fix: Correct the function png_fp_sub in png.c

The code erroneously evaluated `addend0+addend1` in the case where
`addend1` is less than zero.  The function is meant to subtract the
second argument from the first.

Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>

png.c

@@ -1218,7 +1218,7 @@ png_fp_sub(png_int_32 addend0, png_int_32 addend1, int *error)
    else if (addend1 < 0)
    {
       if (0x7fffffff + addend1 >= addend0)
-         return addend0+addend1;
+         return addend0-addend1;
    }
    else
       return addend0;