Revert "libpng 1.6.3"

This reverts commit 777c940a87944192afaa28904c30145bfeb54d09.

Many Blink LayoutTests starts failing after this patch.
http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20Blink&tests=canvas/philip/tests/security.dataURI.html,canvas/philip/tests/toDataURL.arguments.1.html,canvas/philip/tests/toDataURL.arguments.2.html,canvas/philip/tests/toDataURL.arguments.3.html,canvas/philip/tests/toDataURL.bogustype.html,canvas/philip/tests/toDataURL.default.html,canvas/philip/tests/toDataURL.lowercase.ascii.html,canvas/philip/tests/toDataURL.lowercase.unicode.html,canvas/philip/tests/toDataURL.nocontext.html,canvas/philip/tests/toDataURL.png.complexcolours.html,canvas/philip/tests/toDataURL.png.html,canvas/philip/tests/toDataURL.png.primarycolours.html,canvas/philip/tests/toDataURL.unrecognised.html,compositing/overflow/image-load-overflow-scrollbars.html,compositing/overflow/invisible-descendants-should-not-affect-opt-in.html,compositing/tiling/huge-layer-img.html,css2.1/20110323/inline-replaced-width-014.htm,css2.1/t0905-c414-flt-wrap-01-d-g.html,fast/backgrounds/bgCompositeCopy.html,fast/canvas/canvas-blending-color-over-image.html,fast/canvas/canvas-blending-color-over-pattern.html,fast/canvas/canvas-blending-gradient-over-image.html,fast/canvas/canvas-blending-gradient-over-pattern.html,fast/canvas/canvas-blending-image-over-color.html,fast/canvas/canvas-blending-image-over-gradient.html,fast/canvas/canvas-blending-image-over-image.html,fast/canvas/canvas-blending-image-over-pattern.html,fast/canvas/canvas-blending-pattern-over-color.html,fast/canvas/canvas-blending-pattern-over-gradient.html,fast/canvas/canvas-blending-pattern-over-image.html,fast/canvas/canvas-blending-pattern-over-pattern.html,fast/canvas/canvas-createImageBitmap-drawImage.html,fast/canvas/canvas-createImageBitmap-immutable.html,fast/canvas/canvas-createImageBitmap-invalid-args.html,fast/canvas/canvas-createImageBitmap-out-of-bounds-src.html,fast/canvas/canvas-createImageBitmap-recursive.html,fast/canvas/canvas-createPattern-fillRect-shadow.html,fast/canvas/canvas-drawImage-out-of-bounds-src.html,fast/canvas/canvas-drawImage-shadow.html,fast/canvas/canvas-scale-drawImage-shadow.html,fast/canvas/canvas-toDataURL-case-insensitive-mimetype.html,fast/canvas/check-stale-putImageData.html,fast/canvas/toDataURL-alpha.html,fast/canvas/toDataURL-supportedTypes.html,fast/canvas/webgl/gl-teximage.html,fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-rgb565.html,fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-rgba4444.html,fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-rgba5551.html,fast/canvas/webgl/tex-image-and-sub-image-2d-with-image.html,fast/css/color-correction-on-backgrounds.html,fast/css/color-correction.html,fast/images/paint-subrect-grid.html,fast/images/png-suite/test.html,fast/images/png-with-color-profile.html,fast/images/rgb-png-with-cmyk-color-profile.html,inspector/profiler/canvas2d/canvas-get-resource-state.html,inspector/profiler/webgl/webgl-get-resource-state.html,svg/W3C-SVG-1.1/filters-blend-01-b.svg,svg/W3C-SVG-1.1/masking-path-04-b.svg,svg/dynamic-updates/SVGFEBlendElement-dom-in-attr.html,svg/dynamic-updates/SVGFEBlendElement-dom-in2-attr.html,svg/dynamic-updates/SVGFEBlendElement-dom-mode-attr.html,svg/dynamic-updates/SVGFEBlendElement-svgdom-in-prop.html,svg/dynamic-updates/SVGFEBlendElement-svgdom-in2