_Z14user_read_dataP14png_struct_defPhm:
   71|  28.4k|void user_read_data(png_structp png_ptr, png_bytep data, size_t length) {
   72|  28.4k|  BufState* buf_state = static_cast<BufState*>(png_get_io_ptr(png_ptr));
  ------------------
  |  |  291|  28.4k|#define png_get_io_ptr OSS_FUZZ_png_get_io_ptr
  ------------------
   73|  28.4k|  if (length > buf_state->bytes_left) {
  ------------------
  |  Branch (73:7): [True: 1, False: 28.4k]
  ------------------
   74|      1|    png_error(png_ptr, "read error");
  ------------------
  |  |  252|      2|#define png_error OSS_FUZZ_png_error
  ------------------
   75|      1|  }
   76|  28.4k|  memcpy(data, buf_state->data, length);
   77|  28.4k|  buf_state->bytes_left -= length;
   78|  28.4k|  buf_state->data += length;
   79|  28.4k|}
_Z14limited_mallocP14png_struct_defm:
   81|  5.45k|void* limited_malloc(png_structp, png_alloc_size_t size) {
   82|       |  // libpng may allocate large amounts of memory that the fuzzer reports as
   83|       |  // an error. In order to silence these errors, make libpng fail when trying
   84|       |  // to allocate a large amount. This allocator used to be in the Chromium
   85|       |  // version of this fuzzer.
   86|       |  // This number is chosen to match the default png_user_chunk_malloc_max.
   87|  5.45k|  if (size > 8000000)
  ------------------
  |  Branch (87:7): [True: 0, False: 5.45k]
  ------------------
   88|      0|    return nullptr;
   89|       |
   90|  5.45k|  return malloc(size);
   91|  5.45k|}
_Z12default_freeP14png_struct_defPv:
   93|  5.29k|void default_free(png_structp, png_voidp ptr) {
   94|  5.29k|  return free(ptr);
   95|  5.29k|}
LLVMFuzzerTestOneInput:
  102|     34|extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  103|     34|  if (size < kPngHeaderSize) {
  ------------------
  |  Branch (103:7): [True: 0, False: 34]
  ------------------
  104|      0|    return 0;
  105|      0|  }
  106|     34|  nalloc_init(nullptr);
  107|       |
  108|     34|  std::vector<unsigned char> v(data, data + size);
  109|     34|  if (png_sig_cmp(v.data(), 0, kPngHeaderSize)) {
  ------------------
  |  |  448|     34|#define png_sig_cmp OSS_FUZZ_png_sig_cmp
  ------------------
  |  Branch (109:7): [True: 6, False: 28]
  ------------------
  110|       |    // not a PNG.
  111|      6|    return 0;
  112|      6|  }
  113|       |
  114|     28|  PngObjectHandler png_handler;
  115|     28|  png_handler.png_ptr = nullptr;
  116|     28|  png_handler.row_ptr = nullptr;
  117|     28|  png_handler.info_ptr = nullptr;
  118|     28|  png_handler.end_info_ptr = nullptr;
  119|       |
  120|     28|  png_handler.png_ptr = png_create_read_struct
  ------------------
  |  |  244|     28|#define png_create_read_struct OSS_FUZZ_png_create_read_struct
  ------------------
  121|     28|    (PNG_LIBPNG_VER_STRING, nullptr, nullptr, nullptr);
  ------------------
  |  |  277|     28|#define PNG_LIBPNG_VER_STRING "1.6.59.git"
  ------------------
  122|     28|  if (!png_handler.png_ptr) {
  ------------------
  |  Branch (122:7): [True: 0, False: 28]
  ------------------
  123|      0|    return 0;
  124|      0|  }
  125|       |
  126|     28|  nalloc_start(data, size);
  127|     28|  png_handler.info_ptr = png_create_info_struct(png_handler.png_ptr);
  ------------------
  |  |  243|     28|#define png_create_info_struct OSS_FUZZ_png_create_info_struct
  ------------------
  128|     28|  if (!png_handler.info_ptr) {
  ------------------
  |  Branch (128:7): [True: 9, False: 19]
  ------------------
  129|      9|    PNG_CLEANUP
  ------------------
  |  |   27|      9|  nalloc_end(); \
  |  |   28|      9|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (28:6): [True: 9, False: 0]
  |  |  ------------------
  |  |   29|      9|  { \
  |  |   30|      9|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (30:9): [True: 0, False: 9]
  |  |  ------------------
  |  |   31|      9|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   32|      9|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (32:9): [True: 0, False: 9]
  |  |  ------------------
  |  |   33|      9|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   34|      0|        &png_handler.end_info_ptr); \
  |  |   35|      9|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (35:14): [True: 0, False: 9]
  |  |  ------------------
  |  |   36|      9|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   37|      0|        nullptr); \
  |  |   38|      9|    else \
  |  |   39|      9|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  250|      9|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   40|      9|    png_handler.png_ptr = nullptr; \
  |  |   41|      9|    png_handler.row_ptr = nullptr; \
  |  |   42|      9|    png_handler.info_ptr = nullptr; \
  |  |   43|      9|    png_handler.end_info_ptr = nullptr; \
  |  |   44|      9|  }
  ------------------
  130|      9|    return 0;
  131|      9|  }
  132|       |
  133|     19|  png_handler.end_info_ptr = png_create_info_struct(png_handler.png_ptr);
  ------------------
  |  |  243|     19|#define png_create_info_struct OSS_FUZZ_png_create_info_struct
  ------------------
  134|     19|  if (!png_handler.end_info_ptr) {
  ------------------
  |  Branch (134:7): [True: 3, False: 16]
  ------------------
  135|      3|    PNG_CLEANUP
  ------------------
  |  |   27|      3|  nalloc_end(); \
  |  |   28|      3|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (28:6): [True: 3, False: 0]
  |  |  ------------------
  |  |   29|      3|  { \
  |  |   30|      3|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (30:9): [True: 0, False: 3]
  |  |  ------------------
  |  |   31|      3|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   32|      3|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (32:9): [True: 0, False: 3]
  |  |  ------------------
  |  |   33|      3|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   34|      0|        &png_handler.end_info_ptr); \
  |  |   35|      3|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (35:14): [True: 3, False: 0]
  |  |  ------------------
  |  |   36|      3|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      3|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   37|      3|        nullptr); \
  |  |   38|      3|    else \
  |  |   39|      3|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   40|      3|    png_handler.png_ptr = nullptr; \
  |  |   41|      3|    png_handler.row_ptr = nullptr; \
  |  |   42|      3|    png_handler.info_ptr = nullptr; \
  |  |   43|      3|    png_handler.end_info_ptr = nullptr; \
  |  |   44|      3|  }
  ------------------
  136|      3|    return 0;
  137|      3|  }
  138|       |
  139|       |  // Use a custom allocator that fails for large allocations to avoid OOM.
  140|     16|  png_set_mem_fn(png_handler.png_ptr, nullptr, limited_malloc, default_free);
  ------------------
  |  |  407|     16|#define png_set_mem_fn OSS_FUZZ_png_set_mem_fn
  ------------------
  141|       |
  142|     16|  png_set_crc_action(png_handler.png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
  ------------------
  |  |  384|     16|#define png_set_crc_action OSS_FUZZ_png_set_crc_action
  ------------------
                png_set_crc_action(png_handler.png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
  ------------------
  |  | 1505|     16|#define PNG_CRC_QUIET_USE     4  /* quiet/use data      quiet/use data    */
  ------------------
                png_set_crc_action(png_handler.png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
  ------------------
  |  | 1505|     16|#define PNG_CRC_QUIET_USE     4  /* quiet/use data      quiet/use data    */
  ------------------
  143|       |#ifdef PNG_IGNORE_ADLER32
  144|       |  png_set_option(png_handler.png_ptr, PNG_IGNORE_ADLER32, PNG_OPTION_ON);
  145|       |#endif
  146|       |
  147|       |  // Setting up reading from buffer.
  148|     16|  png_handler.buf_state = new BufState();
  149|     16|  png_handler.buf_state->data = data + kPngHeaderSize;
  150|     16|  png_handler.buf_state->bytes_left = size - kPngHeaderSize;
  151|     16|  png_set_read_fn(png_handler.png_ptr, png_handler.buf_state, user_read_data);
  ------------------
  |  |  417|     16|#define png_set_read_fn OSS_FUZZ_png_set_read_fn
  ------------------
  152|     16|  png_set_sig_bytes(png_handler.png_ptr, kPngHeaderSize);
  ------------------
  |  |  433|     16|#define png_set_sig_bytes OSS_FUZZ_png_set_sig_bytes
  ------------------
  153|       |
  154|     16|  if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
  ------------------
  |  Branch (154:7): [True: 11, False: 5]
  ------------------
  155|     11|    PNG_CLEANUP
  ------------------
  |  |   27|     11|  nalloc_end(); \
  |  |   28|     11|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (28:6): [True: 11, False: 0]
  |  |  ------------------
  |  |   29|     11|  { \
  |  |   30|     11|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (30:9): [True: 0, False: 11]
  |  |  ------------------
  |  |   31|     11|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   32|     11|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (32:9): [True: 11, False: 0]
  |  |  ------------------
  |  |   33|     11|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|     11|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   34|     11|        &png_handler.end_info_ptr); \
  |  |   35|     11|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (35:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   36|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   37|      0|        nullptr); \
  |  |   38|      0|    else \
  |  |   39|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   40|     11|    png_handler.png_ptr = nullptr; \
  |  |   41|     11|    png_handler.row_ptr = nullptr; \
  |  |   42|     11|    png_handler.info_ptr = nullptr; \
  |  |   43|     11|    png_handler.end_info_ptr = nullptr; \
  |  |   44|     11|  }
  ------------------
  156|     11|    return 0;
  157|     11|  }
  158|       |
  159|       |  // Reading.
  160|      5|  png_read_info(png_handler.png_ptr, png_handler.info_ptr);
  ------------------
  |  |  357|      5|#define png_read_info OSS_FUZZ_png_read_info
  ------------------
  161|       |
  162|       |  // reset error handler to put png_deleter into scope.
  163|      5|  if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
  ------------------
  |  Branch (163:7): [True: 2, False: 3]
  ------------------
  164|      2|    PNG_CLEANUP
  ------------------
  |  |   27|      2|  nalloc_end(); \
  |  |   28|      2|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (28:6): [True: 2, False: 0]
  |  |  ------------------
  |  |   29|      2|  { \
  |  |   30|      2|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (30:9): [True: 0, False: 2]
  |  |  ------------------
  |  |   31|      2|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   32|      2|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (32:9): [True: 2, False: 0]
  |  |  ------------------
  |  |   33|      2|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      2|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   34|      2|        &png_handler.end_info_ptr); \
  |  |   35|      2|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (35:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   36|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   37|      0|        nullptr); \
  |  |   38|      0|    else \
  |  |   39|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   40|      2|    png_handler.png_ptr = nullptr; \
  |  |   41|      2|    png_handler.row_ptr = nullptr; \
  |  |   42|      2|    png_handler.info_ptr = nullptr; \
  |  |   43|      2|    png_handler.end_info_ptr = nullptr; \
  |  |   44|      2|  }
  ------------------
  165|      2|    return 0;
  166|      2|  }
  167|       |
  168|      3|  png_uint_32 width, height;
  169|      3|  int bit_depth, color_type, interlace_type, compression_type;
  170|      3|  int filter_type;
  171|       |
  172|      3|  if (!png_get_IHDR(png_handler.png_ptr, png_handler.info_ptr, &width,
  ------------------
  |  |  256|      3|#define png_get_IHDR OSS_FUZZ_png_get_IHDR
  ------------------
  |  Branch (172:7): [True: 0, False: 3]
  ------------------
  173|      3|                    &height, &bit_depth, &color_type, &interlace_type,
  174|      3|                    &compression_type, &filter_type)) {
  175|      0|    PNG_CLEANUP
  ------------------
  |  |   27|      0|  nalloc_end(); \
  |  |   28|      0|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (28:6): [True: 0, False: 0]
  |  |  ------------------
  |  |   29|      0|  { \
  |  |   30|      0|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (30:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   31|      0|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   32|      0|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (32:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   33|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   34|      0|        &png_handler.end_info_ptr); \
  |  |   35|      0|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (35:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   36|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   37|      0|        nullptr); \
  |  |   38|      0|    else \
  |  |   39|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   40|      0|    png_handler.png_ptr = nullptr; \
  |  |   41|      0|    png_handler.row_ptr = nullptr; \
  |  |   42|      0|    png_handler.info_ptr = nullptr; \
  |  |   43|      0|    png_handler.end_info_ptr = nullptr; \
  |  |   44|      0|  }
  ------------------
  176|      0|    return 0;
  177|      0|  }
  178|       |
  179|       |  // This is going to be too slow.
  180|      5|  if (width && height > 100000000 / width) {
  ------------------
  |  Branch (180:7): [True: 5, False: 18.4E]
  |  Branch (180:16): [True: 0, False: 5]
  ------------------
  181|      0|    PNG_CLEANUP
  ------------------
  |  |   27|      0|  nalloc_end(); \
  |  |   28|      0|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (28:6): [True: 0, False: 0]
  |  |  ------------------
  |  |   29|      0|  { \
  |  |   30|      0|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (30:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   31|      0|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   32|      0|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (32:9): [True: 0, False: 0]
  |  |  ------------------
  |  |   33|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   34|      0|        &png_handler.end_info_ptr); \
  |  |   35|      0|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (35:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   36|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   37|      0|        nullptr); \
  |  |   38|      0|    else \
  |  |   39|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   40|      0|    png_handler.png_ptr = nullptr; \
  |  |   41|      0|    png_handler.row_ptr = nullptr; \
  |  |   42|      0|    png_handler.info_ptr = nullptr; \
  |  |   43|      0|    png_handler.end_info_ptr = nullptr; \
  |  |   44|      0|  }
  ------------------
  182|      0|    return 0;
  183|      0|  }
  184|       |
  185|       |  // Set several transforms that browsers typically use:
  186|      3|  png_set_gray_to_rgb(png_handler.png_ptr);
  ------------------
  |  |  396|      3|#define png_set_gray_to_rgb OSS_FUZZ_png_set_gray_to_rgb
  ------------------
  187|      3|  png_set_expand(png_handler.png_ptr);
  ------------------
  |  |  388|      3|#define png_set_expand OSS_FUZZ_png_set_expand
  ------------------
  188|      3|  png_set_packing(png_handler.png_ptr);
  ------------------
  |  |  412|      3|#define png_set_packing OSS_FUZZ_png_set_packing
  ------------------
  189|      3|  png_set_scale_16(png_handler.png_ptr);
  ------------------
  |  |  431|      3|#define png_set_scale_16 OSS_FUZZ_png_set_scale_16
  ------------------
  190|      3|  png_set_tRNS_to_alpha(png_handler.png_ptr);
  ------------------
  |  |  440|      3|#define png_set_tRNS_to_alpha OSS_FUZZ_png_set_tRNS_to_alpha
  ------------------
  191|       |
  192|      3|  int passes = png_set_interlace_handling(png_handler.png_ptr);
  ------------------
  |  |  399|      3|#define png_set_interlace_handling OSS_FUZZ_png_set_interlace_handling
  ------------------
  193|       |
  194|      3|  png_read_update_info(png_handler.png_ptr, png_handler.info_ptr);
  ------------------
  |  |  361|      3|#define png_read_update_info OSS_FUZZ_png_read_update_info
  ------------------
  195|       |
  196|      3|  png_handler.row_ptr = png_malloc(
  ------------------
  |  |  347|      3|#define png_malloc OSS_FUZZ_png_malloc
  ------------------
  197|      3|      png_handler.png_ptr, png_get_rowbytes(png_handler.png_ptr,
  ------------------
  |  |  308|      3|#define png_get_rowbytes OSS_FUZZ_png_get_rowbytes
  ------------------
  198|      3|                                            png_handler.info_ptr));
  199|       |
  200|     24|  for (int pass = 0; pass < passes; ++pass) {
  ------------------
  |  Branch (200:22): [True: 21, False: 3]
  ------------------
  201|     84|    for (png_uint_32 y = 0; y < height; ++y) {
  ------------------
  |  Branch (201:29): [True: 63, False: 21]
  ------------------
  202|     63|      png_read_row(png_handler.png_ptr,
  ------------------
  |  |  359|     63|#define png_read_row OSS_FUZZ_png_read_row
  ------------------
  203|     63|                   static_cast<png_bytep>(png_handler.row_ptr), nullptr);
  204|     63|    }
  205|     21|  }
  206|       |
  207|      3|  png_read_end(png_handler.png_ptr, png_handler.end_info_ptr);
  ------------------
  |  |  355|      3|#define png_read_end OSS_FUZZ_png_read_end
  ------------------
  208|       |
  209|      3|  PNG_CLEANUP
  ------------------
  |  |   27|      3|  nalloc_end(); \
  |  |   28|      3|  if(png_handler.png_ptr) \
  |  |  ------------------
  |  |  |  Branch (28:6): [True: 3, False: 0]
  |  |  ------------------
  |  |   29|      3|  { \
  |  |   30|      3|    if (png_handler.row_ptr) \
  |  |  ------------------
  |  |  |  Branch (30:9): [True: 3, False: 0]
  |  |  ------------------
  |  |   31|      3|      png_free(png_handler.png_ptr, png_handler.row_ptr); \
  |  |  ------------------
  |  |  |  |  253|      3|#define png_free OSS_FUZZ_png_free
  |  |  ------------------
  |  |   32|      3|    if (png_handler.end_info_ptr) \
  |  |  ------------------
  |  |  |  Branch (32:9): [True: 3, False: 0]
  |  |  ------------------
  |  |   33|      3|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      3|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   34|      3|        &png_handler.end_info_ptr); \
  |  |   35|      3|    else if (png_handler.info_ptr) \
  |  |  ------------------
  |  |  |  Branch (35:14): [True: 0, False: 0]
  |  |  ------------------
  |  |   36|      0|      png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   37|      0|        nullptr); \
  |  |   38|      0|    else \
  |  |   39|      0|      png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
  |  |  ------------------
  |  |  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  |  |  ------------------
  |  |   40|      3|    png_handler.png_ptr = nullptr; \
  |  |   41|      3|    png_handler.row_ptr = nullptr; \
  |  |   42|      3|    png_handler.info_ptr = nullptr; \
  |  |   43|      3|    png_handler.end_info_ptr = nullptr; \
  |  |   44|      3|  }
  ------------------
  210|       |
  211|      3|#ifdef PNG_SIMPLIFIED_READ_SUPPORTED
  212|       |  // Simplified READ API
  213|      3|  png_image image;
  214|      3|  memset(&image, 0, (sizeof image));
  215|      3|  image.version = PNG_IMAGE_VERSION;
  ------------------
  |  | 2916|      3|#define PNG_IMAGE_VERSION 1
  ------------------
  216|       |
  217|      3|  if (!png_image_begin_read_from_memory(&image, data, size)) {
  ------------------
  |  |  342|      3|#define png_image_begin_read_from_memory OSS_FUZZ_png_image_begin_read_from_memory
  ------------------
  |  Branch (217:7): [True: 3, False: 0]
  ------------------
  218|      3|    return 0;
  219|      3|  }
  220|       |
  221|      0|  image.format = PNG_FORMAT_RGBA;
  ------------------
  |  | 3049|      0|#define PNG_FORMAT_RGBA (PNG_FORMAT_RGB|PNG_FORMAT_FLAG_ALPHA)
  |  |  ------------------
  |  |  |  | 3047|      0|#define PNG_FORMAT_RGB  PNG_FORMAT_FLAG_COLOR
  |  |  |  |  ------------------
  |  |  |  |  |  | 3026|      0|#define PNG_FORMAT_FLAG_COLOR    0x02U /* color format: otherwise grayscale */
  |  |  |  |  ------------------
  |  |  ------------------
  |  |               #define PNG_FORMAT_RGBA (PNG_FORMAT_RGB|PNG_FORMAT_FLAG_ALPHA)
  |  |  ------------------
  |  |  |  | 3025|      0|#define PNG_FORMAT_FLAG_ALPHA    0x01U /* format with an alpha channel */
  |  |  ------------------
  ------------------
  222|      0|  std::vector<png_byte> buffer(PNG_IMAGE_SIZE(image));
  ------------------
  |  | 3167|      0|   PNG_IMAGE_BUFFER_SIZE(image, PNG_IMAGE_ROW_STRIDE(image))
  |  |  ------------------
  |  |  |  | 3158|      0|   (PNG_IMAGE_PIXEL_COMPONENT_SIZE((image).format)*(image).height*(row_stride))
  |  |  |  |  ------------------
  |  |  |  |  |  | 3136|      0|   PNG_IMAGE_PIXEL_(PNG_IMAGE_SAMPLE_COMPONENT_SIZE,fmt)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  | 3127|      0|   (((fmt)&PNG_FORMAT_FLAG_COLORMAP)?1:test(fmt))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  | 3028|      0|#define PNG_FORMAT_FLAG_COLORMAP 0x08U /* image data is color-mapped */
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (((fmt)&PNG_FORMAT_FLAG_COLORMAP)?1:test(fmt))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  | 3136|      0|   PNG_IMAGE_PIXEL_(PNG_IMAGE_SAMPLE_COMPONENT_SIZE,fmt)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 3098|      0|   ((((fmt) & PNG_FORMAT_FLAG_LINEAR) >> 2)+1)
  |  |  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  |  |  | 3027|      0|#define PNG_FORMAT_FLAG_LINEAR   0x04U /* 2-byte channels else 1-byte */
  |  |  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  Branch (3127:5): [True: 0, False: 0]
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3158:68): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  223|      0|  png_image_finish_read(&image, NULL, buffer.data(), 0, NULL);
  ------------------
  |  |  343|      0|#define png_image_finish_read OSS_FUZZ_png_image_finish_read
  ------------------
  224|      0|#endif
  225|       |
  226|      0|  return 0;
  227|      3|}
_ZN16PngObjectHandlerD2Ev:
   58|     28|  ~PngObjectHandler() {
   59|     28|    if (row_ptr)
  ------------------
  |  Branch (59:9): [True: 0, False: 28]
  ------------------
   60|      0|      png_free(png_ptr, row_ptr);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
   61|     28|    if (end_info_ptr)
  ------------------
  |  Branch (61:9): [True: 0, False: 28]
  ------------------
   62|      0|      png_destroy_read_struct(&png_ptr, &info_ptr, &end_info_ptr);
  ------------------
  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  ------------------
   63|     28|    else if (info_ptr)
  ------------------
  |  Branch (63:14): [True: 0, False: 28]
  ------------------
   64|      0|      png_destroy_read_struct(&png_ptr, &info_ptr, nullptr);
  ------------------
  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  ------------------
   65|     28|    else
   66|     28|      png_destroy_read_struct(&png_ptr, nullptr, nullptr);
  ------------------
  |  |  250|     28|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  ------------------
   67|     28|    delete buf_state;
   68|     28|  }

nalloc_init:
  122|     34|void nalloc_init(const char *prog) {
  123|     34|  if (nalloc_initialized) {
  ------------------
  |  Branch (123:7): [True: 33, False: 1]
  ------------------
  124|     33|    return;
  125|     33|  }
  126|      1|  nalloc_initialized = true;
  127|      1|  char *bitmask = getenv("NALLOC_FREQ");
  128|      1|  if (bitmask) {
  ------------------
  |  Branch (128:7): [True: 1, False: 0]
  ------------------
  129|      1|    int shift = atoi(bitmask);
  130|      1|    if (shift > 0 && shift < 31) {
  ------------------
  |  Branch (130:9): [True: 1, False: 0]
  |  Branch (130:22): [True: 0, False: 1]
  ------------------
  131|      0|      nalloc_bitmask = 1 << shift;
  132|      0|      nalloc_random_bitmask = false;
  133|      1|    } else if (shift == 0) {
  ------------------
  |  Branch (133:16): [True: 0, False: 1]
  ------------------
  134|      0|      nalloc_random_bitmask = false;
  135|      0|      nalloc_bitmask = 0;
  136|      0|    }
  137|      1|  } else if (prog == NULL || strstr(prog, "nalloc") == NULL) {
  ------------------
  |  Branch (137:14): [True: 0, False: 0]
  |  Branch (137:30): [True: 0, False: 0]
  ------------------
  138|      0|    nalloc_random_bitmask = false;
  139|      0|    nalloc_bitmask = 0;
  140|      0|    return;
  141|      0|  }
  142|       |
  143|      1|  char *magic = getenv("NALLOC_MAGIC");
  144|      1|  if (magic) {
  ------------------
  |  Branch (144:7): [True: 0, False: 1]
  ------------------
  145|      0|    nalloc_magic = (uint32_t)strtol(magic, NULL, 0);
  146|      0|  }
  147|       |
  148|      1|  char *verbose = getenv("NALLOC_VERBOSE");
  149|      1|  if (verbose) {
  ------------------
  |  Branch (149:7): [True: 0, False: 1]
  ------------------
  150|      0|    nalloc_verbose = true;
  151|      0|  }
  152|      1|}
calloc:
  308|      2|void *calloc(size_t nmemb, size_t size) {
  309|      2|  if (nalloc_fail(size, "calloc")) {
  ------------------
  |  Branch (309:7): [True: 0, False: 2]
  ------------------
  310|      0|    errno = ENOMEM;
  311|      0|    return NULL;
  312|      0|  }
  313|      2|  return nalloc_calloc(nmemb, size);
  ------------------
  |  |  265|      2|#define nalloc_calloc(s, n) __libc_calloc(s, n)
  ------------------
  314|      2|}
malloc:
  316|  58.8k|void *malloc(size_t size) {
  317|  58.8k|  if (nalloc_fail(size, "malloc")) {
  ------------------
  |  Branch (317:7): [True: 214, False: 58.6k]
  ------------------
  318|    214|    errno = ENOMEM;
  319|    214|    return NULL;
  320|    214|  }
  321|  58.6k|  return nalloc_malloc(size);
  ------------------
  |  |  264|  58.6k|#define nalloc_malloc(s) __libc_malloc(s)
  ------------------
  322|  58.8k|}
realloc:
  324|      1|void *realloc(void *ptr, size_t size) {
  325|      1|  if (nalloc_fail(size, "realloc")) {
  ------------------
  |  Branch (325:7): [True: 0, False: 1]
  ------------------
  326|      0|    errno = ENOMEM;
  327|      0|    return NULL;
  328|      0|  }
  329|      1|  return nalloc_realloc(ptr, size);
  ------------------
  |  |  266|      1|#define nalloc_realloc(p, s) __libc_realloc(p, s)
  ------------------
  330|      1|}
libpng_read_fuzzer.cc:_ZL11nalloc_failmPKc:
  200|  58.8k|static bool nalloc_fail(size_t size, const char *op) {
  201|       |  // do not fail before thread init
  202|  58.8k|  if (nalloc_runs == 0) {
  ------------------
  |  Branch (202:7): [True: 53.1k, False: 5.75k]
  ------------------
  203|  53.1k|    return false;
  204|  53.1k|  }
  205|  5.75k|  if (__sync_fetch_and_add(&nalloc_running, 1) != 1) {
  ------------------
  |  Branch (205:7): [True: 240, False: 5.51k]
  ------------------
  206|       |    // do not fail allocations outside of fuzzer input
  207|       |    // and do not fail inside of this function
  208|    240|    __sync_fetch_and_sub(&nalloc_running, 1);
  209|    240|    return false;
  210|    240|  }
  211|  5.51k|  nalloc_random_update((uint8_t)size);
  212|  5.51k|  if (size >= 0x100) {
  ------------------
  |  Branch (212:7): [True: 3.98k, False: 1.53k]
  ------------------
  213|  3.98k|    nalloc_random_update((uint8_t)(size >> 8));
  214|  3.98k|    if (size >= 0x10000) {
  ------------------
  |  Branch (214:9): [True: 5, False: 3.97k]
  ------------------
  215|      5|      nalloc_random_update((uint8_t)(size >> 16));
  216|       |      // bigger may already fail or oom
  217|      5|    }
  218|  3.98k|  }
  219|  5.51k|  if (((nalloc_random_state ^ nalloc_magic) & nalloc_bitmask) == 0) {
  ------------------
  |  Branch (219:7): [True: 214, False: 5.29k]
  ------------------
  220|    214|    if (nalloc_backtrace_exclude(size, op)) {
  ------------------
  |  Branch (220:9): [True: 0, False: 214]
  ------------------
  221|      0|      __sync_fetch_and_sub(&nalloc_running, 1);
  222|      0|      return false;
  223|      0|    }
  224|    214|    __sync_fetch_and_sub(&nalloc_running, 1);
  225|    214|    return true;
  226|    214|  }
  227|  5.29k|  __sync_fetch_and_sub(&nalloc_running, 1);
  228|  5.29k|  return false;
  229|  5.51k|}
libpng_read_fuzzer.cc:_ZL20nalloc_random_updateh:
  155|  6.73M|static inline void nalloc_random_update(uint8_t b) {
  156|  6.73M|  nalloc_random_state =
  157|  6.73M|      ((uint32_t)((uint32_t)nalloc_random_state << 8)) ^
  158|  6.73M|      nalloc_crc32_table[((nalloc_random_state >> 24) ^ b) & 0xFF];
  159|  6.73M|}
libpng_read_fuzzer.cc:_ZL24nalloc_backtrace_excludemPKc:
  188|    214|static bool nalloc_backtrace_exclude(size_t size, const char *op) {
  189|    214|  if (nalloc_verbose) {
  ------------------
  |  Branch (189:7): [True: 0, False: 214]
  ------------------
  190|      0|    fprintf(stderr, "failed %s(%zu) \n", op, size);
  191|       |#ifdef NALLOC_ASAN
  192|       |    __sanitizer_print_stack_trace();
  193|       |#endif
  194|      0|  }
  195|       |
  196|    214|  return false;
  197|    214|}
libpng_read_fuzzer.cc:_ZL12nalloc_startPKhm:
  162|     28|static int nalloc_start(const uint8_t *data, size_t size) {
  163|     28|  if (nalloc_random_bitmask) {
  ------------------
  |  Branch (163:7): [True: 28, False: 0]
  ------------------
  164|     28|    if (nalloc_random_state & 0x10) {
  ------------------
  |  Branch (164:9): [True: 12, False: 16]
  ------------------
  165|     12|      nalloc_bitmask = 0xFFFFFFFF;
  166|     16|    } else {
  167|     16|      nalloc_bitmask = 1 << (5 + (nalloc_random_state & 0xF));
  168|     16|    }
  169|     28|  } else if (nalloc_bitmask == 0) {
  ------------------
  |  Branch (169:14): [True: 0, False: 0]
  ------------------
  170|       |    // nalloc disabled
  171|      0|    return 0;
  172|      0|  }
  173|     28|  nalloc_random_state = 0;
  174|  6.72M|  for (size_t i = 0; i < size; i++) {
  ------------------
  |  Branch (174:22): [True: 6.72M, False: 28]
  ------------------
  175|  6.72M|    nalloc_random_update(data[i]);
  176|  6.72M|  }
  177|     28|  if (__sync_fetch_and_add(&nalloc_running, 1)) {
  ------------------
  |  Branch (177:7): [True: 0, False: 28]
  ------------------
  178|      0|    __sync_fetch_and_sub(&nalloc_running, 1);
  179|      0|    return 0;
  180|      0|  }
  181|     28|  nalloc_runs++;
  182|     28|  return 1;
  183|     28|}
libpng_read_fuzzer.cc:_ZL10nalloc_endv:
  186|     28|static void nalloc_end() { __sync_fetch_and_sub(&nalloc_running, 1); }

OSS_FUZZ_png_set_sig_bytes:
   54|     16|{
   55|     16|   unsigned int nb = (unsigned int)num_bytes;
   56|       |
   57|     16|   png_debug(1, "in png_set_sig_bytes");
  ------------------
  |  |  145|     16|#  define png_debug(l, m) ((void)0)
  ------------------
   58|       |
   59|     16|   if (png_ptr == NULL)
  ------------------
  |  Branch (59:8): [True: 0, False: 16]
  ------------------
   60|      0|      return;
   61|       |
   62|     16|   if (num_bytes < 0)
  ------------------
  |  Branch (62:8): [True: 0, False: 16]
  ------------------
   63|      0|      nb = 0;
   64|       |
   65|     16|   if (nb > 8)
  ------------------
  |  Branch (65:8): [True: 0, False: 16]
  ------------------
   66|      0|      png_error(png_ptr, "Too many bytes for PNG signature");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
   67|       |
   68|     16|   png_ptr->sig_bytes = (png_byte)nb;
   69|     16|}
OSS_FUZZ_png_sig_cmp:
   81|     37|{
   82|     37|   static const png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
   83|       |
   84|     37|   if (num_to_check > 8)
  ------------------
  |  Branch (84:8): [True: 0, False: 37]
  ------------------
   85|      0|      num_to_check = 8;
   86|       |
   87|     37|   else if (num_to_check < 1)
  ------------------
  |  Branch (87:13): [True: 0, False: 37]
  ------------------
   88|      0|      return -1;
   89|       |
   90|     37|   if (start > 7)
  ------------------
  |  Branch (90:8): [True: 0, False: 37]
  ------------------
   91|      0|      return -1;
   92|       |
   93|     37|   if (start + num_to_check > 8)
  ------------------
  |  Branch (93:8): [True: 0, False: 37]
  ------------------
   94|      0|      num_to_check = 8 - start;
   95|       |
   96|     37|   return memcmp(&sig[start], &png_signature[start], num_to_check);
   97|     37|}
OSS_FUZZ_png_zalloc:
  106|  3.45k|{
  107|  3.45k|   png_alloc_size_t num_bytes = size;
  108|       |
  109|  3.45k|   if (png_ptr == NULL)
  ------------------
  |  Branch (109:8): [True: 0, False: 3.45k]
  ------------------
  110|      0|      return NULL;
  111|       |
  112|       |   /* This check against overflow is vestigial, dating back from
  113|       |    * the old times when png_zalloc used to be an exported function.
  114|       |    * We're still keeping it here for now, as an extra-cautious
  115|       |    * prevention against programming errors inside zlib, although it
  116|       |    * should rather be a debug-time assertion instead.
  117|       |    */
  118|  3.45k|   if (size != 0 && items >= (~(png_alloc_size_t)0) / size)
  ------------------
  |  Branch (118:8): [True: 3.45k, False: 0]
  |  Branch (118:21): [True: 0, False: 3.45k]
  ------------------
  119|      0|   {
  120|      0|      png_warning(png_voidcast(png_structrp, png_ptr),
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
                    png_warning(png_voidcast(png_structrp, png_ptr),
  ------------------
  |  |  535|      0|#  define png_voidcast(type, value) (value)
  ------------------
  121|      0|                  "Potential overflow in png_zalloc()");
  122|      0|      return NULL;
  123|      0|   }
  124|       |
  125|  3.45k|   num_bytes *= items;
  126|  3.45k|   return png_malloc_warn(png_voidcast(png_structrp, png_ptr), num_bytes);
  ------------------
  |  |  349|  3.45k|#define png_malloc_warn OSS_FUZZ_png_malloc_warn
  ------------------
                 return png_malloc_warn(png_voidcast(png_structrp, png_ptr), num_bytes);
  ------------------
  |  |  535|  3.45k|#  define png_voidcast(type, value) (value)
  ------------------
  127|  3.45k|}
OSS_FUZZ_png_zfree:
  132|  3.45k|{
  133|  3.45k|   png_free(png_voidcast(png_const_structrp,png_ptr), ptr);
  ------------------
  |  |  253|  3.45k|#define png_free OSS_FUZZ_png_free
  ------------------
                 png_free(png_voidcast(png_const_structrp,png_ptr), ptr);
  ------------------
  |  |  535|  3.45k|#  define png_voidcast(type, value) (value)
  ------------------
  134|  3.45k|}
OSS_FUZZ_png_reset_crc:
  141|  7.98k|{
  142|       |   /* The cast is safe because the crc is a 32-bit value. */
  143|       |   png_ptr->crc = (png_uint_32)crc32(0, Z_NULL, 0);
  144|  7.98k|}
OSS_FUZZ_png_calculate_crc:
  153|  20.4k|{
  154|  20.4k|   int need_crc = 1;
  155|       |
  156|  20.4k|   if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0)
  ------------------
  |  |  941|  20.4k|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  ------------------
  |  Branch (156:8): [True: 20.3k, False: 187]
  ------------------
  157|  20.3k|   {
  158|  20.3k|      if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
  ------------------
  |  |  727|  20.3k|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  703|  20.3k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  728|  20.3k|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  704|  20.3k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
  |  Branch (158:11): [True: 20.3k, False: 0]
  ------------------
  159|  20.3k|          (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
  ------------------
  |  |  703|  20.3k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  ------------------
                        (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
  ------------------
  |  |  704|  20.3k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
  160|  20.3k|         need_crc = 0;
  161|  20.3k|   }
  162|       |
  163|    187|   else /* critical */
  164|    187|   {
  165|    187|      if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)
  ------------------
  |  |  706|    187|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  ------------------
  |  Branch (165:11): [True: 181, False: 6]
  ------------------
  166|    181|         need_crc = 0;
  167|    187|   }
  168|       |
  169|       |   /* 'uLong' is defined in zlib.h as unsigned long; this means that on some
  170|       |    * systems it is a 64-bit value.  crc32, however, returns 32 bits so the
  171|       |    * following cast is safe.  'uInt' may be no more than 16 bits, so it is
  172|       |    * necessary to perform a loop here.
  173|       |    */
  174|  20.4k|   if (need_crc != 0 && length > 0)
  ------------------
  |  Branch (174:8): [True: 6, False: 20.4k]
  |  Branch (174:25): [True: 6, False: 0]
  ------------------
  175|      6|   {
  176|      6|      uLong crc = png_ptr->crc; /* Should never issue a warning */
  177|       |
  178|      6|      do
  179|      6|      {
  180|      6|         uInt safe_length = (uInt)length;
  181|      6|#ifndef __COVERITY__
  182|      6|         if (safe_length == 0)
  ------------------
  |  Branch (182:14): [True: 0, False: 6]
  ------------------
  183|      0|            safe_length = (uInt)-1; /* evil, but safe */
  184|      6|#endif
  185|       |
  186|      6|         crc = crc32(crc, ptr, safe_length);
  187|       |
  188|       |         /* The following should never issue compiler warnings; if they do the
  189|       |          * target system has characteristics that will probably violate other
  190|       |          * assumptions within the libpng code.
  191|       |          */
  192|      6|         ptr += safe_length;
  193|      6|         length -= safe_length;
  194|      6|      }
  195|      6|      while (length > 0);
  ------------------
  |  Branch (195:14): [True: 0, False: 6]
  ------------------
  196|       |
  197|       |      /* And the following is always safe because the crc is only 32 bits. */
  198|      6|      png_ptr->crc = (png_uint_32)crc;
  199|      6|   }
  200|  20.4k|}
OSS_FUZZ_png_user_version_check:
  207|     31|{
  208|       |   /* Libpng versions 1.0.0 and later are binary compatible if the version
  209|       |    * string matches through the second '.'; we must recompile any
  210|       |    * applications that use any older library version.
  211|       |    */
  212|       |
  213|     31|   if (user_png_ver != NULL)
  ------------------
  |  Branch (213:8): [True: 31, False: 0]
  ------------------
  214|     31|   {
  215|     31|      int i = -1;
  216|     31|      int found_dots = 0;
  217|       |
  218|     31|      do
  219|    124|      {
  220|    124|         i++;
  221|    124|         if (user_png_ver[i] != PNG_LIBPNG_VER_STRING[i])
  ------------------
  |  |  277|    124|#define PNG_LIBPNG_VER_STRING "1.6.59.git"
  ------------------
  |  Branch (221:14): [True: 0, False: 124]
  ------------------
  222|      0|            png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
  ------------------
  |  |  712|      0|#define PNG_FLAG_LIBRARY_MISMATCH        0x20000U
  ------------------
  223|    124|         if (user_png_ver[i] == '.')
  ------------------
  |  Branch (223:14): [True: 62, False: 62]
  ------------------
  224|     62|            found_dots++;
  225|    124|      } while (found_dots < 2 && user_png_ver[i] != 0 &&
  ------------------
  |  Branch (225:16): [True: 93, False: 31]
  |  Branch (225:34): [True: 93, False: 0]
  ------------------
  226|     93|            PNG_LIBPNG_VER_STRING[i] != 0);
  ------------------
  |  |  277|     93|#define PNG_LIBPNG_VER_STRING "1.6.59.git"
  ------------------
  |  Branch (226:13): [True: 93, False: 0]
  ------------------
  227|     31|   }
  228|       |
  229|      0|   else
  230|      0|      png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
  ------------------
  |  |  712|      0|#define PNG_FLAG_LIBRARY_MISMATCH        0x20000U
  ------------------
  231|       |
  232|     31|   if ((png_ptr->flags & PNG_FLAG_LIBRARY_MISMATCH) != 0)
  ------------------
  |  |  712|     31|#define PNG_FLAG_LIBRARY_MISMATCH        0x20000U
  ------------------
  |  Branch (232:8): [True: 0, False: 31]
  ------------------
  233|      0|   {
  234|      0|#ifdef PNG_WARNINGS_SUPPORTED
  235|      0|      size_t pos = 0;
  236|      0|      char m[128];
  237|       |
  238|      0|      pos = png_safecat(m, (sizeof m), pos,
  ------------------
  |  |   75|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  239|      0|          "Application built with libpng-");
  240|      0|      pos = png_safecat(m, (sizeof m), pos, user_png_ver);
  ------------------
  |  |   75|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  241|      0|      pos = png_safecat(m, (sizeof m), pos, " but running with ");
  ------------------
  |  |   75|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  242|      0|      pos = png_safecat(m, (sizeof m), pos, PNG_LIBPNG_VER_STRING);
  ------------------
  |  |   75|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
                    pos = png_safecat(m, (sizeof m), pos, PNG_LIBPNG_VER_STRING);
  ------------------
  |  |  277|      0|#define PNG_LIBPNG_VER_STRING "1.6.59.git"
  ------------------
  243|      0|      PNG_UNUSED(pos)
  ------------------
  |  |  479|      0|#  define PNG_UNUSED(param) (void)param;
  ------------------
  244|       |
  245|      0|      png_warning(png_ptr, m);
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  246|      0|#endif
  247|       |
  248|      0|      return 0;
  249|      0|   }
  250|       |
  251|       |   /* Success return. */
  252|     31|   return 1;
  253|     31|}
OSS_FUZZ_png_create_png_struct:
  263|     31|{
  264|     31|   png_struct create_struct;
  265|     31|#  ifdef PNG_SETJMP_SUPPORTED
  266|     31|      jmp_buf create_jmp_buf;
  267|     31|#  endif
  268|       |
  269|       |   /* This temporary stack-allocated structure is used to provide a place to
  270|       |    * build enough context to allow the user provided memory allocator (if any)
  271|       |    * to be called.
  272|       |    */
  273|     31|   memset(&create_struct, 0, (sizeof create_struct));
  274|       |
  275|     31|#  ifdef PNG_USER_LIMITS_SUPPORTED
  276|     31|      create_struct.user_width_max = PNG_USER_WIDTH_MAX;
  ------------------
  |  |  225|     31|#define PNG_USER_WIDTH_MAX 1000000
  ------------------
  277|     31|      create_struct.user_height_max = PNG_USER_HEIGHT_MAX;
  ------------------
  |  |  224|     31|#define PNG_USER_HEIGHT_MAX 1000000
  ------------------
  278|       |
  279|     31|#     ifdef PNG_USER_CHUNK_CACHE_MAX
  280|     31|      create_struct.user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;
  ------------------
  |  |  222|     31|#define PNG_USER_CHUNK_CACHE_MAX 1000
  ------------------
  281|     31|#     endif
  282|       |
  283|     31|#     if PNG_USER_CHUNK_MALLOC_MAX > 0 /* default to compile-time limit */
  284|     31|      create_struct.user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;
  ------------------
  |  |  223|     31|#define PNG_USER_CHUNK_MALLOC_MAX 8000000
  ------------------
  285|       |
  286|       |      /* No compile-time limit, so initialize to the system limit: */
  287|       |#     elif defined PNG_MAX_MALLOC_64K /* legacy system limit */
  288|       |      create_struct.user_chunk_malloc_max = 65536U;
  289|       |
  290|       |#     else /* modern system limit SIZE_MAX (C99) */
  291|       |      create_struct.user_chunk_malloc_max = PNG_SIZE_MAX;
  292|       |#     endif
  293|     31|#  endif
  294|       |
  295|       |   /* The following two API calls simply set fields in png_struct, so it is safe
  296|       |    * to do them now even though error handling is not yet set up.
  297|       |    */
  298|     31|#  ifdef PNG_USER_MEM_SUPPORTED
  299|     31|      png_set_mem_fn(&create_struct, mem_ptr, malloc_fn, free_fn);
  ------------------
  |  |  407|     31|#define png_set_mem_fn OSS_FUZZ_png_set_mem_fn
  ------------------
  300|       |#  else
  301|       |      PNG_UNUSED(mem_ptr)
  302|       |      PNG_UNUSED(malloc_fn)
  303|       |      PNG_UNUSED(free_fn)
  304|       |#  endif
  305|       |
  306|       |   /* (*error_fn) can return control to the caller after the error_ptr is set,
  307|       |    * this will result in a memory leak unless the error_fn does something
  308|       |    * extremely sophisticated.  The design lacks merit but is implicit in the
  309|       |    * API.
  310|       |    */
  311|     31|   png_set_error_fn(&create_struct, error_ptr, error_fn, warn_fn);
  ------------------
  |  |  387|     31|#define png_set_error_fn OSS_FUZZ_png_set_error_fn
  ------------------
  312|       |
  313|     31|#  ifdef PNG_SETJMP_SUPPORTED
  314|     31|      if (!setjmp(create_jmp_buf))
  ------------------
  |  Branch (314:11): [True: 31, False: 0]
  ------------------
  315|     31|#  endif
  316|     31|      {
  317|     31|#  ifdef PNG_SETJMP_SUPPORTED
  318|       |         /* Temporarily fake out the longjmp information until we have
  319|       |          * successfully completed this function.  This only works if we have
  320|       |          * setjmp() support compiled in, but it is safe - this stuff should
  321|       |          * never happen.
  322|       |          */
  323|     31|         create_struct.jmp_buf_ptr = &create_jmp_buf;
  324|     31|         create_struct.jmp_buf_size = 0; /*stack allocation*/
  325|     31|         create_struct.longjmp_fn = longjmp;
  326|     31|#  endif
  327|       |         /* Call the general version checker (shared with read and write code):
  328|       |          */
  329|     31|         if (png_user_version_check(&create_struct, user_png_ver) != 0)
  ------------------
  |  |    7|     31|#define png_user_version_check OSS_FUZZ_png_user_version_check
  ------------------
  |  Branch (329:14): [True: 31, False: 0]
  ------------------
  330|     31|         {
  331|     31|            png_structrp png_ptr = png_voidcast(png_structrp,
  ------------------
  |  |  535|     31|#  define png_voidcast(type, value) (value)
  ------------------
  332|     31|                png_malloc_warn(&create_struct, (sizeof *png_ptr)));
  333|       |
  334|     31|            if (png_ptr != NULL)
  ------------------
  |  Branch (334:17): [True: 31, False: 0]
  ------------------
  335|     31|            {
  336|       |               /* png_ptr->zstream holds a back-pointer to the png_struct, so
  337|       |                * this can only be done now:
  338|       |                */
  339|     31|               create_struct.zstream.zalloc = png_zalloc;
  ------------------
  |  |   14|     31|#define png_zalloc OSS_FUZZ_png_zalloc
  ------------------
  340|     31|               create_struct.zstream.zfree = png_zfree;
  ------------------
  |  |   15|     31|#define png_zfree OSS_FUZZ_png_zfree
  ------------------
  341|     31|               create_struct.zstream.opaque = png_ptr;
  342|       |
  343|     31|#              ifdef PNG_SETJMP_SUPPORTED
  344|       |               /* Eliminate the local error handling: */
  345|     31|               create_struct.jmp_buf_ptr = NULL;
  346|     31|               create_struct.jmp_buf_size = 0;
  347|     31|               create_struct.longjmp_fn = 0;
  348|     31|#              endif
  349|       |
  350|     31|               *png_ptr = create_struct;
  351|       |
  352|       |               /* This is the successful return point */
  353|     31|               return png_ptr;
  354|     31|            }
  355|     31|         }
  356|     31|      }
  357|       |
  358|       |   /* A longjmp because of a bug in the application storage allocator or a
  359|       |    * simple failure to allocate the png_struct.
  360|       |    */
  361|      0|   return NULL;
  362|     31|}
OSS_FUZZ_png_create_info_struct:
  368|     50|{
  369|     50|   png_inforp info_ptr;
  370|       |
  371|     50|   png_debug(1, "in png_create_info_struct");
  ------------------
  |  |  145|     50|#  define png_debug(l, m) ((void)0)
  ------------------
  372|       |
  373|     50|   if (png_ptr == NULL)
  ------------------
  |  Branch (373:8): [True: 0, False: 50]
  ------------------
  374|      0|      return NULL;
  375|       |
  376|       |   /* Use the internal API that does not (or at least should not) error out, so
  377|       |    * that this call always returns ok.  The application typically sets up the
  378|       |    * error handling *after* creating the info_struct because this is the way it
  379|       |    * has always been done in 'example.c'.
  380|       |    */
  381|     50|   info_ptr = png_voidcast(png_inforp, png_malloc_base(png_ptr,
  ------------------
  |  |  535|     50|#  define png_voidcast(type, value) (value)
  ------------------
  382|     50|       (sizeof *info_ptr)));
  383|       |
  384|     50|   if (info_ptr != NULL)
  ------------------
  |  Branch (384:8): [True: 38, False: 12]
  ------------------
  385|     38|      memset(info_ptr, 0, (sizeof *info_ptr));
  386|       |
  387|     50|   return info_ptr;
  388|     50|}
OSS_FUZZ_png_destroy_info_struct:
  400|     62|{
  401|     62|   png_inforp info_ptr = NULL;
  402|       |
  403|     62|   png_debug(1, "in png_destroy_info_struct");
  ------------------
  |  |  145|     62|#  define png_debug(l, m) ((void)0)
  ------------------
  404|       |
  405|     62|   if (png_ptr == NULL)
  ------------------
  |  Branch (405:8): [True: 0, False: 62]
  ------------------
  406|      0|      return;
  407|       |
  408|     62|   if (info_ptr_ptr != NULL)
  ------------------
  |  Branch (408:8): [True: 38, False: 24]
  ------------------
  409|     38|      info_ptr = *info_ptr_ptr;
  410|       |
  411|     62|   if (info_ptr != NULL)
  ------------------
  |  Branch (411:8): [True: 38, False: 24]
  ------------------
  412|     38|   {
  413|       |      /* Do this first in case of an error below; if the app implements its own
  414|       |       * memory management this can lead to png_free calling png_error, which
  415|       |       * will abort this routine and return control to the app error handler.
  416|       |       * An infinite loop may result if it then tries to free the same info
  417|       |       * ptr.
  418|       |       */
  419|     38|      *info_ptr_ptr = NULL;
  420|       |
  421|     38|      png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);
  ------------------
  |  |  254|     38|#define png_free_data OSS_FUZZ_png_free_data
  ------------------
                    png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);
  ------------------
  |  | 1852|     38|#define PNG_FREE_ALL  0xffffU
  ------------------
  422|     38|      memset(info_ptr, 0, (sizeof *info_ptr));
  423|     38|      png_free(png_ptr, info_ptr);
  ------------------
  |  |  253|     38|#define png_free OSS_FUZZ_png_free
  ------------------
  424|     38|   }
  425|     62|}
OSS_FUZZ_png_free_data:
  485|     38|{
  486|     38|   png_debug(1, "in png_free_data");
  ------------------
  |  |  145|     38|#  define png_debug(l, m) ((void)0)
  ------------------
  487|       |
  488|     38|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (488:8): [True: 0, False: 38]
  |  Branch (488:27): [True: 0, False: 38]
  ------------------
  489|      0|      return;
  490|       |
  491|     38|#ifdef PNG_TEXT_SUPPORTED
  492|       |   /* Free text item num or (if num == -1) all text items */
  493|     38|   if (info_ptr->text != NULL &&
  ------------------
  |  Branch (493:8): [True: 5, False: 33]
  ------------------
  494|      5|       ((mask & PNG_FREE_TEXT) & info_ptr->free_me) != 0)
  ------------------
  |  | 1850|      5|#define PNG_FREE_TEXT 0x4000U
  ------------------
  |  Branch (494:8): [True: 5, False: 0]
  ------------------
  495|      5|   {
  496|      5|      if (num != -1)
  ------------------
  |  Branch (496:11): [True: 0, False: 5]
  ------------------
  497|      0|      {
  498|      0|         png_free(png_ptr, info_ptr->text[num].key);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  499|      0|         info_ptr->text[num].key = NULL;
  500|      0|      }
  501|       |
  502|      5|      else
  503|      5|      {
  504|      5|         int i;
  505|       |
  506|    499|         for (i = 0; i < info_ptr->num_text; i++)
  ------------------
  |  Branch (506:22): [True: 494, False: 5]
  ------------------
  507|    494|            png_free(png_ptr, info_ptr->text[i].key);
  ------------------
  |  |  253|    494|#define png_free OSS_FUZZ_png_free
  ------------------
  508|       |
  509|      5|         png_free(png_ptr, info_ptr->text);
  ------------------
  |  |  253|      5|#define png_free OSS_FUZZ_png_free
  ------------------
  510|      5|         info_ptr->text = NULL;
  511|      5|         info_ptr->num_text = 0;
  512|      5|         info_ptr->max_text = 0;
  513|      5|      }
  514|      5|   }
  515|     38|#endif
  516|       |
  517|     38|#ifdef PNG_tRNS_SUPPORTED
  518|       |   /* Free any tRNS entry */
  519|     38|   if (((mask & PNG_FREE_TRNS) & info_ptr->free_me) != 0)
  ------------------
  |  | 1849|     38|#define PNG_FREE_TRNS 0x2000U
  ------------------
  |  Branch (519:8): [True: 0, False: 38]
  ------------------
  520|      0|   {
  521|      0|      info_ptr->valid &= ~PNG_INFO_tRNS;
  ------------------
  |  |  734|      0|#define PNG_INFO_tRNS 0x0010U
  ------------------
  522|      0|      png_free(png_ptr, info_ptr->trans_alpha);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  523|      0|      info_ptr->trans_alpha = NULL;
  524|      0|      info_ptr->num_trans = 0;
  525|      0|   }
  526|     38|#endif
  527|       |
  528|     38|#ifdef PNG_sCAL_SUPPORTED
  529|       |   /* Free any sCAL entry */
  530|     38|   if (((mask & PNG_FREE_SCAL) & info_ptr->free_me) != 0)
  ------------------
  |  | 1843|     38|#define PNG_FREE_SCAL 0x0100U
  ------------------
  |  Branch (530:8): [True: 0, False: 38]
  ------------------
  531|      0|   {
  532|      0|      png_free(png_ptr, info_ptr->scal_s_width);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  533|      0|      png_free(png_ptr, info_ptr->scal_s_height);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  534|      0|      info_ptr->scal_s_width = NULL;
  535|      0|      info_ptr->scal_s_height = NULL;
  536|      0|      info_ptr->valid &= ~PNG_INFO_sCAL;
  ------------------
  |  |  744|      0|#define PNG_INFO_sCAL 0x4000U  /* ESR, 1.0.6 */
  ------------------
  537|      0|   }
  538|     38|#endif
  539|       |
  540|     38|#ifdef PNG_pCAL_SUPPORTED
  541|       |   /* Free any pCAL entry */
  542|     38|   if (((mask & PNG_FREE_PCAL) & info_ptr->free_me) != 0)
  ------------------
  |  | 1842|     38|#define PNG_FREE_PCAL 0x0080U
  ------------------
  |  Branch (542:8): [True: 0, False: 38]
  ------------------
  543|      0|   {
  544|      0|      png_free(png_ptr, info_ptr->pcal_purpose);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  545|      0|      png_free(png_ptr, info_ptr->pcal_units);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  546|      0|      info_ptr->pcal_purpose = NULL;
  547|      0|      info_ptr->pcal_units = NULL;
  548|       |
  549|      0|      if (info_ptr->pcal_params != NULL)
  ------------------
  |  Branch (549:11): [True: 0, False: 0]
  ------------------
  550|      0|         {
  551|      0|            int i;
  552|       |
  553|      0|            for (i = 0; i < info_ptr->pcal_nparams; i++)
  ------------------
  |  Branch (553:25): [True: 0, False: 0]
  ------------------
  554|      0|               png_free(png_ptr, info_ptr->pcal_params[i]);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  555|       |
  556|      0|            png_free(png_ptr, info_ptr->pcal_params);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  557|      0|            info_ptr->pcal_params = NULL;
  558|      0|         }
  559|      0|      info_ptr->valid &= ~PNG_INFO_pCAL;
  ------------------
  |  |  740|      0|#define PNG_INFO_pCAL 0x0400U
  ------------------
  560|      0|   }
  561|     38|#endif
  562|       |
  563|     38|#ifdef PNG_iCCP_SUPPORTED
  564|       |   /* Free any profile entry */
  565|     38|   if (((mask & PNG_FREE_ICCP) & info_ptr->free_me) != 0)
  ------------------
  |  | 1839|     38|#define PNG_FREE_ICCP 0x0010U
  ------------------
  |  Branch (565:8): [True: 0, False: 38]
  ------------------
  566|      0|   {
  567|      0|      png_free(png_ptr, info_ptr->iccp_name);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  568|      0|      png_free(png_ptr, info_ptr->iccp_profile);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  569|      0|      info_ptr->iccp_name = NULL;
  570|      0|      info_ptr->iccp_profile = NULL;
  571|      0|      info_ptr->valid &= ~PNG_INFO_iCCP;
  ------------------
  |  |  742|      0|#define PNG_INFO_iCCP 0x1000U  /* ESR, 1.0.6 */
  ------------------
  572|      0|   }
  573|     38|#endif
  574|       |
  575|     38|#ifdef PNG_sPLT_SUPPORTED
  576|       |   /* Free a given sPLT entry, or (if num == -1) all sPLT entries */
  577|     38|   if (info_ptr->splt_palettes != NULL &&
  ------------------
  |  Branch (577:8): [True: 2, False: 36]
  ------------------
  578|      2|       ((mask & PNG_FREE_SPLT) & info_ptr->free_me) != 0)
  ------------------
  |  | 1840|      2|#define PNG_FREE_SPLT 0x0020U
  ------------------
  |  Branch (578:8): [True: 2, False: 0]
  ------------------
  579|      2|   {
  580|      2|      if (num != -1)
  ------------------
  |  Branch (580:11): [True: 0, False: 2]
  ------------------
  581|      0|      {
  582|      0|         png_free(png_ptr, info_ptr->splt_palettes[num].name);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  583|      0|         png_free(png_ptr, info_ptr->splt_palettes[num].entries);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  584|      0|         info_ptr->splt_palettes[num].name = NULL;
  585|      0|         info_ptr->splt_palettes[num].entries = NULL;
  586|      0|      }
  587|       |
  588|      2|      else
  589|      2|      {
  590|      2|         int i;
  591|       |
  592|    253|         for (i = 0; i < info_ptr->splt_palettes_num; i++)
  ------------------
  |  Branch (592:22): [True: 251, False: 2]
  ------------------
  593|    251|         {
  594|    251|            png_free(png_ptr, info_ptr->splt_palettes[i].name);
  ------------------
  |  |  253|    251|#define png_free OSS_FUZZ_png_free
  ------------------
  595|    251|            png_free(png_ptr, info_ptr->splt_palettes[i].entries);
  ------------------
  |  |  253|    251|#define png_free OSS_FUZZ_png_free
  ------------------
  596|    251|         }
  597|       |
  598|      2|         png_free(png_ptr, info_ptr->splt_palettes);
  ------------------
  |  |  253|      2|#define png_free OSS_FUZZ_png_free
  ------------------
  599|      2|         info_ptr->splt_palettes = NULL;
  600|      2|         info_ptr->splt_palettes_num = 0;
  601|      2|         info_ptr->valid &= ~PNG_INFO_sPLT;
  ------------------
  |  |  743|      2|#define PNG_INFO_sPLT 0x2000U  /* ESR, 1.0.6 */
  ------------------
  602|      2|      }
  603|      2|   }
  604|     38|#endif
  605|       |
  606|     38|#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
  607|     38|   if (info_ptr->unknown_chunks != NULL &&
  ------------------
  |  Branch (607:8): [True: 0, False: 38]
  ------------------
  608|      0|       ((mask & PNG_FREE_UNKN) & info_ptr->free_me) != 0)
  ------------------
  |  | 1845|      0|#  define PNG_FREE_UNKN 0x0200U
  ------------------
  |  Branch (608:8): [True: 0, False: 0]
  ------------------
  609|      0|   {
  610|      0|      if (num != -1)
  ------------------
  |  Branch (610:11): [True: 0, False: 0]
  ------------------
  611|      0|      {
  612|      0|          png_free(png_ptr, info_ptr->unknown_chunks[num].data);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  613|      0|          info_ptr->unknown_chunks[num].data = NULL;
  614|      0|      }
  615|       |
  616|      0|      else
  617|      0|      {
  618|      0|         int i;
  619|       |
  620|      0|         for (i = 0; i < info_ptr->unknown_chunks_num; i++)
  ------------------
  |  Branch (620:22): [True: 0, False: 0]
  ------------------
  621|      0|            png_free(png_ptr, info_ptr->unknown_chunks[i].data);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  622|       |
  623|      0|         png_free(png_ptr, info_ptr->unknown_chunks);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  624|      0|         info_ptr->unknown_chunks = NULL;
  625|      0|         info_ptr->unknown_chunks_num = 0;
  626|      0|      }
  627|      0|   }
  628|     38|#endif
  629|       |
  630|     38|#ifdef PNG_eXIf_SUPPORTED
  631|       |   /* Free any eXIf entry */
  632|     38|   if (((mask & PNG_FREE_EXIF) & info_ptr->free_me) != 0)
  ------------------
  |  | 1851|     38|#define PNG_FREE_EXIF 0x8000U /* Added at libpng-1.6.31 */
  ------------------
  |  Branch (632:8): [True: 0, False: 38]
  ------------------
  633|      0|   {
  634|      0|      if (info_ptr->exif)
  ------------------
  |  Branch (634:11): [True: 0, False: 0]
  ------------------
  635|      0|      {
  636|      0|         png_free(png_ptr, info_ptr->exif);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  637|      0|         info_ptr->exif = NULL;
  638|      0|      }
  639|      0|      info_ptr->valid &= ~PNG_INFO_eXIf;
  ------------------
  |  |  746|      0|#define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */
  ------------------
  640|      0|   }
  641|     38|#endif
  642|       |
  643|     38|#ifdef PNG_hIST_SUPPORTED
  644|       |   /* Free any hIST entry */
  645|     38|   if (((mask & PNG_FREE_HIST) & info_ptr->free_me) != 0)
  ------------------
  |  | 1838|     38|#define PNG_FREE_HIST 0x0008U
  ------------------
  |  Branch (645:8): [True: 0, False: 38]
  ------------------
  646|      0|   {
  647|      0|      png_free(png_ptr, info_ptr->hist);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  648|      0|      info_ptr->hist = NULL;
  649|      0|      info_ptr->valid &= ~PNG_INFO_hIST;
  ------------------
  |  |  736|      0|#define PNG_INFO_hIST 0x0040U
  ------------------
  650|      0|   }
  651|     38|#endif
  652|       |
  653|       |   /* Free any PLTE entry that was internally allocated */
  654|     38|   if (((mask & PNG_FREE_PLTE) & info_ptr->free_me) != 0)
  ------------------
  |  | 1848|     38|#define PNG_FREE_PLTE 0x1000U
  ------------------
  |  Branch (654:8): [True: 0, False: 38]
  ------------------
  655|      0|   {
  656|      0|      png_free(png_ptr, info_ptr->palette);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  657|      0|      info_ptr->palette = NULL;
  658|      0|      info_ptr->valid &= ~PNG_INFO_PLTE;
  ------------------
  |  |  733|      0|#define PNG_INFO_PLTE 0x0008U
  ------------------
  659|      0|      info_ptr->num_palette = 0;
  660|      0|   }
  661|       |
  662|     38|#ifdef PNG_INFO_IMAGE_SUPPORTED
  663|       |   /* Free any image bits attached to the info structure */
  664|     38|   if (((mask & PNG_FREE_ROWS) & info_ptr->free_me) != 0)
  ------------------
  |  | 1841|     38|#define PNG_FREE_ROWS 0x0040U
  ------------------
  |  Branch (664:8): [True: 0, False: 38]
  ------------------
  665|      0|   {
  666|      0|      if (info_ptr->row_pointers != NULL)
  ------------------
  |  Branch (666:11): [True: 0, False: 0]
  ------------------
  667|      0|      {
  668|      0|         png_uint_32 row;
  669|      0|         for (row = 0; row < info_ptr->height; row++)
  ------------------
  |  Branch (669:24): [True: 0, False: 0]
  ------------------
  670|      0|            png_free(png_ptr, info_ptr->row_pointers[row]);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  671|       |
  672|      0|         png_free(png_ptr, info_ptr->row_pointers);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  673|      0|         info_ptr->row_pointers = NULL;
  674|      0|      }
  675|      0|      info_ptr->valid &= ~PNG_INFO_IDAT;
  ------------------
  |  |  745|      0|#define PNG_INFO_IDAT 0x8000U  /* ESR, 1.0.6 */
  ------------------
  676|      0|   }
  677|     38|#endif
  678|       |
  679|     38|   if (num != -1)
  ------------------
  |  Branch (679:8): [True: 0, False: 38]
  ------------------
  680|      0|      mask &= ~PNG_FREE_MUL;
  ------------------
  |  | 1853|      0|#define PNG_FREE_MUL  0x4220U /* PNG_FREE_SPLT|PNG_FREE_TEXT|PNG_FREE_UNKN */
  ------------------
  681|       |
  682|     38|   info_ptr->free_me &= ~mask;
  683|     38|}
OSS_FUZZ_png_get_io_ptr:
  692|  28.4k|{
  693|  28.4k|   if (png_ptr == NULL)
  ------------------
  |  Branch (693:8): [True: 0, False: 28.4k]
  ------------------
  694|      0|      return NULL;
  695|       |
  696|  28.4k|   return png_ptr->io_ptr;
  697|  28.4k|}
OSS_FUZZ_png_handle_as_unknown:
  932|  7.96k|{
  933|       |   /* Check chunk_name and return "keep" value if it's on the list, else 0 */
  934|  7.96k|   png_const_bytep p, p_end;
  935|       |
  936|  7.96k|   if (png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list == 0)
  ------------------
  |  Branch (936:8): [True: 0, False: 7.96k]
  |  Branch (936:27): [True: 0, False: 7.96k]
  |  Branch (936:49): [True: 7.96k, False: 0]
  ------------------
  937|  7.96k|      return PNG_HANDLE_CHUNK_AS_DEFAULT;
  ------------------
  |  | 2583|  7.96k|#define PNG_HANDLE_CHUNK_AS_DEFAULT   0
  ------------------
  938|       |
  939|      0|   p_end = png_ptr->chunk_list;
  940|      0|   p = p_end + png_ptr->num_chunk_list*5; /* beyond end */
  941|       |
  942|       |   /* The code is the fifth byte after each four byte string.  Historically this
  943|       |    * code was always searched from the end of the list, this is no longer
  944|       |    * necessary because the 'set' routine handles duplicate entries correctly.
  945|       |    */
  946|      0|   do /* num_chunk_list > 0, so at least one */
  947|      0|   {
  948|      0|      p -= 5;
  949|       |
  950|      0|      if (memcmp(chunk_name, p, 4) == 0)
  ------------------
  |  Branch (950:11): [True: 0, False: 0]
  ------------------
  951|      0|         return p[4];
  952|      0|   }
  953|      0|   while (p > p_end);
  ------------------
  |  Branch (953:11): [True: 0, False: 0]
  ------------------
  954|       |
  955|       |   /* This means that known chunks should be processed and unknown chunks should
  956|       |    * be handled according to the value of png_ptr->unknown_default; this can be
  957|       |    * confusing because, as a result, there are two levels of defaulting for
  958|       |    * unknown chunks.
  959|       |    */
  960|      0|   return PNG_HANDLE_CHUNK_AS_DEFAULT;
  ------------------
  |  | 2583|      0|#define PNG_HANDLE_CHUNK_AS_DEFAULT   0
  ------------------
  961|      0|}
OSS_FUZZ_png_chunk_unknown_handling:
  967|  7.96k|{
  968|  7.96k|   png_byte chunk_string[5];
  969|       |
  970|  7.96k|   PNG_CSTRING_FROM_CHUNK(chunk_string, chunk_name);
  ------------------
  |  |  938|  7.96k|   (void)(PNG_STRING_FROM_CHUNK(s,c), ((char*)(s))[4] = 0)
  |  |  ------------------
  |  |  |  |  931|  7.96k|   (void)(((char*)(s))[0]=(char)(((c)>>24) & 0xff), \
  |  |  |  |  932|  7.96k|   ((char*)(s))[1]=(char)(((c)>>16) & 0xff),\
  |  |  |  |  933|  7.96k|   ((char*)(s))[2]=(char)(((c)>>8) & 0xff), \
  |  |  |  |  934|  7.96k|   ((char*)(s))[3]=(char)((c & 0xff)))
  |  |  ------------------
  ------------------
  971|  7.96k|   return png_handle_as_unknown(png_ptr, chunk_string);
  ------------------
  |  |  341|  7.96k|#define png_handle_as_unknown OSS_FUZZ_png_handle_as_unknown
  ------------------
  972|  7.96k|}
OSS_FUZZ_png_zstream_error:
 1004|  4.56k|{
 1005|       |   /* Translate 'ret' into an appropriate error string, priority is given to the
 1006|       |    * one in zstream if set.  This always returns a string, even in cases like
 1007|       |    * Z_OK or Z_STREAM_END where the error code is a success code.
 1008|       |    */
 1009|  4.56k|   if (png_ptr->zstream.msg == NULL) switch (ret)
  ------------------
  |  Branch (1009:8): [True: 3.41k, False: 1.14k]
  ------------------
 1010|  3.41k|   {
 1011|      0|      default:
  ------------------
  |  Branch (1011:7): [True: 0, False: 3.41k]
  ------------------
 1012|  3.41k|      case Z_OK:
  ------------------
  |  Branch (1012:7): [True: 3.41k, False: 1]
  ------------------
 1013|  3.41k|         png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected zlib return code");
  ------------------
  |  |   40|  3.41k|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1014|  3.41k|         break;
 1015|       |
 1016|      0|      case Z_STREAM_END:
  ------------------
  |  Branch (1016:7): [True: 0, False: 3.41k]
  ------------------
 1017|       |         /* Normal exit */
 1018|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected end of LZ stream");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1019|      0|         break;
 1020|       |
 1021|      0|      case Z_NEED_DICT:
  ------------------
  |  Branch (1021:7): [True: 0, False: 3.41k]
  ------------------
 1022|       |         /* This means the deflate stream did not have a dictionary; this
 1023|       |          * indicates a bogus PNG.
 1024|       |          */
 1025|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("missing LZ dictionary");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1026|      0|         break;
 1027|       |
 1028|      0|      case Z_ERRNO:
  ------------------
  |  Branch (1028:7): [True: 0, False: 3.41k]
  ------------------
 1029|       |         /* gz APIs only: should not happen */
 1030|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("zlib IO error");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1031|      0|         break;
 1032|       |
 1033|      0|      case Z_STREAM_ERROR:
  ------------------
  |  Branch (1033:7): [True: 0, False: 3.41k]
  ------------------
 1034|       |         /* internal libpng error */
 1035|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("bad parameters to zlib");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1036|      0|         break;
 1037|       |
 1038|      0|      case Z_DATA_ERROR:
  ------------------
  |  Branch (1038:7): [True: 0, False: 3.41k]
  ------------------
 1039|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("damaged LZ stream");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1040|      0|         break;
 1041|       |
 1042|      1|      case Z_MEM_ERROR:
  ------------------
  |  Branch (1042:7): [True: 1, False: 3.41k]
  ------------------
 1043|      1|         png_ptr->zstream.msg = PNGZ_MSG_CAST("insufficient memory");
  ------------------
  |  |   40|      1|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1044|      1|         break;
 1045|       |
 1046|      0|      case Z_BUF_ERROR:
  ------------------
  |  Branch (1046:7): [True: 0, False: 3.41k]
  ------------------
 1047|       |         /* End of input or output; not a problem if the caller is doing
 1048|       |          * incremental read or write.
 1049|       |          */
 1050|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("truncated");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1051|      0|         break;
 1052|       |
 1053|      0|      case Z_VERSION_ERROR:
  ------------------
  |  Branch (1053:7): [True: 0, False: 3.41k]
  ------------------
 1054|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("unsupported zlib version");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1055|      0|         break;
 1056|       |
 1057|      0|      case PNG_UNEXPECTED_ZLIB_RETURN:
  ------------------
  |  | 1077|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  |  Branch (1057:7): [True: 0, False: 3.41k]
  ------------------
 1058|       |         /* Compile errors here mean that zlib now uses the value co-opted in
 1059|       |          * pngpriv.h for PNG_UNEXPECTED_ZLIB_RETURN; update the switch above
 1060|       |          * and change pngpriv.h.  Note that this message is "... return",
 1061|       |          * whereas the default/Z_OK one is "... return code".
 1062|       |          */
 1063|      0|         png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected zlib return");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
 1064|      0|         break;
 1065|  3.41k|   }
 1066|  4.56k|}
OSS_FUZZ_png_icc_check_length:
 1596|  3.41k|{
 1597|  3.41k|   if (!icc_check_length(png_ptr, name, profile_length))
  ------------------
  |  Branch (1597:8): [True: 0, False: 3.41k]
  ------------------
 1598|      0|      return 0;
 1599|       |
 1600|       |   /* This needs to be here because the 'normal' check is in
 1601|       |    * png_decompress_chunk, yet this happens after the attempt to
 1602|       |    * png_malloc_base the required data.  We only need this on read; on write
 1603|       |    * the caller supplies the profile buffer so libpng doesn't allocate it.  See
 1604|       |    * the call to icc_check_length below (the write case).
