Coverage Report

Created: 2025-02-03 06:29

/src/libspectre/ghostscript/libpng/pngwutil.c
Line
Count
Source (jump to first uncovered line)
1
2
/* pngwutil.c - utilities to write a PNG file
3
 *
4
 * Copyright (c) 2018 Cosmin Truta
5
 * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
6
 * Copyright (c) 1996-1997 Andreas Dilger
7
 * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
8
 *
9
 * This code is released under the libpng license.
10
 * For conditions of distribution and use, see the disclaimer
11
 * and license in png.h
12
 */
13
14
#include "pngpriv.h"
15
16
#ifdef PNG_WRITE_SUPPORTED
17
18
#ifdef PNG_WRITE_INT_FUNCTIONS_SUPPORTED
19
/* Place a 32-bit number into a buffer in PNG byte order.  We work
20
 * with unsigned numbers for convenience, although one supported
21
 * ancillary chunk uses signed (two's complement) numbers.
22
 */
23
void PNGAPI
24
png_save_uint_32(png_bytep buf, png_uint_32 i)
25
0
{
26
0
   buf[0] = (png_byte)((i >> 24) & 0xffU);
27
0
   buf[1] = (png_byte)((i >> 16) & 0xffU);
28
0
   buf[2] = (png_byte)((i >>  8) & 0xffU);
29
0
   buf[3] = (png_byte)( i        & 0xffU);
30
0
}
31
32
/* Place a 16-bit number into a buffer in PNG byte order.
33
 * The parameter is declared unsigned int, not png_uint_16,
34
 * just to avoid potential problems on pre-ANSI C compilers.
35
 */
36
void PNGAPI
37
png_save_uint_16(png_bytep buf, unsigned int i)
38
0
{
39
0
   buf[0] = (png_byte)((i >> 8) & 0xffU);
40
0
   buf[1] = (png_byte)( i       & 0xffU);
41
0
}
42
#endif
43
44
/* Simple function to write the signature.  If we have already written
45
 * the magic bytes of the signature, or more likely, the PNG stream is
46
 * being embedded into another stream and doesn't need its own signature,
47
 * we should call png_set_sig_bytes() to tell libpng how many of the
48
 * bytes have already been written.
49
 */
50
void PNGAPI
51
png_write_sig(png_structrp png_ptr)
52
0
{
53
0
   png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
54
55
0
#ifdef PNG_IO_STATE_SUPPORTED
56
   /* Inform the I/O callback that the signature is being written */
57
0
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_SIGNATURE;
58
0
#endif
59
60
   /* Write the rest of the 8 byte signature */
61
0
   png_write_data(png_ptr, &png_signature[png_ptr->sig_bytes],
62
0
       (size_t)(8 - png_ptr->sig_bytes));
63
64
0
   if (png_ptr->sig_bytes < 3)
65
0
      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
66
0
}
67
68
/* Write the start of a PNG chunk.  The type is the chunk type.
69
 * The total_length is the sum of the lengths of all the data you will be
70
 * passing in png_write_chunk_data().
71
 */
72
static void
73
png_write_chunk_header(png_structrp png_ptr, png_uint_32 chunk_name,
74
    png_uint_32 length)
75
0
{
76
0
   png_byte buf[8];
77
78
#if defined(PNG_DEBUG) && (PNG_DEBUG > 0)
79
   PNG_CSTRING_FROM_CHUNK(buf, chunk_name);
80
   png_debug2(0, "Writing %s chunk, length = %lu", buf, (unsigned long)length);
81
#endif
82
83
0
   if (png_ptr == NULL)
84
0
      return;
85
86
0
#ifdef PNG_IO_STATE_SUPPORTED
87
   /* Inform the I/O callback that the chunk header is being written.
88
    * PNG_IO_CHUNK_HDR requires a single I/O call.
89
    */
90
0
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_HDR;
91
0
#endif
92
93
   /* Write the length and the chunk name */
94
0
   png_save_uint_32(buf, length);
95
0
   png_save_uint_32(buf + 4, chunk_name);
96
0
   png_write_data(png_ptr, buf, 8);
97
98
   /* Put the chunk name into png_ptr->chunk_name */
99
0
   png_ptr->chunk_name = chunk_name;
100
101
   /* Reset the crc and run it over the chunk name */
102
0
   png_reset_crc(png_ptr);
103
104
0
   png_calculate_crc(png_ptr, buf + 4, 4);
105
106
0
#ifdef PNG_IO_STATE_SUPPORTED
107
   /* Inform the I/O callback that chunk data will (possibly) be written.
108
    * PNG_IO_CHUNK_DATA does NOT require a specific number of I/O calls.
109
    */
110
0
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_DATA;
111
0
#endif
112
0
}
113
114
void PNGAPI
115
png_write_chunk_start(png_structrp png_ptr, png_const_bytep chunk_string,
116
    png_uint_32 length)
117
0
{
118
0
   png_write_chunk_header(png_ptr, PNG_CHUNK_FROM_STRING(chunk_string), length);
119
0
}
120
121
/* Write the data of a PNG chunk started with png_write_chunk_header().
122
 * Note that multiple calls to this function are allowed, and that the
123
 * sum of the lengths from these calls *must* add up to the total_length
124
 * given to png_write_chunk_header().
125
 */
126
void PNGAPI
127
png_write_chunk_data(png_structrp png_ptr, png_const_bytep data, size_t length)
128
0
{
129
   /* Write the data, and run the CRC over it */
130
0
   if (png_ptr == NULL)
131
0
      return;
132
133
0
   if (data != NULL && length > 0)
134
0
   {
135
0
      png_write_data(png_ptr, data, length);
136
137
      /* Update the CRC after writing the data,
138
       * in case the user I/O routine alters it.
139
       */
140
0
      png_calculate_crc(png_ptr, data, length);
141
0
   }
142
0
}
143
144
/* Finish a chunk started with png_write_chunk_header(). */
145
void PNGAPI
146
png_write_chunk_end(png_structrp png_ptr)
147
0
{
148
0
   png_byte buf[4];
149
150
0
   if (png_ptr == NULL) return;
151
152
0
#ifdef PNG_IO_STATE_SUPPORTED
153
   /* Inform the I/O callback that the chunk CRC is being written.
154
    * PNG_IO_CHUNK_CRC requires a single I/O function call.
155
    */
156
0
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_CRC;
157
0
#endif
158
159
   /* Write the crc in a single operation */
160
0
   png_save_uint_32(buf, png_ptr->crc);
161
162
0
   png_write_data(png_ptr, buf, 4);
163
0
}
164
165
/* Write a PNG chunk all at once.  The type is an array of ASCII characters
166
 * representing the chunk name.  The array must be at least 4 bytes in
167
 * length, and does not need to be null terminated.  To be safe, pass the
168
 * pre-defined chunk names here, and if you need a new one, define it
169
 * where the others are defined.  The length is the length of the data.
170
 * All the data must be present.  If that is not possible, use the
171
 * png_write_chunk_start(), png_write_chunk_data(), and png_write_chunk_end()
172
 * functions instead.
173
 */
174
static void
175
png_write_complete_chunk(png_structrp png_ptr, png_uint_32 chunk_name,
176
    png_const_bytep data, size_t length)
177
0
{
178
0
   if (png_ptr == NULL)
179
0
      return;
180
181
   /* On 64-bit architectures 'length' may not fit in a png_uint_32. */
182
0
   if (length > PNG_UINT_31_MAX)
183
0
      png_error(png_ptr, "length exceeds PNG maximum");
184
185
0
   png_write_chunk_header(png_ptr, chunk_name, (png_uint_32)length);
186
0
   png_write_chunk_data(png_ptr, data, length);
187
0
   png_write_chunk_end(png_ptr);
188
0
}
189
190
/* This is the API that calls the internal function above. */
191
void PNGAPI
192
png_write_chunk(png_structrp png_ptr, png_const_bytep chunk_string,
193
    png_const_bytep data, size_t length)
194
0
{
195
0
   png_write_complete_chunk(png_ptr, PNG_CHUNK_FROM_STRING(chunk_string), data,
196
0
       length);
197
0
}
198
199
/* This is used below to find the size of an image to pass to png_deflate_claim,
200
 * so it only needs to be accurate if the size is less than 16384 bytes (the
201
 * point at which a lower LZ window size can be used.)
202
 */
203
static png_alloc_size_t
204
png_image_size(png_structrp png_ptr)
205
0
{
206
   /* Only return sizes up to the maximum of a png_uint_32; do this by limiting
207
    * the width and height used to 15 bits.
208
    */
209
0
   png_uint_32 h = png_ptr->height;
210
211
0
   if (png_ptr->rowbytes < 32768 && h < 32768)
212
0
   {
213
0
      if (png_ptr->interlaced != 0)
214
0
      {
215
         /* Interlacing makes the image larger because of the replication of
216
          * both the filter byte and the padding to a byte boundary.
217
          */
218
0
         png_uint_32 w = png_ptr->width;
219
0
         unsigned int pd = png_ptr->pixel_depth;
220
0
         png_alloc_size_t cb_base;
221
0
         int pass;
222
223
0
         for (cb_base=0, pass=0; pass<=6; ++pass)
224
0
         {
225
0
            png_uint_32 pw = PNG_PASS_COLS(w, pass);
226
227
0
            if (pw > 0)
228
0
               cb_base += (PNG_ROWBYTES(pd, pw)+1) * PNG_PASS_ROWS(h, pass);
229
0
         }
230
231
0
         return cb_base;
232
0
      }
233
234
0
      else
235
0
         return (png_ptr->rowbytes+1) * h;
236
0
   }
237
238
0
   else
239
0
      return 0xffffffffU;
240
0
}
241
242
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
243
   /* This is the code to hack the first two bytes of the deflate stream (the
244
    * deflate header) to correct the windowBits value to match the actual data
245
    * size.  Note that the second argument is the *uncompressed* size but the
246
    * first argument is the *compressed* data (and it must be deflate
247
    * compressed.)
248
    */
249
static void
250
optimize_cmf(png_bytep data, png_alloc_size_t data_size)
251
0
{
252
   /* Optimize the CMF field in the zlib stream.  The resultant zlib stream is
253
    * still compliant to the stream specification.
254
    */
255
0
   if (data_size <= 16384) /* else windowBits must be 15 */
256
0
   {
257
0
      unsigned int z_cmf = data[0];  /* zlib compression method and flags */
258
259
0
      if ((z_cmf & 0x0f) == 8 && (z_cmf & 0xf0) <= 0x70)
260
0
      {
261
0
         unsigned int z_cinfo;
262
0
         unsigned int half_z_window_size;
263
264
0
         z_cinfo = z_cmf >> 4;
265
0
         half_z_window_size = 1U << (z_cinfo + 7);
266
267
0
         if (data_size <= half_z_window_size) /* else no change */
268
0
         {
269
0
            unsigned int tmp;
270
271
0
            do
272
0
            {
273
0
               half_z_window_size >>= 1;
274
0
               --z_cinfo;
275
0
            }
276
0
            while (z_cinfo > 0 && data_size <= half_z_window_size);
277
278
0
            z_cmf = (z_cmf & 0x0f) | (z_cinfo << 4);
279
280
0
            data[0] = (png_byte)z_cmf;
281
0
            tmp = data[1] & 0xe0;
282
0
            tmp += 0x1f - ((z_cmf << 8) + tmp) % 0x1f;
283
0
            data[1] = (png_byte)tmp;
284
0
         }
285
0
      }
286
0
   }
287
0
}
288
#endif /* WRITE_OPTIMIZE_CMF */
289
290
/* Initialize the compressor for the appropriate type of compression. */
291
static int
292
png_deflate_claim(png_structrp png_ptr, png_uint_32 owner,
293
    png_alloc_size_t data_size)
294
0
{
295
0
   if (png_ptr->zowner != 0)
296
0
   {
297
0
#if defined(PNG_WARNINGS_SUPPORTED) || defined(PNG_ERROR_TEXT_SUPPORTED)
298
0
      char msg[64];
299
300
0
      PNG_STRING_FROM_CHUNK(msg, owner);
301
0
      msg[4] = ':';
302
0
      msg[5] = ' ';
303
0
      PNG_STRING_FROM_CHUNK(msg+6, png_ptr->zowner);
304
      /* So the message that results is "<chunk> using zstream"; this is an
305
       * internal error, but is very useful for debugging.  i18n requirements
306
       * are minimal.
307
       */
308
0
      (void)png_safecat(msg, (sizeof msg), 10, " using zstream");
309
0
#endif
310
0
#if PNG_RELEASE_BUILD
311
0
         png_warning(png_ptr, msg);
312
313
         /* Attempt sane error recovery */
314
0
         if (png_ptr->zowner == png_IDAT) /* don't steal from IDAT */
315
0
         {
316
0
            png_ptr->zstream.msg = PNGZ_MSG_CAST("in use by IDAT");
317
0
            return Z_STREAM_ERROR;
318
0
         }
319
320
0
         png_ptr->zowner = 0;
321
#else
322
         png_error(png_ptr, msg);
323
#endif
324
0
   }
325
326
0
   {
327
0
      int level = png_ptr->zlib_level;
328
0
      int method = png_ptr->zlib_method;
329
0
      int windowBits = png_ptr->zlib_window_bits;
330
0
      int memLevel = png_ptr->zlib_mem_level;
331
0
      int strategy; /* set below */
332
0
      int ret; /* zlib return code */
333
334
0
      if (owner == png_IDAT)
335
0
      {
336
0
         if ((png_ptr->flags & PNG_FLAG_ZLIB_CUSTOM_STRATEGY) != 0)
337
0
            strategy = png_ptr->zlib_strategy;
338
339
0
         else if (png_ptr->do_filter != PNG_FILTER_NONE)
340
0
            strategy = PNG_Z_DEFAULT_STRATEGY;
341
342
0
         else
343
0
            strategy = PNG_Z_DEFAULT_NOFILTER_STRATEGY;
344
0
      }
345
346
0
      else
347
0
      {
348
0
#ifdef PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED
349
0
            level = png_ptr->zlib_text_level;
350
0
            method = png_ptr->zlib_text_method;
351
0
            windowBits = png_ptr->zlib_text_window_bits;
352
0
            memLevel = png_ptr->zlib_text_mem_level;
353
0
            strategy = png_ptr->zlib_text_strategy;
354
#else
355
            /* If customization is not supported the values all come from the
356
             * IDAT values except for the strategy, which is fixed to the
357
             * default.  (This is the pre-1.6.0 behavior too, although it was
358
             * implemented in a very different way.)