-prop.html,svg/dynamic-updates/SVGFEBlendElement-svgdom-mode-prop.html,virtual/deferred/fast/images/paint-subrect-grid.html,virtual/deferred/fast/images/png-suite/test.html,virtual/deferred/fast/images/png-with-color-profile.html,virtual/deferred/fast/images/rgb-png-with-cmyk-color-profile.html,virtual/gpu/canvas/philip/tests/security.dataURI.html,virtual/gpu/canvas/philip/tests/toDataURL.arguments.1.html,virtual/gpu/canvas/philip/tests/toDataURL.arguments.2.html,virtual/gpu/canvas/philip/tests/toDataURL.arguments.3.html,virtual/gpu/canvas/philip/tests/toDataURL.bogustype.html,virtual/gpu/canvas/philip/tests/toDataURL.default.html,virtual/gpu/canvas/philip/tests/toDataURL.lowercase.ascii.html,virtual/gpu/canvas/philip/tests/toDataURL.lowercase.unicode.html,virtual/gpu/canvas/philip/tests/toDataURL.nocontext.html,virtual/gpu/canvas/philip/tests/toDataURL.png.complexcolours.html,virtual/gpu/canvas/philip/tests/toDataURL.png.html,virtual/gpu/canvas/philip/tests/toDataURL.png.primarycolours.html,virtual/gpu/canvas/philip/tests/toDataURL.unrecognised.html,virtual/gpu/compositedscrolling/overflow/image-load-overflow-scrollbars.html,virtual/gpu/compositedscrolling/overflow/invisible-descendants-should-not-affect-opt-in.html,virtual/gpu/fast/canvas/canvas-blending-color-over-image.html,virtual/gpu/fast/canvas/canvas-blending-color-over-pattern.html,virtual/gpu/fast/canvas/canvas-blending-gradient-over-image.html,virtual/gpu/fast/canvas/canvas-blending-gradient-over-pattern.html,virtual/gpu/fast/canvas/canvas-blending-image-over-color.html,virtual/gpu/fast/canvas/canvas-blending-image-over-gradient.html,virtual/gpu/fast/canvas/canvas-blending-image-over-image.html,virtual/gpu/fast/canvas/canvas-blending-image-over-pattern.html,virtual/gpu/fast/canvas/canvas-blending-pattern-over-color.html,virtual/gpu/fast/canvas/canvas-blending-pattern-over-gradient.html,virtual/gpu/fast/canvas/canvas-blending-pattern-over-image.html,virtual/gpu/fast/canvas/canvas-blending-pattern-over-pattern.html,virtual/gpu/fast/canvas/canvas-createImageBitmap-drawImage.html,virtual/gpu/fast/canvas/canvas-createImageBitmap-immutable.html,virtual/gpu/fast/canvas/canvas-createImageBitmap-invalid-args.html,virtual/gpu/fast/canvas/canvas-createImageBitmap-out-of-bounds-src.html,virtual/gpu/fast/canvas/canvas-createImageBitmap-recursive.html,virtual/gpu/fast/canvas/canvas-createPattern-fillRect-shadow.html,virtual/gpu/fast/canvas/canvas-drawImage-out-of-bounds-src.html,virtual/gpu/fast/canvas/canvas-scale-drawImage-shadow.html,virtual/gpu/fast/canvas/canvas-toDataURL-case-insensitive-mimetype.html,virtual/gpu/fast/canvas/check-stale-putImageData.html,virtual/gpu/fast/canvas/toDataURL-alpha.html,virtual/gpu/fast/canvas/toDataURL-supportedTypes.html,virtual/gpu/fast/canvas/webgl/gl-teximage.html,virtual/gpu/fast/canvas/webgl/premultiplyalpha-test.html,virtual/gpu/fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-rgb565.html,virtual/gpu/fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-rgba4444.html,virtual/gpu/fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-rgba5551.html,virtual/gpu/fast/canvas/webgl/tex-image-and-sub-image-2d-with-image.html,virtual/softwarecompositing/overflow/image-load-overflow-scrollbars.html,virtual/softwarecompositing/overflow/invisible-descendants-should-not-affect-opt-in.html,virtual/softwarecompositing/tiling/huge-layer-img.html

