp += 2)
-                     {
-                        png_uint_16 v;
-
-                        v = (png_uint_16)(((*sp) << 8) + *(sp + 1));
-
-                        if (v == png_ptr->trans_color.gray)
-                        {
-                           *sp = (png_byte)((png_ptr->background.gray >> 8)
-                                & 0xff);
-                           *(sp + 1) = (png_byte)(png_ptr->background.gray
-                                & 0xff);
-                        }
-                     }
-                  }
-                  break;
-               }
-
-               default:
-                  break;
-            }
-            break;
-         }
-
-         case PNG_COLOR_TYPE_RGB:
-         {
-            if (row_info->bit_depth == 8)
-            {
-#ifdef PNG_READ_GAMMA_SUPPORTED
-               if (gamma_table != NULL)
-               {
-                  sp = row;
-                  for (i = 0; i < row_width; i++, sp += 3)
-                  {
-                     if (*sp == png_ptr->trans_color.red &&
-                         *(sp + 1) == png_ptr->trans_color.green &&
-                         *(sp + 2) == png_ptr->trans_color.blue)
-                     {
-                        *sp = (png_byte)png_ptr->background.red;
-                        *(sp + 1) = (png_byte)png_ptr->background.green;
-                        *(sp + 2) = (png_byte)png_ptr->background.blue;
-                     }
-
-                     else
-                     {
-                        *sp = gamma_table[*sp];
-                        *(sp + 1) = gamma_table[*(sp + 1)];
-                        *(sp + 2) = gamma_table[*(sp + 2)];
-                     }
-                  }
-               }
-               else
-#endif
-               {
-                  sp = row;
-                  for (i = 0; i < row_width; i++, sp += 3)
-                  {
-                     if (*sp == png_ptr->trans_color.red &&
-                         *(sp + 1) == png_ptr->trans_color.green &&
-                         *(sp + 2) == png_ptr->trans_color.blue)
-                     {
-                        *sp = (png_byte)png_ptr->background.red;
-                        *(sp + 1) = (png_byte)png_ptr->background.green;
-                        *(sp + 2) = (png_byte)png_ptr->background.blue;
-                     }
-                  }
-               }
-            }
-            else /* if (row_info->bit_depth == 16) */
-            {
-#ifdef PNG_READ_GAMMA_SUPPORTED
-               if (gamma_16 != NULL)
-               {
-                  sp = row;
-                  for (i = 0; i < row_width; i++, sp += 6)
-                  {
-                     png_uint_16 r = (png_uint_16)(((*sp) << 8) + *(sp + 1));
-
-                     png_uint_16 g = (png_uint_16)(((*(sp + 2)) << 8)
-                         + *(sp + 3));
-
-                     png_uint_16 b = (png_uint_16)(((*(sp + 4)) << 8)
-                         + *(sp + 5));
-
-                     if (r == png_ptr->trans_color.red &&
-                         g == png_ptr->trans_color.green &&
-                         b == png_ptr->trans_color.blue)
-                     {
-                        /* Background is already in screen gamma */
-                        *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff);
-                        *(sp + 2) = (png_byte)((png_ptr->background.green >> 8)
-                                & 0xff);
-                        *(sp + 3) = (png_byte)(png_ptr->background.green
-                                & 0xff);
-                        *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8)
-                                & 0xff);
-                        *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff);
-                     }
-
-                     else
-                     {
-                        png_uint_16 v = gamma_16[*(sp + 1) >> gamma_shift][*sp];
-                        *sp = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(v & 0xff);
-
-                        v = gamma_16[*(sp + 3) >> gamma_shift][*(sp + 2)];
-                        *(sp + 2) = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 3) = (png_byte)(v & 0xff);
-
-                        v = gamma_16[*(sp + 5) >> gamma_shift][*(sp + 4)];
-                        *(sp + 4) = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 5) = (png_byte)(v & 0xff);
-                     }
+                        shift -= 2;
                   }
                }
 
                else
 #endif
                {
                   sp = row;
-                  for (i = 0; i < row_width; i++, sp += 6)
+                  shift = 6;
+                  for (i = 0; i < row_width; i++)
                   {
-                     png_uint_16 r = (png_uint_16)(((*sp) << 8) + *(sp + 1));
-
-                     png_uint_16 g = (png_uint_16)(((*(sp + 2)) << 8)
-                         + *(sp + 3));
-
-                     png_uint_16 b = (png_uint_16)(((*(sp + 4)) << 8)
-                         + *(sp + 5));
-
-                     if (r == png_ptr->trans_color.red &&
-                         g == png_ptr->trans_color.green &&
-                         b == png_ptr->trans_color.blue)
+                     if ((png_uint_16)((*sp >> shift) & 0x03)
+                         == png_ptr->trans_color.gray)
+                     {
+                        unsigned int tmp = *sp & (0x3f3f >> (6 - shift));
+                        tmp |=
+                            (unsigned int)png_ptr->background.gray << shift;
+                        *sp = (png_byte)(tmp & 0xff);
+                     }
+
+                     if (shift == 0)
                      {
-                        *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff);
-                        *(sp + 2) = (png_byte)((png_ptr->background.green >> 8)
-                                & 0xff);
-                        *(sp + 3) = (png_byte)(png_ptr->background.green
-                                & 0xff);
-                        *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8)
-                                & 0xff);
-                        *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff);
+                        shift = 6;
+                        sp++;
                      }
+
+                     else
+                        shift -= 2;
+                  }
+               }
+               break;
+            }
+
+            case 4:
+            {
+#ifdef PNG_READ_GAMMA_SUPPORTED
+               if (gamma_table != NULL)
+               {
+                  sp = row;
+                  shift = 4;
+                  for (i = 0; i < row_width; i++)
+                  {
+                     if ((png_uint_16)((*sp >> shift) & 0x0f)
+                         == png_ptr->trans_color.gray)
+                     {
+                        unsigned int tmp = *sp & (0x0f0f >> (4 - shift));
+                        tmp |=
+                           (unsigned int)(png_ptr->background.gray << shift);
+                        *sp = (png_byte)(tmp & 0xff);
+                     }
+
+                     else
+                     {
+                        unsigned int p = (*sp >> shift) & 0x0f;
+                        unsigned int g = (gamma_table[p | (p << 4)] >> 4) &
+                           0x0f;
+                        unsigned int tmp = *sp & (0x0f0f >> (4 - shift));
+                        tmp |= (unsigned int)(g << shift);
+                        *sp = (png_byte)(tmp & 0xff);
+                     }
+
+                     if (shift == 0)
+                     {
+                        shift = 4;
+                        sp++;
+                     }
+
+                     else
+                        shift -= 4;
                   }
                }
+
+               else
+#endif
+               {
+                  sp = row;
+                  shift = 4;
+                  for (i = 0; i < row_width; i++)
+                  {
+                     if ((png_uint_16)((*sp >> shift) & 0x0f)
+                         == png_ptr->trans_color.gray)
+                     {
+                        unsigned int tmp = *sp & (0x0f0f >> (4 - shift));
+                        tmp |=
+                           (unsigned int)(png_ptr->background.gray << shift);
+                        *sp = (png_byte)(tmp & 0xff);
+                     }
+
+                     if (shift == 0)
+                     {
+                        shift = 4;
+                        sp++;
+                     }
+
+                     else
+                        shift -= 4;
+                  }
+               }
+               break;
             }
-            break;
-         }
-
-         case PNG_COLOR_TYPE_GRAY_ALPHA:
-         {
-            if (row_info->bit_depth == 8)
+
+            case 8:
             {
 #ifdef PNG_READ_GAMMA_SUPPORTED
-               if (gamma_to_1 != NULL && gamma_from_1 != NULL &&
-                   gamma_table != NULL)
+               if (gamma_table != NULL)
+               {
+                  sp = row;
+                  for (i = 0; i < row_width; i++, sp++)
+                  {
+                     if (*sp == png_ptr->trans_color.gray)
+                        *sp = (png_byte)png_ptr->background.gray;
+
+                     else
+                        *sp = gamma_table[*sp];
+                  }
+               }
+               else
+#endif
+               {
+                  sp = row;
+                  for (i = 0; i < row_width; i++, sp++)
+                  {
+                     if (*sp == png_ptr->trans_color.gray)
+                        *sp = (png_byte)png_ptr->background.gray;
+                  }
+               }
+               break;
+            }
+
+            case 16:
+            {
+#ifdef PNG_READ_GAMMA_SUPPORTED
+               if (gamma_16 != NULL)
                {
                   sp = row;
                   for (i = 0; i < row_width; i++, sp += 2)
                   {
-                     png_uint_16 a = *(sp + 1);
-
-                     if (a == 0xff)
-                        *sp = gamma_table[*sp];
-
-                     else if (a == 0)
+                     png_uint_16 v;
+
+                     v = (png_uint_16)(((*sp) << 8) + *(sp + 1));
+
+                     if (v == png_ptr->trans_color.gray)
                      {
                         /* Background is already in screen gamma */
-                        *sp = (png_byte)png_ptr->background.gray;
+                        *sp = (png_byte)((png_ptr->background.gray >> 8)
+                             & 0xff);
+                        *(sp + 1) = (png_byte)(png_ptr->background.gray
+                             & 0xff);
                      }
 
