pngrutil.c 120 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607360836093610361136123613361436153616361736183619362036213622362336243625362636273628362936303631363236333634363536363637363836393640364136423643364436453646364736483649365036513652365336543655365636573658365936603661366236633664366536663667366836693670367136723673367436753676367736783679368036813682368336843685368636873688368936903691369236933694369536963697369836993700370137023703370437053706370737083709371037113712371337143715371637173718371937203721372237233724372537263727372837293730373137323733373437353736373737383739374037413742374337443745374637473748374937503751375237533754375537563757375837593760376137623763376437653766376737683769377037713772377337743775377637773778377937803781378237833784378537863787378837893790379137923793379437953796379737983799380038013802380338043805380638073808380938103811381238133814381538163817381838193820382138223823382438253826382738283829383038313832383338343835383638373838383938403841384238433844384538463847384838493850385138523853385438553856385738583859386038613862386338643865386638673868386938703871387238733874387538763877387838793880388138823883388438853886388738883889389038913892389338943895389638973898389939003901390239033904390539063907390839093910391139123913391439153916391739183919392039213922392339243925392639273928392939303931393239333934393539363937393839393940394139423943394439453946394739483949395039513952395339543955395639573958395939603961396239633964396539663967396839693970397139723973397439753976397739783979398039813982398339843985398639873988398939903991399239933994399539963997399839994000400140024003400440054006400740084009401040114012401340144015401640174018401940204021402240234024402540264027402840294030403140324033403440354036403740384039404040414042404340444045404640474048404940504051405240534054405540564057405840594060406140624063406440654066406740684069407040714072407340744075407640774078407940804081408240834084408540864087408840894090409140924093409440954096409740984099410041014102410341044105410641074108410941104111411241134114411541164117411841194120412141224123412441254126412741284129413041314132413341344135413641374138413941404141414241434144414541464147414841494150415141524153415441554156415741584159
  1. /* pngrutil.c - utilities to read a PNG file
  2. *
  3. * Last changed in libpng 1.5.9 [February 18, 2012]
  4. * Copyright (c) 1998-2012 Glenn Randers-Pehrson
  5. * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  6. * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  7. *
  8. * This code is released under the libpng license.
  9. * For conditions of distribution and use, see the disclaimer
  10. * and license in png.h
  11. *
  12. * This file contains routines that are only called from within
  13. * libpng itself during the course of reading an image.
  14. */
  15. #include "pngpriv.h"
  16. #ifdef PNG_READ_SUPPORTED
  17. #define png_strtod(p,a,b) strtod(a,b)
  18. png_uint_32 PNGAPI
  19. png_get_uint_31(png_structp png_ptr, png_const_bytep buf)
  20. {
  21. png_uint_32 uval = png_get_uint_32(buf);
  22. if (uval > PNG_UINT_31_MAX)
  23. png_error(png_ptr, "PNG unsigned integer out of range");
  24. return (uval);
  25. }
  26. #if defined(PNG_READ_gAMA_SUPPORTED) || defined(PNG_READ_cHRM_SUPPORTED)
  27. /* The following is a variation on the above for use with the fixed
  28. * point values used for gAMA and cHRM. Instead of png_error it
  29. * issues a warning and returns (-1) - an invalid value because both
  30. * gAMA and cHRM use *unsigned* integers for fixed point values.
  31. */
  32. #define PNG_FIXED_ERROR (-1)
  33. static png_fixed_point /* PRIVATE */
  34. png_get_fixed_point(png_structp png_ptr, png_const_bytep buf)
  35. {
  36. png_uint_32 uval = png_get_uint_32(buf);
  37. if (uval <= PNG_UINT_31_MAX)
  38. return (png_fixed_point)uval; /* known to be in range */
  39. /* The caller can turn off the warning by passing NULL. */
  40. if (png_ptr != NULL)
  41. png_warning(png_ptr, "PNG fixed point integer out of range");
  42. return PNG_FIXED_ERROR;
  43. }
  44. #endif
  45. #ifdef PNG_READ_INT_FUNCTIONS_SUPPORTED
  46. /* NOTE: the read macros will obscure these definitions, so that if
  47. * PNG_USE_READ_MACROS is set the library will not use them internally,
  48. * but the APIs will still be available externally.
  49. *
  50. * The parentheses around "PNGAPI function_name" in the following three
  51. * functions are necessary because they allow the macros to co-exist with
  52. * these (unused but exported) functions.
  53. */
  54. /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */
  55. png_uint_32 (PNGAPI
  56. png_get_uint_32)(png_const_bytep buf)
  57. {
  58. png_uint_32 uval =
  59. ((png_uint_32)(*(buf )) << 24) +
  60. ((png_uint_32)(*(buf + 1)) << 16) +
  61. ((png_uint_32)(*(buf + 2)) << 8) +
  62. ((png_uint_32)(*(buf + 3)) ) ;
  63. return uval;
  64. }
  65. /* Grab a signed 32-bit integer from a buffer in big-endian format. The
  66. * data is stored in the PNG file in two's complement format and there
  67. * is no guarantee that a 'png_int_32' is exactly 32 bits, therefore
  68. * the following code does a two's complement to native conversion.
  69. */
  70. png_int_32 (PNGAPI
  71. png_get_int_32)(png_const_bytep buf)
  72. {
  73. png_uint_32 uval = png_get_uint_32(buf);
  74. if ((uval & 0x80000000) == 0) /* non-negative */
  75. return uval;
  76. uval = (uval ^ 0xffffffff) + 1; /* 2's complement: -x = ~x+1 */
  77. return -(png_int_32)uval;
  78. }
  79. /* Grab an unsigned 16-bit integer from a buffer in big-endian format. */
  80. png_uint_16 (PNGAPI
  81. png_get_uint_16)(png_const_bytep buf)
  82. {
  83. /* ANSI-C requires an int value to accomodate at least 16 bits so this
  84. * works and allows the compiler not to worry about possible narrowing
  85. * on 32 bit systems. (Pre-ANSI systems did not make integers smaller
  86. * than 16 bits either.)
  87. */
  88. unsigned int val =
  89. ((unsigned int)(*buf) << 8) +
  90. ((unsigned int)(*(buf + 1)));
  91. return (png_uint_16)val;
  92. }
  93. #endif /* PNG_READ_INT_FUNCTIONS_SUPPORTED */
  94. /* Read and check the PNG file signature */
  95. void /* PRIVATE */
  96. png_read_sig(png_structp png_ptr, png_infop info_ptr)
  97. {
  98. png_size_t num_checked, num_to_check;
  99. /* Exit if the user application does not expect a signature. */
  100. if (png_ptr->sig_bytes >= 8)
  101. return;
  102. num_checked = png_ptr->sig_bytes;
  103. num_to_check = 8 - num_checked;
  104. #ifdef PNG_IO_STATE_SUPPORTED
  105. png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE;
  106. #endif
  107. /* The signature must be serialized in a single I/O call. */
  108. png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check);
  109. png_ptr->sig_bytes = 8;
  110. if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))
  111. {
  112. if (num_checked < 4 &&
  113. png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4))
  114. png_error(png_ptr, "Not a PNG file");
  115. else
  116. png_error(png_ptr, "PNG file corrupted by ASCII conversion");
  117. }
  118. if (num_checked < 3)
  119. png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
  120. }
  121. /* Read the chunk header (length + type name).
  122. * Put the type name into png_ptr->chunk_name, and return the length.
  123. */
  124. png_uint_32 /* PRIVATE */
  125. png_read_chunk_header(png_structp png_ptr)
  126. {
  127. png_byte buf[8];
  128. png_uint_32 length;
  129. #ifdef PNG_IO_STATE_SUPPORTED
  130. png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR;
  131. #endif
  132. /* Read the length and the chunk name.
  133. * This must be performed in a single I/O call.
  134. */
  135. png_read_data(png_ptr, buf, 8);
  136. length = png_get_uint_31(png_ptr, buf);
  137. /* Put the chunk name into png_ptr->chunk_name. */
  138. png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(buf+4);
  139. png_debug2(0, "Reading %lx chunk, length = %lu",
  140. (unsigned long)png_ptr->chunk_name, (unsigned long)length);
  141. /* Reset the crc and run it over the chunk name. */
  142. png_reset_crc(png_ptr);
  143. png_calculate_crc(png_ptr, buf + 4, 4);
  144. /* Check to see if chunk name is valid. */
  145. png_check_chunk_name(png_ptr, png_ptr->chunk_name);
  146. #ifdef PNG_IO_STATE_SUPPORTED
  147. png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;
  148. #endif
  149. return length;
  150. }
  151. /* Read data, and (optionally) run it through the CRC. */
  152. void /* PRIVATE */
  153. png_crc_read(png_structp png_ptr, png_bytep buf, png_size_t length)
  154. {
  155. if (png_ptr == NULL)
  156. return;
  157. png_read_data(png_ptr, buf, length);
  158. png_calculate_crc(png_ptr, buf, length);
  159. }
  160. /* Optionally skip data and then check the CRC. Depending on whether we
  161. * are reading a ancillary or critical chunk, and how the program has set
  162. * things up, we may calculate the CRC on the data and print a message.
  163. * Returns '1' if there was a CRC error, '0' otherwise.
  164. */
  165. int /* PRIVATE */
  166. png_crc_finish(png_structp png_ptr, png_uint_32 skip)
  167. {
  168. png_size_t i;
  169. png_size_t istop = png_ptr->zbuf_size;
  170. for (i = (png_size_t)skip; i > istop; i -= istop)
  171. {
  172. png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size);
  173. }
  174. if (i)
  175. {
  176. png_crc_read(png_ptr, png_ptr->zbuf, i);
  177. }
  178. if (png_crc_error(png_ptr))
  179. {
  180. if (PNG_CHUNK_ANCILLIARY(png_ptr->chunk_name) ?
  181. !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) :
  182. (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE))
  183. {
  184. png_chunk_warning(png_ptr, "CRC error");
  185. }
  186. else
  187. {
  188. png_chunk_benign_error(png_ptr, "CRC error");
  189. return (0);
  190. }
  191. return (1);
  192. }
  193. return (0);
  194. }
  195. /* Compare the CRC stored in the PNG file with that calculated by libpng from
  196. * the data it has read thus far.
  197. */
  198. int /* PRIVATE */
  199. png_crc_error(png_structp png_ptr)
  200. {
  201. png_byte crc_bytes[4];
  202. png_uint_32 crc;
  203. int need_crc = 1;
  204. if (PNG_CHUNK_ANCILLIARY(png_ptr->chunk_name))
  205. {
  206. if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
  207. (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
  208. need_crc = 0;
  209. }
  210. else /* critical */
  211. {
  212. if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE)
  213. need_crc = 0;
  214. }
  215. #ifdef PNG_IO_STATE_SUPPORTED
  216. png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC;
  217. #endif
  218. /* The chunk CRC must be serialized in a single I/O call. */
  219. png_read_data(png_ptr, crc_bytes, 4);
  220. if (need_crc)
  221. {
  222. crc = png_get_uint_32(crc_bytes);
  223. return ((int)(crc != png_ptr->crc));
  224. }
  225. else
  226. return (0);
  227. }
  228. #ifdef PNG_READ_COMPRESSED_TEXT_SUPPORTED
  229. static png_size_t
  230. png_inflate(png_structp png_ptr, png_bytep data, png_size_t size,
  231. png_bytep output, png_size_t output_size)
  232. {
  233. png_size_t count = 0;
  234. /* zlib can't necessarily handle more than 65535 bytes at once (i.e. it can't
  235. * even necessarily handle 65536 bytes) because the type uInt is "16 bits or
  236. * more". Consequently it is necessary to chunk the input to zlib. This
  237. * code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the maximum value
  238. * that can be stored in a uInt.) It is possible to set ZLIB_IO_MAX to a
  239. * lower value in pngpriv.h and this may sometimes have a performance
  240. * advantage, because it forces access of the input data to be separated from
  241. * at least some of the use by some period of time.
  242. */
  243. png_ptr->zstream.next_in = data;
  244. /* avail_in is set below from 'size' */
  245. png_ptr->zstream.avail_in = 0;
  246. while (1)
  247. {
  248. int ret, avail;
  249. /* The setting of 'avail_in' used to be outside the loop; by setting it
  250. * inside it is possible to chunk the input to zlib and simply rely on
  251. * zlib to advance the 'next_in' pointer. This allows arbitrary amounts o
  252. * data to be passed through zlib at the unavoidable cost of requiring a
  253. * window save (memcpy of up to 32768 output bytes) every ZLIB_IO_MAX
  254. * input bytes.
  255. */
  256. if (png_ptr->zstream.avail_in == 0 && size > 0)
  257. {
  258. if (size <= ZLIB_IO_MAX)
  259. {
  260. /* The value is less than ZLIB_IO_MAX so the cast is safe: */
  261. png_ptr->zstream.avail_in = (uInt)size;
  262. size = 0;
  263. }
  264. else
  265. {
  266. png_ptr->zstream.avail_in = ZLIB_IO_MAX;
  267. size -= ZLIB_IO_MAX;
  268. }
  269. }
  270. /* Reset the output buffer each time round - we empty it
  271. * after every inflate call.
  272. */
  273. png_ptr->zstream.next_out = png_ptr->zbuf;
  274. png_ptr->zstream.avail_out = png_ptr->zbuf_size;
  275. ret = inflate(&png_ptr->zstream, Z_NO_FLUSH);
  276. avail = png_ptr->zbuf_size - png_ptr->zstream.avail_out;
  277. /* First copy/count any new output - but only if we didn't
  278. * get an error code.
  279. */
  280. if ((ret == Z_OK || ret == Z_STREAM_END) && avail > 0)
  281. {
  282. png_size_t space = avail; /* > 0, see above */
  283. if (output != 0 && output_size > count)
  284. {
  285. png_size_t copy = output_size - count;
  286. if (space < copy)
  287. copy = space;
  288. png_memcpy(output + count, png_ptr->zbuf, copy);
  289. }
  290. count += space;
  291. }
  292. if (ret == Z_OK)
  293. continue;
  294. /* Termination conditions - always reset the zstream, it
  295. * must be left in inflateInit state.
  296. */
  297. png_ptr->zstream.avail_in = 0;
  298. inflateReset(&png_ptr->zstream);
  299. if (ret == Z_STREAM_END)
  300. return count; /* NOTE: may be zero. */
  301. /* Now handle the error codes - the API always returns 0
  302. * and the error message is dumped into the uncompressed
  303. * buffer if available.
  304. */
  305. # ifdef PNG_WARNINGS_SUPPORTED
  306. {
  307. png_const_charp msg;
  308. if (png_ptr->zstream.msg != 0)
  309. msg = png_ptr->zstream.msg;
  310. else switch (ret)
  311. {
  312. case Z_BUF_ERROR:
  313. msg = "Buffer error in compressed datastream";
  314. break;
  315. case Z_DATA_ERROR:
  316. msg = "Data error in compressed datastream";
  317. break;
  318. default:
  319. msg = "Incomplete compressed datastream";
  320. break;
  321. }
  322. png_chunk_warning(png_ptr, msg);
  323. }
  324. # endif
  325. /* 0 means an error - notice that this code simply ignores
  326. * zero length compressed chunks as a result.
  327. */
  328. return 0;
  329. }
  330. }
  331. /*
  332. * Decompress trailing data in a chunk. The assumption is that chunkdata
  333. * points at an allocated area holding the contents of a chunk with a
  334. * trailing compressed part. What we get back is an allocated area
  335. * holding the original prefix part and an uncompressed version of the
  336. * trailing part (the malloc area passed in is freed).
  337. */
  338. void /* PRIVATE */
  339. png_decompress_chunk(png_structp png_ptr, int comp_type,
  340. png_size_t chunklength,
  341. png_size_t prefix_size, png_size_t *newlength)
  342. {
  343. /* The caller should guarantee this */
  344. if (prefix_size > chunklength)
  345. {
  346. /* The recovery is to delete the chunk. */
  347. png_warning(png_ptr, "invalid chunklength");
  348. prefix_size = 0; /* To delete everything */
  349. }
  350. else if (comp_type == PNG_COMPRESSION_TYPE_BASE)
  351. {
  352. png_size_t expanded_size = png_inflate(png_ptr,
  353. (png_bytep)(png_ptr->chunkdata + prefix_size),
  354. chunklength - prefix_size,
  355. 0, /* output */
  356. 0); /* output size */
  357. /* Now check the limits on this chunk - if the limit fails the
  358. * compressed data will be removed, the prefix will remain.
  359. */
  360. if (prefix_size >= (~(png_size_t)0) - 1 ||
  361. expanded_size >= (~(png_size_t)0) - 1 - prefix_size
  362. #ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
  363. || (png_ptr->user_chunk_malloc_max &&
  364. (prefix_size + expanded_size >= png_ptr->user_chunk_malloc_max - 1))
  365. #else
  366. # ifdef PNG_USER_CHUNK_MALLOC_MAX
  367. || ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
  368. prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)
  369. # endif
  370. #endif
  371. )
  372. png_warning(png_ptr, "Exceeded size limit while expanding chunk");
  373. /* If the size is zero either there was an error and a message
  374. * has already been output (warning) or the size really is zero
  375. * and we have nothing to do - the code will exit through the
  376. * error case below.
