Home | History | Annotate | Download | only in libpng
      1 
      2 /* png.c - location for general purpose libpng functions
      3  *
      4  * Last changed in libpng 1.6.9 [February 6, 2014]
      5  * Copyright (c) 1998-2014 Glenn Randers-Pehrson
      6  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
      7  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
      8  *
      9  * This code is released under the libpng license.
     10  * For conditions of distribution and use, see the disclaimer
     11  * and license in png.h
     12  */
     13 
     14 #include "pngpriv.h"
     15 
     16 /* Generate a compiler error if there is an old png.h in the search path. */
     17 typedef png_libpng_version_1_6_10 Your_png_h_is_not_version_1_6_10;
     18 
     19 /* Tells libpng that we have already handled the first "num_bytes" bytes
     20  * of the PNG file signature.  If the PNG data is embedded into another
     21  * stream we can set num_bytes = 8 so that libpng will not attempt to read
     22  * or write any of the magic bytes before it starts on the IHDR.
     23  */
     24 
     25 #ifdef PNG_READ_SUPPORTED
     26 void PNGAPI
     27 png_set_sig_bytes(png_structrp png_ptr, int num_bytes)
     28 {
     29    png_debug(1, "in png_set_sig_bytes");
     30 
     31    if (png_ptr == NULL)
     32       return;
     33 
     34    if (num_bytes > 8)
     35       png_error(png_ptr, "Too many bytes for PNG signature");
     36 
     37    png_ptr->sig_bytes = (png_byte)(num_bytes < 0 ? 0 : num_bytes);
     38 }
     39 
     40 /* Checks whether the supplied bytes match the PNG signature.  We allow
     41  * checking less than the full 8-byte signature so that those apps that
     42  * already read the first few bytes of a file to determine the file type
     43  * can simply check the remaining bytes for extra assurance.  Returns
     44  * an integer less than, equal to, or greater than zero if sig is found,
     45  * respectively, to be less than, to match, or be greater than the correct
     46  * PNG signature (this is the same behavior as strcmp, memcmp, etc).
     47  */
     48 int PNGAPI
     49 png_sig_cmp(png_const_bytep sig, png_size_t start, png_size_t num_to_check)
     50 {
     51    png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
     52 
     53    if (num_to_check > 8)
     54       num_to_check = 8;
     55 
     56    else if (num_to_check < 1)
     57       return (-1);
     58 
     59    if (start > 7)
     60       return (-1);
     61 
     62    if (start + num_to_check > 8)
     63       num_to_check = 8 - start;
     64 
     65    return ((int)(memcmp(&sig[start], &png_signature[start], num_to_check)));
     66 }
     67 
     68 #endif /* PNG_READ_SUPPORTED */
     69 
     70 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
     71 /* Function to allocate memory for zlib */
     72 PNG_FUNCTION(voidpf /* PRIVATE */,
     73 png_zalloc,(voidpf png_ptr, uInt items, uInt size),PNG_ALLOCATED)
     74 {
     75    png_alloc_size_t num_bytes = size;
     76 
     77    if (png_ptr == NULL)
     78       return NULL;
     79 
     80    if (items >= (~(png_alloc_size_t)0)/size)
     81    {
     82       png_warning (png_voidcast(png_structrp, png_ptr),
     83          "Potential overflow in png_zalloc()");
     84       return NULL;
     85    }
     86 
     87    num_bytes *= items;
     88    return png_malloc_warn(png_voidcast(png_structrp, png_ptr), num_bytes);
     89 }
     90 
     91 /* Function to free memory for zlib */
     92 void /* PRIVATE */
     93 png_zfree(voidpf png_ptr, voidpf ptr)
     94 {
     95    png_free(png_voidcast(png_const_structrp,png_ptr), ptr);
     96 }
     97 
     98 /* Reset the CRC variable to 32 bits of 1's.  Care must be taken
     99  * in case CRC is > 32 bits to leave the top bits 0.
    100  */
    101 void /* PRIVATE */
    102 png_reset_crc(png_structrp png_ptr)
    103 {
    104    /* The cast is safe because the crc is a 32 bit value. */
    105    png_ptr->crc = (png_uint_32)crc32(0, Z_NULL, 0);
    106 }
    107 
    108 /* Calculate the CRC over a section of data.  We can only pass as
    109  * much data to this routine as the largest single buffer size.  We
    110  * also check that this data will actually be used before going to the
    111  * trouble of calculating it.
    112  */
    113 void /* PRIVATE */
    114 png_calculate_crc(png_structrp png_ptr, png_const_bytep ptr, png_size_t length)
    115 {
    116    int need_crc = 1;
    117 
    118    if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name))
    119    {
    120       if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
    121           (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
    122          need_crc = 0;
    123    }
    124 
    125    else /* critical */
    126    {
    127       if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE)
    128          need_crc = 0;
    129    }
    130 
    131    /* 'uLong' is defined in zlib.h as unsigned long; this means that on some
    132     * systems it is a 64 bit value.  crc32, however, returns 32 bits so the
    133     * following cast is safe.  'uInt' may be no more than 16 bits, so it is
    134     * necessary to perform a loop here.
    135     */
    136    if (need_crc && length > 0)
    137    {
    138       uLong crc = png_ptr->crc; /* Should never issue a warning */
    139 
    140       do
    141       {
    142          uInt safe_length = (uInt)length;
    143          if (safe_length == 0)
    144             safe_length = (uInt)-1; /* evil, but safe */
    145 
    146          crc = crc32(crc, ptr, safe_length);
    147 
    148          /* The following should never issue compiler warnings; if they do the
    149           * target system has characteristics that will probably violate other
    150           * assumptions within the libpng code.
    151           */
    152          ptr += safe_length;
    153          length -= safe_length;
    154       }
    155       while (length > 0);
    156 
    157       /* And the following is always safe because the crc is only 32 bits. */
    158       png_ptr->crc = (png_uint_32)crc;
    159    }
    160 }
    161 
    162 /* Check a user supplied version number, called from both read and write
    163  * functions that create a png_struct.
    164  */
    165 int
    166 png_user_version_check(png_structrp png_ptr, png_const_charp user_png_ver)
    167 {
    168    if (user_png_ver)
    169    {
    170       int i = 0;
    171 
    172       do
    173       {
    174          if (user_png_ver[i] != png_libpng_ver[i])
    175             png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
    176       } while (png_libpng_ver[i++]);
    177    }
    178 
    179    else
    180       png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;
    181 
    182    if (png_ptr->flags & PNG_FLAG_LIBRARY_MISMATCH)
    183    {
    184      /* Libpng 0.90 and later are binary incompatible with libpng 0.89, so
    185       * we must recompile any applications that use any older library version.
    186       * For versions after libpng 1.0, we will be compatible, so we need
    187       * only check the first and third digits (note that when we reach version
    188       * 1.10 we will need to check the fourth symbol, namely user_png_ver[3]).
    189       */
    190       if (user_png_ver == NULL || user_png_ver[0] != png_libpng_ver[0] ||
    191           (user_png_ver[0] == '1' && (user_png_ver[2] != png_libpng_ver[2] ||
    192           user_png_ver[3] != png_libpng_ver[3])) ||
    193           (user_png_ver[0] == '0' && user_png_ver[2] < '9'))
    194       {
    195 #ifdef PNG_WARNINGS_SUPPORTED
    196          size_t pos = 0;
    197          char m[128];
    198 
    199          pos = png_safecat(m, (sizeof m), pos,
    200              "Application built with libpng-");
    201          pos = png_safecat(m, (sizeof m), pos, user_png_ver);
    202          pos = png_safecat(m, (sizeof m), pos, " but running with ");
    203          pos = png_safecat(m, (sizeof m), pos, png_libpng_ver);
    204          PNG_UNUSED(pos)
    205 
    206          png_warning(png_ptr, m);
    207 #endif
    208 
    209 #ifdef PNG_ERROR_NUMBERS_SUPPORTED
    210          png_ptr->flags = 0;
    211 #endif
    212 
    213          return 0;
    214       }
    215    }
    216 
    217    /* Success return. */
    218    return 1;
    219 }
    220 
    221 /* Generic function to create a png_struct for either read or write - this
    222  * contains the common initialization.
    223  */
    224 PNG_FUNCTION(png_structp /* PRIVATE */,
    225 png_create_png_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
    226     png_error_ptr error_fn, png_error_ptr warn_fn, png_voidp mem_ptr,
    227     png_malloc_ptr malloc_fn, png_free_ptr free_fn),PNG_ALLOCATED)
    228 {
    229    png_struct create_struct;
    230 #  ifdef PNG_SETJMP_SUPPORTED
    231       jmp_buf create_jmp_buf;
    232 #  endif
    233 
    234    /* This temporary stack-allocated structure is used to provide a place to
    235     * build enough context to allow the user provided memory allocator (if any)
    236     * to be called.
    237     */
    238    memset(&create_struct, 0, (sizeof create_struct));
    239 
    240    /* Added at libpng-1.2.6 */
    241 #  ifdef PNG_USER_LIMITS_SUPPORTED
    242       create_struct.user_width_max = PNG_USER_WIDTH_MAX;
    243       create_struct.user_height_max = PNG_USER_HEIGHT_MAX;
    244 
    245 #     ifdef PNG_USER_CHUNK_CACHE_MAX
    246          /* Added at libpng-1.2.43 and 1.4.0 */
    247          create_struct.user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;
    248 #     endif
    249 
    250 #     ifdef PNG_USER_CHUNK_MALLOC_MAX
    251          /* Added at libpng-1.2.43 and 1.4.1, required only for read but exists
    252           * in png_struct regardless.
    253           */
    254          create_struct.user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;
    255 #     endif
    256 #  endif
    257 
    258    /* The following two API calls simply set fields in png_struct, so it is safe
    259     * to do them now even though error handling is not yet set up.
    260     */
    261 #  ifdef PNG_USER_MEM_SUPPORTED
    262       png_set_mem_fn(&create_struct, mem_ptr, malloc_fn, free_fn);
    263 #  else
    264       PNG_UNUSED(mem_ptr)
    265       PNG_UNUSED(malloc_fn)
    266       PNG_UNUSED(free_fn)
    267 #  endif
    268 
    269    /* (*error_fn) can return control to the caller after the error_ptr is set,
    270     * this will result in a memory leak unless the error_fn does something
    271     * extremely sophisticated.  The design lacks merit but is implicit in the
    272     * API.
    273     */
    274    png_set_error_fn(&create_struct, error_ptr, error_fn, warn_fn);
    275 
    276 #  ifdef PNG_SETJMP_SUPPORTED
    277       if (!setjmp(create_jmp_buf))
    278       {
    279          /* Temporarily fake out the longjmp information until we have
    280           * successfully completed this function.  This only works if we have
    281           * setjmp() support compiled in, but it is safe - this stuff should
    282           * never happen.
    283           */
    284          create_struct.jmp_buf_ptr = &create_jmp_buf;
    285          create_struct.jmp_buf_size = 0; /*stack allocation*/
    286          create_struct.longjmp_fn = longjmp;
    287 #  else
    288       {
    289 #  endif
    290          /* Call the general version checker (shared with read and write code):
    291           */
    292          if (png_user_version_check(&create_struct, user_png_ver))
    293          {
    294             png_structrp png_ptr = png_voidcast(png_structrp,
    295                png_malloc_warn(&create_struct, (sizeof *png_ptr)));
    296 
    297             if (png_ptr != NULL)
    298             {
    299                /* png_ptr->zstream holds a back-pointer to the png_struct, so
    300                 * this can only be done now:
    301                 */
    302                create_struct.zstream.zalloc = png_zalloc;
    303                create_struct.zstream.zfree = png_zfree;
    304                create_struct.zstream.opaque = png_ptr;
    305 
    306 #              ifdef PNG_SETJMP_SUPPORTED
    307                   /* Eliminate the local error handling: */
    308                   create_struct.jmp_buf_ptr = NULL;
    309                   create_struct.jmp_buf_size = 0;
    310                   create_struct.longjmp_fn = 0;
    311 #              endif
    312 
    313                *png_ptr = create_struct;
    314 
    315                /* This is the successful return point */
    316                return png_ptr;
    317             }
    318          }
    319       }
    320 
    321    /* A longjmp because of a bug in the application storage allocator or a
    322     * simple failure to allocate the png_struct.
    323     */
    324    return NULL;
    325 }
    326 
    327 /* Allocate the memory for an info_struct for the application. */
    328 PNG_FUNCTION(png_infop,PNGAPI
    329 png_create_info_struct,(png_const_structrp png_ptr),PNG_ALLOCATED)
    330 {
    331    png_inforp info_ptr;
    332 
    333    png_debug(1, "in png_create_info_struct");
    334 
    335    if (png_ptr == NULL)
    336       return NULL;
    337 
    338    /* Use the internal API that does not (or at least should not) error out, so
    339     * that this call always returns ok.  The application typically sets up the
    340     * error handling *after* creating the info_struct because this is the way it
    341     * has always been done in 'example.c'.
    342     */
    343    info_ptr = png_voidcast(png_inforp, png_malloc_base(png_ptr,
    344       (sizeof *info_ptr)));
    345 
    346    if (info_ptr != NULL)
    347       memset(info_ptr, 0, (sizeof *info_ptr));
    348 
    349    return info_ptr;
    350 }
    351 
    352 /* This function frees the memory associated with a single info struct.
    353  * Normally, one would use either png_destroy_read_struct() or
    354  * png_destroy_write_struct() to free an info struct, but this may be
    355  * useful for some applications.  From libpng 1.6.0 this function is also used
    356  * internally to implement the png_info release part of the 'struct' destroy
    357  * APIs.  This ensures that all possible approaches free the same data (all of
    358  * it).
    359  */
    360 void PNGAPI
    361 png_destroy_info_struct(png_const_structrp png_ptr, png_infopp info_ptr_ptr)
    362 {
    363    png_inforp info_ptr = NULL;
    364 
    365    png_debug(1, "in png_destroy_info_struct");
    366 
    367    if (png_ptr == NULL)
    368       return;
    369 
    370    if (info_ptr_ptr != NULL)
    371       info_ptr = *info_ptr_ptr;
    372 
    373    if (info_ptr != NULL)
    374    {
    375       /* Do this first in case of an error below; if the app implements its own
    376        * memory management this can lead to png_free calling png_error, which
    377        * will abort this routine and return control to the app error handler.
    378        * An infinite loop may result if it then tries to free the same info
    379        * ptr.
    380        */
    381       *info_ptr_ptr = NULL;
    382 
    383       png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);
    384       memset(info_ptr, 0, (sizeof *info_ptr));
    385       png_free(png_ptr, info_ptr);
    386    }
    387 }
    388 
    389 /* Initialize the info structure.  This is now an internal function (0.89)
    390  * and applications using it are urged to use png_create_info_struct()
    391  * instead.  Use deprecated in 1.6.0, internal use removed (used internally it
    392  * is just a memset).
    393  *
    394  * NOTE: it is almost inconceivable that this API is used because it bypasses
    395  * the user-memory mechanism and the user error handling/warning mechanisms in
    396  * those cases where it does anything other than a memset.
