1 | ␍␊ |
2 | /* pngrutil.c - utilities to read a PNG file␍␊ |
3 | *␍␊ |
4 | * Last changed in libpng 1.5.10 [March 8, 2012]␍␊ |
5 | * Copyright (c) 1998-2012 Glenn Randers-Pehrson␍␊ |
6 | * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)␍␊ |
7 | * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)␍␊ |
8 | *␍␊ |
9 | * This code is released under the libpng license.␍␊ |
10 | * For conditions of distribution and use, see the disclaimer␍␊ |
11 | * and license in png.h␍␊ |
12 | *␍␊ |
13 | * This file contains routines that are only called from within␍␊ |
14 | * libpng itself during the course of reading an image.␍␊ |
15 | */␍␊ |
16 | ␍␊ |
17 | #include "pngpriv.h"␍␊ |
18 | ␍␊ |
19 | #ifdef PNG_READ_SUPPORTED␍␊ |
20 | ␍␊ |
21 | #define png_strtod(p,a,b) strtod(a,b)␍␊ |
22 | ␍␊ |
23 | png_uint_32 PNGAPI␍␊ |
24 | png_get_uint_31(png_structp png_ptr, png_const_bytep buf)␍␊ |
25 | {␍␊ |
26 | png_uint_32 uval = png_get_uint_32(buf);␍␊ |
27 | ␍␊ |
28 | if (uval > PNG_UINT_31_MAX)␍␊ |
29 | png_error(png_ptr, "PNG unsigned integer out of range");␍␊ |
30 | ␍␊ |
31 | return (uval);␍␊ |
32 | }␍␊ |
33 | ␍␊ |
34 | #if defined(PNG_READ_gAMA_SUPPORTED) || defined(PNG_READ_cHRM_SUPPORTED)␍␊ |
35 | /* The following is a variation on the above for use with the fixed␍␊ |
36 | * point values used for gAMA and cHRM. Instead of png_error it␍␊ |
37 | * issues a warning and returns (-1) - an invalid value because both␍␊ |
38 | * gAMA and cHRM use *unsigned* integers for fixed point values.␍␊ |
39 | */␍␊ |
40 | #define PNG_FIXED_ERROR (-1)␍␊ |
41 | ␍␊ |
42 | static png_fixed_point /* PRIVATE */␍␊ |
43 | png_get_fixed_point(png_structp png_ptr, png_const_bytep buf)␍␊ |
44 | {␍␊ |
45 | png_uint_32 uval = png_get_uint_32(buf);␍␊ |
46 | ␍␊ |
47 | if (uval <= PNG_UINT_31_MAX)␍␊ |
48 | return (png_fixed_point)uval; /* known to be in range */␍␊ |
49 | ␍␊ |
50 | /* The caller can turn off the warning by passing NULL. */␍␊ |
51 | if (png_ptr != NULL)␍␊ |
52 | png_warning(png_ptr, "PNG fixed point integer out of range");␍␊ |
53 | ␍␊ |
54 | return PNG_FIXED_ERROR;␍␊ |
55 | }␍␊ |
56 | #endif␍␊ |
57 | ␍␊ |
58 | #ifdef PNG_READ_INT_FUNCTIONS_SUPPORTED␍␊ |
59 | /* NOTE: the read macros will obscure these definitions, so that if␍␊ |
60 | * PNG_USE_READ_MACROS is set the library will not use them internally,␍␊ |
61 | * but the APIs will still be available externally.␍␊ |
62 | *␍␊ |
63 | * The parentheses around "PNGAPI function_name" in the following three␍␊ |
64 | * functions are necessary because they allow the macros to co-exist with␍␊ |
65 | * these (unused but exported) functions.␍␊ |
66 | */␍␊ |
67 | ␍␊ |
68 | /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */␍␊ |
69 | png_uint_32 (PNGAPI␍␊ |
70 | png_get_uint_32)(png_const_bytep buf)␍␊ |
71 | {␍␊ |
72 | png_uint_32 uval =␍␊ |
73 | ((png_uint_32)(*(buf )) << 24) +␍␊ |
74 | ((png_uint_32)(*(buf + 1)) << 16) +␍␊ |
75 | ((png_uint_32)(*(buf + 2)) << 8) +␍␊ |
76 | ((png_uint_32)(*(buf + 3)) ) ;␍␊ |
77 | ␍␊ |
78 | return uval;␍␊ |
79 | }␍␊ |
80 | ␍␊ |
81 | /* Grab a signed 32-bit integer from a buffer in big-endian format. The␍␊ |
82 | * data is stored in the PNG file in two's complement format and there␍␊ |
83 | * is no guarantee that a 'png_int_32' is exactly 32 bits, therefore␍␊ |
84 | * the following code does a two's complement to native conversion.␍␊ |
85 | */␍␊ |
86 | png_int_32 (PNGAPI␍␊ |
87 | png_get_int_32)(png_const_bytep buf)␍␊ |
88 | {␍␊ |
89 | png_uint_32 uval = png_get_uint_32(buf);␍␊ |
90 | if ((uval & 0x80000000) == 0) /* non-negative */␍␊ |
91 | return uval;␍␊ |
92 | ␍␊ |
93 | uval = (uval ^ 0xffffffff) + 1; /* 2's complement: -x = ~x+1 */␍␊ |
94 | return -(png_int_32)uval;␍␊ |
95 | }␍␊ |
96 | ␍␊ |
97 | /* Grab an unsigned 16-bit integer from a buffer in big-endian format. */␍␊ |
98 | png_uint_16 (PNGAPI␍␊ |
99 | png_get_uint_16)(png_const_bytep buf)␍␊ |
100 | {␍␊ |
101 | /* ANSI-C requires an int value to accomodate at least 16 bits so this␍␊ |
102 | * works and allows the compiler not to worry about possible narrowing␍␊ |
103 | * on 32 bit systems. (Pre-ANSI systems did not make integers smaller␍␊ |
104 | * than 16 bits either.)␍␊ |
105 | */␍␊ |
106 | unsigned int val =␍␊ |
107 | ((unsigned int)(*buf) << 8) +␍␊ |
108 | ((unsigned int)(*(buf + 1)));␍␊ |
109 | ␍␊ |
110 | return (png_uint_16)val;␍␊ |
111 | }␍␊ |
112 | ␍␊ |
113 | #endif /* PNG_READ_INT_FUNCTIONS_SUPPORTED */␍␊ |
114 | ␍␊ |
115 | /* Read and check the PNG file signature */␍␊ |
116 | void /* PRIVATE */␍␊ |
117 | png_read_sig(png_structp png_ptr, png_infop info_ptr)␍␊ |
118 | {␍␊ |
119 | png_size_t num_checked, num_to_check;␍␊ |
120 | ␍␊ |
121 | /* Exit if the user application does not expect a signature. */␍␊ |
122 | if (png_ptr->sig_bytes >= 8)␍␊ |
123 | return;␍␊ |
124 | ␍␊ |
125 | num_checked = png_ptr->sig_bytes;␍␊ |
126 | num_to_check = 8 - num_checked;␍␊ |
127 | ␍␊ |
128 | #ifdef PNG_IO_STATE_SUPPORTED␍␊ |
129 | png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE;␍␊ |
130 | #endif␍␊ |
131 | ␍␊ |
132 | /* The signature must be serialized in a single I/O call. */␍␊ |
133 | png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check);␍␊ |
134 | png_ptr->sig_bytes = 8;␍␊ |
135 | ␍␊ |
136 | if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))␍␊ |
137 | {␍␊ |
138 | if (num_checked < 4 &&␍␊ |
139 | png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4))␍␊ |
140 | png_error(png_ptr, "Not a PNG file");␍␊ |
141 | else␍␊ |
142 | png_error(png_ptr, "PNG file corrupted by ASCII conversion");␍␊ |
143 | }␍␊ |
144 | if (num_checked < 3)␍␊ |
145 | png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;␍␊ |
146 | }␍␊ |
147 | ␍␊ |
148 | /* Read the chunk header (length + type name).␍␊ |
149 | * Put the type name into png_ptr->chunk_name, and return the length.␍␊ |
150 | */␍␊ |
151 | png_uint_32 /* PRIVATE */␍␊ |
152 | png_read_chunk_header(png_structp png_ptr)␍␊ |
153 | {␍␊ |
154 | png_byte buf[8];␍␊ |
155 | png_uint_32 length;␍␊ |
156 | ␍␊ |
157 | #ifdef PNG_IO_STATE_SUPPORTED␍␊ |
158 | png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR;␍␊ |
159 | #endif␍␊ |
160 | ␍␊ |
161 | /* Read the length and the chunk name.␍␊ |
162 | * This must be performed in a single I/O call.␍␊ |
163 | */␍␊ |
164 | png_read_data(png_ptr, buf, 8);␍␊ |
165 | length = png_get_uint_31(png_ptr, buf);␍␊ |
166 | ␍␊ |
167 | /* Put the chunk name into png_ptr->chunk_name. */␍␊ |
168 | png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(buf+4);␍␊ |
169 | ␍␊ |
170 | png_debug2(0, "Reading %lx chunk, length = %lu",␍␊ |
171 | (unsigned long)png_ptr->chunk_name, (unsigned long)length);␍␊ |
172 | ␍␊ |
173 | /* Reset the crc and run it over the chunk name. */␍␊ |
174 | png_reset_crc(png_ptr);␍␊ |
175 | png_calculate_crc(png_ptr, buf + 4, 4);␍␊ |
176 | ␍␊ |
177 | /* Check to see if chunk name is valid. */␍␊ |
178 | png_check_chunk_name(png_ptr, png_ptr->chunk_name);␍␊ |
179 | ␍␊ |
180 | #ifdef PNG_IO_STATE_SUPPORTED␍␊ |
181 | png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;␍␊ |
182 | #endif␍␊ |
183 | ␍␊ |
184 | return length;␍␊ |
185 | }␍␊ |
186 | ␍␊ |
187 | /* Read data, and (optionally) run it through the CRC. */␍␊ |
188 | void /* PRIVATE */␍␊ |
189 | png_crc_read(png_structp png_ptr, png_bytep buf, png_size_t length)␍␊ |
190 | {␍␊ |
191 | if (png_ptr == NULL)␍␊ |
192 | return;␍␊ |
193 | ␍␊ |
194 | png_read_data(png_ptr, buf, length);␍␊ |
195 | png_calculate_crc(png_ptr, buf, length);␍␊ |
196 | }␍␊ |
197 | ␍␊ |
198 | /* Optionally skip data and then check the CRC. Depending on whether we␍␊ |
199 | * are reading a ancillary or critical chunk, and how the program has set␍␊ |
200 | * things up, we may calculate the CRC on the data and print a message.␍␊ |
201 | * Returns '1' if there was a CRC error, '0' otherwise.␍␊ |
202 | */␍␊ |
203 | int /* PRIVATE */␍␊ |
204 | png_crc_finish(png_structp png_ptr, png_uint_32 skip)␍␊ |
205 | {␍␊ |
206 | png_size_t i;␍␊ |
207 | png_size_t istop = png_ptr->zbuf_size;␍␊ |
208 | ␍␊ |
209 | for (i = (png_size_t)skip; i > istop; i -= istop)␍␊ |
210 | {␍␊ |
211 | png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size);␍␊ |
212 | }␍␊ |
213 | ␍␊ |
214 | if (i)␍␊ |
215 | {␍␊ |
216 | png_crc_read(png_ptr, png_ptr->zbuf, i);␍␊ |
217 | }␍␊ |
218 | ␍␊ |
219 | if (png_crc_error(png_ptr))␍␊ |
220 | {␍␊ |
221 | if (PNG_CHUNK_ANCILLIARY(png_ptr->chunk_name) ?␍␊ |
222 | !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) :␍␊ |
223 | (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE))␍␊ |
224 | {␍␊ |
225 | png_chunk_warning(png_ptr, "CRC error");␍␊ |
226 | }␍␊ |
227 | ␍␊ |
228 | else␍␊ |
229 | {␍␊ |
230 | png_chunk_benign_error(png_ptr, "CRC error");␍␊ |
231 | return (0);␍␊ |
232 | }␍␊ |
233 | ␍␊ |
234 | return (1);␍␊ |
235 | }␍␊ |
236 | ␍␊ |
237 | return (0);␍␊ |
238 | }␍␊ |
239 | ␍␊ |
240 | /* Compare the CRC stored in the PNG file with that calculated by libpng from␍␊ |
241 | * the data it has read thus far.␍␊ |
242 | */␍␊ |
243 | int /* PRIVATE */␍␊ |
244 | png_crc_error(png_structp png_ptr)␍␊ |
245 | {␍␊ |
246 | png_byte crc_bytes[4];␍␊ |
247 | png_uint_32 crc;␍␊ |
248 | int need_crc = 1;␍␊ |
249 | ␍␊ |
250 | if (PNG_CHUNK_ANCILLIARY(png_ptr->chunk_name))␍␊ |
251 | {␍␊ |
252 | if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==␍␊ |
253 | (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))␍␊ |
254 | need_crc = 0;␍␊ |
255 | }␍␊ |
256 | ␍␊ |
257 | else /* critical */␍␊ |
258 | {␍␊ |
259 | if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE)␍␊ |
260 | need_crc = 0;␍␊ |
261 | }␍␊ |
262 | ␍␊ |
263 | #ifdef PNG_IO_STATE_SUPPORTED␍␊ |
264 | png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC;␍␊ |
265 | #endif␍␊ |
266 | ␍␊ |
267 | /* The chunk CRC must be serialized in a single I/O call. */␍␊ |
268 | png_read_data(png_ptr, crc_bytes, 4);␍␊ |
269 | ␍␊ |
270 | if (need_crc)␍␊ |
271 | {␍␊ |
272 | crc = png_get_uint_32(crc_bytes);␍␊ |
273 | return ((int)(crc != png_ptr->crc));␍␊ |
274 | }␍␊ |
275 | ␍␊ |
276 | else␍␊ |
277 | return (0);␍␊ |
278 | }␍␊ |
279 | ␍␊ |
280 | #ifdef PNG_READ_COMPRESSED_TEXT_SUPPORTED␍␊ |
281 | static png_size_t␍␊ |
282 | png_inflate(png_structp png_ptr, png_bytep data, png_size_t size,␍␊ |
283 | png_bytep output, png_size_t output_size)␍␊ |
284 | {␍␊ |
285 | png_size_t count = 0;␍␊ |
286 | ␍␊ |
287 | /* zlib can't necessarily handle more than 65535 bytes at once (i.e. it can't␍␊ |
288 | * even necessarily handle 65536 bytes) because the type uInt is "16 bits or␍␊ |
289 | * more". Consequently it is necessary to chunk the input to zlib. This␍␊ |
290 | * code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the maximum value␍␊ |
291 | * that can be stored in a uInt.) It is possible to set ZLIB_IO_MAX to a␍␊ |
292 | * lower value in pngpriv.h and this may sometimes have a performance␍␊ |
293 | * advantage, because it forces access of the input data to be separated from␍␊ |
294 | * at least some of the use by some period of time.␍␊ |
295 | */␍␊ |
296 | png_ptr->zstream.next_in = data;␍␊ |
297 | /* avail_in is set below from 'size' */␍␊ |
298 | png_ptr->zstream.avail_in = 0;␍␊ |
299 | ␍␊ |
300 | while (1)␍␊ |
301 | {␍␊ |
302 | int ret, avail;␍␊ |
303 | ␍␊ |
304 | /* The setting of 'avail_in' used to be outside the loop; by setting it␍␊ |
305 | * inside it is possible to chunk the input to zlib and simply rely on␍␊ |
306 | * zlib to advance the 'next_in' pointer. This allows arbitrary amounts o␍␊ |
307 | * data to be passed through zlib at the unavoidable cost of requiring a␍␊ |
308 | * window save (memcpy of up to 32768 output bytes) every ZLIB_IO_MAX␍␊ |
309 | * input bytes.␍␊ |
310 | */␍␊ |
311 | if (png_ptr->zstream.avail_in == 0 && size > 0)␍␊ |
312 | {␍␊ |
313 | if (size <= ZLIB_IO_MAX)␍␊ |
314 | {␍␊ |
315 | /* The value is less than ZLIB_IO_MAX so the cast is safe: */␍␊ |
316 | png_ptr->zstream.avail_in = (uInt)size;␍␊ |
317 | size = 0;␍␊ |
318 | }␍␊ |
319 | ␍␊ |
320 | else␍␊ |
321 | {␍␊ |
322 | png_ptr->zstream.avail_in = ZLIB_IO_MAX;␍␊ |
323 | size -= ZLIB_IO_MAX;␍␊ |
324 | }␍␊ |
325 | }␍␊ |
326 | ␍␊ |
327 | /* Reset the output buffer each time round - we empty it␍␊ |
328 | * after every inflate call.␍␊ |
329 | */␍␊ |
330 | png_ptr->zstream.next_out = png_ptr->zbuf;␍␊ |
331 | png_ptr->zstream.avail_out = png_ptr->zbuf_size;␍␊ |
332 | ␍␊ |
333 | #if 1␍␊ |
334 | ret = inflate(&png_ptr->zstream, Z_NO_FLUSH);␍␊ |
335 | #else␍␊ |
336 | int flush = Z_NO_FLUSH;␍␊ |
337 | execut_hook("inflate", &png_ptr->zstream, &flush, &ret, NULL, NULL, NULL );␍␊ |
338 | #endif␍␊ |
339 | avail = png_ptr->zbuf_size - png_ptr->zstream.avail_out;␍␊ |
340 | ␍␊ |
341 | /* First copy/count any new output - but only if we didn't␍␊ |
342 | * get an error code.␍␊ |
343 | */␍␊ |
344 | if ((ret == Z_OK || ret == Z_STREAM_END) && avail > 0)␍␊ |
345 | {␍␊ |
346 | png_size_t space = avail; /* > 0, see above */␍␊ |
347 | ␍␊ |
348 | if (output != 0 && output_size > count)␍␊ |
349 | {␍␊ |
350 | png_size_t copy = output_size - count;␍␊ |
351 | ␍␊ |
352 | if (space < copy)␍␊ |
353 | copy = space;␍␊ |
354 | ␍␊ |
355 | png_memcpy(output + count, png_ptr->zbuf, copy);␍␊ |
356 | }␍␊ |
357 | count += space;␍␊ |
358 | }␍␊ |
359 | ␍␊ |
360 | if (ret == Z_OK)␍␊ |
361 | continue;␍␊ |
362 | ␍␊ |
363 | /* Termination conditions - always reset the zstream, it␍␊ |
364 | * must be left in inflateInit state.␍␊ |
365 | */␍␊ |
366 | png_ptr->zstream.avail_in = 0;␍␊ |
367 | #if 1␍␊ |
368 | inflateReset(&png_ptr->zstream); ␍␊ |
369 | #else␍␊ |
370 | int resetret;␍␊ |
371 | execut_hook("inflateReset", &png_ptr->zstream &resetret, NULL, NULL, NULL, NULL );␍␊ |
372 | #endif␍␊ |
373 | if (ret == Z_STREAM_END)␍␊ |
374 | return count; /* NOTE: may be zero. */␍␊ |
375 | ␍␊ |
376 | /* Now handle the error codes - the API always returns 0␍␊ |
377 | * and the error message is dumped into the uncompressed␍␊ |
378 | * buffer if available.␍␊ |
379 | */␍␊ |
380 | # ifdef PNG_WARNINGS_SUPPORTED␍␊ |
381 | {␍␊ |
382 | png_const_charp msg;␍␊ |
383 | ␍␊ |
384 | if (png_ptr->zstream.msg != 0)␍␊ |
385 | msg = png_ptr->zstream.msg;␍␊ |
386 | ␍␊ |
387 | else switch (ret)␍␊ |
388 | {␍␊ |
389 | case Z_BUF_ERROR:␍␊ |
390 | msg = "Buffer error in compressed datastream";␍␊ |
391 | break;␍␊ |
392 | ␍␊ |
393 | case Z_DATA_ERROR:␍␊ |
394 | msg = "Data error in compressed datastream";␍␊ |
395 | break;␍␊ |
396 | ␍␊ |
397 | default:␍␊ |
398 | msg = "Incomplete compressed datastream";␍␊ |
399 | break;␍␊ |
400 | }␍␊ |
401 | ␍␊ |
402 | png_chunk_warning(png_ptr, msg);␍␊ |
403 | }␍␊ |
404 | # endif␍␊ |
405 | ␍␊ |
406 | /* 0 means an error - notice that this code simply ignores␍␊ |
407 | * zero length compressed chunks as a result.␍␊ |
408 | */␍␊ |
409 | return 0;␍␊ |
410 | }␍␊ |
411 | }␍␊ |
412 | ␍␊ |
413 | /*␍␊ |
414 | * Decompress trailing data in a chunk. The assumption is that chunkdata␍␊ |
415 | * points at an allocated area holding the contents of a chunk with a␍␊ |
416 | * trailing compressed part. What we get back is an allocated area␍␊ |
417 | * holding the original prefix part and an uncompressed version of the␍␊ |
418 | * trailing part (the malloc area passed in is freed).␍␊ |
419 | */␍␊ |
420 | void /* PRIVATE */␍␊ |
421 | png_decompress_chunk(png_structp png_ptr, int comp_type,␍␊ |
422 | png_size_t chunklength,␍␊ |
423 | png_size_t prefix_size, png_size_t *newlength)␍␊ |
424 | {␍␊ |
425 | /* The caller should guarantee this */␍␊ |
426 | if (prefix_size > chunklength)␍␊ |
427 | {␍␊ |
428 | /* The recovery is to delete the chunk. */␍␊ |
429 | png_warning(png_ptr, "invalid chunklength");␍␊ |
430 | prefix_size = 0; /* To delete everything */␍␊ |
431 | }␍␊ |
432 | ␍␊ |
433 | else if (comp_type == PNG_COMPRESSION_TYPE_BASE)␍␊ |
434 | {␍␊ |
435 | png_size_t expanded_size = png_inflate(png_ptr,␍␊ |
436 | (png_bytep)(png_ptr->chunkdata + prefix_size),␍␊ |
437 | chunklength - prefix_size,␍␊ |
438 | 0, /* output */␍␊ |
439 | 0); /* output size */␍␊ |
440 | ␍␊ |
441 | /* Now check the limits on this chunk - if the limit fails the␍␊ |
442 | * compressed data will be removed, the prefix will remain.␍␊ |
443 | */␍␊ |
444 | if (prefix_size >= (~(png_size_t)0) - 1 ||␍␊ |
445 | expanded_size >= (~(png_size_t)0) - 1 - prefix_size␍␊ |
446 | #ifdef PNG_USER_LIMITS_SUPPORTED␍␊ |
447 | || (png_ptr->user_chunk_malloc_max &&␍␊ |
448 | (prefix_size + expanded_size >= png_ptr->user_chunk_malloc_max - 1))␍␊ |
449 | #else␍␊ |
450 | || ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&␍␊ |
451 | prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)␍␊ |
452 | #endif␍␊ |
453 | )␍␊ |
454 | png_warning(png_ptr, "Exceeded size limit while expanding chunk");␍␊ |
455 | ␍␊ |
456 | /* If the size is zero either there was an error and a message␍␊ |
457 | * has already been output (warning) or the size really is zero␍␊ |
458 | * and we have nothing to do - the code will exit through the␍␊ |
459 | * error case below.␍␊ |
460 | */␍␊ |
461 | else if (expanded_size > 0)␍␊ |
462 | {␍␊ |
463 | /* Success (maybe) - really uncompress the chunk. */␍␊ |
464 | png_size_t new_size = 0;␍␊ |
465 | png_charp text = (png_charp)png_malloc_warn(png_ptr,␍␊ |
466 | prefix_size + expanded_size + 1);␍␊ |
467 | ␍␊ |
468 | if (text != NULL)␍␊ |
469 | {␍␊ |
470 | png_memcpy(text, png_ptr->chunkdata, prefix_size);␍␊ |
471 | new_size = png_inflate(png_ptr,␍␊ |
472 | (png_bytep)(png_ptr->chunkdata + prefix_size),␍␊ |
473 | chunklength - prefix_size,␍␊ |
474 | (png_bytep)(text + prefix_size), expanded_size);␍␊ |
475 | text[prefix_size + expanded_size] = 0; /* just in case */␍␊ |
476 | ␍␊ |
477 | if (new_size == expanded_size)␍␊ |
478 | {␍␊ |
479 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
480 | png_ptr->chunkdata = text;␍␊ |
481 | *newlength = prefix_size + expanded_size;␍␊ |
482 | return; /* The success return! */␍␊ |
483 | }␍␊ |
484 | ␍␊ |
485 | png_warning(png_ptr, "png_inflate logic error");␍␊ |
486 | png_free(png_ptr, text);␍␊ |
487 | }␍␊ |
488 | ␍␊ |
489 | else␍␊ |
490 | png_warning(png_ptr, "Not enough memory to decompress chunk");␍␊ |
491 | }␍␊ |
492 | }␍␊ |
493 | ␍␊ |
494 | else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */␍␊ |
495 | {␍␊ |
496 | PNG_WARNING_PARAMETERS(p)␍␊ |
497 | png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_d, comp_type);␍␊ |
498 | png_formatted_warning(png_ptr, p, "Unknown compression type @1");␍␊ |
499 | ␍␊ |
500 | /* The recovery is to simply drop the data. */␍␊ |
501 | }␍␊ |
502 | ␍␊ |
