Chris Efant:

package/rene/libpng/2-CAN-2002-1363.patch

@@ -0,0 +1,24 @@
+--- ./pngrtran.c	9 Jan 2004 18:22:43 -0000	1.1
++++ ./pngrtran.c	3 May 2004 08:19:51 -0000	1.2
+@@ -1965,8 +1965,8 @@
+          /* This changes the data from RRGGBB to RRGGBBXX */
+          if (flags & PNG_FLAG_FILLER_AFTER)
+          {
+-            png_bytep sp = row + (png_size_t)row_width * 3;
+-            png_bytep dp = sp  + (png_size_t)row_width;
++            png_bytep sp = row + (png_size_t)row_width * 6;
++            png_bytep dp = sp  + (png_size_t)row_width * 2;
+             for (i = 1; i < row_width; i++)
+             {
+                *(--dp) = hi_filler;
+@@ -1987,8 +1987,8 @@
+          /* This changes the data from RRGGBB to XXRRGGBB */
+          else
+          {
+-            png_bytep sp = row + (png_size_t)row_width * 3;
+-            png_bytep dp = sp  + (png_size_t)row_width;
++            png_bytep sp = row + (png_size_t)row_width * 6;
++            png_bytep dp = sp  + (png_size_t)row_width * 2;
+             for (i = 0; i < row_width; i++)
+             {
+                *(--dp) = *(--sp);

package/rene/libpng/3b-CAN-2004-0421.patch

@@ -0,0 +1,41 @@
+*** ./pngconf.h_125	2002-10-03 07:32:27.000000000 -0400
+--- ./pngconf.h	2004-05-06 09:41:33.000000000 -0400
+***************
+*** 1280,1285 ****
+--- 1285,1291 ----
+  #  define CVT_PTR(ptr) (png_far_to_near(png_ptr,ptr,CHECK))
+  #  define CVT_PTR_NOCHECK(ptr) (png_far_to_near(png_ptr,ptr,NOCHECK))
+  #  define png_strcpy _fstrcpy
++ #  define png_strncpy _fstrncpy    /* Added to v 1.2.6 */
+  #  define png_strlen _fstrlen
+  #  define png_memcmp _fmemcmp      /* SJT: added */
+  #  define png_memcpy _fmemcpy
+***************
+*** 1288,1293 ****
+--- 1294,1300 ----
+  #  define CVT_PTR(ptr)         (ptr)
+  #  define CVT_PTR_NOCHECK(ptr) (ptr)
+  #  define png_strcpy strcpy
++ #  define png_strncpy strncpy   /* Added to v 1.2.6 */
+  #  define png_strlen strlen
+  #  define png_memcmp memcmp     /* SJT: added */
+  #  define png_memcpy memcpy
+*** ./pngerror.c_125	2002-10-03 07:32:27.000000000 -0400
+--- ./pngerror.c	2004-05-06 09:41:28.000000000 -0400
+***************
+*** 137,143 ****
+     {
+        buffer[iout++] = ':';
+        buffer[iout++] = ' ';
+!       png_memcpy(buffer+iout, error_message, 64);
+        buffer[iout+63] = 0;
+     }
+  }
+--- 137,143 ----
+     {
+        buffer[iout++] = ':';
+        buffer[iout++] = ' ';
+!       png_strncpy(buffer+iout, error_message, 63);
+        buffer[iout+63] = 0;
+     }
+  }

package/rene/libpng/4-CAN-2002-1363b.patch

@@ -0,0 +1,24 @@
+--- ./pngrtran.c	Thu Oct  3 06:32:29 2002
++++ ./pngrtran.c	Fri Jul 23 18:51:26 2004
+@@ -1889,8 +1889,8 @@
+          /* This changes the data from GG to GGXX */
+          if (flags & PNG_FLAG_FILLER_AFTER)
+          {
+-            png_bytep sp = row + (png_size_t)row_width;
+-            png_bytep dp = sp  + (png_size_t)row_width;
++            png_bytep sp = row + (png_size_t)row_width * 2;
++            png_bytep dp = sp  + (png_size_t)row_width * 2;
+             for (i = 1; i < row_width; i++)
+             {
+                *(--dp) = hi_filler;
+@@ -1907,8 +1907,8 @@
+          /* This changes the data from GG to XXGG */
+          else
+          {
+-            png_bytep sp = row + (png_size_t)row_width;
+-            png_bytep dp = sp  + (png_size_t)row_width;
++            png_bytep sp = row + (png_size_t)row_width * 2;
++            png_bytep dp = sp  + (png_size_t)row_width * 2;
+             for (i = 0; i < row_width; i++)
+             {
+                *(--dp) = *(--sp);