aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/libraries/irrlicht-1.8/source/Irrlicht/libpng/pngrutil.c
diff options
context:
space:
mode:
Diffstat (limited to 'libraries/irrlicht-1.8/source/Irrlicht/libpng/pngrutil.c')
-rw-r--r--libraries/irrlicht-1.8/source/Irrlicht/libpng/pngrutil.c4158
1 files changed, 4158 insertions, 0 deletions
diff --git a/libraries/irrlicht-1.8/source/Irrlicht/libpng/pngrutil.c b/libraries/irrlicht-1.8/source/Irrlicht/libpng/pngrutil.c
new file mode 100644
index 0000000..7b4557f
--- /dev/null
+++ b/libraries/irrlicht-1.8/source/Irrlicht/libpng/pngrutil.c
@@ -0,0 +1,4158 @@
1
2/* pngrutil.c - utilities to read a PNG file
3 *
4 * Last changed in libpng 1.5.9 [February 18, 2012]
5 * Copyright (c) 1998-2012 Glenn Randers-Pehrson
6 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
7 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
8 *
9 * This code is released under the libpng license.
10 * For conditions of distribution and use, see the disclaimer
11 * and license in png.h
12 *
13 * This file contains routines that are only called from within
14 * libpng itself during the course of reading an image.
15 */
16
17#include "pngpriv.h"
18
19#ifdef PNG_READ_SUPPORTED
20
21#define png_strtod(p,a,b) strtod(a,b)
22
23png_uint_32 PNGAPI
24png_get_uint_31(png_structp png_ptr, png_const_bytep buf)
25{
26 png_uint_32 uval = png_get_uint_32(buf);
27
28 if (uval > PNG_UINT_31_MAX)
29 png_error(png_ptr, "PNG unsigned integer out of range");
30
31 return (uval);
32}
33
34#if defined(PNG_READ_gAMA_SUPPORTED) || defined(PNG_READ_cHRM_SUPPORTED)
35/* The following is a variation on the above for use with the fixed
36 * point values used for gAMA and cHRM. Instead of png_error it
37 * issues a warning and returns (-1) - an invalid value because both
38 * gAMA and cHRM use *unsigned* integers for fixed point values.
39 */
40#define PNG_FIXED_ERROR (-1)
41
42static png_fixed_point /* PRIVATE */
43png_get_fixed_point(png_structp png_ptr, png_const_bytep buf)
44{
45 png_uint_32 uval = png_get_uint_32(buf);
46
47 if (uval <= PNG_UINT_31_MAX)
48 return (png_fixed_point)uval; /* known to be in range */
49
50 /* The caller can turn off the warning by passing NULL. */
51 if (png_ptr != NULL)
52 png_warning(png_ptr, "PNG fixed point integer out of range");
53
54 return PNG_FIXED_ERROR;
55}
56#endif
57
58#ifdef PNG_READ_INT_FUNCTIONS_SUPPORTED
59/* NOTE: the read macros will obscure these definitions, so that if
60 * PNG_USE_READ_MACROS is set the library will not use them internally,
61 * but the APIs will still be available externally.
62 *
63 * The parentheses around "PNGAPI function_name" in the following three
64 * functions are necessary because they allow the macros to co-exist with
65 * these (unused but exported) functions.
66 */
67
68/* Grab an unsigned 32-bit integer from a buffer in big-endian format. */
69png_uint_32 (PNGAPI
70png_get_uint_32)(png_const_bytep buf)
71{
72 png_uint_32 uval =
73 ((png_uint_32)(*(buf )) << 24) +
74 ((png_uint_32)(*(buf + 1)) << 16) +
75 ((png_uint_32)(*(buf + 2)) << 8) +
76 ((png_uint_32)(*(buf + 3)) ) ;
77
78 return uval;
79}
80
81/* Grab a signed 32-bit integer from a buffer in big-endian format. The
82 * data is stored in the PNG file in two's complement format and there
83 * is no guarantee that a 'png_int_32' is exactly 32 bits, therefore
84 * the following code does a two's complement to native conversion.
85 */
86png_int_32 (PNGAPI
87png_get_int_32)(png_const_bytep buf)
88{
89 png_uint_32 uval = png_get_uint_32(buf);
90 if ((uval & 0x80000000) == 0) /* non-negative */
91 return uval;
92
93 uval = (uval ^ 0xffffffff) + 1; /* 2's complement: -x = ~x+1 */
94 return -(png_int_32)uval;
95}
96
97/* Grab an unsigned 16-bit integer from a buffer in big-endian format. */
98png_uint_16 (PNGAPI
99png_get_uint_16)(png_const_bytep buf)
100{
101 /* ANSI-C requires an int value to accomodate at least 16 bits so this
102 * works and allows the compiler not to worry about possible narrowing
103 * on 32 bit systems. (Pre-ANSI systems did not make integers smaller
104 * than 16 bits either.)
105 */
106 unsigned int val =
107 ((unsigned int)(*buf) << 8) +
108 ((unsigned int)(*(buf + 1)));
109
110 return (png_uint_16)val;
111}
112
113#endif /* PNG_READ_INT_FUNCTIONS_SUPPORTED */
114
115/* Read and check the PNG file signature */
116void /* PRIVATE */
117png_read_sig(png_structp png_ptr, png_infop info_ptr)
118{
119 png_size_t num_checked, num_to_check;
120
121 /* Exit if the user application does not expect a signature. */
122 if (png_ptr->sig_bytes >= 8)
123 return;
124
125 num_checked = png_ptr->sig_bytes;
126 num_to_check = 8 - num_checked;
127
128#ifdef PNG_IO_STATE_SUPPORTED
129 png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE;
130#endif
131
132 /* The signature must be serialized in a single I/O call. */
133 png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check);
134 png_ptr->sig_bytes = 8;
135
136 if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))
137 {
138 if (num_checked < 4 &&
139 png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4))
140 png_error(png_ptr, "Not a PNG file");
141 else
142 png_error(png_ptr, "PNG file corrupted by ASCII conversion");
143 }
144 if (num_checked < 3)
145 png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
146}
147
148/* Read the chunk header (length + type name).
149 * Put the type name into png_ptr->chunk_name, and return the length.
150 */
151png_uint_32 /* PRIVATE */
152png_read_chunk_header(png_structp png_ptr)
153{
154 png_byte buf[8];
155 png_uint_32 length;
156
157#ifdef PNG_IO_STATE_SUPPORTED
158 png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR;
159#endif
160
161 /* Read the length and the chunk name.
162 * This must be performed in a single I/O call.
163 */
164 png_read_data(png_ptr, buf, 8);
165 length = png_get_uint_31(png_ptr, buf);
166
167 /* Put the chunk name into png_ptr->chunk_name. */
168 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(buf+4);
169
170 png_debug2(0, "Reading %lx chunk, length = %lu",
171 (unsigned long)png_ptr->chunk_name, (unsigned long)length);
172
173 /* Reset the crc and run it over the chunk name. */
174 png_reset_crc(png_ptr);
175 png_calculate_crc(png_ptr, buf + 4, 4);
176
177 /* Check to see if chunk name is valid. */
178 png_check_chunk_name(png_ptr, png_ptr->chunk_name);
179
180#ifdef PNG_IO_STATE_SUPPORTED
181 png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;
182#endif
183
184 return length;
185}
186
187/* Read data, and (optionally) run it through the CRC. */
188void /* PRIVATE */
189png_crc_read(png_structp png_ptr, png_bytep buf, png_size_t length)
190{
191 if (png_ptr == NULL)
192 return;
193
194 png_read_data(png_ptr, buf, length);
195 png_calculate_crc(png_ptr, buf, length);
196}
197
198/* Optionally skip data and then check the CRC. Depending on whether we
199 * are reading a ancillary or critical chunk, and how the program has set
200 * things up, we may calculate the CRC on the data and print a message.
201 * Returns '1' if there was a CRC error, '0' otherwise.
202 */
203int /* PRIVATE */
204png_crc_finish(png_structp png_ptr, png_uint_32 skip)
205{
206 png_size_t i;
207 png_size_t istop = png_ptr->zbuf_size;
208
209 for (i = (png_size_t)skip; i > istop; i -= istop)
210 {
211 png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size);
212 }
213
214 if (i)
215 {
216 png_crc_read(png_ptr, png_ptr->zbuf, i);
217 }
218
219 if (png_crc_error(png_ptr))
220 {
221 if (PNG_CHUNK_ANCILLIARY(png_ptr->chunk_name) ?
222 !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) :
223 (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE))
224 {
225 png_chunk_warning(png_ptr, "CRC error");
226 }
227
228 else
229 {
230 png_chunk_benign_error(png_ptr, "CRC error");
231 return (0);
232 }
233
234 return (1);
235 }
236
237 return (0);
238}
239
240/* Compare the CRC stored in the PNG file with that calculated by libpng from
241 * the data it has read thus far.
242 */
243int /* PRIVATE */
244png_crc_error(png_structp png_ptr)
245{
246 png_byte crc_bytes[4];
247 png_uint_32 crc;
248 int need_crc = 1;
249
250 if (PNG_CHUNK_ANCILLIARY(png_ptr->chunk_name))
251 {
252 if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
253 (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
254 need_crc = 0;
255 }
256
257 else /* critical */
258 {
259 if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE)
260 need_crc = 0;
261 }
262
263#ifdef PNG_IO_STATE_SUPPORTED
264 png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC;
265#endif
266
267 /* The chunk CRC must be serialized in a single I/O call. */
268 png_read_data(png_ptr, crc_bytes, 4);
269
270 if (need_crc)
271 {
272 crc = png_get_uint_32(crc_bytes);
273 return ((int)(crc != png_ptr->crc));
274 }
275
276 else
277 return (0);
278}
279
280#ifdef PNG_READ_COMPRESSED_TEXT_SUPPORTED
281static png_size_t
282png_inflate(png_structp png_ptr, png_bytep data, png_size_t size,
283 png_bytep output, png_size_t output_size)
284{
285 png_size_t count = 0;
286
287 /* zlib can't necessarily handle more than 65535 bytes at once (i.e. it can't
288 * even necessarily handle 65536 bytes) because the type uInt is "16 bits or
289 * more". Consequently it is necessary to chunk the input to zlib. This
290 * code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the maximum value
291 * that can be stored in a uInt.) It is possible to set ZLIB_IO_MAX to a
292 * lower value in pngpriv.h and this may sometimes have a performance
293 * advantage, because it forces access of the input data to be separated from
294 * at least some of the use by some period of time.
295 */
296 png_ptr->zstream.next_in = data;
297 /* avail_in is set below from 'size' */
298 png_ptr->zstream.avail_in = 0;
299
300 while (1)
301 {
302 int ret, avail;
303
304 /* The setting of 'avail_in' used to be outside the loop; by setting it
305 * inside it is possible to chunk the input to zlib and simply rely on
306 * zlib to advance the 'next_in' pointer. This allows arbitrary amounts o
307 * data to be passed through zlib at the unavoidable cost of requiring a
308 * window save (memcpy of up to 32768 output bytes) every ZLIB_IO_MAX
309 * input bytes.
310 */
311 if (png_ptr->zstream.avail_in == 0 && size > 0)
312 {
313 if (size <= ZLIB_IO_MAX)
314 {
315 /* The value is less than ZLIB_IO_MAX so the cast is safe: */
316 png_ptr->zstream.avail_in = (uInt)size;
317 size = 0;
318 }
319
320 else
321 {
322 png_ptr->zstream.avail_in = ZLIB_IO_MAX;
323 size -= ZLIB_IO_MAX;
324 }
325 }
326
327 /* Reset the output buffer each time round - we empty it
328 * after every inflate call.
329 */
330 png_ptr->zstream.next_out = png_ptr->zbuf;
331 png_ptr->zstream.avail_out = png_ptr->zbuf_size;
332
333 ret = inflate(&png_ptr->zstream, Z_NO_FLUSH);
334 avail = png_ptr->zbuf_size - png_ptr->zstream.avail_out;
335
336 /* First copy/count any new output - but only if we didn't
337 * get an error code.
338 */
339 if ((ret == Z_OK || ret == Z_STREAM_END) && avail > 0)
340 {
341 png_size_t space = avail; /* > 0, see above */
342
343 if (output != 0 && output_size > count)
344 {
345 png_size_t copy = output_size - count;
346
347 if (space < copy)
348 copy = space;
349
350 png_memcpy(output + count, png_ptr->zbuf, copy);
351 }
352 count += space;
353 }
354
355 if (ret == Z_OK)
356 continue;
357
358 /* Termination conditions - always reset the zstream, it
359 * must be left in inflateInit state.
360 */
361 png_ptr->zstream.avail_in = 0;
362 inflateReset(&png_ptr->zstream);
363
364 if (ret == Z_STREAM_END)
365 return count; /* NOTE: may be zero. */
366
367 /* Now handle the error codes - the API always returns 0
368 * and the error message is dumped into the uncompressed
369 * buffer if available.
370 */
371# ifdef PNG_WARNINGS_SUPPORTED
372 {
373 png_const_charp msg;
374
375 if (png_ptr->zstream.msg != 0)
376 msg = png_ptr->zstream.msg;
377
378 else switch (ret)
379 {
380 case Z_BUF_ERROR:
381 msg = "Buffer error in compressed datastream";
382 break;
383
384 case Z_DATA_ERROR:
385 msg = "Data error in compressed datastream";
386 break;
387
388 default:
389 msg = "Incomplete compressed datastream";
390 break;
391 }
392
393 png_chunk_warning(png_ptr, msg);
394 }
395# endif
396
397 /* 0 means an error - notice that this code simply ignores
398 * zero length compressed chunks as a result.
399 */
400 return 0;
401 }
402}
403
404/*
405 * Decompress trailing data in a chunk. The assumption is that chunkdata
406 * points at an allocated area holding the contents of a chunk with a
407 * trailing compressed part. What we get back is an allocated area
408 * holding the original prefix part and an uncompressed version of the
409 * trailing part (the malloc area passed in is freed).
410 */
411void /* PRIVATE */
412png_decompress_chunk(png_structp png_ptr, int comp_type,
413 png_size_t chunklength,
414 png_size_t prefix_size, png_size_t *newlength)
415{
416 /* The caller should guarantee this */
417 if (prefix_size > chunklength)
418 {
419 /* The recovery is to delete the chunk. */
420 png_warning(png_ptr, "invalid chunklength");
421 prefix_size = 0; /* To delete everything */
422 }
423
424 else if (comp_type == PNG_COMPRESSION_TYPE_BASE)
425 {
426 png_size_t expanded_size = png_inflate(png_ptr,
427 (png_bytep)(png_ptr->chunkdata + prefix_size),
428 chunklength - prefix_size,
429 0, /* output */
430 0); /* output size */
431
432 /* Now check the limits on this chunk - if the limit fails the
433 * compressed data will be removed, the prefix will remain.
434 */
435 if (prefix_size >= (~(png_size_t)0) - 1 ||
436 expanded_size >= (~(png_size_t)0) - 1 - prefix_size
437#ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
438 || (png_ptr->user_chunk_malloc_max &&
439 (prefix_size + expanded_size >= png_ptr->user_chunk_malloc_max - 1))
440#else
441# ifdef PNG_USER_CHUNK_MALLOC_MAX
442 || ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
443 prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)
444# endif
445#endif
446 )
447 png_warning(png_ptr, "Exceeded size limit while expanding chunk");
448
449 /* If the size is zero either there was an error and a message
450 * has already been output (warning) or the size really is zero
451 * and we have nothing to do - the code will exit through the
452 * error case below.
453 */
454 else if (expanded_size > 0)
455 {
456 /* Success (maybe) - really uncompress the chunk. */
457 png_size_t new_size = 0;
458 png_charp text = (png_charp)png_malloc_warn(png_ptr,
459 prefix_size + expanded_size + 1);
460
461 if (text != NULL)
462 {
463 png_memcpy(text, png_ptr->chunkdata, prefix_size);
464 new_size = png_inflate(png_ptr,
465 (png_bytep)(png_ptr->chunkdata + prefix_size),
466 chunklength - prefix_size,
467 (png_bytep)(text + prefix_size), expanded_size);
468 text[prefix_size + expanded_size] = 0; /* just in case */
469
470 if (new_size == expanded_size)
471 {
472 png_free(png_ptr, png_ptr->chunkdata);
473 png_ptr->chunkdata = text;
474 *newlength = prefix_size + expanded_size;
475 return; /* The success return! */
476 }
477
478 png_warning(png_ptr, "png_inflate logic error");
479 png_free(png_ptr, text);
480 }
481
482 else
483 png_warning(png_ptr, "Not enough memory to decompress chunk");
484 }
485 }
486
487 else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */
488 {
489 PNG_WARNING_PARAMETERS(p)
490 png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_d, comp_type);
491 png_formatted_warning(png_ptr, p, "Unknown compression type @1");
492
493 /* The recovery is to simply drop the data. */
494 }
495
496 /* Generic error return - leave the prefix, delete the compressed
497 * data, reallocate the chunkdata to remove the potentially large
498 * amount of compressed data.
