and test.cmake.in

The macro underreported the size (by up to 512 bytes) of an 8-bit non-color
palette based memory format because it failed to take into account that the
memory palette has to be expanded to full RGB when it is written to PNG.

This is not likely to be a serious bug because the macro is new, the memory
format in question is likely to be rarely used and the result of an undersized
buffer fails in a safe way.
Signed-off-by: NJohn Bowler <jbowler@acm.org>

Signed-off-by: NJohn Bowler <jbowler@acm.org>

This is the test backported from 1.7 to ensure that when treating IDATs as
unknown the test does not fail if there are more than one IDAT chunks in the
file.
Signed-off-by: NJohn Bowler <jbowler@acm.org>

This implements an API and provides a number of assist macros to allow an
application which uses the simplified API write to bypass stdio and write
directly to memory.

It also includes some warnings (png.h) and some check code to detect *possible*
overflow in the ROW_STRIDE and simplified image SIZE macros.  This disallows
image width/height/format that *might* overflow.  A quiet API change that limits
in-memory image size (uncompressed) to less that 4GByte and image row size
(stride) to less than 2GByte.
Signed-off-by: NJohn Bowler <jbowler@acm.org>

pngunknown.c calls png_init_io (always), skip the test if there is no stdio.h
support.
Signed-off-by: NJohn Bowler <jbowler@acm.org>

"tmpfile()" implementation in contrib/libtests/pngstest.c

Only affects release builds
Signed-off-by: NJohn Bowler <jbowler@acm.org>

Undefined because (png_byte) << shift is undefined if it changes the signed bit
(because png_byte is promoted to int).  The libpng exported functions
png_get_uint_32 and png_get_uint_16 handle this.

Bug reported by David Drysdale as a result of reports from UBSAN in clang 3.8.

This changes pngvalid to use BE random numbers; this used to produce errors but
these should not be fixed as a result of the previous changes.
Signed-off-by: NJohn Bowler <jbowler@acm.org>

This widens the 'limit' check on the internally calculated error limits in the
'DIGITIZE' case (the code used prior to 1.7 for rgb_to_gray error checks) and it
changes the check to only operate in non-release builds (base build type not RC
or RELEASE.)
Signed-off-by: NJohn Bowler <jbowler@acm.org>