 1605|       |    */
 1606|  3.41k|   if (profile_length > png_chunk_max(png_ptr))
  ------------------
  |  | 1126|  3.41k|#  define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max)
  ------------------
  |  Branch (1606:8): [True: 979, False: 2.43k]
  ------------------
 1607|    979|      return png_icc_profile_error(png_ptr, name, profile_length,
 1608|    979|            "profile too long");
 1609|       |
 1610|  2.43k|   return 1;
 1611|  3.41k|}
OSS_FUZZ_png_icc_check_header:
 1617|  2.43k|{
 1618|  2.43k|   png_uint_32 temp;
 1619|       |
 1620|       |   /* Length check; this cannot be ignored in this code because profile_length
 1621|       |    * is used later to check the tag table, so even if the profile seems over
 1622|       |    * long profile_length from the caller must be correct.  The caller can fix
 1623|       |    * this up on read or write by just passing in the profile header length.
 1624|       |    */
 1625|  2.43k|   temp = png_get_uint_32(profile);
  ------------------
  |  |  322|  2.43k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|  2.43k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|  2.43k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|  2.43k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|  2.43k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|  2.43k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1626|  2.43k|   if (temp != profile_length)
  ------------------
  |  Branch (1626:8): [True: 0, False: 2.43k]
  ------------------
 1627|      0|      return png_icc_profile_error(png_ptr, name, temp,
 1628|      0|          "length does not match profile");
 1629|       |
 1630|  2.43k|   temp = (png_uint_32) (*(profile+8));
 1631|  2.43k|   if (temp > 3 && (profile_length & 3))
  ------------------
  |  Branch (1631:8): [True: 2.43k, False: 0]
  |  Branch (1631:20): [True: 0, False: 2.43k]
  ------------------
 1632|      0|      return png_icc_profile_error(png_ptr, name, profile_length,
 1633|      0|          "invalid length");
 1634|       |
 1635|  2.43k|   temp = png_get_uint_32(profile+128); /* tag count: 12 bytes/tag */
  ------------------
  |  |  322|  2.43k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|  2.43k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|  2.43k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|  2.43k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|  2.43k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|  2.43k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1636|  2.43k|   if (temp > 357913930 || /* (2^32-4-132)/12: maximum possible tag count */
  ------------------
  |  Branch (1636:8): [True: 2.43k, False: 0]
  ------------------
 1637|      0|      profile_length < 132+12*temp) /* truncated tag table */
  ------------------
  |  Branch (1637:7): [True: 0, False: 0]
  ------------------
 1638|  2.43k|      return png_icc_profile_error(png_ptr, name, temp,
 1639|  2.43k|          "tag count too large");
 1640|       |
 1641|       |   /* The 'intent' must be valid or we can't store it, ICC limits the intent to
 1642|       |    * 16 bits.
 1643|       |    */
 1644|      0|   temp = png_get_uint_32(profile+64);
  ------------------
  |  |  322|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1645|      0|   if (temp >= 0xffff) /* The ICC limit */
  ------------------
  |  Branch (1645:8): [True: 0, False: 0]
  ------------------
 1646|      0|      return png_icc_profile_error(png_ptr, name, temp,
 1647|      0|          "invalid rendering intent");
 1648|       |
 1649|       |   /* This is just a warning because the profile may be valid in future
 1650|       |    * versions.
 1651|       |    */
 1652|      0|   if (temp >= PNG_sRGB_INTENT_LAST)
  ------------------
  |  |  717|      0|#define PNG_sRGB_INTENT_LAST       4 /* Not a valid value */
  ------------------
  |  Branch (1652:8): [True: 0, False: 0]
  ------------------
 1653|      0|      (void)png_icc_profile_error(png_ptr, name, temp,
 1654|      0|          "intent outside defined range");
 1655|       |
 1656|       |   /* At this point the tag table can't be checked because it hasn't necessarily
 1657|       |    * been loaded; however, various header fields can be checked.  These checks
 1658|       |    * are for values permitted by the PNG spec in an ICC profile; the PNG spec
 1659|       |    * restricts the profiles that can be passed in an iCCP chunk (they must be
 1660|       |    * appropriate to processing PNG data!)
 1661|       |    */
 1662|       |
 1663|       |   /* Data checks (could be skipped).  These checks must be independent of the
 1664|       |    * version number; however, the version number doesn't accommodate changes in
 1665|       |    * the header fields (just the known tags and the interpretation of the
 1666|       |    * data.)
 1667|       |    */
 1668|      0|   temp = png_get_uint_32(profile+36); /* signature 'ascp' */
  ------------------
  |  |  322|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1669|      0|   if (temp != 0x61637370)
  ------------------
  |  Branch (1669:8): [True: 0, False: 0]
  ------------------
 1670|      0|      return png_icc_profile_error(png_ptr, name, temp,
 1671|      0|          "invalid signature");
 1672|       |
 1673|       |   /* Currently the PCS illuminant/adopted white point (the computational
 1674|       |    * white point) are required to be D50,
 1675|       |    * however the profile contains a record of the illuminant so perhaps ICC
 1676|       |    * expects to be able to change this in the future (despite the rationale in
 1677|       |    * the introduction for using a fixed PCS adopted white.)  Consequently the
 1678|       |    * following is just a warning.
 1679|       |    */
 1680|      0|   if (memcmp(profile+68, D50_nCIEXYZ, 12) != 0)
  ------------------
  |  Branch (1680:8): [True: 0, False: 0]
  ------------------
 1681|      0|      (void)png_icc_profile_error(png_ptr, name, 0/*no tag value*/,
 1682|      0|          "PCS illuminant is not D50");
 1683|       |
 1684|       |   /* The PNG spec requires this:
 1685|       |    * "If the iCCP chunk is present, the image samples conform to the colour
 1686|       |    * space represented by the embedded ICC profile as defined by the
 1687|       |    * International Color Consortium [ICC]. The colour space of the ICC profile
 1688|       |    * shall be an RGB colour space for colour images (PNG colour types 2, 3, and
 1689|       |    * 6), or a greyscale colour space for greyscale images (PNG colour types 0
 1690|       |    * and 4)."
 1691|       |    *
 1692|       |    * This checking code ensures the embedded profile (on either read or write)
 1693|       |    * conforms to the specification requirements.  Notice that an ICC 'gray'
 1694|       |    * color-space profile contains the information to transform the monochrome
 1695|       |    * data to XYZ or L*a*b (according to which PCS the profile uses) and this
 1696|       |    * should be used in preference to the standard libpng K channel replication
 1697|       |    * into R, G and B channels.
 1698|       |    *
 1699|       |    * Previously it was suggested that an RGB profile on grayscale data could be
 1700|       |    * handled.  However it is clear that using an RGB profile in this context
 1701|       |    * must be an error - there is no specification of what it means.  Thus it is
 1702|       |    * almost certainly more correct to ignore the profile.
 1703|       |    */
 1704|      0|   temp = png_get_uint_32(profile+16); /* data colour space field */
  ------------------
  |  |  322|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1705|      0|   switch (temp)
 1706|      0|   {
 1707|      0|      case 0x52474220: /* 'RGB ' */
  ------------------
  |  Branch (1707:7): [True: 0, False: 0]
  ------------------
 1708|      0|         if ((color_type & PNG_COLOR_MASK_COLOR) == 0)
  ------------------
  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (1708:14): [True: 0, False: 0]
  ------------------
 1709|      0|            return png_icc_profile_error(png_ptr, name, temp,
 1710|      0|                "RGB color space not permitted on grayscale PNG");
 1711|      0|         break;
 1712|       |
 1713|      0|      case 0x47524159: /* 'GRAY' */
  ------------------
  |  Branch (1713:7): [True: 0, False: 0]
  ------------------
 1714|      0|         if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
  ------------------
  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (1714:14): [True: 0, False: 0]
  ------------------
 1715|      0|            return png_icc_profile_error(png_ptr, name, temp,
 1716|      0|                "Gray color space not permitted on RGB PNG");
 1717|      0|         break;
 1718|       |
 1719|      0|      default:
  ------------------
  |  Branch (1719:7): [True: 0, False: 0]
  ------------------
 1720|      0|         return png_icc_profile_error(png_ptr, name, temp,
 1721|      0|             "invalid ICC profile color space");
 1722|      0|   }
 1723|       |
 1724|       |   /* It is up to the application to check that the profile class matches the
 1725|       |    * application requirements; the spec provides no guidance, but it's pretty
 1726|       |    * weird if the profile is not scanner ('scnr'), monitor ('mntr'), printer
 1727|       |    * ('prtr') or 'spac' (for generic color spaces).  Issue a warning in these
 1728|       |    * cases.  Issue an error for device link or abstract profiles - these don't
 1729|       |    * contain the records necessary to transform the color-space to anything
 1730|       |    * other than the target device (and not even that for an abstract profile).
 1731|       |    * Profiles of these classes may not be embedded in images.
 1732|       |    */
 1733|      0|   temp = png_get_uint_32(profile+12); /* profile/device class */
  ------------------
  |  |  322|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1734|      0|   switch (temp)
 1735|      0|   {
 1736|      0|      case 0x73636e72: /* 'scnr' */
  ------------------
  |  Branch (1736:7): [True: 0, False: 0]
  ------------------
 1737|      0|      case 0x6d6e7472: /* 'mntr' */
  ------------------
  |  Branch (1737:7): [True: 0, False: 0]
  ------------------
 1738|      0|      case 0x70727472: /* 'prtr' */
  ------------------
  |  Branch (1738:7): [True: 0, False: 0]
  ------------------
 1739|      0|      case 0x73706163: /* 'spac' */
  ------------------
  |  Branch (1739:7): [True: 0, False: 0]
  ------------------
 1740|       |         /* All supported */
 1741|      0|         break;
 1742|       |
 1743|      0|      case 0x61627374: /* 'abst' */
  ------------------
  |  Branch (1743:7): [True: 0, False: 0]
  ------------------
 1744|       |         /* May not be embedded in an image */
 1745|      0|         return png_icc_profile_error(png_ptr, name, temp,
 1746|      0|             "invalid embedded Abstract ICC profile");
 1747|       |
 1748|      0|      case 0x6c696e6b: /* 'link' */
  ------------------
  |  Branch (1748:7): [True: 0, False: 0]
  ------------------
 1749|       |         /* DeviceLink profiles cannot be interpreted in a non-device specific
 1750|       |          * fashion, if an app uses the AToB0Tag in the profile the results are
 1751|       |          * undefined unless the result is sent to the intended device,
 1752|       |          * therefore a DeviceLink profile should not be found embedded in a
 1753|       |          * PNG.
 1754|       |          */
 1755|      0|         return png_icc_profile_error(png_ptr, name, temp,
 1756|      0|             "unexpected DeviceLink ICC profile class");
 1757|       |
 1758|      0|      case 0x6e6d636c: /* 'nmcl' */
  ------------------
  |  Branch (1758:7): [True: 0, False: 0]
  ------------------
 1759|       |         /* A NamedColor profile is also device specific, however it doesn't
 1760|       |          * contain an AToB0 tag that is open to misinterpretation.  Almost
 1761|       |          * certainly it will fail the tests below.
 1762|       |          */
 1763|      0|         (void)png_icc_profile_error(png_ptr, name, temp,
 1764|      0|             "unexpected NamedColor ICC profile class");
 1765|      0|         break;
 1766|       |
 1767|      0|      default:
  ------------------
  |  Branch (1767:7): [True: 0, False: 0]
  ------------------
 1768|       |         /* To allow for future enhancements to the profile accept unrecognized
 1769|       |          * profile classes with a warning, these then hit the test below on the
 1770|       |          * tag content to ensure they are backward compatible with one of the
 1771|       |          * understood profiles.
 1772|       |          */
 1773|      0|         (void)png_icc_profile_error(png_ptr, name, temp,
 1774|      0|             "unrecognized ICC profile class");
 1775|      0|         break;
 1776|      0|   }
 1777|       |
 1778|       |   /* For any profile other than a device link one the PCS must be encoded
 1779|       |    * either in XYZ or Lab.
 1780|       |    */
 1781|      0|   temp = png_get_uint_32(profile+20);
  ------------------
  |  |  322|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1782|      0|   switch (temp)
 1783|      0|   {
 1784|      0|      case 0x58595a20: /* 'XYZ ' */
  ------------------
  |  Branch (1784:7): [True: 0, False: 0]
  ------------------
 1785|      0|      case 0x4c616220: /* 'Lab ' */
  ------------------
  |  Branch (1785:7): [True: 0, False: 0]
  ------------------
 1786|      0|         break;
 1787|       |
 1788|      0|      default:
  ------------------
  |  Branch (1788:7): [True: 0, False: 0]
  ------------------
 1789|      0|         return png_icc_profile_error(png_ptr, name, temp,
 1790|      0|             "unexpected ICC PCS encoding");
 1791|      0|   }
 1792|       |
 1793|      0|   return 1;
 1794|      0|}
OSS_FUZZ_png_check_IHDR:
 1965|     19|{
 1966|     19|   int error = 0;
 1967|       |
 1968|       |   /* Check for width and height valid values */
 1969|     19|   if (width == 0)
  ------------------
  |  Branch (1969:8): [True: 0, False: 19]
  ------------------
 1970|      0|   {
 1971|      0|      png_warning(png_ptr, "Image width is zero in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1972|      0|      error = 1;
 1973|      0|   }
 1974|       |
 1975|     19|   if (width > PNG_UINT_31_MAX)
  ------------------
  |  |  647|     19|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
  |  Branch (1975:8): [True: 0, False: 19]
  ------------------
 1976|      0|   {
 1977|      0|      png_warning(png_ptr, "Invalid image width in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1978|      0|      error = 1;
 1979|      0|   }
 1980|       |
 1981|       |   /* The bit mask on the first line below must be at least as big as a
 1982|       |    * png_uint_32.  "~7U" is not adequate on 16-bit systems because it will
 1983|       |    * be an unsigned 16-bit value.  Casting to (png_alloc_size_t) makes the
 1984|       |    * type of the result at least as bit (in bits) as the RHS of the > operator
 1985|       |    * which also avoids a common warning on 64-bit systems that the comparison
 1986|       |    * of (png_uint_32) against the constant value on the RHS will always be
 1987|       |    * false.
 1988|       |    */
 1989|     19|   if (((width + 7) & ~(png_alloc_size_t)7) >
  ------------------
  |  Branch (1989:8): [True: 0, False: 19]
  ------------------
 1990|     19|       (((PNG_SIZE_MAX
  ------------------
  |  |  649|     19|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
 1991|     19|           - 48        /* big_row_buf hack */
 1992|     19|           - 1)        /* filter byte */
 1993|     19|           / 8)        /* 8-byte RGBA pixels */
 1994|     19|           - 1))       /* extra max_pixel_depth pad */
 1995|      0|   {
 1996|       |      /* The size of the row must be within the limits of this architecture.
 1997|       |       * Because the read code can perform arbitrary transformations the
 1998|       |       * maximum size is checked here.  Because the code in png_read_start_row
 1999|       |       * adds extra space "for safety's sake" in several places a conservative
 2000|       |       * limit is used here.
 2001|       |       *
 2002|       |       * NOTE: it would be far better to check the size that is actually used,
 2003|       |       * but the effect in the real world is minor and the changes are more
 2004|       |       * extensive, therefore much more dangerous and much more difficult to
 2005|       |       * write in a way that avoids compiler warnings.
 2006|       |       */
 2007|      0|      png_warning(png_ptr, "Image width is too large for this architecture");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2008|      0|      error = 1;
 2009|      0|   }
 2010|       |
 2011|     19|#ifdef PNG_SET_USER_LIMITS_SUPPORTED
 2012|     19|   if (width > png_ptr->user_width_max)
  ------------------
  |  Branch (2012:8): [True: 0, False: 19]
  ------------------
 2013|       |#else
 2014|       |   if (width > PNG_USER_WIDTH_MAX)
 2015|       |#endif
 2016|      0|   {
 2017|      0|      png_warning(png_ptr, "Image width exceeds user limit in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2018|      0|      error = 1;
 2019|      0|   }
 2020|       |
 2021|     19|   if (height == 0)
  ------------------
  |  Branch (2021:8): [True: 0, False: 19]
  ------------------
 2022|      0|   {
 2023|      0|      png_warning(png_ptr, "Image height is zero in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2024|      0|      error = 1;
 2025|      0|   }
 2026|       |
 2027|     19|   if (height > PNG_UINT_31_MAX)
  ------------------
  |  |  647|     19|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
  |  Branch (2027:8): [True: 0, False: 19]
  ------------------
 2028|      0|   {
 2029|      0|      png_warning(png_ptr, "Invalid image height in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2030|      0|      error = 1;
 2031|      0|   }
 2032|       |
 2033|     19|#ifdef PNG_SET_USER_LIMITS_SUPPORTED
 2034|     19|   if (height > png_ptr->user_height_max)
  ------------------
  |  Branch (2034:8): [True: 0, False: 19]
  ------------------
 2035|       |#else
 2036|       |   if (height > PNG_USER_HEIGHT_MAX)
 2037|       |#endif
 2038|      0|   {
 2039|      0|      png_warning(png_ptr, "Image height exceeds user limit in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2040|      0|      error = 1;
 2041|      0|   }
 2042|       |
 2043|       |   /* Check other values */
 2044|     19|   if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 &&
  ------------------
  |  Branch (2044:8): [True: 9, False: 10]
  |  Branch (2044:26): [True: 9, False: 0]
  |  Branch (2044:44): [True: 0, False: 9]
  ------------------
 2045|      0|       bit_depth != 8 && bit_depth != 16)
  ------------------
  |  Branch (2045:8): [True: 0, False: 0]
  |  Branch (2045:26): [True: 0, False: 0]
  ------------------
 2046|      0|   {
 2047|      0|      png_warning(png_ptr, "Invalid bit depth in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2048|      0|      error = 1;
 2049|      0|   }
 2050|       |
 2051|     19|   if (color_type < 0 || color_type == 1 ||
  ------------------
  |  Branch (2051:8): [True: 0, False: 19]
  |  Branch (2051:26): [True: 0, False: 19]
  ------------------
 2052|     19|       color_type == 5 || color_type > 6)
  ------------------
  |  Branch (2052:8): [True: 0, False: 19]
  |  Branch (2052:27): [True: 0, False: 19]
  ------------------
 2053|      0|   {
 2054|      0|      png_warning(png_ptr, "Invalid color type in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2055|      0|      error = 1;
 2056|      0|   }
 2057|       |
 2058|     19|   if (((color_type == PNG_COLOR_TYPE_PALETTE) && bit_depth > 8) ||
  ------------------
  |  |  667|     19|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|     19|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|     19|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (2058:9): [True: 0, False: 19]
  |  Branch (2058:51): [True: 0, False: 0]
  ------------------
 2059|     19|       ((color_type == PNG_COLOR_TYPE_RGB ||
  ------------------
  |  |  668|     38|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  662|     19|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (2059:10): [True: 0, False: 19]
  ------------------
 2060|     19|         color_type == PNG_COLOR_TYPE_GRAY_ALPHA ||
  ------------------
  |  |  670|     38|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|     19|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (2060:10): [True: 0, False: 19]
  ------------------
 2061|     19|         color_type == PNG_COLOR_TYPE_RGB_ALPHA) && bit_depth < 8))
  ------------------
  |  |  669|     19|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|     19|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|     19|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (2061:10): [True: 0, False: 19]
  |  Branch (2061:53): [True: 0, False: 0]
  ------------------
 2062|      0|   {
 2063|      0|      png_warning(png_ptr, "Invalid color type/bit depth combination in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2064|      0|      error = 1;
 2065|      0|   }
 2066|       |
 2067|     19|   if (interlace_type >= PNG_INTERLACE_LAST)
  ------------------
  |  |  687|     19|#define PNG_INTERLACE_LAST        2 /* Not a valid value */
  ------------------
  |  Branch (2067:8): [True: 0, False: 19]
  ------------------
 2068|      0|   {
 2069|      0|      png_warning(png_ptr, "Unknown interlace method in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2070|      0|      error = 1;
 2071|      0|   }
 2072|       |
 2073|     19|   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
  ------------------
  |  |  676|     19|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */
  ------------------
  |  Branch (2073:8): [True: 0, False: 19]
  ------------------
 2074|      0|   {
 2075|      0|      png_warning(png_ptr, "Unknown compression method in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2076|      0|      error = 1;
 2077|      0|   }
 2078|       |
 2079|     19|#ifdef PNG_MNG_FEATURES_SUPPORTED
 2080|       |   /* Accept filter_method 64 (intrapixel differencing) only if
 2081|       |    * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
 2082|       |    * 2. Libpng did not read a PNG signature (this filter_method is only
 2083|       |    *    used in PNG datastreams that are embedded in MNG datastreams) and
 2084|       |    * 3. The application called png_permit_mng_features with a mask that
 2085|       |    *    included PNG_FLAG_MNG_FILTER_64 and
 2086|       |    * 4. The filter_method is 64 and
 2087|       |    * 5. The color_type is RGB or RGBA
 2088|       |    */
 2089|     19|   if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) != 0 &&
  ------------------
  |  |  652|     19|#define PNG_HAVE_PNG_SIGNATURE    0x1000U
  ------------------
  |  Branch (2089:8): [True: 0, False: 19]
  ------------------
 2090|      0|       png_ptr->mng_features_permitted != 0)
  ------------------
  |  Branch (2090:8): [True: 0, False: 0]
  ------------------
 2091|      0|      png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2092|       |
 2093|     19|   if (filter_type != PNG_FILTER_TYPE_BASE)
  ------------------
  |  |  680|     19|#define PNG_FILTER_TYPE_BASE      0 /* Single row per-byte filtering */
  ------------------
  |  Branch (2093:8): [True: 0, False: 19]
  ------------------
 2094|      0|   {
 2095|      0|      if (!((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) != 0 &&
  ------------------
  |  |  876|      0|#define PNG_FLAG_MNG_FILTER_64      0x04
  ------------------
  |  Branch (2095:13): [True: 0, False: 0]
  ------------------
 2096|      0|          (filter_type == PNG_INTRAPIXEL_DIFFERENCING) &&
  ------------------
  |  |  681|      0|#define PNG_INTRAPIXEL_DIFFERENCING 64 /* Used only in MNG datastreams */
  ------------------
  |  Branch (2096:11): [True: 0, False: 0]
  ------------------
 2097|      0|          ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) == 0) &&
  ------------------
  |  |  652|      0|#define PNG_HAVE_PNG_SIGNATURE    0x1000U
  ------------------
  |  Branch (2097:11): [True: 0, False: 0]
  ------------------
 2098|      0|          (color_type == PNG_COLOR_TYPE_RGB ||
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (2098:12): [True: 0, False: 0]
  ------------------
 2099|      0|          color_type == PNG_COLOR_TYPE_RGB_ALPHA)))
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (2099:11): [True: 0, False: 0]
  ------------------
 2100|      0|      {
 2101|      0|         png_warning(png_ptr, "Unknown filter method in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2102|      0|         error = 1;
 2103|      0|      }
 2104|       |
 2105|      0|      if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) != 0)
  ------------------
  |  |  652|      0|#define PNG_HAVE_PNG_SIGNATURE    0x1000U
  ------------------
  |  Branch (2105:11): [True: 0, False: 0]
  ------------------
 2106|      0|      {
 2107|      0|         png_warning(png_ptr, "Invalid filter method in IHDR");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 2108|      0|         error = 1;
 2109|      0|      }
 2110|      0|   }
 2111|       |
 2112|       |#else
 2113|       |   if (filter_type != PNG_FILTER_TYPE_BASE)
 2114|       |   {
 2115|       |      png_warning(png_ptr, "Unknown filter method in IHDR");
 2116|       |      error = 1;
 2117|       |   }
 2118|       |#endif
 2119|       |
 2120|     19|   if (error == 1)
  ------------------
  |  Branch (2120:8): [True: 0, False: 19]
  ------------------
 2121|      0|      png_error(png_ptr, "Invalid IHDR data");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 2122|     19|}
OSS_FUZZ_png_check_fp_number:
 2136|    165|{
 2137|    165|   int state = *statep;
 2138|    165|   size_t i = *whereami;
 2139|       |
 2140|  1.28k|   while (i < size)
  ------------------
  |  Branch (2140:11): [True: 1.28k, False: 2]
  ------------------
 2141|  1.28k|   {
 2142|  1.28k|      int type;
 2143|       |      /* First find the type of the next character */
 2144|  1.28k|      switch (string[i])
 2145|  1.28k|      {
 2146|     84|      case 43:  type = PNG_FP_SAW_SIGN;                   break;
  ------------------
  |  | 2118|     84|#define PNG_FP_SAW_SIGN   4  /* Saw +/- in current state */
  ------------------
  |  Branch (2146:7): [True: 84, False: 1.20k]
  ------------------
 2147|    107|      case 45:  type = PNG_FP_SAW_SIGN + PNG_FP_NEGATIVE; break;
  ------------------
  |  | 2118|    107|#define PNG_FP_SAW_SIGN   4  /* Saw +/- in current state */
  ------------------
                    case 45:  type = PNG_FP_SAW_SIGN + PNG_FP_NEGATIVE; break;
  ------------------
  |  | 2127|    107|#define PNG_FP_NEGATIVE 128  /* A negative number, including "-0" */
  ------------------
  |  Branch (2147:7): [True: 107, False: 1.17k]
  ------------------
 2148|     23|      case 46:  type = PNG_FP_SAW_DOT;                    break;
  ------------------
  |  | 2120|     23|#define PNG_FP_SAW_DOT   16  /* Saw a dot in current state */
  ------------------
  |  Branch (2148:7): [True: 23, False: 1.26k]
  ------------------
 2149|    140|      case 48:  type = PNG_FP_SAW_DIGIT;                  break;
  ------------------
  |  | 2119|    140|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2149:7): [True: 140, False: 1.14k]
  ------------------
 2150|    187|      case 49: case 50: case 51: case 52:
  ------------------
  |  Branch (2150:7): [True: 56, False: 1.23k]
  |  Branch (2150:16): [True: 63, False: 1.22k]
  |  Branch (2150:25): [True: 25, False: 1.26k]
  |  Branch (2150:34): [True: 43, False: 1.24k]
  ------------------
 2151|    526|      case 53: case 54: case 55: case 56:
  ------------------
  |  Branch (2151:7): [True: 3, False: 1.28k]
  |  Branch (2151:16): [True: 21, False: 1.26k]
  |  Branch (2151:25): [True: 56, False: 1.23k]
  |  Branch (2151:34): [True: 259, False: 1.02k]
  ------------------
 2152|    825|      case 57:  type = PNG_FP_SAW_DIGIT + PNG_FP_NONZERO; break;
  ------------------
  |  | 2119|    825|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
                    case 57:  type = PNG_FP_SAW_DIGIT + PNG_FP_NONZERO; break;
  ------------------
  |  | 2128|    825|#define PNG_FP_NONZERO  256  /* A non-zero value */
  ------------------
  |  Branch (2152:7): [True: 299, False: 987]
  ------------------
 2153|     44|      case 69:
  ------------------
  |  Branch (2153:7): [True: 44, False: 1.24k]
  ------------------
 2154|     44|      case 101: type = PNG_FP_SAW_E;                      break;
  ------------------
  |  | 2121|     44|#define PNG_FP_SAW_E     32  /* Saw an E (or e) in current state */
  ------------------
  |  Branch (2154:7): [True: 0, False: 1.28k]
  ------------------
 2155|     63|      default:  goto PNG_FP_End;
  ------------------
  |  Branch (2155:7): [True: 63, False: 1.22k]
  ------------------
 2156|  1.28k|      }
 2157|       |
 2158|       |      /* Now deal with this type according to the current
 2159|       |       * state, the type is arranged to not overlap the
 2160|       |       * bits of the PNG_FP_STATE.
 2161|       |       */
 2162|  1.22k|      switch ((state & PNG_FP_STATE) + (type & PNG_FP_SAW_ANY))
  ------------------
  |  | 2117|  1.22k|#define PNG_FP_STATE      3  /* mask for the above */
  ------------------
                    switch ((state & PNG_FP_STATE) + (type & PNG_FP_SAW_ANY))
  ------------------
  |  | 2122|  1.22k|#define PNG_FP_SAW_ANY   60  /* Saw any of the above 4 */
  ------------------
 2163|  1.22k|      {
 2164|    189|      case PNG_FP_INTEGER + PNG_FP_SAW_SIGN:
  ------------------
  |  | 2114|    189|#define PNG_FP_INTEGER    0  /* before or in integer */
  ------------------
                    case PNG_FP_INTEGER + PNG_FP_SAW_SIGN:
  ------------------
  |  | 2118|    189|#define PNG_FP_SAW_SIGN   4  /* Saw +/- in current state */
  ------------------
  |  Branch (2164:7): [True: 189, False: 1.03k]
  ------------------
 2165|    189|         if ((state & PNG_FP_SAW_ANY) != 0)
  ------------------
  |  | 2122|    189|#define PNG_FP_SAW_ANY   60  /* Saw any of the above 4 */
  ------------------
  |  Branch (2165:14): [True: 79, False: 110]
  ------------------
 2166|     79|            goto PNG_FP_End; /* not a part of the number */
 2167|       |
 2168|    110|         png_fp_add(state, type);
  ------------------
  |  | 2130|    110|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2169|    110|         break;
 2170|       |
 2171|     23|      case PNG_FP_INTEGER + PNG_FP_SAW_DOT:
  ------------------
  |  | 2114|     23|#define PNG_FP_INTEGER    0  /* before or in integer */
  ------------------
                    case PNG_FP_INTEGER + PNG_FP_SAW_DOT:
  ------------------
  |  | 2120|     23|#define PNG_FP_SAW_DOT   16  /* Saw a dot in current state */
  ------------------
  |  Branch (2171:7): [True: 23, False: 1.20k]
  ------------------
 2172|       |         /* Ok as trailer, ok as lead of fraction. */
 2173|     23|         if ((state & PNG_FP_SAW_DOT) != 0) /* two dots */
  ------------------
  |  | 2120|     23|#define PNG_FP_SAW_DOT   16  /* Saw a dot in current state */
  ------------------
  |  Branch (2173:14): [True: 0, False: 23]
  ------------------
 2174|      0|            goto PNG_FP_End;
 2175|       |
 2176|     23|         else if ((state & PNG_FP_SAW_DIGIT) != 0) /* trailing dot? */
  ------------------
  |  | 2119|     23|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2176:19): [True: 22, False: 1]
  ------------------
 2177|     22|            png_fp_add(state, type);
  ------------------
  |  | 2130|     22|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2178|       |
 2179|      1|         else
 2180|      1|            png_fp_set(state, PNG_FP_FRACTION | type);
  ------------------
  |  | 2131|      1|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
  |  |  ------------------
  |  |  |  | 2129|      1|#define PNG_FP_STICKY   448  /* The above three flags */
  |  |  ------------------
  ------------------
 2181|       |
 2182|     23|         break;
 2183|       |
 2184|    922|      case PNG_FP_INTEGER + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 2114|    922|#define PNG_FP_INTEGER    0  /* before or in integer */
  ------------------
                    case PNG_FP_INTEGER + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 2119|    922|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2184:7): [True: 922, False: 301]
  ------------------
 2185|    922|         if ((state & PNG_FP_SAW_DOT) != 0) /* delayed fraction */
  ------------------
  |  | 2120|    922|#define PNG_FP_SAW_DOT   16  /* Saw a dot in current state */
  ------------------
  |  Branch (2185:14): [True: 22, False: 900]
  ------------------
 2186|     22|            png_fp_set(state, PNG_FP_FRACTION | PNG_FP_SAW_DOT);
  ------------------
  |  | 2131|     22|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
  |  |  ------------------
  |  |  |  | 2129|     22|#define PNG_FP_STICKY   448  /* The above three flags */
  |  |  ------------------
  ------------------
 2187|       |
 2188|    922|         png_fp_add(state, type | PNG_FP_WAS_VALID);
  ------------------
  |  | 2130|    922|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2189|       |
 2190|    922|         break;
 2191|       |
 2192|      2|      case PNG_FP_INTEGER + PNG_FP_SAW_E:
  ------------------
  |  | 2114|      2|#define PNG_FP_INTEGER    0  /* before or in integer */
  ------------------
                    case PNG_FP_INTEGER + PNG_FP_SAW_E:
  ------------------
  |  | 2121|      2|#define PNG_FP_SAW_E     32  /* Saw an E (or e) in current state */
  ------------------
  |  Branch (2192:7): [True: 2, False: 1.22k]
  ------------------
 2193|      2|         if ((state & PNG_FP_SAW_DIGIT) == 0)
  ------------------
  |  | 2119|      2|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2193:14): [True: 0, False: 2]
  ------------------
 2194|      0|            goto PNG_FP_End;
 2195|       |
 2196|      2|         png_fp_set(state, PNG_FP_EXPONENT);
  ------------------
  |  | 2131|      2|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
  |  |  ------------------
  |  |  |  | 2129|      2|#define PNG_FP_STICKY   448  /* The above three flags */
  |  |  ------------------
  ------------------
 2197|       |
 2198|      2|         break;
 2199|       |
 2200|       |   /* case PNG_FP_FRACTION + PNG_FP_SAW_SIGN:
 2201|       |         goto PNG_FP_End; ** no sign in fraction */
 2202|       |
 2203|       |   /* case PNG_FP_FRACTION + PNG_FP_SAW_DOT:
 2204|       |         goto PNG_FP_End; ** Because SAW_DOT is always set */
 2205|       |
 2206|     43|      case PNG_FP_FRACTION + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 2115|     43|#define PNG_FP_FRACTION   1  /* before or in fraction */
  ------------------
                    case PNG_FP_FRACTION + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 2119|     43|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2206:7): [True: 43, False: 1.18k]
  ------------------
 2207|     43|         png_fp_add(state, type | PNG_FP_WAS_VALID);
  ------------------
  |  | 2130|     43|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2208|     43|         break;
 2209|       |
 2210|     21|      case PNG_FP_FRACTION + PNG_FP_SAW_E:
  ------------------
  |  | 2115|     21|#define PNG_FP_FRACTION   1  /* before or in fraction */
  ------------------
                    case PNG_FP_FRACTION + PNG_FP_SAW_E:
  ------------------
  |  | 2121|     21|#define PNG_FP_SAW_E     32  /* Saw an E (or e) in current state */
  ------------------
  |  Branch (2210:7): [True: 21, False: 1.20k]
  ------------------
 2211|       |         /* This is correct because the trailing '.' on an
 2212|       |          * integer is handled above - so we can only get here
 2213|       |          * with the sequence ".E" (with no preceding digits).
 2214|       |          */
 2215|     21|         if ((state & PNG_FP_SAW_DIGIT) == 0)
  ------------------
  |  | 2119|     21|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2215:14): [True: 0, False: 21]
  ------------------
 2216|      0|            goto PNG_FP_End;
 2217|       |
 2218|     21|         png_fp_set(state, PNG_FP_EXPONENT);
  ------------------
  |  | 2131|     21|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
  |  |  ------------------
  |  |  |  | 2129|     21|#define PNG_FP_STICKY   448  /* The above three flags */
  |  |  ------------------
  ------------------
 2219|       |
 2220|     21|         break;
 2221|       |
 2222|      2|      case PNG_FP_EXPONENT + PNG_FP_SAW_SIGN:
  ------------------
  |  | 2116|      2|#define PNG_FP_EXPONENT   2  /* before or in exponent */
  ------------------
                    case PNG_FP_EXPONENT + PNG_FP_SAW_SIGN:
  ------------------
  |  | 2118|      2|#define PNG_FP_SAW_SIGN   4  /* Saw +/- in current state */
  ------------------
  |  Branch (2222:7): [True: 2, False: 1.22k]
  ------------------
 2223|      2|         if ((state & PNG_FP_SAW_ANY) != 0)
  ------------------
  |  | 2122|      2|#define PNG_FP_SAW_ANY   60  /* Saw any of the above 4 */
  ------------------
  |  Branch (2223:14): [True: 0, False: 2]
  ------------------
 2224|      0|            goto PNG_FP_End; /* not a part of the number */
 2225|       |
 2226|      2|         png_fp_add(state, PNG_FP_SAW_SIGN);
  ------------------
  |  | 2130|      2|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2227|       |
 2228|      2|         break;
 2229|       |
 2230|       |   /* case PNG_FP_EXPONENT + PNG_FP_SAW_DOT:
 2231|       |         goto PNG_FP_End; */
 2232|       |
 2233|      0|      case PNG_FP_EXPONENT + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 2116|      0|#define PNG_FP_EXPONENT   2  /* before or in exponent */
  ------------------
                    case PNG_FP_EXPONENT + PNG_FP_SAW_DIGIT:
  ------------------
  |  | 2119|      0|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
  |  Branch (2233:7): [True: 0, False: 1.22k]
  ------------------
 2234|      0|         png_fp_add(state, PNG_FP_SAW_DIGIT | PNG_FP_WAS_VALID);
  ------------------
  |  | 2130|      0|#define png_fp_add(state, flags) ((state) |= (flags))
  ------------------
 2235|       |
 2236|      0|         break;
 2237|       |
 2238|       |   /* case PNG_FP_EXPONEXT + PNG_FP_SAW_E:
 2239|       |         goto PNG_FP_End; */
 2240|       |
 2241|     21|      default: goto PNG_FP_End; /* I.e. break 2 */
  ------------------
  |  Branch (2241:7): [True: 21, False: 1.20k]
  ------------------
 2242|  1.22k|      }
 2243|       |
 2244|       |      /* The character seems ok, continue. */
 2245|  1.12k|      ++i;
 2246|  1.12k|   }
 2247|       |
 2248|    165|PNG_FP_End:
 2249|       |   /* Here at the end, update the state and return the correct
 2250|       |    * return code.
 2251|       |    */
 2252|    165|   *statep = state;
 2253|    165|   *whereami = i;
 2254|       |
 2255|    165|   return (state & PNG_FP_SAW_DIGIT) != 0;
  ------------------
  |  | 2119|    165|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  ------------------
 2256|    165|}
OSS_FUZZ_png_gamma_significant:
 2910|      5|{
 2911|       |   /* sRGB:       1/2.2 == 0.4545(45)
 2912|       |    * AdobeRGB:   1/(2+51/256) ~= 0.45471 5dp
 2913|       |    *
 2914|       |    * So the correction from AdobeRGB to sRGB (output) is:
 2915|       |    *
 2916|       |    *    2.2/(2+51/256) == 1.00035524
 2917|       |    *
 2918|       |    * I.e. vanishingly small (<4E-4) but still detectable in 16-bit linear (+/-
 2919|       |    * 23).  Note that the Adobe choice seems to be something intended to give an
 2920|       |    * exact number with 8 binary fractional digits - it is the closest to 2.2
 2921|       |    * that is possible a base 2 .8p representation.
 2922|       |    */
 2923|      5|   return gamma_val < PNG_FP_1 - PNG_GAMMA_THRESHOLD_FIXED ||
  ------------------
  |  |  654|      5|#define PNG_FP_1    100000
  ------------------
                 return gamma_val < PNG_FP_1 - PNG_GAMMA_THRESHOLD_FIXED ||
  ------------------
  |  |  208|     10|#define PNG_GAMMA_THRESHOLD_FIXED 5000
  ------------------
  |  Branch (2923:11): [True: 0, False: 5]
  ------------------
 2924|      5|       gamma_val > PNG_FP_1 + PNG_GAMMA_THRESHOLD_FIXED;
  ------------------
  |  |  654|      5|#define PNG_FP_1    100000
  ------------------
                     gamma_val > PNG_FP_1 + PNG_GAMMA_THRESHOLD_FIXED;
  ------------------
  |  |  208|      5|#define PNG_GAMMA_THRESHOLD_FIXED 5000
  ------------------
  |  Branch (2924:8): [True: 0, False: 5]
  ------------------
 2925|      5|}
OSS_FUZZ_png_destroy_gamma_table:
 3546|     31|{
 3547|     31|   png_free(png_ptr, png_ptr->gamma_table);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
 3548|     31|   png_ptr->gamma_table = NULL;
 3549|       |
 3550|     31|#ifdef PNG_16BIT_SUPPORTED
 3551|     31|   if (png_ptr->gamma_16_table != NULL)
  ------------------
  |  Branch (3551:8): [True: 0, False: 31]
  ------------------
 3552|      0|   {
 3553|      0|      int i;
 3554|      0|      int istop = (1 << (8 - png_ptr->gamma_shift));
 3555|      0|      for (i = 0; i < istop; i++)
  ------------------
  |  Branch (3555:19): [True: 0, False: 0]
  ------------------
 3556|      0|      {
 3557|      0|         png_free(png_ptr, png_ptr->gamma_16_table[i]);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 3558|      0|      }
 3559|      0|   png_free(png_ptr, png_ptr->gamma_16_table);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 3560|      0|   png_ptr->gamma_16_table = NULL;
 3561|      0|   }
 3562|     31|#endif /* 16BIT */
 3563|       |
 3564|     31|#if defined(PNG_READ_BACKGROUND_SUPPORTED) || \
 3565|     31|   defined(PNG_READ_ALPHA_MODE_SUPPORTED) || \
 3566|     31|   defined(PNG_READ_RGB_TO_GRAY_SUPPORTED)
 3567|     31|   png_free(png_ptr, png_ptr->gamma_from_1);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
 3568|     31|   png_ptr->gamma_from_1 = NULL;
 3569|     31|   png_free(png_ptr, png_ptr->gamma_to_1);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
 3570|     31|   png_ptr->gamma_to_1 = NULL;
 3571|       |
 3572|     31|#ifdef PNG_16BIT_SUPPORTED
 3573|     31|   if (png_ptr->gamma_16_from_1 != NULL)
  ------------------
  |  Branch (3573:8): [True: 0, False: 31]
  ------------------
 3574|      0|   {
 3575|      0|      int i;
 3576|      0|      int istop = (1 << (8 - png_ptr->gamma_shift));
 3577|      0|      for (i = 0; i < istop; i++)
  ------------------
  |  Branch (3577:19): [True: 0, False: 0]
  ------------------
 3578|      0|      {
 3579|      0|         png_free(png_ptr, png_ptr->gamma_16_from_1[i]);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 3580|      0|      }
 3581|      0|   png_free(png_ptr, png_ptr->gamma_16_from_1);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 3582|      0|   png_ptr->gamma_16_from_1 = NULL;
 3583|      0|   }
 3584|     31|   if (png_ptr->gamma_16_to_1 != NULL)
  ------------------
  |  Branch (3584:8): [True: 0, False: 31]
  ------------------
 3585|      0|   {
 3586|      0|      int i;
 3587|      0|      int istop = (1 << (8 - png_ptr->gamma_shift));
 3588|      0|      for (i = 0; i < istop; i++)
  ------------------
  |  Branch (3588:19): [True: 0, False: 0]
  ------------------
 3589|      0|      {
 3590|      0|         png_free(png_ptr, png_ptr->gamma_16_to_1[i]);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 3591|      0|      }
 3592|      0|   png_free(png_ptr, png_ptr->gamma_16_to_1);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 3593|       |   png_ptr->gamma_16_to_1 = NULL;
 3594|      0|   }
 3595|     31|#endif /* 16BIT */
 3596|     31|#endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */
 3597|     31|}
OSS_FUZZ_png_image_free:
 4020|      3|{
 4021|       |   /* Safely call the real function, but only if doing so is safe at this point
 4022|       |    * (if not inside an error handling context).  Otherwise assume
 4023|       |    * png_safe_execute will call this API after the return.
 4024|       |    */
 4025|      3|   if (image != NULL && image->opaque != NULL &&
  ------------------
  |  Branch (4025:8): [True: 3, False: 0]
  |  Branch (4025:25): [True: 3, False: 0]
  ------------------
 4026|      3|      image->opaque->error_buf == NULL)
  ------------------
  |  Branch (4026:7): [True: 3, False: 0]
  ------------------
 4027|      3|   {
 4028|      3|      png_image_free_function(image);
 4029|       |      image->opaque = NULL;
 4030|      3|   }
 4031|      3|}
png.c:icc_check_length:
 1587|  3.41k|{
 1588|  3.41k|   if (profile_length < 132)
  ------------------
  |  Branch (1588:8): [True: 0, False: 3.41k]
  ------------------
 1589|      0|      return png_icc_profile_error(png_ptr, name, profile_length, "too short");
 1590|  3.41k|   return 1;
 1591|  3.41k|}
png.c:png_icc_profile_error:
 1541|  3.41k|{
 1542|  3.41k|   size_t pos;
 1543|  3.41k|   char message[196]; /* see below for calculation */
 1544|       |
 1545|  3.41k|   pos = png_safecat(message, (sizeof message), 0, "profile '"); /* 9 chars */
  ------------------
  |  |   75|  3.41k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1546|  3.41k|   pos = png_safecat(message, pos+79, pos, name); /* Truncate to 79 chars */
  ------------------
  |  |   75|  3.41k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1547|  3.41k|   pos = png_safecat(message, (sizeof message), pos, "': "); /* +2 = 90 */
  ------------------
  |  |   75|  3.41k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1548|  3.41k|   if (is_ICC_signature(value) != 0)
  ------------------
  |  Branch (1548:8): [True: 1.37k, False: 2.04k]
  ------------------
 1549|  1.37k|   {
 1550|       |      /* So 'value' is at most 4 bytes and the following cast is safe */
 1551|  1.37k|      png_icc_tag_name(message+pos, (png_uint_32)value);
 1552|  1.37k|      pos += 6; /* total +8; less than the else clause */
 1553|  1.37k|      message[pos++] = ':';
 1554|  1.37k|      message[pos++] = ' ';
 1555|  1.37k|   }
 1556|  2.04k|#  ifdef PNG_WARNINGS_SUPPORTED
 1557|  2.04k|   else
 1558|  2.04k|   {
 1559|  2.04k|      char number[PNG_NUMBER_BUFFER_SIZE]; /* +24 = 114 */
 1560|       |
 1561|  2.04k|      pos = png_safecat(message, (sizeof message), pos,
  ------------------
  |  |   75|  2.04k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1562|  2.04k|          png_format_number(number, number+(sizeof number),
  ------------------
  |  |   76|  2.04k|#define png_format_number OSS_FUZZ_png_format_number
  ------------------
 1563|  2.04k|          PNG_NUMBER_FORMAT_x, value));
  ------------------
  |  | 1966|  2.04k|#define PNG_NUMBER_FORMAT_x     3
  ------------------
 1564|  2.04k|      pos = png_safecat(message, (sizeof message), pos, "h: "); /* +2 = 116 */
  ------------------
  |  |   75|  2.04k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1565|  2.04k|   }
 1566|  3.41k|#  endif
 1567|       |   /* The 'reason' is an arbitrary message, allow +79 maximum 195 */
 1568|  3.41k|   pos = png_safecat(message, (sizeof message), pos, reason);
  ------------------
  |  |   75|  3.41k|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
 1569|  3.41k|   PNG_UNUSED(pos)
  ------------------
  |  |  479|  3.41k|#  define PNG_UNUSED(param) (void)param;
  ------------------
 1570|       |
 1571|  3.41k|   png_chunk_benign_error(png_ptr, message);
  ------------------
  |  |  238|  3.41k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1572|       |
 1573|  3.41k|   return 0;
 1574|  3.41k|}
png.c:is_ICC_signature:
 1531|  3.41k|{
 1532|  3.41k|   return is_ICC_signature_char(it >> 24) /* checks all the top bits */ &&
  ------------------
  |  Branch (1532:11): [True: 2.26k, False: 1.14k]
  ------------------
 1533|  2.26k|      is_ICC_signature_char((it >> 16) & 0xff) &&
  ------------------
  |  Branch (1533:7): [True: 1.87k, False: 396]
  ------------------
 1534|  1.87k|      is_ICC_signature_char((it >> 8) & 0xff) &&
  ------------------
  |  Branch (1534:7): [True: 1.67k, False: 192]
  ------------------
 1535|  1.67k|      is_ICC_signature_char(it & 0xff);
  ------------------
  |  Branch (1535:7): [True: 1.37k, False: 307]
  ------------------
 1536|  3.41k|}
png.c:is_ICC_signature_char:
 1524|  9.23k|{
 1525|  9.23k|   return it == 32 || (it >= 48 && it <= 57) || (it >= 65 && it <= 90) ||
  ------------------
  |  Branch (1525:11): [True: 0, False: 9.23k]
  |  Branch (1525:24): [True: 8.13k, False: 1.09k]
  |  Branch (1525:36): [True: 2.00k, False: 6.13k]
  |  Branch (1525:50): [True: 6.13k, False: 1.09k]
  |  Branch (1525:62): [True: 2.07k, False: 4.05k]
  ------------------
 1526|  5.14k|      (it >= 97 && it <= 122);
  ------------------
  |  Branch (1526:8): [True: 4.05k, False: 1.09k]
  |  Branch (1526:20): [True: 3.10k, False: 949]
  ------------------
 1527|  9.23k|}
png.c:png_icc_tag_name:
 1513|  1.37k|{
 1514|  1.37k|   name[0] = '\'';
 1515|  1.37k|   name[1] = png_icc_tag_char(tag >> 24);
 1516|  1.37k|   name[2] = png_icc_tag_char(tag >> 16);
 1517|  1.37k|   name[3] = png_icc_tag_char(tag >>  8);
 1518|  1.37k|   name[4] = png_icc_tag_char(tag      );
 1519|  1.37k|   name[5] = '\'';
 1520|  1.37k|}
png.c:png_icc_tag_char:
 1503|  5.48k|{
 1504|  5.48k|   byte &= 0xff;
 1505|  5.48k|   if (byte >= 32 && byte <= 126)
  ------------------
  |  Branch (1505:8): [True: 5.48k, False: 0]
  |  Branch (1505:22): [True: 5.48k, False: 0]
  ------------------
 1506|  5.48k|      return (char)byte;
 1507|      0|   else
 1508|      0|      return '?';
 1509|  5.48k|}
png.c:png_image_free_function:
 3960|      3|{
 3961|      3|   png_imagep image = png_voidcast(png_imagep, argument);
  ------------------
  |  |  535|      3|#  define png_voidcast(type, value) (value)
  ------------------
 3962|      3|   png_controlp cp = image->opaque;
 3963|      3|   png_control c;
 3964|       |
 3965|       |   /* Double check that we have a png_ptr - it should be impossible to get here
 3966|       |    * without one.
 3967|       |    */
 3968|      3|   if (cp->png_ptr == NULL)
  ------------------
  |  Branch (3968:8): [True: 0, False: 3]
  ------------------
 3969|      0|      return 0;
 3970|       |
 3971|       |   /* First free any data held in the control structure. */
 3972|       |#  ifdef PNG_STDIO_SUPPORTED
 3973|       |      if (cp->owned_file != 0)
 3974|       |      {
 3975|       |         FILE *fp = png_voidcast(FILE *, cp->png_ptr->io_ptr);
 3976|       |         cp->owned_file = 0;
 3977|       |
 3978|       |         /* Ignore errors here. */
 3979|       |         if (fp != NULL)
 3980|       |         {
 3981|       |            cp->png_ptr->io_ptr = NULL;
 3982|       |            (void)fclose(fp);
 3983|       |         }
 3984|       |      }
 3985|       |#  endif
 3986|       |
 3987|       |   /* Copy the control structure so that the original, allocated, version can be
 3988|       |    * safely freed.  Notice that a png_error here stops the remainder of the
 3989|       |    * cleanup, but this is probably fine because that would indicate bad memory
 3990|       |    * problems anyway.
 3991|       |    */
 3992|      3|   c = *cp;
 3993|      3|   image->opaque = &c;
 3994|      3|   png_free(c.png_ptr, cp);
  ------------------
  |  |  253|      3|#define png_free OSS_FUZZ_png_free
  ------------------
 3995|       |
 3996|       |   /* Then the structures, calling the correct API. */
 3997|      3|   if (c.for_write != 0)
  ------------------
  |  Branch (3997:8): [True: 0, False: 3]
  ------------------
 3998|      0|   {
 3999|       |#     ifdef PNG_SIMPLIFIED_WRITE_SUPPORTED
 4000|       |         png_destroy_write_struct(&c.png_ptr, &c.info_ptr);
 4001|       |#     else
 4002|      0|         png_error(c.png_ptr, "simplified write not supported");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4003|      0|#     endif
 4004|      0|   }
 4005|      3|   else
 4006|      3|   {
 4007|      3|#     ifdef PNG_SIMPLIFIED_READ_SUPPORTED
 4008|      3|         png_destroy_read_struct(&c.png_ptr, &c.info_ptr, NULL);
  ------------------
  |  |  250|      3|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  ------------------
 4009|       |#     else
 4010|       |         png_error(c.png_ptr, "simplified read not supported");
 4011|       |#     endif
 4012|      3|   }
 4013|       |
 4014|       |   /* Success. */
 4015|      3|   return 1;
 4016|      3|}

OSS_FUZZ_png_error:
   41|     16|{
   42|     16|   if (png_ptr != NULL && png_ptr->error_fn != NULL)
  ------------------
  |  Branch (42:8): [True: 16, False: 0]
  |  Branch (42:27): [True: 3, False: 13]
  ------------------
   43|      3|      (*(png_ptr->error_fn))(png_constcast(png_structrp,png_ptr),
  ------------------
  |  |  536|      3|#  define png_constcast(type, value) ((type)(void*)(const void*)(value))
  ------------------
   44|      3|          error_message);
   45|       |
   46|       |   /* If the custom handler doesn't exist, or if it returns,
   47|       |      use the default handler, which will not return. */
   48|     16|   png_default_error(png_ptr, error_message);
   49|     16|}
OSS_FUZZ_png_safecat:
   75|  17.7k|{
   76|  17.7k|   if (buffer != NULL && pos < bufsize)
  ------------------
  |  Branch (76:8): [True: 17.7k, False: 0]
  |  Branch (76:26): [True: 17.7k, False: 0]
  ------------------
   77|  17.7k|   {
   78|  17.7k|      if (string != NULL)
  ------------------
  |  Branch (78:11): [True: 17.7k, False: 0]
  ------------------
   79|   215k|         while (*string != '\0' && pos < bufsize-1)
  ------------------
  |  Branch (79:17): [True: 198k, False: 17.7k]
  |  Branch (79:36): [True: 198k, False: 0]
  ------------------
   80|   198k|           buffer[pos++] = *string++;
   81|       |
   82|  17.7k|      buffer[pos] = '\0';
   83|  17.7k|   }
   84|       |
   85|  17.7k|   return pos;
   86|  17.7k|}
OSS_FUZZ_png_format_number:
   96|  2.04k|{
   97|  2.04k|   int count = 0;    /* number of digits output */
   98|  2.04k|   int mincount = 1; /* minimum number required */
   99|  2.04k|   int output = 0;   /* digit output (for the fixed point format) */
  100|       |
  101|  2.04k|   *--end = '\0';
  102|       |
  103|       |   /* This is written so that the loop always runs at least once, even with
  104|       |    * number zero.
  105|       |    */
  106|  17.4k|   while (end > start && (number != 0 || count < mincount))
  ------------------
  |  Branch (106:11): [True: 17.4k, False: 0]
  |  Branch (106:27): [True: 15.3k, False: 2.04k]
  |  Branch (106:42): [True: 0, False: 2.04k]
  ------------------
  107|  15.3k|   {
  108|       |
  109|  15.3k|      static const char digits[] = "0123456789ABCDEF";
  110|       |
  111|  15.3k|      switch (format)
  112|  15.3k|      {
  113|      0|         case PNG_NUMBER_FORMAT_fixed:
  ------------------
  |  | 1968|      0|#define PNG_NUMBER_FORMAT_fixed 5 /* choose the signed API */
  ------------------
  |  Branch (113:10): [True: 0, False: 15.3k]
  ------------------
  114|       |            /* Needs five digits (the fraction) */
  115|      0|            mincount = 5;
  116|      0|            if (output != 0 || number % 10 != 0)
  ------------------
  |  Branch (116:17): [True: 0, False: 0]
  |  Branch (116:32): [True: 0, False: 0]
  ------------------
  117|      0|            {
  118|      0|               *--end = digits[number % 10];
  119|      0|               output = 1;
  120|      0|            }
  121|      0|            number /= 10;
  122|      0|            break;
  123|       |
  124|      0|         case PNG_NUMBER_FORMAT_02u:
  ------------------
  |  | 1963|      0|#define PNG_NUMBER_FORMAT_02u   2
  ------------------
  |  Branch (124:10): [True: 0, False: 15.3k]
  ------------------
  125|       |            /* Expects at least 2 digits. */
  126|      0|            mincount = 2;
  127|       |            /* FALLTHROUGH */
  128|       |
  129|      0|         case PNG_NUMBER_FORMAT_u:
  ------------------
  |  | 1962|      0|#define PNG_NUMBER_FORMAT_u     1 /* chose unsigned API! */
  ------------------
  |  Branch (129:10): [True: 0, False: 15.3k]
  ------------------
  130|      0|            *--end = digits[number % 10];
  131|      0|            number /= 10;
  132|      0|            break;
  133|       |
  134|      0|         case PNG_NUMBER_FORMAT_02x:
  ------------------
  |  | 1967|      0|#define PNG_NUMBER_FORMAT_02x   4
  ------------------
  |  Branch (134:10): [True: 0, False: 15.3k]
  ------------------
  135|       |            /* This format expects at least two digits */
  136|      0|            mincount = 2;
  137|       |            /* FALLTHROUGH */
  138|       |
  139|  15.3k|         case PNG_NUMBER_FORMAT_x:
  ------------------
  |  | 1966|  15.3k|#define PNG_NUMBER_FORMAT_x     3
  ------------------
  |  Branch (139:10): [True: 15.3k, False: 0]
  ------------------
  140|  15.3k|            *--end = digits[number & 0xf];
  141|  15.3k|            number >>= 4;
  142|  15.3k|            break;
  143|       |
  144|      0|         default: /* an error */
  ------------------
  |  Branch (144:10): [True: 0, False: 15.3k]
  ------------------
  145|      0|            number = 0;
  146|      0|            break;
  147|  15.3k|      }
  148|       |
  149|       |      /* Keep track of the number of digits added */
  150|  15.3k|      ++count;
  151|       |
  152|       |      /* Float a fixed number here: */
  153|  15.3k|      if ((format == PNG_NUMBER_FORMAT_fixed) && (count == 5) && (end > start))
  ------------------
  |  | 1968|  15.3k|#define PNG_NUMBER_FORMAT_fixed 5 /* choose the signed API */
  ------------------
  |  Branch (153:11): [True: 0, False: 15.3k]
  |  Branch (153:50): [True: 0, False: 0]
  |  Branch (153:66): [True: 0, False: 0]
  ------------------
  154|      0|      {
  155|       |         /* End of the fraction, but maybe nothing was output?  In that case
  156|       |          * drop the decimal point.  If the number is a true zero handle that
  157|       |          * here.
  158|       |          */
  159|      0|         if (output != 0)
  ------------------
  |  Branch (159:14): [True: 0, False: 0]
  ------------------
  160|      0|            *--end = '.';
  161|      0|         else if (number == 0) /* and !output */
  ------------------
  |  Branch (161:19): [True: 0, False: 0]
  ------------------
  162|      0|            *--end = '0';
  163|      0|      }
  164|  15.3k|   }
  165|       |
  166|  2.04k|   return end;
  167|  2.04k|}
OSS_FUZZ_png_warning:
  178|  6.30k|{
  179|  6.30k|   int offset = 0;
  180|  6.30k|   if (png_ptr != NULL && png_ptr->warning_fn != NULL)
  ------------------
  |  Branch (180:8): [True: 6.30k, False: 0]
  |  Branch (180:27): [True: 0, False: 6.30k]
  ------------------
  181|      0|      (*(png_ptr->warning_fn))(png_constcast(png_structrp,png_ptr),
  ------------------
  |  |  536|      0|#  define png_constcast(type, value) ((type)(void*)(const void*)(value))
  ------------------
  182|      0|          warning_message + offset);
  183|  6.30k|   else
  184|  6.30k|      png_default_warning(png_ptr, warning_message + offset);
  185|  6.30k|}
OSS_FUZZ_png_benign_error:
  309|      3|{
  310|      3|   if ((png_ptr->flags & PNG_FLAG_BENIGN_ERRORS_WARN) != 0)
  ------------------
  |  |  715|      3|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
  |  Branch (310:8): [True: 3, False: 0]
  ------------------
  311|      3|   {
  312|      3|#     ifdef PNG_READ_SUPPORTED
  313|      3|         if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&
  ------------------
  |  |  655|      3|#define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
  ------------------
  |  Branch (313:14): [True: 3, False: 0]
  ------------------
  314|      3|            png_ptr->chunk_name != 0)
  ------------------
  |  Branch (314:13): [True: 3, False: 0]
  ------------------
  315|      3|            png_chunk_warning(png_ptr, error_message);
  ------------------
  |  |  240|      3|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
  316|      0|         else
  317|      0|#     endif
  318|      0|      png_warning(png_ptr, error_message);
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  319|      3|   }
  320|       |
  321|      0|   else
  322|      0|   {
  323|      0|#     ifdef PNG_READ_SUPPORTED
  324|      0|         if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&
  ------------------
  |  |  655|      0|#define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
  ------------------
  |  Branch (324:14): [True: 0, False: 0]
  ------------------
  325|      0|            png_ptr->chunk_name != 0)
  ------------------
  |  Branch (325:13): [True: 0, False: 0]
  ------------------
  326|      0|            png_chunk_error(png_ptr, error_message);
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  327|      0|         else
  328|      0|#     endif
  329|      0|      png_error(png_ptr, error_message);
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  330|      0|   }
  331|       |
  332|       |#  ifndef PNG_ERROR_TEXT_SUPPORTED
  333|       |      PNG_UNUSED(error_message)
  334|       |#  endif
  335|      3|}
OSS_FUZZ_png_chunk_error:
  428|      9|{
  429|      9|   char msg[18+PNG_MAX_ERROR_TEXT];
  430|      9|   if (png_ptr == NULL)
  ------------------
  |  Branch (430:8): [True: 0, False: 9]
  ------------------
  431|      0|      png_error(png_ptr, error_message);
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  432|       |
  433|      9|   else
  434|      9|   {
  435|      9|      png_format_buffer(png_ptr, msg, error_message);
  436|      9|      png_error(png_ptr, msg);
  ------------------
  |  |  252|     18|#define png_error OSS_FUZZ_png_error
  ------------------
  437|      9|   }
  438|      9|}
OSS_FUZZ_png_chunk_warning:
  444|  5.88k|{
  445|  5.88k|   char msg[18+PNG_MAX_ERROR_TEXT];
  446|  5.88k|   if (png_ptr == NULL)
  ------------------
  |  Branch (446:8): [True: 0, False: 5.88k]
  ------------------
  447|      0|      png_warning(png_ptr, warning_message);
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  448|       |
  449|  5.88k|   else
  450|  5.88k|   {
  451|  5.88k|      png_format_buffer(png_ptr, msg, warning_message);
  452|  5.88k|      png_warning(png_ptr, msg);
  ------------------
  |  |  450|  5.88k|#define png_warning OSS_FUZZ_png_warning
  ------------------
  453|  5.88k|   }
  454|  5.88k|}
OSS_FUZZ_png_chunk_benign_error:
  462|  5.81k|{
  463|  5.81k|   if ((png_ptr->flags & PNG_FLAG_BENIGN_ERRORS_WARN) != 0)
  ------------------
  |  |  715|  5.81k|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
  |  Branch (463:8): [True: 5.81k, False: 0]
  ------------------
  464|  5.81k|      png_chunk_warning(png_ptr, error_message);
  ------------------
  |  |  240|  5.81k|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
  465|       |
  466|      0|   else
  467|      0|      png_chunk_error(png_ptr, error_message);
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  468|       |
  469|       |#  ifndef PNG_ERROR_TEXT_SUPPORTED
  470|       |      PNG_UNUSED(error_message)
  471|       |#  endif
  472|  5.81k|}
OSS_FUZZ_png_chunk_report:
  478|     68|{
  479|       |#  ifndef PNG_WARNINGS_SUPPORTED
  480|       |      PNG_UNUSED(message)
  481|       |#  endif
  482|       |
  483|       |   /* This is always supported, but for just read or just write it
  484|       |    * unconditionally does the right thing.
  485|       |    */
  486|       |#  if defined(PNG_READ_SUPPORTED) && defined(PNG_WRITE_SUPPORTED)
  487|       |      if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0)
  488|       |#  endif
  489|       |
  490|     68|#  ifdef PNG_READ_SUPPORTED
  491|     68|      {
  492|     68|         if (error < PNG_CHUNK_ERROR)
  ------------------
  |  | 2055|     68|#define PNG_CHUNK_ERROR       2 /* always an error */
  ------------------
  |  Branch (492:14): [True: 68, False: 0]
  ------------------
  493|     68|            png_chunk_warning(png_ptr, message);
  ------------------
  |  |  240|     68|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
  494|       |
  495|      0|         else
  496|      0|            png_chunk_benign_error(png_ptr, message);
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
  497|     68|      }
  498|     68|#  endif
  499|       |
  500|       |#  if defined(PNG_READ_SUPPORTED) && defined(PNG_WRITE_SUPPORTED)
  501|       |      else if ((png_ptr->mode & PNG_IS_READ_STRUCT) == 0)
  502|       |#  endif
  503|       |
  504|       |#  ifdef PNG_WRITE_SUPPORTED
  505|       |      {
  506|       |         if (error < PNG_CHUNK_WRITE_ERROR)
  507|       |            png_app_warning(png_ptr, message);
  508|       |
  509|       |         else
  510|       |            png_app_error(png_ptr, message);
  511|       |      }
  512|       |#  endif
  513|     68|}
OSS_FUZZ_png_set_longjmp_fn:
  546|     21|{
  547|       |   /* From libpng 1.6.0 the app gets one chance to set a 'jmpbuf_size' value
  548|       |    * and it must not change after that.  Libpng doesn't care how big the
  549|       |    * buffer is, just that it doesn't change.
  550|       |    *
  551|       |    * If the buffer size is no *larger* than the size of jmp_buf when libpng is
  552|       |    * compiled a built in jmp_buf is returned; this preserves the pre-1.6.0
  553|       |    * semantics that this call will not fail.  If the size is larger, however,
  554|       |    * the buffer is allocated and this may fail, causing the function to return
  555|       |    * NULL.
  556|       |    */
  557|     21|   if (png_ptr == NULL)
  ------------------
  |  Branch (557:8): [True: 0, False: 21]
  ------------------
  558|      0|      return NULL;
  559|       |
  560|     21|   if (png_ptr->jmp_buf_ptr == NULL)
  ------------------
  |  Branch (560:8): [True: 16, False: 5]
  ------------------
  561|     16|   {
  562|     16|      png_ptr->jmp_buf_size = 0; /* not allocated */
  563|       |
  564|     16|      if (jmp_buf_size <= (sizeof png_ptr->jmp_buf_local))
  ------------------
  |  Branch (564:11): [True: 16, False: 0]
  ------------------
  565|     16|         png_ptr->jmp_buf_ptr = &png_ptr->jmp_buf_local;
  566|       |
  567|      0|      else
  568|      0|      {
  569|      0|         png_ptr->jmp_buf_ptr = png_voidcast(jmp_buf *,
  ------------------
  |  |  535|      0|#  define png_voidcast(type, value) (value)
  ------------------
  570|      0|             png_malloc_warn(png_ptr, jmp_buf_size));
  571|       |
  572|      0|         if (png_ptr->jmp_buf_ptr == NULL)
  ------------------
  |  Branch (572:14): [True: 0, False: 0]
  ------------------
  573|      0|            return NULL; /* new NULL return on OOM */
  574|       |
  575|      0|         png_ptr->jmp_buf_size = jmp_buf_size;
  576|      0|      }
  577|     16|   }
  578|       |
  579|      5|   else /* Already allocated: check the size */
  580|      5|   {
  581|      5|      size_t size = png_ptr->jmp_buf_size;
  582|       |
  583|      5|      if (size == 0)
  ------------------
  |  Branch (583:11): [True: 5, False: 0]
  ------------------
  584|      5|      {
  585|      5|         size = (sizeof png_ptr->jmp_buf_local);
  586|      5|         if (png_ptr->jmp_buf_ptr != &png_ptr->jmp_buf_local)
  ------------------
  |  Branch (586:14): [True: 0, False: 5]
  ------------------
  587|      0|         {
  588|       |            /* This is an internal error in libpng: somehow we have been left
  589|       |             * with a stack allocated jmp_buf when the application regained
  590|       |             * control.  It's always possible to fix this up, but for the moment
  591|       |             * this is a png_error because that makes it easy to detect.
  592|       |             */
  593|      0|            png_error(png_ptr, "Libpng jmp_buf still allocated");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  594|       |            /* png_ptr->jmp_buf_ptr = &png_ptr->jmp_buf_local; */
  595|      0|         }
  596|      5|      }
  597|       |
  598|      5|      if (size != jmp_buf_size)
  ------------------
  |  Branch (598:11): [True: 0, False: 5]
  ------------------
  599|      0|      {
  600|      0|         png_warning(png_ptr, "Application jmp_buf size changed");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
  601|      0|         return NULL; /* caller will probably crash: no choice here */
  602|      0|      }
  603|      5|   }
  604|       |
  605|       |   /* Finally fill in the function, now we have a satisfactory buffer. It is
  606|       |    * valid to change the function on every call.
  607|       |    */
  608|     21|   png_ptr->longjmp_fn = longjmp_fn;
  609|     21|   return png_ptr->jmp_buf_ptr;
  610|     21|}
OSS_FUZZ_png_free_jmpbuf:
  614|     31|{
  615|     31|   if (png_ptr != NULL)
  ------------------
  |  Branch (615:8): [True: 31, False: 0]
  ------------------
  616|     31|   {
  617|     31|      jmp_buf *jb = png_ptr->jmp_buf_ptr;
  618|       |
  619|       |      /* A size of 0 is used to indicate a local, stack, allocation of the
  620|       |       * pointer; used here and in png.c
  621|       |       */
  622|     31|      if (jb != NULL && png_ptr->jmp_buf_size > 0)
  ------------------
  |  Branch (622:11): [True: 16, False: 15]
  |  Branch (622:25): [True: 0, False: 16]
  ------------------
  623|      0|      {
  624|       |
  625|       |         /* This stuff is so that a failure to free the error control structure
  626|       |          * does not leave libpng in a state with no valid error handling: the
  627|       |          * free always succeeds, if there is an error it gets ignored.
  628|       |          */
  629|      0|         if (jb != &png_ptr->jmp_buf_local)
  ------------------
  |  Branch (629:14): [True: 0, False: 0]
  ------------------
  630|      0|         {
  631|       |            /* Make an internal, libpng, jmp_buf to return here */
  632|      0|            jmp_buf free_jmp_buf;
  633|       |
  634|      0|            if (!setjmp(free_jmp_buf))
  ------------------
  |  Branch (634:17): [True: 0, False: 0]
  ------------------
  635|      0|            {
  636|      0|               png_ptr->jmp_buf_ptr = &free_jmp_buf; /* come back here */
  637|      0|               png_ptr->jmp_buf_size = 0; /* stack allocation */
  638|      0|               png_ptr->longjmp_fn = longjmp;
  639|      0|               png_free(png_ptr, jb); /* Return to setjmp on error */
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  640|      0|            }
  641|      0|         }
  642|      0|      }
  643|       |
  644|       |      /* *Always* cancel everything out: */
  645|     31|      png_ptr->jmp_buf_size = 0;
  646|       |      png_ptr->jmp_buf_ptr = NULL;
  647|     31|      png_ptr->longjmp_fn = 0;
  648|     31|   }
  649|     31|}
OSS_FUZZ_png_longjmp:
  674|     13|{
  675|     13|#ifdef PNG_SETJMP_SUPPORTED
  676|     13|   if (png_ptr != NULL && png_ptr->longjmp_fn != NULL &&
  ------------------
  |  Branch (676:8): [True: 13, False: 0]
  |  Branch (676:27): [True: 13, False: 0]
  ------------------
  677|     13|       png_ptr->jmp_buf_ptr != NULL)
  ------------------
  |  Branch (677:8): [True: 13, False: 0]
  ------------------
  678|     13|      png_ptr->longjmp_fn(*png_ptr->jmp_buf_ptr, val);
  679|       |#else
  680|       |   PNG_UNUSED(png_ptr)
  681|       |   PNG_UNUSED(val)
  682|       |#endif
  683|       |
  684|       |   /* If control reaches this point, png_longjmp() must not return. The only
  685|       |    * choice is to terminate the whole process (or maybe the thread); to do
  686|       |    * this the ANSI-C abort() function is used unless a different method is
  687|       |    * implemented by overriding the default configuration setting for
  688|       |    * PNG_ABORT().
  689|       |    */
  690|     13|   PNG_ABORT();
  ------------------
  |  |  580|     13|#  define PNG_ABORT() abort()
  ------------------
  691|     13|}
OSS_FUZZ_png_set_error_fn:
  720|     31|{
  721|     31|   if (png_ptr == NULL)
  ------------------
  |  Branch (721:8): [True: 0, False: 31]
  ------------------
  722|      0|      return;
  723|       |
  724|     31|   png_ptr->error_ptr = error_ptr;
  725|     31|   png_ptr->error_fn = error_fn;
  726|     31|#ifdef PNG_WARNINGS_SUPPORTED
  727|     31|   png_ptr->warning_fn = warning_fn;
  728|       |#else
  729|       |   PNG_UNUSED(warning_fn)
  730|       |#endif
  731|     31|}
OSS_FUZZ_png_safe_error:
  766|      3|{
  767|      3|   png_const_structrp png_ptr = png_nonconst_ptr;
  768|      3|   png_imagep image = png_voidcast(png_imagep, png_ptr->error_ptr);
  ------------------
  |  |  535|      3|#  define png_voidcast(type, value) (value)
  ------------------
  769|       |
  770|       |   /* An error is always logged here, overwriting anything (typically a warning)
  771|       |    * that is already there:
  772|       |    */
  773|      3|   if (image != NULL)
  ------------------
  |  Branch (773:8): [True: 3, False: 0]
  ------------------
  774|      3|   {
  775|      3|      png_safecat(image->message, (sizeof image->message), 0, error_message);
  ------------------
  |  |   75|      3|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  776|      3|      image->warning_or_error |= PNG_IMAGE_ERROR;
  ------------------
  |  | 2940|      3|#  define PNG_IMAGE_ERROR 2
  ------------------
  777|       |
  778|       |      /* Retrieve the jmp_buf from within the png_control, making this work for
  779|       |       * C++ compilation too is pretty tricky: C++ wants a pointer to the first
  780|       |       * element of a jmp_buf, but C doesn't tell us the type of that.