  377. */
  378. else if (expanded_size > 0)
  379. {
  380. /* Success (maybe) - really uncompress the chunk. */
  381. png_size_t new_size = 0;
  382. png_charp text = (png_charp)png_malloc_warn(png_ptr,
  383. prefix_size + expanded_size + 1);
  384. if (text != NULL)
  385. {
  386. png_memcpy(text, png_ptr->chunkdata, prefix_size);
  387. new_size = png_inflate(png_ptr,
  388. (png_bytep)(png_ptr->chunkdata + prefix_size),
  389. chunklength - prefix_size,
  390. (png_bytep)(text + prefix_size), expanded_size);
  391. text[prefix_size + expanded_size] = 0; /* just in case */
  392. if (new_size == expanded_size)
  393. {
  394. png_free(png_ptr, png_ptr->chunkdata);
  395. png_ptr->chunkdata = text;
  396. *newlength = prefix_size + expanded_size;
  397. return; /* The success return! */
  398. }
  399. png_warning(png_ptr, "png_inflate logic error");
  400. png_free(png_ptr, text);
  401. }
  402. else
  403. png_warning(png_ptr, "Not enough memory to decompress chunk");
  404. }
  405. }
  406. else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */
  407. {
  408. PNG_WARNING_PARAMETERS(p)
  409. png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_d, comp_type);
  410. png_formatted_warning(png_ptr, p, "Unknown compression type @1");
  411. /* The recovery is to simply drop the data. */
  412. }
  413. /* Generic error return - leave the prefix, delete the compressed
  414. * data, reallocate the chunkdata to remove the potentially large
  415. * amount of compressed data.
  416. */
  417. {
  418. png_charp text = (png_charp)png_malloc_warn(png_ptr, prefix_size + 1);
  419. if (text != NULL)
  420. {
  421. if (prefix_size > 0)
  422. png_memcpy(text, png_ptr->chunkdata, prefix_size);
  423. png_free(png_ptr, png_ptr->chunkdata);
  424. png_ptr->chunkdata = text;
  425. /* This is an extra zero in the 'uncompressed' part. */
  426. *(png_ptr->chunkdata + prefix_size) = 0x00;
  427. }
  428. /* Ignore a malloc error here - it is safe. */
  429. }
  430. *newlength = prefix_size;
  431. }
  432. #endif /* PNG_READ_COMPRESSED_TEXT_SUPPORTED */
  433. /* Read and check the IDHR chunk */
  434. void /* PRIVATE */
  435. png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  436. {
  437. png_byte buf[13];
  438. png_uint_32 width, height;
  439. int bit_depth, color_type, compression_type, filter_type;
  440. int interlace_type;
  441. png_debug(1, "in png_handle_IHDR");
  442. if (png_ptr->mode & PNG_HAVE_IHDR)
  443. png_error(png_ptr, "Out of place IHDR");
  444. /* Check the length */
  445. if (length != 13)
  446. png_error(png_ptr, "Invalid IHDR chunk");
  447. png_ptr->mode |= PNG_HAVE_IHDR;
  448. png_crc_read(png_ptr, buf, 13);
  449. png_crc_finish(png_ptr, 0);
  450. width = png_get_uint_31(png_ptr, buf);
  451. height = png_get_uint_31(png_ptr, buf + 4);
  452. bit_depth = buf[8];
  453. color_type = buf[9];
  454. compression_type = buf[10];
  455. filter_type = buf[11];
  456. interlace_type = buf[12];
  457. /* Set internal variables */
  458. png_ptr->width = width;
  459. png_ptr->height = height;
  460. png_ptr->bit_depth = (png_byte)bit_depth;
  461. png_ptr->interlaced = (png_byte)interlace_type;
  462. png_ptr->color_type = (png_byte)color_type;
  463. #ifdef PNG_MNG_FEATURES_SUPPORTED
  464. png_ptr->filter_type = (png_byte)filter_type;
  465. #endif
  466. png_ptr->compression_type = (png_byte)compression_type;
  467. /* Find number of channels */
  468. switch (png_ptr->color_type)
  469. {
  470. default: /* invalid, png_set_IHDR calls png_error */
  471. case PNG_COLOR_TYPE_GRAY:
  472. case PNG_COLOR_TYPE_PALETTE:
  473. png_ptr->channels = 1;
  474. break;
  475. case PNG_COLOR_TYPE_RGB:
  476. png_ptr->channels = 3;
  477. break;
  478. case PNG_COLOR_TYPE_GRAY_ALPHA:
  479. png_ptr->channels = 2;
  480. break;
  481. case PNG_COLOR_TYPE_RGB_ALPHA:
  482. png_ptr->channels = 4;
  483. break;
  484. }
  485. /* Set up other useful info */
  486. png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *
  487. png_ptr->channels);
  488. png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
  489. png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);
  490. png_debug1(3, "channels = %d", png_ptr->channels);
  491. png_debug1(3, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes);
  492. png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
  493. color_type, interlace_type, compression_type, filter_type);
  494. }
  495. /* Read and check the palette */
  496. void /* PRIVATE */
  497. png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  498. {
  499. png_color palette[PNG_MAX_PALETTE_LENGTH];
  500. int num, i;
  501. #ifdef PNG_POINTER_INDEXING_SUPPORTED
  502. png_colorp pal_ptr;
  503. #endif
  504. png_debug(1, "in png_handle_PLTE");
  505. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  506. png_error(png_ptr, "Missing IHDR before PLTE");
  507. else if (png_ptr->mode & PNG_HAVE_IDAT)
  508. {
  509. png_warning(png_ptr, "Invalid PLTE after IDAT");
  510. png_crc_finish(png_ptr, length);
  511. return;
  512. }
  513. else if (png_ptr->mode & PNG_HAVE_PLTE)
  514. png_error(png_ptr, "Duplicate PLTE chunk");
  515. png_ptr->mode |= PNG_HAVE_PLTE;
  516. if (!(png_ptr->color_type&PNG_COLOR_MASK_COLOR))
  517. {
  518. png_warning(png_ptr,
  519. "Ignoring PLTE chunk in grayscale PNG");
  520. png_crc_finish(png_ptr, length);
  521. return;
  522. }
  523. #ifndef PNG_READ_OPT_PLTE_SUPPORTED
  524. if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
  525. {
  526. png_crc_finish(png_ptr, length);
  527. return;
  528. }
  529. #endif
  530. if (length > 3*PNG_MAX_PALETTE_LENGTH || length % 3)
  531. {
  532. if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
  533. {
  534. png_warning(png_ptr, "Invalid palette chunk");
  535. png_crc_finish(png_ptr, length);
  536. return;
  537. }
  538. else
  539. {
  540. png_error(png_ptr, "Invalid palette chunk");
  541. }
  542. }
  543. num = (int)length / 3;
  544. #ifdef PNG_POINTER_INDEXING_SUPPORTED
  545. for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
  546. {
  547. png_byte buf[3];
  548. png_crc_read(png_ptr, buf, 3);
  549. pal_ptr->red = buf[0];
  550. pal_ptr->green = buf[1];
  551. pal_ptr->blue = buf[2];
  552. }
  553. #else
  554. for (i = 0; i < num; i++)
  555. {
  556. png_byte buf[3];
  557. png_crc_read(png_ptr, buf, 3);
  558. /* Don't depend upon png_color being any order */
  559. palette[i].red = buf[0];
  560. palette[i].green = buf[1];
  561. palette[i].blue = buf[2];
  562. }
  563. #endif
  564. /* If we actually need the PLTE chunk (ie for a paletted image), we do
  565. * whatever the normal CRC configuration tells us. However, if we
  566. * have an RGB image, the PLTE can be considered ancillary, so
  567. * we will act as though it is.
  568. */
  569. #ifndef PNG_READ_OPT_PLTE_SUPPORTED
  570. if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  571. #endif
  572. {
  573. png_crc_finish(png_ptr, 0);
  574. }
  575. #ifndef PNG_READ_OPT_PLTE_SUPPORTED
  576. else if (png_crc_error(png_ptr)) /* Only if we have a CRC error */
  577. {
  578. /* If we don't want to use the data from an ancillary chunk,
  579. * we have two options: an error abort, or a warning and we
  580. * ignore the data in this chunk (which should be OK, since
  581. * it's considered ancillary for a RGB or RGBA image).
  582. */
  583. if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE))
  584. {
  585. if (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)
  586. {
  587. png_chunk_benign_error(png_ptr, "CRC error");
  588. }
  589. else
  590. {
  591. png_chunk_warning(png_ptr, "CRC error");
  592. return;
  593. }
  594. }
  595. /* Otherwise, we (optionally) emit a warning and use the chunk. */
  596. else if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN))
  597. {
  598. png_chunk_warning(png_ptr, "CRC error");
  599. }
  600. }
  601. #endif
  602. png_set_PLTE(png_ptr, info_ptr, palette, num);
  603. #ifdef PNG_READ_tRNS_SUPPORTED
  604. if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  605. {
  606. if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))
  607. {
  608. if (png_ptr->num_trans > (png_uint_16)num)
  609. {
  610. png_warning(png_ptr, "Truncating incorrect tRNS chunk length");
  611. png_ptr->num_trans = (png_uint_16)num;
  612. }
  613. if (info_ptr->num_trans > (png_uint_16)num)
  614. {
  615. png_warning(png_ptr, "Truncating incorrect info tRNS chunk length");
  616. info_ptr->num_trans = (png_uint_16)num;
  617. }
  618. }
  619. }
  620. #endif
  621. }
  622. void /* PRIVATE */
  623. png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  624. {
  625. png_debug(1, "in png_handle_IEND");
  626. if (!(png_ptr->mode & PNG_HAVE_IHDR) || !(png_ptr->mode & PNG_HAVE_IDAT))
  627. {
  628. png_error(png_ptr, "No image in file");
  629. }
  630. png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);
  631. if (length != 0)
  632. {
  633. png_warning(png_ptr, "Incorrect IEND chunk length");
  634. }
  635. png_crc_finish(png_ptr, length);
  636. PNG_UNUSED(info_ptr) /* Quiet compiler warnings about unused info_ptr */
  637. }
  638. #ifdef PNG_READ_gAMA_SUPPORTED
  639. void /* PRIVATE */
  640. png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  641. {
  642. png_fixed_point igamma;
  643. png_byte buf[4];
  644. png_debug(1, "in png_handle_gAMA");
  645. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  646. png_error(png_ptr, "Missing IHDR before gAMA");
  647. else if (png_ptr->mode & PNG_HAVE_IDAT)
  648. {
  649. png_warning(png_ptr, "Invalid gAMA after IDAT");
  650. png_crc_finish(png_ptr, length);
  651. return;
  652. }
  653. else if (png_ptr->mode & PNG_HAVE_PLTE)
  654. /* Should be an error, but we can cope with it */
  655. png_warning(png_ptr, "Out of place gAMA chunk");
  656. if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)
  657. #ifdef PNG_READ_sRGB_SUPPORTED
  658. && !(info_ptr->valid & PNG_INFO_sRGB)
  659. #endif
  660. )
  661. {
  662. png_warning(png_ptr, "Duplicate gAMA chunk");
  663. png_crc_finish(png_ptr, length);
  664. return;
  665. }
  666. if (length != 4)
  667. {
  668. png_warning(png_ptr, "Incorrect gAMA chunk length");
  669. png_crc_finish(png_ptr, length);
  670. return;
  671. }
  672. png_crc_read(png_ptr, buf, 4);
  673. if (png_crc_finish(png_ptr, 0))
  674. return;
  675. igamma = png_get_fixed_point(NULL, buf);
  676. /* Check for zero gamma or an error. */
  677. if (igamma <= 0)
  678. {
  679. png_warning(png_ptr,
  680. "Ignoring gAMA chunk with out of range gamma");
  681. return;
  682. }
  683. # ifdef PNG_READ_sRGB_SUPPORTED
  684. if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))
  685. {
  686. if (PNG_OUT_OF_RANGE(igamma, 45500, 500))
  687. {
  688. PNG_WARNING_PARAMETERS(p)
  689. png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_fixed, igamma);
  690. png_formatted_warning(png_ptr, p,
  691. "Ignoring incorrect gAMA value @1 when sRGB is also present");
  692. return;
  693. }
  694. }
  695. # endif /* PNG_READ_sRGB_SUPPORTED */
  696. # ifdef PNG_READ_GAMMA_SUPPORTED
  697. /* Gamma correction on read is supported. */
  698. png_ptr->gamma = igamma;
  699. # endif
  700. /* And set the 'info' structure members. */
  701. png_set_gAMA_fixed(png_ptr, info_ptr, igamma);
  702. }
  703. #endif
  704. #ifdef PNG_READ_sBIT_SUPPORTED
  705. void /* PRIVATE */
  706. png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  707. {
  708. png_size_t truelen;
  709. png_byte buf[4];
  710. png_debug(1, "in png_handle_sBIT");
  711. buf[0] = buf[1] = buf[2] = buf[3] = 0;
  712. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  713. png_error(png_ptr, "Missing IHDR before sBIT");
  714. else if (png_ptr->mode & PNG_HAVE_IDAT)
  715. {
  716. png_warning(png_ptr, "Invalid sBIT after IDAT");
  717. png_crc_finish(png_ptr, length);
  718. return;
  719. }
  720. else if (png_ptr->mode & PNG_HAVE_PLTE)
  721. {
  722. /* Should be an error, but we can cope with it */
  723. png_warning(png_ptr, "Out of place sBIT chunk");
  724. }
  725. if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT))
  726. {
  727. png_warning(png_ptr, "Duplicate sBIT chunk");
  728. png_crc_finish(png_ptr, length);
  729. return;
  730. }
  731. if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  732. truelen = 3;
  733. else
  734. truelen = (png_size_t)png_ptr->channels;
  735. if (length != truelen || length > 4)
  736. {
  737. png_warning(png_ptr, "Incorrect sBIT chunk length");
  738. png_crc_finish(png_ptr, length);
  739. return;
  740. }
  741. png_crc_read(png_ptr, buf, truelen);
  742. if (png_crc_finish(png_ptr, 0))
  743. return;
  744. if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)
  745. {
  746. png_ptr->sig_bit.red = buf[0];
  747. png_ptr->sig_bit.green = buf[1];
  748. png_ptr->sig_bit.blue = buf[2];
  749. png_ptr->sig_bit.alpha = buf[3];
  750. }
  751. else
  752. {
  753. png_ptr->sig_bit.gray = buf[0];
  754. png_ptr->sig_bit.red = buf[0];
  755. png_ptr->sig_bit.green = buf[0];
  756. png_ptr->sig_bit.blue = buf[0];
  757. png_ptr->sig_bit.alpha = buf[1];
  758. }
  759. png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));
  760. }
  761. #endif
  762. #ifdef PNG_READ_cHRM_SUPPORTED
  763. void /* PRIVATE */
  764. png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  765. {
  766. png_byte buf[32];
  767. png_fixed_point x_white, y_white, x_red, y_red, x_green, y_green, x_blue,
  768. y_blue;
  769. png_debug(1, "in png_handle_cHRM");
  770. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  771. png_error(png_ptr, "Missing IHDR before cHRM");
  772. else if (png_ptr->mode & PNG_HAVE_IDAT)
  773. {
  774. png_warning(png_ptr, "Invalid cHRM after IDAT");
  775. png_crc_finish(png_ptr, length);
  776. return;
  777. }
  778. else if (png_ptr->mode & PNG_HAVE_PLTE)
  779. /* Should be an error, but we can cope with it */
  780. png_warning(png_ptr, "Out of place cHRM chunk");
  781. if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM)
  782. # ifdef PNG_READ_sRGB_SUPPORTED
  783. && !(info_ptr->valid & PNG_INFO_sRGB)
  784. # endif
  785. )
  786. {
  787. png_warning(png_ptr, "Duplicate cHRM chunk");
  788. png_crc_finish(png_ptr, length);
  789. return;
  790. }
  791. if (length != 32)
  792. {
  793. png_warning(png_ptr, "Incorrect cHRM chunk length");
  794. png_crc_finish(png_ptr, length);
  795. return;
  796. }
  797. png_crc_read(png_ptr, buf, 32);
  798. if (png_crc_finish(png_ptr, 0))
  799. return;
  800. x_white = png_get_fixed_point(NULL, buf);
  801. y_white = png_get_fixed_point(NULL, buf + 4);
  802. x_red = png_get_fixed_point(NULL, buf + 8);
  803. y_red = png_get_fixed_point(NULL, buf + 12);
  804. x_green = png_get_fixed_point(NULL, buf + 16);
  805. y_green = png_get_fixed_point(NULL, buf + 20);
  806. x_blue = png_get_fixed_point(NULL, buf + 24);
  807. y_blue = png_get_fixed_point(NULL, buf + 28);
  808. if (x_white == PNG_FIXED_ERROR ||
  809. y_white == PNG_FIXED_ERROR ||
  810. x_red == PNG_FIXED_ERROR ||
  811. y_red == PNG_FIXED_ERROR ||
  812. x_green == PNG_FIXED_ERROR ||
  813. y_green == PNG_FIXED_ERROR ||
  814. x_blue == PNG_FIXED_ERROR ||
  815. y_blue == PNG_FIXED_ERROR)
  816. {
  817. png_warning(png_ptr, "Ignoring cHRM chunk with negative chromaticities");
  818. return;
  819. }
  820. #ifdef PNG_READ_sRGB_SUPPORTED
  821. if ((info_ptr != NULL) && (info_ptr->valid & PNG_INFO_sRGB))
  822. {
  823. if (PNG_OUT_OF_RANGE(x_white, 31270, 1000) ||
  824. PNG_OUT_OF_RANGE(y_white, 32900, 1000) ||
  825. PNG_OUT_OF_RANGE(x_red, 64000, 1000) ||
  826. PNG_OUT_OF_RANGE(y_red, 33000, 1000) ||
  827. PNG_OUT_OF_RANGE(x_green, 30000, 1000) ||
  828. PNG_OUT_OF_RANGE(y_green, 60000, 1000) ||
  829. PNG_OUT_OF_RANGE(x_blue, 15000, 1000) ||
  830. PNG_OUT_OF_RANGE(y_blue, 6000, 1000))
  831. {
  832. PNG_WARNING_PARAMETERS(p)
  833. png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_fixed, x_white);
  834. png_warning_parameter_signed(p, 2, PNG_NUMBER_FORMAT_fixed, y_white);
  835. png_warning_parameter_signed(p, 3, PNG_NUMBER_FORMAT_fixed, x_red);
  836. png_warning_parameter_signed(p, 4, PNG_NUMBER_FORMAT_fixed, y_red);
  837. png_warning_parameter_signed(p, 5, PNG_NUMBER_FORMAT_fixed, x_green);
  838. png_warning_parameter_signed(p, 6, PNG_NUMBER_FORMAT_fixed, y_green);
  839. png_warning_parameter_signed(p, 7, PNG_NUMBER_FORMAT_fixed, x_blue);
  840. png_warning_parameter_signed(p, 8, PNG_NUMBER_FORMAT_fixed, y_blue);
  841. png_formatted_warning(png_ptr, p,
  842. "Ignoring incorrect cHRM white(@1,@2) r(@3,@4)g(@5,@6)b(@7,@8) "
  843. "when sRGB is also present");
  844. }
  845. return;
  846. }
  847. #endif /* PNG_READ_sRGB_SUPPORTED */
  848. #ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
  849. /* Store the _white values as default coefficients for the rgb to gray
  850. * operation if it is supported. Check if the transform is already set to
  851. * avoid destroying the transform values.
