Bug 544747 - Update libpng to version 1.4.1. r=joe
authorGlenn Randers-Pehrson <glennrp+bmo@gmail.com>
Tue, 09 Mar 2010 13:22:44 -0500
changeset 39164 e9a5b0c0bd338860aff2b1d99b3e2045aec36970
parent 39163 c4b4efecdaee59a84ef09049637d14a30bbcc0e4
child 39165 29cb33290f7e5bebde5158f6f227f1affc3cf7bb
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersjoe
bugs544747
milestone1.9.3a3pre
Bug 544747 - Update libpng to version 1.4.1. r=joe
modules/libimg/png/CHANGES
modules/libimg/png/LICENSE
modules/libimg/png/MOZCHANGES
modules/libimg/png/README
modules/libimg/png/libpng.txt
modules/libimg/png/mozpngconf.h
modules/libimg/png/png.c
modules/libimg/png/png.h
modules/libimg/png/pngconf.h
modules/libimg/png/pngget.c
modules/libimg/png/pngmem.c
modules/libimg/png/pngpread.c
modules/libimg/png/pngpriv.h
modules/libimg/png/pngread.c
modules/libimg/png/pngrio.c
modules/libimg/png/pngrtran.c
modules/libimg/png/pngrutil.c
modules/libimg/png/pngset.c
modules/libimg/png/pngwrite.c
modules/libimg/png/pngwtran.c
modules/libimg/png/pngwutil.c
modules/libpr0n/decoders/png/nsPNGDecoder.cpp
--- a/modules/libimg/png/CHANGES
+++ b/modules/libimg/png/CHANGES
@@ -2453,16 +2453,92 @@ version 1.4.0rc07 [January 1, 2010]
 
 version 1.4.0rc08 [January 2, 2010]
   Avoid deprecated references to png_ptr-io_ptr and png_ptr->error_ptr
     in pngtest.c
 
 version 1.4.0 [January 3, 2010]
   No changes.
 
+version 1.4.1beta01 [January 8, 2010]
+  Updated CMakeLists.txt for consistent indentation and to avoid an
+    unclosed if-statement warning (Philip Lowman).
+  Revised Makefile.am and Makefile.in to remove references to Y2KINFO,
+    KNOWNBUG, and libpng.la (Robert Schwebel).
+  Revised the makefiles to install the same files and symbolic
+    links as configure, except for libpng.la and libpng14.la.
+  Make png_set|get_compression_buffer_size() available even when
+    PNG_WRITE_SUPPORTED is not enabled.
+  Revised Makefile.am and Makefile.in to simplify their maintenance.
+  Revised scripts/makefile.linux to install a link to libpng14.so.14.1
+
+version 1.4.1beta02 [January 9, 2010]
+  Revised the rest of the makefiles to install a link to libpng14.so.14.1
+
+version 1.4.1beta03 [January 10, 2010]
+  Removed png_set_premultiply_alpha() from scripts/*.def
+
+version 1.4.1rc01 [January 16, 2010]
+  No changes.
+
+version 1.4.1beta04 [January 23, 2010]
+  Revised png_decompress_chunk() to improve speed and memory usage when
+    decoding large chunks.
+  Added png_set|get_chunk_malloc_max() functions.
+
+version 1.4.1beta05 [January 26, 2010]
+  Relocated "int k" declaration in pngtest.c to minimize its scope.
+
+version 1.4.1beta06 [January 28, 2010]
+  Revised png_decompress_chunk() to use a two-pass method suggested by
+    John Bowler.
+
+version 1.4.1beta07 [February 6, 2010]
+  Folded some long lines in the source files.
+  Added defineable PNG_USER_CHUNK_CACHE_MAX, PNG_USER_CHUNK_MALLOC_MAX,
+    and a PNG_USER_LIMITS_SUPPORTED flag.
+  Eliminated use of png_ptr->irowbytes and reused the slot in png_ptr as
+    png_ptr->png_user_chunk_malloc_max.
+  Revised png_push_save_buffer() to do fewer but larger png_malloc() calls.
+
+version 1.4.1beta08 [February 6, 2010]
+  Minor cleanup and updating of dates and copyright year.
+
+version 1.4.1beta09 [February 7, 2010]
+  Reverted to original png_push_save_buffer() code.
+
+version 1.4.1beta10 [February 9, 2010]
+  Return allocated "old_buffer" in png_push_save_buffer() before calling
+    png_error(), to avoid a potential memory leak.
+
+version 1.4.1beta11 [February 12, 2010]
+  Relocated misplaced closing curley bracket in png_decompress_chunk().
+  Removed unused "buffer_size" variable from png_decompress_chunk().
+  Removed the cbuilder5 project, which has not been updated to 1.4.0.
+  Complete rewrite of two-pass png_decompress_chunk() by John Bowler.
+
+version 1.4.1beta12 [February 14, 2010]
+  Fixed type declaration of png_get_user_malloc_max() in pngget.c (Daisuke
+    Nishikawa)
+
+version 1.4.1rc02 [January 18, 2010]
+  No changes.
+
+version 1.4.1rc03 [February 19, 2010]
+  Noted in scripts/makefile.mingw that it expects to be run under MSYS.
+  Removed obsolete unused MMX-querying support from contrib/gregbook
+  Removed the AIX redefinition of jmpbuf in png.h
+  Define _ALL_SOURCE in configure.ac, makefile.aix, and CMakeLists.txt
+    when using AIX compiler.
+
+version 1.4.1rc04 [February 19, 2010]
+  Removed unused gzio.c from contrib/pngminim gather and makefile scripts
+
+version 1.4.1 [February 25, 2010]
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
 to subscribe)
 or to glennrp at users.sourceforge.net
 
 Glenn R-P
 */ }
--- a/modules/libimg/png/LICENSE
+++ b/modules/libimg/png/LICENSE
@@ -5,17 +5,17 @@ included in the libpng distribution, the
 
 COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
 
 If you modify libpng you may insert additional notices immediately following
 this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.2.6, August 15, 2004, through 1.4.0, January 3, 2010, are
+libpng versions 1.2.6, August 15, 2004, through 1.4.1, February 25, 2010, are
 Copyright (c) 2004, 2006-2007 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
 
    Cosmin Truta
 
 libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are
 Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are
@@ -103,9 +103,9 @@ boxes and the like:
 Also, the PNG logo (in PNG format, of course) is supplied in the
 files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31).
 
 Libpng is OSI Certified Open Source Software.  OSI Certified Open Source is a
 certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-January 3, 2010
+February 25, 2010
--- a/modules/libimg/png/MOZCHANGES
+++ b/modules/libimg/png/MOZCHANGES
@@ -1,11 +1,13 @@
 
 Changes made to pristine png source by mozilla.org developers.
 
+2010/02/26  -- Synced with libpng-1.4.1 (bug #544747).
+
 2010/01/04  -- Synced with libpng-1.4.0 (bug #532645).
 
 2009/09/10  -- Synced with libpng-1.2.40 (bug #492200 and #504805).
                Moved location of acTL chunk to just after IHDR
                in output PNG file.
 
 2009/06/01  -- Eliminated incorrect test and rejection of APNG
                blend_op in opaque images (bug #441971 and #455140).
--- a/modules/libimg/png/README
+++ b/modules/libimg/png/README
@@ -1,9 +1,9 @@
-README for libpng version 1.4.0 - January 3, 2010 (shared library 14.0)
+README for libpng version 1.4.1 - February 25, 2010 (shared library 14.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
 
 Libpng comes in several distribution formats.  Get libpng-*.tar.gz,
 libpng-*.tar.xz or libpng-*.tar.bz2 if you want UNIX-style line endings
 in the text files, or lpng*.zip if you want DOS-style line endings.
 
@@ -180,19 +180,19 @@ Files in this distribution:
                             libpng and zlib
        visualc6         =>  Contains a Microsoft Visual C++ (MSVC)
                             workspace for building libpng and zlib
       scripts       =>  Directory containing scripts for building libpng:
        descrip.mms      =>  VMS makefile for MMS or MMK
        makefile.std     =>  Generic UNIX makefile (cc, creates static
                             libpng.a)
        makefile.elf     =>  Linux/ELF makefile symbol versioning,
-                            gcc, creates libpng14.so.14.1.4.0)
+                            gcc, creates libpng14.so.14.1.4.1)
        makefile.linux   =>  Linux/ELF makefile
-                            (gcc, creates libpng14.so.14.1.4.0)
+                            (gcc, creates libpng14.so.14.1.4.1)
        makefile.gcc     =>  Generic makefile (gcc, creates static libpng.a)
        makefile.knr     =>  Archaic UNIX Makefile that converts files with
                             ansi2knr (Requires ansi2knr.c from
                             ftp://ftp.cs.wisc.edu/ghost)
        makefile.aix     =>  AIX makefile
        makefile.cygwin  =>  Cygwin/gcc makefile
        makefile.darwin  =>  Darwin makefile
        makefile.dec     =>  DEC Alpha UNIX makefile
@@ -204,22 +204,22 @@ Files in this distribution:
        makefile.intel   =>  Intel C/C++ version 4.0 and later
        makefile.mingw   =>  Mingw/gcc makefile
        makefile.netbsd  =>  NetBSD/cc makefile, makes libpng.so.
        makefile.ne14bsd  =>  NetBSD/cc makefile, makes
                             libpng14.so
        makefile.openbsd =>  OpenBSD makefile
        makefile.sgi     =>  Silicon Graphics IRIX (cc, creates static lib)
        makefile.sggcc   =>  Silicon Graphics
-                            (gcc, creates libpng14.so.14.1.4.0)
+                            (gcc, creates libpng14.so.14.1.4.1)
        makefile.sunos   =>  Sun makefile
        makefile.solaris =>  Solaris 2.X makefile
-                            (gcc, creates libpng14.so.14.1.4.0)
+                            (gcc, creates libpng14.so.14.1.4.1)
        makefile.so9     =>  Solaris 9 makefile
-                            (gcc, creates libpng14.so.14.1.4.0)
+                            (gcc, creates libpng14.so.14.1.4.1)
        makefile.32sunu  =>  Sun Ultra 32-bit makefile
        makefile.64sunu  =>  Sun Ultra 64-bit makefile
        makefile.sco     =>  For SCO OSr5  ELF and Unixware 7 with Native cc
        makefile.mips    =>  MIPS makefile
        makefile.acorn   =>  Acorn makefile
        makefile.amiga   =>  Amiga makefile
        smakefile.ppc    =>  AMIGA smakefile for SAS C V6.58/7.00 PPC
                             compiler (Requires SCOPTIONS, copied from
--- a/modules/libimg/png/libpng.txt
+++ b/modules/libimg/png/libpng.txt
@@ -1,22 +1,22 @@
 libpng.txt - A description on how to use and modify libpng
 
- libpng version 1.4.0 - January 3, 2010
+ libpng version 1.4.1 - February 25, 2010
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2009 Glenn Randers-Pehrson
 
  This document is released under the libpng license.
  For conditions of distribution and use, see the disclaimer
  and license in png.h
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.4.0 - January 3, 2010
+ libpng versions 0.97, January 1998, through 1.4.1 - February 25, 2010
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2009 Glenn Randers-Pehrson
 
  libpng 1.0 beta 6  version 0.96 May 28, 1997
  Updated and distributed by Andreas Dilger
  Copyright (c) 1996, 1997 Andreas Dilger
 
  libpng 1.0 beta 2 - version 0.88  January 26, 1996
@@ -255,16 +255,25 @@ section below.
     png_init_io(png_ptr, fp);
 
 If you had previously opened the file and read any of the signature from
 the beginning in order to see if this was a PNG file, you need to let
 libpng know that there are some bytes missing from the start of the file.
 
     png_set_sig_bytes(png_ptr, number);
 
+You can change the zlib compression buffer size to be used while
+reading compressed data with
+
+    png_set_compression_buffer_size(png_ptr, buffer_size);
+
+where the default size is 8192 bytes.  Note that the buffer size
+is changed immediately and the buffer is reallocated immediately,
+instead of setting a flag to be acted upon later.
+
 Setting up callback code
 
 You can set up a callback function to handle any unknown chunks in the
 input stream. You must supply the function
 
     read_chunk_callback(png_ptr ptr,
          png_unknown_chunkp chunk);
     {
@@ -418,16 +427,28 @@ of sPLT, tEXt, iTXt, zTXt, and unknown c
 
 where 0x7fffffffL means unlimited.  You can retrieve this limit with
 
    chunk_cache_max = png_get_chunk_cache_max(png_ptr);
 
 This limit also applies to the number of buffers that can be allocated
 by png_decompress_chunk() while decompressing iTXt, zTXt, and iCCP chunks.
 
+You can also set a limit on the amount of memory that a compressed chunk
+other than IDAT can occupy, with
+
+   png_set_chunk_malloc_max(png_ptr, user_chunk_malloc_max);
+
+and you can retrieve the limit with
+
+   chunk_malloc_max = png_get_chunk_malloc_max(png_ptr);
+
+Any chunks that would cause either of these limits to be exceeded will
+be ignored.
+
 The high-level read interface
 
 At this point there are two ways to proceed; through the high-level
 read interface, or through a sequence of low-level read operations.
 You can use the high-level interface if (a) you are willing to read
 the entire image into memory, and (b) the input transformations
 you want to do are limited to the following set:
 
@@ -873,17 +894,17 @@ viewing application that wishes to treat
 These three functions are actually aliases for png_set_expand(), added
 in libpng version 1.0.4, with the function names expanded to improve code
 readability.  In some future version they may actually do different
 things.
 
 As of libpng version 1.2.9, png_set_expand_gray_1_2_4_to_8() was
 added.  It expands the sample depth without changing tRNS to alpha.
 
-As of libpng version 1.4.0, not all possible expansions are supported.
+As of libpng version 1.4.1, not all possible expansions are supported.
 
 In the following table, the 01 means grayscale with depth<8, 31 means
 indexed with depth<8, other numerals represent the color type, "T" means
 the tRNS chunk is present, A means an alpha channel is present, and O
 means tRNS or alpha is present but all pixels in the image are opaque.
 
   FROM  01  31   0  0T  0O   2  2T  2O   3  3T  3O  4A  4O  6A  6O 
    TO
@@ -2474,17 +2495,17 @@ png_create_write_struct_2() to register 
 above.  These functions also provide a void pointer that can be retrieved
 via
 
     mem_ptr=png_get_mem_ptr(png_ptr);
 
 Your replacement memory functions must have prototypes as follows:
 
     png_voidp malloc_fn(png_structp png_ptr,
-       png_size_t size);
+       png_alloc_size_t size);
     void free_fn(png_structp png_ptr, png_voidp ptr);
 
 Your malloc_fn() must return NULL in case of failure.  The png_malloc()
 function will normally call png_error() if it receives a NULL from the
 system memory allocator or from your replacement malloc_fn().
 
 Your free_fn() will never be called with a NULL ptr, since libpng's
 png_free() checks for NULL before calling free_fn().
@@ -3058,16 +3079,18 @@ deprecated since libpng-1.0.18 and 1.2.9
 png_set_expand_gray_1_2_4_to_8() because the former function also
 expanded palette images.
 
 We changed the prototype for png_malloc() from
     png_malloc(png_structp png_ptr, png_uint_32 size)
 to
     png_malloc(png_structp png_ptr, png_alloc_size_t size)
 
+This also applies to the prototype for the user replacement malloc_fn().
+
 The png_calloc() function was added and is used in place of
 of "png_malloc(); png_memset();" except in the case in png_read_png()
 where the array consists of pointers; in this case a "for" loop is used
 after the png_malloc() to set the pointers to NULL, to give robust.
 behavior in case the application runs out of memory part-way through
 the process.
 
 We changed the prototypes of png_get_compression_buffer_size() and
@@ -3217,23 +3240,23 @@ when there is only one macro being teste
 We do not use the TAB character for indentation in the C sources.
 
 Lines do not exceed 80 characters.
 
 Other rules can be inferred by inspecting the libpng source.
 
 XIII. Y2K Compliance in libpng
 
-January 3, 2010
+February 25, 2010
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.4.0 are Y2K compliant.  It is my belief that earlier
+upward through 1.4.1 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that
 will hold years up to 65535.  The other two hold the date in text
 format, and will hold years up to 9999.
 
 The integer is
     "png_uint_16 year" in png_time_struct.
--- a/modules/libimg/png/mozpngconf.h
+++ b/modules/libimg/png/mozpngconf.h
@@ -33,21 +33,25 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZPNGCONF_H
 #define MOZPNGCONF_H
 
+#define PNG_USER_CHUNK_MALLOC_MAX 4000000L
+
 #define PNG_NO_GLOBAL_ARRAYS
 
 #ifndef MOZ_PNG_READ
 #define PNG_NO_READ_SUPPORTED
 #endif
+#define PNG_NO_SET_USER_LIMITS
+#define PNG_NO_USER_LIMITS
 #define PNG_NO_ASSEMBLER_CODE
 #define PNG_NO_WARN_UNINITIALIZED_ROW
 #define PNG_NO_READ_BACKGROUND
 #define PNG_NO_READ_DITHER
 #define PNG_NO_READ_INVERT
 #define PNG_NO_READ_SHIFT
 #define PNG_NO_READ_PACK
 #define PNG_NO_READ_PACKSWAP
@@ -107,16 +111,17 @@
 #define PNG_NO_WRITE_USER_CHUNKS
 #define PNG_NO_WRITE_EMPTY_PLTE
 #define PNG_NO_WRITE_OPT_PLTE
 #define PNG_NO_WRITE_FILTER
 #define PNG_NO_WRITE_WEIGHTED_FILTER
 #define PNG_NO_WRITE_INTERLACING_SUPPORTED  /* effective libpng-1.3.0 */
 #endif
 
+#define PNG_NO_HANDLE_AS_UNKNOWN
 #define PNG_NO_INFO_IMAGE
 #define PNG_NO_USER_MEM
 #define PNG_NO_FIXED_POINT_SUPPORTED
 #define PNG_NO_MNG_FEATURES
 #define PNG_NO_USER_TRANSFORM_PTR
 #define PNG_NO_CONSOLE_IO
 #define PNG_NO_ZALLOC_ZERO
 #define PNG_NO_ERROR_NUMBERS
--- a/modules/libimg/png/png.c
+++ b/modules/libimg/png/png.c
@@ -1,28 +1,28 @@
 
 /* png.c - location for general purpose libpng functions
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
 #define PNG_NO_EXTERN
 #define PNG_NO_PEDANTIC_WARNINGS
 #include "png.h"
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_4_0 Your_png_h_is_not_version_1_4_0;
+typedef version_1_4_1 Your_png_h_is_not_version_1_4_1;
 
 /* Version information for C files.  This had better match the version
  * string defined in png.h.
  */
 
 /* Tells libpng that we have already handled the first "num_bytes" bytes
  * of the PNG file signature.  If the PNG data is embedded into another
  * stream we can set num_bytes = 8 so that libpng will not attempt to read
@@ -546,23 +546,23 @@ png_charp PNGAPI
 png_get_copyright(png_structp png_ptr)
 {
    png_ptr = png_ptr;  /* Silence compiler warning about unused png_ptr */
 #ifdef PNG_STRING_COPYRIGHT
       return PNG_STRING_COPYRIGHT
 #else
 #ifdef __STDC__
    return ((png_charp) PNG_STRING_NEWLINE \
-     "libpng version 1.4.0 - January 3, 2010" PNG_STRING_NEWLINE \
+     "libpng version 1.4.1 - February 25, 2010" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2010 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE);
 #else
-      return ((png_charp) "libpng version 1.4.0 - January 3, 2010\
+      return ((png_charp) "libpng version 1.4.1 - February 25, 2010\
       Copyright (c) 1998-2010 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.");
 #endif
 #endif
 }
 
 /* The following return the library version as a short string in the
--- a/modules/libimg/png/png.h
+++ b/modules/libimg/png/png.h
@@ -1,22 +1,22 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.4.0 - January 3, 2010
+ * libpng version 1.4.1 - February 25, 2010
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license (See LICENSE, below)
  *
  * Authors and maintainers:
  *  libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *  libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *  libpng versions 0.97, January 1998, through 1.4.0 - January 3, 2010: Glenn
+ *  libpng versions 0.97, January 1998, through 1.4.1 - February 25, 2010: Glenn
  *  See also "Contributing Authors", below.
  *
  * Note about libpng version numbers:
  *
  *    Due to various miscommunications, unforeseen code incompatibilities
  *    and occasional factors outside the authors' control, version numbering
  *    on the library has not always been consistent and straightforward.
  *    The following table summarizes matters since version 0.89c, which was
@@ -129,16 +129,21 @@
  *    1.4.0beta9-14           14    10400  14.so.0.0[.0]
  *    1.2.13                  13    10213  12.so.0.13[.0]
  *    1.4.0beta15-36          14    10400  14.so.0.0[.0]
  *    1.4.0beta37-87          14    10400  14.so.14.0[.0]
  *    1.4.0rc01               14    10400  14.so.14.0[.0]
  *    1.4.0beta88-109         14    10400  14.so.14.0[.0]
  *    1.4.0rc02-08            14    10400  14.so.14.0[.0]
  *    1.4.0                   14    10400  14.so.14.0[.0]
+ *    1.4.1beta01-03          14    10401  14.so.14.1[.0]
+ *    1.4.1rc01               14    10401  14.so.14.1[.0]
+ *    1.4.1beta04-12          14    10401  14.so.14.1[.0]
+ *    1.4.1rc02-04            14    10401  14.so.14.1[.0]
+ *    1.4.1                   14    10401  14.so.14.1[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
  *    used for changes in backward compatibility, as it is intended.  The
  *    PNG_LIBPNG_VER macro, which is not used within libpng but is available
  *    for applications, is an unsigned integer of the form xyyzz corresponding
  *    to the source version x.y.z (leading zeros in y and z).  Beta versions
  *    were given the previous public release number plus a letter, until
@@ -160,17 +165,17 @@
 /*
  * COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
  *
  * If you modify libpng you may insert additional notices immediately following
  * this sentence.
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.2.6, August 15, 2004, through 1.4.0, January 3, 2010, are
+ * libpng versions 1.2.6, August 15, 2004, through 1.4.1, February 25, 2010, are
  * Copyright (c) 2004, 2006-2010 Glenn Randers-Pehrson, and are
  * distributed according to the same disclaimer and license as libpng-1.2.5
  * with the following individual added to the list of Contributing Authors:
  *
  *    Cosmin Truta
  *
  * libpng versions 1.0.7, July 1, 2000, through 1.2.5, October 3, 2002, are
  * Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are
@@ -272,23 +277,23 @@
  *
  * Thanks to Frank J. T. Wojcik for helping with the documentation.
  */
 
