_Z14user_read_dataP14png_struct_defPhm:
   70|  1.04M|void user_read_data(png_structp png_ptr, png_bytep data, size_t length) {
   71|  1.04M|  BufState* buf_state = static_cast<BufState*>(png_get_io_ptr(png_ptr));
  ------------------
  |  |  274|  1.04M|#define png_get_io_ptr OSS_FUZZ_png_get_io_ptr
  ------------------
   72|  1.04M|  if (length > buf_state->bytes_left) {
  ------------------
  |  Branch (72:7): [True: 7.95k, False: 1.03M]
  ------------------
   73|  7.95k|    png_error(png_ptr, "read error");
  ------------------
  |  |  238|  15.9k|#define png_error OSS_FUZZ_png_error
  ------------------
   74|  7.95k|  }
   75|  1.03M|  memcpy(data, buf_state->data, length);
   76|  1.03M|  buf_state->bytes_left -= length;
   77|  1.03M|  buf_state->data += length;
   78|  1.03M|}
_Z14limited_mallocP14png_struct_defm:
   80|  99.6k|void* limited_malloc(png_structp, png_alloc_size_t size) {
   81|       |  // libpng may allocate large amounts of memory that the fuzzer reports as
   82|       |  // an error. In order to silence these errors, make libpng fail when trying
   83|       |  // to allocate a large amount. This allocator used to be in the Chromium
   84|       |  // version of this fuzzer.
   85|       |  // This number is chosen to match the default png_user_chunk_malloc_max.
   86|  99.6k|  if (size > 8000000)
  ------------------
  |  Branch (86:7): [True: 40.6k, False: 59.0k]
  ------------------
   87|  40.6k|    return nullptr;
   88|       |
   89|  59.0k|  return malloc(size);
   90|  99.6k|}
_Z12default_freeP14png_struct_defPv:
   92|  84.5k|void default_free(png_structp, png_voidp ptr) {
   93|  84.5k|  return free(ptr);
   94|  84.5k|}
LLVMFuzzerTestOneInput:
  101|  8.58k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  102|  8.58k|  if (size < kPngHeaderSize) {
  ------------------
  |  Branch (102:7): [True: 4, False: 8.57k]
  ------------------
  103|      4|    return 0;
  104|      4|  }
  105|       |
  106|  8.57k|  std::vector<unsigned char> v(data, data + size);
  107|  8.57k|  if (png_sig_cmp(v.data(), 0, kPngHeaderSize)) {
  ------------------
  |  |  424|  8.57k|#define png_sig_cmp OSS_FUZZ_png_sig_cmp
  ------------------
  |  Branch (107:7): [True: 77, False: 8.50k]
  ------------------
  108|       |    // not a PNG.
  109|     77|    return 0;
  110|     77|  }
  111|       |
  112|  8.50k|  PngObjectHandler png_handler;
  113|  8.50k|  png_handler.png_ptr = nullptr;
  114|  8.50k|  png_handler.row_ptr = nullptr;
  115|  8.50k|  png_handler.info_ptr = nullptr;
  116|  8.50k|  png_handler.end_info_ptr = nullptr;
  117|       |
  118|  8.50k|  png_handler.png_ptr = png_create_read_struct
  ------------------
  |  |  230|  8.50k|#define png_create_read_struct OSS_FUZZ_png_create_read_struct
  ------------------
  119|  8.50k|    (PNG_LIBPNG_VER_STRING, nullptr, nullptr, nullptr);
  ------------------
  |  |  281|  8.50k|#define PNG_LIBPNG_VER_STRING "1.6.40.git"
  ------------------
  120|  8.50k|  if (!png_handler.png_ptr) {
  ------------------
  |  Branch (120:7): [True: 0, False: 8.50k]
  ------------------
  121|      0|    return 0;
  122|      0|  }
  123|       |
  124|  8.50k|  png_handler.info_ptr = png_create_info_struct(png_handler.png_ptr);
  ------------------
  |  |  229|  8.50k|#define png_create_info_struct OSS_FUZZ_png_create_info_struct
  ------------------
  125|  8.50k|  if (!png_handler.info_ptr) {
  ------------------
  |  Branch (125:7): [True: 0, False: 8.50k]
  ------------------
  126|      0|    PNG_CLEANUP
  ------------------
  |  |   27|      0|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (27:6): [True: 0, False: 0]
  |  |  ------------------
  |  |   28|      0|  { \
  |  |   29|      0|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (29:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   30|      0|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   31|      0|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (31:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   32|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   33|      0|        &png_handler.end_info_ptr); \
  |  |   34|      0|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (34:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   35|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   36|      0|        nullptr); \
  |  |   37|      0|    else \
  |  |   38|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   39|      0|    png_handler.png_ptr = nullptr; \
  |  |   40|      0|    png_handler.row_ptr = nullptr; \
  |  |   41|      0|    png_handler.info_ptr = nullptr; \
  |  |   42|      0|    png_handler.end_info_ptr = nullptr; \
  |  |   43|      0|  }
  ------------------
  127|      0|    return 0;
  128|      0|  }
  129|       |
  130|  8.50k|  png_handler.end_info_ptr = png_create_info_struct(png_handler.png_ptr);
  ------------------
  |  |  229|  8.50k|#define png_create_info_struct OSS_FUZZ_png_create_info_struct
  ------------------
  131|  8.50k|  if (!png_handler.end_info_ptr) {
  ------------------
  |  Branch (131:7): [True: 0, False: 8.50k]
  ------------------
  132|      0|    PNG_CLEANUP
  ------------------
  |  |   27|      0|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (27:6): [True: 0, False: 0]
  |  |  ------------------
  |  |   28|      0|  { \
  |  |   29|      0|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (29:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   30|      0|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   31|      0|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (31:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   32|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   33|      0|        &png_handler.end_info_ptr); \
  |  |   34|      0|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (34:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   35|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   36|      0|        nullptr); \
  |  |   37|      0|    else \
  |  |   38|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   39|      0|    png_handler.png_ptr = nullptr; \
  |  |   40|      0|    png_handler.row_ptr = nullptr; \
  |  |   41|      0|    png_handler.info_ptr = nullptr; \
  |  |   42|      0|    png_handler.end_info_ptr = nullptr; \
  |  |   43|      0|  }
  ------------------
  133|      0|    return 0;
  134|      0|  }
  135|       |
  136|       |  // Use a custom allocator that fails for large allocations to avoid OOM.
  137|  8.50k|  png_set_mem_fn(png_handler.png_ptr, nullptr, limited_malloc, default_free);
  ------------------
  |  |  383|  8.50k|#define png_set_mem_fn OSS_FUZZ_png_set_mem_fn
  ------------------
  138|       |
  139|  8.50k|  png_set_crc_action(png_handler.png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
  ------------------
  |  |  362|  8.50k|#define png_set_crc_action OSS_FUZZ_png_set_crc_action
  ------------------
                png_set_crc_action(png_handler.png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
  ------------------
  |  | 1440|  8.50k|#define PNG_CRC_QUIET_USE     4  /* quiet/use data      quiet/use data    */
  ------------------
                png_set_crc_action(png_handler.png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
  ------------------
  |  | 1440|  8.50k|#define PNG_CRC_QUIET_USE     4  /* quiet/use data      quiet/use data    */
  ------------------
  140|  8.50k|#ifdef PNG_IGNORE_ADLER32
  141|  8.50k|  png_set_option(png_handler.png_ptr, PNG_IGNORE_ADLER32, PNG_OPTION_ON);
  ------------------
  |  |  385|  8.50k|#define png_set_option OSS_FUZZ_png_set_option
  ------------------
                png_set_option(png_handler.png_ptr, PNG_IGNORE_ADLER32, PNG_OPTION_ON);
  ------------------
  |  | 3210|  8.50k|#define PNG_IGNORE_ADLER32 8
  ------------------
                png_set_option(png_handler.png_ptr, PNG_IGNORE_ADLER32, PNG_OPTION_ON);
  ------------------
  |  | 3220|  8.50k|#define PNG_OPTION_ON      3
  ------------------
  142|  8.50k|#endif
  143|       |
  144|       |  // Setting up reading from buffer.
  145|  8.50k|  png_handler.buf_state = new BufState();
  146|  8.50k|  png_handler.buf_state->data = data + kPngHeaderSize;
  147|  8.50k|  png_handler.buf_state->bytes_left = size - kPngHeaderSize;
  148|  8.50k|  png_set_read_fn(png_handler.png_ptr, png_handler.buf_state, user_read_data);
  ------------------
  |  |  393|  8.50k|#define png_set_read_fn OSS_FUZZ_png_set_read_fn
  ------------------
  149|  8.50k|  png_set_sig_bytes(png_handler.png_ptr, kPngHeaderSize);
  ------------------
  |  |  409|  8.50k|#define png_set_sig_bytes OSS_FUZZ_png_set_sig_bytes
  ------------------
  150|       |
  151|  8.50k|  if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
  152|  6.62k|    PNG_CLEANUP
  ------------------
  |  |   27|  6.62k|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (27:6): [True: 6.62k, False: 0]
  |  |  ------------------
  |  |   28|  6.62k|  { \
  |  |   29|  6.62k|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (29:9): [True: 0, False: 6.62k]
  |  |  ------------------
  |  |   30|  6.62k|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   31|  6.62k|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (31:9): [True: 6.62k, False: 0]
  |  |  ------------------
  |  |   32|  6.62k|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|  6.62k|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   33|  6.62k|        &png_handler.end_info_ptr); \
  |  |   34|  6.62k|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (34:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   35|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   36|      0|        nullptr); \
  |  |   37|      0|    else \
  |  |   38|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   39|  6.62k|    png_handler.png_ptr = nullptr; \
  |  |   40|  6.62k|    png_handler.row_ptr = nullptr; \
  |  |   41|  6.62k|    png_handler.info_ptr = nullptr; \
  |  |   42|  6.62k|    png_handler.end_info_ptr = nullptr; \
  |  |   43|  6.62k|  }
  ------------------
  153|  6.62k|    return 0;
  154|  6.62k|  }
  155|       |
  156|       |  // Reading.
  157|  1.87k|  png_read_info(png_handler.png_ptr, png_handler.info_ptr);
  ------------------
  |  |  338|  1.87k|#define png_read_info OSS_FUZZ_png_read_info
  ------------------
  158|       |
  159|       |  // reset error handler to put png_deleter into scope.
  160|  1.87k|  if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
  161|  1.80k|    PNG_CLEANUP
  ------------------
  |  |   27|  1.80k|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (27:6): [True: 1.80k, False: 0]
  |  |  ------------------
  |  |   28|  1.80k|  { \
  |  |   29|  1.80k|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (29:9): [True: 1.79k, False: 7]
  |  |  ------------------
  |  |   30|  1.80k|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  239|  1.79k|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   31|  1.80k|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (31:9): [True: 1.80k, False: 0]
  |  |  ------------------
  |  |   32|  1.80k|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|  1.80k|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   33|  1.80k|        &png_handler.end_info_ptr); \
  |  |   34|  1.80k|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (34:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   35|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   36|      0|        nullptr); \
  |  |   37|      0|    else \
  |  |   38|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   39|  1.80k|    png_handler.png_ptr = nullptr; \
  |  |   40|  1.80k|    png_handler.row_ptr = nullptr; \
  |  |   41|  1.80k|    png_handler.info_ptr = nullptr; \
  |  |   42|  1.80k|    png_handler.end_info_ptr = nullptr; \
  |  |   43|  1.80k|  }
  ------------------
  162|  1.80k|    return 0;
  163|  1.80k|  }
  164|       |
  165|     69|  png_uint_32 width, height;
  166|     69|  int bit_depth, color_type, interlace_type, compression_type;
  167|     69|  int filter_type;
  168|       |
  169|     69|  if (!png_get_IHDR(png_handler.png_ptr, png_handler.info_ptr, &width,
  ------------------
  |  |  242|     69|#define png_get_IHDR OSS_FUZZ_png_get_IHDR
  ------------------
  |  Branch (169:7): [True: 0, False: 69]
  ------------------
  170|     69|                    &height, &bit_depth, &color_type, &interlace_type,
  171|     69|                    &compression_type, &filter_type)) {
  172|      0|    PNG_CLEANUP
  ------------------
  |  |   27|      0|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (27:6): [True: 0, False: 0]
  |  |  ------------------
  |  |   28|      0|  { \
  |  |   29|      0|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (29:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   30|      0|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   31|      0|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (31:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   32|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   33|      0|        &png_handler.end_info_ptr); \
  |  |   34|      0|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (34:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   35|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   36|      0|        nullptr); \
  |  |   37|      0|    else \
  |  |   38|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   39|      0|    png_handler.png_ptr = nullptr; \
  |  |   40|      0|    png_handler.row_ptr = nullptr; \
  |  |   41|      0|    png_handler.info_ptr = nullptr; \
  |  |   42|      0|    png_handler.end_info_ptr = nullptr; \
  |  |   43|      0|  }
  ------------------
  173|      0|    return 0;
  174|      0|  }
  175|       |
  176|       |  // This is going to be too slow.
  177|  1.87k|  if (width && height > 100000000 / width) {
  ------------------
  |  Branch (177:7): [True: 1.87k, False: 18.4E]
  |  Branch (177:16): [True: 56, False: 1.81k]
  ------------------
  178|     56|    PNG_CLEANUP
  ------------------
  |  |   27|     56|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (27:6): [True: 56, False: 0]
  |  |  ------------------
  |  |   28|     56|  { \
  |  |   29|     56|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (29:9): [True: 0, False: 56]
  |  |  ------------------
  |  |   30|     56|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   31|     56|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (31:9): [True: 56, False: 0]
  |  |  ------------------
  |  |   32|     56|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|     56|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   33|     56|        &png_handler.end_info_ptr); \
  |  |   34|     56|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (34:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   35|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   36|      0|        nullptr); \
  |  |   37|      0|    else \
  |  |   38|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   39|     56|    png_handler.png_ptr = nullptr; \
  |  |   40|     56|    png_handler.row_ptr = nullptr; \
  |  |   41|     56|    png_handler.info_ptr = nullptr; \
  |  |   42|     56|    png_handler.end_info_ptr = nullptr; \
  |  |   43|     56|  }
  ------------------
  179|     56|    return 0;
  180|     56|  }
  181|       |
  182|       |  // Set several transforms that browsers typically use:
  183|     13|  png_set_gray_to_rgb(png_handler.png_ptr);
  ------------------
  |  |  374|     13|#define png_set_gray_to_rgb OSS_FUZZ_png_set_gray_to_rgb
  ------------------
  184|     13|  png_set_expand(png_handler.png_ptr);
  ------------------
  |  |  366|     13|#define png_set_expand OSS_FUZZ_png_set_expand
  ------------------
  185|     13|  png_set_packing(png_handler.png_ptr);
  ------------------
  |  |  388|     13|#define png_set_packing OSS_FUZZ_png_set_packing
  ------------------
  186|     13|  png_set_scale_16(png_handler.png_ptr);
  ------------------
  |  |  407|     13|#define png_set_scale_16 OSS_FUZZ_png_set_scale_16
  ------------------
  187|     13|  png_set_tRNS_to_alpha(png_handler.png_ptr);
  ------------------
  |  |  416|     13|#define png_set_tRNS_to_alpha OSS_FUZZ_png_set_tRNS_to_alpha
  ------------------
  188|       |
  189|     13|  int passes = png_set_interlace_handling(png_handler.png_ptr);
  ------------------
  |  |  377|     13|#define png_set_interlace_handling OSS_FUZZ_png_set_interlace_handling
  ------------------
  190|       |
  191|     13|  png_read_update_info(png_handler.png_ptr, png_handler.info_ptr);
  ------------------
  |  |  342|     13|#define png_read_update_info OSS_FUZZ_png_read_update_info
  ------------------
  192|       |
  193|     13|  png_handler.row_ptr = png_malloc(
  ------------------
  |  |  328|     13|#define png_malloc OSS_FUZZ_png_malloc
  ------------------
  194|     13|      png_handler.png_ptr, png_get_rowbytes(png_handler.png_ptr,
  ------------------
  |  |  289|     13|#define png_get_rowbytes OSS_FUZZ_png_get_rowbytes
  ------------------
  195|     13|                                            png_handler.info_ptr));
  196|       |
  197|  3.32k|  for (int pass = 0; pass < passes; ++pass) {
  ------------------
  |  Branch (197:22): [True: 3.30k, False: 13]
  ------------------
  198|   267k|    for (png_uint_32 y = 0; y < height; ++y) {
  ------------------
  |  Branch (198:29): [True: 264k, False: 3.30k]
  ------------------
  199|   264k|      png_read_row(png_handler.png_ptr,
  ------------------
  |  |  340|   264k|#define png_read_row OSS_FUZZ_png_read_row
  ------------------
  200|   264k|                   static_cast<png_bytep>(png_handler.row_ptr), nullptr);
  201|   264k|    }
  202|  3.30k|  }
  203|       |
  204|     13|  png_read_end(png_handler.png_ptr, png_handler.end_info_ptr);
  ------------------
  |  |  336|     13|#define png_read_end OSS_FUZZ_png_read_end
  ------------------
  205|       |
  206|     13|  PNG_CLEANUP
  ------------------
  |  |   27|     13|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (27:6): [True: 13, False: 0]
  |  |  ------------------
  |  |   28|     13|  { \
  |  |   29|     13|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (29:9): [True: 13, False: 0]
  |  |  ------------------
  |  |   30|     13|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  239|     13|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   31|     13|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (31:9): [True: 13, False: 0]
  |  |  ------------------
  |  |   32|     13|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|     13|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   33|     13|        &png_handler.end_info_ptr); \
  |  |   34|     13|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (34:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   35|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   36|      0|        nullptr); \
  |  |   37|      0|    else \
  |  |   38|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   39|     13|    png_handler.png_ptr = nullptr; \
  |  |   40|     13|    png_handler.row_ptr = nullptr; \
  |  |   41|     13|    png_handler.info_ptr = nullptr; \
  |  |   42|     13|    png_handler.end_info_ptr = nullptr; \
  |  |   43|     13|  }
  ------------------
  207|     13|  return 0;
  208|     69|}
_ZN16PngObjectHandlerD2Ev:
   57|  8.50k|  ~PngObjectHandler() {
   58|  8.50k|    if (row_ptr)
  ------------------
  |  Branch (58:9): [True: 0, False: 8.50k]
  ------------------
   59|      0|      png_free(png_ptr, row_ptr);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
   60|  8.50k|    if (end_info_ptr)
  ------------------
  |  Branch (60:9): [True: 0, False: 8.50k]
  ------------------
   61|      0|      png_destroy_read_struct(&png_ptr, &info_ptr, &end_info_ptr);
  ------------------
  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  ------------------
   62|  8.50k|    else if (info_ptr)
  ------------------
  |  Branch (62:14): [True: 0, False: 8.50k]
  ------------------
   63|      0|      png_destroy_read_struct(&png_ptr, &info_ptr, nullptr);
  ------------------
  |  |  236|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  ------------------
   64|  8.50k|    else
   65|  8.50k|      png_destroy_read_struct(&png_ptr, nullptr, nullptr);
  ------------------
  |  |  236|  8.50k|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  ------------------
   66|  8.50k|    delete buf_state;
   67|  8.50k|  }

OSS_FUZZ_png_set_sig_bytes:
   48|  8.50k|{
   49|  8.50k|   unsigned int nb = (unsigned int)num_bytes;
   50|       |
   51|  8.50k|   png_debug(1, "in png_set_sig_bytes");
  ------------------
  |  |  145|  8.50k|#  define png_debug(l, m) ((void)0)
  ------------------
   52|       |
   53|  8.50k|   if (png_ptr == NULL)
  ------------------
  |  Branch (53:8): [True: 0, False: 8.50k]
  ------------------
   54|      0|      return;
   55|       |
   56|  8.50k|   if (num_bytes < 0)
  ------------------
  |  Branch (56:8): [True: 0, False: 8.50k]
  ------------------
   57|      0|      nb = 0;
   58|       |
   59|  8.50k|   if (nb > 8)
  ------------------
  |  Branch (59:8): [True: 0, False: 8.50k]
  ------------------
   60|      0|      png_error(png_ptr, "Too many bytes for PNG signature");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
   61|       |
   62|  8.50k|   png_ptr->sig_bytes = (png_byte)nb;
   63|  8.50k|}
OSS_FUZZ_png_sig_cmp:
   75|  8.57k|{
   76|  8.57k|   png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
   77|       |
   78|  8.57k|   if (num_to_check > 8)
  ------------------
  |  Branch (78:8): [True: 0, False: 8.57k]
  ------------------
   79|      0|      num_to_check = 8;
   80|       |
   81|  8.57k|   else if (num_to_check < 1)
  ------------------
  |  Branch (81:13): [True: 0, False: 8.57k]
  ------------------
   82|      0|      return (-1);
   83|       |
   84|  8.57k|   if (start > 7)
  ------------------
  |  Branch (84:8): [True: 0, False: 8.57k]
  ------------------
   85|      0|      return (-1);
   86|       |
   87|  8.57k|   if (start + num_to_check > 8)
  ------------------
  |  Branch (87:8): [True: 0, False: 8.57k]
  ------------------
   88|      0|      num_to_check = 8 - start;
   89|       |
   90|  8.57k|   return ((int)(memcmp(&sig[start], &png_signature[start], num_to_check)));
   91|  8.57k|}
OSS_FUZZ_png_zalloc:
   99|  11.9k|{
  100|  11.9k|   png_alloc_size_t num_bytes = size;
  101|       |
  102|  11.9k|   if (png_ptr == NULL)
  ------------------
  |  Branch (102:8): [True: 0, False: 11.9k]
  ------------------
  103|      0|      return NULL;
  104|       |
  105|  11.9k|   if (items >= (~(png_alloc_size_t)0)/size)
  ------------------
  |  Branch (105:8): [True: 0, False: 11.9k]
  ------------------
  106|      0|   {
  107|      0|      png_warning (png_voidcast(png_structrp, png_ptr),
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
                    png_warning (png_voidcast(png_structrp, png_ptr),
  ------------------
  |  |  500|      0|#  define png_voidcast(type, value) (value)
  ------------------
  108|      0|          "Potential overflow in png_zalloc()");
  109|      0|      return NULL;
  110|      0|   }
  111|       |
  112|  11.9k|   num_bytes *= items;
  113|  11.9k|   return png_malloc_warn(png_voidcast(png_structrp, png_ptr), num_bytes);
  ------------------
  |  |  330|  11.9k|#define png_malloc_warn OSS_FUZZ_png_malloc_warn
  ------------------
                 return png_malloc_warn(png_voidcast(png_structrp, png_ptr), num_bytes);
  ------------------
  |  |  500|  11.9k|#  define png_voidcast(type, value) (value)
  ------------------
  114|  11.9k|}
OSS_FUZZ_png_zfree:
  119|  11.9k|{
  120|  11.9k|   png_free(png_voidcast(png_const_structrp,png_ptr), ptr);
  ------------------
  |  |  239|  11.9k|#define png_free OSS_FUZZ_png_free
  ------------------
                 png_free(png_voidcast(png_const_structrp,png_ptr), ptr);
  ------------------
  |  |  500|  11.9k|#  define png_voidcast(type, value) (value)
  ------------------
  121|  11.9k|}
OSS_FUZZ_png_reset_crc:
  128|   109k|{
  129|       |   /* The cast is safe because the crc is a 32-bit value. */
  130|   109k|   png_ptr->crc = (png_uint_32)crc32(0, Z_NULL, 0);
  131|   109k|}
OSS_FUZZ_png_calculate_crc:
  140|   972k|{
  141|   972k|   int need_crc = 1;
  142|       |
  143|   972k|   if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0)
  ------------------
  |  |  888|   972k|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  ------------------
  |  Branch (143:8): [True: 939k, False: 33.0k]
  ------------------
  144|   939k|   {
  145|   939k|      if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
  ------------------
  |  |  702|   939k|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  678|   939k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  703|   939k|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  679|   939k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
  |  Branch (145:11): [True: 939k, False: 0]
  ------------------
  146|   939k|          (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
  ------------------
  |  |  678|   939k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  ------------------
                        (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
  ------------------
  |  |  679|   939k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
  147|   939k|         need_crc = 0;
  148|   939k|   }
  149|       |
  150|  33.0k|   else /* critical */
  151|  33.0k|   {
  152|  33.0k|      if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)
  ------------------
  |  |  681|  33.0k|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  ------------------
  |  Branch (152:11): [True: 33.0k, False: 0]
  ------------------
  153|  33.0k|         need_crc = 0;
  154|  33.0k|   }
  155|       |
  156|       |   /* 'uLong' is defined in zlib.h as unsigned long; this means that on some
  157|       |    * systems it is a 64-bit value.  crc32, however, returns 32 bits so the
  158|       |    * following cast is safe.  'uInt' may be no more than 16 bits, so it is
  159|       |    * necessary to perform a loop here.
  160|       |    */
  161|   972k|   if (need_crc != 0 && length > 0)
  ------------------
  |  Branch (161:8): [True: 0, False: 972k]
  |  Branch (161:25): [True: 0, False: 0]
  ------------------
  162|      0|   {
  163|      0|      uLong crc = png_ptr->crc; /* Should never issue a warning */
  164|       |
  165|      0|      do
  166|      0|      {
  167|      0|         uInt safe_length = (uInt)length;
  168|      0|#ifndef __COVERITY__
  169|      0|         if (safe_length == 0)
  ------------------
  |  Branch (169:14): [True: 0, False: 0]
  ------------------
  170|      0|            safe_length = (uInt)-1; /* evil, but safe */
  171|      0|#endif
  172|       |
  173|      0|         crc = crc32(crc, ptr, safe_length);
  174|       |
  175|       |         /* The following should never issue compiler warnings; if they do the
  176|       |          * target system has characteristics that will probably violate other
  177|       |          * assumptions within the libpng code.
  178|       |          */
  179|      0|         ptr += safe_length;
  180|      0|         length -= safe_length;
  181|      0|      }
  182|      0|      while (length > 0);
  ------------------
  |  Branch (182:14): [True: 0, False: 0]
  ------------------
  183|       |
  184|       |      /* And the following is always safe because the crc is only 32 bits. */
  185|      0|      png_ptr->crc = (png_uint_32)crc;
  186|      0|   }
  187|   972k|}
OSS_FUZZ_png_user_version_check:
  194|  8.50k|{
  195|       |   /* Libpng versions 1.0.0 and later are binary compatible if the version
  196|       |    * string matches through the second '.'; we must recompile any
  197|       |    * applications that use any older library version.
  198|       |    */
  199|       |
  200|  8.50k|   if (user_png_ver != NULL)
  ------------------
  |  Branch (200:8): [True: 8.50k, False: 0]
  ------------------
  201|  8.50k|   {
  202|  8.50k|      int i = -1;
  203|  8.50k|      int found_dots = 0;
  204|       |
  205|  8.50k|      do
  206|  34.0k|      {
  207|  34.0k|         i++;
  208|  34.0k|         if (user_png_ver[i] != PNG_LIBPNG_VER_STRING[i])
  ------------------
  |  |  281|  34.0k|#define PNG_LIBPNG_VER_STRING "1.6.40.git"
  ------------------
  |  Branch (208:14): [True: 0, False: 34.0k]
  ------------------
  209|      0|            png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
  ------------------
  |  |  687|      0|#define PNG_FLAG_LIBRARY_MISMATCH        0x20000U
  ------------------
  210|  34.0k|         if (user_png_ver[i] == '.')
  ------------------
  |  Branch (210:14): [True: 17.0k, False: 17.0k]
  ------------------
  211|  17.0k|            found_dots++;
  212|  34.0k|      } while (found_dots < 2 && user_png_ver[i] != 0 &&
  ------------------
  |  Branch (212:16): [True: 25.5k, False: 8.50k]
  |  Branch (212:34): [True: 25.5k, False: 0]
  ------------------
  213|  34.0k|            PNG_LIBPNG_VER_STRING[i] != 0);
  ------------------
  |  |  281|  25.5k|#define PNG_LIBPNG_VER_STRING "1.6.40.git"
  ------------------
  |  Branch (213:13): [True: 25.5k, False: 0]
  ------------------
  214|  8.50k|   }
  215|       |
  216|      0|   else
  217|      0|      png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
  ------------------
  |  |  687|      0|#define PNG_FLAG_LIBRARY_MISMATCH        0x20000U
  ------------------
  218|       |
  219|  8.50k|   if ((png_ptr->flags & PNG_FLAG_LIBRARY_MISMATCH) != 0)
  ------------------
  |  |  687|  8.50k|#define PNG_FLAG_LIBRARY_MISMATCH        0x20000U
  ------------------
  |  Branch (219:8): [True: 0, False: 8.50k]
  ------------------
  220|      0|   {
  221|      0|#ifdef PNG_WARNINGS_SUPPORTED
  222|      0|      size_t pos = 0;
  223|      0|      char m[128];
  224|       |
  225|      0|      pos = png_safecat(m, (sizeof m), pos,
  ------------------
  |  |  112|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  226|      0|          "Application built with libpng-");
  227|      0|      pos = png_safecat(m, (sizeof m), pos, user_png_ver);
  ------------------
  |  |  112|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  228|      0|      pos = png_safecat(m, (sizeof m), pos, " but running with ");
  ------------------
  |  |  112|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  229|      0|      pos = png_safecat(m, (sizeof m), pos, PNG_LIBPNG_VER_STRING);
  ------------------
  |  |  112|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
                    pos = png_safecat(m, (sizeof m), pos, PNG_LIBPNG_VER_STRING);
  ------------------
  |  |  281|      0|#define PNG_LIBPNG_VER_STRING "1.6.40.git"
  ------------------
  230|      0|      PNG_UNUSED(pos)
  ------------------
  |  |  444|      0|#  define PNG_UNUSED(param) (void)param;
  ------------------
  231|       |
  232|      0|      png_warning(png_ptr, m);
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  233|      0|#endif
  234|       |
  235|       |#ifdef PNG_ERROR_NUMBERS_SUPPORTED
  236|       |      png_ptr->flags = 0;
  237|       |#endif
  238|       |
  239|      0|      return 0;
  240|      0|   }
  241|       |
  242|       |   /* Success return. */
  243|  8.50k|   return 1;
  244|  8.50k|}
OSS_FUZZ_png_create_png_struct:
  253|  8.50k|{
  254|  8.50k|   png_struct create_struct;
  255|  8.50k|#  ifdef PNG_SETJMP_SUPPORTED
  256|  8.50k|      jmp_buf create_jmp_buf;
  257|  8.50k|#  endif
  258|       |
  259|       |   /* This temporary stack-allocated structure is used to provide a place to
  260|       |    * build enough context to allow the user provided memory allocator (if any)
  261|       |    * to be called.
  262|       |    */
  263|  8.50k|   memset(&create_struct, 0, (sizeof create_struct));
  264|       |
  265|       |   /* Added at libpng-1.2.6 */
  266|  8.50k|#  ifdef PNG_USER_LIMITS_SUPPORTED
  267|  8.50k|      create_struct.user_width_max = PNG_USER_WIDTH_MAX;
  ------------------
  |  |  211|  8.50k|#define PNG_USER_WIDTH_MAX 1000000
  ------------------
  268|  8.50k|      create_struct.user_height_max = PNG_USER_HEIGHT_MAX;
  ------------------
  |  |  210|  8.50k|#define PNG_USER_HEIGHT_MAX 1000000
  ------------------
  269|       |
  270|  8.50k|#     ifdef PNG_USER_CHUNK_CACHE_MAX
  271|       |      /* Added at libpng-1.2.43 and 1.4.0 */
  272|  8.50k|      create_struct.user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;
  ------------------
  |  |  208|  8.50k|#define PNG_USER_CHUNK_CACHE_MAX 1000
  ------------------
  273|  8.50k|#     endif
  274|       |
  275|  8.50k|#     ifdef PNG_USER_CHUNK_MALLOC_MAX
  276|       |      /* Added at libpng-1.2.43 and 1.4.1, required only for read but exists
  277|       |       * in png_struct regardless.
  278|       |       */
  279|  8.50k|      create_struct.user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;
  ------------------
  |  |  209|  8.50k|#define PNG_USER_CHUNK_MALLOC_MAX 8000000
  ------------------
  280|  8.50k|#     endif
  281|  8.50k|#  endif
  282|       |
  283|       |   /* The following two API calls simply set fields in png_struct, so it is safe
  284|       |    * to do them now even though error handling is not yet set up.
  285|       |    */
  286|  8.50k|#  ifdef PNG_USER_MEM_SUPPORTED
  287|  8.50k|      png_set_mem_fn(&create_struct, mem_ptr, malloc_fn, free_fn);
  ------------------
  |  |  383|  8.50k|#define png_set_mem_fn OSS_FUZZ_png_set_mem_fn
  ------------------
  288|       |#  else
  289|       |      PNG_UNUSED(mem_ptr)
  290|       |      PNG_UNUSED(malloc_fn)
  291|       |      PNG_UNUSED(free_fn)
  292|       |#  endif
  293|       |
  294|       |   /* (*error_fn) can return control to the caller after the error_ptr is set,
  295|       |    * this will result in a memory leak unless the error_fn does something
  296|       |    * extremely sophisticated.  The design lacks merit but is implicit in the
  297|       |    * API.
  298|       |    */
  299|  8.50k|   png_set_error_fn(&create_struct, error_ptr, error_fn, warn_fn);
  ------------------
  |  |  365|  8.50k|#define png_set_error_fn OSS_FUZZ_png_set_error_fn
  ------------------
  300|       |
  301|  8.50k|#  ifdef PNG_SETJMP_SUPPORTED
  302|  8.50k|      if (!setjmp(create_jmp_buf))
  ------------------
  |  Branch (302:11): [True: 8.50k, False: 0]
  ------------------
  303|  8.50k|#  endif
  304|  8.50k|      {
  305|  8.50k|#  ifdef PNG_SETJMP_SUPPORTED
  306|       |         /* Temporarily fake out the longjmp information until we have
  307|       |          * successfully completed this function.  This only works if we have
  308|       |          * setjmp() support compiled in, but it is safe - this stuff should
  309|       |          * never happen.
  310|       |          */
  311|  8.50k|         create_struct.jmp_buf_ptr = &create_jmp_buf;
  312|  8.50k|         create_struct.jmp_buf_size = 0; /*stack allocation*/
  313|  8.50k|         create_struct.longjmp_fn = longjmp;
  314|  8.50k|#  endif
  315|       |         /* Call the general version checker (shared with read and write code):
  316|       |          */
  317|  8.50k|         if (png_user_version_check(&create_struct, user_png_ver) != 0)
  ------------------
  |  |    6|  8.50k|#define png_user_version_check OSS_FUZZ_png_user_version_check
  ------------------
  |  Branch (317:14): [True: 8.50k, False: 0]
  ------------------
  318|  8.50k|         {
  319|  8.50k|            png_structrp png_ptr = png_voidcast(png_structrp,
  ------------------
  |  |  500|  8.50k|#  define png_voidcast(type, value) (value)
  ------------------
  320|  8.50k|                png_malloc_warn(&create_struct, (sizeof *png_ptr)));
  321|       |
  322|  8.50k|            if (png_ptr != NULL)
  ------------------
  |  Branch (322:17): [True: 8.50k, False: 0]
  ------------------
  323|  8.50k|            {
  324|       |               /* png_ptr->zstream holds a back-pointer to the png_struct, so
  325|       |                * this can only be done now:
  326|       |                */
  327|  8.50k|               create_struct.zstream.zalloc = png_zalloc;
  ------------------
  |  |   13|  8.50k|#define png_zalloc OSS_FUZZ_png_zalloc
  ------------------
  328|  8.50k|               create_struct.zstream.zfree = png_zfree;
  ------------------
  |  |   14|  8.50k|#define png_zfree OSS_FUZZ_png_zfree
  ------------------
  329|  8.50k|               create_struct.zstream.opaque = png_ptr;
  330|       |
  331|  8.50k|#              ifdef PNG_SETJMP_SUPPORTED
  332|       |               /* Eliminate the local error handling: */
  333|  8.50k|               create_struct.jmp_buf_ptr = NULL;
  334|  8.50k|               create_struct.jmp_buf_size = 0;
  335|  8.50k|               create_struct.longjmp_fn = 0;
  336|  8.50k|#              endif
  337|       |
  338|  8.50k|               *png_ptr = create_struct;
  339|       |
  340|       |               /* This is the successful return point */
  341|  8.50k|               return png_ptr;
  342|  8.50k|            }
  343|  8.50k|         }
  344|  8.50k|      }
  345|       |
  346|       |   /* A longjmp because of a bug in the application storage allocator or a
  347|       |    * simple failure to allocate the png_struct.
  348|       |    */
  349|      0|   return NULL;
  350|  8.50k|}
OSS_FUZZ_png_create_info_struct:
  355|  17.0k|{
  356|  17.0k|   png_inforp info_ptr;
  357|       |
  358|  17.0k|   png_debug(1, "in png_create_info_struct");
  ------------------
  |  |  145|  17.0k|#  define png_debug(l, m) ((void)0)
  ------------------
  359|       |
  360|  17.0k|   if (png_ptr == NULL)
  ------------------
  |  Branch (360:8): [True: 0, False: 17.0k]
  ------------------
  361|      0|      return NULL;
  362|       |
  363|       |   /* Use the internal API that does not (or at least should not) error out, so
  364|       |    * that this call always returns ok.  The application typically sets up the
  365|       |    * error handling *after* creating the info_struct because this is the way it
  366|       |    * has always been done in 'example.c'.
  367|       |    */
  368|  17.0k|   info_ptr = png_voidcast(png_inforp, png_malloc_base(png_ptr,
  ------------------
  |  |  500|  17.0k|#  define png_voidcast(type, value) (value)
  ------------------
  369|  17.0k|       (sizeof *info_ptr)));
  370|       |
  371|  17.0k|   if (info_ptr != NULL)
  ------------------
  |  Branch (371:8): [True: 17.0k, False: 0]
  ------------------
  372|  17.0k|      memset(info_ptr, 0, (sizeof *info_ptr));
  373|       |
  374|  17.0k|   return info_ptr;
  375|  17.0k|}
OSS_FUZZ_png_destroy_info_struct:
  387|  17.0k|{
  388|  17.0k|   png_inforp info_ptr = NULL;
  389|       |
  390|  17.0k|   png_debug(1, "in png_destroy_info_struct");
  ------------------
  |  |  145|  17.0k|#  define png_debug(l, m) ((void)0)
  ------------------
  391|       |
  392|  17.0k|   if (png_ptr == NULL)
  ------------------
  |  Branch (392:8): [True: 0, False: 17.0k]
  ------------------
  393|      0|      return;
  394|       |
  395|  17.0k|   if (info_ptr_ptr != NULL)
  ------------------
  |  Branch (395:8): [True: 17.0k, False: 0]
  ------------------
  396|  17.0k|      info_ptr = *info_ptr_ptr;
  397|       |
  398|  17.0k|   if (info_ptr != NULL)
  ------------------
  |  Branch (398:8): [True: 17.0k, False: 0]
  ------------------
  399|  17.0k|   {
  400|       |      /* Do this first in case of an error below; if the app implements its own
  401|       |       * memory management this can lead to png_free calling png_error, which
  402|       |       * will abort this routine and return control to the app error handler.
  403|       |       * An infinite loop may result if it then tries to free the same info
  404|       |       * ptr.
  405|       |       */
  406|  17.0k|      *info_ptr_ptr = NULL;
  407|       |
  408|  17.0k|      png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);
  ------------------
  |  |  240|  17.0k|#define png_free_data OSS_FUZZ_png_free_data
  ------------------
                    png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);
  ------------------
  |  | 1762|  17.0k|#define PNG_FREE_ALL  0xffffU
  ------------------
  409|  17.0k|      memset(info_ptr, 0, (sizeof *info_ptr));
  410|  17.0k|      png_free(png_ptr, info_ptr);
  ------------------
  |  |  239|  17.0k|#define png_free OSS_FUZZ_png_free
  ------------------
  411|  17.0k|   }
  412|  17.0k|}
OSS_FUZZ_png_free_data:
  473|  25.3k|{
  474|  25.3k|   png_debug(1, "in png_free_data");
  ------------------
  |  |  145|  25.3k|#  define png_debug(l, m) ((void)0)
  ------------------
  475|       |
  476|  25.3k|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (476:8): [True: 0, False: 25.3k]
  |  Branch (476:27): [True: 0, False: 25.3k]
  ------------------
  477|      0|      return;
  478|       |
  479|  25.3k|#ifdef PNG_TEXT_SUPPORTED
  480|       |   /* Free text item num or (if num == -1) all text items */
  481|  25.3k|   if (info_ptr->text != NULL &&
  ------------------
  |  Branch (481:8): [True: 1.18k, False: 24.1k]
  ------------------
  482|  25.3k|       ((mask & PNG_FREE_TEXT) & info_ptr->free_me) != 0)
  ------------------
  |  | 1760|  1.18k|#define PNG_FREE_TEXT 0x4000U
  ------------------
  |  Branch (482:8): [True: 386, False: 802]
  ------------------
  483|    386|   {
  484|    386|      if (num != -1)
  ------------------
  |  Branch (484:11): [True: 0, False: 386]
  ------------------
  485|      0|      {
  486|      0|         png_free(png_ptr, info_ptr->text[num].key);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  487|      0|         info_ptr->text[num].key = NULL;
  488|      0|      }
  489|       |
  490|    386|      else
  491|    386|      {
  492|    386|         int i;
  493|       |
  494|  4.97k|         for (i = 0; i < info_ptr->num_text; i++)
  ------------------
  |  Branch (494:22): [True: 4.58k, False: 386]
  ------------------
  495|  4.58k|            png_free(png_ptr, info_ptr->text[i].key);
  ------------------
  |  |  239|  4.58k|#define png_free OSS_FUZZ_png_free
  ------------------
  496|       |
  497|    386|         png_free(png_ptr, info_ptr->text);
  ------------------
  |  |  239|    386|#define png_free OSS_FUZZ_png_free
  ------------------
  498|    386|         info_ptr->text = NULL;
  499|    386|         info_ptr->num_text = 0;
  500|    386|         info_ptr->max_text = 0;
  501|    386|      }
  502|    386|   }
  503|  25.3k|#endif
  504|       |
  505|  25.3k|#ifdef PNG_tRNS_SUPPORTED
  506|       |   /* Free any tRNS entry */
  507|  25.3k|   if (((mask & PNG_FREE_TRNS) & info_ptr->free_me) != 0)
  ------------------
  |  | 1759|  25.3k|#define PNG_FREE_TRNS 0x2000U
  ------------------
  |  Branch (507:8): [True: 486, False: 24.8k]
  ------------------
  508|    486|   {
  509|    486|      info_ptr->valid &= ~PNG_INFO_tRNS;
  ------------------
  |  |  736|    486|#define PNG_INFO_tRNS 0x0010U
  ------------------
  510|    486|      png_free(png_ptr, info_ptr->trans_alpha);
  ------------------
  |  |  239|    486|#define png_free OSS_FUZZ_png_free
  ------------------
  511|    486|      info_ptr->trans_alpha = NULL;
  512|    486|      info_ptr->num_trans = 0;
  513|    486|   }
  514|  25.3k|#endif
  515|       |
  516|  25.3k|#ifdef PNG_sCAL_SUPPORTED
  517|       |   /* Free any sCAL entry */
  518|  25.3k|   if (((mask & PNG_FREE_SCAL) & info_ptr->free_me) != 0)
  ------------------
  |  | 1753|  25.3k|#define PNG_FREE_SCAL 0x0100U
  ------------------
  |  Branch (518:8): [True: 145, False: 25.2k]
  ------------------
  519|    145|   {
  520|    145|      png_free(png_ptr, info_ptr->scal_s_width);
  ------------------
  |  |  239|    145|#define png_free OSS_FUZZ_png_free
  ------------------
  521|    145|      png_free(png_ptr, info_ptr->scal_s_height);
  ------------------
  |  |  239|    145|#define png_free OSS_FUZZ_png_free
  ------------------
  522|    145|      info_ptr->scal_s_width = NULL;
  523|    145|      info_ptr->scal_s_height = NULL;
  524|    145|      info_ptr->valid &= ~PNG_INFO_sCAL;
  ------------------
  |  |  746|    145|#define PNG_INFO_sCAL 0x4000U  /* ESR, 1.0.6 */
  ------------------
  525|    145|   }
  526|  25.3k|#endif
  527|       |
  528|  25.3k|#ifdef PNG_pCAL_SUPPORTED
  529|       |   /* Free any pCAL entry */
  530|  25.3k|   if (((mask & PNG_FREE_PCAL) & info_ptr->free_me) != 0)
  ------------------
  |  | 1752|  25.3k|#define PNG_FREE_PCAL 0x0080U
  ------------------
  |  Branch (530:8): [True: 11, False: 25.3k]
  ------------------
  531|     11|   {
  532|     11|      png_free(png_ptr, info_ptr->pcal_purpose);
  ------------------
  |  |  239|     11|#define png_free OSS_FUZZ_png_free
  ------------------
  533|     11|      png_free(png_ptr, info_ptr->pcal_units);
  ------------------
  |  |  239|     11|#define png_free OSS_FUZZ_png_free
  ------------------
  534|     11|      info_ptr->pcal_purpose = NULL;
  535|     11|      info_ptr->pcal_units = NULL;
  536|       |
  537|     11|      if (info_ptr->pcal_params != NULL)
  ------------------
  |  Branch (537:11): [True: 11, False: 0]
  ------------------
  538|     11|         {
  539|     11|            int i;
  540|       |
  541|     36|            for (i = 0; i < info_ptr->pcal_nparams; i++)
  ------------------
  |  Branch (541:25): [True: 25, False: 11]
  ------------------
  542|     25|               png_free(png_ptr, info_ptr->pcal_params[i]);
  ------------------
  |  |  239|     25|#define png_free OSS_FUZZ_png_free
  ------------------
  543|       |
  544|     11|            png_free(png_ptr, info_ptr->pcal_params);
  ------------------
  |  |  239|     11|#define png_free OSS_FUZZ_png_free
  ------------------
  545|     11|            info_ptr->pcal_params = NULL;
  546|     11|         }
  547|     11|      info_ptr->valid &= ~PNG_INFO_pCAL;
  ------------------
  |  |  742|     11|#define PNG_INFO_pCAL 0x0400U
  ------------------
  548|     11|   }
  549|  25.3k|#endif
  550|       |
  551|  25.3k|#ifdef PNG_iCCP_SUPPORTED
  552|       |   /* Free any profile entry */
  553|  25.3k|   if (((mask & PNG_FREE_ICCP) & info_ptr->free_me) != 0)
  ------------------
  |  | 1749|  25.3k|#define PNG_FREE_ICCP 0x0010U
  ------------------
  |  Branch (553:8): [True: 5.37k, False: 20.0k]
  ------------------
  554|  5.37k|   {
  555|  5.37k|      png_free(png_ptr, info_ptr->iccp_name);
  ------------------
  |  |  239|  5.37k|#define png_free OSS_FUZZ_png_free
  ------------------
  556|  5.37k|      png_free(png_ptr, info_ptr->iccp_profile);
  ------------------
  |  |  239|  5.37k|#define png_free OSS_FUZZ_png_free
  ------------------
  557|  5.37k|      info_ptr->iccp_name = NULL;
  558|  5.37k|      info_ptr->iccp_profile = NULL;
  559|  5.37k|      info_ptr->valid &= ~PNG_INFO_iCCP;
  ------------------
  |  |  744|  5.37k|#define PNG_INFO_iCCP 0x1000U  /* ESR, 1.0.6 */
  ------------------
  560|  5.37k|   }
  561|  25.3k|#endif
  562|       |
  563|  25.3k|#ifdef PNG_sPLT_SUPPORTED
  564|       |   /* Free a given sPLT entry, or (if num == -1) all sPLT entries */
  565|  25.3k|   if (info_ptr->splt_palettes != NULL &&
  ------------------
  |  Branch (565:8): [True: 283, False: 25.0k]
  ------------------
  566|  25.3k|       ((mask & PNG_FREE_SPLT) & info_ptr->free_me) != 0)
  ------------------
  |  | 1750|    283|#define PNG_FREE_SPLT 0x0020U
  ------------------
  |  Branch (566:8): [True: 89, False: 194]
  ------------------
  567|     89|   {
  568|     89|      if (num != -1)
  ------------------
  |  Branch (568:11): [True: 0, False: 89]
  ------------------
  569|      0|      {
  570|      0|         png_free(png_ptr, info_ptr->splt_palettes[num].name);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  571|      0|         png_free(png_ptr, info_ptr->splt_palettes[num].entries);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  572|      0|         info_ptr->splt_palettes[num].name = NULL;
  573|      0|         info_ptr->splt_palettes[num].entries = NULL;
  574|      0|      }
  575|       |
  576|     89|      else
  577|     89|      {
  578|     89|         int i;
  579|       |
  580|  2.87k|         for (i = 0; i < info_ptr->splt_palettes_num; i++)
  ------------------
  |  Branch (580:22): [True: 2.78k, False: 89]
  ------------------
  581|  2.78k|         {
  582|  2.78k|            png_free(png_ptr, info_ptr->splt_palettes[i].name);
  ------------------
  |  |  239|  2.78k|#define png_free OSS_FUZZ_png_free
  ------------------
  583|  2.78k|            png_free(png_ptr, info_ptr->splt_palettes[i].entries);
  ------------------
  |  |  239|  2.78k|#define png_free OSS_FUZZ_png_free
  ------------------
  584|  2.78k|         }
  585|       |
  586|     89|         png_free(png_ptr, info_ptr->splt_palettes);
  ------------------
  |  |  239|     89|#define png_free OSS_FUZZ_png_free
  ------------------
  587|     89|         info_ptr->splt_palettes = NULL;
  588|     89|         info_ptr->splt_palettes_num = 0;
  589|     89|         info_ptr->valid &= ~PNG_INFO_sPLT;
  ------------------
  |  |  745|     89|#define PNG_INFO_sPLT 0x2000U  /* ESR, 1.0.6 */
  ------------------
  590|     89|      }
  591|     89|   }
  592|  25.3k|#endif
  593|       |
  594|  25.3k|#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
  595|  25.3k|   if (info_ptr->unknown_chunks != NULL &&
  ------------------
  |  Branch (595:8): [True: 0, False: 25.3k]
  ------------------
  596|  25.3k|       ((mask & PNG_FREE_UNKN) & info_ptr->free_me) != 0)
  ------------------
  |  | 1755|      0|#  define PNG_FREE_UNKN 0x0200U
  ------------------
  |  Branch (596:8): [True: 0, False: 0]
  ------------------
  597|      0|   {
  598|      0|      if (num != -1)
  ------------------
  |  Branch (598:11): [True: 0, False: 0]
  ------------------
  599|      0|      {
  600|      0|          png_free(png_ptr, info_ptr->unknown_chunks[num].data);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  601|      0|          info_ptr->unknown_chunks[num].data = NULL;
  602|      0|      }
  603|       |
  604|      0|      else
  605|      0|      {
  606|      0|         int i;
  607|       |
  608|      0|         for (i = 0; i < info_ptr->unknown_chunks_num; i++)
  ------------------
  |  Branch (608:22): [True: 0, False: 0]
  ------------------
  609|      0|            png_free(png_ptr, info_ptr->unknown_chunks[i].data);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  610|       |
  611|      0|         png_free(png_ptr, info_ptr->unknown_chunks);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  612|      0|         info_ptr->unknown_chunks = NULL;
  613|      0|         info_ptr->unknown_chunks_num = 0;
  614|      0|      }
  615|      0|   }
  616|  25.3k|#endif
  617|       |
  618|  25.3k|#ifdef PNG_eXIf_SUPPORTED
  619|       |   /* Free any eXIf entry */
  620|  25.3k|   if (((mask & PNG_FREE_EXIF) & info_ptr->free_me) != 0)
  ------------------
  |  | 1761|  25.3k|#define PNG_FREE_EXIF 0x8000U /* Added at libpng-1.6.31 */
  ------------------
  |  Branch (620:8): [True: 168, False: 25.2k]
  ------------------
  621|    168|   {
  622|    168|# ifdef PNG_READ_eXIf_SUPPORTED
  623|    168|      if (info_ptr->eXIf_buf)
  ------------------
  |  Branch (623:11): [True: 82, False: 86]
  ------------------
  624|     82|      {
  625|     82|         png_free(png_ptr, info_ptr->eXIf_buf);
  ------------------
  |  |  239|     82|#define png_free OSS_FUZZ_png_free
  ------------------
  626|     82|         info_ptr->eXIf_buf = NULL;
  627|     82|      }
  628|    168|# endif
  629|    168|      if (info_ptr->exif)
  ------------------
  |  Branch (629:11): [True: 44, False: 124]
  ------------------
  630|     44|      {
  631|     44|         png_free(png_ptr, info_ptr->exif);
  ------------------
  |  |  239|     44|#define png_free OSS_FUZZ_png_free
  ------------------
  632|     44|         info_ptr->exif = NULL;
  633|     44|      }
  634|    168|      info_ptr->valid &= ~PNG_INFO_eXIf;
  ------------------
  |  |  748|    168|#define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */
  ------------------
  635|    168|   }
  636|  25.3k|#endif
  637|       |
  638|  25.3k|#ifdef PNG_hIST_SUPPORTED
  639|       |   /* Free any hIST entry */
  640|  25.3k|   if (((mask & PNG_FREE_HIST) & info_ptr->free_me) != 0)
  ------------------
  |  | 1748|  25.3k|#define PNG_FREE_HIST 0x0008U
  ------------------
  |  Branch (640:8): [True: 28, False: 25.3k]
  ------------------
  641|     28|   {
  642|     28|      png_free(png_ptr, info_ptr->hist);
  ------------------
  |  |  239|     28|#define png_free OSS_FUZZ_png_free
  ------------------
  643|     28|      info_ptr->hist = NULL;
  644|     28|      info_ptr->valid &= ~PNG_INFO_hIST;
  ------------------
  |  |  738|     28|#define PNG_INFO_hIST 0x0040U
  ------------------
  645|     28|   }
  646|  25.3k|#endif
  647|       |
  648|       |   /* Free any PLTE entry that was internally allocated */
  649|  25.3k|   if (((mask & PNG_FREE_PLTE) & info_ptr->free_me) != 0)
  ------------------
  |  | 1758|  25.3k|#define PNG_FREE_PLTE 0x1000U
  ------------------
  |  Branch (649:8): [True: 355, False: 25.0k]
  ------------------
  650|    355|   {
  651|    355|      png_free(png_ptr, info_ptr->palette);
  ------------------
  |  |  239|    355|#define png_free OSS_FUZZ_png_free
  ------------------
  652|    355|      info_ptr->palette = NULL;
  653|    355|      info_ptr->valid &= ~PNG_INFO_PLTE;
  ------------------
  |  |  735|    355|#define PNG_INFO_PLTE 0x0008U
  ------------------
  654|    355|      info_ptr->num_palette = 0;
  655|    355|   }
  656|       |
  657|  25.3k|#ifdef PNG_INFO_IMAGE_SUPPORTED
  658|       |   /* Free any image bits attached to the info structure */
  659|  25.3k|   if (((mask & PNG_FREE_ROWS) & info_ptr->free_me) != 0)
  ------------------
  |  | 1751|  25.3k|#define PNG_FREE_ROWS 0x0040U
  ------------------
  |  Branch (659:8): [True: 0, False: 25.3k]
  ------------------
  660|      0|   {
  661|      0|      if (info_ptr->row_pointers != NULL)
  ------------------
  |  Branch (661:11): [True: 0, False: 0]
  ------------------
  662|      0|      {
  663|      0|         png_uint_32 row;
  664|      0|         for (row = 0; row < info_ptr->height; row++)
  ------------------
  |  Branch (664:24): [True: 0, False: 0]
  ------------------
  665|      0|            png_free(png_ptr, info_ptr->row_pointers[row]);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  666|       |
  667|      0|         png_free(png_ptr, info_ptr->row_pointers);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  668|      0|         info_ptr->row_pointers = NULL;
  669|      0|      }
  670|      0|      info_ptr->valid &= ~PNG_INFO_IDAT;
  ------------------
  |  |  747|      0|#define PNG_INFO_IDAT 0x8000U  /* ESR, 1.0.6 */
  ------------------
  671|      0|   }
  672|  25.3k|#endif
  673|       |
  674|  25.3k|   if (num != -1)
  ------------------
  |  Branch (674:8): [True: 6.24k, False: 19.1k]
  ------------------
  675|  6.24k|      mask &= ~PNG_FREE_MUL;
  ------------------
  |  | 1763|  6.24k|#define PNG_FREE_MUL  0x4220U /* PNG_FREE_SPLT|PNG_FREE_TEXT|PNG_FREE_UNKN */
  ------------------
  676|       |
  677|  25.3k|   info_ptr->free_me &= ~mask;
  678|  25.3k|}
OSS_FUZZ_png_get_io_ptr:
  687|  1.04M|{
  688|  1.04M|   if (png_ptr == NULL)
  ------------------
  |  Branch (688:8): [True: 0, False: 1.04M]
  ------------------
  689|      0|      return (NULL);
  690|       |
  691|  1.04M|   return (png_ptr->io_ptr);
  692|  1.04M|}
OSS_FUZZ_png_handle_as_unknown:
  927|   100k|{
  928|       |   /* Check chunk_name and return "keep" value if it's on the list, else 0 */
  929|   100k|   png_const_bytep p, p_end;
  930|       |
  931|   100k|   if (png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list == 0)
  ------------------
  |  Branch (931:8): [True: 0, False: 100k]
  |  Branch (931:27): [True: 0, False: 100k]
  |  Branch (931:49): [True: 100k, False: 0]
  ------------------
  932|   100k|      return PNG_HANDLE_CHUNK_AS_DEFAULT;
  ------------------
  |  | 2345|   100k|#define PNG_HANDLE_CHUNK_AS_DEFAULT   0
  ------------------
  933|       |
  934|      0|   p_end = png_ptr->chunk_list;
  935|      0|   p = p_end + png_ptr->num_chunk_list*5; /* beyond end */
  936|       |
  937|       |   /* The code is the fifth byte after each four byte string.  Historically this
  938|       |    * code was always searched from the end of the list, this is no longer
  939|       |    * necessary because the 'set' routine handles duplicate entries correctly.
  940|       |    */
  941|      0|   do /* num_chunk_list > 0, so at least one */
  942|      0|   {
  943|      0|      p -= 5;
  944|       |
  945|      0|      if (memcmp(chunk_name, p, 4) == 0)
  ------------------
  |  Branch (945:11): [True: 0, False: 0]
  ------------------
  946|      0|         return p[4];
  947|      0|   }
  948|      0|   while (p > p_end);
  ------------------
  |  Branch (948:11): [True: 0, False: 0]
  ------------------
  949|       |
  950|       |   /* This means that known chunks should be processed and unknown chunks should
  951|       |    * be handled according to the value of png_ptr->unknown_default; this can be
  952|       |    * confusing because, as a result, there are two levels of defaulting for
  953|       |    * unknown chunks.
  954|       |    */
  955|      0|   return PNG_HANDLE_CHUNK_AS_DEFAULT;
  ------------------
  |  | 2345|      0|#define PNG_HANDLE_CHUNK_AS_DEFAULT   0
  ------------------
  956|      0|}
OSS_FUZZ_png_chunk_unknown_handling:
  962|   100k|{
  963|   100k|   png_byte chunk_string[5];
  964|       |
  965|   100k|   PNG_CSTRING_FROM_CHUNK(chunk_string, chunk_name);
  ------------------
  |  |  885|   100k|   (void)(PNG_STRING_FROM_CHUNK(s,c), ((char*)(s))[4] = 0)
  |  |  ------------------
  |  |  |  |  878|   100k|   (void)(((char*)(s))[0]=(char)(((c)>>24) & 0xff), \
  |  |  |  |  879|   100k|   ((char*)(s))[1]=(char)(((c)>>16) & 0xff),\
  |  |  |  |  880|   100k|   ((char*)(s))[2]=(char)(((c)>>8) & 0xff), \
  |  |  |  |  881|   100k|   ((char*)(s))[3]=(char)((c & 0xff)))
  |  |  ------------------
  ------------------
  966|   100k|   return png_handle_as_unknown(png_ptr, chunk_string);
  ------------------
  |  |  322|   100k|#define png_handle_as_unknown OSS_FUZZ_png_handle_as_unknown
  ------------------
  967|   100k|}
OSS_FUZZ_png_zstream_error:
  999|  22.1k|{
 1000|       |   /* Translate 'ret' into an appropriate error string, priority is given to the
 1001|       |    * one in zstream if set.  This always returns a string, even in cases like
 1002|       |    * Z_OK or Z_STREAM_END where the error code is a success code.
 1003|       |    */
 1004|  22.1k|   if (png_ptr->zstream.msg == NULL) switch (ret)
  ------------------
  |  Branch (1004:8): [True: 9.55k, False: 12.5k]
  ------------------
 1005|  9.55k|   {
 1006|      0|      default:
  ------------------
  |  Branch (1006:7): [True: 0, False: 9.55k]
  ------------------
 1007|  5.24k|      case Z_OK:
  ------------------
  |  Branch (1007:7): [True: 5.24k, False: 4.31k]
  ------------------
 1008|  5.24k|         png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected zlib return code");
  ------------------
  |  |   43|  5.24k|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1009|  5.24k|         break;
 1010|       |
 1011|  3.74k|      case Z_STREAM_END:
  ------------------
  |  Branch (1011:7): [True: 3.74k, False: 5.81k]
  ------------------
 1012|       |         /* Normal exit */
 1013|  3.74k|         png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected end of LZ stream");
  ------------------
  |  |   43|  3.74k|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1014|  3.74k|         break;
 1015|       |
 1016|      2|      case Z_NEED_DICT:
  ------------------
  |  Branch (1016:7): [True: 2, False: 9.55k]
  ------------------
 1017|       |         /* This means the deflate stream did not have a dictionary; this
 1018|       |          * indicates a bogus PNG.
 1019|       |          */
 1020|      2|         png_ptr->zstream.msg = PNGZ_MSG_CAST("missing LZ dictionary");
  ------------------
  |  |   43|      2|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1021|      2|         break;
 1022|       |
 1023|      0|      case Z_ERRNO:
  ------------------
  |  Branch (1023:7): [True: 0, False: 9.55k]
  ------------------
 1024|       |         /* gz APIs only: should not happen */
 1025|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("zlib IO error");
  ------------------
  |  |   43|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1026|      0|         break;
 1027|       |
 1028|      0|      case Z_STREAM_ERROR:
  ------------------
  |  Branch (1028:7): [True: 0, False: 9.55k]
  ------------------
 1029|       |         /* internal libpng error */
 1030|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("bad parameters to zlib");
  ------------------
  |  |   43|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1031|      0|         break;
 1032|       |
 1033|      0|      case Z_DATA_ERROR:
  ------------------
  |  Branch (1033:7): [True: 0, False: 9.55k]
  ------------------
 1034|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("damaged LZ stream");
  ------------------
  |  |   43|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1035|      0|         break;
 1036|       |
 1037|      0|      case Z_MEM_ERROR:
  ------------------
  |  Branch (1037:7): [True: 0, False: 9.55k]
  ------------------
 1038|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("insufficient memory");
  ------------------
  |  |   43|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1039|      0|         break;
 1040|       |
 1041|    571|      case Z_BUF_ERROR:
  ------------------
  |  Branch (1041:7): [True: 571, False: 8.98k]
  ------------------
 1042|       |         /* End of input or output; not a problem if the caller is doing
 1043|       |          * incremental read or write.
 1044|       |          */
 1045|    571|         png_ptr->zstream.msg = PNGZ_MSG_CAST("truncated");
  ------------------
  |  |   43|    571|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1046|    571|         break;
 1047|       |
 1048|      0|      case Z_VERSION_ERROR:
  ------------------
  |  Branch (1048:7): [True: 0, False: 9.55k]
  ------------------
 1049|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("unsupported zlib version");
  ------------------
  |  |   43|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1050|      0|         break;
 1051|       |
 1052|      0|      case PNG_UNEXPECTED_ZLIB_RETURN:
  ------------------
  |  |  964|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  |  Branch (1052:7): [True: 0, False: 9.55k]
  ------------------
 1053|       |         /* Compile errors here mean that zlib now uses the value co-opted in
 1054|       |          * pngpriv.h for PNG_UNEXPECTED_ZLIB_RETURN; update the switch above
 1055|       |          * and change pngpriv.h.  Note that this message is "... return",
 1056|       |          * whereas the default/Z_OK one is "... return code".
 1057|       |          */
 1058|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected zlib return");
  ------------------
  |  |   43|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1059|      0|         break;
 1060|  9.55k|   }
 1061|  22.1k|}
OSS_FUZZ_png_colorspace_set_gamma:
 1116|  2.14k|{
 1117|       |   /* Changed in libpng-1.5.4 to limit the values to ensure overflow can't
 1118|       |    * occur.  Since the fixed point representation is asymmetrical it is
 1119|       |    * possible for 1/gamma to overflow the limit of 21474 and this means the
 1120|       |    * gamma value must be at least 5/100000 and hence at most 20000.0.  For
 1121|       |    * safety the limits here are a little narrower.  The values are 0.00016 to
 1122|       |    * 6250.0, which are truly ridiculous gamma values (and will produce
 1123|       |    * displays that are all black or all white.)
 1124|       |    *
 1125|       |    * In 1.6.0 this test replaces the ones in pngrutil.c, in the gAMA chunk
 1126|       |    * handling code, which only required the value to be >0.
 1127|       |    */
 1128|  2.14k|   png_const_charp errmsg;
 1129|       |
 1130|  2.14k|   if (gAMA < 16 || gAMA > 625000000)
  ------------------
  |  Branch (1130:8): [True: 363, False: 1.78k]
  |  Branch (1130:21): [True: 252, False: 1.53k]
  ------------------
 1131|    615|      errmsg = "gamma value out of range";
 1132|       |
 1133|  1.53k|#  ifdef PNG_READ_gAMA_SUPPORTED
 1134|       |   /* Allow the application to set the gamma value more than once */
 1135|  1.53k|   else if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&
  ------------------
  |  |  630|  1.53k|#define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
  ------------------
  |  Branch (1135:13): [True: 1.53k, False: 0]
  ------------------
 1136|  1.53k|      (colorspace->flags & PNG_COLORSPACE_FROM_gAMA) != 0)
  ------------------
  |  |  134|  1.53k|#define PNG_COLORSPACE_FROM_gAMA            0x0008
  ------------------
  |  Branch (1136:7): [True: 222, False: 1.31k]
  ------------------
 1137|    222|      errmsg = "duplicate";
 1138|  1.31k|#  endif
 1139|       |
 1140|       |   /* Do nothing if the colorspace is already invalid */
 1141|  1.31k|   else if ((colorspace->flags & PNG_COLORSPACE_INVALID) != 0)
  ------------------
  |  |  139|  1.31k|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
  |  Branch (1141:13): [True: 531, False: 781]
  ------------------
 1142|    531|      return;
 1143|       |
 1144|    781|   else
 1145|    781|   {
 1146|    781|      if (png_colorspace_check_gamma(png_ptr, colorspace, gAMA,
  ------------------
  |  Branch (1146:11): [True: 194, False: 587]
  ------------------
 1147|    781|          1/*from gAMA*/) != 0)
 1148|    194|      {
 1149|       |         /* Store this gamma value. */
 1150|    194|         colorspace->gamma = gAMA;
 1151|    194|         colorspace->flags |=
 1152|    194|            (PNG_COLORSPACE_HAVE_GAMMA | PNG_COLORSPACE_FROM_gAMA);
  ------------------
  |  |  131|    194|#define PNG_COLORSPACE_HAVE_GAMMA           0x0001
  ------------------
                          (PNG_COLORSPACE_HAVE_GAMMA | PNG_COLORSPACE_FROM_gAMA);
  ------------------
  |  |  134|    194|#define PNG_COLORSPACE_FROM_gAMA            0x0008
  ------------------
 1153|    194|      }
 1154|       |
 1155|       |      /* At present if the check_gamma test fails the gamma of the colorspace is
 1156|       |       * not updated however the colorspace is not invalidated.  This
 1157|       |       * corresponds to the case where the existing gamma comes from an sRGB
 1158|       |       * chunk or profile.  An error message has already been output.
 1159|       |       */
 1160|    781|      return;
 1161|    781|   }
 1162|       |
 1163|       |   /* Error exit - errmsg has been set. */
 1164|    837|   colorspace->flags |= PNG_COLORSPACE_INVALID;
  ------------------
  |  |  139|    837|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
 1165|    837|   png_chunk_report(png_ptr, errmsg, PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  |  120|    837|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
                 png_chunk_report(png_ptr, errmsg, PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|    837|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
 1166|    837|}
OSS_FUZZ_png_colorspace_sync_info:
 1170|  8.53k|{
 1171|  8.53k|   if ((info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0)
  ------------------
  |  |  139|  8.53k|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
  |  Branch (1171:8): [True: 2.12k, False: 6.40k]
  ------------------
 1172|  2.12k|   {
 1173|       |      /* Everything is invalid */
 1174|  2.12k|      info_ptr->valid &= ~(PNG_INFO_gAMA|PNG_INFO_cHRM|PNG_INFO_sRGB|
  ------------------
  |  |  732|  2.12k|#define PNG_INFO_gAMA 0x0001U
  ------------------
                    info_ptr->valid &= ~(PNG_INFO_gAMA|PNG_INFO_cHRM|PNG_INFO_sRGB|
  ------------------
  |  |  734|  2.12k|#define PNG_INFO_cHRM 0x0004U
  ------------------
                    info_ptr->valid &= ~(PNG_INFO_gAMA|PNG_INFO_cHRM|PNG_INFO_sRGB|
  ------------------
  |  |  743|  2.12k|#define PNG_INFO_sRGB 0x0800U  /* GR-P, 0.96a */
  ------------------
 1175|  2.12k|         PNG_INFO_iCCP);
  ------------------
  |  |  744|  2.12k|#define PNG_INFO_iCCP 0x1000U  /* ESR, 1.0.6 */
  ------------------
 1176|       |
 1177|  2.12k|#     ifdef PNG_COLORSPACE_SUPPORTED
 1178|       |      /* Clean up the iCCP profile now if it won't be used. */
 1179|  2.12k|      png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, -1/*not used*/);
  ------------------
  |  |  240|  2.12k|#define png_free_data OSS_FUZZ_png_free_data
  ------------------
                    png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, -1/*not used*/);
  ------------------
  |  | 1749|  2.12k|#define PNG_FREE_ICCP 0x0010U
  ------------------
 1180|       |#     else
 1181|       |      PNG_UNUSED(png_ptr)
 1182|       |#     endif
 1183|  2.12k|   }
 1184|       |
 1185|  6.40k|   else
 1186|  6.40k|   {
 1187|  6.40k|#     ifdef PNG_COLORSPACE_SUPPORTED
 1188|       |      /* Leave the INFO_iCCP flag set if the pngset.c code has already set
 1189|       |       * it; this allows a PNG to contain a profile which matches sRGB and
 1190|       |       * yet still have that profile retrievable by the application.
 1191|       |       */
 1192|  6.40k|      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_MATCHES_sRGB) != 0)
  ------------------
  |  |  138|  6.40k|#define PNG_COLORSPACE_MATCHES_sRGB         0x0080 /* exact match on profile */
  ------------------
  |  Branch (1192:11): [True: 724, False: 5.68k]
  ------------------
 1193|    724|         info_ptr->valid |= PNG_INFO_sRGB;
  ------------------
  |  |  743|    724|#define PNG_INFO_sRGB 0x0800U  /* GR-P, 0.96a */
  ------------------
 1194|       |
 1195|  5.68k|      else
 1196|  5.68k|         info_ptr->valid &= ~PNG_INFO_sRGB;
  ------------------
  |  |  743|  5.68k|#define PNG_INFO_sRGB 0x0800U  /* GR-P, 0.96a */
  ------------------
 1197|       |
 1198|  6.40k|      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_ENDPOINTS) != 0)
  ------------------
  |  |  132|  6.40k|#define PNG_COLORSPACE_HAVE_ENDPOINTS       0x0002
  ------------------
  |  Branch (1198:11): [True: 933, False: 5.47k]
  ------------------
 1199|    933|         info_ptr->valid |= PNG_INFO_cHRM;
  ------------------
  |  |  734|    933|#define PNG_INFO_cHRM 0x0004U
  ------------------
 1200|       |
 1201|  5.47k|      else
 1202|  5.47k|         info_ptr->valid &= ~PNG_INFO_cHRM;
  ------------------
  |  |  734|  5.47k|#define PNG_INFO_cHRM 0x0004U
  ------------------
 1203|  6.40k|#     endif
 1204|       |
 1205|  6.40k|      if ((info_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_GAMMA) != 0)
  ------------------
  |  |  131|  6.40k|#define PNG_COLORSPACE_HAVE_GAMMA           0x0001
  ------------------
  |  Branch (1205:11): [True: 990, False: 5.41k]
  ------------------
 1206|    990|         info_ptr->valid |= PNG_INFO_gAMA;
  ------------------
  |  |  732|    990|#define PNG_INFO_gAMA 0x0001U
  ------------------
 1207|       |
 1208|  5.41k|      else
 1209|  5.41k|         info_ptr->valid &= ~PNG_INFO_gAMA;
  ------------------
  |  |  732|  5.41k|#define PNG_INFO_gAMA 0x0001U
  ------------------
 1210|  6.40k|   }
 1211|  8.53k|}
OSS_FUZZ_png_colorspace_sync:
 1216|  8.53k|{
 1217|  8.53k|   if (info_ptr == NULL) /* reduce code size; check here not in the caller */
  ------------------
  |  Branch (1217:8): [True: 0, False: 8.53k]
  ------------------
 1218|      0|      return;
 1219|       |
 1220|  8.53k|   info_ptr->colorspace = png_ptr->colorspace;
 1221|  8.53k|   png_colorspace_sync_info(png_ptr, info_ptr);
  ------------------
  |  |   98|  8.53k|#define png_colorspace_sync_info OSS_FUZZ_png_colorspace_sync_info
  ------------------
 1222|  8.53k|}
OSS_FUZZ_png_colorspace_set_chromaticities:
 1722|    772|{
 1723|       |   /* We must check the end points to ensure they are reasonable - in the past
 1724|       |    * color management systems have crashed as a result of getting bogus
 1725|       |    * colorant values, while this isn't the fault of libpng it is the
 1726|       |    * responsibility of libpng because PNG carries the bomb and libpng is in a
 1727|       |    * position to protect against it.
 1728|       |    */
 1729|    772|   png_XYZ XYZ;
 1730|       |
 1731|    772|   switch (png_colorspace_check_xy(&XYZ, xy))
 1732|    772|   {
 1733|    124|      case 0: /* success */
  ------------------
  |  Branch (1733:7): [True: 124, False: 648]
  ------------------
 1734|    124|         return png_colorspace_set_xy_and_XYZ(png_ptr, colorspace, xy, &XYZ,
 1735|    124|             preferred);
 1736|       |
 1737|    648|      case 1:
  ------------------
  |  Branch (1737:7): [True: 648, False: 124]
  ------------------
 1738|       |         /* We can't invert the chromaticities so we can't produce value XYZ
 1739|       |          * values.  Likely as not a color management system will fail too.
 1740|       |          */
 1741|    648|         colorspace->flags |= PNG_COLORSPACE_INVALID;
  ------------------
  |  |  139|    648|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
 1742|    648|         png_benign_error(png_ptr, "invalid chromaticities");
  ------------------
  |  |  221|    648|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
 1743|    648|         break;
 1744|       |
 1745|      0|      default:
  ------------------
  |  Branch (1745:7): [True: 0, False: 772]
  ------------------
 1746|       |         /* libpng is broken; this should be a warning but if it happens we
 1747|       |          * want error reports so for the moment it is an error.
 1748|       |          */
 1749|      0|         colorspace->flags |= PNG_COLORSPACE_INVALID;
  ------------------
  |  |  139|      0|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
 1750|      0|         png_error(png_ptr, "internal error checking chromaticities");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 1751|    772|   }
 1752|       |
 1753|    648|   return 0; /* failed */
 1754|    772|}
OSS_FUZZ_png_colorspace_set_sRGB:
 1874|    177|{
 1875|       |   /* sRGB sets known gamma, end points and (from the chunk) intent. */
 1876|       |   /* IMPORTANT: these are not necessarily the values found in an ICC profile
 1877|       |    * because ICC profiles store values adapted to a D50 environment; it is
 1878|       |    * expected that the ICC profile mediaWhitePointTag will be D50; see the
 1879|       |    * checks and code elsewhere to understand this better.
 1880|       |    *
 1881|       |    * These XYZ values, which are accurate to 5dp, produce rgb to gray
 1882|       |    * coefficients of (6968,23435,2366), which are reduced (because they add up
 1883|       |    * to 32769 not 32768) to (6968,23434,2366).  These are the values that
 1884|       |    * libpng has traditionally used (and are the best values given the 15bit
 1885|       |    * algorithm used by the rgb to gray code.)
 1886|       |    */
 1887|    177|   static const png_XYZ sRGB_XYZ = /* D65 XYZ (*not* the D50 adapted values!) */
 1888|    177|   {
 1889|       |      /* color      X      Y      Z */
 1890|    177|      /* red   */ 41239, 21264,  1933,
 1891|    177|      /* green */ 35758, 71517, 11919,
 1892|    177|      /* blue  */ 18048,  7219, 95053
 1893|    177|   };
 1894|       |
 1895|       |   /* Do nothing if the colorspace is already invalidated. */
 1896|    177|   if ((colorspace->flags & PNG_COLORSPACE_INVALID) != 0)
  ------------------
  |  |  139|    177|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
  |  Branch (1896:8): [True: 0, False: 177]
  ------------------
 1897|      0|      return 0;
 1898|       |
 1899|       |   /* Check the intent, then check for existing settings.  It is valid for the
 1900|       |    * PNG file to have cHRM or gAMA chunks along with sRGB, but the values must
 1901|       |    * be consistent with the correct values.  If, however, this function is
 1902|       |    * called below because an iCCP chunk matches sRGB then it is quite
 1903|       |    * conceivable that an older app recorded incorrect gAMA and cHRM because of
 1904|       |    * an incorrect calculation based on the values in the profile - this does
 1905|       |    * *not* invalidate the profile (though it still produces an error, which can
 1906|       |    * be ignored.)
 1907|       |    */
 1908|    177|   if (intent < 0 || intent >= PNG_sRGB_INTENT_LAST)
  ------------------
  |  |  719|    177|#define PNG_sRGB_INTENT_LAST       4 /* Not a valid value */
  ------------------
  |  Branch (1908:8): [True: 0, False: 177]
  |  Branch (1908:22): [True: 52, False: 125]
  ------------------
 1909|     52|      return png_icc_profile_error(png_ptr, colorspace, "sRGB",
 1910|     52|          (png_alloc_size_t)intent, "invalid sRGB rendering intent");
 1911|       |
 1912|    125|   if ((colorspace->flags & PNG_COLORSPACE_HAVE_INTENT) != 0 &&
  ------------------
  |  |  133|    125|#define PNG_COLORSPACE_HAVE_INTENT          0x0004
  ------------------
  |  Branch (1912:8): [True: 0, False: 125]
  ------------------
 1913|    125|       colorspace->rendering_intent != intent)
  ------------------
  |  Branch (1913:8): [True: 0, False: 0]
  ------------------
 1914|      0|      return png_icc_profile_error(png_ptr, colorspace, "sRGB",
 1915|      0|         (png_alloc_size_t)intent, "inconsistent rendering intents");
 1916|       |
 1917|    125|   if ((colorspace->flags & PNG_COLORSPACE_FROM_sRGB) != 0)
  ------------------
  |  |  136|    125|#define PNG_COLORSPACE_FROM_sRGB            0x0020
  ------------------
  |  Branch (1917:8): [True: 0, False: 125]
  ------------------
 1918|      0|   {
 1919|      0|      png_benign_error(png_ptr, "duplicate sRGB information ignored");
  ------------------
  |  |  221|      0|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
 1920|      0|      return 0;
 1921|      0|   }
 1922|       |
 1923|       |   /* If the standard sRGB cHRM chunk does not match the one from the PNG file
 1924|       |    * warn but overwrite the value with the correct one.
 1925|       |    */
 1926|    125|   if ((colorspace->flags & PNG_COLORSPACE_HAVE_ENDPOINTS) != 0 &&
  ------------------
  |  |  132|    125|#define PNG_COLORSPACE_HAVE_ENDPOINTS       0x0002
  ------------------
  |  Branch (1926:8): [True: 7, False: 118]
  ------------------
 1927|    125|       !png_colorspace_endpoints_match(&sRGB_xy, &colorspace->end_points_xy,
  ------------------
  |  Branch (1927:8): [True: 6, False: 1]
  ------------------
 1928|      7|       100))
 1929|      6|      png_chunk_report(png_ptr, "cHRM chunk does not match sRGB",
  ------------------
  |  |  120|      6|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 1930|      6|         PNG_CHUNK_ERROR);
  ------------------
  |  | 1835|      6|#define PNG_CHUNK_ERROR       2 /* always an error */
  ------------------
 1931|       |
 1932|       |   /* This check is just done for the error reporting - the routine always
 1933|       |    * returns true when the 'from' argument corresponds to sRGB (2).
 1934|       |    */
 1935|    125|   (void)png_colorspace_check_gamma(png_ptr, colorspace, PNG_GAMMA_sRGB_INVERSE,
  ------------------
  |  |  897|    125|#define PNG_GAMMA_sRGB_INVERSE 45455
  ------------------
 1936|    125|       2/*from sRGB*/);
 1937|       |
 1938|       |   /* intent: bugs in GCC force 'int' to be used as the parameter type. */
 1939|    125|   colorspace->rendering_intent = (png_uint_16)intent;
 1940|    125|   colorspace->flags |= PNG_COLORSPACE_HAVE_INTENT;
  ------------------
  |  |  133|    125|#define PNG_COLORSPACE_HAVE_INTENT          0x0004
  ------------------
 1941|       |
 1942|       |   /* endpoints */
 1943|    125|   colorspace->end_points_xy = sRGB_xy;
 1944|    125|   colorspace->end_points_XYZ = sRGB_XYZ;
 1945|    125|   colorspace->flags |=
 1946|    125|      (PNG_COLORSPACE_HAVE_ENDPOINTS|PNG_COLORSPACE_ENDPOINTS_MATCH_sRGB);
  ------------------
  |  |  132|    125|#define PNG_COLORSPACE_HAVE_ENDPOINTS       0x0002
  ------------------
                    (PNG_COLORSPACE_HAVE_ENDPOINTS|PNG_COLORSPACE_ENDPOINTS_MATCH_sRGB);
  ------------------
  |  |  137|    125|#define PNG_COLORSPACE_ENDPOINTS_MATCH_sRGB 0x0040
  ------------------
 1947|       |
 1948|       |   /* gamma */
 1949|    125|   colorspace->gamma = PNG_GAMMA_sRGB_INVERSE;
  ------------------
  |  |  897|    125|#define PNG_GAMMA_sRGB_INVERSE 45455
  ------------------
 1950|    125|   colorspace->flags |= PNG_COLORSPACE_HAVE_GAMMA;
  ------------------
  |  |  131|    125|#define PNG_COLORSPACE_HAVE_GAMMA           0x0001
  ------------------
 1951|       |
 1952|       |   /* Finally record that we have an sRGB profile */
 1953|    125|   colorspace->flags |=
 1954|    125|      (PNG_COLORSPACE_MATCHES_sRGB|PNG_COLORSPACE_FROM_sRGB);
  ------------------
  |  |  138|    125|#define PNG_COLORSPACE_MATCHES_sRGB         0x0080 /* exact match on profile */
  ------------------
                    (PNG_COLORSPACE_MATCHES_sRGB|PNG_COLORSPACE_FROM_sRGB);
  ------------------
  |  |  136|    125|#define PNG_COLORSPACE_FROM_sRGB            0x0020
  ------------------
 1955|       |
 1956|    125|   return 1; /* set */
 1957|    125|}
OSS_FUZZ_png_icc_check_length:
 1983|  6.56k|{
 1984|  6.56k|   if (!icc_check_length(png_ptr, colorspace, name, profile_length))
  ------------------
  |  Branch (1984:8): [True: 2, False: 6.56k]
  ------------------
 1985|      2|      return 0;
 1986|       |
 1987|       |   /* This needs to be here because the 'normal' check is in
 1988|       |    * png_decompress_chunk, yet this happens after the attempt to
 1989|       |    * png_malloc_base the required data.  We only need this on read; on write
 1990|       |    * the caller supplies the profile buffer so libpng doesn't allocate it.  See
 1991|       |    * the call to icc_check_length below (the write case).
 1992|       |    */
 1993|  6.56k|#  ifdef PNG_SET_USER_LIMITS_SUPPORTED
 1994|  6.56k|      else if (png_ptr->user_chunk_malloc_max > 0 &&
  ------------------
  |  Branch (1994:16): [True: 6.56k, False: 0]
  ------------------
 1995|  6.56k|               png_ptr->user_chunk_malloc_max < profile_length)
  ------------------
  |  Branch (1995:16): [True: 44, False: 6.52k]
  ------------------
 1996|     44|         return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
 1997|     44|             "exceeds application limits");
 1998|       |#  elif PNG_USER_CHUNK_MALLOC_MAX > 0
 1999|       |      else if (PNG_USER_CHUNK_MALLOC_MAX < profile_length)
 2000|       |         return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
 2001|       |             "exceeds libpng limits");
 2002|       |#  else /* !SET_USER_LIMITS */
 2003|       |      /* This will get compiled out on all 32-bit and better systems. */
 2004|       |      else if (PNG_SIZE_MAX < profile_length)
 2005|       |         return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
 2006|       |             "exceeds system limits");
 2007|       |#  endif /* !SET_USER_LIMITS */
 2008|       |
 2009|  6.52k|   return 1;
 2010|  6.56k|}
OSS_FUZZ_png_icc_check_header:
 2017|  6.52k|{
 2018|  6.52k|   png_uint_32 temp;
 2019|       |
 2020|       |   /* Length check; this cannot be ignored in this code because profile_length
 2021|       |    * is used later to check the tag table, so even if the profile seems over
 2022|       |    * long profile_length from the caller must be correct.  The caller can fix
 2023|       |    * this up on read or write by just passing in the profile header length.
 2024|       |    */
 2025|  6.52k|   temp = png_get_uint_32(profile);
  ------------------
  |  |  303|  6.52k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  6.52k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  6.52k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  6.52k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  6.52k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  6.52k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2026|  6.52k|   if (temp != profile_length)
  ------------------
  |  Branch (2026:8): [True: 0, False: 6.52k]
  ------------------
 2027|      0|      return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2028|      0|          "length does not match profile");
 2029|       |
 2030|  6.52k|   temp = (png_uint_32) (*(profile+8));
 2031|  6.52k|   if (temp > 3 && (profile_length & 3))
  ------------------
  |  Branch (2031:8): [True: 5.30k, False: 1.21k]
  |  Branch (2031:20): [True: 9, False: 5.29k]
  ------------------
 2032|      9|      return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
 2033|      9|          "invalid length");
 2034|       |
 2035|  6.51k|   temp = png_get_uint_32(profile+128); /* tag count: 12 bytes/tag */
  ------------------
  |  |  303|  6.51k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  6.51k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  6.51k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  6.51k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  6.51k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  6.51k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2036|  6.51k|   if (temp > 357913930 || /* (2^32-4-132)/12: maximum possible tag count */
  ------------------
  |  Branch (2036:8): [True: 112, False: 6.39k]
  ------------------
 2037|  6.51k|      profile_length < 132+12*temp) /* truncated tag table */
  ------------------
  |  Branch (2037:7): [True: 50, False: 6.34k]
  ------------------
 2038|    162|      return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2039|    162|          "tag count too large");
 2040|       |
 2041|       |   /* The 'intent' must be valid or we can't store it, ICC limits the intent to
 2042|       |    * 16 bits.
 2043|       |    */
 2044|  6.34k|   temp = png_get_uint_32(profile+64);
  ------------------
  |  |  303|  6.34k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  6.34k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  6.34k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  6.34k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  6.34k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  6.34k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2045|  6.34k|   if (temp >= 0xffff) /* The ICC limit */
  ------------------
  |  Branch (2045:8): [True: 24, False: 6.32k]
  ------------------
 2046|     24|      return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2047|     24|          "invalid rendering intent");
 2048|       |
 2049|       |   /* This is just a warning because the profile may be valid in future
 2050|       |    * versions.
 2051|       |    */
 2052|  6.32k|   if (temp >= PNG_sRGB_INTENT_LAST)
  ------------------
  |  |  719|  6.32k|#define PNG_sRGB_INTENT_LAST       4 /* Not a valid value */
  ------------------
  |  Branch (2052:8): [True: 3.02k, False: 3.29k]
  ------------------
 2053|  3.02k|      (void)png_icc_profile_error(png_ptr, NULL, name, temp,
 2054|  3.02k|          "intent outside defined range");
 2055|       |
 2056|       |   /* At this point the tag table can't be checked because it hasn't necessarily
 2057|       |    * been loaded; however, various header fields can be checked.  These checks
 2058|       |    * are for values permitted by the PNG spec in an ICC profile; the PNG spec
 2059|       |    * restricts the profiles that can be passed in an iCCP chunk (they must be
 2060|       |    * appropriate to processing PNG data!)
 2061|       |    */
 2062|       |
 2063|       |   /* Data checks (could be skipped).  These checks must be independent of the
 2064|       |    * version number; however, the version number doesn't accommodate changes in
 2065|       |    * the header fields (just the known tags and the interpretation of the
 2066|       |    * data.)
 2067|       |    */
 2068|  6.32k|   temp = png_get_uint_32(profile+36); /* signature 'ascp' */
  ------------------
  |  |  303|  6.32k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  6.32k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  6.32k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  6.32k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  6.32k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  6.32k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2069|  6.32k|   if (temp != 0x61637370)
  ------------------
  |  Branch (2069:8): [True: 35, False: 6.29k]
  ------------------
 2070|     35|      return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2071|     35|          "invalid signature");
 2072|       |
 2073|       |   /* Currently the PCS illuminant/adopted white point (the computational
 2074|       |    * white point) are required to be D50,
 2075|       |    * however the profile contains a record of the illuminant so perhaps ICC
 2076|       |    * expects to be able to change this in the future (despite the rationale in
 2077|       |    * the introduction for using a fixed PCS adopted white.)  Consequently the
 2078|       |    * following is just a warning.
 2079|       |    */
 2080|  6.29k|   if (memcmp(profile+68, D50_nCIEXYZ, 12) != 0)
  ------------------
  |  Branch (2080:8): [True: 5.56k, False: 721]
  ------------------
 2081|  5.56k|      (void)png_icc_profile_error(png_ptr, NULL, name, 0/*no tag value*/,
 2082|  5.56k|          "PCS illuminant is not D50");
 2083|       |
 2084|       |   /* The PNG spec requires this:
 2085|       |    * "If the iCCP chunk is present, the image samples conform to the colour
 2086|       |    * space represented by the embedded ICC profile as defined by the
 2087|       |    * International Color Consortium [ICC]. The colour space of the ICC profile
 2088|       |    * shall be an RGB colour space for colour images (PNG colour types 2, 3, and
 2089|       |    * 6), or a greyscale colour space for greyscale images (PNG colour types 0
 2090|       |    * and 4)."
 2091|       |    *
 2092|       |    * This checking code ensures the embedded profile (on either read or write)
 2093|       |    * conforms to the specification requirements.  Notice that an ICC 'gray'
 2094|       |    * color-space profile contains the information to transform the monochrome
 2095|       |    * data to XYZ or L*a*b (according to which PCS the profile uses) and this
 2096|       |    * should be used in preference to the standard libpng K channel replication
 2097|       |    * into R, G and B channels.
 2098|       |    *
 2099|       |    * Previously it was suggested that an RGB profile on grayscale data could be
 2100|       |    * handled.  However it it is clear that using an RGB profile in this context
 2101|       |    * must be an error - there is no specification of what it means.  Thus it is
 2102|       |    * almost certainly more correct to ignore the profile.
 2103|       |    */
 2104|  6.29k|   temp = png_get_uint_32(profile+16); /* data colour space field */
  ------------------
  |  |  303|  6.29k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  6.29k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  6.29k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  6.29k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  6.29k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  6.29k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2105|  6.29k|   switch (temp)
 2106|  6.29k|   {
 2107|  4.08k|      case 0x52474220: /* 'RGB ' */
  ------------------
  |  Branch (2107:7): [True: 4.08k, False: 2.20k]
  ------------------
 2108|  4.08k|         if ((color_type & PNG_COLOR_MASK_COLOR) == 0)
  ------------------
  |  |  664|  4.08k|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (2108:14): [True: 1, False: 4.08k]
  ------------------
 2109|      1|            return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2110|      1|                "RGB color space not permitted on grayscale PNG");
 2111|  4.08k|         break;
 2112|       |
 2113|  4.08k|      case 0x47524159: /* 'GRAY' */
  ------------------
  |  Branch (2113:7): [True: 2.03k, False: 4.25k]
  ------------------
 2114|  2.03k|         if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
  ------------------
  |  |  664|  2.03k|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (2114:14): [True: 1, False: 2.03k]
  ------------------
 2115|      1|            return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2116|      1|                "Gray color space not permitted on RGB PNG");
 2117|  2.03k|         break;
 2118|       |
 2119|  2.03k|      default:
  ------------------
  |  Branch (2119:7): [True: 165, False: 6.12k]
  ------------------
 2120|    165|         return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2121|    165|             "invalid ICC profile color space");
 2122|  6.29k|   }
 2123|       |
 2124|       |   /* It is up to the application to check that the profile class matches the
 2125|       |    * application requirements; the spec provides no guidance, but it's pretty
 2126|       |    * weird if the profile is not scanner ('scnr'), monitor ('mntr'), printer
 2127|       |    * ('prtr') or 'spac' (for generic color spaces).  Issue a warning in these
 2128|       |    * cases.  Issue an error for device link or abstract profiles - these don't
 2129|       |    * contain the records necessary to transform the color-space to anything
 2130|       |    * other than the target device (and not even that for an abstract profile).
 2131|       |    * Profiles of these classes may not be embedded in images.
 2132|       |    */
 2133|  6.12k|   temp = png_get_uint_32(profile+12); /* profile/device class */
  ------------------
  |  |  303|  6.12k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  6.12k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  6.12k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  6.12k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  6.12k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  6.12k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2134|  6.12k|   switch (temp)
 2135|  6.12k|   {
 2136|    240|      case 0x73636e72: /* 'scnr' */
  ------------------
  |  Branch (2136:7): [True: 240, False: 5.88k]
  ------------------
 2137|    933|      case 0x6d6e7472: /* 'mntr' */
  ------------------
  |  Branch (2137:7): [True: 693, False: 5.43k]
  ------------------
 2138|  1.18k|      case 0x70727472: /* 'prtr' */
  ------------------
  |  Branch (2138:7): [True: 253, False: 5.87k]
  ------------------
 2139|  1.38k|      case 0x73706163: /* 'spac' */
  ------------------
  |  Branch (2139:7): [True: 202, False: 5.92k]
  ------------------
 2140|       |         /* All supported */
 2141|  1.38k|         break;
 2142|       |
 2143|      1|      case 0x61627374: /* 'abst' */
  ------------------
  |  Branch (2143:7): [True: 1, False: 6.12k]
  ------------------
 2144|       |         /* May not be embedded in an image */
 2145|      1|         return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2146|      1|             "invalid embedded Abstract ICC profile");
 2147|       |
 2148|      1|      case 0x6c696e6b: /* 'link' */
  ------------------
  |  Branch (2148:7): [True: 1, False: 6.12k]
  ------------------
 2149|       |         /* DeviceLink profiles cannot be interpreted in a non-device specific
 2150|       |          * fashion, if an app uses the AToB0Tag in the profile the results are
 2151|       |          * undefined unless the result is sent to the intended device,
 2152|       |          * therefore a DeviceLink profile should not be found embedded in a
 2153|       |          * PNG.
 2154|       |          */
 2155|      1|         return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2156|      1|             "unexpected DeviceLink ICC profile class");
 2157|       |
 2158|    547|      case 0x6e6d636c: /* 'nmcl' */
  ------------------
  |  Branch (2158:7): [True: 547, False: 5.57k]
  ------------------
 2159|       |         /* A NamedColor profile is also device specific, however it doesn't
 2160|       |          * contain an AToB0 tag that is open to misinterpretation.  Almost
 2161|       |          * certainly it will fail the tests below.
 2162|       |          */
 2163|    547|         (void)png_icc_profile_error(png_ptr, NULL, name, temp,
 2164|    547|             "unexpected NamedColor ICC profile class");
 2165|    547|         break;
 2166|       |
 2167|  4.18k|      default:
  ------------------
  |  Branch (2167:7): [True: 4.18k, False: 1.93k]
  ------------------
 2168|       |         /* To allow for future enhancements to the profile accept unrecognized
 2169|       |          * profile classes with a warning, these then hit the test below on the
 2170|       |          * tag content to ensure they are backward compatible with one of the
 2171|       |          * understood profiles.
 2172|       |          */
 2173|  4.18k|         (void)png_icc_profile_error(png_ptr, NULL, name, temp,
 2174|  4.18k|             "unrecognized ICC profile class");
 2175|  4.18k|         break;
 2176|  6.12k|   }
 2177|       |
 2178|       |   /* For any profile other than a device link one the PCS must be encoded
 2179|       |    * either in XYZ or Lab.
 2180|       |    */
 2181|  6.12k|   temp = png_get_uint_32(profile+20);
  ------------------
  |  |  303|  6.12k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  6.12k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  6.12k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  6.12k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  6.12k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  6.12k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2182|  6.12k|   switch (temp)
 2183|  6.12k|   {
 2184|  2.83k|      case 0x58595a20: /* 'XYZ ' */
  ------------------
  |  Branch (2184:7): [True: 2.83k, False: 3.28k]
  ------------------
 2185|  5.85k|      case 0x4c616220: /* 'Lab ' */
  ------------------
  |  Branch (2185:7): [True: 3.01k, False: 3.10k]
  ------------------
 2186|  5.85k|         break;
 2187|       |
 2188|    266|      default:
  ------------------
  |  Branch (2188:7): [True: 266, False: 5.85k]
  ------------------
 2189|    266|         return png_icc_profile_error(png_ptr, colorspace, name, temp,
 2190|    266|             "unexpected ICC PCS encoding");
 2191|  6.12k|   }
 2192|       |
 2193|  5.85k|   return 1;
 2194|  6.12k|}
OSS_FUZZ_png_icc_check_tag_table:
 2200|  5.80k|{
 2201|  5.80k|   png_uint_32 tag_count = png_get_uint_32(profile+128);
  ------------------
  |  |  303|  5.80k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  5.80k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  5.80k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  5.80k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  5.80k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  5.80k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2202|  5.80k|   png_uint_32 itag;
 2203|  5.80k|   png_const_bytep tag = profile+132; /* The first tag */
 2204|       |
 2205|       |   /* First scan all the tags in the table and add bits to the icc_info value
 2206|       |    * (temporarily in 'tags').