503 | /* Generic error return - leave the prefix, delete the compressed␍␊ |
504 | * data, reallocate the chunkdata to remove the potentially large␍␊ |
505 | * amount of compressed data.␍␊ |
506 | */␍␊ |
507 | {␍␊ |
508 | png_charp text = (png_charp)png_malloc_warn(png_ptr, prefix_size + 1);␍␊ |
509 | ␍␊ |
510 | if (text != NULL)␍␊ |
511 | {␍␊ |
512 | if (prefix_size > 0)␍␊ |
513 | png_memcpy(text, png_ptr->chunkdata, prefix_size);␍␊ |
514 | ␍␊ |
515 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
516 | png_ptr->chunkdata = text;␍␊ |
517 | ␍␊ |
518 | /* This is an extra zero in the 'uncompressed' part. */␍␊ |
519 | *(png_ptr->chunkdata + prefix_size) = 0x00;␍␊ |
520 | }␍␊ |
521 | /* Ignore a malloc error here - it is safe. */␍␊ |
522 | }␍␊ |
523 | ␍␊ |
524 | *newlength = prefix_size;␍␊ |
525 | }␍␊ |
526 | #endif /* PNG_READ_COMPRESSED_TEXT_SUPPORTED */␍␊ |
527 | ␍␊ |
528 | /* Read and check the IDHR chunk */␍␊ |
529 | void /* PRIVATE */␍␊ |
530 | png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
531 | {␍␊ |
532 | png_byte buf[13];␍␊ |
533 | png_uint_32 width, height;␍␊ |
534 | int bit_depth, color_type, compression_type, filter_type;␍␊ |
535 | int interlace_type;␍␊ |
536 | ␍␊ |
537 | png_debug(1, "in png_handle_IHDR");␍␊ |
538 | ␍␊ |
539 | if (png_ptr->mode & PNG_HAVE_IHDR)␍␊ |
540 | png_error(png_ptr, "Out of place IHDR");␍␊ |
541 | ␍␊ |
542 | /* Check the length */␍␊ |
543 | if (length != 13)␍␊ |
544 | png_error(png_ptr, "Invalid IHDR chunk");␍␊ |
545 | ␍␊ |
546 | png_ptr->mode |= PNG_HAVE_IHDR;␍␊ |
547 | ␍␊ |
548 | png_crc_read(png_ptr, buf, 13);␍␊ |
549 | png_crc_finish(png_ptr, 0);␍␊ |
550 | ␍␊ |
551 | width = png_get_uint_31(png_ptr, buf);␍␊ |
552 | height = png_get_uint_31(png_ptr, buf + 4);␍␊ |
553 | bit_depth = buf[8];␍␊ |
554 | color_type = buf[9];␍␊ |
555 | compression_type = buf[10];␍␊ |
556 | filter_type = buf[11];␍␊ |
557 | interlace_type = buf[12];␍␊ |
558 | ␍␊ |
559 | /* Set internal variables */␍␊ |
560 | png_ptr->width = width;␍␊ |
561 | png_ptr->height = height;␍␊ |
562 | png_ptr->bit_depth = (png_byte)bit_depth;␍␊ |
563 | png_ptr->interlaced = (png_byte)interlace_type;␍␊ |
564 | png_ptr->color_type = (png_byte)color_type;␍␊ |
565 | #ifdef PNG_MNG_FEATURES_SUPPORTED␍␊ |
566 | png_ptr->filter_type = (png_byte)filter_type;␍␊ |
567 | #endif␍␊ |
568 | png_ptr->compression_type = (png_byte)compression_type;␍␊ |
569 | ␍␊ |
570 | /* Find number of channels */␍␊ |
571 | switch (png_ptr->color_type)␍␊ |
572 | {␍␊ |
573 | default: /* invalid, png_set_IHDR calls png_error */␍␊ |
574 | case PNG_COLOR_TYPE_GRAY:␍␊ |
575 | case PNG_COLOR_TYPE_PALETTE:␍␊ |
576 | png_ptr->channels = 1;␍␊ |
577 | break;␍␊ |
578 | ␍␊ |
579 | case PNG_COLOR_TYPE_RGB:␍␊ |
580 | png_ptr->channels = 3;␍␊ |
581 | break;␍␊ |
582 | ␍␊ |
583 | case PNG_COLOR_TYPE_GRAY_ALPHA:␍␊ |
584 | png_ptr->channels = 2;␍␊ |
585 | break;␍␊ |
586 | ␍␊ |
587 | case PNG_COLOR_TYPE_RGB_ALPHA:␍␊ |
588 | png_ptr->channels = 4;␍␊ |
589 | break;␍␊ |
590 | }␍␊ |
591 | ␍␊ |
592 | /* Set up other useful info */␍␊ |
593 | png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *␍␊ |
594 | png_ptr->channels);␍␊ |
595 | png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);␍␊ |
596 | png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);␍␊ |
597 | png_debug1(3, "channels = %d", png_ptr->channels);␍␊ |
598 | png_debug1(3, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes);␍␊ |
599 | png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,␍␊ |
600 | color_type, interlace_type, compression_type, filter_type);␍␊ |
601 | }␍␊ |
602 | ␍␊ |
603 | /* Read and check the palette */␍␊ |
604 | void /* PRIVATE */␍␊ |
605 | png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
606 | {␍␊ |
607 | png_color palette[PNG_MAX_PALETTE_LENGTH];␍␊ |
608 | int num, i;␍␊ |
609 | #ifdef PNG_POINTER_INDEXING_SUPPORTED␍␊ |
610 | png_colorp pal_ptr;␍␊ |
611 | #endif␍␊ |
612 | ␍␊ |
613 | png_debug(1, "in png_handle_PLTE");␍␊ |
614 | ␍␊ |
615 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
616 | png_error(png_ptr, "Missing IHDR before PLTE");␍␊ |
617 | ␍␊ |
618 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
619 | {␍␊ |
620 | png_warning(png_ptr, "Invalid PLTE after IDAT");␍␊ |
621 | png_crc_finish(png_ptr, length);␍␊ |
622 | return;␍␊ |
623 | }␍␊ |
624 | ␍␊ |
625 | else if (png_ptr->mode & PNG_HAVE_PLTE)␍␊ |
626 | png_error(png_ptr, "Duplicate PLTE chunk");␍␊ |
627 | ␍␊ |
628 | png_ptr->mode |= PNG_HAVE_PLTE;␍␊ |
629 | ␍␊ |
630 | if (!(png_ptr->color_type&PNG_COLOR_MASK_COLOR))␍␊ |
631 | {␍␊ |
632 | png_warning(png_ptr,␍␊ |
633 | "Ignoring PLTE chunk in grayscale PNG");␍␊ |
634 | png_crc_finish(png_ptr, length);␍␊ |
635 | return;␍␊ |
636 | }␍␊ |
637 | ␍␊ |
638 | #ifndef PNG_READ_OPT_PLTE_SUPPORTED␍␊ |
639 | if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)␍␊ |
640 | {␍␊ |
641 | png_crc_finish(png_ptr, length);␍␊ |
642 | return;␍␊ |
643 | }␍␊ |
644 | #endif␍␊ |
645 | ␍␊ |
646 | if (length > 3*PNG_MAX_PALETTE_LENGTH || length % 3)␍␊ |
647 | {␍␊ |
648 | if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)␍␊ |
649 | {␍␊ |
650 | png_warning(png_ptr, "Invalid palette chunk");␍␊ |
651 | png_crc_finish(png_ptr, length);␍␊ |
652 | return;␍␊ |
653 | }␍␊ |
654 | ␍␊ |
655 | else␍␊ |
656 | {␍␊ |
657 | png_error(png_ptr, "Invalid palette chunk");␍␊ |
658 | }␍␊ |
659 | }␍␊ |
660 | ␍␊ |
661 | num = (int)length / 3;␍␊ |
662 | ␍␊ |
663 | #ifdef PNG_POINTER_INDEXING_SUPPORTED␍␊ |
664 | for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)␍␊ |
665 | {␍␊ |
666 | png_byte buf[3];␍␊ |
667 | ␍␊ |
668 | png_crc_read(png_ptr, buf, 3);␍␊ |
669 | pal_ptr->red = buf[0];␍␊ |
670 | pal_ptr->green = buf[1];␍␊ |
671 | pal_ptr->blue = buf[2];␍␊ |
672 | }␍␊ |
673 | #else␍␊ |
674 | for (i = 0; i < num; i++)␍␊ |
675 | {␍␊ |
676 | png_byte buf[3];␍␊ |
677 | ␍␊ |
678 | png_crc_read(png_ptr, buf, 3);␍␊ |
679 | /* Don't depend upon png_color being any order */␍␊ |
680 | palette[i].red = buf[0];␍␊ |
681 | palette[i].green = buf[1];␍␊ |
682 | palette[i].blue = buf[2];␍␊ |
683 | }␍␊ |
684 | #endif␍␊ |
685 | ␍␊ |
686 | /* If we actually need the PLTE chunk (ie for a paletted image), we do␍␊ |
687 | * whatever the normal CRC configuration tells us. However, if we␍␊ |
688 | * have an RGB image, the PLTE can be considered ancillary, so␍␊ |
689 | * we will act as though it is.␍␊ |
690 | */␍␊ |
691 | #ifndef PNG_READ_OPT_PLTE_SUPPORTED␍␊ |
692 | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)␍␊ |
693 | #endif␍␊ |
694 | {␍␊ |
695 | png_crc_finish(png_ptr, 0);␍␊ |
696 | }␍␊ |
697 | ␍␊ |
698 | #ifndef PNG_READ_OPT_PLTE_SUPPORTED␍␊ |
699 | else if (png_crc_error(png_ptr)) /* Only if we have a CRC error */␍␊ |
700 | {␍␊ |
701 | /* If we don't want to use the data from an ancillary chunk,␍␊ |
702 | * we have two options: an error abort, or a warning and we␍␊ |
703 | * ignore the data in this chunk (which should be OK, since␍␊ |
704 | * it's considered ancillary for a RGB or RGBA image).␍␊ |
705 | */␍␊ |
706 | if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE))␍␊ |
707 | {␍␊ |
708 | if (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)␍␊ |
709 | {␍␊ |
710 | png_chunk_benign_error(png_ptr, "CRC error");␍␊ |
711 | }␍␊ |
712 | ␍␊ |
713 | else␍␊ |
714 | {␍␊ |
715 | png_chunk_warning(png_ptr, "CRC error");␍␊ |
716 | return;␍␊ |
717 | }␍␊ |
718 | }␍␊ |
719 | ␍␊ |
720 | /* Otherwise, we (optionally) emit a warning and use the chunk. */␍␊ |
721 | else if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN))␍␊ |
722 | {␍␊ |
723 | png_chunk_warning(png_ptr, "CRC error");␍␊ |
724 | }␍␊ |
725 | }␍␊ |
726 | #endif␍␊ |
727 | ␍␊ |
728 | png_set_PLTE(png_ptr, info_ptr, palette, num);␍␊ |
729 | ␍␊ |
730 | #ifdef PNG_READ_tRNS_SUPPORTED␍␊ |
731 | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)␍␊ |
732 | {␍␊ |
733 | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))␍␊ |
734 | {␍␊ |
735 | if (png_ptr->num_trans > (png_uint_16)num)␍␊ |
736 | {␍␊ |
737 | png_warning(png_ptr, "Truncating incorrect tRNS chunk length");␍␊ |
738 | png_ptr->num_trans = (png_uint_16)num;␍␊ |
739 | }␍␊ |
740 | ␍␊ |
741 | if (info_ptr->num_trans > (png_uint_16)num)␍␊ |
742 | {␍␊ |
743 | png_warning(png_ptr, "Truncating incorrect info tRNS chunk length");␍␊ |
744 | info_ptr->num_trans = (png_uint_16)num;␍␊ |
745 | }␍␊ |
746 | }␍␊ |
747 | }␍␊ |
748 | #endif␍␊ |
749 | ␍␊ |
750 | }␍␊ |
751 | ␍␊ |
752 | void /* PRIVATE */␍␊ |
753 | png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
754 | {␍␊ |
755 | png_debug(1, "in png_handle_IEND");␍␊ |
756 | ␍␊ |
757 | if (!(png_ptr->mode & PNG_HAVE_IHDR) || !(png_ptr->mode & PNG_HAVE_IDAT))␍␊ |
758 | {␍␊ |
759 | png_error(png_ptr, "No image in file");␍␊ |
760 | }␍␊ |
761 | ␍␊ |
762 | png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);␍␊ |
763 | ␍␊ |
764 | if (length != 0)␍␊ |
765 | {␍␊ |
766 | png_warning(png_ptr, "Incorrect IEND chunk length");␍␊ |
767 | }␍␊ |
768 | ␍␊ |
769 | png_crc_finish(png_ptr, length);␍␊ |
770 | ␍␊ |
771 | PNG_UNUSED(info_ptr) /* Quiet compiler warnings about unused info_ptr */␍␊ |
772 | }␍␊ |
773 | ␍␊ |
774 | #ifdef PNG_READ_gAMA_SUPPORTED␍␊ |
775 | void /* PRIVATE */␍␊ |
776 | png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
777 | {␍␊ |
778 | png_fixed_point igamma;␍␊ |
779 | png_byte buf[4];␍␊ |
780 | ␍␊ |
781 | png_debug(1, "in png_handle_gAMA");␍␊ |
782 | ␍␊ |
783 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
784 | png_error(png_ptr, "Missing IHDR before gAMA");␍␊ |
785 | ␍␊ |
786 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
787 | {␍␊ |
788 | png_warning(png_ptr, "Invalid gAMA after IDAT");␍␊ |
789 | png_crc_finish(png_ptr, length);␍␊ |
790 | return;␍␊ |
791 | }␍␊ |
792 | ␍␊ |
793 | else if (png_ptr->mode & PNG_HAVE_PLTE)␍␊ |
794 | /* Should be an error, but we can cope with it */␍␊ |
795 | png_warning(png_ptr, "Out of place gAMA chunk");␍␊ |
796 | ␍␊ |
797 | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)␍␊ |
798 | #ifdef PNG_READ_sRGB_SUPPORTED␍␊ |
799 | && !(info_ptr->valid & PNG_INFO_sRGB)␍␊ |
800 | #endif␍␊ |
801 | )␍␊ |
802 | {␍␊ |
803 | png_warning(png_ptr, "Duplicate gAMA chunk");␍␊ |
804 | png_crc_finish(png_ptr, length);␍␊ |
805 | return;␍␊ |
806 | }␍␊ |
807 | ␍␊ |
808 | if (length != 4)␍␊ |
809 | {␍␊ |
810 | png_warning(png_ptr, "Incorrect gAMA chunk length");␍␊ |
811 | png_crc_finish(png_ptr, length);␍␊ |
812 | return;␍␊ |
813 | }␍␊ |
814 | ␍␊ |
815 | png_crc_read(png_ptr, buf, 4);␍␊ |
816 | ␍␊ |
817 | if (png_crc_finish(png_ptr, 0))␍␊ |
818 | return;␍␊ |
819 | ␍␊ |
820 | igamma = png_get_fixed_point(NULL, buf);␍␊ |
821 | ␍␊ |
822 | /* Check for zero gamma or an error. */␍␊ |
823 | if (igamma <= 0)␍␊ |
824 | {␍␊ |
825 | png_warning(png_ptr,␍␊ |
826 | "Ignoring gAMA chunk with out of range gamma");␍␊ |
827 | ␍␊ |
828 | return;␍␊ |
829 | }␍␊ |
830 | ␍␊ |
831 | # ifdef PNG_READ_sRGB_SUPPORTED␍␊ |
832 | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))␍␊ |
833 | {␍␊ |
834 | if (PNG_OUT_OF_RANGE(igamma, 45500, 500))␍␊ |
835 | {␍␊ |
836 | PNG_WARNING_PARAMETERS(p)␍␊ |
837 | png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_fixed, igamma);␍␊ |
838 | png_formatted_warning(png_ptr, p,␍␊ |
839 | "Ignoring incorrect gAMA value @1 when sRGB is also present");␍␊ |
840 | return;␍␊ |
841 | }␍␊ |
842 | }␍␊ |
843 | # endif /* PNG_READ_sRGB_SUPPORTED */␍␊ |
844 | ␍␊ |
845 | # ifdef PNG_READ_GAMMA_SUPPORTED␍␊ |
846 | /* Gamma correction on read is supported. */␍␊ |
847 | png_ptr->gamma = igamma;␍␊ |
848 | # endif␍␊ |
849 | /* And set the 'info' structure members. */␍␊ |
850 | png_set_gAMA_fixed(png_ptr, info_ptr, igamma);␍␊ |
851 | }␍␊ |
852 | #endif␍␊ |
853 | ␍␊ |
854 | #ifdef PNG_READ_sBIT_SUPPORTED␍␊ |
855 | void /* PRIVATE */␍␊ |
856 | png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
857 | {␍␊ |
858 | png_size_t truelen;␍␊ |
859 | png_byte buf[4];␍␊ |
860 | ␍␊ |
861 | png_debug(1, "in png_handle_sBIT");␍␊ |
862 | ␍␊ |
863 | buf[0] = buf[1] = buf[2] = buf[3] = 0;␍␊ |
864 | ␍␊ |
865 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
866 | png_error(png_ptr, "Missing IHDR before sBIT");␍␊ |
867 | ␍␊ |
868 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
869 | {␍␊ |
870 | png_warning(png_ptr, "Invalid sBIT after IDAT");␍␊ |
871 | png_crc_finish(png_ptr, length);␍␊ |
872 | return;␍␊ |
873 | }␍␊ |
874 | ␍␊ |
875 | else if (png_ptr->mode & PNG_HAVE_PLTE)␍␊ |
876 | {␍␊ |
877 | /* Should be an error, but we can cope with it */␍␊ |
878 | png_warning(png_ptr, "Out of place sBIT chunk");␍␊ |
879 | }␍␊ |
880 | ␍␊ |
881 | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT))␍␊ |
882 | {␍␊ |
883 | png_warning(png_ptr, "Duplicate sBIT chunk");␍␊ |
884 | png_crc_finish(png_ptr, length);␍␊ |
885 | return;␍␊ |
886 | }␍␊ |
887 | ␍␊ |
888 | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)␍␊ |
889 | truelen = 3;␍␊ |
890 | ␍␊ |
891 | else␍␊ |
892 | truelen = (png_size_t)png_ptr->channels;␍␊ |
893 | ␍␊ |
894 | if (length != truelen || length > 4)␍␊ |
895 | {␍␊ |
896 | png_warning(png_ptr, "Incorrect sBIT chunk length");␍␊ |
897 | png_crc_finish(png_ptr, length);␍␊ |
898 | return;␍␊ |
899 | }␍␊ |
900 | ␍␊ |
901 | png_crc_read(png_ptr, buf, truelen);␍␊ |
902 | ␍␊ |
903 | if (png_crc_finish(png_ptr, 0))␍␊ |
904 | return;␍␊ |
905 | ␍␊ |
906 | if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)␍␊ |
907 | {␍␊ |
908 | png_ptr->sig_bit.red = buf[0];␍␊ |
909 | png_ptr->sig_bit.green = buf[1];␍␊ |
910 | png_ptr->sig_bit.blue = buf[2];␍␊ |
911 | png_ptr->sig_bit.alpha = buf[3];␍␊ |
912 | }␍␊ |
913 | ␍␊ |
914 | else␍␊ |
915 | {␍␊ |
916 | png_ptr->sig_bit.gray = buf[0];␍␊ |
917 | png_ptr->sig_bit.red = buf[0];␍␊ |
918 | png_ptr->sig_bit.green = buf[0];␍␊ |
919 | png_ptr->sig_bit.blue = buf[0];␍␊ |
920 | png_ptr->sig_bit.alpha = buf[1];␍␊ |
921 | }␍␊ |
922 | ␍␊ |
923 | png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));␍␊ |
924 | }␍␊ |
925 | #endif␍␊ |
926 | ␍␊ |
927 | #ifdef PNG_READ_cHRM_SUPPORTED␍␊ |
928 | void /* PRIVATE */␍␊ |
929 | png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
930 | {␍␊ |
931 | png_byte buf[32];␍␊ |
932 | png_fixed_point x_white, y_white, x_red, y_red, x_green, y_green, x_blue,␍␊ |
933 | y_blue;␍␊ |
934 | ␍␊ |
935 | png_debug(1, "in png_handle_cHRM");␍␊ |
936 | ␍␊ |
937 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
938 | png_error(png_ptr, "Missing IHDR before cHRM");␍␊ |
939 | ␍␊ |
940 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
941 | {␍␊ |
942 | png_warning(png_ptr, "Invalid cHRM after IDAT");␍␊ |
943 | png_crc_finish(png_ptr, length);␍␊ |
944 | return;␍␊ |
945 | }␍␊ |
946 | ␍␊ |
947 | else if (png_ptr->mode & PNG_HAVE_PLTE)␍␊ |
948 | /* Should be an error, but we can cope with it */␍␊ |
949 | png_warning(png_ptr, "Out of place cHRM chunk");␍␊ |
950 | ␍␊ |
951 | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM)␍␊ |
952 | # ifdef PNG_READ_sRGB_SUPPORTED␍␊ |
953 | && !(info_ptr->valid & PNG_INFO_sRGB)␍␊ |
954 | # endif␍␊ |
955 | )␍␊ |
956 | {␍␊ |
957 | png_warning(png_ptr, "Duplicate cHRM chunk");␍␊ |
958 | png_crc_finish(png_ptr, length);␍␊ |
959 | return;␍␊ |
960 | }␍␊ |
961 | ␍␊ |
962 | if (length != 32)␍␊ |
963 | {␍␊ |
964 | png_warning(png_ptr, "Incorrect cHRM chunk length");␍␊ |
965 | png_crc_finish(png_ptr, length);␍␊ |
966 | return;␍␊ |
967 | }␍␊ |
968 | ␍␊ |
969 | png_crc_read(png_ptr, buf, 32);␍␊ |
970 | ␍␊ |
971 | if (png_crc_finish(png_ptr, 0))␍␊ |
972 | return;␍␊ |
973 | ␍␊ |
974 | x_white = png_get_fixed_point(NULL, buf);␍␊ |
975 | y_white = png_get_fixed_point(NULL, buf + 4);␍␊ |
976 | x_red = png_get_fixed_point(NULL, buf + 8);␍␊ |
977 | y_red = png_get_fixed_point(NULL, buf + 12);␍␊ |
978 | x_green = png_get_fixed_point(NULL, buf + 16);␍␊ |
979 | y_green = png_get_fixed_point(NULL, buf + 20);␍␊ |
980 | x_blue = png_get_fixed_point(NULL, buf + 24);␍␊ |
981 | y_blue = png_get_fixed_point(NULL, buf + 28);␍␊ |
982 | ␍␊ |
983 | if (x_white == PNG_FIXED_ERROR ||␍␊ |
984 | y_white == PNG_FIXED_ERROR ||␍␊ |
985 | x_red == PNG_FIXED_ERROR ||␍␊ |
986 | y_red == PNG_FIXED_ERROR ||␍␊ |
987 | x_green == PNG_FIXED_ERROR ||␍␊ |
988 | y_green == PNG_FIXED_ERROR ||␍␊ |
989 | x_blue == PNG_FIXED_ERROR ||␍␊ |
990 | y_blue == PNG_FIXED_ERROR)␍␊ |
991 | {␍␊ |
992 | png_warning(png_ptr, "Ignoring cHRM chunk with negative chromaticities");␍␊ |
993 | return;␍␊ |
994 | }␍␊ |
995 | ␍␊ |
996 | #ifdef PNG_READ_sRGB_SUPPORTED␍␊ |
997 | if ((info_ptr != NULL) && (info_ptr->valid & PNG_INFO_sRGB))␍␊ |
998 | {␍␊ |
999 | if (PNG_OUT_OF_RANGE(x_white, 31270, 1000) ||␍␊ |
1000 | PNG_OUT_OF_RANGE(y_white, 32900, 1000) ||␍␊ |
1001 | PNG_OUT_OF_RANGE(x_red, 64000, 1000) ||␍␊ |
1002 | PNG_OUT_OF_RANGE(y_red, 33000, 1000) ||␍␊ |
1003 | PNG_OUT_OF_RANGE(x_green, 30000, 1000) ||␍␊ |
1004 | PNG_OUT_OF_RANGE(y_green, 60000, 1000) ||␍␊ |
1005 | PNG_OUT_OF_RANGE(x_blue, 15000, 1000) ||␍␊ |
1006 | PNG_OUT_OF_RANGE(y_blue, 6000, 1000))␍␊ |
1007 | {␍␊ |
1008 | PNG_WARNING_PARAMETERS(p)␍␊ |
1009 | ␍␊ |
1010 | png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_fixed, x_white);␍␊ |
1011 | png_warning_parameter_signed(p, 2, PNG_NUMBER_FORMAT_fixed, y_white);␍␊ |
1012 | png_warning_parameter_signed(p, 3, PNG_NUMBER_FORMAT_fixed, x_red);␍␊ |
1013 | png_warning_parameter_signed(p, 4, PNG_NUMBER_FORMAT_fixed, y_red);␍␊ |
1014 | png_warning_parameter_signed(p, 5, PNG_NUMBER_FORMAT_fixed, x_green);␍␊ |
1015 | png_warning_parameter_signed(p, 6, PNG_NUMBER_FORMAT_fixed, y_green);␍␊ |
1016 | png_warning_parameter_signed(p, 7, PNG_NUMBER_FORMAT_fixed, x_blue);␍␊ |
1017 | png_warning_parameter_signed(p, 8, PNG_NUMBER_FORMAT_fixed, y_blue);␍␊ |
1018 | ␍␊ |
1019 | png_formatted_warning(png_ptr, p,␍␊ |
1020 | "Ignoring incorrect cHRM white(@1,@2) r(@3,@4)g(@5,@6)b(@7,@8) "␍␊ |
1021 | "when sRGB is also present");␍␊ |
1022 | }␍␊ |
1023 | return;␍␊ |
1024 | }␍␊ |
1025 | #endif /* PNG_READ_sRGB_SUPPORTED */␍␊ |
1026 | ␍␊ |
1027 | #ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED␍␊ |
1028 | /* Store the _white values as default coefficients for the rgb to gray␍␊ |
1029 | * operation if it is supported. Check if the transform is already set to␍␊ |
1030 | * avoid destroying the transform values.␍␊ |
1031 | */␍␊ |
1032 | if (!png_ptr->rgb_to_gray_coefficients_set)␍␊ |
1033 | {␍␊ |
1034 | /* png_set_background has not been called and we haven't seen an sRGB␍␊ |
1035 | * chunk yet. Find the XYZ of the three end points.␍␊ |
1036 | */␍␊ |
1037 | png_XYZ XYZ;␍␊ |
1038 | png_xy xy;␍␊ |
1039 | ␍␊ |
1040 | xy.redx = x_red;␍␊ |