  852. */
  853. if (!png_ptr->rgb_to_gray_coefficients_set)
  854. {
  855. /* png_set_background has not been called and we haven't seen an sRGB
  856. * chunk yet. Find the XYZ of the three end points.
  857. */
  858. png_XYZ XYZ;
  859. png_xy xy;
  860. xy.redx = x_red;
  861. xy.redy = y_red;
  862. xy.greenx = x_green;
  863. xy.greeny = y_green;
  864. xy.bluex = x_blue;
  865. xy.bluey = y_blue;
  866. xy.whitex = x_white;
  867. xy.whitey = y_white;
  868. if (png_XYZ_from_xy_checked(png_ptr, &XYZ, xy))
  869. {
  870. /* The success case, because XYZ_from_xy normalises to a reference
  871. * white Y of 1.0 we just need to scale the numbers. This should
  872. * always work just fine. It is an internal error if this overflows.
  873. */
  874. {
  875. png_fixed_point r, g, b;
  876. if (png_muldiv(&r, XYZ.redY, 32768, PNG_FP_1) &&
  877. r >= 0 && r <= 32768 &&
  878. png_muldiv(&g, XYZ.greenY, 32768, PNG_FP_1) &&
  879. g >= 0 && g <= 32768 &&
  880. png_muldiv(&b, XYZ.blueY, 32768, PNG_FP_1) &&
  881. b >= 0 && b <= 32768 &&
  882. r+g+b <= 32769)
  883. {
  884. /* We allow 0 coefficients here. r+g+b may be 32769 if two or
  885. * all of the coefficients were rounded up. Handle this by
  886. * reducing the *largest* coefficient by 1; this matches the
  887. * approach used for the default coefficients in pngrtran.c
  888. */
  889. int add = 0;
  890. if (r+g+b > 32768)
  891. add = -1;
  892. else if (r+g+b < 32768)
  893. add = 1;
  894. if (add != 0)
  895. {
  896. if (g >= r && g >= b)
  897. g += add;
  898. else if (r >= g && r >= b)
  899. r += add;
  900. else
  901. b += add;
  902. }
  903. /* Check for an internal error. */
  904. if (r+g+b != 32768)
  905. png_error(png_ptr,
  906. "internal error handling cHRM coefficients");
  907. png_ptr->rgb_to_gray_red_coeff = (png_uint_16)r;
  908. png_ptr->rgb_to_gray_green_coeff = (png_uint_16)g;
  909. }
  910. /* This is a png_error at present even though it could be ignored -
  911. * it should never happen, but it is important that if it does, the
  912. * bug is fixed.
  913. */
  914. else
  915. png_error(png_ptr, "internal error handling cHRM->XYZ");
  916. }
  917. }
  918. }
  919. #endif
  920. png_set_cHRM_fixed(png_ptr, info_ptr, x_white, y_white, x_red, y_red,
  921. x_green, y_green, x_blue, y_blue);
  922. }
  923. #endif
  924. #ifdef PNG_READ_sRGB_SUPPORTED
  925. void /* PRIVATE */
  926. png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  927. {
  928. int intent;
  929. png_byte buf[1];
  930. png_debug(1, "in png_handle_sRGB");
  931. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  932. png_error(png_ptr, "Missing IHDR before sRGB");
  933. else if (png_ptr->mode & PNG_HAVE_IDAT)
  934. {
  935. png_warning(png_ptr, "Invalid sRGB after IDAT");
  936. png_crc_finish(png_ptr, length);
  937. return;
  938. }
  939. else if (png_ptr->mode & PNG_HAVE_PLTE)
  940. /* Should be an error, but we can cope with it */
  941. png_warning(png_ptr, "Out of place sRGB chunk");
  942. if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))
  943. {
  944. png_warning(png_ptr, "Duplicate sRGB chunk");
  945. png_crc_finish(png_ptr, length);
  946. return;
  947. }
  948. if (length != 1)
  949. {
  950. png_warning(png_ptr, "Incorrect sRGB chunk length");
  951. png_crc_finish(png_ptr, length);
  952. return;
  953. }
  954. png_crc_read(png_ptr, buf, 1);
  955. if (png_crc_finish(png_ptr, 0))
  956. return;
  957. intent = buf[0];
  958. /* Check for bad intent */
  959. if (intent >= PNG_sRGB_INTENT_LAST)
  960. {
  961. png_warning(png_ptr, "Unknown sRGB intent");
  962. return;
  963. }
  964. #if defined(PNG_READ_gAMA_SUPPORTED) && defined(PNG_READ_GAMMA_SUPPORTED)
  965. if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA))
  966. {
  967. if (PNG_OUT_OF_RANGE(info_ptr->gamma, 45500, 500))
  968. {
  969. PNG_WARNING_PARAMETERS(p)
  970. png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_fixed,
  971. info_ptr->gamma);
  972. png_formatted_warning(png_ptr, p,
  973. "Ignoring incorrect gAMA value @1 when sRGB is also present");
  974. }
  975. }
  976. #endif /* PNG_READ_gAMA_SUPPORTED */
  977. #ifdef PNG_READ_cHRM_SUPPORTED
  978. if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM))
  979. if (PNG_OUT_OF_RANGE(info_ptr->x_white, 31270, 1000) ||
  980. PNG_OUT_OF_RANGE(info_ptr->y_white, 32900, 1000) ||
  981. PNG_OUT_OF_RANGE(info_ptr->x_red, 64000, 1000) ||
  982. PNG_OUT_OF_RANGE(info_ptr->y_red, 33000, 1000) ||
  983. PNG_OUT_OF_RANGE(info_ptr->x_green, 30000, 1000) ||
  984. PNG_OUT_OF_RANGE(info_ptr->y_green, 60000, 1000) ||
  985. PNG_OUT_OF_RANGE(info_ptr->x_blue, 15000, 1000) ||
  986. PNG_OUT_OF_RANGE(info_ptr->y_blue, 6000, 1000))
  987. {
  988. png_warning(png_ptr,
  989. "Ignoring incorrect cHRM value when sRGB is also present");
  990. }
  991. #endif /* PNG_READ_cHRM_SUPPORTED */
  992. /* This is recorded for use when handling the cHRM chunk above. An sRGB
  993. * chunk unconditionally overwrites the coefficients for grayscale conversion
  994. * too.
  995. */
  996. png_ptr->is_sRGB = 1;
  997. # ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
  998. /* Don't overwrite user supplied values: */
  999. if (!png_ptr->rgb_to_gray_coefficients_set)
  1000. {
  1001. /* These numbers come from the sRGB specification (or, since one has to
  1002. * pay much money to get a copy, the wikipedia sRGB page) the
  1003. * chromaticity values quoted have been inverted to get the reverse
  1004. * transformation from RGB to XYZ and the 'Y' coefficients scaled by
  1005. * 32768 (then rounded).
  1006. *
  1007. * sRGB and ITU Rec-709 both truncate the values for the D65 white
  1008. * point to four digits and, even though it actually stores five
  1009. * digits, the PNG spec gives the truncated value.
  1010. *
  1011. * This means that when the chromaticities are converted back to XYZ
  1012. * end points we end up with (6968,23435,2366), which, as described in
  1013. * pngrtran.c, would overflow. If the five digit precision and up is
  1014. * used we get, instead:
  1015. *
  1016. * 6968*R + 23435*G + 2365*B
  1017. *
  1018. * (Notice that this rounds the blue coefficient down, rather than the
  1019. * choice used in pngrtran.c which is to round the green one down.)
  1020. */
  1021. png_ptr->rgb_to_gray_red_coeff = 6968; /* 0.212639005871510 */
  1022. png_ptr->rgb_to_gray_green_coeff = 23434; /* 0.715168678767756 */
  1023. /* png_ptr->rgb_to_gray_blue_coeff = 2366; 0.072192315360734 */
  1024. /* The following keeps the cHRM chunk from destroying the
  1025. * coefficients again in the event that it follows the sRGB chunk.
  1026. */
  1027. png_ptr->rgb_to_gray_coefficients_set = 1;
  1028. }
  1029. # endif
  1030. png_set_sRGB_gAMA_and_cHRM(png_ptr, info_ptr, intent);
  1031. }
  1032. #endif /* PNG_READ_sRGB_SUPPORTED */
  1033. #ifdef PNG_READ_iCCP_SUPPORTED
  1034. void /* PRIVATE */
  1035. png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1036. /* Note: this does not properly handle chunks that are > 64K under DOS */
  1037. {
  1038. png_byte compression_type;
  1039. png_bytep pC;
  1040. png_charp profile;
  1041. png_uint_32 skip = 0;
  1042. png_uint_32 profile_size;
  1043. png_alloc_size_t profile_length;
  1044. png_size_t slength, prefix_length, data_length;
  1045. png_debug(1, "in png_handle_iCCP");
  1046. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1047. png_error(png_ptr, "Missing IHDR before iCCP");
  1048. else if (png_ptr->mode & PNG_HAVE_IDAT)
  1049. {
  1050. png_warning(png_ptr, "Invalid iCCP after IDAT");
  1051. png_crc_finish(png_ptr, length);
  1052. return;
  1053. }
  1054. else if (png_ptr->mode & PNG_HAVE_PLTE)
  1055. /* Should be an error, but we can cope with it */
  1056. png_warning(png_ptr, "Out of place iCCP chunk");
  1057. if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP))
  1058. {
  1059. png_warning(png_ptr, "Duplicate iCCP chunk");
  1060. png_crc_finish(png_ptr, length);
  1061. return;
  1062. }
  1063. #ifdef PNG_MAX_MALLOC_64K
  1064. if (length > (png_uint_32)65535L)
  1065. {
  1066. png_warning(png_ptr, "iCCP chunk too large to fit in memory");
  1067. skip = length - (png_uint_32)65535L;
  1068. length = (png_uint_32)65535L;
  1069. }
  1070. #endif
  1071. png_free(png_ptr, png_ptr->chunkdata);
  1072. png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
  1073. slength = length;
  1074. png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
  1075. if (png_crc_finish(png_ptr, skip))
  1076. {
  1077. png_free(png_ptr, png_ptr->chunkdata);
  1078. png_ptr->chunkdata = NULL;
  1079. return;
  1080. }
  1081. png_ptr->chunkdata[slength] = 0x00;
  1082. for (profile = png_ptr->chunkdata; *profile; profile++)
  1083. /* Empty loop to find end of name */ ;
  1084. ++profile;
  1085. /* There should be at least one zero (the compression type byte)
  1086. * following the separator, and we should be on it
  1087. */
  1088. if (profile >= png_ptr->chunkdata + slength - 1)
  1089. {
  1090. png_free(png_ptr, png_ptr->chunkdata);
  1091. png_ptr->chunkdata = NULL;
  1092. png_warning(png_ptr, "Malformed iCCP chunk");
  1093. return;
  1094. }
  1095. /* Compression_type should always be zero */
  1096. compression_type = *profile++;
  1097. if (compression_type)
  1098. {
  1099. png_warning(png_ptr, "Ignoring nonzero compression type in iCCP chunk");
  1100. compression_type = 0x00; /* Reset it to zero (libpng-1.0.6 through 1.0.8
  1101. wrote nonzero) */
  1102. }
  1103. prefix_length = profile - png_ptr->chunkdata;
  1104. png_decompress_chunk(png_ptr, compression_type,
  1105. slength, prefix_length, &data_length);
  1106. profile_length = data_length - prefix_length;
  1107. if (prefix_length > data_length || profile_length < 4)
  1108. {
  1109. png_free(png_ptr, png_ptr->chunkdata);
  1110. png_ptr->chunkdata = NULL;
  1111. png_warning(png_ptr, "Profile size field missing from iCCP chunk");
  1112. return;
  1113. }
  1114. /* Check the profile_size recorded in the first 32 bits of the ICC profile */
  1115. pC = (png_bytep)(png_ptr->chunkdata + prefix_length);
  1116. profile_size = ((*(pC )) << 24) |
  1117. ((*(pC + 1)) << 16) |
  1118. ((*(pC + 2)) << 8) |
  1119. ((*(pC + 3)) );
  1120. /* NOTE: the following guarantees that 'profile_length' fits into 32 bits,
  1121. * because profile_size is a 32 bit value.
  1122. */
  1123. if (profile_size < profile_length)
  1124. profile_length = profile_size;
  1125. /* And the following guarantees that profile_size == profile_length. */
  1126. if (profile_size > profile_length)
  1127. {
  1128. PNG_WARNING_PARAMETERS(p)
  1129. png_free(png_ptr, png_ptr->chunkdata);
  1130. png_ptr->chunkdata = NULL;
  1131. png_warning_parameter_unsigned(p, 1, PNG_NUMBER_FORMAT_u, profile_size);
  1132. png_warning_parameter_unsigned(p, 2, PNG_NUMBER_FORMAT_u, profile_length);
  1133. png_formatted_warning(png_ptr, p,
  1134. "Ignoring iCCP chunk with declared size = @1 and actual length = @2");
  1135. return;
  1136. }
  1137. png_set_iCCP(png_ptr, info_ptr, png_ptr->chunkdata,
  1138. compression_type, (png_bytep)png_ptr->chunkdata + prefix_length,
  1139. profile_size);
  1140. png_free(png_ptr, png_ptr->chunkdata);
  1141. png_ptr->chunkdata = NULL;
  1142. }
  1143. #endif /* PNG_READ_iCCP_SUPPORTED */
  1144. #ifdef PNG_READ_sPLT_SUPPORTED
  1145. void /* PRIVATE */
  1146. png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1147. /* Note: this does not properly handle chunks that are > 64K under DOS */
  1148. {
  1149. png_bytep entry_start;
  1150. png_sPLT_t new_palette;
  1151. png_sPLT_entryp pp;
  1152. png_uint_32 data_length;
  1153. int entry_size, i;
  1154. png_uint_32 skip = 0;
  1155. png_size_t slength;
  1156. png_uint_32 dl;
  1157. png_size_t max_dl;
  1158. png_debug(1, "in png_handle_sPLT");
  1159. #ifdef PNG_USER_LIMITS_SUPPORTED
  1160. if (png_ptr->user_chunk_cache_max != 0)
  1161. {
  1162. if (png_ptr->user_chunk_cache_max == 1)
  1163. {
  1164. png_crc_finish(png_ptr, length);
  1165. return;
  1166. }
  1167. if (--png_ptr->user_chunk_cache_max == 1)
  1168. {
  1169. png_warning(png_ptr, "No space in chunk cache for sPLT");
  1170. png_crc_finish(png_ptr, length);
  1171. return;
  1172. }
  1173. }
  1174. #endif
  1175. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1176. png_error(png_ptr, "Missing IHDR before sPLT");
  1177. else if (png_ptr->mode & PNG_HAVE_IDAT)
  1178. {
  1179. png_warning(png_ptr, "Invalid sPLT after IDAT");
  1180. png_crc_finish(png_ptr, length);
  1181. return;
  1182. }
  1183. #ifdef PNG_MAX_MALLOC_64K
  1184. if (length > (png_uint_32)65535L)
  1185. {
  1186. png_warning(png_ptr, "sPLT chunk too large to fit in memory");
  1187. skip = length - (png_uint_32)65535L;
  1188. length = (png_uint_32)65535L;
  1189. }
  1190. #endif
  1191. png_free(png_ptr, png_ptr->chunkdata);
  1192. png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
  1193. /* WARNING: this may break if size_t is less than 32 bits; it is assumed
  1194. * that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a
  1195. * potential breakage point if the types in pngconf.h aren't exactly right.
  1196. */
  1197. slength = length;
  1198. png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
  1199. if (png_crc_finish(png_ptr, skip))
  1200. {
  1201. png_free(png_ptr, png_ptr->chunkdata);
  1202. png_ptr->chunkdata = NULL;
  1203. return;
  1204. }
  1205. png_ptr->chunkdata[slength] = 0x00;
  1206. for (entry_start = (png_bytep)png_ptr->chunkdata; *entry_start;
  1207. entry_start++)
  1208. /* Empty loop to find end of name */ ;
  1209. ++entry_start;
  1210. /* A sample depth should follow the separator, and we should be on it */
  1211. if (entry_start > (png_bytep)png_ptr->chunkdata + slength - 2)
  1212. {
  1213. png_free(png_ptr, png_ptr->chunkdata);
  1214. png_ptr->chunkdata = NULL;
  1215. png_warning(png_ptr, "malformed sPLT chunk");
  1216. return;
  1217. }
  1218. new_palette.depth = *entry_start++;
  1219. entry_size = (new_palette.depth == 8 ? 6 : 10);
  1220. /* This must fit in a png_uint_32 because it is derived from the original
  1221. * chunk data length (and use 'length', not 'slength' here for clarity -
  1222. * they are guaranteed to be the same, see the tests above.)
