[LIBPNG]

- Sync to 1.5.12. Patch by Vincenzo Cotugno.
See issue #7202 for more details.

svn path=/trunk/; revision=57042

reactos/dll/3rdparty/libpng/docs/ANNOUNCE

@@ -1,5 +1,5 @@
 
-Libpng 1.5.2 - March 31, 2011
+Libpng 1.5.12 - July 11, 2012
 
 This is a public release of libpng, intended for use in production codes.
 
@@ -8,55 +8,31 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script
 
-   libpng-1.5.2.tar.xz (LZMA-compressed, recommended)
+   libpng-1.5.12.tar.xz (LZMA-compressed, recommended)
-   libpng-1.5.2.tar.gz
+   libpng-1.5.12.tar.gz
-   libpng-1.5.2.tar.bz2
+   libpng-1.5.12.tar.bz2
 
 Source files with CRLF line endings (for Windows), without the
 "configure" script
 
-   lpng152.7z  (LZMA-compressed, recommended)
+   lpng1512.7z  (LZMA-compressed, recommended)
-   lpng152.zip
+   lpng1512.zip
 
 Other information:
 
-   libpng-1.5.2-README.txt
+   libpng-1.5.12-README.txt
-   libpng-1.5.2-LICENSE.txt
+   libpng-1.5.12-LICENSE.txt
 
-Changes since the last public release (1.5.2):
+Changes since the last public release (1.5.11):
 
-  More -Wshadow fixes for older gcc compilers.  Older gcc versions apparently
+  Removed scripts/makefile.cegcc from the *.zip and *.7z distributions; it
-    check formal parameters names in function declarations (as well as
+    depends on configure, which is not included in those archives.
-    definitions) to see if they match a name in the global namespace.
+  Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386.
-  Revised PNG_EXPORTA macro to not use an empty parameter, to accommodate the
-    old VisualC++ preprocessor.
-  Turned on interlace handling in png_read_png().
-  Fixed gcc pendantic warnings.
-  Handle longjmp in Cygwin.
-  Fixed png_get_current_row_number() in the interlaced case.
-  Cleaned up ALPHA flags and transformations.
-  Implemented expansion to 16 bits.
-  Fixed mistake in the descriptions of user read_transform and write_transform
-    function prototypes in the manual.  The row_info struct is png_row_infop.
-  Corrected png_get_current_row_number documentation
-  Fixed the read/write row callback documentation.
-    This documents the current behavior, where the callback is called after
-    every row with information pertaining to the next row.
-  Fixed scripts/makefile.vcwin32
-  Updated contrib/pngsuite/README to add the word "modify".
-  Define PNG_ALLOCATED and other attributes to blank when _MSC_VER<1300.
-  ifdef out mask arrays in pngread.c when interlacing is not supported.
-  Added a hint to try CPP=/bin/cpp if "cpp -E" fails in scripts/pnglibconf.mak
-    and in contrib/pngminim/*/makefile, eg., on SunOS 5.10, and removed "strip"
-    from the makefiles.
-  Fixed a bug (present since libpng-1.0.7) that makes png_handle_sPLT() fail
-    to compile when PNG_NO_POINTER_INDEXING is defined (Chubanov Kirill)
-  Don't include standard header files in png.h while building the symbol table,
-    to avoid cpp failure on SunOS (introduced PNG_BUILDING_SYMBOL_TABLE macro).
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
-to subscribe) or to glennrp at users.sourceforge.net
+to subscribe)
+or to glennrp at users.sourceforge.net
 
 Glenn R-P

reactos/dll/3rdparty/libpng/docs/CHANGES

@@ -1,5 +1,4 @@
 #if 0
-libpng_changes(){ /*
 CHANGES - changes for libpng
 
 Version 0.2
@@ -15,7 +14,7 @@ Version 0.3
   fixed some bugs in writer
   interfaced with zlib 0.5
   added K&R support
-  added check for 64 KB blocks for 16 bit machines
+  added check for 64 KB blocks for 16-bit machines
 
 Version 0.4
   cleaned up code and commented code
@@ -74,7 +73,7 @@ Version 0.82 [September, 1995]
 Version 0.85 [December, 1995]
   added more medium model code (almost everything's a far)
   added i/o, error, and memory callback functions
-  fixed some bugs (16 bit, 4 bit interlaced, etc.)
+  fixed some bugs (16-bit, 4-bit interlaced, etc.)
   added first run progressive reader (barely tested)
 
 Version 0.86 [January, 1996]
@@ -180,7 +179,7 @@ Version 0.96 [May, 1997]
   Fixed serious bug with < 8bpp images introduced in 0.95
   Fixed 256-color transparency bug (Greg Roelofs)
   Fixed up documentation (Greg Roelofs, Laszlo Nyul)
-  Fixed "error" in pngconf.h for Linux setjmp() behaviour
+  Fixed "error" in pngconf.h for Linux setjmp() behavior
   Fixed DOS medium model support (Tim Wegner)
   Fixed png_check_keyword() for case with error in static string text
   Added read of CRC after IEND chunk for embedded PNGs (Laszlo Nyul)
@@ -197,18 +196,20 @@ Version 0.97 [January, 1998]
   Added more typecasts. 65536L becomes (png_uint_32)65536L, etc. (Glenn R-P)
   Minor corrections in libpng.txt
   Added simple sRGB support (Glenn R-P)
-  Easier conditional compiling, e.g. define PNG_READ/WRITE_NOT_FULLY_SUPPORTED;
+  Easier conditional compiling, e.g.,
+    define PNG_READ/WRITE_NOT_FULLY_SUPPORTED;
     all configurable options can be selected from command-line instead
     of having to edit pngconf.h (Glenn R-P)
   Fixed memory leak in pngwrite.c (free info_ptr->text) (Glenn R-P)
   Added more conditions for png_do_background, to avoid changing
     black pixels to background when a background is supplied and
     no pixels are transparent
-  Repaired PNG_NO_STDIO behaviour
+  Repaired PNG_NO_STDIO behavior
-  Tested NODIV support and made it default behaviour (Greg Roelofs)
+  Tested NODIV support and made it default behavior (Greg Roelofs)
   Added "-m" option and PNGTEST_DEBUG_MEMORY to pngtest (John Bowler)
   Regularized version numbering scheme and bumped shared-library major
-     version number to 2 to avoid problems with libpng 0.89 apps (Greg Roelofs)
+    version number to 2 to avoid problems with libpng 0.89 apps
+    (Greg Roelofs)
 
 Version 0.98 [January, 1998]
   Cleaned up some typos in libpng.txt and in code documentation
@@ -1778,7 +1779,7 @@ Version 1.2.13beta1 [October 2, 2006]
   Removed AC_FUNC_MALLOC from configure.ac
   Work around Intel-Mac compiler bug by setting PNG_NO_MMX_CODE in pngconf.h
   Change "logical" to "bitwise" throughout documentation.
-  Detect and fix attempt to write wrong iCCP profile length.
+  Detect and fix attempt to write wrong iCCP profile length (CVE-2006-7244)
 
 Version 1.0.21, 1.2.13 [November 14, 2006]
   Fix potential buffer overflow in sPLT chunk handler.
@@ -2361,7 +2362,7 @@ Version 1.4.0beta72 [August 1, 2009]
 
 Version 1.4.0beta73 [August 1, 2009]
   Reject attempt to write iCCP chunk with negative embedded profile length
-    (JD Chen)
+    (JD Chen) (CVE-2009-5063).
 
 Version 1.4.0beta74 [August 8, 2009]
   Changed png_ptr and info_ptr member "trans" to "trans_alpha".
@@ -2935,7 +2936,7 @@ Version 1.5.0beta36 [July 29, 2010]
     PNG_INTERLACE transform and to get the number of rows in the current
     pass.
   A new test program, pngvalid.c, validates the gamma code.
-  Errors in the 16 bit gamma correction (overflows) have been corrected.
+  Errors in the 16-bit gamma correction (overflows) have been corrected.
   cHRM chunk testing is done consistently (previously the floating point
     API bypassed it, because the test really didn't work on FP, now the test
     is performed on the actual values to be stored in the PNG file so it
@@ -3149,8 +3150,8 @@ version 1.5.1beta01 [January 8, 2011]
     in version 1.5.0beta36 but is not noted in the CHANGES.  Similarly,
     it was changed from png_charpp to png_const_bytepp in png_set_iCCP().
   Ensure that png_rgb_to_gray ignores palette mapped images, if libpng
-    internally happens to call it with one.
+    internally happens to call it with one, and fixed a failure to handle
-  Fixed a failure to handle palette mapped images correctly.
+    palette mapped images correctly.  This fixes CVE-2690.
 
 Version 1.5.1beta02 [January 14, 2011]
   Fixed a bug in handling of interlaced images (bero at arklinux.org).
@@ -3208,9 +3209,9 @@ Version 1.5.1beta09 [January 24, 2011]
     pngvalid contains tests of transforms, which tests are currently disabled
     because they are incompletely tested.  gray_to_rgb was failing to expand
     the bit depth for smaller bit depth images; this seems to be a long
-    standing error and resulted, apparently, in invalid output.  The
+    standing error and resulted, apparently, in invalid output
-    documentation did not accurately describe what libpng really does when
+    (CVE-2011-0408, CERT VU#643140).  The documentation did not accurately
-    converting RGB to gray.
+    describe what libpng really does when converting RGB to gray.
 
 Version 1.5.1beta10 [January 27, 2010]
   Fixed incorrect examples of callback prototypes in the manual, that were
@@ -3227,7 +3228,7 @@ Version 1.5.1beta10 [January 27, 2010]
 Version 1.5.1beta11 [January 28, 2011]
   Changed PNG_UNUSED from "param=param;" to "{if(param){}}".
   Corrected local variable type in new API png_process_data_skip()
-    The type was self-evidently incorrect but only causes problems on 64 bit
+    The type was self-evidently incorrect but only causes problems on 64-bit
     architectures.
   Added transform tests to pngvalid and simplified the arguments.
 
@@ -3285,6 +3286,615 @@ Version 1.5.2rc03 [March 24, 2011]
     to avoid cpp failure on SunOS (introduced PNG_BUILDING_SYMBOL_TABLE macro).
 
