Corrected the test on user transform changes on read. It was in the png_set of
the transform function, but that doesn't matter unless the transform function
changes the rowbuf size, and that is only valid if transform_info is called.

Upstream-Status: Backport (will be in 1.6.2)
                 - b44cd59ad9747069b90c6ff0f76558157a61e26a
                 - a8715cabd11354da9650dff7c0770686a217b550
Signed-off-by: Ross Burton <ross.burton@intel.com>


diff --git a/pngrtran.c b/pngrtran.c
index 626f3b0..4485e40 100644
--- a/pngrtran.c
+++ b/pngrtran.c
@@ -1056,9 +1056,6 @@ png_set_read_user_transform_fn(png_structrp png_ptr, png_user_transform_ptr
 {
    png_debug(1, "in png_set_read_user_transform_fn");
 
-   if (!png_rtran_ok(png_ptr, 0))
-      return;
-
 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
    png_ptr->transformations |= PNG_USER_TRANSFORM;
    png_ptr->read_user_transform_fn = read_user_transform_fn;
diff --git a/pngtrans.c b/pngtrans.c
index b532172..f822324 100644
--- a/pngtrans.c
+++ b/pngtrans.c
@@ -782,6 +782,17 @@ png_set_user_transform_info(png_structrp png_ptr, png_voidp
 
    if (png_ptr == NULL)
       return;
+
+#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
+   if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&
+      (png_ptr->flags & PNG_FLAG_ROW_INIT) != 0)
+   {
+      png_app_error(png_ptr,
+            "info change after png_start_read_image or png_read_update_info");
+      return;
+   }
+#endif
+
    png_ptr->user_transform_ptr = user_transform_ptr;
    png_ptr->user_transform_depth = (png_byte)user_transform_depth;
    png_ptr->user_transform_channels = (png_byte)user_transform_channels;