BUG=none
TBR= dominikg@chromium.org, arv@chromium.org

Review URL: https://codereview.chromium.org/23494067

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@224979 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 511 insertions, 147 deletions

diff --git a/third_party/libpng/pngmem.c b/third_party/libpng/pngmem.c
index b9b3efb..a18719b 100644
--- a/third_party/libpng/pngmem.c
+++ b/third_party/libpng/pngmem.c
@@ -1,8 +1,8 @@
 
 /* pngmem.c - stub functions for memory allocation
  *
- * Last changed in libpng 1.6.0 [February 14, 2013]
- * Copyright (c) 1998-2013 Glenn Randers-Pehrson
+ * Last changed in libpng 1.2.41 [February 25, 2010]
+ * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -17,232 +17,597 @@
  * identify the replacement functions.
  */
 
-#include "pngpriv.h"
-
+#define PNG_INTERNAL
+#define PNG_NO_PEDANTIC_WARNINGS
+#include "png.h"
 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
-/* Free a png_struct */
+
+/* Borland DOS special memory handler */
+#if defined(__TURBOC__) && !defined(_Windows) && !defined(__FLAT__)
+/* If you change this, be sure to change the one in png.h also */
+
+/* Allocate memory for a png_struct.  The malloc and memset can be replaced
+   by a single call to calloc() if this is thought to improve performance. */
+png_voidp /* PRIVATE */
+png_create_struct(int type)
+{
+#ifdef PNG_USER_MEM_SUPPORTED
+   return (png_create_struct_2(type, png_malloc_ptr_NULL, png_voidp_NULL));
+}
+
+/* Alternate version of png_create_struct, for use with user-defined malloc. */
+png_voidp /* PRIVATE */
+png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
+{
+#endif /* PNG_USER_MEM_SUPPORTED */
+   png_size_t size;
+   png_voidp struct_ptr;
+
+   if (type == PNG_STRUCT_INFO)
+      size = png_sizeof(png_info);
+   else if (type == PNG_STRUCT_PNG)
+      size = png_sizeof(png_struct);
+   else
+      return (png_get_copyright(NULL));
+
+#ifdef PNG_USER_MEM_SUPPORTED
+   if (malloc_fn != NULL)
+   {
+      png_struct dummy_struct;
+      png_structp png_ptr = &dummy_struct;
+      png_ptr->mem_ptr=mem_ptr;
+      struct_ptr = (*(malloc_fn))(png_ptr, (png_uint_32)size);
+   }
+   else
+#endif /* PNG_USER_MEM_SUPPORTED */
+   struct_ptr = (png_voidp)farmalloc(size);
+   if (struct_ptr != NULL)
+      png_memset(struct_ptr, 0, size);
+   return (struct_ptr);
+}
+
+/* Free memory allocated by a png_create_struct() call */
 void /* PRIVATE */
-png_destroy_png_struct(png_structrp png_ptr)
+png_destroy_struct(png_voidp struct_ptr)
 {
-   if (png_ptr != NULL)
+#ifdef PNG_USER_MEM_SUPPORTED
+   png_destroy_struct_2(struct_ptr, png_free_ptr_NULL, png_voidp_NULL);
+}
+
+/* Free memory allocated by a png_create_struct() call */
+void /* PRIVATE */
+png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn,
+    png_voidp mem_ptr)
+{
+#endif
+   if (struct_ptr != NULL)
    {
-      /* png_free might call png_error and may certainly call
-       * png_get_mem_ptr, so fake a temporary png_struct to support this.
-       */
-      png_struct dummy_struct = *png_ptr;
-      memset(png_ptr, 0, (sizeof *png_ptr));
-      png_free(&dummy_struct, png_ptr);
-
-#     ifdef PNG_SETJMP_SUPPORTED
-         /* We may have a jmp_buf left to deallocate. */
-         png_free_jmpbuf(&dummy_struct);
-#     endif
+#ifdef PNG_USER_MEM_SUPPORTED
+      if (free_fn != NULL)
+      {
+         png_struct dummy_struct;
+         png_structp png_ptr = &dummy_struct;
+         png_ptr->mem_ptr=mem_ptr;
+         (*(free_fn))(png_ptr, struct_ptr);
+         return;
+      }
+#endif /* PNG_USER_MEM_SUPPORTED */
+      farfree (struct_ptr);
    }
 }
 
 /* Allocate memory.  For reasonable files, size should never exceed
  * 64K.  However, zlib may allocate more then 64K if you don't tell
- * it not to.  See zconf.h and png.h for more information.  zlib does
+ * it not to.  See zconf.h and png.h for more information. zlib does
  * need to allocate exactly 64K, so whatever you call here must
  * have the ability to do that.
+ *
+ * Borland seems to have a problem in DOS mode for exactly 64K.
+ * It gives you a segment with an offset of 8 (perhaps to store its
+ * memory stuff).  zlib doesn't like this at all, so we have to
+ * detect and deal with it.  This code should not be needed in
+ * Windows or OS/2 modes, and only in 16 bit mode.  This code has
+ * been updated by Alexander Lehmann for version 0.89 to waste less
+ * memory.
+ *
+ * Note that we can't use png_size_t for the "size" declaration,
+ * since on some systems a png_size_t is a 16-bit quantity, and as a
+ * result, we would be truncating potentially larger memory requests
+ * (which should cause a fatal error) and introducing major problems.
  */
-PNG_FUNCTION(png_voidp,PNGAPI
-png_calloc,(png_const_structrp png_ptr, png_alloc_size_t size),PNG_ALLOCATED)
+png_voidp /* PRIVATE */
+png_calloc(png_structp png_ptr, png_uint_32 size)
 {
    png_voidp ret;
 
