[libpng17] Imported from libpng-1.7.0beta70.tarv1.7.0beta70

25 files changed, 326 insertions, 351 deletions

diff --git a/ANNOUNCE b/ANNOUNCE
index d7725d25b..c487b8c71 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
 
-Libpng 1.7.0beta70 - December 1, 2015
+Libpng 1.7.0beta70 - December 3, 2015
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -1022,7 +1022,7 @@ Version 1.7.0beta69 [November 24, 2015]
   Temporarily disabled filter selection while writing, and temporarily
     replaced pngtest.png accordingly.
 
-Version 1.7.0beta70 [December 1, 2015]
+Version 1.7.0beta70 [December 3, 2015]
   Fixed a simple bracket problem that prevented reading non-interlaced
     PNG files with height == 1.
   The code failed to zero out the row buffer at the start of a pass where
diff --git a/CHANGES b/CHANGES
index 7ae88a705..c21ab5134 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5321,7 +5321,7 @@ Version 1.7.0beta69 [November 24, 2015]
   Temporarily disabled filter selection while writing, and temporarily
     replaced pngtest.png accordingly.
 
-Version 1.7.0beta70 [December 1, 2015]
+Version 1.7.0beta70 [December 3, 2015]
   Fixed a simple bracket problem that prevented reading non-interlaced
     PNG files with height == 1.
   The code failed to zero out the row buffer at the start of a pass where
diff --git a/LICENSE b/LICENSE
index 162f77208..859592ea1 100644
--- a/LICENSE
+++ b/LICENSE
@@ -10,7 +10,7 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.0.7, July 1, 2000, through 1.7.0beta70, November 24, 2015, are
+libpng versions 1.0.7, July 1, 2000, through 1.7.0beta70, December 3, 2015, are
 Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -109,4 +109,4 @@ the additional disclaimers inserted at version 1.0.7.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-November 24, 2015
+December 3, 2015
diff --git a/README b/README
index cee9282a1..939b0d4ec 100644
--- a/README
+++ b/README
@@ -1,4 +1,4 @@
-README for libpng version 1.7.0beta70 - November 24, 2015 (shared library 17.0)
+README for libpng version 1.7.0beta70 - December 3, 2015 (shared library 17.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
diff --git a/contrib/libtests/pngvalid.c b/contrib/libtests/pngvalid.c
index c2f8bde39..5b0863c75 100644
--- a/contrib/libtests/pngvalid.c
+++ b/contrib/libtests/pngvalid.c
@@ -1,7 +1,7 @@
 
 /* pngvalid.c - validate libpng by constructing then reading png files.
  *
- * Last changed in libpng 1.5.25 [RDATE%]
+ * Last changed in libpng 1.7.0 [(PENDING RELEASE)]
  * Copyright (c) 2014-2015 Glenn Randers-Pehrson
  * Written by John Cunningham Bowler
  *
@@ -4276,72 +4276,63 @@ make_error(png_store* const ps, png_byte const colour_type,
 #undef exception__env
 
       /* And clear these flags */
+      ps->expect_error = 0;
       ps->expect_warning = 0;
 
-      if (ps->expect_error)
-         ps->expect_error = 0;
+      /* Now write the whole image, just to make sure that the detected, or
+       * undetected, errro has not created problems inside libpng.
+       */
+      if (png_get_rowbytes(pp, pi) !=
+          transform_rowsize(pp, colour_type, bit_depth))
+         png_error(pp, "row size incorrect");
 
       else
       {
-         /* Now write the whole image, just to make sure that the detected, or
-          * undetected, errro has not created problems inside libpng.  This
-          * doesn't work if there was a png_error in png_write_info because that
-          * can abort before PLTE was written.
-          */
-         if (png_get_rowbytes(pp, pi) !=
-             transform_rowsize(pp, colour_type, bit_depth))
-            png_error(pp, "row size incorrect");
+         int npasses = set_write_interlace_handling(pp, interlace_type);
+         int pass;
 
-         else
-         {
-            int npasses = set_write_interlace_handling(pp, interlace_type);
-            int pass;
+         if (npasses != npasses_from_interlace_type(pp, interlace_type))
+            png_error(pp, "write: png_set_interlace_handling failed");
 
-            if (npasses != npasses_from_interlace_type(pp, interlace_type))
-               png_error(pp, "write: png_set_interlace_handling failed");
+         for (pass=0; pass<npasses; ++pass)
+         {
+            png_uint_32 y;
 
-            for (pass=0; pass<npasses; ++pass)
+            for (y=0; y<h; ++y)
             {
-               png_uint_32 y;
-
-               for (y=0; y<h; ++y)
-               {
-                  png_byte buffer[TRANSFORM_ROWMAX];
+               png_byte buffer[TRANSFORM_ROWMAX];
 
-                  transform_row(pp, buffer, colour_type, bit_depth, y);
+               transform_row(pp, buffer, colour_type, bit_depth, y);
 
-#                 if do_own_interlace
-                     /* If do_own_interlace *and* the image is interlaced we
-                      * need a reduced interlace row; this may be reduced to
-                      * empty.
+#              if do_own_interlace
+                  /* If do_own_interlace *and* the image is interlaced we need a
+                   * reduced interlace row; this may be reduced to empty.
+                   */
+                  if (interlace_type == PNG_INTERLACE_ADAM7)
+                  {
+                     /* The row must not be written if it doesn't exist, notice
+                      * that there are two conditions here, either the row isn't
+                      * ever in the pass or the row would be but isn't wide
+                      * enough to contribute any pixels.  In fact the wPass test
+                      * can be used to skip the whole y loop in this case.
                       */
-                     if (interlace_type == PNG_INTERLACE_ADAM7)
-                     {
-                        /* The row must not be written if it doesn't exist,
-                         * notice that there are two conditions here, either the
-                         * row isn't ever in the pass or the row would be but
-                         * isn't wide enough to contribute any pixels.  In fact
-                         * the wPass test can be used to skip the whole y loop
-                         * in this case.
-                         */
-                        if (PNG_ROW_IN_INTERLACE_PASS(y, pass) &&
-                            PNG_PASS_COLS(w, pass) > 0)
-                           interlace_row(buffer, buffer,
-                                 bit_size(pp, colour_type, bit_depth), w, pass,
-                                 0/*data always bigendian*/);
-                        else
-                           continue;
-                     }
-#                 endif /* do_own_interlace */
+                     if (PNG_ROW_IN_INTERLACE_PASS(y, pass) &&
+                         PNG_PASS_COLS(w, pass) > 0)
+                        interlace_row(buffer, buffer,
+                              bit_size(pp, colour_type, bit_depth), w, pass,
+                              0/*data always bigendian*/);
+                     else
+                        continue;
+                  }
+#              endif /* do_own_interlace */
 
