Because png_handle_pCAL has allocated memory to free.
Signed-off-by: NJohn Bowler <jbowler@acm.org>

When an input file contains a zero length IDAT and pngfix is not applying the
IDAT rechunking (--max) option pngfix will go into a loop writing the zero
length IDAT for ever.

This is a fairly minor issue for interactive use; zero length IDAT is very rare,
the problem is obvious (pngfix hangs) and the fix (use --max, or --max=4096
etc), while not obvious, is easy.

For non-interactive use, e.g. trying to automatically repair a PNG that cannot
be read by libpng, there are security consequences:

1) pngfix hangs.  This may permit a DoS attack.
2) When the --out option is used pngfix will just keep writing.  This is a very
likely DoS scenario.
Signed-off-by: NJohn Bowler <jbowler@acm.org>

    1. png_read_filter_row_sub4_msa
    2. png_read_filter_row_avg4_msa
    3. png_read_filter_row_paeth4_msa
    4. png_read_filter_row_sub3_msa
    5. png_read_filter_row_avg3_msa
    6. png_read_filter_row_paeth3_msa
Signed-off-by: NMandar Sahastrabuddhe <Mandar.Sahastrabuddhe@imgtec.com>

Update from original

Also added one msa optimized function: png_read_filter_row_up_msa
Signed-off-by: NMandar Sahastrabuddhe <Mandar.Sahastrabuddhe@imgtec.com>

Moved it from bin_PROGRAMS to check_PROGRAMS in Makefile.am so it will be
built but not installed.

chunk reading.

now that iCCP profile_length honors PNG_USER_CHUNK_MALLOC_MAX.

The code now validates the ICC profile length against the user chunk limit
before the buffer is allocated, as opposed to doing it while the buffer is read.

This removes the potential to consume virtual address space with a carefully
crafted ICC profile; only an issue on 32-bit systems where a valid profile can
be up to 2^32-4 bytes in length.  libpng never writes beyond the application
supplied limit, but previously it did allocate a buffer of the size specified in
the profile header.  The exploitability of this is almost zero; the address
space is released as soon as the PNG read completes.

Also clean up PNG_DEBUG compile of pngtest.c.
Signed-off-by: NJohn Bowler <jbowler@acm.org>

png_error() on failure.  Reject oversized iCCP profile immediately.