-   ret = png_malloc(png_ptr, size);
-
+   ret = (png_malloc(png_ptr, size));
    if (ret != NULL)
-      memset(ret, 0, size);
-
-   return ret;
+      png_memset(ret,0,(png_size_t)size);
+   return (ret);
 }
 
-/* png_malloc_base, an internal function added at libpng 1.6.0, does the work of
- * allocating memory, taking into account limits and PNG_USER_MEM_SUPPORTED.
- * Checking and error handling must happen outside this routine; it returns NULL
- * if the allocation cannot be done (for any reason.)
- */
-PNG_FUNCTION(png_voidp /* PRIVATE */,
-png_malloc_base,(png_const_structrp png_ptr, png_alloc_size_t size),
-   PNG_ALLOCATED)
+png_voidp PNGAPI
+png_malloc(png_structp png_ptr, png_uint_32 size)
 {
-   /* Moved to png_malloc_base from png_malloc_default in 1.6.0; the DOS
-    * allocators have also been removed in 1.6.0, so any 16-bit system now has
-    * to implement a user memory handler.  This checks to be sure it isn't
-    * called with big numbers.
-    */
+   png_voidp ret;
+
+   if (png_ptr == NULL || size == 0)
+      return (NULL);
+
 #ifdef PNG_USER_MEM_SUPPORTED
-   PNG_UNUSED(png_ptr)
+   if (png_ptr->malloc_fn != NULL)
+      ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
+   else
+      ret = (png_malloc_default(png_ptr, size));
+   if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+       png_error(png_ptr, "Out of memory!");
+   return (ret);
+}
+
+png_voidp PNGAPI
+png_malloc_default(png_structp png_ptr, png_uint_32 size)
+{
+   png_voidp ret;
+#endif /* PNG_USER_MEM_SUPPORTED */
+
+   if (png_ptr == NULL || size == 0)
+      return (NULL);
+
+#ifdef PNG_MAX_MALLOC_64K
+   if (size > (png_uint_32)65536L)
+   {
+      png_warning(png_ptr, "Cannot Allocate > 64K");
+      ret = NULL;
+   }
+   else
 #endif
-   if (size > 0 && size <= PNG_SIZE_MAX
-#     ifdef PNG_MAX_MALLOC_64K
-         && size <= 65536U
-#     endif
-      )
+
+   if (size != (size_t)size)
+      ret = NULL;
+   else if (size == (png_uint_32)65536L)
    {
-#ifdef PNG_USER_MEM_SUPPORTED
-      if (png_ptr != NULL && png_ptr->malloc_fn != NULL)
-         return png_ptr->malloc_fn(png_constcast(png_structrp,png_ptr), size);
+      if (png_ptr->offset_table == NULL)
+      {
+         /* Try to see if we need to do any of this fancy stuff */
+         ret = farmalloc(size);
+         if (ret == NULL || ((png_size_t)ret & 0xffff))
+         {
+            int num_blocks;
+            png_uint_32 total_size;
+            png_bytep table;
+            int i;
+            png_byte huge * hptr;
+
+            if (ret != NULL)
+            {
+               farfree(ret);
+               ret = NULL;
+            }
+
+            if (png_ptr->zlib_window_bits > 14)
+               num_blocks = (int)(1 << (png_ptr->zlib_window_bits - 14));
+            else
+               num_blocks = 1;
+            if (png_ptr->zlib_mem_level >= 7)
+               num_blocks += (int)(1 << (png_ptr->zlib_mem_level - 7));
+            else
+               num_blocks++;
+
+            total_size = ((png_uint_32)65536L) * (png_uint_32)num_blocks+16;
+
+            table = farmalloc(total_size);
+
+            if (table == NULL)
+            {
+#ifndef PNG_USER_MEM_SUPPORTED
+               if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+                  png_error(png_ptr, "Out Of Memory."); /* Note "O", "M" */
+               else
+                  png_warning(png_ptr, "Out Of Memory.");
+#endif
+               return (NULL);
+            }
+
+            if ((png_size_t)table & 0xfff0)
+            {
+#ifndef PNG_USER_MEM_SUPPORTED
+               if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+                  png_error(png_ptr,
+                    "Farmalloc didn't return normalized pointer");
+               else
+                  png_warning(png_ptr,
+                    "Farmalloc didn't return normalized pointer");
+#endif
+               return (NULL);
+            }
+
+            png_ptr->offset_table = table;
+            png_ptr->offset_table_ptr = farmalloc(num_blocks *
+               png_sizeof(png_bytep));
+
+            if (png_ptr->offset_table_ptr == NULL)
+            {
+#ifndef PNG_USER_MEM_SUPPORTED
+               if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+                  png_error(png_ptr, "Out Of memory."); /* Note "O", "m" */
+               else
+                  png_warning(png_ptr, "Out Of memory.");
+#endif
+               return (NULL);
+            }
+
+            hptr = (png_byte huge *)table;
+            if ((png_size_t)hptr & 0xf)
+            {
+               hptr = (png_byte huge *)((long)(hptr) & 0xfffffff0L);
+               hptr = hptr + 16L;  /* "hptr += 16L" fails on Turbo C++ 3.0 */
+            }
+            for (i = 0; i < num_blocks; i++)
+            {
+               png_ptr->offset_table_ptr[i] = (png_bytep)hptr;
+               hptr = hptr + (png_uint_32)65536L;  /* "+=" fails on TC++3.0 */
+            }
+
+            png_ptr->offset_table_number = num_blocks;
+            png_ptr->offset_table_count = 0;
+            png_ptr->offset_table_count_free = 0;
+         }
+      }
 
