Security bug for libpng, update needed to 1.2.36

There's a new version of libpng, 1.2.36 which fixes a security bug. Chrome/Chromium still runs on 1.2.35 it seems

BUG=13046
TEST=Ran tests


Review URL: http://codereview.chromium.org/112080

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@17365 0039d316-1c4b-4281-b951-d872f2087c98

15 files changed, 193 insertions, 151 deletions

diff --git a/third_party/libpng/LICENSE b/third_party/libpng/LICENSE
index 50b4041..7e0387c 100644
--- a/third_party/libpng/LICENSE
+++ b/third_party/libpng/LICENSE
@@ -8,8 +8,8 @@ COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
 If you modify libpng you may insert additional notices immediately following
 this sentence.
 
-libpng versions 1.2.6, August 15, 2004, through 1.2.35, February 14, 2009, are
-Copyright (c) 2004, 2006-2008 Glenn Randers-Pehrson, and are
+libpng versions 1.2.6, August 15, 2004, through 1.2.36, May 7, 2009, are
+Copyright (c) 2004, 2006-2009 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
 
@@ -106,4 +106,4 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-February 14, 2009
+May 7, 2009
diff --git a/third_party/libpng/README b/third_party/libpng/README
index 6d57ac4..06caf24 100644
--- a/third_party/libpng/README
+++ b/third_party/libpng/README
@@ -1,4 +1,4 @@
-README for libpng version 1.2.35 - February 14, 2009 (shared library 12.0)
+README for libpng version 1.2.36 - May 7, 2009 (shared library 12.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
@@ -194,11 +194,11 @@ Files in this distribution:
        descrip.mms      =>  VMS makefile for MMS or MMK
        makefile.std     =>  Generic UNIX makefile (cc, creates static libpng.a)
        makefile.elf     =>  Linux/ELF makefile symbol versioning,
-                            gcc, creates libpng12.so.0.1.2.35)
+                            gcc, creates libpng12.so.0.1.2.36)
        makefile.linux   =>  Linux/ELF makefile
-                            (gcc, creates libpng12.so.0.1.2.35)
+                            (gcc, creates libpng12.so.0.1.2.36)
        makefile.gcmmx   =>  Linux/ELF makefile
-                            (gcc, creates libpng12.so.0.1.2.35,
+                            (gcc, creates libpng12.so.0.1.2.36,
                             uses assembler code tuned for Intel MMX platform)
        makefile.gcc     =>  Generic makefile (gcc, creates static libpng.a)
        makefile.knr     =>  Archaic UNIX Makefile that converts files with
@@ -220,12 +220,12 @@ Files in this distribution:
        makefile.openbsd =>  OpenBSD makefile
        makefile.sgi     =>  Silicon Graphics IRIX (cc, creates static lib)
        makefile.sggcc   =>  Silicon Graphics
-                            (gcc, creates libpng12.so.0.1.2.35)
+                            (gcc, creates libpng12.so.0.1.2.36)
        makefile.sunos   =>  Sun makefile
        makefile.solaris =>  Solaris 2.X makefile
-                            (gcc, creates libpng12.so.0.1.2.35)
+                            (gcc, creates libpng12.so.0.1.2.36)
        makefile.so9     =>  Solaris 9 makefile
-                            (gcc, creates libpng12.so.0.1.2.35)
+                            (gcc, creates libpng12.so.0.1.2.36)
        makefile.32sunu  =>  Sun Ultra 32-bit makefile
        makefile.64sunu  =>  Sun Ultra 64-bit makefile
        makefile.sco     =>  For SCO OSr5  ELF and Unixware 7 with Native cc
diff --git a/third_party/libpng/README.chromium b/third_party/libpng/README.chromium
index 898051e..358194c 100644
--- a/third_party/libpng/README.chromium
+++ b/third_party/libpng/README.chromium
@@ -2,7 +2,7 @@ Our custom configuration options are defined in pngusr.h. This was previously
 called mozpngconf.h, which was copied from Mozilla and modified by Apple (hence
 the webkit_* names).
 