                      else
                      {
-                        png_byte v, w;
-
-                        v = gamma_to_1[*sp];
-                        png_composite(w, v, a, png_ptr->background_1.gray);
-                        if (optimize == 0)
-                           w = gamma_from_1[w];
-                        *sp = w;
+                        v = gamma_16[*(sp + 1) >> gamma_shift][*sp];
+                        *sp = (png_byte)((v >> 8) & 0xff);
+                        *(sp + 1) = (png_byte)(v & 0xff);
                      }
                   }
                }
                else
 #endif
                {
                   sp = row;
                   for (i = 0; i < row_width; i++, sp += 2)
                   {
-                     png_byte a = *(sp + 1);
-
-                     if (a == 0)
-                        *sp = (png_byte)png_ptr->background.gray;
-
-                     else if (a < 0xff)
-                        png_composite(*sp, *sp, a, png_ptr->background.gray);
-                  }
-               }
-            }
-            else /* if (png_ptr->bit_depth == 16) */
-            {
-#ifdef PNG_READ_GAMMA_SUPPORTED
-               if (gamma_16 != NULL && gamma_16_from_1 != NULL &&
-                   gamma_16_to_1 != NULL)
-               {
-                  sp = row;
-                  for (i = 0; i < row_width; i++, sp += 4)
-                  {
-                     png_uint_16 a = (png_uint_16)(((*(sp + 2)) << 8)
-                         + *(sp + 3));
-
-                     if (a == (png_uint_16)0xffff)
-                     {
-                        png_uint_16 v;
-
-                        v = gamma_16[*(sp + 1) >> gamma_shift][*sp];
-                        *sp = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(v & 0xff);
-                     }
-
-                     else if (a == 0)
-                     {
-                        /* Background is already in screen gamma */
-                        *sp = (png_byte)((png_ptr->background.gray >> 8)
-                                & 0xff);
-                        *(sp + 1) = (png_byte)(png_ptr->background.gray & 0xff);
-                     }
-
-                     else
-                     {
-                        png_uint_16 g, v, w;
-
-                        g = gamma_16_to_1[*(sp + 1) >> gamma_shift][*sp];
-                        png_composite_16(v, g, a, png_ptr->background_1.gray);
-                        if (optimize != 0)
-                           w = v;
-                        else
-                           w = gamma_16_from_1[(v & 0xff) >>
-                               gamma_shift][v >> 8];
-                        *sp = (png_byte)((w >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(w & 0xff);
-                     }
-                  }
-               }
-               else
-#endif
-               {
-                  sp = row;
-                  for (i = 0; i < row_width; i++, sp += 4)
-                  {
-                     png_uint_16 a = (png_uint_16)(((*(sp + 2)) << 8)
-                         + *(sp + 3));
-
-                     if (a == 0)
+                     png_uint_16 v;
+
+                     v = (png_uint_16)(((*sp) << 8) + *(sp + 1));
+
+                     if (v == png_ptr->trans_color.gray)
                      {
                         *sp = (png_byte)((png_ptr->background.gray >> 8)
-                                & 0xff);
-                        *(sp + 1) = (png_byte)(png_ptr->background.gray & 0xff);
-                     }
-
-                     else if (a < 0xffff)
-                     {
-                        png_uint_16 g, v;
-
-                        g = (png_uint_16)(((*sp) << 8) + *(sp + 1));
-                        png_composite_16(v, g, a, png_ptr->background.gray);
-                        *sp = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(v & 0xff);
-                     }
-                  }
-               }
-            }
-            break;
-         }
-
-         case PNG_COLOR_TYPE_RGB_ALPHA:
-         {
-            if (row_info->bit_depth == 8)
-            {
-#ifdef PNG_READ_GAMMA_SUPPORTED
-               if (gamma_to_1 != NULL && gamma_from_1 != NULL &&
-                   gamma_table != NULL)
-               {
-                  sp = row;
-                  for (i = 0; i < row_width; i++, sp += 4)
-                  {
-                     png_byte a = *(sp + 3);
-
-                     if (a == 0xff)
-                     {
-                        *sp = gamma_table[*sp];
-                        *(sp + 1) = gamma_table[*(sp + 1)];
-                        *(sp + 2) = gamma_table[*(sp + 2)];
-                     }
-
-                     else if (a == 0)
-                     {
-                        /* Background is already in screen gamma */
-                        *sp = (png_byte)png_ptr->background.red;
-                        *(sp + 1) = (png_byte)png_ptr->background.green;
-                        *(sp + 2) = (png_byte)png_ptr->background.blue;
-                     }
-
-                     else
-                     {
-                        png_byte v, w;
-
-                        v = gamma_to_1[*sp];
-                        png_composite(w, v, a, png_ptr->background_1.red);
-                        if (optimize == 0) w = gamma_from_1[w];
-                        *sp = w;
-
-                        v = gamma_to_1[*(sp + 1)];
-                        png_composite(w, v, a, png_ptr->background_1.green);
-                        if (optimize == 0) w = gamma_from_1[w];
-                        *(sp + 1) = w;
-
-                        v = gamma_to_1[*(sp + 2)];
-                        png_composite(w, v, a, png_ptr->background_1.blue);
-                        if (optimize == 0) w = gamma_from_1[w];
-                        *(sp + 2) = w;
+                             & 0xff);
+                        *(sp + 1) = (png_byte)(png_ptr->background.gray
+                             & 0xff);
                      }
                   }
                }
-               else
+               break;
+            }
+
+            default:
+               break;
+         }
+         break;
+      }
+
+      case PNG_COLOR_TYPE_RGB:
+      {
+         if (row_info->bit_depth == 8)
+         {
+#ifdef PNG_READ_GAMMA_SUPPORTED
+            if (gamma_table != NULL)
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 3)
+               {
+                  if (*sp == png_ptr->trans_color.red &&
+                      *(sp + 1) == png_ptr->trans_color.green &&
+                      *(sp + 2) == png_ptr->trans_color.blue)
+                  {
+                     *sp = (png_byte)png_ptr->background.red;
+                     *(sp + 1) = (png_byte)png_ptr->background.green;
+                     *(sp + 2) = (png_byte)png_ptr->background.blue;
+                  }
+
+                  else
+                  {
+                     *sp = gamma_table[*sp];
+                     *(sp + 1) = gamma_table[*(sp + 1)];
+                     *(sp + 2) = gamma_table[*(sp + 2)];
+                  }
+               }
+            }
+            else
 #endif
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 3)
                {
-                  sp = row;
-                  for (i = 0; i < row_width; i++, sp += 4)
+                  if (*sp == png_ptr->trans_color.red &&
+                      *(sp + 1) == png_ptr->trans_color.green &&
+                      *(sp + 2) == png_ptr->trans_color.blue)
+                  {
+                     *sp = (png_byte)png_ptr->background.red;
+                     *(sp + 1) = (png_byte)png_ptr->background.green;
+                     *(sp + 2) = (png_byte)png_ptr->background.blue;
+                  }
+               }
+            }
+         }
+         else /* if (row_info->bit_depth == 16) */
+         {
+#ifdef PNG_READ_GAMMA_SUPPORTED
+            if (gamma_16 != NULL)
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 6)
+               {
+                  png_uint_16 r = (png_uint_16)(((*sp) << 8) + *(sp + 1));
+
+                  png_uint_16 g = (png_uint_16)(((*(sp + 2)) << 8)
+                      + *(sp + 3));
+
+                  png_uint_16 b = (png_uint_16)(((*(sp + 4)) << 8)
+                      + *(sp + 5));
+
+                  if (r == png_ptr->trans_color.red &&
+                      g == png_ptr->trans_color.green &&
+                      b == png_ptr->trans_color.blue)
+                  {
+                     /* Background is already in screen gamma */
+                     *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff);
+                     *(sp + 2) = (png_byte)((png_ptr->background.green >> 8)
+                             & 0xff);
+                     *(sp + 3) = (png_byte)(png_ptr->background.green
+                             & 0xff);
+                     *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8)
+                             & 0xff);
+                     *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff);
+                  }
+
+                  else
                   {
-                     png_byte a = *(sp + 3);
-
-                     if (a == 0)
-                     {
-                        *sp = (png_byte)png_ptr->background.red;
-                        *(sp + 1) = (png_byte)png_ptr->background.green;
-                        *(sp + 2) = (png_byte)png_ptr->background.blue;
-                     }
-
-                     else if (a < 0xff)
-                     {
-                        png_composite(*sp, *sp, a, png_ptr->background.red);
-
-                        png_composite(*(sp + 1), *(sp + 1), a,
-                            png_ptr->background.green);
-
-                        png_composite(*(sp + 2), *(sp + 2), a,
-                            png_ptr->background.blue);
-                     }
+                     png_uint_16 v = gamma_16[*(sp + 1) >> gamma_shift][*sp];
+                     *sp = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(v & 0xff);
+
+                     v = gamma_16[*(sp + 3) >> gamma_shift][*(sp + 2)];
+                     *(sp + 2) = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 3) = (png_byte)(v & 0xff);
+
+                     v = gamma_16[*(sp + 5) >> gamma_shift][*(sp + 4)];
+                     *(sp + 4) = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 5) = (png_byte)(v & 0xff);
+                  }
+               }
+            }
+
+            else
+#endif
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 6)
+               {
+                  png_uint_16 r = (png_uint_16)(((*sp) << 8) + *(sp + 1));
+
+                  png_uint_16 g = (png_uint_16)(((*(sp + 2)) << 8)
+                      + *(sp + 3));
+
+                  png_uint_16 b = (png_uint_16)(((*(sp + 4)) << 8)
+                      + *(sp + 5));
+
+                  if (r == png_ptr->trans_color.red &&
+                      g == png_ptr->trans_color.green &&
+                      b == png_ptr->trans_color.blue)
+                  {
+                     *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff);
+                     *(sp + 2) = (png_byte)((png_ptr->background.green >> 8)
+                             & 0xff);
+                     *(sp + 3) = (png_byte)(png_ptr->background.green
+                             & 0xff);
+                     *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8)
+                             & 0xff);
+                     *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff);
+                  }
+               }
+            }
+         }
+         break;
+      }
+
+      case PNG_COLOR_TYPE_GRAY_ALPHA:
+      {
+         if (row_info->bit_depth == 8)
+         {
+#ifdef PNG_READ_GAMMA_SUPPORTED
+            if (gamma_to_1 != NULL && gamma_from_1 != NULL &&
+                gamma_table != NULL)
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 2)
+               {
+                  png_uint_16 a = *(sp + 1);
+
+                  if (a == 0xff)
+                     *sp = gamma_table[*sp];
+
+                  else if (a == 0)
+                  {
+                     /* Background is already in screen gamma */
+                     *sp = (png_byte)png_ptr->background.gray;
+                  }
+
+                  else
+                  {
+                     png_byte v, w;
+
+                     v = gamma_to_1[*sp];
+                     png_composite(w, v, a, png_ptr->background_1.gray);
+                     if (optimize == 0)
+                        w = gamma_from_1[w];
+                     *sp = w;
+                  }
+               }
+            }
+            else
+#endif
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 2)
+               {
+                  png_byte a = *(sp + 1);
+
+                  if (a == 0)
+                     *sp = (png_byte)png_ptr->background.gray;
+
+                  else if (a < 0xff)
+                     png_composite(*sp, *sp, a, png_ptr->background.gray);
+               }
+            }
+         }
+         else /* if (png_ptr->bit_depth == 16) */
+         {
+#ifdef PNG_READ_GAMMA_SUPPORTED
+            if (gamma_16 != NULL && gamma_16_from_1 != NULL &&
+                gamma_16_to_1 != NULL)
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 4)
+               {
+                  png_uint_16 a = (png_uint_16)(((*(sp + 2)) << 8)
+                      + *(sp + 3));
+
+                  if (a == (png_uint_16)0xffff)
+                  {
+                     png_uint_16 v;
+
+                     v = gamma_16[*(sp + 1) >> gamma_shift][*sp];
+                     *sp = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(v & 0xff);
+                  }
+
+                  else if (a == 0)
+                  {
+                     /* Background is already in screen gamma */
+                     *sp = (png_byte)((png_ptr->background.gray >> 8)
+                             & 0xff);
+                     *(sp + 1) = (png_byte)(png_ptr->background.gray & 0xff);
+                  }
+
+                  else
+                  {
+                     png_uint_16 g, v, w;
+
+                     g = gamma_16_to_1[*(sp + 1) >> gamma_shift][*sp];
+                     png_composite_16(v, g, a, png_ptr->background_1.gray);
+                     if (optimize != 0)
+                        w = v;
+                     else
+                        w = gamma_16_from_1[(v & 0xff) >>
+                            gamma_shift][v >> 8];
+                     *sp = (png_byte)((w >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(w & 0xff);
                   }
                }
             }
-            else /* if (row_info->bit_depth == 16) */
+            else
+#endif
             {
-#ifdef PNG_READ_GAMMA_SUPPORTED
-               if (gamma_16 != NULL && gamma_16_from_1 != NULL &&
-                   gamma_16_to_1 != NULL)
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 4)
                {
-                  sp = row;
-                  for (i = 0; i < row_width; i++, sp += 8)
+                  png_uint_16 a = (png_uint_16)(((*(sp + 2)) << 8)
+                      + *(sp + 3));
+
+                  if (a == 0)
                   {
-                     png_uint_16 a = (png_uint_16)(((png_uint_16)(*(sp + 6))
-                         << 8) + (png_uint_16)(*(sp + 7)));
-
-                     if (a == (png_uint_16)0xffff)
-                     {
-                        png_uint_16 v;
-
-                        v = gamma_16[*(sp + 1) >> gamma_shift][*sp];
-                        *sp = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(v & 0xff);
-
-                        v = gamma_16[*(sp + 3) >> gamma_shift][*(sp + 2)];
-                        *(sp + 2) = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 3) = (png_byte)(v & 0xff);
-
-                        v = gamma_16[*(sp + 5) >> gamma_shift][*(sp + 4)];
-                        *(sp + 4) = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 5) = (png_byte)(v & 0xff);
-                     }
-
-                     else if (a == 0)
-                     {
-                        /* Background is already in screen gamma */
-                        *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff);
-                        *(sp + 2) = (png_byte)((png_ptr->background.green >> 8)
-                                & 0xff);
-                        *(sp + 3) = (png_byte)(png_ptr->background.green
-                                & 0xff);
-                        *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8)
-                                & 0xff);
-                        *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff);
-                     }
-
-                     else
-                     {
-                        png_uint_16 v, w;
-
-                        v = gamma_16_to_1[*(sp + 1) >> gamma_shift][*sp];
-                        png_composite_16(w, v, a, png_ptr->background_1.red);
-                        if (optimize == 0)
-                           w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >>
-                                8];
-                        *sp = (png_byte)((w >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(w & 0xff);
-
-                        v = gamma_16_to_1[*(sp + 3) >> gamma_shift][*(sp + 2)];
-                        png_composite_16(w, v, a, png_ptr->background_1.green);
-                        if (optimize == 0)
-                           w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >>
-                                8];
-
-                        *(sp + 2) = (png_byte)((w >> 8) & 0xff);
-                        *(sp + 3) = (png_byte)(w & 0xff);
-
-                        v = gamma_16_to_1[*(sp + 5) >> gamma_shift][*(sp + 4)];
-                        png_composite_16(w, v, a, png_ptr->background_1.blue);
-                        if (optimize == 0)
-                           w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >>
-                                8];
-
-                        *(sp + 4) = (png_byte)((w >> 8) & 0xff);
-                        *(sp + 5) = (png_byte)(w & 0xff);
-                     }
+                     *sp = (png_byte)((png_ptr->background.gray >> 8)
+                             & 0xff);
+                     *(sp + 1) = (png_byte)(png_ptr->background.gray & 0xff);
+                  }
+
+                  else if (a < 0xffff)
+                  {
+                     png_uint_16 g, v;
+
+                     g = (png_uint_16)(((*sp) << 8) + *(sp + 1));
+                     png_composite_16(v, g, a, png_ptr->background.gray);
+                     *sp = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(v & 0xff);
                   }
                }
-
-               else
-#endif
+            }
+         }
+         break;
+      }
+
+      case PNG_COLOR_TYPE_RGB_ALPHA:
+      {
+         if (row_info->bit_depth == 8)
+         {
+#ifdef PNG_READ_GAMMA_SUPPORTED
+            if (gamma_to_1 != NULL && gamma_from_1 != NULL &&
+                gamma_table != NULL)
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 4)
                {
-                  sp = row;
-                  for (i = 0; i < row_width; i++, sp += 8)
+                  png_byte a = *(sp + 3);
+
+                  if (a == 0xff)
+                  {
+                     *sp = gamma_table[*sp];
+                     *(sp + 1) = gamma_table[*(sp + 1)];
+                     *(sp + 2) = gamma_table[*(sp + 2)];
+                  }
+
+                  else if (a == 0)
+                  {
+                     /* Background is already in screen gamma */
+                     *sp = (png_byte)png_ptr->background.red;
+                     *(sp + 1) = (png_byte)png_ptr->background.green;
+                     *(sp + 2) = (png_byte)png_ptr->background.blue;
+                  }
+
+                  else
                   {
-                     png_uint_16 a = (png_uint_16)(((png_uint_16)(*(sp + 6))
-                         << 8) + (png_uint_16)(*(sp + 7)));
-
-                     if (a == 0)
-                     {
-                        *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff);
-                        *(sp + 2) = (png_byte)((png_ptr->background.green >> 8)
-                                & 0xff);
-                        *(sp + 3) = (png_byte)(png_ptr->background.green
-                                & 0xff);
-                        *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8)
-                                & 0xff);
-                        *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff);
-                     }
-
-                     else if (a < 0xffff)
-                     {
-                        png_uint_16 v;
-
-                        png_uint_16 r = (png_uint_16)(((*sp) << 8) + *(sp + 1));
-                        png_uint_16 g = (png_uint_16)(((*(sp + 2)) << 8)
-                            + *(sp + 3));
-                        png_uint_16 b = (png_uint_16)(((*(sp + 4)) << 8)
-                            + *(sp + 5));
-
-                        png_composite_16(v, r, a, png_ptr->background.red);
-                        *sp = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 1) = (png_byte)(v & 0xff);
-
-                        png_composite_16(v, g, a, png_ptr->background.green);
-                        *(sp + 2) = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 3) = (png_byte)(v & 0xff);
-
-                        png_composite_16(v, b, a, png_ptr->background.blue);
-                        *(sp + 4) = (png_byte)((v >> 8) & 0xff);
-                        *(sp + 5) = (png_byte)(v & 0xff);
-                     }
+                     png_byte v, w;
+
+                     v = gamma_to_1[*sp];
+                     png_composite(w, v, a, png_ptr->background_1.red);
+                     if (optimize == 0) w = gamma_from_1[w];
+                     *sp = w;
+
+                     v = gamma_to_1[*(sp + 1)];
+                     png_composite(w, v, a, png_ptr->background_1.green);
+                     if (optimize == 0) w = gamma_from_1[w];
+                     *(sp + 1) = w;
+
+                     v = gamma_to_1[*(sp + 2)];
+                     png_composite(w, v, a, png_ptr->background_1.blue);
+                     if (optimize == 0) w = gamma_from_1[w];
+                     *(sp + 2) = w;
+                  }
+               }
+            }
+            else
+#endif
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 4)
+               {
+                  png_byte a = *(sp + 3);
+
+                  if (a == 0)
+                  {
+                     *sp = (png_byte)png_ptr->background.red;
+                     *(sp + 1) = (png_byte)png_ptr->background.green;
+                     *(sp + 2) = (png_byte)png_ptr->background.blue;
+                  }
+
+                  else if (a < 0xff)
+                  {
+                     png_composite(*sp, *sp, a, png_ptr->background.red);
+
+                     png_composite(*(sp + 1), *(sp + 1), a,
+                         png_ptr->background.green);
+
+                     png_composite(*(sp + 2), *(sp + 2), a,
+                         png_ptr->background.blue);
                   }
                }
             }
-            break;
          }
-
-         default:
-            break;
+         else /* if (row_info->bit_depth == 16) */
+         {
+#ifdef PNG_READ_GAMMA_SUPPORTED
+            if (gamma_16 != NULL && gamma_16_from_1 != NULL &&
+                gamma_16_to_1 != NULL)
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 8)
+               {
+                  png_uint_16 a = (png_uint_16)(((png_uint_16)(*(sp + 6))
+                      << 8) + (png_uint_16)(*(sp + 7)));
+
+                  if (a == (png_uint_16)0xffff)
+                  {
+                     png_uint_16 v;
+
+                     v = gamma_16[*(sp + 1) >> gamma_shift][*sp];
+                     *sp = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(v & 0xff);
+
+                     v = gamma_16[*(sp + 3) >> gamma_shift][*(sp + 2)];
+                     *(sp + 2) = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 3) = (png_byte)(v & 0xff);
+
+                     v = gamma_16[*(sp + 5) >> gamma_shift][*(sp + 4)];
+                     *(sp + 4) = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 5) = (png_byte)(v & 0xff);
+                  }
+
+                  else if (a == 0)
+                  {
+                     /* Background is already in screen gamma */
+                     *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff);
+                     *(sp + 2) = (png_byte)((png_ptr->background.green >> 8)
+                             & 0xff);
+                     *(sp + 3) = (png_byte)(png_ptr->background.green
+                             & 0xff);
+                     *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8)
+                             & 0xff);
+                     *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff);
+                  }
+
+                  else
+                  {
+                     png_uint_16 v, w;
+
+                     v = gamma_16_to_1[*(sp + 1) >> gamma_shift][*sp];
+                     png_composite_16(w, v, a, png_ptr->background_1.red);
+                     if (optimize == 0)
+                        w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >>
+                             8];
+                     *sp = (png_byte)((w >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(w & 0xff);
+
+                     v = gamma_16_to_1[*(sp + 3) >> gamma_shift][*(sp + 2)];
+                     png_composite_16(w, v, a, png_ptr->background_1.green);
+                     if (optimize == 0)
+                        w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >>
+                             8];
+
+                     *(sp + 2) = (png_byte)((w >> 8) & 0xff);
+                     *(sp + 3) = (png_byte)(w & 0xff);
+
+                     v = gamma_16_to_1[*(sp + 5) >> gamma_shift][*(sp + 4)];
+                     png_composite_16(w, v, a, png_ptr->background_1.blue);
+                     if (optimize == 0)
+                        w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >>
+                             8];
+
+                     *(sp + 4) = (png_byte)((w >> 8) & 0xff);
+                     *(sp + 5) = (png_byte)(w & 0xff);
+                  }
+               }
+            }
+
+            else
+#endif
+            {
+               sp = row;
+               for (i = 0; i < row_width; i++, sp += 8)
+               {
+                  png_uint_16 a = (png_uint_16)(((png_uint_16)(*(sp + 6))
+                      << 8) + (png_uint_16)(*(sp + 7)));
+
+                  if (a == 0)
+                  {
+                     *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff);
+                     *(sp + 2) = (png_byte)((png_ptr->background.green >> 8)
+                             & 0xff);
+                     *(sp + 3) = (png_byte)(png_ptr->background.green
+                             & 0xff);
+                     *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8)
+                             & 0xff);
+                     *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff);
+                  }
+
+                  else if (a < 0xffff)
+                  {
+                     png_uint_16 v;
+
+                     png_uint_16 r = (png_uint_16)(((*sp) << 8) + *(sp + 1));
+                     png_uint_16 g = (png_uint_16)(((*(sp + 2)) << 8)
+                         + *(sp + 3));
+                     png_uint_16 b = (png_uint_16)(((*(sp + 4)) << 8)
+                         + *(sp + 5));
+
+                     png_composite_16(v, r, a, png_ptr->background.red);
+                     *sp = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 1) = (png_byte)(v & 0xff);
+
+                     png_composite_16(v, g, a, png_ptr->background.green);
+                     *(sp + 2) = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 3) = (png_byte)(v & 0xff);
+
+                     png_composite_16(v, b, a, png_ptr->background.blue);
+                     *(sp + 4) = (png_byte)((v >> 8) & 0xff);
+                     *(sp + 5) = (png_byte)(v & 0xff);
+                  }
+               }
+            }
+         }
+         break;
       }
+
+      default:
+         break;
    }
 }
 #endif /* READ_BACKGROUND || READ_ALPHA_MODE */
 
