Description:fix CVE-2018-14048.It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.
https://nvd.nist.gov/vuln/detail/CVE-2018-140480
https://github.com/glennrp/libpng/pull/290/commits/6b16211b552a21e1c640bdeaf072ed6df43c3f55

Team:OTHERS
Feature or Bugfix:Bugfix
Binary Source:No
PrivateCode(Yes/No):No

Change-Id: I762f59767b070f5c6a98b3604cdc6cb69081575b
Reviewed-on: http://mgit-tm.rnd.huawei.com/10448035Tested-by: Npublic jenkins <public_jenkins@notesmail.huawei.com>
Reviewed-by: Nliqiang 00425722 <liqiang121@huawei.com>
Reviewed-by: Nzhaopeng 00380337 <zhaopeng22@huawei.com>

Found via `codespell` and `grep`

As per the const correctness rules, top-level const-ness of data
in automatic scopes does not propagate outside of these scopes
(unlike const-ness at lower levels, such as pointers to const data).

Previously, const was used liberally, but inconsistently across the
libpng codebase. Using const wherever applicable is not incorrect.
However, _consistent_ use of const is difficult to maintain in such
conditions.

In conclusion, we shall continue to use const only where doing so is
strictly necessary:

1. If a function guarantees that it will not modify an argument
   passed by pointer, the corresponding function parameter should be
   a pointer-to-const (const T *).

2. Static data should not be modified, therefore it should be const.

Reference:
Google C++ Style Guide
https://google.github.io/styleguide/cppguide.html#Use_of_const

In v1.6.0, size_t became a required type. It should be used
consistently. To maintain backwards compatibility, png_size_t
is still maintained in deprecated form.

found via `codespell-q 3`
please review

Some are user facing. Some are in actual code. Most are in source comments. Also, please double check the changes in contrib/tools/pngfix.c

The fixed size buffer for the file name being processed could have a byte
written beyond the end; a bug where the test was updated without changing the
size of the buffer.  This commit reduces the buffer to the system maximum.

png_getrowbytes could, in theory, return 0; probably only if there is a bug in
libpng but the code now checks.
Signed-off-by: NJohn Bowler <jbowler@acm.org>

Signed-off-by: NJohn Bowler <jbowler@acm.org>

If PNG_PNGCP_TIMING_SUPPORTED is defined maximal resolution CPU time logging of
png_read_png and png_write_png is enabled via the --time command line option.
This is not on by default but is enabled by contrib/conftests/pngcp.dfa
Signed-off-by: NJohn Bowler <jbowler@acm.org>

This adds pngcp to the build together with a pngcp.dfa configuration test; the
test revealed some configuration bugs which are fixed by corrections to the
_SUPPORTED macros.

pngcp builds on all tested configurations and a number of bugs have been fixed
to make this happen relative to the version in libpng 1.7 contrib/examples.
pngcp.dfa will have to be different for 1.7 but pngcp.c should work fine (not
yet tested).  pngcp itself is still missing a usage message; this is a
preliminary version, although since it behaves the same way as 'cp' most unoids
shouldn't have a problem using it correctly.
Signed-off-by: NJohn Bowler <jbowler@acm.org>