Index: config.tests/x11/xfreetype.test
--- config.tests/x11/xfreetype.test.orig	2004-08-09 22:16:57 +0200
+++ config.tests/x11/xfreetype.test	2006-03-15 21:01:02 +0100
@@ -56,7 +56,7 @@
     XFT=no
     [ "$VERBOSE" = "yes" ] && echo "  Could not find Xft lib anywhere in $LIBDIRS"
 fi
-LIBXFT="-l$F -lfreetype"
+LIBXFT="-l$F -lfontconfig -lexpat -lfreetype"
 
 # check for X11/Xft/Xft.h
 XFT_H=
@@ -90,7 +90,7 @@
     [ "$VERBOSE" = "yes" ] && echo "  Found Xft version $XFT_MAJOR.$XFT_MINOR.$XFT_REVISION"
     if [ "$XFT_MAJOR" = "2" ]; then
         XFT2=yes
-	LIBXFT="$LIBXFT -lfontconfig"
+	LIBXFT="$LIBXFT"
     fi
 fi
 
Index: configure
--- configure.orig	2006-03-08 13:11:24 +0100
+++ configure	2006-03-15 21:01:02 +0100
@@ -1788,21 +1788,6 @@
 	    CFG_FREETYPE=yes
 	fi
     fi
-    # add freetype2 include path
-    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.inc ];then
-	QMAKE_VARS="$QMAKE_VARS \"INCLUDEPATH+=`cat $outpath/config.tests/x11/xft.inc`\""
-    fi
-    rm -f $outpath/config.tests/x11/xft.inc
-    # add Xft specific libraries
-    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.lib ]; then
-	QMAKE_VARS="$QMAKE_VARS \"QMAKE_LIBS_X11=`cat $outpath/config.tests/x11/xft.lib` \$\$QMAKE_LIBS_X11\""
-    fi
-    rm -f $outpath/config.tests/x11/xft.lib
-    # add Xft specific config options
-    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.cfg ]; then
-	QMAKE_CONFIG="$QMAKE_CONFIG `cat $outpath/config.tests/x11/xft.cfg`"
-    fi
-    rm -f $outpath/config.tests/x11/xft.cfg
     # auto-detect Session Management support
     if [ "$CFG_SM" = "auto" ]; then
 	if $x11tests/sm.test $XQMAKESPEC $OPT_VERBOSE $L_FLAGS $I_FLAGS; then
@@ -2981,6 +2966,21 @@
     if [ "$CFG_XKB" = "yes" ]; then
         QMAKE_CONFIG="$QMAKE_CONFIG xkb"
     fi
+    # add freetype2 include path
+    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.inc ];then
+	QMAKE_VARS="$QMAKE_VARS \"INCLUDEPATH+=`cat $outpath/config.tests/x11/xft.inc`\""
+    fi
+    rm -f $outpath/config.tests/x11/xft.inc
+    # add Xft specific libraries
+    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.lib ]; then
+	QMAKE_VARS="$QMAKE_VARS \"QMAKE_LIBS_X11=`cat $outpath/config.tests/x11/xft.lib` \$\$QMAKE_LIBS_X11\""
+    fi
+    rm -f $outpath/config.tests/x11/xft.lib
+    # add Xft specific config options
+    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.cfg ]; then
+	QMAKE_CONFIG="$QMAKE_CONFIG `cat $outpath/config.tests/x11/xft.cfg`"
+    fi
+    rm -f $outpath/config.tests/x11/xft.cfg
 elif [ "$PLATFORM_MAC" = "yes" ]; then
     if [ "$CFG_TABLET" = "yes" ]; then
 	QMAKE_CONFIG="$QMAKE_CONFIG tablet"
Index: src/3rdparty/libpng/png.h
--- src/3rdparty/libpng/png.h.orig	2004-09-03 20:17:23 +0200
+++ src/3rdparty/libpng/png.h	2006-03-15 21:01:02 +0100
@@ -839,6 +839,9 @@
 /* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */
 #define PNG_MAX_UINT PNG_UINT_31_MAX
 
+/* Constraints on width, height, (2 ^ 24) - 1*/
+#define PNG_MAX_DIMENSION 16777215
+
 /* These describe the color_type field in png_info. */
 /* color type masks */
 #define PNG_COLOR_MASK_PALETTE    1
Index: src/3rdparty/libpng/pngconf.h
--- src/3rdparty/libpng/pngconf.h.orig	2004-09-03 20:37:07 +0200
+++ src/3rdparty/libpng/pngconf.h	2006-03-15 21:01:02 +0100
@@ -251,10 +251,6 @@
 #      define PNG_SAVE_BSD_SOURCE
 #      undef _BSD_SOURCE
 #    endif
-#    ifdef _SETJMP_H
-      __png.h__ already includes setjmp.h;
-      __dont__ include it again.;
-#    endif
 #  endif /* __linux__ */
 
    /* include setjmp.h for error handling */
Index: src/3rdparty/libpng/pngerror.c
--- src/3rdparty/libpng/pngerror.c.orig	2004-09-03 20:06:36 +0200
+++ src/3rdparty/libpng/pngerror.c	2006-03-15 21:01:02 +0100
@@ -135,10 +135,13 @@
       buffer[iout] = 0;
    else
    {
+      png_size_t len;
+      if ((len = png_strlen(error_message)) > 63)
+          len = 63;
       buffer[iout++] = ':';
       buffer[iout++] = ' ';
-      png_strncpy(buffer+iout, error_message, 63);
-      buffer[iout+63] = 0;
+      png_strncpy(buffer+iout, error_message, len);
+      buffer[iout+len] = 0;
    }
 }
 
Index: src/3rdparty/libpng/pngrutil.c
--- src/3rdparty/libpng/pngrutil.c.orig	2004-09-03 20:34:00 +0200
+++ src/3rdparty/libpng/pngrutil.c	2006-03-15 21:01:03 +0100
@@ -355,7 +355,11 @@
    png_crc_finish(png_ptr, 0);
 
    width = png_get_uint_32(buf);
+   if (width > PNG_MAX_DIMENSION)
+      png_error(png_ptr, "Width is too large");
    height = png_get_uint_32(buf + 4);
+   if (height > PNG_MAX_DIMENSION)
+      png_error(png_ptr, "Height is too large");
    bit_depth = buf[8];
    color_type = buf[9];
    compression_type = buf[10];
@@ -680,7 +684,7 @@
    else
       truelen = (png_size_t)png_ptr->channels;
 
-   if (length != truelen)
+   if (length != truelen || length > 4)
    {
       png_warning(png_ptr, "Incorrect sBIT chunk length");
       png_crc_finish(png_ptr, length);
@@ -1415,7 +1419,7 @@
 void /* PRIVATE */
 png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
-   int num, i;
+   unsigned int num, i;
    png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
 
    png_debug(1, "in png_handle_hIST\n");
@@ -1441,8 +1445,8 @@
       return;
    }
 
-   num = (int)length / 2 ;
-   if (num != png_ptr->num_palette)
+   num = length / 2 ;
+   if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH)
    {
       png_warning(png_ptr, "Incorrect hIST chunk length");
       png_crc_finish(png_ptr, length);
@@ -2883,6 +2887,9 @@
                png_read_data(png_ptr, chunk_length, 4);
                png_ptr->idat_size = png_get_uint_32(chunk_length);
 
+               if (png_ptr->idat_size > PNG_MAX_UINT)
+                  png_error(png_ptr, "Invalid chunk length.");
+
                png_reset_crc(png_ptr);
                png_crc_read(png_ptr, png_ptr->chunk_name, 4);
                if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))