[ros-diffs] [reactos] 03/03: [LIBPNG] Update to version 1.6.37. CORE-16147

[Thomas Faber]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=d16c9a798a160435121d6…

commit d16c9a798a160435121d603322c7aa64e29e7e2a
Author:     Thomas Faber <thomas.faber(a)reactos.org>
AuthorDate: Thu Jun 27 11:09:58 2019 +0200
Commit:     Thomas Faber <thomas.faber(a)reactos.org>
CommitDate: Thu Jun 27 12:52:12 2019 +0200

    [LIBPNG] Update to version 1.6.37. CORE-16147
---
 dll/3rdparty/libpng/docs/ANNOUNCE            | 66 ++++++++--------------------
 dll/3rdparty/libpng/docs/CHANGES             | 39 ++++++++++------
 dll/3rdparty/libpng/docs/LICENSE             |  8 ++--
 dll/3rdparty/libpng/docs/README              |  4 +-
 dll/3rdparty/libpng/docs/libpng-manual.txt   |  8 ++--
 dll/3rdparty/libpng/png.c                    | 11 +++--
 dll/3rdparty/libpng/pngpriv.h                | 10 ++---
 dll/3rdparty/libpng/pngread.c                |  8 +++-
 dll/3rdparty/libpng/pngrtran.c               | 50 +++++++++++----------
 dll/3rdparty/libpng/pngstruct.h              | 12 ++---
 dll/3rdparty/libpng/pngwrite.c               |  6 +--
 media/doc/3rd Party Files.txt                |  2 +-
 sdk/include/reactos/libs/libpng/png.h        | 34 +++++++-------
 sdk/include/reactos/libs/libpng/pngconf.h    |  6 +--
 sdk/include/reactos/libs/libpng/pnglibconf.h |  4 +-
 15 files changed, 128 insertions(+), 140 deletions(-)

diff --git a/dll/3rdparty/libpng/docs/ANNOUNCE b/dll/3rdparty/libpng/docs/ANNOUNCE
index f1724c0d0d9..ecf9c7043b0 100644
--- a/dll/3rdparty/libpng/docs/ANNOUNCE
+++ b/dll/3rdparty/libpng/docs/ANNOUNCE
@@ -1,5 +1,5 @@
-libpng 1.6.36 - December 1, 2018
-================================
+libpng 1.6.37 - April 14, 2019
+==============================
 
 This is a public release of libpng, intended for use in production code.
 
@@ -9,13 +9,13 @@ Files available for download
 
 Source files with LF line endings (for Unix/Linux):
 
- * libpng-1.6.36.tar.xz (LZMA-compressed, recommended)
- * libpng-1.6.36.tar.gz
+ * libpng-1.6.37.tar.xz (LZMA-compressed, recommended)
+ * libpng-1.6.37.tar.gz
 
 Source files with CRLF line endings (for Windows):
 
- * lp1636.7z (LZMA-compressed, recommended)
- * lp1636.zip
+ * lp1637.7z (LZMA-compressed, recommended)
+ * lp1637.zip
 
 Other information:
 
@@ -25,50 +25,20 @@ Other information:
  * TRADEMARK.md
 
 
-IMPORTANT licensing update: libpng license v2
----------------------------------------------
-
-The new libpng license comprises the terms and conditions from the zlib
-license, and the disclaimer from the Boost license.
-
-The legacy libpng license, used until libpng-1.6.35, is appended to the
-new license, following the precedent established in the Python Software
-Foundation License version 2.
-
-From now on, the list of contributing authors shall be maintained in a
-separate AUTHORS file.  The lists of previous contributing authors,
-mentioned in the legacy libpng license and considered to be an integral
-part of that license, are kept intact, with no further updates.
-
-
-Changes since the previous public release (version 1.6.35)
+Changes since the previous public release (version 1.6.36)
 ----------------------------------------------------------
 
