diff -ru4N libpng-1.2.26/Makefile.am libpng-1.2.27/Makefile.am --- libpng-1.2.26/Makefile.am 2008-04-02 12:27:55.328103092 -0500 +++ libpng-1.2.27/Makefile.am 2008-04-28 19:38:45.260317816 -0500 @@ -85,13 +85,16 @@ ${srcdir}/contrib/pngminus/* \ ${srcdir}/contrib/pngsuite/* \ ${srcdir}/contrib/visupng/* \ $(TESTS) \ - example.c libpng.txt pngvcrd.c + example.c libpng-1.2.27.txt pngvcrd.c CLEANFILES= pngout.png libpng12.pc libpng12-config libpng.vers \ libpng.sym +MAINTAINERCLEANFILES = Makefile.in aclocal.m4 config.guess config.h.in \ +config.sub configure depcomp install-sh ltmain.sh missing + $(PNGLIB_BASENAME).pc: libpng.pc cp libpng.pc $@ $(PNGLIB_BASENAME)-config: libpng-config diff -ru4N libpng-1.2.26/configure.ac libpng-1.2.27/configure.ac --- libpng-1.2.26/configure.ac 2008-04-02 12:27:55.373016093 -0500 +++ libpng-1.2.27/configure.ac 2008-04-28 19:38:45.305359366 -0500 @@ -37,8 +37,9 @@ AC_PROG_CC AC_PROG_LD AC_PROG_CPP AC_CHECK_TOOL(SED, sed, :) +AC_LIBTOOL_WIN32_DLL AC_PROG_INSTALL AC_PROG_LN_S AC_PROG_MAKE_SET AC_PROG_LIBTOOL diff -ru4N libpng-1.2.26/png.h libpng-1.2.27/png.h --- libpng-1.2.26/png.h 2008-04-02 12:27:29.867681595 -0500 +++ libpng-1.2.27/png.h 2008-04-28 19:38:21.814508813 -0500 @@ -1,5 +1,4 @@ - /* png.h - header file for PNG reference library * * libpng version 1.2.27 - April 29, 2008 * Copyright (c) 1998-2008 Glenn Randers-Pehrson @@ -180,8 +179,14 @@ * 1.0.31 10 10031 10.so.0.31[.0] * 1.2.25 13 10225 12.so.0.25[.0] * 1.2.26beta01-06 13 10226 12.so.0.26[.0] * 1.2.26rc01 13 10226 12.so.0.26[.0] + * 1.2.26 13 10226 12.so.0.26[.0] + * 1.0.32 10 10032 10.so.0.32[.0] + * 1.2.27beta01-06 13 10227 12.so.0.27[.0] + * 1.2.27rc01 13 10227 12.so.0.27[.0] + * 1.0.33 10 10032 10.so.0.33[.0] + * 1.2.27 13 10227 12.so.0.27[.0] * * Henceforth the source version will match the shared-library major * and minor numbers; the shared-library major version number will be * used for changes in backward compatibility, as it is intended. The @@ -189,9 +194,9 @@ * for applications, is an unsigned integer of the form xyyzz corresponding * to the source version x.y.z (leading zeros in y and z). Beta versions * were given the previous public release number plus a letter, until * version 1.0.6j; from then on they were given the upcoming public - * release number plus "betaNN" or "rcN". + * release number plus "betaNN" or "rcNN". * * Binary incompatibility exists only when applications make direct access * to the info_ptr or png_ptr members through png.h, and the compiled * application is loaded with a different version of the library. diff -ru4N libpng-1.2.26/pngmem.c libpng-1.2.27/pngmem.c --- libpng-1.2.26/pngmem.c 2008-04-05 21:37:26.543330673 -0500 +++ libpng-1.2.27/pngmem.c 2008-04-28 19:38:22.015337549 -0500 @@ -1,8 +1,8 @@ /* pngmem.c - stub functions for memory allocation * - * Last changed in libpng 1.2.26 [April 2, 2008] + * Last changed in libpng 1.2.27 [April 29, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -292,9 +292,9 @@ png_free_default(png_structp png_ptr, png_voidp ptr) { #endif /* PNG_USER_MEM_SUPPORTED */ - if(png_ptr == NULL) return; + if(png_ptr == NULL || ptr == NULL) return; if (png_ptr->offset_table != NULL) { int i; diff -ru4N libpng-1.2.26/pngpread.c libpng-1.2.27/pngpread.c --- libpng-1.2.26/pngpread.c 2008-04-05 21:37:29.944173338 -0500 +++ libpng-1.2.27/pngpread.c 2008-04-28 19:38:22.067206508 -0500 @@ -1,8 +1,8 @@ /* pngpread.c - read a png file in push mode * - * Last changed in libpng 1.2.26 [April 2, 2008] + * Last changed in libpng 1.2.27 [April 29, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -1501,11 +1501,16 @@ (png_charp)png_ptr->chunk_name, png_sizeof(png_ptr->unknown_chunk.name)); png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name)-1]='\0'; - png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length); png_ptr->unknown_chunk.size = (png_size_t)length; - png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length); + if (length == 0) + png_ptr->unknown_chunk.data = NULL; + else + { + png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length); + png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length); + } #if defined(PNG_READ_USER_CHUNKS_SUPPORTED) if(png_ptr->read_user_chunk_fn != NULL) { /* callback to user unknown chunk handler */ diff -ru4N libpng-1.2.26/pngrtran.c libpng-1.2.27/pngrtran.c --- libpng-1.2.26/pngrtran.c 2008-04-02 12:27:30.477040372 -0500 +++ libpng-1.2.27/pngrtran.c 2008-04-28 19:38:22.270040113 -0500 @@ -1,8 +1,8 @@ /* pngrtran.c - transforms the data in a row for PNG readers * - * Last changed in libpng 1.2.25 [February 18, 2008] + * Last changed in libpng 1.2.27 [April 29, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -547,11 +547,9 @@ { png_debug(1, "in png_set_expand\n"); if(png_ptr == NULL) return; png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS); -#ifdef PNG_WARN_UNINITIALIZED_ROW png_ptr->flags &= ~PNG_FLAG_ROW_INIT; -#endif } /* GRR 19990627: the following three functions currently are identical * to png_set_expand(). However, it is entirely reasonable that someone @@ -576,11 +574,9 @@ { png_debug(1, "in png_set_palette_to_rgb\n"); if(png_ptr == NULL) return; png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS); -#ifdef PNG_WARN_UNINITIALIZED_ROW png_ptr->flags &= ~PNG_FLAG_ROW_INIT; -#endif } #if !defined(PNG_1_0_X) /* Expand grayscale images of less than 8-bit depth to 8 bits. */ @@ -589,11 +585,9 @@ { png_debug(1, "in png_set_expand_gray_1_2_4_to_8\n"); if(png_ptr == NULL) return; png_ptr->transformations |= PNG_EXPAND; -#ifdef PNG_WARN_UNINITIALIZED_ROW png_ptr->flags &= ~PNG_FLAG_ROW_INIT; -#endif } #endif #if defined(PNG_1_0_X) || defined(PNG_1_2_X) @@ -614,11 +608,9 @@ png_set_tRNS_to_alpha(png_structp png_ptr) { png_debug(1, "in png_set_tRNS_to_alpha\n"); png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS); -#ifdef PNG_WARN_UNINITIALIZED_ROW png_ptr->flags &= ~PNG_FLAG_ROW_INIT; -#endif } #endif /* defined(PNG_READ_EXPAND_SUPPORTED) */ #if defined(PNG_READ_GRAY_TO_RGB_SUPPORTED) @@ -626,11 +618,9 @@ png_set_gray_to_rgb(png_structp png_ptr) { png_debug(1, "in png_set_gray_to_rgb\n"); png_ptr->transformations |= PNG_GRAY_TO_RGB; -#ifdef PNG_WARN_UNINITIALIZED_ROW png_ptr->flags &= ~PNG_FLAG_ROW_INIT; -#endif } #endif #if defined(PNG_READ_RGB_TO_GRAY_SUPPORTED) @@ -966,9 +956,9 @@ } /* Prevent the transformations being done again, and make sure * that the now spurious alpha channel is stripped - the code * has just reduced background composition and gamma correction - * to a simply alpha channel strip. + * to a simple alpha channel strip. */ png_ptr->transformations &= ~PNG_BACKGROUND; png_ptr->transformations &= ~PNG_GAMMA; png_ptr->transformations |= PNG_STRIP_ALPHA; @@ -1137,9 +1127,10 @@ if (png_ptr->transformations & PNG_EXPAND) { if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) { - if (png_ptr->num_trans && (png_ptr->transformations & PNG_EXPAND_tRNS)) + if (png_ptr->num_trans && + (png_ptr->transformations & PNG_EXPAND_tRNS)) info_ptr->color_type = PNG_COLOR_TYPE_RGB_ALPHA; else info_ptr->color_type = PNG_COLOR_TYPE_RGB; info_ptr->bit_depth = 8; @@ -1150,10 +1141,12 @@ if (png_ptr->num_trans) { if (png_ptr->transformations & PNG_EXPAND_tRNS) info_ptr->color_type |= PNG_COLOR_MASK_ALPHA; +#if 0 /* Removed from libpng-1.2.27 */ else info_ptr->color_type |= PNG_COLOR_MASK_COLOR; +#endif } if (info_ptr->bit_depth < 8) info_ptr->bit_depth = 8; info_ptr->num_trans = 0; diff -ru4N libpng-1.2.26/pngrutil.c libpng-1.2.27/pngrutil.c --- libpng-1.2.26/pngrutil.c 2008-04-05 21:37:32.785260077 -0500 +++ libpng-1.2.27/pngrutil.c 2008-04-28 19:38:22.364959159 -0500 @@ -1,8 +1,8 @@ /* pngrutil.c - utilities to read a PNG file * - * Last changed in libpng 1.2.26 [April 2, 2008] + * Last changed in libpng 1.2.27 [April 29, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -1240,17 +1240,11 @@ void /* PRIVATE */ png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { png_byte readbuf[PNG_MAX_PALETTE_LENGTH]; - int bit_mask; png_debug(1, "in png_handle_tRNS\n"); - /* For non-indexed color, mask off any bits in the tRNS value that - * exceed the bit depth. Some creators were writing extra bits there. - * This is not needed for indexed color. */ - bit_mask = (1 << png_ptr->bit_depth) - 1; - if (!(png_ptr->mode & PNG_HAVE_IHDR)) png_error(png_ptr, "Missing IHDR before tRNS"); else if (png_ptr->mode & PNG_HAVE_IDAT) { @@ -1277,9 +1271,9 @@ } png_crc_read(png_ptr, buf, 2); png_ptr->num_trans = 1; - png_ptr->trans_values.gray = png_get_uint_16(buf) & bit_mask; + png_ptr->trans_values.gray = png_get_uint_16(buf); } else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) { png_byte buf[6]; @@ -1291,11 +1285,11 @@ return; } png_crc_read(png_ptr, buf, (png_size_t)length); png_ptr->num_trans = 1; - png_ptr->trans_values.red = png_get_uint_16(buf) & bit_mask; - png_ptr->trans_values.green = png_get_uint_16(buf + 2) & bit_mask; - png_ptr->trans_values.blue = png_get_uint_16(buf + 4) & bit_mask; + png_ptr->trans_values.red = png_get_uint_16(buf); + png_ptr->trans_values.green = png_get_uint_16(buf + 2); + png_ptr->trans_values.blue = png_get_uint_16(buf + 4); } else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) { if (!(png_ptr->mode & PNG_HAVE_PLTE)) @@ -2226,11 +2220,16 @@ png_memcpy((png_charp)png_ptr->unknown_chunk.name, (png_charp)png_ptr->chunk_name, png_sizeof(png_ptr->unknown_chunk.name)); png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name)-1] = '\0'; - png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length); png_ptr->unknown_chunk.size = (png_size_t)length; - png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length); + if (length == 0) + png_ptr->unknown_chunk.data = NULL; + else + { + png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length); + png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length); + } #if defined(PNG_READ_USER_CHUNKS_SUPPORTED) if(png_ptr->read_user_chunk_fn != NULL) { /* callback to user unknown chunk handler */ @@ -2250,9 +2249,9 @@ } } else #endif - png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1); + png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1); png_free(png_ptr, png_ptr->unknown_chunk.data); png_ptr->unknown_chunk.data = NULL; } else @@ -3148,10 +3147,9 @@ #endif if(row_bytes + 64 > png_ptr->old_big_row_buf_size) { - if (png_ptr->big_row_buf) - png_free(png_ptr,png_ptr->big_row_buf); + png_free(png_ptr,png_ptr->big_row_buf); png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes+64); png_ptr->row_buf = png_ptr->big_row_buf+32; png_ptr->old_big_row_buf_size = row_bytes+64; } @@ -3164,10 +3162,9 @@ png_error(png_ptr, "Row has too many bytes to allocate in memory."); if(png_ptr->rowbytes+1 > png_ptr->old_prev_row_size) { - if (png_ptr->prev_row) - png_free(png_ptr,png_ptr->prev_row); + png_free(png_ptr,png_ptr->prev_row); png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)( png_ptr->rowbytes + 1)); png_ptr->old_prev_row_size = png_ptr->rowbytes+1; } diff -ru4N libpng-1.2.26/pngset.c libpng-1.2.27/pngset.c --- libpng-1.2.26/pngset.c 2008-04-02 12:27:30.621225067 -0500 +++ libpng-1.2.27/pngset.c 2008-04-28 19:38:22.410252918 -0500 @@ -1,8 +1,8 @@ /* pngset.c - storage of image information into info struct * - * Last changed in libpng 1.2.25 [February 18, 2008] + * Last changed in libpng 1.2.27 [April 29, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -913,39 +913,52 @@ png_debug1(1, "in %s storage function\n", "tRNS"); if (png_ptr == NULL || info_ptr == NULL) return; + png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0); + if (trans != NULL) { /* * It may not actually be necessary to set png_ptr->trans here; * we do it for backward compatibility with the way the png_handle_tRNS * function used to do the allocation. */ -#ifdef PNG_FREE_ME_SUPPORTED - png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0); -#endif + /* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */ png_ptr->trans = info_ptr->trans = (png_bytep)png_malloc(png_ptr, (png_uint_32)PNG_MAX_PALETTE_LENGTH); - if (num_trans <= PNG_MAX_PALETTE_LENGTH) + if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH) png_memcpy(info_ptr->trans, trans, (png_size_t)num_trans); -#ifdef PNG_FREE_ME_SUPPORTED - info_ptr->free_me |= PNG_FREE_TRNS; -#else - png_ptr->flags |= PNG_FLAG_FREE_TRNS; -#endif } if (trans_values != NULL) { + int sample_max = (1 << info_ptr->bit_depth); + if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY && + (int)trans_values->gray > sample_max) || + (info_ptr->color_type == PNG_COLOR_TYPE_RGB && + ((int)trans_values->red > sample_max || + (int)trans_values->green > sample_max || + (int)trans_values->blue > sample_max))) + png_warning(png_ptr, + "tRNS chunk has out-of-range samples for bit_depth"); png_memcpy(&(info_ptr->trans_values), trans_values, png_sizeof(png_color_16)); if (num_trans == 0) num_trans = 1; } + info_ptr->num_trans = (png_uint_16)num_trans; - info_ptr->valid |= PNG_INFO_tRNS; + if (num_trans != 0) + { + info_ptr->valid |= PNG_INFO_tRNS; +#ifdef PNG_FREE_ME_SUPPORTED + info_ptr->free_me |= PNG_FREE_TRNS; +#else + png_ptr->flags |= PNG_FLAG_FREE_TRNS; +#endif + } } #endif #if defined(PNG_sPLT_SUPPORTED) @@ -1039,30 +1052,33 @@ info_ptr->unknown_chunks=NULL; for (i = 0; i < num_unknowns; i++) { - png_unknown_chunkp to = np + info_ptr->unknown_chunks_num + i; - png_unknown_chunkp from = unknowns + i; + png_unknown_chunkp to = np + info_ptr->unknown_chunks_num + i; + png_unknown_chunkp from = unknowns + i; - png_memcpy((png_charp)to->name, - (png_charp)from->name, - png_sizeof(from->name)); - to->name[png_sizeof(to->name)-1] = '\0'; + png_memcpy((png_charp)to->name, + (png_charp)from->name, + png_sizeof(from->name)); + to->name[png_sizeof(to->name)-1] = '\0'; + to->size = from->size; + /* note our location in the read or write sequence */ + to->location = (png_byte)(png_ptr->mode & 0xff); - to->data = (png_bytep)png_malloc_warn(png_ptr, from->size); - if (to->data == NULL) - { - png_warning(png_ptr, + if (from->size == 0) + to->data=NULL; + else + { + to->data = (png_bytep)png_malloc_warn(png_ptr, from->size); + if (to->data == NULL) + { + png_warning(png_ptr, "Out of memory while processing unknown chunk."); - } - else - { - png_memcpy(to->data, from->data, from->size); - to->size = from->size; - - /* note our location in the read or write sequence */ - to->location = (png_byte)(png_ptr->mode & 0xff); - } + to->size=0; + } + else + png_memcpy(to->data, from->data, from->size); + } } info_ptr->unknown_chunks = np; info_ptr->unknown_chunks_num += num_unknowns; @@ -1192,10 +1208,9 @@ png_set_compression_buffer_size(png_structp png_ptr, png_uint_32 size) { if (png_ptr == NULL) return; - if(png_ptr->zbuf) - png_free(png_ptr, png_ptr->zbuf); + png_free(png_ptr, png_ptr->zbuf); png_ptr->zbuf_size = (png_size_t)size; png_ptr->zbuf = (png_bytep)png_malloc(png_ptr, size); png_ptr->zstream.next_out = png_ptr->zbuf; png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size; diff -ru4N libpng-1.2.26/pngtest.c libpng-1.2.27/pngtest.c --- libpng-1.2.26/pngtest.c 2008-04-02 12:27:30.672802643 -0500 +++ libpng-1.2.27/pngtest.c 2008-04-28 19:38:22.462691712 -0500 @@ -1,10 +1,10 @@ /* pngtest.c - a simple test program to test libpng * - * Last changed in libpng 1.2.23 - [November 6, 2007] + * Last changed in libpng 1.2.27 - [April 29, 2008] * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2007 Glenn Randers-Pehrson + * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * * This program reads in a PNG image, writes it out again, and then @@ -688,10 +688,9 @@ if (setjmp(png_jmpbuf(read_ptr))) #endif { fprintf(STDERR, "%s -> %s: libpng read error\n", inname, outname); - if (row_buf) - png_free(read_ptr, row_buf); + png_free(read_ptr, row_buf); png_destroy_read_struct(&read_ptr, &read_info_ptr, &end_info_ptr); #ifdef PNG_WRITE_SUPPORTED png_destroy_info_struct(write_ptr, &write_end_info_ptr); png_destroy_write_struct(&write_ptr, &write_info_ptr); @@ -1023,10 +1022,18 @@ if (png_get_tRNS(read_ptr, read_info_ptr, &trans, &num_trans, &trans_values)) { - png_set_tRNS(write_ptr, write_info_ptr, trans, num_trans, - trans_values); + int sample_max = (1 << read_info_ptr->bit_depth); + /* libpng doesn't reject a tRNS chunk with out-of-range samples */ + if (!((read_info_ptr->color_type == PNG_COLOR_TYPE_GRAY && + (int)trans_values->gray > sample_max) || + (read_info_ptr->color_type == PNG_COLOR_TYPE_RGB && + ((int)trans_values->red > sample_max || + (int)trans_values->green > sample_max || + (int)trans_values->blue > sample_max)))) + png_set_tRNS(write_ptr, write_info_ptr, trans, num_trans, + trans_values); } } #endif #if defined(PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED) diff -ru4N libpng-1.2.26/pngwrite.c libpng-1.2.27/pngwrite.c --- libpng-1.2.26/pngwrite.c 2008-04-02 12:27:30.775542734 -0500 +++ libpng-1.2.27/pngwrite.c 2008-04-28 19:38:22.563925438 -0500 @@ -1,8 +1,8 @@ /* pngwrite.c - general routines to write a PNG file * - * Last changed in libpng 1.2.25 [February 18, 2008] + * Last changed in libpng 1.2.27 [April 29, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -111,8 +111,10 @@ !(up->location & PNG_HAVE_IDAT) && ((up->name[3] & 0x20) || keep == PNG_HANDLE_CHUNK_ALWAYS || (png_ptr->flags & PNG_FLAG_KEEP_UNSAFE_CHUNKS))) { + if (up->size == 0) + png_warning(png_ptr, "Writing zero-length unknown chunk"); png_write_chunk(png_ptr, up->name, up->data, up->size); } } } diff -ru4N libpng-1.2.26/pngwutil.c libpng-1.2.27/pngwutil.c --- libpng-1.2.26/pngwutil.c 2008-04-05 21:37:36.435142425 -0500 +++ libpng-1.2.27/pngwutil.c 2008-04-28 19:38:22.673120311 -0500 @@ -1,8 +1,8 @@ /* pngwutil.c - utilities to write a PNG file * - * Last changed in libpng 1.2.26 [April 2, 2008] + * Last changed in libpng 1.2.27 [April 29, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -1515,10 +1515,9 @@ png_write_compressed_data_out(png_ptr, &comp); png_write_chunk_end(png_ptr); png_free(png_ptr, new_key); - if (new_lang) - png_free(png_ptr, new_lang); + png_free(png_ptr, new_lang); } #endif #if defined(PNG_WRITE_oFFs_SUPPORTED)