/src/skia/third_party/externals/libpng/pngrutil.c
Line | Count | Source (jump to first uncovered line) |
1 | | |
2 | | /* pngrutil.c - utilities to read a PNG file |
3 | | * |
4 | | * Copyright (c) 2018 Cosmin Truta |
5 | | * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson |
6 | | * Copyright (c) 1996-1997 Andreas Dilger |
7 | | * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc. |
8 | | * |
9 | | * This code is released under the libpng license. |
10 | | * For conditions of distribution and use, see the disclaimer |
11 | | * and license in png.h |
12 | | * |
13 | | * This file contains routines that are only called from within |
14 | | * libpng itself during the course of reading an image. |
15 | | */ |
16 | | |
17 | | #include "pngpriv.h" |
18 | | |
19 | | #ifdef PNG_READ_SUPPORTED |
20 | | |
21 | | png_uint_32 PNGAPI |
22 | | png_get_uint_31(png_const_structrp png_ptr, png_const_bytep buf) |
23 | 184k | { |
24 | 184k | png_uint_32 uval = png_get_uint_32(buf); |
25 | | |
26 | 184k | if (uval > PNG_UINT_31_MAX) |
27 | 1.26k | png_error(png_ptr, "PNG unsigned integer out of range"); |
28 | | |
29 | 183k | return (uval); |
30 | 183k | } |
31 | | |
32 | | #if defined(PNG_READ_gAMA_SUPPORTED) || defined(PNG_READ_cHRM_SUPPORTED) |
33 | | /* The following is a variation on the above for use with the fixed |
34 | | * point values used for gAMA and cHRM. Instead of png_error it |
35 | | * issues a warning and returns (-1) - an invalid value because both |
36 | | * gAMA and cHRM use *unsigned* integers for fixed point values. |
37 | | */ |
38 | 44.4k | #define PNG_FIXED_ERROR (-1) |
39 | | |
40 | | static png_fixed_point /* PRIVATE */ |
41 | | png_get_fixed_point(png_structrp png_ptr, png_const_bytep buf) |
42 | 29.0k | { |
43 | 29.0k | png_uint_32 uval = png_get_uint_32(buf); |
44 | | |
45 | 29.0k | if (uval <= PNG_UINT_31_MAX) |
46 | 23.6k | return (png_fixed_point)uval; /* known to be in range */ |
47 | | |
48 | | /* The caller can turn off the warning by passing NULL. */ |
49 | 5.46k | if (png_ptr != NULL) |
50 | 0 | png_warning(png_ptr, "PNG fixed point integer out of range"); |
51 | | |
52 | 5.46k | return PNG_FIXED_ERROR; |
53 | 5.46k | } |
54 | | #endif |
55 | | |
56 | | #ifdef PNG_READ_INT_FUNCTIONS_SUPPORTED |
57 | | /* NOTE: the read macros will obscure these definitions, so that if |
58 | | * PNG_USE_READ_MACROS is set the library will not use them internally, |
59 | | * but the APIs will still be available externally. |
60 | | * |
61 | | * The parentheses around "PNGAPI function_name" in the following three |
62 | | * functions are necessary because they allow the macros to co-exist with |
63 | | * these (unused but exported) functions. |
64 | | */ |
65 | | |
66 | | /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ |
67 | | png_uint_32 (PNGAPI |
68 | | png_get_uint_32)(png_const_bytep buf) |
69 | 0 | { |
70 | 0 | png_uint_32 uval = |
71 | 0 | ((png_uint_32)(*(buf )) << 24) + |
72 | 0 | ((png_uint_32)(*(buf + 1)) << 16) + |
73 | 0 | ((png_uint_32)(*(buf + 2)) << 8) + |
74 | 0 | ((png_uint_32)(*(buf + 3)) ) ; |
75 | |
|
76 | 0 | return uval; |
77 | 0 | } |
78 | | |
79 | | /* Grab a signed 32-bit integer from a buffer in big-endian format. The |
80 | | * data is stored in the PNG file in two's complement format and there |
81 | | * is no guarantee that a 'png_int_32' is exactly 32 bits, therefore |
82 | | * the following code does a two's complement to native conversion. |
83 | | */ |
84 | | png_int_32 (PNGAPI |
85 | | png_get_int_32)(png_const_bytep buf) |
86 | 0 | { |
87 | 0 | png_uint_32 uval = png_get_uint_32(buf); |
88 | 0 | if ((uval & 0x80000000) == 0) /* non-negative */ |
89 | 0 | return (png_int_32)uval; |
90 | | |
91 | 0 | uval = (uval ^ 0xffffffff) + 1; /* 2's complement: -x = ~x+1 */ |
92 | 0 | if ((uval & 0x80000000) == 0) /* no overflow */ |
93 | 0 | return -(png_int_32)uval; |
94 | | /* The following has to be safe; this function only gets called on PNG data |
95 | | * and if we get here that data is invalid. 0 is the most safe value and |
96 | | * if not then an attacker would surely just generate a PNG with 0 instead. |
97 | | */ |
98 | 0 | return 0; |
99 | 0 | } |
100 | | |
101 | | /* Grab an unsigned 16-bit integer from a buffer in big-endian format. */ |
102 | | png_uint_16 (PNGAPI |
103 | | png_get_uint_16)(png_const_bytep buf) |
104 | 0 | { |
105 | | /* ANSI-C requires an int value to accommodate at least 16 bits so this |
106 | | * works and allows the compiler not to worry about possible narrowing |
107 | | * on 32-bit systems. (Pre-ANSI systems did not make integers smaller |
108 | | * than 16 bits either.) |
109 | | */ |
110 | 0 | unsigned int val = |
111 | 0 | ((unsigned int)(*buf) << 8) + |
112 | 0 | ((unsigned int)(*(buf + 1))); |
113 | |
|
114 | 0 | return (png_uint_16)val; |
115 | 0 | } |
116 | | |
117 | | #endif /* READ_INT_FUNCTIONS */ |
118 | | |
119 | | /* Read and check the PNG file signature */ |
120 | | void /* PRIVATE */ |
121 | | png_read_sig(png_structrp png_ptr, png_inforp info_ptr) |
122 | 0 | { |
123 | 0 | size_t num_checked, num_to_check; |
124 | | |
125 | | /* Exit if the user application does not expect a signature. */ |
126 | 0 | if (png_ptr->sig_bytes >= 8) |
127 | 0 | return; |
128 | | |
129 | 0 | num_checked = png_ptr->sig_bytes; |
130 | 0 | num_to_check = 8 - num_checked; |
131 | |
|
132 | 0 | #ifdef PNG_IO_STATE_SUPPORTED |
133 | 0 | png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE; |
134 | 0 | #endif |
135 | | |
136 | | /* The signature must be serialized in a single I/O call. */ |
137 | 0 | png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check); |
138 | 0 | png_ptr->sig_bytes = 8; |
139 | |
|
140 | 0 | if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check) != 0) |
141 | 0 | { |
142 | 0 | if (num_checked < 4 && |
143 | 0 | png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4)) |
144 | 0 | png_error(png_ptr, "Not a PNG file"); |
145 | 0 | else |
146 | 0 | png_error(png_ptr, "PNG file corrupted by ASCII conversion"); |
147 | 0 | } |
148 | 0 | if (num_checked < 3) |
149 | 0 | png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE; |
150 | 0 | } |
151 | | |
152 | | /* Read the chunk header (length + type name). |
153 | | * Put the type name into png_ptr->chunk_name, and return the length. |
154 | | */ |
155 | | png_uint_32 /* PRIVATE */ |
156 | | png_read_chunk_header(png_structrp png_ptr) |
157 | 0 | { |
158 | 0 | png_byte buf[8]; |
159 | 0 | png_uint_32 length; |
160 | |
|
161 | 0 | #ifdef PNG_IO_STATE_SUPPORTED |
162 | 0 | png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR; |
163 | 0 | #endif |
164 | | |
165 | | /* Read the length and the chunk name. |
166 | | * This must be performed in a single I/O call. |
167 | | */ |
168 | 0 | png_read_data(png_ptr, buf, 8); |
169 | 0 | length = png_get_uint_31(png_ptr, buf); |
170 | | |
171 | | /* Put the chunk name into png_ptr->chunk_name. */ |
172 | 0 | png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(buf+4); |
173 | |
|
174 | 0 | png_debug2(0, "Reading %lx chunk, length = %lu", |
175 | 0 | (unsigned long)png_ptr->chunk_name, (unsigned long)length); |
176 | | |
177 | | /* Reset the crc and run it over the chunk name. */ |
178 | 0 | png_reset_crc(png_ptr); |
179 | 0 | png_calculate_crc(png_ptr, buf + 4, 4); |
180 | | |
181 | | /* Check to see if chunk name is valid. */ |
182 | 0 | png_check_chunk_name(png_ptr, png_ptr->chunk_name); |
183 | | |
184 | | /* Check for too-large chunk length */ |
185 | 0 | png_check_chunk_length(png_ptr, length); |
186 | |
|
187 | 0 | #ifdef PNG_IO_STATE_SUPPORTED |
188 | 0 | png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA; |
189 | 0 | #endif |
190 | |
|
191 | 0 | return length; |
192 | 0 | } |
193 | | |
194 | | /* Read data, and (optionally) run it through the CRC. */ |
195 | | void /* PRIVATE */ |
196 | | png_crc_read(png_structrp png_ptr, png_bytep buf, png_uint_32 length) |
197 | 312k | { |
198 | 312k | if (png_ptr == NULL) |
199 | 0 | return; |
200 | | |
201 | 312k | png_read_data(png_ptr, buf, length); |
202 | 312k | png_calculate_crc(png_ptr, buf, length); |
203 | 312k | } |
204 | | |
205 | | /* Optionally skip data and then check the CRC. Depending on whether we |
206 | | * are reading an ancillary or critical chunk, and how the program has set |
207 | | * things up, we may calculate the CRC on the data and print a message. |
208 | | * Returns '1' if there was a CRC error, '0' otherwise. |
209 | | */ |
210 | | int /* PRIVATE */ |
211 | | png_crc_finish(png_structrp png_ptr, png_uint_32 skip) |
212 | 147k | { |
213 | | /* The size of the local buffer for inflate is a good guess as to a |
214 | | * reasonable size to use for buffering reads from the application. |
215 | | */ |
216 | 182k | while (skip > 0) |
217 | 34.7k | { |
218 | 34.7k | png_uint_32 len; |
219 | 34.7k | png_byte tmpbuf[PNG_INFLATE_BUF_SIZE]; |
220 | | |
221 | 34.7k | len = (sizeof tmpbuf); |
222 | 34.7k | if (len > skip) |
223 | 34.3k | len = skip; |
224 | 34.7k | skip -= len; |
225 | | |
226 | 34.7k | png_crc_read(png_ptr, tmpbuf, len); |
227 | 34.7k | } |
228 | | |
229 | 147k | if (png_crc_error(png_ptr) != 0) |
230 | 54.0k | { |
231 | 54.0k | if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0 ? |
232 | 52.8k | (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == 0 : |
233 | 1.18k | (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE) != 0) |
234 | 52.8k | { |
235 | 52.8k | png_chunk_warning(png_ptr, "CRC error"); |
236 | 52.8k | } |
237 | | |
238 | 1.18k | else |
239 | 1.18k | png_chunk_error(png_ptr, "CRC error"); |
240 | | |
241 | 52.8k | return (1); |
242 | 52.8k | } |
243 | | |
244 | 93.2k | return (0); |
245 | 93.2k | } |
246 | | |
247 | | /* Compare the CRC stored in the PNG file with that calculated by libpng from |
248 | | * the data it has read thus far. |
249 | | */ |
250 | | int /* PRIVATE */ |
251 | | png_crc_error(png_structrp png_ptr) |
252 | 147k | { |
253 | 147k | png_byte crc_bytes[4]; |
254 | 147k | png_uint_32 crc; |
255 | 147k | int need_crc = 1; |
256 | | |
257 | 147k | if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0) |
258 | 124k | { |
259 | 124k | if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) == |
260 | 124k | (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN)) |
261 | 0 | need_crc = 0; |
262 | 124k | } |
263 | | |
264 | 23.3k | else /* critical */ |
265 | 23.3k | { |
266 | 23.3k | if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0) |
267 | 0 | need_crc = 0; |
268 | 23.3k | } |
269 | | |
270 | 147k | #ifdef PNG_IO_STATE_SUPPORTED |
271 | 147k | png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC; |
272 | 147k | #endif |
273 | | |
274 | | /* The chunk CRC must be serialized in a single I/O call. */ |
275 | 147k | png_read_data(png_ptr, crc_bytes, 4); |
276 | | |
277 | 147k | if (need_crc != 0) |
278 | 147k | { |
279 | 147k | crc = png_get_uint_32(crc_bytes); |
280 | 147k | return ((int)(crc != png_ptr->crc)); |
281 | 147k | } |
282 | | |
283 | 0 | else |
284 | 0 | return (0); |
285 | 147k | } |
286 | | |
287 | | #if defined(PNG_READ_iCCP_SUPPORTED) || defined(PNG_READ_iTXt_SUPPORTED) ||\ |
288 | | defined(PNG_READ_pCAL_SUPPORTED) || defined(PNG_READ_sCAL_SUPPORTED) ||\ |
289 | | defined(PNG_READ_sPLT_SUPPORTED) || defined(PNG_READ_tEXt_SUPPORTED) ||\ |
290 | | defined(PNG_READ_zTXt_SUPPORTED) || defined(PNG_SEQUENTIAL_READ_SUPPORTED) |
291 | | /* Manage the read buffer; this simply reallocates the buffer if it is not small |
292 | | * enough (or if it is not allocated). The routine returns a pointer to the |
293 | | * buffer; if an error occurs and 'warn' is set the routine returns NULL, else |
294 | | * it will call png_error (via png_malloc) on failure. (warn == 2 means |
295 | | * 'silent'). |
296 | | */ |
297 | | static png_bytep |
298 | | png_read_buffer(png_structrp png_ptr, png_alloc_size_t new_size, int warn) |
299 | 51.1k | { |
300 | 51.1k | png_bytep buffer = png_ptr->read_buffer; |
301 | | |
302 | 51.1k | if (buffer != NULL && new_size > png_ptr->read_buffer_size) |
303 | 3.30k | { |
304 | 3.30k | png_ptr->read_buffer = NULL; |
305 | 3.30k | png_ptr->read_buffer = NULL; |
306 | 3.30k | png_ptr->read_buffer_size = 0; |
307 | 3.30k | png_free(png_ptr, buffer); |
308 | 3.30k | buffer = NULL; |
309 | 3.30k | } |
310 | | |
311 | 51.1k | if (buffer == NULL) |
312 | 16.4k | { |
313 | 16.4k | buffer = png_voidcast(png_bytep, png_malloc_base(png_ptr, new_size)); |
314 | | |
315 | 16.4k | if (buffer != NULL) |
316 | 15.7k | { |
317 | 15.7k | memset(buffer, 0, new_size); /* just in case */ |
318 | 15.7k | png_ptr->read_buffer = buffer; |
319 | 15.7k | png_ptr->read_buffer_size = new_size; |
320 | 15.7k | } |
321 | | |
322 | 668 | else if (warn < 2) /* else silent */ |
323 | 0 | { |
324 | 0 | if (warn != 0) |
325 | 0 | png_chunk_warning(png_ptr, "insufficient memory to read chunk"); |
326 | | |
327 | 0 | else |
328 | 0 | png_chunk_error(png_ptr, "insufficient memory to read chunk"); |
329 | 51.1k | } |
330 | 16.4k | } |
331 | | |
332 | 51.1k | return buffer; |
333 | 51.1k | } |
334 | | #endif /* READ_iCCP|iTXt|pCAL|sCAL|sPLT|tEXt|zTXt|SEQUENTIAL_READ */ |
335 | | |
336 | | /* png_inflate_claim: claim the zstream for some nefarious purpose that involves |
337 | | * decompression. Returns Z_OK on success, else a zlib error code. It checks |
338 | | * the owner but, in final release builds, just issues a warning if some other |
339 | | * chunk apparently owns the stream. Prior to release it does a png_error. |
340 | | */ |
341 | | static int |
342 | | png_inflate_claim(png_structrp png_ptr, png_uint_32 owner) |
343 | 21.3k | { |
344 | 21.3k | if (png_ptr->zowner != 0) |
345 | 0 | { |
346 | 0 | char msg[64]; |
347 | |
|
348 | 0 | PNG_STRING_FROM_CHUNK(msg, png_ptr->zowner); |
349 | | /* So the message that results is "<chunk> using zstream"; this is an |
350 | | * internal error, but is very useful for debugging. i18n requirements |
351 | | * are minimal. |
352 | | */ |
353 | 0 | (void)png_safecat(msg, (sizeof msg), 4, " using zstream"); |
354 | | #if PNG_RELEASE_BUILD |
355 | | png_chunk_warning(png_ptr, msg); |
356 | | png_ptr->zowner = 0; |
357 | | #else |
358 | 0 | png_chunk_error(png_ptr, msg); |
359 | 0 | #endif |
360 | 0 | } |
361 | | |
362 | | /* Implementation note: unlike 'png_deflate_claim' this internal function |
363 | | * does not take the size of the data as an argument. Some efficiency could |
364 | | * be gained by using this when it is known *if* the zlib stream itself does |
365 | | * not record the number; however, this is an illusion: the original writer |
366 | | * of the PNG may have selected a lower window size, and we really must |
367 | | * follow that because, for systems with with limited capabilities, we |
368 | | * would otherwise reject the application's attempts to use a smaller window |
369 | | * size (zlib doesn't have an interface to say "this or lower"!). |
370 | | * |
371 | | * inflateReset2 was added to zlib 1.2.4; before this the window could not be |
372 | | * reset, therefore it is necessary to always allocate the maximum window |
373 | | * size with earlier zlibs just in case later compressed chunks need it. |
374 | | */ |
375 | 21.3k | { |
376 | 21.3k | int ret; /* zlib return code */ |
377 | 21.3k | #if ZLIB_VERNUM >= 0x1240 |
378 | 21.3k | int window_bits = 0; |
379 | | |
380 | 21.3k | # if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW) |
381 | 21.3k | if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & 3) == |
382 | 21.3k | PNG_OPTION_ON) |
383 | 21.3k | { |
384 | 21.3k | window_bits = 15; |
385 | 21.3k | png_ptr->zstream_start = 0; /* fixed window size */ |
386 | 21.3k | } |
387 | | |
388 | 0 | else |
389 | 0 | { |
390 | 0 | png_ptr->zstream_start = 1; |
391 | 0 | } |
392 | 21.3k | # endif |
393 | | |
394 | 21.3k | #endif /* ZLIB_VERNUM >= 0x1240 */ |
395 | | |
396 | | /* Set this for safety, just in case the previous owner left pointers to |
397 | | * memory allocations. |
398 | | */ |
399 | 21.3k | png_ptr->zstream.next_in = NULL; |
400 | 21.3k | png_ptr->zstream.avail_in = 0; |
401 | 21.3k | png_ptr->zstream.next_out = NULL; |
402 | 21.3k | png_ptr->zstream.avail_out = 0; |
403 | | |
404 | 21.3k | if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0) |
405 | 12.4k | { |
406 | 12.4k | #if ZLIB_VERNUM >= 0x1240 |
407 | 12.4k | ret = inflateReset2(&png_ptr->zstream, window_bits); |
408 | | #else |
409 | | ret = inflateReset(&png_ptr->zstream); |
410 | | #endif |
411 | 12.4k | } |
412 | | |
413 | 8.94k | else |
414 | 8.94k | { |
415 | 8.94k | #if ZLIB_VERNUM >= 0x1240 |
416 | 8.94k | ret = inflateInit2(&png_ptr->zstream, window_bits); |
417 | | #else |
418 | | ret = inflateInit(&png_ptr->zstream); |
419 | | #endif |
420 | | |
421 | 8.94k | if (ret == Z_OK) |
422 | 8.94k | png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED; |
423 | 8.94k | } |
424 | | |
425 | 21.3k | #if ZLIB_VERNUM >= 0x1290 && \ |
426 | 21.3k | defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_IGNORE_ADLER32) |
427 | 21.3k | if (((png_ptr->options >> PNG_IGNORE_ADLER32) & 3) == PNG_OPTION_ON) |
428 | | /* Turn off validation of the ADLER32 checksum in IDAT chunks */ |
429 | 0 | ret = inflateValidate(&png_ptr->zstream, 0); |
430 | 21.3k | #endif |
431 | | |
432 | 21.3k | if (ret == Z_OK) |
433 | 21.3k | png_ptr->zowner = owner; |
434 | | |
435 | 0 | else |
436 | 0 | png_zstream_error(png_ptr, ret); |
437 | | |
438 | 21.3k | return ret; |
439 | 21.3k | } |
440 | | |
441 | | #ifdef window_bits |
442 | | # undef window_bits |
443 | | #endif |
444 | 21.3k | } |
445 | | |
446 | | #if ZLIB_VERNUM >= 0x1240 |
447 | | /* Handle the start of the inflate stream if we called inflateInit2(strm,0); |
448 | | * in this case some zlib versions skip validation of the CINFO field and, in |
449 | | * certain circumstances, libpng may end up displaying an invalid image, in |
450 | | * contrast to implementations that call zlib in the normal way (e.g. libpng |
451 | | * 1.5). |
452 | | */ |
453 | | int /* PRIVATE */ |
454 | | png_zlib_inflate(png_structrp png_ptr, int flush) |
455 | 1.09M | { |
456 | 1.09M | if (png_ptr->zstream_start && png_ptr->zstream.avail_in > 0) |
457 | 0 | { |
458 | 0 | if ((*png_ptr->zstream.next_in >> 4) > 7) |
459 | 0 | { |
460 | 0 | png_ptr->zstream.msg = "invalid window size (libpng)"; |
461 | 0 | return Z_DATA_ERROR; |
462 | 0 | } |
463 | | |
464 | 0 | png_ptr->zstream_start = 0; |
465 | 0 | } |
466 | | |
467 | 1.09M | return inflate(&png_ptr->zstream, flush); |
468 | 1.09M | } |
469 | | #endif /* Zlib >= 1.2.4 */ |
470 | | |
471 | | #ifdef PNG_READ_COMPRESSED_TEXT_SUPPORTED |
472 | | #if defined(PNG_READ_zTXt_SUPPORTED) || defined (PNG_READ_iTXt_SUPPORTED) |
473 | | /* png_inflate now returns zlib error codes including Z_OK and Z_STREAM_END to |
474 | | * allow the caller to do multiple calls if required. If the 'finish' flag is |
475 | | * set Z_FINISH will be passed to the final inflate() call and Z_STREAM_END must |
476 | | * be returned or there has been a problem, otherwise Z_SYNC_FLUSH is used and |
477 | | * Z_OK or Z_STREAM_END will be returned on success. |
478 | | * |
479 | | * The input and output sizes are updated to the actual amounts of data consumed |
480 | | * or written, not the amount available (as in a z_stream). The data pointers |
481 | | * are not changed, so the next input is (data+input_size) and the next |
482 | | * available output is (output+output_size). |
483 | | */ |
484 | | static int |
485 | | png_inflate(png_structrp png_ptr, png_uint_32 owner, int finish, |
486 | | /* INPUT: */ png_const_bytep input, png_uint_32p input_size_ptr, |
487 | | /* OUTPUT: */ png_bytep output, png_alloc_size_t *output_size_ptr) |
488 | 6.27k | { |
489 | 6.27k | if (png_ptr->zowner == owner) /* Else not claimed */ |
490 | 6.27k | { |
491 | 6.27k | int ret; |
492 | 6.27k | png_alloc_size_t avail_out = *output_size_ptr; |
493 | 6.27k | png_uint_32 avail_in = *input_size_ptr; |
494 | | |
495 | | /* zlib can't necessarily handle more than 65535 bytes at once (i.e. it |
496 | | * can't even necessarily handle 65536 bytes) because the type uInt is |
497 | | * "16 bits or more". Consequently it is necessary to chunk the input to |
498 | | * zlib. This code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the |
499 | | * maximum value that can be stored in a uInt.) It is possible to set |
500 | | * ZLIB_IO_MAX to a lower value in pngpriv.h and this may sometimes have |
501 | | * a performance advantage, because it reduces the amount of data accessed |
502 | | * at each step and that may give the OS more time to page it in. |
503 | | */ |
504 | 6.27k | png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input); |
505 | | /* avail_in and avail_out are set below from 'size' */ |
506 | 6.27k | png_ptr->zstream.avail_in = 0; |
507 | 6.27k | png_ptr->zstream.avail_out = 0; |
508 | | |
509 | | /* Read directly into the output if it is available (this is set to |
510 | | * a local buffer below if output is NULL). |
511 | | */ |
512 | 6.27k | if (output != NULL) |
513 | 1.61k | png_ptr->zstream.next_out = output; |
514 | | |
515 | 6.27k | do |
516 | 20.9k | { |
517 | 20.9k | uInt avail; |
518 | 20.9k | Byte local_buffer[PNG_INFLATE_BUF_SIZE]; |
519 | | |
520 | | /* zlib INPUT BUFFER */ |
521 | | /* The setting of 'avail_in' used to be outside the loop; by setting it |
522 | | * inside it is possible to chunk the input to zlib and simply rely on |
523 | | * zlib to advance the 'next_in' pointer. This allows arbitrary |
524 | | * amounts of data to be passed through zlib at the unavoidable cost of |
525 | | * requiring a window save (memcpy of up to 32768 output bytes) |
526 | | * every ZLIB_IO_MAX input bytes. |
527 | | */ |
528 | 20.9k | avail_in += png_ptr->zstream.avail_in; /* not consumed last time */ |
529 | | |
530 | 20.9k | avail = ZLIB_IO_MAX; |
531 | | |
532 | 20.9k | if (avail_in < avail) |
533 | 20.9k | avail = (uInt)avail_in; /* safe: < than ZLIB_IO_MAX */ |
534 | | |
535 | 20.9k | avail_in -= avail; |
536 | 20.9k | png_ptr->zstream.avail_in = avail; |
537 | | |
538 | | /* zlib OUTPUT BUFFER */ |
539 | 20.9k | avail_out += png_ptr->zstream.avail_out; /* not written last time */ |
540 | | |
541 | 20.9k | avail = ZLIB_IO_MAX; /* maximum zlib can process */ |
542 | | |
543 | 20.9k | if (output == NULL) |
544 | 19.3k | { |
545 | | /* Reset the output buffer each time round if output is NULL and |
546 | | * make available the full buffer, up to 'remaining_space' |
547 | | */ |
548 | 19.3k | png_ptr->zstream.next_out = local_buffer; |
549 | 19.3k | if ((sizeof local_buffer) < avail) |
550 | 19.3k | avail = (sizeof local_buffer); |
551 | 19.3k | } |