 #ifdef PNG_READ_GAMMA_SUPPORTED
 /* Gamma correct the image, avoiding the alpha channel.  Make sure
  * you do this after you deal with the transparency issue on grayscale
  * or RGB images. If your bit depth is 8, use gamma_table, if it
@@ -4215,18 +4212,18 @@ png_do_expand_palette(png_row_infop row_
    if (row_info->color_type == PNG_COLOR_TYPE_PALETTE)
    {
       if (row_info->bit_depth < 8)
       {
          switch (row_info->bit_depth)
          {
             case 1:
             {
-               sp = row + (png_size_t)((row_width - 1) >> 3);
-               dp = row + (png_size_t)row_width - 1;
+               sp = row + (size_t)((row_width - 1) >> 3);
+               dp = row + (size_t)row_width - 1;
                shift = 7 - (int)((row_width + 7) & 0x07);
                for (i = 0; i < row_width; i++)
                {
                   if ((*sp >> shift) & 0x01)
                      *dp = 1;
 
                   else
                      *dp = 0;
@@ -4242,18 +4239,18 @@ png_do_expand_palette(png_row_infop row_
 
                   dp--;
                }
                break;
             }
 
             case 2:
             {
-               sp = row + (png_size_t)((row_width - 1) >> 2);
-               dp = row + (png_size_t)row_width - 1;
+               sp = row + (size_t)((row_width - 1) >> 2);
+               dp = row + (size_t)row_width - 1;
                shift = (int)((3 - ((row_width + 3) & 0x03)) << 1);
                for (i = 0; i < row_width; i++)
                {
                   value = (*sp >> shift) & 0x03;
                   *dp = (png_byte)value;
                   if (shift == 6)
                   {
                      shift = 0;
@@ -4265,18 +4262,18 @@ png_do_expand_palette(png_row_infop row_
 
                   dp--;
                }
                break;
             }
 
             case 4:
             {
-               sp = row + (png_size_t)((row_width - 1) >> 1);
-               dp = row + (png_size_t)row_width - 1;
+               sp = row + (size_t)((row_width - 1) >> 1);
+               dp = row + (size_t)row_width - 1;
                shift = (int)((row_width & 0x01) << 2);
                for (i = 0; i < row_width; i++)
                {
                   value = (*sp >> shift) & 0x0f;
                   *dp = (png_byte)value;
                   if (shift == 4)
                   {
                      shift = 0;
@@ -4299,18 +4296,18 @@ png_do_expand_palette(png_row_infop row_
          row_info->rowbytes = row_width;
       }
 
       if (row_info->bit_depth == 8)
       {
          {
             if (num_trans > 0)
             {
-               sp = row + (png_size_t)row_width - 1;
-               dp = row + ((png_size_t)row_width << 2) - 1;
+               sp = row + (size_t)row_width - 1;
+               dp = row + ((size_t)row_width << 2) - 1;
 
                for (i = 0; i < row_width; i++)
                {
                   if ((int)(*sp) >= num_trans)
                      *dp-- = 0xff;
 
                   else
                      *dp-- = trans_alpha[*sp];
@@ -4324,18 +4321,18 @@ png_do_expand_palette(png_row_infop row_
                row_info->pixel_depth = 32;
                row_info->rowbytes = row_width * 4;
                row_info->color_type = 6;
                row_info->channels = 4;
             }
 
             else
             {
-               sp = row + (png_size_t)row_width - 1;
-               dp = row + (png_size_t)(row_width * 3) - 1;
+               sp = row + (size_t)row_width - 1;
+               dp = row + (size_t)(row_width * 3) - 1;
 
                for (i = 0; i < row_width; i++)
                {
                   *dp-- = palette[*sp].blue;
                   *dp-- = palette[*sp].green;
                   *dp-- = palette[*sp].red;
                   sp--;
                }
@@ -4360,229 +4357,227 @@ png_do_expand(png_row_infop row_info, pn
 {
    int shift, value;
    png_bytep sp, dp;
    png_uint_32 i;
    png_uint_32 row_width=row_info->width;
 
    png_debug(1, "in png_do_expand");
 
+   if (row_info->color_type == PNG_COLOR_TYPE_GRAY)
    {
-      if (row_info->color_type == PNG_COLOR_TYPE_GRAY)
+      unsigned int gray = trans_color != NULL ? trans_color->gray : 0;
+
+      if (row_info->bit_depth < 8)
       {
-         unsigned int gray = trans_color != NULL ? trans_color->gray : 0;
-
-         if (row_info->bit_depth < 8)
+         switch (row_info->bit_depth)
          {
-            switch (row_info->bit_depth)
+            case 1:
             {
-               case 1:
-               {
-                  gray = (gray & 0x01) * 0xff;
-                  sp = row + (png_size_t)((row_width - 1) >> 3);
-                  dp = row + (png_size_t)row_width - 1;
-                  shift = 7 - (int)((row_width + 7) & 0x07);
-                  for (i = 0; i < row_width; i++)
-                  {
-                     if ((*sp >> shift) & 0x01)
-                        *dp = 0xff;
-
-                     else
-                        *dp = 0;
-
-                     if (shift == 7)
-                     {
-                        shift = 0;
-                        sp--;
-                     }
-
-                     else
-                        shift++;
-
-                     dp--;
-                  }
-                  break;
-               }
-
-               case 2:
-               {
-                  gray = (gray & 0x03) * 0x55;
-                  sp = row + (png_size_t)((row_width - 1) >> 2);
-                  dp = row + (png_size_t)row_width - 1;
-                  shift = (int)((3 - ((row_width + 3) & 0x03)) << 1);
-                  for (i = 0; i < row_width; i++)
-                  {
-                     value = (*sp >> shift) & 0x03;
-                     *dp = (png_byte)(value | (value << 2) | (value << 4) |
-                        (value << 6));
-                     if (shift == 6)
-                     {
-                        shift = 0;
-                        sp--;
-                     }
-
-                     else
-                        shift += 2;
-
-                     dp--;
-                  }
-                  break;
-               }
-
-               case 4:
-               {
-                  gray = (gray & 0x0f) * 0x11;
-                  sp = row + (png_size_t)((row_width - 1) >> 1);
-                  dp = row + (png_size_t)row_width - 1;
-                  shift = (int)((1 - ((row_width + 1) & 0x01)) << 2);
-                  for (i = 0; i < row_width; i++)
-                  {
-                     value = (*sp >> shift) & 0x0f;
-                     *dp = (png_byte)(value | (value << 4));
-                     if (shift == 4)
-                     {
-                        shift = 0;
-                        sp--;
-                     }
-
-                     else
-                        shift = 4;
-
-                     dp--;
-                  }
-                  break;
-               }
-
-               default:
-                  break;
-            }
-
-            row_info->bit_depth = 8;
-            row_info->pixel_depth = 8;
-            row_info->rowbytes = row_width;
-         }
-
-         if (trans_color != NULL)
-         {
-            if (row_info->bit_depth == 8)
-            {
-               gray = gray & 0xff;
-               sp = row + (png_size_t)row_width - 1;
-               dp = row + ((png_size_t)row_width << 1) - 1;
-
+               gray = (gray & 0x01) * 0xff;
+               sp = row + (size_t)((row_width - 1) >> 3);
+               dp = row + (size_t)row_width - 1;
+               shift = 7 - (int)((row_width + 7) & 0x07);
                for (i = 0; i < row_width; i++)
                {
-                  if ((*sp & 0xffU) == gray)
-                     *dp-- = 0;
+                  if ((*sp >> shift) & 0x01)
+                     *dp = 0xff;
 
                   else
-                     *dp-- = 0xff;
-
-                  *dp-- = *sp--;
-               }
-            }
-
-            else if (row_info->bit_depth == 16)
-            {
-               unsigned int gray_high = (gray >> 8) & 0xff;
-               unsigned int gray_low = gray & 0xff;
-               sp = row + row_info->rowbytes - 1;
-               dp = row + (row_info->rowbytes << 1) - 1;
-               for (i = 0; i < row_width; i++)
-               {
-                  if ((*(sp - 1) & 0xffU) == gray_high &&
-                      (*(sp) & 0xffU) == gray_low)
+                     *dp = 0;
+
+                  if (shift == 7)
                   {
-                     *dp-- = 0;
-                     *dp-- = 0;
+                     shift = 0;
+                     sp--;
                   }
 
                   else
+                     shift++;
+
+                  dp--;
+               }
+               break;
+            }
+
+            case 2:
+            {
+               gray = (gray & 0x03) * 0x55;
+               sp = row + (size_t)((row_width - 1) >> 2);
+               dp = row + (size_t)row_width - 1;
+               shift = (int)((3 - ((row_width + 3) & 0x03)) << 1);
+               for (i = 0; i < row_width; i++)
+               {
+                  value = (*sp >> shift) & 0x03;
+                  *dp = (png_byte)(value | (value << 2) | (value << 4) |
+                     (value << 6));
+                  if (shift == 6)
                   {
-                     *dp-- = 0xff;
-                     *dp-- = 0xff;
+                     shift = 0;
+                     sp--;
                   }
 
-                  *dp-- = *sp--;
-                  *dp-- = *sp--;
+                  else
+                     shift += 2;
+
+                  dp--;
                }
+               break;
             }
 
-            row_info->color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
-            row_info->channels = 2;
-            row_info->pixel_depth = (png_byte)(row_info->bit_depth << 1);
-            row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
-                row_width);
+            case 4:
+            {
+               gray = (gray & 0x0f) * 0x11;
+               sp = row + (size_t)((row_width - 1) >> 1);
+               dp = row + (size_t)row_width - 1;
+               shift = (int)((1 - ((row_width + 1) & 0x01)) << 2);
+               for (i = 0; i < row_width; i++)
+               {
+                  value = (*sp >> shift) & 0x0f;
+                  *dp = (png_byte)(value | (value << 4));
+                  if (shift == 4)
+                  {
+                     shift = 0;
+                     sp--;
+                  }
+
+                  else
+                     shift = 4;
+
+                  dp--;
+               }
+               break;
+            }
+
+            default:
+               break;
          }
+
+         row_info->bit_depth = 8;
+         row_info->pixel_depth = 8;
+         row_info->rowbytes = row_width;
       }
-      else if (row_info->color_type == PNG_COLOR_TYPE_RGB &&
-          trans_color != NULL)
+
+      if (trans_color != NULL)
       {
          if (row_info->bit_depth == 8)
          {
-            png_byte red = (png_byte)(trans_color->red & 0xff);
-            png_byte green = (png_byte)(trans_color->green & 0xff);
-            png_byte blue = (png_byte)(trans_color->blue & 0xff);
-            sp = row + (png_size_t)row_info->rowbytes - 1;
-            dp = row + ((png_size_t)row_width << 2) - 1;
+            gray = gray & 0xff;
+            sp = row + (size_t)row_width - 1;
+            dp = row + ((size_t)row_width << 1) - 1;
+
             for (i = 0; i < row_width; i++)
             {
-               if (*(sp - 2) == red && *(sp - 1) == green && *(sp) == blue)
+               if ((*sp & 0xffU) == gray)
                   *dp-- = 0;
 
                else
                   *dp-- = 0xff;
 