    397  */
    398 PNG_FUNCTION(void,PNGAPI
    399 png_info_init_3,(png_infopp ptr_ptr, png_size_t png_info_struct_size),
    400    PNG_DEPRECATED)
    401 {
    402    png_inforp info_ptr = *ptr_ptr;
    403 
    404    png_debug(1, "in png_info_init_3");
    405 
    406    if (info_ptr == NULL)
    407       return;
    408 
    409    if ((sizeof (png_info)) > png_info_struct_size)
    410    {
    411       *ptr_ptr = NULL;
    412       /* The following line is why this API should not be used: */
    413       free(info_ptr);
    414       info_ptr = png_voidcast(png_inforp, png_malloc_base(NULL,
    415          (sizeof *info_ptr)));
    416       *ptr_ptr = info_ptr;
    417    }
    418 
    419    /* Set everything to 0 */
    420    memset(info_ptr, 0, (sizeof *info_ptr));
    421 }
    422 
    423 /* The following API is not called internally */
    424 void PNGAPI
    425 png_data_freer(png_const_structrp png_ptr, png_inforp info_ptr,
    426    int freer, png_uint_32 mask)
    427 {
    428    png_debug(1, "in png_data_freer");
    429 
    430    if (png_ptr == NULL || info_ptr == NULL)
    431       return;
    432 
    433    if (freer == PNG_DESTROY_WILL_FREE_DATA)
    434       info_ptr->free_me |= mask;
    435 
    436    else if (freer == PNG_USER_WILL_FREE_DATA)
    437       info_ptr->free_me &= ~mask;
    438 
    439    else
    440       png_error(png_ptr, "Unknown freer parameter in png_data_freer");
    441 }
    442 
    443 void PNGAPI
    444 png_free_data(png_const_structrp png_ptr, png_inforp info_ptr, png_uint_32 mask,
    445    int num)
    446 {
    447    png_debug(1, "in png_free_data");
    448 
    449    if (png_ptr == NULL || info_ptr == NULL)
    450       return;
    451 
    452 #ifdef PNG_TEXT_SUPPORTED
    453    /* Free text item num or (if num == -1) all text items */
    454    if ((mask & PNG_FREE_TEXT) & info_ptr->free_me)
    455    {
    456       if (num != -1)
    457       {
    458          if (info_ptr->text && info_ptr->text[num].key)
    459          {
    460             png_free(png_ptr, info_ptr->text[num].key);
    461             info_ptr->text[num].key = NULL;
    462          }
    463       }
    464 
    465       else
    466       {
    467          int i;
    468          for (i = 0; i < info_ptr->num_text; i++)
    469              png_free_data(png_ptr, info_ptr, PNG_FREE_TEXT, i);
    470          png_free(png_ptr, info_ptr->text);
    471          info_ptr->text = NULL;
    472          info_ptr->num_text=0;
    473       }
    474    }
    475 #endif
    476 
    477 #ifdef PNG_tRNS_SUPPORTED
    478    /* Free any tRNS entry */
    479    if ((mask & PNG_FREE_TRNS) & info_ptr->free_me)
    480    {
    481       png_free(png_ptr, info_ptr->trans_alpha);
    482       info_ptr->trans_alpha = NULL;
    483       info_ptr->valid &= ~PNG_INFO_tRNS;
    484    }
    485 #endif
    486 
    487 #ifdef PNG_sCAL_SUPPORTED
    488    /* Free any sCAL entry */
    489    if ((mask & PNG_FREE_SCAL) & info_ptr->free_me)
    490    {
    491       png_free(png_ptr, info_ptr->scal_s_width);
    492       png_free(png_ptr, info_ptr->scal_s_height);
    493       info_ptr->scal_s_width = NULL;
    494       info_ptr->scal_s_height = NULL;
    495       info_ptr->valid &= ~PNG_INFO_sCAL;
    496    }
    497 #endif
    498 
    499 #ifdef PNG_pCAL_SUPPORTED
    500    /* Free any pCAL entry */
    501    if ((mask & PNG_FREE_PCAL) & info_ptr->free_me)
    502    {
    503       png_free(png_ptr, info_ptr->pcal_purpose);
    504       png_free(png_ptr, info_ptr->pcal_units);
    505       info_ptr->pcal_purpose = NULL;
    506       info_ptr->pcal_units = NULL;
    507       if (info_ptr->pcal_params != NULL)
    508          {
    509             unsigned int i;
    510             for (i = 0; i < info_ptr->pcal_nparams; i++)
    511             {
    512                png_free(png_ptr, info_ptr->pcal_params[i]);
    513                info_ptr->pcal_params[i] = NULL;
    514             }
    515             png_free(png_ptr, info_ptr->pcal_params);
    516             info_ptr->pcal_params = NULL;
    517          }
    518       info_ptr->valid &= ~PNG_INFO_pCAL;
    519    }
    520 #endif
    521 
    522 #ifdef PNG_iCCP_SUPPORTED
    523    /* Free any profile entry */
    524    if ((mask & PNG_FREE_ICCP) & info_ptr->free_me)
    525    {
    526       png_free(png_ptr, info_ptr->iccp_name);
    527       png_free(png_ptr, info_ptr->iccp_profile);
    528       info_ptr->iccp_name = NULL;
    529       info_ptr->iccp_profile = NULL;
    530       info_ptr->valid &= ~PNG_INFO_iCCP;
    531    }
    532 #endif
    533 
    534 #ifdef PNG_sPLT_SUPPORTED
    535    /* Free a given sPLT entry, or (if num == -1) all sPLT entries */
    536    if ((mask & PNG_FREE_SPLT) & info_ptr->free_me)
    537    {
    538       if (num != -1)
    539       {
    540          if (info_ptr->splt_palettes)
    541          {
    542             png_free(png_ptr, info_ptr->splt_palettes[num].name);
    543             png_free(png_ptr, info_ptr->splt_palettes[num].entries);
    544             info_ptr->splt_palettes[num].name = NULL;
    545             info_ptr->splt_palettes[num].entries = NULL;
    546          }
    547       }
    548 
    549       else
    550       {
    551          if (info_ptr->splt_palettes_num)
    552          {
    553             int i;
    554             for (i = 0; i < info_ptr->splt_palettes_num; i++)
    555                png_free_data(png_ptr, info_ptr, PNG_FREE_SPLT, (int)i);
    556 
    557             png_free(png_ptr, info_ptr->splt_palettes);
    558             info_ptr->splt_palettes = NULL;
    559             info_ptr->splt_palettes_num = 0;
    560          }
    561          info_ptr->valid &= ~PNG_INFO_sPLT;
    562       }
    563    }
    564 #endif
    565 
    566 #ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
    567    if ((mask & PNG_FREE_UNKN) & info_ptr->free_me)
    568    {
    569       if (num != -1)
    570       {
    571           if (info_ptr->unknown_chunks)
    572           {
    573              png_free(png_ptr, info_ptr->unknown_chunks[num].data);
    574              info_ptr->unknown_chunks[num].data = NULL;
    575           }
    576       }
    577 
    578       else
    579       {
    580          int i;
    581 
    582          if (info_ptr->unknown_chunks_num)
    583          {
    584             for (i = 0; i < info_ptr->unknown_chunks_num; i++)
    585                png_free_data(png_ptr, info_ptr, PNG_FREE_UNKN, (int)i);
    586 
    587             png_free(png_ptr, info_ptr->unknown_chunks);
    588             info_ptr->unknown_chunks = NULL;
    589             info_ptr->unknown_chunks_num = 0;
    590          }
    591       }
    592    }
    593 #endif
    594 
    595 #ifdef PNG_hIST_SUPPORTED
    596    /* Free any hIST entry */
    597    if ((mask & PNG_FREE_HIST)  & info_ptr->free_me)
    598    {
    599       png_free(png_ptr, info_ptr->hist);
    600       info_ptr->hist = NULL;
    601       info_ptr->valid &= ~PNG_INFO_hIST;
    602    }
    603 #endif
    604 
    605    /* Free any PLTE entry that was internally allocated */
    606    if ((mask & PNG_FREE_PLTE) & info_ptr->free_me)
    607    {
    608       png_free(png_ptr, info_ptr->palette);
    609       info_ptr->palette = NULL;
    610       info_ptr->valid &= ~PNG_INFO_PLTE;
    611       info_ptr->num_palette = 0;
    612    }
    613 
    614 #ifdef PNG_INFO_IMAGE_SUPPORTED
    615    /* Free any image bits attached to the info structure */
    616    if ((mask & PNG_FREE_ROWS) & info_ptr->free_me)
    617    {
    618       if (info_ptr->row_pointers)
    619       {
    620          png_uint_32 row;
    621          for (row = 0; row < info_ptr->height; row++)
    622          {
    623             png_free(png_ptr, info_ptr->row_pointers[row]);
    624             info_ptr->row_pointers[row] = NULL;
    625          }
    626          png_free(png_ptr, info_ptr->row_pointers);
    627          info_ptr->row_pointers = NULL;
    628       }
    629       info_ptr->valid &= ~PNG_INFO_IDAT;
    630    }
    631 #endif
    632 
    633    if (num != -1)
    634       mask &= ~PNG_FREE_MUL;
    635 
    636    info_ptr->free_me &= ~mask;
    637 }
    638 #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
    639 
    640 /* This function returns a pointer to the io_ptr associated with the user
    641  * functions.  The application should free any memory associated with this
    642  * pointer before png_write_destroy() or png_read_destroy() are called.
    643  */
    644 png_voidp PNGAPI
    645 png_get_io_ptr(png_const_structrp png_ptr)
    646 {
    647    if (png_ptr == NULL)
    648       return (NULL);
    649 
    650    return (png_ptr->io_ptr);
    651 }
    652 
    653 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
    654 #  ifdef PNG_STDIO_SUPPORTED
    655 /* Initialize the default input/output functions for the PNG file.  If you
    656  * use your own read or write routines, you can call either png_set_read_fn()
    657  * or png_set_write_fn() instead of png_init_io().  If you have defined
    658  * PNG_NO_STDIO or otherwise disabled PNG_STDIO_SUPPORTED, you must use a
    659  * function of your own because "FILE *" isn't necessarily available.
    660  */
    661 void PNGAPI
    662 png_init_io(png_structrp png_ptr, png_FILE_p fp)
    663 {
    664    png_debug(1, "in png_init_io");
    665 
    666    if (png_ptr == NULL)
    667       return;
    668 
    669    png_ptr->io_ptr = (png_voidp)fp;
    670 }
    671 #  endif
    672 
    673 #ifdef PNG_SAVE_INT_32_SUPPORTED
    674 /* The png_save_int_32 function assumes integers are stored in two's
    675  * complement format.  If this isn't the case, then this routine needs to
    676  * be modified to write data in two's complement format.  Note that,
    677  * the following works correctly even if png_int_32 has more than 32 bits
    678  * (compare the more complex code required on read for sign extension.)
    679  */
    680 void PNGAPI
    681 png_save_int_32(png_bytep buf, png_int_32 i)
    682 {
    683    buf[0] = (png_byte)((i >> 24) & 0xff);
    684    buf[1] = (png_byte)((i >> 16) & 0xff);
    685    buf[2] = (png_byte)((i >> 8) & 0xff);
    686    buf[3] = (png_byte)(i & 0xff);
    687 }
    688 #endif
    689 
    690 #  ifdef PNG_TIME_RFC1123_SUPPORTED
    691 /* Convert the supplied time into an RFC 1123 string suitable for use in
    692  * a "Creation Time" or other text-based time string.
    693  */
    694 int PNGAPI
    695 png_convert_to_rfc1123_buffer(char out[29], png_const_timep ptime)
    696 {
    697    static PNG_CONST char short_months[12][4] =
    698         {"Jan", "Feb", "Mar", "Apr", "May", "Jun",
    699          "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
    700 
    701    if (out == NULL)
    702       return 0;
    703 
    704    if (ptime->year > 9999 /* RFC1123 limitation */ ||
    705        ptime->month == 0    ||  ptime->month > 12  ||
    706        ptime->day   == 0    ||  ptime->day   > 31  ||
    707        ptime->hour  > 23    ||  ptime->minute > 59 ||
    708        ptime->second > 60)
    709       return 0;
    710 
    711    {
    712       size_t pos = 0;
    713       char number_buf[5]; /* enough for a four-digit year */
    714 
    715 #     define APPEND_STRING(string) pos = png_safecat(out, 29, pos, (string))
    716 #     define APPEND_NUMBER(format, value)\
    717          APPEND_STRING(PNG_FORMAT_NUMBER(number_buf, format, (value)))
    718 #     define APPEND(ch) if (pos < 28) out[pos++] = (ch)
    719 
    720       APPEND_NUMBER(PNG_NUMBER_FORMAT_u, (unsigned)ptime->day);
    721       APPEND(' ');
    722       APPEND_STRING(short_months[(ptime->month - 1)]);
    723       APPEND(' ');
    724       APPEND_NUMBER(PNG_NUMBER_FORMAT_u, ptime->year);
    725       APPEND(' ');
    726       APPEND_NUMBER(PNG_NUMBER_FORMAT_02u, (unsigned)ptime->hour);
    727       APPEND(':');
    728       APPEND_NUMBER(PNG_NUMBER_FORMAT_02u, (unsigned)ptime->minute);
    729       APPEND(':');
    730       APPEND_NUMBER(PNG_NUMBER_FORMAT_02u, (unsigned)ptime->second);
    731       APPEND_STRING(" +0000"); /* This reliably terminates the buffer */
    732 
    733 #     undef APPEND
    734 #     undef APPEND_NUMBER
    735 #     undef APPEND_STRING
    736    }
    737 
    738    return 1;
    739 }
    740 
    741 #     if PNG_LIBPNG_VER < 10700
    742 /* To do: remove the following from libpng-1.7 */
    743 /* Original API that uses a private buffer in png_struct.
    744  * Deprecated because it causes png_struct to carry a spurious temporary
    745  * buffer (png_struct::time_buffer), better to have the caller pass this in.
    746  */
    747 png_const_charp PNGAPI
    748 png_convert_to_rfc1123(png_structrp png_ptr, png_const_timep ptime)
    749 {
    750    if (png_ptr != NULL)
    751    {
    752       /* The only failure above if png_ptr != NULL is from an invalid ptime */
    753       if (!png_convert_to_rfc1123_buffer(png_ptr->time_buffer, ptime))
    754          png_warning(png_ptr, "Ignoring invalid time value");
    755 
    756       else
    757          return png_ptr->time_buffer;
    758    }
    759 
    760    return NULL;
    761 }
    762 #     endif
    763 #  endif /* PNG_TIME_RFC1123_SUPPORTED */
    764 
    765 #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
    766 
    767 png_const_charp PNGAPI
    768 png_get_copyright(png_const_structrp png_ptr)
    769 {
    770    PNG_UNUSED(png_ptr)  /* Silence compiler warning about unused png_ptr */
    771 #ifdef PNG_STRING_COPYRIGHT
    772    return PNG_STRING_COPYRIGHT
    773 #else
    774 #  ifdef __STDC__
    775    return PNG_STRING_NEWLINE \
    776      "libpng version 1.6.10 - March 6, 2014" PNG_STRING_NEWLINE \
    777      "Copyright (c) 1998-2014 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
    778      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
    779      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
    780      PNG_STRING_NEWLINE;
    781 #  else
    782       return "libpng version 1.6.10 - March 6, 2014\
    783       Copyright (c) 1998-2014 Glenn Randers-Pehrson\
    784       Copyright (c) 1996-1997 Andreas Dilger\
    785       Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.";
    786 #  endif
    787 #endif
    788 }
    789 
    790 /* The following return the library version as a short string in the
    791  * format 1.0.0 through 99.99.99zz.  To get the version of *.h files
    792  * used with your application, print out PNG_LIBPNG_VER_STRING, which
    793  * is defined in png.h.
    794  * Note: now there is no difference between png_get_libpng_ver() and
    795  * png_get_header_ver().  Due to the version_nn_nn_nn typedef guard,
    796  * it is guaranteed that png.c uses the correct version of png.h.
    797  */
    798 png_const_charp PNGAPI
    799 png_get_libpng_ver(png_const_structrp png_ptr)
    800 {
    801    /* Version of *.c files used when building libpng */
    802    return png_get_header_ver(png_ptr);
    803 }
    804 
    805 png_const_charp PNGAPI
    806 png_get_header_ver(png_const_structrp png_ptr)
    807 {
    808    /* Version of *.h files used when building libpng */
    809    PNG_UNUSED(png_ptr)  /* Silence compiler warning about unused png_ptr */
    810    return PNG_LIBPNG_VER_STRING;
    811 }
    812 
    813 png_const_charp PNGAPI
    814 png_get_header_version(png_const_structrp png_ptr)
    815 {
    816    /* Returns longer string containing both version and date */
    817    PNG_UNUSED(png_ptr)  /* Silence compiler warning about unused png_ptr */
    818 #ifdef __STDC__
    819    return PNG_HEADER_VERSION_STRING
    820 #  ifndef PNG_READ_SUPPORTED
    821    "     (NO READ SUPPORT)"
    822 #  endif
    823    PNG_STRING_NEWLINE;
    824 #else
    825    return PNG_HEADER_VERSION_STRING;
    826 #endif
    827 }
    828 
    829 #ifdef PNG_BUILD_GRAYSCALE_PALETTE_SUPPORTED
    830 /* NOTE: this routine is not used internally! */
    831 /* Build a grayscale palette.  Palette is assumed to be 1 << bit_depth
    832  * large of png_color.  This lets grayscale images be treated as
    833  * paletted.  Most useful for gamma correction and simplification
    834  * of code.  This API is not used internally.
    835  */
    836 void PNGAPI
    837 png_build_grayscale_palette(int bit_depth, png_colorp palette)
    838 {
    839    int num_palette;
    840    int color_inc;
    841    int i;
    842    int v;
    843 
    844    png_debug(1, "in png_do_build_grayscale_palette");
    845 
    846    if (palette == NULL)
    847       return;
    848 
    849    switch (bit_depth)
    850    {
    851       case 1:
    852          num_palette = 2;
    853          color_inc = 0xff;
    854          break;
    855 
    856       case 2:
    857          num_palette = 4;
    858          color_inc = 0x55;
    859          break;
    860 
    861       case 4:
    862          num_palette = 16;
    863          color_inc = 0x11;
    864          break;
    865 
    866       case 8:
    867          num_palette = 256;
    868          color_inc = 1;
    869          break;
    870 
    871       default:
    872          num_palette = 0;
    873          color_inc = 0;
    874          break;
    875    }
    876 
    877    for (i = 0, v = 0; i < num_palette; i++, v += color_inc)
    878    {
    879       palette[i].red = (png_byte)v;
    880       palette[i].green = (png_byte)v;
    881       palette[i].blue = (png_byte)v;
    882    }
    883 }
    884 #endif
    885 
    886 #ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
    887 int PNGAPI
    888 png_handle_as_unknown(png_const_structrp png_ptr, png_const_bytep chunk_name)
    889 {
    890    /* Check chunk_name and return "keep" value if it's on the list, else 0 */
    891    png_const_bytep p, p_end;
    892 
    893    if (png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list == 0)
    894       return PNG_HANDLE_CHUNK_AS_DEFAULT;
    895 
    896    p_end = png_ptr->chunk_list;
    897    p = p_end + png_ptr->num_chunk_list*5; /* beyond end */
    898 
    899    /* The code is the fifth byte after each four byte string.  Historically this
    900     * code was always searched from the end of the list, this is no longer
    901     * necessary because the 'set' routine handles duplicate entries correcty.
    902     */
    903    do /* num_chunk_list > 0, so at least one */
    904    {
    905       p -= 5;
    906 
    907       if (!memcmp(chunk_name, p, 4))
    908          return p[4];
    909    }
    910    while (p > p_end);
    911 
    912    /* This means that known chunks should be processed and unknown chunks should
    913     * be handled according to the value of png_ptr->unknown_default; this can be
    914     * confusing because, as a result, there are two levels of defaulting for
    915     * unknown chunks.
    916     */
    917    return PNG_HANDLE_CHUNK_AS_DEFAULT;
    918 }
    919 
    920 #if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED) ||\
    921    defined(PNG_HANDLE_AS_UNKNOWN_SUPPORTED)
    922 int /* PRIVATE */
    923 png_chunk_unknown_handling(png_const_structrp png_ptr, png_uint_32 chunk_name)
    924 {
    925    png_byte chunk_string[5];
    926 
    927    PNG_CSTRING_FROM_CHUNK(chunk_string, chunk_name);
    928    return png_handle_as_unknown(png_ptr, chunk_string);
    929 }
    930 #endif /* READ_UNKNOWN_CHUNKS || HANDLE_AS_UNKNOWN */
    931 #endif /* SET_UNKNOWN_CHUNKS */
    932 
    933 #ifdef PNG_READ_SUPPORTED
    934 /* This function, added to libpng-1.0.6g, is untested. */
    935 int PNGAPI
    936 png_reset_zstream(png_structrp png_ptr)
    937 {
    938    if (png_ptr == NULL)
    939       return Z_STREAM_ERROR;
    940 
    941    /* WARNING: this resets the window bits to the maximum! */
    942    return (inflateReset(&png_ptr->zstream));
    943 }
    944 #endif /* PNG_READ_SUPPORTED */
    945 
    946 /* This function was added to libpng-1.0.7 */
    947 png_uint_32 PNGAPI
    948 png_access_version_number(void)
    949 {
    950    /* Version of *.c files used when building libpng */
    951    return((png_uint_32)PNG_LIBPNG_VER);
    952 }
    953 
    954 
    955 
    956 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
    957 /* Ensure that png_ptr->zstream.msg holds some appropriate error message string.