- * Optimized png_do_expand_palette for ARM processors.
-   Improved performance by around 10-22% on a recent ARM Chromebook.
-   (Contributed by Richard Townsend, ARM Holdings)
- * Fixed manipulation of machine-specific optimization options.
-   (Contributed by Vicki Pfau)
- * Used memcpy instead of manual pointer arithmetic on Intel SSE2.
-   (Contributed by Samuel Williams)
- * Fixed build errors with MSVC on ARM64.
-   (Contributed by Zhijie Liang)
- * Fixed detection of libm in CMakeLists.
-   (Contributed by Cameron Cawley)
- * Fixed incorrect creation of pkg-config file in CMakeLists.
-   (Contributed by Kyle Bentley)
- * Fixed the CMake build on Windows MSYS by avoiding symlinks.
- * Fixed a build warning on OpenBSD.
-   (Contributed by Theo Buehler)
- * Fixed various typos in comments.
-   (Contributed by "luz.paz")
- * Raised the minimum required CMake version from 3.0.2 to 3.1.
- * Removed yet more of the vestigial support for pre-ANSI C compilers.
- * Removed ancient makefiles for ancient systems that have been broken
-   across all previous libpng-1.6.x versions.
- * Removed the Y2K compliance statement and the export control
-   information.
- * Applied various code style and documentation fixes.
+ * Fixed a use-after-free vulnerability (CVE-2019-7317) in png_image_free.
+ * Fixed a memory leak in the ARM NEON implementation of png_do_expand_palette.
+ * Fixed a memory leak in pngtest.c.
+ * Fixed two vulnerabilities (CVE-2018-14048, CVE-2018-14550) in
+   contrib/pngminus; refactor.
+ * Changed the license of contrib/pngminus to MIT; refresh makefile and docs.
+   (Contributed by Willem van Schaik)
+ * Fixed a typo in the libpng license v2.
+   (Contributed by Miguel Ojeda)
+ * Added makefiles for AddressSanitizer-enabled builds.
+ * Cleaned up various makefiles.
 
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
diff --git a/dll/3rdparty/libpng/docs/CHANGES b/dll/3rdparty/libpng/docs/CHANGES
index bdd44806549..f0b0a9342c3 100644
--- a/dll/3rdparty/libpng/docs/CHANGES
+++ b/dll/3rdparty/libpng/docs/CHANGES
@@ -6066,31 +6066,44 @@ Version 1.6.35 [July 15, 2018]
 Version 1.6.36 [December 1, 2018]
   Optimized png_do_expand_palette for ARM processors.
   Improved performance by around 10-22% on a recent ARM Chromebook.
-  (Contributed by Richard Townsend, ARM Holdings)
+    (Contributed by Richard Townsend, ARM Holdings)
   Fixed manipulation of machine-specific optimization options.
-  (Contributed by Vicki Pfau)
+    (Contributed by Vicki Pfau)
   Used memcpy instead of manual pointer arithmetic on Intel SSE2.
-  (Contributed by Samuel Williams)
+    (Contributed by Samuel Williams)
   Fixed build errors with MSVC on ARM64.
-  (Contributed by Zhijie Liang)
+    (Contributed by Zhijie Liang)
   Fixed detection of libm in CMakeLists.
-  (Contributed by Cameron Cawley)
+    (Contributed by Cameron Cawley)
   Fixed incorrect creation of pkg-config file in CMakeLists.
-  (Contributed by Kyle Bentley)
+    (Contributed by Kyle Bentley)
   Fixed the CMake build on Windows MSYS by avoiding symlinks.
   Fixed a build warning on OpenBSD.
-  (Contributed by Theo Buehler)
+    (Contributed by Theo Buehler)
   Fixed various typos in comments.
-  (Contributed by "luz.paz")
+    (Contributed by "luz.paz")
   Raised the minimum required CMake version from 3.0.2 to 3.1.
   Removed yet more of the vestigial support for pre-ANSI C compilers.
   Removed ancient makefiles for ancient systems that have been broken
-  across all previous libpng-1.6.x versions.
+    across all previous libpng-1.6.x versions.
   Removed the Y2K compliance statement and the export control
-  information.
+    information.
   Applied various code style and documentation fixes.
 