 /*
  * Y2K compliance in libpng:
  * =========================
  *
- *    January 3, 2010
+ *    February 25, 2010
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.4.0 are Y2K compliant.  It is my belief that earlier
+ *    upward through 1.4.1 are Y2K compliant.  It is my belief that earlier
  *    versions were also Y2K compliant.
  *
  *    Libpng only has three year fields.  One is a 2-byte unsigned integer
  *    that will hold years up to 65535.  The other two hold the date in text
  *    format, and will hold years up to 9999.
  *
  *    The integer is
  *        "png_uint_16 year" in png_time_struct.
@@ -334,27 +339,27 @@
 
 /* This is not the place to learn how to use libpng.  The file libpng.txt
  * describes how to use libpng, and the file example.c summarizes it
  * with some code on which to build.  This file is useful for looking
  * at the actual function definitions and structure components.
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.4.0"
+#define PNG_LIBPNG_VER_STRING "1.4.1"
 #define PNG_HEADER_VERSION_STRING \
-   " libpng version 1.4.0 - January 3, 2010\n"
+   " libpng version 1.4.1 - February 25, 2010\n"
 
 #define PNG_LIBPNG_VER_SONUM   14
 #define PNG_LIBPNG_VER_DLLNUM  14
 
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   4
-#define PNG_LIBPNG_VER_RELEASE 0
+#define PNG_LIBPNG_VER_RELEASE 1
 /* This should match the numeric part of the final component of
  * PNG_LIBPNG_VER_STRING, omitting any leading zero:
  */
 
 #define PNG_LIBPNG_VER_BUILD  0
 
 /* Release Status */
 #define PNG_LIBPNG_BUILD_ALPHA    1
@@ -374,27 +379,23 @@
 #define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_BETA
 
 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
  * We must not include leading zeros.
  * Versions 0.7 through 1.0.0 were in the range 0 to 100 here (only
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
  * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
  */
-#define PNG_LIBPNG_VER 10400 /* 1.4.0 */
+#define PNG_LIBPNG_VER 10401 /* 1.4.1 */
 
 #ifndef PNG_VERSION_INFO_ONLY
 /* Include the compression library's header */
 #include "zlib.h"
 #endif
 
-#ifdef AIX
-#define jmpbuf __jmpbuf
-#endif
-
 /* Include all user configurable info, including optional assembler routines */
 #include "pngconf.h"
 
 /*
  * Added at libpng-1.2.8
  *
  * Ref MSDN: Private as priority over Special
  * VS_FF_PRIVATEBUILD File *was not* built using standard release
@@ -624,54 +625,69 @@ typedef png_unknown_chunk FAR * FAR * pn
  * passed (they make their own copies), EXCEPT that the png_set_text
  * functions use the same storage passed to them in the text_ptr or
  * itxt_ptr structure argument, and the png_set_rows and png_set_unknowns
  * functions do not make their own copies.
  */
 typedef struct png_info_struct
 {
    /* the following are necessary for every PNG file */
-   png_uint_32 width PNG_DEPSTRUCT;       /* width of image in pixels (from IHDR) */
-   png_uint_32 height PNG_DEPSTRUCT;      /* height of image in pixels (from IHDR) */
-   png_uint_32 valid PNG_DEPSTRUCT;       /* valid chunk data (see PNG_INFO_ below) */
-   png_size_t rowbytes PNG_DEPSTRUCT;     /* bytes needed to hold an untransformed row */
-   png_colorp palette PNG_DEPSTRUCT;      /* array of color values (valid & PNG_INFO_PLTE) */
-   png_uint_16 num_palette PNG_DEPSTRUCT; /* number of color entries in "palette" (PLTE) */
-   png_uint_16 num_trans PNG_DEPSTRUCT;   /* number of transparent palette color (tRNS) */
-   png_byte bit_depth PNG_DEPSTRUCT;      /* 1, 2, 4, 8, or 16 bits/channel (from IHDR) */
-   png_byte color_type PNG_DEPSTRUCT;     /* see PNG_COLOR_TYPE_ below (from IHDR) */
+   png_uint_32 width PNG_DEPSTRUCT;  /* width of image in pixels (from IHDR) */
+   png_uint_32 height PNG_DEPSTRUCT; /* height of image in pixels (from IHDR) */
+   png_uint_32 valid PNG_DEPSTRUCT;  /* valid chunk data (see PNG_INFO_
+                                        below) */
+   png_size_t rowbytes PNG_DEPSTRUCT; /* bytes needed to hold an untransformed
+                                         row */
+   png_colorp palette PNG_DEPSTRUCT;      /* array of color values
+                                             (valid & PNG_INFO_PLTE) */
+   png_uint_16 num_palette PNG_DEPSTRUCT; /* number of color entries in
+                                             "palette" (PLTE) */
+   png_uint_16 num_trans PNG_DEPSTRUCT;   /* number of transparent palette
+                                             color (tRNS) */
+   png_byte bit_depth PNG_DEPSTRUCT;      /* 1, 2, 4, 8, or 16 bits/channel
+                                             (from IHDR) */
+   png_byte color_type PNG_DEPSTRUCT;     /* see PNG_COLOR_TYPE_ below
+                                             (from IHDR) */
    /* The following three should have been named *_method not *_type */
-   png_byte compression_type PNG_DEPSTRUCT; /* must be PNG_COMPRESSION_TYPE_BASE (IHDR) */
-   png_byte filter_type PNG_DEPSTRUCT;    /* must be PNG_FILTER_TYPE_BASE (from IHDR) */
-   png_byte interlace_type PNG_DEPSTRUCT; /* One of PNG_INTERLACE_NONE, PNG_INTERLACE_ADAM7 */
+   png_byte compression_type PNG_DEPSTRUCT; /* must be
+                                             PNG_COMPRESSION_TYPE_BASE (IHDR) */
+   png_byte filter_type PNG_DEPSTRUCT;    /* must be PNG_FILTER_TYPE_BASE
+                                             (from IHDR) */
+   png_byte interlace_type PNG_DEPSTRUCT; /* One of PNG_INTERLACE_NONE,
+                                             PNG_INTERLACE_ADAM7 */
 
    /* The following is informational only on read, and not used on writes. */
-   png_byte channels PNG_DEPSTRUCT;       /* number of data channels per pixel (1, 2, 3, 4) */
+   png_byte channels PNG_DEPSTRUCT;       /* number of data channels per
+                                             pixel (1, 2, 3, 4) */
    png_byte pixel_depth PNG_DEPSTRUCT;    /* number of bits per pixel */
-   png_byte spare_byte PNG_DEPSTRUCT;     /* to align the data, and for future use */
-   png_byte signature[8] PNG_DEPSTRUCT;   /* magic bytes read by libpng from start of file */
+   png_byte spare_byte PNG_DEPSTRUCT;     /* to align the data, and for
+                                             future use */
+   png_byte signature[8] PNG_DEPSTRUCT;   /* magic bytes read by libpng
+                                             from start of file */
 
    /* The rest of the data is optional.  If you are reading, check the
     * valid field to see if the information in these are valid.  If you
     * are writing, set the valid field to those chunks you want written,
     * and initialize the appropriate fields below.
     */
 
 #if defined(PNG_gAMA_SUPPORTED) && defined(PNG_FLOATING_POINT_SUPPORTED)
    /* The gAMA chunk describes the gamma characteristics of the system
     * on which the image was created, normally in the range [1.0, 2.5].
     * Data is valid if (valid & PNG_INFO_gAMA) is non-zero.
     */
-   float gamma PNG_DEPSTRUCT; /* gamma value of image, if (valid & PNG_INFO_gAMA) */
+   float gamma PNG_DEPSTRUCT; /* gamma value of image,
+                                 if (valid & PNG_INFO_gAMA) */
 #endif
 
 #ifdef PNG_sRGB_SUPPORTED
     /* GR-P, 0.96a */
     /* Data valid if (valid & PNG_INFO_sRGB) non-zero. */
-   png_byte srgb_intent PNG_DEPSTRUCT; /* sRGB rendering intent [0, 1, 2, or 3] */
+   png_byte srgb_intent PNG_DEPSTRUCT; /* sRGB rendering intent
+                                          [0, 1, 2, or 3] */
 #endif
 
 #ifdef PNG_TEXT_SUPPORTED
    /* The tEXt, and zTXt chunks contain human-readable textual data in
     * uncompressed, compressed, and optionally compressed forms, respectively.
     * The data in "text" is an array of pointers to uncompressed,
     * null-terminated C strings. Each chunk has a keyword that describes the
     * textual data contained in that chunk.  Keywords are not required to be
@@ -706,18 +722,20 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
     * other image types that don't need a full alpha channel.  There are
     * "num_trans" transparency values for a paletted image, stored in the
     * same order as the palette colors, starting from index 0.  Values
     * for the data are in the range [0, 255], ranging from fully transparent
     * to fully opaque, respectively.  For non-paletted images, there is a
     * single color specified that should be treated as fully transparent.
     * Data is valid if (valid & PNG_INFO_tRNS) is non-zero.
     */
-   png_bytep trans_alpha PNG_DEPSTRUCT;    /* alpha values for paletted image */
-   png_color_16 trans_color PNG_DEPSTRUCT; /* transparent color for non-palette image */
+   png_bytep trans_alpha PNG_DEPSTRUCT;    /* alpha values for paletted
+                                              image */
+   png_color_16 trans_color PNG_DEPSTRUCT; /* transparent color for
+                                              non-palette image */
 #endif
 
 #if defined(PNG_bKGD_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
    /* The bKGD chunk gives the suggested image background color if the
     * display program does not have its own background color and the image
     * is needs to composited onto a background before display.  The colors
     * in "background" are normally in the same color space/depth as the
     * pixel data.  Data is valid if (valid & PNG_INFO_bKGD) is non-zero.
@@ -738,17 +756,18 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
 
 #ifdef PNG_pHYs_SUPPORTED
    /* The pHYs chunk gives the physical pixel density of the image for
     * display or printing in "phys_unit_type" units (see PNG_RESOLUTION_
     * defines below).  Data is valid if (valid & PNG_INFO_pHYs) is non-zero.
     */
    png_uint_32 x_pixels_per_unit PNG_DEPSTRUCT; /* horizontal pixel density */
    png_uint_32 y_pixels_per_unit PNG_DEPSTRUCT; /* vertical pixel density */
-   png_byte phys_unit_type PNG_DEPSTRUCT; /* resolution type (see PNG_RESOLUTION_ below) */
+   png_byte phys_unit_type PNG_DEPSTRUCT; /* resolution type (see
+                                             PNG_RESOLUTION_ below) */
 #endif
 
 #ifdef PNG_hIST_SUPPORTED
    /* The hIST chunk contains the relative frequency or importance of the
     * various palette entries, so that a viewer can intelligently select a
     * reduced-color palette, if required.  Data is an array of "num_palette"
     * values in the range [0,65535]. Data valid if (valid & PNG_INFO_hIST)
     * is non-zero.
@@ -785,36 +804,42 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
     * defines below, and the PNG-Group's PNG extensions document for a
     * complete description of the transformations and how they should be
     * implemented, and for a description of the ASCII parameter strings.
     * Data values are valid if (valid & PNG_INFO_pCAL) non-zero.
     */
    png_charp pcal_purpose PNG_DEPSTRUCT;  /* pCAL chunk description string */
    png_int_32 pcal_X0 PNG_DEPSTRUCT;      /* minimum value */
    png_int_32 pcal_X1 PNG_DEPSTRUCT;      /* maximum value */
-   png_charp pcal_units PNG_DEPSTRUCT;    /* Latin-1 string giving physical units */
-   png_charpp pcal_params PNG_DEPSTRUCT;  /* ASCII strings containing parameter values */
-   png_byte pcal_type PNG_DEPSTRUCT;      /* equation type (see PNG_EQUATION_ below) */
-   png_byte pcal_nparams PNG_DEPSTRUCT;   /* number of parameters given in pcal_params */
+   png_charp pcal_units PNG_DEPSTRUCT;    /* Latin-1 string giving physical
+                                             units */
+   png_charpp pcal_params PNG_DEPSTRUCT;  /* ASCII strings containing
+                                             parameter values */
+   png_byte pcal_type PNG_DEPSTRUCT;      /* equation type
+                                             (see PNG_EQUATION_ below) */
+   png_byte pcal_nparams PNG_DEPSTRUCT;   /* number of parameters given
+                                             in pcal_params */
 #endif
 
 /* New members added in libpng-1.0.6 */
-   png_uint_32 free_me PNG_DEPSTRUCT;     /* flags items libpng is responsible for freeing */
+   png_uint_32 free_me PNG_DEPSTRUCT;     /* flags items libpng is
+                                             responsible for freeing */
 
 #if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED) || \
  defined(PNG_HANDLE_AS_UNKNOWN_SUPPORTED)
    /* Storage for unknown chunks that the library doesn't recognize. */
    png_unknown_chunkp unknown_chunks PNG_DEPSTRUCT;
    png_size_t unknown_chunks_num PNG_DEPSTRUCT;
 #endif
 
 #ifdef PNG_iCCP_SUPPORTED
    /* iCCP chunk data. */
    png_charp iccp_name PNG_DEPSTRUCT;     /* profile name */
-   png_charp iccp_profile PNG_DEPSTRUCT;  /* International Color Consortium profile data */
+   png_charp iccp_profile PNG_DEPSTRUCT;  /* International Color Consortium
+                                             profile data */
                             /* Note to maintainer: should be png_bytep */
    png_uint_32 iccp_proflen PNG_DEPSTRUCT;  /* ICC profile data length */
    png_byte iccp_compression PNG_DEPSTRUCT; /* Always zero */
 #endif
 
 #ifdef PNG_sPLT_SUPPORTED
    /* Data on sPLT chunks (there may be more than one). */
    png_sPLT_tp splt_palettes PNG_DEPSTRUCT;
@@ -836,23 +861,25 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
 #endif
 #ifdef PNG_FIXED_POINT_SUPPORTED
    png_charp scal_s_width PNG_DEPSTRUCT;     /* string containing height */
    png_charp scal_s_height PNG_DEPSTRUCT;    /* string containing width */
 #endif
 #endif
 
 #ifdef PNG_INFO_IMAGE_SUPPORTED
-   /* Memory has been allocated if (valid & PNG_ALLOCATED_INFO_ROWS) non-zero */
+   /* Memory has been allocated if (valid & PNG_ALLOCATED_INFO_ROWS)
+      non-zero */
    /* Data valid if (valid & PNG_INFO_IDAT) non-zero */
    png_bytepp row_pointers PNG_DEPSTRUCT;        /* the image bits */
 #endif
 
 #if defined(PNG_FIXED_POINT_SUPPORTED) && defined(PNG_gAMA_SUPPORTED)
-   png_fixed_point int_gamma PNG_DEPSTRUCT; /* gamma of image, if (valid & PNG_INFO_gAMA) */
+   png_fixed_point int_gamma PNG_DEPSTRUCT; /* gamma of image,
+                                               if (valid & PNG_INFO_gAMA) */
 #endif
 
 #if defined(PNG_cHRM_SUPPORTED) && defined(PNG_FIXED_POINT_SUPPORTED)
    png_fixed_point int_x_white PNG_DEPSTRUCT;
    png_fixed_point int_y_white PNG_DEPSTRUCT;
    png_fixed_point int_x_red PNG_DEPSTRUCT;
    png_fixed_point int_y_red PNG_DEPSTRUCT;
    png_fixed_point int_x_green PNG_DEPSTRUCT;
@@ -1006,35 +1033,37 @@ typedef void (PNGAPI *png_error_ptr) PNG
 typedef void (PNGAPI *png_rw_ptr) PNGARG((png_structp, png_bytep, png_size_t));
 typedef void (PNGAPI *png_flush_ptr) PNGARG((png_structp));
 typedef void (PNGAPI *png_read_status_ptr) PNGARG((png_structp, png_uint_32,
    int));
 typedef void (PNGAPI *png_write_status_ptr) PNGARG((png_structp, png_uint_32,
    int));
 
 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
-typedef void (PNGAPI *png_progressive_info_ptr) PNGARG((png_structp, png_infop));
+typedef void (PNGAPI *png_progressive_info_ptr) PNGARG((png_structp,
+   png_infop));
 typedef void (PNGAPI *png_progressive_end_ptr) PNGARG((png_structp, png_infop));
 typedef void (PNGAPI *png_progressive_row_ptr) PNGARG((png_structp, png_bytep,
    png_uint_32, int));
 
 #ifdef PNG_APNG_SUPPORTED
 typedef void (PNGAPI *png_progressive_frame_ptr) PNGARG((png_structp, 
    png_uint_32));
 #endif
 #endif
 
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
     defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
 typedef void (PNGAPI *png_user_transform_ptr) PNGARG((png_structp,
-    png_row_infop, png_bytep));
+   png_row_infop, png_bytep));
 #endif
 
 #ifdef PNG_USER_CHUNKS_SUPPORTED
-typedef int (PNGAPI *png_user_chunk_ptr) PNGARG((png_structp, png_unknown_chunkp));
+typedef int (PNGAPI *png_user_chunk_ptr) PNGARG((png_structp,
+   png_unknown_chunkp));
 #endif
 #ifdef PNG_UNKNOWN_CHUNKS_SUPPORTED
 typedef void (PNGAPI *png_unknown_chunk_ptr) PNGARG((png_structp));
 #endif
 #ifdef PNG_SETJMP_SUPPORTED
 /* This must match the function definition in <setjmp.h>, and the
  * application must include this before png.h to obtain the definition
  * of jmp_buf.
@@ -1076,210 +1105,300 @@ typedef void (*png_free_ptr) PNGARG((png
  * It should NOT be accessed directly by an application, except to store
  * the jmp_buf.
  */
 
 struct png_struct_def
 {
 #ifdef PNG_SETJMP_SUPPORTED
    jmp_buf jmpbuf PNG_DEPSTRUCT;            /* used in png_error */
-   png_longjmp_ptr longjmp_fn PNG_DEPSTRUCT;/* setjmp non-local goto function. */
+   png_longjmp_ptr longjmp_fn PNG_DEPSTRUCT;/* setjmp non-local goto
+                                               function. */
 #endif
-   png_error_ptr error_fn PNG_DEPSTRUCT;    /* function for printing errors and aborting */
-   png_error_ptr warning_fn PNG_DEPSTRUCT;  /* function for printing warnings */
-   png_voidp error_ptr PNG_DEPSTRUCT;       /* user supplied struct for error functions */
-   png_rw_ptr write_data_fn PNG_DEPSTRUCT;  /* function for writing output data */
-   png_rw_ptr read_data_fn PNG_DEPSTRUCT;   /* function for reading input data */
-   png_voidp io_ptr PNG_DEPSTRUCT;          /* ptr to application struct for I/O functions */
+   png_error_ptr error_fn PNG_DEPSTRUCT;    /* function for printing
+                                               errors and aborting */
+   png_error_ptr warning_fn PNG_DEPSTRUCT;  /* function for printing
+                                               warnings */
+   png_voidp error_ptr PNG_DEPSTRUCT;       /* user supplied struct for
+                                               error functions */
+   png_rw_ptr write_data_fn PNG_DEPSTRUCT;  /* function for writing
+                                               output data */
+   png_rw_ptr read_data_fn PNG_DEPSTRUCT;   /* function for reading
+                                               input data */
+   png_voidp io_ptr PNG_DEPSTRUCT;          /* ptr to application struct
+                                               for I/O functions */
 
 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
-   png_user_transform_ptr read_user_transform_fn PNG_DEPSTRUCT; /* user read transform */
+   png_user_transform_ptr read_user_transform_fn PNG_DEPSTRUCT; /* user read
+                                                                 transform */
 #endif
 
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
-   png_user_transform_ptr write_user_transform_fn PNG_DEPSTRUCT; /* user write transform */
+   png_user_transform_ptr write_user_transform_fn PNG_DEPSTRUCT; /* user write
+                                                                  transform */
 #endif
 