    958  * If it doesn't 'ret' is used to set it to something appropriate, even in cases
    959  * like Z_OK or Z_STREAM_END where the error code is apparently a success code.
    960  */
    961 void /* PRIVATE */
    962 png_zstream_error(png_structrp png_ptr, int ret)
    963 {
    964    /* Translate 'ret' into an appropriate error string, priority is given to the
    965     * one in zstream if set.  This always returns a string, even in cases like
    966     * Z_OK or Z_STREAM_END where the error code is a success code.
    967     */
    968    if (png_ptr->zstream.msg == NULL) switch (ret)
    969    {
    970       default:
    971       case Z_OK:
    972          png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected zlib return code");
    973          break;
    974 
    975       case Z_STREAM_END:
    976          /* Normal exit */
    977          png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected end of LZ stream");
    978          break;
    979 
    980       case Z_NEED_DICT:
    981          /* This means the deflate stream did not have a dictionary; this
    982           * indicates a bogus PNG.
    983           */
    984          png_ptr->zstream.msg = PNGZ_MSG_CAST("missing LZ dictionary");
    985          break;
    986 
    987       case Z_ERRNO:
    988          /* gz APIs only: should not happen */
    989          png_ptr->zstream.msg = PNGZ_MSG_CAST("zlib IO error");
    990          break;
    991 
    992       case Z_STREAM_ERROR:
    993          /* internal libpng error */
    994          png_ptr->zstream.msg = PNGZ_MSG_CAST("bad parameters to zlib");
    995          break;
    996 
    997       case Z_DATA_ERROR:
    998          png_ptr->zstream.msg = PNGZ_MSG_CAST("damaged LZ stream");
    999          break;
   1000 
   1001       case Z_MEM_ERROR:
   1002          png_ptr->zstream.msg = PNGZ_MSG_CAST("insufficient memory");
   1003          break;
   1004 
   1005       case Z_BUF_ERROR:
   1006          /* End of input or output; not a problem if the caller is doing
   1007           * incremental read or write.
   1008           */
   1009          png_ptr->zstream.msg = PNGZ_MSG_CAST("truncated");
   1010          break;
   1011 
   1012       case Z_VERSION_ERROR:
   1013          png_ptr->zstream.msg = PNGZ_MSG_CAST("unsupported zlib version");
   1014          break;
   1015 
   1016       case PNG_UNEXPECTED_ZLIB_RETURN:
   1017          /* Compile errors here mean that zlib now uses the value co-opted in
   1018           * pngpriv.h for PNG_UNEXPECTED_ZLIB_RETURN; update the switch above
   1019           * and change pngpriv.h.  Note that this message is "... return",
   1020           * whereas the default/Z_OK one is "... return code".
   1021           */
   1022          png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected zlib return");
   1023          break;
   1024    }
   1025 }
   1026 
   1027 /* png_convert_size: a PNGAPI but no longer in png.h, so deleted
   1028  * at libpng 1.5.5!
   1029  */
   1030 
   1031 /* Added at libpng version 1.2.34 and 1.4.0 (moved from pngset.c) */
   1032 #ifdef PNG_GAMMA_SUPPORTED /* always set if COLORSPACE */
   1033 static int
   1034 png_colorspace_check_gamma(png_const_structrp png_ptr,
   1035    png_colorspacerp colorspace, png_fixed_point gAMA, int from)
   1036    /* This is called to check a new gamma value against an existing one.  The
   1037     * routine returns false if the new gamma value should not be written.
   1038     *
   1039     * 'from' says where the new gamma value comes from:
   1040     *
   1041     *    0: the new gamma value is the libpng estimate for an ICC profile
   1042     *    1: the new gamma value comes from a gAMA chunk
   1043     *    2: the new gamma value comes from an sRGB chunk
   1044     */
   1045 {
   1046    png_fixed_point gtest;
   1047 
   1048    if ((colorspace->flags & PNG_COLORSPACE_HAVE_GAMMA) != 0 &&
   1049       (!png_muldiv(&gtest, colorspace->gamma, PNG_FP_1, gAMA) ||
   1050       png_gamma_significant(gtest)))
   1051    {
   1052       /* Either this is an sRGB image, in which case the calculated gamma
   1053        * approximation should match, or this is an image with a profile and the
   1054        * value libpng calculates for the gamma of the profile does not match the
   1055        * value recorded in the file.  The former, sRGB, case is an error, the
   1056        * latter is just a warning.
   1057        */
   1058       if ((colorspace->flags & PNG_COLORSPACE_FROM_sRGB) != 0 || from == 2)
   1059       {
   1060          png_chunk_report(png_ptr, "gamma value does not match sRGB",
   1061             PNG_CHUNK_ERROR);
   1062          /* Do not overwrite an sRGB value */
   1063          return from == 2;
   1064       }
   1065 
   1066       else /* sRGB tag not involved */
   1067       {
   1068          png_chunk_report(png_ptr, "gamma value does not match libpng estimate",
   1069             PNG_CHUNK_WARNING);
   1070          return from == 1;
   1071       }
   1072    }
   1073 
   1074    return 1;
   1075 }
   1076 
   1077 void /* PRIVATE */
   1078 png_colorspace_set_gamma(png_const_structrp png_ptr,
   1079    png_colorspacerp colorspace, png_fixed_point gAMA)
   1080 {
   1081    /* Changed in libpng-1.5.4 to limit the values to ensure overflow can't
   1082     * occur.  Since the fixed point representation is assymetrical it is
   1083     * possible for 1/gamma to overflow the limit of 21474 and this means the
   1084     * gamma value must be at least 5/100000 and hence at most 20000.0.  For
   1085     * safety the limits here are a little narrower.  The values are 0.00016 to
   1086     * 6250.0, which are truly ridiculous gamma values (and will produce
   1087     * displays that are all black or all white.)
   1088     *
   1089     * In 1.6.0 this test replaces the ones in pngrutil.c, in the gAMA chunk
   1090     * handling code, which only required the value to be >0.
   1091     */
   1092    png_const_charp errmsg;
   1093 
   1094    if (gAMA < 16 || gAMA > 625000000)
   1095       errmsg = "gamma value out of range";
   1096 
   1097 #  ifdef PNG_READ_gAMA_SUPPORTED
   1098       /* Allow the application to set the gamma value more than once */
   1099       else if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&
   1100          (colorspace->flags & PNG_COLORSPACE_FROM_gAMA) != 0)
   1101          errmsg = "duplicate";
   1102 #  endif
   1103 
   1104    /* Do nothing if the colorspace is already invalid */
   1105    else if (colorspace->flags & PNG_COLORSPACE_INVALID)
   1106       return;
   1107 
   1108    else
   1109    {
   1110       if (png_colorspace_check_gamma(png_ptr, colorspace, gAMA, 1/*from gAMA*/))
   1111       {
   1112          /* Store this gamma value. */
   1113          colorspace->gamma = gAMA;
   1114          colorspace->flags |=
   1115             (PNG_COLORSPACE_HAVE_GAMMA | PNG_COLORSPACE_FROM_gAMA);
   1116       }
   1117 
   1118       /* At present if the check_gamma test fails the gamma of the colorspace is
   1119        * not updated however the colorspace is not invalidated.  This
   1120        * corresponds to the case where the existing gamma comes from an sRGB
   1121        * chunk or profile.  An error message has already been output.
   1122        */
   1123       return;
   1124    }
   1125 
   1126    /* Error exit - errmsg has been set. */
   1127    colorspace->flags |= PNG_COLORSPACE_INVALID;
   1128    png_chunk_report(png_ptr, errmsg, PNG_CHUNK_WRITE_ERROR);
   1129 }
   1130 
   1131 void /* PRIVATE */
   1132 png_colorspace_sync_info(png_const_structrp png_ptr, png_inforp info_ptr)
   1133 {
   1134    if (info_ptr->colorspace.flags & PNG_COLORSPACE_INVALID)
   1135    {
   1136       /* Everything is invalid */
   1137       info_ptr->valid &= ~(PNG_INFO_gAMA|PNG_INFO_cHRM|PNG_INFO_sRGB|
   1138          PNG_INFO_iCCP);
   1139 
   1140 #     ifdef PNG_COLORSPACE_SUPPORTED
   1141          /* Clean up the iCCP profile now if it won't be used. */
   1142          png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, -1/*not used*/);
   1143 #     else
   1144          PNG_UNUSED(png_ptr)
   1145 #     endif
   1146    }
   1147 
   1148    else
   1149    {
   1150 #     ifdef PNG_COLORSPACE_SUPPORTED
   1151          /* Leave the INFO_iCCP flag set if the pngset.c code has already set
   1152           * it; this allows a PNG to contain a profile which matches sRGB and
   1153           * yet still have that profile retrievable by the application.
   1154           */
   1155          if (info_ptr->colorspace.flags & PNG_COLORSPACE_MATCHES_sRGB)
   1156             info_ptr->valid |= PNG_INFO_sRGB;
   1157 
   1158          else
   1159             info_ptr->valid &= ~PNG_INFO_sRGB;
   1160 
   1161          if (info_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_ENDPOINTS)
   1162             info_ptr->valid |= PNG_INFO_cHRM;
   1163 
   1164          else
   1165             info_ptr->valid &= ~PNG_INFO_cHRM;
   1166 #     endif
   1167 
   1168       if (info_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_GAMMA)
   1169          info_ptr->valid |= PNG_INFO_gAMA;
   1170 
   1171       else
   1172          info_ptr->valid &= ~PNG_INFO_gAMA;
   1173    }
   1174 }
   1175 
   1176 #ifdef PNG_READ_SUPPORTED
   1177 void /* PRIVATE */
   1178 png_colorspace_sync(png_const_structrp png_ptr, png_inforp info_ptr)
   1179 {
   1180    if (info_ptr == NULL) /* reduce code size; check here not in the caller */
   1181       return;
   1182 
   1183    info_ptr->colorspace = png_ptr->colorspace;
   1184    png_colorspace_sync_info(png_ptr, info_ptr);
   1185 }
   1186 #endif
   1187 #endif
   1188 
   1189 #ifdef PNG_COLORSPACE_SUPPORTED
   1190 /* Added at libpng-1.5.5 to support read and write of true CIEXYZ values for
   1191  * cHRM, as opposed to using chromaticities.  These internal APIs return
   1192  * non-zero on a parameter error.  The X, Y and Z values are required to be
   1193  * positive and less than 1.0.
   1194  */
   1195 static int
   1196 png_xy_from_XYZ(png_xy *xy, const png_XYZ *XYZ)
   1197 {
   1198    png_int_32 d, dwhite, whiteX, whiteY;
   1199 
   1200    d = XYZ->red_X + XYZ->red_Y + XYZ->red_Z;
   1201    if (!png_muldiv(&xy->redx, XYZ->red_X, PNG_FP_1, d)) return 1;
   1202    if (!png_muldiv(&xy->redy, XYZ->red_Y, PNG_FP_1, d)) return 1;
   1203    dwhite = d;
   1204    whiteX = XYZ->red_X;
   1205    whiteY = XYZ->red_Y;
   1206 
   1207    d = XYZ->green_X + XYZ->green_Y + XYZ->green_Z;
   1208    if (!png_muldiv(&xy->greenx, XYZ->green_X, PNG_FP_1, d)) return 1;
   1209    if (!png_muldiv(&xy->greeny, XYZ->green_Y, PNG_FP_1, d)) return 1;
   1210    dwhite += d;
   1211    whiteX += XYZ->green_X;
   1212    whiteY += XYZ->green_Y;
   1213 
   1214    d = XYZ->blue_X + XYZ->blue_Y + XYZ->blue_Z;
   1215    if (!png_muldiv(&xy->bluex, XYZ->blue_X, PNG_FP_1, d)) return 1;
   1216    if (!png_muldiv(&xy->bluey, XYZ->blue_Y, PNG_FP_1, d)) return 1;
   1217    dwhite += d;
   1218    whiteX += XYZ->blue_X;
   1219    whiteY += XYZ->blue_Y;
   1220 
   1221    /* The reference white is simply the sum of the end-point (X,Y,Z) vectors,
   1222     * thus:
   1223     */
   1224    if (!png_muldiv(&xy->whitex, whiteX, PNG_FP_1, dwhite)) return 1;
   1225    if (!png_muldiv(&xy->whitey, whiteY, PNG_FP_1, dwhite)) return 1;
   1226 
   1227    return 0;
   1228 }
   1229 
   1230 static int
   1231 png_XYZ_from_xy(png_XYZ *XYZ, const png_xy *xy)
   1232 {
   1233    png_fixed_point red_inverse, green_inverse, blue_scale;
   1234    png_fixed_point left, right, denominator;
   1235 
   1236    /* Check xy and, implicitly, z.  Note that wide gamut color spaces typically
   1237     * have end points with 0 tristimulus values (these are impossible end
   1238     * points, but they are used to cover the possible colors.)
   1239     */
   1240    if (xy->redx < 0 || xy->redx > PNG_FP_1) return 1;
   1241    if (xy->redy < 0 || xy->redy > PNG_FP_1-xy->redx) return 1;
   1242    if (xy->greenx < 0 || xy->greenx > PNG_FP_1) return 1;
   1243    if (xy->greeny < 0 || xy->greeny > PNG_FP_1-xy->greenx) return 1;
   1244    if (xy->bluex < 0 || xy->bluex > PNG_FP_1) return 1;
   1245    if (xy->bluey < 0 || xy->bluey > PNG_FP_1-xy->bluex) return 1;
   1246    if (xy->whitex < 0 || xy->whitex > PNG_FP_1) return 1;
   1247    if (xy->whitey < 0 || xy->whitey > PNG_FP_1-xy->whitex) return 1;
   1248 
   1249    /* The reverse calculation is more difficult because the original tristimulus
   1250     * value had 9 independent values (red,green,blue)x(X,Y,Z) however only 8
   1251     * derived values were recorded in the cHRM chunk;
   1252     * (red,green,blue,white)x(x,y).  This loses one degree of freedom and
   1253     * therefore an arbitrary ninth value has to be introduced to undo the
   1254     * original transformations.
   1255     *
   1256     * Think of the original end-points as points in (X,Y,Z) space.  The
   1257     * chromaticity values (c) have the property:
   1258     *
   1259     *           C
   1260     *   c = ---------
   1261     *       X + Y + Z
   1262     *
   1263     * For each c (x,y,z) from the corresponding original C (X,Y,Z).  Thus the
   1264     * three chromaticity values (x,y,z) for each end-point obey the
   1265     * relationship:
   1266     *
   1267     *   x + y + z = 1
   1268     *
   1269     * This describes the plane in (X,Y,Z) space that intersects each axis at the
   1270     * value 1.0; call this the chromaticity plane.  Thus the chromaticity
   1271     * calculation has scaled each end-point so that it is on the x+y+z=1 plane
   1272     * and chromaticity is the intersection of the vector from the origin to the
   1273     * (X,Y,Z) value with the chromaticity plane.
   1274     *
   1275     * To fully invert the chromaticity calculation we would need the three
   1276     * end-point scale factors, (red-scale, green-scale, blue-scale), but these
   1277     * were not recorded.  Instead we calculated the reference white (X,Y,Z) and
   1278     * recorded the chromaticity of this.  The reference white (X,Y,Z) would have
   1279     * given all three of the scale factors since:
   1280     *
   1281     *    color-C = color-c * color-scale
   1282     *    white-C = red-C + green-C + blue-C
   1283     *            = red-c*red-scale + green-c*green-scale + blue-c*blue-scale
   1284     *
   1285     * But cHRM records only white-x and white-y, so we have lost the white scale
   1286     * factor:
   1287     *
   1288     *    white-C = white-c*white-scale
   1289     *
   1290     * To handle this the inverse transformation makes an arbitrary assumption
   1291     * about white-scale:
   1292     *
   1293     *    Assume: white-Y = 1.0
   1294     *    Hence:  white-scale = 1/white-y
   1295     *    Or:     red-Y + green-Y + blue-Y = 1.0
   1296     *
   1297     * Notice the last statement of the assumption gives an equation in three of
   1298     * the nine values we want to calculate.  8 more equations come from the
   1299     * above routine as summarised at the top above (the chromaticity
   1300     * calculation):
   1301     *
   1302     *    Given: color-x = color-X / (color-X + color-Y + color-Z)
   1303     *    Hence: (color-x - 1)*color-X + color.x*color-Y + color.x*color-Z = 0
   1304     *
   1305     * This is 9 simultaneous equations in the 9 variables "color-C" and can be
   1306     * solved by Cramer's rule.  Cramer's rule requires calculating 10 9x9 matrix
   1307     * determinants, however this is not as bad as it seems because only 28 of
   1308     * the total of 90 terms in the various matrices are non-zero.  Nevertheless
   1309     * Cramer's rule is notoriously numerically unstable because the determinant
   1310     * calculation involves the difference of large, but similar, numbers.  It is
   1311     * difficult to be sure that the calculation is stable for real world values
   1312     * and it is certain that it becomes unstable where the end points are close
   1313     * together.
   1314     *
   1315     * So this code uses the perhaps slightly less optimal but more
   1316     * understandable and totally obvious approach of calculating color-scale.
   1317     *
   1318     * This algorithm depends on the precision in white-scale and that is
   1319     * (1/white-y), so we can immediately see that as white-y approaches 0 the
   1320     * accuracy inherent in the cHRM chunk drops off substantially.