  781|       |       */
  782|      3|      if (image->opaque != NULL && image->opaque->error_buf != NULL)
  ------------------
  |  Branch (782:11): [True: 3, False: 0]
  |  Branch (782:36): [True: 3, False: 0]
  ------------------
  783|      3|         longjmp(png_control_jmp_buf(image->opaque), 1);
  ------------------
  |  | 2302|      3|#  define png_control_jmp_buf(pc) ((pc)->error_buf)
  ------------------
  784|       |
  785|       |      /* Missing longjmp buffer, the following is to help debugging: */
  786|      0|      {
  787|      0|         size_t pos = png_safecat(image->message, (sizeof image->message), 0,
  ------------------
  |  |   75|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  788|      0|             "bad longjmp: ");
  789|      0|         png_safecat(image->message, (sizeof image->message), pos,
  ------------------
  |  |   75|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  790|      0|             error_message);
  791|      0|      }
  792|      0|   }
  793|       |
  794|       |   /* Here on an internal programming error. */
  795|      0|   abort();
  796|      3|}
OSS_FUZZ_png_safe_execute:
  816|      3|{
  817|      3|   const png_voidp saved_error_buf = image->opaque->error_buf;
  818|      3|   jmp_buf safe_jmpbuf;
  819|       |
  820|       |   /* Safely execute function(arg), with png_error returning back here. */
  821|      3|   if (setjmp(safe_jmpbuf) == 0)
  ------------------
  |  Branch (821:8): [True: 3, False: 0]
  ------------------
  822|      3|   {
  823|      3|      int result;
  824|       |
  825|      3|      image->opaque->error_buf = safe_jmpbuf;
  826|      3|      result = function(arg);
  827|      3|      image->opaque->error_buf = saved_error_buf;
  828|       |
  829|      3|      if (result)
  ------------------
  |  Branch (829:11): [True: 0, False: 3]
  ------------------
  830|      0|         return 1; /* success */
  831|      3|   }
  832|       |
  833|       |   /* The function failed either because of a caught png_error and a regular
  834|       |    * return of false above or because of an uncaught png_error from the
  835|       |    * function itself.  Ensure that the error_buf is always set back to the
  836|       |    * value saved above:
  837|       |    */
  838|      3|   image->opaque->error_buf = saved_error_buf;
  839|       |
  840|       |   /* On the final false return, when about to return control to the caller, the
  841|       |    * image is freed (png_image_free does this check but it is duplicated here
  842|       |    * for clarity:
  843|       |    */
  844|      3|   if (saved_error_buf == NULL)
  ------------------
  |  Branch (844:8): [True: 3, False: 0]
  ------------------
  845|      3|      png_image_free(image);
  ------------------
  |  |  344|      3|#define png_image_free OSS_FUZZ_png_image_free
  ------------------
  846|       |
  847|      3|   return 0; /* failure */
  848|      3|}
pngerror.c:png_format_buffer:
  382|  5.89k|{
  383|  5.89k|   png_uint_32 chunk_name = png_ptr->chunk_name;
  384|  5.89k|   int iout = 0, ishift = 24;
  385|       |
  386|  29.4k|   while (ishift >= 0)
  ------------------
  |  Branch (386:11): [True: 23.5k, False: 5.89k]
  ------------------
  387|  23.5k|   {
  388|  23.5k|      int c = (int)(chunk_name >> ishift) & 0xff;
  389|       |
  390|  23.5k|      ishift -= 8;
  391|  23.5k|      if (isnonalpha(c) != 0)
  ------------------
  |  |  373|  23.5k|#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))
  |  |  ------------------
  |  |  |  Branch (373:24): [True: 16, False: 23.5k]
  |  |  |  Branch (373:36): [True: 1, False: 23.5k]
  |  |  |  Branch (373:50): [True: 6.89k, False: 16.6k]
  |  |  |  Branch (373:62): [True: 1, False: 6.89k]
  |  |  ------------------
  ------------------
  |  Branch (391:11): [True: 18, False: 23.5k]
  ------------------
  392|     18|      {
  393|     18|         buffer[iout++] = PNG_LITERAL_LEFT_SQUARE_BRACKET;
  ------------------
  |  |   42|     18|#    define PNG_LITERAL_LEFT_SQUARE_BRACKET 0x5b
  ------------------
  394|     18|         buffer[iout++] = png_digit[(c & 0xf0) >> 4];
  395|     18|         buffer[iout++] = png_digit[c & 0x0f];
  396|     18|         buffer[iout++] = PNG_LITERAL_RIGHT_SQUARE_BRACKET;
  ------------------
  |  |   45|     18|#    define PNG_LITERAL_RIGHT_SQUARE_BRACKET 0x5d
  ------------------
  397|     18|      }
  398|       |
  399|  23.5k|      else
  400|  23.5k|      {
  401|  23.5k|         buffer[iout++] = (char)c;
  402|  23.5k|      }
  403|  23.5k|   }
  404|       |
  405|  5.89k|   if (error_message == NULL)
  ------------------
  |  Branch (405:8): [True: 0, False: 5.89k]
  ------------------
  406|      0|      buffer[iout] = '\0';
  407|       |
  408|  5.89k|   else
  409|  5.89k|   {
  410|  5.89k|      int iin = 0;
  411|       |
  412|  5.89k|      buffer[iout++] = ':';
  413|  5.89k|      buffer[iout++] = ' ';
  414|       |
  415|   268k|      while (iin < PNG_MAX_ERROR_TEXT-1 && error_message[iin] != '\0')
  ------------------
  |  |  364|   268k|#define PNG_MAX_ERROR_TEXT 196 /* Currently limited by profile_error in png.c */
  ------------------
  |  Branch (415:14): [True: 268k, False: 0]
  |  Branch (415:44): [True: 262k, False: 5.89k]
  ------------------
  416|   262k|         buffer[iout++] = error_message[iin++];
  417|       |
  418|       |      /* iin < PNG_MAX_ERROR_TEXT, so the following is safe: */
  419|  5.89k|      buffer[iout] = '\0';
  420|  5.89k|   }
  421|  5.89k|}
pngerror.c:png_default_error:
  660|     13|{
  661|       |#ifdef PNG_CONSOLE_IO_SUPPORTED
  662|       |   fprintf(stderr, "libpng error: %s", error_message ? error_message :
  663|       |      "undefined");
  664|       |   fprintf(stderr, PNG_STRING_NEWLINE);
  665|       |#else
  666|     13|   PNG_UNUSED(error_message) /* Make compiler happy */
  ------------------
  |  |  479|     13|#  define PNG_UNUSED(param) (void)param;
  ------------------
  667|     13|#endif
  668|     13|   png_longjmp(png_ptr, 1);
  ------------------
  |  |  346|     26|#define png_longjmp OSS_FUZZ_png_longjmp
  ------------------
  669|     13|}
pngerror.c:png_default_warning:
  701|  6.30k|{
  702|       |#ifdef PNG_CONSOLE_IO_SUPPORTED
  703|       |   fprintf(stderr, "libpng warning: %s", warning_message);
  704|       |   fprintf(stderr, PNG_STRING_NEWLINE);
  705|       |#else
  706|  6.30k|   PNG_UNUSED(warning_message) /* Make compiler happy */
  ------------------
  |  |  479|  6.30k|#  define PNG_UNUSED(param) (void)param;
  ------------------
  707|  6.30k|#endif
  708|  6.30k|   PNG_UNUSED(png_ptr) /* Make compiler happy */
  ------------------
  |  |  479|  6.30k|#  define PNG_UNUSED(param) (void)param;
  ------------------
  709|  6.30k|}

OSS_FUZZ_png_get_rowbytes:
   41|      3|{
   42|      3|   if (png_ptr != NULL && info_ptr != NULL)
  ------------------
  |  Branch (42:8): [True: 3, False: 0]
  |  Branch (42:27): [True: 3, False: 0]
  ------------------
   43|      3|      return info_ptr->rowbytes;
   44|       |
   45|      0|   return 0;
   46|      3|}
OSS_FUZZ_png_get_IHDR:
  942|      5|{
  943|      5|   png_debug1(1, "in %s retrieval function", "IHDR");
  ------------------
  |  |  148|      5|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  944|       |
  945|      5|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (945:8): [True: 0, False: 5]
  |  Branch (945:27): [True: 0, False: 5]
  ------------------
  946|      0|      return 0;
  947|       |
  948|      5|   if (width != NULL)
  ------------------
  |  Branch (948:8): [True: 5, False: 0]
  ------------------
  949|      5|       *width = info_ptr->width;
  950|       |
  951|      5|   if (height != NULL)
  ------------------
  |  Branch (951:8): [True: 5, False: 0]
  ------------------
  952|      5|       *height = info_ptr->height;
  953|       |
  954|      5|   if (bit_depth != NULL)
  ------------------
  |  Branch (954:8): [True: 5, False: 0]
  ------------------
  955|      5|       *bit_depth = info_ptr->bit_depth;
  956|       |
  957|      5|   if (color_type != NULL)
  ------------------
  |  Branch (957:8): [True: 5, False: 0]
  ------------------
  958|      5|       *color_type = info_ptr->color_type;
  959|       |
  960|      5|   if (compression_type != NULL)
  ------------------
  |  Branch (960:8): [True: 5, False: 0]
  ------------------
  961|      5|      *compression_type = info_ptr->compression_type;
  962|       |
  963|      5|   if (filter_type != NULL)
  ------------------
  |  Branch (963:8): [True: 5, False: 0]
  ------------------
  964|      5|      *filter_type = info_ptr->filter_type;
  965|       |
  966|      5|   if (interlace_type != NULL)
  ------------------
  |  Branch (966:8): [True: 5, False: 0]
  ------------------
  967|      5|      *interlace_type = info_ptr->interlace_type;
  968|       |
  969|       |   /* This is redundant if we can be sure that the info_ptr values were all
  970|       |    * assigned in png_set_IHDR().  We do the check anyhow in case an
  971|       |    * application has ignored our advice not to mess with the members
  972|       |    * of info_ptr directly.
  973|       |    */
  974|      5|   png_check_IHDR(png_ptr, info_ptr->width, info_ptr->height,
  ------------------
  |  |   72|      5|#define png_check_IHDR OSS_FUZZ_png_check_IHDR
  ------------------
  975|      5|       info_ptr->bit_depth, info_ptr->color_type, info_ptr->interlace_type,
  976|      5|       info_ptr->compression_type, info_ptr->filter_type);
  977|       |
  978|      5|   return 1;
  979|      5|}

OSS_FUZZ_png_destroy_png_struct:
   25|     31|{
   26|     31|   if (png_ptr != NULL)
  ------------------
  |  Branch (26:8): [True: 31, False: 0]
  ------------------
   27|     31|   {
   28|       |      /* png_free might call png_error and may certainly call
   29|       |       * png_get_mem_ptr, so fake a temporary png_struct to support this.
   30|       |       */
   31|     31|      png_struct dummy_struct = *png_ptr;
   32|     31|      memset(png_ptr, 0, (sizeof *png_ptr));
   33|     31|      png_free(&dummy_struct, png_ptr);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
   34|       |
   35|     31|#     ifdef PNG_SETJMP_SUPPORTED
   36|       |         /* We may have a jmp_buf left to deallocate. */
   37|     31|         png_free_jmpbuf(&dummy_struct);
  ------------------
  |  |   13|     31|#define png_free_jmpbuf OSS_FUZZ_png_free_jmpbuf
  ------------------
   38|     31|#     endif
   39|     31|   }
   40|     31|}
OSS_FUZZ_png_calloc:
   51|      5|{
   52|      5|   png_voidp ret;
   53|       |
   54|      5|   ret = png_malloc(png_ptr, size);
  ------------------
  |  |  347|      5|#define png_malloc OSS_FUZZ_png_malloc
  ------------------
   55|       |
   56|      5|   if (ret != NULL)
  ------------------
  |  Branch (56:8): [True: 5, False: 0]
  ------------------
   57|      5|      memset(ret, 0, size);
   58|       |
   59|      5|   return ret;
   60|      5|}
OSS_FUZZ_png_malloc_base:
   70|  5.53k|{
   71|       |   /* Moved to png_malloc_base from png_malloc_default in 1.6.0; the DOS
   72|       |    * allocators have also been removed in 1.6.0, so any 16-bit system now has
   73|       |    * to implement a user memory handler.  This checks to be sure it isn't
   74|       |    * called with big numbers.
   75|       |    */
   76|       |#  ifdef PNG_MAX_MALLOC_64K
   77|       |      /* This is support for legacy systems which had segmented addressing
   78|       |       * limiting the maximum allocation size to 65536.  It takes precedence
   79|       |       * over PNG_SIZE_MAX which is set to 65535 on true 16-bit systems.
   80|       |       *
   81|       |       * TODO: libpng-1.8: finally remove both cases.
   82|       |       */
   83|       |      if (size > 65536U) return NULL;
   84|       |#  endif
   85|       |
   86|       |   /* This is checked too because the system malloc call below takes a (size_t).
   87|       |    */
   88|  5.53k|   if (size > PNG_SIZE_MAX) return NULL;
  ------------------
  |  |  649|  5.53k|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
  |  Branch (88:8): [True: 0, False: 5.53k]
  ------------------
   89|       |
   90|  5.53k|#  ifdef PNG_USER_MEM_SUPPORTED
   91|  5.53k|      if (png_ptr != NULL && png_ptr->malloc_fn != NULL)
  ------------------
  |  Branch (91:11): [True: 5.53k, False: 0]
  |  Branch (91:30): [True: 5.45k, False: 84]
  ------------------
   92|  5.45k|         return png_ptr->malloc_fn(png_constcast(png_structrp,png_ptr), size);
  ------------------
  |  |  536|  5.45k|#  define png_constcast(type, value) ((type)(void*)(const void*)(value))
  ------------------
   93|       |#  else
   94|       |      PNG_UNUSED(png_ptr)
   95|       |#  endif
   96|       |
   97|       |   /* Use the system malloc */
   98|     84|   return malloc((size_t)/*SAFE*/size); /* checked for truncation above */
   99|  5.53k|}
OSS_FUZZ_png_malloc_array:
  124|    261|{
  125|    261|   if (nelements <= 0 || element_size == 0)
  ------------------
  |  Branch (125:8): [True: 0, False: 261]
  |  Branch (125:26): [True: 0, False: 261]
  ------------------
  126|      0|      png_error(png_ptr, "internal error: array alloc");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  127|       |
  128|    261|   return png_malloc_array_checked(png_ptr, nelements, element_size);
  129|    261|}
OSS_FUZZ_png_realloc_array:
  135|    384|{
  136|       |   /* These are internal errors: */
  137|    384|   if (add_elements <= 0 || element_size == 0 || old_elements < 0 ||
  ------------------
  |  Branch (137:8): [True: 0, False: 384]
  |  Branch (137:29): [True: 0, False: 384]
  |  Branch (137:50): [True: 0, False: 384]
  ------------------
  138|    384|      (old_array == NULL && old_elements > 0))
  ------------------
  |  Branch (138:8): [True: 7, False: 377]
  |  Branch (138:29): [True: 0, False: 7]
  ------------------
  139|      0|      png_error(png_ptr, "internal error: array realloc");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  140|       |
  141|       |   /* Check for overflow on the elements count (so the caller does not have to
  142|       |    * check.)
  143|       |    */
  144|    384|   if (add_elements <= INT_MAX - old_elements)
  ------------------
  |  Branch (144:8): [True: 384, False: 0]
  ------------------
  145|    384|   {
  146|    384|      png_voidp new_array = png_malloc_array_checked(png_ptr,
  147|    384|          old_elements+add_elements, element_size);
  148|       |
  149|    384|      if (new_array != NULL)
  ------------------
  |  Branch (149:11): [True: 347, False: 37]
  ------------------
  150|    347|      {
  151|       |         /* Because png_malloc_array worked the size calculations below cannot
  152|       |          * overflow.
  153|       |          */
  154|    347|         if (old_elements > 0)
  ------------------
  |  Branch (154:14): [True: 340, False: 7]
  ------------------
  155|    340|            memcpy(new_array, old_array, element_size*(unsigned)old_elements);
  156|       |
  157|    347|         memset((char*)new_array + element_size*(unsigned)old_elements, 0,
  158|    347|             element_size*(unsigned)add_elements);
  159|       |
  160|    347|         return new_array;
  161|    347|      }
  162|    384|   }
  163|       |
  164|     37|   return NULL; /* error */
  165|    384|}
OSS_FUZZ_png_malloc:
  175|     13|{
  176|     13|   png_voidp ret;
  177|       |
  178|     13|   if (png_ptr == NULL)
  ------------------
  |  Branch (178:8): [True: 0, False: 13]
  ------------------
  179|      0|      return NULL;
  180|       |
  181|     13|   ret = png_malloc_base(png_ptr, size);
  ------------------
  |  |    8|     13|#define png_malloc_base OSS_FUZZ_png_malloc_base
  ------------------
  182|       |
  183|     13|   if (ret == NULL)
  ------------------
  |  Branch (183:8): [True: 2, False: 11]
  ------------------
  184|      2|       png_error(png_ptr, "Out of memory"); /* 'm' means png_malloc */
  ------------------
  |  |  252|      2|#define png_error OSS_FUZZ_png_error
  ------------------
  185|       |
  186|     11|   return ret;
  187|     13|}
OSS_FUZZ_png_malloc_warn:
  216|  4.02k|{
  217|  4.02k|   if (png_ptr != NULL)
  ------------------
  |  Branch (217:8): [True: 4.02k, False: 0]
  ------------------
  218|  4.02k|   {
  219|  4.02k|      png_voidp ret = png_malloc_base(png_ptr, size);
  ------------------
  |  |    8|  4.02k|#define png_malloc_base OSS_FUZZ_png_malloc_base
  ------------------
  220|       |
  221|  4.02k|      if (ret != NULL)
  ------------------
  |  Branch (221:11): [True: 3.89k, False: 130]
  ------------------
  222|  3.89k|         return ret;
  223|       |
  224|    130|      png_warning(png_ptr, "Out of memory");
  ------------------
  |  |  450|    130|#define png_warning OSS_FUZZ_png_warning
  ------------------
  225|    130|   }
  226|       |
  227|    130|   return NULL;
  228|  4.02k|}
OSS_FUZZ_png_free:
  235|  6.18k|{
  236|  6.18k|   if (png_ptr == NULL || ptr == NULL)
  ------------------
  |  Branch (236:8): [True: 0, False: 6.18k]
  |  Branch (236:27): [True: 860, False: 5.32k]
  ------------------
  237|    860|      return;
  238|       |
  239|  5.32k|#ifdef PNG_USER_MEM_SUPPORTED
  240|  5.32k|   if (png_ptr->free_fn != NULL)
  ------------------
  |  Branch (240:8): [True: 5.29k, False: 24]
  ------------------
  241|  5.29k|      png_ptr->free_fn(png_constcast(png_structrp,png_ptr), ptr);
  ------------------
  |  |  536|  5.29k|#  define png_constcast(type, value) ((type)(void*)(const void*)(value))
  ------------------
  242|       |
  243|     24|   else
  244|     24|      png_free_default(png_ptr, ptr);
  ------------------
  |  |  255|     24|#define png_free_default OSS_FUZZ_png_free_default
  ------------------
  245|  5.32k|}
OSS_FUZZ_png_free_default:
  250|     24|{
  251|     24|   if (png_ptr == NULL || ptr == NULL)
  ------------------
  |  Branch (251:8): [True: 0, False: 24]
  |  Branch (251:27): [True: 0, False: 24]
  ------------------
  252|      0|      return;
  253|     24|#endif /* USER_MEM */
  254|       |
  255|     24|   free(ptr);
  256|     24|}
OSS_FUZZ_png_set_mem_fn:
  265|     47|{
  266|     47|   if (png_ptr != NULL)
  ------------------
  |  Branch (266:8): [True: 47, False: 0]
  ------------------
  267|     47|   {
  268|     47|      png_ptr->mem_ptr = mem_ptr;
  269|     47|      png_ptr->malloc_fn = malloc_fn;
  270|     47|      png_ptr->free_fn = free_fn;
  271|     47|   }
  272|     47|}
pngmem.c:png_malloc_array_checked:
  110|    645|{
  111|    645|   png_alloc_size_t req = (png_alloc_size_t)nelements; /* known to be > 0 */
  112|       |
  113|    645|   if (req <= PNG_SIZE_MAX/element_size)
  ------------------
  |  |  649|    645|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
  |  Branch (113:8): [True: 645, False: 0]
  ------------------
  114|    645|      return png_malloc_base(png_ptr, req * element_size);
  ------------------
  |  |    8|    645|#define png_malloc_base OSS_FUZZ_png_malloc_base
  ------------------
  115|       |
  116|       |   /* The failure case when the request is too large */
  117|      0|   return NULL;
  118|    645|}

OSS_FUZZ_png_create_read_struct:
   28|     31|{
   29|       |#ifndef PNG_USER_MEM_SUPPORTED
   30|       |   png_structp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
   31|       |        error_fn, warn_fn, NULL, NULL, NULL);
   32|       |#else
   33|     31|   return png_create_read_struct_2(user_png_ver, error_ptr, error_fn,
  ------------------
  |  |  245|     31|#define png_create_read_struct_2 OSS_FUZZ_png_create_read_struct_2
  ------------------
   34|     31|        warn_fn, NULL, NULL, NULL);
   35|     31|}
OSS_FUZZ_png_create_read_struct_2:
   45|     31|{
   46|     31|   png_structp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
  ------------------
  |  |   11|     31|#define png_create_png_struct OSS_FUZZ_png_create_png_struct
  ------------------
   47|     31|       error_fn, warn_fn, mem_ptr, malloc_fn, free_fn);
   48|     31|#endif /* USER_MEM */
   49|       |
   50|     31|   if (png_ptr != NULL)
  ------------------
  |  Branch (50:8): [True: 31, False: 0]
  ------------------
   51|     31|   {
   52|     31|      png_ptr->mode = PNG_IS_READ_STRUCT;
  ------------------
  |  |  655|     31|#define PNG_IS_READ_STRUCT        0x8000U /* Else is a write struct */
  ------------------
   53|       |
   54|       |      /* Added in libpng-1.6.0; this can be used to detect a read structure if
   55|       |       * required (it will be zero in a write structure.)
   56|       |       */
   57|     31|#     ifdef PNG_SEQUENTIAL_READ_SUPPORTED
   58|     31|         png_ptr->IDAT_read_size = PNG_IDAT_READ_SIZE;
  ------------------
  |  |  209|     31|#define PNG_IDAT_READ_SIZE PNG_ZBUF_SIZE
  |  |  ------------------
  |  |  |  |  226|     31|#define PNG_ZBUF_SIZE 8192
  |  |  ------------------
  ------------------
   59|     31|#     endif
   60|       |
   61|     31|#     ifdef PNG_BENIGN_READ_ERRORS_SUPPORTED
   62|     31|         png_ptr->flags |= PNG_FLAG_BENIGN_ERRORS_WARN;
  ------------------
  |  |  715|     31|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
   63|       |
   64|       |         /* In stable builds only warn if an application error can be completely
   65|       |          * handled.
   66|       |          */
   67|       |#        if PNG_RELEASE_BUILD
   68|       |            png_ptr->flags |= PNG_FLAG_APP_WARNINGS_WARN;
   69|       |#        endif
   70|     31|#     endif
   71|       |
   72|       |      /* TODO: delay this, it can be done in png_init_io (if the app doesn't
   73|       |       * do it itself) avoiding setting the default function if it is not
   74|       |       * required.
   75|       |       */
   76|     31|      png_set_read_fn(png_ptr, NULL, NULL);
  ------------------
  |  |  417|     31|#define png_set_read_fn OSS_FUZZ_png_set_read_fn
  ------------------
   77|     31|   }
   78|       |
   79|     31|   return png_ptr;
   80|     31|}
OSS_FUZZ_png_read_info:
   94|     19|{
   95|     19|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
   96|     19|   int keep;
   97|     19|#endif
   98|       |
   99|     19|   png_debug(1, "in png_read_info");
  ------------------
  |  |  145|     19|#  define png_debug(l, m) ((void)0)
  ------------------
  100|       |
  101|     19|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (101:8): [True: 0, False: 19]
  |  Branch (101:27): [True: 0, False: 19]
  ------------------
  102|      0|      return;
  103|       |
  104|       |   /* Read and check the PNG file signature. */
  105|     19|   png_read_sig(png_ptr, info_ptr);
  ------------------
  |  |   21|     19|#define png_read_sig OSS_FUZZ_png_read_sig
  ------------------
  106|       |
  107|     19|   for (;;)
  108|  7.98k|   {
  109|  7.98k|      png_uint_32 length = png_read_chunk_header(png_ptr);
  ------------------
  |  |   22|  7.98k|#define png_read_chunk_header OSS_FUZZ_png_read_chunk_header
  ------------------
  110|  7.98k|      png_uint_32 chunk_name = png_ptr->chunk_name;
  111|       |
  112|       |      /* IDAT logic needs to happen here to simplify getting the two flags
  113|       |       * right.
  114|       |       */
  115|  7.98k|      if (chunk_name == png_IDAT)
  ------------------
  |  |  886|  7.98k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|  7.98k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (115:11): [True: 5, False: 7.97k]
  ------------------
  116|      5|      {
  117|      5|         if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  642|      5|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (117:14): [True: 0, False: 5]
  ------------------
  118|      0|            png_chunk_error(png_ptr, "Missing IHDR before IDAT");
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  119|       |
  120|      5|         else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  ------------------
  |  |  667|     10|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      5|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      5|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (120:19): [True: 0, False: 5]
  ------------------
  121|      0|             (png_ptr->mode & PNG_HAVE_PLTE) == 0)
  ------------------
  |  |  643|      0|#define PNG_HAVE_PLTE  0x02
  ------------------
  |  Branch (121:14): [True: 0, False: 0]
  ------------------
  122|      0|            png_chunk_error(png_ptr, "Missing PLTE before IDAT");
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  123|       |
  124|      5|         else if ((png_ptr->mode & PNG_AFTER_IDAT) != 0)
  ------------------
  |  |  644|      5|#define PNG_AFTER_IDAT 0x08
  ------------------
  |  Branch (124:19): [True: 0, False: 5]
  ------------------
  125|      0|            png_chunk_benign_error(png_ptr, "Too many IDATs found");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
  126|       |
  127|      5|         png_ptr->mode |= PNG_HAVE_IDAT;
  ------------------
  |  |  642|      5|#define PNG_HAVE_IDAT               0x04U
  ------------------
  128|      5|      }
  129|       |
  130|  7.97k|      else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
  ------------------
  |  |  642|  7.97k|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (130:16): [True: 0, False: 7.97k]
  ------------------
  131|      0|      {
  132|      0|         png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
  ------------------
  |  |  653|      0|#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
  ------------------
  133|      0|         png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  644|      0|#define PNG_AFTER_IDAT 0x08
  ------------------
  134|      0|      }
  135|       |
  136|  7.98k|      if (chunk_name == png_IHDR)
  ------------------
  |  |  888|  7.98k|#define png_IHDR PNG_U32( 73,  72,  68,  82)
  |  |  ------------------
  |  |  |  |  845|  7.98k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (136:11): [True: 18, False: 7.96k]
  ------------------
  137|     18|         png_handle_chunk(png_ptr, info_ptr, length);
  ------------------
  |  |   50|     18|#define png_handle_chunk OSS_FUZZ_png_handle_chunk
  ------------------
  138|       |
  139|  7.96k|      else if (chunk_name == png_IEND)
  ------------------
  |  |  887|  7.96k|#define png_IEND PNG_U32( 73,  69,  78,  68)
  |  |  ------------------
  |  |  |  |  845|  7.96k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.96k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.96k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.96k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.96k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (139:16): [True: 0, False: 7.96k]
  ------------------
  140|      0|         png_handle_chunk(png_ptr, info_ptr, length);
  ------------------
  |  |   50|      0|#define png_handle_chunk OSS_FUZZ_png_handle_chunk
  ------------------
  141|       |
  142|  7.96k|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  143|  7.96k|      else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0)
  ------------------
  |  |   51|  7.96k|#define png_chunk_unknown_handling OSS_FUZZ_png_chunk_unknown_handling
  ------------------
  |  Branch (143:16): [True: 0, False: 7.96k]
  ------------------
  144|      0|      {
  145|      0|         png_handle_unknown(png_ptr, info_ptr, length, keep);
  ------------------
  |  |   49|      0|#define png_handle_unknown OSS_FUZZ_png_handle_unknown
  ------------------
  146|       |
  147|      0|         if (chunk_name == png_PLTE)
  ------------------
  |  |  889|      0|#define png_PLTE PNG_U32( 80,  76,  84,  69)
  |  |  ------------------
  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (147:14): [True: 0, False: 0]
  ------------------
  148|      0|            png_ptr->mode |= PNG_HAVE_PLTE;
  ------------------
  |  |  643|      0|#define PNG_HAVE_PLTE  0x02
  ------------------
  149|       |
  150|      0|         else if (chunk_name == png_IDAT)
  ------------------
  |  |  886|      0|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (150:19): [True: 0, False: 0]
  ------------------
  151|      0|         {
  152|      0|            png_ptr->idat_size = 0; /* It has been consumed */
  153|      0|            break;
  154|      0|         }
  155|      0|      }
  156|  7.96k|#endif
  157|       |
  158|  7.96k|      else if (chunk_name == png_IDAT)
  ------------------
  |  |  886|  7.96k|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|  7.96k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.96k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.96k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.96k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.96k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (158:16): [True: 5, False: 7.95k]
  ------------------
  159|      5|      {
  160|      5|         png_ptr->idat_size = length;
  161|      5|         break;
  162|      5|      }
  163|       |
  164|  7.95k|      else
  165|  7.95k|         png_handle_chunk(png_ptr, info_ptr, length);
  ------------------
  |  |   50|  7.95k|#define png_handle_chunk OSS_FUZZ_png_handle_chunk
  ------------------
  166|  7.98k|   }
  167|     19|}
OSS_FUZZ_png_read_update_info:
  173|      5|{
  174|      5|   png_debug(1, "in png_read_update_info");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
  175|       |
  176|      5|   if (png_ptr != NULL)
  ------------------
  |  Branch (176:8): [True: 5, False: 0]
  ------------------
  177|      5|   {
  178|      5|      if ((png_ptr->flags & PNG_FLAG_ROW_INIT) == 0)
  ------------------
  |  |  701|      5|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
  |  Branch (178:11): [True: 5, False: 0]
  ------------------
  179|      5|      {
  180|      5|         png_read_start_row(png_ptr);
  ------------------
  |  |   41|      5|#define png_read_start_row OSS_FUZZ_png_read_start_row
  ------------------
  181|       |
  182|      5|#        ifdef PNG_READ_TRANSFORMS_SUPPORTED
  183|      5|            png_read_transform_info(png_ptr, info_ptr);
  ------------------
  |  |   43|      5|#define png_read_transform_info OSS_FUZZ_png_read_transform_info
  ------------------
  184|       |#        else
  185|       |            PNG_UNUSED(info_ptr)
  186|       |#        endif
  187|      5|      }
  188|       |
  189|       |      /* New in 1.6.0 this avoids the bug of doing the initializations twice */
  190|      0|      else
  191|      0|         png_app_error(png_ptr,
  ------------------
  |  |   82|      0|#define png_app_error OSS_FUZZ_png_app_error
  ------------------
  192|      0|             "png_read_update_info/png_start_read_image: duplicate call");
  193|      5|   }
  194|      5|}
OSS_FUZZ_png_read_row:
  289|     63|{
  290|     63|   png_row_info row_info;
  291|       |
  292|     63|   if (png_ptr == NULL)
  ------------------
  |  Branch (292:8): [True: 0, False: 63]
  ------------------
  293|      0|      return;
  294|       |
  295|     63|   png_debug2(1, "in png_read_row (row %lu, pass %d)",
  ------------------
  |  |  151|     63|#  define png_debug2(l, m, p1, p2) ((void)0)
  ------------------
  296|     63|       (unsigned long)png_ptr->row_number, png_ptr->pass);
  297|       |
  298|       |   /* png_read_start_row sets the information (in particular iwidth) for this
  299|       |    * interlace pass.
  300|       |    */
  301|     63|   if ((png_ptr->flags & PNG_FLAG_ROW_INIT) == 0)
  ------------------
  |  |  701|     63|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
  |  Branch (301:8): [True: 0, False: 63]
  ------------------
  302|      0|      png_read_start_row(png_ptr);
  ------------------
  |  |   41|      0|#define png_read_start_row OSS_FUZZ_png_read_start_row
  ------------------
  303|       |
  304|       |   /* 1.5.6: row_info moved out of png_struct to a local here. */
  305|     63|   row_info.width = png_ptr->iwidth; /* NOTE: width of current interlaced row */
  306|     63|   row_info.color_type = png_ptr->color_type;
  307|     63|   row_info.bit_depth = png_ptr->bit_depth;
  308|     63|   row_info.channels = png_ptr->channels;
  309|     63|   row_info.pixel_depth = png_ptr->pixel_depth;
  310|     63|   row_info.rowbytes = PNG_ROWBYTES(row_info.pixel_depth, row_info.width);
  ------------------
  |  |  755|     63|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 0, False: 63]
  |  |  ------------------
  |  |  756|     63|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|     63|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
  311|       |
  312|     63|#ifdef PNG_WARNINGS_SUPPORTED
  313|     63|   if (png_ptr->row_number == 0 && png_ptr->pass == 0)
  ------------------
  |  Branch (313:8): [True: 21, False: 42]
  |  Branch (313:36): [True: 3, False: 18]
  ------------------
  314|      3|   {
  315|       |   /* Check for transforms that have been set but were defined out */
  316|       |#if defined(PNG_WRITE_INVERT_SUPPORTED) && !defined(PNG_READ_INVERT_SUPPORTED)
  317|       |   if ((png_ptr->transformations & PNG_INVERT_MONO) != 0)
  318|       |      png_warning(png_ptr, "PNG_READ_INVERT_SUPPORTED is not defined");
  319|       |#endif
  320|       |
  321|       |#if defined(PNG_WRITE_FILLER_SUPPORTED) && !defined(PNG_READ_FILLER_SUPPORTED)
  322|       |   if ((png_ptr->transformations & PNG_FILLER) != 0)
  323|       |      png_warning(png_ptr, "PNG_READ_FILLER_SUPPORTED is not defined");
  324|       |#endif
  325|       |
  326|       |#if defined(PNG_WRITE_PACKSWAP_SUPPORTED) && \
  327|       |    !defined(PNG_READ_PACKSWAP_SUPPORTED)
  328|       |   if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
  329|       |      png_warning(png_ptr, "PNG_READ_PACKSWAP_SUPPORTED is not defined");
  330|       |#endif
  331|       |
  332|       |#if defined(PNG_WRITE_PACK_SUPPORTED) && !defined(PNG_READ_PACK_SUPPORTED)
  333|       |   if ((png_ptr->transformations & PNG_PACK) != 0)
  334|       |      png_warning(png_ptr, "PNG_READ_PACK_SUPPORTED is not defined");
  335|       |#endif
  336|       |
  337|       |#if defined(PNG_WRITE_SHIFT_SUPPORTED) && !defined(PNG_READ_SHIFT_SUPPORTED)
  338|       |   if ((png_ptr->transformations & PNG_SHIFT) != 0)
  339|       |      png_warning(png_ptr, "PNG_READ_SHIFT_SUPPORTED is not defined");
  340|       |#endif
  341|       |
  342|       |#if defined(PNG_WRITE_BGR_SUPPORTED) && !defined(PNG_READ_BGR_SUPPORTED)
  343|       |   if ((png_ptr->transformations & PNG_BGR) != 0)
  344|       |      png_warning(png_ptr, "PNG_READ_BGR_SUPPORTED is not defined");
  345|       |#endif
  346|       |
  347|       |#if defined(PNG_WRITE_SWAP_SUPPORTED) && !defined(PNG_READ_SWAP_SUPPORTED)
  348|       |   if ((png_ptr->transformations & PNG_SWAP_BYTES) != 0)
  349|       |      png_warning(png_ptr, "PNG_READ_SWAP_SUPPORTED is not defined");
  350|       |#endif
  351|      3|   }
  352|     63|#endif /* WARNINGS */
  353|       |
  354|     63|#ifdef PNG_READ_INTERLACING_SUPPORTED
  355|       |   /* If interlaced and we do not need a new row, combine row and return.
  356|       |    * Notice that the pixels we have from previous rows have been transformed
  357|       |    * already; we can only combine like with like (transformed or
  358|       |    * untransformed) and, because of the libpng API for interlaced images, this
  359|       |    * means we must transform before de-interlacing.
  360|       |    */
  361|     63|   if (png_ptr->interlaced != 0 &&
  ------------------
  |  Branch (361:8): [True: 63, False: 0]
  ------------------
  362|     63|       (png_ptr->transformations & PNG_INTERLACE) != 0)
  ------------------
  |  |  659|     63|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (362:8): [True: 63, False: 0]
  ------------------
  363|     63|   {
  364|     63|      switch (png_ptr->pass)
  365|     63|      {
  366|      9|         case 0:
  ------------------
  |  Branch (366:10): [True: 9, False: 54]
  ------------------
  367|      9|            if (png_ptr->row_number & 0x07)
  ------------------
  |  Branch (367:17): [True: 6, False: 3]
  ------------------
  368|      6|            {
  369|      6|               if (dsp_row != NULL)
  ------------------
  |  Branch (369:20): [True: 0, False: 6]
  ------------------
  370|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  371|      6|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|      6|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  372|      6|               return;
  373|      6|            }
  374|      3|            break;
  375|       |
  376|      9|         case 1:
  ------------------
  |  Branch (376:10): [True: 9, False: 54]
  ------------------
  377|      9|            if ((png_ptr->row_number & 0x07) || png_ptr->width < 5)
  ------------------
  |  Branch (377:17): [True: 6, False: 3]
  |  Branch (377:49): [True: 0, False: 3]
  ------------------
  378|      6|            {
  379|      6|               if (dsp_row != NULL)
  ------------------
  |  Branch (379:20): [True: 0, False: 6]
  ------------------
  380|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  381|       |
  382|      6|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|      6|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  383|      6|               return;
  384|      6|            }
  385|      3|            break;
  386|       |
  387|      9|         case 2:
  ------------------
  |  Branch (387:10): [True: 9, False: 54]
  ------------------
  388|      9|            if ((png_ptr->row_number & 0x07) != 4)
  ------------------
  |  Branch (388:17): [True: 9, False: 0]
  ------------------
  389|      9|            {
  390|      9|               if (dsp_row != NULL && (png_ptr->row_number & 4))
  ------------------
  |  Branch (390:20): [True: 0, False: 9]
  |  Branch (390:39): [True: 0, False: 0]
  ------------------
  391|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  392|       |
  393|      9|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|      9|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  394|      9|               return;
  395|      9|            }
  396|      0|            break;
  397|       |
  398|      9|         case 3:
  ------------------
  |  Branch (398:10): [True: 9, False: 54]
  ------------------
  399|      9|            if ((png_ptr->row_number & 3) || png_ptr->width < 3)
  ------------------
  |  Branch (399:17): [True: 6, False: 3]
  |  Branch (399:46): [True: 0, False: 3]
  ------------------
  400|      6|            {
  401|      6|               if (dsp_row != NULL)
  ------------------
  |  Branch (401:20): [True: 0, False: 6]
  ------------------
  402|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  403|       |
  404|      6|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|      6|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  405|      6|               return;
  406|      6|            }
  407|      3|            break;
  408|       |
  409|      9|         case 4:
  ------------------
  |  Branch (409:10): [True: 9, False: 54]
  ------------------
  410|      9|            if ((png_ptr->row_number & 3) != 2)
  ------------------
  |  Branch (410:17): [True: 6, False: 3]
  ------------------
  411|      6|            {
  412|      6|               if (dsp_row != NULL && (png_ptr->row_number & 2))
  ------------------
  |  Branch (412:20): [True: 0, False: 6]
  |  Branch (412:39): [True: 0, False: 0]
  ------------------
  413|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  414|       |
  415|      6|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|      6|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  416|      6|               return;
  417|      6|            }
  418|      3|            break;
  419|       |
  420|      9|         case 5:
  ------------------
  |  Branch (420:10): [True: 9, False: 54]
  ------------------
  421|      9|            if ((png_ptr->row_number & 1) || png_ptr->width < 2)
  ------------------
  |  Branch (421:17): [True: 3, False: 6]
  |  Branch (421:46): [True: 0, False: 6]
  ------------------
  422|      3|            {
  423|      3|               if (dsp_row != NULL)
  ------------------
  |  Branch (423:20): [True: 0, False: 3]
  ------------------
  424|      0|                  png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  425|       |
  426|      3|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|      3|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  427|      3|               return;
  428|      3|            }
  429|      6|            break;
  430|       |
  431|      6|         default:
  ------------------
  |  Branch (431:10): [True: 0, False: 63]
  ------------------
  432|      9|         case 6:
  ------------------
  |  Branch (432:10): [True: 9, False: 54]
  ------------------
  433|      9|            if ((png_ptr->row_number & 1) == 0)
  ------------------
  |  Branch (433:17): [True: 6, False: 3]
  ------------------
  434|      6|            {
  435|      6|               png_read_finish_row(png_ptr);
  ------------------
  |  |   40|      6|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  436|      6|               return;
  437|      6|            }
  438|      3|            break;
  439|     63|      }
  440|     63|   }
  441|     21|#endif
  442|       |
  443|     21|   if ((png_ptr->mode & PNG_HAVE_IDAT) == 0)
  ------------------
  |  |  642|     21|#define PNG_HAVE_IDAT               0x04U
  ------------------
  |  Branch (443:8): [True: 0, False: 21]
  ------------------
  444|      0|      png_error(png_ptr, "Invalid attempt to read row data");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  445|       |
  446|       |   /* Fill the row with IDAT data: */
  447|     21|   png_ptr->row_buf[0]=255; /* to force error if no data was found */
  448|     21|   png_read_IDAT_data(png_ptr, png_ptr->row_buf, row_info.rowbytes + 1);
  ------------------
  |  |   38|     21|#define png_read_IDAT_data OSS_FUZZ_png_read_IDAT_data
  ------------------
  449|       |
  450|     21|   if (png_ptr->row_buf[0] > PNG_FILTER_VALUE_NONE)
  ------------------
  |  | 1541|     21|#define PNG_FILTER_VALUE_NONE  0
  ------------------
  |  Branch (450:8): [True: 21, False: 0]
  ------------------
  451|     21|   {
  452|     21|      if (png_ptr->row_buf[0] < PNG_FILTER_VALUE_LAST)
  ------------------
  |  | 1546|     21|#define PNG_FILTER_VALUE_LAST  5
  ------------------
  |  Branch (452:11): [True: 21, False: 0]
  ------------------
  453|     21|         png_read_filter_row(png_ptr, &row_info, png_ptr->row_buf + 1,
  ------------------
  |  |   36|     21|#define png_read_filter_row OSS_FUZZ_png_read_filter_row
  ------------------
  454|     21|             png_ptr->prev_row + 1, png_ptr->row_buf[0]);
  455|      0|      else
  456|      0|         png_error(png_ptr, "bad adaptive filter value");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  457|     21|   }
  458|       |
  459|       |   /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before
  460|       |    * 1.5.6, while the buffer really is this big in current versions of libpng
  461|       |    * it may not be in the future, so this was changed just to copy the
  462|       |    * interlaced count:
  463|       |    */
  464|     21|   memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1);
  465|       |
  466|     21|#ifdef PNG_MNG_FEATURES_SUPPORTED
  467|     21|   if ((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) != 0 &&
  ------------------
  |  |  876|     21|#define PNG_FLAG_MNG_FILTER_64      0x04
  ------------------
  |  Branch (467:8): [True: 0, False: 21]
  ------------------
  468|      0|       (png_ptr->filter_type == PNG_INTRAPIXEL_DIFFERENCING))
  ------------------
  |  |  681|      0|#define PNG_INTRAPIXEL_DIFFERENCING 64 /* Used only in MNG datastreams */
  ------------------
  |  Branch (468:8): [True: 0, False: 0]
  ------------------
  469|      0|   {
  470|       |      /* Intrapixel differencing */
  471|      0|      png_do_read_intrapixel(&row_info, png_ptr->row_buf + 1);
  472|      0|   }
  473|     21|#endif
  474|       |
  475|     21|#ifdef PNG_READ_TRANSFORMS_SUPPORTED
  476|     21|   if (png_ptr->transformations
  ------------------
  |  Branch (476:8): [True: 21, False: 0]
  ------------------
  477|      0|#     ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
  478|      0|         || png_ptr->num_palette_max >= 0
  ------------------
  |  Branch (478:13): [True: 0, False: 0]
  ------------------
  479|     21|#     endif
  480|     21|      )
  481|     21|      png_do_read_transformations(png_ptr, &row_info);
  ------------------
  |  |   52|     21|#define png_do_read_transformations OSS_FUZZ_png_do_read_transformations
  ------------------
  482|     21|#endif
  483|       |
  484|       |   /* The transformed pixel depth should match the depth now in row_info. */
  485|     21|   if (png_ptr->transformed_pixel_depth == 0)
  ------------------
  |  Branch (485:8): [True: 3, False: 18]
  ------------------
  486|      3|   {
  487|      3|      png_ptr->transformed_pixel_depth = row_info.pixel_depth;
  488|      3|      if (row_info.pixel_depth > png_ptr->maximum_pixel_depth)
  ------------------
  |  Branch (488:11): [True: 0, False: 3]
  ------------------
  489|      0|         png_error(png_ptr, "sequential row overflow");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  490|      3|   }
  491|       |
  492|     18|   else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth)
  ------------------
  |  Branch (492:13): [True: 0, False: 18]
  ------------------
  493|      0|      png_error(png_ptr, "internal sequential row size calculation error");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  494|       |
  495|     21|#ifdef PNG_READ_INTERLACING_SUPPORTED
  496|       |   /* Expand interlaced rows to full size */
  497|     21|   if (png_ptr->interlaced != 0 &&
  ------------------
  |  Branch (497:8): [True: 21, False: 0]
  ------------------
  498|     21|      (png_ptr->transformations & PNG_INTERLACE) != 0)
  ------------------
  |  |  659|     21|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (498:7): [True: 21, False: 0]
  ------------------
  499|     21|   {
  500|     21|      if (png_ptr->pass < 6)
  ------------------
  |  Branch (500:11): [True: 18, False: 3]
  ------------------
  501|     18|         png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass,
  ------------------
  |  |   35|     18|#define png_do_read_interlace OSS_FUZZ_png_do_read_interlace
  ------------------
  502|     18|             png_ptr->transformations);
  503|       |
  504|     21|      if (dsp_row != NULL)
  ------------------
  |  Branch (504:11): [True: 0, False: 21]
  ------------------
  505|      0|         png_combine_row(png_ptr, dsp_row, 1/*display*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  506|       |
  507|     21|      if (row != NULL)
  ------------------
  |  Branch (507:11): [True: 21, False: 0]
  ------------------
  508|     21|         png_combine_row(png_ptr, row, 0/*row*/);
  ------------------
  |  |   34|     21|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  509|     21|   }
  510|       |
  511|      0|   else
  512|      0|#endif
  513|      0|   {
  514|      0|      if (row != NULL)
  ------------------
  |  Branch (514:11): [True: 0, False: 0]
  ------------------
  515|      0|         png_combine_row(png_ptr, row, -1/*ignored*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  516|       |
  517|      0|      if (dsp_row != NULL)
  ------------------
  |  Branch (517:11): [True: 0, False: 0]
  ------------------
  518|      0|         png_combine_row(png_ptr, dsp_row, -1/*ignored*/);
  ------------------
  |  |   34|      0|#define png_combine_row OSS_FUZZ_png_combine_row
  ------------------
  519|      0|   }
  520|     21|   png_read_finish_row(png_ptr);
  ------------------
  |  |   40|     21|#define png_read_finish_row OSS_FUZZ_png_read_finish_row
  ------------------
  521|       |
  522|     21|   if (png_ptr->read_row_fn != NULL)
  ------------------
  |  Branch (522:8): [True: 0, False: 21]
  ------------------
  523|      0|      (*(png_ptr->read_row_fn))(png_ptr, png_ptr->row_number, png_ptr->pass);
  524|     21|}
OSS_FUZZ_png_read_end:
  675|      3|{
  676|      3|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  677|      3|   int keep;
  678|      3|#endif
  679|       |
  680|      3|   png_debug(1, "in png_read_end");
  ------------------
  |  |  145|      3|#  define png_debug(l, m) ((void)0)
  ------------------
  681|       |
  682|      3|   if (png_ptr == NULL)
  ------------------
  |  Branch (682:8): [True: 0, False: 3]
  ------------------
  683|      0|      return;
  684|       |
  685|       |   /* If png_read_end is called in the middle of reading the rows there may
  686|       |    * still be pending IDAT data and an owned zstream.  Deal with this here.
  687|       |    */
  688|      3|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  689|      3|   if (png_chunk_unknown_handling(png_ptr, png_IDAT) == 0)
  ------------------
  |  |   51|      3|#define png_chunk_unknown_handling OSS_FUZZ_png_chunk_unknown_handling
  ------------------
                 if (png_chunk_unknown_handling(png_ptr, png_IDAT) == 0)
  ------------------
  |  |  886|      3|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|      3|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      3|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      3|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      3|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      3|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (689:8): [True: 3, False: 0]
  ------------------
  690|      3|#endif
  691|      3|      png_read_finish_IDAT(png_ptr);
  ------------------
  |  |   39|      3|#define png_read_finish_IDAT OSS_FUZZ_png_read_finish_IDAT
  ------------------
  692|       |
  693|      3|#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
  694|       |   /* Report invalid palette index; added at libpng-1.5.10 */
  695|      3|   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  ------------------
  |  |  667|      6|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      3|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      3|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (695:8): [True: 0, False: 3]
  ------------------
  696|      0|       png_ptr->num_palette_max >= png_ptr->num_palette)
  ------------------
  |  Branch (696:8): [True: 0, False: 0]
  ------------------
  697|      0|      png_benign_error(png_ptr, "Read palette index exceeding num_palette");
  ------------------
  |  |  235|      0|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
  698|      3|#endif
  699|       |
  700|      3|   do
  701|      9|   {
  702|      9|      png_uint_32 length = png_read_chunk_header(png_ptr);
  ------------------
  |  |   22|      9|#define png_read_chunk_header OSS_FUZZ_png_read_chunk_header
  ------------------
  703|      9|      png_uint_32 chunk_name = png_ptr->chunk_name;
  704|       |
  705|      9|      if (chunk_name != png_IDAT)
  ------------------
  |  |  886|      9|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|      9|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      9|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      9|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      9|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      9|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (705:11): [True: 6, False: 3]
  ------------------
  706|      6|      {
  707|       |         /* These flags must be set consistently for all non-IDAT chunks,
  708|       |          * including the unknown chunks.
  709|       |          */
  710|      6|         png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT | PNG_AFTER_IDAT;
  ------------------
  |  |  653|      6|#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
  ------------------
                       png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT | PNG_AFTER_IDAT;
  ------------------
  |  |  644|      6|#define PNG_AFTER_IDAT 0x08
  ------------------
  711|      6|      }
  712|       |
  713|      9|      if (chunk_name == png_IEND)
  ------------------
  |  |  887|      9|#define png_IEND PNG_U32( 73,  69,  78,  68)
  |  |  ------------------
  |  |  |  |  845|      9|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      9|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      9|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      9|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      9|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (713:11): [True: 3, False: 6]
  ------------------
  714|      3|         png_handle_chunk(png_ptr, info_ptr, length);
  ------------------
  |  |   50|      3|#define png_handle_chunk OSS_FUZZ_png_handle_chunk
  ------------------
  715|       |
  716|      6|      else if (chunk_name == png_IHDR)
  ------------------
  |  |  888|      6|#define png_IHDR PNG_U32( 73,  72,  68,  82)
  |  |  ------------------
  |  |  |  |  845|      6|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (716:16): [True: 0, False: 6]
  ------------------
  717|      0|         png_handle_chunk(png_ptr, info_ptr, length);
  ------------------
  |  |   50|      0|#define png_handle_chunk OSS_FUZZ_png_handle_chunk
  ------------------
  718|       |
  719|      6|      else if (info_ptr == NULL)
  ------------------
  |  Branch (719:16): [True: 0, False: 6]
  ------------------
  720|      0|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  721|       |
  722|      6|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  723|      6|      else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0)
  ------------------
  |  |   51|      6|#define png_chunk_unknown_handling OSS_FUZZ_png_chunk_unknown_handling
  ------------------
  |  Branch (723:16): [True: 0, False: 6]
  ------------------
  724|      0|      {
  725|      0|         if (chunk_name == png_IDAT)
  ------------------
  |  |  886|      0|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (725:14): [True: 0, False: 0]
  ------------------
  726|      0|         {
  727|      0|            if ((length > 0 && !(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED))
  ------------------
  |  |  698|      0|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (727:18): [True: 0, False: 0]
  |  Branch (727:32): [True: 0, False: 0]
  ------------------
  728|      0|                || (png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) != 0)
  ------------------
  |  |  653|      0|#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
  ------------------
  |  Branch (728:20): [True: 0, False: 0]
  ------------------
  729|      0|               png_benign_error(png_ptr, ".Too many IDATs found");
  ------------------
  |  |  235|      0|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
  730|      0|         }
  731|      0|         png_handle_unknown(png_ptr, info_ptr, length, keep);
  ------------------
  |  |   49|      0|#define png_handle_unknown OSS_FUZZ_png_handle_unknown
  ------------------
  732|      0|         if (chunk_name == png_PLTE)
  ------------------
  |  |  889|      0|#define png_PLTE PNG_U32( 80,  76,  84,  69)
  |  |  ------------------
  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (732:14): [True: 0, False: 0]
  ------------------
  733|      0|            png_ptr->mode |= PNG_HAVE_PLTE;
  ------------------
  |  |  643|      0|#define PNG_HAVE_PLTE  0x02
  ------------------
  734|      0|      }
  735|      6|#endif
  736|       |
  737|      6|      else if (chunk_name == png_IDAT)
  ------------------
  |  |  886|      6|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|      6|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (737:16): [True: 3, False: 3]
  ------------------
  738|      3|      {
  739|       |         /* Zero length IDATs are legal after the last IDAT has been
  740|       |          * read, but not after other chunks have been read.  1.6 does not
  741|       |          * always read all the deflate data; specifically it cannot be relied
  742|       |          * upon to read the Adler32 at the end.  If it doesn't ignore IDAT
  743|       |          * chunks which are longer than zero as well:
  744|       |          */
  745|      3|         if ((length > 0 && !(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED))
  ------------------
  |  |  698|      3|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (745:15): [True: 3, False: 0]
  |  Branch (745:29): [True: 0, False: 3]
  ------------------
  746|      3|             || (png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) != 0)
  ------------------
  |  |  653|      3|#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */
  ------------------
  |  Branch (746:17): [True: 3, False: 0]
  ------------------
  747|      3|            png_benign_error(png_ptr, "..Too many IDATs found");
  ------------------
  |  |  235|      3|#define png_benign_error OSS_FUZZ_png_benign_error
  ------------------
  748|       |
  749|      3|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      3|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  750|      3|      }
  751|       |
  752|      3|      else
  753|      3|         png_handle_chunk(png_ptr, info_ptr, length);
  ------------------
  |  |   50|      3|#define png_handle_chunk OSS_FUZZ_png_handle_chunk
  ------------------
  754|      9|   } while ((png_ptr->mode & PNG_HAVE_IEND) == 0);
  ------------------
  |  |  644|      9|#define PNG_HAVE_IEND               0x10U
  ------------------
  |  Branch (754:13): [True: 6, False: 3]
  ------------------
  755|      3|}
OSS_FUZZ_png_destroy_read_struct:
  832|     59|{
  833|     59|   png_structrp png_ptr = NULL;
  834|       |
  835|     59|   png_debug(1, "in png_destroy_read_struct");
  ------------------
  |  |  145|     59|#  define png_debug(l, m) ((void)0)
  ------------------
  836|       |
  837|     59|   if (png_ptr_ptr != NULL)
  ------------------
  |  Branch (837:8): [True: 59, False: 0]
  ------------------
  838|     59|      png_ptr = *png_ptr_ptr;
  839|       |
  840|     59|   if (png_ptr == NULL)
  ------------------
  |  Branch (840:8): [True: 28, False: 31]
  ------------------
  841|     28|      return;
  842|       |
  843|       |   /* libpng 1.6.0: use the API to destroy info structs to ensure consistent
  844|       |    * behavior.  Prior to 1.6.0 libpng did extra 'info' destruction in this API.
  845|       |    * The extra was, apparently, unnecessary yet this hides memory leak bugs.
  846|       |    */
  847|     31|   png_destroy_info_struct(png_ptr, end_info_ptr_ptr);
  ------------------
  |  |  249|     31|#define png_destroy_info_struct OSS_FUZZ_png_destroy_info_struct
  ------------------
  848|     31|   png_destroy_info_struct(png_ptr, info_ptr_ptr);
  ------------------
  |  |  249|     31|#define png_destroy_info_struct OSS_FUZZ_png_destroy_info_struct
  ------------------
  849|       |
  850|     31|   *png_ptr_ptr = NULL;
  851|     31|   png_read_destroy(png_ptr);
  852|     31|   png_destroy_png_struct(png_ptr);
  ------------------
  |  |   12|     31|#define png_destroy_png_struct OSS_FUZZ_png_destroy_png_struct
  ------------------
  853|     31|}
OSS_FUZZ_png_image_begin_read_from_memory:
 1437|      3|{
 1438|      3|   if (image != NULL && image->version == PNG_IMAGE_VERSION)
  ------------------
  |  | 2916|      3|#define PNG_IMAGE_VERSION 1
  ------------------
  |  Branch (1438:8): [True: 3, False: 0]
  |  Branch (1438:25): [True: 3, False: 0]
  ------------------
 1439|      3|   {
 1440|      3|      if (memory != NULL && size > 0)
  ------------------
  |  Branch (1440:11): [True: 3, False: 0]
  |  Branch (1440:29): [True: 3, False: 0]
  ------------------
 1441|      3|      {
 1442|      3|         if (png_image_read_init(image) != 0)
  ------------------
  |  Branch (1442:14): [True: 3, False: 0]
  ------------------
 1443|      3|         {
 1444|       |            /* Now set the IO functions to read from the memory buffer and
 1445|       |             * store it into io_ptr.  Again do this in-place to avoid calling a
 1446|       |             * libpng function that requires error handling.
 1447|       |             */
 1448|      3|            image->opaque->memory = png_voidcast(png_const_bytep, memory);
  ------------------
  |  |  535|      3|#  define png_voidcast(type, value) (value)
  ------------------
 1449|      3|            image->opaque->size = size;
 1450|      3|            image->opaque->png_ptr->io_ptr = image;
 1451|      3|            image->opaque->png_ptr->read_data_fn = png_image_memory_read;
 1452|       |
 1453|      3|            return png_safe_execute(image, png_image_read_header, image);
  ------------------
  |  |  103|      3|#define png_safe_execute OSS_FUZZ_png_safe_execute
  ------------------
 1454|      3|         }
 1455|      3|      }
 1456|       |
 1457|      0|      else
 1458|      0|         return png_image_error(image,
  ------------------
  |  |  104|      0|#define png_image_error OSS_FUZZ_png_image_error
  ------------------
 1459|      0|             "png_image_begin_read_from_memory: invalid argument");
 1460|      3|   }
 1461|       |
 1462|      0|   else if (image != NULL)
  ------------------
  |  Branch (1462:13): [True: 0, False: 0]
  ------------------
 1463|      0|      return png_image_error(image,
  ------------------
  |  |  104|      0|#define png_image_error OSS_FUZZ_png_image_error
  ------------------
 1464|      0|          "png_image_begin_read_from_memory: incorrect PNG_IMAGE_VERSION");
 1465|       |
 1466|      0|   return 0;
 1467|      3|}
pngread.c:png_read_destroy:
  761|     31|{
  762|     31|   png_debug(1, "in png_read_destroy");
  ------------------
  |  |  145|     31|#  define png_debug(l, m) ((void)0)
  ------------------
  763|       |
  764|     31|#ifdef PNG_READ_GAMMA_SUPPORTED
  765|     31|   png_destroy_gamma_table(png_ptr);
  ------------------
  |  |   96|     31|#define png_destroy_gamma_table OSS_FUZZ_png_destroy_gamma_table
  ------------------
  766|     31|#endif
  767|       |
  768|     31|   png_free(png_ptr, png_ptr->big_row_buf);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  769|     31|   png_ptr->big_row_buf = NULL;
  770|     31|   png_free(png_ptr, png_ptr->big_prev_row);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  771|     31|   png_ptr->big_prev_row = NULL;
  772|     31|   png_free(png_ptr, png_ptr->read_buffer);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  773|     31|   png_ptr->read_buffer = NULL;
  774|       |
  775|     31|#ifdef PNG_READ_QUANTIZE_SUPPORTED
  776|     31|   png_free(png_ptr, png_ptr->palette_lookup);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  777|     31|   png_ptr->palette_lookup = NULL;
  778|     31|   png_free(png_ptr, png_ptr->quantize_index);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  779|     31|   png_ptr->quantize_index = NULL;
  780|     31|#endif
  781|       |
  782|       |   /* png_ptr->palette is always independently allocated (not aliased
  783|       |    * with info_ptr->palette), so free it unconditionally.
  784|       |    */
  785|     31|   png_free(png_ptr, png_ptr->palette);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  786|     31|   png_ptr->palette = NULL;
  787|       |
  788|     31|#if defined(PNG_tRNS_SUPPORTED) || \
  789|     31|    defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
  790|       |   /* png_ptr->trans_alpha is always independently allocated (not aliased
  791|       |    * with info_ptr->trans_alpha), so free it unconditionally.
  792|       |    */
  793|     31|   png_free(png_ptr, png_ptr->trans_alpha);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  794|     31|   png_ptr->trans_alpha = NULL;
  795|     31|#endif
  796|       |
  797|     31|   inflateEnd(&png_ptr->zstream);
  798|       |
  799|     31|#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
  800|     31|   png_free(png_ptr, png_ptr->save_buffer);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  801|     31|   png_ptr->save_buffer = NULL;
  802|     31|#endif
  803|       |
  804|     31|#if defined(PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED) && \
  805|     31|   defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
  806|     31|   png_free(png_ptr, png_ptr->unknown_chunk.data);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  807|     31|   png_ptr->unknown_chunk.data = NULL;
  808|     31|#endif
  809|       |
  810|     31|#ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
  811|     31|   png_free(png_ptr, png_ptr->chunk_list);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  812|     31|   png_ptr->chunk_list = NULL;
  813|     31|#endif
  814|       |
  815|     31|#if defined(PNG_READ_EXPAND_SUPPORTED) && \
  816|     31|    (defined(PNG_ARM_NEON_IMPLEMENTATION) || \
  817|     31|     defined(PNG_RISCV_RVV_IMPLEMENTATION))
  818|     31|   png_free(png_ptr, png_ptr->riffled_palette);
  ------------------
  |  |  253|     31|#define png_free OSS_FUZZ_png_free
  ------------------
  819|     31|   png_ptr->riffled_palette = NULL;
  820|     31|#endif
  821|       |
  822|       |   /* NOTE: the 'setjmp' buffer may still be allocated and the memory and error
  823|       |    * callbacks are still set at this point.  They are required to complete the
  824|       |    * destruction of the png_struct itself.
  825|       |    */
  826|     31|}
pngread.c:png_image_read_init:
 1129|      3|{
 1130|      3|   if (image->opaque == NULL)
  ------------------
  |  Branch (1130:8): [True: 3, False: 0]
  ------------------
 1131|      3|   {
 1132|      3|      png_structp png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, image,
  ------------------
  |  |  244|      3|#define png_create_read_struct OSS_FUZZ_png_create_read_struct
  ------------------
                    png_structp png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, image,
  ------------------
  |  |  277|      3|#define PNG_LIBPNG_VER_STRING "1.6.59.git"
  ------------------
 1133|      3|          png_safe_error, png_safe_warning);
  ------------------
  |  |  101|      3|#define png_safe_error OSS_FUZZ_png_safe_error
  ------------------
                        png_safe_error, png_safe_warning);
  ------------------
  |  |  102|      3|#define png_safe_warning OSS_FUZZ_png_safe_warning
  ------------------
 1134|       |
 1135|       |      /* And set the rest of the structure to NULL to ensure that the various
 1136|       |       * fields are consistent.
 1137|       |       */
 1138|      3|      memset(image, 0, (sizeof *image));
 1139|      3|      image->version = PNG_IMAGE_VERSION;
  ------------------
  |  | 2916|      3|#define PNG_IMAGE_VERSION 1
  ------------------
 1140|       |
 1141|      3|      if (png_ptr != NULL)
  ------------------
  |  Branch (1141:11): [True: 3, False: 0]
  ------------------
 1142|      3|      {
 1143|      3|         png_infop info_ptr = png_create_info_struct(png_ptr);
  ------------------
  |  |  243|      3|#define png_create_info_struct OSS_FUZZ_png_create_info_struct
  ------------------
 1144|       |
 1145|      3|         if (info_ptr != NULL)
  ------------------
  |  Branch (1145:14): [True: 3, False: 0]
  ------------------
 1146|      3|         {
 1147|      3|            png_controlp control = png_voidcast(png_controlp,
  ------------------
  |  |  535|      3|#  define png_voidcast(type, value) (value)
  ------------------
 1148|      3|                png_malloc_warn(png_ptr, (sizeof *control)));
 1149|       |
 1150|      3|            if (control != NULL)
  ------------------
  |  Branch (1150:17): [True: 3, False: 0]
  ------------------
 1151|      3|            {
 1152|      3|               memset(control, 0, (sizeof *control));
 1153|       |
 1154|      3|               control->png_ptr = png_ptr;
 1155|      3|               control->info_ptr = info_ptr;
 1156|      3|               control->for_write = 0;
 1157|       |
 1158|      3|               image->opaque = control;
 1159|      3|               return 1;
 1160|      3|            }
 1161|       |
 1162|       |            /* Error clean up */
 1163|      0|            png_destroy_info_struct(png_ptr, &info_ptr);
  ------------------
  |  |  249|      0|#define png_destroy_info_struct OSS_FUZZ_png_destroy_info_struct
  ------------------
 1164|      0|         }
 1165|       |
 1166|      0|         png_destroy_read_struct(&png_ptr, NULL, NULL);
  ------------------
  |  |  250|      0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct
  ------------------
 1167|      0|      }
 1168|       |
 1169|      0|      return png_image_error(image, "png_image_read: out of memory");
  ------------------
  |  |  104|      0|#define png_image_error OSS_FUZZ_png_image_error
  ------------------
 1170|      3|   }
 1171|       |
 1172|      0|   return png_image_error(image, "png_image_read: opaque pointer not NULL");
  ------------------
  |  |  104|      0|#define png_image_error OSS_FUZZ_png_image_error
  ------------------
 1173|      3|}
pngread.c:png_image_memory_read:
 1407|     12|{
 1408|     12|   if (png_ptr != NULL)
  ------------------
  |  Branch (1408:8): [True: 12, False: 0]
  ------------------
 1409|     12|   {
 1410|     12|      png_imagep image = png_voidcast(png_imagep, png_ptr->io_ptr);
  ------------------
  |  |  535|     12|#  define png_voidcast(type, value) (value)
  ------------------
 1411|     12|      if (image != NULL)
  ------------------
  |  Branch (1411:11): [True: 12, False: 0]
  ------------------
 1412|     12|      {
 1413|     12|         png_controlp cp = image->opaque;
 1414|     12|         if (cp != NULL)
  ------------------
  |  Branch (1414:14): [True: 12, False: 0]
  ------------------
 1415|     12|         {
 1416|     12|            png_const_bytep memory = cp->memory;
 1417|     12|            size_t size = cp->size;
 1418|       |
 1419|     12|            if (memory != NULL && size >= need)
  ------------------
  |  Branch (1419:17): [True: 12, False: 0]
  |  Branch (1419:35): [True: 12, False: 0]
  ------------------
 1420|     12|            {
 1421|     12|               memcpy(out, memory, need);
 1422|     12|               cp->memory = memory + need;
 1423|     12|               cp->size = size - need;
 1424|     12|               return;
 1425|     12|            }
 1426|       |
 1427|      0|            png_error(png_ptr, "read beyond end of data");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 1428|     12|         }
 1429|     12|      }
 1430|       |
 1431|      0|      png_error(png_ptr, "invalid memory read");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 1432|     12|   }
 1433|     12|}
pngread.c:png_image_read_header:
 1277|      3|{
 1278|      3|   png_imagep image = png_voidcast(png_imagep, argument);
  ------------------
  |  |  535|      3|#  define png_voidcast(type, value) (value)
  ------------------
 1279|      3|   png_structrp png_ptr = image->opaque->png_ptr;
 1280|      3|   png_inforp info_ptr = image->opaque->info_ptr;
 1281|       |
 1282|      3|#ifdef PNG_BENIGN_ERRORS_SUPPORTED
 1283|      3|   png_set_benign_errors(png_ptr, 1/*warn*/);
  ------------------
  |  |  371|      3|#define png_set_benign_errors OSS_FUZZ_png_set_benign_errors
  ------------------
 1284|      3|#endif
 1285|      3|   png_read_info(png_ptr, info_ptr);
  ------------------
  |  |  357|      3|#define png_read_info OSS_FUZZ_png_read_info
  ------------------
 1286|       |
 1287|       |   /* Do this the fast way; just read directly out of png_struct. */
 1288|      3|   image->width = png_ptr->width;
 1289|      3|   image->height = png_ptr->height;
 1290|       |
 1291|      3|   {
 1292|      3|      png_uint_32 format = png_image_format(png_ptr);
 1293|       |
 1294|      3|      image->format = format;
 1295|       |
 1296|       |      /* Greyscale images don't (typically) have colour space information and
 1297|       |       * using it is pretty much impossible, so use sRGB for grayscale (it
 1298|       |       * doesn't matter r==g==b so the transform is irrelevant.)
 1299|       |       */
 1300|      3|      if ((format & PNG_FORMAT_FLAG_COLOR) != 0 &&
  ------------------
  |  | 3026|      3|#define PNG_FORMAT_FLAG_COLOR    0x02U /* color format: otherwise grayscale */
  ------------------
  |  Branch (1300:11): [True: 0, False: 3]
  ------------------
 1301|      0|          png_image_is_not_sRGB(png_ptr))
  ------------------
  |  Branch (1301:11): [True: 0, False: 0]
  ------------------
 1302|      0|         image->flags |= PNG_IMAGE_FLAG_COLORSPACE_NOT_sRGB;
  ------------------
  |  | 3185|      0|#define PNG_IMAGE_FLAG_COLORSPACE_NOT_sRGB 0x01
  ------------------
 1303|      3|   }
 1304|       |
 1305|       |   /* We need the maximum number of entries regardless of the format the
 1306|       |    * application sets here.