1041 | xy.redy = y_red;␍␊ |
1042 | xy.greenx = x_green;␍␊ |
1043 | xy.greeny = y_green;␍␊ |
1044 | xy.bluex = x_blue;␍␊ |
1045 | xy.bluey = y_blue;␍␊ |
1046 | xy.whitex = x_white;␍␊ |
1047 | xy.whitey = y_white;␍␊ |
1048 | ␍␊ |
1049 | if (png_XYZ_from_xy_checked(png_ptr, &XYZ, xy))␍␊ |
1050 | {␍␊ |
1051 | /* The success case, because XYZ_from_xy normalises to a reference␍␊ |
1052 | * white Y of 1.0 we just need to scale the numbers. This should␍␊ |
1053 | * always work just fine. It is an internal error if this overflows.␍␊ |
1054 | */␍␊ |
1055 | {␍␊ |
1056 | png_fixed_point r, g, b;␍␊ |
1057 | if (png_muldiv(&r, XYZ.redY, 32768, PNG_FP_1) &&␍␊ |
1058 | r >= 0 && r <= 32768 &&␍␊ |
1059 | png_muldiv(&g, XYZ.greenY, 32768, PNG_FP_1) &&␍␊ |
1060 | g >= 0 && g <= 32768 &&␍␊ |
1061 | png_muldiv(&b, XYZ.blueY, 32768, PNG_FP_1) &&␍␊ |
1062 | b >= 0 && b <= 32768 &&␍␊ |
1063 | r+g+b <= 32769)␍␊ |
1064 | {␍␊ |
1065 | /* We allow 0 coefficients here. r+g+b may be 32769 if two or␍␊ |
1066 | * all of the coefficients were rounded up. Handle this by␍␊ |
1067 | * reducing the *largest* coefficient by 1; this matches the␍␊ |
1068 | * approach used for the default coefficients in pngrtran.c␍␊ |
1069 | */␍␊ |
1070 | int add = 0;␍␊ |
1071 | ␍␊ |
1072 | if (r+g+b > 32768)␍␊ |
1073 | add = -1;␍␊ |
1074 | else if (r+g+b < 32768)␍␊ |
1075 | add = 1;␍␊ |
1076 | ␍␊ |
1077 | if (add != 0)␍␊ |
1078 | {␍␊ |
1079 | if (g >= r && g >= b)␍␊ |
1080 | g += add;␍␊ |
1081 | else if (r >= g && r >= b)␍␊ |
1082 | r += add;␍␊ |
1083 | else␍␊ |
1084 | b += add;␍␊ |
1085 | }␍␊ |
1086 | ␍␊ |
1087 | /* Check for an internal error. */␍␊ |
1088 | if (r+g+b != 32768)␍␊ |
1089 | png_error(png_ptr,␍␊ |
1090 | "internal error handling cHRM coefficients");␍␊ |
1091 | ␍␊ |
1092 | png_ptr->rgb_to_gray_red_coeff = (png_uint_16)r;␍␊ |
1093 | png_ptr->rgb_to_gray_green_coeff = (png_uint_16)g;␍␊ |
1094 | }␍␊ |
1095 | ␍␊ |
1096 | /* This is a png_error at present even though it could be ignored -␍␊ |
1097 | * it should never happen, but it is important that if it does, the␍␊ |
1098 | * bug is fixed.␍␊ |
1099 | */␍␊ |
1100 | else␍␊ |
1101 | png_error(png_ptr, "internal error handling cHRM->XYZ");␍␊ |
1102 | }␍␊ |
1103 | }␍␊ |
1104 | }␍␊ |
1105 | #endif␍␊ |
1106 | ␍␊ |
1107 | png_set_cHRM_fixed(png_ptr, info_ptr, x_white, y_white, x_red, y_red,␍␊ |
1108 | x_green, y_green, x_blue, y_blue);␍␊ |
1109 | }␍␊ |
1110 | #endif␍␊ |
1111 | ␍␊ |
1112 | #ifdef PNG_READ_sRGB_SUPPORTED␍␊ |
1113 | void /* PRIVATE */␍␊ |
1114 | png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
1115 | {␍␊ |
1116 | int intent;␍␊ |
1117 | png_byte buf[1];␍␊ |
1118 | ␍␊ |
1119 | png_debug(1, "in png_handle_sRGB");␍␊ |
1120 | ␍␊ |
1121 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
1122 | png_error(png_ptr, "Missing IHDR before sRGB");␍␊ |
1123 | ␍␊ |
1124 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
1125 | {␍␊ |
1126 | png_warning(png_ptr, "Invalid sRGB after IDAT");␍␊ |
1127 | png_crc_finish(png_ptr, length);␍␊ |
1128 | return;␍␊ |
1129 | }␍␊ |
1130 | ␍␊ |
1131 | else if (png_ptr->mode & PNG_HAVE_PLTE)␍␊ |
1132 | /* Should be an error, but we can cope with it */␍␊ |
1133 | png_warning(png_ptr, "Out of place sRGB chunk");␍␊ |
1134 | ␍␊ |
1135 | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))␍␊ |
1136 | {␍␊ |
1137 | png_warning(png_ptr, "Duplicate sRGB chunk");␍␊ |
1138 | png_crc_finish(png_ptr, length);␍␊ |
1139 | return;␍␊ |
1140 | }␍␊ |
1141 | ␍␊ |
1142 | if (length != 1)␍␊ |
1143 | {␍␊ |
1144 | png_warning(png_ptr, "Incorrect sRGB chunk length");␍␊ |
1145 | png_crc_finish(png_ptr, length);␍␊ |
1146 | return;␍␊ |
1147 | }␍␊ |
1148 | ␍␊ |
1149 | png_crc_read(png_ptr, buf, 1);␍␊ |
1150 | ␍␊ |
1151 | if (png_crc_finish(png_ptr, 0))␍␊ |
1152 | return;␍␊ |
1153 | ␍␊ |
1154 | intent = buf[0];␍␊ |
1155 | ␍␊ |
1156 | /* Check for bad intent */␍␊ |
1157 | if (intent >= PNG_sRGB_INTENT_LAST)␍␊ |
1158 | {␍␊ |
1159 | png_warning(png_ptr, "Unknown sRGB intent");␍␊ |
1160 | return;␍␊ |
1161 | }␍␊ |
1162 | ␍␊ |
1163 | #if defined(PNG_READ_gAMA_SUPPORTED) && defined(PNG_READ_GAMMA_SUPPORTED)␍␊ |
1164 | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA))␍␊ |
1165 | {␍␊ |
1166 | if (PNG_OUT_OF_RANGE(info_ptr->gamma, 45500, 500))␍␊ |
1167 | {␍␊ |
1168 | PNG_WARNING_PARAMETERS(p)␍␊ |
1169 | ␍␊ |
1170 | png_warning_parameter_signed(p, 1, PNG_NUMBER_FORMAT_fixed,␍␊ |
1171 | info_ptr->gamma);␍␊ |
1172 | ␍␊ |
1173 | png_formatted_warning(png_ptr, p,␍␊ |
1174 | "Ignoring incorrect gAMA value @1 when sRGB is also present");␍␊ |
1175 | }␍␊ |
1176 | }␍␊ |
1177 | #endif /* PNG_READ_gAMA_SUPPORTED */␍␊ |
1178 | ␍␊ |
1179 | #ifdef PNG_READ_cHRM_SUPPORTED␍␊ |
1180 | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM))␍␊ |
1181 | if (PNG_OUT_OF_RANGE(info_ptr->x_white, 31270, 1000) ||␍␊ |
1182 | PNG_OUT_OF_RANGE(info_ptr->y_white, 32900, 1000) ||␍␊ |
1183 | PNG_OUT_OF_RANGE(info_ptr->x_red, 64000, 1000) ||␍␊ |
1184 | PNG_OUT_OF_RANGE(info_ptr->y_red, 33000, 1000) ||␍␊ |
1185 | PNG_OUT_OF_RANGE(info_ptr->x_green, 30000, 1000) ||␍␊ |
1186 | PNG_OUT_OF_RANGE(info_ptr->y_green, 60000, 1000) ||␍␊ |
1187 | PNG_OUT_OF_RANGE(info_ptr->x_blue, 15000, 1000) ||␍␊ |
1188 | PNG_OUT_OF_RANGE(info_ptr->y_blue, 6000, 1000))␍␊ |
1189 | {␍␊ |
1190 | png_warning(png_ptr,␍␊ |
1191 | "Ignoring incorrect cHRM value when sRGB is also present");␍␊ |
1192 | }␍␊ |
1193 | #endif /* PNG_READ_cHRM_SUPPORTED */␍␊ |
1194 | ␍␊ |
1195 | /* This is recorded for use when handling the cHRM chunk above. An sRGB␍␊ |
1196 | * chunk unconditionally overwrites the coefficients for grayscale conversion␍␊ |
1197 | * too.␍␊ |
1198 | */␍␊ |
1199 | png_ptr->is_sRGB = 1;␍␊ |
1200 | ␍␊ |
1201 | # ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED␍␊ |
1202 | /* Don't overwrite user supplied values: */␍␊ |
1203 | if (!png_ptr->rgb_to_gray_coefficients_set)␍␊ |
1204 | {␍␊ |
1205 | /* These numbers come from the sRGB specification (or, since one has to␍␊ |
1206 | * pay much money to get a copy, the wikipedia sRGB page) the␍␊ |
1207 | * chromaticity values quoted have been inverted to get the reverse␍␊ |
1208 | * transformation from RGB to XYZ and the 'Y' coefficients scaled by␍␊ |
1209 | * 32768 (then rounded).␍␊ |
1210 | *␍␊ |
1211 | * sRGB and ITU Rec-709 both truncate the values for the D65 white␍␊ |
1212 | * point to four digits and, even though it actually stores five␍␊ |
1213 | * digits, the PNG spec gives the truncated value.␍␊ |
1214 | *␍␊ |
1215 | * This means that when the chromaticities are converted back to XYZ␍␊ |
1216 | * end points we end up with (6968,23435,2366), which, as described in␍␊ |
1217 | * pngrtran.c, would overflow. If the five digit precision and up is␍␊ |
1218 | * used we get, instead:␍␊ |
1219 | *␍␊ |
1220 | * 6968*R + 23435*G + 2365*B␍␊ |
1221 | *␍␊ |
1222 | * (Notice that this rounds the blue coefficient down, rather than the␍␊ |
1223 | * choice used in pngrtran.c which is to round the green one down.)␍␊ |
1224 | */␍␊ |
1225 | png_ptr->rgb_to_gray_red_coeff = 6968; /* 0.212639005871510 */␍␊ |
1226 | png_ptr->rgb_to_gray_green_coeff = 23434; /* 0.715168678767756 */␍␊ |
1227 | /* png_ptr->rgb_to_gray_blue_coeff = 2366; 0.072192315360734␉*/␍␊ |
1228 | ␍␊ |
1229 | /* The following keeps the cHRM chunk from destroying the␍␊ |
1230 | * coefficients again in the event that it follows the sRGB chunk.␍␊ |
1231 | */␍␊ |
1232 | png_ptr->rgb_to_gray_coefficients_set = 1;␍␊ |
1233 | }␍␊ |
1234 | # endif␍␊ |
1235 | ␍␊ |
1236 | png_set_sRGB_gAMA_and_cHRM(png_ptr, info_ptr, intent);␍␊ |
1237 | }␍␊ |
1238 | #endif /* PNG_READ_sRGB_SUPPORTED */␍␊ |
1239 | ␍␊ |
1240 | #ifdef PNG_READ_iCCP_SUPPORTED␍␊ |
1241 | void /* PRIVATE */␍␊ |
1242 | png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
1243 | /* Note: this does not properly handle chunks that are > 64K under DOS */␍␊ |
1244 | {␍␊ |
1245 | png_byte compression_type;␍␊ |
1246 | png_bytep pC;␍␊ |
1247 | png_charp profile;␍␊ |
1248 | png_uint_32 skip = 0;␍␊ |
1249 | png_uint_32 profile_size;␍␊ |
1250 | png_alloc_size_t profile_length;␍␊ |
1251 | png_size_t slength, prefix_length, data_length;␍␊ |
1252 | ␍␊ |
1253 | png_debug(1, "in png_handle_iCCP");␍␊ |
1254 | ␍␊ |
1255 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
1256 | png_error(png_ptr, "Missing IHDR before iCCP");␍␊ |
1257 | ␍␊ |
1258 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
1259 | {␍␊ |
1260 | png_warning(png_ptr, "Invalid iCCP after IDAT");␍␊ |
1261 | png_crc_finish(png_ptr, length);␍␊ |
1262 | return;␍␊ |
1263 | }␍␊ |
1264 | ␍␊ |
1265 | else if (png_ptr->mode & PNG_HAVE_PLTE)␍␊ |
1266 | /* Should be an error, but we can cope with it */␍␊ |
1267 | png_warning(png_ptr, "Out of place iCCP chunk");␍␊ |
1268 | ␍␊ |
1269 | if ((png_ptr->mode & PNG_HAVE_iCCP) || (info_ptr != NULL &&␍␊ |
1270 | (info_ptr->valid & (PNG_INFO_iCCP|PNG_INFO_sRGB))))␍␊ |
1271 | {␍␊ |
1272 | png_warning(png_ptr, "Duplicate iCCP chunk");␍␊ |
1273 | png_crc_finish(png_ptr, length);␍␊ |
1274 | return;␍␊ |
1275 | }␍␊ |
1276 | ␍␊ |
1277 | png_ptr->mode |= PNG_HAVE_iCCP;␍␊ |
1278 | ␍␊ |
1279 | #ifdef PNG_MAX_MALLOC_64K␍␊ |
1280 | if (length > (png_uint_32)65535L)␍␊ |
1281 | {␍␊ |
1282 | png_warning(png_ptr, "iCCP chunk too large to fit in memory");␍␊ |
1283 | skip = length - (png_uint_32)65535L;␍␊ |
1284 | length = (png_uint_32)65535L;␍␊ |
1285 | }␍␊ |
1286 | #endif␍␊ |
1287 | ␍␊ |
1288 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1289 | png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);␍␊ |
1290 | slength = length;␍␊ |
1291 | png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);␍␊ |
1292 | ␍␊ |
1293 | if (png_crc_finish(png_ptr, skip))␍␊ |
1294 | {␍␊ |
1295 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1296 | png_ptr->chunkdata = NULL;␍␊ |
1297 | return;␍␊ |
1298 | }␍␊ |
1299 | ␍␊ |
1300 | png_ptr->chunkdata[slength] = 0x00;␍␊ |
1301 | ␍␊ |
1302 | for (profile = png_ptr->chunkdata; *profile; profile++)␍␊ |
1303 | /* Empty loop to find end of name */ ;␍␊ |
1304 | ␍␊ |
1305 | ++profile;␍␊ |
1306 | ␍␊ |
1307 | /* There should be at least one zero (the compression type byte)␍␊ |
1308 | * following the separator, and we should be on it␍␊ |
1309 | */␍␊ |
1310 | if (profile >= png_ptr->chunkdata + slength - 1)␍␊ |
1311 | {␍␊ |
1312 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1313 | png_ptr->chunkdata = NULL;␍␊ |
1314 | png_warning(png_ptr, "Malformed iCCP chunk");␍␊ |
1315 | return;␍␊ |
1316 | }␍␊ |
1317 | ␍␊ |
1318 | /* Compression_type should always be zero */␍␊ |
1319 | compression_type = *profile++;␍␊ |
1320 | ␍␊ |
1321 | if (compression_type)␍␊ |
1322 | {␍␊ |
1323 | png_warning(png_ptr, "Ignoring nonzero compression type in iCCP chunk");␍␊ |
1324 | compression_type = 0x00; /* Reset it to zero (libpng-1.0.6 through 1.0.8␍␊ |
1325 | wrote nonzero) */␍␊ |
1326 | }␍␊ |
1327 | ␍␊ |
1328 | prefix_length = profile - png_ptr->chunkdata;␍␊ |
1329 | png_decompress_chunk(png_ptr, compression_type,␍␊ |
1330 | slength, prefix_length, &data_length);␍␊ |
1331 | ␍␊ |
1332 | profile_length = data_length - prefix_length;␍␊ |
1333 | ␍␊ |
1334 | if (prefix_length > data_length || profile_length < 4)␍␊ |
1335 | {␍␊ |
1336 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1337 | png_ptr->chunkdata = NULL;␍␊ |
1338 | png_warning(png_ptr, "Profile size field missing from iCCP chunk");␍␊ |
1339 | return;␍␊ |
1340 | }␍␊ |
1341 | ␍␊ |
1342 | /* Check the profile_size recorded in the first 32 bits of the ICC profile */␍␊ |
1343 | pC = (png_bytep)(png_ptr->chunkdata + prefix_length);␍␊ |
1344 | profile_size = ((*(pC )) << 24) |␍␊ |
1345 | ((*(pC + 1)) << 16) |␍␊ |
1346 | ((*(pC + 2)) << 8) |␍␊ |
1347 | ((*(pC + 3)) );␍␊ |
1348 | ␍␊ |
1349 | /* NOTE: the following guarantees that 'profile_length' fits into 32 bits,␍␊ |
1350 | * because profile_size is a 32 bit value.␍␊ |
1351 | */␍␊ |
1352 | if (profile_size < profile_length)␍␊ |
1353 | profile_length = profile_size;␍␊ |
1354 | ␍␊ |
1355 | /* And the following guarantees that profile_size == profile_length. */␍␊ |
1356 | if (profile_size > profile_length)␍␊ |
1357 | {␍␊ |
1358 | PNG_WARNING_PARAMETERS(p)␍␊ |
1359 | ␍␊ |
1360 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1361 | png_ptr->chunkdata = NULL;␍␊ |
1362 | ␍␊ |
1363 | png_warning_parameter_unsigned(p, 1, PNG_NUMBER_FORMAT_u, profile_size);␍␊ |
1364 | png_warning_parameter_unsigned(p, 2, PNG_NUMBER_FORMAT_u, profile_length);␍␊ |
1365 | png_formatted_warning(png_ptr, p,␍␊ |
1366 | "Ignoring iCCP chunk with declared size = @1 and actual length = @2");␍␊ |
1367 | return;␍␊ |
1368 | }␍␊ |
1369 | ␍␊ |
1370 | png_set_iCCP(png_ptr, info_ptr, png_ptr->chunkdata,␍␊ |
1371 | compression_type, (png_bytep)png_ptr->chunkdata + prefix_length,␍␊ |
1372 | profile_size);␍␊ |
1373 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1374 | png_ptr->chunkdata = NULL;␍␊ |
1375 | }␍␊ |
1376 | #endif /* PNG_READ_iCCP_SUPPORTED */␍␊ |
1377 | ␍␊ |
1378 | #ifdef PNG_READ_sPLT_SUPPORTED␍␊ |
1379 | void /* PRIVATE */␍␊ |
1380 | png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
1381 | /* Note: this does not properly handle chunks that are > 64K under DOS */␍␊ |
1382 | {␍␊ |
1383 | png_bytep entry_start;␍␊ |
1384 | png_sPLT_t new_palette;␍␊ |
1385 | png_sPLT_entryp pp;␍␊ |
1386 | png_uint_32 data_length;␍␊ |
1387 | int entry_size, i;␍␊ |
1388 | png_uint_32 skip = 0;␍␊ |
1389 | png_size_t slength;␍␊ |
1390 | png_uint_32 dl;␍␊ |
1391 | png_size_t max_dl;␍␊ |
1392 | ␍␊ |
1393 | png_debug(1, "in png_handle_sPLT");␍␊ |
1394 | ␍␊ |
1395 | #ifdef PNG_USER_LIMITS_SUPPORTED␍␊ |
1396 | ␍␊ |
1397 | if (png_ptr->user_chunk_cache_max != 0)␍␊ |
1398 | {␍␊ |
1399 | if (png_ptr->user_chunk_cache_max == 1)␍␊ |
1400 | {␍␊ |
1401 | png_crc_finish(png_ptr, length);␍␊ |
1402 | return;␍␊ |
1403 | }␍␊ |
1404 | ␍␊ |
1405 | if (--png_ptr->user_chunk_cache_max == 1)␍␊ |
1406 | {␍␊ |
1407 | png_warning(png_ptr, "No space in chunk cache for sPLT");␍␊ |
1408 | png_crc_finish(png_ptr, length);␍␊ |
1409 | return;␍␊ |
1410 | }␍␊ |
1411 | }␍␊ |
1412 | #endif␍␊ |
1413 | ␍␊ |
1414 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
1415 | png_error(png_ptr, "Missing IHDR before sPLT");␍␊ |
1416 | ␍␊ |
1417 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
1418 | {␍␊ |
1419 | png_warning(png_ptr, "Invalid sPLT after IDAT");␍␊ |
1420 | png_crc_finish(png_ptr, length);␍␊ |
1421 | return;␍␊ |
1422 | }␍␊ |
1423 | ␍␊ |
1424 | #ifdef PNG_MAX_MALLOC_64K␍␊ |
1425 | if (length > (png_uint_32)65535L)␍␊ |
1426 | {␍␊ |
1427 | png_warning(png_ptr, "sPLT chunk too large to fit in memory");␍␊ |
1428 | skip = length - (png_uint_32)65535L;␍␊ |
1429 | length = (png_uint_32)65535L;␍␊ |
1430 | }␍␊ |
1431 | #endif␍␊ |
1432 | ␍␊ |
1433 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1434 | png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);␍␊ |
1435 | ␍␊ |
1436 | /* WARNING: this may break if size_t is less than 32 bits; it is assumed␍␊ |
1437 | * that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a␍␊ |
1438 | * potential breakage point if the types in pngconf.h aren't exactly right.␍␊ |
1439 | */␍␊ |
1440 | slength = length;␍␊ |
1441 | png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);␍␊ |
1442 | ␍␊ |
1443 | if (png_crc_finish(png_ptr, skip))␍␊ |
1444 | {␍␊ |
1445 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1446 | png_ptr->chunkdata = NULL;␍␊ |
1447 | return;␍␊ |
1448 | }␍␊ |
1449 | ␍␊ |
1450 | png_ptr->chunkdata[slength] = 0x00;␍␊ |
1451 | ␍␊ |
1452 | for (entry_start = (png_bytep)png_ptr->chunkdata; *entry_start;␍␊ |
1453 | entry_start++)␍␊ |
1454 | /* Empty loop to find end of name */ ;␍␊ |
1455 | ␍␊ |
1456 | ++entry_start;␍␊ |
1457 | ␍␊ |
1458 | /* A sample depth should follow the separator, and we should be on it */␍␊ |
1459 | if (entry_start > (png_bytep)png_ptr->chunkdata + slength - 2)␍␊ |
1460 | {␍␊ |
1461 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1462 | png_ptr->chunkdata = NULL;␍␊ |
1463 | png_warning(png_ptr, "malformed sPLT chunk");␍␊ |
1464 | return;␍␊ |
1465 | }␍␊ |
1466 | ␍␊ |
1467 | new_palette.depth = *entry_start++;␍␊ |
1468 | entry_size = (new_palette.depth == 8 ? 6 : 10);␍␊ |
1469 | /* This must fit in a png_uint_32 because it is derived from the original␍␊ |
1470 | * chunk data length (and use 'length', not 'slength' here for clarity -␍␊ |
1471 | * they are guaranteed to be the same, see the tests above.)␍␊ |
1472 | */␍␊ |
1473 | data_length = length - (png_uint_32)(entry_start -␍␊ |
1474 | (png_bytep)png_ptr->chunkdata);␍␊ |
1475 | ␍␊ |
1476 | /* Integrity-check the data length */␍␊ |
1477 | if (data_length % entry_size)␍␊ |
1478 | {␍␊ |
1479 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1480 | png_ptr->chunkdata = NULL;␍␊ |
1481 | png_warning(png_ptr, "sPLT chunk has bad length");␍␊ |
1482 | return;␍␊ |
1483 | }␍␊ |
1484 | ␍␊ |
1485 | dl = (png_int_32)(data_length / entry_size);␍␊ |
1486 | max_dl = PNG_SIZE_MAX / png_sizeof(png_sPLT_entry);␍␊ |
1487 | ␍␊ |
1488 | if (dl > max_dl)␍␊ |
1489 | {␍␊ |
1490 | png_warning(png_ptr, "sPLT chunk too long");␍␊ |
1491 | return;␍␊ |
1492 | }␍␊ |
1493 | ␍␊ |
1494 | new_palette.nentries = (png_int_32)(data_length / entry_size);␍␊ |
1495 | ␍␊ |
1496 | new_palette.entries = (png_sPLT_entryp)png_malloc_warn(␍␊ |
1497 | png_ptr, new_palette.nentries * png_sizeof(png_sPLT_entry));␍␊ |
1498 | ␍␊ |
1499 | if (new_palette.entries == NULL)␍␊ |
1500 | {␍␊ |
1501 | png_warning(png_ptr, "sPLT chunk requires too much memory");␍␊ |
1502 | return;␍␊ |
1503 | }␍␊ |
1504 | ␍␊ |
1505 | #ifdef PNG_POINTER_INDEXING_SUPPORTED␍␊ |
1506 | for (i = 0; i < new_palette.nentries; i++)␍␊ |
1507 | {␍␊ |
1508 | pp = new_palette.entries + i;␍␊ |
1509 | ␍␊ |
1510 | if (new_palette.depth == 8)␍␊ |
1511 | {␍␊ |
1512 | pp->red = *entry_start++;␍␊ |
1513 | pp->green = *entry_start++;␍␊ |
1514 | pp->blue = *entry_start++;␍␊ |
1515 | pp->alpha = *entry_start++;␍␊ |
1516 | }␍␊ |
1517 | ␍␊ |
1518 | else␍␊ |
1519 | {␍␊ |
1520 | pp->red = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1521 | pp->green = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1522 | pp->blue = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1523 | pp->alpha = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1524 | }␍␊ |
1525 | ␍␊ |
1526 | pp->frequency = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1527 | }␍␊ |
1528 | #else␍␊ |
1529 | pp = new_palette.entries;␍␊ |
1530 | ␍␊ |