-Updated to 1.2.35, no changes to the source files but all unneeded files
+Updated to 1.2.36, no changes to the source files but all unneeded files
 stripped.
 
 http://www.libpng.org/pub/png/libpng.html
diff --git a/third_party/libpng/png.c b/third_party/libpng/png.c
index e7d1405..e1c0666 100644
--- a/third_party/libpng/png.c
+++ b/third_party/libpng/png.c
@@ -13,7 +13,7 @@
 #include "png.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_2_35 Your_png_h_is_not_version_1_2_35;
+typedef version_1_2_36 Your_png_h_is_not_version_1_2_36;
 
 /* Version information for C files.  This had better match the version
  * string defined in png.h.  */
@@ -694,7 +694,7 @@ png_charp PNGAPI
 png_get_copyright(png_structp png_ptr)
 {
    png_ptr = png_ptr;  /* silence compiler warning about unused png_ptr */
-   return ((png_charp) "\n libpng version 1.2.35 - February 14, 2009\n\
+   return ((png_charp) "\n libpng version 1.2.36 - May 7, 2009\n\
    Copyright (c) 1998-2008 Glenn Randers-Pehrson\n\
    Copyright (c) 1996-1997 Andreas Dilger\n\
    Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\n");
@@ -800,6 +800,7 @@ png_convert_size(size_t size)
 /* Added at libpng version 1.2.34 and 1.4.0 (moved from pngset.c) */
 #if defined(PNG_cHRM_SUPPORTED)
 #if !defined(PNG_NO_CHECK_cHRM)
+
 /*
  Multiply two 32-bit numbers, V1 and V2, using 32-bit
  arithmetic, to produce a 64 bit result in the HI/LO words.
diff --git a/third_party/libpng/png.h b/third_party/libpng/png.h
index 1de4ddd..267677a 100644
--- a/third_party/libpng/png.h
+++ b/third_party/libpng/png.h
@@ -1,6 +1,6 @@
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.2.35 - February 14, 2009
+ * libpng version 1.2.36 - May 7, 2009
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -8,7 +8,7 @@
  * Authors and maintainers:
  *  libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *  libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *  libpng versions 0.97, January 1998, through 1.2.35 - February 14, 2009: Glenn
+ *  libpng versions 0.97, January 1998, through 1.2.36 - May 7, 2009: Glenn
  *  See also "Contributing Authors", below.
  *
  * Note about libpng version numbers:
@@ -222,6 +222,10 @@
  *    1.2.35rc01-02           13    10235  12.so.0.35[.0]
  *    1.0.43                  10    10043  10.so.0.43[.0]
  *    1.2.35                  13    10235  12.so.0.35[.0]
+ *    1.2.36beta01-05         13    10236  12.so.0.36[.0]
+ *    1.2.36rc01              13    10236  12.so.0.36[.0]
+ *    1.0.44                  10    10044  10.so.0.44[.0]
+ *    1.2.36                  13    10236  12.so.0.36[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
@@ -251,8 +255,8 @@
  * If you modify libpng you may insert additional notices immediately following
  * this sentence.
  *
- * libpng versions 1.2.6, August 15, 2004, through 1.2.35, February 14, 2009, are
- * Copyright (c) 2004, 2006-2008 Glenn Randers-Pehrson, and are
+ * libpng versions 1.2.6, August 15, 2004, through 1.2.36, May 7, 2009, are
+ * Copyright (c) 2004, 2006-2009 Glenn Randers-Pehrson, and are
  * distributed according to the same disclaimer and license as libpng-1.2.5
  * with the following individual added to the list of Contributing Authors:
  *
@@ -363,13 +367,13 @@
  * Y2K compliance in libpng:
  * =========================
  *
- *    February 14, 2009
+ *    May 7, 2009
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.2.35 are Y2K compliant.  It is my belief that earlier
+ *    upward through 1.2.36 are Y2K compliant.  It is my belief that earlier
  *    versions were also Y2K compliant.
  *
  *    Libpng only has three year fields.  One is a 2-byte unsigned integer
@@ -425,9 +429,9 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.2.35"
+#define PNG_LIBPNG_VER_STRING "1.2.36"
 #define PNG_HEADER_VERSION_STRING \
-   " libpng version 1.2.35 - February 14, 2009\n"
+   " libpng version 1.2.36 - May 7, 2009\n"
 
 #define PNG_LIBPNG_VER_SONUM   0
 #define PNG_LIBPNG_VER_DLLNUM  13
@@ -435,7 +439,7 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   2
-#define PNG_LIBPNG_VER_RELEASE 35
+#define PNG_LIBPNG_VER_RELEASE 36
 /* This should match the numeric part of the final component of
  * PNG_LIBPNG_VER_STRING, omitting any leading zero: */
 
@@ -463,7 +467,7 @@
  * Versions 0.7 through 1.0.0 were in the range 0 to 100 here (only
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
  * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release */
-#define PNG_LIBPNG_VER 10235 /* 1.2.35 */
+#define PNG_LIBPNG_VER 10236 /* 1.2.36 */
 
