Bug 980488 - Update in-tree libpng to version 1.6.10. r=jrmuizel
authorGlenn Randers-Pehrson <glennrp+bmo@gmail.com>
Mon, 24 Mar 2014 16:36:11 -0400
changeset 194666 5f91b2fc681250572075a4ed7871bfac7ab20abf
parent 194665 74fa10a83ce8aa95112def87d5cc9769d3d52985
child 194667 47f3d3a56f03a2c0a2702494443a0586dd6004e6
push id486
push userasasaki@mozilla.com
push dateMon, 14 Jul 2014 18:39:42 +0000
treeherdermozilla-release@d33428174ff1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjrmuizel
bugs980488
milestone31.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 980488 - Update in-tree libpng to version 1.6.10. r=jrmuizel
configure.in
media/libpng/CHANGES
media/libpng/LICENSE
media/libpng/MOZCHANGES
media/libpng/README
media/libpng/apng.patch
media/libpng/arm/MOZ_PNG_cpu-features.c
media/libpng/arm/MOZ_PNG_cpu-features.h
media/libpng/arm/arm_init.c
media/libpng/arm/linux.c
media/libpng/moz.build
media/libpng/mozpngconf.h
media/libpng/png.c
media/libpng/png.h
media/libpng/pngconf.h
media/libpng/pngerror.c
media/libpng/pngpread.c
media/libpng/pngpriv.h
media/libpng/pngread.c
media/libpng/pngrtran.c
media/libpng/pngrutil.c
media/libpng/pngwrite.c
media/libpng/pngwutil.c
--- a/configure.in
+++ b/configure.in
@@ -46,17 +46,17 @@ dnl ====================================
 _SUBDIR_HOST_CFLAGS="$HOST_CFLAGS"
 _SUBDIR_HOST_CXXFLAGS="$HOST_CXXFLAGS"
 _SUBDIR_HOST_LDFLAGS="$HOST_LDFLAGS"
 _SUBDIR_CONFIG_ARGS="$ac_configure_args"
 
 dnl Set the version number of the libs included with mozilla
 dnl ========================================================
 MOZJPEG=62
-MOZPNG=10609
+MOZPNG=10610
 NSPR_VERSION=4
 NSS_VERSION=3
 
 dnl Set the minimum version of toolkit libs used by mozilla
 dnl ========================================================
 GLIB_VERSION=1.2.0
 PERL_VERSION=5.006
 CAIRO_VERSION=1.10
--- a/media/libpng/CHANGES
+++ b/media/libpng/CHANGES
@@ -4749,17 +4749,17 @@ Version 1.6.8rc02 [December 14, 2013]
     Libpng-1.6.0 and earlier do not have this bug.
 
 Version 1.6.8 [December 19, 2013]
   No changes.
 
 Version 1.6.9beta01 [December 26, 2013]
   Bookkeeping: Moved functions around (no changes). Moved transform
     function definitions before the place where they are called so that
-    they can be masde static. Move the intrapixel functions and the
+    they can be made static. Move the intrapixel functions and the
     grayscale palette builder out of the png?tran.c files. The latter
     isn't a transform function and is no longer used internally, and the
     former MNG specific functions are better placed in pngread/pngwrite.c
   Made transform implementation functions static. This makes the internal
     functions called by png_do_{read|write}_transformations static. On an
     x86-64 DLL build (Gentoo Linux) this reduces the size of the text
     segment of the DLL by 1208 bytes, about 0.6%. It also simplifies
     maintenance by removing the declarations from pngpriv.h and allowing
@@ -4795,16 +4795,90 @@ Version 1.6.9beta04 [January 20, 2014]
 Version 1.6.9rc01 [January 28, 2014]
   No changes.
 
 Version 1.6.9rc02 [January 30, 2014]
   Quiet an uninitialized memory warning from VC2013 in png_get_png().
 
 Version 1.6.9 [February 6, 2014]
 
+Version 1.6.10beta01 [February 9, 2014]
+  Backported changes from libpng-1.7.0beta30 and beta31:
+  Fixed a large number of instances where PNGCBAPI was omitted from
+    function definitions.
+  Added pngimage test program for png_read_png() and png_write_png()
+    with two new test scripts.
+  Removed dependence on !PNG_READ_EXPAND_SUPPORTED for calling
+    png_set_packing() in png_read_png().
+  Fixed combination of ~alpha with shift. On read invert alpha, processing
+    occurred after shift processing, which causes the final values to be
+    outside the range that should be produced by the shift. Reversing the
+    order on read makes the two transforms work together correctly and mirrors
+    the order used on write.
+  Do not read invalid sBIT chunks. Previously libpng only checked sBIT
+    values on write, so a malicious PNG writer could therefore cause
+    the read code to return an invalid sBIT chunk, which might lead to
+    application errors or crashes.  Such chunks are now skipped (with
+    chunk_benign_error).
+  Make png_read_png() and png_write_png() prototypes in png.h depend
+    upon PNG_READ_SUPPORTED and PNG_WRITE_SUPPORTED.
+  Support builds with unsupported PNG_TRANSFORM_* values.  All of the
+    PNG_TRANSFORM_* values are always defined in png.h and, because they
+    are used for both read and write in some cases, it is not reliable
+    to #if out ones that are totally unsupported. This change adds error
+    detection in png_read_image() and png_write_image() to do a
+    png_app_error() if the app requests something that cannot be done
+    and it adds corresponding code to pngimage.c to handle such options
+    by not attempting to test them.
+
+Version 1.6.10beta02 [February 23, 2014]
+  Moved redefines of png_error(), png_warning(), png_chunk_error(),
+    and png_chunk_warning() from pngpriv.h to png.h to make them visible
+    to libpng-calling applications.
+  Moved OS dependent code from arm/arm_init.c, to allow the included
+    implementation of the ARM NEON discovery function to be set at
+    build-time and provide sample implementations from the current code in the
+    contrib/arm-neon subdirectory. The __linux__ code has also been changed to
+    compile and link on Android by using /proc/cpuinfo, and the old linux code
+    is in contrib/arm-neon/linux-auxv.c.  The new code avoids POSIX and Linux
+    dependencies apart from opening /proc/cpuinfo and is C90 compliant.
+  Check for info_ptr == NULL early in png_read_end() so we don't need to
+    run all the png_handle_*() and depend on them to return if info_ptr == NULL.
+    This improves the performance of png_read_end(png_ptr, NULL) and makes
+    it more robust against future programming errors.
+  Check for __has_extension before using it in pngconf.h, to
+    support older Clang versions (Jeremy Sequoia).
+  Treat CRC error handling with png_set_crc_action(), instead of with
+    png_set_benign_errors(), which has been the case since libpng-1.6.0beta18.
+  Use a user warning handler in contrib/gregbook/readpng2.c instead of default,
+    so warnings will be put on stderr even if libpng has CONSOLE_IO disabled.
+  Added png_ptr->process_mode = PNG_READ_IDAT_MODE in png_push_read_chunk
+    after recognizing the IDAT chunk, which avoids an infinite loop while
+    reading a datastream whose first IDAT chunk is of zero-length.
+    This fixes CERT VU#684412 and CVE-2014-0333.
+  Don't recognize known sRGB profiles as sRGB if they have been hacked,
+    but don't reject them and don't issue a copyright violation warning.
+
+Version 1.6.10beta03 [February 25, 2014]
+  Moved some documentation from png.h to libpng.3 and libpng-manual.txt
+  Minor editing of contrib/arm-neon/README and contrib/examples/*.c
+
+Version 1.6.10rc01 [February 27, 2014]
+  Fixed typos in the manual and in scripts/pnglibconf.dfa (CFLAGS -> CPPFLAGS
+    and PNG_USR_CONFIG -> PNG_USER_CONFIG).
+
+Version 1.6.10rc02 [February 28, 2014]
+  Removed unreachable return statement after png_chunk_error()
+    in pngrutil.c
+
+Version 1.6.10rc03 [March 4, 2014]
+  Un-deprecated png_data_freer().
+
+Version 1.6.10 [March 6, 2014]
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
 to subscribe)
 or to glennrp at users.sourceforge.net
 
 Glenn R-P
 #endif
--- a/media/libpng/LICENSE
+++ b/media/libpng/LICENSE
@@ -5,17 +5,17 @@ included in the libpng distribution, the
 
 COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
 
 If you modify libpng you may insert additional notices immediately following
 this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.2.6, August 15, 2004, through 1.6.9, February 6, 2014, are
+libpng versions 1.2.6, August 15, 2004, through 1.6.10, March 6, 2014, are
 Copyright (c) 2004, 2006-2014 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
 
    Cosmin Truta
 
 libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are
 Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are
@@ -103,9 +103,9 @@ boxes and the like:
 Also, the PNG logo (in PNG format, of course) is supplied in the
 files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31).
 
 Libpng is OSI Certified Open Source Software.  OSI Certified Open Source is a
 certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-February 6, 2014
+March 6, 2014
--- a/media/libpng/MOZCHANGES
+++ b/media/libpng/MOZCHANGES
@@ -1,26 +1,36 @@
 
-Changes made to pristine png source by mozilla.org developers.
+Changes made to pristine libpng source by mozilla.org developers.
+
+2014/03/21  -- Synced with libpng-1.6.10 (bug #980488) and disabled
+               PNG_WARNINGS and PNG_ERROR_TEXT in non-debug builds.
+               Limit image dimensions to 32767 (bug #251381, #591822,
+               and #967656).
+
+2014/03/04  -- Enabled PNG_WARNINGS and other stuff in mozpngconf.h
+               as part of enabling Freetype2 with PNG (bug #969814).
+
+2014/03/03  -- Fixed hang with empty IDAT (bug #974825).
 
 2014/02/18  -- Exposed png_error(), etc. redefinitions to applications
                (moved them from pngpriv.h to png.h).
 
 2014/02/18  -- Disabled PNG_FIXED_POINT_SUPPORTED in mozpngconf.h (we
                don't need both FIXED and FLOATING_POINT support).
 
 2014/02/15  -- Synced with libpng-1.6.9 (bug #952505).
 
-2014/02/11  -- Fixed crash with empty PLTE, CVE-2013-6954 (bug #945912)
+2014/02/11  -- Fixed crash with empty PLTE, CVE-2013-6954 (bug #945912).
 
 2013/12/11  -- Enable ARM support (bug #832390).
 
 2013/11/17  -- Synced with libpng-1.6.7 (bug #938740).
 
-2013/09/21  -- Synced with libpng-1.6.6 (bug #886499).
+2013/09/21  -- Synced with libpng-1.6.6 (bug #841734).
 
 2013/07/17  -- Synced with libpng-1.5.17 (bug #886499).
 
 2013/06/06  -- Synced with libpng-1.5.16 (bug #873001).
 
 2013/04/11  -- Synced with libpng-1.5.15 (bug #858578).
 
 2013/01/24  -- Synced with libpng-1.5.14 (bug #832487).
@@ -61,26 +71,26 @@ 2009/02/19  -- Synced with libpng-1.2.35
 2008/08/21  -- Synced with libpng-1.2.31 (bug #418900).
 
 2008/03/29  -- Initialize prev_row for each APNG frame, only when
                the frame size increases (bug #420416).
 
 2008/01/18  -- Synced with libpng-1.2.24 (bug #408429).
 
 2007/11/13  -- Synced with libpng-1.2.23; Removed pnggccrd.c and pngvcrd.c;
-               Reduced footprint by removing error and warning text
-               (bug #403239)
+               Reduced footprint by removing error and warning text in
+               non-debug builds via settings in mozpngconf.h (bug #403239).
 
-2007/11/06  -- Synced with libpng-1.2.22 (removes MMX support) (bug #386585)
+2007/11/06  -- Synced with libpng-1.2.22 (removes MMX support) (bug #386585).
 
-2007/07/27  -- Enabled cHRM and iCCP chunks for color management (bug #16769)
+2007/07/27  -- Enabled cHRM and iCCP chunks for color management (bug #16769).
 
-2007/05/05  -- Zeroed png_ptr->num_trans on CRC error (bug #374810)
+2007/05/05  -- Zeroed png_ptr->num_trans on CRC error (bug #374810).
 
-2007/04/19  -- Synced with libpng-1.2.16 tree (bug #373249)
+2007/04/19  -- Synced with libpng-1.2.16 tree (bug #373249).
 
-2007/03/20  -- Added support for APNG (bug #257197)
+2007/03/20  -- Added support for APNG (bug #257197).
 
-2006/06/27  -- Synced with libpng-1.2.12 tree (bug #334110)
+2006/06/27  -- Synced with libpng-1.2.12 tree (bug #334110).
 
-2004/10/07  -- Synced with libpng-1.2.7 tree (bug #261922)
+2004/10/07  -- Synced with libpng-1.2.7 tree (bug #261922).
 
-2004/10/07  -- Added mozpngconf.h (bug #208607)
+2004/10/07  -- Added mozpngconf.h (bug #208607).
--- a/media/libpng/README
+++ b/media/libpng/README
@@ -1,9 +1,9 @@
-README for libpng version 1.6.9 - February 6, 2014 (shared library 16.0)
+README for libpng version 1.6.10 - March 6, 2014 (shared library 16.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
 
 Libpng comes in several distribution formats.  Get libpng-*.tar.gz or
 libpng-*.tar.xz or if you want UNIX-style line endings in the text files,
 or lpng*.7z or lpng*.zip if you want DOS-style line endings.
 