-                  png_write_row(pp, buffer);
-               }
+               png_write_row(pp, buffer);
             }
-         } /* image writing */
-
-         png_write_end(pp, pi);
+         }
       }
 
+      png_write_end(pp, pi);
+
       /* The following deletes the file that was just written. */
       store_write_reset(ps);
    }
diff --git a/libpng-manual.txt b/libpng-manual.txt
index 4cc749f5a..3e052d688 100644
--- a/libpng-manual.txt
+++ b/libpng-manual.txt
@@ -1,6 +1,6 @@
 libpng-manual.txt - A description on how to use and modify libpng
 
- libpng version 1.7.0beta70 - December 1, 2015
+ libpng version 1.7.0beta70 - December 3, 2015
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2015 Glenn Randers-Pehrson
@@ -11,7 +11,7 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.7.0beta70 - December 1, 2015
+ libpng versions 0.97, January 1998, through 1.7.0beta70 - December 3, 2015
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2015 Glenn Randers-Pehrson
 
diff --git a/libpng.3 b/libpng.3
index 3ff2de0cb..76e391e80 100644
--- a/libpng.3
+++ b/libpng.3
@@ -1,4 +1,4 @@
-.TH LIBPNG 3 "December 1, 2015"
+.TH LIBPNG 3 "December 3, 2015"
 .SH NAME
 libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta70
 .SH SYNOPSIS
@@ -498,7 +498,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
 .SH LIBPNG.TXT
 libpng-manual.txt - A description on how to use and modify libpng
 
- libpng version 1.7.0beta70 - December 1, 2015
+ libpng version 1.7.0beta70 - December 3, 2015
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2015 Glenn Randers-Pehrson
@@ -509,7 +509,7 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.7.0beta70 - December 1, 2015
+ libpng versions 0.97, January 1998, through 1.7.0beta70 - December 3, 2015
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2015 Glenn Randers-Pehrson
 
@@ -5980,7 +5980,7 @@ possible without all of you.
 
 Thanks to Frank J. T. Wojcik for helping with the documentation.
 
-Libpng version 1.7.0beta70 - December 1, 2015:
+Libpng version 1.7.0beta70 - December 3, 2015:
 Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
 Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).
 
@@ -6005,7 +6005,7 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.0.7, July 1, 2000, through 1.7.0beta70, December 1, 2015, are
+libpng versions 1.0.7, July 1, 2000, through 1.7.0beta70, December 3, 2015, are
 Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
@@ -6104,7 +6104,7 @@ the additional disclaimers inserted at version 1.0.7.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-December 1, 2015
+December 3, 2015
 
 .\" end of man page
 
diff --git a/libpngpf.3 b/libpngpf.3
index 9ec163d34..bb11722b5 100644
--- a/libpngpf.3
+++ b/libpngpf.3
@@ -1,4 +1,4 @@
-.TH LIBPNGPF 3 "November 24, 2015"
+.TH LIBPNGPF 3 "December 3, 2015"
 .SH NAME
 libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta70
 (private functions)
diff --git a/png.5 b/png.5
index 55f856eb6..4287cb2b7 100644
--- a/png.5
+++ b/png.5
@@ -1,4 +1,4 @@
-.TH PNG 5 "November 24, 2015"
+.TH PNG 5 "December 3, 2015"
 .SH NAME
 png \- Portable Network Graphics (PNG) format
 .SH DESCRIPTION
diff --git a/png.c b/png.c
index 407e54a68..e3643b061 100644
--- a/png.c
+++ b/png.c
@@ -712,13 +712,13 @@ png_get_copyright(png_const_structrp png_ptr)
 #else
 #  ifdef __STDC__
    return PNG_STRING_NEWLINE \
-     "libpng version 1.7.0beta70 - November 30, 2015" PNG_STRING_NEWLINE \
+     "libpng version 1.7.0beta70 - December 3, 2015" PNG_STRING_NEWLINE \
      "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
      PNG_STRING_NEWLINE;
 #  else
-      return "libpng version 1.7.0beta70 - November 30, 2015\
+      return "libpng version 1.7.0beta70 - December 3, 2015\
       Copyright (c) 1998-2015 Glenn Randers-Pehrson\
       Copyright (c) 1996-1997 Andreas Dilger\
       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
diff --git a/png.h b/png.h
index 2c403cb65..96b620fb9 100644
--- a/png.h
+++ b/png.h
@@ -1,7 +1,7 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.7.0beta70, November 30, 2015
+ * libpng version 1.7.0beta70, December 3, 2015
  *
  * Copyright (c) 1998-2015 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -12,7 +12,7 @@
  * Authors and maintainers:
  *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
- *   libpng versions 0.97, January 1998, through 1.7.0beta70, November 30, 2015:
+ *   libpng versions 0.97, January 1998, through 1.7.0beta70, December 3, 2015:
  *     Glenn Randers-Pehrson.
  *   See also "Contributing Authors", below.
  */
@@ -25,7 +25,7 @@
  *
  * This code is released under the libpng license.
  *
- * libpng versions 1.0.7, July 1, 2000, through 1.7.0beta70, November 30, 2015, are
+ * libpng versions 1.0.7, July 1, 2000, through 1.7.0beta70, December 3, 2015, are
  * Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, are
  * derived from libpng-1.0.6, and are distributed according to the same
  * disclaimer and license as libpng-1.0.6 with the following individuals
@@ -218,7 +218,7 @@
  * Y2K compliance in libpng:
  * =========================
  *
- *    November 30, 2015
+ *    December 3, 2015
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
@@ -288,7 +288,7 @@
 /* Version information for png.h - this should match the version in png.c */
 #define PNG_LIBPNG_VER_STRING "1.7.0beta70"
 #define PNG_HEADER_VERSION_STRING \
-     " libpng version 1.7.0beta70 - November 30, 2015\n"
+     " libpng version 1.7.0beta70 - December 3, 2015\n"
 
