Bug 1377118 - Update in-tree libpng to version 1.6.31. r=jrmuizel
authorGlenn Randers-Pehrson <glennrp+bmo@gmail.com>
Thu, 27 Jul 2017 11:42:00 -0400
changeset 420577 16cb5a4806b62474c4a7eb9e0510854a013233f6
parent 420576 fac66a370cf5f2ab1757e2714ca6901b5260aac9
child 420578 980e4db21b3ed6779c36d1a21be21598565d1f16
push id7566
push usermtabara@mozilla.com
push dateWed, 02 Aug 2017 08:25:16 +0000
treeherdermozilla-beta@86913f512c3c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjrmuizel
bugs1377118
milestone56.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1377118 - Update in-tree libpng to version 1.6.31. r=jrmuizel
media/libpng/CHANGES
media/libpng/LICENSE
media/libpng/README
media/libpng/apng.patch
media/libpng/arm/filter_neon.S
media/libpng/arm/linux.c
media/libpng/intel/filter_sse2_intrinsics.c
media/libpng/libpng-manual.txt
media/libpng/png.c
media/libpng/png.h
media/libpng/pngconf.h
media/libpng/pngerror.c
media/libpng/pngget.c
media/libpng/pnginfo.h
media/libpng/pngpriv.h
media/libpng/pngread.c
media/libpng/pngrtran.c
media/libpng/pngrutil.c
media/libpng/pngset.c
media/libpng/pngstruct.h
media/libpng/pngtrans.c
media/libpng/pngwrite.c
media/libpng/pngwutil.c
media/libpng/sse2/filter_sse2_intrinsics.c
media/libpng/sse2/intel_init.c
old-configure.in
--- a/media/libpng/CHANGES
+++ b/media/libpng/CHANGES
@@ -5756,17 +5756,19 @@ Version 1.6.26 [October 20, 2016]
 
 Version 1.6.27beta01 [November 2, 2016]
   Restrict the new ADLER32-skipping to IDAT chunks.  It broke iCCP chunk
     handling: an erroneous iCCP chunk would throw a png_error and reject the
     entire PNG image instead of rejecting just the iCCP chunk with a warning,
     if built with zlib-1.2.8.1.
 
 Version 1.6.27rc01 [December 27, 2016]
-  Control ADLER32 checking with new PNG_IGNORE_ADLER32 option.
+  Control ADLER32 checking with new PNG_IGNORE_ADLER32 option. Fixes
+    an endless loop when handling erroneous ADLER32 checksums; bug
+    introduced in libpng-1.6.26.
   Removed the use of a macro containing the pre-processor 'defined'
     operator.  It is unclear whether this is valid; a macro that
     "generates" 'defined' is not permitted, but the use of the word
     "generates" within the C90 standard seems to imply more than simple
     substitution of an expression itself containing a well-formed defined
     operation.
   Added ARM support to CMakeLists.txt (Andreas Franek).
 
@@ -5806,22 +5808,111 @@ Version 1.6.29beta02 [February 22, 2017]
     Malaquias)
   The contrib/examples/pngtopng.c recovery code was in the wrong "if"
     branches; the comments were correct.
   Added code for PowerPC VSX optimisation (Vadim Barkov).
 
 Version 1.6.29beta03 [March 1, 2017]
   Avoid potential overflow of shift operations in png_do_expand() (Aaron Boxer).
   Change test ZLIB_VERNUM >= 0x1281 to ZLIB_VERNUM >= 0x1290 in pngrutil.c
-    because Solaris 11 distributes zlib-1.2.8.f that is older than 1.2.8.1.
+    because Solaris 11 distributes zlib-1.2.8.f that is older than 1.2.8.1,
+    as suggested in zlib FAQ, item 24.
   Suppress clang warnings about implicit sign changes in png.c
 
 Version 1.6.29 [March 16, 2017]
   No changes.
 
+Version 1.6.30beta01 [April 1, 2017]
+  Added missing "$(CPPFLAGS)" to the compile line for c.pic.o in
+    makefile.linux and makefile.solaris-x86 (Cosmin).
+  Revised documentation of png_get_error_ptr() in the libpng manual.
+  Silence clang -Wcomma and const drop warnings (Viktor Szakats).
+  Update Sourceforge URLs in documentation (https instead of http).
+
+Version 1.6.30beta02 [April 22, 2017]
+  Document need to check for integer overflow when allocating a pixel
+    buffer for multiple rows in contrib/gregbook, contrib/pngminus,
+    example.c, and in the manual (suggested by Jaeseung Choi). This
+    is similar to the bug reported against pngquant in CVE-2016-5735.
+  Removed reference to the obsolete PNG_SAFE_LIMITS macro in the documentation.
+
+Version 1.6.30beta03 [May 22, 2017]
+  Check for integer overflow in contrib/visupng and contrib/tools/genpng.
+  Do not double evaluate CMAKE_SYSTEM_PROCESSOR in CMakeLists.txt.
+  Test CMAKE_HOST_WIN32 instead of WIN32 in CMakeLists.txt.
+  Fix some URL in documentation.
+
+Version 1.6.30beta04 [June 7, 2017]
+  Avoid writing an empty IDAT when the last IDAT exactly fills the
+    compression buffer (bug report by Brian Baird). This bug was
+    introduced in libpng-1.6.0.
+
+Version 1.6.30rc01 [June 14, 2017]
+  No changes.
+
+Version 1.6.30rc02 [June 25, 2017]
+  Update copyright year in pnglibconf.h, make ltmain.sh executable.
+  Add a reference to the libpng.download site in README.
+
+Version 1.6.30 [June 28, 2017]
+  No changes.
+
+Version 1.6.31beta01 [July 5, 2017]
+  Guard the definition of _POSIX_SOURCE in pngpriv.h (AIX already defines it;
+    bug report by Michael Felt).
+  Revised pngpriv.h to work around failure to compile arm/filter_neon.S
+    ("typedef" directive is unrecognized by the assembler). The problem
+    was introduced in libpng-1.6.30beta01.
+  Added "Requires: zlib" to libpng.pc.in (Pieter Neerincx).
+  Added special case for FreeBSD in arm/filter_neon.S (Maya Rashish).
+
+Version 1.6.31beta02 [July 8, 2017]
+  Added instructions for disabling hardware optimizations in INSTALL.
+  Added "--enable-hardware-optimizations" configuration flag to enable
+    or disable all hardware optimizations with one flag.
+
+Version 1.6.31beta03 [July 9, 2017]
+  Updated CMakeLists.txt to add INTEL_SSE and MIPS_MSA platforms.
+  Changed "int" to "png_size_t" in intel/filter_sse2.c to prevent
+    possible integer overflow (Bug report by John Bowler).
+  Quieted "declaration after statement" warnings in intel/filter_sse2.c.
+  Added scripts/makefile-linux-opt, which has hardware optimizations enabled.
+
+Version 1.6.31beta04 [July 11, 2017]
+  Removed one of the GCC-7.1.0 'strict-overflow' warnings that result when
+    integers appear on both sides of a compare.  Worked around the others by
+    forcing the strict-overflow setting in the relevant functions to a level
+    where they are not reported (John Bowler).
+  Changed "FALL THROUGH" comments to "FALLTHROUGH" because GCC doesn't like
+    the space.
+  Worked around some C-style casts from (void*) because g++ 5.4.0 objects
+    to them.
+  Increased the buffer size for 'sprint' to pass the gcc 7.1.0 'sprint
+    overflow' check that is on by default with -Wall -Wextra.
+
+Version 1.6.31beta05 [July 13, 2017]
+  Added eXIf chunk support.
+
+Version 1.6.31beta06 [July 17, 2017]
+  Added a minimal eXIf chunk (with Orientation and FocalLengthIn35mmFilm
+    tags) to pngtest.png.
+
+Version 1.6.31beta07 [July 18, 2017]
+  Revised the eXIf chunk in pngtest.png to fix "Bad IFD1 Directory" warning.
+
+Version 1.6.31rc01 [July 19, 2017]
+  No changes.
+
+Version 1.6.31rc02 [July 25, 2017]
+  Fixed typo in example.c (png_free_image should be png_image_free) (Bug
+    report by John Smith)
+
+Version 1.6.31 [July 27, 2017]
+  No changes.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
 to subscribe)
 or to glennrp at users.sourceforge.net
 
 Glenn R-P
 #endif
--- a/media/libpng/LICENSE
+++ b/media/libpng/LICENSE
@@ -15,17 +15,17 @@ obtain one at http://mozilla.org/MPL/2.0
 This modified version of libpng code adds animated PNG support and is
 released under the libpng license described below. The modifications are
 Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2017 Max Stepin,
 and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
 surrounding them in the modified libpng source files.
 
 This code is released under the libpng license.
 
-libpng versions 1.0.7, July 1, 2000 through 1.6.29, March 16, 2017 are
+libpng versions 1.0.7, July 1, 2000 through 1.6.31, July 27, 2017 are
 Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
 added to the list of Contributing Authors:
 
    Simon-Pierre Cadieux
    Eric S. Raymond
    Mans Rullgard
@@ -135,9 +135,9 @@ The Copyright owner believes that the Ex
 Number (ECCN) for libpng is EAR99, which means not subject to export
 controls or International Traffic in Arms Regulations (ITAR) because
 it is open source, publicly available software, that does not contain
 any encryption software.  See the EAR, paragraphs 734.3(b)(3) and
 734.7(b).
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-March 16, 2017
+April 1, 2017
--- a/media/libpng/README
+++ b/media/libpng/README
@@ -1,9 +1,9 @@
-README for libpng version 1.6.29 - March 16, 2017 (shared library 16.0)
+README for libpng version 1.6.31 - July 27, 2017 (shared library 16.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
 
 Libpng comes in several distribution formats.  Get libpng-*.tar.gz or
 libpng-*.tar.xz or if you want UNIX-style line endings in the text files,
 or lpng*.7z or lpng*.zip if you want DOS-style line endings.
 
@@ -18,17 +18,17 @@ March 1998.
 ****
 Note that some of the changes to the png_info structure render this
 version of the library binary incompatible with libpng-0.89 or
 earlier versions if you are using a shared library.  The type of the
 "filler" parameter for png_set_filler() has changed from png_byte to
 png_uint_32, which will affect shared-library applications that use
 this function.
 
-To avoid problems with changes to the internals of png info_struct,
+To avoid problems with changes to the internals of the png info_struct,
 new APIs have been made available in 0.95 to avoid direct application
 access to info_ptr.  These functions are the png_set_<chunk> and
 png_get_<chunk> functions.  These functions should be used when
 accessing/storing the info_struct data, rather than manipulating it
 directly, to avoid such problems in the future.
 
 It is important to note that the APIs did not make current programs
 that access the info struct directly incompatible with the new
@@ -83,21 +83,21 @@ and medium memory models.  You should al
 compression library that is useful for more things than just PNG files.
 You can use zlib as a drop-in replacement for fread() and fwrite() if
 you are so inclined.
 
 zlib should be available at the same place that libpng is, or at zlib.net.
 
 You may also want a copy of the PNG specification.  It is available
 as an RFC, a W3C Recommendation, and an ISO/IEC Standard.  You can find
-these at http://www.libpng.org/pub/png/documents/
+these at http://www.libpng.org/pub/png/pngdocs.html .
 
-This code is currently being archived at libpng.sf.net in the
-[DOWNLOAD] area, and at ftp://ftp.simplesystems.org.  If you can't find it
-in any of those places, e-mail me, and I'll help you find it.
+This code is currently being archived at libpng.sourceforge.io in the
+[DOWNLOAD] area, and at http://libpng.download/src .  If you
+can't find it in any of those places, e-mail me, and I'll help you find it.
 
 I am not a lawyer, but I believe that the Export Control Classification
 Number (ECCN) for libpng is EAR99, which means not subject to export
 controls or International Traffic in Arms Regulations (ITAR) because it
 is open source, publicly available software, that does not contain any
 encryption software.  See the EAR, paragraphs 734.3(b)(3) and 734.7(b).
 
 If you have any code changes, requests, problems, etc., please e-mail
--- a/media/libpng/apng.patch
+++ b/media/libpng/apng.patch
@@ -9,17 +9,17 @@ Index: LICENSE
 +This modified version of libpng code adds animated PNG support and is
 +released under the libpng license described below. The modifications are
 +Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2017 Max Stepin,
 +and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
 +surrounding them in the modified libpng source files.
 +
  This code is released under the libpng license.
  
- libpng versions 1.0.7, July 1, 2000 through 1.6.29, March 16, 2017 are
+ libpng versions 1.0.7, July 1, 2000 through 1.6.31, July 27, 2017 are
 Index: pngread.c
 ===================================================================
 --- pngread.c
 +++ pngread.c
 @@ -161,6 +161,9 @@
  
        else if (chunk_name == png_IDAT)
        {
@@ -119,17 +119,17 @@ Index: pngread.c
 +
  /* Optional call to update the users info_ptr structure */
  void PNGAPI
  png_read_update_info(png_structrp png_ptr, png_inforp info_ptr)
 Index: pngget.c
 ===================================================================
 --- pngget.c
 +++ pngget.c
-@@ -1216,4 +1216,166 @@
+@@ -1234,4 +1234,166 @@
  #  endif
  #endif
  
 +#ifdef PNG_APNG_SUPPORTED
 +png_uint_32 PNGAPI
 +png_get_acTL(png_structp png_ptr, png_infop info_ptr,
 +             png_uint_32 *num_frames, png_uint_32 *num_plays)
 +{
@@ -290,33 +290,33 @@ Index: pngget.c
 +    return 0;
 +}
 +#endif /* APNG */
  #endif /* READ || WRITE */
 Index: png.c
 ===================================================================
 --- png.c
 +++ png.c
-@@ -776,17 +776,21 @@
+@@ -806,17 +806,21 @@
  #else
  #  ifdef __STDC__
     return PNG_STRING_NEWLINE \
--      "libpng version 1.6.29 - March 16, 2017" PNG_STRING_NEWLINE \
-+      "libpng version 1.6.29+apng - March 16, 2017" PNG_STRING_NEWLINE \
+-      "libpng version 1.6.31 - July 27, 2017" PNG_STRING_NEWLINE \
++      "libpng version 1.6.31+apng - July 27, 2017" PNG_STRING_NEWLINE \
        "Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson" \
        PNG_STRING_NEWLINE \
        "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
        "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
 -      PNG_STRING_NEWLINE;
 +      PNG_STRING_NEWLINE \
 +      "Portions Copyright (c) 2006-2007 Andrew Smith" PNG_STRING_NEWLINE \
 +      "Portions Copyright (c) 2008-2017 Max Stepin" PNG_STRING_NEWLINE ;
  #  else
--   return "libpng version 1.6.29 - March 16, 2017\
-+   return "libpng version 1.6.29+apng - March 16, 2017\
+-   return "libpng version 1.6.31 - July 27, 2017\
++   return "libpng version 1.6.31+apng - July 27, 2017\
        Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson\
        Copyright (c) 1996-1997 Andreas Dilger\
 -      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
 +      Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\
 +      Portions Copyright (c) 2006-2007 Andrew Smith\
 +      Portions Copyright (c) 2008-2017 Max Stepin";
  #  endif
  #endif
@@ -332,26 +332,26 @@ Index: png.h
 + * This modified version of libpng code adds animated PNG support and is
 + * released under the libpng license described below. The modifications are
 + * Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2017 Max Stepin,
 + * and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
 + * surrounding them in the modified libpng source files.
 + *
   * This code is released under the libpng license.
   *
-  * libpng versions 1.0.7, July 1, 2000 through 1.6.29, March 16, 2017 are
+  * libpng versions 1.0.7, July 1, 2000 through 1.6.31, July 27, 2017 are
 @@ -309,8 +315,9 @@
   */
  
  /* Version information for png.h - this should match the version in png.c */
--#define PNG_LIBPNG_VER_STRING "1.6.29"
--#define PNG_HEADER_VERSION_STRING " libpng version 1.6.29 - March 16, 2017\n"
-+#define PNG_LIBPNG_VER_STRING "1.6.29+apng"
+-#define PNG_LIBPNG_VER_STRING "1.6.31"
+-#define PNG_HEADER_VERSION_STRING " libpng version 1.6.31 - July 27, 2017\n"
++#define PNG_LIBPNG_VER_STRING "1.6.31+apng"
 +#define PNG_HEADER_VERSION_STRING \
-+     " libpng version 1.6.29+apng - March 16, 2017\n"
++     " libpng version 1.6.31+apng - July 27, 2017\n"
  
  #define PNG_LIBPNG_VER_SONUM   16
  #define PNG_LIBPNG_VER_DLLNUM  16
 @@ -361,6 +368,10 @@
  #   include "pnglibconf.h"
  #endif
  
 +#define PNG_APNG_SUPPORTED
@@ -374,159 +374,159 @@ Index: png.h
 +/* blend_op flags from inside fcTL */
 +#define PNG_BLEND_OP_SOURCE        0x00
 +#define PNG_BLEND_OP_OVER          0x01
 +#endif /* APNG */
 +
  /* This triggers a compiler error in png.c, if png.c and png.h
   * do not agree upon the version number.
   */
-@@ -776,6 +798,10 @@
- #define PNG_INFO_sPLT 0x2000U  /* ESR, 1.0.6 */
+@@ -777,6 +799,10 @@
  #define PNG_INFO_sCAL 0x4000U  /* ESR, 1.0.6 */
  #define PNG_INFO_IDAT 0x8000U  /* ESR, 1.0.6 */
+ #define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */
 +#ifdef PNG_APNG_SUPPORTED
-+#define PNG_INFO_acTL 0x10000U
-+#define PNG_INFO_fcTL 0x20000U
++#define PNG_INFO_acTL 0x20000U
++#define PNG_INFO_fcTL 0x40000U
 +#endif
  
  /* This is used for the transformation routines, as some of them
   * change these values for the row.  It also should enable using
-@@ -813,6 +839,10 @@
+@@ -814,6 +840,10 @@
  #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
  typedef PNG_CALLBACK(void, *png_progressive_info_ptr, (png_structp, png_infop));
  typedef PNG_CALLBACK(void, *png_progressive_end_ptr, (png_structp, png_infop));
 +#ifdef PNG_APNG_SUPPORTED
 +typedef PNG_CALLBACK(void, *png_progressive_frame_ptr, (png_structp,
 +    png_uint_32));
 +#endif
  
  /* The following callback receives png_uint_32 row_number, int pass for the
   * png_bytep data of the row.  When transforming an interlaced image the
-@@ -3245,6 +3275,75 @@
+@@ -3251,6 +3281,75 @@
   *  END OF HARDWARE AND SOFTWARE OPTIONS
   ******************************************************************************/
  
