Index: abi/src/af/util/xp/ut_iconv.cpp
--- abi/src/af/util/xp/ut_iconv.cpp.orig	2003-12-28 12:24:14.000000000 +0100
+++ abi/src/af/util/xp/ut_iconv.cpp	2003-12-28 12:31:24.000000000 +0100
@@ -67,7 +68,7 @@
 #if defined (WIN32) || defined(__QNXNTO__) || defined(__CYGWIN__) ||  \
 (defined (__MACH__) && defined (__APPLE__)) || \
 (defined(TARGET_OS_MAC) && TARGET_OS_MAC) || \
-defined(__BEOS__) || defined (__AIX__) || \
+defined(__BEOS__) || defined (__AIX__) || defined(__FreeBSD__) || \
 (defined(__linux__) && defined(__powerpc__) && (__GLIBC__ <= 2) && (__GLIBC_MINOR__ <= 1))
 
 #define ICONV_CONST const

Index: libpng/pngrtran.c
--- libpng/pngrtran.c.orig	Wed Oct  2 20:20:24 2002
+++ libpng/pngrtran.c	Wed Jan 15 11:30:23 2003
@@ -1965,8 +1965,8 @@
          /* This changes the data from RRGGBB to RRGGBBXX */
          if (flags & PNG_FLAG_FILLER_AFTER)
          {
-            png_bytep sp = row + (png_size_t)row_width * 3;
-            png_bytep dp = sp  + (png_size_t)row_width;
+            png_bytep sp = row + (png_size_t)row_width * 6;
+            png_bytep dp = sp  + (png_size_t)row_width * 2;
             for (i = 1; i < row_width; i++)
             {
                *(--dp) = hi_filler;
@@ -1987,8 +1987,8 @@
          /* This changes the data from RRGGBB to XXRRGGBB */
          else
          {
-            png_bytep sp = row + (png_size_t)row_width * 3;
-            png_bytep dp = sp  + (png_size_t)row_width;
+            png_bytep sp = row + (png_size_t)row_width * 6;
+            png_bytep dp = sp  + (png_size_t)row_width * 2;
             for (i = 0; i < row_width; i++)
             {
                *(--dp) = *(--sp);

Steve G <linux_4ever@yahoo.com>
Libpng accesses memory that is out of bounds when creating an error message

Index: pngerror.c
--- libpng/pngerror.c.orig	2002-10-03 13:32:27.000000000 +0200
+++ libpng/pngerror.c	2004-04-28 13:24:22.000000000 +0200
@@ -135,10 +135,13 @@
       buffer[iout] = 0;
    else
    {
+      png_size_t len;
+      if ((len = png_strlen(error_message)) > 63)
+          len = 63;
       buffer[iout++] = ':';
       buffer[iout++] = ' ';
-      png_memcpy(buffer+iout, error_message, 64);
-      buffer[iout+63] = 0;
+      png_memcpy(buffer+iout, error_message, len);
+      buffer[iout+len] = 0;
    }
 }