 2207|       |    */
 2208|  44.6k|   for (itag=0; itag < tag_count; ++itag, tag += 12)
  ------------------
  |  Branch (2208:17): [True: 39.0k, False: 5.63k]
  ------------------
 2209|  39.0k|   {
 2210|  39.0k|      png_uint_32 tag_id = png_get_uint_32(tag+0);
  ------------------
  |  |  303|  39.0k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  39.0k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  39.0k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  39.0k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  39.0k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  39.0k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2211|  39.0k|      png_uint_32 tag_start = png_get_uint_32(tag+4); /* must be aligned */
  ------------------
  |  |  303|  39.0k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  39.0k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  39.0k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  39.0k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  39.0k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  39.0k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2212|  39.0k|      png_uint_32 tag_length = png_get_uint_32(tag+8);/* not padded */
  ------------------
  |  |  303|  39.0k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  39.0k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  39.0k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  39.0k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  39.0k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  39.0k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2213|       |
 2214|       |      /* The ICC specification does not exclude zero length tags, therefore the
 2215|       |       * start might actually be anywhere if there is no data, but this would be
 2216|       |       * a clear abuse of the intent of the standard so the start is checked for
 2217|       |       * being in range.  All defined tag types have an 8 byte header - a 4 byte
 2218|       |       * type signature then 0.
 2219|       |       */
 2220|       |
 2221|       |      /* This is a hard error; potentially it can cause read outside the
 2222|       |       * profile.
 2223|       |       */
 2224|  39.0k|      if (tag_start > profile_length || tag_length > profile_length - tag_start)
  ------------------
  |  Branch (2224:11): [True: 86, False: 38.9k]
  |  Branch (2224:41): [True: 87, False: 38.8k]
  ------------------
 2225|    173|         return png_icc_profile_error(png_ptr, colorspace, name, tag_id,
 2226|    173|             "ICC profile tag outside profile");
 2227|       |
 2228|  38.8k|      if ((tag_start & 3) != 0)
  ------------------
  |  Branch (2228:11): [True: 6.56k, False: 32.2k]
  ------------------
 2229|  6.56k|      {
 2230|       |         /* CNHP730S.icc shipped with Microsoft Windows 64 violates this; it is
 2231|       |          * only a warning here because libpng does not care about the
 2232|       |          * alignment.
 2233|       |          */
 2234|  6.56k|         (void)png_icc_profile_error(png_ptr, NULL, name, tag_id,
 2235|  6.56k|             "ICC profile tag start not a multiple of 4");
 2236|  6.56k|      }
 2237|  38.8k|   }
 2238|       |
 2239|  5.63k|   return 1; /* success, maybe with warnings */
 2240|  5.80k|}
OSS_FUZZ_png_icc_set_sRGB:
 2430|  5.37k|{
 2431|       |   /* Is this profile one of the known ICC sRGB profiles?  If it is, just set
 2432|       |    * the sRGB information.
 2433|       |    */
 2434|  5.37k|   if (png_compare_ICC_profile_with_sRGB(png_ptr, profile, adler) != 0)
  ------------------
  |  Branch (2434:8): [True: 0, False: 5.37k]
  ------------------
 2435|      0|      (void)png_colorspace_set_sRGB(png_ptr, colorspace,
  ------------------
  |  |  102|      0|#define png_colorspace_set_sRGB OSS_FUZZ_png_colorspace_set_sRGB
  ------------------
 2436|      0|         (int)/*already checked*/png_get_uint_32(profile+64));
  ------------------
  |  |  303|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2437|  5.37k|}
OSS_FUZZ_png_check_IHDR:
 2551|  9.72k|{
 2552|  9.72k|   int error = 0;
 2553|       |
 2554|       |   /* Check for width and height valid values */
 2555|  9.72k|   if (width == 0)
  ------------------
  |  Branch (2555:8): [True: 6, False: 9.71k]
  ------------------
 2556|      6|   {
 2557|      6|      png_warning(png_ptr, "Image width is zero in IHDR");
  ------------------
  |  |  426|      6|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2558|      6|      error = 1;
 2559|      6|   }
 2560|       |
 2561|  9.72k|   if (width > PNG_UINT_31_MAX)
  ------------------
  |  |  649|  9.72k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
  |  Branch (2561:8): [True: 0, False: 9.72k]
  ------------------
 2562|      0|   {
 2563|      0|      png_warning(png_ptr, "Invalid image width in IHDR");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2564|      0|      error = 1;
 2565|      0|   }
 2566|       |
 2567|  9.72k|   if (png_gt(((width + 7) & (~7U)),
  ------------------
  |  Branch (2567:8): [True: 0, False: 9.72k]
  ------------------
 2568|  9.72k|       ((PNG_SIZE_MAX
  ------------------
  |  |  651|  9.72k|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
 2569|  9.72k|           - 48        /* big_row_buf hack */
 2570|  9.72k|           - 1)        /* filter byte */
 2571|  9.72k|           / 8)        /* 8-byte RGBA pixels */
 2572|  9.72k|           - 1))       /* extra max_pixel_depth pad */
 2573|      0|   {
 2574|       |      /* The size of the row must be within the limits of this architecture.
 2575|       |       * Because the read code can perform arbitrary transformations the
 2576|       |       * maximum size is checked here.  Because the code in png_read_start_row
 2577|       |       * adds extra space "for safety's sake" in several places a conservative
 2578|       |       * limit is used here.
 2579|       |       *
 2580|       |       * NOTE: it would be far better to check the size that is actually used,
 2581|       |       * but the effect in the real world is minor and the changes are more
 2582|       |       * extensive, therefore much more dangerous and much more difficult to
 2583|       |       * write in a way that avoids compiler warnings.
 2584|       |       */
 2585|      0|      png_warning(png_ptr, "Image width is too large for this architecture");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2586|      0|      error = 1;
 2587|      0|   }
 2588|       |
 2589|  9.72k|#ifdef PNG_SET_USER_LIMITS_SUPPORTED
 2590|  9.72k|   if (width > png_ptr->user_width_max)
  ------------------
  |  Branch (2590:8): [True: 63, False: 9.65k]
  ------------------
 2591|       |#else
 2592|       |   if (width > PNG_USER_WIDTH_MAX)
 2593|       |#endif
 2594|     63|   {
 2595|     63|      png_warning(png_ptr, "Image width exceeds user limit in IHDR");
  ------------------
  |  |  426|     63|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2596|     63|      error = 1;
 2597|     63|   }
 2598|       |
 2599|  9.72k|   if (height == 0)
  ------------------
  |  Branch (2599:8): [True: 8, False: 9.71k]
  ------------------
 2600|      8|   {
 2601|      8|      png_warning(png_ptr, "Image height is zero in IHDR");
  ------------------
  |  |  426|      8|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2602|      8|      error = 1;
 2603|      8|   }
 2604|       |
 2605|  9.72k|   if (height > PNG_UINT_31_MAX)
  ------------------
  |  |  649|  9.72k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
  |  Branch (2605:8): [True: 0, False: 9.72k]
  ------------------
 2606|      0|   {
 2607|      0|      png_warning(png_ptr, "Invalid image height in IHDR");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2608|      0|      error = 1;
 2609|      0|   }
 2610|       |
 2611|  9.72k|#ifdef PNG_SET_USER_LIMITS_SUPPORTED
 2612|  9.72k|   if (height > png_ptr->user_height_max)
  ------------------
  |  Branch (2612:8): [True: 68, False: 9.65k]
  ------------------
 2613|       |#else
 2614|       |   if (height > PNG_USER_HEIGHT_MAX)
 2615|       |#endif
 2616|     68|   {
 2617|     68|      png_warning(png_ptr, "Image height exceeds user limit in IHDR");
  ------------------
  |  |  426|     68|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2618|     68|      error = 1;
 2619|     68|   }
 2620|       |
 2621|       |   /* Check other values */
 2622|  9.72k|   if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 &&
  ------------------
  |  Branch (2622:8): [True: 7.25k, False: 2.46k]
  |  Branch (2622:26): [True: 4.44k, False: 2.80k]
  |  Branch (2622:44): [True: 3.46k, False: 980]
  ------------------
 2623|  9.72k|       bit_depth != 8 && bit_depth != 16)
  ------------------
  |  Branch (2623:8): [True: 1.18k, False: 2.28k]
  |  Branch (2623:26): [True: 110, False: 1.07k]
  ------------------
 2624|    110|   {
 2625|    110|      png_warning(png_ptr, "Invalid bit depth in IHDR");
  ------------------
  |  |  426|    110|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2626|    110|      error = 1;
 2627|    110|   }
 2628|       |
 2629|  9.72k|   if (color_type < 0 || color_type == 1 ||
  ------------------
  |  Branch (2629:8): [True: 0, False: 9.72k]
  |  Branch (2629:26): [True: 4, False: 9.71k]
  ------------------
 2630|  9.72k|       color_type == 5 || color_type > 6)
  ------------------
  |  Branch (2630:8): [True: 1, False: 9.71k]
  |  Branch (2630:27): [True: 74, False: 9.64k]
  ------------------
 2631|     79|   {
 2632|     79|      png_warning(png_ptr, "Invalid color type in IHDR");
  ------------------
  |  |  426|     79|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2633|     79|      error = 1;
 2634|     79|   }
 2635|       |
 2636|  9.72k|   if (((color_type == PNG_COLOR_TYPE_PALETTE) && bit_depth > 8) ||
  ------------------
  |  |  669|  9.72k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  9.72k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  9.72k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (2636:9): [True: 3.09k, False: 6.62k]
  |  Branch (2636:51): [True: 6, False: 3.08k]
  ------------------
 2637|  9.72k|       ((color_type == PNG_COLOR_TYPE_RGB ||
  ------------------
  |  |  670|  19.4k|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|  9.71k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (2637:10): [True: 1.17k, False: 8.54k]
  ------------------
 2638|  9.71k|         color_type == PNG_COLOR_TYPE_GRAY_ALPHA ||
  ------------------
  |  |  672|  18.2k|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|  8.54k|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (2638:10): [True: 209, False: 8.33k]
  ------------------
 2639|  9.71k|         color_type == PNG_COLOR_TYPE_RGB_ALPHA) && bit_depth < 8))
  ------------------
  |  |  671|  8.33k|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|  8.33k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|  8.33k|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (2639:10): [True: 501, False: 7.83k]
  |  Branch (2639:53): [True: 4, False: 1.88k]
  ------------------
 2640|     10|   {
 2641|     10|      png_warning(png_ptr, "Invalid color type/bit depth combination in IHDR");
  ------------------
  |  |  426|     10|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2642|     10|      error = 1;
 2643|     10|   }
 2644|       |
 2645|  9.72k|   if (interlace_type >= PNG_INTERLACE_LAST)
  ------------------
  |  |  689|  9.72k|#define PNG_INTERLACE_LAST        2 /* Not a valid value */
  ------------------
  |  Branch (2645:8): [True: 84, False: 9.63k]
  ------------------
 2646|     84|   {
 2647|     84|      png_warning(png_ptr, "Unknown interlace method in IHDR");
  ------------------
  |  |  426|     84|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2648|     84|      error = 1;
 2649|     84|   }
 2650|       |
 2651|  9.72k|   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
  ------------------
  |  |  678|  9.72k|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */
  ------------------
  |  Branch (2651:8): [True: 91, False: 9.63k]
  ------------------
 2652|     91|   {
 2653|     91|      png_warning(png_ptr, "Unknown compression method in IHDR");
  ------------------
  |  |  426|     91|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2654|     91|      error = 1;
 2655|     91|   }
 2656|       |
 2657|  9.72k|#ifdef PNG_MNG_FEATURES_SUPPORTED
 2658|       |   /* Accept filter_method 64 (intrapixel differencing) only if
 2659|       |    * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
 2660|       |    * 2. Libpng did not read a PNG signature (this filter_method is only
 2661|       |    *    used in PNG datastreams that are embedded in MNG datastreams) and
 2662|       |    * 3. The application called png_permit_mng_features with a mask that
 2663|       |    *    included PNG_FLAG_MNG_FILTER_64 and
 2664|       |    * 4. The filter_method is 64 and
 2665|       |    * 5. The color_type is RGB or RGBA
 2666|       |    */
 2667|  9.72k|   if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) != 0 &&
  ------------------
  |  |  627|  9.72k|#define PNG_HAVE_PNG_SIGNATURE    0x1000U
  ------------------
  |  Branch (2667:8): [True: 0, False: 9.72k]
  ------------------
 2668|  9.72k|       png_ptr->mng_features_permitted != 0)
  ------------------
  |  Branch (2668:8): [True: 0, False: 0]
  ------------------
 2669|      0|      png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2670|       |
 2671|  9.72k|   if (filter_type != PNG_FILTER_TYPE_BASE)
  ------------------
  |  |  682|  9.72k|#define PNG_FILTER_TYPE_BASE      0 /* Single row per-byte filtering */
  ------------------
  |  Branch (2671:8): [True: 90, False: 9.63k]
  ------------------
 2672|     90|   {
 2673|     90|      if (!((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) != 0 &&
  ------------------
  |  |  858|     90|#define PNG_FLAG_MNG_FILTER_64      0x04
  ------------------
  |  Branch (2673:13): [True: 0, False: 90]
  ------------------
 2674|     90|          (filter_type == PNG_INTRAPIXEL_DIFFERENCING) &&
  ------------------
  |  |  683|      0|#define PNG_INTRAPIXEL_DIFFERENCING 64 /* Used only in MNG datastreams */
  ------------------
  |  Branch (2674:11): [True: 0, False: 0]
  ------------------
 2675|     90|          ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) == 0) &&
  ------------------
  |  |  627|      0|#define PNG_HAVE_PNG_SIGNATURE    0x1000U
  ------------------
  |  Branch (2675:11): [True: 0, False: 0]
  ------------------
 2676|     90|          (color_type == PNG_COLOR_TYPE_RGB ||
  ------------------
  |  |  670|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (2676:12): [True: 0, False: 0]
  ------------------
 2677|      0|          color_type == PNG_COLOR_TYPE_RGB_ALPHA)))
  ------------------
  |  |  671|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (2677:11): [True: 0, False: 0]
  ------------------
 2678|     90|      {
 2679|     90|         png_warning(png_ptr, "Unknown filter method in IHDR");
  ------------------
  |  |  426|     90|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2680|     90|         error = 1;
 2681|     90|      }
 2682|       |
 2683|     90|      if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) != 0)
  ------------------
  |  |  627|     90|#define PNG_HAVE_PNG_SIGNATURE    0x1000U
  ------------------
  |  Branch (2683:11): [True: 0, False: 90]
  ------------------
 2684|      0|      {
 2685|      0|         png_warning(png_ptr, "Invalid filter method in IHDR");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2686|      0|         error = 1;
 2687|      0|      }
 2688|     90|   }
 2689|       |
 2690|       |#else
 2691|       |   if (filter_type != PNG_FILTER_TYPE_BASE)
 2692|       |   {
 2693|       |      png_warning(png_ptr, "Unknown filter method in IHDR");
 2694|       |      error = 1;
 2695|       |   }
 2696|       |#endif
 2697|       |
 2698|  9.72k|   if (error == 1)
  ------------------
  |  Branch (2698:8): [True: 127, False: 9.59k]
  ------------------
 2699|    127|      png_error(png_ptr, "Invalid IHDR data");
  ------------------
  |  |  238|    127|#define png_error OSS_FUZZ_png_error
  ------------------
 2700|  9.72k|}
OSS_FUZZ_png_check_fp_number:
 2714|  7.77k|{
 2715|  7.77k|   int state = *statep;
 2716|  7.77k|   size_t i = *whereami;
 2717|       |
 2718|  33.2k|   while (i < size)
  ------------------
  |  Branch (2718:11): [True: 30.7k, False: 2.44k]
  ------------------
 2719|  30.7k|   {
 2720|  30.7k|      int type;
 2721|       |      /* First find the type of the next character */
 2722|  30.7k|      switch (string[i])
 2723|  30.7k|      {
 2724|    924|      case 43:  type = PNG_FP_SAW_SIGN;                   break;
  ------------------
  |  | 1895|    924|#define PNG_FP_SAW_SIGN   4  /* Saw +/- in current state */
  ------------------
  |  Branch (2724:7): [True: 924, False: 29.8k]
  ------------------
 2725|    906|      case 45:  type = PNG_FP_SAW_SIGN + PNG_FP_NEGATIVE; break;
  ------------------
  |  | 1895|    906|#define PNG_FP_SAW_SIGN   4  /* Saw +/- in current state */
  ------------------
                    case 45:  type = PNG_FP_SAW_SIGN + PNG_FP_NEGATIVE; break;
  ------------------
  |  | 1904|    906|#define PNG_FP_NEGATIVE 128  /* A negative number, including "-0" */
  ------------------
  |  Branch (2725:7): [True: 906, False: 29.8k]
  ------------------
 2726|  2.52k|      case 46:  type = PNG_FP_SAW_DOT;                    break;
  ------------------
  |  | 1897|  2.52k|#define PNG_FP_SAW_DOT   16  /* Saw a dot in current state */
  ------------------
  |  Branch (2726:7): [True: 2.52k, False: 28.2k]
  ------------------
 2727|  6.94k|      case 48:  type = PNG_FP_SAW_DIGIT;                  break;
  ------------------
  |  | 1896|  6.94k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2727:7): [True: 6.94k, False: 23.8k]
  ------------------
 2728|  7.46k|      case 49: case 50: case 51: case 52:
  ------------------
  |  Branch (2728:7): [True: 2.10k, False: 28.6k]
  |  Branch (2728:16): [True: 2.26k, False: 28.5k]
  |  Branch (2728:25): [True: 1.50k, False: 29.2k]
  |  Branch (2728:34): [True: 1.58k, False: 29.1k]
  ------------------
 2729|  11.9k|      case 53: case 54: case 55: case 56:
  ------------------
  |  Branch (2729:7): [True: 1.18k, False: 29.6k]
  |  Branch (2729:16): [True: 968, False: 29.8k]
  |  Branch (2729:25): [True: 1.17k, False: 29.6k]
  |  Branch (2729:34): [True: 1.14k, False: 29.6k]
  ------------------
 2730|  13.8k|      case 57:  type = PNG_FP_SAW_DIGIT + PNG_FP_NONZERO; break;
  ------------------
  |  | 1896|  13.8k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
                    case 57:  type = PNG_FP_SAW_DIGIT + PNG_FP_NONZERO; break;
  ------------------
  |  | 1905|  13.8k|#define PNG_FP_NONZERO  256  /* A non-zero value */
  ------------------
  |  Branch (2730:7): [True: 1.92k, False: 28.8k]
  ------------------
 2731|    862|      case 69:
  ------------------
  |  Branch (2731:7): [True: 862, False: 29.9k]
  ------------------
 2732|  2.52k|      case 101: type = PNG_FP_SAW_E;                      break;
  ------------------
  |  | 1898|  2.52k|#define PNG_FP_SAW_E     32  /* Saw an E (or e) in current state */
  ------------------
  |  Branch (2732:7): [True: 1.66k, False: 29.1k]
  ------------------
 2733|  3.10k|      default:  goto PNG_FP_End;
  ------------------
  |  Branch (2733:7): [True: 3.10k, False: 27.6k]
  ------------------
 2734|  30.7k|      }
 2735|       |
 2736|       |      /* Now deal with this type according to the current
 2737|       |       * state, the type is arranged to not overlap the
 2738|       |       * bits of the PNG_FP_STATE.
 2739|       |       */
 2740|  27.6k|      switch ((state & PNG_FP_STATE) + (type & PNG_FP_SAW_ANY))
  ------------------
  |  | 1894|  27.6k|#define PNG_FP_STATE      3  /* mask for the above */
  ------------------
                    switch ((state & PNG_FP_STATE) + (type & PNG_FP_SAW_ANY))
  ------------------
  |  | 1899|  27.6k|#define PNG_FP_SAW_ANY   60  /* Saw any of the above 4 */
  ------------------
 2741|  27.6k|      {
 2742|  1.16k|      case PNG_FP_INTEGER + PNG_FP_SAW_SIGN:
  ------------------
  |  | 1891|  1.16k|#define PNG_FP_INTEGER    0  /* before or in integer */
  ------------------
                    case PNG_FP_INTEGER + PNG_FP_SAW_SIGN:
  ------------------
  |  | 1895|  1.16k|#define PNG_FP_SAW_SIGN   4  /* Saw +/- in current state */
  ------------------
  |  Branch (2742:7): [True: 1.16k, False: 26.5k]
  ------------------
 2743|  1.16k|         if ((state & PNG_FP_SAW_ANY) != 0)
  ------------------
  |  | 1899|  1.16k|#define PNG_FP_SAW_ANY   60  /* Saw any of the above 4 */
  ------------------
  |  Branch (2743:14): [True: 455, False: 706]
  ------------------
 2744|    455|            goto PNG_FP_End; /* not a part of the number */
 2745|       |
 2746|    706|         png_fp_add(state, type);
  ------------------
  |  | 2708|    706|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2747|    706|         break;
 2748|       |
 2749|  2.24k|      case PNG_FP_INTEGER + PNG_FP_SAW_DOT:
  ------------------
  |  | 1891|  2.24k|#define PNG_FP_INTEGER    0  /* before or in integer */
  ------------------
                    case PNG_FP_INTEGER + PNG_FP_SAW_DOT:
  ------------------
  |  | 1897|  2.24k|#define PNG_FP_SAW_DOT   16  /* Saw a dot in current state */
  ------------------
  |  Branch (2749:7): [True: 2.24k, False: 25.4k]
  ------------------
 2750|       |         /* Ok as trailer, ok as lead of fraction. */
 2751|  2.24k|         if ((state & PNG_FP_SAW_DOT) != 0) /* two dots */
  ------------------
  |  | 1897|  2.24k|#define PNG_FP_SAW_DOT   16  /* Saw a dot in current state */
  ------------------
  |  Branch (2751:14): [True: 200, False: 2.04k]
  ------------------
 2752|    200|            goto PNG_FP_End;
 2753|       |
 2754|  2.04k|         else if ((state & PNG_FP_SAW_DIGIT) != 0) /* trailing dot? */
  ------------------
  |  | 1896|  2.04k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2754:19): [True: 734, False: 1.30k]
  ------------------
 2755|    734|            png_fp_add(state, type);
  ------------------
  |  | 2708|    734|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2756|       |
 2757|  1.30k|         else
 2758|  1.30k|            png_fp_set(state, PNG_FP_FRACTION | type);
  ------------------
  |  | 2709|  1.30k|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
  |  |  ------------------
  |  |  |  | 1906|  1.30k|#define PNG_FP_STICKY   448  /* The above three flags */
  |  |  ------------------
  ------------------
 2759|       |
 2760|  2.04k|         break;
 2761|       |
 2762|  12.8k|      case PNG_FP_INTEGER + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 1891|  12.8k|#define PNG_FP_INTEGER    0  /* before or in integer */
  ------------------
                    case PNG_FP_INTEGER + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 1896|  12.8k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2762:7): [True: 12.8k, False: 14.8k]
  ------------------
 2763|  12.8k|         if ((state & PNG_FP_SAW_DOT) != 0) /* delayed fraction */
  ------------------
  |  | 1897|  12.8k|#define PNG_FP_SAW_DOT   16  /* Saw a dot in current state */
  ------------------
  |  Branch (2763:14): [True: 437, False: 12.4k]
  ------------------
 2764|    437|            png_fp_set(state, PNG_FP_FRACTION | PNG_FP_SAW_DOT);
  ------------------
  |  | 2709|    437|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
  |  |  ------------------
  |  |  |  | 1906|    437|#define PNG_FP_STICKY   448  /* The above three flags */
  |  |  ------------------
  ------------------
 2765|       |
 2766|  12.8k|         png_fp_add(state, type | PNG_FP_WAS_VALID);
  ------------------
  |  | 2708|  12.8k|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2767|       |
 2768|  12.8k|         break;
 2769|       |
 2770|  1.42k|      case PNG_FP_INTEGER + PNG_FP_SAW_E:
  ------------------
  |  | 1891|  1.42k|#define PNG_FP_INTEGER    0  /* before or in integer */
  ------------------
                    case PNG_FP_INTEGER + PNG_FP_SAW_E:
  ------------------
  |  | 1898|  1.42k|#define PNG_FP_SAW_E     32  /* Saw an E (or e) in current state */
  ------------------
  |  Branch (2770:7): [True: 1.42k, False: 26.2k]
  ------------------
 2771|  1.42k|         if ((state & PNG_FP_SAW_DIGIT) == 0)
  ------------------
  |  | 1896|  1.42k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2771:14): [True: 230, False: 1.19k]
  ------------------
 2772|    230|            goto PNG_FP_End;
 2773|       |
 2774|  1.19k|         png_fp_set(state, PNG_FP_EXPONENT);
  ------------------
  |  | 2709|  1.19k|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
  |  |  ------------------
  |  |  |  | 1906|  1.19k|#define PNG_FP_STICKY   448  /* The above three flags */
  |  |  ------------------
  ------------------
 2775|       |
 2776|  1.19k|         break;
 2777|       |
 2778|       |   /* case PNG_FP_FRACTION + PNG_FP_SAW_SIGN:
 2779|       |         goto PNG_FP_End; ** no sign in fraction */
 2780|       |
 2781|       |   /* case PNG_FP_FRACTION + PNG_FP_SAW_DOT:
 2782|       |         goto PNG_FP_End; ** Because SAW_DOT is always set */
 2783|       |
 2784|  6.53k|      case PNG_FP_FRACTION + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 1892|  6.53k|#define PNG_FP_FRACTION   1  /* before or in fraction */
  ------------------
                    case PNG_FP_FRACTION + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 1896|  6.53k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2784:7): [True: 6.53k, False: 21.1k]
  ------------------
 2785|  6.53k|         png_fp_add(state, type | PNG_FP_WAS_VALID);
  ------------------
  |  | 2708|  6.53k|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2786|  6.53k|         break;
 2787|       |
 2788|    709|      case PNG_FP_FRACTION + PNG_FP_SAW_E:
  ------------------
  |  | 1892|    709|#define PNG_FP_FRACTION   1  /* before or in fraction */
  ------------------
                    case PNG_FP_FRACTION + PNG_FP_SAW_E:
  ------------------
  |  | 1898|    709|#define PNG_FP_SAW_E     32  /* Saw an E (or e) in current state */
  ------------------
  |  Branch (2788:7): [True: 709, False: 26.9k]
  ------------------
 2789|       |         /* This is correct because the trailing '.' on an
 2790|       |          * integer is handled above - so we can only get here
 2791|       |          * with the sequence ".E" (with no preceding digits).
 2792|       |          */
 2793|    709|         if ((state & PNG_FP_SAW_DIGIT) == 0)
  ------------------
  |  | 1896|    709|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2793:14): [True: 321, False: 388]
  ------------------
 2794|    321|            goto PNG_FP_End;
 2795|       |
 2796|    388|         png_fp_set(state, PNG_FP_EXPONENT);
  ------------------
  |  | 2709|    388|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
  |  |  ------------------
  |  |  |  | 1906|    388|#define PNG_FP_STICKY   448  /* The above three flags */
  |  |  ------------------
  ------------------
 2797|       |
 2798|    388|         break;
 2799|       |
 2800|    665|      case PNG_FP_EXPONENT + PNG_FP_SAW_SIGN:
  ------------------
  |  | 1893|    665|#define PNG_FP_EXPONENT   2  /* before or in exponent */
  ------------------
                    case PNG_FP_EXPONENT + PNG_FP_SAW_SIGN:
  ------------------
  |  | 1895|    665|#define PNG_FP_SAW_SIGN   4  /* Saw +/- in current state */
  ------------------
  |  Branch (2800:7): [True: 665, False: 27.0k]
  ------------------
 2801|    665|         if ((state & PNG_FP_SAW_ANY) != 0)
  ------------------
  |  | 1899|    665|#define PNG_FP_SAW_ANY   60  /* Saw any of the above 4 */
  ------------------
  |  Branch (2801:14): [True: 340, False: 325]
  ------------------
 2802|    340|            goto PNG_FP_End; /* not a part of the number */
 2803|       |
 2804|    325|         png_fp_add(state, PNG_FP_SAW_SIGN);
  ------------------
  |  | 2708|    325|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2805|       |
 2806|    325|         break;
 2807|       |
 2808|       |   /* case PNG_FP_EXPONENT + PNG_FP_SAW_DOT:
 2809|       |         goto PNG_FP_End; */
 2810|       |
 2811|  1.41k|      case PNG_FP_EXPONENT + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 1893|  1.41k|#define PNG_FP_EXPONENT   2  /* before or in exponent */
  ------------------
                    case PNG_FP_EXPONENT + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 1896|  1.41k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2811:7): [True: 1.41k, False: 26.2k]
  ------------------
 2812|  1.41k|         png_fp_add(state, PNG_FP_SAW_DIGIT | PNG_FP_WAS_VALID);
  ------------------
  |  | 2708|  1.41k|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2813|       |
 2814|  1.41k|         break;
 2815|       |
 2816|       |   /* case PNG_FP_EXPONEXT + PNG_FP_SAW_E:
 2817|       |         goto PNG_FP_End; */
 2818|       |
 2819|    683|      default: goto PNG_FP_End; /* I.e. break 2 */
  ------------------
  |  Branch (2819:7): [True: 683, False: 26.9k]
  ------------------
 2820|  27.6k|      }
 2821|       |
 2822|       |      /* The character seems ok, continue. */
 2823|  25.4k|      ++i;
 2824|  25.4k|   }
 2825|       |
 2826|  7.77k|PNG_FP_End:
 2827|       |   /* Here at the end, update the state and return the correct
 2828|       |    * return code.
 2829|       |    */
 2830|  7.77k|   *statep = state;
 2831|  7.77k|   *whereami = i;
 2832|       |
 2833|  7.77k|   return (state & PNG_FP_SAW_DIGIT) != 0;
  ------------------
  |  | 1896|  7.77k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
 2834|  7.77k|}
OSS_FUZZ_png_check_fp_string:
 2840|  1.81k|{
 2841|  1.81k|   int        state=0;
 2842|  1.81k|   size_t char_index=0;
 2843|       |
 2844|  1.81k|   if (png_check_fp_number(string, size, &state, &char_index) != 0 &&
  ------------------
  |  |  123|  1.81k|#define png_check_fp_number OSS_FUZZ_png_check_fp_number
  ------------------
  |  Branch (2844:8): [True: 1.23k, False: 574]
  ------------------
 2845|  1.81k|      (char_index == size || string[char_index] == 0))
  ------------------
  |  Branch (2845:8): [True: 1.02k, False: 213]
  |  Branch (2845:30): [True: 0, False: 213]
  ------------------
 2846|  1.02k|      return state /* must be non-zero - see above */;
 2847|       |
 2848|    787|   return 0; /* i.e. fail */
 2849|  1.81k|}
OSS_FUZZ_png_muldiv:
 3351|  10.3k|{
 3352|       |   /* Return a * times / divisor, rounded. */
 3353|  10.3k|   if (divisor != 0)
  ------------------
  |  Branch (3353:8): [True: 10.3k, False: 4]
  ------------------
 3354|  10.3k|   {
 3355|  10.3k|      if (a == 0 || times == 0)
  ------------------
  |  Branch (3355:11): [True: 1.11k, False: 9.26k]
  |  Branch (3355:21): [True: 75, False: 9.19k]
  ------------------
 3356|  1.18k|      {
 3357|  1.18k|         *res = 0;
 3358|  1.18k|         return 1;
 3359|  1.18k|      }
 3360|  9.19k|      else
 3361|  9.19k|      {
 3362|  9.19k|#ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
 3363|  9.19k|         double r = a;
 3364|  9.19k|         r *= times;
 3365|  9.19k|         r /= divisor;
 3366|  9.19k|         r = floor(r+.5);
 3367|       |
 3368|       |         /* A png_fixed_point is a 32-bit integer. */
 3369|  9.19k|         if (r <= 2147483647. && r >= -2147483648.)
  ------------------
  |  Branch (3369:14): [True: 9.19k, False: 1]
  |  Branch (3369:34): [True: 9.19k, False: 2]
  ------------------
 3370|  9.19k|         {
 3371|  9.19k|            *res = (png_fixed_point)r;
 3372|  9.19k|            return 1;
 3373|  9.19k|         }
 3374|       |#else
 3375|       |         int negative = 0;
 3376|       |         png_uint_32 A, T, D;
 3377|       |         png_uint_32 s16, s32, s00;
 3378|       |
 3379|       |         if (a < 0)
 3380|       |            negative = 1, A = -a;
 3381|       |         else
 3382|       |            A = a;
 3383|       |
 3384|       |         if (times < 0)
 3385|       |            negative = !negative, T = -times;
 3386|       |         else
 3387|       |            T = times;
 3388|       |
 3389|       |         if (divisor < 0)
 3390|       |            negative = !negative, D = -divisor;
 3391|       |         else
 3392|       |            D = divisor;
 3393|       |
 3394|       |         /* Following can't overflow because the arguments only
 3395|       |          * have 31 bits each, however the result may be 32 bits.
 3396|       |          */
 3397|       |         s16 = (A >> 16) * (T & 0xffff) +
 3398|       |                           (A & 0xffff) * (T >> 16);
 3399|       |         /* Can't overflow because the a*times bit is only 30
 3400|       |          * bits at most.
 3401|       |          */
 3402|       |         s32 = (A >> 16) * (T >> 16) + (s16 >> 16);
 3403|       |         s00 = (A & 0xffff) * (T & 0xffff);
 3404|       |
 3405|       |         s16 = (s16 & 0xffff) << 16;
 3406|       |         s00 += s16;
 3407|       |
 3408|       |         if (s00 < s16)
 3409|       |            ++s32; /* carry */
 3410|       |
 3411|       |         if (s32 < D) /* else overflow */
 3412|       |         {
 3413|       |            /* s32.s00 is now the 64-bit product, do a standard
 3414|       |             * division, we know that s32 < D, so the maximum
 3415|       |             * required shift is 31.
 3416|       |             */
 3417|       |            int bitshift = 32;
 3418|       |            png_fixed_point result = 0; /* NOTE: signed */
 3419|       |
 3420|       |            while (--bitshift >= 0)
 3421|       |            {
 3422|       |               png_uint_32 d32, d00;
 3423|       |
 3424|       |               if (bitshift > 0)
 3425|       |                  d32 = D >> (32-bitshift), d00 = D << bitshift;
 3426|       |
 3427|       |               else
 3428|       |                  d32 = 0, d00 = D;
 3429|       |
 3430|       |               if (s32 > d32)
 3431|       |               {
 3432|       |                  if (s00 < d00) --s32; /* carry */
 3433|       |                  s32 -= d32, s00 -= d00, result += 1<<bitshift;
 3434|       |               }
 3435|       |
 3436|       |               else
 3437|       |                  if (s32 == d32 && s00 >= d00)
 3438|       |                     s32 = 0, s00 -= d00, result += 1<<bitshift;
 3439|       |            }
 3440|       |
 3441|       |            /* Handle the rounding. */
 3442|       |            if (s00 >= (D >> 1))
 3443|       |               ++result;
 3444|       |
 3445|       |            if (negative != 0)
 3446|       |               result = -result;
 3447|       |
 3448|       |            /* Check for overflow. */
 3449|       |            if ((negative != 0 && result <= 0) ||
 3450|       |                (negative == 0 && result >= 0))
 3451|       |            {
 3452|       |               *res = result;
 3453|       |               return 1;
 3454|       |            }
 3455|       |         }
 3456|       |#endif
 3457|  9.19k|      }
 3458|  10.3k|   }
 3459|       |
 3460|      7|   return 0;
 3461|  10.3k|}
OSS_FUZZ_png_reciprocal:
 3489|  1.27k|{
 3490|  1.27k|#ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
 3491|  1.27k|   double r = floor(1E10/a+.5);
 3492|       |
 3493|  1.27k|   if (r <= 2147483647. && r >= -2147483648.)
  ------------------
  |  Branch (3493:8): [True: 1.27k, False: 0]
  |  Branch (3493:28): [True: 1.27k, False: 0]
  ------------------
 3494|  1.27k|      return (png_fixed_point)r;
 3495|       |#else
 3496|       |   png_fixed_point res;
 3497|       |
 3498|       |   if (png_muldiv(&res, 100000, 100000, a) != 0)
 3499|       |      return res;
 3500|       |#endif
 3501|       |
 3502|      0|   return 0; /* error/overflow */
 3503|  1.27k|}
OSS_FUZZ_png_gamma_significant:
 3510|  2.47k|{
 3511|  2.47k|   return gamma_val < PNG_FP_1 - PNG_GAMMA_THRESHOLD_FIXED ||
  ------------------
  |  |  656|  2.47k|#define PNG_FP_1    100000
  ------------------
                 return gamma_val < PNG_FP_1 - PNG_GAMMA_THRESHOLD_FIXED ||
  ------------------
  |  |  194|  4.94k|#define PNG_GAMMA_THRESHOLD_FIXED 5000
  ------------------
  |  Branch (3511:11): [True: 437, False: 2.03k]
  ------------------
 3512|  2.47k|       gamma_val > PNG_FP_1 + PNG_GAMMA_THRESHOLD_FIXED;
  ------------------
  |  |  656|  2.03k|#define PNG_FP_1    100000
  ------------------
                     gamma_val > PNG_FP_1 + PNG_GAMMA_THRESHOLD_FIXED;
  ------------------
  |  |  194|  2.03k|#define PNG_GAMMA_THRESHOLD_FIXED 5000
  ------------------
  |  Branch (3512:8): [True: 251, False: 1.78k]
  ------------------
 3513|  2.47k|}
OSS_FUZZ_png_destroy_gamma_table:
 4137|  8.50k|{
 4138|  8.50k|   png_free(png_ptr, png_ptr->gamma_table);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
 4139|  8.50k|   png_ptr->gamma_table = NULL;
 4140|       |
 4141|  8.50k|#ifdef PNG_16BIT_SUPPORTED
 4142|  8.50k|   if (png_ptr->gamma_16_table != NULL)
  ------------------
  |  Branch (4142:8): [True: 0, False: 8.50k]
  ------------------
 4143|      0|   {
 4144|      0|      int i;
 4145|      0|      int istop = (1 << (8 - png_ptr->gamma_shift));
 4146|      0|      for (i = 0; i < istop; i++)
  ------------------
  |  Branch (4146:19): [True: 0, False: 0]
  ------------------
 4147|      0|      {
 4148|      0|         png_free(png_ptr, png_ptr->gamma_16_table[i]);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 4149|      0|      }
 4150|      0|   png_free(png_ptr, png_ptr->gamma_16_table);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 4151|      0|   png_ptr->gamma_16_table = NULL;
 4152|      0|   }
 4153|  8.50k|#endif /* 16BIT */
 4154|       |
 4155|  8.50k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) || \
 4156|  8.50k|   defined(PNG_READ_ALPHA_MODE_SUPPORTED) || \
 4157|  8.50k|   defined(PNG_READ_RGB_TO_GRAY_SUPPORTED)
 4158|  8.50k|   png_free(png_ptr, png_ptr->gamma_from_1);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
 4159|  8.50k|   png_ptr->gamma_from_1 = NULL;
 4160|  8.50k|   png_free(png_ptr, png_ptr->gamma_to_1);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
 4161|  8.50k|   png_ptr->gamma_to_1 = NULL;
 4162|       |
 4163|  8.50k|#ifdef PNG_16BIT_SUPPORTED
 4164|  8.50k|   if (png_ptr->gamma_16_from_1 != NULL)
  ------------------
  |  Branch (4164:8): [True: 0, False: 8.50k]
  ------------------
 4165|      0|   {
 4166|      0|      int i;
 4167|      0|      int istop = (1 << (8 - png_ptr->gamma_shift));
 4168|      0|      for (i = 0; i < istop; i++)
  ------------------
  |  Branch (4168:19): [True: 0, False: 0]
  ------------------
 4169|      0|      {
 4170|      0|         png_free(png_ptr, png_ptr->gamma_16_from_1[i]);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 4171|      0|      }
 4172|      0|   png_free(png_ptr, png_ptr->gamma_16_from_1);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 4173|      0|   png_ptr->gamma_16_from_1 = NULL;
 4174|      0|   }
 4175|  8.50k|   if (png_ptr->gamma_16_to_1 != NULL)
  ------------------
  |  Branch (4175:8): [True: 0, False: 8.50k]
  ------------------
 4176|      0|   {
 4177|      0|      int i;
 4178|      0|      int istop = (1 << (8 - png_ptr->gamma_shift));
 4179|      0|      for (i = 0; i < istop; i++)
  ------------------
  |  Branch (4179:19): [True: 0, False: 0]
  ------------------
 4180|      0|      {
 4181|      0|         png_free(png_ptr, png_ptr->gamma_16_to_1[i]);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 4182|      0|      }
 4183|      0|   png_free(png_ptr, png_ptr->gamma_16_to_1);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 4184|      0|   png_ptr->gamma_16_to_1 = NULL;
 4185|      0|   }
 4186|  8.50k|#endif /* 16BIT */
 4187|  8.50k|#endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */
 4188|  8.50k|}
OSS_FUZZ_png_set_option:
 4333|  8.50k|{
 4334|  8.50k|   if (png_ptr != NULL && option >= 0 && option < PNG_OPTION_NEXT &&
  ------------------
  |  | 3214|  17.0k|#define PNG_OPTION_NEXT  12 /* Next option - numbers must be even */
  ------------------
  |  Branch (4334:8): [True: 8.50k, False: 0]
  |  Branch (4334:27): [True: 8.50k, False: 0]
  |  Branch (4334:42): [True: 8.50k, False: 0]
  ------------------
 4335|  8.50k|      (option & 1) == 0)
  ------------------
  |  Branch (4335:7): [True: 8.50k, False: 0]
  ------------------
 4336|  8.50k|   {
 4337|  8.50k|      png_uint_32 mask = 3U << option;
 4338|  8.50k|      png_uint_32 setting = (2U + (onoff != 0)) << option;
 4339|  8.50k|      png_uint_32 current = png_ptr->options;
 4340|       |
 4341|  8.50k|      png_ptr->options = (png_uint_32)((current & ~mask) | setting);
 4342|       |
 4343|  8.50k|      return (int)(current & mask) >> option;
 4344|  8.50k|   }
 4345|       |
 4346|      0|   return PNG_OPTION_INVALID;
  ------------------
  |  | 3218|      0|#define PNG_OPTION_INVALID 1 /* Option number out of range */
  ------------------
 4347|  8.50k|}
png.c:png_colorspace_check_gamma:
 1081|    906|{
 1082|    906|   png_fixed_point gtest;
 1083|       |
 1084|    906|   if ((colorspace->flags & PNG_COLORSPACE_HAVE_GAMMA) != 0 &&
  ------------------
  |  |  131|    906|#define PNG_COLORSPACE_HAVE_GAMMA           0x0001
  ------------------
  |  Branch (1084:8): [True: 655, False: 251]
  ------------------
 1085|    906|       (png_muldiv(&gtest, colorspace->gamma, PNG_FP_1, gAMA) == 0  ||
  ------------------
  |  |  125|    655|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                     (png_muldiv(&gtest, colorspace->gamma, PNG_FP_1, gAMA) == 0  ||
  ------------------
  |  |  656|    655|#define PNG_FP_1    100000
  ------------------
  |  Branch (1085:9): [True: 0, False: 655]
  ------------------
 1086|    655|      png_gamma_significant(gtest) != 0))
  ------------------
  |  |  129|    655|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1086:7): [True: 639, False: 16]
  ------------------
 1087|    639|   {
 1088|       |      /* Either this is an sRGB image, in which case the calculated gamma
 1089|       |       * approximation should match, or this is an image with a profile and the
 1090|       |       * value libpng calculates for the gamma of the profile does not match the
 1091|       |       * value recorded in the file.  The former, sRGB, case is an error, the
 1092|       |       * latter is just a warning.
 1093|       |       */
 1094|    639|      if ((colorspace->flags & PNG_COLORSPACE_FROM_sRGB) != 0 || from == 2)
  ------------------
  |  |  136|    639|#define PNG_COLORSPACE_FROM_sRGB            0x0020
  ------------------
  |  Branch (1094:11): [True: 587, False: 52]
  |  Branch (1094:66): [True: 52, False: 0]
  ------------------
 1095|    639|      {
 1096|    639|         png_chunk_report(png_ptr, "gamma value does not match sRGB",
  ------------------
  |  |  120|    639|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 1097|    639|             PNG_CHUNK_ERROR);
  ------------------
  |  | 1835|    639|#define PNG_CHUNK_ERROR       2 /* always an error */
  ------------------
 1098|       |         /* Do not overwrite an sRGB value */
 1099|    639|         return from == 2;
 1100|    639|      }
 1101|       |
 1102|      0|      else /* sRGB tag not involved */
 1103|      0|      {
 1104|      0|         png_chunk_report(png_ptr, "gamma value does not match libpng estimate",
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 1105|      0|             PNG_CHUNK_WARNING);
  ------------------
  |  | 1833|      0|#define PNG_CHUNK_WARNING     0 /* never an error */
  ------------------
 1106|      0|         return from == 1;
 1107|      0|      }
 1108|    639|   }
 1109|       |
 1110|    267|   return 1;
 1111|    906|}
png.c:png_colorspace_check_xy:
 1619|    772|{
 1620|    772|   int result;
 1621|    772|   png_xy xy_test;
 1622|       |
 1623|       |   /* As a side-effect this routine also returns the XYZ endpoints. */
 1624|    772|   result = png_XYZ_from_xy(XYZ, xy);
 1625|    772|   if (result != 0)
  ------------------
  |  Branch (1625:8): [True: 407, False: 365]
  ------------------
 1626|    407|      return result;
 1627|       |
 1628|    365|   result = png_xy_from_XYZ(&xy_test, XYZ);
 1629|    365|   if (result != 0)
  ------------------
  |  Branch (1629:8): [True: 2, False: 363]
  ------------------
 1630|      2|      return result;
 1631|       |
 1632|    363|   if (png_colorspace_endpoints_match(xy, &xy_test,
  ------------------
  |  Branch (1632:8): [True: 124, False: 239]
  ------------------
 1633|    363|       5/*actually, the math is pretty accurate*/) != 0)
 1634|    124|      return 0;
 1635|       |
 1636|       |   /* Too much slip */
 1637|    239|   return 1;
 1638|    363|}
png.c:png_XYZ_from_xy:
 1277|    772|{
 1278|    772|   png_fixed_point red_inverse, green_inverse, blue_scale;
 1279|    772|   png_fixed_point left, right, denominator;
 1280|       |
 1281|       |   /* Check xy and, implicitly, z.  Note that wide gamut color spaces typically
 1282|       |    * have end points with 0 tristimulus values (these are impossible end
 1283|       |    * points, but they are used to cover the possible colors).  We check
 1284|       |    * xy->whitey against 5, not 0, to avoid a possible integer overflow.
 1285|       |    */
 1286|    772|   if (xy->redx   < 0 || xy->redx > PNG_FP_1) return 1;
  ------------------
  |  |  656|    772|#define PNG_FP_1    100000
  ------------------
  |  Branch (1286:8): [True: 0, False: 772]
  |  Branch (1286:26): [True: 34, False: 738]
  ------------------
 1287|    738|   if (xy->redy   < 0 || xy->redy > PNG_FP_1-xy->redx) return 1;
  ------------------
  |  |  656|    738|#define PNG_FP_1    100000
  ------------------
  |  Branch (1287:8): [True: 0, False: 738]
  |  Branch (1287:26): [True: 64, False: 674]
  ------------------
 1288|    674|   if (xy->greenx < 0 || xy->greenx > PNG_FP_1) return 1;
  ------------------
  |  |  656|    674|#define PNG_FP_1    100000
  ------------------
  |  Branch (1288:8): [True: 0, False: 674]
  |  Branch (1288:26): [True: 20, False: 654]
  ------------------
 1289|    654|   if (xy->greeny < 0 || xy->greeny > PNG_FP_1-xy->greenx) return 1;
  ------------------
  |  |  656|    654|#define PNG_FP_1    100000
  ------------------
  |  Branch (1289:8): [True: 0, False: 654]
  |  Branch (1289:26): [True: 53, False: 601]
  ------------------
 1290|    601|   if (xy->bluex  < 0 || xy->bluex > PNG_FP_1) return 1;
  ------------------
  |  |  656|    601|#define PNG_FP_1    100000
  ------------------
  |  Branch (1290:8): [True: 0, False: 601]
  |  Branch (1290:26): [True: 7, False: 594]
  ------------------
 1291|    594|   if (xy->bluey  < 0 || xy->bluey > PNG_FP_1-xy->bluex) return 1;
  ------------------
  |  |  656|    594|#define PNG_FP_1    100000
  ------------------
  |  Branch (1291:8): [True: 0, False: 594]
  |  Branch (1291:26): [True: 52, False: 542]
  ------------------
 1292|    542|   if (xy->whitex < 0 || xy->whitex > PNG_FP_1) return 1;
  ------------------
  |  |  656|    542|#define PNG_FP_1    100000
  ------------------
  |  Branch (1292:8): [True: 0, False: 542]
  |  Branch (1292:26): [True: 24, False: 518]
  ------------------
 1293|    518|   if (xy->whitey < 5 || xy->whitey > PNG_FP_1-xy->whitex) return 1;
  ------------------
  |  |  656|    514|#define PNG_FP_1    100000
  ------------------
  |  Branch (1293:8): [True: 4, False: 514]
  |  Branch (1293:26): [True: 61, False: 453]
  ------------------
 1294|       |
 1295|       |   /* The reverse calculation is more difficult because the original tristimulus
 1296|       |    * value had 9 independent values (red,green,blue)x(X,Y,Z) however only 8
 1297|       |    * derived values were recorded in the cHRM chunk;
 1298|       |    * (red,green,blue,white)x(x,y).  This loses one degree of freedom and
 1299|       |    * therefore an arbitrary ninth value has to be introduced to undo the
 1300|       |    * original transformations.
 1301|       |    *
 1302|       |    * Think of the original end-points as points in (X,Y,Z) space.  The
 1303|       |    * chromaticity values (c) have the property:
 1304|       |    *
 1305|       |    *           C
 1306|       |    *   c = ---------
 1307|       |    *       X + Y + Z
 1308|       |    *
 1309|       |    * For each c (x,y,z) from the corresponding original C (X,Y,Z).  Thus the
 1310|       |    * three chromaticity values (x,y,z) for each end-point obey the
 1311|       |    * relationship:
 1312|       |    *
 1313|       |    *   x + y + z = 1
 1314|       |    *
 1315|       |    * This describes the plane in (X,Y,Z) space that intersects each axis at the
 1316|       |    * value 1.0; call this the chromaticity plane.  Thus the chromaticity
 1317|       |    * calculation has scaled each end-point so that it is on the x+y+z=1 plane
 1318|       |    * and chromaticity is the intersection of the vector from the origin to the
 1319|       |    * (X,Y,Z) value with the chromaticity plane.
 1320|       |    *
 1321|       |    * To fully invert the chromaticity calculation we would need the three
 1322|       |    * end-point scale factors, (red-scale, green-scale, blue-scale), but these
 1323|       |    * were not recorded.  Instead we calculated the reference white (X,Y,Z) and
 1324|       |    * recorded the chromaticity of this.  The reference white (X,Y,Z) would have
 1325|       |    * given all three of the scale factors since:
 1326|       |    *
 1327|       |    *    color-C = color-c * color-scale
 1328|       |    *    white-C = red-C + green-C + blue-C
 1329|       |    *            = red-c*red-scale + green-c*green-scale + blue-c*blue-scale
 1330|       |    *
 1331|       |    * But cHRM records only white-x and white-y, so we have lost the white scale
 1332|       |    * factor:
 1333|       |    *
 1334|       |    *    white-C = white-c*white-scale
 1335|       |    *
 1336|       |    * To handle this the inverse transformation makes an arbitrary assumption
 1337|       |    * about white-scale:
 1338|       |    *
 1339|       |    *    Assume: white-Y = 1.0
 1340|       |    *    Hence:  white-scale = 1/white-y
 1341|       |    *    Or:     red-Y + green-Y + blue-Y = 1.0
 1342|       |    *
 1343|       |    * Notice the last statement of the assumption gives an equation in three of
 1344|       |    * the nine values we want to calculate.  8 more equations come from the
 1345|       |    * above routine as summarised at the top above (the chromaticity
 1346|       |    * calculation):
 1347|       |    *
 1348|       |    *    Given: color-x = color-X / (color-X + color-Y + color-Z)
 1349|       |    *    Hence: (color-x - 1)*color-X + color.x*color-Y + color.x*color-Z = 0
 1350|       |    *
 1351|       |    * This is 9 simultaneous equations in the 9 variables "color-C" and can be
 1352|       |    * solved by Cramer's rule.  Cramer's rule requires calculating 10 9x9 matrix
 1353|       |    * determinants, however this is not as bad as it seems because only 28 of
 1354|       |    * the total of 90 terms in the various matrices are non-zero.  Nevertheless
 1355|       |    * Cramer's rule is notoriously numerically unstable because the determinant
 1356|       |    * calculation involves the difference of large, but similar, numbers.  It is
 1357|       |    * difficult to be sure that the calculation is stable for real world values
 1358|       |    * and it is certain that it becomes unstable where the end points are close
 1359|       |    * together.
 1360|       |    *
 1361|       |    * So this code uses the perhaps slightly less optimal but more
 1362|       |    * understandable and totally obvious approach of calculating color-scale.
 1363|       |    *
 1364|       |    * This algorithm depends on the precision in white-scale and that is
 1365|       |    * (1/white-y), so we can immediately see that as white-y approaches 0 the
 1366|       |    * accuracy inherent in the cHRM chunk drops off substantially.
 1367|       |    *
 1368|       |    * libpng arithmetic: a simple inversion of the above equations
 1369|       |    * ------------------------------------------------------------
 1370|       |    *
 1371|       |    *    white_scale = 1/white-y
 1372|       |    *    white-X = white-x * white-scale
 1373|       |    *    white-Y = 1.0
 1374|       |    *    white-Z = (1 - white-x - white-y) * white_scale
 1375|       |    *
 1376|       |    *    white-C = red-C + green-C + blue-C
 1377|       |    *            = red-c*red-scale + green-c*green-scale + blue-c*blue-scale
 1378|       |    *
 1379|       |    * This gives us three equations in (red-scale,green-scale,blue-scale) where
 1380|       |    * all the coefficients are now known:
 1381|       |    *
 1382|       |    *    red-x*red-scale + green-x*green-scale + blue-x*blue-scale
 1383|       |    *       = white-x/white-y
 1384|       |    *    red-y*red-scale + green-y*green-scale + blue-y*blue-scale = 1
 1385|       |    *    red-z*red-scale + green-z*green-scale + blue-z*blue-scale
 1386|       |    *       = (1 - white-x - white-y)/white-y
 1387|       |    *
 1388|       |    * In the last equation color-z is (1 - color-x - color-y) so we can add all
 1389|       |    * three equations together to get an alternative third:
 1390|       |    *
 1391|       |    *    red-scale + green-scale + blue-scale = 1/white-y = white-scale
 1392|       |    *
 1393|       |    * So now we have a Cramer's rule solution where the determinants are just
 1394|       |    * 3x3 - far more tractible.  Unfortunately 3x3 determinants still involve
 1395|       |    * multiplication of three coefficients so we can't guarantee to avoid
 1396|       |    * overflow in the libpng fixed point representation.  Using Cramer's rule in
 1397|       |    * floating point is probably a good choice here, but it's not an option for
 1398|       |    * fixed point.  Instead proceed to simplify the first two equations by
 1399|       |    * eliminating what is likely to be the largest value, blue-scale:
 1400|       |    *
 1401|       |    *    blue-scale = white-scale - red-scale - green-scale
 1402|       |    *
 1403|       |    * Hence:
 1404|       |    *
 1405|       |    *    (red-x - blue-x)*red-scale + (green-x - blue-x)*green-scale =
 1406|       |    *                (white-x - blue-x)*white-scale
 1407|       |    *
 1408|       |    *    (red-y - blue-y)*red-scale + (green-y - blue-y)*green-scale =
 1409|       |    *                1 - blue-y*white-scale
 1410|       |    *
 1411|       |    * And now we can trivially solve for (red-scale,green-scale):
 1412|       |    *
 1413|       |    *    green-scale =
 1414|       |    *                (white-x - blue-x)*white-scale - (red-x - blue-x)*red-scale
 1415|       |    *                -----------------------------------------------------------
 1416|       |    *                                  green-x - blue-x
 1417|       |    *
 1418|       |    *    red-scale =
 1419|       |    *                1 - blue-y*white-scale - (green-y - blue-y) * green-scale
 1420|       |    *                ---------------------------------------------------------
 1421|       |    *                                  red-y - blue-y
 1422|       |    *
 1423|       |    * Hence:
 1424|       |    *
 1425|       |    *    red-scale =
 1426|       |    *          ( (green-x - blue-x) * (white-y - blue-y) -
 1427|       |    *            (green-y - blue-y) * (white-x - blue-x) ) / white-y
 1428|       |    * -------------------------------------------------------------------------
 1429|       |    *  (green-x - blue-x)*(red-y - blue-y)-(green-y - blue-y)*(red-x - blue-x)
 1430|       |    *
 1431|       |    *    green-scale =
 1432|       |    *          ( (red-y - blue-y) * (white-x - blue-x) -
 1433|       |    *            (red-x - blue-x) * (white-y - blue-y) ) / white-y
 1434|       |    * -------------------------------------------------------------------------
 1435|       |    *  (green-x - blue-x)*(red-y - blue-y)-(green-y - blue-y)*(red-x - blue-x)
 1436|       |    *
 1437|       |    * Accuracy:
 1438|       |    * The input values have 5 decimal digits of accuracy.  The values are all in
 1439|       |    * the range 0 < value < 1, so simple products are in the same range but may
 1440|       |    * need up to 10 decimal digits to preserve the original precision and avoid
 1441|       |    * underflow.  Because we are using a 32-bit signed representation we cannot
 1442|       |    * match this; the best is a little over 9 decimal digits, less than 10.
 1443|       |    *
 1444|       |    * The approach used here is to preserve the maximum precision within the
 1445|       |    * signed representation.  Because the red-scale calculation above uses the
 1446|       |    * difference between two products of values that must be in the range -1..+1
 1447|       |    * it is sufficient to divide the product by 7; ceil(100,000/32767*2).  The
 1448|       |    * factor is irrelevant in the calculation because it is applied to both
 1449|       |    * numerator and denominator.
 1450|       |    *
 1451|       |    * Note that the values of the differences of the products of the
 1452|       |    * chromaticities in the above equations tend to be small, for example for
 1453|       |    * the sRGB chromaticities they are:
 1454|       |    *
 1455|       |    * red numerator:    -0.04751
 1456|       |    * green numerator:  -0.08788
 1457|       |    * denominator:      -0.2241 (without white-y multiplication)
 1458|       |    *
 1459|       |    *  The resultant Y coefficients from the chromaticities of some widely used
 1460|       |    *  color space definitions are (to 15 decimal places):
 1461|       |    *
 1462|       |    *  sRGB
 1463|       |    *    0.212639005871510 0.715168678767756 0.072192315360734
 1464|       |    *  Kodak ProPhoto
 1465|       |    *    0.288071128229293 0.711843217810102 0.000085653960605
 1466|       |    *  Adobe RGB
 1467|       |    *    0.297344975250536 0.627363566255466 0.075291458493998
 1468|       |    *  Adobe Wide Gamut RGB
 1469|       |    *    0.258728243040113 0.724682314948566 0.016589442011321
 1470|       |    */
 1471|       |   /* By the argument, above overflow should be impossible here. The return
 1472|       |    * value of 2 indicates an internal error to the caller.
 1473|       |    */
 1474|    453|   if (png_muldiv(&left, xy->greenx-xy->bluex, xy->redy - xy->bluey, 7) == 0)
  ------------------
  |  |  125|    453|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
  |  Branch (1474:8): [True: 0, False: 453]
  ------------------
 1475|      0|      return 2;
 1476|    453|   if (png_muldiv(&right, xy->greeny-xy->bluey, xy->redx - xy->bluex, 7) == 0)
  ------------------
  |  |  125|    453|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
  |  Branch (1476:8): [True: 0, False: 453]
  ------------------
 1477|      0|      return 2;
 1478|    453|   denominator = left - right;
 1479|       |
 1480|       |   /* Now find the red numerator. */
 1481|    453|   if (png_muldiv(&left, xy->greenx-xy->bluex, xy->whitey-xy->bluey, 7) == 0)
  ------------------
  |  |  125|    453|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
  |  Branch (1481:8): [True: 0, False: 453]
  ------------------
 1482|      0|      return 2;
 1483|    453|   if (png_muldiv(&right, xy->greeny-xy->bluey, xy->whitex-xy->bluex, 7) == 0)
  ------------------
  |  |  125|    453|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
  |  Branch (1483:8): [True: 0, False: 453]
  ------------------
 1484|      0|      return 2;
 1485|       |
 1486|       |   /* Overflow is possible here and it indicates an extreme set of PNG cHRM
 1487|       |    * chunk values.  This calculation actually returns the reciprocal of the
 1488|       |    * scale value because this allows us to delay the multiplication of white-y
 1489|       |    * into the denominator, which tends to produce a small number.
 1490|       |    */
 1491|    453|   if (png_muldiv(&red_inverse, xy->whitey, denominator, left-right) == 0 ||
  ------------------
  |  |  125|    453|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
  |  Branch (1491:8): [True: 2, False: 451]
  ------------------
 1492|    453|       red_inverse <= xy->whitey /* r+g+b scales = white scale */)
  ------------------
  |  Branch (1492:8): [True: 30, False: 421]
  ------------------
 1493|     32|      return 1;
 1494|       |
 1495|       |   /* Similarly for green_inverse: */
 1496|    421|   if (png_muldiv(&left, xy->redy-xy->bluey, xy->whitex-xy->bluex, 7) == 0)
  ------------------
  |  |  125|    421|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
  |  Branch (1496:8): [True: 0, False: 421]
  ------------------
 1497|      0|      return 2;
 1498|    421|   if (png_muldiv(&right, xy->redx-xy->bluex, xy->whitey-xy->bluey, 7) == 0)
  ------------------
  |  |  125|    421|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
  |  Branch (1498:8): [True: 0, False: 421]
  ------------------
 1499|      0|      return 2;
 1500|    421|   if (png_muldiv(&green_inverse, xy->whitey, denominator, left-right) == 0 ||
  ------------------
  |  |  125|    421|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
  |  Branch (1500:8): [True: 3, False: 418]
  ------------------
 1501|    421|       green_inverse <= xy->whitey)
  ------------------
  |  Branch (1501:8): [True: 15, False: 403]
  ------------------
 1502|     18|      return 1;
 1503|       |
 1504|       |   /* And the blue scale, the checks above guarantee this can't overflow but it
 1505|       |    * can still produce 0 for extreme cHRM values.
 1506|       |    */
 1507|    403|   blue_scale = png_reciprocal(xy->whitey) - png_reciprocal(red_inverse) -
  ------------------
  |  |  127|    403|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
                 blue_scale = png_reciprocal(xy->whitey) - png_reciprocal(red_inverse) -
  ------------------
  |  |  127|    403|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1508|    403|       png_reciprocal(green_inverse);
  ------------------
  |  |  127|    403|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1509|    403|   if (blue_scale <= 0)
  ------------------
  |  Branch (1509:8): [True: 38, False: 365]
  ------------------
 1510|     38|      return 1;
 1511|       |
 1512|       |
 1513|       |   /* And fill in the png_XYZ: */
 1514|    365|   if (png_muldiv(&XYZ->red_X, xy->redx, PNG_FP_1, red_inverse) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&XYZ->red_X, xy->redx, PNG_FP_1, red_inverse) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1514:8): [True: 0, False: 365]
  ------------------
 1515|      0|      return 1;
 1516|    365|   if (png_muldiv(&XYZ->red_Y, xy->redy, PNG_FP_1, red_inverse) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&XYZ->red_Y, xy->redy, PNG_FP_1, red_inverse) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1516:8): [True: 0, False: 365]
  ------------------
 1517|      0|      return 1;
 1518|    365|   if (png_muldiv(&XYZ->red_Z, PNG_FP_1 - xy->redx - xy->redy, PNG_FP_1,
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&XYZ->red_Z, PNG_FP_1 - xy->redx - xy->redy, PNG_FP_1,
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
                 if (png_muldiv(&XYZ->red_Z, PNG_FP_1 - xy->redx - xy->redy, PNG_FP_1,
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1518:8): [True: 0, False: 365]
  ------------------
 1519|    365|       red_inverse) == 0)
 1520|      0|      return 1;
 1521|       |
 1522|    365|   if (png_muldiv(&XYZ->green_X, xy->greenx, PNG_FP_1, green_inverse) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&XYZ->green_X, xy->greenx, PNG_FP_1, green_inverse) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1522:8): [True: 0, False: 365]
  ------------------
 1523|      0|      return 1;
 1524|    365|   if (png_muldiv(&XYZ->green_Y, xy->greeny, PNG_FP_1, green_inverse) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&XYZ->green_Y, xy->greeny, PNG_FP_1, green_inverse) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1524:8): [True: 0, False: 365]
  ------------------
 1525|      0|      return 1;
 1526|    365|   if (png_muldiv(&XYZ->green_Z, PNG_FP_1 - xy->greenx - xy->greeny, PNG_FP_1,
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&XYZ->green_Z, PNG_FP_1 - xy->greenx - xy->greeny, PNG_FP_1,
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
                 if (png_muldiv(&XYZ->green_Z, PNG_FP_1 - xy->greenx - xy->greeny, PNG_FP_1,
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1526:8): [True: 0, False: 365]
  ------------------
 1527|    365|       green_inverse) == 0)
 1528|      0|      return 1;
 1529|       |
 1530|    365|   if (png_muldiv(&XYZ->blue_X, xy->bluex, blue_scale, PNG_FP_1) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&XYZ->blue_X, xy->bluex, blue_scale, PNG_FP_1) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1530:8): [True: 0, False: 365]
  ------------------
 1531|      0|      return 1;
 1532|    365|   if (png_muldiv(&XYZ->blue_Y, xy->bluey, blue_scale, PNG_FP_1) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&XYZ->blue_Y, xy->bluey, blue_scale, PNG_FP_1) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1532:8): [True: 0, False: 365]
  ------------------
 1533|      0|      return 1;
 1534|    365|   if (png_muldiv(&XYZ->blue_Z, PNG_FP_1 - xy->bluex - xy->bluey, blue_scale,
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&XYZ->blue_Z, PNG_FP_1 - xy->bluex - xy->bluey, blue_scale,
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1534:8): [True: 0, False: 365]
  ------------------
 1535|    365|       PNG_FP_1) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
 1536|      0|      return 1;
 1537|       |
 1538|    365|   return 0; /*success*/
 1539|    365|}
png.c:png_xy_from_XYZ:
 1234|    365|{
 1235|    365|   png_int_32 d, dwhite, whiteX, whiteY;
 1236|       |
 1237|    365|   d = XYZ->red_X + XYZ->red_Y + XYZ->red_Z;
 1238|    365|   if (png_muldiv(&xy->redx, XYZ->red_X, PNG_FP_1, d) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&xy->redx, XYZ->red_X, PNG_FP_1, d) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1238:8): [True: 0, False: 365]
  ------------------
 1239|      0|      return 1;
 1240|    365|   if (png_muldiv(&xy->redy, XYZ->red_Y, PNG_FP_1, d) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&xy->redy, XYZ->red_Y, PNG_FP_1, d) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1240:8): [True: 0, False: 365]
  ------------------
 1241|      0|      return 1;
 1242|    365|   dwhite = d;
 1243|    365|   whiteX = XYZ->red_X;
 1244|    365|   whiteY = XYZ->red_Y;
 1245|       |
 1246|    365|   d = XYZ->green_X + XYZ->green_Y + XYZ->green_Z;
 1247|    365|   if (png_muldiv(&xy->greenx, XYZ->green_X, PNG_FP_1, d) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&xy->greenx, XYZ->green_X, PNG_FP_1, d) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1247:8): [True: 0, False: 365]
  ------------------
 1248|      0|      return 1;
 1249|    365|   if (png_muldiv(&xy->greeny, XYZ->green_Y, PNG_FP_1, d) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&xy->greeny, XYZ->green_Y, PNG_FP_1, d) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1249:8): [True: 0, False: 365]
  ------------------
 1250|      0|      return 1;
 1251|    365|   dwhite += d;
 1252|    365|   whiteX += XYZ->green_X;
 1253|    365|   whiteY += XYZ->green_Y;
 1254|       |
 1255|    365|   d = XYZ->blue_X + XYZ->blue_Y + XYZ->blue_Z;
 1256|    365|   if (png_muldiv(&xy->bluex, XYZ->blue_X, PNG_FP_1, d) == 0)
  ------------------
  |  |  125|    365|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&xy->bluex, XYZ->blue_X, PNG_FP_1, d) == 0)
  ------------------
  |  |  656|    365|#define PNG_FP_1    100000
  ------------------
  |  Branch (1256:8): [True: 2, False: 363]
  ------------------
 1257|      2|      return 1;
 1258|    363|   if (png_muldiv(&xy->bluey, XYZ->blue_Y, PNG_FP_1, d) == 0)
  ------------------
  |  |  125|    363|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&xy->bluey, XYZ->blue_Y, PNG_FP_1, d) == 0)
  ------------------
  |  |  656|    363|#define PNG_FP_1    100000
  ------------------
  |  Branch (1258:8): [True: 0, False: 363]
  ------------------
 1259|      0|      return 1;
 1260|    363|   dwhite += d;
 1261|    363|   whiteX += XYZ->blue_X;
 1262|    363|   whiteY += XYZ->blue_Y;
 1263|       |
 1264|       |   /* The reference white is simply the sum of the end-point (X,Y,Z) vectors,
 1265|       |    * thus:
 1266|       |    */
 1267|    363|   if (png_muldiv(&xy->whitex, whiteX, PNG_FP_1, dwhite) == 0)
  ------------------
  |  |  125|    363|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&xy->whitex, whiteX, PNG_FP_1, dwhite) == 0)
  ------------------
  |  |  656|    363|#define PNG_FP_1    100000
  ------------------
  |  Branch (1267:8): [True: 0, False: 363]
  ------------------
 1268|      0|      return 1;
 1269|    363|   if (png_muldiv(&xy->whitey, whiteY, PNG_FP_1, dwhite) == 0)
  ------------------
  |  |  125|    363|#define png_muldiv OSS_FUZZ_png_muldiv
  ------------------
                 if (png_muldiv(&xy->whitey, whiteY, PNG_FP_1, dwhite) == 0)
  ------------------
  |  |  656|    363|#define PNG_FP_1    100000
  ------------------
  |  Branch (1269:8): [True: 0, False: 363]
  ------------------
 1270|      0|      return 1;
 1271|       |
 1272|    363|   return 0;
 1273|    363|}
png.c:png_colorspace_set_xy_and_XYZ:
 1675|    124|{
 1676|    124|   if ((colorspace->flags & PNG_COLORSPACE_INVALID) != 0)
  ------------------
  |  |  139|    124|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
  |  Branch (1676:8): [True: 0, False: 124]
  ------------------
 1677|      0|      return 0;
 1678|       |
 1679|       |   /* The consistency check is performed on the chromaticities; this factors out
 1680|       |    * variations because of the normalization (or not) of the end point Y
 1681|       |    * values.
 1682|       |    */
 1683|    124|   if (preferred < 2 &&
  ------------------
  |  Branch (1683:8): [True: 124, False: 0]
  ------------------
 1684|    124|       (colorspace->flags & PNG_COLORSPACE_HAVE_ENDPOINTS) != 0)
  ------------------
  |  |  132|    124|#define PNG_COLORSPACE_HAVE_ENDPOINTS       0x0002
  ------------------
  |  Branch (1684:8): [True: 2, False: 122]
  ------------------
 1685|      2|   {
 1686|       |      /* The end points must be reasonably close to any we already have.  The
 1687|       |       * following allows an error of up to +/-.001
 1688|       |       */
 1689|      2|      if (png_colorspace_endpoints_match(xy, &colorspace->end_points_xy,
  ------------------
  |  Branch (1689:11): [True: 1, False: 1]
  ------------------
 1690|      2|          100) == 0)
 1691|      1|      {
 1692|      1|         colorspace->flags |= PNG_COLORSPACE_INVALID;
  ------------------
  |  |  139|      1|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
 1693|      1|         png_benign_error(png_ptr, "inconsistent chromaticities");
  ------------------
  |  |  221|      1|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
 1694|      1|         return 0; /* failed */
 1695|      1|      }
 1696|       |
 1697|       |      /* Only overwrite with preferred values */
 1698|      1|      if (preferred == 0)
  ------------------
  |  Branch (1698:11): [True: 0, False: 1]
  ------------------
 1699|      0|         return 1; /* ok, but no change */
 1700|      1|   }
 1701|       |
 1702|    123|   colorspace->end_points_xy = *xy;
 1703|    123|   colorspace->end_points_XYZ = *XYZ;
 1704|    123|   colorspace->flags |= PNG_COLORSPACE_HAVE_ENDPOINTS;
  ------------------
  |  |  132|    123|#define PNG_COLORSPACE_HAVE_ENDPOINTS       0x0002
  ------------------
 1705|       |
 1706|       |   /* The end points are normally quoted to two decimal digits, so allow +/-0.01
 1707|       |    * on this test.
 1708|       |    */
 1709|    123|   if (png_colorspace_endpoints_match(xy, &sRGB_xy, 1000) != 0)
  ------------------
  |  Branch (1709:8): [True: 5, False: 118]
  ------------------
 1710|      5|      colorspace->flags |= PNG_COLORSPACE_ENDPOINTS_MATCH_sRGB;
  ------------------
  |  |  137|      5|#define PNG_COLORSPACE_ENDPOINTS_MATCH_sRGB 0x0040
  ------------------
 1711|       |
 1712|    118|   else
 1713|    118|      colorspace->flags &= PNG_COLORSPACE_CANCEL(
  ------------------
  |  |  140|    118|#define PNG_COLORSPACE_CANCEL(flags)        (0xffff ^ (flags))
  ------------------
 1714|    123|         PNG_COLORSPACE_ENDPOINTS_MATCH_sRGB);
 1715|       |
 1716|    123|   return 2; /* ok and changed */
 1717|    124|}
png.c:png_icc_profile_error:
 1825|  20.8k|{
 1826|  20.8k|   size_t pos;
 1827|  20.8k|   char message[196]; /* see below for calculation */
 1828|       |
 1829|  20.8k|   if (colorspace != NULL)
  ------------------
  |  Branch (1829:8): [True: 936, False: 19.8k]
  ------------------
 1830|    936|      colorspace->flags |= PNG_COLORSPACE_INVALID;
  ------------------
  |  |  139|    936|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
 1831|       |
 1832|  20.8k|   pos = png_safecat(message, (sizeof message), 0, "profile '"); /* 9 chars */
  ------------------
  |  |  112|  20.8k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1833|  20.8k|   pos = png_safecat(message, pos+79, pos, name); /* Truncate to 79 chars */
  ------------------
  |  |  112|  20.8k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1834|  20.8k|   pos = png_safecat(message, (sizeof message), pos, "': "); /* +2 = 90 */
  ------------------
  |  |  112|  20.8k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1835|  20.8k|   if (is_ICC_signature(value) != 0)
  ------------------
  |  Branch (1835:8): [True: 3.16k, False: 17.6k]
  ------------------
 1836|  3.16k|   {
 1837|       |      /* So 'value' is at most 4 bytes and the following cast is safe */
 1838|  3.16k|      png_icc_tag_name(message+pos, (png_uint_32)value);
 1839|  3.16k|      pos += 6; /* total +8; less than the else clause */
 1840|  3.16k|      message[pos++] = ':';
 1841|  3.16k|      message[pos++] = ' ';
 1842|  3.16k|   }
 1843|  17.6k|#  ifdef PNG_WARNINGS_SUPPORTED
 1844|  17.6k|   else
 1845|  17.6k|      {
 1846|  17.6k|         char number[PNG_NUMBER_BUFFER_SIZE]; /* +24 = 114 */
 1847|       |
 1848|  17.6k|         pos = png_safecat(message, (sizeof message), pos,
  ------------------
  |  |  112|  17.6k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1849|  17.6k|             png_format_number(number, number+(sizeof number),
  ------------------
  |  |  113|  17.6k|#define png_format_number OSS_FUZZ_png_format_number
  ------------------
 1850|  17.6k|             PNG_NUMBER_FORMAT_x, value));
  ------------------
  |  | 1752|  17.6k|#define PNG_NUMBER_FORMAT_x     3
  ------------------
 1851|  17.6k|         pos = png_safecat(message, (sizeof message), pos, "h: "); /* +2 = 116 */
  ------------------
  |  |  112|  17.6k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1852|  17.6k|      }
 1853|  20.8k|#  endif
 1854|       |   /* The 'reason' is an arbitrary message, allow +79 maximum 195 */
 1855|  20.8k|   pos = png_safecat(message, (sizeof message), pos, reason);
  ------------------
  |  |  112|  20.8k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1856|  20.8k|   PNG_UNUSED(pos)
  ------------------
  |  |  444|  20.8k|#  define PNG_UNUSED(param) (void)param;
  ------------------
 1857|       |
 1858|       |   /* This is recoverable, but make it unconditionally an app_error on write to
 1859|       |    * avoid writing invalid ICC profiles into PNG files (i.e., we handle them
 1860|       |    * on read, with a warning, but on write unless the app turns off
 1861|       |    * application errors the PNG won't be written.)
 1862|       |    */
 1863|  20.8k|   png_chunk_report(png_ptr, message,
  ------------------
  |  |  120|  20.8k|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 1864|  20.8k|       (colorspace != NULL) ? PNG_CHUNK_ERROR : PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1835|    936|#define PNG_CHUNK_ERROR       2 /* always an error */
  ------------------
                     (colorspace != NULL) ? PNG_CHUNK_ERROR : PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|  19.8k|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
  |  Branch (1864:8): [True: 936, False: 19.8k]
  ------------------
 1865|       |
 1866|  20.8k|   return 0;
 1867|  20.8k|}
png.c:is_ICC_signature:
 1815|  20.8k|{
 1816|  20.8k|   return is_ICC_signature_char(it >> 24) /* checks all the top bits */ &&
  ------------------
  |  Branch (1816:11): [True: 8.58k, False: 12.2k]
  ------------------
 1817|  20.8k|      is_ICC_signature_char((it >> 16) & 0xff) &&
  ------------------
  |  Branch (1817:7): [True: 6.88k, False: 1.70k]
  ------------------
 1818|  20.8k|      is_ICC_signature_char((it >> 8) & 0xff) &&
  ------------------
  |  Branch (1818:7): [True: 5.54k, False: 1.33k]
  ------------------
 1819|  20.8k|      is_ICC_signature_char(it & 0xff);
  ------------------
  |  Branch (1819:7): [True: 3.16k, False: 2.38k]
  ------------------
 1820|  20.8k|}
png.c:is_ICC_signature_char:
 1808|  41.8k|{
 1809|  41.8k|   return it == 32 || (it >= 48 && it <= 57) || (it >= 65 && it <= 90) ||
  ------------------
  |  Branch (1809:11): [True: 1.74k, False: 40.0k]
  |  Branch (1809:24): [True: 25.7k, False: 14.3k]
  |  Branch (1809:36): [True: 3.01k, False: 22.7k]
  |  Branch (1809:50): [True: 22.2k, False: 14.8k]
  |  Branch (1809:62): [True: 5.17k, False: 17.0k]
  ------------------
 1810|  41.8k|      (it >= 97 && it <= 122);
  ------------------
  |  Branch (1810:8): [True: 16.5k, False: 15.3k]
  |  Branch (1810:20): [True: 14.2k, False: 2.31k]
  ------------------
 1811|  41.8k|}
png.c:png_icc_tag_name:
 1797|  3.16k|{
 1798|  3.16k|   name[0] = '\'';
 1799|  3.16k|   name[1] = png_icc_tag_char(tag >> 24);
 1800|  3.16k|   name[2] = png_icc_tag_char(tag >> 16);
 1801|  3.16k|   name[3] = png_icc_tag_char(tag >>  8);
 1802|  3.16k|   name[4] = png_icc_tag_char(tag      );
 1803|  3.16k|   name[5] = '\'';
 1804|  3.16k|}
png.c:png_icc_tag_char:
 1787|  12.6k|{
 1788|  12.6k|   byte &= 0xff;
 1789|  12.6k|   if (byte >= 32 && byte <= 126)
  ------------------
  |  Branch (1789:8): [True: 12.6k, False: 0]
  |  Branch (1789:22): [True: 12.6k, False: 0]
  ------------------
 1790|  12.6k|      return (char)byte;
 1791|      0|   else
 1792|      0|      return '?';
 1793|  12.6k|}
png.c:png_colorspace_endpoints_match:
 1593|    495|{
 1594|       |   /* Allow an error of +/-0.01 (absolute value) on each chromaticity */
 1595|    495|   if (PNG_OUT_OF_RANGE(xy1->whitex, xy2->whitex,delta) ||
  ------------------
  |  |  758|    990|   ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
  |  |  ------------------
  |  |  |  Branch (758:6): [True: 71, False: 424]
  |  |  |  Branch (758:35): [True: 68, False: 356]
  |  |  ------------------
  ------------------
 1596|    495|       PNG_OUT_OF_RANGE(xy1->whitey, xy2->whitey,delta) ||
  ------------------
  |  |  758|    851|   ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
  |  |  ------------------
  |  |  |  Branch (758:6): [True: 6, False: 350]
  |  |  |  Branch (758:35): [True: 27, False: 323]
  |  |  ------------------
  ------------------
 1597|    495|       PNG_OUT_OF_RANGE(xy1->redx,   xy2->redx,  delta) ||
  ------------------
  |  |  758|    818|   ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
  |  |  ------------------
  |  |  |  Branch (758:6): [True: 5, False: 318]
  |  |  |  Branch (758:35): [True: 26, False: 292]
  |  |  ------------------
  ------------------
 1598|    495|       PNG_OUT_OF_RANGE(xy1->redy,   xy2->redy,  delta) ||
  ------------------
  |  |  758|    787|   ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
  |  |  ------------------
  |  |  |  Branch (758:6): [True: 4, False: 288]
  |  |  |  Branch (758:35): [True: 28, False: 260]
  |  |  ------------------
  ------------------
 1599|    495|       PNG_OUT_OF_RANGE(xy1->greenx, xy2->greenx,delta) ||
  ------------------
  |  |  758|    755|   ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
  |  |  ------------------
  |  |  |  Branch (758:6): [True: 6, False: 254]
  |  |  |  Branch (758:35): [True: 43, False: 211]
  |  |  ------------------
  ------------------
 1600|    495|       PNG_OUT_OF_RANGE(xy1->greeny, xy2->greeny,delta) ||
  ------------------
  |  |  758|    706|   ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
  |  |  ------------------
  |  |  |  Branch (758:6): [True: 6, False: 205]
  |  |  |  Branch (758:35): [True: 30, False: 175]
  |  |  ------------------
  ------------------
 1601|    495|       PNG_OUT_OF_RANGE(xy1->bluex,  xy2->bluex, delta) ||
  ------------------
  |  |  758|    670|   ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
  |  |  ------------------
  |  |  |  Branch (758:6): [True: 2, False: 173]
  |  |  |  Branch (758:35): [True: 19, False: 154]
  |  |  ------------------
  ------------------
 1602|    495|       PNG_OUT_OF_RANGE(xy1->bluey,  xy2->bluey, delta))
  ------------------
  |  |  758|    154|   ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
  |  |  ------------------
  |  |  |  Branch (758:6): [True: 2, False: 152]
  |  |  |  Branch (758:35): [True: 21, False: 131]
  |  |  ------------------
  ------------------
 1603|    364|      return 0;
 1604|    131|   return 1;
 1605|    495|}
png.c:icc_check_length:
 1972|  6.56k|{
 1973|  6.56k|   if (profile_length < 132)
  ------------------
  |  Branch (1973:8): [True: 2, False: 6.56k]
  ------------------
 1974|      2|      return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
 1975|      2|          "too short");
 1976|  6.56k|   return 1;
 1977|  6.56k|}
png.c:png_compare_ICC_profile_with_sRGB:
 2309|  5.37k|{
 2310|       |   /* The quick check is to verify just the MD5 signature and trust the
 2311|       |    * rest of the data.  Because the profile has already been verified for
 2312|       |    * correctness this is safe.  png_colorspace_set_sRGB will check the 'intent'
 2313|       |    * field too, so if the profile has been edited with an intent not defined
 2314|       |    * by sRGB (but maybe defined by a later ICC specification) the read of
 2315|       |    * the profile will fail at that point.
 2316|       |    */
 2317|       |
 2318|  5.37k|   png_uint_32 length = 0;
 2319|  5.37k|   png_uint_32 intent = 0x10000; /* invalid */
 2320|  5.37k|#if PNG_sRGB_PROFILE_CHECKS > 1
 2321|  5.37k|   uLong crc = 0; /* the value for 0 length data */
 2322|  5.37k|#endif
 2323|  5.37k|   unsigned int i;
 2324|       |
 2325|  5.37k|#ifdef PNG_SET_OPTION_SUPPORTED
 2326|       |   /* First see if PNG_SKIP_sRGB_CHECK_PROFILE has been set to "on" */
 2327|  5.37k|   if (((png_ptr->options >> PNG_SKIP_sRGB_CHECK_PROFILE) & 3) ==
  ------------------
  |  | 3206|  5.37k|#define PNG_SKIP_sRGB_CHECK_PROFILE 4 /* SOFTWARE: Check ICC profile for sRGB */
  ------------------
  |  Branch (2327:8): [True: 0, False: 5.37k]
  ------------------
 2328|  5.37k|               PNG_OPTION_ON)
  ------------------
  |  | 3220|  5.37k|#define PNG_OPTION_ON      3
  ------------------
 2329|      0|      return 0;
 2330|  5.37k|#endif
 2331|       |
 2332|  42.3k|   for (i=0; i < (sizeof png_sRGB_checks) / (sizeof png_sRGB_checks[0]); ++i)
  ------------------
  |  Branch (2332:14): [True: 37.3k, False: 5.05k]
  ------------------
 2333|  37.3k|   {
 2334|  37.3k|      if (png_get_uint_32(profile+84) == png_sRGB_checks[i].md5[0] &&
  ------------------
  |  |  303|  37.3k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  37.3k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  37.3k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  37.3k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  37.3k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  37.3k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (2334:11): [True: 13.7k, False: 23.5k]
  ------------------
 2335|  37.3k|         png_get_uint_32(profile+88) == png_sRGB_checks[i].md5[1] &&
  ------------------
  |  |  303|  13.7k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  13.7k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  13.7k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  13.7k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  13.7k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  13.7k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (2335:10): [True: 7.68k, False: 6.05k]
  ------------------
 2336|  37.3k|         png_get_uint_32(profile+92) == png_sRGB_checks[i].md5[2] &&
  ------------------
  |  |  303|  7.68k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  7.68k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  7.68k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  7.68k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  7.68k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  7.68k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (2336:10): [True: 6.66k, False: 1.02k]
  ------------------
 2337|  37.3k|         png_get_uint_32(profile+96) == png_sRGB_checks[i].md5[3])
  ------------------
  |  |  303|  6.66k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  6.66k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  6.66k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  6.66k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  6.66k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  6.66k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (2337:10): [True: 4.92k, False: 1.73k]
  ------------------
 2338|  4.92k|      {
 2339|       |         /* This may be one of the old HP profiles without an MD5, in that
 2340|       |          * case we can only use the length and Adler32 (note that these
 2341|       |          * are not used by default if there is an MD5!)
 2342|       |          */
 2343|       |#        if PNG_sRGB_PROFILE_CHECKS == 0
 2344|       |            if (png_sRGB_checks[i].have_md5 != 0)
 2345|       |               return 1+png_sRGB_checks[i].is_broken;
 2346|       |#        endif
 2347|       |
 2348|       |         /* Profile is unsigned or more checks have been configured in. */
 2349|  4.92k|         if (length == 0)
  ------------------
  |  Branch (2349:14): [True: 1.75k, False: 3.17k]
  ------------------
 2350|  1.75k|         {
 2351|  1.75k|            length = png_get_uint_32(profile);
  ------------------
  |  |  303|  1.75k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  1.75k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  1.75k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  1.75k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  1.75k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  1.75k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2352|  1.75k|            intent = png_get_uint_32(profile+64);
  ------------------
  |  |  303|  1.75k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  1.75k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  1.75k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  1.75k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  1.75k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  1.75k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2353|  1.75k|         }
 2354|       |
 2355|       |         /* Length *and* intent must match */
 2356|  4.92k|         if (length == (png_uint_32) png_sRGB_checks[i].length &&
  ------------------
  |  Branch (2356:14): [True: 1.04k, False: 3.88k]
  ------------------
 2357|  4.92k|            intent == (png_uint_32) png_sRGB_checks[i].intent)
  ------------------
  |  Branch (2357:13): [True: 325, False: 722]
  ------------------
 2358|    325|         {
 2359|       |            /* Now calculate the adler32 if not done already. */
 2360|    325|            if (adler == 0)
  ------------------
  |  Branch (2360:17): [True: 0, False: 325]
  ------------------
 2361|      0|            {
 2362|      0|               adler = adler32(0, NULL, 0);
 2363|      0|               adler = adler32(adler, profile, length);
 2364|      0|            }
 2365|       |
 2366|    325|            if (adler == png_sRGB_checks[i].adler)
  ------------------
  |  Branch (2366:17): [True: 0, False: 325]
  ------------------
 2367|      0|            {
 2368|       |               /* These basic checks suggest that the data has not been
 2369|       |                * modified, but if the check level is more than 1 perform
 2370|       |                * our own crc32 checksum on the data.
 2371|       |                */
 2372|      0|#              if PNG_sRGB_PROFILE_CHECKS > 1
 2373|      0|                  if (crc == 0)
  ------------------
  |  Branch (2373:23): [True: 0, False: 0]
  ------------------
 2374|      0|                  {
 2375|      0|                     crc = crc32(0, NULL, 0);
 2376|      0|                     crc = crc32(crc, profile, length);
 2377|      0|                  }
 2378|       |
 2379|       |                  /* So this check must pass for the 'return' below to happen.
 2380|       |                   */
 2381|      0|                  if (crc == png_sRGB_checks[i].crc)
  ------------------
  |  Branch (2381:23): [True: 0, False: 0]
  ------------------
 2382|      0|#              endif
 2383|      0|               {
 2384|      0|                  if (png_sRGB_checks[i].is_broken != 0)
  ------------------
  |  Branch (2384:23): [True: 0, False: 0]
  ------------------
 2385|      0|                  {
 2386|       |                     /* These profiles are known to have bad data that may cause
 2387|       |                      * problems if they are used, therefore attempt to
 2388|       |                      * discourage their use, skip the 'have_md5' warning below,
 2389|       |                      * which is made irrelevant by this error.
 2390|       |                      */
 2391|      0|                     png_chunk_report(png_ptr, "known incorrect sRGB profile",
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 2392|      0|                         PNG_CHUNK_ERROR);
  ------------------
  |  | 1835|      0|#define PNG_CHUNK_ERROR       2 /* always an error */
  ------------------
 2393|      0|                  }
 2394|       |
 2395|       |                  /* Warn that this being done; this isn't even an error since
 2396|       |                   * the profile is perfectly valid, but it would be nice if
 2397|       |                   * people used the up-to-date ones.
 2398|       |                   */
 2399|      0|                  else if (png_sRGB_checks[i].have_md5 == 0)
  ------------------
  |  Branch (2399:28): [True: 0, False: 0]
  ------------------
 2400|      0|                  {
 2401|      0|                     png_chunk_report(png_ptr,
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 2402|      0|                         "out-of-date sRGB profile with no signature",
 2403|      0|                         PNG_CHUNK_WARNING);
  ------------------
  |  | 1833|      0|#define PNG_CHUNK_WARNING     0 /* never an error */
  ------------------
 2404|      0|                  }
 2405|       |
 2406|      0|                  return 1+png_sRGB_checks[i].is_broken;
 2407|      0|               }
 2408|      0|            }
 2409|       |
 2410|    325|# if PNG_sRGB_PROFILE_CHECKS > 0
 2411|       |         /* The signature matched, but the profile had been changed in some
 2412|       |          * way.  This probably indicates a data error or uninformed hacking.
 2413|       |          * Fall through to "no match".
 2414|       |          */
 2415|    325|         png_chunk_report(png_ptr,
  ------------------
  |  |  120|    325|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 2416|    325|             "Not recognizing known sRGB profile that has been edited",
 2417|    325|             PNG_CHUNK_WARNING);
  ------------------
  |  | 1833|    325|#define PNG_CHUNK_WARNING     0 /* never an error */
  ------------------
 2418|    325|         break;
 2419|    325|# endif
 2420|    325|         }
 2421|  4.92k|      }
 2422|  37.3k|   }
 2423|       |
 2424|  5.37k|   return 0; /* no match */
 2425|  5.37k|}
png.c:png_gt:
 2539|  9.72k|{
 2540|  9.72k|   return a > b;
 2541|  9.72k|}

OSS_FUZZ_png_error:
   41|  8.43k|{
   42|       |#ifdef PNG_ERROR_NUMBERS_SUPPORTED
   43|       |   char msg[16];
   44|       |   if (png_ptr != NULL)
   45|       |   {
   46|       |      if ((png_ptr->flags &
   47|       |         (PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT)) != 0)
   48|       |      {
   49|       |         if (*error_message == PNG_LITERAL_SHARP)
   50|       |         {
   51|       |            /* Strip "#nnnn " from beginning of error message. */
   52|       |            int offset;
   53|       |            for (offset = 1; offset<15; offset++)
   54|       |               if (error_message[offset] == ' ')
   55|       |                  break;
   56|       |
   57|       |            if ((png_ptr->flags & PNG_FLAG_STRIP_ERROR_TEXT) != 0)
   58|       |            {
   59|       |               int i;
   60|       |               for (i = 0; i < offset - 1; i++)
   61|       |                  msg[i] = error_message[i + 1];
   62|       |               msg[i - 1] = '\0';
   63|       |               error_message = msg;
   64|       |            }
   65|       |
   66|       |            else
   67|       |               error_message += offset;
   68|       |         }
   69|       |
   70|       |         else
   71|       |         {
   72|       |            if ((png_ptr->flags & PNG_FLAG_STRIP_ERROR_TEXT) != 0)
   73|       |            {
   74|       |               msg[0] = '0';
   75|       |               msg[1] = '\0';
   76|       |               error_message = msg;
   77|       |            }
   78|       |         }
   79|       |      }
   80|       |   }
   81|       |#endif
   82|  8.43k|   if (png_ptr != NULL && png_ptr->error_fn != NULL)
  ------------------
  |  Branch (82:8): [True: 8.43k, False: 0]
  |  Branch (82:27): [True: 0, False: 8.43k]
  ------------------
   83|      0|      (*(png_ptr->error_fn))(png_constcast(png_structrp,png_ptr),
  ------------------
  |  |  501|      0|#  define png_constcast(type, value) ((type)(void*)(const void*)(value))
  ------------------
   84|      0|          error_message);
   85|       |
   86|       |   /* If the custom handler doesn't exist, or if it returns,
   87|       |      use the default handler, which will not return. */
   88|  8.43k|   png_default_error(png_ptr, error_message);
   89|  8.43k|}
OSS_FUZZ_png_safecat:
  114|   118k|{
  115|   118k|   if (buffer != NULL && pos < bufsize)
  ------------------
  |  Branch (115:8): [True: 118k, False: 0]
  |  Branch (115:26): [True: 118k, False: 0]
  ------------------
  116|   118k|   {
  117|   118k|      if (string != NULL)
  ------------------
  |  Branch (117:11): [True: 118k, False: 0]
  ------------------
  118|  1.19M|         while (*string != '\0' && pos < bufsize-1)
  ------------------
  |  Branch (118:17): [True: 1.07M, False: 118k]
  |  Branch (118:36): [True: 1.07M, False: 4]
  ------------------
  119|  1.07M|           buffer[pos++] = *string++;
  120|       |
  121|   118k|      buffer[pos] = '\0';
  122|   118k|   }
  123|       |
  124|   118k|   return pos;
  125|   118k|}
OSS_FUZZ_png_format_number:
  135|  17.6k|{
  136|  17.6k|   int count = 0;    /* number of digits output */
  137|  17.6k|   int mincount = 1; /* minimum number required */
  138|  17.6k|   int output = 0;   /* digit output (for the fixed point format) */
  139|       |
  140|  17.6k|   *--end = '\0';
  141|       |
  142|       |   /* This is written so that the loop always runs at least once, even with
  143|       |    * number zero.