 +#ifdef PNG_APNG_SUPPORTED
-+PNG_EXPORT(246, png_uint_32, png_get_acTL, (png_structp png_ptr,
++PNG_EXPORT(248, png_uint_32, png_get_acTL, (png_structp png_ptr,
 +   png_infop info_ptr, png_uint_32 *num_frames, png_uint_32 *num_plays));
 +
-+PNG_EXPORT(247, png_uint_32, png_set_acTL, (png_structp png_ptr,
++PNG_EXPORT(249, png_uint_32, png_set_acTL, (png_structp png_ptr,
 +   png_infop info_ptr, png_uint_32 num_frames, png_uint_32 num_plays));
 +
-+PNG_EXPORT(248, png_uint_32, png_get_num_frames, (png_structp png_ptr,
++PNG_EXPORT(250, png_uint_32, png_get_num_frames, (png_structp png_ptr,
 +   png_infop info_ptr));
 +
-+PNG_EXPORT(249, png_uint_32, png_get_num_plays, (png_structp png_ptr,
++PNG_EXPORT(251, png_uint_32, png_get_num_plays, (png_structp png_ptr,
 +   png_infop info_ptr));
 +
-+PNG_EXPORT(250, png_uint_32, png_get_next_frame_fcTL,
++PNG_EXPORT(252, png_uint_32, png_get_next_frame_fcTL,
 +   (png_structp png_ptr, png_infop info_ptr, png_uint_32 *width,
 +   png_uint_32 *height, png_uint_32 *x_offset, png_uint_32 *y_offset,
 +   png_uint_16 *delay_num, png_uint_16 *delay_den, png_byte *dispose_op,
 +   png_byte *blend_op));
 +
-+PNG_EXPORT(251, png_uint_32, png_set_next_frame_fcTL,
++PNG_EXPORT(253, png_uint_32, png_set_next_frame_fcTL,
 +   (png_structp png_ptr, png_infop info_ptr, png_uint_32 width,
 +   png_uint_32 height, png_uint_32 x_offset, png_uint_32 y_offset,
 +   png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
 +   png_byte blend_op));
 +
-+PNG_EXPORT(252, png_uint_32, png_get_next_frame_width,
++PNG_EXPORT(254, png_uint_32, png_get_next_frame_width,
 +   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(253, png_uint_32, png_get_next_frame_height,
++PNG_EXPORT(255, png_uint_32, png_get_next_frame_height,
 +   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(254, png_uint_32, png_get_next_frame_x_offset,
++PNG_EXPORT(256, png_uint_32, png_get_next_frame_x_offset,
 +   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(255, png_uint_32, png_get_next_frame_y_offset,
++PNG_EXPORT(257, png_uint_32, png_get_next_frame_y_offset,
 +   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(256, png_uint_16, png_get_next_frame_delay_num,
++PNG_EXPORT(258, png_uint_16, png_get_next_frame_delay_num,
 +   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(257, png_uint_16, png_get_next_frame_delay_den,
++PNG_EXPORT(259, png_uint_16, png_get_next_frame_delay_den,
 +   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(258, png_byte, png_get_next_frame_dispose_op,
++PNG_EXPORT(260, png_byte, png_get_next_frame_dispose_op,
 +   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(259, png_byte, png_get_next_frame_blend_op,
++PNG_EXPORT(261, png_byte, png_get_next_frame_blend_op,
 +   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(260, png_byte, png_get_first_frame_is_hidden,
++PNG_EXPORT(262, png_byte, png_get_first_frame_is_hidden,
 +   (png_structp png_ptr, png_infop info_ptr));
-+PNG_EXPORT(261, png_uint_32, png_set_first_frame_is_hidden,
++PNG_EXPORT(263, png_uint_32, png_set_first_frame_is_hidden,
 +   (png_structp png_ptr, png_infop info_ptr, png_byte is_hidden));
 +
 +#ifdef PNG_READ_APNG_SUPPORTED
-+PNG_EXPORT(262, void, png_read_frame_head, (png_structp png_ptr,
++PNG_EXPORT(264, void, png_read_frame_head, (png_structp png_ptr,
 +   png_infop info_ptr));
 +#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
-+PNG_EXPORT(263, void, png_set_progressive_frame_fn, (png_structp png_ptr,
++PNG_EXPORT(265, void, png_set_progressive_frame_fn, (png_structp png_ptr,
 +   png_progressive_frame_ptr frame_info_fn,
 +   png_progressive_frame_ptr frame_end_fn));
 +#endif /* PROGRESSIVE_READ */
 +#endif /* READ_APNG */
 +
 +#ifdef PNG_WRITE_APNG_SUPPORTED
-+PNG_EXPORT(264, void, png_write_frame_head, (png_structp png_ptr,
++PNG_EXPORT(266, void, png_write_frame_head, (png_structp png_ptr,
 +   png_infop info_ptr, png_bytepp row_pointers,
 +   png_uint_32 width, png_uint_32 height,
 +   png_uint_32 x_offset, png_uint_32 y_offset,
 +   png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
 +   png_byte blend_op));
 +
-+PNG_EXPORT(265, void, png_write_frame_tail, (png_structp png_ptr,
++PNG_EXPORT(267, void, png_write_frame_tail, (png_structp png_ptr,
 +   png_infop info_ptr));
 +#endif /* WRITE_APNG */
 +#endif /* APNG */
 +
  /* Maintainer: Put new public prototypes here ^, in libpng.3, in project
   * defs, and in scripts/symbols.def.
   */
-@@ -3253,7 +3352,11 @@
+@@ -3259,7 +3358,11 @@
   * one to use is one more than this.)
   */
  #ifdef PNG_EXPORT_LAST_ORDINAL
 +#ifdef PNG_APNG_SUPPORTED
-+  PNG_EXPORT_LAST_ORDINAL(265);
++  PNG_EXPORT_LAST_ORDINAL(267);
 +#else
-   PNG_EXPORT_LAST_ORDINAL(245);
+   PNG_EXPORT_LAST_ORDINAL(247);
 +#endif /* APNG */
  #endif
  
  #ifdef __cplusplus
 Index: pngpriv.h
 ===================================================================
 --- pngpriv.h
 +++ pngpriv.h
-@@ -616,6 +616,10 @@
+@@ -628,6 +628,10 @@
  #define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
                     /*             0x4000U (unused) */
  #define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
 +#ifdef PNG_APNG_SUPPORTED
 +#define PNG_HAVE_acTL            0x10000U
 +#define PNG_HAVE_fcTL            0x20000U
 +#endif
  
  /* Flags for the transformations the PNG library does on the image data */
  #define PNG_BGR                 0x0001U
-@@ -851,6 +855,16 @@
+@@ -864,6 +868,16 @@
  #define png_tRNS PNG_U32(116,  82,  78,  83)
  #define png_zTXt PNG_U32(122,  84,  88, 116)
  
 +#ifdef PNG_APNG_SUPPORTED
 +#define png_acTL PNG_U32( 97,  99,  84,  76)
 +#define png_fcTL PNG_U32(102,  99,  84,  76)
 +#define png_fdAT PNG_U32(102, 100,  65,  84)
 +
 +/* For png_struct.apng_flags: */
 +#define PNG_FIRST_FRAME_HIDDEN       0x0001U
 +#define PNG_APNG_APP                 0x0002U
 +#endif
 +
  /* The following will work on (signed char*) strings, whereas the get_uint_32
   * macro will fail on top-bit-set values because of the sign extension.
   */
-@@ -1589,6 +1603,49 @@
+@@ -1607,6 +1621,49 @@
  
  #endif /* PROGRESSIVE_READ */
  
 +#ifdef PNG_APNG_SUPPORTED
 +PNG_INTERNAL_FUNCTION(void,png_ensure_fcTL_is_valid,(png_structp png_ptr,
 +   png_uint_32 width, png_uint_32 height,
 +   png_uint_32 x_offset, png_uint_32 y_offset,
 +   png_uint_16 delay_num, png_uint_16 delay_den,
@@ -570,17 +570,17 @@ Index: pngpriv.h
 +
  /* Added at libpng version 1.6.0 */
  #ifdef PNG_GAMMA_SUPPORTED
  PNG_INTERNAL_FUNCTION(void,png_colorspace_set_gamma,(png_const_structrp png_ptr,
 Index: pnginfo.h
 ===================================================================
 --- pnginfo.h
 +++ pnginfo.h
-@@ -255,5 +255,18 @@
+@@ -260,5 +260,18 @@
     png_bytepp row_pointers;        /* the image bits */
  #endif
  
 +#ifdef PNG_APNG_SUPPORTED
 +   png_uint_32 num_frames; /* including default image */
 +   png_uint_32 num_plays;
 +   png_uint_32 next_frame_width;
 +   png_uint_32 next_frame_height;
@@ -929,29 +929,29 @@ Index: pngpread.c
 +
  png_voidp PNGAPI
  png_get_progressive_ptr(png_const_structrp png_ptr)
  {
 Index: pngset.c
 ===================================================================
 --- pngset.c
 +++ pngset.c
-@@ -241,6 +241,11 @@
+@@ -274,6 +274,11 @@
     info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
  
     info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
 +
 +#ifdef PNG_APNG_SUPPORTED
 +   /* for non-animated png. this may be overwritten from an acTL chunk later */
 +   info_ptr->num_frames = 1;
 +#endif
  }
  
  #ifdef PNG_oFFs_SUPPORTED
-@@ -1110,6 +1115,146 @@
+@@ -1144,6 +1149,146 @@
  }
  #endif /* sPLT */
  
 +#ifdef PNG_APNG_SUPPORTED
 +png_uint_32 PNGAPI
 +png_set_acTL(png_structp png_ptr, png_infop info_ptr,
 +    png_uint_32 num_frames, png_uint_32 num_plays)
 +{
@@ -1104,17 +1104,17 @@ Index: pngrutil.c
 +#ifdef PNG_READ_APNG_SUPPORTED
 +   png_ptr->first_frame_width = width;
 +   png_ptr->first_frame_height = height;
 +#endif
 +
     /* Set internal variables */
     png_ptr->width = width;
     png_ptr->height = height;
-@@ -2761,6 +2766,180 @@
+@@ -2802,6 +2807,180 @@
  }
  #endif
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +void /* PRIVATE */
 +png_handle_acTL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 +{
 +    png_byte data[8];
@@ -1285,17 +1285,17 @@ Index: pngrutil.c
 +
 +    png_ptr->next_seq_num++;
 +}
 +#endif /* READ_APNG */
 +
  #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
  /* Utility function for png_handle_unknown; set up png_ptr::unknown_chunk */
  static int
-@@ -4023,6 +4202,38 @@
+@@ -4070,6 +4249,38 @@
           uInt avail_in;
           png_bytep buffer;
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +         png_uint_32 bytes_to_skip = 0;
 +
 +         while (png_ptr->idat_size == 0 || bytes_to_skip != 0)
 +         {
@@ -1324,35 +1324,35 @@ Index: pngrutil.c
 +
 +               png_ptr->idat_size -= 4;
 +            }
 +         }
 +#else
           while (png_ptr->idat_size == 0)
           {
              png_crc_finish(png_ptr, 0);
-@@ -4034,6 +4245,7 @@
+@@ -4081,6 +4292,7 @@
              if (png_ptr->chunk_name != png_IDAT)
                 png_error(png_ptr, "Not enough image data");
           }
 +#endif /* READ_APNG */
  
           avail_in = png_ptr->IDAT_read_size;
  
-@@ -4097,6 +4309,9 @@
+@@ -4144,6 +4356,9 @@
  
           png_ptr->mode |= PNG_AFTER_IDAT;
           png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
 +#ifdef PNG_READ_APNG_SUPPORTED
 +         png_ptr->num_frames_read++;
 +#endif
  
           if (png_ptr->zstream.avail_in > 0 || png_ptr->idat_size > 0)
              png_chunk_benign_error(png_ptr, "Extra compressed data");
-@@ -4535,4 +4750,80 @@
+@@ -4582,4 +4797,80 @@
  
     png_ptr->flags |= PNG_FLAG_ROW_INIT;
  }
 +
 +#ifdef PNG_READ_APNG_SUPPORTED
 +/* This function is to be called after the main IDAT set has been read and
 + * before a new IDAT is read. It resets some parts of png_ptr
 + * to make them usable by the read functions again */
@@ -1439,49 +1439,53 @@ Index: pngwutil.c
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +   png_ptr->first_frame_width = width;
 +   png_ptr->first_frame_height = height;
 +#endif
 +
     if ((png_ptr->do_filter) == PNG_NO_FILTERS)
     {
        if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE ||
-@@ -1003,7 +1008,15 @@
-                optimize_cmf(data, png_image_size(png_ptr));
+@@ -1004,7 +1009,17 @@
  #endif
  
+          if (size > 0)
 +#ifdef PNG_WRITE_APNG_SUPPORTED
-+         if (png_ptr->num_frames_written == 0)
++         {
++            if (png_ptr->num_frames_written == 0)
 +#endif
-          png_write_complete_chunk(png_ptr, png_IDAT, data, size);
+             png_write_complete_chunk(png_ptr, png_IDAT, data, size);
 +#ifdef PNG_WRITE_APNG_SUPPORTED
-+         else
-+            png_write_fdAT(png_ptr, data, size);
++            else
++               png_write_fdAT(png_ptr, data, size);
++         }
 +#endif /* WRITE_APNG */
 +
           png_ptr->mode |= PNG_HAVE_IDAT;
  
           png_ptr->zstream.next_out = data;
-@@ -1049,7 +1062,15 @@
-             optimize_cmf(data, png_image_size(png_ptr));
+@@ -1051,7 +1066,17 @@
  #endif
  
+          if (size > 0)
 +#ifdef PNG_WRITE_APNG_SUPPORTED
-+         if (png_ptr->num_frames_written == 0)
++         {
++            if (png_ptr->num_frames_written == 0)
 +#endif
-          png_write_complete_chunk(png_ptr, png_IDAT, data, size);
+             png_write_complete_chunk(png_ptr, png_IDAT, data, size);
 +#ifdef PNG_WRITE_APNG_SUPPORTED
-+         else
-+            png_write_fdAT(png_ptr, data, size);
++            else
++               png_write_fdAT(png_ptr, data, size);
++         }
 +#endif /* WRITE_APNG */
 +
           png_ptr->zstream.avail_out = 0;
           png_ptr->zstream.next_out = NULL;
           png_ptr->mode |= PNG_HAVE_IDAT | PNG_AFTER_IDAT;
-@@ -1863,6 +1884,82 @@
+@@ -1896,6 +1921,82 @@
  }
  #endif
  
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +void /* PRIVATE */
 +png_write_acTL(png_structp png_ptr,
 +    png_uint_32 num_frames, png_uint_32 num_plays)
 +{
@@ -1554,17 +1558,17 @@ Index: pngwutil.c
 +
 +    png_ptr->next_seq_num++;
 +}
 +#endif /* WRITE_APNG */
 +
  /* Initializes the row writing capability of libpng */
  void /* PRIVATE */
  png_write_start_row(png_structrp png_ptr)
-@@ -2757,4 +2854,39 @@
+@@ -2790,4 +2891,39 @@
     }
  #endif /* WRITE_FLUSH */
  }
 +
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +void /* PRIVATE */
 +png_write_reset(png_structp png_ptr)
 +{
@@ -1598,32 +1602,32 @@ Index: pngwutil.c
 +    png_ptr->usr_width = png_ptr->width;
 +}
 +#endif /* WRITE_APNG */
  #endif /* WRITE */
 Index: scripts/symbols.def
 ===================================================================
 --- scripts/symbols.def
 +++ scripts/symbols.def
-@@ -250,3 +250,23 @@
-  png_get_palette_max @243
-  png_set_option @244
+@@ -252,3 +252,23 @@
   png_image_write_to_memory @245
-+ png_get_acTL @246
-+ png_set_acTL @247
-+ png_get_num_frames @248
-+ png_get_num_plays @249
-+ png_get_next_frame_fcTL @250
-+ png_set_next_frame_fcTL @251
-+ png_get_next_frame_width @252
-+ png_get_next_frame_height @253
-+ png_get_next_frame_x_offset @254
-+ png_get_next_frame_y_offset @255
-+ png_get_next_frame_delay_num @256
-+ png_get_next_frame_delay_den @257
-+ png_get_next_frame_dispose_op @258
-+ png_get_next_frame_blend_op @259
-+ png_get_first_frame_is_hidden @260
-+ png_set_first_frame_is_hidden @261
-+ png_read_frame_head @262
-+ png_set_progressive_frame_fn @263
-+ png_write_frame_head @264
-+ png_write_frame_tail @265
+  png_get_eXIf @246
+  png_set_eXIf @247
++ png_get_acTL @248
++ png_set_acTL @249
++ png_get_num_frames @250
++ png_get_num_plays @251
++ png_get_next_frame_fcTL @252
++ png_set_next_frame_fcTL @253
++ png_get_next_frame_width @254
++ png_get_next_frame_height @255
++ png_get_next_frame_x_offset @256
++ png_get_next_frame_y_offset @257
++ png_get_next_frame_delay_num @258
++ png_get_next_frame_delay_den @259
++ png_get_next_frame_dispose_op @260
++ png_get_next_frame_blend_op @261
++ png_get_first_frame_is_hidden @262
++ png_set_first_frame_is_hidden @263
++ png_read_frame_head @264
++ png_set_progressive_frame_fn @265
++ png_write_frame_head @266
++ png_write_frame_tail @267
--- a/media/libpng/arm/filter_neon.S
+++ b/media/libpng/arm/filter_neon.S
@@ -1,14 +1,14 @@
 
 /* filter_neon.S - NEON optimised filter functions
  *
- * Copyright (c) 2014 Glenn Randers-Pehrson
+ * Copyright (c) 2014,2017 Glenn Randers-Pehrson
  * Written by Mans Rullgard, 2011.
- * Last changed in libpng 1.6.16 [December 22, 2014]
+ * Last changed in libpng 1.6.31 [July 27, 2017]
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
 /* These are required because Mozilla's moz.build system doesn't pass
  * -DDefined macros to the assembler.
@@ -17,17 +17,17 @@
 #define MOZ_PNG_HAVE_ARM_NEON
 
 /* This is required to get the symbol renames, which are #defines, and the
  * definitions (or not) of PNG_ARM_NEON_OPT and PNG_ARM_NEON_IMPLEMENTATION.
  */
 #define PNG_VERSION_INFO_ONLY
 #include "../pngpriv.h"
 