359
             */
360
            strategy = Z_DEFAULT_STRATEGY;
361
#endif
362
0
      }
363
364
      /* Adjust 'windowBits' down if larger than 'data_size'; to stop this
365
       * happening just pass 32768 as the data_size parameter.  Notice that zlib
366
       * requires an extra 262 bytes in the window in addition to the data to be
367
       * able to see the whole of the data, so if data_size+262 takes us to the
368
       * next windowBits size we need to fix up the value later.  (Because even
369
       * though deflate needs the extra window, inflate does not!)
370
       */
371
0
      if (data_size <= 16384)
372
0
      {
373
         /* IMPLEMENTATION NOTE: this 'half_window_size' stuff is only here to
374
          * work round a Microsoft Visual C misbehavior which, contrary to C-90,
375
          * widens the result of the following shift to 64-bits if (and,
376
          * apparently, only if) it is used in a test.
377
          */
378
0
         unsigned int half_window_size = 1U << (windowBits-1);
379
380
0
         while (data_size + 262 <= half_window_size)
381
0
         {
382
0
            half_window_size >>= 1;
383
0
            --windowBits;
384
0
         }
385
0
      }
386
387
      /* Check against the previous initialized values, if any. */
388
0
      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0 &&
389
0
         (png_ptr->zlib_set_level != level ||
390
0
         png_ptr->zlib_set_method != method ||
391
0
         png_ptr->zlib_set_window_bits != windowBits ||
392
0
         png_ptr->zlib_set_mem_level != memLevel ||
393
0
         png_ptr->zlib_set_strategy != strategy))
394
0
      {
395
0
         if (deflateEnd(&png_ptr->zstream) != Z_OK)
396
0
            png_warning(png_ptr, "deflateEnd failed (ignored)");
397
398
0
         png_ptr->flags &= ~PNG_FLAG_ZSTREAM_INITIALIZED;
399
0
      }
400
401
      /* For safety clear out the input and output pointers (currently zlib
402
       * doesn't use them on Init, but it might in the future).
403
       */
404
0
      png_ptr->zstream.next_in = NULL;
405
0
      png_ptr->zstream.avail_in = 0;
406
0
      png_ptr->zstream.next_out = NULL;
407
0
      png_ptr->zstream.avail_out = 0;
408
409
      /* Now initialize if required, setting the new parameters, otherwise just
410
       * do a simple reset to the previous parameters.
411
       */
412
0
      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
413
0
         ret = deflateReset(&png_ptr->zstream);
414
415
0
      else
416
0
      {
417
0
         ret = deflateInit2(&png_ptr->zstream, level, method, windowBits,
418
0
             memLevel, strategy);
419
420
0
         if (ret == Z_OK)
421
0
            png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED;
422
0
      }
423
424
      /* The return code is from either deflateReset or deflateInit2; they have
425
       * pretty much the same set of error codes.
426
       */
427
0
      if (ret == Z_OK)
428
0
         png_ptr->zowner = owner;
429
430
0
      else
431
0
         png_zstream_error(png_ptr, ret);
432
433
0
      return ret;
434
0
   }
435
0
}
436
437
/* Clean up (or trim) a linked list of compression buffers. */
438
void /* PRIVATE */
439
png_free_buffer_list(png_structrp png_ptr, png_compression_bufferp *listp)
440
0
{
441
0
   png_compression_bufferp list = *listp;
442
443
0
   if (list != NULL)
444
0
   {
445
0
      *listp = NULL;
446
447
0
      do
448
0
      {
449
0
         png_compression_bufferp next = list->next;
450
451
0
         png_free(png_ptr, list);
452
0
         list = next;
453
0
      }
454
0
      while (list != NULL);
455
0
   }
456
0
}
457
458
#ifdef PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
459
/* This pair of functions encapsulates the operation of (a) compressing a
460
 * text string, and (b) issuing it later as a series of chunk data writes.
461
 * The compression_state structure is shared context for these functions
462
 * set up by the caller to allow access to the relevant local variables.
463
 *
464
 * compression_buffer (new in 1.6.0) is just a linked list of zbuffer_size
465
 * temporary buffers.  From 1.6.0 it is retained in png_struct so that it will
466
 * be correctly freed in the event of a write error (previous implementations
467
 * just leaked memory.)
468
 */
469
typedef struct
470
{
471
   png_const_bytep      input;        /* The uncompressed input data */
472
   png_alloc_size_t     input_len;    /* Its length */
473
   png_uint_32          output_len;   /* Final compressed length */
474
   png_byte             output[1024]; /* First block of output */
475
} compression_state;
476
477
static void
478
png_text_compress_init(compression_state *comp, png_const_bytep input,
479
    png_alloc_size_t input_len)
480
0
{
481
0
   comp->input = input;
482
0
   comp->input_len = input_len;
483
0
   comp->output_len = 0;
484
0
}
485
486
/* Compress the data in the compression state input */
487
static int
488
png_text_compress(png_structrp png_ptr, png_uint_32 chunk_name,
489
    compression_state *comp, png_uint_32 prefix_len)
490
0
{
491
0
   int ret;
492
493
   /* To find the length of the output it is necessary to first compress the
494
    * input. The result is buffered rather than using the two-pass algorithm
495
    * that is used on the inflate side; deflate is assumed to be slower and a
496
    * PNG writer is assumed to have more memory available than a PNG reader.
497
    *
498
    * IMPLEMENTATION NOTE: the zlib API deflateBound() can be used to find an
499
    * upper limit on the output size, but it is always bigger than the input
500
    * size so it is likely to be more efficient to use this linked-list
501
    * approach.
502
    */
503
0
   ret = png_deflate_claim(png_ptr, chunk_name, comp->input_len);
504
505
0
   if (ret != Z_OK)
506
0
      return ret;
507
508
   /* Set up the compression buffers, we need a loop here to avoid overflowing a
509
    * uInt.  Use ZLIB_IO_MAX to limit the input.  The output is always limited
510
    * by the output buffer size, so there is no need to check that.  Since this
511
    * is ANSI-C we know that an 'int', hence a uInt, is always at least 16 bits
512
    * in size.
513
    */
514
0
   {
515
0
      png_compression_bufferp *end = &png_ptr->zbuffer_list;
516
0
      png_alloc_size_t input_len = comp->input_len; /* may be zero! */
517
0
      png_uint_32 output_len;
518
519
      /* zlib updates these for us: */
520
0
      png_ptr->zstream.next_in = PNGZ_INPUT_CAST(comp->input);
521
0
      png_ptr->zstream.avail_in = 0; /* Set below */
522
0
      png_ptr->zstream.next_out = comp->output;
523
0
      png_ptr->zstream.avail_out = (sizeof comp->output);
524
525
0
      output_len = png_ptr->zstream.avail_out;
526
527
0
      do
528
0
      {
529
0
         uInt avail_in = ZLIB_IO_MAX;
530
531
0
         if (avail_in > input_len)
532
0
            avail_in = (uInt)input_len;
533
534
0
         input_len -= avail_in;
535
536
0
         png_ptr->zstream.avail_in = avail_in;
537
538
0
         if (png_ptr->zstream.avail_out == 0)
539
0
         {
540
0
            png_compression_buffer *next;
541
542
            /* Chunk data is limited to 2^31 bytes in length, so the prefix
543
             * length must be counted here.
544
             */
545
0
            if (output_len + prefix_len > PNG_UINT_31_MAX)
546
0
            {
547
0
               ret = Z_MEM_ERROR;
548
0
               break;
549
0
            }
550
551
            /* Need a new (malloc'ed) buffer, but there may be one present
552
             * already.
553
             */
554
0
            next = *end;
555
0
            if (next == NULL)
556
0
            {
557
0
               next = png_voidcast(png_compression_bufferp, png_malloc_base
558
0
                  (png_ptr, PNG_COMPRESSION_BUFFER_SIZE(png_ptr)));
559
560
0
               if (next == NULL)
561
0
               {
562
0
                  ret = Z_MEM_ERROR;
563
0
                  break;
564
0
               }
565
566
               /* Link in this buffer (so that it will be freed later) */
567
0
               next->next = NULL;
568
0
               *end = next;
569
0
            }
570
571
0
            png_ptr->zstream.next_out = next->output;
572
0
            png_ptr->zstream.avail_out = png_ptr->zbuffer_size;
573
0
            output_len += png_ptr->zstream.avail_out;
574
575
            /* Move 'end' to the next buffer pointer. */
576
0
            end = &next->next;
577
0
         }
578
579
         /* Compress the data */
580
0
         ret = deflate(&png_ptr->zstream,
581
0
             input_len > 0 ? Z_NO_FLUSH : Z_FINISH);
582
583
         /* Claw back input data that was not consumed (because avail_in is
584
          * reset above every time round the loop).
585
          */
586
0
         input_len += png_ptr->zstream.avail_in;
587
0
         png_ptr->zstream.avail_in = 0; /* safety */
588
0
      }
589
0
      while (ret == Z_OK);
590
591
      /* There may be some space left in the last output buffer. This needs to
592
       * be subtracted from output_len.
593
       */
594
0
      output_len -= png_ptr->zstream.avail_out;
595
0
      png_ptr->zstream.avail_out = 0; /* safety */
596
0
      comp->output_len = output_len;
597
598
      /* Now double check the output length, put in a custom message if it is
599
       * too long.  Otherwise ensure the z_stream::msg pointer is set to
600
       * something.
601
       */
602
0
      if (output_len + prefix_len >= PNG_UINT_31_MAX)
603
0
      {
604
0
         png_ptr->zstream.msg = PNGZ_MSG_CAST("compressed data too long");
605
0
         ret = Z_MEM_ERROR;
606
0
      }
607
608
0
      else
609
0
         png_zstream_error(png_ptr, ret);
610
611
      /* Reset zlib for another zTXt/iTXt or image data */
612
0
      png_ptr->zowner = 0;
613
614
      /* The only success case is Z_STREAM_END, input_len must be 0; if not this
615
       * is an internal error.
616
       */
617
0
      if (ret == Z_STREAM_END && input_len == 0)
618
0
      {
619
0
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
620
         /* Fix up the deflate header, if required */
621
0
         optimize_cmf(comp->output, comp->input_len);
622
0
#endif
623
         /* But Z_OK is returned, not Z_STREAM_END; this allows the claim
624
          * function above to return Z_STREAM_END on an error (though it never
625
          * does in the current versions of zlib.)
626
          */
627
0
         return Z_OK;
628
0
      }
629
630
0
      else
631
0
         return ret;
632
0
   }
633
0
}
634
635
/* Ship the compressed text out via chunk writes */
636
static void
637
png_write_compressed_data_out(png_structrp png_ptr, compression_state *comp)
638
0
{
639
0
   png_uint_32 output_len = comp->output_len;
640
0
   png_const_bytep output = comp->output;
641
0
   png_uint_32 avail = (sizeof comp->output);
642
0
   png_compression_buffer *next = png_ptr->zbuffer_list;
643
644
0
   for (;;)
645
0
   {
646
0
      if (avail > output_len)
647
0
         avail = output_len;
648
649
0
      png_write_chunk_data(png_ptr, output, avail);
650
651
0
      output_len -= avail;
652
653
0
      if (output_len == 0 || next == NULL)
654
0
         break;
655
656
0
      avail = png_ptr->zbuffer_size;
657
0
      output = next->output;
658
0
      next = next->next;
659
0
   }
660
661
   /* This is an internal error; 'next' must have been NULL! */
662
0
   if (output_len > 0)
663
0
      png_error(png_ptr, "error writing ancillary chunked compressed data");
664
0
}
665
#endif /* WRITE_COMPRESSED_TEXT */
666
667
/* Write the IHDR chunk, and update the png_struct with the necessary
668
 * information.  Note that the rest of this code depends upon this
669
 * information being correct.