  1223. */
  1224. data_length = length - (png_uint_32)(entry_start -
  1225. (png_bytep)png_ptr->chunkdata);
  1226. /* Integrity-check the data length */
  1227. if (data_length % entry_size)
  1228. {
  1229. png_free(png_ptr, png_ptr->chunkdata);
  1230. png_ptr->chunkdata = NULL;
  1231. png_warning(png_ptr, "sPLT chunk has bad length");
  1232. return;
  1233. }
  1234. dl = (png_int_32)(data_length / entry_size);
  1235. max_dl = PNG_SIZE_MAX / png_sizeof(png_sPLT_entry);
  1236. if (dl > max_dl)
  1237. {
  1238. png_warning(png_ptr, "sPLT chunk too long");
  1239. return;
  1240. }
  1241. new_palette.nentries = (png_int_32)(data_length / entry_size);
  1242. new_palette.entries = (png_sPLT_entryp)png_malloc_warn(
  1243. png_ptr, new_palette.nentries * png_sizeof(png_sPLT_entry));
  1244. if (new_palette.entries == NULL)
  1245. {
  1246. png_warning(png_ptr, "sPLT chunk requires too much memory");
  1247. return;
  1248. }
  1249. #ifdef PNG_POINTER_INDEXING_SUPPORTED
  1250. for (i = 0; i < new_palette.nentries; i++)
  1251. {
  1252. pp = new_palette.entries + i;
  1253. if (new_palette.depth == 8)
  1254. {
  1255. pp->red = *entry_start++;
  1256. pp->green = *entry_start++;
  1257. pp->blue = *entry_start++;
  1258. pp->alpha = *entry_start++;
  1259. }
  1260. else
  1261. {
  1262. pp->red = png_get_uint_16(entry_start); entry_start += 2;
  1263. pp->green = png_get_uint_16(entry_start); entry_start += 2;
  1264. pp->blue = png_get_uint_16(entry_start); entry_start += 2;
  1265. pp->alpha = png_get_uint_16(entry_start); entry_start += 2;
  1266. }
  1267. pp->frequency = png_get_uint_16(entry_start); entry_start += 2;
  1268. }
  1269. #else
  1270. pp = new_palette.entries;
  1271. for (i = 0; i < new_palette.nentries; i++)
  1272. {
  1273. if (new_palette.depth == 8)
  1274. {
  1275. pp[i].red = *entry_start++;
  1276. pp[i].green = *entry_start++;
  1277. pp[i].blue = *entry_start++;
  1278. pp[i].alpha = *entry_start++;
  1279. }
  1280. else
  1281. {
  1282. pp[i].red = png_get_uint_16(entry_start); entry_start += 2;
  1283. pp[i].green = png_get_uint_16(entry_start); entry_start += 2;
  1284. pp[i].blue = png_get_uint_16(entry_start); entry_start += 2;
  1285. pp[i].alpha = png_get_uint_16(entry_start); entry_start += 2;
  1286. }
  1287. pp[i].frequency = png_get_uint_16(entry_start); entry_start += 2;
  1288. }
  1289. #endif
  1290. /* Discard all chunk data except the name and stash that */
  1291. new_palette.name = png_ptr->chunkdata;
  1292. png_set_sPLT(png_ptr, info_ptr, &new_palette, 1);
  1293. png_free(png_ptr, png_ptr->chunkdata);
  1294. png_ptr->chunkdata = NULL;
  1295. png_free(png_ptr, new_palette.entries);
  1296. }
  1297. #endif /* PNG_READ_sPLT_SUPPORTED */
  1298. #ifdef PNG_READ_tRNS_SUPPORTED
  1299. void /* PRIVATE */
  1300. png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1301. {
  1302. png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
  1303. png_debug(1, "in png_handle_tRNS");
  1304. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1305. png_error(png_ptr, "Missing IHDR before tRNS");
  1306. else if (png_ptr->mode & PNG_HAVE_IDAT)
  1307. {
  1308. png_warning(png_ptr, "Invalid tRNS after IDAT");
  1309. png_crc_finish(png_ptr, length);
  1310. return;
  1311. }
  1312. else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))
  1313. {
  1314. png_warning(png_ptr, "Duplicate tRNS chunk");
  1315. png_crc_finish(png_ptr, length);
  1316. return;
  1317. }
  1318. if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
  1319. {
  1320. png_byte buf[2];
  1321. if (length != 2)
  1322. {
  1323. png_warning(png_ptr, "Incorrect tRNS chunk length");
  1324. png_crc_finish(png_ptr, length);
  1325. return;
  1326. }
  1327. png_crc_read(png_ptr, buf, 2);
  1328. png_ptr->num_trans = 1;
  1329. png_ptr->trans_color.gray = png_get_uint_16(buf);
  1330. }
  1331. else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
  1332. {
  1333. png_byte buf[6];
  1334. if (length != 6)
  1335. {
  1336. png_warning(png_ptr, "Incorrect tRNS chunk length");
  1337. png_crc_finish(png_ptr, length);
  1338. return;
  1339. }
  1340. png_crc_read(png_ptr, buf, (png_size_t)length);
  1341. png_ptr->num_trans = 1;
  1342. png_ptr->trans_color.red = png_get_uint_16(buf);
  1343. png_ptr->trans_color.green = png_get_uint_16(buf + 2);
  1344. png_ptr->trans_color.blue = png_get_uint_16(buf + 4);
  1345. }
  1346. else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  1347. {
  1348. if (!(png_ptr->mode & PNG_HAVE_PLTE))
  1349. {
  1350. /* Should be an error, but we can cope with it. */
  1351. png_warning(png_ptr, "Missing PLTE before tRNS");
  1352. }
  1353. if (length > (png_uint_32)png_ptr->num_palette ||
  1354. length > PNG_MAX_PALETTE_LENGTH)
  1355. {
  1356. png_warning(png_ptr, "Incorrect tRNS chunk length");
  1357. png_crc_finish(png_ptr, length);
  1358. return;
  1359. }
  1360. if (length == 0)
  1361. {
  1362. png_warning(png_ptr, "Zero length tRNS chunk");
  1363. png_crc_finish(png_ptr, length);
  1364. return;
  1365. }
  1366. png_crc_read(png_ptr, readbuf, (png_size_t)length);
  1367. png_ptr->num_trans = (png_uint_16)length;
  1368. }
  1369. else
  1370. {
  1371. png_warning(png_ptr, "tRNS chunk not allowed with alpha channel");
  1372. png_crc_finish(png_ptr, length);
  1373. return;
  1374. }
  1375. if (png_crc_finish(png_ptr, 0))
  1376. {
  1377. png_ptr->num_trans = 0;
  1378. return;
  1379. }
  1380. png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
  1381. &(png_ptr->trans_color));
  1382. }
  1383. #endif
  1384. #ifdef PNG_READ_bKGD_SUPPORTED
  1385. void /* PRIVATE */
  1386. png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1387. {
  1388. png_size_t truelen;
  1389. png_byte buf[6];
  1390. png_color_16 background;
  1391. png_debug(1, "in png_handle_bKGD");
  1392. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1393. png_error(png_ptr, "Missing IHDR before bKGD");
  1394. else if (png_ptr->mode & PNG_HAVE_IDAT)
  1395. {
  1396. png_warning(png_ptr, "Invalid bKGD after IDAT");
  1397. png_crc_finish(png_ptr, length);
  1398. return;
  1399. }
  1400. else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  1401. !(png_ptr->mode & PNG_HAVE_PLTE))
  1402. {
  1403. png_warning(png_ptr, "Missing PLTE before bKGD");
  1404. png_crc_finish(png_ptr, length);
  1405. return;
  1406. }
  1407. else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD))
  1408. {
  1409. png_warning(png_ptr, "Duplicate bKGD chunk");
  1410. png_crc_finish(png_ptr, length);
  1411. return;
  1412. }
  1413. if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  1414. truelen = 1;
  1415. else if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)
  1416. truelen = 6;
  1417. else
  1418. truelen = 2;
  1419. if (length != truelen)
  1420. {
  1421. png_warning(png_ptr, "Incorrect bKGD chunk length");
  1422. png_crc_finish(png_ptr, length);
  1423. return;
  1424. }
  1425. png_crc_read(png_ptr, buf, truelen);
  1426. if (png_crc_finish(png_ptr, 0))
  1427. return;
  1428. /* We convert the index value into RGB components so that we can allow
  1429. * arbitrary RGB values for background when we have transparency, and
  1430. * so it is easy to determine the RGB values of the background color
  1431. * from the info_ptr struct.
  1432. */
  1433. if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  1434. {
  1435. background.index = buf[0];
  1436. if (info_ptr && info_ptr->num_palette)
  1437. {
  1438. if (buf[0] >= info_ptr->num_palette)
  1439. {
  1440. png_warning(png_ptr, "Incorrect bKGD chunk index value");
  1441. return;
  1442. }
  1443. background.red = (png_uint_16)png_ptr->palette[buf[0]].red;
  1444. background.green = (png_uint_16)png_ptr->palette[buf[0]].green;
  1445. background.blue = (png_uint_16)png_ptr->palette[buf[0]].blue;
  1446. }
  1447. else
  1448. background.red = background.green = background.blue = 0;
  1449. background.gray = 0;
  1450. }
  1451. else if (!(png_ptr->color_type & PNG_COLOR_MASK_COLOR)) /* GRAY */
  1452. {
  1453. background.index = 0;
  1454. background.red =
  1455. background.green =
  1456. background.blue =
  1457. background.gray = png_get_uint_16(buf);
  1458. }
  1459. else
  1460. {
  1461. background.index = 0;
  1462. background.red = png_get_uint_16(buf);
  1463. background.green = png_get_uint_16(buf + 2);
  1464. background.blue = png_get_uint_16(buf + 4);
  1465. background.gray = 0;
  1466. }
  1467. png_set_bKGD(png_ptr, info_ptr, &background);
  1468. }
  1469. #endif
  1470. #ifdef PNG_READ_hIST_SUPPORTED
  1471. void /* PRIVATE */
  1472. png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1473. {
  1474. unsigned int num, i;
  1475. png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
  1476. png_debug(1, "in png_handle_hIST");
  1477. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1478. png_error(png_ptr, "Missing IHDR before hIST");
  1479. else if (png_ptr->mode & PNG_HAVE_IDAT)
  1480. {
  1481. png_warning(png_ptr, "Invalid hIST after IDAT");
  1482. png_crc_finish(png_ptr, length);
  1483. return;
  1484. }
  1485. else if (!(png_ptr->mode & PNG_HAVE_PLTE))
  1486. {
  1487. png_warning(png_ptr, "Missing PLTE before hIST");
  1488. png_crc_finish(png_ptr, length);
  1489. return;
  1490. }
  1491. else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST))
  1492. {
  1493. png_warning(png_ptr, "Duplicate hIST chunk");
  1494. png_crc_finish(png_ptr, length);
  1495. return;
  1496. }
  1497. num = length / 2 ;
  1498. if (num != (unsigned int)png_ptr->num_palette || num >
  1499. (unsigned int)PNG_MAX_PALETTE_LENGTH)
  1500. {
  1501. png_warning(png_ptr, "Incorrect hIST chunk length");
  1502. png_crc_finish(png_ptr, length);
  1503. return;
  1504. }
  1505. for (i = 0; i < num; i++)
  1506. {
  1507. png_byte buf[2];
  1508. png_crc_read(png_ptr, buf, 2);
  1509. readbuf[i] = png_get_uint_16(buf);
  1510. }
  1511. if (png_crc_finish(png_ptr, 0))
  1512. return;
  1513. png_set_hIST(png_ptr, info_ptr, readbuf);
  1514. }
  1515. #endif
  1516. #ifdef PNG_READ_pHYs_SUPPORTED
  1517. void /* PRIVATE */
  1518. png_handle_pHYs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1519. {
  1520. png_byte buf[9];
  1521. png_uint_32 res_x, res_y;
  1522. int unit_type;
  1523. png_debug(1, "in png_handle_pHYs");
  1524. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1525. png_error(png_ptr, "Missing IHDR before pHYs");
  1526. else if (png_ptr->mode & PNG_HAVE_IDAT)
  1527. {
  1528. png_warning(png_ptr, "Invalid pHYs after IDAT");
  1529. png_crc_finish(png_ptr, length);
  1530. return;
  1531. }
  1532. else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs))
  1533. {
  1534. png_warning(png_ptr, "Duplicate pHYs chunk");
  1535. png_crc_finish(png_ptr, length);
  1536. return;
  1537. }
  1538. if (length != 9)
  1539. {
  1540. png_warning(png_ptr, "Incorrect pHYs chunk length");
  1541. png_crc_finish(png_ptr, length);
  1542. return;
  1543. }
  1544. png_crc_read(png_ptr, buf, 9);
  1545. if (png_crc_finish(png_ptr, 0))
  1546. return;
  1547. res_x = png_get_uint_32(buf);
  1548. res_y = png_get_uint_32(buf + 4);
  1549. unit_type = buf[8];
  1550. png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type);
  1551. }
  1552. #endif
  1553. #ifdef PNG_READ_oFFs_SUPPORTED
  1554. void /* PRIVATE */
  1555. png_handle_oFFs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1556. {
  1557. png_byte buf[9];
  1558. png_int_32 offset_x, offset_y;
  1559. int unit_type;
  1560. png_debug(1, "in png_handle_oFFs");
  1561. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1562. png_error(png_ptr, "Missing IHDR before oFFs");
  1563. else if (png_ptr->mode & PNG_HAVE_IDAT)
  1564. {
  1565. png_warning(png_ptr, "Invalid oFFs after IDAT");
  1566. png_crc_finish(png_ptr, length);
  1567. return;
  1568. }
  1569. else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs))
  1570. {
  1571. png_warning(png_ptr, "Duplicate oFFs chunk");
  1572. png_crc_finish(png_ptr, length);
  1573. return;
  1574. }
  1575. if (length != 9)
  1576. {
  1577. png_warning(png_ptr, "Incorrect oFFs chunk length");
  1578. png_crc_finish(png_ptr, length);
  1579. return;
  1580. }
  1581. png_crc_read(png_ptr, buf, 9);
  1582. if (png_crc_finish(png_ptr, 0))
  1583. return;
  1584. offset_x = png_get_int_32(buf);
  1585. offset_y = png_get_int_32(buf + 4);
  1586. unit_type = buf[8];
  1587. png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type);
  1588. }
  1589. #endif
  1590. #ifdef PNG_READ_pCAL_SUPPORTED
  1591. /* Read the pCAL chunk (described in the PNG Extensions document) */
  1592. void /* PRIVATE */
  1593. png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1594. {
  1595. png_int_32 X0, X1;
  1596. png_byte type, nparams;
  1597. png_charp buf, units, endptr;
  1598. png_charpp params;
  1599. png_size_t slength;
  1600. int i;
  1601. png_debug(1, "in png_handle_pCAL");
  1602. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1603. png_error(png_ptr, "Missing IHDR before pCAL");
  1604. else if (png_ptr->mode & PNG_HAVE_IDAT)
  1605. {
  1606. png_warning(png_ptr, "Invalid pCAL after IDAT");
  1607. png_crc_finish(png_ptr, length);
  1608. return;
  1609. }
  1610. else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL))
  1611. {
  1612. png_warning(png_ptr, "Duplicate pCAL chunk");
  1613. png_crc_finish(png_ptr, length);
  1614. return;
  1615. }
  1616. png_debug1(2, "Allocating and reading pCAL chunk data (%u bytes)",
  1617. length + 1);
  1618. png_free(png_ptr, png_ptr->chunkdata);
  1619. png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
  1620. if (png_ptr->chunkdata == NULL)
  1621. {
  1622. png_warning(png_ptr, "No memory for pCAL purpose");
  1623. return;
  1624. }
  1625. slength = length;
  1626. png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
  1627. if (png_crc_finish(png_ptr, 0))
  1628. {
  1629. png_free(png_ptr, png_ptr->chunkdata);
  1630. png_ptr->chunkdata = NULL;
  1631. return;
  1632. }
  1633. png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */
  1634. png_debug(3, "Finding end of pCAL purpose string");
  1635. for (buf = png_ptr->chunkdata; *buf; buf++)
  1636. /* Empty loop */ ;
  1637. endptr = png_ptr->chunkdata + slength;
  1638. /* We need to have at least 12 bytes after the purpose string
  1639. * in order to get the parameter information.
  1640. */
  1641. if (endptr <= buf + 12)
  1642. {
  1643. png_warning(png_ptr, "Invalid pCAL data");
  1644. png_free(png_ptr, png_ptr->chunkdata);
  1645. png_ptr->chunkdata = NULL;
  1646. return;
  1647. }
  1648. png_debug(3, "Reading pCAL X0, X1, type, nparams, and units");
  1649. X0 = png_get_int_32((png_bytep)buf+1);
  1650. X1 = png_get_int_32((png_bytep)buf+5);
  1651. type = buf[9];
  1652. nparams = buf[10];
  1653. units = buf + 11;
  1654. png_debug(3, "Checking pCAL equation type and number of parameters");
  1655. /* Check that we have the right number of parameters for known
  1656. * equation types.