--- a/media/libpng/apng.patch
+++ b/media/libpng/apng.patch
@@ -273,28 +273,28 @@ Index: pngget.c
 +    return 0;
 +}
 +#endif /* PNG_APNG_SUPPORTED */
  #endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */
 Index: png.h
 ===================================================================
 --- png.h
 +++ png.h
-@@ -454,6 +454,10 @@
+@@ -457,6 +457,10 @@
  #   include "pnglibconf.h"
  #endif
  
 +#define PNG_APNG_SUPPORTED
 +#define PNG_READ_APNG_SUPPORTED
 +#define PNG_WRITE_APNG_SUPPORTED
 +
  #ifndef PNG_VERSION_INFO_ONLY
     /* Machine specific configuration. */
  #  include "pngconf.h"
-@@ -544,6 +548,17 @@
+@@ -547,6 +551,17 @@
   * See pngconf.h for base types that vary by machine/system
   */
  
 +#ifdef PNG_APNG_SUPPORTED
 +/* dispose_op flags from inside fcTL */
 +#define PNG_DISPOSE_OP_NONE        0x00
 +#define PNG_DISPOSE_OP_BACKGROUND  0x01
 +#define PNG_DISPOSE_OP_PREVIOUS    0x02
@@ -302,39 +302,39 @@ Index: png.h
 +/* blend_op flags from inside fcTL */
 +#define PNG_BLEND_OP_SOURCE        0x00
 +#define PNG_BLEND_OP_OVER          0x01
 +#endif /* PNG_APNG_SUPPORTED */
 +
  /* This triggers a compiler error in png.c, if png.c and png.h
   * do not agree upon the version number.
   */
-@@ -864,6 +879,10 @@
+@@ -867,6 +882,10 @@
  #define PNG_INFO_sPLT 0x2000   /* ESR, 1.0.6 */
  #define PNG_INFO_sCAL 0x4000   /* ESR, 1.0.6 */
  #define PNG_INFO_IDAT 0x8000   /* ESR, 1.0.6 */
 +#ifdef PNG_APNG_SUPPORTED
 +#define PNG_INFO_acTL 0x10000
 +#define PNG_INFO_fcTL 0x20000
 +#endif
  
  /* This is used for the transformation routines, as some of them
   * change these values for the row.  It also should enable using
-@@ -901,6 +920,10 @@
+@@ -904,6 +923,10 @@
  #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
  typedef PNG_CALLBACK(void, *png_progressive_info_ptr, (png_structp, png_infop));
  typedef PNG_CALLBACK(void, *png_progressive_end_ptr, (png_structp, png_infop));
 +#ifdef PNG_APNG_SUPPORTED
 +typedef PNG_CALLBACK(void, *png_progressive_frame_ptr, (png_structp,
 +    png_uint_32));
 +#endif
  
  /* The following callback receives png_uint_32 row_number, int pass for the
   * png_bytep data of the row.  When transforming an interlaced image the
-@@ -3304,6 +3327,75 @@
+@@ -3241,6 +3264,75 @@
   *  END OF HARDWARE OPTIONS
   ******************************************************************************/
  
 +#ifdef PNG_APNG_SUPPORTED
 +PNG_EXPORT(245, png_uint_32, png_get_acTL, (png_structp png_ptr,
 +   png_infop info_ptr, png_uint_32 *num_frames, png_uint_32 *num_plays));
 +
 +PNG_EXPORT(246, png_uint_32, png_set_acTL, (png_structp png_ptr,
@@ -400,61 +400,61 @@ Index: png.h
 +PNG_EXPORT(264, void, png_write_frame_tail, (png_structp png_ptr,
 +   png_infop info_ptr));
 +#endif /* PNG_WRITE_APNG_SUPPORTED */
 +#endif /* PNG_APNG_SUPPORTED */
 +
  /* Maintainer: Put new public prototypes here ^, in libpng.3, and project
   * defs, scripts/pnglibconf.h, and scripts/pnglibconf.h.prebuilt
   */
-@@ -3313,7 +3405,11 @@
+@@ -3250,7 +3342,11 @@
   * scripts/symbols.def as well.
   */
  #ifdef PNG_EXPORT_LAST_ORDINAL
 +#ifdef PNG_APNG_SUPPORTED
 +  PNG_EXPORT_LAST_ORDINAL(264);
 +#else
    PNG_EXPORT_LAST_ORDINAL(244);
 +#endif /* PNG_APNG_SUPPORTED */
  #endif
  
  #ifdef __cplusplus
 Index: pngpriv.h
 ===================================================================
 --- pngpriv.h
 +++ pngpriv.h
-@@ -550,6 +550,10 @@
+@@ -551,6 +551,10 @@
  #define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000 /* Have another chunk after IDAT */
                     /*             0x4000 (unused) */
  #define PNG_IS_READ_STRUCT        0x8000 /* Else is a write struct */
 +#ifdef PNG_APNG_SUPPORTED
 +#define PNG_HAVE_acTL            0x10000
 +#define PNG_HAVE_fcTL            0x20000
 +#endif
  
  /* Flags for the transformations the PNG library does on the image data */
  #define PNG_BGR                 0x0001
-@@ -771,6 +775,16 @@
+@@ -772,6 +776,16 @@
  #define png_tRNS PNG_U32(116,  82,  78,  83)
  #define png_zTXt PNG_U32(122,  84,  88, 116)
  
 +#ifdef PNG_APNG_SUPPORTED
 +#define png_acTL PNG_U32( 97,  99,  84,  76)
 +#define png_fcTL PNG_U32(102,  99,  84,  76)
 +#define png_fdAT PNG_U32(102, 100,  65,  84)
 +
 +/* For png_struct.apng_flags: */
 +#define PNG_FIRST_FRAME_HIDDEN       0x0001
 +#define PNG_APNG_APP                 0x0002
 +#endif
 +
  /* The following will work on (signed char*) strings, whereas the get_uint_32
   * macro will fail on top-bit-set values because of the sign extension.
   */
-@@ -1451,6 +1465,49 @@
+@@ -1452,6 +1466,49 @@
  
  #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */
  
 +#ifdef PNG_APNG_SUPPORTED
 +PNG_INTERNAL_FUNCTION(void,png_ensure_fcTL_is_valid,(png_structp png_ptr,
 +   png_uint_32 width, png_uint_32 height,
 +   png_uint_32 x_offset, png_uint_32 y_offset,
 +   png_uint_16 delay_num, png_uint_16 delay_den,
@@ -576,17 +576,17 @@ Index: pngwrite.c
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +   if (png_ptr->num_frames_written != png_ptr->num_frames_to_write)
 +      png_error(png_ptr, "Not enough frames written");
 +#endif
 +
  #ifdef PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED
     if (png_ptr->num_palette_max > png_ptr->num_palette)
        png_benign_error(png_ptr, "Wrote palette index exceeding num_palette");
-@@ -2397,4 +2406,42 @@
+@@ -2433,4 +2442,42 @@
  }
  #endif /* PNG_STDIO_SUPPORTED */
  #endif /* SIMPLIFIED_WRITE */
 +
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +void PNGAPI
 +png_write_frame_head(png_structp png_ptr, png_infop info_ptr,
 +    png_bytepp row_pointers, png_uint_32 width, png_uint_32 height,
@@ -733,27 +733,27 @@ Index: pngpread.c
 +
 +      return;
 +   }
 +#endif /* PNG_READ_APNG_SUPPORTED */
 +
     if (chunk_name == png_IDAT)
     {
        if (png_ptr->mode & PNG_AFTER_IDAT)
-@@ -299,6 +402,9 @@
+@@ -300,6 +403,9 @@
  
     else if (chunk_name == png_IDAT)
     {
 +#ifdef PNG_READ_APNG_SUPPORTED
 +      png_have_info(png_ptr, info_ptr);
 +#endif
        png_ptr->idat_size = png_ptr->push_length;
        png_ptr->process_mode = PNG_READ_IDAT_MODE;
        png_push_have_info(png_ptr, info_ptr);
-@@ -530,6 +636,30 @@
+@@ -531,6 +637,30 @@
     }
  #endif
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +   else if (chunk_name == png_acTL)
 +   {
 +      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 +      {
@@ -774,29 +774,29 @@ Index: pngpread.c
 +
 +      png_handle_fcTL(png_ptr, info_ptr, png_ptr->push_length);
 +   }
 +
 +#endif /* PNG_READ_APNG_SUPPORTED */
     else
     {
        if (png_ptr->push_length + 4 > png_ptr->buffer_size)
-@@ -731,7 +861,11 @@
+@@ -732,7 +862,11 @@
        png_byte chunk_tag[4];
  
        /* TODO: this code can be commoned up with the same code in push_read */
 +#ifdef PNG_READ_APNG_SUPPORTED
 +      if (png_ptr->buffer_size < 12)
 +#else
        if (png_ptr->buffer_size < 8)
 +#endif
        {
           png_push_save_buffer(png_ptr);
           return;
-@@ -744,17 +878,64 @@
+@@ -745,17 +879,64 @@
        png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag);
        png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +      if (png_ptr->chunk_name != png_fdAT && png_ptr->num_frames_read > 0)
 +      {
 +          if (png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED)
 +          {
@@ -851,33 +851,33 @@ Index: pngpread.c
 +      {
 +         png_ensure_sequence_number(png_ptr, 4);
 +         png_ptr->idat_size -= 4;
 +      }
 +#endif
     }
  
     if (png_ptr->idat_size && png_ptr->save_buffer_size)
-@@ -832,6 +1013,15 @@
+@@ -833,6 +1014,15 @@
     if (!(buffer_length > 0) || buffer == NULL)
        png_error(png_ptr, "No IDAT data (internal error)");
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +   /* If the app is not APNG-aware, decode only the first frame */
 +   if (!(png_ptr->apng_flags & PNG_APNG_APP) && png_ptr->num_frames_read > 0)
 +   {
 +     png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
 +     return;
 +   }
 +#endif
 +
     /* This routine must process all the data it has been given
      * before returning, calling the row callback as required to
      * handle the uncompressed results.
-@@ -1280,6 +1470,18 @@
+@@ -1281,6 +1471,18 @@
     png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
  }
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +void PNGAPI
 +png_set_progressive_frame_fn(png_structp png_ptr,
 +   png_progressive_frame_ptr frame_info_fn,
 +   png_progressive_frame_ptr frame_end_fn)
@@ -1054,29 +1054,29 @@ Index: pngset.c
 +
  #ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
  static png_byte
  check_location(png_const_structrp png_ptr, int location)
 Index: pngrutil.c
 ===================================================================
 --- pngrutil.c
 +++ pngrutil.c
-@@ -826,6 +826,11 @@
+@@ -818,6 +818,11 @@
     filter_type = buf[11];
     interlace_type = buf[12];
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +   png_ptr->first_frame_width = width;
 +   png_ptr->first_frame_height = height;
 +#endif
 +
     /* Set internal variables */
     png_ptr->width = width;
     png_ptr->height = height;
-@@ -2700,6 +2705,179 @@
+@@ -2698,6 +2703,179 @@
  }
  #endif
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +void /* PRIVATE */
 +png_handle_acTL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 +{
 +    png_byte data[8];
@@ -1246,17 +1246,17 @@ Index: pngrutil.c
 +
 +    png_ptr->next_seq_num++;
 +}
 +#endif /* PNG_READ_APNG_SUPPORTED */
 +
  #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
  /* Utility function for png_handle_unknown; set up png_ptr::unknown_chunk */
  static int
-@@ -3957,6 +4135,38 @@
+@@ -3955,6 +4133,38 @@
           uInt avail_in;
           png_bytep buffer;
  
 +#ifdef PNG_READ_APNG_SUPPORTED
 +         png_uint_32 bytes_to_skip = 0;
 +
 +         while (png_ptr->idat_size == 0 || bytes_to_skip != 0)
 +         {
@@ -1285,35 +1285,35 @@ Index: pngrutil.c
 +
 +               png_ptr->idat_size -= 4;
 +            }
 +         }
 +#else
           while (png_ptr->idat_size == 0)
           {
              png_crc_finish(png_ptr, 0);
-@@ -3968,6 +4178,7 @@
+@@ -3966,6 +4176,7 @@
              if (png_ptr->chunk_name != png_IDAT)
                 png_error(png_ptr, "Not enough image data");
           }
 +#endif /* PNG_READ_APNG_SUPPORTED */
  
           avail_in = png_ptr->IDAT_read_size;
  
-@@ -4031,6 +4242,9 @@
+@@ -4029,6 +4240,9 @@
  
           png_ptr->mode |= PNG_AFTER_IDAT;
           png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
 +#ifdef PNG_READ_APNG_SUPPORTED
 +         png_ptr->num_frames_read++;
 +#endif
  
           if (png_ptr->zstream.avail_in > 0 || png_ptr->idat_size > 0)
              png_chunk_benign_error(png_ptr, "Extra compressed data");
-@@ -4476,4 +4690,80 @@
+@@ -4474,4 +4688,80 @@
  