1531 | for (i = 0; i < new_palette.nentries; i++)␍␊ |
1532 | {␍␊ |
1533 | ␍␊ |
1534 | if (new_palette.depth == 8)␍␊ |
1535 | {␍␊ |
1536 | pp[i].red = *entry_start++;␍␊ |
1537 | pp[i].green = *entry_start++;␍␊ |
1538 | pp[i].blue = *entry_start++;␍␊ |
1539 | pp[i].alpha = *entry_start++;␍␊ |
1540 | }␍␊ |
1541 | ␍␊ |
1542 | else␍␊ |
1543 | {␍␊ |
1544 | pp[i].red = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1545 | pp[i].green = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1546 | pp[i].blue = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1547 | pp[i].alpha = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1548 | }␍␊ |
1549 | ␍␊ |
1550 | pp[i].frequency = png_get_uint_16(entry_start); entry_start += 2;␍␊ |
1551 | }␍␊ |
1552 | #endif␍␊ |
1553 | ␍␊ |
1554 | /* Discard all chunk data except the name and stash that */␍␊ |
1555 | new_palette.name = png_ptr->chunkdata;␍␊ |
1556 | ␍␊ |
1557 | png_set_sPLT(png_ptr, info_ptr, &new_palette, 1);␍␊ |
1558 | ␍␊ |
1559 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1560 | png_ptr->chunkdata = NULL;␍␊ |
1561 | png_free(png_ptr, new_palette.entries);␍␊ |
1562 | }␍␊ |
1563 | #endif /* PNG_READ_sPLT_SUPPORTED */␍␊ |
1564 | ␍␊ |
1565 | #ifdef PNG_READ_tRNS_SUPPORTED␍␊ |
1566 | void /* PRIVATE */␍␊ |
1567 | png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
1568 | {␍␊ |
1569 | png_byte readbuf[PNG_MAX_PALETTE_LENGTH];␍␊ |
1570 | ␍␊ |
1571 | png_debug(1, "in png_handle_tRNS");␍␊ |
1572 | ␍␊ |
1573 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
1574 | png_error(png_ptr, "Missing IHDR before tRNS");␍␊ |
1575 | ␍␊ |
1576 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
1577 | {␍␊ |
1578 | png_warning(png_ptr, "Invalid tRNS after IDAT");␍␊ |
1579 | png_crc_finish(png_ptr, length);␍␊ |
1580 | return;␍␊ |
1581 | }␍␊ |
1582 | ␍␊ |
1583 | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))␍␊ |
1584 | {␍␊ |
1585 | png_warning(png_ptr, "Duplicate tRNS chunk");␍␊ |
1586 | png_crc_finish(png_ptr, length);␍␊ |
1587 | return;␍␊ |
1588 | }␍␊ |
1589 | ␍␊ |
1590 | if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)␍␊ |
1591 | {␍␊ |
1592 | png_byte buf[2];␍␊ |
1593 | ␍␊ |
1594 | if (length != 2)␍␊ |
1595 | {␍␊ |
1596 | png_warning(png_ptr, "Incorrect tRNS chunk length");␍␊ |
1597 | png_crc_finish(png_ptr, length);␍␊ |
1598 | return;␍␊ |
1599 | }␍␊ |
1600 | ␍␊ |
1601 | png_crc_read(png_ptr, buf, 2);␍␊ |
1602 | png_ptr->num_trans = 1;␍␊ |
1603 | png_ptr->trans_color.gray = png_get_uint_16(buf);␍␊ |
1604 | }␍␊ |
1605 | ␍␊ |
1606 | else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)␍␊ |
1607 | {␍␊ |
1608 | png_byte buf[6];␍␊ |
1609 | ␍␊ |
1610 | if (length != 6)␍␊ |
1611 | {␍␊ |
1612 | png_warning(png_ptr, "Incorrect tRNS chunk length");␍␊ |
1613 | png_crc_finish(png_ptr, length);␍␊ |
1614 | return;␍␊ |
1615 | }␍␊ |
1616 | ␍␊ |
1617 | png_crc_read(png_ptr, buf, (png_size_t)length);␍␊ |
1618 | png_ptr->num_trans = 1;␍␊ |
1619 | png_ptr->trans_color.red = png_get_uint_16(buf);␍␊ |
1620 | png_ptr->trans_color.green = png_get_uint_16(buf + 2);␍␊ |
1621 | png_ptr->trans_color.blue = png_get_uint_16(buf + 4);␍␊ |
1622 | }␍␊ |
1623 | ␍␊ |
1624 | else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)␍␊ |
1625 | {␍␊ |
1626 | if (!(png_ptr->mode & PNG_HAVE_PLTE))␍␊ |
1627 | {␍␊ |
1628 | /* Should be an error, but we can cope with it. */␍␊ |
1629 | png_warning(png_ptr, "Missing PLTE before tRNS");␍␊ |
1630 | }␍␊ |
1631 | ␍␊ |
1632 | if (length > (png_uint_32)png_ptr->num_palette ||␍␊ |
1633 | length > PNG_MAX_PALETTE_LENGTH)␍␊ |
1634 | {␍␊ |
1635 | png_warning(png_ptr, "Incorrect tRNS chunk length");␍␊ |
1636 | png_crc_finish(png_ptr, length);␍␊ |
1637 | return;␍␊ |
1638 | }␍␊ |
1639 | ␍␊ |
1640 | if (length == 0)␍␊ |
1641 | {␍␊ |
1642 | png_warning(png_ptr, "Zero length tRNS chunk");␍␊ |
1643 | png_crc_finish(png_ptr, length);␍␊ |
1644 | return;␍␊ |
1645 | }␍␊ |
1646 | ␍␊ |
1647 | png_crc_read(png_ptr, readbuf, (png_size_t)length);␍␊ |
1648 | png_ptr->num_trans = (png_uint_16)length;␍␊ |
1649 | }␍␊ |
1650 | ␍␊ |
1651 | else␍␊ |
1652 | {␍␊ |
1653 | png_warning(png_ptr, "tRNS chunk not allowed with alpha channel");␍␊ |
1654 | png_crc_finish(png_ptr, length);␍␊ |
1655 | return;␍␊ |
1656 | }␍␊ |
1657 | ␍␊ |
1658 | if (png_crc_finish(png_ptr, 0))␍␊ |
1659 | {␍␊ |
1660 | png_ptr->num_trans = 0;␍␊ |
1661 | return;␍␊ |
1662 | }␍␊ |
1663 | ␍␊ |
1664 | png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,␍␊ |
1665 | &(png_ptr->trans_color));␍␊ |
1666 | }␍␊ |
1667 | #endif␍␊ |
1668 | ␍␊ |
1669 | #ifdef PNG_READ_bKGD_SUPPORTED␍␊ |
1670 | void /* PRIVATE */␍␊ |
1671 | png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
1672 | {␍␊ |
1673 | png_size_t truelen;␍␊ |
1674 | png_byte buf[6];␍␊ |
1675 | png_color_16 background;␍␊ |
1676 | ␍␊ |
1677 | png_debug(1, "in png_handle_bKGD");␍␊ |
1678 | ␍␊ |
1679 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
1680 | png_error(png_ptr, "Missing IHDR before bKGD");␍␊ |
1681 | ␍␊ |
1682 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
1683 | {␍␊ |
1684 | png_warning(png_ptr, "Invalid bKGD after IDAT");␍␊ |
1685 | png_crc_finish(png_ptr, length);␍␊ |
1686 | return;␍␊ |
1687 | }␍␊ |
1688 | ␍␊ |
1689 | else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&␍␊ |
1690 | !(png_ptr->mode & PNG_HAVE_PLTE))␍␊ |
1691 | {␍␊ |
1692 | png_warning(png_ptr, "Missing PLTE before bKGD");␍␊ |
1693 | png_crc_finish(png_ptr, length);␍␊ |
1694 | return;␍␊ |
1695 | }␍␊ |
1696 | ␍␊ |
1697 | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD))␍␊ |
1698 | {␍␊ |
1699 | png_warning(png_ptr, "Duplicate bKGD chunk");␍␊ |
1700 | png_crc_finish(png_ptr, length);␍␊ |
1701 | return;␍␊ |
1702 | }␍␊ |
1703 | ␍␊ |
1704 | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)␍␊ |
1705 | truelen = 1;␍␊ |
1706 | ␍␊ |
1707 | else if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)␍␊ |
1708 | truelen = 6;␍␊ |
1709 | ␍␊ |
1710 | else␍␊ |
1711 | truelen = 2;␍␊ |
1712 | ␍␊ |
1713 | if (length != truelen)␍␊ |
1714 | {␍␊ |
1715 | png_warning(png_ptr, "Incorrect bKGD chunk length");␍␊ |
1716 | png_crc_finish(png_ptr, length);␍␊ |
1717 | return;␍␊ |
1718 | }␍␊ |
1719 | ␍␊ |
1720 | png_crc_read(png_ptr, buf, truelen);␍␊ |
1721 | ␍␊ |
1722 | if (png_crc_finish(png_ptr, 0))␍␊ |
1723 | return;␍␊ |
1724 | ␍␊ |
1725 | /* We convert the index value into RGB components so that we can allow␍␊ |
1726 | * arbitrary RGB values for background when we have transparency, and␍␊ |
1727 | * so it is easy to determine the RGB values of the background color␍␊ |
1728 | * from the info_ptr struct.␍␊ |
1729 | */␍␊ |
1730 | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)␍␊ |
1731 | {␍␊ |
1732 | background.index = buf[0];␍␊ |
1733 | ␍␊ |
1734 | if (info_ptr && info_ptr->num_palette)␍␊ |
1735 | {␍␊ |
1736 | if (buf[0] >= info_ptr->num_palette)␍␊ |
1737 | {␍␊ |
1738 | png_warning(png_ptr, "Incorrect bKGD chunk index value");␍␊ |
1739 | return;␍␊ |
1740 | }␍␊ |
1741 | ␍␊ |
1742 | background.red = (png_uint_16)png_ptr->palette[buf[0]].red;␍␊ |
1743 | background.green = (png_uint_16)png_ptr->palette[buf[0]].green;␍␊ |
1744 | background.blue = (png_uint_16)png_ptr->palette[buf[0]].blue;␍␊ |
1745 | }␍␊ |
1746 | ␍␊ |
1747 | else␍␊ |
1748 | background.red = background.green = background.blue = 0;␍␊ |
1749 | ␍␊ |
1750 | background.gray = 0;␍␊ |
1751 | }␍␊ |
1752 | ␍␊ |
1753 | else if (!(png_ptr->color_type & PNG_COLOR_MASK_COLOR)) /* GRAY */␍␊ |
1754 | {␍␊ |
1755 | background.index = 0;␍␊ |
1756 | background.red =␍␊ |
1757 | background.green =␍␊ |
1758 | background.blue =␍␊ |
1759 | background.gray = png_get_uint_16(buf);␍␊ |
1760 | }␍␊ |
1761 | ␍␊ |
1762 | else␍␊ |
1763 | {␍␊ |
1764 | background.index = 0;␍␊ |
1765 | background.red = png_get_uint_16(buf);␍␊ |
1766 | background.green = png_get_uint_16(buf + 2);␍␊ |
1767 | background.blue = png_get_uint_16(buf + 4);␍␊ |
1768 | background.gray = 0;␍␊ |
1769 | }␍␊ |
1770 | ␍␊ |
1771 | png_set_bKGD(png_ptr, info_ptr, &background);␍␊ |
1772 | }␍␊ |
1773 | #endif␍␊ |
1774 | ␍␊ |
1775 | #ifdef PNG_READ_hIST_SUPPORTED␍␊ |
1776 | void /* PRIVATE */␍␊ |
1777 | png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
1778 | {␍␊ |
1779 | unsigned int num, i;␍␊ |
1780 | png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];␍␊ |
1781 | ␍␊ |
1782 | png_debug(1, "in png_handle_hIST");␍␊ |
1783 | ␍␊ |
1784 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
1785 | png_error(png_ptr, "Missing IHDR before hIST");␍␊ |
1786 | ␍␊ |
1787 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
1788 | {␍␊ |
1789 | png_warning(png_ptr, "Invalid hIST after IDAT");␍␊ |
1790 | png_crc_finish(png_ptr, length);␍␊ |
1791 | return;␍␊ |
1792 | }␍␊ |
1793 | ␍␊ |
1794 | else if (!(png_ptr->mode & PNG_HAVE_PLTE))␍␊ |
1795 | {␍␊ |
1796 | png_warning(png_ptr, "Missing PLTE before hIST");␍␊ |
1797 | png_crc_finish(png_ptr, length);␍␊ |
1798 | return;␍␊ |
1799 | }␍␊ |
1800 | ␍␊ |
1801 | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST))␍␊ |
1802 | {␍␊ |
1803 | png_warning(png_ptr, "Duplicate hIST chunk");␍␊ |
1804 | png_crc_finish(png_ptr, length);␍␊ |
1805 | return;␍␊ |
1806 | }␍␊ |
1807 | ␍␊ |
1808 | if (length > 2*PNG_MAX_PALETTE_LENGTH ||␍␊ |
1809 | length != (unsigned int) (2*png_ptr->num_palette))␍␊ |
1810 | {␍␊ |
1811 | png_warning(png_ptr, "Incorrect hIST chunk length");␍␊ |
1812 | png_crc_finish(png_ptr, length);␍␊ |
1813 | return;␍␊ |
1814 | }␍␊ |
1815 | ␍␊ |
1816 | num = length / 2 ;␍␊ |
1817 | ␍␊ |
1818 | for (i = 0; i < num; i++)␍␊ |
1819 | {␍␊ |
1820 | png_byte buf[2];␍␊ |
1821 | ␍␊ |
1822 | png_crc_read(png_ptr, buf, 2);␍␊ |
1823 | readbuf[i] = png_get_uint_16(buf);␍␊ |
1824 | }␍␊ |
1825 | ␍␊ |
1826 | if (png_crc_finish(png_ptr, 0))␍␊ |
1827 | return;␍␊ |
1828 | ␍␊ |
1829 | png_set_hIST(png_ptr, info_ptr, readbuf);␍␊ |
1830 | }␍␊ |
1831 | #endif␍␊ |
1832 | ␍␊ |
1833 | #ifdef PNG_READ_pHYs_SUPPORTED␍␊ |
1834 | void /* PRIVATE */␍␊ |
1835 | png_handle_pHYs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
1836 | {␍␊ |
1837 | png_byte buf[9];␍␊ |
1838 | png_uint_32 res_x, res_y;␍␊ |
1839 | int unit_type;␍␊ |
1840 | ␍␊ |
1841 | png_debug(1, "in png_handle_pHYs");␍␊ |
1842 | ␍␊ |
1843 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
1844 | png_error(png_ptr, "Missing IHDR before pHYs");␍␊ |
1845 | ␍␊ |
1846 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
1847 | {␍␊ |
1848 | png_warning(png_ptr, "Invalid pHYs after IDAT");␍␊ |
1849 | png_crc_finish(png_ptr, length);␍␊ |
1850 | return;␍␊ |
1851 | }␍␊ |
1852 | ␍␊ |
1853 | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs))␍␊ |
1854 | {␍␊ |
1855 | png_warning(png_ptr, "Duplicate pHYs chunk");␍␊ |
1856 | png_crc_finish(png_ptr, length);␍␊ |
1857 | return;␍␊ |
1858 | }␍␊ |
1859 | ␍␊ |
1860 | if (length != 9)␍␊ |
1861 | {␍␊ |
1862 | png_warning(png_ptr, "Incorrect pHYs chunk length");␍␊ |
1863 | png_crc_finish(png_ptr, length);␍␊ |
1864 | return;␍␊ |
1865 | }␍␊ |
1866 | ␍␊ |
1867 | png_crc_read(png_ptr, buf, 9);␍␊ |
1868 | ␍␊ |
1869 | if (png_crc_finish(png_ptr, 0))␍␊ |
1870 | return;␍␊ |
1871 | ␍␊ |
1872 | res_x = png_get_uint_32(buf);␍␊ |
1873 | res_y = png_get_uint_32(buf + 4);␍␊ |
1874 | unit_type = buf[8];␍␊ |
1875 | png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type);␍␊ |
1876 | }␍␊ |
1877 | #endif␍␊ |
1878 | ␍␊ |
1879 | #ifdef PNG_READ_oFFs_SUPPORTED␍␊ |
1880 | void /* PRIVATE */␍␊ |
1881 | png_handle_oFFs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
1882 | {␍␊ |
1883 | png_byte buf[9];␍␊ |
1884 | png_int_32 offset_x, offset_y;␍␊ |
1885 | int unit_type;␍␊ |
1886 | ␍␊ |
1887 | png_debug(1, "in png_handle_oFFs");␍␊ |
1888 | ␍␊ |
1889 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
1890 | png_error(png_ptr, "Missing IHDR before oFFs");␍␊ |
1891 | ␍␊ |
1892 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
1893 | {␍␊ |
1894 | png_warning(png_ptr, "Invalid oFFs after IDAT");␍␊ |
1895 | png_crc_finish(png_ptr, length);␍␊ |
1896 | return;␍␊ |
1897 | }␍␊ |
1898 | ␍␊ |
1899 | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs))␍␊ |
1900 | {␍␊ |
1901 | png_warning(png_ptr, "Duplicate oFFs chunk");␍␊ |
1902 | png_crc_finish(png_ptr, length);␍␊ |
1903 | return;␍␊ |
1904 | }␍␊ |
1905 | ␍␊ |
1906 | if (length != 9)␍␊ |
1907 | {␍␊ |
1908 | png_warning(png_ptr, "Incorrect oFFs chunk length");␍␊ |
1909 | png_crc_finish(png_ptr, length);␍␊ |
1910 | return;␍␊ |
1911 | }␍␊ |
1912 | ␍␊ |
1913 | png_crc_read(png_ptr, buf, 9);␍␊ |
1914 | ␍␊ |
1915 | if (png_crc_finish(png_ptr, 0))␍␊ |
1916 | return;␍␊ |
1917 | ␍␊ |
1918 | offset_x = png_get_int_32(buf);␍␊ |
1919 | offset_y = png_get_int_32(buf + 4);␍␊ |
1920 | unit_type = buf[8];␍␊ |
1921 | png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type);␍␊ |
1922 | }␍␊ |
1923 | #endif␍␊ |
1924 | ␍␊ |
1925 | #ifdef PNG_READ_pCAL_SUPPORTED␍␊ |
1926 | /* Read the pCAL chunk (described in the PNG Extensions document) */␍␊ |
1927 | void /* PRIVATE */␍␊ |
1928 | png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
1929 | {␍␊ |
1930 | png_int_32 X0, X1;␍␊ |
1931 | png_byte type, nparams;␍␊ |
1932 | png_charp buf, units, endptr;␍␊ |
1933 | png_charpp params;␍␊ |
1934 | png_size_t slength;␍␊ |
1935 | int i;␍␊ |
1936 | ␍␊ |
1937 | png_debug(1, "in png_handle_pCAL");␍␊ |
1938 | ␍␊ |
1939 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
1940 | png_error(png_ptr, "Missing IHDR before pCAL");␍␊ |
1941 | ␍␊ |
1942 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
1943 | {␍␊ |
1944 | png_warning(png_ptr, "Invalid pCAL after IDAT");␍␊ |
1945 | png_crc_finish(png_ptr, length);␍␊ |
1946 | return;␍␊ |
1947 | }␍␊ |
1948 | ␍␊ |
1949 | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL))␍␊ |
1950 | {␍␊ |
1951 | png_warning(png_ptr, "Duplicate pCAL chunk");␍␊ |
1952 | png_crc_finish(png_ptr, length);␍␊ |
1953 | return;␍␊ |
1954 | }␍␊ |
1955 | ␍␊ |
1956 | png_debug1(2, "Allocating and reading pCAL chunk data (%u bytes)",␍␊ |
1957 | length + 1);␍␊ |
1958 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1959 | png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);␍␊ |
1960 | ␍␊ |
1961 | if (png_ptr->chunkdata == NULL)␍␊ |
1962 | {␍␊ |
1963 | png_warning(png_ptr, "No memory for pCAL purpose");␍␊ |
1964 | return;␍␊ |
1965 | }␍␊ |
1966 | ␍␊ |
1967 | slength = length;␍␊ |
1968 | png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);␍␊ |
1969 | ␍␊ |
1970 | if (png_crc_finish(png_ptr, 0))␍␊ |
1971 | {␍␊ |
1972 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1973 | png_ptr->chunkdata = NULL;␍␊ |
1974 | return;␍␊ |
1975 | }␍␊ |
1976 | ␍␊ |
1977 | png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */␍␊ |
1978 | ␍␊ |
1979 | png_debug(3, "Finding end of pCAL purpose string");␍␊ |
1980 | for (buf = png_ptr->chunkdata; *buf; buf++)␍␊ |
1981 | /* Empty loop */ ;␍␊ |
1982 | ␍␊ |
1983 | endptr = png_ptr->chunkdata + slength;␍␊ |
1984 | ␍␊ |
1985 | /* We need to have at least 12 bytes after the purpose string␍␊ |
1986 | * in order to get the parameter information.␍␊ |
1987 | */␍␊ |
1988 | if (endptr <= buf + 12)␍␊ |
1989 | {␍␊ |
1990 | png_warning(png_ptr, "Invalid pCAL data");␍␊ |
1991 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
1992 | png_ptr->chunkdata = NULL;␍␊ |
1993 | return;␍␊ |
1994 | }␍␊ |
1995 | ␍␊ |
1996 | png_debug(3, "Reading pCAL X0, X1, type, nparams, and units");␍␊ |
1997 | X0 = png_get_int_32((png_bytep)buf+1);␍␊ |
1998 | X1 = png_get_int_32((png_bytep)buf+5);␍␊ |
1999 | type = buf[9];␍␊ |
2000 | nparams = buf[10];␍␊ |
2001 | units = buf + 11;␍␊ |
2002 | ␍␊ |
2003 | png_debug(3, "Checking pCAL equation type and number of parameters");␍␊ |
2004 | /* Check that we have the right number of parameters for known␍␊ |
2005 | * equation types.␍␊ |
2006 | */␍␊ |
2007 | if ((type == PNG_EQUATION_LINEAR && nparams != 2) ||␍␊ |
2008 | (type == PNG_EQUATION_BASE_E && nparams != 3) ||␍␊ |
2009 | (type == PNG_EQUATION_ARBITRARY && nparams != 3) ||␍␊ |
2010 | (type == PNG_EQUATION_HYPERBOLIC && nparams != 4))␍␊ |
2011 | {␍␊ |
2012 | png_warning(png_ptr, "Invalid pCAL parameters for equation type");␍␊ |
2013 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2014 | png_ptr->chunkdata = NULL;␍␊ |
2015 | return;␍␊ |
2016 | }␍␊ |
2017 | ␍␊ |
2018 | else if (type >= PNG_EQUATION_LAST)␍␊ |
2019 | {␍␊ |
2020 | png_warning(png_ptr, "Unrecognized equation type for pCAL chunk");␍␊ |
2021 | }␍␊ |
2022 | ␍␊ |
2023 | for (buf = units; *buf; buf++)␍␊ |
2024 | /* Empty loop to move past the units string. */ ;␍␊ |
2025 | ␍␊ |
2026 | png_debug(3, "Allocating pCAL parameters array");␍␊ |
2027 | ␍␊ |
2028 | params = (png_charpp)png_malloc_warn(png_ptr,␍␊ |
2029 | (png_size_t)(nparams * png_sizeof(png_charp)));␍␊ |
2030 | ␍␊ |
2031 | if (params == NULL)␍␊ |
2032 | {␍␊ |
2033 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2034 | png_ptr->chunkdata = NULL;␍␊ |
2035 | png_warning(png_ptr, "No memory for pCAL params");␍␊ |
2036 | return;␍␊ |
2037 | }␍␊ |
2038 | ␍␊ |
2039 | /* Get pointers to the start of each parameter string. */␍␊ |
2040 | for (i = 0; i < (int)nparams; i++)␍␊ |
2041 | {␍␊ |
2042 | buf++; /* Skip the null string terminator from previous parameter. */␍␊ |
2043 | ␍␊ |
2044 | png_debug1(3, "Reading pCAL parameter %d", i);␍␊ |
2045 | ␍␊ |
2046 | for (params[i] = buf; buf <= endptr && *buf != 0x00; buf++)␍␊ |
2047 | /* Empty loop to move past each parameter string */ ;␍␊ |
2048 | ␍␊ |
2049 | /* Make sure we haven't run out of data yet */␍␊ |
2050 | if (buf > endptr)␍␊ |
2051 | {␍␊ |
2052 | png_warning(png_ptr, "Invalid pCAL data");␍␊ |
2053 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2054 | png_ptr->chunkdata = NULL;␍␊ |
2055 | png_free(png_ptr, params);␍␊ |
2056 | return;␍␊ |
2057 | }␍␊ |
2058 | }␍␊ |
2059 | ␍␊ |
2060 | png_set_pCAL(png_ptr, info_ptr, png_ptr->chunkdata, X0, X1, type, nparams,␍␊ |
2061 | units, params);␍␊ |
2062 | ␍␊ |
2063 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2064 | png_ptr->chunkdata = NULL;␍␊ |
2065 | png_free(png_ptr, params);␍␊ |
2066 | }␍␊ |
2067 | #endif␍␊ |
2068 | ␍␊ |
2069 | #ifdef PNG_READ_sCAL_SUPPORTED␍␊ |
2070 | /* Read the sCAL chunk */␍␊ |
2071 | void /* PRIVATE */␍␊ |
2072 | png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
2073 | {␍␊ |
2074 | png_size_t slength, i;␍␊ |
2075 | int state;␍␊ |
2076 | ␍␊ |
2077 | png_debug(1, "in png_handle_sCAL");␍␊ |
2078 | ␍␊ |
2079 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
2080 | png_error(png_ptr, "Missing IHDR before sCAL");␍␊ |