 #define PNG_LIBPNG_VER_SONUM   17
 #define PNG_LIBPNG_VER_DLLNUM  17
diff --git a/pngconf.h b/pngconf.h
index 98a4f3e79..ab7aac1cb 100644
--- a/pngconf.h
+++ b/pngconf.h
@@ -1,7 +1,7 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.7.0beta70, November 24, 2015
+ * libpng version 1.7.0beta70, December 3, 2015
  *
  * Copyright (c) 1998-2015 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
diff --git a/pngread.c b/pngread.c
index f6b8ffabe..79cbac1e4 100644
--- a/pngread.c
+++ b/pngread.c
@@ -727,20 +727,22 @@ png_read_destroy(png_structrp png_ptr)
    png_free(png_ptr, png_ptr->read_buffer);
    png_ptr->read_buffer = NULL;
 
-   if (png_ptr->palette != NULL)
+   if ((png_ptr->free_me & PNG_FREE_PLTE) != 0)
    {
       png_free(png_ptr, png_ptr->palette);
       png_ptr->num_palette = 0;
       png_ptr->palette = NULL;
    }
+   png_ptr->free_me &= PNG_BIC_MASK(PNG_FREE_PLTE);
 
 #ifdef PNG_READ_tRNS_SUPPORTED
-   if (png_ptr->trans_alpha != NULL)
+   if ((png_ptr->free_me & PNG_FREE_TRNS) != 0)
    {
       png_free(png_ptr, png_ptr->trans_alpha);
       png_ptr->num_trans = 0;
       png_ptr->trans_alpha = NULL;
    }
+   png_ptr->free_me &= PNG_BIC_MASK(PNG_FREE_TRNS);
 #endif
 
    if (png_ptr->zstream.state != NULL)
diff --git a/pngrtran.c b/pngrtran.c
index 6594a2850..9c54978c0 100644
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -5985,15 +5985,21 @@ setup_palette_cache(png_structp png_ptr, png_byte cache[8*256])
 static void
 png_remove_PLTE_and_tRNS(png_structrp png_ptr)
 {
-   if (png_ptr->palette != NULL)
+   if ((png_ptr->free_me & PNG_FREE_PLTE) != 0)
+   {
+      png_ptr->free_me &= PNG_BIC_MASK(PNG_FREE_PLTE);
       png_free(png_ptr, png_ptr->palette);
+   }
 
    png_ptr->palette = NULL;
    png_ptr->num_palette = 0;
 
 #  ifdef PNG_READ_tRNS_SUPPORTED
-      if (png_ptr->trans_alpha != NULL)
+      if ((png_ptr->free_me & PNG_FREE_TRNS) != 0)
+      {
+         png_ptr->free_me &= PNG_BIC_MASK(PNG_FREE_TRNS);
          png_free(png_ptr, png_ptr->trans_alpha);
+      }
 
       png_ptr->trans_alpha = NULL;
       png_ptr->num_trans = 0;
@@ -6096,10 +6102,13 @@ update_palette(png_structp png_ptr, png_cache_paramsp cp,
     * entries were shifted or inverted.  This could be fixed, but it would
     * complicate the libpng API to expose the information.
     */
+   png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
+       PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
+   png_ptr->free_me |= PNG_FREE_PLTE;
+
    /* Write the transformed palette: */
    {
-      png_colorp palette = png_voidcast(png_colorp, png_calloc(png_ptr,
-               sizeof (png_color[PNG_MAX_PALETTE_LENGTH])));
+      png_colorp  palette = png_ptr->palette;
       png_const_bytep p;
       const int is_color = (cp->tend.format & PNG_FORMAT_FLAG_COLOR) != 0;
       unsigned int i;
@@ -6109,10 +6118,6 @@ update_palette(png_structp png_ptr, png_cache_paramsp cp,
          png_byte trans_alpha[PNG_MAX_PALETTE_LENGTH];
 #     endif /* READ_tRNS */
 
-      memset(palette, 0xFFU, sizeof (png_color[PNG_MAX_PALETTE_LENGTH]));
-      png_free(png_ptr, png_ptr->palette);
-      png_ptr->palette = palette;
-
       for (i=0, p=cache.b8; i<cp->tend.width; ++i)
       {
          if (is_color)
@@ -6143,17 +6148,12 @@ update_palette(png_structp png_ptr, png_cache_paramsp cp,
 #     ifdef PNG_READ_tRNS_SUPPORTED
          if (num_trans > 0)
          {
-            png_bytep tRNS = png_voidcast(png_bytep, png_malloc(png_ptr,
-                     PNG_MAX_PALETTE_LENGTH));
-
-            memset(tRNS, 0xFFU, PNG_MAX_PALETTE_LENGTH);
-
-            if (png_ptr->trans_alpha != NULL)
-               png_free(png_ptr, png_ptr->trans_alpha);
-
-            png_ptr->trans_alpha = tRNS;
-
-            memcpy(tRNS, trans_alpha, num_trans);
+            png_ptr->trans_alpha = png_voidcast(png_bytep, png_malloc(png_ptr,
+               PNG_MAX_PALETTE_LENGTH));
+            png_ptr->free_me |= PNG_FREE_TRNS;
+            memcpy(png_ptr->trans_alpha, trans_alpha, num_trans);
+            memset(png_ptr->trans_alpha+num_trans, 0xFFU,
+               PNG_MAX_PALETTE_LENGTH-num_trans);
             png_ptr->num_trans = png_check_bits(png_ptr, num_trans, 9);
          }
 #     endif /* READ_tRNS */
diff --git a/pngrutil.c b/pngrutil.c
index 7bb53bafa..6336300de 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -849,7 +849,8 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr)
 {
    png_color palette[PNG_MAX_PALETTE_LENGTH];
    png_uint_32 length = png_ptr->chunk_length;
-   png_uint_32 max_palette_length, num, i;
+   int max_palette_length, num, i;
+   png_colorp pal_ptr;
 
    png_debug(1, "in png_handle_PLTE");
 
@@ -877,7 +878,7 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr)
    }
 
    /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */
-   num = length / 3U;
+   num = (int)length / 3;
 
    /* If the palette has 256 or fewer entries but is too large for the bit
     * depth, we don't issue an error, to preserve the behavior of previous
@@ -885,21 +886,21 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr)
     * here.
     */
    if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
-      max_palette_length = (1U << png_ptr->bit_depth);
+      max_palette_length = (1 << png_ptr->bit_depth);
    else
       max_palette_length = PNG_MAX_PALETTE_LENGTH;
 
    if (num > max_palette_length)
       num = max_palette_length;
 
-   for (i = 0; i < num; ++i)
+   for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
    {
       png_byte buf[3];
 
       png_crc_read(png_ptr, buf, 3);
-      palette[i].red = buf[0];
-      palette[i].green = buf[1];
-      palette[i].blue = buf[2];
+      pal_ptr->red = buf[0];
+      pal_ptr->green = buf[1];
+      pal_ptr->blue = buf[2];
    }
 
