Code: store_image_row(PNG_CONST png_store* ps, png_const_structp pp, int nImage,
    png_uint_32 y)
 {
    png_size_t coffset = (nImage * ps->image_h + y) * (ps->cb_row + 5) + 2;

 if (ps->image == NULL)
      png_error(pp, "no allocated image");

 if (coffset + ps->cb_row + 3 > ps->cb_image)
      png_error(pp, "image too small");

 return ps->image + coffset;
}

Commit Message: DO NOT MERGE Update libpng to 1.6.20

BUG:23265085
Change-Id: I85199805636d771f3597b691b63bc0bf46084833
(cherry picked from commit bbe98b40cda082024b669fa508931042eed18f82)

CWE ID: 
store_image_row(PNG_CONST png_store* ps, png_const_structp pp, int nImage,
store_image_row(const png_store* ps, png_const_structp pp, int nImage,
    png_uint_32 y)
 {
    png_size_t coffset = (nImage * ps->image_h + y) * (ps->cb_row + 5) + 2;

 if (ps->image == NULL)
      png_error(pp, "no allocated image");

 if (coffset + ps->cb_row + 3 > ps->cb_image)
      png_error(pp, "image too small");

 return ps->image + coffset;
}