  144|       |    */
  145|  93.8k|   while (end > start && (number != 0 || count < mincount))
  ------------------
  |  Branch (145:11): [True: 93.8k, False: 0]
  |  Branch (145:27): [True: 69.8k, False: 24.0k]
  |  Branch (145:42): [True: 6.39k, False: 17.6k]
  ------------------
  146|  76.2k|   {
  147|       |
  148|  76.2k|      static const char digits[] = "0123456789ABCDEF";
  149|       |
  150|  76.2k|      switch (format)
  151|  76.2k|      {
  152|      0|         case PNG_NUMBER_FORMAT_fixed:
  ------------------
  |  | 1754|      0|#define PNG_NUMBER_FORMAT_fixed 5 /* choose the signed API */
  ------------------
  |  Branch (152:10): [True: 0, False: 76.2k]
  ------------------
  153|       |            /* Needs five digits (the fraction) */
  154|      0|            mincount = 5;
  155|      0|            if (output != 0 || number % 10 != 0)
  ------------------
  |  Branch (155:17): [True: 0, False: 0]
  |  Branch (155:32): [True: 0, False: 0]
  ------------------
  156|      0|            {
  157|      0|               *--end = digits[number % 10];
  158|      0|               output = 1;
  159|      0|            }
  160|      0|            number /= 10;
  161|      0|            break;
  162|       |
  163|      0|         case PNG_NUMBER_FORMAT_02u:
  ------------------
  |  | 1749|      0|#define PNG_NUMBER_FORMAT_02u   2
  ------------------
  |  Branch (163:10): [True: 0, False: 76.2k]
  ------------------
  164|       |            /* Expects at least 2 digits. */
  165|      0|            mincount = 2;
  166|       |            /* FALLTHROUGH */
  167|       |
  168|      0|         case PNG_NUMBER_FORMAT_u:
  ------------------
  |  | 1748|      0|#define PNG_NUMBER_FORMAT_u     1 /* chose unsigned API! */
  ------------------
  |  Branch (168:10): [True: 0, False: 76.2k]
  ------------------
  169|      0|            *--end = digits[number % 10];
  170|      0|            number /= 10;
  171|      0|            break;
  172|       |
  173|      0|         case PNG_NUMBER_FORMAT_02x:
  ------------------
  |  | 1753|      0|#define PNG_NUMBER_FORMAT_02x   4
  ------------------
  |  Branch (173:10): [True: 0, False: 76.2k]
  ------------------
  174|       |            /* This format expects at least two digits */
  175|      0|            mincount = 2;
  176|       |            /* FALLTHROUGH */
  177|       |
  178|  76.2k|         case PNG_NUMBER_FORMAT_x:
  ------------------
  |  | 1752|  76.2k|#define PNG_NUMBER_FORMAT_x     3
  ------------------
  |  Branch (178:10): [True: 76.2k, False: 0]
  ------------------
  179|  76.2k|            *--end = digits[number & 0xf];
  180|  76.2k|            number >>= 4;
  181|  76.2k|            break;
  182|       |
  183|      0|         default: /* an error */
  ------------------
  |  Branch (183:10): [True: 0, False: 76.2k]
  ------------------
  184|      0|            number = 0;
  185|      0|            break;
  186|  76.2k|      }
  187|       |
  188|       |      /* Keep track of the number of digits added */
  189|  76.2k|      ++count;
  190|       |
  191|       |      /* Float a fixed number here: */
  192|  76.2k|      if ((format == PNG_NUMBER_FORMAT_fixed) && (count == 5) && (end > start))
  ------------------
  |  | 1754|  76.2k|#define PNG_NUMBER_FORMAT_fixed 5 /* choose the signed API */
  ------------------
  |  Branch (192:11): [True: 0, False: 76.2k]
  |  Branch (192:50): [True: 0, False: 0]
  |  Branch (192:66): [True: 0, False: 0]
  ------------------
  193|      0|      {
  194|       |         /* End of the fraction, but maybe nothing was output?  In that case
  195|       |          * drop the decimal point.  If the number is a true zero handle that
  196|       |          * here.
  197|       |          */
  198|      0|         if (output != 0)
  ------------------
  |  Branch (198:14): [True: 0, False: 0]
  ------------------
  199|      0|            *--end = '.';
  200|      0|         else if (number == 0) /* and !output */
  ------------------
  |  Branch (200:19): [True: 0, False: 0]
  ------------------
  201|      0|            *--end = '0';
  202|      0|      }
  203|  76.2k|   }
  204|       |
  205|  17.6k|   return end;
  206|  17.6k|}
OSS_FUZZ_png_warning:
  217|   148k|{
  218|   148k|   int offset = 0;
  219|   148k|   if (png_ptr != NULL)
  ------------------
  |  Branch (219:8): [True: 148k, False: 0]
  ------------------
  220|   148k|   {
  221|       |#ifdef PNG_ERROR_NUMBERS_SUPPORTED
  222|       |   if ((png_ptr->flags &
  223|       |       (PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT)) != 0)
  224|       |#endif
  225|   148k|      {
  226|   148k|         if (*warning_message == PNG_LITERAL_SHARP)
  ------------------
  |  |   39|   148k|#    define PNG_LITERAL_SHARP 0x23
  ------------------
  |  Branch (226:14): [True: 0, False: 148k]
  ------------------
  227|      0|         {
  228|      0|            for (offset = 1; offset < 15; offset++)
  ------------------
  |  Branch (228:30): [True: 0, False: 0]
  ------------------
  229|      0|               if (warning_message[offset] == ' ')
  ------------------
  |  Branch (229:20): [True: 0, False: 0]
  ------------------
  230|      0|                  break;
  231|      0|         }
  232|   148k|      }
  233|   148k|   }
  234|   148k|   if (png_ptr != NULL && png_ptr->warning_fn != NULL)
  ------------------
  |  Branch (234:8): [True: 148k, False: 0]
  |  Branch (234:27): [True: 0, False: 148k]
  ------------------
  235|      0|      (*(png_ptr->warning_fn))(png_constcast(png_structrp,png_ptr),
  ------------------
  |  |  501|      0|#  define png_constcast(type, value) ((type)(void*)(const void*)(value))
  ------------------
  236|      0|          warning_message + offset);
  237|   148k|   else
  238|   148k|      png_default_warning(png_ptr, warning_message + offset);
  239|   148k|}
OSS_FUZZ_png_benign_error:
  363|  4.92k|{
  364|  4.92k|   if ((png_ptr->flags & PNG_FLAG_BENIGN_ERRORS_WARN) != 0)
  ------------------
  |  |  690|  4.92k|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
  |  Branch (364:8): [True: 4.92k, False: 0]
  ------------------
  365|  4.92k|   {
  366|  4.92k|#     ifdef PNG_READ_SUPPORTED
  367|  4.92k|         if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&
  ------------------
  |  |  630|  4.92k|#define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
  ------------------
  |  Branch (367:14): [True: 4.92k, False: 0]
  ------------------
  368|  4.92k|            png_ptr->chunk_name != 0)
  ------------------
  |  Branch (368:13): [True: 4.92k, False: 0]
  ------------------
  369|  4.92k|            png_chunk_warning(png_ptr, error_message);
  ------------------
  |  |  226|  4.92k|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
  370|      0|         else
  371|      0|#     endif
  372|      0|      png_warning(png_ptr, error_message);
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  373|  4.92k|   }
  374|       |
  375|      0|   else
  376|      0|   {
  377|      0|#     ifdef PNG_READ_SUPPORTED
  378|      0|         if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&
  ------------------
  |  |  630|      0|#define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
  ------------------
  |  Branch (378:14): [True: 0, False: 0]
  ------------------
  379|      0|            png_ptr->chunk_name != 0)
  ------------------
  |  Branch (379:13): [True: 0, False: 0]
  ------------------
  380|      0|            png_chunk_error(png_ptr, error_message);
  ------------------
  |  |  225|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  381|      0|         else
  382|      0|#     endif
  383|      0|      png_error(png_ptr, error_message);
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  384|      0|   }
  385|       |
  386|       |#  ifndef PNG_ERROR_TEXT_SUPPORTED
  387|       |      PNG_UNUSED(error_message)
  388|       |#  endif
  389|  4.92k|}
OSS_FUZZ_png_chunk_error:
  482|    148|{
  483|    148|   char msg[18+PNG_MAX_ERROR_TEXT];
  484|    148|   if (png_ptr == NULL)
  ------------------
  |  Branch (484:8): [True: 0, False: 148]
  ------------------
  485|      0|      png_error(png_ptr, error_message);
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  486|       |
  487|    148|   else
  488|    148|   {
  489|    148|      png_format_buffer(png_ptr, msg, error_message);
  490|    148|      png_error(png_ptr, msg);
  ------------------
  |  |  238|    296|#define png_error OSS_FUZZ_png_error
  ------------------
  491|    148|   }
  492|    148|}
OSS_FUZZ_png_chunk_warning:
  498|   143k|{
  499|   143k|   char msg[18+PNG_MAX_ERROR_TEXT];
  500|   143k|   if (png_ptr == NULL)
  ------------------
  |  Branch (500:8): [True: 0, False: 143k]
  ------------------
  501|      0|      png_warning(png_ptr, warning_message);
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  502|       |
  503|   143k|   else
  504|   143k|   {
  505|   143k|      png_format_buffer(png_ptr, msg, warning_message);
  506|   143k|      png_warning(png_ptr, msg);
  ------------------
  |  |  426|   143k|#define png_warning OSS_FUZZ_png_warning
  ------------------
  507|   143k|   }
  508|   143k|}
OSS_FUZZ_png_chunk_benign_error:
  516|  73.6k|{
  517|  73.6k|   if ((png_ptr->flags & PNG_FLAG_BENIGN_ERRORS_WARN) != 0)
  ------------------
  |  |  690|  73.6k|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
  |  Branch (517:8): [True: 73.6k, False: 0]
  ------------------
  518|  73.6k|      png_chunk_warning(png_ptr, error_message);
  ------------------
  |  |  226|  73.6k|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
  519|       |
  520|      0|   else
  521|      0|      png_chunk_error(png_ptr, error_message);
  ------------------
  |  |  225|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  522|       |
  523|       |#  ifndef PNG_ERROR_TEXT_SUPPORTED
  524|       |      PNG_UNUSED(error_message)
  525|       |#  endif
  526|  73.6k|}
OSS_FUZZ_png_chunk_report:
  532|  23.7k|{
  533|       |#  ifndef PNG_WARNINGS_SUPPORTED
  534|       |      PNG_UNUSED(message)
  535|       |#  endif
  536|       |
  537|       |   /* This is always supported, but for just read or just write it
  538|       |    * unconditionally does the right thing.
  539|       |    */
  540|       |#  if defined(PNG_READ_SUPPORTED) && defined(PNG_WRITE_SUPPORTED)
  541|       |      if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0)
  542|       |#  endif
  543|       |
  544|  23.7k|#  ifdef PNG_READ_SUPPORTED
  545|  23.7k|      {
  546|  23.7k|         if (error < PNG_CHUNK_ERROR)
  ------------------
  |  | 1835|  23.7k|#define PNG_CHUNK_ERROR       2 /* always an error */
  ------------------
  |  Branch (546:14): [True: 22.1k, False: 1.58k]
  ------------------
  547|  22.1k|            png_chunk_warning(png_ptr, message);
  ------------------
  |  |  226|  22.1k|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
  548|       |
  549|  1.58k|         else
  550|  1.58k|            png_chunk_benign_error(png_ptr, message);
  ------------------
  |  |  224|  1.58k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
  551|  23.7k|      }
  552|  23.7k|#  endif
  553|       |
  554|       |#  if defined(PNG_READ_SUPPORTED) && defined(PNG_WRITE_SUPPORTED)
  555|       |      else if ((png_ptr->mode & PNG_IS_READ_STRUCT) == 0)
  556|       |#  endif
  557|       |
  558|       |#  ifdef PNG_WRITE_SUPPORTED
  559|       |      {
  560|       |         if (error < PNG_CHUNK_WRITE_ERROR)
  561|       |            png_app_warning(png_ptr, message);
  562|       |
  563|       |         else
  564|       |            png_app_error(png_ptr, message);
  565|       |      }
  566|       |#  endif
  567|  23.7k|}
OSS_FUZZ_png_set_longjmp_fn:
  599|  10.3k|{
  600|       |   /* From libpng 1.6.0 the app gets one chance to set a 'jmpbuf_size' value
  601|       |    * and it must not change after that.  Libpng doesn't care how big the
  602|       |    * buffer is, just that it doesn't change.
  603|       |    *
  604|       |    * If the buffer size is no *larger* than the size of jmp_buf when libpng is
  605|       |    * compiled a built in jmp_buf is returned; this preserves the pre-1.6.0
  606|       |    * semantics that this call will not fail.  If the size is larger, however,
  607|       |    * the buffer is allocated and this may fail, causing the function to return
  608|       |    * NULL.
  609|       |    */
  610|  10.3k|   if (png_ptr == NULL)
  ------------------
  |  Branch (610:8): [True: 0, False: 10.3k]
  ------------------
  611|      0|      return NULL;
  612|       |
  613|  10.3k|   if (png_ptr->jmp_buf_ptr == NULL)
  ------------------
  |  Branch (613:8): [True: 8.50k, False: 1.87k]
  ------------------
  614|  8.50k|   {
  615|  8.50k|      png_ptr->jmp_buf_size = 0; /* not allocated */
  616|       |
  617|  8.50k|      if (jmp_buf_size <= (sizeof png_ptr->jmp_buf_local))
  ------------------
  |  Branch (617:11): [True: 8.50k, False: 0]
  ------------------
  618|  8.50k|         png_ptr->jmp_buf_ptr = &png_ptr->jmp_buf_local;
  619|       |
  620|      0|      else
  621|      0|      {
  622|      0|         png_ptr->jmp_buf_ptr = png_voidcast(jmp_buf *,
  ------------------
  |  |  500|      0|#  define png_voidcast(type, value) (value)
  ------------------
  623|      0|             png_malloc_warn(png_ptr, jmp_buf_size));
  624|       |
  625|      0|         if (png_ptr->jmp_buf_ptr == NULL)
  ------------------
  |  Branch (625:14): [True: 0, False: 0]
  ------------------
  626|      0|            return NULL; /* new NULL return on OOM */
  627|       |
  628|      0|         png_ptr->jmp_buf_size = jmp_buf_size;
  629|      0|      }
  630|  8.50k|   }
  631|       |
  632|  1.87k|   else /* Already allocated: check the size */
  633|  1.87k|   {
  634|  1.87k|      size_t size = png_ptr->jmp_buf_size;
  635|       |
  636|  1.87k|      if (size == 0)
  ------------------
  |  Branch (636:11): [True: 1.87k, False: 0]
  ------------------
  637|  1.87k|      {
  638|  1.87k|         size = (sizeof png_ptr->jmp_buf_local);
  639|  1.87k|         if (png_ptr->jmp_buf_ptr != &png_ptr->jmp_buf_local)
  ------------------
  |  Branch (639:14): [True: 0, False: 1.87k]
  ------------------
  640|      0|         {
  641|       |            /* This is an internal error in libpng: somehow we have been left
  642|       |             * with a stack allocated jmp_buf when the application regained
  643|       |             * control.  It's always possible to fix this up, but for the moment
  644|       |             * this is a png_error because that makes it easy to detect.
  645|       |             */
  646|      0|            png_error(png_ptr, "Libpng jmp_buf still allocated");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  647|       |            /* png_ptr->jmp_buf_ptr = &png_ptr->jmp_buf_local; */
  648|      0|         }
  649|  1.87k|      }
  650|       |
  651|  1.87k|      if (size != jmp_buf_size)
  ------------------
  |  Branch (651:11): [True: 0, False: 1.87k]
  ------------------
  652|      0|      {
  653|      0|         png_warning(png_ptr, "Application jmp_buf size changed");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  654|      0|         return NULL; /* caller will probably crash: no choice here */
  655|      0|      }
  656|  1.87k|   }
  657|       |
  658|       |   /* Finally fill in the function, now we have a satisfactory buffer. It is
  659|       |    * valid to change the function on every call.
  660|       |    */
  661|  10.3k|   png_ptr->longjmp_fn = longjmp_fn;
  662|  10.3k|   return png_ptr->jmp_buf_ptr;
  663|  10.3k|}
OSS_FUZZ_png_free_jmpbuf:
  667|  8.50k|{
  668|  8.50k|   if (png_ptr != NULL)
  ------------------
  |  Branch (668:8): [True: 8.50k, False: 0]
  ------------------
  669|  8.50k|   {
  670|  8.50k|      jmp_buf *jb = png_ptr->jmp_buf_ptr;
  671|       |
  672|       |      /* A size of 0 is used to indicate a local, stack, allocation of the
  673|       |       * pointer; used here and in png.c
  674|       |       */
  675|  8.50k|      if (jb != NULL && png_ptr->jmp_buf_size > 0)
  ------------------
  |  Branch (675:11): [True: 8.50k, False: 0]
  |  Branch (675:25): [True: 0, False: 8.50k]
  ------------------
  676|      0|      {
  677|       |
  678|       |         /* This stuff is so that a failure to free the error control structure
  679|       |          * does not leave libpng in a state with no valid error handling: the
  680|       |          * free always succeeds, if there is an error it gets ignored.
  681|       |          */
  682|      0|         if (jb != &png_ptr->jmp_buf_local)
  ------------------
  |  Branch (682:14): [True: 0, False: 0]
  ------------------
  683|      0|         {
  684|       |            /* Make an internal, libpng, jmp_buf to return here */
  685|      0|            jmp_buf free_jmp_buf;
  686|       |
  687|      0|            if (!setjmp(free_jmp_buf))
  ------------------
  |  Branch (687:17): [True: 0, False: 0]
  ------------------
  688|      0|            {
  689|      0|               png_ptr->jmp_buf_ptr = &free_jmp_buf; /* come back here */
  690|      0|               png_ptr->jmp_buf_size = 0; /* stack allocation */
  691|      0|               png_ptr->longjmp_fn = longjmp;
  692|      0|               png_free(png_ptr, jb); /* Return to setjmp on error */
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  693|      0|            }
  694|      0|         }
  695|      0|      }
  696|       |
  697|       |      /* *Always* cancel everything out: */
  698|  8.50k|      png_ptr->jmp_buf_size = 0;
  699|  8.50k|      png_ptr->jmp_buf_ptr = NULL;
  700|  8.50k|      png_ptr->longjmp_fn = 0;
  701|  8.50k|   }
  702|  8.50k|}
OSS_FUZZ_png_longjmp:
  759|  8.43k|{
  760|  8.43k|#ifdef PNG_SETJMP_SUPPORTED
  761|  8.43k|   if (png_ptr != NULL && png_ptr->longjmp_fn != NULL &&
  ------------------
  |  Branch (761:8): [True: 8.43k, False: 0]
  |  Branch (761:27): [True: 8.43k, False: 0]
  ------------------
  762|  8.43k|       png_ptr->jmp_buf_ptr != NULL)
  ------------------
  |  Branch (762:8): [True: 8.43k, False: 0]
  ------------------
  763|  8.43k|      png_ptr->longjmp_fn(*png_ptr->jmp_buf_ptr, val);
  764|       |#else
  765|       |   PNG_UNUSED(png_ptr)
  766|       |   PNG_UNUSED(val)
  767|       |#endif
  768|       |
  769|       |   /* If control reaches this point, png_longjmp() must not return. The only
  770|       |    * choice is to terminate the whole process (or maybe the thread); to do
  771|       |    * this the ANSI-C abort() function is used unless a different method is
  772|       |    * implemented by overriding the default configuration setting for
  773|       |    * PNG_ABORT().
  774|       |    */
  775|  8.43k|   PNG_ABORT();
  ------------------
  |  |  555|  8.43k|#  define PNG_ABORT() abort()
  ------------------
  776|  8.43k|}
OSS_FUZZ_png_set_error_fn:
  837|  8.50k|{
  838|  8.50k|   if (png_ptr == NULL)
  ------------------
  |  Branch (838:8): [True: 0, False: 8.50k]
  ------------------
  839|      0|      return;
  840|       |
  841|  8.50k|   png_ptr->error_ptr = error_ptr;
  842|  8.50k|   png_ptr->error_fn = error_fn;
  843|  8.50k|#ifdef PNG_WARNINGS_SUPPORTED
  844|  8.50k|   png_ptr->warning_fn = warning_fn;
  845|       |#else
  846|       |   PNG_UNUSED(warning_fn)
  847|       |#endif
  848|  8.50k|}
pngerror.c:png_format_buffer:
  436|   143k|{
  437|   143k|   png_uint_32 chunk_name = png_ptr->chunk_name;
  438|   143k|   int iout = 0, ishift = 24;
  439|       |
  440|   718k|   while (ishift >= 0)
  ------------------
  |  Branch (440:11): [True: 574k, False: 143k]
  ------------------
  441|   574k|   {
  442|   574k|      int c = (int)(chunk_name >> ishift) & 0xff;
  443|       |
  444|   574k|      ishift -= 8;
  445|   574k|      if (isnonalpha(c) != 0)
  ------------------
  |  |  427|   574k|#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))
  |  |  ------------------
  |  |  |  Branch (427:24): [True: 83, False: 574k]
  |  |  |  Branch (427:36): [True: 31, False: 574k]
  |  |  |  Branch (427:50): [True: 234k, False: 339k]
  |  |  |  Branch (427:62): [True: 4, False: 234k]
  |  |  ------------------
  ------------------
  |  Branch (445:11): [True: 118, False: 574k]
  ------------------
  446|    118|      {
  447|    118|         buffer[iout++] = PNG_LITERAL_LEFT_SQUARE_BRACKET;
  ------------------
  |  |   42|    118|#    define PNG_LITERAL_LEFT_SQUARE_BRACKET 0x5b
  ------------------
  448|    118|         buffer[iout++] = png_digit[(c & 0xf0) >> 4];
  449|    118|         buffer[iout++] = png_digit[c & 0x0f];
  450|    118|         buffer[iout++] = PNG_LITERAL_RIGHT_SQUARE_BRACKET;
  ------------------
  |  |   45|    118|#    define PNG_LITERAL_RIGHT_SQUARE_BRACKET 0x5d
  ------------------
  451|    118|      }
  452|       |
  453|   574k|      else
  454|   574k|      {
  455|   574k|         buffer[iout++] = (char)c;
  456|   574k|      }
  457|   574k|   }
  458|       |
  459|   143k|   if (error_message == NULL)
  ------------------
  |  Branch (459:8): [True: 0, False: 143k]
  ------------------
  460|      0|      buffer[iout] = '\0';
  461|       |
  462|   143k|   else
  463|   143k|   {
  464|   143k|      int iin = 0;
  465|       |
  466|   143k|      buffer[iout++] = ':';
  467|   143k|      buffer[iout++] = ' ';
  468|       |
  469|  3.78M|      while (iin < PNG_MAX_ERROR_TEXT-1 && error_message[iin] != '\0')
  ------------------
  |  |  418|  3.78M|#define PNG_MAX_ERROR_TEXT 196 /* Currently limited by profile_error in png.c */
  ------------------
  |  Branch (469:14): [True: 3.78M, False: 0]
  |  Branch (469:44): [True: 3.64M, False: 143k]
  ------------------
  470|  3.64M|         buffer[iout++] = error_message[iin++];
  471|       |
  472|       |      /* iin < PNG_MAX_ERROR_TEXT, so the following is safe: */
  473|   143k|      buffer[iout] = '\0';
  474|   143k|   }
  475|   143k|}
pngerror.c:png_default_error:
  713|  8.43k|{
  714|       |#ifdef PNG_CONSOLE_IO_SUPPORTED
  715|       |#ifdef PNG_ERROR_NUMBERS_SUPPORTED
  716|       |   /* Check on NULL only added in 1.5.4 */
  717|       |   if (error_message != NULL && *error_message == PNG_LITERAL_SHARP)
  718|       |   {
  719|       |      /* Strip "#nnnn " from beginning of error message. */
  720|       |      int offset;
  721|       |      char error_number[16];
  722|       |      for (offset = 0; offset<15; offset++)
  723|       |      {
  724|       |         error_number[offset] = error_message[offset + 1];
  725|       |         if (error_message[offset] == ' ')
  726|       |            break;
  727|       |      }
  728|       |
  729|       |      if ((offset > 1) && (offset < 15))
  730|       |      {
  731|       |         error_number[offset - 1] = '\0';
  732|       |         fprintf(stderr, "libpng error no. %s: %s",
  733|       |             error_number, error_message + offset + 1);
  734|       |         fprintf(stderr, PNG_STRING_NEWLINE);
  735|       |      }
  736|       |
  737|       |      else
  738|       |      {
  739|       |         fprintf(stderr, "libpng error: %s, offset=%d",
  740|       |             error_message, offset);
  741|       |         fprintf(stderr, PNG_STRING_NEWLINE);
  742|       |      }
  743|       |   }
  744|       |   else
  745|       |#endif
  746|       |   {
  747|       |      fprintf(stderr, "libpng error: %s", error_message ? error_message :
  748|       |         "undefined");
  749|       |      fprintf(stderr, PNG_STRING_NEWLINE);
  750|       |   }
  751|       |#else
  752|       |   PNG_UNUSED(error_message) /* Make compiler happy */
  ------------------
  |  |  444|  8.43k|#  define PNG_UNUSED(param) (void)param;
  ------------------
  753|  8.43k|#endif
  754|  8.43k|   png_longjmp(png_ptr, 1);
  ------------------
  |  |  327|  16.8k|#define png_longjmp OSS_FUZZ_png_longjmp
  ------------------
  755|  8.43k|}
pngerror.c:png_default_warning:
  786|   148k|{
  787|       |#ifdef PNG_CONSOLE_IO_SUPPORTED
  788|       |#  ifdef PNG_ERROR_NUMBERS_SUPPORTED
  789|       |   if (*warning_message == PNG_LITERAL_SHARP)
  790|       |   {
  791|       |      int offset;
  792|       |      char warning_number[16];
  793|       |      for (offset = 0; offset < 15; offset++)
  794|       |      {
  795|       |         warning_number[offset] = warning_message[offset + 1];
  796|       |         if (warning_message[offset] == ' ')
  797|       |            break;
  798|       |      }
  799|       |
  800|       |      if ((offset > 1) && (offset < 15))
  801|       |      {
  802|       |         warning_number[offset + 1] = '\0';
  803|       |         fprintf(stderr, "libpng warning no. %s: %s",
  804|       |             warning_number, warning_message + offset);
  805|       |         fprintf(stderr, PNG_STRING_NEWLINE);
  806|       |      }
  807|       |
  808|       |      else
  809|       |      {
  810|       |         fprintf(stderr, "libpng warning: %s",
  811|       |             warning_message);
  812|       |         fprintf(stderr, PNG_STRING_NEWLINE);
  813|       |      }
  814|       |   }
  815|       |   else
  816|       |#  endif
  817|       |
  818|       |   {
  819|       |      fprintf(stderr, "libpng warning: %s", warning_message);
  820|       |      fprintf(stderr, PNG_STRING_NEWLINE);
  821|       |   }
  822|       |#else
  823|       |   PNG_UNUSED(warning_message) /* Make compiler happy */
  ------------------
  |  |  444|   148k|#  define PNG_UNUSED(param) (void)param;
  ------------------
  824|   148k|#endif
  825|       |   PNG_UNUSED(png_ptr) /* Make compiler happy */
  ------------------
  |  |  444|   148k|#  define PNG_UNUSED(param) (void)param;
  ------------------
  826|   148k|}

OSS_FUZZ_png_get_rowbytes:
   31|  1.81k|{
   32|  1.81k|   if (png_ptr != NULL && info_ptr != NULL)
  ------------------
  |  Branch (32:8): [True: 1.81k, False: 0]
  |  Branch (32:27): [True: 1.81k, False: 0]
  ------------------
   33|  1.81k|      return(info_ptr->rowbytes);
   34|       |
   35|      0|   return(0);
   36|  1.81k|}
OSS_FUZZ_png_get_IHDR:
  829|  1.87k|{
  830|  1.87k|   png_debug1(1, "in %s retrieval function", "IHDR");
  ------------------
  |  |  148|  1.87k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  831|       |
  832|  1.87k|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (832:8): [True: 0, False: 1.87k]
  |  Branch (832:27): [True: 0, False: 1.87k]
  ------------------
  833|      0|      return (0);
  834|       |
  835|  1.87k|   if (width != NULL)
  ------------------
  |  Branch (835:8): [True: 1.87k, False: 0]
  ------------------
  836|  1.87k|       *width = info_ptr->width;
  837|       |
  838|  1.87k|   if (height != NULL)
  ------------------
  |  Branch (838:8): [True: 1.87k, False: 0]
  ------------------
  839|  1.87k|       *height = info_ptr->height;
  840|       |
  841|  1.87k|   if (bit_depth != NULL)
  ------------------
  |  Branch (841:8): [True: 1.87k, False: 0]
  ------------------
  842|  1.87k|       *bit_depth = info_ptr->bit_depth;
  843|       |
  844|  1.87k|   if (color_type != NULL)
  ------------------
  |  Branch (844:8): [True: 1.87k, False: 0]
  ------------------
  845|  1.87k|       *color_type = info_ptr->color_type;
  846|       |
  847|  1.87k|   if (compression_type != NULL)
  ------------------
  |  Branch (847:8): [True: 1.87k, False: 0]
  ------------------
  848|  1.87k|      *compression_type = info_ptr->compression_type;
  849|       |
  850|  1.87k|   if (filter_type != NULL)
  ------------------
  |  Branch (850:8): [True: 1.87k, False: 0]
  ------------------
  851|  1.87k|      *filter_type = info_ptr->filter_type;
  852|       |
  853|  1.87k|   if (interlace_type != NULL)
  ------------------
  |  Branch (853:8): [True: 1.87k, False: 0]
  ------------------
  854|  1.87k|      *interlace_type = info_ptr->interlace_type;
  855|       |
  856|       |   /* This is redundant if we can be sure that the info_ptr values were all
  857|       |    * assigned in png_set_IHDR().  We do the check anyhow in case an
  858|       |    * application has ignored our advice not to mess with the members
  859|       |    * of info_ptr directly.
  860|       |    */
  861|  1.87k|   png_check_IHDR(png_ptr, info_ptr->width, info_ptr->height,
  ------------------
  |  |  109|  1.87k|#define png_check_IHDR OSS_FUZZ_png_check_IHDR
  ------------------
  862|  1.87k|       info_ptr->bit_depth, info_ptr->color_type, info_ptr->interlace_type,
  863|  1.87k|       info_ptr->compression_type, info_ptr->filter_type);
  864|       |
  865|  1.87k|   return (1);
  866|  1.87k|}

OSS_FUZZ_png_destroy_png_struct:
   26|  8.50k|{
   27|  8.50k|   if (png_ptr != NULL)
  ------------------
  |  Branch (27:8): [True: 8.50k, False: 0]
  ------------------
   28|  8.50k|   {
   29|       |      /* png_free might call png_error and may certainly call
   30|       |       * png_get_mem_ptr, so fake a temporary png_struct to support this.
   31|       |       */
   32|  8.50k|      png_struct dummy_struct = *png_ptr;
   33|  8.50k|      memset(png_ptr, 0, (sizeof *png_ptr));
   34|  8.50k|      png_free(&dummy_struct, png_ptr);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
   35|       |
   36|  8.50k|#     ifdef PNG_SETJMP_SUPPORTED
   37|       |         /* We may have a jmp_buf left to deallocate. */
   38|  8.50k|         png_free_jmpbuf(&dummy_struct);
  ------------------
  |  |   12|  8.50k|#define png_free_jmpbuf OSS_FUZZ_png_free_jmpbuf
  ------------------
   39|  8.50k|#     endif
   40|  8.50k|   }
   41|  8.50k|}
OSS_FUZZ_png_calloc:
   51|  1.19k|{
   52|  1.19k|   png_voidp ret;
   53|       |
   54|  1.19k|   ret = png_malloc(png_ptr, size);
  ------------------
  |  |  328|  1.19k|#define png_malloc OSS_FUZZ_png_malloc
  ------------------
   55|       |
   56|  1.19k|   if (ret != NULL)
  ------------------
  |  Branch (56:8): [True: 1.19k, False: 1]
  ------------------
   57|  1.19k|      memset(ret, 0, size);
   58|       |
   59|  1.19k|   return ret;
   60|  1.19k|}
OSS_FUZZ_png_malloc_base:
   70|   125k|{
   71|       |   /* Moved to png_malloc_base from png_malloc_default in 1.6.0; the DOS
   72|       |    * allocators have also been removed in 1.6.0, so any 16-bit system now has
   73|       |    * to implement a user memory handler.  This checks to be sure it isn't
   74|       |    * called with big numbers.
   75|       |    */
   76|       |#ifndef PNG_USER_MEM_SUPPORTED
   77|       |   PNG_UNUSED(png_ptr)
   78|       |#endif
   79|       |
   80|       |   /* Some compilers complain that this is always true.  However, it
   81|       |    * can be false when integer overflow happens.
   82|       |    */
   83|   125k|   if (size > 0 && size <= PNG_SIZE_MAX
  ------------------
  |  |  651|   125k|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
  |  Branch (83:8): [True: 125k, False: 491]
  |  Branch (83:20): [True: 125k, False: 0]
  ------------------
   84|       |#     ifdef PNG_MAX_MALLOC_64K
   85|       |         && size <= 65536U
   86|       |#     endif
   87|   125k|      )
   88|   125k|   {
   89|   125k|#ifdef PNG_USER_MEM_SUPPORTED
   90|   125k|      if (png_ptr != NULL && png_ptr->malloc_fn != NULL)
  ------------------
  |  Branch (90:11): [True: 125k, False: 0]
  |  Branch (90:30): [True: 99.6k, False: 25.5k]
  ------------------
   91|  99.6k|         return png_ptr->malloc_fn(png_constcast(png_structrp,png_ptr), size);
  ------------------
  |  |  501|  99.6k|#  define png_constcast(type, value) ((type)(void*)(const void*)(value))
  ------------------
   92|       |
   93|  25.5k|      else
   94|  25.5k|#endif
   95|  25.5k|         return malloc((size_t)size); /* checked for truncation above */
   96|   125k|   }
   97|       |
   98|    491|   else
   99|    491|      return NULL;
  100|   125k|}
OSS_FUZZ_png_malloc_array:
  124|  2.78k|{
  125|  2.78k|   if (nelements <= 0 || element_size == 0)
  ------------------
  |  Branch (125:8): [True: 0, False: 2.78k]
  |  Branch (125:26): [True: 0, False: 2.78k]
  ------------------
  126|      0|      png_error(png_ptr, "internal error: array alloc");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  127|       |
  128|  2.78k|   return png_malloc_array_checked(png_ptr, nelements, element_size);
  129|  2.78k|}
OSS_FUZZ_png_realloc_array:
  134|  3.63k|{
  135|       |   /* These are internal errors: */
  136|  3.63k|   if (add_elements <= 0 || element_size == 0 || old_elements < 0 ||
  ------------------
  |  Branch (136:8): [True: 0, False: 3.63k]
  |  Branch (136:29): [True: 0, False: 3.63k]
  |  Branch (136:50): [True: 0, False: 3.63k]
  ------------------
  137|  3.63k|      (old_array == NULL && old_elements > 0))
  ------------------
  |  Branch (137:8): [True: 475, False: 3.15k]
  |  Branch (137:29): [True: 0, False: 475]
  ------------------
  138|      0|      png_error(png_ptr, "internal error: array realloc");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  139|       |
  140|       |   /* Check for overflow on the elements count (so the caller does not have to
  141|       |    * check.)
  142|       |    */
  143|  3.63k|   if (add_elements <= INT_MAX - old_elements)
  ------------------
  |  Branch (143:8): [True: 3.63k, False: 0]
  ------------------
  144|  3.63k|   {
  145|  3.63k|      png_voidp new_array = png_malloc_array_checked(png_ptr,
  146|  3.63k|          old_elements+add_elements, element_size);
  147|       |
  148|  3.63k|      if (new_array != NULL)
  ------------------
  |  Branch (148:11): [True: 3.63k, False: 0]
  ------------------
  149|  3.63k|      {
  150|       |         /* Because png_malloc_array worked the size calculations below cannot
  151|       |          * overflow.
  152|       |          */
  153|  3.63k|         if (old_elements > 0)
  ------------------
  |  Branch (153:14): [True: 3.15k, False: 475]
  ------------------
  154|  3.15k|            memcpy(new_array, old_array, element_size*(unsigned)old_elements);
  155|       |
  156|  3.63k|         memset((char*)new_array + element_size*(unsigned)old_elements, 0,
  157|  3.63k|             element_size*(unsigned)add_elements);
  158|       |
  159|  3.63k|         return new_array;
  160|  3.63k|      }
  161|  3.63k|   }
  162|       |
  163|      0|   return NULL; /* error */
  164|  3.63k|}
OSS_FUZZ_png_malloc:
  173|  6.28k|{
  174|  6.28k|   png_voidp ret;
  175|       |
  176|  6.28k|   if (png_ptr == NULL)
  ------------------
  |  Branch (176:8): [True: 0, False: 6.28k]
  ------------------
  177|      0|      return NULL;
  178|       |
  179|  6.28k|   ret = png_malloc_base(png_ptr, size);
  ------------------
  |  |    7|  6.28k|#define png_malloc_base OSS_FUZZ_png_malloc_base
  ------------------
  180|       |
  181|  6.28k|   if (ret == NULL)
  ------------------
  |  Branch (181:8): [True: 7, False: 6.27k]
  ------------------
  182|      7|       png_error(png_ptr, "Out of memory"); /* 'm' means png_malloc */
  ------------------
  |  |  238|      7|#define png_error OSS_FUZZ_png_error
  ------------------
  183|       |
  184|  6.27k|   return ret;
  185|  6.28k|}
OSS_FUZZ_png_malloc_warn:
  214|  26.6k|{
  215|  26.6k|   if (png_ptr != NULL)
  ------------------
  |  Branch (215:8): [True: 26.6k, False: 0]
  ------------------
  216|  26.6k|   {
  217|  26.6k|      png_voidp ret = png_malloc_base(png_ptr, size);
  ------------------
  |  |    7|  26.6k|#define png_malloc_base OSS_FUZZ_png_malloc_base
  ------------------
  218|       |
  219|  26.6k|      if (ret != NULL)
  ------------------
  |  Branch (219:11): [True: 26.3k, False: 247]
  ------------------
  220|  26.3k|         return ret;
  221|       |
  222|    247|      png_warning(png_ptr, "Out of memory");
  ------------------
  |  |  426|    247|#define png_warning OSS_FUZZ_png_warning
  ------------------
  223|    247|   }
  224|       |
  225|    247|   return NULL;
  226|  26.6k|}
OSS_FUZZ_png_free:
  233|   183k|{
  234|   183k|   if (png_ptr == NULL || ptr == NULL)
  ------------------
  |  Branch (234:8): [True: 0, False: 183k]
  |  Branch (234:27): [True: 98.8k, False: 84.5k]
  ------------------
  235|  98.8k|      return;
  236|       |
  237|  84.5k|#ifdef PNG_USER_MEM_SUPPORTED
  238|  84.5k|   if (png_ptr->free_fn != NULL)
  ------------------
  |  Branch (238:8): [True: 84.5k, False: 0]
  ------------------
  239|  84.5k|      png_ptr->free_fn(png_constcast(png_structrp,png_ptr), ptr);
  ------------------
  |  |  501|  84.5k|#  define png_constcast(type, value) ((type)(void*)(const void*)(value))
  ------------------
  240|       |
  241|      0|   else
  242|      0|      png_free_default(png_ptr, ptr);
  ------------------
  |  |  241|      0|#define png_free_default OSS_FUZZ_png_free_default
  ------------------
  243|  84.5k|}
OSS_FUZZ_png_set_mem_fn:
  262|  17.0k|{
  263|  17.0k|   if (png_ptr != NULL)
  ------------------
  |  Branch (263:8): [True: 17.0k, False: 0]
  ------------------
  264|  17.0k|   {
  265|  17.0k|      png_ptr->mem_ptr = mem_ptr;
  266|  17.0k|      png_ptr->malloc_fn = malloc_fn;
  267|  17.0k|      png_ptr->free_fn = free_fn;
  268|  17.0k|   }
  269|  17.0k|}
pngmem.c:png_malloc_array_checked:
  111|  6.41k|{
  112|  6.41k|   png_alloc_size_t req = (png_alloc_size_t)nelements; /* known to be > 0 */
  113|       |
  114|  6.41k|   if (req <= PNG_SIZE_MAX/element_size)
  ------------------
  |  |  651|  6.41k|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
  |  Branch (114:8): [True: 6.41k, False: 0]
  ------------------
  115|  6.41k|      return png_malloc_base(png_ptr, req * element_size);
  ------------------
  |  |    7|  6.41k|#define png_malloc_base OSS_FUZZ_png_malloc_base
  ------------------
  116|       |
  117|       |   /* The failure case when the request is too large */
  118|      0|   return NULL;
  119|  6.41k|}

OSS_FUZZ_png_create_read_struct:
   28|  8.50k|{
   29|       |#ifndef PNG_USER_MEM_SUPPORTED
   30|       |   png_structp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
   31|       |        error_fn, warn_fn, NULL, NULL, NULL);
   32|       |#else
   33|  8.50k|   return png_create_read_struct_2(user_png_ver, error_ptr, error_fn,
  ------------------
  |  |  231|  8.50k|#define png_create_read_struct_2 OSS_FUZZ_png_create_read_struct_2
  ------------------
   34|  8.50k|        warn_fn, NULL, NULL, NULL);
   35|  8.50k|}
OSS_FUZZ_png_create_read_struct_2:
   44|  8.50k|{
   45|  8.50k|   png_structp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
  ------------------
  |  |   10|  8.50k|#define png_create_png_struct OSS_FUZZ_png_create_png_struct
  ------------------
   46|  8.50k|       error_fn, warn_fn, mem_ptr, malloc_fn, free_fn);
   47|  8.50k|#endif /* USER_MEM */
   48|       |
   49|  8.50k|   if (png_ptr != NULL)
  ------------------
  |  Branch (49:8): [True: 8.50k, False: 0]
  ------------------
   50|  8.50k|   {
   51|  8.50k|      png_ptr->mode = PNG_IS_READ_STRUCT;
  ------------------
  |  |  630|  8.50k|#define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
  ------------------
   52|       |
   53|       |      /* Added in libpng-1.6.0; this can be used to detect a read structure if
   54|       |       * required (it will be zero in a write structure.)
   55|       |       */
   56|  8.50k|#     ifdef PNG_SEQUENTIAL_READ_SUPPORTED
   57|  8.50k|         png_ptr->IDAT_read_size = PNG_IDAT_READ_SIZE;
  ------------------
  |  |  195|  8.50k|#define PNG_IDAT_READ_SIZE PNG_ZBUF_SIZE
  |  |  ------------------
  |  |  |  |  212|  8.50k|#define PNG_ZBUF_SIZE 8192
  |  |  ------------------
  ------------------
   58|  8.50k|#     endif
   59|       |
   60|  8.50k|#     ifdef PNG_BENIGN_READ_ERRORS_SUPPORTED
   61|  8.50k|         png_ptr->flags |= PNG_FLAG_BENIGN_ERRORS_WARN;
  ------------------
  |  |  690|  8.50k|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
   62|       |
   63|       |         /* In stable builds only warn if an application error can be completely
   64|       |          * handled.
   65|       |          */
   66|       |#        if PNG_RELEASE_BUILD
   67|       |            png_ptr->flags |= PNG_FLAG_APP_WARNINGS_WARN;
   68|       |#        endif
   69|  8.50k|#     endif
   70|       |
   71|       |      /* TODO: delay this, it can be done in png_init_io (if the app doesn't
   72|       |       * do it itself) avoiding setting the default function if it is not
   73|       |       * required.
   74|       |       */
   75|  8.50k|      png_set_read_fn(png_ptr, NULL, NULL);
  ------------------
  |  |  393|  8.50k|#define png_set_read_fn OSS_FUZZ_png_set_read_fn
  ------------------
   76|  8.50k|   }
   77|       |
   78|  8.50k|   return png_ptr;
   79|  8.50k|}
OSS_FUZZ_png_read_info:
   93|  8.50k|{
   94|  8.50k|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
   95|  8.50k|   int keep;
   96|  8.50k|#endif
   97|       |
   98|  8.50k|   png_debug(1, "in png_read_info");
  ------------------
  |  |  145|  8.50k|#  define png_debug(l, m) ((void)0)
  ------------------
   99|       |
  100|  8.50k|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (100:8): [True: 0, False: 8.50k]
  |  Branch (100:27): [True: 0, False: 8.50k]
  ------------------
  101|      0|      return;
  102|       |
  103|       |   /* Read and check the PNG file signature. */
  104|  8.50k|   png_read_sig(png_ptr, info_ptr);
  ------------------
  |  |   20|  8.50k|#define png_read_sig OSS_FUZZ_png_read_sig
  ------------------
  105|       |
  106|  8.50k|   for (;;)
  107|   103k|   {
  108|   103k|      png_uint_32 length = png_read_chunk_header(png_ptr);
  ------------------
  |  |   21|   103k|#define png_read_chunk_header OSS_FUZZ_png_read_chunk_header
  ------------------
  109|   103k|      png_uint_32 chunk_name = png_ptr->chunk_name;
  110|       |
  111|       |      /* IDAT logic needs to happen here to simplify getting the two flags
  112|       |       * right.
  113|       |       */
  114|   103k|      if (chunk_name == png_IDAT)
  ------------------
  |  |  839|   103k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|   103k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   103k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   103k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   103k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   103k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (114:11): [True: 1.88k, False: 101k]
  ------------------
  115|  1.88k|      {
  116|  1.88k|         if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  1.88k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (116:14): [True: 3, False: 1.88k]
  ------------------
  117|      3|            png_chunk_error(png_ptr, "Missing IHDR before IDAT");
  ------------------
  |  |  225|      3|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  118|       |
  119|  1.88k|         else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  ------------------
  |  |  669|  3.76k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  1.88k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  1.88k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (119:19): [True: 180, False: 1.70k]
  ------------------
  120|  1.88k|             (png_ptr->mode & PNG_HAVE_PLTE) == 0)
  ------------------
  |  |  645|    180|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (120:14): [True: 7, False: 173]
  ------------------
  121|      7|            png_chunk_error(png_ptr, "Missing PLTE before IDAT");
  ------------------
  |  |  225|      7|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  122|       |
  123|  1.87k|         else if ((png_ptr->mode & PNG_AFTER_IDAT) != 0)
  ------------------
  |  |  646|  1.87k|#define PNG_AFTER_IDAT 0x08
  ------------------
  |  Branch (123:19): [True: 0, False: 1.87k]
  ------------------
  124|      0|            png_chunk_benign_error(png_ptr, "Too many IDATs found");
  ------------------
  |  |  224|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
  125|       |
  126|  1.87k|         png_ptr->mode |= PNG_HAVE_IDAT;
  ------------------
  |  |  617|  1.87k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  127|  1.87k|      }
  128|       |
  129|   101k|      else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|   101k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (129:16): [True: 0, False: 101k]
  ------------------
  130|      0|      {
  131|      0|         png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
  ------------------
  |  |  628|      0|#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
  ------------------
  132|      0|         png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  646|      0|#define PNG_AFTER_IDAT 0x08
  ------------------
  133|      0|      }
  134|       |
  135|       |      /* This should be a binary subdivision search or a hash for
  136|       |       * matching the chunk name rather than a linear search.
  137|       |       */
  138|   103k|      if (chunk_name == png_IHDR)
  ------------------
  |  |  841|   103k|#define png_IHDR PNG_U32( 73,  72,  68,  82)
  |  |  ------------------
  |  |  |  |  814|   103k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   103k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   103k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   103k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   103k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (138:11): [True: 7.95k, False: 95.4k]
  ------------------
  139|  7.95k|         png_handle_IHDR(png_ptr, info_ptr, length);
  ------------------
  |  |   49|  7.95k|#define png_handle_IHDR OSS_FUZZ_png_handle_IHDR
  ------------------
  140|       |
  141|  95.4k|      else if (chunk_name == png_IEND)
  ------------------
  |  |  840|  95.4k|#define png_IEND PNG_U32( 73,  69,  78,  68)
  |  |  ------------------
  |  |  |  |  814|  95.4k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  95.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  95.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  95.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  95.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (141:16): [True: 2, False: 95.4k]
  ------------------
  142|      2|         png_handle_IEND(png_ptr, info_ptr, length);
  ------------------
  |  |   51|      2|#define png_handle_IEND OSS_FUZZ_png_handle_IEND
  ------------------
  143|       |
  144|  95.4k|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  145|  95.4k|      else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0)
  ------------------
  |  |   73|  95.4k|#define png_chunk_unknown_handling OSS_FUZZ_png_chunk_unknown_handling
  ------------------
  |  Branch (145:16): [True: 0, False: 95.4k]
  ------------------
  146|      0|      {
  147|      0|         png_handle_unknown(png_ptr, info_ptr, length, keep);
  ------------------
  |  |   72|      0|#define png_handle_unknown OSS_FUZZ_png_handle_unknown
  ------------------
  148|       |
  149|      0|         if (chunk_name == png_PLTE)
  ------------------
  |  |  842|      0|#define png_PLTE PNG_U32( 80,  76,  84,  69)
  |  |  ------------------
  |  |  |  |  814|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (149:14): [True: 0, False: 0]
  ------------------
  150|      0|            png_ptr->mode |= PNG_HAVE_PLTE;
  ------------------
  |  |  645|      0|#define PNG_HAVE_PLTE  0x02
  ------------------
  151|       |
  152|      0|         else if (chunk_name == png_IDAT)
  ------------------
  |  |  839|      0|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (152:19): [True: 0, False: 0]
  ------------------
  153|      0|         {
  154|      0|            png_ptr->idat_size = 0; /* It has been consumed */
  155|      0|            break;
  156|      0|         }
  157|      0|      }
  158|  95.4k|#endif
  159|  95.4k|      else if (chunk_name == png_PLTE)
  ------------------
  |  |  842|  95.4k|#define png_PLTE PNG_U32( 80,  76,  84,  69)
  |  |  ------------------
  |  |  |  |  814|  95.4k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  95.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  95.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  95.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  95.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (159:16): [True: 491, False: 94.9k]
  ------------------
  160|    491|         png_handle_PLTE(png_ptr, info_ptr, length);
  ------------------
  |  |   50|    491|#define png_handle_PLTE OSS_FUZZ_png_handle_PLTE
  ------------------
  161|       |
  162|  94.9k|      else if (chunk_name == png_IDAT)
  ------------------
  |  |  839|  94.9k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|  94.9k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  94.9k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  94.9k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  94.9k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  94.9k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (162:16): [True: 1.87k, False: 93.1k]
  ------------------
  163|  1.87k|      {
  164|  1.87k|         png_ptr->idat_size = length;
  165|  1.87k|         break;
  166|  1.87k|      }
  167|       |
  168|  93.1k|#ifdef PNG_READ_bKGD_SUPPORTED
  169|  93.1k|      else if (chunk_name == png_bKGD)
  ------------------
  |  |  843|  93.1k|#define png_bKGD PNG_U32( 98,  75,  71,  68)
  |  |  ------------------
  |  |  |  |  814|  93.1k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  93.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  93.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  93.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  93.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (169:16): [True: 2.30k, False: 90.8k]
  ------------------
  170|  2.30k|         png_handle_bKGD(png_ptr, info_ptr, length);
  ------------------
  |  |   52|  2.30k|#define png_handle_bKGD OSS_FUZZ_png_handle_bKGD
  ------------------
  171|  90.8k|#endif
  172|       |
  173|  90.8k|#ifdef PNG_READ_cHRM_SUPPORTED
  174|  90.8k|      else if (chunk_name == png_cHRM)
  ------------------
  |  |  844|  90.8k|#define png_cHRM PNG_U32( 99,  72,  82,  77)
  |  |  ------------------
  |  |  |  |  814|  90.8k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  90.8k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  90.8k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  90.8k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  90.8k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (174:16): [True: 3.52k, False: 87.2k]
  ------------------
  175|  3.52k|         png_handle_cHRM(png_ptr, info_ptr, length);
  ------------------
  |  |   53|  3.52k|#define png_handle_cHRM OSS_FUZZ_png_handle_cHRM
  ------------------
  176|  87.2k|#endif
  177|       |
  178|  87.2k|#ifdef PNG_READ_eXIf_SUPPORTED
  179|  87.2k|      else if (chunk_name == png_eXIf)
  ------------------
  |  |  845|  87.2k|#define png_eXIf PNG_U32(101,  88,  73, 102) /* registered July 2017 */
  |  |  ------------------
  |  |  |  |  814|  87.2k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  87.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  87.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  87.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  87.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (179:16): [True: 1.50k, False: 85.7k]
  ------------------
  180|  1.50k|         png_handle_eXIf(png_ptr, info_ptr, length);
  ------------------
  |  |   54|  1.50k|#define png_handle_eXIf OSS_FUZZ_png_handle_eXIf
  ------------------
  181|  85.7k|#endif
  182|       |
  183|  85.7k|#ifdef PNG_READ_gAMA_SUPPORTED
  184|  85.7k|      else if (chunk_name == png_gAMA)
  ------------------
  |  |  847|  85.7k|#define png_gAMA PNG_U32(103,  65,  77,  65)
  |  |  ------------------
  |  |  |  |  814|  85.7k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  85.7k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  85.7k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  85.7k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  85.7k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (184:16): [True: 2.55k, False: 83.2k]
  ------------------
  185|  2.55k|         png_handle_gAMA(png_ptr, info_ptr, length);
  ------------------
  |  |   55|  2.55k|#define png_handle_gAMA OSS_FUZZ_png_handle_gAMA
  ------------------
  186|  83.2k|#endif
  187|       |
  188|  83.2k|#ifdef PNG_READ_hIST_SUPPORTED
  189|  83.2k|      else if (chunk_name == png_hIST)
  ------------------
  |  |  851|  83.2k|#define png_hIST PNG_U32(104,  73,  83,  84)
  |  |  ------------------
  |  |  |  |  814|  83.2k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  83.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  83.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  83.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  83.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (189:16): [True: 1.21k, False: 82.0k]
  ------------------
  190|  1.21k|         png_handle_hIST(png_ptr, info_ptr, length);
  ------------------
  |  |   56|  1.21k|#define png_handle_hIST OSS_FUZZ_png_handle_hIST
  ------------------
  191|  82.0k|#endif
  192|       |
  193|  82.0k|#ifdef PNG_READ_oFFs_SUPPORTED
  194|  82.0k|      else if (chunk_name == png_oFFs)
  ------------------
  |  |  854|  82.0k|#define png_oFFs PNG_U32(111,  70,  70, 115)
  |  |  ------------------
  |  |  |  |  814|  82.0k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  82.0k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  82.0k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  82.0k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  82.0k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (194:16): [True: 434, False: 81.5k]
  ------------------
  195|    434|         png_handle_oFFs(png_ptr, info_ptr, length);
  ------------------
  |  |   59|    434|#define png_handle_oFFs OSS_FUZZ_png_handle_oFFs
  ------------------
  196|  81.5k|#endif
  197|       |
  198|  81.5k|#ifdef PNG_READ_pCAL_SUPPORTED
  199|  81.5k|      else if (chunk_name == png_pCAL)
  ------------------
  |  |  855|  81.5k|#define png_pCAL PNG_U32(112,  67,  65,  76)
  |  |  ------------------
  |  |  |  |  814|  81.5k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  81.5k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  81.5k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  81.5k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  81.5k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (199:16): [True: 4.40k, False: 77.1k]
  ------------------
  200|  4.40k|         png_handle_pCAL(png_ptr, info_ptr, length);
  ------------------
  |  |   60|  4.40k|#define png_handle_pCAL OSS_FUZZ_png_handle_pCAL
  ------------------
  201|  77.1k|#endif
  202|       |
  203|  77.1k|#ifdef PNG_READ_sCAL_SUPPORTED
  204|  77.1k|      else if (chunk_name == png_sCAL)
  ------------------
  |  |  858|  77.1k|#define png_sCAL PNG_U32(115,  67,  65,  76)
  |  |  ------------------
  |  |  |  |  814|  77.1k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  77.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  77.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  77.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  77.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (204:16): [True: 4.94k, False: 72.2k]
  ------------------
  205|  4.94k|         png_handle_sCAL(png_ptr, info_ptr, length);
  ------------------
  |  |   63|  4.94k|#define png_handle_sCAL OSS_FUZZ_png_handle_sCAL
  ------------------
  206|  72.2k|#endif
  207|       |
  208|  72.2k|#ifdef PNG_READ_pHYs_SUPPORTED
  209|  72.2k|      else if (chunk_name == png_pHYs)
  ------------------
  |  |  856|  72.2k|#define png_pHYs PNG_U32(112,  72,  89, 115)
  |  |  ------------------
  |  |  |  |  814|  72.2k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  72.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  72.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  72.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  72.2k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (209:16): [True: 432, False: 71.7k]
  ------------------
  210|    432|         png_handle_pHYs(png_ptr, info_ptr, length);
  ------------------
  |  |   61|    432|#define png_handle_pHYs OSS_FUZZ_png_handle_pHYs
  ------------------
  211|  71.7k|#endif
  212|       |
  213|  71.7k|#ifdef PNG_READ_sBIT_SUPPORTED
  214|  71.7k|      else if (chunk_name == png_sBIT)
  ------------------
  |  |  857|  71.7k|#define png_sBIT PNG_U32(115,  66,  73,  84)
  |  |  ------------------
  |  |  |  |  814|  71.7k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  71.7k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  71.7k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  71.7k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  71.7k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (214:16): [True: 1.47k, False: 70.3k]
  ------------------
  215|  1.47k|         png_handle_sBIT(png_ptr, info_ptr, length);
  ------------------
  |  |   62|  1.47k|#define png_handle_sBIT OSS_FUZZ_png_handle_sBIT
  ------------------
  216|  70.3k|#endif
  217|       |
  218|  70.3k|#ifdef PNG_READ_sRGB_SUPPORTED
  219|  70.3k|      else if (chunk_name == png_sRGB)
  ------------------
  |  |  860|  70.3k|#define png_sRGB PNG_U32(115,  82,  71,  66)
  |  |  ------------------
  |  |  |  |  814|  70.3k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  70.3k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  70.3k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  70.3k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  70.3k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (219:16): [True: 876, False: 69.4k]
  ------------------
  220|    876|         png_handle_sRGB(png_ptr, info_ptr, length);
  ------------------
  |  |   65|    876|#define png_handle_sRGB OSS_FUZZ_png_handle_sRGB
  ------------------
  221|  69.4k|#endif
  222|       |
  223|  69.4k|#ifdef PNG_READ_iCCP_SUPPORTED
  224|  69.4k|      else if (chunk_name == png_iCCP)
  ------------------
  |  |  852|  69.4k|#define png_iCCP PNG_U32(105,  67,  67,  80)
  |  |  ------------------
  |  |  |  |  814|  69.4k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  69.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  69.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  69.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  69.4k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (224:16): [True: 7.44k, False: 61.9k]
  ------------------
  225|  7.44k|         png_handle_iCCP(png_ptr, info_ptr, length);
  ------------------
  |  |   57|  7.44k|#define png_handle_iCCP OSS_FUZZ_png_handle_iCCP
  ------------------
  226|  61.9k|#endif
  227|       |
  228|  61.9k|#ifdef PNG_READ_sPLT_SUPPORTED
  229|  61.9k|      else if (chunk_name == png_sPLT)
  ------------------
  |  |  859|  61.9k|#define png_sPLT PNG_U32(115,  80,  76,  84)
  |  |  ------------------
  |  |  |  |  814|  61.9k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  61.9k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  61.9k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  61.9k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  61.9k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (229:16): [True: 4.60k, False: 57.3k]
  ------------------
  230|  4.60k|         png_handle_sPLT(png_ptr, info_ptr, length);
  ------------------
  |  |   64|  4.60k|#define png_handle_sPLT OSS_FUZZ_png_handle_sPLT
  ------------------
  231|  57.3k|#endif
  232|       |
  233|  57.3k|#ifdef PNG_READ_tEXt_SUPPORTED
  234|  57.3k|      else if (chunk_name == png_tEXt)
  ------------------
  |  |  862|  57.3k|#define png_tEXt PNG_U32(116,  69,  88, 116)
  |  |  ------------------
  |  |  |  |  814|  57.3k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  57.3k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  57.3k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  57.3k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  57.3k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (234:16): [True: 41.7k, False: 15.5k]
  ------------------
  235|  41.7k|         png_handle_tEXt(png_ptr, info_ptr, length);
  ------------------
  |  |   66|  41.7k|#define png_handle_tEXt OSS_FUZZ_png_handle_tEXt
  ------------------
  236|  15.5k|#endif
  237|       |
  238|  15.5k|#ifdef PNG_READ_tIME_SUPPORTED
  239|  15.5k|      else if (chunk_name == png_tIME)
  ------------------
  |  |  863|  15.5k|#define png_tIME PNG_U32(116,  73,  77,  69)
  |  |  ------------------
  |  |  |  |  814|  15.5k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  15.5k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  15.5k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  15.5k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  15.5k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (239:16): [True: 1.94k, False: 13.6k]
  ------------------
  240|  1.94k|         png_handle_tIME(png_ptr, info_ptr, length);
  ------------------
  |  |   67|  1.94k|#define png_handle_tIME OSS_FUZZ_png_handle_tIME
  ------------------
  241|  13.6k|#endif
  242|       |
  243|  13.6k|#ifdef PNG_READ_tRNS_SUPPORTED
  244|  13.6k|      else if (chunk_name == png_tRNS)
  ------------------
  |  |  864|  13.6k|#define png_tRNS PNG_U32(116,  82,  78,  83)
  |  |  ------------------
  |  |  |  |  814|  13.6k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  13.6k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  13.6k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  13.6k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  13.6k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (244:16): [True: 2.47k, False: 11.1k]
  ------------------
  245|  2.47k|         png_handle_tRNS(png_ptr, info_ptr, length);
  ------------------
  |  |   68|  2.47k|#define png_handle_tRNS OSS_FUZZ_png_handle_tRNS
  ------------------
  246|  11.1k|#endif
  247|       |
  248|  11.1k|#ifdef PNG_READ_zTXt_SUPPORTED
  249|  11.1k|      else if (chunk_name == png_zTXt)
  ------------------
  |  |  865|  11.1k|#define png_zTXt PNG_U32(122,  84,  88, 116)
  |  |  ------------------
  |  |  |  |  814|  11.1k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  11.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  11.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  11.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  11.1k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (249:16): [True: 3.11k, False: 8.04k]
  ------------------
  250|  3.11k|         png_handle_zTXt(png_ptr, info_ptr, length);
  ------------------
  |  |   69|  3.11k|#define png_handle_zTXt OSS_FUZZ_png_handle_zTXt
  ------------------
  251|  8.04k|#endif
  252|       |
  253|  8.04k|#ifdef PNG_READ_iTXt_SUPPORTED
  254|  8.04k|      else if (chunk_name == png_iTXt)
  ------------------
  |  |  853|  8.04k|#define png_iTXt PNG_U32(105,  84,  88, 116)
  |  |  ------------------
  |  |  |  |  814|  8.04k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.04k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.04k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.04k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.04k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (254:16): [True: 3.85k, False: 4.19k]
  ------------------
  255|  3.85k|         png_handle_iTXt(png_ptr, info_ptr, length);
  ------------------
  |  |   58|  3.85k|#define png_handle_iTXt OSS_FUZZ_png_handle_iTXt
  ------------------
  256|  4.19k|#endif
  257|       |
  258|  4.19k|      else
  259|  4.19k|         png_handle_unknown(png_ptr, info_ptr, length,
  ------------------
  |  |   72|  4.19k|#define png_handle_unknown OSS_FUZZ_png_handle_unknown
  ------------------
  260|  4.19k|             PNG_HANDLE_CHUNK_AS_DEFAULT);
  ------------------
  |  | 2345|  4.19k|#define PNG_HANDLE_CHUNK_AS_DEFAULT   0
  ------------------
  261|   103k|   }
  262|  8.50k|}
OSS_FUZZ_png_read_update_info:
  268|  1.81k|{
  269|  1.81k|   png_debug(1, "in png_read_update_info");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
  270|       |
  271|  1.81k|   if (png_ptr != NULL)
  ------------------
  |  Branch (271:8): [True: 1.81k, False: 0]
  ------------------
  272|  1.81k|   {
  273|  1.81k|      if ((png_ptr->flags & PNG_FLAG_ROW_INIT) == 0)
  ------------------
  |  |  676|  1.81k|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
  |  Branch (273:11): [True: 1.81k, False: 0]
  ------------------
  274|  1.81k|      {
  275|  1.81k|         png_read_start_row(png_ptr);
  ------------------
  |  |   41|  1.81k|#define png_read_start_row OSS_FUZZ_png_read_start_row
  ------------------
  276|       |
  277|  1.81k|#        ifdef PNG_READ_TRANSFORMS_SUPPORTED
  278|  1.81k|            png_read_transform_info(png_ptr, info_ptr);
  ------------------
  |  |   43|  1.81k|#define png_read_transform_info OSS_FUZZ_png_read_transform_info
  ------------------
  279|       |#        else
  280|       |            PNG_UNUSED(info_ptr)
  281|       |#        endif
  282|  1.81k|      }
  283|       |
  284|       |      /* New in 1.6.0 this avoids the bug of doing the initializations twice */
  285|      0|      else
  286|      0|         png_app_error(png_ptr,
  ------------------
  |  |  119|      0|#define png_app_error OSS_FUZZ_png_app_error
  ------------------
  287|      0|             "png_read_update_info/png_start_read_image: duplicate call");
  288|  1.81k|   }
  289|  1.81k|}
OSS_FUZZ_png_read_row:
  384|   264k|{
  385|   264k|   png_row_info row_info;
  386|       |
  387|   264k|   if (png_ptr == NULL)
  ------------------
  |  Branch (387:8): [True: 0, False: 264k]
  ------------------
  388|      0|      return;
  389|       |
  390|   264k|   png_debug2(1, "in png_read_row (row %lu, pass %d)",
  ------------------
  |  |  151|   264k|#  define png_debug2(l, m, p1, p2) ((void)0)
  ------------------
  391|   264k|       (unsigned long)png_ptr->row_number, png_ptr->pass);
  392|       |
  393|       |   /* png_read_start_row sets the information (in particular iwidth) for this
  394|       |    * interlace pass.
  395|       |    */
  396|   264k|   if ((png_ptr->flags & PNG_FLAG_ROW_INIT) == 0)
  ------------------
  |  |  676|   264k|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
  |  Branch (396:8): [True: 0, False: 264k]
  ------------------
  397|      0|      png_read_start_row(png_ptr);
  ------------------
  |  |   41|      0|#define png_read_start_row OSS_FUZZ_png_read_start_row
  ------------------
  398|       |
  399|       |   /* 1.5.6: row_info moved out of png_struct to a local here. */
  400|   264k|   row_info.width = png_ptr->iwidth; /* NOTE: width of current interlaced row */
  401|   264k|   row_info.color_type = png_ptr->color_type;
  402|   264k|   row_info.bit_depth = png_ptr->bit_depth;
  403|   264k|   row_info.channels = png_ptr->channels;
  404|   264k|   row_info.pixel_depth = png_ptr->pixel_depth;
  405|   264k|   row_info.rowbytes = PNG_ROWBYTES(row_info.pixel_depth, row_info.width);
  ------------------
  |  |  730|   264k|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 42.0k, False: 222k]
  |  |  ------------------
  |  |  731|   264k|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|   264k|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
  406|       |
  407|   264k|#ifdef PNG_WARNINGS_SUPPORTED
  408|   264k|   if (png_ptr->row_number == 0 && png_ptr->pass == 0)
  ------------------
  |  Branch (408:8): [True: 3.30k, False: 261k]
  |  Branch (408:36): [True: 1.81k, False: 1.49k]
  ------------------
  409|  1.81k|   {
  410|       |   /* Check for transforms that have been set but were defined out */
  411|       |#if defined(PNG_WRITE_INVERT_SUPPORTED) && !defined(PNG_READ_INVERT_SUPPORTED)
  412|       |   if ((png_ptr->transformations & PNG_INVERT_MONO) != 0)
  413|       |      png_warning(png_ptr, "PNG_READ_INVERT_SUPPORTED is not defined");
  414|       |#endif
  415|       |
  416|       |#if defined(PNG_WRITE_FILLER_SUPPORTED) && !defined(PNG_READ_FILLER_SUPPORTED)
  417|       |   if ((png_ptr->transformations & PNG_FILLER) != 0)
  418|       |      png_warning(png_ptr, "PNG_READ_FILLER_SUPPORTED is not defined");
  419|       |#endif
  420|       |
  421|       |#if defined(PNG_WRITE_PACKSWAP_SUPPORTED) && \
  422|       |    !defined(PNG_READ_PACKSWAP_SUPPORTED)
  423|       |   if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
  424|       |      png_warning(png_ptr, "PNG_READ_PACKSWAP_SUPPORTED is not defined");
  425|       |#endif
  426|       |
  427|       |#if defined(PNG_WRITE_PACK_SUPPORTED) && !defined(PNG_READ_PACK_SUPPORTED)
  428|       |   if ((png_ptr->transformations & PNG_PACK) != 0)
  429|       |      png_warning(png_ptr, "PNG_READ_PACK_SUPPORTED is not defined");
  430|       |#endif
  431|       |
  432|       |#if defined(PNG_WRITE_SHIFT_SUPPORTED) && !defined(PNG_READ_SHIFT_SUPPORTED)
  433|       |   if ((png_ptr->transformations & PNG_SHIFT) != 0)
  434|       |      png_warning(png_ptr, "PNG_READ_SHIFT_SUPPORTED is not defined");
  435|       |#endif
  436|       |
  437|       |#if defined(PNG_WRITE_BGR_SUPPORTED) && !defined(PNG_READ_BGR_SUPPORTED)
  438|       |   if ((png_ptr->transformations & PNG_BGR) != 0)
  439|       |      png_warning(png_ptr, "PNG_READ_BGR_SUPPORTED is not defined");
  440|       |#endif
  441|       |
  442|       |#if defined(PNG_WRITE_SWAP_SUPPORTED) && !defined(PNG_READ_SWAP_SUPPORTED)
  443|       |   if ((png_ptr->transformations & PNG_SWAP_BYTES) != 0)
  444|       |      png_warning(png_ptr, "PNG_READ_SWAP_SUPPORTED is not defined");
  445|       |#endif
  446|  1.81k|   }
  447|   264k|#endif /* WARNINGS */
  448|       |
  449|   264k|#ifdef PNG_READ_INTERLACING_SUPPORTED
  450|       |   /* If interlaced and we do not need a new row, combine row and return.
  451|       |    * Notice that the pixels we have from previous rows have been transformed
  452|       |    * already; we can only combine like with like (transformed or
  453|       |    * untransformed) and, because of the libpng API for interlaced images, this
  454|       |    * means we must transform before de-interlacing.
  455|       |    */
  456|   264k|   if (png_ptr->interlaced != 0 &&
  ------------------
  |  Branch (456:8): [True: 86.7k, False: 177k]
  ------------------
  457|   264k|       (png_ptr->transformations & PNG_INTERLACE) != 0)
  ------------------
  |  |  634|  86.7k|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (457:8): [True: 86.7k, False: 0]
  ------------------
  458|  86.7k|   {
  459|  86.7k|      switch (png_ptr->pass)
  460|  86.7k|      {
  461|  37.4k|         case 0:
  ------------------
  |  Branch (461:10): [True: 37.4k, False: 49.3k]
  ------------------
  462|  37.4k|            if (png_ptr->row_number & 0x07)
  ------------------
  |  Branch (462:17): [True: 32.1k, False: 5.31k]
  ------------------
  463|  32.1k|            {
  464|  32.1k|               if (dsp_row != NULL)
  ------------------
  |  Branch (464:20): [True: 0, False: 32.1k]
  ------------------
  465|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  466|  32.1k|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|  32.1k|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  467|  32.1k|               return;
  468|  32.1k|            }
  469|  5.31k|            break;
  470|       |
  471|  15.1k|         case 1:
  ------------------
  |  Branch (471:10): [True: 15.1k, False: 71.5k]
  ------------------
  472|  15.1k|            if ((png_ptr->row_number & 0x07) || png_ptr->width < 5)
  ------------------
  |  Branch (472:17): [True: 13.0k, False: 2.11k]
  |  Branch (472:49): [True: 1.13k, False: 988]
  ------------------
  473|  14.1k|            {
  474|  14.1k|               if (dsp_row != NULL)
  ------------------
  |  Branch (474:20): [True: 0, False: 14.1k]
  ------------------
  475|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  476|       |
  477|  14.1k|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|  14.1k|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  478|  14.1k|               return;
  479|  14.1k|            }
  480|    988|            break;
  481|       |
  482|  10.3k|         case 2:
  ------------------
  |  Branch (482:10): [True: 10.3k, False: 76.3k]
  ------------------
  483|  10.3k|            if ((png_ptr->row_number & 0x07) != 4)
  ------------------
  |  Branch (483:17): [True: 9.09k, False: 1.25k]
  ------------------
  484|  9.09k|            {
  485|  9.09k|               if (dsp_row != NULL && (png_ptr->row_number & 4))
  ------------------
  |  Branch (485:20): [True: 0, False: 9.09k]
  |  Branch (485:39): [True: 0, False: 0]
  ------------------
  486|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  487|       |
  488|  9.09k|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|  9.09k|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  489|  9.09k|               return;
  490|  9.09k|            }
  491|  1.25k|            break;
  492|       |
  493|  9.32k|         case 3:
  ------------------
  |  Branch (493:10): [True: 9.32k, False: 77.3k]
  ------------------
  494|  9.32k|            if ((png_ptr->row_number & 3) || png_ptr->width < 3)
  ------------------
  |  Branch (494:17): [True: 6.87k, False: 2.45k]
  |  Branch (494:46): [True: 1.12k, False: 1.32k]
  ------------------
  495|  8.00k|            {
  496|  8.00k|               if (dsp_row != NULL)
  ------------------
  |  Branch (496:20): [True: 0, False: 8.00k]
  ------------------
  497|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  498|       |
  499|  8.00k|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|  8.00k|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  500|  8.00k|               return;
  501|  8.00k|            }
  502|  1.32k|            break;
  503|       |
  504|  6.35k|         case 4:
  ------------------
  |  Branch (504:10): [True: 6.35k, False: 80.3k]
  ------------------
  505|  6.35k|            if ((png_ptr->row_number & 3) != 2)
  ------------------
  |  Branch (505:17): [True: 4.82k, False: 1.52k]
  ------------------
  506|  4.82k|            {
  507|  4.82k|               if (dsp_row != NULL && (png_ptr->row_number & 2))
  ------------------
  |  Branch (507:20): [True: 0, False: 4.82k]
  |  Branch (507:39): [True: 0, False: 0]
  ------------------
  508|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  509|       |
  510|  4.82k|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|  4.82k|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  511|  4.82k|               return;
  512|  4.82k|            }
  513|  1.52k|            break;
  514|       |
  515|  4.82k|         case 5:
  ------------------
  |  Branch (515:10): [True: 4.82k, False: 81.8k]
  ------------------
  516|  4.82k|            if ((png_ptr->row_number & 1) || png_ptr->width < 2)
  ------------------
  |  Branch (516:17): [True: 2.37k, False: 2.45k]
  |  Branch (516:46): [True: 768, False: 1.68k]
  ------------------
  517|  3.14k|            {
  518|  3.14k|               if (dsp_row != NULL)
  ------------------
  |  Branch (518:20): [True: 0, False: 3.14k]
  ------------------
  519|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  520|       |
  521|  3.14k|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|  3.14k|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  522|  3.14k|               return;
  523|  3.14k|            }
  524|  1.68k|            break;
  525|       |
  526|  1.68k|         default:
  ------------------
  |  Branch (526:10): [True: 0, False: 86.7k]
  ------------------
  527|  3.28k|         case 6:
  ------------------
  |  Branch (527:10): [True: 3.28k, False: 83.4k]
  ------------------
  528|  3.28k|            if ((png_ptr->row_number & 1) == 0)
  ------------------
  |  Branch (528:17): [True: 1.66k, False: 1.61k]
  ------------------
  529|  1.66k|            {
  530|  1.66k|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|  1.66k|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  531|  1.66k|               return;
  532|  1.66k|            }
  533|  1.61k|            break;
  534|  86.7k|      }
  535|  86.7k|   }
  536|   191k|#endif
  537|       |
  538|   191k|   if ((png_ptr->mode & PNG_HAVE_IDAT) == 0)
  ------------------
  |  |  617|   191k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (538:8): [True: 0, False: 191k]
  ------------------
  539|      0|      png_error(png_ptr, "Invalid attempt to read row data");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  540|       |
  541|       |   /* Fill the row with IDAT data: */
  542|   191k|   png_ptr->row_buf[0]=255; /* to force error if no data was found */
  543|   191k|   png_read_IDAT_data(png_ptr, png_ptr->row_buf, row_info.rowbytes + 1);
  ------------------
  |  |   38|   191k|#define png_read_IDAT_data OSS_FUZZ_png_read_IDAT_data
  ------------------
  544|       |
  545|   191k|   if (png_ptr->row_buf[0] > PNG_FILTER_VALUE_NONE)
  ------------------
  |  | 1476|   191k|#define PNG_FILTER_VALUE_NONE  0
  ------------------
  |  Branch (545:8): [True: 96.1k, False: 95.5k]
  ------------------
  546|  96.1k|   {
  547|  96.1k|      if (png_ptr->row_buf[0] < PNG_FILTER_VALUE_LAST)
  ------------------
  |  | 1481|  96.1k|#define PNG_FILTER_VALUE_LAST  5
  ------------------
  |  Branch (547:11): [True: 96.1k, False: 25]
  ------------------
  548|  96.1k|         png_read_filter_row(png_ptr, &row_info, png_ptr->row_buf + 1,
  ------------------
  |  |   36|  96.1k|#define png_read_filter_row OSS_FUZZ_png_read_filter_row
  ------------------
  549|  96.1k|             png_ptr->prev_row + 1, png_ptr->row_buf[0]);
  550|     25|      else
  551|     25|         png_error(png_ptr, "bad adaptive filter value");
  ------------------
  |  |  238|     25|#define png_error OSS_FUZZ_png_error
  ------------------
  552|  96.1k|   }
  553|       |
  554|       |   /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before
  555|       |    * 1.5.6, while the buffer really is this big in current versions of libpng
  556|       |    * it may not be in the future, so this was changed just to copy the
  557|       |    * interlaced count:
  558|       |    */
  559|   191k|   memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1);
  560|       |
  561|   191k|#ifdef PNG_MNG_FEATURES_SUPPORTED
  562|   191k|   if ((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) != 0 &&
  ------------------
  |  |  858|   191k|#define PNG_FLAG_MNG_FILTER_64      0x04
  ------------------
  |  Branch (562:8): [True: 0, False: 191k]
  ------------------
  563|   191k|       (png_ptr->filter_type == PNG_INTRAPIXEL_DIFFERENCING))
  ------------------
  |  |  683|      0|#define PNG_INTRAPIXEL_DIFFERENCING 64 /* Used only in MNG datastreams */
  ------------------
  |  Branch (563:8): [True: 0, False: 0]
  ------------------
  564|      0|   {
  565|       |      /* Intrapixel differencing */
  566|      0|      png_do_read_intrapixel(&row_info, png_ptr->row_buf + 1);
  567|      0|   }
  568|   191k|#endif
  569|       |
  570|   191k|#ifdef PNG_READ_TRANSFORMS_SUPPORTED
  571|   191k|   if (png_ptr->transformations)
  ------------------
  |  Branch (571:8): [True: 190k, False: 1.07k]
  ------------------
  572|   190k|      png_do_read_transformations(png_ptr, &row_info);
  ------------------
  |  |   74|   190k|#define png_do_read_transformations OSS_FUZZ_png_do_read_transformations
  ------------------
  573|   191k|#endif
  574|       |
  575|       |   /* The transformed pixel depth should match the depth now in row_info. */
  576|   191k|   if (png_ptr->transformed_pixel_depth == 0)
  ------------------
  |  Branch (576:8): [True: 1.49k, False: 190k]
  ------------------
  577|  1.49k|   {
  578|  1.49k|      png_ptr->transformed_pixel_depth = row_info.pixel_depth;
  579|  1.49k|      if (row_info.pixel_depth > png_ptr->maximum_pixel_depth)
  ------------------
  |  Branch (579:11): [True: 0, False: 1.49k]
  ------------------
  580|      0|         png_error(png_ptr, "sequential row overflow");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  581|  1.49k|   }
  582|       |
  583|   190k|   else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth)
  ------------------
  |  Branch (583:13): [True: 0, False: 190k]
  ------------------
  584|      0|      png_error(png_ptr, "internal sequential row size calculation error");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  585|       |
  586|   191k|#ifdef PNG_READ_INTERLACING_SUPPORTED
  587|       |   /* Expand interlaced rows to full size */
  588|   191k|   if (png_ptr->interlaced != 0 &&
  ------------------
  |  Branch (588:8): [True: 13.0k, False: 178k]
  ------------------
  589|   191k|      (png_ptr->transformations & PNG_INTERLACE) != 0)
  ------------------
  |  |  634|  13.0k|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (589:7): [True: 13.0k, False: 0]
  ------------------
  590|  13.0k|   {
  591|  13.0k|      if (png_ptr->pass < 6)
  ------------------
  |  Branch (591:11): [True: 11.4k, False: 1.60k]
  ------------------
  592|  11.4k|         png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass,
  ------------------
  |  |   35|  11.4k|#define png_do_read_interlace OSS_FUZZ_png_do_read_interlace
  ------------------
  593|  11.4k|             png_ptr->transformations);
  594|       |
  595|  13.0k|      if (dsp_row != NULL)
  ------------------
  |  Branch (595:11): [True: 0, False: 13.0k]
  ------------------
  596|      0|         png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  597|       |
  598|  13.0k|      if (row != NULL)
  ------------------
  |  Branch (598:11): [True: 13.0k, False: 0]
  ------------------
  599|  13.0k|         png_combine_row(png_ptr, row, 0/*row*/);
  ------------------
  |  |   34|  13.0k|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  600|  13.0k|   }
  601|       |
  602|   178k|   else
  603|   178k|#endif
  604|   178k|   {
  605|   178k|      if (row != NULL)
  ------------------
  |  Branch (605:11): [True: 177k, False: 1.07k]
  ------------------
  606|   177k|         png_combine_row(png_ptr, row, -1/*ignored*/);
  ------------------
  |  |   34|   177k|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  607|       |
  608|   178k|      if (dsp_row != NULL)
  ------------------
  |  Branch (608:11): [True: 0, False: 178k]
  ------------------
  609|      0|         png_combine_row(png_ptr, dsp_row, -1/*ignored*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  610|   178k|   }
  611|   191k|   png_read_finish_row(png_ptr);
  ------------------
  |  |   40|   191k|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  612|       |
  613|   191k|   if (png_ptr->read_row_fn != NULL)
  ------------------
  |  Branch (613:8): [True: 0, False: 191k]
  ------------------
  614|      0|      (*(png_ptr->read_row_fn))(png_ptr, png_ptr->row_number, png_ptr->pass);
  615|       |
  616|   191k|}
OSS_FUZZ_png_read_end:
  767|    595|{
  768|    595|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  769|    595|   int keep;
  770|    595|#endif
  771|       |
  772|    595|   png_debug(1, "in png_read_end");
  ------------------
  |  |  145|    595|#  define png_debug(l, m) ((void)0)
  ------------------
  773|       |
  774|    595|   if (png_ptr == NULL)
  ------------------
  |  Branch (774:8): [True: 0, False: 595]
  ------------------
  775|      0|      return;
  776|       |
  777|       |   /* If png_read_end is called in the middle of reading the rows there may
  778|       |    * still be pending IDAT data and an owned zstream.  Deal with this here.
  779|       |    */
  780|    595|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  781|    595|   if (png_chunk_unknown_handling(png_ptr, png_IDAT) == 0)
  ------------------
  |  |   73|    595|#define png_chunk_unknown_handling OSS_FUZZ_png_chunk_unknown_handling
  ------------------
                 if (png_chunk_unknown_handling(png_ptr, png_IDAT) == 0)
  ------------------
  |  |  839|    595|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|    595|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|    595|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|    595|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|    595|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|    595|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (781:8): [True: 595, False: 0]
  ------------------
  782|    595|#endif
  783|    595|      png_read_finish_IDAT(png_ptr);
  ------------------
  |  |   39|    595|#define png_read_finish_IDAT OSS_FUZZ_png_read_finish_IDAT
  ------------------
  784|       |
  785|    595|#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
  786|       |   /* Report invalid palette index; added at libng-1.5.10 */
  787|    595|   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  ------------------
  |  |  669|  1.19k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|    595|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|    595|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (787:8): [True: 8, False: 587]
  ------------------
  788|    595|       png_ptr->num_palette_max > png_ptr->num_palette)
  ------------------
  |  Branch (788:8): [True: 0, False: 8]
  ------------------
  789|      0|      png_benign_error(png_ptr, "Read palette index exceeding num_palette");
  ------------------
  |  |  221|      0|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
  790|    595|#endif
  791|       |
  792|    595|   do
  793|  8.15k|   {
  794|  8.15k|      png_uint_32 length = png_read_chunk_header(png_ptr);
  ------------------
  |  |   21|  8.15k|#define png_read_chunk_header OSS_FUZZ_png_read_chunk_header
  ------------------
  795|  8.15k|      png_uint_32 chunk_name = png_ptr->chunk_name;
  796|       |
  797|  8.15k|      if (chunk_name != png_IDAT)
  ------------------
  |  |  839|  8.15k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|  8.15k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.15k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.15k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.15k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.15k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (797:11): [True: 7.49k, False: 654]
  ------------------
  798|  7.49k|         png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
  ------------------
  |  |  628|  7.49k|#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
  ------------------
  799|       |
  800|  8.15k|      if (chunk_name == png_IEND)
  ------------------
  |  |  840|  8.15k|#define png_IEND PNG_U32( 73,  69,  78,  68)
  |  |  ------------------
  |  |  |  |  814|  8.15k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.15k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.15k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.15k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.15k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (800:11): [True: 14, False: 8.13k]
  ------------------
  801|     14|         png_handle_IEND(png_ptr, info_ptr, length);
  ------------------
  |  |   51|     14|#define png_handle_IEND OSS_FUZZ_png_handle_IEND
  ------------------
  802|       |
  803|  8.13k|      else if (chunk_name == png_IHDR)
  ------------------
  |  |  841|  8.13k|#define png_IHDR PNG_U32( 73,  72,  68,  82)
  |  |  ------------------
  |  |  |  |  814|  8.13k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.13k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.13k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.13k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.13k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (803:16): [True: 1, False: 8.13k]
  ------------------
  804|      1|         png_handle_IHDR(png_ptr, info_ptr, length);
  ------------------
  |  |   49|      1|#define png_handle_IHDR OSS_FUZZ_png_handle_IHDR
  ------------------
  805|       |
  806|  8.13k|      else if (info_ptr == NULL)
  ------------------
  |  Branch (806:16): [True: 0, False: 8.13k]
  ------------------
  807|      0|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  808|       |
  809|  8.13k|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  810|  8.13k|      else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0)
  ------------------
  |  |   73|  8.13k|#define png_chunk_unknown_handling OSS_FUZZ_png_chunk_unknown_handling
  ------------------
  |  Branch (810:16): [True: 0, False: 8.13k]
  ------------------
  811|      0|      {
  812|      0|         if (chunk_name == png_IDAT)
  ------------------
  |  |  839|      0|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (812:14): [True: 0, False: 0]
  ------------------
  813|      0|         {
  814|      0|            if ((length > 0 && !(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED))
  ------------------
  |  |  673|      0|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (814:18): [True: 0, False: 0]
  |  Branch (814:32): [True: 0, False: 0]
  ------------------
  815|      0|                || (png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) != 0)
  ------------------
  |  |  628|      0|#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
  ------------------
  |  Branch (815:20): [True: 0, False: 0]
  ------------------
  816|      0|               png_benign_error(png_ptr, ".Too many IDATs found");
  ------------------
  |  |  221|      0|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
  817|      0|         }
  818|      0|         png_handle_unknown(png_ptr, info_ptr, length, keep);
  ------------------
  |  |   72|      0|#define png_handle_unknown OSS_FUZZ_png_handle_unknown
  ------------------
  819|      0|         if (chunk_name == png_PLTE)
  ------------------
  |  |  842|      0|#define png_PLTE PNG_U32( 80,  76,  84,  69)
  |  |  ------------------
  |  |  |  |  814|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|      0|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (819:14): [True: 0, False: 0]
  ------------------
  820|      0|            png_ptr->mode |= PNG_HAVE_PLTE;
  ------------------
  |  |  645|      0|#define PNG_HAVE_PLTE  0x02
  ------------------
  821|      0|      }
  822|  8.13k|#endif
  823|       |
  824|  8.13k|      else if (chunk_name == png_IDAT)
  ------------------
  |  |  839|  8.13k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|  8.13k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.13k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.13k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.13k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  8.13k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (824:16): [True: 618, False: 7.51k]
  ------------------
  825|    618|      {
  826|       |         /* Zero length IDATs are legal after the last IDAT has been
  827|       |          * read, but not after other chunks have been read.  1.6 does not
  828|       |          * always read all the deflate data; specifically it cannot be relied
  829|       |          * upon to read the Adler32 at the end.  If it doesn't ignore IDAT
  830|       |          * chunks which are longer than zero as well:
  831|       |          */
  832|    618|         if ((length > 0 && !(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED))
  ------------------
  |  |  673|    233|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (832:15): [True: 233, False: 385]
  |  Branch (832:29): [True: 0, False: 233]
  ------------------
  833|    618|             || (png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) != 0)
  ------------------
  |  |  628|    618|#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
  ------------------
  |  Branch (833:17): [True: 334, False: 284]
  ------------------
  834|    334|            png_benign_error(png_ptr, "..Too many IDATs found");
  ------------------
  |  |  221|    334|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
  835|       |
  836|    618|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    618|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  837|    618|      }
  838|  7.51k|      else if (chunk_name == png_PLTE)
  ------------------
  |  |  842|  7.51k|#define png_PLTE PNG_U32( 80,  76,  84,  69)
  |  |  ------------------
  |  |  |  |  814|  7.51k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (838:16): [True: 194, False: 7.32k]
  ------------------
  839|    194|         png_handle_PLTE(png_ptr, info_ptr, length);
  ------------------
  |  |   50|    194|#define png_handle_PLTE OSS_FUZZ_png_handle_PLTE
  ------------------
  840|       |
  841|  7.32k|#ifdef PNG_READ_bKGD_SUPPORTED
  842|  7.32k|      else if (chunk_name == png_bKGD)
  ------------------
  |  |  843|  7.32k|#define png_bKGD PNG_U32( 98,  75,  71,  68)
  |  |  ------------------
  |  |  |  |  814|  7.32k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.32k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.32k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.32k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.32k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (842:16): [True: 194, False: 7.12k]
  ------------------
  843|    194|         png_handle_bKGD(png_ptr, info_ptr, length);
  ------------------
  |  |   52|    194|#define png_handle_bKGD OSS_FUZZ_png_handle_bKGD
  ------------------
  844|  7.12k|#endif
  845|       |
  846|  7.12k|#ifdef PNG_READ_cHRM_SUPPORTED
  847|  7.12k|      else if (chunk_name == png_cHRM)
  ------------------
  |  |  844|  7.12k|#define png_cHRM PNG_U32( 99,  72,  82,  77)
  |  |  ------------------
  |  |  |  |  814|  7.12k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.12k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.12k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.12k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  7.12k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (847:16): [True: 194, False: 6.93k]
  ------------------
  848|    194|         png_handle_cHRM(png_ptr, info_ptr, length);
  ------------------
  |  |   53|    194|#define png_handle_cHRM OSS_FUZZ_png_handle_cHRM
  ------------------
  849|  6.93k|#endif
  850|       |
  851|  6.93k|#ifdef PNG_READ_eXIf_SUPPORTED
  852|  6.93k|      else if (chunk_name == png_eXIf)
  ------------------
  |  |  845|  6.93k|#define png_eXIf PNG_U32(101,  88,  73, 102) /* registered July 2017 */
  |  |  ------------------
  |  |  |  |  814|  6.93k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.93k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.93k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.93k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.93k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (852:16): [True: 231, False: 6.70k]
  ------------------
  853|    231|         png_handle_eXIf(png_ptr, info_ptr, length);
  ------------------
  |  |   54|    231|#define png_handle_eXIf OSS_FUZZ_png_handle_eXIf
  ------------------
  854|  6.70k|#endif
  855|       |
  856|  6.70k|#ifdef PNG_READ_gAMA_SUPPORTED
  857|  6.70k|      else if (chunk_name == png_gAMA)
  ------------------
  |  |  847|  6.70k|#define png_gAMA PNG_U32(103,  65,  77,  65)
  |  |  ------------------
  |  |  |  |  814|  6.70k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.70k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.70k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.70k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.70k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (857:16): [True: 194, False: 6.51k]
  ------------------
  858|    194|         png_handle_gAMA(png_ptr, info_ptr, length);
  ------------------
  |  |   55|    194|#define png_handle_gAMA OSS_FUZZ_png_handle_gAMA
  ------------------
  859|  6.51k|#endif
  860|       |
  861|  6.51k|#ifdef PNG_READ_hIST_SUPPORTED
  862|  6.51k|      else if (chunk_name == png_hIST)
  ------------------
  |  |  851|  6.51k|#define png_hIST PNG_U32(104,  73,  83,  84)
  |  |  ------------------
  |  |  |  |  814|  6.51k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (862:16): [True: 194, False: 6.31k]
  ------------------
  863|    194|         png_handle_hIST(png_ptr, info_ptr, length);
  ------------------
  |  |   56|    194|#define png_handle_hIST OSS_FUZZ_png_handle_hIST
  ------------------
  864|  6.31k|#endif
  865|       |
  866|  6.31k|#ifdef PNG_READ_oFFs_SUPPORTED
  867|  6.31k|      else if (chunk_name == png_oFFs)
  ------------------
  |  |  854|  6.31k|#define png_oFFs PNG_U32(111,  70,  70, 115)
  |  |  ------------------
  |  |  |  |  814|  6.31k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.31k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.31k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.31k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.31k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (867:16): [True: 215, False: 6.10k]
  ------------------
  868|    215|         png_handle_oFFs(png_ptr, info_ptr, length);
  ------------------
  |  |   59|    215|#define png_handle_oFFs OSS_FUZZ_png_handle_oFFs
  ------------------
  869|  6.10k|#endif
  870|       |
  871|  6.10k|#ifdef PNG_READ_pCAL_SUPPORTED
  872|  6.10k|      else if (chunk_name == png_pCAL)
  ------------------
  |  |  855|  6.10k|#define png_pCAL PNG_U32(112,  67,  65,  76)
  |  |  ------------------
  |  |  |  |  814|  6.10k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.10k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.10k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.10k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.10k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (872:16): [True: 195, False: 5.90k]
  ------------------
  873|    195|         png_handle_pCAL(png_ptr, info_ptr, length);
  ------------------
  |  |   60|    195|#define png_handle_pCAL OSS_FUZZ_png_handle_pCAL
  ------------------
  874|  5.90k|#endif
  875|       |
  876|  5.90k|#ifdef PNG_READ_sCAL_SUPPORTED
  877|  5.90k|      else if (chunk_name == png_sCAL)
  ------------------
  |  |  858|  5.90k|#define png_sCAL PNG_U32(115,  67,  65,  76)
  |  |  ------------------
  |  |  |  |  814|  5.90k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.90k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.90k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.90k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.90k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (877:16): [True: 194, False: 5.71k]
  ------------------
  878|    194|         png_handle_sCAL(png_ptr, info_ptr, length);
  ------------------
  |  |   63|    194|#define png_handle_sCAL OSS_FUZZ_png_handle_sCAL
  ------------------
  879|  5.71k|#endif
  880|       |
  881|  5.71k|#ifdef PNG_READ_pHYs_SUPPORTED
  882|  5.71k|      else if (chunk_name == png_pHYs)
  ------------------
  |  |  856|  5.71k|#define png_pHYs PNG_U32(112,  72,  89, 115)
  |  |  ------------------
  |  |  |  |  814|  5.71k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.71k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.71k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.71k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.71k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (882:16): [True: 198, False: 5.51k]
  ------------------
  883|    198|         png_handle_pHYs(png_ptr, info_ptr, length);
  ------------------
  |  |   61|    198|#define png_handle_pHYs OSS_FUZZ_png_handle_pHYs
  ------------------
  884|  5.51k|#endif
  885|       |
  886|  5.51k|#ifdef PNG_READ_sBIT_SUPPORTED
  887|  5.51k|      else if (chunk_name == png_sBIT)
  ------------------
  |  |  857|  5.51k|#define png_sBIT PNG_U32(115,  66,  73,  84)
  |  |  ------------------
  |  |  |  |  814|  5.51k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.51k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (887:16): [True: 196, False: 5.31k]
  ------------------
  888|    196|         png_handle_sBIT(png_ptr, info_ptr, length);
  ------------------
  |  |   62|    196|#define png_handle_sBIT OSS_FUZZ_png_handle_sBIT
  ------------------
  889|  5.31k|#endif
  890|       |
  891|  5.31k|#ifdef PNG_READ_sRGB_SUPPORTED
  892|  5.31k|      else if (chunk_name == png_sRGB)
  ------------------
  |  |  860|  5.31k|#define png_sRGB PNG_U32(115,  82,  71,  66)
  |  |  ------------------
  |  |  |  |  814|  5.31k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.31k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.31k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.31k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.31k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (892:16): [True: 194, False: 5.12k]
  ------------------
  893|    194|         png_handle_sRGB(png_ptr, info_ptr, length);
  ------------------
  |  |   65|    194|#define png_handle_sRGB OSS_FUZZ_png_handle_sRGB
  ------------------
  894|  5.12k|#endif
  895|       |
  896|  5.12k|#ifdef PNG_READ_iCCP_SUPPORTED
  897|  5.12k|      else if (chunk_name == png_iCCP)
  ------------------
  |  |  852|  5.12k|#define png_iCCP PNG_U32(105,  67,  67,  80)
  |  |  ------------------
  |  |  |  |  814|  5.12k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.12k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.12k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.12k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  5.12k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (897:16): [True: 197, False: 4.92k]
  ------------------
  898|    197|         png_handle_iCCP(png_ptr, info_ptr, length);
  ------------------
  |  |   57|    197|#define png_handle_iCCP OSS_FUZZ_png_handle_iCCP
  ------------------
  899|  4.92k|#endif
  900|       |
  901|  4.92k|#ifdef PNG_READ_sPLT_SUPPORTED
  902|  4.92k|      else if (chunk_name == png_sPLT)
  ------------------
  |  |  859|  4.92k|#define png_sPLT PNG_U32(115,  80,  76,  84)
  |  |  ------------------
  |  |  |  |  814|  4.92k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  4.92k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  4.92k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  4.92k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  4.92k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (902:16): [True: 478, False: 4.44k]
  ------------------
  903|    478|         png_handle_sPLT(png_ptr, info_ptr, length);
  ------------------
  |  |   64|    478|#define png_handle_sPLT OSS_FUZZ_png_handle_sPLT
  ------------------
  904|  4.44k|#endif
  905|       |
  906|  4.44k|#ifdef PNG_READ_tEXt_SUPPORTED
  907|  4.44k|      else if (chunk_name == png_tEXt)
  ------------------
  |  |  862|  4.44k|#define png_tEXt PNG_U32(116,  69,  88, 116)
  |  |  ------------------
  |  |  |  |  814|  4.44k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  4.44k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  4.44k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  4.44k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  4.44k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (907:16): [True: 1.96k, False: 2.48k]
  ------------------
  908|  1.96k|         png_handle_tEXt(png_ptr, info_ptr, length);
  ------------------
  |  |   66|  1.96k|#define png_handle_tEXt OSS_FUZZ_png_handle_tEXt
  ------------------
  909|  2.48k|#endif
  910|       |
  911|  2.48k|#ifdef PNG_READ_tIME_SUPPORTED
  912|  2.48k|      else if (chunk_name == png_tIME)
  ------------------
  |  |  863|  2.48k|#define png_tIME PNG_U32(116,  73,  77,  69)
  |  |  ------------------
  |  |  |  |  814|  2.48k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.48k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.48k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.48k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.48k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (912:16): [True: 195, False: 2.28k]
  ------------------
  913|    195|         png_handle_tIME(png_ptr, info_ptr, length);
  ------------------
  |  |   67|    195|#define png_handle_tIME OSS_FUZZ_png_handle_tIME
  ------------------
  914|  2.28k|#endif
  915|       |
  916|  2.28k|#ifdef PNG_READ_tRNS_SUPPORTED
  917|  2.28k|      else if (chunk_name == png_tRNS)
  ------------------
  |  |  864|  2.28k|#define png_tRNS PNG_U32(116,  82,  78,  83)
  |  |  ------------------
  |  |  |  |  814|  2.28k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.28k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.28k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.28k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.28k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (917:16): [True: 195, False: 2.09k]
  ------------------
  918|    195|         png_handle_tRNS(png_ptr, info_ptr, length);
  ------------------
  |  |   68|    195|#define png_handle_tRNS OSS_FUZZ_png_handle_tRNS
  ------------------
  919|  2.09k|#endif
  920|       |
  921|  2.09k|#ifdef PNG_READ_zTXt_SUPPORTED
  922|  2.09k|      else if (chunk_name == png_zTXt)
  ------------------
  |  |  865|  2.09k|#define png_zTXt PNG_U32(122,  84,  88, 116)
  |  |  ------------------
  |  |  |  |  814|  2.09k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.09k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.09k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.09k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  2.09k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (922:16): [True: 477, False: 1.61k]
  ------------------
  923|    477|         png_handle_zTXt(png_ptr, info_ptr, length);
  ------------------
  |  |   69|    477|#define png_handle_zTXt OSS_FUZZ_png_handle_zTXt
  ------------------
  924|  1.61k|#endif
  925|       |
  926|  1.61k|#ifdef PNG_READ_iTXt_SUPPORTED
  927|  1.61k|      else if (chunk_name == png_iTXt)
  ------------------
  |  |  853|  1.61k|#define png_iTXt PNG_U32(105,  84,  88, 116)
  |  |  ------------------
  |  |  |  |  814|  1.61k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.61k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.61k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.61k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.61k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (927:16): [True: 993, False: 623]
  ------------------
  928|    993|         png_handle_iTXt(png_ptr, info_ptr, length);
  ------------------
  |  |   58|    993|#define png_handle_iTXt OSS_FUZZ_png_handle_iTXt
  ------------------
  929|    623|#endif
  930|       |
  931|    623|      else
  932|    623|         png_handle_unknown(png_ptr, info_ptr, length,
  ------------------
  |  |   72|    623|#define png_handle_unknown OSS_FUZZ_png_handle_unknown
  ------------------
  933|    623|             PNG_HANDLE_CHUNK_AS_DEFAULT);
  ------------------
  |  | 2345|    623|#define PNG_HANDLE_CHUNK_AS_DEFAULT   0
  ------------------
  934|  8.15k|   } while ((png_ptr->mode & PNG_HAVE_IEND) == 0);
  ------------------
  |  |  619|  8.15k|#define PNG_HAVE_IEND               0x10U
  ------------------
  |  Branch (934:13): [True: 7.55k, False: 595]
  ------------------
  935|    595|}
OSS_FUZZ_png_destroy_read_struct:
 1013|  17.0k|{
 1014|  17.0k|   png_structrp png_ptr = NULL;
 1015|       |
 1016|  17.0k|   png_debug(1, "in png_destroy_read_struct");
  ------------------
  |  |  145|  17.0k|#  define png_debug(l, m) ((void)0)
  ------------------
 1017|       |
 1018|  17.0k|   if (png_ptr_ptr != NULL)
  ------------------
  |  Branch (1018:8): [True: 17.0k, False: 0]
  ------------------
 1019|  17.0k|      png_ptr = *png_ptr_ptr;
 1020|       |
 1021|  17.0k|   if (png_ptr == NULL)
  ------------------
  |  Branch (1021:8): [True: 8.50k, False: 8.50k]
  ------------------
 1022|  8.50k|      return;
 1023|       |
 1024|       |   /* libpng 1.6.0: use the API to destroy info structs to ensure consistent
 1025|       |    * behavior.  Prior to 1.6.0 libpng did extra 'info' destruction in this API.
 1026|       |    * The extra was, apparently, unnecessary yet this hides memory leak bugs.
 1027|       |    */
 1028|  8.50k|   png_destroy_info_struct(png_ptr, end_info_ptr_ptr);
  ------------------
  |  |  235|  8.50k|#define png_destroy_info_struct OSS_FUZZ_png_destroy_info_struct
  ------------------
 1029|  8.50k|   png_destroy_info_struct(png_ptr, info_ptr_ptr);
  ------------------
  |  |  235|  8.50k|#define png_destroy_info_struct OSS_FUZZ_png_destroy_info_struct
  ------------------
 1030|       |
 1031|  8.50k|   *png_ptr_ptr = NULL;
 1032|  8.50k|   png_read_destroy(png_ptr);
 1033|  8.50k|   png_destroy_png_struct(png_ptr);
  ------------------
  |  |   11|  8.50k|#define png_destroy_png_struct OSS_FUZZ_png_destroy_png_struct
  ------------------
 1034|  8.50k|}
pngread.c:png_read_destroy:
  941|  8.50k|{
  942|  8.50k|   png_debug(1, "in png_read_destroy");
  ------------------
  |  |  145|  8.50k|#  define png_debug(l, m) ((void)0)
  ------------------
  943|       |
  944|  8.50k|#ifdef PNG_READ_GAMMA_SUPPORTED
  945|  8.50k|   png_destroy_gamma_table(png_ptr);
  ------------------
  |  |  133|  8.50k|#define png_destroy_gamma_table OSS_FUZZ_png_destroy_gamma_table
  ------------------
  946|  8.50k|#endif
  947|       |
  948|  8.50k|   png_free(png_ptr, png_ptr->big_row_buf);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
  949|  8.50k|   png_ptr->big_row_buf = NULL;
  950|  8.50k|   png_free(png_ptr, png_ptr->big_prev_row);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
  951|  8.50k|   png_ptr->big_prev_row = NULL;
  952|  8.50k|   png_free(png_ptr, png_ptr->read_buffer);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
  953|  8.50k|   png_ptr->read_buffer = NULL;
  954|       |
  955|  8.50k|#ifdef PNG_READ_QUANTIZE_SUPPORTED
  956|  8.50k|   png_free(png_ptr, png_ptr->palette_lookup);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
  957|  8.50k|   png_ptr->palette_lookup = NULL;
  958|  8.50k|   png_free(png_ptr, png_ptr->quantize_index);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
  959|  8.50k|   png_ptr->quantize_index = NULL;
  960|  8.50k|#endif
  961|       |
  962|  8.50k|   if ((png_ptr->free_me & PNG_FREE_PLTE) != 0)
  ------------------
  |  | 1758|  8.50k|#define PNG_FREE_PLTE 0x1000U
  ------------------
  |  Branch (962:8): [True: 0, False: 8.50k]
  ------------------
  963|      0|   {
  964|      0|      png_zfree(png_ptr, png_ptr->palette);
  ------------------
  |  |   14|      0|#define png_zfree OSS_FUZZ_png_zfree
  ------------------
  965|      0|      png_ptr->palette = NULL;
  966|      0|   }
  967|  8.50k|   png_ptr->free_me &= ~PNG_FREE_PLTE;
  ------------------
  |  | 1758|  8.50k|#define PNG_FREE_PLTE 0x1000U
  ------------------
  968|       |
  969|  8.50k|#if defined(PNG_tRNS_SUPPORTED) || \
  970|  8.50k|    defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
  971|  8.50k|   if ((png_ptr->free_me & PNG_FREE_TRNS) != 0)
  ------------------
  |  | 1759|  8.50k|#define PNG_FREE_TRNS 0x2000U
  ------------------
  |  Branch (971:8): [True: 0, False: 8.50k]
  ------------------
  972|      0|   {
  973|      0|      png_free(png_ptr, png_ptr->trans_alpha);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  974|      0|      png_ptr->trans_alpha = NULL;
  975|      0|   }
  976|  8.50k|   png_ptr->free_me &= ~PNG_FREE_TRNS;
  ------------------
  |  | 1759|  8.50k|#define PNG_FREE_TRNS 0x2000U
  ------------------
  977|  8.50k|#endif
  978|       |
  979|  8.50k|   inflateEnd(&png_ptr->zstream);
  980|       |
  981|  8.50k|#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
  982|  8.50k|   png_free(png_ptr, png_ptr->save_buffer);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
  983|  8.50k|   png_ptr->save_buffer = NULL;
  984|  8.50k|#endif
  985|       |
  986|  8.50k|#if defined(PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED) && \
  987|  8.50k|   defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
  988|  8.50k|   png_free(png_ptr, png_ptr->unknown_chunk.data);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
  989|  8.50k|   png_ptr->unknown_chunk.data = NULL;
  990|  8.50k|#endif
  991|       |
  992|  8.50k|#ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
  993|  8.50k|   png_free(png_ptr, png_ptr->chunk_list);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
  994|  8.50k|   png_ptr->chunk_list = NULL;
  995|  8.50k|#endif
  996|       |
  997|  8.50k|#if defined(PNG_READ_EXPAND_SUPPORTED) && \
  998|  8.50k|    defined(PNG_ARM_NEON_IMPLEMENTATION)
  999|  8.50k|   png_free(png_ptr, png_ptr->riffled_palette);
  ------------------
  |  |  239|  8.50k|#define png_free OSS_FUZZ_png_free
  ------------------
 1000|  8.50k|   png_ptr->riffled_palette = NULL;
 1001|  8.50k|#endif
 1002|       |
 1003|       |   /* NOTE: the 'setjmp' buffer may still be allocated and the memory and error
 1004|       |    * callbacks are still set at this point.  They are required to complete the
 1005|       |    * destruction of the png_struct itself.
 1006|       |    */
 1007|  8.50k|}

OSS_FUZZ_png_read_data:
   33|  1.04M|{
   34|  1.04M|   png_debug1(4, "reading %d bytes", (int)length);
  ------------------
  |  |  148|  1.04M|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
   35|       |
   36|  1.04M|   if (png_ptr->read_data_fn != NULL)
  ------------------
  |  Branch (36:8): [True: 1.04M, False: 0]
  ------------------
   37|  1.04M|      (*(png_ptr->read_data_fn))(png_ptr, data, length);
   38|       |
   39|      0|   else
   40|      0|      png_error(png_ptr, "Call to NULL read function");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
   41|  1.04M|}
OSS_FUZZ_png_set_read_fn:
   89|  17.0k|{
   90|  17.0k|   if (png_ptr == NULL)
  ------------------
  |  Branch (90:8): [True: 0, False: 17.0k]
  ------------------
   91|      0|      return;
   92|       |
   93|  17.0k|   png_ptr->io_ptr = io_ptr;
   94|       |
   95|       |#ifdef PNG_STDIO_SUPPORTED
   96|       |   if (read_data_fn != NULL)
   97|       |      png_ptr->read_data_fn = read_data_fn;
   98|       |
   99|       |   else
  100|       |      png_ptr->read_data_fn = png_default_read_data;
  101|       |#else
  102|  17.0k|   png_ptr->read_data_fn = read_data_fn;
  103|  17.0k|#endif
  104|       |
  105|       |#ifdef PNG_WRITE_SUPPORTED
  106|       |   /* It is an error to write to a read device */
  107|       |   if (png_ptr->write_data_fn != NULL)
  108|       |   {
  109|       |      png_ptr->write_data_fn = NULL;
  110|       |      png_warning(png_ptr,
  111|       |          "Can't set both read_data_fn and write_data_fn in the"
  112|       |          " same structure");
  113|       |   }
  114|       |#endif
  115|       |
  116|       |#ifdef PNG_WRITE_FLUSH_SUPPORTED
  117|       |   png_ptr->output_flush_fn = NULL;
  118|       |#endif
  119|  17.0k|}

OSS_FUZZ_png_set_crc_action:
   37|  8.50k|{
   38|  8.50k|   png_debug(1, "in png_set_crc_action");
  ------------------
  |  |  145|  8.50k|#  define png_debug(l, m) ((void)0)
  ------------------
   39|       |
   40|  8.50k|   if (png_ptr == NULL)
  ------------------
  |  Branch (40:8): [True: 0, False: 8.50k]
  ------------------
   41|      0|      return;
   42|       |
   43|       |   /* Tell libpng how we react to CRC errors in critical chunks */
   44|  8.50k|   switch (crit_action)
   45|  8.50k|   {
   46|      0|      case PNG_CRC_NO_CHANGE:                        /* Leave setting as is */
  ------------------
  |  | 1441|      0|#define PNG_CRC_NO_CHANGE     5  /* use current value   use current value */
  ------------------
  |  Branch (46:7): [True: 0, False: 8.50k]
  ------------------
   47|      0|         break;
   48|       |
   49|      0|      case PNG_CRC_WARN_USE:                               /* Warn/use data */
  ------------------
  |  | 1439|      0|#define PNG_CRC_WARN_USE      3  /* warn/use data       warn/use data     */
  ------------------
  |  Branch (49:7): [True: 0, False: 8.50k]
  ------------------
   50|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
  ------------------
  |  |  705|      0|#define PNG_FLAG_CRC_CRITICAL_MASK  (PNG_FLAG_CRC_CRITICAL_USE | \
  |  |  ------------------
  |  |  |  |  680|      0|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  |  |  ------------------
  |  |  706|      0|                                     PNG_FLAG_CRC_CRITICAL_IGNORE)
  |  |  ------------------
  |  |  |  |  681|      0|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  |  |  ------------------
  ------------------
   51|      0|         png_ptr->flags |= PNG_FLAG_CRC_CRITICAL_USE;
  ------------------
  |  |  680|      0|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  ------------------
   52|      0|         break;
   53|       |
   54|  8.50k|      case PNG_CRC_QUIET_USE:                             /* Quiet/use data */
  ------------------
  |  | 1440|  8.50k|#define PNG_CRC_QUIET_USE     4  /* quiet/use data      quiet/use data    */
  ------------------
  |  Branch (54:7): [True: 8.50k, False: 0]
  ------------------
   55|  8.50k|         png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
  ------------------
  |  |  705|  8.50k|#define PNG_FLAG_CRC_CRITICAL_MASK  (PNG_FLAG_CRC_CRITICAL_USE | \
  |  |  ------------------
  |  |  |  |  680|  8.50k|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  |  |  ------------------
  |  |  706|  8.50k|                                     PNG_FLAG_CRC_CRITICAL_IGNORE)
  |  |  ------------------
  |  |  |  |  681|  8.50k|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  |  |  ------------------
  ------------------
   56|  8.50k|         png_ptr->flags |= PNG_FLAG_CRC_CRITICAL_USE |
  ------------------
  |  |  680|  8.50k|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  ------------------
   57|  8.50k|                           PNG_FLAG_CRC_CRITICAL_IGNORE;
  ------------------
  |  |  681|  8.50k|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  ------------------
   58|  8.50k|         break;
   59|       |
   60|      0|      case PNG_CRC_WARN_DISCARD:    /* Not a valid action for critical data */
  ------------------
  |  | 1438|      0|#define PNG_CRC_WARN_DISCARD  2  /* (INVALID)           warn/discard data */
  ------------------
  |  Branch (60:7): [True: 0, False: 8.50k]
  ------------------
   61|      0|         png_warning(png_ptr,
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
   62|      0|             "Can't discard critical data on CRC error");
   63|       |         /* FALLTHROUGH */
   64|      0|      case PNG_CRC_ERROR_QUIT:                                /* Error/quit */
  ------------------
  |  | 1437|      0|#define PNG_CRC_ERROR_QUIT    1  /* error/quit          error/quit        */
  ------------------
  |  Branch (64:7): [True: 0, False: 8.50k]
  ------------------
   65|       |
   66|      0|      case PNG_CRC_DEFAULT:
  ------------------
  |  | 1436|      0|#define PNG_CRC_DEFAULT       0  /* error/quit          warn/discard data */
  ------------------
  |  Branch (66:7): [True: 0, False: 8.50k]
  ------------------
   67|      0|      default:
  ------------------
  |  Branch (67:7): [True: 0, False: 8.50k]
  ------------------
   68|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
  ------------------
  |  |  705|      0|#define PNG_FLAG_CRC_CRITICAL_MASK  (PNG_FLAG_CRC_CRITICAL_USE | \
  |  |  ------------------
  |  |  |  |  680|      0|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  |  |  ------------------
  |  |  706|      0|                                     PNG_FLAG_CRC_CRITICAL_IGNORE)
  |  |  ------------------
  |  |  |  |  681|      0|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  |  |  ------------------
  ------------------
   69|      0|         break;
   70|  8.50k|   }
   71|       |
   72|       |   /* Tell libpng how we react to CRC errors in ancillary chunks */
   73|  8.50k|   switch (ancil_action)
   74|  8.50k|   {
   75|      0|      case PNG_CRC_NO_CHANGE:                       /* Leave setting as is */
  ------------------
  |  | 1441|      0|#define PNG_CRC_NO_CHANGE     5  /* use current value   use current value */
  ------------------
  |  Branch (75:7): [True: 0, False: 8.50k]
  ------------------
   76|      0|         break;
   77|       |
   78|      0|      case PNG_CRC_WARN_USE:                              /* Warn/use data */
  ------------------
  |  | 1439|      0|#define PNG_CRC_WARN_USE      3  /* warn/use data       warn/use data     */
  ------------------
  |  Branch (78:7): [True: 0, False: 8.50k]
  ------------------
   79|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
  ------------------
  |  |  702|      0|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  678|      0|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  703|      0|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  679|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
   80|      0|         png_ptr->flags |= PNG_FLAG_CRC_ANCILLARY_USE;
  ------------------
  |  |  678|      0|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  ------------------
   81|      0|         break;
   82|       |
   83|  8.50k|      case PNG_CRC_QUIET_USE:                            /* Quiet/use data */
  ------------------
  |  | 1440|  8.50k|#define PNG_CRC_QUIET_USE     4  /* quiet/use data      quiet/use data    */
  ------------------
  |  Branch (83:7): [True: 8.50k, False: 0]
  ------------------
   84|  8.50k|         png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
  ------------------
  |  |  702|  8.50k|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  678|  8.50k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  703|  8.50k|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  679|  8.50k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
   85|  8.50k|         png_ptr->flags |= PNG_FLAG_CRC_ANCILLARY_USE |
  ------------------
  |  |  678|  8.50k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  ------------------
   86|  8.50k|                           PNG_FLAG_CRC_ANCILLARY_NOWARN;
  ------------------
  |  |  679|  8.50k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
   87|  8.50k|         break;
   88|       |
   89|      0|      case PNG_CRC_ERROR_QUIT:                               /* Error/quit */
  ------------------
  |  | 1437|      0|#define PNG_CRC_ERROR_QUIT    1  /* error/quit          error/quit        */
  ------------------
  |  Branch (89:7): [True: 0, False: 8.50k]
  ------------------
   90|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
  ------------------
  |  |  702|      0|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  678|      0|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  703|      0|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  679|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
   91|      0|         png_ptr->flags |= PNG_FLAG_CRC_ANCILLARY_NOWARN;
  ------------------
  |  |  679|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
   92|      0|         break;
   93|       |
   94|      0|      case PNG_CRC_WARN_DISCARD:                      /* Warn/discard data */
  ------------------
  |  | 1438|      0|#define PNG_CRC_WARN_DISCARD  2  /* (INVALID)           warn/discard data */
  ------------------
  |  Branch (94:7): [True: 0, False: 8.50k]
  ------------------
   95|       |
   96|      0|      case PNG_CRC_DEFAULT:
  ------------------
  |  | 1436|      0|#define PNG_CRC_DEFAULT       0  /* error/quit          warn/discard data */
  ------------------
  |  Branch (96:7): [True: 0, False: 8.50k]
  ------------------
   97|      0|      default:
  ------------------
  |  Branch (97:7): [True: 0, False: 8.50k]
  ------------------
   98|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
  ------------------
  |  |  702|      0|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  678|      0|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  703|      0|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  679|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
   99|      0|         break;
  100|  8.50k|   }
  101|  8.50k|}
OSS_FUZZ_png_set_scale_16:
  184|  1.81k|{
  185|  1.81k|   png_debug(1, "in png_set_scale_16");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
  186|       |
  187|  1.81k|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (187:8): [True: 0, False: 1.81k]
  ------------------
  188|      0|      return;
  189|       |
  190|  1.81k|   png_ptr->transformations |= PNG_SCALE_16_TO_8;
  ------------------
  |  |  660|  1.81k|#define PNG_SCALE_16_TO_8    0x4000000U /* Added to libpng-1.5.4 */
  ------------------
  191|  1.81k|}
OSS_FUZZ_png_set_expand:
  873|  1.81k|{
  874|  1.81k|   png_debug(1, "in png_set_expand");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
  875|       |
  876|  1.81k|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (876:8): [True: 0, False: 1.81k]
  ------------------
  877|      0|      return;
  878|       |
  879|  1.81k|   png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
  ------------------
  |  |  645|  1.81k|#define PNG_EXPAND              0x1000U
  ------------------
                 png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
  ------------------
  |  |  659|  1.81k|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  880|  1.81k|}
OSS_FUZZ_png_set_expand_gray_1_2_4_to_8:
  915|  1.81k|{
  916|  1.81k|   png_debug(1, "in png_set_expand_gray_1_2_4_to_8");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
  917|       |
  918|  1.81k|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (918:8): [True: 0, False: 1.81k]
  ------------------
  919|      0|      return;
  920|       |
  921|  1.81k|   png_ptr->transformations |= PNG_EXPAND;
  ------------------
  |  |  645|  1.81k|#define PNG_EXPAND              0x1000U
  ------------------
  922|  1.81k|}
OSS_FUZZ_png_set_tRNS_to_alpha:
  927|  1.81k|{
  928|  1.81k|   png_debug(1, "in png_set_tRNS_to_alpha");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
  929|       |
  930|  1.81k|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (930:8): [True: 0, False: 1.81k]
  ------------------
  931|      0|      return;
  932|       |
  933|  1.81k|   png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
  ------------------
  |  |  645|  1.81k|#define PNG_EXPAND              0x1000U
  ------------------
                 png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
  ------------------
  |  |  659|  1.81k|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  934|  1.81k|}
OSS_FUZZ_png_set_gray_to_rgb:
  956|  1.81k|{
  957|  1.81k|   png_debug(1, "in png_set_gray_to_rgb");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
  958|       |
  959|  1.81k|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (959:8): [True: 0, False: 1.81k]
  ------------------
  960|      0|      return;
  961|       |
  962|       |   /* Because rgb must be 8 bits or more: */
  963|  1.81k|   png_set_expand_gray_1_2_4_to_8(png_ptr);
  ------------------
  |  |  368|  1.81k|#define png_set_expand_gray_1_2_4_to_8 OSS_FUZZ_png_set_expand_gray_1_2_4_to_8
  ------------------
  964|  1.81k|   png_ptr->transformations |= PNG_GRAY_TO_RGB;
  ------------------
  |  |  647|  1.81k|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  965|  1.81k|}
OSS_FUZZ_png_init_read_transformations:
 1292|  1.81k|{
 1293|  1.81k|   png_debug(1, "in png_init_read_transformations");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
 1294|       |
 1295|       |   /* This internal function is called from png_read_start_row in pngrutil.c
 1296|       |    * and it is called before the 'rowbytes' calculation is done, so the code
 1297|       |    * in here can change or update the transformations flags.
 1298|       |    *
 1299|       |    * First do updates that do not depend on the details of the PNG image data
 1300|       |    * being processed.
 1301|       |    */
 1302|       |
 1303|  1.81k|#ifdef PNG_READ_GAMMA_SUPPORTED
 1304|       |   /* Prior to 1.5.4 these tests were performed from png_set_gamma, 1.5.4 adds
 1305|       |    * png_set_alpha_mode and this is another source for a default file gamma so
 1306|       |    * the test needs to be performed later - here.  In addition prior to 1.5.4
 1307|       |    * the tests were repeated for the PALETTE color type here - this is no
 1308|       |    * longer necessary (and doesn't seem to have been necessary before.)
 1309|       |    */
 1310|  1.81k|   {
 1311|       |      /* The following temporary indicates if overall gamma correction is
 1312|       |       * required.
 1313|       |       */
 1314|  1.81k|      int gamma_correction = 0;
 1315|       |
 1316|  1.81k|      if (png_ptr->colorspace.gamma != 0) /* has been set */
  ------------------
  |  Branch (1316:11): [True: 62, False: 1.75k]
  ------------------
 1317|     62|      {
 1318|     62|         if (png_ptr->screen_gamma != 0) /* screen set too */
  ------------------
  |  Branch (1318:14): [True: 0, False: 62]
  ------------------
 1319|      0|            gamma_correction = png_gamma_threshold(png_ptr->colorspace.gamma,
 1320|      0|                png_ptr->screen_gamma);
 1321|       |
 1322|     62|         else
 1323|       |            /* Assume the output matches the input; a long time default behavior
 1324|       |             * of libpng, although the standard has nothing to say about this.
 1325|       |             */
 1326|     62|            png_ptr->screen_gamma = png_reciprocal(png_ptr->colorspace.gamma);
  ------------------
  |  |  127|     62|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1327|     62|      }
 1328|       |
 1329|  1.75k|      else if (png_ptr->screen_gamma != 0)
  ------------------
  |  Branch (1329:16): [True: 0, False: 1.75k]
  ------------------
 1330|       |         /* The converse - assume the file matches the screen, note that this
 1331|       |          * perhaps undesirable default can (from 1.5.4) be changed by calling
 1332|       |          * png_set_alpha_mode (even if the alpha handling mode isn't required
 1333|       |          * or isn't changed from the default.)
 1334|       |          */
 1335|      0|         png_ptr->colorspace.gamma = png_reciprocal(png_ptr->screen_gamma);
  ------------------
  |  |  127|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1336|       |
 1337|  1.75k|      else /* neither are set */
 1338|       |         /* Just in case the following prevents any processing - file and screen
 1339|       |          * are both assumed to be linear and there is no way to introduce a
 1340|       |          * third gamma value other than png_set_background with 'UNIQUE', and,
 1341|       |          * prior to 1.5.4
 1342|       |          */
 1343|  1.75k|         png_ptr->screen_gamma = png_ptr->colorspace.gamma = PNG_FP_1;
  ------------------
  |  |  656|  1.75k|#define PNG_FP_1    100000
  ------------------
 1344|       |
 1345|       |      /* We have a gamma value now. */
 1346|  1.81k|      png_ptr->colorspace.flags |= PNG_COLORSPACE_HAVE_GAMMA;
  ------------------
  |  |  131|  1.81k|#define PNG_COLORSPACE_HAVE_GAMMA           0x0001
  ------------------
 1347|       |
 1348|       |      /* Now turn the gamma transformation on or off as appropriate.  Notice
 1349|       |       * that PNG_GAMMA just refers to the file->screen correction.  Alpha
 1350|       |       * composition may independently cause gamma correction because it needs
 1351|       |       * linear data (e.g. if the file has a gAMA chunk but the screen gamma
 1352|       |       * hasn't been specified.)  In any case this flag may get turned off in
 1353|       |       * the code immediately below if the transform can be handled outside the
 1354|       |       * row loop.
 1355|       |       */
 1356|  1.81k|      if (gamma_correction != 0)
  ------------------
  |  Branch (1356:11): [True: 0, False: 1.81k]
  ------------------
 1357|      0|         png_ptr->transformations |= PNG_GAMMA;
  ------------------
  |  |  646|      0|#define PNG_GAMMA               0x2000U
  ------------------
 1358|       |
 1359|  1.81k|      else
 1360|  1.81k|         png_ptr->transformations &= ~PNG_GAMMA;
  ------------------
  |  |  646|  1.81k|#define PNG_GAMMA               0x2000U
  ------------------
 1361|  1.81k|   }
 1362|  1.81k|#endif
 1363|       |
 1364|       |   /* Certain transformations have the effect of preventing other
 1365|       |    * transformations that happen afterward in png_do_read_transformations;
 1366|       |    * resolve the interdependencies here.  From the code of
 1367|       |    * png_do_read_transformations the order is:
 1368|       |    *
 1369|       |    *  1) PNG_EXPAND (including PNG_EXPAND_tRNS)
 1370|       |    *  2) PNG_STRIP_ALPHA (if no compose)
 1371|       |    *  3) PNG_RGB_TO_GRAY
 1372|       |    *  4) PNG_GRAY_TO_RGB iff !PNG_BACKGROUND_IS_GRAY
 1373|       |    *  5) PNG_COMPOSE
 1374|       |    *  6) PNG_GAMMA
 1375|       |    *  7) PNG_STRIP_ALPHA (if compose)
 1376|       |    *  8) PNG_ENCODE_ALPHA
 1377|       |    *  9) PNG_SCALE_16_TO_8
 1378|       |    * 10) PNG_16_TO_8
 1379|       |    * 11) PNG_QUANTIZE (converts to palette)
 1380|       |    * 12) PNG_EXPAND_16
 1381|       |    * 13) PNG_GRAY_TO_RGB iff PNG_BACKGROUND_IS_GRAY
 1382|       |    * 14) PNG_INVERT_MONO
 1383|       |    * 15) PNG_INVERT_ALPHA
 1384|       |    * 16) PNG_SHIFT
 1385|       |    * 17) PNG_PACK
 1386|       |    * 18) PNG_BGR
 1387|       |    * 19) PNG_PACKSWAP
 1388|       |    * 20) PNG_FILLER (includes PNG_ADD_ALPHA)
 1389|       |    * 21) PNG_SWAP_ALPHA
 1390|       |    * 22) PNG_SWAP_BYTES
 1391|       |    * 23) PNG_USER_TRANSFORM [must be last]
 1392|       |    */
 1393|  1.81k|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
 1394|  1.81k|   if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 &&
  ------------------
  |  |  651|  1.81k|#define PNG_STRIP_ALPHA        0x40000U
  ------------------
  |  Branch (1394:8): [True: 0, False: 1.81k]
  ------------------
 1395|  1.81k|       (png_ptr->transformations & PNG_COMPOSE) == 0)
  ------------------
  |  |  640|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1395:8): [True: 0, False: 0]
  ------------------
 1396|      0|   {
 1397|       |      /* Stripping the alpha channel happens immediately after the 'expand'
 1398|       |       * transformations, before all other transformation, so it cancels out
 1399|       |       * the alpha handling.  It has the side effect negating the effect of
 1400|       |       * PNG_EXPAND_tRNS too:
 1401|       |       */
 1402|      0|      png_ptr->transformations &= ~(PNG_BACKGROUND_EXPAND | PNG_ENCODE_ALPHA |
  ------------------
  |  |  641|      0|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
                    png_ptr->transformations &= ~(PNG_BACKGROUND_EXPAND | PNG_ENCODE_ALPHA |
  ------------------
  |  |  657|      0|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
 1403|      0|         PNG_EXPAND_tRNS);
  ------------------
  |  |  659|      0|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
 1404|      0|      png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
  ------------------
  |  |  683|      0|#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
  ------------------
 1405|       |
 1406|       |      /* Kill the tRNS chunk itself too.  Prior to 1.5.4 this did not happen
 1407|       |       * so transparency information would remain just so long as it wasn't
 1408|       |       * expanded.  This produces unexpected API changes if the set of things
 1409|       |       * that do PNG_EXPAND_tRNS changes (perfectly possible given the
 1410|       |       * documentation - which says ask for what you want, accept what you
 1411|       |       * get.)  This makes the behavior consistent from 1.5.4:
 1412|       |       */
 1413|      0|      png_ptr->num_trans = 0;
 1414|      0|   }
 1415|  1.81k|#endif /* STRIP_ALPHA supported, no COMPOSE */
 1416|       |
 1417|  1.81k|#ifdef PNG_READ_ALPHA_MODE_SUPPORTED
 1418|       |   /* If the screen gamma is about 1.0 then the OPTIMIZE_ALPHA and ENCODE_ALPHA
 1419|       |    * settings will have no effect.
 1420|       |    */
 1421|  1.81k|   if (png_gamma_significant(png_ptr->screen_gamma) == 0)
  ------------------
  |  |  129|  1.81k|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1421:8): [True: 1.76k, False: 49]
  ------------------
 1422|  1.76k|   {
 1423|  1.76k|      png_ptr->transformations &= ~PNG_ENCODE_ALPHA;
  ------------------
  |  |  657|  1.76k|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
 1424|  1.76k|      png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
  ------------------
  |  |  683|  1.76k|#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
  ------------------
 1425|  1.76k|   }
 1426|  1.81k|#endif
 1427|       |
 1428|  1.81k|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 1429|       |   /* Make sure the coefficients for the rgb to gray conversion are set
 1430|       |    * appropriately.
 1431|       |    */
 1432|  1.81k|   if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0)
  ------------------
  |  |  656|  1.81k|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (1432:8): [True: 0, False: 1.81k]
  ------------------
 1433|      0|      png_colorspace_set_rgb_coefficients(png_ptr);
  ------------------
  |  |  108|      0|#define png_colorspace_set_rgb_coefficients OSS_FUZZ_png_colorspace_set_rgb_coefficients
  ------------------
 1434|  1.81k|#endif
 1435|       |
 1436|  1.81k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 1437|  1.81k|#if defined(PNG_READ_EXPAND_SUPPORTED) && defined(PNG_READ_BACKGROUND_SUPPORTED)
 1438|       |   /* Detect gray background and attempt to enable optimization for
 1439|       |    * gray --> RGB case.
 1440|       |    *
 1441|       |    * Note:  if PNG_BACKGROUND_EXPAND is set and color_type is either RGB or
 1442|       |    * RGB_ALPHA (in which case need_expand is superfluous anyway), the
 1443|       |    * background color might actually be gray yet not be flagged as such.
 1444|       |    * This is not a problem for the current code, which uses
 1445|       |    * PNG_BACKGROUND_IS_GRAY only to decide when to do the
 1446|       |    * png_do_gray_to_rgb() transformation.
 1447|       |    *
 1448|       |    * TODO: this code needs to be revised to avoid the complexity and
 1449|       |    * interdependencies.  The color type of the background should be recorded in
 1450|       |    * png_set_background, along with the bit depth, then the code has a record
 1451|       |    * of exactly what color space the background is currently in.
 1452|       |    */
 1453|  1.81k|   if ((png_ptr->transformations & PNG_BACKGROUND_EXPAND) != 0)
  ------------------
  |  |  641|  1.81k|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
  |  Branch (1453:8): [True: 0, False: 1.81k]
  ------------------
 1454|      0|   {
 1455|       |      /* PNG_BACKGROUND_EXPAND: the background is in the file color space, so if
 1456|       |       * the file was grayscale the background value is gray.
 1457|       |       */
 1458|      0|      if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
  ------------------
  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (1458:11): [True: 0, False: 0]
  ------------------
 1459|      0|         png_ptr->mode |= PNG_BACKGROUND_IS_GRAY;
  ------------------
  |  |  626|      0|#define PNG_BACKGROUND_IS_GRAY     0x800U
  ------------------
 1460|      0|   }
 1461|       |
 1462|  1.81k|   else if ((png_ptr->transformations & PNG_COMPOSE) != 0)
  ------------------
  |  |  640|  1.81k|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1462:13): [True: 0, False: 1.81k]
  ------------------
 1463|      0|   {
 1464|       |      /* PNG_COMPOSE: png_set_background was called with need_expand false,
 1465|       |       * so the color is in the color space of the output or png_set_alpha_mode
 1466|       |       * was called and the color is black.  Ignore RGB_TO_GRAY because that
 1467|       |       * happens before GRAY_TO_RGB.
 1468|       |       */
 1469|      0|      if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0)
  ------------------
  |  |  647|      0|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (1469:11): [True: 0, False: 0]
  ------------------
 1470|      0|      {
 1471|      0|         if (png_ptr->background.red == png_ptr->background.green &&
  ------------------
  |  Branch (1471:14): [True: 0, False: 0]
  ------------------
 1472|      0|             png_ptr->background.red == png_ptr->background.blue)
  ------------------
  |  Branch (1472:14): [True: 0, False: 0]
  ------------------
 1473|      0|         {
 1474|      0|            png_ptr->mode |= PNG_BACKGROUND_IS_GRAY;
  ------------------
  |  |  626|      0|#define PNG_BACKGROUND_IS_GRAY     0x800U
  ------------------
 1475|      0|            png_ptr->background.gray = png_ptr->background.red;
 1476|      0|         }
 1477|      0|      }
 1478|      0|   }
 1479|  1.81k|#endif /* READ_EXPAND && READ_BACKGROUND */
 1480|  1.81k|#endif /* READ_GRAY_TO_RGB */
 1481|       |
 1482|       |   /* For indexed PNG data (PNG_COLOR_TYPE_PALETTE) many of the transformations
 1483|       |    * can be performed directly on the palette, and some (such as rgb to gray)
 1484|       |    * can be optimized inside the palette.  This is particularly true of the
 1485|       |    * composite (background and alpha) stuff, which can be pretty much all done
 1486|       |    * in the palette even if the result is expanded to RGB or gray afterward.
 1487|       |    *
 1488|       |    * NOTE: this is Not Yet Implemented, the code behaves as in 1.5.1 and
 1489|       |    * earlier and the palette stuff is actually handled on the first row.  This
 1490|       |    * leads to the reported bug that the palette returned by png_get_PLTE is not
 1491|       |    * updated.
 1492|       |    */
 1493|  1.81k|   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  1.81k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  1.81k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  1.81k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1493:8): [True: 173, False: 1.64k]
  ------------------
 1494|    173|      png_init_palette_transformations(png_ptr);
 1495|       |
 1496|  1.64k|   else
 1497|  1.64k|      png_init_rgb_transformations(png_ptr);
 1498|       |
 1499|  1.81k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) && \
 1500|  1.81k|   defined(PNG_READ_EXPAND_16_SUPPORTED)
 1501|  1.81k|   if ((png_ptr->transformations & PNG_EXPAND_16) != 0 &&
  ------------------
  |  |  642|  1.81k|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
  |  Branch (1501:8): [True: 0, False: 1.81k]
  ------------------
 1502|  1.81k|       (png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  640|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1502:8): [True: 0, False: 0]
  ------------------
 1503|  1.81k|       (png_ptr->transformations & PNG_BACKGROUND_EXPAND) == 0 &&
  ------------------
  |  |  641|      0|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
  |  Branch (1503:8): [True: 0, False: 0]
  ------------------
 1504|  1.81k|       png_ptr->bit_depth != 16)
  ------------------
  |  Branch (1504:8): [True: 0, False: 0]
  ------------------
 1505|      0|   {
 1506|       |      /* TODO: fix this.  Because the expand_16 operation is after the compose
 1507|       |       * handling the background color must be 8, not 16, bits deep, but the
 1508|       |       * application will supply a 16-bit value so reduce it here.
 1509|       |       *
 1510|       |       * The PNG_BACKGROUND_EXPAND code above does not expand to 16 bits at
 1511|       |       * present, so that case is ok (until do_expand_16 is moved.)
 1512|       |       *
 1513|       |       * NOTE: this discards the low 16 bits of the user supplied background
 1514|       |       * color, but until expand_16 works properly there is no choice!
 1515|       |       */
 1516|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
 1517|      0|      CHOP(png_ptr->background.red);
  ------------------
  |  | 1516|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
  |  |  ------------------
  |  |  |  |  726|      0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255)
  |  |  |  |  ------------------
  |  |  |  |  |  |  725|      0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16)
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1518|      0|      CHOP(png_ptr->background.green);
  ------------------
  |  | 1516|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
  |  |  ------------------
  |  |  |  |  726|      0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255)
  |  |  |  |  ------------------
  |  |  |  |  |  |  725|      0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16)
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1519|      0|      CHOP(png_ptr->background.blue);
  ------------------
  |  | 1516|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
  |  |  ------------------
  |  |  |  |  726|      0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255)
  |  |  |  |  ------------------
  |  |  |  |  |  |  725|      0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16)
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1520|      0|      CHOP(png_ptr->background.gray);
  ------------------
  |  | 1516|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
  |  |  ------------------
  |  |  |  |  726|      0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255)
  |  |  |  |  ------------------
  |  |  |  |  |  |  725|      0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16)
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1521|      0|#     undef CHOP
 1522|      0|   }
 1523|  1.81k|#endif /* READ_BACKGROUND && READ_EXPAND_16 */
 1524|       |
 1525|  1.81k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) && \
 1526|  1.81k|   (defined(PNG_READ_SCALE_16_TO_8_SUPPORTED) || \
 1527|  1.81k|   defined(PNG_READ_STRIP_16_TO_8_SUPPORTED))
 1528|  1.81k|   if ((png_ptr->transformations & (PNG_16_TO_8|PNG_SCALE_16_TO_8)) != 0 &&
  ------------------
  |  |  643|  1.81k|#define PNG_16_TO_8             0x0400U    /* Becomes 'chop' in 1.5.4 */
  ------------------
                 if ((png_ptr->transformations & (PNG_16_TO_8|PNG_SCALE_16_TO_8)) != 0 &&
  ------------------
  |  |  660|  1.81k|#define PNG_SCALE_16_TO_8    0x4000000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (1528:8): [True: 1.81k, False: 0]
  ------------------
 1529|  1.81k|       (png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  640|  1.81k|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1529:8): [True: 0, False: 1.81k]
  ------------------
 1530|  1.81k|       (png_ptr->transformations & PNG_BACKGROUND_EXPAND) == 0 &&
  ------------------
  |  |  641|      0|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
  |  Branch (1530:8): [True: 0, False: 0]
  ------------------
 1531|  1.81k|       png_ptr->bit_depth == 16)
  ------------------
  |  Branch (1531:8): [True: 0, False: 0]
  ------------------
 1532|      0|   {
 1533|       |      /* On the other hand, if a 16-bit file is to be reduced to 8-bits per
 1534|       |       * component this will also happen after PNG_COMPOSE and so the background
 1535|       |       * color must be pre-expanded here.
 1536|       |       *
 1537|       |       * TODO: fix this too.
 1538|       |       */
 1539|      0|      png_ptr->background.red = (png_uint_16)(png_ptr->background.red * 257);
 1540|      0|      png_ptr->background.green =
 1541|      0|         (png_uint_16)(png_ptr->background.green * 257);
 1542|      0|      png_ptr->background.blue = (png_uint_16)(png_ptr->background.blue * 257);
 1543|      0|      png_ptr->background.gray = (png_uint_16)(png_ptr->background.gray * 257);
 1544|      0|   }
 1545|  1.81k|#endif
 1546|       |
 1547|       |   /* NOTE: below 'PNG_READ_ALPHA_MODE_SUPPORTED' is presumed to also enable the
 1548|       |    * background support (see the comments in scripts/pnglibconf.dfa), this
 1549|       |    * allows pre-multiplication of the alpha channel to be implemented as
 1550|       |    * compositing on black.  This is probably sub-optimal and has been done in
 1551|       |    * 1.5.4 betas simply to enable external critique and testing (i.e. to
 1552|       |    * implement the new API quickly, without lots of internal changes.)
 1553|       |    */
 1554|       |
 1555|  1.81k|#ifdef PNG_READ_GAMMA_SUPPORTED
 1556|  1.81k|#  ifdef PNG_READ_BACKGROUND_SUPPORTED
 1557|       |      /* Includes ALPHA_MODE */
 1558|  1.81k|      png_ptr->background_1 = png_ptr->background;
 1559|  1.81k|#  endif
 1560|       |
 1561|       |   /* This needs to change - in the palette image case a whole set of tables are
 1562|       |    * built when it would be quicker to just calculate the correct value for
 1563|       |    * each palette entry directly.  Also, the test is too tricky - why check
 1564|       |    * PNG_RGB_TO_GRAY if PNG_GAMMA is not set?  The answer seems to be that
 1565|       |    * PNG_GAMMA is cancelled even if the gamma is known?  The test excludes the
 1566|       |    * PNG_COMPOSE case, so apparently if there is no *overall* gamma correction
 1567|       |    * the gamma tables will not be built even if composition is required on a
 1568|       |    * gamma encoded value.
 1569|       |    *
 1570|       |    * In 1.5.4 this is addressed below by an additional check on the individual
 1571|       |    * file gamma - if it is not 1.0 both RGB_TO_GRAY and COMPOSE need the
 1572|       |    * tables.
 1573|       |    */
 1574|  1.81k|   if ((png_ptr->transformations & PNG_GAMMA) != 0 ||
  ------------------
  |  |  646|  1.81k|#define PNG_GAMMA               0x2000U
  ------------------
  |  Branch (1574:8): [True: 0, False: 1.81k]
  ------------------
 1575|  1.81k|       ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0 &&
  ------------------
  |  |  656|  1.81k|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (1575:9): [True: 0, False: 1.81k]
  ------------------
 1576|  1.81k|        (png_gamma_significant(png_ptr->colorspace.gamma) != 0 ||
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1576:10): [True: 0, False: 0]
  ------------------
 1577|      0|         png_gamma_significant(png_ptr->screen_gamma) != 0)) ||
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1577:10): [True: 0, False: 0]
  ------------------
 1578|  1.81k|        ((png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  640|  1.81k|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1578:10): [True: 0, False: 1.81k]
  ------------------
 1579|  1.81k|         (png_gamma_significant(png_ptr->colorspace.gamma) != 0 ||
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1579:11): [True: 0, False: 0]
  ------------------
 1580|      0|          png_gamma_significant(png_ptr->screen_gamma) != 0
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1580:11): [True: 0, False: 0]
  ------------------
 1581|      0|#  ifdef PNG_READ_BACKGROUND_SUPPORTED
 1582|      0|         || (png_ptr->background_gamma_type == PNG_BACKGROUND_GAMMA_UNIQUE &&
  ------------------
  |  | 1310|      0|#  define PNG_BACKGROUND_GAMMA_UNIQUE  3
  ------------------
  |  Branch (1582:14): [True: 0, False: 0]
  ------------------
 1583|      0|           png_gamma_significant(png_ptr->background_gamma) != 0)
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1583:12): [True: 0, False: 0]
  ------------------
 1584|      0|#  endif
 1585|  1.81k|        )) || ((png_ptr->transformations & PNG_ENCODE_ALPHA) != 0 &&
  ------------------
  |  |  657|  1.81k|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (1585:16): [True: 0, False: 1.81k]
  ------------------
 1586|  1.81k|       png_gamma_significant(png_ptr->screen_gamma) != 0))
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1586:8): [True: 0, False: 0]
  ------------------
 1587|      0|   {
 1588|      0|      png_build_gamma_table(png_ptr, png_ptr->bit_depth);
  ------------------
  |  |  134|      0|#define png_build_gamma_table OSS_FUZZ_png_build_gamma_table
  ------------------
 1589|       |
 1590|      0|#ifdef PNG_READ_BACKGROUND_SUPPORTED
 1591|      0|      if ((png_ptr->transformations & PNG_COMPOSE) != 0)
  ------------------
  |  |  640|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1591:11): [True: 0, False: 0]
  ------------------
 1592|      0|      {
 1593|       |         /* Issue a warning about this combination: because RGB_TO_GRAY is
 1594|       |          * optimized to do the gamma transform if present yet do_background has
 1595|       |          * to do the same thing if both options are set a
 1596|       |          * double-gamma-correction happens.  This is true in all versions of
 1597|       |          * libpng to date.
 1598|       |          */
 1599|      0|         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0)
  ------------------
  |  |  656|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (1599:14): [True: 0, False: 0]
  ------------------
 1600|      0|            png_warning(png_ptr,
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1601|      0|                "libpng does not support gamma+background+rgb_to_gray");
 1602|       |
 1603|      0|         if ((png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) != 0)
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1603:14): [True: 0, False: 0]
  ------------------
 1604|      0|         {
 1605|       |            /* We don't get to here unless there is a tRNS chunk with non-opaque
 1606|       |             * entries - see the checking code at the start of this function.
 1607|       |             */
 1608|      0|            png_color back, back_1;
 1609|      0|            png_colorp palette = png_ptr->palette;
 1610|      0|            int num_palette = png_ptr->num_palette;
 1611|      0|            int i;
 1612|      0|            if (png_ptr->background_gamma_type == PNG_BACKGROUND_GAMMA_FILE)
  ------------------
  |  | 1309|      0|#  define PNG_BACKGROUND_GAMMA_FILE    2
  ------------------
  |  Branch (1612:17): [True: 0, False: 0]
  ------------------
 1613|      0|            {
 1614|       |
 1615|      0|               back.red = png_ptr->gamma_table[png_ptr->background.red];
 1616|      0|               back.green = png_ptr->gamma_table[png_ptr->background.green];
 1617|      0|               back.blue = png_ptr->gamma_table[png_ptr->background.blue];
 1618|       |
 1619|      0|               back_1.red = png_ptr->gamma_to_1[png_ptr->background.red];
 1620|      0|               back_1.green = png_ptr->gamma_to_1[png_ptr->background.green];
 1621|      0|               back_1.blue = png_ptr->gamma_to_1[png_ptr->background.blue];
 1622|      0|            }
 1623|      0|            else
 1624|      0|            {
 1625|      0|               png_fixed_point g, gs;
 1626|       |
 1627|      0|               switch (png_ptr->background_gamma_type)
 1628|      0|               {
 1629|      0|                  case PNG_BACKGROUND_GAMMA_SCREEN:
  ------------------
  |  | 1308|      0|#  define PNG_BACKGROUND_GAMMA_SCREEN  1
  ------------------
  |  Branch (1629:19): [True: 0, False: 0]
  ------------------
 1630|      0|                     g = (png_ptr->screen_gamma);
 1631|      0|                     gs = PNG_FP_1;
  ------------------
  |  |  656|      0|#define PNG_FP_1    100000
  ------------------
 1632|      0|                     break;
 1633|       |
 1634|      0|                  case PNG_BACKGROUND_GAMMA_FILE:
  ------------------
  |  | 1309|      0|#  define PNG_BACKGROUND_GAMMA_FILE    2
  ------------------
  |  Branch (1634:19): [True: 0, False: 0]
  ------------------
 1635|      0|                     g = png_reciprocal(png_ptr->colorspace.gamma);
  ------------------
  |  |  127|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1636|      0|                     gs = png_reciprocal2(png_ptr->colorspace.gamma,
  ------------------
  |  |  128|      0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2
  ------------------
 1637|      0|                         png_ptr->screen_gamma);
 1638|      0|                     break;
 1639|       |
 1640|      0|                  case PNG_BACKGROUND_GAMMA_UNIQUE:
  ------------------
  |  | 1310|      0|#  define PNG_BACKGROUND_GAMMA_UNIQUE  3
  ------------------
  |  Branch (1640:19): [True: 0, False: 0]
  ------------------
 1641|      0|                     g = png_reciprocal(png_ptr->background_gamma);
  ------------------
  |  |  127|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1642|      0|                     gs = png_reciprocal2(png_ptr->background_gamma,
  ------------------
  |  |  128|      0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2
  ------------------
 1643|      0|                         png_ptr->screen_gamma);
 1644|      0|                     break;
 1645|      0|                  default:
  ------------------
  |  Branch (1645:19): [True: 0, False: 0]
  ------------------
 1646|      0|                     g = PNG_FP_1;    /* back_1 */
  ------------------
  |  |  656|      0|#define PNG_FP_1    100000
  ------------------
 1647|      0|                     gs = PNG_FP_1;   /* back */
  ------------------
  |  |  656|      0|#define PNG_FP_1    100000
  ------------------
 1648|      0|                     break;
 1649|      0|               }
 1650|       |
 1651|      0|               if (png_gamma_significant(gs) != 0)
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1651:20): [True: 0, False: 0]
  ------------------
 1652|      0|               {
 1653|      0|                  back.red = png_gamma_8bit_correct(png_ptr->background.red,
  ------------------
  |  |  132|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1654|      0|                      gs);
 1655|      0|                  back.green = png_gamma_8bit_correct(png_ptr->background.green,
  ------------------
  |  |  132|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1656|      0|                      gs);
 1657|      0|                  back.blue = png_gamma_8bit_correct(png_ptr->background.blue,
  ------------------
  |  |  132|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1658|      0|                      gs);
 1659|      0|               }
 1660|       |
 1661|      0|               else
 1662|      0|               {
 1663|      0|                  back.red   = (png_byte)png_ptr->background.red;
 1664|      0|                  back.green = (png_byte)png_ptr->background.green;
 1665|      0|                  back.blue  = (png_byte)png_ptr->background.blue;
 1666|      0|               }
 1667|       |
 1668|      0|               if (png_gamma_significant(g) != 0)
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1668:20): [True: 0, False: 0]
  ------------------
 1669|      0|               {
 1670|      0|                  back_1.red = png_gamma_8bit_correct(png_ptr->background.red,
  ------------------
  |  |  132|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1671|      0|                      g);
 1672|      0|                  back_1.green = png_gamma_8bit_correct(
  ------------------
  |  |  132|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1673|      0|                      png_ptr->background.green, g);
 1674|      0|                  back_1.blue = png_gamma_8bit_correct(png_ptr->background.blue,
  ------------------
  |  |  132|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1675|      0|                      g);
 1676|      0|               }
 1677|       |
 1678|      0|               else
 1679|      0|               {
 1680|      0|                  back_1.red   = (png_byte)png_ptr->background.red;
 1681|      0|                  back_1.green = (png_byte)png_ptr->background.green;
 1682|      0|                  back_1.blue  = (png_byte)png_ptr->background.blue;
 1683|      0|               }
 1684|      0|            }
 1685|       |
 1686|      0|            for (i = 0; i < num_palette; i++)
  ------------------
  |  Branch (1686:25): [True: 0, False: 0]
  ------------------
 1687|      0|            {
 1688|      0|               if (i < (int)png_ptr->num_trans &&
  ------------------
  |  Branch (1688:20): [True: 0, False: 0]
  ------------------
 1689|      0|                   png_ptr->trans_alpha[i] != 0xff)
  ------------------
  |  Branch (1689:20): [True: 0, False: 0]
  ------------------
 1690|      0|               {
 1691|      0|                  if (png_ptr->trans_alpha[i] == 0)
  ------------------
  |  Branch (1691:23): [True: 0, False: 0]
  ------------------
 1692|      0|                  {
 1693|      0|                     palette[i] = back;
 1694|      0|                  }
 1695|      0|                  else /* if (png_ptr->trans_alpha[i] != 0xff) */
 1696|      0|                  {
 1697|      0|                     png_byte v, w;
 1698|       |
 1699|      0|                     v = png_ptr->gamma_to_1[palette[i].red];
 1700|      0|                     png_composite(w, v, png_ptr->trans_alpha[i], back_1.red);
  ------------------
  |  | 2511|      0|   {                                                     \
  |  | 2512|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2513|      0|          * (png_uint_16)(alpha)                         \
  |  | 2514|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2515|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2516|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2517|      0|   }
  ------------------
 1701|      0|                     palette[i].red = png_ptr->gamma_from_1[w];
 1702|       |
 1703|      0|                     v = png_ptr->gamma_to_1[palette[i].green];
 1704|      0|                     png_composite(w, v, png_ptr->trans_alpha[i], back_1.green);
  ------------------
  |  | 2511|      0|   {                                                     \
  |  | 2512|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2513|      0|          * (png_uint_16)(alpha)                         \
  |  | 2514|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2515|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2516|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2517|      0|   }
  ------------------
 1705|      0|                     palette[i].green = png_ptr->gamma_from_1[w];
 1706|       |
 1707|      0|                     v = png_ptr->gamma_to_1[palette[i].blue];
 1708|      0|                     png_composite(w, v, png_ptr->trans_alpha[i], back_1.blue);
  ------------------
  |  | 2511|      0|   {                                                     \
  |  | 2512|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2513|      0|          * (png_uint_16)(alpha)                         \
  |  | 2514|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2515|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2516|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2517|      0|   }
  ------------------
 1709|      0|                     palette[i].blue = png_ptr->gamma_from_1[w];
 1710|      0|                  }
 1711|      0|               }
 1712|      0|               else
 1713|      0|               {
 1714|      0|                  palette[i].red = png_ptr->gamma_table[palette[i].red];
 1715|      0|                  palette[i].green = png_ptr->gamma_table[palette[i].green];
 1716|      0|                  palette[i].blue = png_ptr->gamma_table[palette[i].blue];
 1717|      0|               }
 1718|      0|            }
 1719|       |
 1720|       |            /* Prevent the transformations being done again.
 1721|       |             *
 1722|       |             * NOTE: this is highly dubious; it removes the transformations in
 1723|       |             * place.  This seems inconsistent with the general treatment of the
 1724|       |             * transformations elsewhere.
 1725|       |             */
 1726|      0|            png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA);
  ------------------
  |  |  640|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
                          png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA);
  ------------------
  |  |  646|      0|#define PNG_GAMMA               0x2000U
  ------------------
 1727|      0|         } /* color_type == PNG_COLOR_TYPE_PALETTE */
 1728|       |
 1729|       |         /* if (png_ptr->background_gamma_type!=PNG_BACKGROUND_GAMMA_UNKNOWN) */
 1730|      0|         else /* color_type != PNG_COLOR_TYPE_PALETTE */
 1731|      0|         {
 1732|      0|            int gs_sig, g_sig;
 1733|      0|            png_fixed_point g = PNG_FP_1;  /* Correction to linear */
  ------------------
  |  |  656|      0|#define PNG_FP_1    100000
  ------------------
 1734|      0|            png_fixed_point gs = PNG_FP_1; /* Correction to screen */
  ------------------
  |  |  656|      0|#define PNG_FP_1    100000
  ------------------
 1735|       |
 1736|      0|            switch (png_ptr->background_gamma_type)
 1737|      0|            {
 1738|      0|               case PNG_BACKGROUND_GAMMA_SCREEN:
  ------------------
  |  | 1308|      0|#  define PNG_BACKGROUND_GAMMA_SCREEN  1
  ------------------
  |  Branch (1738:16): [True: 0, False: 0]
  ------------------
 1739|      0|                  g = png_ptr->screen_gamma;
 1740|       |                  /* gs = PNG_FP_1; */
 1741|      0|                  break;
 1742|       |
 1743|      0|               case PNG_BACKGROUND_GAMMA_FILE:
  ------------------
  |  | 1309|      0|#  define PNG_BACKGROUND_GAMMA_FILE    2
  ------------------
  |  Branch (1743:16): [True: 0, False: 0]
  ------------------
 1744|      0|                  g = png_reciprocal(png_ptr->colorspace.gamma);
  ------------------
  |  |  127|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1745|      0|                  gs = png_reciprocal2(png_ptr->colorspace.gamma,
  ------------------
  |  |  128|      0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2
  ------------------
 1746|      0|                      png_ptr->screen_gamma);
 1747|      0|                  break;
 1748|       |
 1749|      0|               case PNG_BACKGROUND_GAMMA_UNIQUE:
  ------------------
  |  | 1310|      0|#  define PNG_BACKGROUND_GAMMA_UNIQUE  3
  ------------------
  |  Branch (1749:16): [True: 0, False: 0]
  ------------------
 1750|      0|                  g = png_reciprocal(png_ptr->background_gamma);
  ------------------
  |  |  127|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1751|      0|                  gs = png_reciprocal2(png_ptr->background_gamma,
  ------------------
  |  |  128|      0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2
  ------------------
 1752|      0|                      png_ptr->screen_gamma);
 1753|      0|                  break;
 1754|       |
 1755|      0|               default:
  ------------------
  |  Branch (1755:16): [True: 0, False: 0]
  ------------------
 1756|      0|                  png_error(png_ptr, "invalid background gamma type");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 1757|      0|            }
 1758|       |
 1759|      0|            g_sig = png_gamma_significant(g);
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
 1760|      0|            gs_sig = png_gamma_significant(gs);
  ------------------
  |  |  129|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
 1761|       |
 1762|      0|            if (g_sig != 0)
  ------------------
  |  Branch (1762:17): [True: 0, False: 0]
  ------------------
 1763|      0|               png_ptr->background_1.gray = png_gamma_correct(png_ptr,
  ------------------
  |  |  130|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1764|      0|                   png_ptr->background.gray, g);
 1765|       |
 1766|      0|            if (gs_sig != 0)
  ------------------
  |  Branch (1766:17): [True: 0, False: 0]
  ------------------
 1767|      0|               png_ptr->background.gray = png_gamma_correct(png_ptr,
  ------------------
  |  |  130|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1768|      0|                   png_ptr->background.gray, gs);
 1769|       |
 1770|      0|            if ((png_ptr->background.red != png_ptr->background.green) ||
  ------------------
  |  Branch (1770:17): [True: 0, False: 0]
  ------------------
 1771|      0|                (png_ptr->background.red != png_ptr->background.blue) ||
  ------------------
  |  Branch (1771:17): [True: 0, False: 0]
  ------------------
 1772|      0|                (png_ptr->background.red != png_ptr->background.gray))
  ------------------
  |  Branch (1772:17): [True: 0, False: 0]
  ------------------
 1773|      0|            {
 1774|       |               /* RGB or RGBA with color background */
 1775|      0|               if (g_sig != 0)
  ------------------
  |  Branch (1775:20): [True: 0, False: 0]
  ------------------
 1776|      0|               {
 1777|      0|                  png_ptr->background_1.red = png_gamma_correct(png_ptr,
  ------------------
  |  |  130|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1778|      0|                      png_ptr->background.red, g);
 1779|       |
 1780|      0|                  png_ptr->background_1.green = png_gamma_correct(png_ptr,
  ------------------
  |  |  130|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1781|      0|                      png_ptr->background.green, g);
 1782|       |
 1783|      0|                  png_ptr->background_1.blue = png_gamma_correct(png_ptr,
  ------------------
  |  |  130|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1784|      0|                      png_ptr->background.blue, g);
 1785|      0|               }
 1786|       |
 1787|      0|               if (gs_sig != 0)
  ------------------
  |  Branch (1787:20): [True: 0, False: 0]
  ------------------
 1788|      0|               {
 1789|      0|                  png_ptr->background.red = png_gamma_correct(png_ptr,
  ------------------
  |  |  130|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1790|      0|                      png_ptr->background.red, gs);
 1791|       |
 1792|      0|                  png_ptr->background.green = png_gamma_correct(png_ptr,
  ------------------
  |  |  130|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1793|      0|                      png_ptr->background.green, gs);
 1794|       |
 1795|      0|                  png_ptr->background.blue = png_gamma_correct(png_ptr,
  ------------------
  |  |  130|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1796|      0|                      png_ptr->background.blue, gs);
 1797|      0|               }
 1798|      0|            }
 1799|       |
 1800|      0|            else
 1801|      0|            {
 1802|       |               /* GRAY, GRAY ALPHA, RGB, or RGBA with gray background */
 1803|      0|               png_ptr->background_1.red = png_ptr->background_1.green
 1804|      0|                   = png_ptr->background_1.blue = png_ptr->background_1.gray;
 1805|       |
 1806|      0|               png_ptr->background.red = png_ptr->background.green
 1807|      0|                   = png_ptr->background.blue = png_ptr->background.gray;
 1808|      0|            }
 1809|       |
 1810|       |            /* The background is now in screen gamma: */
 1811|      0|            png_ptr->background_gamma_type = PNG_BACKGROUND_GAMMA_SCREEN;
  ------------------
  |  | 1308|      0|#  define PNG_BACKGROUND_GAMMA_SCREEN  1
  ------------------
 1812|      0|         } /* color_type != PNG_COLOR_TYPE_PALETTE */
 1813|      0|      }/* png_ptr->transformations & PNG_BACKGROUND */
 1814|       |
 1815|      0|      else
 1816|       |      /* Transformation does not include PNG_BACKGROUND */
 1817|      0|#endif /* READ_BACKGROUND */
 1818|      0|      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1818:11): [True: 0, False: 0]
  ------------------
 1819|      0|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 1820|       |         /* RGB_TO_GRAY needs to have non-gamma-corrected values! */
 1821|      0|         && ((png_ptr->transformations & PNG_EXPAND) == 0 ||
  ------------------
  |  |  645|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (1821:14): [True: 0, False: 0]
  ------------------
 1822|      0|         (png_ptr->transformations & PNG_RGB_TO_GRAY) == 0)
  ------------------
  |  |  656|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (1822:10): [True: 0, False: 0]
  ------------------
 1823|      0|#endif
 1824|      0|         )
 1825|      0|      {
 1826|      0|         png_colorp palette = png_ptr->palette;
 1827|      0|         int num_palette = png_ptr->num_palette;
 1828|      0|         int i;
 1829|       |
 1830|       |         /* NOTE: there are other transformations that should probably be in
 1831|       |          * here too.
 1832|       |          */
 1833|      0|         for (i = 0; i < num_palette; i++)
  ------------------
  |  Branch (1833:22): [True: 0, False: 0]
  ------------------
 1834|      0|         {
 1835|      0|            palette[i].red = png_ptr->gamma_table[palette[i].red];
 1836|      0|            palette[i].green = png_ptr->gamma_table[palette[i].green];
 1837|      0|            palette[i].blue = png_ptr->gamma_table[palette[i].blue];
 1838|      0|         }
 1839|       |
 1840|       |         /* Done the gamma correction. */
 1841|      0|         png_ptr->transformations &= ~PNG_GAMMA;
  ------------------
  |  |  646|      0|#define PNG_GAMMA               0x2000U
  ------------------
 1842|      0|      } /* color_type == PALETTE && !PNG_BACKGROUND transformation */
 1843|      0|   }
 1844|  1.81k|#ifdef PNG_READ_BACKGROUND_SUPPORTED
 1845|  1.81k|   else
 1846|  1.81k|#endif
 1847|  1.81k|#endif /* READ_GAMMA */
 1848|       |
 1849|  1.81k|#ifdef PNG_READ_BACKGROUND_SUPPORTED
 1850|       |   /* No GAMMA transformation (see the hanging else 4 lines above) */
 1851|  1.81k|   if ((png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  640|  1.81k|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1851:8): [True: 0, False: 1.81k]
  ------------------
 1852|  1.81k|       (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE))
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1852:8): [True: 0, False: 0]
  ------------------
 1853|      0|   {
 1854|      0|      int i;
 1855|      0|      int istop = (int)png_ptr->num_trans;
 1856|      0|      png_color back;
 1857|      0|      png_colorp palette = png_ptr->palette;
 1858|       |
 1859|      0|      back.red   = (png_byte)png_ptr->background.red;
 1860|      0|      back.green = (png_byte)png_ptr->background.green;
 1861|      0|      back.blue  = (png_byte)png_ptr->background.blue;
 1862|       |
 1863|      0|      for (i = 0; i < istop; i++)
  ------------------
  |  Branch (1863:19): [True: 0, False: 0]
  ------------------
 1864|      0|      {
 1865|      0|         if (png_ptr->trans_alpha[i] == 0)
  ------------------
  |  Branch (1865:14): [True: 0, False: 0]
  ------------------
 1866|      0|         {
 1867|      0|            palette[i] = back;
 1868|      0|         }
 1869|       |
 1870|      0|         else if (png_ptr->trans_alpha[i] != 0xff)
  ------------------
  |  Branch (1870:19): [True: 0, False: 0]
  ------------------
 1871|      0|         {
 1872|       |            /* The png_composite() macro is defined in png.h */
 1873|      0|            png_composite(palette[i].red, palette[i].red,
  ------------------
  |  | 2511|      0|   {                                                     \
  |  | 2512|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2513|      0|          * (png_uint_16)(alpha)                         \
  |  | 2514|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2515|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2516|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2517|      0|   }
  ------------------
 1874|      0|                png_ptr->trans_alpha[i], back.red);
 1875|       |
 1876|      0|            png_composite(palette[i].green, palette[i].green,
  ------------------
  |  | 2511|      0|   {                                                     \
  |  | 2512|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2513|      0|          * (png_uint_16)(alpha)                         \
  |  | 2514|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2515|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2516|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2517|      0|   }
  ------------------
 1877|      0|                png_ptr->trans_alpha[i], back.green);
 1878|       |
 1879|      0|            png_composite(palette[i].blue, palette[i].blue,
  ------------------
  |  | 2511|      0|   {                                                     \
  |  | 2512|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2513|      0|          * (png_uint_16)(alpha)                         \
  |  | 2514|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2515|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2516|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2517|      0|   }
  ------------------
 1880|      0|                png_ptr->trans_alpha[i], back.blue);
 1881|      0|         }
 1882|      0|      }
 1883|       |
 1884|      0|      png_ptr->transformations &= ~PNG_COMPOSE;
  ------------------
  |  |  640|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
 1885|      0|   }
 1886|  1.81k|#endif /* READ_BACKGROUND */
 1887|       |
 1888|  1.81k|#ifdef PNG_READ_SHIFT_SUPPORTED
 1889|  1.81k|   if ((png_ptr->transformations & PNG_SHIFT) != 0 &&
  ------------------
  |  |  636|  1.81k|#define PNG_SHIFT               0x0008U
  ------------------
  |  Branch (1889:8): [True: 0, False: 1.81k]
  ------------------
 1890|  1.81k|       (png_ptr->transformations & PNG_EXPAND) == 0 &&
  ------------------
  |  |  645|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (1890:8): [True: 0, False: 0]
  ------------------
 1891|  1.81k|       (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE))
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1891:8): [True: 0, False: 0]
  ------------------
 1892|      0|   {
 1893|      0|      int i;
 1894|      0|      int istop = png_ptr->num_palette;
 1895|      0|      int shift = 8 - png_ptr->sig_bit.red;
 1896|       |
 1897|      0|      png_ptr->transformations &= ~PNG_SHIFT;
  ------------------
  |  |  636|      0|#define PNG_SHIFT               0x0008U
  ------------------
 1898|       |
 1899|       |      /* significant bits can be in the range 1 to 7 for a meaningful result, if
 1900|       |       * the number of significant bits is 0 then no shift is done (this is an
 1901|       |       * error condition which is silently ignored.)
 1902|       |       */
 1903|      0|      if (shift > 0 && shift < 8)
  ------------------
  |  Branch (1903:11): [True: 0, False: 0]
  |  Branch (1903:24): [True: 0, False: 0]
  ------------------
 1904|      0|         for (i=0; i<istop; ++i)
  ------------------
  |  Branch (1904:20): [True: 0, False: 0]
  ------------------
 1905|      0|         {
 1906|      0|            int component = png_ptr->palette[i].red;
 1907|       |
 1908|      0|            component >>= shift;
 1909|      0|            png_ptr->palette[i].red = (png_byte)component;
 1910|      0|         }
 1911|       |
 1912|      0|      shift = 8 - png_ptr->sig_bit.green;
 1913|      0|      if (shift > 0 && shift < 8)
  ------------------
  |  Branch (1913:11): [True: 0, False: 0]
  |  Branch (1913:24): [True: 0, False: 0]
  ------------------
 1914|      0|         for (i=0; i<istop; ++i)
  ------------------
  |  Branch (1914:20): [True: 0, False: 0]
  ------------------
 1915|      0|         {
 1916|      0|            int component = png_ptr->palette[i].green;
 1917|       |
 1918|      0|            component >>= shift;
 1919|      0|            png_ptr->palette[i].green = (png_byte)component;
 1920|      0|         }
 1921|       |
 1922|      0|      shift = 8 - png_ptr->sig_bit.blue;
 1923|      0|      if (shift > 0 && shift < 8)
  ------------------
  |  Branch (1923:11): [True: 0, False: 0]
  |  Branch (1923:24): [True: 0, False: 0]
  ------------------
 1924|      0|         for (i=0; i<istop; ++i)
  ------------------
  |  Branch (1924:20): [True: 0, False: 0]
  ------------------
 1925|      0|         {
 1926|      0|            int component = png_ptr->palette[i].blue;
 1927|       |
 1928|      0|            component >>= shift;
 1929|      0|            png_ptr->palette[i].blue = (png_byte)component;
 1930|      0|         }
 1931|      0|   }
 1932|  1.81k|#endif /* READ_SHIFT */
 1933|  1.81k|}
OSS_FUZZ_png_read_transform_info:
 1941|  1.81k|{
 1942|  1.81k|   png_debug(1, "in png_read_transform_info");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
 1943|       |
 1944|  1.81k|#ifdef PNG_READ_EXPAND_SUPPORTED
 1945|  1.81k|   if ((png_ptr->transformations & PNG_EXPAND) != 0)
  ------------------
  |  |  645|  1.81k|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (1945:8): [True: 1.81k, False: 0]
  ------------------
 1946|  1.81k|   {
 1947|  1.81k|      if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  1.81k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  1.81k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  1.81k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1947:11): [True: 171, False: 1.64k]
  ------------------
 1948|    171|      {
 1949|       |         /* This check must match what actually happens in
 1950|       |          * png_do_expand_palette; if it ever checks the tRNS chunk to see if
 1951|       |          * it is all opaque we must do the same (at present it does not.)
 1952|       |          */
 1953|    171|         if (png_ptr->num_trans > 0)
  ------------------
  |  Branch (1953:14): [True: 72, False: 99]
  ------------------
 1954|     72|            info_ptr->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
  ------------------
  |  |  671|     72|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|     72|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|     72|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
 1955|       |
 1956|     99|         else
 1957|     99|            info_ptr->color_type = PNG_COLOR_TYPE_RGB;
  ------------------
  |  |  670|     99|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|     99|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
 1958|       |
 1959|    171|         info_ptr->bit_depth = 8;
 1960|    171|         info_ptr->num_trans = 0;
 1961|       |
 1962|    171|         if (png_ptr->palette == NULL)
  ------------------
  |  Branch (1962:14): [True: 0, False: 171]
  ------------------
 1963|      0|            png_error (png_ptr, "Palette is NULL in indexed image");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 1964|    171|      }
 1965|  1.64k|      else
 1966|  1.64k|      {
 1967|  1.64k|         if (png_ptr->num_trans != 0)
  ------------------
  |  Branch (1967:14): [True: 278, False: 1.36k]
  ------------------
 1968|    278|         {
 1969|    278|            if ((png_ptr->transformations & PNG_EXPAND_tRNS) != 0)
  ------------------
  |  |  659|    278|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  |  Branch (1969:17): [True: 278, False: 0]
  ------------------
 1970|    278|               info_ptr->color_type |= PNG_COLOR_MASK_ALPHA;
  ------------------
  |  |  665|    278|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
 1971|    278|         }
 1972|  1.64k|         if (info_ptr->bit_depth < 8)
  ------------------
  |  Branch (1972:14): [True: 1.01k, False: 624]
  ------------------
 1973|  1.01k|            info_ptr->bit_depth = 8;
 1974|       |
 1975|  1.64k|         info_ptr->num_trans = 0;
 1976|  1.64k|      }
 1977|  1.81k|   }
 1978|  1.81k|#endif
 1979|       |
 1980|  1.81k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\
 1981|  1.81k|   defined(PNG_READ_ALPHA_MODE_SUPPORTED)
 1982|       |   /* The following is almost certainly wrong unless the background value is in
 1983|       |    * the screen space!
 1984|       |    */
 1985|  1.81k|   if ((png_ptr->transformations & PNG_COMPOSE) != 0)
  ------------------
  |  |  640|  1.81k|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1985:8): [True: 0, False: 1.81k]
  ------------------
 1986|      0|      info_ptr->background = png_ptr->background;
 1987|  1.81k|#endif
 1988|       |
 1989|  1.81k|#ifdef PNG_READ_GAMMA_SUPPORTED
 1990|       |   /* The following used to be conditional on PNG_GAMMA (prior to 1.5.4),
 1991|       |    * however it seems that the code in png_init_read_transformations, which has
 1992|       |    * been called before this from png_read_update_info->png_read_start_row
 1993|       |    * sometimes does the gamma transform and cancels the flag.
 1994|       |    *
 1995|       |    * TODO: this looks wrong; the info_ptr should end up with a gamma equal to
 1996|       |    * the screen_gamma value.  The following probably results in weirdness if
 1997|       |    * the info_ptr is used by the app after the rows have been read.
 1998|       |    */
 1999|  1.81k|   info_ptr->colorspace.gamma = png_ptr->colorspace.gamma;
 2000|  1.81k|#endif
 2001|       |
 2002|  1.81k|   if (info_ptr->bit_depth == 16)
  ------------------
  |  Branch (2002:8): [True: 371, False: 1.44k]
  ------------------
 2003|    371|   {
 2004|    371|#  ifdef PNG_READ_16BIT_SUPPORTED
 2005|    371|#     ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
 2006|    371|         if ((png_ptr->transformations & PNG_SCALE_16_TO_8) != 0)
  ------------------
  |  |  660|    371|#define PNG_SCALE_16_TO_8    0x4000000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (2006:14): [True: 371, False: 0]
  ------------------
 2007|    371|            info_ptr->bit_depth = 8;
 2008|    371|#     endif
 2009|       |
 2010|    371|#     ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED
 2011|    371|         if ((png_ptr->transformations & PNG_16_TO_8) != 0)
  ------------------
  |  |  643|    371|#define PNG_16_TO_8             0x0400U    /* Becomes 'chop' in 1.5.4 */
  ------------------
  |  Branch (2011:14): [True: 0, False: 371]
  ------------------
 2012|      0|            info_ptr->bit_depth = 8;
 2013|    371|#     endif
 2014|       |
 2015|       |#  else
 2016|       |      /* No 16-bit support: force chopping 16-bit input down to 8, in this case
 2017|       |       * the app program can chose if both APIs are available by setting the
 2018|       |       * correct scaling to use.
 2019|       |       */
 2020|       |#     ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED
 2021|       |         /* For compatibility with previous versions use the strip method by
 2022|       |          * default.  This code works because if PNG_SCALE_16_TO_8 is already
 2023|       |          * set the code below will do that in preference to the chop.
 2024|       |          */
 2025|       |         png_ptr->transformations |= PNG_16_TO_8;
 2026|       |         info_ptr->bit_depth = 8;
 2027|       |#     else
 2028|       |
 2029|       |#        ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
 2030|       |            png_ptr->transformations |= PNG_SCALE_16_TO_8;
 2031|       |            info_ptr->bit_depth = 8;
 2032|       |#        else
 2033|       |
 2034|       |            CONFIGURATION ERROR: you must enable at least one 16 to 8 method
 2035|       |#        endif
 2036|       |#    endif
 2037|       |#endif /* !READ_16BIT */
 2038|    371|   }
 2039|       |
 2040|  1.81k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 2041|  1.81k|   if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0)
  ------------------
  |  |  647|  1.81k|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (2041:8): [True: 1.81k, False: 0]
  ------------------
 2042|  1.81k|      info_ptr->color_type = (png_byte)(info_ptr->color_type |
 2043|  1.81k|         PNG_COLOR_MASK_COLOR);
  ------------------
  |  |  664|  1.81k|#define PNG_COLOR_MASK_COLOR      2
  ------------------
 2044|  1.81k|#endif
 2045|       |
 2046|  1.81k|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 2047|  1.81k|   if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0)
  ------------------
  |  |  656|  1.81k|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (2047:8): [True: 0, False: 1.81k]
  ------------------
 2048|      0|      info_ptr->color_type = (png_byte)(info_ptr->color_type &
 2049|      0|         ~PNG_COLOR_MASK_COLOR);
  ------------------
  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  ------------------
 2050|  1.81k|#endif
 2051|       |
 2052|  1.81k|#ifdef PNG_READ_QUANTIZE_SUPPORTED
 2053|  1.81k|   if ((png_ptr->transformations & PNG_QUANTIZE) != 0)
  ------------------
  |  |  639|  1.81k|#define PNG_QUANTIZE            0x0040U
  ------------------
  |  Branch (2053:8): [True: 0, False: 1.81k]
  ------------------
 2054|      0|   {
 2055|      0|      if (((info_ptr->color_type == PNG_COLOR_TYPE_RGB) ||
  ------------------
  |  |  670|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (2055:12): [True: 0, False: 0]
  ------------------
 2056|      0|          (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)) &&
  ------------------
  |  |  671|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (2056:11): [True: 0, False: 0]
  ------------------
 2057|      0|          png_ptr->palette_lookup != 0 && info_ptr->bit_depth == 8)
  ------------------
  |  Branch (2057:11): [True: 0, False: 0]
  |  Branch (2057:43): [True: 0, False: 0]
  ------------------
 2058|      0|      {
 2059|      0|         info_ptr->color_type = PNG_COLOR_TYPE_PALETTE;
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
 2060|      0|      }
 2061|      0|   }
 2062|  1.81k|#endif
 2063|       |
 2064|  1.81k|#ifdef PNG_READ_EXPAND_16_SUPPORTED
 2065|  1.81k|   if ((png_ptr->transformations & PNG_EXPAND_16) != 0 &&
  ------------------
  |  |  642|  1.81k|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
  |  Branch (2065:8): [True: 0, False: 1.81k]
  ------------------
 2066|  1.81k|       info_ptr->bit_depth == 8 &&
  ------------------
  |  Branch (2066:8): [True: 0, False: 0]
  ------------------
 2067|  1.81k|       info_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (2067:8): [True: 0, False: 0]
  ------------------
 2068|      0|   {
 2069|      0|      info_ptr->bit_depth = 16;
 2070|      0|   }
 2071|  1.81k|#endif
 2072|       |
 2073|  1.81k|#ifdef PNG_READ_PACK_SUPPORTED
 2074|  1.81k|   if ((png_ptr->transformations & PNG_PACK) != 0 &&
  ------------------
  |  |  635|  1.81k|#define PNG_PACK                0x0004U
  ------------------
  |  Branch (2074:8): [True: 1.15k, False: 657]
  ------------------
 2075|  1.81k|       (info_ptr->bit_depth < 8))
  ------------------
  |  Branch (2075:8): [True: 0, False: 1.15k]
  ------------------
 2076|      0|      info_ptr->bit_depth = 8;
 2077|  1.81k|#endif
 2078|       |
 2079|  1.81k|   if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  1.81k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  1.81k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  1.81k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (2079:8): [True: 0, False: 1.81k]
  ------------------
 2080|      0|      info_ptr->channels = 1;
 2081|       |
 2082|  1.81k|   else if ((info_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
  ------------------
  |  |  664|  1.81k|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (2082:13): [True: 1.81k, False: 0]
  ------------------
 2083|  1.81k|      info_ptr->channels = 3;
 2084|       |
 2085|      0|   else
 2086|      0|      info_ptr->channels = 1;
 2087|       |
 2088|  1.81k|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
 2089|  1.81k|   if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0)
  ------------------
  |  |  651|  1.81k|#define PNG_STRIP_ALPHA        0x40000U
  ------------------
  |  Branch (2089:8): [True: 0, False: 1.81k]
  ------------------
 2090|      0|   {
 2091|      0|      info_ptr->color_type = (png_byte)(info_ptr->color_type &
 2092|      0|         ~PNG_COLOR_MASK_ALPHA);
  ------------------
  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
 2093|      0|      info_ptr->num_trans = 0;
 2094|      0|   }
 2095|  1.81k|#endif
 2096|       |
 2097|  1.81k|   if ((info_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)
  ------------------
  |  |  665|  1.81k|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
  |  Branch (2097:8): [True: 470, False: 1.34k]
  ------------------
 2098|    470|      info_ptr->channels++;
 2099|       |
 2100|  1.81k|#ifdef PNG_READ_FILLER_SUPPORTED
 2101|       |   /* STRIP_ALPHA and FILLER allowed:  MASK_ALPHA bit stripped above */
 2102|  1.81k|   if ((png_ptr->transformations & PNG_FILLER) != 0 &&
  ------------------
  |  |  648|  1.81k|#define PNG_FILLER              0x8000U
  ------------------
  |  Branch (2102:8): [True: 0, False: 1.81k]
  ------------------
 2103|  1.81k|       (info_ptr->color_type == PNG_COLOR_TYPE_RGB ||
  ------------------
  |  |  670|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (2103:9): [True: 0, False: 0]
  ------------------
 2104|      0|       info_ptr->color_type == PNG_COLOR_TYPE_GRAY))
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (2104:8): [True: 0, False: 0]
  ------------------
 2105|      0|   {
 2106|      0|      info_ptr->channels++;
 2107|       |      /* If adding a true alpha channel not just filler */
 2108|      0|      if ((png_ptr->transformations & PNG_ADD_ALPHA) != 0)
  ------------------
  |  |  658|      0|#define PNG_ADD_ALPHA        0x1000000U /* Added to libpng-1.2.7 */
  ------------------
  |  Branch (2108:11): [True: 0, False: 0]
  ------------------
 2109|      0|         info_ptr->color_type |= PNG_COLOR_MASK_ALPHA;
  ------------------
  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
 2110|      0|   }
 2111|  1.81k|#endif
 2112|       |
 2113|  1.81k|#if defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) && \
 2114|  1.81k|defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
 2115|  1.81k|   if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
  ------------------
  |  |  653|  1.81k|#define PNG_USER_TRANSFORM    0x100000U
  ------------------
  |  Branch (2115:8): [True: 0, False: 1.81k]
  ------------------
 2116|      0|   {
 2117|      0|      if (png_ptr->user_transform_depth != 0)
  ------------------
  |  Branch (2117:11): [True: 0, False: 0]
  ------------------
 2118|      0|         info_ptr->bit_depth = png_ptr->user_transform_depth;
 2119|       |
 2120|      0|      if (png_ptr->user_transform_channels != 0)
  ------------------
  |  Branch (2120:11): [True: 0, False: 0]
  ------------------
 2121|      0|         info_ptr->channels = png_ptr->user_transform_channels;
 2122|      0|   }
 2123|  1.81k|#endif
 2124|       |
 2125|  1.81k|   info_ptr->pixel_depth = (png_byte)(info_ptr->channels *
 2126|  1.81k|       info_ptr->bit_depth);
 2127|       |
 2128|  1.81k|   info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, info_ptr->width);
  ------------------
  |  |  730|  1.81k|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 1.81k, False: 0]
  |  |  ------------------
  |  |  731|  1.81k|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|  1.81k|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 2129|       |
 2130|       |   /* Adding in 1.5.4: cache the above value in png_struct so that we can later
 2131|       |    * check in png_rowbytes that the user buffer won't get overwritten.  Note
 2132|       |    * that the field is not always set - if png_read_update_info isn't called
 2133|       |    * the application has to either not do any transforms or get the calculation
 2134|       |    * right itself.
 2135|       |    */
 2136|  1.81k|   png_ptr->info_rowbytes = info_ptr->rowbytes;
 2137|       |
 2138|       |#ifndef PNG_READ_EXPAND_SUPPORTED
 2139|       |   if (png_ptr != NULL)
 2140|       |      return;
 2141|       |#endif
 2142|  1.81k|}
OSS_FUZZ_png_do_read_transformations:
 4741|   190k|{
 4742|   190k|   png_debug(1, "in png_do_read_transformations");
  ------------------
  |  |  145|   190k|#  define png_debug(l, m) ((void)0)
  ------------------
 4743|       |
 4744|   190k|   if (png_ptr->row_buf == NULL)
  ------------------
  |  Branch (4744:8): [True: 0, False: 190k]
  ------------------
 4745|      0|   {
 4746|       |      /* Prior to 1.5.4 this output row/pass where the NULL pointer is, but this
 4747|       |       * error is incredibly rare and incredibly easy to debug without this
 4748|       |       * information.
 4749|       |       */
 4750|      0|      png_error(png_ptr, "NULL row buffer");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4751|      0|   }
 4752|       |
 4753|       |   /* The following is debugging; prior to 1.5.4 the code was never compiled in;
 4754|       |    * in 1.5.4 PNG_FLAG_DETECT_UNINITIALIZED was added and the macro
 4755|       |    * PNG_WARN_UNINITIALIZED_ROW removed.  In 1.6 the new flag is set only for
 4756|       |    * all transformations, however in practice the ROW_INIT always gets done on
 4757|       |    * demand, if necessary.
 4758|       |    */
 4759|   190k|   if ((png_ptr->flags & PNG_FLAG_DETECT_UNINITIALIZED) != 0 &&
  ------------------
  |  |  684|   190k|#define PNG_FLAG_DETECT_UNINITIALIZED     0x4000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (4759:8): [True: 190k, False: 0]
  ------------------
 4760|   190k|       (png_ptr->flags & PNG_FLAG_ROW_INIT) == 0)
  ------------------
  |  |  676|   190k|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
  |  Branch (4760:8): [True: 0, False: 190k]
  ------------------
 4761|      0|   {
 4762|       |      /* Application has failed to call either png_read_start_image() or
 4763|       |       * png_read_update_info() after setting transforms that expand pixels.
 4764|       |       * This check added to libpng-1.2.19 (but not enabled until 1.5.4).
 4765|       |       */
 4766|      0|      png_error(png_ptr, "Uninitialized row");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4767|      0|   }
 4768|       |
 4769|   190k|#ifdef PNG_READ_EXPAND_SUPPORTED
 4770|   190k|   if ((png_ptr->transformations & PNG_EXPAND) != 0)
  ------------------
  |  |  645|   190k|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (4770:8): [True: 190k, False: 0]
  ------------------
 4771|   190k|   {
 4772|   190k|      if (row_info->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|   190k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|   190k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|   190k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (4772:11): [True: 3.08k, False: 187k]
  ------------------
 4773|  3.08k|      {
 4774|       |#ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE
 4775|       |         if ((png_ptr->num_trans > 0) && (png_ptr->bit_depth == 8))
 4776|       |         {
 4777|       |            if (png_ptr->riffled_palette == NULL)
 4778|       |            {
 4779|       |               /* Initialize the accelerated palette expansion. */
 4780|       |               png_ptr->riffled_palette =
 4781|       |                   (png_bytep)png_malloc(png_ptr, 256 * 4);
 4782|       |               png_riffle_palette_neon(png_ptr);
 4783|       |            }
 4784|       |         }
 4785|       |#endif
 4786|  3.08k|         png_do_expand_palette(png_ptr, row_info, png_ptr->row_buf + 1,
 4787|  3.08k|             png_ptr->palette, png_ptr->trans_alpha, png_ptr->num_trans);
 4788|  3.08k|      }
 4789|       |
 4790|   187k|      else
 4791|   187k|      {
 4792|   187k|         if (png_ptr->num_trans != 0 &&
  ------------------
  |  Branch (4792:14): [True: 1.24k, False: 186k]
  ------------------
 4793|   187k|             (png_ptr->transformations & PNG_EXPAND_tRNS) != 0)
  ------------------
  |  |  659|  1.24k|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  |  Branch (4793:14): [True: 1.24k, False: 0]
  ------------------
 4794|  1.24k|            png_do_expand(row_info, png_ptr->row_buf + 1,
 4795|  1.24k|                &(png_ptr->trans_color));
 4796|       |
 4797|   186k|         else
 4798|   186k|            png_do_expand(row_info, png_ptr->row_buf + 1, NULL);
 4799|   187k|      }
 4800|   190k|   }
 4801|   190k|#endif
 4802|       |
 4803|   190k|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
 4804|   190k|   if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 &&
  ------------------
  |  |  651|   190k|#define PNG_STRIP_ALPHA        0x40000U
  ------------------
  |  Branch (4804:8): [True: 0, False: 190k]
  ------------------
 4805|   190k|       (png_ptr->transformations & PNG_COMPOSE) == 0 &&
  ------------------
  |  |  640|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (4805:8): [True: 0, False: 0]
  ------------------
 4806|   190k|       (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA ||
  ------------------
  |  |  671|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4806:9): [True: 0, False: 0]
  ------------------
 4807|      0|       row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA))
  ------------------
  |  |  672|      0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4807:8): [True: 0, False: 0]
  ------------------
 4808|      0|      png_do_strip_channel(row_info, png_ptr->row_buf + 1,
  ------------------
  |  |   44|      0|#define png_do_strip_channel OSS_FUZZ_png_do_strip_channel
  ------------------
 4809|      0|          0 /* at_start == false, because SWAP_ALPHA happens later */);
 4810|   190k|#endif
 4811|       |
 4812|   190k|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 4813|   190k|   if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0)
  ------------------
  |  |  656|   190k|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (4813:8): [True: 0, False: 190k]
  ------------------
 4814|      0|   {
 4815|      0|      int rgb_error =
 4816|      0|          png_do_rgb_to_gray(png_ptr, row_info,
 4817|      0|              png_ptr->row_buf + 1);
 4818|       |
 4819|      0|      if (rgb_error != 0)
  ------------------
  |  Branch (4819:11): [True: 0, False: 0]
  ------------------
 4820|      0|      {
 4821|      0|         png_ptr->rgb_to_gray_status=1;
 4822|      0|         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
  ------------------
  |  |  656|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (4822:14): [True: 0, False: 0]
  ------------------
 4823|      0|             PNG_RGB_TO_GRAY_WARN)
  ------------------
  |  |  655|      0|#define PNG_RGB_TO_GRAY_WARN  0x400000U
  ------------------
 4824|      0|            png_warning(png_ptr, "png_do_rgb_to_gray found nongray pixel");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 4825|       |
 4826|      0|         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
  ------------------
  |  |  656|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (4826:14): [True: 0, False: 0]
  ------------------
 4827|      0|             PNG_RGB_TO_GRAY_ERR)
  ------------------
  |  |  654|      0|#define PNG_RGB_TO_GRAY_ERR   0x200000U
  ------------------
 4828|      0|            png_error(png_ptr, "png_do_rgb_to_gray found nongray pixel");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4829|      0|      }
 4830|      0|   }
 4831|   190k|#endif
 4832|       |
 4833|       |/* From Andreas Dilger e-mail to png-implement, 26 March 1998:
 4834|       | *
 4835|       | *   In most cases, the "simple transparency" should be done prior to doing
 4836|       | *   gray-to-RGB, or you will have to test 3x as many bytes to check if a
 4837|       | *   pixel is transparent.  You would also need to make sure that the
 4838|       | *   transparency information is upgraded to RGB.
 4839|       | *
 4840|       | *   To summarize, the current flow is:
 4841|       | *   - Gray + simple transparency -> compare 1 or 2 gray bytes and composite
 4842|       | *                                   with background "in place" if transparent,
 4843|       | *                                   convert to RGB if necessary
 4844|       | *   - Gray + alpha -> composite with gray background and remove alpha bytes,
 4845|       | *                                   convert to RGB if necessary
 4846|       | *
 4847|       | *   To support RGB backgrounds for gray images we need:
 4848|       | *   - Gray + simple transparency -> convert to RGB + simple transparency,
 4849|       | *                                   compare 3 or 6 bytes and composite with
 4850|       | *                                   background "in place" if transparent
 4851|       | *                                   (3x compare/pixel compared to doing
 4852|       | *                                   composite with gray bkgrnd)
 4853|       | *   - Gray + alpha -> convert to RGB + alpha, composite with background and
 4854|       | *                                   remove alpha bytes (3x float
 4855|       | *                                   operations/pixel compared with composite
 4856|       | *                                   on gray background)
 4857|       | *
 4858|       | *  Greg's change will do this.  The reason it wasn't done before is for
 4859|       | *  performance, as this increases the per-pixel operations.  If we would check
 4860|       | *  in advance if the background was gray or RGB, and position the gray-to-RGB
 4861|       | *  transform appropriately, then it would save a lot of work/time.
 4862|       | */
 4863|       |
 4864|   190k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 4865|       |   /* If gray -> RGB, do so now only if background is non-gray; else do later
 4866|       |    * for performance reasons
 4867|       |    */
 4868|   190k|   if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0 &&
  ------------------
  |  |  647|   190k|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (4868:8): [True: 190k, False: 0]
  ------------------
 4869|   190k|       (png_ptr->mode & PNG_BACKGROUND_IS_GRAY) == 0)
  ------------------
  |  |  626|   190k|#define PNG_BACKGROUND_IS_GRAY     0x800U
  ------------------
  |  Branch (4869:8): [True: 190k, False: 0]
  ------------------
 4870|   190k|      png_do_gray_to_rgb(row_info, png_ptr->row_buf + 1);
 4871|   190k|#endif
 4872|       |
 4873|   190k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\
 4874|   190k|   defined(PNG_READ_ALPHA_MODE_SUPPORTED)
 4875|   190k|   if ((png_ptr->transformations & PNG_COMPOSE) != 0)
  ------------------
  |  |  640|   190k|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (4875:8): [True: 0, False: 190k]
  ------------------
 4876|      0|      png_do_compose(row_info, png_ptr->row_buf + 1, png_ptr);
 4877|   190k|#endif
 4878|       |
 4879|   190k|#ifdef PNG_READ_GAMMA_SUPPORTED
 4880|   190k|   if ((png_ptr->transformations & PNG_GAMMA) != 0 &&
  ------------------
  |  |  646|   190k|#define PNG_GAMMA               0x2000U
  ------------------
  |  Branch (4880:8): [True: 0, False: 190k]
  ------------------
 4881|   190k|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 4882|       |      /* Because RGB_TO_GRAY does the gamma transform. */
 4883|   190k|      (png_ptr->transformations & PNG_RGB_TO_GRAY) == 0 &&
  ------------------
  |  |  656|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (4883:7): [True: 0, False: 0]
  ------------------
 4884|   190k|#endif
 4885|   190k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\
 4886|   190k|   defined(PNG_READ_ALPHA_MODE_SUPPORTED)
 4887|       |      /* Because PNG_COMPOSE does the gamma transform if there is something to
 4888|       |       * do (if there is an alpha channel or transparency.)
 4889|       |       */
 4890|   190k|       !((png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  640|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (4890:10): [True: 0, False: 0]
  ------------------
 4891|      0|       ((png_ptr->num_trans != 0) ||
  ------------------
  |  Branch (4891:9): [True: 0, False: 0]
  ------------------
 4892|      0|       (png_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)) &&
  ------------------
  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
  |  Branch (4892:8): [True: 0, False: 0]
  ------------------
 4893|   190k|#endif
 4894|       |      /* Because png_init_read_transformations transforms the palette, unless
 4895|       |       * RGB_TO_GRAY will do the transform.
 4896|       |       */
 4897|   190k|       (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE))
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (4897:8): [True: 0, False: 0]
  ------------------
 4898|      0|      png_do_gamma(row_info, png_ptr->row_buf + 1, png_ptr);
 4899|   190k|#endif
 4900|       |
 4901|   190k|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
 4902|   190k|   if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 &&
  ------------------
  |  |  651|   190k|#define PNG_STRIP_ALPHA        0x40000U
  ------------------
  |  Branch (4902:8): [True: 0, False: 190k]
  ------------------
 4903|   190k|       (png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  640|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (4903:8): [True: 0, False: 0]
  ------------------
 4904|   190k|       (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA ||
  ------------------
  |  |  671|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4904:9): [True: 0, False: 0]
  ------------------
 4905|      0|       row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA))
  ------------------
  |  |  672|      0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4905:8): [True: 0, False: 0]
  ------------------
 4906|      0|      png_do_strip_channel(row_info, png_ptr->row_buf + 1,
  ------------------
  |  |   44|      0|#define png_do_strip_channel OSS_FUZZ_png_do_strip_channel
  ------------------
 4907|      0|          0 /* at_start == false, because SWAP_ALPHA happens later */);
 4908|   190k|#endif
 4909|       |
 4910|   190k|#ifdef PNG_READ_ALPHA_MODE_SUPPORTED
 4911|   190k|   if ((png_ptr->transformations & PNG_ENCODE_ALPHA) != 0 &&
  ------------------
  |  |  657|   190k|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (4911:8): [True: 0, False: 190k]
  ------------------
 4912|   190k|       (row_info->color_type & PNG_COLOR_MASK_ALPHA) != 0)
  ------------------
  |  |  665|      0|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
  |  Branch (4912:8): [True: 0, False: 0]
  ------------------
 4913|      0|      png_do_encode_alpha(row_info, png_ptr->row_buf + 1, png_ptr);
 4914|   190k|#endif
 4915|       |
 4916|   190k|#ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
 4917|   190k|   if ((png_ptr->transformations & PNG_SCALE_16_TO_8) != 0)
  ------------------
  |  |  660|   190k|#define PNG_SCALE_16_TO_8    0x4000000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (4917:8): [True: 190k, False: 0]
  ------------------
 4918|   190k|      png_do_scale_16_to_8(row_info, png_ptr->row_buf + 1);
 4919|   190k|#endif
 4920|       |
 4921|   190k|#ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED
 4922|       |   /* There is no harm in doing both of these because only one has any effect,
 4923|       |    * by putting the 'scale' option first if the app asks for scale (either by
 4924|       |    * calling the API or in a TRANSFORM flag) this is what happens.
 4925|       |    */
 4926|   190k|   if ((png_ptr->transformations & PNG_16_TO_8) != 0)
  ------------------
  |  |  643|   190k|#define PNG_16_TO_8             0x0400U    /* Becomes 'chop' in 1.5.4 */
  ------------------
  |  Branch (4926:8): [True: 0, False: 190k]
  ------------------
 4927|      0|      png_do_chop(row_info, png_ptr->row_buf + 1);
 4928|   190k|#endif
 4929|       |
 4930|   190k|#ifdef PNG_READ_QUANTIZE_SUPPORTED
 4931|   190k|   if ((png_ptr->transformations & PNG_QUANTIZE) != 0)
  ------------------
  |  |  639|   190k|#define PNG_QUANTIZE            0x0040U
  ------------------
  |  Branch (4931:8): [True: 0, False: 190k]
  ------------------
 4932|      0|   {
 4933|      0|      png_do_quantize(row_info, png_ptr->row_buf + 1,
 4934|      0|          png_ptr->palette_lookup, png_ptr->quantize_index);
 4935|       |
 4936|      0|      if (row_info->rowbytes == 0)
  ------------------
  |  Branch (4936:11): [True: 0, False: 0]
  ------------------
 4937|      0|         png_error(png_ptr, "png_do_quantize returned rowbytes=0");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4938|      0|   }
 4939|   190k|#endif /* READ_QUANTIZE */
 4940|       |
 4941|   190k|#ifdef PNG_READ_EXPAND_16_SUPPORTED
 4942|       |   /* Do the expansion now, after all the arithmetic has been done.  Notice
 4943|       |    * that previous transformations can handle the PNG_EXPAND_16 flag if this
 4944|       |    * is efficient (particularly true in the case of gamma correction, where
 4945|       |    * better accuracy results faster!)
 4946|       |    */
 4947|   190k|   if ((png_ptr->transformations & PNG_EXPAND_16) != 0)
  ------------------
  |  |  642|   190k|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
  |  Branch (4947:8): [True: 0, False: 190k]
  ------------------
 4948|      0|      png_do_expand_16(row_info, png_ptr->row_buf + 1);
 4949|   190k|#endif
 4950|       |
 4951|   190k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 4952|       |   /* NOTE: moved here in 1.5.4 (from much later in this list.) */
 4953|   190k|   if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0 &&
  ------------------
  |  |  647|   190k|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (4953:8): [True: 190k, False: 0]
  ------------------
 4954|   190k|       (png_ptr->mode & PNG_BACKGROUND_IS_GRAY) != 0)
  ------------------
  |  |  626|   190k|#define PNG_BACKGROUND_IS_GRAY     0x800U
  ------------------
  |  Branch (4954:8): [True: 0, False: 190k]
  ------------------
 4955|      0|      png_do_gray_to_rgb(row_info, png_ptr->row_buf + 1);
 4956|   190k|#endif
 4957|       |
 4958|   190k|#ifdef PNG_READ_INVERT_SUPPORTED
 4959|   190k|   if ((png_ptr->transformations & PNG_INVERT_MONO) != 0)
  ------------------
  |  |  638|   190k|#define PNG_INVERT_MONO         0x0020U
  ------------------
  |  Branch (4959:8): [True: 0, False: 190k]
  ------------------
 4960|      0|      png_do_invert(row_info, png_ptr->row_buf + 1);
  ------------------
  |  |   47|      0|#define png_do_invert OSS_FUZZ_png_do_invert
  ------------------
 4961|   190k|#endif
 4962|       |
 4963|   190k|#ifdef PNG_READ_INVERT_ALPHA_SUPPORTED
 4964|   190k|   if ((png_ptr->transformations & PNG_INVERT_ALPHA) != 0)
  ------------------
  |  |  652|   190k|#define PNG_INVERT_ALPHA       0x80000U
  ------------------
  |  Branch (4964:8): [True: 0, False: 190k]
  ------------------
 4965|      0|      png_do_read_invert_alpha(row_info, png_ptr->row_buf + 1);
 4966|   190k|#endif
 4967|       |
 4968|   190k|#ifdef PNG_READ_SHIFT_SUPPORTED
 4969|   190k|   if ((png_ptr->transformations & PNG_SHIFT) != 0)
  ------------------
  |  |  636|   190k|#define PNG_SHIFT               0x0008U
  ------------------
  |  Branch (4969:8): [True: 0, False: 190k]
  ------------------
 4970|      0|      png_do_unshift(row_info, png_ptr->row_buf + 1,
 4971|      0|          &(png_ptr->shift));
 4972|   190k|#endif
 4973|       |
 4974|   190k|#ifdef PNG_READ_PACK_SUPPORTED
 4975|   190k|   if ((png_ptr->transformations & PNG_PACK) != 0)
  ------------------
  |  |  635|   190k|#define PNG_PACK                0x0004U
  ------------------
  |  Branch (4975:8): [True: 179k, False: 10.6k]
  ------------------
 4976|   179k|      png_do_unpack(row_info, png_ptr->row_buf + 1);
 4977|   190k|#endif
 4978|       |
 4979|   190k|#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
 4980|       |   /* Added at libpng-1.5.10 */
 4981|   190k|   if (row_info->color_type == PNG_COLOR_TYPE_PALETTE &&
  ------------------
  |  |  669|   381k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|   190k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|   190k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (4981:8): [True: 0, False: 190k]
  ------------------
 4982|   190k|       png_ptr->num_palette_max >= 0)
  ------------------
  |  Branch (4982:8): [True: 0, False: 0]
  ------------------
 4983|      0|      png_do_check_palette_indexes(png_ptr, row_info);
  ------------------
  |  |  110|      0|#define png_do_check_palette_indexes OSS_FUZZ_png_do_check_palette_indexes
  ------------------
 4984|   190k|#endif
 4985|       |
 4986|   190k|#ifdef PNG_READ_BGR_SUPPORTED
 4987|   190k|   if ((png_ptr->transformations & PNG_BGR) != 0)
  ------------------
  |  |  633|   190k|#define PNG_BGR                 0x0001U
  ------------------
  |  Branch (4987:8): [True: 0, False: 190k]
  ------------------
 4988|      0|      png_do_bgr(row_info, png_ptr->row_buf + 1);
  ------------------
  |  |   48|      0|#define png_do_bgr OSS_FUZZ_png_do_bgr
  ------------------
 4989|   190k|#endif
 4990|       |
 4991|   190k|#ifdef PNG_READ_PACKSWAP_SUPPORTED
 4992|   190k|   if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  649|   190k|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (4992:8): [True: 0, False: 190k]
  ------------------
 4993|      0|      png_do_packswap(row_info, png_ptr->row_buf + 1);
  ------------------
  |  |   46|      0|#define png_do_packswap OSS_FUZZ_png_do_packswap
  ------------------
 4994|   190k|#endif
 4995|       |
 4996|   190k|#ifdef PNG_READ_FILLER_SUPPORTED
 4997|   190k|   if ((png_ptr->transformations & PNG_FILLER) != 0)
  ------------------
  |  |  648|   190k|#define PNG_FILLER              0x8000U
  ------------------
  |  Branch (4997:8): [True: 0, False: 190k]
  ------------------
 4998|      0|      png_do_read_filler(row_info, png_ptr->row_buf + 1,
 4999|      0|          (png_uint_32)png_ptr->filler, png_ptr->flags);
 5000|   190k|#endif
 5001|       |
 5002|   190k|#ifdef PNG_READ_SWAP_ALPHA_SUPPORTED
 5003|   190k|   if ((png_ptr->transformations & PNG_SWAP_ALPHA) != 0)
  ------------------
  |  |  650|   190k|#define PNG_SWAP_ALPHA         0x20000U
  ------------------
  |  Branch (5003:8): [True: 0, False: 190k]
  ------------------
 5004|      0|      png_do_read_swap_alpha(row_info, png_ptr->row_buf + 1);
 5005|   190k|#endif
 5006|       |
 5007|   190k|#ifdef PNG_READ_16BIT_SUPPORTED
 5008|   190k|#ifdef PNG_READ_SWAP_SUPPORTED
 5009|   190k|   if ((png_ptr->transformations & PNG_SWAP_BYTES) != 0)
  ------------------
  |  |  637|   190k|#define PNG_SWAP_BYTES          0x0010U
  ------------------
  |  Branch (5009:8): [True: 0, False: 190k]
  ------------------
 5010|      0|      png_do_swap(row_info, png_ptr->row_buf + 1);
  ------------------
  |  |   45|      0|#define png_do_swap OSS_FUZZ_png_do_swap
  ------------------
 5011|   190k|#endif
 5012|   190k|#endif
 5013|       |
 5014|   190k|#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
 5015|   190k|   if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
  ------------------
  |  |  653|   190k|#define PNG_USER_TRANSFORM    0x100000U
  ------------------
  |  Branch (5015:8): [True: 0, False: 190k]
  ------------------
 5016|      0|   {
 5017|      0|      if (png_ptr->read_user_transform_fn != NULL)
  ------------------
  |  Branch (5017:11): [True: 0, False: 0]
  ------------------
 5018|      0|         (*(png_ptr->read_user_transform_fn)) /* User read transform function */
 5019|      0|             (png_ptr,     /* png_ptr */
 5020|      0|             row_info,     /* row_info: */
 5021|       |                /*  png_uint_32 width;       width of row */
 5022|       |                /*  size_t rowbytes;         number of bytes in row */
 5023|       |                /*  png_byte color_type;     color type of pixels */
 5024|       |                /*  png_byte bit_depth;      bit depth of samples */
 5025|       |                /*  png_byte channels;       number of channels (1-4) */
 5026|       |                /*  png_byte pixel_depth;    bits per pixel (depth*channels) */
 5027|      0|             png_ptr->row_buf + 1);    /* start of pixel data for row */
 5028|      0|#ifdef PNG_USER_TRANSFORM_PTR_SUPPORTED
 5029|      0|      if (png_ptr->user_transform_depth != 0)
  ------------------
  |  Branch (5029:11): [True: 0, False: 0]
  ------------------
 5030|      0|         row_info->bit_depth = png_ptr->user_transform_depth;
 5031|       |
 5032|      0|      if (png_ptr->user_transform_channels != 0)
  ------------------
  |  Branch (5032:11): [True: 0, False: 0]
  ------------------
 5033|      0|         row_info->channels = png_ptr->user_transform_channels;
 5034|      0|#endif
 5035|      0|      row_info->pixel_depth = (png_byte)(row_info->bit_depth *
 5036|      0|          row_info->channels);
 5037|       |
 5038|      0|      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_info->width);
  ------------------
  |  |  730|      0|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 0, False: 0]
  |  |  ------------------
  |  |  731|      0|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|      0|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 5039|      0|   }
 5040|   190k|#endif
 5041|   190k|}
pngrtran.c:png_rtran_ok:
  111|  9.09k|{
  112|  9.09k|   if (png_ptr != NULL)
  ------------------
  |  Branch (112:8): [True: 9.09k, False: 0]
  ------------------
  113|  9.09k|   {
  114|  9.09k|      if ((png_ptr->flags & PNG_FLAG_ROW_INIT) != 0)
  ------------------
  |  |  676|  9.09k|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
  |  Branch (114:11): [True: 0, False: 9.09k]
  ------------------
  115|      0|         png_app_error(png_ptr,
  ------------------
  |  |  119|      0|#define png_app_error OSS_FUZZ_png_app_error
  ------------------
  116|      0|             "invalid after png_start_read_image or png_read_update_info");
  117|       |
  118|  9.09k|      else if (need_IHDR && (png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|      0|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (118:16): [True: 0, False: 9.09k]
  |  Branch (118:29): [True: 0, False: 0]
  ------------------
  119|      0|         png_app_error(png_ptr, "invalid before the PNG header has been read");
  ------------------
  |  |  119|      0|#define png_app_error OSS_FUZZ_png_app_error
  ------------------
  120|       |
  121|  9.09k|      else
  122|  9.09k|      {
  123|       |         /* Turn on failure to initialize correctly for all transforms. */
  124|  9.09k|         png_ptr->flags |= PNG_FLAG_DETECT_UNINITIALIZED;
  ------------------
  |  |  684|  9.09k|#define PNG_FLAG_DETECT_UNINITIALIZED     0x4000U /* Added to libpng-1.5.4 */
  ------------------
  125|       |
  126|  9.09k|         return 1; /* Ok */
  127|  9.09k|      }
  128|  9.09k|   }
  129|       |
  130|      0|   return 0; /* no png_error possible! */
  131|  9.09k|}
pngrtran.c:png_init_palette_transformations:
 1118|    173|{
 1119|       |   /* Called to handle the (input) palette case.  In png_do_read_transformations
 1120|       |    * the first step is to expand the palette if requested, so this code must
 1121|       |    * take care to only make changes that are invariant with respect to the
 1122|       |    * palette expansion, or only do them if there is no expansion.
 1123|       |    *
 1124|       |    * STRIP_ALPHA has already been handled in the caller (by setting num_trans
 1125|       |    * to 0.)
 1126|       |    */
 1127|    173|   int input_has_alpha = 0;
 1128|    173|   int input_has_transparency = 0;
 1129|       |
 1130|    173|   if (png_ptr->num_trans > 0)
  ------------------
  |  Branch (1130:8): [True: 74, False: 99]
  ------------------
 1131|     74|   {
 1132|     74|      int i;
 1133|       |
 1134|       |      /* Ignore if all the entries are opaque (unlikely!) */
 1135|    563|      for (i=0; i<png_ptr->num_trans; ++i)
  ------------------
  |  Branch (1135:17): [True: 538, False: 25]
  ------------------
 1136|    538|      {
 1137|    538|         if (png_ptr->trans_alpha[i] == 255)
  ------------------
  |  Branch (1137:14): [True: 230, False: 308]
  ------------------
 1138|    230|            continue;
 1139|    308|         else if (png_ptr->trans_alpha[i] == 0)
  ------------------
  |  Branch (1139:19): [True: 259, False: 49]
  ------------------
 1140|    259|            input_has_transparency = 1;
 1141|     49|         else
 1142|     49|         {
 1143|     49|            input_has_transparency = 1;
 1144|     49|            input_has_alpha = 1;
 1145|     49|            break;
 1146|     49|         }
 1147|    538|      }
 1148|     74|   }
 1149|       |
 1150|       |   /* If no alpha we can optimize. */
 1151|    173|   if (input_has_alpha == 0)
  ------------------
  |  Branch (1151:8): [True: 124, False: 49]
  ------------------
 1152|    124|   {
 1153|       |      /* Any alpha means background and associative alpha processing is
 1154|       |       * required, however if the alpha is 0 or 1 throughout OPTIMIZE_ALPHA
 1155|       |       * and ENCODE_ALPHA are irrelevant.
 1156|       |       */
 1157|    124|      png_ptr->transformations &= ~PNG_ENCODE_ALPHA;
  ------------------
  |  |  657|    124|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
 1158|    124|      png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
  ------------------
  |  |  683|    124|#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
  ------------------
 1159|       |
 1160|    124|      if (input_has_transparency == 0)
  ------------------
  |  Branch (1160:11): [True: 105, False: 19]
  ------------------
 1161|    105|         png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND);
  ------------------
  |  |  640|    105|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
                       png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND);
  ------------------
  |  |  641|    105|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
 1162|    124|   }
 1163|       |
 1164|    173|#if defined(PNG_READ_EXPAND_SUPPORTED) && defined(PNG_READ_BACKGROUND_SUPPORTED)
 1165|       |   /* png_set_background handling - deals with the complexity of whether the
 1166|       |    * background color is in the file format or the screen format in the case
 1167|       |    * where an 'expand' will happen.
 1168|       |    */
 1169|       |
 1170|       |   /* The following code cannot be entered in the alpha pre-multiplication case
 1171|       |    * because PNG_BACKGROUND_EXPAND is cancelled below.
 1172|       |    */
 1173|    173|   if ((png_ptr->transformations & PNG_BACKGROUND_EXPAND) != 0 &&
  ------------------
  |  |  641|    173|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
  |  Branch (1173:8): [True: 0, False: 173]
  ------------------
 1174|    173|       (png_ptr->transformations & PNG_EXPAND) != 0)
  ------------------
  |  |  645|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (1174:8): [True: 0, False: 0]
  ------------------
 1175|      0|   {
 1176|      0|      {
 1177|      0|         png_ptr->background.red   =
 1178|      0|             png_ptr->palette[png_ptr->background.index].red;
 1179|      0|         png_ptr->background.green =
 1180|      0|             png_ptr->palette[png_ptr->background.index].green;
 1181|      0|         png_ptr->background.blue  =
 1182|      0|             png_ptr->palette[png_ptr->background.index].blue;
 1183|       |
 1184|      0|#ifdef PNG_READ_INVERT_ALPHA_SUPPORTED
 1185|      0|         if ((png_ptr->transformations & PNG_INVERT_ALPHA) != 0)
  ------------------
  |  |  652|      0|#define PNG_INVERT_ALPHA       0x80000U
  ------------------
  |  Branch (1185:14): [True: 0, False: 0]
  ------------------
 1186|      0|         {
 1187|      0|            if ((png_ptr->transformations & PNG_EXPAND_tRNS) == 0)
  ------------------
  |  |  659|      0|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  |  Branch (1187:17): [True: 0, False: 0]
  ------------------
 1188|      0|            {
 1189|       |               /* Invert the alpha channel (in tRNS) unless the pixels are
 1190|       |                * going to be expanded, in which case leave it for later
 1191|       |                */
 1192|      0|               int i, istop = png_ptr->num_trans;
 1193|       |
 1194|      0|               for (i = 0; i < istop; i++)
  ------------------
  |  Branch (1194:28): [True: 0, False: 0]
  ------------------
 1195|      0|                  png_ptr->trans_alpha[i] =
 1196|      0|                      (png_byte)(255 - png_ptr->trans_alpha[i]);
 1197|      0|            }
 1198|      0|         }
 1199|      0|#endif /* READ_INVERT_ALPHA */
 1200|      0|      }
 1201|      0|   } /* background expand and (therefore) no alpha association. */
 1202|    173|#endif /* READ_EXPAND && READ_BACKGROUND */
 1203|    173|}
pngrtran.c:png_init_rgb_transformations:
 1207|  1.64k|{
 1208|       |   /* Added to libpng-1.5.4: check the color type to determine whether there
 1209|       |    * is any alpha or transparency in the image and simply cancel the
 1210|       |    * background and alpha mode stuff if there isn't.
 1211|       |    */
 1212|  1.64k|   int input_has_alpha = (png_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0;
  ------------------
  |  |  665|  1.64k|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
 1213|  1.64k|   int input_has_transparency = png_ptr->num_trans > 0;
 1214|       |
 1215|       |   /* If no alpha we can optimize. */
 1216|  1.64k|   if (input_has_alpha == 0)
  ------------------
  |  Branch (1216:8): [True: 1.52k, False: 125]
  ------------------
 1217|  1.52k|   {
 1218|       |      /* Any alpha means background and associative alpha processing is
 1219|       |       * required, however if the alpha is 0 or 1 throughout OPTIMIZE_ALPHA
 1220|       |       * and ENCODE_ALPHA are irrelevant.
 1221|       |       */
 1222|  1.52k|#     ifdef PNG_READ_ALPHA_MODE_SUPPORTED
 1223|  1.52k|         png_ptr->transformations &= ~PNG_ENCODE_ALPHA;
  ------------------
  |  |  657|  1.52k|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
 1224|  1.52k|         png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
  ------------------
  |  |  683|  1.52k|#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
  ------------------
 1225|  1.52k|#     endif
 1226|       |
 1227|  1.52k|      if (input_has_transparency == 0)
  ------------------
  |  Branch (1227:11): [True: 1.24k, False: 278]
  ------------------
 1228|  1.24k|         png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND);
  ------------------
  |  |  640|  1.24k|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
                       png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND);
  ------------------
  |  |  641|  1.24k|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
 1229|  1.52k|   }
 1230|       |
 1231|  1.64k|#if defined(PNG_READ_EXPAND_SUPPORTED) && defined(PNG_READ_BACKGROUND_SUPPORTED)
 1232|       |   /* png_set_background handling - deals with the complexity of whether the
 1233|       |    * background color is in the file format or the screen format in the case
 1234|       |    * where an 'expand' will happen.
 1235|       |    */
 1236|       |
 1237|       |   /* The following code cannot be entered in the alpha pre-multiplication case
 1238|       |    * because PNG_BACKGROUND_EXPAND is cancelled below.
 1239|       |    */
 1240|  1.64k|   if ((png_ptr->transformations & PNG_BACKGROUND_EXPAND) != 0 &&
  ------------------
  |  |  641|  1.64k|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
  |  Branch (1240:8): [True: 0, False: 1.64k]
  ------------------
 1241|  1.64k|       (png_ptr->transformations & PNG_EXPAND) != 0 &&
  ------------------
  |  |  645|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (1241:8): [True: 0, False: 0]
  ------------------
 1242|  1.64k|       (png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
  ------------------
  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (1242:8): [True: 0, False: 0]
  ------------------
 1243|       |       /* i.e., GRAY or GRAY_ALPHA */
 1244|      0|   {
 1245|      0|      {
 1246|       |         /* Expand background and tRNS chunks */
 1247|      0|         int gray = png_ptr->background.gray;
 1248|      0|         int trans_gray = png_ptr->trans_color.gray;
 1249|       |
 1250|      0|         switch (png_ptr->bit_depth)
 1251|      0|         {
 1252|      0|            case 1:
  ------------------
  |  Branch (1252:13): [True: 0, False: 0]
  ------------------
 1253|      0|               gray *= 0xff;
 1254|      0|               trans_gray *= 0xff;
 1255|      0|               break;
 1256|       |
 1257|      0|            case 2:
  ------------------
  |  Branch (1257:13): [True: 0, False: 0]
  ------------------
 1258|      0|               gray *= 0x55;
 1259|      0|               trans_gray *= 0x55;
 1260|      0|               break;
 1261|       |
 1262|      0|            case 4:
  ------------------
  |  Branch (1262:13): [True: 0, False: 0]
  ------------------
 1263|      0|               gray *= 0x11;
 1264|      0|               trans_gray *= 0x11;
 1265|      0|               break;
 1266|       |
 1267|      0|            default:
  ------------------
  |  Branch (1267:13): [True: 0, False: 0]
  ------------------
 1268|       |
 1269|      0|            case 8:
  ------------------
  |  Branch (1269:13): [True: 0, False: 0]
  ------------------
 1270|       |               /* FALLTHROUGH */ /*  (Already 8 bits) */
 1271|       |
 1272|      0|            case 16:
  ------------------
  |  Branch (1272:13): [True: 0, False: 0]
  ------------------
 1273|       |               /* Already a full 16 bits */
 1274|      0|               break;
 1275|      0|         }
 1276|       |
 1277|      0|         png_ptr->background.red = png_ptr->background.green =
 1278|      0|            png_ptr->background.blue = (png_uint_16)gray;
 1279|       |
 1280|      0|         if ((png_ptr->transformations & PNG_EXPAND_tRNS) == 0)
  ------------------
  |  |  659|      0|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  |  Branch (1280:14): [True: 0, False: 0]
  ------------------
 1281|      0|         {
 1282|      0|            png_ptr->trans_color.red = png_ptr->trans_color.green =
 1283|      0|               png_ptr->trans_color.blue = (png_uint_16)trans_gray;
 1284|      0|         }
 1285|      0|      }
 1286|      0|   } /* background expand and (therefore) no alpha association. */
 1287|  1.64k|#endif /* READ_EXPAND && READ_BACKGROUND */
 1288|  1.64k|}
pngrtran.c:png_do_expand_palette:
 4212|  3.08k|{
 4213|  3.08k|   int shift, value;
 4214|  3.08k|   png_bytep sp, dp;
 4215|  3.08k|   png_uint_32 i;
 4216|  3.08k|   png_uint_32 row_width=row_info->width;
 4217|       |
 4218|  3.08k|   png_debug(1, "in png_do_expand_palette");
  ------------------
  |  |  145|  3.08k|#  define png_debug(l, m) ((void)0)
  ------------------
 4219|       |
 4220|  3.08k|   if (row_info->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  3.08k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  3.08k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  3.08k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (4220:8): [True: 3.08k, False: 0]
  ------------------
 4221|  3.08k|   {
 4222|  3.08k|      if (row_info->bit_depth < 8)
  ------------------
  |  Branch (4222:11): [True: 1.23k, False: 1.84k]
  ------------------
 4223|  1.23k|      {
 4224|  1.23k|         switch (row_info->bit_depth)
 4225|  1.23k|         {
 4226|    411|            case 1:
  ------------------
  |  Branch (4226:13): [True: 411, False: 826]
  ------------------
 4227|    411|            {
 4228|    411|               sp = row + (size_t)((row_width - 1) >> 3);
 4229|    411|               dp = row + (size_t)row_width - 1;
 4230|    411|               shift = 7 - (int)((row_width + 7) & 0x07);
 4231|  2.80M|               for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4231:28): [True: 2.80M, False: 411]
  ------------------
 4232|  2.80M|               {
 4233|  2.80M|                  if ((*sp >> shift) & 0x01)
  ------------------
  |  Branch (4233:23): [True: 807k, False: 1.99M]
  ------------------
 4234|   807k|                     *dp = 1;
 4235|       |
 4236|  1.99M|                  else
 4237|  1.99M|                     *dp = 0;
 4238|       |
 4239|  2.80M|                  if (shift == 7)
  ------------------
  |  Branch (4239:23): [True: 350k, False: 2.45M]
  ------------------
 4240|   350k|                  {
 4241|   350k|                     shift = 0;
 4242|   350k|                     sp--;
 4243|   350k|                  }
 4244|       |
 4245|  2.45M|                  else
 4246|  2.45M|                     shift++;
 4247|       |
 4248|  2.80M|                  dp--;
 4249|  2.80M|               }
 4250|    411|               break;
 4251|      0|            }
 4252|       |
 4253|    351|            case 2:
  ------------------
  |  Branch (4253:13): [True: 351, False: 886]
  ------------------
 4254|    351|            {
 4255|    351|               sp = row + (size_t)((row_width - 1) >> 2);
 4256|    351|               dp = row + (size_t)row_width - 1;
 4257|    351|               shift = (int)((3 - ((row_width + 3) & 0x03)) << 1);
 4258|  9.66k|               for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4258:28): [True: 9.31k, False: 351]
  ------------------
 4259|  9.31k|               {
 4260|  9.31k|                  value = (*sp >> shift) & 0x03;
 4261|  9.31k|                  *dp = (png_byte)value;
 4262|  9.31k|                  if (shift == 6)
  ------------------
  |  Branch (4262:23): [True: 2.53k, False: 6.78k]
  ------------------
 4263|  2.53k|                  {
 4264|  2.53k|                     shift = 0;
 4265|  2.53k|                     sp--;
 4266|  2.53k|                  }
 4267|       |
 4268|  6.78k|                  else
 4269|  6.78k|                     shift += 2;
 4270|       |
 4271|  9.31k|                  dp--;
 4272|  9.31k|               }
 4273|    351|               break;
 4274|      0|            }
 4275|       |
 4276|    475|            case 4:
  ------------------
  |  Branch (4276:13): [True: 475, False: 762]
  ------------------
 4277|    475|            {
 4278|    475|               sp = row + (size_t)((row_width - 1) >> 1);
 4279|    475|               dp = row + (size_t)row_width - 1;
 4280|    475|               shift = (int)((row_width & 0x01) << 2);
 4281|  67.6k|               for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4281:28): [True: 67.2k, False: 475]
  ------------------
 4282|  67.2k|               {
 4283|  67.2k|                  value = (*sp >> shift) & 0x0f;
 4284|  67.2k|                  *dp = (png_byte)value;
 4285|  67.2k|                  if (shift == 4)
  ------------------
  |  Branch (4285:23): [True: 33.6k, False: 33.5k]
  ------------------
 4286|  33.6k|                  {
 4287|  33.6k|                     shift = 0;
 4288|  33.6k|                     sp--;
 4289|  33.6k|                  }
 4290|       |
 4291|  33.5k|                  else
 4292|  33.5k|                     shift += 4;
 4293|       |
 4294|  67.2k|                  dp--;
 4295|  67.2k|               }
 4296|    475|               break;
 4297|      0|            }
 4298|       |
 4299|      0|            default:
  ------------------
  |  Branch (4299:13): [True: 0, False: 1.23k]
  ------------------
 4300|      0|               break;
 4301|  1.23k|         }
 4302|  1.23k|         row_info->bit_depth = 8;
 4303|  1.23k|         row_info->pixel_depth = 8;
 4304|  1.23k|         row_info->rowbytes = row_width;
 4305|  1.23k|      }
 4306|       |
 4307|  3.08k|      if (row_info->bit_depth == 8)
  ------------------
  |  Branch (4307:11): [True: 3.08k, False: 0]
  ------------------
 4308|  3.08k|      {
 4309|  3.08k|         {
 4310|  3.08k|            if (num_trans > 0)
  ------------------
  |  Branch (4310:17): [True: 300, False: 2.78k]
  ------------------
 4311|    300|            {
 4312|    300|               sp = row + (size_t)row_width - 1;
 4313|    300|               dp = row + ((size_t)row_width << 2) - 1;
 4314|       |
 4315|    300|               i = 0;
 4316|       |#ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE
 4317|       |               if (png_ptr->riffled_palette != NULL)
 4318|       |               {
 4319|       |                  /* The RGBA optimization works with png_ptr->bit_depth == 8
 4320|       |                   * but sometimes row_info->bit_depth has been changed to 8.
 4321|       |                   * In these cases, the palette hasn't been riffled.
 4322|       |                   */
 4323|       |                  i = png_do_expand_palette_rgba8_neon(png_ptr, row_info, row,
 4324|       |                      &sp, &dp);
 4325|       |               }
 4326|       |#else
 4327|    300|               PNG_UNUSED(png_ptr)
  ------------------
  |  |  444|    300|#  define PNG_UNUSED(param) (void)param;
  ------------------
 4328|    300|#endif
 4329|       |
 4330|  1.61M|               for (; i < row_width; i++)
  ------------------
  |  Branch (4330:23): [True: 1.61M, False: 300]
  ------------------
 4331|  1.61M|               {
 4332|  1.61M|                  if ((int)(*sp) >= num_trans)
  ------------------
  |  Branch (4332:23): [True: 4.35k, False: 1.61M]
  ------------------
 4333|  4.35k|                     *dp-- = 0xff;
 4334|  1.61M|                  else
 4335|  1.61M|                     *dp-- = trans_alpha[*sp];
 4336|  1.61M|                  *dp-- = palette[*sp].blue;
 4337|  1.61M|                  *dp-- = palette[*sp].green;
 4338|  1.61M|                  *dp-- = palette[*sp].red;
 4339|  1.61M|                  sp--;
 4340|  1.61M|               }
 4341|    300|               row_info->bit_depth = 8;
 4342|    300|               row_info->pixel_depth = 32;
 4343|    300|               row_info->rowbytes = row_width * 4;
 4344|    300|               row_info->color_type = 6;
 4345|    300|               row_info->channels = 4;
 4346|    300|            }
 4347|       |
 4348|  2.78k|            else
 4349|  2.78k|            {
 4350|  2.78k|               sp = row + (size_t)row_width - 1;
 4351|  2.78k|               dp = row + (size_t)(row_width * 3) - 1;
 4352|  2.78k|               i = 0;
 4353|       |#ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE
 4354|       |               i = png_do_expand_palette_rgb8_neon(png_ptr, row_info, row,
 4355|       |                   &sp, &dp);
 4356|       |#else
 4357|  2.78k|               PNG_UNUSED(png_ptr)
  ------------------
  |  |  444|  2.78k|#  define PNG_UNUSED(param) (void)param;
  ------------------
 4358|  2.78k|#endif
 4359|       |
 4360|  1.27M|               for (; i < row_width; i++)
  ------------------
  |  Branch (4360:23): [True: 1.27M, False: 2.78k]
  ------------------
 4361|  1.27M|               {
 4362|  1.27M|                  *dp-- = palette[*sp].blue;
 4363|  1.27M|                  *dp-- = palette[*sp].green;
 4364|  1.27M|                  *dp-- = palette[*sp].red;
 4365|  1.27M|                  sp--;
 4366|  1.27M|               }
 4367|       |
 4368|  2.78k|               row_info->bit_depth = 8;
 4369|  2.78k|               row_info->pixel_depth = 24;
 4370|  2.78k|               row_info->rowbytes = row_width * 3;
 4371|  2.78k|               row_info->color_type = 2;
 4372|  2.78k|               row_info->channels = 3;
 4373|  2.78k|            }
 4374|  3.08k|         }
 4375|  3.08k|      }
 4376|  3.08k|   }
 4377|  3.08k|}
pngrtran.c:png_do_expand:
 4385|   187k|{
 4386|   187k|   int shift, value;
 4387|   187k|   png_bytep sp, dp;
 4388|   187k|   png_uint_32 i;
 4389|   187k|   png_uint_32 row_width=row_info->width;
 4390|       |
 4391|   187k|   png_debug(1, "in png_do_expand");
  ------------------
  |  |  145|   187k|#  define png_debug(l, m) ((void)0)
  ------------------
 4392|       |
 4393|   187k|   if (row_info->color_type == PNG_COLOR_TYPE_GRAY)
  ------------------
  |  |  668|   187k|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (4393:8): [True: 183k, False: 3.50k]
  ------------------
 4394|   183k|   {
 4395|   183k|      unsigned int gray = trans_color != NULL ? trans_color->gray : 0;
  ------------------
  |  Branch (4395:27): [True: 589, False: 183k]
  ------------------
 4396|       |
 4397|   183k|      if (row_info->bit_depth < 8)
  ------------------
  |  Branch (4397:11): [True: 178k, False: 5.32k]
  ------------------
 4398|   178k|      {
 4399|   178k|         switch (row_info->bit_depth)
 4400|   178k|         {
 4401|  26.7k|            case 1:
  ------------------
  |  Branch (4401:13): [True: 26.7k, False: 151k]
  ------------------
 4402|  26.7k|            {
 4403|  26.7k|               gray = (gray & 0x01) * 0xff;
 4404|  26.7k|               sp = row + (size_t)((row_width - 1) >> 3);
 4405|  26.7k|               dp = row + (size_t)row_width - 1;
 4406|  26.7k|               shift = 7 - (int)((row_width + 7) & 0x07);
 4407|  13.9M|               for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4407:28): [True: 13.9M, False: 26.7k]
  ------------------
 4408|  13.9M|               {
 4409|  13.9M|                  if ((*sp >> shift) & 0x01)
  ------------------
  |  Branch (4409:23): [True: 2.46M, False: 11.4M]
  ------------------
 4410|  2.46M|                     *dp = 0xff;
 4411|       |
 4412|  11.4M|                  else
 4413|  11.4M|                     *dp = 0;
 4414|       |
 4415|  13.9M|                  if (shift == 7)
  ------------------
  |  Branch (4415:23): [True: 1.75M, False: 12.1M]
  ------------------
 4416|  1.75M|                  {
 4417|  1.75M|                     shift = 0;
 4418|  1.75M|                     sp--;
 4419|  1.75M|                  }
 4420|       |
 4421|  12.1M|                  else
 4422|  12.1M|                     shift++;
 4423|       |
 4424|  13.9M|                  dp--;
 4425|  13.9M|               }
 4426|  26.7k|               break;
 4427|      0|            }
 4428|       |
 4429|  3.10k|            case 2:
  ------------------
  |  Branch (4429:13): [True: 3.10k, False: 175k]
  ------------------
 4430|  3.10k|            {
 4431|  3.10k|               gray = (gray & 0x03) * 0x55;
 4432|  3.10k|               sp = row + (size_t)((row_width - 1) >> 2);
 4433|  3.10k|               dp = row + (size_t)row_width - 1;
 4434|  3.10k|               shift = (int)((3 - ((row_width + 3) & 0x03)) << 1);
 4435|  2.65M|               for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4435:28): [True: 2.65M, False: 3.10k]
  ------------------
 4436|  2.65M|               {
 4437|  2.65M|                  value = (*sp >> shift) & 0x03;
 4438|  2.65M|                  *dp = (png_byte)(value | (value << 2) | (value << 4) |
 4439|  2.65M|                     (value << 6));
 4440|  2.65M|                  if (shift == 6)
  ------------------
  |  Branch (4440:23): [True: 665k, False: 1.98M]
  ------------------
 4441|   665k|                  {
 4442|   665k|                     shift = 0;
 4443|   665k|                     sp--;
 4444|   665k|                  }
 4445|       |
 4446|  1.98M|                  else
 4447|  1.98M|                     shift += 2;
 4448|       |
 4449|  2.65M|                  dp--;
 4450|  2.65M|               }
 4451|  3.10k|               break;
 4452|      0|            }
 4453|       |
 4454|   148k|            case 4:
  ------------------
  |  Branch (4454:13): [True: 148k, False: 29.8k]
  ------------------
 4455|   148k|            {
 4456|   148k|               gray = (gray & 0x0f) * 0x11;
 4457|   148k|               sp = row + (size_t)((row_width - 1) >> 1);
 4458|   148k|               dp = row + (size_t)row_width - 1;
 4459|   148k|               shift = (int)((1 - ((row_width + 1) & 0x01)) << 2);
 4460|  55.8M|               for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4460:28): [True: 55.7M, False: 148k]
  ------------------
 4461|  55.7M|               {
 4462|  55.7M|                  value = (*sp >> shift) & 0x0f;
 4463|  55.7M|                  *dp = (png_byte)(value | (value << 4));
 4464|  55.7M|                  if (shift == 4)
  ------------------
  |  Branch (4464:23): [True: 27.9M, False: 27.7M]
  ------------------
 4465|  27.9M|                  {
 4466|  27.9M|                     shift = 0;
 4467|  27.9M|                     sp--;
 4468|  27.9M|                  }
 4469|       |
 4470|  27.7M|                  else
 4471|  27.7M|                     shift = 4;
 4472|       |
 4473|  55.7M|                  dp--;
 4474|  55.7M|               }
 4475|   148k|               break;
 4476|      0|            }
 4477|       |
 4478|      0|            default:
  ------------------
  |  Branch (4478:13): [True: 0, False: 178k]
  ------------------
 4479|      0|               break;
 4480|   178k|         }
 4481|       |
 4482|   178k|         row_info->bit_depth = 8;
 4483|   178k|         row_info->pixel_depth = 8;
 4484|   178k|         row_info->rowbytes = row_width;
 4485|   178k|      }
 4486|       |
 4487|   183k|      if (trans_color != NULL)
  ------------------
  |  Branch (4487:11): [True: 589, False: 183k]
  ------------------
 4488|    589|      {
 4489|    589|         if (row_info->bit_depth == 8)
  ------------------
  |  Branch (4489:14): [True: 282, False: 307]
  ------------------
 4490|    282|         {
 4491|    282|            gray = gray & 0xff;
 4492|    282|            sp = row + (size_t)row_width - 1;
 4493|    282|            dp = row + ((size_t)row_width << 1) - 1;
 4494|       |
 4495|  1.84M|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4495:25): [True: 1.84M, False: 282]
  ------------------
 4496|  1.84M|            {
 4497|  1.84M|               if ((*sp & 0xffU) == gray)
  ------------------
  |  Branch (4497:20): [True: 1.47M, False: 368k]
  ------------------
 4498|  1.47M|                  *dp-- = 0;
 4499|       |
 4500|   368k|               else
 4501|   368k|                  *dp-- = 0xff;
 4502|       |
 4503|  1.84M|               *dp-- = *sp--;
 4504|  1.84M|            }
 4505|    282|         }
 4506|       |
 4507|    307|         else if (row_info->bit_depth == 16)
  ------------------
  |  Branch (4507:19): [True: 307, False: 0]
  ------------------
 4508|    307|         {
 4509|    307|            unsigned int gray_high = (gray >> 8) & 0xff;
 4510|    307|            unsigned int gray_low = gray & 0xff;
 4511|    307|            sp = row + row_info->rowbytes - 1;
 4512|    307|            dp = row + (row_info->rowbytes << 1) - 1;
 4513|  1.04M|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4513:25): [True: 1.04M, False: 307]
  ------------------
 4514|  1.04M|            {
 4515|  1.04M|               if ((*(sp - 1) & 0xffU) == gray_high &&
  ------------------
  |  Branch (4515:20): [True: 1.51k, False: 1.04M]
  ------------------
 4516|  1.04M|                   (*(sp) & 0xffU) == gray_low)
  ------------------
  |  Branch (4516:20): [True: 235, False: 1.27k]
  ------------------
 4517|    235|               {
 4518|    235|                  *dp-- = 0;
 4519|    235|                  *dp-- = 0;
 4520|    235|               }
 4521|       |
 4522|  1.04M|               else
 4523|  1.04M|               {
 4524|  1.04M|                  *dp-- = 0xff;
 4525|  1.04M|                  *dp-- = 0xff;
 4526|  1.04M|               }
 4527|       |
 4528|  1.04M|               *dp-- = *sp--;
 4529|  1.04M|               *dp-- = *sp--;
 4530|  1.04M|            }
 4531|    307|         }
 4532|       |
 4533|    589|         row_info->color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
  ------------------
  |  |  672|    589|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|    589|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
 4534|    589|         row_info->channels = 2;
 4535|    589|         row_info->pixel_depth = (png_byte)(row_info->bit_depth << 1);
 4536|    589|         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
  ------------------
  |  |  730|    589|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 589, False: 0]
  |  |  ------------------
  |  |  731|    589|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|    589|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 4537|    589|             row_width);
 4538|    589|      }
 4539|   183k|   }
 4540|  3.50k|   else if (row_info->color_type == PNG_COLOR_TYPE_RGB &&
  ------------------
  |  |  670|  7.00k|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|  3.50k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (4540:13): [True: 2.02k, False: 1.47k]
  ------------------
 4541|  3.50k|       trans_color != NULL)
  ------------------
  |  Branch (4541:8): [True: 660, False: 1.36k]
  ------------------
 4542|    660|   {
 4543|    660|      if (row_info->bit_depth == 8)
  ------------------
  |  Branch (4543:11): [True: 349, False: 311]
  ------------------
 4544|    349|      {
 4545|    349|         png_byte red = (png_byte)(trans_color->red & 0xff);
 4546|    349|         png_byte green = (png_byte)(trans_color->green & 0xff);
 4547|    349|         png_byte blue = (png_byte)(trans_color->blue & 0xff);
 4548|    349|         sp = row + (size_t)row_info->rowbytes - 1;
 4549|    349|         dp = row + ((size_t)row_width << 2) - 1;
 4550|   571k|         for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4550:22): [True: 571k, False: 349]
  ------------------
 4551|   571k|         {
 4552|   571k|            if (*(sp - 2) == red && *(sp - 1) == green && *(sp) == blue)
  ------------------
  |  Branch (4552:17): [True: 30.5k, False: 540k]
  |  Branch (4552:37): [True: 22.9k, False: 7.60k]
  |  Branch (4552:59): [True: 14.7k, False: 8.17k]
  ------------------
 4553|  14.7k|               *dp-- = 0;
 4554|       |
 4555|   556k|            else
 4556|   556k|               *dp-- = 0xff;
 4557|       |
 4558|   571k|            *dp-- = *sp--;
 4559|   571k|            *dp-- = *sp--;
 4560|   571k|            *dp-- = *sp--;
 4561|   571k|         }
 4562|    349|      }
 4563|    311|      else if (row_info->bit_depth == 16)
  ------------------
  |  Branch (4563:16): [True: 311, False: 0]
  ------------------
 4564|    311|      {
 4565|    311|         png_byte red_high = (png_byte)((trans_color->red >> 8) & 0xff);
 4566|    311|         png_byte green_high = (png_byte)((trans_color->green >> 8) & 0xff);
 4567|    311|         png_byte blue_high = (png_byte)((trans_color->blue >> 8) & 0xff);
 4568|    311|         png_byte red_low = (png_byte)(trans_color->red & 0xff);
 4569|    311|         png_byte green_low = (png_byte)(trans_color->green & 0xff);
 4570|    311|         png_byte blue_low = (png_byte)(trans_color->blue & 0xff);
 4571|    311|         sp = row + row_info->rowbytes - 1;
 4572|    311|         dp = row + ((size_t)row_width << 3) - 1;
 4573|  3.17k|         for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4573:22): [True: 2.85k, False: 311]
  ------------------
 4574|  2.85k|         {
 4575|  2.85k|            if (*(sp - 5) == red_high &&
  ------------------
  |  Branch (4575:17): [True: 1.89k, False: 962]
  ------------------
 4576|  2.85k|                *(sp - 4) == red_low &&
  ------------------
  |  Branch (4576:17): [True: 1.46k, False: 435]
  ------------------
 4577|  2.85k|                *(sp - 3) == green_high &&
  ------------------
  |  Branch (4577:17): [True: 1.09k, False: 367]
  ------------------
 4578|  2.85k|                *(sp - 2) == green_low &&
  ------------------
  |  Branch (4578:17): [True: 740, False: 355]
  ------------------
 4579|  2.85k|                *(sp - 1) == blue_high &&
  ------------------
  |  Branch (4579:17): [True: 419, False: 321]
  ------------------
 4580|  2.85k|                *(sp    ) == blue_low)
  ------------------
  |  Branch (4580:17): [True: 212, False: 207]
  ------------------
 4581|    212|            {
 4582|    212|               *dp-- = 0;
 4583|    212|               *dp-- = 0;
 4584|    212|            }
 4585|       |
 4586|  2.64k|            else
 4587|  2.64k|            {
 4588|  2.64k|               *dp-- = 0xff;
 4589|  2.64k|               *dp-- = 0xff;
 4590|  2.64k|            }
 4591|       |
 4592|  2.85k|            *dp-- = *sp--;
 4593|  2.85k|            *dp-- = *sp--;
 4594|  2.85k|            *dp-- = *sp--;
 4595|  2.85k|            *dp-- = *sp--;
 4596|  2.85k|            *dp-- = *sp--;
 4597|  2.85k|            *dp-- = *sp--;
 4598|  2.85k|         }
 4599|    311|      }
 4600|    660|      row_info->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
  ------------------
  |  |  671|    660|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|    660|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|    660|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
 4601|    660|      row_info->channels = 4;
 4602|    660|      row_info->pixel_depth = (png_byte)(row_info->bit_depth << 2);
 4603|    660|      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
  ------------------
  |  |  730|    660|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 660, False: 0]
  |  |  ------------------
  |  |  731|    660|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|    660|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 4604|    660|   }
 4605|   187k|}
pngrtran.c:png_do_gray_to_rgb:
 2861|   190k|{
 2862|   190k|   png_uint_32 i;
 2863|   190k|   png_uint_32 row_width = row_info->width;
 2864|       |
 2865|   190k|   png_debug(1, "in png_do_gray_to_rgb");
  ------------------
  |  |  145|   190k|#  define png_debug(l, m) ((void)0)
  ------------------
 2866|       |
 2867|   190k|   if (row_info->bit_depth >= 8 &&
  ------------------
  |  Branch (2867:8): [True: 190k, False: 0]
  ------------------
 2868|   190k|       (row_info->color_type & PNG_COLOR_MASK_COLOR) == 0)
  ------------------
  |  |  664|   190k|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (2868:8): [True: 184k, False: 5.81k]
  ------------------
 2869|   184k|   {
 2870|   184k|      if (row_info->color_type == PNG_COLOR_TYPE_GRAY)
  ------------------
  |  |  668|   184k|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (2870:11): [True: 183k, False: 1.35k]
  ------------------
 2871|   183k|      {
 2872|   183k|         if (row_info->bit_depth == 8)
  ------------------
  |  Branch (2872:14): [True: 179k, False: 3.57k]
  ------------------
 2873|   179k|         {
 2874|       |            /* This changes G to RGB */
 2875|   179k|            png_bytep sp = row + (size_t)row_width - 1;
 2876|   179k|            png_bytep dp = sp  + (size_t)row_width * 2;
 2877|  71.6M|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2877:25): [True: 71.4M, False: 179k]
  ------------------
 2878|  71.4M|            {
 2879|  71.4M|               *(dp--) = *sp;
 2880|  71.4M|               *(dp--) = *sp;
 2881|  71.4M|               *(dp--) = *(sp--);
 2882|  71.4M|            }
 2883|   179k|         }
 2884|       |
 2885|  3.57k|         else
 2886|  3.57k|         {
 2887|       |            /* This changes GG to RRGGBB */
 2888|  3.57k|            png_bytep sp = row + (size_t)row_width * 2 - 1;
 2889|  3.57k|            png_bytep dp = sp  + (size_t)row_width * 4;
 2890|  2.32M|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2890:25): [True: 2.32M, False: 3.57k]
  ------------------
 2891|  2.32M|            {
 2892|  2.32M|               *(dp--) = *sp;
 2893|  2.32M|               *(dp--) = *(sp - 1);
 2894|  2.32M|               *(dp--) = *sp;
 2895|  2.32M|               *(dp--) = *(sp - 1);
 2896|  2.32M|               *(dp--) = *(sp--);
 2897|  2.32M|               *(dp--) = *(sp--);
 2898|  2.32M|            }
 2899|  3.57k|         }
 2900|   183k|      }
 2901|       |
 2902|  1.35k|      else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
  ------------------
  |  |  672|  1.35k|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|  1.35k|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (2902:16): [True: 1.35k, False: 0]
  ------------------
 2903|  1.35k|      {
 2904|  1.35k|         if (row_info->bit_depth == 8)
  ------------------
  |  Branch (2904:14): [True: 696, False: 663]
  ------------------
 2905|    696|         {
 2906|       |            /* This changes GA to RGBA */
 2907|    696|            png_bytep sp = row + (size_t)row_width * 2 - 1;
 2908|    696|            png_bytep dp = sp  + (size_t)row_width * 2;
 2909|  3.95M|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2909:25): [True: 3.95M, False: 696]
  ------------------
 2910|  3.95M|            {
 2911|  3.95M|               *(dp--) = *(sp--);
 2912|  3.95M|               *(dp--) = *sp;
 2913|  3.95M|               *(dp--) = *sp;
 2914|  3.95M|               *(dp--) = *(sp--);
 2915|  3.95M|            }
 2916|    696|         }
 2917|       |
 2918|    663|         else
 2919|    663|         {
 2920|       |            /* This changes GGAA to RRGGBBAA */
 2921|    663|            png_bytep sp = row + (size_t)row_width * 4 - 1;
 2922|    663|            png_bytep dp = sp  + (size_t)row_width * 4;
 2923|  1.04M|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2923:25): [True: 1.04M, False: 663]
  ------------------
 2924|  1.04M|            {
 2925|  1.04M|               *(dp--) = *(sp--);
 2926|  1.04M|               *(dp--) = *(sp--);
 2927|  1.04M|               *(dp--) = *sp;
 2928|  1.04M|               *(dp--) = *(sp - 1);
 2929|  1.04M|               *(dp--) = *sp;
 2930|  1.04M|               *(dp--) = *(sp - 1);
 2931|  1.04M|               *(dp--) = *(sp--);
 2932|  1.04M|               *(dp--) = *(sp--);
 2933|  1.04M|            }
 2934|    663|         }
 2935|  1.35k|      }
 2936|   184k|      row_info->channels = (png_byte)(row_info->channels + 2);
 2937|   184k|      row_info->color_type |= PNG_COLOR_MASK_COLOR;
  ------------------
  |  |  664|   184k|#define PNG_COLOR_MASK_COLOR      2
  ------------------
 2938|   184k|      row_info->pixel_depth = (png_byte)(row_info->channels *
 2939|   184k|          row_info->bit_depth);
 2940|   184k|      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
  ------------------
  |  |  730|   184k|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 184k, False: 0]
  |  |  ------------------
  |  |  731|   184k|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|   184k|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 2941|   184k|   }
 2942|   190k|}
pngrtran.c:png_do_scale_16_to_8:
 2390|   190k|{
 2391|   190k|   png_debug(1, "in png_do_scale_16_to_8");
  ------------------
  |  |  145|   190k|#  define png_debug(l, m) ((void)0)
  ------------------
 2392|       |
 2393|   190k|   if (row_info->bit_depth == 16)
  ------------------
  |  Branch (2393:8): [True: 4.92k, False: 185k]
  ------------------
 2394|  4.92k|   {
 2395|  4.92k|      png_bytep sp = row; /* source */
 2396|  4.92k|      png_bytep dp = row; /* destination */
 2397|  4.92k|      png_bytep ep = sp + row_info->rowbytes; /* end+1 */
 2398|       |
 2399|  16.1M|      while (sp < ep)
  ------------------
  |  Branch (2399:14): [True: 16.1M, False: 4.92k]
  ------------------
 2400|  16.1M|      {
 2401|       |         /* The input is an array of 16-bit components, these must be scaled to
 2402|       |          * 8 bits each.  For a 16-bit value V the required value (from the PNG
 2403|       |          * specification) is:
 2404|       |          *
 2405|       |          *    (V * 255) / 65535
 2406|       |          *
 2407|       |          * This reduces to round(V / 257), or floor((V + 128.5)/257)
 2408|       |          *
 2409|       |          * Represent V as the two byte value vhi.vlo.  Make a guess that the
 2410|       |          * result is the top byte of V, vhi, then the correction to this value
 2411|       |          * is:
 2412|       |          *
 2413|       |          *    error = floor(((V-vhi.vhi) + 128.5) / 257)
 2414|       |          *          = floor(((vlo-vhi) + 128.5) / 257)
 2415|       |          *
 2416|       |          * This can be approximated using integer arithmetic (and a signed
 2417|       |          * shift):
 2418|       |          *
 2419|       |          *    error = (vlo-vhi+128) >> 8;
 2420|       |          *
 2421|       |          * The approximate differs from the exact answer only when (vlo-vhi) is
 2422|       |          * 128; it then gives a correction of +1 when the exact correction is
 2423|       |          * 0.  This gives 128 errors.  The exact answer (correct for all 16-bit
 2424|       |          * input values) is:
 2425|       |          *
 2426|       |          *    error = (vlo-vhi+128)*65535 >> 24;
 2427|       |          *
 2428|       |          * An alternative arithmetic calculation which also gives no errors is:
 2429|       |          *
 2430|       |          *    (V * 255 + 32895) >> 16
 2431|       |          */
 2432|       |
 2433|  16.1M|         png_int_32 tmp = *sp++; /* must be signed! */
 2434|  16.1M|         tmp += (((int)*sp++ - tmp + 128) * 65535) >> 24;
 2435|  16.1M|         *dp++ = (png_byte)tmp;
 2436|  16.1M|      }
 2437|       |
 2438|  4.92k|      row_info->bit_depth = 8;
 2439|  4.92k|      row_info->pixel_depth = (png_byte)(8 * row_info->channels);
 2440|  4.92k|      row_info->rowbytes = row_info->width * row_info->channels;
 2441|  4.92k|   }
 2442|   190k|}
pngrtran.c:png_do_unpack:
 2153|   179k|{
 2154|   179k|   png_debug(1, "in png_do_unpack");
  ------------------
  |  |  145|   179k|#  define png_debug(l, m) ((void)0)
  ------------------
 2155|       |
 2156|   179k|   if (row_info->bit_depth < 8)
  ------------------
  |  Branch (2156:8): [True: 0, False: 179k]
  ------------------
 2157|      0|   {
 2158|      0|      png_uint_32 i;
 2159|      0|      png_uint_32 row_width=row_info->width;
 2160|       |
 2161|      0|      switch (row_info->bit_depth)
 2162|      0|      {
 2163|      0|         case 1:
  ------------------
  |  Branch (2163:10): [True: 0, False: 0]
  ------------------
 2164|      0|         {
 2165|      0|            png_bytep sp = row + (size_t)((row_width - 1) >> 3);
 2166|      0|            png_bytep dp = row + (size_t)row_width - 1;
 2167|      0|            png_uint_32 shift = 7U - ((row_width + 7U) & 0x07);
 2168|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2168:25): [True: 0, False: 0]
  ------------------
 2169|      0|            {
 2170|      0|               *dp = (png_byte)((*sp >> shift) & 0x01);
 2171|       |
 2172|      0|               if (shift == 7)
  ------------------
  |  Branch (2172:20): [True: 0, False: 0]
  ------------------
 2173|      0|               {
 2174|      0|                  shift = 0;
 2175|      0|                  sp--;
 2176|      0|               }
 2177|       |
 2178|      0|               else
 2179|      0|                  shift++;
 2180|       |
 2181|      0|               dp--;
 2182|      0|            }
 2183|      0|            break;
 2184|      0|         }
 2185|       |
 2186|      0|         case 2:
  ------------------
  |  Branch (2186:10): [True: 0, False: 0]
  ------------------
 2187|      0|         {
 2188|       |
 2189|      0|            png_bytep sp = row + (size_t)((row_width - 1) >> 2);
 2190|      0|            png_bytep dp = row + (size_t)row_width - 1;
 2191|      0|            png_uint_32 shift = ((3U - ((row_width + 3U) & 0x03)) << 1);
 2192|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2192:25): [True: 0, False: 0]
  ------------------
 2193|      0|            {
 2194|      0|               *dp = (png_byte)((*sp >> shift) & 0x03);
 2195|       |
 2196|      0|               if (shift == 6)
  ------------------
  |  Branch (2196:20): [True: 0, False: 0]
  ------------------
 2197|      0|               {
 2198|      0|                  shift = 0;
 2199|      0|                  sp--;
 2200|      0|               }
 2201|       |
 2202|      0|               else
 2203|      0|                  shift += 2;
 2204|       |
 2205|      0|               dp--;
 2206|      0|            }
 2207|      0|            break;
 2208|      0|         }
 2209|       |
 2210|      0|         case 4:
  ------------------
  |  Branch (2210:10): [True: 0, False: 0]
  ------------------
 2211|      0|         {
 2212|      0|            png_bytep sp = row + (size_t)((row_width - 1) >> 1);
 2213|      0|            png_bytep dp = row + (size_t)row_width - 1;
 2214|      0|            png_uint_32 shift = ((1U - ((row_width + 1U) & 0x01)) << 2);
 2215|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2215:25): [True: 0, False: 0]
  ------------------
 2216|      0|            {
 2217|      0|               *dp = (png_byte)((*sp >> shift) & 0x0f);
 2218|       |
 2219|      0|               if (shift == 4)
  ------------------
  |  Branch (2219:20): [True: 0, False: 0]
  ------------------
 2220|      0|               {
 2221|      0|                  shift = 0;
 2222|      0|                  sp--;
 2223|      0|               }
 2224|       |
 2225|      0|               else
 2226|      0|                  shift = 4;
 2227|       |
 2228|      0|               dp--;
 2229|      0|            }
 2230|      0|            break;
 2231|      0|         }
 2232|       |
 2233|      0|         default:
  ------------------
  |  Branch (2233:10): [True: 0, False: 0]
  ------------------
 2234|      0|            break;
 2235|      0|      }
 2236|      0|      row_info->bit_depth = 8;
 2237|      0|      row_info->pixel_depth = (png_byte)(8 * row_info->channels);
 2238|      0|      row_info->rowbytes = row_width * row_info->channels;
 2239|      0|   }
 2240|   179k|}

OSS_FUZZ_png_get_uint_31:
   23|   125k|{
   24|   125k|   png_uint_32 uval = png_get_uint_32(buf);
  ------------------
  |  |  303|   125k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|   125k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|   125k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|   125k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|   125k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|   125k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
   25|       |
   26|   125k|   if (uval > PNG_UINT_31_MAX)
  ------------------
  |  |  649|   125k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
  |  Branch (26:8): [True: 112, False: 125k]
  ------------------
   27|    112|      png_error(png_ptr, "PNG unsigned integer out of range");
  ------------------
  |  |  238|    112|#define png_error OSS_FUZZ_png_error
  ------------------
   28|       |
   29|   125k|   return (uval);
   30|   125k|}
OSS_FUZZ_png_read_sig:
  122|  8.50k|{
  123|  8.50k|   size_t num_checked, num_to_check;
  124|       |
  125|       |   /* Exit if the user application does not expect a signature. */
  126|  8.50k|   if (png_ptr->sig_bytes >= 8)
  ------------------
  |  Branch (126:8): [True: 8.50k, False: 0]
  ------------------
  127|  8.50k|      return;
  128|       |
  129|      0|   num_checked = png_ptr->sig_bytes;
  130|      0|   num_to_check = 8 - num_checked;
  131|       |
  132|      0|#ifdef PNG_IO_STATE_SUPPORTED
  133|      0|   png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE;
  ------------------
  |  | 2423|      0|#  define PNG_IO_READING     0x0001   /* currently reading */
  ------------------
                 png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE;
  ------------------
  |  | 2425|      0|#  define PNG_IO_SIGNATURE   0x0010   /* currently at the file signature */
  ------------------
  134|      0|#endif
  135|       |
  136|       |   /* The signature must be serialized in a single I/O call. */
  137|      0|   png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check);
  ------------------
  |  |   22|      0|#define png_read_data OSS_FUZZ_png_read_data
  ------------------
  138|      0|   png_ptr->sig_bytes = 8;
  139|       |
  140|      0|   if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check) != 0)
  ------------------
  |  |  424|      0|#define png_sig_cmp OSS_FUZZ_png_sig_cmp
  ------------------
  |  Branch (140:8): [True: 0, False: 0]
  ------------------
  141|      0|   {
  142|      0|      if (num_checked < 4 &&
  ------------------
  |  Branch (142:11): [True: 0, False: 0]
  ------------------
  143|      0|          png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4))
  ------------------
  |  |  424|      0|#define png_sig_cmp OSS_FUZZ_png_sig_cmp
  ------------------
  |  Branch (143:11): [True: 0, False: 0]
  ------------------
  144|      0|         png_error(png_ptr, "Not a PNG file");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  145|      0|      else
  146|      0|         png_error(png_ptr, "PNG file corrupted by ASCII conversion");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  147|      0|   }
  148|      0|   if (num_checked < 3)
  ------------------
  |  Branch (148:8): [True: 0, False: 0]
  ------------------
  149|      0|      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
  ------------------
  |  |  627|      0|#define PNG_HAVE_PNG_SIGNATURE    0x1000U
  ------------------
  150|      0|}
OSS_FUZZ_png_read_chunk_header:
  157|   112k|{
  158|   112k|   png_byte buf[8];
  159|   112k|   png_uint_32 length;
  160|       |
  161|   112k|#ifdef PNG_IO_STATE_SUPPORTED
  162|   112k|   png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR;
  ------------------
  |  | 2423|   112k|#  define PNG_IO_READING     0x0001   /* currently reading */
  ------------------
                 png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR;
  ------------------
  |  | 2426|   112k|#  define PNG_IO_CHUNK_HDR   0x0020   /* currently at the chunk header */
  ------------------
  163|   112k|#endif
  164|       |
  165|       |   /* Read the length and the chunk name.
  166|       |    * This must be performed in a single I/O call.
  167|       |    */
  168|   112k|   png_read_data(png_ptr, buf, 8);
  ------------------
  |  |   22|   112k|#define png_read_data OSS_FUZZ_png_read_data
  ------------------
  169|   112k|   length = png_get_uint_31(png_ptr, buf);
  ------------------
  |  |  302|   112k|#define png_get_uint_31 OSS_FUZZ_png_get_uint_31
  ------------------
  170|       |
  171|       |   /* Put the chunk name into png_ptr->chunk_name. */
  172|   112k|   png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(buf+4);
  ------------------
  |  |  871|   112k|   PNG_U32(0xff & (s)[0], 0xff & (s)[1], 0xff & (s)[2], 0xff & (s)[3])
  |  |  ------------------
  |  |  |  |  814|   112k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   112k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   112k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   112k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   112k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  173|       |
  174|   112k|   png_debug2(0, "Reading %lx chunk, length = %lu",
  ------------------
  |  |  151|   112k|#  define png_debug2(l, m, p1, p2) ((void)0)
  ------------------
  175|   112k|       (unsigned long)png_ptr->chunk_name, (unsigned long)length);
  176|       |
  177|       |   /* Reset the crc and run it over the chunk name. */
  178|   112k|   png_reset_crc(png_ptr);
  ------------------
  |  |   18|   112k|#define png_reset_crc OSS_FUZZ_png_reset_crc
  ------------------
  179|   112k|   png_calculate_crc(png_ptr, buf + 4, 4);
  ------------------
  |  |   26|   112k|#define png_calculate_crc OSS_FUZZ_png_calculate_crc
  ------------------
  180|       |
  181|       |   /* Check to see if chunk name is valid. */
  182|   112k|   png_check_chunk_name(png_ptr, png_ptr->chunk_name);
  ------------------
  |  |   70|   112k|#define png_check_chunk_name OSS_FUZZ_png_check_chunk_name
  ------------------
  183|       |
  184|       |   /* Check for too-large chunk length */
  185|   112k|   png_check_chunk_length(png_ptr, length);
  ------------------
  |  |   71|   112k|#define png_check_chunk_length OSS_FUZZ_png_check_chunk_length
  ------------------
  186|       |
  187|   112k|#ifdef PNG_IO_STATE_SUPPORTED
  188|   112k|   png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;
  ------------------
  |  | 2423|   112k|#  define PNG_IO_READING     0x0001   /* currently reading */
  ------------------
                 png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;
  ------------------
  |  | 2427|   112k|#  define PNG_IO_CHUNK_DATA  0x0040   /* currently at the chunk data */
  ------------------
  189|   112k|#endif
  190|       |
  191|   112k|   return length;
  192|   112k|}
OSS_FUZZ_png_crc_read:
  197|   866k|{
  198|   866k|   if (png_ptr == NULL)
  ------------------
  |  Branch (198:8): [True: 0, False: 866k]
  ------------------
  199|      0|      return;
  200|       |
  201|   866k|   png_read_data(png_ptr, buf, length);
  ------------------
  |  |   22|   866k|#define png_read_data OSS_FUZZ_png_read_data
  ------------------
  202|   866k|   png_calculate_crc(png_ptr, buf, length);
  ------------------
  |  |   26|   866k|#define png_calculate_crc OSS_FUZZ_png_calculate_crc
  ------------------
  203|   866k|}
OSS_FUZZ_png_crc_finish:
  212|  67.9k|{
  213|       |   /* The size of the local buffer for inflate is a good guess as to a
  214|       |    * reasonable size to use for buffering reads from the application.
  215|       |    */
  216|  76.5k|   while (skip > 0)
  ------------------
  |  Branch (216:11): [True: 8.55k, False: 67.9k]
  ------------------
  217|  8.55k|   {
  218|  8.55k|      png_uint_32 len;
  219|  8.55k|      png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
  220|       |
  221|  8.55k|      len = (sizeof tmpbuf);
  222|  8.55k|      if (len > skip)
  ------------------
  |  Branch (222:11): [True: 5.91k, False: 2.63k]
  ------------------
  223|  5.91k|         len = skip;
  224|  8.55k|      skip -= len;
  225|       |
  226|  8.55k|      png_crc_read(png_ptr, tmpbuf, len);
  ------------------
  |  |   23|  8.55k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
  227|  8.55k|   }
  228|       |
  229|  67.9k|   if (png_crc_error(png_ptr) != 0)
  ------------------
  |  |   25|  67.9k|#define png_crc_error OSS_FUZZ_png_crc_error
  ------------------
  |  Branch (229:8): [True: 0, False: 67.9k]
  ------------------
  230|      0|   {
  231|      0|      if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0 ?
  ------------------
  |  |  888|      0|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  ------------------
  |  Branch (231:11): [True: 0, False: 0]
  |  Branch (231:11): [True: 0, False: 0]
  ------------------
  232|      0|          (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == 0 :
  ------------------
  |  |  679|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
  233|      0|          (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE) != 0)
  ------------------
  |  |  680|      0|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  ------------------
  234|      0|      {
  235|      0|         png_chunk_warning(png_ptr, "CRC error");
  ------------------
  |  |  226|      0|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
  236|      0|      }
  237|       |
  238|      0|      else
  239|      0|         png_chunk_error(png_ptr, "CRC error");
  ------------------
  |  |  225|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  240|       |
  241|      0|      return (1);
  242|      0|   }
  243|       |
  244|  67.9k|   return (0);
  245|  67.9k|}
OSS_FUZZ_png_crc_error:
  252|  65.4k|{
  253|  65.4k|   png_byte crc_bytes[4];
  254|  65.4k|   png_uint_32 crc;
  255|  65.4k|   int need_crc = 1;
  256|       |
  257|  65.4k|   if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0)
  ------------------
  |  |  888|  65.4k|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  ------------------
  |  Branch (257:8): [True: 53.7k, False: 11.6k]
  ------------------
  258|  53.7k|   {
  259|  53.7k|      if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
  ------------------
  |  |  702|  53.7k|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  678|  53.7k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  703|  53.7k|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  679|  53.7k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
  |  Branch (259:11): [True: 53.7k, False: 0]
  ------------------
  260|  53.7k|          (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
  ------------------
  |  |  678|  53.7k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  ------------------
                        (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
  ------------------
  |  |  679|  53.7k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
  261|  53.7k|         need_crc = 0;
  262|  53.7k|   }
  263|       |
  264|  11.6k|   else /* critical */
  265|  11.6k|   {
  266|  11.6k|      if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)
  ------------------
  |  |  681|  11.6k|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  ------------------
  |  Branch (266:11): [True: 11.6k, False: 0]
  ------------------
  267|  11.6k|         need_crc = 0;
  268|  11.6k|   }
  269|       |
  270|  65.4k|#ifdef PNG_IO_STATE_SUPPORTED
  271|  65.4k|   png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC;
  ------------------
  |  | 2423|  65.4k|#  define PNG_IO_READING     0x0001   /* currently reading */
  ------------------
                 png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC;
  ------------------
  |  | 2428|  65.4k|#  define PNG_IO_CHUNK_CRC   0x0080   /* currently at the chunk crc */
  ------------------
  272|  65.4k|#endif
  273|       |
  274|       |   /* The chunk CRC must be serialized in a single I/O call. */
  275|  65.4k|   png_read_data(png_ptr, crc_bytes, 4);
  ------------------
  |  |   22|  65.4k|#define png_read_data OSS_FUZZ_png_read_data
  ------------------
  276|       |
  277|  65.4k|   if (need_crc != 0)
  ------------------
  |  Branch (277:8): [True: 0, False: 65.4k]
  ------------------
  278|      0|   {
  279|      0|      crc = png_get_uint_32(crc_bytes);
  ------------------
  |  |  303|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  280|      0|      return ((int)(crc != png_ptr->crc));
  281|      0|   }
  282|       |
  283|  65.4k|   else
  284|  65.4k|      return (0);
  285|  65.4k|}
OSS_FUZZ_png_zlib_inflate:
  454|  2.19M|{
  455|  2.19M|   if (png_ptr->zstream_start && png_ptr->zstream.avail_in > 0)
  ------------------
  |  Branch (455:8): [True: 10.4k, False: 2.18M]
  |  Branch (455:34): [True: 10.4k, False: 0]
  ------------------
  456|  10.4k|   {
  457|  10.4k|      if ((*png_ptr->zstream.next_in >> 4) > 7)
  ------------------
  |  Branch (457:11): [True: 404, False: 10.0k]
  ------------------
  458|    404|      {
  459|    404|         png_ptr->zstream.msg = "invalid window size (libpng)";
  460|    404|         return Z_DATA_ERROR;
  461|    404|      }
  462|       |
  463|  10.0k|      png_ptr->zstream_start = 0;
  464|  10.0k|   }
  465|       |
  466|  2.19M|   return inflate(&png_ptr->zstream, flush);
  467|  2.19M|}
OSS_FUZZ_png_handle_IHDR:
  839|  7.95k|{
  840|  7.95k|   png_byte buf[13];
  841|  7.95k|   png_uint_32 width, height;
  842|  7.95k|   int bit_depth, color_type, compression_type, filter_type;
  843|  7.95k|   int interlace_type;
  844|       |
  845|  7.95k|   png_debug(1, "in png_handle_IHDR");
  ------------------
  |  |  145|  7.95k|#  define png_debug(l, m) ((void)0)
  ------------------
  846|       |
  847|  7.95k|   if ((png_ptr->mode & PNG_HAVE_IHDR) != 0)
  ------------------
  |  |  644|  7.95k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (847:8): [True: 4, False: 7.94k]
  ------------------
  848|      4|      png_chunk_error(png_ptr, "out of place");
  ------------------
  |  |  225|      4|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  849|       |
  850|       |   /* Check the length */
  851|  7.94k|   if (length != 13)
  ------------------
  |  Branch (851:8): [True: 33, False: 7.91k]
  ------------------
  852|     33|      png_chunk_error(png_ptr, "invalid");
  ------------------
  |  |  225|     33|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  853|       |
  854|  7.91k|   png_ptr->mode |= PNG_HAVE_IHDR;
  ------------------
  |  |  644|  7.91k|#define PNG_HAVE_IHDR  0x01
  ------------------
  855|       |
  856|  7.91k|   png_crc_read(png_ptr, buf, 13);
  ------------------
  |  |   23|  7.91k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
  857|  7.91k|   png_crc_finish(png_ptr, 0);
  ------------------
  |  |   24|  7.91k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  858|       |
  859|  7.91k|   width = png_get_uint_31(png_ptr, buf);
  ------------------
  |  |  302|  7.91k|#define png_get_uint_31 OSS_FUZZ_png_get_uint_31
  ------------------
  860|  7.91k|   height = png_get_uint_31(png_ptr, buf + 4);
  ------------------
  |  |  302|  7.91k|#define png_get_uint_31 OSS_FUZZ_png_get_uint_31
  ------------------
  861|  7.91k|   bit_depth = buf[8];
  862|  7.91k|   color_type = buf[9];
  863|  7.91k|   compression_type = buf[10];
  864|  7.91k|   filter_type = buf[11];
  865|  7.91k|   interlace_type = buf[12];
  866|       |
  867|       |   /* Set internal variables */
  868|  7.91k|   png_ptr->width = width;
  869|  7.91k|   png_ptr->height = height;
  870|  7.91k|   png_ptr->bit_depth = (png_byte)bit_depth;
  871|  7.91k|   png_ptr->interlaced = (png_byte)interlace_type;
  872|  7.91k|   png_ptr->color_type = (png_byte)color_type;
  873|  7.91k|#ifdef PNG_MNG_FEATURES_SUPPORTED
  874|  7.91k|   png_ptr->filter_type = (png_byte)filter_type;
  875|  7.91k|#endif
  876|  7.91k|   png_ptr->compression_type = (png_byte)compression_type;
  877|       |
  878|       |   /* Find number of channels */
  879|  7.91k|   switch (png_ptr->color_type)
  880|  7.91k|   {
  881|     79|      default: /* invalid, png_set_IHDR calls png_error */
  ------------------
  |  Branch (881:7): [True: 79, False: 7.83k]
  ------------------
  882|  3.46k|      case PNG_COLOR_TYPE_GRAY:
  ------------------
  |  |  668|  3.46k|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (882:7): [True: 3.38k, False: 4.53k]
  ------------------
  883|  6.38k|      case PNG_COLOR_TYPE_PALETTE:
  ------------------
  |  |  669|  6.38k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  6.38k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  6.38k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (883:7): [True: 2.92k, False: 4.99k]
  ------------------
  884|  6.38k|         png_ptr->channels = 1;
  885|  6.38k|         break;
  886|       |
  887|    891|      case PNG_COLOR_TYPE_RGB:
  ------------------
  |  |  670|    891|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|    891|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (887:7): [True: 891, False: 7.02k]
  ------------------
  888|    891|         png_ptr->channels = 3;
  889|    891|         break;
  890|       |
  891|    130|      case PNG_COLOR_TYPE_GRAY_ALPHA:
  ------------------
  |  |  672|    130|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|    130|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (891:7): [True: 130, False: 7.78k]
  ------------------
  892|    130|         png_ptr->channels = 2;
  893|    130|         break;
  894|       |
  895|    443|      case PNG_COLOR_TYPE_RGB_ALPHA:
  ------------------
  |  |  671|    443|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|    443|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|    443|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (895:7): [True: 443, False: 7.47k]
  ------------------
  896|    443|         png_ptr->channels = 4;
  897|    443|         break;
  898|  7.91k|   }
  899|       |
  900|       |   /* Set up other useful info */
  901|  7.84k|   png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels);
  902|  7.84k|   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
  ------------------
  |  |  730|  7.84k|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 2.74k, False: 5.09k]
  |  |  ------------------
  |  |  731|  7.84k|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|  7.84k|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
  903|  7.84k|   png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);
  ------------------
  |  |  148|  7.84k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  904|  7.84k|   png_debug1(3, "channels = %d", png_ptr->channels);
  ------------------
  |  |  148|  7.84k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  905|  7.84k|   png_debug1(3, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes);
  ------------------
  |  |  148|  7.84k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  906|  7.84k|   png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
  ------------------
  |  |  344|  7.84k|#define png_set_IHDR OSS_FUZZ_png_set_IHDR
  ------------------
  907|  7.84k|       color_type, interlace_type, compression_type, filter_type);
  908|  7.84k|}
OSS_FUZZ_png_handle_PLTE:
  913|    685|{
  914|    685|   png_color palette[PNG_MAX_PALETTE_LENGTH];
  915|    685|   int max_palette_length, num, i;
  916|    685|#ifdef PNG_POINTER_INDEXING_SUPPORTED
  917|    685|   png_colorp pal_ptr;
  918|    685|#endif
  919|       |
  920|    685|   png_debug(1, "in png_handle_PLTE");
  ------------------
  |  |  145|    685|#  define png_debug(l, m) ((void)0)
  ------------------
  921|       |
  922|    685|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|    685|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (922:8): [True: 1, False: 684]
  ------------------
  923|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  924|       |
  925|       |   /* Moved to before the 'after IDAT' check below because otherwise duplicate
  926|       |    * PLTE chunks are potentially ignored (the spec says there shall not be more
  927|       |    * than one PLTE, the error is not treated as benign, so this check trumps
  928|       |    * the requirement that PLTE appears before IDAT.)
  929|       |    */
  930|    684|   else if ((png_ptr->mode & PNG_HAVE_PLTE) != 0)
  ------------------
  |  |  645|    684|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (930:13): [True: 1, False: 683]
  ------------------
  931|      1|      png_chunk_error(png_ptr, "duplicate");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  932|       |
  933|    683|   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|    683|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (933:13): [True: 194, False: 489]
  ------------------
  934|    194|   {
  935|       |      /* This is benign because the non-benign error happened before, when an
  936|       |       * IDAT was encountered in a color-mapped image with no PLTE.
  937|       |       */
  938|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  939|    194|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
  940|    194|      return;
  941|    194|   }
  942|       |
  943|    489|   png_ptr->mode |= PNG_HAVE_PLTE;
  ------------------
  |  |  645|    489|#define PNG_HAVE_PLTE  0x02
  ------------------
  944|       |
  945|    489|   if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
  ------------------
  |  |  664|    489|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (945:8): [True: 90, False: 399]
  ------------------
  946|     90|   {
  947|     90|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|     90|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  948|     90|      png_chunk_benign_error(png_ptr, "ignored in grayscale PNG");
  ------------------
  |  |  224|     90|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
  949|     90|      return;
  950|     90|   }
  951|       |
  952|       |#ifndef PNG_READ_OPT_PLTE_SUPPORTED
  953|       |   if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
  954|       |   {
  955|       |      png_crc_finish(png_ptr, length);
  956|       |      return;
  957|       |   }
  958|       |#endif
  959|       |
  960|    399|   if (length > 3*PNG_MAX_PALETTE_LENGTH || length % 3)
  ------------------
  |  |  725|    798|#define PNG_MAX_PALETTE_LENGTH    256
  ------------------
  |  Branch (960:8): [True: 1, False: 398]
  |  Branch (960:45): [True: 4, False: 394]
  ------------------
  961|      5|   {
  962|      5|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|      5|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  963|       |
  964|      5|      if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|      5|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      5|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      5|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (964:11): [True: 2, False: 3]
  ------------------
  965|      2|         png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|      2|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
  966|       |
  967|      3|      else
  968|      3|         png_chunk_error(png_ptr, "invalid");
  ------------------
  |  |  225|      3|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  969|       |
  970|      2|      return;
  971|      5|   }
  972|       |
  973|       |   /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */
  974|    394|   num = (int)length / 3;
  975|       |
  976|       |   /* If the palette has 256 or fewer entries but is too large for the bit
  977|       |    * depth, we don't issue an error, to preserve the behavior of previous
  978|       |    * libpng versions. We silently truncate the unused extra palette entries
  979|       |    * here.
  980|       |    */
  981|    394|   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|    394|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|    394|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|    394|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (981:8): [True: 367, False: 27]
  ------------------
  982|    367|      max_palette_length = (1 << png_ptr->bit_depth);
  983|     27|   else
  984|     27|      max_palette_length = PNG_MAX_PALETTE_LENGTH;
  ------------------
  |  |  725|     27|#define PNG_MAX_PALETTE_LENGTH    256
  ------------------
  985|       |
  986|    394|   if (num > max_palette_length)
  ------------------
  |  Branch (986:8): [True: 15, False: 379]
  ------------------
  987|     15|      num = max_palette_length;
  988|       |
  989|    394|#ifdef PNG_POINTER_INDEXING_SUPPORTED
  990|  10.2k|   for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
  ------------------
  |  Branch (990:35): [True: 9.81k, False: 394]
  ------------------
  991|  9.81k|   {
  992|  9.81k|      png_byte buf[3];
  993|       |
  994|  9.81k|      png_crc_read(png_ptr, buf, 3);
  ------------------
  |  |   23|  9.81k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
  995|  9.81k|      pal_ptr->red = buf[0];
  996|  9.81k|      pal_ptr->green = buf[1];
  997|  9.81k|      pal_ptr->blue = buf[2];
  998|  9.81k|   }
  999|       |#else
 1000|       |   for (i = 0; i < num; i++)
 1001|       |   {
 1002|       |      png_byte buf[3];
 1003|       |
 1004|       |      png_crc_read(png_ptr, buf, 3);
 1005|       |      /* Don't depend upon png_color being any order */
 1006|       |      palette[i].red = buf[0];
 1007|       |      palette[i].green = buf[1];
 1008|       |      palette[i].blue = buf[2];
 1009|       |   }
 1010|       |#endif
 1011|       |
 1012|       |   /* If we actually need the PLTE chunk (ie for a paletted image), we do
 1013|       |    * whatever the normal CRC configuration tells us.  However, if we
 1014|       |    * have an RGB image, the PLTE can be considered ancillary, so
 1015|       |    * we will act as though it is.
 1016|       |    */
 1017|       |#ifndef PNG_READ_OPT_PLTE_SUPPORTED
 1018|       |   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
 1019|       |#endif
 1020|    394|   {
 1021|    394|      png_crc_finish(png_ptr, (png_uint_32) (length - (unsigned int)num * 3));
  ------------------
  |  |   24|    394|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1022|    394|   }
 1023|       |
 1024|       |#ifndef PNG_READ_OPT_PLTE_SUPPORTED
 1025|       |   else if (png_crc_error(png_ptr) != 0)  /* Only if we have a CRC error */
 1026|       |   {
 1027|       |      /* If we don't want to use the data from an ancillary chunk,
 1028|       |       * we have two options: an error abort, or a warning and we
 1029|       |       * ignore the data in this chunk (which should be OK, since
 1030|       |       * it's considered ancillary for a RGB or RGBA image).
 1031|       |       *
 1032|       |       * IMPLEMENTATION NOTE: this is only here because png_crc_finish uses the
 1033|       |       * chunk type to determine whether to check the ancillary or the critical
 1034|       |       * flags.
 1035|       |       */
 1036|       |      if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE) == 0)
 1037|       |      {
 1038|       |         if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) != 0)
 1039|       |            return;
 1040|       |
 1041|       |         else
 1042|       |            png_chunk_error(png_ptr, "CRC error");
 1043|       |      }
 1044|       |
 1045|       |      /* Otherwise, we (optionally) emit a warning and use the chunk. */
 1046|       |      else if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == 0)
 1047|       |         png_chunk_warning(png_ptr, "CRC error");
 1048|       |   }
 1049|       |#endif
 1050|       |
 1051|       |   /* TODO: png_set_PLTE has the side effect of setting png_ptr->palette to its
 1052|       |    * own copy of the palette.  This has the side effect that when png_start_row
 1053|       |    * is called (this happens after any call to png_read_update_info) the
 1054|       |    * info_ptr palette gets changed.  This is extremely unexpected and
 1055|       |    * confusing.
 1056|       |    *
 1057|       |    * Fix this by not sharing the palette in this way.
 1058|       |    */
 1059|    394|   png_set_PLTE(png_ptr, info_ptr, palette, num);
  ------------------
  |  |  345|    394|#define png_set_PLTE OSS_FUZZ_png_set_PLTE
  ------------------
 1060|       |
 1061|       |   /* The three chunks, bKGD, hIST and tRNS *must* appear after PLTE and before
 1062|       |    * IDAT.  Prior to 1.6.0 this was not checked; instead the code merely
 1063|       |    * checked the apparent validity of a tRNS chunk inserted before PLTE on a
 1064|       |    * palette PNG.  1.6.0 attempts to rigorously follow the standard and
 1065|       |    * therefore does a benign error if the erroneous condition is detected *and*
 1066|       |    * cancels the tRNS if the benign error returns.  The alternative is to
 1067|       |    * amend the standard since it would be rather hypocritical of the standards
 1068|       |    * maintainers to ignore it.
 1069|       |    */
 1070|    394|#ifdef PNG_READ_tRNS_SUPPORTED
 1071|    394|   if (png_ptr->num_trans > 0 ||
  ------------------
  |  Branch (1071:8): [True: 40, False: 354]
  ------------------
 1072|    394|       (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != 0))
  ------------------
  |  |  736|    354|#define PNG_INFO_tRNS 0x0010U
  ------------------
  |  Branch (1072:9): [True: 354, False: 0]
  |  Branch (1072:29): [True: 0, False: 354]
  ------------------
 1073|      1|   {
 1074|       |      /* Cancel this because otherwise it would be used if the transforms
 1075|       |       * require it.  Don't cancel the 'valid' flag because this would prevent
 1076|       |       * detection of duplicate chunks.
 1077|       |       */
 1078|      1|      png_ptr->num_trans = 0;
 1079|       |
 1080|      1|      if (info_ptr != NULL)
  ------------------
  |  Branch (1080:11): [True: 1, False: 0]
  ------------------
 1081|      1|         info_ptr->num_trans = 0;
 1082|       |
 1083|      1|      png_chunk_benign_error(png_ptr, "tRNS must be after");
  ------------------
  |  |  224|      1|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1084|      1|   }
 1085|    394|#endif
 1086|       |
 1087|    394|#ifdef PNG_READ_hIST_SUPPORTED
 1088|    394|   if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != 0)
  ------------------
  |  |  738|    355|#define PNG_INFO_hIST 0x0040U
  ------------------
  |  Branch (1088:8): [True: 355, False: 39]
  |  Branch (1088:28): [True: 0, False: 355]
  ------------------
 1089|      0|      png_chunk_benign_error(png_ptr, "hIST must be after");
  ------------------
  |  |  224|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1090|    394|#endif
 1091|       |
 1092|    394|#ifdef PNG_READ_bKGD_SUPPORTED
 1093|    394|   if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != 0)
  ------------------
  |  |  737|    355|#define PNG_INFO_bKGD 0x0020U
  ------------------
  |  Branch (1093:8): [True: 355, False: 39]
  |  Branch (1093:28): [True: 1, False: 354]
  ------------------
 1094|      1|      png_chunk_benign_error(png_ptr, "bKGD must be after");
  ------------------
  |  |  224|      1|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1095|    394|#endif
 1096|    394|}
OSS_FUZZ_png_handle_IEND:
 1100|     16|{
 1101|     16|   png_debug(1, "in png_handle_IEND");
  ------------------
  |  |  145|     16|#  define png_debug(l, m) ((void)0)
  ------------------
 1102|       |
 1103|     16|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0 ||
  ------------------
  |  |  644|     16|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (1103:8): [True: 1, False: 15]
  ------------------
 1104|     16|       (png_ptr->mode & PNG_HAVE_IDAT) == 0)
  ------------------
  |  |  617|     15|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (1104:8): [True: 1, False: 14]
  ------------------
 1105|      2|      png_chunk_error(png_ptr, "out of place");
  ------------------
  |  |  225|      2|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 1106|       |
 1107|     14|   png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);
  ------------------
  |  |  646|     14|#define PNG_AFTER_IDAT 0x08
  ------------------
                 png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);
  ------------------
  |  |  619|     14|#define PNG_HAVE_IEND               0x10U
  ------------------
 1108|       |
 1109|     14|   png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|     14|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1110|       |
 1111|     14|   if (length != 0)
  ------------------
  |  Branch (1111:8): [True: 12, False: 2]
  ------------------
 1112|     12|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|     12|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1113|       |
 1114|     14|   PNG_UNUSED(info_ptr)
  ------------------
  |  |  444|     14|#  define PNG_UNUSED(param) (void)param;
  ------------------
 1115|     14|}
OSS_FUZZ_png_handle_gAMA:
 1120|  2.74k|{
 1121|  2.74k|   png_fixed_point igamma;
 1122|  2.74k|   png_byte buf[4];
 1123|       |
 1124|  2.74k|   png_debug(1, "in png_handle_gAMA");
  ------------------
  |  |  145|  2.74k|#  define png_debug(l, m) ((void)0)
  ------------------
 1125|       |
 1126|  2.74k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  2.74k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (1126:8): [True: 1, False: 2.74k]
  ------------------
 1127|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 1128|       |
 1129|  2.74k|   else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  617|  2.74k|#define PNG_HAVE_IDAT               0x04U
  ------------------
                 else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  645|  2.74k|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (1129:13): [True: 364, False: 2.38k]
  ------------------
 1130|    364|   {
 1131|    364|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    364|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1132|    364|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    364|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1133|    364|      return;
 1134|    364|   }
 1135|       |
 1136|  2.38k|   if (length != 4)
  ------------------
  |  Branch (1136:8): [True: 226, False: 2.15k]
  ------------------
 1137|    226|   {
 1138|    226|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    226|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1139|    226|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    226|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1140|    226|      return;
 1141|    226|   }
 1142|       |
 1143|  2.15k|   png_crc_read(png_ptr, buf, 4);
  ------------------
  |  |   23|  2.15k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1144|       |
 1145|  2.15k|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|  2.15k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (1145:8): [True: 0, False: 2.15k]
  ------------------
 1146|      0|      return;
 1147|       |
 1148|  2.15k|   igamma = png_get_fixed_point(NULL, buf);
 1149|       |
 1150|  2.15k|   png_colorspace_set_gamma(png_ptr, &png_ptr->colorspace, igamma);
  ------------------
  |  |   97|  2.15k|#define png_colorspace_set_gamma OSS_FUZZ_png_colorspace_set_gamma
  ------------------
 1151|  2.15k|   png_colorspace_sync(png_ptr, info_ptr);
  ------------------
  |  |   99|  2.15k|#define png_colorspace_sync OSS_FUZZ_png_colorspace_sync
  ------------------
 1152|  2.15k|}
OSS_FUZZ_png_handle_sBIT:
 1158|  1.67k|{
 1159|  1.67k|   unsigned int truelen, i;
 1160|  1.67k|   png_byte sample_depth;
 1161|  1.67k|   png_byte buf[4];
 1162|       |
 1163|  1.67k|   png_debug(1, "in png_handle_sBIT");
  ------------------
  |  |  145|  1.67k|#  define png_debug(l, m) ((void)0)
  ------------------
 1164|       |
 1165|  1.67k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  1.67k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (1165:8): [True: 1, False: 1.67k]
  ------------------
 1166|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 1167|       |
 1168|  1.67k|   else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  617|  1.67k|#define PNG_HAVE_IDAT               0x04U
  ------------------
                 else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  645|  1.67k|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (1168:13): [True: 262, False: 1.40k]
  ------------------
 1169|    262|   {
 1170|    262|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    262|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1171|    262|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    262|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1172|    262|      return;
 1173|    262|   }
 1174|       |
 1175|  1.40k|   if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT) != 0)
  ------------------
  |  |  733|  1.40k|#define PNG_INFO_sBIT 0x0002U
  ------------------
  |  Branch (1175:8): [True: 1.40k, False: 0]
  |  Branch (1175:28): [True: 194, False: 1.21k]
  ------------------
 1176|    194|   {
 1177|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1178|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1179|    194|      return;
 1180|    194|   }
 1181|       |
 1182|  1.21k|   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  1.21k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  1.21k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  1.21k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1182:8): [True: 459, False: 755]
  ------------------
 1183|    459|   {
 1184|    459|      truelen = 3;
 1185|    459|      sample_depth = 8;
 1186|    459|   }
 1187|       |
 1188|    755|   else
 1189|    755|   {
 1190|    755|      truelen = png_ptr->channels;
 1191|    755|      sample_depth = png_ptr->bit_depth;
 1192|    755|   }
 1193|       |
 1194|  1.21k|   if (length != truelen || length > 4)
  ------------------
  |  Branch (1194:8): [True: 539, False: 675]
  |  Branch (1194:29): [True: 0, False: 675]
  ------------------
 1195|    539|   {
 1196|    539|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    539|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1197|    539|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    539|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1198|    539|      return;
 1199|    539|   }
 1200|       |
 1201|    675|   buf[0] = buf[1] = buf[2] = buf[3] = sample_depth;
 1202|    675|   png_crc_read(png_ptr, buf, truelen);
  ------------------
  |  |   23|    675|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1203|       |
 1204|    675|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|    675|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (1204:8): [True: 0, False: 675]
  ------------------
 1205|      0|      return;
 1206|       |
 1207|  1.08k|   for (i=0; i<truelen; ++i)
  ------------------
  |  Branch (1207:14): [True: 1.06k, False: 22]
  ------------------
 1208|  1.06k|   {
 1209|  1.06k|      if (buf[i] == 0 || buf[i] > sample_depth)
  ------------------
  |  Branch (1209:11): [True: 359, False: 705]
  |  Branch (1209:26): [True: 294, False: 411]
  ------------------
 1210|    653|      {
 1211|    653|         png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    653|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1212|    653|         return;
 1213|    653|      }
 1214|  1.06k|   }
 1215|       |
 1216|     22|   if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
  ------------------
  |  |  664|     22|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (1216:8): [True: 2, False: 20]
  ------------------
 1217|      2|   {
 1218|      2|      png_ptr->sig_bit.red = buf[0];
 1219|      2|      png_ptr->sig_bit.green = buf[1];
 1220|      2|      png_ptr->sig_bit.blue = buf[2];
 1221|      2|      png_ptr->sig_bit.alpha = buf[3];
 1222|      2|   }
 1223|       |
 1224|     20|   else
 1225|     20|   {
 1226|     20|      png_ptr->sig_bit.gray = buf[0];
 1227|     20|      png_ptr->sig_bit.red = buf[0];
 1228|     20|      png_ptr->sig_bit.green = buf[0];
 1229|     20|      png_ptr->sig_bit.blue = buf[0];
 1230|     20|      png_ptr->sig_bit.alpha = buf[1];
 1231|     20|   }
 1232|       |
 1233|     22|   png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));
  ------------------
  |  |  400|     22|#define png_set_sBIT OSS_FUZZ_png_set_sBIT
  ------------------
 1234|     22|}
OSS_FUZZ_png_handle_cHRM:
 1240|  3.71k|{
 1241|  3.71k|   png_byte buf[32];
 1242|  3.71k|   png_xy xy;
 1243|       |
 1244|  3.71k|   png_debug(1, "in png_handle_cHRM");
  ------------------
  |  |  145|  3.71k|#  define png_debug(l, m) ((void)0)
  ------------------
 1245|       |
 1246|  3.71k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  3.71k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (1246:8): [True: 1, False: 3.71k]
  ------------------
 1247|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 1248|       |
 1249|  3.71k|   else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  617|  3.71k|#define PNG_HAVE_IDAT               0x04U
  ------------------
                 else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  645|  3.71k|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (1249:13): [True: 212, False: 3.50k]
  ------------------
 1250|    212|   {
 1251|    212|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    212|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1252|    212|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    212|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1253|    212|      return;
 1254|    212|   }
 1255|       |
 1256|  3.50k|   if (length != 32)
  ------------------
  |  Branch (1256:8): [True: 200, False: 3.30k]
  ------------------
 1257|    200|   {
 1258|    200|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    200|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1259|    200|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    200|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1260|    200|      return;
 1261|    200|   }
 1262|       |
 1263|  3.30k|   png_crc_read(png_ptr, buf, 32);
  ------------------
  |  |   23|  3.30k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1264|       |
 1265|  3.30k|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|  3.30k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (1265:8): [True: 0, False: 3.30k]
  ------------------
 1266|      0|      return;
 1267|       |
 1268|  3.30k|   xy.whitex = png_get_fixed_point(NULL, buf);
 1269|  3.30k|   xy.whitey = png_get_fixed_point(NULL, buf + 4);
 1270|  3.30k|   xy.redx   = png_get_fixed_point(NULL, buf + 8);
 1271|  3.30k|   xy.redy   = png_get_fixed_point(NULL, buf + 12);
 1272|  3.30k|   xy.greenx = png_get_fixed_point(NULL, buf + 16);
 1273|  3.30k|   xy.greeny = png_get_fixed_point(NULL, buf + 20);
 1274|  3.30k|   xy.bluex  = png_get_fixed_point(NULL, buf + 24);
 1275|  3.30k|   xy.bluey  = png_get_fixed_point(NULL, buf + 28);
 1276|       |
 1277|  3.30k|   if (xy.whitex == PNG_FIXED_ERROR ||
  ------------------
  |  |   38|  6.60k|#define PNG_FIXED_ERROR (-1)
  ------------------
  |  Branch (1277:8): [True: 381, False: 2.92k]
  ------------------
 1278|  3.30k|       xy.whitey == PNG_FIXED_ERROR ||
  ------------------
  |  |   38|  6.22k|#define PNG_FIXED_ERROR (-1)
  ------------------
  |  Branch (1278:8): [True: 439, False: 2.48k]
  ------------------
 1279|  3.30k|       xy.redx   == PNG_FIXED_ERROR ||
  ------------------
  |  |   38|  5.78k|#define PNG_FIXED_ERROR (-1)
  ------------------
  |  Branch (1279:8): [True: 244, False: 2.24k]
  ------------------
 1280|  3.30k|       xy.redy   == PNG_FIXED_ERROR ||
  ------------------
  |  |   38|  5.54k|#define PNG_FIXED_ERROR (-1)
  ------------------
  |  Branch (1280:8): [True: 216, False: 2.02k]
  ------------------
 1281|  3.30k|       xy.greenx == PNG_FIXED_ERROR ||
  ------------------
  |  |   38|  5.32k|#define PNG_FIXED_ERROR (-1)
  ------------------
  |  Branch (1281:8): [True: 347, False: 1.67k]
  ------------------
 1282|  3.30k|       xy.greeny == PNG_FIXED_ERROR ||
  ------------------
  |  |   38|  4.98k|#define PNG_FIXED_ERROR (-1)
  ------------------
  |  Branch (1282:8): [True: 206, False: 1.47k]
  ------------------
 1283|  3.30k|       xy.bluex  == PNG_FIXED_ERROR ||
  ------------------
  |  |   38|  4.77k|#define PNG_FIXED_ERROR (-1)
  ------------------
  |  Branch (1283:8): [True: 214, False: 1.25k]
  ------------------
 1284|  3.30k|       xy.bluey  == PNG_FIXED_ERROR)
  ------------------
  |  |   38|  1.25k|#define PNG_FIXED_ERROR (-1)
  ------------------
  |  Branch (1284:8): [True: 207, False: 1.05k]
  ------------------
 1285|  2.24k|   {
 1286|  2.24k|      png_chunk_benign_error(png_ptr, "invalid values");
  ------------------
  |  |  224|  2.24k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1287|  2.24k|      return;
 1288|  2.24k|   }
 1289|       |
 1290|       |   /* If a colorspace error has already been output skip this chunk */
 1291|  1.05k|   if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0)
  ------------------
  |  |  139|  1.05k|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
  |  Branch (1291:8): [True: 276, False: 783]
  ------------------
 1292|    276|      return;
 1293|       |
 1294|    783|   if ((png_ptr->colorspace.flags & PNG_COLORSPACE_FROM_cHRM) != 0)
  ------------------
  |  |  135|    783|#define PNG_COLORSPACE_FROM_cHRM            0x0010
  ------------------
  |  Branch (1294:8): [True: 2, False: 781]
  ------------------
 1295|      2|   {
 1296|      2|      png_ptr->colorspace.flags |= PNG_COLORSPACE_INVALID;
  ------------------
  |  |  139|      2|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
 1297|      2|      png_colorspace_sync(png_ptr, info_ptr);
  ------------------
  |  |   99|      2|#define png_colorspace_sync OSS_FUZZ_png_colorspace_sync
  ------------------
 1298|      2|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|      2|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1299|      2|      return;
 1300|      2|   }
 1301|       |
 1302|    781|   png_ptr->colorspace.flags |= PNG_COLORSPACE_FROM_cHRM;
  ------------------
  |  |  135|    781|#define PNG_COLORSPACE_FROM_cHRM            0x0010
  ------------------
 1303|    781|   (void)png_colorspace_set_chromaticities(png_ptr, &png_ptr->colorspace, &xy,
  ------------------
  |  |  100|    781|#define png_colorspace_set_chromaticities OSS_FUZZ_png_colorspace_set_chromaticities
  ------------------
 1304|    781|       1/*prefer cHRM values*/);
 1305|    781|   png_colorspace_sync(png_ptr, info_ptr);
  ------------------
  |  |   99|    781|#define png_colorspace_sync OSS_FUZZ_png_colorspace_sync
  ------------------
 1306|    781|}
OSS_FUZZ_png_handle_sRGB:
 1312|  1.07k|{
 1313|  1.07k|   png_byte intent;
 1314|       |
 1315|  1.07k|   png_debug(1, "in png_handle_sRGB");
  ------------------
  |  |  145|  1.07k|#  define png_debug(l, m) ((void)0)
  ------------------
 1316|       |
 1317|  1.07k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  1.07k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (1317:8): [True: 1, False: 1.06k]
  ------------------
 1318|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 1319|       |
 1320|  1.06k|   else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  617|  1.06k|#define PNG_HAVE_IDAT               0x04U
  ------------------
                 else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  645|  1.06k|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (1320:13): [True: 212, False: 857]
  ------------------
 1321|    212|   {
 1322|    212|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    212|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1323|    212|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    212|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1324|    212|      return;
 1325|    212|   }
 1326|       |
 1327|    857|   if (length != 1)
  ------------------
  |  Branch (1327:8): [True: 225, False: 632]
  ------------------
 1328|    225|   {
 1329|    225|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    225|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1330|    225|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    225|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1331|    225|      return;
 1332|    225|   }
 1333|       |
 1334|    632|   png_crc_read(png_ptr, &intent, 1);
  ------------------
  |  |   23|    632|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1335|       |
 1336|    632|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|    632|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (1336:8): [True: 0, False: 632]
  ------------------
 1337|      0|      return;
 1338|       |
 1339|       |   /* If a colorspace error has already been output skip this chunk */
 1340|    632|   if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0)
  ------------------
  |  |  139|    632|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
  |  Branch (1340:8): [True: 438, False: 194]
  ------------------
 1341|    438|      return;
 1342|       |
 1343|       |   /* Only one sRGB or iCCP chunk is allowed, use the HAVE_INTENT flag to detect
 1344|       |    * this.
 1345|       |    */
 1346|    194|   if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) != 0)
  ------------------
  |  |  133|    194|#define PNG_COLORSPACE_HAVE_INTENT          0x0004
  ------------------
  |  Branch (1346:8): [True: 9, False: 185]
  ------------------
 1347|      9|   {
 1348|      9|      png_ptr->colorspace.flags |= PNG_COLORSPACE_INVALID;
  ------------------
  |  |  139|      9|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
 1349|      9|      png_colorspace_sync(png_ptr, info_ptr);
  ------------------
  |  |   99|      9|#define png_colorspace_sync OSS_FUZZ_png_colorspace_sync
  ------------------
 1350|      9|      png_chunk_benign_error(png_ptr, "too many profiles");
  ------------------
  |  |  224|      9|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1351|      9|      return;
 1352|      9|   }
 1353|       |
 1354|    185|   (void)png_colorspace_set_sRGB(png_ptr, &png_ptr->colorspace, intent);
  ------------------
  |  |  102|    185|#define png_colorspace_set_sRGB OSS_FUZZ_png_colorspace_set_sRGB
  ------------------
 1355|    185|   png_colorspace_sync(png_ptr, info_ptr);
  ------------------
  |  |   99|    185|#define png_colorspace_sync OSS_FUZZ_png_colorspace_sync
  ------------------
 1356|    185|}
OSS_FUZZ_png_handle_iCCP:
 1363|  7.64k|{
 1364|  7.64k|   png_const_charp errmsg = NULL; /* error message output, or no error */
 1365|  7.64k|   int finished = 0; /* crc checked */
 1366|       |
 1367|  7.64k|   png_debug(1, "in png_handle_iCCP");
  ------------------
  |  |  145|  7.64k|#  define png_debug(l, m) ((void)0)
  ------------------
 1368|       |
 1369|  7.64k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  7.64k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (1369:8): [True: 1, False: 7.64k]
  ------------------
 1370|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 1371|       |
 1372|  7.64k|   else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  617|  7.64k|#define PNG_HAVE_IDAT               0x04U
  ------------------
                 else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
  ------------------
  |  |  645|  7.64k|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (1372:13): [True: 215, False: 7.43k]
  ------------------
 1373|    215|   {
 1374|    215|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    215|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1375|    215|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    215|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1376|    215|      return;
 1377|    215|   }
 1378|       |
 1379|       |   /* Consistent with all the above colorspace handling an obviously *invalid*
 1380|       |    * chunk is just ignored, so does not invalidate the color space.  An
 1381|       |    * alternative is to set the 'invalid' flags at the start of this routine
 1382|       |    * and only clear them in they were not set before and all the tests pass.
 1383|       |    */
 1384|       |
 1385|       |   /* The keyword must be at least one character and there is a
 1386|       |    * terminator (0) byte and the compression method byte, and the
 1387|       |    * 'zlib' datastream is at least 11 bytes.
 1388|       |    */
 1389|  7.43k|   if (length < 14)
  ------------------
  |  Branch (1389:8): [True: 213, False: 7.21k]
  ------------------
 1390|    213|   {
 1391|    213|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    213|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1392|    213|      png_chunk_benign_error(png_ptr, "too short");
  ------------------
  |  |  224|    213|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1393|    213|      return;
 1394|    213|   }
 1395|       |
 1396|       |   /* If a colorspace error has already been output skip this chunk */
 1397|  7.21k|   if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0)
  ------------------
  |  |  139|  7.21k|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
  |  Branch (1397:8): [True: 194, False: 7.02k]
  ------------------
 1398|    194|   {
 1399|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1400|    194|      return;
 1401|    194|   }
 1402|       |
 1403|       |   /* Only one sRGB or iCCP chunk is allowed, use the HAVE_INTENT flag to detect
 1404|       |    * this.
 1405|       |    */
 1406|  7.02k|   if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) == 0)
  ------------------
  |  |  133|  7.02k|#define PNG_COLORSPACE_HAVE_INTENT          0x0004
  ------------------
  |  Branch (1406:8): [True: 7.02k, False: 2]
  ------------------
 1407|  7.02k|   {
 1408|  7.02k|      uInt read_length, keyword_length;
 1409|  7.02k|      char keyword[81];
 1410|       |
 1411|       |      /* Find the keyword; the keyword plus separator and compression method
 1412|       |       * bytes can be at most 81 characters long.
 1413|       |       */
 1414|  7.02k|      read_length = 81; /* maximum */
 1415|  7.02k|      if (read_length > length)
  ------------------
  |  Branch (1415:11): [True: 332, False: 6.68k]
  ------------------
 1416|    332|         read_length = (uInt)length;
 1417|       |
 1418|  7.02k|      png_crc_read(png_ptr, (png_bytep)keyword, read_length);
  ------------------
  |  |   23|  7.02k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1419|  7.02k|      length -= read_length;
 1420|       |
 1421|       |      /* The minimum 'zlib' stream is assumed to be just the 2 byte header,
 1422|       |       * 5 bytes minimum 'deflate' stream, and the 4 byte checksum.
 1423|       |       */
 1424|  7.02k|      if (length < 11)
  ------------------
  |  Branch (1424:11): [True: 347, False: 6.67k]
  ------------------
 1425|    347|      {
 1426|    347|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    347|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1427|    347|         png_chunk_benign_error(png_ptr, "too short");
  ------------------
  |  |  224|    347|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1428|    347|         return;
 1429|    347|      }
 1430|       |
 1431|  6.67k|      keyword_length = 0;
 1432|  20.3k|      while (keyword_length < 80 && keyword_length < read_length &&
  ------------------
  |  Branch (1432:14): [True: 20.3k, False: 59]
  |  Branch (1432:37): [True: 20.3k, False: 0]
  ------------------
 1433|  20.3k|         keyword[keyword_length] != 0)
  ------------------
  |  Branch (1433:10): [True: 13.7k, False: 6.61k]
  ------------------
 1434|  13.7k|         ++keyword_length;
 1435|       |
 1436|       |      /* TODO: make the keyword checking common */
 1437|  6.67k|      if (keyword_length >= 1 && keyword_length <= 79)
  ------------------
  |  Branch (1437:11): [True: 6.61k, False: 59]
  |  Branch (1437:34): [True: 6.61k, False: 1]
  ------------------
 1438|  6.61k|      {
 1439|       |         /* We only understand '0' compression - deflate - so if we get a
 1440|       |          * different value we can't safely decode the chunk.
 1441|       |          */
 1442|  6.61k|         if (keyword_length+1 < read_length &&
  ------------------
  |  Branch (1442:14): [True: 6.61k, False: 0]
  ------------------
 1443|  6.61k|            keyword[keyword_length+1] == PNG_COMPRESSION_TYPE_BASE)
  ------------------
  |  |  678|  6.61k|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */
  ------------------
  |  Branch (1443:13): [True: 6.61k, False: 2]
  ------------------
 1444|  6.61k|         {
 1445|  6.61k|            read_length -= keyword_length+2;
 1446|       |
 1447|  6.61k|            if (png_inflate_claim(png_ptr, png_iCCP) == Z_OK)
  ------------------
  |  |  852|  6.61k|#define png_iCCP PNG_U32(105,  67,  67,  80)
  |  |  ------------------
  |  |  |  |  814|  6.61k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.61k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.61k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.61k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  6.61k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (1447:17): [True: 6.61k, False: 0]
  ------------------
 1448|  6.61k|            {
 1449|  6.61k|               Byte profile_header[132]={0};
 1450|  6.61k|               Byte local_buffer[PNG_INFLATE_BUF_SIZE];
 1451|  6.61k|               png_alloc_size_t size = (sizeof profile_header);
 1452|       |
 1453|  6.61k|               png_ptr->zstream.next_in = (Bytef*)keyword + (keyword_length+2);
 1454|  6.61k|               png_ptr->zstream.avail_in = read_length;
 1455|  6.61k|               (void)png_inflate_read(png_ptr, local_buffer,
 1456|  6.61k|                   (sizeof local_buffer), &length, profile_header, &size,
 1457|  6.61k|                   0/*finish: don't, because the output is too small*/);
 1458|       |
 1459|  6.61k|               if (size == 0)
  ------------------
  |  Branch (1459:20): [True: 6.56k, False: 46]
  ------------------
 1460|  6.56k|               {
 1461|       |                  /* We have the ICC profile header; do the basic header checks.
 1462|       |                   */
 1463|  6.56k|                  png_uint_32 profile_length = png_get_uint_32(profile_header);
  ------------------
  |  |  303|  6.56k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  6.56k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  6.56k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  6.56k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  6.56k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  6.56k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1464|       |
 1465|  6.56k|                  if (png_icc_check_length(png_ptr, &png_ptr->colorspace,
  ------------------
  |  |  104|  6.56k|#define png_icc_check_length OSS_FUZZ_png_icc_check_length
  ------------------
  |  Branch (1465:23): [True: 6.52k, False: 46]
  ------------------
 1466|  6.56k|                      keyword, profile_length) != 0)
 1467|  6.52k|                  {
 1468|       |                     /* The length is apparently ok, so we can check the 132
 1469|       |                      * byte header.
 1470|       |                      */
 1471|  6.52k|                     if (png_icc_check_header(png_ptr, &png_ptr->colorspace,
  ------------------
  |  |  105|  6.52k|#define png_icc_check_header OSS_FUZZ_png_icc_check_header
  ------------------
  |  Branch (1471:26): [True: 5.85k, False: 665]
  ------------------
 1472|  6.52k|                         keyword, profile_length, profile_header,
 1473|  6.52k|                         png_ptr->color_type) != 0)
 1474|  5.85k|                     {
 1475|       |                        /* Now read the tag table; a variable size buffer is
 1476|       |                         * needed at this point, allocate one for the whole
 1477|       |                         * profile.  The header check has already validated
 1478|       |                         * that none of this stuff will overflow.
 1479|       |                         */
 1480|  5.85k|                        png_uint_32 tag_count =
 1481|  5.85k|                           png_get_uint_32(profile_header + 128);
  ------------------
  |  |  303|  5.85k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  5.85k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  5.85k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  5.85k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  5.85k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  5.85k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1482|  5.85k|                        png_bytep profile = png_read_buffer(png_ptr,
 1483|  5.85k|                            profile_length, 2/*silent*/);
 1484|       |
 1485|  5.85k|                        if (profile != NULL)
  ------------------
  |  Branch (1485:29): [True: 5.85k, False: 0]
  ------------------
 1486|  5.85k|                        {
 1487|  5.85k|                           memcpy(profile, profile_header,
 1488|  5.85k|                               (sizeof profile_header));
 1489|       |
 1490|  5.85k|                           size = 12 * tag_count;
 1491|       |
 1492|  5.85k|                           (void)png_inflate_read(png_ptr, local_buffer,
 1493|  5.85k|                               (sizeof local_buffer), &length,
 1494|  5.85k|                               profile + (sizeof profile_header), &size, 0);
 1495|       |
 1496|       |                           /* Still expect a buffer error because we expect
 1497|       |                            * there to be some tag data!
 1498|       |                            */
 1499|  5.85k|                           if (size == 0)
  ------------------
  |  Branch (1499:32): [True: 5.80k, False: 50]
  ------------------
 1500|  5.80k|                           {
 1501|  5.80k|                              if (png_icc_check_tag_table(png_ptr,
  ------------------
  |  |  106|  5.80k|#define png_icc_check_tag_table OSS_FUZZ_png_icc_check_tag_table
  ------------------
  |  Branch (1501:35): [True: 5.63k, False: 173]
  ------------------
 1502|  5.80k|                                  &png_ptr->colorspace, keyword, profile_length,
 1503|  5.80k|                                  profile) != 0)
 1504|  5.63k|                              {
 1505|       |                                 /* The profile has been validated for basic
 1506|       |                                  * security issues, so read the whole thing in.
 1507|       |                                  */
 1508|  5.63k|                                 size = profile_length - (sizeof profile_header)
 1509|  5.63k|                                     - 12 * tag_count;
 1510|       |
 1511|  5.63k|                                 (void)png_inflate_read(png_ptr, local_buffer,
 1512|  5.63k|                                     (sizeof local_buffer), &length,
 1513|  5.63k|                                     profile + (sizeof profile_header) +
 1514|  5.63k|                                     12 * tag_count, &size, 1/*finish*/);
 1515|       |
 1516|  5.63k|                                 if (length > 0 && !(png_ptr->flags &
  ------------------
  |  Branch (1516:38): [True: 2.43k, False: 3.19k]
  |  Branch (1516:52): [True: 0, False: 2.43k]
  ------------------
 1517|  2.43k|                                     PNG_FLAG_BENIGN_ERRORS_WARN))
  ------------------
  |  |  690|  2.43k|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
 1518|      0|                                    errmsg = "extra compressed data";
 1519|       |
 1520|       |                                 /* But otherwise allow extra data: */
 1521|  5.63k|                                 else if (size == 0)
  ------------------
  |  Branch (1521:43): [True: 5.45k, False: 179]
  ------------------
 1522|  5.45k|                                 {
 1523|  5.45k|                                    if (length > 0)
  ------------------
  |  Branch (1523:41): [True: 2.35k, False: 3.09k]
  ------------------
 1524|  2.35k|                                    {
 1525|       |                                       /* This can be handled completely, so
 1526|       |                                        * keep going.
 1527|       |                                        */
 1528|  2.35k|                                       png_chunk_warning(png_ptr,
  ------------------
  |  |  226|  2.35k|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
 1529|  2.35k|                                           "extra compressed data");
 1530|  2.35k|                                    }
 1531|       |
 1532|  5.45k|                                    png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|  5.45k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1533|  5.45k|                                    finished = 1;
 1534|       |
 1535|  5.45k|# if defined(PNG_sRGB_SUPPORTED) && PNG_sRGB_PROFILE_CHECKS >= 0
 1536|       |                                    /* Check for a match against sRGB */
 1537|  5.45k|                                    png_icc_set_sRGB(png_ptr,
  ------------------
  |  |  107|  5.45k|#define png_icc_set_sRGB OSS_FUZZ_png_icc_set_sRGB
  ------------------
 1538|  5.45k|                                        &png_ptr->colorspace, profile,
 1539|  5.45k|                                        png_ptr->zstream.adler);
 1540|  5.45k|# endif
 1541|       |
 1542|       |                                    /* Steal the profile for info_ptr. */
 1543|  5.45k|                                    if (info_ptr != NULL)
  ------------------
  |  Branch (1543:41): [True: 5.37k, False: 74]
  ------------------
 1544|  5.37k|                                    {
 1545|  5.37k|                                       png_free_data(png_ptr, info_ptr,
  ------------------
  |  |  240|  5.37k|#define png_free_data OSS_FUZZ_png_free_data
  ------------------
 1546|  5.37k|                                           PNG_FREE_ICCP, 0);
  ------------------
  |  | 1749|  5.37k|#define PNG_FREE_ICCP 0x0010U
  ------------------
 1547|       |
 1548|  5.37k|                                       info_ptr->iccp_name = png_voidcast(char*,
  ------------------
  |  |  500|  5.37k|#  define png_voidcast(type, value) (value)
  ------------------
 1549|  5.37k|                                           png_malloc_base(png_ptr,
 1550|  5.37k|                                           keyword_length+1));
 1551|  5.37k|                                       if (info_ptr->iccp_name != NULL)
  ------------------
  |  Branch (1551:44): [True: 5.37k, False: 0]
  ------------------
 1552|  5.37k|                                       {
 1553|  5.37k|                                          memcpy(info_ptr->iccp_name, keyword,
 1554|  5.37k|                                              keyword_length+1);
 1555|  5.37k|                                          info_ptr->iccp_proflen =
 1556|  5.37k|                                              profile_length;
 1557|  5.37k|                                          info_ptr->iccp_profile = profile;
 1558|  5.37k|                                          png_ptr->read_buffer = NULL; /*steal*/
 1559|  5.37k|                                          info_ptr->free_me |= PNG_FREE_ICCP;
  ------------------
  |  | 1749|  5.37k|#define PNG_FREE_ICCP 0x0010U
  ------------------
 1560|  5.37k|                                          info_ptr->valid |= PNG_INFO_iCCP;
  ------------------
  |  |  744|  5.37k|#define PNG_INFO_iCCP 0x1000U  /* ESR, 1.0.6 */
  ------------------
 1561|  5.37k|                                       }
 1562|       |
 1563|      0|                                       else
 1564|      0|                                       {
 1565|      0|                                          png_ptr->colorspace.flags |=
 1566|      0|                                             PNG_COLORSPACE_INVALID;
  ------------------
  |  |  139|      0|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
 1567|      0|                                          errmsg = "out of memory";
 1568|      0|                                       }
 1569|  5.37k|                                    }
 1570|       |
 1571|       |                                    /* else the profile remains in the read
 1572|       |                                     * buffer which gets reused for subsequent
 1573|       |                                     * chunks.
 1574|       |                                     */
 1575|       |
 1576|  5.45k|                                    if (info_ptr != NULL)
  ------------------
  |  Branch (1576:41): [True: 5.37k, False: 74]
  ------------------
 1577|  5.37k|                                       png_colorspace_sync(png_ptr, info_ptr);
  ------------------
  |  |   99|  5.37k|#define png_colorspace_sync OSS_FUZZ_png_colorspace_sync
  ------------------
 1578|       |
 1579|  5.45k|                                    if (errmsg == NULL)
  ------------------
  |  Branch (1579:41): [True: 5.37k, False: 74]
  ------------------
 1580|  5.37k|                                    {
 1581|  5.37k|                                       png_ptr->zowner = 0;
 1582|  5.37k|                                       return;
 1583|  5.37k|                                    }
 1584|  5.45k|                                 }
 1585|    253|                                 if (errmsg == NULL)
  ------------------
  |  Branch (1585:38): [True: 118, False: 135]
  ------------------
 1586|    118|                                    errmsg = png_ptr->zstream.msg;
 1587|    253|                              }
 1588|       |                              /* else png_icc_check_tag_table output an error */
 1589|  5.80k|                           }
 1590|     50|                           else /* profile truncated */
 1591|     50|                              errmsg = png_ptr->zstream.msg;
 1592|  5.85k|                        }
 1593|       |
 1594|      0|                        else
 1595|      0|                           errmsg = "out of memory";
 1596|  5.85k|                     }
 1597|       |
 1598|       |                     /* else png_icc_check_header output an error */
 1599|  6.52k|                  }
 1600|       |
 1601|       |                  /* else png_icc_check_length output an error */
 1602|  6.56k|               }
 1603|       |
 1604|     46|               else /* profile truncated */
 1605|     46|                  errmsg = png_ptr->zstream.msg;
 1606|       |
 1607|       |               /* Release the stream */
 1608|  1.23k|               png_ptr->zowner = 0;
 1609|  1.23k|            }
 1610|       |
 1611|      0|            else /* png_inflate_claim failed */
 1612|      0|               errmsg = png_ptr->zstream.msg;
 1613|  6.61k|         }
 1614|       |
 1615|      2|         else
 1616|      2|            errmsg = "bad compression method"; /* or missing */
 1617|  6.61k|      }
 1618|       |
 1619|     60|      else
 1620|     60|         errmsg = "bad keyword";
 1621|  6.67k|   }
 1622|       |
 1623|      2|   else
 1624|      2|      errmsg = "too many profiles";
 1625|       |
 1626|       |   /* Failure: the reason is in 'errmsg' */
 1627|  1.29k|   if (finished == 0)
  ------------------
  |  Branch (1627:8): [True: 1.05k, False: 246]
  ------------------
 1628|  1.05k|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|  1.05k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1629|       |
 1630|  1.29k|   png_ptr->colorspace.flags |= PNG_COLORSPACE_INVALID;
  ------------------
  |  |  139|  1.29k|#define PNG_COLORSPACE_INVALID              0x8000
  ------------------
 1631|  1.29k|   png_colorspace_sync(png_ptr, info_ptr);
  ------------------
  |  |   99|  1.29k|#define png_colorspace_sync OSS_FUZZ_png_colorspace_sync
  ------------------
 1632|  1.29k|   if (errmsg != NULL) /* else already output */
  ------------------
  |  Branch (1632:8): [True: 41, False: 1.25k]
  ------------------
 1633|     41|      png_chunk_benign_error(png_ptr, errmsg);
  ------------------
  |  |  224|     41|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1634|  1.29k|}
OSS_FUZZ_png_handle_sPLT:
 1641|  5.08k|{
 1642|  5.08k|   png_bytep entry_start, buffer;
 1643|  5.08k|   png_sPLT_t new_palette;
 1644|  5.08k|   png_sPLT_entryp pp;
 1645|  5.08k|   png_uint_32 data_length;
 1646|  5.08k|   int entry_size, i;
 1647|  5.08k|   png_uint_32 skip = 0;
 1648|  5.08k|   png_uint_32 dl;
 1649|  5.08k|   size_t max_dl;
 1650|       |
 1651|  5.08k|   png_debug(1, "in png_handle_sPLT");
  ------------------
  |  |  145|  5.08k|#  define png_debug(l, m) ((void)0)
  ------------------
 1652|       |
 1653|  5.08k|#ifdef PNG_USER_LIMITS_SUPPORTED
 1654|  5.08k|   if (png_ptr->user_chunk_cache_max != 0)
  ------------------
  |  Branch (1654:8): [True: 5.08k, False: 0]
  ------------------
 1655|  5.08k|   {
 1656|  5.08k|      if (png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (1656:11): [True: 195, False: 4.89k]
  ------------------
 1657|    195|      {
 1658|    195|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    195|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1659|    195|         return;
 1660|    195|      }
 1661|       |
 1662|  4.89k|      if (--png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (1662:11): [True: 8, False: 4.88k]
  ------------------
 1663|      8|      {
 1664|      8|         png_warning(png_ptr, "No space in chunk cache for sPLT");
  ------------------
  |  |  426|      8|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1665|      8|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|      8|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1666|      8|         return;
 1667|      8|      }
 1668|  4.89k|   }
 1669|  4.88k|#endif
 1670|       |
 1671|  4.88k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  4.88k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (1671:8): [True: 2, False: 4.88k]
  ------------------
 1672|      2|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      2|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 1673|       |
 1674|  4.88k|   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|  4.88k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (1674:13): [True: 316, False: 4.56k]
  ------------------
 1675|    316|   {
 1676|    316|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    316|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1677|    316|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    316|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1678|    316|      return;
 1679|    316|   }
 1680|       |
 1681|       |#ifdef PNG_MAX_MALLOC_64K
 1682|       |   if (length > 65535U)
 1683|       |   {
 1684|       |      png_crc_finish(png_ptr, length);
 1685|       |      png_chunk_benign_error(png_ptr, "too large to fit in memory");
 1686|       |      return;
 1687|       |   }
 1688|       |#endif
 1689|       |
 1690|  4.56k|   buffer = png_read_buffer(png_ptr, length+1, 2/*silent*/);
 1691|  4.56k|   if (buffer == NULL)
  ------------------
  |  Branch (1691:8): [True: 42, False: 4.52k]
  ------------------
 1692|     42|   {
 1693|     42|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|     42|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1694|     42|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  224|     42|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1695|     42|      return;
 1696|     42|   }
 1697|       |
 1698|       |
 1699|       |   /* WARNING: this may break if size_t is less than 32 bits; it is assumed
 1700|       |    * that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a
 1701|       |    * potential breakage point if the types in pngconf.h aren't exactly right.
 1702|       |    */
 1703|  4.52k|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   23|  4.52k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1704|       |
 1705|  4.52k|   if (png_crc_finish(png_ptr, skip) != 0)
  ------------------
  |  |   24|  4.52k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (1705:8): [True: 0, False: 4.52k]
  ------------------
 1706|      0|      return;
 1707|       |
 1708|  4.52k|   buffer[length] = 0;
 1709|       |
 1710|  5.60k|   for (entry_start = buffer; *entry_start; entry_start++)
  ------------------
  |  Branch (1710:31): [True: 1.08k, False: 4.52k]
  ------------------
 1711|  1.08k|      /* Empty loop to find end of name */ ;
 1712|       |
 1713|  4.52k|   ++entry_start;
 1714|       |
 1715|       |   /* A sample depth should follow the separator, and we should be on it  */
 1716|  4.52k|   if (length < 2U || entry_start > buffer + (length - 2U))
  ------------------
  |  Branch (1716:8): [True: 955, False: 3.56k]
  |  Branch (1716:23): [True: 216, False: 3.35k]
  ------------------
 1717|  1.11k|   {
 1718|  1.11k|      png_warning(png_ptr, "malformed sPLT chunk");
  ------------------
  |  |  426|  1.11k|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1719|  1.11k|      return;
 1720|  1.11k|   }
 1721|       |
 1722|  3.41k|   new_palette.depth = *entry_start++;
 1723|  3.41k|   entry_size = (new_palette.depth == 8 ? 6 : 10);
  ------------------
  |  Branch (1723:18): [True: 2.75k, False: 655]
  ------------------
 1724|       |   /* This must fit in a png_uint_32 because it is derived from the original
 1725|       |    * chunk data length.
 1726|       |    */
 1727|  3.41k|   data_length = length - (png_uint_32)(entry_start - buffer);
 1728|       |
 1729|       |   /* Integrity-check the data length */
 1730|  3.41k|   if ((data_length % (unsigned int)entry_size) != 0)
  ------------------
  |  Branch (1730:8): [True: 569, False: 2.84k]
  ------------------
 1731|    569|   {
 1732|    569|      png_warning(png_ptr, "sPLT chunk has bad length");
  ------------------
  |  |  426|    569|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1733|    569|      return;
 1734|    569|   }
 1735|       |
 1736|  2.84k|   dl = (png_uint_32)(data_length / (unsigned int)entry_size);
 1737|  2.84k|   max_dl = PNG_SIZE_MAX / (sizeof (png_sPLT_entry));
  ------------------
  |  |  651|  2.84k|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
 1738|       |
 1739|  2.84k|   if (dl > max_dl)
  ------------------
  |  Branch (1739:8): [True: 0, False: 2.84k]
  ------------------
 1740|      0|   {
 1741|      0|      png_warning(png_ptr, "sPLT chunk too long");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1742|      0|      return;
 1743|      0|   }
 1744|       |
 1745|  2.84k|   new_palette.nentries = (png_int_32)(data_length / (unsigned int)entry_size);
 1746|       |
 1747|  2.84k|   new_palette.entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
  ------------------
  |  |  330|  2.84k|#define png_malloc_warn OSS_FUZZ_png_malloc_warn
  ------------------
 1748|  2.84k|       (png_alloc_size_t) new_palette.nentries * (sizeof (png_sPLT_entry)));
 1749|       |
 1750|  2.84k|   if (new_palette.entries == NULL)
  ------------------
  |  Branch (1750:8): [True: 0, False: 2.84k]
  ------------------
 1751|      0|   {
 1752|      0|      png_warning(png_ptr, "sPLT chunk requires too much memory");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1753|      0|      return;
 1754|      0|   }
 1755|       |
 1756|  2.84k|#ifdef PNG_POINTER_INDEXING_SUPPORTED
 1757|  74.2k|   for (i = 0; i < new_palette.nentries; i++)
  ------------------
  |  Branch (1757:16): [True: 71.4k, False: 2.84k]
  ------------------
 1758|  71.4k|   {
 1759|  71.4k|      pp = new_palette.entries + i;
 1760|       |
 1761|  71.4k|      if (new_palette.depth == 8)
  ------------------
  |  Branch (1761:11): [True: 4.48k, False: 66.9k]
  ------------------
 1762|  4.48k|      {
 1763|  4.48k|         pp->red = *entry_start++;
 1764|  4.48k|         pp->green = *entry_start++;
 1765|  4.48k|         pp->blue = *entry_start++;
 1766|  4.48k|         pp->alpha = *entry_start++;
 1767|  4.48k|      }
 1768|       |
 1769|  66.9k|      else
 1770|  66.9k|      {
 1771|  66.9k|         pp->red   = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  301|  66.9k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|  66.9k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|  66.9k|   ((png_uint_16) \
  |  |  |  |  |  | 2586|  66.9k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|  66.9k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1772|  66.9k|         pp->green = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  301|  66.9k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|  66.9k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|  66.9k|   ((png_uint_16) \
  |  |  |  |  |  | 2586|  66.9k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|  66.9k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1773|  66.9k|         pp->blue  = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  301|  66.9k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|  66.9k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|  66.9k|   ((png_uint_16) \
  |  |  |  |  |  | 2586|  66.9k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|  66.9k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1774|  66.9k|         pp->alpha = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  301|  66.9k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|  66.9k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|  66.9k|   ((png_uint_16) \
  |  |  |  |  |  | 2586|  66.9k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|  66.9k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1775|  66.9k|      }
 1776|       |
 1777|  71.4k|      pp->frequency = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  301|  71.4k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|  71.4k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|  71.4k|   ((png_uint_16) \
  |  |  |  |  |  | 2586|  71.4k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|  71.4k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1778|  71.4k|   }
 1779|       |#else
 1780|       |   pp = new_palette.entries;
 1781|       |
 1782|       |   for (i = 0; i < new_palette.nentries; i++)
 1783|       |   {
 1784|       |
 1785|       |      if (new_palette.depth == 8)
 1786|       |      {
 1787|       |         pp[i].red   = *entry_start++;
 1788|       |         pp[i].green = *entry_start++;
 1789|       |         pp[i].blue  = *entry_start++;
 1790|       |         pp[i].alpha = *entry_start++;
 1791|       |      }
 1792|       |
 1793|       |      else
 1794|       |      {
 1795|       |         pp[i].red   = png_get_uint_16(entry_start); entry_start += 2;
 1796|       |         pp[i].green = png_get_uint_16(entry_start); entry_start += 2;
 1797|       |         pp[i].blue  = png_get_uint_16(entry_start); entry_start += 2;
 1798|       |         pp[i].alpha = png_get_uint_16(entry_start); entry_start += 2;
 1799|       |      }
 1800|       |
 1801|       |      pp[i].frequency = png_get_uint_16(entry_start); entry_start += 2;
 1802|       |   }
 1803|       |#endif
 1804|       |
 1805|       |   /* Discard all chunk data except the name and stash that */
 1806|  2.84k|   new_palette.name = (png_charp)buffer;
 1807|       |
 1808|  2.84k|   png_set_sPLT(png_ptr, info_ptr, &new_palette, 1);
  ------------------
  |  |  404|  2.84k|#define png_set_sPLT OSS_FUZZ_png_set_sPLT
  ------------------
 1809|       |
 1810|  2.84k|   png_free(png_ptr, new_palette.entries);
  ------------------
  |  |  239|  2.84k|#define png_free OSS_FUZZ_png_free
  ------------------
 1811|  2.84k|}
OSS_FUZZ_png_handle_tRNS:
 1817|  2.66k|{
 1818|  2.66k|   png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
 1819|       |
 1820|  2.66k|   png_debug(1, "in png_handle_tRNS");
  ------------------
  |  |  145|  2.66k|#  define png_debug(l, m) ((void)0)
  ------------------
 1821|       |
 1822|  2.66k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  2.66k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (1822:8): [True: 1, False: 2.66k]
  ------------------
 1823|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 1824|       |
 1825|  2.66k|   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|  2.66k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (1825:13): [True: 195, False: 2.47k]
  ------------------
 1826|    195|   {
 1827|    195|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    195|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1828|    195|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    195|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1829|    195|      return;
 1830|    195|   }
 1831|       |
 1832|  2.47k|   else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != 0)
  ------------------
  |  |  736|  2.47k|#define PNG_INFO_tRNS 0x0010U
  ------------------
  |  Branch (1832:13): [True: 2.47k, False: 0]
  |  Branch (1832:33): [True: 194, False: 2.27k]
  ------------------
 1833|    194|   {
 1834|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1835|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1836|    194|      return;
 1837|    194|   }
 1838|       |
 1839|  2.27k|   if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
  ------------------
  |  |  668|  2.27k|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (1839:8): [True: 568, False: 1.71k]
  ------------------
 1840|    568|   {
 1841|    568|      png_byte buf[2];
 1842|       |
 1843|    568|      if (length != 2)
  ------------------
  |  Branch (1843:11): [True: 414, False: 154]
  ------------------
 1844|    414|      {
 1845|    414|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    414|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1846|    414|         png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    414|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1847|    414|         return;
 1848|    414|      }
 1849|       |
 1850|    154|      png_crc_read(png_ptr, buf, 2);
  ------------------
  |  |   23|    154|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1851|    154|      png_ptr->num_trans = 1;
 1852|    154|      png_ptr->trans_color.gray = png_get_uint_16(buf);
  ------------------
  |  |  301|    154|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|    154|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|    154|   ((png_uint_16) \
  |  |  |  |  |  | 2586|    154|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|    154|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1853|    154|   }
 1854|       |
 1855|  1.71k|   else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
  ------------------
  |  |  670|  1.71k|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|  1.71k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (1855:13): [True: 659, False: 1.05k]
  ------------------
 1856|    659|   {
 1857|    659|      png_byte buf[6];
 1858|       |
 1859|    659|      if (length != 6)
  ------------------
  |  Branch (1859:11): [True: 420, False: 239]
  ------------------
 1860|    420|      {
 1861|    420|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    420|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1862|    420|         png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    420|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1863|    420|         return;
 1864|    420|      }
 1865|       |
 1866|    239|      png_crc_read(png_ptr, buf, length);
  ------------------
  |  |   23|    239|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1867|    239|      png_ptr->num_trans = 1;
 1868|    239|      png_ptr->trans_color.red = png_get_uint_16(buf);
  ------------------
  |  |  301|    239|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|    239|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|    239|   ((png_uint_16) \
  |  |  |  |  |  | 2586|    239|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|    239|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1869|    239|      png_ptr->trans_color.green = png_get_uint_16(buf + 2);
  ------------------
  |  |  301|    239|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|    239|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|    239|   ((png_uint_16) \
  |  |  |  |  |  | 2586|    239|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|    239|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1870|    239|      png_ptr->trans_color.blue = png_get_uint_16(buf + 4);
  ------------------
  |  |  301|    239|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|    239|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|    239|   ((png_uint_16) \
  |  |  |  |  |  | 2586|    239|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|    239|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1871|    239|   }
 1872|       |
 1873|  1.05k|   else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  1.05k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  1.05k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  1.05k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1873:13): [True: 730, False: 322]
  ------------------
 1874|    730|   {
 1875|    730|      if ((png_ptr->mode & PNG_HAVE_PLTE) == 0)
  ------------------
  |  |  645|    730|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (1875:11): [True: 194, False: 536]
  ------------------
 1876|    194|      {
 1877|       |         /* TODO: is this actually an error in the ISO spec? */
 1878|    194|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1879|    194|         png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1880|    194|         return;
 1881|    194|      }
 1882|       |
 1883|    536|      if (length > (unsigned int) png_ptr->num_palette ||
  ------------------
  |  Branch (1883:11): [True: 223, False: 313]
  ------------------
 1884|    536|         length > (unsigned int) PNG_MAX_PALETTE_LENGTH ||
  ------------------
  |  |  725|    849|#define PNG_MAX_PALETTE_LENGTH    256
  ------------------
  |  Branch (1884:10): [True: 0, False: 313]
  ------------------
 1885|    536|         length == 0)
  ------------------
  |  Branch (1885:10): [True: 202, False: 111]
  ------------------
 1886|    425|      {
 1887|    425|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    425|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1888|    425|         png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    425|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1889|    425|         return;
 1890|    425|      }
 1891|       |
 1892|    111|      png_crc_read(png_ptr, readbuf, length);
  ------------------
  |  |   23|    111|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1893|    111|      png_ptr->num_trans = (png_uint_16)length;
 1894|    111|   }
 1895|       |
 1896|    322|   else
 1897|    322|   {
 1898|    322|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    322|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1899|    322|      png_chunk_benign_error(png_ptr, "invalid with alpha channel");
  ------------------
  |  |  224|    322|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1900|    322|      return;
 1901|    322|   }
 1902|       |
 1903|    504|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|    504|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (1903:8): [True: 0, False: 504]
  ------------------
 1904|      0|   {
 1905|      0|      png_ptr->num_trans = 0;
 1906|      0|      return;
 1907|      0|   }
 1908|       |
 1909|       |   /* TODO: this is a horrible side effect in the palette case because the
 1910|       |    * png_struct ends up with a pointer to the tRNS buffer owned by the
 1911|       |    * png_info.  Fix this.
 1912|       |    */
 1913|    504|   png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
  ------------------
  |  |  415|    504|#define png_set_tRNS OSS_FUZZ_png_set_tRNS
  ------------------
 1914|    504|       &(png_ptr->trans_color));
 1915|    504|}
OSS_FUZZ_png_handle_bKGD:
 1921|  2.49k|{
 1922|  2.49k|   unsigned int truelen;
 1923|  2.49k|   png_byte buf[6];
 1924|  2.49k|   png_color_16 background;
 1925|       |
 1926|  2.49k|   png_debug(1, "in png_handle_bKGD");
  ------------------
  |  |  145|  2.49k|#  define png_debug(l, m) ((void)0)
  ------------------
 1927|       |
 1928|  2.49k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  2.49k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (1928:8): [True: 1, False: 2.49k]
  ------------------
 1929|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 1930|       |
 1931|  2.49k|   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0 ||
  ------------------
  |  |  617|  2.49k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (1931:13): [True: 194, False: 2.30k]
  ------------------
 1932|  2.49k|       (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  ------------------
  |  |  669|  4.60k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  2.30k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  2.30k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1932:9): [True: 638, False: 1.66k]
  ------------------
 1933|  2.30k|       (png_ptr->mode & PNG_HAVE_PLTE) == 0))
  ------------------
  |  |  645|    638|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (1933:8): [True: 194, False: 444]
  ------------------
 1934|    388|   {
 1935|    388|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    388|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1936|    388|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    388|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1937|    388|      return;
 1938|    388|   }
 1939|       |
 1940|  2.10k|   else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != 0)
  ------------------
  |  |  737|  2.10k|#define PNG_INFO_bKGD 0x0020U
  ------------------
  |  Branch (1940:13): [True: 2.10k, False: 0]
  |  Branch (1940:33): [True: 194, False: 1.91k]
  ------------------
 1941|    194|   {
 1942|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1943|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1944|    194|      return;
 1945|    194|   }
 1946|       |
 1947|  1.91k|   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  1.91k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  1.91k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  1.91k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1947:8): [True: 444, False: 1.47k]
  ------------------
 1948|    444|      truelen = 1;
 1949|       |
 1950|  1.47k|   else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
  ------------------
  |  |  664|  1.47k|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (1950:13): [True: 830, False: 640]
  ------------------
 1951|    830|      truelen = 6;
 1952|       |
 1953|    640|   else
 1954|    640|      truelen = 2;
 1955|       |
 1956|  1.91k|   if (length != truelen)
  ------------------
  |  Branch (1956:8): [True: 612, False: 1.30k]
  ------------------
 1957|    612|   {
 1958|    612|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    612|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1959|    612|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    612|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1960|    612|      return;
 1961|    612|   }
 1962|       |
 1963|  1.30k|   png_crc_read(png_ptr, buf, truelen);
  ------------------
  |  |   23|  1.30k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1964|       |
 1965|  1.30k|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|  1.30k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (1965:8): [True: 0, False: 1.30k]
  ------------------
 1966|      0|      return;
 1967|       |
 1968|       |   /* We convert the index value into RGB components so that we can allow
 1969|       |    * arbitrary RGB values for background when we have transparency, and
 1970|       |    * so it is easy to determine the RGB values of the background color
 1971|       |    * from the info_ptr struct.
 1972|       |    */
 1973|  1.30k|   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  1.30k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  1.30k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  1.30k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1973:8): [True: 248, False: 1.05k]
  ------------------
 1974|    248|   {
 1975|    248|      background.index = buf[0];
 1976|       |
 1977|    248|      if (info_ptr != NULL && info_ptr->num_palette != 0)
  ------------------
  |  Branch (1977:11): [True: 248, False: 0]
  |  Branch (1977:31): [True: 248, False: 0]
  ------------------
 1978|    248|      {
 1979|    248|         if (buf[0] >= info_ptr->num_palette)
  ------------------
  |  Branch (1979:14): [True: 242, False: 6]
  ------------------
 1980|    242|         {
 1981|    242|            png_chunk_benign_error(png_ptr, "invalid index");
  ------------------
  |  |  224|    242|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1982|    242|            return;
 1983|    242|         }
 1984|       |
 1985|      6|         background.red = (png_uint_16)png_ptr->palette[buf[0]].red;
 1986|      6|         background.green = (png_uint_16)png_ptr->palette[buf[0]].green;
 1987|      6|         background.blue = (png_uint_16)png_ptr->palette[buf[0]].blue;
 1988|      6|      }
 1989|       |
 1990|      0|      else
 1991|      0|         background.red = background.green = background.blue = 0;
 1992|       |
 1993|      6|      background.gray = 0;
 1994|      6|   }
 1995|       |
 1996|  1.05k|   else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) /* GRAY */
  ------------------
  |  |  664|  1.05k|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (1996:13): [True: 422, False: 632]
  ------------------
 1997|    422|   {
 1998|    422|      if (png_ptr->bit_depth <= 8)
  ------------------
  |  Branch (1998:11): [True: 418, False: 4]
  ------------------
 1999|    418|      {
 2000|    418|         if (buf[0] != 0 || buf[1] >= (unsigned int)(1 << png_ptr->bit_depth))
  ------------------
  |  Branch (2000:14): [True: 200, False: 218]
  |  Branch (2000:29): [True: 212, False: 6]
  ------------------
 2001|    412|         {
 2002|    412|            png_chunk_benign_error(png_ptr, "invalid gray level");
  ------------------
  |  |  224|    412|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2003|    412|            return;
 2004|    412|         }
 2005|    418|      }
 2006|       |
 2007|     10|      background.index = 0;
 2008|     10|      background.red =
 2009|     10|      background.green =
 2010|     10|      background.blue =
 2011|     10|      background.gray = png_get_uint_16(buf);
  ------------------
  |  |  301|     10|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|     10|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|     10|   ((png_uint_16) \
  |  |  |  |  |  | 2586|     10|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|     10|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2012|     10|   }
 2013|       |
 2014|    632|   else
 2015|    632|   {
 2016|    632|      if (png_ptr->bit_depth <= 8)
  ------------------
  |  Branch (2016:11): [True: 623, False: 9]
  ------------------
 2017|    623|      {
 2018|    623|         if (buf[0] != 0 || buf[2] != 0 || buf[4] != 0)
  ------------------
  |  Branch (2018:14): [True: 233, False: 390]
  |  Branch (2018:29): [True: 194, False: 196]
  |  Branch (2018:44): [True: 194, False: 2]
  ------------------
 2019|    621|         {
 2020|    621|            png_chunk_benign_error(png_ptr, "invalid color");
  ------------------
  |  |  224|    621|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2021|    621|            return;
 2022|    621|         }
 2023|    623|      }
 2024|       |
 2025|     11|      background.index = 0;
 2026|     11|      background.red = png_get_uint_16(buf);
  ------------------
  |  |  301|     11|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|     11|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|     11|   ((png_uint_16) \
  |  |  |  |  |  | 2586|     11|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|     11|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2027|     11|      background.green = png_get_uint_16(buf + 2);
  ------------------
  |  |  301|     11|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|     11|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|     11|   ((png_uint_16) \
  |  |  |  |  |  | 2586|     11|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|     11|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2028|     11|      background.blue = png_get_uint_16(buf + 4);
  ------------------
  |  |  301|     11|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|     11|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|     11|   ((png_uint_16) \
  |  |  |  |  |  | 2586|     11|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|     11|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2029|     11|      background.gray = 0;
 2030|     11|   }
 2031|       |
 2032|     27|   png_set_bKGD(png_ptr, info_ptr, &background);
  ------------------
  |  |  349|     27|#define png_set_bKGD OSS_FUZZ_png_set_bKGD
  ------------------
 2033|     27|}
OSS_FUZZ_png_handle_eXIf:
 2039|  1.73k|{
 2040|  1.73k|   unsigned int i;
 2041|       |
 2042|  1.73k|   png_debug(1, "in png_handle_eXIf");
  ------------------
  |  |  145|  1.73k|#  define png_debug(l, m) ((void)0)
  ------------------
 2043|       |
 2044|  1.73k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  1.73k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2044:8): [True: 1, False: 1.73k]
  ------------------
 2045|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2046|       |
 2047|  1.73k|   if (length < 2)
  ------------------
  |  Branch (2047:8): [True: 530, False: 1.20k]
  ------------------
 2048|    530|   {
 2049|    530|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    530|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2050|    530|      png_chunk_benign_error(png_ptr, "too short");
  ------------------
  |  |  224|    530|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2051|    530|      return;
 2052|    530|   }
 2053|       |
 2054|  1.20k|   else if (info_ptr == NULL || (info_ptr->valid & PNG_INFO_eXIf) != 0)
  ------------------
  |  |  748|  1.20k|#define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */
  ------------------
  |  Branch (2054:13): [True: 0, False: 1.20k]
  |  Branch (2054:33): [True: 194, False: 1.00k]
  ------------------
 2055|    194|   {
 2056|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2057|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2058|    194|      return;
 2059|    194|   }
 2060|       |
 2061|  1.00k|   info_ptr->free_me |= PNG_FREE_EXIF;
  ------------------
  |  | 1761|  1.00k|#define PNG_FREE_EXIF 0x8000U /* Added at libpng-1.6.31 */
  ------------------
 2062|       |
 2063|  1.00k|   info_ptr->eXIf_buf = png_voidcast(png_bytep,
  ------------------
  |  |  500|  1.00k|#  define png_voidcast(type, value) (value)
  ------------------
 2064|  1.00k|             png_malloc_warn(png_ptr, length));
 2065|       |
 2066|  1.00k|   if (info_ptr->eXIf_buf == NULL)
  ------------------
  |  Branch (2066:8): [True: 32, False: 977]
  ------------------
 2067|     32|   {
 2068|     32|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|     32|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2069|     32|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  224|     32|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2070|     32|      return;
 2071|     32|   }
 2072|       |
 2073|   792k|   for (i = 0; i < length; i++)
  ------------------
  |  Branch (2073:16): [True: 792k, False: 86]
  ------------------
 2074|   792k|   {
 2075|   792k|      png_byte buf[1];
 2076|   792k|      png_crc_read(png_ptr, buf, 1);
  ------------------
  |  |   23|   792k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2077|   792k|      info_ptr->eXIf_buf[i] = buf[0];
 2078|   792k|      if (i == 1)
  ------------------
  |  Branch (2078:11): [True: 962, False: 791k]
  ------------------
 2079|    962|      {
 2080|    962|         if ((buf[0] != 'M' && buf[0] != 'I') ||
  ------------------
  |  Branch (2080:15): [True: 608, False: 354]
  |  Branch (2080:32): [True: 269, False: 339]
  ------------------
 2081|    962|             (info_ptr->eXIf_buf[0] != buf[0]))
  ------------------
  |  Branch (2081:14): [True: 622, False: 71]
  ------------------
 2082|    891|         {
 2083|    891|            png_crc_finish(png_ptr, length - 2);
  ------------------
  |  |   24|    891|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2084|    891|            png_chunk_benign_error(png_ptr, "incorrect byte-order specifier");
  ------------------
  |  |  224|    891|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2085|    891|            png_free(png_ptr, info_ptr->eXIf_buf);
  ------------------
  |  |  239|    891|#define png_free OSS_FUZZ_png_free
  ------------------
 2086|    891|            info_ptr->eXIf_buf = NULL;
 2087|    891|            return;
 2088|    891|         }
 2089|    962|      }
 2090|   792k|   }
 2091|       |
 2092|     86|   if (png_crc_finish(png_ptr, 0) == 0)
  ------------------
  |  |   24|     86|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2092:8): [True: 44, False: 42]
  ------------------
 2093|     44|      png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
  ------------------
  |  |  364|     44|#define png_set_eXIf_1 OSS_FUZZ_png_set_eXIf_1
  ------------------
 2094|       |
 2095|     86|   png_free(png_ptr, info_ptr->eXIf_buf);
  ------------------
  |  |  239|     86|#define png_free OSS_FUZZ_png_free
  ------------------
 2096|     86|   info_ptr->eXIf_buf = NULL;
 2097|     86|}
OSS_FUZZ_png_handle_hIST:
 2103|  1.41k|{
 2104|  1.41k|   unsigned int num, i;
 2105|  1.41k|   png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
 2106|       |
 2107|  1.41k|   png_debug(1, "in png_handle_hIST");
  ------------------
  |  |  145|  1.41k|#  define png_debug(l, m) ((void)0)
  ------------------
 2108|       |
 2109|  1.41k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  1.41k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2109:8): [True: 1, False: 1.41k]
  ------------------
 2110|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2111|       |
 2112|  1.41k|   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0 ||
  ------------------
  |  |  617|  1.41k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (2112:13): [True: 194, False: 1.21k]
  ------------------
 2113|  1.41k|       (png_ptr->mode & PNG_HAVE_PLTE) == 0)
  ------------------
  |  |  645|  1.21k|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (2113:8): [True: 195, False: 1.02k]
  ------------------
 2114|    389|   {
 2115|    389|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    389|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2116|    389|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    389|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2117|    389|      return;
 2118|    389|   }
 2119|       |
 2120|  1.02k|   else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != 0)
  ------------------
  |  |  738|  1.02k|#define PNG_INFO_hIST 0x0040U
  ------------------
  |  Branch (2120:13): [True: 1.02k, False: 0]
  |  Branch (2120:33): [True: 194, False: 827]
  ------------------
 2121|    194|   {
 2122|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2123|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2124|    194|      return;
 2125|    194|   }
 2126|       |
 2127|    827|   num = length / 2 ;
 2128|       |
 2129|    827|   if (length != num * 2 ||
  ------------------
  |  Branch (2129:8): [True: 194, False: 633]
  ------------------
 2130|    827|       num != (unsigned int)png_ptr->num_palette ||
  ------------------
  |  Branch (2130:8): [True: 230, False: 403]
  ------------------
 2131|    827|       num > (unsigned int)PNG_MAX_PALETTE_LENGTH)
  ------------------
  |  |  725|    403|#define PNG_MAX_PALETTE_LENGTH    256
  ------------------
  |  Branch (2131:8): [True: 0, False: 403]
  ------------------
 2132|    424|   {
 2133|    424|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    424|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2134|    424|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    424|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2135|    424|      return;
 2136|    424|   }
 2137|       |
 2138|  1.14k|   for (i = 0; i < num; i++)
  ------------------
  |  Branch (2138:16): [True: 738, False: 403]
  ------------------
 2139|    738|   {
 2140|    738|      png_byte buf[2];
 2141|       |
 2142|    738|      png_crc_read(png_ptr, buf, 2);
  ------------------
  |  |   23|    738|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2143|    738|      readbuf[i] = png_get_uint_16(buf);
  ------------------
  |  |  301|    738|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|    738|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|    738|   ((png_uint_16) \
  |  |  |  |  |  | 2586|    738|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|    738|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2144|    738|   }
 2145|       |
 2146|    403|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|    403|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2146:8): [True: 0, False: 403]
  ------------------
 2147|      0|      return;
 2148|       |
 2149|    403|   png_set_hIST(png_ptr, info_ptr, readbuf);
  ------------------
  |  |  375|    403|#define png_set_hIST OSS_FUZZ_png_set_hIST
  ------------------
 2150|    403|}
OSS_FUZZ_png_handle_pHYs:
 2156|    630|{
 2157|    630|   png_byte buf[9];
 2158|    630|   png_uint_32 res_x, res_y;
 2159|    630|   int unit_type;
 2160|       |
 2161|    630|   png_debug(1, "in png_handle_pHYs");
  ------------------
  |  |  145|    630|#  define png_debug(l, m) ((void)0)
  ------------------
 2162|       |
 2163|    630|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|    630|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2163:8): [True: 2, False: 628]
  ------------------
 2164|      2|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      2|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2165|       |
 2166|    628|   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|    628|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (2166:13): [True: 198, False: 430]
  ------------------
 2167|    198|   {
 2168|    198|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    198|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2169|    198|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    198|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2170|    198|      return;
 2171|    198|   }
 2172|       |
 2173|    430|   else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs) != 0)
  ------------------
  |  |  739|    430|#define PNG_INFO_pHYs 0x0080U
  ------------------
  |  Branch (2173:13): [True: 430, False: 0]
  |  Branch (2173:33): [True: 194, False: 236]
  ------------------
 2174|    194|   {
 2175|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2176|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2177|    194|      return;
 2178|    194|   }
 2179|       |
 2180|    236|   if (length != 9)
  ------------------
  |  Branch (2180:8): [True: 226, False: 10]
  ------------------
 2181|    226|   {
 2182|    226|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    226|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2183|    226|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    226|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2184|    226|      return;
 2185|    226|   }
 2186|       |
 2187|     10|   png_crc_read(png_ptr, buf, 9);
  ------------------
  |  |   23|     10|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2188|       |
 2189|     10|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|     10|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2189:8): [True: 0, False: 10]
  ------------------
 2190|      0|      return;
 2191|       |
 2192|     10|   res_x = png_get_uint_32(buf);
  ------------------
  |  |  303|     10|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|     10|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|     10|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|     10|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|     10|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|     10|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2193|     10|   res_y = png_get_uint_32(buf + 4);
  ------------------
  |  |  303|     10|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|     10|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|     10|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|     10|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|     10|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|     10|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2194|     10|   unit_type = buf[8];
 2195|     10|   png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type);
  ------------------
  |  |  387|     10|#define png_set_pHYs OSS_FUZZ_png_set_pHYs
  ------------------
 2196|     10|}
OSS_FUZZ_png_handle_oFFs:
 2202|    649|{
 2203|    649|   png_byte buf[9];
 2204|    649|   png_int_32 offset_x, offset_y;
 2205|    649|   int unit_type;
 2206|       |
 2207|    649|   png_debug(1, "in png_handle_oFFs");
  ------------------
  |  |  145|    649|#  define png_debug(l, m) ((void)0)
  ------------------
 2208|       |
 2209|    649|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|    649|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2209:8): [True: 1, False: 648]
  ------------------
 2210|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2211|       |
 2212|    648|   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|    648|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (2212:13): [True: 215, False: 433]
  ------------------
 2213|    215|   {
 2214|    215|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    215|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2215|    215|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    215|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2216|    215|      return;
 2217|    215|   }
 2218|       |
 2219|    433|   else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs) != 0)
  ------------------
  |  |  740|    433|#define PNG_INFO_oFFs 0x0100U
  ------------------
  |  Branch (2219:13): [True: 433, False: 0]
  |  Branch (2219:33): [True: 194, False: 239]
  ------------------
 2220|    194|   {
 2221|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2222|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2223|    194|      return;
 2224|    194|   }
 2225|       |
 2226|    239|   if (length != 9)
  ------------------
  |  Branch (2226:8): [True: 227, False: 12]
  ------------------
 2227|    227|   {
 2228|    227|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    227|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2229|    227|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    227|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2230|    227|      return;
 2231|    227|   }
 2232|       |
 2233|     12|   png_crc_read(png_ptr, buf, 9);
  ------------------
  |  |   23|     12|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2234|       |
 2235|     12|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|     12|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2235:8): [True: 0, False: 12]
  ------------------
 2236|      0|      return;
 2237|       |
 2238|     12|   offset_x = png_get_int_32(buf);
  ------------------
  |  |  271|     12|#define png_get_int_32 OSS_FUZZ_png_get_int_32
  |  |  ------------------
  |  |  |  |  440|     12|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2590|     12|   ((png_int_32)((*(buf) & 0x80) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (2590:18): [True: 8, False: 4]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2591|     12|    ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  303|      8|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  438|      8|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2576|      8|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2577|      8|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2578|      8|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2579|      8|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2592|     12|    : (png_int_32)png_get_uint_32(buf)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  303|      4|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  438|      4|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2576|      4|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2577|      4|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2578|      4|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2579|      4|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2239|     12|   offset_y = png_get_int_32(buf + 4);
  ------------------
  |  |  271|     12|#define png_get_int_32 OSS_FUZZ_png_get_int_32
  |  |  ------------------
  |  |  |  |  440|     12|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2590|     12|   ((png_int_32)((*(buf) & 0x80) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (2590:18): [True: 2, False: 10]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2591|     12|    ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  303|      2|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  438|      2|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2576|      2|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2577|      2|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2578|      2|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2579|      2|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2592|     12|    : (png_int_32)png_get_uint_32(buf)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  303|     10|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  438|     10|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2576|     10|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2577|     10|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2578|     10|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2579|     10|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2240|     12|   unit_type = buf[8];
 2241|     12|   png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type);
  ------------------
  |  |  384|     12|#define png_set_oFFs OSS_FUZZ_png_set_oFFs
  ------------------
 2242|     12|}
OSS_FUZZ_png_handle_pCAL:
 2249|  4.60k|{
 2250|  4.60k|   png_int_32 X0, X1;
 2251|  4.60k|   png_byte type, nparams;
 2252|  4.60k|   png_bytep buffer, buf, units, endptr;
 2253|  4.60k|   png_charpp params;
 2254|  4.60k|   int i;
 2255|       |
 2256|  4.60k|   png_debug(1, "in png_handle_pCAL");
  ------------------
  |  |  145|  4.60k|#  define png_debug(l, m) ((void)0)
  ------------------
 2257|       |
 2258|  4.60k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  4.60k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2258:8): [True: 1, False: 4.60k]
  ------------------
 2259|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2260|       |
 2261|  4.60k|   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|  4.60k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (2261:13): [True: 195, False: 4.40k]
  ------------------
 2262|    195|   {
 2263|    195|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    195|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2264|    195|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    195|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2265|    195|      return;
 2266|    195|   }
 2267|       |
 2268|  4.40k|   else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL) != 0)
  ------------------
  |  |  742|  4.40k|#define PNG_INFO_pCAL 0x0400U
  ------------------
  |  Branch (2268:13): [True: 4.40k, False: 0]
  |  Branch (2268:33): [True: 194, False: 4.21k]
  ------------------
 2269|    194|   {
 2270|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2271|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2272|    194|      return;
 2273|    194|   }
 2274|       |
 2275|  4.21k|   png_debug1(2, "Allocating and reading pCAL chunk data (%u bytes)",
  ------------------
  |  |  148|  4.21k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 2276|  4.21k|       length + 1);
 2277|       |
 2278|  4.21k|   buffer = png_read_buffer(png_ptr, length+1, 2/*silent*/);
 2279|       |
 2280|  4.21k|   if (buffer == NULL)
  ------------------
  |  Branch (2280:8): [True: 26, False: 4.18k]
  ------------------
 2281|     26|   {
 2282|     26|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|     26|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2283|     26|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  224|     26|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2284|     26|      return;
 2285|     26|   }
 2286|       |
 2287|  4.18k|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   23|  4.18k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2288|       |
 2289|  4.18k|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|  4.18k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2289:8): [True: 0, False: 4.18k]
  ------------------
 2290|      0|      return;
 2291|       |
 2292|  4.18k|   buffer[length] = 0; /* Null terminate the last string */
 2293|       |
 2294|  4.18k|   png_debug(3, "Finding end of pCAL purpose string");
  ------------------
  |  |  145|  4.18k|#  define png_debug(l, m) ((void)0)
  ------------------
 2295|  4.77k|   for (buf = buffer; *buf; buf++)
  ------------------
  |  Branch (2295:23): [True: 594, False: 4.18k]
  ------------------
 2296|    594|      /* Empty loop */ ;
 2297|       |
 2298|  4.18k|   endptr = buffer + length;
 2299|       |
 2300|       |   /* We need to have at least 12 bytes after the purpose string
 2301|       |    * in order to get the parameter information.
 2302|       |    */
 2303|  4.18k|   if (endptr - buf <= 12)
  ------------------
  |  Branch (2303:8): [True: 1.25k, False: 2.92k]
  ------------------
 2304|  1.25k|   {
 2305|  1.25k|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|  1.25k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2306|  1.25k|      return;
 2307|  1.25k|   }
 2308|       |
 2309|  2.92k|   png_debug(3, "Reading pCAL X0, X1, type, nparams, and units");
  ------------------
  |  |  145|  2.92k|#  define png_debug(l, m) ((void)0)
  ------------------
 2310|  2.92k|   X0 = png_get_int_32((png_bytep)buf+1);
  ------------------
  |  |  271|  2.92k|#define png_get_int_32 OSS_FUZZ_png_get_int_32
  |  |  ------------------
  |  |  |  |  440|  2.92k|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2590|  2.92k|   ((png_int_32)((*(buf) & 0x80) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (2590:18): [True: 1.20k, False: 1.72k]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2591|  2.92k|    ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  303|  1.20k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  438|  1.20k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2576|  1.20k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2577|  1.20k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2578|  1.20k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2579|  1.20k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2592|  2.92k|    : (png_int_32)png_get_uint_32(buf)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  303|  1.72k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  438|  1.72k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2576|  1.72k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2577|  1.72k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2578|  1.72k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2579|  1.72k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2311|  2.92k|   X1 = png_get_int_32((png_bytep)buf+5);
  ------------------
  |  |  271|  2.92k|#define png_get_int_32 OSS_FUZZ_png_get_int_32
  |  |  ------------------
  |  |  |  |  440|  2.92k|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2590|  2.92k|   ((png_int_32)((*(buf) & 0x80) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (2590:18): [True: 1.04k, False: 1.87k]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2591|  2.92k|    ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  303|  1.04k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  438|  1.04k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2576|  1.04k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2577|  1.04k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2578|  1.04k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2579|  1.04k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2592|  2.92k|    : (png_int_32)png_get_uint_32(buf)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  303|  1.87k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  438|  1.87k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2576|  1.87k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2577|  1.87k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2578|  1.87k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2579|  1.87k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2312|  2.92k|   type = buf[9];
 2313|  2.92k|   nparams = buf[10];
 2314|  2.92k|   units = buf + 11;
 2315|       |
 2316|  2.92k|   png_debug(3, "Checking pCAL equation type and number of parameters");
  ------------------
  |  |  145|  2.92k|#  define png_debug(l, m) ((void)0)
  ------------------
 2317|       |   /* Check that we have the right number of parameters for known
 2318|       |    * equation types.
 2319|       |    */
 2320|  2.92k|   if ((type == PNG_EQUATION_LINEAR && nparams != 2) ||
  ------------------
  |  |  697|  5.85k|#define PNG_EQUATION_LINEAR       0 /* Linear transformation */
  ------------------
  |  Branch (2320:9): [True: 689, False: 2.23k]
  |  Branch (2320:40): [True: 218, False: 471]
  ------------------
 2321|  2.92k|       (type == PNG_EQUATION_BASE_E && nparams != 3) ||
  ------------------
  |  |  698|  5.34k|#define PNG_EQUATION_BASE_E       1 /* Exponential base e transform */
  ------------------
  |  Branch (2321:9): [True: 409, False: 2.26k]
  |  Branch (2321:40): [True: 209, False: 200]
  ------------------
 2322|  2.92k|       (type == PNG_EQUATION_ARBITRARY && nparams != 3) ||
  ------------------
  |  |  699|  4.92k|#define PNG_EQUATION_ARBITRARY    2 /* Arbitrary base exponential transform */
  ------------------
  |  Branch (2322:9): [True: 523, False: 1.94k]
  |  Branch (2322:43): [True: 323, False: 200]
  ------------------
 2323|  2.92k|       (type == PNG_EQUATION_HYPERBOLIC && nparams != 4))
  ------------------
  |  |  700|  4.28k|#define PNG_EQUATION_HYPERBOLIC   3 /* Hyperbolic sine transformation */
  ------------------
  |  Branch (2323:9): [True: 645, False: 1.49k]
  |  Branch (2323:44): [True: 214, False: 431]
  ------------------
 2324|    964|   {
 2325|    964|      png_chunk_benign_error(png_ptr, "invalid parameter count");
  ------------------
  |  |  224|    964|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2326|    964|      return;
 2327|    964|   }
 2328|       |
 2329|  1.96k|   else if (type >= PNG_EQUATION_LAST)
  ------------------
  |  |  701|  1.96k|#define PNG_EQUATION_LAST         4 /* Not a valid value */
  ------------------
  |  Branch (2329:13): [True: 624, False: 1.33k]
  ------------------
 2330|    624|   {
 2331|    624|      png_chunk_benign_error(png_ptr, "unrecognized equation type");
  ------------------
  |  |  224|    624|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2332|    624|   }
 2333|       |
 2334|  3.02k|   for (buf = units; *buf; buf++)
  ------------------
  |  Branch (2334:22): [True: 1.06k, False: 1.96k]
  ------------------
 2335|  1.06k|      /* Empty loop to move past the units string. */ ;
 2336|       |
 2337|  1.96k|   png_debug(3, "Allocating pCAL parameters array");
  ------------------
  |  |  145|  1.96k|#  define png_debug(l, m) ((void)0)
  ------------------
 2338|       |
 2339|  1.96k|   params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
  ------------------
  |  |  500|  1.96k|#  define png_voidcast(type, value) (value)
  ------------------
 2340|  1.96k|       nparams * (sizeof (png_charp))));
 2341|       |
 2342|  1.96k|   if (params == NULL)
  ------------------
  |  Branch (2342:8): [True: 215, False: 1.74k]
  ------------------
 2343|    215|   {
 2344|    215|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  224|    215|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2345|    215|      return;
 2346|    215|   }
 2347|       |
 2348|       |   /* Get pointers to the start of each parameter string. */
 2349|  5.49k|   for (i = 0; i < nparams; i++)
  ------------------
  |  Branch (2349:16): [True: 4.34k, False: 1.15k]
  ------------------
 2350|  4.34k|   {
 2351|  4.34k|      buf++; /* Skip the null string terminator from previous parameter. */
 2352|       |
 2353|  4.34k|      png_debug1(3, "Reading pCAL parameter %d", i);
  ------------------
  |  |  148|  4.34k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 2354|       |
 2355|  30.1k|      for (params[i] = (png_charp)buf; buf <= endptr && *buf != 0; buf++)
  ------------------
  |  Branch (2355:40): [True: 29.6k, False: 595]
  |  Branch (2355:57): [True: 25.8k, False: 3.74k]
  ------------------
 2356|  25.8k|         /* Empty loop to move past each parameter string */ ;
 2357|       |
 2358|       |      /* Make sure we haven't run out of data yet */
 2359|  4.34k|      if (buf > endptr)
  ------------------
  |  Branch (2359:11): [True: 595, False: 3.74k]
  ------------------
 2360|    595|      {
 2361|    595|         png_free(png_ptr, params);
  ------------------
  |  |  239|    595|#define png_free OSS_FUZZ_png_free
  ------------------
 2362|    595|         png_chunk_benign_error(png_ptr, "invalid data");
  ------------------
  |  |  224|    595|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2363|    595|         return;
 2364|    595|      }
 2365|  4.34k|   }
 2366|       |
 2367|  1.15k|   png_set_pCAL(png_ptr, info_ptr, (png_charp)buffer, X0, X1, type, nparams,
  ------------------
  |  |  386|  1.15k|#define png_set_pCAL OSS_FUZZ_png_set_pCAL
  ------------------
 2368|  1.15k|       (png_charp)units, params);
 2369|       |
 2370|  1.15k|   png_free(png_ptr, params);
  ------------------
  |  |  239|  1.15k|#define png_free OSS_FUZZ_png_free
  ------------------
 2371|  1.15k|}
OSS_FUZZ_png_handle_sCAL:
 2378|  5.13k|{
 2379|  5.13k|   png_bytep buffer;
 2380|  5.13k|   size_t i;
 2381|  5.13k|   int state;
 2382|       |
 2383|  5.13k|   png_debug(1, "in png_handle_sCAL");
  ------------------
  |  |  145|  5.13k|#  define png_debug(l, m) ((void)0)
  ------------------
 2384|       |
 2385|  5.13k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  5.13k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2385:8): [True: 1, False: 5.13k]
  ------------------
 2386|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2387|       |
 2388|  5.13k|   else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|  5.13k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (2388:13): [True: 194, False: 4.94k]
  ------------------
 2389|    194|   {
 2390|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2391|    194|      png_chunk_benign_error(png_ptr, "out of place");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2392|    194|      return;
 2393|    194|   }
 2394|       |
 2395|  4.94k|   else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL) != 0)
  ------------------
  |  |  746|  4.94k|#define PNG_INFO_sCAL 0x4000U  /* ESR, 1.0.6 */
  ------------------
  |  Branch (2395:13): [True: 4.94k, False: 0]
  |  Branch (2395:33): [True: 194, False: 4.75k]
  ------------------
 2396|    194|   {
 2397|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2398|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2399|    194|      return;
 2400|    194|   }
 2401|       |
 2402|       |   /* Need unit type, width, \0, height: minimum 4 bytes */
 2403|  4.75k|   else if (length < 4)
  ------------------
  |  Branch (2403:13): [True: 198, False: 4.55k]
  ------------------
 2404|    198|   {
 2405|    198|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    198|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2406|    198|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    198|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2407|    198|      return;
 2408|    198|   }
 2409|       |
 2410|  4.55k|   png_debug1(2, "Allocating and reading sCAL chunk data (%u bytes)",
  ------------------
  |  |  148|  4.55k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 2411|  4.55k|       length + 1);
 2412|       |
 2413|  4.55k|   buffer = png_read_buffer(png_ptr, length+1, 2/*silent*/);
 2414|       |
 2415|  4.55k|   if (buffer == NULL)
  ------------------
  |  Branch (2415:8): [True: 54, False: 4.49k]
  ------------------
 2416|     54|   {
 2417|     54|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  224|     54|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2418|     54|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|     54|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2419|     54|      return;
 2420|     54|   }
 2421|       |
 2422|  4.49k|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   23|  4.49k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2423|  4.49k|   buffer[length] = 0; /* Null terminate the last string */
 2424|       |
 2425|  4.49k|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|  4.49k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2425:8): [True: 0, False: 4.49k]
  ------------------
 2426|      0|      return;
 2427|       |
 2428|       |   /* Validate the unit. */
 2429|  4.49k|   if (buffer[0] != 1 && buffer[0] != 2)
  ------------------
  |  Branch (2429:8): [True: 2.00k, False: 2.49k]
  |  Branch (2429:26): [True: 458, False: 1.54k]
  ------------------
 2430|    458|   {
 2431|    458|      png_chunk_benign_error(png_ptr, "invalid unit");
  ------------------
  |  |  224|    458|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2432|    458|      return;
 2433|    458|   }
 2434|       |
 2435|       |   /* Validate the ASCII numbers, need two ASCII numbers separated by
 2436|       |    * a '\0' and they need to fit exactly in the chunk data.
 2437|       |    */
 2438|  4.04k|   i = 1;
 2439|  4.04k|   state = 0;
 2440|       |
 2441|  4.04k|   if (png_check_fp_number((png_const_charp)buffer, length, &state, &i) == 0 ||
  ------------------
  |  |  123|  4.04k|#define png_check_fp_number OSS_FUZZ_png_check_fp_number
  ------------------
  |  Branch (2441:8): [True: 873, False: 3.16k]
  ------------------
 2442|  4.04k|       i >= length || buffer[i++] != 0)
  ------------------
  |  Branch (2442:8): [True: 486, False: 2.68k]
  |  Branch (2442:23): [True: 491, False: 2.19k]
  ------------------
 2443|  1.78k|      png_chunk_benign_error(png_ptr, "bad width format");
  ------------------
  |  |  224|  1.78k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2444|       |
 2445|  2.25k|   else if (PNG_FP_IS_POSITIVE(state) == 0)
  ------------------
  |  | 1930|  2.25k|#define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK)
  |  |  ------------------
  |  |  |  | 1924|  2.25k|#define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1896|  2.25k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1904|  2.25k|#define PNG_FP_NEGATIVE 128  /* A negative number, including "-0" */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1905|  2.25k|#define PNG_FP_NONZERO  256  /* A non-zero value */
  |  |  |  |  ------------------
  |  |  ------------------
  |  |               #define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK)
  |  |  ------------------
  |  |  |  | 1926|  2.25k|#define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1896|  2.25k|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1905|  2.25k|#define PNG_FP_NONZERO  256  /* A non-zero value */
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (2445:13): [True: 199, False: 2.05k]
  ------------------
 2446|    199|      png_chunk_benign_error(png_ptr, "non-positive width");
  ------------------
  |  |  224|    199|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2447|       |
 2448|  2.05k|   else
 2449|  2.05k|   {
 2450|  2.05k|      size_t heighti = i;
 2451|       |
 2452|  2.05k|      state = 0;
 2453|  2.05k|      if (png_check_fp_number((png_const_charp)buffer, length,
  ------------------
  |  |  123|  2.05k|#define png_check_fp_number OSS_FUZZ_png_check_fp_number
  ------------------
  |  Branch (2453:11): [True: 1.04k, False: 1.01k]
  ------------------
 2454|  2.05k|          &state, &i) == 0 || i != length)
  ------------------
  |  Branch (2454:31): [True: 540, False: 475]
  ------------------
 2455|  1.51k|         png_chunk_benign_error(png_ptr, "bad height format");
  ------------------
  |  |  224|  1.51k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2456|       |
 2457|    541|      else if (PNG_FP_IS_POSITIVE(state) == 0)
  ------------------
  |  | 1930|    541|#define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK)
  |  |  ------------------
  |  |  |  | 1924|    541|#define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1896|    541|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1904|    541|#define PNG_FP_NEGATIVE 128  /* A negative number, including "-0" */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1905|    541|#define PNG_FP_NONZERO  256  /* A non-zero value */
  |  |  |  |  ------------------
  |  |  ------------------
  |  |               #define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK)
  |  |  ------------------
  |  |  |  | 1926|    541|#define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1896|    541|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 1905|    541|#define PNG_FP_NONZERO  256  /* A non-zero value */
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (2457:16): [True: 330, False: 211]
  ------------------
 2458|    330|         png_chunk_benign_error(png_ptr, "non-positive height");
  ------------------
  |  |  224|    330|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2459|       |
 2460|    211|      else
 2461|       |         /* This is the (only) success case. */
 2462|    211|         png_set_sCAL_s(png_ptr, info_ptr, buffer[0],
  ------------------
  |  |  403|    211|#define png_set_sCAL_s OSS_FUZZ_png_set_sCAL_s
  ------------------
 2463|    211|             (png_charp)buffer+1, (png_charp)buffer+heighti);
 2464|  2.05k|   }
 2465|  4.04k|}
OSS_FUZZ_png_handle_tIME:
 2471|  2.14k|{
 2472|  2.14k|   png_byte buf[7];
 2473|  2.14k|   png_time mod_time;
 2474|       |
 2475|  2.14k|   png_debug(1, "in png_handle_tIME");
  ------------------
  |  |  145|  2.14k|#  define png_debug(l, m) ((void)0)
  ------------------
 2476|       |
 2477|  2.14k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  2.14k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2477:8): [True: 1, False: 2.14k]
  ------------------
 2478|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2479|       |
 2480|  2.14k|   else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME) != 0)
  ------------------
  |  |  741|  2.14k|#define PNG_INFO_tIME 0x0200U
  ------------------
  |  Branch (2480:13): [True: 2.14k, False: 0]
  |  Branch (2480:33): [True: 194, False: 1.94k]
  ------------------
 2481|    194|   {
 2482|    194|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2483|    194|      png_chunk_benign_error(png_ptr, "duplicate");
  ------------------
  |  |  224|    194|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2484|    194|      return;
 2485|    194|   }
 2486|       |
 2487|  1.94k|   if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|  1.94k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (2487:8): [True: 195, False: 1.75k]
  ------------------
 2488|    195|      png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  646|    195|#define PNG_AFTER_IDAT 0x08
  ------------------
 2489|       |
 2490|  1.94k|   if (length != 7)
  ------------------
  |  Branch (2490:8): [True: 403, False: 1.54k]
  ------------------
 2491|    403|   {
 2492|    403|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    403|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2493|    403|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  224|    403|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2494|    403|      return;
 2495|    403|   }
 2496|       |
 2497|  1.54k|   png_crc_read(png_ptr, buf, 7);
  ------------------
  |  |   23|  1.54k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2498|       |
 2499|  1.54k|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|  1.54k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2499:8): [True: 0, False: 1.54k]
  ------------------
 2500|      0|      return;
 2501|       |
 2502|  1.54k|   mod_time.second = buf[6];
 2503|  1.54k|   mod_time.minute = buf[5];
 2504|  1.54k|   mod_time.hour = buf[4];
 2505|  1.54k|   mod_time.day = buf[3];
 2506|  1.54k|   mod_time.month = buf[2];
 2507|  1.54k|   mod_time.year = png_get_uint_16(buf);
  ------------------
  |  |  301|  1.54k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  439|  1.54k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2585|  1.54k|   ((png_uint_16) \
  |  |  |  |  |  | 2586|  1.54k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2587|  1.54k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2508|       |
 2509|  1.54k|   png_set_tIME(png_ptr, info_ptr, &mod_time);
  ------------------
  |  |  414|  1.54k|#define png_set_tIME OSS_FUZZ_png_set_tIME
  ------------------
 2510|  1.54k|}
OSS_FUZZ_png_handle_tEXt:
 2517|  43.7k|{
 2518|  43.7k|   png_text  text_info;
 2519|  43.7k|   png_bytep buffer;
 2520|  43.7k|   png_charp key;
 2521|  43.7k|   png_charp text;
 2522|  43.7k|   png_uint_32 skip = 0;
 2523|       |
 2524|  43.7k|   png_debug(1, "in png_handle_tEXt");
  ------------------
  |  |  145|  43.7k|#  define png_debug(l, m) ((void)0)
  ------------------
 2525|       |
 2526|  43.7k|#ifdef PNG_USER_LIMITS_SUPPORTED
 2527|  43.7k|   if (png_ptr->user_chunk_cache_max != 0)
  ------------------
  |  Branch (2527:8): [True: 43.7k, False: 0]
  ------------------
 2528|  43.7k|   {
 2529|  43.7k|      if (png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2529:11): [True: 194, False: 43.5k]
  ------------------
 2530|    194|      {
 2531|    194|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2532|    194|         return;
 2533|    194|      }
 2534|       |
 2535|  43.5k|      if (--png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2535:11): [True: 14, False: 43.5k]
  ------------------
 2536|     14|      {
 2537|     14|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|     14|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2538|     14|         png_chunk_benign_error(png_ptr, "no space in chunk cache");
  ------------------
  |  |  224|     14|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2539|     14|         return;
 2540|     14|      }
 2541|  43.5k|   }
 2542|  43.5k|#endif
 2543|       |
 2544|  43.5k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  43.5k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2544:8): [True: 1, False: 43.5k]
  ------------------
 2545|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2546|       |
 2547|  43.5k|   if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|  43.5k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (2547:8): [True: 1.96k, False: 41.5k]
  ------------------
 2548|  1.96k|      png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  646|  1.96k|#define PNG_AFTER_IDAT 0x08
  ------------------
 2549|       |
 2550|       |#ifdef PNG_MAX_MALLOC_64K
 2551|       |   if (length > 65535U)
 2552|       |   {
 2553|       |      png_crc_finish(png_ptr, length);
 2554|       |      png_chunk_benign_error(png_ptr, "too large to fit in memory");
 2555|       |      return;
 2556|       |   }
 2557|       |#endif
 2558|       |
 2559|  43.5k|   buffer = png_read_buffer(png_ptr, length+1, 1/*warn*/);
 2560|       |
 2561|  43.5k|   if (buffer == NULL)
  ------------------
  |  Branch (2561:8): [True: 40.3k, False: 3.18k]
  ------------------
 2562|  40.3k|   {
 2563|  40.3k|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  224|  40.3k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2564|  40.3k|      return;
 2565|  40.3k|   }
 2566|       |
 2567|  3.18k|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   23|  3.18k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2568|       |
 2569|  3.18k|   if (png_crc_finish(png_ptr, skip) != 0)
  ------------------
  |  |   24|  3.18k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2569:8): [True: 0, False: 3.18k]
  ------------------
 2570|      0|      return;
 2571|       |
 2572|  3.18k|   key = (png_charp)buffer;
 2573|  3.18k|   key[length] = 0;
 2574|       |
 2575|  3.66k|   for (text = key; *text; text++)
  ------------------
  |  Branch (2575:21): [True: 488, False: 3.18k]
  ------------------
 2576|    488|      /* Empty loop to find end of key */ ;
 2577|       |
 2578|  3.18k|   if (text != key + length)
  ------------------
  |  Branch (2578:8): [True: 256, False: 2.92k]
  ------------------
 2579|    256|      text++;
 2580|       |
 2581|  3.18k|   text_info.compression = PNG_TEXT_COMPRESSION_NONE;
  ------------------
  |  |  588|  3.18k|#define PNG_TEXT_COMPRESSION_NONE    -1
  ------------------
 2582|  3.18k|   text_info.key = key;
 2583|  3.18k|   text_info.lang = NULL;
 2584|  3.18k|   text_info.lang_key = NULL;
 2585|  3.18k|   text_info.itxt_length = 0;
 2586|  3.18k|   text_info.text = text;
 2587|  3.18k|   text_info.text_length = strlen(text);
 2588|       |
 2589|  3.18k|   if (png_set_text_2(png_ptr, info_ptr, &text_info, 1) != 0)
  ------------------
  |  |   31|  3.18k|#define png_set_text_2 OSS_FUZZ_png_set_text_2
  ------------------
  |  Branch (2589:8): [True: 0, False: 3.18k]
  ------------------
 2590|      0|      png_warning(png_ptr, "Insufficient memory to process text chunk");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2591|  3.18k|}
OSS_FUZZ_png_handle_zTXt:
 2598|  3.58k|{
 2599|  3.58k|   png_const_charp errmsg = NULL;
 2600|  3.58k|   png_bytep       buffer;
 2601|  3.58k|   png_uint_32     keyword_length;
 2602|       |
 2603|  3.58k|   png_debug(1, "in png_handle_zTXt");
  ------------------
  |  |  145|  3.58k|#  define png_debug(l, m) ((void)0)
  ------------------
 2604|       |
 2605|  3.58k|#ifdef PNG_USER_LIMITS_SUPPORTED
 2606|  3.58k|   if (png_ptr->user_chunk_cache_max != 0)
  ------------------
  |  Branch (2606:8): [True: 3.58k, False: 0]
  ------------------
 2607|  3.58k|   {
 2608|  3.58k|      if (png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2608:11): [True: 194, False: 3.39k]
  ------------------
 2609|    194|      {
 2610|    194|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    194|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2611|    194|         return;
 2612|    194|      }
 2613|       |
 2614|  3.39k|      if (--png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2614:11): [True: 10, False: 3.38k]
  ------------------
 2615|     10|      {
 2616|     10|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|     10|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2617|     10|         png_chunk_benign_error(png_ptr, "no space in chunk cache");
  ------------------
  |  |  224|     10|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2618|     10|         return;
 2619|     10|      }
 2620|  3.39k|   }
 2621|  3.38k|#endif
 2622|       |
 2623|  3.38k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  3.38k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2623:8): [True: 1, False: 3.38k]
  ------------------
 2624|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2625|       |
 2626|  3.38k|   if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|  3.38k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (2626:8): [True: 348, False: 3.03k]
  ------------------
 2627|    348|      png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  646|    348|#define PNG_AFTER_IDAT 0x08
  ------------------
 2628|       |
 2629|       |   /* Note, "length" is sufficient here; we won't be adding
 2630|       |    * a null terminator later.
 2631|       |    */
 2632|  3.38k|   buffer = png_read_buffer(png_ptr, length, 2/*silent*/);
 2633|       |
 2634|  3.38k|   if (buffer == NULL)
  ------------------
  |  Branch (2634:8): [True: 308, False: 3.07k]
  ------------------
 2635|    308|   {
 2636|    308|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    308|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2637|    308|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  224|    308|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2638|    308|      return;
 2639|    308|   }
 2640|       |
 2641|  3.07k|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   23|  3.07k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2642|       |
 2643|  3.07k|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|  3.07k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2643:8): [True: 0, False: 3.07k]
  ------------------
 2644|      0|      return;
 2645|       |
 2646|       |   /* TODO: also check that the keyword contents match the spec! */
 2647|  3.07k|   for (keyword_length = 0;
 2648|  1.13M|      keyword_length < length && buffer[keyword_length] != 0;
  ------------------
  |  Branch (2648:7): [True: 1.13M, False: 899]
  |  Branch (2648:34): [True: 1.12M, False: 2.17k]
  ------------------
 2649|  1.12M|      ++keyword_length)
 2650|  1.12M|      /* Empty loop to find end of name */ ;
 2651|       |
 2652|  3.07k|   if (keyword_length > 79 || keyword_length < 1)
  ------------------
  |  Branch (2652:8): [True: 147, False: 2.92k]
  |  Branch (2652:31): [True: 375, False: 2.55k]
  ------------------
 2653|    462|      errmsg = "bad keyword";
 2654|       |
 2655|       |   /* zTXt must have some LZ data after the keyword, although it may expand to
 2656|       |    * zero bytes; we need a '\0' at the end of the keyword, the compression type
 2657|       |    * then the LZ data:
 2658|       |    */
 2659|  2.61k|   else if (keyword_length + 3 > length)
  ------------------
  |  Branch (2659:13): [True: 423, False: 2.18k]
  ------------------
 2660|    423|      errmsg = "truncated";
 2661|       |
 2662|  2.18k|   else if (buffer[keyword_length+1] != PNG_COMPRESSION_TYPE_BASE)
  ------------------
  |  |  678|  2.18k|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */
  ------------------
  |  Branch (2662:13): [True: 277, False: 1.91k]
  ------------------
 2663|    277|      errmsg = "unknown compression type";
 2664|       |
 2665|  1.91k|   else
 2666|  1.91k|   {
 2667|  1.91k|      png_alloc_size_t uncompressed_length = PNG_SIZE_MAX;
  ------------------
  |  |  651|  1.91k|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
 2668|       |
 2669|       |      /* TODO: at present png_decompress_chunk imposes a single application
 2670|       |       * level memory limit, this should be split to different values for iCCP
 2671|       |       * and text chunks.
 2672|       |       */
 2673|  1.91k|      if (png_decompress_chunk(png_ptr, length, keyword_length+2,
  ------------------
  |  Branch (2673:11): [True: 997, False: 915]
  ------------------
 2674|  1.91k|          &uncompressed_length, 1/*terminate*/) == Z_STREAM_END)
 2675|    997|      {
 2676|    997|         png_text text;
 2677|       |
 2678|    997|         if (png_ptr->read_buffer == NULL)
  ------------------
  |  Branch (2678:14): [True: 0, False: 997]
  ------------------
 2679|      0|           errmsg="Read failure in png_handle_zTXt";
 2680|    997|         else
 2681|    997|         {
 2682|       |            /* It worked; png_ptr->read_buffer now looks like a tEXt chunk
 2683|       |             * except for the extra compression type byte and the fact that
 2684|       |             * it isn't necessarily '\0' terminated.
 2685|       |             */
 2686|    997|            buffer = png_ptr->read_buffer;
 2687|    997|            buffer[uncompressed_length+(keyword_length+2)] = 0;
 2688|       |
 2689|    997|            text.compression = PNG_TEXT_COMPRESSION_zTXt;
  ------------------
  |  |  589|    997|#define PNG_TEXT_COMPRESSION_zTXt     0
  ------------------
 2690|    997|            text.key = (png_charp)buffer;
 2691|    997|            text.text = (png_charp)(buffer + keyword_length+2);
 2692|    997|            text.text_length = uncompressed_length;
 2693|    997|            text.itxt_length = 0;
 2694|    997|            text.lang = NULL;
 2695|    997|            text.lang_key = NULL;
 2696|       |
 2697|    997|            if (png_set_text_2(png_ptr, info_ptr, &text, 1) != 0)
  ------------------
  |  |   31|    997|#define png_set_text_2 OSS_FUZZ_png_set_text_2
  ------------------
  |  Branch (2697:17): [True: 0, False: 997]
  ------------------
 2698|      0|               errmsg = "insufficient memory";
 2699|    997|         }
 2700|    997|      }
 2701|       |
 2702|    915|      else
 2703|    915|         errmsg = png_ptr->zstream.msg;
 2704|  1.91k|   }
 2705|       |
 2706|  3.07k|   if (errmsg != NULL)
  ------------------
  |  Branch (2706:8): [True: 2.01k, False: 1.05k]
  ------------------
 2707|  2.01k|      png_chunk_benign_error(png_ptr, errmsg);
  ------------------
  |  |  224|  2.01k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2708|  3.07k|}
OSS_FUZZ_png_handle_iTXt:
 2715|  4.84k|{
 2716|  4.84k|   png_const_charp errmsg = NULL;
 2717|  4.84k|   png_bytep buffer;
 2718|  4.84k|   png_uint_32 prefix_length;
 2719|       |
 2720|  4.84k|   png_debug(1, "in png_handle_iTXt");
  ------------------
  |  |  145|  4.84k|#  define png_debug(l, m) ((void)0)
  ------------------
 2721|       |
 2722|  4.84k|#ifdef PNG_USER_LIMITS_SUPPORTED
 2723|  4.84k|   if (png_ptr->user_chunk_cache_max != 0)
  ------------------
  |  Branch (2723:8): [True: 4.84k, False: 0]
  ------------------
 2724|  4.84k|   {
 2725|  4.84k|      if (png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2725:11): [True: 198, False: 4.64k]
  ------------------
 2726|    198|      {
 2727|    198|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|    198|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2728|    198|         return;
 2729|    198|      }
 2730|       |
 2731|  4.64k|      if (--png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2731:11): [True: 4, False: 4.64k]
  ------------------
 2732|      4|      {
 2733|      4|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|      4|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2734|      4|         png_chunk_benign_error(png_ptr, "no space in chunk cache");
  ------------------
  |  |  224|      4|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2735|      4|         return;
 2736|      4|      }
 2737|  4.64k|   }
 2738|  4.64k|#endif
 2739|       |
 2740|  4.64k|   if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  644|  4.64k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (2740:8): [True: 1, False: 4.64k]
  ------------------
 2741|      1|      png_chunk_error(png_ptr, "missing IHDR");
  ------------------
  |  |  225|      1|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2742|       |
 2743|  4.64k|   if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  617|  4.64k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (2743:8): [True: 989, False: 3.65k]
  ------------------
 2744|    989|      png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  646|    989|#define PNG_AFTER_IDAT 0x08
  ------------------
 2745|       |
 2746|  4.64k|   buffer = png_read_buffer(png_ptr, length+1, 1/*warn*/);
 2747|       |
 2748|  4.64k|   if (buffer == NULL)
  ------------------
  |  Branch (2748:8): [True: 31, False: 4.61k]
  ------------------
 2749|     31|   {
 2750|     31|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|     31|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2751|     31|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  224|     31|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2752|     31|      return;
 2753|     31|   }
 2754|       |
 2755|  4.61k|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   23|  4.61k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2756|       |
 2757|  4.61k|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   24|  4.61k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2757:8): [True: 0, False: 4.61k]
  ------------------
 2758|      0|      return;
 2759|       |
 2760|       |   /* First the keyword. */
 2761|  4.61k|   for (prefix_length=0;
 2762|   550k|      prefix_length < length && buffer[prefix_length] != 0;
  ------------------
  |  Branch (2762:7): [True: 547k, False: 2.65k]
  |  Branch (2762:33): [True: 545k, False: 1.95k]
  ------------------
 2763|   545k|      ++prefix_length)
 2764|   545k|      /* Empty loop */ ;
 2765|       |
 2766|       |   /* Perform a basic check on the keyword length here. */
 2767|  4.61k|   if (prefix_length > 79 || prefix_length < 1)
  ------------------
  |  Branch (2767:8): [True: 262, False: 4.34k]
  |  Branch (2767:30): [True: 1.40k, False: 2.94k]
  ------------------
 2768|  1.60k|      errmsg = "bad keyword";
 2769|       |
 2770|       |   /* Expect keyword, compression flag, compression type, language, translated
 2771|       |    * keyword (both may be empty but are 0 terminated) then the text, which may
 2772|       |    * be empty.
 2773|       |    */
 2774|  3.00k|   else if (prefix_length + 5 > length)
  ------------------
  |  Branch (2774:13): [True: 1.03k, False: 1.97k]
  ------------------
 2775|  1.03k|      errmsg = "truncated";
 2776|       |
 2777|  1.97k|   else if (buffer[prefix_length+1] == 0 ||
  ------------------
  |  Branch (2777:13): [True: 698, False: 1.27k]
  ------------------
 2778|  1.97k|      (buffer[prefix_length+1] == 1 &&
  ------------------
  |  Branch (2778:8): [True: 1.06k, False: 212]
  ------------------
 2779|  1.27k|      buffer[prefix_length+2] == PNG_COMPRESSION_TYPE_BASE))
  ------------------
  |  |  678|  1.06k|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */
  ------------------
  |  Branch (2779:7): [True: 860, False: 201]
  ------------------
 2780|  1.50k|   {
 2781|  1.50k|      int compressed = buffer[prefix_length+1] != 0;
 2782|  1.50k|      png_uint_32 language_offset, translated_keyword_offset;
 2783|  1.50k|      png_alloc_size_t uncompressed_length = 0;
 2784|       |
 2785|       |      /* Now the language tag */
 2786|  1.50k|      prefix_length += 3;
 2787|  1.50k|      language_offset = prefix_length;
 2788|       |
 2789|   867k|      for (; prefix_length < length && buffer[prefix_length] != 0;
  ------------------
  |  Branch (2789:14): [True: 866k, False: 472]
  |  Branch (2789:40): [True: 865k, False: 1.03k]
  ------------------
 2790|   865k|         ++prefix_length)
 2791|   865k|         /* Empty loop */ ;
 2792|       |
 2793|       |      /* WARNING: the length may be invalid here, this is checked below. */
 2794|  1.50k|      translated_keyword_offset = ++prefix_length;
 2795|       |
 2796|   497k|      for (; prefix_length < length && buffer[prefix_length] != 0;
  ------------------
  |  Branch (2796:14): [True: 496k, False: 742]
  |  Branch (2796:40): [True: 496k, False: 760]
  ------------------
 2797|   496k|         ++prefix_length)
 2798|   496k|         /* Empty loop */ ;
 2799|       |
 2800|       |      /* prefix_length should now be at the trailing '\0' of the translated
 2801|       |       * keyword, but it may already be over the end.  None of this arithmetic
 2802|       |       * can overflow because chunks are at most 2^31 bytes long, but on 16-bit
 2803|       |       * systems the available allocation may overflow.
 2804|       |       */
 2805|  1.50k|      ++prefix_length;
 2806|       |
 2807|  1.50k|      if (compressed == 0 && prefix_length <= length)
  ------------------
  |  Branch (2807:11): [True: 642, False: 860]
  |  Branch (2807:30): [True: 260, False: 382]
  ------------------
 2808|    260|         uncompressed_length = length - prefix_length;
 2809|       |
 2810|  1.24k|      else if (compressed != 0 && prefix_length < length)
  ------------------
  |  Branch (2810:16): [True: 860, False: 382]
  |  Branch (2810:35): [True: 439, False: 421]
  ------------------
 2811|    439|      {
 2812|    439|         uncompressed_length = PNG_SIZE_MAX;
  ------------------
  |  |  651|    439|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
 2813|       |
 2814|       |         /* TODO: at present png_decompress_chunk imposes a single application
 2815|       |          * level memory limit, this should be split to different values for
 2816|       |          * iCCP and text chunks.
 2817|       |          */
 2818|    439|         if (png_decompress_chunk(png_ptr, length, prefix_length,
  ------------------
  |  Branch (2818:14): [True: 214, False: 225]
  ------------------
 2819|    439|             &uncompressed_length, 1/*terminate*/) == Z_STREAM_END)
 2820|    214|            buffer = png_ptr->read_buffer;
 2821|       |
 2822|    225|         else
 2823|    225|            errmsg = png_ptr->zstream.msg;
 2824|    439|      }
 2825|       |
 2826|    803|      else
 2827|    803|         errmsg = "truncated";
 2828|       |
 2829|  1.50k|      if (errmsg == NULL)
  ------------------
  |  Branch (2829:11): [True: 474, False: 1.02k]
  ------------------
 2830|    474|      {
 2831|    474|         png_text text;
 2832|       |
 2833|    474|         buffer[uncompressed_length+prefix_length] = 0;
 2834|       |
 2835|    474|         if (compressed == 0)
  ------------------
  |  Branch (2835:14): [True: 260, False: 214]
  ------------------
 2836|    260|            text.compression = PNG_ITXT_COMPRESSION_NONE;
  ------------------
  |  |  590|    260|#define PNG_ITXT_COMPRESSION_NONE     1
  ------------------
 2837|       |
 2838|    214|         else
 2839|    214|            text.compression = PNG_ITXT_COMPRESSION_zTXt;
  ------------------
  |  |  591|    214|#define PNG_ITXT_COMPRESSION_zTXt     2
  ------------------
 2840|       |
 2841|    474|         text.key = (png_charp)buffer;
 2842|    474|         text.lang = (png_charp)buffer + language_offset;
 2843|    474|         text.lang_key = (png_charp)buffer + translated_keyword_offset;
 2844|    474|         text.text = (png_charp)buffer + prefix_length;
 2845|    474|         text.text_length = 0;
 2846|    474|         text.itxt_length = uncompressed_length;
 2847|       |
 2848|    474|         if (png_set_text_2(png_ptr, info_ptr, &text, 1) != 0)
  ------------------
  |  |   31|    474|#define png_set_text_2 OSS_FUZZ_png_set_text_2
  ------------------
  |  Branch (2848:14): [True: 0, False: 474]
  ------------------
 2849|      0|            errmsg = "insufficient memory";
 2850|    474|      }
 2851|  1.50k|   }
 2852|       |
 2853|    469|   else
 2854|    469|      errmsg = "bad compression info";
 2855|       |
 2856|  4.61k|   if (errmsg != NULL)
  ------------------
  |  Branch (2856:8): [True: 4.08k, False: 530]
  ------------------
 2857|  4.08k|      png_chunk_benign_error(png_ptr, errmsg);
  ------------------
  |  |  224|  4.08k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2858|  4.61k|}
OSS_FUZZ_png_handle_unknown:
 2925|  1.60k|{
 2926|  1.60k|   int handled = 0; /* the chunk was handled */
 2927|       |
 2928|  1.60k|   png_debug(1, "in png_handle_unknown");
  ------------------
  |  |  145|  1.60k|#  define png_debug(l, m) ((void)0)
  ------------------
 2929|       |
 2930|  1.60k|#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
 2931|       |   /* NOTE: this code is based on the code in libpng-1.4.12 except for fixing
 2932|       |    * the bug which meant that setting a non-default behavior for a specific
 2933|       |    * chunk would be ignored (the default was always used unless a user
 2934|       |    * callback was installed).
 2935|       |    *
 2936|       |    * 'keep' is the value from the png_chunk_unknown_handling, the setting for
 2937|       |    * this specific chunk_name, if PNG_HANDLE_AS_UNKNOWN_SUPPORTED, if not it
 2938|       |    * will always be PNG_HANDLE_CHUNK_AS_DEFAULT and it needs to be set here.
 2939|       |    * This is just an optimization to avoid multiple calls to the lookup
 2940|       |    * function.
 2941|       |    */
 2942|       |#  ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 2943|       |#     ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
 2944|       |   keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name);
 2945|       |#     endif
 2946|       |#  endif
 2947|       |
 2948|       |   /* One of the following methods will read the chunk or skip it (at least one
 2949|       |    * of these is always defined because this is the only way to switch on
 2950|       |    * PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
 2951|       |    */
 2952|  1.60k|#  ifdef PNG_READ_USER_CHUNKS_SUPPORTED
 2953|       |   /* The user callback takes precedence over the chunk keep value, but the
 2954|       |    * keep value is still required to validate a save of a critical chunk.
 2955|       |    */
 2956|  1.60k|   if (png_ptr->read_user_chunk_fn != NULL)
  ------------------
  |  Branch (2956:8): [True: 0, False: 1.60k]
  ------------------
 2957|      0|   {
 2958|      0|      if (png_cache_unknown_chunk(png_ptr, length) != 0)
  ------------------
  |  Branch (2958:11): [True: 0, False: 0]
  ------------------
 2959|      0|      {
 2960|       |         /* Callback to user unknown chunk handler */
 2961|      0|         int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr,
 2962|      0|             &png_ptr->unknown_chunk);
 2963|       |
 2964|       |         /* ret is:
 2965|       |          * negative: An error occurred; png_chunk_error will be called.
 2966|       |          *     zero: The chunk was not handled, the chunk will be discarded
 2967|       |          *           unless png_set_keep_unknown_chunks has been used to set
 2968|       |          *           a 'keep' behavior for this particular chunk, in which
 2969|       |          *           case that will be used.  A critical chunk will cause an
 2970|       |          *           error at this point unless it is to be saved.
 2971|       |          * positive: The chunk was handled, libpng will ignore/discard it.
 2972|       |          */
 2973|      0|         if (ret < 0)
  ------------------
  |  Branch (2973:14): [True: 0, False: 0]
  ------------------
 2974|      0|            png_chunk_error(png_ptr, "error in user chunk");
  ------------------
  |  |  225|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2975|       |
 2976|      0|         else if (ret == 0)
  ------------------
  |  Branch (2976:19): [True: 0, False: 0]
  ------------------
 2977|      0|         {
 2978|       |            /* If the keep value is 'default' or 'never' override it, but
 2979|       |             * still error out on critical chunks unless the keep value is
 2980|       |             * 'always'  While this is weird it is the behavior in 1.4.12.
 2981|       |             * A possible improvement would be to obey the value set for the
 2982|       |             * chunk, but this would be an API change that would probably
 2983|       |             * damage some applications.
 2984|       |             *
 2985|       |             * The png_app_warning below catches the case that matters, where
 2986|       |             * the application has not set specific save or ignore for this
 2987|       |             * chunk or global save or ignore.
 2988|       |             */
 2989|      0|            if (keep < PNG_HANDLE_CHUNK_IF_SAFE)
  ------------------
  |  | 2347|      0|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
  |  Branch (2989:17): [True: 0, False: 0]
  ------------------
 2990|      0|            {
 2991|      0|#              ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
 2992|      0|               if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE)
  ------------------
  |  | 2347|      0|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
  |  Branch (2992:20): [True: 0, False: 0]
  ------------------
 2993|      0|               {
 2994|      0|                  png_chunk_warning(png_ptr, "Saving unknown chunk:");
  ------------------
  |  |  226|      0|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
 2995|      0|                  png_app_warning(png_ptr,
  ------------------
  |  |  118|      0|#define png_app_warning OSS_FUZZ_png_app_warning
  ------------------
 2996|      0|                      "forcing save of an unhandled chunk;"
 2997|      0|                      " please call png_set_keep_unknown_chunks");
 2998|       |                      /* with keep = PNG_HANDLE_CHUNK_IF_SAFE */
 2999|      0|               }
 3000|      0|#              endif
 3001|      0|               keep = PNG_HANDLE_CHUNK_IF_SAFE;
  ------------------
  |  | 2347|      0|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
 3002|      0|            }
 3003|      0|         }
 3004|       |
 3005|      0|         else /* chunk was handled */
 3006|      0|         {
 3007|      0|            handled = 1;
 3008|       |            /* Critical chunks can be safely discarded at this point. */
 3009|      0|            keep = PNG_HANDLE_CHUNK_NEVER;
  ------------------
  |  | 2346|      0|#define PNG_HANDLE_CHUNK_NEVER        1
  ------------------
 3010|      0|         }
 3011|      0|      }
 3012|       |
 3013|      0|      else
 3014|      0|         keep = PNG_HANDLE_CHUNK_NEVER; /* insufficient memory */
  ------------------
  |  | 2346|      0|#define PNG_HANDLE_CHUNK_NEVER        1
  ------------------
 3015|      0|   }
 3016|       |
 3017|  1.60k|   else
 3018|       |   /* Use the SAVE_UNKNOWN_CHUNKS code or skip the chunk */
 3019|  1.60k|#  endif /* READ_USER_CHUNKS */
 3020|       |
 3021|  1.60k|#  ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED
 3022|  1.60k|   {
 3023|       |      /* keep is currently just the per-chunk setting, if there was no
 3024|       |       * setting change it to the global default now (not that this may
 3025|       |       * still be AS_DEFAULT) then obtain the cache of the chunk if required,
 3026|       |       * if not simply skip the chunk.
 3027|       |       */
 3028|  1.60k|      if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT)
  ------------------
  |  | 2345|  1.60k|#define PNG_HANDLE_CHUNK_AS_DEFAULT   0
  ------------------
  |  Branch (3028:11): [True: 1.60k, False: 0]
  ------------------
 3029|  1.60k|         keep = png_ptr->unknown_default;
 3030|       |
 3031|  1.60k|      if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
  ------------------
  |  | 2348|  3.20k|#define PNG_HANDLE_CHUNK_ALWAYS       3
  ------------------
  |  Branch (3031:11): [True: 0, False: 1.60k]
  ------------------
 3032|  1.60k|         (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
  ------------------
  |  | 2347|  3.20k|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
  |  Branch (3032:11): [True: 0, False: 1.60k]
  ------------------
 3033|  1.60k|          PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
  ------------------
  |  |  888|      0|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  |  |  ------------------
  |  |  |  Branch (888:34): [True: 0, False: 0]
  |  |  ------------------
  ------------------
 3034|      0|      {
 3035|      0|         if (png_cache_unknown_chunk(png_ptr, length) == 0)
  ------------------
  |  Branch (3035:14): [True: 0, False: 0]
  ------------------
 3036|      0|            keep = PNG_HANDLE_CHUNK_NEVER;
  ------------------
  |  | 2346|      0|#define PNG_HANDLE_CHUNK_NEVER        1
  ------------------
 3037|      0|      }
 3038|       |
 3039|  1.60k|      else
 3040|  1.60k|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   24|  1.60k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 3041|  1.60k|   }
 3042|       |#  else
 3043|       |#     ifndef PNG_READ_USER_CHUNKS_SUPPORTED
 3044|       |#        error no method to support READ_UNKNOWN_CHUNKS
 3045|       |#     endif
 3046|       |
 3047|       |   {
 3048|       |      /* If here there is no read callback pointer set and no support is
 3049|       |       * compiled in to just save the unknown chunks, so simply skip this
 3050|       |       * chunk.  If 'keep' is something other than AS_DEFAULT or NEVER then
 3051|       |       * the app has erroneously asked for unknown chunk saving when there
 3052|       |       * is no support.
 3053|       |       */
 3054|       |      if (keep > PNG_HANDLE_CHUNK_NEVER)
 3055|       |         png_app_error(png_ptr, "no unknown chunk support available");
 3056|       |
 3057|       |      png_crc_finish(png_ptr, length);
 3058|       |   }
 3059|       |#  endif
 3060|       |
 3061|  1.60k|#  ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
 3062|       |   /* Now store the chunk in the chunk list if appropriate, and if the limits
 3063|       |    * permit it.
 3064|       |    */
 3065|  1.60k|   if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
  ------------------
  |  | 2348|  3.20k|#define PNG_HANDLE_CHUNK_ALWAYS       3
  ------------------
  |  Branch (3065:8): [True: 825, False: 779]
  ------------------
 3066|  1.60k|      (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
  ------------------
  |  | 2347|  1.55k|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
  |  Branch (3066:8): [True: 0, False: 779]
  ------------------
 3067|    779|       PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
  ------------------
  |  |  888|      0|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  |  |  ------------------
  |  |  |  Branch (888:34): [True: 0, False: 0]
  |  |  ------------------
  ------------------
 3068|      0|   {
 3069|      0|#     ifdef PNG_USER_LIMITS_SUPPORTED
 3070|      0|      switch (png_ptr->user_chunk_cache_max)
 3071|      0|      {
 3072|      0|         case 2:
  ------------------
  |  Branch (3072:10): [True: 0, False: 0]
  ------------------
 3073|      0|            png_ptr->user_chunk_cache_max = 1;
 3074|      0|            png_chunk_benign_error(png_ptr, "no space in chunk cache");
  ------------------
  |  |  224|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 3075|       |            /* FALLTHROUGH */
 3076|      0|         case 1:
  ------------------
  |  Branch (3076:10): [True: 0, False: 0]
  ------------------
 3077|       |            /* NOTE: prior to 1.6.0 this case resulted in an unknown critical
 3078|       |             * chunk being skipped, now there will be a hard error below.
 3079|       |             */
 3080|      0|            break;
 3081|       |
 3082|      0|         default: /* not at limit */
  ------------------
  |  Branch (3082:10): [True: 0, False: 0]
  ------------------
 3083|      0|            --(png_ptr->user_chunk_cache_max);
 3084|       |            /* FALLTHROUGH */
 3085|      0|         case 0: /* no limit */
  ------------------
  |  Branch (3085:10): [True: 0, False: 0]
  ------------------
 3086|      0|#  endif /* USER_LIMITS */
 3087|       |            /* Here when the limit isn't reached or when limits are compiled
 3088|       |             * out; store the chunk.
 3089|       |             */
 3090|      0|            png_set_unknown_chunks(png_ptr, info_ptr,
  ------------------
  |  |  419|      0|#define png_set_unknown_chunks OSS_FUZZ_png_set_unknown_chunks
  ------------------
 3091|      0|                &png_ptr->unknown_chunk, 1);
 3092|      0|            handled = 1;
 3093|      0|#  ifdef PNG_USER_LIMITS_SUPPORTED
 3094|      0|            break;
 3095|      0|      }
 3096|      0|#  endif
 3097|      0|   }
 3098|       |#  else /* no store support: the chunk must be handled by the user callback */
 3099|       |   PNG_UNUSED(info_ptr)
 3100|       |#  endif
 3101|       |
 3102|       |   /* Regardless of the error handling below the cached data (if any) can be
 3103|       |    * freed now.  Notice that the data is not freed if there is a png_error, but
 3104|       |    * it will be freed by destroy_read_struct.
 3105|       |    */
 3106|  1.60k|   if (png_ptr->unknown_chunk.data != NULL)
  ------------------
  |  Branch (3106:8): [True: 0, False: 1.60k]
  ------------------
 3107|      0|      png_free(png_ptr, png_ptr->unknown_chunk.data);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 3108|  1.60k|   png_ptr->unknown_chunk.data = NULL;
 3109|       |
 3110|       |#else /* !PNG_READ_UNKNOWN_CHUNKS_SUPPORTED */
 3111|       |   /* There is no support to read an unknown chunk, so just skip it. */
 3112|       |   png_crc_finish(png_ptr, length);
 3113|       |   PNG_UNUSED(info_ptr)
 3114|       |   PNG_UNUSED(keep)
 3115|       |#endif /* !READ_UNKNOWN_CHUNKS */
 3116|       |
 3117|       |   /* Check for unhandled critical chunks */
 3118|  1.60k|   if (handled == 0 && PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
  ------------------
  |  |  889|    779|#define PNG_CHUNK_CRITICAL(c)     (!PNG_CHUNK_ANCILLARY(c))
  |  |  ------------------
  |  |  |  |  888|    779|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  |  |  ------------------
  |  |  |  Branch (889:35): [True: 2, False: 777]
  |  |  ------------------
  ------------------
  |  Branch (3118:8): [True: 779, False: 825]
  ------------------
 3119|      2|      png_chunk_error(png_ptr, "unhandled critical chunk");
  ------------------
  |  |  225|      2|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 3120|  1.60k|}
OSS_FUZZ_png_check_chunk_name:
 3136|   109k|{
 3137|   109k|   int i;
 3138|   109k|   png_uint_32 cn=chunk_name;
 3139|       |
 3140|   109k|   png_debug(1, "in png_check_chunk_name");
  ------------------
  |  |  145|   109k|#  define png_debug(l, m) ((void)0)
  ------------------
 3141|       |
 3142|   547k|   for (i=1; i<=4; ++i)
  ------------------
  |  Branch (3142:14): [True: 437k, False: 109k]
  ------------------
 3143|   437k|   {
 3144|   437k|      int c = cn & 0xff;
 3145|       |
 3146|   437k|      if (c < 65 || c > 122 || (c > 90 && c < 97))
  ------------------
  |  Branch (3146:11): [True: 32, False: 437k]
  |  Branch (3146:21): [True: 11, False: 437k]
  |  Branch (3146:33): [True: 153k, False: 284k]
  |  Branch (3146:43): [True: 4, False: 153k]
  ------------------
 3147|     47|         png_chunk_error(png_ptr, "invalid chunk type");
  ------------------
  |  |  225|     47|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 3148|       |
 3149|   437k|      cn >>= 8;
 3150|   437k|   }
 3151|   109k|}
OSS_FUZZ_png_check_chunk_length:
 3155|   109k|{
 3156|   109k|   png_alloc_size_t limit = PNG_UINT_31_MAX;
  ------------------
  |  |  649|   109k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
 3157|       |
 3158|   109k|# ifdef PNG_SET_USER_LIMITS_SUPPORTED
 3159|   109k|   if (png_ptr->user_chunk_malloc_max > 0 &&
  ------------------
  |  Branch (3159:8): [True: 109k, False: 0]
  ------------------
 3160|   109k|       png_ptr->user_chunk_malloc_max < limit)
  ------------------
  |  Branch (3160:8): [True: 109k, False: 0]
  ------------------
 3161|   109k|      limit = png_ptr->user_chunk_malloc_max;
 3162|       |# elif PNG_USER_CHUNK_MALLOC_MAX > 0
 3163|       |   if (PNG_USER_CHUNK_MALLOC_MAX < limit)
 3164|       |      limit = PNG_USER_CHUNK_MALLOC_MAX;
 3165|       |# endif
 3166|   109k|   if (png_ptr->chunk_name == png_IDAT)
  ------------------
  |  |  839|   109k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|   109k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   109k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   109k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   109k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|   109k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (3166:8): [True: 3.53k, False: 105k]
  ------------------
 3167|  3.53k|   {
 3168|  3.53k|      png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
  ------------------
  |  |  649|  3.53k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
 3169|  3.53k|      size_t row_factor =
 3170|  3.53k|         (size_t)png_ptr->width
 3171|  3.53k|         * (size_t)png_ptr->channels
 3172|  3.53k|         * (png_ptr->bit_depth > 8? 2: 1)
  ------------------
  |  Branch (3172:13): [True: 518, False: 3.01k]
  ------------------
 3173|  3.53k|         + 1
 3174|  3.53k|         + (png_ptr->interlaced? 6: 0);
  ------------------
  |  Branch (3174:13): [True: 1.03k, False: 2.49k]
  ------------------
 3175|  3.53k|      if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
  ------------------
  |  |  650|  3.53k|#define PNG_UINT_32_MAX ((png_uint_32)(-1))
  ------------------
  |  Branch (3175:11): [True: 8, False: 3.52k]
  ------------------
 3176|      8|         idat_limit = PNG_UINT_31_MAX;
  ------------------
  |  |  649|      8|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
 3177|  3.52k|      else
 3178|  3.52k|         idat_limit = png_ptr->height * row_factor;
 3179|  3.53k|      row_factor = row_factor > 32566? 32566 : row_factor;
  ------------------
  |  Branch (3179:20): [True: 869, False: 2.66k]
  ------------------
 3180|  3.53k|      idat_limit += 6 + 5*(idat_limit/row_factor+1); /* zlib+deflate overhead */
 3181|  3.53k|      idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX;
  ------------------
  |  |  649|  3.53k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
                    idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX;
  ------------------
  |  |  649|  3.55k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
  |  Branch (3181:18): [True: 3.51k, False: 20]
  ------------------
 3182|  3.53k|      limit = limit < idat_limit? idat_limit : limit;
  ------------------
  |  Branch (3182:15): [True: 717, False: 2.81k]
  ------------------
 3183|  3.53k|   }
 3184|       |
 3185|   109k|   if (length > limit)
  ------------------
  |  Branch (3185:8): [True: 3.93k, False: 105k]
  ------------------
 3186|  3.93k|   {
 3187|  3.93k|      png_debug2(0," length = %lu, limit = %lu",
  ------------------
  |  |  151|  3.93k|#  define png_debug2(l, m, p1, p2) ((void)0)
  ------------------
 3188|  3.93k|         (unsigned long)length,(unsigned long)limit);
 3189|  3.93k|      png_benign_error(png_ptr, "chunk data is too large");
  ------------------
  |  |  221|  3.93k|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
 3190|  3.93k|   }
 3191|   109k|}
OSS_FUZZ_png_combine_row:
 3202|   190k|{
 3203|   190k|   unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
 3204|   190k|   png_const_bytep sp = png_ptr->row_buf + 1;
 3205|   190k|   png_alloc_size_t row_width = png_ptr->width;
 3206|   190k|   unsigned int pass = png_ptr->pass;
 3207|   190k|   png_bytep end_ptr = 0;
 3208|   190k|   png_byte end_byte = 0;
 3209|   190k|   unsigned int end_mask;
 3210|       |
 3211|   190k|   png_debug(1, "in png_combine_row");
  ------------------
  |  |  145|   190k|#  define png_debug(l, m) ((void)0)
  ------------------
 3212|       |
 3213|       |   /* Added in 1.5.6: it should not be possible to enter this routine until at
 3214|       |    * least one row has been read from the PNG data and transformed.
 3215|       |    */
 3216|   190k|   if (pixel_depth == 0)
  ------------------
  |  Branch (3216:8): [True: 0, False: 190k]
  ------------------
 3217|      0|      png_error(png_ptr, "internal row logic error");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 3218|       |
 3219|       |   /* Added in 1.5.4: the pixel depth should match the information returned by
 3220|       |    * any call to png_read_update_info at this point.  Do not continue if we got
 3221|       |    * this wrong.
 3222|       |    */
 3223|   190k|   if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes !=
  ------------------
  |  Branch (3223:8): [True: 190k, False: 0]
  |  Branch (3223:39): [True: 0, False: 190k]
  ------------------
 3224|   190k|          PNG_ROWBYTES(pixel_depth, row_width))
  ------------------
  |  |  730|   190k|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 190k, False: 0]
  |  |  ------------------
  |  |  731|   190k|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|   190k|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 3225|      0|      png_error(png_ptr, "internal row size calculation error");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 3226|       |
 3227|       |   /* Don't expect this to ever happen: */
 3228|   190k|   if (row_width == 0)
  ------------------
  |  Branch (3228:8): [True: 0, False: 190k]
  ------------------
 3229|      0|      png_error(png_ptr, "internal row width error");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 3230|       |
 3231|       |   /* Preserve the last byte in cases where only part of it will be overwritten,
 3232|       |    * the multiply below may overflow, we don't care because ANSI-C guarantees
 3233|       |    * we get the low bits.
 3234|       |    */
 3235|   190k|   end_mask = (pixel_depth * row_width) & 7;
 3236|   190k|   if (end_mask != 0)
  ------------------
  |  Branch (3236:8): [True: 0, False: 190k]
  ------------------
 3237|      0|   {
 3238|       |      /* end_ptr == NULL is a flag to say do nothing */
 3239|      0|      end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1;
  ------------------
  |  |  730|      0|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 0, False: 0]
  |  |  ------------------
  |  |  731|      0|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|      0|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 3240|      0|      end_byte = *end_ptr;
 3241|      0|#     ifdef PNG_READ_PACKSWAP_SUPPORTED
 3242|      0|      if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  649|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3242:11): [True: 0, False: 0]
  ------------------
 3243|       |         /* little-endian byte */
 3244|      0|         end_mask = (unsigned int)(0xff << end_mask);
 3245|       |
 3246|      0|      else /* big-endian byte */
 3247|      0|#     endif
 3248|      0|      end_mask = 0xff >> end_mask;
 3249|       |      /* end_mask is now the bits to *keep* from the destination row */
 3250|      0|   }
 3251|       |
 3252|       |   /* For non-interlaced images this reduces to a memcpy(). A memcpy()
 3253|       |    * will also happen if interlacing isn't supported or if the application
 3254|       |    * does not call png_set_interlace_handling().  In the latter cases the
 3255|       |    * caller just gets a sequence of the unexpanded rows from each interlace
 3256|       |    * pass.
 3257|       |    */
 3258|   190k|#ifdef PNG_READ_INTERLACING_SUPPORTED
 3259|   190k|   if (png_ptr->interlaced != 0 &&
  ------------------
  |  Branch (3259:8): [True: 13.0k, False: 177k]
  ------------------
 3260|   190k|       (png_ptr->transformations & PNG_INTERLACE) != 0 &&
  ------------------
  |  |  634|  13.0k|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (3260:8): [True: 13.0k, False: 0]
  ------------------
 3261|   190k|       pass < 6 && (display == 0 ||
  ------------------
  |  Branch (3261:8): [True: 11.4k, False: 1.60k]
  |  Branch (3261:21): [True: 11.4k, False: 0]
  ------------------
 3262|       |       /* The following copies everything for 'display' on passes 0, 2 and 4. */
 3263|  11.4k|       (display == 1 && (pass & 1) != 0)))
  ------------------
  |  Branch (3263:9): [True: 0, False: 0]
  |  Branch (3263:25): [True: 0, False: 0]
  ------------------
 3264|  11.4k|   {
 3265|       |      /* Narrow images may have no bits in a pass; the caller should handle
 3266|       |       * this, but this test is cheap:
 3267|       |       */
 3268|  11.4k|      if (row_width <= PNG_PASS_START_COL(pass))
  ------------------
  |  | 2444|  11.4k|#define PNG_PASS_START_COL(pass) (((1& (pass))<<(3-(((pass)+1)>>1)))&7)
  ------------------
  |  Branch (3268:11): [True: 0, False: 11.4k]
  ------------------
 3269|      0|         return;
 3270|       |
 3271|  11.4k|      if (pixel_depth < 8)
  ------------------
  |  Branch (3271:11): [True: 0, False: 11.4k]
  ------------------
 3272|      0|      {
 3273|       |         /* For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit
 3274|       |          * into 32 bits, then a single loop over the bytes using the four byte
 3275|       |          * values in the 32-bit mask can be used.  For the 'display' option the
 3276|       |          * expanded mask may also not require any masking within a byte.  To
 3277|       |          * make this work the PACKSWAP option must be taken into account - it
 3278|       |          * simply requires the pixels to be reversed in each byte.
 3279|       |          *
 3280|       |          * The 'regular' case requires a mask for each of the first 6 passes,
 3281|       |          * the 'display' case does a copy for the even passes in the range
 3282|       |          * 0..6.  This has already been handled in the test above.
 3283|       |          *
 3284|       |          * The masks are arranged as four bytes with the first byte to use in
 3285|       |          * the lowest bits (little-endian) regardless of the order (PACKSWAP or
 3286|       |          * not) of the pixels in each byte.
 3287|       |          *
 3288|       |          * NOTE: the whole of this logic depends on the caller of this function
 3289|       |          * only calling it on rows appropriate to the pass.  This function only
 3290|       |          * understands the 'x' logic; the 'y' logic is handled by the caller.
 3291|       |          *
 3292|       |          * The following defines allow generation of compile time constant bit
 3293|       |          * masks for each pixel depth and each possibility of swapped or not
 3294|       |          * swapped bytes.  Pass 'p' is in the range 0..6; 'x', a pixel index,
 3295|       |          * is in the range 0..7; and the result is 1 if the pixel is to be
 3296|       |          * copied in the pass, 0 if not.  'S' is for the sparkle method, 'B'
 3297|       |          * for the block method.
 3298|       |          *
 3299|       |          * With some compilers a compile time expression of the general form:
 3300|       |          *
 3301|       |          *    (shift >= 32) ? (a >> (shift-32)) : (b >> shift)
 3302|       |          *
 3303|       |          * Produces warnings with values of 'shift' in the range 33 to 63
 3304|       |          * because the right hand side of the ?: expression is evaluated by
 3305|       |          * the compiler even though it isn't used.  Microsoft Visual C (various
 3306|       |          * versions) and the Intel C compiler are known to do this.  To avoid
 3307|       |          * this the following macros are used in 1.5.6.  This is a temporary
 3308|       |          * solution to avoid destabilizing the code during the release process.
 3309|       |          */
 3310|      0|#        if PNG_USE_COMPILE_TIME_MASKS
 3311|      0|#           define PNG_LSR(x,s) ((x)>>((s) & 0x1f))
 3312|      0|#           define PNG_LSL(x,s) ((x)<<((s) & 0x1f))
 3313|       |#        else
 3314|       |#           define PNG_LSR(x,s) ((x)>>(s))
 3315|       |#           define PNG_LSL(x,s) ((x)<<(s))
 3316|       |#        endif
 3317|      0|#        define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\
 3318|      0|           PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1)
 3319|      0|#        define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\
 3320|      0|           PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1)
 3321|       |
 3322|       |         /* Return a mask for pass 'p' pixel 'x' at depth 'd'.  The mask is
 3323|       |          * little endian - the first pixel is at bit 0 - however the extra
 3324|       |          * parameter 's' can be set to cause the mask position to be swapped
 3325|       |          * within each byte, to match the PNG format.  This is done by XOR of
 3326|       |          * the shift with 7, 6 or 4 for bit depths 1, 2 and 4.
 3327|       |          */
 3328|      0|#        define PIXEL_MASK(p,x,d,s) \
 3329|      0|            (PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0))))
 3330|       |
 3331|       |         /* Hence generate the appropriate 'block' or 'sparkle' pixel copy mask.
 3332|       |          */
 3333|      0|#        define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
 3334|      0|#        define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
 3335|       |
 3336|       |         /* Combine 8 of these to get the full mask.  For the 1-bpp and 2-bpp
 3337|       |          * cases the result needs replicating, for the 4-bpp case the above
 3338|       |          * generates a full 32 bits.
 3339|       |          */
 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
 3341|       |
 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
 3345|       |
 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
 3349|       |
 3350|      0|#if PNG_USE_COMPILE_TIME_MASKS
 3351|       |         /* Utility macros to construct all the masks for a depth/swap
 3352|       |          * combination.  The 's' parameter says whether the format is PNG
 3353|       |          * (big endian bytes) or not.  Only the three odd-numbered passes are
 3354|       |          * required for the display/block algorithm.
 3355|       |          */
 3356|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
 3357|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
 3358|       |
 3359|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
 3360|       |
 3361|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
 3362|       |
 3363|       |         /* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and
 3364|       |          * then pass:
 3365|       |          */
 3366|      0|         static const png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] =
 3367|      0|         {
 3368|       |            /* Little-endian byte masks for PACKSWAP */
 3369|      0|            { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
  ------------------
  |  | 3356|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3357|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
  ------------------
  |  | 3356|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3357|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
  ------------------
  |  | 3356|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3357|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
 3370|       |            /* Normal (big-endian byte) masks - PNG format */
 3371|      0|            { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
  ------------------
  |  | 3356|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3357|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
  ------------------
  |  | 3356|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3357|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
  ------------------
  |  | 3356|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3357|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3342|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3343|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3344|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
 3372|      0|         };
 3373|       |
 3374|       |         /* display_mask has only three entries for the odd passes, so index by
 3375|       |          * pass>>1.
 3376|       |          */
 3377|      0|         static const png_uint_32 display_mask[2][3][3] =
 3378|      0|         {
 3379|       |            /* Little-endian byte masks for PACKSWAP */
 3380|      0|            { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
  ------------------
  |  | 3359|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
  ------------------
  |  | 3359|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
  ------------------
  |  | 3359|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
 3381|       |            /* Normal (big-endian byte) masks - PNG format */
 3382|      0|            { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
  ------------------
  |  | 3359|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
  ------------------
  |  | 3359|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
  ------------------
  |  | 3359|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3346|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3340|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:36): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:40): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (3340:59): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3347|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3348|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
 3383|      0|         };
 3384|       |
 3385|      0|#        define MASK(pass,depth,display,png)\
 3386|      0|            ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
 3387|      0|               row_mask[png][DEPTH_INDEX(depth)][pass])
 3388|       |
 3389|       |#else /* !PNG_USE_COMPILE_TIME_MASKS */
 3390|       |         /* This is the runtime alternative: it seems unlikely that this will
 3391|       |          * ever be either smaller or faster than the compile time approach.
 3392|       |          */
 3393|       |#        define MASK(pass,depth,display,png)\
 3394|       |            ((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png))
 3395|       |#endif /* !USE_COMPILE_TIME_MASKS */
 3396|       |
 3397|       |         /* Use the appropriate mask to copy the required bits.  In some cases
 3398|       |          * the byte mask will be 0 or 0xff; optimize these cases.  row_width is
 3399|       |          * the number of pixels, but the code copies bytes, so it is necessary
 3400|       |          * to special case the end.
 3401|       |          */
 3402|      0|         png_uint_32 pixels_per_byte = 8 / pixel_depth;
 3403|      0|         png_uint_32 mask;
 3404|       |
 3405|      0|#        ifdef PNG_READ_PACKSWAP_SUPPORTED
 3406|      0|         if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  649|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3406:14): [True: 0, False: 0]
  ------------------
 3407|      0|            mask = MASK(pass, pixel_depth, display, 0);
  ------------------
  |  | 3386|      0|            ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
  |  |  ------------------
  |  |  |  | 3361|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3361:33): [True: 0, False: 0]
  |  |  |  |  |  Branch (3361:43): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  |  Branch (3386:14): [True: 0, False: 0]
  |  |  ------------------
  |  | 3387|      0|               row_mask[png][DEPTH_INDEX(depth)][pass])
  |  |  ------------------
  |  |  |  | 3361|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3361:33): [True: 0, False: 0]
  |  |  |  |  |  Branch (3361:43): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 3408|       |
 3409|      0|         else
 3410|      0|#        endif
 3411|      0|         mask = MASK(pass, pixel_depth, display, 1);
  ------------------
  |  | 3386|      0|            ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
  |  |  ------------------
  |  |  |  | 3361|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3361:33): [True: 0, False: 0]
  |  |  |  |  |  Branch (3361:43): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  |  Branch (3386:14): [True: 0, False: 0]
  |  |  ------------------
  |  | 3387|      0|               row_mask[png][DEPTH_INDEX(depth)][pass])
  |  |  ------------------
  |  |  |  | 3361|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3361:33): [True: 0, False: 0]
  |  |  |  |  |  Branch (3361:43): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 3412|       |
 3413|      0|         for (;;)
 3414|      0|         {
 3415|      0|            png_uint_32 m;
 3416|       |
 3417|       |            /* It doesn't matter in the following if png_uint_32 has more than
 3418|       |             * 32 bits because the high bits always match those in m<<24; it is,
 3419|       |             * however, essential to use OR here, not +, because of this.
 3420|       |             */
 3421|      0|            m = mask;
 3422|      0|            mask = (m >> 8) | (m << 24); /* rotate right to good compilers */
 3423|      0|            m &= 0xff;
 3424|       |
 3425|      0|            if (m != 0) /* something to copy */
  ------------------
  |  Branch (3425:17): [True: 0, False: 0]
  ------------------
 3426|      0|            {
 3427|      0|               if (m != 0xff)
  ------------------
  |  Branch (3427:20): [True: 0, False: 0]
  ------------------
 3428|      0|                  *dp = (png_byte)((*dp & ~m) | (*sp & m));
 3429|      0|               else
 3430|      0|                  *dp = *sp;
 3431|      0|            }
 3432|       |
 3433|       |            /* NOTE: this may overwrite the last byte with garbage if the image
 3434|       |             * is not an exact number of bytes wide; libpng has always done
 3435|       |             * this.
 3436|       |             */
 3437|      0|            if (row_width <= pixels_per_byte)
  ------------------
  |  Branch (3437:17): [True: 0, False: 0]
  ------------------
 3438|      0|               break; /* May need to restore part of the last byte */
 3439|       |
 3440|      0|            row_width -= pixels_per_byte;
 3441|      0|            ++dp;
 3442|      0|            ++sp;
 3443|      0|         }
 3444|      0|      }
 3445|       |
 3446|  11.4k|      else /* pixel_depth >= 8 */
 3447|  11.4k|      {
 3448|  11.4k|         unsigned int bytes_to_copy, bytes_to_jump;
 3449|       |
 3450|       |         /* Validate the depth - it must be a multiple of 8 */
 3451|  11.4k|         if (pixel_depth & 7)
  ------------------
  |  Branch (3451:14): [True: 0, False: 11.4k]
  ------------------
 3452|      0|            png_error(png_ptr, "invalid user transform pixel depth");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 3453|       |
 3454|  11.4k|         pixel_depth >>= 3; /* now in bytes */
 3455|  11.4k|         row_width *= pixel_depth;
 3456|       |
 3457|       |         /* Regardless of pass number the Adam 7 interlace always results in a
 3458|       |          * fixed number of pixels to copy then to skip.  There may be a
 3459|       |          * different number of pixels to skip at the start though.
 3460|       |          */
 3461|  11.4k|         {
 3462|  11.4k|            unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth;
  ------------------
  |  | 2444|  11.4k|#define PNG_PASS_START_COL(pass) (((1& (pass))<<(3-(((pass)+1)>>1)))&7)
  ------------------
 3463|       |
 3464|  11.4k|            row_width -= offset;
 3465|  11.4k|            dp += offset;
 3466|  11.4k|            sp += offset;
 3467|  11.4k|         }
 3468|       |
 3469|       |         /* Work out the bytes to copy. */
 3470|  11.4k|         if (display != 0)
  ------------------
  |  Branch (3470:14): [True: 0, False: 11.4k]
  ------------------
 3471|      0|         {
 3472|       |            /* When doing the 'block' algorithm the pixel in the pass gets
 3473|       |             * replicated to adjacent pixels.  This is why the even (0,2,4,6)
 3474|       |             * passes are skipped above - the entire expanded row is copied.
 3475|       |             */
 3476|      0|            bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth;
 3477|       |
 3478|       |            /* But don't allow this number to exceed the actual row width. */
 3479|      0|            if (bytes_to_copy > row_width)
  ------------------
  |  Branch (3479:17): [True: 0, False: 0]
  ------------------
 3480|      0|               bytes_to_copy = (unsigned int)/*SAFE*/row_width;
 3481|      0|         }
 3482|       |
 3483|  11.4k|         else /* normal row; Adam7 only ever gives us one pixel to copy. */
 3484|  11.4k|            bytes_to_copy = pixel_depth;
 3485|       |
 3486|       |         /* In Adam7 there is a constant offset between where the pixels go. */
 3487|  11.4k|         bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;
  ------------------
  |  | 2452|  11.4k|#define PNG_PASS_COL_OFFSET(pass) (1<<((7-(pass))>>1))
  ------------------
 3488|       |
 3489|       |         /* And simply copy these bytes.  Some optimization is possible here,
 3490|       |          * depending on the value of 'bytes_to_copy'.  Special case the low
 3491|       |          * byte counts, which we know to be frequent.
 3492|       |          *
 3493|       |          * Notice that these cases all 'return' rather than 'break' - this
 3494|       |          * avoids an unnecessary test on whether to restore the last byte
 3495|       |          * below.
 3496|       |          */
 3497|  11.4k|         switch (bytes_to_copy)
 3498|  11.4k|         {
 3499|      0|            case 1:
  ------------------
  |  Branch (3499:13): [True: 0, False: 11.4k]
  ------------------
 3500|      0|               for (;;)
 3501|      0|               {
 3502|      0|                  *dp = *sp;
 3503|       |
 3504|      0|                  if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3504:23): [True: 0, False: 0]
  ------------------
 3505|      0|                     return;
 3506|       |
 3507|      0|                  dp += bytes_to_jump;
 3508|      0|                  sp += bytes_to_jump;
 3509|      0|                  row_width -= bytes_to_jump;
 3510|      0|               }
 3511|       |
 3512|      0|            case 2:
  ------------------
  |  Branch (3512:13): [True: 0, False: 11.4k]
  ------------------
 3513|       |               /* There is a possibility of a partial copy at the end here; this
 3514|       |                * slows the code down somewhat.
 3515|       |                */
 3516|      0|               do
 3517|      0|               {
 3518|      0|                  dp[0] = sp[0]; dp[1] = sp[1];
 3519|       |
 3520|      0|                  if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3520:23): [True: 0, False: 0]
  ------------------
 3521|      0|                     return;
 3522|       |
 3523|      0|                  sp += bytes_to_jump;
 3524|      0|                  dp += bytes_to_jump;
 3525|      0|                  row_width -= bytes_to_jump;
 3526|      0|               }
 3527|      0|               while (row_width > 1);
  ------------------
  |  Branch (3527:23): [True: 0, False: 0]
  ------------------
 3528|       |
 3529|       |               /* And there can only be one byte left at this point: */
 3530|      0|               *dp = *sp;
 3531|      0|               return;
 3532|       |
 3533|  9.37k|            case 3:
  ------------------
  |  Branch (3533:13): [True: 9.37k, False: 2.06k]
  ------------------
 3534|       |               /* This can only be the RGB case, so each copy is exactly one
 3535|       |                * pixel and it is not necessary to check for a partial copy.
 3536|       |                */
 3537|  9.37k|               for (;;)
 3538|  2.61M|               {
 3539|  2.61M|                  dp[0] = sp[0]; dp[1] = sp[1]; dp[2] = sp[2];
 3540|       |
 3541|  2.61M|                  if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3541:23): [True: 9.37k, False: 2.60M]
  ------------------
 3542|  9.37k|                     return;
 3543|       |
 3544|  2.60M|                  sp += bytes_to_jump;
 3545|  2.60M|                  dp += bytes_to_jump;
 3546|  2.60M|                  row_width -= bytes_to_jump;
 3547|  2.60M|               }
 3548|       |
 3549|  2.06k|            default:
  ------------------
  |  Branch (3549:13): [True: 2.06k, False: 9.37k]
  ------------------
 3550|  2.06k|#if PNG_ALIGN_TYPE != PNG_ALIGN_NONE
 3551|       |               /* Check for double byte alignment and, if possible, use a
 3552|       |                * 16-bit copy.  Don't attempt this for narrow images - ones that
 3553|       |                * are less than an interlace panel wide.  Don't attempt it for
 3554|       |                * wide bytes_to_copy either - use the memcpy there.
 3555|       |                */
 3556|  2.06k|               if (bytes_to_copy < 16 /*else use memcpy*/ &&
  ------------------
  |  Branch (3556:20): [True: 2.06k, False: 0]
  ------------------
 3557|  2.06k|                   png_isaligned(dp, png_uint_16) &&
  ------------------
  |  |  598|  4.13k|   (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0)
  |  |  ------------------
  |  |  |  |  583|  2.06k|#  define png_alignof(type) (sizeof(type))
  |  |  ------------------
  |  |  |  Branch (598:4): [True: 2.06k, False: 0]
  |  |  ------------------
  ------------------
 3558|  2.06k|                   png_isaligned(sp, png_uint_16) &&
  ------------------
  |  |  598|  4.13k|   (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0)
  |  |  ------------------
  |  |  |  |  583|  2.06k|#  define png_alignof(type) (sizeof(type))
  |  |  ------------------
  |  |  |  Branch (598:4): [True: 2.06k, False: 0]
  |  |  ------------------
  ------------------
 3559|  2.06k|                   bytes_to_copy % (sizeof (png_uint_16)) == 0 &&
  ------------------
  |  Branch (3559:20): [True: 2.06k, False: 0]
  ------------------
 3560|  2.06k|                   bytes_to_jump % (sizeof (png_uint_16)) == 0)
  ------------------
  |  Branch (3560:20): [True: 2.06k, False: 0]
  ------------------
 3561|  2.06k|               {
 3562|       |                  /* Everything is aligned for png_uint_16 copies, but try for
 3563|       |                   * png_uint_32 first.
 3564|       |                   */
 3565|  2.06k|                  if (png_isaligned(dp, png_uint_32) &&
  ------------------
  |  |  598|  4.13k|   (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0)
  |  |  ------------------
  |  |  |  |  583|  2.06k|#  define png_alignof(type) (sizeof(type))
  |  |  ------------------
  |  |  |  Branch (598:4): [True: 2.06k, False: 0]
  |  |  ------------------
  ------------------
 3566|  2.06k|                      png_isaligned(sp, png_uint_32) &&
  ------------------
  |  |  598|  4.13k|   (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0)
  |  |  ------------------
  |  |  |  |  583|  2.06k|#  define png_alignof(type) (sizeof(type))
  |  |  ------------------
  |  |  |  Branch (598:4): [True: 2.06k, False: 0]
  |  |  ------------------
  ------------------
 3567|  2.06k|                      bytes_to_copy % (sizeof (png_uint_32)) == 0 &&
  ------------------
  |  Branch (3567:23): [True: 2.06k, False: 0]
  ------------------
 3568|  2.06k|                      bytes_to_jump % (sizeof (png_uint_32)) == 0)
  ------------------
  |  Branch (3568:23): [True: 2.06k, False: 0]
  ------------------
 3569|  2.06k|                  {
 3570|  2.06k|                     png_uint_32p dp32 = png_aligncast(png_uint_32p,dp);
  ------------------
  |  |  502|  2.06k|#  define png_aligncast(type, value) ((void*)(value))
  ------------------
 3571|  2.06k|                     png_const_uint_32p sp32 = png_aligncastconst(
  ------------------
  |  |  503|  2.06k|#  define png_aligncastconst(type, value) ((const void*)(value))
  ------------------
 3572|  2.06k|                         png_const_uint_32p, sp);
 3573|  2.06k|                     size_t skip = (bytes_to_jump-bytes_to_copy) /
 3574|  2.06k|                         (sizeof (png_uint_32));
 3575|       |
 3576|  2.06k|                     do
 3577|  3.11M|                     {
 3578|  3.11M|                        size_t c = bytes_to_copy;
 3579|  3.11M|                        do
 3580|  3.11M|                        {
 3581|  3.11M|                           *dp32++ = *sp32++;
 3582|  3.11M|                           c -= (sizeof (png_uint_32));
 3583|  3.11M|                        }
 3584|  3.11M|                        while (c > 0);
  ------------------
  |  Branch (3584:32): [True: 0, False: 3.11M]
  ------------------
 3585|       |
 3586|  3.11M|                        if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3586:29): [True: 2.06k, False: 3.11M]
  ------------------
 3587|  2.06k|                           return;
 3588|       |
 3589|  3.11M|                        dp32 += skip;
 3590|  3.11M|                        sp32 += skip;
 3591|  3.11M|                        row_width -= bytes_to_jump;
 3592|  3.11M|                     }
 3593|  3.11M|                     while (bytes_to_copy <= row_width);
  ------------------
  |  Branch (3593:29): [True: 3.11M, False: 0]
  ------------------
 3594|       |
 3595|       |                     /* Get to here when the row_width truncates the final copy.
 3596|       |                      * There will be 1-3 bytes left to copy, so don't try the
 3597|       |                      * 16-bit loop below.
 3598|       |                      */
 3599|      0|                     dp = (png_bytep)dp32;
 3600|      0|                     sp = (png_const_bytep)sp32;
 3601|      0|                     do
 3602|      0|                        *dp++ = *sp++;
 3603|      0|                     while (--row_width > 0);
  ------------------
  |  Branch (3603:29): [True: 0, False: 0]
  ------------------
 3604|      0|                     return;
 3605|  2.06k|                  }
 3606|       |
 3607|       |                  /* Else do it in 16-bit quantities, but only if the size is
 3608|       |                   * not too large.
 3609|       |                   */
 3610|      0|                  else
 3611|      0|                  {
 3612|      0|                     png_uint_16p dp16 = png_aligncast(png_uint_16p, dp);
  ------------------
  |  |  502|      0|#  define png_aligncast(type, value) ((void*)(value))
  ------------------
 3613|      0|                     png_const_uint_16p sp16 = png_aligncastconst(
  ------------------
  |  |  503|      0|#  define png_aligncastconst(type, value) ((const void*)(value))
  ------------------
 3614|      0|                        png_const_uint_16p, sp);
 3615|      0|                     size_t skip = (bytes_to_jump-bytes_to_copy) /
 3616|      0|                        (sizeof (png_uint_16));
 3617|       |
 3618|      0|                     do
 3619|      0|                     {
 3620|      0|                        size_t c = bytes_to_copy;
 3621|      0|                        do
 3622|      0|                        {
 3623|      0|                           *dp16++ = *sp16++;
 3624|      0|                           c -= (sizeof (png_uint_16));
 3625|      0|                        }
 3626|      0|                        while (c > 0);
  ------------------
  |  Branch (3626:32): [True: 0, False: 0]
  ------------------
 3627|       |
 3628|      0|                        if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3628:29): [True: 0, False: 0]
  ------------------
 3629|      0|                           return;
 3630|       |
 3631|      0|                        dp16 += skip;
 3632|      0|                        sp16 += skip;
 3633|      0|                        row_width -= bytes_to_jump;
 3634|      0|                     }
 3635|      0|                     while (bytes_to_copy <= row_width);
  ------------------
  |  Branch (3635:29): [True: 0, False: 0]
  ------------------
 3636|       |
 3637|       |                     /* End of row - 1 byte left, bytes_to_copy > row_width: */
 3638|      0|                     dp = (png_bytep)dp16;
 3639|      0|                     sp = (png_const_bytep)sp16;
 3640|      0|                     do
 3641|      0|                        *dp++ = *sp++;
 3642|      0|                     while (--row_width > 0);
  ------------------
  |  Branch (3642:29): [True: 0, False: 0]
  ------------------
 3643|      0|                     return;
 3644|      0|                  }
 3645|  2.06k|               }
 3646|      0|#endif /* ALIGN_TYPE code */
 3647|       |
 3648|       |               /* The true default - use a memcpy: */
 3649|      0|               for (;;)
 3650|      0|               {
 3651|      0|                  memcpy(dp, sp, bytes_to_copy);
 3652|       |
 3653|      0|                  if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3653:23): [True: 0, False: 0]
  ------------------
 3654|      0|                     return;
 3655|       |
 3656|      0|                  sp += bytes_to_jump;
 3657|      0|                  dp += bytes_to_jump;
 3658|      0|                  row_width -= bytes_to_jump;
 3659|      0|                  if (bytes_to_copy > row_width)
  ------------------
  |  Branch (3659:23): [True: 0, False: 0]
  ------------------
 3660|      0|                     bytes_to_copy = (unsigned int)/*SAFE*/row_width;
 3661|      0|               }
 3662|  11.4k|         }
 3663|       |
 3664|       |         /* NOT REACHED*/
 3665|  11.4k|      } /* pixel_depth >= 8 */
 3666|       |
 3667|       |      /* Here if pixel_depth < 8 to check 'end_ptr' below. */
 3668|  11.4k|   }
 3669|   179k|   else
 3670|   179k|#endif /* READ_INTERLACING */
 3671|       |
 3672|       |   /* If here then the switch above wasn't used so just memcpy the whole row
 3673|       |    * from the temporary row buffer (notice that this overwrites the end of the
 3674|       |    * destination row if it is a partial byte.)
 3675|       |    */
 3676|   179k|   memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width));
  ------------------
  |  |  730|   179k|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 179k, False: 0]
  |  |  ------------------
  |  |  731|   179k|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|   179k|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 3677|       |
 3678|       |   /* Restore the overwritten bits from the last byte if necessary. */
 3679|   179k|   if (end_ptr != NULL)
  ------------------
  |  Branch (3679:8): [True: 0, False: 179k]
  ------------------
 3680|      0|      *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask));
 3681|   179k|}
OSS_FUZZ_png_do_read_interlace:
 3687|  11.4k|{
 3688|       |   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 3689|       |   /* Offset to next interlace block */
 3690|  11.4k|   static const unsigned int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
 3691|       |
 3692|  11.4k|   png_debug(1, "in png_do_read_interlace");
  ------------------
  |  |  145|  11.4k|#  define png_debug(l, m) ((void)0)
  ------------------
 3693|  11.4k|   if (row != NULL && row_info != NULL)
  ------------------
  |  Branch (3693:8): [True: 11.4k, False: 0]
  |  Branch (3693:23): [True: 11.4k, False: 0]
  ------------------
 3694|  11.4k|   {
 3695|  11.4k|      png_uint_32 final_width;
 3696|       |
 3697|  11.4k|      final_width = row_info->width * png_pass_inc[pass];
 3698|       |
 3699|  11.4k|      switch (row_info->pixel_depth)
 3700|  11.4k|      {
 3701|      0|         case 1:
  ------------------
  |  Branch (3701:10): [True: 0, False: 11.4k]
  ------------------
 3702|      0|         {
 3703|      0|            png_bytep sp = row + (size_t)((row_info->width - 1) >> 3);
 3704|      0|            png_bytep dp = row + (size_t)((final_width - 1) >> 3);
 3705|      0|            unsigned int sshift, dshift;
 3706|      0|            unsigned int s_start, s_end;
 3707|      0|            int s_inc;
 3708|      0|            int jstop = (int)png_pass_inc[pass];
 3709|      0|            png_byte v;
 3710|      0|            png_uint_32 i;
 3711|      0|            int j;
 3712|       |
 3713|      0|#ifdef PNG_READ_PACKSWAP_SUPPORTED
 3714|      0|            if ((transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  649|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3714:17): [True: 0, False: 0]
  ------------------
 3715|      0|            {
 3716|      0|                sshift = ((row_info->width + 7) & 0x07);
 3717|      0|                dshift = ((final_width + 7) & 0x07);
 3718|      0|                s_start = 7;
 3719|      0|                s_end = 0;
 3720|      0|                s_inc = -1;
 3721|      0|            }
 3722|       |
 3723|      0|            else
 3724|      0|#endif
 3725|      0|            {
 3726|      0|                sshift = 7 - ((row_info->width + 7) & 0x07);
 3727|      0|                dshift = 7 - ((final_width + 7) & 0x07);
 3728|      0|                s_start = 0;
 3729|      0|                s_end = 7;
 3730|      0|                s_inc = 1;
 3731|      0|            }
 3732|       |
 3733|      0|            for (i = 0; i < row_info->width; i++)
  ------------------
  |  Branch (3733:25): [True: 0, False: 0]
  ------------------
 3734|      0|            {
 3735|      0|               v = (png_byte)((*sp >> sshift) & 0x01);
 3736|      0|               for (j = 0; j < jstop; j++)
  ------------------
  |  Branch (3736:28): [True: 0, False: 0]
  ------------------
 3737|      0|               {
 3738|      0|                  unsigned int tmp = *dp & (0x7f7f >> (7 - dshift));
 3739|      0|                  tmp |= (unsigned int)(v << dshift);
 3740|      0|                  *dp = (png_byte)(tmp & 0xff);
 3741|       |
 3742|      0|                  if (dshift == s_end)
  ------------------
  |  Branch (3742:23): [True: 0, False: 0]
  ------------------
 3743|      0|                  {
 3744|      0|                     dshift = s_start;
 3745|      0|                     dp--;
 3746|      0|                  }
 3747|       |
 3748|      0|                  else
 3749|      0|                     dshift = (unsigned int)((int)dshift + s_inc);
 3750|      0|               }
 3751|       |
 3752|      0|               if (sshift == s_end)
  ------------------
  |  Branch (3752:20): [True: 0, False: 0]
  ------------------
 3753|      0|               {
 3754|      0|                  sshift = s_start;
 3755|      0|                  sp--;
 3756|      0|               }
 3757|       |
 3758|      0|               else
 3759|      0|                  sshift = (unsigned int)((int)sshift + s_inc);
 3760|      0|            }
 3761|      0|            break;
 3762|      0|         }
 3763|       |
 3764|      0|         case 2:
  ------------------
  |  Branch (3764:10): [True: 0, False: 11.4k]
  ------------------
 3765|      0|         {
 3766|      0|            png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2);
 3767|      0|            png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2);
 3768|      0|            unsigned int sshift, dshift;
 3769|      0|            unsigned int s_start, s_end;
 3770|      0|            int s_inc;
 3771|      0|            int jstop = (int)png_pass_inc[pass];
 3772|      0|            png_uint_32 i;
 3773|       |
 3774|      0|#ifdef PNG_READ_PACKSWAP_SUPPORTED
 3775|      0|            if ((transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  649|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3775:17): [True: 0, False: 0]
  ------------------
 3776|      0|            {
 3777|      0|               sshift = (((row_info->width + 3) & 0x03) << 1);
 3778|      0|               dshift = (((final_width + 3) & 0x03) << 1);
 3779|      0|               s_start = 6;
 3780|      0|               s_end = 0;
 3781|      0|               s_inc = -2;
 3782|      0|            }
 3783|       |
 3784|      0|            else
 3785|      0|#endif
 3786|      0|            {
 3787|      0|               sshift = ((3 - ((row_info->width + 3) & 0x03)) << 1);
 3788|      0|               dshift = ((3 - ((final_width + 3) & 0x03)) << 1);
 3789|      0|               s_start = 0;
 3790|      0|               s_end = 6;
 3791|      0|               s_inc = 2;
 3792|      0|            }
 3793|       |
 3794|      0|            for (i = 0; i < row_info->width; i++)
  ------------------
  |  Branch (3794:25): [True: 0, False: 0]
  ------------------
 3795|      0|            {
 3796|      0|               png_byte v;
 3797|      0|               int j;
 3798|       |
 3799|      0|               v = (png_byte)((*sp >> sshift) & 0x03);
 3800|      0|               for (j = 0; j < jstop; j++)
  ------------------
  |  Branch (3800:28): [True: 0, False: 0]
  ------------------
 3801|      0|               {
 3802|      0|                  unsigned int tmp = *dp & (0x3f3f >> (6 - dshift));
 3803|      0|                  tmp |= (unsigned int)(v << dshift);
 3804|      0|                  *dp = (png_byte)(tmp & 0xff);
 3805|       |
 3806|      0|                  if (dshift == s_end)
  ------------------
  |  Branch (3806:23): [True: 0, False: 0]
  ------------------
 3807|      0|                  {
 3808|      0|                     dshift = s_start;
 3809|      0|                     dp--;
 3810|      0|                  }
 3811|       |
 3812|      0|                  else
 3813|      0|                     dshift = (unsigned int)((int)dshift + s_inc);
 3814|      0|               }
 3815|       |
 3816|      0|               if (sshift == s_end)
  ------------------
  |  Branch (3816:20): [True: 0, False: 0]
  ------------------
 3817|      0|               {
 3818|      0|                  sshift = s_start;
 3819|      0|                  sp--;
 3820|      0|               }
 3821|       |
 3822|      0|               else
 3823|      0|                  sshift = (unsigned int)((int)sshift + s_inc);
 3824|      0|            }
 3825|      0|            break;
 3826|      0|         }
 3827|       |
 3828|      0|         case 4:
  ------------------
  |  Branch (3828:10): [True: 0, False: 11.4k]
  ------------------
 3829|      0|         {
 3830|      0|            png_bytep sp = row + (size_t)((row_info->width - 1) >> 1);
 3831|      0|            png_bytep dp = row + (size_t)((final_width - 1) >> 1);
 3832|      0|            unsigned int sshift, dshift;
 3833|      0|            unsigned int s_start, s_end;
 3834|      0|            int s_inc;
 3835|      0|            png_uint_32 i;
 3836|      0|            int jstop = (int)png_pass_inc[pass];
 3837|       |
 3838|      0|#ifdef PNG_READ_PACKSWAP_SUPPORTED
 3839|      0|            if ((transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  649|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3839:17): [True: 0, False: 0]
  ------------------
 3840|      0|            {
 3841|      0|               sshift = (((row_info->width + 1) & 0x01) << 2);
 3842|      0|               dshift = (((final_width + 1) & 0x01) << 2);
 3843|      0|               s_start = 4;
 3844|      0|               s_end = 0;
 3845|      0|               s_inc = -4;
 3846|      0|            }
 3847|       |
 3848|      0|            else
 3849|      0|#endif
 3850|      0|            {
 3851|      0|               sshift = ((1 - ((row_info->width + 1) & 0x01)) << 2);
 3852|      0|               dshift = ((1 - ((final_width + 1) & 0x01)) << 2);
 3853|      0|               s_start = 0;
 3854|      0|               s_end = 4;
 3855|      0|               s_inc = 4;
 3856|      0|            }
 3857|       |
 3858|      0|            for (i = 0; i < row_info->width; i++)
  ------------------
  |  Branch (3858:25): [True: 0, False: 0]
  ------------------
 3859|      0|            {
 3860|      0|               png_byte v = (png_byte)((*sp >> sshift) & 0x0f);
 3861|      0|               int j;
 3862|       |
 3863|      0|               for (j = 0; j < jstop; j++)
  ------------------
  |  Branch (3863:28): [True: 0, False: 0]
  ------------------
 3864|      0|               {
 3865|      0|                  unsigned int tmp = *dp & (0xf0f >> (4 - dshift));
 3866|      0|                  tmp |= (unsigned int)(v << dshift);
 3867|      0|                  *dp = (png_byte)(tmp & 0xff);
 3868|       |
 3869|      0|                  if (dshift == s_end)
  ------------------
  |  Branch (3869:23): [True: 0, False: 0]
  ------------------
 3870|      0|                  {
 3871|      0|                     dshift = s_start;
 3872|      0|                     dp--;
 3873|      0|                  }
 3874|       |
 3875|      0|                  else
 3876|      0|                     dshift = (unsigned int)((int)dshift + s_inc);
 3877|      0|               }
 3878|       |
 3879|      0|               if (sshift == s_end)
  ------------------
  |  Branch (3879:20): [True: 0, False: 0]
  ------------------
 3880|      0|               {
 3881|      0|                  sshift = s_start;
 3882|      0|                  sp--;
 3883|      0|               }
 3884|       |
 3885|      0|               else
 3886|      0|                  sshift = (unsigned int)((int)sshift + s_inc);
 3887|      0|            }
 3888|      0|            break;
 3889|      0|         }
 3890|       |
 3891|  11.4k|         default:
  ------------------
  |  Branch (3891:10): [True: 11.4k, False: 0]
  ------------------
 3892|  11.4k|         {
 3893|  11.4k|            size_t pixel_bytes = (row_info->pixel_depth >> 3);
 3894|       |
 3895|  11.4k|            png_bytep sp = row + (size_t)(row_info->width - 1)
 3896|  11.4k|                * pixel_bytes;
 3897|       |
 3898|  11.4k|            png_bytep dp = row + (size_t)(final_width - 1) * pixel_bytes;
 3899|       |
 3900|  11.4k|            int jstop = (int)png_pass_inc[pass];
 3901|  11.4k|            png_uint_32 i;
 3902|       |
 3903|  5.74M|            for (i = 0; i < row_info->width; i++)
  ------------------
  |  Branch (3903:25): [True: 5.73M, False: 11.4k]
  ------------------
 3904|  5.73M|            {
 3905|  5.73M|               png_byte v[8]; /* SAFE; pixel_depth does not exceed 64 */
 3906|  5.73M|               int j;
 3907|       |
 3908|  5.73M|               memcpy(v, sp, pixel_bytes);
 3909|       |
 3910|  36.9M|               for (j = 0; j < jstop; j++)
  ------------------
  |  Branch (3910:28): [True: 31.2M, False: 5.73M]
  ------------------
 3911|  31.2M|               {
 3912|  31.2M|                  memcpy(dp, v, pixel_bytes);
 3913|  31.2M|                  dp -= pixel_bytes;
 3914|  31.2M|               }
 3915|       |
 3916|  5.73M|               sp -= pixel_bytes;
 3917|  5.73M|            }
 3918|  11.4k|            break;
 3919|      0|         }
 3920|  11.4k|      }
 3921|       |
 3922|  11.4k|      row_info->width = final_width;
 3923|  11.4k|      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);
  ------------------
  |  |  730|  11.4k|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 11.4k, False: 0]
  |  |  ------------------
  |  |  731|  11.4k|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|  11.4k|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 3924|  11.4k|   }
 3925|       |#ifndef PNG_READ_PACKSWAP_SUPPORTED
 3926|       |   PNG_UNUSED(transformations)  /* Silence compiler warning */
 3927|       |#endif
 3928|  11.4k|}
OSS_FUZZ_png_read_filter_row:
 4134|  96.1k|{
 4135|       |   /* OPTIMIZATION: DO NOT MODIFY THIS FUNCTION, instead #define
 4136|       |    * PNG_FILTER_OPTIMIZATIONS to a function that overrides the generic
 4137|       |    * implementations.  See png_init_filter_functions above.
 4138|       |    */
 4139|  96.1k|   if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
  ------------------
  |  | 1476|   192k|#define PNG_FILTER_VALUE_NONE  0
  ------------------
                 if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
  ------------------
  |  | 1481|  96.1k|#define PNG_FILTER_VALUE_LAST  5
  ------------------
  |  Branch (4139:8): [True: 96.1k, False: 0]
  |  Branch (4139:42): [True: 96.1k, False: 0]
  ------------------
 4140|  96.1k|   {
 4141|  96.1k|      if (pp->read_filter[0] == NULL)
  ------------------
  |  Branch (4141:11): [True: 1.22k, False: 94.8k]
  ------------------
 4142|  1.22k|         png_init_filter_functions(pp);
 4143|       |
 4144|  96.1k|      pp->read_filter[filter-1](row_info, row, prev_row);
 4145|  96.1k|   }
 4146|  96.1k|}
OSS_FUZZ_png_read_IDAT_data:
 4152|   192k|{
 4153|       |   /* Loop reading IDATs and decompressing the result into output[avail_out] */
 4154|   192k|   png_ptr->zstream.next_out = output;
 4155|   192k|   png_ptr->zstream.avail_out = 0; /* safety: set below */
 4156|       |
 4157|   192k|   if (output == NULL)
  ------------------
  |  Branch (4157:8): [True: 705, False: 191k]
  ------------------
 4158|    705|      avail_out = 0;
 4159|       |
 4160|   192k|   do
 4161|  2.08M|   {
 4162|  2.08M|      int ret;
 4163|  2.08M|      png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
 4164|       |
 4165|  2.08M|      if (png_ptr->zstream.avail_in == 0)
  ------------------
  |  Branch (4165:11): [True: 3.17k, False: 2.07M]
  ------------------
 4166|  3.17k|      {
 4167|  3.17k|         uInt avail_in;
 4168|  3.17k|         png_bytep buffer;
 4169|       |
 4170|  5.04k|         while (png_ptr->idat_size == 0)
  ------------------
  |  Branch (4170:17): [True: 1.87k, False: 3.17k]
  ------------------
 4171|  1.87k|         {
 4172|  1.87k|            png_crc_finish(png_ptr, 0);
  ------------------
  |  |   24|  1.87k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 4173|       |
 4174|  1.87k|            png_ptr->idat_size = png_read_chunk_header(png_ptr);
  ------------------
  |  |   21|  1.87k|#define png_read_chunk_header OSS_FUZZ_png_read_chunk_header
  ------------------
 4175|       |            /* This is an error even in the 'check' case because the code just
 4176|       |             * consumed a non-IDAT header.
 4177|       |             */
 4178|  1.87k|            if (png_ptr->chunk_name != png_IDAT)
  ------------------
  |  |  839|  1.87k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|  1.87k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.87k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.87k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.87k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.87k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (4178:17): [True: 3, False: 1.87k]
  ------------------
 4179|      3|               png_error(png_ptr, "Not enough image data");
  ------------------
  |  |  238|      3|#define png_error OSS_FUZZ_png_error
  ------------------
 4180|  1.87k|         }
 4181|       |
 4182|  3.17k|         avail_in = png_ptr->IDAT_read_size;
 4183|       |
 4184|  3.17k|         if (avail_in > png_ptr->idat_size)
  ------------------
  |  Branch (4184:14): [True: 1.73k, False: 1.43k]
  ------------------
 4185|  1.73k|            avail_in = (uInt)png_ptr->idat_size;
 4186|       |
 4187|       |         /* A PNG with a gradually increasing IDAT size will defeat this attempt
 4188|       |          * to minimize memory usage by causing lots of re-allocs, but
 4189|       |          * realistically doing IDAT_read_size re-allocs is not likely to be a
 4190|       |          * big problem.
 4191|       |          */
 4192|  3.17k|         buffer = png_read_buffer(png_ptr, avail_in, 0/*error*/);
 4193|       |
 4194|  3.17k|         png_crc_read(png_ptr, buffer, avail_in);
  ------------------
  |  |   23|  3.17k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 4195|  3.17k|         png_ptr->idat_size -= avail_in;
 4196|       |
 4197|  3.17k|         png_ptr->zstream.next_in = buffer;
 4198|  3.17k|         png_ptr->zstream.avail_in = avail_in;
 4199|  3.17k|      }
 4200|       |
 4201|       |      /* And set up the output side. */
 4202|  2.08M|      if (output != NULL) /* standard read */
  ------------------
  |  Branch (4202:11): [True: 190k, False: 1.88M]
  ------------------
 4203|   190k|      {
 4204|   190k|         uInt out = ZLIB_IO_MAX;
  ------------------
  |  |   56|   190k|#  define ZLIB_IO_MAX ((uInt)-1)
  ------------------
 4205|       |
 4206|   190k|         if (out > avail_out)
  ------------------
  |  Branch (4206:14): [True: 190k, False: 0]
  ------------------
 4207|   190k|            out = (uInt)avail_out;
 4208|       |
 4209|   190k|         avail_out -= out;
 4210|   190k|         png_ptr->zstream.avail_out = out;
 4211|   190k|      }
 4212|       |
 4213|  1.88M|      else /* after last row, checking for end */
 4214|  1.88M|      {
 4215|  1.88M|         png_ptr->zstream.next_out = tmpbuf;
 4216|  1.88M|         png_ptr->zstream.avail_out = (sizeof tmpbuf);
 4217|  1.88M|      }
 4218|       |
 4219|       |      /* Use NO_FLUSH; this gives zlib the maximum opportunity to optimize the
 4220|       |       * process.  If the LZ stream is truncated the sequential reader will
 4221|       |       * terminally damage the stream, above, by reading the chunk header of the
 4222|       |       * following chunk (it then exits with png_error).
 4223|       |       *
 4224|       |       * TODO: deal more elegantly with truncated IDAT lists.
 4225|       |       */
 4226|  2.08M|      ret = PNG_INFLATE(png_ptr, Z_NO_FLUSH);
  ------------------
  |  | 1387|  2.08M|#  define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush)
  |  |  ------------------
  |  |  |  |   42|  2.08M|#define png_zlib_inflate OSS_FUZZ_png_zlib_inflate
  |  |  ------------------
  ------------------
 4227|       |
 4228|       |      /* Take the unconsumed output back. */
 4229|  2.08M|      if (output != NULL)
  ------------------
  |  Branch (4229:11): [True: 190k, False: 1.88M]
  ------------------
 4230|   190k|         avail_out += png_ptr->zstream.avail_out;
 4231|       |
 4232|  1.88M|      else /* avail_out counts the extra bytes */
 4233|  1.88M|         avail_out += (sizeof tmpbuf) - png_ptr->zstream.avail_out;
 4234|       |
 4235|  2.08M|      png_ptr->zstream.avail_out = 0;
 4236|       |
 4237|  2.08M|      if (ret == Z_STREAM_END)
  ------------------
  |  Branch (4237:11): [True: 98, False: 2.08M]
  ------------------
 4238|     98|      {
 4239|       |         /* Do this for safety; we won't read any more into this row. */
 4240|     98|         png_ptr->zstream.next_out = NULL;
 4241|       |
 4242|     98|         png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  646|     98|#define PNG_AFTER_IDAT 0x08
  ------------------
 4243|     98|         png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
  ------------------
  |  |  673|     98|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
 4244|       |
 4245|     98|         if (png_ptr->zstream.avail_in > 0 || png_ptr->idat_size > 0)
  ------------------
  |  Branch (4245:14): [True: 44, False: 54]
  |  Branch (4245:47): [True: 30, False: 24]
  ------------------
 4246|     74|            png_chunk_benign_error(png_ptr, "Extra compressed data");
  ------------------
  |  |  224|     74|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 4247|     98|         break;
 4248|     98|      }
 4249|       |
 4250|  2.08M|      if (ret != Z_OK)
  ------------------
  |  Branch (4250:11): [True: 615, False: 2.07M]
  ------------------
 4251|    615|      {
 4252|    615|         png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|    615|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
 4253|       |
 4254|    615|         if (output != NULL)
  ------------------
  |  Branch (4254:14): [True: 27, False: 588]
  ------------------
 4255|     27|            png_chunk_error(png_ptr, png_ptr->zstream.msg);
  ------------------
  |  |  225|     27|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 4256|       |
 4257|    588|         else /* checking */
 4258|    588|         {
 4259|    588|            png_chunk_benign_error(png_ptr, png_ptr->zstream.msg);
  ------------------
  |  |  224|    588|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 4260|    588|            return;
 4261|    588|         }
 4262|    615|      }
 4263|  2.08M|   } while (avail_out > 0);
  ------------------
  |  Branch (4263:13): [True: 1.88M, False: 191k]
  ------------------
 4264|       |
 4265|   191k|   if (avail_out > 0)
  ------------------
  |  Branch (4265:8): [True: 93, False: 191k]
  ------------------
 4266|     93|   {
 4267|       |      /* The stream ended before the image; this is the same as too few IDATs so
 4268|       |       * should be handled the same way.
 4269|       |       */
 4270|     93|      if (output != NULL)
  ------------------
  |  Branch (4270:11): [True: 48, False: 45]
  ------------------
 4271|     48|         png_error(png_ptr, "Not enough image data");
  ------------------
  |  |  238|     48|#define png_error OSS_FUZZ_png_error
  ------------------
 4272|       |
 4273|     45|      else /* the deflate stream contained extra data */
 4274|     45|         png_chunk_benign_error(png_ptr, "Too much image data");
  ------------------
  |  |  224|     45|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 4275|     93|   }
 4276|   191k|}
OSS_FUZZ_png_read_finish_IDAT:
 4280|  1.30k|{
 4281|       |   /* We don't need any more data and the stream should have ended, however the
 4282|       |    * LZ end code may actually not have been processed.  In this case we must
 4283|       |    * read it otherwise stray unread IDAT data or, more likely, an IDAT chunk
 4284|       |    * may still remain to be consumed.
 4285|       |    */
 4286|  1.30k|   if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
  ------------------
  |  |  673|  1.30k|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (4286:8): [True: 705, False: 598]
  ------------------
 4287|    705|   {
 4288|       |      /* The NULL causes png_read_IDAT_data to swallow any remaining bytes in
 4289|       |       * the compressed stream, but the stream may be damaged too, so even after
 4290|       |       * this call we may need to terminate the zstream ownership.
 4291|       |       */
 4292|    705|      png_read_IDAT_data(png_ptr, NULL, 0);
  ------------------
  |  |   38|    705|#define png_read_IDAT_data OSS_FUZZ_png_read_IDAT_data
  ------------------
 4293|    705|      png_ptr->zstream.next_out = NULL; /* safety */
 4294|       |
 4295|       |      /* Now clear everything out for safety; the following may not have been
 4296|       |       * done.
 4297|       |       */
 4298|    705|      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
  ------------------
  |  |  673|    705|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (4298:11): [True: 588, False: 117]
  ------------------
 4299|    588|      {
 4300|    588|         png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  646|    588|#define PNG_AFTER_IDAT 0x08
  ------------------
 4301|    588|         png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
  ------------------
  |  |  673|    588|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
 4302|    588|      }
 4303|    705|   }
 4304|       |
 4305|       |   /* If the zstream has not been released do it now *and* terminate the reading
 4306|       |    * of the final IDAT chunk.
 4307|       |    */
 4308|  1.30k|   if (png_ptr->zowner == png_IDAT)
  ------------------
  |  |  839|  1.30k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|  1.30k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.30k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.30k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.30k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.30k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (4308:8): [True: 636, False: 667]
  ------------------
 4309|    636|   {
 4310|       |      /* Always do this; the pointers otherwise point into the read buffer. */
 4311|    636|      png_ptr->zstream.next_in = NULL;
 4312|    636|      png_ptr->zstream.avail_in = 0;
 4313|       |
 4314|       |      /* Now we no longer own the zstream. */
 4315|    636|      png_ptr->zowner = 0;
 4316|       |
 4317|       |      /* The slightly weird semantics of the sequential IDAT reading is that we
 4318|       |       * are always in or at the end of an IDAT chunk, so we always need to do a
 4319|       |       * crc_finish here.  If idat_size is non-zero we also need to read the
 4320|       |       * spurious bytes at the end of the chunk now.
 4321|       |       */
 4322|    636|      (void)png_crc_finish(png_ptr, png_ptr->idat_size);
  ------------------
  |  |   24|    636|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 4323|    636|   }
 4324|  1.30k|}
OSS_FUZZ_png_read_finish_row:
 4328|   263k|{
 4329|       |   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 4330|       |
 4331|       |   /* Start of interlace block */
 4332|   263k|   static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
 4333|       |
 4334|       |   /* Offset to next interlace block */
 4335|   263k|   static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
 4336|       |
 4337|       |   /* Start of interlace block in the y direction */
 4338|   263k|   static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
 4339|       |
 4340|       |   /* Offset to next interlace block in the y direction */
 4341|   263k|   static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
 4342|       |
 4343|   263k|   png_debug(1, "in png_read_finish_row");
  ------------------
  |  |  145|   263k|#  define png_debug(l, m) ((void)0)
  ------------------
 4344|   263k|   png_ptr->row_number++;
 4345|   263k|   if (png_ptr->row_number < png_ptr->num_rows)
  ------------------
  |  Branch (4345:8): [True: 261k, False: 2.20k]
  ------------------
 4346|   261k|      return;
 4347|       |
 4348|  2.20k|   if (png_ptr->interlaced != 0)
  ------------------
  |  Branch (4348:8): [True: 1.67k, False: 535]
  ------------------
 4349|  1.67k|   {
 4350|  1.67k|      png_ptr->row_number = 0;
 4351|       |
 4352|       |      /* TO DO: don't do this if prev_row isn't needed (requires
 4353|       |       * read-ahead of the next row's filter byte.
 4354|       |       */
 4355|  1.67k|      memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
 4356|       |
 4357|  1.67k|      do
 4358|  1.67k|      {
 4359|  1.67k|         png_ptr->pass++;
 4360|       |
 4361|  1.67k|         if (png_ptr->pass >= 7)
  ------------------
  |  Branch (4361:14): [True: 173, False: 1.49k]
  ------------------
 4362|    173|            break;
 4363|       |
 4364|  1.49k|         png_ptr->iwidth = (png_ptr->width +
 4365|  1.49k|            png_pass_inc[png_ptr->pass] - 1 -
 4366|  1.49k|            png_pass_start[png_ptr->pass]) /
 4367|  1.49k|            png_pass_inc[png_ptr->pass];
 4368|       |
 4369|  1.49k|         if ((png_ptr->transformations & PNG_INTERLACE) == 0)
  ------------------
  |  |  634|  1.49k|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (4369:14): [True: 0, False: 1.49k]
  ------------------
 4370|      0|         {
 4371|      0|            png_ptr->num_rows = (png_ptr->height +
 4372|      0|                png_pass_yinc[png_ptr->pass] - 1 -
 4373|      0|                png_pass_ystart[png_ptr->pass]) /
 4374|      0|                png_pass_yinc[png_ptr->pass];
 4375|      0|         }
 4376|       |
 4377|  1.49k|         else  /* if (png_ptr->transformations & PNG_INTERLACE) */
 4378|  1.49k|            break; /* libpng deinterlacing sees every row */
 4379|       |
 4380|  1.49k|      } while (png_ptr->num_rows == 0 || png_ptr->iwidth == 0);
  ------------------
  |  Branch (4380:16): [True: 0, False: 0]
  |  Branch (4380:42): [True: 0, False: 0]
  ------------------
 4381|       |
 4382|  1.67k|      if (png_ptr->pass < 7)
  ------------------
  |  Branch (4382:11): [True: 1.49k, False: 173]
  ------------------
 4383|  1.49k|         return;
 4384|  1.67k|   }
 4385|       |
 4386|       |   /* Here after at the end of the last row of the last pass. */
 4387|    708|   png_read_finish_IDAT(png_ptr);
  ------------------
  |  |   39|    708|#define png_read_finish_IDAT OSS_FUZZ_png_read_finish_IDAT
  ------------------
 4388|    708|}
OSS_FUZZ_png_read_start_row:
 4393|  1.81k|{
 4394|       |   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
 4395|       |
 4396|       |   /* Start of interlace block */
 4397|  1.81k|   static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
 4398|       |
 4399|       |   /* Offset to next interlace block */
 4400|  1.81k|   static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
 4401|       |
 4402|       |   /* Start of interlace block in the y direction */
 4403|  1.81k|   static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
 4404|       |
 4405|       |   /* Offset to next interlace block in the y direction */
 4406|  1.81k|   static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
 4407|       |
 4408|  1.81k|   unsigned int max_pixel_depth;
 4409|  1.81k|   size_t row_bytes;
 4410|       |
 4411|  1.81k|   png_debug(1, "in png_read_start_row");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
 4412|       |
 4413|  1.81k|#ifdef PNG_READ_TRANSFORMS_SUPPORTED
 4414|  1.81k|   png_init_read_transformations(png_ptr);
  ------------------
  |  |   75|  1.81k|#define png_init_read_transformations OSS_FUZZ_png_init_read_transformations
  ------------------
 4415|  1.81k|#endif
 4416|  1.81k|   if (png_ptr->interlaced != 0)
  ------------------
  |  Branch (4416:8): [True: 842, False: 976]
  ------------------
 4417|    842|   {
 4418|    842|      if ((png_ptr->transformations & PNG_INTERLACE) == 0)
  ------------------
  |  |  634|    842|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (4418:11): [True: 0, False: 842]
  ------------------
 4419|      0|         png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
 4420|      0|             png_pass_ystart[0]) / png_pass_yinc[0];
 4421|       |
 4422|    842|      else
 4423|    842|         png_ptr->num_rows = png_ptr->height;
 4424|       |
 4425|    842|      png_ptr->iwidth = (png_ptr->width +
 4426|    842|          png_pass_inc[png_ptr->pass] - 1 -
 4427|    842|          png_pass_start[png_ptr->pass]) /
 4428|    842|          png_pass_inc[png_ptr->pass];
 4429|    842|   }
 4430|       |
 4431|    976|   else
 4432|    976|   {
 4433|    976|      png_ptr->num_rows = png_ptr->height;
 4434|    976|      png_ptr->iwidth = png_ptr->width;
 4435|    976|   }
 4436|       |
 4437|  1.81k|   max_pixel_depth = (unsigned int)png_ptr->pixel_depth;
 4438|       |
 4439|       |   /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpler set of
 4440|       |    * calculations to calculate the final pixel depth, then
 4441|       |    * png_do_read_transforms actually does the transforms.  This means that the
 4442|       |    * code which effectively calculates this value is actually repeated in three
 4443|       |    * separate places.  They must all match.  Innocent changes to the order of
 4444|       |    * transformations can and will break libpng in a way that causes memory
 4445|       |    * overwrites.
 4446|       |    *
 4447|       |    * TODO: fix this.
 4448|       |    */
 4449|  1.81k|#ifdef PNG_READ_PACK_SUPPORTED
 4450|  1.81k|   if ((png_ptr->transformations & PNG_PACK) != 0 && png_ptr->bit_depth < 8)
  ------------------
  |  |  635|  1.81k|#define PNG_PACK                0x0004U
  ------------------
  |  Branch (4450:8): [True: 1.15k, False: 662]
  |  Branch (4450:54): [True: 1.15k, False: 0]
  ------------------
 4451|  1.15k|      max_pixel_depth = 8;
 4452|  1.81k|#endif
 4453|       |
 4454|  1.81k|#ifdef PNG_READ_EXPAND_SUPPORTED
 4455|  1.81k|   if ((png_ptr->transformations & PNG_EXPAND) != 0)
  ------------------
  |  |  645|  1.81k|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (4455:8): [True: 1.81k, False: 0]
  ------------------
 4456|  1.81k|   {
 4457|  1.81k|      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  1.81k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  1.81k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  1.81k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (4457:11): [True: 173, False: 1.64k]
  ------------------
 4458|    173|      {
 4459|    173|         if (png_ptr->num_trans != 0)
  ------------------
  |  Branch (4459:14): [True: 74, False: 99]
  ------------------
 4460|     74|            max_pixel_depth = 32;
 4461|       |
 4462|     99|         else
 4463|     99|            max_pixel_depth = 24;
 4464|    173|      }
 4465|       |
 4466|  1.64k|      else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
  ------------------
  |  |  668|  1.64k|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (4466:16): [True: 1.24k, False: 404]
  ------------------
 4467|  1.24k|      {
 4468|  1.24k|         if (max_pixel_depth < 8)
  ------------------
  |  Branch (4468:14): [True: 0, False: 1.24k]
  ------------------
 4469|      0|            max_pixel_depth = 8;
 4470|       |
 4471|  1.24k|         if (png_ptr->num_trans != 0)
  ------------------
  |  Branch (4471:14): [True: 97, False: 1.14k]
  ------------------
 4472|     97|            max_pixel_depth *= 2;
 4473|  1.24k|      }
 4474|       |
 4475|    404|      else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
  ------------------
  |  |  670|    404|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|    404|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (4475:16): [True: 279, False: 125]
  ------------------
 4476|    279|      {
 4477|    279|         if (png_ptr->num_trans != 0)
  ------------------
  |  Branch (4477:14): [True: 181, False: 98]
  ------------------
 4478|    181|         {
 4479|    181|            max_pixel_depth *= 4;
 4480|    181|            max_pixel_depth /= 3;
 4481|    181|         }
 4482|    279|      }
 4483|  1.81k|   }
 4484|  1.81k|#endif
 4485|       |
 4486|  1.81k|#ifdef PNG_READ_EXPAND_16_SUPPORTED
 4487|  1.81k|   if ((png_ptr->transformations & PNG_EXPAND_16) != 0)
  ------------------
  |  |  642|  1.81k|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
  |  Branch (4487:8): [True: 0, False: 1.81k]
  ------------------
 4488|      0|   {
 4489|      0|#  ifdef PNG_READ_EXPAND_SUPPORTED
 4490|       |      /* In fact it is an error if it isn't supported, but checking is
 4491|       |       * the safe way.
 4492|       |       */
 4493|      0|      if ((png_ptr->transformations & PNG_EXPAND) != 0)
  ------------------
  |  |  645|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (4493:11): [True: 0, False: 0]
  ------------------
 4494|      0|      {
 4495|      0|         if (png_ptr->bit_depth < 16)
  ------------------
  |  Branch (4495:14): [True: 0, False: 0]
  ------------------
 4496|      0|            max_pixel_depth *= 2;
 4497|      0|      }
 4498|      0|      else
 4499|      0|#  endif
 4500|      0|      png_ptr->transformations &= ~PNG_EXPAND_16;
  ------------------
  |  |  642|      0|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
 4501|      0|   }
 4502|  1.81k|#endif
 4503|       |
 4504|  1.81k|#ifdef PNG_READ_FILLER_SUPPORTED
 4505|  1.81k|   if ((png_ptr->transformations & (PNG_FILLER)) != 0)
  ------------------
  |  |  648|  1.81k|#define PNG_FILLER              0x8000U
  ------------------
  |  Branch (4505:8): [True: 0, False: 1.81k]
  ------------------
 4506|      0|   {
 4507|      0|      if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (4507:11): [True: 0, False: 0]
  ------------------
 4508|      0|      {
 4509|      0|         if (max_pixel_depth <= 8)
  ------------------
  |  Branch (4509:14): [True: 0, False: 0]
  ------------------
 4510|      0|            max_pixel_depth = 16;
 4511|       |
 4512|      0|         else
 4513|      0|            max_pixel_depth = 32;
 4514|      0|      }
 4515|       |
 4516|      0|      else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB ||
  ------------------
  |  |  670|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (4516:16): [True: 0, False: 0]
  ------------------
 4517|      0|         png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (4517:10): [True: 0, False: 0]
  ------------------
 4518|      0|      {
 4519|      0|         if (max_pixel_depth <= 32)
  ------------------
  |  Branch (4519:14): [True: 0, False: 0]
  ------------------
 4520|      0|            max_pixel_depth = 32;
 4521|       |
 4522|      0|         else
 4523|      0|            max_pixel_depth = 64;
 4524|      0|      }
 4525|      0|   }
 4526|  1.81k|#endif
 4527|       |
 4528|  1.81k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 4529|  1.81k|   if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0)
  ------------------
  |  |  647|  1.81k|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (4529:8): [True: 1.81k, False: 0]
  ------------------
 4530|  1.81k|   {
 4531|  1.81k|      if (
 4532|  1.81k|#ifdef PNG_READ_EXPAND_SUPPORTED
 4533|  1.81k|          (png_ptr->num_trans != 0 &&
  ------------------
  |  Branch (4533:12): [True: 352, False: 1.46k]
  ------------------
 4534|  1.81k|          (png_ptr->transformations & PNG_EXPAND) != 0) ||
  ------------------
  |  |  645|    352|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (4534:11): [True: 352, False: 0]
  ------------------
 4535|  1.81k|#endif
 4536|  1.81k|#ifdef PNG_READ_FILLER_SUPPORTED
 4537|  1.81k|          (png_ptr->transformations & (PNG_FILLER)) != 0 ||
  ------------------
  |  |  648|  1.46k|#define PNG_FILLER              0x8000U
  ------------------
  |  Branch (4537:11): [True: 0, False: 1.46k]
  ------------------
 4538|  1.81k|#endif
 4539|  1.81k|          png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
  ------------------
  |  |  672|  1.46k|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|  1.46k|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4539:11): [True: 75, False: 1.39k]
  ------------------
 4540|    427|      {
 4541|    427|         if (max_pixel_depth <= 16)
  ------------------
  |  Branch (4541:14): [True: 81, False: 346]
  ------------------
 4542|     81|            max_pixel_depth = 32;
 4543|       |
 4544|    346|         else
 4545|    346|            max_pixel_depth = 64;
 4546|    427|      }
 4547|       |
 4548|  1.39k|      else
 4549|  1.39k|      {
 4550|  1.39k|         if (max_pixel_depth <= 8)
  ------------------
  |  Branch (4550:14): [True: 1.02k, False: 363]
  ------------------
 4551|  1.02k|         {
 4552|  1.02k|            if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
  ------------------
  |  |  671|  1.02k|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|  1.02k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|  1.02k|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4552:17): [True: 0, False: 1.02k]
  ------------------
 4553|      0|               max_pixel_depth = 32;
 4554|       |
 4555|  1.02k|            else
 4556|  1.02k|               max_pixel_depth = 24;
 4557|  1.02k|         }
 4558|       |
 4559|    363|         else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
  ------------------
  |  |  671|    363|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  664|    363|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  665|    363|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4559:19): [True: 50, False: 313]
  ------------------
 4560|     50|            max_pixel_depth = 64;
 4561|       |
 4562|    313|         else
 4563|    313|            max_pixel_depth = 48;
 4564|  1.39k|      }
 4565|  1.81k|   }
 4566|  1.81k|#endif
 4567|       |
 4568|  1.81k|#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
 4569|  1.81k|defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
 4570|  1.81k|   if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
  ------------------
  |  |  653|  1.81k|#define PNG_USER_TRANSFORM    0x100000U
  ------------------
  |  Branch (4570:8): [True: 0, False: 1.81k]
  ------------------
 4571|      0|   {
 4572|      0|      unsigned int user_pixel_depth = png_ptr->user_transform_depth *
 4573|      0|         png_ptr->user_transform_channels;
 4574|       |
 4575|      0|      if (user_pixel_depth > max_pixel_depth)
  ------------------
  |  Branch (4575:11): [True: 0, False: 0]
  ------------------
 4576|      0|         max_pixel_depth = user_pixel_depth;
 4577|      0|   }
 4578|  1.81k|#endif
 4579|       |
 4580|       |   /* This value is stored in png_struct and double checked in the row read
 4581|       |    * code.
 4582|       |    */
 4583|  1.81k|   png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;
 4584|  1.81k|   png_ptr->transformed_pixel_depth = 0; /* calculated on demand */
 4585|       |
 4586|       |   /* Align the width on the next larger 8 pixels.  Mainly used
 4587|       |    * for interlacing
 4588|       |    */
 4589|  1.81k|   row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));
 4590|       |   /* Calculate the maximum bytes needed, adding a byte and a pixel
 4591|       |    * for safety's sake
 4592|       |    */
 4593|  1.81k|   row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
  ------------------
  |  |  730|  1.81k|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 1.81k, False: 0]
  |  |  ------------------
  |  |  731|  1.81k|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|  1.81k|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 4594|  1.81k|       1 + ((max_pixel_depth + 7) >> 3U);
 4595|       |
 4596|       |#ifdef PNG_MAX_MALLOC_64K
 4597|       |   if (row_bytes > (png_uint_32)65536L)
 4598|       |      png_error(png_ptr, "This image requires a row greater than 64KB");
 4599|       |#endif
 4600|       |
 4601|  1.81k|   if (row_bytes + 48 > png_ptr->old_big_row_buf_size)
  ------------------
  |  Branch (4601:8): [True: 1.81k, False: 0]
  ------------------
 4602|  1.81k|   {
 4603|  1.81k|      png_free(png_ptr, png_ptr->big_row_buf);
  ------------------
  |  |  239|  1.81k|#define png_free OSS_FUZZ_png_free
  ------------------
 4604|  1.81k|      png_free(png_ptr, png_ptr->big_prev_row);
  ------------------
  |  |  239|  1.81k|#define png_free OSS_FUZZ_png_free
  ------------------
 4605|       |
 4606|  1.81k|      if (png_ptr->interlaced != 0)
  ------------------
  |  Branch (4606:11): [True: 842, False: 976]
  ------------------
 4607|    842|         png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr,
  ------------------
  |  |  223|    842|#define png_calloc OSS_FUZZ_png_calloc
  ------------------
 4608|    842|             row_bytes + 48);
 4609|       |
 4610|    976|      else
 4611|    976|         png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
  ------------------
  |  |  328|    976|#define png_malloc OSS_FUZZ_png_malloc
  ------------------
 4612|       |
 4613|  1.81k|      png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
  ------------------
  |  |  328|  1.81k|#define png_malloc OSS_FUZZ_png_malloc
  ------------------
 4614|       |
 4615|  1.81k|#ifdef PNG_ALIGNED_MEMORY_SUPPORTED
 4616|       |      /* Use 16-byte aligned memory for row_buf with at least 16 bytes
 4617|       |       * of padding before and after row_buf; treat prev_row similarly.
 4618|       |       * NOTE: the alignment is to the start of the pixels, one beyond the start
 4619|       |       * of the buffer, because of the filter byte.  Prior to libpng 1.5.6 this
 4620|       |       * was incorrect; the filter byte was aligned, which had the exact
 4621|       |       * opposite effect of that intended.
 4622|       |       */
 4623|  1.81k|      {
 4624|  1.81k|         png_bytep temp = png_ptr->big_row_buf + 32;
 4625|  1.81k|         size_t extra = (size_t)temp & 0x0f;
 4626|  1.81k|         png_ptr->row_buf = temp - extra - 1/*filter byte*/;
 4627|       |
 4628|  1.81k|         temp = png_ptr->big_prev_row + 32;
 4629|  1.81k|         extra = (size_t)temp & 0x0f;
 4630|  1.81k|         png_ptr->prev_row = temp - extra - 1/*filter byte*/;
 4631|  1.81k|      }
 4632|       |#else
 4633|       |      /* Use 31 bytes of padding before and 17 bytes after row_buf. */
 4634|       |      png_ptr->row_buf = png_ptr->big_row_buf + 31;
 4635|       |      png_ptr->prev_row = png_ptr->big_prev_row + 31;
 4636|       |#endif
 4637|  1.81k|      png_ptr->old_big_row_buf_size = row_bytes + 48;
 4638|  1.81k|   }
 4639|       |
 4640|       |#ifdef PNG_MAX_MALLOC_64K
 4641|       |   if (png_ptr->rowbytes > 65535)
 4642|       |      png_error(png_ptr, "This image requires a row greater than 64KB");
 4643|       |
 4644|       |#endif
 4645|  1.81k|   if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1))
  ------------------
  |  |  651|  1.81k|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
  |  Branch (4645:8): [True: 0, False: 1.81k]
  ------------------
 4646|      0|      png_error(png_ptr, "Row has too many bytes to allocate in memory");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4647|       |
 4648|  1.81k|   memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
 4649|       |
 4650|  1.81k|   png_debug1(3, "width = %u,", png_ptr->width);
  ------------------
  |  |  148|  1.81k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4651|  1.81k|   png_debug1(3, "height = %u,", png_ptr->height);
  ------------------
  |  |  148|  1.81k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4652|  1.81k|   png_debug1(3, "iwidth = %u,", png_ptr->iwidth);
  ------------------
  |  |  148|  1.81k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4653|  1.81k|   png_debug1(3, "num_rows = %u,", png_ptr->num_rows);
  ------------------
  |  |  148|  1.81k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4654|  1.81k|   png_debug1(3, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes);
  ------------------
  |  |  148|  1.81k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4655|  1.81k|   png_debug1(3, "irowbytes = %lu",
  ------------------
  |  |  148|  1.81k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4656|  1.81k|       (unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1);
 4657|       |
 4658|       |   /* The sequential reader needs a buffer for IDAT, but the progressive reader
 4659|       |    * does not, so free the read buffer now regardless; the sequential reader
 4660|       |    * reallocates it on demand.
 4661|       |    */
 4662|  1.81k|   if (png_ptr->read_buffer != NULL)
  ------------------
  |  Branch (4662:8): [True: 35, False: 1.78k]
  ------------------
 4663|     35|   {
 4664|     35|      png_bytep buffer = png_ptr->read_buffer;
 4665|       |
 4666|     35|      png_ptr->read_buffer_size = 0;
 4667|     35|      png_ptr->read_buffer = NULL;
 4668|     35|      png_free(png_ptr, buffer);
  ------------------
  |  |  239|     35|#define png_free OSS_FUZZ_png_free
  ------------------
 4669|     35|   }
 4670|       |
 4671|       |   /* Finally claim the zstream for the inflate of the IDAT data, use the bits
 4672|       |    * value from the stream (note that this will result in a fatal error if the
 4673|       |    * IDAT stream has a bogus deflate header window_bits value, but this should
 4674|       |    * not be happening any longer!)
 4675|       |    */
 4676|  1.81k|   if (png_inflate_claim(png_ptr, png_IDAT) != Z_OK)
  ------------------
  |  |  839|  1.81k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  814|  1.81k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.81k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.81k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.81k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  812|  1.81k|#define PNG_32b(b,s) ((png_uint_32)(b) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (4676:8): [True: 0, False: 1.81k]
  ------------------
 4677|      0|      png_error(png_ptr, png_ptr->zstream.msg);
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4678|       |
 4679|  1.81k|   png_ptr->flags |= PNG_FLAG_ROW_INIT;
  ------------------
  |  |  676|  1.81k|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
 4680|  1.81k|}
pngrutil.c:png_get_fixed_point:
   42|  28.5k|{
   43|  28.5k|   png_uint_32 uval = png_get_uint_32(buf);
  ------------------
  |  |  303|  28.5k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  438|  28.5k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2576|  28.5k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2577|  28.5k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2578|  28.5k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2579|  28.5k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
   44|       |
   45|  28.5k|   if (uval <= PNG_UINT_31_MAX)
  ------------------
  |  |  649|  28.5k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
  |  Branch (45:8): [True: 21.7k, False: 6.74k]
  ------------------
   46|  21.7k|      return (png_fixed_point)uval; /* known to be in range */
   47|       |
   48|       |   /* The caller can turn off the warning by passing NULL. */
   49|  6.74k|   if (png_ptr != NULL)
  ------------------
  |  Branch (49:8): [True: 0, False: 6.74k]
  ------------------
   50|      0|      png_warning(png_ptr, "PNG fixed point integer out of range");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
   51|       |
   52|  6.74k|   return PNG_FIXED_ERROR;
  ------------------
  |  |   38|  6.74k|#define PNG_FIXED_ERROR (-1)
  ------------------
   53|  28.5k|}
pngrutil.c:png_inflate_claim:
  342|  10.7k|{
  343|  10.7k|   if (png_ptr->zowner != 0)
  ------------------
  |  Branch (343:8): [True: 0, False: 10.7k]
  ------------------
  344|      0|   {
  345|      0|      char msg[64];
  346|       |
  347|      0|      PNG_STRING_FROM_CHUNK(msg, png_ptr->zowner);
  ------------------
  |  |  878|      0|   (void)(((char*)(s))[0]=(char)(((c)>>24) & 0xff), \
  |  |  879|      0|   ((char*)(s))[1]=(char)(((c)>>16) & 0xff),\
  |  |  880|      0|   ((char*)(s))[2]=(char)(((c)>>8) & 0xff), \
  |  |  881|      0|   ((char*)(s))[3]=(char)((c & 0xff)))
  ------------------
  348|       |      /* So the message that results is "<chunk> using zstream"; this is an
  349|       |       * internal error, but is very useful for debugging.  i18n requirements
  350|       |       * are minimal.
  351|       |       */
  352|      0|      (void)png_safecat(msg, (sizeof msg), 4, " using zstream");
  ------------------
  |  |  112|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  353|       |#if PNG_RELEASE_BUILD
  354|       |      png_chunk_warning(png_ptr, msg);
  355|       |      png_ptr->zowner = 0;
  356|       |#else
  357|      0|      png_chunk_error(png_ptr, msg);
  ------------------
  |  |  225|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  358|      0|#endif
  359|      0|   }
  360|       |
  361|       |   /* Implementation note: unlike 'png_deflate_claim' this internal function
  362|       |    * does not take the size of the data as an argument.  Some efficiency could
  363|       |    * be gained by using this when it is known *if* the zlib stream itself does
  364|       |    * not record the number; however, this is an illusion: the original writer
  365|       |    * of the PNG may have selected a lower window size, and we really must
  366|       |    * follow that because, for systems with with limited capabilities, we
  367|       |    * would otherwise reject the application's attempts to use a smaller window
  368|       |    * size (zlib doesn't have an interface to say "this or lower"!).
  369|       |    *
  370|       |    * inflateReset2 was added to zlib 1.2.4; before this the window could not be
  371|       |    * reset, therefore it is necessary to always allocate the maximum window
  372|       |    * size with earlier zlibs just in case later compressed chunks need it.
  373|       |    */
  374|  10.7k|   {
  375|  10.7k|      int ret; /* zlib return code */
  376|  10.7k|#if ZLIB_VERNUM >= 0x1240
  377|  10.7k|      int window_bits = 0;
  378|       |
  379|  10.7k|# if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW)
  380|  10.7k|      if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & 3) ==
  ------------------
  |  | 3205|  10.7k|#define PNG_MAXIMUM_INFLATE_WINDOW 2 /* SOFTWARE: force maximum window */
  ------------------
  |  Branch (380:11): [True: 0, False: 10.7k]
  ------------------
  381|  10.7k|          PNG_OPTION_ON)
  ------------------
  |  | 3220|  10.7k|#define PNG_OPTION_ON      3
  ------------------
  382|      0|      {
  383|      0|         window_bits = 15;
  384|      0|         png_ptr->zstream_start = 0; /* fixed window size */
  385|      0|      }
  386|       |
  387|  10.7k|      else
  388|  10.7k|      {
  389|  10.7k|         png_ptr->zstream_start = 1;
  390|  10.7k|      }
  391|  10.7k|# endif
  392|       |
  393|  10.7k|#endif /* ZLIB_VERNUM >= 0x1240 */
  394|       |
  395|       |      /* Set this for safety, just in case the previous owner left pointers to
  396|       |       * memory allocations.
  397|       |       */
  398|  10.7k|      png_ptr->zstream.next_in = NULL;
  399|  10.7k|      png_ptr->zstream.avail_in = 0;
  400|  10.7k|      png_ptr->zstream.next_out = NULL;
  401|  10.7k|      png_ptr->zstream.avail_out = 0;
  402|       |
  403|  10.7k|      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
  ------------------
  |  |  671|  10.7k|#define PNG_FLAG_ZSTREAM_INITIALIZED      0x0002U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (403:11): [True: 7.12k, False: 3.58k]
  ------------------
  404|  7.12k|      {
  405|  7.12k|#if ZLIB_VERNUM >= 0x1240
  406|  7.12k|         ret = inflateReset2(&png_ptr->zstream, window_bits);
  407|       |#else
  408|       |         ret = inflateReset(&png_ptr->zstream);
  409|       |#endif
  410|  7.12k|      }
  411|       |
  412|  3.58k|      else
  413|  3.58k|      {
  414|  3.58k|#if ZLIB_VERNUM >= 0x1240
  415|  3.58k|         ret = inflateInit2(&png_ptr->zstream, window_bits);
  416|       |#else
  417|       |         ret = inflateInit(&png_ptr->zstream);
  418|       |#endif
  419|       |
  420|  3.58k|         if (ret == Z_OK)
  ------------------
  |  Branch (420:14): [True: 3.58k, False: 0]
  ------------------
  421|  3.58k|            png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED;
  ------------------
  |  |  671|  3.58k|#define PNG_FLAG_ZSTREAM_INITIALIZED      0x0002U /* Added to libpng-1.6.0 */
  ------------------
  422|  3.58k|      }
  423|       |
  424|  10.7k|#if ZLIB_VERNUM >= 0x1290 && \
  425|  10.7k|   defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_IGNORE_ADLER32)
  426|  10.7k|      if (((png_ptr->options >> PNG_IGNORE_ADLER32) & 3) == PNG_OPTION_ON)
  ------------------
  |  | 3210|  10.7k|#define PNG_IGNORE_ADLER32 8
  ------------------
                    if (((png_ptr->options >> PNG_IGNORE_ADLER32) & 3) == PNG_OPTION_ON)
  ------------------
  |  | 3220|  10.7k|#define PNG_OPTION_ON      3
  ------------------
  |  Branch (426:11): [True: 10.7k, False: 0]
  ------------------
  427|       |         /* Turn off validation of the ADLER32 checksum in IDAT chunks */
  428|  10.7k|         ret = inflateValidate(&png_ptr->zstream, 0);
  429|  10.7k|#endif
  430|       |
  431|  10.7k|      if (ret == Z_OK)
  ------------------
  |  Branch (431:11): [True: 10.7k, False: 0]
  ------------------
  432|  10.7k|         png_ptr->zowner = owner;
  433|       |
  434|      0|      else
  435|      0|         png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|      0|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  436|       |
  437|  10.7k|      return ret;
  438|  10.7k|   }
  439|       |
  440|       |#ifdef window_bits
  441|       |# undef window_bits
  442|       |#endif
  443|  10.7k|}
pngrutil.c:png_inflate_read:
  776|  18.0k|{
  777|  18.0k|   if (png_ptr->zowner == png_ptr->chunk_name)
  ------------------
  |  Branch (777:8): [True: 18.0k, False: 0]
  ------------------
  778|  18.0k|   {
  779|  18.0k|      int ret;
  780|       |
  781|       |      /* next_in and avail_in must have been initialized by the caller. */
  782|  18.0k|      png_ptr->zstream.next_out = next_out;
  783|  18.0k|      png_ptr->zstream.avail_out = 0; /* set in the loop */
  784|       |
  785|  18.0k|      do
  786|  21.5k|      {
  787|  21.5k|         if (png_ptr->zstream.avail_in == 0)
  ------------------
  |  Branch (787:14): [True: 6.17k, False: 15.4k]
  ------------------
  788|  6.17k|         {
  789|  6.17k|            if (read_size > *chunk_bytes)
  ------------------
  |  Branch (789:17): [True: 5.86k, False: 305]
  ------------------
  790|  5.86k|               read_size = (uInt)*chunk_bytes;
  791|  6.17k|            *chunk_bytes -= read_size;
  792|       |
  793|  6.17k|            if (read_size > 0)
  ------------------
  |  Branch (793:17): [True: 3.49k, False: 2.67k]
  ------------------
  794|  3.49k|               png_crc_read(png_ptr, read_buffer, read_size);
  ------------------
  |  |   23|  3.49k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
  795|       |
  796|  6.17k|            png_ptr->zstream.next_in = read_buffer;
  797|  6.17k|            png_ptr->zstream.avail_in = read_size;
  798|  6.17k|         }
  799|       |
  800|  21.5k|         if (png_ptr->zstream.avail_out == 0)
  ------------------
  |  Branch (800:14): [True: 18.0k, False: 3.50k]
  ------------------
  801|  18.0k|         {
  802|  18.0k|            uInt avail = ZLIB_IO_MAX;
  ------------------
  |  |   56|  18.0k|#  define ZLIB_IO_MAX ((uInt)-1)
  ------------------
  803|  18.0k|            if (avail > *out_size)
  ------------------
  |  Branch (803:17): [True: 18.0k, False: 0]
  ------------------
  804|  18.0k|               avail = (uInt)*out_size;
  805|  18.0k|            *out_size -= avail;
  806|       |
  807|  18.0k|            png_ptr->zstream.avail_out = avail;
  808|  18.0k|         }
  809|       |
  810|       |         /* Use Z_SYNC_FLUSH when there is no more chunk data to ensure that all
  811|       |          * the available output is produced; this allows reading of truncated
  812|       |          * streams.
  813|       |          */
  814|  21.5k|         ret = PNG_INFLATE(png_ptr, *chunk_bytes > 0 ?
  ------------------
  |  | 1387|  56.9k|#  define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush)
  |  |  ------------------
  |  |  |  |   42|  21.5k|#define png_zlib_inflate OSS_FUZZ_png_zlib_inflate
  |  |  ------------------
  |  |  |  Branch (1387:55): [True: 3.13k, False: 3.75k]
  |  |  |  Branch (1387:55): [True: 14.6k, False: 6.88k]
  |  |  ------------------
  ------------------
  815|  21.5k|             Z_NO_FLUSH : (finish ? Z_FINISH : Z_SYNC_FLUSH));
  816|  21.5k|      }
  817|  21.5k|      while (ret == Z_OK && (*out_size > 0 || png_ptr->zstream.avail_out > 0));
  ------------------
  |  Branch (817:14): [True: 10.8k, False: 10.7k]
  |  Branch (817:30): [True: 0, False: 10.8k]
  |  Branch (817:47): [True: 3.48k, False: 7.37k]
  ------------------
  818|       |
  819|  18.0k|      *out_size += png_ptr->zstream.avail_out;
  820|  18.0k|      png_ptr->zstream.avail_out = 0; /* Should not be required, but is safe */
  821|       |
  822|       |      /* Ensure the error message pointer is always set: */
  823|  18.0k|      png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|  18.0k|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  824|  18.0k|      return ret;
  825|  18.0k|   }
  826|       |
  827|      0|   else
  828|      0|   {
  829|      0|      png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
  ------------------
  |  |   43|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
  830|      0|      return Z_STREAM_ERROR;
  831|      0|   }
  832|  18.0k|}
pngrutil.c:png_read_buffer:
  299|  73.0k|{
  300|  73.0k|   png_bytep buffer = png_ptr->read_buffer;
  301|       |
  302|  73.0k|   if (buffer != NULL && new_size > png_ptr->read_buffer_size)
  ------------------
  |  Branch (302:8): [True: 23.1k, False: 49.9k]
  |  Branch (302:26): [True: 5.40k, False: 17.7k]
  ------------------
  303|  5.40k|   {
  304|  5.40k|      png_ptr->read_buffer = NULL;
  305|  5.40k|      png_ptr->read_buffer_size = 0;
  306|  5.40k|      png_free(png_ptr, buffer);
  ------------------
  |  |  239|  5.40k|#define png_free OSS_FUZZ_png_free
  ------------------
  307|  5.40k|      buffer = NULL;
  308|  5.40k|   }
  309|       |
  310|  73.0k|   if (buffer == NULL)
  ------------------
  |  Branch (310:8): [True: 55.3k, False: 17.7k]
  ------------------
  311|  55.3k|   {
  312|  55.3k|      buffer = png_voidcast(png_bytep, png_malloc_base(png_ptr, new_size));
  ------------------
  |  |  500|  55.3k|#  define png_voidcast(type, value) (value)
  ------------------
  313|       |
  314|  55.3k|      if (buffer != NULL)
  ------------------
  |  Branch (314:11): [True: 14.5k, False: 40.8k]
  ------------------
  315|  14.5k|      {
  316|  14.5k|         memset(buffer, 0, new_size); /* just in case */
  317|  14.5k|         png_ptr->read_buffer = buffer;
  318|  14.5k|         png_ptr->read_buffer_size = new_size;
  319|  14.5k|      }
  320|       |
  321|  40.8k|      else if (warn < 2) /* else silent */
  ------------------
  |  Branch (321:16): [True: 40.4k, False: 430]
  ------------------
  322|  40.4k|      {
  323|  40.4k|         if (warn != 0)
  ------------------
  |  Branch (323:14): [True: 40.4k, False: 0]
  ------------------
  324|  40.4k|             png_chunk_warning(png_ptr, "insufficient memory to read chunk");
  ------------------
  |  |  226|  40.4k|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
  325|       |
  326|      0|         else
  327|      0|             png_chunk_error(png_ptr, "insufficient memory to read chunk");
  ------------------
  |  |  225|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  328|  40.4k|      }
  329|  55.3k|   }
  330|       |
  331|  73.0k|   return buffer;
  332|  73.0k|}
pngrutil.c:png_decompress_chunk:
  613|  2.29k|{
  614|       |   /* TODO: implement different limits for different types of chunk.
  615|       |    *
  616|       |    * The caller supplies *newlength set to the maximum length of the
  617|       |    * uncompressed data, but this routine allocates space for the prefix and
  618|       |    * maybe a '\0' terminator too.  We have to assume that 'prefix_size' is
  619|       |    * limited only by the maximum chunk size.
  620|       |    */
  621|  2.29k|   png_alloc_size_t limit = PNG_SIZE_MAX;
  ------------------
  |  |  651|  2.29k|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
  622|       |
  623|  2.29k|# ifdef PNG_SET_USER_LIMITS_SUPPORTED
  624|  2.29k|   if (png_ptr->user_chunk_malloc_max > 0 &&
  ------------------
  |  Branch (624:8): [True: 2.29k, False: 0]
  ------------------
  625|  2.29k|       png_ptr->user_chunk_malloc_max < limit)
  ------------------
  |  Branch (625:8): [True: 2.29k, False: 0]
  ------------------
  626|  2.29k|      limit = png_ptr->user_chunk_malloc_max;
  627|       |# elif PNG_USER_CHUNK_MALLOC_MAX > 0
  628|       |   if (PNG_USER_CHUNK_MALLOC_MAX < limit)
  629|       |      limit = PNG_USER_CHUNK_MALLOC_MAX;
  630|       |# endif
  631|       |
  632|  2.29k|   if (limit >= prefix_size + (terminate != 0))
  ------------------
  |  Branch (632:8): [True: 2.29k, False: 0]
  ------------------
  633|  2.29k|   {
  634|  2.29k|      int ret;
  635|       |
  636|  2.29k|      limit -= prefix_size + (terminate != 0);
  637|       |
  638|  2.29k|      if (limit < *newlength)
  ------------------
  |  Branch (638:11): [True: 2.29k, False: 0]
  ------------------
  639|  2.29k|         *newlength = limit;
  640|       |
  641|       |      /* Now try to claim the stream. */
  642|  2.29k|      ret = png_inflate_claim(png_ptr, png_ptr->chunk_name);
  643|       |
  644|  2.29k|      if (ret == Z_OK)
  ------------------
  |  Branch (644:11): [True: 2.29k, False: 0]
  ------------------
  645|  2.29k|      {
  646|  2.29k|         png_uint_32 lzsize = chunklength - prefix_size;
  647|       |
  648|  2.29k|         ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/,
  649|  2.29k|             /* input: */ png_ptr->read_buffer + prefix_size, &lzsize,
  650|       |             /* output: */ NULL, newlength);
  651|       |
  652|  2.29k|         if (ret == Z_STREAM_END)
  ------------------
  |  Branch (652:14): [True: 1.21k, False: 1.08k]
  ------------------
  653|  1.21k|         {
  654|       |            /* Use 'inflateReset' here, not 'inflateReset2' because this
  655|       |             * preserves the previously decided window size (otherwise it would
  656|       |             * be necessary to store the previous window size.)  In practice
  657|       |             * this doesn't matter anyway, because png_inflate will call inflate
  658|       |             * with Z_FINISH in almost all cases, so the window will not be
  659|       |             * maintained.
  660|       |             */
  661|  1.21k|            if (inflateReset(&png_ptr->zstream) == Z_OK)
  ------------------
  |  Branch (661:17): [True: 1.21k, False: 0]
  ------------------
  662|  1.21k|            {
  663|       |               /* Because of the limit checks above we know that the new,
  664|       |                * expanded, size will fit in a size_t (let alone an
  665|       |                * png_alloc_size_t).  Use png_malloc_base here to avoid an
  666|       |                * extra OOM message.
  667|       |                */
  668|  1.21k|               png_alloc_size_t new_size = *newlength;
  669|  1.21k|               png_alloc_size_t buffer_size = prefix_size + new_size +
  670|  1.21k|                   (terminate != 0);
  671|  1.21k|               png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr,
  ------------------
  |  |  500|  1.21k|#  define png_voidcast(type, value) (value)
  ------------------
  672|  1.21k|                   buffer_size));
  673|       |
  674|  1.21k|               if (text != NULL)
  ------------------
  |  Branch (674:20): [True: 1.21k, False: 0]
  ------------------
  675|  1.21k|               {
  676|  1.21k|                  memset(text, 0, buffer_size);
  677|       |
  678|  1.21k|                  ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/,
  679|  1.21k|                      png_ptr->read_buffer + prefix_size, &lzsize,
  680|  1.21k|                      text + prefix_size, newlength);
  681|       |
  682|  1.21k|                  if (ret == Z_STREAM_END)
  ------------------
  |  Branch (682:23): [True: 1.21k, False: 0]
  ------------------
  683|  1.21k|                  {
  684|  1.21k|                     if (new_size == *newlength)
  ------------------
  |  Branch (684:26): [True: 1.21k, False: 0]
  ------------------
  685|  1.21k|                     {
  686|  1.21k|                        if (terminate != 0)
  ------------------
  |  Branch (686:29): [True: 1.21k, False: 0]
  ------------------
  687|  1.21k|                           text[prefix_size + *newlength] = 0;
  688|       |
  689|  1.21k|                        if (prefix_size > 0)
  ------------------
  |  Branch (689:29): [True: 1.21k, False: 0]
  ------------------
  690|  1.21k|                           memcpy(text, png_ptr->read_buffer, prefix_size);
  691|       |
  692|  1.21k|                        {
  693|  1.21k|                           png_bytep old_ptr = png_ptr->read_buffer;
  694|       |
  695|  1.21k|                           png_ptr->read_buffer = text;
  696|  1.21k|                           png_ptr->read_buffer_size = buffer_size;
  697|  1.21k|                           text = old_ptr; /* freed below */
  698|  1.21k|                        }
  699|  1.21k|                     }
  700|       |
  701|      0|                     else
  702|      0|                     {
  703|       |                        /* The size changed on the second read, there can be no
  704|       |                         * guarantee that anything is correct at this point.
  705|       |                         * The 'msg' pointer has been set to "unexpected end of
  706|       |                         * LZ stream", which is fine, but return an error code
  707|       |                         * that the caller won't accept.
  708|       |                         */
  709|      0|                        ret = PNG_UNEXPECTED_ZLIB_RETURN;
  ------------------
  |  |  964|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  710|      0|                     }
  711|  1.21k|                  }
  712|       |
  713|      0|                  else if (ret == Z_OK)
  ------------------
  |  Branch (713:28): [True: 0, False: 0]
  ------------------
  714|      0|                     ret = PNG_UNEXPECTED_ZLIB_RETURN; /* for safety */
  ------------------
  |  |  964|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  715|       |
  716|       |                  /* Free the text pointer (this is the old read_buffer on
  717|       |                   * success)
  718|       |                   */
  719|  1.21k|                  png_free(png_ptr, text);
  ------------------
  |  |  239|  1.21k|#define png_free OSS_FUZZ_png_free
  ------------------
  720|       |
  721|       |                  /* This really is very benign, but it's still an error because
  722|       |                   * the extra space may otherwise be used as a Trojan Horse.
  723|       |                   */
  724|  1.21k|                  if (ret == Z_STREAM_END &&
  ------------------
  |  Branch (724:23): [True: 1.21k, False: 0]
  ------------------
  725|  1.21k|                      chunklength - prefix_size != lzsize)
  ------------------
  |  Branch (725:23): [True: 493, False: 718]
  ------------------
  726|    493|                     png_chunk_benign_error(png_ptr, "extra compressed data");
  ------------------
  |  |  224|    493|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
  727|  1.21k|               }
  728|       |
  729|      0|               else
  730|      0|               {
  731|       |                  /* Out of memory allocating the buffer */
  732|      0|                  ret = Z_MEM_ERROR;
  733|      0|                  png_zstream_error(png_ptr, Z_MEM_ERROR);
  ------------------
  |  |    4|      0|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  734|      0|               }
  735|  1.21k|            }
  736|       |
  737|      0|            else
  738|      0|            {
  739|       |               /* inflateReset failed, store the error message */
  740|      0|               png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|      0|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  741|      0|               ret = PNG_UNEXPECTED_ZLIB_RETURN;
  ------------------
  |  |  964|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  742|      0|            }
  743|  1.21k|         }
  744|       |
  745|  1.08k|         else if (ret == Z_OK)
  ------------------
  |  Branch (745:19): [True: 0, False: 1.08k]
  ------------------
  746|      0|            ret = PNG_UNEXPECTED_ZLIB_RETURN;
  ------------------
  |  |  964|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  747|       |
  748|       |         /* Release the claimed stream */
  749|  2.29k|         png_ptr->zowner = 0;
  750|  2.29k|      }
  751|       |
  752|      0|      else /* the claim failed */ if (ret == Z_STREAM_END) /* impossible! */
  ------------------
  |  Branch (752:39): [True: 0, False: 0]
  ------------------
  753|      0|         ret = PNG_UNEXPECTED_ZLIB_RETURN;
  ------------------
  |  |  964|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  754|       |
  755|  2.29k|      return ret;
  756|  2.29k|   }
  757|       |
  758|      0|   else
  759|      0|   {
  760|       |      /* Application/configuration limits exceeded */
  761|      0|      png_zstream_error(png_ptr, Z_MEM_ERROR);
  ------------------
  |  |    4|      0|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  762|      0|      return Z_MEM_ERROR;
  763|      0|   }
  764|  2.29k|}
pngrutil.c:png_inflate:
  487|  3.50k|{
  488|  3.50k|   if (png_ptr->zowner == owner) /* Else not claimed */
  ------------------
  |  Branch (488:8): [True: 3.50k, False: 0]
  ------------------
  489|  3.50k|   {
  490|  3.50k|      int ret;
  491|  3.50k|      png_alloc_size_t avail_out = *output_size_ptr;
  492|  3.50k|      png_uint_32 avail_in = *input_size_ptr;
  493|       |
  494|       |      /* zlib can't necessarily handle more than 65535 bytes at once (i.e. it
  495|       |       * can't even necessarily handle 65536 bytes) because the type uInt is
  496|       |       * "16 bits or more".  Consequently it is necessary to chunk the input to
  497|       |       * zlib.  This code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the
  498|       |       * maximum value that can be stored in a uInt.)  It is possible to set
  499|       |       * ZLIB_IO_MAX to a lower value in pngpriv.h and this may sometimes have
  500|       |       * a performance advantage, because it reduces the amount of data accessed
  501|       |       * at each step and that may give the OS more time to page it in.
  502|       |       */
  503|  3.50k|      png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input);
  ------------------
  |  |   44|  3.50k|#  define PNGZ_INPUT_CAST(b) (b)
  ------------------
  504|       |      /* avail_in and avail_out are set below from 'size' */
  505|  3.50k|      png_ptr->zstream.avail_in = 0;
  506|  3.50k|      png_ptr->zstream.avail_out = 0;
  507|       |
  508|       |      /* Read directly into the output if it is available (this is set to
  509|       |       * a local buffer below if output is NULL).
  510|       |       */
  511|  3.50k|      if (output != NULL)
  ------------------
  |  Branch (511:11): [True: 1.21k, False: 2.29k]
  ------------------
  512|  1.21k|         png_ptr->zstream.next_out = output;
  513|       |
  514|  3.50k|      do
  515|  95.6k|      {
  516|  95.6k|         uInt avail;
  517|  95.6k|         Byte local_buffer[PNG_INFLATE_BUF_SIZE];
  518|       |
  519|       |         /* zlib INPUT BUFFER */
  520|       |         /* The setting of 'avail_in' used to be outside the loop; by setting it
  521|       |          * inside it is possible to chunk the input to zlib and simply rely on
  522|       |          * zlib to advance the 'next_in' pointer.  This allows arbitrary
  523|       |          * amounts of data to be passed through zlib at the unavoidable cost of
  524|       |          * requiring a window save (memcpy of up to 32768 output bytes)
  525|       |          * every ZLIB_IO_MAX input bytes.
  526|       |          */
  527|  95.6k|         avail_in += png_ptr->zstream.avail_in; /* not consumed last time */
  528|       |
  529|  95.6k|         avail = ZLIB_IO_MAX;
  ------------------
  |  |   56|  95.6k|#  define ZLIB_IO_MAX ((uInt)-1)
  ------------------
  530|       |
  531|  95.6k|         if (avail_in < avail)
  ------------------
  |  Branch (531:14): [True: 95.6k, False: 0]
  ------------------
  532|  95.6k|            avail = (uInt)avail_in; /* safe: < than ZLIB_IO_MAX */
  533|       |
  534|  95.6k|         avail_in -= avail;
  535|  95.6k|         png_ptr->zstream.avail_in = avail;
  536|       |
  537|       |         /* zlib OUTPUT BUFFER */
  538|  95.6k|         avail_out += png_ptr->zstream.avail_out; /* not written last time */
  539|       |
  540|  95.6k|         avail = ZLIB_IO_MAX; /* maximum zlib can process */
  ------------------
  |  |   56|  95.6k|#  define ZLIB_IO_MAX ((uInt)-1)
  ------------------
  541|       |
  542|  95.6k|         if (output == NULL)
  ------------------
  |  Branch (542:14): [True: 94.4k, False: 1.21k]
  ------------------
  543|  94.4k|         {
  544|       |            /* Reset the output buffer each time round if output is NULL and
  545|       |             * make available the full buffer, up to 'remaining_space'
  546|       |             */
  547|  94.4k|            png_ptr->zstream.next_out = local_buffer;
  548|  94.4k|            if ((sizeof local_buffer) < avail)
  ------------------
  |  Branch (548:17): [True: 94.4k, False: 0]
  ------------------
  549|  94.4k|               avail = (sizeof local_buffer);
  550|  94.4k|         }
  551|       |
  552|  95.6k|         if (avail_out < avail)
  ------------------
  |  Branch (552:14): [True: 1.21k, False: 94.4k]
  ------------------
  553|  1.21k|            avail = (uInt)avail_out; /* safe: < ZLIB_IO_MAX */
  554|       |
  555|  95.6k|         png_ptr->zstream.avail_out = avail;
  556|  95.6k|         avail_out -= avail;
  557|       |
  558|       |         /* zlib inflate call */
  559|       |         /* In fact 'avail_out' may be 0 at this point, that happens at the end
  560|       |          * of the read when the final LZ end code was not passed at the end of
  561|       |          * the previous chunk of input data.  Tell zlib if we have reached the
  562|       |          * end of the output buffer.
  563|       |          */
  564|  95.6k|         ret = PNG_INFLATE(png_ptr, avail_out > 0 ? Z_NO_FLUSH :
  ------------------
  |  | 1387|   193k|#  define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush)
  |  |  ------------------
  |  |  |  |   42|  95.6k|#define png_zlib_inflate OSS_FUZZ_png_zlib_inflate
  |  |  ------------------
  |  |  |  Branch (1387:55): [True: 1.21k, False: 0]
  |  |  |  Branch (1387:55): [True: 94.4k, False: 1.21k]
  |  |  ------------------
  ------------------
  565|  95.6k|             (finish ? Z_FINISH : Z_SYNC_FLUSH));
  566|  95.6k|      } while (ret == Z_OK);
  ------------------
  |  Branch (566:16): [True: 92.1k, False: 3.50k]
  ------------------
  567|       |
  568|       |      /* For safety kill the local buffer pointer now */
  569|  3.50k|      if (output == NULL)
  ------------------
  |  Branch (569:11): [True: 2.29k, False: 1.21k]
  ------------------
  570|  2.29k|         png_ptr->zstream.next_out = NULL;
  571|       |
  572|       |      /* Claw back the 'size' and 'remaining_space' byte counts. */
  573|  3.50k|      avail_in += png_ptr->zstream.avail_in;
  574|  3.50k|      avail_out += png_ptr->zstream.avail_out;
  575|       |
  576|       |      /* Update the input and output sizes; the updated values are the amount
  577|       |       * consumed or written, effectively the inverse of what zlib uses.
  578|       |       */
  579|  3.50k|      if (avail_out > 0)
  ------------------
  |  Branch (579:11): [True: 2.29k, False: 1.21k]
  ------------------
  580|  2.29k|         *output_size_ptr -= avail_out;
  581|       |
  582|  3.50k|      if (avail_in > 0)
  ------------------
  |  Branch (582:11): [True: 999, False: 2.50k]
  ------------------
  583|    999|         *input_size_ptr -= avail_in;
  584|       |
  585|       |      /* Ensure png_ptr->zstream.msg is set (even in the success case!) */
  586|  3.50k|      png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|  3.50k|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  587|  3.50k|      return ret;
  588|  3.50k|   }
  589|       |
  590|      0|   else
  591|      0|   {
  592|       |      /* This is a bad internal error.  The recovery assigns to the zstream msg
  593|       |       * pointer, which is not owned by the caller, but this is safe; it's only
  594|       |       * used on errors!
  595|       |       */
  596|      0|      png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
  ------------------
  |  |   43|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
  597|      0|      return Z_STREAM_ERROR;
  598|      0|   }
  599|  3.50k|}
pngrutil.c:png_init_filter_functions:
 4105|  1.22k|{
 4106|  1.22k|   unsigned int bpp = (pp->pixel_depth + 7) >> 3;
 4107|       |
 4108|  1.22k|   pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub;
  ------------------
  |  | 1477|  1.22k|#define PNG_FILTER_VALUE_SUB   1
  ------------------
 4109|  1.22k|   pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up;
  ------------------
  |  | 1478|  1.22k|#define PNG_FILTER_VALUE_UP    2
  ------------------
 4110|  1.22k|   pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg;
  ------------------
  |  | 1479|  1.22k|#define PNG_FILTER_VALUE_AVG   3
  ------------------
 4111|  1.22k|   if (bpp == 1)
  ------------------
  |  Branch (4111:8): [True: 980, False: 241]
  ------------------
 4112|    980|      pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
  ------------------
  |  | 1480|    980|#define PNG_FILTER_VALUE_PAETH 4
  ------------------
 4113|    980|         png_read_filter_row_paeth_1byte_pixel;
 4114|    241|   else
 4115|    241|      pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
  ------------------
  |  | 1480|    241|#define PNG_FILTER_VALUE_PAETH 4
  ------------------
 4116|    241|         png_read_filter_row_paeth_multibyte_pixel;
 4117|       |
 4118|       |#ifdef PNG_FILTER_OPTIMIZATIONS
 4119|       |   /* To use this define PNG_FILTER_OPTIMIZATIONS as the name of a function to
 4120|       |    * call to install hardware optimizations for the above functions; simply
 4121|       |    * replace whatever elements of the pp->read_filter[] array with a hardware
 4122|       |    * specific (or, for that matter, generic) optimization.
 4123|       |    *
 4124|       |    * To see an example of this examine what configure.ac does when
 4125|       |    * --enable-arm-neon is specified on the command line.
 4126|       |    */
 4127|       |   PNG_FILTER_OPTIMIZATIONS(pp, bpp);
 4128|       |#endif
 4129|  1.22k|}
pngrutil.c:png_read_filter_row_sub:
 3934|  33.1k|{
 3935|  33.1k|   size_t i;
 3936|  33.1k|   size_t istop = row_info->rowbytes;
 3937|  33.1k|   unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
 3938|  33.1k|   png_bytep rp = row + bpp;
 3939|       |
 3940|  33.1k|   PNG_UNUSED(prev_row)
  ------------------
  |  |  444|  33.1k|#  define PNG_UNUSED(param) (void)param;
  ------------------
 3941|       |
 3942|  14.5M|   for (i = bpp; i < istop; i++)
  ------------------
  |  Branch (3942:18): [True: 14.4M, False: 33.1k]
  ------------------
 3943|  14.4M|   {
 3944|  14.4M|      *rp = (png_byte)(((int)(*rp) + (int)(*(rp-bpp))) & 0xff);
 3945|  14.4M|      rp++;
 3946|  14.4M|   }
 3947|  33.1k|}
pngrutil.c:png_read_filter_row_up:
 3952|  47.8k|{
 3953|  47.8k|   size_t i;
 3954|  47.8k|   size_t istop = row_info->rowbytes;
 3955|  47.8k|   png_bytep rp = row;
 3956|  47.8k|   png_const_bytep pp = prev_row;
 3957|       |
 3958|  15.6M|   for (i = 0; i < istop; i++)
  ------------------
  |  Branch (3958:16): [True: 15.5M, False: 47.8k]
  ------------------
 3959|  15.5M|   {
 3960|  15.5M|      *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff);
 3961|  15.5M|      rp++;
 3962|  15.5M|   }
 3963|  47.8k|}
pngrutil.c:png_read_filter_row_avg:
 3968|  8.35k|{
 3969|  8.35k|   size_t i;
 3970|  8.35k|   png_bytep rp = row;
 3971|  8.35k|   png_const_bytep pp = prev_row;
 3972|  8.35k|   unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
 3973|  8.35k|   size_t istop = row_info->rowbytes - bpp;
 3974|       |
 3975|  18.0k|   for (i = 0; i < bpp; i++)
  ------------------
  |  Branch (3975:16): [True: 9.66k, False: 8.35k]
  ------------------
 3976|  9.66k|   {
 3977|  9.66k|      *rp = (png_byte)(((int)(*rp) +
 3978|  9.66k|         ((int)(*pp++) / 2 )) & 0xff);
 3979|       |
 3980|  9.66k|      rp++;
 3981|  9.66k|   }
 3982|       |
 3983|  1.28M|   for (i = 0; i < istop; i++)
  ------------------
  |  Branch (3983:16): [True: 1.28M, False: 8.35k]
  ------------------
 3984|  1.28M|   {
 3985|  1.28M|      *rp = (png_byte)(((int)(*rp) +
 3986|  1.28M|         (int)(*pp++ + *(rp-bpp)) / 2 ) & 0xff);
 3987|       |
 3988|  1.28M|      rp++;
 3989|  1.28M|   }
 3990|  8.35k|}
pngrutil.c:png_read_filter_row_paeth_1byte_pixel:
 3995|  5.14k|{
 3996|  5.14k|   png_bytep rp_end = row + row_info->rowbytes;
 3997|  5.14k|   int a, c;
 3998|       |
 3999|       |   /* First pixel/byte */
 4000|  5.14k|   c = *prev_row++;
 4001|  5.14k|   a = *row + c;
 4002|  5.14k|   *row++ = (png_byte)a;
 4003|       |
 4004|       |   /* Remainder */
 4005|   502k|   while (row < rp_end)
  ------------------
  |  Branch (4005:11): [True: 497k, False: 5.14k]
  ------------------
 4006|   497k|   {
 4007|   497k|      int b, pa, pb, pc, p;
 4008|       |
 4009|   497k|      a &= 0xff; /* From previous iteration or start */
 4010|   497k|      b = *prev_row++;
 4011|       |
 4012|   497k|      p = b - c;
 4013|   497k|      pc = a - c;
 4014|       |
 4015|       |#ifdef PNG_USE_ABS
 4016|       |      pa = abs(p);
 4017|       |      pb = abs(pc);
 4018|       |      pc = abs(p + pc);
 4019|       |#else
 4020|   497k|      pa = p < 0 ? -p : p;
  ------------------
  |  Branch (4020:12): [True: 67.3k, False: 430k]
  ------------------
 4021|   497k|      pb = pc < 0 ? -pc : pc;
  ------------------
  |  Branch (4021:12): [True: 8.70k, False: 488k]
  ------------------
 4022|   497k|      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
  ------------------
  |  Branch (4022:12): [True: 39.5k, False: 457k]
  ------------------
 4023|   497k|#endif
 4024|       |
 4025|       |      /* Find the best predictor, the least of pa, pb, pc favoring the earlier
 4026|       |       * ones in the case of a tie.
 4027|       |       */
 4028|   497k|      if (pb < pa)
  ------------------
  |  Branch (4028:11): [True: 79.9k, False: 417k]
  ------------------
 4029|  79.9k|      {
 4030|  79.9k|         pa = pb; a = b;
 4031|  79.9k|      }
 4032|   497k|      if (pc < pa) a = c;
  ------------------
  |  Branch (4032:11): [True: 9.98k, False: 487k]
  ------------------
 4033|       |
 4034|       |      /* Calculate the current pixel in a, and move the previous row pixel to c
 4035|       |       * for the next time round the loop
 4036|       |       */
 4037|   497k|      c = b;
 4038|   497k|      a += *row;
 4039|   497k|      *row++ = (png_byte)a;
 4040|   497k|   }
 4041|  5.14k|}
pngrutil.c:png_read_filter_row_paeth_multibyte_pixel:
 4046|  1.62k|{
 4047|  1.62k|   unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
 4048|  1.62k|   png_bytep rp_end = row + bpp;
 4049|       |
 4050|       |   /* Process the first pixel in the row completely (this is the same as 'up'
 4051|       |    * because there is only one candidate predictor for the first row).
 4052|       |    */
 4053|  6.18k|   while (row < rp_end)
  ------------------
  |  Branch (4053:11): [True: 4.55k, False: 1.62k]
  ------------------
 4054|  4.55k|   {
 4055|  4.55k|      int a = *row + *prev_row++;
 4056|  4.55k|      *row++ = (png_byte)a;
 4057|  4.55k|   }
 4058|       |
 4059|       |   /* Remainder */
 4060|  1.62k|   rp_end = rp_end + (row_info->rowbytes - bpp);
 4061|       |
 4062|  2.47M|   while (row < rp_end)
  ------------------
  |  Branch (4062:11): [True: 2.46M, False: 1.62k]
  ------------------
 4063|  2.46M|   {
 4064|  2.46M|      int a, b, c, pa, pb, pc, p;
 4065|       |
 4066|  2.46M|      c = *(prev_row - bpp);
 4067|  2.46M|      a = *(row - bpp);
 4068|  2.46M|      b = *prev_row++;
 4069|       |
 4070|  2.46M|      p = b - c;
 4071|  2.46M|      pc = a - c;
 4072|       |
 4073|       |#ifdef PNG_USE_ABS
 4074|       |      pa = abs(p);
 4075|       |      pb = abs(pc);
 4076|       |      pc = abs(p + pc);
 4077|       |#else
 4078|  2.46M|      pa = p < 0 ? -p : p;
  ------------------
  |  Branch (4078:12): [True: 360k, False: 2.10M]
  ------------------
 4079|  2.46M|      pb = pc < 0 ? -pc : pc;
  ------------------
  |  Branch (4079:12): [True: 141k, False: 2.32M]
  ------------------
 4080|  2.46M|      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
  ------------------
  |  Branch (4080:12): [True: 218k, False: 2.25M]
  ------------------
 4081|  2.46M|#endif
 4082|       |
 4083|  2.46M|      if (pb < pa)
  ------------------
  |  Branch (4083:11): [True: 266k, False: 2.20M]
  ------------------
 4084|   266k|      {
 4085|   266k|         pa = pb; a = b;
 4086|   266k|      }
 4087|  2.46M|      if (pc < pa) a = c;
  ------------------
  |  Branch (4087:11): [True: 38.3k, False: 2.43M]
  ------------------
 4088|       |
 4089|  2.46M|      a += *row;
 4090|  2.46M|      *row++ = (png_byte)a;
 4091|  2.46M|   }
 4092|  1.62k|}

OSS_FUZZ_png_set_bKGD:
   27|     19|{
   28|     19|   png_debug1(1, "in %s storage function", "bKGD");
  ------------------
  |  |  148|     19|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
   29|       |
   30|     19|   if (png_ptr == NULL || info_ptr == NULL || background == NULL)
  ------------------
  |  Branch (30:8): [True: 0, False: 19]
  |  Branch (30:27): [True: 0, False: 19]
  |  Branch (30:47): [True: 0, False: 19]
  ------------------
   31|      0|      return;
   32|       |
   33|     19|   info_ptr->background = *background;
   34|     19|   info_ptr->valid |= PNG_INFO_bKGD;
  ------------------
  |  |  737|     19|#define PNG_INFO_bKGD 0x0020U
  ------------------
   35|     19|}
OSS_FUZZ_png_set_eXIf_1:
  150|     44|{
  151|     44|   int i;
  152|       |
  153|     44|   png_debug1(1, "in %s storage function", "eXIf");
  ------------------
  |  |  148|     44|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  154|       |
  155|     44|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (155:8): [True: 0, False: 44]
  |  Branch (155:27): [True: 0, False: 44]
  ------------------
  156|      0|      return;
  157|       |
  158|     44|   if (info_ptr->exif)
  ------------------
  |  Branch (158:8): [True: 0, False: 44]
  ------------------
  159|      0|   {
  160|      0|      png_free(png_ptr, info_ptr->exif);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  161|      0|      info_ptr->exif = NULL;
  162|      0|   }
  163|       |
  164|     44|   info_ptr->num_exif = num_exif;
  165|       |
  166|     44|   info_ptr->exif = png_voidcast(png_bytep, png_malloc_warn(png_ptr,
  ------------------
  |  |  500|     44|#  define png_voidcast(type, value) (value)
  ------------------
  167|     44|       info_ptr->num_exif));
  168|       |
  169|     44|   if (info_ptr->exif == NULL)
  ------------------
  |  Branch (169:8): [True: 0, False: 44]
  ------------------
  170|      0|   {
  171|      0|      png_warning(png_ptr, "Insufficient memory for eXIf chunk data");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  172|      0|      return;
  173|      0|   }
  174|       |
  175|     44|   info_ptr->free_me |= PNG_FREE_EXIF;
  ------------------
  |  | 1761|     44|#define PNG_FREE_EXIF 0x8000U /* Added at libpng-1.6.31 */
  ------------------
  176|       |
  177|   789k|   for (i = 0; i < (int) info_ptr->num_exif; i++)
  ------------------
  |  Branch (177:16): [True: 789k, False: 44]
  ------------------
  178|   789k|      info_ptr->exif[i] = eXIf_buf[i];
  179|       |
  180|     44|   info_ptr->valid |= PNG_INFO_eXIf;
  ------------------
  |  |  748|     44|#define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */
  ------------------
  181|     44|}
OSS_FUZZ_png_set_hIST:
  212|    377|{
  213|    377|   int i;
  214|       |
  215|    377|   png_debug1(1, "in %s storage function", "hIST");
  ------------------
  |  |  148|    377|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  216|       |
  217|    377|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (217:8): [True: 0, False: 377]
  |  Branch (217:27): [True: 0, False: 377]
  ------------------
  218|      0|      return;
  219|       |
  220|    377|   if (info_ptr->num_palette == 0 || info_ptr->num_palette
  ------------------
  |  Branch (220:8): [True: 349, False: 28]
  |  Branch (220:38): [True: 0, False: 28]
  ------------------
  221|     28|       > PNG_MAX_PALETTE_LENGTH)
  ------------------
  |  |  725|     28|#define PNG_MAX_PALETTE_LENGTH    256
  ------------------
  222|    349|   {
  223|    349|      png_warning(png_ptr,
  ------------------
  |  |  426|    349|#define png_warning OSS_FUZZ_png_warning
  ------------------
  224|    349|          "Invalid palette size, hIST allocation skipped");
  225|       |
  226|    349|      return;
  227|    349|   }
  228|       |
  229|     28|   png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
  ------------------
  |  |  240|     28|#define png_free_data OSS_FUZZ_png_free_data
  ------------------
                 png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
  ------------------
  |  | 1748|     28|#define PNG_FREE_HIST 0x0008U
  ------------------
  230|       |
  231|       |   /* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in
  232|       |    * version 1.2.1
  233|       |    */
  234|     28|   info_ptr->hist = png_voidcast(png_uint_16p, png_malloc_warn(png_ptr,
  ------------------
  |  |  500|     28|#  define png_voidcast(type, value) (value)
  ------------------
  235|     28|       PNG_MAX_PALETTE_LENGTH * (sizeof (png_uint_16))));
  236|       |
  237|     28|   if (info_ptr->hist == NULL)
  ------------------
  |  Branch (237:8): [True: 0, False: 28]
  ------------------
  238|      0|   {
  239|      0|      png_warning(png_ptr, "Insufficient memory for hIST chunk data");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  240|       |
  241|      0|      return;
  242|      0|   }
  243|       |
  244|     28|   info_ptr->free_me |= PNG_FREE_HIST;
  ------------------
  |  | 1748|     28|#define PNG_FREE_HIST 0x0008U
  ------------------
  245|       |
  246|    376|   for (i = 0; i < info_ptr->num_palette; i++)
  ------------------
  |  Branch (246:16): [True: 348, False: 28]
  ------------------
  247|    348|      info_ptr->hist[i] = hist[i];
  248|       |
  249|     28|   info_ptr->valid |= PNG_INFO_hIST;
  ------------------
  |  |  738|     28|#define PNG_INFO_hIST 0x0040U
  ------------------
  250|     28|}
OSS_FUZZ_png_set_IHDR:
  258|  7.84k|{
  259|  7.84k|   png_debug1(1, "in %s storage function", "IHDR");
  ------------------
  |  |  148|  7.84k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  260|       |
  261|  7.84k|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (261:8): [True: 0, False: 7.84k]
  |  Branch (261:27): [True: 0, False: 7.84k]
  ------------------
  262|      0|      return;
  263|       |
  264|  7.84k|   info_ptr->width = width;
  265|  7.84k|   info_ptr->height = height;
  266|  7.84k|   info_ptr->bit_depth = (png_byte)bit_depth;
  267|  7.84k|   info_ptr->color_type = (png_byte)color_type;
  268|  7.84k|   info_ptr->compression_type = (png_byte)compression_type;
  269|  7.84k|   info_ptr->filter_type = (png_byte)filter_type;
  270|  7.84k|   info_ptr->interlace_type = (png_byte)interlace_type;
  271|       |
  272|  7.84k|   png_check_IHDR (png_ptr, info_ptr->width, info_ptr->height,
  ------------------
  |  |  109|  7.84k|#define png_check_IHDR OSS_FUZZ_png_check_IHDR
  ------------------
  273|  7.84k|       info_ptr->bit_depth, info_ptr->color_type, info_ptr->interlace_type,
  274|  7.84k|       info_ptr->compression_type, info_ptr->filter_type);
  275|       |
  276|  7.84k|   if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|  7.84k|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|  7.84k|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|  7.84k|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (276:8): [True: 2.91k, False: 4.93k]
  ------------------
  277|  2.91k|      info_ptr->channels = 1;
  278|       |
  279|  4.93k|   else if ((info_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
  ------------------
  |  |  664|  4.93k|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (279:13): [True: 1.32k, False: 3.61k]
  ------------------
  280|  1.32k|      info_ptr->channels = 3;
  281|       |
  282|  3.61k|   else
  283|  3.61k|      info_ptr->channels = 1;
  284|       |
  285|  7.84k|   if ((info_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)
  ------------------
  |  |  665|  7.84k|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
  |  Branch (285:8): [True: 564, False: 7.28k]
  ------------------
  286|    564|      info_ptr->channels++;
  287|       |
  288|  7.84k|   info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
  289|       |
  290|  7.84k|   info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
  ------------------
  |  |  730|  7.84k|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (730:6): [True: 2.66k, False: 5.18k]
  |  |  ------------------
  |  |  731|  7.84k|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  732|  7.84k|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
  291|  7.84k|}
OSS_FUZZ_png_set_oFFs:
  297|     11|{
  298|     11|   png_debug1(1, "in %s storage function", "oFFs");
  ------------------
  |  |  148|     11|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  299|       |
  300|     11|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (300:8): [True: 0, False: 11]
  |  Branch (300:27): [True: 0, False: 11]
  ------------------
  301|      0|      return;
  302|       |
  303|     11|   info_ptr->x_offset = offset_x;
  304|     11|   info_ptr->y_offset = offset_y;
  305|     11|   info_ptr->offset_unit_type = (png_byte)unit_type;
  306|     11|   info_ptr->valid |= PNG_INFO_oFFs;
  ------------------
  |  |  740|     11|#define PNG_INFO_oFFs 0x0100U
  ------------------
  307|     11|}
OSS_FUZZ_png_set_pCAL:
  315|  1.11k|{
  316|  1.11k|   size_t length;
  317|  1.11k|   int i;
  318|       |
  319|  1.11k|   png_debug1(1, "in %s storage function", "pCAL");
  ------------------
  |  |  148|  1.11k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  320|       |
  321|  1.11k|   if (png_ptr == NULL || info_ptr == NULL || purpose == NULL || units == NULL
  ------------------
  |  Branch (321:8): [True: 0, False: 1.11k]
  |  Branch (321:27): [True: 0, False: 1.11k]
  |  Branch (321:47): [True: 0, False: 1.11k]
  |  Branch (321:66): [True: 0, False: 1.11k]
  ------------------
  322|  1.11k|       || (nparams > 0 && params == NULL))
  ------------------
  |  Branch (322:12): [True: 1.11k, False: 0]
  |  Branch (322:27): [True: 0, False: 1.11k]
  ------------------
  323|      0|      return;
  324|       |
  325|  1.11k|   length = strlen(purpose) + 1;
  326|  1.11k|   png_debug1(3, "allocating purpose for info (%lu bytes)",
  ------------------
  |  |  148|  1.11k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  327|  1.11k|       (unsigned long)length);
  328|       |
  329|       |   /* TODO: validate format of calibration name and unit name */
  330|       |
  331|       |   /* Check that the type matches the specification. */
  332|  1.11k|   if (type < 0 || type > 3)
  ------------------
  |  Branch (332:8): [True: 0, False: 1.11k]
  |  Branch (332:20): [True: 318, False: 798]
  ------------------
  333|    318|   {
  334|    318|      png_chunk_report(png_ptr, "Invalid pCAL equation type",
  ------------------
  |  |  120|    318|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
  335|    318|            PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|    318|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
  336|    318|      return;
  337|    318|   }
  338|       |
  339|    798|   if (nparams < 0 || nparams > 255)
  ------------------
  |  Branch (339:8): [True: 0, False: 798]
  |  Branch (339:23): [True: 0, False: 798]
  ------------------
  340|      0|   {
  341|      0|      png_chunk_report(png_ptr, "Invalid pCAL parameter count",
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
  342|      0|            PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
  343|      0|      return;
  344|      0|   }
  345|       |
  346|       |   /* Validate params[nparams] */
  347|  1.53k|   for (i=0; i<nparams; ++i)
  ------------------
  |  Branch (347:14): [True: 1.52k, False: 11]
  ------------------
  348|  1.52k|   {
  349|  1.52k|      if (params[i] == NULL ||
  ------------------
  |  Branch (349:11): [True: 0, False: 1.52k]
  ------------------
  350|  1.52k|          !png_check_fp_string(params[i], strlen(params[i])))
  ------------------
  |  |  124|  1.52k|#define png_check_fp_string OSS_FUZZ_png_check_fp_string
  ------------------
  |  Branch (350:11): [True: 787, False: 736]
  ------------------
  351|    787|      {
  352|    787|         png_chunk_report(png_ptr, "Invalid format for pCAL parameter",
  ------------------
  |  |  120|    787|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
  353|    787|               PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|    787|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
  354|    787|         return;
  355|    787|      }
  356|  1.52k|   }
  357|       |
  358|     11|   info_ptr->pcal_purpose = png_voidcast(png_charp,
  ------------------
  |  |  500|     11|#  define png_voidcast(type, value) (value)
  ------------------
  359|     11|       png_malloc_warn(png_ptr, length));
  360|       |
  361|     11|   if (info_ptr->pcal_purpose == NULL)
  ------------------
  |  Branch (361:8): [True: 0, False: 11]
  ------------------
  362|      0|   {
  363|      0|      png_chunk_report(png_ptr, "Insufficient memory for pCAL purpose",
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
  364|      0|            PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
  365|      0|      return;
  366|      0|   }
  367|       |
  368|     11|   memcpy(info_ptr->pcal_purpose, purpose, length);
  369|       |
  370|     11|   png_debug(3, "storing X0, X1, type, and nparams in info");
  ------------------
  |  |  145|     11|#  define png_debug(l, m) ((void)0)
  ------------------
  371|     11|   info_ptr->pcal_X0 = X0;
  372|     11|   info_ptr->pcal_X1 = X1;
  373|     11|   info_ptr->pcal_type = (png_byte)type;
  374|     11|   info_ptr->pcal_nparams = (png_byte)nparams;
  375|       |
  376|     11|   length = strlen(units) + 1;
  377|     11|   png_debug1(3, "allocating units for info (%lu bytes)",
  ------------------
  |  |  148|     11|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  378|     11|       (unsigned long)length);
  379|       |
  380|     11|   info_ptr->pcal_units = png_voidcast(png_charp,
  ------------------
  |  |  500|     11|#  define png_voidcast(type, value) (value)
  ------------------
  381|     11|       png_malloc_warn(png_ptr, length));
  382|       |
  383|     11|   if (info_ptr->pcal_units == NULL)
  ------------------
  |  Branch (383:8): [True: 0, False: 11]
  ------------------
  384|      0|   {
  385|      0|      png_warning(png_ptr, "Insufficient memory for pCAL units");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  386|       |
  387|      0|      return;
  388|      0|   }
  389|       |
  390|     11|   memcpy(info_ptr->pcal_units, units, length);
  391|       |
  392|     11|   info_ptr->pcal_params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
  ------------------
  |  |  500|     11|#  define png_voidcast(type, value) (value)
  ------------------
  393|     11|       (size_t)(((unsigned int)nparams + 1) * (sizeof (png_charp)))));
  394|       |
  395|     11|   if (info_ptr->pcal_params == NULL)
  ------------------
  |  Branch (395:8): [True: 0, False: 11]
  ------------------
  396|      0|   {
  397|      0|      png_warning(png_ptr, "Insufficient memory for pCAL params");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  398|       |
  399|      0|      return;
  400|      0|   }
  401|       |
  402|     11|   memset(info_ptr->pcal_params, 0, ((unsigned int)nparams + 1) *
  403|     11|       (sizeof (png_charp)));
  404|       |
  405|     36|   for (i = 0; i < nparams; i++)
  ------------------
  |  Branch (405:16): [True: 25, False: 11]
  ------------------
  406|     25|   {
  407|     25|      length = strlen(params[i]) + 1;
  408|     25|      png_debug2(3, "allocating parameter %d for info (%lu bytes)", i,
  ------------------
  |  |  151|     25|#  define png_debug2(l, m, p1, p2) ((void)0)
  ------------------
  409|     25|          (unsigned long)length);
  410|       |
  411|     25|      info_ptr->pcal_params[i] = (png_charp)png_malloc_warn(png_ptr, length);
  ------------------
  |  |  330|     25|#define png_malloc_warn OSS_FUZZ_png_malloc_warn
  ------------------
  412|       |
  413|     25|      if (info_ptr->pcal_params[i] == NULL)
  ------------------
  |  Branch (413:11): [True: 0, False: 25]
  ------------------
  414|      0|      {
  415|      0|         png_warning(png_ptr, "Insufficient memory for pCAL parameter");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  416|       |
  417|      0|         return;
  418|      0|      }
  419|       |
  420|     25|      memcpy(info_ptr->pcal_params[i], params[i], length);
  421|     25|   }
  422|       |
  423|     11|   info_ptr->valid |= PNG_INFO_pCAL;
  ------------------
  |  |  742|     11|#define PNG_INFO_pCAL 0x0400U
  ------------------
  424|     11|   info_ptr->free_me |= PNG_FREE_PCAL;
  ------------------
  |  | 1752|     11|#define PNG_FREE_PCAL 0x0080U
  ------------------
  425|     11|}
OSS_FUZZ_png_set_sCAL_s:
  432|    145|{
  433|    145|   size_t lengthw = 0, lengthh = 0;
  434|       |
  435|    145|   png_debug1(1, "in %s storage function", "sCAL");
  ------------------
  |  |  148|    145|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  436|       |
  437|    145|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (437:8): [True: 0, False: 145]
  |  Branch (437:27): [True: 0, False: 145]
  ------------------
  438|      0|      return;
  439|       |
  440|       |   /* Double check the unit (should never get here with an invalid
  441|       |    * unit unless this is an API call.)
  442|       |    */
  443|    145|   if (unit != 1 && unit != 2)
  ------------------
  |  Branch (443:8): [True: 76, False: 69]
  |  Branch (443:21): [True: 0, False: 76]
  ------------------
  444|      0|      png_error(png_ptr, "Invalid sCAL unit");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  445|       |
  446|    145|   if (swidth == NULL || (lengthw = strlen(swidth)) == 0 ||
  ------------------
  |  Branch (446:8): [True: 0, False: 145]
  |  Branch (446:26): [True: 0, False: 145]
  ------------------
  447|    145|       swidth[0] == 45 /* '-' */ || !png_check_fp_string(swidth, lengthw))
  ------------------
  |  |  124|    145|#define png_check_fp_string OSS_FUZZ_png_check_fp_string
  ------------------
  |  Branch (447:8): [True: 0, False: 145]
  |  Branch (447:37): [True: 0, False: 145]
  ------------------
  448|      0|      png_error(png_ptr, "Invalid sCAL width");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  449|       |
  450|    145|   if (sheight == NULL || (lengthh = strlen(sheight)) == 0 ||
  ------------------
  |  Branch (450:8): [True: 0, False: 145]
  |  Branch (450:27): [True: 0, False: 145]
  ------------------
  451|    145|       sheight[0] == 45 /* '-' */ || !png_check_fp_string(sheight, lengthh))
  ------------------
  |  |  124|    145|#define png_check_fp_string OSS_FUZZ_png_check_fp_string
  ------------------
  |  Branch (451:8): [True: 0, False: 145]
  |  Branch (451:38): [True: 0, False: 145]
  ------------------
  452|      0|      png_error(png_ptr, "Invalid sCAL height");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  453|       |
  454|    145|   info_ptr->scal_unit = (png_byte)unit;
  455|       |
  456|    145|   ++lengthw;
  457|       |
  458|    145|   png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthw);
  ------------------
  |  |  148|    145|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  459|       |
  460|    145|   info_ptr->scal_s_width = png_voidcast(png_charp,
  ------------------
  |  |  500|    145|#  define png_voidcast(type, value) (value)
  ------------------
  461|    145|       png_malloc_warn(png_ptr, lengthw));
  462|       |
  463|    145|   if (info_ptr->scal_s_width == NULL)
  ------------------
  |  Branch (463:8): [True: 0, False: 145]
  ------------------
  464|      0|   {
  465|      0|      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  466|       |
  467|      0|      return;
  468|      0|   }
  469|       |
  470|    145|   memcpy(info_ptr->scal_s_width, swidth, lengthw);
  471|       |
  472|    145|   ++lengthh;
  473|       |
  474|    145|   png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthh);
  ------------------
  |  |  148|    145|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  475|       |
  476|    145|   info_ptr->scal_s_height = png_voidcast(png_charp,
  ------------------
  |  |  500|    145|#  define png_voidcast(type, value) (value)
  ------------------
  477|    145|       png_malloc_warn(png_ptr, lengthh));
  478|       |
  479|    145|   if (info_ptr->scal_s_height == NULL)
  ------------------
  |  Branch (479:8): [True: 0, False: 145]
  ------------------
  480|      0|   {
  481|      0|      png_free (png_ptr, info_ptr->scal_s_width);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  482|      0|      info_ptr->scal_s_width = NULL;
  483|       |
  484|      0|      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  485|       |
  486|      0|      return;
  487|      0|   }
  488|       |
  489|    145|   memcpy(info_ptr->scal_s_height, sheight, lengthh);
  490|       |
  491|    145|   info_ptr->valid |= PNG_INFO_sCAL;
  ------------------
  |  |  746|    145|#define PNG_INFO_sCAL 0x4000U  /* ESR, 1.0.6 */
  ------------------
  492|    145|   info_ptr->free_me |= PNG_FREE_SCAL;
  ------------------
  |  | 1753|    145|#define PNG_FREE_SCAL 0x0100U
  ------------------
  493|    145|}
OSS_FUZZ_png_set_pHYs:
  558|      9|{
  559|      9|   png_debug1(1, "in %s storage function", "pHYs");
  ------------------
  |  |  148|      9|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  560|       |
  561|      9|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (561:8): [True: 0, False: 9]
  |  Branch (561:27): [True: 0, False: 9]
  ------------------
  562|      0|      return;
  563|       |
  564|      9|   info_ptr->x_pixels_per_unit = res_x;
  565|      9|   info_ptr->y_pixels_per_unit = res_y;
  566|      9|   info_ptr->phys_unit_type = (png_byte)unit_type;
  567|      9|   info_ptr->valid |= PNG_INFO_pHYs;
  ------------------
  |  |  739|      9|#define PNG_INFO_pHYs 0x0080U
  ------------------
  568|      9|}
OSS_FUZZ_png_set_PLTE:
  574|    360|{
  575|       |
  576|    360|   png_uint_32 max_palette_length;
  577|       |
  578|    360|   png_debug1(1, "in %s storage function", "PLTE");
  ------------------
  |  |  148|    360|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  579|       |
  580|    360|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (580:8): [True: 0, False: 360]
  |  Branch (580:27): [True: 0, False: 360]
  ------------------
  581|      0|      return;
  582|       |
  583|    360|   max_palette_length = (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
  ------------------
  |  |  669|    360|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|    360|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|    360|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (583:25): [True: 343, False: 17]
  ------------------
  584|    343|      (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
  ------------------
  |  |  725|    377|#define PNG_MAX_PALETTE_LENGTH    256
  ------------------
  585|       |
  586|    360|   if (num_palette < 0 || num_palette > (int) max_palette_length)
  ------------------
  |  Branch (586:8): [True: 0, False: 360]
  |  Branch (586:27): [True: 0, False: 360]
  ------------------
  587|      0|   {
  588|      0|      if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  664|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (588:11): [True: 0, False: 0]
  ------------------
  589|      0|         png_error(png_ptr, "Invalid palette length");
  ------------------
  |  |  238|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  590|       |
  591|      0|      else
  592|      0|      {
  593|      0|         png_warning(png_ptr, "Invalid palette length");
  ------------------
  |  |  426|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  594|       |
  595|      0|         return;
  596|      0|      }
  597|      0|   }
  598|       |
  599|    360|   if ((num_palette > 0 && palette == NULL) ||
  ------------------
  |  Branch (599:9): [True: 355, False: 5]
  |  Branch (599:28): [True: 0, False: 355]
  ------------------
  600|    360|      (num_palette == 0
  ------------------
  |  Branch (600:8): [True: 5, False: 355]
  ------------------
  601|    360|#        ifdef PNG_MNG_FEATURES_SUPPORTED
  602|    360|            && (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0
  ------------------
  |  |  857|      5|#define PNG_FLAG_MNG_EMPTY_PLTE     0x01
  ------------------
  |  Branch (602:16): [True: 5, False: 0]
  ------------------
  603|    360|#        endif
  604|    360|      ))
  605|      5|   {
  606|      5|      png_error(png_ptr, "Invalid palette");
  ------------------
  |  |  238|     10|#define png_error OSS_FUZZ_png_error
  ------------------
  607|      5|   }
  608|       |
  609|       |   /* It may not actually be necessary to set png_ptr->palette here;
  610|       |    * we do it for backward compatibility with the way the png_handle_tRNS
  611|       |    * function used to do the allocation.
  612|       |    *
  613|       |    * 1.6.0: the above statement appears to be incorrect; something has to set
  614|       |    * the palette inside png_struct on read.
  615|       |    */
  616|    355|   png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
  ------------------
  |  |  240|    355|#define png_free_data OSS_FUZZ_png_free_data
  ------------------
                 png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
  ------------------
  |  | 1758|    355|#define PNG_FREE_PLTE 0x1000U
  ------------------
  617|       |
  618|       |   /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
  619|       |    * of num_palette entries, in case of an invalid PNG file or incorrect
  620|       |    * call to png_set_PLTE() with too-large sample values.
  621|       |    */
  622|    355|   png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
  ------------------
  |  |  500|    355|#  define png_voidcast(type, value) (value)
  ------------------
  623|    355|       PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
  624|       |
  625|    355|   if (num_palette > 0)
  ------------------
  |  Branch (625:8): [True: 355, False: 0]
  ------------------
  626|    355|      memcpy(png_ptr->palette, palette, (unsigned int)num_palette *
  627|    355|          (sizeof (png_color)));
  628|    355|   info_ptr->palette = png_ptr->palette;
  629|    355|   info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;
  630|       |
  631|    355|   info_ptr->free_me |= PNG_FREE_PLTE;
  ------------------
  |  | 1758|    355|#define PNG_FREE_PLTE 0x1000U
  ------------------
  632|       |
  633|    355|   info_ptr->valid |= PNG_INFO_PLTE;
  ------------------
  |  |  735|    355|#define PNG_INFO_PLTE 0x0008U
  ------------------
  634|    355|}
OSS_FUZZ_png_set_sBIT:
  640|     12|{
  641|     12|   png_debug1(1, "in %s storage function", "sBIT");
  ------------------
  |  |  148|     12|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  642|       |
  643|     12|   if (png_ptr == NULL || info_ptr == NULL || sig_bit == NULL)
  ------------------
  |  Branch (643:8): [True: 0, False: 12]
  |  Branch (643:27): [True: 0, False: 12]
  |  Branch (643:47): [True: 0, False: 12]
  ------------------
  644|      0|      return;
  645|       |
  646|     12|   info_ptr->sig_bit = *sig_bit;
  647|     12|   info_ptr->valid |= PNG_INFO_sBIT;
  ------------------
  |  |  733|     12|#define PNG_INFO_sBIT 0x0002U
  ------------------
  648|     12|}
OSS_FUZZ_png_set_text_2:
  775|  4.58k|{
  776|  4.58k|   int i;
  777|       |
  778|  4.58k|   png_debug1(1, "in %lx storage function", png_ptr == NULL ? 0xabadca11U :
  ------------------
  |  |  148|  4.58k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  779|  4.58k|      (unsigned long)png_ptr->chunk_name);
  780|       |
  781|  4.58k|   if (png_ptr == NULL || info_ptr == NULL || num_text <= 0 || text_ptr == NULL)
  ------------------
  |  Branch (781:8): [True: 0, False: 4.58k]
  |  Branch (781:27): [True: 0, False: 4.58k]
  |  Branch (781:47): [True: 0, False: 4.58k]
  |  Branch (781:64): [True: 0, False: 4.58k]
  ------------------
  782|      0|      return(0);
  783|       |
  784|       |   /* Make sure we have enough space in the "text" array in info_struct
  785|       |    * to hold all of the incoming text_ptr objects.  This compare can't overflow
  786|       |    * because max_text >= num_text (anyway, subtract of two positive integers
  787|       |    * can't overflow in any case.)
  788|       |    */
  789|  4.58k|   if (num_text > info_ptr->max_text - info_ptr->num_text)
  ------------------
  |  Branch (789:8): [True: 849, False: 3.73k]
  ------------------
  790|    849|   {
  791|    849|      int old_num_text = info_ptr->num_text;
  792|    849|      int max_text;
  793|    849|      png_textp new_text = NULL;
  794|       |
  795|       |      /* Calculate an appropriate max_text, checking for overflow. */
  796|    849|      max_text = old_num_text;
  797|    849|      if (num_text <= INT_MAX - max_text)
  ------------------
  |  Branch (797:11): [True: 849, False: 0]
  ------------------
  798|    849|      {
  799|    849|         max_text += num_text;
  800|       |
  801|       |         /* Round up to a multiple of 8 */
  802|    849|         if (max_text < INT_MAX-8)
  ------------------
  |  Branch (802:14): [True: 849, False: 0]
  ------------------
  803|    849|            max_text = (max_text + 8) & ~0x7;
  804|       |
  805|      0|         else
  806|      0|            max_text = INT_MAX;
  807|       |
  808|       |         /* Now allocate a new array and copy the old members in; this does all
  809|       |          * the overflow checks.
  810|       |          */
  811|    849|         new_text = png_voidcast(png_textp,png_realloc_array(png_ptr,
  ------------------
  |  |  500|    849|#  define png_voidcast(type, value) (value)
  ------------------
  812|    849|             info_ptr->text, old_num_text, max_text-old_num_text,
  813|    849|             sizeof *new_text));
  814|    849|      }
  815|       |
  816|    849|      if (new_text == NULL)
  ------------------
  |  Branch (816:11): [True: 0, False: 849]
  ------------------
  817|      0|      {
  818|      0|         png_chunk_report(png_ptr, "too many text chunks",
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
  819|      0|             PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
  820|       |
  821|      0|         return 1;
  822|      0|      }
  823|       |
  824|    849|      png_free(png_ptr, info_ptr->text);
  ------------------
  |  |  239|    849|#define png_free OSS_FUZZ_png_free
  ------------------
  825|       |
  826|    849|      info_ptr->text = new_text;
  827|    849|      info_ptr->free_me |= PNG_FREE_TEXT;
  ------------------
  |  | 1760|    849|#define PNG_FREE_TEXT 0x4000U
  ------------------
  828|    849|      info_ptr->max_text = max_text;
  829|       |      /* num_text is adjusted below as the entries are copied in */
  830|       |
  831|    849|      png_debug1(3, "allocated %d entries for info_ptr->text", max_text);
  ------------------
  |  |  148|    849|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  832|    849|   }
  833|       |
  834|  9.17k|   for (i = 0; i < num_text; i++)
  ------------------
  |  Branch (834:16): [True: 4.58k, False: 4.58k]
  ------------------
  835|  4.58k|   {
  836|  4.58k|      size_t text_length, key_len;
  837|  4.58k|      size_t lang_len, lang_key_len;
  838|  4.58k|      png_textp textp = &(info_ptr->text[info_ptr->num_text]);
  839|       |
  840|  4.58k|      if (text_ptr[i].key == NULL)
  ------------------
  |  Branch (840:11): [True: 0, False: 4.58k]
  ------------------
  841|      0|          continue;
  842|       |
  843|  4.58k|      if (text_ptr[i].compression < PNG_TEXT_COMPRESSION_NONE ||
  ------------------
  |  |  588|  9.17k|#define PNG_TEXT_COMPRESSION_NONE    -1
  ------------------
  |  Branch (843:11): [True: 0, False: 4.58k]
  ------------------
  844|  4.58k|          text_ptr[i].compression >= PNG_TEXT_COMPRESSION_LAST)
  ------------------
  |  |  592|  4.58k|#define PNG_TEXT_COMPRESSION_LAST     3  /* Not a valid value */
  ------------------
  |  Branch (844:11): [True: 0, False: 4.58k]
  ------------------
  845|      0|      {
  846|      0|         png_chunk_report(png_ptr, "text compression mode is out of range",
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
  847|      0|             PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
  848|      0|         continue;
  849|      0|      }
  850|       |
  851|  4.58k|      key_len = strlen(text_ptr[i].key);
  852|       |
  853|  4.58k|      if (text_ptr[i].compression <= 0)
  ------------------
  |  Branch (853:11): [True: 4.11k, False: 474]
  ------------------
  854|  4.11k|      {
  855|  4.11k|         lang_len = 0;
  856|  4.11k|         lang_key_len = 0;
  857|  4.11k|      }
  858|       |
  859|    474|      else
  860|    474|#  ifdef PNG_iTXt_SUPPORTED
  861|    474|      {
  862|       |         /* Set iTXt data */
  863|       |
  864|    474|         if (text_ptr[i].lang != NULL)
  ------------------
  |  Branch (864:14): [True: 474, False: 0]
  ------------------
  865|    474|            lang_len = strlen(text_ptr[i].lang);
  866|       |
  867|      0|         else
  868|      0|            lang_len = 0;
  869|       |
  870|    474|         if (text_ptr[i].lang_key != NULL)
  ------------------
  |  Branch (870:14): [True: 474, False: 0]
  ------------------
  871|    474|            lang_key_len = strlen(text_ptr[i].lang_key);
  872|       |
  873|      0|         else
  874|      0|            lang_key_len = 0;
  875|    474|      }
  876|       |#  else /* iTXt */
  877|       |      {
  878|       |         png_chunk_report(png_ptr, "iTXt chunk not supported",
  879|       |             PNG_CHUNK_WRITE_ERROR);
  880|       |         continue;
  881|       |      }
  882|       |#  endif
  883|       |
  884|  4.58k|      if (text_ptr[i].text == NULL || text_ptr[i].text[0] == '\0')
  ------------------
  |  Branch (884:11): [True: 0, False: 4.58k]
  |  Branch (884:39): [True: 4.06k, False: 518]
  ------------------
  885|  4.06k|      {
  886|  4.06k|         text_length = 0;
  887|  4.06k|#  ifdef PNG_iTXt_SUPPORTED
  888|  4.06k|         if (text_ptr[i].compression > 0)
  ------------------
  |  Branch (888:14): [True: 450, False: 3.61k]
  ------------------
  889|    450|            textp->compression = PNG_ITXT_COMPRESSION_NONE;
  ------------------
  |  |  590|    450|#define PNG_ITXT_COMPRESSION_NONE     1
  ------------------
  890|       |
  891|  3.61k|         else
  892|  3.61k|#  endif
  893|  3.61k|            textp->compression = PNG_TEXT_COMPRESSION_NONE;
  ------------------
  |  |  588|  3.61k|#define PNG_TEXT_COMPRESSION_NONE    -1
  ------------------
  894|  4.06k|      }
  895|       |
  896|    518|      else
  897|    518|      {
  898|    518|         text_length = strlen(text_ptr[i].text);
  899|    518|         textp->compression = text_ptr[i].compression;
  900|    518|      }
  901|       |
  902|  4.58k|      textp->key = png_voidcast(png_charp,png_malloc_base(png_ptr,
  ------------------
  |  |  500|  4.58k|#  define png_voidcast(type, value) (value)
  ------------------
  903|  4.58k|          key_len + text_length + lang_len + lang_key_len + 4));
  904|       |
  905|  4.58k|      if (textp->key == NULL)
  ------------------
  |  Branch (905:11): [True: 0, False: 4.58k]
  ------------------
  906|      0|      {
  907|      0|         png_chunk_report(png_ptr, "text chunk: out of memory",
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
  908|      0|             PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
  909|       |
  910|      0|         return 1;
  911|      0|      }
  912|       |
  913|  4.58k|      png_debug2(2, "Allocated %lu bytes at %p in png_set_text",
  ------------------
  |  |  151|  4.58k|#  define png_debug2(l, m, p1, p2) ((void)0)
  ------------------
  914|  4.58k|          (unsigned long)(png_uint_32)
  915|  4.58k|          (key_len + lang_len + lang_key_len + text_length + 4),
  916|  4.58k|          textp->key);
  917|       |
  918|  4.58k|      memcpy(textp->key, text_ptr[i].key, key_len);
  919|  4.58k|      *(textp->key + key_len) = '\0';
  920|       |
  921|  4.58k|      if (text_ptr[i].compression > 0)
  ------------------
  |  Branch (921:11): [True: 474, False: 4.11k]
  ------------------
  922|    474|      {
  923|    474|         textp->lang = textp->key + key_len + 1;
  924|    474|         memcpy(textp->lang, text_ptr[i].lang, lang_len);
  925|    474|         *(textp->lang + lang_len) = '\0';
  926|    474|         textp->lang_key = textp->lang + lang_len + 1;
  927|    474|         memcpy(textp->lang_key, text_ptr[i].lang_key, lang_key_len);
  928|    474|         *(textp->lang_key + lang_key_len) = '\0';
  929|    474|         textp->text = textp->lang_key + lang_key_len + 1;
  930|    474|      }
  931|       |
  932|  4.11k|      else
  933|  4.11k|      {
  934|  4.11k|         textp->lang=NULL;
  935|  4.11k|         textp->lang_key=NULL;
  936|  4.11k|         textp->text = textp->key + key_len + 1;
  937|  4.11k|      }
  938|       |
  939|  4.58k|      if (text_length != 0)
  ------------------
  |  Branch (939:11): [True: 518, False: 4.06k]
  ------------------
  940|    518|         memcpy(textp->text, text_ptr[i].text, text_length);
  941|       |
  942|  4.58k|      *(textp->text + text_length) = '\0';
  943|       |
  944|  4.58k|#  ifdef PNG_iTXt_SUPPORTED
  945|  4.58k|      if (textp->compression > 0)
  ------------------
  |  Branch (945:11): [True: 474, False: 4.11k]
  ------------------
  946|    474|      {
  947|    474|         textp->text_length = 0;
  948|    474|         textp->itxt_length = text_length;
  949|    474|      }
  950|       |
  951|  4.11k|      else
  952|  4.11k|#  endif
  953|  4.11k|      {
  954|  4.11k|         textp->text_length = text_length;
  955|  4.11k|         textp->itxt_length = 0;
  956|  4.11k|      }
  957|       |
  958|  4.58k|      info_ptr->num_text++;
  959|  4.58k|      png_debug1(3, "transferred text chunk %d", info_ptr->num_text);
  ------------------
  |  |  148|  4.58k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  960|  4.58k|   }
  961|       |
  962|  4.58k|   return(0);
  963|  4.58k|}
OSS_FUZZ_png_set_tIME:
  970|  1.53k|{
  971|  1.53k|   png_debug1(1, "in %s storage function", "tIME");
  ------------------
  |  |  148|  1.53k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  972|       |
  973|  1.53k|   if (png_ptr == NULL || info_ptr == NULL || mod_time == NULL ||
  ------------------
  |  Branch (973:8): [True: 0, False: 1.53k]
  |  Branch (973:27): [True: 0, False: 1.53k]
  |  Branch (973:47): [True: 0, False: 1.53k]
  ------------------
  974|  1.53k|       (png_ptr->mode & PNG_WROTE_tIME) != 0)
  ------------------
  |  |  624|  1.53k|#define PNG_WROTE_tIME             0x200U
  ------------------
  |  Branch (974:8): [True: 0, False: 1.53k]
  ------------------
  975|      0|      return;
  976|       |
  977|  1.53k|   if (mod_time->month == 0   || mod_time->month > 12  ||
  ------------------
  |  Branch (977:8): [True: 214, False: 1.32k]
  |  Branch (977:34): [True: 259, False: 1.06k]
  ------------------
  978|  1.53k|       mod_time->day   == 0   || mod_time->day   > 31  ||
  ------------------
  |  Branch (978:8): [True: 216, False: 850]
  |  Branch (978:34): [True: 226, False: 624]
  ------------------
  979|  1.53k|       mod_time->hour  > 23   || mod_time->minute > 59 ||
  ------------------
  |  Branch (979:8): [True: 200, False: 424]
  |  Branch (979:34): [True: 198, False: 226]
  ------------------
  980|  1.53k|       mod_time->second > 60)
  ------------------
  |  Branch (980:8): [True: 209, False: 17]
  ------------------
  981|  1.52k|   {
  982|  1.52k|      png_warning(png_ptr, "Ignoring invalid time value");
  ------------------
  |  |  426|  1.52k|#define png_warning OSS_FUZZ_png_warning
  ------------------
  983|       |
  984|  1.52k|      return;
  985|  1.52k|   }
  986|       |
  987|     17|   info_ptr->mod_time = *mod_time;
  988|     17|   info_ptr->valid |= PNG_INFO_tIME;
  ------------------
  |  |  741|     17|#define PNG_INFO_tIME 0x0200U
  ------------------
  989|     17|}
OSS_FUZZ_png_set_tRNS:
  996|    486|{
  997|    486|   png_debug1(1, "in %s storage function", "tRNS");
  ------------------
  |  |  148|    486|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  998|       |
  999|    486|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (999:8): [True: 0, False: 486]
  |  Branch (999:27): [True: 0, False: 486]
  ------------------
 1000|       |
 1001|      0|      return;
 1002|       |
 1003|    486|   if (trans_alpha != NULL)
  ------------------
  |  Branch (1003:8): [True: 486, False: 0]
  ------------------
 1004|    486|   {
 1005|       |       /* It may not actually be necessary to set png_ptr->trans_alpha here;
 1006|       |        * we do it for backward compatibility with the way the png_handle_tRNS
 1007|       |        * function used to do the allocation.
 1008|       |        *
 1009|       |        * 1.6.0: The above statement is incorrect; png_handle_tRNS effectively
 1010|       |        * relies on png_set_tRNS storing the information in png_struct
 1011|       |        * (otherwise it won't be there for the code in pngrtran.c).
 1012|       |        */
 1013|       |
 1014|    486|       png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
  ------------------
  |  |  240|    486|#define png_free_data OSS_FUZZ_png_free_data
  ------------------
                     png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
  ------------------
  |  | 1759|    486|#define PNG_FREE_TRNS 0x2000U
  ------------------
 1015|       |
 1016|    486|       if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
  ------------------
  |  |  725|    486|#define PNG_MAX_PALETTE_LENGTH    256
  ------------------
  |  Branch (1016:12): [True: 486, False: 0]
  |  Branch (1016:29): [True: 486, False: 0]
  ------------------
 1017|    486|       {
 1018|       |         /* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */
 1019|    486|          info_ptr->trans_alpha = png_voidcast(png_bytep,
  ------------------
  |  |  500|    486|#  define png_voidcast(type, value) (value)
  ------------------
 1020|    486|              png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
 1021|    486|          memcpy(info_ptr->trans_alpha, trans_alpha, (size_t)num_trans);
 1022|       |
 1023|    486|          info_ptr->valid |= PNG_INFO_tRNS;
  ------------------
  |  |  736|    486|#define PNG_INFO_tRNS 0x0010U
  ------------------
 1024|    486|          info_ptr->free_me |= PNG_FREE_TRNS;
  ------------------
  |  | 1759|    486|#define PNG_FREE_TRNS 0x2000U
  ------------------
 1025|    486|       }
 1026|    486|       png_ptr->trans_alpha = info_ptr->trans_alpha;
 1027|    486|   }
 1028|       |
 1029|    486|   if (trans_color != NULL)
  ------------------
  |  Branch (1029:8): [True: 486, False: 0]
  ------------------
 1030|    486|   {
 1031|    486|#ifdef PNG_WARNINGS_SUPPORTED
 1032|    486|      if (info_ptr->bit_depth < 16)
  ------------------
  |  Branch (1032:11): [True: 309, False: 177]
  ------------------
 1033|    309|      {
 1034|    309|         int sample_max = (1 << info_ptr->bit_depth) - 1;
 1035|       |
 1036|    309|         if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY &&
  ------------------
  |  |  668|    618|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (1036:15): [True: 87, False: 222]
  ------------------
 1037|    309|             trans_color->gray > sample_max) ||
  ------------------
  |  Branch (1037:14): [True: 64, False: 23]
  ------------------
 1038|    309|             (info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
  ------------------
  |  |  670|    490|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  664|    245|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (1038:15): [True: 125, False: 120]
  ------------------
 1039|    245|             (trans_color->red > sample_max ||
  ------------------
  |  Branch (1039:15): [True: 66, False: 59]
  ------------------
 1040|    125|             trans_color->green > sample_max ||
  ------------------
  |  Branch (1040:14): [True: 23, False: 36]
  ------------------
 1041|    125|             trans_color->blue > sample_max)))
  ------------------
  |  Branch (1041:14): [True: 26, False: 10]
  ------------------
 1042|    179|            png_warning(png_ptr,
  ------------------
  |  |  426|    179|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1043|    179|                "tRNS chunk has out-of-range samples for bit_depth");
 1044|    309|      }
 1045|    486|#endif
 1046|       |
 1047|    486|      info_ptr->trans_color = *trans_color;
 1048|       |
 1049|    486|      if (num_trans == 0)
  ------------------
  |  Branch (1049:11): [True: 0, False: 486]
  ------------------
 1050|      0|         num_trans = 1;
 1051|    486|   }
 1052|       |
 1053|    486|   info_ptr->num_trans = (png_uint_16)num_trans;
 1054|       |
 1055|    486|   if (num_trans != 0)
  ------------------
  |  Branch (1055:8): [True: 486, False: 0]
  ------------------
 1056|    486|   {
 1057|    486|      info_ptr->valid |= PNG_INFO_tRNS;
  ------------------
  |  |  736|    486|#define PNG_INFO_tRNS 0x0010U
  ------------------
 1058|    486|      info_ptr->free_me |= PNG_FREE_TRNS;
  ------------------
  |  | 1759|    486|#define PNG_FREE_TRNS 0x2000U
  ------------------
 1059|    486|   }
 1060|    486|}
OSS_FUZZ_png_set_sPLT:
 1075|  2.78k|{
 1076|  2.78k|   png_sPLT_tp np;
 1077|       |
 1078|  2.78k|   if (png_ptr == NULL || info_ptr == NULL || nentries <= 0 || entries == NULL)
  ------------------
  |  Branch (1078:8): [True: 0, False: 2.78k]
  |  Branch (1078:27): [True: 0, False: 2.78k]
  |  Branch (1078:47): [True: 0, False: 2.78k]
  |  Branch (1078:64): [True: 0, False: 2.78k]
  ------------------
 1079|      0|      return;
 1080|       |
 1081|       |   /* Use the internal realloc function, which checks for all the possible
 1082|       |    * overflows.  Notice that the parameters are (int) and (size_t)
 1083|       |    */
 1084|  2.78k|   np = png_voidcast(png_sPLT_tp,png_realloc_array(png_ptr,
  ------------------
  |  |  500|  2.78k|#  define png_voidcast(type, value) (value)
  ------------------
 1085|  2.78k|       info_ptr->splt_palettes, info_ptr->splt_palettes_num, nentries,
 1086|  2.78k|       sizeof *np));
 1087|       |
 1088|  2.78k|   if (np == NULL)
  ------------------
  |  Branch (1088:8): [True: 0, False: 2.78k]
  ------------------
 1089|      0|   {
 1090|       |      /* Out of memory or too many chunks */
 1091|      0|      png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
                    png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
 1092|       |
 1093|      0|      return;
 1094|      0|   }
 1095|       |
 1096|  2.78k|   png_free(png_ptr, info_ptr->splt_palettes);
  ------------------
  |  |  239|  2.78k|#define png_free OSS_FUZZ_png_free
  ------------------
 1097|  2.78k|   info_ptr->splt_palettes = np;
 1098|  2.78k|   info_ptr->free_me |= PNG_FREE_SPLT;
  ------------------
  |  | 1750|  2.78k|#define PNG_FREE_SPLT 0x0020U
  ------------------
 1099|       |
 1100|  2.78k|   np += info_ptr->splt_palettes_num;
 1101|       |
 1102|  2.78k|   do
 1103|  2.78k|   {
 1104|  2.78k|      size_t length;
 1105|       |
 1106|       |      /* Skip invalid input entries */
 1107|  2.78k|      if (entries->name == NULL || entries->entries == NULL)
  ------------------
  |  Branch (1107:11): [True: 0, False: 2.78k]
  |  Branch (1107:36): [True: 0, False: 2.78k]
  ------------------
 1108|      0|      {
 1109|       |         /* png_handle_sPLT doesn't do this, so this is an app error */
 1110|      0|         png_app_error(png_ptr, "png_set_sPLT: invalid sPLT");
  ------------------
  |  |  119|      0|#define png_app_error OSS_FUZZ_png_app_error
  ------------------
 1111|       |         /* Just skip the invalid entry */
 1112|      0|         continue;
 1113|      0|      }
 1114|       |
 1115|  2.78k|      np->depth = entries->depth;
 1116|       |
 1117|       |      /* In the event of out-of-memory just return - there's no point keeping
 1118|       |       * on trying to add sPLT chunks.
 1119|       |       */
 1120|  2.78k|      length = strlen(entries->name) + 1;
 1121|  2.78k|      np->name = png_voidcast(png_charp, png_malloc_base(png_ptr, length));
  ------------------
  |  |  500|  2.78k|#  define png_voidcast(type, value) (value)
  ------------------
 1122|       |
 1123|  2.78k|      if (np->name == NULL)
  ------------------
  |  Branch (1123:11): [True: 0, False: 2.78k]
  ------------------
 1124|      0|         break;
 1125|       |
 1126|  2.78k|      memcpy(np->name, entries->name, length);
 1127|       |
 1128|       |      /* IMPORTANT: we have memory now that won't get freed if something else
 1129|       |       * goes wrong; this code must free it.  png_malloc_array produces no
 1130|       |       * warnings; use a png_chunk_report (below) if there is an error.
 1131|       |       */
 1132|  2.78k|      np->entries = png_voidcast(png_sPLT_entryp, png_malloc_array(png_ptr,
  ------------------
  |  |  500|  2.78k|#  define png_voidcast(type, value) (value)
  ------------------
 1133|  2.78k|          entries->nentries, sizeof (png_sPLT_entry)));
 1134|       |
 1135|  2.78k|      if (np->entries == NULL)
  ------------------
  |  Branch (1135:11): [True: 0, False: 2.78k]
  ------------------
 1136|      0|      {
 1137|      0|         png_free(png_ptr, np->name);
  ------------------
  |  |  239|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 1138|      0|         np->name = NULL;
 1139|      0|         break;
 1140|      0|      }
 1141|       |
 1142|  2.78k|      np->nentries = entries->nentries;
 1143|       |      /* This multiply can't overflow because png_malloc_array has already
 1144|       |       * checked it when doing the allocation.
 1145|       |       */
 1146|  2.78k|      memcpy(np->entries, entries->entries,
 1147|  2.78k|          (unsigned int)entries->nentries * sizeof (png_sPLT_entry));
 1148|       |
 1149|       |      /* Note that 'continue' skips the advance of the out pointer and out
 1150|       |       * count, so an invalid entry is not added.
 1151|       |       */
 1152|  2.78k|      info_ptr->valid |= PNG_INFO_sPLT;
  ------------------
  |  |  745|  2.78k|#define PNG_INFO_sPLT 0x2000U  /* ESR, 1.0.6 */
  ------------------
 1153|  2.78k|      ++(info_ptr->splt_palettes_num);
 1154|  2.78k|      ++np;
 1155|  2.78k|      ++entries;
 1156|  2.78k|   }
 1157|  2.78k|   while (--nentries);
  ------------------
  |  Branch (1157:11): [True: 0, False: 2.78k]
  ------------------
 1158|       |
 1159|  2.78k|   if (nentries > 0)
  ------------------
  |  Branch (1159:8): [True: 0, False: 2.78k]
  ------------------
 1160|      0|      png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  |  120|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
                    png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 1834|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
 1161|  2.78k|}

OSS_FUZZ_png_set_packing:
   51|  1.81k|{
   52|  1.81k|   png_debug(1, "in png_set_packing");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
   53|       |
   54|  1.81k|   if (png_ptr == NULL)
  ------------------
  |  Branch (54:8): [True: 0, False: 1.81k]
  ------------------
   55|      0|      return;
   56|       |
   57|  1.81k|   if (png_ptr->bit_depth < 8)
  ------------------
  |  Branch (57:8): [True: 1.15k, False: 662]
  ------------------
   58|  1.15k|   {
   59|  1.15k|      png_ptr->transformations |= PNG_PACK;
  ------------------
  |  |  635|  1.15k|#define PNG_PACK                0x0004U
  ------------------
   60|       |#     ifdef PNG_WRITE_SUPPORTED
   61|       |         png_ptr->usr_bit_depth = 8;
   62|       |#     endif
   63|  1.15k|   }
   64|  1.81k|}
OSS_FUZZ_png_set_interlace_handling:
  100|  1.81k|{
  101|  1.81k|   png_debug(1, "in png_set_interlace handling");
  ------------------
  |  |  145|  1.81k|#  define png_debug(l, m) ((void)0)
  ------------------
  102|       |
  103|  1.81k|   if (png_ptr != 0 && png_ptr->interlaced != 0)
  ------------------
  |  Branch (103:8): [True: 1.81k, False: 0]
  |  Branch (103:24): [True: 842, False: 976]
  ------------------
  104|    842|   {
  105|    842|      png_ptr->transformations |= PNG_INTERLACE;
  ------------------
  |  |  634|    842|#define PNG_INTERLACE           0x0002U
  ------------------
  106|    842|      return (7);
  107|    842|   }
  108|       |
  109|    976|   return (1);
  110|  1.81k|}