Code:  next_format(png_bytep colour_type, png_bytep bit_depth,
   unsigned int* palette_number, int no_low_depth_gray)
 {
    if (*bit_depth == 0)
    {
       *colour_type = 0;
      if (no_low_depth_gray)
         *bit_depth = 8;
      else
          *bit_depth = 1;
       *palette_number = 0;
       return 1;
    }
 
   if (*colour_type == 3)
    {
      /* Add multiple palettes for colour type 3. */
      if (++*palette_number < PALETTE_COUNT(*bit_depth))
          return 1;
 
       *palette_number = 0;
    }
 
 *bit_depth = (png_byte)(*bit_depth << 1);

 
    /* Palette images are restricted to 8 bit depth */
    if (*bit_depth <= 8
#     ifdef DO_16BIT
          || (*colour_type != 3 && *bit_depth <= 16)
#     endif
       )
       return 1;
 
 /* Move to the next color type, or return 0 at the end. */
 switch (*colour_type)
 {
 case 0:
 *colour_type = 2;
 *bit_depth = 8;
 return 1;

 case 2:
 *colour_type = 3;
 *bit_depth = 1;
 return 1;

 case 3:
 *colour_type = 4;
 *bit_depth = 8;
 return 1;

 case 4:
 *colour_type = 6;
 *bit_depth = 8;
 return 1;

 default:
 return 0;
 }
}

Vulnerability Type: +Priv 
CWE ID: 
Summary: Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23265085.
Commit Message: DO NOT MERGE Update libpng to 1.6.20

BUG:23265085
Change-Id: I85199805636d771f3597b691b63bc0bf46084833
(cherry picked from commit bbe98b40cda082024b669fa508931042eed18f82)