                *dp-- = *sp--;
-               *dp-- = *sp--;
-               *dp-- = *sp--;
             }
          }
+
          else if (row_info->bit_depth == 16)
          {
-            png_byte red_high = (png_byte)((trans_color->red >> 8) & 0xff);
-            png_byte green_high = (png_byte)((trans_color->green >> 8) & 0xff);
-            png_byte blue_high = (png_byte)((trans_color->blue >> 8) & 0xff);
-            png_byte red_low = (png_byte)(trans_color->red & 0xff);
-            png_byte green_low = (png_byte)(trans_color->green & 0xff);
-            png_byte blue_low = (png_byte)(trans_color->blue & 0xff);
+            unsigned int gray_high = (gray >> 8) & 0xff;
+            unsigned int gray_low = gray & 0xff;
             sp = row + row_info->rowbytes - 1;
-            dp = row + ((png_size_t)row_width << 3) - 1;
+            dp = row + (row_info->rowbytes << 1) - 1;
             for (i = 0; i < row_width; i++)
             {
-               if (*(sp - 5) == red_high &&
-                   *(sp - 4) == red_low &&
-                   *(sp - 3) == green_high &&
-                   *(sp - 2) == green_low &&
-                   *(sp - 1) == blue_high &&
-                   *(sp    ) == blue_low)
+               if ((*(sp - 1) & 0xffU) == gray_high &&
+                   (*(sp) & 0xffU) == gray_low)
                {
                   *dp-- = 0;
                   *dp-- = 0;
                }
 
                else
                {
                   *dp-- = 0xff;
                   *dp-- = 0xff;
                }
 
                *dp-- = *sp--;
                *dp-- = *sp--;
-               *dp-- = *sp--;
-               *dp-- = *sp--;
-               *dp-- = *sp--;
-               *dp-- = *sp--;
             }
          }
-         row_info->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
-         row_info->channels = 4;
-         row_info->pixel_depth = (png_byte)(row_info->bit_depth << 2);
-         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
+
+         row_info->color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
+         row_info->channels = 2;
+         row_info->pixel_depth = (png_byte)(row_info->bit_depth << 1);
+         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
+             row_width);
+      }
+   }
+   else if (row_info->color_type == PNG_COLOR_TYPE_RGB &&
+       trans_color != NULL)
+   {
+      if (row_info->bit_depth == 8)
+      {
+         png_byte red = (png_byte)(trans_color->red & 0xff);
+         png_byte green = (png_byte)(trans_color->green & 0xff);
+         png_byte blue = (png_byte)(trans_color->blue & 0xff);
+         sp = row + (size_t)row_info->rowbytes - 1;
+         dp = row + ((size_t)row_width << 2) - 1;
+         for (i = 0; i < row_width; i++)
+         {
+            if (*(sp - 2) == red && *(sp - 1) == green && *(sp) == blue)
+               *dp-- = 0;
+
+            else
+               *dp-- = 0xff;
+
+            *dp-- = *sp--;
+            *dp-- = *sp--;
+            *dp-- = *sp--;
+         }
       }
+      else if (row_info->bit_depth == 16)
+      {
+         png_byte red_high = (png_byte)((trans_color->red >> 8) & 0xff);
+         png_byte green_high = (png_byte)((trans_color->green >> 8) & 0xff);
+         png_byte blue_high = (png_byte)((trans_color->blue >> 8) & 0xff);
+         png_byte red_low = (png_byte)(trans_color->red & 0xff);
+         png_byte green_low = (png_byte)(trans_color->green & 0xff);
+         png_byte blue_low = (png_byte)(trans_color->blue & 0xff);
+         sp = row + row_info->rowbytes - 1;
+         dp = row + ((size_t)row_width << 3) - 1;
+         for (i = 0; i < row_width; i++)
+         {
+            if (*(sp - 5) == red_high &&
+                *(sp - 4) == red_low &&
+                *(sp - 3) == green_high &&
+                *(sp - 2) == green_low &&
+                *(sp - 1) == blue_high &&
+                *(sp    ) == blue_low)
+            {
+               *dp-- = 0;
+               *dp-- = 0;
+            }
+
+            else
+            {
+               *dp-- = 0xff;
+               *dp-- = 0xff;
+            }
+
+            *dp-- = *sp--;
+            *dp-- = *sp--;
+            *dp-- = *sp--;
+            *dp-- = *sp--;
+            *dp-- = *sp--;
+            *dp-- = *sp--;
+         }
+      }
+      row_info->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
+      row_info->channels = 4;
+      row_info->pixel_depth = (png_byte)(row_info->bit_depth << 2);
+      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
    }
 }
 #endif
 
 #ifdef PNG_READ_EXPAND_16_SUPPORTED
 /* If the bit depth is 8 and the color type is not a palette type expand the
  * whole row to 16 bits.  Has no effect otherwise.
  */
@@ -4755,18 +4750,17 @@ png_do_read_transformations(png_structrp
       else
       {
          if (png_ptr->num_trans != 0 &&
              (png_ptr->transformations & PNG_EXPAND_tRNS) != 0)
             png_do_expand(row_info, png_ptr->row_buf + 1,
                 &(png_ptr->trans_color));
 
          else
-            png_do_expand(row_info, png_ptr->row_buf + 1,
-                NULL);
+            png_do_expand(row_info, png_ptr->row_buf + 1, NULL);
       }
    }
 #endif
 
 #ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
    if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 &&
        (png_ptr->transformations & PNG_COMPOSE) == 0 &&
        (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA ||
@@ -4980,17 +4974,17 @@ png_do_read_transformations(png_structrp
 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
    if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
    {
       if (png_ptr->read_user_transform_fn != NULL)
          (*(png_ptr->read_user_transform_fn)) /* User read transform function */
              (png_ptr,     /* png_ptr */
              row_info,     /* row_info: */
                 /*  png_uint_32 width;       width of row */
-                /*  png_size_t rowbytes;     number of bytes in row */
+                /*  size_t rowbytes;         number of bytes in row */
                 /*  png_byte color_type;     color type of pixels */
                 /*  png_byte bit_depth;      bit depth of samples */
                 /*  png_byte channels;       number of channels (1-4) */
                 /*  png_byte pixel_depth;    bits per pixel (depth*channels) */
              png_ptr->row_buf + 1);    /* start of pixel data for row */
 #ifdef PNG_USER_TRANSFORM_PTR_SUPPORTED
       if (png_ptr->user_transform_depth != 0)
          row_info->bit_depth = png_ptr->user_transform_depth;
--- a/media/libpng/pngrutil.c
+++ b/media/libpng/pngrutil.c
@@ -1,13 +1,13 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.6.33 [September 28, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * This file contains routines that are only called from within
@@ -97,17 +97,17 @@ png_get_int_32)(png_const_bytep buf)
     */
    return 0;
 }
 
 /* Grab an unsigned 16-bit integer from a buffer in big-endian format. */
 png_uint_16 (PNGAPI
 png_get_uint_16)(png_const_bytep buf)
 {
-   /* ANSI-C requires an int value to accomodate at least 16 bits so this
+   /* ANSI-C requires an int value to accommodate at least 16 bits so this
     * works and allows the compiler not to worry about possible narrowing
     * on 32-bit systems.  (Pre-ANSI systems did not make integers smaller
     * than 16 bits either.)
     */
    unsigned int val =
        ((unsigned int)(*buf) << 8) +
        ((unsigned int)(*(buf + 1)));
 
@@ -115,17 +115,17 @@ png_get_uint_16)(png_const_bytep buf)
 }
 
 #endif /* READ_INT_FUNCTIONS */
 
 /* Read and check the PNG file signature */
 void /* PRIVATE */
 png_read_sig(png_structrp png_ptr, png_inforp info_ptr)
 {
-   png_size_t num_checked, num_to_check;
+   size_t num_checked, num_to_check;
 
    /* Exit if the user application does not expect a signature. */
    if (png_ptr->sig_bytes >= 8)
       return;
 
    num_checked = png_ptr->sig_bytes;
    num_to_check = 8 - num_checked;
 
@@ -1648,17 +1648,17 @@ png_handle_sPLT(png_structrp png_ptr, pn
 {
    png_bytep entry_start, buffer;
    png_sPLT_t new_palette;
    png_sPLT_entryp pp;
    png_uint_32 data_length;
    int entry_size, i;
    png_uint_32 skip = 0;
    png_uint_32 dl;
-   png_size_t max_dl;
+   size_t max_dl;
 
    png_debug(1, "in png_handle_sPLT");
 
 #ifdef PNG_USER_LIMITS_SUPPORTED
    if (png_ptr->user_chunk_cache_max != 0)
    {
       if (png_ptr->user_chunk_cache_max == 1)
       {
@@ -1997,25 +1997,43 @@ png_handle_bKGD(png_structrp png_ptr, pn
       else
          background.red = background.green = background.blue = 0;
 
       background.gray = 0;
    }
 
    else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) /* GRAY */
    {
+      if (png_ptr->bit_depth <= 8)
+      {
+         if (buf[0] != 0 || buf[1] >= (unsigned int)(1 << png_ptr->bit_depth))
+         {
+            png_chunk_benign_error(png_ptr, "invalid gray level");
+            return;
+         }
+      }
+
       background.index = 0;
       background.red =
       background.green =
       background.blue =
       background.gray = png_get_uint_16(buf);
    }
 
    else
    {
+      if (png_ptr->bit_depth <= 8)
+      {
+         if (buf[0] != 0 || buf[2] != 0 || buf[4] != 0)
+         {
+            png_chunk_benign_error(png_ptr, "invalid color");
+            return;
+         }
+      }
+
       background.index = 0;
       background.red = png_get_uint_16(buf);
       background.green = png_get_uint_16(buf + 2);
       background.blue = png_get_uint_16(buf + 4);
       background.gray = 0;
    }
 
    png_set_bKGD(png_ptr, info_ptr, &background);
@@ -2359,17 +2377,17 @@ png_handle_pCAL(png_structrp png_ptr, pn
 #endif
 
 #ifdef PNG_READ_sCAL_SUPPORTED
 /* Read the sCAL chunk */
 void /* PRIVATE */
 png_handle_sCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
 {
    png_bytep buffer;
-   png_size_t i;
+   size_t i;
    int state;
 
    png_debug(1, "in png_handle_sCAL");
 
    if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
       png_chunk_error(png_ptr, "missing IHDR");
 
    else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
@@ -2429,17 +2447,17 @@ png_handle_sCAL(png_structrp png_ptr, pn
        i >= length || buffer[i++] != 0)
       png_chunk_benign_error(png_ptr, "bad width format");
 
    else if (PNG_FP_IS_POSITIVE(state) == 0)
       png_chunk_benign_error(png_ptr, "non-positive width");
 
    else
    {
-      png_size_t heighti = i;
+      size_t heighti = i;
 
       state = 0;
       if (png_check_fp_number((png_const_charp)buffer, length,
           &state, &i) == 0 || i != length)
          png_chunk_benign_error(png_ptr, "bad height format");
 
       else if (PNG_FP_IS_POSITIVE(state) == 0)
          png_chunk_benign_error(png_ptr, "non-positive height");
@@ -3041,17 +3059,17 @@ png_cache_unknown_chunk(png_structrp png
    if (PNG_USER_CHUNK_MALLOC_MAX < limit)
       limit = PNG_USER_CHUNK_MALLOC_MAX;
 #  endif
 
    if (length <= limit)
    {
       PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
       /* The following is safe because of the PNG_SIZE_MAX init above */
-      png_ptr->unknown_chunk.size = (png_size_t)length/*SAFE*/;
+      png_ptr->unknown_chunk.size = (size_t)length/*SAFE*/;
       /* 'mode' is a flag array, only the bottom four bits matter here */
       png_ptr->unknown_chunk.location = (png_byte)png_ptr->mode/*SAFE*/;
 
       if (length == 0)
          png_ptr->unknown_chunk.data = NULL;
 
       else
       {
@@ -3327,20 +3345,23 @@ png_check_chunk_length(png_const_structr
 #ifdef PNG_READ_APNG_SUPPORTED
    if (png_ptr->chunk_name == png_IDAT || png_ptr->chunk_name == png_fdAT)
 #else
    if (png_ptr->chunk_name == png_IDAT)
 #endif
    {
       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
       size_t row_factor =
-         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
-          + 1 + (png_ptr->interlaced? 6: 0));
+         (size_t)png_ptr->width
+         * (size_t)png_ptr->channels
+         * (png_ptr->bit_depth > 8? 2: 1)
+         + 1
+         + (png_ptr->interlaced? 6: 0);
       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
-         idat_limit=PNG_UINT_31_MAX;
+         idat_limit = PNG_UINT_31_MAX;
       else
          idat_limit = png_ptr->height * row_factor;
       row_factor = row_factor > 32566? 32566 : row_factor;
       idat_limit += 6 + 5*(idat_limit/row_factor+1); /* zlib+deflate overhead */
       idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX;
       limit = limit < idat_limit? idat_limit : limit;
    }
 
@@ -3857,18 +3878,18 @@ png_do_read_interlace(png_row_infop row_
       png_uint_32 final_width;
 
       final_width = row_info->width * png_pass_inc[pass];
 
       switch (row_info->pixel_depth)
       {
          case 1:
          {
-            png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 3);
-            png_bytep dp = row + (png_size_t)((final_width - 1) >> 3);
+            png_bytep sp = row + (size_t)((row_info->width - 1) >> 3);
+            png_bytep dp = row + (size_t)((final_width - 1) >> 3);
             unsigned int sshift, dshift;
             unsigned int s_start, s_end;
             int s_inc;
             int jstop = (int)png_pass_inc[pass];
             png_byte v;
             png_uint_32 i;
             int j;
 
@@ -3984,18 +4005,18 @@ png_do_read_interlace(png_row_infop row_
                else
                   sshift = (unsigned int)((int)sshift + s_inc);
             }
             break;
          }
 
          case 4:
          {
-            png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 1);
-            png_bytep dp = row + (png_size_t)((final_width - 1) >> 1);
+            png_bytep sp = row + (size_t)((row_info->width - 1) >> 1);
+            png_bytep dp = row + (size_t)((final_width - 1) >> 1);
             unsigned int sshift, dshift;
             unsigned int s_start, s_end;
             int s_inc;
             png_uint_32 i;
             int jstop = (int)png_pass_inc[pass];
 
 #ifdef PNG_READ_PACKSWAP_SUPPORTED
             if ((transformations & PNG_PACKSWAP) != 0)
@@ -4047,22 +4068,22 @@ png_do_read_interlace(png_row_infop row_
                else
                   sshift = (unsigned int)((int)sshift + s_inc);
             }
             break;
          }
 
          default:
          {
-            png_size_t pixel_bytes = (row_info->pixel_depth >> 3);
-
-            png_bytep sp = row + (png_size_t)(row_info->width - 1)
+            size_t pixel_bytes = (row_info->pixel_depth >> 3);
+
+            png_bytep sp = row + (size_t)(row_info->width - 1)
                 * pixel_bytes;
 
-            png_bytep dp = row + (png_size_t)(final_width - 1) * pixel_bytes;
+            png_bytep dp = row + (size_t)(final_width - 1) * pixel_bytes;
 
             int jstop = (int)png_pass_inc[pass];
             png_uint_32 i;
 
             for (i = 0; i < row_info->width; i++)
             {
                png_byte v[8]; /* SAFE; pixel_depth does not exceed 64 */
                int j;
@@ -4089,55 +4110,55 @@ png_do_read_interlace(png_row_infop row_
 #endif
 }
 #endif /* READ_INTERLACING */
 
 static void
 png_read_filter_row_sub(png_row_infop row_info, png_bytep row,
     png_const_bytep prev_row)
 {
-   png_size_t i;
-   png_size_t istop = row_info->rowbytes;
+   size_t i;
+   size_t istop = row_info->rowbytes;
    unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
    png_bytep rp = row + bpp;
 
