libpng/ directory inside the sources.
@Diego, do you know which versions of libpng and zlib are bundled?
zlib 1.2.3 and libpng 1.2.22 is what the headers report.
Both versions seems safe from looking at old GLSAs.
Cartman from Pardus helps again :)
Updated, back-ported, and in portage. I'll let Diego close this one...
Checked and all fine now, external libpng is used and no more internal copies of either that or zlib can be found, thanks Steve :)