670
 */
671
void /* PRIVATE */
672
png_write_IHDR(png_structrp png_ptr, png_uint_32 width, png_uint_32 height,
673
    int bit_depth, int color_type, int compression_type, int filter_type,
674
    int interlace_type)
675
0
{
676
0
   png_byte buf[13]; /* Buffer to store the IHDR info */
677
0
   int is_invalid_depth;
678
679
0
   png_debug(1, "in png_write_IHDR");
680
681
   /* Check that we have valid input data from the application info */
682
0
   switch (color_type)
683
0
   {
684
0
      case PNG_COLOR_TYPE_GRAY:
685
0
         switch (bit_depth)
686
0
         {
687
0
            case 1:
688
0
            case 2:
689
0
            case 4:
690
0
            case 8:
691
0
#ifdef PNG_WRITE_16BIT_SUPPORTED
692
0
            case 16:
693
0
#endif
694
0
               png_ptr->channels = 1; break;
695
696
0
            default:
697
0
               png_error(png_ptr,
698
0
                   "Invalid bit depth for grayscale image");
699
0
         }
700
0
         break;
701
702
0
      case PNG_COLOR_TYPE_RGB:
703
0
         is_invalid_depth = (bit_depth != 8);
704
0
#ifdef PNG_WRITE_16BIT_SUPPORTED
705
0
         is_invalid_depth = (is_invalid_depth && bit_depth != 16);
706
0
#endif
707
0
         if (is_invalid_depth)
708
0
            png_error(png_ptr, "Invalid bit depth for RGB image");
709
710
0
         png_ptr->channels = 3;
711
0
         break;
712
713
0
      case PNG_COLOR_TYPE_PALETTE:
714
0
         switch (bit_depth)
715
0
         {
716
0
            case 1:
717
0
            case 2:
718
0
            case 4:
719
0
            case 8:
720
0
               png_ptr->channels = 1;
721
0
               break;
722
723
0
            default:
724
0
               png_error(png_ptr, "Invalid bit depth for paletted image");
725
0
         }
726
0
         break;
727
728
0
      case PNG_COLOR_TYPE_GRAY_ALPHA:
729
0
         is_invalid_depth = (bit_depth != 8);
730
0
#ifdef PNG_WRITE_16BIT_SUPPORTED
731
0
         is_invalid_depth = (is_invalid_depth && bit_depth != 16);
732
0
#endif
733
0
         if (is_invalid_depth)
734
0
            png_error(png_ptr, "Invalid bit depth for grayscale+alpha image");
735
736
0
         png_ptr->channels = 2;
737
0
         break;
738
739
0
      case PNG_COLOR_TYPE_RGB_ALPHA:
740
0
         is_invalid_depth = (bit_depth != 8);
741
0
#ifdef PNG_WRITE_16BIT_SUPPORTED
742
0
         is_invalid_depth = (is_invalid_depth && bit_depth != 16);
743
0
#endif
744
0
         if (is_invalid_depth)
745
0
            png_error(png_ptr, "Invalid bit depth for RGBA image");
746
747
0
         png_ptr->channels = 4;
748
0
         break;
749
750
0
      default:
751
0
         png_error(png_ptr, "Invalid image color type specified");
752
0
   }
753
754
0
   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
755
0
   {
756
0
      png_warning(png_ptr, "Invalid compression type specified");
757
0
      compression_type = PNG_COMPRESSION_TYPE_BASE;
758
0
   }
759
760
   /* Write filter_method 64 (intrapixel differencing) only if
761
    * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
762
    * 2. Libpng did not write a PNG signature (this filter_method is only
763
    *    used in PNG datastreams that are embedded in MNG datastreams) and
764
    * 3. The application called png_permit_mng_features with a mask that
765
    *    included PNG_FLAG_MNG_FILTER_64 and
766
    * 4. The filter_method is 64 and
767
    * 5. The color_type is RGB or RGBA
768
    */
769
0
   if (
770
0
#ifdef PNG_MNG_FEATURES_SUPPORTED
771
0
       !((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) != 0 &&
772
0
       ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) == 0) &&
773
0
       (color_type == PNG_COLOR_TYPE_RGB ||
774
0
        color_type == PNG_COLOR_TYPE_RGB_ALPHA) &&
775
0
       (filter_type == PNG_INTRAPIXEL_DIFFERENCING)) &&
776
0
#endif
777
0
       filter_type != PNG_FILTER_TYPE_BASE)
778
0
   {
779
0
      png_warning(png_ptr, "Invalid filter type specified");
780
0
      filter_type = PNG_FILTER_TYPE_BASE;
781
0
   }
782
783
0
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
784
0
   if (interlace_type != PNG_INTERLACE_NONE &&
785
0
       interlace_type != PNG_INTERLACE_ADAM7)
786
0
   {
787
0
      png_warning(png_ptr, "Invalid interlace type specified");
788
0
      interlace_type = PNG_INTERLACE_ADAM7;
789
0
   }
790
#else
791
   interlace_type=PNG_INTERLACE_NONE;
792
#endif
793
794
   /* Save the relevant information */
795
0
   png_ptr->bit_depth = (png_byte)bit_depth;
796
0
   png_ptr->color_type = (png_byte)color_type;
797
0
   png_ptr->interlaced = (png_byte)interlace_type;
798
0
#ifdef PNG_MNG_FEATURES_SUPPORTED
799
0
   png_ptr->filter_type = (png_byte)filter_type;
800
0
#endif
801
0
   png_ptr->compression_type = (png_byte)compression_type;
802
0
   png_ptr->width = width;
803
0
   png_ptr->height = height;
804
805
0
   png_ptr->pixel_depth = (png_byte)(bit_depth * png_ptr->channels);
806
0
   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, width);
807
   /* Set the usr info, so any transformations can modify it */
808
0
   png_ptr->usr_width = png_ptr->width;
809
0
   png_ptr->usr_bit_depth = png_ptr->bit_depth;
810
0
   png_ptr->usr_channels = png_ptr->channels;
811
812
   /* Pack the header information into the buffer */
813
0
   png_save_uint_32(buf, width);
814
0
   png_save_uint_32(buf + 4, height);
815
0
   buf[8] = (png_byte)bit_depth;
816
0
   buf[9] = (png_byte)color_type;
817
0
   buf[10] = (png_byte)compression_type;
818
0
   buf[11] = (png_byte)filter_type;
819
0
   buf[12] = (png_byte)interlace_type;
820
821
   /* Write the chunk */
822
0
   png_write_complete_chunk(png_ptr, png_IHDR, buf, 13);
823
824
0
   if ((png_ptr->do_filter) == PNG_NO_FILTERS)
825
0
   {
826
0
      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE ||
827
0
          png_ptr->bit_depth < 8)
828
0
         png_ptr->do_filter = PNG_FILTER_NONE;
829
830
0
      else
831
0
         png_ptr->do_filter = PNG_ALL_FILTERS;
832
0
   }
833
834
0
   png_ptr->mode = PNG_HAVE_IHDR; /* not READY_FOR_ZTXT */
835
0
}
836
837
/* Write the palette.  We are careful not to trust png_color to be in the
838
 * correct order for PNG, so people can redefine it to any convenient
839
 * structure.
840
 */
841
void /* PRIVATE */
842
png_write_PLTE(png_structrp png_ptr, png_const_colorp palette,
843
    png_uint_32 num_pal)
844
0
{
845
0
   png_uint_32 max_palette_length, i;
846
0
   png_const_colorp pal_ptr;
847
0
   png_byte buf[3];
848
849
0
   png_debug(1, "in png_write_PLTE");
850
851
0
   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
852
0
      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
853
854
0
   if ((
855
0
#ifdef PNG_MNG_FEATURES_SUPPORTED
856
0
       (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0 &&
857
0
#endif
858
0
       num_pal == 0) || num_pal > max_palette_length)
859
0
   {
860
0
      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
861
0
      {
862
0
         png_error(png_ptr, "Invalid number of colors in palette");
863
0
      }
864
865
0
      else
866
0
      {
867
0
         png_warning(png_ptr, "Invalid number of colors in palette");
868
0
         return;
869
0
      }
870
0
   }
871
872
0
   if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
873
0
   {
874
0
      png_warning(png_ptr,
875
0
          "Ignoring request to write a PLTE chunk in grayscale PNG");
876
877
0
      return;
878
0
   }
879
880
0
   png_ptr->num_palette = (png_uint_16)num_pal;
881
0
   png_debug1(3, "num_palette = %d", png_ptr->num_palette);
882
883
0
   png_write_chunk_header(png_ptr, png_PLTE, (png_uint_32)(num_pal * 3));
884
0
#ifdef PNG_POINTER_INDEXING_SUPPORTED
885
886
0
   for (i = 0, pal_ptr = palette; i < num_pal; i++, pal_ptr++)
887
0
   {
888
0
      buf[0] = pal_ptr->red;
889
0
      buf[1] = pal_ptr->green;
890
0
      buf[2] = pal_ptr->blue;
891
0
      png_write_chunk_data(png_ptr, buf, 3);
892
0
   }
893
894
#else
895
   /* This is a little slower but some buggy compilers need to do this
896
    * instead
897
    */
898
   pal_ptr=palette;
899
900
   for (i = 0; i < num_pal; i++)
901
   {
902
      buf[0] = pal_ptr[i].red;
903
      buf[1] = pal_ptr[i].green;
904
      buf[2] = pal_ptr[i].blue;
905
      png_write_chunk_data(png_ptr, buf, 3);
906
   }
907
908
#endif
909
0
   png_write_chunk_end(png_ptr);
910
0
   png_ptr->mode |= PNG_HAVE_PLTE;
911
0
}
912
913
/* This is similar to png_text_compress, above, except that it does not require
914
 * all of the data at once and, instead of buffering the compressed result,
915
 * writes it as IDAT chunks.  Unlike png_text_compress it *can* png_error out
916
 * because it calls the write interface.  As a result it does its own error
917
 * reporting and does not return an error code.  In the event of error it will
918
 * just call png_error.  The input data length may exceed 32-bits.  The 'flush'
919
 * parameter is exactly the same as that to deflate, with the following
920
 * meanings:
921
 *
922
 * Z_NO_FLUSH: normal incremental output of compressed data
923
 * Z_SYNC_FLUSH: do a SYNC_FLUSH, used by png_write_flush
924
 * Z_FINISH: this is the end of the input, do a Z_FINISH and clean up
925
 *
926
 * The routine manages the acquire and release of the png_ptr->zstream by
927
 * checking and (at the end) clearing png_ptr->zowner; it does some sanity
928
 * checks on the 'mode' flags while doing this.
929
 */
930
void /* PRIVATE */
931
png_compress_IDAT(png_structrp png_ptr, png_const_bytep input,
932
    png_alloc_size_t input_len, int flush)
933
0
{
934
0
   if (png_ptr->zowner != png_IDAT)
935
0
   {
936
      /* First time.   Ensure we have a temporary buffer for compression and
937
       * trim the buffer list if it has more than one entry to free memory.
938
       * If 'WRITE_COMPRESSED_TEXT' is not set the list will never have been
939
       * created at this point, but the check here is quick and safe.
940
       */
941
0
      if (png_ptr->zbuffer_list == NULL)
942
0
      {
943
0
         png_ptr->zbuffer_list = png_voidcast(png_compression_bufferp,
944
0
             png_malloc(png_ptr, PNG_COMPRESSION_BUFFER_SIZE(png_ptr)));
945
0
         png_ptr->zbuffer_list->next = NULL;
946
0
      }
947
948
0
      else
949
0
         png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list->next);
950
951
      /* It is a terminal error if we can't claim the zstream. */
952
0
      if (png_deflate_claim(png_ptr, png_IDAT, png_image_size(png_ptr)) != Z_OK)
953
0
         png_error(png_ptr, png_ptr->zstream.msg);
954
955
      /* The output state is maintained in png_ptr->zstream, so it must be
956
       * initialized here after the claim.
957
       */
958
0
      png_ptr->zstream.next_out = png_ptr->zbuffer_list->output;
959
0
      png_ptr->zstream.avail_out = png_ptr->zbuffer_size;
960
0
   }
961
962
   /* Now loop reading and writing until all the input is consumed or an error
963
    * terminates the operation.  The _out values are maintained across calls to
964
    * this function, but the input must be reset each time.
965
    */
966
0
   png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input);
967
0
   png_ptr->zstream.avail_in = 0; /* set below */
968
0
   for (;;)
969
0
   {
970
0
      int ret;
971
972
      /* INPUT: from the row data */
973
0
      uInt avail = ZLIB_IO_MAX;
974
975
0
      if (avail > input_len)
976
0
         avail = (uInt)input_len; /* safe because of the check */
977
978
0
      png_ptr->zstream.avail_in = avail;
979
0
      input_len -= avail;
980
981
0
      ret = deflate(&png_ptr->zstream, input_len > 0 ? Z_NO_FLUSH : flush);
982
983
      /* Include as-yet unconsumed input */
984
0
      input_len += png_ptr->zstream.avail_in;
985
0
      png_ptr->zstream.avail_in = 0;
986
987
      /* OUTPUT: write complete IDAT chunks when avail_out drops to zero. Note
988
       * that these two zstream fields are preserved across the calls, therefore
989
       * there is no need to set these up on entry to the loop.
990
       */
991
0
      if (png_ptr->zstream.avail_out == 0)
992
0
      {
993
0
         png_bytep data = png_ptr->zbuffer_list->output;
994
0
         uInt size = png_ptr->zbuffer_size;
995
996
         /* Write an IDAT containing the data then reset the buffer.  The
997
          * first IDAT may need deflate header optimization.
998
          */
999
0
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
1000
0
            if ((png_ptr->mode & PNG_HAVE_IDAT) == 0 &&
1001
0
                png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE)
1002
0
               optimize_cmf(data, png_image_size(png_ptr));
1003
0
#endif
1004
1005
0
         if (size > 0)
1006
0
            png_write_complete_chunk(png_ptr, png_IDAT, data, size);
1007
0
         png_ptr->mode |= PNG_HAVE_IDAT;
1008
1009
0
         png_ptr->zstream.next_out = data;
1010
0
         png_ptr->zstream.avail_out = size;
1011
1012
         /* For SYNC_FLUSH or FINISH it is essential to keep calling zlib with
1013
          * the same flush parameter until it has finished output, for NO_FLUSH
1014
          * it doesn't matter.
1015
          */
1016
0
         if (ret == Z_OK && flush != Z_NO_FLUSH)
1017
0
            continue;
1018
0
      }
1019
1020
      /* The order of these checks doesn't matter much; it just affects which
1021
       * possible error might be detected if multiple things go wrong at once.
1022
       */
1023
0
      if (ret == Z_OK) /* most likely return code! */
1024
0
      {
1025
         /* If all the input has been consumed then just return.  If Z_FINISH
1026
          * was used as the flush parameter something has gone wrong if we get
1027
          * here.
1028
          */
1029
0
         if (input_len == 0)
1030
0
         {
1031
0
            if (flush == Z_FINISH)
1032
0
               png_error(png_ptr, "Z_OK on Z_FINISH with output space");
1033
1034
0
            return;
1035
0
         }
1036
0
      }
1037
1038
0
      else if (ret == Z_STREAM_END && flush == Z_FINISH)
1039
0
      {
1040
         /* This is the end of the IDAT data; any pending output must be
1041
          * flushed.  For small PNG files we may still be at the beginning.
