diff -ruN libpng-1.2.21/png.h libpng-1.2.22beta3/png.h
--- libpng-1.2.21/png.h	2007-10-06 17:49:08.142842000 -0500
+++ libpng-1.2.22beta3/png.h	2007-10-06 17:46:16.739373000 -0500
@@ -164,6 +164,7 @@
  *    1.2.21rc1-3             13    10221  12.so.0.21[.0]
  *    1.0.29                  10    10029  10.so.0.29[.0]
  *    1.2.21                  13    10221  12.so.0.21[.0]
+ *    1.2.22beta1-3           13    10222  12.so.0.22[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
diff -ruN libpng-1.2.21/pngconf.h libpng-1.2.22beta3/pngconf.h
--- libpng-1.2.21/pngconf.h	2007-10-06 17:18:11.651376000 -0500
+++ libpng-1.2.22beta3/pngconf.h	2007-10-06 17:46:16.814293000 -0500
@@ -77,7 +77,10 @@
 
 /* Added at libpng-1.2.19, removed at libpng-1.2.20 because it caused trouble
    Restored at libpng-1.2.21 */
-#    define PNG_WARN_UNINITIALIZED_ROW 1
+#if !defined(PNG_NO_WARN_UNINITIALIZED_ROW) && \
+    !defined(PNG_WARN_UNINITIALIZED_ROW)
+#  define PNG_WARN_UNINITIALIZED_ROW 1
+#endif
 /* End of material added at libpng-1.2.19/1.2.21 */
 
 /* This is the size of the compression buffer, and thus the size of
diff -ruN libpng-1.2.21/pngpread.c libpng-1.2.22beta3/pngpread.c
--- libpng-1.2.21/pngpread.c	2007-10-06 17:18:11.905361000 -0500
+++ libpng-1.2.22beta3/pngpread.c	2007-10-06 17:46:17.053258000 -0500
@@ -1491,7 +1491,8 @@
       }
 #endif
       png_strncpy((png_charp)png_ptr->unknown_chunk.name,
-	 (png_charp)png_ptr->chunk_name, 5);
+	 (png_charp)png_ptr->chunk_name, 4);
+      png_ptr->chunk_name[4]=0;
       png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length);
       png_ptr->unknown_chunk.size = (png_size_t)length;
       png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
diff -ruN libpng-1.2.21/pngrtran.c libpng-1.2.22beta3/pngrtran.c
--- libpng-1.2.21/pngrtran.c	2007-10-06 17:34:20.344574000 -0500
+++ libpng-1.2.22beta3/pngrtran.c	2007-10-06 17:46:17.283742000 -0500
@@ -578,7 +578,6 @@
    if(png_ptr == NULL) return;
    png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
 #ifdef PNG_WARN_UNINITIALIZED_ROW
-   png_ptr->flags &= !(PNG_FLAG_ROW_INIT);
    png_ptr->flags &= ~PNG_FLAG_ROW_INIT;
 #endif
 }
@@ -858,7 +857,7 @@
         k=1; /* partial transparency is present */
     }
     if (k == 0)
-      png_ptr->transformations &= ~(PNG_GAMMA);
+      png_ptr->transformations &= ~PNG_GAMMA;
    }
 
    if ((png_ptr->transformations & (PNG_GAMMA | PNG_RGB_TO_GRAY)) &&
diff -ruN libpng-1.2.21/pngrutil.c libpng-1.2.22beta3/pngrutil.c
--- libpng-1.2.21/pngrutil.c	2007-10-06 17:18:12.262096000 -0500
+++ libpng-1.2.22beta3/pngrutil.c	2007-10-06 17:46:17.400359000 -0500
@@ -2224,7 +2224,8 @@
        }
 #endif
        png_strncpy((png_charp)png_ptr->unknown_chunk.name,
-	 (png_charp)png_ptr->chunk_name, 5);
+	 (png_charp)png_ptr->chunk_name, 4);
+       png_ptr->unknown_chunk.name[4]=0;
        png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length);
        png_ptr->unknown_chunk.size = (png_size_t)length;
        png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
diff -ruN libpng-1.2.21/pngset.c libpng-1.2.22beta3/pngset.c
--- libpng-1.2.21/pngset.c	2007-10-06 17:18:12.325123000 -0500
+++ libpng-1.2.22beta3/pngset.c	2007-10-06 17:46:17.455707000 -0500
@@ -690,7 +690,8 @@
       png_warning(png_ptr, "Insufficient memory to process iCCP chunk.");
       return;
    }
-   png_strncpy(new_iccp_name, name, png_strlen(new_iccp_name)+1);
+   png_strncpy(new_iccp_name, name, png_strlen(name));
+   new_iccp_name[png_strlen(name)]=0;
    new_iccp_profile = (png_charp)png_malloc_warn(png_ptr, proflen);
    if (new_iccp_profile == NULL)
    {
@@ -980,7 +981,8 @@
              "Out of memory while processing sPLT chunk");
         }
         /* TODO: use png_malloc_warn */
-        png_strncpy(to->name, from->name, png_strlen(from->name)+1);
+        png_strncpy(to->name, from->name, png_strlen(from->name));
+        to->name[png_strlen(from->name)]=0;
         to->entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
             from->nentries * png_sizeof(png_sPLT_entry));
         /* TODO: use png_malloc_warn */
@@ -1037,7 +1039,8 @@
         png_unknown_chunkp to = np + info_ptr->unknown_chunks_num + i;
         png_unknown_chunkp from = unknowns + i;
 
-        png_strncpy((png_charp)to->name, (png_charp)from->name, 5);
+        png_strncpy((png_charp)to->name, (png_charp)from->name, 4);
+        to->name[4]=0;
         to->data = (png_bytep)png_malloc_warn(png_ptr, from->size);
         if (to->data == NULL)
         {
diff -ruN libpng-1.2.21/pngtest.c libpng-1.2.22beta3/pngtest.c
--- libpng-1.2.21/pngtest.c	2007-10-06 17:18:12.384848000 -0500
+++ libpng-1.2.22beta3/pngtest.c	2007-10-06 17:46:17.516286000 -0500
@@ -1006,7 +1006,8 @@
             pointed to by png_convert_to_rfc1123() gets free'ed before
             we use it */
          png_strncpy(tIME_string,png_convert_to_rfc1123(read_ptr,
-            mod_time),30);
+            mod_time),29);
+         tIME_string[29]=0;
          tIME_chunk_present++;
 #endif /* PNG_TIME_RFC1123_SUPPORTED */
       }
@@ -1147,7 +1148,8 @@
             pointed to by png_convert_to_rfc1123() gets free'ed before
             we use it */
          png_strncpy(tIME_string,png_convert_to_rfc1123(read_ptr,
-            mod_time),30);
+            mod_time),29);
+         tIME_string[29]=0;
          tIME_chunk_present++;
 #endif /* PNG_TIME_RFC1123_SUPPORTED */
       }