499 */
500 {
501 png_charp text = (png_charp)png_malloc_warn(png_ptr, prefix_size + 1);
502
503 if (text != NULL)
504 {
505 if (prefix_size > 0)
506 png_memcpy(text, png_ptr->chunkdata, prefix_size);
507
508 png_free(png_ptr, png_ptr->chunkdata);
509 png_ptr->chunkdata = text;
510
511 /* This is an extra zero in the 'uncompressed' part. */
512 *(png_ptr->chunkdata + prefix_size) = 0x00;
513 }
514 /* Ignore a malloc error here - it is safe. */
515 }
516
517 *newlength = prefix_size;
518}
519#endif /* PNG_READ_COMPRESSED_TEXT_SUPPORTED */
520
521/* Read and check the IDHR chunk */
522void /* PRIVATE */
523png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
524{
525 png_byte buf[13];
526 png_uint_32 width, height;
527 int bit_depth, color_type, compression_type, filter_type;
528 int interlace_type;
529
530 png_debug(1, "in png_handle_IHDR");
531
532 if (png_ptr->mode & PNG_HAVE_IHDR)
533 png_error(png_ptr, "Out of place IHDR");
534
535 /* Check the length */
536 if (length != 13)
537 png_error(png_ptr, "Invalid IHDR chunk");
538
539 png_ptr->mode |= PNG_HAVE_IHDR;
540
541 png_crc_read(png_ptr, buf, 13);
542 png_crc_finish(png_ptr, 0);
543
544 width = png_get_uint_31(png_ptr, buf);
545 height = png_get_uint_31(png_ptr, buf + 4);
546 bit_depth = buf[8];
547 color_type = buf[9];
548 compression_type = buf[10];
549 filter_type = buf[11];
550 interlace_type = buf[12];
551
552 /* Set internal variables */
553 png_ptr->width = width;
554 png_ptr->height = height;
555 png_ptr->bit_depth = (png_byte)bit_depth;
556 png_ptr->interlaced = (png_byte)interlace_type;
557 png_ptr->color_type = (png_byte)color_type;
558#ifdef PNG_MNG_FEATURES_SUPPORTED
559 png_ptr->filter_type = (png_byte)filter_type;
560#endif
561 png_ptr->compression_type = (png_byte)compression_type;
562
563 /* Find number of channels */
564 switch (png_ptr->color_type)
565 {
566 default: /* invalid, png_set_IHDR calls png_error */
567 case PNG_COLOR_TYPE_GRAY:
568 case PNG_COLOR_TYPE_PALETTE:
569 png_ptr->channels = 1;
570 break;
571
572 case PNG_COLOR_TYPE_RGB:
573 png_ptr->channels = 3;
574 break;
575
576 case PNG_COLOR_TYPE_GRAY_ALPHA:
577 png_ptr->channels = 2;
578 break;
579
580 case PNG_COLOR_TYPE_RGB_ALPHA:
581 png_ptr->channels = 4;
582 break;
583 }
584
585 /* Set up other useful info */
586 png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *
587 png_ptr->channels);
588 png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
589 png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);
590 png_debug1(3, "channels = %d", png_ptr->channels);
591 png_debug1(3, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes);
592 png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
593 color_type, interlace_type, compression_type, filter_type);
594}
595
596/* Read and check the palette */
597void /* PRIVATE */
598png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
599{
600 png_color palette[PNG_MAX_PALETTE_LENGTH];
601 int num, i;
602#ifdef PNG_POINTER_INDEXING_SUPPORTED
603 png_colorp pal_ptr;
604#endif
605
606 png_debug(1, "in png_handle_PLTE");
607
608 if (!(png_ptr->mode & PNG_HAVE_IHDR))
609 png_error(png_ptr, "Missing IHDR before PLTE");
610
611 else if (png_ptr->mode & PNG_HAVE_IDAT)
612 {
613 png_warning(png_ptr, "Invalid PLTE after IDAT");
614 png_crc_finish(png_ptr, length);
615 return;
616 }
617
618 else if (png_ptr->mode & PNG_HAVE_PLTE)
619 png_error(png_ptr, "Duplicate PLTE chunk");
620
621 png_ptr->mode |= PNG_HAVE_PLTE;
622
623 if (!(png_ptr->color_type&PNG_COLOR_MASK_COLOR))
624 {
625 png_warning(png_ptr,
626 "Ignoring PLTE chunk in grayscale PNG");
627 png_crc_finish(png_ptr, length);
628 return;
629 }
630
631#ifndef PNG_READ_OPT_PLTE_SUPPORTED
632 if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
633 {
634 png_crc_finish(png_ptr, length);
635 return;
636 }
637#endif
638
639 if (length > 3*PNG_MAX_PALETTE_LENGTH || length % 3)
640 {
641 if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
642 {
643 png_warning(png_ptr, "Invalid palette chunk");
644 png_crc_finish(png_ptr, length);
645 return;
646 }
647
648 else
649 {
650 png_error(png_ptr, "Invalid palette chunk");
651 }
652 }
653
654 num = (int)length / 3;
655
656#ifdef PNG_POINTER_INDEXING_SUPPORTED
657 for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
658 {
659 png_byte buf[3];
660
661 png_crc_read(png_ptr, buf, 3);
662 pal_ptr->red = buf[0];
663 pal_ptr->green = buf[1];
664 pal_ptr->blue = buf[2];
665 }
666#else
667 for (i = 0; i < num; i++)
668 {
669 png_byte buf[3];
670
671 png_crc_read(png_ptr, buf, 3);
672 /* Don't depend upon png_color being any order */
673 palette[i].red = buf[0];
674 palette[i].green = buf[1];
675 palette[i].blue = buf[2];
676 }
677#endif
678
679 /* If we actually need the PLTE chunk (ie for a paletted image), we do
680 * whatever the normal CRC configuration tells us. However, if we
681 * have an RGB image, the PLTE can be considered ancillary, so
682 * we will act as though it is.
683 */
684#ifndef PNG_READ_OPT_PLTE_SUPPORTED
685 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
686#endif
687 {
688 png_crc_finish(png_ptr, 0);
689 }
690
691#ifndef PNG_READ_OPT_PLTE_SUPPORTED
692 else if (png_crc_error(png_ptr)) /* Only if we have a CRC error */
693 {
694 /* If we don't want to use the data from an ancillary chunk,
695 * we have two options: an error abort, or a warning and we
696 * ignore the data in this chunk (which should be OK, since
697 * it's considered ancillary for a RGB or RGBA image).
698 */
699 if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE))
700 {
701 if (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)
702 {
703 png_chunk_benign_error(png_ptr, "CRC error");
704 }
705
706 else
707 {
708 png_chunk_warning(png_ptr, "CRC error");
709 return;
710 }
711 }
712
713 /* Otherwise, we (optionally) emit a warning and use the chunk. */
714 else if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN))
715 {
716 png_chunk_warning(png_ptr, "CRC error");
717 }
718 }
719#endif
720
721 png_set_PLTE(png_ptr, info_ptr, palette, num);
722
723#ifdef PNG_READ_tRNS_SUPPORTED
724 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
725 {
726 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))
727 {
728 if (png_ptr->num_trans > (png_uint_16)num)
729 {
730 png_warning(png_ptr, "Truncating incorrect tRNS chunk length");
731 png_ptr->num_trans = (png_uint_16)num;
732 }
733
734 if (info_ptr->num_trans > (png_uint_16)num)
735 {
736 png_warning(png_ptr, "Truncating incorrect info tRNS chunk length");
737 info_ptr->num_trans = (png_uint_16)num;
738 }
739 }
740 }
741#endif
742
743}
744
745void /* PRIVATE */
746png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
747{
748 png_debug(1, "in png_handle_IEND");
749
750 if (!(png_ptr->mode & PNG_HAVE_IHDR) || !(png_ptr->mode & PNG_HAVE_IDAT))
751 {
752 png_error(png_ptr, "No image in file");
753 }
754
755 png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);
756
757 if (length != 0)
758 {
759 png_warning(png_ptr, "Incorrect IEND chunk length");
760 }
761
762 png_crc_finish(png_ptr, length);
763
764 PNG_UNUSED(info_ptr) /* Quiet compiler warnings about unused info_ptr */
765}
766
767#ifdef PNG_READ_gAMA_SUPPORTED
768void /* PRIVATE */
769png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
770{
771 png_fixed_point igamma;
772 png_byte buf[4];
773
774 png_debug(1, "in png_handle_gAMA");
775
776 if (!(png_ptr->mode & PNG_HAVE_IHDR))
777 png_error(png_ptr, "Missing IHDR before gAMA");
778
779 else if (png_ptr->mode & PNG_HAVE_IDAT)
780 {
781 png_warning(png_ptr, "Invalid gAMA after IDAT");
782 png_crc_finish(png_ptr, length);
783 return;
784 }
785
786 else if (png_ptr->mode & PNG_HAVE_PLTE)
787 /* Should be an error, but we can cope with it */
788 png_warning(png_ptr, "Out of place gAMA chunk");
789
790 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)
791#ifdef PNG_READ_sRGB_SUPPORTED
792 && !(info_ptr->valid & PNG_INFO_sRGB)
793#endif
794 )
795 {
796 png_warning(png_ptr, "Duplicate gAMA chunk");
797 png_crc_finish(png_ptr, length);
798 return;
799 }
800
801 if (length != 4)
802 {
803 png_warning(png_ptr, "Incorrect gAMA chunk length");
804 png_crc_finish(png_ptr, length);
805 return;
806 }
807
808 png_crc_read(png_ptr, buf, 4);
809
810 if (png_crc_finish(png_ptr, 0))
811 return;
812
813 igamma = png_get_fixed_point(NULL, buf);
814
815 /* Check for zero gamma or an error. */
816 if (igamma <= 0)
817 {
818 png_warning(png_ptr,
819 "Ignoring gAMA chunk with out of range gamma");
820
821 return;
822 }
823
824# ifdef PNG_READ_sRGB_SUPPORTED
825 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))
826 {
827 if (PNG_OUT_OF_RANGE(igamma, 45500, 500))
828 {
829 PNG_WARNING_PARAMETERS(p)
830 png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_fixed, igamma);
831 png_formatted_warning(png_ptr, p,
832 "Ignoring incorrect gAMA value @1 when sRGB is also present");
833 return;
834 }
835 }
836# endif /* PNG_READ_sRGB_SUPPORTED */
837
838# ifdef PNG_READ_GAMMA_SUPPORTED
839 /* Gamma correction on read is supported. */
840 png_ptr->gamma = igamma;
841# endif
842 /* And set the 'info' structure members. */
843 png_set_gAMA_fixed(png_ptr, info_ptr, igamma);
844}
845#endif
846
847#ifdef PNG_READ_sBIT_SUPPORTED
848void /* PRIVATE */
849png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
850{
851 png_size_t truelen;
852 png_byte buf[4];
853
854 png_debug(1, "in png_handle_sBIT");
855
856 buf[0] = buf[1] = buf[2] = buf[3] = 0;
857
858 if (!(png_ptr->mode & PNG_HAVE_IHDR))
859 png_error(png_ptr, "Missing IHDR before sBIT");
860
861 else if (png_ptr->mode & PNG_HAVE_IDAT)
862 {
863 png_warning(png_ptr, "Invalid sBIT after IDAT");
864 png_crc_finish(png_ptr, length);
865 return;
866 }
867
868 else if (png_ptr->mode & PNG_HAVE_PLTE)
869 {
870 /* Should be an error, but we can cope with it */
871 png_warning(png_ptr, "Out of place sBIT chunk");
872 }
873
874 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT))
875 {
876 png_warning(png_ptr, "Duplicate sBIT chunk");
877 png_crc_finish(png_ptr, length);
878 return;
879 }
880
881 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
882 truelen = 3;
883
884 else
885 truelen = (png_size_t)png_ptr->channels;
886
887 if (length != truelen || length > 4)
888 {
889 png_warning(png_ptr, "Incorrect sBIT chunk length");
890 png_crc_finish(png_ptr, length);
891 return;
892 }
893
894 png_crc_read(png_ptr, buf, truelen);
895
896 if (png_crc_finish(png_ptr, 0))
897 return;
898
899 if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)
900 {
901 png_ptr->sig_bit.red = buf[0];
902 png_ptr->sig_bit.green = buf[1];
903 png_ptr->sig_bit.blue = buf[2];
904 png_ptr->sig_bit.alpha = buf[3];
905 }
906
907 else
908 {
909 png_ptr->sig_bit.gray = buf[0];
910 png_ptr->sig_bit.red = buf[0];
911 png_ptr->sig_bit.green = buf[0];
912 png_ptr->sig_bit.blue = buf[0];
913 png_ptr->sig_bit.alpha = buf[1];
914 }
915
916 png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));
917}
918#endif
919
920#ifdef PNG_READ_cHRM_SUPPORTED
921void /* PRIVATE */
922png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
923{
924 png_byte buf[32];
925 png_fixed_point x_white, y_white, x_red, y_red, x_green, y_green, x_blue,
926 y_blue;
927
928 png_debug(1, "in png_handle_cHRM");
929
930 if (!(png_ptr->mode & PNG_HAVE_IHDR))
931 png_error(png_ptr, "Missing IHDR before cHRM");
932
933 else if (png_ptr->mode & PNG_HAVE_IDAT)
934 {
935 png_warning(png_ptr, "Invalid cHRM after IDAT");
936 png_crc_finish(png_ptr, length);
937 return;
938 }
939
940 else if (png_ptr->mode & PNG_HAVE_PLTE)
941 /* Should be an error, but we can cope with it */
942 png_warning(png_ptr, "Out of place cHRM chunk");
943
944 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM)
945# ifdef PNG_READ_sRGB_SUPPORTED
946 && !(info_ptr->valid & PNG_INFO_sRGB)
947# endif
948 )
949 {
950 png_warning(png_ptr, "Duplicate cHRM chunk");
951 png_crc_finish(png_ptr, length);
952 return;
953 }
954
955 if (length != 32)
956 {
957 png_warning(png_ptr, "Incorrect cHRM chunk length");
958 png_crc_finish(png_ptr, length);
959 return;
960 }
961
962 png_crc_read(png_ptr, buf, 32);
963
964 if (png_crc_finish(png_ptr, 0))
965 return;
966
967 x_white = png_get_fixed_point(NULL, buf);
968 y_white = png_get_fixed_point(NULL, buf + 4);
969 x_red = png_get_fixed_point(NULL, buf + 8);
970 y_red = png_get_fixed_point(NULL, buf + 12);
971 x_green = png_get_fixed_point(NULL, buf + 16);
972 y_green = png_get_fixed_point(NULL, buf + 20);
973 x_blue = png_get_fixed_point(NULL, buf + 24);
974 y_blue = png_get_fixed_point(NULL, buf + 28);
975
976 if (x_white == PNG_FIXED_ERROR ||
977 y_white == PNG_FIXED_ERROR ||
978 x_red == PNG_FIXED_ERROR ||
979 y_red == PNG_FIXED_ERROR ||
980 x_green == PNG_FIXED_ERROR ||
981 y_green == PNG_FIXED_ERROR ||
982 x_blue == PNG_FIXED_ERROR ||
983 y_blue == PNG_FIXED_ERROR)
984 {
985 png_warning(png_ptr, "Ignoring cHRM chunk with negative chromaticities");
986 return;
987 }
988
989#ifdef PNG_READ_sRGB_SUPPORTED
990 if ((info_ptr != NULL) && (info_ptr->valid & PNG_INFO_sRGB))
991 {
992 if (PNG_OUT_OF_RANGE(x_white, 31270, 1000) ||
993 PNG_OUT_OF_RANGE(y_white, 32900, 1000) ||
994 PNG_OUT_OF_RANGE(x_red, 64000, 1000) ||
995 PNG_OUT_OF_RANGE(y_red, 33000, 1000) ||
996 PNG_OUT_OF_RANGE(x_green, 30000, 1000) ||
997 PNG_OUT_OF_RANGE(y_green, 60000, 1000) ||
998 PNG_OUT_OF_RANGE(x_blue, 15000, 1000) ||
999 PNG_OUT_OF_RANGE(y_blue, 6000, 1000))
1000 {
1001 PNG_WARNING_PARAMETERS(p)
1002
1003 png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_fixed, x_white);
1004 png_warning_parameter_signed(p, 2, PNG_NUMBER_FORMAT_fixed, y_white);
1005 png_warning_parameter_signed(p, 3, PNG_NUMBER_FORMAT_fixed, x_red);
1006 png_warning_parameter_signed(p, 4, PNG_NUMBER_FORMAT_fixed, y_red);
1007 png_warning_parameter_signed(p, 5, PNG_NUMBER_FORMAT_fixed, x_green);
1008 png_warning_parameter_signed(p, 6, PNG_NUMBER_FORMAT_fixed, y_green);
1009 png_warning_parameter_signed(p, 7, PNG_NUMBER_FORMAT_fixed, x_blue);
1010 png_warning_parameter_signed(p, 8, PNG_NUMBER_FORMAT_fixed, y_blue);
1011
1012 png_formatted_warning(png_ptr, p,
1013 "Ignoring incorrect cHRM white(@1,@2) r(@3,@4)g(@5,@6)b(@7,@8) "
1014 "when sRGB is also present");
1015 }
1016 return;
1017 }
1018#endif /* PNG_READ_sRGB_SUPPORTED */
1019
1020#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
1021 /* Store the _white values as default coefficients for the rgb to gray
1022 * operation if it is supported. Check if the transform is already set to
1023 * avoid destroying the transform values.
1024 */
1025 if (!png_ptr->rgb_to_gray_coefficients_set)
1026 {
1027 /* png_set_background has not been called and we haven't seen an sRGB
1028 * chunk yet. Find the XYZ of the three end points.