1042
          */
1043
0
         png_bytep data = png_ptr->zbuffer_list->output;
1044
0
         uInt size = png_ptr->zbuffer_size - png_ptr->zstream.avail_out;
1045
1046
0
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
1047
0
         if ((png_ptr->mode & PNG_HAVE_IDAT) == 0 &&
1048
0
             png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE)
1049
0
            optimize_cmf(data, png_image_size(png_ptr));
1050
0
#endif
1051
1052
0
         if (size > 0)
1053
0
            png_write_complete_chunk(png_ptr, png_IDAT, data, size);
1054
0
         png_ptr->zstream.avail_out = 0;
1055
0
         png_ptr->zstream.next_out = NULL;
1056
0
         png_ptr->mode |= PNG_HAVE_IDAT | PNG_AFTER_IDAT;
1057
1058
0
         png_ptr->zowner = 0; /* Release the stream */
1059
0
         return;
1060
0
      }
1061
1062
0
      else
1063
0
      {
1064
         /* This is an error condition. */
1065
0
         png_zstream_error(png_ptr, ret);
1066
0
         png_error(png_ptr, png_ptr->zstream.msg);
1067
0
      }
1068
0
   }
1069
0
}
1070
1071
/* Write an IEND chunk */
1072
void /* PRIVATE */
1073
png_write_IEND(png_structrp png_ptr)
1074
0
{
1075
0
   png_debug(1, "in png_write_IEND");
1076
1077
0
   png_write_complete_chunk(png_ptr, png_IEND, NULL, 0);
1078
0
   png_ptr->mode |= PNG_HAVE_IEND;
1079
0
}
1080
1081
#ifdef PNG_WRITE_gAMA_SUPPORTED
1082
/* Write a gAMA chunk */
1083
void /* PRIVATE */
1084
png_write_gAMA_fixed(png_structrp png_ptr, png_fixed_point file_gamma)
1085
0
{
1086
0
   png_byte buf[4];
1087
1088
0
   png_debug(1, "in png_write_gAMA");
1089
1090
   /* file_gamma is saved in 1/100,000ths */
1091
0
   png_save_uint_32(buf, (png_uint_32)file_gamma);
1092
0
   png_write_complete_chunk(png_ptr, png_gAMA, buf, 4);
1093
0
}
1094
#endif
1095
1096
#ifdef PNG_WRITE_sRGB_SUPPORTED
1097
/* Write a sRGB chunk */
1098
void /* PRIVATE */
1099
png_write_sRGB(png_structrp png_ptr, int srgb_intent)
1100
0
{
1101
0
   png_byte buf[1];
1102
1103
0
   png_debug(1, "in png_write_sRGB");
1104
1105
0
   if (srgb_intent >= PNG_sRGB_INTENT_LAST)
1106
0
      png_warning(png_ptr,
1107
0
          "Invalid sRGB rendering intent specified");
1108
1109
0
   buf[0]=(png_byte)srgb_intent;
1110
0
   png_write_complete_chunk(png_ptr, png_sRGB, buf, 1);
1111
0
}
1112
#endif
1113
1114
#ifdef PNG_WRITE_iCCP_SUPPORTED
1115
/* Write an iCCP chunk */
1116
void /* PRIVATE */
1117
png_write_iCCP(png_structrp png_ptr, png_const_charp name,
1118
    png_const_bytep profile)
1119
0
{
1120
0
   png_uint_32 name_len;
1121
0
   png_uint_32 profile_len;
1122
0
   png_byte new_name[81]; /* 1 byte for the compression byte */
1123
0
   compression_state comp;
1124
0
   png_uint_32 temp;
1125
1126
0
   png_debug(1, "in png_write_iCCP");
1127
1128
   /* These are all internal problems: the profile should have been checked
1129
    * before when it was stored.
1130
    */
1131
0
   if (profile == NULL)
1132
0
      png_error(png_ptr, "No profile for iCCP chunk"); /* internal error */
1133
1134
0
   profile_len = png_get_uint_32(profile);
1135
1136
0
   if (profile_len < 132)
1137
0
      png_error(png_ptr, "ICC profile too short");
1138
1139
0
   temp = (png_uint_32) (*(profile+8));
1140
0
   if (temp > 3 && (profile_len & 0x03))
1141
0
      png_error(png_ptr, "ICC profile length invalid (not a multiple of 4)");
1142
1143
0
   {
1144
0
      png_uint_32 embedded_profile_len = png_get_uint_32(profile);
1145
1146
0
      if (profile_len != embedded_profile_len)
1147
0
         png_error(png_ptr, "Profile length does not match profile");
1148
0
   }
1149
1150
0
   name_len = png_check_keyword(png_ptr, name, new_name);
1151
1152
0
   if (name_len == 0)
1153
0
      png_error(png_ptr, "iCCP: invalid keyword");
1154
1155
0
   new_name[++name_len] = PNG_COMPRESSION_TYPE_BASE;
1156
1157
   /* Make sure we include the NULL after the name and the compression type */
1158
0
   ++name_len;
1159
1160
0
   png_text_compress_init(&comp, profile, profile_len);
1161
1162
   /* Allow for keyword terminator and compression byte */
1163
0
   if (png_text_compress(png_ptr, png_iCCP, &comp, name_len) != Z_OK)
1164
0
      png_error(png_ptr, png_ptr->zstream.msg);
1165
1166
0
   png_write_chunk_header(png_ptr, png_iCCP, name_len + comp.output_len);
1167
1168
0
   png_write_chunk_data(png_ptr, new_name, name_len);
1169
1170
0
   png_write_compressed_data_out(png_ptr, &comp);
1171
1172
0
   png_write_chunk_end(png_ptr);
1173
0
}
1174
#endif
1175
1176
#ifdef PNG_WRITE_sPLT_SUPPORTED
1177
/* Write a sPLT chunk */
1178
void /* PRIVATE */
1179
png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
1180
0
{
1181
0
   png_uint_32 name_len;
1182
0
   png_byte new_name[80];
1183
0
   png_byte entrybuf[10];
1184
0
   size_t entry_size = (spalette->depth == 8 ? 6 : 10);
1185
0
   size_t palette_size = entry_size * (size_t)spalette->nentries;
1186
0
   png_sPLT_entryp ep;
1187
#ifndef PNG_POINTER_INDEXING_SUPPORTED
1188
   int i;
1189
#endif
1190
1191
0
   png_debug(1, "in png_write_sPLT");
1192
1193
0
   name_len = png_check_keyword(png_ptr, spalette->name, new_name);
1194
1195
0
   if (name_len == 0)
1196
0
      png_error(png_ptr, "sPLT: invalid keyword");
1197
1198
   /* Make sure we include the NULL after the name */
1199
0
   png_write_chunk_header(png_ptr, png_sPLT,
1200
0
       (png_uint_32)(name_len + 2 + palette_size));
1201
1202
0
   png_write_chunk_data(png_ptr, (png_bytep)new_name, (size_t)(name_len + 1));
1203
1204
0
   png_write_chunk_data(png_ptr, &spalette->depth, 1);
1205
1206
   /* Loop through each palette entry, writing appropriately */
1207
0
#ifdef PNG_POINTER_INDEXING_SUPPORTED
1208
0
   for (ep = spalette->entries; ep<spalette->entries + spalette->nentries; ep++)
1209
0
   {
1210
0
      if (spalette->depth == 8)
1211
0
      {
1212
0
         entrybuf[0] = (png_byte)ep->red;
1213
0
         entrybuf[1] = (png_byte)ep->green;
1214
0
         entrybuf[2] = (png_byte)ep->blue;
1215
0
         entrybuf[3] = (png_byte)ep->alpha;
1216
0
         png_save_uint_16(entrybuf + 4, ep->frequency);
1217
0
      }
1218
1219
0
      else
1220
0
      {
1221
0
         png_save_uint_16(entrybuf + 0, ep->red);
1222
0
         png_save_uint_16(entrybuf + 2, ep->green);
1223
0
         png_save_uint_16(entrybuf + 4, ep->blue);
1224
0
         png_save_uint_16(entrybuf + 6, ep->alpha);
1225
0
         png_save_uint_16(entrybuf + 8, ep->frequency);
1226
0
      }
1227
1228
0
      png_write_chunk_data(png_ptr, entrybuf, entry_size);
1229
0
   }
1230
#else
1231
   ep=spalette->entries;
1232
   for (i = 0; i>spalette->nentries; i++)
1233
   {
1234
      if (spalette->depth == 8)
1235
      {
1236
         entrybuf[0] = (png_byte)ep[i].red;
1237
         entrybuf[1] = (png_byte)ep[i].green;
1238
         entrybuf[2] = (png_byte)ep[i].blue;
1239
         entrybuf[3] = (png_byte)ep[i].alpha;
1240
         png_save_uint_16(entrybuf + 4, ep[i].frequency);
1241
      }
1242
1243
      else
1244
      {
1245
         png_save_uint_16(entrybuf + 0, ep[i].red);
1246
         png_save_uint_16(entrybuf + 2, ep[i].green);
1247
         png_save_uint_16(entrybuf + 4, ep[i].blue);
1248
         png_save_uint_16(entrybuf + 6, ep[i].alpha);
1249
         png_save_uint_16(entrybuf + 8, ep[i].frequency);
1250
      }
1251
1252
      png_write_chunk_data(png_ptr, entrybuf, entry_size);
1253
   }
1254
#endif
1255
1256
0
   png_write_chunk_end(png_ptr);
1257
0
}
1258
#endif
1259
1260
#ifdef PNG_WRITE_sBIT_SUPPORTED
1261
/* Write the sBIT chunk */
1262
void /* PRIVATE */
1263
png_write_sBIT(png_structrp png_ptr, png_const_color_8p sbit, int color_type)
1264
0
{
1265
0
   png_byte buf[4];
1266
0
   size_t size;
1267
1268
0
   png_debug(1, "in png_write_sBIT");
1269
1270
   /* Make sure we don't depend upon the order of PNG_COLOR_8 */
1271
0
   if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
1272
0
   {
1273
0
      png_byte maxbits;
1274
1275
0
      maxbits = (png_byte)(color_type==PNG_COLOR_TYPE_PALETTE ? 8 :
1276
0
          png_ptr->usr_bit_depth);
1277
1278
0
      if (sbit->red == 0 || sbit->red > maxbits ||
1279
0
          sbit->green == 0 || sbit->green > maxbits ||
1280
0
          sbit->blue == 0 || sbit->blue > maxbits)
1281
0
      {
1282
0
         png_warning(png_ptr, "Invalid sBIT depth specified");
1283
0
         return;
1284
0
      }
1285
1286
0
      buf[0] = sbit->red;
1287
0
      buf[1] = sbit->green;
1288
0
      buf[2] = sbit->blue;
1289
0
      size = 3;
1290
0
   }
1291
1292
0
   else
1293
0
   {
1294
0
      if (sbit->gray == 0 || sbit->gray > png_ptr->usr_bit_depth)
1295
0
      {
1296
0
         png_warning(png_ptr, "Invalid sBIT depth specified");
1297
0
         return;
1298
0
      }
1299
1300
0
      buf[0] = sbit->gray;
1301
0
      size = 1;
1302
0
   }
1303
1304
0
   if ((color_type & PNG_COLOR_MASK_ALPHA) != 0)
1305
0
   {
1306
0
      if (sbit->alpha == 0 || sbit->alpha > png_ptr->usr_bit_depth)
1307
0
      {
1308
0
         png_warning(png_ptr, "Invalid sBIT depth specified");
1309
0
         return;
1310
0
      }
1311
1312
0
      buf[size++] = sbit->alpha;
1313
0
   }
1314
1315
0
   png_write_complete_chunk(png_ptr, png_sBIT, buf, size);
1316
0
}
1317
#endif
1318
1319
#ifdef PNG_WRITE_cHRM_SUPPORTED
1320
/* Write the cHRM chunk */
1321
void /* PRIVATE */
1322
png_write_cHRM_fixed(png_structrp png_ptr, const png_xy *xy)
1323
0
{
1324
0
   png_byte buf[32];
1325
1326
0
   png_debug(1, "in png_write_cHRM");
1327
1328
   /* Each value is saved in 1/100,000ths */
1329
0
   png_save_int_32(buf,      xy->whitex);
1330
0
   png_save_int_32(buf +  4, xy->whitey);
1331
1332
0
   png_save_int_32(buf +  8, xy->redx);
1333
0
   png_save_int_32(buf + 12, xy->redy);
1334
1335
0
   png_save_int_32(buf + 16, xy->greenx);
1336
0
   png_save_int_32(buf + 20, xy->greeny);
1337
1338
0
   png_save_int_32(buf + 24, xy->bluex);
1339
0
   png_save_int_32(buf + 28, xy->bluey);
1340
1341
0
   png_write_complete_chunk(png_ptr, png_cHRM, buf, 32);
1342
0
}
1343
#endif
1344
1345
#ifdef PNG_WRITE_tRNS_SUPPORTED
1346
/* Write the tRNS chunk */
1347
void /* PRIVATE */
1348
png_write_tRNS(png_structrp png_ptr, png_const_bytep trans_alpha,
1349
    png_const_color_16p tran, int num_trans, int color_type)
1350
0
{
1351
0
   png_byte buf[6];
1352
1353
0
   png_debug(1, "in png_write_tRNS");
1354
1355
0
   if (color_type == PNG_COLOR_TYPE_PALETTE)
1356
0
   {
1357
0
      if (num_trans <= 0 || num_trans > (int)png_ptr->num_palette)
1358
0
      {
1359
0
         png_app_warning(png_ptr,
1360
0
             "Invalid number of transparent colors specified");
1361
0
         return;
1362
0
      }
1363
1364
      /* Write the chunk out as it is */
1365
0
      png_write_complete_chunk(png_ptr, png_tRNS, trans_alpha,
1366
0
          (size_t)num_trans);
1367
0
   }
1368
1369
0
   else if (color_type == PNG_COLOR_TYPE_GRAY)
1370
0
   {
1371
      /* One 16-bit value */
1372
0
      if (tran->gray >= (1 << png_ptr->bit_depth))
1373
0
      {
1374
0
         png_app_warning(png_ptr,
1375
0
             "Ignoring attempt to write tRNS chunk out-of-range for bit_depth");
1376
1377
0
         return;
1378
0
      }
1379
1380
0
      png_save_uint_16(buf, tran->gray);
1381
0
      png_write_complete_chunk(png_ptr, png_tRNS, buf, 2);
1382
0
   }
1383
1384
0
   else if (color_type == PNG_COLOR_TYPE_RGB)
1385
0
   {
1386
      /* Three 16-bit values */
1387
0
      png_save_uint_16(buf, tran->red);
1388
0
      png_save_uint_16(buf + 2, tran->green);
1389
0
      png_save_uint_16(buf + 4, tran->blue);
1390
0
#ifdef PNG_WRITE_16BIT_SUPPORTED
1391
0
      if (png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]) != 0)
1392
#else
1393
      if ((buf[0] | buf[2] | buf[4]) != 0)
1394
#endif
1395
0
      {
1396
0
         png_app_warning(png_ptr,
1397
0
             "Ignoring attempt to write 16-bit tRNS chunk when bit_depth is 8");
1398
0
         return;
1399
0
      }
1400
1401
0
      png_write_complete_chunk(png_ptr, png_tRNS, buf, 6);
1402
0
   }
1403
1404
0
   else
1405
0
   {
1406
0
      png_app_warning(png_ptr, "Can't write tRNS with an alpha channel");
1407
0
   }
1408
0
}
1409
#endif
1410
1411
#ifdef PNG_WRITE_bKGD_SUPPORTED
1412
/* Write the background chunk */
1413
void /* PRIVATE */
1414
png_write_bKGD(png_structrp png_ptr, png_const_color_16p back, int color_type)
1415
0
{
1416
0
   png_byte buf[6];
1417
1418
0
   png_debug(1, "in png_write_bKGD");
1419
1420
0
   if (color_type == PNG_COLOR_TYPE_PALETTE)
1421
0
   {
1422
0
      if (
1423
0
#ifdef PNG_MNG_FEATURES_SUPPORTED
1424
0
          (png_ptr->num_palette != 0 ||
1425
0
          (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0) &&
1426
0
#endif
1427
0
         back->index >= png_ptr->num_palette)
1428
0
      {
1429
0
         png_warning(png_ptr, "Invalid background palette index");
1430
0
         return;
1431
0
      }
1432
1433
0
      buf[0] = back->index;
1434
0
      png_write_complete_chunk(png_ptr, png_bKGD, buf, 1);
1435
0
   }
1436
1437
0
   else if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
1438
0
   {
1439
0
      png_save_uint_16(buf, back->red);
1440
0
      png_save_uint_16(buf + 2, back->green);
1441
0
      png_save_uint_16(buf + 4, back->blue);
1442
0
#ifdef PNG_WRITE_16BIT_SUPPORTED
1443
0
      if (png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]) != 0)
1444
#else
1445
      if ((buf[0] | buf[2] | buf[4]) != 0)
1446
#endif
1447
0
      {
1448
0
         png_warning(png_ptr,
1449
0
             "Ignoring attempt to write 16-bit bKGD chunk "
1450
0
             "when bit_depth is 8");
1451
1452
0
         return;
1453
0
      }
1454
1455
0
      png_write_complete_chunk(png_ptr, png_bKGD, buf, 6);
1456
0
   }
1457
1458
0
   else
1459
0
   {
1460
0
      if (back->gray >= (1 << png_ptr->bit_depth))
1461
0
      {
1462
0
         png_warning(png_ptr,
1463
0
             "Ignoring attempt to write bKGD chunk out-of-range for bit_depth");
1464
1465
0
         return;
1466
0
      }
1467
1468
0
      png_save_uint_16(buf, back->gray);
1469
0
      png_write_complete_chunk(png_ptr, png_bKGD, buf, 2);
1470
0
   }
1471
0
}
1472
#endif
1473
1474
#ifdef PNG_WRITE_eXIf_SUPPORTED
1475
/* Write the Exif data */
1476
void /* PRIVATE */
1477
png_write_eXIf(png_structrp png_ptr, png_bytep exif, int num_exif)
1478
0
{
1479
0
   int i;
1480
0
   png_byte buf[1];
1481
1482
0
   png_debug(1, "in png_write_eXIf");
1483
1484
0
   png_write_chunk_header(png_ptr, png_eXIf, (png_uint_32)(num_exif));
1485
1486
0
   for (i = 0; i < num_exif; i++)
1487
0
   {
1488
0
      buf[0] = exif[i];
1489
0
      png_write_chunk_data(png_ptr, buf, 1);
1490
0
   }
1491
1492
0
   png_write_chunk_end(png_ptr);
1493
0
}
1494
#endif
1495
1496
#ifdef PNG_WRITE_hIST_SUPPORTED
1497
/* Write the histogram */
1498
void /* PRIVATE */
1499
png_write_hIST(png_structrp png_ptr, png_const_uint_16p hist, int num_hist)
1500
0
{
1501
0
   int i;
1502
0
   png_byte buf[3];
1503
1504
0
   png_debug(1, "in png_write_hIST");
1505
1506
0
   if (num_hist > (int)png_ptr->num_palette)
1507
0
   {
1508
0
      png_debug2(3, "num_hist = %d, num_palette = %d", num_hist,
1509
0
          png_ptr->num_palette);
1510
1511
0
      png_warning(png_ptr, "Invalid number of histogram entries specified");
1512
0
      return;
1513
0
   }
1514
1515
0
   png_write_chunk_header(png_ptr, png_hIST, (png_uint_32)(num_hist * 2));
1516
1517
0
   for (i = 0; i < num_hist; i++)
1518
0
   {
1519
0
      png_save_uint_16(buf, hist[i]);
1520
0
      png_write_chunk_data(png_ptr, buf, 2);
1521
0
   }
1522
1523
0
   png_write_chunk_end(png_ptr);
1524
0
}
1525
#endif
1526
1527
#ifdef PNG_WRITE_tEXt_SUPPORTED
1528
/* Write a tEXt chunk */
1529
void /* PRIVATE */
1530
png_write_tEXt(png_structrp png_ptr, png_const_charp key, png_const_charp text,
1531
    size_t text_len)
1532
0
{
1533
0
   png_uint_32 key_len;
1534
0
   png_byte new_key[80];
1535
1536
0
   png_debug(1, "in png_write_tEXt");
1537
1538
0
   key_len = png_check_keyword(png_ptr, key, new_key);
1539
1540
0
   if (key_len == 0)
1541
0
      png_error(png_ptr, "tEXt: invalid keyword");
1542
1543
0
   if (text == NULL || *text == '\0')
1544
0
      text_len = 0;
1545
1546
0
   else
1547
0
      text_len = strlen(text);
1548
1549
0
   if (text_len > PNG_UINT_31_MAX - (key_len+1))
1550
0
      png_error(png_ptr, "tEXt: text too long");
1551
1552
   /* Make sure we include the 0 after the key */
1553
0
   png_write_chunk_header(png_ptr, png_tEXt,
1554
0
       (png_uint_32)/*checked above*/(key_len + text_len + 1));
1555
   /*
1556
    * We leave it to the application to meet PNG-1.0 requirements on the
1557
    * contents of the text.  PNG-1.0 through PNG-1.2 discourage the use of
1558
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG will forbid them.
1559
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
1560
    */
1561
0
   png_write_chunk_data(png_ptr, new_key, key_len + 1);
1562
1563
0
   if (text_len != 0)
1564
0
      png_write_chunk_data(png_ptr, (png_const_bytep)text, text_len);
1565
1566
0
   png_write_chunk_end(png_ptr);
1567
0
}
1568
#endif
1569
1570
#ifdef PNG_WRITE_zTXt_SUPPORTED
1571
/* Write a compressed text chunk */
1572
void /* PRIVATE */
1573
png_write_zTXt(png_structrp png_ptr, png_const_charp key, png_const_charp text,
1574
    int compression)
1575
0
{
1576
0
   png_uint_32 key_len;
1577
0
   png_byte new_key[81];
1578
0
   compression_state comp;
1579
1580
0
   png_debug(1, "in png_write_zTXt");
1581
1582
0
   if (compression == PNG_TEXT_COMPRESSION_NONE)
1583
0
   {
1584
0
      png_write_tEXt(png_ptr, key, text, 0);
1585
0
      return;
1586
0
   }
1587
1588
0
   if (compression != PNG_TEXT_COMPRESSION_zTXt)
1589
0
      png_error(png_ptr, "zTXt: invalid compression type");
1590
1591
0
   key_len = png_check_keyword(png_ptr, key, new_key);
1592
1593
0
   if (key_len == 0)
1594
0
      png_error(png_ptr, "zTXt: invalid keyword");
1595
1596
   /* Add the compression method and 1 for the keyword separator. */
1597
0
   new_key[++key_len] = PNG_COMPRESSION_TYPE_BASE;
1598
0
   ++key_len;
1599
1600
   /* Compute the compressed data; do it now for the length */
1601
0
   png_text_compress_init(&comp, (png_const_bytep)text,
1602
0
       text == NULL ? 0 : strlen(text));
1603
1604
0
   if (png_text_compress(png_ptr, png_zTXt, &comp, key_len) != Z_OK)
1605
0
      png_error(png_ptr, png_ptr->zstream.msg);
1606
1607
   /* Write start of chunk */
1608
0
   png_write_chunk_header(png_ptr, png_zTXt, key_len + comp.output_len);
1609
1610
   /* Write key */
1611
0
   png_write_chunk_data(png_ptr, new_key, key_len);
1612
1613
   /* Write the compressed data */
1614
0
   png_write_compressed_data_out(png_ptr, &comp);
1615
1616
   /* Close the chunk */
1617
0
   png_write_chunk_end(png_ptr);
1618
0
}
1619
#endif
1620
1621
#ifdef PNG_WRITE_iTXt_SUPPORTED
1622
/* Write an iTXt chunk */
1623
void /* PRIVATE */
1624
png_write_iTXt(png_structrp png_ptr, int compression, png_const_charp key,
1625
    png_const_charp lang, png_const_charp lang_key, png_const_charp text)
1626
0
{
1627
0
   png_uint_32 key_len, prefix_len;
1628
0
   size_t lang_len, lang_key_len;
1629
0
   png_byte new_key[82];
1630
0
   compression_state comp;
1631
1632
0
   png_debug(1, "in png_write_iTXt");
1633
1634
0
   key_len = png_check_keyword(png_ptr, key, new_key);
1635
1636
0
   if (key_len == 0)
1637
0
      png_error(png_ptr, "iTXt: invalid keyword");
1638
1639
   /* Set the compression flag */
1640
0
   switch (compression)
1641
0
   {
1642
0
      case PNG_ITXT_COMPRESSION_NONE:
1643
0
      case PNG_TEXT_COMPRESSION_NONE:
1644
0
         compression = new_key[++key_len] = 0; /* no compression */
1645
0
         break;
1646
1647
0
      case PNG_TEXT_COMPRESSION_zTXt:
1648
0
      case PNG_ITXT_COMPRESSION_zTXt:
1649
0
         compression = new_key[++key_len] = 1; /* compressed */
1650
0
         break;
1651
1652
0
      default:
1653
0
         png_error(png_ptr, "iTXt: invalid compression");
1654
0
   }
1655
1656
0
   new_key[++key_len] = PNG_COMPRESSION_TYPE_BASE;
1657
0
   ++key_len; /* for the keywod separator */
1658
1659
   /* We leave it to the application to meet PNG-1.0 requirements on the
1660
    * contents of the text.  PNG-1.0 through PNG-1.2 discourage the use of
1661
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG, however,
1662
    * specifies that the text is UTF-8 and this really doesn't require any
1663
    * checking.
1664
    *
1665
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
1666
    *
1667
    * TODO: validate the language tag correctly (see the spec.)