-      else
+      if (png_ptr->offset_table_count >= png_ptr->offset_table_number)
+      {
+#ifndef PNG_USER_MEM_SUPPORTED
+         if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+            png_error(png_ptr, "Out of Memory."); /* Note "o" and "M" */
+         else
+            png_warning(png_ptr, "Out of Memory.");
 #endif
-         return malloc((size_t)size); /* checked for truncation above */
-   }
+         return (NULL);
+      }
 
+      ret = png_ptr->offset_table_ptr[png_ptr->offset_table_count++];
+   }
    else
-      return NULL;
+      ret = farmalloc(size);
+
+#ifndef PNG_USER_MEM_SUPPORTED
+   if (ret == NULL)
+   {
+      if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+         png_error(png_ptr, "Out of memory."); /* Note "o" and "m" */
+      else
+         png_warning(png_ptr, "Out of memory."); /* Note "o" and "m" */
+   }
+#endif
+
+   return (ret);
 }
 
-/* This is really here only to work round a spurious warning in GCC 4.6 and 4.7
- * that arises because of the checks in png_realloc_array that are repeated in
- * png_malloc_array.
+/* Free a pointer allocated by png_malloc().  In the default
+ * configuration, png_ptr is not used, but is passed in case it
+ * is needed.  If ptr is NULL, return without taking any action.
  */
-static png_voidp
-png_malloc_array_checked(png_const_structrp png_ptr, int nelements,
-   size_t element_size)
+void PNGAPI
+png_free(png_structp png_ptr, png_voidp ptr)
 {
-   png_alloc_size_t req = nelements; /* known to be > 0 */
-
-   if (req <= PNG_SIZE_MAX/element_size)
-      return png_malloc_base(png_ptr, req * element_size);
+   if (png_ptr == NULL || ptr == NULL)
+      return;
 
-   /* The failure case when the request is too large */
-   return NULL;
+#ifdef PNG_USER_MEM_SUPPORTED
+   if (png_ptr->free_fn != NULL)
+   {
+      (*(png_ptr->free_fn))(png_ptr, ptr);
+      return;
+   }
+   else
+      png_free_default(png_ptr, ptr);
 }
 
-PNG_FUNCTION(png_voidp /* PRIVATE */,
-png_malloc_array,(png_const_structrp png_ptr, int nelements,
-   size_t element_size),PNG_ALLOCATED)
+void PNGAPI
+png_free_default(png_structp png_ptr, png_voidp ptr)
 {
-   if (nelements <= 0 || element_size == 0)
-      png_error(png_ptr, "internal error: array alloc");
+#endif /* PNG_USER_MEM_SUPPORTED */
 
-   return png_malloc_array_checked(png_ptr, nelements, element_size);
-}
+   if (png_ptr == NULL || ptr == NULL)
+      return;
 
-PNG_FUNCTION(png_voidp /* PRIVATE */,
-png_realloc_array,(png_const_structrp png_ptr, png_const_voidp old_array,
-   int old_elements, int add_elements, size_t element_size),PNG_ALLOCATED)
-{
-   /* These are internal errors: */
-   if (add_elements <= 0 || element_size == 0 || old_elements < 0 ||
-      (old_array == NULL && old_elements > 0))
-      png_error(png_ptr, "internal error: array realloc");
-
-   /* Check for overflow on the elements count (so the caller does not have to
-    * check.)
-    */
-   if (add_elements <= INT_MAX - old_elements)
+   if (png_ptr->offset_table != NULL)
    {
-      png_voidp new_array = png_malloc_array_checked(png_ptr,
-         old_elements+add_elements, element_size);
+      int i;
 