 /* These were added in libpng-1.0.2 */
 #ifdef PNG_USER_TRANSFORM_PTR_SUPPORTED
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
     defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
-   png_voidp user_transform_ptr PNG_DEPSTRUCT; /* user supplied struct for user transform */
-   png_byte user_transform_depth PNG_DEPSTRUCT;    /* bit depth of user transformed pixels */
-   png_byte user_transform_channels PNG_DEPSTRUCT; /* channels in user transformed pixels */
+   png_voidp user_transform_ptr PNG_DEPSTRUCT; /* user supplied struct
+                                                  for user transform */
+   png_byte user_transform_depth PNG_DEPSTRUCT;    /* bit depth of user
+                                                      transformed pixels */
+   png_byte user_transform_channels PNG_DEPSTRUCT; /* channels in user
+                                                      transformed pixels */
 #endif
 #endif
 
-   png_uint_32 mode PNG_DEPSTRUCT;          /* tells us where we are in the PNG file */
-   png_uint_32 flags PNG_DEPSTRUCT;         /* flags indicating various things to libpng */
-   png_uint_32 transformations PNG_DEPSTRUCT; /* which transformations to perform */
+   png_uint_32 mode PNG_DEPSTRUCT;          /* tells us where we are in
+                                               the PNG file */
+   png_uint_32 flags PNG_DEPSTRUCT;         /* flags indicating various
+                                               things to libpng */
+   png_uint_32 transformations PNG_DEPSTRUCT; /* which transformations
+                                                 to perform */
 
-   z_stream zstream PNG_DEPSTRUCT;          /* pointer to decompression structure (below) */
+   z_stream zstream PNG_DEPSTRUCT;          /* pointer to decompression
+                                               structure (below) */
    png_bytep zbuf PNG_DEPSTRUCT;            /* buffer for zlib */
    png_size_t zbuf_size PNG_DEPSTRUCT;      /* size of zbuf */
    int zlib_level PNG_DEPSTRUCT;            /* holds zlib compression level */
    int zlib_method PNG_DEPSTRUCT;           /* holds zlib compression method */
-   int zlib_window_bits PNG_DEPSTRUCT;      /* holds zlib compression window bits */
-   int zlib_mem_level PNG_DEPSTRUCT;        /* holds zlib compression memory level */
-   int zlib_strategy PNG_DEPSTRUCT;         /* holds zlib compression strategy */
+   int zlib_window_bits PNG_DEPSTRUCT;      /* holds zlib compression window
+                                               bits */
+   int zlib_mem_level PNG_DEPSTRUCT;        /* holds zlib compression memory
+                                               level */
+   int zlib_strategy PNG_DEPSTRUCT;         /* holds zlib compression
+                                               strategy */
 
    png_uint_32 width PNG_DEPSTRUCT;         /* width of image in pixels */
    png_uint_32 height PNG_DEPSTRUCT;        /* height of image in pixels */
    png_uint_32 num_rows PNG_DEPSTRUCT;      /* number of rows in current pass */
    png_uint_32 usr_width PNG_DEPSTRUCT;     /* width of row at start of write */
    png_size_t rowbytes PNG_DEPSTRUCT;       /* size of row in bytes */
-   png_size_t irowbytes PNG_DEPSTRUCT;      /* size of current interlaced row in bytes */
-   png_uint_32 iwidth PNG_DEPSTRUCT;        /* width of current interlaced row in pixels */
+#if 0 /* Replaced with the following in libpng-1.4.1 */
+   png_size_t irowbytes PNG_DEPSTRUCT;
+#endif
+/* Added in libpng-1.4.1 */
+#ifdef PNG_USER_LIMITS_SUPPORTED
+   /* Total memory that a zTXt, sPLT, iTXt, iCCP, or unknown chunk
+    * can occupy when decompressed.  0 means unlimited.
+    * We will change the typedef from png_size_t to png_alloc_size_t
+    * in libpng-1.6.0
+    */
+   png_alloc_size_t user_chunk_malloc_max PNG_DEPSTRUCT;
+#endif
+   png_uint_32 iwidth PNG_DEPSTRUCT;        /* width of current interlaced
+                                               row in pixels */
    png_uint_32 row_number PNG_DEPSTRUCT;    /* current row in interlace pass */
-   png_bytep prev_row PNG_DEPSTRUCT;        /* buffer to save previous (unfiltered) row */
-   png_bytep row_buf PNG_DEPSTRUCT;         /* buffer to save current (unfiltered) row */
-   png_bytep sub_row PNG_DEPSTRUCT;         /* buffer to save "sub" row when filtering */
-   png_bytep up_row PNG_DEPSTRUCT;          /* buffer to save "up" row when filtering */
-   png_bytep avg_row PNG_DEPSTRUCT;         /* buffer to save "avg" row when filtering */
-   png_bytep paeth_row PNG_DEPSTRUCT;       /* buffer to save "Paeth" row when filtering */
-   png_row_info row_info PNG_DEPSTRUCT;     /* used for transformation routines */
+   png_bytep prev_row PNG_DEPSTRUCT;        /* buffer to save previous
+                                               (unfiltered) row */
+   png_bytep row_buf PNG_DEPSTRUCT;         /* buffer to save current
+                                               (unfiltered) row */
+   png_bytep sub_row PNG_DEPSTRUCT;         /* buffer to save "sub" row
+                                               when filtering */
+   png_bytep up_row PNG_DEPSTRUCT;          /* buffer to save "up" row
+                                               when filtering */
+   png_bytep avg_row PNG_DEPSTRUCT;         /* buffer to save "avg" row
+                                               when filtering */
+   png_bytep paeth_row PNG_DEPSTRUCT;       /* buffer to save "Paeth" row
+                                               when filtering */
+   png_row_info row_info PNG_DEPSTRUCT;     /* used for transformation
+                                               routines */
 
    png_uint_32 idat_size PNG_DEPSTRUCT;     /* current IDAT size for read */
    png_uint_32 crc PNG_DEPSTRUCT;           /* current chunk CRC value */
    png_colorp palette PNG_DEPSTRUCT;        /* palette from the input file */
-   png_uint_16 num_palette PNG_DEPSTRUCT;   /* number of color entries in palette */
+   png_uint_16 num_palette PNG_DEPSTRUCT;   /* number of color entries in
+                                               palette */
    png_uint_16 num_trans PNG_DEPSTRUCT;     /* number of transparency values */
-   png_byte chunk_name[5] PNG_DEPSTRUCT;    /* null-terminated name of current chunk */
-   png_byte compression PNG_DEPSTRUCT;      /* file compression type (always 0) */
+   png_byte chunk_name[5] PNG_DEPSTRUCT;    /* null-terminated name of current
+                                               chunk */
+   png_byte compression PNG_DEPSTRUCT;      /* file compression type
+                                               (always 0) */
    png_byte filter PNG_DEPSTRUCT;           /* file filter type (always 0) */
-   png_byte interlaced PNG_DEPSTRUCT;       /* PNG_INTERLACE_NONE, PNG_INTERLACE_ADAM7 */
+   png_byte interlaced PNG_DEPSTRUCT;       /* PNG_INTERLACE_NONE,
+                                               PNG_INTERLACE_ADAM7 */
    png_byte pass PNG_DEPSTRUCT;             /* current interlace pass (0 - 6) */
-   png_byte do_filter PNG_DEPSTRUCT;        /* row filter flags (see PNG_FILTER_ below ) */
+   png_byte do_filter PNG_DEPSTRUCT;        /* row filter flags (see
+                                               PNG_FILTER_ below ) */
    png_byte color_type PNG_DEPSTRUCT;       /* color type of file */
    png_byte bit_depth PNG_DEPSTRUCT;        /* bit depth of file */
    png_byte usr_bit_depth PNG_DEPSTRUCT;    /* bit depth of users row */
    png_byte pixel_depth PNG_DEPSTRUCT;      /* number of bits per pixel */
    png_byte channels PNG_DEPSTRUCT;         /* number of channels in file */
    png_byte usr_channels PNG_DEPSTRUCT;     /* channels at start of write */
-   png_byte sig_bytes PNG_DEPSTRUCT;        /* magic bytes read/written from start of file */
+   png_byte sig_bytes PNG_DEPSTRUCT;        /* magic bytes read/written from
+                                               start of file */
 
 #if defined(PNG_READ_FILLER_SUPPORTED) || defined(PNG_WRITE_FILLER_SUPPORTED)
-   png_uint_16 filler PNG_DEPSTRUCT;           /* filler bytes for pixel expansion */
+   png_uint_16 filler PNG_DEPSTRUCT;           /* filler bytes for pixel
+                                                  expansion */
 #endif
 
 #ifdef PNG_bKGD_SUPPORTED
    png_byte background_gamma_type PNG_DEPSTRUCT;
 #  ifdef PNG_FLOATING_POINT_SUPPORTED
    float background_gamma PNG_DEPSTRUCT;
 #  endif
-   png_color_16 background PNG_DEPSTRUCT;   /* background color in screen gamma space */
+   png_color_16 background PNG_DEPSTRUCT;   /* background color in
+                                               screen gamma space */
 #ifdef PNG_READ_GAMMA_SUPPORTED
-   png_color_16 background_1 PNG_DEPSTRUCT; /* background normalized to gamma 1.0 */
+   png_color_16 background_1 PNG_DEPSTRUCT; /* background normalized
+                                               to gamma 1.0 */
 #endif
 #endif /* PNG_bKGD_SUPPORTED */
 
 #ifdef PNG_WRITE_FLUSH_SUPPORTED
-   png_flush_ptr output_flush_fn PNG_DEPSTRUCT; /* Function for flushing output */
-   png_uint_32 flush_dist PNG_DEPSTRUCT;    /* how many rows apart to flush, 0 - no flush */
-   png_uint_32 flush_rows PNG_DEPSTRUCT;    /* number of rows written since last flush */
+   png_flush_ptr output_flush_fn PNG_DEPSTRUCT; /* Function for flushing
+                                               output */
+   png_uint_32 flush_dist PNG_DEPSTRUCT;    /* how many rows apart to flush,
+                                               0 - no flush */
+   png_uint_32 flush_rows PNG_DEPSTRUCT;    /* number of rows written since
+                                               last flush */
 #endif
 
 #if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
-   int gamma_shift PNG_DEPSTRUCT;      /* number of "insignificant" bits 16-bit gamma */
+   int gamma_shift PNG_DEPSTRUCT;      /* number of "insignificant" bits
+                                          16-bit gamma */
 #ifdef PNG_FLOATING_POINT_SUPPORTED
    float gamma PNG_DEPSTRUCT;          /* file gamma value */
-   float screen_gamma PNG_DEPSTRUCT;   /* screen gamma value (display_exponent) */
+   float screen_gamma PNG_DEPSTRUCT;   /* screen gamma value
+                                          (display_exponent) */
 #endif
 #endif
 
 #if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
-   png_bytep gamma_table PNG_DEPSTRUCT;     /* gamma table for 8-bit depth files */
+   png_bytep gamma_table PNG_DEPSTRUCT;     /* gamma table for 8-bit
+                                               depth files */
    png_bytep gamma_from_1 PNG_DEPSTRUCT;    /* converts from 1.0 to screen */
    png_bytep gamma_to_1 PNG_DEPSTRUCT;      /* converts from file to 1.0 */
-   png_uint_16pp gamma_16_table PNG_DEPSTRUCT; /* gamma table for 16-bit depth files */
-   png_uint_16pp gamma_16_from_1 PNG_DEPSTRUCT; /* converts from 1.0 to screen */
+   png_uint_16pp gamma_16_table PNG_DEPSTRUCT; /* gamma table for 16-bit
+                                                  depth files */
+   png_uint_16pp gamma_16_from_1 PNG_DEPSTRUCT; /* converts from 1.0 to
+                                                   screen */
    png_uint_16pp gamma_16_to_1 PNG_DEPSTRUCT; /* converts from file to 1.0 */
 #endif
 
 #if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_sBIT_SUPPORTED)
-   png_color_8 sig_bit PNG_DEPSTRUCT;       /* significant bits in each available channel */
+   png_color_8 sig_bit PNG_DEPSTRUCT;       /* significant bits in each
+                                               available channel */
 #endif
 
 #if defined(PNG_READ_SHIFT_SUPPORTED) || defined(PNG_WRITE_SHIFT_SUPPORTED)
-   png_color_8 shift PNG_DEPSTRUCT;         /* shift for significant bit tranformation */
+   png_color_8 shift PNG_DEPSTRUCT;         /* shift for significant bit
+                                               tranformation */
 #endif
 
 #if defined(PNG_tRNS_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED) \
  || defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
-   png_bytep trans_alpha PNG_DEPSTRUCT;           /* alpha values for paletted files */
-   png_color_16 trans_color PNG_DEPSTRUCT;  /* transparent color for non-paletted files */
+   png_bytep trans_alpha PNG_DEPSTRUCT;           /* alpha values for
+                                                     paletted files */
+   png_color_16 trans_color PNG_DEPSTRUCT;  /* transparent color for
+                                               non-paletted files */
 #endif
 
-   png_read_status_ptr read_row_fn PNG_DEPSTRUCT;   /* called after each row is decoded */
-   png_write_status_ptr write_row_fn PNG_DEPSTRUCT; /* called after each row is encoded */
+   png_read_status_ptr read_row_fn PNG_DEPSTRUCT;   /* called after each
+                                                       row is decoded */
+   png_write_status_ptr write_row_fn PNG_DEPSTRUCT; /* called after each
+                                                       row is encoded */
 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
-   png_progressive_info_ptr info_fn PNG_DEPSTRUCT; /* called after header data fully read */
-   png_progressive_row_ptr row_fn PNG_DEPSTRUCT;   /* called after each prog. row is decoded */
-   png_progressive_end_ptr end_fn PNG_DEPSTRUCT;   /* called after image is complete */
-   png_bytep save_buffer_ptr PNG_DEPSTRUCT;        /* current location in save_buffer */
-   png_bytep save_buffer PNG_DEPSTRUCT;            /* buffer for previously read data */
-   png_bytep current_buffer_ptr PNG_DEPSTRUCT;     /* current location in current_buffer */
-   png_bytep current_buffer PNG_DEPSTRUCT;         /* buffer for recently used data */
-   png_uint_32 push_length PNG_DEPSTRUCT;          /* size of current input chunk */
-   png_uint_32 skip_length PNG_DEPSTRUCT;          /* bytes to skip in input data */
-   png_size_t save_buffer_size PNG_DEPSTRUCT;      /* amount of data now in save_buffer */
-   png_size_t save_buffer_max PNG_DEPSTRUCT;       /* total size of save_buffer */
-   png_size_t buffer_size PNG_DEPSTRUCT;           /* total amount of available input data */
-   png_size_t current_buffer_size PNG_DEPSTRUCT;   /* amount of data now in current_buffer */
-   int process_mode PNG_DEPSTRUCT;                 /* what push library is currently doing */
-   int cur_palette PNG_DEPSTRUCT;                  /* current push library palette index */
+   png_progressive_info_ptr info_fn PNG_DEPSTRUCT; /* called after header
+                                                      data fully read */
+   png_progressive_row_ptr row_fn PNG_DEPSTRUCT;   /* called after each
+                                                      prog. row is decoded */
+   png_progressive_end_ptr end_fn PNG_DEPSTRUCT;   /* called after image
+                                                      is complete */
+   png_bytep save_buffer_ptr PNG_DEPSTRUCT;        /* current location in
+                                                      save_buffer */
+   png_bytep save_buffer PNG_DEPSTRUCT;            /* buffer for previously
+                                                      read data */
+   png_bytep current_buffer_ptr PNG_DEPSTRUCT;     /* current location in
+                                                      current_buffer */
+   png_bytep current_buffer PNG_DEPSTRUCT;         /* buffer for recently
+                                                      used data */
+   png_uint_32 push_length PNG_DEPSTRUCT;          /* size of current input
+                                                      chunk */
+   png_uint_32 skip_length PNG_DEPSTRUCT;          /* bytes to skip in
+                                                      input data */
+   png_size_t save_buffer_size PNG_DEPSTRUCT;      /* amount of data now
+                                                      in save_buffer */
+   png_size_t save_buffer_max PNG_DEPSTRUCT;       /* total size of
+                                                      save_buffer */
+   png_size_t buffer_size PNG_DEPSTRUCT;           /* total amount of
+                                                      available input data */
+   png_size_t current_buffer_size PNG_DEPSTRUCT;   /* amount of data now
+                                                      in current_buffer */
+   int process_mode PNG_DEPSTRUCT;                 /* what push library
+                                                      is currently doing */
+   int cur_palette PNG_DEPSTRUCT;                  /* current push library
+                                                      palette index */
 
 #  ifdef PNG_TEXT_SUPPORTED
-     png_size_t current_text_size PNG_DEPSTRUCT;   /* current size of text input data */
-     png_size_t current_text_left PNG_DEPSTRUCT;   /* how much text left to read in input */
-     png_charp current_text PNG_DEPSTRUCT;         /* current text chunk buffer */
-     png_charp current_text_ptr PNG_DEPSTRUCT;     /* current location in current_text */
+     png_size_t current_text_size PNG_DEPSTRUCT;   /* current size of
+                                                      text input data */
+     png_size_t current_text_left PNG_DEPSTRUCT;   /* how much text left
+                                                      to read in input */
+     png_charp current_text PNG_DEPSTRUCT;         /* current text chunk
+                                                      buffer */
+     png_charp current_text_ptr PNG_DEPSTRUCT;     /* current location
+                                                      in current_text */
 #  endif /* PNG_PROGRESSIVE_READ_SUPPORTED && PNG_TEXT_SUPPORTED */
 
 #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */
 
 #if defined(__TURBOC__) && !defined(_Windows) && !defined(__FLAT__)
 /* For the Borland special 64K segment handler */
    png_bytepp offset_table_ptr PNG_DEPSTRUCT;
    png_bytep offset_table PNG_DEPSTRUCT;
    png_uint_16 offset_table_number PNG_DEPSTRUCT;
    png_uint_16 offset_table_count PNG_DEPSTRUCT;
    png_uint_16 offset_table_count_free PNG_DEPSTRUCT;
 #endif
 
 #ifdef PNG_READ_DITHER_SUPPORTED
-   png_bytep palette_lookup PNG_DEPSTRUCT;         /* lookup table for dithering */
-   png_bytep dither_index PNG_DEPSTRUCT;           /* index translation for palette files */
+   png_bytep palette_lookup PNG_DEPSTRUCT; /* lookup table for dithering */
+   png_bytep dither_index PNG_DEPSTRUCT;   /* index translation for palette
+                                              files */
 #endif
 
 #if defined(PNG_READ_DITHER_SUPPORTED) || defined(PNG_hIST_SUPPORTED)
    png_uint_16p hist PNG_DEPSTRUCT;                /* histogram */
 #endif
 
 #ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED
-   png_byte heuristic_method PNG_DEPSTRUCT;        /* heuristic for row filter selection */
-   png_byte num_prev_filters PNG_DEPSTRUCT;        /* number of weights for previous rows */
-   png_bytep prev_filters PNG_DEPSTRUCT;           /* filter type(s) of previous row(s) */
-   png_uint_16p filter_weights PNG_DEPSTRUCT;      /* weight(s) for previous line(s) */
-   png_uint_16p inv_filter_weights PNG_DEPSTRUCT;  /* 1/weight(s) for previous line(s) */
-   png_uint_16p filter_costs PNG_DEPSTRUCT;        /* relative filter calculation cost */
-   png_uint_16p inv_filter_costs PNG_DEPSTRUCT;    /* 1/relative filter calculation cost */
+   png_byte heuristic_method PNG_DEPSTRUCT;        /* heuristic for row
+                                                      filter selection */
+   png_byte num_prev_filters PNG_DEPSTRUCT;        /* number of weights
+                                                      for previous rows */
+   png_bytep prev_filters PNG_DEPSTRUCT;           /* filter type(s) of
+                                                      previous row(s) */
+   png_uint_16p filter_weights PNG_DEPSTRUCT;      /* weight(s) for previous
+                                                      line(s) */
+   png_uint_16p inv_filter_weights PNG_DEPSTRUCT;  /* 1/weight(s) for
+                                                      previous line(s) */
+   png_uint_16p filter_costs PNG_DEPSTRUCT;        /* relative filter
+                                                      calculation cost */
+   png_uint_16p inv_filter_costs PNG_DEPSTRUCT;    /* 1/relative filter
+                                                      calculation cost */
 #endif
 
 #ifdef PNG_TIME_RFC1123_SUPPORTED
-   png_charp time_buffer PNG_DEPSTRUCT;            /* String to hold RFC 1123 time text */
+   png_charp time_buffer PNG_DEPSTRUCT; /* String to hold RFC 1123 time text */
 #endif
 
 /* New members added in libpng-1.0.6 */
 
-   png_uint_32 free_me PNG_DEPSTRUCT;     /* flags items libpng is responsible for freeing */
+   png_uint_32 free_me PNG_DEPSTRUCT;    /* flags items libpng is
+                                            responsible for freeing */
 