     png_ptr->flags |= PNG_FLAG_ROW_INIT;
  }
 +
 +#ifdef PNG_READ_APNG_SUPPORTED
 +/* This function is to be called after the main IDAT set has been read and
 + * before a new IDAT is read. It resets some parts of png_ptr
 + * to make them usable by the read functions again */
@@ -1515,17 +1515,17 @@ Index: pngwutil.c
 +
 +    png_ptr->next_seq_num++;
 +}
 +#endif /* PNG_WRITE_APNG_SUPPORTED */
 +
  /* Initializes the row writing capability of libpng */
  void /* PRIVATE */
  png_write_start_row(png_structrp png_ptr)
-@@ -3020,4 +3117,39 @@
+@@ -3021,4 +3118,39 @@
     }
  #endif
  }
 +
 +#ifdef PNG_WRITE_APNG_SUPPORTED
 +void /* PRIVATE */
 +png_write_reset(png_structp png_ptr)
 +{
deleted file mode 100644
--- a/media/libpng/arm/MOZ_PNG_cpu-features.c
+++ /dev/null
@@ -1,406 +0,0 @@
-/*
- *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
- *
- *  Use of this source code is governed by a BSD-style license
- *  that can be found in the LICENSE file in the root of the source
- *  tree. An additional intellectual property rights grant can be found
- *  in the file PATENTS.  All contributing project authors may
- *  be found in the AUTHORS file in the root of the source tree.
- */
-
-/*  This is a copy of webrtc/system_wrappers/source/android/cpu-features.c
- *  with name changed to MOZ_PNG_cpu-features.c, exported symbols prefixed
- *  with "MOZ_PNG_", and cpufeatures.h changed to a local file with MOZ_PNG
- *  prefix.
- */
-
-#ifdef __ANDROID__
-#include <sys/system_properties.h>
-#ifdef __arm__
-#include <machine/cpu-features.h>
-#endif
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <stdlib.h>
-
-/* Was #include "webrtc/system_wrappers/source/android/cpu-features.h" */
-#include "MOZ_PNG_cpu-features.h"
-
-static  pthread_once_t     g_once;
-static  AndroidCpuFamily   g_cpuFamily;
-static  uint64_t           g_cpuFeatures;
-static  int                g_cpuCount;
-
-static const int  android_cpufeatures_debug = 0;
-
-#ifdef __arm__
-#  define DEFAULT_CPU_FAMILY  ANDROID_CPU_FAMILY_ARM
-#elif defined __i386__
-#  define DEFAULT_CPU_FAMILY  ANDROID_CPU_FAMILY_X86
-#else
-#  define DEFAULT_CPU_FAMILY  ANDROID_CPU_FAMILY_UNKNOWN
-#endif
-
-#define  D(...) \
-    do { \
-        if (android_cpufeatures_debug) { \
-            printf(__VA_ARGS__); fflush(stdout); \
-        } \
-    } while (0)
-
-#ifdef __i386__
-static __inline__ void x86_cpuid(int func, int values[4])
-{
-    int a, b, c, d;
-    /* We need to preserve ebx since we're compiling PIC code */
-    /* this means we can't use "=b" for the second output register */
-    __asm__ __volatile__ ( \
-      "push %%ebx\n"
-      "cpuid\n" \
-      "mov %1, %%ebx\n"
-      "pop %%ebx\n"
-      : "=a" (a), "=r" (b), "=c" (c), "=d" (d) \
-      : "a" (func) \
-    );
-    values[0] = a;
-    values[1] = b;
-    values[2] = c;
-    values[3] = d;
-}
-#endif
-
-/* Read the content of /proc/cpuinfo into a user-provided buffer.
- * Return the length of the data, or -1 on error. Does *not*
- * zero-terminate the content. Will not read more
- * than 'buffsize' bytes.
- */
-static int
-read_file(const char*  pathname, char*  buffer, size_t  buffsize)
-{
-    int  fd, len;
-
-    fd = open(pathname, O_RDONLY);
-    if (fd < 0)
-        return -1;
-
-    do {
-        len = read(fd, buffer, buffsize);
-    } while (len < 0 && errno == EINTR);
-
-    close(fd);
-
-    return len;
-}
-
-/* Extract the content of a the first occurence of a given field in
- * the content of /proc/cpuinfo and return it as a heap-allocated
- * string that must be freed by the caller.
- *
- * Return NULL if not found
- */
-static char*
-extract_cpuinfo_field(char* buffer, int buflen, const char* field)
-{
-    int  fieldlen = strlen(field);
-    char* bufend = buffer + buflen;
-    char* result = NULL;
-    int len, ignore;
-    const char *p, *q;
-
-    /* Look for first field occurence, and ensures it starts the line.
-     */
-    p = buffer;
-    bufend = buffer + buflen;
-    for (;;) {
-        p = memmem(p, bufend-p, field, fieldlen);
-        if (p == NULL)
-            goto EXIT;
-
-        if (p == buffer || p[-1] == '\n')
-            break;
-
-        p += fieldlen;
-    }
-
-    /* Skip to the first column followed by a space */
-    p += fieldlen;
-    p  = memchr(p, ':', bufend-p);
-    if (p == NULL || p[1] != ' ')
-        goto EXIT;
-
-    /* Find the end of the line */
-    p += 2;
-    q = memchr(p, '\n', bufend-p);
-    if (q == NULL)
-        q = bufend;
-
-    /* Copy the line into a heap-allocated buffer */
-    len = q-p;
-    result = malloc(len+1);
-    if (result == NULL)
-        goto EXIT;
-
-    memcpy(result, p, len);
-    result[len] = '\0';
-
-EXIT:
-    return result;
-}
-
-/* Count the number of occurences of a given field prefix in /proc/cpuinfo.
- */
-static int
-count_cpuinfo_field(char* buffer, int buflen, const char* field)
-{
-    int fieldlen = strlen(field);
-    const char* p = buffer;
-    const char* bufend = buffer + buflen;
-    const char* q;
-    int count = 0;
-
-    for (;;) {
-        const char* q;
-
-        p = memmem(p, bufend-p, field, fieldlen);
-        if (p == NULL)
-            break;
-
-        /* Ensure that the field is at the start of a line */
-        if (p > buffer && p[-1] != '\n') {
-            p += fieldlen;
-            continue;
-        }
-
-
-        /* skip any whitespace */
-        q = p + fieldlen;
-        while (q < bufend && (*q == ' ' || *q == '\t'))
-            q++;
-
-        /* we must have a colon now */
-        if (q < bufend && *q == ':') {
-            count += 1;
-            q ++;
-        }
-        p = q;
-    }
-
-    return count;
-}
-
-/* Like strlen(), but for constant string literals */
-#define STRLEN_CONST(x)  ((sizeof(x)-1)
-
-
-/* Checks that a space-separated list of items contains one given 'item'.
- * Returns 1 if found, 0 otherwise.
- */
-static int
-has_list_item(const char* list, const char* item)
-{
-    const char*  p = list;
-    int itemlen = strlen(item);
-
-    if (list == NULL)
-        return 0;
-
-    while (*p) {
-        const char*  q;
-
-        /* skip spaces */
-        while (*p == ' ' || *p == '\t')
-            p++;
-
-        /* find end of current list item */
-        q = p;
-        while (*q && *q != ' ' && *q != '\t')
-            q++;
-
-        if (itemlen == q-p && !memcmp(p, item, itemlen))
-            return 1;
-
-        /* skip to next item */
-        p = q;
-    }
-    return 0;
-}
-
-
-static void
-android_cpuInit(void)
-{
-    char cpuinfo[4096];
-    int  cpuinfo_len;
-
-    g_cpuFamily   = DEFAULT_CPU_FAMILY;
-    g_cpuFeatures = 0;
-    g_cpuCount    = 1;
-
-    cpuinfo_len = read_file("/proc/cpuinfo", cpuinfo, sizeof cpuinfo);
-    D("cpuinfo_len is (%d):\n%.*s\n", cpuinfo_len,
-      cpuinfo_len >= 0 ? cpuinfo_len : 0, cpuinfo);
-
-    if (cpuinfo_len < 0)  /* should not happen */ {
-        return;
-    }
-
-    /* Count the CPU cores, the value may be 0 for single-core CPUs */
-    g_cpuCount = count_cpuinfo_field(cpuinfo, cpuinfo_len, "processor");
-    if (g_cpuCount == 0) {
-        g_cpuCount = count_cpuinfo_field(cpuinfo, cpuinfo_len, "Processor");
-        if (g_cpuCount == 0) {
-            g_cpuCount = 1;
-        }
-    }
-
-    D("found cpuCount = %d\n", g_cpuCount);
-
-#ifdef __ARM_ARCH__
-    {
-        char*  features = NULL;
-        char*  architecture = NULL;
-
-        /* Extract architecture from the "CPU Architecture" field.
-         * The list is well-known, unlike the the output of
-         * the 'Processor' field which can vary greatly.
-         *
-         * See the definition of the 'proc_arch' array in
-         * $KERNEL/arch/arm/kernel/setup.c and the 'c_show' function in
-         * same file.
-         */
-        char* cpuArch = extract_cpuinfo_field(cpuinfo, cpuinfo_len, "CPU architecture");
-
-        if (cpuArch != NULL) {
-            char*  end;
-            long   archNumber;
-            int    hasARMv7 = 0;
-
-            D("found cpuArch = '%s'\n", cpuArch);
-
-            /* read the initial decimal number, ignore the rest */
-            archNumber = strtol(cpuArch, &end, 10);
-
-            /* Here we assume that ARMv8 will be upwards compatible with v7
-                * in the future. Unfortunately, there is no 'Features' field to
-                * indicate that Thumb-2 is supported.
-                */
-            if (end > cpuArch && archNumber >= 7) {
-                hasARMv7 = 1;
-            }
-
-            /* Unfortunately, it seems that certain ARMv6-based CPUs
-             * report an incorrect architecture number of 7!
-             *
-             * See http://code.google.com/p/android/issues/detail?id=10812
-             *
-             * We try to correct this by looking at the 'elf_format'
-             * field reported by the 'Processor' field, which is of the
-             * form of "(v7l)" for an ARMv7-based CPU, and "(v6l)" for
-             * an ARMv6-one.
-             */
-            if (hasARMv7) {
-                char* cpuProc = extract_cpuinfo_field(cpuinfo, cpuinfo_len,
-                                                      "Processor");
-                if (cpuProc != NULL) {
-                    D("found cpuProc = '%s'\n", cpuProc);
-                    if (has_list_item(cpuProc, "(v6l)")) {
-                        D("CPU processor and architecture mismatch!!\n");
-                        hasARMv7 = 0;
-                    }
-                    free(cpuProc);
-                }
-            }
-
-            if (hasARMv7) {
-                g_cpuFeatures |= ANDROID_CPU_ARM_FEATURE_ARMv7;
-            }
-
-            /* The LDREX / STREX instructions are available from ARMv6 */
-            if (archNumber >= 6) {
-                g_cpuFeatures |= ANDROID_CPU_ARM_FEATURE_LDREX_STREX;
-            }
-
-            free(cpuArch);
-        }
-
-        /* Extract the list of CPU features from 'Features' field */
-        char* cpuFeatures = extract_cpuinfo_field(cpuinfo, cpuinfo_len, "Features");
-
-        if (cpuFeatures != NULL) {
-
-            D("found cpuFeatures = '%s'\n", cpuFeatures);
-
-            if (has_list_item(cpuFeatures, "vfpv3"))
-                g_cpuFeatures |= ANDROID_CPU_ARM_FEATURE_VFPv3;
-
-            else if (has_list_item(cpuFeatures, "vfpv3d16"))
-                g_cpuFeatures |= ANDROID_CPU_ARM_FEATURE_VFPv3;
-
-            if (has_list_item(cpuFeatures, "neon")) {
-                /* Note: Certain kernels only report neon but not vfpv3
-                    *       in their features list. However, ARM mandates
-                    *       that if Neon is implemented, so must be VFPv3
-                    *       so always set the flag.
-                    */
-                g_cpuFeatures |= ANDROID_CPU_ARM_FEATURE_NEON |
-                                 ANDROID_CPU_ARM_FEATURE_VFPv3;
-            }
-            free(cpuFeatures);
-        }
-    }
-#endif /* __ARM_ARCH__ */
-
-#ifdef __i386__
-    g_cpuFamily = ANDROID_CPU_FAMILY_X86;
-
-    int regs[4];
-
-/* According to http://en.wikipedia.org/wiki/CPUID */
-#define VENDOR_INTEL_b  0x756e6547
-#define VENDOR_INTEL_c  0x6c65746e
-#define VENDOR_INTEL_d  0x49656e69
-
-    x86_cpuid(0, regs);
-    int vendorIsIntel = (regs[1] == VENDOR_INTEL_b &&
-                         regs[2] == VENDOR_INTEL_c &&
-                         regs[3] == VENDOR_INTEL_d);
-
-    x86_cpuid(1, regs);
-    if ((regs[2] & (1 << 9)) != 0) {
-        g_cpuFeatures |= ANDROID_CPU_X86_FEATURE_SSSE3;
-    }
-    if ((regs[2] & (1 << 23)) != 0) {
-        g_cpuFeatures |= ANDROID_CPU_X86_FEATURE_POPCNT;
-    }
-    if (vendorIsIntel && (regs[2] & (1 << 22)) != 0) {
-        g_cpuFeatures |= ANDROID_CPU_X86_FEATURE_MOVBE;
-    }
-#endif
-}
-
-
-AndroidCpuFamily
-android_getCpuFamily(void)
-{
-    pthread_once(&g_once, android_cpuInit);
-    return g_cpuFamily;
-}
-
-
-uint64_t
-android_getCpuFeatures(void)
-{
-    pthread_once(&g_once, android_cpuInit);
-    return g_cpuFeatures;
-}
-
-
-int
-android_getCpuCount(void)
-{
-    pthread_once(&g_once, android_cpuInit);
-    return g_cpuCount;
-}
-#endif /* __ANDROID__ */
deleted file mode 100644
--- a/media/libpng/arm/MOZ_PNG_cpu-features.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
- *
- *  Use of this source code is governed by a BSD-style license
- *  that can be found in the LICENSE file in the root of the source
- *  tree. An additional intellectual property rights grant can be found
- *  in the file PATENTS.  All contributing project authors may
- *  be found in the AUTHORS file in the root of the source tree.
- */
-
-/*  This is a copy of webrtc/system_wrappers/source/android/cpu-features.h
- *  with name changed to MOZ_PNG_cpu-features.h and exported symbols
- *  prefixed with "MOZ_PNG_".
- */
-
-// You can download Android source at
-// http://source.android.com/source/downloading.html
-// Original files are in ndk/sources/android/cpufeatures
-// Revision is Change-Id: I9a0629efba36a6023f05e5f092e7addcc1b7d2a9
-
-#ifndef CPU_FEATURES_H
-#define CPU_FEATURES_H
-
-#define android_getCpuFamily MOZ_PNG_android_getCpuFamily
-#define android_getCpuFeatures MOZ_PNG_android_getCpuFeatures
-#define android_getCpuCount MOZ_PNG_android_getCpuCount
-
-#include <sys/cdefs.h>
-#include <stdint.h>
-
-__BEGIN_DECLS
-
-typedef enum {
-    ANDROID_CPU_FAMILY_UNKNOWN = 0,
-    ANDROID_CPU_FAMILY_ARM,
-    ANDROID_CPU_FAMILY_X86,
-
-    ANDROID_CPU_FAMILY_MAX  /* do not remove */
-
-} AndroidCpuFamily;
-
-/* Return family of the device's CPU */
-extern AndroidCpuFamily   android_getCpuFamily(void);
-
-enum {
-    ANDROID_CPU_ARM_FEATURE_ARMv7       = (1 << 0),
-    ANDROID_CPU_ARM_FEATURE_VFPv3       = (1 << 1),
-    ANDROID_CPU_ARM_FEATURE_NEON        = (1 << 2),
-    ANDROID_CPU_ARM_FEATURE_LDREX_STREX = (1 << 3),
-};
-
-enum {
-    ANDROID_CPU_X86_FEATURE_SSSE3  = (1 << 0),
-    ANDROID_CPU_X86_FEATURE_POPCNT = (1 << 1),
-    ANDROID_CPU_X86_FEATURE_MOVBE  = (1 << 2),
-};
-
-extern uint64_t    android_getCpuFeatures(void);
-
-/* Return the number of CPU cores detected on this device. */
-extern int         android_getCpuCount(void);
-
-__END_DECLS
-
-#endif /* CPU_FEATURES_H */
--- a/media/libpng/arm/arm_init.c
+++ b/media/libpng/arm/arm_init.c
@@ -1,155 +1,56 @@
 