1029 */
1030 png_XYZ XYZ;
1031 png_xy xy;
1032
1033 xy.redx = x_red;
1034 xy.redy = y_red;
1035 xy.greenx = x_green;
1036 xy.greeny = y_green;
1037 xy.bluex = x_blue;
1038 xy.bluey = y_blue;
1039 xy.whitex = x_white;
1040 xy.whitey = y_white;
1041
1042 if (png_XYZ_from_xy_checked(png_ptr, &XYZ, xy))
1043 {
1044 /* The success case, because XYZ_from_xy normalises to a reference
1045 * white Y of 1.0 we just need to scale the numbers. This should
1046 * always work just fine. It is an internal error if this overflows.
1047 */
1048 {
1049 png_fixed_point r, g, b;
1050 if (png_muldiv(&r, XYZ.redY, 32768, PNG_FP_1) &&
1051 r >= 0 && r <= 32768 &&
1052 png_muldiv(&g, XYZ.greenY, 32768, PNG_FP_1) &&
1053 g >= 0 && g <= 32768 &&
1054 png_muldiv(&b, XYZ.blueY, 32768, PNG_FP_1) &&
1055 b >= 0 && b <= 32768 &&
1056 r+g+b <= 32769)
1057 {
1058 /* We allow 0 coefficients here. r+g+b may be 32769 if two or
1059 * all of the coefficients were rounded up. Handle this by
1060 * reducing the *largest* coefficient by 1; this matches the
1061 * approach used for the default coefficients in pngrtran.c
1062 */
1063 int add = 0;
1064
1065 if (r+g+b > 32768)
1066 add = -1;
1067 else if (r+g+b < 32768)
1068 add = 1;
1069
1070 if (add != 0)
1071 {
1072 if (g >= r && g >= b)
1073 g += add;
1074 else if (r >= g && r >= b)
1075 r += add;
1076 else
1077 b += add;
1078 }
1079
1080 /* Check for an internal error. */
1081 if (r+g+b != 32768)
1082 png_error(png_ptr,
1083 "internal error handling cHRM coefficients");
1084
1085 png_ptr->rgb_to_gray_red_coeff = (png_uint_16)r;
1086 png_ptr->rgb_to_gray_green_coeff = (png_uint_16)g;
1087 }
1088
1089 /* This is a png_error at present even though it could be ignored -
1090 * it should never happen, but it is important that if it does, the
1091 * bug is fixed.
1092 */
1093 else
1094 png_error(png_ptr, "internal error handling cHRM->XYZ");
1095 }
1096 }
1097 }
1098#endif
1099
1100 png_set_cHRM_fixed(png_ptr, info_ptr, x_white, y_white, x_red, y_red,
1101 x_green, y_green, x_blue, y_blue);
1102}
1103#endif
1104
1105#ifdef PNG_READ_sRGB_SUPPORTED
1106void /* PRIVATE */
1107png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
1108{
1109 int intent;
1110 png_byte buf[1];
1111
1112 png_debug(1, "in png_handle_sRGB");
1113
1114 if (!(png_ptr->mode & PNG_HAVE_IHDR))
1115 png_error(png_ptr, "Missing IHDR before sRGB");
1116
1117 else if (png_ptr->mode & PNG_HAVE_IDAT)
1118 {
1119 png_warning(png_ptr, "Invalid sRGB after IDAT");
1120 png_crc_finish(png_ptr, length);
1121 return;
1122 }
1123
1124 else if (png_ptr->mode & PNG_HAVE_PLTE)
1125 /* Should be an error, but we can cope with it */
1126 png_warning(png_ptr, "Out of place sRGB chunk");
1127
1128 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))
1129 {
1130 png_warning(png_ptr, "Duplicate sRGB chunk");
1131 png_crc_finish(png_ptr, length);
1132 return;
1133 }
1134
1135 if (length != 1)
1136 {
1137 png_warning(png_ptr, "Incorrect sRGB chunk length");
1138 png_crc_finish(png_ptr, length);
1139 return;
1140 }
1141
1142 png_crc_read(png_ptr, buf, 1);
1143
1144 if (png_crc_finish(png_ptr, 0))
1145 return;
1146
1147 intent = buf[0];
1148
1149 /* Check for bad intent */
1150 if (intent >= PNG_sRGB_INTENT_LAST)
1151 {
1152 png_warning(png_ptr, "Unknown sRGB intent");
1153 return;
1154 }
1155
1156#if defined(PNG_READ_gAMA_SUPPORTED) && defined(PNG_READ_GAMMA_SUPPORTED)
1157 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA))
1158 {
1159 if (PNG_OUT_OF_RANGE(info_ptr->gamma, 45500, 500))
1160 {
1161 PNG_WARNING_PARAMETERS(p)
1162
1163 png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_fixed,
1164 info_ptr->gamma);
1165
1166 png_formatted_warning(png_ptr, p,
1167 "Ignoring incorrect gAMA value @1 when sRGB is also present");
1168 }
1169 }
1170#endif /* PNG_READ_gAMA_SUPPORTED */
1171
1172#ifdef PNG_READ_cHRM_SUPPORTED
1173 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM))
1174 if (PNG_OUT_OF_RANGE(info_ptr->x_white, 31270, 1000) ||
1175 PNG_OUT_OF_RANGE(info_ptr->y_white, 32900, 1000) ||
1176 PNG_OUT_OF_RANGE(info_ptr->x_red, 64000, 1000) ||
1177 PNG_OUT_OF_RANGE(info_ptr->y_red, 33000, 1000) ||
1178 PNG_OUT_OF_RANGE(info_ptr->x_green, 30000, 1000) ||
1179 PNG_OUT_OF_RANGE(info_ptr->y_green, 60000, 1000) ||
1180 PNG_OUT_OF_RANGE(info_ptr->x_blue, 15000, 1000) ||
1181 PNG_OUT_OF_RANGE(info_ptr->y_blue, 6000, 1000))
1182 {
1183 png_warning(png_ptr,
1184 "Ignoring incorrect cHRM value when sRGB is also present");
1185 }
1186#endif /* PNG_READ_cHRM_SUPPORTED */
1187
1188 /* This is recorded for use when handling the cHRM chunk above. An sRGB
1189 * chunk unconditionally overwrites the coefficients for grayscale conversion
1190 * too.
1191 */
1192 png_ptr->is_sRGB = 1;
1193
1194# ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
1195 /* Don't overwrite user supplied values: */
1196 if (!png_ptr->rgb_to_gray_coefficients_set)
1197 {
1198 /* These numbers come from the sRGB specification (or, since one has to
1199 * pay much money to get a copy, the wikipedia sRGB page) the
1200 * chromaticity values quoted have been inverted to get the reverse
1201 * transformation from RGB to XYZ and the 'Y' coefficients scaled by
1202 * 32768 (then rounded).
1203 *
1204 * sRGB and ITU Rec-709 both truncate the values for the D65 white
1205 * point to four digits and, even though it actually stores five
1206 * digits, the PNG spec gives the truncated value.
1207 *
1208 * This means that when the chromaticities are converted back to XYZ
1209 * end points we end up with (6968,23435,2366), which, as described in
1210 * pngrtran.c, would overflow. If the five digit precision and up is
1211 * used we get, instead:
1212 *
1213 * 6968*R + 23435*G + 2365*B
1214 *
1215 * (Notice that this rounds the blue coefficient down, rather than the
1216 * choice used in pngrtran.c which is to round the green one down.)
1217 */
1218 png_ptr->rgb_to_gray_red_coeff = 6968; /* 0.212639005871510 */
1219 png_ptr->rgb_to_gray_green_coeff = 23434; /* 0.715168678767756 */
1220 /* png_ptr->rgb_to_gray_blue_coeff = 2366; 0.072192315360734 */
1221
1222 /* The following keeps the cHRM chunk from destroying the
1223 * coefficients again in the event that it follows the sRGB chunk.
1224 */
1225 png_ptr->rgb_to_gray_coefficients_set = 1;
1226 }
1227# endif
1228
1229 png_set_sRGB_gAMA_and_cHRM(png_ptr, info_ptr, intent);
1230}
1231#endif /* PNG_READ_sRGB_SUPPORTED */
1232
1233#ifdef PNG_READ_iCCP_SUPPORTED
1234void /* PRIVATE */
1235png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
1236/* Note: this does not properly handle chunks that are > 64K under DOS */
1237{
1238 png_byte compression_type;
1239 png_bytep pC;
1240 png_charp profile;
1241 png_uint_32 skip = 0;
1242 png_uint_32 profile_size;
1243 png_alloc_size_t profile_length;
1244 png_size_t slength, prefix_length, data_length;
1245
1246 png_debug(1, "in png_handle_iCCP");
1247
1248 if (!(png_ptr->mode & PNG_HAVE_IHDR))
1249 png_error(png_ptr, "Missing IHDR before iCCP");
1250
1251 else if (png_ptr->mode & PNG_HAVE_IDAT)
1252 {
1253 png_warning(png_ptr, "Invalid iCCP after IDAT");
1254 png_crc_finish(png_ptr, length);
1255 return;
1256 }
1257
1258 else if (png_ptr->mode & PNG_HAVE_PLTE)
1259 /* Should be an error, but we can cope with it */
1260 png_warning(png_ptr, "Out of place iCCP chunk");
1261
1262 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP))
1263 {
1264 png_warning(png_ptr, "Duplicate iCCP chunk");
1265 png_crc_finish(png_ptr, length);
1266 return;
1267 }
1268
1269#ifdef PNG_MAX_MALLOC_64K
1270 if (length > (png_uint_32)65535L)
1271 {
1272 png_warning(png_ptr, "iCCP chunk too large to fit in memory");
1273 skip = length - (png_uint_32)65535L;
1274 length = (png_uint_32)65535L;
1275 }
1276#endif
1277
1278 png_free(png_ptr, png_ptr->chunkdata);
1279 png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
1280 slength = length;
1281 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
1282
1283 if (png_crc_finish(png_ptr, skip))
1284 {
1285 png_free(png_ptr, png_ptr->chunkdata);
1286 png_ptr->chunkdata = NULL;
1287 return;
1288 }
1289
1290 png_ptr->chunkdata[slength] = 0x00;
1291
1292 for (profile = png_ptr->chunkdata; *profile; profile++)
1293 /* Empty loop to find end of name */ ;
1294
1295 ++profile;
1296
1297 /* There should be at least one zero (the compression type byte)
1298 * following the separator, and we should be on it
1299 */
1300 if (profile >= png_ptr->chunkdata + slength - 1)
1301 {
1302 png_free(png_ptr, png_ptr->chunkdata);
1303 png_ptr->chunkdata = NULL;
1304 png_warning(png_ptr, "Malformed iCCP chunk");
1305 return;
1306 }
1307
1308 /* Compression_type should always be zero */
1309 compression_type = *profile++;
1310
1311 if (compression_type)
1312 {
1313 png_warning(png_ptr, "Ignoring nonzero compression type in iCCP chunk");
1314 compression_type = 0x00; /* Reset it to zero (libpng-1.0.6 through 1.0.8
1315 wrote nonzero) */
1316 }
1317
1318 prefix_length = profile - png_ptr->chunkdata;
1319 png_decompress_chunk(png_ptr, compression_type,
1320 slength, prefix_length, &data_length);
1321
1322 profile_length = data_length - prefix_length;
1323
1324 if (prefix_length > data_length || profile_length < 4)
1325 {
1326 png_free(png_ptr, png_ptr->chunkdata);
1327 png_ptr->chunkdata = NULL;
1328 png_warning(png_ptr, "Profile size field missing from iCCP chunk");
1329 return;
1330 }
1331
1332 /* Check the profile_size recorded in the first 32 bits of the ICC profile */
1333 pC = (png_bytep)(png_ptr->chunkdata + prefix_length);
1334 profile_size = ((*(pC )) << 24) |
1335 ((*(pC + 1)) << 16) |
1336 ((*(pC + 2)) << 8) |
1337 ((*(pC + 3)) );
1338
1339 /* NOTE: the following guarantees that 'profile_length' fits into 32 bits,
1340 * because profile_size is a 32 bit value.
1341 */
1342 if (profile_size < profile_length)
1343 profile_length = profile_size;
1344
1345 /* And the following guarantees that profile_size == profile_length. */
1346 if (profile_size > profile_length)
1347 {
1348 PNG_WARNING_PARAMETERS(p)
1349
1350 png_free(png_ptr, png_ptr->chunkdata);
1351 png_ptr->chunkdata = NULL;
1352
1353 png_warning_parameter_unsigned(p, 1, PNG_NUMBER_FORMAT_u, profile_size);
1354 png_warning_parameter_unsigned(p, 2, PNG_NUMBER_FORMAT_u, profile_length);
1355 png_formatted_warning(png_ptr, p,
1356 "Ignoring iCCP chunk with declared size = @1 and actual length = @2");
1357 return;
1358 }
1359
1360 png_set_iCCP(png_ptr, info_ptr, png_ptr->chunkdata,
1361 compression_type, (png_bytep)png_ptr->chunkdata + prefix_length,
1362 profile_size);
1363 png_free(png_ptr, png_ptr->chunkdata);
1364 png_ptr->chunkdata = NULL;
1365}
1366#endif /* PNG_READ_iCCP_SUPPORTED */
1367
1368#ifdef PNG_READ_sPLT_SUPPORTED
1369void /* PRIVATE */
1370png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
1371/* Note: this does not properly handle chunks that are > 64K under DOS */
1372{
1373 png_bytep entry_start;
1374 png_sPLT_t new_palette;
1375 png_sPLT_entryp pp;
1376 png_uint_32 data_length;
1377 int entry_size, i;
1378 png_uint_32 skip = 0;
1379 png_size_t slength;
1380 png_uint_32 dl;
1381 png_size_t max_dl;
1382
1383 png_debug(1, "in png_handle_sPLT");
1384
1385#ifdef PNG_USER_LIMITS_SUPPORTED
1386
1387 if (png_ptr->user_chunk_cache_max != 0)
1388 {
1389 if (png_ptr->user_chunk_cache_max == 1)
1390 {
1391 png_crc_finish(png_ptr, length);
1392 return;
1393 }
1394
1395 if (--png_ptr->user_chunk_cache_max == 1)
1396 {
1397 png_warning(png_ptr, "No space in chunk cache for sPLT");
1398 png_crc_finish(png_ptr, length);
1399 return;
1400 }
1401 }
1402#endif
1403
1404 if (!(png_ptr->mode & PNG_HAVE_IHDR))
1405 png_error(png_ptr, "Missing IHDR before sPLT");
1406
1407 else if (png_ptr->mode & PNG_HAVE_IDAT)
1408 {
1409 png_warning(png_ptr, "Invalid sPLT after IDAT");
1410 png_crc_finish(png_ptr, length);
1411 return;
1412 }
1413
1414#ifdef PNG_MAX_MALLOC_64K
1415 if (length > (png_uint_32)65535L)
1416 {
1417 png_warning(png_ptr, "sPLT chunk too large to fit in memory");
1418 skip = length - (png_uint_32)65535L;
1419 length = (png_uint_32)65535L;
1420 }
1421#endif
1422
1423 png_free(png_ptr, png_ptr->chunkdata);
1424 png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
1425
1426 /* WARNING: this may break if size_t is less than 32 bits; it is assumed
1427 * that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a
1428 * potential breakage point if the types in pngconf.h aren't exactly right.
1429 */
1430 slength = length;
1431 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
1432
1433 if (png_crc_finish(png_ptr, skip))
1434 {
1435 png_free(png_ptr, png_ptr->chunkdata);
1436 png_ptr->chunkdata = NULL;
1437 return;
1438 }
1439
1440 png_ptr->chunkdata[slength] = 0x00;
1441
1442 for (entry_start = (png_bytep)png_ptr->chunkdata; *entry_start;
1443 entry_start++)
1444 /* Empty loop to find end of name */ ;
1445
1446 ++entry_start;
1447
1448 /* A sample depth should follow the separator, and we should be on it */
1449 if (entry_start > (png_bytep)png_ptr->chunkdata + slength - 2)
1450 {
1451 png_free(png_ptr, png_ptr->chunkdata);
1452 png_ptr->chunkdata = NULL;
1453 png_warning(png_ptr, "malformed sPLT chunk");
1454 return;
1455 }
1456
1457 new_palette.depth = *entry_start++;
1458 entry_size = (new_palette.depth == 8 ? 6 : 10);
1459 /* This must fit in a png_uint_32 because it is derived from the original
1460 * chunk data length (and use 'length', not 'slength' here for clarity -
1461 * they are guaranteed to be the same, see the tests above.)