 #ifdef PNG_USER_CHUNKS_SUPPORTED
    png_voidp user_chunk_ptr PNG_DEPSTRUCT;
-   png_user_chunk_ptr read_user_chunk_fn PNG_DEPSTRUCT; /* user read chunk handler */
+   png_user_chunk_ptr read_user_chunk_fn PNG_DEPSTRUCT; /* user read
+                                                           chunk handler */
 #endif
 
 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
    int num_chunk_list PNG_DEPSTRUCT;
    png_bytep chunk_list PNG_DEPSTRUCT;
 #endif
 
 /* New members added in libpng-1.0.3 */
@@ -1308,41 +1427,47 @@ struct png_struct_def
 #ifdef PNG_MNG_FEATURES_SUPPORTED
    png_byte filter_type PNG_DEPSTRUCT;
 #endif
 
 /* New members added in libpng-1.2.0 */
 
 /* New members added in libpng-1.0.2 but first enabled by default in 1.2.0 */
 #ifdef PNG_USER_MEM_SUPPORTED
-   png_voidp mem_ptr PNG_DEPSTRUCT;                /* user supplied struct for mem functions */
-   png_malloc_ptr malloc_fn PNG_DEPSTRUCT;         /* function for allocating memory */
-   png_free_ptr free_fn PNG_DEPSTRUCT;             /* function for freeing memory */
+   png_voidp mem_ptr PNG_DEPSTRUCT;             /* user supplied struct for
+                                                   mem functions */
+   png_malloc_ptr malloc_fn PNG_DEPSTRUCT;      /* function for
+                                                   allocating memory */
+   png_free_ptr free_fn PNG_DEPSTRUCT;          /* function for
+                                                   freeing memory */
 #endif
 
 /* New member added in libpng-1.0.13 and 1.2.0 */
-   png_bytep big_row_buf PNG_DEPSTRUCT;         /* buffer to save current (unfiltered) row */
+   png_bytep big_row_buf PNG_DEPSTRUCT;         /* buffer to save current
+                                                   (unfiltered) row */
 
 #ifdef PNG_READ_DITHER_SUPPORTED
 /* The following three members were added at version 1.0.14 and 1.2.4 */
    png_bytep dither_sort PNG_DEPSTRUCT;            /* working sort array */
-   png_bytep index_to_palette PNG_DEPSTRUCT;       /* where the original index currently is */
-                                     /* in the palette */
-   png_bytep palette_to_index PNG_DEPSTRUCT;       /* which original index points to this */
-                                     /* palette color */
+   png_bytep index_to_palette PNG_DEPSTRUCT;       /* where the original
+                                                     index currently is
+                                                     in the palette */
+   png_bytep palette_to_index PNG_DEPSTRUCT;       /* which original index
+                                                      points to this
+                                                      palette color */
 #endif
 
 /* New members added in libpng-1.0.16 and 1.2.6 */
    png_byte compression_type PNG_DEPSTRUCT;
 
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+#ifdef PNG_USER_LIMITS_SUPPORTED
    png_uint_32 user_width_max PNG_DEPSTRUCT;
    png_uint_32 user_height_max PNG_DEPSTRUCT;
    /* Added in libpng-1.4.0: Total number of sPLT, text, and unknown
-    * chunks that can be stored (0x7fffffff means unlimited).
+    * chunks that can be stored (0 means unlimited).
     */
    png_uint_32 user_chunk_cache_max PNG_DEPSTRUCT;
 #endif
 
 /* New member added in libpng-1.0.25 and 1.2.17 */
 #ifdef PNG_UNKNOWN_CHUNKS_SUPPORTED
    /* Storage for unknown chunk that the library doesn't recognize. */
    png_unknown_chunk unknown_chunk PNG_DEPSTRUCT;
@@ -1350,18 +1475,18 @@ struct png_struct_def
 
 /* New members added in libpng-1.2.26 */
   png_uint_32 old_big_row_buf_size PNG_DEPSTRUCT;
   png_uint_32 old_prev_row_size PNG_DEPSTRUCT;
 
 /* New member added in libpng-1.2.30 */
   png_charp chunkdata PNG_DEPSTRUCT;  /* buffer for reading chunk data */
 
+#ifdef PNG_IO_STATE_SUPPORTED
 /* New member added in libpng-1.4.0 */
-#ifdef PNG_IO_STATE_SUPPORTED
    png_uint_32 io_state PNG_DEPSTRUCT;
 #endif
 
 #ifdef PNG_APNG_SUPPORTED
    png_uint_32 apng_flags;
    png_uint_32 next_seq_num;         /* next fcTL/fdAT chunk sequence number */
    png_uint_32 first_frame_width;
    png_uint_32 first_frame_height;
@@ -1394,17 +1519,17 @@ struct png_struct_def
 /* blend_op flags from inside fcTL */
 #define PNG_BLEND_OP_SOURCE        0x00
 #define PNG_BLEND_OP_OVER          0x01
 #endif /* PNG_APNG_SUPPORTED */
 
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef png_structp version_1_4_0;
+typedef png_structp version_1_4_1;
 
 typedef png_struct FAR * FAR * png_structpp;
 
 /* Here are the function definitions most commonly used.  This is not
  * the place to find out how to use libpng.  See libpng.txt for the
  * full explanation, see example.c for the summary.  This just provides
  * a simple one line description of the use of each function.
  */
@@ -1431,39 +1556,36 @@ extern PNG_EXPORT(png_structp,png_create
    PNGARG((png_const_charp user_png_ver, png_voidp error_ptr,
    png_error_ptr error_fn, png_error_ptr warn_fn)) PNG_ALLOCATED;
 
 /* Allocate and initialize png_ptr struct for writing, and any other memory */
 extern PNG_EXPORT(png_structp,png_create_write_struct)
    PNGARG((png_const_charp user_png_ver, png_voidp error_ptr,
    png_error_ptr error_fn, png_error_ptr warn_fn)) PNG_ALLOCATED;
 
-#ifdef PNG_WRITE_SUPPORTED
 extern PNG_EXPORT(png_size_t,png_get_compression_buffer_size)
    PNGARG((png_structp png_ptr));
-#endif
 
-#ifdef PNG_WRITE_SUPPORTED
 extern PNG_EXPORT(void,png_set_compression_buffer_size)
    PNGARG((png_structp png_ptr, png_size_t size));
-#endif
 
 /* Moved from pngconf.h in 1.4.0 and modified to ensure setjmp/longjmp
  * match up.
  */
 #ifdef PNG_SETJMP_SUPPORTED
 /* This function returns the jmp_buf built in to *png_ptr.  It must be
  * supplied with an appropriate 'longjmp' function to use on that jmp_buf
  * unless the default error function is overridden in which case NULL is
  * acceptable.  The size of the jmp_buf is checked against the actual size
  * allocated by the library - the call will return NULL on a mismatch
  * indicating an ABI mismatch.
  */
 extern PNG_EXPORT(jmp_buf*, png_set_longjmp_fn)
-   PNGARG((png_structp png_ptr, png_longjmp_ptr longjmp_fn, size_t jmp_buf_size));
+   PNGARG((png_structp png_ptr, png_longjmp_ptr longjmp_fn, size_t
+       jmp_buf_size));
 #  define png_jmpbuf(png_ptr) \
    (*png_set_longjmp_fn((png_ptr), longjmp, sizeof (jmp_buf)))
 #else
 #  define png_jmpbuf(png_ptr) \
    (LIBPNG_WAS_COMPILED_WITH__PNG_NO_SETJMP)
 #endif
 
 /* Reset the compression stream */
@@ -1598,17 +1720,18 @@ extern PNG_EXPORT(void,png_set_add_alpha
 extern PNG_EXPORT(void,png_set_swap) PNGARG((png_structp png_ptr));
 #endif
 
 #if defined(PNG_READ_PACK_SUPPORTED) || defined(PNG_WRITE_PACK_SUPPORTED)
 /* Use 1 byte per pixel in 1, 2, or 4-bit depth files. */
 extern PNG_EXPORT(void,png_set_packing) PNGARG((png_structp png_ptr));
 #endif
 
-#if defined(PNG_READ_PACKSWAP_SUPPORTED) || defined(PNG_WRITE_PACKSWAP_SUPPORTED)
+#if defined(PNG_READ_PACKSWAP_SUPPORTED) || \
+    defined(PNG_WRITE_PACKSWAP_SUPPORTED)
 /* Swap packing order of pixels in bytes. */
 extern PNG_EXPORT(void,png_set_packswap) PNGARG((png_structp png_ptr));
 #endif
 
 #if defined(PNG_READ_SHIFT_SUPPORTED) || defined(PNG_WRITE_SHIFT_SUPPORTED)
 /* Converts files to legal bit depths. */
 extern PNG_EXPORT(void,png_set_shift) PNGARG((png_structp png_ptr,
    png_color_8p true_bits));
@@ -1639,17 +1762,19 @@ extern PNG_EXPORT(void,png_set_backgroun
 #endif
 
 #ifdef PNG_READ_16_TO_8_SUPPORTED
 /* Strip the second byte of information from a 16-bit depth file. */
 extern PNG_EXPORT(void,png_set_strip_16) PNGARG((png_structp png_ptr));
 #endif
 
 #ifdef PNG_READ_DITHER_SUPPORTED
-/* Turn on dithering, and reduce the palette to the number of colors available. */
+/* Turn on dithering, and reduce the palette to the number of colors
+ * available.
+ */
 extern PNG_EXPORT(void,png_set_dither) PNGARG((png_structp png_ptr,
    png_colorp palette, int num_palette, int maximum_colors,
    png_uint_16p histogram, int full_dither));
 #endif
 
 #ifdef PNG_READ_GAMMA_SUPPORTED
 /* Handle gamma correction. Screen_gamma=(display_exponent) */
 #ifdef PNG_FLOATING_POINT_SUPPORTED
@@ -1868,17 +1993,18 @@ extern PNG_EXPORT(void,png_set_compressi
  * fprintf().  These functions can be made to use other I/O routines
  * at run time for those applications that need to handle I/O in a
  * different manner by calling png_set_???_fn().  See libpng.txt for
  * more information.
  */
 
 #ifdef PNG_STDIO_SUPPORTED
 /* Initialize the input/output for the PNG file to the default functions. */
-extern PNG_EXPORT(void,png_init_io) PNGARG((png_structp png_ptr, png_FILE_p fp));
+extern PNG_EXPORT(void,png_init_io) PNGARG((png_structp png_ptr,
+    png_FILE_p fp));
 #endif
 
 /* Replace the (error and abort), and warning functions with user
  * supplied functions.  If no messages are to be printed you must still
  * write and use replacement functions. The replacement error_fn should
  * still do a longjmp to the last setjmp location if you are using this
  * method of error handling.  If error_fn or warning_fn is NULL, the
  * default function will be used.
@@ -2483,17 +2609,18 @@ extern PNG_EXPORT(void, png_read_png) PN
 extern PNG_EXPORT(void, png_write_png) PNGARG((png_structp png_ptr,
                         png_infop info_ptr,
                         int transforms,
                         png_voidp params));
 #endif
 
 extern PNG_EXPORT(png_charp,png_get_copyright) PNGARG((png_structp png_ptr));
 extern PNG_EXPORT(png_charp,png_get_header_ver) PNGARG((png_structp png_ptr));
-extern PNG_EXPORT(png_charp,png_get_header_version) PNGARG((png_structp png_ptr));
+extern PNG_EXPORT(png_charp,png_get_header_version) PNGARG((png_structp
+    png_ptr));
 extern PNG_EXPORT(png_charp,png_get_libpng_ver) PNGARG((png_structp png_ptr));
 
 #ifdef PNG_MNG_FEATURES_SUPPORTED
 extern PNG_EXPORT(png_uint_32,png_permit_mng_features) PNGARG((png_structp
    png_ptr, png_uint_32 mng_features_permitted));
 #endif
 
 /* For use in png_set_keep_unknown, added to version 1.2.6 */
@@ -2518,16 +2645,21 @@ extern PNG_EXPORT(png_uint_32,png_get_us
    png_ptr));
 extern PNG_EXPORT(png_uint_32,png_get_user_height_max) PNGARG((png_structp
    png_ptr));
 /* Added in libpng-1.4.0 */
 extern PNG_EXPORT(void,png_set_chunk_cache_max) PNGARG((png_structp
    png_ptr, png_uint_32 user_chunk_cache_max));
 extern PNG_EXPORT(png_uint_32,png_get_chunk_cache_max)
    PNGARG((png_structp png_ptr));
+/* Added in libpng-1.4.1 */
+extern PNG_EXPORT(void,png_set_chunk_malloc_max) PNGARG((png_structp
+   png_ptr, png_alloc_size_t user_chunk_cache_max));
+extern PNG_EXPORT(png_alloc_size_t,png_get_chunk_malloc_max)
+   PNGARG((png_structp png_ptr));
 #endif
 
 #if defined(PNG_INCH_CONVERSIONS) && defined(PNG_FLOATING_POINT_SUPPORTED)
 PNG_EXPORT(png_uint_32,png_get_pixels_per_inch) PNGARG((png_structp png_ptr,
 png_infop info_ptr));
 
 PNG_EXPORT(png_uint_32,png_get_x_pixels_per_inch) PNGARG((png_structp png_ptr,
 png_infop info_ptr));
@@ -2580,26 +2712,28 @@ extern PNG_EXPORT(png_bytep,png_get_io_c
  * 32768 are correct for the NODIV code; 127 and 32767 are correct for the
  * standard method.
  *
  * [Optimized code by Greg Roelofs and Mark Adler...blame us for bugs. :-) ]
  */
 
  /* fg and bg should be in `gamma 1.0' space; alpha is the opacity          */
 
-#  define png_composite(composite, fg, alpha, bg)                            \
-     { png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) * (png_uint_16)(alpha) \
-                        +        (png_uint_16)(bg)*(png_uint_16)(255 -       \
-                        (png_uint_16)(alpha)) + (png_uint_16)128);           \
+#  define png_composite(composite, fg, alpha, bg)         \
+     { png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
+           * (png_uint_16)(alpha)                         \
+           + (png_uint_16)(bg)*(png_uint_16)(255          \
+           - (png_uint_16)(alpha)) + (png_uint_16)128);   \
        (composite) = (png_byte)((temp + (temp >> 8)) >> 8); }
 
-#  define png_composite_16(composite, fg, alpha, bg)                         \
-     { png_uint_32 temp = (png_uint_32)((png_uint_32)(fg) * (png_uint_32)(alpha) \
-                        + (png_uint_32)(bg)*(png_uint_32)(65535L -           \
-                        (png_uint_32)(alpha)) + (png_uint_32)32768L);        \
+#  define png_composite_16(composite, fg, alpha, bg)       \
+     { png_uint_32 temp = (png_uint_32)((png_uint_32)(fg)  \
+           * (png_uint_32)(alpha)                          \
+           + (png_uint_32)(bg)*(png_uint_32)(65535L        \
+           - (png_uint_32)(alpha)) + (png_uint_32)32768L); \
        (composite) = (png_uint_16)((temp + (temp >> 16)) >> 16); }
 
 #else  /* Standard method using integer division */
 
 #  define png_composite(composite, fg, alpha, bg)                            \
      (composite) = (png_byte)(((png_uint_16)(fg) * (png_uint_16)(alpha) +    \
        (png_uint_16)(bg) * (png_uint_16)(255 - (png_uint_16)(alpha)) +       \
        (png_uint_16)127) / 255)
--- a/modules/libimg/png/pngconf.h
+++ b/modules/libimg/png/pngconf.h
@@ -1,12 +1,12 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.4.0 - January 3, 2010
+ * libpng version 1.4.1 - February 25, 2010
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
@@ -25,17 +25,19 @@
 #include "mozpngconf.h"
 
 #ifndef PNG_NO_LIMITS_H
 #  include <limits.h>
 #endif
 
 /* Added at libpng-1.2.9 */
 
-/* config.h is created by and PNG_CONFIGURE_LIBPNG is set by the "configure" script. */
+/* config.h is created by and PNG_CONFIGURE_LIBPNG is set by the "configure"
+ * script.
+ */
 #ifdef PNG_CONFIGURE_LIBPNG
 #  ifdef HAVE_CONFIG_H
 #    include "config.h"
 #  endif
 #endif
 
 /*
  * Added at libpng-1.2.8
@@ -669,35 +671,57 @@
 #endif
 
 /* Added at libpng-1.2.0 */
 #if !defined(PNG_NO_USER_MEM) && !defined(PNG_USER_MEM_SUPPORTED)
 #  define PNG_USER_MEM_SUPPORTED
 #endif
 
 /* Added at libpng-1.2.6 */
-#ifndef PNG_SET_USER_LIMITS_SUPPORTED
-#  ifndef PNG_NO_SET_USER_LIMITS
+#ifndef PNG_NO_SET_USER_LIMITS
+#  ifndef PNG_SET_USER_LIMITS_SUPPORTED
 #    define PNG_SET_USER_LIMITS_SUPPORTED
 #  endif
+  /* Feature added at libpng-1.4.0, this flag added at 1.4.1 */
+#  ifndef PNG_SET_CHUNK_CACHE_LIMIT_SUPPORTED
+#    define PNG_SET_CHUNK_CACHE_LIMIT_SUPPORTED
+#  endif
+  /* Feature added at libpng-1.4.1, this flag added at 1.4.1 */
+#  ifndef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
+#    define PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
+#  endif
+#endif
+
+/* Added at libpng-1.2.43 */
+#ifndef PNG_USER_LIMITS_SUPPORTED
+#  ifndef PNG_NO_USER_LIMITS
+#    define PNG_USER_LIMITS_SUPPORTED
+#  endif
 #endif
 
 /* Added at libpng-1.0.16 and 1.2.6.  To accept all valid PNGs no matter
- * how large, set these limits to 0x7fffffffL
+ * how large, set these two limits to 0x7fffffffL
  */
 #ifndef PNG_USER_WIDTH_MAX
 #  define PNG_USER_WIDTH_MAX 1000000L
 #endif
 #ifndef PNG_USER_HEIGHT_MAX
 #  define PNG_USER_HEIGHT_MAX 1000000L
 #endif
 
-/* Added at libpng-1.4.0 */
+/* Added at libpng-1.2.43.  To accept all valid PNGs no matter
+ * how large, set these two limits to 0.
+ */
 #ifndef PNG_USER_CHUNK_CACHE_MAX
-#  define PNG_USER_CHUNK_CACHE_MAX 0x7fffffffL
+#  define PNG_USER_CHUNK_CACHE_MAX 0
+#endif
+
+/* Added at libpng-1.2.43 */
+#ifndef PNG_USER_CHUNK_MALLOC_MAX
+#  define PNG_USER_CHUNK_MALLOC_MAX 0
 #endif
 
 /* Added at libpng-1.4.0 */
 #if !defined(PNG_NO_IO_STATE) && !defined(PNG_IO_STATE_SUPPORTED)
 #  define PNG_IO_STATE_SUPPORTED
 #endif
 
 #ifndef PNG_LITERAL_SHARP
@@ -862,30 +886,32 @@
     defined(PNG_READ_zTXt_SUPPORTED)
 #  define PNG_READ_TEXT_SUPPORTED
 #  define PNG_TEXT_SUPPORTED
 #endif
 
 #endif /* PNG_READ_ANCILLARY_CHUNKS_SUPPORTED */
 
 #ifndef PNG_NO_READ_UNKNOWN_CHUNKS
-#  define PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
+#  ifndef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
+#    define PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
+#  endif
 #  ifndef PNG_UNKNOWN_CHUNKS_SUPPORTED
 #    define PNG_UNKNOWN_CHUNKS_SUPPORTED
 #  endif
+#  ifndef PNG_READ_USER_CHUNKS_SUPPORTED
+#    define PNG_READ_USER_CHUNKS_SUPPORTED
+#  endif
 #endif
-#if !defined(PNG_NO_READ_USER_CHUNKS) && \
-     defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
-#  define PNG_READ_USER_CHUNKS_SUPPORTED
-#  define PNG_USER_CHUNKS_SUPPORTED
-#  ifdef PNG_NO_READ_UNKNOWN_CHUNKS
-#    undef PNG_NO_READ_UNKNOWN_CHUNKS
+#ifndef PNG_NO_READ_USER_CHUNKS
+#  ifndef PNG_READ_USER_CHUNKS_SUPPORTED
+#    define PNG_READ_USER_CHUNKS_SUPPORTED
 #  endif
-#  ifdef PNG_NO_HANDLE_AS_UNKNOWN
-#    undef PNG_NO_HANDLE_AS_UNKNOWN
+#  ifndef PNG_USER_CHUNKS_SUPPORTED
+#    define PNG_USER_CHUNKS_SUPPORTED
 #  endif
 #endif
 #ifndef PNG_NO_HANDLE_AS_UNKNOWN
 #  ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 #    define PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 #  endif
 #endif
 
@@ -1026,18 +1052,20 @@
 #  endif
 #  ifndef PNG_APNG_SUPPORTED
 #    define PNG_APNG_SUPPORTED
 #  endif
 #endif
 
 #endif /* PNG_WRITE_ANCILLARY_CHUNKS_SUPPORTED */
 
-#if !defined(PNG_NO_WRITE_FILTER) && !defined(PNG_WRITE_FILTER_SUPPORTED)
-#  define PNG_WRITE_FILTER_SUPPORTED
+#ifndef PNG_NO_WRITE_FILTER
+#  ifndef PNG_WRITE_FILTER_SUPPORTED
+#    define PNG_WRITE_FILTER_SUPPORTED
+#  endif
 #endif
 