-#if defined(__linux__) && defined(__ELF__)
+#if (defined(__linux__) || defined(__FreeBSD__)) && defined(__ELF__)
 .section .note.GNU-stack,"",%progbits /* mark stack as non-executable */
 #endif
 
 #ifdef PNG_READ_SUPPORTED
 
 /* Assembler NEON support - only works for 32-bit ARM (i.e. it does not work for
  * ARM64).  The code in arm/filter_neon_intrinsics.c supports ARM64, however it
  * only works if -mfpu=neon is specified on the GCC command line.  See pngpriv.h
--- a/media/libpng/arm/linux.c
+++ b/media/libpng/arm/linux.c
@@ -1,13 +1,13 @@
 /* contrib/arm-neon/linux.c
  *
- * Copyright (c) 2014 Glenn Randers-Pehrson
- * Written by John Bowler, 2014.
- * Last changed in libpng 1.6.16 [December 22, 2014]
+ * Last changed in libpng 1.6.31 [July 27, 2017]
+ * Copyright (c) 2014, 2017 Glenn Randers-Pehrson
+ * Written by John Bowler, 2014, 2017.
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * SEE contrib/arm-neon/README before reporting bugs
  *
  * STATUS: SUPPORTED
@@ -57,30 +57,30 @@ png_have_neon(png_structp png_ptr)
          {
             case StartLine:
                /* Match spaces at the start of line */
                if (ch <= 32) /* skip control characters and space */
                   break;
 
                counter=0;
                state = Feature;
-               /* FALL THROUGH */
+               /* FALLTHROUGH */
 
             case Feature:
                /* Match 'FEATURE', ASCII case insensitive. */
                if ((ch & ~0x20) == ch_feature[counter])
                {
                   if (++counter == (sizeof ch_feature))
                      state = Colon;
                   break;
                }
 
                /* did not match 'feature' */
                state = SkipLine;
-               /* FALL THROUGH */
+               /* FALLTHROUGH */
 
             case SkipLine:
             skipLine:
                /* Skip everything until we see linefeed or carriage return */
                if (ch != 10 && ch != 13)
                   break;
 
                state = StartLine;
@@ -105,29 +105,29 @@ png_have_neon(png_structp png_ptr)
 
             case StartTag:
                /* Skip space characters before a tag */
                if (ch == 32 || ch == 9)
                   break;
 
                state = Neon;
                counter = 0;
-               /* FALL THROUGH */
+               /* FALLTHROUGH */
 
             case Neon:
                /* Look for 'neon' tag */
                if ((ch & ~0x20) == ch_neon[counter])
                {
                   if (++counter == (sizeof ch_neon))
                      state = HaveNeon;
                   break;
                }
 
                state = SkipTag;
-               /* FALL THROUGH */
+               /* FALLTHROUGH */
 
             case SkipTag:
                /* Skip non-space characters */
                if (ch == 10 || ch == 13)
                   state = StartLine;
 
                else if (ch == 32 || ch == 9)
                   state = StartTag;
--- a/media/libpng/intel/filter_sse2_intrinsics.c
+++ b/media/libpng/intel/filter_sse2_intrinsics.c
@@ -1,16 +1,16 @@
 
 /* filter_sse2_intrinsics.c - SSE2 optimized filter functions
  *
  * Copyright (c) 2016-2017 Glenn Randers-Pehrson
  * Written by Mike Klein and Matt Sarett
  * Derived from arm/filter_neon_intrinsics.c
  *
- * Last changed in libpng 1.6.29 [March 16, 2017]
+ * Last changed in libpng 1.6.31 [July 27, 2017]
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
 #include "../pngpriv.h"
 
@@ -35,123 +35,140 @@ static __m128i load4(const void* p) {
 static void store4(void* p, __m128i v) {
    *(int*)p = _mm_cvtsi128_si32(v);
 }
 
 static __m128i load3(const void* p) {
    /* We'll load 2 bytes, then 1 byte,
     * then mask them together, and finally load into SSE.
     */
-   const png_uint_16* p01 = p;
+   const png_uint_16* p01 = (png_const_uint_16p)p;
    const png_byte*    p2  = (const png_byte*)(p01+1);
 
    png_uint_32 v012 = (png_uint_32)(*p01)
                     | (png_uint_32)(*p2) << 16;
    return load4(&v012);
 }
 
 static void store3(void* p, __m128i v) {
    /* We'll pull from SSE as a 32-bit int, then write
     * its bottom two bytes, then its third byte.
     */
    png_uint_32 v012;
+   png_uint_16* p01;
+   png_byte*    p2;
+
    store4(&v012, v);
 
-   png_uint_16* p01 = p;
-   png_byte*    p2  = (png_byte*)(p01+1);
-   *p01 = v012;
-   *p2  = v012 >> 16;
+   p01 = (png_uint_16p)p;
+   p2  = (png_byte*)(p01+1);
+   *p01 = (png_uint_16)v012;
+   *p2  = (png_byte)(v012 >> 16);
 }
 
 void png_read_filter_row_sub3_sse2(png_row_infop row_info, png_bytep row,
    png_const_bytep prev)
 {
    /* The Sub filter predicts each pixel as the previous pixel, a.
     * There is no pixel to the left of the first pixel.  It's encoded directly.
     * That works with our main loop if we just say that left pixel was zero.
     */
-   png_debug(1, "in png_read_filter_row_sub3_sse2");
+   png_size_t rb;
+
    __m128i a, d = _mm_setzero_si128();
 
-   int rb = row_info->rowbytes;
+   png_debug(1, "in png_read_filter_row_sub3_sse2");
+
+   rb = row_info->rowbytes;
    while (rb >= 4) {
       a = d; d = load4(row);
       d = _mm_add_epi8(d, a);
       store3(row, d);
 
       row += 3;
       rb  -= 3;
    }
    if (rb > 0) {
       a = d; d = load3(row);
       d = _mm_add_epi8(d, a);
       store3(row, d);
 
       row += 3;
       rb  -= 3;
    }
+   PNG_UNUSED(prev)
 }
 
 void png_read_filter_row_sub4_sse2(png_row_infop row_info, png_bytep row,
    png_const_bytep prev)
 {
    /* The Sub filter predicts each pixel as the previous pixel, a.
     * There is no pixel to the left of the first pixel.  It's encoded directly.
     * That works with our main loop if we just say that left pixel was zero.
     */
-   png_debug(1, "in png_read_filter_row_sub4_sse2");
+   png_size_t rb;
+
    __m128i a, d = _mm_setzero_si128();
 
-   int rb = row_info->rowbytes;
-   while (rb > 0) {
+   png_debug(1, "in png_read_filter_row_sub4_sse2");
+
+   rb = row_info->rowbytes+4;
+   while (rb > 4) {
       a = d; d = load4(row);
       d = _mm_add_epi8(d, a);
       store4(row, d);
 
       row += 4;
       rb  -= 4;
    }
+   PNG_UNUSED(prev)
 }
 
 void png_read_filter_row_avg3_sse2(png_row_infop row_info, png_bytep row,
    png_const_bytep prev)
 {
    /* The Avg filter predicts each pixel as the (truncated) average of a and b.
     * There's no pixel to the left of the first pixel.  Luckily, it's
     * predicted to be half of the pixel above it.  So again, this works
     * perfectly with our loop if we make sure a starts at zero.
     */
-   png_debug(1, "in png_read_filter_row_avg3_sse2");
+
+   png_size_t rb;
+
    const __m128i zero = _mm_setzero_si128();
+
    __m128i    b;
    __m128i a, d = zero;
 
-   int rb = row_info->rowbytes;
+   png_debug(1, "in png_read_filter_row_avg3_sse2");
+   rb = row_info->rowbytes;
    while (rb >= 4) {
+      __m128i avg;
              b = load4(prev);
       a = d; d = load4(row );
 
       /* PNG requires a truncating average, so we can't just use _mm_avg_epu8 */
-      __m128i avg = _mm_avg_epu8(a,b);
+      avg = _mm_avg_epu8(a,b);
       /* ...but we can fix it up by subtracting off 1 if it rounded up. */
       avg = _mm_sub_epi8(avg, _mm_and_si128(_mm_xor_si128(a,b),
                                             _mm_set1_epi8(1)));
       d = _mm_add_epi8(d, avg);
       store3(row, d);
 
       prev += 3;
       row  += 3;
       rb   -= 3;
    }
    if (rb > 0) {
+      __m128i avg;
              b = load3(prev);
       a = d; d = load3(row );
 
       /* PNG requires a truncating average, so we can't just use _mm_avg_epu8 */
-      __m128i avg = _mm_avg_epu8(a,b);
+      avg = _mm_avg_epu8(a,b);
       /* ...but we can fix it up by subtracting off 1 if it rounded up. */
       avg = _mm_sub_epi8(avg, _mm_and_si128(_mm_xor_si128(a,b),
                                             _mm_set1_epi8(1)));
 
       d = _mm_add_epi8(d, avg);
       store3(row, d);
 
       prev += 3;
@@ -163,28 +180,31 @@ void png_read_filter_row_avg3_sse2(png_r
 void png_read_filter_row_avg4_sse2(png_row_infop row_info, png_bytep row,
    png_const_bytep prev)
 {
    /* The Avg filter predicts each pixel as the (truncated) average of a and b.
     * There's no pixel to the left of the first pixel.  Luckily, it's
     * predicted to be half of the pixel above it.  So again, this works
     * perfectly with our loop if we make sure a starts at zero.
     */
-   png_debug(1, "in png_read_filter_row_avg4_sse2");
+   png_size_t rb;
    const __m128i zero = _mm_setzero_si128();
    __m128i    b;
    __m128i a, d = zero;
 
-   int rb = row_info->rowbytes;
-   while (rb > 0) {
+   png_debug(1, "in png_read_filter_row_avg4_sse2");
+
+   rb = row_info->rowbytes+4;
+   while (rb > 4) {
+      __m128i avg;
              b = load4(prev);
       a = d; d = load4(row );
 
       /* PNG requires a truncating average, so we can't just use _mm_avg_epu8 */
-      __m128i avg = _mm_avg_epu8(a,b);
+      avg = _mm_avg_epu8(a,b);
       /* ...but we can fix it up by subtracting off 1 if it rounded up. */
       avg = _mm_sub_epi8(avg, _mm_and_si128(_mm_xor_si128(a,b),
                                             _mm_set1_epi8(1)));
 
       d = _mm_add_epi8(d, avg);
       store4(row, d);
 
       prev += 4;
@@ -232,81 +252,86 @@ void png_read_filter_row_paeth3_sse2(png
     * p=a+b-c.
     *
     * The first pixel has no left context, and so uses an Up filter, p = b.
     * This works naturally with our main loop's p = a+b-c if we force a and c
     * to zero.
     * Here we zero b and d, which become c and a respectively at the start of
     * the loop.
     */
-   png_debug(1, "in png_read_filter_row_paeth3_sse2");
+   png_size_t rb;
    const __m128i zero = _mm_setzero_si128();
    __m128i c, b = zero,
            a, d = zero;
 
-   int rb = row_info->rowbytes;
+   png_debug(1, "in png_read_filter_row_paeth3_sse2");
+
+   rb = row_info->rowbytes;
    while (rb >= 4) {
       /* It's easiest to do this math (particularly, deal with pc) with 16-bit
        * intermediates.
        */
+      __m128i pa,pb,pc,smallest,nearest;
       c = b; b = _mm_unpacklo_epi8(load4(prev), zero);
       a = d; d = _mm_unpacklo_epi8(load4(row ), zero);
 
       /* (p-a) == (a+b-c - a) == (b-c) */
-      __m128i pa = _mm_sub_epi16(b,c);
+   
+      pa = _mm_sub_epi16(b,c);
 
       /* (p-b) == (a+b-c - b) == (a-c) */
-      __m128i pb = _mm_sub_epi16(a,c);
+      pb = _mm_sub_epi16(a,c);
 
       /* (p-c) == (a+b-c - c) == (a+b-c-c) == (b-c)+(a-c) */
-      __m128i pc = _mm_add_epi16(pa,pb);
+      pc = _mm_add_epi16(pa,pb);
 
       pa = abs_i16(pa);  /* |p-a| */
       pb = abs_i16(pb);  /* |p-b| */
       pc = abs_i16(pc);  /* |p-c| */
 
-      __m128i smallest = _mm_min_epi16(pc, _mm_min_epi16(pa, pb));
+      smallest = _mm_min_epi16(pc, _mm_min_epi16(pa, pb));
 
       /* Paeth breaks ties favoring a over b over c. */
-      __m128i nearest  = if_then_else(_mm_cmpeq_epi16(smallest, pa), a,
-                         if_then_else(_mm_cmpeq_epi16(smallest, pb), b,
-                                                                     c));
+      nearest  = if_then_else(_mm_cmpeq_epi16(smallest, pa), a,
+                 if_then_else(_mm_cmpeq_epi16(smallest, pb), b,
+                                                             c));
 
       /* Note `_epi8`: we need addition to wrap modulo 255. */
       d = _mm_add_epi8(d, nearest);
       store3(row, _mm_packus_epi16(d,d));
 
       prev += 3;
       row  += 3;
       rb   -= 3;
    }
    if (rb > 0) {
       /* It's easiest to do this math (particularly, deal with pc) with 16-bit
        * intermediates.
        */
+      __m128i pa,pb,pc,smallest,nearest;
       c = b; b = _mm_unpacklo_epi8(load3(prev), zero);
       a = d; d = _mm_unpacklo_epi8(load3(row ), zero);
 
       /* (p-a) == (a+b-c - a) == (b-c) */
-      __m128i pa = _mm_sub_epi16(b,c);
+      pa = _mm_sub_epi16(b,c);
 
       /* (p-b) == (a+b-c - b) == (a-c) */
-      __m128i pb = _mm_sub_epi16(a,c);
+      pb = _mm_sub_epi16(a,c);
 
       /* (p-c) == (a+b-c - c) == (a+b-c-c) == (b-c)+(a-c) */
-      __m128i pc = _mm_add_epi16(pa,pb);
+      pc = _mm_add_epi16(pa,pb);
 
       pa = abs_i16(pa);  /* |p-a| */
       pb = abs_i16(pb);  /* |p-b| */
       pc = abs_i16(pc);  /* |p-c| */
 
-      __m128i smallest = _mm_min_epi16(pc, _mm_min_epi16(pa, pb));
+      smallest = _mm_min_epi16(pc, _mm_min_epi16(pa, pb));
 
       /* Paeth breaks ties favoring a over b over c. */
-      __m128i nearest  = if_then_else(_mm_cmpeq_epi16(smallest, pa), a,
+      nearest  = if_then_else(_mm_cmpeq_epi16(smallest, pa), a,
                          if_then_else(_mm_cmpeq_epi16(smallest, pb), b,
                                                                      c));
 
       /* Note `_epi8`: we need addition to wrap modulo 255. */
       d = _mm_add_epi8(d, nearest);
       store3(row, _mm_packus_epi16(d,d));
 
       prev += 3;
@@ -326,46 +351,49 @@ void png_read_filter_row_paeth4_sse2(png
     * p=a+b-c.
     *
     * The first pixel has no left context, and so uses an Up filter, p = b.
     * This works naturally with our main loop's p = a+b-c if we force a and c
     * to zero.
     * Here we zero b and d, which become c and a respectively at the start of
     * the loop.
     */
-   png_debug(1, "in png_read_filter_row_paeth4_sse2");
+   png_size_t rb;
    const __m128i zero = _mm_setzero_si128();
+   __m128i pa,pb,pc,smallest,nearest;
    __m128i c, b = zero,
            a, d = zero;
 
-   int rb = row_info->rowbytes;
-   while (rb > 0) {
+   png_debug(1, "in png_read_filter_row_paeth4_sse2");
+
+   rb = row_info->rowbytes+4;
+   while (rb > 4) {
       /* It's easiest to do this math (particularly, deal with pc) with 16-bit
        * intermediates.
        */
       c = b; b = _mm_unpacklo_epi8(load4(prev), zero);
       a = d; d = _mm_unpacklo_epi8(load4(row ), zero);
 
       /* (p-a) == (a+b-c - a) == (b-c) */
-      __m128i pa = _mm_sub_epi16(b,c);
+      pa = _mm_sub_epi16(b,c);
 
       /* (p-b) == (a+b-c - b) == (a-c) */
-      __m128i pb = _mm_sub_epi16(a,c);
+      pb = _mm_sub_epi16(a,c);
 
       /* (p-c) == (a+b-c - c) == (a+b-c-c) == (b-c)+(a-c) */
-      __m128i pc = _mm_add_epi16(pa,pb);
+      pc = _mm_add_epi16(pa,pb);
 
       pa = abs_i16(pa);  /* |p-a| */
       pb = abs_i16(pb);  /* |p-b| */
       pc = abs_i16(pc);  /* |p-c| */
 
-      __m128i smallest = _mm_min_epi16(pc, _mm_min_epi16(pa, pb));
+      smallest = _mm_min_epi16(pc, _mm_min_epi16(pa, pb));
 
       /* Paeth breaks ties favoring a over b over c. */
-      __m128i nearest  = if_then_else(_mm_cmpeq_epi16(smallest, pa), a,
+      nearest  = if_then_else(_mm_cmpeq_epi16(smallest, pa), a,
                          if_then_else(_mm_cmpeq_epi16(smallest, pb), b,
                                                                      c));
 
       /* Note `_epi8`: we need addition to wrap modulo 255. */
       d = _mm_add_epi8(d, nearest);
       store4(row, _mm_packus_epi16(d,d));
 
       prev += 4;
--- a/media/libpng/libpng-manual.txt
+++ b/media/libpng/libpng-manual.txt
@@ -1,24 +1,24 @@
 libpng-manual.txt - A description on how to use and modify libpng
 
- libpng version 1.6.29 - March 16, 2017
+ libpng version 1.6.31 - July 27, 2017
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
- Copyright (c) 1998-2016 Glenn Randers-Pehrson
+ Copyright (c) 1998-2017 Glenn Randers-Pehrson
 
  This document is released under the libpng license.
  For conditions of distribution and use, see the disclaimer
  and license in png.h
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.6.29 - March 16, 2017
+ libpng versions 0.97, January 1998, through 1.6.31 - July 27, 2017
  Updated and distributed by Glenn Randers-Pehrson
- Copyright (c) 1998-2016 Glenn Randers-Pehrson
+ Copyright (c) 1998-2017 Glenn Randers-Pehrson
 
  libpng 1.0 beta 6 - version 0.96 - May 28, 1997
  Updated and distributed by Andreas Dilger
  Copyright (c) 1996, 1997 Andreas Dilger
 
  libpng 1.0 beta 2 - version 0.88 - January 26, 1996
  For conditions of distribution and use, see copyright
  notice in png.h. Copyright (c) 1995, 1996 Guy Eric
@@ -61,27 +61,27 @@ and the files in the "contrib" directory
 the libpng distribution.
 