1462 */
1463 data_length = length - (png_uint_32)(entry_start -
1464 (png_bytep)png_ptr->chunkdata);
1465
1466 /* Integrity-check the data length */
1467 if (data_length % entry_size)
1468 {
1469 png_free(png_ptr, png_ptr->chunkdata);
1470 png_ptr->chunkdata = NULL;
1471 png_warning(png_ptr, "sPLT chunk has bad length");
1472 return;
1473 }
1474
1475 dl = (png_int_32)(data_length / entry_size);
1476 max_dl = PNG_SIZE_MAX / png_sizeof(png_sPLT_entry);
1477
1478 if (dl > max_dl)
1479 {
1480 png_warning(png_ptr, "sPLT chunk too long");
1481 return;
1482 }
1483
1484 new_palette.nentries = (png_int_32)(data_length / entry_size);
1485
1486 new_palette.entries = (png_sPLT_entryp)png_malloc_warn(
1487 png_ptr, new_palette.nentries * png_sizeof(png_sPLT_entry));
1488
1489 if (new_palette.entries == NULL)
1490 {
1491 png_warning(png_ptr, "sPLT chunk requires too much memory");
1492 return;
1493 }
1494
1495#ifdef PNG_POINTER_INDEXING_SUPPORTED
1496 for (i = 0; i < new_palette.nentries; i++)
1497 {
1498 pp = new_palette.entries + i;
1499
1500 if (new_palette.depth == 8)
1501 {
1502 pp->red = *entry_start++;
1503 pp->green = *entry_start++;
1504 pp->blue = *entry_start++;
1505 pp->alpha = *entry_start++;
1506 }
1507
1508 else
1509 {
1510 pp->red = png_get_uint_16(entry_start); entry_start += 2;
1511 pp->green = png_get_uint_16(entry_start); entry_start += 2;
1512 pp->blue = png_get_uint_16(entry_start); entry_start += 2;
1513 pp->alpha = png_get_uint_16(entry_start); entry_start += 2;
1514 }
1515
1516 pp->frequency = png_get_uint_16(entry_start); entry_start += 2;
1517 }
1518#else
1519 pp = new_palette.entries;
1520
1521 for (i = 0; i < new_palette.nentries; i++)
1522 {
1523
1524 if (new_palette.depth == 8)
1525 {
1526 pp[i].red = *entry_start++;
1527 pp[i].green = *entry_start++;
1528 pp[i].blue = *entry_start++;
1529 pp[i].alpha = *entry_start++;
1530 }
1531
1532 else
1533 {
1534 pp[i].red = png_get_uint_16(entry_start); entry_start += 2;
1535 pp[i].green = png_get_uint_16(entry_start); entry_start += 2;
1536 pp[i].blue = png_get_uint_16(entry_start); entry_start += 2;
1537 pp[i].alpha = png_get_uint_16(entry_start); entry_start += 2;
1538 }
1539
1540 pp[i].frequency = png_get_uint_16(entry_start); entry_start += 2;
1541 }
1542#endif
1543
1544 /* Discard all chunk data except the name and stash that */
1545 new_palette.name = png_ptr->chunkdata;
1546
1547 png_set_sPLT(png_ptr, info_ptr, &new_palette, 1);
1548
1549 png_free(png_ptr, png_ptr->chunkdata);
1550 png_ptr->chunkdata = NULL;
1551 png_free(png_ptr, new_palette.entries);
1552}
1553#endif /* PNG_READ_sPLT_SUPPORTED */
1554
1555#ifdef PNG_READ_tRNS_SUPPORTED
1556void /* PRIVATE */
1557png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
1558{
1559 png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
1560
1561 png_debug(1, "in png_handle_tRNS");
1562
1563 if (!(png_ptr->mode & PNG_HAVE_IHDR))
1564 png_error(png_ptr, "Missing IHDR before tRNS");
1565
1566 else if (png_ptr->mode & PNG_HAVE_IDAT)
1567 {
1568 png_warning(png_ptr, "Invalid tRNS after IDAT");
1569 png_crc_finish(png_ptr, length);
1570 return;
1571 }
1572
1573 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))
1574 {
1575 png_warning(png_ptr, "Duplicate tRNS chunk");
1576 png_crc_finish(png_ptr, length);
1577 return;
1578 }
1579
1580 if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
1581 {
1582 png_byte buf[2];
1583
1584 if (length != 2)
1585 {
1586 png_warning(png_ptr, "Incorrect tRNS chunk length");
1587 png_crc_finish(png_ptr, length);
1588 return;
1589 }
1590
1591 png_crc_read(png_ptr, buf, 2);
1592 png_ptr->num_trans = 1;
1593 png_ptr->trans_color.gray = png_get_uint_16(buf);
1594 }
1595
1596 else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
1597 {
1598 png_byte buf[6];
1599
1600 if (length != 6)
1601 {
1602 png_warning(png_ptr, "Incorrect tRNS chunk length");
1603 png_crc_finish(png_ptr, length);
1604 return;
1605 }
1606
1607 png_crc_read(png_ptr, buf, (png_size_t)length);
1608 png_ptr->num_trans = 1;
1609 png_ptr->trans_color.red = png_get_uint_16(buf);
1610 png_ptr->trans_color.green = png_get_uint_16(buf + 2);
1611 png_ptr->trans_color.blue = png_get_uint_16(buf + 4);
1612 }
1613
1614 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1615 {
1616 if (!(png_ptr->mode & PNG_HAVE_PLTE))
1617 {
1618 /* Should be an error, but we can cope with it. */
1619 png_warning(png_ptr, "Missing PLTE before tRNS");
1620 }
1621
1622 if (length > (png_uint_32)png_ptr->num_palette ||
1623 length > PNG_MAX_PALETTE_LENGTH)
1624 {
1625 png_warning(png_ptr, "Incorrect tRNS chunk length");
1626 png_crc_finish(png_ptr, length);
1627 return;
1628 }
1629
1630 if (length == 0)
1631 {
1632 png_warning(png_ptr, "Zero length tRNS chunk");
1633 png_crc_finish(png_ptr, length);
1634 return;
1635 }
1636
1637 png_crc_read(png_ptr, readbuf, (png_size_t)length);
1638 png_ptr->num_trans = (png_uint_16)length;
1639 }
1640
1641 else
1642 {
1643 png_warning(png_ptr, "tRNS chunk not allowed with alpha channel");
1644 png_crc_finish(png_ptr, length);
1645 return;
1646 }
1647
1648 if (png_crc_finish(png_ptr, 0))
1649 {
1650 png_ptr->num_trans = 0;
1651 return;
1652 }
1653
1654 png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
1655 &(png_ptr->trans_color));
1656}
1657#endif
1658
1659#ifdef PNG_READ_bKGD_SUPPORTED
1660void /* PRIVATE */
1661png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
1662{
1663 png_size_t truelen;
1664 png_byte buf[6];
1665 png_color_16 background;
1666
1667 png_debug(1, "in png_handle_bKGD");
1668
1669 if (!(png_ptr->mode & PNG_HAVE_IHDR))
1670 png_error(png_ptr, "Missing IHDR before bKGD");
1671
1672 else if (png_ptr->mode & PNG_HAVE_IDAT)
1673 {
1674 png_warning(png_ptr, "Invalid bKGD after IDAT");
1675 png_crc_finish(png_ptr, length);
1676 return;
1677 }
1678
1679 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
1680 !(png_ptr->mode & PNG_HAVE_PLTE))
1681 {
1682 png_warning(png_ptr, "Missing PLTE before bKGD");
1683 png_crc_finish(png_ptr, length);
1684 return;
1685 }
1686
1687 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD))
1688 {
1689 png_warning(png_ptr, "Duplicate bKGD chunk");
1690 png_crc_finish(png_ptr, length);
1691 return;
1692 }
1693
1694 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1695 truelen = 1;
1696
1697 else if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)
1698 truelen = 6;
1699
1700 else
1701 truelen = 2;
1702
1703 if (length != truelen)
1704 {
1705 png_warning(png_ptr, "Incorrect bKGD chunk length");
1706 png_crc_finish(png_ptr, length);
1707 return;
1708 }
1709
1710 png_crc_read(png_ptr, buf, truelen);
1711
1712 if (png_crc_finish(png_ptr, 0))
1713 return;
1714
1715 /* We convert the index value into RGB components so that we can allow
1716 * arbitrary RGB values for background when we have transparency, and
1717 * so it is easy to determine the RGB values of the background color
1718 * from the info_ptr struct.
1719 */
1720 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1721 {
1722 background.index = buf[0];
1723
1724 if (info_ptr && info_ptr->num_palette)
1725 {
1726 if (buf[0] >= info_ptr->num_palette)
1727 {
1728 png_warning(png_ptr, "Incorrect bKGD chunk index value");
1729 return;
1730 }
1731
1732 background.red = (png_uint_16)png_ptr->palette[buf[0]].red;
1733 background.green = (png_uint_16)png_ptr->palette[buf[0]].green;
1734 background.blue = (png_uint_16)png_ptr->palette[buf[0]].blue;
1735 }
1736
1737 else
1738 background.red = background.green = background.blue = 0;
1739
1740 background.gray = 0;
1741 }
1742
1743 else if (!(png_ptr->color_type & PNG_COLOR_MASK_COLOR)) /* GRAY */
1744 {
1745 background.index = 0;
1746 background.red =
1747 background.green =
1748 background.blue =
1749 background.gray = png_get_uint_16(buf);
1750 }
1751
1752 else
1753 {
1754 background.index = 0;
1755 background.red = png_get_uint_16(buf);
1756 background.green = png_get_uint_16(buf + 2);
1757 background.blue = png_get_uint_16(buf + 4);
1758 background.gray = 0;
1759 }
1760
1761 png_set_bKGD(png_ptr, info_ptr, &background);
1762}
1763#endif
1764
1765#ifdef PNG_READ_hIST_SUPPORTED
1766void /* PRIVATE */
1767png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
1768{
1769 unsigned int num, i;
1770 png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
1771
1772 png_debug(1, "in png_handle_hIST");
1773
1774 if (!(png_ptr->mode & PNG_HAVE_IHDR))
1775 png_error(png_ptr, "Missing IHDR before hIST");
1776
1777 else if (png_ptr->mode & PNG_HAVE_IDAT)
1778 {
1779 png_warning(png_ptr, "Invalid hIST after IDAT");
1780 png_crc_finish(png_ptr, length);
1781 return;
1782 }
1783
1784 else if (!(png_ptr->mode & PNG_HAVE_PLTE))
1785 {
1786 png_warning(png_ptr, "Missing PLTE before hIST");
1787 png_crc_finish(png_ptr, length);
1788 return;
1789 }
1790
1791 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST))
1792 {
1793 png_warning(png_ptr, "Duplicate hIST chunk");
1794 png_crc_finish(png_ptr, length);
1795 return;
1796 }
1797
1798 num = length / 2 ;
1799
1800 if (num != (unsigned int)png_ptr->num_palette || num >
1801 (unsigned int)PNG_MAX_PALETTE_LENGTH)
1802 {
1803 png_warning(png_ptr, "Incorrect hIST chunk length");
1804 png_crc_finish(png_ptr, length);
1805 return;
1806 }
1807
1808 for (i = 0; i < num; i++)
1809 {
1810 png_byte buf[2];
1811
1812 png_crc_read(png_ptr, buf, 2);
1813 readbuf[i] = png_get_uint_16(buf);
1814 }
1815
1816 if (png_crc_finish(png_ptr, 0))
1817 return;
1818
1819 png_set_hIST(png_ptr, info_ptr, readbuf);
1820}
1821#endif
1822
1823#ifdef PNG_READ_pHYs_SUPPORTED
1824void /* PRIVATE */
1825png_handle_pHYs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
1826{
1827 png_byte buf[9];
1828 png_uint_32 res_x, res_y;
1829 int unit_type;
1830
1831 png_debug(1, "in png_handle_pHYs");
1832
1833 if (!(png_ptr->mode & PNG_HAVE_IHDR))
1834 png_error(png_ptr, "Missing IHDR before pHYs");
1835
1836 else if (png_ptr->mode & PNG_HAVE_IDAT)
1837 {
1838 png_warning(png_ptr, "Invalid pHYs after IDAT");
1839 png_crc_finish(png_ptr, length);
1840 return;
1841 }
1842
1843 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs))
1844 {
1845 png_warning(png_ptr, "Duplicate pHYs chunk");
1846 png_crc_finish(png_ptr, length);
1847 return;
1848 }
1849
1850 if (length != 9)
1851 {
1852 png_warning(png_ptr, "Incorrect pHYs chunk length");
1853 png_crc_finish(png_ptr, length);
1854 return;
1855 }
1856
1857 png_crc_read(png_ptr, buf, 9);
1858
1859 if (png_crc_finish(png_ptr, 0))
1860 return;
1861
1862 res_x = png_get_uint_32(buf);
1863 res_y = png_get_uint_32(buf + 4);
1864 unit_type = buf[8];
1865 png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type);
1866}
1867#endif
1868
1869#ifdef PNG_READ_oFFs_SUPPORTED
1870void /* PRIVATE */
1871png_handle_oFFs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
1872{
1873 png_byte buf[9];
1874 png_int_32 offset_x, offset_y;
1875 int unit_type;
1876
1877 png_debug(1, "in png_handle_oFFs");
1878
1879 if (!(png_ptr->mode & PNG_HAVE_IHDR))
1880 png_error(png_ptr, "Missing IHDR before oFFs");
1881
1882 else if (png_ptr->mode & PNG_HAVE_IDAT)
1883 {
1884 png_warning(png_ptr, "Invalid oFFs after IDAT");
1885 png_crc_finish(png_ptr, length);
1886 return;
1887 }
1888
1889 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs))
1890 {
1891 png_warning(png_ptr, "Duplicate oFFs chunk");
1892 png_crc_finish(png_ptr, length);
1893 return;
1894 }
1895
1896 if (length != 9)
1897 {
1898 png_warning(png_ptr, "Incorrect oFFs chunk length");
1899 png_crc_finish(png_ptr, length);
1900 return;
1901 }
1902
1903 png_crc_read(png_ptr, buf, 9);
1904
1905 if (png_crc_finish(png_ptr, 0))
1906 return;
1907
1908 offset_x = png_get_int_32(buf);
1909 offset_y = png_get_int_32(buf + 4);
1910 unit_type = buf[8];
1911 png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type);
1912}
1913#endif
1914
1915#ifdef PNG_READ_pCAL_SUPPORTED
1916/* Read the pCAL chunk (described in the PNG Extensions document) */
1917void /* PRIVATE */
1918png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
1919{
1920 png_int_32 X0, X1;
1921 png_byte type, nparams;
1922 png_charp buf, units, endptr;
1923 png_charpp params;
1924 png_size_t slength;
1925 int i;
1926
1927 png_debug(1, "in png_handle_pCAL");
1928
1929 if (!(png_ptr->mode & PNG_HAVE_IHDR))
1930 png_error(png_ptr, "Missing IHDR before pCAL");
1931
1932 else if (png_ptr->mode & PNG_HAVE_IDAT)
1933 {
1934 png_warning(png_ptr, "Invalid pCAL after IDAT");
1935 png_crc_finish(png_ptr, length);
1936 return;
1937 }
1938
1939 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL))
1940 {
1941 png_warning(png_ptr, "Duplicate pCAL chunk");
1942 png_crc_finish(png_ptr, length);
1943 return;
1944 }
1945
1946 png_debug1(2, "Allocating and reading pCAL chunk data (%u bytes)",
1947 length + 1);
1948 png_free(png_ptr, png_ptr->chunkdata);
1949 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
1950
1951 if (png_ptr->chunkdata == NULL)
1952 {
1953 png_warning(png_ptr, "No memory for pCAL purpose");
1954 return;
1955 }
1956
1957 slength = length;
1958 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
1959
1960 if (png_crc_finish(png_ptr, 0))
1961 {
1962 png_free(png_ptr, png_ptr->chunkdata);
1963 png_ptr->chunkdata = NULL;
1964 return;
1965 }
1966
1967 png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */
1968
1969 png_debug(3, "Finding end of pCAL purpose string");
1970 for (buf = png_ptr->chunkdata; *buf; buf++)
1971 /* Empty loop */ ;
1972
1973 endptr = png_ptr->chunkdata + slength;
1974
1975 /* We need to have at least 12 bytes after the purpose string
1976 * in order to get the parameter information.
1977 */
1978 if (endptr <= buf + 12)
1979 {
1980 png_warning(png_ptr, "Invalid pCAL data");
1981 png_free(png_ptr, png_ptr->chunkdata);
1982 png_ptr->chunkdata = NULL;
1983 return;
1984 }
1985
1986 png_debug(3, "Reading pCAL X0, X1, type, nparams, and units");
1987 X0 = png_get_int_32((png_bytep)buf+1);
1988 X1 = png_get_int_32((png_bytep)buf+5);
1989 type = buf[9];
1990 nparams = buf[10];
1991 units = buf + 11;
1992
1993 png_debug(3, "Checking pCAL equation type and number of parameters");
1994 /* Check that we have the right number of parameters for known
1995 * equation types.