   1321     *
   1322     * libpng arithmetic: a simple invertion of the above equations
   1323     * ------------------------------------------------------------
   1324     *
   1325     *    white_scale = 1/white-y
   1326     *    white-X = white-x * white-scale
   1327     *    white-Y = 1.0
   1328     *    white-Z = (1 - white-x - white-y) * white_scale
   1329     *
   1330     *    white-C = red-C + green-C + blue-C
   1331     *            = red-c*red-scale + green-c*green-scale + blue-c*blue-scale
   1332     *
   1333     * This gives us three equations in (red-scale,green-scale,blue-scale) where
   1334     * all the coefficients are now known:
   1335     *
   1336     *    red-x*red-scale + green-x*green-scale + blue-x*blue-scale
   1337     *       = white-x/white-y
   1338     *    red-y*red-scale + green-y*green-scale + blue-y*blue-scale = 1
   1339     *    red-z*red-scale + green-z*green-scale + blue-z*blue-scale
   1340     *       = (1 - white-x - white-y)/white-y
   1341     *
   1342     * In the last equation color-z is (1 - color-x - color-y) so we can add all
   1343     * three equations together to get an alternative third:
   1344     *
   1345     *    red-scale + green-scale + blue-scale = 1/white-y = white-scale
   1346     *
   1347     * So now we have a Cramer's rule solution where the determinants are just
   1348     * 3x3 - far more tractible.  Unfortunately 3x3 determinants still involve
   1349     * multiplication of three coefficients so we can't guarantee to avoid
   1350     * overflow in the libpng fixed point representation.  Using Cramer's rule in
   1351     * floating point is probably a good choice here, but it's not an option for
   1352     * fixed point.  Instead proceed to simplify the first two equations by
   1353     * eliminating what is likely to be the largest value, blue-scale:
   1354     *
   1355     *    blue-scale = white-scale - red-scale - green-scale
   1356     *
   1357     * Hence:
   1358     *
   1359     *    (red-x - blue-x)*red-scale + (green-x - blue-x)*green-scale =
   1360     *                (white-x - blue-x)*white-scale
   1361     *
   1362     *    (red-y - blue-y)*red-scale + (green-y - blue-y)*green-scale =
   1363     *                1 - blue-y*white-scale
   1364     *
   1365     * And now we can trivially solve for (red-scale,green-scale):
   1366     *
   1367     *    green-scale =
   1368     *                (white-x - blue-x)*white-scale - (red-x - blue-x)*red-scale
   1369     *                -----------------------------------------------------------
   1370     *                                  green-x - blue-x
   1371     *
   1372     *    red-scale =
   1373     *                1 - blue-y*white-scale - (green-y - blue-y) * green-scale
   1374     *                ---------------------------------------------------------
   1375     *                                  red-y - blue-y
   1376     *
   1377     * Hence:
   1378     *
   1379     *    red-scale =
   1380     *          ( (green-x - blue-x) * (white-y - blue-y) -
   1381     *            (green-y - blue-y) * (white-x - blue-x) ) / white-y
   1382     * -------------------------------------------------------------------------
   1383     *  (green-x - blue-x)*(red-y - blue-y)-(green-y - blue-y)*(red-x - blue-x)
   1384     *
   1385     *    green-scale =
   1386     *          ( (red-y - blue-y) * (white-x - blue-x) -
   1387     *            (red-x - blue-x) * (white-y - blue-y) ) / white-y
   1388     * -------------------------------------------------------------------------
   1389     *  (green-x - blue-x)*(red-y - blue-y)-(green-y - blue-y)*(red-x - blue-x)
   1390     *
   1391     * Accuracy:
   1392     * The input values have 5 decimal digits of accuracy.  The values are all in
   1393     * the range 0 < value < 1, so simple products are in the same range but may
   1394     * need up to 10 decimal digits to preserve the original precision and avoid
   1395     * underflow.  Because we are using a 32-bit signed representation we cannot
   1396     * match this; the best is a little over 9 decimal digits, less than 10.
   1397     *
   1398     * The approach used here is to preserve the maximum precision within the
   1399     * signed representation.  Because the red-scale calculation above uses the
   1400     * difference between two products of values that must be in the range -1..+1
   1401     * it is sufficient to divide the product by 7; ceil(100,000/32767*2).  The
   1402     * factor is irrelevant in the calculation because it is applied to both
   1403     * numerator and denominator.
   1404     *
   1405     * Note that the values of the differences of the products of the
   1406     * chromaticities in the above equations tend to be small, for example for
   1407     * the sRGB chromaticities they are:
   1408     *
   1409     * red numerator:    -0.04751
   1410     * green numerator:  -0.08788
   1411     * denominator:      -0.2241 (without white-y multiplication)
   1412     *
   1413     *  The resultant Y coefficients from the chromaticities of some widely used
   1414     *  color space definitions are (to 15 decimal places):
   1415     *
   1416     *  sRGB
   1417     *    0.212639005871510 0.715168678767756 0.072192315360734
   1418     *  Kodak ProPhoto
   1419     *    0.288071128229293 0.711843217810102 0.000085653960605
   1420     *  Adobe RGB
   1421     *    0.297344975250536 0.627363566255466 0.075291458493998
   1422     *  Adobe Wide Gamut RGB
   1423     *    0.258728243040113 0.724682314948566 0.016589442011321
   1424     */
   1425    /* By the argument, above overflow should be impossible here. The return
   1426     * value of 2 indicates an internal error to the caller.
   1427     */
   1428    if (!png_muldiv(&left, xy->greenx-xy->bluex, xy->redy - xy->bluey, 7))
   1429       return 2;
   1430    if (!png_muldiv(&right, xy->greeny-xy->bluey, xy->redx - xy->bluex, 7))
   1431       return 2;
   1432    denominator = left - right;
   1433 
   1434    /* Now find the red numerator. */
   1435    if (!png_muldiv(&left, xy->greenx-xy->bluex, xy->whitey-xy->bluey, 7))
   1436       return 2;
   1437    if (!png_muldiv(&right, xy->greeny-xy->bluey, xy->whitex-xy->bluex, 7))
   1438       return 2;
   1439 
   1440    /* Overflow is possible here and it indicates an extreme set of PNG cHRM
   1441     * chunk values.  This calculation actually returns the reciprocal of the
   1442     * scale value because this allows us to delay the multiplication of white-y
   1443     * into the denominator, which tends to produce a small number.
   1444     */
   1445    if (!png_muldiv(&red_inverse, xy->whitey, denominator, left-right) ||
   1446        red_inverse <= xy->whitey /* r+g+b scales = white scale */)
   1447       return 1;
   1448 
   1449    /* Similarly for green_inverse: */
   1450    if (!png_muldiv(&left, xy->redy-xy->bluey, xy->whitex-xy->bluex, 7))
   1451       return 2;
   1452    if (!png_muldiv(&right, xy->redx-xy->bluex, xy->whitey-xy->bluey, 7))
   1453       return 2;
   1454    if (!png_muldiv(&green_inverse, xy->whitey, denominator, left-right) ||
   1455        green_inverse <= xy->whitey)
   1456       return 1;
   1457 
   1458    /* And the blue scale, the checks above guarantee this can't overflow but it
   1459     * can still produce 0 for extreme cHRM values.
   1460     */
   1461    blue_scale = png_reciprocal(xy->whitey) - png_reciprocal(red_inverse) -
   1462       png_reciprocal(green_inverse);
   1463    if (blue_scale <= 0) return 1;
   1464 
   1465 
   1466    /* And fill in the png_XYZ: */
   1467    if (!png_muldiv(&XYZ->red_X, xy->redx, PNG_FP_1, red_inverse)) return 1;
   1468    if (!png_muldiv(&XYZ->red_Y, xy->redy, PNG_FP_1, red_inverse)) return 1;
   1469    if (!png_muldiv(&XYZ->red_Z, PNG_FP_1 - xy->redx - xy->redy, PNG_FP_1,
   1470       red_inverse))
   1471       return 1;
   1472 
   1473    if (!png_muldiv(&XYZ->green_X, xy->greenx, PNG_FP_1, green_inverse))
   1474       return 1;
   1475    if (!png_muldiv(&XYZ->green_Y, xy->greeny, PNG_FP_1, green_inverse))
   1476       return 1;
   1477    if (!png_muldiv(&XYZ->green_Z, PNG_FP_1 - xy->greenx - xy->greeny, PNG_FP_1,
   1478       green_inverse))
   1479       return 1;
   1480 
   1481    if (!png_muldiv(&XYZ->blue_X, xy->bluex, blue_scale, PNG_FP_1)) return 1;
   1482    if (!png_muldiv(&XYZ->blue_Y, xy->bluey, blue_scale, PNG_FP_1)) return 1;
   1483    if (!png_muldiv(&XYZ->blue_Z, PNG_FP_1 - xy->bluex - xy->bluey, blue_scale,
   1484       PNG_FP_1))
   1485       return 1;
   1486 
   1487    return 0; /*success*/
   1488 }
   1489 
   1490 static int
   1491 png_XYZ_normalize(png_XYZ *XYZ)
   1492 {
   1493    png_int_32 Y;
   1494 
   1495    if (XYZ->red_Y < 0 || XYZ->green_Y < 0 || XYZ->blue_Y < 0 ||
   1496       XYZ->red_X < 0 || XYZ->green_X < 0 || XYZ->blue_X < 0 ||
   1497       XYZ->red_Z < 0 || XYZ->green_Z < 0 || XYZ->blue_Z < 0)
   1498       return 1;
   1499 
   1500    /* Normalize by scaling so the sum of the end-point Y values is PNG_FP_1.
   1501     * IMPLEMENTATION NOTE: ANSI requires signed overflow not to occur, therefore
   1502     * relying on addition of two positive values producing a negative one is not
   1503     * safe.
   1504     */
   1505    Y = XYZ->red_Y;
   1506    if (0x7fffffff - Y < XYZ->green_X) return 1;
   1507    Y += XYZ->green_Y;
   1508    if (0x7fffffff - Y < XYZ->blue_X) return 1;
   1509    Y += XYZ->blue_Y;
   1510 
   1511    if (Y != PNG_FP_1)
   1512    {
   1513       if (!png_muldiv(&XYZ->red_X, XYZ->red_X, PNG_FP_1, Y)) return 1;
   1514       if (!png_muldiv(&XYZ->red_Y, XYZ->red_Y, PNG_FP_1, Y)) return 1;
   1515       if (!png_muldiv(&XYZ->red_Z, XYZ->red_Z, PNG_FP_1, Y)) return 1;
   1516 
   1517       if (!png_muldiv(&XYZ->green_X, XYZ->green_X, PNG_FP_1, Y)) return 1;
   1518       if (!png_muldiv(&XYZ->green_Y, XYZ->green_Y, PNG_FP_1, Y)) return 1;
   1519       if (!png_muldiv(&XYZ->green_Z, XYZ->green_Z, PNG_FP_1, Y)) return 1;
   1520 
   1521       if (!png_muldiv(&XYZ->blue_X, XYZ->blue_X, PNG_FP_1, Y)) return 1;
   1522       if (!png_muldiv(&XYZ->blue_Y, XYZ->blue_Y, PNG_FP_1, Y)) return 1;
   1523       if (!png_muldiv(&XYZ->blue_Z, XYZ->blue_Z, PNG_FP_1, Y)) return 1;
   1524    }
   1525 
   1526    return 0;
   1527 }
   1528 
   1529 static int
   1530 png_colorspace_endpoints_match(const png_xy *xy1, const png_xy *xy2, int delta)
   1531 {
   1532    /* Allow an error of +/-0.01 (absolute value) on each chromaticity */
   1533    return !(PNG_OUT_OF_RANGE(xy1->whitex, xy2->whitex,delta) ||
   1534       PNG_OUT_OF_RANGE(xy1->whitey, xy2->whitey,delta) ||
   1535       PNG_OUT_OF_RANGE(xy1->redx,   xy2->redx,  delta) ||
   1536       PNG_OUT_OF_RANGE(xy1->redy,   xy2->redy,  delta) ||
   1537       PNG_OUT_OF_RANGE(xy1->greenx, xy2->greenx,delta) ||
   1538       PNG_OUT_OF_RANGE(xy1->greeny, xy2->greeny,delta) ||
   1539       PNG_OUT_OF_RANGE(xy1->bluex,  xy2->bluex, delta) ||
   1540       PNG_OUT_OF_RANGE(xy1->bluey,  xy2->bluey, delta));
   1541 }
   1542 
   1543 /* Added in libpng-1.6.0, a different check for the validity of a set of cHRM
   1544  * chunk chromaticities.  Earlier checks used to simply look for the overflow
   1545  * condition (where the determinant of the matrix to solve for XYZ ends up zero
   1546  * because the chromaticity values are not all distinct.)  Despite this it is
   1547  * theoretically possible to produce chromaticities that are apparently valid
   1548  * but that rapidly degrade to invalid, potentially crashing, sets because of
   1549  * arithmetic inaccuracies when calculations are performed on them.  The new
   1550  * check is to round-trip xy -> XYZ -> xy and then check that the result is
   1551  * within a small percentage of the original.
   1552  */
   1553 static int
   1554 png_colorspace_check_xy(png_XYZ *XYZ, const png_xy *xy)
   1555 {
   1556    int result;
   1557    png_xy xy_test;
   1558 
   1559    /* As a side-effect this routine also returns the XYZ endpoints. */
   1560    result = png_XYZ_from_xy(XYZ, xy);
   1561    if (result) return result;
   1562 
   1563    result = png_xy_from_XYZ(&xy_test, XYZ);
   1564    if (result) return result;
   1565 
   1566    if (png_colorspace_endpoints_match(xy, &xy_test,
   1567       5/*actually, the math is pretty accurate*/))
   1568       return 0;
   1569 
   1570    /* Too much slip */
   1571    return 1;
   1572 }
   1573 
   1574 /* This is the check going the other way.  The XYZ is modified to normalize it
   1575  * (another side-effect) and the xy chromaticities are returned.
   1576  */
   1577 static int
   1578 png_colorspace_check_XYZ(png_xy *xy, png_XYZ *XYZ)
   1579 {
   1580    int result;
   1581    png_XYZ XYZtemp;
   1582 
   1583    result = png_XYZ_normalize(XYZ);
   1584    if (result) return result;
   1585 
   1586    result = png_xy_from_XYZ(xy, XYZ);
   1587    if (result) return result;
   1588 
   1589    XYZtemp = *XYZ;
   1590    return png_colorspace_check_xy(&XYZtemp, xy);
   1591 }
   1592 
   1593 /* Used to check for an endpoint match against sRGB */
   1594 static const png_xy sRGB_xy = /* From ITU-R BT.709-3 */
   1595 {
   1596    /* color      x       y */
   1597    /* red   */ 64000, 33000,
   1598    /* green */ 30000, 60000,
   1599    /* blue  */ 15000,  6000,
   1600    /* white */ 31270, 32900
   1601 };
   1602 
   1603 static int
   1604 png_colorspace_set_xy_and_XYZ(png_const_structrp png_ptr,
   1605    png_colorspacerp colorspace, const png_xy *xy, const png_XYZ *XYZ,
   1606    int preferred)
   1607 {
   1608    if (colorspace->flags & PNG_COLORSPACE_INVALID)
   1609       return 0;
   1610 
   1611    /* The consistency check is performed on the chromaticities; this factors out
   1612     * variations because of the normalization (or not) of the end point Y
   1613     * values.
   1614     */
   1615    if (preferred < 2 && (colorspace->flags & PNG_COLORSPACE_HAVE_ENDPOINTS))
   1616    {
   1617       /* The end points must be reasonably close to any we already have.  The
   1618        * following allows an error of up to +/-.001
   1619        */
   1620       if (!png_colorspace_endpoints_match(xy, &colorspace->end_points_xy, 100))
   1621       {
   1622          colorspace->flags |= PNG_COLORSPACE_INVALID;
   1623          png_benign_error(png_ptr, "inconsistent chromaticities");
   1624          return 0; /* failed */
   1625       }
   1626 
   1627       /* Only overwrite with preferred values */
   1628       if (!preferred)
   1629          return 1; /* ok, but no change */
   1630    }
   1631 
   1632    colorspace->end_points_xy = *xy;
   1633    colorspace->end_points_XYZ = *XYZ;
   1634    colorspace->flags |= PNG_COLORSPACE_HAVE_ENDPOINTS;
   1635 
   1636    /* The end points are normally quoted to two decimal digits, so allow +/-0.01
   1637     * on this test.
   1638     */
   1639    if (png_colorspace_endpoints_match(xy, &sRGB_xy, 1000))
   1640       colorspace->flags |= PNG_COLORSPACE_ENDPOINTS_MATCH_sRGB;
   1641 
   1642    else
   1643       colorspace->flags &= PNG_COLORSPACE_CANCEL(
   1644          PNG_COLORSPACE_ENDPOINTS_MATCH_sRGB);
   1645 
   1646    return 2; /* ok and changed */
   1647 }
   1648 
   1649 int /* PRIVATE */
   1650 png_colorspace_set_chromaticities(png_const_structrp png_ptr,
   1651    png_colorspacerp colorspace, const png_xy *xy, int preferred)
   1652 {
   1653    /* We must check the end points to ensure they are reasonable - in the past
   1654     * color management systems have crashed as a result of getting bogus
   1655     * colorant values, while this isn't the fault of libpng it is the
   1656     * responsibility of libpng because PNG carries the bomb and libpng is in a
   1657     * position to protect against it.
   1658     */
   1659    png_XYZ XYZ;
   1660 
   1661    switch (png_colorspace_check_xy(&XYZ, xy))
   1662    {
   1663       case 0: /* success */
   1664          return png_colorspace_set_xy_and_XYZ(png_ptr, colorspace, xy, &XYZ,
   1665             preferred);
   1666 
   1667       case 1:
   1668          /* We can't invert the chromaticities so we can't produce value XYZ
   1669           * values.  Likely as not a color management system will fail too.