 Libpng was written as a companion to the PNG specification, as a way
 of reducing the amount of time and effort it takes to support the PNG
 file format in application programs.
 
 The PNG specification (second edition), November 2003, is available as
 a W3C Recommendation and as an ISO Standard (ISO/IEC 15948:2004 (E)) at
-<http://www.w3.org/TR/2003/REC-PNG-20031110/
+<https://www.w3.org/TR/2003/REC-PNG-20031110/
 The W3C and ISO documents have identical technical content.
 
 The PNG-1.2 specification is available at
-<http://png-mng.sourceforge.net/pub/png/spec/1.2/>.
+<https://png-mng.sourceforge.io/pub/png/spec/1.2/>.
 It is technically equivalent
 to the PNG specification (second edition) but has some additional material.
 
-The PNG-1.0 specification is available as RFC 2083 
-<http://png-mng.sourceforge.net/pub/png/spec/1.0/> and as a
-W3C Recommendation <http://www.w3.org/TR/REC-png-961001>.
+The PNG-1.0 specification is available as RFC 2083
+<https://png-mng.sourceforge.io/pub/png/spec/1.0/> and as a
+W3C Recommendation <https://www.w3.org/TR/REC-png-961001>.
 
 Some additional chunks are described in the special-purpose public chunks
 documents at <http://www.libpng.org/pub/png/spec/register/>
 
 Other information
 about PNG, and the latest version of libpng, can be found at the PNG home
 page, <http://www.libpng.org/pub/png/>.
 
@@ -96,17 +96,17 @@ to be easily modifiable, to be portable 
 machines (ANSI, K&R, 16-, 32-, and 64-bit) available, and to be easy
 to use.  The ultimate goal of libpng is to promote the acceptance of
 the PNG file format in whatever way possible.  While there is still
 work to be done (see the TODO file), libpng should cover the
 majority of the needs of its users.
 
 Libpng uses zlib for its compression and decompression of PNG files.
 Further information about zlib, and the latest version of zlib, can
-be found at the zlib home page, <http://zlib.net/>.
+be found at the zlib home page, <https://zlib.net/>.
 The zlib compression utility is a general purpose utility that is
 useful for more than PNG files, and can be used without libpng.
 See the documentation delivered with zlib for more details.
 You can usually find the source files for the zlib utility wherever you
 find the libpng source files.
 
 Libpng is thread safe, provided the threads are using different
 instances of the structures.  Each thread should have its own
@@ -1185,17 +1185,30 @@ row_pointers prior to calling png_read_p
 
    for (int i=0; i<height, i++)
       row_pointers[i]=png_malloc(png_ptr,
           width*pixel_size);
 
    png_set_rows(png_ptr, info_ptr, &row_pointers);
 
 Alternatively you could allocate your image in one big block and define
-row_pointers[i] to point into the proper places in your block.
+row_pointers[i] to point into the proper places in your block, but first
+be sure that your platform is able to allocate such a large buffer:
+
+   /* Guard against integer overflow */
+   if (height > PNG_SIZE_MAX/(width*pixel_size)) {
+        png_error(png_ptr,"image_data buffer would be too large");
+   }
+
+   png_bytep buffer=png_malloc(png_ptr,height*width*pixel_size);
+
+   for (int i=0; i<height, i++)
+      row_pointers[i]=buffer+i*width*pixel_size;
+
+   png_set_rows(png_ptr, info_ptr, &row_pointers);
 
 If you use png_set_rows(), the application is responsible for freeing
 row_pointers (and row_pointers[i], if they were separately allocated).
 
 If you don't allocate row_pointers ahead of time, png_read_png() will
 do it, and it'll be free'ed by libpng when you call png_destroy_*().
 
 The low-level read interface
@@ -1312,16 +1325,21 @@ in until png_read_end() has read the chu
     channels       - number of channels of info for the
                      color type (valid values are 1 (GRAY,
                      PALETTE), 2 (GRAY_ALPHA), 3 (RGB),
                      4 (RGB_ALPHA or RGB + filler byte))
 
     rowbytes = png_get_rowbytes(png_ptr, info_ptr);
 
     rowbytes       - number of bytes needed to hold a row
+                     This value, the bit_depth, color_type,
+                     and the number of channels can change
+                     if you use transforms such as
+                     png_set_expand(). See
+                     png_read_update_info(), below.
 
     signature = png_get_signature(png_ptr, info_ptr);
 
     signature      - holds the signature read from the
                      file (if any).  The data is kept in
                      the same offset it would be if the
                      whole signature were read (i.e. if an
                      application had already read in 4
@@ -1430,16 +1448,21 @@ png_set_rgb_to_gray()).
 
     num_trans      - number of transparent entries
                      (PNG_INFO_tRNS)
 
     trans_color    - graylevel or color sample values of
                      the single transparent color for
                      non-paletted images (PNG_INFO_tRNS)
 
+    png_get_eXIf(png_ptr, info_ptr, &exif);
+                     (PNG_INFO_eXIf)
+
+    exif           - Exif profile (array of png_byte)
+
     png_get_hIST(png_ptr, info_ptr, &hist);
                      (PNG_INFO_hIST)
 
     hist           - histogram of palette (array of
                      png_uint_16)
 
     png_get_tIME(png_ptr, info_ptr, &mod_time);
 
@@ -2141,16 +2164,26 @@ only call png_read_update_info() once wi
 After you call png_read_update_info(), you can allocate any
 memory you need to hold the image.  The row data is simply
 raw byte data for all forms of images.  As the actual allocation
 varies among applications, no example will be given.  If you
 are allocating one large chunk, you will need to build an
 array of pointers to each row, as it will be needed for some
 of the functions below.
 
+Be sure that your platform can allocate the buffer that you'll need.
+libpng internally checks for oversize width, but you'll need to
+do your own check for number_of_rows*width*pixel_size if you are using
+a multiple-row buffer:
+
+   /* Guard against integer overflow */
+   if (number_of_rows > PNG_SIZE_MAX/(width*pixel_size)) {
+        png_error(png_ptr,"image_data buffer would be too large");
+   }
+
 Remember: Before you call png_read_update_info(), the png_get_*()
 functions return the values corresponding to the original PNG image.
 After you call png_read_update_info the values refer to the image
 that libpng will output.  Consequently you must call all the png_set_
 functions before you call png_read_update_info().  This is particularly
 important for png_set_interlace_handling() - if you are going to call
 png_read_update_info() you must call png_set_interlace_handling() before
 it unless you want to receive interlaced output.
@@ -2465,16 +2498,17 @@ your application instead of by libpng, y
     png_set_invalid(png_ptr, info_ptr, mask);
 
     mask - identifies the chunks to be made invalid,
            containing the bitwise OR of one or
            more of
              PNG_INFO_gAMA, PNG_INFO_sBIT,
              PNG_INFO_cHRM, PNG_INFO_PLTE,
              PNG_INFO_tRNS, PNG_INFO_bKGD,
+             PNG_INFO_eXIf,
              PNG_INFO_hIST, PNG_INFO_pHYs,
              PNG_INFO_oFFs, PNG_INFO_tIME,
              PNG_INFO_pCAL, PNG_INFO_sRGB,
              PNG_INFO_iCCP, PNG_INFO_sPLT,
              PNG_INFO_sCAL, PNG_INFO_IDAT
 
 For a more compact example of reading a PNG image, see the file example.c.
 
@@ -3064,16 +3098,21 @@ width, height, bit_depth, and color_type
     num_trans      - number of transparent entries
                      (PNG_INFO_tRNS)
 
     trans_color    - graylevel or color sample values
                      (in order red, green, blue) of the
                      single transparent color for
                      non-paletted images (PNG_INFO_tRNS)
 
+    png_set_eXIf(png_ptr, info_ptr, exif);
+
+    hist           - Exif profile (array of
+                     png_byte) (PNG_INFO_eXIf)
+
     png_set_hIST(png_ptr, info_ptr, hist);
 
     hist           - histogram of palette (array of
                      png_uint_16) (PNG_INFO_hIST)
 
     png_set_tIME(png_ptr, info_ptr, mod_time);
 
     mod_time       - time image was last modified
@@ -3819,17 +3858,17 @@ channel and are suitable for passing to 
 the native byte order of the platform on which the application is running.
 All channels can be converted to the original value by dividing by 65535; all
 channels are linear.  Color channels use the RGB encoding (RGB end-points) of
 the sRGB specification.  This encoding is identified by the
 PNG_FORMAT_FLAG_LINEAR flag below.
 
 When the simplified API needs to convert between sRGB and linear colorspaces,
 the actual sRGB transfer curve defined in the sRGB specification (see the
-article at http://en.wikipedia.org/wiki/SRGB) is used, not the gamma=1/2.2
+article at https://en.wikipedia.org/wiki/SRGB) is used, not the gamma=1/2.2
 approximation used elsewhere in libpng.
 
 When an alpha channel is present it is expected to denote pixel coverage
 of the color or luminance channels and is returned as an associated alpha
 channel: the color/gray channels are scaled (pre-multiplied) by the alpha
 value.
 
 The samples are either contained directly in the image data, between 1 and 8
@@ -4083,17 +4122,17 @@ READ APIs
    void png_image_free(png_imagep image)
 
       Free any data allocated by libpng in image->opaque,
       setting the pointer to NULL.  May be called at any time
       after the structure is initialized.
 
 When the simplified API needs to convert between sRGB and linear colorspaces,
 the actual sRGB transfer curve defined in the sRGB specification (see the
-article at http://en.wikipedia.org/wiki/SRGB) is used, not the gamma=1/2.2
+article at https://en.wikipedia.org/wiki/SRGB) is used, not the gamma=1/2.2
 approximation used elsewhere in libpng.
 
 WRITE APIS
 
 For write you must initialize a png_image structure to describe the image to
 be written:
 
    version: must be set to PNG_IMAGE_VERSION
@@ -4241,37 +4280,40 @@ functions, you will need to set up your 
 functions are normally supplied at the time that the png_struct is created.
 It is also possible to redirect errors and warnings to your own replacement
 functions after png_create_*_struct() has been called by calling:
 
     png_set_error_fn(png_structp png_ptr,
         png_voidp error_ptr, png_error_ptr error_fn,
         png_error_ptr warning_fn);
 
-    png_voidp error_ptr = png_get_error_ptr(png_ptr);
-
 If NULL is supplied for either error_fn or warning_fn, then the libpng
 default function will be used, calling fprintf() and/or longjmp() if a
 problem is encountered.  The replacement error functions should have
 parameters as follows:
 
     void user_error_fn(png_structp png_ptr,
         png_const_charp error_msg);
 
     void user_warning_fn(png_structp png_ptr,
         png_const_charp warning_msg);
 
+Then, within your user_error_fn or user_warning_fn, you can retrieve
+the error_ptr if you need it, by calling
+
+    png_voidp error_ptr = png_get_error_ptr(png_ptr);
+
 The motivation behind using setjmp() and longjmp() is the C++ throw and
 catch exception handling methods.  This makes the code much easier to write,
 as there is no need to check every return code of every function call.
 However, there are some uncertainties about the status of local variables
 after a longjmp, so the user may want to be careful about doing anything
 after setjmp returns non-zero besides returning itself.  Consult your
 compiler documentation for more details.  For an alternative approach, you
-may wish to use the "cexcept" facility (see http://cexcept.sourceforge.net),
+may wish to use the "cexcept" facility (see https://cexcept.sourceforge.io/),
 which is illustrated in pngvalid.c and in contrib/visupng.
 
 Beginning in libpng-1.4.0, the png_set_benign_errors() API became available.
 You can use this to handle certain errors (normally handled as errors)
 as warnings.
 
     png_set_benign_errors (png_ptr, int allowed);
 
@@ -4489,17 +4531,17 @@ png_permit_mng_features() function:
       supported by the version of libpng that you are using.
 
 It is an error to use this function when reading or writing a standalone
 PNG file with the PNG 8-byte signature.  The PNG datastream must be wrapped
 in a MNG datastream.  As a minimum, it must have the MNG 8-byte signature
 and the MHDR and MEND chunks.  Libpng does not provide support for these
 or any other MNG chunks; your application must provide its own support for
 them.  You may wish to consider using libmng (available at
-http://www.libmng.com) instead.
+https://www.libmng.com/) instead.
 
 VIII.  Changes to Libpng from version 0.88
 
 It should be noted that versions of libpng later than 0.96 are not
 distributed by the original libpng author, Guy Schalnat, nor by
 Andreas Dilger, who had taken over from Guy during 1996 and 1997, and
 distributed versions 0.89 through 0.96, but rather by another member
 of the original PNG Group, Glenn Randers-Pehrson.  Guy and Andreas are
@@ -4912,28 +4954,24 @@ macro became PNG_READ_STRIP_16_TO_8_SUPP
 png_set_*_16_to_8() functions separately.
 
 Prior to libpng-1.5.4, the png_set_user_limits() function could only be
 used to reduce the width and height limits from the value of
 PNG_USER_WIDTH_MAX and PNG_USER_HEIGHT_MAX, although this document said
 that it could be used to override them.  Now this function will reduce or
 increase the limits.
 
-Starting in libpng-1.5.10, the user limits can be set en masse with the
-configuration option PNG_SAFE_LIMITS_SUPPORTED.  If this option is enabled,
-a set of "safe" limits is applied in pngpriv.h.  These can be overridden by
-application calls to png_set_user_limits(), png_set_user_chunk_cache_max(),
-and/or png_set_user_malloc_max() that increase or decrease the limits.  Also,
-in libpng-1.5.10 the default width and height limits were increased
-from 1,000,000 to 0x7fffffff (i.e., made unlimited).  Therefore, the
-limits are now
-                               default      safe
+Starting in libpng-1.5.22, default user limits were established. These
+can be overridden by application calls to png_set_user_limits(),
+png_set_user_chunk_cache_max(), and/or png_set_user_malloc_max().
+The limits are now
+                             max possible  default
    png_user_width_max        0x7fffffff    1,000,000
    png_user_height_max       0x7fffffff    1,000,000
-   png_user_chunk_cache_max  0 (unlimited)   128
+   png_user_chunk_cache_max  0 (unlimited) 1000
    png_user_chunk_malloc_max 0 (unlimited) 8,000,000
 
 The png_set_option() function (and the "options" member of the png struct) was
 added to libpng-1.5.15, with option PNG_ARM_NEON.
 
 The library now supports a complete fixed point implementation and can
 thus be used on systems that have no floating point support or very
 limited or slow support.  Previously gamma correction, an essential part
@@ -5173,53 +5211,64 @@ It can be set for testing debug or beta 
 when the build type is switched to RC or STABLE. In essence this overrides the
 PNG_LIBPNG_BUILD_BASE_TYPE definition which is not directly user controllable.
 
 Starting with libpng-1.6.19, attempting to set an over-length PLTE chunk
 is an error. Previously this requirement of the PNG specification was not
 enforced, and the palette was always limited to 256 entries. An over-length
 PLTE chunk found in an input PNG is silently truncated.
 
+Starting with libpng-1.6.31, the eXIf chunk is supported. Libpng does not
+attempt to decode the Exif profile; it simply returns a byte array
+containing the profile to the calling application which must do its own
+decoding.
+
 XIII.  Detecting libpng
 
 The png_get_io_ptr() function has been present since libpng-0.88, has never
 changed, and is unaffected by conditional compilation macros.  It is the
 best choice for use in configure scripts for detecting the presence of any
 libpng version since 0.88.  In an autoconf "configure.in" you could use
 
     AC_CHECK_LIB(png, png_get_io_ptr, ...
 
 XV. Source code repository
 
 Since about February 2009, version 1.2.34, libpng has been under "git" source
 control.  The git repository was built from old libpng-x.y.z.tar.gz files
 going back to version 0.70.  You can access the git repository (read only)
 at
 
-    git://git.code.sf.net/p/libpng/code
-
-or you can browse it with a web browser by selecting the "code" button at
-
-    https://sourceforge.net/projects/libpng
+    https://github.com/glennrp/libpng or
+    https://git.code.sf.net/p/libpng/code.git
+
+or you can browse it with a web browser at
+
+    https://github.com/glennrp/libpng or
+    https://sourceforge.net/p/libpng/code/ci/libpng16/tree/
 
 Patches can be sent to glennrp at users.sourceforge.net or to
 png-mng-implement at lists.sourceforge.net or you can upload them to
 the libpng bug tracker at
 
-    http://libpng.sourceforge.net
+    https://libpng.sourceforge.io/
+
+or as a "pull request" to
+
+    https://github.com/glennrp/libpng/pulls
 
 We also accept patches built from the tar or zip distributions, and
 simple verbal discriptions of bug fixes, reported either to the
 SourceForge bug tracker, to the png-mng-implement at lists.sf.net
-mailing list, or directly to glennrp.
+mailing list, as github issues, or directly to glennrp.
 
 XV. Coding style
 
 Our coding style is similar to the "Allman" style
-(See http://en.wikipedia.org/wiki/Indent_style#Allman_style), with curly
+(See https://en.wikipedia.org/wiki/Indent_style#Allman_style), with curly
 braces on separate lines:
 
     if (condition)
     {
        action;
     }
 
     else if (another condition)
@@ -5310,17 +5359,17 @@ sizeof operator, with its argument, in p
 
   (sizeof (png_uint_32))
   (sizeof array)
 
 Prior to libpng-1.6.0 we used a "png_sizeof()" macro, formatted as
 though it were a function.
 
 Control keywords if, for, while, and switch are always followed by a space
-to distinguish them from function calls, which have no trailing space. 
+to distinguish them from function calls, which have no trailing space.
 
 We put a space after each comma and after each semicolon
 in "for" statements, and we put spaces before and after each
 C binary operator and after "for" or "while", and before
 "?".  We don't put a space between a typecast and the expression
 being cast, nor do we put one between a function name and the
 left parenthesis that follows it:
 
@@ -5336,31 +5385,31 @@ with an even number of lower-case hex di
 (e.g., 0x00U, 0xffU, 0x0100U) and long if they are greater than 0x7fff
 (e.g., 0xffffUL).
 
 We prefer to use underscores rather than camelCase in names, except
 for a few type names that we inherit from zlib.h.
 
 We prefer "if (something != 0)" and "if (something == 0)" over
 "if (something)" and if "(!something)", respectively, and for pointers
-we prefer "if (some_pointer != NULL)" or "if (some_pointer == NULL)". 
+we prefer "if (some_pointer != NULL)" or "if (some_pointer == NULL)".
 