552 | | |
553 | 20.9k | if (avail_out < avail) |
554 | 1.61k | avail = (uInt)avail_out; /* safe: < ZLIB_IO_MAX */ |
555 | | |
556 | 20.9k | png_ptr->zstream.avail_out = avail; |
557 | 20.9k | avail_out -= avail; |
558 | | |
559 | | /* zlib inflate call */ |
560 | | /* In fact 'avail_out' may be 0 at this point, that happens at the end |
561 | | * of the read when the final LZ end code was not passed at the end of |
562 | | * the previous chunk of input data. Tell zlib if we have reached the |
563 | | * end of the output buffer. |
564 | | */ |
565 | 20.9k | ret = PNG_INFLATE(png_ptr, avail_out > 0 ? Z_NO_FLUSH : |
566 | 20.9k | (finish ? Z_FINISH : Z_SYNC_FLUSH)); |
567 | 20.9k | } while (ret == Z_OK); |
568 | | |
569 | | /* For safety kill the local buffer pointer now */ |
570 | 6.27k | if (output == NULL) |
571 | 4.66k | png_ptr->zstream.next_out = NULL; |
572 | | |
573 | | /* Claw back the 'size' and 'remaining_space' byte counts. */ |
574 | 6.27k | avail_in += png_ptr->zstream.avail_in; |
575 | 6.27k | avail_out += png_ptr->zstream.avail_out; |
576 | | |
577 | | /* Update the input and output sizes; the updated values are the amount |
578 | | * consumed or written, effectively the inverse of what zlib uses. |
579 | | */ |
580 | 6.27k | if (avail_out > 0) |
581 | 4.66k | *output_size_ptr -= avail_out; |
582 | | |
583 | 6.27k | if (avail_in > 0) |
584 | 1.73k | *input_size_ptr -= avail_in; |
585 | | |
586 | | /* Ensure png_ptr->zstream.msg is set (even in the success case!) */ |
587 | 6.27k | png_zstream_error(png_ptr, ret); |
588 | 6.27k | return ret; |
589 | 6.27k | } |
590 | | |
591 | 0 | else |
592 | 0 | { |
593 | | /* This is a bad internal error. The recovery assigns to the zstream msg |
594 | | * pointer, which is not owned by the caller, but this is safe; it's only |
595 | | * used on errors! |
596 | | */ |
597 | 0 | png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed"); |
598 | 0 | return Z_STREAM_ERROR; |
599 | 0 | } |
600 | 6.27k | } |
601 | | |
602 | | /* |
603 | | * Decompress trailing data in a chunk. The assumption is that read_buffer |
604 | | * points at an allocated area holding the contents of a chunk with a |
605 | | * trailing compressed part. What we get back is an allocated area |
606 | | * holding the original prefix part and an uncompressed version of the |
607 | | * trailing part (the malloc area passed in is freed). |
608 | | */ |
609 | | static int |
610 | | png_decompress_chunk(png_structrp png_ptr, |
611 | | png_uint_32 chunklength, png_uint_32 prefix_size, |
612 | | png_alloc_size_t *newlength /* must be initialized to the maximum! */, |
613 | | int terminate /*add a '\0' to the end of the uncompressed data*/) |
614 | 4.66k | { |
615 | | /* TODO: implement different limits for different types of chunk. |
616 | | * |
617 | | * The caller supplies *newlength set to the maximum length of the |
618 | | * uncompressed data, but this routine allocates space for the prefix and |
619 | | * maybe a '\0' terminator too. We have to assume that 'prefix_size' is |
620 | | * limited only by the maximum chunk size. |
621 | | */ |
622 | 4.66k | png_alloc_size_t limit = PNG_SIZE_MAX; |
623 | | |
624 | 4.66k | # ifdef PNG_SET_USER_LIMITS_SUPPORTED |
625 | 4.66k | if (png_ptr->user_chunk_malloc_max > 0 && |
626 | 4.66k | png_ptr->user_chunk_malloc_max < limit) |
627 | 4.66k | limit = png_ptr->user_chunk_malloc_max; |
628 | | # elif PNG_USER_CHUNK_MALLOC_MAX > 0 |
629 | | if (PNG_USER_CHUNK_MALLOC_MAX < limit) |
630 | | limit = PNG_USER_CHUNK_MALLOC_MAX; |
631 | | # endif |
632 | | |
633 | 4.66k | if (limit >= prefix_size + (terminate != 0)) |
634 | 4.66k | { |
635 | 4.66k | int ret; |
636 | | |
637 | 4.66k | limit -= prefix_size + (terminate != 0); |
638 | | |
639 | 4.66k | if (limit < *newlength) |
640 | 4.66k | *newlength = limit; |
641 | | |
642 | | /* Now try to claim the stream. */ |
643 | 4.66k | ret = png_inflate_claim(png_ptr, png_ptr->chunk_name); |
644 | | |
645 | 4.66k | if (ret == Z_OK) |
646 | 4.66k | { |
647 | 4.66k | png_uint_32 lzsize = chunklength - prefix_size; |
648 | | |
649 | 4.66k | ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/, |
650 | 4.66k | /* input: */ png_ptr->read_buffer + prefix_size, &lzsize, |
651 | | /* output: */ NULL, newlength); |
652 | | |
653 | 4.66k | if (ret == Z_STREAM_END) |
654 | 1.61k | { |
655 | | /* Use 'inflateReset' here, not 'inflateReset2' because this |
656 | | * preserves the previously decided window size (otherwise it would |
657 | | * be necessary to store the previous window size.) In practice |
658 | | * this doesn't matter anyway, because png_inflate will call inflate |
659 | | * with Z_FINISH in almost all cases, so the window will not be |
660 | | * maintained. |
661 | | */ |
662 | 1.61k | if (inflateReset(&png_ptr->zstream) == Z_OK) |
663 | 1.61k | { |
664 | | /* Because of the limit checks above we know that the new, |
665 | | * expanded, size will fit in a size_t (let alone an |
666 | | * png_alloc_size_t). Use png_malloc_base here to avoid an |
667 | | * extra OOM message. |
668 | | */ |
669 | 1.61k | png_alloc_size_t new_size = *newlength; |
670 | 1.61k | png_alloc_size_t buffer_size = prefix_size + new_size + |
671 | 1.61k | (terminate != 0); |
672 | 1.61k | png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr, |
673 | 1.61k | buffer_size)); |
674 | | |
675 | 1.61k | if (text != NULL) |
676 | 1.61k | { |
677 | 1.61k | memset(text, 0, buffer_size); |
678 | | |
679 | 1.61k | ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/, |
680 | 1.61k | png_ptr->read_buffer + prefix_size, &lzsize, |
681 | 1.61k | text + prefix_size, newlength); |
682 | | |
683 | 1.61k | if (ret == Z_STREAM_END) |
684 | 1.61k | { |
685 | 1.61k | if (new_size == *newlength) |
686 | 1.61k | { |
687 | 1.61k | if (terminate != 0) |
688 | 1.61k | text[prefix_size + *newlength] = 0; |
689 | | |
690 | 1.61k | if (prefix_size > 0) |
691 | 1.61k | memcpy(text, png_ptr->read_buffer, prefix_size); |
692 | | |
693 | 1.61k | { |
694 | 1.61k | png_bytep old_ptr = png_ptr->read_buffer; |
695 | | |
696 | 1.61k | png_ptr->read_buffer = text; |
697 | 1.61k | png_ptr->read_buffer_size = buffer_size; |
698 | 1.61k | text = old_ptr; /* freed below */ |
699 | 1.61k | } |
700 | 1.61k | } |
701 | | |
702 | 0 | else |
703 | 0 | { |
704 | | /* The size changed on the second read, there can be no |
705 | | * guarantee that anything is correct at this point. |
706 | | * The 'msg' pointer has been set to "unexpected end of |
707 | | * LZ stream", which is fine, but return an error code |
708 | | * that the caller won't accept. |
709 | | */ |
710 | 0 | ret = PNG_UNEXPECTED_ZLIB_RETURN; |
711 | 0 | } |
712 | 1.61k | } |
713 | | |
714 | 0 | else if (ret == Z_OK) |
715 | 0 | ret = PNG_UNEXPECTED_ZLIB_RETURN; /* for safety */ |
716 | | |
717 | | /* Free the text pointer (this is the old read_buffer on |
718 | | * success) |
719 | | */ |
720 | 1.61k | png_free(png_ptr, text); |
721 | | |
722 | | /* This really is very benign, but it's still an error because |
723 | | * the extra space may otherwise be used as a Trojan Horse. |
724 | | */ |
725 | 1.61k | if (ret == Z_STREAM_END && |
726 | 1.61k | chunklength - prefix_size != lzsize) |
727 | 528 | png_chunk_benign_error(png_ptr, "extra compressed data"); |
728 | 1.61k | } |
729 | | |
730 | 0 | else |
731 | 0 | { |
732 | | /* Out of memory allocating the buffer */ |
733 | 0 | ret = Z_MEM_ERROR; |
734 | 0 | png_zstream_error(png_ptr, Z_MEM_ERROR); |
735 | 0 | } |
736 | 1.61k | } |
737 | | |
738 | 0 | else |
739 | 0 | { |
740 | | /* inflateReset failed, store the error message */ |
741 | 0 | png_zstream_error(png_ptr, ret); |
742 | 0 | ret = PNG_UNEXPECTED_ZLIB_RETURN; |
743 | 0 | } |
744 | 1.61k | } |
745 | | |
746 | 3.05k | else if (ret == Z_OK) |
747 | 0 | ret = PNG_UNEXPECTED_ZLIB_RETURN; |
748 | | |
749 | | /* Release the claimed stream */ |
750 | 4.66k | png_ptr->zowner = 0; |
751 | 4.66k | } |
752 | | |
753 | 0 | else /* the claim failed */ if (ret == Z_STREAM_END) /* impossible! */ |
754 | 0 | ret = PNG_UNEXPECTED_ZLIB_RETURN; |
755 | | |
756 | 4.66k | return ret; |
757 | 4.66k | } |
758 | | |
759 | 0 | else |
760 | 0 | { |
761 | | /* Application/configuration limits exceeded */ |
762 | 0 | png_zstream_error(png_ptr, Z_MEM_ERROR); |
763 | 0 | return Z_MEM_ERROR; |
764 | 0 | } |
765 | 4.66k | } |
766 | | #endif /* READ_zTXt || READ_iTXt */ |
767 | | #endif /* READ_COMPRESSED_TEXT */ |
768 | | |
769 | | #ifdef PNG_READ_iCCP_SUPPORTED |
770 | | /* Perform a partial read and decompress, producing 'avail_out' bytes and |
771 | | * reading from the current chunk as required. |
772 | | */ |
773 | | static int |
774 | | png_inflate_read(png_structrp png_ptr, png_bytep read_buffer, uInt read_size, |
775 | | png_uint_32p chunk_bytes, png_bytep next_out, png_alloc_size_t *out_size, |
776 | | int finish) |
777 | 31.6k | { |
778 | 31.6k | if (png_ptr->zowner == png_ptr->chunk_name) |
779 | 31.6k | { |
780 | 31.6k | int ret; |
781 | | |
782 | | /* next_in and avail_in must have been initialized by the caller. */ |
783 | 31.6k | png_ptr->zstream.next_out = next_out; |
784 | 31.6k | png_ptr->zstream.avail_out = 0; /* set in the loop */ |
785 | | |
786 | 31.6k | do |
787 | 39.9k | { |
788 | 39.9k | if (png_ptr->zstream.avail_in == 0) |
789 | 14.8k | { |
790 | 14.8k | if (read_size > *chunk_bytes) |
791 | 14.4k | read_size = (uInt)*chunk_bytes; |
792 | 14.8k | *chunk_bytes -= read_size; |
793 | | |
794 | 14.8k | if (read_size > 0) |
795 | 9.29k | png_crc_read(png_ptr, read_buffer, read_size); |
796 | | |
797 | 14.8k | png_ptr->zstream.next_in = read_buffer; |
798 | 14.8k | png_ptr->zstream.avail_in = read_size; |
799 | 14.8k | } |
800 | | |
801 | 39.9k | if (png_ptr->zstream.avail_out == 0) |
802 | 31.6k | { |
803 | 31.6k | uInt avail = ZLIB_IO_MAX; |
804 | 31.6k | if (avail > *out_size) |
805 | 31.6k | avail = (uInt)*out_size; |
806 | 31.6k | *out_size -= avail; |
807 | | |
808 | 31.6k | png_ptr->zstream.avail_out = avail; |
809 | 31.6k | } |
810 | | |
811 | | /* Use Z_SYNC_FLUSH when there is no more chunk data to ensure that all |
812 | | * the available output is produced; this allows reading of truncated |
813 | | * streams. |
814 | | */ |
815 | 39.9k | ret = PNG_INFLATE(png_ptr, *chunk_bytes > 0 ? |
816 | 39.9k | Z_NO_FLUSH : (finish ? Z_FINISH : Z_SYNC_FLUSH)); |
817 | 39.9k | } |
818 | 39.9k | while (ret == Z_OK && (*out_size > 0 || png_ptr->zstream.avail_out > 0)); |
819 | | |
820 | 31.6k | *out_size += png_ptr->zstream.avail_out; |
821 | 31.6k | png_ptr->zstream.avail_out = 0; /* Should not be required, but is safe */ |
822 | | |
823 | | /* Ensure the error message pointer is always set: */ |
824 | 31.6k | png_zstream_error(png_ptr, ret); |
825 | 31.6k | return ret; |
826 | 31.6k | } |
827 | | |
828 | 0 | else |
829 | 0 | { |
830 | 0 | png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed"); |
831 | 0 | return Z_STREAM_ERROR; |
832 | 0 | } |
833 | 31.6k | } |
834 | | #endif /* READ_iCCP */ |
835 | | |
836 | | /* Read and check the IDHR chunk */ |
837 | | |
838 | | void /* PRIVATE */ |
839 | | png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
840 | 13.7k | { |
841 | 13.7k | png_byte buf[13]; |
842 | 13.7k | png_uint_32 width, height; |
843 | 13.7k | int bit_depth, color_type, compression_type, filter_type; |
844 | 13.7k | int interlace_type; |
845 | | |
846 | 13.7k | png_debug(1, "in png_handle_IHDR"); |
847 | | |
848 | 13.7k | if ((png_ptr->mode & PNG_HAVE_IHDR) != 0) |
849 | 107 | png_chunk_error(png_ptr, "out of place"); |
850 | | |
851 | | /* Check the length */ |
852 | 13.6k | if (length != 13) |
853 | 0 | png_chunk_error(png_ptr, "invalid"); |
854 | | |
855 | 13.6k | png_ptr->mode |= PNG_HAVE_IHDR; |
856 | | |
857 | 13.6k | png_crc_read(png_ptr, buf, 13); |
858 | 13.6k | png_crc_finish(png_ptr, 0); |
859 | | |
860 | 13.6k | width = png_get_uint_31(png_ptr, buf); |
861 | 13.6k | height = png_get_uint_31(png_ptr, buf + 4); |
862 | 13.6k | bit_depth = buf[8]; |
863 | 13.6k | color_type = buf[9]; |
864 | 13.6k | compression_type = buf[10]; |
865 | 13.6k | filter_type = buf[11]; |
866 | 13.6k | interlace_type = buf[12]; |
867 | | |
868 | | /* Set internal variables */ |
869 | 13.6k | png_ptr->width = width; |
870 | 13.6k | png_ptr->height = height; |
871 | 13.6k | png_ptr->bit_depth = (png_byte)bit_depth; |
872 | 13.6k | png_ptr->interlaced = (png_byte)interlace_type; |
873 | 13.6k | png_ptr->color_type = (png_byte)color_type; |
874 | 13.6k | #ifdef PNG_MNG_FEATURES_SUPPORTED |
875 | 13.6k | png_ptr->filter_type = (png_byte)filter_type; |
876 | 13.6k | #endif |
877 | 13.6k | png_ptr->compression_type = (png_byte)compression_type; |
878 | | |
879 | | /* Find number of channels */ |
880 | 13.6k | switch (png_ptr->color_type) |
881 | 13.6k | { |
882 | 44 | default: /* invalid, png_set_IHDR calls png_error */ |
883 | 4.12k | case PNG_COLOR_TYPE_GRAY: |
884 | 7.75k | case PNG_COLOR_TYPE_PALETTE: |
885 | 7.75k | png_ptr->channels = 1; |
886 | 7.75k | break; |
887 | | |
888 | 3.91k | case PNG_COLOR_TYPE_RGB: |
889 | 3.91k | png_ptr->channels = 3; |
890 | 3.91k | break; |
891 | | |
892 | 241 | case PNG_COLOR_TYPE_GRAY_ALPHA: |
893 | 241 | png_ptr->channels = 2; |
894 | 241 | break; |
895 | | |
896 | 1.70k | case PNG_COLOR_TYPE_RGB_ALPHA: |
897 | 1.70k | png_ptr->channels = 4; |
898 | 1.70k | break; |
899 | 13.6k | } |
900 | | |
901 | | /* Set up other useful info */ |
902 | 13.6k | png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels); |
903 | 13.6k | png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width); |
904 | 13.6k | png_debug1(3, "bit_depth = %d", png_ptr->bit_depth); |
905 | 13.6k | png_debug1(3, "channels = %d", png_ptr->channels); |
906 | 13.6k | png_debug1(3, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes); |
907 | 13.6k | png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth, |
908 | 13.6k | color_type, interlace_type, compression_type, filter_type); |
909 | 13.6k | } |
910 | | |
911 | | /* Read and check the palette */ |
912 | | void /* PRIVATE */ |
913 | | png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
914 | 1.83k | { |
915 | 1.83k | png_color palette[PNG_MAX_PALETTE_LENGTH]; |
916 | 1.83k | int max_palette_length, num, i; |
917 | 1.83k | #ifdef PNG_POINTER_INDEXING_SUPPORTED |
918 | 1.83k | png_colorp pal_ptr; |
919 | 1.83k | #endif |
920 | | |
921 | 1.83k | png_debug(1, "in png_handle_PLTE"); |
922 | | |
923 | 1.83k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
924 | 40 | png_chunk_error(png_ptr, "missing IHDR"); |
925 | | |
926 | | /* Moved to before the 'after IDAT' check below because otherwise duplicate |
927 | | * PLTE chunks are potentially ignored (the spec says there shall not be more |
928 | | * than one PLTE, the error is not treated as benign, so this check trumps |
929 | | * the requirement that PLTE appears before IDAT.) |
930 | | */ |
931 | 1.79k | else if ((png_ptr->mode & PNG_HAVE_PLTE) != 0) |
932 | 12 | png_chunk_error(png_ptr, "duplicate"); |
933 | | |
934 | 1.78k | else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
935 | 119 | { |
936 | | /* This is benign because the non-benign error happened before, when an |
937 | | * IDAT was encountered in a color-mapped image with no PLTE. |
938 | | */ |
939 | 119 | png_crc_finish(png_ptr, length); |
940 | 119 | png_chunk_benign_error(png_ptr, "out of place"); |
941 | 119 | return; |
942 | 119 | } |
943 | | |
944 | 1.66k | png_ptr->mode |= PNG_HAVE_PLTE; |
945 | | |
946 | 1.66k | if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) |
947 | 340 | { |
948 | 340 | png_crc_finish(png_ptr, length); |
949 | 340 | png_chunk_benign_error(png_ptr, "ignored in grayscale PNG"); |
950 | 340 | return; |
951 | 340 | } |
952 | | |
953 | 1.32k | #ifndef PNG_READ_OPT_PLTE_SUPPORTED |
954 | 1.32k | if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE) |
955 | 167 | { |
956 | 167 | png_crc_finish(png_ptr, length); |
957 | 167 | return; |
958 | 167 | } |
959 | 1.15k | #endif |
960 | | |
961 | 1.15k | if (length > 3*PNG_MAX_PALETTE_LENGTH || length % 3) |
962 | 65 | { |
963 | 65 | png_crc_finish(png_ptr, length); |
964 | | |
965 | 65 | if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE) |
966 | 0 | png_chunk_benign_error(png_ptr, "invalid"); |
967 | | |
968 | 65 | else |
969 | 65 | png_chunk_error(png_ptr, "invalid"); |
970 | | |
971 | 0 | return; |
972 | 0 | } |
973 | | |
974 | | /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */ |
975 | 1.08k | num = (int)length / 3; |
976 | | |
977 | | /* If the palette has 256 or fewer entries but is too large for the bit |
978 | | * depth, we don't issue an error, to preserve the behavior of previous |
979 | | * libpng versions. We silently truncate the unused extra palette entries |
980 | | * here. |
981 | | */ |
982 | 1.08k | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) |
983 | 1.08k | max_palette_length = (1 << png_ptr->bit_depth); |
984 | 0 | else |
985 | 0 | max_palette_length = PNG_MAX_PALETTE_LENGTH; |
986 | | |
987 | 1.08k | if (num > max_palette_length) |
988 | 52 | num = max_palette_length; |
989 | | |
990 | 1.08k | #ifdef PNG_POINTER_INDEXING_SUPPORTED |
991 | 11.7k | for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++) |
992 | 10.6k | { |
993 | 10.6k | png_byte buf[3]; |
994 | | |
995 | 10.6k | png_crc_read(png_ptr, buf, 3); |
996 | 10.6k | pal_ptr->red = buf[0]; |
997 | 10.6k | pal_ptr->green = buf[1]; |
998 | 10.6k | pal_ptr->blue = buf[2]; |
999 | 10.6k | } |
1000 | | #else |
1001 | | for (i = 0; i < num; i++) |
1002 | | { |
1003 | | png_byte buf[3]; |
1004 | | |
1005 | | png_crc_read(png_ptr, buf, 3); |
1006 | | /* Don't depend upon png_color being any order */ |
1007 | | palette[i].red = buf[0]; |
1008 | | palette[i].green = buf[1]; |
1009 | | palette[i].blue = buf[2]; |
1010 | | } |
1011 | | #endif |
1012 | | |
1013 | | /* If we actually need the PLTE chunk (ie for a paletted image), we do |
1014 | | * whatever the normal CRC configuration tells us. However, if we |
1015 | | * have an RGB image, the PLTE can be considered ancillary, so |
1016 | | * we will act as though it is. |
1017 | | */ |
1018 | 1.08k | #ifndef PNG_READ_OPT_PLTE_SUPPORTED |
1019 | 1.08k | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) |
1020 | 1.08k | #endif |
1021 | 1.08k | { |
1022 | 1.08k | png_crc_finish(png_ptr, (png_uint_32) (length - (unsigned int)num * 3)); |
1023 | 1.08k | } |
1024 | | |
1025 | 0 | #ifndef PNG_READ_OPT_PLTE_SUPPORTED |
1026 | 0 | else if (png_crc_error(png_ptr) != 0) /* Only if we have a CRC error */ |
1027 | 0 | { |
1028 | | /* If we don't want to use the data from an ancillary chunk, |
1029 | | * we have two options: an error abort, or a warning and we |
1030 | | * ignore the data in this chunk (which should be OK, since |
1031 | | * it's considered ancillary for a RGB or RGBA image). |
1032 | | * |
1033 | | * IMPLEMENTATION NOTE: this is only here because png_crc_finish uses the |
1034 | | * chunk type to determine whether to check the ancillary or the critical |
1035 | | * flags. |
1036 | | */ |
1037 | 0 | if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE) == 0) |
1038 | 0 | { |
1039 | 0 | if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) != 0) |
1040 | 0 | return; |
1041 | | |
1042 | 0 | else |
1043 | 0 | png_chunk_error(png_ptr, "CRC error"); |
1044 | 0 | } |
1045 | | |
1046 | | /* Otherwise, we (optionally) emit a warning and use the chunk. */ |
1047 | 0 | else if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == 0) |
1048 | 0 | png_chunk_warning(png_ptr, "CRC error"); |
1049 | 0 | } |
1050 | 1.08k | #endif |
1051 | | |
1052 | | /* TODO: png_set_PLTE has the side effect of setting png_ptr->palette to its |
1053 | | * own copy of the palette. This has the side effect that when png_start_row |
1054 | | * is called (this happens after any call to png_read_update_info) the |
1055 | | * info_ptr palette gets changed. This is extremely unexpected and |
1056 | | * confusing. |
1057 | | * |
1058 | | * Fix this by not sharing the palette in this way. |
1059 | | */ |
1060 | 1.08k | png_set_PLTE(png_ptr, info_ptr, palette, num); |
1061 | | |
1062 | | /* The three chunks, bKGD, hIST and tRNS *must* appear after PLTE and before |
1063 | | * IDAT. Prior to 1.6.0 this was not checked; instead the code merely |
1064 | | * checked the apparent validity of a tRNS chunk inserted before PLTE on a |
1065 | | * palette PNG. 1.6.0 attempts to rigorously follow the standard and |
1066 | | * therefore does a benign error if the erroneous condition is detected *and* |
1067 | | * cancels the tRNS if the benign error returns. The alternative is to |
1068 | | * amend the standard since it would be rather hypocritical of the standards |
1069 | | * maintainers to ignore it. |
1070 | | */ |
1071 | 1.08k | #ifdef PNG_READ_tRNS_SUPPORTED |
1072 | 1.08k | if (png_ptr->num_trans > 0 || |
1073 | 1.00k | (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != 0)) |
1074 | 0 | { |
1075 | | /* Cancel this because otherwise it would be used if the transforms |
1076 | | * require it. Don't cancel the 'valid' flag because this would prevent |
1077 | | * detection of duplicate chunks. |
1078 | | */ |
1079 | 0 | png_ptr->num_trans = 0; |
1080 | |
|
1081 | 0 | if (info_ptr != NULL) |
1082 | 0 | info_ptr->num_trans = 0; |
1083 | |
|
1084 | 0 | png_chunk_benign_error(png_ptr, "tRNS must be after"); |
1085 | 0 | } |
1086 | 1.08k | #endif |
1087 | | |
1088 | 1.08k | #ifdef PNG_READ_hIST_SUPPORTED |
1089 | 1.08k | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != 0) |
1090 | 0 | png_chunk_benign_error(png_ptr, "hIST must be after"); |
1091 | 1.08k | #endif |
1092 | | |
1093 | 1.08k | #ifdef PNG_READ_bKGD_SUPPORTED |
1094 | 1.08k | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != 0) |
1095 | 0 | png_chunk_benign_error(png_ptr, "bKGD must be after"); |
1096 | 1.08k | #endif |
1097 | 1.08k | } |
1098 | | |
1099 | | void /* PRIVATE */ |
1100 | | png_handle_IEND(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
1101 | 226 | { |
1102 | 226 | png_debug(1, "in png_handle_IEND"); |
1103 | | |
1104 | 226 | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0 || |
1105 | 211 | (png_ptr->mode & PNG_HAVE_IDAT) == 0) |
1106 | 175 | png_chunk_error(png_ptr, "out of place"); |
1107 | | |
1108 | 51 | png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND); |
1109 | | |
1110 | 51 | png_crc_finish(png_ptr, length); |
1111 | | |
1112 | 51 | if (length != 0) |
1113 | 1 | png_chunk_benign_error(png_ptr, "invalid"); |
1114 | | |
1115 | 51 | PNG_UNUSED(info_ptr) |
1116 | 51 | } |
1117 | | |
1118 | | #ifdef PNG_READ_gAMA_SUPPORTED |
1119 | | void /* PRIVATE */ |