 #ifndef PNG_NO_WRITE_UNKNOWN_CHUNKS
 #  define PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED
 #  ifndef PNG_UNKNOWN_CHUNKS_SUPPORTED
 #    define PNG_UNKNOWN_CHUNKS_SUPPORTED
 #  endif
 #endif
--- a/modules/libimg/png/pngget.c
+++ b/modules/libimg/png/pngget.c
@@ -1,12 +1,12 @@
 
 /* pngget.c - retrieval of values from info struct
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -1027,46 +1027,53 @@ png_get_rgb_to_gray_status (png_structp 
 #ifdef PNG_USER_CHUNKS_SUPPORTED
 png_voidp PNGAPI
 png_get_user_chunk_ptr(png_structp png_ptr)
 {
    return (png_ptr? png_ptr->user_chunk_ptr : NULL);
 }
 #endif
 
-#ifdef PNG_WRITE_SUPPORTED
 png_size_t PNGAPI
 png_get_compression_buffer_size(png_structp png_ptr)
 {
    return (png_ptr ? png_ptr->zbuf_size : 0L);
 }
-#endif
 
 
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
-/* These functions were added to libpng 1.2.6 */
+/* These functions were added to libpng 1.2.6 and were enabled
+ * by default in libpng-1.4.0 */
 png_uint_32 PNGAPI
 png_get_user_width_max (png_structp png_ptr)
 {
     return (png_ptr? png_ptr->user_width_max : 0);
 }
 png_uint_32 PNGAPI
 png_get_user_height_max (png_structp png_ptr)
 {
     return (png_ptr? png_ptr->user_height_max : 0);
 }
+
 /* This function was added to libpng 1.4.0 */
 png_uint_32 PNGAPI
 png_get_chunk_cache_max (png_structp png_ptr)
 {
-    return (png_ptr? png_ptr->user_chunk_cache_max? 0x7fffffffL :
-       png_ptr->user_chunk_cache_max - 1 : 0);
+    return (png_ptr? png_ptr->user_chunk_cache_max : 0);
+}
+/* This function was added to libpng 1.4.1 */
+png_alloc_size_t PNGAPI
+png_get_chunk_malloc_max (png_structp png_ptr)
+{
+    return (png_ptr?
+       png_ptr->user_chunk_malloc_max : 0);
 }
 #endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */
 
+/* These functions were added to libpng 1.4.0 */
 #ifdef PNG_IO_STATE_SUPPORTED
 png_uint_32 PNGAPI
 png_get_io_state (png_structp png_ptr)
 {
     return png_ptr->io_state;
 }
 
 png_bytep PNGAPI
--- a/modules/libimg/png/pngmem.c
+++ b/modules/libimg/png/pngmem.c
@@ -1,12 +1,12 @@
 
 /* pngmem.c - stub functions for memory allocation
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.0 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -196,17 +196,17 @@ png_malloc_default(png_structp png_ptr, 
             total_size = ((png_uint_32)65536L) * (png_uint_32)num_blocks+16;
 
             table = farmalloc(total_size);
 
             if (table == NULL)
             {
 #ifndef PNG_USER_MEM_SUPPORTED
                if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
-                  png_error(png_ptr, "Out Of Memory"); /* Note "O" and "M" */
+                  png_error(png_ptr, "Out Of Memory"); /* Note "O", "M" */
                else
                   png_warning(png_ptr, "Out Of Memory");
 #endif
                return (NULL);
             }
 
             if ((png_size_t)table & 0xfff0)
             {
@@ -224,17 +224,17 @@ png_malloc_default(png_structp png_ptr, 
             png_ptr->offset_table = table;
             png_ptr->offset_table_ptr = farmalloc(num_blocks *
                png_sizeof(png_bytep));
 
             if (png_ptr->offset_table_ptr == NULL)
             {
 #ifndef PNG_USER_MEM_SUPPORTED
                if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
-                  png_error(png_ptr, "Out Of memory"); /* Note "O" and "M" */
+                  png_error(png_ptr, "Out Of memory"); /* Note "O", "m" */
                else
                   png_warning(png_ptr, "Out Of memory");
 #endif
                return (NULL);
             }
 
             hptr = (png_byte huge *)table;
             if ((png_size_t)hptr & 0xf)
--- a/modules/libimg/png/pngpread.c
+++ b/modules/libimg/png/pngpread.c
@@ -1,12 +1,12 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
@@ -200,17 +200,17 @@ png_push_read_chunk(png_structp png_ptr,
       PNG_tIME;
 #endif
 #ifdef PNG_READ_tRNS_SUPPORTED
       PNG_tRNS;
 #endif
 #ifdef PNG_READ_zTXt_SUPPORTED
       PNG_zTXt;
 #endif
-#if defined(PNG_READ_APNG_SUPPORTED)
+#ifdef PNG_READ_APNG_SUPPORTED
       PNG_acTL;
       PNG_fcTL;
       PNG_fdAT;
 #endif
 
    /* First we make sure we have enough data for the 4 byte chunk name
     * and the 4 byte chunk length before proceeding with decoding the
     * chunk data.  To fully decode each of these chunks, we also make
@@ -230,17 +230,17 @@ png_push_read_chunk(png_structp png_ptr,
       png_push_fill_buffer(png_ptr, chunk_length, 4);
       png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
       png_reset_crc(png_ptr);
       png_crc_read(png_ptr, png_ptr->chunk_name, 4);
       png_check_chunk_name(png_ptr, png_ptr->chunk_name);
       png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
    }
    
-#if defined(PNG_READ_APNG_SUPPORTED)
+#ifdef PNG_READ_APNG_SUPPORTED
    if (png_ptr->num_frames_read > 0 && 
        png_ptr->num_frames_read < info_ptr->num_frames)
    {
       if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
       {
          /* Discard trailing IDATs for the first frame */
          if (png_ptr->mode & PNG_HAVE_fcTL || png_ptr->num_frames_read > 1)
             png_error(png_ptr, "out of place IDAT");
@@ -328,18 +328,18 @@ png_push_read_chunk(png_structp png_ptr,
          return;
       }
       
       return;
    }
 #endif /* PNG_READ_APNG_SUPPORTED */
    
    if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
-     if (png_ptr->mode & PNG_AFTER_IDAT)
-        png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
+      if (png_ptr->mode & PNG_AFTER_IDAT)
+         png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
 
    if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
    {
       if (png_ptr->push_length != 13)
          png_error(png_ptr, "Invalid IHDR length");
 
       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
       {
@@ -421,24 +421,26 @@ png_push_read_chunk(png_structp png_ptr,
       {
          if (!(png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT))
             if (png_ptr->push_length == 0)
                return;
 
          if (png_ptr->mode & PNG_AFTER_IDAT)
             png_benign_error(png_ptr, "Too many IDATs found");
       }
-#if defined(PNG_READ_APNG_SUPPORTED)
+#ifdef PNG_READ_APNG_SUPPORTED
       png_have_info(png_ptr, info_ptr);
 #endif
       png_ptr->idat_size = png_ptr->push_length;
       png_ptr->mode |= PNG_HAVE_IDAT;
       png_ptr->process_mode = PNG_READ_IDAT_MODE;
       png_push_have_info(png_ptr, info_ptr);
-      png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
+      png_ptr->zstream.avail_out =
+          (uInt) PNG_ROWBYTES(png_ptr->pixel_depth,
+          png_ptr->iwidth) + 1;
       png_ptr->zstream.next_out = png_ptr->row_buf;
       return;
    }
 
 #ifdef PNG_READ_gAMA_SUPPORTED
    else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4))
    {
       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
@@ -654,17 +656,17 @@ png_push_read_chunk(png_structp png_ptr,
          png_push_save_buffer(png_ptr);
          return;
       }
 
       png_push_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
    }
 
 #endif
-#if defined(PNG_READ_APNG_SUPPORTED)
+#ifdef PNG_READ_APNG_SUPPORTED
    else if (!png_memcmp(png_ptr->chunk_name, png_acTL, 4))
    {
       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
       {
          png_push_save_buffer(png_ptr);
          return;
       }
       png_handle_acTL(png_ptr, info_ptr, png_ptr->push_length);
@@ -826,26 +828,31 @@ png_push_save_buffer(png_structp png_ptr
       if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
          (png_ptr->current_buffer_size + 256))
       {
         png_error(png_ptr, "Potential overflow of save_buffer");
       }
 
       new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
       old_buffer = png_ptr->save_buffer;
-      png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr,
-         (png_size_t)new_max);
+      png_ptr->save_buffer = (png_bytep)png_malloc_warn(png_ptr,
+          (png_size_t)new_max);
+      if (png_ptr->save_buffer == NULL)
+      {
+         png_free(png_ptr, old_buffer);
+         png_error(png_ptr, "Insufficient memory for save_buffer");
+      }
       png_memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
       png_free(png_ptr, old_buffer);
       png_ptr->save_buffer_max = new_max;
    }
    if (png_ptr->current_buffer_size)
    {
       png_memcpy(png_ptr->save_buffer + png_ptr->save_buffer_size,
-         png_ptr->current_buffer_ptr, png_ptr->current_buffer_size);
+          png_ptr->current_buffer_ptr, png_ptr->current_buffer_size);
       png_ptr->save_buffer_size += png_ptr->current_buffer_size;
       png_ptr->current_buffer_size = 0;
    }
    png_ptr->save_buffer_ptr = png_ptr->save_buffer;
    png_ptr->buffer_size = 0;
 }
 
 void /* PRIVATE */
@@ -857,37 +864,41 @@ png_push_restore_buffer(png_structp png_
    png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size;
    png_ptr->current_buffer_ptr = png_ptr->current_buffer;
 }
 
 void /* PRIVATE */
 png_push_read_IDAT(png_structp png_ptr)
 {
    PNG_IDAT;
-#if defined(PNG_READ_APNG_SUPPORTED)
+#ifdef PNG_READ_APNG_SUPPORTED
    PNG_fdAT;
    PNG_IEND;
 #endif
    if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER))
    {
       png_byte chunk_length[4];
 
+#ifdef PNG_READ_APNG_SUPPORTED
       if (png_ptr->buffer_size < 12)
+#else
+      if (png_ptr->buffer_size < 8)
+#endif
       {
          png_push_save_buffer(png_ptr);
          return;
       }
 
       png_push_fill_buffer(png_ptr, chunk_length, 4);
       png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
       png_reset_crc(png_ptr);
       png_crc_read(png_ptr, png_ptr->chunk_name, 4);
       png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
 
-#if defined(PNG_READ_APNG_SUPPORTED)
+#ifdef PNG_READ_APNG_SUPPORTED
       if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_fdAT, 4)
           && png_ptr->num_frames_read > 0)
       {
           if (png_ptr->flags & PNG_FLAG_ZLIB_FINISHED)
           {
               png_ptr->process_mode = PNG_READ_CHUNK_MODE;
               if (png_ptr->frame_end_fn != NULL)
                  (*(png_ptr->frame_end_fn))(png_ptr, png_ptr->num_frames_read);
@@ -907,36 +918,37 @@ png_push_read_IDAT(png_structp png_ptr)
                                    "APNG chunks");
               png_crc_finish(png_ptr, png_ptr->push_length);
               png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
               return;
           }
       }
       else 
 #endif
-      if ( png_memcmp(png_ptr->chunk_name, png_IDAT, 4)
-#if defined(PNG_READ_APNG_SUPPORTED)
-                && (png_ptr->num_frames_read == 0)
+#ifdef PNG_READ_APNG_SUPPORTED
+      if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4)
+                && (png_ptr->num_frames_read == 0))
+#else
+      if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
 #endif
-         )
       {
          png_ptr->process_mode = PNG_READ_CHUNK_MODE;
          if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
             png_error(png_ptr, "Not enough compressed data");
-#if defined(PNG_READ_APNG_SUPPORTED)
+#ifdef PNG_READ_APNG_SUPPORTED
          if (png_ptr->frame_end_fn != NULL)
             (*(png_ptr->frame_end_fn))(png_ptr, png_ptr->num_frames_read);
          png_ptr->num_frames_read++;
 #endif
          return;
       }
 
       png_ptr->idat_size = png_ptr->push_length;
       
-#if defined(PNG_READ_APNG_SUPPORTED)
+#ifdef PNG_READ_APNG_SUPPORTED
       if (png_ptr->num_frames_read > 0)
       {
          png_ensure_sequence_number(png_ptr, 4);
          png_ptr->idat_size -= 4;
       }
 #endif
    }
    if (png_ptr->idat_size && png_ptr->save_buffer_size)
@@ -976,17 +988,17 @@ png_push_read_IDAT(png_structp png_ptr)
          if ((png_uint_32)save_size != png_ptr->idat_size)
             png_error(png_ptr, "save_size overflowed in pngpread");
       }
       else
          save_size = png_ptr->current_buffer_size;
 
       png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
       if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
-        png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
+         png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
 
       png_ptr->idat_size -= save_size;
       png_ptr->buffer_size -= save_size;
       png_ptr->current_buffer_size -= save_size;
       png_ptr->current_buffer_ptr += save_size;
    }
    if (!png_ptr->idat_size)
    {
@@ -1048,17 +1060,19 @@ png_process_IDAT_data(png_structp png_pt
              png_ptr->row_number == png_ptr->num_rows))
          {
            if (png_ptr->zstream.avail_in)
              png_warning(png_ptr, "Too much data in IDAT chunks");
            png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
            break;
          }
          png_push_process_row(png_ptr);
-         png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
+         png_ptr->zstream.avail_out =
+             (uInt) PNG_ROWBYTES(png_ptr->pixel_depth,
+             png_ptr->iwidth) + 1;
          png_ptr->zstream.next_out = png_ptr->row_buf;
       }
 
       else
          break;
    }
 }
 
@@ -1313,19 +1327,16 @@ png_read_push_finish_row(png_structp png
          if (png_ptr->pass >= 7)
             break;
 
          png_ptr->iwidth = (png_ptr->width +
             png_pass_inc[png_ptr->pass] - 1 -
             png_pass_start[png_ptr->pass]) /
             png_pass_inc[png_ptr->pass];
 
-         png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,
-            png_ptr->iwidth) + 1;
-
          if (png_ptr->transformations & PNG_INTERLACE)
             break;
 
          png_ptr->num_rows = (png_ptr->height +
             png_pass_yinc[png_ptr->pass] - 1 -
             png_pass_ystart[png_ptr->pass]) /
             png_pass_yinc[png_ptr->pass];
 
@@ -1422,17 +1433,17 @@ png_push_read_tEXt(png_structp png_ptr, 
 
       ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
 
       png_free(png_ptr, key);
       png_free(png_ptr, text_ptr);
       png_ptr->current_text = NULL;
 
       if (ret)
-        png_warning(png_ptr, "Insufficient memory to store text chunk");
+         png_warning(png_ptr, "Insufficient memory to store text chunk");
    }
 }
 #endif
 
 #ifdef PNG_READ_zTXt_SUPPORTED
 void /* PRIVATE */
 png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
    length)
@@ -1623,17 +1634,17 @@ png_push_read_zTXt(png_structp png_ptr, 
       text_ptr->text = text;
 
       ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
 
       png_free(png_ptr, key);
       png_free(png_ptr, text_ptr);
 
       if (ret)
-        png_warning(png_ptr, "Insufficient memory to store text chunk");
+         png_warning(png_ptr, "Insufficient memory to store text chunk");
    }
 }
 #endif
 
 #ifdef PNG_READ_iTXt_SUPPORTED
 void /* PRIVATE */
 png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
    length)
@@ -1651,17 +1662,17 @@ png_push_handle_iTXt(png_structp png_ptr
    {
       png_warning(png_ptr, "iTXt chunk too large to fit in memory");
       png_ptr->skip_length = length - (png_uint_32)65535L;
       length = (png_uint_32)65535L;
    }
 #endif
 
    png_ptr->current_text = (png_charp)png_malloc(png_ptr,
-      (png_size_t)(length + 1));
+       (png_size_t)(length + 1));
    png_ptr->current_text[length] = '\0';
    png_ptr->current_text_ptr = png_ptr->current_text;
    png_ptr->current_text_size = (png_size_t)length;
    png_ptr->current_text_left = (png_size_t)length;
    png_ptr->process_mode = PNG_READ_iTXt_MODE;
 }
 
 void /* PRIVATE */
@@ -1744,17 +1755,17 @@ png_push_read_iTXt(png_structp png_ptr, 
       text_ptr->itxt_length = png_strlen(text);
 
       ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
 
       png_ptr->current_text = NULL;
 
       png_free(png_ptr, text_ptr);
       if (ret)
-        png_warning(png_ptr, "Insufficient memory to store iTXt chunk");
+         png_warning(png_ptr, "Insufficient memory to store iTXt chunk");
    }
 }
 #endif
 
 /* This function is called when we haven't found a handler for this
  * chunk.  If there isn't a problem with the chunk itself (ie a bad chunk
  * name or a critical chunk), the chunk is (currently) silently ignored.
  */
@@ -1763,21 +1774,21 @@ png_push_handle_unknown(png_structp png_
    length)
 {
    png_uint_32 skip = 0;
 
    if (!(png_ptr->chunk_name[0] & 0x20))
    {
 #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
       if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
-         PNG_HANDLE_CHUNK_ALWAYS
+          PNG_HANDLE_CHUNK_ALWAYS
 #ifdef PNG_READ_USER_CHUNKS_SUPPORTED
-         && png_ptr->read_user_chunk_fn == NULL
+          && png_ptr->read_user_chunk_fn == NULL
 #endif
-         )
+          )
 #endif
          png_chunk_error(png_ptr, "unknown critical chunk");
 
       info_ptr = info_ptr; /* To quiet some compiler warnings */
    }
 
 #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
    if (png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
@@ -1786,58 +1797,58 @@ png_push_handle_unknown(png_structp png_
       if (length > (png_uint_32)65535L)
       {
           png_warning(png_ptr, "unknown chunk too large to fit in memory");
           skip = length - (png_uint_32)65535L;
           length = (png_uint_32)65535L;
       }
 #endif
       png_memcpy((png_charp)png_ptr->unknown_chunk.name,
-                 (png_charp)png_ptr->chunk_name, 
-                 png_sizeof(png_ptr->unknown_chunk.name));
+          (png_charp)png_ptr->chunk_name, 
+          png_sizeof(png_ptr->unknown_chunk.name));
       png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name) - 1]
-        = '\0';
+          = '\0';
 
       png_ptr->unknown_chunk.size = (png_size_t)length;
 
       if (length == 0)
          png_ptr->unknown_chunk.data = NULL;
 
       else
       {
          png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr,
-       (png_size_t)length);
+             (png_size_t)length);
          png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
       }
 
 #ifdef PNG_READ_USER_CHUNKS_SUPPORTED
       if (png_ptr->read_user_chunk_fn != NULL)
       {
          /* Callback to user unknown chunk handler */
          int ret;
          ret = (*(png_ptr->read_user_chunk_fn))
-           (png_ptr, &png_ptr->unknown_chunk);
+             (png_ptr, &png_ptr->unknown_chunk);
 
          if (ret < 0)
             png_chunk_error(png_ptr, "error in user chunk");
 
          if (ret == 0)
          {
             if (!(png_ptr->chunk_name[0] & 0x20))
                if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
-                    PNG_HANDLE_CHUNK_ALWAYS)
+                   PNG_HANDLE_CHUNK_ALWAYS)
                   png_chunk_error(png_ptr, "unknown critical chunk");
             png_set_unknown_chunks(png_ptr, info_ptr,
-               &png_ptr->unknown_chunk, 1);
+                &png_ptr->unknown_chunk, 1);
          }
       }
 
       else
 #endif
-        png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
+         png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
       png_free(png_ptr, png_ptr->unknown_chunk.data);
       png_ptr->unknown_chunk.data = NULL;
    }
 
    else
 #endif
       skip=length;
    png_push_crc_skip(png_ptr, skip);
@@ -1889,17 +1900,17 @@ png_set_progressive_read_fn(png_structp 
 
    png_ptr->info_fn = info_fn;
    png_ptr->row_fn = row_fn;
    png_ptr->end_fn = end_fn;
 
    png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
 }
 
-#if defined(PNG_READ_APNG_SUPPORTED)
+#ifdef PNG_READ_APNG_SUPPORTED
 void PNGAPI
 png_set_progressive_frame_fn(png_structp png_ptr,
    png_progressive_frame_ptr frame_info_fn,
    png_progressive_frame_ptr frame_end_fn)
 {
    png_ptr->frame_info_fn = frame_info_fn;
    png_ptr->frame_end_fn = frame_end_fn;
 }
--- a/modules/libimg/png/pngpriv.h
+++ b/modules/libimg/png/pngpriv.h
@@ -1,12 +1,12 @@
 
 /* pngpriv.h - private declarations for use inside libpng
  *
- * libpng version 1.4.0 - January 3, 2010
+ * libpng version 1.4.1 - February 25, 2010
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
@@ -355,18 +355,18 @@ PNG_EXTERN void png_write_IDAT PNGARG((p
 
 PNG_EXTERN void png_write_IEND PNGARG((png_structp png_ptr));
 