 /* arm_init.c - NEON optimised filter functions
  *
- * Copyright (c) 2013 Glenn Randers-Pehrson
+ * Copyright (c) 2014 Glenn Randers-Pehrson
  * Written by Mans Rullgard, 2011.
- * Last changed in libpng 1.6.6 [September 16, 2013]
+ * Last changed in libpng 1.6.10 [March 6, 2014]
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 /* Below, after checking __linux__, various non-C90 POSIX 1003.1 functions are
  * called.
  */
 #define _POSIX_SOURCE 1
 
 #include "../pngpriv.h"
 
 #ifdef PNG_READ_SUPPORTED
 #if PNG_ARM_NEON_OPT > 0
 #ifdef PNG_ARM_NEON_CHECK_SUPPORTED /* Do run-time checks */
-#include <signal.h> /* for sig_atomic_t */
-
-#ifdef __ANDROID__
-/* Linux provides access to information about CPU capabilites via
- * /proc/self/auxv, however Android blocks this while still claiming to be
- * Linux.  The Andoid NDK, however, provides appropriate support.
+/* WARNING: it is strongly recommended that you do not build libpng with
+ * run-time checks for CPU features if at all possible.  In the case of the ARM
+ * NEON instructions there is no processor-specific way of detecting the
+ * presense of the required support, therefore run-time detectioon is extremely
+ * OS specific.
  *
- * Documentation: http://www.kandroid.org/ndk/docs/CPU-ARM-NEON.html
- */
-#include "MOZ_PNG_cpu-features.h"
-
-static int
-png_have_neon(png_structp png_ptr)
-{
-   /* This is a whole lot easier than the mess below, however it is probably
-    * implemented as below, therefore it is better to cache the result (these
-    * function calls may be slow!)
-    */
-   PNG_UNUSED(png_ptr)
-   return android_getCpuFamily() == ANDROID_CPU_FAMILY_ARM &&
-      (android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_NEON) != 0;
-}
-#elif defined(__linux__)
-/* The generic __linux__ implementation requires reading /proc/self/auxv and
- * looking at each element for one that records NEON capabilities.
+ * You may set the macro PNG_ARM_NEON_FILE to the file name of file containing
+ * a fragment of C source code which defines the png_have_neon function.  There
+ * are a number of implementations in contrib/arm-neon, but the only one that
+ * has partial support is contrib/arm-neon/linux.c - a generic Linux
+ * implementation which reads /proc/cpufino.
  */
-#include <unistd.h> /* for POSIX 1003.1 */
-#include <errno.h>  /* for EINTR */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <elf.h>
-#include <asm/hwcap.h>
-
-/* A read call may be interrupted, in which case it returns -1 and sets errno to
- * EINTR if nothing was done, otherwise (if something was done) a partial read
- * may result.
- */
-static size_t
-safe_read(png_structp png_ptr, int fd, void *buffer_in, size_t nbytes)
-{
-   size_t ntotal = 0;
-   char *buffer = png_voidcast(char*, buffer_in);
-
-   while (nbytes > 0)
-   {
-      unsigned int nread;
-      int iread;
-
-      /* Passing nread > INT_MAX to read is implementation defined in POSIX
-       * 1003.1, therefore despite the unsigned argument portable code must
-       * limit the value to INT_MAX!
-       */
-      if (nbytes > INT_MAX)
-         nread = INT_MAX;
-
-      else
-         nread = (unsigned int)/*SAFE*/nbytes;
-
-      iread = read(fd, buffer, nread);
+#ifndef PNG_ARM_NEON_FILE
+#  ifdef __linux__
+#     define PNG_ARM_NEON_FILE "linux.c"
+#  endif
+#endif
 
-      if (iread == -1)
-      {
-         /* This is the devil in the details, a read can terminate early with 0
-          * bytes read because of EINTR, yet it still returns -1 otherwise end
-          * of file cannot be distinguished.
-          */
-         if (errno != EINTR)
-         {
-            png_warning(png_ptr, "/proc read failed");
-            return 0; /* I.e., a permanent failure */
-         }
-      }
-
-      else if (iread < 0)
-      {
-         /* Not a valid 'read' result: */
-         png_warning(png_ptr, "OS /proc read bug");
-         return 0;
-      }
-
-      else if (iread > 0)
-      {
-         /* Continue reading until a permanent failure, or EOF */
-         buffer += iread;
-         nbytes -= (unsigned int)/*SAFE*/iread;
-         ntotal += (unsigned int)/*SAFE*/iread;
-      }
-
-      else
-         return ntotal;
-   }
+#ifdef PNG_ARM_NEON_FILE
 
-   return ntotal; /* nbytes == 0 */
-}
-
-static int
-png_have_neon(png_structp png_ptr)
-{
-   int fd = open("/proc/self/auxv", O_RDONLY);
-   Elf32_auxv_t aux;
-
-   /* Failsafe: failure to open means no NEON */
-   if (fd == -1)
-   {
-      png_warning(png_ptr, "/proc/self/auxv open failed");
-      return 0;
-   }
+#include <signal.h> /* for sig_atomic_t */
+static int png_have_neon(png_structp png_ptr);
+#include PNG_ARM_NEON_FILE
 
-   while (safe_read(png_ptr, fd, &aux, sizeof aux) == sizeof aux)
-   {
-      if (aux.a_type == AT_HWCAP && (aux.a_un.a_val & HWCAP_NEON) != 0)
-      {
-         close(fd);
-         return 1;
-      }
-   }
-
-   close(fd);
-   return 0;
-}
-#else
-   /* We don't know how to do a run-time check on this system */
-#  error "no support for run-time ARM NEON checks"
-#endif /* OS checks */
+#else  /* PNG_ARM_NEON_FILE */
+#  error "PNG_ARM_NEON_FILE undefined: no support for run-time ARM NEON checks"
+#endif /* PNG_ARM_NEON_FILE */
 #endif /* PNG_ARM_NEON_CHECK_SUPPORTED */
 
 #ifndef PNG_ALIGNED_MEMORY_SUPPORTED
 #  error "ALIGNED_MEMORY is required; set: -DPNG_ALIGNED_MEMORY_SUPPORTED"
 #endif
 
 void
 png_init_filter_functions_neon(png_structp pp, unsigned int bpp)
new file mode 100644
--- /dev/null
+++ b/media/libpng/arm/linux.c
@@ -0,0 +1,159 @@
+/* contrib/arm-neon/linux.c
+ *
+ * Copyright (c) 2014 Glenn Randers-Pehrson
+ * Written by John Bowler, 2014.
+ * Last changed in libpng 1.6.10 [March 6, 2014]
+ *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
+ * SEE contrib/arm-neon/README before reporting bugs
+ *
+ * STATUS: SUPPORTED
+ * BUG REPORTS: png-mng-implement@sourceforge.net
+ *
+ * png_have_neon implemented for Linux by reading the widely available
+ * pseudo-file /proc/cpuinfo.
+ *
+ * This code is strict ANSI-C and is probably moderately portable, it does
+ * however use <stdio.h> and assumes that /proc/cpuinfo is never localized.
+ */
+#include <stdio.h>
+
+static int
+png_have_neon(png_structp png_ptr)
+{
+   FILE *f = fopen("/proc/cpuinfo", "rb");
+
+   if (f != NULL)
+   {
+      /* This is a simple state machine which reads the input byte-by-byte until
+       * it gets a match on the 'neon' feature or reaches the end of the stream.
+       */
+      static const char ch_feature[] = { 70, 69, 65, 84, 85, 82, 69, 83 };
+      static const char ch_neon[] = { 78, 69, 79, 78 };
+
+      enum
+      {
+         StartLine, Feature, Colon, StartTag, Neon, HaveNeon, SkipTag, SkipLine
+      }  state;
+      int counter;
+
+      for (state=StartLine, counter=0;;)
+      {
+         int ch = fgetc(f);
+
+         if (ch == EOF)
+         {
+            /* EOF means error or end-of-file, return false; neon at EOF is
+             * assumed to be a mistake.
+             */
+            fclose(f);
+            return 0;
+         }
+
+         switch (state)
+         {
+            case StartLine:
+               /* Match spaces at the start of line */
+               if (ch <= 32) /* skip control characters and space */
+                  break;
+
+               counter=0;
+               state = Feature;
+               /* FALL THROUGH */
+
+            case Feature:
+               /* Match 'FEATURE', ASCII case insensitive. */
+               if ((ch & ~0x20) == ch_feature[counter])
+               {
+                  if (++counter == (sizeof ch_feature))
+                     state = Colon;
+                  break;
+               }
+               
+               /* did not match 'feature' */
+               state = SkipLine;
+               /* FALL THROUGH */
+
+            case SkipLine:
+            skipLine:
+               /* Skip everything until we see linefeed or carriage return */
+               if (ch != 10 && ch != 13)
+                  break;
+
+               state = StartLine;
+               break;
+
+            case Colon:
+               /* Match any number of space or tab followed by ':' */
+               if (ch == 32 || ch == 9)
+                  break;
+
+               if (ch == 58) /* i.e. ':' */
+               {
+                  state = StartTag;
+                  break;
+               }
+
+               /* Either a bad line format or a 'feature' prefix followed by
+                * other characters.
+                */
+               state = SkipLine;
+               goto skipLine;
+
+            case StartTag:
+               /* Skip space characters before a tag */
+               if (ch == 32 || ch == 9)
+                  break;
+
+               state = Neon;
+               counter = 0;
+               /* FALL THROUGH */
+
+            case Neon:
+               /* Look for 'neon' tag */
+               if ((ch & ~0x20) == ch_neon[counter])
+               {
+                  if (++counter == (sizeof ch_neon))
+                     state = HaveNeon;
+                  break;
+               }
+
+               state = SkipTag;
+               /* FALL THROUGH */
+
+            case SkipTag:
+               /* Skip non-space characters */
+               if (ch == 10 || ch == 13)
+                  state = StartLine;
+
+               else if (ch == 32 || ch == 9)
+                  state = StartTag;
+               break;
+
+            case HaveNeon:
+               /* Have seen a 'neon' prefix, but there must be a space or new
+                * line character to terminate it.
+                */
+               if (ch == 10 || ch == 13 || ch == 32 || ch == 9)
+               {
+                  fclose(f);
+                  return 1;
+               }
+
+               state = SkipTag;
+               break;
+
+            default:
+               png_error(png_ptr, "png_have_neon: internal error (bug)");
+         }
+      }
+   }
+
+   else
+      png_warning(png_ptr, "/proc/cpuinfo open failed");
+
+   return 0;
+}
--- a/media/libpng/moz.build
+++ b/media/libpng/moz.build
@@ -33,22 +33,16 @@ if CONFIG['MOZ_PNG_ARM_NEON']:
         'arm/arm_init.c',
         'arm/filter_neon_intrinsics.c'
     ]
 
     SOURCES += [
         'arm/filter_neon.S'
     ]
 
-    if CONFIG['MOZ_PNG_ARM_NEON_CHECK']:
-        DEFINES['MOZ_PNG_HAVE_ARM_NEON_CHECK'] = True
-        UNIFIED_SOURCES += [
-            'arm/MOZ_PNG_cpu-features.c'
-        ]
-
 LIBRARY_NAME = 'mozpng'
 
 MSVC_ENABLE_PGO = True
 
 if CONFIG['GKMEDIAS_SHARED_LIBRARY']:
     NO_VISIBILITY_FLAGS = True
 
 FINAL_LIBRARY = 'gkmedias'
--- a/media/libpng/mozpngconf.h
+++ b/media/libpng/mozpngconf.h
@@ -1,24 +1,27 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef MOZPNGCONF_H
 #define MOZPNGCONF_H
 #define PNGLCONF_H /* So we don't try to use libpng's pnglibconf.h */
 
+/* limit image dimensions (bug #251381, #591822, and #967656) */
+#define MOZ_PNG_MAX_DIMENSION 32767
+
 #define PNG_API_RULE 0
 #define PNG_COST_SHIFT 3
 #define PNG_GAMMA_THRESHOLD_FIXED 5000
 #define PNG_MAX_GAMMA_8 11
 #define PNG_USER_CHUNK_CACHE_MAX 128
 #define PNG_USER_CHUNK_MALLOC_MAX 4000000L
-#define PNG_USER_HEIGHT_MAX 1000000
-#define PNG_USER_WIDTH_MAX 1000000
+#define PNG_USER_HEIGHT_MAX MOZ_PNG_MAX_DIMENSION
+#define PNG_USER_WIDTH_MAX MOZ_PNG_MAX_DIMENSION
 #define PNG_WEIGHT_SHIFT 8
 #define PNG_ZBUF_SIZE 8192
 #define PNG_IDAT_READ_SIZE PNG_ZBUF_SIZE
 #define PNG_INFLATE_BUF_SIZE 1024
 #define PNG_Z_DEFAULT_COMPRESSION (-1)
 #define PNG_Z_DEFAULT_NOFILTER_STRATEGY 0
 #define PNG_Z_DEFAULT_STRATEGY 1
 
@@ -110,18 +113,21 @@
 #define PNG_16BIT_SUPPORTED
 #define PNG_CHECK_cHRM_SUPPORTED
 #define PNG_FLOATING_ARITHMETIC_SUPPORTED
 #define PNG_FLOATING_POINT_SUPPORTED
 #define PNG_POINTER_INDEXING_SUPPORTED
 #define PNG_SETJMP_SUPPORTED
 #define PNG_STDIO_SUPPORTED
 #define PNG_TEXT_SUPPORTED
+
+#ifdef PR_LOGGING
 #define PNG_ERROR_TEXT_SUPPORTED
 #define PNG_WARNINGS_SUPPORTED
+#endif
 
 /* Mangle names of exported libpng functions so different libpng versions
    can coexist. It is recommended that if you do this, you give your
    library a different name such as "mozlibpng" instead of "libpng". */
 