    PNG_UNUSED(prev_row)
 
    for (i = bpp; i < istop; i++)
    {
       *rp = (png_byte)(((int)(*rp) + (int)(*(rp-bpp))) & 0xff);
       rp++;
    }
 }
 
 static void
 png_read_filter_row_up(png_row_infop row_info, png_bytep row,
     png_const_bytep prev_row)
 {
-   png_size_t i;
-   png_size_t istop = row_info->rowbytes;
+   size_t i;
+   size_t istop = row_info->rowbytes;
    png_bytep rp = row;
    png_const_bytep pp = prev_row;
 
    for (i = 0; i < istop; i++)
    {
       *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff);
       rp++;
    }
 }
 
 static void
 png_read_filter_row_avg(png_row_infop row_info, png_bytep row,
     png_const_bytep prev_row)
 {
-   png_size_t i;
+   size_t i;
    png_bytep rp = row;
    png_const_bytep pp = prev_row;
    unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
-   png_size_t istop = row_info->rowbytes - bpp;
+   size_t istop = row_info->rowbytes - bpp;
 
    for (i = 0; i < bpp; i++)
    {
       *rp = (png_byte)(((int)(*rp) +
          ((int)(*pp++) / 2 )) & 0xff);
 
       rp++;
    }
@@ -4599,17 +4620,17 @@ png_read_start_row(png_structrp png_ptr)
 
    /* Start of interlace block in the y direction */
    static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
 
    /* Offset to next interlace block in the y direction */
    static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
 
    unsigned int max_pixel_depth;
-   png_size_t row_bytes;
+   size_t row_bytes;
 
    png_debug(1, "in png_read_start_row");
 
 #ifdef PNG_READ_TRANSFORMS_SUPPORTED
    png_init_read_transformations(png_ptr);
 #endif
    if (png_ptr->interlaced != 0)
    {
--- a/media/libpng/pngset.c
+++ b/media/libpng/pngset.c
@@ -1,13 +1,13 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.6.32 [August 24, 2017]
- * Copyright (c) 1998-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * The functions here are used during reads to store data from the file
@@ -313,17 +313,17 @@ png_set_oFFs(png_const_structrp png_ptr,
 #endif
 
 #ifdef PNG_pCAL_SUPPORTED
 void PNGAPI
 png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
     png_const_charp purpose, png_int_32 X0, png_int_32 X1, int type,
     int nparams, png_const_charp units, png_charpp params)
 {
-   png_size_t length;
+   size_t length;
    int i;
 
    png_debug1(1, "in %s storage function", "pCAL");
 
    if (png_ptr == NULL || info_ptr == NULL || purpose == NULL || units == NULL
        || (nparams > 0 && params == NULL))
       return;
 
@@ -390,17 +390,17 @@ png_set_pCAL(png_const_structrp png_ptr,
       png_warning(png_ptr, "Insufficient memory for pCAL units");
 
       return;
    }
 
    memcpy(info_ptr->pcal_units, units, length);
 
    info_ptr->pcal_params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
-       (png_size_t)(((unsigned int)nparams + 1) * (sizeof (png_charp)))));
+       (size_t)(((unsigned int)nparams + 1) * (sizeof (png_charp)))));
 
    if (info_ptr->pcal_params == NULL)
    {
       png_warning(png_ptr, "Insufficient memory for pCAL params");
 
       return;
    }
 
@@ -430,17 +430,17 @@ png_set_pCAL(png_const_structrp png_ptr,
 }
 #endif
 
 #ifdef PNG_sCAL_SUPPORTED
 void PNGAPI
 png_set_sCAL_s(png_const_structrp png_ptr, png_inforp info_ptr,
     int unit, png_const_charp swidth, png_const_charp sheight)
 {
-   png_size_t lengthw = 0, lengthh = 0;
+   size_t lengthw = 0, lengthh = 0;
 
    png_debug1(1, "in %s storage function", "sCAL");
 
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
    /* Double check the unit (should never get here with an invalid
     * unit unless this is an API call.)
@@ -691,17 +691,17 @@ png_set_sRGB_gAMA_and_cHRM(png_const_str
 #ifdef PNG_iCCP_SUPPORTED
 void PNGAPI
 png_set_iCCP(png_const_structrp png_ptr, png_inforp info_ptr,
     png_const_charp name, int compression_type,
     png_const_bytep profile, png_uint_32 proflen)
 {
    png_charp new_iccp_name;
    png_bytep new_iccp_profile;
-   png_size_t length;
+   size_t length;
 
    png_debug1(1, "in %s storage function", "iCCP");
 
    if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL)
       return;
 
    if (compression_type != PNG_COMPRESSION_TYPE_BASE)
       png_app_error(png_ptr, "Invalid iCCP compression method");
@@ -1018,17 +1018,17 @@ png_set_tRNS(png_structrp png_ptr, png_i
 
        png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
 
        if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
        {
          /* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */
           info_ptr->trans_alpha = png_voidcast(png_bytep,
               png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
-          memcpy(info_ptr->trans_alpha, trans_alpha, (png_size_t)num_trans);
+          memcpy(info_ptr->trans_alpha, trans_alpha, (size_t)num_trans);
        }
        png_ptr->trans_alpha = info_ptr->trans_alpha;
    }
 
    if (trans_color != NULL)
    {
 #ifdef PNG_WARNINGS_SUPPORTED
       if (info_ptr->bit_depth < 16)
@@ -1098,17 +1098,17 @@ png_set_sPLT(png_const_structrp png_ptr,
    png_free(png_ptr, info_ptr->splt_palettes);
    info_ptr->splt_palettes = np;
    info_ptr->free_me |= PNG_FREE_SPLT;
 
    np += info_ptr->splt_palettes_num;
 
    do
    {
-      png_size_t length;
+      size_t length;
 
       /* Skip invalid input entries */
       if (entries->name == NULL || entries->entries == NULL)
       {
          /* png_handle_sPLT doesn't do this, so this is an app error */
          png_app_error(png_ptr, "png_set_sPLT: invalid sPLT");
          /* Just skip the invalid entry */
          continue;
@@ -1703,17 +1703,17 @@ png_set_rows(png_const_structrp png_ptr,
    info_ptr->row_pointers = row_pointers;
 
    if (row_pointers != NULL)
       info_ptr->valid |= PNG_INFO_IDAT;
 }
 #endif
 
 void PNGAPI
-png_set_compression_buffer_size(png_structrp png_ptr, png_size_t size)
+png_set_compression_buffer_size(png_structrp png_ptr, size_t size)
 {
    if (png_ptr == NULL)
       return;
 
    if (size == 0 || size > PNG_UINT_31_MAX)
       png_error(png_ptr, "invalid compression buffer size");
 
 #  ifdef PNG_SEQUENTIAL_READ_SUPPORTED
--- a/media/libpng/pngstruct.h
+++ b/media/libpng/pngstruct.h
@@ -1,13 +1,13 @@
 
 /* pngstruct.h - header file for PNG reference library
  *
- * Last changed in libpng 1.6.32 [August 24, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -42,17 +42,17 @@
 #else
 #  define PNGZ_MSG_CAST(s) (s)
 #  define PNGZ_INPUT_CAST(b) (b)
 #endif
 
 /* zlib.h declares a magic type 'uInt' that limits the amount of data that zlib
  * can handle at once.  This type need be no larger than 16 bits (so maximum of
  * 65535), this define allows us to discover how big it is, but limited by the
- * maximuum for png_size_t.  The value can be overriden in a library build
+ * maximum for size_t.  The value can be overridden in a library build
  * (pngusr.h, or set it in CPPFLAGS) and it works to set it to a considerably
  * lower value (e.g. 255 works).  A lower value may help memory usage (slightly)
  * and may even improve performance on some systems (and degrade it on others.)
  */
 #ifndef ZLIB_IO_MAX
 #  define ZLIB_IO_MAX ((uInt)-1)
 #endif
 
@@ -209,17 +209,17 @@ struct png_struct_def
    int zlib_set_mem_level;
    int zlib_set_strategy;
 #endif
 
    png_uint_32 width;         /* width of image in pixels */
    png_uint_32 height;        /* height of image in pixels */
    png_uint_32 num_rows;      /* number of rows in current pass */
    png_uint_32 usr_width;     /* width of row at start of write */
-   png_size_t rowbytes;       /* size of row in bytes */
+   size_t rowbytes;           /* size of row in bytes */
    png_uint_32 iwidth;        /* width of current interlaced row in pixels */
    png_uint_32 row_number;    /* current row in interlace pass */
    png_uint_32 chunk_name;    /* PNG_CHUNK() id of current chunk */
    png_bytep prev_row;        /* buffer to save previous (unfiltered) row.
                                * While reading this is a pointer into
                                * big_prev_row; while writing it is separately
                                * allocated if needed.
                                */
@@ -227,17 +227,17 @@ struct png_struct_def
                                * While reading, this is a pointer into
                                * big_row_buf; while writing it is separately
                                * allocated.
                                */
 #ifdef PNG_WRITE_FILTER_SUPPORTED
    png_bytep try_row;    /* buffer to save trial row when filtering */
    png_bytep tst_row;    /* buffer to save best trial row when filtering */
 #endif
-   png_size_t info_rowbytes;  /* Added in 1.5.4: cache of updated row bytes */
+   size_t info_rowbytes;      /* Added in 1.5.4: cache of updated row bytes */
 
    png_uint_32 idat_size;     /* current IDAT size for read */
    png_uint_32 crc;           /* current chunk CRC value */
    png_colorp palette;        /* palette from the input file */
    png_uint_16 num_palette;   /* number of color entries in palette */
 
 /* Added at libpng-1.5.10 */
 #ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
@@ -302,17 +302,17 @@ struct png_struct_def
 #endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */
 #endif
 
 #if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_sBIT_SUPPORTED)
    png_color_8 sig_bit;       /* significant bits in each available channel */
 #endif
 
 #if defined(PNG_READ_SHIFT_SUPPORTED) || defined(PNG_WRITE_SHIFT_SUPPORTED)
-   png_color_8 shift;         /* shift for significant bit tranformation */
+   png_color_8 shift;         /* shift for significant bit transformation */
 #endif
 
 #if defined(PNG_tRNS_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED) \
  || defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
    png_bytep trans_alpha;           /* alpha values for paletted files */
    png_color_16 trans_color;  /* transparent color for non-paletted files */
 #endif
 
@@ -323,20 +323,20 @@ struct png_struct_def
    png_progressive_row_ptr row_fn;   /* called after a prog. row is decoded */
    png_progressive_end_ptr end_fn;   /* called after image is complete */
    png_bytep save_buffer_ptr;        /* current location in save_buffer */
    png_bytep save_buffer;            /* buffer for previously read data */
    png_bytep current_buffer_ptr;     /* current location in current_buffer */
    png_bytep current_buffer;         /* buffer for recently used data */
    png_uint_32 push_length;          /* size of current input chunk */
    png_uint_32 skip_length;          /* bytes to skip in input data */
-   png_size_t save_buffer_size;      /* amount of data now in save_buffer */
-   png_size_t save_buffer_max;       /* total size of save_buffer */
-   png_size_t buffer_size;           /* total amount of available input data */
-   png_size_t current_buffer_size;   /* amount of data now in current_buffer */
+   size_t save_buffer_size;          /* amount of data now in save_buffer */
+   size_t save_buffer_max;           /* total size of save_buffer */
+   size_t buffer_size;               /* total amount of available input data */
+   size_t current_buffer_size;       /* amount of data now in current_buffer */
    int process_mode;                 /* what push library is currently doing */
    int cur_palette;                  /* current push library palette index */
 
 #endif /* PROGRESSIVE_READ */
 
 #if defined(__TURBOC__) && !defined(_Windows) && !defined(__FLAT__)
 /* For the Borland special 64K segment handler */
    png_bytepp offset_table_ptr;
@@ -467,17 +467,17 @@ struct png_struct_def
 #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
    /* Temporary storage for unknown chunk that the library doesn't recognize,
     * used while reading the chunk.
     */
    png_unknown_chunk unknown_chunk;
 #endif
 
 /* New member added in libpng-1.2.26 */
-  png_size_t old_big_row_buf_size;
+   size_t old_big_row_buf_size;
 
 #ifdef PNG_READ_SUPPORTED
 /* New member added in libpng-1.2.30 */
   png_bytep        read_buffer;      /* buffer for reading chunk data */
   png_alloc_size_t read_buffer_size; /* current size of the buffer */
 #endif
 #ifdef PNG_SEQUENTIAL_READ_SUPPORTED
   uInt             IDAT_read_size;   /* limit on read buffer size for IDAT */
--- a/media/libpng/pngtrans.c
+++ b/media/libpng/pngtrans.c
@@ -1,13 +1,13 @@
 
 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
  *
- * Last changed in libpng 1.6.33 [September 28, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -264,47 +264,47 @@ png_do_invert(png_row_infop row_info, pn
    png_debug(1, "in png_do_invert");
 
   /* This test removed from libpng version 1.0.13 and 1.2.0:
    *   if (row_info->bit_depth == 1 &&
    */
    if (row_info->color_type == PNG_COLOR_TYPE_GRAY)
    {
       png_bytep rp = row;
-      png_size_t i;
-      png_size_t istop = row_info->rowbytes;
+      size_t i;
+      size_t istop = row_info->rowbytes;
 
       for (i = 0; i < istop; i++)
       {
          *rp = (png_byte)(~(*rp));
          rp++;
       }
    }
 
    else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA &&
       row_info->bit_depth == 8)
    {
       png_bytep rp = row;
-      png_size_t i;
-      png_size_t istop = row_info->rowbytes;
+      size_t i;
+      size_t istop = row_info->rowbytes;
 
       for (i = 0; i < istop; i += 2)
       {
          *rp = (png_byte)(~(*rp));
          rp += 2;
       }
    }
 
 #ifdef PNG_16BIT_SUPPORTED
    else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA &&
       row_info->bit_depth == 16)
    {
       png_bytep rp = row;
-      png_size_t i;
-      png_size_t istop = row_info->rowbytes;
+      size_t i;
+      size_t istop = row_info->rowbytes;
 
       for (i = 0; i < istop; i += 4)
       {
          *rp = (png_byte)(~(*rp));
          *(rp + 1) = (png_byte)(~(*(rp + 1)));
          rp += 4;
       }
    }
@@ -604,17 +604,17 @@ png_do_strip_channel(png_row_infop row_i
       if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
          row_info->color_type = PNG_COLOR_TYPE_RGB;
    }
 
    else
       return; /* The filler channel has gone already */
 
    /* Fix the rowbytes value. */
-   row_info->rowbytes = (png_size_t)(dp-row);
+   row_info->rowbytes = (size_t)(dp-row);
 }
 #endif
 