-      if (new_array != NULL)
+      for (i = 0; i < png_ptr->offset_table_count; i++)
       {
-         /* Because png_malloc_array worked the size calculations below cannot
-          * overflow.
-          */
-         if (old_elements > 0)
-            memcpy(new_array, old_array, element_size*(unsigned)old_elements);
-
-         memset((char*)new_array + element_size*(unsigned)old_elements, 0,
-            element_size*(unsigned)add_elements);
-
-         return new_array;
+         if (ptr == png_ptr->offset_table_ptr[i])
+         {
+            ptr = NULL;
+            png_ptr->offset_table_count_free++;
+            break;
+         }
+      }
+      if (png_ptr->offset_table_count_free == png_ptr->offset_table_count)
+      {
+         farfree(png_ptr->offset_table);
+         farfree(png_ptr->offset_table_ptr);
+         png_ptr->offset_table = NULL;
+         png_ptr->offset_table_ptr = NULL;
       }
    }
 
-   return NULL; /* error */
+   if (ptr != NULL)
+   {
+      farfree(ptr);
+   }
 }
 
-/* Various functions that have different error handling are derived from this.
- * png_malloc always exists, but if PNG_USER_MEM_SUPPORTED is defined a separate
- * function png_malloc_default is also provided.
- */
-PNG_FUNCTION(png_voidp,PNGAPI
-png_malloc,(png_const_structrp png_ptr, png_alloc_size_t size),PNG_ALLOCATED)
+#else /* Not the Borland DOS special memory handler */
+
+/* Allocate memory for a png_struct or a png_info.  The malloc and
+   memset can be replaced by a single call to calloc() if this is thought
+   to improve performance noticably. */
+png_voidp /* PRIVATE */
+png_create_struct(int type)
 {
-   png_voidp ret;
+#ifdef PNG_USER_MEM_SUPPORTED
+   return (png_create_struct_2(type, png_malloc_ptr_NULL, png_voidp_NULL));
+}
 
-   if (png_ptr == NULL)
-      return NULL;
+/* Allocate memory for a png_struct or a png_info.  The malloc and
+   memset can be replaced by a single call to calloc() if this is thought
+   to improve performance noticably. */
+png_voidp /* PRIVATE */
+png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
+{
+#endif /* PNG_USER_MEM_SUPPORTED */
+   png_size_t size;
+   png_voidp struct_ptr;
 
-   ret = png_malloc_base(png_ptr, size);
+   if (type == PNG_STRUCT_INFO)
+      size = png_sizeof(png_info);
+   else if (type == PNG_STRUCT_PNG)
+      size = png_sizeof(png_struct);
+   else
+      return (NULL);
 
-   if (ret == NULL)
-       png_error(png_ptr, "Out of memory"); /* 'm' means png_malloc */
+#ifdef PNG_USER_MEM_SUPPORTED
+   if (malloc_fn != NULL)
+   {
+      png_struct dummy_struct;
+      png_structp png_ptr = &dummy_struct;
+      png_ptr->mem_ptr=mem_ptr;
+      struct_ptr = (*(malloc_fn))(png_ptr, size);
+      if (struct_ptr != NULL)
+         png_memset(struct_ptr, 0, size);
+      return (struct_ptr);
+   }
+#endif /* PNG_USER_MEM_SUPPORTED */
+
+#if defined(__TURBOC__) && !defined(__FLAT__)
+   struct_ptr = (png_voidp)farmalloc(size);
+#else
+# if defined(_MSC_VER) && defined(MAXSEG_64K)
+   struct_ptr = (png_voidp)halloc(size, 1);
+# else
+   struct_ptr = (png_voidp)malloc(size);
+# endif
+#endif
+   if (struct_ptr != NULL)
+      png_memset(struct_ptr, 0, size);
 