-Send comments/corrections/commendations to png-mng-implement at lists.sf.net
-(subscription required; visit
+Version 1.6.37 [April 14, 2019]
+  Fixed a use-after-free vulnerability (CVE-2019-7317) in png_image_free.
+  Fixed a memory leak in the ARM NEON implementation of png_do_expand_palette.
+  Fixed a memory leak in pngtest.c.
+  Fixed two vulnerabilities (CVE-2018-14048, CVE-2018-14550) in
+    contrib/pngminus; refactor.
+  Changed the license of contrib/pngminus to MIT; refresh makefile and docs.
+    (Contributed by Willem van Schaik)
+  Fixed a typo in the libpng license v2.
+    (Contributed by Miguel Ojeda)
+  Added makefiles for AddressSanitizer-enabled builds.
+  Cleaned up various makefiles.
+
+Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
+Subscription is required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
-to subscribe).
+to subscribe.
diff --git a/dll/3rdparty/libpng/docs/LICENSE b/dll/3rdparty/libpng/docs/LICENSE
index 62ab8e48dcf..e0c5b531cf5 100644
--- a/dll/3rdparty/libpng/docs/LICENSE
+++ b/dll/3rdparty/libpng/docs/LICENSE
@@ -4,8 +4,8 @@ COPYRIGHT NOTICE, DISCLAIMER, and LICENSE
 PNG Reference Library License version 2
 ---------------------------------------
 
- * Copyright (c) 1995-2018 The PNG Reference Library Authors.
- * Copyright (c) 2018 Cosmin Truta.
+ * Copyright (c) 1995-2019 The PNG Reference Library Authors.
+ * Copyright (c) 2018-2019 Cosmin Truta.
  * Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson.
  * Copyright (c) 1996-1997 Andreas Dilger.
  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -13,7 +13,7 @@ PNG Reference Library License version 2
 The software is supplied "as is", without warranty of any kind,
 express or implied, including, without limitation, the warranties
 of merchantability, fitness for a particular purpose, title, and
-non-infringement.  In no even shall the Copyright owners, or
+non-infringement.  In no event shall the Copyright owners, or
 anyone distributing the software, be liable for any damages or
 other liability, whether in contract, tort or otherwise, arising
 from, out of, or in connection with the software, or the use or
@@ -39,7 +39,7 @@ subject to the following restrictions:
 PNG Reference Library License version 1 (for libpng 0.5 through 1.6.35)
 -----------------------------------------------------------------------
 
-libpng versions 1.0.7, July 1, 2000 through 1.6.35, July 15, 2018 are
+libpng versions 1.0.7, July 1, 2000, through 1.6.35, July 15, 2018 are
 Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
diff --git a/dll/3rdparty/libpng/docs/README b/dll/3rdparty/libpng/docs/README
index e41e0f549bb..cfc1f0e3dc9 100644
--- a/dll/3rdparty/libpng/docs/README
+++ b/dll/3rdparty/libpng/docs/README
@@ -1,5 +1,5 @@
-README for libpng version 1.6.36 - December 1, 2018
-===================================================
+README for libpng version 1.6.37 - April 14, 2019
+=================================================
 
 See the note about version numbers near the top of png.h.
 See INSTALL for instructions on how to install libpng.
diff --git a/dll/3rdparty/libpng/docs/libpng-manual.txt
b/dll/3rdparty/libpng/docs/libpng-manual.txt
index 19cfed28add..5dad92fbf74 100644
--- a/dll/3rdparty/libpng/docs/libpng-manual.txt
+++ b/dll/3rdparty/libpng/docs/libpng-manual.txt
@@ -1,6 +1,6 @@
 libpng-manual.txt - A description on how to use and modify libpng
 