 #ifndef PNG_VERSION_INFO_ONLY
 /* include the compression library's header */
@@ -1487,7 +1491,7 @@ struct png_struct_def
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef png_structp version_1_2_35;
+typedef png_structp version_1_2_36;
 
 typedef png_struct FAR * FAR * png_structpp;
 
@@ -1987,6 +1991,11 @@ extern PNG_EXPORT(png_voidp,png_get_error_ptr) PNGARG((png_structp png_ptr));
  * If buffered output is not used, then output_flush_fn can be set to NULL.
  * If PNG_WRITE_FLUSH_SUPPORTED is not defined at libpng compile time
  * output_flush_fn will be ignored (and thus can be NULL).
+ * It is probably a mistake to use NULL for output_flush_fn if
+ * write_data_fn is not also NULL unless you have built libpng with
+ * PNG_WRITE_FLUSH_SUPPORTED undefined, because in this case libpng's
+ * default flush function, which uses the standard *FILE structure, will
+ * be used.
  */
 extern PNG_EXPORT(void,png_set_write_fn) PNGARG((png_structp png_ptr,
    png_voidp io_ptr, png_rw_ptr write_data_fn, png_flush_ptr output_flush_fn));
@@ -2556,64 +2565,72 @@ extern PNG_EXPORT(void, png_write_png) PNGARG((png_structp png_ptr,
 #ifndef PNG_DEBUG_FILE
 #define PNG_DEBUG_FILE stderr
 #endif /* PNG_DEBUG_FILE */
+
 #if (PNG_DEBUG > 1)
-#ifndef png_debug
 /* Note: ["%s"m PNG_STRING_NEWLINE] probably does not work on
  * non-ISO compilers */
-#ifdef __STDC__
-#define png_debug(l,m) \
-{ \
-     int num_tabs=l; \
-     fprintf(PNG_DEBUG_FILE,"%s"m PNG_STRING_NEWLINE,(num_tabs==1 ? "\t" : \
-       (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":"")))); \
-}
-#endif
-#ifndef png_debug1
-#define png_debug1(l,m,p1) \
-{ \
-     int num_tabs=l; \
-     fprintf(PNG_DEBUG_FILE,"%s"m PNG_STRING_NEWLINE,(num_tabs==1 ? "\t" : \
-       (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))),p1); \
-}
-#endif
-#ifndef png_debug2
-#define png_debug2(l,m,p1,p2) \
-{ \
-     int num_tabs=l; \
-     fprintf(PNG_DEBUG_FILE,"%s"m PNG_STRING_NEWLINE,(num_tabs==1 ? "\t" : \
-       (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))),p1,p2); \
-}
-#endif
-#else /* __STDC __ */
-#ifndef png_debug
-#define png_debug(l,m) \
-     int num_tabs=l; \
-     char format[256]; \
-     snprintf(format,256,"%s%s%s",(num_tabs==1 ? "\t" : \
-       (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))), \
-       m,PNG_STRING_NEWLINE); \
-     fprintf(PNG_DEBUG_FILE,format);
-#endif
-#ifndef png_debug1
-#define png_debug1(l,m,p1) \
-     int num_tabs=l; \
-     char format[256]; \
-     snprintf(format,256,"%s%s%s",(num_tabs==1 ? "\t" : \
-       (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))), \
-       m,PNG_STRING_NEWLINE); \
-     fprintf(PNG_DEBUG_FILE,format,p1);
-#endif
-#ifndef png_debug2
-#define png_debug2(l,m,p1,p2) \
-     int num_tabs=l; \
-     char format[256]; \
-     snprintf(format,256,"%s%s%s",(num_tabs==1 ? "\t" : \
-       (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))), \
-       m,PNG_STRING_NEWLINE); \
-     fprintf(PNG_DEBUG_FILE,format,p1,p2);
-#endif
-#endif /* __STDC __ */
+#  ifdef __STDC__
+#    ifndef png_debug
+#      define png_debug(l,m) \
+       { \
+       int num_tabs=l; \
+       fprintf(PNG_DEBUG_FILE,"%s"m PNG_STRING_NEWLINE,(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":"")))); \
+       }
+#    endif
+#    ifndef png_debug1
+#      define png_debug1(l,m,p1) \
+       { \
+       int num_tabs=l; \
+       fprintf(PNG_DEBUG_FILE,"%s"m PNG_STRING_NEWLINE,(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))),p1); \
+       }
+#    endif
+#    ifndef png_debug2
+#      define png_debug2(l,m,p1,p2) \
+       { \
+       int num_tabs=l; \
+       fprintf(PNG_DEBUG_FILE,"%s"m PNG_STRING_NEWLINE,(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))),p1,p2); \
+       }
+#    endif
+#  else /* __STDC __ */
+#    ifndef png_debug
+#      define png_debug(l,m) \
+       { \
+       int num_tabs=l; \
+       char format[256]; \
+       snprintf(format,256,"%s%s%s",(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))), \
+         m,PNG_STRING_NEWLINE); \
+       fprintf(PNG_DEBUG_FILE,format); \
+       }
+#    endif
+#    ifndef png_debug1
+#      define png_debug1(l,m,p1) \
+       { \
+       int num_tabs=l; \
+       char format[256]; \
+       snprintf(format,256,"%s%s%s",(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))), \
+         m,PNG_STRING_NEWLINE); \
+       fprintf(PNG_DEBUG_FILE,format,p1); \
+       }
+#    endif
+#    ifndef png_debug2
+#      define png_debug2(l,m,p1,p2) \
+       { \
+       int num_tabs=l; \
+       char format[256]; \
+       snprintf(format,256,"%s%s%s",(num_tabs==1 ? "\t" : \
+         (num_tabs==2 ? "\t\t":(num_tabs>2 ? "\t\t\t":""))), \
+         m,PNG_STRING_NEWLINE); \
+       fprintf(PNG_DEBUG_FILE,format,p1,p2); \
+       }
+#    endif
+#  endif /* __STDC __ */
 #endif /* (PNG_DEBUG > 1) */
+
 #endif /* _MSC_VER */
 #endif /* (PNG_DEBUG > 0) */
 #endif /* PNG_DEBUG */
@@ -2708,6 +2725,7 @@ extern PNG_EXPORT(void,png_set_mmx_thresholds)
 #if !defined(PNG_1_0_X)
 /* png.c, pnggccrd.c, or pngvcrd.c */
 extern PNG_EXPORT(int,png_mmx_support) PNGARG((void));
+#endif /* PNG_1_0_X */
 #endif /* PNG_ASSEMBLER_CODE_SUPPORTED */
 