 #if defined(PNG_READ_BGR_SUPPORTED) || defined(PNG_WRITE_BGR_SUPPORTED)
 /* Swaps red and blue bytes within a pixel */
 void /* PRIVATE */
 png_do_bgr(png_row_infop row_info, png_bytep row)
 {
--- a/media/libpng/pngwio.c
+++ b/media/libpng/pngwio.c
@@ -1,13 +1,13 @@
 
 /* pngwio.c - functions for data output
  *
- * Last changed in libpng 1.6.24 [August 4, 2016]
- * Copyright (c) 1998-2002,2004,2006-2014,2016 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2014,2016,2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * This file provides a location for all output.  Users who need
@@ -25,17 +25,17 @@
 /* Write the data to whatever output you are using.  The default routine
  * writes to a file pointer.  Note that this routine sometimes gets called
  * with very small lengths, so you should implement some kind of simple
  * buffering if you are using unbuffered writes.  This should never be asked
  * to write more than 64K on a 16-bit machine.
  */
 
 void /* PRIVATE */
-png_write_data(png_structrp png_ptr, png_const_bytep data, png_size_t length)
+png_write_data(png_structrp png_ptr, png_const_bytep data, size_t length)
 {
    /* NOTE: write_data_fn must not change the buffer! */
    if (png_ptr->write_data_fn != NULL )
       (*(png_ptr->write_data_fn))(png_ptr, png_constcast(png_bytep,data),
           length);
 
    else
       png_error(png_ptr, "Call to NULL write function");
@@ -43,19 +43,19 @@ png_write_data(png_structrp png_ptr, png
 
 #ifdef PNG_STDIO_SUPPORTED
 /* This is the function that does the actual writing of data.  If you are
  * not writing to a standard C stream, you should create a replacement
  * write_data function and use it at run time with png_set_write_fn(), rather
  * than changing the library.
  */
 void PNGCBAPI
-png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
+png_default_write_data(png_structp png_ptr, png_bytep data, size_t length)
 {
-   png_size_t check;
+   size_t check;
 
    if (png_ptr == NULL)
       return;
 
    check = fwrite(data, 1, length, (png_FILE_p)(png_ptr->io_ptr));
 
    if (check != length)
       png_error(png_ptr, "Write Error");
--- a/media/libpng/pngwrite.c
+++ b/media/libpng/pngwrite.c
@@ -1,13 +1,13 @@
 
 /* pngwrite.c - general routines to write a PNG file
  *
- * Last changed in libpng 1.6.32 [August 24, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -1640,17 +1640,17 @@ png_write_image_16bit(png_voidp argument
 /* Given 16-bit input (1 to 4 channels) write 8-bit output.  If an alpha channel
  * is present it must be removed from the components, the components are then
  * written in sRGB encoding.  No components are added or removed.
  *
  * Calculate an alpha reciprocal to reverse pre-multiplication.  As above the
  * calculation can be done to 15 bits of accuracy; however, the output needs to
  * be scaled in the range 0..255*65535, so include that scaling here.
  */
-#   define UNP_RECIPROCAL(alpha) ((((0xffff*0xff)<<7)+(alpha>>1))/alpha)
+#   define UNP_RECIPROCAL(alpha) ((((0xffff*0xff)<<7)+((alpha)>>1))/(alpha))
 
 static png_byte
 png_unpremultiply(png_uint_32 component, png_uint_32 alpha,
     png_uint_32 reciprocal/*from the above macro*/)
 {
    /* The following gives 1.0 for an alpha of 0, which is fine, otherwise if 0/0
     * is represented as some other value there is more likely to be a
     * discontinuity which will probably damage compression when moving from a
@@ -2166,18 +2166,17 @@ png_image_write_main(png_voidp argument)
    }
 
    png_write_end(png_ptr, info_ptr);
    return 1;
 }
 
 
 static void (PNGCBAPI
-image_memory_write)(png_structp png_ptr, png_bytep/*const*/ data,
-    png_size_t size)
+image_memory_write)(png_structp png_ptr, png_bytep/*const*/ data, size_t size)
 {
    png_image_write_control *display = png_voidcast(png_image_write_control*,
        png_ptr->io_ptr/*backdoor: png_get_io_ptr(png_ptr)*/);
    const png_alloc_size_t ob = display->output_bytes;
 
    /* Check for overflow; this should never happen: */
    if (size <= ((png_alloc_size_t)-1) - ob)
    {
--- a/media/libpng/pngwtran.c
+++ b/media/libpng/pngwtran.c
@@ -1,13 +1,13 @@
 
 /* pngwtran.c - transforms the data in a row for PNG writers
  *
- * Last changed in libpng 1.6.26 [October 20, 2016]
- * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2016,2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -207,19 +207,19 @@ png_do_shift(png_row_infop row_info, png
          shift_dec[channels] = bit_depth->alpha;
          channels++;
       }
 
       /* With low row depths, could only be grayscale, so one channel */
       if (row_info->bit_depth < 8)
       {
          png_bytep bp = row;
-         png_size_t i;
+         size_t i;
          unsigned int mask;
-         png_size_t row_bytes = row_info->rowbytes;
+         size_t row_bytes = row_info->rowbytes;
 
          if (bit_depth->gray == 1 && row_info->bit_depth == 2)
             mask = 0x55;
 
          else if (row_info->bit_depth == 4 && bit_depth->gray == 3)
             mask = 0x11;
 
          else
@@ -509,17 +509,17 @@ png_do_write_transformations(png_structr
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
    if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
       if (png_ptr->write_user_transform_fn != NULL)
          (*(png_ptr->write_user_transform_fn)) /* User write transform
                                                  function */
              (png_ptr,  /* png_ptr */
              row_info,  /* row_info: */
                 /*  png_uint_32 width;       width of row */
-                /*  png_size_t rowbytes;     number of bytes in row */
+                /*  size_t rowbytes;         number of bytes in row */
                 /*  png_byte color_type;     color type of pixels */
                 /*  png_byte bit_depth;      bit depth of samples */
                 /*  png_byte channels;       number of channels (1-4) */
                 /*  png_byte pixel_depth;    bits per pixel (depth*channels) */
              png_ptr->row_buf + 1);      /* start of pixel data for row */
 #endif
 
 #ifdef PNG_WRITE_FILLER_SUPPORTED
--- a/media/libpng/pngwutil.c
+++ b/media/libpng/pngwutil.c
@@ -1,13 +1,13 @@
 
 /* pngwutil.c - utilities to write a PNG file
  *
- * Last changed in libpng 1.6.32 [August 24, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.35 [July 15, 2018]
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -54,17 +54,17 @@ png_write_sig(png_structrp png_ptr)
 
 #ifdef PNG_IO_STATE_SUPPORTED
    /* Inform the I/O callback that the signature is being written */
    png_ptr->io_state = PNG_IO_WRITING | PNG_IO_SIGNATURE;
 #endif
 
    /* Write the rest of the 8 byte signature */
    png_write_data(png_ptr, &png_signature[png_ptr->sig_bytes],
-       (png_size_t)(8 - png_ptr->sig_bytes));
+       (size_t)(8 - png_ptr->sig_bytes));
 
    if (png_ptr->sig_bytes < 3)
       png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
 }
 
 /* Write the start of a PNG chunk.  The type is the chunk type.
  * The total_length is the sum of the lengths of all the data you will be
  * passing in png_write_chunk_data().
@@ -119,18 +119,17 @@ png_write_chunk_start(png_structrp png_p
 }
 
 /* Write the data of a PNG chunk started with png_write_chunk_header().
  * Note that multiple calls to this function are allowed, and that the
  * sum of the lengths from these calls *must* add up to the total_length
  * given to png_write_chunk_header().
  */
 void PNGAPI
-png_write_chunk_data(png_structrp png_ptr, png_const_bytep data,
-    png_size_t length)
+png_write_chunk_data(png_structrp png_ptr, png_const_bytep data, size_t length)
 {
    /* Write the data, and run the CRC over it */
    if (png_ptr == NULL)
       return;
 
    if (data != NULL && length > 0)
    {
       png_write_data(png_ptr, data, length);
@@ -155,48 +154,48 @@ png_write_chunk_end(png_structrp png_ptr
     * PNG_IO_CHUNK_CRC requires a single I/O function call.
     */
    png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_CRC;
 #endif
 
    /* Write the crc in a single operation */
    png_save_uint_32(buf, png_ptr->crc);
 
-   png_write_data(png_ptr, buf, (png_size_t)4);
+   png_write_data(png_ptr, buf, 4);
 }
 
 /* Write a PNG chunk all at once.  The type is an array of ASCII characters
  * representing the chunk name.  The array must be at least 4 bytes in
  * length, and does not need to be null terminated.  To be safe, pass the
  * pre-defined chunk names here, and if you need a new one, define it
  * where the others are defined.  The length is the length of the data.
  * All the data must be present.  If that is not possible, use the
  * png_write_chunk_start(), png_write_chunk_data(), and png_write_chunk_end()
  * functions instead.
  */
 static void
 png_write_complete_chunk(png_structrp png_ptr, png_uint_32 chunk_name,
-    png_const_bytep data, png_size_t length)
+    png_const_bytep data, size_t length)
 {
    if (png_ptr == NULL)
       return;
 
    /* On 64-bit architectures 'length' may not fit in a png_uint_32. */
    if (length > PNG_UINT_31_MAX)
       png_error(png_ptr, "length exceeds PNG maximum");
 
    png_write_chunk_header(png_ptr, chunk_name, (png_uint_32)length);
    png_write_chunk_data(png_ptr, data, length);
    png_write_chunk_end(png_ptr);
 }
 
 /* This is the API that calls the internal function above. */
 void PNGAPI
 png_write_chunk(png_structrp png_ptr, png_const_bytep chunk_string,
-    png_const_bytep data, png_size_t length)
+    png_const_bytep data, size_t length)
 {
    png_write_complete_chunk(png_ptr, PNG_CHUNK_FROM_STRING(chunk_string), data,
        length);
 }
 
 /* This is used below to find the size of an image to pass to png_deflate_claim,
  * so it only needs to be accurate if the size is less than 16384 bytes (the
  * point at which a lower LZ window size can be used.)
@@ -815,17 +814,17 @@ png_write_IHDR(png_structrp png_ptr, png
    png_save_uint_32(buf + 4, height);
    buf[8] = (png_byte)bit_depth;
    buf[9] = (png_byte)color_type;
    buf[10] = (png_byte)compression_type;
    buf[11] = (png_byte)filter_type;
    buf[12] = (png_byte)interlace_type;
 
    /* Write the chunk */
-   png_write_complete_chunk(png_ptr, png_IHDR, buf, (png_size_t)13);
+   png_write_complete_chunk(png_ptr, png_IHDR, buf, 13);
 
 #ifdef PNG_WRITE_APNG_SUPPORTED
    png_ptr->first_frame_width = width;
    png_ptr->first_frame_height = height;
 #endif
 
    if ((png_ptr->do_filter) == PNG_NO_FILTERS)
    {
@@ -889,31 +888,31 @@ png_write_PLTE(png_structrp png_ptr, png
    png_write_chunk_header(png_ptr, png_PLTE, (png_uint_32)(num_pal * 3));
 #ifdef PNG_POINTER_INDEXING_SUPPORTED
 
    for (i = 0, pal_ptr = palette; i < num_pal; i++, pal_ptr++)
    {
       buf[0] = pal_ptr->red;
       buf[1] = pal_ptr->green;
       buf[2] = pal_ptr->blue;
-      png_write_chunk_data(png_ptr, buf, (png_size_t)3);
+      png_write_chunk_data(png_ptr, buf, 3);
    }
 
 #else
    /* This is a little slower but some buggy compilers need to do this
     * instead
     */
    pal_ptr=palette;
 
    for (i = 0; i < num_pal; i++)
    {
       buf[0] = pal_ptr[i].red;
       buf[1] = pal_ptr[i].green;
       buf[2] = pal_ptr[i].blue;
-      png_write_chunk_data(png_ptr, buf, (png_size_t)3);
+      png_write_chunk_data(png_ptr, buf, 3);
    }
 
 #endif
    png_write_chunk_end(png_ptr);
    png_ptr->mode |= PNG_HAVE_PLTE;
 }
 
 /* This is similar to png_text_compress, above, except that it does not require
@@ -1095,32 +1094,32 @@ png_compress_IDAT(png_structrp png_ptr, 
 }
 
 /* Write an IEND chunk */
 void /* PRIVATE */
 png_write_IEND(png_structrp png_ptr)
 {
    png_debug(1, "in png_write_IEND");
 
-   png_write_complete_chunk(png_ptr, png_IEND, NULL, (png_size_t)0);
+   png_write_complete_chunk(png_ptr, png_IEND, NULL, 0);
    png_ptr->mode |= PNG_HAVE_IEND;
 }
 
 #ifdef PNG_WRITE_gAMA_SUPPORTED
 /* Write a gAMA chunk */
 void /* PRIVATE */
 png_write_gAMA_fixed(png_structrp png_ptr, png_fixed_point file_gamma)
 {
    png_byte buf[4];
 
    png_debug(1, "in png_write_gAMA");
 
    /* file_gamma is saved in 1/100,000ths */
    png_save_uint_32(buf, (png_uint_32)file_gamma);
-   png_write_complete_chunk(png_ptr, png_gAMA, buf, (png_size_t)4);
+   png_write_complete_chunk(png_ptr, png_gAMA, buf, 4);
 }
 #endif
 
 #ifdef PNG_WRITE_sRGB_SUPPORTED
 /* Write a sRGB chunk */
 void /* PRIVATE */
 png_write_sRGB(png_structrp png_ptr, int srgb_intent)
 {
@@ -1128,17 +1127,17 @@ png_write_sRGB(png_structrp png_ptr, int
 
    png_debug(1, "in png_write_sRGB");
 
    if (srgb_intent >= PNG_sRGB_INTENT_LAST)
       png_warning(png_ptr,
           "Invalid sRGB rendering intent specified");
 
    buf[0]=(png_byte)srgb_intent;
-   png_write_complete_chunk(png_ptr, png_sRGB, buf, (png_size_t)1);
+   png_write_complete_chunk(png_ptr, png_sRGB, buf, 1);
 }
 #endif
 
 #ifdef PNG_WRITE_iCCP_SUPPORTED
 /* Write an iCCP chunk */
 void /* PRIVATE */
 png_write_iCCP(png_structrp png_ptr, png_const_charp name,
     png_const_bytep profile)
@@ -1202,38 +1201,37 @@ png_write_iCCP(png_structrp png_ptr, png
 #ifdef PNG_WRITE_sPLT_SUPPORTED
 /* Write a sPLT chunk */
 void /* PRIVATE */
 png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
 {
    png_uint_32 name_len;
    png_byte new_name[80];
    png_byte entrybuf[10];
-   png_size_t entry_size = (spalette->depth == 8 ? 6 : 10);
-   png_size_t palette_size = entry_size * (png_size_t)spalette->nentries;
+   size_t entry_size = (spalette->depth == 8 ? 6 : 10);
+   size_t palette_size = entry_size * (size_t)spalette->nentries;
    png_sPLT_entryp ep;
 #ifndef PNG_POINTER_INDEXING_SUPPORTED
    int i;
 #endif
 
    png_debug(1, "in png_write_sPLT");
 
    name_len = png_check_keyword(png_ptr, spalette->name, new_name);
 
    if (name_len == 0)
       png_error(png_ptr, "sPLT: invalid keyword");
 