2081 | ␍␊ |
2082 | else if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
2083 | {␍␊ |
2084 | png_warning(png_ptr, "Invalid sCAL after IDAT");␍␊ |
2085 | png_crc_finish(png_ptr, length);␍␊ |
2086 | return;␍␊ |
2087 | }␍␊ |
2088 | ␍␊ |
2089 | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL))␍␊ |
2090 | {␍␊ |
2091 | png_warning(png_ptr, "Duplicate sCAL chunk");␍␊ |
2092 | png_crc_finish(png_ptr, length);␍␊ |
2093 | return;␍␊ |
2094 | }␍␊ |
2095 | ␍␊ |
2096 | /* Need unit type, width, \0, height: minimum 4 bytes */␍␊ |
2097 | else if (length < 4)␍␊ |
2098 | {␍␊ |
2099 | png_warning(png_ptr, "sCAL chunk too short");␍␊ |
2100 | png_crc_finish(png_ptr, length);␍␊ |
2101 | return;␍␊ |
2102 | }␍␊ |
2103 | ␍␊ |
2104 | png_debug1(2, "Allocating and reading sCAL chunk data (%u bytes)",␍␊ |
2105 | length + 1);␍␊ |
2106 | ␍␊ |
2107 | png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);␍␊ |
2108 | ␍␊ |
2109 | if (png_ptr->chunkdata == NULL)␍␊ |
2110 | {␍␊ |
2111 | png_warning(png_ptr, "Out of memory while processing sCAL chunk");␍␊ |
2112 | png_crc_finish(png_ptr, length);␍␊ |
2113 | return;␍␊ |
2114 | }␍␊ |
2115 | ␍␊ |
2116 | slength = length;␍␊ |
2117 | png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);␍␊ |
2118 | png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */␍␊ |
2119 | ␍␊ |
2120 | if (png_crc_finish(png_ptr, 0))␍␊ |
2121 | {␍␊ |
2122 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2123 | png_ptr->chunkdata = NULL;␍␊ |
2124 | return;␍␊ |
2125 | }␍␊ |
2126 | ␍␊ |
2127 | /* Validate the unit. */␍␊ |
2128 | if (png_ptr->chunkdata[0] != 1 && png_ptr->chunkdata[0] != 2)␍␊ |
2129 | {␍␊ |
2130 | png_warning(png_ptr, "Invalid sCAL ignored: invalid unit");␍␊ |
2131 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2132 | png_ptr->chunkdata = NULL;␍␊ |
2133 | return;␍␊ |
2134 | }␍␊ |
2135 | ␍␊ |
2136 | /* Validate the ASCII numbers, need two ASCII numbers separated by␍␊ |
2137 | * a '\0' and they need to fit exactly in the chunk data.␍␊ |
2138 | */␍␊ |
2139 | i = 1;␍␊ |
2140 | state = 0;␍␊ |
2141 | ␍␊ |
2142 | if (!png_check_fp_number(png_ptr->chunkdata, slength, &state, &i) ||␍␊ |
2143 | i >= slength || png_ptr->chunkdata[i++] != 0)␍␊ |
2144 | png_warning(png_ptr, "Invalid sCAL chunk ignored: bad width format");␍␊ |
2145 | ␍␊ |
2146 | else if (!PNG_FP_IS_POSITIVE(state))␍␊ |
2147 | png_warning(png_ptr, "Invalid sCAL chunk ignored: non-positive width");␍␊ |
2148 | ␍␊ |
2149 | else␍␊ |
2150 | {␍␊ |
2151 | png_size_t heighti = i;␍␊ |
2152 | ␍␊ |
2153 | state = 0;␍␊ |
2154 | if (!png_check_fp_number(png_ptr->chunkdata, slength, &state, &i) ||␍␊ |
2155 | i != slength)␍␊ |
2156 | png_warning(png_ptr, "Invalid sCAL chunk ignored: bad height format");␍␊ |
2157 | ␍␊ |
2158 | else if (!PNG_FP_IS_POSITIVE(state))␍␊ |
2159 | png_warning(png_ptr,␍␊ |
2160 | "Invalid sCAL chunk ignored: non-positive height");␍␊ |
2161 | ␍␊ |
2162 | else␍␊ |
2163 | /* This is the (only) success case. */␍␊ |
2164 | png_set_sCAL_s(png_ptr, info_ptr, png_ptr->chunkdata[0],␍␊ |
2165 | png_ptr->chunkdata+1, png_ptr->chunkdata+heighti);␍␊ |
2166 | }␍␊ |
2167 | ␍␊ |
2168 | /* Clean up - just free the temporarily allocated buffer. */␍␊ |
2169 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2170 | png_ptr->chunkdata = NULL;␍␊ |
2171 | }␍␊ |
2172 | #endif␍␊ |
2173 | ␍␊ |
2174 | #ifdef PNG_READ_tIME_SUPPORTED␍␊ |
2175 | void /* PRIVATE */␍␊ |
2176 | png_handle_tIME(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
2177 | {␍␊ |
2178 | png_byte buf[7];␍␊ |
2179 | png_time mod_time;␍␊ |
2180 | ␍␊ |
2181 | png_debug(1, "in png_handle_tIME");␍␊ |
2182 | ␍␊ |
2183 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
2184 | png_error(png_ptr, "Out of place tIME chunk");␍␊ |
2185 | ␍␊ |
2186 | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME))␍␊ |
2187 | {␍␊ |
2188 | png_warning(png_ptr, "Duplicate tIME chunk");␍␊ |
2189 | png_crc_finish(png_ptr, length);␍␊ |
2190 | return;␍␊ |
2191 | }␍␊ |
2192 | ␍␊ |
2193 | if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
2194 | png_ptr->mode |= PNG_AFTER_IDAT;␍␊ |
2195 | ␍␊ |
2196 | if (length != 7)␍␊ |
2197 | {␍␊ |
2198 | png_warning(png_ptr, "Incorrect tIME chunk length");␍␊ |
2199 | png_crc_finish(png_ptr, length);␍␊ |
2200 | return;␍␊ |
2201 | }␍␊ |
2202 | ␍␊ |
2203 | png_crc_read(png_ptr, buf, 7);␍␊ |
2204 | ␍␊ |
2205 | if (png_crc_finish(png_ptr, 0))␍␊ |
2206 | return;␍␊ |
2207 | ␍␊ |
2208 | mod_time.second = buf[6];␍␊ |
2209 | mod_time.minute = buf[5];␍␊ |
2210 | mod_time.hour = buf[4];␍␊ |
2211 | mod_time.day = buf[3];␍␊ |
2212 | mod_time.month = buf[2];␍␊ |
2213 | mod_time.year = png_get_uint_16(buf);␍␊ |
2214 | ␍␊ |
2215 | png_set_tIME(png_ptr, info_ptr, &mod_time);␍␊ |
2216 | }␍␊ |
2217 | #endif␍␊ |
2218 | ␍␊ |
2219 | #ifdef PNG_READ_tEXt_SUPPORTED␍␊ |
2220 | /* Note: this does not properly handle chunks that are > 64K under DOS */␍␊ |
2221 | void /* PRIVATE */␍␊ |
2222 | png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
2223 | {␍␊ |
2224 | png_textp text_ptr;␍␊ |
2225 | png_charp key;␍␊ |
2226 | png_charp text;␍␊ |
2227 | png_uint_32 skip = 0;␍␊ |
2228 | png_size_t slength;␍␊ |
2229 | int ret;␍␊ |
2230 | ␍␊ |
2231 | png_debug(1, "in png_handle_tEXt");␍␊ |
2232 | ␍␊ |
2233 | #ifdef PNG_USER_LIMITS_SUPPORTED␍␊ |
2234 | if (png_ptr->user_chunk_cache_max != 0)␍␊ |
2235 | {␍␊ |
2236 | if (png_ptr->user_chunk_cache_max == 1)␍␊ |
2237 | {␍␊ |
2238 | png_crc_finish(png_ptr, length);␍␊ |
2239 | return;␍␊ |
2240 | }␍␊ |
2241 | ␍␊ |
2242 | if (--png_ptr->user_chunk_cache_max == 1)␍␊ |
2243 | {␍␊ |
2244 | png_warning(png_ptr, "No space in chunk cache for tEXt");␍␊ |
2245 | png_crc_finish(png_ptr, length);␍␊ |
2246 | return;␍␊ |
2247 | }␍␊ |
2248 | }␍␊ |
2249 | #endif␍␊ |
2250 | ␍␊ |
2251 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
2252 | png_error(png_ptr, "Missing IHDR before tEXt");␍␊ |
2253 | ␍␊ |
2254 | if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
2255 | png_ptr->mode |= PNG_AFTER_IDAT;␍␊ |
2256 | ␍␊ |
2257 | #ifdef PNG_MAX_MALLOC_64K␍␊ |
2258 | if (length > (png_uint_32)65535L)␍␊ |
2259 | {␍␊ |
2260 | png_warning(png_ptr, "tEXt chunk too large to fit in memory");␍␊ |
2261 | skip = length - (png_uint_32)65535L;␍␊ |
2262 | length = (png_uint_32)65535L;␍␊ |
2263 | }␍␊ |
2264 | #endif␍␊ |
2265 | ␍␊ |
2266 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2267 | ␍␊ |
2268 | png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);␍␊ |
2269 | ␍␊ |
2270 | if (png_ptr->chunkdata == NULL)␍␊ |
2271 | {␍␊ |
2272 | png_warning(png_ptr, "No memory to process text chunk");␍␊ |
2273 | return;␍␊ |
2274 | }␍␊ |
2275 | ␍␊ |
2276 | slength = length;␍␊ |
2277 | png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);␍␊ |
2278 | ␍␊ |
2279 | if (png_crc_finish(png_ptr, skip))␍␊ |
2280 | {␍␊ |
2281 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2282 | png_ptr->chunkdata = NULL;␍␊ |
2283 | return;␍␊ |
2284 | }␍␊ |
2285 | ␍␊ |
2286 | key = png_ptr->chunkdata;␍␊ |
2287 | ␍␊ |
2288 | key[slength] = 0x00;␍␊ |
2289 | ␍␊ |
2290 | for (text = key; *text; text++)␍␊ |
2291 | /* Empty loop to find end of key */ ;␍␊ |
2292 | ␍␊ |
2293 | if (text != key + slength)␍␊ |
2294 | text++;␍␊ |
2295 | ␍␊ |
2296 | text_ptr = (png_textp)png_malloc_warn(png_ptr,␍␊ |
2297 | png_sizeof(png_text));␍␊ |
2298 | ␍␊ |
2299 | if (text_ptr == NULL)␍␊ |
2300 | {␍␊ |
2301 | png_warning(png_ptr, "Not enough memory to process text chunk");␍␊ |
2302 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2303 | png_ptr->chunkdata = NULL;␍␊ |
2304 | return;␍␊ |
2305 | }␍␊ |
2306 | ␍␊ |
2307 | text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;␍␊ |
2308 | text_ptr->key = key;␍␊ |
2309 | text_ptr->lang = NULL;␍␊ |
2310 | text_ptr->lang_key = NULL;␍␊ |
2311 | text_ptr->itxt_length = 0;␍␊ |
2312 | text_ptr->text = text;␍␊ |
2313 | text_ptr->text_length = png_strlen(text);␍␊ |
2314 | ␍␊ |
2315 | ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);␍␊ |
2316 | ␍␊ |
2317 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2318 | png_ptr->chunkdata = NULL;␍␊ |
2319 | png_free(png_ptr, text_ptr);␍␊ |
2320 | ␍␊ |
2321 | if (ret)␍␊ |
2322 | png_warning(png_ptr, "Insufficient memory to process text chunk");␍␊ |
2323 | }␍␊ |
2324 | #endif␍␊ |
2325 | ␍␊ |
2326 | #ifdef PNG_READ_zTXt_SUPPORTED␍␊ |
2327 | /* Note: this does not correctly handle chunks that are > 64K under DOS */␍␊ |
2328 | void /* PRIVATE */␍␊ |
2329 | png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
2330 | {␍␊ |
2331 | png_textp text_ptr;␍␊ |
2332 | png_charp text;␍␊ |
2333 | int comp_type;␍␊ |
2334 | int ret;␍␊ |
2335 | png_size_t slength, prefix_len, data_len;␍␊ |
2336 | ␍␊ |
2337 | png_debug(1, "in png_handle_zTXt");␍␊ |
2338 | ␍␊ |
2339 | #ifdef PNG_USER_LIMITS_SUPPORTED␍␊ |
2340 | if (png_ptr->user_chunk_cache_max != 0)␍␊ |
2341 | {␍␊ |
2342 | if (png_ptr->user_chunk_cache_max == 1)␍␊ |
2343 | {␍␊ |
2344 | png_crc_finish(png_ptr, length);␍␊ |
2345 | return;␍␊ |
2346 | }␍␊ |
2347 | ␍␊ |
2348 | if (--png_ptr->user_chunk_cache_max == 1)␍␊ |
2349 | {␍␊ |
2350 | png_warning(png_ptr, "No space in chunk cache for zTXt");␍␊ |
2351 | png_crc_finish(png_ptr, length);␍␊ |
2352 | return;␍␊ |
2353 | }␍␊ |
2354 | }␍␊ |
2355 | #endif␍␊ |
2356 | ␍␊ |
2357 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
2358 | png_error(png_ptr, "Missing IHDR before zTXt");␍␊ |
2359 | ␍␊ |
2360 | if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
2361 | png_ptr->mode |= PNG_AFTER_IDAT;␍␊ |
2362 | ␍␊ |
2363 | #ifdef PNG_MAX_MALLOC_64K␍␊ |
2364 | /* We will no doubt have problems with chunks even half this size, but␍␊ |
2365 | * there is no hard and fast rule to tell us where to stop.␍␊ |
2366 | */␍␊ |
2367 | if (length > (png_uint_32)65535L)␍␊ |
2368 | {␍␊ |
2369 | png_warning(png_ptr, "zTXt chunk too large to fit in memory");␍␊ |
2370 | png_crc_finish(png_ptr, length);␍␊ |
2371 | return;␍␊ |
2372 | }␍␊ |
2373 | #endif␍␊ |
2374 | ␍␊ |
2375 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2376 | png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);␍␊ |
2377 | ␍␊ |
2378 | if (png_ptr->chunkdata == NULL)␍␊ |
2379 | {␍␊ |
2380 | png_warning(png_ptr, "Out of memory processing zTXt chunk");␍␊ |
2381 | return;␍␊ |
2382 | }␍␊ |
2383 | ␍␊ |
2384 | slength = length;␍␊ |
2385 | png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);␍␊ |
2386 | ␍␊ |
2387 | if (png_crc_finish(png_ptr, 0))␍␊ |
2388 | {␍␊ |
2389 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2390 | png_ptr->chunkdata = NULL;␍␊ |
2391 | return;␍␊ |
2392 | }␍␊ |
2393 | ␍␊ |
2394 | png_ptr->chunkdata[slength] = 0x00;␍␊ |
2395 | ␍␊ |
2396 | for (text = png_ptr->chunkdata; *text; text++)␍␊ |
2397 | /* Empty loop */ ;␍␊ |
2398 | ␍␊ |
2399 | /* zTXt must have some text after the chunkdataword */␍␊ |
2400 | if (text >= png_ptr->chunkdata + slength - 2)␍␊ |
2401 | {␍␊ |
2402 | png_warning(png_ptr, "Truncated zTXt chunk");␍␊ |
2403 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2404 | png_ptr->chunkdata = NULL;␍␊ |
2405 | return;␍␊ |
2406 | }␍␊ |
2407 | ␍␊ |
2408 | else␍␊ |
2409 | {␍␊ |
2410 | comp_type = *(++text);␍␊ |
2411 | ␍␊ |
2412 | if (comp_type != PNG_TEXT_COMPRESSION_zTXt)␍␊ |
2413 | {␍␊ |
2414 | png_warning(png_ptr, "Unknown compression type in zTXt chunk");␍␊ |
2415 | comp_type = PNG_TEXT_COMPRESSION_zTXt;␍␊ |
2416 | }␍␊ |
2417 | ␍␊ |
2418 | text++; /* Skip the compression_method byte */␍␊ |
2419 | }␍␊ |
2420 | ␍␊ |
2421 | prefix_len = text - png_ptr->chunkdata;␍␊ |
2422 | ␍␊ |
2423 | png_decompress_chunk(png_ptr, comp_type,␍␊ |
2424 | (png_size_t)length, prefix_len, &data_len);␍␊ |
2425 | ␍␊ |
2426 | text_ptr = (png_textp)png_malloc_warn(png_ptr,␍␊ |
2427 | png_sizeof(png_text));␍␊ |
2428 | ␍␊ |
2429 | if (text_ptr == NULL)␍␊ |
2430 | {␍␊ |
2431 | png_warning(png_ptr, "Not enough memory to process zTXt chunk");␍␊ |
2432 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2433 | png_ptr->chunkdata = NULL;␍␊ |
2434 | return;␍␊ |
2435 | }␍␊ |
2436 | ␍␊ |
2437 | text_ptr->compression = comp_type;␍␊ |
2438 | text_ptr->key = png_ptr->chunkdata;␍␊ |
2439 | text_ptr->lang = NULL;␍␊ |
2440 | text_ptr->lang_key = NULL;␍␊ |
2441 | text_ptr->itxt_length = 0;␍␊ |
2442 | text_ptr->text = png_ptr->chunkdata + prefix_len;␍␊ |
2443 | text_ptr->text_length = data_len;␍␊ |
2444 | ␍␊ |
2445 | ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);␍␊ |
2446 | ␍␊ |
2447 | png_free(png_ptr, text_ptr);␍␊ |
2448 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2449 | png_ptr->chunkdata = NULL;␍␊ |
2450 | ␍␊ |
2451 | if (ret)␍␊ |
2452 | png_error(png_ptr, "Insufficient memory to store zTXt chunk");␍␊ |
2453 | }␍␊ |
2454 | #endif␍␊ |
2455 | ␍␊ |
2456 | #ifdef PNG_READ_iTXt_SUPPORTED␍␊ |
2457 | /* Note: this does not correctly handle chunks that are > 64K under DOS */␍␊ |
2458 | void /* PRIVATE */␍␊ |
2459 | png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
2460 | {␍␊ |
2461 | png_textp text_ptr;␍␊ |
2462 | png_charp key, lang, text, lang_key;␍␊ |
2463 | int comp_flag;␍␊ |
2464 | int comp_type = 0;␍␊ |
2465 | int ret;␍␊ |
2466 | png_size_t slength, prefix_len, data_len;␍␊ |
2467 | ␍␊ |
2468 | png_debug(1, "in png_handle_iTXt");␍␊ |
2469 | ␍␊ |
2470 | #ifdef PNG_USER_LIMITS_SUPPORTED␍␊ |
2471 | if (png_ptr->user_chunk_cache_max != 0)␍␊ |
2472 | {␍␊ |
2473 | if (png_ptr->user_chunk_cache_max == 1)␍␊ |
2474 | {␍␊ |
2475 | png_crc_finish(png_ptr, length);␍␊ |
2476 | return;␍␊ |
2477 | }␍␊ |
2478 | ␍␊ |
2479 | if (--png_ptr->user_chunk_cache_max == 1)␍␊ |
2480 | {␍␊ |
2481 | png_warning(png_ptr, "No space in chunk cache for iTXt");␍␊ |
2482 | png_crc_finish(png_ptr, length);␍␊ |
2483 | return;␍␊ |
2484 | }␍␊ |
2485 | }␍␊ |
2486 | #endif␍␊ |
2487 | ␍␊ |
2488 | if (!(png_ptr->mode & PNG_HAVE_IHDR))␍␊ |
2489 | png_error(png_ptr, "Missing IHDR before iTXt");␍␊ |
2490 | ␍␊ |
2491 | if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
2492 | png_ptr->mode |= PNG_AFTER_IDAT;␍␊ |
2493 | ␍␊ |
2494 | #ifdef PNG_MAX_MALLOC_64K␍␊ |
2495 | /* We will no doubt have problems with chunks even half this size, but␍␊ |
2496 | * there is no hard and fast rule to tell us where to stop.␍␊ |
2497 | */␍␊ |
2498 | if (length > (png_uint_32)65535L)␍␊ |
2499 | {␍␊ |
2500 | png_warning(png_ptr, "iTXt chunk too large to fit in memory");␍␊ |
2501 | png_crc_finish(png_ptr, length);␍␊ |
2502 | return;␍␊ |
2503 | }␍␊ |
2504 | #endif␍␊ |
2505 | ␍␊ |
2506 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2507 | png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);␍␊ |
2508 | ␍␊ |
2509 | if (png_ptr->chunkdata == NULL)␍␊ |
2510 | {␍␊ |
2511 | png_warning(png_ptr, "No memory to process iTXt chunk");␍␊ |
2512 | return;␍␊ |
2513 | }␍␊ |
2514 | ␍␊ |
2515 | slength = length;␍␊ |
2516 | png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);␍␊ |
2517 | ␍␊ |
2518 | if (png_crc_finish(png_ptr, 0))␍␊ |
2519 | {␍␊ |
2520 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2521 | png_ptr->chunkdata = NULL;␍␊ |
2522 | return;␍␊ |
2523 | }␍␊ |
2524 | ␍␊ |
2525 | png_ptr->chunkdata[slength] = 0x00;␍␊ |
2526 | ␍␊ |
2527 | for (lang = png_ptr->chunkdata; *lang; lang++)␍␊ |
2528 | /* Empty loop */ ;␍␊ |
2529 | ␍␊ |
2530 | lang++; /* Skip NUL separator */␍␊ |
2531 | ␍␊ |
2532 | /* iTXt must have a language tag (possibly empty), two compression bytes,␍␊ |
2533 | * translated keyword (possibly empty), and possibly some text after the␍␊ |
2534 | * keyword␍␊ |
2535 | */␍␊ |
2536 | ␍␊ |
2537 | if (lang >= png_ptr->chunkdata + slength - 3)␍␊ |
2538 | {␍␊ |
2539 | png_warning(png_ptr, "Truncated iTXt chunk");␍␊ |
2540 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2541 | png_ptr->chunkdata = NULL;␍␊ |
2542 | return;␍␊ |
2543 | }␍␊ |
2544 | ␍␊ |
2545 | else␍␊ |
2546 | {␍␊ |
2547 | comp_flag = *lang++;␍␊ |
2548 | comp_type = *lang++;␍␊ |
2549 | }␍␊ |
2550 | ␍␊ |
2551 | if (comp_type || (comp_flag && comp_flag != PNG_TEXT_COMPRESSION_zTXt))␍␊ |
2552 | {␍␊ |
2553 | png_warning(png_ptr, "Unknown iTXt compression type or method");␍␊ |
2554 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2555 | png_ptr->chunkdata = NULL;␍␊ |
2556 | return;␍␊ |
2557 | }␍␊ |
2558 | ␍␊ |
2559 | for (lang_key = lang; *lang_key; lang_key++)␍␊ |
2560 | /* Empty loop */ ;␍␊ |
2561 | ␍␊ |
2562 | lang_key++; /* Skip NUL separator */␍␊ |
2563 | ␍␊ |
2564 | if (lang_key >= png_ptr->chunkdata + slength)␍␊ |
2565 | {␍␊ |
2566 | png_warning(png_ptr, "Truncated iTXt chunk");␍␊ |
2567 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2568 | png_ptr->chunkdata = NULL;␍␊ |
2569 | return;␍␊ |
2570 | }␍␊ |
2571 | ␍␊ |
2572 | for (text = lang_key; *text; text++)␍␊ |
2573 | /* Empty loop */ ;␍␊ |
2574 | ␍␊ |
2575 | text++; /* Skip NUL separator */␍␊ |
2576 | ␍␊ |
2577 | if (text >= png_ptr->chunkdata + slength)␍␊ |
2578 | {␍␊ |
2579 | png_warning(png_ptr, "Malformed iTXt chunk");␍␊ |
2580 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2581 | png_ptr->chunkdata = NULL;␍␊ |
2582 | return;␍␊ |
2583 | }␍␊ |
2584 | ␍␊ |
2585 | prefix_len = text - png_ptr->chunkdata;␍␊ |
2586 | ␍␊ |
2587 | key=png_ptr->chunkdata;␍␊ |
2588 | ␍␊ |
2589 | if (comp_flag)␍␊ |
2590 | png_decompress_chunk(png_ptr, comp_type,␍␊ |
2591 | (size_t)length, prefix_len, &data_len);␍␊ |
2592 | ␍␊ |
2593 | else␍␊ |
2594 | data_len = png_strlen(png_ptr->chunkdata + prefix_len);␍␊ |
2595 | ␍␊ |
2596 | text_ptr = (png_textp)png_malloc_warn(png_ptr,␍␊ |
2597 | png_sizeof(png_text));␍␊ |
2598 | ␍␊ |
2599 | if (text_ptr == NULL)␍␊ |
2600 | {␍␊ |
2601 | png_warning(png_ptr, "Not enough memory to process iTXt chunk");␍␊ |
2602 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2603 | png_ptr->chunkdata = NULL;␍␊ |
2604 | return;␍␊ |
2605 | }␍␊ |
2606 | ␍␊ |
2607 | text_ptr->compression = (int)comp_flag + 1;␍␊ |
2608 | text_ptr->lang_key = png_ptr->chunkdata + (lang_key - key);␍␊ |
2609 | text_ptr->lang = png_ptr->chunkdata + (lang - key);␍␊ |
2610 | text_ptr->itxt_length = data_len;␍␊ |
2611 | text_ptr->text_length = 0;␍␊ |
2612 | text_ptr->key = png_ptr->chunkdata;␍␊ |
2613 | text_ptr->text = png_ptr->chunkdata + prefix_len;␍␊ |
2614 | ␍␊ |
2615 | ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);␍␊ |
2616 | ␍␊ |
2617 | png_free(png_ptr, text_ptr);␍␊ |
2618 | png_free(png_ptr, png_ptr->chunkdata);␍␊ |
2619 | png_ptr->chunkdata = NULL;␍␊ |
2620 | ␍␊ |
2621 | if (ret)␍␊ |
2622 | png_error(png_ptr, "Insufficient memory to store iTXt chunk");␍␊ |
2623 | }␍␊ |
2624 | #endif␍␊ |
