LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

...