    /* Make sure we include the NULL after the name */
    png_write_chunk_header(png_ptr, png_sPLT,
        (png_uint_32)(name_len + 2 + palette_size));
 
-   png_write_chunk_data(png_ptr, (png_bytep)new_name,
-       (png_size_t)(name_len + 1));
-
-   png_write_chunk_data(png_ptr, &spalette->depth, (png_size_t)1);
+   png_write_chunk_data(png_ptr, (png_bytep)new_name, (size_t)(name_len + 1));
+
+   png_write_chunk_data(png_ptr, &spalette->depth, 1);
 
    /* Loop through each palette entry, writing appropriately */
 #ifdef PNG_POINTER_INDEXING_SUPPORTED
    for (ep = spalette->entries; ep<spalette->entries + spalette->nentries; ep++)
    {
       if (spalette->depth == 8)
       {
          entrybuf[0] = (png_byte)ep->red;
@@ -1285,17 +1283,17 @@ png_write_sPLT(png_structrp png_ptr, png
 #endif
 
 #ifdef PNG_WRITE_sBIT_SUPPORTED
 /* Write the sBIT chunk */
 void /* PRIVATE */
 png_write_sBIT(png_structrp png_ptr, png_const_color_8p sbit, int color_type)
 {
    png_byte buf[4];
-   png_size_t size;
+   size_t size;
 
    png_debug(1, "in png_write_sBIT");
 
    /* Make sure we don't depend upon the order of PNG_COLOR_8 */
    if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
    {
       png_byte maxbits;
 
@@ -1385,32 +1383,32 @@ png_write_tRNS(png_structrp png_ptr, png
       {
          png_app_warning(png_ptr,
              "Invalid number of transparent colors specified");
          return;
       }
 
       /* Write the chunk out as it is */
       png_write_complete_chunk(png_ptr, png_tRNS, trans_alpha,
-          (png_size_t)num_trans);
+          (size_t)num_trans);
    }
 
    else if (color_type == PNG_COLOR_TYPE_GRAY)
    {
       /* One 16-bit value */
       if (tran->gray >= (1 << png_ptr->bit_depth))
       {
          png_app_warning(png_ptr,
              "Ignoring attempt to write tRNS chunk out-of-range for bit_depth");
 
          return;
       }
 
       png_save_uint_16(buf, tran->gray);
-      png_write_complete_chunk(png_ptr, png_tRNS, buf, (png_size_t)2);
+      png_write_complete_chunk(png_ptr, png_tRNS, buf, 2);
    }
 
    else if (color_type == PNG_COLOR_TYPE_RGB)
    {
       /* Three 16-bit values */
       png_save_uint_16(buf, tran->red);
       png_save_uint_16(buf + 2, tran->green);
       png_save_uint_16(buf + 4, tran->blue);
@@ -1420,17 +1418,17 @@ png_write_tRNS(png_structrp png_ptr, png
       if ((buf[0] | buf[2] | buf[4]) != 0)
 #endif
       {
          png_app_warning(png_ptr,
              "Ignoring attempt to write 16-bit tRNS chunk when bit_depth is 8");
          return;
       }
 
-      png_write_complete_chunk(png_ptr, png_tRNS, buf, (png_size_t)6);
+      png_write_complete_chunk(png_ptr, png_tRNS, buf, 6);
    }
 
    else
    {
       png_app_warning(png_ptr, "Can't write tRNS with an alpha channel");
    }
 }
 #endif
@@ -1453,17 +1451,17 @@ png_write_bKGD(png_structrp png_ptr, png
 #endif
          back->index >= png_ptr->num_palette)
       {
          png_warning(png_ptr, "Invalid background palette index");
          return;
       }
 
       buf[0] = back->index;
-      png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)1);
+      png_write_complete_chunk(png_ptr, png_bKGD, buf, 1);
    }
 
    else if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
    {
       png_save_uint_16(buf, back->red);
       png_save_uint_16(buf + 2, back->green);
       png_save_uint_16(buf + 4, back->blue);
 #ifdef PNG_WRITE_16BIT_SUPPORTED
@@ -1474,31 +1472,31 @@ png_write_bKGD(png_structrp png_ptr, png
       {
          png_warning(png_ptr,
              "Ignoring attempt to write 16-bit bKGD chunk "
              "when bit_depth is 8");
 
          return;
       }
 
-      png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)6);
+      png_write_complete_chunk(png_ptr, png_bKGD, buf, 6);
    }
 
    else
    {
       if (back->gray >= (1 << png_ptr->bit_depth))
       {
          png_warning(png_ptr,
              "Ignoring attempt to write bKGD chunk out-of-range for bit_depth");
 
          return;
       }
 
       png_save_uint_16(buf, back->gray);
-      png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)2);
+      png_write_complete_chunk(png_ptr, png_bKGD, buf, 2);
    }
 }
 #endif
 
 #ifdef PNG_WRITE_eXIf_SUPPORTED
 /* Write the Exif data */
 void /* PRIVATE */
 png_write_eXIf(png_structrp png_ptr, png_bytep exif, int num_exif)
@@ -1508,17 +1506,17 @@ png_write_eXIf(png_structrp png_ptr, png
 
    png_debug(1, "in png_write_eXIf");
 
    png_write_chunk_header(png_ptr, png_eXIf, (png_uint_32)(num_exif));
 
    for (i = 0; i < num_exif; i++)
    {
       buf[0] = exif[i];
-      png_write_chunk_data(png_ptr, buf, (png_size_t)1);
+      png_write_chunk_data(png_ptr, buf, 1);
    }
 
    png_write_chunk_end(png_ptr);
 }
 #endif
 
 #ifdef PNG_WRITE_hIST_SUPPORTED
 /* Write the histogram */
@@ -1539,28 +1537,28 @@ png_write_hIST(png_structrp png_ptr, png
       return;
    }
 
    png_write_chunk_header(png_ptr, png_hIST, (png_uint_32)(num_hist * 2));
 
    for (i = 0; i < num_hist; i++)
    {
       png_save_uint_16(buf, hist[i]);
-      png_write_chunk_data(png_ptr, buf, (png_size_t)2);
+      png_write_chunk_data(png_ptr, buf, 2);
    }
 
    png_write_chunk_end(png_ptr);
 }
 #endif
 
 #ifdef PNG_WRITE_tEXt_SUPPORTED
 /* Write a tEXt chunk */
 void /* PRIVATE */
 png_write_tEXt(png_structrp png_ptr, png_const_charp key, png_const_charp text,
-    png_size_t text_len)
+    size_t text_len)
 {
    png_uint_32 key_len;
    png_byte new_key[80];
 
    png_debug(1, "in png_write_tEXt");
 
    key_len = png_check_keyword(png_ptr, key, new_key);
 
@@ -1647,17 +1645,17 @@ png_write_zTXt(png_structrp png_ptr, png
 
 #ifdef PNG_WRITE_iTXt_SUPPORTED
 /* Write an iTXt chunk */
 void /* PRIVATE */
 png_write_iTXt(png_structrp png_ptr, int compression, png_const_charp key,
     png_const_charp lang, png_const_charp lang_key, png_const_charp text)
 {
    png_uint_32 key_len, prefix_len;
-   png_size_t lang_len, lang_key_len;
+   size_t lang_len, lang_key_len;
    png_byte new_key[82];
    compression_state comp;
 
    png_debug(1, "in png_write_iTXt");
 
    key_len = png_check_keyword(png_ptr, key, new_key);
 
    if (key_len == 0)
@@ -1757,28 +1755,28 @@ png_write_oFFs(png_structrp png_ptr, png
 
    if (unit_type >= PNG_OFFSET_LAST)
       png_warning(png_ptr, "Unrecognized unit type for oFFs chunk");
 
    png_save_int_32(buf, x_offset);
    png_save_int_32(buf + 4, y_offset);
    buf[8] = (png_byte)unit_type;
 
-   png_write_complete_chunk(png_ptr, png_oFFs, buf, (png_size_t)9);
+   png_write_complete_chunk(png_ptr, png_oFFs, buf, 9);
 }
 #endif
 #ifdef PNG_WRITE_pCAL_SUPPORTED
 /* Write the pCAL chunk (described in the PNG extensions document) */
 void /* PRIVATE */
 png_write_pCAL(png_structrp png_ptr, png_charp purpose, png_int_32 X0,
     png_int_32 X1, int type, int nparams, png_const_charp units,
     png_charpp params)
 {
    png_uint_32 purpose_len;
-   png_size_t units_len, total_len;
+   size_t units_len, total_len;
    png_size_tp params_len;
    png_byte buf[10];
    png_byte new_purpose[80];
    int i;
 
    png_debug1(1, "in png_write_pCAL (%d parameters)", nparams);
 
    if (type >= PNG_EQUATION_LAST)
@@ -1792,17 +1790,17 @@ png_write_pCAL(png_structrp png_ptr, png
    ++purpose_len; /* terminator */
 
    png_debug1(3, "pCAL purpose length = %d", (int)purpose_len);
    units_len = strlen(units) + (nparams == 0 ? 0 : 1);
    png_debug1(3, "pCAL units length = %d", (int)units_len);
    total_len = purpose_len + units_len + 10;
 
    params_len = (png_size_tp)png_malloc(png_ptr,
-       (png_alloc_size_t)((png_alloc_size_t)nparams * (sizeof (png_size_t))));
+       (png_alloc_size_t)((png_alloc_size_t)nparams * (sizeof (size_t))));
 
    /* Find the length of each parameter, making sure we don't count the
     * null terminator for the last parameter.
     */
    for (i = 0; i < nparams; i++)
    {
       params_len[i] = strlen(params[i]) + (i == nparams - 1 ? 0 : 1);
       png_debug2(3, "pCAL parameter %d length = %lu", i,
@@ -1812,18 +1810,18 @@ png_write_pCAL(png_structrp png_ptr, png
 
    png_debug1(3, "pCAL total length = %d", (int)total_len);
    png_write_chunk_header(png_ptr, png_pCAL, (png_uint_32)total_len);
    png_write_chunk_data(png_ptr, new_purpose, purpose_len);
    png_save_int_32(buf, X0);
    png_save_int_32(buf + 4, X1);
    buf[8] = (png_byte)type;
    buf[9] = (png_byte)nparams;
-   png_write_chunk_data(png_ptr, buf, (png_size_t)10);
-   png_write_chunk_data(png_ptr, (png_const_bytep)units, (png_size_t)units_len);
+   png_write_chunk_data(png_ptr, buf, 10);
+   png_write_chunk_data(png_ptr, (png_const_bytep)units, (size_t)units_len);
 
    for (i = 0; i < nparams; i++)
    {
       png_write_chunk_data(png_ptr, (png_const_bytep)params[i], params_len[i]);
    }
 
    png_free(png_ptr, params_len);
    png_write_chunk_end(png_ptr);
@@ -1832,17 +1830,17 @@ png_write_pCAL(png_structrp png_ptr, png
 
 #ifdef PNG_WRITE_sCAL_SUPPORTED
 /* Write the sCAL chunk */
 void /* PRIVATE */
 png_write_sCAL_s(png_structrp png_ptr, int unit, png_const_charp width,
     png_const_charp height)
 {
    png_byte buf[64];
-   png_size_t wlen, hlen, total_len;
+   size_t wlen, hlen, total_len;
 
    png_debug(1, "in png_write_sCAL_s");
 
    wlen = strlen(width);
    hlen = strlen(height);
    total_len = wlen + hlen + 2;
 
    if (total_len > 64)
@@ -1873,17 +1871,17 @@ png_write_pHYs(png_structrp png_ptr, png
 
    if (unit_type >= PNG_RESOLUTION_LAST)
       png_warning(png_ptr, "Unrecognized unit type for pHYs chunk");
 
    png_save_uint_32(buf, x_pixels_per_unit);
    png_save_uint_32(buf + 4, y_pixels_per_unit);
    buf[8] = (png_byte)unit_type;
 
-   png_write_complete_chunk(png_ptr, png_pHYs, buf, (png_size_t)9);
+   png_write_complete_chunk(png_ptr, png_pHYs, buf, 9);
 }
 #endif
 
 #ifdef PNG_WRITE_tIME_SUPPORTED
 /* Write the tIME chunk.  Use either png_convert_from_struct_tm()
  * or png_convert_from_time_t(), or fill in the structure yourself.
  */
 void /* PRIVATE */
@@ -1903,17 +1901,17 @@ png_write_tIME(png_structrp png_ptr, png
 
    png_save_uint_16(buf, mod_time->year);
    buf[2] = mod_time->month;
    buf[3] = mod_time->day;
    buf[4] = mod_time->hour;
    buf[5] = mod_time->minute;
    buf[6] = mod_time->second;
 
-   png_write_complete_chunk(png_ptr, png_tIME, buf, (png_size_t)7);
+   png_write_complete_chunk(png_ptr, png_tIME, buf, 7);
 }
 #endif
 
 #ifdef PNG_WRITE_APNG_SUPPORTED
 void /* PRIVATE */
 png_write_acTL(png_structp png_ptr,
     png_uint_32 num_frames, png_uint_32 num_plays)
 {
@@ -2169,18 +2167,18 @@ png_write_finish_row(png_structrp png_pt
 
       }
 
       /* Reset the row above the image for the next pass */
       if (png_ptr->pass < 7)
       {
          if (png_ptr->prev_row != NULL)
             memset(png_ptr->prev_row, 0,
-                (png_size_t)(PNG_ROWBYTES(png_ptr->usr_channels*
-                png_ptr->usr_bit_depth, png_ptr->width)) + 1);
+                PNG_ROWBYTES(png_ptr->usr_channels *
+                png_ptr->usr_bit_depth, png_ptr->width) + 1);
 
          return;
       }
    }
 #endif
 
    /* If we get here, we've just written the last row, so we need
       to flush the compressor */
@@ -2226,17 +2224,17 @@ png_do_write_interlace(png_row_infop row
 
             dp = row;
             d = 0;
             shift = 7;
 
             for (i = png_pass_start[pass]; i < row_width;
                i += png_pass_inc[pass])
             {
-               sp = row + (png_size_t)(i >> 3);
+               sp = row + (size_t)(i >> 3);
                value = (int)(*sp >> (7 - (int)(i & 0x07))) & 0x01;
                d |= (value << shift);
 
                if (shift == 0)
                {
                   shift = 7;
                   *dp++ = (png_byte)d;
                   d = 0;
@@ -2264,17 +2262,17 @@ png_do_write_interlace(png_row_infop row
 
             dp = row;
             shift = 6;
             d = 0;
 
             for (i = png_pass_start[pass]; i < row_width;
                i += png_pass_inc[pass])
             {
-               sp = row + (png_size_t)(i >> 2);
+               sp = row + (size_t)(i >> 2);
                value = (*sp >> ((3 - (int)(i & 0x03)) << 1)) & 0x03;
                d |= (value << shift);
 
                if (shift == 0)
                {
                   shift = 6;
                   *dp++ = (png_byte)d;
                   d = 0;
@@ -2300,17 +2298,17 @@ png_do_write_interlace(png_row_infop row
             png_uint_32 row_width = row_info->width;
 
             dp = row;
             shift = 4;
             d = 0;
             for (i = png_pass_start[pass]; i < row_width;
                 i += png_pass_inc[pass])
             {
-               sp = row + (png_size_t)(i >> 1);
+               sp = row + (size_t)(i >> 1);
                value = (*sp >> ((1 - (int)(i & 0x01)) << 2)) & 0x0f;
                d |= (value << shift);
 
                if (shift == 0)
                {
                   shift = 4;
                   *dp++ = (png_byte)d;
                   d = 0;
@@ -2326,30 +2324,30 @@ png_do_write_interlace(png_row_infop row
          }
 
          default:
          {
             png_bytep sp;
             png_bytep dp;
             png_uint_32 i;
             png_uint_32 row_width = row_info->width;
-            png_size_t pixel_bytes;
+            size_t pixel_bytes;
 