 /* The following has been present since libpng-0.88, has never changed, and
    is unaffected by conditional compilation macros.  It will not be mangled
    and it is the only choice for use in configure scripts for detecting the
@@ -617,18 +623,22 @@
 #define png_zlib_release                          MOZ_PNG_zlib_release
 #define convert_gamma_value                       MOZ_convert_gamma_value
 #define ppi_from_ppm                              MOZ_ppi_from_ppm
 #define translate_gamma_flags                     MOZ_translate_gamma_flags
 
 /* libpng-1.6.x additions */
 #define png_app_error                             MOZ_PNG_app_err
 #define png_app_warning                           MOZ_PNG_app_warn
-#define png_benign_error                          MOZ_PNG_benign_err
-#define png_chunk_benign_error                    MOZ_PNG_chunk_benign_err
+#ifndef png_benign_error
+#  define png_benign_error                        MOZ_PNG_benign_err
+#endif
+#ifndef png_chunk_benign_error
+#  define png_chunk_benign_error                  MOZ_PNG_chunk_benign_err
+#endif
 #define png_chunk_report                          MOZ_PNG_chunk_report
 #define png_colorspace_set_ICC                    MOZ_PNG_cs_set_ICC
 #define png_colorspace_set_chromaticities         MOZ_PNG_cs_set_chromats
 #define png_colorspace_set_endpoints              MOZ_PNG_cs_set_endpts
 #define png_colorspace_set_gamma                  MOZ_PNG_cs_set_gamma
 #define png_colorspace_set_sRGB                   MOZ_PNG_cs_set_sRGB
 #define png_colorspace_sync                       MOZ_PNG_cs_sync
 #define png_colorspace_sync_info                  MOZ_PNG_cs_sync_info
@@ -642,25 +652,28 @@
 #define png_icc_check_length                      MOZ_PNG_icc_check_length
 #define png_icc_check_tag_table                   MOZ_PNG_icc_check_tags
 #define png_icc_set_sRGB                          MOZ_PNG_icc_set_sRGB
 #define png_malloc_array                          MOZ_PNG_malloc_array
 #define png_malloc_base                           MOZ_PNG_malloc_base
 #define png_realloc_array                         MOZ_PNG_realloc_array
 #define png_zstream_error                         MOZ_PNG_zstream_error
 
-/* needed by FreeType's PNG support */
-#define png_error                       MOZ_PNG_error
-
-#if defined(PR_LOGGING) && defined(PNG_WARNINGS_SUPPORTED)
-#define png_warning                     MOZ_PNG_warning
-#define png_chunk_error                 MOZ_PNG_chunk_err
+#if defined(PR_LOGGING)
+#ifndef png_warning
+#  define png_warning                     MOZ_PNG_warning
+#endif
+#ifndef png_chunk_error
+#  define png_chunk_error                 MOZ_PNG_chunk_err
+#endif
+#ifndef png_chunk_warning
+#  define png_chunk_warning               MOZ_PNG_chunk_warn
+#endif
 #define png_fixed_error                 MOZ_PNG_fixed_err
 #define png_formatted_warning           MOZ_PNG_formatted_warning
-#define png_chunk_warning               MOZ_PNG_chunk_warn
 #define png_warning_parameter           MOZ_PNG_warn_param
 #define png_warning_parameter_signed    MOZ_PNG_warn_param_signed
 #define png_warning_parameter_unsigned  MOZ_PNG_warn_param_unsigned
 #endif
 
 #if defined(PNG_READ_PACK_SUPPORTED) || defined(PNG_WRITE_PACK_SUPPORTED)
 #define png_set_packing  MOZ_PNG_set_packing
 #endif
--- a/media/libpng/png.c
+++ b/media/libpng/png.c
@@ -9,17 +9,17 @@
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_9 Your_png_h_is_not_version_1_6_9;
+typedef png_libpng_version_1_6_10 Your_png_h_is_not_version_1_6_10;
 
 /* Tells libpng that we have already handled the first "num_bytes" bytes
  * of the PNG file signature.  If the PNG data is embedded into another
  * stream we can set num_bytes = 8 so that libpng will not attempt to read
  * or write any of the magic bytes before it starts on the IHDR.
  */
 
 #ifdef PNG_READ_SUPPORTED
@@ -768,23 +768,23 @@ png_const_charp PNGAPI
 png_get_copyright(png_const_structrp png_ptr)
 {
    PNG_UNUSED(png_ptr)  /* Silence compiler warning about unused png_ptr */
 #ifdef PNG_STRING_COPYRIGHT
    return PNG_STRING_COPYRIGHT
 #else
 #  ifdef __STDC__
    return PNG_STRING_NEWLINE \
-     "libpng version 1.6.9 - February 6, 2014" PNG_STRING_NEWLINE \
+     "libpng version 1.6.10 - March 6, 2014" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.6.9 - February 6, 2014\
+      return "libpng version 1.6.10 - March 6, 2014\
       Copyright (c) 1998-2014 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
 #  endif
 #endif
 }
 
 /* The following return the library version as a short string in the
@@ -1737,17 +1737,18 @@ png_icc_tag_name(char *name, png_uint_32
 
 static int
 is_ICC_signature_char(png_alloc_size_t it)
 {
    return it == 32 || (it >= 48 && it <= 57) || (it >= 65 && it <= 90) ||
       (it >= 97 && it <= 122);
 }
 
-static int is_ICC_signature(png_alloc_size_t it)
+static int
+is_ICC_signature(png_alloc_size_t it)
 {
    return is_ICC_signature_char(it >> 24) /* checks all the top bits */ &&
       is_ICC_signature_char((it >> 16) & 0xff) &&
       is_ICC_signature_char((it >> 8) & 0xff) &&
       is_ICC_signature_char(it & 0xff);
 }
 
 static int
@@ -2290,25 +2291,26 @@ png_compare_ICC_profile_with_sRGB(png_co
                         PNG_CHUNK_WARNING);
                   }
 
                   return 1+png_sRGB_checks[i].is_broken;
                }
             }
          }
 
-#        if PNG_sRGB_PROFILE_CHECKS > 0
-            /* The signature matched, but the profile had been changed in some
-             * way.  This is an apparent violation of the ICC terms of use and,
-             * anyway, probably indicates a data error or uninformed hacking.
-             */
-            if (png_sRGB_checks[i].have_md5)
-               png_benign_error(png_ptr,
-                  "copyright violation: edited ICC profile ignored");
-#        endif
+# if PNG_sRGB_PROFILE_CHECKS > 0
+         /* The signature matched, but the profile had been changed in some
+          * way.  This probably indicates a data error or uninformed hacking.
+          * Fall through to "no match".
+          */
+         png_chunk_report(png_ptr,
+             "Not recognizing known sRGB profile that has been edited", 
+             PNG_CHUNK_WARNING);
+         break;
+# endif
       }
    }
 
    return 0; /* no match */
 }
 #endif
 
 #ifdef PNG_sRGB_SUPPORTED
--- a/media/libpng/png.h
+++ b/media/libpng/png.h
@@ -1,22 +1,22 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.6.9 - February 6, 2014
- * Copyright (c) 1998-2013 Glenn Randers-Pehrson
+ * libpng version 1.6.10 - March 6, 2014
+ * Copyright (c) 1998-2014 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license (See LICENSE, below)
  *
  * Authors and maintainers:
  *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *   libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.6.9 - February 6, 2014: Glenn
+ *   libpng versions 0.97, January 1998, through 1.6.10 - March 6, 2014: Glenn
  *   See also "Contributing Authors", below.
  *
  * Note about libpng version numbers:
  *
  *   Due to various miscommunications, unforeseen code incompatibilities
  *   and occasional factors outside the authors' control, version numbering
  *   on the library has not always been consistent and straightforward.
  *   The following table summarizes matters since version 0.89c, which was
@@ -187,16 +187,19 @@
  *    1.6.7rc01-03            16    10607  16.so.16.7[.0]
  *    1.6.7                   16    10607  16.so.16.7[.0]
  *    1.6.8beta01-02          16    10608  16.so.16.8[.0]
  *    1.6.8rc01-02            16    10608  16.so.16.8[.0]
  *    1.6.8                   16    10608  16.so.16.8[.0]
  *    1.6.9beta01-04          16    10609  16.so.16.9[.0]
  *    1.6.9rc01-02            16    10609  16.so.16.9[.0]
  *    1.6.9                   16    10609  16.so.16.9[.0]
+ *    1.6.10beta01-03         16    10610  16.so.16.10[.0]
+ *    1.6.10betarc01-04       16    10610  16.so.16.10[.0]
+ *    1.6.10beta              16    10610  16.so.16.10[.0]
  *
  *   Henceforth the source version will match the shared-library major
  *   and minor numbers; the shared-library major version number will be
  *   used for changes in backward compatibility, as it is intended.  The
  *   PNG_LIBPNG_VER macro, which is not used within libpng but is available
  *   for applications, is an unsigned integer of the form xyyzz corresponding
  *   to the source version x.y.z (leading zeros in y and z).  Beta versions
  *   were given the previous public release number plus a letter, until
@@ -218,17 +221,17 @@
 /*
  * COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
  *
  * If you modify libpng you may insert additional notices immediately following
  * this sentence.
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.2.6, August 15, 2004, through 1.6.9, February 6, 2014, are
+ * libpng versions 1.2.6, August 15, 2004, through 1.6.10, March 6, 2014, are
  * Copyright (c) 2004, 2006-2013 Glenn Randers-Pehrson, and are
  * distributed according to the same disclaimer and license as libpng-1.2.5
  * with the following individual added to the list of Contributing Authors:
  *
  *    Cosmin Truta
  *
  * libpng versions 1.0.7, July 1, 2000, through 1.2.5, October 3, 2002, are
  * Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are
@@ -330,23 +333,23 @@
  *
  * Thanks to Frank J. T. Wojcik for helping with the documentation.
  */
 
 /*
  * Y2K compliance in libpng:
  * =========================
  *
- *    February 6, 2014
+ *    March 6, 2014
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.6.9 are Y2K compliant.  It is my belief that
+ *    upward through 1.6.10 are Y2K compliant.  It is my belief that
  *    earlier versions were also Y2K compliant.
  *
  *    Libpng only has two year fields.  One is a 2-byte unsigned integer
  *    that will hold years up to 65535.  The other, which is deprecated,
  *    holds the date in text format, and will hold years up to 9999.
  *
  *    The integer is
  *        "png_uint_16 year" in png_time_struct.
@@ -396,27 +399,27 @@
  * with some code on which to build.  This file is useful for looking
  * at the actual function definitions and structure components.
  *
  * If you just need to read a PNG file and don't want to read the documentation
  * skip to the end of this file and read the section entitled 'simplified API'.
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.6.9"
+#define PNG_LIBPNG_VER_STRING "1.6.10"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.6.9 - February 6, 2014\n"
+     " libpng version 1.6.10 - March 6, 2014\n"
 
 #define PNG_LIBPNG_VER_SONUM   16
 #define PNG_LIBPNG_VER_DLLNUM  16
 
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   6
-#define PNG_LIBPNG_VER_RELEASE 9
+#define PNG_LIBPNG_VER_RELEASE 10
 
 /* This should match the numeric part of the final component of
  * PNG_LIBPNG_VER_STRING, omitting any leading zero:
  */
 
 #define PNG_LIBPNG_VER_BUILD  0
 
 /* Release Status */
@@ -437,22 +440,26 @@
 #define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE
 
 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
  * We must not include leading zeros.
  * Versions 0.7 through 1.0.0 were in the range 0 to 100 here (only
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
  * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
  */
-#define PNG_LIBPNG_VER 10609 /* 1.6.9 */
+#define PNG_LIBPNG_VER 10610 /* 1.6.10 */
 
 /* Library configuration: these options cannot be changed after
  * the library has been built.
  */
 
+#define PNG_APNG_SUPPORTED
+#define PNG_READ_APNG_SUPPORTED
+#define PNG_WRITE_APNG_SUPPORTED
+
 #ifndef PNG_VERSION_INFO_ONLY
    /* Machine specific configuration. */
 #  include "mozpngconf.h"
 #  include "pngconf.h"
 #endif
 
 /*
  * Added at libpng-1.2.8
@@ -548,17 +555,17 @@ extern "C" {
 /* blend_op flags from inside fcTL */
 #define PNG_BLEND_OP_SOURCE        0x00
 #define PNG_BLEND_OP_OVER          0x01
 #endif /* PNG_APNG_SUPPORTED */
 
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef char* png_libpng_version_1_6_9;
+typedef char* png_libpng_version_1_6_10;
 
 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
  *
  * png_struct is the cache of information used while reading or writing a single
  * PNG file.  One of these is always required, although the simplified API
  * (below) hides the creation and destruction of it.
  */
 typedef struct png_struct_def png_struct;
@@ -1218,53 +1225,39 @@ PNG_EXPORT(34, png_byte, png_get_rgb_to_
 #endif
 
 #ifdef PNG_BUILD_GRAYSCALE_PALETTE_SUPPORTED
 PNG_EXPORT(35, void, png_build_grayscale_palette, (int bit_depth,
     png_colorp palette));
 #endif
 