    /* If we actually need the PLTE chunk (ie for a paletted image), we do
@@ -910,7 +911,7 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr)
 #ifndef PNG_READ_OPT_PLTE_SUPPORTED
    if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
 #endif
-      png_crc_finish(png_ptr, length - num * 3U);
+      png_crc_finish(png_ptr, (int) length - num * 3);
 
 #ifndef PNG_READ_OPT_PLTE_SUPPORTED
    else if (png_crc_error(png_ptr))  /* Only if we have a CRC error */
@@ -941,16 +942,16 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr)
    }
 #endif /* READ_OPT_PLTE */
 
+   /* TODO: png_set_PLTE has the side effect of setting png_ptr->palette to its
+    * own copy of the palette.  This has the side effect that when png_start_row
+    * is called (this happens after any call to png_read_update_info) the
+    * info_ptr palette gets changed.  This is extremely unexpected and
+    * confusing.
+    *
+    * Fix this by not sharing the palette in this way.
+    */
    png_set_PLTE(png_ptr, info_ptr, palette, num);
 
-   /* Ok, make our own copy since the set succeeded: */
-   debug(png_ptr->palette == NULL); /* should only get set once */
-   png_ptr->palette = png_voidcast(png_colorp, png_malloc(png_ptr,
-         sizeof (png_color[PNG_MAX_PALETTE_LENGTH])));
-   memset(png_ptr->palette, 0xFFU, sizeof (png_color[PNG_MAX_PALETTE_LENGTH]));
-   memcpy(png_ptr->palette, info_ptr->palette, 3*num);
-   png_ptr->num_palette = info_ptr->num_palette;
-
    /* The three chunks, bKGD, hIST and tRNS *must* appear after PLTE and before
     * IDAT.  Prior to 1.6.0 this was not checked; instead the code merely
     * checked the apparent validity of a tRNS chunk inserted before PLTE on a
@@ -1605,13 +1606,10 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr)
 static void
 png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr)
 {
-   png_uint_32 num_trans;
    png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
 
    png_debug(1, "in png_handle_tRNS");
 
-   png_ptr->num_trans = 0U; /* safety */
-
    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))
    {
       /* libpng 1.7.0: this used to be a benign error, but it doesn't look very
@@ -1635,7 +1633,7 @@ png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr)
       }
 
       png_crc_read(png_ptr, buf, 2);
-      num_trans = 1U;
+      png_ptr->num_trans = 1;
       png_ptr->trans_color.gray = png_get_uint_16(buf);
    }
 
@@ -1650,7 +1648,7 @@ png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr)
       }
 
       png_crc_read(png_ptr, buf, 6);
-      num_trans = 1U;
+      png_ptr->num_trans = 1;
       png_ptr->trans_color.red = png_get_uint_16(buf);
       png_ptr->trans_color.green = png_get_uint_16(buf + 2);
       png_ptr->trans_color.blue = png_get_uint_16(buf + 4);
@@ -1658,18 +1656,21 @@ png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr)
 
    else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
    {
+      png_uint_32 length;
+
       /* png_find_chunk_op checks this: */
       debug(png_ptr->mode & PNG_HAVE_PLTE);
 
-      num_trans = png_ptr->chunk_length;
+      length = png_ptr->chunk_length;
 
-      if (num_trans > png_ptr->num_palette || num_trans == 0)
+      if (length > png_ptr->num_palette || length == 0)
       {
          png_handle_bad_length(png_ptr);
          return;
       }
 
-      png_crc_read(png_ptr, readbuf, num_trans);
+      png_crc_read(png_ptr, readbuf, length);
+      png_ptr->num_trans = length & 0x1FF;
    }
 
    else
@@ -1679,22 +1680,20 @@ png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr)
    }
 
    if (png_crc_finish(png_ptr, 0))
-      return;
-
-   /* Set it into the info_struct: */
-   png_set_tRNS(png_ptr, info_ptr, readbuf, num_trans, &png_ptr->trans_color);
-
-   /* Now make a copy of the buffer if one is required (palette images). */
-   debug(png_ptr->trans_alpha == NULL);
-   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
    {
-      png_ptr->trans_alpha = png_voidcast(png_bytep,
-            png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
-      memset(png_ptr->trans_alpha, 0xFFU, PNG_MAX_PALETTE_LENGTH);
-      memcpy(png_ptr->trans_alpha, info_ptr->trans_alpha, num_trans);
+      png_ptr->num_trans = 0;
+      return;
    }
 
-   png_ptr->num_trans = png_check_bits(png_ptr, num_trans, 9);
+   /* TODO: this is a horrible side effect in the palette case because the
+    * png_struct ends up with a pointer to the tRNS buffer owned by the
+    * png_info.  Fix this.
+    */
+   png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
+       &(png_ptr->trans_color));
+
+   if (info_ptr != NULL)
+      png_ptr->trans_alpha = info_ptr->trans_alpha;
 }
 #else
 #  define png_handle_tRNS NULL
diff --git a/pngset.c b/pngset.c
index 033ef1f56..83857f942 100644
--- a/pngset.c
+++ b/pngset.c
@@ -533,20 +533,30 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
       png_error(png_ptr, "Invalid palette");
 #endif /* MNG_FEATURES */
 
+   /* It may not actually be necessary to set png_ptr->palette here;
+    * we do it for backward compatibility with the way the png_handle_tRNS
+    * function used to do the allocation.
+    *
+    * 1.6.0: the above statement appears to be incorrect; something has to set
+    * the palette inside png_struct on read.
+    */
    png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
 
    /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
     * of num_palette entries, in case of an invalid PNG file or incorrect
     * call to png_set_PLTE() with too-large sample values.
     */
-   info_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
+   png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
        PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
 
    if (num_palette > 0)
-      memcpy(info_ptr->palette, palette, num_palette * (sizeof (png_color)));
+      memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color)));
+   info_ptr->palette = png_ptr->palette;
+   info_ptr->num_palette = png_ptr->num_palette = png_check_bits(png_ptr,
+      num_palette, 9);
 
-   info_ptr->num_palette = png_check_bits(png_ptr, num_palette, 9);
    info_ptr->free_me |= PNG_FREE_PLTE;
+
    info_ptr->valid |= PNG_INFO_PLTE;
 }
 