 /* Strip the prepended error numbers ("#nnn ") from error and warning
@@ -2717,8 +2735,6 @@ extern PNG_EXPORT(void,png_set_strip_error_numbers) PNGARG((png_structp
    png_ptr, png_uint_32 strip_mode));
 #endif
 
-#endif /* PNG_1_0_X */
-
 /* Added at libpng-1.2.6 */
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
 extern PNG_EXPORT(void,png_set_user_limits) PNGARG((png_structp
diff --git a/third_party/libpng/pngconf.h b/third_party/libpng/pngconf.h
index 834f7e7..f5e5c59 100644
--- a/third_party/libpng/pngconf.h
+++ b/third_party/libpng/pngconf.h
@@ -1,7 +1,7 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.2.35 - February 14, 2009
+ * libpng version 1.2.36 - May 7, 2009
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -314,21 +314,29 @@
 #ifdef PNG_SETJMP_SUPPORTED
 /* This is an attempt to force a single setjmp behaviour on Linux.  If
  * the X config stuff didn't define _BSD_SOURCE we wouldn't need this.
+ *
+ * You can bypass this test if you know that your application uses exactly
+ * the same setjmp.h that was included when libpng was built.  Only define
+ * PNG_SKIP_SETJMP_CHECK while building your application, prior to the
+ * application's '#include "png.h"'. Don't define PNG_SKIP_SETJMP_CHECK
+ * while building a separate libpng library for general use.
  */
 
-#  ifdef __linux__
-#    ifdef _BSD_SOURCE
-#      define PNG_SAVE_BSD_SOURCE
-#      undef _BSD_SOURCE
-#    endif
-#    ifdef _SETJMP_H
-     /* If you encounter a compiler error here, see the explanation
-      * near the end of INSTALL.
-      */
-         __pngconf.h__ already includes setjmp.h;
-         __dont__ include it again.;
-#    endif
-#  endif /* __linux__ */
+#  ifndef PNG_SKIP_SETJMP_CHECK
+#    ifdef __linux__
+#      ifdef _BSD_SOURCE
+#        define PNG_SAVE_BSD_SOURCE
+#        undef _BSD_SOURCE
+#      endif
+#      ifdef _SETJMP_H
+       /* If you encounter a compiler error here, see the explanation
+        * near the end of INSTALL.
+        */
+           __pngconf.h__ in libpng already includes setjmp.h;
+           __dont__ include it again.;
+#      endif
+#    endif /* __linux__ */
+#  endif /* PNG_SKIP_SETJMP_CHECK */
 