1996 */
1997 if ((type == PNG_EQUATION_LINEAR && nparams != 2) ||
1998 (type == PNG_EQUATION_BASE_E && nparams != 3) ||
1999 (type == PNG_EQUATION_ARBITRARY && nparams != 3) ||
2000 (type == PNG_EQUATION_HYPERBOLIC && nparams != 4))
2001 {
2002 png_warning(png_ptr, "Invalid pCAL parameters for equation type");
2003 png_free(png_ptr, png_ptr->chunkdata);
2004 png_ptr->chunkdata = NULL;
2005 return;
2006 }
2007
2008 else if (type >= PNG_EQUATION_LAST)
2009 {
2010 png_warning(png_ptr, "Unrecognized equation type for pCAL chunk");
2011 }
2012
2013 for (buf = units; *buf; buf++)
2014 /* Empty loop to move past the units string. */ ;
2015
2016 png_debug(3, "Allocating pCAL parameters array");
2017
2018 params = (png_charpp)png_malloc_warn(png_ptr,
2019 (png_size_t)(nparams * png_sizeof(png_charp)));
2020
2021 if (params == NULL)
2022 {
2023 png_free(png_ptr, png_ptr->chunkdata);
2024 png_ptr->chunkdata = NULL;
2025 png_warning(png_ptr, "No memory for pCAL params");
2026 return;
2027 }
2028
2029 /* Get pointers to the start of each parameter string. */
2030 for (i = 0; i < (int)nparams; i++)
2031 {
2032 buf++; /* Skip the null string terminator from previous parameter. */
2033
2034 png_debug1(3, "Reading pCAL parameter %d", i);
2035
2036 for (params[i] = buf; buf <= endptr && *buf != 0x00; buf++)
2037 /* Empty loop to move past each parameter string */ ;
2038
2039 /* Make sure we haven't run out of data yet */
2040 if (buf > endptr)
2041 {
2042 png_warning(png_ptr, "Invalid pCAL data");
2043 png_free(png_ptr, png_ptr->chunkdata);
2044 png_ptr->chunkdata = NULL;
2045 png_free(png_ptr, params);
2046 return;
2047 }
2048 }
2049
2050 png_set_pCAL(png_ptr, info_ptr, png_ptr->chunkdata, X0, X1, type, nparams,
2051 units, params);
2052
2053 png_free(png_ptr, png_ptr->chunkdata);
2054 png_ptr->chunkdata = NULL;
2055 png_free(png_ptr, params);
2056}
2057#endif
2058
2059#ifdef PNG_READ_sCAL_SUPPORTED
2060/* Read the sCAL chunk */
2061void /* PRIVATE */
2062png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
2063{
2064 png_size_t slength, i;
2065 int state;
2066
2067 png_debug(1, "in png_handle_sCAL");
2068
2069 if (!(png_ptr->mode & PNG_HAVE_IHDR))
2070 png_error(png_ptr, "Missing IHDR before sCAL");
2071
2072 else if (png_ptr->mode & PNG_HAVE_IDAT)
2073 {
2074 png_warning(png_ptr, "Invalid sCAL after IDAT");
2075 png_crc_finish(png_ptr, length);
2076 return;
2077 }
2078
2079 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL))
2080 {
2081 png_warning(png_ptr, "Duplicate sCAL chunk");
2082 png_crc_finish(png_ptr, length);
2083 return;
2084 }
2085
2086 /* Need unit type, width, \0, height: minimum 4 bytes */
2087 else if (length < 4)
2088 {
2089 png_warning(png_ptr, "sCAL chunk too short");
2090 png_crc_finish(png_ptr, length);
2091 return;
2092 }
2093
2094 png_debug1(2, "Allocating and reading sCAL chunk data (%u bytes)",
2095 length + 1);
2096
2097 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
2098
2099 if (png_ptr->chunkdata == NULL)
2100 {
2101 png_warning(png_ptr, "Out of memory while processing sCAL chunk");
2102 png_crc_finish(png_ptr, length);
2103 return;
2104 }
2105
2106 slength = length;
2107 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
2108 png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */
2109
2110 if (png_crc_finish(png_ptr, 0))
2111 {
2112 png_free(png_ptr, png_ptr->chunkdata);
2113 png_ptr->chunkdata = NULL;
2114 return;
2115 }
2116
2117 /* Validate the unit. */
2118 if (png_ptr->chunkdata[0] != 1 && png_ptr->chunkdata[0] != 2)
2119 {
2120 png_warning(png_ptr, "Invalid sCAL ignored: invalid unit");
2121 png_free(png_ptr, png_ptr->chunkdata);
2122 png_ptr->chunkdata = NULL;
2123 return;
2124 }
2125
2126 /* Validate the ASCII numbers, need two ASCII numbers separated by
2127 * a '\0' and they need to fit exactly in the chunk data.
2128 */
2129 i = 1;
2130 state = 0;
2131
2132 if (!png_check_fp_number(png_ptr->chunkdata, slength, &state, &i) ||
2133 i >= slength || png_ptr->chunkdata[i++] != 0)
2134 png_warning(png_ptr, "Invalid sCAL chunk ignored: bad width format");
2135
2136 else if (!PNG_FP_IS_POSITIVE(state))
2137 png_warning(png_ptr, "Invalid sCAL chunk ignored: non-positive width");
2138
2139 else
2140 {
2141 png_size_t heighti = i;
2142
2143 state = 0;
2144 if (!png_check_fp_number(png_ptr->chunkdata, slength, &state, &i) ||
2145 i != slength)
2146 png_warning(png_ptr, "Invalid sCAL chunk ignored: bad height format");
2147
2148 else if (!PNG_FP_IS_POSITIVE(state))
2149 png_warning(png_ptr,
2150 "Invalid sCAL chunk ignored: non-positive height");
2151
2152 else
2153 /* This is the (only) success case. */
2154 png_set_sCAL_s(png_ptr, info_ptr, png_ptr->chunkdata[0],
2155 png_ptr->chunkdata+1, png_ptr->chunkdata+heighti);
2156 }
2157
2158 /* Clean up - just free the temporarily allocated buffer. */
2159 png_free(png_ptr, png_ptr->chunkdata);
2160 png_ptr->chunkdata = NULL;
2161}
2162#endif
2163
2164#ifdef PNG_READ_tIME_SUPPORTED
2165void /* PRIVATE */
2166png_handle_tIME(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
2167{
2168 png_byte buf[7];
2169 png_time mod_time;
2170
2171 png_debug(1, "in png_handle_tIME");
2172
2173 if (!(png_ptr->mode & PNG_HAVE_IHDR))
2174 png_error(png_ptr, "Out of place tIME chunk");
2175
2176 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME))
2177 {
2178 png_warning(png_ptr, "Duplicate tIME chunk");
2179 png_crc_finish(png_ptr, length);
2180 return;
2181 }
2182
2183 if (png_ptr->mode & PNG_HAVE_IDAT)
2184 png_ptr->mode |= PNG_AFTER_IDAT;
2185
2186 if (length != 7)
2187 {
2188 png_warning(png_ptr, "Incorrect tIME chunk length");
2189 png_crc_finish(png_ptr, length);
2190 return;
2191 }
2192
2193 png_crc_read(png_ptr, buf, 7);
2194
2195 if (png_crc_finish(png_ptr, 0))
2196 return;
2197
2198 mod_time.second = buf[6];
2199 mod_time.minute = buf[5];
2200 mod_time.hour = buf[4];
2201 mod_time.day = buf[3];
2202 mod_time.month = buf[2];
2203 mod_time.year = png_get_uint_16(buf);
2204
2205 png_set_tIME(png_ptr, info_ptr, &mod_time);
2206}
2207#endif
2208
2209#ifdef PNG_READ_tEXt_SUPPORTED
2210/* Note: this does not properly handle chunks that are > 64K under DOS */
2211void /* PRIVATE */
2212png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
2213{
2214 png_textp text_ptr;
2215 png_charp key;
2216 png_charp text;
2217 png_uint_32 skip = 0;
2218 png_size_t slength;
2219 int ret;
2220
2221 png_debug(1, "in png_handle_tEXt");
2222
2223#ifdef PNG_USER_LIMITS_SUPPORTED
2224 if (png_ptr->user_chunk_cache_max != 0)
2225 {
2226 if (png_ptr->user_chunk_cache_max == 1)
2227 {
2228 png_crc_finish(png_ptr, length);
2229 return;
2230 }
2231
2232 if (--png_ptr->user_chunk_cache_max == 1)
2233 {
2234 png_warning(png_ptr, "No space in chunk cache for tEXt");
2235 png_crc_finish(png_ptr, length);
2236 return;
2237 }
2238 }
2239#endif
2240
2241 if (!(png_ptr->mode & PNG_HAVE_IHDR))
2242 png_error(png_ptr, "Missing IHDR before tEXt");
2243
2244 if (png_ptr->mode & PNG_HAVE_IDAT)
2245 png_ptr->mode |= PNG_AFTER_IDAT;
2246
2247#ifdef PNG_MAX_MALLOC_64K
2248 if (length > (png_uint_32)65535L)
2249 {
2250 png_warning(png_ptr, "tEXt chunk too large to fit in memory");
2251 skip = length - (png_uint_32)65535L;
2252 length = (png_uint_32)65535L;
2253 }
2254#endif
2255
2256 png_free(png_ptr, png_ptr->chunkdata);
2257
2258 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
2259
2260 if (png_ptr->chunkdata == NULL)
2261 {
2262 png_warning(png_ptr, "No memory to process text chunk");
2263 return;
2264 }
2265
2266 slength = length;
2267 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
2268
2269 if (png_crc_finish(png_ptr, skip))
2270 {
2271 png_free(png_ptr, png_ptr->chunkdata);
2272 png_ptr->chunkdata = NULL;
2273 return;
2274 }
2275
2276 key = png_ptr->chunkdata;
2277
2278 key[slength] = 0x00;
2279
2280 for (text = key; *text; text++)
2281 /* Empty loop to find end of key */ ;
2282
2283 if (text != key + slength)
2284 text++;
2285
2286 text_ptr = (png_textp)png_malloc_warn(png_ptr,
2287 png_sizeof(png_text));
2288
2289 if (text_ptr == NULL)
2290 {
2291 png_warning(png_ptr, "Not enough memory to process text chunk");
2292 png_free(png_ptr, png_ptr->chunkdata);
2293 png_ptr->chunkdata = NULL;
2294 return;
2295 }
2296
2297 text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
2298 text_ptr->key = key;
2299 text_ptr->lang = NULL;
2300 text_ptr->lang_key = NULL;
2301 text_ptr->itxt_length = 0;
2302 text_ptr->text = text;
2303 text_ptr->text_length = png_strlen(text);
2304
2305 ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
2306
2307 png_free(png_ptr, png_ptr->chunkdata);
2308 png_ptr->chunkdata = NULL;
2309 png_free(png_ptr, text_ptr);
2310
2311 if (ret)
2312 png_warning(png_ptr, "Insufficient memory to process text chunk");
2313}
2314#endif
2315
2316#ifdef PNG_READ_zTXt_SUPPORTED
2317/* Note: this does not correctly handle chunks that are > 64K under DOS */
2318void /* PRIVATE */
2319png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
2320{
2321 png_textp text_ptr;
2322 png_charp text;
2323 int comp_type;
2324 int ret;
2325 png_size_t slength, prefix_len, data_len;
2326
2327 png_debug(1, "in png_handle_zTXt");
2328
2329#ifdef PNG_USER_LIMITS_SUPPORTED
2330 if (png_ptr->user_chunk_cache_max != 0)
2331 {
2332 if (png_ptr->user_chunk_cache_max == 1)
2333 {
2334 png_crc_finish(png_ptr, length);
2335 return;
2336 }
2337
2338 if (--png_ptr->user_chunk_cache_max == 1)
2339 {
2340 png_warning(png_ptr, "No space in chunk cache for zTXt");
2341 png_crc_finish(png_ptr, length);
2342 return;
2343 }
2344 }
2345#endif
2346
2347 if (!(png_ptr->mode & PNG_HAVE_IHDR))
2348 png_error(png_ptr, "Missing IHDR before zTXt");
2349
2350 if (png_ptr->mode & PNG_HAVE_IDAT)
2351 png_ptr->mode |= PNG_AFTER_IDAT;
2352
2353#ifdef PNG_MAX_MALLOC_64K
2354 /* We will no doubt have problems with chunks even half this size, but
2355 * there is no hard and fast rule to tell us where to stop.
2356 */
2357 if (length > (png_uint_32)65535L)
2358 {
2359 png_warning(png_ptr, "zTXt chunk too large to fit in memory");
2360 png_crc_finish(png_ptr, length);
2361 return;
2362 }
2363#endif
2364
2365 png_free(png_ptr, png_ptr->chunkdata);
2366 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
2367
2368 if (png_ptr->chunkdata == NULL)
2369 {
2370 png_warning(png_ptr, "Out of memory processing zTXt chunk");
2371 return;
2372 }
2373
2374 slength = length;
2375 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
2376
2377 if (png_crc_finish(png_ptr, 0))
2378 {
2379 png_free(png_ptr, png_ptr->chunkdata);
2380 png_ptr->chunkdata = NULL;
2381 return;
2382 }
2383
2384 png_ptr->chunkdata[slength] = 0x00;
2385
2386 for (text = png_ptr->chunkdata; *text; text++)
2387 /* Empty loop */ ;
2388
2389 /* zTXt must have some text after the chunkdataword */
2390 if (text >= png_ptr->chunkdata + slength - 2)
2391 {
2392 png_warning(png_ptr, "Truncated zTXt chunk");
2393 png_free(png_ptr, png_ptr->chunkdata);
2394 png_ptr->chunkdata = NULL;
2395 return;
2396 }
2397
2398 else
2399 {
2400 comp_type = *(++text);
2401
2402 if (comp_type != PNG_TEXT_COMPRESSION_zTXt)
2403 {
2404 png_warning(png_ptr, "Unknown compression type in zTXt chunk");
2405 comp_type = PNG_TEXT_COMPRESSION_zTXt;
2406 }
2407
2408 text++; /* Skip the compression_method byte */
2409 }
2410
2411 prefix_len = text - png_ptr->chunkdata;
2412
2413 png_decompress_chunk(png_ptr, comp_type,
2414 (png_size_t)length, prefix_len, &data_len);
2415
2416 text_ptr = (png_textp)png_malloc_warn(png_ptr,
2417 png_sizeof(png_text));
2418
2419 if (text_ptr == NULL)
2420 {
2421 png_warning(png_ptr, "Not enough memory to process zTXt chunk");
2422 png_free(png_ptr, png_ptr->chunkdata);
2423 png_ptr->chunkdata = NULL;
2424 return;
2425 }
2426
2427 text_ptr->compression = comp_type;
2428 text_ptr->key = png_ptr->chunkdata;
2429 text_ptr->lang = NULL;
2430 text_ptr->lang_key = NULL;
2431 text_ptr->itxt_length = 0;
2432 text_ptr->text = png_ptr->chunkdata + prefix_len;
2433 text_ptr->text_length = data_len;
2434
2435 ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
2436
2437 png_free(png_ptr, text_ptr);
2438 png_free(png_ptr, png_ptr->chunkdata);
2439 png_ptr->chunkdata = NULL;
2440
2441 if (ret)
2442 png_error(png_ptr, "Insufficient memory to store zTXt chunk");
2443}
2444#endif
2445
2446#ifdef PNG_READ_iTXt_SUPPORTED
2447/* Note: this does not correctly handle chunks that are > 64K under DOS */
2448void /* PRIVATE */
2449png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
2450{
2451 png_textp text_ptr;
2452 png_charp key, lang, text, lang_key;
2453 int comp_flag;
2454 int comp_type = 0;
2455 int ret;
2456 png_size_t slength, prefix_len, data_len;
2457
2458 png_debug(1, "in png_handle_iTXt");
2459
2460#ifdef PNG_USER_LIMITS_SUPPORTED
2461 if (png_ptr->user_chunk_cache_max != 0)
2462 {
2463 if (png_ptr->user_chunk_cache_max == 1)
2464 {
2465 png_crc_finish(png_ptr, length);
2466 return;
2467 }
2468
2469 if (--png_ptr->user_chunk_cache_max == 1)
2470 {
2471 png_warning(png_ptr, "No space in chunk cache for iTXt");
2472 png_crc_finish(png_ptr, length);
2473 return;
2474 }
2475 }
2476#endif
2477
2478 if (!(png_ptr->mode & PNG_HAVE_IHDR))
2479 png_error(png_ptr, "Missing IHDR before iTXt");
2480
2481 if (png_ptr->mode & PNG_HAVE_IDAT)
2482 png_ptr->mode |= PNG_AFTER_IDAT;
2483
2484#ifdef PNG_MAX_MALLOC_64K
2485 /* We will no doubt have problems with chunks even half this size, but
2486 * there is no hard and fast rule to tell us where to stop.