@@ -952,11 +962,11 @@ png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
       /* Expect png_set_PLTE to happen before png_set_tRNS, so num_palette will
        * be set, but this is not a requirement of the API.
        */
-      if (info_ptr->num_palette)
-         max_num = info_ptr->num_palette;
+      if (png_ptr->num_palette)
+         max_num = png_ptr->num_palette;
 
       else
-         max_num = 1 << info_ptr->bit_depth;
+         max_num = 1 << png_ptr->bit_depth;
 
       if (num_trans > max_num)
       {
diff --git a/pngstruct.h b/pngstruct.h
index eadd5b9e2..4c460279e 100644
--- a/pngstruct.h
+++ b/pngstruct.h
@@ -370,18 +370,17 @@ struct png_struct_def
     * the hope is that such processors will generate code that is both smaller
     * and faster.
     */
-#ifdef PNG_READ_SUPPORTED
    png_colorp  palette;        /* palette from the input file */
-#endif /* READ */
 #ifdef PNG_READ_tRNS_SUPPORTED
    png_bytep   trans_alpha;    /* alpha values for paletted files */
-#endif /* READ_tRNS */
+#endif
 
    png_uint_32 width;          /* width of image in pixels */
    png_uint_32 height;         /* height of image in pixels */
    png_uint_32 chunk_name;     /* PNG_CHUNK() id of current chunk */
    png_uint_32 chunk_length;   /* Length (possibly remaining) in said chunk. */
    png_uint_32 crc;            /* current chunk CRC value */
+   png_uint_32 free_me;        /* items libpng is responsible for freeing */
 
    unsigned int flags;                  /* flags (should be bit fields) */
    unsigned int mode                :6; /* where we are in the PNG file */
@@ -600,7 +599,12 @@ struct png_struct_def
    int zlib_set_window_bits;
    int zlib_set_mem_level;
    int zlib_set_strategy;
-#endif /* WRITE */
+
+   unsigned int             zbuffer_start; /* Bytes written from start */
+   png_uint_32              zbuffer_len;   /* Length of data in list */
+   png_compression_bufferp  zbuffer_list;  /* Created on demand during write */
+   png_compression_bufferp *zbuffer_end;   /* 'next' field of current buffer */
+#endif
 
    /* ERROR HANDLING */
 #ifdef PNG_SETJMP_SUPPORTED
@@ -744,23 +748,14 @@ struct png_struct_def
     * zlib expects a 'zstream' as the fundamental control structure, it allows
     * all the parameters to be passed as one pointer.
     */
-   z_stream     zstream;       /* decompression structure */
    png_uint_32  zowner;        /* ID (chunk type) of zstream owner, 0 if none */
-#  ifdef PNG_WRITE_SUPPORTED
-   png_compression_bufferp  zbuffer_list;  /* Created on demand during write */
-   png_compression_bufferp *zbuffer_end;   /* 'next' field of current buffer */
-   png_uint_32              zbuffer_len;   /* Length of data in list */
-   unsigned int             zbuffer_start; /* Bytes written from start */
-#  endif /* WRITE */
-#  ifdef PNG_READ_SUPPORTED
-   unsigned int zstream_ended:1; /* no more zlib output available [read] */
-   unsigned int zstream_error:1; /* zlib error message has been output [read] */
-#  endif /* READ */
-#  ifdef PNG_PROGRESSIVE_READ_SUPPORTED
+   z_stream     zstream;       /* decompression structure */
+   unsigned int zstream_start:1; /* before first byte of stream */
+   unsigned int zstream_ended:1; /* no more zlib output available */
+   unsigned int zstream_error:1; /* zlib error message has been output */
    unsigned int zstream_eod  :1; /* all the required uncompressed data has been
                                   * received; set by the zstream using code for
-                                  * its own purposes. [progressive read] */
-#  endif /* PROGRESSIVE_READ */
+                                  * its own purposes. */
 
    /* MNG SUPPORT */
 #ifdef PNG_MNG_FEATURES_SUPPORTED
diff --git a/pngtrans.c b/pngtrans.c
index df1bc7bdc..5ee0ab923 100644
--- a/pngtrans.c
+++ b/pngtrans.c
@@ -580,13 +580,12 @@ init_transform_mech(png_structrp png_ptr, png_transform_control *tc, int start)
 
 #ifdef PNG_PALETTE_MAX_SUPPORTED
 static int
-set_palette_max(png_structrp png_ptr, png_transformp tr, unsigned int max,
-      unsigned int format_max)
+set_palette_max(png_structrp png_ptr, png_transformp tr, unsigned int max)
    /* Called whenever a new maximum pixel value is found */
 {
    /* One of these must be true: */
 #  ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
-      if (max >= tr->args && !png_ptr->palette_index_check_issued)
+      if (max >= png_ptr->num_palette && !png_ptr->palette_index_check_issued)
       {
 #        ifdef PNG_READ_SUPPORTED
 #           ifdef PNG_WRITE_SUPPORTED
@@ -605,7 +604,7 @@ set_palette_max(png_structrp png_ptr, png_transformp tr, unsigned int max,
       png_ptr->palette_index_max = png_check_bits(png_ptr, max, 9);
 #  endif
 
-   if (max == format_max)
+   if (max == (1U << png_ptr->bit_depth)-1U)
    {
       tr->fn = NULL; /* no point continuing once the max has been seen */
       return 1; /* stop */
@@ -634,7 +633,7 @@ palette_max_1bpp(png_transformp *tr, png_transform_controlp tc)
    }
 
    /* If the code reaches this point there is a set pixel */
-   (void)set_palette_max(tc->png_ptr, *tr, 1U, 1U);
+   (void)set_palette_max(tc->png_ptr, *tr, 1);
 }
 
 static void
@@ -691,7 +690,7 @@ palette_max_2bpp(png_transformp *tr, png_transform_controlp tc)
          continue;
 
       /* new_max is greater than max: */
-      if (set_palette_max(tc->png_ptr, *tr, new_max, 3U))
+      if (set_palette_max(tc->png_ptr, *tr, new_max))
          return;
 
       /* Record new_max: */
@@ -727,7 +726,7 @@ palette_max_4bpp(png_transformp *tr, png_transform_controlp tc)
 
    if (max > (*tr)->args)
    {
-      if (set_palette_max(tc->png_ptr, *tr, max, 15U))
+      if (set_palette_max(tc->png_ptr, *tr, max))
          return;
 