 #ifdef PNG_WRITE_gAMA_SUPPORTED
 #ifdef PNG_FLOATING_POINT_SUPPORTED
 PNG_EXTERN void png_write_gAMA PNGARG((png_structp png_ptr, double file_gamma));
 #endif
 #ifdef PNG_FIXED_POINT_SUPPORTED
-PNG_EXTERN void png_write_gAMA_fixed PNGARG((png_structp png_ptr, png_fixed_point
-    file_gamma));
+PNG_EXTERN void png_write_gAMA_fixed PNGARG((png_structp png_ptr,
+    png_fixed_point file_gamma));
 #endif
 #endif
 
 #ifdef PNG_WRITE_sBIT_SUPPORTED
 PNG_EXTERN void png_write_sBIT PNGARG((png_structp png_ptr, png_color_8p sbit,
    int color_type));
 #endif
 
@@ -585,17 +585,18 @@ PNG_EXTERN void png_do_write_invert_alph
 PNG_EXTERN void png_do_strip_filler PNGARG((png_row_infop row_info,
    png_bytep row, png_uint_32 flags));
 #endif
 
 #if defined(PNG_READ_SWAP_SUPPORTED) || defined(PNG_WRITE_SWAP_SUPPORTED)
 PNG_EXTERN void png_do_swap PNGARG((png_row_infop row_info, png_bytep row));
 #endif
 
-#if defined(PNG_READ_PACKSWAP_SUPPORTED) || defined(PNG_WRITE_PACKSWAP_SUPPORTED)
+#if defined(PNG_READ_PACKSWAP_SUPPORTED) || \
+    defined(PNG_WRITE_PACKSWAP_SUPPORTED)
 PNG_EXTERN void png_do_packswap PNGARG((png_row_infop row_info, png_bytep row));
 #endif
 
 #ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 PNG_EXTERN int png_do_rgb_to_gray PNGARG((png_structp png_ptr, png_row_infop
    row_info, png_bytep row));
 #endif
 
--- a/modules/libimg/png/pngread.c
+++ b/modules/libimg/png/pngread.c
@@ -1,12 +1,12 @@
 
 /* pngread.c - read a PNG file
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -26,17 +26,19 @@ png_create_read_struct(png_const_charp u
    png_error_ptr error_fn, png_error_ptr warn_fn)
 {
 
 #ifdef PNG_USER_MEM_SUPPORTED
    return (png_create_read_struct_2(user_png_ver, error_ptr, error_fn,
       warn_fn, NULL, NULL, NULL));
 }
 
-/* Alternate create PNG structure for reading, and allocate any memory needed. */
+/* Alternate create PNG structure for reading, and allocate any memory
+ * needed.
+ */
 png_structp PNGAPI
 png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
    png_error_ptr error_fn, png_error_ptr warn_fn, png_voidp mem_ptr,
    png_malloc_ptr malloc_fn, png_free_ptr free_fn)
 {
 #endif /* PNG_USER_MEM_SUPPORTED */
 
 #ifdef PNG_SETJMP_SUPPORTED
@@ -60,21 +62,27 @@ png_create_read_struct_2(png_const_charp
       malloc_fn, mem_ptr);
 #else
    png_ptr = (png_structp)png_create_struct(PNG_STRUCT_PNG);
 #endif
    if (png_ptr == NULL)
       return (NULL);
 
    /* Added at libpng-1.2.6 */
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+#ifdef PNG_USER_LIMITS_SUPPORTED
    png_ptr->user_width_max = PNG_USER_WIDTH_MAX;
    png_ptr->user_height_max = PNG_USER_HEIGHT_MAX;
-   /* Added at libpng-1.4.0 */
+#  ifdef PNG_USER_CHUNK_CACHE_MAX
+   /* Added at libpng-1.2.43 and 1.4.0 */
    png_ptr->user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;
+#  endif
+#  ifdef PNG_SET_USER_CHUNK_MALLOC_MAX
+   /* Added at libpng-1.2.43 and 1.4.1 */
+   png_ptr->user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;
+#  endif
 #endif
 
 #ifdef PNG_SETJMP_SUPPORTED
 /* Applications that neglect to set up their own setjmp() and then
    encounter a png_error() will longjmp here.  Since the jmpbuf is
    then meaningless we abort instead of returning. */
 #ifdef USE_FAR_KEYWORD
    if (setjmp(jmpbuf))
@@ -287,16 +295,21 @@ png_read_info(png_structp png_ptr, png_i
       PNG_tIME;
 #endif
 #ifdef PNG_READ_tRNS_SUPPORTED
       PNG_tRNS;
 #endif
 #ifdef PNG_READ_zTXt_SUPPORTED
       PNG_zTXt;
 #endif
+#if defined(PNG_READ_APNG_SUPPORTED)
+      PNG_acTL;
+      PNG_fcTL;
+      PNG_fdAT;
+#endif
       png_uint_32 length = png_read_chunk_header(png_ptr);
       PNG_CONST png_bytep chunk_name = png_ptr->chunk_name;
 
       /* This should be a binary subdivision search or a hash for
        * matching the chunk name rather than a linear search.
        */
       if (!png_memcmp(chunk_name, png_IDAT, 4))
         if (png_ptr->mode & PNG_AFTER_IDAT)
@@ -443,21 +456,19 @@ png_read_frame_head(png_structp png_ptr,
     png_crc_finish(png_ptr, 0); /* CRC from last IDAT or fdAT chunk */
     
     png_read_reset(png_ptr);
     png_ptr->mode &= ~PNG_HAVE_fcTL;
     
     have_chunk_after_DAT = 0;
     for (;;)
     {
-#ifdef PNG_USE_LOCAL_ARRAYS
         PNG_IDAT;
         PNG_fdAT;
         PNG_fcTL;
-#endif
         png_byte chunk_length[4];
         png_uint_32 length;
         
         png_read_data(png_ptr, chunk_length, 4);
         length = png_get_uint_31(png_ptr, chunk_length);
         
         png_reset_crc(png_ptr);
         png_crc_read(png_ptr, png_ptr->chunk_name, 4);
@@ -564,17 +575,18 @@ png_read_row(png_structp png_ptr, png_by
 #if defined(PNG_WRITE_INVERT_SUPPORTED) && !defined(PNG_READ_INVERT_SUPPORTED)
    if (png_ptr->transformations & PNG_INVERT_MONO)
       png_warning(png_ptr, "PNG_READ_INVERT_SUPPORTED is not defined");
 #endif
 #if defined(PNG_WRITE_FILLER_SUPPORTED) && !defined(PNG_READ_FILLER_SUPPORTED)
    if (png_ptr->transformations & PNG_FILLER)
       png_warning(png_ptr, "PNG_READ_FILLER_SUPPORTED is not defined");
 #endif
-#if defined(PNG_WRITE_PACKSWAP_SUPPORTED) && !defined(PNG_READ_PACKSWAP_SUPPORTED)
+#if defined(PNG_WRITE_PACKSWAP_SUPPORTED) && \
+    !defined(PNG_READ_PACKSWAP_SUPPORTED)
    if (png_ptr->transformations & PNG_PACKSWAP)
       png_warning(png_ptr, "PNG_READ_PACKSWAP_SUPPORTED is not defined");
 #endif
 #if defined(PNG_WRITE_PACK_SUPPORTED) && !defined(PNG_READ_PACK_SUPPORTED)
    if (png_ptr->transformations & PNG_PACK)
       png_warning(png_ptr, "PNG_READ_PACK_SUPPORTED is not defined");
 #endif
 #if defined(PNG_WRITE_SHIFT_SUPPORTED) && !defined(PNG_READ_SHIFT_SUPPORTED)
@@ -667,55 +679,30 @@ png_read_row(png_structp png_ptr, png_by
       }
    }
 #endif
 
    if (!(png_ptr->mode & PNG_HAVE_IDAT))
       png_error(png_ptr, "Invalid attempt to read row data");
 
    png_ptr->zstream.next_out = png_ptr->row_buf;
-   png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
+   png_ptr->zstream.avail_out =
+       (uInt)(PNG_ROWBYTES(png_ptr->pixel_depth,
+       png_ptr->iwidth) + 1);
    do
    {
       if (!(png_ptr->zstream.avail_in))
       {
-         png_uint_32 bytes_to_skip = 0;
-         
-         while (!png_ptr->idat_size || bytes_to_skip != 0)
+         while (!png_ptr->idat_size)
          {
-            png_crc_finish(png_ptr, bytes_to_skip);
-            bytes_to_skip = 0;
-            
+            png_crc_finish(png_ptr, 0);
+
             png_ptr->idat_size = png_read_chunk_header(png_ptr);
-            
-#if defined(PNG_READ_APNG_SUPPORTED)
-            if (png_ptr->num_frames_read == 0)
-            {
-#endif
-               if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
-                  png_error(png_ptr, "Not enough image data");
-#if defined(PNG_READ_APNG_SUPPORTED)
-            }
-            else
-            {
-               if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
-                  png_error(png_ptr, "Not enough image data");
-               if (png_memcmp(png_ptr->chunk_name, png_fdAT, 4))
-               {
-                  png_warning(png_ptr, "Skipped (ignored) a chunk "
-                                       "between APNG chunks");
-                  bytes_to_skip = png_ptr->idat_size;
-                  continue;
-               }
-               
-               png_ensure_sequence_number(png_ptr, png_ptr->idat_size);
-               
-               png_ptr->idat_size -= 4;
-            }
-#endif
+            if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
+               png_error(png_ptr, "Not enough image data");
          }
          png_ptr->zstream.avail_in = (uInt)png_ptr->zbuf_size;
          png_ptr->zstream.next_in = png_ptr->zbuf;
          if (png_ptr->zbuf_size > png_ptr->idat_size)
             png_ptr->zstream.avail_in = (uInt)png_ptr->idat_size;
          png_crc_read(png_ptr, png_ptr->zbuf,
             (png_size_t)png_ptr->zstream.avail_in);
          png_ptr->idat_size -= png_ptr->zstream.avail_in;
@@ -1166,17 +1153,18 @@ png_destroy_read_struct(png_structpp png
       png_destroy_struct((png_voidp)png_ptr);
 #endif
       *png_ptr_ptr = NULL;
    }
 }
 
 /* Free all memory used by the read (old method) */
 void /* PRIVATE */
-png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr)
+png_read_destroy(png_structp png_ptr, png_infop info_ptr,
+    png_infop end_info_ptr)
 {
 #ifdef PNG_SETJMP_SUPPORTED
    jmp_buf tmp_jmp;
 #endif
    png_error_ptr error_fn;
    png_error_ptr warning_fn;
    png_voidp error_ptr;
 #ifdef PNG_USER_MEM_SUPPORTED
--- a/modules/libimg/png/pngrio.c
+++ b/modules/libimg/png/pngrio.c
@@ -1,12 +1,12 @@
 
 /* pngrio.c - functions for data input
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
--- a/modules/libimg/png/pngrtran.c
+++ b/modules/libimg/png/pngrtran.c
@@ -1,12 +1,12 @@
 
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -427,18 +427,20 @@ png_set_dither(png_structp png_ptr, png_
                            }
                         }
 
                         png_ptr->index_to_palette[png_ptr->palette_to_index
                            [num_new_palette]] = png_ptr->index_to_palette[j];
                         png_ptr->palette_to_index[png_ptr->index_to_palette[j]]
                            = png_ptr->palette_to_index[num_new_palette];
 
-                        png_ptr->index_to_palette[j] = (png_byte)num_new_palette;
-                        png_ptr->palette_to_index[num_new_palette] = (png_byte)j;
+                        png_ptr->index_to_palette[j] =
+                            (png_byte)num_new_palette;
+                        png_ptr->palette_to_index[num_new_palette] =
+                            (png_byte)j;
                      }
                      if (num_new_palette <= maximum_colors)
                         break;
                   }
                   if (num_new_palette <= maximum_colors)
                      break;
                }
             }
@@ -497,17 +499,18 @@ png_set_dither(png_structp png_ptr, png_
          int r = (palette[i].red >> (8 - PNG_DITHER_RED_BITS));
          int g = (palette[i].green >> (8 - PNG_DITHER_GREEN_BITS));
          int b = (palette[i].blue >> (8 - PNG_DITHER_BLUE_BITS));
 
          for (ir = 0; ir < num_red; ir++)
          {
             /* int dr = abs(ir - r); */
             int dr = ((ir > r) ? ir - r : r - ir);
-            int index_r = (ir << (PNG_DITHER_BLUE_BITS + PNG_DITHER_GREEN_BITS));
+            int index_r = (ir << (PNG_DITHER_BLUE_BITS +
+                PNG_DITHER_GREEN_BITS));
 
             for (ig = 0; ig < num_green; ig++)
             {
                /* int dg = abs(ig - g); */
                int dg = ((ig > g) ? ig - g : g - ig);
                int dt = dr + dg;
                int dm = ((dr > dg) ? dr : dg);
                int index_g = index_r | (ig << PNG_DITHER_BLUE_BITS);
@@ -742,18 +745,19 @@ png_set_read_user_transform_fn(png_struc
  * the palette.
  */
 void /* PRIVATE */
 png_init_read_transformations(png_structp png_ptr)
 {
    png_debug(1, "in png_init_read_transformations");
 
   {
-#if defined(PNG_READ_BACKGROUND_SUPPORTED) || defined(PNG_READ_SHIFT_SUPPORTED) \
- || defined(PNG_READ_GAMMA_SUPPORTED)
+#if defined(PNG_READ_BACKGROUND_SUPPORTED) || \
+    defined(PNG_READ_SHIFT_SUPPORTED) || \
+    defined(PNG_READ_GAMMA_SUPPORTED)
    int color_type = png_ptr->color_type;
 #endif
 
 #if defined(PNG_READ_EXPAND_SUPPORTED) && defined(PNG_READ_BACKGROUND_SUPPORTED)
 
 #ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
    /* Detect gray background and attempt to enable optimization
     * for gray --> RGB case
@@ -881,21 +885,17 @@ png_init_read_transformations(png_struct
     }
     if (k == 0)
       png_ptr->transformations &= ~PNG_GAMMA;
    }
 
    if ((png_ptr->transformations & (PNG_GAMMA | PNG_RGB_TO_GRAY)) &&
         png_ptr->gamma != 0.0)
    {
-      if (png_ptr->transformations & PNG_16_TO_8)
-/*         png_build_gamma_table(png_ptr, 8); */
-         png_build_gamma_table(png_ptr, png_ptr->bit_depth);
-      else
-         png_build_gamma_table(png_ptr, png_ptr->bit_depth);
+      png_build_gamma_table(png_ptr, png_ptr->bit_depth);
 
 #ifdef PNG_READ_BACKGROUND_SUPPORTED
       if (png_ptr->transformations & PNG_BACKGROUND)
       {
          if (color_type == PNG_COLOR_TYPE_PALETTE)
          {
            /* Could skip if no transparency */
             png_color back, back_1;
@@ -944,17 +944,18 @@ png_init_read_transformations(png_struct
                   back.green = (png_byte)png_ptr->background.green;
                   back.blue  = (png_byte)png_ptr->background.blue;
                }
                else
                {
                   back.red = (png_byte)(pow(
                      (double)png_ptr->background.red/255.0, gs) * 255.0 + .5);
                   back.green = (png_byte)(pow(
-                     (double)png_ptr->background.green/255.0, gs) * 255.0 + .5);
+                     (double)png_ptr->background.green/255.0, gs) * 255.0
+                         + .5);
                   back.blue = (png_byte)(pow(
                      (double)png_ptr->background.blue/255.0, gs) * 255.0 + .5);
                }
 
                back_1.red = (png_byte)(pow(
                   (double)png_ptr->background.red/255.0, g) * 255.0 + .5);
                back_1.green = (png_byte)(pow(
                   (double)png_ptr->background.green/255.0, g) * 255.0 + .5);
@@ -1356,17 +1357,18 @@ png_do_read_transformations(png_structp 
       png_do_strip_filler(&(png_ptr->row_info), png_ptr->row_buf + 1,
          PNG_FLAG_FILLER_AFTER | (png_ptr->flags & PNG_FLAG_STRIP_ALPHA));
 #endif
 
 #ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
    if (png_ptr->transformations & PNG_RGB_TO_GRAY)
    {
       int rgb_error =
-         png_do_rgb_to_gray(png_ptr, &(png_ptr->row_info), png_ptr->row_buf + 1);
+         png_do_rgb_to_gray(png_ptr, &(png_ptr->row_info),
+             png_ptr->row_buf + 1);
       if (rgb_error)
       {
          png_ptr->rgb_to_gray_status=1;
          if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
              PNG_RGB_TO_GRAY_WARN)
             png_warning(png_ptr, "png_do_rgb_to_gray found nongray pixel");
          if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
              PNG_RGB_TO_GRAY_ERR)
@@ -2342,17 +2344,18 @@ png_do_rgb_to_gray(png_structp png_ptr, 
                   blue  = (png_uint_16)(((*(sp))<<8) | *(sp+1)); sp+=2;
 
                   if (red == green && red == blue)
                      w = red;
                   else
                   {
                      png_uint_16 red_1   = png_ptr->gamma_16_to_1[(red&0xff) >>
                                   png_ptr->gamma_shift][red>>8];
-                     png_uint_16 green_1 = png_ptr->gamma_16_to_1[(green&0xff) >>
+                     png_uint_16 green_1 =
+                         png_ptr->gamma_16_to_1[(green&0xff) >>
                                   png_ptr->gamma_shift][green>>8];
                      png_uint_16 blue_1  = png_ptr->gamma_16_to_1[(blue&0xff) >>
                                   png_ptr->gamma_shift][blue>>8];
                      png_uint_16 gray16  = (png_uint_16)((rc*red_1 + gc*green_1
                                   + bc*blue_1)>>15);
                      w = png_ptr->gamma_16_from_1[(gray16&0xff) >>
                          png_ptr->gamma_shift][gray16 >> 8];
                      rgb_error |= 1;
@@ -2438,23 +2441,24 @@ png_do_rgb_to_gray(png_structp png_ptr, 
                   green = (png_uint_16)(((*(sp))<<8) | *(sp+1)); sp+=2;
                   blue  = (png_uint_16)(((*(sp))<<8) | *(sp+1)); sp+=2;
 
                   if (red == green && red == blue)
                      w = red;
                   else
                   {
                      png_uint_16 red_1   = png_ptr->gamma_16_to_1[(red&0xff) >>
-                                  png_ptr->gamma_shift][red>>8];
-                     png_uint_16 green_1 = png_ptr->gamma_16_to_1[(green&0xff) >>
-                                  png_ptr->gamma_shift][green>>8];
+                         png_ptr->gamma_shift][red>>8];
+                     png_uint_16 green_1 =
+                         png_ptr->gamma_16_to_1[(green&0xff) >>
+                         png_ptr->gamma_shift][green>>8];
                      png_uint_16 blue_1  = png_ptr->gamma_16_to_1[(blue&0xff) >>
-                                  png_ptr->gamma_shift][blue>>8];
+                         png_ptr->gamma_shift][blue>>8];
                      png_uint_16 gray16  = (png_uint_16)((rc * red_1
-                                  + gc * green_1 + bc * blue_1)>>15);
+                         + gc * green_1 + bc * blue_1)>>15);
                      w = png_ptr->gamma_16_from_1[(gray16&0xff) >>
                          png_ptr->gamma_shift][gray16 >> 8];
                      rgb_error |= 1;
                   }
 
                   *(dp++) = (png_byte)((w>>8) & 0xff);
                   *(dp++) = (png_byte)(w & 0xff);
                   *(dp++) = *(sp++);  /* alpha */
@@ -3374,34 +3378,34 @@ png_do_gamma(png_row_infop row_info, png
                for (i = 0; i < row_width; i += 4)
                {
                   int a = *sp & 0xc0;
                   int b = *sp & 0x30;
                   int c = *sp & 0x0c;
                   int d = *sp & 0x03;
 
                   *sp = (png_byte)(
-                        ((((int)gamma_table[a|(a>>2)|(a>>4)|(a>>6)])   ) & 0xc0)|
-                        ((((int)gamma_table[(b<<2)|b|(b>>2)|(b>>4)])>>2) & 0x30)|
-                        ((((int)gamma_table[(c<<4)|(c<<2)|c|(c>>2)])>>4) & 0x0c)|
-                        ((((int)gamma_table[(d<<6)|(d<<4)|(d<<2)|d])>>6) ));
+                      ((((int)gamma_table[a|(a>>2)|(a>>4)|(a>>6)])   ) & 0xc0)|
+                      ((((int)gamma_table[(b<<2)|b|(b>>2)|(b>>4)])>>2) & 0x30)|
+                      ((((int)gamma_table[(c<<4)|(c<<2)|c|(c>>2)])>>4) & 0x0c)|
+                      ((((int)gamma_table[(d<<6)|(d<<4)|(d<<2)|d])>>6) ));
                   sp++;
                }
             }
 
             if (row_info->bit_depth == 4)
             {
                sp = row;
                for (i = 0; i < row_width; i += 2)
                {
                   int msb = *sp & 0xf0;
                   int lsb = *sp & 0x0f;
 