   1670           */
   1671          colorspace->flags |= PNG_COLORSPACE_INVALID;
   1672          png_benign_error(png_ptr, "invalid chromaticities");
   1673          break;
   1674 
   1675       default:
   1676          /* libpng is broken; this should be a warning but if it happens we
   1677           * want error reports so for the moment it is an error.
   1678           */
   1679          colorspace->flags |= PNG_COLORSPACE_INVALID;
   1680          png_error(png_ptr, "internal error checking chromaticities");
   1681          break;
   1682    }
   1683 
   1684    return 0; /* failed */
   1685 }
   1686 
   1687 int /* PRIVATE */
   1688 png_colorspace_set_endpoints(png_const_structrp png_ptr,
   1689    png_colorspacerp colorspace, const png_XYZ *XYZ_in, int preferred)
   1690 {
   1691    png_XYZ XYZ = *XYZ_in;
   1692    png_xy xy;
   1693 
   1694    switch (png_colorspace_check_XYZ(&xy, &XYZ))
   1695    {
   1696       case 0:
   1697          return png_colorspace_set_xy_and_XYZ(png_ptr, colorspace, &xy, &XYZ,
   1698             preferred);
   1699 
   1700       case 1:
   1701          /* End points are invalid. */
   1702          colorspace->flags |= PNG_COLORSPACE_INVALID;
   1703          png_benign_error(png_ptr, "invalid end points");
   1704          break;
   1705 
   1706       default:
   1707          colorspace->flags |= PNG_COLORSPACE_INVALID;
   1708          png_error(png_ptr, "internal error checking chromaticities");
   1709          break;
   1710    }
   1711 
   1712    return 0; /* failed */
   1713 }
   1714 
   1715 #if defined(PNG_sRGB_SUPPORTED) || defined(PNG_iCCP_SUPPORTED)
   1716 /* Error message generation */
   1717 static char
   1718 png_icc_tag_char(png_uint_32 byte)
   1719 {
   1720    byte &= 0xff;
   1721    if (byte >= 32 && byte <= 126)
   1722       return (char)byte;
   1723    else
   1724       return '?';
   1725 }
   1726 
   1727 static void
   1728 png_icc_tag_name(char *name, png_uint_32 tag)
   1729 {
   1730    name[0] = '\'';
   1731    name[1] = png_icc_tag_char(tag >> 24);
   1732    name[2] = png_icc_tag_char(tag >> 16);
   1733    name[3] = png_icc_tag_char(tag >>  8);
   1734    name[4] = png_icc_tag_char(tag      );
   1735    name[5] = '\'';
   1736 }
   1737 
   1738 static int
   1739 is_ICC_signature_char(png_alloc_size_t it)
   1740 {
   1741    return it == 32 || (it >= 48 && it <= 57) || (it >= 65 && it <= 90) ||
   1742       (it >= 97 && it <= 122);
   1743 }
   1744 
   1745 static int
   1746 is_ICC_signature(png_alloc_size_t it)
   1747 {
   1748    return is_ICC_signature_char(it >> 24) /* checks all the top bits */ &&
   1749       is_ICC_signature_char((it >> 16) & 0xff) &&
   1750       is_ICC_signature_char((it >> 8) & 0xff) &&
   1751       is_ICC_signature_char(it & 0xff);
   1752 }
   1753 
   1754 static int
   1755 png_icc_profile_error(png_const_structrp png_ptr, png_colorspacerp colorspace,
   1756    png_const_charp name, png_alloc_size_t value, png_const_charp reason)
   1757 {
   1758    size_t pos;
   1759    char message[196]; /* see below for calculation */
   1760 
   1761    if (colorspace != NULL)
   1762       colorspace->flags |= PNG_COLORSPACE_INVALID;
   1763 
   1764    pos = png_safecat(message, (sizeof message), 0, "profile '"); /* 9 chars */
   1765    pos = png_safecat(message, pos+79, pos, name); /* Truncate to 79 chars */
   1766    pos = png_safecat(message, (sizeof message), pos, "': "); /* +2 = 90 */
   1767    if (is_ICC_signature(value))
   1768    {
   1769       /* So 'value' is at most 4 bytes and the following cast is safe */
   1770       png_icc_tag_name(message+pos, (png_uint_32)value);
   1771       pos += 6; /* total +8; less than the else clause */
   1772       message[pos++] = ':';
   1773       message[pos++] = ' ';
   1774    }
   1775 #  ifdef PNG_WARNINGS_SUPPORTED
   1776    else
   1777       {
   1778          char number[PNG_NUMBER_BUFFER_SIZE]; /* +24 = 114*/
   1779 
   1780          pos = png_safecat(message, (sizeof message), pos,
   1781             png_format_number(number, number+(sizeof number),
   1782                PNG_NUMBER_FORMAT_x, value));
   1783          pos = png_safecat(message, (sizeof message), pos, "h: "); /*+2 = 116*/
   1784       }
   1785 #  endif
   1786    /* The 'reason' is an arbitrary message, allow +79 maximum 195 */
   1787    pos = png_safecat(message, (sizeof message), pos, reason);
   1788    PNG_UNUSED(pos)
   1789 
   1790    /* This is recoverable, but make it unconditionally an app_error on write to
   1791     * avoid writing invalid ICC profiles into PNG files.  (I.e.  we handle them
   1792     * on read, with a warning, but on write unless the app turns off
   1793     * application errors the PNG won't be written.)
   1794     */
   1795    png_chunk_report(png_ptr, message,
   1796       (colorspace != NULL) ? PNG_CHUNK_ERROR : PNG_CHUNK_WRITE_ERROR);
   1797 
   1798    return 0;
   1799 }
   1800 #endif /* sRGB || iCCP */
   1801 
   1802 #ifdef PNG_sRGB_SUPPORTED
   1803 int /* PRIVATE */
   1804 png_colorspace_set_sRGB(png_const_structrp png_ptr, png_colorspacerp colorspace,
   1805    int intent)
   1806 {
   1807    /* sRGB sets known gamma, end points and (from the chunk) intent. */
   1808    /* IMPORTANT: these are not necessarily the values found in an ICC profile
   1809     * because ICC profiles store values adapted to a D50 environment; it is
   1810     * expected that the ICC profile mediaWhitePointTag will be D50, see the
   1811     * checks and code elsewhere to understand this better.
   1812     *
   1813     * These XYZ values, which are accurate to 5dp, produce rgb to gray
   1814     * coefficients of (6968,23435,2366), which are reduced (because they add up
   1815     * to 32769 not 32768) to (6968,23434,2366).  These are the values that
   1816     * libpng has traditionally used (and are the best values given the 15bit
   1817     * algorithm used by the rgb to gray code.)
   1818     */
   1819    static const png_XYZ sRGB_XYZ = /* D65 XYZ (*not* the D50 adapted values!) */
   1820    {
   1821       /* color      X      Y      Z */
   1822       /* red   */ 41239, 21264,  1933,
   1823       /* green */ 35758, 71517, 11919,
   1824       /* blue  */ 18048,  7219, 95053
   1825    };
   1826 
   1827    /* Do nothing if the colorspace is already invalidated. */
   1828    if (colorspace->flags & PNG_COLORSPACE_INVALID)
   1829       return 0;
   1830 
   1831    /* Check the intent, then check for existing settings.  It is valid for the
   1832     * PNG file to have cHRM or gAMA chunks along with sRGB, but the values must
   1833     * be consistent with the correct values.  If, however, this function is
   1834     * called below because an iCCP chunk matches sRGB then it is quite
   1835     * conceivable that an older app recorded incorrect gAMA and cHRM because of
   1836     * an incorrect calculation based on the values in the profile - this does
   1837     * *not* invalidate the profile (though it still produces an error, which can
   1838     * be ignored.)
   1839     */
   1840    if (intent < 0 || intent >= PNG_sRGB_INTENT_LAST)
   1841       return png_icc_profile_error(png_ptr, colorspace, "sRGB",
   1842          (unsigned)intent, "invalid sRGB rendering intent");
   1843 
   1844    if ((colorspace->flags & PNG_COLORSPACE_HAVE_INTENT) != 0 &&
   1845       colorspace->rendering_intent != intent)
   1846       return png_icc_profile_error(png_ptr, colorspace, "sRGB",
   1847          (unsigned)intent, "inconsistent rendering intents");
   1848 
   1849    if ((colorspace->flags & PNG_COLORSPACE_FROM_sRGB) != 0)
   1850    {
   1851       png_benign_error(png_ptr, "duplicate sRGB information ignored");
   1852       return 0;
   1853    }
   1854 
   1855    /* If the standard sRGB cHRM chunk does not match the one from the PNG file
   1856     * warn but overwrite the value with the correct one.
   1857     */
   1858    if ((colorspace->flags & PNG_COLORSPACE_HAVE_ENDPOINTS) != 0 &&
   1859       !png_colorspace_endpoints_match(&sRGB_xy, &colorspace->end_points_xy,
   1860          100))
   1861       png_chunk_report(png_ptr, "cHRM chunk does not match sRGB",
   1862          PNG_CHUNK_ERROR);
   1863 
   1864    /* This check is just done for the error reporting - the routine always
   1865     * returns true when the 'from' argument corresponds to sRGB (2).
   1866     */
   1867    (void)png_colorspace_check_gamma(png_ptr, colorspace, PNG_GAMMA_sRGB_INVERSE,
   1868       2/*from sRGB*/);
   1869 
   1870    /* intent: bugs in GCC force 'int' to be used as the parameter type. */
   1871    colorspace->rendering_intent = (png_uint_16)intent;
   1872    colorspace->flags |= PNG_COLORSPACE_HAVE_INTENT;
   1873 
   1874    /* endpoints */
   1875    colorspace->end_points_xy = sRGB_xy;
   1876    colorspace->end_points_XYZ = sRGB_XYZ;
   1877    colorspace->flags |=
   1878       (PNG_COLORSPACE_HAVE_ENDPOINTS|PNG_COLORSPACE_ENDPOINTS_MATCH_sRGB);
   1879 
   1880    /* gamma */
   1881    colorspace->gamma = PNG_GAMMA_sRGB_INVERSE;
   1882    colorspace->flags |= PNG_COLORSPACE_HAVE_GAMMA;
   1883 
   1884    /* Finally record that we have an sRGB profile */
   1885    colorspace->flags |=
   1886       (PNG_COLORSPACE_MATCHES_sRGB|PNG_COLORSPACE_FROM_sRGB);
   1887 
   1888    return 1; /* set */
   1889 }
   1890 #endif /* sRGB */
   1891 
   1892 #ifdef PNG_iCCP_SUPPORTED
   1893 /* Encoded value of D50 as an ICC XYZNumber.  From the ICC 2010 spec the value
   1894  * is XYZ(0.9642,1.0,0.8249), which scales to:
   1895  *
   1896  *    (63189.8112, 65536, 54060.6464)
   1897  */
   1898 static const png_byte D50_nCIEXYZ[12] =
   1899    { 0x00, 0x00, 0xf6, 0xd6, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0xd3, 0x2d };
   1900 
   1901 int /* PRIVATE */
   1902 png_icc_check_length(png_const_structrp png_ptr, png_colorspacerp colorspace,
   1903    png_const_charp name, png_uint_32 profile_length)
   1904 {
   1905    if (profile_length < 132)
   1906       return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
   1907          "too short");
   1908 
   1909    if (profile_length & 3)
   1910       return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
   1911          "invalid length");
   1912 
   1913    return 1;
   1914 }
   1915 
   1916 int /* PRIVATE */
   1917 png_icc_check_header(png_const_structrp png_ptr, png_colorspacerp colorspace,
   1918    png_const_charp name, png_uint_32 profile_length,
   1919    png_const_bytep profile/* first 132 bytes only */, int color_type)
   1920 {
   1921    png_uint_32 temp;
   1922 
   1923    /* Length check; this cannot be ignored in this code because profile_length
   1924     * is used later to check the tag table, so even if the profile seems over
   1925     * long profile_length from the caller must be correct.  The caller can fix
   1926     * this up on read or write by just passing in the profile header length.
   1927     */
   1928    temp = png_get_uint_32(profile);
   1929    if (temp != profile_length)
   1930       return png_icc_profile_error(png_ptr, colorspace, name, temp,
   1931          "length does not match profile");
   1932 
   1933    temp = png_get_uint_32(profile+128); /* tag count: 12 bytes/tag */
   1934    if (temp > 357913930 || /* (2^32-4-132)/12: maximum possible tag count */
   1935       profile_length < 132+12*temp) /* truncated tag table */
   1936       return png_icc_profile_error(png_ptr, colorspace, name, temp,
   1937          "tag count too large");
   1938 
   1939    /* The 'intent' must be valid or we can't store it, ICC limits the intent to
   1940     * 16 bits.
   1941     */
   1942    temp = png_get_uint_32(profile+64);
   1943    if (temp >= 0xffff) /* The ICC limit */
   1944       return png_icc_profile_error(png_ptr, colorspace, name, temp,
   1945          "invalid rendering intent");
   1946 
   1947    /* This is just a warning because the profile may be valid in future
   1948     * versions.
   1949     */
   1950    if (temp >= PNG_sRGB_INTENT_LAST)
   1951       (void)png_icc_profile_error(png_ptr, NULL, name, temp,
   1952          "intent outside defined range");
   1953 
   1954    /* At this point the tag table can't be checked because it hasn't necessarily
   1955     * been loaded; however, various header fields can be checked.  These checks
   1956     * are for values permitted by the PNG spec in an ICC profile; the PNG spec
   1957     * restricts the profiles that can be passed in an iCCP chunk (they must be
   1958     * appropriate to processing PNG data!)
   1959     */
   1960 
   1961    /* Data checks (could be skipped).  These checks must be independent of the
   1962     * version number; however, the version number doesn't accomodate changes in
   1963     * the header fields (just the known tags and the interpretation of the
   1964     * data.)
   1965     */
   1966    temp = png_get_uint_32(profile+36); /* signature 'ascp' */
   1967    if (temp != 0x61637370)
   1968       return png_icc_profile_error(png_ptr, colorspace, name, temp,
   1969          "invalid signature");
   1970 
   1971    /* Currently the PCS illuminant/adopted white point (the computational
   1972     * white point) are required to be D50,
   1973     * however the profile contains a record of the illuminant so perhaps ICC
   1974     * expects to be able to change this in the future (despite the rationale in
   1975     * the introduction for using a fixed PCS adopted white.)  Consequently the
   1976     * following is just a warning.
   1977     */
   1978    if (memcmp(profile+68, D50_nCIEXYZ, 12) != 0)
   1979       (void)png_icc_profile_error(png_ptr, NULL, name, 0/*no tag value*/,
   1980          "PCS illuminant is not D50");
   1981 
   1982    /* The PNG spec requires this:
   1983     * "If the iCCP chunk is present, the image samples conform to the colour
   1984     * space represented by the embedded ICC profile as defined by the
   1985     * International Color Consortium [ICC]. The colour space of the ICC profile
   1986     * shall be an RGB colour space for colour images (PNG colour types 2, 3, and
   1987     * 6), or a greyscale colour space for greyscale images (PNG colour types 0
   1988     * and 4)."
   1989     *
   1990     * This checking code ensures the embedded profile (on either read or write)
   1991     * conforms to the specification requirements.  Notice that an ICC 'gray'
   1992     * color-space profile contains the information to transform the monochrome
   1993     * data to XYZ or L*a*b (according to which PCS the profile uses) and this
   1994     * should be used in preference to the standard libpng K channel replication
   1995     * into R, G and B channels.
   1996     *
   1997     * Previously it was suggested that an RGB profile on grayscale data could be
   1998     * handled.  However it it is clear that using an RGB profile in this context
   1999     * must be an error - there is no specification of what it means.  Thus it is
   2000     * almost certainly more correct to ignore the profile.
   2001     */
   2002    temp = png_get_uint_32(profile+16); /* data colour space field */
   2003    switch (temp)
   2004    {
   2005       case 0x52474220: /* 'RGB ' */
   2006          if (!(color_type & PNG_COLOR_MASK_COLOR))
   2007             return png_icc_profile_error(png_ptr, colorspace, name, temp,
   2008                "RGB color space not permitted on grayscale PNG");
   2009          break;
   2010 
   2011       case 0x47524159: /* 'GRAY' */
   2012          if (color_type & PNG_COLOR_MASK_COLOR)
   2013             return png_icc_profile_error(png_ptr, colorspace, name, temp,
   2014                "Gray color space not permitted on RGB PNG");
   2015          break;
   2016 
   2017       default:
   2018          return png_icc_profile_error(png_ptr, colorspace, name, temp,
   2019             "invalid ICC profile color space");
   2020    }
   2021 
   2022    /* It is up to the application to check that the profile class matches the
   2023     * application requirements; the spec provides no guidance, but it's pretty
   2024     * weird if the profile is not scanner ('scnr'), monitor ('mntr'), printer
   2025     * ('prtr') or 'spac' (for generic color spaces).  Issue a warning in these
   2026     * cases.  Issue an error for device link or abstract profiles - these don't
   2027     * contain the records necessary to transform the color-space to anything
   2028     * other than the target device (and not even that for an abstract profile).
   2029     * Profiles of these classes may not be embedded in images.
   2030     */
   2031    temp = png_get_uint_32(profile+12); /* profile/device class */
   2032    switch (temp)
   2033    {
   2034       case 0x73636E72: /* 'scnr' */
   2035       case 0x6D6E7472: /* 'mntr' */
   2036       case 0x70727472: /* 'prtr' */
   2037       case 0x73706163: /* 'spac' */
   2038          /* All supported */
   2039          break;
   2040 
   2041       case 0x61627374: /* 'abst' */
   2042          /* May not be embedded in an image */
   2043          return png_icc_profile_error(png_ptr, colorspace, name, temp,
   2044             "invalid embedded Abstract ICC profile");
   2045 
   2046       case 0x6C696E6B: /* 'link' */
   2047          /* DeviceLink profiles cannnot be interpreted in a non-device specific
   2048           * fashion, if an app uses the AToB0Tag in the profile the results are
   2049           * undefined unless the result is sent to the intended device,
   2050           * therefore a DeviceLink profile should not be found embedded in a
   2051           * PNG.
