Code:  perform_transform_test(png_modifier *pm)
 {
   png_byte colour_type = 0;

    png_byte bit_depth = 0;
    unsigned int palette_number = 0;
 
   while (next_format(&colour_type, &bit_depth, &palette_number, 0))
    {
       png_uint_32 counter = 0;
       size_t base_pos;
 char name[64];

      base_pos = safecat(name, sizeof name, 0, "transform:");


       for (;;)
       {
          size_t pos = base_pos;
         PNG_CONST image_transform *list = 0;
 
          /* 'max' is currently hardwired to '1'; this should be settable on the
           * command line.
          */
         counter = image_transform_add(&list, 1/*max*/, counter,
            name, sizeof name, &pos, colour_type, bit_depth);

 if (counter == 0)
 break;

 /* The command line can change this to checking interlaced images. */
 do
 {
            pm->repeat = 0;
            transform_test(pm, FILEID(colour_type, bit_depth, palette_number,
               pm->interlace_type, 0, 0, 0), list, name);

 if (fail(pm))
 return;
 }
 while (pm->repeat);
 }
 }
}

Vulnerability Type: +Priv 
CWE ID: 
Summary: Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23265085.
Commit Message: DO NOT MERGE Update libpng to 1.6.20

BUG:23265085
Change-Id: I85199805636d771f3597b691b63bc0bf46084833
(cherry picked from commit bbe98b40cda082024b669fa508931042eed18f82)
