LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*

...