   2052           */
   2053          return png_icc_profile_error(png_ptr, colorspace, name, temp,
   2054             "unexpected DeviceLink ICC profile class");
   2055 
   2056       case 0x6E6D636C: /* 'nmcl' */
   2057          /* A NamedColor profile is also device specific, however it doesn't
   2058           * contain an AToB0 tag that is open to misintrepretation.  Almost
   2059           * certainly it will fail the tests below.
   2060           */
   2061          (void)png_icc_profile_error(png_ptr, NULL, name, temp,
   2062             "unexpected NamedColor ICC profile class");
   2063          break;
   2064 
   2065       default:
   2066          /* To allow for future enhancements to the profile accept unrecognized
   2067           * profile classes with a warning, these then hit the test below on the
   2068           * tag content to ensure they are backward compatible with one of the
   2069           * understood profiles.
   2070           */
   2071          (void)png_icc_profile_error(png_ptr, NULL, name, temp,
   2072             "unrecognized ICC profile class");
   2073          break;
   2074    }
   2075 
   2076    /* For any profile other than a device link one the PCS must be encoded
   2077     * either in XYZ or Lab.
   2078     */
   2079    temp = png_get_uint_32(profile+20);
   2080    switch (temp)
   2081    {
   2082       case 0x58595A20: /* 'XYZ ' */
   2083       case 0x4C616220: /* 'Lab ' */
   2084          break;
   2085 
   2086       default:
   2087          return png_icc_profile_error(png_ptr, colorspace, name, temp,
   2088             "unexpected ICC PCS encoding");
   2089    }
   2090 
   2091    return 1;
   2092 }
   2093 
   2094 int /* PRIVATE */
   2095 png_icc_check_tag_table(png_const_structrp png_ptr, png_colorspacerp colorspace,
   2096    png_const_charp name, png_uint_32 profile_length,
   2097    png_const_bytep profile /* header plus whole tag table */)
   2098 {
   2099    png_uint_32 tag_count = png_get_uint_32(profile+128);
   2100    png_uint_32 itag;
   2101    png_const_bytep tag = profile+132; /* The first tag */
   2102 
   2103    /* First scan all the tags in the table and add bits to the icc_info value
   2104     * (temporarily in 'tags').
   2105     */
   2106    for (itag=0; itag < tag_count; ++itag, tag += 12)
   2107    {
   2108       png_uint_32 tag_id = png_get_uint_32(tag+0);
   2109       png_uint_32 tag_start = png_get_uint_32(tag+4); /* must be aligned */
   2110       png_uint_32 tag_length = png_get_uint_32(tag+8);/* not padded */
   2111 
   2112       /* The ICC specification does not exclude zero length tags, therefore the
   2113        * start might actually be anywhere if there is no data, but this would be
   2114        * a clear abuse of the intent of the standard so the start is checked for
   2115        * being in range.  All defined tag types have an 8 byte header - a 4 byte
   2116        * type signature then 0.
   2117        */
   2118       if ((tag_start & 3) != 0)
   2119       {
   2120          /* CNHP730S.icc shipped with Microsoft Windows 64 violates this, it is
   2121           * only a warning here because libpng does not care about the
   2122           * alignment.
   2123           */
   2124          (void)png_icc_profile_error(png_ptr, NULL, name, tag_id,
   2125             "ICC profile tag start not a multiple of 4");
   2126       }
   2127 
   2128       /* This is a hard error; potentially it can cause read outside the
   2129        * profile.
   2130        */
   2131       if (tag_start > profile_length || tag_length > profile_length - tag_start)
   2132          return png_icc_profile_error(png_ptr, colorspace, name, tag_id,
   2133             "ICC profile tag outside profile");
   2134    }
   2135 
   2136    return 1; /* success, maybe with warnings */
   2137 }
   2138 
   2139 #ifdef PNG_sRGB_SUPPORTED
   2140 /* Information about the known ICC sRGB profiles */
   2141 static const struct
   2142 {
   2143    png_uint_32 adler, crc, length;
   2144    png_uint_32 md5[4];
   2145    png_byte    have_md5;
   2146    png_byte    is_broken;
   2147    png_uint_16 intent;
   2148 
   2149 #  define PNG_MD5(a,b,c,d) { a, b, c, d }, (a!=0)||(b!=0)||(c!=0)||(d!=0)
   2150 #  define PNG_ICC_CHECKSUM(adler, crc, md5, intent, broke, date, length, fname)\
   2151       { adler, crc, length, md5, broke, intent },
   2152 
   2153 } png_sRGB_checks[] =
   2154 {
   2155    /* This data comes from contrib/tools/checksum-icc run on downloads of
   2156     * all four ICC sRGB profiles from www.color.org.
   2157     */
   2158    /* adler32, crc32, MD5[4], intent, date, length, file-name */
   2159    PNG_ICC_CHECKSUM(0x0a3fd9f6, 0x3b8772b9,
   2160       PNG_MD5(0x29f83dde, 0xaff255ae, 0x7842fae4, 0xca83390d), 0, 0,
   2161       "2009/03/27 21:36:31", 3048, "sRGB_IEC61966-2-1_black_scaled.icc")
   2162 
   2163    /* ICC sRGB v2 perceptual no black-compensation: */
   2164    PNG_ICC_CHECKSUM(0x4909e5e1, 0x427ebb21,
   2165       PNG_MD5(0xc95bd637, 0xe95d8a3b, 0x0df38f99, 0xc1320389), 1, 0,
   2166       "2009/03/27 21:37:45", 3052, "sRGB_IEC61966-2-1_no_black_scaling.icc")
   2167 
   2168    PNG_ICC_CHECKSUM(0xfd2144a1, 0x306fd8ae,
   2169       PNG_MD5(0xfc663378, 0x37e2886b, 0xfd72e983, 0x8228f1b8), 0, 0,
   2170       "2009/08/10 17:28:01", 60988, "sRGB_v4_ICC_preference_displayclass.icc")
   2171 
   2172    /* ICC sRGB v4 perceptual */
   2173    PNG_ICC_CHECKSUM(0x209c35d2, 0xbbef7812,
   2174       PNG_MD5(0x34562abf, 0x994ccd06, 0x6d2c5721, 0xd0d68c5d), 0, 0,
   2175       "2007/07/25 00:05:37", 60960, "sRGB_v4_ICC_preference.icc")
   2176 
   2177    /* The following profiles have no known MD5 checksum. If there is a match
   2178     * on the (empty) MD5 the other fields are used to attempt a match and
   2179     * a warning is produced.  The first two of these profiles have a 'cprt' tag
   2180     * which suggests that they were also made by Hewlett Packard.
   2181     */
   2182    PNG_ICC_CHECKSUM(0xa054d762, 0x5d5129ce,
   2183       PNG_MD5(0x00000000, 0x00000000, 0x00000000, 0x00000000), 1, 0,
   2184       "2004/07/21 18:57:42", 3024, "sRGB_IEC61966-2-1_noBPC.icc")
   2185 
   2186    /* This is a 'mntr' (display) profile with a mediaWhitePointTag that does not
   2187     * match the D50 PCS illuminant in the header (it is in fact the D65 values,
   2188     * so the white point is recorded as the un-adapted value.)  The profiles
   2189     * below only differ in one byte - the intent - and are basically the same as
   2190     * the previous profile except for the mediaWhitePointTag error and a missing
   2191     * chromaticAdaptationTag.
   2192     */
   2193    PNG_ICC_CHECKSUM(0xf784f3fb, 0x182ea552,
   2194       PNG_MD5(0x00000000, 0x00000000, 0x00000000, 0x00000000), 0, 1/*broken*/,
   2195       "1998/02/09 06:49:00", 3144, "HP-Microsoft sRGB v2 perceptual")
   2196 
   2197    PNG_ICC_CHECKSUM(0x0398f3fc, 0xf29e526d,
   2198       PNG_MD5(0x00000000, 0x00000000, 0x00000000, 0x00000000), 1, 1/*broken*/,
   2199       "1998/02/09 06:49:00", 3144, "HP-Microsoft sRGB v2 media-relative")
   2200 };
   2201 
   2202 static int
   2203 png_compare_ICC_profile_with_sRGB(png_const_structrp png_ptr,
   2204    png_const_bytep profile, uLong adler)
   2205 {
   2206    /* The quick check is to verify just the MD5 signature and trust the
   2207     * rest of the data.  Because the profile has already been verified for
   2208     * correctness this is safe.  png_colorspace_set_sRGB will check the 'intent'
   2209     * field too, so if the profile has been edited with an intent not defined
   2210     * by sRGB (but maybe defined by a later ICC specification) the read of
   2211     * the profile will fail at that point.
   2212     */
   2213    png_uint_32 length = 0;
   2214    png_uint_32 intent = 0x10000; /* invalid */
   2215 #if PNG_sRGB_PROFILE_CHECKS > 1
   2216    uLong crc = 0; /* the value for 0 length data */
   2217 #endif
   2218    unsigned int i;
   2219 
   2220    for (i=0; i < (sizeof png_sRGB_checks) / (sizeof png_sRGB_checks[0]); ++i)
   2221    {
   2222       if (png_get_uint_32(profile+84) == png_sRGB_checks[i].md5[0] &&
   2223          png_get_uint_32(profile+88) == png_sRGB_checks[i].md5[1] &&
   2224          png_get_uint_32(profile+92) == png_sRGB_checks[i].md5[2] &&
   2225          png_get_uint_32(profile+96) == png_sRGB_checks[i].md5[3])
   2226       {
   2227          /* This may be one of the old HP profiles without an MD5, in that
   2228           * case we can only use the length and Adler32 (note that these
   2229           * are not used by default if there is an MD5!)
   2230           */
   2231 #        if PNG_sRGB_PROFILE_CHECKS == 0
   2232             if (png_sRGB_checks[i].have_md5)
   2233                return 1+png_sRGB_checks[i].is_broken;
   2234 #        endif
   2235 
   2236          /* Profile is unsigned or more checks have been configured in. */
   2237          if (length == 0)
   2238          {
   2239             length = png_get_uint_32(profile);
   2240             intent = png_get_uint_32(profile+64);
   2241          }
   2242 
   2243          /* Length *and* intent must match */
   2244          if (length == png_sRGB_checks[i].length &&
   2245             intent == png_sRGB_checks[i].intent)
   2246          {
   2247             /* Now calculate the adler32 if not done already. */
   2248             if (adler == 0)
   2249             {
   2250                adler = adler32(0, NULL, 0);
   2251                adler = adler32(adler, profile, length);
   2252             }
   2253 
   2254             if (adler == png_sRGB_checks[i].adler)
   2255             {
   2256                /* These basic checks suggest that the data has not been
   2257                 * modified, but if the check level is more than 1 perform
   2258                 * our own crc32 checksum on the data.
   2259                 */
   2260 #              if PNG_sRGB_PROFILE_CHECKS > 1
   2261                   if (crc == 0)
   2262                   {
   2263                      crc = crc32(0, NULL, 0);
   2264                      crc = crc32(crc, profile, length);
   2265                   }
   2266 
   2267                   /* So this check must pass for the 'return' below to happen.
   2268                    */
   2269                   if (crc == png_sRGB_checks[i].crc)
   2270 #              endif
   2271                {
   2272                   if (png_sRGB_checks[i].is_broken)
   2273                   {
   2274                      /* These profiles are known to have bad data that may cause
   2275                       * problems if they are used, therefore attempt to
   2276                       * discourage their use, skip the 'have_md5' warning below,
   2277                       * which is made irrelevant by this error.
   2278                       */
   2279                      png_chunk_report(png_ptr, "known incorrect sRGB profile",
   2280                         PNG_CHUNK_ERROR);
   2281                   }
   2282 
   2283                   /* Warn that this being done; this isn't even an error since
   2284                    * the profile is perfectly valid, but it would be nice if
   2285                    * people used the up-to-date ones.
   2286                    */
   2287                   else if (!png_sRGB_checks[i].have_md5)
   2288                   {
   2289                      png_chunk_report(png_ptr,
   2290                         "out-of-date sRGB profile with no signature",
   2291                         PNG_CHUNK_WARNING);
   2292                   }
   2293 
   2294                   return 1+png_sRGB_checks[i].is_broken;
   2295                }
   2296             }
   2297          }
   2298 
   2299 # if PNG_sRGB_PROFILE_CHECKS > 0
   2300          /* The signature matched, but the profile had been changed in some
   2301           * way.  This probably indicates a data error or uninformed hacking.
   2302           * Fall through to "no match".
   2303           */
   2304          png_chunk_report(png_ptr,
   2305              "Not recognizing known sRGB profile that has been edited",
   2306              PNG_CHUNK_WARNING);
   2307          break;
   2308 # endif
   2309       }
   2310    }
   2311 
   2312    return 0; /* no match */
   2313 }
   2314 #endif
   2315 
   2316 #ifdef PNG_sRGB_SUPPORTED
   2317 void /* PRIVATE */
   2318 png_icc_set_sRGB(png_const_structrp png_ptr,
   2319    png_colorspacerp colorspace, png_const_bytep profile, uLong adler)
   2320 {
   2321    /* Is this profile one of the known ICC sRGB profiles?  If it is, just set
   2322     * the sRGB information.
   2323     */
   2324    if (png_compare_ICC_profile_with_sRGB(png_ptr, profile, adler))
   2325       (void)png_colorspace_set_sRGB(png_ptr, colorspace,
   2326          (int)/*already checked*/png_get_uint_32(profile+64));
   2327 }
   2328 #endif /* PNG_READ_sRGB_SUPPORTED */
   2329 
   2330 int /* PRIVATE */
   2331 png_colorspace_set_ICC(png_const_structrp png_ptr, png_colorspacerp colorspace,
   2332    png_const_charp name, png_uint_32 profile_length, png_const_bytep profile,
   2333    int color_type)
   2334 {
   2335    if (colorspace->flags & PNG_COLORSPACE_INVALID)
   2336       return 0;
   2337 
   2338    if (png_icc_check_length(png_ptr, colorspace, name, profile_length) &&
   2339       png_icc_check_header(png_ptr, colorspace, name, profile_length, profile,
   2340          color_type) &&
   2341       png_icc_check_tag_table(png_ptr, colorspace, name, profile_length,
   2342          profile))
   2343    {
   2344 #     ifdef PNG_sRGB_SUPPORTED
   2345          /* If no sRGB support, don't try storing sRGB information */
   2346          png_icc_set_sRGB(png_ptr, colorspace, profile, 0);
   2347 #     endif
   2348       return 1;
   2349    }
   2350 
   2351    /* Failure case */
   2352    return 0;
   2353 }
   2354 #endif /* iCCP */
   2355 
   2356 #ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED
   2357 void /* PRIVATE */
   2358 png_colorspace_set_rgb_coefficients(png_structrp png_ptr)
   2359 {
   2360    /* Set the rgb_to_gray coefficients from the colorspace. */
   2361    if (!png_ptr->rgb_to_gray_coefficients_set &&
   2362       (png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_ENDPOINTS) != 0)
   2363    {
   2364       /* png_set_background has not been called, get the coefficients from the Y
   2365        * values of the colorspace colorants.
   2366        */
   2367       png_fixed_point r = png_ptr->colorspace.end_points_XYZ.red_Y;
   2368       png_fixed_point g = png_ptr->colorspace.end_points_XYZ.green_Y;
   2369       png_fixed_point b = png_ptr->colorspace.end_points_XYZ.blue_Y;
   2370       png_fixed_point total = r+g+b;
   2371 
   2372       if (total > 0 &&
   2373          r >= 0 && png_muldiv(&r, r, 32768, total) && r >= 0 && r <= 32768 &&
   2374          g >= 0 && png_muldiv(&g, g, 32768, total) && g >= 0 && g <= 32768 &&
   2375          b >= 0 && png_muldiv(&b, b, 32768, total) && b >= 0 && b <= 32768 &&
   2376          r+g+b <= 32769)
   2377       {
   2378          /* We allow 0 coefficients here.  r+g+b may be 32769 if two or
   2379           * all of the coefficients were rounded up.  Handle this by
   2380           * reducing the *largest* coefficient by 1; this matches the
   2381           * approach used for the default coefficients in pngrtran.c
   2382           */
   2383          int add = 0;
   2384 
   2385          if (r+g+b > 32768)
   2386             add = -1;
   2387          else if (r+g+b < 32768)
   2388             add = 1;
   2389 
   2390          if (add != 0)
   2391          {
   2392             if (g >= r && g >= b)
   2393                g += add;
   2394             else if (r >= g && r >= b)
   2395                r += add;
   2396             else
   2397                b += add;
   2398          }
   2399 
   2400          /* Check for an internal error. */
   2401          if (r+g+b != 32768)
   2402             png_error(png_ptr,
   2403                "internal error handling cHRM coefficients");
   2404 
   2405          else
   2406          {
   2407             png_ptr->rgb_to_gray_red_coeff   = (png_uint_16)r;
   2408             png_ptr->rgb_to_gray_green_coeff = (png_uint_16)g;
   2409          }
   2410       }
   2411 
   2412       /* This is a png_error at present even though it could be ignored -
   2413        * it should never happen, but it is important that if it does, the
   2414        * bug is fixed.