2625 | ␍␊ |
2626 | /* This function is called when we haven't found a handler for a␍␊ |
2627 | * chunk. If there isn't a problem with the chunk itself (ie bad␍␊ |
2628 | * chunk name, CRC, or a critical chunk), the chunk is silently ignored␍␊ |
2629 | * -- unless the PNG_FLAG_UNKNOWN_CHUNKS_SUPPORTED flag is on in which␍␊ |
2630 | * case it will be saved away to be written out later.␍␊ |
2631 | */␍␊ |
2632 | void /* PRIVATE */␍␊ |
2633 | png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)␍␊ |
2634 | {␍␊ |
2635 | png_uint_32 skip = 0;␍␊ |
2636 | ␍␊ |
2637 | png_debug(1, "in png_handle_unknown");␍␊ |
2638 | ␍␊ |
2639 | #ifdef PNG_USER_LIMITS_SUPPORTED␍␊ |
2640 | if (png_ptr->user_chunk_cache_max != 0)␍␊ |
2641 | {␍␊ |
2642 | if (png_ptr->user_chunk_cache_max == 1)␍␊ |
2643 | {␍␊ |
2644 | png_crc_finish(png_ptr, length);␍␊ |
2645 | return;␍␊ |
2646 | }␍␊ |
2647 | ␍␊ |
2648 | if (--png_ptr->user_chunk_cache_max == 1)␍␊ |
2649 | {␍␊ |
2650 | png_warning(png_ptr, "No space in chunk cache for unknown chunk");␍␊ |
2651 | png_crc_finish(png_ptr, length);␍␊ |
2652 | return;␍␊ |
2653 | }␍␊ |
2654 | }␍␊ |
2655 | #endif␍␊ |
2656 | ␍␊ |
2657 | if (png_ptr->mode & PNG_HAVE_IDAT)␍␊ |
2658 | {␍␊ |
2659 | if (png_ptr->chunk_name != png_IDAT)␍␊ |
2660 | png_ptr->mode |= PNG_AFTER_IDAT;␍␊ |
2661 | }␍␊ |
2662 | ␍␊ |
2663 | if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))␍␊ |
2664 | {␍␊ |
2665 | #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED␍␊ |
2666 | if (png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name) !=␍␊ |
2667 | PNG_HANDLE_CHUNK_ALWAYS␍␊ |
2668 | #ifdef PNG_READ_USER_CHUNKS_SUPPORTED␍␊ |
2669 | && png_ptr->read_user_chunk_fn == NULL␍␊ |
2670 | #endif␍␊ |
2671 | )␍␊ |
2672 | #endif␍␊ |
2673 | png_chunk_error(png_ptr, "unknown critical chunk");␍␊ |
2674 | }␍␊ |
2675 | ␍␊ |
2676 | #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED␍␊ |
2677 | if ((png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)␍␊ |
2678 | #ifdef PNG_READ_USER_CHUNKS_SUPPORTED␍␊ |
2679 | || (png_ptr->read_user_chunk_fn != NULL)␍␊ |
2680 | #endif␍␊ |
2681 | )␍␊ |
2682 | {␍␊ |
2683 | #ifdef PNG_MAX_MALLOC_64K␍␊ |
2684 | if (length > 65535)␍␊ |
2685 | {␍␊ |
2686 | png_warning(png_ptr, "unknown chunk too large to fit in memory");␍␊ |
2687 | skip = length - 65535;␍␊ |
2688 | length = 65535;␍␊ |
2689 | }␍␊ |
2690 | #endif␍␊ |
2691 | ␍␊ |
2692 | /* TODO: this code is very close to the unknown handling in pngpread.c,␍␊ |
2693 | * maybe it can be put into a common utility routine?␍␊ |
2694 | * png_struct::unknown_chunk is just used as a temporary variable, along␍␊ |
2695 | * with the data into which the chunk is read. These can be eliminated.␍␊ |
2696 | */␍␊ |
2697 | PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);␍␊ |
2698 | png_ptr->unknown_chunk.size = (png_size_t)length;␍␊ |
2699 | ␍␊ |
2700 | if (length == 0)␍␊ |
2701 | png_ptr->unknown_chunk.data = NULL;␍␊ |
2702 | ␍␊ |
2703 | else␍␊ |
2704 | {␍␊ |
2705 | png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length);␍␊ |
2706 | png_crc_read(png_ptr, png_ptr->unknown_chunk.data, length);␍␊ |
2707 | }␍␊ |
2708 | ␍␊ |
2709 | #ifdef PNG_READ_USER_CHUNKS_SUPPORTED␍␊ |
2710 | if (png_ptr->read_user_chunk_fn != NULL)␍␊ |
2711 | {␍␊ |
2712 | /* Callback to user unknown chunk handler */␍␊ |
2713 | int ret;␍␊ |
2714 | ␍␊ |
2715 | ret = (*(png_ptr->read_user_chunk_fn))␍␊ |
2716 | (png_ptr, &png_ptr->unknown_chunk);␍␊ |
2717 | ␍␊ |
2718 | if (ret < 0)␍␊ |
2719 | png_chunk_error(png_ptr, "error in user chunk");␍␊ |
2720 | ␍␊ |
2721 | if (ret == 0)␍␊ |
2722 | {␍␊ |
2723 | if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name))␍␊ |
2724 | {␍␊ |
2725 | #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED␍␊ |
2726 | if (png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name) !=␍␊ |
2727 | PNG_HANDLE_CHUNK_ALWAYS)␍␊ |
2728 | #endif␍␊ |
2729 | png_chunk_error(png_ptr, "unknown critical chunk");␍␊ |
2730 | }␍␊ |
2731 | ␍␊ |
2732 | png_set_unknown_chunks(png_ptr, info_ptr,␍␊ |
2733 | &png_ptr->unknown_chunk, 1);␍␊ |
2734 | }␍␊ |
2735 | }␍␊ |
2736 | ␍␊ |
2737 | else␍␊ |
2738 | #endif␍␊ |
2739 | png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);␍␊ |
2740 | ␍␊ |
2741 | png_free(png_ptr, png_ptr->unknown_chunk.data);␍␊ |
2742 | png_ptr->unknown_chunk.data = NULL;␍␊ |
2743 | }␍␊ |
2744 | ␍␊ |
2745 | else␍␊ |
2746 | #endif␍␊ |
2747 | skip = length;␍␊ |
2748 | ␍␊ |
2749 | png_crc_finish(png_ptr, skip);␍␊ |
2750 | ␍␊ |
2751 | #ifndef PNG_READ_USER_CHUNKS_SUPPORTED␍␊ |
2752 | PNG_UNUSED(info_ptr) /* Quiet compiler warnings about unused info_ptr */␍␊ |
2753 | #endif␍␊ |
2754 | }␍␊ |
2755 | ␍␊ |
2756 | /* This function is called to verify that a chunk name is valid.␍␊ |
2757 | * This function can't have the "critical chunk check" incorporated␍␊ |
2758 | * into it, since in the future we will need to be able to call user␍␊ |
2759 | * functions to handle unknown critical chunks after we check that␍␊ |
2760 | * the chunk name itself is valid.␍␊ |
2761 | */␍␊ |
2762 | ␍␊ |
2763 | /* Bit hacking: the test for an invalid byte in the 4 byte chunk name is:␍␊ |
2764 | *␍␊ |
2765 | * ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))␍␊ |
2766 | */␍␊ |
2767 | ␍␊ |
2768 | void /* PRIVATE */␍␊ |
2769 | png_check_chunk_name(png_structp png_ptr, png_uint_32 chunk_name)␍␊ |
2770 | {␍␊ |
2771 | int i;␍␊ |
2772 | ␍␊ |
2773 | png_debug(1, "in png_check_chunk_name");␍␊ |
2774 | ␍␊ |
2775 | for (i=1; i<=4; ++i)␍␊ |
2776 | {␍␊ |
2777 | int c = chunk_name & 0xff;␍␊ |
2778 | ␍␊ |
2779 | if (c < 65 || c > 122 || (c > 90 && c < 97))␍␊ |
2780 | png_chunk_error(png_ptr, "invalid chunk type");␍␊ |
2781 | ␍␊ |
2782 | chunk_name >>= 8;␍␊ |
2783 | }␍␊ |
2784 | }␍␊ |
2785 | ␍␊ |
2786 | /* Combines the row recently read in with the existing pixels in the row. This␍␊ |
2787 | * routine takes care of alpha and transparency if requested. This routine also␍␊ |
2788 | * handles the two methods of progressive display of interlaced images,␍␊ |
2789 | * depending on the 'display' value; if 'display' is true then the whole row␍␊ |
2790 | * (dp) is filled from the start by replicating the available pixels. If␍␊ |
2791 | * 'display' is false only those pixels present in the pass are filled in.␍␊ |
2792 | */␍␊ |
2793 | void /* PRIVATE */␍␊ |
2794 | png_combine_row(png_structp png_ptr, png_bytep dp, int display)␍␊ |
2795 | {␍␊ |
2796 | unsigned int pixel_depth = png_ptr->transformed_pixel_depth;␍␊ |
2797 | png_const_bytep sp = png_ptr->row_buf + 1;␍␊ |
2798 | png_uint_32 row_width = png_ptr->width;␍␊ |
2799 | unsigned int pass = png_ptr->pass;␍␊ |
2800 | png_bytep end_ptr = 0;␍␊ |
2801 | png_byte end_byte = 0;␍␊ |
2802 | unsigned int end_mask;␍␊ |
2803 | ␍␊ |
2804 | png_debug(1, "in png_combine_row");␍␊ |
2805 | ␍␊ |
2806 | /* Added in 1.5.6: it should not be possible to enter this routine until at␍␊ |
2807 | * least one row has been read from the PNG data and transformed.␍␊ |
2808 | */␍␊ |
2809 | if (pixel_depth == 0)␍␊ |
2810 | png_error(png_ptr, "internal row logic error");␍␊ |
2811 | ␍␊ |
2812 | /* Added in 1.5.4: the pixel depth should match the information returned by␍␊ |
2813 | * any call to png_read_update_info at this point. Do not continue if we got␍␊ |
2814 | * this wrong.␍␊ |
2815 | */␍␊ |
2816 | if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes !=␍␊ |
2817 | PNG_ROWBYTES(pixel_depth, row_width))␍␊ |
2818 | png_error(png_ptr, "internal row size calculation error");␍␊ |
2819 | ␍␊ |
2820 | /* Don't expect this to ever happen: */␍␊ |
2821 | if (row_width == 0)␍␊ |
2822 | png_error(png_ptr, "internal row width error");␍␊ |
2823 | ␍␊ |
2824 | /* Preserve the last byte in cases where only part of it will be overwritten,␍␊ |
2825 | * the multiply below may overflow, we don't care because ANSI-C guarantees␍␊ |
2826 | * we get the low bits.␍␊ |
2827 | */␍␊ |
2828 | end_mask = (pixel_depth * row_width) & 7;␍␊ |
2829 | if (end_mask != 0)␍␊ |
2830 | {␍␊ |
2831 | /* end_ptr == NULL is a flag to say do nothing */␍␊ |
2832 | end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1;␍␊ |
2833 | end_byte = *end_ptr;␍␊ |
2834 | # ifdef PNG_READ_PACKSWAP_SUPPORTED␍␊ |
2835 | if (png_ptr->transformations & PNG_PACKSWAP) /* little-endian byte */␍␊ |
2836 | end_mask = 0xff << end_mask;␍␊ |
2837 | ␍␊ |
2838 | else /* big-endian byte */␍␊ |
2839 | # endif␍␊ |
2840 | end_mask = 0xff >> end_mask;␍␊ |
2841 | /* end_mask is now the bits to *keep* from the destination row */␍␊ |
2842 | }␍␊ |
2843 | ␍␊ |
2844 | /* For non-interlaced images this reduces to a png_memcpy(). A png_memcpy()␍␊ |
2845 | * will also happen if interlacing isn't supported or if the application␍␊ |
2846 | * does not call png_set_interlace_handling(). In the latter cases the␍␊ |
2847 | * caller just gets a sequence of the unexpanded rows from each interlace␍␊ |
2848 | * pass.␍␊ |
2849 | */␍␊ |
2850 | #ifdef PNG_READ_INTERLACING_SUPPORTED␍␊ |
2851 | if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE) &&␍␊ |
2852 | pass < 6 && (display == 0 ||␍␊ |
2853 | /* The following copies everything for 'display' on passes 0, 2 and 4. */␍␊ |
2854 | (display == 1 && (pass & 1) != 0)))␍␊ |
2855 | {␍␊ |
2856 | /* Narrow images may have no bits in a pass; the caller should handle␍␊ |
2857 | * this, but this test is cheap:␍␊ |
2858 | */␍␊ |
2859 | if (row_width <= PNG_PASS_START_COL(pass))␍␊ |
2860 | return;␍␊ |
2861 | ␍␊ |
2862 | if (pixel_depth < 8)␍␊ |
2863 | {␍␊ |
2864 | /* For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit␍␊ |
2865 | * into 32 bits, then a single loop over the bytes using the four byte␍␊ |
2866 | * values in the 32-bit mask can be used. For the 'display' option the␍␊ |
2867 | * expanded mask may also not require any masking within a byte. To␍␊ |
2868 | * make this work the PACKSWAP option must be taken into account - it␍␊ |
2869 | * simply requires the pixels to be reversed in each byte.␍␊ |
2870 | *␍␊ |
2871 | * The 'regular' case requires a mask for each of the first 6 passes,␍␊ |
2872 | * the 'display' case does a copy for the even passes in the range␍␊ |
2873 | * 0..6. This has already been handled in the test above.␍␊ |
2874 | *␍␊ |
2875 | * The masks are arranged as four bytes with the first byte to use in␍␊ |
2876 | * the lowest bits (little-endian) regardless of the order (PACKSWAP or␍␊ |
2877 | * not) of the pixels in each byte.␍␊ |
2878 | *␍␊ |
2879 | * NOTE: the whole of this logic depends on the caller of this function␍␊ |
2880 | * only calling it on rows appropriate to the pass. This function only␍␊ |
2881 | * understands the 'x' logic; the 'y' logic is handled by the caller.␍␊ |
2882 | *␍␊ |
2883 | * The following defines allow generation of compile time constant bit␍␊ |
2884 | * masks for each pixel depth and each possibility of swapped or not␍␊ |
2885 | * swapped bytes. Pass 'p' is in the range 0..6; 'x', a pixel index,␍␊ |
2886 | * is in the range 0..7; and the result is 1 if the pixel is to be␍␊ |
2887 | * copied in the pass, 0 if not. 'S' is for the sparkle method, 'B'␍␊ |
2888 | * for the block method.␍␊ |
2889 | *␍␊ |
2890 | * With some compilers a compile time expression of the general form:␍␊ |
2891 | *␍␊ |
2892 | * (shift >= 32) ? (a >> (shift-32)) : (b >> shift)␍␊ |
2893 | *␍␊ |
2894 | * Produces warnings with values of 'shift' in the range 33 to 63␍␊ |
2895 | * because the right hand side of the ?: expression is evaluated by␍␊ |
2896 | * the compiler even though it isn't used. Microsoft Visual C (various␍␊ |
2897 | * versions) and the Intel C compiler are known to do this. To avoid␍␊ |
2898 | * this the following macros are used in 1.5.6. This is a temporary␍␊ |
2899 | * solution to avoid destabilizing the code during the release process.␍␊ |
2900 | */␍␊ |
2901 | # if PNG_USE_COMPILE_TIME_MASKS␍␊ |
2902 | # define PNG_LSR(x,s) ((x)>>((s) & 0x1f))␍␊ |
2903 | # define PNG_LSL(x,s) ((x)<<((s) & 0x1f))␍␊ |
2904 | # else␍␊ |
2905 | # define PNG_LSR(x,s) ((x)>>(s))␍␊ |
2906 | # define PNG_LSL(x,s) ((x)<<(s))␍␊ |
2907 | # endif␍␊ |
2908 | # define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\␍␊ |
2909 | PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1)␍␊ |
2910 | # define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\␍␊ |
2911 | PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1)␍␊ |
2912 | ␍␊ |
2913 | /* Return a mask for pass 'p' pixel 'x' at depth 'd'. The mask is␍␊ |
2914 | * little endian - the first pixel is at bit 0 - however the extra␍␊ |
2915 | * parameter 's' can be set to cause the mask position to be swapped␍␊ |
2916 | * within each byte, to match the PNG format. This is done by XOR of␍␊ |
2917 | * the shift with 7, 6 or 4 for bit depths 1, 2 and 4.␍␊ |
2918 | */␍␊ |
2919 | # define PIXEL_MASK(p,x,d,s) \␍␊ |
2920 | (PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0))))␍␊ |
2921 | ␍␊ |
2922 | /* Hence generate the appropriate 'block' or 'sparkle' pixel copy mask.␍␊ |
2923 | */␍␊ |
2924 | # define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)␍␊ |
2925 | # define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)␍␊ |
2926 | ␍␊ |
2927 | /* Combine 8 of these to get the full mask. For the 1-bpp and 2-bpp␍␊ |
2928 | * cases the result needs replicating, for the 4-bpp case the above␍␊ |
2929 | * generates a full 32 bits.␍␊ |
2930 | */␍␊ |
2931 | # define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))␍␊ |
2932 | ␍␊ |
2933 | # define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\␍␊ |
2934 | S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\␍␊ |
2935 | S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)␍␊ |
2936 | ␍␊ |
2937 | # define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\␍␊ |
2938 | B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\␍␊ |
2939 | B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)␍␊ |
2940 | ␍␊ |
2941 | #if PNG_USE_COMPILE_TIME_MASKS␍␊ |
2942 | /* Utility macros to construct all the masks for a depth/swap␍␊ |
2943 | * combination. The 's' parameter says whether the format is PNG␍␊ |
2944 | * (big endian bytes) or not. Only the three odd-numbered passes are␍␊ |
2945 | * required for the display/block algorithm.␍␊ |
2946 | */␍␊ |
2947 | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\␍␊ |
2948 | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }␍␊ |
2949 | ␍␊ |
2950 | # define B_MASKS(d,s) { B_MASK(1,d,s), S_MASK(3,d,s), S_MASK(5,d,s) }␍␊ |
2951 | ␍␊ |
2952 | # define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))␍␊ |
2953 | ␍␊ |
2954 | /* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and␍␊ |
2955 | * then pass:␍␊ |
2956 | */␍␊ |
2957 | static PNG_CONST png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] =␍␊ |
2958 | {␍␊ |
2959 | /* Little-endian byte masks for PACKSWAP */␍␊ |
2960 | { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },␍␊ |
2961 | /* Normal (big-endian byte) masks - PNG format */␍␊ |
2962 | { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }␍␊ |
2963 | };␍␊ |
2964 | ␍␊ |
2965 | /* display_mask has only three entries for the odd passes, so index by␍␊ |
2966 | * pass>>1.␍␊ |
2967 | */␍␊ |
2968 | static PNG_CONST png_uint_32 display_mask[2][3][3] =␍␊ |
2969 | {␍␊ |
2970 | /* Little-endian byte masks for PACKSWAP */␍␊ |
2971 | { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },␍␊ |
2972 | /* Normal (big-endian byte) masks - PNG format */␍␊ |
2973 | { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }␍␊ |
2974 | };␍␊ |
2975 | ␍␊ |
2976 | # define MASK(pass,depth,display,png)\␍␊ |
2977 | ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\␍␊ |
2978 | row_mask[png][DEPTH_INDEX(depth)][pass])␍␊ |
2979 | ␍␊ |
2980 | #else /* !PNG_USE_COMPILE_TIME_MASKS */␍␊ |
2981 | /* This is the runtime alternative: it seems unlikely that this will␍␊ |
2982 | * ever be either smaller or faster than the compile time approach.␍␊ |
2983 | */␍␊ |
2984 | # define MASK(pass,depth,display,png)\␍␊ |
2985 | ((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png))␍␊ |
2986 | #endif /* !PNG_USE_COMPILE_TIME_MASKS */␍␊ |
2987 | ␍␊ |
2988 | /* Use the appropriate mask to copy the required bits. In some cases␍␊ |
2989 | * the byte mask will be 0 or 0xff, optimize these cases. row_width is␍␊ |
2990 | * the number of pixels, but the code copies bytes, so it is necessary␍␊ |
2991 | * to special case the end.␍␊ |
2992 | */␍␊ |
2993 | png_uint_32 pixels_per_byte = 8 / pixel_depth;␍␊ |
2994 | png_uint_32 mask;␍␊ |
2995 | ␍␊ |
2996 | # ifdef PNG_READ_PACKSWAP_SUPPORTED␍␊ |
2997 | if (png_ptr->transformations & PNG_PACKSWAP)␍␊ |
2998 | mask = MASK(pass, pixel_depth, display, 0);␍␊ |
2999 | ␍␊ |
3000 | else␍␊ |
3001 | # endif␍␊ |
3002 | mask = MASK(pass, pixel_depth, display, 1);␍␊ |
3003 | ␍␊ |
3004 | for (;;)␍␊ |
3005 | {␍␊ |
3006 | png_uint_32 m;␍␊ |
3007 | ␍␊ |
3008 | /* It doesn't matter in the following if png_uint_32 has more than␍␊ |
3009 | * 32 bits because the high bits always match those in m<<24; it is,␍␊ |
3010 | * however, essential to use OR here, not +, because of this.␍␊ |
3011 | */␍␊ |
3012 | m = mask;␍␊ |
3013 | mask = (m >> 8) | (m << 24); /* rotate right to good compilers */␍␊ |
3014 | m &= 0xff;␍␊ |
3015 | ␍␊ |
3016 | if (m != 0) /* something to copy */␍␊ |
3017 | {␍␊ |
3018 | if (m != 0xff)␍␊ |
3019 | *dp = (png_byte)((*dp & ~m) | (*sp & m));␍␊ |
3020 | else␍␊ |
3021 | *dp = *sp;␍␊ |
3022 | }␍␊ |
3023 | ␍␊ |
3024 | /* NOTE: this may overwrite the last byte with garbage if the image␍␊ |
3025 | * is not an exact number of bytes wide; libpng has always done␍␊ |
3026 | * this.␍␊ |
3027 | */␍␊ |
3028 | if (row_width <= pixels_per_byte)␍␊ |
3029 | break; /* May need to restore part of the last byte */␍␊ |
3030 | ␍␊ |
3031 | row_width -= pixels_per_byte;␍␊ |
3032 | ++dp;␍␊ |
3033 | ++sp;␍␊ |
3034 | }␍␊ |
3035 | }␍␊ |
3036 | ␍␊ |
3037 | else /* pixel_depth >= 8 */␍␊ |
3038 | {␍␊ |
3039 | unsigned int bytes_to_copy, bytes_to_jump;␍␊ |
3040 | ␍␊ |
3041 | /* Validate the depth - it must be a multiple of 8 */␍␊ |
3042 | if (pixel_depth & 7)␍␊ |
3043 | png_error(png_ptr, "invalid user transform pixel depth");␍␊ |
3044 | ␍␊ |
3045 | pixel_depth >>= 3; /* now in bytes */␍␊ |
3046 | row_width *= pixel_depth;␍␊ |
3047 | ␍␊ |
3048 | /* Regardless of pass number the Adam 7 interlace always results in a␍␊ |
3049 | * fixed number of pixels to copy then to skip. There may be a␍␊ |
3050 | * different number of pixels to skip at the start though.␍␊ |
3051 | */␍␊ |