 Version 1.5.2 [March 31, 2011]
+  No changes.
+
+Version 1.5.3beta01 [April 1, 2011]
+  Re-initialize the zlib compressor before compressing non-IDAT chunks.
+  Added API functions (png_set_text_compression_level() and four others) to
+    set parameters for zlib compression of non-IDAT chunks.
+
+Version 1.5.3beta02 [April 3, 2011]
+  Updated scripts/symbols.def with new API functions.
+  Only compile the new zlib re-initializing code when text or iCCP is
+    supported, using PNG_WRITE_COMPRESSED_TEXT_SUPPORTED macro.
+  Improved the optimization of the zlib CMF byte (see libpng-1.2.6beta03).
+  Optimize the zlib CMF byte in non-IDAT compressed chunks
+
+Version 1.5.3beta03 [April 16, 2011]
+  Fixed gcc -ansi -pedantic compile. A strict ANSI system does not have
+    snprintf, and the "__STRICT_ANSI__" detects that condition more reliably
+    than __STDC__ (John Bowler).
+  Removed the PNG_PTR_NORETURN attribute because it too dangerous. It tells
+    the compiler that a user supplied callback (the error handler) does not
+    return, yet there is no guarantee in practice that the application code
+    will correctly implement the error handler because the compiler only
+    issues a warning if there is a mistake (John Bowler).
+  Removed the no-longer-used PNG_DEPSTRUCT macro.
+  Updated the zlib version to 1.2.5 in the VStudio project.
+  Fixed 64-bit builds where png_uint_32 is smaller than png_size_t in
+    pngwutil.c (John Bowler).
+  Fixed bug with stripping the filler or alpha channel when writing, that
+    was introduced in libpng-1.5.2beta01 (bug report by Andrew Church).
+
+Version 1.5.3beta04 [April 27, 2011]
+  Updated pngtest.png with the new zlib CMF optimization.
+  Cleaned up conditional compilation code and of background/gamma handling
+    Internal changes only except a new option to avoid compiling the
+    png_build_grayscale_palette API (which is not used at all internally.)
+    The main change is to move the transform tests (READ_TRANSFORMS,
+    WRITE_TRANSFORMS) up one level to the caller of the APIs.  This avoids
+    calls to spurious functions if all transforms are disabled and slightly
+    simplifies those functions.  Pngvalid modified to handle this.
+    A minor change is to stop the strip_16 and expand_16 interfaces from
+    disabling each other; this allows the future alpha premultiplication
+    code to use 16-bit intermediate values while still producing 8-bit output.
+    png_do_background and png_do_gamma have been simplified to take a single
+    pointer to the png_struct rather than pointers to every item required
+    from the png_struct. This makes no practical difference to the internal
+    code.
+  A serious bug in the pngvalid internal routine 'standard_display_init' has
+    been fixed - this failed to initialize the red channel and accidentally
+    initialized the alpha channel twice.
+  Changed png_struct jmp_buf member name from png_jmpbuf to tmp_jmpbuf to
+    avoid a possible clash with the png_jmpbuf macro on some platforms.
+
+Version 1.5.3beta05 [May 6, 2011]
+  Added the "_POSIX_SOURCE" feature test macro to ensure libpng sees the
+    correct API. _POSIX_SOURCE is defined in pngpriv.h, pngtest.c and
+    pngvalid.c to ensure that POSIX conformant systems disable non-POSIX APIs.
+  Removed png_snprintf and added formatted warning messages.  This change adds
+    internal APIs to allow png_warning messages to have parameters without
+    requiring the host OS to implement snprintf.  As a side effect the
+    dependency of the tIME-supporting RFC1132 code on stdio is removed and
+    PNG_NO_WARNINGS does actually work now.
+  Pass "" instead of '\0' to png_default_error() in png_err().  This mistake
+    was introduced in libpng-1.2.20beta01.  This fixes CVE-2011-2691.
+  Added PNG_WRITE_OPTIMIZE_CMF_SUPPORTED macro to make the zlib "CMF" byte
+    optimization configureable.
+  IDAT compression failed if preceded by a compressed text chunk (bug
+    introduced in libpng-1.5.3beta01-02).  This was because the attempt to
+    reset the zlib stream in png_write_IDAT happened after the first IDAT
+    chunk had been deflated - much too late.  In this change internal
+    functions were added to claim/release the z_stream and, hopefully, make
+    the code more robust.  Also deflateEnd checking is added - previously
+    libpng would ignore an error at the end of the stream.
+
+Version 1.5.3beta06 [May 8, 2011]
+  Removed the -D_ALL_SOURCE from definitions for AIX in CMakeLists.txt
+  Implemented premultiplied alpha support: png_set_alpha_mode API
+
+Version 1.5.3beta07 [May 11, 2011]
+  Added expand_16 support to the high level interface.
+  Added named value and 'flag' gamma support to png_set_gamma.  Made a minor
+    change from the previous (unreleased) ABI/API to hide the exact value used
+    for Macs - it's not a good idea to embed this in the ABI!
+  Moved macro definitions for PNG_HAVE_IHDR, PNG_HAVE_PLTE, and PNG_AFTER_IDAT
+    from pngpriv.h to png.h because they must be visible to applications
+    that call png_set_unknown_chunks().
+  Check for up->location !PNG_AFTER_IDAT when writing unknown chunks
+    before IDAT.
+
+Version 1.5.3beta08 [May 16, 2011]
+  Improved "pngvalid --speed" to exclude more of pngvalid from the time.
+  Documented png_set_alpha_mode(), other changes in libpng.3/libpng-manual.txt
+  The cHRM chunk now sets the defaults for png_set_rgb_to_gray() (when negative
+    parameters are supplied by the caller), while in the absence of cHRM
+    sRGB/Rec 709 values are still used.  This introduced a divide-by-zero
+    bug in png_handle_cHRM().
+  The bKGD chunk no longer overwrites the background value set by
+    png_set_background(), allowing the latter to be used before the file
+    header is read. It never performed any useful function to override
+    the default anyway.
+  Added memory overwrite and palette image checks to pngvalid.c
+    Previously palette image code was poorly checked. Since the transformation
+    code has a special palette path in most cases this was a severe weakness.
+  Minor cleanup and some extra checking in pngrutil.c and pngrtran.c. When
+    expanding an indexed image, always expand to RGBA if transparency is
+    present.
+
+Version 1.5.3beta09 [May 17, 2011]
+  Reversed earlier 1.5.3 change of transformation order; move png_expand_16
+    back where it was.  The change doesn't work because it requires 16-bit
+    gamma tables when the code only generates 8-bit ones.  This fails
+    silently; the libpng code just doesn't do any gamma correction.  Moving
+    the tests back leaves the old, inaccurate, 8-bit gamma calculations, but
+    these are clearly better than none!
+
+Version 1.5.3beta10 [May 20, 2011]
+
+  png_set_background() and png_expand_16() did not work together correctly.
+    This problem is present in 1.5.2; if png_set_background is called with
+    need_expand false and the matching 16 bit color libpng erroneously just
+    treats it as an 8-bit color because of where png_do_expand_16 is in the
+    transform list.  This simple fix reduces the supplied colour to 8-bits,
+    so it gets smashed, but this is better than the current behavior.
+  Added tests for expand16, more fixes for palette image tests to pngvalid.
+    Corrects the code for palette image tests and disables attempts to
+    validate palette colors.
+
+Version 1.5.3rc01 [June 3, 2011]
+  No changes.
+
+Version 1.5.3rc02 [June 8, 2011]
+  Fixed uninitialized memory read in png_format_buffer() (Bug report by
+    Frank Busse, CVE-2011-2501, related to CVE-2004-0421).
+
+Version 1.5.3beta11 [June 11, 2011]
+  Fixed png_handle_sCAL which is broken in 1.5. This fixes CVE 2011-2692.
+  Added sCAL to pngtest.png
+  Revised documentation about png_set_user_limits() to say that it also affects
+    png writing.
+  Revised handling of png_set_user_limits() so that it can increase the
+    limit beyond the PNG_USER_WIDTH|HEIGHT_MAX; previously it could only
+    reduce it.
+  Make the 16-to-8 scaling accurate. Dividing by 256 with no rounding is
+    wrong (high by one) 25% of the time. Dividing by 257 with rounding is
+    wrong in 128 out of 65536 cases. Getting the right answer all the time
+    without division is easy.
+  Added "_SUPPORTED" to the PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION macro.
+  Added projects/owatcom, an IDE project for OpenWatcom to replace
+    scripts/makefile.watcom.  This project works with OpenWatcom 1.9. The
+    IDE autogenerates appropriate makefiles (libpng.mk) for batch processing.
+    The project is configurable, unlike the Visual Studio project, so long
+    as the developer has an awk.
+  Changed png_set_gAMA to limit the gamma value range so that the inverse
+    of the stored value cannot overflow the fixed point representation,
+    and changed other things OpenWatcom warns about.
+  Revised pngvalid.c to test PNG_ALPHA_MODE_SUPPORTED correctly. This allows
+    pngvalid to build when ALPHA_MODE is not supported, which is required if
+    it is to build on libpng 1.4.
+  Removed string/memory macros that are no longer used and are not
+    necessarily fully supportable, particularly png_strncpy and png_snprintf.
+  Added log option to pngvalid.c and attempted to improve gamma messages.
+
+Version 1.5.3 [omitted]
+  People found the presence of a beta release following an rc release
+    to be confusing; therefore we bump the version to libpng-1.5.4beta01
+    and there will be no libpng-1.5.3 release.
+
+Version 1.5.4beta01 [June 14, 2011]
+  Made it possible to undefine PNG_READ_16_TO_8_ACCURATE_SCALE_SUPPORTED
+    to get the same (inaccurate) output as libpng-1.5.2 and earlier.
+  Moved definitions of PNG_HAVE_IHDR, PNG_AFTER_IDAT, and PNG_HAVE_PLTE
+    outside of an unknown-chunk block in png.h because they are also
+    needed for other uses.
+
+Version 1.5.4beta02 [June 14, 2011]
+  Fixed and clarified LEGACY 16-to-8 scaling code.
+  Added png_set_chop_16() API, to match inaccurate results from previous
+    libpng versions.
+  Removed the ACCURATE and LEGACY options (they are no longer useable)
+  Use the old scaling method for background if png_set_chop_16() was
+    called.
+  Made png_set_chop_16() API removeable by disabling PNG_CHOP_16_TO_8_SUPPORTED
+
+Version 1.5.4beta03 [June 15, 2011]
+  Fixed a problem in png_do_expand_palette() exposed by optimization in
+    1.5.3beta06
+  Also removed a spurious and confusing "trans" member ("trans") from png_info.
+  The palette expand optimization prevented expansion to an intermediate RGBA
+    form if tRNS was present but alpha was marked to be stripped; this exposed
+    a check for tRNS in png_do_expand_palette() which is inconsistent with the
+    code elsewhere in libpng.
+  Correction to the expand_16 code; removed extra instance of
+    png_set_scale_16_to_8 from pngpriv.h
+
+Version 1.5.4beta04 [June 16, 2011]
+  Added a missing "#ifdef PNG_READ_BACKGROUND_SUPPORTED/#endif" in pngrtran.c
+  Added PNG_TRANSFORM_CHOP_16 to the high-level read transforms.
+  Made PNG_READ_16_TO_8_ACCURATE_SCALE configurable again.  If this is
+    not enabled, png_set_strip_16() and png_do_scale_16_to_8() aren't built.
+  Revised contrib/visupng, gregbook, and pngminim to demonstrate chop_16_to_8
+
+Version 1.5.4beta05 [June 16, 2011]
+  Renamed png_set_strip_16() to png_set_scale_16() and renamed
+    png_set_chop_16() to png_set_strip(16) in an attempt to minimize the
+    behavior changes between libpng14 and libpng15.
+
+Version 1.5.4beta06 [June 18, 2011]
+  Fixed new bug that was causing both strip_16 and scale_16 to be applied.
+
+Version 1.5.4beta07 [June 19, 2011]
+  Fixed pngvalid, simplified macros, added checking for 0 in sCAL.
+    The ACCURATE scale macro is no longer defined in 1.5 - call the
+    png_scale_16_to_8 API.  Made sure that PNG_READ_16_TO_8 is still defined
+    if the png_strip_16_to_8 API is present.  png_check_fp_number now
+    maintains some state so that positive, negative and zero values are
+    identified.  sCAL uses these to be strictly spec conformant.
+
+Version 1.5.4beta08 [June 23, 2011]
+  Fixed pngvalid if ACCURATE_SCALE is defined.
+  Updated scripts/pnglibconf.h.prebuilt.
+
+Version 1.5.4rc01 [June 30, 2011]
+  Define PNG_ALLOCATED to "restrict" only if MSC_VER >= 1400.
+
+Version 1.5.4 [July 7, 2011]
+  No changes.
+
+Version 1.5.5beta01 [July 13, 2011]
+  Fixed some typos and made other minor changes in the manual.
+  Updated contrib/pngminus/makefile.std (Samuli Souminen)
+
+Version 1.5.5beta02 [July 14, 2011]
+  Revised Makefile.am and Makefile.in to look in the right directory for
+    pnglibconf.h.prebuilt
+
+Version 1.5.5beta03 [July 27, 2011]
+  Enabled compilation with g++ compiler.  This compiler does not recognize
+    the file extension, so it always compiles with C++ rules.  Made minor
+    changes to pngrutil.c to cast results where C++ expects it but C does not.
+  Minor editing of libpng.3 and libpng-manual.txt.
+
+Version 1.5.5beta04 [July 29, 2011]
+  Revised CMakeLists.txt (Clifford Yapp)
+  Updated commentary about the png_rgb_to_gray() default coefficients
+    in the manual and in pngrtran.c
+
+Version 1.5.5beta05 [August 17, 2011]
+  Prevent unexpected API exports from non-libpng DLLs on Windows.  The "_DLL"
+    is removed from the test of whether a DLL is being built (this erroneously
+    caused the libpng APIs to be marked as DLL exports in static builds under
+    Microsoft Visual Studio).  Almost all of the libpng building configuration
+    is moved from pngconf.h to pngpriv.h, but PNG_DLL_EXPORT remains in
+    pngconf.h, though, so that it is colocated with the import definition (it
+    is no longer used anywhere in the installed headers).  The VStudio project
+    definitions have been cleaned up: "_USRDLL" has been removed from the
+    static library builds (this was incorrect), and PNG_USE_DLL has been added
+    to pngvalid to test the functionality (pngtest does not supply it,
+    deliberately).  The spurious "_EXPORTS" has been removed from the
+    libpng build (all these errors were a result of copy/paste between project
+    configurations.)
+  Added new types and internal functions for CIE RGB end point handling to
+    pngpriv.h (functions yet to be implemented).
+
+Version 1.5.5beta06 [August 26, 2011]
+  Ensure the CMAKE_LIBRARY_OUTPUT_DIRECTORY is set in CMakeLists.txt
+    (Clifford Yap)
+  Fixes to rgb_to_gray and cHRM XYZ APIs (John Bowler):
+    The rgb_to_gray code had errors when combined with gamma correction.
+    Some pixels were treated as true grey when they weren't and such pixels
+    and true grey ones were not gamma corrected (the original value of the
+    red component was used instead).  APIs to get and set cHRM using color
+    space end points have been added and the rgb_to_gray code that defaults
+    based on cHRM, and the divide-by-zero bug in png_handle_cHRM (CERT
+    VU#477046, CVE-2011-3328, introduced in 1.5.4) have been corrected.
+  A considerable number of tests has been added to pngvalid for the
+    rgb_to_gray transform.
+  Arithmetic errors in rgb_to_gray whereby the calculated gray value was
+    truncated to the bit depth rather than rounded have been fixed except in
+    the 8-bit non-gamma-corrected case (where consistency seems more important
+    than correctness.)  The code still has considerable inaccuracies in the
+    8-bit case because 8-bit linear arithmetic is used.
+
+Version 1.5.5beta07 [September 7, 2011]
+  Added "$(ARCH)" option to makefile.darwin
+  Added SunOS support to configure.ac and Makefile.am
+  Changed png_chunk_benign_error() to png_warning() in png.c, in
+    png_XYZ_from_xy_checked().
+
+Version 1.5.5beta08 [September 10, 2011]
+  Fixed 64-bit compilation errors (gcc). The errors fixed relate
+    to conditions where types that are 32 bits in the GCC 32-bit
+    world (uLong and png_size_t) become 64 bits in the 64-bit
+    world.  This produces potential truncation errors which the
+    compiler correctly flags.
+  Relocated new HAVE_SOLARIS_LD definition in configure.ac
+  Constant changes for 64-bit compatibility (removal of L suffixes). The
+    16-bit cases still use "L" as we don't have a 16-bit test system.
+
+Version 1.5.5rc01 [September 15, 2011]
+  Removed "L" suffixes in pngpriv.h