   2415        */
   2416       else
   2417          png_error(png_ptr, "internal error handling cHRM->XYZ");
   2418    }
   2419 }
   2420 #endif
   2421 
   2422 #endif /* COLORSPACE */
   2423 
   2424 void /* PRIVATE */
   2425 png_check_IHDR(png_const_structrp png_ptr,
   2426    png_uint_32 width, png_uint_32 height, int bit_depth,
   2427    int color_type, int interlace_type, int compression_type,
   2428    int filter_type)
   2429 {
   2430    int error = 0;
   2431 
   2432    /* Check for width and height valid values */
   2433    if (width == 0)
   2434    {
   2435       png_warning(png_ptr, "Image width is zero in IHDR");
   2436       error = 1;
   2437    }
   2438 
   2439    if (height == 0)
   2440    {
   2441       png_warning(png_ptr, "Image height is zero in IHDR");
   2442       error = 1;
   2443    }
   2444 
   2445 #  ifdef PNG_SET_USER_LIMITS_SUPPORTED
   2446    if (width > png_ptr->user_width_max)
   2447 
   2448 #  else
   2449    if (width > PNG_USER_WIDTH_MAX)
   2450 #  endif
   2451    {
   2452       png_warning(png_ptr, "Image width exceeds user limit in IHDR");
   2453       error = 1;
   2454    }
   2455 
   2456 #  ifdef PNG_SET_USER_LIMITS_SUPPORTED
   2457    if (height > png_ptr->user_height_max)
   2458 #  else
   2459    if (height > PNG_USER_HEIGHT_MAX)
   2460 #  endif
   2461    {
   2462       png_warning(png_ptr, "Image height exceeds user limit in IHDR");
   2463       error = 1;
   2464    }
   2465 
   2466    if (width > PNG_UINT_31_MAX)
   2467    {
   2468       png_warning(png_ptr, "Invalid image width in IHDR");
   2469       error = 1;
   2470    }
   2471 
   2472    if (height > PNG_UINT_31_MAX)
   2473    {
   2474       png_warning(png_ptr, "Invalid image height in IHDR");
   2475       error = 1;
   2476    }
   2477 
   2478    /* Check other values */
   2479    if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 &&
   2480        bit_depth != 8 && bit_depth != 16)
   2481    {
   2482       png_warning(png_ptr, "Invalid bit depth in IHDR");
   2483       error = 1;
   2484    }
   2485 
   2486    if (color_type < 0 || color_type == 1 ||
   2487        color_type == 5 || color_type > 6)
   2488    {
   2489       png_warning(png_ptr, "Invalid color type in IHDR");
   2490       error = 1;
   2491    }
   2492 
   2493    if (((color_type == PNG_COLOR_TYPE_PALETTE) && bit_depth > 8) ||
   2494        ((color_type == PNG_COLOR_TYPE_RGB ||
   2495          color_type == PNG_COLOR_TYPE_GRAY_ALPHA ||
   2496          color_type == PNG_COLOR_TYPE_RGB_ALPHA) && bit_depth < 8))
   2497    {
   2498       png_warning(png_ptr, "Invalid color type/bit depth combination in IHDR");
   2499       error = 1;
   2500    }
   2501 
   2502    if (interlace_type >= PNG_INTERLACE_LAST)
   2503    {
   2504       png_warning(png_ptr, "Unknown interlace method in IHDR");
   2505       error = 1;
   2506    }
   2507 
   2508    if (compression_type != PNG_COMPRESSION_TYPE_BASE)
   2509    {
   2510       png_warning(png_ptr, "Unknown compression method in IHDR");
   2511       error = 1;
   2512    }
   2513 
   2514 #  ifdef PNG_MNG_FEATURES_SUPPORTED
   2515    /* Accept filter_method 64 (intrapixel differencing) only if
   2516     * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
   2517     * 2. Libpng did not read a PNG signature (this filter_method is only
   2518     *    used in PNG datastreams that are embedded in MNG datastreams) and
   2519     * 3. The application called png_permit_mng_features with a mask that
   2520     *    included PNG_FLAG_MNG_FILTER_64 and
   2521     * 4. The filter_method is 64 and
   2522     * 5. The color_type is RGB or RGBA
   2523     */
   2524    if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) &&
   2525        png_ptr->mng_features_permitted)
   2526       png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
   2527 
   2528    if (filter_type != PNG_FILTER_TYPE_BASE)
   2529    {
   2530       if (!((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
   2531           (filter_type == PNG_INTRAPIXEL_DIFFERENCING) &&
   2532           ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) == 0) &&
   2533           (color_type == PNG_COLOR_TYPE_RGB ||
   2534           color_type == PNG_COLOR_TYPE_RGB_ALPHA)))
   2535       {
   2536          png_warning(png_ptr, "Unknown filter method in IHDR");
   2537          error = 1;
   2538       }
   2539 
   2540       if (png_ptr->mode & PNG_HAVE_PNG_SIGNATURE)
   2541       {
   2542          png_warning(png_ptr, "Invalid filter method in IHDR");
   2543          error = 1;
   2544       }
   2545    }
   2546 
   2547 #  else
   2548    if (filter_type != PNG_FILTER_TYPE_BASE)
   2549    {
   2550       png_warning(png_ptr, "Unknown filter method in IHDR");
   2551       error = 1;
   2552    }
   2553 #  endif
   2554 
   2555    if (error == 1)
   2556       png_error(png_ptr, "Invalid IHDR data");
   2557 }
   2558 
   2559 #if defined(PNG_sCAL_SUPPORTED) || defined(PNG_pCAL_SUPPORTED)
   2560 /* ASCII to fp functions */
   2561 /* Check an ASCII formated floating point value, see the more detailed
   2562  * comments in pngpriv.h
   2563  */
   2564 /* The following is used internally to preserve the sticky flags */
   2565 #define png_fp_add(state, flags) ((state) |= (flags))
   2566 #define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY))
   2567 
   2568 int /* PRIVATE */
   2569 png_check_fp_number(png_const_charp string, png_size_t size, int *statep,
   2570    png_size_tp whereami)
   2571 {
   2572    int state = *statep;
   2573    png_size_t i = *whereami;
   2574 
   2575    while (i < size)
   2576    {
   2577       int type;
   2578       /* First find the type of the next character */
   2579       switch (string[i])
   2580       {
   2581       case 43:  type = PNG_FP_SAW_SIGN;                   break;
   2582       case 45:  type = PNG_FP_SAW_SIGN + PNG_FP_NEGATIVE; break;
   2583       case 46:  type = PNG_FP_SAW_DOT;                    break;
   2584       case 48:  type = PNG_FP_SAW_DIGIT;                  break;
   2585       case 49: case 50: case 51: case 52:
   2586       case 53: case 54: case 55: case 56:
   2587       case 57:  type = PNG_FP_SAW_DIGIT + PNG_FP_NONZERO; break;
   2588       case 69:
   2589       case 101: type = PNG_FP_SAW_E;                      break;
   2590       default:  goto PNG_FP_End;
   2591       }
   2592 
   2593       /* Now deal with this type according to the current
   2594        * state, the type is arranged to not overlap the
   2595        * bits of the PNG_FP_STATE.
   2596        */
   2597       switch ((state & PNG_FP_STATE) + (type & PNG_FP_SAW_ANY))
   2598       {
   2599       case PNG_FP_INTEGER + PNG_FP_SAW_SIGN:
   2600          if (state & PNG_FP_SAW_ANY)
   2601             goto PNG_FP_End; /* not a part of the number */
   2602 
   2603          png_fp_add(state, type);
   2604          break;
   2605 
   2606       case PNG_FP_INTEGER + PNG_FP_SAW_DOT:
   2607          /* Ok as trailer, ok as lead of fraction. */
   2608          if (state & PNG_FP_SAW_DOT) /* two dots */
   2609             goto PNG_FP_End;
   2610 
   2611          else if (state & PNG_FP_SAW_DIGIT) /* trailing dot? */
   2612             png_fp_add(state, type);
   2613 
   2614          else
   2615             png_fp_set(state, PNG_FP_FRACTION | type);
   2616 
   2617          break;
   2618 
   2619       case PNG_FP_INTEGER + PNG_FP_SAW_DIGIT:
   2620          if (state & PNG_FP_SAW_DOT) /* delayed fraction */
   2621             png_fp_set(state, PNG_FP_FRACTION | PNG_FP_SAW_DOT);
   2622 
   2623          png_fp_add(state, type | PNG_FP_WAS_VALID);
   2624 
   2625          break;
   2626 
   2627       case PNG_FP_INTEGER + PNG_FP_SAW_E:
   2628          if ((state & PNG_FP_SAW_DIGIT) == 0)
   2629             goto PNG_FP_End;
   2630 
   2631          png_fp_set(state, PNG_FP_EXPONENT);
   2632 
   2633          break;
   2634 
   2635    /* case PNG_FP_FRACTION + PNG_FP_SAW_SIGN:
   2636          goto PNG_FP_End; ** no sign in fraction */
   2637 
   2638    /* case PNG_FP_FRACTION + PNG_FP_SAW_DOT:
   2639          goto PNG_FP_End; ** Because SAW_DOT is always set */
   2640 
   2641       case PNG_FP_FRACTION + PNG_FP_SAW_DIGIT:
   2642          png_fp_add(state, type | PNG_FP_WAS_VALID);
   2643          break;
   2644 
   2645       case PNG_FP_FRACTION + PNG_FP_SAW_E:
   2646          /* This is correct because the trailing '.' on an
   2647           * integer is handled above - so we can only get here
   2648           * with the sequence ".E" (with no preceding digits).
   2649           */
   2650          if ((state & PNG_FP_SAW_DIGIT) == 0)
   2651             goto PNG_FP_End;
   2652 
   2653          png_fp_set(state, PNG_FP_EXPONENT);
   2654 
   2655          break;
   2656 
   2657       case PNG_FP_EXPONENT + PNG_FP_SAW_SIGN:
   2658          if (state & PNG_FP_SAW_ANY)
   2659             goto PNG_FP_End; /* not a part of the number */
   2660 
   2661          png_fp_add(state, PNG_FP_SAW_SIGN);
   2662 
   2663          break;
   2664 
   2665    /* case PNG_FP_EXPONENT + PNG_FP_SAW_DOT:
   2666          goto PNG_FP_End; */
   2667 
   2668       case PNG_FP_EXPONENT + PNG_FP_SAW_DIGIT:
   2669          png_fp_add(state, PNG_FP_SAW_DIGIT | PNG_FP_WAS_VALID);
   2670 
   2671          break;
   2672 
   2673    /* case PNG_FP_EXPONEXT + PNG_FP_SAW_E:
   2674          goto PNG_FP_End; */
   2675 
   2676       default: goto PNG_FP_End; /* I.e. break 2 */
   2677       }
   2678 
   2679       /* The character seems ok, continue. */
   2680       ++i;
   2681    }
   2682 
   2683 PNG_FP_End:
   2684    /* Here at the end, update the state and return the correct
   2685     * return code.
   2686     */
   2687    *statep = state;
   2688    *whereami = i;
   2689 
   2690    return (state & PNG_FP_SAW_DIGIT) != 0;
   2691 }
   2692 
   2693 
   2694 /* The same but for a complete string. */
   2695 int
   2696 png_check_fp_string(png_const_charp string, png_size_t size)
   2697 {
   2698    int        state=0;
   2699    png_size_t char_index=0;
   2700 
   2701    if (png_check_fp_number(string, size, &state, &char_index) &&
   2702       (char_index == size || string[char_index] == 0))
   2703       return state /* must be non-zero - see above */;
   2704 
   2705    return 0; /* i.e. fail */
   2706 }
   2707 #endif /* pCAL or sCAL */
   2708 
   2709 #ifdef PNG_sCAL_SUPPORTED
   2710 #  ifdef PNG_FLOATING_POINT_SUPPORTED
   2711 /* Utility used below - a simple accurate power of ten from an integral
   2712  * exponent.
   2713  */
   2714 static double
   2715 png_pow10(int power)
   2716 {
   2717    int recip = 0;
   2718    double d = 1;
   2719 
   2720    /* Handle negative exponent with a reciprocal at the end because
   2721     * 10 is exact whereas .1 is inexact in base 2
   2722     */
   2723    if (power < 0)
   2724    {
   2725       if (power < DBL_MIN_10_EXP) return 0;
   2726       recip = 1, power = -power;
   2727    }
   2728 
   2729    if (power > 0)
   2730    {
   2731       /* Decompose power bitwise. */
   2732       double mult = 10;
   2733       do
   2734       {
   2735          if (power & 1) d *= mult;
   2736          mult *= mult;
   2737          power >>= 1;
   2738       }
   2739       while (power > 0);
   2740 
   2741       if (recip) d = 1/d;
   2742    }
   2743    /* else power is 0 and d is 1 */
   2744 
   2745    return d;
   2746 }
   2747 
   2748 /* Function to format a floating point value in ASCII with a given
   2749  * precision.
   2750  */
   2751 void /* PRIVATE */
   2752 png_ascii_from_fp(png_const_structrp png_ptr, png_charp ascii, png_size_t size,
   2753     double fp, unsigned int precision)
   2754 {
   2755    /* We use standard functions from math.h, but not printf because
   2756     * that would require stdio.  The caller must supply a buffer of
   2757     * sufficient size or we will png_error.  The tests on size and
   2758     * the space in ascii[] consumed are indicated below.
   2759     */
   2760    if (precision < 1)
   2761       precision = DBL_DIG;
   2762 
   2763    /* Enforce the limit of the implementation precision too. */
   2764    if (precision > DBL_DIG+1)
   2765       precision = DBL_DIG+1;
   2766 
   2767    /* Basic sanity checks */
   2768    if (size >= precision+5) /* See the requirements below. */
   2769    {
   2770       if (fp < 0)
   2771       {
   2772          fp = -fp;
   2773          *ascii++ = 45; /* '-'  PLUS 1 TOTAL 1 */
   2774          --size;
   2775       }
   2776 
   2777       if (fp >= DBL_MIN && fp <= DBL_MAX)
   2778       {
   2779          int exp_b10;       /* A base 10 exponent */
   2780          double base;   /* 10^exp_b10 */
   2781 
   2782          /* First extract a base 10 exponent of the number,
   2783           * the calculation below rounds down when converting
   2784           * from base 2 to base 10 (multiply by log10(2) -
   2785           * 0.3010, but 77/256 is 0.3008, so exp_b10 needs to
   2786           * be increased.  Note that the arithmetic shift
   2787           * performs a floor() unlike C arithmetic - using a
   2788           * C multiply would break the following for negative
   2789           * exponents.
   2790           */
   2791          (void)frexp(fp, &exp_b10); /* exponent to base 2 */
   2792 
   2793          exp_b10 = (exp_b10 * 77) >> 8; /* <= exponent to base 10 */
   2794 
   2795          /* Avoid underflow here. */
   2796          base = png_pow10(exp_b10); /* May underflow */
   2797 
   2798          while (base < DBL_MIN || base < fp)
   2799          {
   2800             /* And this may overflow. */
   2801             double test = png_pow10(exp_b10+1);
   2802 
   2803             if (test <= DBL_MAX)
   2804                ++exp_b10, base = test;
   2805 
   2806             else
   2807                break;
   2808          }
   2809 
   2810          /* Normalize fp and correct exp_b10, after this fp is in the
   2811           * range [.1,1) and exp_b10 is both the exponent and the digit
   2812           * *before* which the decimal point should be inserted
   2813           * (starting with 0 for the first digit).  Note that this
   2814           * works even if 10^exp_b10 is out of range because of the
   2815           * test on DBL_MAX above.
   2816           */
   2817          fp /= base;
   2818          while (fp >= 1) fp /= 10, ++exp_b10;
   2819 
   2820          /* Because of the code above fp may, at this point, be
   2821           * less than .1, this is ok because the code below can
   2822           * handle the leading zeros this generates, so no attempt
   2823           * is made to correct that here.
   2824           */
   2825 
   2826          {
   2827             int czero, clead, cdigits;
   2828             char exponent[10];
   2829 
   2830             /* Allow up to two leading zeros - this will not lengthen
   2831              * the number compared to using E-n.
   2832              */
   2833             if (exp_b10 < 0 && exp_b10 > -3) /* PLUS 3 TOTAL 4 */
   2834             {
   2835                czero = -exp_b10; /* PLUS 2 digits: TOTAL 3 */
   2836                exp_b10 = 0;      /* Dot added below before first output. */
   2837             }
   2838             else
   2839                czero = 0;    /* No zeros to add */
   2840 
   2841             /* Generate the digit list, stripping trailing zeros and
   2842              * inserting a '.' before a digit if the exponent is 0.
   2843              */
   2844             clead = czero; /* Count of leading zeros */
   2845             cdigits = 0;   /* Count of digits in list. */
   2846 
   2847             do
   2848             {
   2849                double d;
   2850 
   2851                fp *= 10;
   2852                /* Use modf here, not floor and subtract, so that
   2853                 * the separation is done in one step.  At the end
   2854                 * of the loop don't break the number into parts so
   2855                 * that the final digit is rounded.
   2856                 */
   2857                if (cdigits+czero-clead+1 < (int)precision)
   2858                   fp = modf(fp, &d);
   2859 
   2860                else
   2861                {
   2862                   d = floor(fp + .5);
   2863 
   2864                   if (d > 9)
   2865                   {
   2866                      /* Rounding up to 10, handle that here. */
   2867                      if (czero > 0)
   2868                      {
   2869                         --czero, d = 1;
   2870                         if (cdigits == 0) --clead;
   2871                      }
   2872                      else
   2873                      {
   2874                         while (cdigits > 0 && d > 9)
   2875                         {
   2876                            int ch = *--ascii;
   2877 
   2878                            if (exp_b10 != (-1))
   2879                               ++exp_b10;
   2880 
   2881                            else if (ch == 46)
   2882                            {
   2883                               ch = *--ascii, ++size;
   2884                               /* Advance exp_b10 to '1', so that the
   2885                                * decimal point happens after the
   2886                                * previous digit.
   2887                                */
   2888                               exp_b10 = 1;
   2889                            }
   2890 
   2891                            --cdigits;
   2892                            d = ch - 47;  /* I.e. 1+(ch-48) */
   2893                         }
   2894 
   2895                         /* Did we reach the beginning? If so adjust the
   2896                          * exponent but take into account the leading
   2897                          * decimal point.
   2898                          */
   2899                         if (d > 9)  /* cdigits == 0 */
   2900                         {
   2901                            if (exp_b10 == (-1))
   2902                            {
   2903                               /* Leading decimal point (plus zeros?), if
   2904                                * we lose the decimal point here it must
   2905                                * be reentered below.