  1657. */
  1658. if ((type == PNG_EQUATION_LINEAR && nparams != 2) ||
  1659. (type == PNG_EQUATION_BASE_E && nparams != 3) ||
  1660. (type == PNG_EQUATION_ARBITRARY && nparams != 3) ||
  1661. (type == PNG_EQUATION_HYPERBOLIC && nparams != 4))
  1662. {
  1663. png_warning(png_ptr, "Invalid pCAL parameters for equation type");
  1664. png_free(png_ptr, png_ptr->chunkdata);
  1665. png_ptr->chunkdata = NULL;
  1666. return;
  1667. }
  1668. else if (type >= PNG_EQUATION_LAST)
  1669. {
  1670. png_warning(png_ptr, "Unrecognized equation type for pCAL chunk");
  1671. }
  1672. for (buf = units; *buf; buf++)
  1673. /* Empty loop to move past the units string. */ ;
  1674. png_debug(3, "Allocating pCAL parameters array");
  1675. params = (png_charpp)png_malloc_warn(png_ptr,
  1676. (png_size_t)(nparams * png_sizeof(png_charp)));
  1677. if (params == NULL)
  1678. {
  1679. png_free(png_ptr, png_ptr->chunkdata);
  1680. png_ptr->chunkdata = NULL;
  1681. png_warning(png_ptr, "No memory for pCAL params");
  1682. return;
  1683. }
  1684. /* Get pointers to the start of each parameter string. */
  1685. for (i = 0; i < (int)nparams; i++)
  1686. {
  1687. buf++; /* Skip the null string terminator from previous parameter. */
  1688. png_debug1(3, "Reading pCAL parameter %d", i);
  1689. for (params[i] = buf; buf <= endptr && *buf != 0x00; buf++)
  1690. /* Empty loop to move past each parameter string */ ;
  1691. /* Make sure we haven't run out of data yet */
  1692. if (buf > endptr)
  1693. {
  1694. png_warning(png_ptr, "Invalid pCAL data");
  1695. png_free(png_ptr, png_ptr->chunkdata);
  1696. png_ptr->chunkdata = NULL;
  1697. png_free(png_ptr, params);
  1698. return;
  1699. }
  1700. }
  1701. png_set_pCAL(png_ptr, info_ptr, png_ptr->chunkdata, X0, X1, type, nparams,
  1702. units, params);
  1703. png_free(png_ptr, png_ptr->chunkdata);
  1704. png_ptr->chunkdata = NULL;
  1705. png_free(png_ptr, params);
  1706. }
  1707. #endif
  1708. #ifdef PNG_READ_sCAL_SUPPORTED
  1709. /* Read the sCAL chunk */
  1710. void /* PRIVATE */
  1711. png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1712. {
  1713. png_size_t slength, i;
  1714. int state;
  1715. png_debug(1, "in png_handle_sCAL");
  1716. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1717. png_error(png_ptr, "Missing IHDR before sCAL");
  1718. else if (png_ptr->mode & PNG_HAVE_IDAT)
  1719. {
  1720. png_warning(png_ptr, "Invalid sCAL after IDAT");
  1721. png_crc_finish(png_ptr, length);
  1722. return;
  1723. }
  1724. else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL))
  1725. {
  1726. png_warning(png_ptr, "Duplicate sCAL chunk");
  1727. png_crc_finish(png_ptr, length);
  1728. return;
  1729. }
  1730. /* Need unit type, width, \0, height: minimum 4 bytes */
  1731. else if (length < 4)
  1732. {
  1733. png_warning(png_ptr, "sCAL chunk too short");
  1734. png_crc_finish(png_ptr, length);
  1735. return;
  1736. }
  1737. png_debug1(2, "Allocating and reading sCAL chunk data (%u bytes)",
  1738. length + 1);
  1739. png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
  1740. if (png_ptr->chunkdata == NULL)
  1741. {
  1742. png_warning(png_ptr, "Out of memory while processing sCAL chunk");
  1743. png_crc_finish(png_ptr, length);
  1744. return;
  1745. }
  1746. slength = length;
  1747. png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
  1748. png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */
  1749. if (png_crc_finish(png_ptr, 0))
  1750. {
  1751. png_free(png_ptr, png_ptr->chunkdata);
  1752. png_ptr->chunkdata = NULL;
  1753. return;
  1754. }
  1755. /* Validate the unit. */
  1756. if (png_ptr->chunkdata[0] != 1 && png_ptr->chunkdata[0] != 2)
  1757. {
  1758. png_warning(png_ptr, "Invalid sCAL ignored: invalid unit");
  1759. png_free(png_ptr, png_ptr->chunkdata);
  1760. png_ptr->chunkdata = NULL;
  1761. return;
  1762. }
  1763. /* Validate the ASCII numbers, need two ASCII numbers separated by
  1764. * a '\0' and they need to fit exactly in the chunk data.
  1765. */
  1766. i = 1;
  1767. state = 0;
  1768. if (!png_check_fp_number(png_ptr->chunkdata, slength, &state, &i) ||
  1769. i >= slength || png_ptr->chunkdata[i++] != 0)
  1770. png_warning(png_ptr, "Invalid sCAL chunk ignored: bad width format");
  1771. else if (!PNG_FP_IS_POSITIVE(state))
  1772. png_warning(png_ptr, "Invalid sCAL chunk ignored: non-positive width");
  1773. else
  1774. {
  1775. png_size_t heighti = i;
  1776. state = 0;
  1777. if (!png_check_fp_number(png_ptr->chunkdata, slength, &state, &i) ||
  1778. i != slength)
  1779. png_warning(png_ptr, "Invalid sCAL chunk ignored: bad height format");
  1780. else if (!PNG_FP_IS_POSITIVE(state))
  1781. png_warning(png_ptr,
  1782. "Invalid sCAL chunk ignored: non-positive height");
  1783. else
  1784. /* This is the (only) success case. */
  1785. png_set_sCAL_s(png_ptr, info_ptr, png_ptr->chunkdata[0],
  1786. png_ptr->chunkdata+1, png_ptr->chunkdata+heighti);
  1787. }
  1788. /* Clean up - just free the temporarily allocated buffer. */
  1789. png_free(png_ptr, png_ptr->chunkdata);
  1790. png_ptr->chunkdata = NULL;
  1791. }
  1792. #endif
  1793. #ifdef PNG_READ_tIME_SUPPORTED
  1794. void /* PRIVATE */
  1795. png_handle_tIME(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1796. {
  1797. png_byte buf[7];
  1798. png_time mod_time;
  1799. png_debug(1, "in png_handle_tIME");
  1800. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1801. png_error(png_ptr, "Out of place tIME chunk");
  1802. else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME))
  1803. {
  1804. png_warning(png_ptr, "Duplicate tIME chunk");
  1805. png_crc_finish(png_ptr, length);
  1806. return;
  1807. }
  1808. if (png_ptr->mode & PNG_HAVE_IDAT)
  1809. png_ptr->mode |= PNG_AFTER_IDAT;
  1810. if (length != 7)
  1811. {
  1812. png_warning(png_ptr, "Incorrect tIME chunk length");
  1813. png_crc_finish(png_ptr, length);
  1814. return;
  1815. }
  1816. png_crc_read(png_ptr, buf, 7);
  1817. if (png_crc_finish(png_ptr, 0))
  1818. return;
  1819. mod_time.second = buf[6];
  1820. mod_time.minute = buf[5];
  1821. mod_time.hour = buf[4];
  1822. mod_time.day = buf[3];
  1823. mod_time.month = buf[2];
  1824. mod_time.year = png_get_uint_16(buf);
  1825. png_set_tIME(png_ptr, info_ptr, &mod_time);
  1826. }
  1827. #endif
  1828. #ifdef PNG_READ_tEXt_SUPPORTED
  1829. /* Note: this does not properly handle chunks that are > 64K under DOS */
  1830. void /* PRIVATE */
  1831. png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1832. {
  1833. png_textp text_ptr;
  1834. png_charp key;
  1835. png_charp text;
  1836. png_uint_32 skip = 0;
  1837. png_size_t slength;
  1838. int ret;
  1839. png_debug(1, "in png_handle_tEXt");
  1840. #ifdef PNG_USER_LIMITS_SUPPORTED
  1841. if (png_ptr->user_chunk_cache_max != 0)
  1842. {
  1843. if (png_ptr->user_chunk_cache_max == 1)
  1844. {
  1845. png_crc_finish(png_ptr, length);
  1846. return;
  1847. }
  1848. if (--png_ptr->user_chunk_cache_max == 1)
  1849. {
  1850. png_warning(png_ptr, "No space in chunk cache for tEXt");
  1851. png_crc_finish(png_ptr, length);
  1852. return;
  1853. }
  1854. }
  1855. #endif
  1856. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1857. png_error(png_ptr, "Missing IHDR before tEXt");
  1858. if (png_ptr->mode & PNG_HAVE_IDAT)
  1859. png_ptr->mode |= PNG_AFTER_IDAT;
  1860. #ifdef PNG_MAX_MALLOC_64K
  1861. if (length > (png_uint_32)65535L)
  1862. {
  1863. png_warning(png_ptr, "tEXt chunk too large to fit in memory");
  1864. skip = length - (png_uint_32)65535L;
  1865. length = (png_uint_32)65535L;
  1866. }
  1867. #endif
  1868. png_free(png_ptr, png_ptr->chunkdata);
  1869. png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
  1870. if (png_ptr->chunkdata == NULL)
  1871. {
  1872. png_warning(png_ptr, "No memory to process text chunk");
  1873. return;
  1874. }
  1875. slength = length;
  1876. png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
  1877. if (png_crc_finish(png_ptr, skip))
  1878. {
  1879. png_free(png_ptr, png_ptr->chunkdata);
  1880. png_ptr->chunkdata = NULL;
  1881. return;
  1882. }
  1883. key = png_ptr->chunkdata;
  1884. key[slength] = 0x00;
  1885. for (text = key; *text; text++)
  1886. /* Empty loop to find end of key */ ;
  1887. if (text != key + slength)
  1888. text++;
  1889. text_ptr = (png_textp)png_malloc_warn(png_ptr,
  1890. png_sizeof(png_text));
  1891. if (text_ptr == NULL)
  1892. {
  1893. png_warning(png_ptr, "Not enough memory to process text chunk");
  1894. png_free(png_ptr, png_ptr->chunkdata);
  1895. png_ptr->chunkdata = NULL;
  1896. return;
  1897. }
  1898. text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
  1899. text_ptr->key = key;
  1900. text_ptr->lang = NULL;
  1901. text_ptr->lang_key = NULL;
  1902. text_ptr->itxt_length = 0;
  1903. text_ptr->text = text;
  1904. text_ptr->text_length = png_strlen(text);
  1905. ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
  1906. png_free(png_ptr, png_ptr->chunkdata);
  1907. png_ptr->chunkdata = NULL;
  1908. png_free(png_ptr, text_ptr);
  1909. if (ret)
  1910. png_warning(png_ptr, "Insufficient memory to process text chunk");
  1911. }
  1912. #endif
  1913. #ifdef PNG_READ_zTXt_SUPPORTED
  1914. /* Note: this does not correctly handle chunks that are > 64K under DOS */
  1915. void /* PRIVATE */
  1916. png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  1917. {
  1918. png_textp text_ptr;
  1919. png_charp text;
  1920. int comp_type;
  1921. int ret;
  1922. png_size_t slength, prefix_len, data_len;
  1923. png_debug(1, "in png_handle_zTXt");
  1924. #ifdef PNG_USER_LIMITS_SUPPORTED
  1925. if (png_ptr->user_chunk_cache_max != 0)
  1926. {
  1927. if (png_ptr->user_chunk_cache_max == 1)
  1928. {
  1929. png_crc_finish(png_ptr, length);
  1930. return;
  1931. }
  1932. if (--png_ptr->user_chunk_cache_max == 1)
  1933. {
  1934. png_warning(png_ptr, "No space in chunk cache for zTXt");
  1935. png_crc_finish(png_ptr, length);
  1936. return;
  1937. }
  1938. }
  1939. #endif
  1940. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  1941. png_error(png_ptr, "Missing IHDR before zTXt");
  1942. if (png_ptr->mode & PNG_HAVE_IDAT)
  1943. png_ptr->mode |= PNG_AFTER_IDAT;
  1944. #ifdef PNG_MAX_MALLOC_64K
  1945. /* We will no doubt have problems with chunks even half this size, but
  1946. * there is no hard and fast rule to tell us where to stop.
  1947. */
  1948. if (length > (png_uint_32)65535L)
  1949. {
  1950. png_warning(png_ptr, "zTXt chunk too large to fit in memory");
  1951. png_crc_finish(png_ptr, length);
  1952. return;
  1953. }
  1954. #endif
  1955. png_free(png_ptr, png_ptr->chunkdata);
  1956. png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
  1957. if (png_ptr->chunkdata == NULL)
  1958. {
  1959. png_warning(png_ptr, "Out of memory processing zTXt chunk");
  1960. return;
  1961. }
  1962. slength = length;
  1963. png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
  1964. if (png_crc_finish(png_ptr, 0))
  1965. {
  1966. png_free(png_ptr, png_ptr->chunkdata);
  1967. png_ptr->chunkdata = NULL;
  1968. return;
  1969. }
  1970. png_ptr->chunkdata[slength] = 0x00;
  1971. for (text = png_ptr->chunkdata; *text; text++)
  1972. /* Empty loop */ ;
  1973. /* zTXt must have some text after the chunkdataword */
  1974. if (text >= png_ptr->chunkdata + slength - 2)
  1975. {
  1976. png_warning(png_ptr, "Truncated zTXt chunk");
  1977. png_free(png_ptr, png_ptr->chunkdata);
  1978. png_ptr->chunkdata = NULL;
  1979. return;
  1980. }
  1981. else
  1982. {
  1983. comp_type = *(++text);
  1984. if (comp_type != PNG_TEXT_COMPRESSION_zTXt)
  1985. {
  1986. png_warning(png_ptr, "Unknown compression type in zTXt chunk");
  1987. comp_type = PNG_TEXT_COMPRESSION_zTXt;
  1988. }
  1989. text++; /* Skip the compression_method byte */
  1990. }
  1991. prefix_len = text - png_ptr->chunkdata;
  1992. png_decompress_chunk(png_ptr, comp_type,
  1993. (png_size_t)length, prefix_len, &data_len);
  1994. text_ptr = (png_textp)png_malloc_warn(png_ptr,
  1995. png_sizeof(png_text));
  1996. if (text_ptr == NULL)
  1997. {
  1998. png_warning(png_ptr, "Not enough memory to process zTXt chunk");
  1999. png_free(png_ptr, png_ptr->chunkdata);
  2000. png_ptr->chunkdata = NULL;
  2001. return;
  2002. }
  2003. text_ptr->compression = comp_type;
  2004. text_ptr->key = png_ptr->chunkdata;
  2005. text_ptr->lang = NULL;
  2006. text_ptr->lang_key = NULL;
  2007. text_ptr->itxt_length = 0;
  2008. text_ptr->text = png_ptr->chunkdata + prefix_len;
  2009. text_ptr->text_length = data_len;
  2010. ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
  2011. png_free(png_ptr, text_ptr);
  2012. png_free(png_ptr, png_ptr->chunkdata);
  2013. png_ptr->chunkdata = NULL;
  2014. if (ret)
  2015. png_error(png_ptr, "Insufficient memory to store zTXt chunk");
  2016. }
  2017. #endif
  2018. #ifdef PNG_READ_iTXt_SUPPORTED
  2019. /* Note: this does not correctly handle chunks that are > 64K under DOS */
  2020. void /* PRIVATE */
  2021. png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  2022. {
  2023. png_textp text_ptr;
  2024. png_charp key, lang, text, lang_key;
  2025. int comp_flag;
  2026. int comp_type = 0;
  2027. int ret;
  2028. png_size_t slength, prefix_len, data_len;
  2029. png_debug(1, "in png_handle_iTXt");
  2030. #ifdef PNG_USER_LIMITS_SUPPORTED
  2031. if (png_ptr->user_chunk_cache_max != 0)
  2032. {
  2033. if (png_ptr->user_chunk_cache_max == 1)
  2034. {
  2035. png_crc_finish(png_ptr, length);
  2036. return;
  2037. }
  2038. if (--png_ptr->user_chunk_cache_max == 1)
  2039. {
  2040. png_warning(png_ptr, "No space in chunk cache for iTXt");
  2041. png_crc_finish(png_ptr, length);
  2042. return;
  2043. }
  2044. }
  2045. #endif
  2046. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  2047. png_error(png_ptr, "Missing IHDR before iTXt");
  2048. if (png_ptr->mode & PNG_HAVE_IDAT)
  2049. png_ptr->mode |= PNG_AFTER_IDAT;
  2050. #ifdef PNG_MAX_MALLOC_64K
  2051. /* We will no doubt have problems with chunks even half this size, but
  2052. * there is no hard and fast rule to tell us where to stop.
  2053. */
  2054. if (length > (png_uint_32)65535L)
  2055. {
  2056. png_warning(png_ptr, "iTXt chunk too large to fit in memory");
  2057. png_crc_finish(png_ptr, length);
  2058. return;
  2059. }
  2060. #endif
  2061. png_free(png_ptr, png_ptr->chunkdata);
  2062. png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
  2063. if (png_ptr->chunkdata == NULL)
  2064. {
  2065. png_warning(png_ptr, "No memory to process iTXt chunk");
  2066. return;
  2067. }
  2068. slength = length;
  2069. png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
  2070. if (png_crc_finish(png_ptr, 0))
  2071. {
  2072. png_free(png_ptr, png_ptr->chunkdata);
  2073. png_ptr->chunkdata = NULL;
  2074. return;
  2075. }
  2076. png_ptr->chunkdata[slength] = 0x00;
  2077. for (lang = png_ptr->chunkdata; *lang; lang++)
  2078. /* Empty loop */ ;
  2079. lang++; /* Skip NUL separator */
  2080. /* iTXt must have a language tag (possibly empty), two compression bytes,
  2081. * translated keyword (possibly empty), and possibly some text after the
  2082. * keyword
  2083. */
  2084. if (lang >= png_ptr->chunkdata + slength - 3)
  2085. {
  2086. png_warning(png_ptr, "Truncated iTXt chunk");
  2087. png_free(png_ptr, png_ptr->chunkdata);
  2088. png_ptr->chunkdata = NULL;
  2089. return;
  2090. }
  2091. else
  2092. {
  2093. comp_flag = *lang++;
  2094. comp_type = *lang++;
  2095. }
  2096. if (comp_type || (comp_flag && comp_flag != PNG_TEXT_COMPRESSION_zTXt))
  2097. {
  2098. png_warning(png_ptr, "Unknown iTXt compression type or method");
  2099. png_free(png_ptr, png_ptr->chunkdata);
  2100. png_ptr->chunkdata = NULL;
  2101. return;
  2102. }
  2103. for (lang_key = lang; *lang_key; lang_key++)
  2104. /* Empty loop */ ;
  2105. lang_key++; /* Skip NUL separator */
  2106. if (lang_key >= png_ptr->chunkdata + slength)
  2107. {
  2108. png_warning(png_ptr, "Truncated iTXt chunk");
  2109. png_free(png_ptr, png_ptr->chunkdata);
  2110. png_ptr->chunkdata = NULL;
  2111. return;
  2112. }
  2113. for (text = lang_key; *text; text++)
  2114. /* Empty loop */ ;
  2115. text++; /* Skip NUL separator */
  2116. if (text >= png_ptr->chunkdata + slength)
  2117. {
  2118. png_warning(png_ptr, "Malformed iTXt chunk");
  2119. png_free(png_ptr, png_ptr->chunkdata);
  2120. png_ptr->chunkdata = NULL;
  2121. return;
  2122. }
  2123. prefix_len = text - png_ptr->chunkdata;
  2124. key=png_ptr->chunkdata;
  2125. if (comp_flag)
  2126. png_decompress_chunk(png_ptr, comp_type,
  2127. (size_t)length, prefix_len, &data_len);
  2128. else
  2129. data_len = png_strlen(png_ptr->chunkdata + prefix_len);
  2130. text_ptr = (png_textp)png_malloc_warn(png_ptr,
  2131. png_sizeof(png_text));
  2132. if (text_ptr == NULL)
  2133. {
  2134. png_warning(png_ptr, "Not enough memory to process iTXt chunk");
  2135. png_free(png_ptr, png_ptr->chunkdata);
  2136. png_ptr->chunkdata = NULL;
  2137. return;
  2138. }
  2139. text_ptr->compression = (int)comp_flag + 1;
  2140. text_ptr->lang_key = png_ptr->chunkdata + (lang_key - key);
  2141. text_ptr->lang = png_ptr->chunkdata + (lang - key);
  2142. text_ptr->itxt_length = data_len;
  2143. text_ptr->text_length = 0;
  2144. text_ptr->key = png_ptr->chunkdata;
  2145. text_ptr->text = png_ptr->chunkdata + prefix_len;
  2146. ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
  2147. png_free(png_ptr, text_ptr);
  2148. png_free(png_ptr, png_ptr->chunkdata);
  2149. png_ptr->chunkdata = NULL;
  2150. if (ret)
  2151. png_error(png_ptr, "Insufficient memory to store iTXt chunk");
  2152. }
  2153. #endif
  2154. /* This function is called when we haven't found a handler for a
  2155. * chunk. If there isn't a problem with the chunk itself (ie bad
  2156. * chunk name, CRC, or a critical chunk), the chunk is silently ignored
  2157. * -- unless the PNG_FLAG_UNKNOWN_CHUNKS_SUPPORTED flag is on in which
  2158. * case it will be saved away to be written out later.