       (*tr)->args = max;
@@ -753,7 +752,7 @@ palette_max_8bpp(png_transformp *tr, png_transform_controlp tc)
 
    if (max > (*tr)->args)
    {
-      if (set_palette_max(tc->png_ptr, *tr, max, 255U))
+      if (set_palette_max(tc->png_ptr, *tr, max))
          return;
 
       (*tr)->args = max;
@@ -766,19 +765,13 @@ palette_max_init(png_transformp *tr, png_transform_controlp tc)
 #  define png_ptr (tc->png_ptr)
    if ((tc->format & PNG_FORMAT_FLAG_COLORMAP) != 0)
    {
-      if (tc->init == PNG_TC_INIT_FINAL)
+      if (tc->init == PNG_TC_INIT_FINAL) switch (tc->bit_depth)
       {
-         /* Record the palette depth to check here: */
-         (*tr)->args = png_ptr->num_palette;
-
-         switch (tc->bit_depth)
-         {
-            case 1: (*tr)->fn = palette_max_1bpp; break;
-            case 2: (*tr)->fn = palette_max_2bpp; break;
-            case 4: (*tr)->fn = palette_max_4bpp; break;
-            case 8: (*tr)->fn = palette_max_8bpp; break;
-            default:impossible("palette bit depth");
-         }
+         case 1: (*tr)->fn = palette_max_1bpp; break;
+         case 2: (*tr)->fn = palette_max_2bpp; break;
+         case 4: (*tr)->fn = palette_max_4bpp; break;
+         case 8: (*tr)->fn = palette_max_8bpp; break;
+         default:impossible("palette bit depth");
       }
    }
 
diff --git a/pngwutil.c b/pngwutil.c
index d6998e32f..468859763 100644
--- a/pngwutil.c
+++ b/pngwutil.c
@@ -1319,6 +1319,14 @@ png_write_tRNS(png_structrp png_ptr, png_const_bytep trans_alpha,
    if (color_type == PNG_COLOR_TYPE_PALETTE)
    {
       affirm(num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH);
+      if ((unsigned int)/*SAFE*/num_trans > png_ptr->num_palette)
+      {
+         /* This is an error which can only be reliably detected late. */
+         png_app_error(png_ptr,
+             "Invalid number of transparent colors specified");
+         return;
+      }
+
       {
 #        ifdef PNG_WRITE_INVERT_ALPHA_SUPPORTED
             union
@@ -1899,148 +1907,11 @@ png_start_IDAT(png_structrp png_ptr)
 }
 
 static void
-png_write_IDAT(png_structrp png_ptr, int end_of_image)
-{
-   png_compression_bufferp *listp = &png_ptr->zbuffer_list;
-   png_compression_bufferp list;
-   png_uint_32 output_len = png_ptr->zbuffer_len;
-   png_uint_32 start = png_ptr->zbuffer_start;
-   png_uint_32 size = png_ptr->IDAT_size;
-   const png_uint_32 min_size = (end_of_image ? 1U : size);
-
-   affirm(output_len >= min_size);
-
-   /* png_struct::zbuffer_end points to the pointer to the next (unused)
-    * compression buffer.  We don't need those blocks to produce output so
-    * free them now to save space.  This also ensures that *zbuffer_end is
-    * NULL so can be used to store the list head when wrapping the list.
-    */
-   png_free_buffer_list(png_ptr, png_ptr->zbuffer_end);
-
-   /* Write at least one chunk, of size 'size', write chunks until
-    * 'output_len' is less than 'min_size'.
-    */
-   list = *listp;
-
-   /* First, if this is the very first IDAT (PNG_HAVE_IDAT not set)
-    * optimize the CINFO field:
-    */
-#        ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
-      if ((png_ptr->mode & PNG_HAVE_IDAT) == 0U)
-      {
-         affirm(start == 0U);
-         optimize_cmf(list->output, png_image_size(png_ptr));
-      }
-#        endif /* WRITE_OPTIMIZE_CMF */
-
-   do /* write chunks */
-   {
-      /* 'size' is the size of the chunk to write, limited to IDAT_size:
-       */
-      if (size > output_len) /* Z_FINISH */
-         size = output_len;
-
-      debug(size >= min_size);
-      png_write_chunk_header(png_ptr, png_IDAT, size);
-
-      do /* write the data of one chunk */
-      {
-         /* The chunk data may be split across multiple compression
-          * buffers.  This loop moves 'list' down the available
-          * compression buffers.
-          */
-         png_uint_32 avail = PNG_ROW_BUFFER_SIZE - start; /* in *list */
-
-         if (avail > output_len) /* valid bytes */
-            avail = output_len;
-
-         if (avail > size) /* bytes needed for chunk */
-            avail = size;
-
-         affirm(list != NULL && avail > 0U &&
-                start+avail <= PNG_ROW_BUFFER_SIZE);
-         png_write_chunk_data(png_ptr, list->output+start, avail);
-         output_len -= avail;
-         size -= avail;
-         start += avail;
-
-         if (start == PNG_ROW_BUFFER_SIZE)
-         {
-            /* End of the buffer.  If all the compressed data has been
-             * consumed (output_len == 0) this will set list to NULL
-             * because of the png_free_buffer_list call above.  At this
-             * point 'size' should be 0 too and the loop will terminate.
-             */
-            start = 0U;
-            listp = &list->next;
-            list = *listp; /* May be NULL at the end */
-         }
-      } while (size > 0);
-
-      png_write_chunk_end(png_ptr);
-      size = png_ptr->IDAT_size; /* For the next chunk */
-   } while (output_len >= min_size);
-
-   png_ptr->mode |= PNG_HAVE_IDAT;
-   png_ptr->zbuffer_len = output_len;
-
-   if (output_len > 0U) /* Still got stuff to write */
-   {
-      affirm(!end_of_image && list != NULL);
-
-      /* If any compression buffers have been completely written move them
-       * to the end of the list so that they can be re-used and move
-       * 'list' to the head:
-       */
-      if (listp != &png_ptr->zbuffer_list) /* list not at start */
-      {
-         debug(list != png_ptr->zbuffer_list /* obviously */ &&
-               listp != png_ptr->zbuffer_end /* because *end == NULL */);
-         *png_ptr->zbuffer_end = png_ptr->zbuffer_list;
-         *listp = NULL;
-         png_ptr->zbuffer_list = list;
-      }
-
-      /* 'list' is now at the start, so 'start' can be stored. */
-      png_ptr->zbuffer_start = start;
-      png_ptr->zbuffer_len = output_len;
-   }
-
-   else /* output_len == 0U; all compressed data has been written */
-   {
-      if (end_of_image)
-      {
-         png_ptr->zowner = 0U; /* release z_stream */
-         png_ptr->mode |= PNG_AFTER_IDAT;
-      }
-
-      /* Else: this is unlikely but possible; the compression code managed
-       * to exactly fill an IDAT chunk with the data for this block of row
-       * bytes so nothing is left in the buffer list.  Simply reset the
-       * output pointers to the start of the list.  This code is executed
-       * on Z_FINISH as well just to make the state safe.
-       */
-      png_ptr->zstream.next_out = NULL;
-      png_ptr->zstream.avail_out = 0U;
-      png_ptr->zbuffer_start = 0U;
-      png_ptr->zbuffer_len = 0U;
-      png_ptr->zbuffer_end = &png_ptr->zbuffer_list;
-   } /* output_len == 0 */
-}
-
-typedef struct
-{
-   png_compression_bufferp *zbuffer_end;   /* 'next' field of current buffer */
-   png_uint_32              zbuffer_len;   /* Length of data in list */
-}  png_IDAT_compression_state;
-
-static int
-png_compress_IDAT_test(png_structrp png_ptr, png_IDAT_compression_state *state,
-      z_stream *zstream, png_const_voidp input, uInt input_len, int flush)
+png_compress_IDAT(png_structrp png_ptr, png_const_voidp input, uInt input_len,
+      int flush)
 {
-   png_uint_32 output_len = 0U;
    int ret;
-
+   
    /* The stream must have been claimed: */
    affirm(png_ptr->zowner == png_IDAT);
 