2487 */
2488 if (length > (png_uint_32)65535L)
2489 {
2490 png_warning(png_ptr, "iTXt chunk too large to fit in memory");
2491 png_crc_finish(png_ptr, length);
2492 return;
2493 }
2494#endif
2495
2496 png_free(png_ptr, png_ptr->chunkdata);
2497 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
2498
2499 if (png_ptr->chunkdata == NULL)
2500 {
2501 png_warning(png_ptr, "No memory to process iTXt chunk");
2502 return;
2503 }
2504
2505 slength = length;
2506 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);
2507
2508 if (png_crc_finish(png_ptr, 0))
2509 {
2510 png_free(png_ptr, png_ptr->chunkdata);
2511 png_ptr->chunkdata = NULL;
2512 return;
2513 }
2514
2515 png_ptr->chunkdata[slength] = 0x00;
2516
2517 for (lang = png_ptr->chunkdata; *lang; lang++)
2518 /* Empty loop */ ;
2519
2520 lang++; /* Skip NUL separator */
2521
2522 /* iTXt must have a language tag (possibly empty), two compression bytes,
2523 * translated keyword (possibly empty), and possibly some text after the
2524 * keyword
2525 */
2526
2527 if (lang >= png_ptr->chunkdata + slength - 3)
2528 {
2529 png_warning(png_ptr, "Truncated iTXt chunk");
2530 png_free(png_ptr, png_ptr->chunkdata);
2531 png_ptr->chunkdata = NULL;
2532 return;
2533 }
2534
2535 else
2536 {
2537 comp_flag = *lang++;
2538 comp_type = *lang++;
2539 }
2540
2541 if (comp_type || (comp_flag && comp_flag != PNG_TEXT_COMPRESSION_zTXt))
2542 {
2543 png_warning(png_ptr, "Unknown iTXt compression type or method");
2544 png_free(png_ptr, png_ptr->chunkdata);
2545 png_ptr->chunkdata = NULL;
2546 return;
2547 }
2548
2549 for (lang_key = lang; *lang_key; lang_key++)
2550 /* Empty loop */ ;
2551
2552 lang_key++; /* Skip NUL separator */
2553
2554 if (lang_key >= png_ptr->chunkdata + slength)
2555 {
2556 png_warning(png_ptr, "Truncated iTXt chunk");
2557 png_free(png_ptr, png_ptr->chunkdata);
2558 png_ptr->chunkdata = NULL;
2559 return;
2560 }
2561
2562 for (text = lang_key; *text; text++)
2563 /* Empty loop */ ;
2564
2565 text++; /* Skip NUL separator */
2566
2567 if (text >= png_ptr->chunkdata + slength)
2568 {
2569 png_warning(png_ptr, "Malformed iTXt chunk");
2570 png_free(png_ptr, png_ptr->chunkdata);
2571 png_ptr->chunkdata = NULL;
2572 return;
2573 }
2574
2575 prefix_len = text - png_ptr->chunkdata;
2576
2577 key=png_ptr->chunkdata;
2578
2579 if (comp_flag)
2580 png_decompress_chunk(png_ptr, comp_type,
2581 (size_t)length, prefix_len, &data_len);
2582
2583 else
2584 data_len = png_strlen(png_ptr->chunkdata + prefix_len);
2585
2586 text_ptr = (png_textp)png_malloc_warn(png_ptr,
2587 png_sizeof(png_text));
2588
2589 if (text_ptr == NULL)
2590 {
2591 png_warning(png_ptr, "Not enough memory to process iTXt chunk");
2592 png_free(png_ptr, png_ptr->chunkdata);
2593 png_ptr->chunkdata = NULL;
2594 return;
2595 }
2596
2597 text_ptr->compression = (int)comp_flag + 1;
2598 text_ptr->lang_key = png_ptr->chunkdata + (lang_key - key);
2599 text_ptr->lang = png_ptr->chunkdata + (lang - key);
2600 text_ptr->itxt_length = data_len;
2601 text_ptr->text_length = 0;
2602 text_ptr->key = png_ptr->chunkdata;
2603 text_ptr->text = png_ptr->chunkdata + prefix_len;
2604
2605 ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
2606
2607 png_free(png_ptr, text_ptr);
2608 png_free(png_ptr, png_ptr->chunkdata);
2609 png_ptr->chunkdata = NULL;
2610
2611 if (ret)
2612 png_error(png_ptr, "Insufficient memory to store iTXt chunk");
2613}
2614#endif
2615
2616/* This function is called when we haven't found a handler for a
2617 * chunk. If there isn't a problem with the chunk itself (ie bad
2618 * chunk name, CRC, or a critical chunk), the chunk is silently ignored
2619 * -- unless the PNG_FLAG_UNKNOWN_CHUNKS_SUPPORTED flag is on in which
2620 * case it will be saved away to be written out later.
2621 */
2622void /* PRIVATE */
2623png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
2624{
2625 png_uint_32 skip = 0;
2626
2627 png_debug(1, "in png_handle_unknown");
2628
2629#ifdef PNG_USER_LIMITS_SUPPORTED
2630 if (png_ptr->user_chunk_cache_max != 0)
2631 {
2632 if (png_ptr->user_chunk_cache_max == 1)
2633 {
2634 png_crc_finish(png_ptr, length);
2635 return;
2636 }
2637
2638 if (--png_ptr->user_chunk_cache_max == 1)
2639 {
2640 png_warning(png_ptr, "No space in chunk cache for unknown chunk");
2641 png_crc_finish(png_ptr, length);
2642 return;
2643 }
2644 }
2645#endif
2646
2647 if (png_ptr->mode & PNG_HAVE_IDAT)
2648 {
2649 if (png_ptr->chunk_name != png_IDAT)
2650 png_ptr->mode |= PNG_AFTER_IDAT;
2651 }
2652
2653 if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
2654 {
2655#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
2656 if (png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name) !=
2657 PNG_HANDLE_CHUNK_ALWAYS
2658#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
2659 && png_ptr->read_user_chunk_fn == NULL
2660#endif
2661 )
2662#endif
2663 png_chunk_error(png_ptr, "unknown critical chunk");
2664 }
2665
2666#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
2667 if ((png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
2668#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
2669 || (png_ptr->read_user_chunk_fn != NULL)
2670#endif
2671 )
2672 {
2673#ifdef PNG_MAX_MALLOC_64K
2674 if (length > 65535)
2675 {
2676 png_warning(png_ptr, "unknown chunk too large to fit in memory");
2677 skip = length - 65535;
2678 length = 65535;
2679 }
2680#endif
2681
2682 /* TODO: this code is very close to the unknown handling in pngpread.c,
2683 * maybe it can be put into a common utility routine?
2684 * png_struct::unknown_chunk is just used as a temporary variable, along
2685 * with the data into which the chunk is read. These can be eliminated.
2686 */
2687 PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
2688 png_ptr->unknown_chunk.size = (png_size_t)length;
2689
2690 if (length == 0)
2691 png_ptr->unknown_chunk.data = NULL;
2692
2693 else
2694 {
2695 png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length);
2696 png_crc_read(png_ptr, png_ptr->unknown_chunk.data, length);
2697 }
2698
2699#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
2700 if (png_ptr->read_user_chunk_fn != NULL)
2701 {
2702 /* Callback to user unknown chunk handler */
2703 int ret;
2704
2705 ret = (*(png_ptr->read_user_chunk_fn))
2706 (png_ptr, &png_ptr->unknown_chunk);
2707
2708 if (ret < 0)
2709 png_chunk_error(png_ptr, "error in user chunk");
2710
2711 if (ret == 0)
2712 {
2713 if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
2714 {
2715#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
2716 if (png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name) !=
2717 PNG_HANDLE_CHUNK_ALWAYS)
2718#endif
2719 png_chunk_error(png_ptr, "unknown critical chunk");
2720 }
2721
2722 png_set_unknown_chunks(png_ptr, info_ptr,
2723 &png_ptr->unknown_chunk, 1);
2724 }
2725 }
2726
2727 else
2728#endif
2729 png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
2730
2731 png_free(png_ptr, png_ptr->unknown_chunk.data);
2732 png_ptr->unknown_chunk.data = NULL;
2733 }
2734
2735 else
2736#endif
2737 skip = length;
2738
2739 png_crc_finish(png_ptr, skip);
2740
2741#ifndef PNG_READ_USER_CHUNKS_SUPPORTED
2742 PNG_UNUSED(info_ptr) /* Quiet compiler warnings about unused info_ptr */
2743#endif
2744}
2745
2746/* This function is called to verify that a chunk name is valid.
2747 * This function can't have the "critical chunk check" incorporated
2748 * into it, since in the future we will need to be able to call user
2749 * functions to handle unknown critical chunks after we check that
2750 * the chunk name itself is valid.
2751 */
2752
2753/* Bit hacking: the test for an invalid byte in the 4 byte chunk name is:
2754 *
2755 * ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))
2756 */
2757
2758void /* PRIVATE */
2759png_check_chunk_name(png_structp png_ptr, png_uint_32 chunk_name)
2760{
2761 int i;
2762
2763 png_debug(1, "in png_check_chunk_name");
2764
2765 for (i=1; i<=4; ++i)
2766 {
2767 int c = chunk_name & 0xff;
2768
2769 if (c < 65 || c > 122 || (c > 90 && c < 97))
2770 png_chunk_error(png_ptr, "invalid chunk type");
2771
2772 chunk_name >>= 8;
2773 }
2774}
2775
2776/* Combines the row recently read in with the existing pixels in the row. This
2777 * routine takes care of alpha and transparency if requested. This routine also
2778 * handles the two methods of progressive display of interlaced images,
2779 * depending on the 'display' value; if 'display' is true then the whole row
2780 * (dp) is filled from the start by replicating the available pixels. If
2781 * 'display' is false only those pixels present in the pass are filled in.
2782 */
2783void /* PRIVATE */
2784png_combine_row(png_structp png_ptr, png_bytep dp, int display)
2785{
2786 unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
2787 png_const_bytep sp = png_ptr->row_buf + 1;
2788 png_uint_32 row_width = png_ptr->width;
2789 unsigned int pass = png_ptr->pass;
2790 png_bytep end_ptr = 0;
2791 png_byte end_byte = 0;
2792 unsigned int end_mask;
2793
2794 png_debug(1, "in png_combine_row");
2795
2796 /* Added in 1.5.6: it should not be possible to enter this routine until at
2797 * least one row has been read from the PNG data and transformed.
2798 */
2799 if (pixel_depth == 0)
2800 png_error(png_ptr, "internal row logic error");
2801
2802 /* Added in 1.5.4: the pixel depth should match the information returned by
2803 * any call to png_read_update_info at this point. Do not continue if we got
2804 * this wrong.
2805 */
2806 if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes !=
2807 PNG_ROWBYTES(pixel_depth, row_width))
2808 png_error(png_ptr, "internal row size calculation error");
2809
2810 /* Don't expect this to ever happen: */
2811 if (row_width == 0)
2812 png_error(png_ptr, "internal row width error");
2813
2814 /* Preserve the last byte in cases where only part of it will be overwritten,
2815 * the multiply below may overflow, we don't care because ANSI-C guarantees
2816 * we get the low bits.
2817 */
2818 end_mask = (pixel_depth * row_width) & 7;
2819 if (end_mask != 0)
2820 {
2821 /* end_ptr == NULL is a flag to say do nothing */
2822 end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1;
2823 end_byte = *end_ptr;
2824# ifdef PNG_READ_PACKSWAP_SUPPORTED
2825 if (png_ptr->transformations & PNG_PACKSWAP) /* little-endian byte */
2826 end_mask = 0xff << end_mask;
2827
2828 else /* big-endian byte */
2829# endif
2830 end_mask = 0xff >> end_mask;
2831 /* end_mask is now the bits to *keep* from the destination row */
2832 }
2833
2834 /* For non-interlaced images this reduces to a png_memcpy(). A png_memcpy()
2835 * will also happen if interlacing isn't supported or if the application
2836 * does not call png_set_interlace_handling(). In the latter cases the
2837 * caller just gets a sequence of the unexpanded rows from each interlace
2838 * pass.
2839 */
2840#ifdef PNG_READ_INTERLACING_SUPPORTED
2841 if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE) &&
2842 pass < 6 && (display == 0 ||
2843 /* The following copies everything for 'display' on passes 0, 2 and 4. */
2844 (display == 1 && (pass & 1) != 0)))
2845 {
2846 /* Narrow images may have no bits in a pass; the caller should handle
2847 * this, but this test is cheap:
2848 */
2849 if (row_width <= PNG_PASS_START_COL(pass))
2850 return;
2851
2852 if (pixel_depth < 8)
2853 {
2854 /* For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit
2855 * into 32 bits, then a single loop over the bytes using the four byte
2856 * values in the 32-bit mask can be used. For the 'display' option the
2857 * expanded mask may also not require any masking within a byte. To
2858 * make this work the PACKSWAP option must be taken into account - it
2859 * simply requires the pixels to be reversed in each byte.
2860 *
2861 * The 'regular' case requires a mask for each of the first 6 passes,
2862 * the 'display' case does a copy for the even passes in the range
2863 * 0..6. This has already been handled in the test above.
2864 *
2865 * The masks are arranged as four bytes with the first byte to use in
2866 * the lowest bits (little-endian) regardless of the order (PACKSWAP or
2867 * not) of the pixels in each byte.
2868 *
2869 * NOTE: the whole of this logic depends on the caller of this function
2870 * only calling it on rows appropriate to the pass. This function only
2871 * understands the 'x' logic; the 'y' logic is handled by the caller.
2872 *
2873 * The following defines allow generation of compile time constant bit
2874 * masks for each pixel depth and each possibility of swapped or not
2875 * swapped bytes. Pass 'p' is in the range 0..6; 'x', a pixel index,
2876 * is in the range 0..7; and the result is 1 if the pixel is to be
2877 * copied in the pass, 0 if not. 'S' is for the sparkle method, 'B'
2878 * for the block method.
2879 *
2880 * With some compilers a compile time expression of the general form:
2881 *
2882 * (shift >= 32) ? (a >> (shift-32)) : (b >> shift)
2883 *
2884 * Produces warnings with values of 'shift' in the range 33 to 63
2885 * because the right hand side of the ?: expression is evaluated by
2886 * the compiler even though it isn't used. Microsoft Visual C (various
2887 * versions) and the Intel C compiler are known to do this. To avoid
2888 * this the following macros are used in 1.5.6. This is a temporary
2889 * solution to avoid destabilizing the code during the release process.
2890 */
2891# if PNG_USE_COMPILE_TIME_MASKS
2892# define PNG_LSR(x,s) ((x)>>((s) & 0x1f))
2893# define PNG_LSL(x,s) ((x)<<((s) & 0x1f))
2894# else
2895# define PNG_LSR(x,s) ((x)>>(s))
2896# define PNG_LSL(x,s) ((x)<<(s))
2897# endif
2898# define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\
2899 PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1)
2900# define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\
2901 PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1)
2902
2903 /* Return a mask for pass 'p' pixel 'x' at depth 'd'. The mask is
2904 * little endian - the first pixel is at bit 0 - however the extra
2905 * parameter 's' can be set to cause the mask position to be swapped
2906 * within each byte, to match the PNG format. This is done by XOR of
2907 * the shift with 7, 6 or 4 for bit depths 1, 2 and 4.
2908 */
2909# define PIXEL_MASK(p,x,d,s) \
2910 (PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0))))
2911
2912 /* Hence generate the appropriate 'block' or 'sparkle' pixel copy mask.
2913 */
2914# define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
2915# define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
2916
2917 /* Combine 8 of these to get the full mask. For the 1-bpp and 2-bpp
2918 * cases the result needs replicating, for the 4-bpp case the above
2919 * generates a full 32 bits.
2920 */
2921# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
2922
2923# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
2924 S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
2925 S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
2926
2927# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
2928 B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
2929 B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
2930
2931#if PNG_USE_COMPILE_TIME_MASKS
2932 /* Utility macros to construct all the masks for a depth/swap
2933 * combination. The 's' parameter says whether the format is PNG
2934 * (big endian bytes) or not. Only the three odd-numbered passes are
2935 * required for the display/block algorithm.
2936 */
2937# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
2938 S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
2939
2940# define B_MASKS(d,s) { B_MASK(1,d,s), S_MASK(3,d,s), S_MASK(5,d,s) }
2941
2942# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
2943
2944 /* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and
2945 * then pass:
2946 */
2947 static PNG_CONST png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] =
2948 {
2949 /* Little-endian byte masks for PACKSWAP */
2950 { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
2951 /* Normal (big-endian byte) masks - PNG format */
2952 { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
2953 };
2954
2955 /* display_mask has only three entries for the odd passes, so index by
2956 * pass>>1.
2957 */
2958 static PNG_CONST png_uint_32 display_mask[2][3][3] =
2959 {
2960 /* Little-endian byte masks for PACKSWAP */
2961 { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
2962 /* Normal (big-endian byte) masks - PNG format */
2963 { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
2964 };
2965
2966# define MASK(pass,depth,display,png)\
2967 ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
2968 row_mask[png][DEPTH_INDEX(depth)][pass])
2969
2970#else /* !PNG_USE_COMPILE_TIME_MASKS */
2971 /* This is the runtime alternative: it seems unlikely that this will
2972 * ever be either smaller or faster than the compile time approach.
2973 */
2974# define MASK(pass,depth,display,png)\
2975 ((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png))
2976#endif /* !PNG_USE_COMPILE_TIME_MASKS */
2977
2978 /* Use the appropriate mask to copy the required bits. In some cases
2979 * the byte mask will be 0 or 0xff, optimize these cases. row_width is
2980 * the number of pixels, but the code copies bytes, so it is necessary
2981 * to special case the end.
2982 */
2983 png_uint_32 pixels_per_byte = 8 / pixel_depth;
2984 png_uint_32 mask;
2985
2986# ifdef PNG_READ_PACKSWAP_SUPPORTED
2987 if (png_ptr->transformations & PNG_PACKSWAP)
2988 mask = MASK(pass, pixel_depth, display, 0);
2989
2990 else
2991# endif
2992 mask = MASK(pass, pixel_depth, display, 1);
2993
2994 for (;;)
2995 {
2996 png_uint_32 m;
2997
2998 /* It doesn't matter in the following if png_uint_32 has more than
2999 * 32 bits because the high bits always match those in m<<24; it is,
3000 * however, essential to use OR here, not +, because of this.
3001 */
3002 m = mask;
3003 mask = (m >> 8) | (m << 24); /* rotate right to good compilers */
3004 m &= 0xff;
3005
3006 if (m != 0) /* something to copy */
3007 {
3008 if (m != 0xff)
3009 *dp = (png_byte)((*dp & ~m) | (*sp & m));
3010 else
3011 *dp = *sp;
3012 }
3013
3014 /* NOTE: this may overwrite the last byte with garbage if the image
3015 * is not an exact number of bytes wide; libpng has always done
3016 * this.
3017 */
3018 if (row_width <= pixels_per_byte)
3019 break; /* May need to restore part of the last byte */
3020
3021 row_width -= pixels_per_byte;
3022 ++dp;
3023 ++sp;
3024 }
3025 }
3026
3027 else /* pixel_depth >= 8 */
3028 {
3029 unsigned int bytes_to_copy, bytes_to_jump;
3030
3031 /* Validate the depth - it must be a multiple of 8 */
3032 if (pixel_depth & 7)
3033 png_error(png_ptr, "invalid user transform pixel depth");
3034
3035 pixel_depth >>= 3; /* now in bytes */
3036 row_width *= pixel_depth;
3037
3038 /* Regardless of pass number the Adam 7 interlace always results in a
3039 * fixed number of pixels to copy then to skip. There may be a
3040 * different number of pixels to skip at the start though.