+
+Version 1.5.5 [September 22, 2011]
+  No changes.
+
+Version 1.5.6beta01 [September 22, 2011]
+  Fixed some 64-bit type conversion warnings in pngrtran.c
+  Moved row_info from png_struct to a local variable.
+  The various interlace mask arrays have been made into arrays of
+    bytes and made PNG_CONST and static (previously some arrays were
+    marked PNG_CONST and some weren't).
+  Additional checks have been added to the transform code to validate the
+    pixel depths after the transforms on both read and write.
+  Removed some redundant code from pngwrite.c, in png_destroy_write_struct().
+  Changed chunk reading/writing code to use png_uint_32 instead of png_byte[4].
+    This removes the need to allocate temporary strings for chunk names on
+    the stack in the read/write code.  Unknown chunk handling still uses the
+    string form because this is exposed in the API.
+
+Version 1.5.6beta02 [September 26, 2011]
+  Added a note in the manual the png_read_update_info() must be called only
+    once with a particular info_ptr.
+  Fixed a typo in the definition of the new PNG_STRING_FROM_CHUNK(s,c) macro.
+
+Version 1.5.6beta03 [September 28, 2011]
+  Revised test-pngtest.sh to report FAIL when pngtest fails.
+  Added "--strict" option to pngtest, to report FAIL when the failure is
+    only because the resulting valid files are different.
+  Revised CMakeLists.txt to work with mingw and removed some material from
+    CMakeLists.txt that is no longer useful in libpng-1.5.
+
+Version 1.5.6beta04 [October 5, 2011]
+  Fixed typo in Makefile.in and Makefile.am ("-M Wl" should be "-M -Wl")."
+
+Version 1.5.6beta05 [October 12, 2011]
+  Speed up png_combine_row() for interlaced images. This reduces the generality
+    of the code, allowing it to be optimized for Adam7 interlace.  The masks
+    passed to png_combine_row() are now generated internally, avoiding
+    some code duplication and localizing the interlace handling somewhat.
+  Align png_struct::row_buf - previously it was always unaligned, caused by
+    a bug in the code that attempted to align it; the code needs to subtract
+    one from the pointer to take account of the filter byte prepended to
+    each row.
+  Optimized png_combine_row() when rows are aligned. This gains a small
+    percentage for 16-bit and 32-bit pixels in the typical case where the
+    output row buffers are appropriately aligned. The optimization was not
+    previously possible because the png_struct buffer was always misaligned.
+  Fixed bug in png_write_chunk_header() debug print, introduced in 1.5.6beta01.
+
+Version 1.5.6beta06 [October 17, 2011]
+  Removed two redundant tests for unitialized row.
+  Fixed a relatively harmless memory overwrite in compressed text writing
+    with a 1 byte zlib buffer.
+  Add ability to call png_read_update_info multiple times to pngvalid.c.
+  Fixes for multiple calls to png_read_update_info. These fixes attend to
+    most of the errors revealed in pngvalid, however doing the gamma work
+    twice results in inaccuracies that can't be easily fixed.  There is now
+    a warning in the code if this is going to happen.
+  Turned on multiple png_read_update_info in pngvalid transform tests.
+  Prevent libpng from overwriting unused bits at the end of the image when
+    it is not byte aligned, while reading. Prior to libpng-1.5.6 libpng would
+    overwrite the partial byte at the end of each row if the row width was not
+    an exact multiple of 8 bits and the image is not interlaced.
+
+Version 1.5.6beta07 [October 21, 2011]
+  Made png_ptr->prev_row an aligned pointer into png_ptr->big_prev_row
+    (Mans Rullgard).
+
+Version 1.5.6rc01 [October 26, 2011]
+  Changed misleading "Missing PLTE before cHRM" warning to "Out of place cHRM"
+
+Version 1.5.6rc02 [October 27, 2011]
+  Added LSR() macro to defend against buggy compilers that evaluate non-taken
+    code branches and complain about out-of-range shifts.
+
+Version 1.5.6rc03 [October 28, 2011]
+  Renamed the LSR() macro to PNG_LSR() and added PNG_LSL() macro.
+  Fixed compiler warnings with Intel and MSYS compilers. The logical shift
+    fix for Microsoft Visual C is required by other compilers, so this
+    enables that fix for all compilers when using compile-time constants.
+    Under MSYS 'byte' is a name declared in a system header file, so we
+    changed the name of a local variable to avoid the warnings that result.
+  Added #define PNG_ALIGN_TYPE PNG_ALIGN_NONE to contrib/pngminim/*/pngusr.h
+
+Version 1.5.6 [November 3, 2011]
+  No changes.
+
+Version 1.5.7beta01 [November 4, 2011]
+  Added support for ARM processor (Mans Rullgard)
+  Fixed bug in pngvalid on early allocation failure; fixed type cast in
+    pngmem.c; pngvalid would attempt to call png_error() if the allocation
+    of a png_struct or png_info failed. This would probably have led to a
+    crash.  The pngmem.c implementation of png_malloc() included a cast
+    to png_size_t which would fail on large allocations on 16-bit systems.
+  Fix for the preprocessor of the Intel C compiler. The preprocessor
+    splits adjacent @ signs with a space; this changes the concatentation
+    token from @-@-@ to PNG_JOIN; that should work with all compiler
+    preprocessors.
+  Paeth filter speed improvements from work by Siarhei Siamashka. This
+    changes the 'Paeth' reconstruction function to improve the GCC code
+    generation on x86. The changes are only part of the suggested ones;
+    just the changes that definitely improve speed and remain simple.
+    The changes also slightly increase the clarity of the code.
+
+Version 1.5.7beta02 [November 11, 2011]
+  Check compression_type parameter in png_get_iCCP and remove spurious
+    casts. The compression_type parameter is always assigned to, so must
+    be non-NULL. The cast of the profile length potentially truncated the
+    value unnecessarily on a 16-bit int system, so the cast of the (byte)
+    compression type to (int) is specified by ANSI-C anyway.
+  Fixed FP division by zero in pngvalid.c; the 'test_pixel' code left
+    the sBIT fields in the test pixel as 0, which resulted in a floating
+    point division by zero which was irrelevant but causes systems where
+    FP exceptions cause a crash. Added code to pngvalid to turn on FP
+    exceptions if the appropriate glibc support is there to ensure this is
+    tested in the future.
+  Updated scripts/pnglibconf.mak and scripts/makefile.std to handle the
+    new PNG_JOIN macro.
+  Added versioning to pnglibconf.h comments.
+  Simplified read/write API initial version; basic read/write tested on
+    a variety of images, limited documentation (in the header file.)
+  Installed more accurate linear to sRGB conversion tables. The slightly
+    modified tables reduce the number of 16-bit values that
+    convert to an off-by-one 8-bit value.  The "makesRGB.c" code that was used
+    to generate the tables is now in a contrib/sRGBtables sub-directory.
+
+Version 1.5.7beta03 [November 17, 2011]
+  Removed PNG_CONST from the sRGB table declarations in pngpriv.h and png.c
+  Added run-time detection of NEON support.
+  Added contrib/libtests; includes simplified API test and timing test and
+    a color conversion utility for rapid checking of failed 'pngstest' results.
+  Multiple transform bug fixes plus a work-round for double gamma correction.
+    libpng does not support more than one transform that requires linear data
+    at once - if this is tried typically the results is double gamma
+    correction. Since the simplified APIs can need rgb to gray combined with
+    a compose operation it is necessary to do one of these outside the main
+    libpng transform code. This check-in also contains fixes to various bugs
+    in the simplified APIs themselves and to some bugs in compose and rgb to
+    gray (on palette) itself.
+  Fixes for C++ compilation using g++ When libpng source is compiled
+    using g++. The compiler imposes C++ rules on the C source; thus it
+    is desireable to make the source work with either C or C++ rules
+    without throwing away useful error information.  This change adds
+    png_voidcast to allow C semantic (void*) cases or the corresponding
+    C++ static_cast operation, as appropriate.
+  Added --noexecstack to assembler file compilation. GCC does not set
+    this on assembler compilation, even though it does on C compilation.
+    This creates security issues if assembler code is enabled; the
+    work-around is to set it by default in the flags for $(CCAS)
+  Work around compilers that don't support declaration of const data. Some
+    compilers fault 'extern const' data declarations (because the data is
+    not initialized); this turns on const-ness only for compilers where
+    this is known to work.
+
+Version 1.5.7beta04 [November 17, 2011]
+  Since the gcc driver does not recognize the --noexecstack flag, we must
+    use the -Wa prefix to have it passed through to the assembler.
+    Also removed a duplicate setting of this flag.
+  Added files that were omitted from the libpng-1.5.7beta03 zip distribution.
+
+Version 1.5.7beta05 [November 25, 2011]
+  Removed "zTXt" from warning in generic chunk decompression function.
+  Validate time settings passed to pngset() and png_convert_to_rfc1123()
+    (Frank Busse).
+  Added MINGW support to CMakeLists.txt
+  Reject invalid compression flag or method when reading the iTXt chunk.
+  Backed out 'simplified' API changes. The API seems too complex and there
+    is a lack of consensus or enthusiasm for the proposals.  The API also
+    reveals significant bugs inside libpng (double gamma correction and the
+    known bug of being unable to retrieve a corrected palette). It seems
+    better to wait until the bugs, at least, are corrected.
+  Moved pngvalid.c into contrib/libtests
+  Rebuilt Makefile.in, configure, etc., with autoconf-2.68
+
+Version 1.5.7rc01 [December 1, 2011]
+  Replaced an "#if" with "#ifdef" in pngrtran.c
+  Revised #if PNG_DO_BC block in png.c (use #ifdef and add #else)
+
+Version 1.5.7rc02 [December 5, 2011]
+  Revised project files and contrib/pngvalid/pngvalid.c to account for
+    the relocation of pngvalid into contrib/libtests.
+  Revised pngconf.h to use " __declspec(restrict)" only when MSC_VER >= 1400,
+    as in libpng-1.5.4.
+  Put CRLF line endings in the owatcom project files.
+
+Version 1.5.7rc03 [December 7, 2011]
+  Updated CMakeLists.txt to account for the relocation of pngvalid.c
+
+Version 1.5.7 [December 15, 2011]
+  Minor fixes to pngvalid.c for gcc 4.6.2 compatibility to remove warnings
+    reported by earlier versions.
+
+Version 1.5.8beta01 [January 15, 2011]
+  Removed '#include config.h"' from contrib/libtests/pngvalid.c.  It's not
+    needed and causes trouble for VPATH building.
+  Moved AC_MSG_CHECKING([if libraries can be versioned]) later to the proper
+    location in configure.ac (Gilles Espinasse).
+  Fix bug in pngerror.c: some long warnings were being improperly truncated
+    (CVE-2011-3464, bug introduced in libpng-1.5.3beta05).
+
+Version 1.5.8rc01 [January 21, 2012]
+  No changes.
+
+Version 1.5.8rc02 [January 25, 2012]
+  Fixed Min/GW uninstall to remove libpng.dll.a
+  Conditionalize the install rules for MINGW and CYGWIN in CMakeLists.txt
+
+Version 1.5.8 [February 1, 2012]
+  No changes.
+
+Version 1.5.9beta01 [February 3, 2012]
+  Rebuilt configure scripts in the tar distributions.
+
+Version 1.5.9beta02 [February 16, 2012]
+  Removed two unused definitions from scripts/pnglibconf.h.prebuilt
+  Removed some unused arrays (with #ifdef) from png_read_push_finish_row().
+  Removed tests for no-longer-used *_EMPTY_PLTE_SUPPORTED from pngstruct.h
+
+Version 1.5.9rc01 [February 17, 2012]
+  Fixed CVE-2011-3026 buffer overrun bug.  This bug was introduced when
+    iCCP chunk support was added at libpng-1.0.6. Deal more correctly with the
+    test on iCCP chunk length. Also removed spurious casts that may hide
+    problems on 16-bit systems.
+
+Version 1.5.9 [February 18, 2012]
+  No changes.
+
+Version 1.5.10beta01 [February 24, 2012]
+  Removed two useless #ifdef directives from pngread.c and one from pngrutil.c
+  Always put the CMAKE_LIBRARY in "lib" (removed special WIN32 case).
+  Removed empty vstudio/pngstest directory (Clifford Yapp).
+  Eliminated redundant png_push_read_tEXt|zTXt|iTXt|unknown code from
+    pngpread.c and use the sequential png_handle_tEXt, etc., in pngrutil.c;
+    now that png_ptr->buffer is inaccessible to applications, the special
+    handling is no longer useful.
+  Fixed bug with png_handle_hIST with odd chunk length (Frank Busse).
+  Added PNG_SAFE_LIMITS feature to pnglibconf.dfa and code in pngconf.h
+    to reset the user limits to safe ones if PNG_SAFE_LIMITS is defined.
+    To enable, use "CPPFLAGS=-DPNG_SAFE_LIMITS_SUPPORTED" on the configure
+    command or put "#define PNG_SAFE_LIMITS_SUPPORTED" in pnglibconf.h.
+  Revised the SAFE_LIMITS feature to be the same as the feature in libpng16.
+  Added information about the new limits in the manual.
+
+Version 1.5.10beta02 [February 27, 2012]
+  Updated Makefile.in
+
+Version 1.5.10beta03 [March 6, 2012]
+  Removed unused "current_text" members of png_struct and the png_free()
+    of png_ptr->current_text from pngread.c
+  Added palette-index checking. Issue a png_warning() if an invalid index is
+    found.
+
+Version 1.5.10beta04 [March 10, 2012]
+  Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition.
+  Fixed CMF optimization of non-IDAT compressed chunks, which was added at
+    libpng-1.5.4.  It sometimes produced too small of a window.
+
+Version 1.5.10beta05 [March 10, 2012]
+  Reject all iCCP chunks after the first, even if the first one is invalid.
+  Issue a png_benign_error() instead of png_warning() about bad palette index.
+  Fixed an off-by-one error in the palette index checking function.
+  Revised example.c to put text strings in a temporary character array
+    instead of directly assigning string constants to png_textp members.
+    This avoids compiler warnings when -Wwrite-strings is enabled.
+
+Version 1.5.10 [March 29, 2012]
+  Prevent PNG_EXPAND+PNG_SHIFT doing the shift twice.
+  Revised png_set_text_2() to avoid potential memory corruption (fixes
+    CVE-2011-3048).
+
+Version 1.5.11beta01 [April 28, 2012]
+  Revised scripts/makefile.darwin: use system zlib; remove quotes around
+    architecture list; add missing ppc architecture; add architecture options
+    to shared library link; don't try to create a shared lib based on missing
+    RELEASE variable.
+  Enable png_set_check_for_invalid_index() for both read and write.
+  Removed #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED/#endif in pngpriv.h around
+    declaration of png_handle_unknown().
+  Added -lssp_nonshared in a comment in scripts/makefile.freebsd
+    and changed deprecated NOOBJ and NOPROFILE to NO_OBJ and NO_PROFILE.
+
+Version 1.5.11rc01 [May 23, 2012]
+  No changes.
+
+Version 1.5.11rc02 [May 29, 2012]
+  Fixed some typos in comments.
+  Revised CMakeLists.txt to not attempt to make a symlink under mingw.
+  Added two images to contrib/pngsuite (1-bit and 2-bit transparent grayscale),
+    and renamed three whose names were inconsistent with those in
+    pngsuite/README.txt.
+
+Version 1.5.11rc03 [June 4, 2012]
+  Do not depend upon a GCC feature macro being available for use in generating
+    the linker mapfile symbol prefix.
+  Made fixes for new optimization warnings from gcc 4.7.0. The compiler
+    performed an optimization which is safe but then warned about it.
+    Changing the type of 'palette_number' in pngvalid.c removes the warning.
+
+Version 1.5.11rc04 [June 6, 2012]
+  Improved performance of new do_check_palette_indexes() function.
+
+Version 1.5.11rc05 [June 7, 2012]
+  Don't check palette indexes if num_palette is 0 (as it can be in MNG files).
+
+Version 1.5.11 [June 14, 2012]
+  Include zlib.h in contrib/gregbook and contrib/visupng examples.
+
+Version 1.5.12 [July 11, 2012]
+  Removed scripts/makefile.cegcc from the *.zip and *.7z distributions; it
+    depends on configure, which is not included in those archives.
+  Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
@@ -3293,5 +3903,4 @@ to subscribe)
 or to glennrp at users.sourceforge.net
 