- Copyright (c) 2018 Cosmin Truta
+ Copyright (c) 2018-2019 Cosmin Truta
  Copyright (c) 1998-2018 Glenn Randers-Pehrson
 
  This document is released under the libpng license.
@@ -9,11 +9,11 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng version 1.6.36 - December 1, 2018
+ libpng version 1.6.36, December 2018, through 1.6.37 - April 2019
  Updated and distributed by Cosmin Truta
- Copyright (c) 2018 Cosmin Truta
+ Copyright (c) 2018-2019 Cosmin Truta
 
- libpng versions 0.97, January 1998, through 1.6.35 - July 15, 2018
+ libpng versions 0.97, January 1998, through 1.6.35 - July 2018
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2018 Glenn Randers-Pehrson
 
diff --git a/dll/3rdparty/libpng/png.c b/dll/3rdparty/libpng/png.c
index 3dce191d17e..757c755f97c 100644
--- a/dll/3rdparty/libpng/png.c
+++ b/dll/3rdparty/libpng/png.c
@@ -1,7 +1,7 @@
 
 /* png.c - location for general purpose libpng functions
  *
- * Copyright (c) 2018 Cosmin Truta
+ * Copyright (c) 2018-2019 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * Copyright (c) 1996-1997 Andreas Dilger
  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -14,7 +14,7 @@
 #include "pngpriv.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef png_libpng_version_1_6_36 Your_png_h_is_not_version_1_6_36;
+typedef png_libpng_version_1_6_37 Your_png_h_is_not_version_1_6_37;
 
 #ifdef __GNUC__
 /* The version tests may need to be added to, but the problem warning has
@@ -815,8 +815,8 @@ png_get_copyright(png_const_structrp png_ptr)
    return PNG_STRING_COPYRIGHT
 #else
    return PNG_STRING_NEWLINE \
-      "libpng version 1.6.36" PNG_STRING_NEWLINE \
-      "Copyright (c) 2018 Cosmin Truta" PNG_STRING_NEWLINE \
+      "libpng version 1.6.37" PNG_STRING_NEWLINE \
+      "Copyright (c) 2018-2019 Cosmin Truta" PNG_STRING_NEWLINE \
       "Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson" \
       PNG_STRING_NEWLINE \
       "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
@@ -4588,8 +4588,7 @@ png_image_free(png_imagep image)
    if (image != NULL && image->opaque != NULL &&
       image->opaque->error_buf == NULL)
    {
-      /* Ignore errors here: */
-      (void)png_safe_execute(image, png_image_free_function, image);
+      png_image_free_function(image);
       image->opaque = NULL;
    }
 }
diff --git a/dll/3rdparty/libpng/pngpriv.h b/dll/3rdparty/libpng/pngpriv.h
index 973c3eac1f9..583c26f9bde 100644
--- a/dll/3rdparty/libpng/pngpriv.h
+++ b/dll/3rdparty/libpng/pngpriv.h
@@ -1,7 +1,7 @@
 
 /* pngpriv.h - private declarations for use inside libpng
  *
- * Copyright (c) 2018 Cosmin Truta
+ * Copyright (c) 2018-2019 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * Copyright (c) 1996-1997 Andreas Dilger
  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -2119,11 +2119,11 @@ PNG_INTERNAL_FUNCTION(png_uint_32, png_check_keyword,
(png_structrp png_ptr,
 
