Update to 1.5.3rc02 for a security fix.

Version 1.5.3beta07 [May 11, 2011]
  Added expand_16 support to the high level interface.
  Added named value and 'flag' gamma support to png_set_gamma.  Made a minor
    change from the previous (unreleased) ABI/API to hide the exact value used
    for Macs - it's not a good idea to embed this in the ABI!
  Moved macro definitions for PNG_HAVE_IHDR, PNG_HAVE_PLTE, and PNG_AFTER_IDAT
    from pngpriv.h to png.h because they must be visible to applications
    that call png_set_unknown_chunks().
  Check for up->location !PNG_AFTER_IDAT when writing unknown chunks
    before IDAT.

Version 1.5.3beta08 [May 16, 2011]
  Improved "pngvalid --speed" to exclude more of pngvalid from the time.
  Documented png_set_alpha_mode(), other changes in libpng.3/libpng-manual.txt
  The cHRM chunk now sets the defaults for png_set_rgb_to_gray() (when negative
    parameters are supplied by the caller), while in the absence of cHRM
    sRGB/Rec 709 values are still used.
  The bKGD chunk no longer overwrites the background value set by
    png_set_background(), allowing the latter to be used before the file
    header is read. It never performed any useful function to override
    the default anyway.
  Added memory overwrite and palette image checks to pngvalid.c
    Previously palette image code was poorly checked. Since the transformation
    code has a special palette path in most cases this was a severe weakness.
  Minor cleanup and some extra checking in pngrutil.c and pngrtran.c. When
    expanding an indexed image, always expand to RGBA if transparency is
    present.

Version 1.5.3beta09 [May 17, 2011]
  Reversed earlier 1.5.3 change of transformation order; move png_expand_16
    back where it was.  The change doesn't work because it requires 16-bit
    gamma tables when the code only generates 8-bit ones.  This fails
    silently; the libpng code just doesn't do any gamma correction.  Moving
    the tests back leaves the old, inaccurate, 8-bit gamma calculations, but
    these are clearly better than none!

Version 1.5.3beta10 [May 20, 2011]

  png_set_background() and png_expand_16() did not work together correctly.
    This problem is present in 1.5.2; if png_set_background is called with
    need_expand false and the matching 16 bit color libpng erroneously just
    treats it as an 8-bit color because of where png_do_expand_16 is in the
    transform list.  This simple fix reduces the supplied colour to 8-bits,
    so it gets smashed, but this is better than the current behavior.
  Added tests for expand16, more fixes for palette image tests to pngvalid.
    Corrects the code for palette image tests and disables attempts to
    validate palette colors.

Version 1.5.3rc01 [June 3, 2011]
  No changes.

Version 1.5.3rc02 [June 7, 2011]
  Fixed 1-byte uninitialized memory reference in png_format_buffer() (Bug
    report by Frank Busse, related to CVE-2004-0421).

2 files changed, 6 insertions, 6 deletions

diff --git a/graphics/png/Makefile b/graphics/png/Makefile
index 80309a15c50..1b8e304b1bf 100644
--- a/graphics/png/Makefile
+++ b/graphics/png/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.136 2011/05/08 09:09:20 wiz Exp $
+# $NetBSD: Makefile,v 1.137 2011/06/08 06:58:58 wiz Exp $
 
-DISTNAME=	libpng-1.5.3beta06
+DISTNAME=	libpng-1.5.3rc02
 PKGNAME=	${DISTNAME:S/lib//}
 CATEGORIES=	graphics
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE:=libpng/} \
diff --git a/graphics/png/distinfo b/graphics/png/distinfo
index 0f0a40420a7..299c56d8beb 100644
--- a/graphics/png/distinfo
+++ b/graphics/png/distinfo
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.83 2011/05/08 09:11:08 wiz Exp $
+$NetBSD: distinfo,v 1.84 2011/06/08 06:58:58 wiz Exp $
 
-SHA1 (libpng-1.5.3beta06.tar.gz) = 033a8123244a9bb5c8a837a3a921548f8c08bdde
-RMD160 (libpng-1.5.3beta06.tar.gz) = 6b4eca7d154ec150ab23b6826114ca9188c78b25
-Size (libpng-1.5.3beta06.tar.gz) = 992355 bytes
+SHA1 (libpng-1.5.3rc02.tar.gz) = 0ccc3250fc9690e66355298f65919e252caf9cb1
+RMD160 (libpng-1.5.3rc02.tar.gz) = a70c0840a33ae0c17b2593bd1bc63fe10a2c52d4
+Size (libpng-1.5.3rc02.tar.gz) = 1004084 bytes
 SHA1 (patch-aa) = 0c4f4e594798384079a0ce2ee5d7a45e16366b12