 Glenn R-P
-*/ }
 #endif

reactos/dll/3rdparty/libpng/docs/INSTALL

@@ -133,3 +133,23 @@ run "make install".
 Further information can be found in the README and libpng-manual.txt
 files, in the individual makefiles, in png.h, and the manual pages
 libpng.3 and png.5.
+
+Using the ./configure script -- 16 December 2002.
+=================================================
+
+The ./configure script should work compatibly with what scripts/makefile.*
+did, however there are some options you might need to add to configure
+explicitly, which previously was done semi-automatically (if you didn't edit
+scripts/makefile.* yourself, that is)
+
+CFLAGS="-Wall -O -funroll-loops \
+-malign-loops=2 -malign-functions=2" ./configure --prefix=/usr/include \
+--with-pkgconfigdir=/usr/lib/pkgconfig --includedir=/usr/include
+
+You can alternatively specify --includedir=/usr/include, /usr/local/include,
+/usr/include/libpng%NN%, or whatever.
+
+If you find that the configure script is out-of-date or is not supporting
+your platform properly, try running autogen.sh to regenerate "configure",
+"Makefile.in", and the other configuration files. Then try configure again.
+

reactos/dll/3rdparty/libpng/docs/LICENSE

@@ -10,8 +10,8 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.2.6, August 15, 2004, through 1.5.2, March 31, 2011, are
+libpng versions 1.2.6, August 15, 2004, through 1.5.12, July 11, 2012, are
-Copyright (c) 2004, 2006-2011 Glenn Randers-Pehrson, and are
+Copyright (c) 2004, 2006-2012 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
 
@@ -108,4 +108,4 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-March 31, 2011
+July 11, 2012

reactos/dll/3rdparty/libpng/docs/README

@@ -1,4 +1,4 @@
-README for libpng version 1.5.2 - March 31, 2011 (shared library 15.0)
+README for libpng version 1.5.12 - July 11, 2012 (shared library 15.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
@@ -114,19 +114,16 @@ given in previous versions of this document.  He and Andreas will
 read mail addressed to the png-implement list, however.
 
 Please do not send general questions about PNG.  Send them to
-the (png-list at ccrc.wustl.edu, subscription required, write to
+png-mng-misc at lists.sf.net (subscription required; visit
-majordomo at ccrc.wustl.edu with "subscribe png-list" in your message).
+https://lists.sourceforge.net/lists/listinfo/png-mng-misc to
-On the other hand,
+subscribe).  If you have a question about something
-please do not send libpng questions to that address, send them to me
-or to the png-implement list.  I'll
-get them in the end anyway.  If you have a question about something
 in the PNG specification that is related to using libpng, send it
 to me.  Send me any questions that start with "I was using libpng,
 and ...".  If in doubt, send questions to me.  I'll bounce them
 to others, if necessary.
 
 Please do not send suggestions on how to change PNG.  We have
-been discussing PNG for nine years now, and it is official and
+been discussing PNG for sixteen years now, and it is official and
 finished.  If you have suggestions for libpng, however, I'll
 gladly listen.  Even if your suggestion is not used immediately,
 it may be used later.

reactos/dll/3rdparty/libpng/docs/example.c

@@ -2,11 +2,10 @@
 #if 0 /* in case someone actually tries to compile this */
 
 /* example.c - an example of using libpng
- * Last changed in libpng 1.5.2 [March 31, 2011]
+ * Last changed in libpng 1.5.10 [March 8, 2012]
- * This file has been placed in the public domain by the authors.
+ * Maintained 1998-2012 Glenn Randers-Pehrson
- * Maintained 1998-2011 Glenn Randers-Pehrson
+ * Maintained 1996, 1997 Andreas Dilger
- * Maintained 1996, 1997 Andreas Dilger)
+ * Written 1995, 1996 Guy Eric Schalnat, Group 42, Inc.
- * Written 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  */
 
 /* This is an example of how to use libpng to read and write PNG files.
@@ -14,6 +13,8 @@
  * read it, do so first.  This was designed to be a starting point of an
  * implementation.  This is not officially part of libpng, is hereby placed
  * in the public domain, and therefore does not require a copyright notice.
+ * To the extent possible under law, the authors have waived all copyright and
+ * related or neighboring rights to this file.
  *
  * This file does not currently compile, because it is missing certain
  * parts, like allocating memory to hold an image.  You will have to
@@ -22,6 +23,10 @@
  * see also the programs in the contrib directory.
  */
 
+#define _POSIX_SOURCE 1  /* libpng and zlib are POSIX-compliant.  You may
+                          * change this if your application uses non-POSIX
+                          * extensions. */
+
 #include "png.h"
 
  /* The png_jmpbuf() macro, used in error handling, became available in
@@ -183,8 +188,15 @@ void read_png(FILE *fp, unsigned int sig_read)  /* File is already open */
     * are mutually exclusive.
     */
 
-   /* Tell libpng to strip 16 bit/color files down to 8 bits/color */
+   /* Tell libpng to strip 16 bit/color files down to 8 bits/color.
+    * Use accurate scaling if it's available, otherwise just chop off the
+    * low byte.
+    */
+#ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
+    png_set_scale_16(png_ptr);
+#else
    png_set_strip_16(png_ptr);
+#endif
 
    /* Strip alpha bytes from the input data without combining with the
     * background (not recommended).
@@ -330,11 +342,16 @@ void read_png(FILE *fp, unsigned int sig_read)  /* File is already open */
    /* Add filler (or alpha) byte (before/after each RGB triplet) */
    png_set_filler(png_ptr, 0xff, PNG_FILLER_AFTER);
 
+#ifdef PNG_READ_INTERLACING_SUPPORTED
    /* Turn on interlace handling.  REQUIRED if you are not using
     * png_read_image().  To see how to handle interlacing passes,
     * see the png_read_row() method below:
     */
    number_passes = png_set_interlace_handling(png_ptr);
+#else
+   number_passes = 1;
+#endif /* PNG_READ_INTERLACING_SUPPORTED */
+
 
    /* Optional call to gamma correct and add the background to the palette
     * and update info structure.  REQUIRED if you are expecting libpng to
@@ -516,6 +533,7 @@ row_callback(png_structp png_ptr, png_bytep new_row,
     */
    png_bytep old_row = ((png_bytep *)our_data)[row_num];
 
+#ifdef PNG_READ_INTERLACING_SUPPORTED
    /* If both rows are allocated then copy the new row
     * data to the corresponding row data.
     */
@@ -544,6 +562,7 @@ row_callback(png_structp png_ptr, png_bytep new_row,
     * to pass the current row as new_row, and the function will combine
     * the old row and the new row.
     */
+#endif /* PNG_READ_INTERLACING_SUPPORTED */
 }
 
 end_callback(png_structp png_ptr, png_infop info)
@@ -676,25 +695,38 @@ void write_png(char *file_name /* , ... other image information ... */)
    png_set_gAMA(png_ptr, info_ptr, gamma);
 
    /* Optionally write comments into the image */
-   text_ptr[0].key = "Title";
+   {
-   text_ptr[0].text = "Mona Lisa";
+      png_text text_ptr[3];
+
+      char key0[]="Title";
+      char text0[]="Mona Lisa";
+      text_ptr[0].key = key0;
+      text_ptr[0].text = text0;
       text_ptr[0].compression = PNG_TEXT_COMPRESSION_NONE;
       text_ptr[0].itxt_length = 0;
       text_ptr[0].lang = NULL;
       text_ptr[0].lang_key = NULL;
-   text_ptr[1].key = "Author";
+
-   text_ptr[1].text = "Leonardo DaVinci";
+      char key1[]="Author";
+      char text1[]="Leonardo DaVinci";
+      text_ptr[1].key = key1;
+      text_ptr[1].text = text1;
       text_ptr[1].compression = PNG_TEXT_COMPRESSION_NONE;
       text_ptr[1].itxt_length = 0;
       text_ptr[1].lang = NULL;
       text_ptr[1].lang_key = NULL;
-   text_ptr[2].key = "Description";
+
-   text_ptr[2].text = "<long text>";
+      char key2[]="Description";
+      char text2[]="<long text>";
+      text_ptr[2].key = key2;
+      text_ptr[2].text = text2;
       text_ptr[2].compression = PNG_TEXT_COMPRESSION_zTXt;
       text_ptr[2].itxt_length = 0;
       text_ptr[2].lang = NULL;
       text_ptr[2].lang_key = NULL;
-   png_set_text(png_ptr, info_ptr, text_ptr, 3);
+
+      png_set_text(write_ptr, write_info_ptr, text_ptr, 3);
+   }
 
    /* Other optional chunks like cHRM, bKGD, tRNS, tIME, oFFs, pHYs */
 

reactos/dll/3rdparty/libpng/png.c

@@ -1,8 +1,8 @@
 
 /* png.c - location for general purpose libpng functions
  *
- * Last changed in libpng 1.5.7 [December 15, 2011]
+ * Last changed in libpng 1.5.11 [June 14, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -14,7 +14,7 @@
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_9 Your_png_h_is_not_version_1_5_9;
+typedef png_libpng_version_1_5_12 Your_png_h_is_not_version_1_5_12;
 
 /* Tells libpng that we have already handled the first "num_bytes" bytes
  * of the PNG file signature.  If the PNG data is embedded into another
@@ -655,14 +655,14 @@ png_get_copyright(png_const_structp png_ptr)
 #else
 #  ifdef __STDC__
    return PNG_STRING_NEWLINE \
-     "libpng version 1.5.9 - February 18, 2012" PNG_STRING_NEWLINE \
+     "libpng version 1.5.12 - July 11, 2012" PNG_STRING_NEWLINE \
-     "Copyright (c) 1998-2011 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
+     "Copyright (c) 1998-2012 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.5.9 - February 18, 2012\
+      return "libpng version 1.5.12 - July 11, 2012\
-      Copyright (c) 1998-2011 Glenn Randers-Pehrson\
+      Copyright (c) 1998-2012 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
 #  endif
@@ -969,8 +969,8 @@ int png_XYZ_from_xy(png_XYZ *XYZ, png_xy xy)
     * and it is certain that it becomes unstable where the end points are close
     * together.
     *
-    * So this code uses the perhaps slighly less optimal but more understandable
+    * So this code uses the perhaps slightly less optimal but more
-    * and totally obvious approach of calculating color-scale.
+    * understandable and totally obvious approach of calculating color-scale.
     *
     * This algorithm depends on the precision in white-scale and that is
     * (1/white-y), so we can immediately see that as white-y approaches 0 the
@@ -1467,7 +1467,7 @@ static double
 png_pow10(int power)
 {
    int recip = 0;
-   double d = 1;
+   double d = 1.0;
 
