From f4276c36c93e9a257f0780a3590886d5fa411f1d Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp@shaggy.simplesystems.org>
Date: Sat, 16 May 2009 08:47:20 -0500
Subject: [PATCH] Set png_ptr->old_prev_row_size=0 to force prev_row to be
 cleared

---
 ANNOUNCE   |  2 ++
 CHANGES    |  2 ++
 pngpread.c | 10 ++++++----
 pngrutil.c |  9 +++++----
 4 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/ANNOUNCE b/ANNOUNCE
index a808920d..56d06229 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -54,6 +54,8 @@ version 1.2.37beta01 [May 14, 2009]
 version 1.2.37beta02 [May 16, 2009]
   Fixed typo in libpng documentation (FILTER_AVE should be FILTER_AVG)
   Relocated misplaced #endif in pngwrite.c, sCAL chunk handler.
+  In pngpread.c and pngrutil.c, set png_ptr->old_prev_row_size=0 to
+    force the prev_row array to be cleared before row 0 of each pass.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 
diff --git a/CHANGES b/CHANGES
index 7a8b7338..c3c02f30 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2379,6 +2379,8 @@ version 1.2.37beta01 [May 14, 2009]
 version 1.2.37beta02 [May 16, 2009]
   Fixed typo in libpng documentation (FILTER_AVE should be FILTER_AVG)
   Relocated misplaced #endif in pngwrite.c, sCAL chunk handler.
+  In pngpread.c and pngrutil.c, set png_ptr->old_prev_row_size=0 to
+    force the prev_row array to be cleared before row 0 of each pass.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/pngpread.c b/pngpread.c
index b06fbada..35ef987d 100644
--- a/pngpread.c
+++ b/pngpread.c
@@ -1,9 +1,9 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.2.32 [September 18, 2008]
+ * Last changed in libpng 1.2.37 [May 16, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  */
@@ -1013,11 +1013,12 @@ png_read_push_finish_row(png_structp png_ptr)
    if (png_ptr->row_number < png_ptr->num_rows)
       return;
 
+   png_ptr->old_prev_row_size = 0; /* Force clearing prev_row */
+
+#ifdef PNG_READ_INTERLACING_SUPPORTED
    if (png_ptr->interlaced)
    {
       png_ptr->row_number = 0;
-      png_memset_check(png_ptr, png_ptr->prev_row, 0,
-         png_ptr->rowbytes + 1);
       do
       {
          png_ptr->pass++;
@@ -1049,6 +1050,7 @@ png_read_push_finish_row(png_structp png_ptr)
 
       } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0);
    }
+#endif /* PNG_READ_INTERLACING_SUPPORTED */
 }
 
 #if defined(PNG_READ_tEXt_SUPPORTED)
diff --git a/pngrutil.c b/pngrutil.c
index 46204b96..b7c083eb 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,7 +1,7 @@
 
 /* pngrutil.c - utilities to read a PNG file
  *
- * Last changed in libpng 1.2.37 [May 15, 2009]
+ * Last changed in libpng 1.2.37 [May 16, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -2913,12 +2913,13 @@ png_read_finish_row(png_structp png_ptr)
    if (png_ptr->row_number < png_ptr->num_rows)
       return;
 
+   /* Force prev_row to be cleared. */
+   png_ptr->old_prev_row_size=0;
+
 #ifdef PNG_READ_INTERLACING_SUPPORTED
    if (png_ptr->interlaced)
    {
       png_ptr->row_number = 0;
-      png_memset_check(png_ptr, png_ptr->prev_row, 0,
-         png_ptr->rowbytes + 1);
       do
       {
          png_ptr->pass++;
@@ -3187,7 +3188,7 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
    if (row_bytes + 64 > png_ptr->old_big_row_buf_size)
    {
      png_free(png_ptr, png_ptr->big_row_buf);
-      png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 64);
+     png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 64);
      if (png_ptr->interlaced)
        png_memset(png_ptr->big_row_buf, 0, row_bytes + 64);
      png_ptr->row_buf = png_ptr->big_row_buf + 32;