 We do not use the TAB character for indentation in the C sources.
 
 Lines do not exceed 80 characters.
 
 Other rules can be inferred by inspecting the libpng source.
 
 XVI. Y2K Compliance in libpng
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.6.29 are Y2K compliant.  It is my belief that earlier
+upward through 1.6.31 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has two year fields.  One is a 2-byte unsigned integer
 that will hold years up to 65535.  The other, which is deprecated,
 holds the date in text format, and will hold years up to 9999.
 
 The integer is
     "png_uint_16 year" in png_time_struct.
--- a/media/libpng/png.c
+++ b/media/libpng/png.c
@@ -1,25 +1,45 @@
 
 /* png.c - location for general purpose libpng functions
  *
- * Last changed in libpng 1.6.29 [March 16, 2017]
+ * Last changed in libpng 1.6.31 [July 27, 2017]
  * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_29 Your_png_h_is_not_version_1_6_29;
+typedef png_libpng_version_1_6_31 Your_png_h_is_not_version_1_6_31;
+
+#ifdef __GNUC__
+/* The version tests may need to be added to, but the problem warning has
+ * consistently been fixed in GCC versions which obtain wide-spread release.
+ * The problem is that many versions of GCC rearrange comparison expressions in
+ * the optimizer in such a way that the results of the comparison will change
+ * if signed integer overflow occurs.  Such comparisons are not permitted in
+ * ANSI C90, however GCC isn't clever enough to work out that that do not occur
+ * below in png_ascii_from_fp and png_muldiv, so it produces a warning with
+ * -Wextra.  Unfortunately this is highly dependent on the optimizer and the
+ * machine architecture so the warning comes and goes unpredictably and is
+ * impossible to "fix", even were that a good idea.
+ */
+#if __GNUC__ == 7 && __GNUC_MINOR__ == 1
+#define GCC_STRICT_OVERFLOW 1
+#endif /* GNU 7.1.x */
+#endif /* GNU */
+#ifndef GCC_STRICT_OVERFLOW
+#define GCC_STRICT_OVERFLOW 0
+#endif
 
 /* Tells libpng that we have already handled the first "num_bytes" bytes
  * of the PNG file signature.  If the PNG data is embedded into another
  * stream we can set num_bytes = 8 so that libpng will not attempt to read
  * or write any of the magic bytes before it starts on the IHDR.
  */
 
 #ifdef PNG_READ_SUPPORTED
@@ -590,16 +610,26 @@ png_free_data(png_const_structrp png_ptr
 
          png_free(png_ptr, info_ptr->unknown_chunks);
          info_ptr->unknown_chunks = NULL;
          info_ptr->unknown_chunks_num = 0;
       }
    }
 #endif
 
+#ifdef PNG_eXIf_SUPPORTED
+   /* Free any eXIf entry */
+   if (((mask & PNG_FREE_EXIF) & info_ptr->free_me) != 0)
+   {
+      png_free(png_ptr, info_ptr->exif);
+      info_ptr->exif = NULL;
+      info_ptr->valid &= ~PNG_INFO_eXIf;
+   }
+#endif
+
 #ifdef PNG_hIST_SUPPORTED
    /* Free any hIST entry */
    if (((mask & PNG_FREE_HIST) & info_ptr->free_me) != 0)
    {
       png_free(png_ptr, info_ptr->hist);
       info_ptr->hist = NULL;
       info_ptr->valid &= ~PNG_INFO_hIST;
    }
@@ -771,26 +801,26 @@ png_const_charp PNGAPI
 png_get_copyright(png_const_structrp png_ptr)
 {
    PNG_UNUSED(png_ptr)  /* Silence compiler warning about unused png_ptr */
 #ifdef PNG_STRING_COPYRIGHT
    return PNG_STRING_COPYRIGHT
 #else
 #  ifdef __STDC__
    return PNG_STRING_NEWLINE \
-      "libpng version 1.6.29+apng - March 16, 2017" PNG_STRING_NEWLINE \
+      "libpng version 1.6.31+apng - July 27, 2017" PNG_STRING_NEWLINE \
       "Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson" \
       PNG_STRING_NEWLINE \
       "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
       "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
       PNG_STRING_NEWLINE \
       "Portions Copyright (c) 2006-2007 Andrew Smith" PNG_STRING_NEWLINE \
       "Portions Copyright (c) 2008-2017 Max Stepin" PNG_STRING_NEWLINE ;
 #  else
-   return "libpng version 1.6.29+apng - March 16, 2017\
+   return "libpng version 1.6.31+apng - July 27, 2017\
       Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\
       Portions Copyright (c) 2006-2007 Andrew Smith\
       Portions Copyright (c) 2008-2017 Max Stepin";
 #  endif
 #endif
 }
@@ -2831,17 +2861,17 @@ png_pow10(int power)
    double d = 1;
 
    /* Handle negative exponent with a reciprocal at the end because
     * 10 is exact whereas .1 is inexact in base 2
     */
    if (power < 0)
    {
       if (power < DBL_MIN_10_EXP) return 0;
-      recip = 1, power = -power;
+      recip = 1; power = -power;
    }
 
    if (power > 0)
    {
       /* Decompose power bitwise. */
       double mult = 10;
       do
       {
@@ -2856,16 +2886,24 @@ png_pow10(int power)
    /* else power is 0 and d is 1 */
 
    return d;
 }
 
 /* Function to format a floating point value in ASCII with a given
  * precision.
  */
+#if GCC_STRICT_OVERFLOW
+#pragma GCC diagnostic push
+/* The problem arises below with exp_b10, which can never overflow because it
+ * comes, originally, from frexp and is therefore limited to a range which is
+ * typically +/-710 (log2(DBL_MAX)/log2(DBL_MIN)).
+ */
+#pragma GCC diagnostic warning "-Wstrict-overflow=2"
+#endif /* GCC_STRICT_OVERFLOW */
 void /* PRIVATE */
 png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
     double fp, unsigned int precision)
 {
    /* We use standard functions from math.h, but not printf because
     * that would require stdio.  The caller must supply a buffer of
     * sufficient size or we will png_error.  The tests on size and
     * the space in ascii[] consumed are indicated below.
@@ -2909,48 +2947,53 @@ png_ascii_from_fp(png_const_structrp png
          base = png_pow10(exp_b10); /* May underflow */
 
          while (base < DBL_MIN || base < fp)
          {
             /* And this may overflow. */
             double test = png_pow10(exp_b10+1);
 
             if (test <= DBL_MAX)
-               ++exp_b10, base = test;
+            {
+               ++exp_b10; base = test;
+            }
 
             else
                break;
          }
 
          /* Normalize fp and correct exp_b10, after this fp is in the
           * range [.1,1) and exp_b10 is both the exponent and the digit
           * *before* which the decimal point should be inserted
           * (starting with 0 for the first digit).  Note that this
           * works even if 10^exp_b10 is out of range because of the
           * test on DBL_MAX above.
           */
          fp /= base;
-         while (fp >= 1) fp /= 10, ++exp_b10;
+         while (fp >= 1)
+         {
+            fp /= 10; ++exp_b10;
+         }
 
          /* Because of the code above fp may, at this point, be
           * less than .1, this is ok because the code below can
           * handle the leading zeros this generates, so no attempt
           * is made to correct that here.
           */
 
          {
             unsigned int czero, clead, cdigits;
             char exponent[10];
 
             /* Allow up to two leading zeros - this will not lengthen
              * the number compared to using E-n.
              */
             if (exp_b10 < 0 && exp_b10 > -3) /* PLUS 3 TOTAL 4 */
             {
-               czero = (unsigned int)(-exp_b10); /* PLUS 2 digits: TOTAL 3 */
+               czero = 0U-exp_b10; /* PLUS 2 digits: TOTAL 3 */
                exp_b10 = 0;      /* Dot added below before first output. */
             }
             else
                czero = 0;    /* No zeros to add */
 
             /* Generate the digit list, stripping trailing zeros and
              * inserting a '.' before a digit if the exponent is 0.
              */
@@ -2974,31 +3017,31 @@ png_ascii_from_fp(png_const_structrp png
                {
                   d = floor(fp + .5);
 
                   if (d > 9)
                   {
                      /* Rounding up to 10, handle that here. */
                      if (czero > 0)
                      {
-                        --czero, d = 1;
+                        --czero; d = 1;
                         if (cdigits == 0) --clead;
                      }
                      else
                      {
                         while (cdigits > 0 && d > 9)
                         {
                            int ch = *--ascii;
 
                            if (exp_b10 != (-1))
                               ++exp_b10;
 
                            else if (ch == 46)
                            {
-                              ch = *--ascii, ++size;
+                              ch = *--ascii; ++size;
                               /* Advance exp_b10 to '1', so that the
                                * decimal point happens after the
                                * previous digit.
                                */
                               exp_b10 = 1;
                            }
 
                            --cdigits;
@@ -3015,17 +3058,19 @@ png_ascii_from_fp(png_const_structrp png
                            {
                               /* Leading decimal point (plus zeros?), if
                                * we lose the decimal point here it must
                                * be reentered below.
                                */
                               int ch = *--ascii;
 
                               if (ch == 46)
-                                 ++size, exp_b10 = 1;
+                              {
+                                 ++size; exp_b10 = 1;
+                              }
 
                               /* Else lost a leading zero, so 'exp_b10' is
                                * still ok at (-1)
                                */
                            }
                            else
                               ++exp_b10;
 
@@ -3051,54 +3096,59 @@ png_ascii_from_fp(png_const_structrp png
                   while (czero > 0)
                   {
                      /* exp_b10 == (-1) means we just output the decimal
                       * place - after the DP don't adjust 'exp_b10' any
                       * more!
                       */
                      if (exp_b10 != (-1))
                      {
-                        if (exp_b10 == 0) *ascii++ = 46, --size;
+                        if (exp_b10 == 0)
+                        {
+                           *ascii++ = 46; --size;
+                        }
                         /* PLUS 1: TOTAL 4 */
                         --exp_b10;
                      }
-                     *ascii++ = 48, --czero;
+                     *ascii++ = 48; --czero;
                   }
 
                   if (exp_b10 != (-1))
                   {
                      if (exp_b10 == 0)
-                        *ascii++ = 46, --size; /* counted above */
+                     {
+                        *ascii++ = 46; --size; /* counted above */
+                     }
 
                      --exp_b10;
                   }
-                  *ascii++ = (char)(48 + (int)d), ++cdigits;
+                  *ascii++ = (char)(48 + (int)d); ++cdigits;
                }
             }
             while (cdigits+czero < precision+clead && fp > DBL_MIN);
 
             /* The total output count (max) is now 4+precision */
 
             /* Check for an exponent, if we don't need one we are
              * done and just need to terminate the string.  At
-             * this point exp_b10==(-1) is effectively if flag - it got
+             * this point exp_b10==(-1) is effectively a flag - it got
              * to '-1' because of the decrement after outputting
              * the decimal point above (the exponent required is
              * *not* -1!)
              */
             if (exp_b10 >= (-1) && exp_b10 <= 2)
             {
                /* The following only happens if we didn't output the
                 * leading zeros above for negative exponent, so this
                 * doesn't add to the digit requirement.  Note that the
                 * two zeros here can only be output if the two leading
                 * zeros were *not* output, so this doesn't increase
                 * the output count.
                 */
-               while (--exp_b10 >= 0) *ascii++ = 48;
+               while (exp_b10-- > 0) *ascii++ = 48;
 
                *ascii = 0;
 
                /* Total buffer requirement (including the '\0') is
                 * 5+precision - see check at the start.
                 */
                return;
             }
@@ -3106,33 +3156,33 @@ png_ascii_from_fp(png_const_structrp png
             /* Here if an exponent is required, adjust size for
              * the digits we output but did not count.  The total
              * digit output here so far is at most 1+precision - no
              * decimal point and no leading or trailing zeros have
              * been output.
              */
             size -= cdigits;
 
-            *ascii++ = 69, --size;    /* 'E': PLUS 1 TOTAL 2+precision */
+            *ascii++ = 69; --size;    /* 'E': PLUS 1 TOTAL 2+precision */
 
             /* The following use of an unsigned temporary avoids ambiguities in
              * the signed arithmetic on exp_b10 and permits GCC at least to do
              * better optimization.
              */
             {
                unsigned int uexp_b10;
 
                if (exp_b10 < 0)
                {
-                  *ascii++ = 45, --size; /* '-': PLUS 1 TOTAL 3+precision */
-                  uexp_b10 = (unsigned int)(-exp_b10);
+                  *ascii++ = 45; --size; /* '-': PLUS 1 TOTAL 3+precision */
+                  uexp_b10 = 0U-exp_b10;
                }
 
                else
-                  uexp_b10 = (unsigned int)exp_b10;
+                  uexp_b10 = 0U+exp_b10;
 
                cdigits = 0;
 
                while (uexp_b10 > 0)
                {
                   exponent[cdigits++] = (char)(48 + uexp_b10 % 10);
                   uexp_b10 /= 10;
                }
@@ -3165,16 +3215,19 @@ png_ascii_from_fp(png_const_structrp png
          *ascii = 0;
          return;
       }
    }
 
    /* Here on buffer too small. */
    png_error(png_ptr, "ASCII conversion buffer too small");
 }
+#if GCC_STRICT_OVERFLOW
+#pragma GCC diagnostic pop
+#endif /* GCC_STRICT_OVERFLOW */
 
 #  endif /* FLOATING_POINT */
 
 #  ifdef PNG_FIXED_POINT_SUPPORTED
 /* Function to format a fixed point value in ASCII.
  */
 void /* PRIVATE */
 png_ascii_from_fixed(png_const_structrp png_ptr, png_charp ascii,
@@ -3184,17 +3237,19 @@ png_ascii_from_fixed(png_const_structrp 
     * trailing \0, 13 characters:
     */
    if (size > 12)
    {
       png_uint_32 num;
 
       /* Avoid overflow here on the minimum integer. */
       if (fp < 0)
-         *ascii++ = 45, num = (png_uint_32)(-fp);
+      {
+         *ascii++ = 45; num = (png_uint_32)(-fp);
+      }
       else
          num = (png_uint_32)fp;
 
       if (num <= 0x80000000) /* else overflowed */
       {
          unsigned int ndigits = 0, first = 16 /* flag value */;
          char digits[10];
 
@@ -3222,17 +3277,20 @@ png_ascii_from_fixed(png_const_structrp 
             if (first <= 5)
             {
                unsigned int i;
                *ascii++ = 46; /* decimal point */
                /* ndigits may be <5 for small numbers, output leading zeros
                 * then ndigits digits to first:
                 */
                i = 5;
-               while (ndigits < i) *ascii++ = 48, --i;
+               while (ndigits < i)
+               {
+                  *ascii++ = 48; --i;
+               }
                while (ndigits >= first) *ascii++ = digits[--ndigits];
                /* Don't output the trailing zeros! */
             }
          }
          else
             *ascii++ = 48;
 
          /* And null terminate the string: */
@@ -3273,16 +3331,25 @@ png_fixed(png_const_structrp png_ptr, do
 #if defined(PNG_GAMMA_SUPPORTED) || defined(PNG_COLORSPACE_SUPPORTED) ||\
     defined(PNG_INCH_CONVERSIONS_SUPPORTED) || defined(PNG_READ_pHYs_SUPPORTED)
 /* muldiv functions */
 /* This API takes signed arguments and rounds the result to the nearest
  * integer (or, for a fixed point number - the standard argument - to
  * the nearest .00001).  Overflow and divide by zero are signalled in
  * the result, a boolean - true on success, false on overflow.
  */
+#if GCC_STRICT_OVERFLOW /* from above */
+/* It is not obvious which comparison below gets optimized in such a way that
+ * signed overflow would change the result; looking through the code does not
+ * reveal any tests which have the form GCC complains about, so presumably the
+ * optimizer is moving an add or subtract into the 'if' somewhere.
+ */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic warning "-Wstrict-overflow=2"
+#endif /* GCC_STRICT_OVERFLOW */
 int
 png_muldiv(png_fixed_point_p res, png_fixed_point a, png_int_32 times,
     png_int_32 divisor)
 {
    /* Return a * times / divisor, rounded. */
    if (divisor != 0)
    {
       if (a == 0 || times == 0)
@@ -3387,16 +3454,19 @@ png_muldiv(png_fixed_point_p res, png_fi
             }
          }
 #endif
       }
    }
 
    return 0;
 }
+#if GCC_STRICT_OVERFLOW
+#pragma GCC diagnostic pop
+#endif /* GCC_STRICT_OVERFLOW */
 #endif /* READ_GAMMA || INCH_CONVERSIONS */
 
 #if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_INCH_CONVERSIONS_SUPPORTED)
 /* The following is for when the caller doesn't much care about the
  * result.
  */
 png_fixed_point
 png_muldiv_warn(png_const_structrp png_ptr, png_fixed_point a, png_int_32 times,
@@ -4277,17 +4347,17 @@ png_set_option(png_structrp png_ptr, int
 }
 #endif
 
 /* sRGB support */
 #if defined(PNG_SIMPLIFIED_READ_SUPPORTED) ||\
    defined(PNG_SIMPLIFIED_WRITE_SUPPORTED)
 /* sRGB conversion tables; these are machine generated with the code in
  * contrib/tools/makesRGB.c.  The actual sRGB transfer curve defined in the
- * specification (see the article at http://en.wikipedia.org/wiki/SRGB)
+ * specification (see the article at https://en.wikipedia.org/wiki/SRGB)
  * is used, not the gamma=1/2.2 approximation use elsewhere in libpng.
  * The sRGB to linear table is exact (to the nearest 16-bit linear fraction).
  * The inverse (linear to sRGB) table has accuracies as follows:
  *
  * For all possible (255*65535+1) input values:
  *
  *    error: -0.515566 - 0.625971, 79441 (0.475369%) of readings inexact
  *
--- a/media/libpng/png.h
+++ b/media/libpng/png.h
@@ -1,23 +1,23 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.6.29, March 16, 2017
+ * libpng version 1.6.31, July 27, 2017
  *
  * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license (See LICENSE, below)
  *
  * Authors and maintainers:
  *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.6.29, March 16, 2017:
+ *   libpng versions 0.97, January 1998, through 1.6.31, July 27, 2017:
  *     Glenn Randers-Pehrson.
  *   See also "Contributing Authors", below.
  */
 