    /* Handle negative exponent with a reciprocal at the end because
     * 10 is exact whereas .1 is inexact in base 2
@@ -1481,7 +1481,7 @@ png_pow10(int power)
    if (power > 0)
    {
       /* Decompose power bitwise. */
-      double mult = 10;
+      double mult = 10.0;
       do
       {
          if (power & 1) d *= mult;
@@ -1600,7 +1600,8 @@ png_ascii_from_fp(png_structp png_ptr, png_charp ascii, png_size_t size,
             {
                double d;
 
-               fp *= 10;
+               fp *= 10.0;
+
                /* Use modf here, not floor and subtract, so that
                 * the separation is done in one step.  At the end
                 * of the loop don't break the number into parts so
@@ -1613,7 +1614,7 @@ png_ascii_from_fp(png_structp png_ptr, png_charp ascii, png_size_t size,
                {
                   d = floor(fp + .5);
 
-                  if (d > 9)
+                  if (d > 9.0)
                   {
                      /* Rounding up to 10, handle that here. */
                      if (czero > 0)
@@ -1621,9 +1622,10 @@ png_ascii_from_fp(png_structp png_ptr, png_charp ascii, png_size_t size,
                         --czero, d = 1;
                         if (cdigits == 0) --clead;
                      }
+
                      else
                      {
-                        while (cdigits > 0 && d > 9)
+                        while (cdigits > 0 && d > 9.0)
                         {
                            int ch = *--ascii;
 
@@ -1648,7 +1650,7 @@ png_ascii_from_fp(png_structp png_ptr, png_charp ascii, png_size_t size,
                          * exponent but take into account the leading
                          * decimal point.
                          */
-                        if (d > 9)  /* cdigits == 0 */
+                        if (d > 9.0)  /* cdigits == 0 */
                         {
                            if (exp_b10 == (-1))
                            {
@@ -1669,18 +1671,19 @@ png_ascii_from_fp(png_structp png_ptr, png_charp ascii, png_size_t size,
                               ++exp_b10;
 
                            /* In all cases we output a '1' */
-                           d = 1;
+                           d = 1.0;
                         }
                      }
                   }
                   fp = 0; /* Guarantees termination below. */
                }
 
-               if (d == 0)
+               if (d == 0.0)
                {
                   ++czero;
                   if (cdigits == 0) ++clead;
                }
+
                else
                {
                   /* Included embedded zeros in the digit count. */
@@ -1708,6 +1711,7 @@ png_ascii_from_fp(png_structp png_ptr, png_charp ascii, png_size_t size,
                                                                  above */
                      --exp_b10;
                   }
+
                   *ascii++ = (char)(48 + (int)d), ++cdigits;
                }
             }
@@ -2040,7 +2044,7 @@ png_muldiv_warn(png_structp png_ptr, png_fixed_point a, png_int_32 times,
 }
 #endif
 
-#ifdef PNG_READ_GAMMA_SUPPORTED /* more fixed point functions for gammma */
+#ifdef PNG_READ_GAMMA_SUPPORTED /* more fixed point functions for gamma */
 /* Calculate a reciprocal, return 0 on div-by-zero or overflow. */
 png_fixed_point
 png_reciprocal(png_fixed_point a)

reactos/dll/3rdparty/libpng/pngerror.c

@@ -2,7 +2,7 @@
 /* pngerror.c - stub functions for i/o and memory allocation
  *
  * Last changed in libpng 1.5.8 [February 1, 2011]
- * Copyright (c) 1998-2012 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2011 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *

reactos/dll/3rdparty/libpng/pngpread.c

@@ -1,8 +1,8 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.5.9 [February 18, 2012]
+ * Last changed in libpng 1.5.11 [June 14, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -128,30 +128,6 @@ png_process_some_data(png_structp png_ptr, png_infop info_ptr)
          break;
       }
 
-#ifdef PNG_READ_tEXt_SUPPORTED
-      case PNG_READ_tEXt_MODE:
-      {
-         png_push_read_tEXt(png_ptr, info_ptr);
-         break;
-      }
-
-#endif
-#ifdef PNG_READ_zTXt_SUPPORTED
-      case PNG_READ_zTXt_MODE:
-      {
-         png_push_read_zTXt(png_ptr, info_ptr);
-         break;
-      }
-
-#endif
-#ifdef PNG_READ_iTXt_SUPPORTED
-      case PNG_READ_iTXt_MODE:
-      {
-         png_push_read_iTXt(png_ptr, info_ptr);
-         break;
-      }
-
-#endif
       case PNG_SKIP_MODE:
       {
          png_push_crc_finish(png_ptr);
@@ -196,6 +172,7 @@ png_push_read_sig(png_structp png_ptr, png_infop info_ptr)
       else
          png_error(png_ptr, "PNG file corrupted by ASCII conversion");
    }
+
    else
    {
       if (png_ptr->sig_bytes >= 8)
@@ -305,8 +282,8 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
             png_error(png_ptr, "Missing PLTE before IDAT");
       }
    }
-
 #endif
+
    else if (chunk_name == png_PLTE)
    {
       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
@@ -543,7 +520,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          return;
       }
 
-      png_push_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
    }
 
 #endif
@@ -556,7 +533,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          return;
       }
 
-      png_push_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
    }
 
 #endif
@@ -569,10 +546,11 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          return;
       }
 
-      png_push_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
    }
 
 #endif
+
    else
    {
       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
@@ -580,7 +558,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
          png_push_save_buffer(png_ptr);
          return;
       }
-      png_push_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
+      png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
    }
 
    png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
@@ -620,6 +598,7 @@ png_push_crc_finish(png_structp png_ptr)
       png_ptr->save_buffer_size -= save_size;
       png_ptr->save_buffer_ptr += save_size;
    }
+
    if (png_ptr->skip_length && png_ptr->current_buffer_size)
    {
       png_size_t save_size = png_ptr->current_buffer_size;
@@ -641,6 +620,7 @@ png_push_crc_finish(png_structp png_ptr)
       png_ptr->current_buffer_size -= save_size;
       png_ptr->current_buffer_ptr += save_size;
    }
+
    if (!png_ptr->skip_length)
    {
       if (png_ptr->buffer_size < 4)
@@ -663,6 +643,7 @@ png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
       return;
 
    ptr = buffer;
+
    if (png_ptr->save_buffer_size)
    {
       png_size_t save_size;
@@ -680,6 +661,7 @@ png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
       png_ptr->save_buffer_size -= save_size;
       png_ptr->save_buffer_ptr += save_size;
    }
+
    if (length && png_ptr->current_buffer_size)
    {
       png_size_t save_size;
@@ -709,6 +691,7 @@ png_push_save_buffer(png_structp png_ptr)
          png_bytep dp;
 
          istop = png_ptr->save_buffer_size;
+
          for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer;
              i < istop; i++, sp++, dp++)
          {
@@ -716,6 +699,7 @@ png_push_save_buffer(png_structp png_ptr)
          }
       }
    }
+
    if (png_ptr->save_buffer_size + png_ptr->current_buffer_size >
        png_ptr->save_buffer_max)
    {
@@ -742,6 +726,7 @@ png_push_save_buffer(png_structp png_ptr)
       png_free(png_ptr, old_buffer);
       png_ptr->save_buffer_max = new_max;
    }
+
    if (png_ptr->current_buffer_size)
    {
       png_memcpy(png_ptr->save_buffer + png_ptr->save_buffer_size,
@@ -749,6 +734,7 @@ png_push_save_buffer(png_structp png_ptr)
       png_ptr->save_buffer_size += png_ptr->current_buffer_size;
       png_ptr->current_buffer_size = 0;
    }
+
    png_ptr->save_buffer_ptr = png_ptr->save_buffer;
    png_ptr->buffer_size = 0;
 }
@@ -850,6 +836,7 @@ png_push_read_IDAT(png_structp png_ptr)
       png_ptr->current_buffer_size -= save_size;
       png_ptr->current_buffer_ptr += save_size;
    }
+
    if (!png_ptr->idat_size)
    {
       if (png_ptr->buffer_size < 4)
@@ -1263,521 +1250,6 @@ png_read_push_finish_row(png_structp png_ptr)
 #endif /* PNG_READ_INTERLACING_SUPPORTED */
 }
 