 #ifdef PNG_READ_ALPHA_MODE_SUPPORTED
-/* How the alpha channel is interpreted - this affects how the color channels of
- * a PNG file are returned when an alpha channel, or tRNS chunk in a palette
- * file, is present.
+/* How the alpha channel is interpreted - this affects how the color channels
+ * of a PNG file are returned to the calling application when an alpha channel,
+ * or a tRNS chunk in a palette file, is present.
  *
  * This has no effect on the way pixels are written into a PNG output
  * datastream. The color samples in a PNG datastream are never premultiplied
  * with the alpha samples.
  *
  * The default is to return data according to the PNG specification: the alpha
  * channel is a linear measure of the contribution of the pixel to the
- * corresponding composited pixel.  The gamma encoded color channels must be
- * scaled according to the contribution and to do this it is necessary to undo
+ * corresponding composited pixel, and the color channels are unassociated
+ * (not premultiplied).  The gamma encoded color channels must be scaled
+ * according to the contribution and to do this it is necessary to undo
  * the encoding, scale the color values, perform the composition and reencode
  * the values.  This is the 'PNG' mode.
  *
  * The alternative is to 'associate' the alpha with the color information by
- * storing color channel values that have been scaled by the alpha.  The
- * advantage is that the color channels can be resampled (the image can be
- * scaled) in this form.  The disadvantage is that normal practice is to store
- * linear, not (gamma) encoded, values and this requires 16-bit channels for
- * still images rather than the 8-bit channels that are just about sufficient if
- * gamma encoding is used.  In addition all non-transparent pixel values,
- * including completely opaque ones, must be gamma encoded to produce the final
- * image.  This is the 'STANDARD', 'ASSOCIATED' or 'PREMULTIPLIED' mode (the
- * latter being the two common names for associated alpha color channels.)
+ * storing color channel values that have been scaled by the alpha.
+ * image.  These are the 'STANDARD', 'ASSOCIATED' or 'PREMULTIPLIED' modes
+ * (the latter being the two common names for associated alpha color channels).
  *
- * Since it is not necessary to perform arithmetic on opaque color values so
- * long as they are not to be resampled and are in the final color space it is
- * possible to optimize the handling of alpha by storing the opaque pixels in
- * the PNG format (adjusted for the output color space) while storing partially
- * opaque pixels in the standard, linear, format.  The accuracy required for
- * standard alpha composition is relatively low, because the pixels are
- * isolated, therefore typically the accuracy loss in storing 8-bit linear
- * values is acceptable.  (This is not true if the alpha channel is used to
- * simulate transparency over large areas - use 16 bits or the PNG mode in
- * this case!)  This is the 'OPTIMIZED' mode.  For this mode a pixel is
- * treated as opaque only if the alpha value is equal to the maximum value.
+ * For the 'OPTIMIZED' mode, a pixel is treated as opaque only if the alpha
+ * value is equal to the maximum value.
  *
  * The final choice is to gamma encode the alpha channel as well.  This is
  * broken because, in practice, no implementation that uses this choice
  * correctly undoes the encoding before handling alpha composition.  Use this
  * choice only if other serious errors in the software or hardware you use
  * mandate it; the typical serious error is for dark halos to appear around
  * opaque areas of the composited PNG image because of arithmetic overflow.
  *
@@ -1281,78 +1274,17 @@ PNG_EXPORT(35, void, png_build_grayscale
 PNG_FP_EXPORT(227, void, png_set_alpha_mode, (png_structrp png_ptr, int mode,
     double output_gamma))
 PNG_FIXED_EXPORT(228, void, png_set_alpha_mode_fixed, (png_structrp png_ptr,
     int mode, png_fixed_point output_gamma))
 #endif
 
 #if defined(PNG_GAMMA_SUPPORTED) || defined(PNG_READ_ALPHA_MODE_SUPPORTED)
 /* The output_gamma value is a screen gamma in libpng terminology: it expresses
- * how to decode the output values, not how they are encoded.  The values used
- * correspond to the normal numbers used to describe the overall gamma of a
- * computer display system; for example 2.2 for an sRGB conformant system.  The
- * values are scaled by 100000 in the _fixed version of the API (so 220000 for
- * sRGB.)
- *
- * The inverse of the value is always used to provide a default for the PNG file
- * encoding if it has no gAMA chunk and if png_set_gamma() has not been called
- * to override the PNG gamma information.
- *
- * When the ALPHA_OPTIMIZED mode is selected the output gamma is used to encode
- * opaque pixels however pixels with lower alpha values are not encoded,
- * regardless of the output gamma setting.
- *
- * When the standard Porter Duff handling is requested with mode 1 the output
- * encoding is set to be linear and the output_gamma value is only relevant
- * as a default for input data that has no gamma information.  The linear output
- * encoding will be overridden if png_set_gamma() is called - the results may be
- * highly unexpected!
- *
- * The following numbers are derived from the sRGB standard and the research
- * behind it.  sRGB is defined to be approximated by a PNG gAMA chunk value of
- * 0.45455 (1/2.2) for PNG.  The value implicitly includes any viewing
- * correction required to take account of any differences in the color
- * environment of the original scene and the intended display environment; the
- * value expresses how to *decode* the image for display, not how the original
- * data was *encoded*.
- *
- * sRGB provides a peg for the PNG standard by defining a viewing environment.
- * sRGB itself, and earlier TV standards, actually use a more complex transform
- * (a linear portion then a gamma 2.4 power law) than PNG can express.  (PNG is
- * limited to simple power laws.)  By saying that an image for direct display on
- * an sRGB conformant system should be stored with a gAMA chunk value of 45455
- * (11.3.3.2 and 11.3.3.5 of the ISO PNG specification) the PNG specification
- * makes it possible to derive values for other display systems and
- * environments.
- *
- * The Mac value is deduced from the sRGB based on an assumption that the actual
- * extra viewing correction used in early Mac display systems was implemented as
- * a power 1.45 lookup table.
- *
- * Any system where a programmable lookup table is used or where the behavior of
- * the final display device characteristics can be changed requires system
- * specific code to obtain the current characteristic.  However this can be
- * difficult and most PNG gamma correction only requires an approximate value.
- *
- * By default, if png_set_alpha_mode() is not called, libpng assumes that all
- * values are unencoded, linear, values and that the output device also has a
- * linear characteristic.  This is only very rarely correct - it is invariably
- * better to call png_set_alpha_mode() with PNG_DEFAULT_sRGB than rely on the
- * default if you don't know what the right answer is!
- *
- * The special value PNG_GAMMA_MAC_18 indicates an older Mac system (pre Mac OS
- * 10.6) which used a correction table to implement a somewhat lower gamma on an
- * otherwise sRGB system.
- *
- * Both these values are reserved (not simple gamma values) in order to allow
- * more precise correction internally in the future.
- *
- * NOTE: the following values can be passed to either the fixed or floating
- * point APIs, but the floating point API will also accept floating point
- * values.
+ * how to decode the output values, not how they are encoded.
  */
 #define PNG_DEFAULT_sRGB -1       /* sRGB gamma and color space */
 #define PNG_GAMMA_MAC_18 -2       /* Old Mac '1.8' gamma and color space */
 #define PNG_GAMMA_sRGB   220000   /* Television standards--matches sRGB gamma */
 #define PNG_GAMMA_LINEAR PNG_FP_1 /* Linear */
 #endif
 
 /* The following are examples of calls to png_set_alpha_mode to achieve the
@@ -1965,18 +1897,18 @@ PNG_EXPORT(98, void, png_free_data, (png
 
 /* Reassign responsibility for freeing existing data, whether allocated
  * by libpng or by the application; this works on the png_info structure passed
  * in, it does not change the state for other png_info structures.
  *
  * It is unlikely that this function works correctly as of 1.6.0 and using it
  * may result either in memory leaks or double free of allocated data.
  */
-PNG_EXPORTA(99, void, png_data_freer, (png_const_structrp png_ptr,
-    png_inforp info_ptr, int freer, png_uint_32 mask), PNG_DEPRECATED);
+PNG_EXPORT(99, void, png_data_freer, (png_const_structrp png_ptr,
+    png_inforp info_ptr, int freer, png_uint_32 mask));
 
 /* Assignments for png_data_freer */
 #define PNG_DESTROY_WILL_FREE_DATA 1
 #define PNG_SET_WILL_FREE_DATA 1
 #define PNG_USER_WILL_FREE_DATA 2
 /* Flags for png_ptr->free_me and info_ptr->free_me */
 #define PNG_FREE_HIST 0x0008
 #define PNG_FREE_ICCP 0x0010
@@ -2533,21 +2465,25 @@ PNG_EXPORT(176, int, png_get_unknown_chu
  * If you need to turn it off for a chunk that your application has freed,
  * you can use png_set_invalid(png_ptr, info_ptr, PNG_INFO_CHNK);
  */
 PNG_EXPORT(177, void, png_set_invalid, (png_const_structrp png_ptr,
     png_inforp info_ptr, int mask));
 
 #ifdef PNG_INFO_IMAGE_SUPPORTED
 /* The "params" pointer is currently not used and is for future expansion. */
+#ifdef PNG_SEQUENTIAL_READ_SUPPORTED
 PNG_EXPORT(178, void, png_read_png, (png_structrp png_ptr, png_inforp info_ptr,
     int transforms, png_voidp params));
+#endif
+#ifdef PNG_WRITE_SUPPORTED
 PNG_EXPORT(179, void, png_write_png, (png_structrp png_ptr, png_inforp info_ptr,
     int transforms, png_voidp params));
 #endif
+#endif
 
 PNG_EXPORT(180, png_const_charp, png_get_copyright,
     (png_const_structrp png_ptr));
 PNG_EXPORT(181, png_const_charp, png_get_header_ver,
     (png_const_structrp png_ptr));
 PNG_EXPORT(182, png_const_charp, png_get_header_version,
     (png_const_structrp png_ptr));
 PNG_EXPORT(183, png_const_charp, png_get_libpng_ver,
--- a/media/libpng/pngconf.h
+++ b/media/libpng/pngconf.h
@@ -1,12 +1,12 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.6.9 - February 6, 2014
+ * libpng version 1.6.10 - March 6, 2014
  *
  * Copyright (c) 1998-2013 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
@@ -371,19 +371,21 @@
 #    endif
 #    if !defined(PNG_ALLOCATED) && __has_attribute(__malloc__)
 #      define PNG_ALLOCATED __attribute__((__malloc__))
 #    endif
 #    if !defined(PNG_DEPRECATED) && __has_attribute(__deprecated__)
 #      define PNG_DEPRECATED __attribute__((__deprecated__))
 #    endif
 #    if !defined(PNG_PRIVATE)
-#      if __has_extension(attribute_unavailable_with_message)
-#        define PNG_PRIVATE __attribute__((__unavailable__(\
-           "This function is not exported by libpng.")))
+#      ifdef __has_extension
+#        if __has_extension(attribute_unavailable_with_message)
+#          define PNG_PRIVATE __attribute__((__unavailable__(\
+             "This function is not exported by libpng.")))
+#        endif
 #      endif
 #    endif
 #    ifndef PNG_RESTRICT
 #      define PNG_RESTRICT __restrict
 #    endif
 
 #  elif defined(__GNUC__)
 #    ifndef PNG_USE_RESULT
--- a/media/libpng/pngerror.c
+++ b/media/libpng/pngerror.c
@@ -1,13 +1,13 @@
 
 /* pngerror.c - stub functions for i/o and memory allocation
  *
- * Last changed in libpng 1.6.8 [December 19, 2013]
- * Copyright (c) 1998-2013 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.10 [March 6, 2014]
+ * Copyright (c) 1998-2014 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * This file provides a location for all error handling.  Users who
@@ -871,18 +871,18 @@ png_set_strip_error_numbers(png_structrp
 #endif
 
 #if defined(PNG_SIMPLIFIED_READ_SUPPORTED) ||\
    defined(PNG_SIMPLIFIED_WRITE_SUPPORTED)
    /* Currently the above both depend on SETJMP_SUPPORTED, however it would be
     * possible to implement without setjmp support just so long as there is some
     * way to handle the error return here:
     */
-PNG_FUNCTION(void /* PRIVATE */,
-png_safe_error,(png_structp png_nonconst_ptr, png_const_charp error_message),
+PNG_FUNCTION(void /* PRIVATE */, (PNGCBAPI
+png_safe_error),(png_structp png_nonconst_ptr, png_const_charp error_message),
    PNG_NORETURN)
 {
    const png_const_structrp png_ptr = png_nonconst_ptr;
    png_imagep image = png_voidcast(png_imagep, png_ptr->error_ptr);
 
    /* An error is always logged here, overwriting anything (typically a warning)
     * that is already there:
     */
@@ -907,17 +907,17 @@ png_safe_error,(png_structp png_nonconst
       }
    }
 
    /* Here on an internal programming error. */
    abort();
 }
 
 #ifdef PNG_WARNINGS_SUPPORTED
-void /* PRIVATE */
+void /* PRIVATE */ PNGCBAPI
 png_safe_warning(png_structp png_nonconst_ptr, png_const_charp warning_message)
 {
    const png_const_structrp png_ptr = png_nonconst_ptr;
    png_imagep image = png_voidcast(png_imagep, png_ptr->error_ptr);
 
    /* A warning is only logged if there is no prior warning or error. */
    if (image->warning_or_error == 0)
    {
--- a/media/libpng/pngpread.c
+++ b/media/libpng/pngpread.c
@@ -1,13 +1,13 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.6.8 [December 19, 2013]
- * Copyright (c) 1998-2013 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.10 [March 6, 2014]
+ * Copyright (c) 1998-2014 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
@@ -230,17 +230,16 @@ png_push_read_chunk(png_structrp png_ptr
          if (png_ptr->push_length + 4 > png_ptr->buffer_size)
          {
             png_push_save_buffer(png_ptr);
             return;
          }
 
          png_push_crc_skip(png_ptr, png_ptr->push_length);
          png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
-         png_ptr->process_mode = PNG_READ_IDAT_MODE;
          return;
       }
       else if (chunk_name == png_fdAT)
       {
          if (png_ptr->buffer_size < 4)
          {
             png_push_save_buffer(png_ptr);
             return;
--- a/media/libpng/pngpriv.h
+++ b/media/libpng/pngpriv.h
@@ -1,17 +1,17 @@
 
 /* pngpriv.h - private declarations for use inside libpng
  *
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2014 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
- * Last changed in libpng 1.6.9 [February 6, 2014]
+ * Last changed in libpng 1.6.10 [March 6, 2014]
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
 /* The symbols declared in this file (including the functions declared
  * as extern) are PRIVATE.  They are not part of the libpng public
@@ -251,16 +251,21 @@
 #  define PNG_INTERNAL_DATA(type, name, array) extern type name array
 #endif
 
 #ifndef PNG_INTERNAL_FUNCTION
 #  define PNG_INTERNAL_FUNCTION(type, name, args, attributes)\
       extern PNG_FUNCTION(type, name, args, PNG_EMPTY attributes)
 #endif
 
+#ifndef PNG_INTERNAL_CALLBACK
+#  define PNG_INTERNAL_CALLBACK(type, name, args, attributes)\
+      extern PNG_FUNCTION(type, (PNGCBAPI name), args, PNG_EMPTY attributes)
+#endif
+
 /* If floating or fixed point APIs are disabled they may still be compiled
  * internally.  To handle this make sure they are declared as the appropriate
  * internal extern function (otherwise the symbol prefixing stuff won't work and
  * the functions will be used without definitions.)
  *
  * NOTE: although all the API functions are declared here they are not all
  * actually built!  Because the declarations are still made it is necessary to
  * fake out types that they depend on.
@@ -1933,21 +1938,21 @@ typedef struct png_control
 #else
 #  define png_control_jmp_buf(pc) ((pc)->error_buf)
 #endif
 