1668
    */
1669
0
   if (lang == NULL) lang = ""; /* empty language is valid */
1670
0
   lang_len = strlen(lang)+1;
1671
0
   if (lang_key == NULL) lang_key = ""; /* may be empty */
1672
0
   lang_key_len = strlen(lang_key)+1;
1673
0
   if (text == NULL) text = ""; /* may be empty */
1674
1675
0
   prefix_len = key_len;
1676
0
   if (lang_len > PNG_UINT_31_MAX-prefix_len)
1677
0
      prefix_len = PNG_UINT_31_MAX;
1678
0
   else
1679
0
      prefix_len = (png_uint_32)(prefix_len + lang_len);
1680
1681
0
   if (lang_key_len > PNG_UINT_31_MAX-prefix_len)
1682
0
      prefix_len = PNG_UINT_31_MAX;
1683
0
   else
1684
0
      prefix_len = (png_uint_32)(prefix_len + lang_key_len);
1685
1686
0
   png_text_compress_init(&comp, (png_const_bytep)text, strlen(text));
1687
1688
0
   if (compression != 0)
1689
0
   {
1690
0
      if (png_text_compress(png_ptr, png_iTXt, &comp, prefix_len) != Z_OK)
1691
0
         png_error(png_ptr, png_ptr->zstream.msg);
1692
0
   }
1693
1694
0
   else
1695
0
   {
1696
0
      if (comp.input_len > PNG_UINT_31_MAX-prefix_len)
1697
0
         png_error(png_ptr, "iTXt: uncompressed text too long");
1698
1699
      /* So the string will fit in a chunk: */
1700
0
      comp.output_len = (png_uint_32)/*SAFE*/comp.input_len;
1701
0
   }
1702
1703
0
   png_write_chunk_header(png_ptr, png_iTXt, comp.output_len + prefix_len);
1704
1705
0
   png_write_chunk_data(png_ptr, new_key, key_len);
1706
1707
0
   png_write_chunk_data(png_ptr, (png_const_bytep)lang, lang_len);
1708
1709
0
   png_write_chunk_data(png_ptr, (png_const_bytep)lang_key, lang_key_len);
1710
1711
0
   if (compression != 0)
1712
0
      png_write_compressed_data_out(png_ptr, &comp);
1713
1714
0
   else
1715
0
      png_write_chunk_data(png_ptr, (png_const_bytep)text, comp.output_len);
1716
1717
0
   png_write_chunk_end(png_ptr);
1718
0
}
1719
#endif
1720
1721
#ifdef PNG_WRITE_oFFs_SUPPORTED
1722
/* Write the oFFs chunk */
1723
void /* PRIVATE */
1724
png_write_oFFs(png_structrp png_ptr, png_int_32 x_offset, png_int_32 y_offset,
1725
    int unit_type)
1726
0
{
1727
0
   png_byte buf[9];
1728
1729
0
   png_debug(1, "in png_write_oFFs");
1730
1731
0
   if (unit_type >= PNG_OFFSET_LAST)
1732
0
      png_warning(png_ptr, "Unrecognized unit type for oFFs chunk");
1733
1734
0
   png_save_int_32(buf, x_offset);
1735
0
   png_save_int_32(buf + 4, y_offset);
1736
0
   buf[8] = (png_byte)unit_type;
1737
1738
0
   png_write_complete_chunk(png_ptr, png_oFFs, buf, 9);
1739
0
}
1740
#endif
1741
#ifdef PNG_WRITE_pCAL_SUPPORTED
1742
/* Write the pCAL chunk (described in the PNG extensions document) */
1743
void /* PRIVATE */
1744
png_write_pCAL(png_structrp png_ptr, png_charp purpose, png_int_32 X0,
1745
    png_int_32 X1, int type, int nparams, png_const_charp units,
1746
    png_charpp params)
1747
0
{
1748
0
   png_uint_32 purpose_len;
1749
0
   size_t units_len, total_len;
1750
0
   png_size_tp params_len;
1751
0
   png_byte buf[10];
1752
0
   png_byte new_purpose[80];
1753
0
   int i;
1754
1755
0
   png_debug1(1, "in png_write_pCAL (%d parameters)", nparams);
1756
1757
0
   if (type >= PNG_EQUATION_LAST)
1758
0
      png_error(png_ptr, "Unrecognized equation type for pCAL chunk");
1759
1760
0
   purpose_len = png_check_keyword(png_ptr, purpose, new_purpose);
1761
1762
0
   if (purpose_len == 0)
1763
0
      png_error(png_ptr, "pCAL: invalid keyword");
1764
1765
0
   ++purpose_len; /* terminator */
1766
1767
0
   png_debug1(3, "pCAL purpose length = %d", (int)purpose_len);
1768
0
   units_len = strlen(units) + (nparams == 0 ? 0 : 1);
1769
0
   png_debug1(3, "pCAL units length = %d", (int)units_len);
1770
0
   total_len = purpose_len + units_len + 10;
1771
1772
0
   params_len = (png_size_tp)png_malloc(png_ptr,
1773
0
       (png_alloc_size_t)((png_alloc_size_t)nparams * (sizeof (size_t))));
1774
1775
   /* Find the length of each parameter, making sure we don't count the
1776
    * null terminator for the last parameter.
1777
    */
1778
0
   for (i = 0; i < nparams; i++)
1779
0
   {
1780
0
      params_len[i] = strlen(params[i]) + (i == nparams - 1 ? 0 : 1);
1781
0
      png_debug2(3, "pCAL parameter %d length = %lu", i,
1782
0
          (unsigned long)params_len[i]);
1783
0
      total_len += params_len[i];
1784
0
   }
1785
1786
0
   png_debug1(3, "pCAL total length = %d", (int)total_len);
1787
0
   png_write_chunk_header(png_ptr, png_pCAL, (png_uint_32)total_len);
1788
0
   png_write_chunk_data(png_ptr, new_purpose, purpose_len);
1789
0
   png_save_int_32(buf, X0);
1790
0
   png_save_int_32(buf + 4, X1);
1791
0
   buf[8] = (png_byte)type;
1792
0
   buf[9] = (png_byte)nparams;
1793
0
   png_write_chunk_data(png_ptr, buf, 10);
1794
0
   png_write_chunk_data(png_ptr, (png_const_bytep)units, (size_t)units_len);
1795
1796
0
   for (i = 0; i < nparams; i++)
1797
0
   {
1798
0
      png_write_chunk_data(png_ptr, (png_const_bytep)params[i], params_len[i]);
1799
0
   }
1800
1801
0
   png_free(png_ptr, params_len);
1802
0
   png_write_chunk_end(png_ptr);
1803
0
}
1804
#endif
1805
1806
#ifdef PNG_WRITE_sCAL_SUPPORTED
1807
/* Write the sCAL chunk */
1808
void /* PRIVATE */
1809
png_write_sCAL_s(png_structrp png_ptr, int unit, png_const_charp width,
1810
    png_const_charp height)
1811
0
{
1812
0
   png_byte buf[64];
1813
0
   size_t wlen, hlen, total_len;
1814
1815
0
   png_debug(1, "in png_write_sCAL_s");
1816
1817
0
   wlen = strlen(width);
1818
0
   hlen = strlen(height);
1819
0
   total_len = wlen + hlen + 2;
1820
1821
0
   if (total_len > 64)
1822
0
   {
1823
0
      png_warning(png_ptr, "Can't write sCAL (buffer too small)");
1824
0
      return;
1825
0
   }
1826
1827
0
   buf[0] = (png_byte)unit;
1828
0
   memcpy(buf + 1, width, wlen + 1);      /* Append the '\0' here */
1829
0
   memcpy(buf + wlen + 2, height, hlen);  /* Do NOT append the '\0' here */
1830
1831
0
   png_debug1(3, "sCAL total length = %u", (unsigned int)total_len);
1832
0
   png_write_complete_chunk(png_ptr, png_sCAL, buf, total_len);
1833
0
}
1834
#endif
1835
1836
#ifdef PNG_WRITE_pHYs_SUPPORTED
1837
/* Write the pHYs chunk */
1838
void /* PRIVATE */
1839
png_write_pHYs(png_structrp png_ptr, png_uint_32 x_pixels_per_unit,
1840
    png_uint_32 y_pixels_per_unit,
1841
    int unit_type)
1842
0
{
1843
0
   png_byte buf[9];
1844
1845
0
   png_debug(1, "in png_write_pHYs");
1846
1847
0
   if (unit_type >= PNG_RESOLUTION_LAST)
1848
0
      png_warning(png_ptr, "Unrecognized unit type for pHYs chunk");
1849
1850
0
   png_save_uint_32(buf, x_pixels_per_unit);
1851
0
   png_save_uint_32(buf + 4, y_pixels_per_unit);
1852
0
   buf[8] = (png_byte)unit_type;
1853
1854
0
   png_write_complete_chunk(png_ptr, png_pHYs, buf, 9);
1855
0
}
1856
#endif
1857
1858
#ifdef PNG_WRITE_tIME_SUPPORTED
1859
/* Write the tIME chunk.  Use either png_convert_from_struct_tm()
1860
 * or png_convert_from_time_t(), or fill in the structure yourself.
1861
 */
1862
void /* PRIVATE */
1863
png_write_tIME(png_structrp png_ptr, png_const_timep mod_time)
1864
0
{
1865
0
   png_byte buf[7];
1866
1867
0
   png_debug(1, "in png_write_tIME");
1868
1869
0
   if (mod_time->month  > 12 || mod_time->month  < 1 ||
1870
0
       mod_time->day    > 31 || mod_time->day    < 1 ||
1871
0
       mod_time->hour   > 23 || mod_time->second > 60)
1872
0
   {
1873
0
      png_warning(png_ptr, "Invalid time specified for tIME chunk");
1874
0
      return;
1875
0
   }
1876
1877
0
   png_save_uint_16(buf, mod_time->year);
1878
0
   buf[2] = mod_time->month;
1879
0
   buf[3] = mod_time->day;
1880
0
   buf[4] = mod_time->hour;
1881
0
   buf[5] = mod_time->minute;
1882
0
   buf[6] = mod_time->second;
1883
1884
0
   png_write_complete_chunk(png_ptr, png_tIME, buf, 7);
1885
0
}
1886
#endif
1887
1888
/* Initializes the row writing capability of libpng */
1889
void /* PRIVATE */
1890
png_write_start_row(png_structrp png_ptr)
1891
0
{
1892
0
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
1893
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
1894
1895
   /* Start of interlace block */
1896
0
   static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
1897
1898
   /* Offset to next interlace block */
1899
0
   static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
1900
1901
   /* Start of interlace block in the y direction */
1902
0
   static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
1903
1904
   /* Offset to next interlace block in the y direction */
1905
0
   static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
1906
0
#endif
1907
1908
0
   png_alloc_size_t buf_size;
1909
0
   int usr_pixel_depth;
1910
1911
0
#ifdef PNG_WRITE_FILTER_SUPPORTED
1912
0
   png_byte filters;
1913
0
#endif
1914
1915
0
   png_debug(1, "in png_write_start_row");
1916
1917
0
   usr_pixel_depth = png_ptr->usr_channels * png_ptr->usr_bit_depth;
1918
0
   buf_size = PNG_ROWBYTES(usr_pixel_depth, png_ptr->width) + 1;
1919
1920
   /* 1.5.6: added to allow checking in the row write code. */
1921
0
   png_ptr->transformed_pixel_depth = png_ptr->pixel_depth;
1922
0
   png_ptr->maximum_pixel_depth = (png_byte)usr_pixel_depth;
1923
1924
   /* Set up row buffer */
1925
0
   png_ptr->row_buf = png_voidcast(png_bytep, png_malloc(png_ptr, buf_size));
1926
1927
0
   png_ptr->row_buf[0] = PNG_FILTER_VALUE_NONE;
1928
1929
0
#ifdef PNG_WRITE_FILTER_SUPPORTED
1930
0
   filters = png_ptr->do_filter;
1931
1932
0
   if (png_ptr->height == 1)
1933
0
      filters &= 0xff & ~(PNG_FILTER_UP|PNG_FILTER_AVG|PNG_FILTER_PAETH);
1934
1935
0
   if (png_ptr->width == 1)
1936
0
      filters &= 0xff & ~(PNG_FILTER_SUB|PNG_FILTER_AVG|PNG_FILTER_PAETH);
1937
1938
0
   if (filters == 0)
1939
0
      filters = PNG_FILTER_NONE;
1940
1941
0
   png_ptr->do_filter = filters;
1942
1943
0
   if (((filters & (PNG_FILTER_SUB | PNG_FILTER_UP | PNG_FILTER_AVG |
1944
0
       PNG_FILTER_PAETH)) != 0) && png_ptr->try_row == NULL)
1945
0
   {
1946
0
      int num_filters = 0;
1947
1948
0
      png_ptr->try_row = png_voidcast(png_bytep, png_malloc(png_ptr, buf_size));
1949
1950
0
      if (filters & PNG_FILTER_SUB)
1951
0
         num_filters++;
1952
1953
0
      if (filters & PNG_FILTER_UP)
1954
0
         num_filters++;
1955
1956
0
      if (filters & PNG_FILTER_AVG)
1957
0
         num_filters++;
1958
1959
0
      if (filters & PNG_FILTER_PAETH)
1960
0
         num_filters++;
1961
1962
0
      if (num_filters > 1)
1963
0
         png_ptr->tst_row = png_voidcast(png_bytep, png_malloc(png_ptr,
1964
0
             buf_size));
1965
0
   }
1966
1967
   /* We only need to keep the previous row if we are using one of the following
1968
    * filters.
1969
    */
1970
0
   if ((filters & (PNG_FILTER_AVG | PNG_FILTER_UP | PNG_FILTER_PAETH)) != 0)
1971
0
      png_ptr->prev_row = png_voidcast(png_bytep,
1972
0
          png_calloc(png_ptr, buf_size));
1973
0
#endif /* WRITE_FILTER */
1974
1975
0
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
1976
   /* If interlaced, we need to set up width and height of pass */
1977
0
   if (png_ptr->interlaced != 0)
1978
0
   {
1979
0
      if ((png_ptr->transformations & PNG_INTERLACE) == 0)
1980
0
      {
1981
0
         png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
1982
0
             png_pass_ystart[0]) / png_pass_yinc[0];
1983
1984
0
         png_ptr->usr_width = (png_ptr->width + png_pass_inc[0] - 1 -
1985
0
             png_pass_start[0]) / png_pass_inc[0];
1986
0
      }
1987
1988
0
      else
1989
0
      {
1990
0
         png_ptr->num_rows = png_ptr->height;
1991
0
         png_ptr->usr_width = png_ptr->width;
1992
0
      }
1993
0
   }
1994
1995
0
   else
1996
0
#endif
1997
0
   {
1998
0
      png_ptr->num_rows = png_ptr->height;
1999
0
      png_ptr->usr_width = png_ptr->width;
2000
0
   }
2001
0
}
2002
2003
/* Internal use only.  Called when finished processing a row of data. */
2004
void /* PRIVATE */
2005
png_write_finish_row(png_structrp png_ptr)
2006
0
{
2007
0
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
2008
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
2009
2010
   /* Start of interlace block */
2011
0
   static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
2012
2013
   /* Offset to next interlace block */
2014
0
   static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
2015
2016
   /* Start of interlace block in the y direction */
2017
0
   static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
2018
2019
   /* Offset to next interlace block in the y direction */
2020
0
   static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
2021
0
#endif
2022
2023
0
   png_debug(1, "in png_write_finish_row");
2024
2025
   /* Next row */
2026
0
   png_ptr->row_number++;
2027
2028
   /* See if we are done */
2029
0
   if (png_ptr->row_number < png_ptr->num_rows)
2030
0
      return;
2031
2032
0
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
2033
   /* If interlaced, go to next pass */
2034
0
   if (png_ptr->interlaced != 0)
2035
0
   {
2036
0
      png_ptr->row_number = 0;
2037
0
      if ((png_ptr->transformations & PNG_INTERLACE) != 0)
2038
0
      {
2039
0
         png_ptr->pass++;
2040
0
      }
2041
2042
0
      else
2043
0
      {
2044
         /* Loop until we find a non-zero width or height pass */
2045
0
         do
2046
0
         {
2047
0
            png_ptr->pass++;
2048
2049
0
            if (png_ptr->pass >= 7)
2050
0
               break;
2051
2052
0
            png_ptr->usr_width = (png_ptr->width +
2053
0
                png_pass_inc[png_ptr->pass] - 1 -
2054
0
                png_pass_start[png_ptr->pass]) /
2055
0
                png_pass_inc[png_ptr->pass];
2056
2057
0
            png_ptr->num_rows = (png_ptr->height +
2058
0
                png_pass_yinc[png_ptr->pass] - 1 -
2059
0
                png_pass_ystart[png_ptr->pass]) /
2060
0
                png_pass_yinc[png_ptr->pass];
2061
2062
0
            if ((png_ptr->transformations & PNG_INTERLACE) != 0)
2063
0
               break;
2064
2065
0
         } while (png_ptr->usr_width == 0 || png_ptr->num_rows == 0);
2066
2067
0
      }
2068
2069
      /* Reset the row above the image for the next pass */
2070
0
      if (png_ptr->pass < 7)
2071
0
      {
2072
0
         if (png_ptr->prev_row != NULL)
2073
0
            memset(png_ptr->prev_row, 0,
2074
0
                PNG_ROWBYTES(png_ptr->usr_channels *
2075
0
                png_ptr->usr_bit_depth, png_ptr->width) + 1);
2076
2077
0
         return;
2078
0
      }
2079
0
   }
2080
0
#endif
2081
2082
   /* If we get here, we've just written the last row, so we need
2083
      to flush the compressor */
2084
0
   png_compress_IDAT(png_ptr, NULL, 0, Z_FINISH);
2085
0
}
2086
2087
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
2088
/* Pick out the correct pixels for the interlace pass.
2089
 * The basic idea here is to go through the row with a source
2090
 * pointer and a destination pointer (sp and dp), and copy the
2091
 * correct pixels for the pass.  As the row gets compacted,
2092
 * sp will always be >= dp, so we should never overwrite anything.
2093
 * See the default: case for the easiest code to understand.
2094
 */
2095
void /* PRIVATE */
2096
png_do_write_interlace(png_row_infop row_info, png_bytep row, int pass)
2097
0
{
2098
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
2099
2100
   /* Start of interlace block */
2101
0
   static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
2102
2103
   /* Offset to next interlace block */
2104
0
   static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
2105
2106
0
   png_debug(1, "in png_do_write_interlace");
2107
2108
   /* We don't have to do anything on the last pass (6) */
2109
0
   if (pass < 6)
2110
0
   {
2111
      /* Each pixel depth is handled separately */
2112
0
      switch (row_info->pixel_depth)
2113
0
      {
2114
0
         case 1:
2115
0
         {
2116
0
            png_bytep sp;
2117
0
            png_bytep dp;
2118
0
            unsigned int shift;
2119
0
            int d;
2120
0
            int value;
2121
0
            png_uint_32 i;
2122
0
            png_uint_32 row_width = row_info->width;
2123
2124
0
            dp = row;
2125
0
            d = 0;
2126
0
            shift = 7;
2127
2128
0
            for (i = png_pass_start[pass]; i < row_width;
2129
0
               i += png_pass_inc[pass])
2130
0
            {
2131
0
               sp = row + (size_t)(i >> 3);
2132
0
               value = (int)(*sp >> (7 - (int)(i & 0x07))) & 0x01;
2133
0
               d |= (value << shift);
2134
2135
0
               if (shift == 0)
2136
0
               {
2137
0
                  shift = 7;
2138
0
                  *dp++ = (png_byte)d;
2139
0
                  d = 0;
2140
0
               }
2141
2142
0
               else
2143
0
                  shift--;
2144
2145
0
            }
2146
0
            if (shift != 7)
2147
0
               *dp = (png_byte)d;
2148
2149
0
            break;
2150
0
         }
2151
2152
0
         case 2:
2153
0
         {
2154
0
            png_bytep sp;
2155
0
            png_bytep dp;
2156
0
            unsigned int shift;
2157
0
            int d;
2158
0
            int value;
2159
0
            png_uint_32 i;
2160
0
            png_uint_32 row_width = row_info->width;
2161
2162
0
            dp = row;
2163
0
            shift = 6;
2164
0
            d = 0;
2165
2166
0
            for (i = png_pass_start[pass]; i < row_width;
2167
0
               i += png_pass_inc[pass])
2168
0
            {
2169
0
               sp = row + (size_t)(i >> 2);
2170
0
               value = (*sp >> ((3 - (int)(i & 0x03)) << 1)) & 0x03;
2171
0
               d |= (value << shift);
2172
2173
0
               if (shift == 0)
2174
0
               {
2175
0
                  shift = 6;
2176
0
                  *dp++ = (png_byte)d;
2177
0
                  d = 0;
2178
0
               }
2179
2180
0
               else
2181
0
                  shift -= 2;
2182
0
            }
2183
0
            if (shift != 6)
2184
0
               *dp = (png_byte)d;
2185
2186
0
            break;
2187
0
         }
2188
2189
0
         case 4:
2190
0
         {
2191
0
            png_bytep sp;
2192
0
            png_bytep dp;
2193
0
            unsigned int shift;
2194
0
            int d;
2195
0
            int value;
2196
0
            png_uint_32 i;
2197
0
            png_uint_32 row_width = row_info->width;
2198
2199
0
            dp = row;
2200
0
            shift = 4;
2201
0
            d = 0;
2202
0
            for (i = png_pass_start[pass]; i < row_width;
2203
0
                i += png_pass_inc[pass])
2204
0
            {
2205
0
               sp = row + (size_t)(i >> 1);
2206
0
               value = (*sp >> ((1 - (int)(i & 0x01)) << 2)) & 0x0f;
2207
0
               d |= (value << shift);
2208
2209
0
               if (shift == 0)
2210
0
               {
2211
0
                  shift = 4;
2212
0
                  *dp++ = (png_byte)d;
2213
0
                  d = 0;
2214
0
               }
2215
2216
0
               else
2217
0
                  shift -= 4;
2218
0
            }
2219
0
            if (shift != 4)
2220
0
               *dp = (png_byte)d;
2221
2222
0
            break;
2223
0
         }
2224
2225
0
         default:
2226
0
         {
2227
0
            png_bytep sp;
2228
0
            png_bytep dp;
2229
0
            png_uint_32 i;
2230
0
            png_uint_32 row_width = row_info->width;
2231
0
            size_t pixel_bytes;
2232
2233
            /* Start at the beginning */
2234
0
            dp = row;
2235
2236
            /* Find out how many bytes each pixel takes up */
2237
0
            pixel_bytes = (row_info->pixel_depth >> 3);
2238
2239
            /* Loop through the row, only looking at the pixels that matter */
2240
0
            for (i = png_pass_start[pass]; i < row_width;
2241
0
               i += png_pass_inc[pass])
2242
0
            {
2243
               /* Find out where the original pixel is */
2244
0
               sp = row + (size_t)i * pixel_bytes;
2245
2246
               /* Move the pixel */
2247
0
               if (dp != sp)
2248
0
                  memcpy(dp, sp, pixel_bytes);
2249
2250
               /* Next pixel */
2251
0
               dp += pixel_bytes;
2252
0
            }
2253
0
            break;
2254
0
         }
2255
0
      }
2256
      /* Set new row width */
2257
0
      row_info->width = (row_info->width +
2258
0
          png_pass_inc[pass] - 1 -
2259
0
          png_pass_start[pass]) /
2260
0
          png_pass_inc[pass];
2261
2262
0
      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
2263
0
          row_info->width);
2264
0
   }
2265
0
}
2266
#endif
2267
2268
2269
/* This filters the row, chooses which filter to use, if it has not already
2270
 * been specified by the application, and then writes the row out with the
2271
 * chosen filter.
2272
 */
2273
static void /* PRIVATE */
2274
png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
2275
    size_t row_bytes);
2276
2277
#ifdef PNG_WRITE_FILTER_SUPPORTED
2278
static size_t /* PRIVATE */
2279
png_setup_sub_row(png_structrp png_ptr, png_uint_32 bpp,
2280
    size_t row_bytes, size_t lmins)
2281
0
{
2282
0
   png_bytep rp, dp, lp;
2283
0
   size_t i;
2284
0
   size_t sum = 0;
2285
0
   unsigned int v;
2286
2287
0
   png_ptr->try_row[0] = PNG_FILTER_VALUE_SUB;
2288
2289
0
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1; i < bpp;
2290
0
        i++, rp++, dp++)
2291
0
   {
2292
0
      v = *dp = *rp;
2293
#ifdef PNG_USE_ABS
2294
      sum += 128 - abs((int)v - 128);
2295
#else
2296
0
      sum += (v < 128) ? v : 256 - v;
2297
0
#endif
2298
0
   }
2299
2300
0
   for (lp = png_ptr->row_buf + 1; i < row_bytes;
2301
0
      i++, rp++, lp++, dp++)
2302
0
   {
2303
0
      v = *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);
2304
#ifdef PNG_USE_ABS
2305
      sum += 128 - abs((int)v - 128);
2306
#else
2307
0
      sum += (v < 128) ? v : 256 - v;
2308
0
#endif
2309
2310
0
      if (sum > lmins)  /* We are already worse, don't continue. */
2311
0
        break;
2312
0
   }
2313
2314
0
   return (sum);
2315
0
}
2316
2317
static void /* PRIVATE */
2318
png_setup_sub_row_only(png_structrp png_ptr, png_uint_32 bpp,
2319
    size_t row_bytes)
2320
0
{
2321
0
   png_bytep rp, dp, lp;
2322
0
   size_t i;
2323
2324
0
   png_ptr->try_row[0] = PNG_FILTER_VALUE_SUB;
2325
2326
0
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1; i < bpp;
2327
0
        i++, rp++, dp++)
2328
0
   {
2329
0
      *dp = *rp;
2330
0
   }
2331
2332
0
   for (lp = png_ptr->row_buf + 1; i < row_bytes;
2333
0
      i++, rp++, lp++, dp++)
2334
0
   {
2335
0
      *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);
2336
0
   }
2337
0
}
2338
2339
static size_t /* PRIVATE */
2340
png_setup_up_row(png_structrp png_ptr, size_t row_bytes, size_t lmins)
2341
0
{
2342
0
   png_bytep rp, dp, pp;
2343
0
   size_t i;
2344
0
   size_t sum = 0;
2345
0
   unsigned int v;
2346
2347
0
   png_ptr->try_row[0] = PNG_FILTER_VALUE_UP;
2348
2349
0
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2350
0
       pp = png_ptr->prev_row + 1; i < row_bytes;
2351
0
       i++, rp++, pp++, dp++)
2352
0
   {
2353
0
      v = *dp = (png_byte)(((int)*rp - (int)*pp) & 0xff);
2354
#ifdef PNG_USE_ABS
2355
      sum += 128 - abs((int)v - 128);
2356
#else
2357
0
      sum += (v < 128) ? v : 256 - v;
2358
0
#endif
2359
2360
0
      if (sum > lmins)  /* We are already worse, don't continue. */
2361
0
        break;
2362
0
   }
2363
2364
0
   return (sum);
2365
0
}
2366
static void /* PRIVATE */
2367
png_setup_up_row_only(png_structrp png_ptr, size_t row_bytes)
2368
0
{
2369
0
   png_bytep rp, dp, pp;
2370
0
   size_t i;
2371
2372
0
   png_ptr->try_row[0] = PNG_FILTER_VALUE_UP;
2373
2374
0
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2375
0
       pp = png_ptr->prev_row + 1; i < row_bytes;
2376
0
       i++, rp++, pp++, dp++)
2377
0
   {
2378
0
      *dp = (png_byte)(((int)*rp - (int)*pp) & 0xff);
2379
0
   }
2380
0
}
2381
2382
static size_t /* PRIVATE */
2383
png_setup_avg_row(png_structrp png_ptr, png_uint_32 bpp,
2384
    size_t row_bytes, size_t lmins)
2385
0
{
2386
0
   png_bytep rp, dp, pp, lp;
2387
0
   png_uint_32 i;
2388
0
   size_t sum = 0;
2389
0
   unsigned int v;
2390
2391
0
   png_ptr->try_row[0] = PNG_FILTER_VALUE_AVG;
2392
2393
0
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2394
0
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2395
0
   {
2396
0
      v = *dp++ = (png_byte)(((int)*rp++ - ((int)*pp++ / 2)) & 0xff);
2397
2398
#ifdef PNG_USE_ABS
2399
      sum += 128 - abs((int)v - 128);
2400
#else
2401
0
      sum += (v < 128) ? v : 256 - v;
2402
0
#endif
2403
0
   }
2404
2405
0
   for (lp = png_ptr->row_buf + 1; i < row_bytes; i++)
2406
0
   {
2407
0
      v = *dp++ = (png_byte)(((int)*rp++ - (((int)*pp++ + (int)*lp++) / 2))
2408
0
          & 0xff);
2409
2410
#ifdef PNG_USE_ABS
2411
      sum += 128 - abs((int)v - 128);
2412
#else
2413
0
      sum += (v < 128) ? v : 256 - v;
2414
0
#endif
2415
2416
0
      if (sum > lmins)  /* We are already worse, don't continue. */
2417
0
        break;
2418
0
   }
2419
2420
0
   return (sum);
2421
0
}
2422
static void /* PRIVATE */
2423
png_setup_avg_row_only(png_structrp png_ptr, png_uint_32 bpp,
2424
    size_t row_bytes)
2425
0
{
2426
0
   png_bytep rp, dp, pp, lp;
2427
0
   png_uint_32 i;
2428
2429
0
   png_ptr->try_row[0] = PNG_FILTER_VALUE_AVG;
2430
2431
0
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2432
0
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2433
0
   {
2434
0
      *dp++ = (png_byte)(((int)*rp++ - ((int)*pp++ / 2)) & 0xff);
2435
0
   }
2436
2437
0