-#ifdef PNG_READ_tEXt_SUPPORTED
-void /* PRIVATE */
-png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
-    length)
-{
-   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
-      {
-         PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
-         png_error(png_ptr, "Out of place tEXt");
-         /* NOT REACHED */
-      }
-
-#ifdef PNG_MAX_MALLOC_64K
-   png_ptr->skip_length = 0;  /* This may not be necessary */
-
-   if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
-   {
-      png_warning(png_ptr, "tEXt chunk too large to fit in memory");
-      png_ptr->skip_length = length - (png_uint_32)65535L;
-      length = (png_uint_32)65535L;
-   }
-#endif
-
-   png_ptr->current_text = (png_charp)png_malloc(png_ptr, length + 1);
-   png_ptr->current_text[length] = '\0';
-   png_ptr->current_text_ptr = png_ptr->current_text;
-   png_ptr->current_text_size = (png_size_t)length;
-   png_ptr->current_text_left = (png_size_t)length;
-   png_ptr->process_mode = PNG_READ_tEXt_MODE;
-}
-
-void /* PRIVATE */
-png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
-{
-   if (png_ptr->buffer_size && png_ptr->current_text_left)
-   {
-      png_size_t text_size;
-
-      if (png_ptr->buffer_size < png_ptr->current_text_left)
-         text_size = png_ptr->buffer_size;
-
-      else
-         text_size = png_ptr->current_text_left;
-
-      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
-      png_ptr->current_text_left -= text_size;
-      png_ptr->current_text_ptr += text_size;
-   }
-   if (!(png_ptr->current_text_left))
-   {
-      png_textp text_ptr;
-      png_charp text;
-      png_charp key;
-      int ret;
-
-      if (png_ptr->buffer_size < 4)
-      {
-         png_push_save_buffer(png_ptr);
-         return;
-      }
-
-      png_push_crc_finish(png_ptr);
-
-#ifdef PNG_MAX_MALLOC_64K
-      if (png_ptr->skip_length)
-         return;
-#endif
-
-      key = png_ptr->current_text;
-
-      for (text = key; *text; text++)
-         /* Empty loop */ ;
-
-      if (text < key + png_ptr->current_text_size)
-         text++;
-
-      text_ptr = (png_textp)png_malloc(png_ptr, png_sizeof(png_text));
-      text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
-      text_ptr->key = key;
-      text_ptr->itxt_length = 0;
-      text_ptr->lang = NULL;
-      text_ptr->lang_key = NULL;
-      text_ptr->text = text;
-
-      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
-
-      png_free(png_ptr, key);
-      png_free(png_ptr, text_ptr);
-      png_ptr->current_text = NULL;
-
-      if (ret)
-         png_warning(png_ptr, "Insufficient memory to store text chunk");
-   }
-}
-#endif
-
-#ifdef PNG_READ_zTXt_SUPPORTED
-void /* PRIVATE */
-png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
-   length)
-{
-   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
-   {
-      PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
-      png_error(png_ptr, "Out of place zTXt");
-      /* NOT REACHED */
-   }
-
-#ifdef PNG_MAX_MALLOC_64K
-   /* We can't handle zTXt chunks > 64K, since we don't have enough space
-    * to be able to store the uncompressed data.  Actually, the threshold
-    * is probably around 32K, but it isn't as definite as 64K is.
-    */
-   if (length > (png_uint_32)65535L)
-   {
-      png_warning(png_ptr, "zTXt chunk too large to fit in memory");
-      png_push_crc_skip(png_ptr, length);
-      return;
-   }
-#endif
-
-   png_ptr->current_text = (png_charp)png_malloc(png_ptr, length + 1);
-   png_ptr->current_text[length] = '\0';
-   png_ptr->current_text_ptr = png_ptr->current_text;
-   png_ptr->current_text_size = (png_size_t)length;
-   png_ptr->current_text_left = (png_size_t)length;
-   png_ptr->process_mode = PNG_READ_zTXt_MODE;
-}
-
-void /* PRIVATE */
-png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
-{
-   if (png_ptr->buffer_size && png_ptr->current_text_left)
-   {
-      png_size_t text_size;
-
-      if (png_ptr->buffer_size < (png_uint_32)png_ptr->current_text_left)
-         text_size = png_ptr->buffer_size;
-
-      else
-         text_size = png_ptr->current_text_left;
-
-      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
-      png_ptr->current_text_left -= text_size;
-      png_ptr->current_text_ptr += text_size;
-   }
-   if (!(png_ptr->current_text_left))
-   {
-      png_textp text_ptr;
-      png_charp text;
-      png_charp key;
-      int ret;
-      png_size_t text_size, key_size;
-
-      if (png_ptr->buffer_size < 4)
-      {
-         png_push_save_buffer(png_ptr);
-         return;
-      }
-
-      png_push_crc_finish(png_ptr);
-
-      key = png_ptr->current_text;
-
-      for (text = key; *text; text++)
-         /* Empty loop */ ;
-
-      /* zTXt can't have zero text */
-      if (text >= key + png_ptr->current_text_size)
-      {
-         png_ptr->current_text = NULL;
-         png_free(png_ptr, key);
-         return;
-      }
-
-      text++;
-
-      if (*text != PNG_TEXT_COMPRESSION_zTXt) /* Check compression byte */
-      {
-         png_ptr->current_text = NULL;
-         png_free(png_ptr, key);
-         return;
-      }
-
-      text++;
-
-      png_ptr->zstream.next_in = (png_bytep)text;
-      png_ptr->zstream.avail_in = (uInt)(png_ptr->current_text_size -
-          (text - key));
-      png_ptr->zstream.next_out = png_ptr->zbuf;
-      png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
-
-      key_size = text - key;
-      text_size = 0;
-      text = NULL;
-      ret = Z_STREAM_END;
-
-      while (png_ptr->zstream.avail_in)
-      {
-         ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
-         if (ret != Z_OK && ret != Z_STREAM_END)
-         {
-            inflateReset(&png_ptr->zstream);
-            png_ptr->zstream.avail_in = 0;
-            png_ptr->current_text = NULL;
-            png_free(png_ptr, key);
-            png_free(png_ptr, text);
-            return;
-         }
-
-         if (!(png_ptr->zstream.avail_out) || ret == Z_STREAM_END)
-         {
-            if (text == NULL)
-            {
-               text = (png_charp)png_malloc(png_ptr,
-                   (png_ptr->zbuf_size
-                   - png_ptr->zstream.avail_out + key_size + 1));
-
-               png_memcpy(text + key_size, png_ptr->zbuf,
-                   png_ptr->zbuf_size - png_ptr->zstream.avail_out);
-
-               png_memcpy(text, key, key_size);
-
-               text_size = key_size + png_ptr->zbuf_size -
-                   png_ptr->zstream.avail_out;
-
-               *(text + text_size) = '\0';
-            }
-
-            else
-            {
-               png_charp tmp;
-
-               tmp = text;
-               text = (png_charp)png_malloc(png_ptr, text_size +
-                   (png_ptr->zbuf_size
-                   - png_ptr->zstream.avail_out + 1));
-
-               png_memcpy(text, tmp, text_size);
-               png_free(png_ptr, tmp);
-
-               png_memcpy(text + text_size, png_ptr->zbuf,
-                   png_ptr->zbuf_size - png_ptr->zstream.avail_out);
-
-               text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
-               *(text + text_size) = '\0';
-            }
-
-            if (ret != Z_STREAM_END)
-            {
-               png_ptr->zstream.next_out = png_ptr->zbuf;
-               png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
-            }
-         }
-         else
-         {
-            break;
-         }
-
-         if (ret == Z_STREAM_END)
-            break;
-      }
-
-      inflateReset(&png_ptr->zstream);
-      png_ptr->zstream.avail_in = 0;
-
-      if (ret != Z_STREAM_END)
-      {
-         png_ptr->current_text = NULL;
-         png_free(png_ptr, key);
-         png_free(png_ptr, text);
-         return;
-      }
-
-      png_ptr->current_text = NULL;
-      png_free(png_ptr, key);
-      key = text;
-      text += key_size;
-
-      text_ptr = (png_textp)png_malloc(png_ptr,
-          png_sizeof(png_text));
-      text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
-      text_ptr->key = key;
-      text_ptr->itxt_length = 0;
-      text_ptr->lang = NULL;
-      text_ptr->lang_key = NULL;
-      text_ptr->text = text;
-
-      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
-
-      png_free(png_ptr, key);
-      png_free(png_ptr, text_ptr);
-
-      if (ret)
-         png_warning(png_ptr, "Insufficient memory to store text chunk");
-   }
-}
-#endif
-
-#ifdef PNG_READ_iTXt_SUPPORTED
-void /* PRIVATE */
-png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
-    length)
-{
-   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
-   {
-      PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
-      png_error(png_ptr, "Out of place iTXt");
-      /* NOT REACHED */
-   }
-
-#ifdef PNG_MAX_MALLOC_64K
-   png_ptr->skip_length = 0;  /* This may not be necessary */
-
-   if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
-   {
-      png_warning(png_ptr, "iTXt chunk too large to fit in memory");
-      png_ptr->skip_length = length - (png_uint_32)65535L;
-      length = (png_uint_32)65535L;
-   }
-#endif
-
-   png_ptr->current_text = (png_charp)png_malloc(png_ptr, length + 1);
-   png_ptr->current_text[length] = '\0';
-   png_ptr->current_text_ptr = png_ptr->current_text;
-   png_ptr->current_text_size = (png_size_t)length;
-   png_ptr->current_text_left = (png_size_t)length;
-   png_ptr->process_mode = PNG_READ_iTXt_MODE;
-}
-
-void /* PRIVATE */
-png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
-{
-
-   if (png_ptr->buffer_size && png_ptr->current_text_left)
-   {
-      png_size_t text_size;
-
-      if (png_ptr->buffer_size < png_ptr->current_text_left)
-         text_size = png_ptr->buffer_size;
-
-      else
-         text_size = png_ptr->current_text_left;
-
-      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
-      png_ptr->current_text_left -= text_size;
-      png_ptr->current_text_ptr += text_size;
-   }
-
-   if (!(png_ptr->current_text_left))
-   {
-      png_textp text_ptr;
-      png_charp key;
-      int comp_flag;
-      png_charp lang;
-      png_charp lang_key;
-      png_charp text;
-      int ret;
-
-      if (png_ptr->buffer_size < 4)
-      {
-         png_push_save_buffer(png_ptr);
-         return;
-      }
-
-      png_push_crc_finish(png_ptr);
-
-#ifdef PNG_MAX_MALLOC_64K
-      if (png_ptr->skip_length)
-         return;
-#endif
-
-      key = png_ptr->current_text;
-
-      for (lang = key; *lang; lang++)
-         /* Empty loop */ ;
-
-      if (lang < key + png_ptr->current_text_size - 3)
-         lang++;
-
-      comp_flag = *lang++;
-      lang++;     /* Skip comp_type, always zero */
-
-      for (lang_key = lang; *lang_key; lang_key++)
-         /* Empty loop */ ;
-
-      lang_key++;        /* Skip NUL separator */
-
-      text=lang_key;
-
-      if (lang_key < key + png_ptr->current_text_size - 1)
-      {
-         for (; *text; text++)
-            /* Empty loop */ ;
-      }
-
-      if (text < key + png_ptr->current_text_size)
-         text++;
-
-      text_ptr = (png_textp)png_malloc(png_ptr,
-          png_sizeof(png_text));
-
-      text_ptr->compression = comp_flag + 2;
-      text_ptr->key = key;
-      text_ptr->lang = lang;
-      text_ptr->lang_key = lang_key;
-      text_ptr->text = text;
-      text_ptr->text_length = 0;
-      text_ptr->itxt_length = png_strlen(text);
-
-      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
-
-      png_ptr->current_text = NULL;
-
-      png_free(png_ptr, text_ptr);
-      if (ret)
-         png_warning(png_ptr, "Insufficient memory to store iTXt chunk");
-   }
-}
-#endif
-
-/* This function is called when we haven't found a handler for this
- * chunk.  If there isn't a problem with the chunk itself (ie a bad chunk
- * name or a critical chunk), the chunk is (currently) silently ignored.
- */
-void /* PRIVATE */
-png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
-    length)
-{
-   png_uint_32 skip = 0;
-   png_uint_32 chunk_name = png_ptr->chunk_name;
-
-   if (PNG_CHUNK_CRITICAL(chunk_name))
-   {
-#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
-      if (png_chunk_unknown_handling(png_ptr, chunk_name) !=
-          PNG_HANDLE_CHUNK_ALWAYS
-#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
-          && png_ptr->read_user_chunk_fn == NULL
-#endif
-          )
-#endif
-         png_chunk_error(png_ptr, "unknown critical chunk");
-
-      PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
-   }
-
-#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
-   /* TODO: the code below is apparently just using the
-    * png_struct::unknown_chunk member as a temporarily variable, it should be
-    * possible to eliminate both it and the temporary buffer.
-    */
-   if (png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
-   {
-#ifdef PNG_MAX_MALLOC_64K
-      if (length > 65535)
-      {
-         png_warning(png_ptr, "unknown chunk too large to fit in memory");
-         skip = length - 65535;
-         length = 65535;
-      }
-#endif
-      /* This is just a record for the user; libpng doesn't use the character
-       * form of the name.
-       */
-      PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
-
-      png_ptr->unknown_chunk.size = length;
-
-      if (length == 0)
-         png_ptr->unknown_chunk.data = NULL;
-
-      else
-      {
-         png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr,
-            png_ptr->unknown_chunk.size);
-         png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data,
-            png_ptr->unknown_chunk.size);
-      }
-
-#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
-      if (png_ptr->read_user_chunk_fn != NULL)
-      {
-         /* Callback to user unknown chunk handler */
-         int ret;
-         ret = (*(png_ptr->read_user_chunk_fn))
-             (png_ptr, &png_ptr->unknown_chunk);
-
-         if (ret < 0)
-            png_chunk_error(png_ptr, "error in user chunk");
-
-         if (ret == 0)
-         {
-            if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
-               if (png_chunk_unknown_handling(png_ptr, chunk_name) !=
-                   PNG_HANDLE_CHUNK_ALWAYS)
-                  png_chunk_error(png_ptr, "unknown critical chunk");
-            png_set_unknown_chunks(png_ptr, info_ptr,
-                &png_ptr->unknown_chunk, 1);
-         }
-      }
-
-      else
-#endif
-         png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
-      png_free(png_ptr, png_ptr->unknown_chunk.data);
-      png_ptr->unknown_chunk.data = NULL;
-   }
-
-   else
-#endif
-      skip=length;
-   png_push_crc_skip(png_ptr, skip);
-}
-
 void /* PRIVATE */
 png_push_have_info(png_structp png_ptr, png_infop info_ptr)
 {

reactos/dll/3rdparty/libpng/pngpriv.h

@@ -2,11 +2,11 @@
 /* pngpriv.h - private declarations for use inside libpng
  *
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
- * Last changed in libpng 1.5.7 [December 15, 2011]
+ * Last changed in libpng 1.5.10 [March 29, 2012]
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
@@ -133,6 +133,46 @@
 #  define PNG_DLL_EXPORT
 #endif
 
+/* SECURITY and SAFETY:
+ *
+ * By default libpng is built without any internal limits on image size,
+ * individual heap (png_malloc) allocations or the total amount of memory used.
+ * If PNG_SAFE_LIMITS_SUPPORTED is defined, however, the limits below are used
+ * (unless individually overridden).  These limits are believed to be fairly
+ * safe, but builders of secure systems should verify the values against the
+ * real system capabilities.
+ */
+
+#ifdef PNG_SAFE_LIMITS_SUPPORTED
+   /* 'safe' limits */
+#  ifndef PNG_USER_WIDTH_MAX
+#     define PNG_USER_WIDTH_MAX 1000000
+#  endif
+#  ifndef PNG_USER_HEIGHT_MAX
+#     define PNG_USER_HEIGHT_MAX 1000000
+#  endif
+#  ifndef PNG_USER_CHUNK_CACHE_MAX
+#     define PNG_USER_CHUNK_CACHE_MAX 128
+#  endif
+#  ifndef PNG_USER_CHUNK_MALLOC_MAX
+#     define PNG_USER_CHUNK_MALLOC_MAX 8000000
+#  endif
+#else
+   /* values for no limits */
+#  ifndef PNG_USER_WIDTH_MAX
+#     define PNG_USER_WIDTH_MAX 0x7fffffff
+#  endif
+#  ifndef PNG_USER_HEIGHT_MAX
+#     define PNG_USER_HEIGHT_MAX 0x7fffffff
+#  endif
+#  ifndef PNG_USER_CHUNK_CACHE_MAX
+#     define PNG_USER_CHUNK_CACHE_MAX 0
+#  endif
+#  ifndef PNG_USER_CHUNK_MALLOC_MAX
+#     define PNG_USER_CHUNK_MALLOC_MAX 0
+#  endif
+#endif
+
 /* This is used for 16 bit gamma tables - only the top level pointers are const,
  * this could be changed:
  */
@@ -426,6 +466,7 @@ typedef PNG_CONST png_uint_16p FAR * png_const_uint_16pp;
 #define PNG_BACKGROUND_IS_GRAY     0x800
 #define PNG_HAVE_PNG_SIGNATURE    0x1000
 #define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000 /* Have another chunk after IDAT */
+#define PNG_HAVE_iCCP             0x4000
 
 /* Flags for the transformations the PNG library does on the image data */
 #define PNG_BGR                 0x0001
@@ -1218,10 +1259,8 @@ PNG_EXTERN void png_handle_zTXt PNGARG((png_structp png_ptr, png_infop info_ptr,
     png_uint_32 length));
 #endif
 
-#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 PNG_EXTERN void png_handle_unknown PNGARG((png_structp png_ptr,
     png_infop info_ptr, png_uint_32 length));
-#endif
 
 PNG_EXTERN void png_check_chunk_name PNGARG((png_structp png_ptr,
     png_uint_32 chunk_name));
@@ -1355,6 +1394,13 @@ PNG_EXTERN void png_check_IHDR PNGARG((png_structp png_ptr,
     int color_type, int interlace_type, int compression_type,
     int filter_type));
 
+/* Added at libpng version 1.5.10 */
+#if defined(PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED) || \
+    defined(PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED)
+PNG_EXTERN void png_do_check_palette_indexes PNGARG((png_structp png_ptr,
+    png_row_infop row_info));
+#endif
+
 /* Free all memory used by the read (old method - NOT DLL EXPORTED) */
 PNG_EXTERN void png_read_destroy PNGARG((png_structp png_ptr,
     png_infop info_ptr, png_infop end_info_ptr));

reactos/dll/3rdparty/libpng/pngread.c

@@ -1,8 +1,8 @@
 
 /* pngread.c - read a PNG file
  *
- * Last changed in libpng 1.5.7 [December 15, 2011]
+ * Last changed in libpng 1.5.10 [March 8, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -67,16 +67,12 @@ png_create_read_struct_2,(png_const_charp user_png_ver, png_voidp error_ptr,
    png_ptr->user_width_max = PNG_USER_WIDTH_MAX;
    png_ptr->user_height_max = PNG_USER_HEIGHT_MAX;
 