@@ -2048,34 +1919,22 @@ png_compress_IDAT_test(png_structrp png_ptr, png_IDAT_compression_state *state,
     * buffer list.  next_in must be set here, avail_in comes from the input_len
     * parameter:
     */
-   zstream->next_in = PNGZ_INPUT_CAST(png_voidcast(const Bytef*, input));
-   ret = png_compress(png_ptr, zstream, &state->zbuffer_end, input_len,
-         &output_len, flush);
-   implies(ret == Z_OK || ret == Z_FINISH, zstream->avail_in == 0U);
-   zstream->next_in = NULL;
-   zstream->avail_in = 0U; /* safety */
-
-   /* If IDAT_size is set to PNG_UINT_31_MAX the length will be larger, but
-    * not enough to overflow a png_uint_32.
-    */
-   state->zbuffer_len += output_len;
-   return ret;
-
-}
+   {
+      png_uint_32 output_len = 0U;
 
-static void
-png_compress_IDAT(png_structp png_ptr, png_const_voidp input, uInt input_len,
-      int flush)
-{
-   png_IDAT_compression_state state;
-   int ret;
+      png_ptr->zstream.next_in =
+         PNGZ_INPUT_CAST(png_voidcast(const Bytef*,input));
+      ret = png_compress(png_ptr, &png_ptr->zstream, &png_ptr->zbuffer_end,
+            input_len, &output_len, flush);
+      implies(ret == Z_OK || ret == Z_FINISH, png_ptr->zstream.avail_in == 0U);
+      png_ptr->zstream.next_in = NULL;
+      png_ptr->zstream.avail_in = 0U; /* safety */
 
-   state.zbuffer_end  = png_ptr->zbuffer_end;
-   state.zbuffer_len  = png_ptr->zbuffer_len;
-   ret = png_compress_IDAT_test(png_ptr, &state, &png_ptr->zstream, input,
-         input_len, flush);
-   png_ptr->zbuffer_end  = state.zbuffer_end;
-   png_ptr->zbuffer_len  = state.zbuffer_len;
+      /* If IDAT_size is set to PNG_UINT_31_MAX the length will be larger, but
+       * not enough to overflow a png_uint_32.
+       */
+      png_ptr->zbuffer_len += output_len;
+   }
 
    /* Check the return code. */
    if (ret == Z_OK || ret == Z_STREAM_END)
@@ -2097,7 +1956,133 @@ png_compress_IDAT(png_structp png_ptr, png_const_voidp input, uInt input_len,
        * written this function call is complete.
        */
       if (flush == Z_FINISH || png_ptr->zbuffer_len >= png_ptr->IDAT_size)
-         png_write_IDAT(png_ptr, flush == Z_FINISH);
+      {
+         png_compression_bufferp *listp = &png_ptr->zbuffer_list;
+         png_compression_bufferp list;
+         png_uint_32 output_len = png_ptr->zbuffer_len;
+         png_uint_32 start = png_ptr->zbuffer_start;
+         png_uint_32 size = png_ptr->IDAT_size;
+         const png_uint_32 min_size = (flush == Z_FINISH ? 1U : size);
+
+         affirm(output_len >= min_size);
+
+         /* png_struct::zbuffer_end points to the pointer to the next (unused)
+          * compression buffer.  We don't need those blocks to produce output so
+          * free them now to save space.  This also ensures that *zbuffer_end is
+          * NULL so can be used to store the list head when wrapping the list.
+          */
+         png_free_buffer_list(png_ptr, png_ptr->zbuffer_end);
+
+         /* Write at least one chunk, of size 'size', write chunks until
+          * 'output_len' is less than 'min_size'.
+          */
+         list = *listp;
+
+         /* First, if this is the very first IDAT (PNG_HAVE_IDAT not set)
+          * optimize the CINFO field:
+          */
+#        ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
+            if ((png_ptr->mode & PNG_HAVE_IDAT) == 0U)
+            {
+               affirm(start == 0U);
+               optimize_cmf(list->output, png_image_size(png_ptr));
+            }
+#        endif /* WRITE_OPTIMIZE_CMF */
+
+         do /* write chunks */
+         {
+            /* 'size' is the size of the chunk to write, limited to IDAT_size:
+             */
+            if (size > output_len) /* Z_FINISH */
+               size = output_len;
+
+            debug(size >= min_size);
+            png_write_chunk_header(png_ptr, png_IDAT, size);
+
+            do /* write the data of one chunk */
+            {
+               /* The chunk data may be split across multiple compression
+                * buffers.  This loop moves 'list' down the available
+                * compression buffers.
+                */
+               png_uint_32 avail = PNG_ROW_BUFFER_SIZE - start; /* in *list */
+
+               if (avail > output_len) /* valid bytes */
+                  avail = output_len;
+
+               if (avail > size) /* bytes needed for chunk */
+                  avail = size;
+
+               affirm(list != NULL && avail > 0U &&
+                      start+avail <= PNG_ROW_BUFFER_SIZE);
+               png_write_chunk_data(png_ptr, list->output+start, avail);
+               output_len -= avail;
+               size -= avail;
+               start += avail;
+
+               if (start == PNG_ROW_BUFFER_SIZE)
+               {
+                  /* End of the buffer.  If all the compressed data has been
+                   * consumed (output_len == 0) this will set list to NULL
+                   * because of the png_free_buffer_list call above.  At this
+                   * point 'size' should be 0 too and the loop will terminate.
+                   */
+                  start = 0U;
+                  listp = &list->next;
+                  list = *listp; /* May be NULL at the end */
+               }
+            } while (size > 0);
+
+            png_write_chunk_end(png_ptr);
+            size = png_ptr->IDAT_size; /* For the next chunk */
+         } while (output_len >= min_size);
+
+         png_ptr->mode |= PNG_HAVE_IDAT;
+         png_ptr->zbuffer_len = output_len;
+
+         if (output_len > 0U) /* Still got stuff to write */
+         {
+            affirm(flush != Z_FINISH && list != NULL);
+
+            /* If any compression buffers have been completely written move them
+             * to the end of the list so that they can be re-used and move
+             * 'list' to the head:
+             */
+            if (listp != &png_ptr->zbuffer_list) /* list not at start */
+            {
+               debug(list != png_ptr->zbuffer_list /* obviously */ &&
+                     listp != png_ptr->zbuffer_end /* because *end == NULL */);
+               *png_ptr->zbuffer_end = png_ptr->zbuffer_list;
+               *listp = NULL;
+               png_ptr->zbuffer_list = list;
+            }
+
+            /* 'list' is now at the start, so 'start' can be stored. */
+            png_ptr->zbuffer_start = start;
+            png_ptr->zbuffer_len = output_len;
+         }
+
+         else /* output_len == 0U; all compressed data has been written */
+         {
+            if (flush == Z_FINISH) /* end of data */
+            {
+               png_ptr->zowner = 0U; /* release z_stream */
+               png_ptr->mode |= PNG_AFTER_IDAT;
+            }
+
+            /* Else: this is unlikely but possible; the compression code managed
+             * to exactly fill an IDAT chunk with the data for this block of row
+             * bytes so nothing is left in the buffer list.  Simply reset the
+             * output pointers to the start of the list.  This code is executed
+             * on Z_FINISH as well just to make the state safe.
+             */
+            png_ptr->zstream.next_out = NULL;
+            png_ptr->zstream.avail_out = 0U;
+            png_ptr->zbuffer_start = 0U;
+            png_ptr->zbuffer_len = 0U;
+            png_ptr->zbuffer_end = &png_ptr->zbuffer_list;
+         } /* output_len == 0 */
+      } /* flush == FINISH || png_ptr->zbuffer_len >= png_ptr->IDAT_size */
    }
 