  2159. */
  2160. void /* PRIVATE */
  2161. png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
  2162. {
  2163. png_uint_32 skip = 0;
  2164. png_debug(1, "in png_handle_unknown");
  2165. #ifdef PNG_USER_LIMITS_SUPPORTED
  2166. if (png_ptr->user_chunk_cache_max != 0)
  2167. {
  2168. if (png_ptr->user_chunk_cache_max == 1)
  2169. {
  2170. png_crc_finish(png_ptr, length);
  2171. return;
  2172. }
  2173. if (--png_ptr->user_chunk_cache_max == 1)
  2174. {
  2175. png_warning(png_ptr, "No space in chunk cache for unknown chunk");
  2176. png_crc_finish(png_ptr, length);
  2177. return;
  2178. }
  2179. }
  2180. #endif
  2181. if (png_ptr->mode & PNG_HAVE_IDAT)
  2182. {
  2183. if (png_ptr->chunk_name != png_IDAT)
  2184. png_ptr->mode |= PNG_AFTER_IDAT;
  2185. }
  2186. if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
  2187. {
  2188. #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  2189. if (png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name) !=
  2190. PNG_HANDLE_CHUNK_ALWAYS
  2191. #ifdef PNG_READ_USER_CHUNKS_SUPPORTED
  2192. && png_ptr->read_user_chunk_fn == NULL
  2193. #endif
  2194. )
  2195. #endif
  2196. png_chunk_error(png_ptr, "unknown critical chunk");
  2197. }
  2198. #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
  2199. if ((png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
  2200. #ifdef PNG_READ_USER_CHUNKS_SUPPORTED
  2201. || (png_ptr->read_user_chunk_fn != NULL)
  2202. #endif
  2203. )
  2204. {
  2205. #ifdef PNG_MAX_MALLOC_64K
  2206. if (length > 65535)
  2207. {
  2208. png_warning(png_ptr, "unknown chunk too large to fit in memory");
  2209. skip = length - 65535;
  2210. length = 65535;
  2211. }
  2212. #endif
  2213. /* TODO: this code is very close to the unknown handling in pngpread.c,
  2214. * maybe it can be put into a common utility routine?
  2215. * png_struct::unknown_chunk is just used as a temporary variable, along
  2216. * with the data into which the chunk is read. These can be eliminated.
  2217. */
  2218. PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
  2219. png_ptr->unknown_chunk.size = (png_size_t)length;
  2220. if (length == 0)
  2221. png_ptr->unknown_chunk.data = NULL;
  2222. else
  2223. {
  2224. png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length);
  2225. png_crc_read(png_ptr, png_ptr->unknown_chunk.data, length);
  2226. }
  2227. #ifdef PNG_READ_USER_CHUNKS_SUPPORTED
  2228. if (png_ptr->read_user_chunk_fn != NULL)
  2229. {
  2230. /* Callback to user unknown chunk handler */
  2231. int ret;
  2232. ret = (*(png_ptr->read_user_chunk_fn))
  2233. (png_ptr, &png_ptr->unknown_chunk);
  2234. if (ret < 0)
  2235. png_chunk_error(png_ptr, "error in user chunk");
  2236. if (ret == 0)
  2237. {
  2238. if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
  2239. {
  2240. #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  2241. if (png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name) !=
  2242. PNG_HANDLE_CHUNK_ALWAYS)
  2243. #endif
  2244. png_chunk_error(png_ptr, "unknown critical chunk");
  2245. }
  2246. png_set_unknown_chunks(png_ptr, info_ptr,
  2247. &png_ptr->unknown_chunk, 1);
  2248. }
  2249. }
  2250. else
  2251. #endif
  2252. png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
  2253. png_free(png_ptr, png_ptr->unknown_chunk.data);
  2254. png_ptr->unknown_chunk.data = NULL;
  2255. }
  2256. else
  2257. #endif
  2258. skip = length;
  2259. png_crc_finish(png_ptr, skip);
  2260. #ifndef PNG_READ_USER_CHUNKS_SUPPORTED
  2261. PNG_UNUSED(info_ptr) /* Quiet compiler warnings about unused info_ptr */
  2262. #endif
  2263. }
  2264. /* This function is called to verify that a chunk name is valid.
  2265. * This function can't have the "critical chunk check" incorporated
  2266. * into it, since in the future we will need to be able to call user
  2267. * functions to handle unknown critical chunks after we check that
  2268. * the chunk name itself is valid.
  2269. */
  2270. /* Bit hacking: the test for an invalid byte in the 4 byte chunk name is:
  2271. *
  2272. * ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))
  2273. */
  2274. void /* PRIVATE */
  2275. png_check_chunk_name(png_structp png_ptr, png_uint_32 chunk_name)
  2276. {
  2277. int i;
  2278. png_debug(1, "in png_check_chunk_name");
  2279. for (i=1; i<=4; ++i)
  2280. {
  2281. int c = chunk_name & 0xff;
  2282. if (c < 65 || c > 122 || (c > 90 && c < 97))
  2283. png_chunk_error(png_ptr, "invalid chunk type");
  2284. chunk_name >>= 8;
  2285. }
  2286. }
  2287. /* Combines the row recently read in with the existing pixels in the row. This
  2288. * routine takes care of alpha and transparency if requested. This routine also
  2289. * handles the two methods of progressive display of interlaced images,
  2290. * depending on the 'display' value; if 'display' is true then the whole row
  2291. * (dp) is filled from the start by replicating the available pixels. If
  2292. * 'display' is false only those pixels present in the pass are filled in.
  2293. */
  2294. void /* PRIVATE */
  2295. png_combine_row(png_structp png_ptr, png_bytep dp, int display)
  2296. {
  2297. unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
  2298. png_const_bytep sp = png_ptr->row_buf + 1;
  2299. png_uint_32 row_width = png_ptr->width;
  2300. unsigned int pass = png_ptr->pass;
  2301. png_bytep end_ptr = 0;
  2302. png_byte end_byte = 0;
  2303. unsigned int end_mask;
  2304. png_debug(1, "in png_combine_row");
  2305. /* Added in 1.5.6: it should not be possible to enter this routine until at
  2306. * least one row has been read from the PNG data and transformed.
  2307. */
  2308. if (pixel_depth == 0)
  2309. png_error(png_ptr, "internal row logic error");
  2310. /* Added in 1.5.4: the pixel depth should match the information returned by
  2311. * any call to png_read_update_info at this point. Do not continue if we got
  2312. * this wrong.
  2313. */
  2314. if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes !=
  2315. PNG_ROWBYTES(pixel_depth, row_width))
  2316. png_error(png_ptr, "internal row size calculation error");
  2317. /* Don't expect this to ever happen: */
  2318. if (row_width == 0)
  2319. png_error(png_ptr, "internal row width error");
  2320. /* Preserve the last byte in cases where only part of it will be overwritten,
  2321. * the multiply below may overflow, we don't care because ANSI-C guarantees
  2322. * we get the low bits.
  2323. */
  2324. end_mask = (pixel_depth * row_width) & 7;
  2325. if (end_mask != 0)
  2326. {
  2327. /* end_ptr == NULL is a flag to say do nothing */
  2328. end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1;
  2329. end_byte = *end_ptr;
  2330. # ifdef PNG_READ_PACKSWAP_SUPPORTED
  2331. if (png_ptr->transformations & PNG_PACKSWAP) /* little-endian byte */
  2332. end_mask = 0xff << end_mask;
  2333. else /* big-endian byte */
  2334. # endif
  2335. end_mask = 0xff >> end_mask;
  2336. /* end_mask is now the bits to *keep* from the destination row */
  2337. }
  2338. /* For non-interlaced images this reduces to a png_memcpy(). A png_memcpy()
  2339. * will also happen if interlacing isn't supported or if the application
  2340. * does not call png_set_interlace_handling(). In the latter cases the
  2341. * caller just gets a sequence of the unexpanded rows from each interlace
  2342. * pass.
  2343. */
  2344. #ifdef PNG_READ_INTERLACING_SUPPORTED
  2345. if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE) &&
  2346. pass < 6 && (display == 0 ||
  2347. /* The following copies everything for 'display' on passes 0, 2 and 4. */
  2348. (display == 1 && (pass & 1) != 0)))
  2349. {
  2350. /* Narrow images may have no bits in a pass; the caller should handle
  2351. * this, but this test is cheap:
  2352. */
  2353. if (row_width <= PNG_PASS_START_COL(pass))
  2354. return;
  2355. if (pixel_depth < 8)
  2356. {
  2357. /* For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit
  2358. * into 32 bits, then a single loop over the bytes using the four byte
  2359. * values in the 32-bit mask can be used. For the 'display' option the
  2360. * expanded mask may also not require any masking within a byte. To
  2361. * make this work the PACKSWAP option must be taken into account - it
  2362. * simply requires the pixels to be reversed in each byte.
  2363. *
  2364. * The 'regular' case requires a mask for each of the first 6 passes,
  2365. * the 'display' case does a copy for the even passes in the range
  2366. * 0..6. This has already been handled in the test above.
  2367. *
  2368. * The masks are arranged as four bytes with the first byte to use in
  2369. * the lowest bits (little-endian) regardless of the order (PACKSWAP or
  2370. * not) of the pixels in each byte.
  2371. *
  2372. * NOTE: the whole of this logic depends on the caller of this function
  2373. * only calling it on rows appropriate to the pass. This function only
  2374. * understands the 'x' logic; the 'y' logic is handled by the caller.
  2375. *
  2376. * The following defines allow generation of compile time constant bit
  2377. * masks for each pixel depth and each possibility of swapped or not
  2378. * swapped bytes. Pass 'p' is in the range 0..6; 'x', a pixel index,
  2379. * is in the range 0..7; and the result is 1 if the pixel is to be
  2380. * copied in the pass, 0 if not. 'S' is for the sparkle method, 'B'
  2381. * for the block method.
  2382. *
  2383. * With some compilers a compile time expression of the general form:
  2384. *
  2385. * (shift >= 32) ? (a >> (shift-32)) : (b >> shift)
  2386. *
  2387. * Produces warnings with values of 'shift' in the range 33 to 63
  2388. * because the right hand side of the ?: expression is evaluated by
  2389. * the compiler even though it isn't used. Microsoft Visual C (various
  2390. * versions) and the Intel C compiler are known to do this. To avoid
  2391. * this the following macros are used in 1.5.6. This is a temporary
  2392. * solution to avoid destabilizing the code during the release process.
  2393. */
  2394. # if PNG_USE_COMPILE_TIME_MASKS
  2395. # define PNG_LSR(x,s) ((x)>>((s) & 0x1f))
  2396. # define PNG_LSL(x,s) ((x)<<((s) & 0x1f))
  2397. # else
  2398. # define PNG_LSR(x,s) ((x)>>(s))
  2399. # define PNG_LSL(x,s) ((x)<<(s))
  2400. # endif
  2401. # define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\
  2402. PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1)
  2403. # define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\
  2404. PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1)
  2405. /* Return a mask for pass 'p' pixel 'x' at depth 'd'. The mask is
  2406. * little endian - the first pixel is at bit 0 - however the extra
  2407. * parameter 's' can be set to cause the mask position to be swapped
  2408. * within each byte, to match the PNG format. This is done by XOR of
  2409. * the shift with 7, 6 or 4 for bit depths 1, 2 and 4.
  2410. */
  2411. # define PIXEL_MASK(p,x,d,s) \
  2412. (PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0))))
  2413. /* Hence generate the appropriate 'block' or 'sparkle' pixel copy mask.
  2414. */
  2415. # define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
  2416. # define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
  2417. /* Combine 8 of these to get the full mask. For the 1-bpp and 2-bpp
  2418. * cases the result needs replicating, for the 4-bpp case the above
  2419. * generates a full 32 bits.
  2420. */
  2421. # define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  2422. # define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  2423. S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  2424. S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  2425. # define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  2426. B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  2427. B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  2428. #if PNG_USE_COMPILE_TIME_MASKS
  2429. /* Utility macros to construct all the masks for a depth/swap
  2430. * combination. The 's' parameter says whether the format is PNG
  2431. * (big endian bytes) or not. Only the three odd-numbered passes are
  2432. * required for the display/block algorithm.
  2433. */
  2434. # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  2435. S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  2436. # define B_MASKS(d,s) { B_MASK(1,d,s), S_MASK(3,d,s), S_MASK(5,d,s) }
  2437. # define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
  2438. /* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and
  2439. * then pass:
  2440. */
  2441. static PNG_CONST png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] =
  2442. {
  2443. /* Little-endian byte masks for PACKSWAP */
  2444. { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
  2445. /* Normal (big-endian byte) masks - PNG format */
  2446. { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
  2447. };
  2448. /* display_mask has only three entries for the odd passes, so index by
  2449. * pass>>1.
  2450. */
  2451. static PNG_CONST png_uint_32 display_mask[2][3][3] =
  2452. {
  2453. /* Little-endian byte masks for PACKSWAP */
  2454. { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
  2455. /* Normal (big-endian byte) masks - PNG format */
  2456. { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
  2457. };
  2458. # define MASK(pass,depth,display,png)\
  2459. ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
  2460. row_mask[png][DEPTH_INDEX(depth)][pass])
  2461. #else /* !PNG_USE_COMPILE_TIME_MASKS */
  2462. /* This is the runtime alternative: it seems unlikely that this will
  2463. * ever be either smaller or faster than the compile time approach.
  2464. */
  2465. # define MASK(pass,depth,display,png)\
  2466. ((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png))
  2467. #endif /* !PNG_USE_COMPILE_TIME_MASKS */
  2468. /* Use the appropriate mask to copy the required bits. In some cases
  2469. * the byte mask will be 0 or 0xff, optimize these cases. row_width is
  2470. * the number of pixels, but the code copies bytes, so it is necessary
  2471. * to special case the end.
  2472. */
  2473. png_uint_32 pixels_per_byte = 8 / pixel_depth;
  2474. png_uint_32 mask;
  2475. # ifdef PNG_READ_PACKSWAP_SUPPORTED
  2476. if (png_ptr->transformations & PNG_PACKSWAP)
  2477. mask = MASK(pass, pixel_depth, display, 0);
  2478. else
  2479. # endif
  2480. mask = MASK(pass, pixel_depth, display, 1);
  2481. for (;;)
  2482. {
  2483. png_uint_32 m;
  2484. /* It doesn't matter in the following if png_uint_32 has more than
  2485. * 32 bits because the high bits always match those in m<<24; it is,
  2486. * however, essential to use OR here, not +, because of this.
  2487. */
  2488. m = mask;
  2489. mask = (m >> 8) | (m << 24); /* rotate right to good compilers */
  2490. m &= 0xff;
  2491. if (m != 0) /* something to copy */
  2492. {
  2493. if (m != 0xff)
  2494. *dp = (png_byte)((*dp & ~m) | (*sp & m));
  2495. else
  2496. *dp = *sp;
  2497. }
  2498. /* NOTE: this may overwrite the last byte with garbage if the image
  2499. * is not an exact number of bytes wide; libpng has always done
  2500. * this.
  2501. */
  2502. if (row_width <= pixels_per_byte)
  2503. break; /* May need to restore part of the last byte */
  2504. row_width -= pixels_per_byte;
  2505. ++dp;
  2506. ++sp;
  2507. }
  2508. }
  2509. else /* pixel_depth >= 8 */
  2510. {
  2511. unsigned int bytes_to_copy, bytes_to_jump;
  2512. /* Validate the depth - it must be a multiple of 8 */
  2513. if (pixel_depth & 7)
  2514. png_error(png_ptr, "invalid user transform pixel depth");
  2515. pixel_depth >>= 3; /* now in bytes */
  2516. row_width *= pixel_depth;
  2517. /* Regardless of pass number the Adam 7 interlace always results in a
  2518. * fixed number of pixels to copy then to skip. There may be a
  2519. * different number of pixels to skip at the start though.