3041 */
3042 {
3043 unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth;
3044
3045 row_width -= offset;
3046 dp += offset;
3047 sp += offset;
3048 }
3049
3050 /* Work out the bytes to copy. */
3051 if (display)
3052 {
3053 /* When doing the 'block' algorithm the pixel in the pass gets
3054 * replicated to adjacent pixels. This is why the even (0,2,4,6)
3055 * passes are skipped above - the entire expanded row is copied.
3056 */
3057 bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth;
3058
3059 /* But don't allow this number to exceed the actual row width. */
3060 if (bytes_to_copy > row_width)
3061 bytes_to_copy = row_width;
3062 }
3063
3064 else /* normal row; Adam7 only ever gives us one pixel to copy. */
3065 bytes_to_copy = pixel_depth;
3066
3067 /* In Adam7 there is a constant offset between where the pixels go. */
3068 bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;
3069
3070 /* And simply copy these bytes. Some optimization is possible here,
3071 * depending on the value of 'bytes_to_copy'. Special case the low
3072 * byte counts, which we know to be frequent.
3073 *
3074 * Notice that these cases all 'return' rather than 'break' - this
3075 * avoids an unnecessary test on whether to restore the last byte
3076 * below.
3077 */
3078 switch (bytes_to_copy)
3079 {
3080 case 1:
3081 for (;;)
3082 {
3083 *dp = *sp;
3084
3085 if (row_width <= bytes_to_jump)
3086 return;
3087
3088 dp += bytes_to_jump;
3089 sp += bytes_to_jump;
3090 row_width -= bytes_to_jump;
3091 }
3092
3093 case 2:
3094 /* There is a possibility of a partial copy at the end here; this
3095 * slows the code down somewhat.
3096 */
3097 do
3098 {
3099 dp[0] = sp[0], dp[1] = sp[1];
3100
3101 if (row_width <= bytes_to_jump)
3102 return;
3103
3104 sp += bytes_to_jump;
3105 dp += bytes_to_jump;
3106 row_width -= bytes_to_jump;
3107 }
3108 while (row_width > 1);
3109
3110 /* And there can only be one byte left at this point: */
3111 *dp = *sp;
3112 return;
3113
3114 case 3:
3115 /* This can only be the RGB case, so each copy is exactly one
3116 * pixel and it is not necessary to check for a partial copy.
3117 */
3118 for(;;)
3119 {
3120 dp[0] = sp[0], dp[1] = sp[1], dp[2] = sp[2];
3121
3122 if (row_width <= bytes_to_jump)
3123 return;
3124
3125 sp += bytes_to_jump;
3126 dp += bytes_to_jump;
3127 row_width -= bytes_to_jump;
3128 }
3129
3130 default:
3131#if PNG_ALIGN_TYPE != PNG_ALIGN_NONE
3132 /* Check for double byte alignment and, if possible, use a
3133 * 16-bit copy. Don't attempt this for narrow images - ones that
3134 * are less than an interlace panel wide. Don't attempt it for
3135 * wide bytes_to_copy either - use the png_memcpy there.
3136 */
3137 if (bytes_to_copy < 16 /*else use png_memcpy*/ &&
3138 png_isaligned(dp, png_uint_16) &&
3139 png_isaligned(sp, png_uint_16) &&
3140 bytes_to_copy % sizeof (png_uint_16) == 0 &&
3141 bytes_to_jump % sizeof (png_uint_16) == 0)
3142 {
3143 /* Everything is aligned for png_uint_16 copies, but try for
3144 * png_uint_32 first.
3145 */
3146 if (png_isaligned(dp, png_uint_32) &&
3147 png_isaligned(sp, png_uint_32) &&
3148 bytes_to_copy % sizeof (png_uint_32) == 0 &&
3149 bytes_to_jump % sizeof (png_uint_32) == 0)
3150 {
3151 png_uint_32p dp32 = (png_uint_32p)dp;
3152 png_const_uint_32p sp32 = (png_const_uint_32p)sp;
3153 unsigned int skip = (bytes_to_jump-bytes_to_copy) /
3154 sizeof (png_uint_32);
3155
3156 do
3157 {
3158 size_t c = bytes_to_copy;
3159 do
3160 {
3161 *dp32++ = *sp32++;
3162 c -= sizeof (png_uint_32);
3163 }
3164 while (c > 0);
3165
3166 if (row_width <= bytes_to_jump)
3167 return;
3168
3169 dp32 += skip;
3170 sp32 += skip;
3171 row_width -= bytes_to_jump;
3172 }
3173 while (bytes_to_copy <= row_width);
3174
3175 /* Get to here when the row_width truncates the final copy.
3176 * There will be 1-3 bytes left to copy, so don't try the
3177 * 16-bit loop below.
3178 */
3179 dp = (png_bytep)dp32;
3180 sp = (png_const_bytep)sp32;
3181 do
3182 *dp++ = *sp++;
3183 while (--row_width > 0);
3184 return;
3185 }
3186
3187 /* Else do it in 16-bit quantities, but only if the size is
3188 * not too large.
3189 */
3190 else
3191 {
3192 png_uint_16p dp16 = (png_uint_16p)dp;
3193 png_const_uint_16p sp16 = (png_const_uint_16p)sp;
3194 unsigned int skip = (bytes_to_jump-bytes_to_copy) /
3195 sizeof (png_uint_16);
3196
3197 do
3198 {
3199 size_t c = bytes_to_copy;
3200 do
3201 {
3202 *dp16++ = *sp16++;
3203 c -= sizeof (png_uint_16);
3204 }
3205 while (c > 0);
3206
3207 if (row_width <= bytes_to_jump)
3208 return;
3209
3210 dp16 += skip;
3211 sp16 += skip;
3212 row_width -= bytes_to_jump;
3213 }
3214 while (bytes_to_copy <= row_width);
3215
3216 /* End of row - 1 byte left, bytes_to_copy > row_width: */
3217 dp = (png_bytep)dp16;
3218 sp = (png_const_bytep)sp16;
3219 do
3220 *dp++ = *sp++;
3221 while (--row_width > 0);
3222 return;
3223 }
3224 }
3225#endif /* PNG_ALIGN_ code */
3226
3227 /* The true default - use a png_memcpy: */
3228 for (;;)
3229 {
3230 png_memcpy(dp, sp, bytes_to_copy);
3231
3232 if (row_width <= bytes_to_jump)
3233 return;
3234
3235 sp += bytes_to_jump;
3236 dp += bytes_to_jump;
3237 row_width -= bytes_to_jump;
3238 if (bytes_to_copy > row_width)
3239 bytes_to_copy = row_width;
3240 }
3241 }
3242
3243 /* NOT REACHED*/
3244 } /* pixel_depth >= 8 */
3245
3246 /* Here if pixel_depth < 8 to check 'end_ptr' below. */
3247 }
3248 else
3249#endif
3250
3251 /* If here then the switch above wasn't used so just png_memcpy the whole row
3252 * from the temporary row buffer (notice that this overwrites the end of the
3253 * destination row if it is a partial byte.)
3254 */
3255 png_memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width));
3256
3257 /* Restore the overwritten bits from the last byte if necessary. */
3258 if (end_ptr != NULL)
3259 *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask));
3260}
3261
3262#ifdef PNG_READ_INTERLACING_SUPPORTED
3263void /* PRIVATE */
3264png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
3265 png_uint_32 transformations /* Because these may affect the byte layout */)
3266{
3267 /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
3268 /* Offset to next interlace block */
3269 static PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
3270
3271 png_debug(1, "in png_do_read_interlace");
3272 if (row != NULL && row_info != NULL)
3273 {
3274 png_uint_32 final_width;
3275
3276 final_width = row_info->width * png_pass_inc[pass];
3277
3278 switch (row_info->pixel_depth)
3279 {
3280 case 1:
3281 {
3282 png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 3);
3283 png_bytep dp = row + (png_size_t)((final_width - 1) >> 3);
3284 int sshift, dshift;
3285 int s_start, s_end, s_inc;
3286 int jstop = png_pass_inc[pass];
3287 png_byte v;
3288 png_uint_32 i;
3289 int j;
3290
3291#ifdef PNG_READ_PACKSWAP_SUPPORTED
3292 if (transformations & PNG_PACKSWAP)
3293 {
3294 sshift = (int)((row_info->width + 7) & 0x07);
3295 dshift = (int)((final_width + 7) & 0x07);
3296 s_start = 7;
3297 s_end = 0;
3298 s_inc = -1;
3299 }
3300
3301 else
3302#endif
3303 {
3304 sshift = 7 - (int)((row_info->width + 7) & 0x07);
3305 dshift = 7 - (int)((final_width + 7) & 0x07);
3306 s_start = 0;
3307 s_end = 7;
3308 s_inc = 1;
3309 }
3310
3311 for (i = 0; i < row_info->width; i++)
3312 {
3313 v = (png_byte)((*sp >> sshift) & 0x01);
3314 for (j = 0; j < jstop; j++)
3315 {
3316 *dp &= (png_byte)((0x7f7f >> (7 - dshift)) & 0xff);
3317 *dp |= (png_byte)(v << dshift);
3318
3319 if (dshift == s_end)
3320 {
3321 dshift = s_start;
3322 dp--;
3323 }
3324
3325 else
3326 dshift += s_inc;
3327 }
3328
3329 if (sshift == s_end)
3330 {
3331 sshift = s_start;
3332 sp--;
3333 }
3334
3335 else
3336 sshift += s_inc;
3337 }
3338 break;
3339 }
3340
3341 case 2:
3342 {
3343 png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2);
3344 png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2);
3345 int sshift, dshift;
3346 int s_start, s_end, s_inc;
3347 int jstop = png_pass_inc[pass];
3348 png_uint_32 i;
3349
3350#ifdef PNG_READ_PACKSWAP_SUPPORTED
3351 if (transformations & PNG_PACKSWAP)
3352 {
3353 sshift = (int)(((row_info->width + 3) & 0x03) << 1);
3354 dshift = (int)(((final_width + 3) & 0x03) << 1);
3355 s_start = 6;
3356 s_end = 0;
3357 s_inc = -2;
3358 }
3359
3360 else
3361#endif
3362 {
3363 sshift = (int)((3 - ((row_info->width + 3) & 0x03)) << 1);
3364 dshift = (int)((3 - ((final_width + 3) & 0x03)) << 1);
3365 s_start = 0;
3366 s_end = 6;
3367 s_inc = 2;
3368 }
3369
3370 for (i = 0; i < row_info->width; i++)
3371 {
3372 png_byte v;
3373 int j;
3374
3375 v = (png_byte)((*sp >> sshift) & 0x03);
3376 for (j = 0; j < jstop; j++)
3377 {
3378 *dp &= (png_byte)((0x3f3f >> (6 - dshift)) & 0xff);
3379 *dp |= (png_byte)(v << dshift);
3380
3381 if (dshift == s_end)
3382 {
3383 dshift = s_start;
3384 dp--;
3385 }
3386
3387 else
3388 dshift += s_inc;
3389 }
3390
3391 if (sshift == s_end)
3392 {
3393 sshift = s_start;
3394 sp--;
3395 }
3396
3397 else
3398 sshift += s_inc;
3399 }
3400 break;
3401 }
3402
3403 case 4:
3404 {
3405 png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 1);
3406 png_bytep dp = row + (png_size_t)((final_width - 1) >> 1);
3407 int sshift, dshift;
3408 int s_start, s_end, s_inc;
3409 png_uint_32 i;
3410 int jstop = png_pass_inc[pass];
3411
3412#ifdef PNG_READ_PACKSWAP_SUPPORTED
3413 if (transformations & PNG_PACKSWAP)
3414 {
3415 sshift = (int)(((row_info->width + 1) & 0x01) << 2);
3416 dshift = (int)(((final_width + 1) & 0x01) << 2);
3417 s_start = 4;
3418 s_end = 0;
3419 s_inc = -4;
3420 }
3421
3422 else
3423#endif
3424 {
3425 sshift = (int)((1 - ((row_info->width + 1) & 0x01)) << 2);
3426 dshift = (int)((1 - ((final_width + 1) & 0x01)) << 2);
3427 s_start = 0;
3428 s_end = 4;
3429 s_inc = 4;
3430 }
3431
3432 for (i = 0; i < row_info->width; i++)
3433 {
3434 png_byte v = (png_byte)((*sp >> sshift) & 0x0f);
3435 int j;
3436
3437 for (j = 0; j < jstop; j++)
3438 {
3439 *dp &= (png_byte)((0xf0f >> (4 - dshift)) & 0xff);
3440 *dp |= (png_byte)(v << dshift);
3441
3442 if (dshift == s_end)
3443 {
3444 dshift = s_start;
3445 dp--;
3446 }
3447
3448 else
3449 dshift += s_inc;
3450 }
3451
3452 if (sshift == s_end)
3453 {
3454 sshift = s_start;
3455 sp--;
3456 }
3457
3458 else
3459 sshift += s_inc;
3460 }
3461 break;
3462 }
3463
3464 default:
3465 {
3466 png_size_t pixel_bytes = (row_info->pixel_depth >> 3);
3467
3468 png_bytep sp = row + (png_size_t)(row_info->width - 1)
3469 * pixel_bytes;
3470
3471 png_bytep dp = row + (png_size_t)(final_width - 1) * pixel_bytes;
3472
3473 int jstop = png_pass_inc[pass];
3474 png_uint_32 i;
3475
3476 for (i = 0; i < row_info->width; i++)
3477 {
3478 png_byte v[8];
3479 int j;
3480
3481 png_memcpy(v, sp, pixel_bytes);
3482
3483 for (j = 0; j < jstop; j++)
3484 {
3485 png_memcpy(dp, v, pixel_bytes);
3486 dp -= pixel_bytes;
3487 }
3488
3489 sp -= pixel_bytes;
3490 }
3491 break;
3492 }
3493 }
3494
3495 row_info->width = final_width;
3496 row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);
3497 }
3498#ifndef PNG_READ_PACKSWAP_SUPPORTED
3499 PNG_UNUSED(transformations) /* Silence compiler warning */
3500#endif
3501}
3502#endif /* PNG_READ_INTERLACING_SUPPORTED */
3503
3504static void
3505png_read_filter_row_sub(png_row_infop row_info, png_bytep row,
3506 png_const_bytep prev_row)
3507{
3508 png_size_t i;
3509 png_size_t istop = row_info->rowbytes;
3510 unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
3511 png_bytep rp = row + bpp;
3512
3513 PNG_UNUSED(prev_row)
3514
3515 for (i = bpp; i < istop; i++)
3516 {
3517 *rp = (png_byte)(((int)(*rp) + (int)(*(rp-bpp))) & 0xff);
3518 rp++;
3519 }
3520}
3521
3522static void
3523png_read_filter_row_up(png_row_infop row_info, png_bytep row,
3524 png_const_bytep prev_row)
3525{
3526 png_size_t i;
3527 png_size_t istop = row_info->rowbytes;
3528 png_bytep rp = row;
3529 png_const_bytep pp = prev_row;
3530
3531 for (i = 0; i < istop; i++)
3532 {
3533 *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff);
3534 rp++;
3535 }
3536}
3537
3538static void
3539png_read_filter_row_avg(png_row_infop row_info, png_bytep row,
3540 png_const_bytep prev_row)
3541{
3542 png_size_t i;
3543 png_bytep rp = row;
3544 png_const_bytep pp = prev_row;
3545 unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
3546 png_size_t istop = row_info->rowbytes - bpp;
3547
3548 for (i = 0; i < bpp; i++)
3549 {
3550 *rp = (png_byte)(((int)(*rp) +
3551 ((int)(*pp++) / 2 )) & 0xff);
3552
3553 rp++;
3554 }
3555
3556 for (i = 0; i < istop; i++)
3557 {
3558 *rp = (png_byte)(((int)(*rp) +
3559 (int)(*pp++ + *(rp-bpp)) / 2 ) & 0xff);
3560
3561 rp++;
3562 }
3563}
3564
3565static void
3566png_read_filter_row_paeth_1byte_pixel(png_row_infop row_info, png_bytep row,
3567 png_const_bytep prev_row)
3568{
3569 png_bytep rp_end = row + row_info->rowbytes;
3570 int a, c;
3571
3572 /* First pixel/byte */
3573 c = *prev_row++;
3574 a = *row + c;
3575 *row++ = (png_byte)a;
3576
3577 /* Remainder */
3578 while (row < rp_end)
3579 {
3580 int b, pa, pb, pc, p;
3581
3582 a &= 0xff; /* From previous iteration or start */
3583 b = *prev_row++;
3584
3585 p = b - c;
3586 pc = a - c;
3587
3588# ifdef PNG_USE_ABS
3589 pa = abs(p);
3590 pb = abs(pc);
3591 pc = abs(p + pc);
3592# else
3593 pa = p < 0 ? -p : p;
3594 pb = pc < 0 ? -pc : pc;
3595 pc = (p + pc) < 0 ? -(p + pc) : p + pc;
3596# endif
3597
3598 /* Find the best predictor, the least of pa, pb, pc favoring the earlier
3599 * ones in the case of a tie.