 #if PNG_ARM_NEON_IMPLEMENTATION == 1
 PNG_INTERNAL_FUNCTION(void,
-                      png_riffle_palette_rgba,
-                      (png_structrp, png_row_infop),
+                      png_riffle_palette_neon,
+                      (png_structrp),
                       PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(int,
-                      png_do_expand_palette_neon_rgba,
+                      png_do_expand_palette_rgba8_neon,
                       (png_structrp,
                        png_row_infop,
                        png_const_bytep,
@@ -2131,7 +2131,7 @@ PNG_INTERNAL_FUNCTION(int,
                        const png_bytepp),
                       PNG_EMPTY);
 PNG_INTERNAL_FUNCTION(int,
-                      png_do_expand_palette_neon_rgb,
+                      png_do_expand_palette_rgb8_neon,
                       (png_structrp,
                        png_row_infop,
                        png_const_bytep,
diff --git a/dll/3rdparty/libpng/pngread.c b/dll/3rdparty/libpng/pngread.c
index f8e762196eb..8fa7d9f1628 100644
--- a/dll/3rdparty/libpng/pngread.c
+++ b/dll/3rdparty/libpng/pngread.c
@@ -1,7 +1,7 @@
 
 /* pngread.c - read a PNG file
  *
- * Copyright (c) 2018 Cosmin Truta
+ * Copyright (c) 2018-2019 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * Copyright (c) 1996-1997 Andreas Dilger
  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -994,6 +994,12 @@ png_read_destroy(png_structrp png_ptr)
    png_ptr->chunk_list = NULL;
 #endif
 
+#if defined(PNG_READ_EXPAND_SUPPORTED) && \
+    defined(PNG_ARM_NEON_IMPLEMENTATION)
+   png_free(png_ptr, png_ptr->riffled_palette);
+   png_ptr->riffled_palette = NULL;
+#endif
+
    /* NOTE: the 'setjmp' buffer may still be allocated and the memory and error
     * callbacks are still set at this point.  They are required to complete the
     * destruction of the png_struct itself.
diff --git a/dll/3rdparty/libpng/pngrtran.c b/dll/3rdparty/libpng/pngrtran.c
index ccc58ce6f1d..9a8fad9f4aa 100644
--- a/dll/3rdparty/libpng/pngrtran.c
+++ b/dll/3rdparty/libpng/pngrtran.c
@@ -1,7 +1,7 @@
 
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
- * Copyright (c) 2018 Cosmin Truta
+ * Copyright (c) 2018-2019 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * Copyright (c) 1996-1997 Andreas Dilger
  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -1182,20 +1182,20 @@ png_init_palette_transformations(png_structrp png_ptr)
              png_ptr->palette[png_ptr->background.index].blue;
 
 #ifdef PNG_READ_INVERT_ALPHA_SUPPORTED
-        if ((png_ptr->transformations & PNG_INVERT_ALPHA) != 0)
-        {
-           if ((png_ptr->transformations & PNG_EXPAND_tRNS) == 0)
-           {
-              /* Invert the alpha channel (in tRNS) unless the pixels are
-               * going to be expanded, in which case leave it for later
-               */
-              int i, istop = png_ptr->num_trans;
-
-              for (i=0; i<istop; i++)
-                 png_ptr->trans_alpha[i] = (png_byte)(255 -
-                    png_ptr->trans_alpha[i]);
-           }
-        }
+         if ((png_ptr->transformations & PNG_INVERT_ALPHA) != 0)
+         {
+            if ((png_ptr->transformations & PNG_EXPAND_tRNS) == 0)
+            {
+               /* Invert the alpha channel (in tRNS) unless the pixels are
+                * going to be expanded, in which case leave it for later
+                */
+               int i, istop = png_ptr->num_trans;
+
+               for (i = 0; i < istop; i++)
+                  png_ptr->trans_alpha[i] =
+                      (png_byte)(255 - png_ptr->trans_alpha[i]);
+            }
+         }
 #endif /* READ_INVERT_ALPHA */
       }
    } /* background expand and (therefore) no alpha association. */
@@ -4320,9 +4320,11 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop
row_info,
                    * but sometimes row_info->bit_depth has been changed to 8.
                    * In these cases, the palette hasn't been riffled.
                    */
-                  i = png_do_expand_palette_neon_rgba(png_ptr, row_info, row,
+                  i = png_do_expand_palette_rgba8_neon(png_ptr, row_info, row,
                       &sp, &dp);
                }
+#else
+               PNG_UNUSED(png_ptr)
 #endif
 