    /* include setjmp.h for error handling */
 #  include <setjmp.h>
@@ -800,7 +808,6 @@
 #  define PNG_USER_HEIGHT_MAX 1000000L
 #endif
 
-
 /* Added at libpng-1.2.34 and 1.4.0 */
 #ifndef PNG_STRING_NEWLINE
 #define PNG_STRING_NEWLINE "\n"
diff --git a/third_party/libpng/pngerror.c b/third_party/libpng/pngerror.c
index 7652171..b85ee11 100644
--- a/third_party/libpng/pngerror.c
+++ b/third_party/libpng/pngerror.c
@@ -1,9 +1,9 @@
 
 /* pngerror.c - stub functions for i/o and memory allocation
  *
- * Last changed in libpng 1.2.34 [December 18, 2008]
+ * Last changed in libpng 1.2.36 [May 7, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -44,7 +44,7 @@ png_error(png_structp png_ptr, png_const_charp error_message)
      {
        if (*error_message == '#')
        {
-         /* Strip "#nnnn " from beginning of error message. */
+           /* Strip "#nnnn " from beginning of error message. */
            int offset;
            for (offset = 1; offset<15; offset++)
               if (error_message[offset] == ' ')
@@ -217,7 +217,7 @@ png_default_error(png_structp png_ptr, png_const_charp error_message)
 #ifdef PNG_ERROR_NUMBERS_SUPPORTED
    if (*error_message == '#')
    {
-     /* Strip "#nnnn " from beginning of warning message. */
+     /* Strip "#nnnn " from beginning of error message. */
      int offset;
      char error_number[16];
      for (offset = 0; offset<15; offset++)
@@ -229,15 +229,21 @@ png_default_error(png_structp png_ptr, png_const_charp error_message)
      if ((offset > 1) && (offset < 15))
      {
        error_number[offset - 1] = '\0';
-       fprintf(stderr, "libpng error no. %s: %s\n", error_number,
-          error_message + offset + 1);
+       fprintf(stderr, "libpng error no. %s: %s",
+          error_number, error_message + offset + 1);
+       fprintf(stderr, PNG_STRING_NEWLINE);
      }
      else
-       fprintf(stderr, "libpng error: %s, offset=%d\n", error_message, offset);
+       fprintf(stderr, "libpng error: %s, offset=%d",
+          error_message, offset);
+       fprintf(stderr, PNG_STRING_NEWLINE);
    }
    else
 #endif
-   fprintf(stderr, "libpng error: %s\n", error_message);
+   {
+      fprintf(stderr, "libpng error: %s", error_message);
+      fprintf(stderr, PNG_STRING_NEWLINE);
+   }
 #endif
 
 #ifdef PNG_SETJMP_SUPPORTED
@@ -285,15 +291,23 @@ png_default_warning(png_structp png_ptr, png_const_charp warning_message)
      if ((offset > 1) && (offset < 15))
      {
        warning_number[offset + 1] = '\0';
-       fprintf(stderr, "libpng warning no. %s: %s\n", warning_number,
-          warning_message + offset);
+       fprintf(stderr, "libpng warning no. %s: %s",
+          warning_number, warning_message + offset);
+       fprintf(stderr, PNG_STRING_NEWLINE);
      }
      else
-       fprintf(stderr, "libpng warning: %s\n", warning_message);
+     {
+       fprintf(stderr, "libpng warning: %s",
+          warning_message);
+       fprintf(stderr, PNG_STRING_NEWLINE);
+     }
    }
    else
 #  endif
-     fprintf(stderr, "libpng warning: %s\n", warning_message);
+   {
+     fprintf(stderr, "libpng warning: %s", warning_message);
+     fprintf(stderr, PNG_STRING_NEWLINE);
+   }
 #else
    warning_message = warning_message; /* make compiler happy */
 #endif
diff --git a/third_party/libpng/pngmem.c b/third_party/libpng/pngmem.c
index e28476f..f3394d7 100644
--- a/third_party/libpng/pngmem.c
+++ b/third_party/libpng/pngmem.c
@@ -425,6 +425,7 @@ png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn,
    need to allocate exactly 64K, so whatever you call here must
    have the ability to do that. */
 
