libpng-1.6.8rc02 is available from
Version 1.6.8rc02 [December 14, 2013]
Handle zero-length PLTE chunk or NULL palette with png_error()
instead of png_chunk_report(), which by default issues a warning
rather than an error, leading to later reading from a NULL pointer
(png_ptr->palette) in png_do_expand_palette().
This bug was reported to mozilla, where a zero-length PLTE chunk
leads to a segfault while expanding the paletted image to RGB. The
bug was introduced in libpng-1.6.1; previously libpng would issue an
error when encountering a zero-length PLTE chunk in an indexed-color
1.6.8rc02 passes my suite of 'make check' tests as well as the tests I run
with Visual Studio. I haven't been able to test with the Intel C Compiler
(the machine on which it is installed hasn't booted since the cold weather
set in) and Raspberry Pi is still running (13 out of 32 configs have
passed, no failures) but everything else including NEON ARM passes.