             /* Start at the beginning */
             dp = row;
 
             /* Find out how many bytes each pixel takes up */
             pixel_bytes = (row_info->pixel_depth >> 3);
 
             /* Loop through the row, only looking at the pixels that matter */
             for (i = png_pass_start[pass]; i < row_width;
                i += png_pass_inc[pass])
             {
                /* Find out where the original pixel is */
-               sp = row + (png_size_t)i * pixel_bytes;
+               sp = row + (size_t)i * pixel_bytes;
 
                /* Move the pixel */
                if (dp != sp)
                   memcpy(dp, sp, pixel_bytes);
 
                /* Next pixel */
                dp += pixel_bytes;
             }
@@ -2370,26 +2368,26 @@ png_do_write_interlace(png_row_infop row
 
 
 /* This filters the row, chooses which filter to use, if it has not already
  * been specified by the application, and then writes the row out with the
  * chosen filter.
  */
 static void /* PRIVATE */
 png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
-    png_size_t row_bytes);
+    size_t row_bytes);
 
 #ifdef PNG_WRITE_FILTER_SUPPORTED
-static png_size_t /* PRIVATE */
+static size_t /* PRIVATE */
 png_setup_sub_row(png_structrp png_ptr, const png_uint_32 bpp,
-    const png_size_t row_bytes, const png_size_t lmins)
+    size_t row_bytes, size_t lmins)
 {
    png_bytep rp, dp, lp;
-   png_size_t i;
-   png_size_t sum = 0;
+   size_t i;
+   size_t sum = 0;
    unsigned int v;
 
    png_ptr->try_row[0] = PNG_FILTER_VALUE_SUB;
 
    for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1; i < bpp;
         i++, rp++, dp++)
    {
       v = *dp = *rp;
@@ -2414,43 +2412,42 @@ png_setup_sub_row(png_structrp png_ptr, 
         break;
    }
 
    return (sum);
 }
 
 static void /* PRIVATE */
 png_setup_sub_row_only(png_structrp png_ptr, const png_uint_32 bpp,
-    const png_size_t row_bytes)
+    size_t row_bytes)
 {
    png_bytep rp, dp, lp;
-   png_size_t i;
+   size_t i;
 
    png_ptr->try_row[0] = PNG_FILTER_VALUE_SUB;
 
    for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1; i < bpp;
         i++, rp++, dp++)
    {
       *dp = *rp;
    }
 
    for (lp = png_ptr->row_buf + 1; i < row_bytes;
       i++, rp++, lp++, dp++)
    {
       *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);
    }
 }
 
-static png_size_t /* PRIVATE */
-png_setup_up_row(png_structrp png_ptr, const png_size_t row_bytes,
-    const png_size_t lmins)
+static size_t /* PRIVATE */
+png_setup_up_row(png_structrp png_ptr, size_t row_bytes, size_t lmins)
 {
    png_bytep rp, dp, pp;
-   png_size_t i;
-   png_size_t sum = 0;
+   size_t i;
+   size_t sum = 0;
    unsigned int v;
 
    png_ptr->try_row[0] = PNG_FILTER_VALUE_UP;
 
    for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
        pp = png_ptr->prev_row + 1; i < row_bytes;
        i++, rp++, pp++, dp++)
    {
@@ -2463,38 +2460,38 @@ png_setup_up_row(png_structrp png_ptr, c
 
       if (sum > lmins)  /* We are already worse, don't continue. */
         break;
    }
 
    return (sum);
 }
 static void /* PRIVATE */
-png_setup_up_row_only(png_structrp png_ptr, const png_size_t row_bytes)
+png_setup_up_row_only(png_structrp png_ptr, size_t row_bytes)
 {
    png_bytep rp, dp, pp;
-   png_size_t i;
+   size_t i;
 
    png_ptr->try_row[0] = PNG_FILTER_VALUE_UP;
 
    for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
        pp = png_ptr->prev_row + 1; i < row_bytes;
        i++, rp++, pp++, dp++)
    {
       *dp = (png_byte)(((int)*rp - (int)*pp) & 0xff);
    }
 }
 
-static png_size_t /* PRIVATE */
+static size_t /* PRIVATE */
 png_setup_avg_row(png_structrp png_ptr, const png_uint_32 bpp,
-    const png_size_t row_bytes, const png_size_t lmins)
+    size_t row_bytes, size_t lmins)
 {
    png_bytep rp, dp, pp, lp;
    png_uint_32 i;
-   png_size_t sum = 0;
+   size_t sum = 0;
    unsigned int v;
 
    png_ptr->try_row[0] = PNG_FILTER_VALUE_AVG;
 
    for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
        pp = png_ptr->prev_row + 1; i < bpp; i++)
    {
       v = *dp++ = (png_byte)(((int)*rp++ - ((int)*pp++ / 2)) & 0xff);
@@ -2520,17 +2517,17 @@ png_setup_avg_row(png_structrp png_ptr, 
       if (sum > lmins)  /* We are already worse, don't continue. */
         break;
    }
 
    return (sum);
 }
 static void /* PRIVATE */
 png_setup_avg_row_only(png_structrp png_ptr, const png_uint_32 bpp,
-    const png_size_t row_bytes)
+    size_t row_bytes)
 {
    png_bytep rp, dp, pp, lp;
    png_uint_32 i;
 
    png_ptr->try_row[0] = PNG_FILTER_VALUE_AVG;
 
    for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
        pp = png_ptr->prev_row + 1; i < bpp; i++)
@@ -2540,23 +2537,23 @@ png_setup_avg_row_only(png_structrp png_
 
    for (lp = png_ptr->row_buf + 1; i < row_bytes; i++)
    {
       *dp++ = (png_byte)(((int)*rp++ - (((int)*pp++ + (int)*lp++) / 2))
           & 0xff);
    }
 }
 
-static png_size_t /* PRIVATE */
+static size_t /* PRIVATE */
 png_setup_paeth_row(png_structrp png_ptr, const png_uint_32 bpp,
-    const png_size_t row_bytes, const png_size_t lmins)
+    size_t row_bytes, size_t lmins)
 {
    png_bytep rp, dp, pp, cp, lp;
-   png_size_t i;
-   png_size_t sum = 0;
+   size_t i;
+   size_t sum = 0;
    unsigned int v;
 
    png_ptr->try_row[0] = PNG_FILTER_VALUE_PAETH;
 
    for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
        pp = png_ptr->prev_row + 1; i < bpp; i++)
    {
       v = *dp++ = (png_byte)(((int)*rp++ - (int)*pp++) & 0xff);
@@ -2603,20 +2600,20 @@ png_setup_paeth_row(png_structrp png_ptr
       if (sum > lmins)  /* We are already worse, don't continue. */
         break;
    }
 
    return (sum);
 }
 static void /* PRIVATE */
 png_setup_paeth_row_only(png_structrp png_ptr, const png_uint_32 bpp,
-    const png_size_t row_bytes)
+    size_t row_bytes)
 {
    png_bytep rp, dp, pp, cp, lp;
-   png_size_t i;
+   size_t i;
 
    png_ptr->try_row[0] = PNG_FILTER_VALUE_PAETH;
 
    for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
        pp = png_ptr->prev_row + 1; i < bpp; i++)
    {
       *dp++ = (png_byte)(((int)*rp++ - (int)*pp++) & 0xff);
    }
@@ -2655,18 +2652,18 @@ png_write_find_filter(png_structrp png_p
 {
 #ifndef PNG_WRITE_FILTER_SUPPORTED
    png_write_filtered_row(png_ptr, png_ptr->row_buf, row_info->rowbytes+1);
 #else
    unsigned int filter_to_do = png_ptr->do_filter;
    png_bytep row_buf;
    png_bytep best_row;
    png_uint_32 bpp;
-   png_size_t mins;
-   png_size_t row_bytes = row_info->rowbytes;
+   size_t mins;
+   size_t row_bytes = row_info->rowbytes;
 
    png_debug(1, "in png_write_find_filter");
 
    /* Find out how many bytes offset each pixel is */
    bpp = (row_info->pixel_depth + 7) >> 3;
 
    row_buf = png_ptr->row_buf;
    mins = PNG_SIZE_MAX - 256/* so we can detect potential overflow of the
@@ -2711,18 +2708,18 @@ png_write_find_filter(png_structrp png_p
    }
    else if ((filter_to_do & PNG_FILTER_NONE) != 0 &&
          filter_to_do != PNG_FILTER_NONE)
    {
       /* Overflow not possible and multiple filters in the list, including the
        * 'none' filter.
        */
       png_bytep rp;
-      png_size_t sum = 0;
-      png_size_t i;
+      size_t sum = 0;
+      size_t i;
       unsigned int v;
 
       {
          for (i = 0, rp = row_buf + 1; i < row_bytes; i++, rp++)
          {
             v = *rp;
 #ifdef PNG_USE_ABS
             sum += 128 - abs((int)v - 128);
@@ -2740,18 +2737,18 @@ png_write_find_filter(png_structrp png_p
    /* It's the only filter so no testing is needed */
    {
       png_setup_sub_row_only(png_ptr, bpp, row_bytes);
       best_row = png_ptr->try_row;
    }
 
    else if ((filter_to_do & PNG_FILTER_SUB) != 0)
    {
-      png_size_t sum;
-      png_size_t lmins = mins;
+      size_t sum;
+      size_t lmins = mins;
 
       sum = png_setup_sub_row(png_ptr, bpp, row_bytes, lmins);
 
       if (sum < mins)
       {
          mins = sum;
          best_row = png_ptr->try_row;
          if (png_ptr->tst_row != NULL)
@@ -2766,18 +2763,18 @@ png_write_find_filter(png_structrp png_p
    if (filter_to_do == PNG_FILTER_UP)
    {
       png_setup_up_row_only(png_ptr, row_bytes);
       best_row = png_ptr->try_row;
    }
 
    else if ((filter_to_do & PNG_FILTER_UP) != 0)
    {
-      png_size_t sum;
-      png_size_t lmins = mins;
+      size_t sum;
+      size_t lmins = mins;
 
       sum = png_setup_up_row(png_ptr, row_bytes, lmins);
 
       if (sum < mins)
       {
          mins = sum;
          best_row = png_ptr->try_row;
          if (png_ptr->tst_row != NULL)
@@ -2792,18 +2789,18 @@ png_write_find_filter(png_structrp png_p
    if (filter_to_do == PNG_FILTER_AVG)
    {
       png_setup_avg_row_only(png_ptr, bpp, row_bytes);
       best_row = png_ptr->try_row;
    }
 
    else if ((filter_to_do & PNG_FILTER_AVG) != 0)
    {
-      png_size_t sum;
-      png_size_t lmins = mins;
+      size_t sum;
+      size_t lmins = mins;
 
       sum= png_setup_avg_row(png_ptr, bpp, row_bytes, lmins);
 
       if (sum < mins)
       {
          mins = sum;
          best_row = png_ptr->try_row;
          if (png_ptr->tst_row != NULL)
@@ -2818,18 +2815,18 @@ png_write_find_filter(png_structrp png_p
    if (filter_to_do == PNG_FILTER_PAETH)
    {
       png_setup_paeth_row_only(png_ptr, bpp, row_bytes);
       best_row = png_ptr->try_row;
    }
 
    else if ((filter_to_do & PNG_FILTER_PAETH) != 0)
    {
-      png_size_t sum;
-      png_size_t lmins = mins;
+      size_t sum;
+      size_t lmins = mins;
 
       sum = png_setup_paeth_row(png_ptr, bpp, row_bytes, lmins);
 
       if (sum < mins)
       {
          best_row = png_ptr->try_row;
          if (png_ptr->tst_row != NULL)
          {
@@ -2844,17 +2841,17 @@ png_write_find_filter(png_structrp png_p
 
 #endif /* WRITE_FILTER */
 }
 
 
 /* Do the actual writing of a previously filtered row. */
 static void
 png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
-    png_size_t full_row_length/*includes filter byte*/)
+    size_t full_row_length/*includes filter byte*/)
 {
    png_debug(1, "in png_write_filtered_row");
 
    png_debug1(2, "filter = %d", filtered_row[0]);
 
    png_compress_IDAT(png_ptr, filtered_row, full_row_length, Z_NO_FLUSH);
 
 #ifdef PNG_WRITE_FILTER_SUPPORTED
--- a/media/libpng/powerpc/filter_vsx_intrinsics.c
+++ b/media/libpng/powerpc/filter_vsx_intrinsics.c
@@ -37,18 +37,18 @@
  * whichever of a, b, or c is closest to p=a+b-c.
  * ( this is taken from ../intel/filter_sse2_intrinsics.c )
  */
 
 #define vsx_declare_common_vars(row_info,row,prev_row,offset) \
    png_byte i;\
    png_bytep rp = row + offset;\
    png_const_bytep pp = prev_row;\
-   png_size_t unaligned_top = 16 - (((png_size_t)rp % 16));\
-   png_size_t istop;\
+   size_t unaligned_top = 16 - (((size_t)rp % 16));\
+   size_t istop;\
    if(unaligned_top == 16)\
       unaligned_top = 0;\
    istop = row_info->rowbytes;\
    if((unaligned_top < istop))\
       istop -= unaligned_top;\
    else{\
       unaligned_top = istop;\
       istop = 0;\
--- a/old-configure.in
+++ b/old-configure.in
@@ -41,17 +41,17 @@ dnl ====================================
 _SUBDIR_HOST_CFLAGS="$HOST_CFLAGS"
 _SUBDIR_HOST_CXXFLAGS="$HOST_CXXFLAGS"
 _SUBDIR_HOST_LDFLAGS="$HOST_LDFLAGS"
 _SUBDIR_CONFIG_ARGS="$ac_configure_args"
 
 dnl Set the version number of the libs included with mozilla
 dnl ========================================================
 MOZJPEG=62
-MOZPNG=10634
+MOZPNG=10635
 NSPR_VERSION=4
 NSPR_MINVER=4.19
 NSS_VERSION=3
 
 dnl Set the minimum version of toolkit libs used by mozilla
 dnl ========================================================
 GLIB_VERSION=2.22
 # 2_26 is the earliest version we can set GLIB_VERSION_MIN_REQUIRED.