 /* Utility to safely execute a piece of libpng code catching and logging any
  * errors that might occur.  Returns true on success, false on failure (either
  * of the function or as a result of a png_error.)
  */
-PNG_INTERNAL_FUNCTION(void,png_safe_error,(png_structp png_ptr,
+PNG_INTERNAL_CALLBACK(void,png_safe_error,(png_structp png_ptr,
    png_const_charp error_message),PNG_NORETURN);
 
 #ifdef PNG_WARNINGS_SUPPORTED
-PNG_INTERNAL_FUNCTION(void,png_safe_warning,(png_structp png_ptr,
+PNG_INTERNAL_CALLBACK(void,png_safe_warning,(png_structp png_ptr,
    png_const_charp warning_message),PNG_EMPTY);
 #else
 #  define png_safe_warning 0/*dummy argument*/
 #endif
 
 PNG_INTERNAL_FUNCTION(int,png_safe_execute,(png_imagep image,
    int (*function)(png_voidp), png_voidp arg),PNG_EMPTY);
 
--- a/media/libpng/pngread.c
+++ b/media/libpng/pngread.c
@@ -1,12 +1,12 @@
 
 /* pngread.c - read a PNG file
  *
- * Last changed in libpng 1.6.9 [February 6, 2014]
+ * Last changed in libpng 1.6.10 [March 6, 2014]
  * Copyright (c) 1998-2014 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -856,21 +856,24 @@ png_read_end(png_structrp png_ptr, png_i
      png_benign_error(png_ptr, "Read palette index exceeding num_palette");
 #endif
 
    do
    {
       png_uint_32 length = png_read_chunk_header(png_ptr);
       png_uint_32 chunk_name = png_ptr->chunk_name;
 
-      if (chunk_name == png_IHDR)
+      if (chunk_name == png_IEND)
+         png_handle_IEND(png_ptr, info_ptr, length);
+
+      else if (chunk_name == png_IHDR)
          png_handle_IHDR(png_ptr, info_ptr, length);
 
-      else if (chunk_name == png_IEND)
-         png_handle_IEND(png_ptr, info_ptr, length);
+      else if (info_ptr == NULL)
+         png_crc_finish(png_ptr, length);
 
 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
       else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0)
       {
          if (chunk_name == png_IDAT)
          {
             if ((length > 0) || (png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT))
                png_benign_error(png_ptr, "Too many IDATs found");
@@ -1076,143 +1079,170 @@ png_set_read_status_fn(png_structrp png_
 
 #ifdef PNG_SEQUENTIAL_READ_SUPPORTED
 #ifdef PNG_INFO_IMAGE_SUPPORTED
 void PNGAPI
 png_read_png(png_structrp png_ptr, png_inforp info_ptr,
                            int transforms,
                            voidp params)
 {
-   int row;
-
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
    /* png_read_info() gives us all of the information from the
     * PNG file before the first IDAT (image data chunk).
     */
    png_read_info(png_ptr, info_ptr);
    if (info_ptr->height > PNG_UINT_32_MAX/(sizeof (png_bytep)))
       png_error(png_ptr, "Image is too high to process with png_read_png()");
 
    /* -------------- image transformations start here ------------------- */
-
-#ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
+   /* libpng 1.6.10: add code to cause a png_app_error if a selected TRANSFORM
+    * is not implemented.  This will only happen in de-configured (non-default)
+    * libpng builds.  The results can be unexpected - png_read_png may return
+    * short or mal-formed rows because the transform is skipped.
+    */
+
    /* Tell libpng to strip 16-bit/color files down to 8 bits per color.
     */
    if (transforms & PNG_TRANSFORM_SCALE_16)
-   {
      /* Added at libpng-1.5.4. "strip_16" produces the same result that it
       * did in earlier versions, while "scale_16" is now more accurate.
       */
+#ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
       png_set_scale_16(png_ptr);
-   }
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_SCALE_16 not supported");
 #endif
 
-#ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED
    /* If both SCALE and STRIP are required pngrtran will effectively cancel the
     * latter by doing SCALE first.  This is ok and allows apps not to check for
     * which is supported to get the right answer.
     */
    if (transforms & PNG_TRANSFORM_STRIP_16)
+#ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED
       png_set_strip_16(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_STRIP_16 not supported");
 #endif
 
-#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
    /* Strip alpha bytes from the input data without combining with
     * the background (not recommended).
     */
    if (transforms & PNG_TRANSFORM_STRIP_ALPHA)
+#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
       png_set_strip_alpha(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_STRIP_ALPHA not supported");
 #endif
 
-#if defined(PNG_READ_PACK_SUPPORTED) && !defined(PNG_READ_EXPAND_SUPPORTED)
    /* Extract multiple pixels with bit depths of 1, 2, or 4 from a single
     * byte into separate bytes (useful for paletted and grayscale images).
     */
    if (transforms & PNG_TRANSFORM_PACKING)
+#ifdef PNG_READ_PACK_SUPPORTED
       png_set_packing(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_PACKING not supported");
 #endif
 
-#ifdef PNG_READ_PACKSWAP_SUPPORTED
    /* Change the order of packed pixels to least significant bit first
     * (not useful if you are using png_set_packing).
     */
    if (transforms & PNG_TRANSFORM_PACKSWAP)
+#ifdef PNG_READ_PACKSWAP_SUPPORTED
       png_set_packswap(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_PACKSWAP not supported");
 #endif
 
-#ifdef PNG_READ_EXPAND_SUPPORTED
    /* Expand paletted colors into true RGB triplets
     * Expand grayscale images to full 8 bits from 1, 2, or 4 bits/pixel
     * Expand paletted or RGB images with transparency to full alpha
     * channels so the data will be available as RGBA quartets.
     */
    if (transforms & PNG_TRANSFORM_EXPAND)
-      if ((png_ptr->bit_depth < 8) ||
-          (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ||
-          (info_ptr->valid & PNG_INFO_tRNS))
-         png_set_expand(png_ptr);
+#ifdef PNG_READ_EXPAND_SUPPORTED
+      png_set_expand(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_EXPAND not supported");
 #endif
 
    /* We don't handle background color or gamma transformation or quantizing.
     */
 
-#ifdef PNG_READ_INVERT_SUPPORTED
    /* Invert monochrome files to have 0 as white and 1 as black
     */
    if (transforms & PNG_TRANSFORM_INVERT_MONO)
+#ifdef PNG_READ_INVERT_SUPPORTED
       png_set_invert_mono(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_INVERT_MONO not supported");
 #endif
 
-#ifdef PNG_READ_SHIFT_SUPPORTED
    /* If you want to shift the pixel values from the range [0,255] or
     * [0,65535] to the original [0,7] or [0,31], or whatever range the
     * colors were originally in:
     */
-   if ((transforms & PNG_TRANSFORM_SHIFT) && (info_ptr->valid & PNG_INFO_sBIT))
-      png_set_shift(png_ptr, &info_ptr->sig_bit);
+   if (transforms & PNG_TRANSFORM_SHIFT)
+#ifdef PNG_READ_SHIFT_SUPPORTED
+      if (info_ptr->valid & PNG_INFO_sBIT)
+         png_set_shift(png_ptr, &info_ptr->sig_bit);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_SHIFT not supported");
 #endif
 
-#ifdef PNG_READ_BGR_SUPPORTED
    /* Flip the RGB pixels to BGR (or RGBA to BGRA) */
    if (transforms & PNG_TRANSFORM_BGR)
+#ifdef PNG_READ_BGR_SUPPORTED
       png_set_bgr(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_BGR not supported");
 #endif
 
-#ifdef PNG_READ_SWAP_ALPHA_SUPPORTED
    /* Swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR) */
    if (transforms & PNG_TRANSFORM_SWAP_ALPHA)
+#ifdef PNG_READ_SWAP_ALPHA_SUPPORTED
       png_set_swap_alpha(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_SWAP_ALPHA not supported");
 #endif
 
-#ifdef PNG_READ_SWAP_SUPPORTED
    /* Swap bytes of 16-bit files to least significant byte first */
    if (transforms & PNG_TRANSFORM_SWAP_ENDIAN)
+#ifdef PNG_READ_SWAP_SUPPORTED
       png_set_swap(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_SWAP_ENDIAN not supported");
 #endif
 
 /* Added at libpng-1.2.41 */
-#ifdef PNG_READ_INVERT_ALPHA_SUPPORTED
    /* Invert the alpha channel from opacity to transparency */
    if (transforms & PNG_TRANSFORM_INVERT_ALPHA)
+#ifdef PNG_READ_INVERT_ALPHA_SUPPORTED
       png_set_invert_alpha(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_INVERT_ALPHA not supported");
 #endif
 
 /* Added at libpng-1.2.41 */
-#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
    /* Expand grayscale image to RGB */
    if (transforms & PNG_TRANSFORM_GRAY_TO_RGB)
+#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
       png_set_gray_to_rgb(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_GRAY_TO_RGB not supported");
 #endif
 
 /* Added at libpng-1.5.4 */
+   if (transforms & PNG_TRANSFORM_EXPAND_16)
 #ifdef PNG_READ_EXPAND_16_SUPPORTED
-   if (transforms & PNG_TRANSFORM_EXPAND_16)
       png_set_expand_16(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_EXPAND_16 not supported");
 #endif
 
    /* We don't handle adding filler bytes */
 
    /* We use png_read_image and rely on that for interlace handling, but we also
     * call png_read_update_info therefore must turn on interlace handling now:
     */
    (void)png_set_interlace_handling(png_ptr);
@@ -1225,37 +1255,36 @@ png_read_png(png_structrp png_ptr, png_i
 
    /* -------------- image transformations end here ------------------- */
 
    png_free_data(png_ptr, info_ptr, PNG_FREE_ROWS, 0);
    if (info_ptr->row_pointers == NULL)
    {
       png_uint_32 iptr;
 
-      info_ptr->row_pointers = (png_bytepp)png_malloc(png_ptr,
-          info_ptr->height * (sizeof (png_bytep)));
+      info_ptr->row_pointers = png_voidcast(png_bytepp, png_malloc(png_ptr,
+          info_ptr->height * (sizeof (png_bytep))));
+
       for (iptr=0; iptr<info_ptr->height; iptr++)
          info_ptr->row_pointers[iptr] = NULL;
 
       info_ptr->free_me |= PNG_FREE_ROWS;
 
-      for (row = 0; row < (int)info_ptr->height; row++)
-         info_ptr->row_pointers[row] = (png_bytep)png_malloc(png_ptr,
-            png_get_rowbytes(png_ptr, info_ptr));
+      for (iptr = 0; iptr < info_ptr->height; iptr++)
+         info_ptr->row_pointers[iptr] = png_voidcast(png_bytep,
+            png_malloc(png_ptr, info_ptr->rowbytes));
    }
 
    png_read_image(png_ptr, info_ptr->row_pointers);
    info_ptr->valid |= PNG_INFO_IDAT;
 
    /* Read rest of file, and get additional chunks in info_ptr - REQUIRED */
    png_read_end(png_ptr, info_ptr);
 
-   PNG_UNUSED(transforms)   /* Quiet compiler warnings */
    PNG_UNUSED(params)
-
 }
 #endif /* PNG_INFO_IMAGE_SUPPORTED */
 #endif /* PNG_SEQUENTIAL_READ_SUPPORTED */
 
 #ifdef PNG_SIMPLIFIED_READ_SUPPORTED
 /* SIMPLIFIED READ
  *
  * This code currently relies on the sequential reader, though it could easily
--- a/media/libpng/pngrtran.c
+++ b/media/libpng/pngrtran.c
@@ -1,12 +1,12 @@
 
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
- * Last changed in libpng 1.6.9 [February 6, 2014]
+ * Last changed in libpng 1.6.10 [March 6, 2014]
  * Copyright (c) 1998-2014 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
@@ -1358,22 +1358,22 @@ png_init_read_transformations(png_struct
     *  7) PNG_STRIP_ALPHA (if compose)
     *  8) PNG_ENCODE_ALPHA
     *  9) PNG_SCALE_16_TO_8
     * 10) PNG_16_TO_8
     * 11) PNG_QUANTIZE (converts to palette)
     * 12) PNG_EXPAND_16
     * 13) PNG_GRAY_TO_RGB iff PNG_BACKGROUND_IS_GRAY
     * 14) PNG_INVERT_MONO
-    * 15) PNG_SHIFT
-    * 16) PNG_PACK
-    * 17) PNG_BGR
-    * 18) PNG_PACKSWAP
-    * 19) PNG_FILLER (includes PNG_ADD_ALPHA)
-    * 20) PNG_INVERT_ALPHA
+    * 15) PNG_INVERT_ALPHA
+    * 16) PNG_SHIFT
+    * 17) PNG_PACK
+    * 18) PNG_BGR
+    * 19) PNG_PACKSWAP
+    * 20) PNG_FILLER (includes PNG_ADD_ALPHA)
     * 21) PNG_SWAP_ALPHA
     * 22) PNG_SWAP_BYTES
     * 23) PNG_USER_TRANSFORM [must be last]
     */
 #ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
    if ((png_ptr->transformations & PNG_STRIP_ALPHA) &&
       !(png_ptr->transformations & PNG_COMPOSE))
    {
@@ -4902,16 +4902,21 @@ png_do_read_transformations(png_structrp
       png_do_gray_to_rgb(row_info, png_ptr->row_buf + 1);
 #endif
 
 #ifdef PNG_READ_INVERT_SUPPORTED
    if (png_ptr->transformations & PNG_INVERT_MONO)
       png_do_invert(row_info, png_ptr->row_buf + 1);
 #endif
 
+#ifdef PNG_READ_INVERT_ALPHA_SUPPORTED
+   if (png_ptr->transformations & PNG_INVERT_ALPHA)
+      png_do_read_invert_alpha(row_info, png_ptr->row_buf + 1);
+#endif
+
 #ifdef PNG_READ_SHIFT_SUPPORTED
    if (png_ptr->transformations & PNG_SHIFT)
       png_do_unshift(row_info, png_ptr->row_buf + 1,
           &(png_ptr->shift));
 #endif
 