                for (; i < row_width; i++)
@@ -4349,8 +4351,10 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop
row_info,
                dp = row + (size_t)(row_width * 3) - 1;
                i = 0;
 #ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE
-               i = png_do_expand_palette_neon_rgb(png_ptr, row_info, row,
+               i = png_do_expand_palette_rgb8_neon(png_ptr, row_info, row,
                    &sp, &dp);
+#else
+               PNG_UNUSED(png_ptr)
 #endif
 
                for (; i < row_width; i++)
@@ -4770,19 +4774,17 @@ png_do_read_transformations(png_structrp png_ptr, png_row_infop
row_info)
 #ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE
          if ((png_ptr->num_trans > 0) && (png_ptr->bit_depth == 8))
          {
-            /* Allocate space for the decompressed full palette. */
             if (png_ptr->riffled_palette == NULL)
             {
-               png_ptr->riffled_palette = png_malloc(png_ptr, 256*4);
-               if (png_ptr->riffled_palette == NULL)
-                  png_error(png_ptr, "NULL row buffer");
-               /* Build the RGBA palette. */
-               png_riffle_palette_rgba(png_ptr, row_info);
+               /* Initialize the accelerated palette expansion. */
+               png_ptr->riffled_palette =
+                   (png_bytep)png_malloc(png_ptr, 256 * 4);
+               png_riffle_palette_neon(png_ptr);
             }
          }
 #endif
          png_do_expand_palette(png_ptr, row_info, png_ptr->row_buf + 1,
-            png_ptr->palette, png_ptr->trans_alpha, png_ptr->num_trans);
+             png_ptr->palette, png_ptr->trans_alpha, png_ptr->num_trans);
       }
 
       else
diff --git a/dll/3rdparty/libpng/pngstruct.h b/dll/3rdparty/libpng/pngstruct.h
index 94a6d041fff..8bdc7ce46db 100644
--- a/dll/3rdparty/libpng/pngstruct.h
+++ b/dll/3rdparty/libpng/pngstruct.h
@@ -1,7 +1,7 @@
 
 /* pngstruct.h - header file for PNG reference library
  *
- * Copyright (c) 2018 Cosmin Truta
+ * Copyright (c) 2018-2019 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * Copyright (c) 1996-1997 Andreas Dilger
  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -228,10 +228,6 @@ struct png_struct_def
                                * big_row_buf; while writing it is separately
                                * allocated.
                                */
-#ifdef PNG_READ_EXPAND_SUPPORTED
-   /* Buffer to accelerate palette transformations. */
-   png_bytep riffled_palette;
-#endif
 #ifdef PNG_WRITE_FILTER_SUPPORTED
    png_bytep try_row;    /* buffer to save trial row when filtering */
    png_bytep tst_row;    /* buffer to save best trial row when filtering */
@@ -396,6 +392,12 @@ struct png_struct_def
    /* deleted in 1.5.5: rgb_to_gray_blue_coeff; */
 #endif
 
+/* New member added in libpng-1.6.36 */
+#if defined(PNG_READ_EXPAND_SUPPORTED) && \
+    defined(PNG_ARM_NEON_IMPLEMENTATION)
+   png_bytep riffled_palette; /* buffer for accelerated palette expansion */
+#endif
+
 /* New member added in libpng-1.0.4 (renamed in 1.0.9) */
 #if defined(PNG_MNG_FEATURES_SUPPORTED)
 /* Changed from png_byte to png_uint_32 at version 1.2.0 */
diff --git a/dll/3rdparty/libpng/pngwrite.c b/dll/3rdparty/libpng/pngwrite.c
index 160c877d385..59377a4ddea 100644
--- a/dll/3rdparty/libpng/pngwrite.c
+++ b/dll/3rdparty/libpng/pngwrite.c
@@ -1,7 +1,7 @@
 