1120 | | png_handle_gAMA(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
1121 | 6.44k | { |
1122 | 6.44k | png_fixed_point igamma; |
1123 | 6.44k | png_byte buf[4]; |
1124 | | |
1125 | 6.44k | png_debug(1, "in png_handle_gAMA"); |
1126 | | |
1127 | 6.44k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
1128 | 23 | png_chunk_error(png_ptr, "missing IHDR"); |
1129 | | |
1130 | 6.42k | else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0) |
1131 | 573 | { |
1132 | 573 | png_crc_finish(png_ptr, length); |
1133 | 573 | png_chunk_benign_error(png_ptr, "out of place"); |
1134 | 573 | return; |
1135 | 573 | } |
1136 | | |
1137 | 5.84k | if (length != 4) |
1138 | 597 | { |
1139 | 597 | png_crc_finish(png_ptr, length); |
1140 | 597 | png_chunk_benign_error(png_ptr, "invalid"); |
1141 | 597 | return; |
1142 | 597 | } |
1143 | | |
1144 | 5.25k | png_crc_read(png_ptr, buf, 4); |
1145 | | |
1146 | 5.25k | if (png_crc_finish(png_ptr, 0) != 0) |
1147 | 1.04k | return; |
1148 | | |
1149 | 4.21k | igamma = png_get_fixed_point(NULL, buf); |
1150 | | |
1151 | 4.21k | png_colorspace_set_gamma(png_ptr, &png_ptr->colorspace, igamma); |
1152 | 4.21k | png_colorspace_sync(png_ptr, info_ptr); |
1153 | 4.21k | } |
1154 | | #endif |
1155 | | |
1156 | | #ifdef PNG_READ_sBIT_SUPPORTED |
1157 | | void /* PRIVATE */ |
1158 | | png_handle_sBIT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
1159 | 4.34k | { |
1160 | 4.34k | unsigned int truelen, i; |
1161 | 4.34k | png_byte sample_depth; |
1162 | 4.34k | png_byte buf[4]; |
1163 | | |
1164 | 4.34k | png_debug(1, "in png_handle_sBIT"); |
1165 | | |
1166 | 4.34k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
1167 | 37 | png_chunk_error(png_ptr, "missing IHDR"); |
1168 | | |
1169 | 4.30k | else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0) |
1170 | 349 | { |
1171 | 349 | png_crc_finish(png_ptr, length); |
1172 | 349 | png_chunk_benign_error(png_ptr, "out of place"); |
1173 | 349 | return; |
1174 | 349 | } |
1175 | | |
1176 | 3.95k | if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT) != 0) |
1177 | 812 | { |
1178 | 812 | png_crc_finish(png_ptr, length); |
1179 | 812 | png_chunk_benign_error(png_ptr, "duplicate"); |
1180 | 812 | return; |
1181 | 812 | } |
1182 | | |
1183 | 3.14k | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) |
1184 | 1.24k | { |
1185 | 1.24k | truelen = 3; |
1186 | 1.24k | sample_depth = 8; |
1187 | 1.24k | } |
1188 | | |
1189 | 1.89k | else |
1190 | 1.89k | { |
1191 | 1.89k | truelen = png_ptr->channels; |
1192 | 1.89k | sample_depth = png_ptr->bit_depth; |
1193 | 1.89k | } |
1194 | | |
1195 | 3.14k | if (length != truelen || length > 4) |
1196 | 542 | { |
1197 | 542 | png_chunk_benign_error(png_ptr, "invalid"); |
1198 | 542 | png_crc_finish(png_ptr, length); |
1199 | 542 | return; |
1200 | 542 | } |
1201 | | |
1202 | 2.60k | buf[0] = buf[1] = buf[2] = buf[3] = sample_depth; |
1203 | 2.60k | png_crc_read(png_ptr, buf, truelen); |
1204 | | |
1205 | 2.60k | if (png_crc_finish(png_ptr, 0) != 0) |
1206 | 989 | return; |
1207 | | |
1208 | 5.12k | for (i=0; i<truelen; ++i) |
1209 | 5.02k | { |
1210 | 5.02k | if (buf[i] == 0 || buf[i] > sample_depth) |
1211 | 1.50k | { |
1212 | 1.50k | png_chunk_benign_error(png_ptr, "invalid"); |
1213 | 1.50k | return; |
1214 | 1.50k | } |
1215 | 5.02k | } |
1216 | | |
1217 | 105 | if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0) |
1218 | 67 | { |
1219 | 67 | png_ptr->sig_bit.red = buf[0]; |
1220 | 67 | png_ptr->sig_bit.green = buf[1]; |
1221 | 67 | png_ptr->sig_bit.blue = buf[2]; |
1222 | 67 | png_ptr->sig_bit.alpha = buf[3]; |
1223 | 67 | } |
1224 | | |
1225 | 38 | else |
1226 | 38 | { |
1227 | 38 | png_ptr->sig_bit.gray = buf[0]; |
1228 | 38 | png_ptr->sig_bit.red = buf[0]; |
1229 | 38 | png_ptr->sig_bit.green = buf[0]; |
1230 | 38 | png_ptr->sig_bit.blue = buf[0]; |
1231 | 38 | png_ptr->sig_bit.alpha = buf[1]; |
1232 | 38 | } |
1233 | | |
1234 | 105 | png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit)); |
1235 | 105 | } |
1236 | | #endif |
1237 | | |
1238 | | #ifdef PNG_READ_cHRM_SUPPORTED |
1239 | | void /* PRIVATE */ |
1240 | | png_handle_cHRM(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
1241 | 5.34k | { |
1242 | 5.34k | png_byte buf[32]; |
1243 | 5.34k | png_xy xy; |
1244 | | |
1245 | 5.34k | png_debug(1, "in png_handle_cHRM"); |
1246 | | |
1247 | 5.34k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
1248 | 38 | png_chunk_error(png_ptr, "missing IHDR"); |
1249 | | |
1250 | 5.31k | else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0) |
1251 | 596 | { |
1252 | 596 | png_crc_finish(png_ptr, length); |
1253 | 596 | png_chunk_benign_error(png_ptr, "out of place"); |
1254 | 596 | return; |
1255 | 596 | } |
1256 | | |
1257 | 4.71k | if (length != 32) |
1258 | 644 | { |
1259 | 644 | png_crc_finish(png_ptr, length); |
1260 | 644 | png_chunk_benign_error(png_ptr, "invalid"); |
1261 | 644 | return; |
1262 | 644 | } |
1263 | | |
1264 | 4.07k | png_crc_read(png_ptr, buf, 32); |
1265 | | |
1266 | 4.07k | if (png_crc_finish(png_ptr, 0) != 0) |
1267 | 961 | return; |
1268 | | |
1269 | 3.10k | xy.whitex = png_get_fixed_point(NULL, buf); |
1270 | 3.10k | xy.whitey = png_get_fixed_point(NULL, buf + 4); |
1271 | 3.10k | xy.redx = png_get_fixed_point(NULL, buf + 8); |
1272 | 3.10k | xy.redy = png_get_fixed_point(NULL, buf + 12); |
1273 | 3.10k | xy.greenx = png_get_fixed_point(NULL, buf + 16); |
1274 | 3.10k | xy.greeny = png_get_fixed_point(NULL, buf + 20); |
1275 | 3.10k | xy.bluex = png_get_fixed_point(NULL, buf + 24); |
1276 | 3.10k | xy.bluey = png_get_fixed_point(NULL, buf + 28); |
1277 | | |
1278 | 3.10k | if (xy.whitex == PNG_FIXED_ERROR || |
1279 | 2.96k | xy.whitey == PNG_FIXED_ERROR || |
1280 | 2.77k | xy.redx == PNG_FIXED_ERROR || |
1281 | 2.43k | xy.redy == PNG_FIXED_ERROR || |
1282 | 1.95k | xy.greenx == PNG_FIXED_ERROR || |
1283 | 1.46k | xy.greeny == PNG_FIXED_ERROR || |
1284 | 1.35k | xy.bluex == PNG_FIXED_ERROR || |
1285 | 1.14k | xy.bluey == PNG_FIXED_ERROR) |
1286 | 2.14k | { |
1287 | 2.14k | png_chunk_benign_error(png_ptr, "invalid values"); |
1288 | 2.14k | return; |
1289 | 2.14k | } |
1290 | | |
1291 | | /* If a colorspace error has already been output skip this chunk */ |
1292 | 962 | if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0) |
1293 | 608 | return; |
1294 | | |
1295 | 354 | if ((png_ptr->colorspace.flags & PNG_COLORSPACE_FROM_cHRM) != 0) |
1296 | 24 | { |
1297 | 24 | png_ptr->colorspace.flags |= PNG_COLORSPACE_INVALID; |
1298 | 24 | png_colorspace_sync(png_ptr, info_ptr); |
1299 | 24 | png_chunk_benign_error(png_ptr, "duplicate"); |
1300 | 24 | return; |
1301 | 24 | } |
1302 | | |
1303 | 330 | png_ptr->colorspace.flags |= PNG_COLORSPACE_FROM_cHRM; |
1304 | 330 | (void)png_colorspace_set_chromaticities(png_ptr, &png_ptr->colorspace, &xy, |
1305 | 330 | 1/*prefer cHRM values*/); |
1306 | 330 | png_colorspace_sync(png_ptr, info_ptr); |
1307 | 330 | } |
1308 | | #endif |
1309 | | |
1310 | | #ifdef PNG_READ_sRGB_SUPPORTED |
1311 | | void /* PRIVATE */ |
1312 | | png_handle_sRGB(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
1313 | 3.24k | { |
1314 | 3.24k | png_byte intent; |
1315 | | |
1316 | 3.24k | png_debug(1, "in png_handle_sRGB"); |
1317 | | |
1318 | 3.24k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
1319 | 34 | png_chunk_error(png_ptr, "missing IHDR"); |
1320 | | |
1321 | 3.21k | else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0) |
1322 | 476 | { |
1323 | 476 | png_crc_finish(png_ptr, length); |
1324 | 476 | png_chunk_benign_error(png_ptr, "out of place"); |
1325 | 476 | return; |
1326 | 476 | } |
1327 | | |
1328 | 2.73k | if (length != 1) |
1329 | 356 | { |
1330 | 356 | png_crc_finish(png_ptr, length); |
1331 | 356 | png_chunk_benign_error(png_ptr, "invalid"); |
1332 | 356 | return; |
1333 | 356 | } |
1334 | | |
1335 | 2.38k | png_crc_read(png_ptr, &intent, 1); |
1336 | | |
1337 | 2.38k | if (png_crc_finish(png_ptr, 0) != 0) |
1338 | 828 | return; |
1339 | | |
1340 | | /* If a colorspace error has already been output skip this chunk */ |
1341 | 1.55k | if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0) |
1342 | 1.24k | return; |
1343 | | |
1344 | | /* Only one sRGB or iCCP chunk is allowed, use the HAVE_INTENT flag to detect |
1345 | | * this. |
1346 | | */ |
1347 | 312 | if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) != 0) |
1348 | 29 | { |
1349 | 29 | png_ptr->colorspace.flags |= PNG_COLORSPACE_INVALID; |
1350 | 29 | png_colorspace_sync(png_ptr, info_ptr); |
1351 | 29 | png_chunk_benign_error(png_ptr, "too many profiles"); |
1352 | 29 | return; |
1353 | 29 | } |
1354 | | |
1355 | 283 | (void)png_colorspace_set_sRGB(png_ptr, &png_ptr->colorspace, intent); |
1356 | 283 | png_colorspace_sync(png_ptr, info_ptr); |
1357 | 283 | } |
1358 | | #endif /* READ_sRGB */ |
1359 | | |
1360 | | #ifdef PNG_READ_iCCP_SUPPORTED |
1361 | | void /* PRIVATE */ |
1362 | | png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
1363 | | /* Note: this does not properly handle profiles that are > 64K under DOS */ |
1364 | 17.2k | { |
1365 | 17.2k | png_const_charp errmsg = NULL; /* error message output, or no error */ |
1366 | 17.2k | int finished = 0; /* crc checked */ |
1367 | | |
1368 | 17.2k | png_debug(1, "in png_handle_iCCP"); |
1369 | | |
1370 | 17.2k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
1371 | 67 | png_chunk_error(png_ptr, "missing IHDR"); |
1372 | | |
1373 | 17.2k | else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0) |
1374 | 755 | { |
1375 | 755 | png_crc_finish(png_ptr, length); |
1376 | 755 | png_chunk_benign_error(png_ptr, "out of place"); |
1377 | 755 | return; |
1378 | 755 | } |
1379 | | |
1380 | | /* Consistent with all the above colorspace handling an obviously *invalid* |
1381 | | * chunk is just ignored, so does not invalidate the color space. An |
1382 | | * alternative is to set the 'invalid' flags at the start of this routine |
1383 | | * and only clear them in they were not set before and all the tests pass. |
1384 | | */ |
1385 | | |
1386 | | /* The keyword must be at least one character and there is a |
1387 | | * terminator (0) byte and the compression method byte, and the |
1388 | | * 'zlib' datastream is at least 11 bytes. |
1389 | | */ |
1390 | 16.4k | if (length < 14) |
1391 | 1.03k | { |
1392 | 1.03k | png_crc_finish(png_ptr, length); |
1393 | 1.03k | png_chunk_benign_error(png_ptr, "too short"); |
1394 | 1.03k | return; |
1395 | 1.03k | } |
1396 | | |
1397 | | /* If a colorspace error has already been output skip this chunk */ |
1398 | 15.4k | if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0) |
1399 | 1.54k | { |
1400 | 1.54k | png_crc_finish(png_ptr, length); |
1401 | 1.54k | return; |
1402 | 1.54k | } |
1403 | | |
1404 | | /* Only one sRGB or iCCP chunk is allowed, use the HAVE_INTENT flag to detect |
1405 | | * this. |
1406 | | */ |
1407 | 13.8k | if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) == 0) |
1408 | 13.8k | { |
1409 | 13.8k | uInt read_length, keyword_length; |
1410 | 13.8k | char keyword[81]; |
1411 | | |
1412 | | /* Find the keyword; the keyword plus separator and compression method |
1413 | | * bytes can be at most 81 characters long. |
1414 | | */ |
1415 | 13.8k | read_length = 81; /* maximum */ |
1416 | 13.8k | if (read_length > length) |
1417 | 690 | read_length = (uInt)length; |
1418 | | |
1419 | 13.8k | png_crc_read(png_ptr, (png_bytep)keyword, read_length); |
1420 | 13.8k | length -= read_length; |
1421 | | |
1422 | | /* The minimum 'zlib' stream is assumed to be just the 2 byte header, |
1423 | | * 5 bytes minimum 'deflate' stream, and the 4 byte checksum. |
1424 | | */ |
1425 | 13.8k | if (length < 11) |
1426 | 690 | { |
1427 | 690 | png_crc_finish(png_ptr, length); |
1428 | 690 | png_chunk_benign_error(png_ptr, "too short"); |
1429 | 690 | return; |
1430 | 690 | } |
1431 | | |
1432 | 13.1k | keyword_length = 0; |
1433 | 71.0k | while (keyword_length < 80 && keyword_length < read_length && |
1434 | 70.9k | keyword[keyword_length] != 0) |
1435 | 57.9k | ++keyword_length; |
1436 | | |
1437 | | /* TODO: make the keyword checking common */ |
1438 | 13.1k | if (keyword_length >= 1 && keyword_length <= 79) |
1439 | 12.9k | { |
1440 | | /* We only understand '0' compression - deflate - so if we get a |
1441 | | * different value we can't safely decode the chunk. |
1442 | | */ |
1443 | 12.9k | if (keyword_length+1 < read_length && |
1444 | 12.9k | keyword[keyword_length+1] == PNG_COMPRESSION_TYPE_BASE) |
1445 | 12.8k | { |
1446 | 12.8k | read_length -= keyword_length+2; |
1447 | | |
1448 | 12.8k | if (png_inflate_claim(png_ptr, png_iCCP) == Z_OK) |
1449 | 12.8k | { |
1450 | 12.8k | Byte profile_header[132]={0}; |
1451 | 12.8k | Byte local_buffer[PNG_INFLATE_BUF_SIZE]; |
1452 | 12.8k | png_alloc_size_t size = (sizeof profile_header); |
1453 | | |
1454 | 12.8k | png_ptr->zstream.next_in = (Bytef*)keyword + (keyword_length+2); |
1455 | 12.8k | png_ptr->zstream.avail_in = read_length; |
1456 | 12.8k | (void)png_inflate_read(png_ptr, local_buffer, |
1457 | 12.8k | (sizeof local_buffer), &length, profile_header, &size, |
1458 | 12.8k | 0/*finish: don't, because the output is too small*/); |
1459 | | |
1460 | 12.8k | if (size == 0) |
1461 | 10.9k | { |
1462 | | /* We have the ICC profile header; do the basic header checks. |
1463 | | */ |
1464 | 10.9k | png_uint_32 profile_length = png_get_uint_32(profile_header); |
1465 | | |
1466 | 10.9k | if (png_icc_check_length(png_ptr, &png_ptr->colorspace, |
1467 | 10.9k | keyword, profile_length) != 0) |
1468 | 10.7k | { |
1469 | | /* The length is apparently ok, so we can check the 132 |
1470 | | * byte header. |
1471 | | */ |
1472 | 10.7k | if (png_icc_check_header(png_ptr, &png_ptr->colorspace, |
1473 | 10.7k | keyword, profile_length, profile_header, |
1474 | 10.7k | png_ptr->color_type) != 0) |
1475 | 9.66k | { |
1476 | | /* Now read the tag table; a variable size buffer is |
1477 | | * needed at this point, allocate one for the whole |
1478 | | * profile. The header check has already validated |
1479 | | * that none of this stuff will overflow. |
1480 | | */ |
1481 | 9.66k | png_uint_32 tag_count = |
1482 | 9.66k | png_get_uint_32(profile_header + 128); |
1483 | 9.66k | png_bytep profile = png_read_buffer(png_ptr, |
1484 | 9.66k | profile_length, 2/*silent*/); |
1485 | | |
1486 | 9.66k | if (profile != NULL) |
1487 | 9.66k | { |
1488 | 9.66k | memcpy(profile, profile_header, |
1489 | 9.66k | (sizeof profile_header)); |
1490 | | |
1491 | 9.66k | size = 12 * tag_count; |
1492 | | |
1493 | 9.66k | (void)png_inflate_read(png_ptr, local_buffer, |
1494 | 9.66k | (sizeof local_buffer), &length, |
1495 | 9.66k | profile + (sizeof profile_header), &size, 0); |
1496 | | |
1497 | | /* Still expect a buffer error because we expect |
1498 | | * there to be some tag data! |
1499 | | */ |
1500 | 9.66k | if (size == 0) |
1501 | 9.48k | { |
1502 | 9.48k | if (png_icc_check_tag_table(png_ptr, |
1503 | 9.48k | &png_ptr->colorspace, keyword, profile_length, |
1504 | 9.48k | profile) != 0) |
1505 | 9.16k | { |
1506 | | /* The profile has been validated for basic |
1507 | | * security issues, so read the whole thing in. |
1508 | | */ |
1509 | 9.16k | size = profile_length - (sizeof profile_header) |
1510 | 9.16k | - 12 * tag_count; |
1511 | | |
1512 | 9.16k | (void)png_inflate_read(png_ptr, local_buffer, |
1513 | 9.16k | (sizeof local_buffer), &length, |
1514 | 9.16k | profile + (sizeof profile_header) + |
1515 | 9.16k | 12 * tag_count, &size, 1/*finish*/); |
1516 | | |
1517 | 9.16k | if (length > 0 && !(png_ptr->flags & |
1518 | 1.39k | PNG_FLAG_BENIGN_ERRORS_WARN)) |
1519 | 0 | errmsg = "extra compressed data"; |
1520 | | |
1521 | | /* But otherwise allow extra data: */ |
1522 | 9.16k | else if (size == 0) |
1523 | 8.61k | { |
1524 | 8.61k | if (length > 0) |
1525 | 1.19k | { |
1526 | | /* This can be handled completely, so |
1527 | | * keep going. |
1528 | | */ |
1529 | 1.19k | png_chunk_warning(png_ptr, |
1530 | 1.19k | "extra compressed data"); |
1531 | 1.19k | } |
1532 | | |
1533 | 8.61k | png_crc_finish(png_ptr, length); |
1534 | 8.61k | finished = 1; |
1535 | | |
1536 | 8.61k | # if defined(PNG_sRGB_SUPPORTED) && PNG_sRGB_PROFILE_CHECKS >= 0 |
1537 | | /* Check for a match against sRGB */ |
1538 | 8.61k | png_icc_set_sRGB(png_ptr, |
1539 | 8.61k | &png_ptr->colorspace, profile, |
1540 | 8.61k | png_ptr->zstream.adler); |
1541 | 8.61k | # endif |
1542 | | |
1543 | | /* Steal the profile for info_ptr. */ |
1544 | 8.61k | if (info_ptr != NULL) |
1545 | 8.61k | { |
1546 | 8.61k | png_free_data(png_ptr, info_ptr, |
1547 | 8.61k | PNG_FREE_ICCP, 0); |
1548 | | |
1549 | 8.61k | info_ptr->iccp_name = png_voidcast(char*, |
1550 | 8.61k | png_malloc_base(png_ptr, |
1551 | 8.61k | keyword_length+1)); |
1552 | 8.61k | if (info_ptr->iccp_name != NULL) |
1553 | 8.61k | { |
1554 | 8.61k | memcpy(info_ptr->iccp_name, keyword, |
1555 | 8.61k | keyword_length+1); |
1556 | 8.61k | info_ptr->iccp_proflen = |
1557 | 8.61k | profile_length; |
1558 | 8.61k | info_ptr->iccp_profile = profile; |
1559 | 8.61k | png_ptr->read_buffer = NULL; /*steal*/ |
1560 | 8.61k | info_ptr->free_me |= PNG_FREE_ICCP; |
1561 | 8.61k | info_ptr->valid |= PNG_INFO_iCCP; |
1562 | 8.61k | } |
1563 | | |
1564 | 0 | else |
1565 | 0 | { |
1566 | 0 | png_ptr->colorspace.flags |= |
1567 | 0 | PNG_COLORSPACE_INVALID; |
1568 | 0 | errmsg = "out of memory"; |
1569 | 0 | } |
1570 | 8.61k | } |
1571 | | |
1572 | | /* else the profile remains in the read |
1573 | | * buffer which gets reused for subsequent |
1574 | | * chunks. |
1575 | | */ |
1576 | | |
1577 | 8.61k | if (info_ptr != NULL) |
1578 | 8.61k | png_colorspace_sync(png_ptr, info_ptr); |
1579 | | |
1580 | 8.61k | if (errmsg == NULL) |
1581 | 8.61k | { |
1582 | 8.61k | png_ptr->zowner = 0; |
1583 | 8.61k | return; |
1584 | 8.61k | } |
1585 | 553 | } |
1586 | 553 | if (errmsg == NULL) |
1587 | 553 | errmsg = png_ptr->zstream.msg; |
1588 | 553 | } |
1589 | | /* else png_icc_check_tag_table output an error */ |
1590 | 9.48k | } |
1591 | 179 | else /* profile truncated */ |
1592 | 179 | errmsg = png_ptr->zstream.msg; |
1593 | 9.66k | } |
1594 | | |
1595 | 0 | else |
1596 | 0 | errmsg = "out of memory"; |
1597 | 9.66k | } |
1598 | | |
1599 | | /* else png_icc_check_header output an error */ |
1600 | 10.7k | } |
1601 | | |
1602 | | /* else png_icc_check_length output an error */ |
1603 | 10.9k | } |
1604 | | |
1605 | 1.87k | else /* profile truncated */ |
1606 | 1.87k | errmsg = png_ptr->zstream.msg; |
1607 | | |
1608 | | /* Release the stream */ |
1609 | 4.23k | png_ptr->zowner = 0; |
1610 | 4.23k | } |
1611 | | |
1612 | 0 | else /* png_inflate_claim failed */ |
1613 | 0 | errmsg = png_ptr->zstream.msg; |
1614 | 12.8k | } |
1615 | | |
1616 | 152 | else |
1617 | 152 | errmsg = "bad compression method"; /* or missing */ |
1618 | 12.9k | } |
1619 | | |
1620 | 165 | else |
1621 | 165 | errmsg = "bad keyword"; |
1622 | 13.1k | } |
1623 | | |
1624 | 45 | else |
1625 | 45 | errmsg = "too many profiles"; |
1626 | | |
1627 | | /* Failure: the reason is in 'errmsg' */ |
1628 | 4.59k | if (finished == 0) |
1629 | 4.59k | png_crc_finish(png_ptr, length); |
1630 | | |
1631 | 4.59k | png_ptr->colorspace.flags |= PNG_COLORSPACE_INVALID; |
1632 | 4.59k | png_colorspace_sync(png_ptr, info_ptr); |
1633 | 4.59k | if (errmsg != NULL) /* else already output */ |
1634 | 2.97k | png_chunk_benign_error(png_ptr, errmsg); |
1635 | 4.59k | } |
1636 | | #endif /* READ_iCCP */ |
1637 | | |
1638 | | #ifdef PNG_READ_sPLT_SUPPORTED |
1639 | | void /* PRIVATE */ |
1640 | | png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
1641 | | /* Note: this does not properly handle chunks that are > 64K under DOS */ |
1642 | 5.29k | { |
1643 | 5.29k | png_bytep entry_start, buffer; |
1644 | 5.29k | png_sPLT_t new_palette; |
1645 | 5.29k | png_sPLT_entryp pp; |
1646 | 5.29k | png_uint_32 data_length; |
1647 | 5.29k | int entry_size, i; |
1648 | 5.29k | png_uint_32 skip = 0; |
1649 | 5.29k | png_uint_32 dl; |
1650 | 5.29k | size_t max_dl; |
1651 | | |
1652 | 5.29k | png_debug(1, "in png_handle_sPLT"); |
1653 | | |
1654 | 5.29k | #ifdef PNG_USER_LIMITS_SUPPORTED |
1655 | 5.29k | if (png_ptr->user_chunk_cache_max != 0) |
1656 | 5.29k | { |
1657 | 5.29k | if (png_ptr->user_chunk_cache_max == 1) |
1658 | 0 | { |
1659 | 0 | png_crc_finish(png_ptr, length); |
1660 | 0 | return; |
1661 | 0 | } |
1662 | | |
1663 | 5.29k | if (--png_ptr->user_chunk_cache_max == 1) |
1664 | 0 | { |
1665 | 0 | png_warning(png_ptr, "No space in chunk cache for sPLT"); |
1666 | 0 | png_crc_finish(png_ptr, length); |
1667 | 0 | return; |
1668 | 0 | } |
1669 | 5.29k | } |
1670 | 5.29k | #endif |
1671 | | |
1672 | 5.29k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
1673 | 9 | png_chunk_error(png_ptr, "missing IHDR"); |
1674 | | |
1675 | 5.28k | else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
1676 | 151 | { |
1677 | 151 | png_crc_finish(png_ptr, length); |
1678 | 151 | png_chunk_benign_error(png_ptr, "out of place"); |
1679 | 151 | return; |
1680 | 151 | } |
1681 | | |
1682 | | #ifdef PNG_MAX_MALLOC_64K |
1683 | | if (length > 65535U) |
1684 | | { |
1685 | | png_crc_finish(png_ptr, length); |
1686 | | png_chunk_benign_error(png_ptr, "too large to fit in memory"); |
1687 | | return; |
1688 | | } |
1689 | | #endif |
1690 | | |
1691 | 5.13k | buffer = png_read_buffer(png_ptr, length+1, 2/*silent*/); |
1692 | 5.13k | if (buffer == NULL) |
1693 | 0 | { |
1694 | 0 | png_crc_finish(png_ptr, length); |
1695 | 0 | png_chunk_benign_error(png_ptr, "out of memory"); |
1696 | 0 | return; |
1697 | 0 | } |
1698 | | |
1699 | | |
1700 | | /* WARNING: this may break if size_t is less than 32 bits; it is assumed |
1701 | | * that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a |
1702 | | * potential breakage point if the types in pngconf.h aren't exactly right. |
1703 | | */ |
1704 | 5.13k | png_crc_read(png_ptr, buffer, length); |
1705 | | |
1706 | 5.13k | if (png_crc_finish(png_ptr, skip) != 0) |
1707 | 1.14k | return; |
1708 | | |
1709 | 3.98k | buffer[length] = 0; |
1710 | | |
1711 | 8.24k | for (entry_start = buffer; *entry_start; entry_start++) |
1712 | 4.25k | /* Empty loop to find end of name */ ; |
1713 | | |
1714 | 3.98k | ++entry_start; |
1715 | | |
1716 | | /* A sample depth should follow the separator, and we should be on it */ |
1717 | 3.98k | if (length < 2U || entry_start > buffer + (length - 2U)) |
1718 | 1.06k | { |
1719 | 1.06k | png_warning(png_ptr, "malformed sPLT chunk"); |
1720 | 1.06k | return; |
1721 | 1.06k | } |
1722 | | |
1723 | 2.91k | new_palette.depth = *entry_start++; |