  2520. */
  2521. {
  2522. unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth;
  2523. row_width -= offset;
  2524. dp += offset;
  2525. sp += offset;
  2526. }
  2527. /* Work out the bytes to copy. */
  2528. if (display)
  2529. {
  2530. /* When doing the 'block' algorithm the pixel in the pass gets
  2531. * replicated to adjacent pixels. This is why the even (0,2,4,6)
  2532. * passes are skipped above - the entire expanded row is copied.
  2533. */
  2534. bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth;
  2535. /* But don't allow this number to exceed the actual row width. */
  2536. if (bytes_to_copy > row_width)
  2537. bytes_to_copy = row_width;
  2538. }
  2539. else /* normal row; Adam7 only ever gives us one pixel to copy. */
  2540. bytes_to_copy = pixel_depth;
  2541. /* In Adam7 there is a constant offset between where the pixels go. */
  2542. bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;
  2543. /* And simply copy these bytes. Some optimization is possible here,
  2544. * depending on the value of 'bytes_to_copy'. Special case the low
  2545. * byte counts, which we know to be frequent.
  2546. *
  2547. * Notice that these cases all 'return' rather than 'break' - this
  2548. * avoids an unnecessary test on whether to restore the last byte
  2549. * below.
  2550. */
  2551. switch (bytes_to_copy)
  2552. {
  2553. case 1:
  2554. for (;;)
  2555. {
  2556. *dp = *sp;
  2557. if (row_width <= bytes_to_jump)
  2558. return;
  2559. dp += bytes_to_jump;
  2560. sp += bytes_to_jump;
  2561. row_width -= bytes_to_jump;
  2562. }
  2563. case 2:
  2564. /* There is a possibility of a partial copy at the end here; this
  2565. * slows the code down somewhat.
  2566. */
  2567. do
  2568. {
  2569. dp[0] = sp[0], dp[1] = sp[1];
  2570. if (row_width <= bytes_to_jump)
  2571. return;
  2572. sp += bytes_to_jump;
  2573. dp += bytes_to_jump;
  2574. row_width -= bytes_to_jump;
  2575. }
  2576. while (row_width > 1);
  2577. /* And there can only be one byte left at this point: */
  2578. *dp = *sp;
  2579. return;
  2580. case 3:
  2581. /* This can only be the RGB case, so each copy is exactly one
  2582. * pixel and it is not necessary to check for a partial copy.
  2583. */
  2584. for(;;)
  2585. {
  2586. dp[0] = sp[0], dp[1] = sp[1], dp[2] = sp[2];
  2587. if (row_width <= bytes_to_jump)
  2588. return;
  2589. sp += bytes_to_jump;
  2590. dp += bytes_to_jump;
  2591. row_width -= bytes_to_jump;
  2592. }
  2593. default:
  2594. #if PNG_ALIGN_TYPE != PNG_ALIGN_NONE
  2595. /* Check for double byte alignment and, if possible, use a
  2596. * 16-bit copy. Don't attempt this for narrow images - ones that
  2597. * are less than an interlace panel wide. Don't attempt it for
  2598. * wide bytes_to_copy either - use the png_memcpy there.
  2599. */
  2600. if (bytes_to_copy < 16 /*else use png_memcpy*/ &&
  2601. png_isaligned(dp, png_uint_16) &&
  2602. png_isaligned(sp, png_uint_16) &&
  2603. bytes_to_copy % sizeof (png_uint_16) == 0 &&
  2604. bytes_to_jump % sizeof (png_uint_16) == 0)
  2605. {
  2606. /* Everything is aligned for png_uint_16 copies, but try for
  2607. * png_uint_32 first.
  2608. */
  2609. if (png_isaligned(dp, png_uint_32) &&
  2610. png_isaligned(sp, png_uint_32) &&
  2611. bytes_to_copy % sizeof (png_uint_32) == 0 &&
  2612. bytes_to_jump % sizeof (png_uint_32) == 0)
  2613. {
  2614. png_uint_32p dp32 = (png_uint_32p)dp;
  2615. png_const_uint_32p sp32 = (png_const_uint_32p)sp;
  2616. unsigned int skip = (bytes_to_jump-bytes_to_copy) /
  2617. sizeof (png_uint_32);
  2618. do
  2619. {
  2620. size_t c = bytes_to_copy;
  2621. do
  2622. {
  2623. *dp32++ = *sp32++;
  2624. c -= sizeof (png_uint_32);
  2625. }
  2626. while (c > 0);
  2627. if (row_width <= bytes_to_jump)
  2628. return;
  2629. dp32 += skip;
  2630. sp32 += skip;
  2631. row_width -= bytes_to_jump;
  2632. }
  2633. while (bytes_to_copy <= row_width);
  2634. /* Get to here when the row_width truncates the final copy.
  2635. * There will be 1-3 bytes left to copy, so don't try the
  2636. * 16-bit loop below.
  2637. */
  2638. dp = (png_bytep)dp32;
  2639. sp = (png_const_bytep)sp32;
  2640. do
  2641. *dp++ = *sp++;
  2642. while (--row_width > 0);
  2643. return;
  2644. }
  2645. /* Else do it in 16-bit quantities, but only if the size is
  2646. * not too large.
  2647. */
  2648. else
  2649. {
  2650. png_uint_16p dp16 = (png_uint_16p)dp;
  2651. png_const_uint_16p sp16 = (png_const_uint_16p)sp;
  2652. unsigned int skip = (bytes_to_jump-bytes_to_copy) /
  2653. sizeof (png_uint_16);
  2654. do
  2655. {
  2656. size_t c = bytes_to_copy;
  2657. do
  2658. {
  2659. *dp16++ = *sp16++;
  2660. c -= sizeof (png_uint_16);
  2661. }
  2662. while (c > 0);
  2663. if (row_width <= bytes_to_jump)
  2664. return;
  2665. dp16 += skip;
  2666. sp16 += skip;
  2667. row_width -= bytes_to_jump;
  2668. }
  2669. while (bytes_to_copy <= row_width);
  2670. /* End of row - 1 byte left, bytes_to_copy > row_width: */
  2671. dp = (png_bytep)dp16;
  2672. sp = (png_const_bytep)sp16;
  2673. do
  2674. *dp++ = *sp++;
  2675. while (--row_width > 0);
  2676. return;
  2677. }
  2678. }
  2679. #endif /* PNG_ALIGN_ code */
  2680. /* The true default - use a png_memcpy: */
  2681. for (;;)
  2682. {
  2683. png_memcpy(dp, sp, bytes_to_copy);
  2684. if (row_width <= bytes_to_jump)
  2685. return;
  2686. sp += bytes_to_jump;
  2687. dp += bytes_to_jump;
  2688. row_width -= bytes_to_jump;
  2689. if (bytes_to_copy > row_width)
  2690. bytes_to_copy = row_width;
  2691. }
  2692. }
  2693. /* NOT REACHED*/
  2694. } /* pixel_depth >= 8 */
  2695. /* Here if pixel_depth < 8 to check 'end_ptr' below. */
  2696. }
  2697. else
  2698. #endif
  2699. /* If here then the switch above wasn't used so just png_memcpy the whole row
  2700. * from the temporary row buffer (notice that this overwrites the end of the
  2701. * destination row if it is a partial byte.)
  2702. */
  2703. png_memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width));
  2704. /* Restore the overwritten bits from the last byte if necessary. */
  2705. if (end_ptr != NULL)
  2706. *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask));
  2707. }
  2708. #ifdef PNG_READ_INTERLACING_SUPPORTED
  2709. void /* PRIVATE */
  2710. png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
  2711. png_uint_32 transformations /* Because these may affect the byte layout */)
  2712. {
  2713. /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
  2714. /* Offset to next interlace block */
  2715. static PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
  2716. png_debug(1, "in png_do_read_interlace");
  2717. if (row != NULL && row_info != NULL)
  2718. {
  2719. png_uint_32 final_width;
  2720. final_width = row_info->width * png_pass_inc[pass];
  2721. switch (row_info->pixel_depth)
  2722. {
  2723. case 1:
  2724. {
  2725. png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 3);
  2726. png_bytep dp = row + (png_size_t)((final_width - 1) >> 3);
  2727. int sshift, dshift;
  2728. int s_start, s_end, s_inc;
  2729. int jstop = png_pass_inc[pass];
  2730. png_byte v;
  2731. png_uint_32 i;
  2732. int j;
  2733. #ifdef PNG_READ_PACKSWAP_SUPPORTED
  2734. if (transformations & PNG_PACKSWAP)
  2735. {
  2736. sshift = (int)((row_info->width + 7) & 0x07);
  2737. dshift = (int)((final_width + 7) & 0x07);
  2738. s_start = 7;
  2739. s_end = 0;
  2740. s_inc = -1;
  2741. }
  2742. else
  2743. #endif
  2744. {
  2745. sshift = 7 - (int)((row_info->width + 7) & 0x07);
  2746. dshift = 7 - (int)((final_width + 7) & 0x07);
  2747. s_start = 0;
  2748. s_end = 7;
  2749. s_inc = 1;
  2750. }
  2751. for (i = 0; i < row_info->width; i++)
  2752. {
  2753. v = (png_byte)((*sp >> sshift) & 0x01);
  2754. for (j = 0; j < jstop; j++)
  2755. {
  2756. *dp &= (png_byte)((0x7f7f >> (7 - dshift)) & 0xff);
  2757. *dp |= (png_byte)(v << dshift);
  2758. if (dshift == s_end)
  2759. {
  2760. dshift = s_start;
  2761. dp--;
  2762. }
  2763. else
  2764. dshift += s_inc;
  2765. }
  2766. if (sshift == s_end)
  2767. {
  2768. sshift = s_start;
  2769. sp--;
  2770. }
  2771. else
  2772. sshift += s_inc;
  2773. }
  2774. break;
  2775. }
  2776. case 2:
  2777. {
  2778. png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2);
  2779. png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2);
  2780. int sshift, dshift;
  2781. int s_start, s_end, s_inc;
  2782. int jstop = png_pass_inc[pass];
  2783. png_uint_32 i;
  2784. #ifdef PNG_READ_PACKSWAP_SUPPORTED
  2785. if (transformations & PNG_PACKSWAP)
  2786. {
  2787. sshift = (int)(((row_info->width + 3) & 0x03) << 1);
  2788. dshift = (int)(((final_width + 3) & 0x03) << 1);
  2789. s_start = 6;
  2790. s_end = 0;
  2791. s_inc = -2;
  2792. }
  2793. else
  2794. #endif
  2795. {
  2796. sshift = (int)((3 - ((row_info->width + 3) & 0x03)) << 1);
  2797. dshift = (int)((3 - ((final_width + 3) & 0x03)) << 1);
  2798. s_start = 0;
  2799. s_end = 6;
  2800. s_inc = 2;
  2801. }
  2802. for (i = 0; i < row_info->width; i++)
  2803. {
  2804. png_byte v;
  2805. int j;
  2806. v = (png_byte)((*sp >> sshift) & 0x03);
  2807. for (j = 0; j < jstop; j++)
  2808. {
  2809. *dp &= (png_byte)((0x3f3f >> (6 - dshift)) & 0xff);
  2810. *dp |= (png_byte)(v << dshift);
  2811. if (dshift == s_end)
  2812. {
  2813. dshift = s_start;
  2814. dp--;
  2815. }
  2816. else
  2817. dshift += s_inc;
  2818. }
  2819. if (sshift == s_end)
  2820. {
  2821. sshift = s_start;
  2822. sp--;
  2823. }
  2824. else
  2825. sshift += s_inc;
  2826. }
  2827. break;
  2828. }
  2829. case 4:
  2830. {
  2831. png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 1);
  2832. png_bytep dp = row + (png_size_t)((final_width - 1) >> 1);
  2833. int sshift, dshift;
  2834. int s_start, s_end, s_inc;
  2835. png_uint_32 i;
  2836. int jstop = png_pass_inc[pass];
  2837. #ifdef PNG_READ_PACKSWAP_SUPPORTED
  2838. if (transformations & PNG_PACKSWAP)
  2839. {
  2840. sshift = (int)(((row_info->width + 1) & 0x01) << 2);
  2841. dshift = (int)(((final_width + 1) & 0x01) << 2);
  2842. s_start = 4;
  2843. s_end = 0;
  2844. s_inc = -4;
  2845. }
  2846. else
  2847. #endif
  2848. {
  2849. sshift = (int)((1 - ((row_info->width + 1) & 0x01)) << 2);
  2850. dshift = (int)((1 - ((final_width + 1) & 0x01)) << 2);
  2851. s_start = 0;
  2852. s_end = 4;
  2853. s_inc = 4;
  2854. }
  2855. for (i = 0; i < row_info->width; i++)
  2856. {
  2857. png_byte v = (png_byte)((*sp >> sshift) & 0x0f);
  2858. int j;
  2859. for (j = 0; j < jstop; j++)
  2860. {
  2861. *dp &= (png_byte)((0xf0f >> (4 - dshift)) & 0xff);
  2862. *dp |= (png_byte)(v << dshift);
  2863. if (dshift == s_end)
  2864. {
  2865. dshift = s_start;
  2866. dp--;
  2867. }
  2868. else
  2869. dshift += s_inc;
  2870. }
  2871. if (sshift == s_end)
  2872. {
  2873. sshift = s_start;
  2874. sp--;
  2875. }
  2876. else
  2877. sshift += s_inc;
  2878. }
  2879. break;
  2880. }
  2881. default:
  2882. {
  2883. png_size_t pixel_bytes = (row_info->pixel_depth >> 3);
  2884. png_bytep sp = row + (png_size_t)(row_info->width - 1)
  2885. * pixel_bytes;
  2886. png_bytep dp = row + (png_size_t)(final_width - 1) * pixel_bytes;
  2887. int jstop = png_pass_inc[pass];
  2888. png_uint_32 i;
  2889. for (i = 0; i < row_info->width; i++)
  2890. {
  2891. png_byte v[8];
  2892. int j;
  2893. png_memcpy(v, sp, pixel_bytes);
  2894. for (j = 0; j < jstop; j++)
  2895. {
  2896. png_memcpy(dp, v, pixel_bytes);
  2897. dp -= pixel_bytes;
  2898. }
  2899. sp -= pixel_bytes;
  2900. }
  2901. break;
  2902. }
  2903. }
  2904. row_info->width = final_width;
  2905. row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);
  2906. }
  2907. #ifndef PNG_READ_PACKSWAP_SUPPORTED
  2908. PNG_UNUSED(transformations) /* Silence compiler warning */
  2909. #endif
  2910. }
  2911. #endif /* PNG_READ_INTERLACING_SUPPORTED */
  2912. static void
  2913. png_read_filter_row_sub(png_row_infop row_info, png_bytep row,
  2914. png_const_bytep prev_row)
  2915. {
  2916. png_size_t i;
  2917. png_size_t istop = row_info->rowbytes;
  2918. unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
  2919. png_bytep rp = row + bpp;
  2920. PNG_UNUSED(prev_row)
  2921. for (i = bpp; i < istop; i++)
  2922. {
  2923. *rp = (png_byte)(((int)(*rp) + (int)(*(rp-bpp))) & 0xff);
  2924. rp++;
  2925. }
  2926. }
  2927. static void
  2928. png_read_filter_row_up(png_row_infop row_info, png_bytep row,
  2929. png_const_bytep prev_row)
  2930. {
  2931. png_size_t i;
  2932. png_size_t istop = row_info->rowbytes;
  2933. png_bytep rp = row;
  2934. png_const_bytep pp = prev_row;
  2935. for (i = 0; i < istop; i++)
  2936. {
  2937. *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff);
  2938. rp++;
  2939. }
  2940. }
  2941. static void
  2942. png_read_filter_row_avg(png_row_infop row_info, png_bytep row,
  2943. png_const_bytep prev_row)
  2944. {
  2945. png_size_t i;
  2946. png_bytep rp = row;
  2947. png_const_bytep pp = prev_row;
  2948. unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
  2949. png_size_t istop = row_info->rowbytes - bpp;
  2950. for (i = 0; i < bpp; i++)
  2951. {
  2952. *rp = (png_byte)(((int)(*rp) +
  2953. ((int)(*pp++) / 2 )) & 0xff);
  2954. rp++;
  2955. }
  2956. for (i = 0; i < istop; i++)
  2957. {
  2958. *rp = (png_byte)(((int)(*rp) +
  2959. (int)(*pp++ + *(rp-bpp)) / 2 ) & 0xff);
  2960. rp++;
  2961. }
  2962. }
  2963. static void
  2964. png_read_filter_row_paeth_1byte_pixel(png_row_infop row_info, png_bytep row,
  2965. png_const_bytep prev_row)
  2966. {
  2967. png_bytep rp_end = row + row_info->rowbytes;
  2968. int a, c;
  2969. /* First pixel/byte */
  2970. c = *prev_row++;
  2971. a = *row + c;
  2972. *row++ = (png_byte)a;
  2973. /* Remainder */
  2974. while (row < rp_end)
  2975. {
  2976. int b, pa, pb, pc, p;
  2977. a &= 0xff; /* From previous iteration or start */
  2978. b = *prev_row++;
  2979. p = b - c;
  2980. pc = a - c;
  2981. # ifdef PNG_USE_ABS
  2982. pa = abs(p);
  2983. pb = abs(pc);
  2984. pc = abs(p + pc);
  2985. # else
  2986. pa = p < 0 ? -p : p;
  2987. pb = pc < 0 ? -pc : pc;
  2988. pc = (p + pc) < 0 ? -(p + pc) : p + pc;
  2989. # endif
  2990. /* Find the best predictor, the least of pa, pb, pc favoring the earlier
  2991. * ones in the case of a tie.