+
 png_voidp PNGAPI
 png_malloc(png_structp png_ptr, png_uint_32 size)
 {
diff --git a/third_party/libpng/pngread.c b/third_party/libpng/pngread.c
index ace91ba..8e9c0cb 100644
--- a/third_party/libpng/pngread.c
+++ b/third_party/libpng/pngread.c
@@ -1434,11 +1434,11 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
    {
       info_ptr->row_pointers = (png_bytepp)png_malloc(png_ptr,
          info_ptr->height * png_sizeof(png_bytep));
+      png_memset(info_ptr->row_pointers, 0, info_ptr->height
+         * png_sizeof(png_bytep));
 #ifdef PNG_FREE_ME_SUPPORTED
       info_ptr->free_me |= PNG_FREE_ROWS;
 #endif
-      png_memset(info_ptr->row_pointers, 0, info_ptr->height
-         * png_sizeof(png_bytep));
       for (row = 0; row < (int)info_ptr->height; row++)
          info_ptr->row_pointers[row] = (png_bytep)png_malloc(png_ptr,
             png_get_rowbytes(png_ptr, info_ptr));
diff --git a/third_party/libpng/pngrio.c b/third_party/libpng/pngrio.c
index f5027e7..d47d86d 100644
--- a/third_party/libpng/pngrio.c
+++ b/third_party/libpng/pngrio.c
@@ -1,9 +1,9 @@
 
 /* pngrio.c - functions for data input
  *
- * Last changed in libpng 1.2.30 [August 15, 2008]
+ * Last changed in libpng 1.2.36 [May 7, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -132,7 +132,9 @@ png_default_read_data(png_structp png_ptr, png_bytep data, png_size_t length)
                   a location where input data can be stored, and a 32-bit
                   unsigned int that is the number of bytes to be read.
                   To exit and output any fatal error messages the new write
-                  function should call png_error(png_ptr, "Error msg"). */
+                  function should call png_error(png_ptr, "Error msg").
+                  May be NULL, in which case libpng's default function will
+                  be used. */
 void PNGAPI
 png_set_read_fn(png_structp png_ptr, png_voidp io_ptr,
    png_rw_ptr read_data_fn)
diff --git a/third_party/libpng/pngrtran.c b/third_party/libpng/pngrtran.c
index a916f54..d7dd8e7 100644
--- a/third_party/libpng/pngrtran.c
+++ b/third_party/libpng/pngrtran.c
@@ -455,10 +455,8 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
       int num_green = (1 << PNG_DITHER_GREEN_BITS);
       int num_blue = (1 << PNG_DITHER_BLUE_BITS);
       png_size_t num_entries = ((png_size_t)1 << total_bits);
-
       png_ptr->palette_lookup = (png_bytep )png_malloc(png_ptr,
          (png_uint_32)(num_entries * png_sizeof(png_byte)));
-
       png_memset(png_ptr->palette_lookup, 0, num_entries *
          png_sizeof(png_byte));
 
@@ -4125,14 +4123,13 @@ png_build_gamma_table(png_structp png_ptr)
 
      png_ptr->gamma_16_table = (png_uint_16pp)png_malloc(png_ptr,
         (png_uint_32)(num * png_sizeof(png_uint_16p)));
+     png_memset(png_ptr->gamma_16_table, 0, num * png_sizeof(png_uint_16p)); 
 
      if (png_ptr->transformations & (PNG_16_TO_8 | PNG_BACKGROUND))
      {
         double fin, fout;
         png_uint_32 last, max;
 
-        png_memset(png_ptr->gamma_16_table, 0, num * png_sizeof(png_uint_16p)); 
-
         for (i = 0; i < num; i++)
         {
            png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr,
@@ -4187,7 +4184,6 @@ png_build_gamma_table(png_structp png_ptr)
 
         png_ptr->gamma_16_to_1 = (png_uint_16pp)png_malloc(png_ptr,
            (png_uint_32)(num * png_sizeof(png_uint_16p )));
-
         png_memset(png_ptr->gamma_16_to_1, 0, num * png_sizeof(png_uint_16p)); 
 
         for (i = 0; i < num; i++)
@@ -4212,7 +4208,6 @@ png_build_gamma_table(png_structp png_ptr)
 
         png_ptr->gamma_16_from_1 = (png_uint_16pp)png_malloc(png_ptr,
            (png_uint_32)(num * png_sizeof(png_uint_16p)));
-
         png_memset(png_ptr->gamma_16_from_1, 0,
            num * png_sizeof(png_uint_16p)); 
 
diff --git a/third_party/libpng/pngrutil.c b/third_party/libpng/pngrutil.c
index 5fafde6..f6f9859 100644
--- a/third_party/libpng/pngrutil.c
+++ b/third_party/libpng/pngrutil.c
@@ -1,9 +1,9 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.2.34 [December 18, 2008]
+ * Last changed in libpng 1.2.36 [May 7, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -3187,9 +3187,11 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
    if (row_bytes + 64 > png_ptr->old_big_row_buf_size)
    {
      png_free(png_ptr, png_ptr->big_row_buf);
-     png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes+64);
-     png_ptr->row_buf = png_ptr->big_row_buf+32;
-     png_ptr->old_big_row_buf_size = row_bytes+64;
+      png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 64);
+     if (png_ptr->interlaced)
+       png_memset(png_ptr->big_row_buf, 0, png_ptr->rowbytes + 64);
+     png_ptr->row_buf = png_ptr->big_row_buf + 32;
+     png_ptr->old_big_row_buf_size = row_bytes + 64;
    }
 
 #ifdef PNG_MAX_MALLOC_64K
diff --git a/third_party/libpng/pngset.c b/third_party/libpng/pngset.c
index 9e12b0d..9aa29f1 100644
--- a/third_party/libpng/pngset.c
+++ b/third_party/libpng/pngset.c
@@ -1,7 +1,7 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.2.35 [February 14, 2009]
+ * Last changed in libpng 1.2.36 [May 7, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -108,7 +108,7 @@ png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr,
 void PNGAPI
 png_set_gAMA(png_structp png_ptr, png_infop info_ptr, double file_gamma)
 {
-   double gamma;
+   double png_gamma;
    png_debug1(1, "in %s storage function", "gAMA");
    if (png_ptr == NULL || info_ptr == NULL)
       return;
@@ -117,16 +117,16 @@ png_set_gAMA(png_structp png_ptr, png_infop info_ptr, double file_gamma)
    if (file_gamma > 21474.83)
    {
       png_warning(png_ptr, "Limiting gamma to 21474.83");
-      gamma=21474.83;
+      png_gamma=21474.83;
    }
    else
-      gamma = file_gamma;
-   info_ptr->gamma = (float)gamma;
+      png_gamma = file_gamma;
+   info_ptr->gamma = (float)png_gamma;
 #ifdef PNG_FIXED_POINT_SUPPORTED
-   info_ptr->int_gamma = (int)(gamma*100000.+.5);
+   info_ptr->int_gamma = (int)(png_gamma*100000.+.5);
 #endif
    info_ptr->valid |= PNG_INFO_gAMA;
-   if (gamma == 0.0)
+   if (png_gamma == 0.0)
       png_warning(png_ptr, "Setting gamma=0");
 }
 #endif
@@ -134,7 +134,7 @@ void PNGAPI
 png_set_gAMA_fixed(png_structp png_ptr, png_infop info_ptr, png_fixed_point
    int_gamma)
 {
-   png_fixed_point gamma;
+   png_fixed_point png_gamma;
 
    png_debug1(1, "in %s storage function", "gAMA");
    if (png_ptr == NULL || info_ptr == NULL)
@@ -143,26 +143,26 @@ png_set_gAMA_fixed(png_structp png_ptr, png_infop info_ptr, png_fixed_point
    if (int_gamma > (png_fixed_point) PNG_UINT_31_MAX)
    {
      png_warning(png_ptr, "Limiting gamma to 21474.83");
-     gamma=PNG_UINT_31_MAX;
+     png_gamma=PNG_UINT_31_MAX;
    }
    else
    {
      if (int_gamma < 0)
      {
        png_warning(png_ptr, "Setting negative gamma to zero");
-       gamma = 0;
+       png_gamma = 0;
      }
      else
-       gamma = int_gamma;
+       png_gamma = int_gamma;
    }
 #ifdef PNG_FLOATING_POINT_SUPPORTED
-   info_ptr->gamma = (float)(gamma/100000.);
+   info_ptr->gamma = (float)(png_gamma/100000.);
 #endif
 #ifdef PNG_FIXED_POINT_SUPPORTED
-   info_ptr->int_gamma = gamma;
+   info_ptr->int_gamma = png_gamma;
 #endif
    info_ptr->valid |= PNG_INFO_gAMA;
-   if (gamma == 0)
+   if (png_gamma == 0)
       png_warning(png_ptr, "Setting gamma=0");
 }
 #endif
@@ -383,10 +383,6 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
       return;
    }
 