3600 */
3601 if (pb < pa) pa = pb, a = b;
3602 if (pc < pa) a = c;
3603
3604 /* Calculate the current pixel in a, and move the previous row pixel to c
3605 * for the next time round the loop
3606 */
3607 c = b;
3608 a += *row;
3609 *row++ = (png_byte)a;
3610 }
3611}
3612
3613static void
3614png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
3615 png_const_bytep prev_row)
3616{
3617 int bpp = (row_info->pixel_depth + 7) >> 3;
3618 png_bytep rp_end = row + bpp;
3619
3620 /* Process the first pixel in the row completely (this is the same as 'up'
3621 * because there is only one candidate predictor for the first row).
3622 */
3623 while (row < rp_end)
3624 {
3625 int a = *row + *prev_row++;
3626 *row++ = (png_byte)a;
3627 }
3628
3629 /* Remainder */
3630 rp_end += row_info->rowbytes - bpp;
3631
3632 while (row < rp_end)
3633 {
3634 int a, b, c, pa, pb, pc, p;
3635
3636 c = *(prev_row - bpp);
3637 a = *(row - bpp);
3638 b = *prev_row++;
3639
3640 p = b - c;
3641 pc = a - c;
3642
3643# ifdef PNG_USE_ABS
3644 pa = abs(p);
3645 pb = abs(pc);
3646 pc = abs(p + pc);
3647# else
3648 pa = p < 0 ? -p : p;
3649 pb = pc < 0 ? -pc : pc;
3650 pc = (p + pc) < 0 ? -(p + pc) : p + pc;
3651# endif
3652
3653 if (pb < pa) pa = pb, a = b;
3654 if (pc < pa) a = c;
3655
3656 c = b;
3657 a += *row;
3658 *row++ = (png_byte)a;
3659 }
3660}
3661
3662#ifdef PNG_ARM_NEON
3663
3664#ifdef __linux__
3665#include <stdio.h>
3666#include <elf.h>
3667#include <asm/hwcap.h>
3668
3669static int png_have_hwcap(unsigned cap)
3670{
3671 FILE *f = fopen("/proc/self/auxv", "r");
3672 Elf32_auxv_t aux;
3673 int have_cap = 0;
3674
3675 if (!f)
3676 return 0;
3677
3678 while (fread(&aux, sizeof(aux), 1, f) > 0)
3679 {
3680 if (aux.a_type == AT_HWCAP &&
3681 aux.a_un.a_val & cap)
3682 {
3683 have_cap = 1;
3684 break;
3685 }
3686 }
3687
3688 fclose(f);
3689
3690 return have_cap;
3691}
3692#endif /* __linux__ */
3693
3694static void
3695png_init_filter_functions_neon(png_structp pp, unsigned int bpp)
3696{
3697#ifdef __linux__
3698 if (!png_have_hwcap(HWCAP_NEON))
3699 return;
3700#endif
3701
3702 pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up_neon;
3703
3704 if (bpp == 3)
3705 {
3706 pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub3_neon;
3707 pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg3_neon;
3708 pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
3709 png_read_filter_row_paeth3_neon;
3710 }
3711
3712 else if (bpp == 4)
3713 {
3714 pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub4_neon;
3715 pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg4_neon;
3716 pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
3717 png_read_filter_row_paeth4_neon;
3718 }
3719}
3720#endif /* PNG_ARM_NEON */
3721
3722static void
3723png_init_filter_functions(png_structp pp)
3724{
3725 unsigned int bpp = (pp->pixel_depth + 7) >> 3;
3726
3727 pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub;
3728 pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up;
3729 pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg;
3730 if (bpp == 1)
3731 pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
3732 png_read_filter_row_paeth_1byte_pixel;
3733 else
3734 pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
3735 png_read_filter_row_paeth_multibyte_pixel;
3736
3737#ifdef PNG_ARM_NEON
3738 png_init_filter_functions_neon(pp, bpp);
3739#endif
3740}
3741
3742void /* PRIVATE */
3743png_read_filter_row(png_structp pp, png_row_infop row_info, png_bytep row,
3744 png_const_bytep prev_row, int filter)
3745{
3746 if (pp->read_filter[0] == NULL)
3747 png_init_filter_functions(pp);
3748 if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
3749 pp->read_filter[filter-1](row_info, row, prev_row);
3750}
3751
3752#ifdef PNG_SEQUENTIAL_READ_SUPPORTED
3753void /* PRIVATE */
3754png_read_finish_row(png_structp png_ptr)
3755{
3756#ifdef PNG_READ_INTERLACING_SUPPORTED
3757 /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
3758
3759 /* Start of interlace block */
3760 static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
3761
3762 /* Offset to next interlace block */
3763 static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
3764
3765 /* Start of interlace block in the y direction */
3766 static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
3767
3768 /* Offset to next interlace block in the y direction */
3769 static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
3770#endif /* PNG_READ_INTERLACING_SUPPORTED */
3771
3772 png_debug(1, "in png_read_finish_row");
3773 png_ptr->row_number++;
3774 if (png_ptr->row_number < png_ptr->num_rows)
3775 return;
3776
3777#ifdef PNG_READ_INTERLACING_SUPPORTED
3778 if (png_ptr->interlaced)
3779 {
3780 png_ptr->row_number = 0;
3781
3782 /* TO DO: don't do this if prev_row isn't needed (requires
3783 * read-ahead of the next row's filter byte.
3784 */
3785 png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
3786
3787 do
3788 {
3789 png_ptr->pass++;
3790
3791 if (png_ptr->pass >= 7)
3792 break;
3793
3794 png_ptr->iwidth = (png_ptr->width +
3795 png_pass_inc[png_ptr->pass] - 1 -
3796 png_pass_start[png_ptr->pass]) /
3797 png_pass_inc[png_ptr->pass];
3798
3799 if (!(png_ptr->transformations & PNG_INTERLACE))
3800 {
3801 png_ptr->num_rows = (png_ptr->height +
3802 png_pass_yinc[png_ptr->pass] - 1 -
3803 png_pass_ystart[png_ptr->pass]) /
3804 png_pass_yinc[png_ptr->pass];
3805 }
3806
3807 else /* if (png_ptr->transformations & PNG_INTERLACE) */
3808 break; /* libpng deinterlacing sees every row */
3809
3810 } while (png_ptr->num_rows == 0 || png_ptr->iwidth == 0);
3811
3812 if (png_ptr->pass < 7)
3813 return;
3814 }
3815#endif /* PNG_READ_INTERLACING_SUPPORTED */
3816
3817 if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
3818 {
3819 char extra;
3820 int ret;
3821
3822 png_ptr->zstream.next_out = (Byte *)&extra;
3823 png_ptr->zstream.avail_out = (uInt)1;
3824
3825 for (;;)
3826 {
3827 if (!(png_ptr->zstream.avail_in))
3828 {
3829 while (!png_ptr->idat_size)
3830 {
3831 png_crc_finish(png_ptr, 0);
3832 png_ptr->idat_size = png_read_chunk_header(png_ptr);
3833 if (png_ptr->chunk_name != png_IDAT)
3834 png_error(png_ptr, "Not enough image data");
3835 }
3836
3837 png_ptr->zstream.avail_in = (uInt)png_ptr->zbuf_size;
3838 png_ptr->zstream.next_in = png_ptr->zbuf;
3839
3840 if (png_ptr->zbuf_size > png_ptr->idat_size)
3841 png_ptr->zstream.avail_in = (uInt)png_ptr->idat_size;
3842
3843 png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zstream.avail_in);
3844 png_ptr->idat_size -= png_ptr->zstream.avail_in;
3845 }
3846
3847 ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
3848
3849 if (ret == Z_STREAM_END)
3850 {
3851 if (!(png_ptr->zstream.avail_out) || png_ptr->zstream.avail_in ||
3852 png_ptr->idat_size)
3853 png_warning(png_ptr, "Extra compressed data");
3854
3855 png_ptr->mode |= PNG_AFTER_IDAT;
3856 png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
3857 break;
3858 }
3859
3860 if (ret != Z_OK)
3861 png_error(png_ptr, png_ptr->zstream.msg ? png_ptr->zstream.msg :
3862 "Decompression Error");
3863
3864 if (!(png_ptr->zstream.avail_out))
3865 {
3866 png_warning(png_ptr, "Extra compressed data");
3867 png_ptr->mode |= PNG_AFTER_IDAT;
3868 png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
3869 break;
3870 }
3871
3872 }
3873 png_ptr->zstream.avail_out = 0;
3874 }
3875
3876 if (png_ptr->idat_size || png_ptr->zstream.avail_in)
3877 png_warning(png_ptr, "Extra compression data");
3878
3879 inflateReset(&png_ptr->zstream);
3880
3881 png_ptr->mode |= PNG_AFTER_IDAT;
3882}
3883#endif /* PNG_SEQUENTIAL_READ_SUPPORTED */
3884
3885void /* PRIVATE */
3886png_read_start_row(png_structp png_ptr)
3887{
3888#ifdef PNG_READ_INTERLACING_SUPPORTED
3889 /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
3890
3891 /* Start of interlace block */
3892 static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
3893
3894 /* Offset to next interlace block */
3895 static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
3896
3897 /* Start of interlace block in the y direction */
3898 static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
3899
3900 /* Offset to next interlace block in the y direction */
3901 static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
3902#endif
3903
3904 int max_pixel_depth;
3905 png_size_t row_bytes;
3906
3907 png_debug(1, "in png_read_start_row");
3908 png_ptr->zstream.avail_in = 0;
3909#ifdef PNG_READ_TRANSFORMS_SUPPORTED
3910 png_init_read_transformations(png_ptr);
3911#endif
3912#ifdef PNG_READ_INTERLACING_SUPPORTED
3913 if (png_ptr->interlaced)
3914 {
3915 if (!(png_ptr->transformations & PNG_INTERLACE))
3916 png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
3917 png_pass_ystart[0]) / png_pass_yinc[0];
3918
3919 else
3920 png_ptr->num_rows = png_ptr->height;
3921
3922 png_ptr->iwidth = (png_ptr->width +
3923 png_pass_inc[png_ptr->pass] - 1 -
3924 png_pass_start[png_ptr->pass]) /
3925 png_pass_inc[png_ptr->pass];
3926 }
3927
3928 else
3929#endif /* PNG_READ_INTERLACING_SUPPORTED */
3930 {
3931 png_ptr->num_rows = png_ptr->height;
3932 png_ptr->iwidth = png_ptr->width;
3933 }
3934
3935 max_pixel_depth = png_ptr->pixel_depth;
3936
3937 /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpliar set of
3938 * calculations to calculate the final pixel depth, then
3939 * png_do_read_transforms actually does the transforms. This means that the
3940 * code which effectively calculates this value is actually repeated in three
3941 * separate places. They must all match. Innocent changes to the order of
3942 * transformations can and will break libpng in a way that causes memory
3943 * overwrites.
3944 *
3945 * TODO: fix this.
3946 */
3947#ifdef PNG_READ_PACK_SUPPORTED
3948 if ((png_ptr->transformations & PNG_PACK) && png_ptr->bit_depth < 8)
3949 max_pixel_depth = 8;
3950#endif
3951
3952#ifdef PNG_READ_EXPAND_SUPPORTED
3953 if (png_ptr->transformations & PNG_EXPAND)
3954 {
3955 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
3956 {
3957 if (png_ptr->num_trans)
3958 max_pixel_depth = 32;
3959
3960 else
3961 max_pixel_depth = 24;
3962 }
3963
3964 else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
3965 {
3966 if (max_pixel_depth < 8)
3967 max_pixel_depth = 8;
3968
3969 if (png_ptr->num_trans)
3970 max_pixel_depth *= 2;
3971 }
3972
3973 else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
3974 {
3975 if (png_ptr->num_trans)
3976 {
3977 max_pixel_depth *= 4;
3978 max_pixel_depth /= 3;
3979 }
3980 }
3981 }
3982#endif
3983
3984#ifdef PNG_READ_EXPAND_16_SUPPORTED
3985 if (png_ptr->transformations & PNG_EXPAND_16)
3986 {
3987# ifdef PNG_READ_EXPAND_SUPPORTED
3988 /* In fact it is an error if it isn't supported, but checking is
3989 * the safe way.
3990 */
3991 if (png_ptr->transformations & PNG_EXPAND)
3992 {
3993 if (png_ptr->bit_depth < 16)
3994 max_pixel_depth *= 2;
3995 }
3996 else
3997# endif
3998 png_ptr->transformations &= ~PNG_EXPAND_16;
3999 }
4000#endif
4001
4002#ifdef PNG_READ_FILLER_SUPPORTED
4003 if (png_ptr->transformations & (PNG_FILLER))
4004 {
4005 if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
4006 {
4007 if (max_pixel_depth <= 8)
4008 max_pixel_depth = 16;
4009
4010 else
4011 max_pixel_depth = 32;
4012 }
4013
4014 else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB ||
4015 png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
4016 {
4017 if (max_pixel_depth <= 32)
4018 max_pixel_depth = 32;
4019
4020 else
4021 max_pixel_depth = 64;
4022 }
4023 }
4024#endif
4025
4026#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
4027 if (png_ptr->transformations & PNG_GRAY_TO_RGB)
4028 {
4029 if (
4030#ifdef PNG_READ_EXPAND_SUPPORTED
4031 (png_ptr->num_trans && (png_ptr->transformations & PNG_EXPAND)) ||
4032#endif
4033#ifdef PNG_READ_FILLER_SUPPORTED
4034 (png_ptr->transformations & (PNG_FILLER)) ||
4035#endif
4036 png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
4037 {
4038 if (max_pixel_depth <= 16)
4039 max_pixel_depth = 32;
4040
4041 else
4042 max_pixel_depth = 64;
4043 }
4044
4045 else
4046 {
4047 if (max_pixel_depth <= 8)
4048 {
4049 if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4050 max_pixel_depth = 32;
4051
4052 else
4053 max_pixel_depth = 24;
4054 }
4055
4056 else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4057 max_pixel_depth = 64;
4058
4059 else
4060 max_pixel_depth = 48;
4061 }
4062 }
4063#endif
4064
4065#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
4066defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
4067 if (png_ptr->transformations & PNG_USER_TRANSFORM)
4068 {
4069 int user_pixel_depth = png_ptr->user_transform_depth *
4070 png_ptr->user_transform_channels;
4071
4072 if (user_pixel_depth > max_pixel_depth)
4073 max_pixel_depth = user_pixel_depth;
4074 }
4075#endif
4076
4077 /* This value is stored in png_struct and double checked in the row read
4078 * code.
4079 */
4080 png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;
4081 png_ptr->transformed_pixel_depth = 0; /* calculated on demand */
4082
4083 /* Align the width on the next larger 8 pixels. Mainly used
4084 * for interlacing
4085 */
4086 row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));
4087 /* Calculate the maximum bytes needed, adding a byte and a pixel
4088 * for safety's sake
4089 */
4090 row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
4091 1 + ((max_pixel_depth + 7) >> 3);
4092
4093#ifdef PNG_MAX_MALLOC_64K
4094 if (row_bytes > (png_uint_32)65536L)
4095 png_error(png_ptr, "This image requires a row greater than 64KB");
4096#endif
4097
4098 if (row_bytes + 48 > png_ptr->old_big_row_buf_size)
4099 {
4100 png_free(png_ptr, png_ptr->big_row_buf);
4101 png_free(png_ptr, png_ptr->big_prev_row);
4102
4103 if (png_ptr->interlaced)
4104 png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr,
4105 row_bytes + 48);
4106
4107 else
4108 png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
4109
4110 png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
4111
4112#ifdef PNG_ALIGNED_MEMORY_SUPPORTED
4113 /* Use 16-byte aligned memory for row_buf with at least 16 bytes
4114 * of padding before and after row_buf; treat prev_row similarly.
4115 * NOTE: the alignment is to the start of the pixels, one beyond the start
4116 * of the buffer, because of the filter byte. Prior to libpng 1.5.6 this
4117 * was incorrect; the filter byte was aligned, which had the exact
4118 * opposite effect of that intended.
4119 */
4120 {
4121 png_bytep temp = png_ptr->big_row_buf + 32;
4122 int extra = (int)((temp - (png_bytep)0) & 0x0f);
4123 png_ptr->row_buf = temp - extra - 1/*filter byte*/;
4124
4125 temp = png_ptr->big_prev_row + 32;
4126 extra = (int)((temp - (png_bytep)0) & 0x0f);
4127 png_ptr->prev_row = temp - extra - 1/*filter byte*/;
4128 }
4129
4130#else
4131 /* Use 31 bytes of padding before and 17 bytes after row_buf. */
4132 png_ptr->row_buf = png_ptr->big_row_buf + 31;
4133 png_ptr->prev_row = png_ptr->big_prev_row + 31;
4134#endif
4135 png_ptr->old_big_row_buf_size = row_bytes + 48;
4136 }
4137
4138#ifdef PNG_MAX_MALLOC_64K
4139 if (png_ptr->rowbytes > 65535)
4140 png_error(png_ptr, "This image requires a row greater than 64KB");
4141
4142#endif
4143 if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1))
4144 png_error(png_ptr, "Row has too many bytes to allocate in memory");
4145
4146 png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
4147
4148 png_debug1(3, "width = %u,", png_ptr->width);
4149 png_debug1(3, "height = %u,", png_ptr->height);
4150 png_debug1(3, "iwidth = %u,", png_ptr->iwidth);
4151 png_debug1(3, "num_rows = %u,", png_ptr->num_rows);
4152 png_debug1(3, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes);
4153 png_debug1(3, "irowbytes = %lu",
4154 (unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1);
4155
4156 png_ptr->flags |= PNG_FLAG_ROW_INIT;
4157}
4158#endif /* PNG_READ_SUPPORTED */
generated by cgit v1.1 at 2024-11-20 12:00:36 +0000