 /* pngwrite.c - general routines to write a PNG file
  *
- * Copyright (c) 2018 Cosmin Truta
+ * Copyright (c) 2018-2019 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * Copyright (c) 1996-1997 Andreas Dilger
  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -948,10 +948,6 @@ png_write_destroy(png_structrp png_ptr)
    png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list);
    png_free(png_ptr, png_ptr->row_buf);
    png_ptr->row_buf = NULL;
-#ifdef PNG_READ_EXPANDED_SUPPORTED
-   png_free(png_ptr, png_ptr->riffled_palette);
-   png_ptr->riffled_palette = NULL;
-#endif
 #ifdef PNG_WRITE_FILTER_SUPPORTED
    png_free(png_ptr, png_ptr->prev_row);
    png_free(png_ptr, png_ptr->try_row);
diff --git a/media/doc/3rd Party Files.txt b/media/doc/3rd Party Files.txt
index 1f51414a5c0..26274a45ebd 100644
--- a/media/doc/3rd Party Files.txt	
+++ b/media/doc/3rd Party Files.txt	
@@ -91,7 +91,7 @@ Used Version: 2.7.11
 Website: https://tls.mbed.org/
 
 Title: libpng
-Used Version: 1.6.36
+Used Version: 1.6.37
 Website: http://libpng.sourceforge.net/
 
 Title: ACPICA
diff --git a/sdk/include/reactos/libs/libpng/png.h
b/sdk/include/reactos/libs/libpng/png.h
index 8e272a05532..139eb0dc0f3 100644
--- a/sdk/include/reactos/libs/libpng/png.h
+++ b/sdk/include/reactos/libs/libpng/png.h
@@ -1,9 +1,9 @@
 
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.6.36 - December 1, 2018
+ * libpng version 1.6.37 - April 14, 2019
  *
- * Copyright (c) 2018 Cosmin Truta
+ * Copyright (c) 2018-2019 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
  * Copyright (c) 1996-1997 Andreas Dilger
  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -14,8 +14,9 @@
  *   libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
  *   libpng versions 0.97, January 1998, through 1.6.35, July 2018:
- *     Glenn Randers-Pehrson.
- *   libpng version 1.6.36, December 1, 2018: Cosmin Truta
+ *     Glenn Randers-Pehrson
+ *   libpng versions 1.6.36, December 2018, through 1.6.37, April 2019:
+ *     Cosmin Truta
  *   See also "Contributing Authors", below.
  */
 
@@ -26,8 +27,8 @@
  * PNG Reference Library License version 2
  * ---------------------------------------
  *
- *  * Copyright (c) 1995-2018 The PNG Reference Library Authors.
- *  * Copyright (c) 2018 Cosmin Truta.
+ *  * Copyright (c) 1995-2019 The PNG Reference Library Authors.
+ *  * Copyright (c) 2018-2019 Cosmin Truta.
  *  * Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson.
  *  * Copyright (c) 1996-1997 Andreas Dilger.
  *  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -35,7 +36,7 @@
  * The software is supplied "as is", without warranty of any kind,
  * express or implied, including, without limitation, the warranties
  * of merchantability, fitness for a particular purpose, title, and
- * non-infringement.  In no even shall the Copyright owners, or
+ * non-infringement.  In no event shall the Copyright owners, or
  * anyone distributing the software, be liable for any damages or
  * other liability, whether in contract, tort or otherwise, arising
  * from, out of, or in connection with the software, or the use or
@@ -61,7 +62,7 @@
  * PNG Reference Library License version 1 (for libpng 0.5 through 1.6.35)
  * -----------------------------------------------------------------------
  *
- * libpng versions 1.0.7, July 1, 2000 through 1.6.35, July 15, 2018 are
+ * libpng versions 1.0.7, July 1, 2000, through 1.6.35, July 15, 2018 are
  * Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson, are
  * derived from libpng-1.0.6, and are distributed according to the same
  * disclaimer and license as libpng-1.0.6 with the following individuals
@@ -238,7 +239,7 @@
  *    ...
  *    1.5.30                  15    10530  15.so.15.30[.0]
  *    ...
- *    1.6.36                  16    10636  16.so.16.36[.0]
+ *    1.6.37                  16    10637  16.so.16.37[.0]
  *
  *    Henceforth the source version will match the shared-library major and
  *    minor numbers; the shared-library major version number will be used for
@@ -277,8 +278,8 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.6.36"
-#define PNG_HEADER_VERSION_STRING " libpng version 1.6.36 - December 1,
2018\n"
+#define PNG_LIBPNG_VER_STRING "1.6.37"
+#define PNG_HEADER_VERSION_STRING " libpng version 1.6.37 - April 14, 2019\n"
 
