Code: IDAT_list_extend(struct IDAT_list *tail)
{
 /* Use the previous cached value if available. */
 struct IDAT_list *next = tail->next;

 if (next == NULL)
 {
 /* Insert a new, malloc'ed, block of IDAT information buffers, this
       * one twice as large as the previous one:
       */
 unsigned int length = 2 * tail->length;

 
       if (length < tail->length) /* arithmetic overflow */
          length = tail->length;
      next = png_voidcast(IDAT_list*, malloc(IDAT_list_size(NULL, length)));
       CLEAR(*next);
 
       /* The caller must handle this: */
 if (next == NULL)
 return NULL;

      next->next = NULL;
      next->length = length;
      tail->next = next;
 }

 return next;
}

Vulnerability Type: +Priv 
CWE ID: 
Summary: Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23265085.
Commit Message: DO NOT MERGE Update libpng to 1.6.20

BUG:23265085
Change-Id: I85199805636d771f3597b691b63bc0bf46084833
(cherry picked from commit bbe98b40cda082024b669fa508931042eed18f82)