-   return ret;
+   return (struct_ptr);
 }
 
+
+/* Free memory allocated by a png_create_struct() call */
+void /* PRIVATE */
+png_destroy_struct(png_voidp struct_ptr)
+{
 #ifdef PNG_USER_MEM_SUPPORTED
-PNG_FUNCTION(png_voidp,PNGAPI
-png_malloc_default,(png_const_structrp png_ptr, png_alloc_size_t size),
-   PNG_ALLOCATED PNG_DEPRECATED)
+   png_destroy_struct_2(struct_ptr, png_free_ptr_NULL, png_voidp_NULL);
+}
+
+/* Free memory allocated by a png_create_struct() call */
+void /* PRIVATE */
+png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn,
+    png_voidp mem_ptr)
+{
+#endif /* PNG_USER_MEM_SUPPORTED */
+   if (struct_ptr != NULL)
+   {
+#ifdef PNG_USER_MEM_SUPPORTED
+      if (free_fn != NULL)
+      {
+         png_struct dummy_struct;
+         png_structp png_ptr = &dummy_struct;
+         png_ptr->mem_ptr=mem_ptr;
+         (*(free_fn))(png_ptr, struct_ptr);
+         return;
+      }
+#endif /* PNG_USER_MEM_SUPPORTED */
+#if defined(__TURBOC__) && !defined(__FLAT__)
+      farfree(struct_ptr);
+#else
+# if defined(_MSC_VER) && defined(MAXSEG_64K)
+      hfree(struct_ptr);
+# else
+      free(struct_ptr);
+# endif
+#endif
+   }
+}
+
+/* Allocate memory.  For reasonable files, size should never exceed
+ * 64K.  However, zlib may allocate more then 64K if you don't tell
+ * it not to.  See zconf.h and png.h for more information.  zlib does
+ * need to allocate exactly 64K, so whatever you call here must
+ * have the ability to do that.
+ */
+
+png_voidp /* PRIVATE */
+png_calloc(png_structp png_ptr, png_uint_32 size)
 {
    png_voidp ret;
 
-   if (png_ptr == NULL)
-      return NULL;
+   ret = (png_malloc(png_ptr, size));
+   if (ret != NULL)
+      png_memset(ret,0,(png_size_t)size);
+   return (ret);
+}
 
-   /* Passing 'NULL' here bypasses the application provided memory handler. */
-   ret = png_malloc_base(NULL/*use malloc*/, size);
+png_voidp PNGAPI
+png_malloc(png_structp png_ptr, png_uint_32 size)
+{
+   png_voidp ret;
 
-   if (ret == NULL)
-      png_error(png_ptr, "Out of Memory"); /* 'M' means png_malloc_default */
+#ifdef PNG_USER_MEM_SUPPORTED
+   if (png_ptr == NULL || size == 0)
+      return (NULL);
 
-   return ret;
+   if (png_ptr->malloc_fn != NULL)
+      ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
+   else
+      ret = (png_malloc_default(png_ptr, size));
+   if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+       png_error(png_ptr, "Out of Memory!");
+   return (ret);
 }
-#endif /* PNG_USER_MEM_SUPPORTED */
 
-/* This function was added at libpng version 1.2.3.  The png_malloc_warn()
- * function will issue a png_warning and return NULL instead of issuing a
- * png_error, if it fails to allocate the requested memory.
- */
-PNG_FUNCTION(png_voidp,PNGAPI
-png_malloc_warn,(png_const_structrp png_ptr, png_alloc_size_t size),
-   PNG_ALLOCATED)
+png_voidp PNGAPI
+png_malloc_default(png_structp png_ptr, png_uint_32 size)
 {
-   if (png_ptr != NULL)
-   {
-      png_voidp ret = png_malloc_base(png_ptr, size);
+   png_voidp ret;
+#endif /* PNG_USER_MEM_SUPPORTED */
 
-      if (ret != NULL)
-         return ret;
+   if (png_ptr == NULL || size == 0)
+      return (NULL);
 
-      png_warning(png_ptr, "Out of memory");
+#ifdef PNG_MAX_MALLOC_64K
+   if (size > (png_uint_32)65536L)
+   {
+#ifndef PNG_USER_MEM_SUPPORTED
+      if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+         png_error(png_ptr, "Cannot Allocate > 64K");
+      else
+#endif
+         return NULL;
    }
+#endif
+
+   /* Check for overflow */
+#if defined(__TURBOC__) && !defined(__FLAT__)
+   if (size != (unsigned long)size)
+      ret = NULL;
+   else
+      ret = farmalloc(size);
+#else
+# if defined(_MSC_VER) && defined(MAXSEG_64K)
+   if (size != (unsigned long)size)
+      ret = NULL;
+   else
+      ret = halloc(size, 1);
+# else
+   if (size != (size_t)size)
+      ret = NULL;
+   else
+      ret = malloc((size_t)size);
+# endif
+#endif
+
+#ifndef PNG_USER_MEM_SUPPORTED
+   if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+      png_error(png_ptr, "Out of Memory");
+#endif
 