3052 | {␍␊ |
3053 | unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth;␍␊ |
3054 | ␍␊ |
3055 | row_width -= offset;␍␊ |
3056 | dp += offset;␍␊ |
3057 | sp += offset;␍␊ |
3058 | }␍␊ |
3059 | ␍␊ |
3060 | /* Work out the bytes to copy. */␍␊ |
3061 | if (display)␍␊ |
3062 | {␍␊ |
3063 | /* When doing the 'block' algorithm the pixel in the pass gets␍␊ |
3064 | * replicated to adjacent pixels. This is why the even (0,2,4,6)␍␊ |
3065 | * passes are skipped above - the entire expanded row is copied.␍␊ |
3066 | */␍␊ |
3067 | bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth;␍␊ |
3068 | ␍␊ |
3069 | /* But don't allow this number to exceed the actual row width. */␍␊ |
3070 | if (bytes_to_copy > row_width)␍␊ |
3071 | bytes_to_copy = row_width;␍␊ |
3072 | }␍␊ |
3073 | ␍␊ |
3074 | else /* normal row; Adam7 only ever gives us one pixel to copy. */␍␊ |
3075 | bytes_to_copy = pixel_depth;␍␊ |
3076 | ␍␊ |
3077 | /* In Adam7 there is a constant offset between where the pixels go. */␍␊ |
3078 | bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;␍␊ |
3079 | ␍␊ |
3080 | /* And simply copy these bytes. Some optimization is possible here,␍␊ |
3081 | * depending on the value of 'bytes_to_copy'. Special case the low␍␊ |
3082 | * byte counts, which we know to be frequent.␍␊ |
3083 | *␍␊ |
3084 | * Notice that these cases all 'return' rather than 'break' - this␍␊ |
3085 | * avoids an unnecessary test on whether to restore the last byte␍␊ |
3086 | * below.␍␊ |
3087 | */␍␊ |
3088 | switch (bytes_to_copy)␍␊ |
3089 | {␍␊ |
3090 | case 1:␍␊ |
3091 | for (;;)␍␊ |
3092 | {␍␊ |
3093 | *dp = *sp;␍␊ |
3094 | ␍␊ |
3095 | if (row_width <= bytes_to_jump)␍␊ |
3096 | return;␍␊ |
3097 | ␍␊ |
3098 | dp += bytes_to_jump;␍␊ |
3099 | sp += bytes_to_jump;␍␊ |
3100 | row_width -= bytes_to_jump;␍␊ |
3101 | }␍␊ |
3102 | ␍␊ |
3103 | case 2:␍␊ |
3104 | /* There is a possibility of a partial copy at the end here; this␍␊ |
3105 | * slows the code down somewhat.␍␊ |
3106 | */␍␊ |
3107 | do␍␊ |
3108 | {␍␊ |
3109 | dp[0] = sp[0], dp[1] = sp[1];␍␊ |
3110 | ␍␊ |
3111 | if (row_width <= bytes_to_jump)␍␊ |
3112 | return;␍␊ |
3113 | ␍␊ |
3114 | sp += bytes_to_jump;␍␊ |
3115 | dp += bytes_to_jump;␍␊ |
3116 | row_width -= bytes_to_jump;␍␊ |
3117 | }␍␊ |
3118 | while (row_width > 1);␍␊ |
3119 | ␍␊ |
3120 | /* And there can only be one byte left at this point: */␍␊ |
3121 | *dp = *sp;␍␊ |
3122 | return;␍␊ |
3123 | ␍␊ |
3124 | case 3:␍␊ |
3125 | /* This can only be the RGB case, so each copy is exactly one␍␊ |
3126 | * pixel and it is not necessary to check for a partial copy.␍␊ |
3127 | */␍␊ |
3128 | for(;;)␍␊ |
3129 | {␍␊ |
3130 | dp[0] = sp[0], dp[1] = sp[1], dp[2] = sp[2];␍␊ |
3131 | ␍␊ |
3132 | if (row_width <= bytes_to_jump)␍␊ |
3133 | return;␍␊ |
3134 | ␍␊ |
3135 | sp += bytes_to_jump;␍␊ |
3136 | dp += bytes_to_jump;␍␊ |
3137 | row_width -= bytes_to_jump;␍␊ |
3138 | }␍␊ |
3139 | ␍␊ |
3140 | default:␍␊ |
3141 | #if PNG_ALIGN_TYPE != PNG_ALIGN_NONE␍␊ |
3142 | /* Check for double byte alignment and, if possible, use a␍␊ |
3143 | * 16-bit copy. Don't attempt this for narrow images - ones that␍␊ |
3144 | * are less than an interlace panel wide. Don't attempt it for␍␊ |
3145 | * wide bytes_to_copy either - use the png_memcpy there.␍␊ |
3146 | */␍␊ |
3147 | if (bytes_to_copy < 16 /*else use png_memcpy*/ &&␍␊ |
3148 | png_isaligned(dp, png_uint_16) &&␍␊ |
3149 | png_isaligned(sp, png_uint_16) &&␍␊ |
3150 | bytes_to_copy % sizeof (png_uint_16) == 0 &&␍␊ |
3151 | bytes_to_jump % sizeof (png_uint_16) == 0)␍␊ |
3152 | {␍␊ |
3153 | /* Everything is aligned for png_uint_16 copies, but try for␍␊ |
3154 | * png_uint_32 first.␍␊ |
3155 | */␍␊ |
3156 | if (png_isaligned(dp, png_uint_32) &&␍␊ |
3157 | png_isaligned(sp, png_uint_32) &&␍␊ |
3158 | bytes_to_copy % sizeof (png_uint_32) == 0 &&␍␊ |
3159 | bytes_to_jump % sizeof (png_uint_32) == 0)␍␊ |
3160 | {␍␊ |
3161 | png_uint_32p dp32 = (png_uint_32p)dp;␍␊ |
3162 | png_const_uint_32p sp32 = (png_const_uint_32p)sp;␍␊ |
3163 | unsigned int skip = (bytes_to_jump-bytes_to_copy) /␍␊ |
3164 | sizeof (png_uint_32);␍␊ |
3165 | ␍␊ |
3166 | do␍␊ |
3167 | {␍␊ |
3168 | size_t c = bytes_to_copy;␍␊ |
3169 | do␍␊ |
3170 | {␍␊ |
3171 | *dp32++ = *sp32++;␍␊ |
3172 | c -= sizeof (png_uint_32);␍␊ |
3173 | }␍␊ |
3174 | while (c > 0);␍␊ |
3175 | ␍␊ |
3176 | if (row_width <= bytes_to_jump)␍␊ |
3177 | return;␍␊ |
3178 | ␍␊ |
3179 | dp32 += skip;␍␊ |
3180 | sp32 += skip;␍␊ |
3181 | row_width -= bytes_to_jump;␍␊ |
3182 | }␍␊ |
3183 | while (bytes_to_copy <= row_width);␍␊ |
3184 | ␍␊ |
3185 | /* Get to here when the row_width truncates the final copy.␍␊ |
3186 | * There will be 1-3 bytes left to copy, so don't try the␍␊ |
3187 | * 16-bit loop below.␍␊ |
3188 | */␍␊ |
3189 | dp = (png_bytep)dp32;␍␊ |
3190 | sp = (png_const_bytep)sp32;␍␊ |
3191 | do␍␊ |
3192 | *dp++ = *sp++;␍␊ |
3193 | while (--row_width > 0);␍␊ |
3194 | return;␍␊ |
3195 | }␍␊ |
3196 | ␍␊ |
3197 | /* Else do it in 16-bit quantities, but only if the size is␍␊ |
3198 | * not too large.␍␊ |
3199 | */␍␊ |
3200 | else␍␊ |
3201 | {␍␊ |
3202 | png_uint_16p dp16 = (png_uint_16p)dp;␍␊ |
3203 | png_const_uint_16p sp16 = (png_const_uint_16p)sp;␍␊ |
3204 | unsigned int skip = (bytes_to_jump-bytes_to_copy) /␍␊ |
3205 | sizeof (png_uint_16);␍␊ |
3206 | ␍␊ |
3207 | do␍␊ |
3208 | {␍␊ |
3209 | size_t c = bytes_to_copy;␍␊ |
3210 | do␍␊ |
3211 | {␍␊ |
3212 | *dp16++ = *sp16++;␍␊ |
3213 | c -= sizeof (png_uint_16);␍␊ |
3214 | }␍␊ |
3215 | while (c > 0);␍␊ |
3216 | ␍␊ |
3217 | if (row_width <= bytes_to_jump)␍␊ |
3218 | return;␍␊ |
3219 | ␍␊ |
3220 | dp16 += skip;␍␊ |
3221 | sp16 += skip;␍␊ |
3222 | row_width -= bytes_to_jump;␍␊ |
3223 | }␍␊ |
3224 | while (bytes_to_copy <= row_width);␍␊ |
3225 | ␍␊ |
3226 | /* End of row - 1 byte left, bytes_to_copy > row_width: */␍␊ |
3227 | dp = (png_bytep)dp16;␍␊ |
3228 | sp = (png_const_bytep)sp16;␍␊ |
3229 | do␍␊ |
3230 | *dp++ = *sp++;␍␊ |
3231 | while (--row_width > 0);␍␊ |
3232 | return;␍␊ |
3233 | }␍␊ |
3234 | }␍␊ |
3235 | #endif /* PNG_ALIGN_ code */␍␊ |
3236 | ␍␊ |
3237 | /* The true default - use a png_memcpy: */␍␊ |
3238 | for (;;)␍␊ |
3239 | {␍␊ |
3240 | png_memcpy(dp, sp, bytes_to_copy);␍␊ |
3241 | ␍␊ |
3242 | if (row_width <= bytes_to_jump)␍␊ |
3243 | return;␍␊ |
3244 | ␍␊ |
3245 | sp += bytes_to_jump;␍␊ |
3246 | dp += bytes_to_jump;␍␊ |
3247 | row_width -= bytes_to_jump;␍␊ |
3248 | if (bytes_to_copy > row_width)␍␊ |
3249 | bytes_to_copy = row_width;␍␊ |
3250 | }␍␊ |
3251 | }␍␊ |
3252 | ␍␊ |
3253 | /* NOT REACHED*/␍␊ |
3254 | } /* pixel_depth >= 8 */␍␊ |
3255 | ␍␊ |
3256 | /* Here if pixel_depth < 8 to check 'end_ptr' below. */␍␊ |
3257 | }␍␊ |
3258 | else␍␊ |
3259 | #endif␍␊ |
3260 | ␍␊ |
3261 | /* If here then the switch above wasn't used so just png_memcpy the whole row␍␊ |
3262 | * from the temporary row buffer (notice that this overwrites the end of the␍␊ |
3263 | * destination row if it is a partial byte.)␍␊ |
3264 | */␍␊ |
3265 | png_memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width));␍␊ |
3266 | ␍␊ |
3267 | /* Restore the overwritten bits from the last byte if necessary. */␍␊ |
3268 | if (end_ptr != NULL)␍␊ |
3269 | *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask));␍␊ |
3270 | }␍␊ |
3271 | ␍␊ |
3272 | #ifdef PNG_READ_INTERLACING_SUPPORTED␍␊ |
3273 | void /* PRIVATE */␍␊ |
3274 | png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,␍␊ |
3275 | png_uint_32 transformations /* Because these may affect the byte layout */)␍␊ |
3276 | {␍␊ |
3277 | /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */␍␊ |
3278 | /* Offset to next interlace block */␍␊ |
3279 | static PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};␍␊ |
3280 | ␍␊ |
3281 | png_debug(1, "in png_do_read_interlace");␍␊ |
3282 | if (row != NULL && row_info != NULL)␍␊ |
3283 | {␍␊ |
3284 | png_uint_32 final_width;␍␊ |
3285 | ␍␊ |
3286 | final_width = row_info->width * png_pass_inc[pass];␍␊ |
3287 | ␍␊ |
3288 | switch (row_info->pixel_depth)␍␊ |
3289 | {␍␊ |
3290 | case 1:␍␊ |
3291 | {␍␊ |
3292 | png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 3);␍␊ |
3293 | png_bytep dp = row + (png_size_t)((final_width - 1) >> 3);␍␊ |
3294 | int sshift, dshift;␍␊ |
3295 | int s_start, s_end, s_inc;␍␊ |
3296 | int jstop = png_pass_inc[pass];␍␊ |
3297 | png_byte v;␍␊ |
3298 | png_uint_32 i;␍␊ |
3299 | int j;␍␊ |
3300 | ␍␊ |
3301 | #ifdef PNG_READ_PACKSWAP_SUPPORTED␍␊ |
3302 | if (transformations & PNG_PACKSWAP)␍␊ |
3303 | {␍␊ |
3304 | sshift = (int)((row_info->width + 7) & 0x07);␍␊ |
3305 | dshift = (int)((final_width + 7) & 0x07);␍␊ |
3306 | s_start = 7;␍␊ |
3307 | s_end = 0;␍␊ |
3308 | s_inc = -1;␍␊ |
3309 | }␍␊ |
3310 | ␍␊ |
3311 | else␍␊ |
3312 | #endif␍␊ |
3313 | {␍␊ |
3314 | sshift = 7 - (int)((row_info->width + 7) & 0x07);␍␊ |
3315 | dshift = 7 - (int)((final_width + 7) & 0x07);␍␊ |
3316 | s_start = 0;␍␊ |
3317 | s_end = 7;␍␊ |
3318 | s_inc = 1;␍␊ |
3319 | }␍␊ |
3320 | ␍␊ |
3321 | for (i = 0; i < row_info->width; i++)␍␊ |
3322 | {␍␊ |
3323 | v = (png_byte)((*sp >> sshift) & 0x01);␍␊ |
3324 | for (j = 0; j < jstop; j++)␍␊ |
3325 | {␍␊ |
3326 | *dp &= (png_byte)((0x7f7f >> (7 - dshift)) & 0xff);␍␊ |
3327 | *dp |= (png_byte)(v << dshift);␍␊ |
3328 | ␍␊ |
3329 | if (dshift == s_end)␍␊ |
3330 | {␍␊ |
3331 | dshift = s_start;␍␊ |
3332 | dp--;␍␊ |
3333 | }␍␊ |
3334 | ␍␊ |
3335 | else␍␊ |
3336 | dshift += s_inc;␍␊ |
3337 | }␍␊ |
3338 | ␍␊ |
3339 | if (sshift == s_end)␍␊ |
3340 | {␍␊ |
3341 | sshift = s_start;␍␊ |
3342 | sp--;␍␊ |
3343 | }␍␊ |
3344 | ␍␊ |
3345 | else␍␊ |
3346 | sshift += s_inc;␍␊ |
3347 | }␍␊ |
3348 | break;␍␊ |
3349 | }␍␊ |
3350 | ␍␊ |
3351 | case 2:␍␊ |
3352 | {␍␊ |
3353 | png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2);␍␊ |
3354 | png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2);␍␊ |
3355 | int sshift, dshift;␍␊ |
3356 | int s_start, s_end, s_inc;␍␊ |
3357 | int jstop = png_pass_inc[pass];␍␊ |
3358 | png_uint_32 i;␍␊ |
3359 | ␍␊ |
3360 | #ifdef PNG_READ_PACKSWAP_SUPPORTED␍␊ |
3361 | if (transformations & PNG_PACKSWAP)␍␊ |
3362 | {␍␊ |
3363 | sshift = (int)(((row_info->width + 3) & 0x03) << 1);␍␊ |
3364 | dshift = (int)(((final_width + 3) & 0x03) << 1);␍␊ |
3365 | s_start = 6;␍␊ |
3366 | s_end = 0;␍␊ |
3367 | s_inc = -2;␍␊ |
3368 | }␍␊ |
3369 | ␍␊ |
3370 | else␍␊ |
3371 | #endif␍␊ |
3372 | {␍␊ |
3373 | sshift = (int)((3 - ((row_info->width + 3) & 0x03)) << 1);␍␊ |
3374 | dshift = (int)((3 - ((final_width + 3) & 0x03)) << 1);␍␊ |
3375 | s_start = 0;␍␊ |
3376 | s_end = 6;␍␊ |
3377 | s_inc = 2;␍␊ |
3378 | }␍␊ |
3379 | ␍␊ |
3380 | for (i = 0; i < row_info->width; i++)␍␊ |
3381 | {␍␊ |
3382 | png_byte v;␍␊ |
3383 | int j;␍␊ |
3384 | ␍␊ |
3385 | v = (png_byte)((*sp >> sshift) & 0x03);␍␊ |
3386 | for (j = 0; j < jstop; j++)␍␊ |
3387 | {␍␊ |
3388 | *dp &= (png_byte)((0x3f3f >> (6 - dshift)) & 0xff);␍␊ |
3389 | *dp |= (png_byte)(v << dshift);␍␊ |
3390 | ␍␊ |
3391 | if (dshift == s_end)␍␊ |
3392 | {␍␊ |
3393 | dshift = s_start;␍␊ |
3394 | dp--;␍␊ |
3395 | }␍␊ |
3396 | ␍␊ |
3397 | else␍␊ |
3398 | dshift += s_inc;␍␊ |
3399 | }␍␊ |
3400 | ␍␊ |
3401 | if (sshift == s_end)␍␊ |
3402 | {␍␊ |
3403 | sshift = s_start;␍␊ |
3404 | sp--;␍␊ |
3405 | }␍␊ |
3406 | ␍␊ |
3407 | else␍␊ |
3408 | sshift += s_inc;␍␊ |
3409 | }␍␊ |
3410 | break;␍␊ |
3411 | }␍␊ |
3412 | ␍␊ |
3413 | case 4:␍␊ |
3414 | {␍␊ |
3415 | png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 1);␍␊ |
3416 | png_bytep dp = row + (png_size_t)((final_width - 1) >> 1);␍␊ |
3417 | int sshift, dshift;␍␊ |
3418 | int s_start, s_end, s_inc;␍␊ |
3419 | png_uint_32 i;␍␊ |
3420 | int jstop = png_pass_inc[pass];␍␊ |
3421 | ␍␊ |
3422 | #ifdef PNG_READ_PACKSWAP_SUPPORTED␍␊ |
3423 | if (transformations & PNG_PACKSWAP)␍␊ |
3424 | {␍␊ |
3425 | sshift = (int)(((row_info->width + 1) & 0x01) << 2);␍␊ |
3426 | dshift = (int)(((final_width + 1) & 0x01) << 2);␍␊ |
3427 | s_start = 4;␍␊ |
3428 | s_end = 0;␍␊ |
3429 | s_inc = -4;␍␊ |
3430 | }␍␊ |
3431 | ␍␊ |
3432 | else␍␊ |
3433 | #endif␍␊ |
3434 | {␍␊ |
3435 | sshift = (int)((1 - ((row_info->width + 1) & 0x01)) << 2);␍␊ |
3436 | dshift = (int)((1 - ((final_width + 1) & 0x01)) << 2);␍␊ |
3437 | s_start = 0;␍␊ |
3438 | s_end = 4;␍␊ |
3439 | s_inc = 4;␍␊ |
3440 | }␍␊ |
3441 | ␍␊ |
3442 | for (i = 0; i < row_info->width; i++)␍␊ |
3443 | {␍␊ |
3444 | png_byte v = (png_byte)((*sp >> sshift) & 0x0f);␍␊ |
3445 | int j;␍␊ |
3446 | ␍␊ |
3447 | for (j = 0; j < jstop; j++)␍␊ |
3448 | {␍␊ |
3449 | *dp &= (png_byte)((0xf0f >> (4 - dshift)) & 0xff);␍␊ |
3450 | *dp |= (png_byte)(v << dshift);␍␊ |
3451 | ␍␊ |
3452 | if (dshift == s_end)␍␊ |
3453 | {␍␊ |
3454 | dshift = s_start;␍␊ |
3455 | dp--;␍␊ |
3456 | }␍␊ |
3457 | ␍␊ |
3458 | else␍␊ |
3459 | dshift += s_inc;␍␊ |
3460 | }␍␊ |
3461 | ␍␊ |
3462 | if (sshift == s_end)␍␊ |
3463 | {␍␊ |
3464 | sshift = s_start;␍␊ |
3465 | sp--;␍␊ |
3466 | }␍␊ |
3467 | ␍␊ |
3468 | else␍␊ |
3469 | sshift += s_inc;␍␊ |
3470 | }␍␊ |
3471 | break;␍␊ |
3472 | }␍␊ |
3473 | ␍␊ |
3474 | default:␍␊ |
3475 | {␍␊ |
3476 | png_size_t pixel_bytes = (row_info->pixel_depth >> 3);␍␊ |
3477 | ␍␊ |
3478 | png_bytep sp = row + (png_size_t)(row_info->width - 1)␍␊ |
3479 | * pixel_bytes;␍␊ |
3480 | ␍␊ |
3481 | png_bytep dp = row + (png_size_t)(final_width - 1) * pixel_bytes;␍␊ |
3482 | ␍␊ |
3483 | int jstop = png_pass_inc[pass];␍␊ |
3484 | png_uint_32 i;␍␊ |
3485 | ␍␊ |
3486 | for (i = 0; i < row_info->width; i++)␍␊ |
3487 | {␍␊ |
3488 | png_byte v[8];␍␊ |
3489 | int j;␍␊ |
3490 | ␍␊ |
3491 | png_memcpy(v, sp, pixel_bytes);␍␊ |
3492 | ␍␊ |
3493 | for (j = 0; j < jstop; j++)␍␊ |
3494 | {␍␊ |
3495 | png_memcpy(dp, v, pixel_bytes);␍␊ |
3496 | dp -= pixel_bytes;␍␊ |
3497 | }␍␊ |
3498 | ␍␊ |
3499 | sp -= pixel_bytes;␍␊ |
3500 | }␍␊ |
3501 | break;␍␊ |
3502 | }␍␊ |
3503 | }␍␊ |
3504 | ␍␊ |
3505 | row_info->width = final_width;␍␊ |
3506 | row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);␍␊ |
3507 | }␍␊ |
3508 | #ifndef PNG_READ_PACKSWAP_SUPPORTED␍␊ |
3509 | PNG_UNUSED(transformations) /* Silence compiler warning */␍␊ |
3510 | #endif␍␊ |
3511 | }␍␊ |
3512 | #endif /* PNG_READ_INTERLACING_SUPPORTED */␍␊ |
3513 | ␍␊ |
3514 | static void␍␊ |
3515 | png_read_filter_row_sub(png_row_infop row_info, png_bytep row,␍␊ |
3516 | png_const_bytep prev_row)␍␊ |
3517 | {␍␊ |
3518 | png_size_t i;␍␊ |
3519 | png_size_t istop = row_info->rowbytes;␍␊ |
3520 | unsigned int bpp = (row_info->pixel_depth + 7) >> 3;␍␊ |
3521 | png_bytep rp = row + bpp;␍␊ |
3522 | ␍␊ |
3523 | PNG_UNUSED(prev_row)␍␊ |
3524 | ␍␊ |
3525 | for (i = bpp; i < istop; i++)␍␊ |
3526 | {␍␊ |
3527 | *rp = (png_byte)(((int)(*rp) + (int)(*(rp-bpp))) & 0xff);␍␊ |
3528 | rp++;␍␊ |
3529 | }␍␊ |
3530 | }␍␊ |
3531 | ␍␊ |
3532 | static void␍␊ |
3533 | png_read_filter_row_up(png_row_infop row_info, png_bytep row,␍␊ |
3534 | png_const_bytep prev_row)␍␊ |
3535 | {␍␊ |
3536 | png_size_t i;␍␊ |
3537 | png_size_t istop = row_info->rowbytes;␍␊ |
3538 | png_bytep rp = row;␍␊ |
3539 | png_const_bytep pp = prev_row;␍␊ |
3540 | ␍␊ |
3541 | for (i = 0; i < istop; i++)␍␊ |
3542 | {␍␊ |
3543 | *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff);␍␊ |
3544 | rp++;␍␊ |
3545 | }␍␊ |
3546 | }␍␊ |
3547 | ␍␊ |
3548 | static void␍␊ |
3549 | png_read_filter_row_avg(png_row_infop row_info, png_bytep row,␍␊ |
3550 | png_const_bytep prev_row)␍␊ |
3551 | {␍␊ |
3552 | png_size_t i;␍␊ |
3553 | png_bytep rp = row;␍␊ |
3554 | png_const_bytep pp = prev_row;␍␊ |
3555 | unsigned int bpp = (row_info->pixel_depth + 7) >> 3;␍␊ |
3556 | png_size_t istop = row_info->rowbytes - bpp;␍␊ |
3557 | ␍␊ |
3558 | for (i = 0; i < bpp; i++)␍␊ |
3559 | {␍␊ |
3560 | *rp = (png_byte)(((int)(*rp) +␍␊ |
3561 | ((int)(*pp++) / 2 )) & 0xff);␍␊ |
3562 | ␍␊ |
3563 | rp++;␍␊ |
3564 | }␍␊ |
3565 | ␍␊ |
3566 | for (i = 0; i < istop; i++)␍␊ |
3567 | {␍␊ |
3568 | *rp = (png_byte)(((int)(*rp) +␍␊ |
3569 | (int)(*pp++ + *(rp-bpp)) / 2 ) & 0xff);␍␊ |
3570 | ␍␊ |
3571 | rp++;␍␊ |
3572 | }␍␊ |
3573 | }␍␊ |
3574 | ␍␊ |
3575 | static void␍␊ |
3576 | png_read_filter_row_paeth_1byte_pixel(png_row_infop row_info, png_bytep row,␍␊ |
3577 | png_const_bytep prev_row)␍␊ |
3578 | {␍␊ |
3579 | png_bytep rp_end = row + row_info->rowbytes;␍␊ |
3580 | int a, c;␍␊ |
3581 | ␍␊ |
3582 | /* First pixel/byte */␍␊ |
3583 | c = *prev_row++;␍␊ |
3584 | a = *row + c;␍␊ |
3585 | *row++ = (png_byte)a;␍␊ |
3586 | ␍␊ |
3587 | /* Remainder */␍␊ |
3588 | while (row < rp_end)␍␊ |
3589 | {␍␊ |
3590 | int b, pa, pb, pc, p;␍␊ |
3591 | ␍␊ |
3592 | a &= 0xff; /* From previous iteration or start */␍␊ |
3593 | b = *prev_row++;␍␊ |
3594 | ␍␊ |
3595 | p = b - c;␍␊ |
3596 | pc = a - c;␍␊ |
3597 | ␍␊ |
3598 | # ifdef PNG_USE_ABS␍␊ |
3599 | pa = abs(p);␍␊ |
3600 | pb = abs(pc);␍␊ |
3601 | pc = abs(p + pc);␍␊ |
3602 | # else␍␊ |
3603 | pa = p < 0 ? -p : p;␍␊ |
3604 | pb = pc < 0 ? -pc : pc;␍␊ |
3605 | pc = (p + pc) < 0 ? -(p + pc) : p + pc;␍␊ |
3606 | # endif␍␊ |
3607 | ␍␊ |
3608 | /* Find the best predictor, the least of pa, pb, pc favoring the earlier␍␊ |
3609 | * ones in the case of a tie.␍␊ |
3610 | */␍␊ |
3611 | if (pb < pa) pa = pb, a = b;␍␊ |
3612 | if (pc < pa) a = c;␍␊ |
3613 | ␍␊ |
3614 | /* Calculate the current pixel in a, and move the previous row pixel to c␍␊ |
3615 | * for the next time round the loop␍␊ |
3616 | */␍␊ |
3617 | c = b;␍␊ |
3618 | a += *row;␍␊ |
3619 | *row++ = (png_byte)a;␍␊ |
3620 | }␍␊ |
3621 | }␍␊ |
3622 | ␍␊ |
3623 | static void␍␊ |
3624 | png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,␍␊ |
3625 | png_const_bytep prev_row)␍␊ |
3626 | {␍␊ |
3627 | int bpp = (row_info->pixel_depth + 7) >> 3;␍␊ |
3628 | png_bytep rp_end = row + bpp;␍␊ |
3629 | ␍␊ |
3630 | /* Process the first pixel in the row completely (this is the same as 'up'␍␊ |
3631 | * because there is only one candidate predictor for the first row).␍␊ |
3632 | */␍␊ |
3633 | while (row < rp_end)␍␊ |
3634 | {␍␊ |
3635 | int a = *row + *prev_row++;␍␊ |
3636 | *row++ = (png_byte)a;␍␊ |
3637 | }␍␊ |
3638 | ␍␊ |
3639 | /* Remainder */␍␊ |
3640 | rp_end += row_info->rowbytes - bpp;␍␊ |
3641 | ␍␊ |
3642 | while (row < rp_end)␍␊ |
3643 | {␍␊ |
3644 | int a, b, c, pa, pb, pc, p;␍␊ |
3645 | ␍␊ |
3646 | c = *(prev_row - bpp);␍␊ |
3647 | a = *(row - bpp);␍␊ |
3648 | b = *prev_row++;␍␊ |
3649 | ␍␊ |
3650 | p = b - c;␍␊ |
3651 | pc = a - c;␍␊ |
3652 | ␍␊ |
3653 | # ifdef PNG_USE_ABS␍␊ |
3654 | pa = abs(p);␍␊ |
3655 | pb = abs(pc);␍␊ |
3656 | pc = abs(p + pc);␍␊ |
3657 | # else␍␊ |
3658 | pa = p < 0 ? -p : p;␍␊ |
3659 | pb = pc < 0 ? -pc : pc;␍␊ |
3660 | pc = (p + pc) < 0 ? -(p + pc) : p + pc;␍␊ |
3661 | # endif␍␊ |
3662 | ␍␊ |
3663 | if (pb < pa) pa = pb, a = b;␍␊ |
3664 | if (pc < pa) a = c;␍␊ |
3665 | #if 0␍␊ |
3666 | c = b;␍␊ |
3667 | #endif␍␊ |
3668 | a += *row;␍␊ |
3669 | *row++ = (png_byte)a;␍␊ |
3670 | }␍␊ |
3671 | }␍␊ |
3672 | ␍␊ |
3673 | #ifdef PNG_ARM_NEON␍␊ |
3674 | ␍␊ |
3675 | #ifdef __linux__␍␊ |
3676 | #include <stdio.h>␍␊ |
3677 | #include <elf.h>␍␊ |
3678 | #include <asm/hwcap.h>␍␊ |
3679 | ␍␊ |
3680 | static int png_have_hwcap(unsigned cap)␍␊ |
3681 | {␍␊ |
3682 | FILE *f = fopen("/proc/self/auxv", "r");␍␊ |
3683 | Elf32_auxv_t aux;␍␊ |
3684 | int have_cap = 0;␍␊ |
3685 | ␍␊ |
3686 | if (!f)␍␊ |
3687 | return 0;␍␊ |
3688 | ␍␊ |
3689 | while (fread(&aux, sizeof(aux), 1, f) > 0)␍␊ |
3690 | {␍␊ |
3691 | if (aux.a_type == AT_HWCAP &&␍␊ |
3692 | aux.a_un.a_val & cap)␍␊ |
3693 | {␍␊ |
3694 | have_cap = 1;␍␊ |
3695 | break;␍␊ |
3696 | }␍␊ |
3697 | }␍␊ |
3698 | ␍␊ |
3699 | fclose(f);␍␊ |
3700 | ␍␊ |
3701 | return have_cap;␍␊ |
3702 | }␍␊ |
3703 | #endif /* __linux__ */␍␊ |
3704 | ␍␊ |
3705 | static void␍␊ |
3706 | png_init_filter_functions_neon(png_structp pp, unsigned int bpp)␍␊ |
3707 | {␍␊ |
3708 | #ifdef __linux__␍␊ |
3709 | if (!png_have_hwcap(HWCAP_NEON))␍␊ |
3710 | return;␍␊ |
3711 | #endif␍␊ |
3712 | ␍␊ |
3713 | pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up_neon;␍␊ |
3714 | ␍␊ |
3715 | if (bpp == 3)␍␊ |
3716 | {␍␊ |
3717 | pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub3_neon;␍␊ |
3718 | pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg3_neon;␍␊ |
3719 | pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =␍␊ |
3720 | png_read_filter_row_paeth3_neon;␍␊ |
3721 | }␍␊ |
3722 | ␍␊ |
3723 | else if (bpp == 4)␍␊ |
3724 | {␍␊ |
3725 | pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub4_neon;␍␊ |
3726 | pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg4_neon;␍␊ |
3727 | pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =␍␊ |
3728 | png_read_filter_row_paeth4_neon;␍␊ |
3729 | }␍␊ |
3730 | }␍␊ |
3731 | #endif /* PNG_ARM_NEON */␍␊ |
3732 | ␍␊ |
3733 | static void␍␊ |
3734 | png_init_filter_functions(png_structp pp)␍␊ |
3735 | {␍␊ |
3736 | unsigned int bpp = (pp->pixel_depth + 7) >> 3;␍␊ |
3737 | ␍␊ |
3738 | pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub;␍␊ |
3739 | pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up;␍␊ |
3740 | pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg;␍␊ |
3741 | if (bpp == 1)␍␊ |
3742 | pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =␍␊ |
3743 | png_read_filter_row_paeth_1byte_pixel;␍␊ |
3744 | else␍␊ |
3745 | pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =␍␊ |
3746 | png_read_filter_row_paeth_multibyte_pixel;␍␊ |
3747 | ␍␊ |
3748 | #ifdef PNG_ARM_NEON␍␊ |
3749 | png_init_filter_functions_neon(pp, bpp);␍␊ |
3750 | #endif␍␊ |
3751 | }␍␊ |
3752 | ␍␊ |
3753 | void /* PRIVATE */␍␊ |
3754 | png_read_filter_row(png_structp pp, png_row_infop row_info, png_bytep row,␍␊ |
3755 | png_const_bytep prev_row, int filter)␍␊ |
3756 | {␍␊ |
3757 | if (pp->read_filter[0] == NULL)␍␊ |
3758 | png_init_filter_functions(pp);␍␊ |
3759 | if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)␍␊ |
3760 | pp->read_filter[filter-1](row_info, row, prev_row);␍␊ |
3761 | }␍␊ |
3762 | ␍␊ |
3763 | #ifdef PNG_SEQUENTIAL_READ_SUPPORTED␍␊ |
3764 | void /* PRIVATE */␍␊ |
3765 | png_read_finish_row(png_structp png_ptr)␍␊ |
3766 | {␍␊ |
3767 | #ifdef PNG_READ_INTERLACING_SUPPORTED␍␊ |
3768 | /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */␍␊ |
3769 | ␍␊ |
3770 | /* Start of interlace block */␍␊ |
3771 | static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};␍␊ |
3772 | ␍␊ |
3773 | /* Offset to next interlace block */␍␊ |
3774 | static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};␍␊ |
3775 | ␍␊ |
3776 | /* Start of interlace block in the y direction */␍␊ |
3777 | static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};␍␊ |
3778 | ␍␊ |
3779 | /* Offset to next interlace block in the y direction */␍␊ |
3780 | static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};␍␊ |
3781 | #endif /* PNG_READ_INTERLACING_SUPPORTED */␍␊ |
3782 | ␍␊ |
3783 | png_debug(1, "in png_read_finish_row");␍␊ |
3784 | png_ptr->row_number++;␍␊ |
3785 | if (png_ptr->row_number < png_ptr->num_rows)␍␊ |
3786 | return;␍␊ |
3787 | ␍␊ |
3788 | #ifdef PNG_READ_INTERLACING_SUPPORTED␍␊ |
3789 | if (png_ptr->interlaced)␍␊ |
3790 | {␍␊ |
3791 | png_ptr->row_number = 0;␍␊ |
3792 | ␍␊ |
3793 | /* TO DO: don't do this if prev_row isn't needed (requires␍␊ |
3794 | * read-ahead of the next row's filter byte.␍␊ |
3795 | */␍␊ |
3796 | png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);␍␊ |
3797 | ␍␊ |
3798 | do␍␊ |
3799 | {␍␊ |
3800 | png_ptr->pass++;␍␊ |
3801 | ␍␊ |
3802 | if (png_ptr->pass >= 7)␍␊ |
3803 | break;␍␊ |
3804 | ␍␊ |
3805 | png_ptr->iwidth = (png_ptr->width +␍␊ |
3806 | png_pass_inc[png_ptr->pass] - 1 -␍␊ |
3807 | png_pass_start[png_ptr->pass]) /␍␊ |
3808 | png_pass_inc[png_ptr->pass];␍␊ |
3809 | ␍␊ |
3810 | if (!(png_ptr->transformations & PNG_INTERLACE))␍␊ |
3811 | {␍␊ |
3812 | png_ptr->num_rows = (png_ptr->height +␍␊ |
3813 | png_pass_yinc[png_ptr->pass] - 1 -␍␊ |
3814 | png_pass_ystart[png_ptr->pass]) /␍␊ |
3815 | png_pass_yinc[png_ptr->pass];␍␊ |
3816 | }␍␊ |
3817 | ␍␊ |
3818 | else /* if (png_ptr->transformations & PNG_INTERLACE) */␍␊ |
3819 | break; /* libpng deinterlacing sees every row */␍␊ |
3820 | ␍␊ |
3821 | } while (png_ptr->num_rows == 0 || png_ptr->iwidth == 0);␍␊ |
3822 | ␍␊ |
3823 | if (png_ptr->pass < 7)␍␊ |
3824 | return;␍␊ |
3825 | }␍␊ |
3826 | #endif /* PNG_READ_INTERLACING_SUPPORTED */␍␊ |
3827 | ␍␊ |
3828 | if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))␍␊ |
3829 | {␍␊ |
3830 | char extra;␍␊ |
3831 | int ret;␍␊ |
3832 | ␍␊ |
3833 | png_ptr->zstream.next_out = (Byte *)&extra;␍␊ |
3834 | png_ptr->zstream.avail_out = (uInt)1;␍␊ |
3835 | ␍␊ |
3836 | for (;;)␍␊ |
3837 | {␍␊ |
3838 | if (!(png_ptr->zstream.avail_in))␍␊ |
3839 | {␍␊ |
3840 | while (!png_ptr->idat_size)␍␊ |
3841 | {␍␊ |
3842 | png_crc_finish(png_ptr, 0);␍␊ |
3843 | png_ptr->idat_size = png_read_chunk_header(png_ptr);␍␊ |
3844 | if (png_ptr->chunk_name != png_IDAT)␍␊ |
3845 | png_error(png_ptr, "Not enough image data");␍␊ |
3846 | }␍␊ |
3847 | ␍␊ |
3848 | png_ptr->zstream.avail_in = (uInt)png_ptr->zbuf_size;␍␊ |
3849 | png_ptr->zstream.next_in = png_ptr->zbuf;␍␊ |
3850 | ␍␊ |
3851 | if (png_ptr->zbuf_size > png_ptr->idat_size)␍␊ |
3852 | png_ptr->zstream.avail_in = (uInt)png_ptr->idat_size;␍␊ |
3853 | ␍␊ |
3854 | png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zstream.avail_in);␍␊ |
3855 | png_ptr->idat_size -= png_ptr->zstream.avail_in;␍␊ |
3856 | }␍␊ |
3857 | ␍␊ |
3858 | #if 1␍␊ |
3859 | ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);␍␊ |
3860 | ␍␊ |
3861 | #else␍␊ |
3862 | int flush = Z_PARTIAL_FLUSH;␍␊ |
3863 | execut_hook("inflate", &png_ptr->zstream, &flush, &ret, NULL, NULL, NULL );␍␊ |
3864 | #endif␍␊ |
3865 | if (ret == Z_STREAM_END)␍␊ |
3866 | {␍␊ |
3867 | if (!(png_ptr->zstream.avail_out) || png_ptr->zstream.avail_in ||␍␊ |
3868 | png_ptr->idat_size)␍␊ |
3869 | png_warning(png_ptr, "Extra compressed data");␍␊ |
3870 | ␍␊ |
3871 | png_ptr->mode |= PNG_AFTER_IDAT;␍␊ |
3872 | png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;␍␊ |
3873 | break;␍␊ |
3874 | }␍␊ |
3875 | ␍␊ |
3876 | if (ret != Z_OK)␍␊ |
3877 | png_error(png_ptr, png_ptr->zstream.msg ? png_ptr->zstream.msg :␍␊ |
3878 | "Decompression Error");␍␊ |
3879 | ␍␊ |
3880 | if (!(png_ptr->zstream.avail_out))␍␊ |
3881 | {␍␊ |
3882 | png_warning(png_ptr, "Extra compressed data");␍␊ |
3883 | png_ptr->mode |= PNG_AFTER_IDAT;␍␊ |
3884 | png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;␍␊ |
3885 | break;␍␊ |
3886 | }␍␊ |
3887 | ␍␊ |
3888 | }␍␊ |
3889 | png_ptr->zstream.avail_out = 0;␍␊ |
3890 | }␍␊ |
3891 | ␍␊ |
3892 | if (png_ptr->idat_size || png_ptr->zstream.avail_in)␍␊ |
3893 | png_warning(png_ptr, "Extra compression data");␍␊ |
3894 | ␍␊ |
3895 | #if 1␍␊ |
3896 | inflateReset(&png_ptr->zstream);␍␊ |
3897 | #else␍␊ |
3898 | execut_hook("inflateReset", &png_ptr->zstream NULL, NULL, NULL, NULL, NULL );␍␊ |
3899 | #endif␍␊ |
3900 | png_ptr->mode |= PNG_AFTER_IDAT;␍␊ |
3901 | }␍␊ |
3902 | #endif /* PNG_SEQUENTIAL_READ_SUPPORTED */␍␊ |
3903 | ␍␊ |
3904 | void /* PRIVATE */␍␊ |
3905 | png_read_start_row(png_structp png_ptr)␍␊ |
3906 | {␍␊ |
3907 | #ifdef PNG_READ_INTERLACING_SUPPORTED␍␊ |
3908 | /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */␍␊ |
3909 | ␍␊ |
3910 | /* Start of interlace block */␍␊ |
3911 | static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};␍␊ |
3912 | ␍␊ |
3913 | /* Offset to next interlace block */␍␊ |
3914 | static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};␍␊ |
3915 | ␍␊ |
3916 | /* Start of interlace block in the y direction */␍␊ |
3917 | static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};␍␊ |
3918 | ␍␊ |
3919 | /* Offset to next interlace block in the y direction */␍␊ |
3920 | static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};␍␊ |
3921 | #endif␍␊ |
3922 | ␍␊ |
3923 | int max_pixel_depth;␍␊ |
3924 | png_size_t row_bytes;␍␊ |
3925 | ␍␊ |
3926 | png_debug(1, "in png_read_start_row");␍␊ |
3927 | png_ptr->zstream.avail_in = 0;␍␊ |
3928 | #ifdef PNG_READ_TRANSFORMS_SUPPORTED␍␊ |
3929 | png_init_read_transformations(png_ptr);␍␊ |
3930 | #endif␍␊ |
3931 | #ifdef PNG_READ_INTERLACING_SUPPORTED␍␊ |
3932 | if (png_ptr->interlaced)␍␊ |
3933 | {␍␊ |
3934 | if (!(png_ptr->transformations & PNG_INTERLACE))␍␊ |
3935 | png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -␍␊ |
3936 | png_pass_ystart[0]) / png_pass_yinc[0];␍␊ |
3937 | ␍␊ |
3938 | else␍␊ |
3939 | png_ptr->num_rows = png_ptr->height;␍␊ |
3940 | ␍␊ |
3941 | png_ptr->iwidth = (png_ptr->width +␍␊ |
3942 | png_pass_inc[png_ptr->pass] - 1 -␍␊ |
3943 | png_pass_start[png_ptr->pass]) /␍␊ |
3944 | png_pass_inc[png_ptr->pass];␍␊ |
3945 | }␍␊ |
3946 | ␍␊ |
3947 | else␍␊ |
3948 | #endif /* PNG_READ_INTERLACING_SUPPORTED */␍␊ |
3949 | {␍␊ |
3950 | png_ptr->num_rows = png_ptr->height;␍␊ |
3951 | png_ptr->iwidth = png_ptr->width;␍␊ |
3952 | }␍␊ |
3953 | ␍␊ |
3954 | max_pixel_depth = png_ptr->pixel_depth;␍␊ |
3955 | ␍␊ |
3956 | /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpliar set of␍␊ |
3957 | * calculations to calculate the final pixel depth, then␍␊ |
3958 | * png_do_read_transforms actually does the transforms. This means that the␍␊ |
3959 | * code which effectively calculates this value is actually repeated in three␍␊ |
3960 | * separate places. They must all match. Innocent changes to the order of␍␊ |
3961 | * transformations can and will break libpng in a way that causes memory␍␊ |
3962 | * overwrites.␍␊ |
3963 | *␍␊ |
3964 | * TODO: fix this.␍␊ |
3965 | */␍␊ |
3966 | #ifdef PNG_READ_PACK_SUPPORTED␍␊ |
3967 | if ((png_ptr->transformations & PNG_PACK) && png_ptr->bit_depth < 8)␍␊ |
3968 | max_pixel_depth = 8;␍␊ |
3969 | #endif␍␊ |
3970 | ␍␊ |
3971 | #ifdef PNG_READ_EXPAND_SUPPORTED␍␊ |
3972 | if (png_ptr->transformations & PNG_EXPAND)␍␊ |
3973 | {␍␊ |
3974 | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)␍␊ |
3975 | {␍␊ |
3976 | if (png_ptr->num_trans)␍␊ |
3977 | max_pixel_depth = 32;␍␊ |
3978 | ␍␊ |
3979 | else␍␊ |
3980 | max_pixel_depth = 24;␍␊ |
3981 | }␍␊ |
3982 | ␍␊ |
3983 | else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)␍␊ |
3984 | {␍␊ |
3985 | if (max_pixel_depth < 8)␍␊ |
3986 | max_pixel_depth = 8;␍␊ |
3987 | ␍␊ |
3988 | if (png_ptr->num_trans)␍␊ |
3989 | max_pixel_depth *= 2;␍␊ |
3990 | }␍␊ |
3991 | ␍␊ |
3992 | else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)␍␊ |
3993 | {␍␊ |
3994 | if (png_ptr->num_trans)␍␊ |
3995 | {␍␊ |
3996 | max_pixel_depth *= 4;␍␊ |
3997 | max_pixel_depth /= 3;␍␊ |
3998 | }␍␊ |
3999 | }␍␊ |
4000 | }␍␊ |
4001 | #endif␍␊ |
4002 | ␍␊ |
4003 | #ifdef PNG_READ_EXPAND_16_SUPPORTED␍␊ |
4004 | if (png_ptr->transformations & PNG_EXPAND_16)␍␊ |
4005 | {␍␊ |
4006 | # ifdef PNG_READ_EXPAND_SUPPORTED␍␊ |
4007 | /* In fact it is an error if it isn't supported, but checking is␍␊ |
4008 | * the safe way.␍␊ |
4009 | */␍␊ |
4010 | if (png_ptr->transformations & PNG_EXPAND)␍␊ |
4011 | {␍␊ |
4012 | if (png_ptr->bit_depth < 16)␍␊ |
4013 | max_pixel_depth *= 2;␍␊ |
4014 | }␍␊ |
4015 | else␍␊ |
4016 | # endif␍␊ |
4017 | png_ptr->transformations &= ~PNG_EXPAND_16;␍␊ |
4018 | }␍␊ |
4019 | #endif␍␊ |
4020 | ␍␊ |
4021 | #ifdef PNG_READ_FILLER_SUPPORTED␍␊ |
4022 | if (png_ptr->transformations & (PNG_FILLER))␍␊ |
4023 | {␍␊ |
4024 | if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)␍␊ |
4025 | {␍␊ |
4026 | if (max_pixel_depth <= 8)␍␊ |
4027 | max_pixel_depth = 16;␍␊ |
4028 | ␍␊ |
4029 | else␍␊ |
4030 | max_pixel_depth = 32;␍␊ |
4031 | }␍␊ |
4032 | ␍␊ |
4033 | else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB ||␍␊ |
4034 | png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)␍␊ |
4035 | {␍␊ |
4036 | if (max_pixel_depth <= 32)␍␊ |
4037 | max_pixel_depth = 32;␍␊ |
4038 | ␍␊ |
4039 | else␍␊ |
4040 | max_pixel_depth = 64;␍␊ |
4041 | }␍␊ |
4042 | }␍␊ |
4043 | #endif␍␊ |
4044 | ␍␊ |
4045 | #ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED␍␊ |
4046 | if (png_ptr->transformations & PNG_GRAY_TO_RGB)␍␊ |
4047 | {␍␊ |
4048 | if (␍␊ |
4049 | #ifdef PNG_READ_EXPAND_SUPPORTED␍␊ |
4050 | (png_ptr->num_trans && (png_ptr->transformations & PNG_EXPAND)) ||␍␊ |
4051 | #endif␍␊ |
4052 | #ifdef PNG_READ_FILLER_SUPPORTED␍␊ |
4053 | (png_ptr->transformations & (PNG_FILLER)) ||␍␊ |
4054 | #endif␍␊ |
4055 | png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)␍␊ |
4056 | {␍␊ |
4057 | if (max_pixel_depth <= 16)␍␊ |
4058 | max_pixel_depth = 32;␍␊ |
4059 | ␍␊ |
4060 | else␍␊ |
4061 | max_pixel_depth = 64;␍␊ |
4062 | }␍␊ |
4063 | ␍␊ |
4064 | else␍␊ |
4065 | {␍␊ |
4066 | if (max_pixel_depth <= 8)␍␊ |
4067 | {␍␊ |
4068 | if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)␍␊ |
4069 | max_pixel_depth = 32;␍␊ |
4070 | ␍␊ |
4071 | else␍␊ |
4072 | max_pixel_depth = 24;␍␊ |
4073 | }␍␊ |
4074 | ␍␊ |
4075 | else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)␍␊ |
4076 | max_pixel_depth = 64;␍␊ |
4077 | ␍␊ |
4078 | else␍␊ |
4079 | max_pixel_depth = 48;␍␊ |
4080 | }␍␊ |
4081 | }␍␊ |
4082 | #endif␍␊ |
4083 | ␍␊ |
4084 | #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \␍␊ |
4085 | defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)␍␊ |
4086 | if (png_ptr->transformations & PNG_USER_TRANSFORM)␍␊ |
4087 | {␍␊ |
4088 | int user_pixel_depth = png_ptr->user_transform_depth *␍␊ |
4089 | png_ptr->user_transform_channels;␍␊ |
4090 | ␍␊ |
4091 | if (user_pixel_depth > max_pixel_depth)␍␊ |
4092 | max_pixel_depth = user_pixel_depth;␍␊ |
4093 | }␍␊ |
4094 | #endif␍␊ |
4095 | ␍␊ |
4096 | /* This value is stored in png_struct and double checked in the row read␍␊ |
4097 | * code.␍␊ |
4098 | */␍␊ |
4099 | png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;␍␊ |
4100 | png_ptr->transformed_pixel_depth = 0; /* calculated on demand */␍␊ |
4101 | ␍␊ |
4102 | /* Align the width on the next larger 8 pixels. Mainly used␍␊ |
4103 | * for interlacing␍␊ |
4104 | */␍␊ |
4105 | row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));␍␊ |
4106 | /* Calculate the maximum bytes needed, adding a byte and a pixel␍␊ |
4107 | * for safety's sake␍␊ |
4108 | */␍␊ |
4109 | row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +␍␊ |
4110 | 1 + ((max_pixel_depth + 7) >> 3);␍␊ |
4111 | ␍␊ |
4112 | #ifdef PNG_MAX_MALLOC_64K␍␊ |
4113 | if (row_bytes > (png_uint_32)65536L)␍␊ |
4114 | png_error(png_ptr, "This image requires a row greater than 64KB");␍␊ |
4115 | #endif␍␊ |
4116 | ␍␊ |
4117 | if (row_bytes + 48 > png_ptr->old_big_row_buf_size)␍␊ |
4118 | {␍␊ |
4119 | png_free(png_ptr, png_ptr->big_row_buf);␍␊ |
4120 | png_free(png_ptr, png_ptr->big_prev_row);␍␊ |
4121 | ␍␊ |
4122 | if (png_ptr->interlaced)␍␊ |
4123 | png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr,␍␊ |
4124 | row_bytes + 48);␍␊ |
4125 | ␍␊ |
4126 | else␍␊ |
4127 | png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48);␍␊ |
4128 | ␍␊ |
4129 | png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48);␍␊ |
4130 | ␍␊ |
4131 | #ifdef PNG_ALIGNED_MEMORY_SUPPORTED␍␊ |
4132 | /* Use 16-byte aligned memory for row_buf with at least 16 bytes␍␊ |
4133 | * of padding before and after row_buf; treat prev_row similarly.␍␊ |
4134 | * NOTE: the alignment is to the start of the pixels, one beyond the start␍␊ |
4135 | * of the buffer, because of the filter byte. Prior to libpng 1.5.6 this␍␊ |
4136 | * was incorrect; the filter byte was aligned, which had the exact␍␊ |
4137 | * opposite effect of that intended.␍␊ |
4138 | */␍␊ |
4139 | {␍␊ |
4140 | png_bytep temp = png_ptr->big_row_buf + 32;␍␊ |
4141 | int extra = (int)((temp - (png_bytep)0) & 0x0f);␍␊ |
4142 | png_ptr->row_buf = temp - extra - 1/*filter byte*/;␍␊ |
4143 | ␍␊ |
4144 | temp = png_ptr->big_prev_row + 32;␍␊ |
4145 | extra = (int)((temp - (png_bytep)0) & 0x0f);␍␊ |
4146 | png_ptr->prev_row = temp - extra - 1/*filter byte*/;␍␊ |
4147 | }␍␊ |
4148 | ␍␊ |
4149 | #else␍␊ |
4150 | /* Use 31 bytes of padding before and 17 bytes after row_buf. */␍␊ |
4151 | png_ptr->row_buf = png_ptr->big_row_buf + 31;␍␊ |
4152 | png_ptr->prev_row = png_ptr->big_prev_row + 31;␍␊ |
4153 | #endif␍␊ |
4154 | png_ptr->old_big_row_buf_size = row_bytes + 48;␍␊ |
4155 | }␍␊ |
4156 | ␍␊ |
4157 | #ifdef PNG_MAX_MALLOC_64K␍␊ |
4158 | if (png_ptr->rowbytes > 65535)␍␊ |
4159 | png_error(png_ptr, "This image requires a row greater than 64KB");␍␊ |
4160 | ␍␊ |
4161 | #endif␍␊ |
4162 | if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1))␍␊ |
4163 | png_error(png_ptr, "Row has too many bytes to allocate in memory");␍␊ |
4164 | ␍␊ |
4165 | png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);␍␊ |
4166 | ␍␊ |
4167 | png_debug1(3, "width = %u,", png_ptr->width);␍␊ |
4168 | png_debug1(3, "height = %u,", png_ptr->height);␍␊ |
4169 | png_debug1(3, "iwidth = %u,", png_ptr->iwidth);␍␊ |
4170 | png_debug1(3, "num_rows = %u,", png_ptr->num_rows);␍␊ |
4171 | png_debug1(3, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes);␍␊ |
4172 | png_debug1(3, "irowbytes = %lu",␍␊ |
4173 | (unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1);␍␊ |
4174 | ␍␊ |
4175 | png_ptr->flags |= PNG_FLAG_ROW_INIT;␍␊ |
4176 | }␍␊ |
4177 | #endif /* PNG_READ_SUPPORTED */␍␊ |
4178 | |