  2992. */
  2993. if (pb < pa) pa = pb, a = b;
  2994. if (pc < pa) a = c;
  2995. /* Calculate the current pixel in a, and move the previous row pixel to c
  2996. * for the next time round the loop
  2997. */
  2998. c = b;
  2999. a += *row;
  3000. *row++ = (png_byte)a;
  3001. }
  3002. }
  3003. static void
  3004. png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
  3005. png_const_bytep prev_row)
  3006. {
  3007. int bpp = (row_info->pixel_depth + 7) >> 3;
  3008. png_bytep rp_end = row + bpp;
  3009. /* Process the first pixel in the row completely (this is the same as 'up'
  3010. * because there is only one candidate predictor for the first row).
  3011. */
  3012. while (row < rp_end)
  3013. {
  3014. int a = *row + *prev_row++;
  3015. *row++ = (png_byte)a;
  3016. }
  3017. /* Remainder */
  3018. rp_end += row_info->rowbytes - bpp;
  3019. while (row < rp_end)
  3020. {
  3021. int a, b, c, pa, pb, pc, p;
  3022. c = *(prev_row - bpp);
  3023. a = *(row - bpp);
  3024. b = *prev_row++;
  3025. p = b - c;
  3026. pc = a - c;
  3027. # ifdef PNG_USE_ABS
  3028. pa = abs(p);
  3029. pb = abs(pc);
  3030. pc = abs(p + pc);
  3031. # else
  3032. pa = p < 0 ? -p : p;
  3033. pb = pc < 0 ? -pc : pc;
  3034. pc = (p + pc) < 0 ? -(p + pc) : p + pc;
  3035. # endif
  3036. if (pb < pa) pa = pb, a = b;
  3037. if (pc < pa) a = c;
  3038. c = b;
  3039. a += *row;
  3040. *row++ = (png_byte)a;
  3041. }
  3042. }
  3043. #ifdef PNG_ARM_NEON
  3044. #ifdef __linux__
  3045. #include <stdio.h>
  3046. #include <elf.h>
  3047. #include <asm/hwcap.h>
  3048. static int png_have_hwcap(unsigned cap)
  3049. {
  3050. FILE *f = fopen("/proc/self/auxv", "r");
  3051. Elf32_auxv_t aux;
  3052. int have_cap = 0;
  3053. if (!f)
  3054. return 0;
  3055. while (fread(&aux, sizeof(aux), 1, f) > 0)
  3056. {
  3057. if (aux.a_type == AT_HWCAP &&
  3058. aux.a_un.a_val & cap)
  3059. {
  3060. have_cap = 1;
  3061. break;
  3062. }
  3063. }
  3064. fclose(f);
  3065. return have_cap;
  3066. }
  3067. #endif /* __linux__ */
  3068. static void
  3069. png_init_filter_functions_neon(png_structp pp, unsigned int bpp)
  3070. {
  3071. #ifdef __linux__
  3072. if (!png_have_hwcap(HWCAP_NEON))
  3073. return;
  3074. #endif
  3075. pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up_neon;
  3076. if (bpp == 3)
  3077. {
  3078. pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub3_neon;
  3079. pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg3_neon;
  3080. pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
  3081. png_read_filter_row_paeth3_neon;
  3082. }
  3083. else if (bpp == 4)
  3084. {
  3085. pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub4_neon;
  3086. pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg4_neon;
  3087. pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
  3088. png_read_filter_row_paeth4_neon;
  3089. }
  3090. }
  3091. #endif /* PNG_ARM_NEON */
  3092. static void
  3093. png_init_filter_functions(png_structp pp)
  3094. {
  3095. unsigned int bpp = (pp->pixel_depth + 7) >> 3;
  3096. pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub;
  3097. pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up;
  3098. pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg;
  3099. if (bpp == 1)
  3100. pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
  3101. png_read_filter_row_paeth_1byte_pixel;
  3102. else
  3103. pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
  3104. png_read_filter_row_paeth_multibyte_pixel;
  3105. #ifdef PNG_ARM_NEON
  3106. png_init_filter_functions_neon(pp, bpp);
  3107. #endif
  3108. }
  3109. void /* PRIVATE */
  3110. png_read_filter_row(png_structp pp, png_row_infop row_info, png_bytep row,
  3111. png_const_bytep prev_row, int filter)
  3112. {
  3113. if (pp->read_filter[0] == NULL)
  3114. png_init_filter_functions(pp);
  3115. if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
  3116. pp->read_filter[filter-1](row_info, row, prev_row);
  3117. }
  3118. #ifdef PNG_SEQUENTIAL_READ_SUPPORTED
  3119. void /* PRIVATE */
  3120. png_read_finish_row(png_structp png_ptr)
  3121. {
  3122. #ifdef PNG_READ_INTERLACING_SUPPORTED
  3123. /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
  3124. /* Start of interlace block */
  3125. static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
  3126. /* Offset to next interlace block */
  3127. static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
  3128. /* Start of interlace block in the y direction */
  3129. static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
  3130. /* Offset to next interlace block in the y direction */
  3131. static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
  3132. #endif /* PNG_READ_INTERLACING_SUPPORTED */
  3133. png_debug(1, "in png_read_finish_row");
  3134. png_ptr->row_number++;
  3135. if (png_ptr->row_number < png_ptr->num_rows)
  3136. return;
  3137. #ifdef PNG_READ_INTERLACING_SUPPORTED
  3138. if (png_ptr->interlaced)
  3139. {
  3140. png_ptr->row_number = 0;
  3141. /* TO DO: don't do this if prev_row isn't needed (requires
  3142. * read-ahead of the next row's filter byte.
  3143. */
  3144. png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
  3145. do
  3146. {
  3147. png_ptr->pass++;
  3148. if (png_ptr->pass >= 7)
  3149. break;
  3150. png_ptr->iwidth = (png_ptr->width +
  3151. png_pass_inc[png_ptr->pass] - 1 -
  3152. png_pass_start[png_ptr->pass]) /
  3153. png_pass_inc[png_ptr->pass];
  3154. if (!(png_ptr->transformations & PNG_INTERLACE))
  3155. {
  3156. png_ptr->num_rows = (png_ptr->height +
  3157. png_pass_yinc[png_ptr->pass] - 1 -
  3158. png_pass_ystart[png_ptr->pass]) /
  3159. png_pass_yinc[png_ptr->pass];
  3160. }
  3161. else /* if (png_ptr->transformations & PNG_INTERLACE) */
  3162. break; /* libpng deinterlacing sees every row */
  3163. } while (png_ptr->num_rows == 0 || png_ptr->iwidth == 0);
  3164. if (png_ptr->pass < 7)
  3165. return;
  3166. }
  3167. #endif /* PNG_READ_INTERLACING_SUPPORTED */
  3168. if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
  3169. {
  3170. char extra;
  3171. int ret;
  3172. png_ptr->zstream.next_out = (Byte *)&extra;
  3173. png_ptr->zstream.avail_out = (uInt)1;
  3174. for (;;)
  3175. {
  3176. if (!(png_ptr->zstream.avail_in))
  3177. {
  3178. while (!png_ptr->idat_size)
  3179. {
  3180. png_crc_finish(png_ptr, 0);
  3181. png_ptr->idat_size = png_read_chunk_header(png_ptr);
  3182. if (png_ptr->chunk_name != png_IDAT)
  3183. png_error(png_ptr, "Not enough image data");
  3184. }
  3185. png_ptr->zstream.avail_in = (uInt)png_ptr->zbuf_size;
  3186. png_ptr->zstream.next_in = png_ptr->zbuf;
  3187. if (png_ptr->zbuf_size > png_ptr->idat_size)
  3188. png_ptr->zstream.avail_in = (uInt)png_ptr->idat_size;
  3189. png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zstream.avail_in);
  3190. png_ptr->idat_size -= png_ptr->zstream.avail_in;
  3191. }
  3192. ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
  3193. if (ret == Z_STREAM_END)
  3194. {
  3195. if (!(png_ptr->zstream.avail_out) || png_ptr->zstream.avail_in ||
  3196. png_ptr->idat_size)
  3197. png_warning(png_ptr, "Extra compressed data");
  3198. png_ptr->mode |= PNG_AFTER_IDAT;
  3199. png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
  3200. break;
  3201. }
  3202. if (ret != Z_OK)
  3203. png_error(png_ptr, png_ptr->zstream.msg ? png_ptr->zstream.msg :
  3204. "Decompression Error");
  3205. if (!(png_ptr->zstream.avail_out))
  3206. {
  3207. png_warning(png_ptr, "Extra compressed data");
  3208. png_ptr->mode |= PNG_AFTER_IDAT;
  3209. png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
  3210. break;
  3211. }
  3212. }
  3213. png_ptr->zstream.avail_out = 0;
  3214. }
  3215. if (png_ptr->idat_size || png_ptr->zstream.avail_in)
  3216. png_warning(png_ptr, "Extra compression data");
  3217. inflateReset(&png_ptr->zstream);
  3218. png_ptr->mode |= PNG_AFTER_IDAT;
  3219. }
  3220. #endif /* PNG_SEQUENTIAL_READ_SUPPORTED */
  3221. void /* PRIVATE */
  3222. png_read_start_row(png_structp png_ptr)
  3223. {
  3224. #ifdef PNG_READ_INTERLACING_SUPPORTED
  3225. /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
  3226. /* Start of interlace block */
  3227. static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
  3228. /* Offset to next interlace block */
  3229. static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
  3230. /* Start of interlace block in the y direction */
  3231. static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
  3232. /* Offset to next interlace block in the y direction */
  3233. static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
  3234. #endif
  3235. int max_pixel_depth;
  3236. png_size_t row_bytes;
  3237. png_debug(1, "in png_read_start_row");
  3238. png_ptr->zstream.avail_in = 0;
  3239. #ifdef PNG_READ_TRANSFORMS_SUPPORTED
  3240. png_init_read_transformations(png_ptr);
  3241. #endif
  3242. #ifdef PNG_READ_INTERLACING_SUPPORTED
  3243. if (png_ptr->interlaced)
  3244. {
  3245. if (!(png_ptr->transformations & PNG_INTERLACE))
  3246. png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
  3247. png_pass_ystart[0]) / png_pass_yinc[0];
  3248. else
  3249. png_ptr->num_rows = png_ptr->height;
  3250. png_ptr->iwidth = (png_ptr->width +
  3251. png_pass_inc[png_ptr->pass] - 1 -
  3252. png_pass_start[png_ptr->pass]) /
  3253. png_pass_inc[png_ptr->pass];
  3254. }
  3255. else
  3256. #endif /* PNG_READ_INTERLACING_SUPPORTED */
  3257. {
  3258. png_ptr->num_rows = png_ptr->height;
  3259. png_ptr->iwidth = png_ptr->width;
  3260. }
  3261. max_pixel_depth = png_ptr->pixel_depth;
  3262. /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpliar set of
  3263. * calculations to calculate the final pixel depth, then
  3264. * png_do_read_transforms actually does the transforms. This means that the
  3265. * code which effectively calculates this value is actually repeated in three
  3266. * separate places. They must all match. Innocent changes to the order of
  3267. * transformations can and will break libpng in a way that causes memory
  3268. * overwrites.
  3269. *
  3270. * TODO: fix this.
  3271. */
  3272. #ifdef PNG_READ_PACK_SUPPORTED
  3273. if ((png_ptr->transformations & PNG_PACK) && png_ptr->bit_depth < 8)
  3274. max_pixel_depth = 8;
  3275. #endif
  3276. #ifdef PNG_READ_EXPAND_SUPPORTED
  3277. if (png_ptr->transformations & PNG_EXPAND)
  3278. {
  3279. if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  3280. {
  3281. if (png_ptr->num_trans)
  3282. max_pixel_depth = 32;
  3283. else
  3284. max_pixel_depth = 24;
  3285. }
  3286. else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
  3287. {
  3288. if (max_pixel_depth < 8)
  3289. max_pixel_depth = 8;
  3290. if (png_ptr->num_trans)
  3291. max_pixel_depth *= 2;
  3292. }
  3293. else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
  3294. {
  3295. if (png_ptr->num_trans)
  3296. {
  3297. max_pixel_depth *= 4;
  3298. max_pixel_depth /= 3;
  3299. }
  3300. }
  3301. }
  3302. #endif
  3303. #ifdef PNG_READ_EXPAND_16_SUPPORTED
  3304. if (png_ptr->transformations & PNG_EXPAND_16)
  3305. {
  3306. # ifdef PNG_READ_EXPAND_SUPPORTED
  3307. /* In fact it is an error if it isn't supported, but checking is
  3308. * the safe way.
  3309. */
  3310. if (png_ptr->transformations & PNG_EXPAND)
  3311. {
  3312. if (png_ptr->bit_depth < 16)
  3313. max_pixel_depth *= 2;
  3314. }
  3315. else
  3316. # endif
  3317. png_ptr->transformations &= ~PNG_EXPAND_16;
  3318. }
  3319. #endif
  3320. #ifdef PNG_READ_FILLER_SUPPORTED
  3321. if (png_ptr->transformations & (PNG_FILLER))
  3322. {
  3323. if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
  3324. {
  3325. if (max_pixel_depth <= 8)
  3326. max_pixel_depth = 16;
  3327. else
  3328. max_pixel_depth = 32;
  3329. }
  3330. else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB ||
  3331. png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  3332. {
  3333. if (max_pixel_depth <= 32)
  3334. max_pixel_depth = 32;
  3335. else
  3336. max_pixel_depth = 64;
  3337. }
  3338. }
  3339. #endif
  3340. #ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
  3341. if (png_ptr->transformations & PNG_GRAY_TO_RGB)
  3342. {
  3343. if (
  3344. #ifdef PNG_READ_EXPAND_SUPPORTED
  3345. (png_ptr->num_trans && (png_ptr->transformations & PNG_EXPAND)) ||
  3346. #endif
  3347. #ifdef PNG_READ_FILLER_SUPPORTED
  3348. (png_ptr->transformations & (PNG_FILLER)) ||
  3349. #endif
  3350. png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
  3351. {
  3352. if (max_pixel_depth <= 16)
  3353. max_pixel_depth = 32;
  3354. else
  3355. max_pixel_depth = 64;
  3356. }
  3357. else
  3358. {
  3359. if (max_pixel_depth <= 8)
  3360. {
  3361. if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
  3362. max_pixel_depth = 32;
  3363. else
  3364. max_pixel_depth = 24;
  3365. }
  3366. else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
  3367. max_pixel_depth = 64;
  3368. else
  3369. max_pixel_depth = 48;
  3370. }
  3371. }
  3372. #endif
  3373. #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
  3374. defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
  3375. if (png_ptr->transformations & PNG_USER_TRANSFORM)
  3376. {
  3377. int user_pixel_depth = png_ptr->user_transform_depth *
  3378. png_ptr->user_transform_channels;
  3379. if (user_pixel_depth > max_pixel_depth)
  3380. max_pixel_depth = user_pixel_depth;
  3381. }
  3382. #endif
  3383. /* This value is stored in png_struct and double checked in the row read
  3384. * code.
  3385. */
  3386. png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;
  3387. png_ptr->transformed_pixel_depth = 0; /* calculated on demand */
  3388. /* Align the width on the next larger 8 pixels. Mainly used
  3389. * for interlacing
  3390. */
  3391. row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));
  3392. /* Calculate the maximum bytes needed, adding a byte and a pixel
  3393. * for safety's sake
  3394. */
  3395. row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
  3396. 1 + ((max_pixel_depth + 7) >> 3);
  3397. #ifdef PNG_MAX_MALLOC_64K
  3398. if (row_bytes > (png_uint_32)65536L)
  3399. png_error(png_ptr, "This image requires a row greater than 64KB");
  3400. #endif
  3401. if (row_bytes + 48 > png_ptr->old_big_row_buf_size)
  3402. {
  3403. png_free(png_ptr, png_ptr->big_row_buf);
  3404. png_free(png_ptr, png_ptr->big_prev_row);
  3405. if (png_ptr->interlaced)
  3406. png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr,
  3407. row_bytes + 48);
  3408. else
  3409. png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
  3410. png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
  3411. #ifdef PNG_ALIGNED_MEMORY_SUPPORTED
  3412. /* Use 16-byte aligned memory for row_buf with at least 16 bytes
  3413. * of padding before and after row_buf; treat prev_row similarly.
  3414. * NOTE: the alignment is to the start of the pixels, one beyond the start
  3415. * of the buffer, because of the filter byte. Prior to libpng 1.5.6 this
  3416. * was incorrect; the filter byte was aligned, which had the exact
  3417. * opposite effect of that intended.
  3418. */
  3419. {
  3420. png_bytep temp = png_ptr->big_row_buf + 32;
  3421. int extra = (int)((temp - (png_bytep)0) & 0x0f);
  3422. png_ptr->row_buf = temp - extra - 1/*filter byte*/;
  3423. temp = png_ptr->big_prev_row + 32;
  3424. extra = (int)((temp - (png_bytep)0) & 0x0f);
  3425. png_ptr->prev_row = temp - extra - 1/*filter byte*/;
  3426. }
  3427. #else
  3428. /* Use 31 bytes of padding before and 17 bytes after row_buf. */
  3429. png_ptr->row_buf = png_ptr->big_row_buf + 31;
  3430. png_ptr->prev_row = png_ptr->big_prev_row + 31;
  3431. #endif
  3432. png_ptr->old_big_row_buf_size = row_bytes + 48;
  3433. }
  3434. #ifdef PNG_MAX_MALLOC_64K
  3435. if (png_ptr->rowbytes > 65535)
  3436. png_error(png_ptr, "This image requires a row greater than 64KB");
  3437. #endif
  3438. if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1))
  3439. png_error(png_ptr, "Row has too many bytes to allocate in memory");
  3440. png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
  3441. png_debug1(3, "width = %u,", png_ptr->width);
  3442. png_debug1(3, "height = %u,", png_ptr->height);
  3443. png_debug1(3, "iwidth = %u,", png_ptr->iwidth);
  3444. png_debug1(3, "num_rows = %u,", png_ptr->num_rows);
  3445. png_debug1(3, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes);
  3446. png_debug1(3, "irowbytes = %lu",
  3447. (unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1);
  3448. png_ptr->flags |= PNG_FLAG_ROW_INIT;
  3449. }
  3450. #endif /* PNG_READ_SUPPORTED */