                   *sp = (png_byte)((((int)gamma_table[msb | (msb >> 4)]) & 0xf0)
-                          | (((int)gamma_table[(lsb << 4) | lsb]) >> 4));
+                      | (((int)gamma_table[(lsb << 4) | lsb]) >> 4));
                   sp++;
                }
             }
 
             else if (row_info->bit_depth == 8)
             {
                sp = row;
                for (i = 0; i < row_width; i++)
--- a/modules/libimg/png/pngrutil.c
+++ b/modules/libimg/png/pngrutil.c
@@ -1,12 +1,12 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -196,204 +196,217 @@ png_crc_error(png_structp png_ptr)
       return ((int)(crc != png_ptr->crc));
    }
    else
       return (0);
 }
 
 #if defined(PNG_READ_zTXt_SUPPORTED) || defined(PNG_READ_iTXt_SUPPORTED) || \
     defined(PNG_READ_iCCP_SUPPORTED)
+
+/*
+ * Decompress trailing data in a chunk.  The assumption is that chunkdata
+ * points at an allocated area holding the contents of a chunk with a
+ * trailing compressed part.  What we get back is an allocated area
+ * holding the original prefix part and an uncompressed version of the
+ * trailing part (the malloc area passed in is freed).
+ */
+static png_size_t
+png_inflate(png_structp png_ptr, const png_byte *data, png_size_t size,
+	png_bytep output, png_size_t output_size)
+{
+   png_size_t count = 0;
+
+   png_ptr->zstream.next_in = (png_bytep)data; /* const_cast: VALID */
+   png_ptr->zstream.avail_in = size;
+
+   while (1)
+   {
+      int ret, avail;
+
+      /* Reset the output buffer each time round - we empty it
+       * after every inflate call.
+       */
+      png_ptr->zstream.next_out = png_ptr->zbuf;
+      png_ptr->zstream.avail_out = png_ptr->zbuf_size;
+
+      ret = inflate(&png_ptr->zstream, Z_NO_FLUSH);
+      avail = png_ptr->zbuf_size - png_ptr->zstream.avail_out;
+
+      /* First copy/count any new output - but only if we didn't
+       * get an error code.
+       */
+      if ((ret == Z_OK || ret == Z_STREAM_END) && avail > 0)
+      {
+         if (output != 0 && output_size > count)
+	 {
+	    int copy = output_size - count;
+	    if (avail < copy) copy = avail;
+	    png_memcpy(output + count, png_ptr->zbuf, copy);
+	 }
+         count += avail;
+      }
+
+      if (ret == Z_OK)
+         continue;
+
+      /* Termination conditions - always reset the zstream, it
+       * must be left in inflateInit state.
+       */
+      png_ptr->zstream.avail_in = 0;
+      inflateReset(&png_ptr->zstream);
+
+      if (ret == Z_STREAM_END)
+         return count; /* NOTE: may be zero. */
+
+      /* Now handle the error codes - the API always returns 0
+       * and the error message is dumped into the uncompressed
+       * buffer if available.
+       */
+      {
+         char *msg, umsg[52];
+	 if (png_ptr->zstream.msg != 0)
+	    msg = png_ptr->zstream.msg;
+	 else
+	 {
+#ifdef PNG_STDIO_SUPPORTED
+	    switch (ret)
+	    {
+	 case Z_BUF_ERROR:
+	    msg = "Buffer error in compressed datastream in %s chunk";
+	    break;
+	 case Z_DATA_ERROR:
+	    msg = "Data error in compressed datastream in %s chunk";
+	    break;
+	 default:
+	    msg = "Incomplete compressed datastream in %s chunk";
+	    break;
+	    }
+
+	    png_snprintf(umsg, sizeof umsg, msg, png_ptr->chunk_name);
+	    msg = umsg;
+#else
+	    msg = "Damaged compressed datastream in chunk other than IDAT";
+#endif
+	 }
+
+         png_warning(png_ptr, msg);
+      }
+
+      /* 0 means an error - notice that this code simple ignores
+       * zero length compressed chunks as a result.
+       */
+      return 0;
+   }
+}
+
 /*
  * Decompress trailing data in a chunk.  The assumption is that chunkdata
  * points at an allocated area holding the contents of a chunk with a
  * trailing compressed part.  What we get back is an allocated area
  * holding the original prefix part and an uncompressed version of the
  * trailing part (the malloc area passed in is freed).
  */
 void /* PRIVATE */
 png_decompress_chunk(png_structp png_ptr, int comp_type,
-                              png_size_t chunklength,
-                              png_size_t prefix_size, png_size_t *newlength)
+    png_size_t chunklength,
+    png_size_t prefix_size, png_size_t *newlength)
 {
-   static PNG_CONST char msg[] = "Error decoding compressed chunk";
-   png_charp text;
-   png_size_t text_size;
-
-   if (comp_type == PNG_COMPRESSION_TYPE_BASE)
+   /* The caller should guarantee this */
+   if (prefix_size > chunklength)
+   {
+      /* The recovery is to delete the chunk. */
+      png_warning(png_ptr, "invalid chunklength");
+      prefix_size = 0; /* To delete everything */
+   }
+
+   else if (comp_type == PNG_COMPRESSION_TYPE_BASE)
    {
-      int ret = Z_OK;
-      png_ptr->zstream.next_in = (png_bytep)(png_ptr->chunkdata + prefix_size);
-      png_ptr->zstream.avail_in = (uInt)(chunklength - prefix_size);
-      png_ptr->zstream.next_out = png_ptr->zbuf;
-      png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
-
-      text_size = 0;
-      text = NULL;
-
-      while (png_ptr->zstream.avail_in)
+      png_size_t expanded_size = png_inflate(png_ptr,
+		(png_bytep)(png_ptr->chunkdata + prefix_size),
+                chunklength - prefix_size,
+		0/*output*/, 0/*output size*/);
+
+      /* Now check the limits on this chunk - if the limit fails the
+       * compressed data will be removed, the prefix will remain.
+       */
+      if (prefix_size + expanded_size >= 3999999L)
+         png_warning(png_ptr, "Exceeded size limit while expanding chunk");
+
+      /* If the size is zero either there was an error and a message
+       * has already been output (warning) or the size really is zero
+       * and we have nothing to do - the code will exit through the
+       * error case below.
+       */
+      else if (expanded_size > 0)
       {
-         ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
-         if (ret != Z_OK && ret != Z_STREAM_END)
-         {
-            if (png_ptr->zstream.msg != NULL)
-               png_warning(png_ptr, png_ptr->zstream.msg);
-            else
-               png_warning(png_ptr, msg);
-            inflateReset(&png_ptr->zstream);
-            png_ptr->zstream.avail_in = 0;
-
-            if (text ==  NULL)
-            {
-               text_size = prefix_size + png_sizeof(msg) + 1;
-               text = (png_charp)png_malloc_warn(png_ptr, text_size);
-               if (text ==  NULL)
-                 {
-                    png_free(png_ptr, png_ptr->chunkdata);
-                    png_ptr->chunkdata = NULL;
-                    png_error(png_ptr, "Not enough memory to decompress chunk");
-                 }
-               png_memcpy(text, png_ptr->chunkdata, prefix_size);
-            }
-
-            text[text_size - 1] = 0x00;
-
-            /* Copy what we can of the error message into the text chunk */
-            text_size = (png_size_t)(chunklength -
-              (text - png_ptr->chunkdata) - 1);
-            if (text_size > png_sizeof(msg))
-               text_size = png_sizeof(msg);
-            png_memcpy(text + prefix_size, msg, text_size);
-            break;
-         }
-         if (!png_ptr->zstream.avail_out || ret == Z_STREAM_END)
+         /* Success (maybe) - really uncompress the chunk. */
+	 png_size_t new_size = 0;
+	 png_charp text = png_malloc_warn(png_ptr,
+			prefix_size + expanded_size + 1);
+
+         if (text != NULL)
          {
-            if (text == NULL)
-            {
-               text_size = prefix_size +
-                   png_ptr->zbuf_size - png_ptr->zstream.avail_out;
-               text = (png_charp)png_malloc_warn(png_ptr, text_size + 1);
-               if (text ==  NULL)
-               {
-                  png_free(png_ptr, png_ptr->chunkdata);
-                  png_ptr->chunkdata = NULL;
-                  png_error(png_ptr,
-                    "Not enough memory to decompress chunk");
-               }
-               png_memcpy(text + prefix_size, png_ptr->zbuf,
-                    text_size - prefix_size);
-               png_memcpy(text, png_ptr->chunkdata, prefix_size);
-               *(text + text_size) = 0x00;
-            }
-            else
-            {
-               png_charp tmp;
-
-               tmp = text;
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
-               if ((png_ptr->user_chunk_cache_max != 0) &&
-                  (--png_ptr->user_chunk_cache_max == 0))
-               {
-                  png_warning(png_ptr, "No space in chunk cache");
-                  text = NULL;
-               }
-
-               else
-               {
-#endif
-                  text = (png_charp)png_malloc_warn(png_ptr,
-                     (png_size_t)(text_size +
-                      png_ptr->zbuf_size - png_ptr->zstream.avail_out + 1));
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
-               }
-#endif
-               if (text == NULL)
-               {
-                  png_free(png_ptr, tmp);
-                  png_free(png_ptr, png_ptr->chunkdata);
-                  png_ptr->chunkdata = NULL;
-                  png_error(png_ptr,
-                    "Not enough memory to decompress chunk");
-               }
-               png_memcpy(text, tmp, text_size);
-               png_free(png_ptr, tmp);
-               png_memcpy(text + text_size, png_ptr->zbuf,
-                  (png_ptr->zbuf_size - png_ptr->zstream.avail_out));
-               text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
-               *(text + text_size) = 0x00;
-            }
-            if (ret == Z_STREAM_END)
-               break;
-            else
-            {
-               png_ptr->zstream.next_out = png_ptr->zbuf;
-               png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
-            }
-         }
+	    png_memcpy(text, png_ptr->chunkdata, prefix_size);
+	    new_size = png_inflate(png_ptr,
+                (png_bytep)(png_ptr->chunkdata + prefix_size),
+		chunklength - prefix_size,
+                (png_bytep)(text + prefix_size), expanded_size);
+	    text[prefix_size + expanded_size] = 0; /* just in case */
+
+	    if (new_size == expanded_size)
+	    {
+	       png_free(png_ptr, png_ptr->chunkdata);
+	       png_ptr->chunkdata = text;
+	       *newlength = prefix_size + expanded_size;
+	       return; /* The success return! */
+	    }
+      
+	    png_warning(png_ptr, "png_inflate logic error");
+	    png_free(png_ptr, text);
+	 }
+	 else
+          png_warning(png_ptr, "Not enough memory to decompress chunk");
       }
-      if (ret != Z_STREAM_END)
-      {
-#ifdef PNG_STDIO_SUPPORTED
-         char umsg[52];
-
-         if (ret == Z_BUF_ERROR)
-            png_snprintf(umsg, 52,
-                "Buffer error in compressed datastream in %s chunk",
-                png_ptr->chunk_name);
-
-         else if (ret == Z_DATA_ERROR)
-            png_snprintf(umsg, 52,
-                "Data error in compressed datastream in %s chunk",
-                png_ptr->chunk_name);
-
-         else
-            png_snprintf(umsg, 52,
-                "Incomplete compressed datastream in %s chunk",
-                png_ptr->chunk_name);
-
-         png_warning(png_ptr, umsg);
-#else
-         png_warning(png_ptr,
-            "Incomplete compressed datastream in chunk other than IDAT");
-#endif
-         text_size = prefix_size;
-         if (text ==  NULL)
-         {
-            text = (png_charp)png_malloc_warn(png_ptr, text_size+1);
-            if (text == NULL)
-              {
-                png_free(png_ptr, png_ptr->chunkdata);
-                png_ptr->chunkdata = NULL;
-                png_error(png_ptr, "Not enough memory for text");
-              }
-            png_memcpy(text, png_ptr->chunkdata, prefix_size);
-         }
-         *(text + text_size) = 0x00;
-      }
-
-      inflateReset(&png_ptr->zstream);
-      png_ptr->zstream.avail_in = 0;
-
-      png_free(png_ptr, png_ptr->chunkdata);
-      png_ptr->chunkdata = text;
-      *newlength=text_size;
    }
+
    else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */
    {
+      char umsg[50];
+
 #ifdef PNG_STDIO_SUPPORTED
-      char umsg[50];
-
-      png_snprintf(umsg, 50, "Unknown zTXt compression type %d", comp_type);
+      png_snprintf(umsg, sizeof umsg, "Unknown zTXt compression type %d", comp_type);
       png_warning(png_ptr, umsg);
 #else
       png_warning(png_ptr, "Unknown zTXt compression type");
 #endif
 
-      *(png_ptr->chunkdata + prefix_size) = 0x00;
-      *newlength = prefix_size;
+      /* The recovery is to simply drop the data. */
    }
+
+   /* Generic error return - leave the prefix, delete the compressed
+    * data, reallocate the chunkdata to remove the potentially large
+    * amount of compressed data.
+    */
+   {
+      png_charp text = png_malloc_warn(png_ptr, prefix_size + 1);
+      if (text != NULL)
+      {
+	 if (prefix_size > 0)
+            png_memcpy(text, png_ptr->chunkdata, prefix_size);
+	 png_free(png_ptr, png_ptr->chunkdata);
+	 png_ptr->chunkdata = text;
+
+	 /* This is an extra zero in the 'uncompressed' part. */
+	 *(png_ptr->chunkdata + prefix_size) = 0x00;
+      }
+      /* Ignore a malloc error here - it is safe. */
+   }
+
+   *newlength = prefix_size;
 }
 #endif
 
 /* Read and check the IDHR chunk */
 void /* PRIVATE */
 png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
    png_byte buf[13];
@@ -1135,17 +1148,17 @@ png_handle_sPLT(png_structp png_ptr, png
    png_sPLT_entryp pp;
 #endif
    int data_length, entry_size, i;
    png_uint_32 skip = 0;
    png_size_t slength;
 
    png_debug(1, "in png_handle_sPLT");
 
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+#ifdef PNG_USER_LIMITS_SUPPORTED
 
    if (png_ptr->user_chunk_cache_max != 0)
    {
       if (png_ptr->user_chunk_cache_max == 1)
       {
          png_crc_finish(png_ptr, length);
          return;
       }
@@ -1185,17 +1198,18 @@ png_handle_sPLT(png_structp png_ptr, png
    {
       png_free(png_ptr, png_ptr->chunkdata);
       png_ptr->chunkdata = NULL;
       return;
    }
 
    png_ptr->chunkdata[slength] = 0x00;
 
-   for (entry_start = (png_bytep)png_ptr->chunkdata; *entry_start; entry_start++)
+   for (entry_start = (png_bytep)png_ptr->chunkdata; *entry_start;
+       entry_start++)
       /* Empty loop to find end of name */ ;
    ++entry_start;
 
    /* A sample depth should follow the separator, and we should be on it  */
    if (entry_start > (png_bytep)png_ptr->chunkdata + slength - 2)
    {
       png_free(png_ptr, png_ptr->chunkdata);
       png_ptr->chunkdata = NULL;
@@ -1939,17 +1953,17 @@ png_handle_tEXt(png_structp png_ptr, png
    png_charp key;
    png_charp text;
    png_uint_32 skip = 0;
    png_size_t slength;
    int ret;
 
    png_debug(1, "in png_handle_tEXt");
 
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+#ifdef PNG_USER_LIMITS_SUPPORTED
    if (png_ptr->user_chunk_cache_max != 0)
    {
       if (png_ptr->user_chunk_cache_max == 1)
       {
          png_crc_finish(png_ptr, length);
          return;
       }
       if (--png_ptr->user_chunk_cache_max == 1)
@@ -2041,17 +2055,17 @@ png_handle_zTXt(png_structp png_ptr, png
    png_textp text_ptr;
    png_charp text;
    int comp_type;
    int ret;
    png_size_t slength, prefix_len, data_len;
 
    png_debug(1, "in png_handle_zTXt");
 
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+#ifdef PNG_USER_LIMITS_SUPPORTED
    if (png_ptr->user_chunk_cache_max != 0)
    {
       if (png_ptr->user_chunk_cache_max == 1)
       {
          png_crc_finish(png_ptr, length);
          return;
       }
       if (--png_ptr->user_chunk_cache_max == 1)
@@ -2162,17 +2176,17 @@ png_handle_iTXt(png_structp png_ptr, png
    png_charp key, lang, text, lang_key;
    int comp_flag;
    int comp_type = 0;
    int ret;
    png_size_t slength, prefix_len, data_len;
 
    png_debug(1, "in png_handle_iTXt");
 
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+#ifdef PNG_USER_LIMITS_SUPPORTED
    if (png_ptr->user_chunk_cache_max != 0)
    {
       if (png_ptr->user_chunk_cache_max == 1)
       {
          png_crc_finish(png_ptr, length);
          return;
       }
       if (--png_ptr->user_chunk_cache_max == 1)
@@ -2468,17 +2482,17 @@ png_ensure_sequence_number(png_structp p
    case it will be saved away to be written out later. */
 void /* PRIVATE */
 png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
    png_uint_32 skip = 0;
 
    png_debug(1, "in png_handle_unknown");
 
-#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+#ifdef PNG_USER_LIMITS_SUPPORTED
    if (png_ptr->user_chunk_cache_max != 0)
    {
       if (png_ptr->user_chunk_cache_max == 1)
       {
          png_crc_finish(png_ptr, length);
          return;
       }
       if (--png_ptr->user_chunk_cache_max == 1)
@@ -2523,17 +2537,18 @@ png_handle_unknown(png_structp png_ptr, 
            png_warning(png_ptr, "unknown chunk too large to fit in memory");
            skip = length - (png_uint_32)65535L;
            length = (png_uint_32)65535L;
        }
 #endif
        png_memcpy((png_charp)png_ptr->unknown_chunk.name,
                   (png_charp)png_ptr->chunk_name,
                   png_sizeof(png_ptr->unknown_chunk.name));
-       png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name)-1] = '\0';
+       png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name)-1]
+           = '\0';
        png_ptr->unknown_chunk.size = (png_size_t)length;
        if (length == 0)
          png_ptr->unknown_chunk.data = NULL;
        else
        {
          png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length);
          png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
        }
@@ -2995,17 +3010,18 @@ png_do_read_interlace(png_structp png_pt
                else
                   sshift += s_inc;
             }
             break;
          }
          default:
          {
             png_size_t pixel_bytes = (row_info->pixel_depth >> 3);
-            png_bytep sp = row + (png_size_t)(row_info->width - 1) * pixel_bytes;
+            png_bytep sp = row + (png_size_t)(row_info->width - 1)
+                * pixel_bytes;
             png_bytep dp = row + (png_size_t)(final_width - 1) * pixel_bytes;
 
             int jstop = png_pass_inc[pass];
             png_uint_32 i;
 
             for (i = 0; i < row_info->width; i++)
             {
                png_byte v[8];
@@ -3190,19 +3206,16 @@ png_read_finish_row(png_structp png_ptr)
          png_ptr->pass++;
          if (png_ptr->pass >= 7)
             break;
          png_ptr->iwidth = (png_ptr->width +
             png_pass_inc[png_ptr->pass] - 1 -
             png_pass_start[png_ptr->pass]) /
             png_pass_inc[png_ptr->pass];
 
-         png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,
-            png_ptr->iwidth) + 1;
-
          if (!(png_ptr->transformations & PNG_INTERLACE))
          {
             png_ptr->num_rows = (png_ptr->height +
                png_pass_yinc[png_ptr->pass] - 1 -
                png_pass_ystart[png_ptr->pass]) /
                png_pass_yinc[png_ptr->pass];
             if (!(png_ptr->num_rows))
                continue;
@@ -3317,26 +3330,22 @@ png_read_start_row(png_structp png_ptr)
             png_pass_ystart[0]) / png_pass_yinc[0];
       else
          png_ptr->num_rows = png_ptr->height;
 
       png_ptr->iwidth = (png_ptr->width +
          png_pass_inc[png_ptr->pass] - 1 -
          png_pass_start[png_ptr->pass]) /
          png_pass_inc[png_ptr->pass];
-
-         png_ptr->irowbytes =
-            PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1;
    }
    else
 #endif /* PNG_READ_INTERLACING_SUPPORTED */
    {
       png_ptr->num_rows = png_ptr->height;
       png_ptr->iwidth = png_ptr->width;
-      png_ptr->irowbytes = png_ptr->rowbytes + 1;
    }
    max_pixel_depth = png_ptr->pixel_depth;
 
 #ifdef PNG_READ_PACK_SUPPORTED
    if ((png_ptr->transformations & PNG_PACK) && png_ptr->bit_depth < 8)
       max_pixel_depth = 8;
 #endif
 
@@ -3491,17 +3500,18 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED
 
    png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
 
    png_debug1(3, "width = %lu,", png_ptr->width);
    png_debug1(3, "height = %lu,", png_ptr->height);
    png_debug1(3, "iwidth = %lu,", png_ptr->iwidth);
    png_debug1(3, "num_rows = %lu,", png_ptr->num_rows);
    png_debug1(3, "rowbytes = %lu,", png_ptr->rowbytes);
-   png_debug1(3, "irowbytes = %lu", png_ptr->irowbytes);
+   png_debug1(3, "irowbytes = %lu",
+       PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1);
 
    png_ptr->flags |= PNG_FLAG_ROW_INIT;
 }
 
 #if defined(PNG_READ_APNG_SUPPORTED)
 /* This function is to be called after the main IDAT set has been read and
  * before a new IDAT is read. It resets some parts of png_ptr
  * to make them usable by the read functions again */
@@ -3524,59 +3534,49 @@ png_read_reinit(png_structp png_ptr, png
     if (png_ptr->prev_row)
        png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
 }
 