   for (lp = png_ptr->row_buf + 1; i < row_bytes; i++)
2438
0
   {
2439
0
      *dp++ = (png_byte)(((int)*rp++ - (((int)*pp++ + (int)*lp++) / 2))
2440
0
          & 0xff);
2441
0
   }
2442
0
}
2443
2444
static size_t /* PRIVATE */
2445
png_setup_paeth_row(png_structrp png_ptr, png_uint_32 bpp,
2446
    size_t row_bytes, size_t lmins)
2447
0
{
2448
0
   png_bytep rp, dp, pp, cp, lp;
2449
0
   size_t i;
2450
0
   size_t sum = 0;
2451
0
   unsigned int v;
2452
2453
0
   png_ptr->try_row[0] = PNG_FILTER_VALUE_PAETH;
2454
2455
0
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2456
0
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2457
0
   {
2458
0
      v = *dp++ = (png_byte)(((int)*rp++ - (int)*pp++) & 0xff);
2459
2460
#ifdef PNG_USE_ABS
2461
      sum += 128 - abs((int)v - 128);
2462
#else
2463
0
      sum += (v < 128) ? v : 256 - v;
2464
0
#endif
2465
0
   }
2466
2467
0
   for (lp = png_ptr->row_buf + 1, cp = png_ptr->prev_row + 1; i < row_bytes;
2468
0
        i++)
2469
0
   {
2470
0
      int a, b, c, pa, pb, pc, p;
2471
2472
0
      b = *pp++;
2473
0
      c = *cp++;
2474
0
      a = *lp++;
2475
2476
0
      p = b - c;
2477
0
      pc = a - c;
2478
2479
#ifdef PNG_USE_ABS
2480
      pa = abs(p);
2481
      pb = abs(pc);
2482
      pc = abs(p + pc);
2483
#else
2484
0
      pa = p < 0 ? -p : p;
2485
0
      pb = pc < 0 ? -pc : pc;
2486
0
      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
2487
0
#endif
2488
2489
0
      p = (pa <= pb && pa <=pc) ? a : (pb <= pc) ? b : c;
2490
2491
0
      v = *dp++ = (png_byte)(((int)*rp++ - p) & 0xff);
2492
2493
#ifdef PNG_USE_ABS
2494
      sum += 128 - abs((int)v - 128);
2495
#else
2496
0
      sum += (v < 128) ? v : 256 - v;
2497
0
#endif
2498
2499
0
      if (sum > lmins)  /* We are already worse, don't continue. */
2500
0
        break;
2501
0
   }
2502
2503
0
   return (sum);
2504
0
}
2505
static void /* PRIVATE */
2506
png_setup_paeth_row_only(png_structrp png_ptr, png_uint_32 bpp,
2507
    size_t row_bytes)
2508
0
{
2509
0
   png_bytep rp, dp, pp, cp, lp;
2510
0
   size_t i;
2511
2512
0
   png_ptr->try_row[0] = PNG_FILTER_VALUE_PAETH;
2513
2514
0
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2515
0
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2516
0
   {
2517
0
      *dp++ = (png_byte)(((int)*rp++ - (int)*pp++) & 0xff);
2518
0
   }
2519
2520
0
   for (lp = png_ptr->row_buf + 1, cp = png_ptr->prev_row + 1; i < row_bytes;
2521
0
        i++)
2522
0
   {
2523
0
      int a, b, c, pa, pb, pc, p;
2524
2525
0
      b = *pp++;
2526
0
      c = *cp++;
2527
0
      a = *lp++;
2528
2529
0
      p = b - c;
2530
0
      pc = a - c;
2531
2532
#ifdef PNG_USE_ABS
2533
      pa = abs(p);
2534
      pb = abs(pc);
2535
      pc = abs(p + pc);
2536
#else
2537
0
      pa = p < 0 ? -p : p;
2538
0
      pb = pc < 0 ? -pc : pc;
2539
0
      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
2540
0
#endif
2541
2542
0
      p = (pa <= pb && pa <=pc) ? a : (pb <= pc) ? b : c;
2543
2544
0
      *dp++ = (png_byte)(((int)*rp++ - p) & 0xff);
2545
0
   }
2546
0
}
2547
#endif /* WRITE_FILTER */
2548
2549
void /* PRIVATE */
2550
png_write_find_filter(png_structrp png_ptr, png_row_infop row_info)
2551
0
{
2552
#ifndef PNG_WRITE_FILTER_SUPPORTED
2553
   png_write_filtered_row(png_ptr, png_ptr->row_buf, row_info->rowbytes+1);
2554
#else
2555
0
   unsigned int filter_to_do = png_ptr->do_filter;
2556
0
   png_bytep row_buf;
2557
0
   png_bytep best_row;
2558
0
   png_uint_32 bpp;
2559
0
   size_t mins;
2560
0
   size_t row_bytes = row_info->rowbytes;
2561
2562
0
   png_debug(1, "in png_write_find_filter");
2563
2564
   /* Find out how many bytes offset each pixel is */
2565
0
   bpp = (row_info->pixel_depth + 7) >> 3;
2566
2567
0
   row_buf = png_ptr->row_buf;
2568
0
   mins = PNG_SIZE_MAX - 256/* so we can detect potential overflow of the
2569
0
                               running sum */;
2570
2571
   /* The prediction method we use is to find which method provides the
2572
    * smallest value when summing the absolute values of the distances
2573
    * from zero, using anything >= 128 as negative numbers.  This is known
2574
    * as the "minimum sum of absolute differences" heuristic.  Other
2575
    * heuristics are the "weighted minimum sum of absolute differences"
2576
    * (experimental and can in theory improve compression), and the "zlib
2577
    * predictive" method (not implemented yet), which does test compressions
2578
    * of lines using different filter methods, and then chooses the
2579
    * (series of) filter(s) that give minimum compressed data size (VERY
2580
    * computationally expensive).
2581
    *
2582
    * GRR 980525:  consider also
2583
    *
2584
    *   (1) minimum sum of absolute differences from running average (i.e.,
2585
    *       keep running sum of non-absolute differences & count of bytes)
2586
    *       [track dispersion, too?  restart average if dispersion too large?]
2587
    *
2588
    *  (1b) minimum sum of absolute differences from sliding average, probably
2589
    *       with window size <= deflate window (usually 32K)
2590
    *
2591
    *   (2) minimum sum of squared differences from zero or running average
2592
    *       (i.e., ~ root-mean-square approach)
2593
    */
2594
2595
2596
   /* We don't need to test the 'no filter' case if this is the only filter
2597
    * that has been chosen, as it doesn't actually do anything to the data.
2598
    */
2599
0
   best_row = png_ptr->row_buf;
2600
2601
0
   if (PNG_SIZE_MAX/128 <= row_bytes)
2602
0
   {
2603
      /* Overflow can occur in the calculation, just select the lowest set
2604
       * filter.
2605
       */
2606
0
      filter_to_do &= 0U-filter_to_do;
2607
0
   }
2608
0
   else if ((filter_to_do & PNG_FILTER_NONE) != 0 &&
2609
0
         filter_to_do != PNG_FILTER_NONE)
2610
0
   {
2611
      /* Overflow not possible and multiple filters in the list, including the
2612
       * 'none' filter.
2613
       */
2614
0
      png_bytep rp;
2615
0
      size_t sum = 0;
2616
0
      size_t i;
2617
0
      unsigned int v;
2618
2619
0
      {
2620
0
         for (i = 0, rp = row_buf + 1; i < row_bytes; i++, rp++)
2621
0
         {
2622
0
            v = *rp;
2623
#ifdef PNG_USE_ABS
2624
            sum += 128 - abs((int)v - 128);
2625
#else
2626
0
            sum += (v < 128) ? v : 256 - v;
2627
0
#endif
2628
0
         }
2629
0
      }
2630
2631
0
      mins = sum;
2632
0
   }
2633
2634
   /* Sub filter */
2635
0
   if (filter_to_do == PNG_FILTER_SUB)
2636
   /* It's the only filter so no testing is needed */
2637
0
   {
2638
0
      png_setup_sub_row_only(png_ptr, bpp, row_bytes);
2639
0
      best_row = png_ptr->try_row;
2640
0
   }
2641
2642
0
   else if ((filter_to_do & PNG_FILTER_SUB) != 0)
2643
0
   {
2644
0
      size_t sum;
2645
0
      size_t lmins = mins;
2646
2647
0
      sum = png_setup_sub_row(png_ptr, bpp, row_bytes, lmins);
2648
2649
0
      if (sum < mins)
2650
0
      {
2651
0
         mins = sum;
2652
0
         best_row = png_ptr->try_row;
2653
0
         if (png_ptr->tst_row != NULL)
2654
0
         {
2655
0
            png_ptr->try_row = png_ptr->tst_row;
2656
0
            png_ptr->tst_row = best_row;
2657
0
         }
2658
0
      }
2659
0
   }
2660
2661
   /* Up filter */
2662
0
   if (filter_to_do == PNG_FILTER_UP)
2663
0
   {
2664
0
      png_setup_up_row_only(png_ptr, row_bytes);
2665
0
      best_row = png_ptr->try_row;
2666
0
   }
2667
2668
0
   else if ((filter_to_do & PNG_FILTER_UP) != 0)
2669
0
   {
2670
0
      size_t sum;
2671
0
      size_t lmins = mins;
2672
2673
0
      sum = png_setup_up_row(png_ptr, row_bytes, lmins);
2674
2675
0
      if (sum < mins)
2676
0
      {
2677
0
         mins = sum;
2678
0
         best_row = png_ptr->try_row;
2679
0
         if (png_ptr->tst_row != NULL)
2680
0
         {
2681
0
            png_ptr->try_row = png_ptr->tst_row;
2682
0
            png_ptr->tst_row = best_row;
2683
0
         }
2684
0
      }
2685
0
   }
2686
2687
   /* Avg filter */
2688
0
   if (filter_to_do == PNG_FILTER_AVG)
2689
0
   {
2690
0
      png_setup_avg_row_only(png_ptr, bpp, row_bytes);
2691
0
      best_row = png_ptr->try_row;
2692
0
   }
2693
2694
0
   else if ((filter_to_do & PNG_FILTER_AVG) != 0)
2695
0
   {
2696
0
      size_t sum;
2697
0
      size_t lmins = mins;
2698
2699
0
      sum= png_setup_avg_row(png_ptr, bpp, row_bytes, lmins);
2700
2701
0
      if (sum < mins)
2702
0
      {
2703
0
         mins = sum;
2704
0
         best_row = png_ptr->try_row;
2705
0
         if (png_ptr->tst_row != NULL)
2706
0
         {
2707
0
            png_ptr->try_row = png_ptr->tst_row;
2708
0
            png_ptr->tst_row = best_row;
2709
0
         }
2710
0
      }
2711
0
   }
2712
2713
   /* Paeth filter */
2714
0
   if (filter_to_do == PNG_FILTER_PAETH)
2715
0
   {
2716
0
      png_setup_paeth_row_only(png_ptr, bpp, row_bytes);
2717
0
      best_row = png_ptr->try_row;
2718
0
   }
2719
2720
0
   else if ((filter_to_do & PNG_FILTER_PAETH) != 0)
2721
0
   {
2722
0
      size_t sum;
2723
0
      size_t lmins = mins;
2724
2725
0
      sum = png_setup_paeth_row(png_ptr, bpp, row_bytes, lmins);
2726
2727
0
      if (sum < mins)
2728
0
      {
2729
0
         best_row = png_ptr->try_row;
2730
0
         if (png_ptr->tst_row != NULL)
2731
0
         {
2732
0
            png_ptr->try_row = png_ptr->tst_row;
2733
0
            png_ptr->tst_row = best_row;
2734
0
         }
2735
0
      }
2736
0
   }
2737
2738
   /* Do the actual writing of the filtered row data from the chosen filter. */
2739
0
   png_write_filtered_row(png_ptr, best_row, row_info->rowbytes+1);
2740
2741
0
#endif /* WRITE_FILTER */
2742
0
}
2743
2744
2745
/* Do the actual writing of a previously filtered row. */
2746
static void
2747
png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
2748
    size_t full_row_length/*includes filter byte*/)
2749
0
{
2750
0
   png_debug(1, "in png_write_filtered_row");
2751
2752
0
   png_debug1(2, "filter = %d", filtered_row[0]);
2753
2754
0
   png_compress_IDAT(png_ptr, filtered_row, full_row_length, Z_NO_FLUSH);
2755
2756
0
#ifdef PNG_WRITE_FILTER_SUPPORTED
2757
   /* Swap the current and previous rows */
2758
0
   if (png_ptr->prev_row != NULL)
2759
0
   {
2760
0
      png_bytep tptr;
2761
2762
0
      tptr = png_ptr->prev_row;
2763
0
      png_ptr->prev_row = png_ptr->row_buf;
2764
0
      png_ptr->row_buf = tptr;
2765
0
   }
2766
0
#endif /* WRITE_FILTER */
2767
2768
   /* Finish row - updates counters and flushes zlib if last row */
2769
0
   png_write_finish_row(png_ptr);
2770
2771
0
#ifdef PNG_WRITE_FLUSH_SUPPORTED
2772
0
   png_ptr->flush_rows++;
2773
2774
0
   if (png_ptr->flush_dist > 0 &&
2775
0
       png_ptr->flush_rows >= png_ptr->flush_dist)
2776
0
   {
2777
0
      png_write_flush(png_ptr);
2778
0
   }
2779
0
#endif /* WRITE_FLUSH */
2780
0
}
2781
#endif /* WRITE */