 #ifdef PNG_READ_PACK_SUPPORTED
    if (png_ptr->transformations & PNG_PACK)
@@ -4936,21 +4941,16 @@ png_do_read_transformations(png_structrp
 #endif
 
 #ifdef PNG_READ_FILLER_SUPPORTED
    if (png_ptr->transformations & PNG_FILLER)
       png_do_read_filler(row_info, png_ptr->row_buf + 1,
           (png_uint_32)png_ptr->filler, png_ptr->flags);
 #endif
 
-#ifdef PNG_READ_INVERT_ALPHA_SUPPORTED
-   if (png_ptr->transformations & PNG_INVERT_ALPHA)
-      png_do_read_invert_alpha(row_info, png_ptr->row_buf + 1);
-#endif
-
 #ifdef PNG_READ_SWAP_ALPHA_SUPPORTED
    if (png_ptr->transformations & PNG_SWAP_ALPHA)
       png_do_read_swap_alpha(row_info, png_ptr->row_buf + 1);
 #endif
 
 #ifdef PNG_READ_16BIT_SUPPORTED
 #ifdef PNG_READ_SWAP_SUPPORTED
    if (png_ptr->transformations & PNG_SWAP_BYTES)
--- a/media/libpng/pngrutil.c
+++ b/media/libpng/pngrutil.c
@@ -1,13 +1,13 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.6.8 [December 19, 2013]
- * Copyright (c) 1998-2013 Glenn Randers-Pehrson
+ * Last changed in libpng 1.6.10 [March 6, 2014]
+ * Copyright (c) 1998-2014 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  *
  * This file contains routines that are only called from within
@@ -222,20 +222,17 @@ png_crc_finish(png_structrp png_ptr, png
       if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) ?
           !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) :
           (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE))
       {
          png_chunk_warning(png_ptr, "CRC error");
       }
 
       else
-      {
-         png_chunk_benign_error(png_ptr, "CRC error");
-         return (0);
-      }
+         png_chunk_error(png_ptr, "CRC error");
 
       return (1);
    }
 
    return (0);
 }
 
 /* Compare the CRC stored in the PNG file with that calculated by libpng from
@@ -309,26 +306,21 @@ png_read_buffer(png_structrp png_ptr, pn
       if (buffer != NULL)
       {
          png_ptr->read_buffer = buffer;
          png_ptr->read_buffer_size = new_size;
       }
 
       else if (warn < 2) /* else silent */
       {
-#ifdef PNG_WARNINGS_SUPPORTED
          if (warn)
              png_chunk_warning(png_ptr, "insufficient memory to read chunk");
+
          else
-#endif
-         {
-#ifdef PNG_ERROR_TEXT_SUPPORTED
              png_chunk_error(png_ptr, "insufficient memory to read chunk");
-#endif
-         }
       }
    }
 
    return buffer;
 }
 #endif /* PNG_READ_iCCP|iTXt|pCAL|sCAL|sPLT|tEXt|zTXt|SEQUENTIAL_READ */
 
 /* png_inflate_claim: claim the zstream for some nefarious purpose that involves
@@ -986,32 +978,25 @@ png_handle_PLTE(png_structrp png_ptr, pn
        *
        * IMPLEMENTATION NOTE: this is only here because png_crc_finish uses the
        * chunk type to determine whether to check the ancillary or the critical
        * flags.
        */
       if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE))
       {
          if (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)
-         {
-            png_chunk_benign_error(png_ptr, "CRC error");
-         }
+            return;
 
          else
-         {
-            png_chunk_warning(png_ptr, "CRC error");
-            return;
-         }
+            png_chunk_error(png_ptr, "CRC error");
       }
 
       /* Otherwise, we (optionally) emit a warning and use the chunk. */
       else if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN))
-      {
          png_chunk_warning(png_ptr, "CRC error");
-      }
    }
 #endif
 
    /* TODO: png_set_PLTE has the side effect of setting png_ptr->palette to its
     * own copy of the palette.  This has the side effect that when png_start_row
     * is called (this happens after any call to png_read_update_info) the
     * info_ptr palette gets changed.  This is extremely unexpected and
     * confusing.
@@ -1112,23 +1097,22 @@ png_handle_gAMA(png_structrp png_ptr, pn
    png_colorspace_sync(png_ptr, info_ptr);
 }
 #endif
 
 #ifdef PNG_READ_sBIT_SUPPORTED
 void /* PRIVATE */
 png_handle_sBIT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
 {
-   unsigned int truelen;
+   unsigned int truelen, i;
+   png_byte sample_depth;
    png_byte buf[4];
 
    png_debug(1, "in png_handle_sBIT");
 
-   buf[0] = buf[1] = buf[2] = buf[3] = 0;
-
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_chunk_error(png_ptr, "missing IHDR");
 
    else if (png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE))
    {
       png_crc_finish(png_ptr, length);
       png_chunk_benign_error(png_ptr, "out of place");
       return;
@@ -1137,33 +1121,47 @@ png_handle_sBIT(png_structrp png_ptr, pn
    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT))
    {
       png_crc_finish(png_ptr, length);
       png_chunk_benign_error(png_ptr, "duplicate");
       return;
    }
 
    if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
+   {
       truelen = 3;
+      sample_depth = 8;
+   }
 
    else
+   {
       truelen = png_ptr->channels;
+      sample_depth = png_ptr->bit_depth;
+   }
 
    if (length != truelen || length > 4)
    {
       png_chunk_benign_error(png_ptr, "invalid");
       png_crc_finish(png_ptr, length);
       return;
    }
 
+   buf[0] = buf[1] = buf[2] = buf[3] = sample_depth;
    png_crc_read(png_ptr, buf, truelen);
 
    if (png_crc_finish(png_ptr, 0))
       return;
 
+   for (i=0; i<truelen; ++i)
+      if (buf[i] == 0 || buf[i] > sample_depth)
+      {
+         png_chunk_benign_error(png_ptr, "invalid");
+         return;
+      }
+
    if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)
    {
       png_ptr->sig_bit.red = buf[0];
       png_ptr->sig_bit.green = buf[1];
       png_ptr->sig_bit.blue = buf[2];
       png_ptr->sig_bit.alpha = buf[3];
    }
 
@@ -1423,17 +1421,17 @@ png_handle_iCCP(png_structrp png_ptr, pn
                               (sizeof profile_header));
 
                            size = 12 * tag_count;
 
                            (void)png_inflate_read(png_ptr, local_buffer,
                               (sizeof local_buffer), &length,
                               profile + (sizeof profile_header), &size, 0);
 
-                           /* Still expect a a buffer error because we expect
+                           /* Still expect a buffer error because we expect
                             * there to be some tag data!
                             */
                            if (size == 0)
                            {
                               if (png_icc_check_tag_table(png_ptr,
                                  &png_ptr->colorspace, keyword, profile_length,
                                  profile))
                               {
--- a/media/libpng/pngwrite.c
+++ b/media/libpng/pngwrite.c
@@ -1,12 +1,12 @@
 
 /* pngwrite.c - general routines to write a PNG file
  *
- * Last changed in libpng 1.6.9 [February 6, 2014]
+ * Last changed in libpng 1.6.10 [March 6, 2014]
  * Copyright (c) 1998-2014 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
@@ -1550,91 +1550,127 @@ png_set_write_user_transform_fn(png_stru
 #ifdef PNG_INFO_IMAGE_SUPPORTED
 void PNGAPI
 png_write_png(png_structrp png_ptr, png_inforp info_ptr,
     int transforms, voidp params)
 {
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
+   if ((info_ptr->valid & PNG_INFO_IDAT) == 0)
+   {
+      png_app_error(png_ptr, "no rows for png_write_image to write");
+      return;
+   }
+
    /* Write the file header information. */
    png_write_info(png_ptr, info_ptr);
 
    /* ------ these transformations don't touch the info structure ------- */
 
-#ifdef PNG_WRITE_INVERT_SUPPORTED
    /* Invert monochrome pixels */
    if (transforms & PNG_TRANSFORM_INVERT_MONO)
+#ifdef PNG_WRITE_INVERT_SUPPORTED
       png_set_invert_mono(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_INVERT_MONO not supported");
 #endif
 
-#ifdef PNG_WRITE_SHIFT_SUPPORTED
    /* Shift the pixels up to a legal bit depth and fill in
     * as appropriate to correctly scale the image.
     */
-   if ((transforms & PNG_TRANSFORM_SHIFT)
-       && (info_ptr->valid & PNG_INFO_sBIT))
-      png_set_shift(png_ptr, &info_ptr->sig_bit);
+   if (transforms & PNG_TRANSFORM_SHIFT)
+#ifdef PNG_WRITE_SHIFT_SUPPORTED
+      if (info_ptr->valid & PNG_INFO_sBIT)
+         png_set_shift(png_ptr, &info_ptr->sig_bit);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_SHIFT not supported");
 #endif
 
-#ifdef PNG_WRITE_PACK_SUPPORTED
    /* Pack pixels into bytes */
    if (transforms & PNG_TRANSFORM_PACKING)
-       png_set_packing(png_ptr);
+#ifdef PNG_WRITE_PACK_SUPPORTED
+      png_set_packing(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_PACKING not supported");
 #endif
 
-#ifdef PNG_WRITE_SWAP_ALPHA_SUPPORTED
    /* Swap location of alpha bytes from ARGB to RGBA */
    if (transforms & PNG_TRANSFORM_SWAP_ALPHA)
+#ifdef PNG_WRITE_SWAP_ALPHA_SUPPORTED
       png_set_swap_alpha(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_SWAP_ALPHA not supported");
 #endif
 
+   /* Remove a filler (X) from XRGB/RGBX/AG/GA into to convert it into
+    * RGB, note that the code expects the input color type to be G or RGB; no
+    * alpha channel.
+    */
+   if (transforms &
+      (PNG_TRANSFORM_STRIP_FILLER_AFTER|PNG_TRANSFORM_STRIP_FILLER_BEFORE))
+   {
 #ifdef PNG_WRITE_FILLER_SUPPORTED
-   /* Pack XRGB/RGBX/ARGB/RGBA into RGB (4 channels -> 3 channels) */
-   if (transforms & PNG_TRANSFORM_STRIP_FILLER_AFTER)
-      png_set_filler(png_ptr, 0, PNG_FILLER_AFTER);
+      if (transforms & PNG_TRANSFORM_STRIP_FILLER_AFTER)
+      {
+         if (transforms & PNG_TRANSFORM_STRIP_FILLER_BEFORE)
+            png_app_error(png_ptr,
+               "PNG_TRANSFORM_STRIP_FILLER: BEFORE+AFTER not supported");
 
-   else if (transforms & PNG_TRANSFORM_STRIP_FILLER_BEFORE)
-      png_set_filler(png_ptr, 0, PNG_FILLER_BEFORE);
+         /* Continue if ignored - this is the pre-1.6.10 behavior */
+         png_set_filler(png_ptr, 0, PNG_FILLER_AFTER);
+      }
+
+      else if (transforms & PNG_TRANSFORM_STRIP_FILLER_BEFORE)
+         png_set_filler(png_ptr, 0, PNG_FILLER_BEFORE);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_STRIP_FILLER not supported");
 #endif
+   }
 
-#ifdef PNG_WRITE_BGR_SUPPORTED
    /* Flip BGR pixels to RGB */
    if (transforms & PNG_TRANSFORM_BGR)
+#ifdef PNG_WRITE_BGR_SUPPORTED
       png_set_bgr(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_BGR not supported");
 #endif
 
-#ifdef PNG_WRITE_SWAP_SUPPORTED
    /* Swap bytes of 16-bit files to most significant byte first */
    if (transforms & PNG_TRANSFORM_SWAP_ENDIAN)
+#ifdef PNG_WRITE_SWAP_SUPPORTED
       png_set_swap(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_SWAP_ENDIAN not supported");
 #endif
 
-#ifdef PNG_WRITE_PACKSWAP_SUPPORTED
    /* Swap bits of 1, 2, 4 bit packed pixel formats */
    if (transforms & PNG_TRANSFORM_PACKSWAP)
+#ifdef PNG_WRITE_PACKSWAP_SUPPORTED
       png_set_packswap(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_PACKSWAP not supported");
 #endif
 
-#ifdef PNG_WRITE_INVERT_ALPHA_SUPPORTED
    /* Invert the alpha channel from opacity to transparency */
    if (transforms & PNG_TRANSFORM_INVERT_ALPHA)
+#ifdef PNG_WRITE_INVERT_ALPHA_SUPPORTED
       png_set_invert_alpha(png_ptr);
+#else
+      png_app_error(png_ptr, "PNG_TRANSFORM_INVERT_ALPHA not supported");
 #endif
 
    /* ----------------------- end of transformations ------------------- */
 
    /* Write the bits */
-   if (info_ptr->valid & PNG_INFO_IDAT)
-       png_write_image(png_ptr, info_ptr->row_pointers);
+   png_write_image(png_ptr, info_ptr->row_pointers);
 
    /* It is REQUIRED to call this to finish writing the rest of the file */
    png_write_end(png_ptr, info_ptr);
 
-   PNG_UNUSED(transforms)   /* Quiet compiler warnings */
    PNG_UNUSED(params)
 }
 #endif
 
 
 #ifdef PNG_SIMPLIFIED_WRITE_SUPPORTED
 #ifdef PNG_STDIO_SUPPORTED /* currently required for png_image_write_* */
 /* Initialize the write structure - general purpose utility. */
--- a/media/libpng/pngwutil.c
+++ b/media/libpng/pngwutil.c
@@ -2401,17 +2401,18 @@ png_do_write_interlace(png_row_infop row
    }
 }
 #endif
 
 /* This filters the row, chooses which filter to use, if it has not already
  * been specified by the application, and then writes the row out with the
  * chosen filter.
  */
-static void png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
+static void
+png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
    png_size_t row_bytes);
 
 #define PNG_MAXSUM (((png_uint_32)(-1)) >> 1)
 #define PNG_HISHIFT 10
 #define PNG_LOMASK ((png_uint_32)0xffffL)
 #define PNG_HIMASK ((png_uint_32)(~PNG_LOMASK >> PNG_HISHIFT))
 void /* PRIVATE */
 png_write_find_filter(png_structrp png_ptr, png_row_infop row_info)