-   return NULL;
+   return (ret);
 }
 
 /* Free a pointer allocated by png_malloc().  If ptr is NULL, return
  * without taking any action.
  */
 void PNGAPI
-png_free(png_const_structrp png_ptr, png_voidp ptr)
+png_free(png_structp png_ptr, png_voidp ptr)
 {
    if (png_ptr == NULL || ptr == NULL)
       return;
 
 #ifdef PNG_USER_MEM_SUPPORTED
    if (png_ptr->free_fn != NULL)
-      png_ptr->free_fn(png_constcast(png_structrp,png_ptr), ptr);
-
+   {
+      (*(png_ptr->free_fn))(png_ptr, ptr);
+      return;
+   }
    else
       png_free_default(png_ptr, ptr);
 }
-
-PNG_FUNCTION(void,PNGAPI
-png_free_default,(png_const_structrp png_ptr, png_voidp ptr),PNG_DEPRECATED)
+void PNGAPI
+png_free_default(png_structp png_ptr, png_voidp ptr)
 {
    if (png_ptr == NULL || ptr == NULL)
       return;
+
 #endif /* PNG_USER_MEM_SUPPORTED */
 
+#if defined(__TURBOC__) && !defined(__FLAT__)
+   farfree(ptr);
+#else
+# if defined(_MSC_VER) && defined(MAXSEG_64K)
+   hfree(ptr);
+# else
    free(ptr);
+# endif
+#endif
+}
+
+#endif /* Not Borland DOS special memory handler */
+
+#ifdef PNG_1_0_X
+#  define png_malloc_warn png_malloc
+#else
+/* This function was added at libpng version 1.2.3.  The png_malloc_warn()
+ * function will set up png_malloc() to issue a png_warning and return NULL
+ * instead of issuing a png_error, if it fails to allocate the requested
+ * memory.
+ */
+png_voidp PNGAPI
+png_malloc_warn(png_structp png_ptr, png_uint_32 size)
+{
+   png_voidp ptr;
+   png_uint_32 save_flags;
+   if (png_ptr == NULL)
+      return (NULL);
+
+   save_flags = png_ptr->flags;
+   png_ptr->flags|=PNG_FLAG_MALLOC_NULL_MEM_OK;
+   ptr = (png_voidp)png_malloc((png_structp)png_ptr, size);
+   png_ptr->flags=save_flags;
+   return(ptr);
+}
+#endif
+
+png_voidp PNGAPI
+png_memcpy_check (png_structp png_ptr, png_voidp s1, png_voidp s2,
+   png_uint_32 length)
+{
+   png_size_t size;
+
+   size = (png_size_t)length;
+   if ((png_uint_32)size != length)
+      png_error(png_ptr, "Overflow in png_memcpy_check.");
+
+   return(png_memcpy (s1, s2, size));
+}
+
+png_voidp PNGAPI
+png_memset_check (png_structp png_ptr, png_voidp s1, int value,
+   png_uint_32 length)
+{
+   png_size_t size;
+
+   size = (png_size_t)length;
+   if ((png_uint_32)size != length)
+      png_error(png_ptr, "Overflow in png_memset_check.");
+
+   return (png_memset (s1, value, size));
+
 }
 
 #ifdef PNG_USER_MEM_SUPPORTED
@@ -250,7 +615,7 @@ png_free_default,(png_const_structrp png_ptr, png_voidp ptr),PNG_DEPRECATED)
  * of allocating and freeing memory.
  */
 void PNGAPI
-png_set_mem_fn(png_structrp png_ptr, png_voidp mem_ptr, png_malloc_ptr
+png_set_mem_fn(png_structp png_ptr, png_voidp mem_ptr, png_malloc_ptr
   malloc_fn, png_free_ptr free_fn)
 {
    if (png_ptr != NULL)
@@ -266,12 +631,11 @@ png_set_mem_fn(png_structrp png_ptr, png_voidp mem_ptr, png_malloc_ptr
  * pointer before png_write_destroy and png_read_destroy are called.
  */
 png_voidp PNGAPI
-png_get_mem_ptr(png_const_structrp png_ptr)
+png_get_mem_ptr(png_structp png_ptr)
 {
    if (png_ptr == NULL)
-      return NULL;
-
-   return png_ptr->mem_ptr;
+      return (NULL);
+   return ((png_voidp)png_ptr->mem_ptr);
 }
 #endif /* PNG_USER_MEM_SUPPORTED */
 #endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */