diff -ru4NwbB libpng-1.2.48/png.h libpng-1.2.49/png.h
--- libpng-1.2.48/png.h	2012-03-14 23:04:04.473859192 -0500
+++ libpng-1.2.49/png.h	2012-03-28 23:46:53.490049181 -0500
@@ -278,8 +278,11 @@
  *    1.2.48beta01            13    10248  12.so.0.48[.0]
  *    1.2.48rc01-02           13    10248  12.so.0.48[.0]
  *    1.0.58                  10    10058  10.so.0.58[.0]
  *    1.2.48                  13    10248  12.so.0.48[.0]
+ *    1.2.49rc01              13    10249  12.so.0.49[.0]
+ *    1.0.59                  10    10059  10.so.0.59[.0]
+ *    1.2.49                  13    10249  12.so.0.49[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
  *    used for changes in backward compatibility, as it is intended.  The
diff -ru4NwbB libpng-1.2.48/pngrtran.c libpng-1.2.49/pngrtran.c
--- libpng-1.2.48/pngrtran.c	2012-03-14 23:04:04.562834984 -0500
+++ libpng-1.2.49/pngrtran.c	2012-03-28 23:46:53.582277860 -0500
@@ -1162,8 +1162,9 @@
 #endif /* PNG_READ_BACKGROUND_SUPPORTED */
 
 #ifdef PNG_READ_SHIFT_SUPPORTED
    if ((png_ptr->transformations & PNG_SHIFT) &&
+      !(png_ptr->transformations & PNG_EXPAND) &&
       (color_type == PNG_COLOR_TYPE_PALETTE))
    {
       png_uint_16 i;
       png_uint_16 istop = png_ptr->num_palette;
@@ -1182,8 +1183,10 @@
          png_ptr->palette[i].red >>= sr;
          png_ptr->palette[i].green >>= sg;
          png_ptr->palette[i].blue >>= sb;
       }
+
+      png_ptr->transformations &= ~PNG_SHIFT;
    }
 #endif  /* PNG_READ_SHIFT_SUPPORTED */
  }
 #if !defined(PNG_READ_GAMMA_SUPPORTED) && !defined(PNG_READ_SHIFT_SUPPORTED) \
diff -ru4NwbB libpng-1.2.48/pngset.c libpng-1.2.49/pngset.c
--- libpng-1.2.48/pngset.c	2012-03-14 23:04:04.585052545 -0500
+++ libpng-1.2.49/pngset.c	2012-03-28 23:46:53.605049611 -0500
@@ -666,16 +666,18 @@
     * to hold all of the incoming text_ptr objects.
     */
    if (info_ptr->num_text + num_text > info_ptr->max_text)
    {
+      int old_max_text = info_ptr->max_text;
+      int old_num_text = info_ptr->num_text;
+
       if (info_ptr->text != NULL)
       {
          png_textp old_text;
-         int old_max;
 
-         old_max = info_ptr->max_text;
          info_ptr->max_text = info_ptr->num_text + num_text + 8;
          old_text = info_ptr->text;
+
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_uint_32)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
          {
@@ -678,12 +680,14 @@
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_uint_32)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
          {
-            png_free(png_ptr, old_text);
+            /* Restore to previous condition */
+            info_ptr->max_text = old_max_text;
+            info_ptr->text = old_text;
             return(1);
          }
-         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max *
+         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max_text *
             png_sizeof(png_text)));
          png_free(png_ptr, old_text);
       }
       else
@@ -692,9 +696,14 @@
          info_ptr->num_text = 0;
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_uint_32)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
+         {
+            /* Restore to previous condition */
+            info_ptr->num_text = old_num_text;
+            info_ptr->max_text = old_max_text;
             return(1);
+         }
 #ifdef PNG_FREE_ME_SUPPORTED
          info_ptr->free_me |= PNG_FREE_TEXT;
 #endif
       }
diff -ru4NwbB libpng-1.2.48/projects/xcode/libpng.xcodeproj/project.pbxproj libpng-1.2.49/projects/xcode/libpng.xcodeproj/project.pbxproj
--- libpng-1.2.48/projects/xcode/libpng.xcodeproj/project.pbxproj	2012-03-14 23:04:05.894206373 -0500
+++ libpng-1.2.49/projects/xcode/libpng.xcodeproj/project.pbxproj	2012-03-28 23:46:54.747879279 -0500
@@ -221,9 +221,9 @@
 			buildSettings = {
 				COPY_PHASE_STRIP = NO;
 				DYLIB_COMPATIBILITY_VERSION = 3;
 				DYLIB_CURRENT_VERSION = 3;
-				FRAMEWORK_VERSION = 1.2.48;
+				FRAMEWORK_VERSION = 1.2.49;
 				GCC_PRECOMPILE_PREFIX_HEADER = NO;
 				GCC_PREFIX_HEADER = "";
 				INFOPLIST_FILE = Info.plist;
 				INSTALL_PATH = "@executable_path/../Frameworks";
@@ -239,9 +239,9 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				DYLIB_COMPATIBILITY_VERSION = 3;
 				DYLIB_CURRENT_VERSION = 3;
-				FRAMEWORK_VERSION = 1.2.48;
+				FRAMEWORK_VERSION = 1.2.49;
 				GCC_PRECOMPILE_PREFIX_HEADER = NO;
 				GCC_PREFIX_HEADER = "";
 				INFOPLIST_FILE = Info.plist;
 				INSTALL_PATH = "@executable_path/../Frameworks";