[libpng16] fix: Correct the function png_fp_sub in png.c

The code erroneously evaluated `addend0+addend1` in the case where
`addend1` is less than zero.  The function is meant to subtract the
second argument from the first.

This is a cherry-pick of commit 79fd6d1
from branch 'libpng18'.

Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

png.c

@@ -1241,7 +1241,7 @@ png_fp_sub(png_int_32 addend0, png_int_32 addend1, int *error)
    else if (addend1 < 0)
    {
       if (0x7fffffff + addend1 >= addend0)
-         return addend0+addend1;
+         return addend0-addend1;
    }
    else
       return addend0;