 1307|       |    */
 1308|      3|   {
 1309|      3|      png_uint_32 cmap_entries;
 1310|       |
 1311|      3|      switch (png_ptr->color_type)
 1312|      3|      {
 1313|      0|         case PNG_COLOR_TYPE_GRAY:
  ------------------
  |  |  666|      0|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (1313:10): [True: 0, False: 3]
  ------------------
 1314|      0|            cmap_entries = 1U << png_ptr->bit_depth;
 1315|      0|            break;
 1316|       |
 1317|      0|         case PNG_COLOR_TYPE_PALETTE:
  ------------------
  |  |  667|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1317:10): [True: 0, False: 3]
  ------------------
 1318|      0|            cmap_entries = (png_uint_32)png_ptr->num_palette;
 1319|      0|            break;
 1320|       |
 1321|      0|         default:
  ------------------
  |  Branch (1321:10): [True: 0, False: 3]
  ------------------
 1322|      0|            cmap_entries = 256;
 1323|      0|            break;
 1324|      3|      }
 1325|       |
 1326|      0|      if (cmap_entries > 256)
  ------------------
  |  Branch (1326:11): [True: 0, False: 0]
  ------------------
 1327|      0|         cmap_entries = 256;
 1328|       |
 1329|      0|      image->colormap_entries = cmap_entries;
 1330|      0|   }
 1331|       |
 1332|      0|   return 1;
 1333|      3|}

OSS_FUZZ_png_read_data:
   32|  28.4k|{
   33|  28.4k|   png_debug1(4, "reading %d bytes", (int)length);
  ------------------
  |  |  148|  28.4k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
   34|       |
   35|  28.4k|   if (png_ptr->read_data_fn != NULL)
  ------------------
  |  Branch (35:8): [True: 28.4k, False: 0]
  ------------------
   36|  28.4k|      (*(png_ptr->read_data_fn))(png_ptr, data, length);
   37|       |
   38|      0|   else
   39|      0|      png_error(png_ptr, "Call to NULL read function");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
   40|  28.4k|}
OSS_FUZZ_png_set_read_fn:
   88|     47|{
   89|     47|   if (png_ptr == NULL)
  ------------------
  |  Branch (89:8): [True: 0, False: 47]
  ------------------
   90|      0|      return;
   91|       |
   92|     47|   png_ptr->io_ptr = io_ptr;
   93|       |
   94|       |#ifdef PNG_STDIO_SUPPORTED
   95|       |   if (read_data_fn != NULL)
   96|       |      png_ptr->read_data_fn = read_data_fn;
   97|       |
   98|       |   else
   99|       |      png_ptr->read_data_fn = png_default_read_data;
  100|       |#else
  101|     47|   png_ptr->read_data_fn = read_data_fn;
  102|     47|#endif
  103|       |
  104|       |#ifdef PNG_WRITE_SUPPORTED
  105|       |   /* It is an error to write to a read device */
  106|       |   if (png_ptr->write_data_fn != NULL)
  107|       |   {
  108|       |      png_ptr->write_data_fn = NULL;
  109|       |      png_warning(png_ptr,
  110|       |          "Can't set both read_data_fn and write_data_fn in the"
  111|       |          " same structure");
  112|       |   }
  113|       |#endif
  114|       |
  115|       |#ifdef PNG_WRITE_FLUSH_SUPPORTED
  116|       |   png_ptr->output_flush_fn = NULL;
  117|       |#endif
  118|     47|}

OSS_FUZZ_png_set_crc_action:
   42|     16|{
   43|     16|   png_debug(1, "in png_set_crc_action");
  ------------------
  |  |  145|     16|#  define png_debug(l, m) ((void)0)
  ------------------
   44|       |
   45|     16|   if (png_ptr == NULL)
  ------------------
  |  Branch (45:8): [True: 0, False: 16]
  ------------------
   46|      0|      return;
   47|       |
   48|       |   /* Tell libpng how we react to CRC errors in critical chunks */
   49|     16|   switch (crit_action)
   50|     16|   {
   51|      0|      case PNG_CRC_NO_CHANGE:                        /* Leave setting as is */
  ------------------
  |  | 1506|      0|#define PNG_CRC_NO_CHANGE     5  /* use current value   use current value */
  ------------------
  |  Branch (51:7): [True: 0, False: 16]
  ------------------
   52|      0|         break;
   53|       |
   54|      0|      case PNG_CRC_WARN_USE:                               /* Warn/use data */
  ------------------
  |  | 1504|      0|#define PNG_CRC_WARN_USE      3  /* warn/use data       warn/use data     */
  ------------------
  |  Branch (54:7): [True: 0, False: 16]
  ------------------
   55|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
  ------------------
  |  |  730|      0|#define PNG_FLAG_CRC_CRITICAL_MASK  (PNG_FLAG_CRC_CRITICAL_USE | \
  |  |  ------------------
  |  |  |  |  705|      0|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  |  |  ------------------
  |  |  731|      0|                                     PNG_FLAG_CRC_CRITICAL_IGNORE)
  |  |  ------------------
  |  |  |  |  706|      0|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  |  |  ------------------
  ------------------
   56|      0|         png_ptr->flags |= PNG_FLAG_CRC_CRITICAL_USE;
  ------------------
  |  |  705|      0|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  ------------------
   57|      0|         break;
   58|       |
   59|     16|      case PNG_CRC_QUIET_USE:                             /* Quiet/use data */
  ------------------
  |  | 1505|     16|#define PNG_CRC_QUIET_USE     4  /* quiet/use data      quiet/use data    */
  ------------------
  |  Branch (59:7): [True: 16, False: 0]
  ------------------
   60|     16|         png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
  ------------------
  |  |  730|     16|#define PNG_FLAG_CRC_CRITICAL_MASK  (PNG_FLAG_CRC_CRITICAL_USE | \
  |  |  ------------------
  |  |  |  |  705|     16|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  |  |  ------------------
  |  |  731|     16|                                     PNG_FLAG_CRC_CRITICAL_IGNORE)
  |  |  ------------------
  |  |  |  |  706|     16|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  |  |  ------------------
  ------------------
   61|     16|         png_ptr->flags |= PNG_FLAG_CRC_CRITICAL_USE |
  ------------------
  |  |  705|     16|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  ------------------
   62|     16|                           PNG_FLAG_CRC_CRITICAL_IGNORE;
  ------------------
  |  |  706|     16|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  ------------------
   63|     16|         break;
   64|       |
   65|      0|      case PNG_CRC_WARN_DISCARD:    /* Not a valid action for critical data */
  ------------------
  |  | 1503|      0|#define PNG_CRC_WARN_DISCARD  2  /* (INVALID)           warn/discard data */
  ------------------
  |  Branch (65:7): [True: 0, False: 16]
  ------------------
   66|      0|         png_warning(png_ptr,
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
   67|      0|             "Can't discard critical data on CRC error");
   68|       |         /* FALLTHROUGH */
   69|      0|      case PNG_CRC_ERROR_QUIT:                                /* Error/quit */
  ------------------
  |  | 1502|      0|#define PNG_CRC_ERROR_QUIT    1  /* error/quit          error/quit        */
  ------------------
  |  Branch (69:7): [True: 0, False: 16]
  ------------------
   70|       |
   71|      0|      case PNG_CRC_DEFAULT:
  ------------------
  |  | 1501|      0|#define PNG_CRC_DEFAULT       0  /* error/quit          warn/discard data */
  ------------------
  |  Branch (71:7): [True: 0, False: 16]
  ------------------
   72|      0|      default:
  ------------------
  |  Branch (72:7): [True: 0, False: 16]
  ------------------
   73|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_CRITICAL_MASK;
  ------------------
  |  |  730|      0|#define PNG_FLAG_CRC_CRITICAL_MASK  (PNG_FLAG_CRC_CRITICAL_USE | \
  |  |  ------------------
  |  |  |  |  705|      0|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  |  |  ------------------
  |  |  731|      0|                                     PNG_FLAG_CRC_CRITICAL_IGNORE)
  |  |  ------------------
  |  |  |  |  706|      0|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  |  |  ------------------
  ------------------
   74|      0|         break;
   75|     16|   }
   76|       |
   77|       |   /* Tell libpng how we react to CRC errors in ancillary chunks */
   78|     16|   switch (ancil_action)
   79|     16|   {
   80|      0|      case PNG_CRC_NO_CHANGE:                       /* Leave setting as is */
  ------------------
  |  | 1506|      0|#define PNG_CRC_NO_CHANGE     5  /* use current value   use current value */
  ------------------
  |  Branch (80:7): [True: 0, False: 16]
  ------------------
   81|      0|         break;
   82|       |
   83|      0|      case PNG_CRC_WARN_USE:                              /* Warn/use data */
  ------------------
  |  | 1504|      0|#define PNG_CRC_WARN_USE      3  /* warn/use data       warn/use data     */
  ------------------
  |  Branch (83:7): [True: 0, False: 16]
  ------------------
   84|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
  ------------------
  |  |  727|      0|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  703|      0|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  728|      0|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  704|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
   85|      0|         png_ptr->flags |= PNG_FLAG_CRC_ANCILLARY_USE;
  ------------------
  |  |  703|      0|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  ------------------
   86|      0|         break;
   87|       |
   88|     16|      case PNG_CRC_QUIET_USE:                            /* Quiet/use data */
  ------------------
  |  | 1505|     16|#define PNG_CRC_QUIET_USE     4  /* quiet/use data      quiet/use data    */
  ------------------
  |  Branch (88:7): [True: 16, False: 0]
  ------------------
   89|     16|         png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
  ------------------
  |  |  727|     16|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  703|     16|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  728|     16|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  704|     16|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
   90|     16|         png_ptr->flags |= PNG_FLAG_CRC_ANCILLARY_USE |
  ------------------
  |  |  703|     16|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  ------------------
   91|     16|                           PNG_FLAG_CRC_ANCILLARY_NOWARN;
  ------------------
  |  |  704|     16|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
   92|     16|         break;
   93|       |
   94|      0|      case PNG_CRC_ERROR_QUIT:                               /* Error/quit */
  ------------------
  |  | 1502|      0|#define PNG_CRC_ERROR_QUIT    1  /* error/quit          error/quit        */
  ------------------
  |  Branch (94:7): [True: 0, False: 16]
  ------------------
   95|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
  ------------------
  |  |  727|      0|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  703|      0|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  728|      0|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  704|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
   96|      0|         png_ptr->flags |= PNG_FLAG_CRC_ANCILLARY_NOWARN;
  ------------------
  |  |  704|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
   97|      0|         break;
   98|       |
   99|      0|      case PNG_CRC_WARN_DISCARD:                      /* Warn/discard data */
  ------------------
  |  | 1503|      0|#define PNG_CRC_WARN_DISCARD  2  /* (INVALID)           warn/discard data */
  ------------------
  |  Branch (99:7): [True: 0, False: 16]
  ------------------
  100|       |
  101|      0|      case PNG_CRC_DEFAULT:
  ------------------
  |  | 1501|      0|#define PNG_CRC_DEFAULT       0  /* error/quit          warn/discard data */
  ------------------
  |  Branch (101:7): [True: 0, False: 16]
  ------------------
  102|      0|      default:
  ------------------
  |  Branch (102:7): [True: 0, False: 16]
  ------------------
  103|      0|         png_ptr->flags &= ~PNG_FLAG_CRC_ANCILLARY_MASK;
  ------------------
  |  |  727|      0|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  703|      0|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  728|      0|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  704|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
  104|      0|         break;
  105|     16|   }
  106|     16|}
OSS_FUZZ_png_set_scale_16:
  189|      5|{
  190|      5|   png_debug(1, "in png_set_scale_16");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
  191|       |
  192|      5|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (192:8): [True: 0, False: 5]
  ------------------
  193|      0|      return;
  194|       |
  195|      5|   png_ptr->transformations |= PNG_SCALE_16_TO_8;
  ------------------
  |  |  685|      5|#define PNG_SCALE_16_TO_8    0x4000000U /* Added to libpng-1.5.4 */
  ------------------
  196|      5|}
OSS_FUZZ_png_set_expand:
  949|      5|{
  950|      5|   png_debug(1, "in png_set_expand");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
  951|       |
  952|      5|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (952:8): [True: 0, False: 5]
  ------------------
  953|      0|      return;
  954|       |
  955|      5|   png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
  ------------------
  |  |  670|      5|#define PNG_EXPAND              0x1000U
  ------------------
                 png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
  ------------------
  |  |  684|      5|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  956|      5|}
OSS_FUZZ_png_set_expand_gray_1_2_4_to_8:
  991|      5|{
  992|      5|   png_debug(1, "in png_set_expand_gray_1_2_4_to_8");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
  993|       |
  994|      5|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (994:8): [True: 0, False: 5]
  ------------------
  995|      0|      return;
  996|       |
  997|      5|   png_ptr->transformations |= PNG_EXPAND;
  ------------------
  |  |  670|      5|#define PNG_EXPAND              0x1000U
  ------------------
  998|      5|}
OSS_FUZZ_png_set_tRNS_to_alpha:
 1003|      5|{
 1004|      5|   png_debug(1, "in png_set_tRNS_to_alpha");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
 1005|       |
 1006|      5|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (1006:8): [True: 0, False: 5]
  ------------------
 1007|      0|      return;
 1008|       |
 1009|      5|   png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
  ------------------
  |  |  670|      5|#define PNG_EXPAND              0x1000U
  ------------------
                 png_ptr->transformations |= (PNG_EXPAND | PNG_EXPAND_tRNS);
  ------------------
  |  |  684|      5|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
 1010|      5|}
OSS_FUZZ_png_set_gray_to_rgb:
 1032|      5|{
 1033|      5|   png_debug(1, "in png_set_gray_to_rgb");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
 1034|       |
 1035|      5|   if (png_rtran_ok(png_ptr, 0) == 0)
  ------------------
  |  Branch (1035:8): [True: 0, False: 5]
  ------------------
 1036|      0|      return;
 1037|       |
 1038|       |   /* Because rgb must be 8 bits or more: */
 1039|      5|   png_set_expand_gray_1_2_4_to_8(png_ptr);
  ------------------
  |  |  390|      5|#define png_set_expand_gray_1_2_4_to_8 OSS_FUZZ_png_set_expand_gray_1_2_4_to_8
  ------------------
 1040|      5|   png_ptr->transformations |= PNG_GRAY_TO_RGB;
  ------------------
  |  |  672|      5|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
 1041|      5|}
OSS_FUZZ_png_resolve_file_gamma:
 1352|      5|{
 1353|      5|   png_fixed_point file_gamma;
 1354|       |
 1355|       |   /* The file gamma is determined by these precedence rules, in this order
 1356|       |    * (i.e. use the first value found):
 1357|       |    *
 1358|       |    *    png_set_gamma; png_struct::file_gammma if not zero, then:
 1359|       |    *    png_struct::chunk_gamma if not 0 (determined the PNGv3 rules), then:
 1360|       |    *    png_set_gamma; 1/png_struct::screen_gamma if not zero
 1361|       |    *
 1362|       |    *    0 (i.e. do no gamma handling)
 1363|       |    */
 1364|      5|   file_gamma = png_ptr->file_gamma;
 1365|      5|   if (file_gamma != 0)
  ------------------
  |  Branch (1365:8): [True: 0, False: 5]
  ------------------
 1366|      0|      return file_gamma;
 1367|       |
 1368|      5|   file_gamma = png_ptr->chunk_gamma;
 1369|      5|   if (file_gamma != 0)
  ------------------
  |  Branch (1369:8): [True: 0, False: 5]
  ------------------
 1370|      0|      return file_gamma;
 1371|       |
 1372|      5|   file_gamma = png_ptr->default_gamma;
 1373|      5|   if (file_gamma != 0)
  ------------------
  |  Branch (1373:8): [True: 0, False: 5]
  ------------------
 1374|      0|      return file_gamma;
 1375|       |
 1376|       |   /* If png_reciprocal overflows, it returns 0, indicating to the caller that
 1377|       |    * there is no usable file gamma.  (The checks added to png_set_gamma and
 1378|       |    * png_set_alpha_mode should prevent a screen_gamma which would overflow.)
 1379|       |    */
 1380|      5|   if (png_ptr->screen_gamma != 0)
  ------------------
  |  Branch (1380:8): [True: 0, False: 5]
  ------------------
 1381|      0|      file_gamma = png_reciprocal(png_ptr->screen_gamma);
  ------------------
  |  |   89|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1382|       |
 1383|      5|   return file_gamma;
 1384|      5|}
OSS_FUZZ_png_init_read_transformations:
 1425|      5|{
 1426|      5|   png_debug(1, "in png_init_read_transformations");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
 1427|       |
 1428|       |   /* This internal function is called from png_read_start_row in pngrutil.c
 1429|       |    * and it is called before the 'rowbytes' calculation is done, so the code
 1430|       |    * in here can change or update the transformations flags.
 1431|       |    *
 1432|       |    * First do updates that do not depend on the details of the PNG image data
 1433|       |    * being processed.
 1434|       |    */
 1435|       |
 1436|      5|#ifdef PNG_READ_GAMMA_SUPPORTED
 1437|       |   /* Prior to 1.5.4 these tests were performed from png_set_gamma, 1.5.4 adds
 1438|       |    * png_set_alpha_mode and this is another source for a default file gamma so
 1439|       |    * the test needs to be performed later - here.  In addition prior to 1.5.4
 1440|       |    * the tests were repeated for the PALETTE color type here - this is no
 1441|       |    * longer necessary (and doesn't seem to have been necessary before.)
 1442|       |    *
 1443|       |    * PNGv3: the new mandatory precedence/priority rules for colour space chunks
 1444|       |    * are handled here (by calling the above function).
 1445|       |    *
 1446|       |    * Turn the gamma transformation on or off as appropriate.  Notice that
 1447|       |    * PNG_GAMMA just refers to the file->screen correction.  Alpha composition
 1448|       |    * may independently cause gamma correction because it needs linear data
 1449|       |    * (e.g. if the file has a gAMA chunk but the screen gamma hasn't been
 1450|       |    * specified.)  In any case this flag may get turned off in the code
 1451|       |    * immediately below if the transform can be handled outside the row loop.
 1452|       |    */
 1453|      5|   if (png_init_gamma_values(png_ptr) != 0)
  ------------------
  |  Branch (1453:8): [True: 0, False: 5]
  ------------------
 1454|      0|      png_ptr->transformations |= PNG_GAMMA;
  ------------------
  |  |  671|      0|#define PNG_GAMMA               0x2000U
  ------------------
 1455|       |
 1456|      5|   else
 1457|      5|      png_ptr->transformations &= ~PNG_GAMMA;
  ------------------
  |  |  671|      5|#define PNG_GAMMA               0x2000U
  ------------------
 1458|      5|#endif
 1459|       |
 1460|       |   /* Certain transformations have the effect of preventing other
 1461|       |    * transformations that happen afterward in png_do_read_transformations;
 1462|       |    * resolve the interdependencies here.  From the code of
 1463|       |    * png_do_read_transformations the order is:
 1464|       |    *
 1465|       |    *  1) PNG_EXPAND (including PNG_EXPAND_tRNS)
 1466|       |    *  2) PNG_STRIP_ALPHA (if no compose)
 1467|       |    *  3) PNG_RGB_TO_GRAY
 1468|       |    *  4) PNG_GRAY_TO_RGB iff !PNG_BACKGROUND_IS_GRAY
 1469|       |    *  5) PNG_COMPOSE
 1470|       |    *  6) PNG_GAMMA
 1471|       |    *  7) PNG_STRIP_ALPHA (if compose)
 1472|       |    *  8) PNG_ENCODE_ALPHA
 1473|       |    *  9) PNG_SCALE_16_TO_8
 1474|       |    * 10) PNG_16_TO_8
 1475|       |    * 11) PNG_QUANTIZE (converts to palette)
 1476|       |    * 12) PNG_EXPAND_16
 1477|       |    * 13) PNG_GRAY_TO_RGB iff PNG_BACKGROUND_IS_GRAY
 1478|       |    * 14) PNG_INVERT_MONO
 1479|       |    * 15) PNG_INVERT_ALPHA
 1480|       |    * 16) PNG_SHIFT
 1481|       |    * 17) PNG_PACK
 1482|       |    * 18) PNG_BGR
 1483|       |    * 19) PNG_PACKSWAP
 1484|       |    * 20) PNG_FILLER (includes PNG_ADD_ALPHA)
 1485|       |    * 21) PNG_SWAP_ALPHA
 1486|       |    * 22) PNG_SWAP_BYTES
 1487|       |    * 23) PNG_USER_TRANSFORM [must be last]
 1488|       |    */
 1489|      5|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
 1490|      5|   if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 &&
  ------------------
  |  |  676|      5|#define PNG_STRIP_ALPHA        0x40000U
  ------------------
  |  Branch (1490:8): [True: 0, False: 5]
  ------------------
 1491|      0|       (png_ptr->transformations & PNG_COMPOSE) == 0)
  ------------------
  |  |  665|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1491:8): [True: 0, False: 0]
  ------------------
 1492|      0|   {
 1493|       |      /* Stripping the alpha channel happens immediately after the 'expand'
 1494|       |       * transformations, before all other transformation, so it cancels out
 1495|       |       * the alpha handling.  It has the side effect negating the effect of
 1496|       |       * PNG_EXPAND_tRNS too:
 1497|       |       */
 1498|      0|      png_ptr->transformations &= ~(PNG_BACKGROUND_EXPAND | PNG_ENCODE_ALPHA |
  ------------------
  |  |  666|      0|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
                    png_ptr->transformations &= ~(PNG_BACKGROUND_EXPAND | PNG_ENCODE_ALPHA |
  ------------------
  |  |  682|      0|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
 1499|      0|         PNG_EXPAND_tRNS);
  ------------------
  |  |  684|      0|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
 1500|      0|      png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
  ------------------
  |  |  708|      0|#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
  ------------------
 1501|       |
 1502|       |      /* Kill the tRNS chunk itself too.  Prior to 1.5.4 this did not happen
 1503|       |       * so transparency information would remain just so long as it wasn't
 1504|       |       * expanded.  This produces unexpected API changes if the set of things
 1505|       |       * that do PNG_EXPAND_tRNS changes (perfectly possible given the
 1506|       |       * documentation - which says ask for what you want, accept what you
 1507|       |       * get.)  This makes the behavior consistent from 1.5.4:
 1508|       |       */
 1509|      0|      png_ptr->num_trans = 0;
 1510|      0|   }
 1511|      5|#endif /* STRIP_ALPHA supported, no COMPOSE */
 1512|       |
 1513|      5|#ifdef PNG_READ_ALPHA_MODE_SUPPORTED
 1514|       |   /* If the screen gamma is about 1.0 then the OPTIMIZE_ALPHA and ENCODE_ALPHA
 1515|       |    * settings will have no effect.
 1516|       |    */
 1517|      5|   if (png_gamma_significant(png_ptr->screen_gamma) == 0)
  ------------------
  |  |   91|      5|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1517:8): [True: 5, False: 0]
  ------------------
 1518|      5|   {
 1519|      5|      png_ptr->transformations &= ~PNG_ENCODE_ALPHA;
  ------------------
  |  |  682|      5|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
 1520|      5|      png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
  ------------------
  |  |  708|      5|#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
  ------------------
 1521|      5|   }
 1522|      5|#endif
 1523|       |
 1524|      5|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 1525|       |   /* Make sure the coefficients for the rgb to gray conversion are set
 1526|       |    * appropriately.
 1527|       |    */
 1528|      5|   if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0)
  ------------------
  |  |  681|      5|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (1528:8): [True: 0, False: 5]
  ------------------
 1529|      0|      png_set_rgb_coefficients(png_ptr);
  ------------------
  |  |   98|      0|#define png_set_rgb_coefficients OSS_FUZZ_png_set_rgb_coefficients
  ------------------
 1530|      5|#endif
 1531|       |
 1532|      5|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 1533|      5|#if defined(PNG_READ_EXPAND_SUPPORTED) && defined(PNG_READ_BACKGROUND_SUPPORTED)
 1534|       |   /* Detect gray background and attempt to enable optimization for
 1535|       |    * gray --> RGB case.
 1536|       |    *
 1537|       |    * Note:  if PNG_BACKGROUND_EXPAND is set and color_type is either RGB or
 1538|       |    * RGB_ALPHA (in which case need_expand is superfluous anyway), the
 1539|       |    * background color might actually be gray yet not be flagged as such.
 1540|       |    * This is not a problem for the current code, which uses
 1541|       |    * PNG_BACKGROUND_IS_GRAY only to decide when to do the
 1542|       |    * png_do_gray_to_rgb() transformation.
 1543|       |    *
 1544|       |    * TODO: this code needs to be revised to avoid the complexity and
 1545|       |    * interdependencies.  The color type of the background should be recorded in
 1546|       |    * png_set_background, along with the bit depth, then the code has a record
 1547|       |    * of exactly what color space the background is currently in.
 1548|       |    */
 1549|      5|   if ((png_ptr->transformations & PNG_BACKGROUND_EXPAND) != 0)
  ------------------
  |  |  666|      5|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
  |  Branch (1549:8): [True: 0, False: 5]
  ------------------
 1550|      0|   {
 1551|       |      /* PNG_BACKGROUND_EXPAND: the background is in the file color space, so if
 1552|       |       * the file was grayscale the background value is gray.
 1553|       |       */
 1554|      0|      if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
  ------------------
  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (1554:11): [True: 0, False: 0]
  ------------------
 1555|      0|         png_ptr->mode |= PNG_BACKGROUND_IS_GRAY;
  ------------------
  |  |  651|      0|#define PNG_BACKGROUND_IS_GRAY     0x800U
  ------------------
 1556|      0|   }
 1557|       |
 1558|      5|   else if ((png_ptr->transformations & PNG_COMPOSE) != 0)
  ------------------
  |  |  665|      5|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1558:13): [True: 0, False: 5]
  ------------------
 1559|      0|   {
 1560|       |      /* PNG_COMPOSE: png_set_background was called with need_expand false,
 1561|       |       * so the color is in the color space of the output or png_set_alpha_mode
 1562|       |       * was called and the color is black.  Ignore RGB_TO_GRAY because that
 1563|       |       * happens before GRAY_TO_RGB.
 1564|       |       */
 1565|      0|      if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0)
  ------------------
  |  |  672|      0|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (1565:11): [True: 0, False: 0]
  ------------------
 1566|      0|      {
 1567|      0|         if (png_ptr->background.red == png_ptr->background.green &&
  ------------------
  |  Branch (1567:14): [True: 0, False: 0]
  ------------------
 1568|      0|             png_ptr->background.red == png_ptr->background.blue)
  ------------------
  |  Branch (1568:14): [True: 0, False: 0]
  ------------------
 1569|      0|         {
 1570|      0|            png_ptr->mode |= PNG_BACKGROUND_IS_GRAY;
  ------------------
  |  |  651|      0|#define PNG_BACKGROUND_IS_GRAY     0x800U
  ------------------
 1571|      0|            png_ptr->background.gray = png_ptr->background.red;
 1572|      0|         }
 1573|      0|      }
 1574|      0|   }
 1575|      5|#endif /* READ_EXPAND && READ_BACKGROUND */
 1576|      5|#endif /* READ_GRAY_TO_RGB */
 1577|       |
 1578|       |   /* For indexed PNG data (PNG_COLOR_TYPE_PALETTE) many of the transformations
 1579|       |    * can be performed directly on the palette, and some (such as rgb to gray)
 1580|       |    * can be optimized inside the palette.  This is particularly true of the
 1581|       |    * composite (background and alpha) stuff, which can be pretty much all done
 1582|       |    * in the palette even if the result is expanded to RGB or gray afterward.
 1583|       |    *
 1584|       |    * NOTE: this is Not Yet Implemented, the code behaves as in 1.5.1 and
 1585|       |    * earlier and the palette stuff is actually handled on the first row.  This
 1586|       |    * leads to the reported bug that the palette returned by png_get_PLTE is not
 1587|       |    * updated.
 1588|       |    */
 1589|      5|   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  667|      5|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      5|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      5|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1589:8): [True: 0, False: 5]
  ------------------
 1590|      0|      png_init_palette_transformations(png_ptr);
 1591|       |
 1592|      5|   else
 1593|      5|      png_init_rgb_transformations(png_ptr);
 1594|       |
 1595|      5|#if defined(PNG_READ_BACKGROUND_SUPPORTED) && \
 1596|      5|   defined(PNG_READ_EXPAND_16_SUPPORTED)
 1597|      5|   if ((png_ptr->transformations & PNG_EXPAND_16) != 0 &&
  ------------------
  |  |  667|      5|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
  |  Branch (1597:8): [True: 0, False: 5]
  ------------------
 1598|      0|       (png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  665|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1598:8): [True: 0, False: 0]
  ------------------
 1599|      0|       (png_ptr->transformations & PNG_BACKGROUND_EXPAND) == 0 &&
  ------------------
  |  |  666|      0|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
  |  Branch (1599:8): [True: 0, False: 0]
  ------------------
 1600|      0|       png_ptr->bit_depth != 16)
  ------------------
  |  Branch (1600:8): [True: 0, False: 0]
  ------------------
 1601|      0|   {
 1602|       |      /* TODO: fix this.  Because the expand_16 operation is after the compose
 1603|       |       * handling the background color must be 8, not 16, bits deep, but the
 1604|       |       * application will supply a 16-bit value so reduce it here.
 1605|       |       *
 1606|       |       * The PNG_BACKGROUND_EXPAND code above does not expand to 16 bits at
 1607|       |       * present, so that case is ok (until do_expand_16 is moved.)
 1608|       |       *
 1609|       |       * NOTE: this discards the low 16 bits of the user supplied background
 1610|       |       * color, but until expand_16 works properly there is no choice!
 1611|       |       */
 1612|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
 1613|      0|      CHOP(png_ptr->background.red);
  ------------------
  |  | 1612|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
  |  |  ------------------
  |  |  |  |  751|      0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255)
  |  |  |  |  ------------------
  |  |  |  |  |  |  750|      0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16)
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1614|      0|      CHOP(png_ptr->background.green);
  ------------------
  |  | 1612|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
  |  |  ------------------
  |  |  |  |  751|      0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255)
  |  |  |  |  ------------------
  |  |  |  |  |  |  750|      0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16)
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1615|      0|      CHOP(png_ptr->background.blue);
  ------------------
  |  | 1612|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
  |  |  ------------------
  |  |  |  |  751|      0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255)
  |  |  |  |  ------------------
  |  |  |  |  |  |  750|      0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16)
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1616|      0|      CHOP(png_ptr->background.gray);
  ------------------
  |  | 1612|      0|#     define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x))
  |  |  ------------------
  |  |  |  |  751|      0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255)
  |  |  |  |  ------------------
  |  |  |  |  |  |  750|      0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16)
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1617|      0|#     undef CHOP
 1618|      0|   }
 1619|      5|#endif /* READ_BACKGROUND && READ_EXPAND_16 */
 1620|       |
 1621|      5|#if defined(PNG_READ_BACKGROUND_SUPPORTED) && \
 1622|      5|   (defined(PNG_READ_SCALE_16_TO_8_SUPPORTED) || \
 1623|      5|   defined(PNG_READ_STRIP_16_TO_8_SUPPORTED))
 1624|      5|   if ((png_ptr->transformations & (PNG_16_TO_8|PNG_SCALE_16_TO_8)) != 0 &&
  ------------------
  |  |  668|      5|#define PNG_16_TO_8             0x0400U    /* Becomes 'chop' in 1.5.4 */
  ------------------
                 if ((png_ptr->transformations & (PNG_16_TO_8|PNG_SCALE_16_TO_8)) != 0 &&
  ------------------
  |  |  685|      5|#define PNG_SCALE_16_TO_8    0x4000000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (1624:8): [True: 5, False: 0]
  ------------------
 1625|      5|       (png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  665|      5|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1625:8): [True: 0, False: 5]
  ------------------
 1626|      0|       (png_ptr->transformations & PNG_BACKGROUND_EXPAND) == 0 &&
  ------------------
  |  |  666|      0|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
  |  Branch (1626:8): [True: 0, False: 0]
  ------------------
 1627|      0|       png_ptr->bit_depth == 16)
  ------------------
  |  Branch (1627:8): [True: 0, False: 0]
  ------------------
 1628|      0|   {
 1629|       |      /* On the other hand, if a 16-bit file is to be reduced to 8-bits per
 1630|       |       * component this will also happen after PNG_COMPOSE and so the background
 1631|       |       * color must be pre-expanded here.
 1632|       |       *
 1633|       |       * TODO: fix this too.
 1634|       |       */
 1635|      0|      png_ptr->background.red = (png_uint_16)(png_ptr->background.red * 257);
 1636|      0|      png_ptr->background.green =
 1637|      0|         (png_uint_16)(png_ptr->background.green * 257);
 1638|      0|      png_ptr->background.blue = (png_uint_16)(png_ptr->background.blue * 257);
 1639|      0|      png_ptr->background.gray = (png_uint_16)(png_ptr->background.gray * 257);
 1640|      0|   }
 1641|      5|#endif
 1642|       |
 1643|       |   /* NOTE: below 'PNG_READ_ALPHA_MODE_SUPPORTED' is presumed to also enable the
 1644|       |    * background support (see the comments in scripts/pnglibconf.dfa), this
 1645|       |    * allows pre-multiplication of the alpha channel to be implemented as
 1646|       |    * compositing on black.  This is probably sub-optimal and has been done in
 1647|       |    * 1.5.4 betas simply to enable external critique and testing (i.e. to
 1648|       |    * implement the new API quickly, without lots of internal changes.)
 1649|       |    */
 1650|       |
 1651|      5|#ifdef PNG_READ_GAMMA_SUPPORTED
 1652|      5|#  ifdef PNG_READ_BACKGROUND_SUPPORTED
 1653|       |      /* Includes ALPHA_MODE */
 1654|      5|      png_ptr->background_1 = png_ptr->background;
 1655|      5|#  endif
 1656|       |
 1657|       |   /* This needs to change - in the palette image case a whole set of tables are
 1658|       |    * built when it would be quicker to just calculate the correct value for
 1659|       |    * each palette entry directly.  Also, the test is too tricky - why check
 1660|       |    * PNG_RGB_TO_GRAY if PNG_GAMMA is not set?  The answer seems to be that
 1661|       |    * PNG_GAMMA is cancelled even if the gamma is known?  The test excludes the
 1662|       |    * PNG_COMPOSE case, so apparently if there is no *overall* gamma correction
 1663|       |    * the gamma tables will not be built even if composition is required on a
 1664|       |    * gamma encoded value.
 1665|       |    *
 1666|       |    * In 1.5.4 this is addressed below by an additional check on the individual
 1667|       |    * file gamma - if it is not 1.0 both RGB_TO_GRAY and COMPOSE need the
 1668|       |    * tables.
 1669|       |    */
 1670|      5|   if ((png_ptr->transformations & PNG_GAMMA) != 0 ||
  ------------------
  |  |  671|      5|#define PNG_GAMMA               0x2000U
  ------------------
  |  Branch (1670:8): [True: 0, False: 5]
  ------------------
 1671|      5|       ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0 &&
  ------------------
  |  |  681|      5|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (1671:9): [True: 0, False: 5]
  ------------------
 1672|      0|        (png_gamma_significant(png_ptr->file_gamma) != 0 ||
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1672:10): [True: 0, False: 0]
  ------------------
 1673|      0|         png_gamma_significant(png_ptr->screen_gamma) != 0)) ||
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1673:10): [True: 0, False: 0]
  ------------------
 1674|      5|        ((png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  665|      5|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1674:10): [True: 0, False: 5]
  ------------------
 1675|      0|         (png_gamma_significant(png_ptr->file_gamma) != 0 ||
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1675:11): [True: 0, False: 0]
  ------------------
 1676|      0|          png_gamma_significant(png_ptr->screen_gamma) != 0
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1676:11): [True: 0, False: 0]
  ------------------
 1677|      0|#  ifdef PNG_READ_BACKGROUND_SUPPORTED
 1678|      0|         || (png_ptr->background_gamma_type == PNG_BACKGROUND_GAMMA_UNIQUE &&
  ------------------
  |  | 1362|      0|#  define PNG_BACKGROUND_GAMMA_UNIQUE  3
  ------------------
  |  Branch (1678:14): [True: 0, False: 0]
  ------------------
 1679|      0|           png_gamma_significant(png_ptr->background_gamma) != 0)
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1679:12): [True: 0, False: 0]
  ------------------
 1680|      0|#  endif
 1681|      5|        )) || ((png_ptr->transformations & PNG_ENCODE_ALPHA) != 0 &&
  ------------------
  |  |  682|      5|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (1681:16): [True: 0, False: 5]
  ------------------
 1682|      0|       png_gamma_significant(png_ptr->screen_gamma) != 0))
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1682:8): [True: 0, False: 0]
  ------------------
 1683|      0|   {
 1684|      0|      png_build_gamma_table(png_ptr, png_ptr->bit_depth);
  ------------------
  |  |   97|      0|#define png_build_gamma_table OSS_FUZZ_png_build_gamma_table
  ------------------
 1685|       |
 1686|      0|#ifdef PNG_READ_BACKGROUND_SUPPORTED
 1687|      0|      if ((png_ptr->transformations & PNG_COMPOSE) != 0)
  ------------------
  |  |  665|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1687:11): [True: 0, False: 0]
  ------------------
 1688|      0|      {
 1689|       |         /* Issue a warning about this combination: because RGB_TO_GRAY is
 1690|       |          * optimized to do the gamma transform if present yet do_background has
 1691|       |          * to do the same thing if both options are set a
 1692|       |          * double-gamma-correction happens.  This is true in all versions of
 1693|       |          * libpng to date.
 1694|       |          */
 1695|      0|         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0)
  ------------------
  |  |  681|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (1695:14): [True: 0, False: 0]
  ------------------
 1696|      0|            png_warning(png_ptr,
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1697|      0|                "libpng does not support gamma+background+rgb_to_gray");
 1698|       |
 1699|      0|         if ((png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) != 0)
  ------------------
  |  |  667|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1699:14): [True: 0, False: 0]
  ------------------
 1700|      0|         {
 1701|       |            /* We don't get to here unless there is a tRNS chunk with non-opaque
 1702|       |             * entries - see the checking code at the start of this function.
 1703|       |             */
 1704|      0|            png_color back, back_1;
 1705|      0|            png_colorp palette = png_ptr->palette;
 1706|      0|            int num_palette = png_ptr->num_palette;
 1707|      0|            int i;
 1708|      0|            if (png_ptr->background_gamma_type == PNG_BACKGROUND_GAMMA_FILE)
  ------------------
  |  | 1361|      0|#  define PNG_BACKGROUND_GAMMA_FILE    2
  ------------------
  |  Branch (1708:17): [True: 0, False: 0]
  ------------------
 1709|      0|            {
 1710|       |
 1711|      0|               back.red = png_ptr->gamma_table[png_ptr->background.red];
 1712|      0|               back.green = png_ptr->gamma_table[png_ptr->background.green];
 1713|      0|               back.blue = png_ptr->gamma_table[png_ptr->background.blue];
 1714|       |
 1715|      0|               back_1.red = png_ptr->gamma_to_1[png_ptr->background.red];
 1716|      0|               back_1.green = png_ptr->gamma_to_1[png_ptr->background.green];
 1717|      0|               back_1.blue = png_ptr->gamma_to_1[png_ptr->background.blue];
 1718|      0|            }
 1719|      0|            else
 1720|      0|            {
 1721|      0|               png_fixed_point g, gs;
 1722|       |
 1723|      0|               switch (png_ptr->background_gamma_type)
 1724|      0|               {
 1725|      0|                  case PNG_BACKGROUND_GAMMA_SCREEN:
  ------------------
  |  | 1360|      0|#  define PNG_BACKGROUND_GAMMA_SCREEN  1
  ------------------
  |  Branch (1725:19): [True: 0, False: 0]
  ------------------
 1726|      0|                     g = (png_ptr->screen_gamma);
 1727|      0|                     gs = PNG_FP_1;
  ------------------
  |  |  654|      0|#define PNG_FP_1    100000
  ------------------
 1728|      0|                     break;
 1729|       |
 1730|      0|                  case PNG_BACKGROUND_GAMMA_FILE:
  ------------------
  |  | 1361|      0|#  define PNG_BACKGROUND_GAMMA_FILE    2
  ------------------
  |  Branch (1730:19): [True: 0, False: 0]
  ------------------
 1731|      0|                     g = png_reciprocal(png_ptr->file_gamma);
  ------------------
  |  |   89|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1732|      0|                     gs = png_reciprocal2(png_ptr->file_gamma,
  ------------------
  |  |   90|      0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2
  ------------------
 1733|      0|                         png_ptr->screen_gamma);
 1734|      0|                     break;
 1735|       |
 1736|      0|                  case PNG_BACKGROUND_GAMMA_UNIQUE:
  ------------------
  |  | 1362|      0|#  define PNG_BACKGROUND_GAMMA_UNIQUE  3
  ------------------
  |  Branch (1736:19): [True: 0, False: 0]
  ------------------
 1737|      0|                     g = png_reciprocal(png_ptr->background_gamma);
  ------------------
  |  |   89|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1738|      0|                     gs = png_reciprocal2(png_ptr->background_gamma,
  ------------------
  |  |   90|      0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2
  ------------------
 1739|      0|                         png_ptr->screen_gamma);
 1740|      0|                     break;
 1741|      0|                  default:
  ------------------
  |  Branch (1741:19): [True: 0, False: 0]
  ------------------
 1742|      0|                     g = PNG_FP_1;    /* back_1 */
  ------------------
  |  |  654|      0|#define PNG_FP_1    100000
  ------------------
 1743|      0|                     gs = PNG_FP_1;   /* back */
  ------------------
  |  |  654|      0|#define PNG_FP_1    100000
  ------------------
 1744|      0|                     break;
 1745|      0|               }
 1746|       |
 1747|      0|               if (png_gamma_significant(gs) != 0)
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1747:20): [True: 0, False: 0]
  ------------------
 1748|      0|               {
 1749|      0|                  back.red = png_gamma_8bit_correct(png_ptr->background.red,
  ------------------
  |  |   95|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1750|      0|                      gs);
 1751|      0|                  back.green = png_gamma_8bit_correct(png_ptr->background.green,
  ------------------
  |  |   95|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1752|      0|                      gs);
 1753|      0|                  back.blue = png_gamma_8bit_correct(png_ptr->background.blue,
  ------------------
  |  |   95|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1754|      0|                      gs);
 1755|      0|               }
 1756|       |
 1757|      0|               else
 1758|      0|               {
 1759|      0|                  back.red   = (png_byte)png_ptr->background.red;
 1760|      0|                  back.green = (png_byte)png_ptr->background.green;
 1761|      0|                  back.blue  = (png_byte)png_ptr->background.blue;
 1762|      0|               }
 1763|       |
 1764|      0|               if (png_gamma_significant(g) != 0)
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
  |  Branch (1764:20): [True: 0, False: 0]
  ------------------
 1765|      0|               {
 1766|      0|                  back_1.red = png_gamma_8bit_correct(png_ptr->background.red,
  ------------------
  |  |   95|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1767|      0|                      g);
 1768|      0|                  back_1.green = png_gamma_8bit_correct(
  ------------------
  |  |   95|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1769|      0|                      png_ptr->background.green, g);
 1770|      0|                  back_1.blue = png_gamma_8bit_correct(png_ptr->background.blue,
  ------------------
  |  |   95|      0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct
  ------------------
 1771|      0|                      g);
 1772|      0|               }
 1773|       |
 1774|      0|               else
 1775|      0|               {
 1776|      0|                  back_1.red   = (png_byte)png_ptr->background.red;
 1777|      0|                  back_1.green = (png_byte)png_ptr->background.green;
 1778|      0|                  back_1.blue  = (png_byte)png_ptr->background.blue;
 1779|      0|               }
 1780|      0|            }
 1781|       |
 1782|      0|            for (i = 0; i < num_palette; i++)
  ------------------
  |  Branch (1782:25): [True: 0, False: 0]
  ------------------
 1783|      0|            {
 1784|      0|               if (i < (int)png_ptr->num_trans &&
  ------------------
  |  Branch (1784:20): [True: 0, False: 0]
  ------------------
 1785|      0|                   png_ptr->trans_alpha[i] != 0xff)
  ------------------
  |  Branch (1785:20): [True: 0, False: 0]
  ------------------
 1786|      0|               {
 1787|      0|                  if (png_ptr->trans_alpha[i] == 0)
  ------------------
  |  Branch (1787:23): [True: 0, False: 0]
  ------------------
 1788|      0|                  {
 1789|      0|                     palette[i] = back;
 1790|      0|                  }
 1791|      0|                  else /* if (png_ptr->trans_alpha[i] != 0xff) */
 1792|      0|                  {
 1793|      0|                     if ((png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0)
  ------------------
  |  |  708|      0|#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (1793:26): [True: 0, False: 0]
  ------------------
 1794|      0|                     {
 1795|       |                        /* Premultiply only:
 1796|       |                         * component = round((component * alpha) / 255)
 1797|       |                         */
 1798|      0|                        png_uint_32 component;
 1799|       |
 1800|      0|                        component = png_ptr->gamma_to_1[palette[i].red];
 1801|      0|                        component =
 1802|      0|                            (component * png_ptr->trans_alpha[i] + 128) / 255;
 1803|      0|                        palette[i].red = png_ptr->gamma_from_1[component];
 1804|       |
 1805|      0|                        component = png_ptr->gamma_to_1[palette[i].green];
 1806|      0|                        component =
 1807|      0|                            (component * png_ptr->trans_alpha[i] + 128) / 255;
 1808|      0|                        palette[i].green = png_ptr->gamma_from_1[component];
 1809|       |
 1810|      0|                        component = png_ptr->gamma_to_1[palette[i].blue];
 1811|      0|                        component =
 1812|      0|                            (component * png_ptr->trans_alpha[i] + 128) / 255;
 1813|      0|                        palette[i].blue = png_ptr->gamma_from_1[component];
 1814|      0|                     }
 1815|      0|                     else
 1816|      0|                     {
 1817|       |                        /* Composite with background color:
 1818|       |                         * component =
 1819|       |                         *    alpha * component + (1 - alpha) * background
 1820|       |                         */
 1821|      0|                        png_byte v, w;
 1822|       |
 1823|      0|                        v = png_ptr->gamma_to_1[palette[i].red];
 1824|      0|                        png_composite(w, v,
  ------------------
  |  | 2752|      0|   {                                                     \
  |  | 2753|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2754|      0|          * (png_uint_16)(alpha)                         \
  |  | 2755|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2756|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2757|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2758|      0|   }
  ------------------
 1825|      0|                            png_ptr->trans_alpha[i], back_1.red);
 1826|      0|                        palette[i].red = png_ptr->gamma_from_1[w];
 1827|       |
 1828|      0|                        v = png_ptr->gamma_to_1[palette[i].green];
 1829|      0|                        png_composite(w, v,
  ------------------
  |  | 2752|      0|   {                                                     \
  |  | 2753|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2754|      0|          * (png_uint_16)(alpha)                         \
  |  | 2755|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2756|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2757|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2758|      0|   }
  ------------------
 1830|      0|                            png_ptr->trans_alpha[i], back_1.green);
 1831|      0|                        palette[i].green = png_ptr->gamma_from_1[w];
 1832|       |
 1833|      0|                        v = png_ptr->gamma_to_1[palette[i].blue];
 1834|      0|                        png_composite(w, v,
  ------------------
  |  | 2752|      0|   {                                                     \
  |  | 2753|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2754|      0|          * (png_uint_16)(alpha)                         \
  |  | 2755|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2756|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2757|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2758|      0|   }
  ------------------
 1835|      0|                            png_ptr->trans_alpha[i], back_1.blue);
 1836|      0|                        palette[i].blue = png_ptr->gamma_from_1[w];
 1837|      0|                     }
 1838|      0|                  }
 1839|      0|               }
 1840|      0|               else
 1841|      0|               {
 1842|      0|                  palette[i].red = png_ptr->gamma_table[palette[i].red];
 1843|      0|                  palette[i].green = png_ptr->gamma_table[palette[i].green];
 1844|      0|                  palette[i].blue = png_ptr->gamma_table[palette[i].blue];
 1845|      0|               }
 1846|      0|            }
 1847|       |
 1848|       |            /* Prevent the transformations being done again.
 1849|       |             *
 1850|       |             * NOTE: this is highly dubious; it removes the transformations in
 1851|       |             * place.  This seems inconsistent with the general treatment of the
 1852|       |             * transformations elsewhere.
 1853|       |             */
 1854|      0|            png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA);
  ------------------
  |  |  665|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
                          png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA);
  ------------------
  |  |  671|      0|#define PNG_GAMMA               0x2000U
  ------------------
 1855|      0|            png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
  ------------------
  |  |  708|      0|#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
  ------------------
 1856|      0|         } /* color_type == PNG_COLOR_TYPE_PALETTE */
 1857|       |
 1858|       |         /* if (png_ptr->background_gamma_type!=PNG_BACKGROUND_GAMMA_UNKNOWN) */
 1859|      0|         else /* color_type != PNG_COLOR_TYPE_PALETTE */
 1860|      0|         {
 1861|      0|            int gs_sig, g_sig;
 1862|      0|            png_fixed_point g = PNG_FP_1;  /* Correction to linear */
  ------------------
  |  |  654|      0|#define PNG_FP_1    100000
  ------------------
 1863|      0|            png_fixed_point gs = PNG_FP_1; /* Correction to screen */
  ------------------
  |  |  654|      0|#define PNG_FP_1    100000
  ------------------
 1864|       |
 1865|      0|            switch (png_ptr->background_gamma_type)
 1866|      0|            {
 1867|      0|               case PNG_BACKGROUND_GAMMA_SCREEN:
  ------------------
  |  | 1360|      0|#  define PNG_BACKGROUND_GAMMA_SCREEN  1
  ------------------
  |  Branch (1867:16): [True: 0, False: 0]
  ------------------
 1868|      0|                  g = png_ptr->screen_gamma;
 1869|       |                  /* gs = PNG_FP_1; */
 1870|      0|                  break;
 1871|       |
 1872|      0|               case PNG_BACKGROUND_GAMMA_FILE:
  ------------------
  |  | 1361|      0|#  define PNG_BACKGROUND_GAMMA_FILE    2
  ------------------
  |  Branch (1872:16): [True: 0, False: 0]
  ------------------
 1873|      0|                  g = png_reciprocal(png_ptr->file_gamma);
  ------------------
  |  |   89|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1874|      0|                  gs = png_reciprocal2(png_ptr->file_gamma,
  ------------------
  |  |   90|      0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2
  ------------------
 1875|      0|                      png_ptr->screen_gamma);
 1876|      0|                  break;
 1877|       |
 1878|      0|               case PNG_BACKGROUND_GAMMA_UNIQUE:
  ------------------
  |  | 1362|      0|#  define PNG_BACKGROUND_GAMMA_UNIQUE  3
  ------------------
  |  Branch (1878:16): [True: 0, False: 0]
  ------------------
 1879|      0|                  g = png_reciprocal(png_ptr->background_gamma);
  ------------------
  |  |   89|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1880|      0|                  gs = png_reciprocal2(png_ptr->background_gamma,
  ------------------
  |  |   90|      0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2
  ------------------
 1881|      0|                      png_ptr->screen_gamma);
 1882|      0|                  break;
 1883|       |
 1884|      0|               default:
  ------------------
  |  Branch (1884:16): [True: 0, False: 0]
  ------------------
 1885|      0|                  png_error(png_ptr, "invalid background gamma type");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 1886|      0|            }
 1887|       |
 1888|      0|            g_sig = png_gamma_significant(g);
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
 1889|      0|            gs_sig = png_gamma_significant(gs);
  ------------------
  |  |   91|      0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant
  ------------------
 1890|       |
 1891|      0|            if (g_sig != 0)
  ------------------
  |  Branch (1891:17): [True: 0, False: 0]
  ------------------
 1892|      0|               png_ptr->background_1.gray = png_gamma_correct(png_ptr,
  ------------------
  |  |   93|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1893|      0|                   png_ptr->background.gray, g);
 1894|       |
 1895|      0|            if (gs_sig != 0)
  ------------------
  |  Branch (1895:17): [True: 0, False: 0]
  ------------------
 1896|      0|               png_ptr->background.gray = png_gamma_correct(png_ptr,
  ------------------
  |  |   93|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1897|      0|                   png_ptr->background.gray, gs);
 1898|       |
 1899|      0|            if ((png_ptr->background.red != png_ptr->background.green) ||
  ------------------
  |  Branch (1899:17): [True: 0, False: 0]
  ------------------
 1900|      0|                (png_ptr->background.red != png_ptr->background.blue) ||
  ------------------
  |  Branch (1900:17): [True: 0, False: 0]
  ------------------
 1901|      0|                (png_ptr->background.red != png_ptr->background.gray))
  ------------------
  |  Branch (1901:17): [True: 0, False: 0]
  ------------------
 1902|      0|            {
 1903|       |               /* RGB or RGBA with color background */
 1904|      0|               if (g_sig != 0)
  ------------------
  |  Branch (1904:20): [True: 0, False: 0]
  ------------------
 1905|      0|               {
 1906|      0|                  png_ptr->background_1.red = png_gamma_correct(png_ptr,
  ------------------
  |  |   93|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1907|      0|                      png_ptr->background.red, g);
 1908|       |
 1909|      0|                  png_ptr->background_1.green = png_gamma_correct(png_ptr,
  ------------------
  |  |   93|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1910|      0|                      png_ptr->background.green, g);
 1911|       |
 1912|      0|                  png_ptr->background_1.blue = png_gamma_correct(png_ptr,
  ------------------
  |  |   93|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1913|      0|                      png_ptr->background.blue, g);
 1914|      0|               }
 1915|       |
 1916|      0|               if (gs_sig != 0)
  ------------------
  |  Branch (1916:20): [True: 0, False: 0]
  ------------------
 1917|      0|               {
 1918|      0|                  png_ptr->background.red = png_gamma_correct(png_ptr,
  ------------------
  |  |   93|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1919|      0|                      png_ptr->background.red, gs);
 1920|       |
 1921|      0|                  png_ptr->background.green = png_gamma_correct(png_ptr,
  ------------------
  |  |   93|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1922|      0|                      png_ptr->background.green, gs);
 1923|       |
 1924|      0|                  png_ptr->background.blue = png_gamma_correct(png_ptr,
  ------------------
  |  |   93|      0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct
  ------------------
 1925|      0|                      png_ptr->background.blue, gs);
 1926|      0|               }
 1927|      0|            }
 1928|       |
 1929|      0|            else
 1930|      0|            {
 1931|       |               /* GRAY, GRAY ALPHA, RGB, or RGBA with gray background */
 1932|      0|               png_ptr->background_1.red = png_ptr->background_1.green
 1933|      0|                   = png_ptr->background_1.blue = png_ptr->background_1.gray;
 1934|       |
 1935|      0|               png_ptr->background.red = png_ptr->background.green
 1936|      0|                   = png_ptr->background.blue = png_ptr->background.gray;
 1937|      0|            }
 1938|       |
 1939|       |            /* The background is now in screen gamma: */
 1940|      0|            png_ptr->background_gamma_type = PNG_BACKGROUND_GAMMA_SCREEN;
  ------------------
  |  | 1360|      0|#  define PNG_BACKGROUND_GAMMA_SCREEN  1
  ------------------
 1941|      0|         } /* color_type != PNG_COLOR_TYPE_PALETTE */
 1942|      0|      }/* png_ptr->transformations & PNG_BACKGROUND */
 1943|       |
 1944|      0|      else
 1945|       |      /* Transformation does not include PNG_BACKGROUND */
 1946|      0|#endif /* READ_BACKGROUND */
 1947|      0|      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE
  ------------------
  |  |  667|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1947:11): [True: 0, False: 0]
  ------------------
 1948|      0|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 1949|       |         /* RGB_TO_GRAY needs to have non-gamma-corrected values! */
 1950|      0|         && ((png_ptr->transformations & PNG_EXPAND) == 0 ||
  ------------------
  |  |  670|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (1950:14): [True: 0, False: 0]
  ------------------
 1951|      0|         (png_ptr->transformations & PNG_RGB_TO_GRAY) == 0)
  ------------------
  |  |  681|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (1951:10): [True: 0, False: 0]
  ------------------
 1952|      0|#endif
 1953|      0|         )
 1954|      0|      {
 1955|      0|         png_colorp palette = png_ptr->palette;
 1956|      0|         int num_palette = png_ptr->num_palette;
 1957|      0|         int i;
 1958|       |
 1959|       |         /* NOTE: there are other transformations that should probably be in
 1960|       |          * here too.
 1961|       |          */
 1962|      0|         for (i = 0; i < num_palette; i++)
  ------------------
  |  Branch (1962:22): [True: 0, False: 0]
  ------------------
 1963|      0|         {
 1964|      0|            palette[i].red = png_ptr->gamma_table[palette[i].red];
 1965|      0|            palette[i].green = png_ptr->gamma_table[palette[i].green];
 1966|      0|            palette[i].blue = png_ptr->gamma_table[palette[i].blue];
 1967|      0|         }
 1968|       |
 1969|       |         /* Done the gamma correction. */
 1970|      0|         png_ptr->transformations &= ~PNG_GAMMA;
  ------------------
  |  |  671|      0|#define PNG_GAMMA               0x2000U
  ------------------
 1971|      0|      } /* color_type == PALETTE && !PNG_BACKGROUND transformation */
 1972|      0|   }
 1973|      5|#ifdef PNG_READ_BACKGROUND_SUPPORTED
 1974|      5|   else
 1975|      5|#endif
 1976|      5|#endif /* READ_GAMMA */
 1977|       |
 1978|      5|#ifdef PNG_READ_BACKGROUND_SUPPORTED
 1979|       |   /* No GAMMA transformation (see the hanging else 4 lines above) */
 1980|      5|   if ((png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  665|      5|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (1980:8): [True: 0, False: 5]
  ------------------
 1981|      0|       (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE))
  ------------------
  |  |  667|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (1981:8): [True: 0, False: 0]
  ------------------
 1982|      0|   {
 1983|      0|      int i;
 1984|      0|      int istop = (int)png_ptr->num_trans;
 1985|      0|      png_color back;
 1986|      0|      png_colorp palette = png_ptr->palette;
 1987|       |
 1988|      0|      back.red   = (png_byte)png_ptr->background.red;
 1989|      0|      back.green = (png_byte)png_ptr->background.green;
 1990|      0|      back.blue  = (png_byte)png_ptr->background.blue;
 1991|       |
 1992|      0|      for (i = 0; i < istop; i++)
  ------------------
  |  Branch (1992:19): [True: 0, False: 0]
  ------------------
 1993|      0|      {
 1994|      0|         if (png_ptr->trans_alpha[i] == 0)
  ------------------
  |  Branch (1994:14): [True: 0, False: 0]
  ------------------
 1995|      0|         {
 1996|      0|            palette[i] = back;
 1997|      0|         }
 1998|       |
 1999|      0|         else if (png_ptr->trans_alpha[i] != 0xff)
  ------------------
  |  Branch (1999:19): [True: 0, False: 0]
  ------------------
 2000|      0|         {
 2001|       |            /* The png_composite() macro is defined in png.h */
 2002|      0|            png_composite(palette[i].red, palette[i].red,
  ------------------
  |  | 2752|      0|   {                                                     \
  |  | 2753|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2754|      0|          * (png_uint_16)(alpha)                         \
  |  | 2755|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2756|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2757|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2758|      0|   }
  ------------------
 2003|      0|                png_ptr->trans_alpha[i], back.red);
 2004|       |
 2005|      0|            png_composite(palette[i].green, palette[i].green,
  ------------------
  |  | 2752|      0|   {                                                     \
  |  | 2753|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2754|      0|          * (png_uint_16)(alpha)                         \
  |  | 2755|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2756|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2757|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2758|      0|   }
  ------------------
 2006|      0|                png_ptr->trans_alpha[i], back.green);
 2007|       |
 2008|      0|            png_composite(palette[i].blue, palette[i].blue,
  ------------------
  |  | 2752|      0|   {                                                     \
  |  | 2753|      0|      png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \
  |  | 2754|      0|          * (png_uint_16)(alpha)                         \
  |  | 2755|      0|          + (png_uint_16)(bg)*(png_uint_16)(255          \
  |  | 2756|      0|          - (png_uint_16)(alpha)) + 128);                \
  |  | 2757|      0|      (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \
  |  | 2758|      0|   }
  ------------------
 2009|      0|                png_ptr->trans_alpha[i], back.blue);
 2010|      0|         }
 2011|      0|      }
 2012|       |
 2013|      0|      png_ptr->transformations &= ~PNG_COMPOSE;
  ------------------
  |  |  665|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
 2014|      0|   }
 2015|      5|#endif /* READ_BACKGROUND */
 2016|       |
 2017|      5|#ifdef PNG_READ_SHIFT_SUPPORTED
 2018|      5|   if ((png_ptr->transformations & PNG_SHIFT) != 0 &&
  ------------------
  |  |  661|      5|#define PNG_SHIFT               0x0008U
  ------------------
  |  Branch (2018:8): [True: 0, False: 5]
  ------------------
 2019|      0|       (png_ptr->transformations & PNG_EXPAND) == 0 &&
  ------------------
  |  |  670|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (2019:8): [True: 0, False: 0]
  ------------------
 2020|      0|       (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE))
  ------------------
  |  |  667|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (2020:8): [True: 0, False: 0]
  ------------------
 2021|      0|   {
 2022|      0|      int i;
 2023|      0|      int istop = png_ptr->num_palette;
 2024|      0|      int shift = 8 - png_ptr->sig_bit.red;
 2025|       |
 2026|      0|      png_ptr->transformations &= ~PNG_SHIFT;
  ------------------
  |  |  661|      0|#define PNG_SHIFT               0x0008U
  ------------------
 2027|       |
 2028|       |      /* significant bits can be in the range 1 to 7 for a meaningful result, if
 2029|       |       * the number of significant bits is 0 then no shift is done (this is an
 2030|       |       * error condition which is silently ignored.)
 2031|       |       */
 2032|      0|      if (shift > 0 && shift < 8)
  ------------------
  |  Branch (2032:11): [True: 0, False: 0]
  |  Branch (2032:24): [True: 0, False: 0]
  ------------------
 2033|      0|         for (i=0; i<istop; ++i)
  ------------------
  |  Branch (2033:20): [True: 0, False: 0]
  ------------------
 2034|      0|         {
 2035|      0|            int component = png_ptr->palette[i].red;
 2036|       |
 2037|      0|            component >>= shift;
 2038|      0|            png_ptr->palette[i].red = (png_byte)component;
 2039|      0|         }
 2040|       |
 2041|      0|      shift = 8 - png_ptr->sig_bit.green;
 2042|      0|      if (shift > 0 && shift < 8)
  ------------------
  |  Branch (2042:11): [True: 0, False: 0]
  |  Branch (2042:24): [True: 0, False: 0]
  ------------------
 2043|      0|         for (i=0; i<istop; ++i)
  ------------------
  |  Branch (2043:20): [True: 0, False: 0]
  ------------------
 2044|      0|         {
 2045|      0|            int component = png_ptr->palette[i].green;
 2046|       |
 2047|      0|            component >>= shift;
 2048|      0|            png_ptr->palette[i].green = (png_byte)component;
 2049|      0|         }
 2050|       |
 2051|      0|      shift = 8 - png_ptr->sig_bit.blue;
 2052|      0|      if (shift > 0 && shift < 8)
  ------------------
  |  Branch (2052:11): [True: 0, False: 0]
  |  Branch (2052:24): [True: 0, False: 0]
  ------------------
 2053|      0|         for (i=0; i<istop; ++i)
  ------------------
  |  Branch (2053:20): [True: 0, False: 0]
  ------------------
 2054|      0|         {
 2055|      0|            int component = png_ptr->palette[i].blue;
 2056|       |
 2057|      0|            component >>= shift;
 2058|      0|            png_ptr->palette[i].blue = (png_byte)component;
 2059|      0|         }
 2060|      0|   }
 2061|      5|#endif /* READ_SHIFT */
 2062|      5|}
OSS_FUZZ_png_read_transform_info:
 2070|      3|{
 2071|      3|   png_debug(1, "in png_read_transform_info");
  ------------------
  |  |  145|      3|#  define png_debug(l, m) ((void)0)
  ------------------
 2072|       |
 2073|      3|   if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  ------------------
  |  |  667|      6|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      3|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      3|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (2073:8): [True: 0, False: 3]
  ------------------
 2074|      0|       info_ptr->palette != NULL && png_ptr->palette != NULL)
  ------------------
  |  Branch (2074:8): [True: 0, False: 0]
  |  Branch (2074:37): [True: 0, False: 0]
  ------------------
 2075|      0|   {
 2076|       |      /* Sync info_ptr->palette with png_ptr->palette, which may
 2077|       |       * have been modified by png_init_read_transformations
 2078|       |       * (e.g. for gamma correction or background compositing).
 2079|       |       */
 2080|      0|      memcpy(info_ptr->palette, png_ptr->palette,
 2081|      0|          PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)));
  ------------------
  |  |  723|      0|#define PNG_MAX_PALETTE_LENGTH    256
  ------------------
 2082|      0|   }
 2083|       |
 2084|      3|#ifdef PNG_READ_EXPAND_SUPPORTED
 2085|      3|   if ((png_ptr->transformations & PNG_EXPAND) != 0)
  ------------------
  |  |  670|      3|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (2085:8): [True: 3, False: 0]
  ------------------
 2086|      3|   {
 2087|      3|      if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  667|      3|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      3|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      3|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (2087:11): [True: 0, False: 3]
  ------------------
 2088|      0|      {
 2089|       |         /* This check must match what actually happens in
 2090|       |          * png_do_expand_palette; if it ever checks the tRNS chunk to see if
 2091|       |          * it is all opaque we must do the same (at present it does not.)
 2092|       |          */
 2093|      0|         if (png_ptr->num_trans > 0)
  ------------------
  |  Branch (2093:14): [True: 0, False: 0]
  ------------------
 2094|      0|            info_ptr->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
 2095|       |
 2096|      0|         else
 2097|      0|            info_ptr->color_type = PNG_COLOR_TYPE_RGB;
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
 2098|       |
 2099|      0|         info_ptr->bit_depth = 8;
 2100|      0|         info_ptr->num_trans = 0;
 2101|       |
 2102|      0|         if (png_ptr->palette == NULL)
  ------------------
  |  Branch (2102:14): [True: 0, False: 0]
  ------------------
 2103|      0|            png_error (png_ptr, "Palette is NULL in indexed image");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 2104|      0|      }
 2105|      3|      else
 2106|      3|      {
 2107|      3|         if (png_ptr->num_trans != 0)
  ------------------
  |  Branch (2107:14): [True: 0, False: 3]
  ------------------
 2108|      0|         {
 2109|      0|            if ((png_ptr->transformations & PNG_EXPAND_tRNS) != 0)
  ------------------
  |  |  684|      0|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  |  Branch (2109:17): [True: 0, False: 0]
  ------------------
 2110|      0|               info_ptr->color_type |= PNG_COLOR_MASK_ALPHA;
  ------------------
  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
 2111|      0|         }
 2112|      3|         if (info_ptr->bit_depth < 8)
  ------------------
  |  Branch (2112:14): [True: 3, False: 0]
  ------------------
 2113|      3|            info_ptr->bit_depth = 8;
 2114|       |
 2115|      3|         info_ptr->num_trans = 0;
 2116|      3|      }
 2117|      3|   }
 2118|      3|#endif
 2119|       |
 2120|      3|#if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\
 2121|      3|   defined(PNG_READ_ALPHA_MODE_SUPPORTED)
 2122|       |   /* The following is almost certainly wrong unless the background value is in
 2123|       |    * the screen space!
 2124|       |    */
 2125|      3|   if ((png_ptr->transformations & PNG_COMPOSE) != 0)
  ------------------
  |  |  665|      3|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (2125:8): [True: 0, False: 3]
  ------------------
 2126|      0|      info_ptr->background = png_ptr->background;
 2127|      3|#endif
 2128|       |
 2129|      3|#ifdef PNG_READ_GAMMA_SUPPORTED
 2130|       |   /* The following used to be conditional on PNG_GAMMA (prior to 1.5.4),
 2131|       |    * however it seems that the code in png_init_read_transformations, which has
 2132|       |    * been called before this from png_read_update_info->png_read_start_row
 2133|       |    * sometimes does the gamma transform and cancels the flag.
 2134|       |    *
 2135|       |    * TODO: this is confusing.  It only changes the result of png_get_gAMA and,
 2136|       |    * yes, it does return the value that the transformed data effectively has
 2137|       |    * but does any app really understand this?
 2138|       |    */
 2139|      3|   info_ptr->gamma = png_ptr->file_gamma;
 2140|      3|#endif
 2141|       |
 2142|      3|   if (info_ptr->bit_depth == 16)
  ------------------
  |  Branch (2142:8): [True: 0, False: 3]
  ------------------
 2143|      0|   {
 2144|      0|#  ifdef PNG_READ_16BIT_SUPPORTED
 2145|      0|#     ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
 2146|      0|         if ((png_ptr->transformations & PNG_SCALE_16_TO_8) != 0)
  ------------------
  |  |  685|      0|#define PNG_SCALE_16_TO_8    0x4000000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (2146:14): [True: 0, False: 0]
  ------------------
 2147|      0|            info_ptr->bit_depth = 8;
 2148|      0|#     endif
 2149|       |
 2150|      0|#     ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED
 2151|      0|         if ((png_ptr->transformations & PNG_16_TO_8) != 0)
  ------------------
  |  |  668|      0|#define PNG_16_TO_8             0x0400U    /* Becomes 'chop' in 1.5.4 */
  ------------------
  |  Branch (2151:14): [True: 0, False: 0]
  ------------------
 2152|      0|            info_ptr->bit_depth = 8;
 2153|      0|#     endif
 2154|       |
 2155|       |#  else
 2156|       |      /* No 16-bit support: force chopping 16-bit input down to 8, in this case
 2157|       |       * the app program can chose if both APIs are available by setting the
 2158|       |       * correct scaling to use.
 2159|       |       */
 2160|       |#     ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED
 2161|       |         /* For compatibility with previous versions use the strip method by
 2162|       |          * default.  This code works because if PNG_SCALE_16_TO_8 is already
 2163|       |          * set the code below will do that in preference to the chop.
 2164|       |          */
 2165|       |         png_ptr->transformations |= PNG_16_TO_8;
 2166|       |         info_ptr->bit_depth = 8;
 2167|       |#     else
 2168|       |
 2169|       |#        ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
 2170|       |            png_ptr->transformations |= PNG_SCALE_16_TO_8;
 2171|       |            info_ptr->bit_depth = 8;
 2172|       |#        else
 2173|       |
 2174|       |            CONFIGURATION ERROR: you must enable at least one 16 to 8 method
 2175|       |#        endif
 2176|       |#    endif
 2177|       |#endif /* !READ_16BIT */
 2178|      0|   }
 2179|       |
 2180|      3|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 2181|      3|   if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0)
  ------------------
  |  |  672|      3|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (2181:8): [True: 3, False: 0]
  ------------------
 2182|      3|      info_ptr->color_type = (png_byte)(info_ptr->color_type |
 2183|      3|         PNG_COLOR_MASK_COLOR);
  ------------------
  |  |  662|      3|#define PNG_COLOR_MASK_COLOR      2
  ------------------
 2184|      3|#endif
 2185|       |
 2186|      3|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 2187|      3|   if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0)
  ------------------
  |  |  681|      3|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (2187:8): [True: 0, False: 3]
  ------------------
 2188|      0|      info_ptr->color_type = (png_byte)(info_ptr->color_type &
 2189|      0|         ~PNG_COLOR_MASK_COLOR);
  ------------------
  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  ------------------
 2190|      3|#endif
 2191|       |
 2192|      3|#ifdef PNG_READ_QUANTIZE_SUPPORTED
 2193|      3|   if ((png_ptr->transformations & PNG_QUANTIZE) != 0)
  ------------------
  |  |  664|      3|#define PNG_QUANTIZE            0x0040U
  ------------------
  |  Branch (2193:8): [True: 0, False: 3]
  ------------------
 2194|      0|   {
 2195|      0|      if (((info_ptr->color_type == PNG_COLOR_TYPE_RGB) ||
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (2195:12): [True: 0, False: 0]
  ------------------
 2196|      0|          (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)) &&
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (2196:11): [True: 0, False: 0]
  ------------------
 2197|      0|          png_ptr->palette_lookup != 0 && info_ptr->bit_depth == 8)
  ------------------
  |  Branch (2197:11): [True: 0, False: 0]
  |  Branch (2197:43): [True: 0, False: 0]
  ------------------
 2198|      0|      {
 2199|      0|         info_ptr->color_type = PNG_COLOR_TYPE_PALETTE;
  ------------------
  |  |  667|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
 2200|      0|      }
 2201|      0|   }
 2202|      3|#endif
 2203|       |
 2204|      3|#ifdef PNG_READ_EXPAND_16_SUPPORTED
 2205|      3|   if ((png_ptr->transformations & PNG_EXPAND_16) != 0 &&
  ------------------
  |  |  667|      3|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
  |  Branch (2205:8): [True: 0, False: 3]
  ------------------
 2206|      0|       info_ptr->bit_depth == 8 &&
  ------------------
  |  Branch (2206:8): [True: 0, False: 0]
  ------------------
 2207|      0|       info_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  667|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (2207:8): [True: 0, False: 0]
  ------------------
 2208|      0|   {
 2209|      0|      info_ptr->bit_depth = 16;
 2210|      0|   }
 2211|      3|#endif
 2212|       |
 2213|      3|#ifdef PNG_READ_PACK_SUPPORTED
 2214|      3|   if ((png_ptr->transformations & PNG_PACK) != 0 &&
  ------------------
  |  |  660|      3|#define PNG_PACK                0x0004U
  ------------------
  |  Branch (2214:8): [True: 3, False: 0]
  ------------------
 2215|      3|       (info_ptr->bit_depth < 8))
  ------------------
  |  Branch (2215:8): [True: 0, False: 3]
  ------------------
 2216|      0|      info_ptr->bit_depth = 8;
 2217|      3|#endif
 2218|       |
 2219|      3|   if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  667|      3|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      3|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      3|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (2219:8): [True: 0, False: 3]
  ------------------
 2220|      0|      info_ptr->channels = 1;
 2221|       |
 2222|      3|   else if ((info_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
  ------------------
  |  |  662|      3|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (2222:13): [True: 3, False: 0]
  ------------------
 2223|      3|      info_ptr->channels = 3;
 2224|       |
 2225|      0|   else
 2226|      0|      info_ptr->channels = 1;
 2227|       |
 2228|      3|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
 2229|      3|   if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0)
  ------------------
  |  |  676|      3|#define PNG_STRIP_ALPHA        0x40000U
  ------------------
  |  Branch (2229:8): [True: 0, False: 3]
  ------------------
 2230|      0|   {
 2231|      0|      info_ptr->color_type = (png_byte)(info_ptr->color_type &
 2232|      0|         ~PNG_COLOR_MASK_ALPHA);
  ------------------
  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
 2233|      0|      info_ptr->num_trans = 0;
 2234|      0|   }
 2235|      3|#endif
 2236|       |
 2237|      3|   if ((info_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)
  ------------------
  |  |  663|      3|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
  |  Branch (2237:8): [True: 0, False: 3]
  ------------------
 2238|      0|      info_ptr->channels++;
 2239|       |
 2240|      3|#ifdef PNG_READ_FILLER_SUPPORTED
 2241|       |   /* STRIP_ALPHA and FILLER allowed:  MASK_ALPHA bit stripped above */
 2242|      3|   if ((png_ptr->transformations & PNG_FILLER) != 0 &&
  ------------------
  |  |  673|      3|#define PNG_FILLER              0x8000U
  ------------------
  |  Branch (2242:8): [True: 0, False: 3]
  ------------------
 2243|      0|       (info_ptr->color_type == PNG_COLOR_TYPE_RGB ||
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (2243:9): [True: 0, False: 0]
  ------------------
 2244|      0|       info_ptr->color_type == PNG_COLOR_TYPE_GRAY))
  ------------------
  |  |  666|      0|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (2244:8): [True: 0, False: 0]
  ------------------
 2245|      0|   {
 2246|      0|      info_ptr->channels++;
 2247|       |      /* If adding a true alpha channel not just filler */
 2248|      0|      if ((png_ptr->transformations & PNG_ADD_ALPHA) != 0)
  ------------------
  |  |  683|      0|#define PNG_ADD_ALPHA        0x1000000U /* Added to libpng-1.2.7 */
  ------------------
  |  Branch (2248:11): [True: 0, False: 0]
  ------------------
 2249|      0|         info_ptr->color_type |= PNG_COLOR_MASK_ALPHA;
  ------------------
  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
 2250|      0|   }
 2251|      3|#endif
 2252|       |
 2253|      3|#if defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) && \
 2254|      3|defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
 2255|      3|   if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
  ------------------
  |  |  678|      3|#define PNG_USER_TRANSFORM    0x100000U
  ------------------
  |  Branch (2255:8): [True: 0, False: 3]
  ------------------
 2256|      0|   {
 2257|      0|      if (png_ptr->user_transform_depth != 0)
  ------------------
  |  Branch (2257:11): [True: 0, False: 0]
  ------------------
 2258|      0|         info_ptr->bit_depth = png_ptr->user_transform_depth;
 2259|       |
 2260|      0|      if (png_ptr->user_transform_channels != 0)
  ------------------
  |  Branch (2260:11): [True: 0, False: 0]
  ------------------
 2261|      0|         info_ptr->channels = png_ptr->user_transform_channels;
 2262|      0|   }
 2263|      3|#endif
 2264|       |
 2265|      3|   info_ptr->pixel_depth = (png_byte)(info_ptr->channels *
 2266|      3|       info_ptr->bit_depth);
 2267|       |
 2268|      3|   info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, info_ptr->width);
  ------------------
  |  |  755|      3|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 3, False: 0]
  |  |  ------------------
  |  |  756|      3|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|      3|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 2269|       |
 2270|       |   /* Adding in 1.5.4: cache the above value in png_struct so that we can later
 2271|       |    * check in png_rowbytes that the user buffer won't get overwritten.  Note
 2272|       |    * that the field is not always set - if png_read_update_info isn't called
 2273|       |    * the application has to either not do any transforms or get the calculation
 2274|       |    * right itself.
 2275|       |    */
 2276|      3|   png_ptr->info_rowbytes = info_ptr->rowbytes;
 2277|       |
 2278|       |#ifndef PNG_READ_EXPAND_SUPPORTED
 2279|       |   if (png_ptr != NULL)
 2280|       |      return;
 2281|       |#endif
 2282|      3|}
OSS_FUZZ_png_do_read_transformations:
 4881|     21|{
 4882|     21|   png_debug(1, "in png_do_read_transformations");
  ------------------
  |  |  145|     21|#  define png_debug(l, m) ((void)0)
  ------------------
 4883|       |
 4884|     21|   if (png_ptr->row_buf == NULL)
  ------------------
  |  Branch (4884:8): [True: 0, False: 21]
  ------------------
 4885|      0|   {
 4886|       |      /* Prior to 1.5.4 this output row/pass where the NULL pointer is, but this
 4887|       |       * error is incredibly rare and incredibly easy to debug without this
 4888|       |       * information.
 4889|       |       */
 4890|      0|      png_error(png_ptr, "NULL row buffer");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4891|      0|   }
 4892|       |
 4893|       |   /* The following is debugging; prior to 1.5.4 the code was never compiled in;
 4894|       |    * in 1.5.4 PNG_FLAG_DETECT_UNINITIALIZED was added and the macro
 4895|       |    * PNG_WARN_UNINITIALIZED_ROW removed.  In 1.6 the new flag is set only for
 4896|       |    * all transformations, however in practice the ROW_INIT always gets done on
 4897|       |    * demand, if necessary.
 4898|       |    */
 4899|     21|   if ((png_ptr->flags & PNG_FLAG_DETECT_UNINITIALIZED) != 0 &&
  ------------------
  |  |  709|     21|#define PNG_FLAG_DETECT_UNINITIALIZED     0x4000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (4899:8): [True: 21, False: 0]
  ------------------
 4900|     21|       (png_ptr->flags & PNG_FLAG_ROW_INIT) == 0)
  ------------------
  |  |  701|     21|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
  |  Branch (4900:8): [True: 0, False: 21]
  ------------------
 4901|      0|   {
 4902|       |      /* Application has failed to call either png_read_start_image() or
 4903|       |       * png_read_update_info() after setting transforms that expand pixels.
 4904|       |       * This check added to libpng-1.2.19 (but not enabled until 1.5.4).
 4905|       |       */
 4906|      0|      png_error(png_ptr, "Uninitialized row");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4907|      0|   }
 4908|       |
 4909|     21|#ifdef PNG_READ_EXPAND_SUPPORTED
 4910|     21|   if ((png_ptr->transformations & PNG_EXPAND) != 0)
  ------------------
  |  |  670|     21|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (4910:8): [True: 21, False: 0]
  ------------------
 4911|     21|   {
 4912|     21|      if (row_info->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  667|     21|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|     21|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|     21|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (4912:11): [True: 0, False: 21]
  ------------------
 4913|      0|      {
 4914|       |#ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE
 4915|       |         if ((png_ptr->num_trans > 0) && (png_ptr->bit_depth == 8))
 4916|       |         {
 4917|       |            if (png_ptr->riffled_palette == NULL)
 4918|       |            {
 4919|       |               /* Initialize the accelerated palette expansion. */
 4920|       |               png_ptr->riffled_palette =
 4921|       |                   (png_bytep)png_malloc(png_ptr, 256 * 4);
 4922|       |               png_riffle_palette_neon(png_ptr);
 4923|       |            }
 4924|       |         }
 4925|       |#endif
 4926|      0|         png_do_expand_palette(png_ptr, row_info, png_ptr->row_buf + 1,
 4927|      0|             png_ptr->palette, png_ptr->trans_alpha, png_ptr->num_trans);
 4928|      0|      }
 4929|       |
 4930|     21|      else
 4931|     21|      {
 4932|     21|         if (png_ptr->num_trans != 0 &&
  ------------------
  |  Branch (4932:14): [True: 0, False: 21]
  ------------------
 4933|      0|             (png_ptr->transformations & PNG_EXPAND_tRNS) != 0)
  ------------------
  |  |  684|      0|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  |  Branch (4933:14): [True: 0, False: 0]
  ------------------
 4934|      0|            png_do_expand(row_info, png_ptr->row_buf + 1,
 4935|      0|                &(png_ptr->trans_color));
 4936|       |
 4937|     21|         else
 4938|     21|            png_do_expand(row_info, png_ptr->row_buf + 1, NULL);
 4939|     21|      }
 4940|     21|   }
 4941|     21|#endif
 4942|       |
 4943|     21|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
 4944|     21|   if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 &&
  ------------------
  |  |  676|     21|#define PNG_STRIP_ALPHA        0x40000U
  ------------------
  |  Branch (4944:8): [True: 0, False: 21]
  ------------------
 4945|      0|       (png_ptr->transformations & PNG_COMPOSE) == 0 &&
  ------------------
  |  |  665|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (4945:8): [True: 0, False: 0]
  ------------------
 4946|      0|       (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA ||
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4946:9): [True: 0, False: 0]
  ------------------
 4947|      0|       row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA))
  ------------------
  |  |  670|      0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4947:8): [True: 0, False: 0]
  ------------------
 4948|      0|      png_do_strip_channel(row_info, png_ptr->row_buf + 1,
  ------------------
  |  |   44|      0|#define png_do_strip_channel OSS_FUZZ_png_do_strip_channel
  ------------------
 4949|      0|          0 /* at_start == false, because SWAP_ALPHA happens later */);
 4950|     21|#endif
 4951|       |
 4952|     21|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 4953|     21|   if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0)
  ------------------
  |  |  681|     21|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (4953:8): [True: 0, False: 21]
  ------------------
 4954|      0|   {
 4955|      0|      int rgb_error =
 4956|      0|          png_do_rgb_to_gray(png_ptr, row_info,
 4957|      0|              png_ptr->row_buf + 1);
 4958|       |
 4959|      0|      if (rgb_error != 0)
  ------------------
  |  Branch (4959:11): [True: 0, False: 0]
  ------------------
 4960|      0|      {
 4961|      0|         png_ptr->rgb_to_gray_status=1;
 4962|      0|         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
  ------------------
  |  |  681|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (4962:14): [True: 0, False: 0]
  ------------------
 4963|      0|             PNG_RGB_TO_GRAY_WARN)
  ------------------
  |  |  680|      0|#define PNG_RGB_TO_GRAY_WARN  0x400000U
  ------------------
 4964|      0|            png_warning(png_ptr, "png_do_rgb_to_gray found nongray pixel");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 4965|       |
 4966|      0|         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
  ------------------
  |  |  681|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (4966:14): [True: 0, False: 0]
  ------------------
 4967|      0|             PNG_RGB_TO_GRAY_ERR)
  ------------------
  |  |  679|      0|#define PNG_RGB_TO_GRAY_ERR   0x200000U
  ------------------
 4968|      0|            png_error(png_ptr, "png_do_rgb_to_gray found nongray pixel");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4969|      0|      }
 4970|      0|   }
 4971|     21|#endif
 4972|       |
 4973|       |/* From Andreas Dilger e-mail to png-implement, 26 March 1998:
 4974|       | *
 4975|       | *   In most cases, the "simple transparency" should be done prior to doing
 4976|       | *   gray-to-RGB, or you will have to test 3x as many bytes to check if a
 4977|       | *   pixel is transparent.  You would also need to make sure that the
 4978|       | *   transparency information is upgraded to RGB.
 4979|       | *
 4980|       | *   To summarize, the current flow is:
 4981|       | *   - Gray + simple transparency -> compare 1 or 2 gray bytes and composite
 4982|       | *                                   with background "in place" if transparent,
 4983|       | *                                   convert to RGB if necessary
 4984|       | *   - Gray + alpha -> composite with gray background and remove alpha bytes,
 4985|       | *                                   convert to RGB if necessary
 4986|       | *
 4987|       | *   To support RGB backgrounds for gray images we need:
 4988|       | *   - Gray + simple transparency -> convert to RGB + simple transparency,
 4989|       | *                                   compare 3 or 6 bytes and composite with
 4990|       | *                                   background "in place" if transparent
 4991|       | *                                   (3x compare/pixel compared to doing
 4992|       | *                                   composite with gray bkgrnd)
 4993|       | *   - Gray + alpha -> convert to RGB + alpha, composite with background and
 4994|       | *                                   remove alpha bytes (3x float
 4995|       | *                                   operations/pixel compared with composite
 4996|       | *                                   on gray background)
 4997|       | *
 4998|       | *  Greg's change will do this.  The reason it wasn't done before is for
 4999|       | *  performance, as this increases the per-pixel operations.  If we would check
 5000|       | *  in advance if the background was gray or RGB, and position the gray-to-RGB
 5001|       | *  transform appropriately, then it would save a lot of work/time.
 5002|       | */
 5003|       |
 5004|     21|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 5005|       |   /* If gray -> RGB, do so now only if background is non-gray; else do later
 5006|       |    * for performance reasons
 5007|       |    */
 5008|     21|   if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0 &&
  ------------------
  |  |  672|     21|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (5008:8): [True: 21, False: 0]
  ------------------
 5009|     21|       (png_ptr->mode & PNG_BACKGROUND_IS_GRAY) == 0)
  ------------------
  |  |  651|     21|#define PNG_BACKGROUND_IS_GRAY     0x800U
  ------------------
  |  Branch (5009:8): [True: 21, False: 0]
  ------------------
 5010|     21|      png_do_gray_to_rgb(row_info, png_ptr->row_buf + 1);
 5011|     21|#endif
 5012|       |
 5013|     21|#if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\
 5014|     21|   defined(PNG_READ_ALPHA_MODE_SUPPORTED)
 5015|     21|   if ((png_ptr->transformations & PNG_COMPOSE) != 0)
  ------------------
  |  |  665|     21|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (5015:8): [True: 0, False: 21]
  ------------------
 5016|      0|      png_do_compose(row_info, png_ptr->row_buf + 1, png_ptr);
 5017|     21|#endif
 5018|       |
 5019|     21|#ifdef PNG_READ_GAMMA_SUPPORTED
 5020|     21|   if ((png_ptr->transformations & PNG_GAMMA) != 0 &&
  ------------------
  |  |  671|     21|#define PNG_GAMMA               0x2000U
  ------------------
  |  Branch (5020:8): [True: 0, False: 21]
  ------------------
 5021|      0|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
 5022|       |      /* Because RGB_TO_GRAY does the gamma transform. */
 5023|      0|      (png_ptr->transformations & PNG_RGB_TO_GRAY) == 0 &&
  ------------------
  |  |  681|      0|#define PNG_RGB_TO_GRAY       0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */
  ------------------
  |  Branch (5023:7): [True: 0, False: 0]
  ------------------
 5024|      0|#endif
 5025|      0|#if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\
 5026|      0|   defined(PNG_READ_ALPHA_MODE_SUPPORTED)
 5027|       |      /* Because PNG_COMPOSE does the gamma transform if there is something to
 5028|       |       * do (if there is an alpha channel or transparency.)
 5029|       |       */
 5030|      0|       !((png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  665|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (5030:10): [True: 0, False: 0]
  ------------------
 5031|      0|       ((png_ptr->num_trans != 0) ||
  ------------------
  |  Branch (5031:9): [True: 0, False: 0]
  ------------------
 5032|      0|       (png_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)) &&
  ------------------
  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
  |  Branch (5032:8): [True: 0, False: 0]
  ------------------
 5033|      0|#endif
 5034|       |      /* Because png_init_read_transformations transforms the palette, unless
 5035|       |       * RGB_TO_GRAY will do the transform.
 5036|       |       */
 5037|      0|       (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE))
  ------------------
  |  |  667|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (5037:8): [True: 0, False: 0]
  ------------------
 5038|      0|      png_do_gamma(row_info, png_ptr->row_buf + 1, png_ptr);
 5039|     21|#endif
 5040|       |
 5041|     21|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED
 5042|     21|   if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 &&
  ------------------
  |  |  676|     21|#define PNG_STRIP_ALPHA        0x40000U
  ------------------
  |  Branch (5042:8): [True: 0, False: 21]
  ------------------
 5043|      0|       (png_ptr->transformations & PNG_COMPOSE) != 0 &&
  ------------------
  |  |  665|      0|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
  |  Branch (5043:8): [True: 0, False: 0]
  ------------------
 5044|      0|       (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA ||
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (5044:9): [True: 0, False: 0]
  ------------------
 5045|      0|       row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA))
  ------------------
  |  |  670|      0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (5045:8): [True: 0, False: 0]
  ------------------
 5046|      0|      png_do_strip_channel(row_info, png_ptr->row_buf + 1,
  ------------------
  |  |   44|      0|#define png_do_strip_channel OSS_FUZZ_png_do_strip_channel
  ------------------
 5047|      0|          0 /* at_start == false, because SWAP_ALPHA happens later */);
 5048|     21|#endif
 5049|       |
 5050|     21|#ifdef PNG_READ_ALPHA_MODE_SUPPORTED
 5051|     21|   if ((png_ptr->transformations & PNG_ENCODE_ALPHA) != 0 &&
  ------------------
  |  |  682|     21|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (5051:8): [True: 0, False: 21]
  ------------------
 5052|      0|       (row_info->color_type & PNG_COLOR_MASK_ALPHA) != 0)
  ------------------
  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
  |  Branch (5052:8): [True: 0, False: 0]
  ------------------
 5053|      0|      png_do_encode_alpha(row_info, png_ptr->row_buf + 1, png_ptr);
 5054|     21|#endif
 5055|       |
 5056|     21|#ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED
 5057|     21|   if ((png_ptr->transformations & PNG_SCALE_16_TO_8) != 0)
  ------------------
  |  |  685|     21|#define PNG_SCALE_16_TO_8    0x4000000U /* Added to libpng-1.5.4 */
  ------------------
  |  Branch (5057:8): [True: 21, False: 0]
  ------------------
 5058|     21|      png_do_scale_16_to_8(row_info, png_ptr->row_buf + 1);
 5059|     21|#endif
 5060|       |
 5061|     21|#ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED
 5062|       |   /* There is no harm in doing both of these because only one has any effect,
 5063|       |    * by putting the 'scale' option first if the app asks for scale (either by
 5064|       |    * calling the API or in a TRANSFORM flag) this is what happens.
 5065|       |    */
 5066|     21|   if ((png_ptr->transformations & PNG_16_TO_8) != 0)
  ------------------
  |  |  668|     21|#define PNG_16_TO_8             0x0400U    /* Becomes 'chop' in 1.5.4 */
  ------------------
  |  Branch (5066:8): [True: 0, False: 21]
  ------------------
 5067|      0|      png_do_chop(row_info, png_ptr->row_buf + 1);
 5068|     21|#endif
 5069|       |
 5070|     21|#ifdef PNG_READ_QUANTIZE_SUPPORTED
 5071|     21|   if ((png_ptr->transformations & PNG_QUANTIZE) != 0)
  ------------------
  |  |  664|     21|#define PNG_QUANTIZE            0x0040U
  ------------------
  |  Branch (5071:8): [True: 0, False: 21]
  ------------------
 5072|      0|      png_do_quantize(row_info, png_ptr->row_buf + 1,
 5073|      0|          png_ptr->palette_lookup, png_ptr->quantize_index);
 5074|     21|#endif /* READ_QUANTIZE */
 5075|       |
 5076|     21|#ifdef PNG_READ_EXPAND_16_SUPPORTED
 5077|       |   /* Do the expansion now, after all the arithmetic has been done.  Notice
 5078|       |    * that previous transformations can handle the PNG_EXPAND_16 flag if this
 5079|       |    * is efficient (particularly true in the case of gamma correction, where
 5080|       |    * better accuracy results faster!)
 5081|       |    */
 5082|     21|   if ((png_ptr->transformations & PNG_EXPAND_16) != 0)
  ------------------
  |  |  667|     21|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
  |  Branch (5082:8): [True: 0, False: 21]
  ------------------
 5083|      0|      png_do_expand_16(row_info, png_ptr->row_buf + 1);
 5084|     21|#endif
 5085|       |
 5086|     21|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 5087|       |   /* NOTE: moved here in 1.5.4 (from much later in this list.) */
 5088|     21|   if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0 &&
  ------------------
  |  |  672|     21|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (5088:8): [True: 21, False: 0]
  ------------------
 5089|     21|       (png_ptr->mode & PNG_BACKGROUND_IS_GRAY) != 0)
  ------------------
  |  |  651|     21|#define PNG_BACKGROUND_IS_GRAY     0x800U
  ------------------
  |  Branch (5089:8): [True: 0, False: 21]
  ------------------
 5090|      0|      png_do_gray_to_rgb(row_info, png_ptr->row_buf + 1);
 5091|     21|#endif
 5092|       |
 5093|     21|#ifdef PNG_READ_INVERT_SUPPORTED
 5094|     21|   if ((png_ptr->transformations & PNG_INVERT_MONO) != 0)
  ------------------
  |  |  663|     21|#define PNG_INVERT_MONO         0x0020U
  ------------------
  |  Branch (5094:8): [True: 0, False: 21]
  ------------------
 5095|      0|      png_do_invert(row_info, png_ptr->row_buf + 1);
  ------------------
  |  |   47|      0|#define png_do_invert OSS_FUZZ_png_do_invert
  ------------------
 5096|     21|#endif
 5097|       |
 5098|     21|#ifdef PNG_READ_INVERT_ALPHA_SUPPORTED
 5099|     21|   if ((png_ptr->transformations & PNG_INVERT_ALPHA) != 0)
  ------------------
  |  |  677|     21|#define PNG_INVERT_ALPHA       0x80000U
  ------------------
  |  Branch (5099:8): [True: 0, False: 21]
  ------------------
 5100|      0|      png_do_read_invert_alpha(row_info, png_ptr->row_buf + 1);
 5101|     21|#endif
 5102|       |
 5103|     21|#ifdef PNG_READ_SHIFT_SUPPORTED
 5104|     21|   if ((png_ptr->transformations & PNG_SHIFT) != 0)
  ------------------
  |  |  661|     21|#define PNG_SHIFT               0x0008U
  ------------------
  |  Branch (5104:8): [True: 0, False: 21]
  ------------------
 5105|      0|      png_do_unshift(row_info, png_ptr->row_buf + 1,
 5106|      0|          &(png_ptr->shift));
 5107|     21|#endif
 5108|       |
 5109|     21|#ifdef PNG_READ_PACK_SUPPORTED
 5110|     21|   if ((png_ptr->transformations & PNG_PACK) != 0)
  ------------------
  |  |  660|     21|#define PNG_PACK                0x0004U
  ------------------
  |  Branch (5110:8): [True: 21, False: 0]
  ------------------
 5111|     21|      png_do_unpack(row_info, png_ptr->row_buf + 1);
 5112|     21|#endif
 5113|       |
 5114|     21|#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
 5115|       |   /* Added at libpng-1.5.10 */
 5116|     21|   if (row_info->color_type == PNG_COLOR_TYPE_PALETTE &&
  ------------------
  |  |  667|     42|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|     21|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|     21|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (5116:8): [True: 0, False: 21]
  ------------------
 5117|      0|       png_ptr->num_palette_max >= 0)
  ------------------
  |  Branch (5117:8): [True: 0, False: 0]
  ------------------
 5118|      0|      png_do_check_palette_indexes(png_ptr, row_info);
  ------------------
  |  |   73|      0|#define png_do_check_palette_indexes OSS_FUZZ_png_do_check_palette_indexes
  ------------------
 5119|     21|#endif
 5120|       |
 5121|     21|#ifdef PNG_READ_BGR_SUPPORTED
 5122|     21|   if ((png_ptr->transformations & PNG_BGR) != 0)
  ------------------
  |  |  658|     21|#define PNG_BGR                 0x0001U
  ------------------
  |  Branch (5122:8): [True: 0, False: 21]
  ------------------
 5123|      0|      png_do_bgr(row_info, png_ptr->row_buf + 1);
  ------------------
  |  |   48|      0|#define png_do_bgr OSS_FUZZ_png_do_bgr
  ------------------
 5124|     21|#endif
 5125|       |
 5126|     21|#ifdef PNG_READ_PACKSWAP_SUPPORTED
 5127|     21|   if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  674|     21|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (5127:8): [True: 0, False: 21]
  ------------------
 5128|      0|      png_do_packswap(row_info, png_ptr->row_buf + 1);
  ------------------
  |  |   46|      0|#define png_do_packswap OSS_FUZZ_png_do_packswap
  ------------------
 5129|     21|#endif
 5130|       |
 5131|     21|#ifdef PNG_READ_FILLER_SUPPORTED
 5132|     21|   if ((png_ptr->transformations & PNG_FILLER) != 0)
  ------------------
  |  |  673|     21|#define PNG_FILLER              0x8000U
  ------------------
  |  Branch (5132:8): [True: 0, False: 21]
  ------------------
 5133|      0|      png_do_read_filler(row_info, png_ptr->row_buf + 1,
 5134|      0|          (png_uint_32)png_ptr->filler, png_ptr->flags);
 5135|     21|#endif
 5136|       |
 5137|     21|#ifdef PNG_READ_SWAP_ALPHA_SUPPORTED
 5138|     21|   if ((png_ptr->transformations & PNG_SWAP_ALPHA) != 0)
  ------------------
  |  |  675|     21|#define PNG_SWAP_ALPHA         0x20000U
  ------------------
  |  Branch (5138:8): [True: 0, False: 21]
  ------------------
 5139|      0|      png_do_read_swap_alpha(row_info, png_ptr->row_buf + 1);
 5140|     21|#endif
 5141|       |
 5142|     21|#ifdef PNG_READ_16BIT_SUPPORTED
 5143|     21|#ifdef PNG_READ_SWAP_SUPPORTED
 5144|     21|   if ((png_ptr->transformations & PNG_SWAP_BYTES) != 0)
  ------------------
  |  |  662|     21|#define PNG_SWAP_BYTES          0x0010U
  ------------------
  |  Branch (5144:8): [True: 0, False: 21]
  ------------------
 5145|      0|      png_do_swap(row_info, png_ptr->row_buf + 1);
  ------------------
  |  |   45|      0|#define png_do_swap OSS_FUZZ_png_do_swap
  ------------------
 5146|     21|#endif
 5147|     21|#endif
 5148|       |
 5149|     21|#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED
 5150|     21|   if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
  ------------------
  |  |  678|     21|#define PNG_USER_TRANSFORM    0x100000U
  ------------------
  |  Branch (5150:8): [True: 0, False: 21]
  ------------------
 5151|      0|   {
 5152|      0|      if (png_ptr->read_user_transform_fn != NULL)
  ------------------
  |  Branch (5152:11): [True: 0, False: 0]
  ------------------
 5153|      0|         (*(png_ptr->read_user_transform_fn)) /* User read transform function */
 5154|      0|             (png_ptr,     /* png_ptr */
 5155|      0|             row_info,     /* row_info: */
 5156|       |                /*  png_uint_32 width;       width of row */
 5157|       |                /*  size_t rowbytes;         number of bytes in row */
 5158|       |                /*  png_byte color_type;     color type of pixels */
 5159|       |                /*  png_byte bit_depth;      bit depth of samples */
 5160|       |                /*  png_byte channels;       number of channels (1-4) */
 5161|       |                /*  png_byte pixel_depth;    bits per pixel (depth*channels) */
 5162|      0|             png_ptr->row_buf + 1);    /* start of pixel data for row */
 5163|      0|#ifdef PNG_USER_TRANSFORM_PTR_SUPPORTED
 5164|      0|      if (png_ptr->user_transform_depth != 0)
  ------------------
  |  Branch (5164:11): [True: 0, False: 0]
  ------------------
 5165|      0|         row_info->bit_depth = png_ptr->user_transform_depth;
 5166|       |
 5167|      0|      if (png_ptr->user_transform_channels != 0)
  ------------------
  |  Branch (5167:11): [True: 0, False: 0]
  ------------------
 5168|      0|         row_info->channels = png_ptr->user_transform_channels;
 5169|      0|#endif
 5170|      0|      row_info->pixel_depth = (png_byte)(row_info->bit_depth *
 5171|      0|          row_info->channels);
 5172|       |
 5173|      0|      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_info->width);
  ------------------
  |  |  755|      0|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 0, False: 0]
  |  |  ------------------
  |  |  756|      0|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|      0|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 5174|      0|   }
 5175|     21|#endif
 5176|     21|}
pngrtran.c:png_rtran_ok:
  116|     25|{
  117|     25|   if (png_ptr != NULL)
  ------------------
  |  Branch (117:8): [True: 25, False: 0]
  ------------------
  118|     25|   {
  119|     25|      if ((png_ptr->flags & PNG_FLAG_ROW_INIT) != 0)
  ------------------
  |  |  701|     25|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
  |  Branch (119:11): [True: 0, False: 25]
  ------------------
  120|      0|         png_app_error(png_ptr,
  ------------------
  |  |   82|      0|#define png_app_error OSS_FUZZ_png_app_error
  ------------------
  121|      0|             "invalid after png_start_read_image or png_read_update_info");
  122|       |
  123|     25|      else if (need_IHDR && (png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  642|      0|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (123:16): [True: 0, False: 25]
  |  Branch (123:29): [True: 0, False: 0]
  ------------------
  124|      0|         png_app_error(png_ptr, "invalid before the PNG header has been read");
  ------------------
  |  |   82|      0|#define png_app_error OSS_FUZZ_png_app_error
  ------------------
  125|       |
  126|     25|      else
  127|     25|      {
  128|       |         /* Turn on failure to initialize correctly for all transforms. */
  129|     25|         png_ptr->flags |= PNG_FLAG_DETECT_UNINITIALIZED;
  ------------------
  |  |  709|     25|#define PNG_FLAG_DETECT_UNINITIALIZED     0x4000U /* Added to libpng-1.5.4 */
  ------------------
  130|       |
  131|     25|         return 1; /* Ok */
  132|     25|      }
  133|     25|   }
  134|       |
  135|      0|   return 0; /* no png_error possible! */
  136|     25|}
pngrtran.c:png_init_gamma_values:
 1388|      5|{
 1389|       |   /* The following temporary indicates if overall gamma correction is
 1390|       |    * required.
 1391|       |    */
 1392|      5|   int gamma_correction = 0;
 1393|      5|   png_fixed_point file_gamma, screen_gamma;
 1394|       |
 1395|       |   /* Resolve the file_gamma.  See above: if png_ptr::screen_gamma is set
 1396|       |    * file_gamma will always be set here:
 1397|       |    */
 1398|      5|   file_gamma = png_resolve_file_gamma(png_ptr);
  ------------------
  |  |   92|      5|#define png_resolve_file_gamma OSS_FUZZ_png_resolve_file_gamma
  ------------------
 1399|      5|   screen_gamma = png_ptr->screen_gamma;
 1400|       |
 1401|      5|   if (file_gamma > 0) /* file has been set */
  ------------------
  |  Branch (1401:8): [True: 0, False: 5]
  ------------------
 1402|      0|   {
 1403|      0|      if (screen_gamma > 0) /* screen set too */
  ------------------
  |  Branch (1403:11): [True: 0, False: 0]
  ------------------
 1404|      0|         gamma_correction = png_gamma_threshold(file_gamma, screen_gamma);
 1405|       |
 1406|      0|      else
 1407|       |         /* Assume the output matches the input; a long time default behavior
 1408|       |          * of libpng, although the standard has nothing to say about this.
 1409|       |          */
 1410|      0|         screen_gamma = png_reciprocal(file_gamma);
  ------------------
  |  |   89|      0|#define png_reciprocal OSS_FUZZ_png_reciprocal
  ------------------
 1411|      0|   }
 1412|       |
 1413|      5|   else /* both unset, prevent corrections: */
 1414|      5|      file_gamma = screen_gamma = PNG_FP_1;
  ------------------
  |  |  654|      5|#define PNG_FP_1    100000
  ------------------
 1415|       |
 1416|      5|   png_ptr->file_gamma = file_gamma;
 1417|      5|   png_ptr->screen_gamma = screen_gamma;
 1418|      5|   return gamma_correction;
 1419|       |
 1420|      5|}
pngrtran.c:png_init_rgb_transformations:
 1266|      5|{
 1267|       |   /* Added to libpng-1.5.4: check the color type to determine whether there
 1268|       |    * is any alpha or transparency in the image and simply cancel the
 1269|       |    * background and alpha mode stuff if there isn't.
 1270|       |    */
 1271|      5|   int input_has_alpha = (png_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0;
  ------------------
  |  |  663|      5|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
 1272|      5|   int input_has_transparency = png_ptr->num_trans > 0;
 1273|       |
 1274|       |   /* If no alpha we can optimize. */
 1275|      5|   if (input_has_alpha == 0)
  ------------------
  |  Branch (1275:8): [True: 5, False: 0]
  ------------------
 1276|      5|   {
 1277|       |      /* Any alpha means background and associative alpha processing is
 1278|       |       * required, however if the alpha is 0 or 1 throughout OPTIMIZE_ALPHA
 1279|       |       * and ENCODE_ALPHA are irrelevant.
 1280|       |       */
 1281|      5|#     ifdef PNG_READ_ALPHA_MODE_SUPPORTED
 1282|      5|         png_ptr->transformations &= ~PNG_ENCODE_ALPHA;
  ------------------
  |  |  682|      5|#define PNG_ENCODE_ALPHA      0x800000U /* Added to libpng-1.5.4 */
  ------------------
 1283|      5|         png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
  ------------------
  |  |  708|      5|#define PNG_FLAG_OPTIMIZE_ALPHA           0x2000U /* Added to libpng-1.5.4 */
  ------------------
 1284|      5|#     endif
 1285|       |
 1286|      5|      if (input_has_transparency == 0)
  ------------------
  |  Branch (1286:11): [True: 5, False: 0]
  ------------------
 1287|      5|         png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND);
  ------------------
  |  |  665|      5|#define PNG_COMPOSE             0x0080U    /* Was PNG_BACKGROUND */
  ------------------
                       png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND);
  ------------------
  |  |  666|      5|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
 1288|      5|   }
 1289|       |
 1290|      5|#if defined(PNG_READ_EXPAND_SUPPORTED) && defined(PNG_READ_BACKGROUND_SUPPORTED)
 1291|       |   /* png_set_background handling - deals with the complexity of whether the
 1292|       |    * background color is in the file format or the screen format in the case
 1293|       |    * where an 'expand' will happen.
 1294|       |    */
 1295|       |
 1296|       |   /* The following code cannot be entered in the alpha pre-multiplication case
 1297|       |    * because PNG_BACKGROUND_EXPAND is cancelled below.
 1298|       |    */
 1299|      5|   if ((png_ptr->transformations & PNG_BACKGROUND_EXPAND) != 0 &&
  ------------------
  |  |  666|      5|#define PNG_BACKGROUND_EXPAND   0x0100U
  ------------------
  |  Branch (1299:8): [True: 0, False: 5]
  ------------------
 1300|      0|       (png_ptr->transformations & PNG_EXPAND) != 0 &&
  ------------------
  |  |  670|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (1300:8): [True: 0, False: 0]
  ------------------
 1301|      0|       (png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
  ------------------
  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (1301:8): [True: 0, False: 0]
  ------------------
 1302|       |       /* i.e., GRAY or GRAY_ALPHA */
 1303|      0|   {
 1304|      0|      {
 1305|       |         /* Expand background and tRNS chunks */
 1306|      0|         int gray = png_ptr->background.gray;
 1307|      0|         int trans_gray = png_ptr->trans_color.gray;
 1308|       |
 1309|      0|         switch (png_ptr->bit_depth)
 1310|      0|         {
 1311|      0|            case 1:
  ------------------
  |  Branch (1311:13): [True: 0, False: 0]
  ------------------
 1312|      0|               gray *= 0xff;
 1313|      0|               trans_gray *= 0xff;
 1314|      0|               break;
 1315|       |
 1316|      0|            case 2:
  ------------------
  |  Branch (1316:13): [True: 0, False: 0]
  ------------------
 1317|      0|               gray *= 0x55;
 1318|      0|               trans_gray *= 0x55;
 1319|      0|               break;
 1320|       |
 1321|      0|            case 4:
  ------------------
  |  Branch (1321:13): [True: 0, False: 0]
  ------------------
 1322|      0|               gray *= 0x11;
 1323|      0|               trans_gray *= 0x11;
 1324|      0|               break;
 1325|       |
 1326|      0|            default:
  ------------------
  |  Branch (1326:13): [True: 0, False: 0]
  ------------------
 1327|       |
 1328|      0|            case 8:
  ------------------
  |  Branch (1328:13): [True: 0, False: 0]
  ------------------
 1329|       |               /* FALLTHROUGH */ /*  (Already 8 bits) */
 1330|       |
 1331|      0|            case 16:
  ------------------
  |  Branch (1331:13): [True: 0, False: 0]
  ------------------
 1332|       |               /* Already a full 16 bits */
 1333|      0|               break;
 1334|      0|         }
 1335|       |
 1336|      0|         png_ptr->background.red = png_ptr->background.green =
 1337|      0|            png_ptr->background.blue = (png_uint_16)gray;
 1338|       |
 1339|      0|         if ((png_ptr->transformations & PNG_EXPAND_tRNS) == 0)
  ------------------
  |  |  684|      0|#define PNG_EXPAND_tRNS      0x2000000U /* Added to libpng-1.2.9 */
  ------------------
  |  Branch (1339:14): [True: 0, False: 0]
  ------------------
 1340|      0|         {
 1341|      0|            png_ptr->trans_color.red = png_ptr->trans_color.green =
 1342|      0|               png_ptr->trans_color.blue = (png_uint_16)trans_gray;
 1343|      0|         }
 1344|      0|      }
 1345|      0|   } /* background expand and (therefore) no alpha association. */
 1346|      5|#endif /* READ_EXPAND && READ_BACKGROUND */
 1347|      5|}
pngrtran.c:png_do_expand:
 4525|     21|{
 4526|     21|   int shift, value;
 4527|     21|   png_bytep sp, dp;
 4528|     21|   png_uint_32 i;
 4529|     21|   png_uint_32 row_width=row_info->width;
 4530|       |
 4531|     21|   png_debug(1, "in png_do_expand");
  ------------------
  |  |  145|     21|#  define png_debug(l, m) ((void)0)
  ------------------
 4532|       |
 4533|     21|   if (row_info->color_type == PNG_COLOR_TYPE_GRAY)
  ------------------
  |  |  666|     21|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (4533:8): [True: 21, False: 0]
  ------------------
 4534|     21|   {
 4535|     21|      unsigned int gray = trans_color != NULL ? trans_color->gray : 0;
  ------------------
  |  Branch (4535:27): [True: 0, False: 21]
  ------------------
 4536|       |
 4537|     21|      if (row_info->bit_depth < 8)
  ------------------
  |  Branch (4537:11): [True: 21, False: 0]
  ------------------
 4538|     21|      {
 4539|     21|         switch (row_info->bit_depth)
 4540|     21|         {
 4541|     21|            case 1:
  ------------------
  |  Branch (4541:13): [True: 21, False: 0]
  ------------------
 4542|     21|            {
 4543|     21|               gray = (gray & 0x01) * 0xff;
 4544|     21|               sp = row + (size_t)((row_width - 1) >> 3);
 4545|     21|               dp = row + (size_t)row_width - 1;
 4546|     21|               shift = 7 - (int)((row_width + 7) & 0x07);
 4547|    228|               for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4547:28): [True: 207, False: 21]
  ------------------
 4548|    207|               {
 4549|    207|                  if ((*sp >> shift) & 0x01)
  ------------------
  |  Branch (4549:23): [True: 18, False: 189]
  ------------------
 4550|     18|                     *dp = 0xff;
 4551|       |
 4552|    189|                  else
 4553|    189|                     *dp = 0;
 4554|       |
 4555|    207|                  if (shift == 7)
  ------------------
  |  Branch (4555:23): [True: 36, False: 171]
  ------------------
 4556|     36|                  {
 4557|     36|                     shift = 0;
 4558|     36|                     sp--;
 4559|     36|                  }
 4560|       |
 4561|    171|                  else
 4562|    171|                     shift++;
 4563|       |
 4564|    207|                  dp--;
 4565|    207|               }
 4566|     21|               break;
 4567|      0|            }
 4568|       |
 4569|      0|            case 2:
  ------------------
  |  Branch (4569:13): [True: 0, False: 21]
  ------------------
 4570|      0|            {
 4571|      0|               gray = (gray & 0x03) * 0x55;
 4572|      0|               sp = row + (size_t)((row_width - 1) >> 2);
 4573|      0|               dp = row + (size_t)row_width - 1;
 4574|      0|               shift = (int)((3 - ((row_width + 3) & 0x03)) << 1);
 4575|      0|               for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4575:28): [True: 0, False: 0]
  ------------------
 4576|      0|               {
 4577|      0|                  value = (*sp >> shift) & 0x03;
 4578|      0|                  *dp = (png_byte)(value | (value << 2) | (value << 4) |
 4579|      0|                     (value << 6));
 4580|      0|                  if (shift == 6)
  ------------------
  |  Branch (4580:23): [True: 0, False: 0]
  ------------------
 4581|      0|                  {
 4582|      0|                     shift = 0;
 4583|      0|                     sp--;
 4584|      0|                  }
 4585|       |
 4586|      0|                  else
 4587|      0|                     shift += 2;
 4588|       |
 4589|      0|                  dp--;
 4590|      0|               }
 4591|      0|               break;
 4592|      0|            }
 4593|       |
 4594|      0|            case 4:
  ------------------
  |  Branch (4594:13): [True: 0, False: 21]
  ------------------
 4595|      0|            {
 4596|      0|               gray = (gray & 0x0f) * 0x11;
 4597|      0|               sp = row + (size_t)((row_width - 1) >> 1);
 4598|      0|               dp = row + (size_t)row_width - 1;
 4599|      0|               shift = (int)((1 - ((row_width + 1) & 0x01)) << 2);
 4600|      0|               for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4600:28): [True: 0, False: 0]
  ------------------
 4601|      0|               {
 4602|      0|                  value = (*sp >> shift) & 0x0f;
 4603|      0|                  *dp = (png_byte)(value | (value << 4));
 4604|      0|                  if (shift == 4)
  ------------------
  |  Branch (4604:23): [True: 0, False: 0]
  ------------------
 4605|      0|                  {
 4606|      0|                     shift = 0;
 4607|      0|                     sp--;
 4608|      0|                  }
 4609|       |
 4610|      0|                  else
 4611|      0|                     shift = 4;
 4612|       |
 4613|      0|                  dp--;
 4614|      0|               }
 4615|      0|               break;
 4616|      0|            }
 4617|       |
 4618|      0|            default:
  ------------------
  |  Branch (4618:13): [True: 0, False: 21]
  ------------------
 4619|      0|               break;
 4620|     21|         }
 4621|       |
 4622|     21|         row_info->bit_depth = 8;
 4623|     21|         row_info->pixel_depth = 8;
 4624|     21|         row_info->rowbytes = row_width;
 4625|     21|      }
 4626|       |
 4627|     21|      if (trans_color != NULL)
  ------------------
  |  Branch (4627:11): [True: 0, False: 21]
  ------------------
 4628|      0|      {
 4629|      0|         if (row_info->bit_depth == 8)
  ------------------
  |  Branch (4629:14): [True: 0, False: 0]
  ------------------
 4630|      0|         {
 4631|      0|            gray = gray & 0xff;
 4632|      0|            sp = row + (size_t)row_width - 1;
 4633|      0|            dp = row + ((size_t)row_width << 1) - 1;
 4634|       |
 4635|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4635:25): [True: 0, False: 0]
  ------------------
 4636|      0|            {
 4637|      0|               if ((*sp & 0xffU) == gray)
  ------------------
  |  Branch (4637:20): [True: 0, False: 0]
  ------------------
 4638|      0|                  *dp-- = 0;
 4639|       |
 4640|      0|               else
 4641|      0|                  *dp-- = 0xff;
 4642|       |
 4643|      0|               *dp-- = *sp--;
 4644|      0|            }
 4645|      0|         }
 4646|       |
 4647|      0|         else if (row_info->bit_depth == 16)
  ------------------
  |  Branch (4647:19): [True: 0, False: 0]
  ------------------
 4648|      0|         {
 4649|      0|            unsigned int gray_high = (gray >> 8) & 0xff;
 4650|      0|            unsigned int gray_low = gray & 0xff;
 4651|      0|            sp = row + row_info->rowbytes - 1;
 4652|      0|            dp = row + (row_info->rowbytes << 1) - 1;
 4653|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4653:25): [True: 0, False: 0]
  ------------------
 4654|      0|            {
 4655|      0|               if ((*(sp - 1) & 0xffU) == gray_high &&
  ------------------
  |  Branch (4655:20): [True: 0, False: 0]
  ------------------
 4656|      0|                   (*(sp) & 0xffU) == gray_low)
  ------------------
  |  Branch (4656:20): [True: 0, False: 0]
  ------------------
 4657|      0|               {
 4658|      0|                  *dp-- = 0;
 4659|      0|                  *dp-- = 0;
 4660|      0|               }
 4661|       |
 4662|      0|               else
 4663|      0|               {
 4664|      0|                  *dp-- = 0xff;
 4665|      0|                  *dp-- = 0xff;
 4666|      0|               }
 4667|       |
 4668|      0|               *dp-- = *sp--;
 4669|      0|               *dp-- = *sp--;
 4670|      0|            }
 4671|      0|         }
 4672|       |
 4673|      0|         row_info->color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
  ------------------
  |  |  670|      0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
 4674|      0|         row_info->channels = 2;
 4675|      0|         row_info->pixel_depth = (png_byte)(row_info->bit_depth << 1);
 4676|      0|         row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
  ------------------
  |  |  755|      0|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 0, False: 0]
  |  |  ------------------
  |  |  756|      0|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|      0|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 4677|      0|             row_width);
 4678|      0|      }
 4679|     21|   }
 4680|      0|   else if (row_info->color_type == PNG_COLOR_TYPE_RGB &&
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (4680:13): [True: 0, False: 0]
  ------------------
 4681|      0|       trans_color != NULL)
  ------------------
  |  Branch (4681:8): [True: 0, False: 0]
  ------------------
 4682|      0|   {
 4683|      0|      if (row_info->bit_depth == 8)
  ------------------
  |  Branch (4683:11): [True: 0, False: 0]
  ------------------
 4684|      0|      {
 4685|      0|         png_byte red = (png_byte)(trans_color->red & 0xff);
 4686|      0|         png_byte green = (png_byte)(trans_color->green & 0xff);
 4687|      0|         png_byte blue = (png_byte)(trans_color->blue & 0xff);
 4688|      0|         sp = row + (size_t)row_info->rowbytes - 1;
 4689|      0|         dp = row + ((size_t)row_width << 2) - 1;
 4690|      0|         for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4690:22): [True: 0, False: 0]
  ------------------
 4691|      0|         {
 4692|      0|            if (*(sp - 2) == red && *(sp - 1) == green && *(sp) == blue)
  ------------------
  |  Branch (4692:17): [True: 0, False: 0]
  |  Branch (4692:37): [True: 0, False: 0]
  |  Branch (4692:59): [True: 0, False: 0]
  ------------------
 4693|      0|               *dp-- = 0;
 4694|       |
 4695|      0|            else
 4696|      0|               *dp-- = 0xff;
 4697|       |
 4698|      0|            *dp-- = *sp--;
 4699|      0|            *dp-- = *sp--;
 4700|      0|            *dp-- = *sp--;
 4701|      0|         }
 4702|      0|      }
 4703|      0|      else if (row_info->bit_depth == 16)
  ------------------
  |  Branch (4703:16): [True: 0, False: 0]
  ------------------
 4704|      0|      {
 4705|      0|         png_byte red_high = (png_byte)((trans_color->red >> 8) & 0xff);
 4706|      0|         png_byte green_high = (png_byte)((trans_color->green >> 8) & 0xff);
 4707|      0|         png_byte blue_high = (png_byte)((trans_color->blue >> 8) & 0xff);
 4708|      0|         png_byte red_low = (png_byte)(trans_color->red & 0xff);
 4709|      0|         png_byte green_low = (png_byte)(trans_color->green & 0xff);
 4710|      0|         png_byte blue_low = (png_byte)(trans_color->blue & 0xff);
 4711|      0|         sp = row + row_info->rowbytes - 1;
 4712|      0|         dp = row + ((size_t)row_width << 3) - 1;
 4713|      0|         for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (4713:22): [True: 0, False: 0]
  ------------------
 4714|      0|         {
 4715|      0|            if (*(sp - 5) == red_high &&
  ------------------
  |  Branch (4715:17): [True: 0, False: 0]
  ------------------
 4716|      0|                *(sp - 4) == red_low &&
  ------------------
  |  Branch (4716:17): [True: 0, False: 0]
  ------------------
 4717|      0|                *(sp - 3) == green_high &&
  ------------------
  |  Branch (4717:17): [True: 0, False: 0]
  ------------------
 4718|      0|                *(sp - 2) == green_low &&
  ------------------
  |  Branch (4718:17): [True: 0, False: 0]
  ------------------
 4719|      0|                *(sp - 1) == blue_high &&
  ------------------
  |  Branch (4719:17): [True: 0, False: 0]
  ------------------
 4720|      0|                *(sp    ) == blue_low)
  ------------------
  |  Branch (4720:17): [True: 0, False: 0]
  ------------------
 4721|      0|            {
 4722|      0|               *dp-- = 0;
 4723|      0|               *dp-- = 0;
 4724|      0|            }
 4725|       |
 4726|      0|            else
 4727|      0|            {
 4728|      0|               *dp-- = 0xff;
 4729|      0|               *dp-- = 0xff;
 4730|      0|            }
 4731|       |
 4732|      0|            *dp-- = *sp--;
 4733|      0|            *dp-- = *sp--;
 4734|      0|            *dp-- = *sp--;
 4735|      0|            *dp-- = *sp--;
 4736|      0|            *dp-- = *sp--;
 4737|      0|            *dp-- = *sp--;
 4738|      0|         }
 4739|      0|      }
 4740|      0|      row_info->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
 4741|      0|      row_info->channels = 4;
 4742|      0|      row_info->pixel_depth = (png_byte)(row_info->bit_depth << 2);
 4743|      0|      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
  ------------------
  |  |  755|      0|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 0, False: 0]
  |  |  ------------------
  |  |  756|      0|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|      0|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 4744|      0|   }
 4745|     21|}
pngrtran.c:png_do_gray_to_rgb:
 3001|     21|{
 3002|     21|   png_uint_32 i;
 3003|     21|   png_uint_32 row_width = row_info->width;
 3004|       |
 3005|     21|   png_debug(1, "in png_do_gray_to_rgb");
  ------------------
  |  |  145|     21|#  define png_debug(l, m) ((void)0)
  ------------------
 3006|       |
 3007|     21|   if (row_info->bit_depth >= 8 &&
  ------------------
  |  Branch (3007:8): [True: 21, False: 0]
  ------------------
 3008|     21|       (row_info->color_type & PNG_COLOR_MASK_COLOR) == 0)
  ------------------
  |  |  662|     21|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (3008:8): [True: 21, False: 0]
  ------------------
 3009|     21|   {
 3010|     21|      if (row_info->color_type == PNG_COLOR_TYPE_GRAY)
  ------------------
  |  |  666|     21|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (3010:11): [True: 21, False: 0]
  ------------------
 3011|     21|      {
 3012|     21|         if (row_info->bit_depth == 8)
  ------------------
  |  Branch (3012:14): [True: 21, False: 0]
  ------------------
 3013|     21|         {
 3014|       |            /* This changes G to RGB */
 3015|     21|            png_bytep sp = row + (size_t)row_width - 1;
 3016|     21|            png_bytep dp = sp  + (size_t)row_width * 2;
 3017|    228|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (3017:25): [True: 207, False: 21]
  ------------------
 3018|    207|            {
 3019|    207|               *(dp--) = *sp;
 3020|    207|               *(dp--) = *sp;
 3021|    207|               *(dp--) = *(sp--);
 3022|    207|            }
 3023|     21|         }
 3024|       |
 3025|      0|         else
 3026|      0|         {
 3027|       |            /* This changes GG to RRGGBB */
 3028|      0|            png_bytep sp = row + (size_t)row_width * 2 - 1;
 3029|      0|            png_bytep dp = sp  + (size_t)row_width * 4;
 3030|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (3030:25): [True: 0, False: 0]
  ------------------
 3031|      0|            {
 3032|      0|               *(dp--) = *sp;
 3033|      0|               *(dp--) = *(sp - 1);
 3034|      0|               *(dp--) = *sp;
 3035|      0|               *(dp--) = *(sp - 1);
 3036|      0|               *(dp--) = *(sp--);
 3037|      0|               *(dp--) = *(sp--);
 3038|      0|            }
 3039|      0|         }
 3040|     21|      }
 3041|       |
 3042|      0|      else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
  ------------------
  |  |  670|      0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (3042:16): [True: 0, False: 0]
  ------------------
 3043|      0|      {
 3044|      0|         if (row_info->bit_depth == 8)
  ------------------
  |  Branch (3044:14): [True: 0, False: 0]
  ------------------
 3045|      0|         {
 3046|       |            /* This changes GA to RGBA */
 3047|      0|            png_bytep sp = row + (size_t)row_width * 2 - 1;
 3048|      0|            png_bytep dp = sp  + (size_t)row_width * 2;
 3049|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (3049:25): [True: 0, False: 0]
  ------------------
 3050|      0|            {
 3051|      0|               *(dp--) = *(sp--);
 3052|      0|               *(dp--) = *sp;
 3053|      0|               *(dp--) = *sp;
 3054|      0|               *(dp--) = *(sp--);
 3055|      0|            }
 3056|      0|         }
 3057|       |
 3058|      0|         else
 3059|      0|         {
 3060|       |            /* This changes GGAA to RRGGBBAA */
 3061|      0|            png_bytep sp = row + (size_t)row_width * 4 - 1;
 3062|      0|            png_bytep dp = sp  + (size_t)row_width * 4;
 3063|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (3063:25): [True: 0, False: 0]
  ------------------
 3064|      0|            {
 3065|      0|               *(dp--) = *(sp--);
 3066|      0|               *(dp--) = *(sp--);
 3067|      0|               *(dp--) = *sp;
 3068|      0|               *(dp--) = *(sp - 1);
 3069|      0|               *(dp--) = *sp;
 3070|      0|               *(dp--) = *(sp - 1);
 3071|      0|               *(dp--) = *(sp--);
 3072|      0|               *(dp--) = *(sp--);
 3073|      0|            }
 3074|      0|         }
 3075|      0|      }
 3076|     21|      row_info->channels = (png_byte)(row_info->channels + 2);
 3077|     21|      row_info->color_type |= PNG_COLOR_MASK_COLOR;
  ------------------
  |  |  662|     21|#define PNG_COLOR_MASK_COLOR      2
  ------------------
 3078|     21|      row_info->pixel_depth = (png_byte)(row_info->channels *
 3079|     21|          row_info->bit_depth);
 3080|     21|      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width);
  ------------------
  |  |  755|     21|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 21, False: 0]
  |  |  ------------------
  |  |  756|     21|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|     21|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 3081|     21|   }
 3082|     21|}
pngrtran.c:png_do_scale_16_to_8:
 2530|     21|{
 2531|     21|   png_debug(1, "in png_do_scale_16_to_8");
  ------------------
  |  |  145|     21|#  define png_debug(l, m) ((void)0)
  ------------------
 2532|       |
 2533|     21|   if (row_info->bit_depth == 16)
  ------------------
  |  Branch (2533:8): [True: 0, False: 21]
  ------------------
 2534|      0|   {
 2535|      0|      png_bytep sp = row; /* source */
 2536|      0|      png_bytep dp = row; /* destination */
 2537|      0|      png_bytep ep = sp + row_info->rowbytes; /* end+1 */
 2538|       |
 2539|      0|      while (sp < ep)
  ------------------
  |  Branch (2539:14): [True: 0, False: 0]
  ------------------
 2540|      0|      {
 2541|       |         /* The input is an array of 16-bit components, these must be scaled to
 2542|       |          * 8 bits each.  For a 16-bit value V the required value (from the PNG
 2543|       |          * specification) is:
 2544|       |          *
 2545|       |          *    (V * 255) / 65535
 2546|       |          *
 2547|       |          * This reduces to round(V / 257), or floor((V + 128.5)/257)
 2548|       |          *
 2549|       |          * Represent V as the two byte value vhi.vlo.  Make a guess that the
 2550|       |          * result is the top byte of V, vhi, then the correction to this value
 2551|       |          * is:
 2552|       |          *
 2553|       |          *    error = floor(((V-vhi.vhi) + 128.5) / 257)
 2554|       |          *          = floor(((vlo-vhi) + 128.5) / 257)
 2555|       |          *
 2556|       |          * This can be approximated using integer arithmetic (and a signed
 2557|       |          * shift):
 2558|       |          *
 2559|       |          *    error = (vlo-vhi+128) >> 8;
 2560|       |          *
 2561|       |          * The approximate differs from the exact answer only when (vlo-vhi) is
 2562|       |          * 128; it then gives a correction of +1 when the exact correction is
 2563|       |          * 0.  This gives 128 errors.  The exact answer (correct for all 16-bit
 2564|       |          * input values) is:
 2565|       |          *
 2566|       |          *    error = (vlo-vhi+128)*65535 >> 24;
 2567|       |          *
 2568|       |          * An alternative arithmetic calculation which also gives no errors is:
 2569|       |          *
 2570|       |          *    (V * 255 + 32895) >> 16
 2571|       |          */
 2572|       |
 2573|      0|         png_int_32 tmp = *sp++; /* must be signed! */
 2574|      0|         tmp += (((int)*sp++ - tmp + 128) * 65535) >> 24;
 2575|      0|         *dp++ = (png_byte)tmp;
 2576|      0|      }
 2577|       |
 2578|      0|      row_info->bit_depth = 8;
 2579|      0|      row_info->pixel_depth = (png_byte)(8 * row_info->channels);
 2580|      0|      row_info->rowbytes = (size_t)row_info->width * row_info->channels;
 2581|      0|   }
 2582|     21|}
pngrtran.c:png_do_unpack:
 2293|     21|{
 2294|     21|   png_debug(1, "in png_do_unpack");
  ------------------
  |  |  145|     21|#  define png_debug(l, m) ((void)0)
  ------------------
 2295|       |
 2296|     21|   if (row_info->bit_depth < 8)
  ------------------
  |  Branch (2296:8): [True: 0, False: 21]
  ------------------
 2297|      0|   {
 2298|      0|      png_uint_32 i;
 2299|      0|      png_uint_32 row_width=row_info->width;
 2300|       |
 2301|      0|      switch (row_info->bit_depth)
 2302|      0|      {
 2303|      0|         case 1:
  ------------------
  |  Branch (2303:10): [True: 0, False: 0]
  ------------------
 2304|      0|         {
 2305|      0|            png_bytep sp = row + (size_t)((row_width - 1) >> 3);
 2306|      0|            png_bytep dp = row + (size_t)row_width - 1;
 2307|      0|            png_uint_32 shift = 7U - ((row_width + 7U) & 0x07);
 2308|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2308:25): [True: 0, False: 0]
  ------------------
 2309|      0|            {
 2310|      0|               *dp = (png_byte)((*sp >> shift) & 0x01);
 2311|       |
 2312|      0|               if (shift == 7)
  ------------------
  |  Branch (2312:20): [True: 0, False: 0]
  ------------------
 2313|      0|               {
 2314|      0|                  shift = 0;
 2315|      0|                  sp--;
 2316|      0|               }
 2317|       |
 2318|      0|               else
 2319|      0|                  shift++;
 2320|       |
 2321|      0|               dp--;
 2322|      0|            }
 2323|      0|            break;
 2324|      0|         }
 2325|       |
 2326|      0|         case 2:
  ------------------
  |  Branch (2326:10): [True: 0, False: 0]
  ------------------
 2327|      0|         {
 2328|       |
 2329|      0|            png_bytep sp = row + (size_t)((row_width - 1) >> 2);
 2330|      0|            png_bytep dp = row + (size_t)row_width - 1;
 2331|      0|            png_uint_32 shift = ((3U - ((row_width + 3U) & 0x03)) << 1);
 2332|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2332:25): [True: 0, False: 0]
  ------------------
 2333|      0|            {
 2334|      0|               *dp = (png_byte)((*sp >> shift) & 0x03);
 2335|       |
 2336|      0|               if (shift == 6)
  ------------------
  |  Branch (2336:20): [True: 0, False: 0]
  ------------------
 2337|      0|               {
 2338|      0|                  shift = 0;
 2339|      0|                  sp--;
 2340|      0|               }
 2341|       |
 2342|      0|               else
 2343|      0|                  shift += 2;
 2344|       |
 2345|      0|               dp--;
 2346|      0|            }
 2347|      0|            break;
 2348|      0|         }
 2349|       |
 2350|      0|         case 4:
  ------------------
  |  Branch (2350:10): [True: 0, False: 0]
  ------------------
 2351|      0|         {
 2352|      0|            png_bytep sp = row + (size_t)((row_width - 1) >> 1);
 2353|      0|            png_bytep dp = row + (size_t)row_width - 1;
 2354|      0|            png_uint_32 shift = ((1U - ((row_width + 1U) & 0x01)) << 2);
 2355|      0|            for (i = 0; i < row_width; i++)
  ------------------
  |  Branch (2355:25): [True: 0, False: 0]
  ------------------
 2356|      0|            {
 2357|      0|               *dp = (png_byte)((*sp >> shift) & 0x0f);
 2358|       |
 2359|      0|               if (shift == 4)
  ------------------
  |  Branch (2359:20): [True: 0, False: 0]
  ------------------
 2360|      0|               {
 2361|      0|                  shift = 0;
 2362|      0|                  sp--;
 2363|      0|               }
 2364|       |
 2365|      0|               else
 2366|      0|                  shift = 4;
 2367|       |
 2368|      0|               dp--;
 2369|      0|            }
 2370|      0|            break;
 2371|      0|         }
 2372|       |
 2373|      0|         default:
  ------------------
  |  Branch (2373:10): [True: 0, False: 0]
  ------------------
 2374|      0|            break;
 2375|      0|      }
 2376|      0|      row_info->bit_depth = 8;
 2377|      0|      row_info->pixel_depth = (png_byte)(8 * row_info->channels);
 2378|      0|      row_info->rowbytes = (size_t)row_width * row_info->channels;
 2379|      0|   }
 2380|     21|}

OSS_FUZZ_png_get_uint_31:
   42|  8.01k|{
   43|  8.01k|   png_uint_32 uval = png_get_uint_32(buf);
  ------------------
  |  |  322|  8.01k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|  8.01k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|  8.01k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|  8.01k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|  8.01k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|  8.01k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
   44|       |
   45|  8.01k|   if (uval > PNG_UINT_31_MAX)
  ------------------
  |  |  647|  8.01k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
  ------------------
  |  Branch (45:8): [True: 4, False: 8.01k]
  ------------------
   46|      4|      png_error(png_ptr, "PNG unsigned integer out of range");
  ------------------
  |  |  252|      4|#define png_error OSS_FUZZ_png_error
  ------------------
   47|       |
   48|  8.01k|   return uval;
   49|  8.01k|}
OSS_FUZZ_png_read_sig:
  117|     19|{
  118|     19|   size_t num_checked, num_to_check;
  119|       |
  120|       |   /* Exit if the user application does not expect a signature. */
  121|     19|   if (png_ptr->sig_bytes >= 8)
  ------------------
  |  Branch (121:8): [True: 16, False: 3]
  ------------------
  122|     16|      return;
  123|       |
  124|      3|   num_checked = png_ptr->sig_bytes;
  125|      3|   num_to_check = 8 - num_checked;
  126|       |
  127|      3|#ifdef PNG_IO_STATE_SUPPORTED
  128|      3|   png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE;
  ------------------
  |  | 2664|      3|#  define PNG_IO_READING     0x0001   /* currently reading */
  ------------------
                 png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE;
  ------------------
  |  | 2666|      3|#  define PNG_IO_SIGNATURE   0x0010   /* currently at the file signature */
  ------------------
  129|      3|#endif
  130|       |
  131|       |   /* The signature must be serialized in a single I/O call. */
  132|      3|   png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check);
  ------------------
  |  |   23|      3|#define png_read_data OSS_FUZZ_png_read_data
  ------------------
  133|      3|   png_ptr->sig_bytes = 8;
  134|       |
  135|      3|   if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check) != 0)
  ------------------
  |  |  448|      3|#define png_sig_cmp OSS_FUZZ_png_sig_cmp
  ------------------
  |  Branch (135:8): [True: 0, False: 3]
  ------------------
  136|      0|   {
  137|      0|      if (num_checked < 4 &&
  ------------------
  |  Branch (137:11): [True: 0, False: 0]
  ------------------
  138|      0|          png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4) != 0)
  ------------------
  |  |  448|      0|#define png_sig_cmp OSS_FUZZ_png_sig_cmp
  ------------------
  |  Branch (138:11): [True: 0, False: 0]
  ------------------
  139|      0|         png_error(png_ptr, "Not a PNG file");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  140|      0|      else
  141|      0|         png_error(png_ptr, "PNG file corrupted by ASCII conversion");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
  142|      0|   }
  143|      3|   if (num_checked < 3)
  ------------------
  |  Branch (143:8): [True: 3, False: 0]
  ------------------
  144|      3|      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
  ------------------
  |  |  652|      3|#define PNG_HAVE_PNG_SIGNATURE    0x1000U
  ------------------
  145|      3|}
OSS_FUZZ_png_read_chunk_header:
  184|  7.98k|{
  185|  7.98k|   png_byte buf[8];
  186|  7.98k|   png_uint_32 chunk_name, length;
  187|       |
  188|  7.98k|#ifdef PNG_IO_STATE_SUPPORTED
  189|  7.98k|   png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR;
  ------------------
  |  | 2664|  7.98k|#  define PNG_IO_READING     0x0001   /* currently reading */
  ------------------
                 png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR;
  ------------------
  |  | 2667|  7.98k|#  define PNG_IO_CHUNK_HDR   0x0020   /* currently at the chunk header */
  ------------------
  190|  7.98k|#endif
  191|       |
  192|       |   /* Read the length and the chunk name.  png_struct::chunk_name is immediately
  193|       |    * updated even if they are detectably wrong.  This aids error message
  194|       |    * handling by allowing png_chunk_error to be used.
  195|       |    */
  196|  7.98k|   png_read_data(png_ptr, buf, 8);
  ------------------
  |  |   23|  7.98k|#define png_read_data OSS_FUZZ_png_read_data
  ------------------
  197|  7.98k|   length = png_get_uint_31(png_ptr, buf);
  ------------------
  |  |  321|  7.98k|#define png_get_uint_31 OSS_FUZZ_png_get_uint_31
  ------------------
  198|  7.98k|   png_ptr->chunk_name = chunk_name = PNG_CHUNK_FROM_STRING(buf+4);
  ------------------
  |  |  924|  7.98k|   PNG_U32(0xff & (s)[0], 0xff & (s)[1], 0xff & (s)[2], 0xff & (s)[3])
  |  |  ------------------
  |  |  |  |  845|  7.98k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  199|       |
  200|       |   /* Reset the crc and run it over the chunk name. */
  201|  7.98k|   png_reset_crc(png_ptr);
  ------------------
  |  |   19|  7.98k|#define png_reset_crc OSS_FUZZ_png_reset_crc
  ------------------
  202|  7.98k|   png_calculate_crc(png_ptr, buf + 4, 4);
  ------------------
  |  |   26|  7.98k|#define png_calculate_crc OSS_FUZZ_png_calculate_crc
  ------------------
  203|       |
  204|  7.98k|   png_debug2(0, "Reading chunk typeid = 0x%lx, length = %lu",
  ------------------
  |  |  151|  7.98k|#  define png_debug2(l, m, p1, p2) ((void)0)
  ------------------
  205|  7.98k|       (unsigned long)png_ptr->chunk_name, (unsigned long)length);
  206|       |
  207|       |   /* Sanity check the length (first by <= 0x80) and the chunk name.  An error
  208|       |    * here indicates a broken stream and libpng has no recovery from this.
  209|       |    */
  210|  7.98k|   if (buf[0] >= 0x80U)
  ------------------
  |  Branch (210:8): [True: 0, False: 7.98k]
  ------------------
  211|      0|      png_chunk_error(png_ptr, "bad header (invalid length)");
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  212|       |
  213|       |   /* Check to see if chunk name is valid. */
  214|  7.98k|   if (!check_chunk_name(chunk_name))
  ------------------
  |  Branch (214:8): [True: 6, False: 7.98k]
  ------------------
  215|      6|      png_chunk_error(png_ptr, "bad header (invalid type)");
  ------------------
  |  |  239|      6|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  216|       |
  217|  7.98k|#ifdef PNG_IO_STATE_SUPPORTED
  218|  7.98k|   png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;
  ------------------
  |  | 2664|  7.98k|#  define PNG_IO_READING     0x0001   /* currently reading */
  ------------------
                 png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;
  ------------------
  |  | 2668|  7.98k|#  define PNG_IO_CHUNK_DATA  0x0040   /* currently at the chunk data */
  ------------------
  219|  7.98k|#endif
  220|       |
  221|  7.98k|   return length;
  222|  7.98k|}
OSS_FUZZ_png_crc_read:
  227|  12.5k|{
  228|  12.5k|   if (png_ptr == NULL)
  ------------------
  |  Branch (228:8): [True: 0, False: 12.5k]
  ------------------
  229|      0|      return;
  230|       |
  231|  12.5k|   png_read_data(png_ptr, buf, length);
  ------------------
  |  |   23|  12.5k|#define png_read_data OSS_FUZZ_png_read_data
  ------------------
  232|  12.5k|   png_calculate_crc(png_ptr, buf, length);
  ------------------
  |  |   26|  12.5k|#define png_calculate_crc OSS_FUZZ_png_calculate_crc
  ------------------
  233|  12.5k|}
OSS_FUZZ_png_crc_finish:
  361|  7.97k|{
  362|  7.97k|   return png_crc_finish_critical(png_ptr, skip, 0/*critical handling*/);
  363|  7.97k|}
OSS_FUZZ_png_zlib_inflate:
  526|  5.85k|{
  527|  5.85k|   if (png_ptr->zstream_start && png_ptr->zstream.avail_in > 0)
  ------------------
  |  Branch (527:8): [True: 4.56k, False: 1.28k]
  |  Branch (527:34): [True: 4.56k, False: 0]
  ------------------
  528|  4.56k|   {
  529|  4.56k|      if ((*png_ptr->zstream.next_in >> 4) > 7)
  ------------------
  |  Branch (529:11): [True: 0, False: 4.56k]
  ------------------
  530|      0|      {
  531|      0|         png_ptr->zstream.msg = "invalid window size (libpng)";
  532|      0|         return Z_DATA_ERROR;
  533|      0|      }
  534|       |
  535|  4.56k|      png_ptr->zstream_start = 0;
  536|  4.56k|   }
  537|       |
  538|  5.85k|   return inflate(&png_ptr->zstream, flush);
  539|  5.85k|}
OSS_FUZZ_png_handle_unknown:
 2763|    817|{
 2764|    817|   png_handle_result_code handled = handled_discarded; /* the default */
 2765|       |
 2766|    817|   png_debug(1, "in png_handle_unknown");
  ------------------
  |  |  145|    817|#  define png_debug(l, m) ((void)0)
  ------------------
 2767|       |
 2768|    817|#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
 2769|       |   /* NOTE: this code is based on the code in libpng-1.4.12 except for fixing
 2770|       |    * the bug which meant that setting a non-default behavior for a specific
 2771|       |    * chunk would be ignored (the default was always used unless a user
 2772|       |    * callback was installed).
 2773|       |    *
 2774|       |    * 'keep' is the value from the png_chunk_unknown_handling, the setting for
 2775|       |    * this specific chunk_name, if PNG_HANDLE_AS_UNKNOWN_SUPPORTED, if not it
 2776|       |    * will always be PNG_HANDLE_CHUNK_AS_DEFAULT and it needs to be set here.
 2777|       |    * This is just an optimization to avoid multiple calls to the lookup
 2778|       |    * function.
 2779|       |    */
 2780|       |#  ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 2781|       |#     ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
 2782|       |   keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name);
 2783|       |#     endif
 2784|       |#  endif
 2785|       |
 2786|       |   /* One of the following methods will read the chunk or skip it (at least one
 2787|       |    * of these is always defined because this is the only way to switch on
 2788|       |    * PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
 2789|       |    */
 2790|    817|#  ifdef PNG_READ_USER_CHUNKS_SUPPORTED
 2791|       |   /* The user callback takes precedence over the chunk keep value, but the
 2792|       |    * keep value is still required to validate a save of a critical chunk.
 2793|       |    */
 2794|    817|   if (png_ptr->read_user_chunk_fn != NULL)
  ------------------
  |  Branch (2794:8): [True: 0, False: 817]
  ------------------
 2795|      0|   {
 2796|      0|      if (png_cache_unknown_chunk(png_ptr, length) != 0)
  ------------------
  |  Branch (2796:11): [True: 0, False: 0]
  ------------------
 2797|      0|      {
 2798|       |         /* Callback to user unknown chunk handler */
 2799|      0|         int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr,
 2800|      0|             &png_ptr->unknown_chunk);
 2801|       |
 2802|       |         /* ret is:
 2803|       |          * negative: An error occurred; png_chunk_error will be called.
 2804|       |          *     zero: The chunk was not handled, the chunk will be discarded
 2805|       |          *           unless png_set_keep_unknown_chunks has been used to set
 2806|       |          *           a 'keep' behavior for this particular chunk, in which
 2807|       |          *           case that will be used.  A critical chunk will cause an
 2808|       |          *           error at this point unless it is to be saved.
 2809|       |          * positive: The chunk was handled, libpng will ignore/discard it.
 2810|       |          */
 2811|      0|         if (ret < 0) /* handled_error */
  ------------------
  |  Branch (2811:14): [True: 0, False: 0]
  ------------------
 2812|      0|            png_chunk_error(png_ptr, "error in user chunk");
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2813|       |
 2814|      0|         else if (ret == 0)
  ------------------
  |  Branch (2814:19): [True: 0, False: 0]
  ------------------
 2815|      0|         {
 2816|       |            /* If the keep value is 'default' or 'never' override it, but
 2817|       |             * still error out on critical chunks unless the keep value is
 2818|       |             * 'always'  While this is weird it is the behavior in 1.4.12.
 2819|       |             * A possible improvement would be to obey the value set for the
 2820|       |             * chunk, but this would be an API change that would probably
 2821|       |             * damage some applications.
 2822|       |             *
 2823|       |             * The png_app_warning below catches the case that matters, where
 2824|       |             * the application has not set specific save or ignore for this
 2825|       |             * chunk or global save or ignore.
 2826|       |             */
 2827|      0|            if (keep < PNG_HANDLE_CHUNK_IF_SAFE)
  ------------------
  |  | 2585|      0|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
  |  Branch (2827:17): [True: 0, False: 0]
  ------------------
 2828|      0|            {
 2829|      0|#              ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
 2830|      0|               if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE)
  ------------------
  |  | 2585|      0|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
  |  Branch (2830:20): [True: 0, False: 0]
  ------------------
 2831|      0|               {
 2832|      0|                  png_chunk_warning(png_ptr, "Saving unknown chunk:");
  ------------------
  |  |  240|      0|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
 2833|      0|                  png_app_warning(png_ptr,
  ------------------
  |  |   81|      0|#define png_app_warning OSS_FUZZ_png_app_warning
  ------------------
 2834|      0|                      "forcing save of an unhandled chunk;"
 2835|      0|                      " please call png_set_keep_unknown_chunks");
 2836|       |                      /* with keep = PNG_HANDLE_CHUNK_IF_SAFE */
 2837|      0|               }
 2838|      0|#              endif
 2839|      0|               keep = PNG_HANDLE_CHUNK_IF_SAFE;
  ------------------
  |  | 2585|      0|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
 2840|      0|            }
 2841|      0|         }
 2842|       |
 2843|      0|         else /* chunk was handled */
 2844|      0|         {
 2845|      0|            handled = handled_ok;
 2846|       |            /* Critical chunks can be safely discarded at this point. */
 2847|      0|            keep = PNG_HANDLE_CHUNK_NEVER;
  ------------------
  |  | 2584|      0|#define PNG_HANDLE_CHUNK_NEVER        1
  ------------------
 2848|      0|         }
 2849|      0|      }
 2850|       |
 2851|      0|      else
 2852|      0|         keep = PNG_HANDLE_CHUNK_NEVER; /* insufficient memory */
  ------------------
  |  | 2584|      0|#define PNG_HANDLE_CHUNK_NEVER        1
  ------------------
 2853|      0|   }
 2854|       |
 2855|    817|   else
 2856|       |   /* Use the SAVE_UNKNOWN_CHUNKS code or skip the chunk */
 2857|    817|#  endif /* READ_USER_CHUNKS */
 2858|       |
 2859|    817|#  ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED
 2860|    817|   {
 2861|       |      /* keep is currently just the per-chunk setting, if there was no
 2862|       |       * setting change it to the global default now (not that this may
 2863|       |       * still be AS_DEFAULT) then obtain the cache of the chunk if required,
 2864|       |       * if not simply skip the chunk.
 2865|       |       */
 2866|    817|      if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT)
  ------------------
  |  | 2583|    817|#define PNG_HANDLE_CHUNK_AS_DEFAULT   0
  ------------------
  |  Branch (2866:11): [True: 817, False: 0]
  ------------------
 2867|    817|         keep = png_ptr->unknown_default;
 2868|       |
 2869|    817|      if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
  ------------------
  |  | 2586|  1.63k|#define PNG_HANDLE_CHUNK_ALWAYS       3
  ------------------
  |  Branch (2869:11): [True: 0, False: 817]
  ------------------
 2870|    817|         (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
  ------------------
  |  | 2585|  1.63k|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
  |  Branch (2870:11): [True: 0, False: 817]
  ------------------
 2871|      0|          PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
  ------------------
  |  |  941|      0|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  |  |  ------------------
  |  |  |  Branch (941:34): [True: 0, False: 0]
  |  |  ------------------
  ------------------
 2872|      0|      {
 2873|      0|         if (png_cache_unknown_chunk(png_ptr, length) == 0)
  ------------------
  |  Branch (2873:14): [True: 0, False: 0]
  ------------------
 2874|      0|            keep = PNG_HANDLE_CHUNK_NEVER;
  ------------------
  |  | 2584|      0|#define PNG_HANDLE_CHUNK_NEVER        1
  ------------------
 2875|      0|      }
 2876|       |
 2877|    817|      else
 2878|    817|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|    817|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2879|    817|   }
 2880|       |#  else
 2881|       |#     ifndef PNG_READ_USER_CHUNKS_SUPPORTED
 2882|       |#        error no method to support READ_UNKNOWN_CHUNKS
 2883|       |#     endif
 2884|       |
 2885|       |   {
 2886|       |      /* If here there is no read callback pointer set and no support is
 2887|       |       * compiled in to just save the unknown chunks, so simply skip this
 2888|       |       * chunk.  If 'keep' is something other than AS_DEFAULT or NEVER then
 2889|       |       * the app has erroneously asked for unknown chunk saving when there
 2890|       |       * is no support.
 2891|       |       */
 2892|       |      if (keep > PNG_HANDLE_CHUNK_NEVER)
 2893|       |         png_app_error(png_ptr, "no unknown chunk support available");
 2894|       |
 2895|       |      png_crc_finish(png_ptr, length);
 2896|       |   }
 2897|       |#  endif
 2898|       |
 2899|    817|#  ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
 2900|       |   /* Now store the chunk in the chunk list if appropriate, and if the limits
 2901|       |    * permit it.
 2902|       |    */
 2903|    817|   if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
  ------------------
  |  | 2586|  1.63k|#define PNG_HANDLE_CHUNK_ALWAYS       3
  ------------------
  |  Branch (2903:8): [True: 1, False: 816]
  ------------------
 2904|    816|      (keep == PNG_HANDLE_CHUNK_IF_SAFE &&
  ------------------
  |  | 2585|  1.63k|#define PNG_HANDLE_CHUNK_IF_SAFE      2
  ------------------
  |  Branch (2904:8): [True: 0, False: 816]
  ------------------
 2905|      0|       PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
  ------------------
  |  |  941|      0|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  |  |  ------------------
  |  |  |  Branch (941:34): [True: 0, False: 0]
  |  |  ------------------
  ------------------
 2906|      0|   {
 2907|      0|#     ifdef PNG_USER_LIMITS_SUPPORTED
 2908|      0|      switch (png_ptr->user_chunk_cache_max)
 2909|      0|      {
 2910|      0|         case 2:
  ------------------
  |  Branch (2910:10): [True: 0, False: 0]
  ------------------
 2911|      0|            png_ptr->user_chunk_cache_max = 1;
 2912|      0|            png_chunk_benign_error(png_ptr, "no space in chunk cache");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2913|       |            /* FALLTHROUGH */
 2914|      0|         case 1:
  ------------------
  |  Branch (2914:10): [True: 0, False: 0]
  ------------------
 2915|       |            /* NOTE: prior to 1.6.0 this case resulted in an unknown critical
 2916|       |             * chunk being skipped, now there will be a hard error below.
 2917|       |             */
 2918|      0|            break;
 2919|       |
 2920|      0|         default: /* not at limit */
  ------------------
  |  Branch (2920:10): [True: 0, False: 0]
  ------------------
 2921|      0|            --(png_ptr->user_chunk_cache_max);
 2922|       |            /* FALLTHROUGH */
 2923|      0|         case 0: /* no limit */
  ------------------
  |  Branch (2923:10): [True: 0, False: 0]
  ------------------
 2924|      0|#  endif /* USER_LIMITS */
 2925|       |            /* Here when the limit isn't reached or when limits are compiled
 2926|       |             * out; store the chunk.
 2927|       |             */
 2928|      0|            png_set_unknown_chunks(png_ptr, info_ptr,
  ------------------
  |  |  443|      0|#define png_set_unknown_chunks OSS_FUZZ_png_set_unknown_chunks
  ------------------
 2929|      0|                &png_ptr->unknown_chunk, 1);
 2930|      0|            handled = handled_saved;
 2931|      0|#  ifdef PNG_USER_LIMITS_SUPPORTED
 2932|      0|            break;
 2933|      0|      }
 2934|      0|#  endif
 2935|      0|   }
 2936|       |#  else /* no store support: the chunk must be handled by the user callback */
 2937|       |   PNG_UNUSED(info_ptr)
 2938|       |#  endif
 2939|       |
 2940|       |   /* Regardless of the error handling below the cached data (if any) can be
 2941|       |    * freed now.  Notice that the data is not freed if there is a png_error, but
 2942|       |    * it will be freed by destroy_read_struct.
 2943|       |    */
 2944|    817|   if (png_ptr->unknown_chunk.data != NULL)
  ------------------
  |  Branch (2944:8): [True: 0, False: 817]
  ------------------
 2945|      0|      png_free(png_ptr, png_ptr->unknown_chunk.data);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 2946|    817|   png_ptr->unknown_chunk.data = NULL;
 2947|       |
 2948|       |#else /* !PNG_READ_UNKNOWN_CHUNKS_SUPPORTED */
 2949|       |   /* There is no support to read an unknown chunk, so just skip it. */
 2950|       |   png_crc_finish(png_ptr, length);
 2951|       |   PNG_UNUSED(info_ptr)
 2952|       |   PNG_UNUSED(keep)
 2953|       |#endif /* !READ_UNKNOWN_CHUNKS */
 2954|       |
 2955|       |   /* Check for unhandled critical chunks */
 2956|    817|   if (handled < handled_saved && PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
  ------------------
  |  |  942|    816|#define PNG_CHUNK_CRITICAL(c)     (!PNG_CHUNK_ANCILLARY(c))
  |  |  ------------------
  |  |  |  |  941|    816|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  |  |  ------------------
  |  |  |  Branch (942:35): [True: 0, False: 816]
  |  |  ------------------
  ------------------
  |  Branch (2956:8): [True: 816, False: 1]
  ------------------
 2957|      0|      png_chunk_error(png_ptr, "unhandled critical chunk");
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 2958|       |
 2959|    817|   return handled;
 2960|    817|}
OSS_FUZZ_png_handle_chunk:
 3108|  7.97k|{
 3109|       |   /* CSE: these things don't change, these autos are just to save typing and
 3110|       |    * make the code more clear.
 3111|       |    */
 3112|  7.97k|   const png_uint_32 chunk_name = png_ptr->chunk_name;
 3113|  7.97k|   const png_index chunk_index = png_chunk_index_from_name(chunk_name);
 3114|       |
 3115|  7.97k|   png_handle_result_code handled = handled_error;
 3116|  7.97k|   png_const_charp errmsg = NULL;
 3117|       |
 3118|       |   /* Is this a known chunk?  If not there are no checks performed here;
 3119|       |    * png_handle_unknown does the correct checks.  This means that the values
 3120|       |    * for known but unsupported chunks in the above table are not used here
 3121|       |    * however the chunks_seen fields in png_struct are still set.
 3122|       |    */
 3123|  7.97k|   if (chunk_index == PNG_INDEX_unknown ||
  ------------------
  |  Branch (3123:8): [True: 817, False: 7.15k]
  ------------------
 3124|  7.15k|       read_chunks[chunk_index].handler == NULL)
  ------------------
  |  Branch (3124:8): [True: 0, False: 7.15k]
  ------------------
 3125|    817|   {
 3126|    817|      handled = png_handle_unknown(
  ------------------
  |  |   49|    817|#define png_handle_unknown OSS_FUZZ_png_handle_unknown
  ------------------
 3127|    817|            png_ptr, info_ptr, length, PNG_HANDLE_CHUNK_AS_DEFAULT);
  ------------------
  |  | 2583|    817|#define PNG_HANDLE_CHUNK_AS_DEFAULT   0
  ------------------
 3128|    817|   }
 3129|       |
 3130|       |   /* First check the position.   The first check is historical; the stream must
 3131|       |    * start with IHDR and anything else causes libpng to give up immediately.
 3132|       |    */
 3133|  7.15k|   else if (chunk_index != PNG_INDEX_IHDR &&
  ------------------
  |  Branch (3133:13): [True: 7.13k, False: 18]
  ------------------
 3134|  7.13k|            (png_ptr->mode & PNG_HAVE_IHDR) == 0)
  ------------------
  |  |  642|  7.13k|#define PNG_HAVE_IHDR  0x01
  ------------------
  |  Branch (3134:13): [True: 0, False: 7.13k]
  ------------------
 3135|      0|      png_chunk_error(png_ptr, "missing IHDR"); /* NORETURN */
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 3136|       |
 3137|       |   /* Before all the pos_before chunks, after all the pos_after chunks. */
 3138|  7.15k|   else if (((png_ptr->mode & read_chunks[chunk_index].pos_before) != 0) ||
  ------------------
  |  Branch (3138:13): [True: 3, False: 7.15k]
  ------------------
 3139|  7.15k|            ((png_ptr->mode & read_chunks[chunk_index].pos_after) !=
  ------------------
  |  Branch (3139:13): [True: 0, False: 7.15k]
  ------------------
 3140|  7.15k|             read_chunks[chunk_index].pos_after))
 3141|      3|   {
 3142|      3|      errmsg = "out of place";
 3143|      3|   }
 3144|       |
 3145|       |   /* Now check for duplicates: duplicated critical chunks also produce a
 3146|       |    * full error.
 3147|       |    */
 3148|  7.15k|   else if (read_chunks[chunk_index].multiple == 0 &&
  ------------------
  |  Branch (3148:13): [True: 4.70k, False: 2.45k]
  ------------------
 3149|  4.70k|            png_file_has_chunk(png_ptr, chunk_index))
  ------------------
  |  |  115|  4.70k|   (((png_ptr)->chunks & png_chunk_flag_from_index(i)) != 0)
  |  |  ------------------
  |  |  |  |  108|  4.70k|#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i)))
  |  |  ------------------
  |  |  |  Branch (115:4): [True: 0, False: 4.70k]
  |  |  ------------------
  ------------------
 3150|      0|   {
 3151|      0|      errmsg = "duplicate";
 3152|      0|   }
 3153|       |
 3154|  7.15k|   else if (length < read_chunks[chunk_index].min_length)
  ------------------
  |  Branch (3154:13): [True: 0, False: 7.15k]
  ------------------
 3155|      0|      errmsg = "too short";
 3156|  7.15k|   else
 3157|  7.15k|   {
 3158|       |      /* NOTE: apart from IHDR the critical chunks (PLTE, IDAT and IEND) are set
 3159|       |       * up above not to do any length checks.
 3160|       |       *
 3161|       |       * The png_chunk_max check ensures that the variable length chunks are
 3162|       |       * always checked at this point for being within the system allocation
 3163|       |       * limits.
 3164|       |       */
 3165|  7.15k|      unsigned max_length = read_chunks[chunk_index].max_length;
 3166|       |
 3167|  7.15k|      switch (max_length)
 3168|  7.15k|      {
 3169|  1.10k|         case Limit:
  ------------------
  |  | 3023|  1.10k|#  define Limit   0x802U      /* Limit to png_chunk_max bytes */
  ------------------
  |  Branch (3169:10): [True: 1.10k, False: 6.05k]
  ------------------
 3170|       |            /* png_read_chunk_header has already png_error'ed chunks with a
 3171|       |             * length exceeding the 31-bit PNG limit, so just check the memory
 3172|       |             * limit:
 3173|       |             */
 3174|  1.10k|            if (length <= png_chunk_max(png_ptr))
  ------------------
  |  | 1126|  1.10k|#  define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max)
  ------------------
  |  Branch (3174:17): [True: 1.10k, False: 0]
  ------------------
 3175|  1.10k|               goto MeetsLimit;
 3176|       |
 3177|      0|            errmsg = "length exceeds libpng limit";
 3178|      0|            break;
 3179|       |
 3180|     18|         default:
  ------------------
  |  Branch (3180:10): [True: 18, False: 7.13k]
  ------------------
 3181|     18|            if (length <= max_length)
  ------------------
  |  Branch (3181:17): [True: 18, False: 0]
  ------------------
 3182|     18|               goto MeetsLimit;
 3183|       |
 3184|      0|            errmsg = "too long";
 3185|      0|            break;
 3186|       |
 3187|  6.03k|         case NoCheck:
  ------------------
  |  | 3022|  6.03k|#  define NoCheck 0x801U      /* Do not check the maximum length */
  ------------------
  |  Branch (3187:10): [True: 6.03k, False: 1.11k]
  ------------------
 3188|  7.15k|         MeetsLimit:
 3189|  7.15k|            handled = read_chunks[chunk_index].handler(
 3190|  7.15k|                  png_ptr, info_ptr, length);
 3191|  7.15k|            break;
 3192|  7.15k|      }
 3193|  7.15k|   }
 3194|       |
 3195|       |   /* If there was an error or the chunk was simply skipped it is not counted as
 3196|       |    * 'seen'.
 3197|       |    */
 3198|  7.96k|   if (errmsg != NULL)
  ------------------
  |  Branch (3198:8): [True: 3, False: 7.96k]
  ------------------
 3199|      3|   {
 3200|      3|      if (PNG_CHUNK_CRITICAL(chunk_name)) /* stop immediately */
  ------------------
  |  |  942|      3|#define PNG_CHUNK_CRITICAL(c)     (!PNG_CHUNK_ANCILLARY(c))
  |  |  ------------------
  |  |  |  |  941|      3|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  |  |  ------------------
  |  |  |  Branch (942:35): [True: 0, False: 3]
  |  |  ------------------
  ------------------
 3201|      0|         png_chunk_error(png_ptr, errmsg);
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 3202|      3|      else /* ancillary chunk */
 3203|      3|      {
 3204|       |         /* The chunk data is skipped: */
 3205|      3|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      3|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 3206|      3|         png_chunk_benign_error(png_ptr, errmsg);
  ------------------
  |  |  238|      3|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 3207|      3|      }
 3208|      3|   }
 3209|       |
 3210|  7.96k|   else if (handled >= handled_saved)
  ------------------
  |  Branch (3210:13): [True: 830, False: 7.13k]
  ------------------
 3211|    830|   {
 3212|    830|      if (chunk_index != PNG_INDEX_unknown)
  ------------------
  |  Branch (3212:11): [True: 830, False: 0]
  ------------------
 3213|    830|         png_file_add_chunk(png_ptr, chunk_index);
  ------------------
  |  |  119|    830|   ((void)((png_ptr)->chunks |= png_chunk_flag_from_index(i)))
  |  |  ------------------
  |  |  |  |  108|    830|#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i)))
  |  |  ------------------
  ------------------
 3214|    830|   }
 3215|       |
 3216|  7.96k|   return handled;
 3217|  7.96k|}
OSS_FUZZ_png_combine_row:
 3228|     21|{
 3229|     21|   unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
 3230|     21|   png_const_bytep sp = png_ptr->row_buf + 1;
 3231|     21|   png_alloc_size_t row_width = png_ptr->width;
 3232|     21|   unsigned int pass = png_ptr->pass;
 3233|     21|   png_bytep end_ptr = 0;
 3234|     21|   png_byte end_byte = 0;
 3235|     21|   unsigned int end_mask;
 3236|       |
 3237|     21|   png_debug(1, "in png_combine_row");
  ------------------
  |  |  145|     21|#  define png_debug(l, m) ((void)0)
  ------------------
 3238|       |
 3239|       |   /* Added in 1.5.6: it should not be possible to enter this routine until at
 3240|       |    * least one row has been read from the PNG data and transformed.
 3241|       |    */
 3242|     21|   if (pixel_depth == 0)
  ------------------
  |  Branch (3242:8): [True: 0, False: 21]
  ------------------
 3243|      0|      png_error(png_ptr, "internal row logic error");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 3244|       |
 3245|       |   /* Added in 1.5.4: the pixel depth should match the information returned by
 3246|       |    * any call to png_read_update_info at this point.  Do not continue if we got
 3247|       |    * this wrong.
 3248|       |    */
 3249|     21|   if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes !=
  ------------------
  |  Branch (3249:8): [True: 21, False: 0]
  |  Branch (3249:39): [True: 0, False: 21]
  ------------------
 3250|     21|          PNG_ROWBYTES(pixel_depth, row_width))
  ------------------
  |  |  755|     21|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 21, False: 0]
  |  |  ------------------
  |  |  756|     21|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|     21|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 3251|      0|      png_error(png_ptr, "internal row size calculation error");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 3252|       |
 3253|       |   /* Don't expect this to ever happen: */
 3254|     21|   if (row_width == 0)
  ------------------
  |  Branch (3254:8): [True: 0, False: 21]
  ------------------
 3255|      0|      png_error(png_ptr, "internal row width error");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 3256|       |
 3257|       |   /* Preserve the last byte in cases where only part of it will be overwritten,
 3258|       |    * the multiply below may overflow, we don't care because ANSI-C guarantees
 3259|       |    * we get the low bits.
 3260|       |    */
 3261|     21|   end_mask = (pixel_depth * row_width) & 7;
 3262|     21|   if (end_mask != 0)
  ------------------
  |  Branch (3262:8): [True: 0, False: 21]
  ------------------
 3263|      0|   {
 3264|       |      /* end_ptr == NULL is a flag to say do nothing */
 3265|      0|      end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1;
  ------------------
  |  |  755|      0|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 0, False: 0]
  |  |  ------------------
  |  |  756|      0|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|      0|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 3266|      0|      end_byte = *end_ptr;
 3267|      0|#     ifdef PNG_READ_PACKSWAP_SUPPORTED
 3268|      0|      if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  674|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3268:11): [True: 0, False: 0]
  ------------------
 3269|       |         /* little-endian byte */
 3270|      0|         end_mask = (unsigned int)(0xff << end_mask);
 3271|       |
 3272|      0|      else /* big-endian byte */
 3273|      0|#     endif
 3274|      0|      end_mask = 0xff >> end_mask;
 3275|       |      /* end_mask is now the bits to *keep* from the destination row */
 3276|      0|   }
 3277|       |
 3278|       |   /* For non-interlaced images this reduces to a memcpy(). A memcpy()
 3279|       |    * will also happen if interlacing isn't supported or if the application
 3280|       |    * does not call png_set_interlace_handling().  In the latter cases the
 3281|       |    * caller just gets a sequence of the unexpanded rows from each interlace
 3282|       |    * pass.
 3283|       |    */
 3284|     21|#ifdef PNG_READ_INTERLACING_SUPPORTED
 3285|     21|   if (png_ptr->interlaced != 0 &&
  ------------------
  |  Branch (3285:8): [True: 21, False: 0]
  ------------------
 3286|     21|       (png_ptr->transformations & PNG_INTERLACE) != 0 &&
  ------------------
  |  |  659|     21|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (3286:8): [True: 21, False: 0]
  ------------------
 3287|     21|       pass < 6 && (display == 0 ||
  ------------------
  |  Branch (3287:8): [True: 18, False: 3]
  |  Branch (3287:21): [True: 18, False: 0]
  ------------------
 3288|       |       /* The following copies everything for 'display' on passes 0, 2 and 4. */
 3289|      0|       (display == 1 && (pass & 1) != 0)))
  ------------------
  |  Branch (3289:9): [True: 0, False: 0]
  |  Branch (3289:25): [True: 0, False: 0]
  ------------------
 3290|     18|   {
 3291|       |      /* Narrow images may have no bits in a pass; the caller should handle
 3292|       |       * this, but this test is cheap:
 3293|       |       */
 3294|     18|      if (row_width <= PNG_PASS_START_COL(pass))
  ------------------
  |  | 2685|     18|#define PNG_PASS_START_COL(pass) (((1& (pass))<<(3-(((pass)+1)>>1)))&7)
  ------------------
  |  Branch (3294:11): [True: 0, False: 18]
  ------------------
 3295|      0|         return;
 3296|       |
 3297|     18|      if (pixel_depth < 8)
  ------------------
  |  Branch (3297:11): [True: 0, False: 18]
  ------------------
 3298|      0|      {
 3299|       |         /* For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit
 3300|       |          * into 32 bits, then a single loop over the bytes using the four byte
 3301|       |          * values in the 32-bit mask can be used.  For the 'display' option the
 3302|       |          * expanded mask may also not require any masking within a byte.  To
 3303|       |          * make this work the PACKSWAP option must be taken into account - it
 3304|       |          * simply requires the pixels to be reversed in each byte.
 3305|       |          *
 3306|       |          * The 'regular' case requires a mask for each of the first 6 passes,
 3307|       |          * the 'display' case does a copy for the even passes in the range
 3308|       |          * 0..6.  This has already been handled in the test above.
 3309|       |          *
 3310|       |          * The masks are arranged as four bytes with the first byte to use in
 3311|       |          * the lowest bits (little-endian) regardless of the order (PACKSWAP or
 3312|       |          * not) of the pixels in each byte.
 3313|       |          *
 3314|       |          * NOTE: the whole of this logic depends on the caller of this function
 3315|       |          * only calling it on rows appropriate to the pass.  This function only
 3316|       |          * understands the 'x' logic; the 'y' logic is handled by the caller.
 3317|       |          *
 3318|       |          * The following defines allow generation of compile time constant bit
 3319|       |          * masks for each pixel depth and each possibility of swapped or not
 3320|       |          * swapped bytes.  Pass 'p' is in the range 0..6; 'x', a pixel index,
 3321|       |          * is in the range 0..7; and the result is 1 if the pixel is to be
 3322|       |          * copied in the pass, 0 if not.  'S' is for the sparkle method, 'B'
 3323|       |          * for the block method.
 3324|       |          *
 3325|       |          * With some compilers a compile time expression of the general form:
 3326|       |          *
 3327|       |          *    (shift >= 32) ? (a >> (shift-32)) : (b >> shift)
 3328|       |          *
 3329|       |          * Produces warnings with values of 'shift' in the range 33 to 63
 3330|       |          * because the right hand side of the ?: expression is evaluated by
 3331|       |          * the compiler even though it isn't used.  Microsoft Visual C (various
 3332|       |          * versions) and the Intel C compiler are known to do this.  To avoid
 3333|       |          * this the following macros are used in 1.5.6.  This is a temporary
 3334|       |          * solution to avoid destabilizing the code during the release process.
 3335|       |          */
 3336|      0|#        if PNG_USE_COMPILE_TIME_MASKS
 3337|      0|#           define PNG_LSR(x,s) ((x)>>((s) & 0x1f))
 3338|      0|#           define PNG_LSL(x,s) ((x)<<((s) & 0x1f))
 3339|       |#        else
 3340|       |#           define PNG_LSR(x,s) ((x)>>(s))
 3341|       |#           define PNG_LSL(x,s) ((x)<<(s))
 3342|       |#        endif
 3343|      0|#        define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\
 3344|      0|           PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1)
 3345|      0|#        define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\
 3346|      0|           PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1)
 3347|       |
 3348|       |         /* Return a mask for pass 'p' pixel 'x' at depth 'd'.  The mask is
 3349|       |          * little endian - the first pixel is at bit 0 - however the extra
 3350|       |          * parameter 's' can be set to cause the mask position to be swapped
 3351|       |          * within each byte, to match the PNG format.  This is done by XOR of
 3352|       |          * the shift with 7, 6 or 4 for bit depths 1, 2 and 4.
 3353|       |          */
 3354|      0|#        define PIXEL_MASK(p,x,d,s) \
 3355|      0|            (PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0))))
 3356|       |
 3357|       |         /* Hence generate the appropriate 'block' or 'sparkle' pixel copy mask.
 3358|       |          */
 3359|      0|#        define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
 3360|      0|#        define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
 3361|       |
 3362|       |         /* Combine 8 of these to get the full mask.  For the 1-bpp and 2-bpp
 3363|       |          * cases the result needs replicating, for the 4-bpp case the above
 3364|       |          * generates a full 32 bits.
 3365|       |          */
 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
 3367|       |
 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
 3371|       |
 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
 3375|       |
 3376|      0|#if PNG_USE_COMPILE_TIME_MASKS
 3377|       |         /* Utility macros to construct all the masks for a depth/swap
 3378|       |          * combination.  The 's' parameter says whether the format is PNG
 3379|       |          * (big endian bytes) or not.  Only the three odd-numbered passes are
 3380|       |          * required for the display/block algorithm.
 3381|       |          */
 3382|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
 3383|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
 3384|       |
 3385|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
 3386|       |
 3387|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
 3388|       |
 3389|       |         /* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and
 3390|       |          * then pass:
 3391|       |          */
 3392|      0|         static const png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] =
 3393|      0|         {
 3394|       |            /* Little-endian byte masks for PACKSWAP */
 3395|      0|            { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
  ------------------
  |  | 3382|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3383|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
  ------------------
  |  | 3382|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3383|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
  ------------------
  |  | 3382|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3383|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
 3396|       |            /* Normal (big-endian byte) masks - PNG format */
 3397|      0|            { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
  ------------------
  |  | 3382|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3383|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
  ------------------
  |  | 3382|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3383|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
  ------------------
  |  | 3382|      0|#        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  | 3383|      0|            S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |                           S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3368|      0|#        define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3369|      0|            S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
  |  |  |  | 3370|      0|            S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
 3398|      0|         };
 3399|       |
 3400|       |         /* display_mask has only three entries for the odd passes, so index by
 3401|       |          * pass>>1.
 3402|       |          */
 3403|      0|         static const png_uint_32 display_mask[2][3][3] =
 3404|      0|         {
 3405|       |            /* Little-endian byte masks for PACKSWAP */
 3406|      0|            { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
  ------------------
  |  | 3385|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
  ------------------
  |  | 3385|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
  ------------------
  |  | 3385|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
 3407|       |            /* Normal (big-endian byte) masks - PNG format */
 3408|      0|            { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
  ------------------
  |  | 3385|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
  ------------------
  |  | 3385|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [True: 0, Folded]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
                          { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
  ------------------
  |  | 3385|      0|#        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  |  |               #        define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
  |  |  ------------------
  |  |  |  | 3372|      0|#        define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
  |  |  |  |  ------------------
  |  |  |  |  |  | 3366|      0|#        define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:36): [True: 0, Folded]
  |  |  |  |  |  |  |  Branch (3366:40): [Folded, False: 0]
  |  |  |  |  |  |  |  Branch (3366:59): [Folded, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  | 3373|      0|            B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
  |  |  |  | 3374|      0|            B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
  |  |  ------------------
  ------------------
 3409|      0|         };
 3410|       |
 3411|      0|#        define MASK(pass,depth,display,png)\
 3412|      0|            ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
 3413|      0|               row_mask[png][DEPTH_INDEX(depth)][pass])
 3414|       |
 3415|       |#else /* !PNG_USE_COMPILE_TIME_MASKS */
 3416|       |         /* This is the runtime alternative: it seems unlikely that this will
 3417|       |          * ever be either smaller or faster than the compile time approach.
 3418|       |          */
 3419|       |#        define MASK(pass,depth,display,png)\
 3420|       |            ((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png))
 3421|       |#endif /* !USE_COMPILE_TIME_MASKS */
 3422|       |
 3423|       |         /* Use the appropriate mask to copy the required bits.  In some cases
 3424|       |          * the byte mask will be 0 or 0xff; optimize these cases.  row_width is
 3425|       |          * the number of pixels, but the code copies bytes, so it is necessary
 3426|       |          * to special case the end.
 3427|       |          */
 3428|      0|         png_uint_32 pixels_per_byte = 8 / pixel_depth;
 3429|      0|         png_uint_32 mask;
 3430|       |
 3431|      0|#        ifdef PNG_READ_PACKSWAP_SUPPORTED
 3432|      0|         if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  674|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3432:14): [True: 0, False: 0]
  ------------------
 3433|      0|            mask = MASK(pass, pixel_depth, display, 0);
  ------------------
  |  | 3412|      0|            ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
  |  |  ------------------
  |  |  |  | 3387|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3387:33): [True: 0, False: 0]
  |  |  |  |  |  Branch (3387:43): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  |  Branch (3412:14): [True: 0, False: 0]
  |  |  ------------------
  |  | 3413|      0|               row_mask[png][DEPTH_INDEX(depth)][pass])
  |  |  ------------------
  |  |  |  | 3387|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3387:33): [True: 0, False: 0]
  |  |  |  |  |  Branch (3387:43): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 3434|       |
 3435|      0|         else
 3436|      0|#        endif
 3437|      0|         mask = MASK(pass, pixel_depth, display, 1);
  ------------------
  |  | 3412|      0|            ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
  |  |  ------------------
  |  |  |  | 3387|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3387:33): [True: 0, False: 0]
  |  |  |  |  |  Branch (3387:43): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  |  Branch (3412:14): [True: 0, False: 0]
  |  |  ------------------
  |  | 3413|      0|               row_mask[png][DEPTH_INDEX(depth)][pass])
  |  |  ------------------
  |  |  |  | 3387|      0|#        define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3387:33): [True: 0, False: 0]
  |  |  |  |  |  Branch (3387:43): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 3438|       |
 3439|      0|         for (;;)
 3440|      0|         {
 3441|      0|            png_uint_32 m;
 3442|       |
 3443|       |            /* It doesn't matter in the following if png_uint_32 has more than
 3444|       |             * 32 bits because the high bits always match those in m<<24; it is,
 3445|       |             * however, essential to use OR here, not +, because of this.
 3446|       |             */
 3447|      0|            m = mask;
 3448|      0|            mask = (m >> 8) | (m << 24); /* rotate right to good compilers */
 3449|      0|            m &= 0xff;
 3450|       |
 3451|      0|            if (m != 0) /* something to copy */
  ------------------
  |  Branch (3451:17): [True: 0, False: 0]
  ------------------
 3452|      0|            {
 3453|      0|               if (m != 0xff)
  ------------------
  |  Branch (3453:20): [True: 0, False: 0]
  ------------------
 3454|      0|                  *dp = (png_byte)((*dp & ~m) | (*sp & m));
 3455|      0|               else
 3456|      0|                  *dp = *sp;
 3457|      0|            }
 3458|       |
 3459|       |            /* NOTE: this may overwrite the last byte with garbage if the image
 3460|       |             * is not an exact number of bytes wide; libpng has always done
 3461|       |             * this.
 3462|       |             */
 3463|      0|            if (row_width <= pixels_per_byte)
  ------------------
  |  Branch (3463:17): [True: 0, False: 0]
  ------------------
 3464|      0|               break; /* May need to restore part of the last byte */
 3465|       |
 3466|      0|            row_width -= pixels_per_byte;
 3467|      0|            ++dp;
 3468|      0|            ++sp;
 3469|      0|         }
 3470|      0|      }
 3471|       |
 3472|     18|      else /* pixel_depth >= 8 */
 3473|     18|      {
 3474|     18|         unsigned int bytes_to_copy, bytes_to_jump;
 3475|       |
 3476|       |         /* Validate the depth - it must be a multiple of 8 */
 3477|     18|         if (pixel_depth & 7)
  ------------------
  |  Branch (3477:14): [True: 0, False: 18]
  ------------------
 3478|      0|            png_error(png_ptr, "invalid user transform pixel depth");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 3479|       |
 3480|     18|         pixel_depth >>= 3; /* now in bytes */
 3481|     18|         row_width *= pixel_depth;
 3482|       |
 3483|       |         /* Regardless of pass number the Adam 7 interlace always results in a
 3484|       |          * fixed number of pixels to copy then to skip.  There may be a
 3485|       |          * different number of pixels to skip at the start though.
 3486|       |          */
 3487|     18|         {
 3488|     18|            unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth;
  ------------------
  |  | 2685|     18|#define PNG_PASS_START_COL(pass) (((1& (pass))<<(3-(((pass)+1)>>1)))&7)
  ------------------
 3489|       |
 3490|     18|            row_width -= offset;
 3491|     18|            dp += offset;
 3492|     18|            sp += offset;
 3493|     18|         }
 3494|       |
 3495|       |         /* Work out the bytes to copy. */
 3496|     18|         if (display != 0)
  ------------------
  |  Branch (3496:14): [True: 0, False: 18]
  ------------------
 3497|      0|         {
 3498|       |            /* When doing the 'block' algorithm the pixel in the pass gets
 3499|       |             * replicated to adjacent pixels.  This is why the even (0,2,4,6)
 3500|       |             * passes are skipped above - the entire expanded row is copied.
 3501|       |             */
 3502|      0|            bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth;
 3503|       |
 3504|       |            /* But don't allow this number to exceed the actual row width. */
 3505|      0|            if (bytes_to_copy > row_width)
  ------------------
  |  Branch (3505:17): [True: 0, False: 0]
  ------------------
 3506|      0|               bytes_to_copy = (unsigned int)/*SAFE*/row_width;
 3507|      0|         }
 3508|       |
 3509|     18|         else /* normal row; Adam7 only ever gives us one pixel to copy. */
 3510|     18|            bytes_to_copy = pixel_depth;
 3511|       |
 3512|       |         /* In Adam7 there is a constant offset between where the pixels go. */
 3513|     18|         bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;
  ------------------
  |  | 2693|     18|#define PNG_PASS_COL_OFFSET(pass) (1<<((7-(pass))>>1))
  ------------------
 3514|       |
 3515|       |         /* And simply copy these bytes.  Some optimization is possible here,
 3516|       |          * depending on the value of 'bytes_to_copy'.  Special case the low
 3517|       |          * byte counts, which we know to be frequent.
 3518|       |          *
 3519|       |          * Notice that these cases all 'return' rather than 'break' - this
 3520|       |          * avoids an unnecessary test on whether to restore the last byte
 3521|       |          * below.
 3522|       |          */
 3523|     18|         switch (bytes_to_copy)
 3524|     18|         {
 3525|      0|            case 1:
  ------------------
  |  Branch (3525:13): [True: 0, False: 18]
  ------------------
 3526|      0|               for (;;)
 3527|      0|               {
 3528|      0|                  *dp = *sp;
 3529|       |
 3530|      0|                  if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3530:23): [True: 0, False: 0]
  ------------------
 3531|      0|                     return;
 3532|       |
 3533|      0|                  dp += bytes_to_jump;
 3534|      0|                  sp += bytes_to_jump;
 3535|      0|                  row_width -= bytes_to_jump;
 3536|      0|               }
 3537|       |
 3538|      0|            case 2:
  ------------------
  |  Branch (3538:13): [True: 0, False: 18]
  ------------------
 3539|       |               /* There is a possibility of a partial copy at the end here; this
 3540|       |                * slows the code down somewhat.
 3541|       |                */
 3542|      0|               do
 3543|      0|               {
 3544|      0|                  dp[0] = sp[0]; dp[1] = sp[1];
 3545|       |
 3546|      0|                  if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3546:23): [True: 0, False: 0]
  ------------------
 3547|      0|                     return;
 3548|       |
 3549|      0|                  sp += bytes_to_jump;
 3550|      0|                  dp += bytes_to_jump;
 3551|      0|                  row_width -= bytes_to_jump;
 3552|      0|               }
 3553|      0|               while (row_width > 1);
  ------------------
  |  Branch (3553:23): [True: 0, False: 0]
  ------------------
 3554|       |
 3555|       |               /* And there can only be one byte left at this point: */
 3556|      0|               *dp = *sp;
 3557|      0|               return;
 3558|       |
 3559|     18|            case 3:
  ------------------
  |  Branch (3559:13): [True: 18, False: 0]
  ------------------
 3560|       |               /* This can only be the RGB case, so each copy is exactly one
 3561|       |                * pixel and it is not necessary to check for a partial copy.
 3562|       |                */
 3563|     18|               for (;;)
 3564|    138|               {
 3565|    138|                  dp[0] = sp[0]; dp[1] = sp[1]; dp[2] = sp[2];
 3566|       |
 3567|    138|                  if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3567:23): [True: 18, False: 120]
  ------------------
 3568|     18|                     return;
 3569|       |
 3570|    120|                  sp += bytes_to_jump;
 3571|    120|                  dp += bytes_to_jump;
 3572|    120|                  row_width -= bytes_to_jump;
 3573|    120|               }
 3574|       |
 3575|      0|            default:
  ------------------
  |  Branch (3575:13): [True: 0, False: 18]
  ------------------
 3576|      0|#if PNG_ALIGN_TYPE != PNG_ALIGN_NONE
 3577|       |               /* Check for double byte alignment and, if possible, use a
 3578|       |                * 16-bit copy.  Don't attempt this for narrow images - ones that
 3579|       |                * are less than an interlace panel wide.  Don't attempt it for
 3580|       |                * wide bytes_to_copy either - use the memcpy there.
 3581|       |                */
 3582|      0|               if (bytes_to_copy < 16 /*else use memcpy*/ &&
  ------------------
  |  Branch (3582:20): [True: 0, False: 0]
  ------------------
 3583|      0|                   png_isaligned(dp, png_uint_16) &&
  ------------------
  |  |  623|      0|   (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0)
  |  |  ------------------
  |  |  |  |  608|      0|#  define png_alignof(type) (sizeof(type))
  |  |  ------------------
  |  |  |  Branch (623:4): [True: 0, False: 0]
  |  |  ------------------
  ------------------
 3584|      0|                   png_isaligned(sp, png_uint_16) &&
  ------------------
  |  |  623|      0|   (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0)
  |  |  ------------------
  |  |  |  |  608|      0|#  define png_alignof(type) (sizeof(type))
  |  |  ------------------
  |  |  |  Branch (623:4): [True: 0, False: 0]
  |  |  ------------------
  ------------------
 3585|      0|                   bytes_to_copy % (sizeof (png_uint_16)) == 0 &&
  ------------------
  |  Branch (3585:20): [True: 0, False: 0]
  ------------------
 3586|      0|                   bytes_to_jump % (sizeof (png_uint_16)) == 0)
  ------------------
  |  Branch (3586:20): [True: 0, False: 0]
  ------------------
 3587|      0|               {
 3588|       |                  /* Everything is aligned for png_uint_16 copies, but try for
 3589|       |                   * png_uint_32 first.
 3590|       |                   */
 3591|      0|                  if (png_isaligned(dp, png_uint_32) &&
  ------------------
  |  |  623|      0|   (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0)
  |  |  ------------------
  |  |  |  |  608|      0|#  define png_alignof(type) (sizeof(type))
  |  |  ------------------
  |  |  |  Branch (623:4): [True: 0, False: 0]
  |  |  ------------------
  ------------------
 3592|      0|                      png_isaligned(sp, png_uint_32) &&
  ------------------
  |  |  623|      0|   (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0)
  |  |  ------------------
  |  |  |  |  608|      0|#  define png_alignof(type) (sizeof(type))
  |  |  ------------------
  |  |  |  Branch (623:4): [True: 0, False: 0]
  |  |  ------------------
  ------------------
 3593|      0|                      bytes_to_copy % (sizeof (png_uint_32)) == 0 &&
  ------------------
  |  Branch (3593:23): [True: 0, False: 0]
  ------------------
 3594|      0|                      bytes_to_jump % (sizeof (png_uint_32)) == 0)
  ------------------
  |  Branch (3594:23): [True: 0, False: 0]
  ------------------
 3595|      0|                  {
 3596|      0|                     png_uint_32p dp32 = png_aligncast(png_uint_32p,dp);
  ------------------
  |  |  537|      0|#  define png_aligncast(type, value) ((void*)(value))
  ------------------
 3597|      0|                     png_const_uint_32p sp32 = png_aligncastconst(
  ------------------
  |  |  538|      0|#  define png_aligncastconst(type, value) ((const void*)(value))
  ------------------
 3598|      0|                         png_const_uint_32p, sp);
 3599|      0|                     size_t skip = (bytes_to_jump-bytes_to_copy) /
 3600|      0|                         (sizeof (png_uint_32));
 3601|       |
 3602|      0|                     do
 3603|      0|                     {
 3604|      0|                        size_t c = bytes_to_copy;
 3605|      0|                        do
 3606|      0|                        {
 3607|      0|                           *dp32++ = *sp32++;
 3608|      0|                           c -= (sizeof (png_uint_32));
 3609|      0|                        }
 3610|      0|                        while (c > 0);
  ------------------
  |  Branch (3610:32): [True: 0, False: 0]
  ------------------
 3611|       |
 3612|      0|                        if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3612:29): [True: 0, False: 0]
  ------------------
 3613|      0|                           return;
 3614|       |
 3615|      0|                        dp32 += skip;
 3616|      0|                        sp32 += skip;
 3617|      0|                        row_width -= bytes_to_jump;
 3618|      0|                     }
 3619|      0|                     while (bytes_to_copy <= row_width);
  ------------------
  |  Branch (3619:29): [True: 0, False: 0]
  ------------------
 3620|       |
 3621|       |                     /* Get to here when the row_width truncates the final copy.
 3622|       |                      * There will be 1-3 bytes left to copy, so don't try the
 3623|       |                      * 16-bit loop below.
 3624|       |                      */
 3625|      0|                     dp = (png_bytep)dp32;
 3626|      0|                     sp = (png_const_bytep)sp32;
 3627|      0|                     do
 3628|      0|                        *dp++ = *sp++;
 3629|      0|                     while (--row_width > 0);
  ------------------
  |  Branch (3629:29): [True: 0, False: 0]
  ------------------
 3630|      0|                     return;
 3631|      0|                  }
 3632|       |
 3633|       |                  /* Else do it in 16-bit quantities, but only if the size is
 3634|       |                   * not too large.
 3635|       |                   */
 3636|      0|                  else
 3637|      0|                  {
 3638|      0|                     png_uint_16p dp16 = png_aligncast(png_uint_16p, dp);
  ------------------
  |  |  537|      0|#  define png_aligncast(type, value) ((void*)(value))
  ------------------
 3639|      0|                     png_const_uint_16p sp16 = png_aligncastconst(
  ------------------
  |  |  538|      0|#  define png_aligncastconst(type, value) ((const void*)(value))
  ------------------
 3640|      0|                        png_const_uint_16p, sp);
 3641|      0|                     size_t skip = (bytes_to_jump-bytes_to_copy) /
 3642|      0|                        (sizeof (png_uint_16));
 3643|       |
 3644|      0|                     do
 3645|      0|                     {
 3646|      0|                        size_t c = bytes_to_copy;
 3647|      0|                        do
 3648|      0|                        {
 3649|      0|                           *dp16++ = *sp16++;
 3650|      0|                           c -= (sizeof (png_uint_16));
 3651|      0|                        }
 3652|      0|                        while (c > 0);
  ------------------
  |  Branch (3652:32): [True: 0, False: 0]
  ------------------
 3653|       |
 3654|      0|                        if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3654:29): [True: 0, False: 0]
  ------------------
 3655|      0|                           return;
 3656|       |
 3657|      0|                        dp16 += skip;
 3658|      0|                        sp16 += skip;
 3659|      0|                        row_width -= bytes_to_jump;
 3660|      0|                     }
 3661|      0|                     while (bytes_to_copy <= row_width);
  ------------------
  |  Branch (3661:29): [True: 0, False: 0]
  ------------------
 3662|       |
 3663|       |                     /* End of row - 1 byte left, bytes_to_copy > row_width: */
 3664|      0|                     dp = (png_bytep)dp16;
 3665|      0|                     sp = (png_const_bytep)sp16;
 3666|      0|                     do
 3667|      0|                        *dp++ = *sp++;
 3668|      0|                     while (--row_width > 0);
  ------------------
  |  Branch (3668:29): [True: 0, False: 0]
  ------------------
 3669|      0|                     return;
 3670|      0|                  }
 3671|      0|               }
 3672|      0|#endif /* ALIGN_TYPE code */
 3673|       |
 3674|       |               /* The true default - use a memcpy: */
 3675|      0|               for (;;)
 3676|      0|               {
 3677|      0|                  memcpy(dp, sp, bytes_to_copy);
 3678|       |
 3679|      0|                  if (row_width <= bytes_to_jump)
  ------------------
  |  Branch (3679:23): [True: 0, False: 0]
  ------------------
 3680|      0|                     return;
 3681|       |
 3682|      0|                  sp += bytes_to_jump;
 3683|      0|                  dp += bytes_to_jump;
 3684|      0|                  row_width -= bytes_to_jump;
 3685|      0|                  if (bytes_to_copy > row_width)
  ------------------
  |  Branch (3685:23): [True: 0, False: 0]
  ------------------
 3686|      0|                     bytes_to_copy = (unsigned int)/*SAFE*/row_width;
 3687|      0|               }
 3688|     18|         }
 3689|       |
 3690|       |         /* NOT REACHED*/
 3691|     18|      } /* pixel_depth >= 8 */
 3692|       |
 3693|       |      /* Here if pixel_depth < 8 to check 'end_ptr' below. */
 3694|     18|   }
 3695|      3|   else
 3696|      3|#endif /* READ_INTERLACING */
 3697|       |
 3698|       |   /* If here then the switch above wasn't used so just memcpy the whole row
 3699|       |    * from the temporary row buffer (notice that this overwrites the end of the
 3700|       |    * destination row if it is a partial byte.)
 3701|       |    */
 3702|      3|   memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width));
  ------------------
  |  |  755|      3|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 3, False: 0]
  |  |  ------------------
  |  |  756|      3|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|      3|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 3703|       |
 3704|       |   /* Restore the overwritten bits from the last byte if necessary. */
 3705|      3|   if (end_ptr != NULL)
  ------------------
  |  Branch (3705:8): [True: 0, False: 3]
  ------------------
 3706|      0|      *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask));
 3707|      3|}
OSS_FUZZ_png_do_read_interlace:
 3713|     18|{
 3714|     18|   png_debug(1, "in png_do_read_interlace");
  ------------------
  |  |  145|     18|#  define png_debug(l, m) ((void)0)
  ------------------
 3715|     18|   if (row != NULL && row_info != NULL)
  ------------------
  |  Branch (3715:8): [True: 18, False: 0]
  |  Branch (3715:23): [True: 18, False: 0]
  ------------------
 3716|     18|   {
 3717|     18|      png_uint_32 final_width;
 3718|       |
 3719|     18|      final_width = row_info->width * png_pass_inc[pass];
 3720|       |
 3721|     18|      switch (row_info->pixel_depth)
 3722|     18|      {
 3723|      0|         case 1:
  ------------------
  |  Branch (3723:10): [True: 0, False: 18]
  ------------------
 3724|      0|         {
 3725|      0|            png_bytep sp = row + (size_t)((row_info->width - 1) >> 3);
 3726|      0|            png_bytep dp = row + (size_t)((final_width - 1) >> 3);
 3727|      0|            unsigned int sshift, dshift;
 3728|      0|            unsigned int s_start, s_end;
 3729|      0|            int s_inc;
 3730|      0|            int jstop = (int)png_pass_inc[pass];
 3731|      0|            png_byte v;
 3732|      0|            png_uint_32 i;
 3733|      0|            int j;
 3734|       |
 3735|      0|#ifdef PNG_READ_PACKSWAP_SUPPORTED
 3736|      0|            if ((transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  674|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3736:17): [True: 0, False: 0]
  ------------------
 3737|      0|            {
 3738|      0|                sshift = ((row_info->width + 7) & 0x07);
 3739|      0|                dshift = ((final_width + 7) & 0x07);
 3740|      0|                s_start = 7;
 3741|      0|                s_end = 0;
 3742|      0|                s_inc = -1;
 3743|      0|            }
 3744|       |
 3745|      0|            else
 3746|      0|#endif
 3747|      0|            {
 3748|      0|                sshift = 7 - ((row_info->width + 7) & 0x07);
 3749|      0|                dshift = 7 - ((final_width + 7) & 0x07);
 3750|      0|                s_start = 0;
 3751|      0|                s_end = 7;
 3752|      0|                s_inc = 1;
 3753|      0|            }
 3754|       |
 3755|      0|            for (i = 0; i < row_info->width; i++)
  ------------------
  |  Branch (3755:25): [True: 0, False: 0]
  ------------------
 3756|      0|            {
 3757|      0|               v = (png_byte)((*sp >> sshift) & 0x01);
 3758|      0|               for (j = 0; j < jstop; j++)
  ------------------
  |  Branch (3758:28): [True: 0, False: 0]
  ------------------
 3759|      0|               {
 3760|      0|                  unsigned int tmp = *dp & (0x7f7f >> (7 - dshift));
 3761|      0|                  tmp |= (unsigned int)(v << dshift);
 3762|      0|                  *dp = (png_byte)(tmp & 0xff);
 3763|       |
 3764|      0|                  if (dshift == s_end)
  ------------------
  |  Branch (3764:23): [True: 0, False: 0]
  ------------------
 3765|      0|                  {
 3766|      0|                     dshift = s_start;
 3767|      0|                     dp--;
 3768|      0|                  }
 3769|       |
 3770|      0|                  else
 3771|      0|                     dshift = (unsigned int)((int)dshift + s_inc);
 3772|      0|               }
 3773|       |
 3774|      0|               if (sshift == s_end)
  ------------------
  |  Branch (3774:20): [True: 0, False: 0]
  ------------------
 3775|      0|               {
 3776|      0|                  sshift = s_start;
 3777|      0|                  sp--;
 3778|      0|               }
 3779|       |
 3780|      0|               else
 3781|      0|                  sshift = (unsigned int)((int)sshift + s_inc);
 3782|      0|            }
 3783|      0|            break;
 3784|      0|         }
 3785|       |
 3786|      0|         case 2:
  ------------------
  |  Branch (3786:10): [True: 0, False: 18]
  ------------------
 3787|      0|         {
 3788|      0|            png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2);
 3789|      0|            png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2);
 3790|      0|            unsigned int sshift, dshift;
 3791|      0|            unsigned int s_start, s_end;
 3792|      0|            int s_inc;
 3793|      0|            int jstop = (int)png_pass_inc[pass];
 3794|      0|            png_uint_32 i;
 3795|       |
 3796|      0|#ifdef PNG_READ_PACKSWAP_SUPPORTED
 3797|      0|            if ((transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  674|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3797:17): [True: 0, False: 0]
  ------------------
 3798|      0|            {
 3799|      0|               sshift = (((row_info->width + 3) & 0x03) << 1);
 3800|      0|               dshift = (((final_width + 3) & 0x03) << 1);
 3801|      0|               s_start = 6;
 3802|      0|               s_end = 0;
 3803|      0|               s_inc = -2;
 3804|      0|            }
 3805|       |
 3806|      0|            else
 3807|      0|#endif
 3808|      0|            {
 3809|      0|               sshift = ((3 - ((row_info->width + 3) & 0x03)) << 1);
 3810|      0|               dshift = ((3 - ((final_width + 3) & 0x03)) << 1);
 3811|      0|               s_start = 0;
 3812|      0|               s_end = 6;
 3813|      0|               s_inc = 2;
 3814|      0|            }
 3815|       |
 3816|      0|            for (i = 0; i < row_info->width; i++)
  ------------------
  |  Branch (3816:25): [True: 0, False: 0]
  ------------------
 3817|      0|            {
 3818|      0|               png_byte v;
 3819|      0|               int j;
 3820|       |
 3821|      0|               v = (png_byte)((*sp >> sshift) & 0x03);
 3822|      0|               for (j = 0; j < jstop; j++)
  ------------------
  |  Branch (3822:28): [True: 0, False: 0]
  ------------------
 3823|      0|               {
 3824|      0|                  unsigned int tmp = *dp & (0x3f3f >> (6 - dshift));
 3825|      0|                  tmp |= (unsigned int)(v << dshift);
 3826|      0|                  *dp = (png_byte)(tmp & 0xff);
 3827|       |
 3828|      0|                  if (dshift == s_end)
  ------------------
  |  Branch (3828:23): [True: 0, False: 0]
  ------------------
 3829|      0|                  {
 3830|      0|                     dshift = s_start;
 3831|      0|                     dp--;
 3832|      0|                  }
 3833|       |
 3834|      0|                  else
 3835|      0|                     dshift = (unsigned int)((int)dshift + s_inc);
 3836|      0|               }
 3837|       |
 3838|      0|               if (sshift == s_end)
  ------------------
  |  Branch (3838:20): [True: 0, False: 0]
  ------------------
 3839|      0|               {
 3840|      0|                  sshift = s_start;
 3841|      0|                  sp--;
 3842|      0|               }
 3843|       |
 3844|      0|               else
 3845|      0|                  sshift = (unsigned int)((int)sshift + s_inc);
 3846|      0|            }
 3847|      0|            break;
 3848|      0|         }
 3849|       |
 3850|      0|         case 4:
  ------------------
  |  Branch (3850:10): [True: 0, False: 18]
  ------------------
 3851|      0|         {
 3852|      0|            png_bytep sp = row + (size_t)((row_info->width - 1) >> 1);
 3853|      0|            png_bytep dp = row + (size_t)((final_width - 1) >> 1);
 3854|      0|            unsigned int sshift, dshift;
 3855|      0|            unsigned int s_start, s_end;
 3856|      0|            int s_inc;
 3857|      0|            png_uint_32 i;
 3858|      0|            int jstop = (int)png_pass_inc[pass];
 3859|       |
 3860|      0|#ifdef PNG_READ_PACKSWAP_SUPPORTED
 3861|      0|            if ((transformations & PNG_PACKSWAP) != 0)
  ------------------
  |  |  674|      0|#define PNG_PACKSWAP           0x10000U
  ------------------
  |  Branch (3861:17): [True: 0, False: 0]
  ------------------
 3862|      0|            {
 3863|      0|               sshift = (((row_info->width + 1) & 0x01) << 2);
 3864|      0|               dshift = (((final_width + 1) & 0x01) << 2);
 3865|      0|               s_start = 4;
 3866|      0|               s_end = 0;
 3867|      0|               s_inc = -4;
 3868|      0|            }
 3869|       |
 3870|      0|            else
 3871|      0|#endif
 3872|      0|            {
 3873|      0|               sshift = ((1 - ((row_info->width + 1) & 0x01)) << 2);
 3874|      0|               dshift = ((1 - ((final_width + 1) & 0x01)) << 2);
 3875|      0|               s_start = 0;
 3876|      0|               s_end = 4;
 3877|      0|               s_inc = 4;
 3878|      0|            }
 3879|       |
 3880|      0|            for (i = 0; i < row_info->width; i++)
  ------------------
  |  Branch (3880:25): [True: 0, False: 0]
  ------------------
 3881|      0|            {
 3882|      0|               png_byte v = (png_byte)((*sp >> sshift) & 0x0f);
 3883|      0|               int j;
 3884|       |
 3885|      0|               for (j = 0; j < jstop; j++)
  ------------------
  |  Branch (3885:28): [True: 0, False: 0]
  ------------------
 3886|      0|               {
 3887|      0|                  unsigned int tmp = *dp & (0xf0f >> (4 - dshift));
 3888|      0|                  tmp |= (unsigned int)(v << dshift);
 3889|      0|                  *dp = (png_byte)(tmp & 0xff);
 3890|       |
 3891|      0|                  if (dshift == s_end)
  ------------------
  |  Branch (3891:23): [True: 0, False: 0]
  ------------------
 3892|      0|                  {
 3893|      0|                     dshift = s_start;
 3894|      0|                     dp--;
 3895|      0|                  }
 3896|       |
 3897|      0|                  else
 3898|      0|                     dshift = (unsigned int)((int)dshift + s_inc);
 3899|      0|               }
 3900|       |
 3901|      0|               if (sshift == s_end)
  ------------------
  |  Branch (3901:20): [True: 0, False: 0]
  ------------------
 3902|      0|               {
 3903|      0|                  sshift = s_start;
 3904|      0|                  sp--;
 3905|      0|               }
 3906|       |
 3907|      0|               else
 3908|      0|                  sshift = (unsigned int)((int)sshift + s_inc);
 3909|      0|            }
 3910|      0|            break;
 3911|      0|         }
 3912|       |
 3913|     18|         default:
  ------------------
  |  Branch (3913:10): [True: 18, False: 0]
  ------------------
 3914|     18|         {
 3915|     18|            size_t pixel_bytes = (row_info->pixel_depth >> 3);
 3916|       |
 3917|     18|            png_bytep sp = row + (size_t)(row_info->width - 1)
 3918|     18|                * pixel_bytes;
 3919|       |
 3920|     18|            png_bytep dp = row + (size_t)(final_width - 1) * pixel_bytes;
 3921|       |
 3922|     18|            int jstop = (int)png_pass_inc[pass];
 3923|     18|            png_uint_32 i;
 3924|       |
 3925|    156|            for (i = 0; i < row_info->width; i++)
  ------------------
  |  Branch (3925:25): [True: 138, False: 18]
  ------------------
 3926|    138|            {
 3927|    138|               png_byte v[8]; /* SAFE; pixel_depth does not exceed 64 */
 3928|    138|               int j;
 3929|       |
 3930|    138|               memcpy(v, sp, pixel_bytes);
 3931|       |
 3932|    558|               for (j = 0; j < jstop; j++)
  ------------------
  |  Branch (3932:28): [True: 420, False: 138]
  ------------------
 3933|    420|               {
 3934|    420|                  memcpy(dp, v, pixel_bytes);
 3935|    420|                  dp -= pixel_bytes;
 3936|    420|               }
 3937|       |
 3938|    138|               sp -= pixel_bytes;
 3939|    138|            }
 3940|     18|            break;
 3941|      0|         }
 3942|     18|      }
 3943|       |
 3944|     18|      row_info->width = final_width;
 3945|     18|      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);
  ------------------
  |  |  755|     18|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 18, False: 0]
  |  |  ------------------
  |  |  756|     18|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|     18|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 3946|     18|   }
 3947|       |#ifndef PNG_READ_PACKSWAP_SUPPORTED
 3948|       |   PNG_UNUSED(transformations)  /* Silence compiler warning */
 3949|       |#endif
 3950|     18|}
OSS_FUZZ_png_read_filter_row:
 4156|     21|{
 4157|       |   /* OPTIMIZATION: DO NOT MODIFY THIS FUNCTION, instead #define
 4158|       |    * PNG_FILTER_OPTIMIZATIONS to a function that overrides the generic
 4159|       |    * implementations.  See png_init_filter_functions above.
 4160|       |    */
 4161|     21|   if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
  ------------------
  |  | 1541|     42|#define PNG_FILTER_VALUE_NONE  0
  ------------------
                 if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
  ------------------
  |  | 1546|     21|#define PNG_FILTER_VALUE_LAST  5
  ------------------
  |  Branch (4161:8): [True: 21, False: 0]
  |  Branch (4161:42): [True: 21, False: 0]
  ------------------
 4162|     21|   {
 4163|     21|      if (pp->read_filter[0] == NULL)
  ------------------
  |  Branch (4163:11): [True: 3, False: 18]
  ------------------
 4164|      3|         png_init_filter_functions(pp);
 4165|       |
 4166|     21|      pp->read_filter[filter-1](row_info, row, prev_row);
 4167|     21|   }
 4168|     21|}
OSS_FUZZ_png_read_IDAT_data:
 4174|     24|{
 4175|       |   /* Loop reading IDATs and decompressing the result into output[avail_out] */
 4176|     24|   png_ptr->zstream.next_out = output;
 4177|     24|   png_ptr->zstream.avail_out = 0; /* safety: set below */
 4178|       |
 4179|     24|   if (output == NULL)
  ------------------
  |  Branch (4179:8): [True: 3, False: 21]
  ------------------
 4180|      3|      avail_out = 0;
 4181|       |
 4182|     24|   do
 4183|     24|   {
 4184|     24|      int ret;
 4185|     24|      png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
 4186|       |
 4187|     24|      if (png_ptr->zstream.avail_in == 0)
  ------------------
  |  Branch (4187:11): [True: 3, False: 21]
  ------------------
 4188|      3|      {
 4189|      3|         uInt avail_in;
 4190|      3|         png_bytep buffer;
 4191|       |
 4192|      3|         while (png_ptr->idat_size == 0)
  ------------------
  |  Branch (4192:17): [True: 0, False: 3]
  ------------------
 4193|      0|         {
 4194|      0|            png_crc_finish(png_ptr, 0);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 4195|       |
 4196|      0|            png_ptr->idat_size = png_read_chunk_header(png_ptr);
  ------------------
  |  |   22|      0|#define png_read_chunk_header OSS_FUZZ_png_read_chunk_header
  ------------------
 4197|       |            /* This is an error even in the 'check' case because the code just
 4198|       |             * consumed a non-IDAT header.
 4199|       |             */
 4200|      0|            if (png_ptr->chunk_name != png_IDAT)
  ------------------
  |  |  886|      0|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (4200:17): [True: 0, False: 0]
  ------------------
 4201|      0|               png_error(png_ptr, "Not enough image data");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4202|      0|         }
 4203|       |
 4204|      3|         avail_in = png_ptr->IDAT_read_size;
 4205|       |
 4206|      3|         if (avail_in > png_chunk_max(png_ptr))
  ------------------
  |  | 1126|      3|#  define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max)
  ------------------
  |  Branch (4206:14): [True: 0, False: 3]
  ------------------
 4207|      0|            avail_in = (uInt)/*SAFE*/png_chunk_max(png_ptr);
  ------------------
  |  | 1126|      0|#  define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max)
  ------------------
 4208|       |
 4209|      3|         if (avail_in > png_ptr->idat_size)
  ------------------
  |  Branch (4209:14): [True: 3, False: 0]
  ------------------
 4210|      3|            avail_in = (uInt)png_ptr->idat_size;
 4211|       |
 4212|       |         /* A PNG with a gradually increasing IDAT size will defeat this attempt
 4213|       |          * to minimize memory usage by causing lots of re-allocs, but
 4214|       |          * realistically doing IDAT_read_size re-allocs is not likely to be a
 4215|       |          * big problem.
 4216|       |          *
 4217|       |          * An error here corresponds to the system being out of memory.
 4218|       |          */
 4219|      3|         buffer = png_read_buffer(png_ptr, avail_in);
 4220|       |
 4221|      3|         if (buffer == NULL)
  ------------------
  |  Branch (4221:14): [True: 0, False: 3]
  ------------------
 4222|      0|            png_chunk_error(png_ptr, "out of memory");
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 4223|       |
 4224|      3|         png_crc_read(png_ptr, buffer, avail_in);
  ------------------
  |  |   24|      3|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 4225|      3|         png_ptr->idat_size -= avail_in;
 4226|       |
 4227|      3|         png_ptr->zstream.next_in = buffer;
 4228|      3|         png_ptr->zstream.avail_in = avail_in;
 4229|      3|      }
 4230|       |
 4231|       |      /* And set up the output side. */
 4232|     24|      if (output != NULL) /* standard read */
  ------------------
  |  Branch (4232:11): [True: 21, False: 3]
  ------------------
 4233|     21|      {
 4234|     21|         uInt out = ZLIB_IO_MAX;
  ------------------
  |  |   53|     21|#  define ZLIB_IO_MAX ((uInt)-1)
  ------------------
 4235|       |
 4236|     21|         if (out > avail_out)
  ------------------
  |  Branch (4236:14): [True: 21, False: 0]
  ------------------
 4237|     21|            out = (uInt)avail_out;
 4238|       |
 4239|     21|         avail_out -= out;
 4240|     21|         png_ptr->zstream.avail_out = out;
 4241|     21|      }
 4242|       |
 4243|      3|      else /* after last row, checking for end */
 4244|      3|      {
 4245|      3|         png_ptr->zstream.next_out = tmpbuf;
 4246|      3|         png_ptr->zstream.avail_out = (sizeof tmpbuf);
 4247|      3|      }
 4248|       |
 4249|       |      /* Use NO_FLUSH; this gives zlib the maximum opportunity to optimize the
 4250|       |       * process.  If the LZ stream is truncated the sequential reader will
 4251|       |       * terminally damage the stream, above, by reading the chunk header of the
 4252|       |       * following chunk (it then exits with png_error).
 4253|       |       *
 4254|       |       * TODO: deal more elegantly with truncated IDAT lists.
 4255|       |       */
 4256|     24|      ret = PNG_INFLATE(png_ptr, Z_NO_FLUSH);
  ------------------
  |  | 1729|     24|#  define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush)
  |  |  ------------------
  |  |  |  |   42|     24|#define png_zlib_inflate OSS_FUZZ_png_zlib_inflate
  |  |  ------------------
  ------------------
 4257|       |
 4258|       |      /* Take the unconsumed output back. */
 4259|     24|      if (output != NULL)
  ------------------
  |  Branch (4259:11): [True: 21, False: 3]
  ------------------
 4260|     21|         avail_out += png_ptr->zstream.avail_out;
 4261|       |
 4262|      3|      else /* avail_out counts the extra bytes */
 4263|      3|         avail_out += (sizeof tmpbuf) - png_ptr->zstream.avail_out;
 4264|       |
 4265|     24|      png_ptr->zstream.avail_out = 0;
 4266|       |
 4267|     24|      if (ret == Z_STREAM_END)
  ------------------
  |  Branch (4267:11): [True: 0, False: 24]
  ------------------
 4268|      0|      {
 4269|       |         /* Do this for safety; we won't read any more into this row. */
 4270|      0|         png_ptr->zstream.next_out = NULL;
 4271|       |
 4272|      0|         png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  644|      0|#define PNG_AFTER_IDAT 0x08
  ------------------
 4273|      0|         png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
  ------------------
  |  |  698|      0|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
 4274|       |
 4275|      0|         if (png_ptr->zstream.avail_in > 0 || png_ptr->idat_size > 0)
  ------------------
  |  Branch (4275:14): [True: 0, False: 0]
  |  Branch (4275:47): [True: 0, False: 0]
  ------------------
 4276|      0|            png_chunk_benign_error(png_ptr, "Extra compressed data");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 4277|      0|         break;
 4278|      0|      }
 4279|       |
 4280|     24|      if (ret != Z_OK)
  ------------------
  |  Branch (4280:11): [True: 3, False: 21]
  ------------------
 4281|      3|      {
 4282|      3|         png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|      3|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
 4283|       |
 4284|      3|         if (output != NULL)
  ------------------
  |  Branch (4284:14): [True: 0, False: 3]
  ------------------
 4285|      0|            png_chunk_error(png_ptr, png_ptr->zstream.msg);
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
 4286|       |
 4287|      3|         else /* checking */
 4288|      3|         {
 4289|      3|            png_chunk_benign_error(png_ptr, png_ptr->zstream.msg);
  ------------------
  |  |  238|      3|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 4290|      3|            return;
 4291|      3|         }
 4292|      3|      }
 4293|     24|   } while (avail_out > 0);
  ------------------
  |  Branch (4293:13): [True: 0, False: 21]
  ------------------
 4294|       |
 4295|     21|   if (avail_out > 0)
  ------------------
  |  Branch (4295:8): [True: 0, False: 21]
  ------------------
 4296|      0|   {
 4297|       |      /* The stream ended before the image; this is the same as too few IDATs so
 4298|       |       * should be handled the same way.
 4299|       |       */
 4300|      0|      if (output != NULL)
  ------------------
  |  Branch (4300:11): [True: 0, False: 0]
  ------------------
 4301|      0|         png_error(png_ptr, "Not enough image data");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4302|       |
 4303|      0|      else /* the deflate stream contained extra data */
 4304|      0|         png_chunk_benign_error(png_ptr, "Too much image data");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 4305|      0|   }
 4306|     21|}
OSS_FUZZ_png_read_finish_IDAT:
 4310|      6|{
 4311|       |   /* We don't need any more data and the stream should have ended, however the
 4312|       |    * LZ end code may actually not have been processed.  In this case we must
 4313|       |    * read it otherwise stray unread IDAT data or, more likely, an IDAT chunk
 4314|       |    * may still remain to be consumed.
 4315|       |    */
 4316|      6|   if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
  ------------------
  |  |  698|      6|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (4316:8): [True: 3, False: 3]
  ------------------
 4317|      3|   {
 4318|       |      /* The NULL causes png_read_IDAT_data to swallow any remaining bytes in
 4319|       |       * the compressed stream, but the stream may be damaged too, so even after
 4320|       |       * this call we may need to terminate the zstream ownership.
 4321|       |       */
 4322|      3|      png_read_IDAT_data(png_ptr, NULL, 0);
  ------------------
  |  |   38|      3|#define png_read_IDAT_data OSS_FUZZ_png_read_IDAT_data
  ------------------
 4323|      3|      png_ptr->zstream.next_out = NULL; /* safety */
 4324|       |
 4325|       |      /* Now clear everything out for safety; the following may not have been
 4326|       |       * done.
 4327|       |       */
 4328|      3|      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
  ------------------
  |  |  698|      3|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (4328:11): [True: 3, False: 0]
  ------------------
 4329|      3|      {
 4330|      3|         png_ptr->mode |= PNG_AFTER_IDAT;
  ------------------
  |  |  644|      3|#define PNG_AFTER_IDAT 0x08
  ------------------
 4331|      3|         png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
  ------------------
  |  |  698|      3|#define PNG_FLAG_ZSTREAM_ENDED            0x0008U /* Added to libpng-1.6.0 */
  ------------------
 4332|      3|      }
 4333|      3|   }
 4334|       |
 4335|       |   /* If the zstream has not been released do it now *and* terminate the reading
 4336|       |    * of the final IDAT chunk.
 4337|       |    */
 4338|      6|   if (png_ptr->zowner == png_IDAT)
  ------------------
  |  |  886|      6|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|      6|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      6|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (4338:8): [True: 3, False: 3]
  ------------------
 4339|      3|   {
 4340|       |      /* Always do this; the pointers otherwise point into the read buffer. */
 4341|      3|      png_ptr->zstream.next_in = NULL;
 4342|      3|      png_ptr->zstream.avail_in = 0;
 4343|       |
 4344|       |      /* Now we no longer own the zstream. */
 4345|      3|      png_ptr->zowner = 0;
 4346|       |
 4347|       |      /* The slightly weird semantics of the sequential IDAT reading is that we
 4348|       |       * are always in or at the end of an IDAT chunk, so we always need to do a
 4349|       |       * crc_finish here.  If idat_size is non-zero we also need to read the
 4350|       |       * spurious bytes at the end of the chunk now.
 4351|       |       */
 4352|      3|      (void)png_crc_finish(png_ptr, png_ptr->idat_size);
  ------------------
  |  |   25|      3|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 4353|      3|   }
 4354|      6|}
OSS_FUZZ_png_read_finish_row:
 4358|     63|{
 4359|     63|   png_debug(1, "in png_read_finish_row");
  ------------------
  |  |  145|     63|#  define png_debug(l, m) ((void)0)
  ------------------
 4360|     63|   png_ptr->row_number++;
 4361|     63|   if (png_ptr->row_number < png_ptr->num_rows)
  ------------------
  |  Branch (4361:8): [True: 42, False: 21]
  ------------------
 4362|     42|      return;
 4363|       |
 4364|     21|   if (png_ptr->interlaced != 0)
  ------------------
  |  Branch (4364:8): [True: 21, False: 0]
  ------------------
 4365|     21|   {
 4366|     21|      png_ptr->row_number = 0;
 4367|       |
 4368|       |      /* TO DO: don't do this if prev_row isn't needed (requires
 4369|       |       * read-ahead of the next row's filter byte.
 4370|       |       */
 4371|     21|      memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
 4372|       |
 4373|     21|      do
 4374|     21|      {
 4375|     21|         png_ptr->pass++;
 4376|       |
 4377|     21|         if (png_ptr->pass >= 7)
  ------------------
  |  Branch (4377:14): [True: 3, False: 18]
  ------------------
 4378|      3|            break;
 4379|       |
 4380|     18|         png_ptr->iwidth = (png_ptr->width +
 4381|     18|            png_pass_inc[png_ptr->pass] - 1 -
 4382|     18|            png_pass_start[png_ptr->pass]) /
 4383|     18|            png_pass_inc[png_ptr->pass];
 4384|       |
 4385|     18|         if ((png_ptr->transformations & PNG_INTERLACE) == 0)
  ------------------
  |  |  659|     18|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (4385:14): [True: 0, False: 18]
  ------------------
 4386|      0|         {
 4387|      0|            png_ptr->num_rows = (png_ptr->height +
 4388|      0|                png_pass_yinc[png_ptr->pass] - 1 -
 4389|      0|                png_pass_ystart[png_ptr->pass]) /
 4390|      0|                png_pass_yinc[png_ptr->pass];
 4391|      0|         }
 4392|       |
 4393|     18|         else  /* if (png_ptr->transformations & PNG_INTERLACE) */
 4394|     18|            break; /* libpng deinterlacing sees every row */
 4395|       |
 4396|     18|      } while (png_ptr->num_rows == 0 || png_ptr->iwidth == 0);
  ------------------
  |  Branch (4396:16): [True: 0, False: 0]
  |  Branch (4396:42): [True: 0, False: 0]
  ------------------
 4397|       |
 4398|     21|      if (png_ptr->pass < 7)
  ------------------
  |  Branch (4398:11): [True: 18, False: 3]
  ------------------
 4399|     18|         return;
 4400|     21|   }
 4401|       |
 4402|       |   /* Here after at the end of the last row of the last pass. */
 4403|      3|   png_read_finish_IDAT(png_ptr);
  ------------------
  |  |   39|      3|#define png_read_finish_IDAT OSS_FUZZ_png_read_finish_IDAT
  ------------------
 4404|      3|}
OSS_FUZZ_png_read_start_row:
 4409|      5|{
 4410|      5|   unsigned int max_pixel_depth;
 4411|      5|   size_t row_bytes;
 4412|       |
 4413|      5|   png_debug(1, "in png_read_start_row");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
 4414|       |
 4415|      5|#ifdef PNG_READ_TRANSFORMS_SUPPORTED
 4416|      5|   png_init_read_transformations(png_ptr);
  ------------------
  |  |   53|      5|#define png_init_read_transformations OSS_FUZZ_png_init_read_transformations
  ------------------
 4417|      5|#endif
 4418|      5|   if (png_ptr->interlaced != 0)
  ------------------
  |  Branch (4418:8): [True: 5, False: 0]
  ------------------
 4419|      5|   {
 4420|      5|      if ((png_ptr->transformations & PNG_INTERLACE) == 0)
  ------------------
  |  |  659|      5|#define PNG_INTERLACE           0x0002U
  ------------------
  |  Branch (4420:11): [True: 0, False: 5]
  ------------------
 4421|      0|         png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
 4422|      0|             png_pass_ystart[0]) / png_pass_yinc[0];
 4423|       |
 4424|      5|      else
 4425|      5|         png_ptr->num_rows = png_ptr->height;
 4426|       |
 4427|      5|      png_ptr->iwidth = (png_ptr->width +
 4428|      5|          png_pass_inc[png_ptr->pass] - 1 -
 4429|      5|          png_pass_start[png_ptr->pass]) /
 4430|      5|          png_pass_inc[png_ptr->pass];
 4431|      5|   }
 4432|       |
 4433|      0|   else
 4434|      0|   {
 4435|      0|      png_ptr->num_rows = png_ptr->height;
 4436|      0|      png_ptr->iwidth = png_ptr->width;
 4437|      0|   }
 4438|       |
 4439|      5|   max_pixel_depth = (unsigned int)png_ptr->pixel_depth;
 4440|       |
 4441|       |   /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpler set of
 4442|       |    * calculations to calculate the final pixel depth, then
 4443|       |    * png_do_read_transforms actually does the transforms.  This means that the
 4444|       |    * code which effectively calculates this value is actually repeated in three
 4445|       |    * separate places.  They must all match.  Innocent changes to the order of
 4446|       |    * transformations can and will break libpng in a way that causes memory
 4447|       |    * overwrites.
 4448|       |    *
 4449|       |    * TODO: fix this.
 4450|       |    */
 4451|      5|#ifdef PNG_READ_PACK_SUPPORTED
 4452|      5|   if ((png_ptr->transformations & PNG_PACK) != 0 && png_ptr->bit_depth < 8)
  ------------------
  |  |  660|      5|#define PNG_PACK                0x0004U
  ------------------
  |  Branch (4452:8): [True: 5, False: 0]
  |  Branch (4452:54): [True: 5, False: 0]
  ------------------
 4453|      5|      max_pixel_depth = 8;
 4454|      5|#endif
 4455|       |
 4456|      5|#ifdef PNG_READ_EXPAND_SUPPORTED
 4457|      5|   if ((png_ptr->transformations & PNG_EXPAND) != 0)
  ------------------
  |  |  670|      5|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (4457:8): [True: 5, False: 0]
  ------------------
 4458|      5|   {
 4459|      5|      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  667|      5|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      5|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      5|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (4459:11): [True: 0, False: 5]
  ------------------
 4460|      0|      {
 4461|      0|         if (png_ptr->num_trans != 0)
  ------------------
  |  Branch (4461:14): [True: 0, False: 0]
  ------------------
 4462|      0|            max_pixel_depth = 32;
 4463|       |
 4464|      0|         else
 4465|      0|            max_pixel_depth = 24;
 4466|      0|      }
 4467|       |
 4468|      5|      else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
  ------------------
  |  |  666|      5|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (4468:16): [True: 5, False: 0]
  ------------------
 4469|      5|      {
 4470|      5|         if (max_pixel_depth < 8)
  ------------------
  |  Branch (4470:14): [True: 0, False: 5]
  ------------------
 4471|      0|            max_pixel_depth = 8;
 4472|       |
 4473|      5|         if (png_ptr->num_trans != 0)
  ------------------
  |  Branch (4473:14): [True: 0, False: 5]
  ------------------
 4474|      0|            max_pixel_depth *= 2;
 4475|      5|      }
 4476|       |
 4477|      0|      else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (4477:16): [True: 0, False: 0]
  ------------------
 4478|      0|      {
 4479|      0|         if (png_ptr->num_trans != 0)
  ------------------
  |  Branch (4479:14): [True: 0, False: 0]
  ------------------
 4480|      0|         {
 4481|      0|            max_pixel_depth *= 4;
 4482|      0|            max_pixel_depth /= 3;
 4483|      0|         }
 4484|      0|      }
 4485|      5|   }
 4486|      5|#endif
 4487|       |
 4488|      5|#ifdef PNG_READ_EXPAND_16_SUPPORTED
 4489|      5|   if ((png_ptr->transformations & PNG_EXPAND_16) != 0)
  ------------------
  |  |  667|      5|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
  |  Branch (4489:8): [True: 0, False: 5]
  ------------------
 4490|      0|   {
 4491|      0|#  ifdef PNG_READ_EXPAND_SUPPORTED
 4492|       |      /* In fact it is an error if it isn't supported, but checking is
 4493|       |       * the safe way.
 4494|       |       */
 4495|      0|      if ((png_ptr->transformations & PNG_EXPAND) != 0)
  ------------------
  |  |  670|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (4495:11): [True: 0, False: 0]
  ------------------
 4496|      0|      {
 4497|      0|         if (png_ptr->bit_depth < 16)
  ------------------
  |  Branch (4497:14): [True: 0, False: 0]
  ------------------
 4498|      0|            max_pixel_depth *= 2;
 4499|      0|      }
 4500|      0|      else
 4501|      0|#  endif
 4502|      0|      png_ptr->transformations &= ~PNG_EXPAND_16;
  ------------------
  |  |  667|      0|#define PNG_EXPAND_16           0x0200U    /* Added to libpng 1.5.2 */
  ------------------
 4503|      0|   }
 4504|      5|#endif
 4505|       |
 4506|      5|#ifdef PNG_READ_FILLER_SUPPORTED
 4507|      5|   if ((png_ptr->transformations & (PNG_FILLER)) != 0)
  ------------------
  |  |  673|      5|#define PNG_FILLER              0x8000U
  ------------------
  |  Branch (4507:8): [True: 0, False: 5]
  ------------------
 4508|      0|   {
 4509|      0|      if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
  ------------------
  |  |  666|      0|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (4509:11): [True: 0, False: 0]
  ------------------
 4510|      0|      {
 4511|      0|         if (max_pixel_depth <= 8)
  ------------------
  |  Branch (4511:14): [True: 0, False: 0]
  ------------------
 4512|      0|            max_pixel_depth = 16;
 4513|       |
 4514|      0|         else
 4515|      0|            max_pixel_depth = 32;
 4516|      0|      }
 4517|       |
 4518|      0|      else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB ||
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (4518:16): [True: 0, False: 0]
  ------------------
 4519|      0|         png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  667|      0|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|      0|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (4519:10): [True: 0, False: 0]
  ------------------
 4520|      0|      {
 4521|      0|         if (max_pixel_depth <= 32)
  ------------------
  |  Branch (4521:14): [True: 0, False: 0]
  ------------------
 4522|      0|            max_pixel_depth = 32;
 4523|       |
 4524|      0|         else
 4525|      0|            max_pixel_depth = 64;
 4526|      0|      }
 4527|      0|   }
 4528|      5|#endif
 4529|       |
 4530|      5|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
 4531|      5|   if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0)
  ------------------
  |  |  672|      5|#define PNG_GRAY_TO_RGB         0x4000U
  ------------------
  |  Branch (4531:8): [True: 5, False: 0]
  ------------------
 4532|      5|   {
 4533|      5|      if (
 4534|      5|#ifdef PNG_READ_EXPAND_SUPPORTED
 4535|      5|          (png_ptr->num_trans != 0 &&
  ------------------
  |  Branch (4535:12): [True: 0, False: 5]
  ------------------
 4536|      0|          (png_ptr->transformations & PNG_EXPAND) != 0) ||
  ------------------
  |  |  670|      0|#define PNG_EXPAND              0x1000U
  ------------------
  |  Branch (4536:11): [True: 0, False: 0]
  ------------------
 4537|      5|#endif
 4538|      5|#ifdef PNG_READ_FILLER_SUPPORTED
 4539|      5|          (png_ptr->transformations & (PNG_FILLER)) != 0 ||
  ------------------
  |  |  673|      5|#define PNG_FILLER              0x8000U
  ------------------
  |  Branch (4539:11): [True: 0, False: 5]
  ------------------
 4540|      5|#endif
 4541|      5|          png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
  ------------------
  |  |  670|      5|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      5|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4541:11): [True: 0, False: 5]
  ------------------
 4542|      0|      {
 4543|      0|         if (max_pixel_depth <= 16)
  ------------------
  |  Branch (4543:14): [True: 0, False: 0]
  ------------------
 4544|      0|            max_pixel_depth = 32;
 4545|       |
 4546|      0|         else
 4547|      0|            max_pixel_depth = 64;
 4548|      0|      }
 4549|       |
 4550|      5|      else
 4551|      5|      {
 4552|      5|         if (max_pixel_depth <= 8)
  ------------------
  |  Branch (4552:14): [True: 5, False: 0]
  ------------------
 4553|      5|         {
 4554|      5|            if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
  ------------------
  |  |  669|      5|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|      5|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      5|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4554:17): [True: 0, False: 5]
  ------------------
 4555|      0|               max_pixel_depth = 32;
 4556|       |
 4557|      5|            else
 4558|      5|               max_pixel_depth = 24;
 4559|      5|         }
 4560|       |
 4561|      0|         else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (4561:19): [True: 0, False: 0]
  ------------------
 4562|      0|            max_pixel_depth = 64;
 4563|       |
 4564|      0|         else
 4565|      0|            max_pixel_depth = 48;
 4566|      5|      }
 4567|      5|   }
 4568|      5|#endif
 4569|       |
 4570|      5|#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
 4571|      5|defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
 4572|      5|   if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
  ------------------
  |  |  678|      5|#define PNG_USER_TRANSFORM    0x100000U
  ------------------
  |  Branch (4572:8): [True: 0, False: 5]
  ------------------
 4573|      0|   {
 4574|      0|      unsigned int user_pixel_depth = png_ptr->user_transform_depth *
 4575|      0|         png_ptr->user_transform_channels;
 4576|       |
 4577|      0|      if (user_pixel_depth > max_pixel_depth)
  ------------------
  |  Branch (4577:11): [True: 0, False: 0]
  ------------------
 4578|      0|         max_pixel_depth = user_pixel_depth;
 4579|      0|   }
 4580|      5|#endif
 4581|       |
 4582|       |   /* This value is stored in png_struct and double checked in the row read
 4583|       |    * code.
 4584|       |    */
 4585|      5|   png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;
 4586|      5|   png_ptr->transformed_pixel_depth = 0; /* calculated on demand */
 4587|       |
 4588|       |   /* Align the width on the next larger 8 pixels.  Mainly used
 4589|       |    * for interlacing
 4590|       |    */
 4591|      5|   row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));
 4592|       |   /* Calculate the maximum bytes needed, adding a byte and a pixel
 4593|       |    * for safety's sake
 4594|       |    */
 4595|      5|   row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
  ------------------
  |  |  755|      5|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 5, False: 0]
  |  |  ------------------
  |  |  756|      5|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|      5|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
 4596|      5|       1 + ((max_pixel_depth + 7) >> 3U);
 4597|       |
 4598|       |#ifdef PNG_MAX_MALLOC_64K
 4599|       |   if (row_bytes > (png_uint_32)65536L)
 4600|       |      png_error(png_ptr, "This image requires a row greater than 64KB");
 4601|       |#endif
 4602|       |
 4603|      5|   if (row_bytes + 48 > png_ptr->old_big_row_buf_size)
  ------------------
  |  Branch (4603:8): [True: 5, False: 0]
  ------------------
 4604|      5|   {
 4605|      5|      png_free(png_ptr, png_ptr->big_row_buf);
  ------------------
  |  |  253|      5|#define png_free OSS_FUZZ_png_free
  ------------------
 4606|      5|      png_free(png_ptr, png_ptr->big_prev_row);
  ------------------
  |  |  253|      5|#define png_free OSS_FUZZ_png_free
  ------------------
 4607|       |
 4608|      5|      if (png_ptr->interlaced != 0)
  ------------------
  |  Branch (4608:11): [True: 5, False: 0]
  ------------------
 4609|      5|         png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr,
  ------------------
  |  |  237|      5|#define png_calloc OSS_FUZZ_png_calloc
  ------------------
 4610|      5|             row_bytes + 48);
 4611|       |
 4612|      0|      else
 4613|      0|         png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
  ------------------
  |  |  347|      0|#define png_malloc OSS_FUZZ_png_malloc
  ------------------
 4614|       |
 4615|      5|      png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
  ------------------
  |  |  347|      5|#define png_malloc OSS_FUZZ_png_malloc
  ------------------
 4616|       |
 4617|      5|#ifdef PNG_ALIGNED_MEMORY_SUPPORTED
 4618|       |      /* Use 16-byte aligned memory for row_buf with at least 16 bytes
 4619|       |       * of padding before and after row_buf; treat prev_row similarly.
 4620|       |       * NOTE: the alignment is to the start of the pixels, one beyond the start
 4621|       |       * of the buffer, because of the filter byte.  Prior to libpng 1.5.6 this
 4622|       |       * was incorrect; the filter byte was aligned, which had the exact
 4623|       |       * opposite effect of that intended.
 4624|       |       */
 4625|      5|      {
 4626|      5|         png_bytep temp = png_ptr->big_row_buf + 32;
 4627|      5|         size_t extra = (size_t)temp & 0x0f;
 4628|      5|         png_ptr->row_buf = temp - extra - 1/*filter byte*/;
 4629|       |
 4630|      5|         temp = png_ptr->big_prev_row + 32;
 4631|      5|         extra = (size_t)temp & 0x0f;
 4632|      5|         png_ptr->prev_row = temp - extra - 1/*filter byte*/;
 4633|      5|      }
 4634|       |#else
 4635|       |      /* Use 31 bytes of padding before and 17 bytes after row_buf. */
 4636|       |      png_ptr->row_buf = png_ptr->big_row_buf + 31;
 4637|       |      png_ptr->prev_row = png_ptr->big_prev_row + 31;
 4638|       |#endif
 4639|      5|      png_ptr->old_big_row_buf_size = row_bytes + 48;
 4640|      5|   }
 4641|       |
 4642|       |#ifdef PNG_MAX_MALLOC_64K
 4643|       |   if (png_ptr->rowbytes > 65535)
 4644|       |      png_error(png_ptr, "This image requires a row greater than 64KB");
 4645|       |
 4646|       |#endif
 4647|      5|   if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1))
  ------------------
  |  |  649|      5|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
  |  Branch (4647:8): [True: 0, False: 5]
  ------------------
 4648|      0|      png_error(png_ptr, "Row has too many bytes to allocate in memory");
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4649|       |
 4650|      5|   memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
 4651|       |
 4652|      5|   png_debug1(3, "width = %u,", png_ptr->width);
  ------------------
  |  |  148|      5|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4653|      5|   png_debug1(3, "height = %u,", png_ptr->height);
  ------------------
  |  |  148|      5|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4654|      5|   png_debug1(3, "iwidth = %u,", png_ptr->iwidth);
  ------------------
  |  |  148|      5|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4655|      5|   png_debug1(3, "num_rows = %u,", png_ptr->num_rows);
  ------------------
  |  |  148|      5|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4656|      5|   png_debug1(3, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes);
  ------------------
  |  |  148|      5|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4657|      5|   png_debug1(3, "irowbytes = %lu",
  ------------------
  |  |  148|      5|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 4658|      5|       (unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1);
 4659|       |
 4660|       |   /* The sequential reader needs a buffer for IDAT, but the progressive reader
 4661|       |    * does not, so free the read buffer now regardless; the sequential reader
 4662|       |    * reallocates it on demand.
 4663|       |    */
 4664|      5|   if (png_ptr->read_buffer != NULL)
  ------------------
  |  Branch (4664:8): [True: 0, False: 5]
  ------------------
 4665|      0|   {
 4666|      0|      png_bytep buffer = png_ptr->read_buffer;
 4667|       |
 4668|      0|      png_ptr->read_buffer_size = 0;
 4669|      0|      png_ptr->read_buffer = NULL;
 4670|      0|      png_free(png_ptr, buffer);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 4671|      0|   }
 4672|       |
 4673|       |   /* Finally claim the zstream for the inflate of the IDAT data, use the bits
 4674|       |    * value from the stream (note that this will result in a fatal error if the
 4675|       |    * IDAT stream has a bogus deflate header window_bits value, but this should
 4676|       |    * not be happening any longer!)
 4677|       |    */
 4678|      5|   if (png_inflate_claim(png_ptr, png_IDAT) != Z_OK)
  ------------------
  |  |  886|      5|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  ------------------
  |  |  |  |  845|      5|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      5|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      5|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      5|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|      5|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (4678:8): [True: 0, False: 5]
  ------------------
 4679|      0|      png_error(png_ptr, png_ptr->zstream.msg);
  ------------------
  |  |  252|      0|#define png_error OSS_FUZZ_png_error
  ------------------
 4680|       |
 4681|      5|   png_ptr->flags |= PNG_FLAG_ROW_INIT;
  ------------------
  |  |  701|      5|#define PNG_FLAG_ROW_INIT                 0x0040U
  ------------------
 4682|      5|}
pngrutil.c:check_chunk_name:
  154|  7.98k|{
  155|  7.98k|   png_uint_32 t;
  156|       |
  157|       |   /* Remove bit 5 from all but the reserved byte; this means
  158|       |    * every 8-bit unit must be in the range 65-90 to be valid.
  159|       |    * So bit 5 must be zero, bit 6 must be set and bit 7 zero.
  160|       |    */
  161|  7.98k|   name &= ~PNG_U32(32,32,0,32);
  ------------------
  |  |  845|  7.98k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  ------------------
  162|  7.98k|   t = (name & ~0x1f1f1f1fU) ^ 0x40404040U;
  163|       |
  164|       |   /* Subtract 65 for each 8-bit quantity, this must not
  165|       |    * overflow and each byte must then be in the range 0-25.
  166|       |    */
  167|  7.98k|   name -= PNG_U32(65,65,65,65);
  ------------------
  |  |  845|  7.98k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  ------------------
  168|  7.98k|   t |= name;
  169|       |
  170|       |   /* Subtract 26, handling the overflow which should set the
  171|       |    * top three bits of each byte.
  172|       |    */
  173|  7.98k|   name -= PNG_U32(25,25,25,26);
  ------------------
  |  |  845|  7.98k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  ------------------
  |  |  |  |  843|  7.98k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  ------------------
  ------------------
  174|  7.98k|   t |= ~name;
  175|       |
  176|  7.98k|   return (t & 0xe0e0e0e0U) == 0U;
  177|  7.98k|}
pngrutil.c:png_crc_finish_critical:
  314|  7.97k|{
  315|       |   /* The size of the local buffer for inflate is a good guess as to a
  316|       |    * reasonable size to use for buffering reads from the application.
  317|       |    */
  318|  12.4k|   while (skip > 0)
  ------------------
  |  Branch (318:11): [True: 4.42k, False: 7.97k]
  ------------------
  319|  4.42k|   {
  320|  4.42k|      png_uint_32 len;
  321|  4.42k|      png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
  322|       |
  323|  4.42k|      len = (sizeof tmpbuf);
  324|  4.42k|      if (len > skip)
  ------------------
  |  Branch (324:11): [True: 4.29k, False: 129]
  ------------------
  325|  4.29k|         len = skip;
  326|  4.42k|      skip -= len;
  327|       |
  328|  4.42k|      png_crc_read(png_ptr, tmpbuf, len);
  ------------------
  |  |   24|  4.42k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
  329|  4.42k|   }
  330|       |
  331|       |   /* If 'handle_as_ancillary' has been requested and this is a critical chunk
  332|       |    * but PNG_FLAG_CRC_CRITICAL_IGNORE was set then png_read_crc did not, in
  333|       |    * fact, calculate the CRC so the ANCILLARY settings should not be used
  334|       |    * instead.
  335|       |    */
  336|  7.97k|   if (handle_as_ancillary &&
  ------------------
  |  Branch (336:8): [True: 3, False: 7.97k]
  ------------------
  337|      3|       (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)
  ------------------
  |  |  706|      3|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  ------------------
  |  Branch (337:8): [True: 3, False: 0]
  ------------------
  338|      3|      handle_as_ancillary = 0;
  339|       |
  340|       |   /* TODO: this might be more comprehensible if png_crc_error was inlined here.
  341|       |    */
  342|  7.97k|   if (png_crc_error(png_ptr, handle_as_ancillary) != 0)
  ------------------
  |  Branch (342:8): [True: 3, False: 7.97k]
  ------------------
  343|      3|   {
  344|       |      /* See above for the explanation of how the flags work. */
  345|      3|      if (handle_as_ancillary || PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0 ?
  ------------------
  |  |  941|      3|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  ------------------
  |  Branch (345:11): [True: 0, False: 3]
  |  Branch (345:11): [True: 0, False: 3]
  |  Branch (345:34): [True: 0, False: 3]
  ------------------
  346|      0|          (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == 0 :
  ------------------
  |  |  704|      0|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
  347|      3|          (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE) != 0)
  ------------------
  |  |  705|      3|#define PNG_FLAG_CRC_CRITICAL_USE         0x0400U
  ------------------
  348|      0|         png_chunk_warning(png_ptr, "CRC error");
  ------------------
  |  |  240|      0|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
  349|       |
  350|      3|      else
  351|      3|         png_chunk_error(png_ptr, "CRC error");
  ------------------
  |  |  239|      3|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  352|       |
  353|      0|      return 1;
  354|      3|   }
  355|       |
  356|  7.97k|   return 0;
  357|  7.97k|}
pngrutil.c:png_crc_error:
  240|  7.97k|{
  241|  7.97k|   png_byte crc_bytes[4];
  242|  7.97k|   png_uint_32 crc;
  243|  7.97k|   int need_crc = 1;
  244|       |
  245|       |   /* There are four flags two for ancillary and two for critical chunks.  The
  246|       |    * default setting of these flags is all zero.
  247|       |    *
  248|       |    * PNG_FLAG_CRC_ANCILLARY_USE
  249|       |    * PNG_FLAG_CRC_ANCILLARY_NOWARN
  250|       |    *  USE+NOWARN: no CRC calculation (implemented here), else;
  251|       |    *  NOWARN:     png_chunk_error on error (implemented in png_crc_finish)
  252|       |    *  else:       png_chunk_warning on error (implemented in png_crc_finish)
  253|       |    *              This is the default.
  254|       |    *
  255|       |    *    I.e. NOWARN without USE produces png_chunk_error.  The default setting
  256|       |    *    where neither are set does the same thing.
  257|       |    *
  258|       |    * PNG_FLAG_CRC_CRITICAL_USE
  259|       |    * PNG_FLAG_CRC_CRITICAL_IGNORE
  260|       |    *  IGNORE: no CRC calculation (implemented here), else;
  261|       |    *  USE:    png_chunk_warning on error (implemented in png_crc_finish)
  262|       |    *  else:   png_chunk_error on error (implemented in png_crc_finish)
  263|       |    *          This is the default.
  264|       |    *
  265|       |    * This arose because of original mis-implementation and has persisted for
  266|       |    * compatibility reasons.
  267|       |    *
  268|       |    * TODO: the flag names are internal so maybe this can be changed to
  269|       |    * something comprehensible.
  270|       |    */
  271|  7.97k|   if (handle_as_ancillary || PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0)
  ------------------
  |  |  941|  7.97k|#define PNG_CHUNK_ANCILLARY(c)   (1 & ((c) >> 29))
  ------------------
  |  Branch (271:8): [True: 0, False: 7.97k]
  |  Branch (271:31): [True: 7.95k, False: 27]
  ------------------
  272|  7.95k|   {
  273|  7.95k|      if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
  ------------------
  |  |  727|  7.95k|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \
  |  |  ------------------
  |  |  |  |  703|  7.95k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  |  |  ------------------
  |  |  728|  7.95k|                                     PNG_FLAG_CRC_ANCILLARY_NOWARN)
  |  |  ------------------
  |  |  |  |  704|  7.95k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  |  |  ------------------
  ------------------
  |  Branch (273:11): [True: 7.95k, False: 0]
  ------------------
  274|  7.95k|          (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
  ------------------
  |  |  703|  7.95k|#define PNG_FLAG_CRC_ANCILLARY_USE        0x0100U
  ------------------
                        (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
  ------------------
  |  |  704|  7.95k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN     0x0200U
  ------------------
  275|  7.95k|         need_crc = 0;
  276|  7.95k|   }
  277|       |
  278|     27|   else /* critical */
  279|     27|   {
  280|     27|      if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)
  ------------------
  |  |  706|     27|#define PNG_FLAG_CRC_CRITICAL_IGNORE      0x0800U
  ------------------
  |  Branch (280:11): [True: 24, False: 3]
  ------------------
  281|     24|         need_crc = 0;
  282|     27|   }
  283|       |
  284|  7.97k|#ifdef PNG_IO_STATE_SUPPORTED
  285|  7.97k|   png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC;
  ------------------
  |  | 2664|  7.97k|#  define PNG_IO_READING     0x0001   /* currently reading */
  ------------------
                 png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC;
  ------------------
  |  | 2669|  7.97k|#  define PNG_IO_CHUNK_CRC   0x0080   /* currently at the chunk crc */
  ------------------
  286|  7.97k|#endif
  287|       |
  288|       |   /* The chunk CRC must be serialized in a single I/O call. */
  289|  7.97k|   png_read_data(png_ptr, crc_bytes, 4);
  ------------------
  |  |   23|  7.97k|#define png_read_data OSS_FUZZ_png_read_data
  ------------------
  290|       |
  291|  7.97k|   if (need_crc != 0)
  ------------------
  |  Branch (291:8): [True: 3, False: 7.97k]
  ------------------
  292|      3|   {
  293|      3|      crc = png_get_uint_32(crc_bytes);
  ------------------
  |  |  322|      3|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|      3|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|      3|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|      3|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|      3|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|      3|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  294|      3|      return crc != png_ptr->crc;
  295|      3|   }
  296|       |
  297|  7.97k|   else
  298|  7.97k|      return 0;
  299|  7.97k|}
pngrutil.c:png_chunk_index_from_name:
 3088|  7.97k|{
 3089|       |   /* For chunk png_cHNK return PNG_INDEX_cHNK.  Return PNG_INDEX_unknown if
 3090|       |    * chunk_name is not known.  Notice that in a particular build "known" does
 3091|       |    * not necessarily mean "supported", although the inverse applies.
 3092|       |    */
 3093|  7.97k|   switch (chunk_name)
 3094|  7.97k|   {
 3095|      0|#     define PNG_CHUNK(cHNK, index)\
 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
 3097|       |
 3098|      0|      PNG_KNOWN_CHUNKS
  ------------------
  |  |  968|     18|   PNG_CHUNK(IHDR,  0)\
  |  |  ------------------
  |  |  |  | 3096|     18|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  888|     18|#define png_IHDR PNG_U32( 73,  72,  68,  82)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|     18|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|     18|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|     18|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|     18|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|     18|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 18, False: 7.95k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  969|     18|   PNG_CHUNK(PLTE,  1)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  889|      0|#define png_PLTE PNG_U32( 80,  76,  84,  69)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  970|      0|   PNG_CHUNK(IDAT,  2)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  886|      0|#define png_IDAT PNG_U32( 73,  68,  65,  84)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  971|      3|   PNG_CHUNK(IEND,  3)\
  |  |  ------------------
  |  |  |  | 3096|      3|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  887|      3|#define png_IEND PNG_U32( 73,  69,  78,  68)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      3|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      3|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      3|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      3|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      3|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 3, False: 7.96k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  972|      3|   PNG_CHUNK(acTL,  4)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  890|      0|#define png_acTL PNG_U32( 97,  99,  84,  76) /* PNGv3: APNG */
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  973|      0|   PNG_CHUNK(bKGD,  5)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  891|      0|#define png_bKGD PNG_U32( 98,  75,  71,  68)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  974|      0|   PNG_CHUNK(cHRM,  6)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  892|      0|#define png_cHRM PNG_U32( 99,  72,  82,  77)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  975|      0|   PNG_CHUNK(cICP,  7)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  893|      0|#define png_cICP PNG_U32( 99,  73,  67,  80) /* PNGv3 */
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  976|      0|   PNG_CHUNK(cLLI,  8)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  894|      0|#define png_cLLI PNG_U32( 99,  76,  76,  73) /* PNGv3 */
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  977|      0|   PNG_CHUNK(eXIf,  9)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  895|      0|#define png_eXIf PNG_U32(101,  88,  73, 102) /* registered July 2017 */
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  978|      0|   PNG_CHUNK(fcTL, 10)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  896|      0|#define png_fcTL PNG_U32(102,  99,  84,  76) /* PNGv3: APNG */
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  979|      0|   PNG_CHUNK(fdAT, 11)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  897|      0|#define png_fdAT PNG_U32(102, 100,  65,  84) /* PNGv3: APNG */
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  980|      0|   PNG_CHUNK(gAMA, 12)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  899|      0|#define png_gAMA PNG_U32(103,  65,  77,  65)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  981|      0|   PNG_CHUNK(hIST, 13)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  903|      0|#define png_hIST PNG_U32(104,  73,  83,  84)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  982|  4.40k|   PNG_CHUNK(iCCP, 14)\
  |  |  ------------------
  |  |  |  | 3096|  4.40k|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  904|  4.40k|#define png_iCCP PNG_U32(105,  67,  67,  80)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|  4.40k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|  4.40k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|  4.40k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|  4.40k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|  4.40k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 4.40k, False: 3.57k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  983|  4.40k|   PNG_CHUNK(iTXt, 15)\
  |  |  ------------------
  |  |  |  | 3096|    905|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  905|    905|#define png_iTXt PNG_U32(105,  84,  88, 116)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|    905|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    905|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    905|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    905|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    905|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 905, False: 7.06k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  984|    905|   PNG_CHUNK(mDCV, 16)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  906|      0|#define png_mDCV PNG_U32(109,  68,  67,  86) /* PNGv3 */
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  985|      0|   PNG_CHUNK(oFFs, 17)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  907|      0|#define png_oFFs PNG_U32(111,  70,  70, 115)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  986|    115|   PNG_CHUNK(pCAL, 18)\
  |  |  ------------------
  |  |  |  | 3096|    115|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  908|    115|#define png_pCAL PNG_U32(112,  67,  65,  76)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|    115|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    115|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    115|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    115|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    115|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 115, False: 7.85k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  987|    115|   PNG_CHUNK(pHYs, 19)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  909|      0|#define png_pHYs PNG_U32(112,  72,  89, 115)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  988|      0|   PNG_CHUNK(sBIT, 20)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  910|      0|#define png_sBIT PNG_U32(115,  66,  73,  84)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  989|    166|   PNG_CHUNK(sCAL, 21)\
  |  |  ------------------
  |  |  |  | 3096|    166|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  911|    166|#define png_sCAL PNG_U32(115,  67,  65,  76)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|    166|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    166|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    166|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    166|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    166|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 166, False: 7.80k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  990|    610|   PNG_CHUNK(sPLT, 22)\
  |  |  ------------------
  |  |  |  | 3096|    610|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  912|    610|#define png_sPLT PNG_U32(115,  80,  76,  84)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|    610|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    610|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    610|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    610|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    610|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 610, False: 7.36k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  991|    610|   PNG_CHUNK(sRGB, 23)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  913|      0|#define png_sRGB PNG_U32(115,  82,  71,  66)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  992|      0|   PNG_CHUNK(tEXt, 24)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  915|      0|#define png_tEXt PNG_U32(116,  69,  88, 116)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  993|      0|   PNG_CHUNK(tIME, 25)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  916|      0|#define png_tIME PNG_U32(116,  73,  77,  69)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  994|      0|   PNG_CHUNK(tRNS, 26)\
  |  |  ------------------
  |  |  |  | 3096|      0|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  917|      0|#define png_tRNS PNG_U32(116,  82,  78,  83)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|      0|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|      0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 0, False: 7.97k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  995|    937|   PNG_CHUNK(zTXt, 27)
  |  |  ------------------
  |  |  |  | 3096|    937|         case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */
  |  |  |  |  ------------------
  |  |  |  |  |  |  918|    937|#define png_zTXt PNG_U32(122,  84,  88, 116)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  845|    937|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    937|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    937|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    937|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  843|    937|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (3096:10): [True: 937, False: 7.03k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 3099|       |
 3100|      0|#     undef PNG_CHUNK
 3101|       |
 3102|    817|      default: return PNG_INDEX_unknown;
  ------------------
  |  Branch (3102:7): [True: 817, False: 7.15k]
  ------------------
 3103|  7.97k|   }
 3104|  7.97k|}
pngrutil.c:png_handle_IHDR:
  902|     18|{
  903|     18|   png_byte buf[13];
  904|     18|   png_uint_32 width, height;
  905|     18|   int bit_depth, color_type, compression_type, filter_type;
  906|     18|   int interlace_type;
  907|       |
  908|     18|   png_debug(1, "in png_handle_IHDR");
  ------------------
  |  |  145|     18|#  define png_debug(l, m) ((void)0)
  ------------------
  909|       |
  910|       |   /* Length and position are checked by the caller. */
  911|       |
  912|     18|   png_ptr->mode |= PNG_HAVE_IHDR;
  ------------------
  |  |  642|     18|#define PNG_HAVE_IHDR  0x01
  ------------------
  913|       |
  914|     18|   png_crc_read(png_ptr, buf, 13);
  ------------------
  |  |   24|     18|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
  915|     18|   png_crc_finish(png_ptr, 0);
  ------------------
  |  |   25|     18|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  916|       |
  917|     18|   width = png_get_uint_31(png_ptr, buf);
  ------------------
  |  |  321|     18|#define png_get_uint_31 OSS_FUZZ_png_get_uint_31
  ------------------
  918|     18|   height = png_get_uint_31(png_ptr, buf + 4);
  ------------------
  |  |  321|     18|#define png_get_uint_31 OSS_FUZZ_png_get_uint_31
  ------------------
  919|     18|   bit_depth = buf[8];
  920|     18|   color_type = buf[9];
  921|     18|   compression_type = buf[10];
  922|     18|   filter_type = buf[11];
  923|     18|   interlace_type = buf[12];
  924|       |
  925|       |   /* Set internal variables */
  926|     18|   png_ptr->width = width;
  927|     18|   png_ptr->height = height;
  928|     18|   png_ptr->bit_depth = (png_byte)bit_depth;
  929|     18|   png_ptr->interlaced = (png_byte)interlace_type;
  930|     18|   png_ptr->color_type = (png_byte)color_type;
  931|     18|#ifdef PNG_MNG_FEATURES_SUPPORTED
  932|     18|   png_ptr->filter_type = (png_byte)filter_type;
  933|     18|#endif
  934|     18|   png_ptr->compression_type = (png_byte)compression_type;
  935|       |
  936|       |   /* Find number of channels */
  937|     18|   switch (png_ptr->color_type)
  938|     18|   {
  939|      0|      default: /* invalid, png_set_IHDR calls png_error */
  ------------------
  |  Branch (939:7): [True: 0, False: 18]
  ------------------
  940|     14|      case PNG_COLOR_TYPE_GRAY:
  ------------------
  |  |  666|     14|#define PNG_COLOR_TYPE_GRAY 0
  ------------------
  |  Branch (940:7): [True: 14, False: 4]
  ------------------
  941|     14|      case PNG_COLOR_TYPE_PALETTE:
  ------------------
  |  |  667|     14|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|     14|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|     14|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (941:7): [True: 0, False: 18]
  ------------------
  942|     14|         png_ptr->channels = 1;
  943|     14|         break;
  944|       |
  945|      0|      case PNG_COLOR_TYPE_RGB:
  ------------------
  |  |  668|      0|#define PNG_COLOR_TYPE_RGB        (PNG_COLOR_MASK_COLOR)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  ------------------
  |  Branch (945:7): [True: 0, False: 18]
  ------------------
  946|      0|         png_ptr->channels = 3;
  947|      0|         break;
  948|       |
  949|      0|      case PNG_COLOR_TYPE_GRAY_ALPHA:
  ------------------
  |  |  670|      0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (949:7): [True: 0, False: 18]
  ------------------
  950|      0|         png_ptr->channels = 2;
  951|      0|         break;
  952|       |
  953|      0|      case PNG_COLOR_TYPE_RGB_ALPHA:
  ------------------
  |  |  669|      0|#define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  662|      0|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_RGB_ALPHA  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA)
  |  |  ------------------
  |  |  |  |  663|      0|#define PNG_COLOR_MASK_ALPHA      4
  |  |  ------------------
  ------------------
  |  Branch (953:7): [True: 0, False: 18]
  ------------------
  954|      0|         png_ptr->channels = 4;
  955|      0|         break;
  956|     18|   }
  957|       |
  958|       |   /* Set up other useful info */
  959|     14|   png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels);
  960|     14|   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
  ------------------
  |  |  755|     14|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 0, False: 14]
  |  |  ------------------
  |  |  756|     14|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|     14|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
  961|     14|   png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);
  ------------------
  |  |  148|     14|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  962|     14|   png_debug1(3, "channels = %d", png_ptr->channels);
  ------------------
  |  |  148|     14|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  963|     14|   png_debug1(3, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes);
  ------------------
  |  |  148|     14|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  964|       |
  965|       |   /* Rely on png_set_IHDR to completely validate the data and call png_error if
  966|       |    * it's wrong.
  967|       |    */
  968|     14|   png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
  ------------------
  |  |  363|     14|#define png_set_IHDR OSS_FUZZ_png_set_IHDR
  ------------------
  969|     14|       color_type, interlace_type, compression_type, filter_type);
  970|       |
  971|     14|   return handled_ok;
  972|      0|   PNG_UNUSED(length)
  ------------------
  |  |  479|      0|#  define PNG_UNUSED(param) (void)param;
  ------------------
  973|      0|}
pngrutil.c:png_handle_IEND:
 1086|      3|{
 1087|      3|   png_debug(1, "in png_handle_IEND");
  ------------------
  |  |  145|      3|#  define png_debug(l, m) ((void)0)
  ------------------
 1088|       |
 1089|      3|   png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);
  ------------------
  |  |  644|      3|#define PNG_AFTER_IDAT 0x08
  ------------------
                 png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);
  ------------------
  |  |  644|      3|#define PNG_HAVE_IEND               0x10U
  ------------------
 1090|       |
 1091|      3|   if (length != 0)
  ------------------
  |  Branch (1091:8): [True: 3, False: 0]
  ------------------
 1092|      3|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  238|      3|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1093|       |
 1094|      3|   png_crc_finish_critical(png_ptr, length, 1/*handle as ancillary*/);
 1095|       |
 1096|      3|   return handled_ok;
 1097|      0|   PNG_UNUSED(info_ptr)
  ------------------
  |  |  479|      0|#  define PNG_UNUSED(param) (void)param;
  ------------------
 1098|      0|}
pngrutil.c:png_handle_iCCP:
 1329|  4.40k|{
 1330|  4.40k|   png_const_charp errmsg = NULL; /* error message output, or no error */
 1331|  4.40k|   int finished = 0; /* crc checked */
 1332|       |
 1333|  4.40k|   png_debug(1, "in png_handle_iCCP");
  ------------------
  |  |  145|  4.40k|#  define png_debug(l, m) ((void)0)
  ------------------
 1334|       |
 1335|       |   /* PNGv3: allow PNG files with both sRGB and iCCP because the PNG spec only
 1336|       |    * ever said that there "should" be only one, not "shall" and the PNGv3
 1337|       |    * colour chunk precedence rules give a handling for this case anyway.
 1338|       |    */
 1339|  4.40k|   {
 1340|  4.40k|      uInt read_length, keyword_length;
 1341|  4.40k|      char keyword[81];
 1342|       |
 1343|       |      /* Find the keyword; the keyword plus separator and compression method
 1344|       |       * bytes can be at most 81 characters long.
 1345|       |       */
 1346|  4.40k|      read_length = 81; /* maximum */
 1347|  4.40k|      if (read_length > length)
  ------------------
  |  Branch (1347:11): [True: 0, False: 4.40k]
  ------------------
 1348|      0|         read_length = (uInt)/*SAFE*/length;
 1349|       |
 1350|  4.40k|      png_crc_read(png_ptr, (png_bytep)keyword, read_length);
  ------------------
  |  |   24|  4.40k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1351|  4.40k|      length -= read_length;
 1352|       |
 1353|  4.40k|      if (length < LZ77Min)
  ------------------
  |  |   23|  4.40k|#define LZ77Min  (2U+5U+4U)
  ------------------
  |  Branch (1353:11): [True: 0, False: 4.40k]
  ------------------
 1354|      0|      {
 1355|      0|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1356|      0|         png_chunk_benign_error(png_ptr, "too short");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1357|      0|         return handled_error;
 1358|      0|      }
 1359|       |
 1360|  4.40k|      keyword_length = 0;
 1361|  97.6k|      while (keyword_length < 80 && keyword_length < read_length &&
  ------------------
  |  Branch (1361:14): [True: 97.6k, False: 0]
  |  Branch (1361:37): [True: 97.6k, False: 0]
  ------------------
 1362|  97.6k|         keyword[keyword_length] != 0)
  ------------------
  |  Branch (1362:10): [True: 93.2k, False: 4.40k]
  ------------------
 1363|  93.2k|         ++keyword_length;
 1364|       |
 1365|       |      /* TODO: make the keyword checking common */
 1366|  4.40k|      if (keyword_length >= 1 && keyword_length <= 79)
  ------------------
  |  Branch (1366:11): [True: 4.40k, False: 0]
  |  Branch (1366:34): [True: 4.40k, False: 0]
  ------------------
 1367|  4.40k|      {
 1368|       |         /* We only understand '0' compression - deflate - so if we get a
 1369|       |          * different value we can't safely decode the chunk.
 1370|       |          */
 1371|  4.40k|         if (keyword_length+1 < read_length &&
  ------------------
  |  Branch (1371:14): [True: 4.40k, False: 0]
  ------------------
 1372|  4.40k|            keyword[keyword_length+1] == PNG_COMPRESSION_TYPE_BASE)
  ------------------
  |  |  676|  4.40k|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */
  ------------------
  |  Branch (1372:13): [True: 4.09k, False: 309]
  ------------------
 1373|  4.09k|         {
 1374|  4.09k|            read_length -= keyword_length+2;
 1375|       |
 1376|  4.09k|            if (png_inflate_claim(png_ptr, png_iCCP) == Z_OK)
  ------------------
  |  |  904|  4.09k|#define png_iCCP PNG_U32(105,  67,  67,  80)
  |  |  ------------------
  |  |  |  |  845|  4.09k|   (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  4.09k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  4.09k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  4.09k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  |  |                  (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
  |  |  |  |  ------------------
  |  |  |  |  |  |  843|  4.09k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (1376:17): [True: 4.09k, False: 0]
  ------------------
 1377|  4.09k|            {
 1378|  4.09k|               Byte profile_header[132]={0};
 1379|  4.09k|               Byte local_buffer[PNG_INFLATE_BUF_SIZE];
 1380|  4.09k|               png_alloc_size_t size = (sizeof profile_header);
 1381|       |
 1382|  4.09k|               png_ptr->zstream.next_in = (Bytef*)keyword + (keyword_length+2);
 1383|  4.09k|               png_ptr->zstream.avail_in = read_length;
 1384|  4.09k|               (void)png_inflate_read(png_ptr, local_buffer,
 1385|  4.09k|                   (sizeof local_buffer), &length, profile_header, &size,
 1386|  4.09k|                   0/*finish: don't, because the output is too small*/);
 1387|       |
 1388|  4.09k|               if (size == 0)
  ------------------
  |  Branch (1388:20): [True: 3.41k, False: 676]
  ------------------
 1389|  3.41k|               {
 1390|       |                  /* We have the ICC profile header; do the basic header checks.
 1391|       |                   */
 1392|  3.41k|                  png_uint_32 profile_length = png_get_uint_32(profile_header);
  ------------------
  |  |  322|  3.41k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|  3.41k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|  3.41k|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|  3.41k|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|  3.41k|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|  3.41k|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1393|       |
 1394|  3.41k|                  if (png_icc_check_length(png_ptr, keyword, profile_length) !=
  ------------------
  |  |   68|  3.41k|#define png_icc_check_length OSS_FUZZ_png_icc_check_length
  ------------------
  |  Branch (1394:23): [True: 2.43k, False: 979]
  ------------------
 1395|  3.41k|                      0)
 1396|  2.43k|                  {
 1397|       |                     /* The length is apparently ok, so we can check the 132
 1398|       |                      * byte header.
 1399|       |                      */
 1400|  2.43k|                     if (png_icc_check_header(png_ptr, keyword, profile_length,
  ------------------
  |  |   69|  2.43k|#define png_icc_check_header OSS_FUZZ_png_icc_check_header
  ------------------
  |  Branch (1400:26): [True: 0, False: 2.43k]
  ------------------
 1401|  2.43k|                              profile_header, png_ptr->color_type) != 0)
 1402|      0|                     {
 1403|       |                        /* Now read the tag table; a variable size buffer is
 1404|       |                         * needed at this point, allocate one for the whole
 1405|       |                         * profile.  The header check has already validated
 1406|       |                         * that none of this stuff will overflow.
 1407|       |                         */
 1408|      0|                        png_uint_32 tag_count =
 1409|      0|                           png_get_uint_32(profile_header + 128);
  ------------------
  |  |  322|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  ------------------
  |  |  |  |  462|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2823|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  | 2824|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  | 2825|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  | 2826|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1410|      0|                        png_bytep profile = png_read_buffer(png_ptr,
 1411|      0|                              profile_length);
 1412|       |
 1413|      0|                        if (profile != NULL)
  ------------------
  |  Branch (1413:29): [True: 0, False: 0]
  ------------------
 1414|      0|                        {
 1415|      0|                           memcpy(profile, profile_header,
 1416|      0|                               (sizeof profile_header));
 1417|       |
 1418|      0|                           size = 12 * tag_count;
 1419|       |
 1420|      0|                           (void)png_inflate_read(png_ptr, local_buffer,
 1421|      0|                               (sizeof local_buffer), &length,
 1422|      0|                               profile + (sizeof profile_header), &size, 0);
 1423|       |
 1424|       |                           /* Still expect a buffer error because we expect
 1425|       |                            * there to be some tag data!
 1426|       |                            */
 1427|      0|                           if (size == 0)
  ------------------
  |  Branch (1427:32): [True: 0, False: 0]
  ------------------
 1428|      0|                           {
 1429|      0|                              if (png_icc_check_tag_table(png_ptr,
  ------------------
  |  |   70|      0|#define png_icc_check_tag_table OSS_FUZZ_png_icc_check_tag_table
  ------------------
  |  Branch (1429:35): [True: 0, False: 0]
  ------------------
 1430|      0|                                       keyword, profile_length, profile) != 0)
 1431|      0|                              {
 1432|       |                                 /* The profile has been validated for basic
 1433|       |                                  * security issues, so read the whole thing in.
 1434|       |                                  */
 1435|      0|                                 size = profile_length - (sizeof profile_header)
 1436|      0|                                     - 12 * tag_count;
 1437|       |
 1438|      0|                                 (void)png_inflate_read(png_ptr, local_buffer,
 1439|      0|                                     (sizeof local_buffer), &length,
 1440|      0|                                     profile + (sizeof profile_header) +
 1441|      0|                                     12 * tag_count, &size, 1/*finish*/);
 1442|       |
 1443|      0|                                 if (length > 0 && !(png_ptr->flags &
  ------------------
  |  Branch (1443:38): [True: 0, False: 0]
  |  Branch (1443:52): [True: 0, False: 0]
  ------------------
 1444|      0|                                     PNG_FLAG_BENIGN_ERRORS_WARN))
  ------------------
  |  |  715|      0|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
 1445|      0|                                    errmsg = "extra compressed data";
 1446|       |
 1447|       |                                 /* But otherwise allow extra data: */
 1448|      0|                                 else if (size == 0)
  ------------------
  |  Branch (1448:43): [True: 0, False: 0]
  ------------------
 1449|      0|                                 {
 1450|      0|                                    if (length > 0)
  ------------------
  |  Branch (1450:41): [True: 0, False: 0]
  ------------------
 1451|      0|                                    {
 1452|       |                                       /* This can be handled completely, so
 1453|       |                                        * keep going.
 1454|       |                                        */
 1455|      0|                                       png_chunk_warning(png_ptr,
  ------------------
  |  |  240|      0|#define png_chunk_warning OSS_FUZZ_png_chunk_warning
  ------------------
 1456|      0|                                           "extra compressed data");
 1457|      0|                                    }
 1458|       |
 1459|      0|                                    png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1460|      0|                                    finished = 1;
 1461|       |
 1462|       |                                    /* Steal the profile for info_ptr. */
 1463|      0|                                    if (info_ptr != NULL)
  ------------------
  |  Branch (1463:41): [True: 0, False: 0]
  ------------------
 1464|      0|                                    {
 1465|      0|                                       png_free_data(png_ptr, info_ptr,
  ------------------
  |  |  254|      0|#define png_free_data OSS_FUZZ_png_free_data
  ------------------
 1466|      0|                                           PNG_FREE_ICCP, 0);
  ------------------
  |  | 1839|      0|#define PNG_FREE_ICCP 0x0010U
  ------------------
 1467|       |
 1468|      0|                                       info_ptr->iccp_name = png_voidcast(char*,
  ------------------
  |  |  535|      0|#  define png_voidcast(type, value) (value)
  ------------------
 1469|      0|                                           png_malloc_base(png_ptr,
 1470|      0|                                           keyword_length+1));
 1471|      0|                                       if (info_ptr->iccp_name != NULL)
  ------------------
  |  Branch (1471:44): [True: 0, False: 0]
  ------------------
 1472|      0|                                       {
 1473|      0|                                          memcpy(info_ptr->iccp_name, keyword,
 1474|      0|                                              keyword_length+1);
 1475|      0|                                          info_ptr->iccp_proflen =
 1476|      0|                                              profile_length;
 1477|      0|                                          info_ptr->iccp_profile = profile;
 1478|      0|                                          png_ptr->read_buffer = NULL; /*steal*/
 1479|      0|                                          info_ptr->free_me |= PNG_FREE_ICCP;
  ------------------
  |  | 1839|      0|#define PNG_FREE_ICCP 0x0010U
  ------------------
 1480|      0|                                          info_ptr->valid |= PNG_INFO_iCCP;
  ------------------
  |  |  742|      0|#define PNG_INFO_iCCP 0x1000U  /* ESR, 1.0.6 */
  ------------------
 1481|      0|                                       }
 1482|       |
 1483|      0|                                       else
 1484|      0|                                          errmsg = "out of memory";
 1485|      0|                                    }
 1486|       |
 1487|       |                                    /* else the profile remains in the read
 1488|       |                                     * buffer which gets reused for subsequent
 1489|       |                                     * chunks.
 1490|       |                                     */
 1491|       |
 1492|      0|                                    if (errmsg == NULL)
  ------------------
  |  Branch (1492:41): [True: 0, False: 0]
  ------------------
 1493|      0|                                    {
 1494|      0|                                       png_ptr->zowner = 0;
 1495|      0|                                       return handled_ok;
 1496|      0|                                    }
 1497|      0|                                 }
 1498|      0|                                 if (errmsg == NULL)
  ------------------
  |  Branch (1498:38): [True: 0, False: 0]
  ------------------
 1499|      0|                                    errmsg = png_ptr->zstream.msg;
 1500|      0|                              }
 1501|       |                              /* else png_icc_check_tag_table output an error */
 1502|      0|                           }
 1503|      0|                           else /* profile truncated */
 1504|      0|                              errmsg = png_ptr->zstream.msg;
 1505|      0|                        }
 1506|       |
 1507|      0|                        else
 1508|      0|                           errmsg = "out of memory";
 1509|      0|                     }
 1510|       |
 1511|       |                     /* else png_icc_check_header output an error */
 1512|  2.43k|                  }
 1513|       |
 1514|       |                  /* else png_icc_check_length output an error */
 1515|  3.41k|               }
 1516|       |
 1517|    676|               else /* profile truncated */
 1518|    676|                  errmsg = png_ptr->zstream.msg;
 1519|       |
 1520|       |               /* Release the stream */
 1521|  4.09k|               png_ptr->zowner = 0;
 1522|  4.09k|            }
 1523|       |
 1524|      0|            else /* png_inflate_claim failed */
 1525|      0|               errmsg = png_ptr->zstream.msg;
 1526|  4.09k|         }
 1527|       |
 1528|    309|         else
 1529|    309|            errmsg = "bad compression method"; /* or missing */
 1530|  4.40k|      }
 1531|       |
 1532|      0|      else
 1533|      0|         errmsg = "bad keyword";
 1534|  4.40k|   }
 1535|       |
 1536|       |   /* Failure: the reason is in 'errmsg' */
 1537|  4.40k|   if (finished == 0)
  ------------------
  |  Branch (1537:8): [True: 4.40k, False: 0]
  ------------------
 1538|  4.40k|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|  4.40k|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1539|       |
 1540|  4.40k|   if (errmsg != NULL) /* else already output */
  ------------------
  |  Branch (1540:8): [True: 985, False: 3.41k]
  ------------------
 1541|    985|      png_chunk_benign_error(png_ptr, errmsg);
  ------------------
  |  |  238|    985|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1542|       |
 1543|  4.40k|   return handled_error;
 1544|  4.40k|}
pngrutil.c:png_inflate_read:
  839|  4.09k|{
  840|  4.09k|   if (png_ptr->zowner == png_ptr->chunk_name)
  ------------------
  |  Branch (840:8): [True: 4.09k, False: 0]
  ------------------
  841|  4.09k|   {
  842|  4.09k|      int ret;
  843|       |
  844|       |      /* next_in and avail_in must have been initialized by the caller. */
  845|  4.09k|      png_ptr->zstream.next_out = next_out;
  846|  4.09k|      png_ptr->zstream.avail_out = 0; /* set in the loop */
  847|       |
  848|  4.09k|      do
  849|  5.35k|      {
  850|  5.35k|         if (png_ptr->zstream.avail_in == 0)
  ------------------
  |  Branch (850:14): [True: 1.26k, False: 4.09k]
  ------------------
  851|  1.26k|         {
  852|  1.26k|            if (read_size > *chunk_bytes)
  ------------------
  |  Branch (852:17): [True: 1.26k, False: 0]
  ------------------
  853|  1.26k|               read_size = (uInt)*chunk_bytes;
  854|  1.26k|            *chunk_bytes -= read_size;
  855|       |
  856|  1.26k|            if (read_size > 0)
  ------------------
  |  Branch (856:17): [True: 1.26k, False: 0]
  ------------------
  857|  1.26k|               png_crc_read(png_ptr, read_buffer, read_size);
  ------------------
  |  |   24|  1.26k|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
  858|       |
  859|  1.26k|            png_ptr->zstream.next_in = read_buffer;
  860|  1.26k|            png_ptr->zstream.avail_in = read_size;
  861|  1.26k|         }
  862|       |
  863|  5.35k|         if (png_ptr->zstream.avail_out == 0)
  ------------------
  |  Branch (863:14): [True: 4.09k, False: 1.26k]
  ------------------
  864|  4.09k|         {
  865|  4.09k|            uInt avail = ZLIB_IO_MAX;
  ------------------
  |  |   53|  4.09k|#  define ZLIB_IO_MAX ((uInt)-1)
  ------------------
  866|  4.09k|            if (avail > *out_size)
  ------------------
  |  Branch (866:17): [True: 4.09k, False: 0]
  ------------------
  867|  4.09k|               avail = (uInt)*out_size;
  868|  4.09k|            *out_size -= avail;
  869|       |
  870|  4.09k|            png_ptr->zstream.avail_out = avail;
  871|  4.09k|         }
  872|       |
  873|       |         /* Use Z_SYNC_FLUSH when there is no more chunk data to ensure that all
  874|       |          * the available output is produced; this allows reading of truncated
  875|       |          * streams.
  876|       |          */
  877|  5.35k|         ret = PNG_INFLATE(png_ptr, *chunk_bytes > 0 ?
  ------------------
  |  | 1729|  13.2k|#  define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush)
  |  |  ------------------
  |  |  |  |   42|  5.35k|#define png_zlib_inflate OSS_FUZZ_png_zlib_inflate
  |  |  ------------------
  |  |  |  Branch (1729:55): [True: 0, False: 1.26k]
  |  |  |  Branch (1729:55): [True: 4.09k, False: 1.26k]
  |  |  ------------------
  ------------------
  878|  5.35k|             Z_NO_FLUSH : (finish ? Z_FINISH : Z_SYNC_FLUSH));
  879|  5.35k|      }
  880|  5.35k|      while (ret == Z_OK && (*out_size > 0 || png_ptr->zstream.avail_out > 0));
  ------------------
  |  Branch (880:14): [True: 4.68k, False: 676]
  |  Branch (880:30): [True: 0, False: 4.68k]
  |  Branch (880:47): [True: 1.26k, False: 3.41k]
  ------------------
  881|       |
  882|  4.09k|      *out_size += png_ptr->zstream.avail_out;
  883|  4.09k|      png_ptr->zstream.avail_out = 0; /* Should not be required, but is safe */
  884|       |
  885|       |      /* Ensure the error message pointer is always set: */
  886|  4.09k|      png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|  4.09k|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  887|  4.09k|      return ret;
  888|  4.09k|   }
  889|       |
  890|      0|   else
  891|      0|   {
  892|      0|      png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
  893|       |      return Z_STREAM_ERROR;
  894|      0|   }
  895|  4.09k|}
pngrutil.c:png_handle_iTXt:
 2564|    905|{
 2565|    905|   png_const_charp errmsg = NULL;
 2566|    905|   png_bytep buffer;
 2567|    905|   png_uint_32 prefix_length;
 2568|       |
 2569|    905|   png_debug(1, "in png_handle_iTXt");
  ------------------
  |  |  145|    905|#  define png_debug(l, m) ((void)0)
  ------------------
 2570|       |
 2571|    905|#ifdef PNG_USER_LIMITS_SUPPORTED
 2572|    905|   if (png_ptr->user_chunk_cache_max != 0)
  ------------------
  |  Branch (2572:8): [True: 905, False: 0]
  ------------------
 2573|    905|   {
 2574|    905|      if (png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2574:11): [True: 132, False: 773]
  ------------------
 2575|    132|      {
 2576|    132|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|    132|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2577|    132|         return handled_error;
 2578|    132|      }
 2579|       |
 2580|    773|      if (--png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2580:11): [True: 0, False: 773]
  ------------------
 2581|      0|      {
 2582|      0|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2583|      0|         png_chunk_benign_error(png_ptr, "no space in chunk cache");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2584|      0|         return handled_error;
 2585|      0|      }
 2586|    773|   }
 2587|    773|#endif
 2588|       |
 2589|    773|   buffer = png_read_buffer(png_ptr, length+1);
 2590|       |
 2591|    773|   if (buffer == NULL)
  ------------------
  |  Branch (2591:8): [True: 1, False: 772]
  ------------------
 2592|      1|   {
 2593|      1|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      1|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2594|      1|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  238|      1|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2595|      1|      return handled_error;
 2596|      1|   }
 2597|       |
 2598|    772|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   24|    772|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2599|       |
 2600|    772|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   25|    772|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2600:8): [True: 0, False: 772]
  ------------------
 2601|      0|      return handled_error;
 2602|       |
 2603|       |   /* First the keyword. */
 2604|    772|   for (prefix_length=0;
 2605|  11.7k|      prefix_length < length && buffer[prefix_length] != 0;
  ------------------
  |  Branch (2605:7): [True: 11.7k, False: 0]
  |  Branch (2605:33): [True: 11.0k, False: 772]
  ------------------
 2606|  11.0k|      ++prefix_length)
 2607|  11.0k|      /* Empty loop */ ;
 2608|       |
 2609|       |   /* Perform a basic check on the keyword length here. */
 2610|    772|   if (prefix_length > 79 || prefix_length < 1)
  ------------------
  |  Branch (2610:8): [True: 0, False: 772]
  |  Branch (2610:30): [True: 0, False: 772]
  ------------------
 2611|      0|      errmsg = "bad keyword";
 2612|       |
 2613|       |   /* Expect keyword, compression flag, compression type, language, translated
 2614|       |    * keyword (both may be empty but are 0 terminated) then the text, which may
 2615|       |    * be empty.
 2616|       |    */
 2617|    772|   else if (prefix_length + 5 > length)
  ------------------
  |  Branch (2617:13): [True: 0, False: 772]
  ------------------
 2618|      0|      errmsg = "truncated";
 2619|       |
 2620|    772|   else if (buffer[prefix_length+1] == 0 ||
  ------------------
  |  Branch (2620:13): [True: 494, False: 278]
  ------------------
 2621|    278|      (buffer[prefix_length+1] == 1 &&
  ------------------
  |  Branch (2621:8): [True: 69, False: 209]
  ------------------
 2622|     69|      buffer[prefix_length+2] == PNG_COMPRESSION_TYPE_BASE))
  ------------------
  |  |  676|     69|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */
  ------------------
  |  Branch (2622:7): [True: 69, False: 0]
  ------------------
 2623|    563|   {
 2624|    563|      int compressed = buffer[prefix_length+1] != 0;
 2625|    563|      png_uint_32 language_offset, translated_keyword_offset;
 2626|    563|      png_alloc_size_t uncompressed_length = 0;
 2627|       |
 2628|       |      /* Now the language tag */
 2629|    563|      prefix_length += 3;
 2630|    563|      language_offset = prefix_length;
 2631|       |
 2632|  2.74k|      for (; prefix_length < length && buffer[prefix_length] != 0;
  ------------------
  |  Branch (2632:14): [True: 2.74k, False: 0]
  |  Branch (2632:40): [True: 2.18k, False: 563]
  ------------------
 2633|  2.18k|         ++prefix_length)
 2634|  2.18k|         /* Empty loop */ ;
 2635|       |
 2636|       |      /* WARNING: the length may be invalid here, this is checked below. */
 2637|    563|      translated_keyword_offset = ++prefix_length;
 2638|       |
 2639|  1.35k|      for (; prefix_length < length && buffer[prefix_length] != 0;
  ------------------
  |  Branch (2639:14): [True: 1.35k, False: 0]
  |  Branch (2639:40): [True: 796, False: 563]
  ------------------
 2640|    796|         ++prefix_length)
 2641|    796|         /* Empty loop */ ;
 2642|       |
 2643|       |      /* prefix_length should now be at the trailing '\0' of the translated
 2644|       |       * keyword, but it may already be over the end.  None of this arithmetic
 2645|       |       * can overflow because chunks are at most 2^31 bytes long, but on 16-bit
 2646|       |       * systems the available allocation may overflow.
 2647|       |       */
 2648|    563|      ++prefix_length;
 2649|       |
 2650|    563|      if (compressed == 0 && prefix_length <= length)
  ------------------
  |  Branch (2650:11): [True: 494, False: 69]
  |  Branch (2650:30): [True: 494, False: 0]
  ------------------
 2651|    494|         uncompressed_length = length - prefix_length;
 2652|       |
 2653|     69|      else if (compressed != 0 && prefix_length < length)
  ------------------
  |  Branch (2653:16): [True: 69, False: 0]
  |  Branch (2653:35): [True: 69, False: 0]
  ------------------
 2654|     69|      {
 2655|     69|         uncompressed_length = PNG_SIZE_MAX;
  ------------------
  |  |  649|     69|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
 2656|       |
 2657|       |         /* TODO: at present png_decompress_chunk imposes a single application
 2658|       |          * level memory limit, this should be split to different values for
 2659|       |          * iCCP and text chunks.
 2660|       |          */
 2661|     69|         if (png_decompress_chunk(png_ptr, length, prefix_length,
  ------------------
  |  Branch (2661:14): [True: 0, False: 69]
  ------------------
 2662|     69|             &uncompressed_length, 1/*terminate*/) == Z_STREAM_END)
 2663|      0|            buffer = png_ptr->read_buffer;
 2664|       |
 2665|     69|         else
 2666|     69|            errmsg = png_ptr->zstream.msg;
 2667|     69|      }
 2668|       |
 2669|      0|      else
 2670|      0|         errmsg = "truncated";
 2671|       |
 2672|    563|      if (errmsg == NULL)
  ------------------
  |  Branch (2672:11): [True: 494, False: 69]
  ------------------
 2673|    494|      {
 2674|    494|         png_text text;
 2675|       |
 2676|    494|         buffer[uncompressed_length+prefix_length] = 0;
 2677|       |
 2678|    494|         if (compressed == 0)
  ------------------
  |  Branch (2678:14): [True: 494, False: 0]
  ------------------
 2679|    494|            text.compression = PNG_ITXT_COMPRESSION_NONE;
  ------------------
  |  |  588|    494|#define PNG_ITXT_COMPRESSION_NONE     1
  ------------------
 2680|       |
 2681|      0|         else
 2682|      0|            text.compression = PNG_ITXT_COMPRESSION_zTXt;
  ------------------
  |  |  589|      0|#define PNG_ITXT_COMPRESSION_zTXt     2
  ------------------
 2683|       |
 2684|    494|         text.key = (png_charp)buffer;
 2685|    494|         text.lang = (png_charp)buffer + language_offset;
 2686|    494|         text.lang_key = (png_charp)buffer + translated_keyword_offset;
 2687|    494|         text.text = (png_charp)buffer + prefix_length;
 2688|    494|         text.text_length = 0;
 2689|    494|         text.itxt_length = uncompressed_length;
 2690|       |
 2691|    494|         if (png_set_text_2(png_ptr, info_ptr, &text, 1) == 0)
  ------------------
  |  |   31|    494|#define png_set_text_2 OSS_FUZZ_png_set_text_2
  ------------------
  |  Branch (2691:14): [True: 494, False: 0]
  ------------------
 2692|    494|            return handled_ok;
 2693|       |
 2694|      0|         errmsg = "out of memory";
 2695|      0|      }
 2696|    563|   }
 2697|       |
 2698|    209|   else
 2699|    209|      errmsg = "bad compression info";
 2700|       |
 2701|    278|   if (errmsg != NULL)
  ------------------
  |  Branch (2701:8): [True: 278, False: 0]
  ------------------
 2702|    278|      png_chunk_benign_error(png_ptr, errmsg);
  ------------------
  |  |  238|    278|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2703|    278|   return handled_error;
 2704|    772|}
pngrutil.c:png_decompress_chunk:
  685|    469|{
  686|       |   /* TODO: implement different limits for different types of chunk.
  687|       |    *
  688|       |    * The caller supplies *newlength set to the maximum length of the
  689|       |    * uncompressed data, but this routine allocates space for the prefix and
  690|       |    * maybe a '\0' terminator too.  We have to assume that 'prefix_size' is
  691|       |    * limited only by the maximum chunk size.
  692|       |    */
  693|    469|   png_alloc_size_t limit = png_chunk_max(png_ptr);
  ------------------
  |  | 1126|    469|#  define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max)
  ------------------
  694|       |
  695|    469|   if (limit >= prefix_size + (terminate != 0))
  ------------------
  |  Branch (695:8): [True: 469, False: 0]
  ------------------
  696|    469|   {
  697|    469|      int ret;
  698|       |
  699|    469|      limit -= prefix_size + (terminate != 0);
  700|       |
  701|    469|      if (limit < *newlength)
  ------------------
  |  Branch (701:11): [True: 469, False: 0]
  ------------------
  702|    469|         *newlength = limit;
  703|       |
  704|       |      /* Now try to claim the stream. */
  705|    469|      ret = png_inflate_claim(png_ptr, png_ptr->chunk_name);
  706|       |
  707|    469|      if (ret == Z_OK)
  ------------------
  |  Branch (707:11): [True: 468, False: 1]
  ------------------
  708|    468|      {
  709|    468|         png_uint_32 lzsize = chunklength - prefix_size;
  710|       |
  711|    468|         ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/,
  712|    468|             /* input: */ png_ptr->read_buffer + prefix_size, &lzsize,
  713|    468|             /* output: */ NULL, newlength);
  714|       |
  715|    468|         if (ret == Z_STREAM_END)
  ------------------
  |  Branch (715:14): [True: 0, False: 468]
  ------------------
  716|      0|         {
  717|       |            /* Use 'inflateReset' here, not 'inflateReset2' because this
  718|       |             * preserves the previously decided window size (otherwise it would
  719|       |             * be necessary to store the previous window size.)  In practice
  720|       |             * this doesn't matter anyway, because png_inflate will call inflate
  721|       |             * with Z_FINISH in almost all cases, so the window will not be
  722|       |             * maintained.
  723|       |             */
  724|      0|            if (inflateReset(&png_ptr->zstream) == Z_OK)
  ------------------
  |  Branch (724:17): [True: 0, False: 0]
  ------------------
  725|      0|            {
  726|       |               /* Because of the limit checks above we know that the new,
  727|       |                * expanded, size will fit in a size_t (let alone an
  728|       |                * png_alloc_size_t).  Use png_malloc_base here to avoid an
  729|       |                * extra OOM message.
  730|       |                */
  731|      0|               png_alloc_size_t new_size = *newlength;
  732|      0|               png_alloc_size_t buffer_size = prefix_size + new_size +
  733|      0|                   (terminate != 0);
  734|      0|               png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr,
  ------------------
  |  |  535|      0|#  define png_voidcast(type, value) (value)
  ------------------
  735|      0|                   buffer_size));
  736|       |
  737|      0|               if (text != NULL)
  ------------------
  |  Branch (737:20): [True: 0, False: 0]
  ------------------
  738|      0|               {
  739|      0|                  memset(text, 0, buffer_size);
  740|       |
  741|      0|                  ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/,
  742|      0|                      png_ptr->read_buffer + prefix_size, &lzsize,
  743|      0|                      text + prefix_size, newlength);
  744|       |
  745|      0|                  if (ret == Z_STREAM_END)
  ------------------
  |  Branch (745:23): [True: 0, False: 0]
  ------------------
  746|      0|                  {
  747|      0|                     if (new_size == *newlength)
  ------------------
  |  Branch (747:26): [True: 0, False: 0]
  ------------------
  748|      0|                     {
  749|      0|                        if (terminate != 0)
  ------------------
  |  Branch (749:29): [True: 0, False: 0]
  ------------------
  750|      0|                           text[prefix_size + *newlength] = 0;
  751|       |
  752|      0|                        if (prefix_size > 0)
  ------------------
  |  Branch (752:29): [True: 0, False: 0]
  ------------------
  753|      0|                           memcpy(text, png_ptr->read_buffer, prefix_size);
  754|       |
  755|      0|                        {
  756|      0|                           png_bytep old_ptr = png_ptr->read_buffer;
  757|       |
  758|      0|                           png_ptr->read_buffer = text;
  759|      0|                           png_ptr->read_buffer_size = buffer_size;
  760|      0|                           text = old_ptr; /* freed below */
  761|      0|                        }
  762|      0|                     }
  763|       |
  764|      0|                     else
  765|      0|                     {
  766|       |                        /* The size changed on the second read, there can be no
  767|       |                         * guarantee that anything is correct at this point.
  768|       |                         * The 'msg' pointer has been set to "unexpected end of
  769|       |                         * LZ stream", which is fine, but return an error code
  770|       |                         * that the caller won't accept.
  771|       |                         */
  772|      0|                        ret = PNG_UNEXPECTED_ZLIB_RETURN;
  ------------------
  |  | 1077|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  773|      0|                     }
  774|      0|                  }
  775|       |
  776|      0|                  else if (ret == Z_OK)
  ------------------
  |  Branch (776:28): [True: 0, False: 0]
  ------------------
  777|      0|                     ret = PNG_UNEXPECTED_ZLIB_RETURN; /* for safety */
  ------------------
  |  | 1077|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  778|       |
  779|       |                  /* Free the text pointer (this is the old read_buffer on
  780|       |                   * success)
  781|       |                   */
  782|      0|                  png_free(png_ptr, text);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
  783|       |
  784|       |                  /* This really is very benign, but it's still an error because
  785|       |                   * the extra space may otherwise be used as a Trojan Horse.