1724 | 1.66k | entry_size = (new_palette.depth == 8 ? 6 : 10); |
1725 | | /* This must fit in a png_uint_32 because it is derived from the original |
1726 | | * chunk data length. |
1727 | | */ |
1728 | 2.91k | data_length = length - (png_uint_32)(entry_start - buffer); |
1729 | | |
1730 | | /* Integrity-check the data length */ |
1731 | 2.91k | if ((data_length % (unsigned int)entry_size) != 0) |
1732 | 1.04k | { |
1733 | 1.04k | png_warning(png_ptr, "sPLT chunk has bad length"); |
1734 | 1.04k | return; |
1735 | 1.04k | } |
1736 | | |
1737 | 1.87k | dl = (png_uint_32)(data_length / (unsigned int)entry_size); |
1738 | 1.87k | max_dl = PNG_SIZE_MAX / (sizeof (png_sPLT_entry)); |
1739 | | |
1740 | 1.87k | if (dl > max_dl) |
1741 | 0 | { |
1742 | 0 | png_warning(png_ptr, "sPLT chunk too long"); |
1743 | 0 | return; |
1744 | 0 | } |
1745 | | |
1746 | 1.87k | new_palette.nentries = (png_int_32)(data_length / (unsigned int)entry_size); |
1747 | | |
1748 | 1.87k | new_palette.entries = (png_sPLT_entryp)png_malloc_warn(png_ptr, |
1749 | 1.87k | (png_alloc_size_t) new_palette.nentries * (sizeof (png_sPLT_entry))); |
1750 | | |
1751 | 1.87k | if (new_palette.entries == NULL) |
1752 | 0 | { |
1753 | 0 | png_warning(png_ptr, "sPLT chunk requires too much memory"); |
1754 | 0 | return; |
1755 | 0 | } |
1756 | | |
1757 | 1.87k | #ifdef PNG_POINTER_INDEXING_SUPPORTED |
1758 | 4.64k | for (i = 0; i < new_palette.nentries; i++) |
1759 | 2.77k | { |
1760 | 2.77k | pp = new_palette.entries + i; |
1761 | | |
1762 | 2.77k | if (new_palette.depth == 8) |
1763 | 1.61k | { |
1764 | 1.61k | pp->red = *entry_start++; |
1765 | 1.61k | pp->green = *entry_start++; |
1766 | 1.61k | pp->blue = *entry_start++; |
1767 | 1.61k | pp->alpha = *entry_start++; |
1768 | 1.61k | } |
1769 | | |
1770 | 1.15k | else |
1771 | 1.15k | { |
1772 | 1.15k | pp->red = png_get_uint_16(entry_start); entry_start += 2; |
1773 | 1.15k | pp->green = png_get_uint_16(entry_start); entry_start += 2; |
1774 | 1.15k | pp->blue = png_get_uint_16(entry_start); entry_start += 2; |
1775 | 1.15k | pp->alpha = png_get_uint_16(entry_start); entry_start += 2; |
1776 | 1.15k | } |
1777 | | |
1778 | 2.77k | pp->frequency = png_get_uint_16(entry_start); entry_start += 2; |
1779 | 2.77k | } |
1780 | | #else |
1781 | | pp = new_palette.entries; |
1782 | | |
1783 | | for (i = 0; i < new_palette.nentries; i++) |
1784 | | { |
1785 | | |
1786 | | if (new_palette.depth == 8) |
1787 | | { |
1788 | | pp[i].red = *entry_start++; |
1789 | | pp[i].green = *entry_start++; |
1790 | | pp[i].blue = *entry_start++; |
1791 | | pp[i].alpha = *entry_start++; |
1792 | | } |
1793 | | |
1794 | | else |
1795 | | { |
1796 | | pp[i].red = png_get_uint_16(entry_start); entry_start += 2; |
1797 | | pp[i].green = png_get_uint_16(entry_start); entry_start += 2; |
1798 | | pp[i].blue = png_get_uint_16(entry_start); entry_start += 2; |
1799 | | pp[i].alpha = png_get_uint_16(entry_start); entry_start += 2; |
1800 | | } |
1801 | | |
1802 | | pp[i].frequency = png_get_uint_16(entry_start); entry_start += 2; |
1803 | | } |
1804 | | #endif |
1805 | | |
1806 | | /* Discard all chunk data except the name and stash that */ |
1807 | 1.87k | new_palette.name = (png_charp)buffer; |
1808 | | |
1809 | 1.87k | png_set_sPLT(png_ptr, info_ptr, &new_palette, 1); |
1810 | | |
1811 | 1.87k | png_free(png_ptr, new_palette.entries); |
1812 | 1.87k | } |
1813 | | #endif /* READ_sPLT */ |
1814 | | |
1815 | | #ifdef PNG_READ_tRNS_SUPPORTED |
1816 | | void /* PRIVATE */ |
1817 | | png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
1818 | 8.01k | { |
1819 | 8.01k | png_byte readbuf[PNG_MAX_PALETTE_LENGTH]; |
1820 | | |
1821 | 8.01k | png_debug(1, "in png_handle_tRNS"); |
1822 | | |
1823 | 8.01k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
1824 | 25 | png_chunk_error(png_ptr, "missing IHDR"); |
1825 | | |
1826 | 7.98k | else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
1827 | 533 | { |
1828 | 533 | png_crc_finish(png_ptr, length); |
1829 | 533 | png_chunk_benign_error(png_ptr, "out of place"); |
1830 | 533 | return; |
1831 | 533 | } |
1832 | | |
1833 | 7.45k | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != 0) |
1834 | 896 | { |
1835 | 896 | png_crc_finish(png_ptr, length); |
1836 | 896 | png_chunk_benign_error(png_ptr, "duplicate"); |
1837 | 896 | return; |
1838 | 896 | } |
1839 | | |
1840 | 6.55k | if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) |
1841 | 1.62k | { |
1842 | 1.62k | png_byte buf[2]; |
1843 | | |
1844 | 1.62k | if (length != 2) |
1845 | 721 | { |
1846 | 721 | png_crc_finish(png_ptr, length); |
1847 | 721 | png_chunk_benign_error(png_ptr, "invalid"); |
1848 | 721 | return; |
1849 | 721 | } |
1850 | | |
1851 | 901 | png_crc_read(png_ptr, buf, 2); |
1852 | 901 | png_ptr->num_trans = 1; |
1853 | 901 | png_ptr->trans_color.gray = png_get_uint_16(buf); |
1854 | 901 | } |
1855 | | |
1856 | 4.93k | else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) |
1857 | 1.54k | { |
1858 | 1.54k | png_byte buf[6]; |
1859 | | |
1860 | 1.54k | if (length != 6) |
1861 | 734 | { |
1862 | 734 | png_crc_finish(png_ptr, length); |
1863 | 734 | png_chunk_benign_error(png_ptr, "invalid"); |
1864 | 734 | return; |
1865 | 734 | } |
1866 | | |
1867 | 812 | png_crc_read(png_ptr, buf, length); |
1868 | 812 | png_ptr->num_trans = 1; |
1869 | 812 | png_ptr->trans_color.red = png_get_uint_16(buf); |
1870 | 812 | png_ptr->trans_color.green = png_get_uint_16(buf + 2); |
1871 | 812 | png_ptr->trans_color.blue = png_get_uint_16(buf + 4); |
1872 | 812 | } |
1873 | | |
1874 | 3.39k | else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) |
1875 | 2.73k | { |
1876 | 2.73k | if ((png_ptr->mode & PNG_HAVE_PLTE) == 0) |
1877 | 514 | { |
1878 | | /* TODO: is this actually an error in the ISO spec? */ |
1879 | 514 | png_crc_finish(png_ptr, length); |
1880 | 514 | png_chunk_benign_error(png_ptr, "out of place"); |
1881 | 514 | return; |
1882 | 514 | } |
1883 | | |
1884 | 2.21k | if (length > (unsigned int) png_ptr->num_palette || |
1885 | 1.62k | length > (unsigned int) PNG_MAX_PALETTE_LENGTH || |
1886 | 1.62k | length == 0) |
1887 | 1.25k | { |
1888 | 1.25k | png_crc_finish(png_ptr, length); |
1889 | 1.25k | png_chunk_benign_error(png_ptr, "invalid"); |
1890 | 1.25k | return; |
1891 | 1.25k | } |
1892 | | |
1893 | 964 | png_crc_read(png_ptr, readbuf, length); |
1894 | 964 | png_ptr->num_trans = (png_uint_16)length; |
1895 | 964 | } |
1896 | | |
1897 | 658 | else |
1898 | 658 | { |
1899 | 658 | png_crc_finish(png_ptr, length); |
1900 | 658 | png_chunk_benign_error(png_ptr, "invalid with alpha channel"); |
1901 | 658 | return; |
1902 | 658 | } |
1903 | | |
1904 | 2.67k | if (png_crc_finish(png_ptr, 0) != 0) |
1905 | 2.28k | { |
1906 | 2.28k | png_ptr->num_trans = 0; |
1907 | 2.28k | return; |
1908 | 2.28k | } |
1909 | | |
1910 | | /* TODO: this is a horrible side effect in the palette case because the |
1911 | | * png_struct ends up with a pointer to the tRNS buffer owned by the |
1912 | | * png_info. Fix this. |
1913 | | */ |
1914 | 390 | png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans, |
1915 | 390 | &(png_ptr->trans_color)); |
1916 | 390 | } |
1917 | | #endif |
1918 | | |
1919 | | #ifdef PNG_READ_bKGD_SUPPORTED |
1920 | | void /* PRIVATE */ |
1921 | | png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
1922 | 11.0k | { |
1923 | 11.0k | unsigned int truelen; |
1924 | 11.0k | png_byte buf[6]; |
1925 | 11.0k | png_color_16 background; |
1926 | | |
1927 | 11.0k | png_debug(1, "in png_handle_bKGD"); |
1928 | | |
1929 | 11.0k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
1930 | 15 | png_chunk_error(png_ptr, "missing IHDR"); |
1931 | | |
1932 | 11.0k | else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0 || |
1933 | 9.99k | (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE && |
1934 | 5.05k | (png_ptr->mode & PNG_HAVE_PLTE) == 0)) |
1935 | 1.71k | { |
1936 | 1.71k | png_crc_finish(png_ptr, length); |
1937 | 1.71k | png_chunk_benign_error(png_ptr, "out of place"); |
1938 | 1.71k | return; |
1939 | 1.71k | } |
1940 | | |
1941 | 9.31k | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != 0) |
1942 | 1.93k | { |
1943 | 1.93k | png_crc_finish(png_ptr, length); |
1944 | 1.93k | png_chunk_benign_error(png_ptr, "duplicate"); |
1945 | 1.93k | return; |
1946 | 1.93k | } |
1947 | | |
1948 | 7.37k | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) |
1949 | 2.49k | truelen = 1; |
1950 | | |
1951 | 4.88k | else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0) |
1952 | 2.57k | truelen = 6; |
1953 | | |
1954 | 2.30k | else |
1955 | 2.30k | truelen = 2; |
1956 | | |
1957 | 7.37k | if (length != truelen) |
1958 | 2.12k | { |
1959 | 2.12k | png_crc_finish(png_ptr, length); |
1960 | 2.12k | png_chunk_benign_error(png_ptr, "invalid"); |
1961 | 2.12k | return; |
1962 | 2.12k | } |
1963 | | |
1964 | 5.25k | png_crc_read(png_ptr, buf, truelen); |
1965 | | |
1966 | 5.25k | if (png_crc_finish(png_ptr, 0) != 0) |
1967 | 917 | return; |
1968 | | |
1969 | | /* We convert the index value into RGB components so that we can allow |
1970 | | * arbitrary RGB values for background when we have transparency, and |
1971 | | * so it is easy to determine the RGB values of the background color |
1972 | | * from the info_ptr struct. |
1973 | | */ |
1974 | 4.33k | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) |
1975 | 1.19k | { |
1976 | 1.19k | background.index = buf[0]; |
1977 | | |
1978 | 1.19k | if (info_ptr != NULL && info_ptr->num_palette != 0) |
1979 | 1.19k | { |
1980 | 1.19k | if (buf[0] >= info_ptr->num_palette) |
1981 | 1.03k | { |
1982 | 1.03k | png_chunk_benign_error(png_ptr, "invalid index"); |
1983 | 1.03k | return; |
1984 | 1.03k | } |
1985 | | |
1986 | 163 | background.red = (png_uint_16)png_ptr->palette[buf[0]].red; |
1987 | 163 | background.green = (png_uint_16)png_ptr->palette[buf[0]].green; |
1988 | 163 | background.blue = (png_uint_16)png_ptr->palette[buf[0]].blue; |
1989 | 163 | } |
1990 | | |
1991 | 0 | else |
1992 | 0 | background.red = background.green = background.blue = 0; |
1993 | | |
1994 | 163 | background.gray = 0; |
1995 | 163 | } |
1996 | | |
1997 | 3.13k | else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) /* GRAY */ |
1998 | 1.48k | { |
1999 | 1.48k | if (png_ptr->bit_depth <= 8) |
2000 | 1.45k | { |
2001 | 1.45k | if (buf[0] != 0 || buf[1] >= (unsigned int)(1 << png_ptr->bit_depth)) |
2002 | 1.44k | { |
2003 | 1.44k | png_chunk_benign_error(png_ptr, "invalid gray level"); |
2004 | 1.44k | return; |
2005 | 1.44k | } |
2006 | 39 | } |
2007 | | |
2008 | 39 | background.index = 0; |
2009 | 39 | background.red = |
2010 | 39 | background.green = |
2011 | 39 | background.blue = |
2012 | 39 | background.gray = png_get_uint_16(buf); |
2013 | 39 | } |
2014 | | |
2015 | 1.65k | else |
2016 | 1.65k | { |
2017 | 1.65k | if (png_ptr->bit_depth <= 8) |
2018 | 1.63k | { |
2019 | 1.63k | if (buf[0] != 0 || buf[2] != 0 || buf[4] != 0) |
2020 | 1.61k | { |
2021 | 1.61k | png_chunk_benign_error(png_ptr, "invalid color"); |
2022 | 1.61k | return; |
2023 | 1.61k | } |
2024 | 37 | } |
2025 | | |
2026 | 37 | background.index = 0; |
2027 | 37 | background.red = png_get_uint_16(buf); |
2028 | 37 | background.green = png_get_uint_16(buf + 2); |
2029 | 37 | background.blue = png_get_uint_16(buf + 4); |
2030 | 37 | background.gray = 0; |
2031 | 37 | } |
2032 | | |
2033 | 239 | png_set_bKGD(png_ptr, info_ptr, &background); |
2034 | 239 | } |
2035 | | #endif |
2036 | | |
2037 | | #ifdef PNG_READ_eXIf_SUPPORTED |
2038 | | void /* PRIVATE */ |
2039 | | png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2040 | 0 | { |
2041 | 0 | unsigned int i; |
2042 | |
|
2043 | 0 | png_debug(1, "in png_handle_eXIf"); |
2044 | |
|
2045 | 0 | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2046 | 0 | png_chunk_error(png_ptr, "missing IHDR"); |
2047 | | |
2048 | 0 | if (length < 2) |
2049 | 0 | { |
2050 | 0 | png_crc_finish(png_ptr, length); |
2051 | 0 | png_chunk_benign_error(png_ptr, "too short"); |
2052 | 0 | return; |
2053 | 0 | } |
2054 | | |
2055 | 0 | else if (info_ptr == NULL || (info_ptr->valid & PNG_INFO_eXIf) != 0) |
2056 | 0 | { |
2057 | 0 | png_crc_finish(png_ptr, length); |
2058 | 0 | png_chunk_benign_error(png_ptr, "duplicate"); |
2059 | 0 | return; |
2060 | 0 | } |
2061 | | |
2062 | 0 | info_ptr->free_me |= PNG_FREE_EXIF; |
2063 | |
|
2064 | 0 | info_ptr->eXIf_buf = png_voidcast(png_bytep, |
2065 | 0 | png_malloc_warn(png_ptr, length)); |
2066 | |
|
2067 | 0 | if (info_ptr->eXIf_buf == NULL) |
2068 | 0 | { |
2069 | 0 | png_crc_finish(png_ptr, length); |
2070 | 0 | png_chunk_benign_error(png_ptr, "out of memory"); |
2071 | 0 | return; |
2072 | 0 | } |
2073 | | |
2074 | 0 | for (i = 0; i < length; i++) |
2075 | 0 | { |
2076 | 0 | png_byte buf[1]; |
2077 | 0 | png_crc_read(png_ptr, buf, 1); |
2078 | 0 | info_ptr->eXIf_buf[i] = buf[0]; |
2079 | 0 | if (i == 1 && buf[0] != 'M' && buf[0] != 'I' |
2080 | 0 | && info_ptr->eXIf_buf[0] != buf[0]) |
2081 | 0 | { |
2082 | 0 | png_crc_finish(png_ptr, length); |
2083 | 0 | png_chunk_benign_error(png_ptr, "incorrect byte-order specifier"); |
2084 | 0 | png_free(png_ptr, info_ptr->eXIf_buf); |
2085 | 0 | info_ptr->eXIf_buf = NULL; |
2086 | 0 | return; |
2087 | 0 | } |
2088 | 0 | } |
2089 | |
|
2090 | 0 | if (png_crc_finish(png_ptr, 0) != 0) |
2091 | 0 | return; |
2092 | | |
2093 | 0 | png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf); |
2094 | |
|
2095 | 0 | png_free(png_ptr, info_ptr->eXIf_buf); |
2096 | 0 | info_ptr->eXIf_buf = NULL; |
2097 | 0 | } |
2098 | | #endif |
2099 | | |
2100 | | #ifdef PNG_READ_hIST_SUPPORTED |
2101 | | void /* PRIVATE */ |
2102 | | png_handle_hIST(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2103 | 2.69k | { |
2104 | 2.69k | unsigned int num, i; |
2105 | 2.69k | png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH]; |
2106 | | |
2107 | 2.69k | png_debug(1, "in png_handle_hIST"); |
2108 | | |
2109 | 2.69k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2110 | 17 | png_chunk_error(png_ptr, "missing IHDR"); |
2111 | | |
2112 | 2.67k | else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0 || |
2113 | 2.55k | (png_ptr->mode & PNG_HAVE_PLTE) == 0) |
2114 | 713 | { |
2115 | 713 | png_crc_finish(png_ptr, length); |
2116 | 713 | png_chunk_benign_error(png_ptr, "out of place"); |
2117 | 713 | return; |
2118 | 713 | } |
2119 | | |
2120 | 1.96k | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != 0) |
2121 | 185 | { |
2122 | 185 | png_crc_finish(png_ptr, length); |
2123 | 185 | png_chunk_benign_error(png_ptr, "duplicate"); |
2124 | 185 | return; |
2125 | 185 | } |
2126 | | |
2127 | 1.77k | num = length / 2 ; |
2128 | | |
2129 | 1.77k | if (num != (unsigned int) png_ptr->num_palette || |
2130 | 1.55k | num > (unsigned int) PNG_MAX_PALETTE_LENGTH) |
2131 | 229 | { |
2132 | 229 | png_crc_finish(png_ptr, length); |
2133 | 229 | png_chunk_benign_error(png_ptr, "invalid"); |
2134 | 229 | return; |
2135 | 229 | } |
2136 | | |
2137 | 4.69k | for (i = 0; i < num; i++) |
2138 | 3.14k | { |
2139 | 3.14k | png_byte buf[2]; |
2140 | | |
2141 | 3.14k | png_crc_read(png_ptr, buf, 2); |
2142 | 3.14k | readbuf[i] = png_get_uint_16(buf); |
2143 | 3.14k | } |
2144 | | |
2145 | 1.55k | if (png_crc_finish(png_ptr, 0) != 0) |
2146 | 807 | return; |
2147 | | |
2148 | 743 | png_set_hIST(png_ptr, info_ptr, readbuf); |
2149 | 743 | } |
2150 | | #endif |
2151 | | |
2152 | | #ifdef PNG_READ_pHYs_SUPPORTED |
2153 | | void /* PRIVATE */ |
2154 | | png_handle_pHYs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2155 | 4.92k | { |
2156 | 4.92k | png_byte buf[9]; |
2157 | 4.92k | png_uint_32 res_x, res_y; |
2158 | 4.92k | int unit_type; |
2159 | | |
2160 | 4.92k | png_debug(1, "in png_handle_pHYs"); |
2161 | | |
2162 | 4.92k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2163 | 0 | png_chunk_error(png_ptr, "missing IHDR"); |
2164 | | |
2165 | 4.92k | else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
2166 | 669 | { |
2167 | 669 | png_crc_finish(png_ptr, length); |
2168 | 669 | png_chunk_benign_error(png_ptr, "out of place"); |
2169 | 669 | return; |
2170 | 669 | } |
2171 | | |
2172 | 4.25k | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs) != 0) |
2173 | 2.50k | { |
2174 | 2.50k | png_crc_finish(png_ptr, length); |
2175 | 2.50k | png_chunk_benign_error(png_ptr, "duplicate"); |
2176 | 2.50k | return; |
2177 | 2.50k | } |
2178 | | |
2179 | 1.75k | if (length != 9) |
2180 | 859 | { |
2181 | 859 | png_crc_finish(png_ptr, length); |
2182 | 859 | png_chunk_benign_error(png_ptr, "invalid"); |
2183 | 859 | return; |
2184 | 859 | } |
2185 | | |
2186 | 891 | png_crc_read(png_ptr, buf, 9); |
2187 | | |
2188 | 891 | if (png_crc_finish(png_ptr, 0) != 0) |
2189 | 774 | return; |
2190 | | |
2191 | 117 | res_x = png_get_uint_32(buf); |
2192 | 117 | res_y = png_get_uint_32(buf + 4); |
2193 | 117 | unit_type = buf[8]; |
2194 | 117 | png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type); |
2195 | 117 | } |
2196 | | #endif |
2197 | | |
2198 | | #ifdef PNG_READ_oFFs_SUPPORTED |
2199 | | void /* PRIVATE */ |
2200 | | png_handle_oFFs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2201 | 2.20k | { |
2202 | 2.20k | png_byte buf[9]; |
2203 | 2.20k | png_int_32 offset_x, offset_y; |
2204 | 2.20k | int unit_type; |
2205 | | |
2206 | 2.20k | png_debug(1, "in png_handle_oFFs"); |
2207 | | |
2208 | 2.20k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2209 | 21 | png_chunk_error(png_ptr, "missing IHDR"); |
2210 | | |
2211 | 2.18k | else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
2212 | 428 | { |
2213 | 428 | png_crc_finish(png_ptr, length); |
2214 | 428 | png_chunk_benign_error(png_ptr, "out of place"); |
2215 | 428 | return; |
2216 | 428 | } |
2217 | | |
2218 | 1.75k | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs) != 0) |
2219 | 498 | { |
2220 | 498 | png_crc_finish(png_ptr, length); |
2221 | 498 | png_chunk_benign_error(png_ptr, "duplicate"); |
2222 | 498 | return; |
2223 | 498 | } |
2224 | | |
2225 | 1.25k | if (length != 9) |
2226 | 518 | { |
2227 | 518 | png_crc_finish(png_ptr, length); |
2228 | 518 | png_chunk_benign_error(png_ptr, "invalid"); |
2229 | 518 | return; |
2230 | 518 | } |
2231 | | |
2232 | 740 | png_crc_read(png_ptr, buf, 9); |
2233 | | |
2234 | 740 | if (png_crc_finish(png_ptr, 0) != 0) |
2235 | 658 | return; |
2236 | | |
2237 | 82 | offset_x = png_get_int_32(buf); |
2238 | 82 | offset_y = png_get_int_32(buf + 4); |
2239 | 82 | unit_type = buf[8]; |
2240 | 82 | png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type); |
2241 | 82 | } |
2242 | | #endif |
2243 | | |
2244 | | #ifdef PNG_READ_pCAL_SUPPORTED |
2245 | | /* Read the pCAL chunk (described in the PNG Extensions document) */ |
2246 | | void /* PRIVATE */ |
2247 | | png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2248 | 6.88k | { |
2249 | 6.88k | png_int_32 X0, X1; |
2250 | 6.88k | png_byte type, nparams; |
2251 | 6.88k | png_bytep buffer, buf, units, endptr; |
2252 | 6.88k | png_charpp params; |
2253 | 6.88k | int i; |
2254 | | |
2255 | 6.88k | png_debug(1, "in png_handle_pCAL"); |
2256 | | |
2257 | 6.88k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2258 | 27 | png_chunk_error(png_ptr, "missing IHDR"); |
2259 | | |
2260 | 6.85k | else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
2261 | 314 | { |
2262 | 314 | png_crc_finish(png_ptr, length); |
2263 | 314 | png_chunk_benign_error(png_ptr, "out of place"); |
2264 | 314 | return; |
2265 | 314 | } |
2266 | | |
2267 | 6.54k | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL) != 0) |
2268 | 519 | { |
2269 | 519 | png_crc_finish(png_ptr, length); |
2270 | 519 | png_chunk_benign_error(png_ptr, "duplicate"); |
2271 | 519 | return; |
2272 | 519 | } |
2273 | | |
2274 | 6.02k | png_debug1(2, "Allocating and reading pCAL chunk data (%u bytes)", |
2275 | 6.02k | length + 1); |
2276 | | |
2277 | 6.02k | buffer = png_read_buffer(png_ptr, length+1, 2/*silent*/); |
2278 | | |
2279 | 6.02k | if (buffer == NULL) |
2280 | 0 | { |
2281 | 0 | png_crc_finish(png_ptr, length); |
2282 | 0 | png_chunk_benign_error(png_ptr, "out of memory"); |
2283 | 0 | return; |
2284 | 0 | } |
2285 | | |
2286 | 6.02k | png_crc_read(png_ptr, buffer, length); |
2287 | | |
2288 | 6.02k | if (png_crc_finish(png_ptr, 0) != 0) |
2289 | 1.02k | return; |
2290 | | |
2291 | 5.00k | buffer[length] = 0; /* Null terminate the last string */ |
2292 | | |
2293 | 5.00k | png_debug(3, "Finding end of pCAL purpose string"); |
2294 | 5.32k | for (buf = buffer; *buf; buf++) |
2295 | 321 | /* Empty loop */ ; |
2296 | | |
2297 | 5.00k | endptr = buffer + length; |
2298 | | |
2299 | | /* We need to have at least 12 bytes after the purpose string |
2300 | | * in order to get the parameter information. |
2301 | | */ |
2302 | 5.00k | if (endptr - buf <= 12) |
2303 | 510 | { |
2304 | 510 | png_chunk_benign_error(png_ptr, "invalid"); |
2305 | 510 | return; |
2306 | 510 | } |
2307 | | |
2308 | 4.49k | png_debug(3, "Reading pCAL X0, X1, type, nparams, and units"); |
2309 | 4.49k | X0 = png_get_int_32((png_bytep)buf+1); |
2310 | 4.49k | X1 = png_get_int_32((png_bytep)buf+5); |
2311 | 4.49k | type = buf[9]; |
2312 | 4.49k | nparams = buf[10]; |
2313 | 4.49k | units = buf + 11; |
2314 | | |
2315 | 4.49k | png_debug(3, "Checking pCAL equation type and number of parameters"); |
2316 | | /* Check that we have the right number of parameters for known |
2317 | | * equation types. |
2318 | | */ |
2319 | 4.49k | if ((type == PNG_EQUATION_LINEAR && nparams != 2) || |
2320 | 4.19k | (type == PNG_EQUATION_BASE_E && nparams != 3) || |
2321 | 4.05k | (type == PNG_EQUATION_ARBITRARY && nparams != 3) || |
2322 | 3.94k | (type == PNG_EQUATION_HYPERBOLIC && nparams != 4)) |
2323 | 594 | { |
2324 | 594 | png_chunk_benign_error(png_ptr, "invalid parameter count"); |
2325 | 594 | return; |
2326 | 594 | } |
2327 | | |
2328 | 3.89k | else if (type >= PNG_EQUATION_LAST) |
2329 | 1.06k | { |
2330 | 1.06k | png_chunk_benign_error(png_ptr, "unrecognized equation type"); |
2331 | 1.06k | } |
2332 | | |
2333 | 5.13k | for (buf = units; *buf; buf++) |
2334 | 1.23k | /* Empty loop to move past the units string. */ ; |
2335 | | |
2336 | 3.89k | png_debug(3, "Allocating pCAL parameters array"); |
2337 | | |
2338 | 3.89k | params = png_voidcast(png_charpp, png_malloc_warn(png_ptr, |
2339 | 3.89k | nparams * (sizeof (png_charp)))); |
2340 | | |
2341 | 3.89k | if (params == NULL) |
2342 | 414 | { |
2343 | 414 | png_chunk_benign_error(png_ptr, "out of memory"); |
2344 | 414 | return; |
2345 | 414 | } |
2346 | | |
2347 | | /* Get pointers to the start of each parameter string. */ |
2348 | 10.3k | for (i = 0; i < nparams; i++) |
2349 | 7.98k | { |
2350 | 7.98k | buf++; /* Skip the null string terminator from previous parameter. */ |
2351 | | |
2352 | 7.98k | png_debug1(3, "Reading pCAL parameter %d", i); |
2353 | | |
2354 | 12.8k | for (params[i] = (png_charp)buf; buf <= endptr && *buf != 0; buf++) |
2355 | 4.82k | /* Empty loop to move past each parameter string */ ; |
2356 | | |
2357 | | /* Make sure we haven't run out of data yet */ |
2358 | 7.98k | if (buf > endptr) |
2359 | 1.12k | { |
2360 | 1.12k | png_free(png_ptr, params); |
2361 | 1.12k | png_chunk_benign_error(png_ptr, "invalid data"); |
2362 | 1.12k | return; |
2363 | 1.12k | } |
2364 | 7.98k | } |
2365 | | |
2366 | 2.35k | png_set_pCAL(png_ptr, info_ptr, (png_charp)buffer, X0, X1, type, nparams, |
2367 | 2.35k | (png_charp)units, params); |
2368 | | |
2369 | 2.35k | png_free(png_ptr, params); |
2370 | 2.35k | } |
2371 | | #endif |
2372 | | |
2373 | | #ifdef PNG_READ_sCAL_SUPPORTED |
2374 | | /* Read the sCAL chunk */ |
2375 | | void /* PRIVATE */ |
2376 | | png_handle_sCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2377 | 11.5k | { |
2378 | 11.5k | png_bytep buffer; |
2379 | 11.5k | size_t i; |
2380 | 11.5k | int state; |
2381 | | |
2382 | 11.5k | png_debug(1, "in png_handle_sCAL"); |
2383 | | |
2384 | 11.5k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2385 | 78 | png_chunk_error(png_ptr, "missing IHDR"); |
2386 | | |
2387 | 11.4k | else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
2388 | 292 | { |
2389 | 292 | png_crc_finish(png_ptr, length); |
2390 | 292 | png_chunk_benign_error(png_ptr, "out of place"); |
2391 | 292 | return; |
2392 | 292 | } |
2393 | | |
2394 | 11.1k | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL) != 0) |
2395 | 357 | { |
2396 | 357 | png_crc_finish(png_ptr, length); |
2397 | 357 | png_chunk_benign_error(png_ptr, "duplicate"); |
2398 | 357 | return; |
2399 | 357 | } |
2400 | | |
2401 | | /* Need unit type, width, \0, height: minimum 4 bytes */ |
2402 | 10.7k | else if (length < 4) |
2403 | 743 | { |
2404 | 743 | png_crc_finish(png_ptr, length); |
2405 | 743 | png_chunk_benign_error(png_ptr, "invalid"); |
2406 | 743 | return; |
2407 | 743 | } |
2408 | | |
2409 | 10.0k | png_debug1(2, "Allocating and reading sCAL chunk data (%u bytes)", |
2410 | 10.0k | length + 1); |
2411 | | |
2412 | 10.0k | buffer = png_read_buffer(png_ptr, length+1, 2/*silent*/); |
2413 | | |
2414 | 10.0k | if (buffer == NULL) |
2415 | 0 | { |
2416 | 0 | png_chunk_benign_error(png_ptr, "out of memory"); |
2417 | 0 | png_crc_finish(png_ptr, length); |
2418 | 0 | return; |
2419 | 0 | } |
2420 | | |
2421 | 10.0k | png_crc_read(png_ptr, buffer, length); |
2422 | 10.0k | buffer[length] = 0; /* Null terminate the last string */ |
2423 | | |
2424 | 10.0k | if (png_crc_finish(png_ptr, 0) != 0) |
2425 | 1.65k | return; |
2426 | | |
2427 | | /* Validate the unit. */ |
2428 | 8.39k | if (buffer[0] != 1 && buffer[0] != 2) |
2429 | 264 | { |
2430 | 264 | png_chunk_benign_error(png_ptr, "invalid unit"); |
2431 | 264 | return; |
2432 | 264 | } |
2433 | | |
2434 | | /* Validate the ASCII numbers, need two ASCII numbers separated by |
2435 | | * a '\0' and they need to fit exactly in the chunk data. |
2436 | | */ |
2437 | 8.13k | i = 1; |
2438 | 8.13k | state = 0; |
2439 | | |
2440 | 8.13k | if (png_check_fp_number((png_const_charp)buffer, length, &state, &i) == 0 || |
2441 | 5.70k | i >= length || buffer[i++] != 0) |
2442 | 4.22k | png_chunk_benign_error(png_ptr, "bad width format"); |
2443 | | |
2444 | 3.90k | else if (PNG_FP_IS_POSITIVE(state) == 0) |
2445 | 324 | png_chunk_benign_error(png_ptr, "non-positive width"); |
2446 | | |
2447 | 3.58k | else |
2448 | 3.58k | { |
2449 | 3.58k | size_t heighti = i; |
2450 | | |
2451 | 3.58k | state = 0; |
2452 | 3.58k | if (png_check_fp_number((png_const_charp)buffer, length, |
2453 | 2.26k | &state, &i) == 0 || i != length) |
2454 | 3.10k | png_chunk_benign_error(png_ptr, "bad height format"); |
2455 | | |
2456 | 481 | else if (PNG_FP_IS_POSITIVE(state) == 0) |
2457 | 339 | png_chunk_benign_error(png_ptr, "non-positive height"); |
2458 | | |
2459 | 142 | else |
2460 | | /* This is the (only) success case. */ |
2461 | 142 | png_set_sCAL_s(png_ptr, info_ptr, buffer[0], |
2462 | 142 | (png_charp)buffer+1, (png_charp)buffer+heighti); |
2463 | 3.58k | } |
2464 | 8.13k | } |
2465 | | #endif |
2466 | | |
2467 | | #ifdef PNG_READ_tIME_SUPPORTED |
2468 | | void /* PRIVATE */ |
2469 | | png_handle_tIME(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2470 | 7.27k | { |
2471 | 7.27k | png_byte buf[7]; |
2472 | 7.27k | png_time mod_time; |
2473 | | |
2474 | 7.27k | png_debug(1, "in png_handle_tIME"); |
2475 | | |
2476 | 7.27k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2477 | 41 | png_chunk_error(png_ptr, "missing IHDR"); |
2478 | | |
2479 | 7.23k | else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME) != 0) |
2480 | 365 | { |
2481 | 365 | png_crc_finish(png_ptr, length); |
2482 | 365 | png_chunk_benign_error(png_ptr, "duplicate"); |
2483 | 365 | return; |
2484 | 365 | } |
2485 | | |
2486 | 6.87k | if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
2487 | 159 | png_ptr->mode |= PNG_AFTER_IDAT; |
2488 | | |
2489 | 6.87k | if (length != 7) |
2490 | 672 | { |
2491 | 672 | png_crc_finish(png_ptr, length); |
2492 | 672 | png_chunk_benign_error(png_ptr, "invalid"); |
2493 | 672 | return; |
2494 | 672 | } |
2495 | | |
2496 | 6.19k | png_crc_read(png_ptr, buf, 7); |
2497 | | |
2498 | 6.19k | if (png_crc_finish(png_ptr, 0) != 0) |
2499 | 2.06k | return; |
2500 | | |
2501 | 4.13k | mod_time.second = buf[6]; |
2502 | 4.13k | mod_time.minute = buf[5]; |
2503 | 4.13k | mod_time.hour = buf[4]; |
2504 | 4.13k | mod_time.day = buf[3]; |
2505 | 4.13k | mod_time.month = buf[2]; |
2506 | 4.13k | mod_time.year = png_get_uint_16(buf); |
2507 | | |
2508 | 4.13k | png_set_tIME(png_ptr, info_ptr, &mod_time); |
2509 | 4.13k | } |
2510 | | #endif |
2511 | | |
2512 | | #ifdef PNG_READ_tEXt_SUPPORTED |
2513 | | /* Note: this does not properly handle chunks that are > 64K under DOS */ |
2514 | | void /* PRIVATE */ |
2515 | | png_handle_tEXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2516 | 5.35k | { |
2517 | 5.35k | png_text text_info; |
2518 | 5.35k | png_bytep buffer; |
2519 | 5.35k | png_charp key; |
2520 | 5.35k | png_charp text; |
2521 | 5.35k | png_uint_32 skip = 0; |
2522 | | |
2523 | 5.35k | png_debug(1, "in png_handle_tEXt"); |
2524 | | |
2525 | 5.35k | #ifdef PNG_USER_LIMITS_SUPPORTED |
2526 | 5.35k | if (png_ptr->user_chunk_cache_max != 0) |
2527 | 5.35k | { |
2528 | 5.35k | if (png_ptr->user_chunk_cache_max == 1) |
2529 | 0 | { |
2530 | 0 | png_crc_finish(png_ptr, length); |
2531 | 0 | return; |
2532 | 0 | } |
2533 | | |
2534 | 5.35k | if (--png_ptr->user_chunk_cache_max == 1) |
2535 | 0 | { |
2536 | 0 | png_crc_finish(png_ptr, length); |
2537 | 0 | png_chunk_benign_error(png_ptr, "no space in chunk cache"); |
2538 | 0 | return; |
2539 | 0 | } |
2540 | 5.35k | } |
2541 | 5.35k | #endif |
2542 | | |
2543 | 5.35k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2544 | 24 | png_chunk_error(png_ptr, "missing IHDR"); |
2545 | | |
2546 | 5.33k | if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
2547 | 2.16k | png_ptr->mode |= PNG_AFTER_IDAT; |
2548 | | |
2549 | | #ifdef PNG_MAX_MALLOC_64K |
2550 | | if (length > 65535U) |
2551 | | { |
2552 | | png_crc_finish(png_ptr, length); |
2553 | | png_chunk_benign_error(png_ptr, "too large to fit in memory"); |
2554 | | return; |
2555 | | } |
2556 | | #endif |
2557 | | |
2558 | 5.33k | buffer = png_read_buffer(png_ptr, length+1, 1/*warn*/); |
2559 | | |
2560 | 5.33k | if (buffer == NULL) |
2561 | 0 | { |
2562 | 0 | png_chunk_benign_error(png_ptr, "out of memory"); |
2563 | 0 | return; |
2564 | 0 | } |
2565 | | |
2566 | 5.33k | png_crc_read(png_ptr, buffer, length); |
2567 | | |
2568 | 5.33k | if (png_crc_finish(png_ptr, skip) != 0) |
2569 | 1.36k | return; |
2570 | | |
2571 | 3.97k | key = (png_charp)buffer; |
2572 | 3.97k | key[length] = 0; |
2573 | | |
2574 | 8.38k | for (text = key; *text; text++) |
2575 | 4.41k | /* Empty loop to find end of key */ ; |
2576 | | |
2577 | 3.97k | if (text != key + length) |
2578 | 1.11k | text++; |
2579 | | |
2580 | 3.97k | text_info.compression = PNG_TEXT_COMPRESSION_NONE; |
2581 | 3.97k | text_info.key = key; |
2582 | 3.97k | text_info.lang = NULL; |
2583 | 3.97k | text_info.lang_key = NULL; |
2584 | 3.97k | text_info.itxt_length = 0; |
2585 | 3.97k | text_info.text = text; |
2586 | 3.97k | text_info.text_length = strlen(text); |
2587 | | |
2588 | 3.97k | if (png_set_text_2(png_ptr, info_ptr, &text_info, 1) != 0) |
2589 | 0 | png_warning(png_ptr, "Insufficient memory to process text chunk"); |
2590 | 3.97k | } |
2591 | | #endif |
2592 | | |
2593 | | #ifdef PNG_READ_zTXt_SUPPORTED |
2594 | | /* Note: this does not correctly handle chunks that are > 64K under DOS */ |
2595 | | void /* PRIVATE */ |
2596 | | png_handle_zTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2597 | 8.42k | { |
2598 | 8.42k | png_const_charp errmsg = NULL; |
2599 | 8.42k | png_bytep buffer; |
2600 | 8.42k | png_uint_32 keyword_length; |
2601 | | |
2602 | 8.42k | png_debug(1, "in png_handle_zTXt"); |
2603 | | |
2604 | 8.42k | #ifdef PNG_USER_LIMITS_SUPPORTED |
2605 | 8.42k | if (png_ptr->user_chunk_cache_max != 0) |
2606 | 8.42k | { |
2607 | 8.42k | if (png_ptr->user_chunk_cache_max == 1) |
2608 | 0 | { |
2609 | 0 | png_crc_finish(png_ptr, length); |
2610 | 0 | return; |
2611 | 0 | } |
2612 | | |
2613 | 8.42k | if (--png_ptr->user_chunk_cache_max == 1) |
2614 | 0 | { |
2615 | 0 | png_crc_finish(png_ptr, length); |
2616 | 0 | png_chunk_benign_error(png_ptr, "no space in chunk cache"); |
2617 | 0 | return; |
2618 | 0 | } |
2619 | 8.42k | } |
2620 | 8.42k | #endif |
2621 | | |
2622 | 8.42k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2623 | 53 | png_chunk_error(png_ptr, "missing IHDR"); |
2624 | | |
2625 | 8.37k | if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
2626 | 778 | png_ptr->mode |= PNG_AFTER_IDAT; |
2627 | | |
2628 | | /* Note, "length" is sufficient here; we won't be adding |
2629 | | * a null terminator later. |
2630 | | */ |
2631 | 8.37k | buffer = png_read_buffer(png_ptr, length, 2/*silent*/); |
2632 | | |
2633 | 8.37k | if (buffer == NULL) |
2634 | 668 | { |
2635 | 668 | png_crc_finish(png_ptr, length); |
2636 | 668 | png_chunk_benign_error(png_ptr, "out of memory"); |
2637 | 668 | return; |
2638 | 668 | } |
2639 | | |
2640 | 7.70k | png_crc_read(png_ptr, buffer, length); |
2641 | | |
2642 | 7.70k | if (png_crc_finish(png_ptr, 0) != 0) |
2643 | 1.75k | return; |
2644 | | |
2645 | | /* TODO: also check that the keyword contents match the spec! */ |
2646 | 5.95k | for (keyword_length = 0; |
2647 | 36.2k | keyword_length < length && buffer[keyword_length] != 0; |
2648 | 30.3k | ++keyword_length) |
2649 | 30.3k | /* Empty loop to find end of name */ ; |
2650 | | |
2651 | 5.95k | if (keyword_length > 79 || keyword_length < 1) |
2652 | 1.00k | errmsg = "bad keyword"; |
2653 | | |
2654 | | /* zTXt must have some LZ data after the keyword, although it may expand to |
2655 | | * zero bytes; we need a '\0' at the end of the keyword, the compression type |
2656 | | * then the LZ data: |
2657 | | */ |
2658 | 4.94k | else if (keyword_length + 3 > length) |
2659 | 281 | errmsg = "truncated"; |
2660 | | |
2661 | 4.66k | else if (buffer[keyword_length+1] != PNG_COMPRESSION_TYPE_BASE) |
2662 | 683 | errmsg = "unknown compression type"; |
2663 | | |
2664 | 3.98k | else |
2665 | 3.98k | { |
2666 | 3.98k | png_alloc_size_t uncompressed_length = PNG_SIZE_MAX; |
2667 | | |
2668 | | /* TODO: at present png_decompress_chunk imposes a single application |
2669 | | * level memory limit, this should be split to different values for iCCP |
2670 | | * and text chunks. |
2671 | | */ |
2672 | 3.98k | if (png_decompress_chunk(png_ptr, length, keyword_length+2, |
2673 | 3.98k | &uncompressed_length, 1/*terminate*/) == Z_STREAM_END) |
2674 | 1.41k | { |
2675 | 1.41k | png_text text; |
2676 | | |
2677 | 1.41k | if (png_ptr->read_buffer == NULL) |
2678 | 0 | errmsg="Read failure in png_handle_zTXt"; |
2679 | 1.41k | else |
2680 | 1.41k | { |
2681 | | /* It worked; png_ptr->read_buffer now looks like a tEXt chunk |
2682 | | * except for the extra compression type byte and the fact that |
2683 | | * it isn't necessarily '\0' terminated. |
2684 | | */ |
2685 | 1.41k | buffer = png_ptr->read_buffer; |
2686 | 1.41k | buffer[uncompressed_length+(keyword_length+2)] = 0; |
2687 | | |
2688 | 1.41k | text.compression = PNG_TEXT_COMPRESSION_zTXt; |
2689 | 1.41k | text.key = (png_charp)buffer; |
2690 | 1.41k | text.text = (png_charp)(buffer + keyword_length+2); |
2691 | 1.41k | text.text_length = uncompressed_length; |
2692 | 1.41k | text.itxt_length = 0; |
2693 | 1.41k | text.lang = NULL; |
2694 | 1.41k | text.lang_key = NULL; |
2695 | | |
2696 | 1.41k | if (png_set_text_2(png_ptr, info_ptr, &text, 1) != 0) |
2697 | 0 | errmsg = "insufficient memory"; |
2698 | 1.41k | } |
2699 | 1.41k | } |
2700 | | |
2701 | 2.56k | else |
2702 | 2.56k | errmsg = png_ptr->zstream.msg; |
2703 | 3.98k | } |
2704 | | |
2705 | 5.95k | if (errmsg != NULL) |
2706 | 4.53k | png_chunk_benign_error(png_ptr, errmsg); |
2707 | 5.95k | } |
2708 | | #endif |
2709 | | |
2710 | | #ifdef PNG_READ_iTXt_SUPPORTED |
2711 | | /* Note: this does not correctly handle chunks that are > 64K under DOS */ |
2712 | | void /* PRIVATE */ |
2713 | | png_handle_iTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) |
2714 | 6.61k | { |
2715 | 6.61k | png_const_charp errmsg = NULL; |
2716 | 6.61k | png_bytep buffer; |
2717 | 6.61k | png_uint_32 prefix_length; |
2718 | | |
2719 | 6.61k | png_debug(1, "in png_handle_iTXt"); |
2720 | | |
2721 | 6.61k | #ifdef PNG_USER_LIMITS_SUPPORTED |
2722 | 6.61k | if (png_ptr->user_chunk_cache_max != 0) |
2723 | 6.61k | { |
2724 | 6.61k | if (png_ptr->user_chunk_cache_max == 1) |
2725 | 0 | { |
2726 | 0 | png_crc_finish(png_ptr, length); |
2727 | 0 | return; |
2728 | 0 | } |
2729 | | |
2730 | 6.61k | if (--png_ptr->user_chunk_cache_max == 1) |
2731 | 0 | { |
2732 | 0 | png_crc_finish(png_ptr, length); |
2733 | 0 | png_chunk_benign_error(png_ptr, "no space in chunk cache"); |
2734 | 0 | return; |
2735 | 0 | } |
2736 | 6.61k | } |
2737 | 6.61k | #endif |
2738 | | |
2739 | 6.61k | if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
2740 | 23 | png_chunk_error(png_ptr, "missing IHDR"); |
2741 | | |
2742 | 6.58k | if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) |
2743 | 434 | png_ptr->mode |= PNG_AFTER_IDAT; |
2744 | | |
2745 | 6.58k | buffer = png_read_buffer(png_ptr, length+1, 1/*warn*/); |
2746 | | |
2747 | 6.58k | if (buffer == NULL) |
2748 | 0 | { |
2749 | 0 | png_crc_finish(png_ptr, length); |
2750 | 0 | png_chunk_benign_error(png_ptr, "out of memory"); |
2751 | 0 | return; |
2752 | 0 | } |
2753 | | |
2754 | 6.58k | png_crc_read(png_ptr, buffer, length); |
2755 | | |
2756 | 6.58k | if (png_crc_finish(png_ptr, 0) != 0) |
2757 | 1.55k | return; |
2758 | | |
2759 | | /* First the keyword. */ |
2760 | 5.03k | for (prefix_length=0; |
2761 | 33.9k | prefix_length < length && buffer[prefix_length] != 0; |
2762 | 28.9k | ++prefix_length) |
2763 | 28.9k | /* Empty loop */ ; |
2764 | | |
2765 | | /* Perform a basic check on the keyword length here. */ |
2766 | 5.03k | if (prefix_length > 79 || prefix_length < 1) |
2767 | 1.34k | errmsg = "bad keyword"; |
2768 | | |
2769 | | /* Expect keyword, compression flag, compression type, language, translated |
2770 | | * keyword (both may be empty but are 0 terminated) then the text, which may |
2771 | | * be empty. |
2772 | | */ |
2773 | 3.69k | else if (prefix_length + 5 > length) |
2774 | 512 | errmsg = "truncated"; |
2775 | | |
2776 | 3.17k | else if (buffer[prefix_length+1] == 0 || |
2777 | 2.12k | (buffer[prefix_length+1] == 1 && |
2778 | 1.81k | buffer[prefix_length+2] == PNG_COMPRESSION_TYPE_BASE)) |
2779 | 2.45k | { |
2780 | 2.45k | int compressed = buffer[prefix_length+1] != 0; |
2781 | 2.45k | png_uint_32 language_offset, translated_keyword_offset; |
2782 | 2.45k | png_alloc_size_t uncompressed_length = 0; |
2783 | | |
2784 | | /* Now the language tag */ |
2785 | 2.45k | prefix_length += 3; |
2786 | 2.45k | language_offset = prefix_length; |
2787 | | |
2788 | 4.20k | for (; prefix_length < length && buffer[prefix_length] != 0; |
2789 | 1.75k | ++prefix_length) |
2790 | 1.75k | /* Empty loop */ ; |
2791 | | |
2792 | | /* WARNING: the length may be invalid here, this is checked below. */ |
2793 | 2.45k | translated_keyword_offset = ++prefix_length; |
2794 | | |
2795 | 8.14k | for (; prefix_length < length && buffer[prefix_length] != 0; |
2796 | 5.69k | ++prefix_length) |
2797 | 5.69k | /* Empty loop */ ; |
2798 | | |
2799 | | /* prefix_length should now be at the trailing '\0' of the translated |
2800 | | * keyword, but it may already be over the end. None of this arithmetic |
2801 | | * can overflow because chunks are at most 2^31 bytes long, but on 16-bit |
2802 | | * systems the available allocation may overflow. |
2803 | | */ |
2804 | 2.45k | ++prefix_length; |
2805 | | |
2806 | 2.45k | if (compressed == 0 && prefix_length <= length) |
2807 | 466 | uncompressed_length = length - prefix_length; |
2808 | | |
2809 | 1.98k | else if (compressed != 0 && prefix_length < length) |
2810 | 685 | { |
2811 | 685 | uncompressed_length = PNG_SIZE_MAX; |
2812 | | |
2813 | | /* TODO: at present png_decompress_chunk imposes a single application |
2814 | | * level memory limit, this should be split to different values for |
2815 | | * iCCP and text chunks. |
2816 | | */ |
2817 | 685 | if (png_decompress_chunk(png_ptr, length, prefix_length, |
2818 | 685 | &uncompressed_length, 1/*terminate*/) == Z_STREAM_END) |
2819 | 194 | buffer = png_ptr->read_buffer; |
2820 | | |
2821 | 491 | else |
2822 | 491 | errmsg = png_ptr->zstream.msg; |
2823 | 685 | } |
2824 | | |
2825 | 1.29k | else |
2826 | 1.29k | errmsg = "truncated"; |
2827 | | |
2828 | 2.45k | if (errmsg == NULL) |
2829 | 660 | { |
2830 | 660 | png_text text; |
2831 | | |
2832 | 660 | buffer[uncompressed_length+prefix_length] = 0; |
2833 | | |
2834 | 660 | if (compressed == 0) |
2835 | 466 | text.compression = PNG_ITXT_COMPRESSION_NONE; |
2836 | | |
2837 | 660 | else |
2838 | 194 | text.compression = PNG_ITXT_COMPRESSION_zTXt; |
2839 | | |
2840 | 660 | text.key = (png_charp)buffer; |
2841 | 660 | text.lang = (png_charp)buffer + language_offset; |
2842 | 660 | text.lang_key = (png_charp)buffer + translated_keyword_offset; |
2843 | 660 | text.text = (png_charp)buffer + prefix_length; |
2844 | 660 | text.text_length = 0; |
2845 | 660 | text.itxt_length = uncompressed_length; |
2846 | | |
2847 | 660 | if (png_set_text_2(png_ptr, info_ptr, &text, 1) != 0) |
2848 | 0 | errmsg = "insufficient memory"; |
2849 | 660 | } |
2850 | 2.45k | } |
2851 | | |
2852 | 728 | else |
2853 | 728 | errmsg = "bad compression info"; |
2854 | | |
2855 | 5.03k | if (errmsg != NULL) |
2856 | 4.37k | png_chunk_benign_error(png_ptr, errmsg); |
2857 | 5.03k | } |
2858 | | #endif |
2859 | | |
2860 | | #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED |
2861 | | /* Utility function for png_handle_unknown; set up png_ptr::unknown_chunk */ |
2862 | | static int |
2863 | | png_cache_unknown_chunk(png_structrp png_ptr, png_uint_32 length) |
2864 | 0 | { |
2865 | 0 | png_alloc_size_t limit = PNG_SIZE_MAX; |
2866 | |
|
2867 | 0 | if (png_ptr->unknown_chunk.data != NULL) |
2868 | 0 | { |
2869 | 0 | png_free(png_ptr, png_ptr->unknown_chunk.data); |
2870 | 0 | png_ptr->unknown_chunk.data = NULL; |
2871 | 0 | } |
2872 | |
|
2873 | 0 | # ifdef PNG_SET_USER_LIMITS_SUPPORTED |
2874 | 0 | if (png_ptr->user_chunk_malloc_max > 0 && |
2875 | 0 | png_ptr->user_chunk_malloc_max < limit) |
2876 | 0 | limit = png_ptr->user_chunk_malloc_max; |
2877 | |
|
2878 | | # elif PNG_USER_CHUNK_MALLOC_MAX > 0 |
2879 | | if (PNG_USER_CHUNK_MALLOC_MAX < limit) |
2880 | | limit = PNG_USER_CHUNK_MALLOC_MAX; |
2881 | | # endif |
2882 | |
|
2883 | 0 | if (length <= limit) |
2884 | 0 | { |
2885 | 0 | PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name); |
2886 | | /* The following is safe because of the PNG_SIZE_MAX init above */ |
2887 | 0 | png_ptr->unknown_chunk.size = (size_t)length/*SAFE*/; |
2888 | | /* 'mode' is a flag array, only the bottom four bits matter here */ |
2889 | 0 | png_ptr->unknown_chunk.location = (png_byte)png_ptr->mode/*SAFE*/; |
2890 | |
|
2891 | 0 | if (length == 0) |
2892 | 0 | png_ptr->unknown_chunk.data = NULL; |
2893 | |
|
2894 | 0 | else |
2895 | 0 | { |
2896 | | /* Do a 'warn' here - it is handled below. */ |
2897 | 0 | png_ptr->unknown_chunk.data = png_voidcast(png_bytep, |
2898 | 0 | png_malloc_warn(png_ptr, length)); |
2899 | 0 | } |
2900 | 0 | } |
2901 | |
|
2902 | 0 | if (png_ptr->unknown_chunk.data == NULL && length > 0) |
2903 | 0 | { |
2904 | | /* This is benign because we clean up correctly */ |
2905 | 0 | png_crc_finish(png_ptr, length); |
2906 | 0 | png_chunk_benign_error(png_ptr, "unknown chunk exceeds memory limits"); |
2907 | 0 | return 0; |
2908 | 0 | } |
2909 | | |
2910 | 0 | else |
2911 | 0 | { |
2912 | 0 | if (length > 0) |
2913 | 0 | png_crc_read(png_ptr, png_ptr->unknown_chunk.data, length); |
2914 | 0 | png_crc_finish(png_ptr, 0); |
2915 | 0 | return 1; |
2916 | 0 | } |
2917 | 0 | } |
2918 | | #endif /* READ_UNKNOWN_CHUNKS */ |
2919 | | |
2920 | | /* Handle an unknown, or known but disabled, chunk */ |
2921 | | void /* PRIVATE */ |
2922 | | png_handle_unknown(png_structrp png_ptr, png_inforp info_ptr, |
2923 | | png_uint_32 length, int keep) |
2924 | 7.76k | { |
2925 | 7.76k | int handled = 0; /* the chunk was handled */ |
2926 | | |
2927 | 7.76k | png_debug(1, "in png_handle_unknown"); |
2928 | | |
2929 | 7.76k | #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED |
2930 | | /* NOTE: this code is based on the code in libpng-1.4.12 except for fixing |
2931 | | * the bug which meant that setting a non-default behavior for a specific |
2932 | | * chunk would be ignored (the default was always used unless a user |
2933 | | * callback was installed). |
2934 | | * |
2935 | | * 'keep' is the value from the png_chunk_unknown_handling, the setting for |
2936 | | * this specific chunk_name, if PNG_HANDLE_AS_UNKNOWN_SUPPORTED, if not it |
2937 | | * will always be PNG_HANDLE_CHUNK_AS_DEFAULT and it needs to be set here. |
2938 | | * This is just an optimization to avoid multiple calls to the lookup |
2939 | | * function. |
2940 | | */ |
2941 | | # ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED |
2942 | | # ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED |
2943 | | keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name); |
2944 | | # endif |
2945 | | # endif |
2946 | | |
2947 | | /* One of the following methods will read the chunk or skip it (at least one |
2948 | | * of these is always defined because this is the only way to switch on |
2949 | | * PNG_READ_UNKNOWN_CHUNKS_SUPPORTED) |
2950 | | */ |
2951 | 7.76k | # ifdef PNG_READ_USER_CHUNKS_SUPPORTED |
2952 | | /* The user callback takes precedence over the chunk keep value, but the |
2953 | | * keep value is still required to validate a save of a critical chunk. |
2954 | | */ |
2955 | 7.76k | if (png_ptr->read_user_chunk_fn != NULL) |
2956 | 0 | { |
2957 | 0 | if (png_cache_unknown_chunk(png_ptr, length) != 0) |
2958 | 0 | { |
2959 | | /* Callback to user unknown chunk handler */ |
2960 | 0 | int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr, |
2961 | 0 | &png_ptr->unknown_chunk); |
2962 | | |
2963 | | /* ret is: |
2964 | | * negative: An error occurred; png_chunk_error will be called. |
2965 | | * zero: The chunk was not handled, the chunk will be discarded |
2966 | | * unless png_set_keep_unknown_chunks has been used to set |
2967 | | * a 'keep' behavior for this particular chunk, in which |
2968 | | * case that will be used. A critical chunk will cause an |
2969 | | * error at this point unless it is to be saved. |
2970 | | * positive: The chunk was handled, libpng will ignore/discard it. |
2971 | | */ |
2972 | 0 | if (ret < 0) |
2973 | 0 | png_chunk_error(png_ptr, "error in user chunk"); |
2974 | | |
2975 | 0 | else if (ret == 0) |
2976 | 0 | { |
2977 | | /* If the keep value is 'default' or 'never' override it, but |
2978 | | * still error out on critical chunks unless the keep value is |
2979 | | * 'always' While this is weird it is the behavior in 1.4.12. |
2980 | | * A possible improvement would be to obey the value set for the |
2981 | | * chunk, but this would be an API change that would probably |
2982 | | * damage some applications. |
2983 | | * |
2984 | | * The png_app_warning below catches the case that matters, where |
2985 | | * the application has not set specific save or ignore for this |
2986 | | * chunk or global save or ignore. |
2987 | | */ |
2988 | 0 | if (keep < PNG_HANDLE_CHUNK_IF_SAFE) |
2989 | 0 | { |
2990 | 0 | # ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED |
2991 | 0 | if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE) |
2992 | 0 | { |
2993 | 0 | png_chunk_warning(png_ptr, "Saving unknown chunk:"); |
2994 | 0 | png_app_warning(png_ptr, |
2995 | 0 | "forcing save of an unhandled chunk;" |
2996 | 0 | " please call png_set_keep_unknown_chunks"); |
2997 | | /* with keep = PNG_HANDLE_CHUNK_IF_SAFE */ |
2998 | 0 | } |
2999 | 0 | # endif |
3000 | 0 | keep = PNG_HANDLE_CHUNK_IF_SAFE; |
3001 | 0 | } |
3002 | 0 | } |
3003 | | |
3004 | 0 | else /* chunk was handled */ |
3005 | 0 | { |
3006 | 0 | handled = 1; |
3007 | | /* Critical chunks can be safely discarded at this point. */ |
3008 | 0 | keep = PNG_HANDLE_CHUNK_NEVER; |
3009 | 0 | } |
3010 | 0 | } |
3011 | | |
3012 | 0 | else |
3013 | 0 | keep = PNG_HANDLE_CHUNK_NEVER; /* insufficient memory */ |
3014 | 0 | } |
3015 | | |
3016 | 7.76k | else |
3017 | | /* Use the SAVE_UNKNOWN_CHUNKS code or skip the chunk */ |
3018 | 7.76k | # endif /* READ_USER_CHUNKS */ |
3019 | | |
3020 | 7.76k | # ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED |
3021 | 7.76k | { |
3022 | | /* keep is currently just the per-chunk setting, if there was no |
3023 | | * setting change it to the global default now (not that this may |
3024 | | * still be AS_DEFAULT) then obtain the cache of the chunk if required, |
3025 | | * if not simply skip the chunk. |
3026 | | */ |
3027 | 7.76k | if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT) |
3028 | 7.76k | keep = png_ptr->unknown_default; |
3029 | | |
3030 | 7.76k | if (keep == PNG_HANDLE_CHUNK_ALWAYS || |
3031 | 7.76k | (keep == PNG_HANDLE_CHUNK_IF_SAFE && |
3032 | 0 | PNG_CHUNK_ANCILLARY(png_ptr->chunk_name))) |
3033 | 0 | { |
3034 | 0 | if (png_cache_unknown_chunk(png_ptr, length) == 0) |
3035 | 0 | keep = PNG_HANDLE_CHUNK_NEVER; |
3036 | 0 | } |
3037 | | |
3038 | 7.76k | else |
3039 | 7.76k | png_crc_finish(png_ptr, length); |
3040 | 7.76k | } |
3041 | | # else |
3042 | | # ifndef PNG_READ_USER_CHUNKS_SUPPORTED |
3043 | | # error no method to support READ_UNKNOWN_CHUNKS |
3044 | | # endif |
3045 | | |
3046 | | { |
3047 | | /* If here there is no read callback pointer set and no support is |
3048 | | * compiled in to just save the unknown chunks, so simply skip this |
3049 | | * chunk. If 'keep' is something other than AS_DEFAULT or NEVER then |
3050 | | * the app has erroneously asked for unknown chunk saving when there |
3051 | | * is no support. |
3052 | | */ |
3053 | | if (keep > PNG_HANDLE_CHUNK_NEVER) |
3054 | | png_app_error(png_ptr, "no unknown chunk support available"); |
3055 | | |
3056 | | png_crc_finish(png_ptr, length); |
3057 | | } |
3058 | | # endif |
3059 | | |
3060 | 7.76k | # ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED |
3061 | | /* Now store the chunk in the chunk list if appropriate, and if the limits |
3062 | | * permit it. |
3063 | | */ |
3064 | 7.76k | if (keep == PNG_HANDLE_CHUNK_ALWAYS || |
3065 | 7.64k | (keep == PNG_HANDLE_CHUNK_IF_SAFE && |
3066 | 0 | PNG_CHUNK_ANCILLARY(png_ptr->chunk_name))) |
3067 | 0 | { |
3068 | 0 | # ifdef PNG_USER_LIMITS_SUPPORTED |
3069 | 0 | switch (png_ptr->user_chunk_cache_max) |
3070 | 0 | { |
3071 | 0 | case 2: |
3072 | 0 | png_ptr->user_chunk_cache_max = 1; |
3073 | 0 | png_chunk_benign_error(png_ptr, "no space in chunk cache"); |
3074 | | /* FALLTHROUGH */ |
3075 | 0 | case 1: |
3076 | | /* NOTE: prior to 1.6.0 this case resulted in an unknown critical |
3077 | | * chunk being skipped, now there will be a hard error below. |
3078 | | */ |
3079 | 0 | break; |
3080 | |
|
3081 | 0 | default: /* not at limit */ |
3082 | 0 | --(png_ptr->user_chunk_cache_max); |
3083 | | /* FALLTHROUGH */ |
3084 | 0 | case 0: /* no limit */ |
3085 | 0 | # endif /* USER_LIMITS */ |
3086 | | /* Here when the limit isn't reached or when limits are compiled |
3087 | | * out; store the chunk. |
3088 | | */ |
3089 | 0 | png_set_unknown_chunks(png_ptr, info_ptr, |
3090 | 0 | &png_ptr->unknown_chunk, 1); |
3091 | 0 | handled = 1; |
3092 | 0 | # ifdef PNG_USER_LIMITS_SUPPORTED |
3093 | 0 | break; |
3094 | 7.76k | } |
3095 | 7.76k | # endif |
3096 | 7.76k | } |
3097 | | # else /* no store support: the chunk must be handled by the user callback */ |
3098 | | PNG_UNUSED(info_ptr) |
3099 | | # endif |
3100 | | |
3101 | | /* Regardless of the error handling below the cached data (if any) can be |
3102 | | * freed now. Notice that the data is not freed if there is a png_error, but |
3103 | | * it will be freed by destroy_read_struct. |
3104 | | */ |
3105 | 7.76k | if (png_ptr->unknown_chunk.data != NULL) |
3106 | 0 | png_free(png_ptr, png_ptr->unknown_chunk.data); |
3107 | 7.76k | png_ptr->unknown_chunk.data = NULL; |
3108 | | |
3109 | | #else /* !PNG_READ_UNKNOWN_CHUNKS_SUPPORTED */ |
3110 | | /* There is no support to read an unknown chunk, so just skip it. */ |
3111 | | png_crc_finish(png_ptr, length); |
3112 | | PNG_UNUSED(info_ptr) |
3113 | | PNG_UNUSED(keep) |
3114 | | #endif /* !READ_UNKNOWN_CHUNKS */ |
3115 | | |
3116 | | /* Check for unhandled critical chunks */ |
3117 | 7.76k | if (handled == 0 && PNG_CHUNK_CRITICAL(png_ptr->chunk_name)) |
3118 | 27 | png_chunk_error(png_ptr, "unhandled critical chunk"); |
3119 | 7.76k | } |
3120 | | |
3121 | | /* This function is called to verify that a chunk name is valid. |
3122 | | * This function can't have the "critical chunk check" incorporated |
3123 | | * into it, since in the future we will need to be able to call user |
3124 | | * functions to handle unknown critical chunks after we check that |
3125 | | * the chunk name itself is valid. |
3126 | | */ |
3127 | | |
3128 | | /* Bit hacking: the test for an invalid byte in the 4 byte chunk name is: |
3129 | | * |
3130 | | * ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97)) |
3131 | | */ |
3132 | | |
3133 | | void /* PRIVATE */ |
3134 | | png_check_chunk_name(png_const_structrp png_ptr, png_uint_32 chunk_name) |
3135 | 149k | { |
3136 | 149k | int i; |
3137 | 149k | png_uint_32 cn=chunk_name; |
3138 | | |
3139 | 149k | png_debug(1, "in png_check_chunk_name"); |
3140 | | |
3141 | 734k | for (i=1; i<=4; ++i) |
3142 | 588k | { |
3143 | 588k | int c = cn & 0xff; |
3144 | | |
3145 | 588k | if (c < 65 || c > 122 || (c > 90 && c < 97)) |
3146 | 3.65k | png_chunk_error(png_ptr, "invalid chunk type"); |
3147 | | |
3148 | 584k | cn >>= 8; |
3149 | 584k | } |
3150 | 149k | } |
3151 | | |
3152 | | void /* PRIVATE */ |
3153 | | png_check_chunk_length(png_const_structrp png_ptr, png_uint_32 length) |
3154 | 145k | { |
3155 | 145k | png_alloc_size_t limit = PNG_UINT_31_MAX; |
3156 | | |
3157 | 145k | # ifdef PNG_SET_USER_LIMITS_SUPPORTED |
3158 | 145k | if (png_ptr->user_chunk_malloc_max > 0 && |
3159 | 145k | png_ptr->user_chunk_malloc_max < limit) |
3160 | 145k | limit = png_ptr->user_chunk_malloc_max; |
3161 | | # elif PNG_USER_CHUNK_MALLOC_MAX > 0 |
3162 | | if (PNG_USER_CHUNK_MALLOC_MAX < limit) |
3163 | | limit = PNG_USER_CHUNK_MALLOC_MAX; |
3164 | | # endif |
3165 | 145k | if (png_ptr->chunk_name == png_IDAT) |
3166 | 4.12k | { |
3167 | 4.12k | png_alloc_size_t idat_limit = PNG_UINT_31_MAX; |
3168 | 4.12k | size_t row_factor = |
3169 | 4.12k | (size_t)png_ptr->width |
3170 | 4.12k | * (size_t)png_ptr->channels |
3171 | 3.04k | * (png_ptr->bit_depth > 8? 2: 1) |
3172 | 4.12k | + 1 |
3173 | 2.70k | + (png_ptr->interlaced? 6: 0); |
3174 | 4.12k | if (png_ptr->height > PNG_UINT_32_MAX/row_factor) |
3175 | 0 | idat_limit = PNG_UINT_31_MAX; |
3176 | 4.12k | else |
3177 | 4.12k | idat_limit = png_ptr->height * row_factor; |
3178 | 3.90k | row_factor = row_factor > 32566? 32566 : row_factor; |
3179 | 4.12k | idat_limit += 6 + 5*(idat_limit/row_factor+1); /* zlib+deflate overhead */ |
3180 | 4.12k | idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX; |
3181 | 4.03k | limit = limit < idat_limit? idat_limit : limit; |
3182 | 4.12k | } |
3183 | | |
3184 | 145k | if (length > limit) |
3185 | 549 | { |
3186 | 549 | png_debug2(0," length = %lu, limit = %lu", |
3187 | 549 | (unsigned long)length,(unsigned long)limit); |
3188 | 549 | png_chunk_error(png_ptr, "chunk data is too large"); |
3189 | 549 | } |
3190 | 145k | } |
3191 | | |
3192 | | /* Combines the row recently read in with the existing pixels in the row. This |
3193 | | * routine takes care of alpha and transparency if requested. This routine also |
3194 | | * handles the two methods of progressive display of interlaced images, |
3195 | | * depending on the 'display' value; if 'display' is true then the whole row |
3196 | | * (dp) is filled from the start by replicating the available pixels. If |
3197 | | * 'display' is false only those pixels present in the pass are filled in. |
3198 | | */ |
3199 | | void /* PRIVATE */ |
3200 | | png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display) |
3201 | 3.02M | { |
3202 | 3.02M | unsigned int pixel_depth = png_ptr->transformed_pixel_depth; |
3203 | 3.02M | png_const_bytep sp = png_ptr->row_buf + 1; |
3204 | 3.02M | png_alloc_size_t row_width = png_ptr->width; |
3205 | 3.02M | unsigned int pass = png_ptr->pass; |
3206 | 3.02M | png_bytep end_ptr = 0; |
3207 | 3.02M | png_byte end_byte = 0; |
3208 | 3.02M | unsigned int end_mask; |
3209 | | |
3210 | 3.02M | png_debug(1, "in png_combine_row"); |
3211 | | |
3212 | | /* Added in 1.5.6: it should not be possible to enter this routine until at |
3213 | | * least one row has been read from the PNG data and transformed. |
3214 | | */ |
3215 | 3.02M | if (pixel_depth == 0) |
3216 | 0 | png_error(png_ptr, "internal row logic error"); |
3217 | | |
3218 | | /* Added in 1.5.4: the pixel depth should match the information returned by |
3219 | | * any call to png_read_update_info at this point. Do not continue if we got |
3220 | | * this wrong. |
3221 | | */ |
3222 | 3.02M | if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes != |
3223 | 3.02M | PNG_ROWBYTES(pixel_depth, row_width)) |
3224 | 0 | png_error(png_ptr, "internal row size calculation error"); |
3225 | | |
3226 | | /* Don't expect this to ever happen: */ |
3227 | 3.02M | if (row_width == 0) |
3228 | 0 | png_error(png_ptr, "internal row width error"); |
3229 | | |
3230 | | /* Preserve the last byte in cases where only part of it will be overwritten, |
3231 | | * the multiply below may overflow, we don't care because ANSI-C guarantees |
3232 | | * we get the low bits. |
3233 | | */ |
3234 | 3.02M | end_mask = (pixel_depth * row_width) & 7; |
3235 | 3.02M | if (end_mask != 0) |
3236 | 0 | { |
3237 | | /* end_ptr == NULL is a flag to say do nothing */ |
3238 | 0 | end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1; |
3239 | 0 | end_byte = *end_ptr; |
3240 | 0 | # ifdef PNG_READ_PACKSWAP_SUPPORTED |
3241 | 0 | if ((png_ptr->transformations & PNG_PACKSWAP) != 0) |
3242 | | /* little-endian byte */ |
3243 | 0 | end_mask = (unsigned int)(0xff << end_mask); |
3244 | | |
3245 | 0 | else /* big-endian byte */ |
3246 | 0 | # endif |
3247 | 0 | end_mask = 0xff >> end_mask; |
3248 | | /* end_mask is now the bits to *keep* from the destination row */ |
3249 | 0 | } |
3250 | | |
3251 | | /* For non-interlaced images this reduces to a memcpy(). A memcpy() |
3252 | | * will also happen if interlacing isn't supported or if the application |
3253 | | * does not call png_set_interlace_handling(). In the latter cases the |
3254 | | * caller just gets a sequence of the unexpanded rows from each interlace |
3255 | | * pass. |
3256 | | */ |
3257 | 3.02M | #ifdef PNG_READ_INTERLACING_SUPPORTED |
3258 | 3.02M | if (png_ptr->interlaced != 0 && |
3259 | 3.02M | (png_ptr->transformations & PNG_INTERLACE) != 0 && |
3260 | 3.02M | pass < 6 && (display == 0 || |
3261 | | /* The following copies everything for 'display' on passes 0, 2 and 4. */ |
3262 | 2.81M | (display == 1 && (pass & 1) != 0))) |
3263 | 560k | { |
3264 | | /* Narrow images may have no bits in a pass; the caller should handle |
3265 | | * this, but this test is cheap: |
3266 | | */ |
3267 | 560k | if (row_width <= PNG_PASS_START_COL(pass)) |
3268 | 0 | return; |
3269 | | |
3270 | 560k | if (pixel_depth < 8) |
3271 | 0 | { |
3272 | | /* For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit |
3273 | | * into 32 bits, then a single loop over the bytes using the four byte |
3274 | | * values in the 32-bit mask can be used. For the 'display' option the |
3275 | | * expanded mask may also not require any masking within a byte. To |
3276 | | * make this work the PACKSWAP option must be taken into account - it |
3277 | | * simply requires the pixels to be reversed in each byte. |
3278 | | * |
3279 | | * The 'regular' case requires a mask for each of the first 6 passes, |
3280 | | * the 'display' case does a copy for the even passes in the range |
3281 | | * 0..6. This has already been handled in the test above. |
3282 | | * |
3283 | | * The masks are arranged as four bytes with the first byte to use in |
3284 | | * the lowest bits (little-endian) regardless of the order (PACKSWAP or |
3285 | | * not) of the pixels in each byte. |
3286 | | * |
3287 | | * NOTE: the whole of this logic depends on the caller of this function |
3288 | | * only calling it on rows appropriate to the pass. This function only |
3289 | | * understands the 'x' logic; the 'y' logic is handled by the caller. |
3290 | | * |
3291 | | * The following defines allow generation of compile time constant bit |
3292 | | * masks for each pixel depth and each possibility of swapped or not |
3293 | | * swapped bytes. Pass 'p' is in the range 0..6; 'x', a pixel index, |
3294 | | * is in the range 0..7; and the result is 1 if the pixel is to be |
3295 | | * copied in the pass, 0 if not. 'S' is for the sparkle method, 'B' |
3296 | | * for the block method. |
3297 | | * |
3298 | | * With some compilers a compile time expression of the general form: |
3299 | | * |
3300 | | * (shift >= 32) ? (a >> (shift-32)) : (b >> shift) |
3301 | | * |
3302 | | * Produces warnings with values of 'shift' in the range 33 to 63 |
3303 | | * because the right hand side of the ?: expression is evaluated by |
3304 | | * the compiler even though it isn't used. Microsoft Visual C (various |
3305 | | * versions) and the Intel C compiler are known to do this. To avoid |
3306 | | * this the following macros are used in 1.5.6. This is a temporary |
3307 | | * solution to avoid destabilizing the code during the release process. |
3308 | | */ |
3309 | 0 | # if PNG_USE_COMPILE_TIME_MASKS |
3310 | 0 | # define PNG_LSR(x,s) ((x)>>((s) & 0x1f)) |
3311 | 0 | # define PNG_LSL(x,s) ((x)<<((s) & 0x1f)) |
3312 | | # else |
3313 | | # define PNG_LSR(x,s) ((x)>>(s)) |
3314 | | # define PNG_LSL(x,s) ((x)<<(s)) |
3315 | | # endif |
3316 | 0 | # define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\ |
3317 | 0 | PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1) |
3318 | 0 | # define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\ |
3319 | 0 | PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1) |
3320 | | |
3321 | | /* Return a mask for pass 'p' pixel 'x' at depth 'd'. The mask is |
3322 | | * little endian - the first pixel is at bit 0 - however the extra |
3323 | | * parameter 's' can be set to cause the mask position to be swapped |
3324 | | * within each byte, to match the PNG format. This is done by XOR of |
3325 | | * the shift with 7, 6 or 4 for bit depths 1, 2 and 4. |
3326 | | */ |
3327 | 0 | # define PIXEL_MASK(p,x,d,s) \ |
3328 | 0 | (PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0)))) |
3329 | | |
3330 | | /* Hence generate the appropriate 'block' or 'sparkle' pixel copy mask. |
3331 | | */ |
3332 | 0 | # define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0) |
3333 | 0 | # define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0) |
3334 | | |
3335 | | /* Combine 8 of these to get the full mask. For the 1-bpp and 2-bpp |
3336 | | * cases the result needs replicating, for the 4-bpp case the above |
3337 | | * generates a full 32 bits. |
3338 | | */ |
3339 | 0 | # define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) |
3340 | |
|
3341 | 0 | # define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ |
3342 | 0 | S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ |
3343 | 0 | S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) |
3344 | |
|
3345 | 0 | # define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ |
3346 | 0 | B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ |
3347 | 0 | B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) |
3348 | |
|
3349 | 0 | #if PNG_USE_COMPILE_TIME_MASKS |
3350 | | /* Utility macros to construct all the masks for a depth/swap |
3351 | | * combination. The 's' parameter says whether the format is PNG |
3352 | | * (big endian bytes) or not. Only the three odd-numbered passes are |
3353 | | * required for the display/block algorithm. |
3354 | | */ |
3355 | 0 | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ |
3356 | 0 | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } |
3357 | |
|
3358 | 0 | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } |
3359 | |
|
3360 | 0 | # define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2)) |
3361 | | |
3362 | | /* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and |
3363 | | * then pass: |
3364 | | */ |
3365 | 0 | static const png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] = |
3366 | 0 | { |
3367 | | /* Little-endian byte masks for PACKSWAP */ |
3368 | 0 | { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) }, |
3369 | | /* Normal (big-endian byte) masks - PNG format */ |
3370 | 0 | { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) } |
3371 | 0 | }; |
3372 | | |
3373 | | /* display_mask has only three entries for the odd passes, so index by |
3374 | | * pass>>1. |
3375 | | */ |
3376 | 0 | static const png_uint_32 display_mask[2][3][3] = |
3377 | 0 | { |
3378 | | /* Little-endian byte masks for PACKSWAP */ |
3379 | 0 | { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) }, |
3380 | | /* Normal (big-endian byte) masks - PNG format */ |
3381 | 0 | { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) } |
3382 | 0 | }; |
3383 | |
|
3384 | 0 | # define MASK(pass,depth,display,png)\ |
3385 | 0 | ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\ |
3386 | 0 | row_mask[png][DEPTH_INDEX(depth)][pass]) |
3387 | |
|
3388 | | #else /* !PNG_USE_COMPILE_TIME_MASKS */ |
3389 | | /* This is the runtime alternative: it seems unlikely that this will |
3390 | | * ever be either smaller or faster than the compile time approach. |
3391 | | */ |
3392 | | # define MASK(pass,depth,display,png)\ |
3393 | | ((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png)) |
3394 | | #endif /* !USE_COMPILE_TIME_MASKS */ |
3395 | | |
3396 | | /* Use the appropriate mask to copy the required bits. In some cases |
3397 | | * the byte mask will be 0 or 0xff; optimize these cases. row_width is |
3398 | | * the number of pixels, but the code copies bytes, so it is necessary |
3399 | | * to special case the end. |
3400 | | */ |
3401 | 0 | png_uint_32 pixels_per_byte = 8 / pixel_depth; |
3402 | 0 | png_uint_32 mask; |
3403 | |
|
3404 | 0 | # ifdef PNG_READ_PACKSWAP_SUPPORTED |
3405 | 0 | if ((png_ptr->transformations & PNG_PACKSWAP) != 0) |
3406 | 0 | mask = MASK(pass, pixel_depth, display, 0); |
3407 | |
|
3408 | 0 | else |
3409 | 0 | # endif |
3410 | 0 | mask = MASK(pass, pixel_depth, display, 1); |
3411 | |
|
3412 | 0 | for (;;) |
3413 | 0 | { |
3414 | 0 | png_uint_32 m; |
3415 | | |
3416 | | /* It doesn't matter in the following if png_uint_32 has more than |
3417 | | * 32 bits because the high bits always match those in m<<24; it is, |
3418 | | * however, essential to use OR here, not +, because of this. |
3419 | | */ |
3420 | 0 | m = mask; |
3421 | 0 | mask = (m >> 8) | (m << 24); /* rotate right to good compilers */ |
3422 | 0 | m &= 0xff; |
3423 | |
|
3424 | 0 | if (m != 0) /* something to copy */ |
3425 | 0 | { |
3426 | 0 | if (m != 0xff) |
3427 | 0 | *dp = (png_byte)((*dp & ~m) | (*sp & m)); |
3428 | 0 | else |
3429 | 0 | *dp = *sp; |
3430 | 0 | } |
3431 | | |
3432 | | /* NOTE: this may overwrite the last byte with garbage if the image |
3433 | | * is not an exact number of bytes wide; libpng has always done |
3434 | | * this. |
3435 | | */ |
3436 | 0 | if (row_width <= pixels_per_byte) |
3437 | 0 | break; /* May need to restore part of the last byte */ |
3438 | | |
3439 | 0 | row_width -= pixels_per_byte; |
3440 | 0 | ++dp; |
3441 | 0 | ++sp; |
3442 | 0 | } |
3443 | 0 | } |
3444 | | |
3445 | 560k | else /* pixel_depth >= 8 */ |
3446 | 560k | { |
3447 | 560k | unsigned int bytes_to_copy, bytes_to_jump; |
3448 | | |
3449 | | /* Validate the depth - it must be a multiple of 8 */ |
3450 | 560k | if (pixel_depth & 7) |
3451 | 0 | png_error(png_ptr, "invalid user transform pixel depth"); |
3452 | | |
3453 | 560k | pixel_depth >>= 3; /* now in bytes */ |
3454 | 560k | row_width *= pixel_depth; |
3455 | | |
3456 | | /* Regardless of pass number the Adam 7 interlace always results in a |
3457 | | * fixed number of pixels to copy then to skip. There may be a |
3458 | | * different number of pixels to skip at the start though. |
3459 | | */ |
3460 | 560k | { |
3461 | 560k | unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth; |
3462 | | |
3463 | 560k | row_width -= offset; |
3464 | 560k | dp += offset; |
3465 | 560k | sp += offset; |
3466 | 560k | } |
3467 | | |
3468 | | /* Work out the bytes to copy. */ |
3469 | 560k | if (display != 0) |
3470 | 560k | { |
3471 | | /* When doing the 'block' algorithm the pixel in the pass gets |
3472 | | * replicated to adjacent pixels. This is why the even (0,2,4,6) |
3473 | | * passes are skipped above - the entire expanded row is copied. |
3474 | | */ |
3475 | 560k | bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth; |
3476 | | |
3477 | | /* But don't allow this number to exceed the actual row width. */ |
3478 | 560k | if (bytes_to_copy > row_width) |
3479 | 78.2k | bytes_to_copy = (unsigned int)/*SAFE*/row_width; |
3480 | 560k | } |
3481 | | |
3482 | 0 | else /* normal row; Adam7 only ever gives us one pixel to copy. */ |
3483 | 0 | bytes_to_copy = pixel_depth; |
3484 | | |
3485 | | /* In Adam7 there is a constant offset between where the pixels go. */ |
3486 | 560k | bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth; |
3487 | | |
3488 | | /* And simply copy these bytes. Some optimization is possible here, |
3489 | | * depending on the value of 'bytes_to_copy'. Special case the low |
3490 | | * byte counts, which we know to be frequent. |
3491 | | * |
3492 | | * Notice that these cases all 'return' rather than 'break' - this |
3493 | | * avoids an unnecessary test on whether to restore the last byte |
3494 | | * below. |
3495 | | */ |
3496 | 560k | switch (bytes_to_copy) |
3497 | 560k | { |
3498 | 92.5k | case 1: |
3499 | 92.5k | for (;;) |
3500 | 3.75M | { |
3501 | 3.75M | *dp = *sp; |
3502 | | |
3503 | 3.75M | if (row_width <= bytes_to_jump) |
3504 | 92.5k | return; |
3505 | | |
3506 | 3.66M | dp += bytes_to_jump; |
3507 | 3.66M | sp += bytes_to_jump; |
3508 | 3.66M | row_width -= bytes_to_jump; |
3509 | 3.66M | } |
3510 | | |
3511 | 130k | case 2: |
3512 | | /* There is a possibility of a partial copy at the end here; this |
3513 | | * slows the code down somewhat. |
3514 | | */ |
3515 | 130k | do |
3516 | 7.09M | { |
3517 | 7.09M | dp[0] = sp[0]; dp[1] = sp[1]; |
3518 | | |
3519 | 7.09M | if (row_width <= bytes_to_jump) |
3520 | 129k | return; |
3521 | | |
3522 | 6.96M | sp += bytes_to_jump; |
3523 | 6.96M | dp += bytes_to_jump; |
3524 | 6.96M | row_width -= bytes_to_jump; |
3525 | 6.96M | } |
3526 | 6.96M | while (row_width > 1); |
3527 | | |
3528 | | /* And there can only be one byte left at this point: */ |
3529 | 619 | *dp = *sp; |
3530 | 619 | return; |
3531 | | |
3532 | 124k | case 3: |
3533 | | /* This can only be the RGB case, so each copy is exactly one |
3534 | | * pixel and it is not necessary to check for a partial copy. |
3535 | | */ |
3536 | 124k | for (;;) |
3537 | 1.22M | { |
3538 | 1.22M | dp[0] = sp[0]; dp[1] = sp[1]; dp[2] = sp[2]; |
3539 | | |
3540 | 1.22M | if (row_width <= bytes_to_jump) |
3541 | 124k | return; |
3542 | | |
3543 | 1.10M | sp += bytes_to_jump; |
3544 | 1.10M | dp += bytes_to_jump; |
3545 | 1.10M | row_width -= bytes_to_jump; |
3546 | 1.10M | } |
3547 | | |
3548 | 213k | default: |
3549 | 213k | #if PNG_ALIGN_TYPE != PNG_ALIGN_NONE |
3550 | | /* Check for double byte alignment and, if possible, use a |
3551 | | * 16-bit copy. Don't attempt this for narrow images - ones that |
3552 | | * are less than an interlace panel wide. Don't attempt it for |
3553 | | * wide bytes_to_copy either - use the memcpy there. |
3554 | | */ |
3555 | 213k | if (bytes_to_copy < 16 /*else use memcpy*/ && |
3556 | 194k | png_isaligned(dp, png_uint_16) && |
3557 | 156k | png_isaligned(sp, png_uint_16) && |
3558 | 156k | bytes_to_copy % (sizeof (png_uint_16)) == 0 && |
3559 | 149k | bytes_to_jump % (sizeof (png_uint_16)) == 0) |
3560 | 149k | { |
3561 | | /* Everything is aligned for png_uint_16 copies, but try for |
3562 | | * png_uint_32 first. |
3563 | | */ |
3564 | 149k | if (png_isaligned(dp, png_uint_32) && |
3565 | 130k | png_isaligned(sp, png_uint_32) && |
3566 | 126k | bytes_to_copy % (sizeof (png_uint_32)) == 0 && |
3567 | 124k | bytes_to_jump % (sizeof (png_uint_32)) == 0) |
3568 | 124k | { |
3569 | 124k | png_uint_32p dp32 = png_aligncast(png_uint_32p,dp); |
3570 | 124k | png_const_uint_32p sp32 = png_aligncastconst( |
3571 | 124k | png_const_uint_32p, sp); |
3572 | 124k | size_t skip = (bytes_to_jump-bytes_to_copy) / |
3573 | 124k | (sizeof (png_uint_32)); |
3574 | | |
3575 | 124k | do |
3576 | 11.7M | { |
3577 | 11.7M | size_t c = bytes_to_copy; |
3578 | 11.7M | do |
3579 | 18.8M | { |
3580 | 18.8M | *dp32++ = *sp32++; |
3581 | 18.8M | c -= (sizeof (png_uint_32)); |
3582 | 18.8M | } |
3583 | 18.8M | while (c > 0); |
3584 | | |
3585 | 11.7M | if (row_width <= bytes_to_jump) |
3586 | 105k | return; |
3587 | | |
3588 | 11.6M | dp32 += skip; |
3589 | 11.6M | sp32 += skip; |
3590 | 11.6M | row_width -= bytes_to_jump; |
3591 | 11.6M | } |
3592 | 11.6M | while (bytes_to_copy <= row_width); |
3593 | | |
3594 | | /* Get to here when the row_width truncates the final copy. |
3595 | | * There will be 1-3 bytes left to copy, so don't try the |
3596 | | * 16-bit loop below. |
3597 | | */ |
3598 | 19.9k | dp = (png_bytep)dp32; |
3599 | 19.9k | sp = (png_const_bytep)sp32; |
3600 | 19.9k | do |
3601 | 52.0k | *dp++ = *sp++; |
3602 | 52.0k | while (--row_width > 0); |
3603 | 19.9k | return; |
3604 | 24.6k | } |
3605 | | |
3606 | | /* Else do it in 16-bit quantities, but only if the size is |
3607 | | * not too large. |
3608 | | */ |
3609 | 24.6k | else |
3610 | 24.6k | { |
3611 | 24.6k | png_uint_16p dp16 = png_aligncast(png_uint_16p, dp); |
3612 | 24.6k | png_const_uint_16p sp16 = png_aligncastconst( |
3613 | 24.6k | png_const_uint_16p, sp); |
3614 | 24.6k | size_t skip = (bytes_to_jump-bytes_to_copy) / |
3615 | 24.6k | (sizeof (png_uint_16)); |
3616 | | |
3617 | 24.6k | do |
3618 | 2.76M | { |
3619 | 2.76M | size_t c = bytes_to_copy; |
3620 | 2.76M | do |
3621 | 8.85M | { |
3622 | 8.85M | *dp16++ = *sp16++; |
3623 | 8.85M | c -= (sizeof (png_uint_16)); |
3624 | 8.85M | } |
3625 | 8.85M | while (c > 0); |
3626 | | |
3627 | 2.76M | if (row_width <= bytes_to_jump) |
3628 | 6.02k | return; |
3629 | | |
3630 | 2.75M | dp16 += skip; |
3631 | 2.75M | sp16 += skip; |
3632 | 2.75M | row_width -= bytes_to_jump; |
3633 | 2.75M | } |
3634 | 2.75M | while (bytes_to_copy <= row_width); |
3635 | | |
3636 | | /* End of row - 1 byte left, bytes_to_copy > row_width: */ |
3637 | 18.6k | dp = (png_bytep)dp16; |
3638 | 18.6k | sp = (png_const_bytep)sp16; |
3639 | 18.6k | do |
3640 | 39.6k | *dp++ = *sp++; |
3641 | 39.6k | while (--row_width > 0); |
3642 | 18.6k | return; |
3643 | 63.3k | } |
3644 | 149k | } |
3645 | 63.3k | #endif /* ALIGN_TYPE code */ |
3646 | | |
3647 | | /* The true default - use a memcpy: */ |
3648 | 63.3k | for (;;) |
3649 | 5.20M | { |
3650 | 5.20M | memcpy(dp, sp, bytes_to_copy); |
3651 | | |
3652 | 5.20M | if (row_width <= bytes_to_jump) |
3653 | 63.3k | return; |
3654 | | |
3655 | 5.14M | sp += bytes_to_jump; |
3656 | 5.14M | dp += bytes_to_jump; |
3657 | 5.14M | row_width -= bytes_to_jump; |
3658 | 5.14M | if (bytes_to_copy > row_width) |
3659 | 35.2k | bytes_to_copy = (unsigned int)/*SAFE*/row_width; |
3660 | 5.14M | } |
3661 | 560k | } |
3662 | | |
3663 | | /* NOT REACHED*/ |
3664 | 560k | } /* pixel_depth >= 8 */ |
3665 | | |
3666 | | /* Here if pixel_depth < 8 to check 'end_ptr' below. */ |
3667 | 560k | } |
3668 | 2.46M | else |
3669 | 2.46M | #endif /* READ_INTERLACING */ |
3670 | | |
3671 | | /* If here then the switch above wasn't used so just memcpy the whole row |
3672 | | * from the temporary row buffer (notice that this overwrites the end of the |
3673 | | * destination row if it is a partial byte.) |
3674 | | */ |
3675 | 2.46M | memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width)); |
3676 | | |
3677 | | /* Restore the overwritten bits from the last byte if necessary. */ |
3678 | 2.46M | if (end_ptr != NULL) |
3679 | 0 | *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask)); |
3680 | 2.46M | } |
3681 | | |
3682 | | #ifdef PNG_READ_INTERLACING_SUPPORTED |
3683 | | void /* PRIVATE */ |
3684 | | png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass, |
3685 | | png_uint_32 transformations /* Because these may affect the byte layout */) |
3686 | 668k | { |
3687 | | /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ |
3688 | | /* Offset to next interlace block */ |
3689 | 668k | static const unsigned int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; |
3690 | | |
3691 | 668k | png_debug(1, "in png_do_read_interlace"); |
3692 | 668k | if (row != NULL && row_info != NULL) |
3693 | 668k | { |
3694 | 668k | png_uint_32 final_width; |
3695 | | |
3696 | 668k | final_width = row_info->width * png_pass_inc[pass]; |
3697 | | |
3698 | 668k | switch (row_info->pixel_depth) |
3699 | 668k | { |
3700 | 0 | case 1: |
3701 | 0 | { |
3702 | 0 | png_bytep sp = row + (size_t)((row_info->width - 1) >> 3); |
3703 | 0 | png_bytep dp = row + (size_t)((final_width - 1) >> 3); |
3704 | 0 | unsigned int sshift, dshift; |
3705 | 0 | unsigned int s_start, s_end; |
3706 | 0 | int s_inc; |
3707 | 0 | int jstop = (int)png_pass_inc[pass]; |
3708 | 0 | png_byte v; |
3709 | 0 | png_uint_32 i; |
3710 | 0 | int j; |
3711 | |
|
3712 | 0 | #ifdef PNG_READ_PACKSWAP_SUPPORTED |
3713 | 0 | if ((transformations & PNG_PACKSWAP) != 0) |
3714 | 0 | { |
3715 | 0 | sshift = ((row_info->width + 7) & 0x07); |
3716 | 0 | dshift = ((final_width + 7) & 0x07); |
3717 | 0 | s_start = 7; |
3718 | 0 | s_end = 0; |
3719 | 0 | s_inc = -1; |
3720 | 0 | } |
3721 | | |
3722 | 0 | else |
3723 | 0 | #endif |
3724 | 0 | { |
3725 | 0 | sshift = 7 - ((row_info->width + 7) & 0x07); |
3726 | 0 | dshift = 7 - ((final_width + 7) & 0x07); |
3727 | 0 | s_start = 0; |
3728 | 0 | s_end = 7; |
3729 | 0 | s_inc = 1; |
3730 | 0 | } |
3731 | |
|
3732 | 0 | for (i = 0; i < row_info->width; i++) |
3733 | 0 | { |
3734 | 0 | v = (png_byte)((*sp >> sshift) & 0x01); |
3735 | 0 | for (j = 0; j < jstop; j++) |
3736 | 0 | { |
3737 | 0 | unsigned int tmp = *dp & (0x7f7f >> (7 - dshift)); |
3738 | 0 | tmp |= (unsigned int)(v << dshift); |
3739 | 0 | *dp = (png_byte)(tmp & 0xff); |
3740 | |
|
3741 | 0 | if (dshift == s_end) |
3742 | 0 | { |
3743 | 0 | dshift = s_start; |
3744 | 0 | dp--; |
3745 | 0 | } |
3746 | | |
3747 | 0 | else |
3748 | 0 | dshift = (unsigned int)((int)dshift + s_inc); |
3749 | 0 | } |
3750 | |
|
3751 | 0 | if (sshift == s_end) |
3752 | 0 | { |
3753 | 0 | sshift = s_start; |
3754 | 0 | sp--; |
3755 | 0 | } |
3756 | | |
3757 | 0 | else |
3758 | 0 | sshift = (unsigned int)((int)sshift + s_inc); |
3759 | 0 | } |
3760 | 0 | break; |
3761 | 0 | } |
3762 | | |
3763 | 0 | case 2: |
3764 | 0 | { |
3765 | 0 | png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2); |
3766 | 0 | png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2); |
3767 | 0 | unsigned int sshift, dshift; |
3768 | 0 | unsigned int s_start, s_end; |
3769 | 0 | int s_inc; |
3770 | 0 | int jstop = (int)png_pass_inc[pass]; |
3771 | 0 | png_uint_32 i; |
3772 | |
|
3773 | 0 | #ifdef PNG_READ_PACKSWAP_SUPPORTED |
3774 | 0 | if ((transformations & PNG_PACKSWAP) != 0) |
3775 | 0 | { |
3776 | 0 | sshift = (((row_info->width + 3) & 0x03) << 1); |
3777 | 0 | dshift = (((final_width + 3) & 0x03) << 1); |
3778 | 0 | s_start = 6; |
3779 | 0 | s_end = 0; |
3780 | 0 | s_inc = -2; |
3781 | 0 | } |
3782 | | |
3783 | 0 | else |
3784 | 0 | #endif |
3785 | 0 | { |
3786 | 0 | sshift = ((3 - ((row_info->width + 3) & 0x03)) << 1); |
3787 | 0 | dshift = ((3 - ((final_width + 3) & 0x03)) << 1); |
3788 | 0 | s_start = 0; |
3789 | 0 | s_end = 6; |
3790 | 0 | s_inc = 2; |
3791 | 0 | } |
3792 | |
|
3793 | 0 | for (i = 0; i < row_info->width; i++) |
3794 | 0 | { |
3795 | 0 | png_byte v; |
3796 | 0 | int j; |
3797 | |
|
3798 | 0 | v = (png_byte)((*sp >> sshift) & 0x03); |
3799 | 0 | for (j = 0; j < jstop; j++) |
3800 | 0 | { |
3801 | 0 | unsigned int tmp = *dp & (0x3f3f >> (6 - dshift)); |
3802 | 0 | tmp |= (unsigned int)(v << dshift); |
3803 | 0 | *dp = (png_byte)(tmp & 0xff); |
3804 | |
|
3805 | 0 | if (dshift == s_end) |
3806 | 0 | { |
3807 | 0 | dshift = s_start; |
3808 | 0 | dp--; |
3809 | 0 | } |
3810 | | |
3811 | 0 | else |
3812 | 0 | dshift = (unsigned int)((int)dshift + s_inc); |
3813 | 0 | } |
3814 | |
|
3815 | 0 | if (sshift == s_end) |
3816 | 0 | { |
3817 | 0 | sshift = s_start; |
3818 | 0 | sp--; |
3819 | 0 | } |
3820 | | |
3821 | 0 | else |
3822 | 0 | sshift = (unsigned int)((int)sshift + s_inc); |
3823 | 0 | } |
3824 | 0 | break; |
3825 | 0 | } |
3826 | | |
3827 | 0 | case 4: |
3828 | 0 | { |
3829 | 0 | png_bytep sp = row + (size_t)((row_info->width - 1) >> 1); |
3830 | 0 | png_bytep dp = row + (size_t)((final_width - 1) >> 1); |
3831 | 0 | unsigned int sshift, dshift; |
3832 | 0 | unsigned int s_start, s_end; |
3833 | 0 | int s_inc; |
3834 | 0 | png_uint_32 i; |
3835 | 0 | int jstop = (int)png_pass_inc[pass]; |
3836 | |
|
3837 | 0 | #ifdef PNG_READ_PACKSWAP_SUPPORTED |
3838 | 0 | if ((transformations & PNG_PACKSWAP) != 0) |
3839 | 0 | { |
3840 | 0 | sshift = (((row_info->width + 1) & 0x01) << 2); |
3841 | 0 | dshift = (((final_width + 1) & 0x01) << 2); |
3842 | 0 | s_start = 4; |
3843 | 0 | s_end = 0; |
3844 | 0 | s_inc = -4; |
3845 | 0 | } |
3846 | | |
3847 | 0 | else |
3848 | 0 | #endif |
3849 | 0 | { |
3850 | 0 | sshift = ((1 - ((row_info->width + 1) & 0x01)) << 2); |
3851 | 0 | dshift = ((1 - ((final_width + 1) & 0x01)) << 2); |
3852 | 0 | s_start = 0; |
3853 | 0 | s_end = 4; |
3854 | 0 | s_inc = 4; |
3855 | 0 | } |
3856 | |
|
3857 | 0 | for (i = 0; i < row_info->width; i++) |
3858 | 0 | { |
3859 | 0 | png_byte v = (png_byte)((*sp >> sshift) & 0x0f); |
3860 | 0 | int j; |
3861 | |
|
3862 | 0 | for (j = 0; j < jstop; j++) |
3863 | 0 | { |
3864 | 0 | unsigned int tmp = *dp & (0xf0f >> (4 - dshift)); |
3865 | 0 | tmp |= (unsigned int)(v << dshift); |
3866 | 0 | *dp = (png_byte)(tmp & 0xff); |
3867 | |
|
3868 | 0 | if (dshift == s_end) |
3869 | 0 | { |
3870 | 0 | dshift = s_start; |
3871 | 0 | dp--; |
3872 | 0 | } |
3873 | | |
3874 | 0 | else |
3875 | 0 | dshift = (unsigned int)((int)dshift + s_inc); |
3876 | 0 | } |
3877 | |
|
3878 | 0 | if (sshift == s_end) |
3879 | 0 | { |
3880 | 0 | sshift = s_start; |
3881 | 0 | sp--; |
3882 | 0 | } |
3883 | | |
3884 | 0 | else |
3885 | 0 | sshift = (unsigned int)((int)sshift + s_inc); |
3886 | 0 | } |
3887 | 0 | break; |
3888 | 0 | } |
3889 | | |
3890 | 668k | default: |
3891 | 668k | { |
3892 | 668k | size_t pixel_bytes = (row_info->pixel_depth >> 3); |
3893 | | |
3894 | 668k | png_bytep sp = row + (size_t)(row_info->width - 1) |
3895 | 668k | * pixel_bytes; |
3896 | | |
3897 | 668k | png_bytep dp = row + (size_t)(final_width - 1) * pixel_bytes; |
3898 | | |
3899 | 668k | int jstop = (int)png_pass_inc[pass]; |
3900 | 668k | png_uint_32 i; |
3901 | | |
3902 | 20.7M | for (i = 0; i < row_info->width; i++) |
3903 | 20.1M | { |
3904 | 20.1M | png_byte v[8]; /* SAFE; pixel_depth does not exceed 64 */ |
3905 | 20.1M | int j; |
3906 | | |
3907 | 20.1M | memcpy(v, sp, pixel_bytes); |
3908 | | |
3909 | 97.5M | for (j = 0; j < jstop; j++) |
3910 | 77.4M | { |
3911 | 77.4M | memcpy(dp, v, pixel_bytes); |
3912 | 77.4M | dp -= pixel_bytes; |
3913 | 77.4M | } |
3914 | | |
3915 | 20.1M | sp -= pixel_bytes; |
3916 | 20.1M | } |
3917 | 668k | break; |
3918 | 668k | } |
3919 | 668k | } |
3920 | | |
3921 | 668k | row_info->width = final_width; |
3922 | 668k | row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width); |
3923 | 668k | } |
3924 | | #ifndef PNG_READ_PACKSWAP_SUPPORTED |
3925 | | PNG_UNUSED(transformations) /* Silence compiler warning */ |
3926 | | #endif |
3927 | 668k | } |
3928 | | #endif /* READ_INTERLACING */ |
3929 | | |
3930 | | static void |
3931 | | png_read_filter_row_sub(png_row_infop row_info, png_bytep row, |
3932 | | png_const_bytep prev_row) |
3933 | 66.3k | { |
3934 | 66.3k | size_t i; |
3935 | 66.3k | size_t istop = row_info->rowbytes; |
3936 | 66.3k | unsigned int bpp = (row_info->pixel_depth + 7) >> 3; |
3937 | 66.3k | png_bytep rp = row + bpp; |
3938 | | |
3939 | 66.3k | PNG_UNUSED(prev_row) |
3940 | | |
3941 | 3.66M | for (i = bpp; i < istop; i++) |
3942 | 3.59M | { |
3943 | 3.59M | *rp = (png_byte)(((int)(*rp) + (int)(*(rp-bpp))) & 0xff); |
3944 | 3.59M | rp++; |
3945 | 3.59M | } |
3946 | 66.3k | } |
3947 | | |
3948 | | static void |
3949 | | png_read_filter_row_up(png_row_infop row_info, png_bytep row, |
3950 | | png_const_bytep prev_row) |
3951 | 165k | { |
3952 | 165k | size_t i; |
3953 | 165k | size_t istop = row_info->rowbytes; |
3954 | 165k | png_bytep rp = row; |
3955 | 165k | png_const_bytep pp = prev_row; |
3956 | | |
3957 | 7.66M | for (i = 0; i < istop; i++) |
3958 | 7.49M | { |
3959 | 7.49M | *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff); |
3960 | 7.49M | rp++; |
3961 | 7.49M | } |
3962 | 165k | } |
3963 | | |
3964 | | static void |
3965 | | png_read_filter_row_avg(png_row_infop row_info, png_bytep row, |
3966 | | png_const_bytep prev_row) |
3967 | 191k | { |
3968 | 191k | size_t i; |
3969 | 191k | png_bytep rp = row; |
3970 | 191k | png_const_bytep pp = prev_row; |
3971 | 191k | unsigned int bpp = (row_info->pixel_depth + 7) >> 3; |
3972 | 191k | size_t istop = row_info->rowbytes - bpp; |
3973 | | |
3974 | 393k | for (i = 0; i < bpp; i++) |
3975 | 201k | { |
3976 | 201k | *rp = (png_byte)(((int)(*rp) + |
3977 | 201k | ((int)(*pp++) / 2 )) & 0xff); |
3978 | | |
3979 | 201k | rp++; |
3980 | 201k | } |
3981 | | |
3982 | 2.66M | for (i = 0; i < istop; i++) |
3983 | 2.47M | { |
3984 | 2.47M | *rp = (png_byte)(((int)(*rp) + |
3985 | 2.47M | (int)(*pp++ + *(rp-bpp)) / 2 ) & 0xff); |
3986 | | |
3987 | 2.47M | rp++; |
3988 | 2.47M | } |
3989 | 191k | } |
3990 | | |
3991 | | static void |
3992 | | png_read_filter_row_paeth_1byte_pixel(png_row_infop row_info, png_bytep row, |
3993 | | png_const_bytep prev_row) |
3994 | 61.0k | { |
3995 | 61.0k | png_bytep rp_end = row + row_info->rowbytes; |
3996 | 61.0k | int a, c; |
3997 | | |
3998 | | /* First pixel/byte */ |
3999 | 61.0k | c = *prev_row++; |
4000 | 61.0k | a = *row + c; |
4001 | 61.0k | *row++ = (png_byte)a; |
4002 | | |
4003 | | /* Remainder */ |
4004 | 261k | while (row < rp_end) |
4005 | 200k | { |
4006 | 200k | int b, pa, pb, pc, p; |
4007 | | |
4008 | 200k | a &= 0xff; /* From previous iteration or start */ |
4009 | 200k | b = *prev_row++; |
4010 | | |
4011 | 200k | p = b - c; |
4012 | 200k | pc = a - c; |
4013 | | |
4014 | | #ifdef PNG_USE_ABS |
4015 | | pa = abs(p); |
4016 | | pb = abs(pc); |
4017 | | pc = abs(p + pc); |
4018 | | #else |
4019 | 174k | pa = p < 0 ? -p : p; |
4020 | 198k | pb = pc < 0 ? -pc : pc; |
4021 | 184k | pc = (p + pc) < 0 ? -(p + pc) : p + pc; |
4022 | 200k | #endif |
4023 | | |
4024 | | /* Find the best predictor, the least of pa, pb, pc favoring the earlier |
4025 | | * ones in the case of a tie. |
4026 | | */ |
4027 | 200k | if (pb < pa) |
4028 | 47.0k | { |
4029 | 47.0k | pa = pb; a = b; |
4030 | 47.0k | } |
4031 | 200k | if (pc < pa) a = c; |
4032 | | |
4033 | | /* Calculate the current pixel in a, and move the previous row pixel to c |
4034 | | * for the next time round the loop |
4035 | | */ |
4036 | 200k | c = b; |
4037 | 200k | a += *row; |
4038 | 200k | *row++ = (png_byte)a; |
4039 | 200k | } |
4040 | 61.0k | } |
4041 | | |
4042 | | static void |
4043 | | png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row, |
4044 | | png_const_bytep prev_row) |
4045 | 4.69k | { |
4046 | 4.69k | unsigned int bpp = (row_info->pixel_depth + 7) >> 3; |
4047 | 4.69k | png_bytep rp_end = row + bpp; |
4048 | | |
4049 | | /* Process the first pixel in the row completely (this is the same as 'up' |
4050 | | * because there is only one candidate predictor for the first row). |
4051 | | */ |
4052 | 19.0k | while (row < rp_end) |
4053 | 14.3k | { |
4054 | 14.3k | int a = *row + *prev_row++; |
4055 | 14.3k | *row++ = (png_byte)a; |
4056 | 14.3k | } |
4057 | | |
4058 | | /* Remainder */ |
4059 | 4.69k | rp_end = rp_end + (row_info->rowbytes - bpp); |
4060 | | |
4061 | 2.01M | while (row < rp_end) |
4062 | 2.01M | { |
4063 | 2.01M | int a, b, c, pa, pb, pc, p; |
4064 | | |
4065 | 2.01M | c = *(prev_row - bpp); |
4066 | 2.01M | a = *(row - bpp); |
4067 | 2.01M | b = *prev_row++; |
4068 | | |
4069 | 2.01M | p = b - c; |
4070 | 2.01M | pc = a - c; |
4071 | | |
4072 | | #ifdef PNG_USE_ABS |
4073 | | pa = abs(p); |
4074 | | pb = abs(pc); |
4075 | | pc = abs(p + pc); |
4076 | | #else |
4077 | 1.91M | pa = p < 0 ? -p : p; |
4078 | 1.90M | pb = pc < 0 ? -pc : pc; |
4079 | 1.86M | pc = (p + pc) < 0 ? -(p + pc) : p + pc; |
4080 | 2.01M | #endif |
4081 | | |
4082 | 2.01M | if (pb < pa) |
4083 | 390k | { |
4084 | 390k | pa = pb; a = b; |
4085 | 390k | } |
4086 | 2.01M | if (pc < pa) a = c; |
4087 | | |
4088 | 2.01M | a += *row; |
4089 | 2.01M | *row++ = (png_byte)a; |
4090 | 2.01M | } |
4091 | 4.69k | } |
4092 | | |
4093 | | static void |
4094 | | png_init_filter_functions(png_structrp pp) |
4095 | | /* This function is called once for every PNG image (except for PNG images |
4096 | | * that only use PNG_FILTER_VALUE_NONE for all rows) to set the |
4097 | | * implementations required to reverse the filtering of PNG rows. Reversing |
4098 | | * the filter is the first transformation performed on the row data. It is |
4099 | | * performed in place, therefore an implementation can be selected based on |
4100 | | * the image pixel format. If the implementation depends on image width then |
4101 | | * take care to ensure that it works correctly if the image is interlaced - |
4102 | | * interlacing causes the actual row width to vary. |
4103 | | */ |
4104 | 1.22k | { |
4105 | 1.22k | unsigned int bpp = (pp->pixel_depth + 7) >> 3; |
4106 | | |
4107 | 1.22k | pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub; |
4108 | 1.22k | pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up; |
4109 | 1.22k | pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg; |
4110 | 1.22k | if (bpp == 1) |
4111 | 319 | pp->read_filter[PNG_FILTER_VALUE_PAETH-1] = |
4112 | 319 | png_read_filter_row_paeth_1byte_pixel; |
4113 | 904 | else |
4114 | 904 | pp->read_filter[PNG_FILTER_VALUE_PAETH-1] = |
4115 | 904 | png_read_filter_row_paeth_multibyte_pixel; |
4116 | | |
4117 | 1.22k | #ifdef PNG_FILTER_OPTIMIZATIONS |
4118 | | /* To use this define PNG_FILTER_OPTIMIZATIONS as the name of a function to |
4119 | | * call to install hardware optimizations for the above functions; simply |
4120 | | * replace whatever elements of the pp->read_filter[] array with a hardware |
4121 | | * specific (or, for that matter, generic) optimization. |
4122 | | * |
4123 | | * To see an example of this examine what configure.ac does when |
4124 | | * --enable-arm-neon is specified on the command line. |
4125 | | */ |
4126 | 1.22k | PNG_FILTER_OPTIMIZATIONS(pp, bpp); |
4127 | 1.22k | #endif |
4128 | 1.22k | } |
4129 | | |
4130 | | void /* PRIVATE */ |
4131 | | png_read_filter_row(png_structrp pp, png_row_infop row_info, png_bytep row, |
4132 | | png_const_bytep prev_row, int filter) |
4133 | 550k | { |
4134 | | /* OPTIMIZATION: DO NOT MODIFY THIS FUNCTION, instead #define |
4135 | | * PNG_FILTER_OPTIMIZATIONS to a function that overrides the generic |
4136 | | * implementations. See png_init_filter_functions above. |
4137 | | */ |
4138 | 550k | if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST) |
4139 | 550k | { |
4140 | 550k | if (pp->read_filter[0] == NULL) |
4141 | 1.22k | png_init_filter_functions(pp); |
4142 | | |
4143 | 550k | pp->read_filter[filter-1](row_info, row, prev_row); |
4144 | 550k | } |
4145 | 550k | } |
4146 | | |
4147 | | #ifdef PNG_SEQUENTIAL_READ_SUPPORTED |
4148 | | void /* PRIVATE */ |
4149 | | png_read_IDAT_data(png_structrp png_ptr, png_bytep output, |
4150 | | png_alloc_size_t avail_out) |
4151 | 0 | { |
4152 | | /* Loop reading IDATs and decompressing the result into output[avail_out] */ |
4153 | 0 | png_ptr->zstream.next_out = output; |
4154 | 0 | png_ptr->zstream.avail_out = 0; /* safety: set below */ |
4155 | |
|
4156 | 0 | if (output == NULL) |
4157 | 0 | avail_out = 0; |
4158 | |
|
4159 | 0 | do |
4160 | 0 | { |
4161 | 0 | int ret; |
4162 | 0 | png_byte tmpbuf[PNG_INFLATE_BUF_SIZE]; |
4163 | |
|
4164 | 0 | if (png_ptr->zstream.avail_in == 0) |
4165 | 0 | { |
4166 | 0 | uInt avail_in; |
4167 | 0 | png_bytep buffer; |
4168 | |
|
4169 | 0 | while (png_ptr->idat_size == 0) |
4170 | 0 | { |
4171 | 0 | png_crc_finish(png_ptr, 0); |
4172 | |
|
4173 | 0 | png_ptr->idat_size = png_read_chunk_header(png_ptr); |
4174 | | /* This is an error even in the 'check' case because the code just |
4175 | | * consumed a non-IDAT header. |
4176 | | */ |
4177 | 0 | if (png_ptr->chunk_name != png_IDAT) |
4178 | 0 | png_error(png_ptr, "Not enough image data"); |
4179 | 0 | } |
4180 | |
|
4181 | 0 | avail_in = png_ptr->IDAT_read_size; |
4182 | |
|
4183 | 0 | if (avail_in > png_ptr->idat_size) |
4184 | 0 | avail_in = (uInt)png_ptr->idat_size; |
4185 | | |
4186 | | /* A PNG with a gradually increasing IDAT size will defeat this attempt |
4187 | | * to minimize memory usage by causing lots of re-allocs, but |
4188 | | * realistically doing IDAT_read_size re-allocs is not likely to be a |
4189 | | * big problem. |
4190 | | */ |
4191 | 0 | buffer = png_read_buffer(png_ptr, avail_in, 0/*error*/); |
4192 | |
|
4193 | 0 | png_crc_read(png_ptr, buffer, avail_in); |
4194 | 0 | png_ptr->idat_size -= avail_in; |
4195 | |
|
4196 | 0 | png_ptr->zstream.next_in = buffer; |
4197 | 0 | png_ptr->zstream.avail_in = avail_in; |
4198 | 0 | } |
4199 | | |
4200 | | /* And set up the output side. */ |
4201 | 0 | if (output != NULL) /* standard read */ |
4202 | 0 | { |
4203 | 0 | uInt out = ZLIB_IO_MAX; |
4204 | |
|
4205 | 0 | if (out > avail_out) |
4206 | 0 | out = (uInt)avail_out; |
4207 | |
|
4208 | 0 | avail_out -= out; |
4209 | 0 | png_ptr->zstream.avail_out = out; |
4210 | 0 | } |
4211 | | |
4212 | 0 | else /* after last row, checking for end */ |
4213 | 0 | { |
4214 | 0 | png_ptr->zstream.next_out = tmpbuf; |
4215 | 0 | png_ptr->zstream.avail_out = (sizeof tmpbuf); |
4216 | 0 | } |
4217 | | |
4218 | | /* Use NO_FLUSH; this gives zlib the maximum opportunity to optimize the |
4219 | | * process. If the LZ stream is truncated the sequential reader will |
4220 | | * terminally damage the stream, above, by reading the chunk header of the |
4221 | | * following chunk (it then exits with png_error). |
4222 | | * |
4223 | | * TODO: deal more elegantly with truncated IDAT lists. |
4224 | | */ |
4225 | 0 | ret = PNG_INFLATE(png_ptr, Z_NO_FLUSH); |
4226 | | |
4227 | | /* Take the unconsumed output back. */ |
4228 | 0 | if (output != NULL) |
4229 | 0 | avail_out += png_ptr->zstream.avail_out; |
4230 | | |
4231 | 0 | else /* avail_out counts the extra bytes */ |
4232 | 0 | avail_out += (sizeof tmpbuf) - png_ptr->zstream.avail_out; |
4233 | |
|
4234 | 0 | png_ptr->zstream.avail_out = 0; |
4235 | |
|
4236 | 0 | if (ret == Z_STREAM_END) |
4237 | 0 | { |
4238 | | /* Do this for safety; we won't read any more into this row. */ |
4239 | 0 | png_ptr->zstream.next_out = NULL; |
4240 | |
|
4241 | 0 | png_ptr->mode |= PNG_AFTER_IDAT; |
4242 | 0 | png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED; |
4243 | |
|
4244 | 0 | if (png_ptr->zstream.avail_in > 0 || png_ptr->idat_size > 0) |
4245 | 0 | png_chunk_benign_error(png_ptr, "Extra compressed data"); |
4246 | 0 | break; |
4247 | 0 | } |
4248 | | |
4249 | 0 | if (ret != Z_OK) |
4250 | 0 | { |
4251 | 0 | png_zstream_error(png_ptr, ret); |
4252 | |
|
4253 | 0 | if (output != NULL) |
4254 | 0 | png_chunk_error(png_ptr, png_ptr->zstream.msg); |
4255 | | |
4256 | 0 | else /* checking */ |
4257 | 0 | { |
4258 | 0 | png_chunk_benign_error(png_ptr, png_ptr->zstream.msg); |
4259 | 0 | return; |
4260 | 0 | } |
4261 | 0 | } |
4262 | 0 | } while (avail_out > 0); |
4263 | |
|
4264 | 0 | if (avail_out > 0) |
4265 | 0 | { |
4266 | | /* The stream ended before the image; this is the same as too few IDATs so |
4267 | | * should be handled the same way. |
4268 | | */ |
4269 | 0 | if (output != NULL) |
4270 | 0 | png_error(png_ptr, "Not enough image data"); |
4271 | | |
4272 | 0 | else /* the deflate stream contained extra data */ |
4273 | 0 | png_chunk_benign_error(png_ptr, "Too much image data"); |
4274 | 0 | } |
4275 | 0 | } |
4276 | | |
4277 | | void /* PRIVATE */ |
4278 | | png_read_finish_IDAT(png_structrp png_ptr) |
4279 | 0 | { |
4280 | | /* We don't need any more data and the stream should have ended, however the |
4281 | | * LZ end code may actually not have been processed. In this case we must |
4282 | | * read it otherwise stray unread IDAT data or, more likely, an IDAT chunk |
4283 | | * may still remain to be consumed. |
4284 | | */ |
4285 | 0 | if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0) |
4286 | 0 | { |
4287 | | /* The NULL causes png_read_IDAT_data to swallow any remaining bytes in |
4288 | | * the compressed stream, but the stream may be damaged too, so even after |
4289 | | * this call we may need to terminate the zstream ownership. |
4290 | | */ |
4291 | 0 | png_read_IDAT_data(png_ptr, NULL, 0); |
4292 | 0 | png_ptr->zstream.next_out = NULL; /* safety */ |
4293 | | |
4294 | | /* Now clear everything out for safety; the following may not have been |
4295 | | * done. |
4296 | | */ |
4297 | 0 | if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0) |
4298 | 0 | { |
4299 | 0 | png_ptr->mode |= PNG_AFTER_IDAT; |
4300 | 0 | png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED; |
4301 | 0 | } |
4302 | 0 | } |
4303 | | |
4304 | | /* If the zstream has not been released do it now *and* terminate the reading |
4305 | | * of the final IDAT chunk. |
4306 | | */ |
4307 | 0 | if (png_ptr->zowner == png_IDAT) |
4308 | 0 | { |
4309 | | /* Always do this; the pointers otherwise point into the read buffer. */ |
4310 | 0 | png_ptr->zstream.next_in = NULL; |
4311 | 0 | png_ptr->zstream.avail_in = 0; |
4312 | | |
4313 | | /* Now we no longer own the zstream. */ |
4314 | 0 | png_ptr->zowner = 0; |
4315 | | |
4316 | | /* The slightly weird semantics of the sequential IDAT reading is that we |
4317 | | * are always in or at the end of an IDAT chunk, so we always need to do a |
4318 | | * crc_finish here. If idat_size is non-zero we also need to read the |
4319 | | * spurious bytes at the end of the chunk now. |
4320 | | */ |
4321 | 0 | (void)png_crc_finish(png_ptr, png_ptr->idat_size); |
4322 | 0 | } |
4323 | 0 | } |
4324 | | |
4325 | | void /* PRIVATE */ |
4326 | | png_read_finish_row(png_structrp png_ptr) |
4327 | 0 | { |
4328 | | /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ |
4329 | | |
4330 | | /* Start of interlace block */ |
4331 | 0 | static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; |
4332 | | |
4333 | | /* Offset to next interlace block */ |
4334 | 0 | static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; |
4335 | | |
4336 | | /* Start of interlace block in the y direction */ |
4337 | 0 | static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; |
4338 | | |
4339 | | /* Offset to next interlace block in the y direction */ |
4340 | 0 | static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; |
4341 | |
|
4342 | 0 | png_debug(1, "in png_read_finish_row"); |
4343 | 0 | png_ptr->row_number++; |
4344 | 0 | if (png_ptr->row_number < png_ptr->num_rows) |
4345 | 0 | return; |
4346 | | |
4347 | 0 | if (png_ptr->interlaced != 0) |
4348 | 0 | { |
4349 | 0 | png_ptr->row_number = 0; |
4350 | | |
4351 | | /* TO DO: don't do this if prev_row isn't needed (requires |
4352 | | * read-ahead of the next row's filter byte. |
4353 | | */ |
4354 | 0 | memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); |
4355 | |
|
4356 | 0 | do |
4357 | 0 | { |
4358 | 0 | png_ptr->pass++; |
4359 | |
|
4360 | 0 | if (png_ptr->pass >= 7) |
4361 | 0 | break; |
4362 | | |
4363 | 0 | png_ptr->iwidth = (png_ptr->width + |
4364 | 0 | png_pass_inc[png_ptr->pass] - 1 - |
4365 | 0 | png_pass_start[png_ptr->pass]) / |
4366 | 0 | png_pass_inc[png_ptr->pass]; |
4367 | |
|
4368 | 0 | if ((png_ptr->transformations & PNG_INTERLACE) == 0) |
4369 | 0 | { |
4370 | 0 | png_ptr->num_rows = (png_ptr->height + |
4371 | 0 | png_pass_yinc[png_ptr->pass] - 1 - |
4372 | 0 | png_pass_ystart[png_ptr->pass]) / |
4373 | 0 | png_pass_yinc[png_ptr->pass]; |
4374 | 0 | } |
4375 | | |
4376 | 0 | else /* if (png_ptr->transformations & PNG_INTERLACE) */ |
4377 | 0 | break; /* libpng deinterlacing sees every row */ |
4378 | | |
4379 | 0 | } while (png_ptr->num_rows == 0 || png_ptr->iwidth == 0); |
4380 | |
|
4381 | 0 | if (png_ptr->pass < 7) |
4382 | 0 | return; |
4383 | 0 | } |
4384 | | |
4385 | | /* Here after at the end of the last row of the last pass. */ |
4386 | 0 | png_read_finish_IDAT(png_ptr); |
4387 | 0 | } |
4388 | | #endif /* SEQUENTIAL_READ */ |
4389 | | |
4390 | | void /* PRIVATE */ |
4391 | | png_read_start_row(png_structrp png_ptr) |
4392 | 3.83k | { |
4393 | | /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ |
4394 | | |
4395 | | /* Start of interlace block */ |
4396 | 3.83k | static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; |
4397 | | |
4398 | | /* Offset to next interlace block */ |
4399 | 3.83k | static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; |
4400 | | |
4401 | | /* Start of interlace block in the y direction */ |
4402 | 3.83k | static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; |
4403 | | |
4404 | | /* Offset to next interlace block in the y direction */ |
4405 | 3.83k | static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; |
4406 | | |
4407 | 3.83k | unsigned int max_pixel_depth; |
4408 | 3.83k | size_t row_bytes; |
4409 | | |
4410 | 3.83k | png_debug(1, "in png_read_start_row"); |
4411 | | |
4412 | 3.83k | #ifdef PNG_READ_TRANSFORMS_SUPPORTED |
4413 | 3.83k | png_init_read_transformations(png_ptr); |
4414 | 3.83k | #endif |
4415 | 3.83k | if (png_ptr->interlaced != 0) |
4416 | 1.37k | { |
4417 | 1.37k | if ((png_ptr->transformations & PNG_INTERLACE) == 0) |
4418 | 0 | png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 - |
4419 | 0 | png_pass_ystart[0]) / png_pass_yinc[0]; |
4420 | | |
4421 | 1.37k | else |
4422 | 1.37k | png_ptr->num_rows = png_ptr->height; |
4423 | | |
4424 | 1.37k | png_ptr->iwidth = (png_ptr->width + |
4425 | 1.37k | png_pass_inc[png_ptr->pass] - 1 - |
4426 | 1.37k | png_pass_start[png_ptr->pass]) / |
4427 | 1.37k | png_pass_inc[png_ptr->pass]; |
4428 | 1.37k | } |
4429 | | |
4430 | 2.46k | else |
4431 | 2.46k | { |
4432 | 2.46k | png_ptr->num_rows = png_ptr->height; |
4433 | 2.46k | png_ptr->iwidth = png_ptr->width; |
4434 | 2.46k | } |
4435 | | |
4436 | 3.83k | max_pixel_depth = (unsigned int)png_ptr->pixel_depth; |
4437 | | |
4438 | | /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpler set of |
4439 | | * calculations to calculate the final pixel depth, then |
4440 | | * png_do_read_transforms actually does the transforms. This means that the |
4441 | | * code which effectively calculates this value is actually repeated in three |
4442 | | * separate places. They must all match. Innocent changes to the order of |
4443 | | * transformations can and will break libpng in a way that causes memory |
4444 | | * overwrites. |
4445 | | * |
4446 | | * TODO: fix this. |
4447 | | */ |
4448 | 3.83k | #ifdef PNG_READ_PACK_SUPPORTED |
4449 | 3.83k | if ((png_ptr->transformations & PNG_PACK) != 0 && png_ptr->bit_depth < 8) |
4450 | 295 | max_pixel_depth = 8; |
4451 | 3.83k | #endif |
4452 | | |
4453 | 3.83k | #ifdef PNG_READ_EXPAND_SUPPORTED |
4454 | 3.83k | if ((png_ptr->transformations & PNG_EXPAND) != 0) |
4455 | 694 | { |
4456 | 694 | if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) |
4457 | 0 | { |
4458 | 0 | if (png_ptr->num_trans != 0) |
4459 | 0 | max_pixel_depth = 32; |
4460 | | |
4461 | 0 | else |
4462 | 0 | max_pixel_depth = 24; |
4463 | 0 | } |
4464 | | |
4465 | 694 | else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) |
4466 | 559 | { |
4467 | 559 | if (max_pixel_depth < 8) |
4468 | 496 | max_pixel_depth = 8; |
4469 | | |
4470 | 559 | if (png_ptr->num_trans != 0) |
4471 | 75 | max_pixel_depth *= 2; |
4472 | 559 | } |
4473 | | |
4474 | 135 | else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) |
4475 | 135 | { |
4476 | 135 | if (png_ptr->num_trans != 0) |
4477 | 135 | { |
4478 | 135 | max_pixel_depth *= 4; |
4479 | 135 | max_pixel_depth /= 3; |
4480 | 135 | } |
4481 | 135 | } |
4482 | 694 | } |
4483 | 3.83k | #endif |
4484 | | |
4485 | 3.83k | #ifdef PNG_READ_EXPAND_16_SUPPORTED |
4486 | 3.83k | if ((png_ptr->transformations & PNG_EXPAND_16) != 0) |
4487 | 0 | { |
4488 | 0 | # ifdef PNG_READ_EXPAND_SUPPORTED |
4489 | | /* In fact it is an error if it isn't supported, but checking is |
4490 | | * the safe way. |
4491 | | */ |
4492 | 0 | if ((png_ptr->transformations & PNG_EXPAND) != 0) |
4493 | 0 | { |
4494 | 0 | if (png_ptr->bit_depth < 16) |
4495 | 0 | max_pixel_depth *= 2; |
4496 | 0 | } |
4497 | 0 | else |
4498 | 0 | # endif |
4499 | 0 | png_ptr->transformations &= ~PNG_EXPAND_16; |
4500 | 0 | } |
4501 | 3.83k | #endif |
4502 | | |
4503 | 3.83k | #ifdef PNG_READ_FILLER_SUPPORTED |
4504 | 3.83k | if ((png_ptr->transformations & (PNG_FILLER)) != 0) |
4505 | 0 | { |
4506 | 0 | if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) |
4507 | 0 | { |
4508 | 0 | if (max_pixel_depth <= 8) |
4509 | 0 | max_pixel_depth = 16; |
4510 | | |
4511 | 0 | else |
4512 | 0 | max_pixel_depth = 32; |
4513 | 0 | } |
4514 | | |
4515 | 0 | else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB || |
4516 | 0 | png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) |
4517 | 0 | { |
4518 | 0 | if (max_pixel_depth <= 32) |
4519 | 0 | max_pixel_depth = 32; |
4520 | | |
4521 | 0 | else |
4522 | 0 | max_pixel_depth = 64; |
4523 | 0 | } |
4524 | 0 | } |
4525 | 3.83k | #endif |
4526 | | |
4527 | 3.83k | #ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED |
4528 | 3.83k | if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0) |
4529 | 0 | { |
4530 | 0 | if ( |
4531 | 0 | #ifdef PNG_READ_EXPAND_SUPPORTED |
4532 | 0 | (png_ptr->num_trans != 0 && |
4533 | 0 | (png_ptr->transformations & PNG_EXPAND) != 0) || |
4534 | 0 | #endif |
4535 | 0 | #ifdef PNG_READ_FILLER_SUPPORTED |
4536 | 0 | (png_ptr->transformations & (PNG_FILLER)) != 0 || |
4537 | 0 | #endif |
4538 | 0 | png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) |
4539 | 0 | { |
4540 | 0 | if (max_pixel_depth <= 16) |
4541 | 0 | max_pixel_depth = 32; |
4542 | | |
4543 | 0 | else |
4544 | 0 | max_pixel_depth = 64; |
4545 | 0 | } |
4546 | | |
4547 | 0 | else |
4548 | 0 | { |
4549 | 0 | if (max_pixel_depth <= 8) |
4550 | 0 | { |
4551 | 0 | if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA) |
4552 | 0 | max_pixel_depth = 32; |
4553 | | |
4554 | 0 | else |
4555 | 0 | max_pixel_depth = 24; |
4556 | 0 | } |
4557 | | |
4558 | 0 | else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA) |
4559 | 0 | max_pixel_depth = 64; |
4560 | | |
4561 | 0 | else |
4562 | 0 | max_pixel_depth = 48; |
4563 | 0 | } |
4564 | 0 | } |
4565 | 3.83k | #endif |
4566 | | |
4567 | 3.83k | #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \ |
4568 | 3.83k | defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) |
4569 | 3.83k | if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0) |
4570 | 0 | { |
4571 | 0 | unsigned int user_pixel_depth = png_ptr->user_transform_depth * |
4572 | 0 | png_ptr->user_transform_channels; |
4573 | |
|
4574 | 0 | if (user_pixel_depth > max_pixel_depth) |
4575 | 0 | max_pixel_depth = user_pixel_depth; |
4576 | 0 | } |
4577 | 3.83k | #endif |
4578 | | |
4579 | | /* This value is stored in png_struct and double checked in the row read |
4580 | | * code. |
4581 | | */ |
4582 | 3.83k | png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth; |
4583 | 3.83k | png_ptr->transformed_pixel_depth = 0; /* calculated on demand */ |
4584 | | |
4585 | | /* Align the width on the next larger 8 pixels. Mainly used |
4586 | | * for interlacing |
4587 | | */ |
4588 | 3.83k | row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7)); |
4589 | | /* Calculate the maximum bytes needed, adding a byte and a pixel |
4590 | | * for safety's sake |
4591 | | */ |
4592 | 3.83k | row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) + |
4593 | 3.83k | 1 + ((max_pixel_depth + 7) >> 3U); |
4594 | | |
4595 | | #ifdef PNG_MAX_MALLOC_64K |
4596 | | if (row_bytes > (png_uint_32)65536L) |
4597 | | png_error(png_ptr, "This image requires a row greater than 64KB"); |
4598 | | #endif |
4599 | | |
4600 | 3.83k | if (row_bytes + 48 > png_ptr->old_big_row_buf_size) |
4601 | 3.83k | { |
4602 | 3.83k | png_free(png_ptr, png_ptr->big_row_buf); |
4603 | 3.83k | png_free(png_ptr, png_ptr->big_prev_row); |
4604 | | |
4605 | 3.83k | if (png_ptr->interlaced != 0) |
4606 | 1.37k | png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr, |
4607 | 1.37k | row_bytes + 48); |
4608 | | |
4609 | 2.46k | else |
4610 | 2.46k | png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48); |
4611 | | |
4612 | 3.83k | png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48); |
4613 | | |
4614 | 3.83k | #ifdef PNG_ALIGNED_MEMORY_SUPPORTED |
4615 | | /* Use 16-byte aligned memory for row_buf with at least 16 bytes |
4616 | | * of padding before and after row_buf; treat prev_row similarly. |
4617 | | * NOTE: the alignment is to the start of the pixels, one beyond the start |
4618 | | * of the buffer, because of the filter byte. Prior to libpng 1.5.6 this |
4619 | | * was incorrect; the filter byte was aligned, which had the exact |
4620 | | * opposite effect of that intended. |
4621 | | */ |
4622 | 3.83k | { |
4623 | 3.83k | png_bytep temp = png_ptr->big_row_buf + 32; |
4624 | 3.83k | int extra = (int)((temp - (png_bytep)0) & 0x0f); |
4625 | 3.83k | png_ptr->row_buf = temp - extra - 1/*filter byte*/; |
4626 | | |
4627 | 3.83k | temp = png_ptr->big_prev_row + 32; |
4628 | 3.83k | extra = (int)((temp - (png_bytep)0) & 0x0f); |
4629 | 3.83k | png_ptr->prev_row = temp - extra - 1/*filter byte*/; |
4630 | 3.83k | } |
4631 | | |
4632 | | #else |
4633 | | /* Use 31 bytes of padding before and 17 bytes after row_buf. */ |
4634 | | png_ptr->row_buf = png_ptr->big_row_buf + 31; |
4635 | | png_ptr->prev_row = png_ptr->big_prev_row + 31; |
4636 | | #endif |
4637 | 3.83k | png_ptr->old_big_row_buf_size = row_bytes + 48; |
4638 | 3.83k | } |
4639 | | |
4640 | | #ifdef PNG_MAX_MALLOC_64K |
4641 | | if (png_ptr->rowbytes > 65535) |
4642 | | png_error(png_ptr, "This image requires a row greater than 64KB"); |
4643 | | |
4644 | | #endif |
4645 | 3.83k | if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1)) |
4646 | 0 | png_error(png_ptr, "Row has too many bytes to allocate in memory"); |
4647 | | |
4648 | 3.83k | memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); |
4649 | | |
4650 | 3.83k | png_debug1(3, "width = %u,", png_ptr->width); |
4651 | 3.83k | png_debug1(3, "height = %u,", png_ptr->height); |
4652 | 3.83k | png_debug1(3, "iwidth = %u,", png_ptr->iwidth); |
4653 | 3.83k | png_debug1(3, "num_rows = %u,", png_ptr->num_rows); |
4654 | 3.83k | png_debug1(3, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes); |
4655 | 3.83k | png_debug1(3, "irowbytes = %lu", |
4656 | 3.83k | (unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1); |
4657 | | |
4658 | | /* The sequential reader needs a buffer for IDAT, but the progressive reader |
4659 | | * does not, so free the read buffer now regardless; the sequential reader |
4660 | | * reallocates it on demand. |
4661 | | */ |
4662 | 3.83k | if (png_ptr->read_buffer != NULL) |
4663 | 529 | { |
4664 | 529 | png_bytep buffer = png_ptr->read_buffer; |
4665 | | |
4666 | 529 | png_ptr->read_buffer_size = 0; |
4667 | 529 | png_ptr->read_buffer = NULL; |
4668 | 529 | png_free(png_ptr, buffer); |
4669 | 529 | } |
4670 | | |
4671 | | /* Finally claim the zstream for the inflate of the IDAT data, use the bits |
4672 | | * value from the stream (note that this will result in a fatal error if the |
4673 | | * IDAT stream has a bogus deflate header window_bits value, but this should |
4674 | | * not be happening any longer!) |
4675 | | */ |
4676 | 3.83k | if (png_inflate_claim(png_ptr, png_IDAT) != Z_OK) |
4677 | 0 | png_error(png_ptr, png_ptr->zstream.msg); |
4678 | | |
4679 | 3.83k | png_ptr->flags |= PNG_FLAG_ROW_INIT; |
4680 | 3.83k | } |
4681 | | #endif /* READ */ |