 /* same as png_read_reset() but for the progressive reader */
 void /* PRIVATE */
 png_progressive_read_reset(png_structp png_ptr)
 {
-#ifdef PNG_USE_LOCAL_ARRAYS
     /* start of interlace block */
     const int FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0};
 
     /* offset to next interlace block */
     const int FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1};
 
     /* start of interlace block in the y direction */
     const int FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1};
 
     /* offset to next interlace block in the y direction */
     const int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
-#endif
-    png_uint_32 row_bytes;
     
     if (png_ptr->interlaced)
     {
         if (!(png_ptr->transformations & PNG_INTERLACE))
             png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
                                 png_pass_ystart[0]) / png_pass_yinc[0];
         else
            png_ptr->num_rows = png_ptr->height;
 
         png_ptr->iwidth = (png_ptr->width +
                            png_pass_inc[png_ptr->pass] - 1 -
                            png_pass_start[png_ptr->pass]) /
                            png_pass_inc[png_ptr->pass];
-
-        row_bytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->iwidth) + 1;
-
-        png_ptr->irowbytes = (png_size_t)row_bytes;
-        if((png_uint_32)png_ptr->irowbytes != row_bytes)
-            png_error(png_ptr, "png_progressive_read_reset(): Rowbytes "
-                               "overflow");
     }
     else
     {
         png_ptr->num_rows = png_ptr->height;
         png_ptr->iwidth = png_ptr->width;
-        png_ptr->irowbytes = png_ptr->rowbytes + 1;
     }
     png_ptr->flags &= ~PNG_FLAG_ZLIB_FINISHED;
     if (inflateReset(&(png_ptr->zstream)) != Z_OK)
         png_error(png_ptr, "inflateReset failed");
     png_ptr->zstream.avail_in = 0;
     png_ptr->zstream.next_in = 0;
     png_ptr->zstream.next_out = png_ptr->row_buf;
-    png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
+    png_ptr->zstream.avail_out = (uInt)PNG_ROWBYTES(png_ptr->pixel_depth,
+        png_ptr->iwidth) + 1;
 }
 #endif /* PNG_READ_APNG_SUPPORTED */
 #endif /* PNG_READ_SUPPORTED */
--- a/modules/libimg/png/pngset.c
+++ b/modules/libimg/png/pngset.c
@@ -1,12 +1,12 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -1233,30 +1233,28 @@ png_set_rows(png_structp png_ptr, png_in
    if (info_ptr->row_pointers && (info_ptr->row_pointers != row_pointers))
       png_free_data(png_ptr, info_ptr, PNG_FREE_ROWS, 0);
    info_ptr->row_pointers = row_pointers;
    if (row_pointers)
       info_ptr->valid |= PNG_INFO_IDAT;
 }
 #endif
 
-#ifdef PNG_WRITE_SUPPORTED
 void PNGAPI
 png_set_compression_buffer_size(png_structp png_ptr,
     png_size_t size)
 {
     if (png_ptr == NULL)
        return;
     png_free(png_ptr, png_ptr->zbuf);
     png_ptr->zbuf_size = size;
     png_ptr->zbuf = (png_bytep)png_malloc(png_ptr, size);
     png_ptr->zstream.next_out = png_ptr->zbuf;
     png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
 }
-#endif
 
 void PNGAPI
 png_set_invalid(png_structp png_ptr, png_infop info_ptr, int mask)
 {
    if (png_ptr && info_ptr)
       info_ptr->valid &= ~mask;
 }
 
@@ -1272,28 +1270,34 @@ png_set_user_limits (png_structp png_ptr
     * rejected by png_set_IHDR().  To accept any PNG datastream
     * regardless of dimensions, set both limits to 0x7ffffffL.
     */
    if (png_ptr == NULL)
       return;
    png_ptr->user_width_max = user_width_max;
    png_ptr->user_height_max = user_height_max;
 }
+
 /* This function was added to libpng 1.4.0 */
 void PNGAPI
 png_set_chunk_cache_max (png_structp png_ptr,
    png_uint_32 user_chunk_cache_max)
 {
-    if (png_ptr == NULL)
-      return;
-    png_ptr->user_chunk_cache_max = user_chunk_cache_max;
-    if (user_chunk_cache_max == 0x7fffffffL)  /* Unlimited */
-       png_ptr->user_chunk_cache_max = 0;
-    else
-       png_ptr->user_chunk_cache_max = user_chunk_cache_max + 1;
+    if (png_ptr)
+       png_ptr->user_chunk_cache_max = user_chunk_cache_max;
+}
+
+/* This function was added to libpng 1.4.1 */
+void PNGAPI
+png_set_chunk_malloc_max (png_structp png_ptr,
+   png_alloc_size_t user_chunk_malloc_max)
+{
+    if (png_ptr)
+       png_ptr->user_chunk_malloc_max =
+          (png_size_t)user_chunk_malloc_max;
 }
 #endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */
 
 
 #ifdef PNG_BENIGN_ERRORS_SUPPORTED
 void PNGAPI
 png_set_benign_errors(png_structp png_ptr, int allowed)
 {
--- a/modules/libimg/png/pngwrite.c
+++ b/modules/libimg/png/pngwrite.c
@@ -33,17 +33,18 @@ png_write_info_before_PLTE(png_structp p
 
    if (png_ptr == NULL || info_ptr == NULL)
       return;
    if (!(png_ptr->mode & PNG_WROTE_INFO_BEFORE_PLTE))
    {
    /* Write PNG signature */
    png_write_sig(png_ptr);
 #ifdef PNG_MNG_FEATURES_SUPPORTED
-   if ((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE)&&(png_ptr->mng_features_permitted))
+   if ((png_ptr->mode&PNG_HAVE_PNG_SIGNATURE) && \
+      (png_ptr->mng_features_permitted))
    {
       png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
       png_ptr->mng_features_permitted = 0;
    }
 #endif
    /* Write IHDR information. */
    png_write_IHDR(png_ptr, info_ptr->width, info_ptr->height,
       info_ptr->bit_depth, info_ptr->color_type, info_ptr->compression_type,
@@ -683,19 +684,21 @@ png_write_row(png_structp png_ptr, png_b
 #if !defined(PNG_WRITE_INVERT_SUPPORTED) && defined(PNG_READ_INVERT_SUPPORTED)
       if (png_ptr->transformations & PNG_INVERT_MONO)
          png_warning(png_ptr, "PNG_WRITE_INVERT_SUPPORTED is not defined");
 #endif
 #if !defined(PNG_WRITE_FILLER_SUPPORTED) && defined(PNG_READ_FILLER_SUPPORTED)
       if (png_ptr->transformations & PNG_FILLER)
          png_warning(png_ptr, "PNG_WRITE_FILLER_SUPPORTED is not defined");
 #endif
-#if !defined(PNG_WRITE_PACKSWAP_SUPPORTED) && defined(PNG_READ_PACKSWAP_SUPPORTED)
+#if !defined(PNG_WRITE_PACKSWAP_SUPPORTED) && \
+    defined(PNG_READ_PACKSWAP_SUPPORTED)
       if (png_ptr->transformations & PNG_PACKSWAP)
-         png_warning(png_ptr, "PNG_WRITE_PACKSWAP_SUPPORTED is not defined");
+         png_warning(png_ptr,
+             "PNG_WRITE_PACKSWAP_SUPPORTED is not defined");
 #endif
 #if !defined(PNG_WRITE_PACK_SUPPORTED) && defined(PNG_READ_PACK_SUPPORTED)
       if (png_ptr->transformations & PNG_PACK)
          png_warning(png_ptr, "PNG_WRITE_PACK_SUPPORTED is not defined");
 #endif
 #if !defined(PNG_WRITE_SHIFT_SUPPORTED) && defined(PNG_READ_SHIFT_SUPPORTED)
       if (png_ptr->transformations & PNG_SHIFT)
          png_warning(png_ptr, "PNG_WRITE_SHIFT_SUPPORTED is not defined");
@@ -939,17 +942,17 @@ png_destroy_write_struct(png_structpp pn
       info_ptr = *info_ptr_ptr;
 
    if (info_ptr != NULL)
    {
       if (png_ptr != NULL)
       {
         png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);
 
-#ifdef PNG_UNKNOWN_CHUNKS_SUPPORTED
+#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
         if (png_ptr->num_chunk_list)
         {
            png_free(png_ptr, png_ptr->chunk_list);
            png_ptr->num_chunk_list = 0;
         }
 #endif
       }
 
--- a/modules/libimg/png/pngwtran.c
+++ b/modules/libimg/png/pngwtran.c
@@ -1,12 +1,12 @@
 
 /* pngwtran.c - transforms the data in a row for PNG writers
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
@@ -25,17 +25,18 @@ png_do_write_transformations(png_structp
    png_debug(1, "in png_do_write_transformations");
 
    if (png_ptr == NULL)
       return;
 
 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
    if (png_ptr->transformations & PNG_USER_TRANSFORM)
       if (png_ptr->write_user_transform_fn != NULL)
-        (*(png_ptr->write_user_transform_fn)) /* User write transform function */
+        (*(png_ptr->write_user_transform_fn)) /* User write transform
+                                                 function */
           (png_ptr,                    /* png_ptr */
            &(png_ptr->row_info),       /* row_info:     */
              /*  png_uint_32 width;          width of row */
              /*  png_uint_32 rowbytes;       number of bytes in row */
              /*  png_byte color_type;        color type of pixels */
              /*  png_byte bit_depth;         bit depth of samples */
              /*  png_byte channels;          number of channels (1-4) */
              /*  png_byte pixel_depth;       bits per pixel (depth*channels) */
--- a/modules/libimg/png/pngwutil.c
+++ b/modules/libimg/png/pngwutil.c
@@ -1,12 +1,12 @@
 
 /* pngwutil.c - utilities to write a PNG file
  *
- * Last changed in libpng 1.4.0 [January 3, 2010]
+ * Last changed in libpng 1.4.1 [February 25, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
@@ -431,17 +431,18 @@ png_write_IHDR(png_structp png_ptr, png_
       case PNG_COLOR_TYPE_GRAY:
          switch (bit_depth)
          {
             case 1:
             case 2:
             case 4:
             case 8:
             case 16: png_ptr->channels = 1; break;
-            default: png_error(png_ptr, "Invalid bit depth for grayscale image");
+            default: png_error(png_ptr,
+                         "Invalid bit depth for grayscale image");
          }
          break;
       case PNG_COLOR_TYPE_RGB:
          if (bit_depth != 8 && bit_depth != 16)
             png_error(png_ptr, "Invalid bit depth for RGB image");
          png_ptr->channels = 3;
          break;
       case PNG_COLOR_TYPE_PALETTE:
@@ -639,17 +640,19 @@ png_write_PLTE(png_structp png_ptr, png_
    for (i = 0, pal_ptr = palette; i < num_pal; i++, pal_ptr++)
    {
       buf[0] = pal_ptr->red;
       buf[1] = pal_ptr->green;
       buf[2] = pal_ptr->blue;
       png_write_chunk_data(png_ptr, buf, (png_size_t)3);
    }
 #else
-   /* This is a little slower but some buggy compilers need to do this instead */
+   /* This is a little slower but some buggy compilers need to do this
+    * instead
+    */
    pal_ptr=palette;
    for (i = 0; i < num_pal; i++)
    {
       buf[0] = pal_ptr[i].red;
       buf[1] = pal_ptr[i].green;
       buf[2] = pal_ptr[i].blue;
       png_write_chunk_data(png_ptr, buf, (png_size_t)3);
    }
@@ -1738,19 +1741,17 @@ png_write_tIME(png_structp png_ptr, png_
 }
 #endif
 
 #if defined(PNG_WRITE_APNG_SUPPORTED)
 void /* PRIVATE */
 png_write_acTL(png_structp png_ptr,
    png_uint_32 num_frames, png_uint_32 num_plays)
 {
-#ifdef PNG_USE_LOCAL_ARRAYS
     PNG_acTL;
-#endif
     png_byte data[16];
     
     png_debug(1, "in png_write_acTL");
     
     png_ptr->num_frames_to_write = num_frames;
     
     if (png_ptr->apng_flags & PNG_FIRST_FRAME_HIDDEN)
         num_frames--;
@@ -1762,19 +1763,17 @@ png_write_acTL(png_structp png_ptr,
 }
 
 void /* PRIVATE */
 png_write_fcTL(png_structp png_ptr, png_uint_32 width, png_uint_32 height, 
     png_uint_32 x_offset, png_uint_32 y_offset,
     png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op, 
     png_byte blend_op)
 {
-#ifdef PNG_USE_LOCAL_ARRAYS
     PNG_fcTL;
-#endif
     png_byte data[26];
     
     png_debug(1, "in png_write_fcTL");
     
     if (png_ptr->num_frames_written == 0 && (x_offset != 0 || y_offset != 0))
         png_error(png_ptr, "x and/or y offset for the first frame aren't 0");
     if (png_ptr->num_frames_written == 0 && 
         (width != png_ptr->first_frame_width || 
--- a/modules/libpr0n/decoders/png/nsPNGDecoder.cpp
+++ b/modules/libpr0n/decoders/png/nsPNGDecoder.cpp
@@ -58,23 +58,29 @@
 #include "nspr.h"
 #include "png.h"
 
 #include "gfxPlatform.h"
 
 static void PNGAPI info_callback(png_structp png_ptr, png_infop info_ptr);
 static void PNGAPI row_callback(png_structp png_ptr, png_bytep new_row,
                                 png_uint_32 row_num, int pass);
+#ifdef PNG_APNG_SUPPORTED
 static void PNGAPI frame_info_callback(png_structp png_ptr,
                                        png_uint_32 frame_num);
+#endif
 static void PNGAPI end_callback(png_structp png_ptr, png_infop info_ptr);
 static void PNGAPI error_callback(png_structp png_ptr,
                                   png_const_charp error_msg);
 static void PNGAPI warning_callback(png_structp png_ptr,
                                     png_const_charp warning_msg);
+#if defined(PNG_USER_MEM_SUPPORTED) && !defined(PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED)
+static png_voidp PNGAPI malloc_callback(png_structp png_ptr,
+                                        png_alloc_size_t size);
+#endif
 
 #ifdef PR_LOGGING
 static PRLogModuleInfo *gPNGLog = PR_NewLogModule("PNGDecoder");
 static PRLogModuleInfo *gPNGDecoderAccountingLog =
                         PR_NewLogModule("PNGDecoderAccounting");
 #endif
 
 /* limit image dimensions (bug #251381) */
@@ -240,17 +246,17 @@ void nsPNGDecoder::EndImageFrame()
 
 /* void init (in imgIContainer aImage,
               imgIDecoderObserver aObserver,
               unsigned long aFlags); */
 NS_IMETHODIMP nsPNGDecoder::Init(imgIContainer *aImage,
                                  imgIDecoderObserver *aObserver,
                                  PRUint32 aFlags)
 {
-#if defined(PNG_HANDLE_AS_UNKNOWN_SUPPORTED)
+#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
   static png_byte color_chunks[]=
        { 99,  72,  82,  77, '\0',   /* cHRM */
         105,  67,  67,  80, '\0'};  /* iCCP */
   static png_byte unused_chunks[]=
        { 98,  75,  71,  68, '\0',   /* bKGD */
         104,  73,  83,  84, '\0',   /* hIST */
         105,  84,  88, 116, '\0',   /* iTXt */
         111,  70,  70, 115, '\0',   /* oFFs */
@@ -280,34 +286,60 @@ NS_IMETHODIMP nsPNGDecoder::Init(imgICon
     return NS_OK;
   }
 
   /* For full decodes, do png init stuff */
 
   /* Initialize the container's source image header. */
   /* Always decode to 24 bit pixdepth */
 
-  mPNG = png_create_read_struct(PNG_LIBPNG_VER_STRING,
-                                NULL, error_callback, warning_callback);
+#if defined(PNG_USER_MEM_SUPPORTED) && !defined(PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED)
+  if (gfxPlatform::GetCMSMode() != eCMSMode_Off) {
+    mPNG = png_create_read_struct_2(PNG_LIBPNG_VER_STRING,
+                                    NULL,
+                                    error_callback,
+                                    warning_callback,
+                                    NULL,
+                                    malloc_callback,
+                                    NULL);
+  } else
+#endif
+    mPNG = png_create_read_struct(PNG_LIBPNG_VER_STRING,
+                                  NULL, error_callback,
+                                  warning_callback);
   if (!mPNG)
     return NS_ERROR_OUT_OF_MEMORY;
 
   mInfo = png_create_info_struct(mPNG);
   if (!mInfo) {
     png_destroy_read_struct(&mPNG, NULL, NULL);
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-#if defined(PNG_HANDLE_AS_UNKNOWN_SUPPORTED)
+#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
   /* Ignore unused chunks */
   if (gfxPlatform::GetCMSMode() == eCMSMode_Off)
     png_set_keep_unknown_chunks(mPNG, 1, color_chunks, 2);
 
   png_set_keep_unknown_chunks(mPNG, 1, unused_chunks,
-     (int)sizeof(unused_chunks)/5);
+     (int)sizeof(unused_chunks)/5);   
+#endif
+
+#ifndef MOZPNGCONF_H
+# if defined(PNG_WRITE_SUPPORTED)
+  if (gfxPlatform::GetCMSMode() != eCMSMode_Off) {
+    /* Increase speed of decompressing large iCCP chunks (default buffer
+       size is 8192) */
+    png_set_compression_buffer_size(mPNG, (png_size_t)32768L);
+  }
+
+#   if defined PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
+       png_set_user_chunk_malloc_max(mPNG, 4000000L);
+#   endif
+# endif
 #endif
 
   /* use this as libpng "progressive pointer" (retrieve in callbacks) */
   png_set_progressive_read_fn(mPNG, static_cast<png_voidp>(this),
                               info_callback, row_callback, end_callback);
 
 
   return NS_OK;
@@ -716,16 +748,35 @@ info_callback(png_structp png_ptr, png_i
     if (height < PR_INT32_MAX / (width * channels))
       decoder->interlacebuf = (PRUint8 *)nsMemory::Alloc(channels *
                                                          width * height);
     if (!decoder->interlacebuf) {
       longjmp(png_jmpbuf(decoder->mPNG), 5); // NS_ERROR_OUT_OF_MEMORY
     }
   }
 
+#if defined PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
+  /* Revert to the default memory limit */
+       png_set_user_chunk_malloc_max(decoder->mPNG, PNG_USER_CHUNK_MALLOC_MAX);
+#endif
+#if defined(PNG_USER_MEM_SUPPORTED) && !defined(PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED)
+  /* Revert to the default memory allocator */
+  if (gfxPlatform::GetCMSMode() != eCMSMode_Off)
+     png_set_mem_fn(decoder->mPNG, NULL, NULL, NULL);
+#endif
+
+#ifndef MOZPNGCONF_H
+/* Revert to the default zlib buffer size */
+# if defined(PNG_WRITE_SUPPORTED)
+  if (gfxPlatform::GetCMSMode() != eCMSMode_Off) {
+    png_set_compression_buffer_size(decoder->mPNG, (png_size_t)8192);
+  }
+# endif
+#endif
+
   /* Reject any ancillary chunk after IDAT with a bad CRC (bug #397593).
    * It would be better to show the default frame (if one has already been
    * successfully decoded) before bailing, but it's simpler to just bail
    * out with an error message.
    */
   png_set_crc_action(png_ptr, NULL, PNG_CRC_ERROR_QUIT);
 
   return;
@@ -931,8 +982,49 @@ error_callback(png_structp png_ptr, png_
 }
 
 
 void
 warning_callback(png_structp png_ptr, png_const_charp warning_msg)
 {
   PR_LOG(gPNGLog, PR_LOG_WARNING, ("libpng warning: %s\n", warning_msg));
 }
+
+#if defined(PNG_USER_MEM_SUPPORTED) && !defined(PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED)
+/* Replacement libpng memory allocator that has a 4MB limit */
+png_voidp malloc_callback(png_structp png_ptr, png_alloc_size_t size) {
+
+  png_voidp ret;
+
+  if (png_ptr == NULL || size == 0)
+    return (png_voidp) (NULL);
+
+#ifdef PNG_MAX_MALLOC_64K
+  if (size > (png_uint_32)65536L) {
+         return NULL;
+  }
+#endif
+  if (size > (png_uint_32)4000000L) {
+         return NULL;
+  }
+#if defined(__TURBOC__) && !defined(__FLAT__)
+   if (size != (unsigned long)size)
+      ret = NULL;
+   else
+      ret = farmalloc(size);
+#else
+#  if defined(_MSC_VER) && defined(MAXSEG_64K)
+   if (size != (unsigned long)size)
+      ret = NULL;
+   else
+      ret = halloc(size, 1);
+#  else
+   if (size != (size_t)size)
+      ret = NULL;
+   else
+      ret = malloc((size_t)size);
+#  endif
+#endif
+
+   return (ret);
+}
+#endif /* PNG_USER_MEM_SUPPORTED */
+