  786|       |                   */
  787|      0|                  if (ret == Z_STREAM_END &&
  ------------------
  |  Branch (787:23): [True: 0, False: 0]
  ------------------
  788|      0|                      chunklength - prefix_size != lzsize)
  ------------------
  |  Branch (788:23): [True: 0, False: 0]
  ------------------
  789|      0|                     png_chunk_benign_error(png_ptr, "extra compressed data");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
  790|      0|               }
  791|       |
  792|      0|               else
  793|      0|               {
  794|       |                  /* Out of memory allocating the buffer */
  795|      0|                  ret = Z_MEM_ERROR;
  796|      0|                  png_zstream_error(png_ptr, Z_MEM_ERROR);
  ------------------
  |  |    4|      0|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  797|      0|               }
  798|      0|            }
  799|       |
  800|      0|            else
  801|      0|            {
  802|       |               /* inflateReset failed, store the error message */
  803|      0|               png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|      0|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  804|      0|               ret = PNG_UNEXPECTED_ZLIB_RETURN;
  ------------------
  |  | 1077|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  805|      0|            }
  806|      0|         }
  807|       |
  808|    468|         else if (ret == Z_OK)
  ------------------
  |  Branch (808:19): [True: 0, False: 468]
  ------------------
  809|      0|            ret = PNG_UNEXPECTED_ZLIB_RETURN;
  ------------------
  |  | 1077|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  810|       |
  811|       |         /* Release the claimed stream */
  812|    468|         png_ptr->zowner = 0;
  813|    468|      }
  814|       |
  815|      1|      else /* the claim failed */ if (ret == Z_STREAM_END) /* impossible! */
  ------------------
  |  Branch (815:39): [True: 0, False: 1]
  ------------------
  816|      0|         ret = PNG_UNEXPECTED_ZLIB_RETURN;
  ------------------
  |  | 1077|      0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7)
  ------------------
  817|       |
  818|    469|      return ret;
  819|    469|   }
  820|       |
  821|      0|   else
  822|      0|   {
  823|       |      /* Application/configuration limits exceeded */
  824|      0|      png_zstream_error(png_ptr, Z_MEM_ERROR);
  ------------------
  |  |    4|      0|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  825|       |      return Z_MEM_ERROR;
  826|      0|   }
  827|    469|}
pngrutil.c:png_inflate:
  559|    468|{
  560|    468|   if (png_ptr->zowner == owner) /* Else not claimed */
  ------------------
  |  Branch (560:8): [True: 468, False: 0]
  ------------------
  561|    468|   {
  562|    468|      int ret;
  563|    468|      png_alloc_size_t avail_out = *output_size_ptr;
  564|    468|      png_uint_32 avail_in = *input_size_ptr;
  565|       |
  566|       |      /* zlib can't necessarily handle more than 65535 bytes at once (i.e. it
  567|       |       * can't even necessarily handle 65536 bytes) because the type uInt is
  568|       |       * "16 bits or more".  Consequently it is necessary to chunk the input to
  569|       |       * zlib.  This code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the
  570|       |       * maximum value that can be stored in a uInt.)  It is possible to set
  571|       |       * ZLIB_IO_MAX to a lower value in pngpriv.h and this may sometimes have
  572|       |       * a performance advantage, because it reduces the amount of data accessed
  573|       |       * at each step and that may give the OS more time to page it in.
  574|       |       */
  575|    468|      png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input);
  ------------------
  |  |   41|    468|#  define PNGZ_INPUT_CAST(b) (b)
  ------------------
  576|       |      /* avail_in and avail_out are set below from 'size' */
  577|    468|      png_ptr->zstream.avail_in = 0;
  578|    468|      png_ptr->zstream.avail_out = 0;
  579|       |
  580|       |      /* Read directly into the output if it is available (this is set to
  581|       |       * a local buffer below if output is NULL).
  582|       |       */
  583|    468|      if (output != NULL)
  ------------------
  |  Branch (583:11): [True: 0, False: 468]
  ------------------
  584|      0|         png_ptr->zstream.next_out = output;
  585|       |
  586|    468|      do
  587|    468|      {
  588|    468|         uInt avail;
  589|    468|         Byte local_buffer[PNG_INFLATE_BUF_SIZE];
  590|       |
  591|       |         /* zlib INPUT BUFFER */
  592|       |         /* The setting of 'avail_in' used to be outside the loop; by setting it
  593|       |          * inside it is possible to chunk the input to zlib and simply rely on
  594|       |          * zlib to advance the 'next_in' pointer.  This allows arbitrary
  595|       |          * amounts of data to be passed through zlib at the unavoidable cost of
  596|       |          * requiring a window save (memcpy of up to 32768 output bytes)
  597|       |          * every ZLIB_IO_MAX input bytes.
  598|       |          */
  599|    468|         avail_in += png_ptr->zstream.avail_in; /* not consumed last time */
  600|       |
  601|    468|         avail = ZLIB_IO_MAX;
  ------------------
  |  |   53|    468|#  define ZLIB_IO_MAX ((uInt)-1)
  ------------------
  602|       |
  603|    468|         if (avail_in < avail)
  ------------------
  |  Branch (603:14): [True: 468, False: 0]
  ------------------
  604|    468|            avail = (uInt)avail_in; /* safe: < than ZLIB_IO_MAX */
  605|       |
  606|    468|         avail_in -= avail;
  607|    468|         png_ptr->zstream.avail_in = avail;
  608|       |
  609|       |         /* zlib OUTPUT BUFFER */
  610|    468|         avail_out += png_ptr->zstream.avail_out; /* not written last time */
  611|       |
  612|    468|         avail = ZLIB_IO_MAX; /* maximum zlib can process */
  ------------------
  |  |   53|    468|#  define ZLIB_IO_MAX ((uInt)-1)
  ------------------
  613|       |
  614|    468|         if (output == NULL)
  ------------------
  |  Branch (614:14): [True: 468, False: 0]
  ------------------
  615|    468|         {
  616|       |            /* Reset the output buffer each time round if output is NULL and
  617|       |             * make available the full buffer, up to 'remaining_space'
  618|       |             */
  619|    468|            png_ptr->zstream.next_out = local_buffer;
  620|    468|            if ((sizeof local_buffer) < avail)
  ------------------
  |  Branch (620:17): [True: 468, False: 0]
  ------------------
  621|    468|               avail = (sizeof local_buffer);
  622|    468|         }
  623|       |
  624|    468|         if (avail_out < avail)
  ------------------
  |  Branch (624:14): [True: 0, False: 468]
  ------------------
  625|      0|            avail = (uInt)avail_out; /* safe: < ZLIB_IO_MAX */
  626|       |
  627|    468|         png_ptr->zstream.avail_out = avail;
  628|    468|         avail_out -= avail;
  629|       |
  630|       |         /* zlib inflate call */
  631|       |         /* In fact 'avail_out' may be 0 at this point, that happens at the end
  632|       |          * of the read when the final LZ end code was not passed at the end of
  633|       |          * the previous chunk of input data.  Tell zlib if we have reached the
  634|       |          * end of the output buffer.
  635|       |          */
  636|    468|         ret = PNG_INFLATE(png_ptr, avail_out > 0 ? Z_NO_FLUSH :
  ------------------
  |  | 1729|    936|#  define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush)
  |  |  ------------------
  |  |  |  |   42|    468|#define png_zlib_inflate OSS_FUZZ_png_zlib_inflate
  |  |  ------------------
  |  |  |  Branch (1729:55): [True: 0, False: 0]
  |  |  |  Branch (1729:55): [True: 468, False: 0]
  |  |  ------------------
  ------------------
  637|    468|             (finish ? Z_FINISH : Z_SYNC_FLUSH));
  638|    468|      } while (ret == Z_OK);
  ------------------
  |  Branch (638:16): [True: 0, False: 468]
  ------------------
  639|       |
  640|       |      /* For safety kill the local buffer pointer now */
  641|    468|      if (output == NULL)
  ------------------
  |  Branch (641:11): [True: 468, False: 0]
  ------------------
  642|    468|         png_ptr->zstream.next_out = NULL;
  643|       |
  644|       |      /* Claw back the 'size' and 'remaining_space' byte counts. */
  645|    468|      avail_in += png_ptr->zstream.avail_in;
  646|    468|      avail_out += png_ptr->zstream.avail_out;
  647|       |
  648|       |      /* Update the input and output sizes; the updated values are the amount
  649|       |       * consumed or written, effectively the inverse of what zlib uses.
  650|       |       */
  651|    468|      if (avail_out > 0)
  ------------------
  |  Branch (651:11): [True: 468, False: 0]
  ------------------
  652|    468|         *output_size_ptr -= avail_out;
  653|       |
  654|    468|      if (avail_in > 0)
  ------------------
  |  Branch (654:11): [True: 468, False: 0]
  ------------------
  655|    468|         *input_size_ptr -= avail_in;
  656|       |
  657|       |      /* Ensure png_ptr->zstream.msg is set (even in the success case!) */
  658|    468|      png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|    468|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  659|    468|      return ret;
  660|    468|   }
  661|       |
  662|      0|   else
  663|      0|   {
  664|       |      /* This is a bad internal error.  The recovery assigns to the zstream msg
  665|       |       * pointer, which is not owned by the caller, but this is safe; it's only
  666|       |       * used on errors!
  667|       |       */
  668|      0|      png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
  ------------------
  |  |   40|      0|#  define PNGZ_MSG_CAST(s) (s)
  ------------------
  669|       |      return Z_STREAM_ERROR;
  670|      0|   }
  671|    468|}
pngrutil.c:png_handle_pCAL:
 2141|    115|{
 2142|    115|   png_bytep buffer;
 2143|    115|   png_bytep buf;
 2144|    115|   png_bytep endptr;
 2145|    115|   png_int_32 X0, X1;
 2146|    115|   png_byte type;
 2147|    115|   png_byte nparams;
 2148|    115|   png_byte *units;
 2149|    115|   png_charpp params;
 2150|    115|   int i;
 2151|       |
 2152|    115|   png_debug(1, "in png_handle_pCAL");
  ------------------
  |  |  145|    115|#  define png_debug(l, m) ((void)0)
  ------------------
 2153|    115|   png_debug1(2, "Allocating and reading pCAL chunk data (%u bytes)",
  ------------------
  |  |  148|    115|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 2154|    115|       length + 1);
 2155|       |
 2156|    115|   buffer = png_read_buffer(png_ptr, length+1);
 2157|       |
 2158|    115|   if (buffer == NULL)
  ------------------
  |  Branch (2158:8): [True: 1, False: 114]
  ------------------
 2159|      1|   {
 2160|      1|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      1|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2161|      1|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  238|      1|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2162|      1|      return handled_error;
 2163|      1|   }
 2164|       |
 2165|    114|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   24|    114|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2166|       |
 2167|    114|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   25|    114|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2167:8): [True: 0, False: 114]
  ------------------
 2168|      0|      return handled_error;
 2169|       |
 2170|    114|   buffer[length] = 0; /* Null terminate the last string */
 2171|       |
 2172|    114|   png_debug(3, "Finding end of pCAL purpose string");
  ------------------
  |  |  145|    114|#  define png_debug(l, m) ((void)0)
  ------------------
 2173|    228|   for (buf = buffer; *buf; buf++)
  ------------------
  |  Branch (2173:23): [True: 114, False: 114]
  ------------------
 2174|    114|      /* Empty loop */ ;
 2175|       |
 2176|    114|   endptr = buffer + length;
 2177|       |
 2178|       |   /* We need to have at least 12 bytes after the purpose string
 2179|       |    * in order to get the parameter information.
 2180|       |    */
 2181|    114|   if (endptr - buf <= 12)
  ------------------
  |  Branch (2181:8): [True: 0, False: 114]
  ------------------
 2182|      0|   {
 2183|      0|      png_chunk_benign_error(png_ptr, "invalid");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2184|      0|      return handled_error;
 2185|      0|   }
 2186|       |
 2187|    114|   png_debug(3, "Reading pCAL X0, X1, type, nparams, and units");
  ------------------
  |  |  145|    114|#  define png_debug(l, m) ((void)0)
  ------------------
 2188|    114|   X0 = png_get_int_32((png_bytep)buf+1);
  ------------------
  |  |  288|    114|#define png_get_int_32 OSS_FUZZ_png_get_int_32
  |  |  ------------------
  |  |  |  |  464|    114|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2837|    114|   ((png_int_32)((*(buf) & 0x80) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (2837:18): [True: 114, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2838|    114|    ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  322|    114|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  462|    114|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2823|    114|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2824|    114|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2825|    114|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2826|    114|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2839|    114|    : (png_int_32)png_get_uint_32(buf)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  322|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  462|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2823|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2824|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2825|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2826|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2189|    114|   X1 = png_get_int_32((png_bytep)buf+5);
  ------------------
  |  |  288|    114|#define png_get_int_32 OSS_FUZZ_png_get_int_32
  |  |  ------------------
  |  |  |  |  464|    114|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2837|    114|   ((png_int_32)((*(buf) & 0x80) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (2837:18): [True: 0, False: 114]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2838|    114|    ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  322|      0|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  462|      0|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2823|      0|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2824|      0|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2825|      0|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2826|      0|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  | 2839|    114|    : (png_int_32)png_get_uint_32(buf)))
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  322|    114|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  462|    114|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf)
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  |  | 2823|    114|   (((png_uint_32)(*(buf)) << 24) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2824|    114|    ((png_uint_32)(*((buf) + 1)) << 16) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2825|    114|    ((png_uint_32)(*((buf) + 2)) << 8) + \
  |  |  |  |  |  |  |  |  |  |  |  | 2826|    114|    ((png_uint_32)(*((buf) + 3))))
  |  |  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 2190|    114|   type = buf[9];
 2191|    114|   nparams = buf[10];
 2192|    114|   units = buf + 11;
 2193|       |
 2194|    114|   png_debug(3, "Checking pCAL equation type and number of parameters");
  ------------------
  |  |  145|    114|#  define png_debug(l, m) ((void)0)
  ------------------
 2195|       |   /* Check that we have the right number of parameters for known
 2196|       |    * equation types.
 2197|       |    */
 2198|    114|   if ((type == PNG_EQUATION_LINEAR && nparams != 2) ||
  ------------------
  |  |  695|    228|#define PNG_EQUATION_LINEAR       0 /* Linear transformation */
  ------------------
  |  Branch (2198:9): [True: 0, False: 114]
  |  Branch (2198:40): [True: 0, False: 0]
  ------------------
 2199|    114|       (type == PNG_EQUATION_BASE_E && nparams != 3) ||
  ------------------
  |  |  696|    228|#define PNG_EQUATION_BASE_E       1 /* Exponential base e transform */
  ------------------
  |  Branch (2199:9): [True: 0, False: 114]
  |  Branch (2199:40): [True: 0, False: 0]
  ------------------
 2200|    114|       (type == PNG_EQUATION_ARBITRARY && nparams != 3) ||
  ------------------
  |  |  697|    228|#define PNG_EQUATION_ARBITRARY    2 /* Arbitrary base exponential transform */
  ------------------
  |  Branch (2200:9): [True: 0, False: 114]
  |  Branch (2200:43): [True: 0, False: 0]
  ------------------
 2201|    114|       (type == PNG_EQUATION_HYPERBOLIC && nparams != 4))
  ------------------
  |  |  698|    228|#define PNG_EQUATION_HYPERBOLIC   3 /* Hyperbolic sine transformation */
  ------------------
  |  Branch (2201:9): [True: 0, False: 114]
  |  Branch (2201:44): [True: 0, False: 0]
  ------------------
 2202|      0|   {
 2203|      0|      png_chunk_benign_error(png_ptr, "invalid parameter count");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2204|      0|      return handled_error;
 2205|      0|   }
 2206|       |
 2207|    114|   else if (type >= PNG_EQUATION_LAST)
  ------------------
  |  |  699|    114|#define PNG_EQUATION_LAST         4 /* Not a valid value */
  ------------------
  |  Branch (2207:13): [True: 114, False: 0]
  ------------------
 2208|    114|   {
 2209|    114|      png_chunk_benign_error(png_ptr, "unrecognized equation type");
  ------------------
  |  |  238|    114|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2210|    114|   }
 2211|       |
 2212|    228|   for (buf = units; *buf; buf++)
  ------------------
  |  Branch (2212:22): [True: 114, False: 114]
  ------------------
 2213|    114|      /* Empty loop to move past the units string. */ ;
 2214|       |
 2215|    114|   png_debug(3, "Allocating pCAL parameters array");
  ------------------
  |  |  145|    114|#  define png_debug(l, m) ((void)0)
  ------------------
 2216|       |
 2217|    114|   params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
  ------------------
  |  |  535|    114|#  define png_voidcast(type, value) (value)
  ------------------
 2218|    114|       nparams * (sizeof (png_charp))));
 2219|       |
 2220|    114|   if (params == NULL)
  ------------------
  |  Branch (2220:8): [True: 27, False: 87]
  ------------------
 2221|     27|   {
 2222|     27|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  238|     27|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2223|     27|      return handled_error;
 2224|     27|   }
 2225|       |
 2226|       |   /* Get pointers to the start of each parameter string. */
 2227|  2.29k|   for (i = 0; i < nparams; i++)
  ------------------
  |  Branch (2227:16): [True: 2.29k, False: 0]
  ------------------
 2228|  2.29k|   {
 2229|  2.29k|      buf++; /* Skip the null string terminator from previous parameter. */
 2230|       |
 2231|  2.29k|      png_debug1(3, "Reading pCAL parameter %d", i);
  ------------------
  |  |  148|  2.29k|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 2232|       |
 2233|  7.74k|      for (params[i] = (png_charp)buf; buf <= endptr && *buf != 0; buf++)
  ------------------
  |  Branch (2233:40): [True: 7.65k, False: 87]
  |  Branch (2233:57): [True: 5.44k, False: 2.21k]
  ------------------
 2234|  5.44k|         /* Empty loop to move past each parameter string */ ;
 2235|       |
 2236|       |      /* Make sure we haven't run out of data yet */
 2237|  2.29k|      if (buf > endptr)
  ------------------
  |  Branch (2237:11): [True: 87, False: 2.21k]
  ------------------
 2238|     87|      {
 2239|     87|         png_free(png_ptr, params);
  ------------------
  |  |  253|     87|#define png_free OSS_FUZZ_png_free
  ------------------
 2240|     87|         png_chunk_benign_error(png_ptr, "invalid data");
  ------------------
  |  |  238|     87|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2241|     87|         return handled_error;
 2242|     87|      }
 2243|  2.29k|   }
 2244|       |
 2245|      0|   png_set_pCAL(png_ptr, info_ptr, (png_charp)buffer, X0, X1, type, nparams,
  ------------------
  |  |  410|      0|#define png_set_pCAL OSS_FUZZ_png_set_pCAL
  ------------------
 2246|      0|       (png_charp)units, params);
 2247|       |
 2248|       |   /* TODO: BUG: png_set_pCAL calls png_chunk_report which, in this case, calls
 2249|       |    * png_benign_error and that can error out.
 2250|       |    *
 2251|       |    * png_read_buffer needs to be allocated with space for both nparams and the
 2252|       |    * parameter strings.  Not hard to do.
 2253|       |    */
 2254|      0|   png_free(png_ptr, params);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 2255|      0|   return handled_ok;
 2256|     87|}
pngrutil.c:png_handle_sCAL:
 2265|    163|{
 2266|    163|   png_bytep buffer;
 2267|    163|   size_t i;
 2268|    163|   int state;
 2269|       |
 2270|    163|   png_debug(1, "in png_handle_sCAL");
  ------------------
  |  |  145|    163|#  define png_debug(l, m) ((void)0)
  ------------------
 2271|    163|   png_debug1(2, "Allocating and reading sCAL chunk data (%u bytes)",
  ------------------
  |  |  148|    163|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 2272|    163|       length + 1);
 2273|       |
 2274|    163|   buffer = png_read_buffer(png_ptr, length+1);
 2275|       |
 2276|    163|   if (buffer == NULL)
  ------------------
  |  Branch (2276:8): [True: 0, False: 163]
  ------------------
 2277|      0|   {
 2278|      0|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2279|      0|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2280|      0|      return handled_error;
 2281|      0|   }
 2282|       |
 2283|    163|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   24|    163|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2284|    163|   buffer[length] = 0; /* Null terminate the last string */
 2285|       |
 2286|    163|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   25|    163|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2286:8): [True: 0, False: 163]
  ------------------
 2287|      0|      return handled_error;
 2288|       |
 2289|       |   /* Validate the unit. */
 2290|    163|   if (buffer[0] != 1 && buffer[0] != 2)
  ------------------
  |  Branch (2290:8): [True: 27, False: 136]
  |  Branch (2290:26): [True: 0, False: 27]
  ------------------
 2291|      0|   {
 2292|      0|      png_chunk_benign_error(png_ptr, "invalid unit");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2293|      0|      return handled_error;
 2294|      0|   }
 2295|       |
 2296|       |   /* Validate the ASCII numbers, need two ASCII numbers separated by
 2297|       |    * a '\0' and they need to fit exactly in the chunk data.
 2298|       |    */
 2299|    163|   i = 1;
 2300|    163|   state = 0;
 2301|       |
 2302|    163|   if (png_check_fp_number((png_const_charp)buffer, length, &state, &i) == 0 ||
  ------------------
  |  |   86|    163|#define png_check_fp_number OSS_FUZZ_png_check_fp_number
  ------------------
  |  Branch (2302:8): [True: 46, False: 117]
  ------------------
 2303|    117|       i >= length || buffer[i++] != 0)
  ------------------
  |  Branch (2303:8): [True: 0, False: 117]
  |  Branch (2303:23): [True: 115, False: 2]
  ------------------
 2304|    161|      png_chunk_benign_error(png_ptr, "bad width format");
  ------------------
  |  |  238|    161|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2305|       |
 2306|      2|   else if (PNG_FP_IS_POSITIVE(state) == 0)
  ------------------
  |  | 2153|      2|#define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK)
  |  |  ------------------
  |  |  |  | 2147|      2|#define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2119|      2|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2127|      2|#define PNG_FP_NEGATIVE 128  /* A negative number, including "-0" */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2128|      2|#define PNG_FP_NONZERO  256  /* A non-zero value */
  |  |  |  |  ------------------
  |  |  ------------------
  |  |               #define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK)
  |  |  ------------------
  |  |  |  | 2149|      2|#define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2119|      2|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2128|      2|#define PNG_FP_NONZERO  256  /* A non-zero value */
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (2306:13): [True: 0, False: 2]
  ------------------
 2307|      0|      png_chunk_benign_error(png_ptr, "non-positive width");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2308|       |
 2309|      2|   else
 2310|      2|   {
 2311|      2|      size_t heighti = i;
 2312|       |
 2313|      2|      state = 0;
 2314|      2|      if (png_check_fp_number((png_const_charp)buffer, length,
  ------------------
  |  |   86|      2|#define png_check_fp_number OSS_FUZZ_png_check_fp_number
  ------------------
  |  Branch (2314:11): [True: 2, False: 0]
  ------------------
 2315|      2|          &state, &i) == 0 || i != length)
  ------------------
  |  Branch (2315:31): [True: 0, False: 0]
  ------------------
 2316|      2|         png_chunk_benign_error(png_ptr, "bad height format");
  ------------------
  |  |  238|      2|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2317|       |
 2318|      0|      else if (PNG_FP_IS_POSITIVE(state) == 0)
  ------------------
  |  | 2153|      0|#define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK)
  |  |  ------------------
  |  |  |  | 2147|      0|#define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2119|      0|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2127|      0|#define PNG_FP_NEGATIVE 128  /* A negative number, including "-0" */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2128|      0|#define PNG_FP_NONZERO  256  /* A non-zero value */
  |  |  |  |  ------------------
  |  |  ------------------
  |  |               #define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK)
  |  |  ------------------
  |  |  |  | 2149|      0|#define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2119|      0|#define PNG_FP_SAW_DIGIT  8  /* Saw a digit in current state */
  |  |  |  |  ------------------
  |  |  |  |               #define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2128|      0|#define PNG_FP_NONZERO  256  /* A non-zero value */
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (2318:16): [True: 0, False: 0]
  ------------------
 2319|      0|         png_chunk_benign_error(png_ptr, "non-positive height");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2320|       |
 2321|      0|      else
 2322|      0|      {
 2323|       |         /* This is the (only) success case. */
 2324|      0|         png_set_sCAL_s(png_ptr, info_ptr, buffer[0],
  ------------------
  |  |  427|      0|#define png_set_sCAL_s OSS_FUZZ_png_set_sCAL_s
  ------------------
 2325|      0|             (png_charp)buffer+1, (png_charp)buffer+heighti);
 2326|      0|         return handled_ok;
 2327|      0|      }
 2328|      2|   }
 2329|       |
 2330|    163|   return handled_error;
 2331|    163|}
pngrutil.c:png_handle_sPLT:
 1553|    610|{
 1554|    610|   png_bytep buffer;
 1555|    610|   png_bytep entry_start;
 1556|    610|   png_sPLT_t new_palette;
 1557|    610|   png_sPLT_entryp pp;
 1558|    610|   png_uint_32 data_length;
 1559|    610|   int entry_size, i;
 1560|    610|   png_uint_32 skip = 0;
 1561|    610|   png_uint_32 dl;
 1562|    610|   size_t max_dl;
 1563|       |
 1564|    610|   png_debug(1, "in png_handle_sPLT");
  ------------------
  |  |  145|    610|#  define png_debug(l, m) ((void)0)
  ------------------
 1565|       |
 1566|    610|#ifdef PNG_USER_LIMITS_SUPPORTED
 1567|    610|   if (png_ptr->user_chunk_cache_max != 0)
  ------------------
  |  Branch (1567:8): [True: 610, False: 0]
  ------------------
 1568|    610|   {
 1569|    610|      if (png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (1569:11): [True: 0, False: 610]
  ------------------
 1570|      0|      {
 1571|      0|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1572|      0|         return handled_error;
 1573|      0|      }
 1574|       |
 1575|    610|      if (--png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (1575:11): [True: 0, False: 610]
  ------------------
 1576|      0|      {
 1577|      0|         png_warning(png_ptr, "No space in chunk cache for sPLT");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1578|      0|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1579|      0|         return handled_error;
 1580|      0|      }
 1581|    610|   }
 1582|    610|#endif
 1583|       |
 1584|    610|   buffer = png_read_buffer(png_ptr, length+1);
 1585|    610|   if (buffer == NULL)
  ------------------
  |  Branch (1585:8): [True: 0, False: 610]
  ------------------
 1586|      0|   {
 1587|      0|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 1588|      0|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 1589|      0|      return handled_error;
 1590|      0|   }
 1591|       |
 1592|       |
 1593|       |   /* WARNING: this may break if size_t is less than 32 bits; it is assumed
 1594|       |    * that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a
 1595|       |    * potential breakage point if the types in pngconf.h aren't exactly right.
 1596|       |    */
 1597|    610|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   24|    610|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 1598|       |
 1599|    610|   if (png_crc_finish(png_ptr, skip) != 0)
  ------------------
  |  |   25|    610|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (1599:8): [True: 0, False: 610]
  ------------------
 1600|      0|      return handled_error;
 1601|       |
 1602|    610|   buffer[length] = 0;
 1603|       |
 1604|  3.84k|   for (entry_start = buffer; *entry_start; entry_start++)
  ------------------
  |  Branch (1604:31): [True: 3.23k, False: 610]
  ------------------
 1605|  3.23k|      /* Empty loop to find end of name */ ;
 1606|       |
 1607|    610|   ++entry_start;
 1608|       |
 1609|       |   /* A sample depth should follow the separator, and we should be on it  */
 1610|    610|   if (length < 2U || entry_start > buffer + (length - 2U))
  ------------------
  |  Branch (1610:8): [True: 0, False: 610]
  |  Branch (1610:23): [True: 0, False: 610]
  ------------------
 1611|      0|   {
 1612|      0|      png_warning(png_ptr, "malformed sPLT chunk");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1613|      0|      return handled_error;
 1614|      0|   }
 1615|       |
 1616|    610|   new_palette.depth = *entry_start++;
 1617|    610|   entry_size = (new_palette.depth == 8 ? 6 : 10);
  ------------------
  |  Branch (1617:18): [True: 0, False: 610]
  ------------------
 1618|       |   /* This must fit in a png_uint_32 because it is derived from the original
 1619|       |    * chunk data length.
 1620|       |    */
 1621|    610|   data_length = length - (png_uint_32)(entry_start - buffer);
 1622|       |
 1623|       |   /* Integrity-check the data length */
 1624|    610|   if ((data_length % (unsigned int)entry_size) != 0)
  ------------------
  |  Branch (1624:8): [True: 189, False: 421]
  ------------------
 1625|    189|   {
 1626|    189|      png_warning(png_ptr, "sPLT chunk has bad length");
  ------------------
  |  |  450|    189|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1627|    189|      return handled_error;
 1628|    189|   }
 1629|       |
 1630|    421|   dl = (png_uint_32)(data_length / (unsigned int)entry_size);
 1631|    421|   max_dl = PNG_SIZE_MAX / (sizeof (png_sPLT_entry));
  ------------------
  |  |  649|    421|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
 1632|       |
 1633|    421|   if (dl > max_dl)
  ------------------
  |  Branch (1633:8): [True: 0, False: 421]
  ------------------
 1634|      0|   {
 1635|      0|      png_warning(png_ptr, "sPLT chunk too long");
  ------------------
  |  |  450|      0|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1636|      0|      return handled_error;
 1637|      0|   }
 1638|       |
 1639|    421|   new_palette.nentries = (png_int_32)(data_length / (unsigned int)entry_size);
 1640|       |
 1641|    421|   new_palette.entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
  ------------------
  |  |  349|    421|#define png_malloc_warn OSS_FUZZ_png_malloc_warn
  ------------------
 1642|    421|       (png_alloc_size_t) new_palette.nentries * (sizeof (png_sPLT_entry)));
 1643|       |
 1644|    421|   if (new_palette.entries == NULL)
  ------------------
  |  Branch (1644:8): [True: 102, False: 319]
  ------------------
 1645|    102|   {
 1646|    102|      png_warning(png_ptr, "sPLT chunk requires too much memory");
  ------------------
  |  |  450|    102|#define png_warning OSS_FUZZ_png_warning
  ------------------
 1647|    102|      return handled_error;
 1648|    102|   }
 1649|       |
 1650|  13.9k|   for (i = 0; i < new_palette.nentries; i++)
  ------------------
  |  Branch (1650:16): [True: 13.5k, False: 319]
  ------------------
 1651|  13.5k|   {
 1652|  13.5k|      pp = new_palette.entries + i;
 1653|       |
 1654|  13.5k|      if (new_palette.depth == 8)
  ------------------
  |  Branch (1654:11): [True: 0, False: 13.5k]
  ------------------
 1655|      0|      {
 1656|      0|         pp->red = *entry_start++;
 1657|      0|         pp->green = *entry_start++;
 1658|      0|         pp->blue = *entry_start++;
 1659|      0|         pp->alpha = *entry_start++;
 1660|      0|      }
 1661|       |
 1662|  13.5k|      else
 1663|  13.5k|      {
 1664|  13.5k|         pp->red   = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  320|  13.5k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  463|  13.5k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2832|  13.5k|   ((png_uint_16) \
  |  |  |  |  |  | 2833|  13.5k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2834|  13.5k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1665|  13.5k|         pp->green = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  320|  13.5k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  463|  13.5k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2832|  13.5k|   ((png_uint_16) \
  |  |  |  |  |  | 2833|  13.5k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2834|  13.5k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1666|  13.5k|         pp->blue  = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  320|  13.5k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  463|  13.5k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2832|  13.5k|   ((png_uint_16) \
  |  |  |  |  |  | 2833|  13.5k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2834|  13.5k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1667|  13.5k|         pp->alpha = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  320|  13.5k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  463|  13.5k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2832|  13.5k|   ((png_uint_16) \
  |  |  |  |  |  | 2833|  13.5k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2834|  13.5k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1668|  13.5k|      }
 1669|       |
 1670|  13.5k|      pp->frequency = png_get_uint_16(entry_start); entry_start += 2;
  ------------------
  |  |  320|  13.5k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16
  |  |  ------------------
  |  |  |  |  463|  13.5k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf)
  |  |  |  |  ------------------
  |  |  |  |  |  | 2832|  13.5k|   ((png_uint_16) \
  |  |  |  |  |  | 2833|  13.5k|    (((unsigned int)(*(buf)) << 8) + \
  |  |  |  |  |  | 2834|  13.5k|    ((unsigned int)(*((buf) + 1)))))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1671|  13.5k|   }
 1672|       |
 1673|       |   /* Discard all chunk data except the name and stash that */
 1674|    319|   new_palette.name = (png_charp)buffer;
 1675|       |
 1676|    319|   png_set_sPLT(png_ptr, info_ptr, &new_palette, 1);
  ------------------
  |  |  428|    319|#define png_set_sPLT OSS_FUZZ_png_set_sPLT
  ------------------
 1677|       |
 1678|    319|   png_free(png_ptr, new_palette.entries);
  ------------------
  |  |  253|    319|#define png_free OSS_FUZZ_png_free
  ------------------
 1679|    319|   return handled_ok;
 1680|    421|}
pngrutil.c:png_handle_zTXt:
 2448|    937|{
 2449|    937|   png_const_charp errmsg = NULL;
 2450|    937|   png_bytep buffer;
 2451|    937|   png_uint_32 keyword_length;
 2452|       |
 2453|    937|   png_debug(1, "in png_handle_zTXt");
  ------------------
  |  |  145|    937|#  define png_debug(l, m) ((void)0)
  ------------------
 2454|       |
 2455|    937|#ifdef PNG_USER_LIMITS_SUPPORTED
 2456|    937|   if (png_ptr->user_chunk_cache_max != 0)
  ------------------
  |  Branch (2456:8): [True: 937, False: 0]
  ------------------
 2457|    937|   {
 2458|    937|      if (png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2458:11): [True: 202, False: 735]
  ------------------
 2459|    202|      {
 2460|    202|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|    202|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2461|    202|         return handled_error;
 2462|    202|      }
 2463|       |
 2464|    735|      if (--png_ptr->user_chunk_cache_max == 1)
  ------------------
  |  Branch (2464:11): [True: 1, False: 734]
  ------------------
 2465|      1|      {
 2466|      1|         png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      1|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2467|      1|         png_chunk_benign_error(png_ptr, "no space in chunk cache");
  ------------------
  |  |  238|      1|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2468|      1|         return handled_error;
 2469|      1|      }
 2470|    735|   }
 2471|    734|#endif
 2472|       |
 2473|       |   /* Note, "length" is sufficient here; we won't be adding
 2474|       |    * a null terminator later.  The limit check in png_handle_chunk should be
 2475|       |    * sufficient.
 2476|       |    */
 2477|    734|   buffer = png_read_buffer(png_ptr, length);
 2478|       |
 2479|    734|   if (buffer == NULL)
  ------------------
  |  Branch (2479:8): [True: 0, False: 734]
  ------------------
 2480|      0|   {
 2481|      0|      png_crc_finish(png_ptr, length);
  ------------------
  |  |   25|      0|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
 2482|      0|      png_chunk_benign_error(png_ptr, "out of memory");
  ------------------
  |  |  238|      0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2483|      0|      return handled_error;
 2484|      0|   }
 2485|       |
 2486|    734|   png_crc_read(png_ptr, buffer, length);
  ------------------
  |  |   24|    734|#define png_crc_read OSS_FUZZ_png_crc_read
  ------------------
 2487|       |
 2488|    734|   if (png_crc_finish(png_ptr, 0) != 0)
  ------------------
  |  |   25|    734|#define png_crc_finish OSS_FUZZ_png_crc_finish
  ------------------
  |  Branch (2488:8): [True: 0, False: 734]
  ------------------
 2489|      0|      return handled_error;
 2490|       |
 2491|       |   /* TODO: also check that the keyword contents match the spec! */
 2492|    734|   for (keyword_length = 0;
 2493|  3.61k|      keyword_length < length && buffer[keyword_length] != 0;
  ------------------
  |  Branch (2493:7): [True: 3.61k, False: 0]
  |  Branch (2493:34): [True: 2.88k, False: 734]
  ------------------
 2494|  2.88k|      ++keyword_length)
 2495|  2.88k|      /* Empty loop to find end of name */ ;
 2496|       |
 2497|    734|   if (keyword_length > 79 || keyword_length < 1)
  ------------------
  |  Branch (2497:8): [True: 0, False: 734]
  |  Branch (2497:31): [True: 331, False: 403]
  ------------------
 2498|    331|      errmsg = "bad keyword";
 2499|       |
 2500|       |   /* zTXt must have some LZ data after the keyword, although it may expand to
 2501|       |    * zero bytes; we need a '\0' at the end of the keyword, the compression type
 2502|       |    * then the LZ data:
 2503|       |    */
 2504|    403|   else if (keyword_length + 3 > length)
  ------------------
  |  Branch (2504:13): [True: 0, False: 403]
  ------------------
 2505|      0|      errmsg = "truncated";
 2506|       |
 2507|    403|   else if (buffer[keyword_length+1] != PNG_COMPRESSION_TYPE_BASE)
  ------------------
  |  |  676|    403|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */
  ------------------
  |  Branch (2507:13): [True: 3, False: 400]
  ------------------
 2508|      3|      errmsg = "unknown compression type";
 2509|       |
 2510|    400|   else
 2511|    400|   {
 2512|    400|      png_alloc_size_t uncompressed_length = PNG_SIZE_MAX;
  ------------------
  |  |  649|    400|#define PNG_SIZE_MAX ((size_t)(-1))
  ------------------
 2513|       |
 2514|       |      /* TODO: at present png_decompress_chunk imposes a single application
 2515|       |       * level memory limit, this should be split to different values for iCCP
 2516|       |       * and text chunks.
 2517|       |       */
 2518|    400|      if (png_decompress_chunk(png_ptr, length, keyword_length+2,
  ------------------
  |  Branch (2518:11): [True: 0, False: 400]
  ------------------
 2519|    400|          &uncompressed_length, 1/*terminate*/) == Z_STREAM_END)
 2520|      0|      {
 2521|      0|         png_text text;
 2522|       |
 2523|      0|         if (png_ptr->read_buffer == NULL)
  ------------------
  |  Branch (2523:14): [True: 0, False: 0]
  ------------------
 2524|      0|           errmsg="Read failure in png_handle_zTXt";
 2525|      0|         else
 2526|      0|         {
 2527|       |            /* It worked; png_ptr->read_buffer now looks like a tEXt chunk
 2528|       |             * except for the extra compression type byte and the fact that
 2529|       |             * it isn't necessarily '\0' terminated.
 2530|       |             */
 2531|      0|            buffer = png_ptr->read_buffer;
 2532|      0|            buffer[uncompressed_length+(keyword_length+2)] = 0;
 2533|       |
 2534|      0|            text.compression = PNG_TEXT_COMPRESSION_zTXt;
  ------------------
  |  |  587|      0|#define PNG_TEXT_COMPRESSION_zTXt     0
  ------------------
 2535|      0|            text.key = (png_charp)buffer;
 2536|      0|            text.text = (png_charp)(buffer + keyword_length+2);
 2537|      0|            text.text_length = uncompressed_length;
 2538|      0|            text.itxt_length = 0;
 2539|      0|            text.lang = NULL;
 2540|      0|            text.lang_key = NULL;
 2541|       |
 2542|      0|            if (png_set_text_2(png_ptr, info_ptr, &text, 1) == 0)
  ------------------
  |  |   31|      0|#define png_set_text_2 OSS_FUZZ_png_set_text_2
  ------------------
  |  Branch (2542:17): [True: 0, False: 0]
  ------------------
 2543|      0|               return handled_ok;
 2544|       |
 2545|      0|            errmsg = "out of memory";
 2546|      0|         }
 2547|      0|      }
 2548|       |
 2549|    400|      else
 2550|    400|         errmsg = png_ptr->zstream.msg;
 2551|    400|   }
 2552|       |
 2553|    734|   png_chunk_benign_error(png_ptr, errmsg);
  ------------------
  |  |  238|    734|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error
  ------------------
 2554|    734|   return handled_error;
 2555|    734|}
pngrutil.c:png_init_filter_functions:
 4127|      3|{
 4128|      3|   unsigned int bpp = (pp->pixel_depth + 7) >> 3;
 4129|       |
 4130|      3|   pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub;
  ------------------
  |  | 1542|      3|#define PNG_FILTER_VALUE_SUB   1
  ------------------
 4131|      3|   pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up;
  ------------------
  |  | 1543|      3|#define PNG_FILTER_VALUE_UP    2
  ------------------
 4132|      3|   pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg;
  ------------------
  |  | 1544|      3|#define PNG_FILTER_VALUE_AVG   3
  ------------------
 4133|      3|   if (bpp == 1)
  ------------------
  |  Branch (4133:8): [True: 3, False: 0]
  ------------------
 4134|      3|      pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
  ------------------
  |  | 1545|      3|#define PNG_FILTER_VALUE_PAETH 4
  ------------------
 4135|      3|         png_read_filter_row_paeth_1byte_pixel;
 4136|      0|   else
 4137|      0|      pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
  ------------------
  |  | 1545|      0|#define PNG_FILTER_VALUE_PAETH 4
  ------------------
 4138|      0|         png_read_filter_row_paeth_multibyte_pixel;
 4139|       |
 4140|       |#ifdef PNG_FILTER_OPTIMIZATIONS
 4141|       |   /* To use this define PNG_FILTER_OPTIMIZATIONS as the name of a function to
 4142|       |    * call to install hardware optimizations for the above functions; simply
 4143|       |    * replace whatever elements of the pp->read_filter[] array with a hardware
 4144|       |    * specific (or, for that matter, generic) optimization.
 4145|       |    *
 4146|       |    * To see an example of this examine what configure.ac does when
 4147|       |    * --enable-arm-neon is specified on the command line.
 4148|       |    */
 4149|       |   PNG_FILTER_OPTIMIZATIONS(pp, bpp);
 4150|       |#endif
 4151|      3|}
pngrutil.c:png_read_filter_row_up:
 3974|     21|{
 3975|     21|   size_t i;
 3976|     21|   size_t istop = row_info->rowbytes;
 3977|     21|   png_bytep rp = row;
 3978|     21|   png_const_bytep pp = prev_row;
 3979|       |
 3980|     57|   for (i = 0; i < istop; i++)
  ------------------
  |  Branch (3980:16): [True: 36, False: 21]
  ------------------
 3981|     36|   {
 3982|     36|      *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff);
 3983|     36|      rp++;
 3984|     36|   }
 3985|     21|}
pngrutil.c:png_read_buffer:
  377|  2.39k|{
  378|  2.39k|   png_bytep buffer = png_ptr->read_buffer;
  379|       |
  380|  2.39k|   if (new_size > png_chunk_max(png_ptr)) return NULL;
  ------------------
  |  | 1126|  2.39k|#  define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max)
  ------------------
  |  Branch (380:8): [True: 0, False: 2.39k]
  ------------------
  381|       |
  382|  2.39k|   if (buffer != NULL && new_size > png_ptr->read_buffer_size)
  ------------------
  |  Branch (382:8): [True: 2.38k, False: 14]
  |  Branch (382:26): [True: 8, False: 2.37k]
  ------------------
  383|      8|   {
  384|      8|      png_ptr->read_buffer = NULL;
  385|      8|      png_ptr->read_buffer_size = 0;
  386|      8|      png_free(png_ptr, buffer);
  ------------------
  |  |  253|      8|#define png_free OSS_FUZZ_png_free
  ------------------
  387|      8|      buffer = NULL;
  388|      8|   }
  389|       |
  390|  2.39k|   if (buffer == NULL)
  ------------------
  |  Branch (390:8): [True: 22, False: 2.37k]
  ------------------
  391|     22|   {
  392|     22|      buffer = png_voidcast(png_bytep, png_malloc_base(png_ptr, new_size));
  ------------------
  |  |  535|     22|#  define png_voidcast(type, value) (value)
  ------------------
  393|       |
  394|     22|      if (buffer != NULL)
  ------------------
  |  Branch (394:11): [True: 20, False: 2]
  ------------------
  395|     20|      {
  396|     20|#        ifndef PNG_NO_MEMZERO /* for detecting UIM bugs **only** */
  397|     20|            memset(buffer, 0, new_size); /* just in case */
  398|     20|#        endif
  399|     20|         png_ptr->read_buffer = buffer;
  400|     20|         png_ptr->read_buffer_size = new_size;
  401|     20|      }
  402|     22|   }
  403|       |
  404|  2.39k|   return buffer;
  405|  2.39k|}
pngrutil.c:png_inflate_claim:
  415|  4.56k|{
  416|  4.56k|   if (png_ptr->zowner != 0)
  ------------------
  |  Branch (416:8): [True: 0, False: 4.56k]
  ------------------
  417|      0|   {
  418|      0|      char msg[64];
  419|       |
  420|      0|      PNG_STRING_FROM_CHUNK(msg, png_ptr->zowner);
  ------------------
  |  |  931|      0|   (void)(((char*)(s))[0]=(char)(((c)>>24) & 0xff), \
  |  |  932|      0|   ((char*)(s))[1]=(char)(((c)>>16) & 0xff),\
  |  |  933|      0|   ((char*)(s))[2]=(char)(((c)>>8) & 0xff), \
  |  |  934|      0|   ((char*)(s))[3]=(char)((c & 0xff)))
  ------------------
  421|       |      /* So the message that results is "<chunk> using zstream"; this is an
  422|       |       * internal error, but is very useful for debugging.  i18n requirements
  423|       |       * are minimal.
  424|       |       */
  425|      0|      (void)png_safecat(msg, (sizeof msg), 4, " using zstream");
  ------------------
  |  |   75|      0|#define png_safecat OSS_FUZZ_png_safecat
  ------------------
  426|       |#if PNG_RELEASE_BUILD
  427|       |      png_chunk_warning(png_ptr, msg);
  428|       |      png_ptr->zowner = 0;
  429|       |#else
  430|      0|      png_chunk_error(png_ptr, msg);
  ------------------
  |  |  239|      0|#define png_chunk_error OSS_FUZZ_png_chunk_error
  ------------------
  431|      0|#endif
  432|      0|   }
  433|       |
  434|       |   /* Implementation note: unlike 'png_deflate_claim' this internal function
  435|       |    * does not take the size of the data as an argument.  Some efficiency could
  436|       |    * be gained by using this when it is known *if* the zlib stream itself does
  437|       |    * not record the number; however, this is an illusion: the original writer
  438|       |    * of the PNG may have selected a lower window size, and we really must
  439|       |    * follow that because, for systems with limited capabilities, we
  440|       |    * would otherwise reject the application's attempts to use a smaller window
  441|       |    * size (zlib doesn't have an interface to say "this or lower"!).
  442|       |    *
  443|       |    * inflateReset2 was added to zlib 1.2.4; before this the window could not be
  444|       |    * reset, therefore it is necessary to always allocate the maximum window
  445|       |    * size with earlier zlibs just in case later compressed chunks need it.
  446|       |    */
  447|  4.56k|   {
  448|  4.56k|      int ret; /* zlib return code */
  449|  4.56k|#if ZLIB_VERNUM >= 0x1240
  450|  4.56k|      int window_bits = 0;
  451|       |
  452|  4.56k|# if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW)
  453|  4.56k|      if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & 3) ==
  ------------------
  |  | 3462|  4.56k|#define PNG_MAXIMUM_INFLATE_WINDOW 2
  ------------------
  |  Branch (453:11): [True: 0, False: 4.56k]
  ------------------
  454|  4.56k|          PNG_OPTION_ON)
  ------------------
  |  | 3499|  4.56k|#define PNG_OPTION_ON      3
  ------------------
  455|      0|      {
  456|      0|         window_bits = 15;
  457|      0|         png_ptr->zstream_start = 0; /* fixed window size */
  458|      0|      }
  459|       |
  460|  4.56k|      else
  461|  4.56k|      {
  462|  4.56k|         png_ptr->zstream_start = 1;
  463|  4.56k|      }
  464|  4.56k|# endif
  465|       |
  466|  4.56k|#endif /* ZLIB_VERNUM >= 0x1240 */
  467|       |
  468|       |      /* Set this for safety, just in case the previous owner left pointers to
  469|       |       * memory allocations.
  470|       |       */
  471|  4.56k|      png_ptr->zstream.next_in = NULL;
  472|  4.56k|      png_ptr->zstream.avail_in = 0;
  473|  4.56k|      png_ptr->zstream.next_out = NULL;
  474|  4.56k|      png_ptr->zstream.avail_out = 0;
  475|       |
  476|  4.56k|      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
  ------------------
  |  |  696|  4.56k|#define PNG_FLAG_ZSTREAM_INITIALIZED      0x0002U /* Added to libpng-1.6.0 */
  ------------------
  |  Branch (476:11): [True: 4.55k, False: 11]
  ------------------
  477|  4.55k|      {
  478|  4.55k|#if ZLIB_VERNUM >= 0x1240
  479|  4.55k|         ret = inflateReset2(&png_ptr->zstream, window_bits);
  480|       |#else
  481|       |         ret = inflateReset(&png_ptr->zstream);
  482|       |#endif
  483|  4.55k|      }
  484|       |
  485|     11|      else
  486|     11|      {
  487|     11|#if ZLIB_VERNUM >= 0x1240
  488|     11|         ret = inflateInit2(&png_ptr->zstream, window_bits);
  489|       |#else
  490|       |         ret = inflateInit(&png_ptr->zstream);
  491|       |#endif
  492|       |
  493|     11|         if (ret == Z_OK)
  ------------------
  |  Branch (493:14): [True: 10, False: 1]
  ------------------
  494|     10|            png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED;
  ------------------
  |  |  696|     10|#define PNG_FLAG_ZSTREAM_INITIALIZED      0x0002U /* Added to libpng-1.6.0 */
  ------------------
  495|     11|      }
  496|       |
  497|       |#ifdef PNG_DISABLE_ADLER32_CHECK_SUPPORTED
  498|       |      if (((png_ptr->options >> PNG_IGNORE_ADLER32) & 3) == PNG_OPTION_ON)
  499|       |         /* Turn off validation of the ADLER32 checksum in IDAT chunks */
  500|       |         ret = inflateValidate(&png_ptr->zstream, 0);
  501|       |#endif
  502|       |
  503|  4.56k|      if (ret == Z_OK)
  ------------------
  |  Branch (503:11): [True: 4.56k, False: 1]
  ------------------
  504|  4.56k|         png_ptr->zowner = owner;
  505|       |
  506|      1|      else
  507|      1|         png_zstream_error(png_ptr, ret);
  ------------------
  |  |    4|      1|#define png_zstream_error OSS_FUZZ_png_zstream_error
  ------------------
  508|       |
  509|  4.56k|      return ret;
  510|  4.56k|   }
  511|       |
  512|       |#ifdef window_bits
  513|       |# undef window_bits
  514|       |#endif
  515|  4.56k|}

OSS_FUZZ_png_set_IHDR:
  439|     14|{
  440|     14|   png_debug1(1, "in %s storage function", "IHDR");
  ------------------
  |  |  148|     14|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  441|       |
  442|     14|   if (png_ptr == NULL || info_ptr == NULL)
  ------------------
  |  Branch (442:8): [True: 0, False: 14]
  |  Branch (442:27): [True: 0, False: 14]
  ------------------
  443|      0|      return;
  444|       |
  445|     14|   info_ptr->width = width;
  446|     14|   info_ptr->height = height;
  447|     14|   info_ptr->bit_depth = (png_byte)bit_depth;
  448|     14|   info_ptr->color_type = (png_byte)color_type;
  449|     14|   info_ptr->compression_type = (png_byte)compression_type;
  450|     14|   info_ptr->filter_type = (png_byte)filter_type;
  451|     14|   info_ptr->interlace_type = (png_byte)interlace_type;
  452|       |
  453|     14|   png_check_IHDR (png_ptr, info_ptr->width, info_ptr->height,
  ------------------
  |  |   72|     14|#define png_check_IHDR OSS_FUZZ_png_check_IHDR
  ------------------
  454|     14|       info_ptr->bit_depth, info_ptr->color_type, info_ptr->interlace_type,
  455|     14|       info_ptr->compression_type, info_ptr->filter_type);
  456|       |
  457|     14|   if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
  ------------------
  |  |  667|     14|#define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  662|     14|#define PNG_COLOR_MASK_COLOR      2
  |  |  ------------------
  |  |               #define PNG_COLOR_TYPE_PALETTE  (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE)
  |  |  ------------------
  |  |  |  |  661|     14|#define PNG_COLOR_MASK_PALETTE    1
  |  |  ------------------
  ------------------
  |  Branch (457:8): [True: 0, False: 14]
  ------------------
  458|      0|      info_ptr->channels = 1;
  459|       |
  460|     14|   else if ((info_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
  ------------------
  |  |  662|     14|#define PNG_COLOR_MASK_COLOR      2
  ------------------
  |  Branch (460:13): [True: 0, False: 14]
  ------------------
  461|      0|      info_ptr->channels = 3;
  462|       |
  463|     14|   else
  464|     14|      info_ptr->channels = 1;
  465|       |
  466|     14|   if ((info_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)
  ------------------
  |  |  663|     14|#define PNG_COLOR_MASK_ALPHA      4
  ------------------
  |  Branch (466:8): [True: 0, False: 14]
  ------------------
  467|      0|      info_ptr->channels++;
  468|       |
  469|     14|   info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
  470|       |
  471|     14|   info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
  ------------------
  |  |  755|     14|    ((pixel_bits) >= 8 ? \
  |  |  ------------------
  |  |  |  Branch (755:6): [True: 0, False: 14]
  |  |  ------------------
  |  |  756|     14|    ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \
  |  |  757|     14|    (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) )
  ------------------
  472|     14|}
OSS_FUZZ_png_set_text_2:
  955|    494|{
  956|    494|   int i;
  957|    494|   png_textp old_text = NULL;
  958|       |
  959|    494|   png_debug1(1, "in text storage function, chunk typeid = 0x%lx",
  ------------------
  |  |  148|    494|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
  960|    494|      png_ptr == NULL ? 0xabadca11UL : (unsigned long)png_ptr->chunk_name);
  961|       |
  962|    494|   if (png_ptr == NULL || info_ptr == NULL || num_text <= 0 || text_ptr == NULL)
  ------------------
  |  Branch (962:8): [True: 0, False: 494]
  |  Branch (962:27): [True: 0, False: 494]
  |  Branch (962:47): [True: 0, False: 494]
  |  Branch (962:64): [True: 0, False: 494]
  ------------------
  963|      0|      return 0;
  964|       |
  965|       |   /* Make sure we have enough space in the "text" array in info_struct
  966|       |    * to hold all of the incoming text_ptr objects.  This compare can't overflow
  967|       |    * because max_text >= num_text (anyway, subtract of two positive integers
  968|       |    * can't overflow in any case.)
  969|       |    */
  970|    494|   if (num_text > info_ptr->max_text - info_ptr->num_text)
  ------------------
  |  Branch (970:8): [True: 65, False: 429]
  ------------------
  971|     65|   {
  972|     65|      int old_num_text = info_ptr->num_text;
  973|     65|      int max_text;
  974|     65|      png_textp new_text = NULL;
  975|       |
  976|       |      /* Calculate an appropriate max_text, checking for overflow. */
  977|     65|      max_text = old_num_text;
  978|     65|      if (num_text <= INT_MAX - max_text)
  ------------------
  |  Branch (978:11): [True: 65, False: 0]
  ------------------
  979|     65|      {
  980|     65|         max_text += num_text;
  981|       |
  982|       |         /* Round up to a multiple of 8 */
  983|     65|         if (max_text < INT_MAX-8)
  ------------------
  |  Branch (983:14): [True: 65, False: 0]
  ------------------
  984|     65|            max_text = (max_text + 8) & ~0x7;
  985|       |
  986|      0|         else
  987|      0|            max_text = INT_MAX;
  988|       |
  989|       |         /* Now allocate a new array and copy the old members in; this does all
  990|       |          * the overflow checks.
  991|       |          */
  992|     65|         new_text = png_voidcast(png_textp,png_realloc_array(png_ptr,
  ------------------
  |  |  535|     65|#  define png_voidcast(type, value) (value)
  ------------------
  993|     65|             info_ptr->text, old_num_text, max_text-old_num_text,
  994|     65|             sizeof *new_text));
  995|     65|      }
  996|       |
  997|     65|      if (new_text == NULL)
  ------------------
  |  Branch (997:11): [True: 0, False: 65]
  ------------------
  998|      0|      {
  999|      0|         png_chunk_report(png_ptr, "too many text chunks",
  ------------------
  |  |   83|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 1000|      0|             PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 2054|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
 1001|       |
 1002|      0|         return 1;
 1003|      0|      }
 1004|       |
 1005|       |      /* Defer freeing the old array until after the copy loop below,
 1006|       |       * in case text_ptr aliases info_ptr->text (getter-to-setter).
 1007|       |       */
 1008|     65|      old_text = info_ptr->text;
 1009|       |
 1010|     65|      info_ptr->text = new_text;
 1011|     65|      info_ptr->free_me |= PNG_FREE_TEXT;
  ------------------
  |  | 1850|     65|#define PNG_FREE_TEXT 0x4000U
  ------------------
 1012|     65|      info_ptr->max_text = max_text;
 1013|       |      /* num_text is adjusted below as the entries are copied in */
 1014|       |
 1015|     65|      png_debug1(3, "allocated %d entries for info_ptr->text", max_text);
  ------------------
  |  |  148|     65|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 1016|     65|   }
 1017|       |
 1018|    988|   for (i = 0; i < num_text; i++)
  ------------------
  |  Branch (1018:16): [True: 494, False: 494]
  ------------------
 1019|    494|   {
 1020|    494|      size_t text_length, key_len;
 1021|    494|      size_t lang_len, lang_key_len;
 1022|    494|      png_textp textp = &(info_ptr->text[info_ptr->num_text]);
 1023|       |
 1024|    494|      if (text_ptr[i].key == NULL)
  ------------------
  |  Branch (1024:11): [True: 0, False: 494]
  ------------------
 1025|      0|          continue;
 1026|       |
 1027|    494|      if (text_ptr[i].compression < PNG_TEXT_COMPRESSION_NONE ||
  ------------------
  |  |  586|    988|#define PNG_TEXT_COMPRESSION_NONE    -1
  ------------------
  |  Branch (1027:11): [True: 0, False: 494]
  ------------------
 1028|    494|          text_ptr[i].compression >= PNG_TEXT_COMPRESSION_LAST)
  ------------------
  |  |  590|    494|#define PNG_TEXT_COMPRESSION_LAST     3  /* Not a valid value */
  ------------------
  |  Branch (1028:11): [True: 0, False: 494]
  ------------------
 1029|      0|      {
 1030|      0|         png_chunk_report(png_ptr, "text compression mode is out of range",
  ------------------
  |  |   83|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 1031|      0|             PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 2054|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
 1032|      0|         continue;
 1033|      0|      }
 1034|       |
 1035|    494|      key_len = strlen(text_ptr[i].key);
 1036|       |
 1037|    494|      if (text_ptr[i].compression <= 0)
  ------------------
  |  Branch (1037:11): [True: 0, False: 494]
  ------------------
 1038|      0|      {
 1039|      0|         lang_len = 0;
 1040|      0|         lang_key_len = 0;
 1041|      0|      }
 1042|       |
 1043|    494|      else
 1044|    494|#  ifdef PNG_iTXt_SUPPORTED
 1045|    494|      {
 1046|       |         /* Set iTXt data */
 1047|       |
 1048|    494|         if (text_ptr[i].lang != NULL)
  ------------------
  |  Branch (1048:14): [True: 494, False: 0]
  ------------------
 1049|    494|            lang_len = strlen(text_ptr[i].lang);
 1050|       |
 1051|      0|         else
 1052|      0|            lang_len = 0;
 1053|       |
 1054|    494|         if (text_ptr[i].lang_key != NULL)
  ------------------
  |  Branch (1054:14): [True: 494, False: 0]
  ------------------
 1055|    494|            lang_key_len = strlen(text_ptr[i].lang_key);
 1056|       |
 1057|      0|         else
 1058|      0|            lang_key_len = 0;
 1059|    494|      }
 1060|       |#  else /* iTXt */
 1061|       |      {
 1062|       |         png_chunk_report(png_ptr, "iTXt chunk not supported",
 1063|       |             PNG_CHUNK_WRITE_ERROR);
 1064|       |         continue;
 1065|       |      }
 1066|       |#  endif
 1067|       |
 1068|    494|      if (text_ptr[i].text == NULL || text_ptr[i].text[0] == '\0')
  ------------------
  |  Branch (1068:11): [True: 0, False: 494]
  |  Branch (1068:39): [True: 479, False: 15]
  ------------------
 1069|    479|      {
 1070|    479|         text_length = 0;
 1071|    479|#  ifdef PNG_iTXt_SUPPORTED
 1072|    479|         if (text_ptr[i].compression > 0)
  ------------------
  |  Branch (1072:14): [True: 479, False: 0]
  ------------------
 1073|    479|            textp->compression = PNG_ITXT_COMPRESSION_NONE;
  ------------------
  |  |  588|    479|#define PNG_ITXT_COMPRESSION_NONE     1
  ------------------
 1074|       |
 1075|      0|         else
 1076|      0|#  endif
 1077|      0|            textp->compression = PNG_TEXT_COMPRESSION_NONE;
  ------------------
  |  |  586|      0|#define PNG_TEXT_COMPRESSION_NONE    -1
  ------------------
 1078|    479|      }
 1079|       |
 1080|     15|      else
 1081|     15|      {
 1082|     15|         text_length = strlen(text_ptr[i].text);
 1083|     15|         textp->compression = text_ptr[i].compression;
 1084|     15|      }
 1085|       |
 1086|    494|      textp->key = png_voidcast(png_charp,png_malloc_base(png_ptr,
  ------------------
  |  |  535|    494|#  define png_voidcast(type, value) (value)
  ------------------
 1087|    494|          key_len + text_length + lang_len + lang_key_len + 4));
 1088|       |
 1089|    494|      if (textp->key == NULL)
  ------------------
  |  Branch (1089:11): [True: 0, False: 494]
  ------------------
 1090|      0|      {
 1091|      0|         png_chunk_report(png_ptr, "text chunk: out of memory",
  ------------------
  |  |   83|      0|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
 1092|      0|             PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 2054|      0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
 1093|      0|         png_free(png_ptr, old_text);
  ------------------
  |  |  253|      0|#define png_free OSS_FUZZ_png_free
  ------------------
 1094|       |
 1095|      0|         return 1;
 1096|      0|      }
 1097|       |
 1098|    494|      png_debug2(2, "Allocated %lu bytes at %p in png_set_text",
  ------------------
  |  |  151|    494|#  define png_debug2(l, m, p1, p2) ((void)0)
  ------------------
 1099|    494|          (unsigned long)(png_uint_32)
 1100|    494|          (key_len + lang_len + lang_key_len + text_length + 4),
 1101|    494|          textp->key);
 1102|       |
 1103|    494|      memcpy(textp->key, text_ptr[i].key, key_len);
 1104|    494|      *(textp->key + key_len) = '\0';
 1105|       |
 1106|    494|      if (text_ptr[i].compression > 0)
  ------------------
  |  Branch (1106:11): [True: 494, False: 0]
  ------------------
 1107|    494|      {
 1108|    494|         textp->lang = textp->key + key_len + 1;
 1109|    494|         memcpy(textp->lang, text_ptr[i].lang, lang_len);
 1110|    494|         *(textp->lang + lang_len) = '\0';
 1111|    494|         textp->lang_key = textp->lang + lang_len + 1;
 1112|    494|         memcpy(textp->lang_key, text_ptr[i].lang_key, lang_key_len);
 1113|    494|         *(textp->lang_key + lang_key_len) = '\0';
 1114|    494|         textp->text = textp->lang_key + lang_key_len + 1;
 1115|    494|      }
 1116|       |
 1117|      0|      else
 1118|      0|      {
 1119|      0|         textp->lang=NULL;
 1120|      0|         textp->lang_key=NULL;
 1121|      0|         textp->text = textp->key + key_len + 1;
 1122|      0|      }
 1123|       |
 1124|    494|      if (text_length != 0)
  ------------------
  |  Branch (1124:11): [True: 15, False: 479]
  ------------------
 1125|     15|         memcpy(textp->text, text_ptr[i].text, text_length);
 1126|       |
 1127|    494|      *(textp->text + text_length) = '\0';
 1128|       |
 1129|    494|#  ifdef PNG_iTXt_SUPPORTED
 1130|    494|      if (textp->compression > 0)
  ------------------
  |  Branch (1130:11): [True: 494, False: 0]
  ------------------
 1131|    494|      {
 1132|    494|         textp->text_length = 0;
 1133|    494|         textp->itxt_length = text_length;
 1134|    494|      }
 1135|       |
 1136|      0|      else
 1137|      0|#  endif
 1138|      0|      {
 1139|      0|         textp->text_length = text_length;
 1140|      0|         textp->itxt_length = 0;
 1141|      0|      }
 1142|       |
 1143|    494|      info_ptr->num_text++;
 1144|    494|      png_debug1(3, "transferred text chunk %d", info_ptr->num_text);
  ------------------
  |  |  148|    494|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 1145|    494|   }
 1146|       |
 1147|    494|   png_free(png_ptr, old_text);
  ------------------
  |  |  253|    494|#define png_free OSS_FUZZ_png_free
  ------------------
 1148|       |
 1149|    494|   return 0;
 1150|    494|}
OSS_FUZZ_png_set_sPLT:
 1284|    319|{
 1285|    319|   png_sPLT_tp np;
 1286|    319|   png_sPLT_tp old_spalettes;
 1287|       |
 1288|    319|   png_debug1(1, "in %s storage function", "sPLT");
  ------------------
  |  |  148|    319|#  define png_debug1(l, m, p1) ((void)0)
  ------------------
 1289|       |
 1290|    319|   if (png_ptr == NULL || info_ptr == NULL || nentries <= 0 || entries == NULL)
  ------------------
  |  Branch (1290:8): [True: 0, False: 319]
  |  Branch (1290:27): [True: 0, False: 319]
  |  Branch (1290:47): [True: 0, False: 319]
  |  Branch (1290:64): [True: 0, False: 319]
  ------------------
 1291|      0|      return;
 1292|       |
 1293|       |   /* Use the internal realloc function, which checks for all the possible
 1294|       |    * overflows.  Notice that the parameters are (int) and (size_t)
 1295|       |    */
 1296|    319|   np = png_voidcast(png_sPLT_tp,png_realloc_array(png_ptr,
  ------------------
  |  |  535|    319|#  define png_voidcast(type, value) (value)
  ------------------
 1297|    319|       info_ptr->splt_palettes, info_ptr->splt_palettes_num, nentries,
 1298|    319|       sizeof *np));
 1299|       |
 1300|    319|   if (np == NULL)
  ------------------
  |  Branch (1300:8): [True: 37, False: 282]
  ------------------
 1301|     37|   {
 1302|       |      /* Out of memory or too many chunks */
 1303|     37|      png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  |   83|     37|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
                    png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 2054|     37|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
 1304|     37|      return;
 1305|     37|   }
 1306|       |
 1307|       |   /* Defer freeing the old array until after the copy loop below,
 1308|       |    * in case entries aliases info_ptr->splt_palettes (getter-to-setter).
 1309|       |    */
 1310|    282|   old_spalettes = info_ptr->splt_palettes;
 1311|       |
 1312|    282|   info_ptr->splt_palettes = np;
 1313|    282|   info_ptr->free_me |= PNG_FREE_SPLT;
  ------------------
  |  | 1840|    282|#define PNG_FREE_SPLT 0x0020U
  ------------------
 1314|       |
 1315|    282|   np += info_ptr->splt_palettes_num;
 1316|       |
 1317|    282|   do
 1318|    282|   {
 1319|    282|      size_t length;
 1320|       |
 1321|       |      /* Skip invalid input entries */
 1322|    282|      if (entries->name == NULL || entries->entries == NULL)
  ------------------
  |  Branch (1322:11): [True: 0, False: 282]
  |  Branch (1322:36): [True: 0, False: 282]
  ------------------
 1323|      0|      {
 1324|       |         /* png_handle_sPLT doesn't do this, so this is an app error */
 1325|      0|         png_app_error(png_ptr, "png_set_sPLT: invalid sPLT");
  ------------------
  |  |   82|      0|#define png_app_error OSS_FUZZ_png_app_error
  ------------------
 1326|       |         /* Just skip the invalid entry */
 1327|      0|         continue;
 1328|      0|      }
 1329|       |
 1330|    282|      np->depth = entries->depth;
 1331|       |
 1332|       |      /* In the event of out-of-memory just return - there's no point keeping
 1333|       |       * on trying to add sPLT chunks.
 1334|       |       */
 1335|    282|      length = strlen(entries->name) + 1;
 1336|    282|      np->name = png_voidcast(png_charp, png_malloc_base(png_ptr, length));
  ------------------
  |  |  535|    282|#  define png_voidcast(type, value) (value)
  ------------------
 1337|       |
 1338|    282|      if (np->name == NULL)
  ------------------
  |  Branch (1338:11): [True: 21, False: 261]
  ------------------
 1339|     21|         break;
 1340|       |
 1341|    261|      memcpy(np->name, entries->name, length);
 1342|       |
 1343|       |      /* IMPORTANT: we have memory now that won't get freed if something else
 1344|       |       * goes wrong; this code must free it.  png_malloc_array produces no
 1345|       |       * warnings; use a png_chunk_report (below) if there is an error.
 1346|       |       */
 1347|    261|      np->entries = png_voidcast(png_sPLT_entryp, png_malloc_array(png_ptr,
  ------------------
  |  |  535|    261|#  define png_voidcast(type, value) (value)
  ------------------
 1348|    261|          entries->nentries, sizeof (png_sPLT_entry)));
 1349|       |
 1350|    261|      if (np->entries == NULL)
  ------------------
  |  Branch (1350:11): [True: 10, False: 251]
  ------------------
 1351|     10|      {
 1352|     10|         png_free(png_ptr, np->name);
  ------------------
  |  |  253|     10|#define png_free OSS_FUZZ_png_free
  ------------------
 1353|     10|         np->name = NULL;
 1354|     10|         break;
 1355|     10|      }
 1356|       |
 1357|    251|      np->nentries = entries->nentries;
 1358|       |      /* This multiply can't overflow because png_malloc_array has already
 1359|       |       * checked it when doing the allocation.
 1360|       |       */
 1361|    251|      memcpy(np->entries, entries->entries,
 1362|    251|          (unsigned int)entries->nentries * sizeof (png_sPLT_entry));
 1363|       |
 1364|       |      /* Note that 'continue' skips the advance of the out pointer and out
 1365|       |       * count, so an invalid entry is not added.
 1366|       |       */
 1367|    251|      info_ptr->valid |= PNG_INFO_sPLT;
  ------------------
  |  |  743|    251|#define PNG_INFO_sPLT 0x2000U  /* ESR, 1.0.6 */
  ------------------
 1368|    251|      ++(info_ptr->splt_palettes_num);
 1369|    251|      ++np;
 1370|    251|      ++entries;
 1371|    251|   }
 1372|    282|   while (--nentries);
  ------------------
  |  Branch (1372:11): [True: 0, False: 251]
  ------------------
 1373|       |
 1374|    282|   png_free(png_ptr, old_spalettes);
  ------------------
  |  |  253|    282|#define png_free OSS_FUZZ_png_free
  ------------------
 1375|       |
 1376|    282|   if (nentries > 0)
  ------------------
  |  Branch (1376:8): [True: 31, False: 251]
  ------------------
 1377|     31|      png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  |   83|     31|#define png_chunk_report OSS_FUZZ_png_chunk_report
  ------------------
                    png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
  ------------------
  |  | 2054|     31|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */
  ------------------
 1378|    282|}
OSS_FUZZ_png_set_benign_errors:
 1925|      3|{
 1926|      3|   png_debug(1, "in png_set_benign_errors");
  ------------------
  |  |  145|      3|#  define png_debug(l, m) ((void)0)
  ------------------
 1927|       |
 1928|       |   /* If allowed is 1, png_benign_error() is treated as a warning.
 1929|       |    *
 1930|       |    * If allowed is 0, png_benign_error() is treated as an error (which
 1931|       |    * is the default behavior if png_set_benign_errors() is not called).
 1932|       |    */
 1933|       |
 1934|      3|   if (allowed != 0)
  ------------------
  |  Branch (1934:8): [True: 3, False: 0]
  ------------------
 1935|      3|      png_ptr->flags |= PNG_FLAG_BENIGN_ERRORS_WARN |
  ------------------
  |  |  715|      3|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
 1936|      3|         PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN;
  ------------------
  |  |  716|      3|#define PNG_FLAG_APP_WARNINGS_WARN      0x200000U /* Added to libpng-1.6.0 */
  ------------------
                       PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN;
  ------------------
  |  |  717|      3|#define PNG_FLAG_APP_ERRORS_WARN        0x400000U /* Added to libpng-1.6.0 */
  ------------------
 1937|       |
 1938|      0|   else
 1939|      0|      png_ptr->flags &= ~(PNG_FLAG_BENIGN_ERRORS_WARN |
  ------------------
  |  |  715|      0|#define PNG_FLAG_BENIGN_ERRORS_WARN     0x100000U /* Added to libpng-1.4.0 */
  ------------------
 1940|      0|         PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN);
  ------------------
  |  |  716|      0|#define PNG_FLAG_APP_WARNINGS_WARN      0x200000U /* Added to libpng-1.6.0 */
  ------------------
                       PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN);
  ------------------
  |  |  717|      0|#define PNG_FLAG_APP_ERRORS_WARN        0x400000U /* Added to libpng-1.6.0 */
  ------------------
 1941|      3|}

OSS_FUZZ_png_set_packing:
   50|      5|{
   51|      5|   png_debug(1, "in png_set_packing");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
   52|       |
   53|      5|   if (png_ptr == NULL)
  ------------------
  |  Branch (53:8): [True: 0, False: 5]
  ------------------
   54|      0|      return;
   55|       |
   56|      5|   if (png_ptr->bit_depth < 8)
  ------------------
  |  Branch (56:8): [True: 5, False: 0]
  ------------------
   57|      5|   {
   58|      5|      png_ptr->transformations |= PNG_PACK;
  ------------------
  |  |  660|      5|#define PNG_PACK                0x0004U
  ------------------
   59|       |#     ifdef PNG_WRITE_SUPPORTED
   60|       |         png_ptr->usr_bit_depth = 8;
   61|       |#     endif
   62|      5|   }
   63|      5|}
OSS_FUZZ_png_set_interlace_handling:
  128|      5|{
  129|      5|   png_debug(1, "in png_set_interlace handling");
  ------------------
  |  |  145|      5|#  define png_debug(l, m) ((void)0)
  ------------------
  130|       |
  131|      5|   if (png_ptr != 0 && png_ptr->interlaced != 0)
  ------------------
  |  Branch (131:8): [True: 5, False: 0]
  |  Branch (131:24): [True: 5, False: 0]
  ------------------
  132|      5|   {
  133|      5|      png_ptr->transformations |= PNG_INTERLACE;
  ------------------
  |  |  659|      5|#define PNG_INTERLACE           0x0002U
  ------------------
  134|      5|      return 7;
  135|      5|   }
  136|       |
  137|      0|   return 1;
  138|      5|}