 #define PNG_LIBPNG_VER_SONUM   16
 #define PNG_LIBPNG_VER_DLLNUM  16
@@ -286,12 +287,11 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   6
-#define PNG_LIBPNG_VER_RELEASE 36
+#define PNG_LIBPNG_VER_RELEASE 37
 
-/* This should match the numeric part of the final component of
- * PNG_LIBPNG_VER_STRING, omitting any leading zero:
+/* This should be zero for a public release, or non-zero for a
+ * development version.  [Deprecated]
  */
-
 #define PNG_LIBPNG_VER_BUILD  0
 
 /* Release Status */
@@ -318,7 +318,7 @@
  * From version 1.0.1 it is:
  * XXYYZZ, where XX=major, YY=minor, ZZ=release
  */
-#define PNG_LIBPNG_VER 10636 /* 1.6.36 */
+#define PNG_LIBPNG_VER 10637 /* 1.6.37 */
 
 /* Library configuration: these options cannot be changed after
  * the library has been built.
@@ -428,7 +428,7 @@ extern "C" {
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef char* png_libpng_version_1_6_36;
+typedef char* png_libpng_version_1_6_37;
 
 /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
  *
diff --git a/sdk/include/reactos/libs/libpng/pngconf.h
b/sdk/include/reactos/libs/libpng/pngconf.h
index 5e641b25098..927a769dbee 100644
--- a/sdk/include/reactos/libs/libpng/pngconf.h
+++ b/sdk/include/reactos/libs/libpng/pngconf.h
@@ -1,9 +1,9 @@
 
-/* pngconf.h - machine configurable file for libpng
+/* pngconf.h - machine-configurable file for libpng
  *
- * libpng version 1.6.36
+ * libpng version 1.6.37
  *
- * Copyright (c) 2018 Cosmin Truta
+ * Copyright (c) 2018-2019 Cosmin Truta
  * Copyright (c) 1998-2002,2004,2006-2016,2018 Glenn Randers-Pehrson
  * Copyright (c) 1996-1997 Andreas Dilger
  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
diff --git a/sdk/include/reactos/libs/libpng/pnglibconf.h
b/sdk/include/reactos/libs/libpng/pnglibconf.h
index 00340c678be..e1e27e957ea 100644
--- a/sdk/include/reactos/libs/libpng/pnglibconf.h
+++ b/sdk/include/reactos/libs/libpng/pnglibconf.h
@@ -1,8 +1,8 @@
 /* pnglibconf.h - library build configuration */
 
-/* libpng version 1.6.36 */
+/* libpng version 1.6.37 */
 
-/* Copyright (c) 2018 Cosmin Truta */
+/* Copyright (c) 2018-2019 Cosmin Truta */
 /* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson */
 
 /* This code is released under the libpng license. */