    else /* ret != Z_OK && ret != Z_STREAM_END */
diff --git a/projects/vstudio/readme.txt b/projects/vstudio/readme.txt
index 78460b7e4..96dcf07e9 100644
--- a/projects/vstudio/readme.txt
+++ b/projects/vstudio/readme.txt
@@ -1,7 +1,7 @@
 
 VisualStudio instructions
 
-libpng version 1.7.0beta70 - November 24, 2015
+libpng version 1.7.0beta70 - December 3, 2015
 
 Copyright (c) 1998-2010 Glenn Randers-Pehrson
 
diff --git a/projects/vstudio/zlib.props b/projects/vstudio/zlib.props
index d055cdd34..05eb3f4d5 100644
--- a/projects/vstudio/zlib.props
+++ b/projects/vstudio/zlib.props
@@ -2,7 +2,7 @@
 <!--
  * zlib.props - location of zlib source
  *
- * libpng version 1.7.0beta70 - November 24, 2015
+ * libpng version 1.7.0beta70 - December 3, 2015
  *
  * Copyright (c) 1998-2011 Glenn Randers-Pehrson
  *
diff --git a/scripts/README.txt b/scripts/README.txt
index c37741c62..b430fde85 100644
--- a/scripts/README.txt
+++ b/scripts/README.txt
@@ -1,5 +1,5 @@
 
-Makefiles for  libpng version 1.7.0beta70 - November 24, 2015
+Makefiles for  libpng version 1.7.0beta70 - December 3, 2015
 
 pnglibconf.h.prebuilt       =>  Stores configuration settings
  makefile.linux    =>  Linux/ELF makefile
diff --git a/scripts/options.awk b/scripts/options.awk
index 79d24bbdc..81b82ff09 100755
--- a/scripts/options.awk
+++ b/scripts/options.awk
@@ -243,7 +243,7 @@ $1 == "file" && NF >= 2{
 
 # option NAME ( (requires|enables|if) NAME* | on | off | disabled |
 #                sets SETTING VALUE+ )*
-#
+#     
 #   Declares an option 'NAME' and describes its default setting (disabled)
 #   and its relationship to other options.  The option is disabled
 #   unless *all* the options listed after 'requires' are set and at
diff --git a/scripts/pnglibconf.dfa b/scripts/pnglibconf.dfa
index f01535457..1761ec7d1 100644
--- a/scripts/pnglibconf.dfa
+++ b/scripts/pnglibconf.dfa
@@ -125,7 +125,7 @@ file pnglibconf.h scripts/pnglibconf.dfa PNGLCONF_H
 #
 # To avoid confusion use -DPNG_foo_SUPPORTED= on the command line, which does
 # the same thing as the #define.
-#
+# 
 # SUMMARY:
 #  These lines/macro settings are equivalent:
 #
@@ -460,7 +460,7 @@ option SET_USER_LIMITS requires USER_LIMITS
 # See the comments above about how to change options and settings.
 
 # READ/WRITE tranform support
-#
+# 
 # The internal TRANSFORM_MECH options are used to turn on (or off) the required
 # support code for the read and write transforms.  They are off by default,
 # switching them on is not a good idea.  Switching them off will cause the build
diff --git a/scripts/pnglibconf.h.prebuilt b/scripts/pnglibconf.h.prebuilt
index d39a89ae3..11db11f48 100644
--- a/scripts/pnglibconf.h.prebuilt
+++ b/scripts/pnglibconf.h.prebuilt
@@ -2,7 +2,7 @@
 
 /* pnglibconf.h - library build configuration */
 
-/* Libpng version 1.7.0beta70 - November 30, 2015 */
+/* Libpng version 1.7.0beta70 - December 3, 2015 */
 
 /* Copyright (c) 1998-2015 Glenn Randers-Pehrson */