Code: transform_test(png_modifier *pmIn, PNG_CONST png_uint_32 idIn,
    PNG_CONST image_transform* transform_listIn, PNG_CONST char * volatile name)
 {
    transform_display d;
    context(&pmIn->this, fault);

   transform_display_init(&d, pmIn, idIn, transform_listIn);

 Try
 {
 size_t pos = 0;
      png_structp pp;
      png_infop pi;
 char full_name[256];

 /* Make sure the encoding fields are correct and enter the required
       * modifications.
       */
      transform_set_encoding(&d);

 /* Add any modifications required by the transform list. */
      d.transform_list->ini(d.transform_list, &d);

 /* Add the color space information, if any, to the name. */
      pos = safecat(full_name, sizeof full_name, pos, name);
      pos = safecat_current_encoding(full_name, sizeof full_name, pos, d.pm);

 /* Get a png_struct for reading the image. */
      pp = set_modifier_for_read(d.pm, &pi, d.this.id, full_name);
      standard_palette_init(&d.this);

#     if 0
 /* Logging (debugging only) */
 {
 char buffer[256];

 (void)store_message(&d.pm->this, pp, buffer, sizeof buffer, 0,
 "running test");

            fprintf(stderr, "%s\n", buffer);
 }
#     endif

 /* Introduce the correct read function. */
 if (d.pm->this.progressive)
 {
 /* Share the row function with the standard implementation. */
         png_set_progressive_read_fn(pp, &d, transform_info, progressive_row,
            transform_end);

 /* Now feed data into the reader until we reach the end: */
         modifier_progressive_read(d.pm, pp, pi);
 }
 else
 {
 /* modifier_read expects a png_modifier* */
         png_set_read_fn(pp, d.pm, modifier_read);

 /* Check the header values: */
         png_read_info(pp, pi);

 /* Process the 'info' requirements. Only one image is generated */
         transform_info_imp(&d, pp, pi);

         sequential_row(&d.this, pp, pi, -1, 0);

 if (!d.this.speed)
            transform_image_validate(&d, pp, pi);
 else
            d.this.ps->validated = 1;
 }

      modifier_reset(d.pm);
 }

 Catch(fault)
 {
      modifier_reset(voidcast(png_modifier*,(void*)fault));
 }
}

Vulnerability Type: +Priv 
CWE ID: 
Summary: Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23265085.
Commit Message: DO NOT MERGE Update libpng to 1.6.20

BUG:23265085
Change-Id: I85199805636d771f3597b691b63bc0bf46084833
(cherry picked from commit bbe98b40cda082024b669fa508931042eed18f82)