 /*
  * COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
  *
  * If you modify libpng you may insert additional notices immediately following
@@ -26,17 +26,17 @@
  * This modified version of libpng code adds animated PNG support and is
  * released under the libpng license described below. The modifications are
  * Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2017 Max Stepin,
  * and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
  * surrounding them in the modified libpng source files.
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.0.7, July 1, 2000 through 1.6.29, March 16, 2017 are
+ * libpng versions 1.0.7, July 1, 2000 through 1.6.31, July 27, 2017 are
  * Copyright (c) 2000-2002, 2004, 2006-2017 Glenn Randers-Pehrson, are
  * derived from libpng-1.0.6, and are distributed according to the same
  * disclaimer and license as libpng-1.0.6 with the following individuals
  * added to the list of Contributing Authors:
  *
  *    Simon-Pierre Cadieux
  *    Eric S. Raymond
  *    Mans Rullgard
@@ -214,17 +214,17 @@
  *    1.0.7                    1    10007  (still compatible)
  *    ...
  *    1.0.19                  10    10019  10.so.0.19[.0]
  *    ...
  *    1.2.57                  13    10257  12.so.0.57[.0]
  *    ...
  *    1.5.28                  15    10527  15.so.15.28[.0]
  *    ...
- *    1.6.29                  16    10629  16.so.16.29[.0]
+ *    1.6.31                  16    10631  16.so.16.31[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
  *    used for changes in backward compatibility, as it is intended.  The
  *    PNG_LIBPNG_VER macro, which is not used within libpng but is available
  *    for applications, is an unsigned integer of the form xyyzz corresponding
  *    to the source version x.y.z (leading zeros in y and z).  Beta versions
  *    were given the previous public release number plus a letter, until
@@ -235,30 +235,30 @@
  *    to the info_ptr or png_ptr members through png.h, and the compiled
  *    application is loaded with a different version of the library.
  *
  *    DLLNUM will change each time there are forward or backward changes
  *    in binary compatibility (e.g., when a new feature is added).
  *
  * See libpng.txt or libpng.3 for more information.  The PNG specification
  * is available as a W3C Recommendation and as an ISO Specification,
- * <http://www.w3.org/TR/2003/REC-PNG-20031110/
+ * <https://www.w3.org/TR/2003/REC-PNG-20031110/
  */
 
 /*
  * Y2K compliance in libpng:
  * =========================
  *
- *    March 16, 2017
+ *    July 27, 2017
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.6.29 are Y2K compliant.  It is my belief that
+ *    upward through 1.6.31 are Y2K compliant.  It is my belief that
  *    earlier versions were also Y2K compliant.
  *
  *    Libpng only has two year fields.  One is a 2-byte unsigned integer
  *    that will hold years up to 65535.  The other, which is deprecated,
  *    holds the date in text format, and will hold years up to 9999.
  *
  *    The integer is
  *        "png_uint_16 year" in png_time_struct.
@@ -310,27 +310,27 @@
  * file has been stripped from your copy of libpng, you can find it at
  * <http://www.libpng.org/pub/png/libpng-manual.txt>
  *
  * If you just need to read a PNG file and don't want to read the documentation
  * skip to the end of this file and read the section entitled 'simplified API'.
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.6.29+apng"
+#define PNG_LIBPNG_VER_STRING "1.6.31+apng"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.6.29+apng - March 16, 2017\n"
+     " libpng version 1.6.31+apng - July 27, 2017\n"
 
 #define PNG_LIBPNG_VER_SONUM   16
 #define PNG_LIBPNG_VER_DLLNUM  16
 
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   6
-#define PNG_LIBPNG_VER_RELEASE 29
+#define PNG_LIBPNG_VER_RELEASE 31
 
 /* This should match the numeric part of the final component of
  * PNG_LIBPNG_VER_STRING, omitting any leading zero:
  */
 
 #define PNG_LIBPNG_VER_BUILD  0
 
 /* Release Status */
@@ -351,17 +351,17 @@
 #define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE
 
 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
  * We must not include leading zeros.
  * Versions 0.7 through 1.0.0 were in the range 0 to 100 here (only
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
  * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
  */
-#define PNG_LIBPNG_VER 10629 /* 1.6.29 */
+#define PNG_LIBPNG_VER 10631 /* 1.6.31 */
 
 /* Library configuration: these options cannot be changed after
  * the library has been built.
  */
 #ifndef PNGLCONF_H
 /* If pnglibconf.h is missing, you can
  * copy scripts/pnglibconf.h.prebuilt to pnglibconf.h
  */
@@ -476,17 +476,17 @@ extern "C" {
 /* blend_op flags from inside fcTL */
 #define PNG_BLEND_OP_SOURCE        0x00
 #define PNG_BLEND_OP_OVER          0x01
 #endif /* APNG */
 
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef char* png_libpng_version_1_6_29;
+typedef char* png_libpng_version_1_6_31;
 
 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
  *
  * png_struct is the cache of information used while reading or writing a single
  * PNG file.  One of these is always required, although the simplified API
  * (below) hides the creation and destruction of it.
  */
 typedef struct png_struct_def png_struct;
@@ -793,19 +793,20 @@ typedef png_unknown_chunk * * png_unknow
 #define PNG_INFO_oFFs 0x0100U
 #define PNG_INFO_tIME 0x0200U
 #define PNG_INFO_pCAL 0x0400U
 #define PNG_INFO_sRGB 0x0800U  /* GR-P, 0.96a */
 #define PNG_INFO_iCCP 0x1000U  /* ESR, 1.0.6 */
 #define PNG_INFO_sPLT 0x2000U  /* ESR, 1.0.6 */
 #define PNG_INFO_sCAL 0x4000U  /* ESR, 1.0.6 */
 #define PNG_INFO_IDAT 0x8000U  /* ESR, 1.0.6 */
+#define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */
 #ifdef PNG_APNG_SUPPORTED
-#define PNG_INFO_acTL 0x10000U
-#define PNG_INFO_fcTL 0x20000U
+#define PNG_INFO_acTL 0x20000U
+#define PNG_INFO_fcTL 0x40000U
 #endif
 
 /* This is used for the transformation routines, as some of them
  * change these values for the row.  It also should enable using
  * the routines for other purposes.
  */
 typedef struct png_row_info_struct
 {
@@ -1813,17 +1814,18 @@ PNG_EXPORT(99, void, png_data_freer, (pn
 #define PNG_FREE_SCAL 0x0100U
 #ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
 #  define PNG_FREE_UNKN 0x0200U
 #endif
 /*      PNG_FREE_LIST 0x0400U   removed in 1.6.0 because it is ignored */
 #define PNG_FREE_PLTE 0x1000U
 #define PNG_FREE_TRNS 0x2000U
 #define PNG_FREE_TEXT 0x4000U
-#define PNG_FREE_ALL  0x7fffU
+#define PNG_FREE_EXIF 0x8000U /* Added at libpng-1.6.31 */
+#define PNG_FREE_ALL  0xffffU
 #define PNG_FREE_MUL  0x4220U /* PNG_FREE_SPLT|PNG_FREE_TEXT|PNG_FREE_UNKN */
 
 #ifdef PNG_USER_MEM_SUPPORTED
 PNG_EXPORTA(100, png_voidp, png_malloc_default, (png_const_structrp png_ptr,
     png_alloc_size_t size), PNG_ALLOCATED PNG_DEPRECATED);
 PNG_EXPORTA(101, void, png_free_default, (png_const_structrp png_ptr,
     png_voidp ptr), PNG_DEPRECATED);
 #endif
@@ -2032,16 +2034,23 @@ PNG_FIXED_EXPORT(136, void, png_set_cHRM
 PNG_FIXED_EXPORT(233, void, png_set_cHRM_XYZ_fixed, (png_const_structrp png_ptr,
     png_inforp info_ptr, png_fixed_point int_red_X, png_fixed_point int_red_Y,
     png_fixed_point int_red_Z, png_fixed_point int_green_X,
     png_fixed_point int_green_Y, png_fixed_point int_green_Z,
     png_fixed_point int_blue_X, png_fixed_point int_blue_Y,
     png_fixed_point int_blue_Z))
 #endif
 
+#ifdef PNG_eXIf_SUPPORTED
+PNG_EXPORT(246, png_uint_32, png_get_eXIf, (png_const_structrp png_ptr,
+    png_inforp info_ptr, png_bytep *exif));
+PNG_EXPORT(247, void, png_set_eXIf, (png_const_structrp png_ptr,
+    png_inforp info_ptr, const png_bytep exif));
+#endif
+
 #ifdef PNG_gAMA_SUPPORTED
 PNG_FP_EXPORT(137, png_uint_32, png_get_gAMA, (png_const_structrp png_ptr,
     png_const_inforp info_ptr, double *file_gamma))
 PNG_FIXED_EXPORT(138, png_uint_32, png_get_gAMA_fixed,
     (png_const_structrp png_ptr, png_const_inforp info_ptr,
     png_fixed_point *int_file_gamma))
 #endif
 
@@ -2050,19 +2059,16 @@ PNG_FP_EXPORT(139, void, png_set_gAMA, (
     png_inforp info_ptr, double file_gamma))
 PNG_FIXED_EXPORT(140, void, png_set_gAMA_fixed, (png_const_structrp png_ptr,
     png_inforp info_ptr, png_fixed_point int_file_gamma))
 #endif
 
 #ifdef PNG_hIST_SUPPORTED
 PNG_EXPORT(141, png_uint_32, png_get_hIST, (png_const_structrp png_ptr,
     png_inforp info_ptr, png_uint_16p *hist));
-#endif
-
-#ifdef PNG_hIST_SUPPORTED
 PNG_EXPORT(142, void, png_set_hIST, (png_const_structrp png_ptr,
     png_inforp info_ptr, png_const_uint_16p hist));
 #endif
 
 PNG_EXPORT(143, png_uint_32, png_get_IHDR, (png_const_structrp png_ptr,
     png_const_inforp info_ptr, png_uint_32 *width, png_uint_32 *height,
     int *bit_depth, int *color_type, int *interlace_method,
     int *compression_method, int *filter_method));
@@ -2778,17 +2784,17 @@ typedef struct
  * b) As a value in the range 0..65535, contained in a 2-byte integer.  All
  * channels can be converted to the original value by dividing by 65535; all
  * channels are linear.  Color channels use the RGB encoding (RGB end-points) of
  * the sRGB specification.  This encoding is identified by the
  * PNG_FORMAT_FLAG_LINEAR flag below.
  *
  * When the simplified API needs to convert between sRGB and linear colorspaces,
  * the actual sRGB transfer curve defined in the sRGB specification (see the
- * article at http://en.wikipedia.org/wiki/SRGB) is used, not the gamma=1/2.2
+ * article at https://en.wikipedia.org/wiki/SRGB) is used, not the gamma=1/2.2
  * approximation used elsewhere in libpng.
  *
  * When an alpha channel is present it is expected to denote pixel coverage
  * of the color or luminance channels and is returned as an associated alpha
  * channel: the color/gray channels are scaled (pre-multiplied) by the alpha
  * value.
  *
  * The samples are either contained directly in the image data, between 1 and 8
@@ -3271,96 +3277,96 @@ PNG_EXPORT(244, int, png_set_option, (pn
    int onoff));
 #endif /* SET_OPTION */
 
 /*******************************************************************************
  *  END OF HARDWARE AND SOFTWARE OPTIONS
  ******************************************************************************/
 
 #ifdef PNG_APNG_SUPPORTED
-PNG_EXPORT(246, png_uint_32, png_get_acTL, (png_structp png_ptr,
+PNG_EXPORT(248, png_uint_32, png_get_acTL, (png_structp png_ptr,
    png_infop info_ptr, png_uint_32 *num_frames, png_uint_32 *num_plays));
 
-PNG_EXPORT(247, png_uint_32, png_set_acTL, (png_structp png_ptr,
+PNG_EXPORT(249, png_uint_32, png_set_acTL, (png_structp png_ptr,
    png_infop info_ptr, png_uint_32 num_frames, png_uint_32 num_plays));
 
-PNG_EXPORT(248, png_uint_32, png_get_num_frames, (png_structp png_ptr,
+PNG_EXPORT(250, png_uint_32, png_get_num_frames, (png_structp png_ptr,
    png_infop info_ptr));
 
-PNG_EXPORT(249, png_uint_32, png_get_num_plays, (png_structp png_ptr,
+PNG_EXPORT(251, png_uint_32, png_get_num_plays, (png_structp png_ptr,
    png_infop info_ptr));
 
-PNG_EXPORT(250, png_uint_32, png_get_next_frame_fcTL,
+PNG_EXPORT(252, png_uint_32, png_get_next_frame_fcTL,
    (png_structp png_ptr, png_infop info_ptr, png_uint_32 *width,
    png_uint_32 *height, png_uint_32 *x_offset, png_uint_32 *y_offset,
    png_uint_16 *delay_num, png_uint_16 *delay_den, png_byte *dispose_op,
    png_byte *blend_op));
 
-PNG_EXPORT(251, png_uint_32, png_set_next_frame_fcTL,
+PNG_EXPORT(253, png_uint_32, png_set_next_frame_fcTL,
    (png_structp png_ptr, png_infop info_ptr, png_uint_32 width,
    png_uint_32 height, png_uint_32 x_offset, png_uint_32 y_offset,
    png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
    png_byte blend_op));
 
-PNG_EXPORT(252, png_uint_32, png_get_next_frame_width,
+PNG_EXPORT(254, png_uint_32, png_get_next_frame_width,
    (png_structp png_ptr, png_infop info_ptr));
-PNG_EXPORT(253, png_uint_32, png_get_next_frame_height,
+PNG_EXPORT(255, png_uint_32, png_get_next_frame_height,
    (png_structp png_ptr, png_infop info_ptr));
-PNG_EXPORT(254, png_uint_32, png_get_next_frame_x_offset,
+PNG_EXPORT(256, png_uint_32, png_get_next_frame_x_offset,
    (png_structp png_ptr, png_infop info_ptr));
-PNG_EXPORT(255, png_uint_32, png_get_next_frame_y_offset,
+PNG_EXPORT(257, png_uint_32, png_get_next_frame_y_offset,
    (png_structp png_ptr, png_infop info_ptr));
-PNG_EXPORT(256, png_uint_16, png_get_next_frame_delay_num,
+PNG_EXPORT(258, png_uint_16, png_get_next_frame_delay_num,
    (png_structp png_ptr, png_infop info_ptr));
-PNG_EXPORT(257, png_uint_16, png_get_next_frame_delay_den,
+PNG_EXPORT(259, png_uint_16, png_get_next_frame_delay_den,
    (png_structp png_ptr, png_infop info_ptr));
-PNG_EXPORT(258, png_byte, png_get_next_frame_dispose_op,
+PNG_EXPORT(260, png_byte, png_get_next_frame_dispose_op,
    (png_structp png_ptr, png_infop info_ptr));
-PNG_EXPORT(259, png_byte, png_get_next_frame_blend_op,
+PNG_EXPORT(261, png_byte, png_get_next_frame_blend_op,
    (png_structp png_ptr, png_infop info_ptr));
-PNG_EXPORT(260, png_byte, png_get_first_frame_is_hidden,
+PNG_EXPORT(262, png_byte, png_get_first_frame_is_hidden,
    (png_structp png_ptr, png_infop info_ptr));
-PNG_EXPORT(261, png_uint_32, png_set_first_frame_is_hidden,
+PNG_EXPORT(263, png_uint_32, png_set_first_frame_is_hidden,
    (png_structp png_ptr, png_infop info_ptr, png_byte is_hidden));
 
 #ifdef PNG_READ_APNG_SUPPORTED
-PNG_EXPORT(262, void, png_read_frame_head, (png_structp png_ptr,
+PNG_EXPORT(264, void, png_read_frame_head, (png_structp png_ptr,
    png_infop info_ptr));
 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
-PNG_EXPORT(263, void, png_set_progressive_frame_fn, (png_structp png_ptr,
+PNG_EXPORT(265, void, png_set_progressive_frame_fn, (png_structp png_ptr,
    png_progressive_frame_ptr frame_info_fn,
    png_progressive_frame_ptr frame_end_fn));
 #endif /* PROGRESSIVE_READ */
 #endif /* READ_APNG */
 
 #ifdef PNG_WRITE_APNG_SUPPORTED
-PNG_EXPORT(264, void, png_write_frame_head, (png_structp png_ptr,
+PNG_EXPORT(266, void, png_write_frame_head, (png_structp png_ptr,
    png_infop info_ptr, png_bytepp row_pointers,
    png_uint_32 width, png_uint_32 height,
    png_uint_32 x_offset, png_uint_32 y_offset,
    png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
    png_byte blend_op));
 
-PNG_EXPORT(265, void, png_write_frame_tail, (png_structp png_ptr,
+PNG_EXPORT(267, void, png_write_frame_tail, (png_structp png_ptr,
    png_infop info_ptr));
 #endif /* WRITE_APNG */
 #endif /* APNG */
 
 /* Maintainer: Put new public prototypes here ^, in libpng.3, in project
  * defs, and in scripts/symbols.def.
  */
 
 /* The last ordinal number (this is the *last* one already used; the next
  * one to use is one more than this.)
  */
 #ifdef PNG_EXPORT_LAST_ORDINAL
 #ifdef PNG_APNG_SUPPORTED
-  PNG_EXPORT_LAST_ORDINAL(265);
+  PNG_EXPORT_LAST_ORDINAL(267);
 #else
-  PNG_EXPORT_LAST_ORDINAL(245);
+  PNG_EXPORT_LAST_ORDINAL(247);
 #endif /* APNG */
 #endif
 
 #ifdef __cplusplus
 }
 #endif
 
 #endif /* PNG_VERSION_INFO_ONLY */
--- a/media/libpng/pngconf.h
+++ b/media/libpng/pngconf.h
@@ -1,12 +1,12 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.6.29, March 16, 2017
+ * libpng version 1.6.31, July 27, 2017
  *
  * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
--- a/media/libpng/pngerror.c
+++ b/media/libpng/pngerror.c
@@ -1,13 +1,13 @@
 