-#  ifdef PNG_USER_CHUNK_CACHE_MAX
    /* Added at libpng-1.2.43 and 1.4.0 */
    png_ptr->user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;
-#  endif
 
-#  ifdef PNG_SET_USER_CHUNK_MALLOC_MAX
    /* Added at libpng-1.2.43 and 1.4.1 */
    png_ptr->user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;
 #endif
-#endif
 
 #ifdef PNG_SETJMP_SUPPORTED
 /* Applications that neglect to set up their own setjmp() and then
@@ -805,6 +801,13 @@ png_read_end(png_structp png_ptr, png_infop info_ptr)
 
    png_crc_finish(png_ptr, 0); /* Finish off CRC from last IDAT chunk */
 
+#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
+   /* Report invalid palette index; added at libng-1.5.10 */
+   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
+      png_ptr->num_palette_max > png_ptr->num_palette)
+     png_benign_error(png_ptr, "Read palette index exceeding num_palette");
+#endif
+
    do
    {
       png_uint_32 length = png_read_chunk_header(png_ptr);
@@ -1070,12 +1073,6 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr,
    png_free(png_ptr, png_ptr->save_buffer);
 #endif
 
-#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
-#ifdef PNG_TEXT_SUPPORTED
-   png_free(png_ptr, png_ptr->current_text);
-#endif /* PNG_TEXT_SUPPORTED */
-#endif /* PNG_PROGRESSIVE_READ_SUPPORTED */
-
    /* Save the important info out of the png_struct, in case it is
     * being used again.
     */

reactos/dll/3rdparty/libpng/pngrtran.c

@@ -1,8 +1,8 @@
 
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
- * Last changed in libpng 1.5.7 [December 15, 2011]
+ * Last changed in libpng 1.5.11 [June 14, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -1770,8 +1770,8 @@ png_init_read_transformations(png_structp png_ptr)
          int num_palette = png_ptr->num_palette;
          int i;
 
-         /*NOTE: there are other transformations that should probably be in here
+         /* NOTE: there are other transformations that should probably be in
-          * too.
+          * here too.
           */
          for (i = 0; i < num_palette; i++)
          {
@@ -1830,12 +1830,15 @@ png_init_read_transformations(png_structp png_ptr)
 
 #ifdef PNG_READ_SHIFT_SUPPORTED
    if ((png_ptr->transformations & PNG_SHIFT) &&
+      !(png_ptr->transformations & PNG_EXPAND) &&
        (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE))
    {
       int i;
       int istop = png_ptr->num_palette;
       int shift = 8 - png_ptr->sig_bit.red;
 
+      png_ptr->transformations &= ~PNG_SHIFT;
+
       /* significant bits can be in the range 1 to 7 for a meaninful result, if
        * the number of significant bits is 0 then no shift is done (this is an
        * error condition which is silently ignored.)
@@ -2296,6 +2299,13 @@ png_do_read_transformations(png_structp png_ptr, png_row_infop row_info)
       png_do_unpack(row_info, png_ptr->row_buf + 1);
 #endif
 
+#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
+   /* Added at libpng-1.5.10 */
+   if (row_info->color_type == PNG_COLOR_TYPE_PALETTE &&
+       png_ptr->num_palette_max >= 0)
+      png_do_check_palette_indexes(png_ptr, row_info);
+#endif
+
 #ifdef PNG_READ_BGR_SUPPORTED
    if (png_ptr->transformations & PNG_BGR)
       png_do_bgr(row_info, png_ptr->row_buf + 1);

reactos/dll/3rdparty/libpng/pngrutil.c

@@ -1,7 +1,7 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.5.9 [February 18, 2012]
+ * Last changed in libpng 1.5.10 [March 8, 2012]
  * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -434,14 +434,12 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
        */
       if (prefix_size >= (~(png_size_t)0) - 1 ||
          expanded_size >= (~(png_size_t)0) - 1 - prefix_size
-#ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
+#ifdef PNG_USER_LIMITS_SUPPORTED
          || (png_ptr->user_chunk_malloc_max &&
           (prefix_size + expanded_size >= png_ptr->user_chunk_malloc_max - 1))
 #else
-#  ifdef PNG_USER_CHUNK_MALLOC_MAX
          || ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
           prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)
-#  endif
 #endif
          )
          png_warning(png_ptr, "Exceeded size limit while expanding chunk");
@@ -1259,13 +1257,16 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       /* Should be an error, but we can cope with it */
       png_warning(png_ptr, "Out of place iCCP chunk");
 
-   if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP))
+   if ((png_ptr->mode & PNG_HAVE_iCCP) || (info_ptr != NULL &&
+      (info_ptr->valid & (PNG_INFO_iCCP|PNG_INFO_sRGB))))
    {
       png_warning(png_ptr, "Duplicate iCCP chunk");
       png_crc_finish(png_ptr, length);
       return;
    }
 
+   png_ptr->mode |= PNG_HAVE_iCCP;
+
 #ifdef PNG_MAX_MALLOC_64K
    if (length > (png_uint_32)65535L)
    {
@@ -1795,16 +1796,16 @@ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       return;
    }
 
-   num = length / 2 ;
+   if (length > 2*PNG_MAX_PALETTE_LENGTH ||
-
+       length != (unsigned int) (2*png_ptr->num_palette))
-   if (num != (unsigned int)png_ptr->num_palette || num >
-       (unsigned int)PNG_MAX_PALETTE_LENGTH)
    {
       png_warning(png_ptr, "Incorrect hIST chunk length");
       png_crc_finish(png_ptr, length);
       return;
    }
 
+   num = length / 2 ;
+
    for (i = 0; i < num; i++)
    {
       png_byte buf[2];

reactos/dll/3rdparty/libpng/pngset.c

@@ -1,8 +1,8 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.5.7 [December 15, 2011]
+ * Last changed in libpng 1.5.11 [June 14, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -149,7 +149,7 @@ png_set_gAMA_fixed(png_structp png_ptr, png_infop info_ptr, png_fixed_point
     * possible for 1/gamma to overflow the limit of 21474 and this means the
     * gamma value must be at least 5/100000 and hence at most 20000.0.  For
     * safety the limits here are a little narrower.  The values are 0.00016 to
-    * 6250.0, which are truly ridiculous gammma values (and will produce
+    * 6250.0, which are truly ridiculous gamma values (and will produce
     * displays that are all black or all white.)
     */
    if (file_gamma < 16 || file_gamma > 625000000)
@@ -692,24 +692,28 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
     */
    if (info_ptr->num_text + num_text > info_ptr->max_text)
    {
+      int old_max_text = info_ptr->max_text;
+      int old_num_text = info_ptr->num_text;
+
       if (info_ptr->text != NULL)
       {
          png_textp old_text;
-         int old_max;
 
-         old_max = info_ptr->max_text;
          info_ptr->max_text = info_ptr->num_text + num_text + 8;
          old_text = info_ptr->text;
+
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
 
          if (info_ptr->text == NULL)
          {
-            png_free(png_ptr, old_text);
+            /* Restore to previous condition */
+            info_ptr->max_text = old_max_text;
+            info_ptr->text = old_text;
             return(1);
          }
 
-         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max *
+         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max_text *
              png_sizeof(png_text)));
          png_free(png_ptr, old_text);
       }
@@ -721,7 +725,12 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr,
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
              (png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
+         {
+            /* Restore to previous condition */
+            info_ptr->num_text = old_num_text;
+            info_ptr->max_text = old_max_text;
             return(1);
+         }
          info_ptr->free_me |= PNG_FREE_TEXT;
       }
 
@@ -1281,4 +1290,22 @@ png_set_benign_errors(png_structp png_ptr, int allowed)
       png_ptr->flags &= ~PNG_FLAG_BENIGN_ERRORS_WARN;
 }
 #endif /* PNG_BENIGN_ERRORS_SUPPORTED */
+
+#ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
+/* Whether to report invalid palette index; added at libng-1.5.10
+ *   allowed  - one of 0: disable; 1: enable
+ */
+void PNGAPI
+png_set_check_for_invalid_index(png_structp png_ptr, int allowed)
+{
+   png_debug(1, "in png_set_check_for_invalid_index");
+
+   if (allowed)
+      png_ptr->num_palette_max = 0;
+
+   else
+      png_ptr->num_palette_max = -1;
+}
+#endif
+
 #endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */

reactos/dll/3rdparty/libpng/pngstruct.h

@@ -1,7 +1,7 @@
 
 /* pngstruct.h - header file for PNG reference library
  *
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -121,6 +121,12 @@ struct png_struct_def
    png_uint_32 crc;           /* current chunk CRC value */
    png_colorp palette;        /* palette from the input file */
    png_uint_16 num_palette;   /* number of color entries in palette */
+
+/* Added at libpng-1.5.10 */
+#ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
+   int num_palette_max;       /* maximum palette index found in IDAT */
+#endif
+
    png_uint_16 num_trans;     /* number of transparency values */
    png_byte compression;      /* file compression type (always 0) */
    png_byte filter;           /* file filter type (always 0) */
@@ -211,13 +217,6 @@ struct png_struct_def
    int process_mode;                 /* what push library is currently doing */
    int cur_palette;                  /* current push library palette index */
 
-#  ifdef PNG_TEXT_SUPPORTED
-     png_size_t current_text_size;   /* current size of text input data */
-     png_size_t current_text_left;   /* how much text left to read in input */
-     png_charp current_text;         /* current text chunk buffer */
-     png_charp current_text_ptr;     /* current location in current_text */
-#  endif /* PNG_PROGRESSIVE_READ_SUPPORTED && PNG_TEXT_SUPPORTED */
-
 #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */
 
 #if defined(__TURBOC__) && !defined(_Windows) && !defined(__FLAT__)
@@ -249,6 +248,7 @@ struct png_struct_def
 #endif
 
 #ifdef PNG_TIME_RFC1123_SUPPORTED
+   /* This is going to be unused in libpng16 and removed from libpng17 */
    char time_buffer[29]; /* String to hold RFC 1123 time text */
 #endif
 

reactos/dll/3rdparty/libpng/pngtest.c

@@ -1817,4 +1817,4 @@ main(int argc, char *argv[])
 }
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_5_9 Your_png_h_is_not_version_1_5_9;
+typedef png_libpng_version_1_5_12 Your_png_h_is_not_version_1_5_12;

reactos/dll/3rdparty/libpng/pngtrans.c

@@ -1,8 +1,8 @@
 
 /* pngtrans.c - transforms the data in a row (used by both readers and writers)
  *
- * Last changed in libpng 1.5.4 [July 7, 2011]
+ * Last changed in libpng 1.5.11 [June 14, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -619,6 +619,109 @@ png_do_bgr(png_row_infop row_info, png_bytep row)
 }
 #endif /* PNG_READ_BGR_SUPPORTED or PNG_WRITE_BGR_SUPPORTED */
 
+#if defined(PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED) || \
+    defined(PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED)
+/* Added at libpng-1.5.10 */
+void /* PRIVATE */
+png_do_check_palette_indexes(png_structp png_ptr, png_row_infop row_info)
+{
+   if (png_ptr->num_palette < (1 << row_info->bit_depth) &&
+      png_ptr->num_palette > 0) /* num_palette can be 0 in MNG files */
+   {
+      /* Calculations moved outside switch in an attempt to stop different
+       * compiler warnings.  'padding' is in *bits* within the last byte, it is
+       * an 'int' because pixel_depth becomes an 'int' in the expression below,
+       * and this calculation is used because it avoids warnings that other
+       * forms produced on either GCC or MSVC.
+       */
+      int padding = (-row_info->pixel_depth * row_info->width) & 7;
+      png_bytep rp = png_ptr->row_buf + row_info->rowbytes;
+
+      switch (row_info->bit_depth)
+      {
+         case 1:
+         {
+            /* in this case, all bytes must be 0 so we don't need
+             * to unpack the pixels except for the rightmost one.
+             */
+            for (; rp > png_ptr->row_buf; rp--)
+            {
+              if (*rp >> padding != 0)
+                 png_ptr->num_palette_max = 1;
+              padding = 0;
+            }
+
+            break;
+         }
+
+         case 2:
+         {
+            for (; rp > png_ptr->row_buf; rp--)
+            {
+              int i = ((*rp >> padding) & 0x03);
+
+              if (i > png_ptr->num_palette_max)
+                 png_ptr->num_palette_max = i;
+
+              i = (((*rp >> padding) >> 2) & 0x03);
+
+              if (i > png_ptr->num_palette_max)
+                 png_ptr->num_palette_max = i;
+
+              i = (((*rp >> padding) >> 4) & 0x03);
+
+              if (i > png_ptr->num_palette_max)
+                 png_ptr->num_palette_max = i;
+
+              i = (((*rp >> padding) >> 6) & 0x03);
+
+              if (i > png_ptr->num_palette_max)
+                 png_ptr->num_palette_max = i;
+
+              padding = 0;
+            }
+
+            break;
+         }
+
+         case 4:
+         {
+            for (; rp > png_ptr->row_buf; rp--)
+            {
+              int i = ((*rp >> padding) & 0x0f);
+
+              if (i > png_ptr->num_palette_max)
+                 png_ptr->num_palette_max = i;
+
+              i = (((*rp >> padding) >> 4) & 0x0f);
+
+              if (i > png_ptr->num_palette_max)
+                 png_ptr->num_palette_max = i;
+
+              padding = 0;
+            }
+
+            break;
+         }
+
+         case 8:
+         {
+            for (; rp > png_ptr->row_buf; rp--)
+            {
+               if (*rp > png_ptr->num_palette_max)
+                  png_ptr->num_palette_max = (int) *rp;
+            }
+
+            break;
+         }
+
+         default:
+            break;
+      }
+   }
+}
+#endif /* PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED */
+
 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
     defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
 #ifdef PNG_USER_TRANSFORM_PTR_SUPPORTED

reactos/dll/3rdparty/libpng/pngwrite.c

@@ -1,8 +1,8 @@
 
 /* pngwrite.c - general routines to write a PNG file
  *
- * Last changed in libpng 1.5.7 [December 15, 2011]
+ * Last changed in libpng 1.5.11 [June 14, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -305,6 +305,11 @@ png_write_end(png_structp png_ptr, png_infop info_ptr)
    if (!(png_ptr->mode & PNG_HAVE_IDAT))
       png_error(png_ptr, "No IDATs written into file");
 