-#ifdef PNG_FREE_ME_SUPPORTED
-   info_ptr->free_me |= PNG_FREE_PCAL;
-#endif
-
    png_memset(info_ptr->pcal_params, 0, (nparams + 1) * png_sizeof(png_charp));
 
    for (i = 0; i < nparams; i++)
@@ -404,6 +400,9 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
    }
 
    info_ptr->valid |= PNG_INFO_pCAL;
+#ifdef PNG_FREE_ME_SUPPORTED
+   info_ptr->free_me |= PNG_FREE_PCAL;
+#endif
 }
 #endif
 
@@ -961,7 +960,6 @@ png_set_sPLT(png_structp png_ptr,
 
     png_memcpy(np, info_ptr->splt_palettes,
            info_ptr->splt_palettes_num * png_sizeof(png_sPLT_t));
-
     png_free(png_ptr, info_ptr->splt_palettes);
     info_ptr->splt_palettes=NULL;
 
diff --git a/third_party/libpng/pngwio.c b/third_party/libpng/pngwio.c
index 52eb7c0..ab4dba26 100644
--- a/third_party/libpng/pngwio.c
+++ b/third_party/libpng/pngwio.c
@@ -1,7 +1,7 @@
 
 /* pngwio.c - functions for data output
  *
- * Last changed in libpng 1.2.35 [February 14, 2009]
+ * Last changed in libpng 1.2.36 [May 7, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -137,8 +137,7 @@ png_default_flush(png_structp png_ptr)
    if (png_ptr == NULL) return;
 #if !defined(_WIN32_WCE)
    io_ptr = (png_FILE_p)CVT_PTR((png_ptr->io_ptr));
-   if (io_ptr != NULL && fileno(io_ptr) != -1)
-      fflush(io_ptr);
+   fflush(io_ptr);
 #endif
 }
 #endif
@@ -156,7 +155,9 @@ png_default_flush(png_structp png_ptr)
                    data to be written, and a 32-bit unsigned int that is
                    the number of bytes to be written.  The new write
                    function should call png_error(png_ptr, "Error msg")
-                   to exit and output any fatal error messages.
+                   to exit and output any fatal error messages.  May be
+                   NULL, in which case libpng's default function will
+                   be used.
    flush_data_fn - pointer to a new flush function that takes as its
                    arguments a pointer to a png_struct.  After a call to
                    the flush function, there should be no data in any buffers
@@ -165,7 +166,11 @@ png_default_flush(png_structp png_ptr)
                    supplied although it doesn't have to do anything.  If
                    PNG_WRITE_FLUSH_SUPPORTED is not defined at libpng compile
                    time, output_flush_fn will be ignored, although it must be
-                   supplied for compatibility. */
+                   supplied for compatibility.  May be NULL, in which case
+                   libpng's default function will be used, if
+                   PNG_WRITE_FLUSH_SUPPORTED is defined.  This is not
+                   a good idea if io_ptr does not point to a standard
+                   *FILE structure. */
 void PNGAPI
 png_set_write_fn(png_structp png_ptr, png_voidp io_ptr,
    png_rw_ptr write_data_fn, png_flush_ptr output_flush_fn)
diff --git a/third_party/libpng/pngwutil.c b/third_party/libpng/pngwutil.c
index 957e266..3f55f57 100644
--- a/third_party/libpng/pngwutil.c
+++ b/third_party/libpng/pngwutil.c
@@ -1,9 +1,9 @@
 
 /* pngwutil.c - utilities to write a PNG file
  *
- * Last changed in libpng 1.2.34 [December 18, 2008]
+ * Last changed in libpng 1.2.36 [May 7, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  */
@@ -785,6 +785,7 @@ png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type,
    {
       png_warning(png_ptr,
         "Embedded profile length too large in iCCP chunk");
+      png_free(png_ptr, new_name);
       return;
    }
 
@@ -1759,9 +1760,9 @@ png_write_start_row(png_structp png_ptr)
    if (png_ptr->do_filter & (PNG_FILTER_AVG | PNG_FILTER_UP | PNG_FILTER_PAETH))
    {
      /* set up previous row buffer */
-      png_ptr->prev_row = (png_bytep)png_malloc(png_ptr,
+     png_ptr->prev_row = (png_bytep)png_malloc(png_ptr,
         (png_uint_32)buf_size);
-      png_memset(png_ptr->prev_row, 0, buf_size);
+     png_memset(png_ptr->prev_row, 0, buf_size);
 
       if (png_ptr->do_filter & PNG_FILTER_UP)
       {