 /* pngerror.c - stub functions for i/o and memory allocation
  *
- * Last changed in libpng 1.6.26 [October 20, 2016]
- * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.31 [July 27, 2017]
+ * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * This file provides a location for all error handling.  Users who
@@ -158,27 +158,27 @@ png_format_number(png_const_charp start,
                output = 1;
             }
             number /= 10;
             break;
 
          case PNG_NUMBER_FORMAT_02u:
             /* Expects at least 2 digits. */
             mincount = 2;
-            /* FALL THROUGH */
+            /* FALLTHROUGH */
 
          case PNG_NUMBER_FORMAT_u:
             *--end = digits[number % 10];
             number /= 10;
             break;
 
          case PNG_NUMBER_FORMAT_02x:
             /* This format expects at least two digits */
             mincount = 2;
-            /* FALL THROUGH */
+            /* FALLTHROUGH */
 
          case PNG_NUMBER_FORMAT_x:
             *--end = digits[number & 0xf];
             number >>= 4;
             break;
 
          default: /* an error */
             number = 0;
--- a/media/libpng/pngget.c
+++ b/media/libpng/pngget.c
@@ -768,16 +768,34 @@ png_get_sPLT(png_const_structrp png_ptr,
       *spalettes = info_ptr->splt_palettes;
       return info_ptr->splt_palettes_num;
    }
 
    return (0);
 }
 #endif
 
+#ifdef PNG_eXIf_SUPPORTED
+png_uint_32 PNGAPI
+png_get_eXIf(png_const_structrp png_ptr, png_inforp info_ptr,
+    png_bytep *exif)
+{
+   png_debug1(1, "in %s retrieval function", "eXIf");
+
+   if (png_ptr != NULL && info_ptr != NULL &&
+       (info_ptr->valid & PNG_INFO_eXIf) != 0 && exif != NULL)
+   {
+      *exif = info_ptr->exif;
+      return (PNG_INFO_eXIf);
+   }
+
+   return (0);
+}
+#endif
+
 #ifdef PNG_hIST_SUPPORTED
 png_uint_32 PNGAPI
 png_get_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
     png_uint_16p *hist)
 {
    png_debug1(1, "in %s retrieval function", "hIST");
 
    if (png_ptr != NULL && info_ptr != NULL &&
--- a/media/libpng/pnginfo.h
+++ b/media/libpng/pnginfo.h
@@ -180,16 +180,21 @@ defined(PNG_READ_BACKGROUND_SUPPORTED)
     * display or printing in "phys_unit_type" units (see PNG_RESOLUTION_
     * defines below).  Data is valid if (valid & PNG_INFO_pHYs) is non-zero.
     */
    png_uint_32 x_pixels_per_unit; /* horizontal pixel density */
    png_uint_32 y_pixels_per_unit; /* vertical pixel density */
    png_byte phys_unit_type; /* resolution type (see PNG_RESOLUTION_ below) */
 #endif
 
+#ifdef PNG_eXIf_SUPPORTED
+   int num_exif;
+   png_bytep exif;
+#endif
+
 #ifdef PNG_hIST_SUPPORTED
    /* The hIST chunk contains the relative frequency or importance of the
     * various palette entries, so that a viewer can intelligently select a
     * reduced-color palette, if required.  Data is an array of "num_palette"
     * values in the range [0,65535]. Data valid if (valid & PNG_INFO_hIST)
     * is non-zero.
     */
    png_uint_16p hist;
--- a/media/libpng/pngpriv.h
+++ b/media/libpng/pngpriv.h
@@ -1,12 +1,12 @@
 
 /* pngpriv.h - private declarations for use inside libpng
  *
- * Last changed in libpng 1.6.29 [March 16, 2017]
+ * Last changed in libpng 1.6.31 [July 27, 2017]
  * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
@@ -30,17 +30,19 @@
  * Feature Test Macros must be defined before any system header is included (see
  * POSIX 1003.1 2.8.2 "POSIX Symbols."
  *
  * These macros only have an effect if the operating system supports either
  * POSIX 1003.1 or C99, or both.  On other operating systems (particularly
  * Windows/Visual Studio) there is no effect; the OS specific tests below are
  * still required (as of 2011-05-02.)
  */
-#define _POSIX_SOURCE 1 /* Just the POSIX 1003.1 and C89 APIs */
+#ifndef _POSIX_SOURCE
+# define _POSIX_SOURCE 1 /* Just the POSIX 1003.1 and C89 APIs */
+#endif
 
 #ifndef PNG_VERSION_INFO_ONLY
 /* Standard library headers not required by png.h: */
 #  include <stdlib.h>
 #  include <string.h>
 #endif
 
 #define PNGLIB_BUILD /*libpng is being built, not used*/
@@ -447,49 +449,59 @@
 #  define png_warning_parameter_signed(p,number,format,value) ((void)0)
 #  define png_formatted_warning(pp,p,message) ((void)(pp))
 #  define PNG_WARNING_PARAMETERS(p)
 #endif
 #ifndef PNG_ERROR_TEXT_SUPPORTED
 #  define png_fixed_error(s1,s2) png_err(s1)
 #endif
 
+/* Some fixed point APIs are still required even if not exported because
+ * they get used by the corresponding floating point APIs.  This magic
+ * deals with this:
+ */
+#ifdef PNG_FIXED_POINT_SUPPORTED
+#  define PNGFAPI PNGAPI
+#else
+#  define PNGFAPI /* PRIVATE */
+#endif
+
+#ifndef PNG_VERSION_INFO_ONLY
+/* Other defines specific to compilers can go here.  Try to keep
+ * them inside an appropriate ifdef/endif pair for portability.
+ */
+
 /* C allows up-casts from (void*) to any pointer and (const void*) to any
  * pointer to a const object.  C++ regards this as a type error and requires an
  * explicit, static, cast and provides the static_cast<> rune to ensure that
  * const is not cast away.
  */
 #ifdef __cplusplus
 #  define png_voidcast(type, value) static_cast<type>(value)
 #  define png_constcast(type, value) const_cast<type>(value)
 #  define png_aligncast(type, value) \
    static_cast<type>(static_cast<void*>(value))
 #  define png_aligncastconst(type, value) \
    static_cast<type>(static_cast<const void*>(value))
 #else
 #  define png_voidcast(type, value) (value)
-#  define png_constcast(type, value) ((type)(value))
+#  ifdef _WIN64
+#     ifdef __GNUC__
+         typedef unsigned long long png_ptruint;
+#     else
+         typedef unsigned __int64 png_ptruint;
+#     endif
+#  else
+      typedef unsigned long png_ptruint;
+#  endif
+#  define png_constcast(type, value) ((type)(png_ptruint)(const void*)(value))
 #  define png_aligncast(type, value) ((void*)(value))
 #  define png_aligncastconst(type, value) ((const void*)(value))
 #endif /* __cplusplus */
 
-/* Some fixed point APIs are still required even if not exported because
- * they get used by the corresponding floating point APIs.  This magic
- * deals with this:
- */
-#ifdef PNG_FIXED_POINT_SUPPORTED
-#  define PNGFAPI PNGAPI
-#else
-#  define PNGFAPI /* PRIVATE */
-#endif
-
-#ifndef PNG_VERSION_INFO_ONLY
-/* Other defines specific to compilers can go here.  Try to keep
- * them inside an appropriate ifdef/endif pair for portability.
- */
 #if defined(PNG_FLOATING_POINT_SUPPORTED) ||\
     defined(PNG_FLOATING_ARITHMETIC_SUPPORTED)
    /* png.c requires the following ANSI-C constants if the conversion of
     * floating point to ASCII is implemented therein:
     *
     *  DBL_DIG  Maximum number of decimal digits (can be set to any constant)
     *  DBL_MIN  Smallest normalized fp number (can be set to an arbitrary value)
     *  DBL_MAX  Maximum floating point number (can be set to an arbitrary value)
@@ -829,16 +841,17 @@
  * duplicate the same definitions in application code.
  */
 #define png_IDAT PNG_U32( 73,  68,  65,  84)
 #define png_IEND PNG_U32( 73,  69,  78,  68)
 #define png_IHDR PNG_U32( 73,  72,  68,  82)
 #define png_PLTE PNG_U32( 80,  76,  84,  69)
 #define png_bKGD PNG_U32( 98,  75,  71,  68)
 #define png_cHRM PNG_U32( 99,  72,  82,  77)
+#define png_eXIf PNG_U32(101,  88,  73, 102) /* registered July 2017 */
 #define png_fRAc PNG_U32(102,  82,  65,  99) /* registered, not defined */
 #define png_gAMA PNG_U32(103,  65,  77,  65)
 #define png_gIFg PNG_U32(103,  73,  70, 103)
 #define png_gIFt PNG_U32(103,  73,  70, 116) /* deprecated */
 #define png_gIFx PNG_U32(103,  73,  70, 120)
 #define png_hIST PNG_U32(104,  73,  83,  84)
 #define png_iCCP PNG_U32(105,  67,  67,  80)
 #define png_iTXt PNG_U32(105,  84,  88, 116)
@@ -1438,16 +1451,21 @@ PNG_INTERNAL_FUNCTION(void,png_handle_bK
     png_inforp info_ptr, png_uint_32 length),PNG_EMPTY);
 #endif
 
 #ifdef PNG_READ_cHRM_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_handle_cHRM,(png_structrp png_ptr,
     png_inforp info_ptr, png_uint_32 length),PNG_EMPTY);
 #endif
 
+#ifdef PNG_READ_eXIf_SUPPORTED
+PNG_INTERNAL_FUNCTION(void,png_handle_eXIf,(png_structrp png_ptr,
+    png_inforp info_ptr, png_uint_32 length),PNG_EMPTY);
+#endif
+
 #ifdef PNG_READ_gAMA_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_handle_gAMA,(png_structrp png_ptr,
     png_inforp info_ptr, png_uint_32 length),PNG_EMPTY);
 #endif
 
 #ifdef PNG_READ_hIST_SUPPORTED
 PNG_INTERNAL_FUNCTION(void,png_handle_hIST,(png_structrp png_ptr,
     png_inforp info_ptr, png_uint_32 length),PNG_EMPTY);
--- a/media/libpng/pngread.c
+++ b/media/libpng/pngread.c
@@ -1,13 +1,13 @@
 
 /* pngread.c - read a PNG file
  *
- * Last changed in libpng 1.6.26 [October 20, 2016]
- * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.31 [July 27, 2017]
+ * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * This file contains routines that an application calls directly to
@@ -1958,17 +1958,17 @@ png_create_colormap_entry(png_image_read
          /* The linear 16-bit values must be pre-multiplied by the alpha channel
           * value, if less than 65535 (this is, effectively, composite on black
           * if the alpha channel is removed.)
           */
          switch (PNG_IMAGE_SAMPLE_CHANNELS(image->format))
          {
             case 4:
                entry[afirst ? 0 : 3] = (png_uint_16)alpha;
-               /* FALL THROUGH */
+               /* FALLTHROUGH */
 
             case 3:
                if (alpha < 65535)
                {
                   if (alpha > 0)
                   {
                      blue = (blue * alpha + 32767U)/65535U;
                      green = (green * alpha + 32767U)/65535U;
@@ -1980,17 +1980,17 @@ png_create_colormap_entry(png_image_read
                }
                entry[afirst + (2 ^ bgr)] = (png_uint_16)blue;
                entry[afirst + 1] = (png_uint_16)green;
                entry[afirst + bgr] = (png_uint_16)red;
                break;
 
             case 2:
                entry[1 ^ afirst] = (png_uint_16)alpha;
-               /* FALL THROUGH */
+               /* FALLTHROUGH */
 
             case 1:
                if (alpha < 65535)
                {
                   if (alpha > 0)
                      green = (green * alpha + 32767U)/65535U;
 
                   else
@@ -2009,24 +2009,26 @@ png_create_colormap_entry(png_image_read
          png_bytep entry = png_voidcast(png_bytep, display->colormap);
 
          entry += ip * PNG_IMAGE_SAMPLE_CHANNELS(image->format);
 
          switch (PNG_IMAGE_SAMPLE_CHANNELS(image->format))
          {
             case 4:
                entry[afirst ? 0 : 3] = (png_byte)alpha;
+               /* FALLTHROUGH */
             case 3:
                entry[afirst + (2 ^ bgr)] = (png_byte)blue;
                entry[afirst + 1] = (png_byte)green;
                entry[afirst + bgr] = (png_byte)red;
                break;
 
             case 2:
                entry[1 ^ afirst] = (png_byte)alpha;
+               /* FALLTHROUGH */
             case 1:
                entry[afirst] = (png_byte)green;
                break;
 
             default:
                break;
          }
       }
@@ -2936,17 +2938,17 @@ png_image_read_colormap(png_voidp argume
        (png_ptr->color_type & PNG_COLOR_MASK_ALPHA) == 0)
       png_set_tRNS_to_alpha(png_ptr);
 
    switch (data_encoding)
    {
       case P_sRGB:
          /* Change to 8-bit sRGB */
          png_set_alpha_mode_fixed(png_ptr, PNG_ALPHA_PNG, PNG_GAMMA_sRGB);
-         /* FALL THROUGH */
+         /* FALLTHROUGH */
 
       case P_FILE:
          if (png_ptr->bit_depth > 8)
             png_set_scale_16(png_ptr);
          break;
 
 #ifdef __GNUC__
       default:
@@ -3254,18 +3256,17 @@ png_image_read_colormapped(png_voidp arg
       case PNG_CMAP_RGB_ALPHA:
          /* Output must be 8-bit sRGB encoded RGBA */
          if (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA &&
             info_ptr->bit_depth == 8 &&
             png_ptr->screen_gamma == PNG_GAMMA_sRGB &&
             image->colormap_entries == 244 /* 216 + 1 + 27 */)
             break;
 
-         /* goto bad_output; */
-         /* FALL THROUGH */
+         goto bad_output;
 
       default:
       bad_output:
          png_error(png_ptr, "bad color-map processing (internal error)");
    }
 
    /* Now read the rows.  Do this here if it is possible to read directly into
     * the output buffer, otherwise allocate a local row buffer of the maximum
--- a/media/libpng/pngrtran.c
+++ b/media/libpng/pngrtran.c
@@ -1,12 +1,12 @@
 
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
- * Last changed in libpng 1.6.29 [March 16, 2017]
+ * Last changed in libpng 1.6.31 [July 27, 2017]
  * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -44,16 +44,17 @@ png_set_crc_action(png_structrp png_ptr,
          png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
          png_ptr->flags |= PNG_FLAG_CRC_CRITICAL_USE |
                            PNG_FLAG_CRC_CRITICAL_IGNORE;
          break;
 
       case PNG_CRC_WARN_DISCARD:    /* Not a valid action for critical data */
          png_warning(png_ptr,
              "Can't discard critical data on CRC error");
+         /* FALLTHROUGH */
       case PNG_CRC_ERROR_QUIT:                                /* Error/quit */
 
       case PNG_CRC_DEFAULT:
       default:
          png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
          break;
    }
 
@@ -1248,17 +1249,17 @@ png_init_rgb_transformations(png_structr
             case 4:
                gray *= 0x11;
                trans_gray *= 0x11;
                break;
 
             default:
 
             case 8:
-               /* FALL THROUGH (Already 8 bits) */
+               /* FALLTHROUGH */ /*  (Already 8 bits) */
 
             case 16:
                /* Already a full 16 bits */
                break;
          }
 
          png_ptr->background.red = png_ptr->background.green =
             png_ptr->background.blue = (png_uint_16)gray;
@@ -2929,17 +2930,17 @@ png_do_gray_to_rgb(png_row_infop row_inf
 }
 #endif
 
 #ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 /* Reduce RGB files to grayscale, with or without alpha
  * using the equation given in Poynton's ColorFAQ of 1998-01-04 at
  * <http://www.inforamp.net/~poynton/>  (THIS LINK IS DEAD June 2008 but
  * versions dated 1998 through November 2002 have been archived at
- * http://web.archive.org/web/20000816232553/http://www.inforamp.net/
+ * https://web.archive.org/web/20000816232553/www.inforamp.net/
  * ~poynton/notes/colour_and_gamma/ColorFAQ.txt )
  * Charles Poynton poynton at poynton.com
  *
  *     Y = 0.212671 * R + 0.715160 * G + 0.072169 * B
  *
  *  which can be expressed with integers as
  *
  *     Y = (6969 * R + 23434 * G + 2365 * B)/32768
@@ -4596,17 +4597,19 @@ png_do_expand_16(png_row_infop row_info,
        *  (input / 255) * 65535
        *
        *  Which happens to be exactly input * 257 and this can be achieved
        *  simply by byte replication in place (copying backwards).
        */
       png_byte *sp = row + row_info->rowbytes; /* source, last byte + 1 */
       png_byte *dp = sp + row_info->rowbytes;  /* destination, end + 1 */
       while (dp > sp)
-         dp[-2] = dp[-1] = *--sp, dp -= 2;
+      {
+         dp[-2] = dp[-1] = *--sp; dp -= 2;
+      }
 
       row_info->rowbytes *= 2;
       row_info->bit_depth = 16;
       row_info->pixel_depth = (png_byte)(row_info->channels * 16);
    }
 }
 #endif
 
--- a/media/libpng/pngrutil.c
+++ b/media/libpng/pngrutil.c
@@ -1,12 +1,12 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.6.29 [March 16, 2017]
+ * Last changed in libpng 1.6.31 [July 27, 2017]
  * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -2009,16 +2009,54 @@ png_handle_bKGD(png_structrp png_ptr, pn
       background.blue = png_get_uint_16(buf + 4);
       background.gray = 0;
    }
 
    png_set_bKGD(png_ptr, info_ptr, &background);
 }
 #endif
 
+#ifdef PNG_READ_eXIf_SUPPORTED
+void /* PRIVATE */
+png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
+{
+   unsigned int i;
+   png_bytep eXIf_buf;
+
+   png_debug(1, "in png_handle_eXIf");
+
+   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
+      png_chunk_error(png_ptr, "missing IHDR");
+
+   else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_eXIf) != 0)
+   {
+      png_crc_finish(png_ptr, length);
+      png_chunk_benign_error(png_ptr, "duplicate");
+      return;
+   }
+
+   eXIf_buf = png_voidcast(png_bytep,
+             png_malloc_warn(png_ptr, length));
+
+   for (i = 0; i < length; i++)
+   {
+      png_byte buf[1];
+      png_crc_read(png_ptr, buf, 1);
+      eXIf_buf[i] = buf[0];
+   }
+
+   if (png_crc_finish(png_ptr, 0) != 0)
+      return;
+
+   info_ptr->num_exif = length;
+
+   png_set_eXIf(png_ptr, info_ptr, eXIf_buf);
+}
+#endif
+
 #ifdef PNG_READ_hIST_SUPPORTED
 void /* PRIVATE */
 png_handle_hIST(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
 {
    unsigned int num, i;
    png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
 
    png_debug(1, "in png_handle_hIST");
@@ -2537,16 +2575,19 @@ png_handle_zTXt(png_structrp png_ptr, pn
 #endif
 
    if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
       png_chunk_error(png_ptr, "missing IHDR");
 
    if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
       png_ptr->mode |= PNG_AFTER_IDAT;
 
+   /* Note, "length" is sufficient here; we won't be adding
+    * a null terminator later.
+    */
    buffer = png_read_buffer(png_ptr, length, 2/*silent*/);
 
    if (buffer == NULL)
    {
       png_crc_finish(png_ptr, length);
       png_chunk_benign_error(png_ptr, "out of memory");
       return;
    }
@@ -3149,26 +3190,26 @@ png_handle_unknown(png_structrp png_ptr,
        PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
    {
 #     ifdef PNG_USER_LIMITS_SUPPORTED
       switch (png_ptr->user_chunk_cache_max)
       {
          case 2:
             png_ptr->user_chunk_cache_max = 1;
             png_chunk_benign_error(png_ptr, "no space in chunk cache");
-            /* FALL THROUGH */
+            /* FALLTHROUGH */
          case 1:
             /* NOTE: prior to 1.6.0 this case resulted in an unknown critical
              * chunk being skipped, now there will be a hard error below.
              */
             break;
 
          default: /* not at limit */
             --(png_ptr->user_chunk_cache_max);
-            /* FALL THROUGH */
+            /* FALLTHROUGH */
          case 0: /* no limit */
 #  endif /* USER_LIMITS */
             /* Here when the limit isn't reached or when limits are compiled
              * out; store the chunk.
              */
             png_set_unknown_chunks(png_ptr, info_ptr,
                 &png_ptr->unknown_chunk, 1);
             handled = 1;
@@ -3551,17 +3592,17 @@ png_combine_row(png_const_structrp png_p
                }
 
             case 2:
                /* There is a possibility of a partial copy at the end here; this
                 * slows the code down somewhat.
                 */
                do
                {
-                  dp[0] = sp[0], dp[1] = sp[1];
+                  dp[0] = sp[0]; dp[1] = sp[1];
 
                   if (row_width <= bytes_to_jump)
                      return;
 
                   sp += bytes_to_jump;
                   dp += bytes_to_jump;
                   row_width -= bytes_to_jump;
                }
@@ -3572,17 +3613,17 @@ png_combine_row(png_const_structrp png_p
                return;
 
             case 3:
                /* This can only be the RGB case, so each copy is exactly one
                 * pixel and it is not necessary to check for a partial copy.
                 */
                for (;;)
                {
-                  dp[0] = sp[0], dp[1] = sp[1], dp[2] = sp[2];
+                  dp[0] = sp[0]; dp[1] = sp[1]; dp[2] = sp[2];
 
                   if (row_width <= bytes_to_jump)
                      return;
 
                   sp += bytes_to_jump;
                   dp += bytes_to_jump;
                   row_width -= bytes_to_jump;
                }
@@ -4061,17 +4102,20 @@ png_read_filter_row_paeth_1byte_pixel(pn
       pa = p < 0 ? -p : p;
       pb = pc < 0 ? -pc : pc;
       pc = (p + pc) < 0 ? -(p + pc) : p + pc;
 #endif
 
       /* Find the best predictor, the least of pa, pb, pc favoring the earlier
        * ones in the case of a tie.
        */
-      if (pb < pa) pa = pb, a = b;
+      if (pb < pa)
+      {
+         pa = pb; a = b;
+      }
       if (pc < pa) a = c;
 
       /* Calculate the current pixel in a, and move the previous row pixel to c
        * for the next time round the loop
        */
       c = b;
       a += *row;
       *row++ = (png_byte)a;
@@ -4113,17 +4157,20 @@ png_read_filter_row_paeth_multibyte_pixe
       pb = abs(pc);
       pc = abs(p + pc);
 #else
       pa = p < 0 ? -p : p;
       pb = pc < 0 ? -pc : pc;
       pc = (p + pc) < 0 ? -(p + pc) : p + pc;
 #endif
 
-      if (pb < pa) pa = pb, a = b;
+      if (pb < pa)
+      {
+         pa = pb; a = b;
+      }
       if (pc < pa) a = c;
 
       a += *row;
       *row++ = (png_byte)a;
    }
 }
 
 static void
--- a/media/libpng/pngset.c
+++ b/media/libpng/pngset.c
@@ -1,13 +1,13 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.6.26 [October 20, 2016]
- * Copyright (c) 1998-2016 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.30 [June 28, 2017]
+ * Copyright (c) 1998-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * The functions here are used during reads to store data from the file
@@ -129,16 +129,49 @@ png_set_cHRM_XYZ(png_const_structrp png_
        png_fixed(png_ptr, blue_X, "cHRM Blue X"),
        png_fixed(png_ptr, blue_Y, "cHRM Blue Y"),
        png_fixed(png_ptr, blue_Z, "cHRM Blue Z"));
 }
 #  endif /* FLOATING_POINT */
 
 #endif /* cHRM */
 
+#ifdef PNG_eXIf_SUPPORTED
+void PNGAPI
+png_set_eXIf(png_const_structrp png_ptr, png_inforp info_ptr,
+    const png_bytep eXIf_buf)
+{
+   int i;
+
+   png_debug1(1, "in %s storage function", "eXIf");
+
+   if (png_ptr == NULL || info_ptr == NULL)
+      return;
+
+   png_free_data(png_ptr, info_ptr, PNG_FREE_EXIF, 0);
+
+   info_ptr->exif = png_voidcast(png_bytep, png_malloc_warn(png_ptr,
+       info_ptr->num_exif));
+
+   if (info_ptr->exif == NULL)
+   {
+      png_warning(png_ptr, "Insufficient memory for eXIf chunk data");
+
+      return;
+   }
+
+   info_ptr->free_me |= PNG_FREE_EXIF;
+
+   for (i = 0; i < info_ptr->num_exif; i++)
+      info_ptr->exif[i] = eXIf_buf[i];
+
+   info_ptr->valid |= PNG_INFO_eXIf;
+}
+#endif /* eXIf */
+
 #ifdef PNG_gAMA_SUPPORTED
 void PNGFAPI
 png_set_gAMA_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
     png_fixed_point file_gamma)
 {
    png_debug1(1, "in %s storage function", "gAMA");
 
    if (png_ptr == NULL || info_ptr == NULL)
@@ -1102,18 +1135,19 @@ png_set_sPLT(png_const_structrp png_ptr,
           (unsigned int)entries->nentries * sizeof (png_sPLT_entry));
 
       /* Note that 'continue' skips the advance of the out pointer and out
        * count, so an invalid entry is not added.
        */
       info_ptr->valid |= PNG_INFO_sPLT;
       ++(info_ptr->splt_palettes_num);
       ++np;
+      ++entries;
    }
-   while (++entries, --nentries);
+   while (--nentries);
 
    if (nentries > 0)
       png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
 }
 #endif /* sPLT */
 
 #ifdef PNG_APNG_SUPPORTED
 png_uint_32 PNGAPI
@@ -1836,37 +1870,39 @@ png_check_keyword(png_structrp png_ptr, 
       return 0;
    }
 
    while (*key && key_len < 79)
    {
       png_byte ch = (png_byte)*key++;
 
       if ((ch > 32 && ch <= 126) || (ch >= 161 /*&& ch <= 255*/))
-         *new_key++ = ch, ++key_len, space = 0;
+      {
+         *new_key++ = ch; ++key_len; space = 0;
+      }
 
       else if (space == 0)
       {
          /* A space or an invalid character when one wasn't seen immediately
           * before; output just a space.
           */
-         *new_key++ = 32, ++key_len, space = 1;
+         *new_key++ = 32; ++key_len; space = 1;
 
          /* If the character was not a space then it is invalid. */
          if (ch != 32)
             bad_character = ch;
       }
 
       else if (bad_character == 0)
          bad_character = ch; /* just skip it, record the first error */
    }
 
    if (key_len > 0 && space != 0) /* trailing space */
    {
-      --key_len, --new_key;
+      --key_len; --new_key;
       if (bad_character == 0)
          bad_character = 32;
    }
 
    /* Terminate the keyword */
    *new_key = 0;
 
    if (key_len == 0)
--- a/media/libpng/pngstruct.h
+++ b/media/libpng/pngstruct.h
@@ -495,10 +495,13 @@ struct png_struct_def
    void (*read_filter[PNG_FILTER_VALUE_LAST-1])(png_row_infop row_info,
       png_bytep row, png_const_bytep prev_row);
 
 #ifdef PNG_READ_SUPPORTED
 #if defined(PNG_COLORSPACE_SUPPORTED) || defined(PNG_GAMMA_SUPPORTED)
    png_colorspace   colorspace;
 #endif
 #endif
+
+/* New member added in libpng-1.6.31 */
+   int num_exif;
 };
 #endif /* PNGSTRUCT_H */
--- a/media/libpng/pngtrans.c
+++ b/media/libpng/pngtrans.c
@@ -1,13 +1,13 @@
 
 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
  *
- * Last changed in libpng 1.6.26 [October 20, 2016]
- * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.30 [June 28, 2017]
+ * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -509,34 +509,42 @@ png_do_strip_channel(png_row_infop row_i
    /* GA, GX, XG cases */
    if (row_info->channels == 2)
    {
       if (row_info->bit_depth == 8)
       {
          if (at_start != 0) /* Skip initial filler */
             ++sp;
          else          /* Skip initial channel and, for sp, the filler */
-            sp += 2, ++dp;
+         {
+            sp += 2; ++dp;
+         }
 
          /* For a 1 pixel wide image there is nothing to do */
          while (sp < ep)
-            *dp++ = *sp, sp += 2;
+         {
+            *dp++ = *sp; sp += 2;
+         }
 
          row_info->pixel_depth = 8;
       }
 
       else if (row_info->bit_depth == 16)
       {
          if (at_start != 0) /* Skip initial filler */
             sp += 2;
          else          /* Skip initial channel and, for sp, the filler */
-            sp += 4, dp += 2;
+         {
+            sp += 4; dp += 2;
+         }
 
          while (sp < ep)
-            *dp++ = *sp++, *dp++ = *sp, sp += 3;
+         {
+            *dp++ = *sp++; *dp++ = *sp; sp += 3;
+         }
 
          row_info->pixel_depth = 16;
       }
 
       else
          return; /* bad bit depth */
 
       row_info->channels = 1;
@@ -549,38 +557,44 @@ png_do_strip_channel(png_row_infop row_i
    /* RGBA, RGBX, XRGB cases */
    else if (row_info->channels == 4)
    {
       if (row_info->bit_depth == 8)
       {
          if (at_start != 0) /* Skip initial filler */
             ++sp;
          else          /* Skip initial channels and, for sp, the filler */
-            sp += 4, dp += 3;
+         {
+            sp += 4; dp += 3;
+         }
 
          /* Note that the loop adds 3 to dp and 4 to sp each time. */
          while (sp < ep)
-            *dp++ = *sp++, *dp++ = *sp++, *dp++ = *sp, sp += 2;
+         {
+            *dp++ = *sp++; *dp++ = *sp++; *dp++ = *sp; sp += 2;
+         }
 
          row_info->pixel_depth = 24;
       }
 
       else if (row_info->bit_depth == 16)
       {
          if (at_start != 0) /* Skip initial filler */
             sp += 2;
          else          /* Skip initial channels and, for sp, the filler */
-            sp += 8, dp += 6;
+         {
+            sp += 8; dp += 6;
+         }
 
          while (sp < ep)
          {
             /* Copy 6 bytes, skip 2 */
-            *dp++ = *sp++, *dp++ = *sp++;
-            *dp++ = *sp++, *dp++ = *sp++;
-            *dp++ = *sp++, *dp++ = *sp, sp += 3;
+            *dp++ = *sp++; *dp++ = *sp++;
+            *dp++ = *sp++; *dp++ = *sp++;
+            *dp++ = *sp++; *dp++ = *sp; sp += 3;
          }
 
          row_info->pixel_depth = 48;
       }
 
       else
          return; /* bad bit depth */
 
--- a/media/libpng/pngwrite.c
+++ b/media/libpng/pngwrite.c
@@ -1,13 +1,13 @@
 
 /* pngwrite.c - general routines to write a PNG file
  *
- * Last changed in libpng 1.6.26 [October 20, 2016]
- * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.31 [July 27, 2017]
+ * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -1011,18 +1011,18 @@ png_set_filter(png_structrp png_ptr, int
    if (method == PNG_FILTER_TYPE_BASE)
    {
       switch (filters & (PNG_ALL_FILTERS | 0x07))
       {
 #ifdef PNG_WRITE_FILTER_SUPPORTED
          case 5:
          case 6:
          case 7: png_app_error(png_ptr, "Unknown row filter for method 0");
-            /* FALL THROUGH */
 #endif /* WRITE_FILTER */
+            /* FALLTHROUGH */
          case PNG_FILTER_VALUE_NONE:
             png_ptr->do_filter = PNG_FILTER_NONE; break;
 
 #ifdef PNG_WRITE_FILTER_SUPPORTED
          case PNG_FILTER_VALUE_SUB:
             png_ptr->do_filter = PNG_FILTER_SUB; break;
 
          case PNG_FILTER_VALUE_UP:
@@ -1879,28 +1879,28 @@ png_image_set_PLTE(png_image_write_contr
          entry += (unsigned int)i * channels;
 
          switch (channels)
          {
             case 4:
                tRNS[i] = entry[afirst ? 0 : 3];
                if (tRNS[i] < 255)
                   num_trans = i+1;
-               /* FALL THROUGH */
+               /* FALLTHROUGH */
             case 3:
                palette[i].blue = entry[afirst + (2 ^ bgr)];
                palette[i].green = entry[afirst + 1];
                palette[i].red = entry[afirst + bgr];
                break;
 
             case 2:
                tRNS[i] = entry[1 ^ afirst];
                if (tRNS[i] < 255)
                   num_trans = i+1;
-               /* FALL THROUGH */
+               /* FALLTHROUGH */
             case 1:
                palette[i].blue = palette[i].red = palette[i].green =
                   entry[afirst];
                break;
 
             default:
                break;
          }
--- a/media/libpng/pngwutil.c
+++ b/media/libpng/pngwutil.c
@@ -1003,23 +1003,26 @@ png_compress_IDAT(png_structrp png_ptr, 
           * first IDAT may need deflate header optimization.
           */
 #ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
             if ((png_ptr->mode & PNG_HAVE_IDAT) == 0 &&
                 png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE)
                optimize_cmf(data, png_image_size(png_ptr));
 #endif
 
+         if (size > 0)
 #ifdef PNG_WRITE_APNG_SUPPORTED
-         if (png_ptr->num_frames_written == 0)
+         {
+            if (png_ptr->num_frames_written == 0)
 #endif
-         png_write_complete_chunk(png_ptr, png_IDAT, data, size);
+            png_write_complete_chunk(png_ptr, png_IDAT, data, size);
 #ifdef PNG_WRITE_APNG_SUPPORTED
-         else
-            png_write_fdAT(png_ptr, data, size);
+            else
+               png_write_fdAT(png_ptr, data, size);
+         }
 #endif /* WRITE_APNG */
 
          png_ptr->mode |= PNG_HAVE_IDAT;
 
          png_ptr->zstream.next_out = data;
          png_ptr->zstream.avail_out = size;
 
          /* For SYNC_FLUSH or FINISH it is essential to keep calling zlib with
@@ -1057,23 +1060,26 @@ png_compress_IDAT(png_structrp png_ptr, 
          uInt size = png_ptr->zbuffer_size - png_ptr->zstream.avail_out;
 
 #ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
          if ((png_ptr->mode & PNG_HAVE_IDAT) == 0 &&
              png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE)
             optimize_cmf(data, png_image_size(png_ptr));
 #endif
 
+         if (size > 0)
 #ifdef PNG_WRITE_APNG_SUPPORTED
-         if (png_ptr->num_frames_written == 0)
+         {
+            if (png_ptr->num_frames_written == 0)
 #endif
-         png_write_complete_chunk(png_ptr, png_IDAT, data, size);
+            png_write_complete_chunk(png_ptr, png_IDAT, data, size);
 #ifdef PNG_WRITE_APNG_SUPPORTED
-         else
-            png_write_fdAT(png_ptr, data, size);
+            else
+               png_write_fdAT(png_ptr, data, size);
+         }
 #endif /* WRITE_APNG */
 
          png_ptr->zstream.avail_out = 0;
          png_ptr->zstream.next_out = NULL;
          png_ptr->mode |= PNG_HAVE_IDAT | PNG_AFTER_IDAT;
 
          png_ptr->zowner = 0; /* Release the stream */
          return;
@@ -1487,16 +1493,47 @@ png_write_bKGD(png_structrp png_ptr, png
       }
 
       png_save_uint_16(buf, back->gray);
       png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)2);
    }
 }
 #endif
 
+#ifdef PNG_WRITE_eXIf_SUPPORTED
+/* Write the Exif data */
+void /* PRIVATE */
+png_write_eXIf(png_structrp png_ptr, png_bytep exif, int num_exif)
+{
+   int i;
+   png_byte buf[3];
+
+   png_debug(1, "in png_write_eXIf");
+
+   if (num_exif > (int)png_ptr->num_exif)
+   {
+      png_debug2(3, "num_exif = %d, png_ptr->num_exif = %d", num_exif,
+          png_ptr->num_exif);
+
+      png_warning(png_ptr, "Invalid number of exif bytes specified");
+      return;
+   }
+
+   png_write_chunk_header(png_ptr, png_eXIf, (png_uint_32)(num_exif));
+
+   for (i = 0; i < num_exif; i++)
+   {
+      buf[i] = exif[i];
+      png_write_chunk_data(png_ptr, buf, (png_size_t)1);
+   }
+
+   png_write_chunk_end(png_ptr);
+}
+#endif
+
 #ifdef PNG_WRITE_hIST_SUPPORTED
 /* Write the histogram */
 void /* PRIVATE */
 png_write_hIST(png_structrp png_ptr, png_const_uint_16p hist, int num_hist)
 {
    int i;
    png_byte buf[3];
 
deleted file mode 100644
deleted file mode 100644
--- a/old-configure.in
+++ b/old-configure.in
@@ -41,17 +41,17 @@ dnl ====================================
 _SUBDIR_HOST_CFLAGS="$HOST_CFLAGS"
 _SUBDIR_HOST_CXXFLAGS="$HOST_CXXFLAGS"
 _SUBDIR_HOST_LDFLAGS="$HOST_LDFLAGS"
 _SUBDIR_CONFIG_ARGS="$ac_configure_args"
 
 dnl Set the version number of the libs included with mozilla
 dnl ========================================================
 MOZJPEG=62
-MOZPNG=10629
+MOZPNG=10631
 NSPR_VERSION=4
 NSPR_MINVER=4.16
 NSS_VERSION=3
 
 dnl Set the minimum version of toolkit libs used by mozilla
 dnl ========================================================
 GLIB_VERSION=2.22
 # 2_26 is the earliest version we can set GLIB_VERSION_MIN_REQUIRED.