+#ifdef PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED
+   if (png_ptr->num_palette_max > png_ptr->num_palette)
+      png_benign_error(png_ptr, "Wrote palette index exceeding num_palette");
+#endif
+
    /* See if user wants us to write information chunks */
    if (info_ptr != NULL)
    {
@@ -798,6 +803,14 @@ png_write_row(png_structp png_ptr, png_const_bytep row)
    }
 #endif
 
+/* Added at libpng-1.5.10 */
+#ifdef PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED
+   /* Check for out-of-range palette index */
+   if (row_info.color_type == PNG_COLOR_TYPE_PALETTE &&
+       png_ptr->num_palette_max >= 0)
+      png_do_check_palette_indexes(png_ptr, &row_info);
+#endif
+
    /* Find a filter if necessary, filter the row and write it out. */
    png_write_find_filter(png_ptr, &row_info);
 

reactos/dll/3rdparty/libpng/pngwutil.c

@@ -1,8 +1,8 @@
 
 /* pngwutil.c - utilities to write a PNG file
  *
- * Last changed in libpng 1.5.6 [November 3, 2011]
+ * Last changed in libpng 1.5.10 [March 8, 2012]
- * Copyright (c) 1998-2011 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -569,14 +569,15 @@ png_text_compress(png_structp png_ptr,
 
 /* Ship the compressed text out via chunk writes */
 static void /* PRIVATE */
-png_write_compressed_data_out(png_structp png_ptr, compression_state *comp)
+png_write_compressed_data_out(png_structp png_ptr, compression_state *comp,
+   png_size_t data_len)
 {
    int i;
 
    /* Handle the no-compression case */
    if (comp->input)
    {
-      png_write_chunk_data(png_ptr, comp->input, comp->input_len);
+      png_write_chunk_data(png_ptr, comp->input, data_len);
 
       return;
    }
@@ -585,7 +586,7 @@ png_write_compressed_data_out(png_structp png_ptr, compression_state *comp)
    /* The zbuf_size test is because the code below doesn't work if zbuf_size is
     * '1'; simply skip it to avoid memory overwrite.
     */
-   if (comp->input_len >= 2 && comp->input_len < 16384 && png_ptr->zbuf_size > 1)
+   if (data_len >= 2 && comp->input_len < 16384 && png_ptr->zbuf_size > 1)
    {
       unsigned int z_cmf;  /* zlib compression method and flags */
 
@@ -1164,8 +1165,7 @@ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type,
 
    if (profile_len)
    {
-      comp.input_len = profile_len;
+      png_write_compressed_data_out(png_ptr, &comp, profile_len);
-      png_write_compressed_data_out(png_ptr, &comp);
    }
 
    png_write_chunk_end(png_ptr);
@@ -1735,8 +1735,7 @@ png_write_zTXt(png_structp png_ptr, png_const_charp key, png_const_charp text,
    png_write_chunk_data(png_ptr, &buf, (png_size_t)1);
 
    /* Write the compressed data */
-   comp.input_len = text_len;
+   png_write_compressed_data_out(png_ptr, &comp, text_len);
-   png_write_compressed_data_out(png_ptr, &comp);
 
    /* Close the chunk */
    png_write_chunk_end(png_ptr);
@@ -1827,7 +1826,7 @@ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key,
    png_write_chunk_data(png_ptr, (lang_key ? (png_const_bytep)lang_key : cbuf),
        (png_size_t)(lang_key_len + 1));
 
-   png_write_compressed_data_out(png_ptr, &comp);
+   png_write_compressed_data_out(png_ptr, &comp, text_len);
 
    png_write_chunk_end(png_ptr);
 

reactos/include/reactos/libs/libpng/png.h

@@ -1,7 +1,7 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.5.9 - February 18, 2012
+ * libpng version 1.5.12 - July 11, 2012
  * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -11,7 +11,7 @@
  * Authors and maintainers:
  *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *   libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.5.9 - February 18, 2012: Glenn
+ *   libpng versions 0.97, January 1998, through 1.5.12 - July 11, 2012: Glenn
  *   See also "Contributing Authors", below.
  *
  * Note about libpng version numbers:
@@ -172,6 +172,12 @@
  *    1.5.9beta01-02          15    10509  15.so.15.9[.0]
  *    1.5.9rc01               15    10509  15.so.15.9[.0]
  *    1.5.9                   15    10509  15.so.15.9[.0]
+ *    1.5.10beta01-05         15    10510  15.so.15.10[.0]
+ *    1.5.10                  15    10510  15.so.15.10[.0]
+ *    1.5.11beta01            15    10511  15.so.15.11[.0]
+ *    1.5.11rc01-05           15    10511  15.so.15.11[.0]
+ *    1.5.11                  15    10511  15.so.15.11[.0]
+ *    1.5.12                  15    10512  15.so.15.12[.0]
  *
  *   Henceforth the source version will match the shared-library major
  *   and minor numbers; the shared-library major version number will be
@@ -181,7 +187,7 @@
  *   to the source version x.y.z (leading zeros in y and z).  Beta versions
  *   were given the previous public release number plus a letter, until
  *   version 1.0.6j; from then on they were given the upcoming public
- *   release number plus "betaNN" or "rcN".
+ *   release number plus "betaNN" or "rcNN".
  *
  *   Binary incompatibility exists only when applications make direct access
  *   to the info_ptr or png_ptr members through png.h, and the compiled
@@ -203,7 +209,7 @@
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.2.6, August 15, 2004, through 1.5.9, February 18, 2012, are
+ * libpng versions 1.2.6, August 15, 2004, through 1.5.12, July 11, 2012, are
  * Copyright (c) 2004, 2006-2012 Glenn Randers-Pehrson, and are
  * distributed according to the same disclaimer and license as libpng-1.2.5
  * with the following individual added to the list of Contributing Authors:
@@ -315,13 +321,13 @@
  * Y2K compliance in libpng:
  * =========================
  *
- *    February 18, 2012
+ *    July 11, 2012
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.5.9 are Y2K compliant.  It is my belief that
+ *    upward through 1.5.12 are Y2K compliant.  It is my belief that
  *    earlier versions were also Y2K compliant.
  *
  *    Libpng only has two year fields.  One is a 2-byte unsigned integer
@@ -332,7 +338,8 @@
  *        "png_uint_16 year" in png_time_struct.
  *
  *    The string is
- *        "png_char time_buffer" in png_struct
+ *        "char time_buffer[29]" in png_struct.  This will be no
+ *    longer used in libpng-1.6.0 and will be removed from libpng-1.7.0.
  *
  *    There are seven time-related functions:
  *        png.c: png_convert_to_rfc_1123() in png.c
@@ -379,9 +386,9 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.5.9"
+#define PNG_LIBPNG_VER_STRING "1.5.12"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.5.9 - February 18, 2012\n"
+     " libpng version 1.5.12 - July 11, 2012\n"
 
 #define PNG_LIBPNG_VER_SONUM   15
 #define PNG_LIBPNG_VER_DLLNUM  15
@@ -389,7 +396,7 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   5
-#define PNG_LIBPNG_VER_RELEASE 9
+#define PNG_LIBPNG_VER_RELEASE 12
 
 /* This should match the numeric part of the final component of
  * PNG_LIBPNG_VER_STRING, omitting any leading zero:
@@ -412,7 +419,7 @@
 #define PNG_LIBPNG_BUILD_SPECIAL 32 /* Cannot be OR'ed with
                                        PNG_LIBPNG_BUILD_PRIVATE */
 
-#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_BETA
+#define PNG_LIBPNG_BUILD_BASE_TYPE PNG_LIBPNG_BUILD_STABLE
 
 /* Careful here.  At one time, Guy wanted to use 082, but that would be octal.
  * We must not include leading zeros.
@@ -420,7 +427,7 @@
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
  * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release
  */
-#define PNG_LIBPNG_VER 10509 /* 1.5.9 */
+#define PNG_LIBPNG_VER 10512 /* 1.5.12 */
 
 /* Library configuration: these options cannot be changed after
  * the library has been built.
@@ -542,7 +549,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef char* png_libpng_version_1_5_9;
+typedef char* png_libpng_version_1_5_12;
 
 /* Three color definitions.  The order of the red, green, and blue, (and the
  * exact size) is not important, although the size of the fields need to
@@ -2637,6 +2644,12 @@ PNG_EXPORT(207, void, png_save_uint_16, (png_bytep buf, unsigned int i));
       : (png_int_32)png_get_uint_32(buf)))
 #endif
 
+#if defined(PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED) || \
+    defined(PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED)
+PNG_EXPORT(234, void, png_set_check_for_invalid_index, (png_structp png_ptr,
+    int allowed));
+#endif
+
 /* Maintainer: Put new public prototypes here ^, in libpng.3, and project
  * defs
  */
@@ -2646,7 +2659,7 @@ PNG_EXPORT(207, void, png_save_uint_16, (png_bytep buf, unsigned int i));
  * scripts/symbols.def as well.
  */
 #ifdef PNG_EXPORT_LAST_ORDINAL
-  PNG_EXPORT_LAST_ORDINAL(233);
+  PNG_EXPORT_LAST_ORDINAL(234);
 #endif
 
 #ifdef __cplusplus

reactos/include/reactos/libs/libpng/pngconf.h

@@ -1,7 +1,7 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.5.9 - February 18, 2012
+ * libpng version 1.5.12 - July 11, 2012
  *
  * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -25,7 +25,7 @@
 #ifndef PNG_BUILDING_SYMBOL_TABLE
 /* PNG_NO_LIMITS_H may be used to turn off the use of the standard C
  * definition file for  machine specific limits, this may impact the
- * correctness of the definitons below (see uses of INT_MAX).
+ * correctness of the definitions below (see uses of INT_MAX).
  */
 #  ifndef PNG_NO_LIMITS_H
 #    include <limits.h>
@@ -51,8 +51,8 @@
 
 /* This controls optimization of the reading of 16 and 32 bit values
  * from PNG files.  It can be set on a per-app-file basis - it
- * just changes whether a macro is used to the function is called.
+ * just changes whether a macro is used when the function is called.
- * The library builder sets the default, if read functions are not
+ * The library builder sets the default; if read functions are not
  * built into the library the macro implementation is forced on.
  */
 #ifndef PNG_READ_INT_FUNCTIONS_SUPPORTED

reactos/include/reactos/libs/libpng/pnglibconf.h

@@ -3,9 +3,9 @@
 
 /* pnglibconf.h - library build configuration */
 
-/* libpng version 1.5.4 - last changed on June 22, 2011 */
+/* Libpng 1.5.12 - July 11, 2012 */
 
-/* Copyright (c) 1998-2011 Glenn Randers-Pehrson */
+/* Copyright (c) 1998-2012 Glenn Randers-Pehrson */
 
 /* This code is released under the libpng license. */
 /* For conditions of distribution and use, see the disclaimer */
@@ -31,10 +31,6 @@
 #define PNG_QUANTIZE_GREEN_BITS 5
 #define PNG_QUANTIZE_RED_BITS 5
 #define PNG_sCAL_PRECISION 5
-#define PNG_USER_CHUNK_CACHE_MAX 0
-#define PNG_USER_CHUNK_MALLOC_MAX 0
-#define PNG_USER_HEIGHT_MAX 1000000
-#define PNG_USER_WIDTH_MAX 1000000
 #define PNG_WEIGHT_SHIFT 8
 #define PNG_ZBUF_SIZE 8192
 /* end of settings */
@@ -45,6 +41,7 @@
 #define PNG_bKGD_SUPPORTED
 #define PNG_BUILD_GRAYSCALE_PALETTE_SUPPORTED
 #define PNG_CHECK_cHRM_SUPPORTED
+#define PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
 #define PNG_cHRM_SUPPORTED
 #define PNG_CONSOLE_IO_SUPPORTED
 #define PNG_CONVERT_tIME_SUPPORTED
@@ -74,6 +71,7 @@
 #define PNG_READ_BACKGROUND_SUPPORTED
 #define PNG_READ_BGR_SUPPORTED
 #define PNG_READ_bKGD_SUPPORTED
+#define PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
 #define PNG_READ_cHRM_SUPPORTED
 #define PNG_READ_COMPOSITE_NODIV_SUPPORTED
 #define PNG_READ_COMPRESSED_TEXT_SUPPORTED
@@ -145,6 +143,7 @@
 #define PNG_WRITE_ANCILLARY_CHUNKS_SUPPORTED
 #define PNG_WRITE_BGR_SUPPORTED
 #define PNG_WRITE_bKGD_SUPPORTED
+#define PNG_WRITE_CHECK_FOR_INVALID_INDEX_SUPPORTED
 #define PNG_WRITE_cHRM_SUPPORTED
 #define PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
 #define PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED