Coverage Report

Created: 2025-06-13 06:34

/src/libpng/pngrutil.c
Line
Count
Source (jump to first uncovered line)
1
/* pngrutil.c - utilities to read a PNG file
2
 *
3
 * Copyright (c) 2018-2025 Cosmin Truta
4
 * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
5
 * Copyright (c) 1996-1997 Andreas Dilger
6
 * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
7
 *
8
 * This code is released under the libpng license.
9
 * For conditions of distribution and use, see the disclaimer
10
 * and license in png.h
11
 *
12
 * This file contains routines that are only called from within
13
 * libpng itself during the course of reading an image.
14
 */
15
16
#include "pngpriv.h"
17
18
#ifdef PNG_READ_SUPPORTED
19
20
/* The minimum 'zlib' stream is assumed to be just the 2 byte header, 5 bytes
21
 * minimum 'deflate' stream, and the 4 byte checksum.
22
 */
23
24.3k
#define LZ77Min  (2U+5U+4U)
24
25
#ifdef PNG_READ_INTERLACING_SUPPORTED
26
/* Arrays to facilitate interlacing - use pass (0 - 6) as index. */
27
28
/* Start of interlace block */
29
static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
30
/* Offset to next interlace block */
31
static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
32
/* Start of interlace block in the y direction */
33
static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
34
/* Offset to next interlace block in the y direction */
35
static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
36
37
/* TODO: Move these arrays to a common utility module to avoid duplication. */
38
#endif
39
40
png_uint_32 PNGAPI
41
png_get_uint_31(png_const_structrp png_ptr, png_const_bytep buf)
42
518k
{
43
518k
   png_uint_32 uval = png_get_uint_32(buf);
44
45
518k
   if (uval > PNG_UINT_31_MAX)
46
279
      png_error(png_ptr, "PNG unsigned integer out of range");
47
48
518k
   return uval;
49
518k
}
50
51
#ifdef PNG_READ_INT_FUNCTIONS_SUPPORTED
52
/* NOTE: the read macros will obscure these definitions, so that if
53
 * PNG_USE_READ_MACROS is set the library will not use them internally,
54
 * but the APIs will still be available externally.
55
 *
56
 * The parentheses around "PNGAPI function_name" in the following three
57
 * functions are necessary because they allow the macros to co-exist with
58
 * these (unused but exported) functions.
59
 */
60
61
/* Grab an unsigned 32-bit integer from a buffer in big-endian format. */
62
png_uint_32 (PNGAPI
63
png_get_uint_32)(png_const_bytep buf)
64
0
{
65
0
   png_uint_32 uval =
66
0
       ((png_uint_32)(*(buf    )) << 24) +
67
0
       ((png_uint_32)(*(buf + 1)) << 16) +
68
0
       ((png_uint_32)(*(buf + 2)) <<  8) +
69
0
       ((png_uint_32)(*(buf + 3))      ) ;
70
71
0
   return uval;
72
0
}
73
74
/* Grab a signed 32-bit integer from a buffer in big-endian format.  The
75
 * data is stored in the PNG file in two's complement format and there
76
 * is no guarantee that a 'png_int_32' is exactly 32 bits, therefore
77
 * the following code does a two's complement to native conversion.
78
 */
79
png_int_32 (PNGAPI
80
png_get_int_32)(png_const_bytep buf)
81
0
{
82
0
   png_uint_32 uval = png_get_uint_32(buf);
83
0
   if ((uval & 0x80000000) == 0) /* non-negative */
84
0
      return (png_int_32)uval;
85
86
0
   uval = (uval ^ 0xffffffff) + 1;  /* 2's complement: -x = ~x+1 */
87
0
   if ((uval & 0x80000000) == 0) /* no overflow */
88
0
      return -(png_int_32)uval;
89
   /* The following has to be safe; this function only gets called on PNG data
90
    * and if we get here that data is invalid.  0 is the most safe value and
91
    * if not then an attacker would surely just generate a PNG with 0 instead.
92
    */
93
0
   return 0;
94
0
}
95
96
/* Grab an unsigned 16-bit integer from a buffer in big-endian format. */
97
png_uint_16 (PNGAPI
98
png_get_uint_16)(png_const_bytep buf)
99
0
{
100
   /* ANSI-C requires an int value to accommodate at least 16 bits so this
101
    * works and allows the compiler not to worry about possible narrowing
102
    * on 32-bit systems.  (Pre-ANSI systems did not make integers smaller
103
    * than 16 bits either.)
104
    */
105
0
   unsigned int val =
106
0
       ((unsigned int)(*buf) << 8) +
107
0
       ((unsigned int)(*(buf + 1)));
108
109
0
   return (png_uint_16)val;
110
0
}
111
112
#endif /* READ_INT_FUNCTIONS */
113
114
/* Read and check the PNG file signature */
115
void /* PRIVATE */
116
png_read_sig(png_structrp png_ptr, png_inforp info_ptr)
117
54.4k
{
118
54.4k
   size_t num_checked, num_to_check;
119
120
   /* Exit if the user application does not expect a signature. */
121
54.4k
   if (png_ptr->sig_bytes >= 8)
122
26.0k
      return;
123
124
28.4k
   num_checked = png_ptr->sig_bytes;
125
28.4k
   num_to_check = 8 - num_checked;
126
127
28.4k
#ifdef PNG_IO_STATE_SUPPORTED
128
28.4k
   png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE;
129
28.4k
#endif
130
131
   /* The signature must be serialized in a single I/O call. */
132
28.4k
   png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check);
133
28.4k
   png_ptr->sig_bytes = 8;
134
135
28.4k
   if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check) != 0)
136
0
   {
137
0
      if (num_checked < 4 &&
138
0
          png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4) != 0)
139
0
         png_error(png_ptr, "Not a PNG file");
140
0
      else
141
0
         png_error(png_ptr, "PNG file corrupted by ASCII conversion");
142
0
   }
143
28.4k
   if (num_checked < 3)
144
28.4k
      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
145
28.4k
}
146
147
/* This function is called to verify that a chunk name is valid.
148
 * Do this using the bit-whacking approach from contrib/tools/pngfix.c
149
 *
150
 * Copied from libpng 1.7.
151
 */
152
static int
153
check_chunk_name(png_uint_32 name)
154
413k
{
155
413k
   png_uint_32 t;
156
157
   /* Remove bit 5 from all but the reserved byte; this means
158
    * every 8-bit unit must be in the range 65-90 to be valid.
159
    * So bit 5 must be zero, bit 6 must be set and bit 7 zero.
160
    */
161
413k
   name &= ~PNG_U32(32,32,0,32);
162
413k
   t = (name & ~0x1f1f1f1fU) ^ 0x40404040U;
163
164
   /* Subtract 65 for each 8-bit quantity, this must not
165
    * overflow and each byte must then be in the range 0-25.
166
    */
167
413k
   name -= PNG_U32(65,65,65,65);
168
413k
   t |= name;
169
170
   /* Subtract 26, handling the overflow which should set the
171
    * top three bits of each byte.
172
    */
173
413k
   name -= PNG_U32(25,25,25,26);
174
413k
   t |= ~name;
175
176
413k
   return (t & 0xe0e0e0e0U) == 0U;
177
413k
}
178
179
/* Read the chunk header (length + type name).
180
 * Put the type name into png_ptr->chunk_name, and return the length.
181
 */
182
png_uint_32 /* PRIVATE */
183
png_read_chunk_header(png_structrp png_ptr)
184
416k
{
185
416k
   png_byte buf[8];
186
416k
   png_uint_32 chunk_name, length;
187
188
416k
#ifdef PNG_IO_STATE_SUPPORTED
189
416k
   png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR;
190
416k
#endif
191
192
   /* Read the length and the chunk name.  png_struct::chunk_name is immediately
193
    * updated even if they are detectably wrong.  This aids error message
194
    * handling by allowing png_chunk_error to be used.
195
    */
196
416k
   png_read_data(png_ptr, buf, 8);
197
416k
   length = png_get_uint_31(png_ptr, buf);
198
416k
   png_ptr->chunk_name = chunk_name = PNG_CHUNK_FROM_STRING(buf+4);
199
200
   /* Reset the crc and run it over the chunk name. */
201
416k
   png_reset_crc(png_ptr);
202
416k
   png_calculate_crc(png_ptr, buf + 4, 4);
203
204
416k
   png_debug2(0, "Reading chunk typeid = 0x%lx, length = %lu",
205
416k
       (unsigned long)png_ptr->chunk_name, (unsigned long)length);
206
207
   /* Sanity check the length (first by <= 0x80) and the chunk name.  An error
208
    * here indicates a broken stream and libpng has no recovery from this.
209
    */
210
416k
   if (buf[0] >= 0x80U)
211
0
      png_chunk_error(png_ptr, "bad header (invalid length)");
212
213
   /* Check to see if chunk name is valid. */
214
416k
   if (!check_chunk_name(chunk_name))
215
1.81k
      png_chunk_error(png_ptr, "bad header (invalid type)");
216
217
414k
#ifdef PNG_IO_STATE_SUPPORTED
218
414k
   png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;
219
414k
#endif
220
221
414k
   return length;
222
416k
}
223
224
/* Read data, and (optionally) run it through the CRC. */
225
void /* PRIVATE */
226
png_crc_read(png_structrp png_ptr, png_bytep buf, png_uint_32 length)
227
147M
{
228
147M
   if (png_ptr == NULL)
229
0
      return;
230
231
147M
   png_read_data(png_ptr, buf, length);
232
147M
   png_calculate_crc(png_ptr, buf, length);
233
147M
}
234
235
/* Compare the CRC stored in the PNG file with that calculated by libpng from
236
 * the data it has read thus far.
237
 */
238
static int
239
png_crc_error(png_structrp png_ptr, int handle_as_ancillary)
240
390k
{
241
390k
   png_byte crc_bytes[4];
242
390k
   png_uint_32 crc;
243
390k
   int need_crc = 1;
244
245
   /* There are four flags two for ancillary and two for critical chunks.  The
246
    * default setting of these flags is all zero.
247
    *
248
    * PNG_FLAG_CRC_ANCILLARY_USE
249
    * PNG_FLAG_CRC_ANCILLARY_NOWARN
250
    *  USE+NOWARN: no CRC calculation (implemented here), else;
251
    *  NOWARN:     png_chunk_error on error (implemented in png_crc_finish)
252
    *  else:       png_chunk_warning on error (implemented in png_crc_finish)
253
    *              This is the default.
254
    *
255
    *    I.e. NOWARN without USE produces png_chunk_error.  The default setting
256
    *    where neither are set does the same thing.
257
    *
258
    * PNG_FLAG_CRC_CRITICAL_USE
259
    * PNG_FLAG_CRC_CRITICAL_IGNORE
260
    *  IGNORE: no CRC calculation (implemented here), else;
261
    *  USE:    png_chunk_warning on error (implemented in png_crc_finish)
262
    *  else:   png_chunk_error on error (implemented in png_crc_finish)
263
    *          This is the default.
264
    *
265
    * This arose because of original mis-implementation and has persisted for
266
    * compatibility reasons.
267
    *
268
    * TODO: the flag names are internal so maybe this can be changed to
269
    * something comprehensible.
270
    */
271
390k
   if (handle_as_ancillary || PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0)
272
290k
   {
273
290k
      if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
274
290k
          (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
275
123k
         need_crc = 0;
276
290k
   }
277
278
100k
   else /* critical */
279
100k
   {
280
100k
      if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)
281
54.7k
         need_crc = 0;
282
100k
   }
283
284
390k
#ifdef PNG_IO_STATE_SUPPORTED
285
390k
   png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC;
286
390k
#endif
287
288
   /* The chunk CRC must be serialized in a single I/O call. */
289
390k
   png_read_data(png_ptr, crc_bytes, 4);
290
291
390k
   if (need_crc != 0)
292
210k
   {
293
210k
      crc = png_get_uint_32(crc_bytes);
294
210k
      return crc != png_ptr->crc;
295
210k
   }
296
297
179k
   else
298
179k
      return 0;
299
390k
}
300
301
/* Optionally skip data and then check the CRC.  Depending on whether we
302
 * are reading an ancillary or critical chunk, and how the program has set
303
 * things up, we may calculate the CRC on the data and print a message.
304
 * Returns '1' if there was a CRC error, '0' otherwise.
305
 *
306
 * There is one public version which is used in most places and another which
307
 * takes the value for the 'critical' flag to check.  This allows PLTE and IEND
308
 * handling code to ignore the CRC error and removes some confusing code
309
 * duplication.
310
 */
311
static int
312
png_crc_finish_critical(png_structrp png_ptr, png_uint_32 skip,
313
      int handle_as_ancillary)
314
392k
{
315
   /* The size of the local buffer for inflate is a good guess as to a
316
    * reasonable size to use for buffering reads from the application.
317
    */
318
147M
   while (skip > 0)
319
147M
   {
320
147M
      png_uint_32 len;
321
147M
      png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
322
323
147M
      len = (sizeof tmpbuf);
324
147M
      if (len > skip)
325
38.9k
         len = skip;
326
147M
      skip -= len;
327
328
147M
      png_crc_read(png_ptr, tmpbuf, len);
329
147M
   }
330
331
   /* If 'handle_as_ancillary' has been requested and this is a critical chunk
332
    * but PNG_FLAG_CRC_CRITICAL_IGNORE was set then png_read_crc did not, in
333
    * fact, calculate the CRC so the ANCILLARY settings should not be used
334
    * instead.
335
    */
336
392k
   if (handle_as_ancillary &&
337
392k
       (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)
338
14.2k
      handle_as_ancillary = 0;
339
340
   /* TODO: this might be more comprehensible if png_crc_error was inlined here.
341
    */
342
392k
   if (png_crc_error(png_ptr, handle_as_ancillary) != 0)
343
25.8k
   {
344
      /* See above for the explanation of how the flags work. */
345
25.8k
      if (handle_as_ancillary || PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0 ?
346
21.7k
          (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == 0 :
347
25.8k
          (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE) != 0)
348
21.7k
         png_chunk_warning(png_ptr, "CRC error");
349
350
4.03k
      else
351
4.03k
         png_chunk_error(png_ptr, "CRC error");
352
353
21.7k
      return 1;
354
25.8k
   }
355
356
367k
   return 0;
357
392k
}
358
359
int /* PRIVATE */
360
png_crc_finish(png_structrp png_ptr, png_uint_32 skip)
361
370k
{
362
370k
   return png_crc_finish_critical(png_ptr, skip, 0/*critical handling*/);
363
370k
}
364
365
#if defined(PNG_READ_iCCP_SUPPORTED) || defined(PNG_READ_iTXt_SUPPORTED) ||\
366
    defined(PNG_READ_pCAL_SUPPORTED) || defined(PNG_READ_sCAL_SUPPORTED) ||\
367
    defined(PNG_READ_sPLT_SUPPORTED) || defined(PNG_READ_tEXt_SUPPORTED) ||\
368
    defined(PNG_READ_zTXt_SUPPORTED) || defined(PNG_READ_eXIf_SUPPORTED) ||\
369
    defined(PNG_SEQUENTIAL_READ_SUPPORTED)
370
/* Manage the read buffer; this simply reallocates the buffer if it is not small
371
 * enough (or if it is not allocated).  The routine returns a pointer to the
372
 * buffer; if an error occurs and 'warn' is set the routine returns NULL, else
373
 * it will call png_error on failure.
374
 */
375
static png_bytep
376
png_read_buffer(png_structrp png_ptr, png_alloc_size_t new_size)
377
212k
{
378
212k
   png_bytep buffer = png_ptr->read_buffer;
379
380
212k
   if (new_size > png_chunk_max(png_ptr)) return NULL;
381
382
212k
   if (buffer != NULL && new_size > png_ptr->read_buffer_size)
383
7.87k
   {
384
7.87k
      png_ptr->read_buffer = NULL;
385
7.87k
      png_ptr->read_buffer_size = 0;
386
7.87k
      png_free(png_ptr, buffer);
387
7.87k
      buffer = NULL;
388
7.87k
   }
389
390
212k
   if (buffer == NULL)
391
45.0k
   {
392
45.0k
      buffer = png_voidcast(png_bytep, png_malloc_base(png_ptr, new_size));
393
394
45.0k
      if (buffer != NULL)
395
45.0k
      {
396
45.0k
#        ifndef PNG_NO_MEMZERO /* for detecting UIM bugs **only** */
397
45.0k
            memset(buffer, 0, new_size); /* just in case */
398
45.0k
#        endif
399
45.0k
         png_ptr->read_buffer = buffer;
400
45.0k
         png_ptr->read_buffer_size = new_size;
401
45.0k
      }
402
45.0k
   }
403
404
212k
   return buffer;
405
212k
}
406
#endif /* READ_iCCP|iTXt|pCAL|sCAL|sPLT|tEXt|zTXt|eXIf|SEQUENTIAL_READ */
407
408
/* png_inflate_claim: claim the zstream for some nefarious purpose that involves
409
 * decompression.  Returns Z_OK on success, else a zlib error code.  It checks
410
 * the owner but, in final release builds, just issues a warning if some other
411
 * chunk apparently owns the stream.  Prior to release it does a png_error.
412
 */
413
static int
414
png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
415
57.9k
{
416
57.9k
   if (png_ptr->zowner != 0)
417
0
   {
418
0
      char msg[64];
419
420
0
      PNG_STRING_FROM_CHUNK(msg, png_ptr->zowner);
421
      /* So the message that results is "<chunk> using zstream"; this is an
422
       * internal error, but is very useful for debugging.  i18n requirements
423
       * are minimal.
424
       */
425
0
      (void)png_safecat(msg, (sizeof msg), 4, " using zstream");
426
0
#if PNG_RELEASE_BUILD
427
0
      png_chunk_warning(png_ptr, msg);
428
0
      png_ptr->zowner = 0;
429
#else
430
      png_chunk_error(png_ptr, msg);
431
#endif
432
0
   }
433
434
   /* Implementation note: unlike 'png_deflate_claim' this internal function
435
    * does not take the size of the data as an argument.  Some efficiency could
436
    * be gained by using this when it is known *if* the zlib stream itself does
437
    * not record the number; however, this is an illusion: the original writer
438
    * of the PNG may have selected a lower window size, and we really must
439
    * follow that because, for systems with with limited capabilities, we
440
    * would otherwise reject the application's attempts to use a smaller window
441
    * size (zlib doesn't have an interface to say "this or lower"!).
442
    *
443
    * inflateReset2 was added to zlib 1.2.4; before this the window could not be
444
    * reset, therefore it is necessary to always allocate the maximum window
445
    * size with earlier zlibs just in case later compressed chunks need it.
446
    */
447
57.9k
   {
448
57.9k
      int ret; /* zlib return code */
449
57.9k
#if ZLIB_VERNUM >= 0x1240
450
57.9k
      int window_bits = 0;
451
452
57.9k
# if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW)
453
57.9k
      if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & 3) ==
454
57.9k
          PNG_OPTION_ON)
455
0
      {
456
0
         window_bits = 15;
457
0
         png_ptr->zstream_start = 0; /* fixed window size */
458
0
      }
459
460
57.9k
      else
461
57.9k
      {
462
57.9k
         png_ptr->zstream_start = 1;
463
57.9k
      }
464
57.9k
# endif
465
466
57.9k
#endif /* ZLIB_VERNUM >= 0x1240 */
467
468
      /* Set this for safety, just in case the previous owner left pointers to
469
       * memory allocations.
470
       */
471
57.9k
      png_ptr->zstream.next_in = NULL;
472
57.9k
      png_ptr->zstream.avail_in = 0;
473
57.9k
      png_ptr->zstream.next_out = NULL;
474
57.9k
      png_ptr->zstream.avail_out = 0;
475
476
57.9k
      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
477
21.5k
      {
478
21.5k
#if ZLIB_VERNUM >= 0x1240
479
21.5k
         ret = inflateReset2(&png_ptr->zstream, window_bits);
480
#else
481
         ret = inflateReset(&png_ptr->zstream);
482
#endif
483
21.5k
      }
484
485
36.3k
      else
486
36.3k
      {
487
36.3k
#if ZLIB_VERNUM >= 0x1240
488
36.3k
         ret = inflateInit2(&png_ptr->zstream, window_bits);
489
#else
490
         ret = inflateInit(&png_ptr->zstream);
491
#endif
492
493
36.3k
         if (ret == Z_OK)
494
36.3k
            png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED;
495
36.3k
      }
496
497
#ifdef PNG_DISABLE_ADLER32_CHECK_SUPPORTED
498
      if (((png_ptr->options >> PNG_IGNORE_ADLER32) & 3) == PNG_OPTION_ON)
499
         /* Turn off validation of the ADLER32 checksum in IDAT chunks */
500
         ret = inflateValidate(&png_ptr->zstream, 0);
501
#endif
502
503
57.9k
      if (ret == Z_OK)
504
57.9k
         png_ptr->zowner = owner;
505
506
0
      else
507
0
         png_zstream_error(png_ptr, ret);
508
509
57.9k
      return ret;
510
57.9k
   }
511
512
#ifdef window_bits
513
# undef window_bits
514
#endif
515
57.9k
}
516
517
#if ZLIB_VERNUM >= 0x1240
518
/* Handle the start of the inflate stream if we called inflateInit2(strm,0);
519
 * in this case some zlib versions skip validation of the CINFO field and, in
520
 * certain circumstances, libpng may end up displaying an invalid image, in
521
 * contrast to implementations that call zlib in the normal way (e.g. libpng
522
 * 1.5).
523
 */
524
int /* PRIVATE */
525
png_zlib_inflate(png_structrp png_ptr, int flush)
526
4.55M
{
527
4.55M
   if (png_ptr->zstream_start && png_ptr->zstream.avail_in > 0)
528
54.4k
   {
529
54.4k
      if ((*png_ptr->zstream.next_in >> 4) > 7)
530
1.15k
      {
531
1.15k
         png_ptr->zstream.msg = "invalid window size (libpng)";
532
1.15k
         return Z_DATA_ERROR;
533
1.15k
      }
534
535
53.2k
      png_ptr->zstream_start = 0;
536
53.2k
   }
537
538
4.55M
   return inflate(&png_ptr->zstream, flush);
539
4.55M
}
540
#endif /* Zlib >= 1.2.4 */
541
542
#ifdef PNG_READ_COMPRESSED_TEXT_SUPPORTED
543
#if defined(PNG_READ_zTXt_SUPPORTED) || defined (PNG_READ_iTXt_SUPPORTED)
544
/* png_inflate now returns zlib error codes including Z_OK and Z_STREAM_END to
545
 * allow the caller to do multiple calls if required.  If the 'finish' flag is
546
 * set Z_FINISH will be passed to the final inflate() call and Z_STREAM_END must
547
 * be returned or there has been a problem, otherwise Z_SYNC_FLUSH is used and
548
 * Z_OK or Z_STREAM_END will be returned on success.
549
 *
550
 * The input and output sizes are updated to the actual amounts of data consumed
551
 * or written, not the amount available (as in a z_stream).  The data pointers
552
 * are not changed, so the next input is (data+input_size) and the next
553
 * available output is (output+output_size).
554
 */
555
static int
556
png_inflate(png_structrp png_ptr, png_uint_32 owner, int finish,
557
    /* INPUT: */ png_const_bytep input, png_uint_32p input_size_ptr,
558
    /* OUTPUT: */ png_bytep output, png_alloc_size_t *output_size_ptr)
559
13.3k
{
560
13.3k
   if (png_ptr->zowner == owner) /* Else not claimed */
561
13.3k
   {
562
13.3k
      int ret;
563
13.3k
      png_alloc_size_t avail_out = *output_size_ptr;
564
13.3k
      png_uint_32 avail_in = *input_size_ptr;
565
566
      /* zlib can't necessarily handle more than 65535 bytes at once (i.e. it
567
       * can't even necessarily handle 65536 bytes) because the type uInt is
568
       * "16 bits or more".  Consequently it is necessary to chunk the input to
569
       * zlib.  This code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the
570
       * maximum value that can be stored in a uInt.)  It is possible to set
571
       * ZLIB_IO_MAX to a lower value in pngpriv.h and this may sometimes have
572
       * a performance advantage, because it reduces the amount of data accessed
573
       * at each step and that may give the OS more time to page it in.
574
       */
575
13.3k
      png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input);
576
      /* avail_in and avail_out are set below from 'size' */
577
13.3k
      png_ptr->zstream.avail_in = 0;
578
13.3k
      png_ptr->zstream.avail_out = 0;
579
580
      /* Read directly into the output if it is available (this is set to
581
       * a local buffer below if output is NULL).
582
       */
583
13.3k
      if (output != NULL)
584
5.04k
         png_ptr->zstream.next_out = output;
585
586
13.3k
      do
587
641k
      {
588
641k
         uInt avail;
589
641k
         Byte local_buffer[PNG_INFLATE_BUF_SIZE];
590
591
         /* zlib INPUT BUFFER */
592
         /* The setting of 'avail_in' used to be outside the loop; by setting it
593
          * inside it is possible to chunk the input to zlib and simply rely on
594
          * zlib to advance the 'next_in' pointer.  This allows arbitrary
595
          * amounts of data to be passed through zlib at the unavoidable cost of
596
          * requiring a window save (memcpy of up to 32768 output bytes)
597
          * every ZLIB_IO_MAX input bytes.
598
          */
599
641k
         avail_in += png_ptr->zstream.avail_in; /* not consumed last time */
600
601
641k
         avail = ZLIB_IO_MAX;
602
603
641k
         if (avail_in < avail)
604
641k
            avail = (uInt)avail_in; /* safe: < than ZLIB_IO_MAX */
605
606
641k
         avail_in -= avail;
607
641k
         png_ptr->zstream.avail_in = avail;
608
609
         /* zlib OUTPUT BUFFER */
610
641k
         avail_out += png_ptr->zstream.avail_out; /* not written last time */
611
612
641k
         avail = ZLIB_IO_MAX; /* maximum zlib can process */
613
614
641k
         if (output == NULL)
615
636k
         {
616
            /* Reset the output buffer each time round if output is NULL and
617
             * make available the full buffer, up to 'remaining_space'
618
             */
619
636k
            png_ptr->zstream.next_out = local_buffer;
620
636k
            if ((sizeof local_buffer) < avail)
621
636k
               avail = (sizeof local_buffer);
622
636k
         }
623
624
641k
         if (avail_out < avail)
625
5.04k
            avail = (uInt)avail_out; /* safe: < ZLIB_IO_MAX */
626
627
641k
         png_ptr->zstream.avail_out = avail;
628
641k
         avail_out -= avail;
629
630
         /* zlib inflate call */
631
         /* In fact 'avail_out' may be 0 at this point, that happens at the end
632
          * of the read when the final LZ end code was not passed at the end of
633
          * the previous chunk of input data.  Tell zlib if we have reached the
634
          * end of the output buffer.
635
          */
636
641k
         ret = PNG_INFLATE(png_ptr, avail_out > 0 ? Z_NO_FLUSH :
637
641k
             (finish ? Z_FINISH : Z_SYNC_FLUSH));
638
641k
      } while (ret == Z_OK);
639
640
      /* For safety kill the local buffer pointer now */
641
13.3k
      if (output == NULL)
642
8.30k
         png_ptr->zstream.next_out = NULL;
643
644
      /* Claw back the 'size' and 'remaining_space' byte counts. */
645
13.3k
      avail_in += png_ptr->zstream.avail_in;
646
13.3k
      avail_out += png_ptr->zstream.avail_out;
647
648
      /* Update the input and output sizes; the updated values are the amount
649
       * consumed or written, effectively the inverse of what zlib uses.
650
       */
651
13.3k
      if (avail_out > 0)
652
8.30k
         *output_size_ptr -= avail_out;
653
654
13.3k
      if (avail_in > 0)
655
2.91k
         *input_size_ptr -= avail_in;
656
657
      /* Ensure png_ptr->zstream.msg is set (even in the success case!) */
658
13.3k
      png_zstream_error(png_ptr, ret);
659
13.3k
      return ret;
660
13.3k
   }
661
662
0
   else
663
0
   {
664
      /* This is a bad internal error.  The recovery assigns to the zstream msg
665
       * pointer, which is not owned by the caller, but this is safe; it's only
666
       * used on errors!
667
       */
668
0
      png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
669
0
      return Z_STREAM_ERROR;
670
0
   }
671
13.3k
}
672
673
/*
674
 * Decompress trailing data in a chunk.  The assumption is that read_buffer
675
 * points at an allocated area holding the contents of a chunk with a
676
 * trailing compressed part.  What we get back is an allocated area
677
 * holding the original prefix part and an uncompressed version of the
678
 * trailing part (the malloc area passed in is freed).
679
 */
680
static int
681
png_decompress_chunk(png_structrp png_ptr,
682
    png_uint_32 chunklength, png_uint_32 prefix_size,
683
    png_alloc_size_t *newlength /* must be initialized to the maximum! */,
684
    int terminate /*add a '\0' to the end of the uncompressed data*/)
685
8.30k
{
686
   /* TODO: implement different limits for different types of chunk.
687
    *
688
    * The caller supplies *newlength set to the maximum length of the
689
    * uncompressed data, but this routine allocates space for the prefix and
690
    * maybe a '\0' terminator too.  We have to assume that 'prefix_size' is
691
    * limited only by the maximum chunk size.
692
    */
693
8.30k
   png_alloc_size_t limit = png_chunk_max(png_ptr);
694
695
8.30k
   if (limit >= prefix_size + (terminate != 0))
696
8.30k
   {
697
8.30k
      int ret;
698
699
8.30k
      limit -= prefix_size + (terminate != 0);
700
701
8.30k
      if (limit < *newlength)
702
8.30k
         *newlength = limit;
703
704
      /* Now try to claim the stream. */
705
8.30k
      ret = png_inflate_claim(png_ptr, png_ptr->chunk_name);
706
707
8.30k
      if (ret == Z_OK)
708
8.30k
      {
709
8.30k
         png_uint_32 lzsize = chunklength - prefix_size;
710
711
8.30k
         ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/,
712
8.30k
             /* input: */ png_ptr->read_buffer + prefix_size, &lzsize,
713
             /* output: */ NULL, newlength);
714
715
8.30k
         if (ret == Z_STREAM_END)
716
5.04k
         {
717
            /* Use 'inflateReset' here, not 'inflateReset2' because this
718
             * preserves the previously decided window size (otherwise it would
719
             * be necessary to store the previous window size.)  In practice
720
             * this doesn't matter anyway, because png_inflate will call inflate
721
             * with Z_FINISH in almost all cases, so the window will not be
722
             * maintained.
723
             */
724
5.04k
            if (inflateReset(&png_ptr->zstream) == Z_OK)
725
5.04k
            {
726
               /* Because of the limit checks above we know that the new,
727
                * expanded, size will fit in a size_t (let alone an
728
                * png_alloc_size_t).  Use png_malloc_base here to avoid an
729
                * extra OOM message.
730
                */
731
5.04k
               png_alloc_size_t new_size = *newlength;
732
5.04k
               png_alloc_size_t buffer_size = prefix_size + new_size +
733
5.04k
                   (terminate != 0);
734
5.04k
               png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr,
735
5.04k
                   buffer_size));
736
737
5.04k
               if (text != NULL)
738
5.04k
               {
739
5.04k
                  memset(text, 0, buffer_size);
740
741
5.04k
                  ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/,
742
5.04k
                      png_ptr->read_buffer + prefix_size, &lzsize,
743
5.04k
                      text + prefix_size, newlength);
744
745
5.04k
                  if (ret == Z_STREAM_END)
746
5.04k
                  {
747
5.04k
                     if (new_size == *newlength)
748
5.04k
                     {
749
5.04k
                        if (terminate != 0)
750
5.04k
                           text[prefix_size + *newlength] = 0;
751
752
5.04k
                        if (prefix_size > 0)
753
5.04k
                           memcpy(text, png_ptr->read_buffer, prefix_size);
754
755
5.04k
                        {
756
5.04k
                           png_bytep old_ptr = png_ptr->read_buffer;
757
758
5.04k
                           png_ptr->read_buffer = text;
759
5.04k
                           png_ptr->read_buffer_size = buffer_size;
760
5.04k
                           text = old_ptr; /* freed below */
761
5.04k
                        }
762
5.04k
                     }
763
764
0
                     else
765
0
                     {
766
                        /* The size changed on the second read, there can be no
767
                         * guarantee that anything is correct at this point.
768
                         * The 'msg' pointer has been set to "unexpected end of
769
                         * LZ stream", which is fine, but return an error code
770
                         * that the caller won't accept.
771
                         */
772
0
                        ret = PNG_UNEXPECTED_ZLIB_RETURN;
773
0
                     }
774
5.04k
                  }
775
776
0
                  else if (ret == Z_OK)
777
0
                     ret = PNG_UNEXPECTED_ZLIB_RETURN; /* for safety */
778
779
                  /* Free the text pointer (this is the old read_buffer on
780
                   * success)
781
                   */
782
5.04k
                  png_free(png_ptr, text);
783
784
                  /* This really is very benign, but it's still an error because
785
                   * the extra space may otherwise be used as a Trojan Horse.
786
                   */
787
5.04k
                  if (ret == Z_STREAM_END &&
788
5.04k
                      chunklength - prefix_size != lzsize)
789
1.54k
                     png_chunk_benign_error(png_ptr, "extra compressed data");
790
5.04k
               }
791
792
0
               else
793
0
               {
794
                  /* Out of memory allocating the buffer */
795
0
                  ret = Z_MEM_ERROR;
796
0
                  png_zstream_error(png_ptr, Z_MEM_ERROR);
797
0
               }
798
5.04k
            }
799
800
0
            else
801
0
            {
802
               /* inflateReset failed, store the error message */
803
0
               png_zstream_error(png_ptr, ret);
804
0
               ret = PNG_UNEXPECTED_ZLIB_RETURN;
805
0
            }
806
5.04k
         }
807
808
3.25k
         else if (ret == Z_OK)
809
0
            ret = PNG_UNEXPECTED_ZLIB_RETURN;
810
811
         /* Release the claimed stream */
812
8.30k
         png_ptr->zowner = 0;
813
8.30k
      }
814
815
0
      else /* the claim failed */ if (ret == Z_STREAM_END) /* impossible! */
816
0
         ret = PNG_UNEXPECTED_ZLIB_RETURN;
817
818
8.30k
      return ret;
819
8.30k
   }
820
821
0
   else
822
0
   {
823
      /* Application/configuration limits exceeded */
824
0
      png_zstream_error(png_ptr, Z_MEM_ERROR);
825
0
      return Z_MEM_ERROR;
826
0
   }
827
8.30k
}
828
#endif /* READ_zTXt || READ_iTXt */
829
#endif /* READ_COMPRESSED_TEXT */
830
831
#ifdef PNG_READ_iCCP_SUPPORTED
832
/* Perform a partial read and decompress, producing 'avail_out' bytes and
833
 * reading from the current chunk as required.
834
 */
835
static int
836
png_inflate_read(png_structrp png_ptr, png_bytep read_buffer, uInt read_size,
837
    png_uint_32p chunk_bytes, png_bytep next_out, png_alloc_size_t *out_size,
838
    int finish)
839
34.5k
{
840
34.5k
   if (png_ptr->zowner == png_ptr->chunk_name)
841
34.5k
   {
842
34.5k
      int ret;
843
844
      /* next_in and avail_in must have been initialized by the caller. */
845
34.5k
      png_ptr->zstream.next_out = next_out;
846
34.5k
      png_ptr->zstream.avail_out = 0; /* set in the loop */
847
848
34.5k
      do
849
50.2k
      {
850
50.2k
         if (png_ptr->zstream.avail_in == 0)
851
18.8k
         {
852
18.8k
            if (read_size > *chunk_bytes)
853
17.5k
               read_size = (uInt)*chunk_bytes;
854
18.8k
            *chunk_bytes -= read_size;
855
856
18.8k
            if (read_size > 0)
857
15.2k
               png_crc_read(png_ptr, read_buffer, read_size);
858
859
18.8k
            png_ptr->zstream.next_in = read_buffer;
860
18.8k
            png_ptr->zstream.avail_in = read_size;
861
18.8k
         }
862
863
50.2k
         if (png_ptr->zstream.avail_out == 0)
864
34.5k
         {
865
34.5k
            uInt avail = ZLIB_IO_MAX;
866
34.5k
            if (avail > *out_size)
867
34.5k
               avail = (uInt)*out_size;
868
34.5k
            *out_size -= avail;
869
870
34.5k
            png_ptr->zstream.avail_out = avail;
871
34.5k
         }
872
873
         /* Use Z_SYNC_FLUSH when there is no more chunk data to ensure that all
874
          * the available output is produced; this allows reading of truncated
875
          * streams.
876
          */
877
50.2k
         ret = PNG_INFLATE(png_ptr, *chunk_bytes > 0 ?
878
50.2k
             Z_NO_FLUSH : (finish ? Z_FINISH : Z_SYNC_FLUSH));
879
50.2k
      }
880
50.2k
      while (ret == Z_OK && (*out_size > 0 || png_ptr->zstream.avail_out > 0));
881
882
34.5k
      *out_size += png_ptr->zstream.avail_out;
883
34.5k
      png_ptr->zstream.avail_out = 0; /* Should not be required, but is safe */
884
885
      /* Ensure the error message pointer is always set: */
886
34.5k
      png_zstream_error(png_ptr, ret);
887
34.5k
      return ret;
888
34.5k
   }
889
890
0
   else
891
0
   {
892
0
      png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
893
0
      return Z_STREAM_ERROR;
894
0
   }
895
34.5k
}
896
#endif /* READ_iCCP */
897
898
/* CHUNK HANDLING */
899
/* Read and check the IDHR chunk */
900
static png_handle_result_code
901
png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
902
52.7k
{
903
52.7k
   png_byte buf[13];
904
52.7k
   png_uint_32 width, height;
905
52.7k
   int bit_depth, color_type, compression_type, filter_type;
906
52.7k
   int interlace_type;
907
908
52.7k
   png_debug(1, "in png_handle_IHDR");
909
910
   /* Length and position are checked by the caller. */
911
912
52.7k
   png_ptr->mode |= PNG_HAVE_IHDR;
913
914
52.7k
   png_crc_read(png_ptr, buf, 13);
915
52.7k
   png_crc_finish(png_ptr, 0);
916
917
52.7k
   width = png_get_uint_31(png_ptr, buf);
918
52.7k
   height = png_get_uint_31(png_ptr, buf + 4);
919
52.7k
   bit_depth = buf[8];
920
52.7k
   color_type = buf[9];
921
52.7k
   compression_type = buf[10];
922
52.7k
   filter_type = buf[11];
923
52.7k
   interlace_type = buf[12];
924
925
   /* Set internal variables */
926
52.7k
   png_ptr->width = width;
927
52.7k
   png_ptr->height = height;
928
52.7k
   png_ptr->bit_depth = (png_byte)bit_depth;
929
52.7k
   png_ptr->interlaced = (png_byte)interlace_type;
930
52.7k
   png_ptr->color_type = (png_byte)color_type;
931
52.7k
#ifdef PNG_MNG_FEATURES_SUPPORTED
932
52.7k
   png_ptr->filter_type = (png_byte)filter_type;
933
52.7k
#endif
934
52.7k
   png_ptr->compression_type = (png_byte)compression_type;
935
936
   /* Find number of channels */
937
52.7k
   switch (png_ptr->color_type)
938
52.7k
   {
939
191
      default: /* invalid, png_set_IHDR calls png_error */
940
24.7k
      case PNG_COLOR_TYPE_GRAY:
941
32.5k
      case PNG_COLOR_TYPE_PALETTE:
942
32.5k
         png_ptr->channels = 1;
943
32.5k
         break;
944
945
11.8k
      case PNG_COLOR_TYPE_RGB:
946
11.8k
         png_ptr->channels = 3;
947
11.8k
         break;
948
949
1.52k
      case PNG_COLOR_TYPE_GRAY_ALPHA:
950
1.52k
         png_ptr->channels = 2;
951
1.52k
         break;
952
953
6.66k
      case PNG_COLOR_TYPE_RGB_ALPHA:
954
6.66k
         png_ptr->channels = 4;
955
6.66k
         break;
956
52.7k
   }
957
958
   /* Set up other useful info */
959
52.6k
   png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels);
960
52.6k
   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
961
52.6k
   png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);
962
52.6k
   png_debug1(3, "channels = %d", png_ptr->channels);
963
52.6k
   png_debug1(3, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes);
964
965
   /* Rely on png_set_IHDR to completely validate the data and call png_error if
966
    * it's wrong.
967
    */
968
52.6k
   png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
969
52.6k
       color_type, interlace_type, compression_type, filter_type);
970
971
52.6k
   return handled_ok;
972
0
   PNG_UNUSED(length)
973
0
}
974
975
/* Read and check the palette */
976
/* TODO: there are several obvious errors in this code when handling
977
 * out-of-place chunks and there is much over-complexity caused by trying to
978
 * patch up the problems.
979
 */
980
static png_handle_result_code
981
png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
982
13.8k
{
983
13.8k
   png_const_charp errmsg = NULL;
984
985
13.8k
   png_debug(1, "in png_handle_PLTE");
986
987
   /* 1.6.47: consistency.  This used to be especially treated as a critical
988
    * error even in an image which is not colour mapped, there isn't a good
989
    * justification for treating some errors here one way and others another so
990
    * everything uses the same logic.
991
    */
992
13.8k
   if ((png_ptr->mode & PNG_HAVE_PLTE) != 0)
993
1.20k
      errmsg = "duplicate";
994
995
12.6k
   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
996
1.31k
      errmsg = "out of place";
997
998
11.2k
   else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
999
5.14k
      errmsg = "ignored in grayscale PNG";
1000
1001
6.14k
   else if (length > 3*PNG_MAX_PALETTE_LENGTH || (length % 3) != 0)
1002
1.74k
      errmsg = "invalid";
1003
1004
   /* This drops PLTE in favour of tRNS or bKGD because both of those chunks
1005
    * can have an effect on the rendering of the image whereas PLTE only matters
1006
    * in the case of an 8-bit display with a decoder which controls the palette.
1007
    *
1008
    * The alternative here is to ignore the error and store the palette anyway;
1009
    * destroying the tRNS will definately cause problems.
1010
    *
1011
    * NOTE: the case of PNG_COLOR_TYPE_PALETTE need not be considered because
1012
    * the png_handle_ routines for the three 'after PLTE' chunks tRNS, bKGD and
1013
    * hIST all check for a preceding PLTE in these cases.
1014
    */
1015
4.39k
   else if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE &&
1016
4.39k
            (png_has_chunk(png_ptr, tRNS) || png_has_chunk(png_ptr, bKGD)))
1017
1.55k
      errmsg = "out of place";
1018
1019
2.83k
   else
1020
2.83k
   {
1021
      /* If the palette has 256 or fewer entries but is too large for the bit
1022
       * depth we don't issue an error to preserve the behavior of previous
1023
       * libpng versions. We silently truncate the unused extra palette entries
1024
       * here.
1025
       */
1026
2.83k
      const unsigned max_palette_length =
1027
2.83k
         (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
1028
2.68k
            1U << png_ptr->bit_depth : PNG_MAX_PALETTE_LENGTH;
1029
1030
      /* The cast is safe because 'length' is less than
1031
       * 3*PNG_MAX_PALETTE_LENGTH
1032
       */
1033
2.83k
      const unsigned num = (length > 3U*max_palette_length) ?
1034
2.71k
         max_palette_length : (unsigned)length / 3U;
1035
1036
2.83k
      unsigned i, j;
1037
2.83k
      png_byte buf[3*PNG_MAX_PALETTE_LENGTH];
1038
2.83k
      png_color palette[PNG_MAX_PALETTE_LENGTH];
1039
1040
      /* Read the chunk into the buffer then read to the end of the chunk. */
1041
2.83k
      png_crc_read(png_ptr, buf, num*3U);
1042
2.83k
      png_crc_finish_critical(png_ptr, length - 3U*num,
1043
            /* Handle as ancillary if PLTE is optional: */
1044
2.83k
            png_ptr->color_type != PNG_COLOR_TYPE_PALETTE);
1045
1046
64.0k
      for (i = 0U, j = 0U; i < num; i++)
1047
61.1k
      {
1048
61.1k
         palette[i].red = buf[j++];
1049
61.1k
         palette[i].green = buf[j++];
1050
61.1k
         palette[i].blue = buf[j++];
1051
61.1k
      }
1052
1053
      /* A valid PLTE chunk has been read */
1054
2.83k
      png_ptr->mode |= PNG_HAVE_PLTE;
1055
1056
      /* TODO: png_set_PLTE has the side effect of setting png_ptr->palette to
1057
       * its own copy of the palette.  This has the side effect that when
1058
       * png_start_row is called (this happens after any call to
1059
       * png_read_update_info) the info_ptr palette gets changed.  This is
1060
       * extremely unexpected and confusing.
1061
       *
1062
       * REVIEW: there have been consistent bugs in the past about gamma and
1063
       * similar transforms to colour mapped images being useless because the
1064
       * modified palette cannot be accessed because of the above.
1065
       *
1066
       * CONSIDER: Fix this by not sharing the palette in this way.  But does
1067
       * this completely fix the problem?
1068
       */
1069
2.83k
      png_set_PLTE(png_ptr, info_ptr, palette, num);
1070
2.83k
      return handled_ok;
1071
2.83k
   }
1072
1073
   /* Here on error: errmsg is non NULL. */
1074
10.9k
   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1075
111
   {
1076
111
      png_crc_finish(png_ptr, length);
1077
111
      png_chunk_error(png_ptr, errmsg);
1078
111
   }
1079
1080
10.8k
   else /* not critical to this image */
1081
10.8k
   {
1082
10.8k
      png_crc_finish_critical(png_ptr, length, 1/*handle as ancillary*/);
1083
10.8k
      png_chunk_benign_error(png_ptr, errmsg);
1084
10.8k
   }
1085
1086
   /* Because PNG_UNUSED(errmsg) does not work if all the uses are compiled out
1087
    * (this does happen).
1088
    */
1089
10.8k
   return errmsg != NULL ? handled_error : handled_error;
1090
10.9k
}
1091
1092
/* On read the IDAT chunk is always handled specially, even if marked for
1093
 * unknown handling (this is allowed), so:
1094
 */
1095
#define png_handle_IDAT NULL
1096
1097
static png_handle_result_code
1098
png_handle_IEND(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1099
8.43k
{
1100
8.43k
   png_debug(1, "in png_handle_IEND");
1101
1102
8.43k
   png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);
1103
1104
8.43k
   if (length != 0)
1105
59
      png_chunk_benign_error(png_ptr, "invalid");
1106
1107
8.43k
   png_crc_finish_critical(png_ptr, length, 1/*handle as ancillary*/);
1108
1109
8.43k
   return handled_ok;
1110
0
   PNG_UNUSED(info_ptr)
1111
0
}
1112
1113
#ifdef PNG_READ_gAMA_SUPPORTED
1114
static png_handle_result_code
1115
png_handle_gAMA(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1116
3.55k
{
1117
3.55k
   png_uint_32 ugamma;
1118
3.55k
   png_byte buf[4];
1119
1120
3.55k
   png_debug(1, "in png_handle_gAMA");
1121
1122
3.55k
   png_crc_read(png_ptr, buf, 4);
1123
1124
3.55k
   if (png_crc_finish(png_ptr, 0) != 0)
1125
452
      return handled_error;
1126
1127
3.10k
   ugamma = png_get_uint_32(buf);
1128
1129
3.10k
   if (ugamma > PNG_UINT_31_MAX)
1130
796
   {
1131
796
      png_chunk_benign_error(png_ptr, "invalid");
1132
796
      return handled_error;
1133
796
   }
1134
1135
2.30k
   png_set_gAMA_fixed(png_ptr, info_ptr, (png_fixed_point)/*SAFE*/ugamma);
1136
1137
2.30k
#ifdef PNG_READ_GAMMA_SUPPORTED
1138
      /* PNGv3: chunk precedence for gamma is cICP, [iCCP], sRGB, gAMA.  gAMA is
1139
       * at the end of the chain so simply check for an unset value.
1140
       */
1141
2.30k
      if (png_ptr->chunk_gamma == 0)
1142
2.26k
         png_ptr->chunk_gamma = (png_fixed_point)/*SAFE*/ugamma;
1143
2.30k
#endif /*READ_GAMMA*/
1144
1145
2.30k
   return handled_ok;
1146
0
   PNG_UNUSED(length)
1147
0
}
1148
#else
1149
#  define png_handle_gAMA NULL
1150
#endif
1151
1152
#ifdef PNG_READ_sBIT_SUPPORTED
1153
static png_handle_result_code /* PRIVATE */
1154
png_handle_sBIT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1155
3.69k
{
1156
3.69k
   unsigned int truelen, i;
1157
3.69k
   png_byte sample_depth;
1158
3.69k
   png_byte buf[4];
1159
1160
3.69k
   png_debug(1, "in png_handle_sBIT");
1161
1162
3.69k
   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1163
790
   {
1164
790
      truelen = 3;
1165
790
      sample_depth = 8;
1166
790
   }
1167
1168
2.90k
   else
1169
2.90k
   {
1170
2.90k
      truelen = png_ptr->channels;
1171
2.90k
      sample_depth = png_ptr->bit_depth;
1172
2.90k
   }
1173
1174
3.69k
   if (length != truelen)
1175
991
   {
1176
991
      png_crc_finish(png_ptr, length);
1177
991
      png_chunk_benign_error(png_ptr, "bad length");
1178
991
      return handled_error;
1179
991
   }
1180
1181
2.70k
   buf[0] = buf[1] = buf[2] = buf[3] = sample_depth;
1182
2.70k
   png_crc_read(png_ptr, buf, truelen);
1183
1184
2.70k
   if (png_crc_finish(png_ptr, 0) != 0)
1185
667
      return handled_error;
1186
1187
3.63k
   for (i=0; i<truelen; ++i)
1188
3.17k
   {
1189
3.17k
      if (buf[i] == 0 || buf[i] > sample_depth)
1190
1.57k
      {
1191
1.57k
         png_chunk_benign_error(png_ptr, "invalid");
1192
1.57k
         return handled_error;
1193
1.57k
      }
1194
3.17k
   }
1195
1196
468
   if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
1197
102
   {
1198
102
      png_ptr->sig_bit.red = buf[0];
1199
102
      png_ptr->sig_bit.green = buf[1];
1200
102
      png_ptr->sig_bit.blue = buf[2];
1201
102
      png_ptr->sig_bit.alpha = buf[3];
1202
102
   }
1203
1204
366
   else /* grayscale */
1205
366
   {
1206
366
      png_ptr->sig_bit.gray = buf[0];
1207
366
      png_ptr->sig_bit.red = buf[0];
1208
366
      png_ptr->sig_bit.green = buf[0];
1209
366
      png_ptr->sig_bit.blue = buf[0];
1210
366
      png_ptr->sig_bit.alpha = buf[1];
1211
366
   }
1212
1213
468
   png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));
1214
468
   return handled_ok;
1215
2.04k
}
1216
#else
1217
#  define png_handle_sBIT NULL
1218
#endif
1219
1220
#ifdef PNG_READ_cHRM_SUPPORTED
1221
static png_int_32
1222
png_get_int_32_checked(png_const_bytep buf, int *error)
1223
94.3k
{
1224
94.3k
   png_uint_32 uval = png_get_uint_32(buf);
1225
94.3k
   if ((uval & 0x80000000) == 0) /* non-negative */
1226
67.1k
      return (png_int_32)uval;
1227
1228
27.2k
   uval = (uval ^ 0xffffffff) + 1;  /* 2's complement: -x = ~x+1 */
1229
27.2k
   if ((uval & 0x80000000) == 0) /* no overflow */
1230
17.9k
      return -(png_int_32)uval;
1231
1232
   /* This version of png_get_int_32 has a way of returning the error to the
1233
    * caller, so:
1234
    */
1235
9.28k
   *error = 1;
1236
9.28k
   return 0; /* Safe */
1237
27.2k
}
1238
1239
static png_handle_result_code /* PRIVATE */
1240
png_handle_cHRM(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1241
12.3k
{
1242
12.3k
   int error = 0;
1243
12.3k
   png_xy xy;
1244
12.3k
   png_byte buf[32];
1245
1246
12.3k
   png_debug(1, "in png_handle_cHRM");
1247
1248
12.3k
   png_crc_read(png_ptr, buf, 32);
1249
1250
12.3k
   if (png_crc_finish(png_ptr, 0) != 0)
1251
478
      return handled_error;
1252
1253
11.8k
   xy.whitex = png_get_int_32_checked(buf +  0, &error);
1254
11.8k
   xy.whitey = png_get_int_32_checked(buf +  4, &error);
1255
11.8k
   xy.redx   = png_get_int_32_checked(buf +  8, &error);
1256
11.8k
   xy.redy   = png_get_int_32_checked(buf + 12, &error);
1257
11.8k
   xy.greenx = png_get_int_32_checked(buf + 16, &error);
1258
11.8k
   xy.greeny = png_get_int_32_checked(buf + 20, &error);
1259
11.8k
   xy.bluex  = png_get_int_32_checked(buf + 24, &error);
1260
11.8k
   xy.bluey  = png_get_int_32_checked(buf + 28, &error);
1261
1262
11.8k
   if (error)
1263
4.62k
   {
1264
4.62k
      png_chunk_benign_error(png_ptr, "invalid");
1265
4.62k
      return handled_error;
1266
4.62k
   }
1267
1268
   /* png_set_cHRM may complain about some of the values but this doesn't matter
1269
    * because it was a cHRM and it did have vaguely (if, perhaps, ridiculous)
1270
    * values.  Ridiculousity will be checked if the values are used later.
1271
    */
1272
7.19k
   png_set_cHRM_fixed(png_ptr, info_ptr, xy.whitex, xy.whitey, xy.redx, xy.redy,
1273
7.19k
         xy.greenx, xy.greeny, xy.bluex, xy.bluey);
1274
1275
   /* We only use 'chromaticities' for RGB to gray */
1276
7.19k
#  ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
1277
      /* There is no need to check sRGB here, cICP is NYI and iCCP is not
1278
       * supported so just check mDCV.
1279
       */
1280
7.19k
      if (!png_has_chunk(png_ptr, mDCV))
1281
7.16k
      {
1282
7.16k
         png_ptr->chromaticities = xy;
1283
7.16k
      }
1284
7.19k
#  endif /* READ_RGB_TO_GRAY */
1285
1286
7.19k
   return handled_ok;
1287
0
   PNG_UNUSED(length)
1288
0
}
1289
#else
1290
#  define png_handle_cHRM NULL
1291
#endif
1292
1293
#ifdef PNG_READ_sRGB_SUPPORTED
1294
static png_handle_result_code /* PRIVATE */
1295
png_handle_sRGB(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1296
1.41k
{
1297
1.41k
   png_byte intent;
1298
1299
1.41k
   png_debug(1, "in png_handle_sRGB");
1300
1301
1.41k
   png_crc_read(png_ptr, &intent, 1);
1302
1303
1.41k
   if (png_crc_finish(png_ptr, 0) != 0)
1304
672
      return handled_error;
1305
1306
   /* This checks the range of the "rendering intent" because it is specified in
1307
    * the PNG spec itself; the "reserved" values will result in the chunk not
1308
    * being accepted, just as they do with the various "reserved" values in
1309
    * IHDR.
1310
    */
1311
741
   if (intent > 3/*PNGv3 spec*/)
1312
528
   {
1313
528
      png_chunk_benign_error(png_ptr, "invalid");
1314
528
      return handled_error;
1315
528
   }
1316
1317
213
   png_set_sRGB(png_ptr, info_ptr, intent);
1318
   /* NOTE: png_struct::chromaticities is not set here because the RGB to gray
1319
    * coefficients are known without a need for the chromaticities.
1320
    */
1321
1322
213
#ifdef PNG_READ_GAMMA_SUPPORTED
1323
      /* PNGv3: chunk precedence for gamma is cICP, [iCCP], sRGB, gAMA.  iCCP is
1324
       * not supported by libpng so the only requirement is to check for cICP
1325
       * setting the gamma (this is NYI, but this check is safe.)
1326
       */
1327
213
      if (!png_has_chunk(png_ptr, cICP) || png_ptr->chunk_gamma == 0)
1328
107
         png_ptr->chunk_gamma = PNG_GAMMA_sRGB_INVERSE;
1329
213
#endif /*READ_GAMMA*/
1330
1331
213
   return handled_ok;
1332
0
   PNG_UNUSED(length)
1333
0
}
1334
#else
1335
#  define png_handle_sRGB NULL
1336
#endif /* READ_sRGB */
1337
1338
#ifdef PNG_READ_iCCP_SUPPORTED
1339
static png_handle_result_code /* PRIVATE */
1340
png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1341
/* Note: this does not properly handle profiles that are > 64K under DOS */
1342
24.3k
{
1343
24.3k
   png_const_charp errmsg = NULL; /* error message output, or no error */
1344
24.3k
   int finished = 0; /* crc checked */
1345
1346
24.3k
   png_debug(1, "in png_handle_iCCP");
1347
1348
   /* PNGv3: allow PNG files with both sRGB and iCCP because the PNG spec only
1349
    * ever said that there "should" be only one, not "shall" and the PNGv3
1350
    * colour chunk precedence rules give a handling for this case anyway.
1351
    */
1352
24.3k
   {
1353
24.3k
      uInt read_length, keyword_length;
1354
24.3k
      char keyword[81];
1355
1356
      /* Find the keyword; the keyword plus separator and compression method
1357
       * bytes can be at most 81 characters long.
1358
       */
1359
24.3k
      read_length = 81; /* maximum */
1360
24.3k
      if (read_length > length)
1361
1.49k
         read_length = (uInt)/*SAFE*/length;
1362
1363
24.3k
      png_crc_read(png_ptr, (png_bytep)keyword, read_length);
1364
24.3k
      length -= read_length;
1365
1366
24.3k
      if (length < LZ77Min)
1367
2.08k
      {
1368
2.08k
         png_crc_finish(png_ptr, length);
1369
2.08k
         png_chunk_benign_error(png_ptr, "too short");
1370
2.08k
         return handled_error;
1371
2.08k
      }
1372
1373
22.2k
      keyword_length = 0;
1374
91.5k
      while (keyword_length < 80 && keyword_length < read_length &&
1375
91.5k
         keyword[keyword_length] != 0)
1376
69.3k
         ++keyword_length;
1377
1378
      /* TODO: make the keyword checking common */
1379
22.2k
      if (keyword_length >= 1 && keyword_length <= 79)
1380
21.6k
      {
1381
         /* We only understand '0' compression - deflate - so if we get a
1382
          * different value we can't safely decode the chunk.
1383
          */
1384
21.6k
         if (keyword_length+1 < read_length &&
1385
21.6k
            keyword[keyword_length+1] == PNG_COMPRESSION_TYPE_BASE)
1386
21.3k
         {
1387
21.3k
            read_length -= keyword_length+2;
1388
1389
21.3k
            if (png_inflate_claim(png_ptr, png_iCCP) == Z_OK)
1390
21.3k
            {
1391
21.3k
               Byte profile_header[132]={0};
1392
21.3k
               Byte local_buffer[PNG_INFLATE_BUF_SIZE];
1393
21.3k
               png_alloc_size_t size = (sizeof profile_header);
1394
1395
21.3k
               png_ptr->zstream.next_in = (Bytef*)keyword + (keyword_length+2);
1396
21.3k
               png_ptr->zstream.avail_in = read_length;
1397
21.3k
               (void)png_inflate_read(png_ptr, local_buffer,
1398
21.3k
                   (sizeof local_buffer), &length, profile_header, &size,
1399
21.3k
                   0/*finish: don't, because the output is too small*/);
1400
1401
21.3k
               if (size == 0)
1402
20.2k
               {
1403
                  /* We have the ICC profile header; do the basic header checks.
1404
                   */
1405
20.2k
                  png_uint_32 profile_length = png_get_uint_32(profile_header);
1406
1407
20.2k
                  if (png_icc_check_length(png_ptr, keyword, profile_length) !=
1408
20.2k
                      0)
1409
19.3k
                  {
1410
                     /* The length is apparently ok, so we can check the 132
1411
                      * byte header.
1412
                      */
1413
19.3k
                     if (png_icc_check_header(png_ptr, keyword, profile_length,
1414
19.3k
                              profile_header, png_ptr->color_type) != 0)
1415
8.80k
                     {
1416
                        /* Now read the tag table; a variable size buffer is
1417
                         * needed at this point, allocate one for the whole
1418
                         * profile.  The header check has already validated
1419
                         * that none of this stuff will overflow.
1420
                         */
1421
8.80k
                        png_uint_32 tag_count =
1422
8.80k
                           png_get_uint_32(profile_header + 128);
1423
8.80k
                        png_bytep profile = png_read_buffer(png_ptr,
1424
8.80k
                              profile_length);
1425
1426
8.80k
                        if (profile != NULL)
1427
8.80k
                        {
1428
8.80k
                           memcpy(profile, profile_header,
1429
8.80k
                               (sizeof profile_header));
1430
1431
8.80k
                           size = 12 * tag_count;
1432
1433
8.80k
                           (void)png_inflate_read(png_ptr, local_buffer,
1434
8.80k
                               (sizeof local_buffer), &length,
1435
8.80k
                               profile + (sizeof profile_header), &size, 0);
1436
1437
                           /* Still expect a buffer error because we expect
1438
                            * there to be some tag data!
1439
                            */
1440
8.80k
                           if (size == 0)
1441
6.67k
                           {
1442
6.67k
                              if (png_icc_check_tag_table(png_ptr,
1443
6.67k
                                       keyword, profile_length, profile) != 0)
1444
4.44k
                              {
1445
                                 /* The profile has been validated for basic
1446
                                  * security issues, so read the whole thing in.
1447
                                  */
1448
4.44k
                                 size = profile_length - (sizeof profile_header)
1449
4.44k
                                     - 12 * tag_count;
1450
1451
4.44k
                                 (void)png_inflate_read(png_ptr, local_buffer,
1452
4.44k
                                     (sizeof local_buffer), &length,
1453
4.44k
                                     profile + (sizeof profile_header) +
1454
4.44k
                                     12 * tag_count, &size, 1/*finish*/);
1455
1456
4.44k
                                 if (length > 0 && !(png_ptr->flags &
1457
640
                                     PNG_FLAG_BENIGN_ERRORS_WARN))
1458
0
                                    errmsg = "extra compressed data";
1459
1460
                                 /* But otherwise allow extra data: */
1461
4.44k
                                 else if (size == 0)
1462
240
                                 {
1463
240
                                    if (length > 0)
1464
71
                                    {
1465
                                       /* This can be handled completely, so
1466
                                        * keep going.
1467
                                        */
1468
71
                                       png_chunk_warning(png_ptr,
1469
71
                                           "extra compressed data");
1470
71
                                    }
1471
1472
240
                                    png_crc_finish(png_ptr, length);
1473
240
                                    finished = 1;
1474
1475
                                    /* Steal the profile for info_ptr. */
1476
240
                                    if (info_ptr != NULL)
1477
211
                                    {
1478
211
                                       png_free_data(png_ptr, info_ptr,
1479
211
                                           PNG_FREE_ICCP, 0);
1480
1481
211
                                       info_ptr->iccp_name = png_voidcast(char*,
1482
211
                                           png_malloc_base(png_ptr,
1483
211
                                           keyword_length+1));
1484
211
                                       if (info_ptr->iccp_name != NULL)
1485
211
                                       {
1486
211
                                          memcpy(info_ptr->iccp_name, keyword,
1487
211
                                              keyword_length+1);
1488
211
                                          info_ptr->iccp_proflen =
1489
211
                                              profile_length;
1490
211
                                          info_ptr->iccp_profile = profile;
1491
211
                                          png_ptr->read_buffer = NULL; /*steal*/
1492
211
                                          info_ptr->free_me |= PNG_FREE_ICCP;
1493
211
                                          info_ptr->valid |= PNG_INFO_iCCP;
1494
211
                                       }
1495
1496
0
                                       else
1497
0
                                          errmsg = "out of memory";
1498
211
                                    }
1499
1500
                                    /* else the profile remains in the read
1501
                                     * buffer which gets reused for subsequent
1502
                                     * chunks.
1503
                                     */
1504
1505
240
                                    if (errmsg == NULL)
1506
211
                                    {
1507
211
                                       png_ptr->zowner = 0;
1508
211
                                       return handled_ok;
1509
211
                                    }
1510
240
                                 }
1511
4.23k
                                 if (errmsg == NULL)
1512
4.13k
                                    errmsg = png_ptr->zstream.msg;
1513
4.23k
                              }
1514
                              /* else png_icc_check_tag_table output an error */
1515
6.67k
                           }
1516
2.13k
                           else /* profile truncated */
1517
2.13k
                              errmsg = png_ptr->zstream.msg;
1518
8.80k
                        }
1519
1520
0
                        else
1521
0
                           errmsg = "out of memory";
1522
8.80k
                     }
1523
1524
                     /* else png_icc_check_header output an error */
1525
19.3k
                  }
1526
1527
                  /* else png_icc_check_length output an error */
1528
20.2k
               }
1529
1530
1.09k
               else /* profile truncated */
1531
1.09k
                  errmsg = png_ptr->zstream.msg;
1532
1533
               /* Release the stream */
1534
21.1k
               png_ptr->zowner = 0;
1535
21.1k
            }
1536
1537
0
            else /* png_inflate_claim failed */
1538
0
               errmsg = png_ptr->zstream.msg;
1539
21.3k
         }
1540
1541
280
         else
1542
280
            errmsg = "bad compression method"; /* or missing */
1543
21.6k
      }
1544
1545
620
      else
1546
620
         errmsg = "bad keyword";
1547
22.2k
   }
1548
1549
   /* Failure: the reason is in 'errmsg' */
1550
22.0k
   if (finished == 0)
1551
20.5k
      png_crc_finish(png_ptr, length);
1552
1553
22.0k
   if (errmsg != NULL) /* else already output */
1554
7.68k
      png_chunk_benign_error(png_ptr, errmsg);
1555
1556
22.0k
   return handled_error;
1557
22.2k
}
1558
#else
1559
#  define png_handle_iCCP NULL
1560
#endif /* READ_iCCP */
1561
1562
#ifdef PNG_READ_sPLT_SUPPORTED
1563
static png_handle_result_code /* PRIVATE */
1564
png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1565
/* Note: this does not properly handle chunks that are > 64K under DOS */
1566
22.6k
{
1567
22.6k
   png_bytep entry_start, buffer;
1568
22.6k
   png_sPLT_t new_palette;
1569
22.6k
   png_sPLT_entryp pp;
1570
22.6k
   png_uint_32 data_length;
1571
22.6k
   int entry_size, i;
1572
22.6k
   png_uint_32 skip = 0;
1573
22.6k
   png_uint_32 dl;
1574
22.6k
   size_t max_dl;
1575
1576
22.6k
   png_debug(1, "in png_handle_sPLT");
1577
1578
22.6k
#ifdef PNG_USER_LIMITS_SUPPORTED
1579
22.6k
   if (png_ptr->user_chunk_cache_max != 0)
1580
22.6k
   {
1581
22.6k
      if (png_ptr->user_chunk_cache_max == 1)
1582
390
      {
1583
390
         png_crc_finish(png_ptr, length);
1584
390
         return handled_error;
1585
390
      }
1586
1587
22.2k
      if (--png_ptr->user_chunk_cache_max == 1)
1588
11
      {
1589
11
         png_warning(png_ptr, "No space in chunk cache for sPLT");
1590
11
         png_crc_finish(png_ptr, length);
1591
11
         return handled_error;
1592
11
      }
1593
22.2k
   }
1594
22.2k
#endif
1595
1596
22.2k
   buffer = png_read_buffer(png_ptr, length+1);
1597
22.2k
   if (buffer == NULL)
1598
12
   {
1599
12
      png_crc_finish(png_ptr, length);
1600
12
      png_chunk_benign_error(png_ptr, "out of memory");
1601
12
      return handled_error;
1602
12
   }
1603
1604
1605
   /* WARNING: this may break if size_t is less than 32 bits; it is assumed
1606
    * that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a
1607
    * potential breakage point if the types in pngconf.h aren't exactly right.
1608
    */
1609
22.2k
   png_crc_read(png_ptr, buffer, length);
1610
1611
22.2k
   if (png_crc_finish(png_ptr, skip) != 0)
1612
473
      return handled_error;
1613
1614
21.7k
   buffer[length] = 0;
1615
1616
3.01M
   for (entry_start = buffer; *entry_start; entry_start++)
1617
2.99M
      /* Empty loop to find end of name */ ;
1618
1619
21.7k
   ++entry_start;
1620
1621
   /* A sample depth should follow the separator, and we should be on it  */
1622
21.7k
   if (length < 2U || entry_start > buffer + (length - 2U))
1623
5.72k
   {
1624
5.72k
      png_warning(png_ptr, "malformed sPLT chunk");
1625
5.72k
      return handled_error;
1626
5.72k
   }
1627
1628
16.0k
   new_palette.depth = *entry_start++;
1629
16.0k
   entry_size = (new_palette.depth == 8 ? 6 : 10);
1630
   /* This must fit in a png_uint_32 because it is derived from the original
1631
    * chunk data length.
1632
    */
1633
16.0k
   data_length = length - (png_uint_32)(entry_start - buffer);
1634
1635
   /* Integrity-check the data length */
1636
16.0k
   if ((data_length % (unsigned int)entry_size) != 0)
1637
3.13k
   {
1638
3.13k
      png_warning(png_ptr, "sPLT chunk has bad length");
1639
3.13k
      return handled_error;
1640
3.13k
   }
1641
1642
12.8k
   dl = (png_uint_32)(data_length / (unsigned int)entry_size);
1643
12.8k
   max_dl = PNG_SIZE_MAX / (sizeof (png_sPLT_entry));
1644
1645
12.8k
   if (dl > max_dl)
1646
0
   {
1647
0
      png_warning(png_ptr, "sPLT chunk too long");
1648
0
      return handled_error;
1649
0
   }
1650
1651
12.8k
   new_palette.nentries = (png_int_32)(data_length / (unsigned int)entry_size);
1652
1653
12.8k
   new_palette.entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
1654
12.8k
       (png_alloc_size_t) new_palette.nentries * (sizeof (png_sPLT_entry)));
1655
1656
12.8k
   if (new_palette.entries == NULL)
1657
0
   {
1658
0
      png_warning(png_ptr, "sPLT chunk requires too much memory");
1659
0
      return handled_error;
1660
0
   }
1661
1662
232k
   for (i = 0; i < new_palette.nentries; i++)
1663
219k
   {
1664
219k
      pp = new_palette.entries + i;
1665
1666
219k
      if (new_palette.depth == 8)
1667
17.6k
      {
1668
17.6k
         pp->red = *entry_start++;
1669
17.6k
         pp->green = *entry_start++;
1670
17.6k
         pp->blue = *entry_start++;
1671
17.6k
         pp->alpha = *entry_start++;
1672
17.6k
      }
1673
1674
202k
      else
1675
202k
      {
1676
202k
         pp->red   = png_get_uint_16(entry_start); entry_start += 2;
1677
202k
         pp->green = png_get_uint_16(entry_start); entry_start += 2;
1678
202k
         pp->blue  = png_get_uint_16(entry_start); entry_start += 2;
1679
202k
         pp->alpha = png_get_uint_16(entry_start); entry_start += 2;
1680
202k
      }
1681
1682
219k
      pp->frequency = png_get_uint_16(entry_start); entry_start += 2;
1683
219k
   }
1684
1685
   /* Discard all chunk data except the name and stash that */
1686
12.8k
   new_palette.name = (png_charp)buffer;
1687
1688
12.8k
   png_set_sPLT(png_ptr, info_ptr, &new_palette, 1);
1689
1690
12.8k
   png_free(png_ptr, new_palette.entries);
1691
12.8k
   return handled_ok;
1692
12.8k
}
1693
#else
1694
#  define png_handle_sPLT NULL
1695
#endif /* READ_sPLT */
1696
1697
#ifdef PNG_READ_tRNS_SUPPORTED
1698
static png_handle_result_code /* PRIVATE */
1699
png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1700
12.8k
{
1701
12.8k
   png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
1702
1703
12.8k
   png_debug(1, "in png_handle_tRNS");
1704
1705
12.8k
   if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
1706
4.74k
   {
1707
4.74k
      png_byte buf[2];
1708
1709
4.74k
      if (length != 2)
1710
1.54k
      {
1711
1.54k
         png_crc_finish(png_ptr, length);
1712
1.54k
         png_chunk_benign_error(png_ptr, "invalid");
1713
1.54k
         return handled_error;
1714
1.54k
      }
1715
1716
3.20k
      png_crc_read(png_ptr, buf, 2);
1717
3.20k
      png_ptr->num_trans = 1;
1718
3.20k
      png_ptr->trans_color.gray = png_get_uint_16(buf);
1719
3.20k
   }
1720
1721
8.12k
   else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
1722
3.07k
   {
1723
3.07k
      png_byte buf[6];
1724
1725
3.07k
      if (length != 6)
1726
1.10k
      {
1727
1.10k
         png_crc_finish(png_ptr, length);
1728
1.10k
         png_chunk_benign_error(png_ptr, "invalid");
1729
1.10k
         return handled_error;
1730
1.10k
      }
1731
1732
1.96k
      png_crc_read(png_ptr, buf, length);
1733
1.96k
      png_ptr->num_trans = 1;
1734
1.96k
      png_ptr->trans_color.red = png_get_uint_16(buf);
1735
1.96k
      png_ptr->trans_color.green = png_get_uint_16(buf + 2);
1736
1.96k
      png_ptr->trans_color.blue = png_get_uint_16(buf + 4);
1737
1.96k
   }
1738
1739
5.05k
   else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1740
3.73k
   {
1741
3.73k
      if ((png_ptr->mode & PNG_HAVE_PLTE) == 0)
1742
794
      {
1743
794
         png_crc_finish(png_ptr, length);
1744
794
         png_chunk_benign_error(png_ptr, "out of place");
1745
794
         return handled_error;
1746
794
      }
1747
1748
2.94k
      if (length > (unsigned int) png_ptr->num_palette ||
1749
2.94k
         length > (unsigned int) PNG_MAX_PALETTE_LENGTH ||
1750
2.94k
         length == 0)
1751
1.33k
      {
1752
1.33k
         png_crc_finish(png_ptr, length);
1753
1.33k
         png_chunk_benign_error(png_ptr, "invalid");
1754
1.33k
         return handled_error;
1755
1.33k
      }
1756
1757
1.60k
      png_crc_read(png_ptr, readbuf, length);
1758
1.60k
      png_ptr->num_trans = (png_uint_16)length;
1759
1.60k
   }
1760
1761
1.31k
   else
1762
1.31k
   {
1763
1.31k
      png_crc_finish(png_ptr, length);
1764
1.31k
      png_chunk_benign_error(png_ptr, "invalid with alpha channel");
1765
1.31k
      return handled_error;
1766
1.31k
   }
1767
1768
6.77k
   if (png_crc_finish(png_ptr, 0) != 0)
1769
2.93k
   {
1770
2.93k
      png_ptr->num_trans = 0;
1771
2.93k
      return handled_error;
1772
2.93k
   }
1773
1774
   /* TODO: this is a horrible side effect in the palette case because the
1775
    * png_struct ends up with a pointer to the tRNS buffer owned by the
1776
    * png_info.  Fix this.
1777
    */
1778
3.84k
   png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
1779
3.84k
       &(png_ptr->trans_color));
1780
3.84k
   return handled_ok;
1781
6.77k
}
1782
#else
1783
#  define png_handle_tRNS NULL
1784
#endif
1785
1786
#ifdef PNG_READ_bKGD_SUPPORTED
1787
static png_handle_result_code /* PRIVATE */
1788
png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1789
5.64k
{
1790
5.64k
   unsigned int truelen;
1791
5.64k
   png_byte buf[6];
1792
5.64k
   png_color_16 background;
1793
1794
5.64k
   png_debug(1, "in png_handle_bKGD");
1795
1796
5.64k
   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1797
1.34k
   {
1798
1.34k
      if ((png_ptr->mode & PNG_HAVE_PLTE) == 0)
1799
522
      {
1800
522
         png_crc_finish(png_ptr, length);
1801
522
         png_chunk_benign_error(png_ptr, "out of place");
1802
522
         return handled_error;
1803
522
      }
1804
1805
824
      truelen = 1;
1806
824
   }
1807
1808
4.29k
   else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
1809
2.29k
      truelen = 6;
1810
1811
2.00k
   else
1812
2.00k
      truelen = 2;
1813
1814
5.12k
   if (length != truelen)
1815
987
   {
1816
987
      png_crc_finish(png_ptr, length);
1817
987
      png_chunk_benign_error(png_ptr, "invalid");
1818
987
      return handled_error;
1819
987
   }
1820
1821
4.13k
   png_crc_read(png_ptr, buf, truelen);
1822
1823
4.13k
   if (png_crc_finish(png_ptr, 0) != 0)
1824
425
      return handled_error;
1825
1826
   /* We convert the index value into RGB components so that we can allow
1827
    * arbitrary RGB values for background when we have transparency, and
1828
    * so it is easy to determine the RGB values of the background color
1829
    * from the info_ptr struct.
1830
    */
1831
3.71k
   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1832
786
   {
1833
786
      background.index = buf[0];
1834
1835
786
      if (info_ptr != NULL && info_ptr->num_palette != 0)
1836
786
      {
1837
786
         if (buf[0] >= info_ptr->num_palette)
1838
733
         {
1839
733
            png_chunk_benign_error(png_ptr, "invalid index");
1840
733
            return handled_error;
1841
733
         }
1842
1843
53
         background.red = (png_uint_16)png_ptr->palette[buf[0]].red;
1844
53
         background.green = (png_uint_16)png_ptr->palette[buf[0]].green;
1845
53
         background.blue = (png_uint_16)png_ptr->palette[buf[0]].blue;
1846
53
      }
1847
1848
0
      else
1849
0
         background.red = background.green = background.blue = 0;
1850
1851
53
      background.gray = 0;
1852
53
   }
1853
1854
2.92k
   else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) /* GRAY */
1855
1.25k
   {
1856
1.25k
      if (png_ptr->bit_depth <= 8)
1857
1.24k
      {
1858
1.24k
         if (buf[0] != 0 || buf[1] >= (unsigned int)(1 << png_ptr->bit_depth))
1859
1.22k
         {
1860
1.22k
            png_chunk_benign_error(png_ptr, "invalid gray level");
1861
1.22k
            return handled_error;
1862
1.22k
         }
1863
1.24k
      }
1864
1865
37
      background.index = 0;
1866
37
      background.red =
1867
37
      background.green =
1868
37
      background.blue =
1869
37
      background.gray = png_get_uint_16(buf);
1870
37
   }
1871
1872
1.66k
   else
1873
1.66k
   {
1874
1.66k
      if (png_ptr->bit_depth <= 8)
1875
1.56k
      {
1876
1.56k
         if (buf[0] != 0 || buf[2] != 0 || buf[4] != 0)
1877
1.53k
         {
1878
1.53k
            png_chunk_benign_error(png_ptr, "invalid color");
1879
1.53k
            return handled_error;
1880
1.53k
         }
1881
1.56k
      }
1882
1883
134
      background.index = 0;
1884
134
      background.red = png_get_uint_16(buf);
1885
134
      background.green = png_get_uint_16(buf + 2);
1886
134
      background.blue = png_get_uint_16(buf + 4);
1887
134
      background.gray = 0;
1888
134
   }
1889
1890
224
   png_set_bKGD(png_ptr, info_ptr, &background);
1891
224
   return handled_ok;
1892
3.71k
}
1893
#else
1894
#  define png_handle_bKGD NULL
1895
#endif
1896
1897
#ifdef PNG_READ_cICP_SUPPORTED
1898
static png_handle_result_code /* PRIVATE */
1899
png_handle_cICP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1900
2.27k
{
1901
2.27k
   png_byte buf[4];
1902
1903
2.27k
   png_debug(1, "in png_handle_cICP");
1904
1905
2.27k
   png_crc_read(png_ptr, buf, 4);
1906
1907
2.27k
   if (png_crc_finish(png_ptr, 0) != 0)
1908
375
      return handled_error;
1909
1910
1.90k
   png_set_cICP(png_ptr, info_ptr, buf[0], buf[1],  buf[2], buf[3]);
1911
1912
   /* We only use 'chromaticities' for RGB to gray */
1913
1.90k
#  ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
1914
1.90k
      if (!png_has_chunk(png_ptr, mDCV))
1915
1.68k
      {
1916
         /* TODO: png_ptr->chromaticities = chromaticities; */
1917
1.68k
      }
1918
1.90k
#  endif /* READ_RGB_TO_GRAY */
1919
1920
1.90k
#ifdef PNG_READ_GAMMA_SUPPORTED
1921
      /* PNGv3: chunk precedence for gamma is cICP, [iCCP], sRGB, gAMA.  cICP is
1922
       * at the head so simply set the gamma if it can be determined.  If not
1923
       * chunk_gamma remains unchanged; sRGB and gAMA handling check it for
1924
       * being zero.
1925
       */
1926
      /* TODO: set png_struct::chunk_gamma when possible */
1927
1.90k
#endif /*READ_GAMMA*/
1928
1929
1.90k
   return handled_ok;
1930
0
   PNG_UNUSED(length)
1931
0
}
1932
#else
1933
#  define png_handle_cICP NULL
1934
#endif
1935
1936
#ifdef PNG_READ_cLLI_SUPPORTED
1937
static png_handle_result_code /* PRIVATE */
1938
png_handle_cLLI(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1939
1.28k
{
1940
1.28k
   png_byte buf[8];
1941
1942
1.28k
   png_debug(1, "in png_handle_cLLI");
1943
1944
1.28k
   png_crc_read(png_ptr, buf, 8);
1945
1946
1.28k
   if (png_crc_finish(png_ptr, 0) != 0)
1947
749
      return handled_error;
1948
1949
   /* The error checking happens here, this puts it in just one place: */
1950
536
   png_set_cLLI_fixed(png_ptr, info_ptr, png_get_uint_32(buf),
1951
536
         png_get_uint_32(buf+4));
1952
536
   return handled_ok;
1953
0
   PNG_UNUSED(length)
1954
0
}
1955
#else
1956
#  define png_handle_cLLI NULL
1957
#endif
1958
1959
#ifdef PNG_READ_mDCV_SUPPORTED
1960
static png_handle_result_code /* PRIVATE */
1961
png_handle_mDCV(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1962
3.11k
{
1963
3.11k
   png_xy chromaticities;
1964
3.11k
   png_byte buf[24];
1965
1966
3.11k
   png_debug(1, "in png_handle_mDCV");
1967
1968
3.11k
   png_crc_read(png_ptr, buf, 24);
1969
1970
3.11k
   if (png_crc_finish(png_ptr, 0) != 0)
1971
493
      return handled_error;
1972
1973
   /* The error checking happens here, this puts it in just one place.  The
1974
    * odd /50000 scaling factor makes it more difficult but the (x.y) values are
1975
    * only two bytes so a <<1 is safe.
1976
    *
1977
    * WARNING: the PNG specification defines the cHRM chunk to **start** with
1978
    * the white point (x,y).  The W3C PNG v3 specification puts the white point
1979
    * **after* R,G,B.  The x,y values in mDCV are also scaled by 50,000 and
1980
    * stored in just two bytes, whereas those in cHRM are scaled by 100,000 and
1981
    * stored in four bytes.  This is very, very confusing.  These APIs remove
1982
    * the confusion by copying the existing, well established, API.
1983
    */
1984
2.62k
   chromaticities.redx   = png_get_uint_16(buf+ 0U) << 1; /* red x */
1985
2.62k
   chromaticities.redy   = png_get_uint_16(buf+ 2U) << 1; /* red y */
1986
2.62k
   chromaticities.greenx = png_get_uint_16(buf+ 4U) << 1; /* green x */
1987
2.62k
   chromaticities.greeny = png_get_uint_16(buf+ 6U) << 1; /* green y */
1988
2.62k
   chromaticities.bluex  = png_get_uint_16(buf+ 8U) << 1; /* blue x */
1989
2.62k
   chromaticities.bluey  = png_get_uint_16(buf+10U) << 1; /* blue y */
1990
2.62k
   chromaticities.whitex = png_get_uint_16(buf+12U) << 1; /* white x */
1991
2.62k
   chromaticities.whitey = png_get_uint_16(buf+14U) << 1; /* white y */
1992
1993
2.62k
   png_set_mDCV_fixed(png_ptr, info_ptr,
1994
2.62k
         chromaticities.whitex, chromaticities.whitey,
1995
2.62k
         chromaticities.redx, chromaticities.redy,
1996
2.62k
         chromaticities.greenx, chromaticities.greeny,
1997
2.62k
         chromaticities.bluex, chromaticities.bluey,
1998
2.62k
         png_get_uint_32(buf+16U), /* peak luminance */
1999
2.62k
         png_get_uint_32(buf+20U));/* minimum perceivable luminance */
2000
2001
   /* We only use 'chromaticities' for RGB to gray */
2002
2.62k
#  ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
2003
2.62k
      png_ptr->chromaticities = chromaticities;
2004
2.62k
#  endif /* READ_RGB_TO_GRAY */
2005
2006
2.62k
   return handled_ok;
2007
0
   PNG_UNUSED(length)
2008
0
}
2009
#else
2010
#  define png_handle_mDCV NULL
2011
#endif
2012
2013
#ifdef PNG_READ_eXIf_SUPPORTED
2014
static png_handle_result_code /* PRIVATE */
2015
png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2016
2.53k
{
2017
2.53k
   png_bytep buffer = NULL;
2018
2019
2.53k
   png_debug(1, "in png_handle_eXIf");
2020
2021
2.53k
   buffer = png_read_buffer(png_ptr, length);
2022
2023
2.53k
   if (buffer == NULL)
2024
0
   {
2025
0
      png_crc_finish(png_ptr, length);
2026
0
      png_chunk_benign_error(png_ptr, "out of memory");
2027
0
      return handled_error;
2028
0
   }
2029
2030
2.53k
   png_crc_read(png_ptr, buffer, length);
2031
2032
2.53k
   if (png_crc_finish(png_ptr, 0) != 0)
2033
336
      return handled_error;
2034
2035
   /* PNGv3: the code used to check the byte order mark at the start for MM or
2036
    * II, however PNGv3 states that the the first 4 bytes should be checked.
2037
    * The caller ensures that there are four bytes available.
2038
    */
2039
2.19k
   {
2040
2.19k
      png_uint_32 header = png_get_uint_32(buffer);
2041
2042
      /* These numbers are copied from the PNGv3 spec: */
2043
2.19k
      if (header != 0x49492A00 && header != 0x4D4D002A)
2044
1.97k
      {
2045
1.97k
         png_chunk_benign_error(png_ptr, "invalid");
2046
1.97k
         return handled_error;
2047
1.97k
      }
2048
2.19k
   }
2049
2050
225
   png_set_eXIf_1(png_ptr, info_ptr, length, buffer);
2051
225
   return handled_ok;
2052
2.19k
}
2053
#else
2054
#  define png_handle_eXIf NULL
2055
#endif
2056
2057
#ifdef PNG_READ_hIST_SUPPORTED
2058
static png_handle_result_code /* PRIVATE */
2059
png_handle_hIST(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2060
1.86k
{
2061
1.86k
   unsigned int num, i;
2062
1.86k
   png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
2063
2064
1.86k
   png_debug(1, "in png_handle_hIST");
2065
2066
   /* This cast is safe because the chunk definition limits the length to a
2067
    * maximum of 1024 bytes.
2068
    *
2069
    * TODO: maybe use png_uint_32 anyway, not unsigned int, to reduce the
2070
    * casts.
2071
    */
2072
1.86k
   num = (unsigned int)length / 2 ;
2073
2074
1.86k
   if (length != num * 2 ||
2075
1.86k
       num != (unsigned int)png_ptr->num_palette ||
2076
1.86k
       num > (unsigned int)PNG_MAX_PALETTE_LENGTH)
2077
1.16k
   {
2078
1.16k
      png_crc_finish(png_ptr, length);
2079
1.16k
      png_chunk_benign_error(png_ptr, "invalid");
2080
1.16k
      return handled_error;
2081
1.16k
   }
2082
2083
699
   for (i = 0; i < num; i++)
2084
0
   {
2085
0
      png_byte buf[2];
2086
2087
0
      png_crc_read(png_ptr, buf, 2);
2088
0
      readbuf[i] = png_get_uint_16(buf);
2089
0
   }
2090
2091
699
   if (png_crc_finish(png_ptr, 0) != 0)
2092
487
      return handled_error;
2093
2094
212
   png_set_hIST(png_ptr, info_ptr, readbuf);
2095
212
   return handled_ok;
2096
699
}
2097
#else
2098
#  define png_handle_hIST NULL
2099
#endif
2100
2101
#ifdef PNG_READ_pHYs_SUPPORTED
2102
static png_handle_result_code /* PRIVATE */
2103
png_handle_pHYs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2104
562
{
2105
562
   png_byte buf[9];
2106
562
   png_uint_32 res_x, res_y;
2107
562
   int unit_type;
2108
2109
562
   png_debug(1, "in png_handle_pHYs");
2110
2111
562
   png_crc_read(png_ptr, buf, 9);
2112
2113
562
   if (png_crc_finish(png_ptr, 0) != 0)
2114
492
      return handled_error;
2115
2116
70
   res_x = png_get_uint_32(buf);
2117
70
   res_y = png_get_uint_32(buf + 4);
2118
70
   unit_type = buf[8];
2119
70
   png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type);
2120
70
   return handled_ok;
2121
0
   PNG_UNUSED(length)
2122
0
}
2123
#else
2124
#  define png_handle_pHYs NULL
2125
#endif
2126
2127
#ifdef PNG_READ_oFFs_SUPPORTED
2128
static png_handle_result_code /* PRIVATE */
2129
png_handle_oFFs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2130
653
{
2131
653
   png_byte buf[9];
2132
653
   png_int_32 offset_x, offset_y;
2133
653
   int unit_type;
2134
2135
653
   png_debug(1, "in png_handle_oFFs");
2136
2137
653
   png_crc_read(png_ptr, buf, 9);
2138
2139
653
   if (png_crc_finish(png_ptr, 0) != 0)
2140
511
      return handled_error;
2141
2142
142
   offset_x = png_get_int_32(buf);
2143
142
   offset_y = png_get_int_32(buf + 4);
2144
142
   unit_type = buf[8];
2145
142
   png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type);
2146
142
   return handled_ok;
2147
0
   PNG_UNUSED(length)
2148
0
}
2149
#else
2150
#  define png_handle_oFFs NULL
2151
#endif
2152
2153
#ifdef PNG_READ_pCAL_SUPPORTED
2154
/* Read the pCAL chunk (described in the PNG Extensions document) */
2155
static png_handle_result_code /* PRIVATE */
2156
png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2157
7.04k
{
2158
7.04k
   png_int_32 X0, X1;
2159
7.04k
   png_byte type, nparams;
2160
7.04k
   png_bytep buffer, buf, units, endptr;
2161
7.04k
   png_charpp params;
2162
7.04k
   int i;
2163
2164
7.04k
   png_debug(1, "in png_handle_pCAL");
2165
7.04k
   png_debug1(2, "Allocating and reading pCAL chunk data (%u bytes)",
2166
7.04k
       length + 1);
2167
2168
7.04k
   buffer = png_read_buffer(png_ptr, length+1);
2169
2170
7.04k
   if (buffer == NULL)
2171
15
   {
2172
15
      png_crc_finish(png_ptr, length);
2173
15
      png_chunk_benign_error(png_ptr, "out of memory");
2174
15
      return handled_error;
2175
15
   }
2176
2177
7.02k
   png_crc_read(png_ptr, buffer, length);
2178
2179
7.02k
   if (png_crc_finish(png_ptr, 0) != 0)
2180
490
      return handled_error;
2181
2182
6.53k
   buffer[length] = 0; /* Null terminate the last string */
2183
2184
6.53k
   png_debug(3, "Finding end of pCAL purpose string");
2185
1.29M
   for (buf = buffer; *buf; buf++)
2186
1.28M
      /* Empty loop */ ;
2187
2188
6.53k
   endptr = buffer + length;
2189
2190
   /* We need to have at least 12 bytes after the purpose string
2191
    * in order to get the parameter information.
2192
    */
2193
6.53k
   if (endptr - buf <= 12)
2194
935
   {
2195
935
      png_chunk_benign_error(png_ptr, "invalid");
2196
935
      return handled_error;
2197
935
   }
2198
2199
5.60k
   png_debug(3, "Reading pCAL X0, X1, type, nparams, and units");
2200
5.60k
   X0 = png_get_int_32((png_bytep)buf+1);
2201
5.60k
   X1 = png_get_int_32((png_bytep)buf+5);
2202
5.60k
   type = buf[9];
2203
5.60k
   nparams = buf[10];
2204
5.60k
   units = buf + 11;
2205
2206
5.60k
   png_debug(3, "Checking pCAL equation type and number of parameters");
2207
   /* Check that we have the right number of parameters for known
2208
    * equation types.
2209
    */
2210
5.60k
   if ((type == PNG_EQUATION_LINEAR && nparams != 2) ||
2211
5.60k
       (type == PNG_EQUATION_BASE_E && nparams != 3) ||
2212
5.60k
       (type == PNG_EQUATION_ARBITRARY && nparams != 3) ||
2213
5.60k
       (type == PNG_EQUATION_HYPERBOLIC && nparams != 4))
2214
2.18k
   {
2215
2.18k
      png_chunk_benign_error(png_ptr, "invalid parameter count");
2216
2.18k
      return handled_error;
2217
2.18k
   }
2218
2219
3.42k
   else if (type >= PNG_EQUATION_LAST)
2220
1.14k
   {
2221
1.14k
      png_chunk_benign_error(png_ptr, "unrecognized equation type");
2222
1.14k
   }
2223
2224
2.64M
   for (buf = units; *buf; buf++)
2225
2.63M
      /* Empty loop to move past the units string. */ ;
2226
2227
3.42k
   png_debug(3, "Allocating pCAL parameters array");
2228
2229
3.42k
   params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
2230
3.42k
       nparams * (sizeof (png_charp))));
2231
2232
3.42k
   if (params == NULL)
2233
0
   {
2234
0
      png_chunk_benign_error(png_ptr, "out of memory");
2235
0
      return handled_error;
2236
0
   }
2237
2238
   /* Get pointers to the start of each parameter string. */
2239
6.99k
   for (i = 0; i < nparams; i++)
2240
6.47k
   {
2241
6.47k
      buf++; /* Skip the null string terminator from previous parameter. */
2242
2243
6.47k
      png_debug1(3, "Reading pCAL parameter %d", i);
2244
2245
3.27M
      for (params[i] = (png_charp)buf; buf <= endptr && *buf != 0; buf++)
2246
3.27M
         /* Empty loop to move past each parameter string */ ;
2247
2248
      /* Make sure we haven't run out of data yet */
2249
6.47k
      if (buf > endptr)
2250
2.90k
      {
2251
2.90k
         png_free(png_ptr, params);
2252
2.90k
         png_chunk_benign_error(png_ptr, "invalid data");
2253
2.90k
         return handled_error;
2254
2.90k
      }
2255
6.47k
   }
2256
2257
520
   png_set_pCAL(png_ptr, info_ptr, (png_charp)buffer, X0, X1, type, nparams,
2258
520
       (png_charp)units, params);
2259
2260
   /* TODO: BUG: png_set_pCAL calls png_chunk_report which, in this case, calls
2261
    * png_benign_error and that can error out.
2262
    *
2263
    * png_read_buffer needs to be allocated with space for both nparams and the
2264
    * parameter strings.  Not hard to do.
2265
    */
2266
520
   png_free(png_ptr, params);
2267
520
   return handled_ok;
2268
3.42k
}
2269
#else
2270
#  define png_handle_pCAL NULL
2271
#endif
2272
2273
#ifdef PNG_READ_sCAL_SUPPORTED
2274
/* Read the sCAL chunk */
2275
static png_handle_result_code /* PRIVATE */
2276
png_handle_sCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2277
12.4k
{
2278
12.4k
   png_bytep buffer;
2279
12.4k
   size_t i;
2280
12.4k
   int state;
2281
2282
12.4k
   png_debug(1, "in png_handle_sCAL");
2283
12.4k
   png_debug1(2, "Allocating and reading sCAL chunk data (%u bytes)",
2284
12.4k
       length + 1);
2285
2286
12.4k
   buffer = png_read_buffer(png_ptr, length+1);
2287
2288
12.4k
   if (buffer == NULL)
2289
0
   {
2290
0
      png_crc_finish(png_ptr, length);
2291
0
      png_chunk_benign_error(png_ptr, "out of memory");
2292
0
      return handled_error;
2293
0
   }
2294
2295
12.4k
   png_crc_read(png_ptr, buffer, length);
2296
12.4k
   buffer[length] = 0; /* Null terminate the last string */
2297
2298
12.4k
   if (png_crc_finish(png_ptr, 0) != 0)
2299
756
      return handled_error;
2300
2301
   /* Validate the unit. */
2302
11.6k
   if (buffer[0] != 1 && buffer[0] != 2)
2303
1.15k
   {
2304
1.15k
      png_chunk_benign_error(png_ptr, "invalid unit");
2305
1.15k
      return handled_error;
2306
1.15k
   }
2307
2308
   /* Validate the ASCII numbers, need two ASCII numbers separated by
2309
    * a '\0' and they need to fit exactly in the chunk data.
2310
    */
2311
10.5k
   i = 1;
2312
10.5k
   state = 0;
2313
2314
10.5k
   if (png_check_fp_number((png_const_charp)buffer, length, &state, &i) == 0 ||
2315
10.5k
       i >= length || buffer[i++] != 0)
2316
5.54k
      png_chunk_benign_error(png_ptr, "bad width format");
2317
2318
4.96k
   else if (PNG_FP_IS_POSITIVE(state) == 0)
2319
497
      png_chunk_benign_error(png_ptr, "non-positive width");
2320
2321
4.46k
   else
2322
4.46k
   {
2323
4.46k
      size_t heighti = i;
2324
2325
4.46k
      state = 0;
2326
4.46k
      if (png_check_fp_number((png_const_charp)buffer, length,
2327
4.46k
          &state, &i) == 0 || i != length)
2328
2.21k
         png_chunk_benign_error(png_ptr, "bad height format");
2329
2330
2.24k
      else if (PNG_FP_IS_POSITIVE(state) == 0)
2331
1.50k
         png_chunk_benign_error(png_ptr, "non-positive height");
2332
2333
737
      else
2334
737
      {
2335
         /* This is the (only) success case. */
2336
737
         png_set_sCAL_s(png_ptr, info_ptr, buffer[0],
2337
737
             (png_charp)buffer+1, (png_charp)buffer+heighti);
2338
737
         return handled_ok;
2339
737
      }
2340
4.46k
   }
2341
2342
9.77k
   return handled_error;
2343
10.5k
}
2344
#else
2345
#  define png_handle_sCAL NULL
2346
#endif
2347
2348
#ifdef PNG_READ_tIME_SUPPORTED
2349
static png_handle_result_code /* PRIVATE */
2350
png_handle_tIME(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2351
1.06k
{
2352
1.06k
   png_byte buf[7];
2353
1.06k
   png_time mod_time;
2354
2355
1.06k
   png_debug(1, "in png_handle_tIME");
2356
2357
   /* TODO: what is this doing here?  It should be happened in pngread.c and
2358
    * pngpread.c, although it could be moved to png_handle_chunk below and
2359
    * thereby avoid some code duplication.
2360
    */
2361
1.06k
   if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2362
5
      png_ptr->mode |= PNG_AFTER_IDAT;
2363
2364
1.06k
   png_crc_read(png_ptr, buf, 7);
2365
2366
1.06k
   if (png_crc_finish(png_ptr, 0) != 0)
2367
754
      return handled_error;
2368
2369
306
   mod_time.second = buf[6];
2370
306
   mod_time.minute = buf[5];
2371
306
   mod_time.hour = buf[4];
2372
306
   mod_time.day = buf[3];
2373
306
   mod_time.month = buf[2];
2374
306
   mod_time.year = png_get_uint_16(buf);
2375
2376
306
   png_set_tIME(png_ptr, info_ptr, &mod_time);
2377
306
   return handled_ok;
2378
0
   PNG_UNUSED(length)
2379
0
}
2380
#else
2381
#  define png_handle_tIME NULL
2382
#endif
2383
2384
#ifdef PNG_READ_tEXt_SUPPORTED
2385
/* Note: this does not properly handle chunks that are > 64K under DOS */
2386
static png_handle_result_code /* PRIVATE */
2387
png_handle_tEXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2388
110k
{
2389
110k
   png_text  text_info;
2390
110k
   png_bytep buffer;
2391
110k
   png_charp key;
2392
110k
   png_charp text;
2393
110k
   png_uint_32 skip = 0;
2394
2395
110k
   png_debug(1, "in png_handle_tEXt");
2396
2397
110k
#ifdef PNG_USER_LIMITS_SUPPORTED
2398
110k
   if (png_ptr->user_chunk_cache_max != 0)
2399
110k
   {
2400
110k
      if (png_ptr->user_chunk_cache_max == 1)
2401
1.69k
      {
2402
1.69k
         png_crc_finish(png_ptr, length);
2403
1.69k
         return handled_error;
2404
1.69k
      }
2405
2406
108k
      if (--png_ptr->user_chunk_cache_max == 1)
2407
68
      {
2408
68
         png_crc_finish(png_ptr, length);
2409
68
         png_chunk_benign_error(png_ptr, "no space in chunk cache");
2410
68
         return handled_error;
2411
68
      }
2412
108k
   }
2413
108k
#endif
2414
2415
   /* TODO: this doesn't work and shouldn't be necessary. */
2416
108k
   if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2417
1.21k
      png_ptr->mode |= PNG_AFTER_IDAT;
2418
2419
108k
   buffer = png_read_buffer(png_ptr, length+1);
2420
2421
108k
   if (buffer == NULL)
2422
48
   {
2423
48
      png_crc_finish(png_ptr, length);
2424
48
      png_chunk_benign_error(png_ptr, "out of memory");
2425
48
      return handled_error;
2426
48
   }
2427
2428
108k
   png_crc_read(png_ptr, buffer, length);
2429
2430
108k
   if (png_crc_finish(png_ptr, skip) != 0)
2431
1.36k
      return handled_error;
2432
2433
107k
   key = (png_charp)buffer;
2434
107k
   key[length] = 0;
2435
2436
1.24M
   for (text = key; *text; text++)
2437
1.14M
      /* Empty loop to find end of key */ ;
2438
2439
107k
   if (text != key + length)
2440
65.4k
      text++;
2441
2442
107k
   text_info.compression = PNG_TEXT_COMPRESSION_NONE;
2443
107k
   text_info.key = key;
2444
107k
   text_info.lang = NULL;
2445
107k
   text_info.lang_key = NULL;
2446
107k
   text_info.itxt_length = 0;
2447
107k
   text_info.text = text;
2448
107k
   text_info.text_length = strlen(text);
2449
2450
107k
   if (png_set_text_2(png_ptr, info_ptr, &text_info, 1) == 0)
2451
106k
      return handled_ok;
2452
2453
138
   png_chunk_benign_error(png_ptr, "out of memory");
2454
138
   return handled_error;
2455
107k
}
2456
#else
2457
#  define png_handle_tEXt NULL
2458
#endif
2459
2460
#ifdef PNG_READ_zTXt_SUPPORTED
2461
/* Note: this does not correctly handle chunks that are > 64K under DOS */
2462
static png_handle_result_code /* PRIVATE */
2463
png_handle_zTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2464
9.63k
{
2465
9.63k
   png_const_charp errmsg = NULL;
2466
9.63k
   png_bytep       buffer;
2467
9.63k
   png_uint_32     keyword_length;
2468
2469
9.63k
   png_debug(1, "in png_handle_zTXt");
2470
2471
9.63k
#ifdef PNG_USER_LIMITS_SUPPORTED
2472
9.63k
   if (png_ptr->user_chunk_cache_max != 0)
2473
9.63k
   {
2474
9.63k
      if (png_ptr->user_chunk_cache_max == 1)
2475
388
      {
2476
388
         png_crc_finish(png_ptr, length);
2477
388
         return handled_error;
2478
388
      }
2479
2480
9.24k
      if (--png_ptr->user_chunk_cache_max == 1)
2481
6
      {
2482
6
         png_crc_finish(png_ptr, length);
2483
6
         png_chunk_benign_error(png_ptr, "no space in chunk cache");
2484
6
         return handled_error;
2485
6
      }
2486
9.24k
   }
2487
9.24k
#endif
2488
2489
   /* TODO: should not be necessary. */
2490
9.24k
   if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2491
472
      png_ptr->mode |= PNG_AFTER_IDAT;
2492
2493
   /* Note, "length" is sufficient here; we won't be adding
2494
    * a null terminator later.  The limit check in png_handle_chunk should be
2495
    * sufficient.
2496
    */
2497
9.24k
   buffer = png_read_buffer(png_ptr, length);
2498
2499
9.24k
   if (buffer == NULL)
2500
0
   {
2501
0
      png_crc_finish(png_ptr, length);
2502
0
      png_chunk_benign_error(png_ptr, "out of memory");
2503
0
      return handled_error;
2504
0
   }
2505
2506
9.24k
   png_crc_read(png_ptr, buffer, length);
2507
2508
9.24k
   if (png_crc_finish(png_ptr, 0) != 0)
2509
493
      return handled_error;
2510
2511
   /* TODO: also check that the keyword contents match the spec! */
2512
8.74k
   for (keyword_length = 0;
2513
3.20M
      keyword_length < length && buffer[keyword_length] != 0;
2514
3.19M
      ++keyword_length)
2515
3.19M
      /* Empty loop to find end of name */ ;
2516
2517
8.74k
   if (keyword_length > 79 || keyword_length < 1)
2518
1.04k
      errmsg = "bad keyword";
2519
2520
   /* zTXt must have some LZ data after the keyword, although it may expand to
2521
    * zero bytes; we need a '\0' at the end of the keyword, the compression type
2522
    * then the LZ data:
2523
    */
2524
7.70k
   else if (keyword_length + 3 > length)
2525
1.36k
      errmsg = "truncated";
2526
2527
6.34k
   else if (buffer[keyword_length+1] != PNG_COMPRESSION_TYPE_BASE)
2528
859
      errmsg = "unknown compression type";
2529
2530
5.48k
   else
2531
5.48k
   {
2532
5.48k
      png_alloc_size_t uncompressed_length = PNG_SIZE_MAX;
2533
2534
      /* TODO: at present png_decompress_chunk imposes a single application
2535
       * level memory limit, this should be split to different values for iCCP
2536
       * and text chunks.
2537
       */
2538
5.48k
      if (png_decompress_chunk(png_ptr, length, keyword_length+2,
2539
5.48k
          &uncompressed_length, 1/*terminate*/) == Z_STREAM_END)
2540
3.07k
      {
2541
3.07k
         png_text text;
2542
2543
3.07k
         if (png_ptr->read_buffer == NULL)
2544
0
           errmsg="Read failure in png_handle_zTXt";
2545
3.07k
         else
2546
3.07k
         {
2547
            /* It worked; png_ptr->read_buffer now looks like a tEXt chunk
2548
             * except for the extra compression type byte and the fact that
2549
             * it isn't necessarily '\0' terminated.
2550
             */
2551
3.07k
            buffer = png_ptr->read_buffer;
2552
3.07k
            buffer[uncompressed_length+(keyword_length+2)] = 0;
2553
2554
3.07k
            text.compression = PNG_TEXT_COMPRESSION_zTXt;
2555
3.07k
            text.key = (png_charp)buffer;
2556
3.07k
            text.text = (png_charp)(buffer + keyword_length+2);
2557
3.07k
            text.text_length = uncompressed_length;
2558
3.07k
            text.itxt_length = 0;
2559
3.07k
            text.lang = NULL;
2560
3.07k
            text.lang_key = NULL;
2561
2562
3.07k
            if (png_set_text_2(png_ptr, info_ptr, &text, 1) == 0)
2563
3.07k
               return handled_ok;
2564
2565
0
            errmsg = "out of memory";
2566
0
         }
2567
3.07k
      }
2568
2569
2.40k
      else
2570
2.40k
         errmsg = png_ptr->zstream.msg;
2571
5.48k
   }
2572
2573
5.67k
   png_chunk_benign_error(png_ptr, errmsg);
2574
5.67k
   return handled_error;
2575
8.74k
}
2576
#else
2577
#  define png_handle_zTXt NULL
2578
#endif
2579
2580
#ifdef PNG_READ_iTXt_SUPPORTED
2581
/* Note: this does not correctly handle chunks that are > 64K under DOS */
2582
static png_handle_result_code /* PRIVATE */
2583
png_handle_iTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2584
13.1k
{
2585
13.1k
   png_const_charp errmsg = NULL;
2586
13.1k
   png_bytep buffer;
2587
13.1k
   png_uint_32 prefix_length;
2588
2589
13.1k
   png_debug(1, "in png_handle_iTXt");
2590
2591
13.1k
#ifdef PNG_USER_LIMITS_SUPPORTED
2592
13.1k
   if (png_ptr->user_chunk_cache_max != 0)
2593
13.1k
   {
2594
13.1k
      if (png_ptr->user_chunk_cache_max == 1)
2595
388
      {
2596
388
         png_crc_finish(png_ptr, length);
2597
388
         return handled_error;
2598
388
      }
2599
2600
12.7k
      if (--png_ptr->user_chunk_cache_max == 1)
2601
6
      {
2602
6
         png_crc_finish(png_ptr, length);
2603
6
         png_chunk_benign_error(png_ptr, "no space in chunk cache");
2604
6
         return handled_error;
2605
6
      }
2606
12.7k
   }
2607
12.7k
#endif
2608
2609
   /* TODO: should not be necessary. */
2610
12.7k
   if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2611
688
      png_ptr->mode |= PNG_AFTER_IDAT;
2612
2613
12.7k
   buffer = png_read_buffer(png_ptr, length+1);
2614
2615
12.7k
   if (buffer == NULL)
2616
25
   {
2617
25
      png_crc_finish(png_ptr, length);
2618
25
      png_chunk_benign_error(png_ptr, "out of memory");
2619
25
      return handled_error;
2620
25
   }
2621
2622
12.7k
   png_crc_read(png_ptr, buffer, length);
2623
2624
12.7k
   if (png_crc_finish(png_ptr, 0) != 0)
2625
469
      return handled_error;
2626
2627
   /* First the keyword. */
2628
12.2k
   for (prefix_length=0;
2629
8.50M
      prefix_length < length && buffer[prefix_length] != 0;
2630
8.49M
      ++prefix_length)
2631
8.49M
      /* Empty loop */ ;
2632
2633
   /* Perform a basic check on the keyword length here. */
2634
12.2k
   if (prefix_length > 79 || prefix_length < 1)
2635
891
      errmsg = "bad keyword";
2636
2637
   /* Expect keyword, compression flag, compression type, language, translated
2638
    * keyword (both may be empty but are 0 terminated) then the text, which may
2639
    * be empty.
2640
    */
2641
11.3k
   else if (prefix_length + 5 > length)
2642
1.75k
      errmsg = "truncated";
2643
2644
9.62k
   else if (buffer[prefix_length+1] == 0 ||
2645
9.62k
      (buffer[prefix_length+1] == 1 &&
2646
6.59k
      buffer[prefix_length+2] == PNG_COMPRESSION_TYPE_BASE))
2647
6.54k
   {
2648
6.54k
      int compressed = buffer[prefix_length+1] != 0;
2649
6.54k
      png_uint_32 language_offset, translated_keyword_offset;
2650
6.54k
      png_alloc_size_t uncompressed_length = 0;
2651
2652
      /* Now the language tag */
2653
6.54k
      prefix_length += 3;
2654
6.54k
      language_offset = prefix_length;
2655
2656
5.97M
      for (; prefix_length < length && buffer[prefix_length] != 0;
2657
5.97M
         ++prefix_length)
2658
5.97M
         /* Empty loop */ ;
2659
2660
      /* WARNING: the length may be invalid here, this is checked below. */
2661
6.54k
      translated_keyword_offset = ++prefix_length;
2662
2663
3.85M
      for (; prefix_length < length && buffer[prefix_length] != 0;
2664
3.84M
         ++prefix_length)
2665
3.84M
         /* Empty loop */ ;
2666
2667
      /* prefix_length should now be at the trailing '\0' of the translated
2668
       * keyword, but it may already be over the end.  None of this arithmetic
2669
       * can overflow because chunks are at most 2^31 bytes long, but on 16-bit
2670
       * systems the available allocation may overflow.
2671
       */
2672
6.54k
      ++prefix_length;
2673
2674
6.54k
      if (compressed == 0 && prefix_length <= length)
2675
1.73k
         uncompressed_length = length - prefix_length;
2676
2677
4.80k
      else if (compressed != 0 && prefix_length < length)
2678
2.98k
      {
2679
2.98k
         uncompressed_length = PNG_SIZE_MAX;
2680
2681
         /* TODO: at present png_decompress_chunk imposes a single application
2682
          * level memory limit, this should be split to different values for
2683
          * iCCP and text chunks.
2684
          */
2685
2.98k
         if (png_decompress_chunk(png_ptr, length, prefix_length,
2686
2.98k
             &uncompressed_length, 1/*terminate*/) == Z_STREAM_END)
2687
1.92k
            buffer = png_ptr->read_buffer;
2688
2689
1.05k
         else
2690
1.05k
            errmsg = png_ptr->zstream.msg;
2691
2.98k
      }
2692
2693
1.82k
      else
2694
1.82k
         errmsg = "truncated";
2695
2696
6.54k
      if (errmsg == NULL)
2697
3.65k
      {
2698
3.65k
         png_text text;
2699
2700
3.65k
         buffer[uncompressed_length+prefix_length] = 0;
2701
2702
3.65k
         if (compressed == 0)
2703
1.73k
            text.compression = PNG_ITXT_COMPRESSION_NONE;
2704
2705
1.92k
         else
2706
1.92k
            text.compression = PNG_ITXT_COMPRESSION_zTXt;
2707
2708
3.65k
         text.key = (png_charp)buffer;
2709
3.65k
         text.lang = (png_charp)buffer + language_offset;
2710
3.65k
         text.lang_key = (png_charp)buffer + translated_keyword_offset;
2711
3.65k
         text.text = (png_charp)buffer + prefix_length;
2712
3.65k
         text.text_length = 0;
2713
3.65k
         text.itxt_length = uncompressed_length;
2714
2715
3.65k
         if (png_set_text_2(png_ptr, info_ptr, &text, 1) == 0)
2716
3.65k
            return handled_ok;
2717
2718
0
         errmsg = "out of memory";
2719
0
      }
2720
6.54k
   }
2721
2722
3.08k
   else
2723
3.08k
      errmsg = "bad compression info";
2724
2725
8.61k
   if (errmsg != NULL)
2726
8.44k
      png_chunk_benign_error(png_ptr, errmsg);
2727
8.61k
   return handled_error;
2728
12.2k
}
2729
#else
2730
#  define png_handle_iTXt NULL
2731
#endif
2732
2733
#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
2734
/* Utility function for png_handle_unknown; set up png_ptr::unknown_chunk */
2735
static int
2736
png_cache_unknown_chunk(png_structrp png_ptr, png_uint_32 length)
2737
0
{
2738
0
   const png_alloc_size_t limit = png_chunk_max(png_ptr);
2739
2740
0
   if (png_ptr->unknown_chunk.data != NULL)
2741
0
   {
2742
0
      png_free(png_ptr, png_ptr->unknown_chunk.data);
2743
0
      png_ptr->unknown_chunk.data = NULL;
2744
0
   }
2745
2746
0
   if (length <= limit)
2747
0
   {
2748
0
      PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
2749
      /* The following is safe because of the PNG_SIZE_MAX init above */
2750
0
      png_ptr->unknown_chunk.size = (size_t)length/*SAFE*/;
2751
      /* 'mode' is a flag array, only the bottom four bits matter here */
2752
0
      png_ptr->unknown_chunk.location = (png_byte)png_ptr->mode/*SAFE*/;
2753
2754
0
      if (length == 0)
2755
0
         png_ptr->unknown_chunk.data = NULL;
2756
2757
0
      else
2758
0
      {
2759
         /* Do a 'warn' here - it is handled below. */
2760
0
         png_ptr->unknown_chunk.data = png_voidcast(png_bytep,
2761
0
             png_malloc_warn(png_ptr, length));
2762
0
      }
2763
0
   }
2764
2765
0
   if (png_ptr->unknown_chunk.data == NULL && length > 0)
2766
0
   {
2767
      /* This is benign because we clean up correctly */
2768
0
      png_crc_finish(png_ptr, length);
2769
0
      png_chunk_benign_error(png_ptr, "unknown chunk exceeds memory limits");
2770
0
      return 0;
2771
0
   }
2772
2773
0
   else
2774
0
   {
2775
0
      if (length > 0)
2776
0
         png_crc_read(png_ptr, png_ptr->unknown_chunk.data, length);
2777
0
      png_crc_finish(png_ptr, 0);
2778
0
      return 1;
2779
0
   }
2780
0
}
2781
#endif /* READ_UNKNOWN_CHUNKS */
2782
2783
/* Handle an unknown, or known but disabled, chunk */
2784
png_handle_result_code /*PRIVATE*/
2785
png_handle_unknown(png_structrp png_ptr, png_inforp info_ptr,
2786
    png_uint_32 length, int keep)
2787
9.42k
{
2788
9.42k
   png_handle_result_code handled = handled_discarded; /* the default */
2789
2790
9.42k
   png_debug(1, "in png_handle_unknown");
2791
2792
9.42k
#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
2793
   /* NOTE: this code is based on the code in libpng-1.4.12 except for fixing
2794
    * the bug which meant that setting a non-default behavior for a specific
2795
    * chunk would be ignored (the default was always used unless a user
2796
    * callback was installed).
2797
    *
2798
    * 'keep' is the value from the png_chunk_unknown_handling, the setting for
2799
    * this specific chunk_name, if PNG_HANDLE_AS_UNKNOWN_SUPPORTED, if not it
2800
    * will always be PNG_HANDLE_CHUNK_AS_DEFAULT and it needs to be set here.
2801
    * This is just an optimization to avoid multiple calls to the lookup
2802
    * function.
2803
    */
2804
#  ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
2805
#     ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
2806
   keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name);
2807
#     endif
2808
#  endif
2809
2810
   /* One of the following methods will read the chunk or skip it (at least one
2811
    * of these is always defined because this is the only way to switch on
2812
    * PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
2813
    */
2814
9.42k
#  ifdef PNG_READ_USER_CHUNKS_SUPPORTED
2815
   /* The user callback takes precedence over the chunk keep value, but the
2816
    * keep value is still required to validate a save of a critical chunk.
2817
    */
2818
9.42k
   if (png_ptr->read_user_chunk_fn != NULL)
2819
0
   {
2820
0
      if (png_cache_unknown_chunk(png_ptr, length) != 0)
2821
0
      {
2822
         /* Callback to user unknown chunk handler */
2823
0
         int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr,
2824
0
             &png_ptr->unknown_chunk);
2825
2826
         /* ret is:
2827
          * negative: An error occurred; png_chunk_error will be called.
2828
          *     zero: The chunk was not handled, the chunk will be discarded
2829
          *           unless png_set_keep_unknown_chunks has been used to set
2830
          *           a 'keep' behavior for this particular chunk, in which
2831
          *           case that will be used.  A critical chunk will cause an
2832
          *           error at this point unless it is to be saved.
2833
          * positive: The chunk was handled, libpng will ignore/discard it.
2834
          */
2835
0
         if (ret < 0) /* handled_error */
2836
0
            png_chunk_error(png_ptr, "error in user chunk");
2837
2838
0
         else if (ret == 0)
2839
0
         {
2840
            /* If the keep value is 'default' or 'never' override it, but
2841
             * still error out on critical chunks unless the keep value is
2842
             * 'always'  While this is weird it is the behavior in 1.4.12.
2843
             * A possible improvement would be to obey the value set for the
2844
             * chunk, but this would be an API change that would probably
2845
             * damage some applications.
2846
             *
2847
             * The png_app_warning below catches the case that matters, where
2848
             * the application has not set specific save or ignore for this
2849
             * chunk or global save or ignore.
2850
             */
2851
0
            if (keep < PNG_HANDLE_CHUNK_IF_SAFE)
2852
0
            {
2853
0
#              ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
2854
0
               if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE)
2855
0
               {
2856
0
                  png_chunk_warning(png_ptr, "Saving unknown chunk:");
2857
0
                  png_app_warning(png_ptr,
2858
0
                      "forcing save of an unhandled chunk;"
2859
0
                      " please call png_set_keep_unknown_chunks");
2860
                      /* with keep = PNG_HANDLE_CHUNK_IF_SAFE */
2861
0
               }
2862
0
#              endif
2863
0
               keep = PNG_HANDLE_CHUNK_IF_SAFE;
2864
0
            }
2865
0
         }
2866
2867
0
         else /* chunk was handled */
2868
0
         {
2869
0
            handled = handled_ok;
2870
            /* Critical chunks can be safely discarded at this point. */
2871
0
            keep = PNG_HANDLE_CHUNK_NEVER;
2872
0
         }
2873
0
      }
2874
2875
0
      else
2876
0
         keep = PNG_HANDLE_CHUNK_NEVER; /* insufficient memory */
2877
0
   }
2878
2879
9.42k
   else
2880
   /* Use the SAVE_UNKNOWN_CHUNKS code or skip the chunk */
2881
9.42k
#  endif /* READ_USER_CHUNKS */
2882
2883
9.42k
#  ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED
2884
9.42k
   {
2885
      /* keep is currently just the per-chunk setting, if there was no
2886
       * setting change it to the global default now (not that this may
2887
       * still be AS_DEFAULT) then obtain the cache of the chunk if required,
2888
       * if not simply skip the chunk.
2889
       */
2890
9.42k
      if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT)
2891
9.42k
         keep = png_ptr->unknown_default;
2892
2893
9.42k
      if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
2894
9.42k
         (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
2895
9.42k
          PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
2896
0
      {
2897
0
         if (png_cache_unknown_chunk(png_ptr, length) == 0)
2898
0
            keep = PNG_HANDLE_CHUNK_NEVER;
2899
0
      }
2900
2901
9.42k
      else
2902
9.42k
         png_crc_finish(png_ptr, length);
2903
9.42k
   }
2904
#  else
2905
#     ifndef PNG_READ_USER_CHUNKS_SUPPORTED
2906
#        error no method to support READ_UNKNOWN_CHUNKS
2907
#     endif
2908
2909
   {
2910
      /* If here there is no read callback pointer set and no support is
2911
       * compiled in to just save the unknown chunks, so simply skip this
2912
       * chunk.  If 'keep' is something other than AS_DEFAULT or NEVER then
2913
       * the app has erroneously asked for unknown chunk saving when there
2914
       * is no support.
2915
       */
2916
      if (keep > PNG_HANDLE_CHUNK_NEVER)
2917
         png_app_error(png_ptr, "no unknown chunk support available");
2918
2919
      png_crc_finish(png_ptr, length);
2920
   }
2921
#  endif
2922
2923
9.42k
#  ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
2924
   /* Now store the chunk in the chunk list if appropriate, and if the limits
2925
    * permit it.
2926
    */
2927
9.42k
   if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
2928
9.42k
      (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
2929
7.21k
       PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
2930
0
   {
2931
0
#     ifdef PNG_USER_LIMITS_SUPPORTED
2932
0
      switch (png_ptr->user_chunk_cache_max)
2933
0
      {
2934
0
         case 2:
2935
0
            png_ptr->user_chunk_cache_max = 1;
2936
0
            png_chunk_benign_error(png_ptr, "no space in chunk cache");
2937
            /* FALLTHROUGH */
2938
0
         case 1:
2939
            /* NOTE: prior to 1.6.0 this case resulted in an unknown critical
2940
             * chunk being skipped, now there will be a hard error below.
2941
             */
2942
0
            break;
2943
2944
0
         default: /* not at limit */
2945
0
            --(png_ptr->user_chunk_cache_max);
2946
            /* FALLTHROUGH */
2947
0
         case 0: /* no limit */
2948
0
#  endif /* USER_LIMITS */
2949
            /* Here when the limit isn't reached or when limits are compiled
2950
             * out; store the chunk.
2951
             */
2952
0
            png_set_unknown_chunks(png_ptr, info_ptr,
2953
0
                &png_ptr->unknown_chunk, 1);
2954
0
            handled = handled_saved;
2955
0
#  ifdef PNG_USER_LIMITS_SUPPORTED
2956
0
            break;
2957
0
      }
2958
0
#  endif
2959
0
   }
2960
#  else /* no store support: the chunk must be handled by the user callback */
2961
   PNG_UNUSED(info_ptr)
2962
#  endif
2963
2964
   /* Regardless of the error handling below the cached data (if any) can be
2965
    * freed now.  Notice that the data is not freed if there is a png_error, but
2966
    * it will be freed by destroy_read_struct.
2967
    */
2968
9.42k
   if (png_ptr->unknown_chunk.data != NULL)
2969
0
      png_free(png_ptr, png_ptr->unknown_chunk.data);
2970
9.42k
   png_ptr->unknown_chunk.data = NULL;
2971
2972
#else /* !PNG_READ_UNKNOWN_CHUNKS_SUPPORTED */
2973
   /* There is no support to read an unknown chunk, so just skip it. */
2974
   png_crc_finish(png_ptr, length);
2975
   PNG_UNUSED(info_ptr)
2976
   PNG_UNUSED(keep)
2977
#endif /* !READ_UNKNOWN_CHUNKS */
2978
2979
   /* Check for unhandled critical chunks */
2980
9.42k
   if (handled < handled_saved && PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
2981
424
      png_chunk_error(png_ptr, "unhandled critical chunk");
2982
2983
9.00k
   return handled;
2984
9.42k
}
2985
2986
/* APNG handling: the minimal implementation of APNG handling in libpng 1.6
2987
 * requires that those significant applications which already handle APNG not
2988
 * get hosed.  To do this ensure the code here will have to ensure than APNG
2989
 * data by default (at least in 1.6) gets stored in the unknown chunk list.
2990
 * Maybe this can be relaxed in a few years but at present it's just the only
2991
 * safe way.
2992
 *
2993
 * ATM just cause unknown handling for all three chunks:
2994
 */
2995
#define png_handle_acTL NULL
2996
#define png_handle_fcTL NULL
2997
#define png_handle_fdAT NULL
2998
2999
/*
3000
 * 1.6.47: This is the new table driven interface to all the chunk handling.
3001
 *
3002
 * The table describes the PNG standard rules for **reading** known chunks -
3003
 * every chunk which has an entry in PNG_KNOWN_CHUNKS.  The table contains an
3004
 * entry for each PNG_INDEX_cHNK describing the rules.
3005
 *
3006
 * In this initial version the only information in the entry is the
3007
 * png_handle_cHNK function for the chunk in question.  When chunk support is
3008
 * compiled out the entry will be NULL.
3009
 */
3010
static const struct
3011
{
3012
   png_handle_result_code (*handler)(
3013
         png_structrp, png_inforp, png_uint_32 length);
3014
      /* A chunk-specific 'handler', NULL if the chunk is not supported in this
3015
       * build.
3016
       */
3017
3018
   /* Crushing these values helps on modern 32-bit architectures because the
3019
    * pointer and the following bit fields both end up requiring 32 bits.
3020
    * Typically this will halve the table size.  On 64-bit architectures the
3021
    * table entries will typically be 8 bytes.
3022
    */
3023
   png_uint_32 max_length :12; /* Length min, max in bytes */
3024
   png_uint_32 min_length :8;
3025
      /* Length errors on critical chunks have special handling to preserve the
3026
       * existing behaviour in libpng 1.6.  Anciallary chunks are checked below
3027
       * and produce a 'benign' error.
3028
       */
3029
   png_uint_32 pos_before :4; /* PNG_HAVE_ values chunk must precede */
3030
   png_uint_32 pos_after  :4; /* PNG_HAVE_ values chunk must follow */
3031
      /* NOTE: PLTE, tRNS and bKGD require special handling which depends on
3032
       * the colour type of the base image.
3033
       */
3034
   png_uint_32 multiple   :1; /* Multiple occurences permitted */
3035
      /* This is enabled for PLTE because PLTE may, in practice, be optional */
3036
}
3037
read_chunks[PNG_INDEX_unknown] =
3038
{
3039
   /* Definitions as above but done indirectly by #define so that
3040
    * PNG_KNOWN_CHUNKS can be used safely to build the table in order.
3041
    *
3042
    * Each CDcHNK definition lists the values for the parameters **after**
3043
    * the first, 'handler', function.  'handler' is NULL when the chunk has no
3044
    * compiled in support.
3045
    */
3046
199k
#  define NoCheck 0x801U      /* Do not check the maximum length */
3047
24.6k
#  define Limit   0x802U      /* Limit to png_chunk_max bytes */
3048
#  define LKMin   3U+LZ77Min  /* Minimum length of keyword+LZ77 */
3049
3050
#define hIHDR PNG_HAVE_IHDR
3051
#define hPLTE PNG_HAVE_PLTE
3052
#define hIDAT PNG_HAVE_IDAT
3053
   /* For the two chunks, tRNS and bKGD which can occur in PNGs without a PLTE
3054
    * but must occur after the PLTE use this and put the check in the handler
3055
    * routine for colour mapped images were PLTE is required.  Also put a check
3056
    * in PLTE for other image types to drop the PLTE if tRNS or bKGD have been
3057
    * seen.
3058
    */
3059
#define hCOL  (PNG_HAVE_PLTE|PNG_HAVE_IDAT)
3060
   /* Used for the decoding chunks which must be before PLTE. */
3061
#define aIDAT PNG_AFTER_IDAT
3062
3063
   /* Chunks from W3C PNG v3: */
3064
   /*       cHNK  max_len,   min, before, after, multiple */
3065
#  define CDIHDR      13U,   13U,  hIHDR,     0,        0
3066
#  define CDPLTE  NoCheck,    0U,      0, hIHDR,        1
3067
      /* PLTE errors are only critical for colour-map images, consequently the
3068
       * hander does all the checks.
3069
       */
3070
#  define CDIDAT  NoCheck,    0U,  aIDAT, hIHDR,        1
3071
#  define CDIEND  NoCheck,    0U,      0, aIDAT,        0
3072
      /* Historically data was allowed in IEND */
3073
#  define CDtRNS     256U,    0U,  hIDAT, hIHDR,        0
3074
#  define CDcHRM      32U,   32U,   hCOL, hIHDR,        0
3075
#  define CDgAMA       4U,    4U,   hCOL, hIHDR,        0
3076
#  define CDiCCP  NoCheck, LKMin,   hCOL, hIHDR,        0
3077
#  define CDsBIT       4U,    1U,   hCOL, hIHDR,        0
3078
#  define CDsRGB       1U,    1U,   hCOL, hIHDR,        0
3079
#  define CDcICP       4U,    4U,   hCOL, hIHDR,        0
3080
#  define CDmDCV      24U,   24U,   hCOL, hIHDR,        0
3081
#  define CDeXIf    Limit,    4U,      0, hIHDR,        0
3082
#  define CDcLLI       8U,    8U,   hCOL, hIHDR,        0
3083
#  define CDtEXt  NoCheck,    2U,      0, hIHDR,        1
3084
      /* Allocates 'length+1'; checked in the handler */
3085
#  define CDzTXt    Limit, LKMin,      0, hIHDR,        1
3086
#  define CDiTXt  NoCheck,    6U,      0, hIHDR,        1
3087
      /* Allocates 'length+1'; checked in the handler */
3088
#  define CDbKGD       6U,    1U,  hIDAT, hIHDR,        0
3089
#  define CDhIST    1024U,    0U,  hPLTE, hIHDR,        0
3090
#  define CDpHYs       9U,    9U,  hIDAT, hIHDR,        0
3091
#  define CDsPLT  NoCheck,    3U,  hIDAT, hIHDR,        1
3092
      /* Allocates 'length+1'; checked in the handler */
3093
#  define CDtIME       7U,    7U,      0, hIHDR,        0
3094
#  define CDacTL       8U,    8U,  hIDAT, hIHDR,        0
3095
#  define CDfcTL      25U,   26U,      0, hIHDR,        1
3096
#  define CDfdAT    Limit,    4U,  hIDAT, hIHDR,        1
3097
   /* Supported chunks from PNG extensions 1.5.0, NYI so limit */
3098
#  define CDoFFs       9U,    9U,  hIDAT, hIHDR,        0
3099
#  define CDpCAL  NoCheck,   14U,  hIDAT, hIHDR,        0
3100
      /* Allocates 'length+1'; checked in the handler */
3101
#  define CDsCAL    Limit,    4U,  hIDAT, hIHDR,        0
3102
      /* Allocates 'length+1'; checked in the handler */
3103
3104
#  define PNG_CHUNK(cHNK, index) { png_handle_ ## cHNK, CD ## cHNK },
3105
   PNG_KNOWN_CHUNKS
3106
#  undef PNG_CHUNK
3107
};
3108
3109
3110
static png_index
3111
png_chunk_index_from_name(png_uint_32 chunk_name)
3112
375k
{
3113
   /* For chunk png_cHNK return PNG_INDEX_cHNK.  Return PNG_INDEX_unknown if
3114
    * chunk_name is not known.  Notice that in a particular build "known" does
3115
    * not necessarily mean "supported", although the inverse applies.
3116
    */
3117
375k
   switch (chunk_name)
3118
375k
   {
3119
0
#     define PNG_CHUNK(cHNK, index)\
3120
368k
         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
3121
3122
0
      PNG_KNOWN_CHUNKS
3123
3124
0
#     undef PNG_CHUNK
3125
3126
6.62k
      default: return PNG_INDEX_unknown;
3127
375k
   }
3128
375k
}
3129
3130
png_handle_result_code /*PRIVATE*/
3131
png_handle_chunk(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
3132
375k
{
3133
   /* CSE: these things don't change, these autos are just to save typing and
3134
    * make the code more clear.
3135
    */
3136
375k
   const png_uint_32 chunk_name = png_ptr->chunk_name;
3137
375k
   const png_index chunk_index = png_chunk_index_from_name(chunk_name);
3138
3139
375k
   png_handle_result_code handled = handled_error;
3140
375k
   png_const_charp errmsg = NULL;
3141
3142
   /* Is this a known chunk?  If not there are no checks performed here;
3143
    * png_handle_unknown does the correct checks.  This means that the values
3144
    * for known but unsupported chunks in the above table are not used here
3145
    * however the chunks_seen fields in png_struct are still set.
3146
    */
3147
375k
   if (chunk_index == PNG_INDEX_unknown ||
3148
375k
       read_chunks[chunk_index].handler == NULL)
3149
9.42k
   {
3150
9.42k
      handled = png_handle_unknown(
3151
9.42k
            png_ptr, info_ptr, length, PNG_HANDLE_CHUNK_AS_DEFAULT);
3152
9.42k
   }
3153
3154
   /* First check the position.   The first check is historical; the stream must
3155
    * start with IHDR and anything else causes libpng to give up immediately.
3156
    */
3157
365k
   else if (chunk_index != PNG_INDEX_IHDR &&
3158
365k
            (png_ptr->mode & PNG_HAVE_IHDR) == 0)
3159
68
      png_chunk_error(png_ptr, "missing IHDR"); /* NORETURN */
3160
3161
   /* Before all the pos_before chunks, after all the pos_after chunks. */
3162
365k
   else if (((png_ptr->mode & read_chunks[chunk_index].pos_before) != 0) ||
3163
365k
            ((png_ptr->mode & read_chunks[chunk_index].pos_after) !=
3164
363k
             read_chunks[chunk_index].pos_after))
3165
12.2k
   {
3166
12.2k
      errmsg = "out of place";
3167
12.2k
   }
3168
3169
   /* Now check for duplicates: duplicated critical chunks also produce a
3170
    * full error.
3171
    */
3172
353k
   else if (read_chunks[chunk_index].multiple == 0 &&
3173
353k
            png_file_has_chunk(png_ptr, chunk_index))
3174
7.43k
   {
3175
7.43k
      errmsg = "duplicate";
3176
7.43k
   }
3177
3178
346k
   else if (length < read_chunks[chunk_index].min_length)
3179
17.9k
      errmsg = "too short";
3180
328k
   else
3181
328k
   {
3182
      /* NOTE: apart from IHDR the critical chunks (PLTE, IDAT and IEND) are set
3183
       * up above not to do any length checks.
3184
       *
3185
       * The png_chunk_max check ensures that the variable length chunks are
3186
       * always checked at this point for being within the system allocation
3187
       * limits.
3188
       */
3189
328k
      unsigned max_length = read_chunks[chunk_index].max_length;
3190
3191
328k
      switch (max_length)
3192
328k
      {
3193
24.6k
         case Limit:
3194
            /* png_read_chunk_header has already png_error'ed chunks with a
3195
             * length exceeding the 31-bit PNG limit, so just check the memory
3196
             * limit:
3197
             */
3198
24.6k
            if (length <= png_chunk_max(png_ptr))
3199
24.5k
               goto MeetsLimit;
3200
3201
20
            errmsg = "length exceeds libpng limit";
3202
20
            break;
3203
3204
103k
         default:
3205
103k
            if (length <= max_length)
3206
103k
               goto MeetsLimit;
3207
3208
728
            errmsg = "too long";
3209
728
            break;
3210
3211
199k
         case NoCheck:
3212
327k
         MeetsLimit:
3213
327k
            handled = read_chunks[chunk_index].handler(
3214
327k
                  png_ptr, info_ptr, length);
3215
327k
            break;
3216
328k
      }
3217
328k
   }
3218
3219
   /* If there was an error or the chunk was simply skipped it is not counted as
3220
    * 'seen'.
3221
    */
3222
366k
   if (errmsg != NULL)
3223
38.3k
   {
3224
38.3k
      if (PNG_CHUNK_CRITICAL(chunk_name)) /* stop immediately */
3225
9.95k
         png_chunk_error(png_ptr, errmsg);
3226
28.4k
      else /* ancillary chunk */
3227
28.4k
      {
3228
         /* The chunk data is skipped: */
3229
28.4k
         png_crc_finish(png_ptr, length);
3230
28.4k
         png_chunk_benign_error(png_ptr, errmsg);
3231
28.4k
      }
3232
38.3k
   }
3233
3234
328k
   else if (handled >= handled_saved)
3235
209k
   {
3236
209k
      if (chunk_index != PNG_INDEX_unknown)
3237
209k
         png_file_add_chunk(png_ptr, chunk_index);
3238
209k
   }
3239
3240
356k
   return handled;
3241
366k
}
3242
3243
/* Combines the row recently read in with the existing pixels in the row.  This
3244
 * routine takes care of alpha and transparency if requested.  This routine also
3245
 * handles the two methods of progressive display of interlaced images,
3246
 * depending on the 'display' value; if 'display' is true then the whole row
3247
 * (dp) is filled from the start by replicating the available pixels.  If
3248
 * 'display' is false only those pixels present in the pass are filled in.
3249
 */
3250
void /* PRIVATE */
3251
png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
3252
1.00M
{
3253
1.00M
   unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
3254
1.00M
   png_const_bytep sp = png_ptr->row_buf + 1;
3255
1.00M
   png_alloc_size_t row_width = png_ptr->width;
3256
1.00M
   unsigned int pass = png_ptr->pass;
3257
1.00M
   png_bytep end_ptr = 0;
3258
1.00M
   png_byte end_byte = 0;
3259
1.00M
   unsigned int end_mask;
3260
3261
1.00M
   png_debug(1, "in png_combine_row");
3262
3263
   /* Added in 1.5.6: it should not be possible to enter this routine until at
3264
    * least one row has been read from the PNG data and transformed.
3265
    */
3266
1.00M
   if (pixel_depth == 0)
3267
0
      png_error(png_ptr, "internal row logic error");
3268
3269
   /* Added in 1.5.4: the pixel depth should match the information returned by
3270
    * any call to png_read_update_info at this point.  Do not continue if we got
3271
    * this wrong.
3272
    */
3273
1.00M
   if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes !=
3274
1.00M
          PNG_ROWBYTES(pixel_depth, row_width))
3275
0
      png_error(png_ptr, "internal row size calculation error");
3276
3277
   /* Don't expect this to ever happen: */
3278
1.00M
   if (row_width == 0)
3279
0
      png_error(png_ptr, "internal row width error");
3280
3281
   /* Preserve the last byte in cases where only part of it will be overwritten,
3282
    * the multiply below may overflow, we don't care because ANSI-C guarantees
3283
    * we get the low bits.
3284
    */
3285
1.00M
   end_mask = (pixel_depth * row_width) & 7;
3286
1.00M
   if (end_mask != 0)
3287
3.53k
   {
3288
      /* end_ptr == NULL is a flag to say do nothing */
3289
3.53k
      end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1;
3290
3.53k
      end_byte = *end_ptr;
3291
3.53k
#     ifdef PNG_READ_PACKSWAP_SUPPORTED
3292
3.53k
      if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
3293
         /* little-endian byte */
3294
1.63k
         end_mask = (unsigned int)(0xff << end_mask);
3295
3296
1.90k
      else /* big-endian byte */
3297
1.90k
#     endif
3298
1.90k
      end_mask = 0xff >> end_mask;
3299
      /* end_mask is now the bits to *keep* from the destination row */
3300
3.53k
   }
3301
3302
   /* For non-interlaced images this reduces to a memcpy(). A memcpy()
3303
    * will also happen if interlacing isn't supported or if the application
3304
    * does not call png_set_interlace_handling().  In the latter cases the
3305
    * caller just gets a sequence of the unexpanded rows from each interlace
3306
    * pass.
3307
    */
3308
1.00M
#ifdef PNG_READ_INTERLACING_SUPPORTED
3309
1.00M
   if (png_ptr->interlaced != 0 &&
3310
1.00M
       (png_ptr->transformations & PNG_INTERLACE) != 0 &&
3311
1.00M
       pass < 6 && (display == 0 ||
3312
       /* The following copies everything for 'display' on passes 0, 2 and 4. */
3313
110k
       (display == 1 && (pass & 1) != 0)))
3314
110k
   {
3315
      /* Narrow images may have no bits in a pass; the caller should handle
3316
       * this, but this test is cheap:
3317
       */
3318
110k
      if (row_width <= PNG_PASS_START_COL(pass))
3319
0
         return;
3320
3321
110k
      if (pixel_depth < 8)
3322
4.02k
      {
3323
         /* For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit
3324
          * into 32 bits, then a single loop over the bytes using the four byte
3325
          * values in the 32-bit mask can be used.  For the 'display' option the
3326
          * expanded mask may also not require any masking within a byte.  To
3327
          * make this work the PACKSWAP option must be taken into account - it
3328
          * simply requires the pixels to be reversed in each byte.
3329
          *
3330
          * The 'regular' case requires a mask for each of the first 6 passes,
3331
          * the 'display' case does a copy for the even passes in the range
3332
          * 0..6.  This has already been handled in the test above.
3333
          *
3334
          * The masks are arranged as four bytes with the first byte to use in
3335
          * the lowest bits (little-endian) regardless of the order (PACKSWAP or
3336
          * not) of the pixels in each byte.
3337
          *
3338
          * NOTE: the whole of this logic depends on the caller of this function
3339
          * only calling it on rows appropriate to the pass.  This function only
3340
          * understands the 'x' logic; the 'y' logic is handled by the caller.
3341
          *
3342
          * The following defines allow generation of compile time constant bit
3343
          * masks for each pixel depth and each possibility of swapped or not
3344
          * swapped bytes.  Pass 'p' is in the range 0..6; 'x', a pixel index,
3345
          * is in the range 0..7; and the result is 1 if the pixel is to be
3346
          * copied in the pass, 0 if not.  'S' is for the sparkle method, 'B'
3347
          * for the block method.
3348
          *
3349
          * With some compilers a compile time expression of the general form:
3350
          *
3351
          *    (shift >= 32) ? (a >> (shift-32)) : (b >> shift)
3352
          *
3353
          * Produces warnings with values of 'shift' in the range 33 to 63
3354
          * because the right hand side of the ?: expression is evaluated by
3355
          * the compiler even though it isn't used.  Microsoft Visual C (various
3356
          * versions) and the Intel C compiler are known to do this.  To avoid
3357
          * this the following macros are used in 1.5.6.  This is a temporary
3358
          * solution to avoid destabilizing the code during the release process.
3359
          */
3360
4.02k
#        if PNG_USE_COMPILE_TIME_MASKS
3361
4.02k
#           define PNG_LSR(x,s) ((x)>>((s) & 0x1f))
3362
4.02k
#           define PNG_LSL(x,s) ((x)<<((s) & 0x1f))
3363
#        else
3364
#           define PNG_LSR(x,s) ((x)>>(s))
3365
#           define PNG_LSL(x,s) ((x)<<(s))
3366
#        endif
3367
4.02k
#        define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\
3368
4.02k
           PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1)
3369
4.02k
#        define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\
3370
4.02k
           PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1)
3371
3372
         /* Return a mask for pass 'p' pixel 'x' at depth 'd'.  The mask is
3373
          * little endian - the first pixel is at bit 0 - however the extra
3374
          * parameter 's' can be set to cause the mask position to be swapped
3375
          * within each byte, to match the PNG format.  This is done by XOR of
3376
          * the shift with 7, 6 or 4 for bit depths 1, 2 and 4.
3377
          */
3378
4.02k
#        define PIXEL_MASK(p,x,d,s) \
3379
4.02k
            (PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0))))
3380
3381
         /* Hence generate the appropriate 'block' or 'sparkle' pixel copy mask.
3382
          */
3383
4.02k
#        define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
3384
4.02k
#        define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
3385
3386
         /* Combine 8 of these to get the full mask.  For the 1-bpp and 2-bpp
3387
          * cases the result needs replicating, for the 4-bpp case the above
3388
          * generates a full 32 bits.
3389
          */
3390
6.95M
#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
3391
3392
144k
#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
3393
144k
            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
3394
144k
            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
3395
3396
72.3k
#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
3397
72.3k
            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
3398
72.3k
            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
3399
3400
4.02k
#if PNG_USE_COMPILE_TIME_MASKS
3401
         /* Utility macros to construct all the masks for a depth/swap
3402
          * combination.  The 's' parameter says whether the format is PNG
3403
          * (big endian bytes) or not.  Only the three odd-numbered passes are
3404
          * required for the display/block algorithm.
3405
          */
3406
24.1k
#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
3407
24.1k
            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
3408
3409
24.1k
#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
3410
3411
4.02k
#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
3412
3413
         /* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and
3414
          * then pass:
3415
          */
3416
4.02k
         static const png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] =
3417
4.02k
         {
3418
            /* Little-endian byte masks for PACKSWAP */
3419
4.02k
            { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
3420
            /* Normal (big-endian byte) masks - PNG format */
3421
4.02k
            { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
3422
4.02k
         };
3423
3424
         /* display_mask has only three entries for the odd passes, so index by
3425
          * pass>>1.
3426
          */
3427
4.02k
         static const png_uint_32 display_mask[2][3][3] =
3428
4.02k
         {
3429
            /* Little-endian byte masks for PACKSWAP */
3430
4.02k
            { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
3431
            /* Normal (big-endian byte) masks - PNG format */
3432
4.02k
            { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
3433
4.02k
         };
3434
3435
4.02k
#        define MASK(pass,depth,display,png)\
3436
4.02k
            ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
3437
4.02k
               row_mask[png][DEPTH_INDEX(depth)][pass])
3438
3439
#else /* !PNG_USE_COMPILE_TIME_MASKS */
3440
         /* This is the runtime alternative: it seems unlikely that this will
3441
          * ever be either smaller or faster than the compile time approach.
3442
          */
3443
#        define MASK(pass,depth,display,png)\
3444
            ((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png))
3445
#endif /* !USE_COMPILE_TIME_MASKS */
3446
3447
         /* Use the appropriate mask to copy the required bits.  In some cases
3448
          * the byte mask will be 0 or 0xff; optimize these cases.  row_width is
3449
          * the number of pixels, but the code copies bytes, so it is necessary
3450
          * to special case the end.
3451
          */
3452
4.02k
         png_uint_32 pixels_per_byte = 8 / pixel_depth;
3453
4.02k
         png_uint_32 mask;
3454
3455
4.02k
#        ifdef PNG_READ_PACKSWAP_SUPPORTED
3456
4.02k
         if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
3457
1.62k
            mask = MASK(pass, pixel_depth, display, 0);
3458
3459
2.40k
         else
3460
2.40k
#        endif
3461
2.40k
         mask = MASK(pass, pixel_depth, display, 1);
3462
3463
4.02k
         for (;;)
3464
2.92M
         {
3465
2.92M
            png_uint_32 m;
3466
3467
            /* It doesn't matter in the following if png_uint_32 has more than
3468
             * 32 bits because the high bits always match those in m<<24; it is,
3469
             * however, essential to use OR here, not +, because of this.
3470
             */
3471
2.92M
            m = mask;
3472
2.92M
            mask = (m >> 8) | (m << 24); /* rotate right to good compilers */
3473
2.92M
            m &= 0xff;
3474
3475
2.92M
            if (m != 0) /* something to copy */
3476
2.46M
            {
3477
2.46M
               if (m != 0xff)
3478
2.46M
                  *dp = (png_byte)((*dp & ~m) | (*sp & m));
3479
0
               else
3480
0
                  *dp = *sp;
3481
2.46M
            }
3482
3483
            /* NOTE: this may overwrite the last byte with garbage if the image
3484
             * is not an exact number of bytes wide; libpng has always done
3485
             * this.
3486
             */
3487
2.92M
            if (row_width <= pixels_per_byte)
3488
4.02k
               break; /* May need to restore part of the last byte */
3489
3490
2.92M
            row_width -= pixels_per_byte;
3491
2.92M
            ++dp;
3492
2.92M
            ++sp;
3493
2.92M
         }
3494
4.02k
      }
3495
3496
106k
      else /* pixel_depth >= 8 */
3497
106k
      {
3498
106k
         unsigned int bytes_to_copy, bytes_to_jump;
3499
3500
         /* Validate the depth - it must be a multiple of 8 */
3501
106k
         if (pixel_depth & 7)
3502
0
            png_error(png_ptr, "invalid user transform pixel depth");
3503
3504
106k
         pixel_depth >>= 3; /* now in bytes */
3505
106k
         row_width *= pixel_depth;
3506
3507
         /* Regardless of pass number the Adam 7 interlace always results in a
3508
          * fixed number of pixels to copy then to skip.  There may be a
3509
          * different number of pixels to skip at the start though.
3510
          */
3511
106k
         {
3512
106k
            unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth;
3513
3514
106k
            row_width -= offset;
3515
106k
            dp += offset;
3516
106k
            sp += offset;
3517
106k
         }
3518
3519
         /* Work out the bytes to copy. */
3520
106k
         if (display != 0)
3521
0
         {
3522
            /* When doing the 'block' algorithm the pixel in the pass gets
3523
             * replicated to adjacent pixels.  This is why the even (0,2,4,6)
3524
             * passes are skipped above - the entire expanded row is copied.
3525
             */
3526
0
            bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth;
3527
3528
            /* But don't allow this number to exceed the actual row width. */
3529
0
            if (bytes_to_copy > row_width)
3530
0
               bytes_to_copy = (unsigned int)/*SAFE*/row_width;
3531
0
         }
3532
3533
106k
         else /* normal row; Adam7 only ever gives us one pixel to copy. */
3534
106k
            bytes_to_copy = pixel_depth;
3535
3536
         /* In Adam7 there is a constant offset between where the pixels go. */
3537
106k
         bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;
3538
3539
         /* And simply copy these bytes.  Some optimization is possible here,
3540
          * depending on the value of 'bytes_to_copy'.  Special case the low
3541
          * byte counts, which we know to be frequent.
3542
          *
3543
          * Notice that these cases all 'return' rather than 'break' - this
3544
          * avoids an unnecessary test on whether to restore the last byte
3545
          * below.
3546
          */
3547
106k
         switch (bytes_to_copy)
3548
106k
         {
3549
3.77k
            case 1:
3550
3.77k
               for (;;)
3551
2.29M
               {
3552
2.29M
                  *dp = *sp;
3553
3554
2.29M
                  if (row_width <= bytes_to_jump)
3555
3.77k
                     return;
3556
3557
2.29M
                  dp += bytes_to_jump;
3558
2.29M
                  sp += bytes_to_jump;
3559
2.29M
                  row_width -= bytes_to_jump;
3560
2.29M
               }
3561
3562
4.00k
            case 2:
3563
               /* There is a possibility of a partial copy at the end here; this
3564
                * slows the code down somewhat.
3565
                */
3566
4.00k
               do
3567
2.44M
               {
3568
2.44M
                  dp[0] = sp[0]; dp[1] = sp[1];
3569
3570
2.44M
                  if (row_width <= bytes_to_jump)
3571
4.00k
                     return;
3572
3573
2.44M
                  sp += bytes_to_jump;
3574
2.44M
                  dp += bytes_to_jump;
3575
2.44M
                  row_width -= bytes_to_jump;
3576
2.44M
               }
3577
2.44M
               while (row_width > 1);
3578
3579
               /* And there can only be one byte left at this point: */
3580
0
               *dp = *sp;
3581
0
               return;
3582
3583
41.4k
            case 3:
3584
               /* This can only be the RGB case, so each copy is exactly one
3585
                * pixel and it is not necessary to check for a partial copy.
3586
                */
3587
41.4k
               for (;;)
3588
13.4M
               {
3589
13.4M
                  dp[0] = sp[0]; dp[1] = sp[1]; dp[2] = sp[2];
3590
3591
13.4M
                  if (row_width <= bytes_to_jump)
3592
41.4k
                     return;
3593
3594
13.4M
                  sp += bytes_to_jump;
3595
13.4M
                  dp += bytes_to_jump;
3596
13.4M
                  row_width -= bytes_to_jump;
3597
13.4M
               }
3598
3599
57.5k
            default:
3600
57.5k
#if PNG_ALIGN_TYPE != PNG_ALIGN_NONE
3601
               /* Check for double byte alignment and, if possible, use a
3602
                * 16-bit copy.  Don't attempt this for narrow images - ones that
3603
                * are less than an interlace panel wide.  Don't attempt it for
3604
                * wide bytes_to_copy either - use the memcpy there.
3605
                */
3606
57.5k
               if (bytes_to_copy < 16 /*else use memcpy*/ &&
3607
57.5k
                   png_isaligned(dp, png_uint_16) &&
3608
57.5k
                   png_isaligned(sp, png_uint_16) &&
3609
57.5k
                   bytes_to_copy % (sizeof (png_uint_16)) == 0 &&
3610
57.5k
                   bytes_to_jump % (sizeof (png_uint_16)) == 0)
3611
57.5k
               {
3612
                  /* Everything is aligned for png_uint_16 copies, but try for
3613
                   * png_uint_32 first.
3614
                   */
3615
57.5k
                  if (png_isaligned(dp, png_uint_32) &&
3616
57.5k
                      png_isaligned(sp, png_uint_32) &&
3617
57.5k
                      bytes_to_copy % (sizeof (png_uint_32)) == 0 &&
3618
57.5k
                      bytes_to_jump % (sizeof (png_uint_32)) == 0)
3619
43.9k
                  {
3620
43.9k
                     png_uint_32p dp32 = png_aligncast(png_uint_32p,dp);
3621
43.9k
                     png_const_uint_32p sp32 = png_aligncastconst(
3622
43.9k
                         png_const_uint_32p, sp);
3623
43.9k
                     size_t skip = (bytes_to_jump-bytes_to_copy) /
3624
43.9k
                         (sizeof (png_uint_32));
3625
3626
43.9k
                     do
3627
11.0M
                     {
3628
11.0M
                        size_t c = bytes_to_copy;
3629
11.0M
                        do
3630
12.2M
                        {
3631
12.2M
                           *dp32++ = *sp32++;
3632
12.2M
                           c -= (sizeof (png_uint_32));
3633
12.2M
                        }
3634
12.2M
                        while (c > 0);
3635
3636
11.0M
                        if (row_width <= bytes_to_jump)
3637
43.9k
                           return;
3638
3639
11.0M
                        dp32 += skip;
3640
11.0M
                        sp32 += skip;
3641
11.0M
                        row_width -= bytes_to_jump;
3642
11.0M
                     }
3643
11.0M
                     while (bytes_to_copy <= row_width);
3644
3645
                     /* Get to here when the row_width truncates the final copy.
3646
                      * There will be 1-3 bytes left to copy, so don't try the
3647
                      * 16-bit loop below.
3648
                      */
3649
0
                     dp = (png_bytep)dp32;
3650
0
                     sp = (png_const_bytep)sp32;
3651
0
                     do
3652
0
                        *dp++ = *sp++;
3653
0
                     while (--row_width > 0);
3654
0
                     return;
3655
43.9k
                  }
3656
3657
                  /* Else do it in 16-bit quantities, but only if the size is
3658
                   * not too large.
3659
                   */
3660
13.6k
                  else
3661
13.6k
                  {
3662
13.6k
                     png_uint_16p dp16 = png_aligncast(png_uint_16p, dp);
3663
13.6k
                     png_const_uint_16p sp16 = png_aligncastconst(
3664
13.6k
                        png_const_uint_16p, sp);
3665
13.6k
                     size_t skip = (bytes_to_jump-bytes_to_copy) /
3666
13.6k
                        (sizeof (png_uint_16));
3667
3668
13.6k
                     do
3669
4.28M
                     {
3670
4.28M
                        size_t c = bytes_to_copy;
3671
4.28M
                        do
3672
12.8M
                        {
3673
12.8M
                           *dp16++ = *sp16++;
3674
12.8M
                           c -= (sizeof (png_uint_16));
3675
12.8M
                        }
3676
12.8M
                        while (c > 0);
3677
3678
4.28M
                        if (row_width <= bytes_to_jump)
3679
13.6k
                           return;
3680
3681
4.26M
                        dp16 += skip;
3682
4.26M
                        sp16 += skip;
3683
4.26M
                        row_width -= bytes_to_jump;
3684
4.26M
                     }
3685
4.26M
                     while (bytes_to_copy <= row_width);
3686
3687
                     /* End of row - 1 byte left, bytes_to_copy > row_width: */
3688
0
                     dp = (png_bytep)dp16;
3689
0
                     sp = (png_const_bytep)sp16;
3690
0
                     do
3691
0
                        *dp++ = *sp++;
3692
0
                     while (--row_width > 0);
3693
0
                     return;
3694
13.6k
                  }
3695
57.5k
               }
3696
0
#endif /* ALIGN_TYPE code */
3697
3698
               /* The true default - use a memcpy: */
3699
0
               for (;;)
3700
0
               {
3701
0
                  memcpy(dp, sp, bytes_to_copy);
3702
3703
0
                  if (row_width <= bytes_to_jump)
3704
0
                     return;
3705
3706
0
                  sp += bytes_to_jump;
3707
0
                  dp += bytes_to_jump;
3708
0
                  row_width -= bytes_to_jump;
3709
0
                  if (bytes_to_copy > row_width)
3710
0
                     bytes_to_copy = (unsigned int)/*SAFE*/row_width;
3711
0
               }
3712
106k
         }
3713
3714
         /* NOT REACHED*/
3715
106k
      } /* pixel_depth >= 8 */
3716
3717
      /* Here if pixel_depth < 8 to check 'end_ptr' below. */
3718
110k
   }
3719
895k
   else
3720
895k
#endif /* READ_INTERLACING */
3721
3722
   /* If here then the switch above wasn't used so just memcpy the whole row
3723
    * from the temporary row buffer (notice that this overwrites the end of the
3724
    * destination row if it is a partial byte.)
3725
    */
3726
895k
   memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width));
3727
3728
   /* Restore the overwritten bits from the last byte if necessary. */
3729
899k
   if (end_ptr != NULL)
3730
3.53k
      *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask));
3731
899k
}
3732
3733
#ifdef PNG_READ_INTERLACING_SUPPORTED
3734
void /* PRIVATE */
3735
png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
3736
    png_uint_32 transformations /* Because these may affect the byte layout */)
3737
110k
{
3738
110k
   png_debug(1, "in png_do_read_interlace");
3739
110k
   if (row != NULL && row_info != NULL)
3740
110k
   {
3741
110k
      png_uint_32 final_width;
3742
3743
110k
      final_width = row_info->width * png_pass_inc[pass];
3744
3745
110k
      switch (row_info->pixel_depth)
3746
110k
      {
3747
1.57k
         case 1:
3748
1.57k
         {
3749
1.57k
            png_bytep sp = row + (size_t)((row_info->width - 1) >> 3);
3750
1.57k
            png_bytep dp = row + (size_t)((final_width - 1) >> 3);
3751
1.57k
            unsigned int sshift, dshift;
3752
1.57k
            unsigned int s_start, s_end;
3753
1.57k
            int s_inc;
3754
1.57k
            int jstop = (int)png_pass_inc[pass];
3755
1.57k
            png_byte v;
3756
1.57k
            png_uint_32 i;
3757
1.57k
            int j;
3758
3759
1.57k
#ifdef PNG_READ_PACKSWAP_SUPPORTED
3760
1.57k
            if ((transformations & PNG_PACKSWAP) != 0)
3761
533
            {
3762
533
                sshift = ((row_info->width + 7) & 0x07);
3763
533
                dshift = ((final_width + 7) & 0x07);
3764
533
                s_start = 7;
3765
533
                s_end = 0;
3766
533
                s_inc = -1;
3767
533
            }
3768
3769
1.04k
            else
3770
1.04k
#endif
3771
1.04k
            {
3772
1.04k
                sshift = 7 - ((row_info->width + 7) & 0x07);
3773
1.04k
                dshift = 7 - ((final_width + 7) & 0x07);
3774
1.04k
                s_start = 0;
3775
1.04k
                s_end = 7;
3776
1.04k
                s_inc = 1;
3777
1.04k
            }
3778
3779
2.21M
            for (i = 0; i < row_info->width; i++)
3780
2.21M
            {
3781
2.21M
               v = (png_byte)((*sp >> sshift) & 0x01);
3782
17.5M
               for (j = 0; j < jstop; j++)
3783
15.3M
               {
3784
15.3M
                  unsigned int tmp = *dp & (0x7f7f >> (7 - dshift));
3785
15.3M
                  tmp |= (unsigned int)(v << dshift);
3786
15.3M
                  *dp = (png_byte)(tmp & 0xff);
3787
3788
15.3M
                  if (dshift == s_end)
3789
1.91M
                  {
3790
1.91M
                     dshift = s_start;
3791
1.91M
                     dp--;
3792
1.91M
                  }
3793
3794
13.4M
                  else
3795
13.4M
                     dshift = (unsigned int)((int)dshift + s_inc);
3796
15.3M
               }
3797
3798
2.21M
               if (sshift == s_end)
3799
277k
               {
3800
277k
                  sshift = s_start;
3801
277k
                  sp--;
3802
277k
               }
3803
3804
1.93M
               else
3805
1.93M
                  sshift = (unsigned int)((int)sshift + s_inc);
3806
2.21M
            }
3807
1.57k
            break;
3808
0
         }
3809
3810
1.27k
         case 2:
3811
1.27k
         {
3812
1.27k
            png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2);
3813
1.27k
            png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2);
3814
1.27k
            unsigned int sshift, dshift;
3815
1.27k
            unsigned int s_start, s_end;
3816
1.27k
            int s_inc;
3817
1.27k
            int jstop = (int)png_pass_inc[pass];
3818
1.27k
            png_uint_32 i;
3819
3820
1.27k
#ifdef PNG_READ_PACKSWAP_SUPPORTED
3821
1.27k
            if ((transformations & PNG_PACKSWAP) != 0)
3822
580
            {
3823
580
               sshift = (((row_info->width + 3) & 0x03) << 1);
3824
580
               dshift = (((final_width + 3) & 0x03) << 1);
3825
580
               s_start = 6;
3826
580
               s_end = 0;
3827
580
               s_inc = -2;
3828
580
            }
3829
3830
691
            else
3831
691
#endif
3832
691
            {
3833
691
               sshift = ((3 - ((row_info->width + 3) & 0x03)) << 1);
3834
691
               dshift = ((3 - ((final_width + 3) & 0x03)) << 1);
3835
691
               s_start = 0;
3836
691
               s_end = 6;
3837
691
               s_inc = 2;
3838
691
            }
3839
3840
559k
            for (i = 0; i < row_info->width; i++)
3841
558k
            {
3842
558k
               png_byte v;
3843
558k
               int j;
3844
3845
558k
               v = (png_byte)((*sp >> sshift) & 0x03);
3846
3.29M
               for (j = 0; j < jstop; j++)
3847
2.73M
               {
3848
2.73M
                  unsigned int tmp = *dp & (0x3f3f >> (6 - dshift));
3849
2.73M
                  tmp |= (unsigned int)(v << dshift);
3850
2.73M
                  *dp = (png_byte)(tmp & 0xff);
3851
3852
2.73M
                  if (dshift == s_end)
3853
683k
                  {
3854
683k
                     dshift = s_start;
3855
683k
                     dp--;
3856
683k
                  }
3857
3858
2.05M
                  else
3859
2.05M
                     dshift = (unsigned int)((int)dshift + s_inc);
3860
2.73M
               }
3861
3862
558k
               if (sshift == s_end)
3863
140k
               {
3864
140k
                  sshift = s_start;
3865
140k
                  sp--;
3866
140k
               }
3867
3868
417k
               else
3869
417k
                  sshift = (unsigned int)((int)sshift + s_inc);
3870
558k
            }
3871
1.27k
            break;
3872
0
         }
3873
3874
1.17k
         case 4:
3875
1.17k
         {
3876
1.17k
            png_bytep sp = row + (size_t)((row_info->width - 1) >> 1);
3877
1.17k
            png_bytep dp = row + (size_t)((final_width - 1) >> 1);
3878
1.17k
            unsigned int sshift, dshift;
3879
1.17k
            unsigned int s_start, s_end;
3880
1.17k
            int s_inc;
3881
1.17k
            png_uint_32 i;
3882
1.17k
            int jstop = (int)png_pass_inc[pass];
3883
3884
1.17k
#ifdef PNG_READ_PACKSWAP_SUPPORTED
3885
1.17k
            if ((transformations & PNG_PACKSWAP) != 0)
3886
508
            {
3887
508
               sshift = (((row_info->width + 1) & 0x01) << 2);
3888
508
               dshift = (((final_width + 1) & 0x01) << 2);
3889
508
               s_start = 4;
3890
508
               s_end = 0;
3891
508
               s_inc = -4;
3892
508
            }
3893
3894
670
            else
3895
670
#endif
3896
670
            {
3897
670
               sshift = ((1 - ((row_info->width + 1) & 0x01)) << 2);
3898
670
               dshift = ((1 - ((final_width + 1) & 0x01)) << 2);
3899
670
               s_start = 0;
3900
670
               s_end = 4;
3901
670
               s_inc = 4;
3902
670
            }
3903
3904
85.3k
            for (i = 0; i < row_info->width; i++)
3905
84.1k
            {
3906
84.1k
               png_byte v = (png_byte)((*sp >> sshift) & 0x0f);
3907
84.1k
               int j;
3908
3909
741k
               for (j = 0; j < jstop; j++)
3910
657k
               {
3911
657k
                  unsigned int tmp = *dp & (0xf0f >> (4 - dshift));
3912
657k
                  tmp |= (unsigned int)(v << dshift);
3913
657k
                  *dp = (png_byte)(tmp & 0xff);
3914
3915
657k
                  if (dshift == s_end)
3916
328k
                  {
3917
328k
                     dshift = s_start;
3918
328k
                     dp--;
3919
328k
                  }
3920
3921
328k
                  else
3922
328k
                     dshift = (unsigned int)((int)dshift + s_inc);
3923
657k
               }
3924
3925
84.1k
               if (sshift == s_end)
3926
42.5k
               {
3927
42.5k
                  sshift = s_start;
3928
42.5k
                  sp--;
3929
42.5k
               }
3930
3931
41.6k
               else
3932
41.6k
                  sshift = (unsigned int)((int)sshift + s_inc);
3933
84.1k
            }
3934
1.17k
            break;
3935
0
         }
3936
3937
106k
         default:
3938
106k
         {
3939
106k
            size_t pixel_bytes = (row_info->pixel_depth >> 3);
3940
3941
106k
            png_bytep sp = row + (size_t)(row_info->width - 1)
3942
106k
                * pixel_bytes;
3943
3944
106k
            png_bytep dp = row + (size_t)(final_width - 1) * pixel_bytes;
3945
3946
106k
            int jstop = (int)png_pass_inc[pass];
3947
106k
            png_uint_32 i;
3948
3949
33.6M
            for (i = 0; i < row_info->width; i++)
3950
33.5M
            {
3951
33.5M
               png_byte v[8]; /* SAFE; pixel_depth does not exceed 64 */
3952
33.5M
               int j;
3953
3954
33.5M
               memcpy(v, sp, pixel_bytes);
3955
3956
232M
               for (j = 0; j < jstop; j++)
3957
199M
               {
3958
199M
                  memcpy(dp, v, pixel_bytes);
3959
199M
                  dp -= pixel_bytes;
3960
199M
               }
3961
3962
33.5M
               sp -= pixel_bytes;
3963
33.5M
            }
3964
106k
            break;
3965
0
         }
3966
110k
      }
3967
3968
110k
      row_info->width = final_width;
3969
110k
      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);
3970
110k
   }
3971
#ifndef PNG_READ_PACKSWAP_SUPPORTED
3972
   PNG_UNUSED(transformations)  /* Silence compiler warning */
3973
#endif
3974
110k
}
3975
#endif /* READ_INTERLACING */
3976
3977
static void
3978
png_read_filter_row_sub(png_row_infop row_info, png_bytep row,
3979
    png_const_bytep prev_row)
3980
224k
{
3981
224k
   size_t i;
3982
224k
   size_t istop = row_info->rowbytes;
3983
224k
   unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
3984
224k
   png_bytep rp = row + bpp;
3985
3986
224k
   PNG_UNUSED(prev_row)
3987
3988
11.1M
   for (i = bpp; i < istop; i++)
3989
10.9M
   {
3990
10.9M
      *rp = (png_byte)(((int)(*rp) + (int)(*(rp-bpp))) & 0xff);
3991
10.9M
      rp++;
3992
10.9M
   }
3993
224k
}
3994
3995
static void
3996
png_read_filter_row_up(png_row_infop row_info, png_bytep row,
3997
    png_const_bytep prev_row)
3998
168k
{
3999
168k
   size_t i;
4000
168k
   size_t istop = row_info->rowbytes;
4001
168k
   png_bytep rp = row;
4002
168k
   png_const_bytep pp = prev_row;
4003
4004
13.5M
   for (i = 0; i < istop; i++)
4005
13.4M
   {
4006
13.4M
      *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff);
4007
13.4M
      rp++;
4008
13.4M
   }
4009
168k
}
4010
4011
static void
4012
png_read_filter_row_avg(png_row_infop row_info, png_bytep row,
4013
    png_const_bytep prev_row)
4014
70.5k
{
4015
70.5k
   size_t i;
4016
70.5k
   png_bytep rp = row;
4017
70.5k
   png_const_bytep pp = prev_row;
4018
70.5k
   unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
4019
70.5k
   size_t istop = row_info->rowbytes - bpp;
4020
4021
201k
   for (i = 0; i < bpp; i++)
4022
131k
   {
4023
131k
      *rp = (png_byte)(((int)(*rp) +
4024
131k
         ((int)(*pp++) / 2 )) & 0xff);
4025
4026
131k
      rp++;
4027
131k
   }
4028
4029
12.2M
   for (i = 0; i < istop; i++)
4030
12.2M
   {
4031
12.2M
      *rp = (png_byte)(((int)(*rp) +
4032
12.2M
         (int)(*pp++ + *(rp-bpp)) / 2 ) & 0xff);
4033
4034
12.2M
      rp++;
4035
12.2M
   }
4036
70.5k
}
4037
4038
static void
4039
png_read_filter_row_paeth_1byte_pixel(png_row_infop row_info, png_bytep row,
4040
    png_const_bytep prev_row)
4041
49.7k
{
4042
49.7k
   png_bytep rp_end = row + row_info->rowbytes;
4043
49.7k
   int a, c;
4044
4045
   /* First pixel/byte */
4046
49.7k
   c = *prev_row++;
4047
49.7k
   a = *row + c;
4048
49.7k
   *row++ = (png_byte)a;
4049
4050
   /* Remainder */
4051
279k
   while (row < rp_end)
4052
229k
   {
4053
229k
      int b, pa, pb, pc, p;
4054
4055
229k
      a &= 0xff; /* From previous iteration or start */
4056
229k
      b = *prev_row++;
4057
4058
229k
      p = b - c;
4059
229k
      pc = a - c;
4060
4061
#ifdef PNG_USE_ABS
4062
      pa = abs(p);
4063
      pb = abs(pc);
4064
      pc = abs(p + pc);
4065
#else
4066
229k
      pa = p < 0 ? -p : p;
4067
229k
      pb = pc < 0 ? -pc : pc;
4068
229k
      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
4069
229k
#endif
4070
4071
      /* Find the best predictor, the least of pa, pb, pc favoring the earlier
4072
       * ones in the case of a tie.
4073
       */
4074
229k
      if (pb < pa)
4075
6.73k
      {
4076
6.73k
         pa = pb; a = b;
4077
6.73k
      }
4078
229k
      if (pc < pa) a = c;
4079
4080
      /* Calculate the current pixel in a, and move the previous row pixel to c
4081
       * for the next time round the loop
4082
       */
4083
229k
      c = b;
4084
229k
      a += *row;
4085
229k
      *row++ = (png_byte)a;
4086
229k
   }
4087
49.7k
}
4088
4089
static void
4090
png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
4091
    png_const_bytep prev_row)
4092
27.4k
{
4093
27.4k
   unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
4094
27.4k
   png_bytep rp_end = row + bpp;
4095
4096
   /* Process the first pixel in the row completely (this is the same as 'up'
4097
    * because there is only one candidate predictor for the first row).
4098
    */
4099
131k
   while (row < rp_end)
4100
104k
   {
4101
104k
      int a = *row + *prev_row++;
4102
104k
      *row++ = (png_byte)a;
4103
104k
   }
4104
4105
   /* Remainder */
4106
27.4k
   rp_end = rp_end + (row_info->rowbytes - bpp);
4107
4108
750k
   while (row < rp_end)
4109
723k
   {
4110
723k
      int a, b, c, pa, pb, pc, p;
4111
4112
723k
      c = *(prev_row - bpp);
4113
723k
      a = *(row - bpp);
4114
723k
      b = *prev_row++;
4115
4116
723k
      p = b - c;
4117
723k
      pc = a - c;
4118
4119
#ifdef PNG_USE_ABS
4120
      pa = abs(p);
4121
      pb = abs(pc);
4122
      pc = abs(p + pc);
4123
#else
4124
723k
      pa = p < 0 ? -p : p;
4125
723k
      pb = pc < 0 ? -pc : pc;
4126
723k
      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
4127
723k
#endif
4128
4129
723k
      if (pb < pa)
4130
35.4k
      {
4131
35.4k
         pa = pb; a = b;
4132
35.4k
      }
4133
723k
      if (pc < pa) a = c;
4134
4135
723k
      a += *row;
4136
723k
      *row++ = (png_byte)a;
4137
723k
   }
4138
27.4k
}
4139
4140
static void
4141
png_init_filter_functions(png_structrp pp)
4142
   /* This function is called once for every PNG image (except for PNG images
4143
    * that only use PNG_FILTER_VALUE_NONE for all rows) to set the
4144
    * implementations required to reverse the filtering of PNG rows.  Reversing
4145
    * the filter is the first transformation performed on the row data.  It is
4146
    * performed in place, therefore an implementation can be selected based on
4147
    * the image pixel format.  If the implementation depends on image width then
4148
    * take care to ensure that it works correctly if the image is interlaced -
4149
    * interlacing causes the actual row width to vary.
4150
    */
4151
16.1k
{
4152
16.1k
   unsigned int bpp = (pp->pixel_depth + 7) >> 3;
4153
4154
16.1k
   pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub;
4155
16.1k
   pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up;
4156
16.1k
   pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg;
4157
16.1k
   if (bpp == 1)
4158
7.52k
      pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
4159
7.52k
         png_read_filter_row_paeth_1byte_pixel;
4160
8.65k
   else
4161
8.65k
      pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
4162
8.65k
         png_read_filter_row_paeth_multibyte_pixel;
4163
4164
#ifdef PNG_FILTER_OPTIMIZATIONS
4165
   /* To use this define PNG_FILTER_OPTIMIZATIONS as the name of a function to
4166
    * call to install hardware optimizations for the above functions; simply
4167
    * replace whatever elements of the pp->read_filter[] array with a hardware
4168
    * specific (or, for that matter, generic) optimization.
4169
    *
4170
    * To see an example of this examine what configure.ac does when
4171
    * --enable-arm-neon is specified on the command line.
4172
    */
4173
   PNG_FILTER_OPTIMIZATIONS(pp, bpp);
4174
#endif
4175
16.1k
}
4176
4177
void /* PRIVATE */
4178
png_read_filter_row(png_structrp pp, png_row_infop row_info, png_bytep row,
4179
    png_const_bytep prev_row, int filter)
4180
541k
{
4181
   /* OPTIMIZATION: DO NOT MODIFY THIS FUNCTION, instead #define
4182
    * PNG_FILTER_OPTIMIZATIONS to a function that overrides the generic
4183
    * implementations.  See png_init_filter_functions above.
4184
    */
4185
541k
   if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
4186
541k
   {
4187
541k
      if (pp->read_filter[0] == NULL)
4188
16.1k
         png_init_filter_functions(pp);
4189
4190
541k
      pp->read_filter[filter-1](row_info, row, prev_row);
4191
541k
   }
4192
541k
}
4193
4194
#ifdef PNG_SEQUENTIAL_READ_SUPPORTED
4195
void /* PRIVATE */
4196
png_read_IDAT_data(png_structrp png_ptr, png_bytep output,
4197
    png_alloc_size_t avail_out)
4198
1.02M
{
4199
   /* Loop reading IDATs and decompressing the result into output[avail_out] */
4200
1.02M
   png_ptr->zstream.next_out = output;
4201
1.02M
   png_ptr->zstream.avail_out = 0; /* safety: set below */
4202
4203
1.02M
   if (output == NULL)
4204
6.58k
      avail_out = 0;
4205
4206
1.02M
   do
4207
3.87M
   {
4208
3.87M
      int ret;
4209
3.87M
      png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
4210
4211
3.87M
      if (png_ptr->zstream.avail_in == 0)
4212
35.5k
      {
4213
35.5k
         uInt avail_in;
4214
35.5k
         png_bytep buffer;
4215
4216
43.3k
         while (png_ptr->idat_size == 0)
4217
9.69k
         {
4218
9.69k
            png_crc_finish(png_ptr, 0);
4219
4220
9.69k
            png_ptr->idat_size = png_read_chunk_header(png_ptr);
4221
            /* This is an error even in the 'check' case because the code just
4222
             * consumed a non-IDAT header.
4223
             */
4224
9.69k
            if (png_ptr->chunk_name != png_IDAT)
4225
1.85k
               png_error(png_ptr, "Not enough image data");
4226
9.69k
         }
4227
4228
33.7k
         avail_in = png_ptr->IDAT_read_size;
4229
4230
33.7k
         if (avail_in > png_chunk_max(png_ptr))
4231
0
            avail_in = (uInt)/*SAFE*/png_chunk_max(png_ptr);
4232
4233
33.7k
         if (avail_in > png_ptr->idat_size)
4234
26.9k
            avail_in = (uInt)png_ptr->idat_size;
4235
4236
         /* A PNG with a gradually increasing IDAT size will defeat this attempt
4237
          * to minimize memory usage by causing lots of re-allocs, but
4238
          * realistically doing IDAT_read_size re-allocs is not likely to be a
4239
          * big problem.
4240
          *
4241
          * An error here corresponds to the system being out of memory.
4242
          */
4243
33.7k
         buffer = png_read_buffer(png_ptr, avail_in);
4244
4245
33.7k
         if (buffer == NULL)
4246
0
            png_chunk_error(png_ptr, "out of memory");
4247
4248
33.7k
         png_crc_read(png_ptr, buffer, avail_in);
4249
33.7k
         png_ptr->idat_size -= avail_in;
4250
4251
33.7k
         png_ptr->zstream.next_in = buffer;
4252
33.7k
         png_ptr->zstream.avail_in = avail_in;
4253
33.7k
      }
4254
4255
      /* And set up the output side. */
4256
3.87M
      if (output != NULL) /* standard read */
4257
1.01M
      {
4258
1.01M
         uInt out = ZLIB_IO_MAX;
4259
4260
1.01M
         if (out > avail_out)
4261
1.01M
            out = (uInt)avail_out;
4262
4263
1.01M
         avail_out -= out;
4264
1.01M
         png_ptr->zstream.avail_out = out;
4265
1.01M
      }
4266
4267
2.86M
      else /* after last row, checking for end */
4268
2.86M
      {
4269
2.86M
         png_ptr->zstream.next_out = tmpbuf;
4270
2.86M
         png_ptr->zstream.avail_out = (sizeof tmpbuf);
4271
2.86M
      }
4272
4273
      /* Use NO_FLUSH; this gives zlib the maximum opportunity to optimize the
4274
       * process.  If the LZ stream is truncated the sequential reader will
4275
       * terminally damage the stream, above, by reading the chunk header of the
4276
       * following chunk (it then exits with png_error).
4277
       *
4278
       * TODO: deal more elegantly with truncated IDAT lists.
4279
       */
4280
3.87M
      ret = PNG_INFLATE(png_ptr, Z_NO_FLUSH);
4281
4282
      /* Take the unconsumed output back. */
4283
3.87M
      if (output != NULL)
4284
1.01M
         avail_out += png_ptr->zstream.avail_out;
4285
4286
2.86M
      else /* avail_out counts the extra bytes */
4287
2.86M
         avail_out += (sizeof tmpbuf) - png_ptr->zstream.avail_out;
4288
4289
3.87M
      png_ptr->zstream.avail_out = 0;
4290
4291
3.87M
      if (ret == Z_STREAM_END)
4292
13.5k
      {
4293
         /* Do this for safety; we won't read any more into this row. */
4294
13.5k
         png_ptr->zstream.next_out = NULL;
4295
4296
13.5k
         png_ptr->mode |= PNG_AFTER_IDAT;
4297
13.5k
         png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
4298
4299
13.5k
         if (png_ptr->zstream.avail_in > 0 || png_ptr->idat_size > 0)
4300
122
            png_chunk_benign_error(png_ptr, "Extra compressed data");
4301
13.5k
         break;
4302
13.5k
      }
4303
4304
3.85M
      if (ret != Z_OK)
4305
8.48k
      {
4306
8.48k
         png_zstream_error(png_ptr, ret);
4307
4308
8.48k
         if (output != NULL)
4309
2.73k
            png_chunk_error(png_ptr, png_ptr->zstream.msg);
4310
4311
5.75k
         else /* checking */
4312
5.75k
         {
4313
5.75k
            png_chunk_benign_error(png_ptr, png_ptr->zstream.msg);
4314
5.75k
            return;
4315
5.75k
         }
4316
8.48k
      }
4317
3.85M
   } while (avail_out > 0);
4318
4319
1.01M
   if (avail_out > 0)
4320
767
   {
4321
      /* The stream ended before the image; this is the same as too few IDATs so
4322
       * should be handled the same way.
4323
       */
4324
767
      if (output != NULL)
4325
403
         png_error(png_ptr, "Not enough image data");
4326
4327
364
      else /* the deflate stream contained extra data */
4328
364
         png_chunk_benign_error(png_ptr, "Too much image data");
4329
767
   }
4330
1.01M
}
4331
4332
void /* PRIVATE */
4333
png_read_finish_IDAT(png_structrp png_ptr)
4334
27.2k
{
4335
   /* We don't need any more data and the stream should have ended, however the
4336
    * LZ end code may actually not have been processed.  In this case we must
4337
    * read it otherwise stray unread IDAT data or, more likely, an IDAT chunk
4338
    * may still remain to be consumed.
4339
    */
4340
27.2k
   if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
4341
6.58k
   {
4342
      /* The NULL causes png_read_IDAT_data to swallow any remaining bytes in
4343
       * the compressed stream, but the stream may be damaged too, so even after
4344
       * this call we may need to terminate the zstream ownership.
4345
       */
4346
6.58k
      png_read_IDAT_data(png_ptr, NULL, 0);
4347
6.58k
      png_ptr->zstream.next_out = NULL; /* safety */
4348
4349
      /* Now clear everything out for safety; the following may not have been
4350
       * done.
4351
       */
4352
6.58k
      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
4353
5.36k
      {
4354
5.36k
         png_ptr->mode |= PNG_AFTER_IDAT;
4355
5.36k
         png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
4356
5.36k
      }
4357
6.58k
   }
4358
4359
   /* If the zstream has not been released do it now *and* terminate the reading
4360
    * of the final IDAT chunk.
4361
    */
4362
27.2k
   if (png_ptr->zowner == png_IDAT)
4363
17.6k
   {
4364
      /* Always do this; the pointers otherwise point into the read buffer. */
4365
17.6k
      png_ptr->zstream.next_in = NULL;
4366
17.6k
      png_ptr->zstream.avail_in = 0;
4367
4368
      /* Now we no longer own the zstream. */
4369
17.6k
      png_ptr->zowner = 0;
4370
4371
      /* The slightly weird semantics of the sequential IDAT reading is that we
4372
       * are always in or at the end of an IDAT chunk, so we always need to do a
4373
       * crc_finish here.  If idat_size is non-zero we also need to read the
4374
       * spurious bytes at the end of the chunk now.
4375
       */
4376
17.6k
      (void)png_crc_finish(png_ptr, png_ptr->idat_size);
4377
17.6k
   }
4378
27.2k
}
4379
4380
void /* PRIVATE */
4381
png_read_finish_row(png_structrp png_ptr)
4382
1.79M
{
4383
1.79M
   png_debug(1, "in png_read_finish_row");
4384
1.79M
   png_ptr->row_number++;
4385
1.79M
   if (png_ptr->row_number < png_ptr->num_rows)
4386
1.71M
      return;
4387
4388
82.3k
   if (png_ptr->interlaced != 0)
4389
73.6k
   {
4390
73.6k
      png_ptr->row_number = 0;
4391
4392
      /* TO DO: don't do this if prev_row isn't needed (requires
4393
       * read-ahead of the next row's filter byte.
4394
       */
4395
73.6k
      memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
4396
4397
73.6k
      do
4398
73.8k
      {
4399
73.8k
         png_ptr->pass++;
4400
4401
73.8k
         if (png_ptr->pass >= 7)
4402
9.78k
            break;
4403
4404
64.1k
         png_ptr->iwidth = (png_ptr->width +
4405
64.1k
            png_pass_inc[png_ptr->pass] - 1 -
4406
64.1k
            png_pass_start[png_ptr->pass]) /
4407
64.1k
            png_pass_inc[png_ptr->pass];
4408
4409
64.1k
         if ((png_ptr->transformations & PNG_INTERLACE) == 0)
4410
635
         {
4411
635
            png_ptr->num_rows = (png_ptr->height +
4412
635
                png_pass_yinc[png_ptr->pass] - 1 -
4413
635
                png_pass_ystart[png_ptr->pass]) /
4414
635
                png_pass_yinc[png_ptr->pass];
4415
635
         }
4416
4417
63.4k
         else  /* if (png_ptr->transformations & PNG_INTERLACE) */
4418
63.4k
            break; /* libpng deinterlacing sees every row */
4419
4420
64.1k
      } while (png_ptr->num_rows == 0 || png_ptr->iwidth == 0);
4421
4422
73.6k
      if (png_ptr->pass < 7)
4423
63.8k
         return;
4424
73.6k
   }
4425
4426
   /* Here after at the end of the last row of the last pass. */
4427
18.5k
   png_read_finish_IDAT(png_ptr);
4428
18.5k
}
4429
#endif /* SEQUENTIAL_READ */
4430
4431
void /* PRIVATE */
4432
png_read_start_row(png_structrp png_ptr)
4433
28.3k
{
4434
28.3k
   unsigned int max_pixel_depth;
4435
28.3k
   size_t row_bytes;
4436
4437
28.3k
   png_debug(1, "in png_read_start_row");
4438
4439
28.3k
#ifdef PNG_READ_TRANSFORMS_SUPPORTED
4440
28.3k
   png_init_read_transformations(png_ptr);
4441
28.3k
#endif
4442
28.3k
   if (png_ptr->interlaced != 0)
4443
15.5k
   {
4444
15.5k
      if ((png_ptr->transformations & PNG_INTERLACE) == 0)
4445
664
         png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
4446
664
             png_pass_ystart[0]) / png_pass_yinc[0];
4447
4448
14.8k
      else
4449
14.8k
         png_ptr->num_rows = png_ptr->height;
4450
4451
15.5k
      png_ptr->iwidth = (png_ptr->width +
4452
15.5k
          png_pass_inc[png_ptr->pass] - 1 -
4453
15.5k
          png_pass_start[png_ptr->pass]) /
4454
15.5k
          png_pass_inc[png_ptr->pass];
4455
15.5k
   }
4456
4457
12.7k
   else
4458
12.7k
   {
4459
12.7k
      png_ptr->num_rows = png_ptr->height;
4460
12.7k
      png_ptr->iwidth = png_ptr->width;
4461
12.7k
   }
4462
4463
28.3k
   max_pixel_depth = (unsigned int)png_ptr->pixel_depth;
4464
4465
   /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpler set of
4466
    * calculations to calculate the final pixel depth, then
4467
    * png_do_read_transforms actually does the transforms.  This means that the
4468
    * code which effectively calculates this value is actually repeated in three
4469
    * separate places.  They must all match.  Innocent changes to the order of
4470
    * transformations can and will break libpng in a way that causes memory
4471
    * overwrites.
4472
    *
4473
    * TODO: fix this.
4474
    */
4475
28.3k
#ifdef PNG_READ_PACK_SUPPORTED
4476
28.3k
   if ((png_ptr->transformations & PNG_PACK) != 0 && png_ptr->bit_depth < 8)
4477
6.50k
      max_pixel_depth = 8;
4478
28.3k
#endif
4479
4480
28.3k
#ifdef PNG_READ_EXPAND_SUPPORTED
4481
28.3k
   if ((png_ptr->transformations & PNG_EXPAND) != 0)
4482
26.4k
   {
4483
26.4k
      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
4484
1.67k
      {
4485
1.67k
         if (png_ptr->num_trans != 0)
4486
617
            max_pixel_depth = 32;
4487
4488
1.05k
         else
4489
1.05k
            max_pixel_depth = 24;
4490
1.67k
      }
4491
4492
24.7k
      else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
4493
12.1k
      {
4494
12.1k
         if (max_pixel_depth < 8)
4495
4.57k
            max_pixel_depth = 8;
4496
4497
12.1k
         if (png_ptr->num_trans != 0)
4498
816
            max_pixel_depth *= 2;
4499
12.1k
      }
4500
4501
12.6k
      else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
4502
8.51k
      {
4503
8.51k
         if (png_ptr->num_trans != 0)
4504
957
         {
4505
957
            max_pixel_depth *= 4;
4506
957
            max_pixel_depth /= 3;
4507
957
         }
4508
8.51k
      }
4509
26.4k
   }
4510
28.3k
#endif
4511
4512
28.3k
#ifdef PNG_READ_EXPAND_16_SUPPORTED
4513
28.3k
   if ((png_ptr->transformations & PNG_EXPAND_16) != 0)
4514
3.12k
   {
4515
3.12k
#  ifdef PNG_READ_EXPAND_SUPPORTED
4516
      /* In fact it is an error if it isn't supported, but checking is
4517
       * the safe way.
4518
       */
4519
3.12k
      if ((png_ptr->transformations & PNG_EXPAND) != 0)
4520
3.12k
      {
4521
3.12k
         if (png_ptr->bit_depth < 16)
4522
2.22k
            max_pixel_depth *= 2;
4523
3.12k
      }
4524
0
      else
4525
0
#  endif
4526
0
      png_ptr->transformations &= ~PNG_EXPAND_16;
4527
3.12k
   }
4528
28.3k
#endif
4529
4530
28.3k
#ifdef PNG_READ_FILLER_SUPPORTED
4531
28.3k
   if ((png_ptr->transformations & (PNG_FILLER)) != 0)
4532
8.66k
   {
4533
8.66k
      if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
4534
4.78k
      {
4535
4.78k
         if (max_pixel_depth <= 8)
4536
4.12k
            max_pixel_depth = 16;
4537
4538
658
         else
4539
658
            max_pixel_depth = 32;
4540
4.78k
      }
4541
4542
3.87k
      else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB ||
4543
3.87k
         png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
4544
3.87k
      {
4545
3.87k
         if (max_pixel_depth <= 32)
4546
3.17k
            max_pixel_depth = 32;
4547
4548
702
         else
4549
702
            max_pixel_depth = 64;
4550
3.87k
      }
4551
8.66k
   }
4552
28.3k
#endif
4553
4554
28.3k
#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
4555
28.3k
   if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0)
4556
19.1k
   {
4557
19.1k
      if (
4558
19.1k
#ifdef PNG_READ_EXPAND_SUPPORTED
4559
19.1k
          (png_ptr->num_trans != 0 &&
4560
19.1k
          (png_ptr->transformations & PNG_EXPAND) != 0) ||
4561
19.1k
#endif
4562
19.1k
#ifdef PNG_READ_FILLER_SUPPORTED
4563
19.1k
          (png_ptr->transformations & (PNG_FILLER)) != 0 ||
4564
19.1k
#endif
4565
19.1k
          png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
4566
7.17k
      {
4567
7.17k
         if (max_pixel_depth <= 16)
4568
4.75k
            max_pixel_depth = 32;
4569
4570
2.42k
         else
4571
2.42k
            max_pixel_depth = 64;
4572
7.17k
      }
4573
4574
12.0k
      else
4575
12.0k
      {
4576
12.0k
         if (max_pixel_depth <= 8)
4577
5.15k
         {
4578
5.15k
            if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4579
0
               max_pixel_depth = 32;
4580
4581
5.15k
            else
4582
5.15k
               max_pixel_depth = 24;
4583
5.15k
         }
4584
4585
6.86k
         else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4586
1.21k
            max_pixel_depth = 64;
4587
4588
5.64k
         else
4589
5.64k
            max_pixel_depth = 48;
4590
12.0k
      }
4591
19.1k
   }
4592
28.3k
#endif
4593
4594
28.3k
#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
4595
28.3k
defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
4596
28.3k
   if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
4597
0
   {
4598
0
      unsigned int user_pixel_depth = png_ptr->user_transform_depth *
4599
0
         png_ptr->user_transform_channels;
4600
4601
0
      if (user_pixel_depth > max_pixel_depth)
4602
0
         max_pixel_depth = user_pixel_depth;
4603
0
   }
4604
28.3k
#endif
4605
4606
   /* This value is stored in png_struct and double checked in the row read
4607
    * code.
4608
    */
4609
28.3k
   png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;
4610
28.3k
   png_ptr->transformed_pixel_depth = 0; /* calculated on demand */
4611
4612
   /* Align the width on the next larger 8 pixels.  Mainly used
4613
    * for interlacing
4614
    */
4615
28.3k
   row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));
4616
   /* Calculate the maximum bytes needed, adding a byte and a pixel
4617
    * for safety's sake
4618
    */
4619
28.3k
   row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
4620
28.3k
       1 + ((max_pixel_depth + 7) >> 3U);
4621
4622
#ifdef PNG_MAX_MALLOC_64K
4623
   if (row_bytes > (png_uint_32)65536L)
4624
      png_error(png_ptr, "This image requires a row greater than 64KB");
4625
#endif
4626
4627
28.3k
   if (row_bytes + 48 > png_ptr->old_big_row_buf_size)
4628
28.3k
   {
4629
28.3k
      png_free(png_ptr, png_ptr->big_row_buf);
4630
28.3k
      png_free(png_ptr, png_ptr->big_prev_row);
4631
4632
28.3k
      if (png_ptr->interlaced != 0)
4633
15.5k
         png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr,
4634
15.5k
             row_bytes + 48);
4635
4636
12.7k
      else
4637
12.7k
         png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
4638
4639
28.3k
      png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
4640
4641
28.3k
#ifdef PNG_ALIGNED_MEMORY_SUPPORTED
4642
      /* Use 16-byte aligned memory for row_buf with at least 16 bytes
4643
       * of padding before and after row_buf; treat prev_row similarly.
4644
       * NOTE: the alignment is to the start of the pixels, one beyond the start
4645
       * of the buffer, because of the filter byte.  Prior to libpng 1.5.6 this
4646
       * was incorrect; the filter byte was aligned, which had the exact
4647
       * opposite effect of that intended.
4648
       */
4649
28.3k
      {
4650
28.3k
         png_bytep temp = png_ptr->big_row_buf + 32;
4651
28.3k
         size_t extra = (size_t)temp & 0x0f;
4652
28.3k
         png_ptr->row_buf = temp - extra - 1/*filter byte*/;
4653
4654
28.3k
         temp = png_ptr->big_prev_row + 32;
4655
28.3k
         extra = (size_t)temp & 0x0f;
4656
28.3k
         png_ptr->prev_row = temp - extra - 1/*filter byte*/;
4657
28.3k
      }
4658
#else
4659
      /* Use 31 bytes of padding before and 17 bytes after row_buf. */
4660
      png_ptr->row_buf = png_ptr->big_row_buf + 31;
4661
      png_ptr->prev_row = png_ptr->big_prev_row + 31;
4662
#endif
4663
28.3k
      png_ptr->old_big_row_buf_size = row_bytes + 48;
4664
28.3k
   }
4665
4666
#ifdef PNG_MAX_MALLOC_64K
4667
   if (png_ptr->rowbytes > 65535)
4668
      png_error(png_ptr, "This image requires a row greater than 64KB");
4669
4670
#endif
4671
28.3k
   if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1))
4672
0
      png_error(png_ptr, "Row has too many bytes to allocate in memory");
4673
4674
28.3k
   memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
4675
4676
28.3k
   png_debug1(3, "width = %u,", png_ptr->width);
4677
28.3k
   png_debug1(3, "height = %u,", png_ptr->height);
4678
28.3k
   png_debug1(3, "iwidth = %u,", png_ptr->iwidth);
4679
28.3k
   png_debug1(3, "num_rows = %u,", png_ptr->num_rows);
4680
28.3k
   png_debug1(3, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes);
4681
28.3k
   png_debug1(3, "irowbytes = %lu",
4682
28.3k
       (unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1);
4683
4684
   /* The sequential reader needs a buffer for IDAT, but the progressive reader
4685
    * does not, so free the read buffer now regardless; the sequential reader
4686
    * reallocates it on demand.
4687
    */
4688
28.3k
   if (png_ptr->read_buffer != NULL)
4689
3.72k
   {
4690
3.72k
      png_bytep buffer = png_ptr->read_buffer;
4691
4692
3.72k
      png_ptr->read_buffer_size = 0;
4693
3.72k
      png_ptr->read_buffer = NULL;
4694
3.72k
      png_free(png_ptr, buffer);
4695
3.72k
   }
4696
4697
   /* Finally claim the zstream for the inflate of the IDAT data, use the bits
4698
    * value from the stream (note that this will result in a fatal error if the
4699
    * IDAT stream has a bogus deflate header window_bits value, but this should
4700
    * not be happening any longer!)
4701
    */
4702
28.3k
   if (png_inflate_claim(png_ptr, png_IDAT) != Z_OK)
4703
0
      png_error(png_ptr, png_ptr->zstream.msg);
4704
4705
28.3k
   png_ptr->flags |= PNG_FLAG_ROW_INIT;
4706
28.3k
}
4707
#endif /* READ */