   2906                                */
   2907                               int ch = *--ascii;
   2908 
   2909                               if (ch == 46)
   2910                                  ++size, exp_b10 = 1;
   2911 
   2912                               /* Else lost a leading zero, so 'exp_b10' is
   2913                                * still ok at (-1)
   2914                                */
   2915                            }
   2916                            else
   2917                               ++exp_b10;
   2918 
   2919                            /* In all cases we output a '1' */
   2920                            d = 1;
   2921                         }
   2922                      }
   2923                   }
   2924                   fp = 0; /* Guarantees termination below. */
   2925                }
   2926 
   2927                if (d == 0)
   2928                {
   2929                   ++czero;
   2930                   if (cdigits == 0) ++clead;
   2931                }
   2932                else
   2933                {
   2934                   /* Included embedded zeros in the digit count. */
   2935                   cdigits += czero - clead;
   2936                   clead = 0;
   2937 
   2938                   while (czero > 0)
   2939                   {
   2940                      /* exp_b10 == (-1) means we just output the decimal
   2941                       * place - after the DP don't adjust 'exp_b10' any
   2942                       * more!
   2943                       */
   2944                      if (exp_b10 != (-1))
   2945                      {
   2946                         if (exp_b10 == 0) *ascii++ = 46, --size;
   2947                         /* PLUS 1: TOTAL 4 */
   2948                         --exp_b10;
   2949                      }
   2950                      *ascii++ = 48, --czero;
   2951                   }
   2952 
   2953                   if (exp_b10 != (-1))
   2954                   {
   2955                      if (exp_b10 == 0) *ascii++ = 46, --size; /* counted
   2956                                                                  above */
   2957                      --exp_b10;
   2958                   }
   2959                   *ascii++ = (char)(48 + (int)d), ++cdigits;
   2960                }
   2961             }
   2962             while (cdigits+czero-clead < (int)precision && fp > DBL_MIN);
   2963 
   2964             /* The total output count (max) is now 4+precision */
   2965 
   2966             /* Check for an exponent, if we don't need one we are
   2967              * done and just need to terminate the string.  At
   2968              * this point exp_b10==(-1) is effectively if flag - it got
   2969              * to '-1' because of the decrement after outputing
   2970              * the decimal point above (the exponent required is
   2971              * *not* -1!)
   2972              */
   2973             if (exp_b10 >= (-1) && exp_b10 <= 2)
   2974             {
   2975                /* The following only happens if we didn't output the
   2976                 * leading zeros above for negative exponent, so this
   2977                 * doest add to the digit requirement.  Note that the
   2978                 * two zeros here can only be output if the two leading
   2979                 * zeros were *not* output, so this doesn't increase
   2980                 * the output count.
   2981                 */
   2982                while (--exp_b10 >= 0) *ascii++ = 48;
   2983 
   2984                *ascii = 0;
   2985 
   2986                /* Total buffer requirement (including the '\0') is
   2987                 * 5+precision - see check at the start.
   2988                 */
   2989                return;
   2990             }
   2991 
   2992             /* Here if an exponent is required, adjust size for
   2993              * the digits we output but did not count.  The total
   2994              * digit output here so far is at most 1+precision - no
   2995              * decimal point and no leading or trailing zeros have
   2996              * been output.
   2997              */
   2998             size -= cdigits;
   2999 
   3000             *ascii++ = 69, --size;    /* 'E': PLUS 1 TOTAL 2+precision */
   3001 
   3002             /* The following use of an unsigned temporary avoids ambiguities in
   3003              * the signed arithmetic on exp_b10 and permits GCC at least to do
   3004              * better optimization.
   3005              */
   3006             {
   3007                unsigned int uexp_b10;
   3008 
   3009                if (exp_b10 < 0)
   3010                {
   3011                   *ascii++ = 45, --size; /* '-': PLUS 1 TOTAL 3+precision */
   3012                   uexp_b10 = -exp_b10;
   3013                }
   3014 
   3015                else
   3016                   uexp_b10 = exp_b10;
   3017 
   3018                cdigits = 0;
   3019 
   3020                while (uexp_b10 > 0)
   3021                {
   3022                   exponent[cdigits++] = (char)(48 + uexp_b10 % 10);
   3023                   uexp_b10 /= 10;
   3024                }
   3025             }
   3026 
   3027             /* Need another size check here for the exponent digits, so
   3028              * this need not be considered above.
   3029              */
   3030             if ((int)size > cdigits)
   3031             {
   3032                while (cdigits > 0) *ascii++ = exponent[--cdigits];
   3033 
   3034                *ascii = 0;
   3035 
   3036                return;
   3037             }
   3038          }
   3039       }
   3040       else if (!(fp >= DBL_MIN))
   3041       {
   3042          *ascii++ = 48; /* '0' */
   3043          *ascii = 0;
   3044          return;
   3045       }
   3046       else
   3047       {
   3048          *ascii++ = 105; /* 'i' */
   3049          *ascii++ = 110; /* 'n' */
   3050          *ascii++ = 102; /* 'f' */
   3051          *ascii = 0;
   3052          return;
   3053       }
   3054    }
   3055 
   3056    /* Here on buffer too small. */
   3057    png_error(png_ptr, "ASCII conversion buffer too small");
   3058 }
   3059 
   3060 #  endif /* FLOATING_POINT */
   3061 
   3062 #  ifdef PNG_FIXED_POINT_SUPPORTED
   3063 /* Function to format a fixed point value in ASCII.
   3064  */
   3065 void /* PRIVATE */
   3066 png_ascii_from_fixed(png_const_structrp png_ptr, png_charp ascii,
   3067     png_size_t size, png_fixed_point fp)
   3068 {
   3069    /* Require space for 10 decimal digits, a decimal point, a minus sign and a
   3070     * trailing \0, 13 characters:
   3071     */
   3072    if (size > 12)
   3073    {
   3074       png_uint_32 num;
   3075 
   3076       /* Avoid overflow here on the minimum integer. */
   3077       if (fp < 0)
   3078          *ascii++ = 45, --size, num = -fp;
   3079       else
   3080          num = fp;
   3081 
   3082       if (num <= 0x80000000) /* else overflowed */
   3083       {
   3084          unsigned int ndigits = 0, first = 16 /* flag value */;
   3085          char digits[10];
   3086 
   3087          while (num)
   3088          {
   3089             /* Split the low digit off num: */
   3090             unsigned int tmp = num/10;
   3091             num -= tmp*10;
   3092             digits[ndigits++] = (char)(48 + num);
   3093             /* Record the first non-zero digit, note that this is a number
   3094              * starting at 1, it's not actually the array index.
   3095              */
   3096             if (first == 16 && num > 0)
   3097                first = ndigits;
   3098             num = tmp;
   3099          }
   3100 
   3101          if (ndigits > 0)
   3102          {
   3103             while (ndigits > 5) *ascii++ = digits[--ndigits];
   3104             /* The remaining digits are fractional digits, ndigits is '5' or
   3105              * smaller at this point.  It is certainly not zero.  Check for a
   3106              * non-zero fractional digit:
   3107              */
   3108             if (first <= 5)
   3109             {
   3110                unsigned int i;
   3111                *ascii++ = 46; /* decimal point */
   3112                /* ndigits may be <5 for small numbers, output leading zeros
   3113                 * then ndigits digits to first:
   3114                 */
   3115                i = 5;
   3116                while (ndigits < i) *ascii++ = 48, --i;
   3117                while (ndigits >= first) *ascii++ = digits[--ndigits];
   3118                /* Don't output the trailing zeros! */
   3119             }
   3120          }
   3121          else
   3122             *ascii++ = 48;
   3123 
   3124          /* And null terminate the string: */
   3125          *ascii = 0;
   3126          return;
   3127       }
   3128    }
   3129 
   3130    /* Here on buffer too small. */
   3131    png_error(png_ptr, "ASCII conversion buffer too small");
   3132 }
   3133 #   endif /* FIXED_POINT */
   3134 #endif /* READ_SCAL */
   3135 
   3136 #if defined(PNG_FLOATING_POINT_SUPPORTED) && \
   3137    !defined(PNG_FIXED_POINT_MACRO_SUPPORTED) && \
   3138    (defined(PNG_gAMA_SUPPORTED) || defined(PNG_cHRM_SUPPORTED) || \
   3139    defined(PNG_sCAL_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED) || \
   3140    defined(PNG_READ_RGB_TO_GRAY_SUPPORTED)) || \
   3141    (defined(PNG_sCAL_SUPPORTED) && \
   3142    defined(PNG_FLOATING_ARITHMETIC_SUPPORTED))
   3143 png_fixed_point
   3144 png_fixed(png_const_structrp png_ptr, double fp, png_const_charp text)
   3145 {
   3146    double r = floor(100000 * fp + .5);
   3147 
   3148    if (r > 2147483647. || r < -2147483648.)
   3149       png_fixed_error(png_ptr, text);
   3150 
   3151 #  ifndef PNG_ERROR_TEXT_SUPPORTED
   3152       PNG_UNUSED(text)
   3153 #  endif
   3154 
   3155    return (png_fixed_point)r;
   3156 }
   3157 #endif
   3158 
   3159 #if defined(PNG_GAMMA_SUPPORTED) || defined(PNG_COLORSPACE_SUPPORTED) ||\
   3160     defined(PNG_INCH_CONVERSIONS_SUPPORTED) || defined(PNG_READ_pHYs_SUPPORTED)
   3161 /* muldiv functions */
   3162 /* This API takes signed arguments and rounds the result to the nearest
   3163  * integer (or, for a fixed point number - the standard argument - to
   3164  * the nearest .00001).  Overflow and divide by zero are signalled in
   3165  * the result, a boolean - true on success, false on overflow.
   3166  */
   3167 int
   3168 png_muldiv(png_fixed_point_p res, png_fixed_point a, png_int_32 times,
   3169     png_int_32 divisor)
   3170 {
   3171    /* Return a * times / divisor, rounded. */
   3172    if (divisor != 0)
   3173    {
   3174       if (a == 0 || times == 0)
   3175       {
   3176          *res = 0;
   3177          return 1;
   3178       }
   3179       else
   3180       {
   3181 #ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
   3182          double r = a;
   3183          r *= times;
   3184          r /= divisor;
   3185          r = floor(r+.5);
   3186 
   3187          /* A png_fixed_point is a 32-bit integer. */
   3188          if (r <= 2147483647. && r >= -2147483648.)
   3189          {
   3190             *res = (png_fixed_point)r;
   3191             return 1;
   3192          }
   3193 #else
   3194          int negative = 0;
   3195          png_uint_32 A, T, D;
   3196          png_uint_32 s16, s32, s00;
   3197 
   3198          if (a < 0)
   3199             negative = 1, A = -a;
   3200          else
   3201             A = a;
   3202 
   3203          if (times < 0)
   3204             negative = !negative, T = -times;
   3205          else
   3206             T = times;
   3207 
   3208          if (divisor < 0)
   3209             negative = !negative, D = -divisor;
   3210          else
   3211             D = divisor;
   3212 
   3213          /* Following can't overflow because the arguments only
   3214           * have 31 bits each, however the result may be 32 bits.
   3215           */
   3216          s16 = (A >> 16) * (T & 0xffff) +
   3217                            (A & 0xffff) * (T >> 16);
   3218          /* Can't overflow because the a*times bit is only 30
   3219           * bits at most.
   3220           */
   3221          s32 = (A >> 16) * (T >> 16) + (s16 >> 16);
   3222          s00 = (A & 0xffff) * (T & 0xffff);
   3223 
   3224          s16 = (s16 & 0xffff) << 16;
   3225          s00 += s16;
   3226 
   3227          if (s00 < s16)
   3228             ++s32; /* carry */
   3229 
   3230          if (s32 < D) /* else overflow */
   3231          {
   3232             /* s32.s00 is now the 64-bit product, do a standard
   3233              * division, we know that s32 < D, so the maximum
   3234              * required shift is 31.
   3235              */
   3236             int bitshift = 32;
   3237             png_fixed_point result = 0; /* NOTE: signed */
   3238 
   3239             while (--bitshift >= 0)
   3240             {
   3241                png_uint_32 d32, d00;
   3242 
   3243                if (bitshift > 0)
   3244                   d32 = D >> (32-bitshift), d00 = D << bitshift;
   3245 
   3246                else
   3247                   d32 = 0, d00 = D;
   3248 
   3249                if (s32 > d32)
   3250                {
   3251                   if (s00 < d00) --s32; /* carry */
   3252                   s32 -= d32, s00 -= d00, result += 1<<bitshift;
   3253                }
   3254 
   3255                else
   3256                   if (s32 == d32 && s00 >= d00)
   3257                      s32 = 0, s00 -= d00, result += 1<<bitshift;
   3258             }
   3259 
   3260             /* Handle the rounding. */
   3261             if (s00 >= (D >> 1))
   3262                ++result;
   3263 
   3264             if (negative)
   3265                result = -result;
   3266 
   3267             /* Check for overflow. */
   3268             if ((negative && result <= 0) || (!negative && result >= 0))
   3269             {
   3270                *res = result;
   3271                return 1;
   3272             }
   3273          }
   3274 #endif
   3275       }
   3276    }
   3277 
   3278    return 0;
   3279 }
   3280 #endif /* READ_GAMMA || INCH_CONVERSIONS */
   3281 
   3282 #if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_INCH_CONVERSIONS_SUPPORTED)
   3283 /* The following is for when the caller doesn't much care about the
   3284  * result.
   3285  */
   3286 png_fixed_point
   3287 png_muldiv_warn(png_const_structrp png_ptr, png_fixed_point a, png_int_32 times,
   3288     png_int_32 divisor)
   3289 {
   3290    png_fixed_point result;
   3291 
   3292    if (png_muldiv(&result, a, times, divisor))
   3293       return result;
   3294 
   3295    png_warning(png_ptr, "fixed point overflow ignored");
   3296    return 0;
   3297 }
   3298 #endif
   3299 
   3300 #ifdef PNG_GAMMA_SUPPORTED /* more fixed point functions for gamma */
   3301 /* Calculate a reciprocal, return 0 on div-by-zero or overflow. */
   3302 png_fixed_point
   3303 png_reciprocal(png_fixed_point a)
   3304 {
   3305 #ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
   3306    double r = floor(1E10/a+.5);
   3307 
   3308    if (r <= 2147483647. && r >= -2147483648.)
   3309       return (png_fixed_point)r;
   3310 #else
   3311    png_fixed_point res;
   3312 
   3313    if (png_muldiv(&res, 100000, 100000, a))
   3314       return res;
   3315 #endif
   3316 
   3317    return 0; /* error/overflow */
   3318 }
   3319 
   3320 /* This is the shared test on whether a gamma value is 'significant' - whether
   3321  * it is worth doing gamma correction.
   3322  */
   3323 int /* PRIVATE */
   3324 png_gamma_significant(png_fixed_point gamma_val)
   3325 {
   3326    return gamma_val < PNG_FP_1 - PNG_GAMMA_THRESHOLD_FIXED ||
   3327        gamma_val > PNG_FP_1 + PNG_GAMMA_THRESHOLD_FIXED;
   3328 }
   3329 #endif
   3330 
   3331 #ifdef PNG_READ_GAMMA_SUPPORTED
   3332 #  ifdef PNG_16BIT_SUPPORTED
   3333 /* A local convenience routine. */
   3334 static png_fixed_point
   3335 png_product2(png_fixed_point a, png_fixed_point b)
   3336 {
   3337    /* The required result is 1/a * 1/b; the following preserves accuracy. */
   3338 #    ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
   3339    double r = a * 1E-5;
   3340    r *= b;
   3341    r = floor(r+.5);
   3342 
   3343    if (r <= 2147483647. && r >= -2147483648.)
   3344       return (png_fixed_point)r;
   3345 #    else
   3346    png_fixed_point res;
   3347 
   3348    if (png_muldiv(&res, a, b, 100000))
   3349       return res;
   3350 #    endif
   3351 
   3352    return 0; /* overflow */
   3353 }
   3354 #  endif /* 16BIT */
   3355 
   3356 /* The inverse of the above. */
   3357 png_fixed_point
   3358 png_reciprocal2(png_fixed_point a, png_fixed_point b)
   3359 {
   3360    /* The required result is 1/a * 1/b; the following preserves accuracy. */
   3361 #ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
   3362    double r = 1E15/a;
   3363    r /= b;
   3364    r = floor(r+.5);
   3365 
   3366    if (r <= 2147483647. && r >= -2147483648.)
   3367       return (png_fixed_point)r;
   3368 #else
   3369    /* This may overflow because the range of png_fixed_point isn't symmetric,
   3370     * but this API is only used for the product of file and screen gamma so it
   3371     * doesn't matter that the smallest number it can produce is 1/21474, not
   3372     * 1/100000
   3373     */
   3374    png_fixed_point res = png_product2(a, b);
   3375 
   3376    if (res != 0)
   3377       return png_reciprocal(res);
   3378 #endif
   3379 
   3380    return 0; /* overflow */
   3381 }
   3382 #endif /* READ_GAMMA */
   3383 
   3384 #ifdef PNG_READ_GAMMA_SUPPORTED /* gamma table code */
   3385 #ifndef PNG_FLOATING_ARITHMETIC_SUPPORTED
   3386 /* Fixed point gamma.
   3387  *
   3388  * The code to calculate the tables used below can be found in the shell script
   3389  * contrib/tools/intgamma.sh
   3390  *
   3391  * To calculate gamma this code implements fast log() and exp() calls using only
   3392  * fixed point arithmetic.  This code has sufficient precision for either 8-bit
   3393  * or 16-bit sample values.
   3394  *
   3395  * The tables used here were calculated using simple 'bc' programs, but C double
   3396  * precision floating point arithmetic would work fine.
   3397  *
   3398  * 8-bit log table
   3399  *   This is a table of -log(value/255)/log(2) for 'value' in the range 128 to
   3400  *   255, so it's the base 2 logarithm of a normalized 8-bit floating point
   3401  *   mantissa.  The numbers are 32-bit fractions.
   3402  */
   3403 static const png_uint_32
   3404 png_8bit_l2[128] =
   3405 {
   3406    4270715492U, 4222494797U, 4174646467U, 4127164793U, 4080044201U, 4033279239U,
   3407    3986864580U, 3940795015U, 3895065449U, 3849670902U, 3804606499U, 3759867474U,
   3408    3715449162U, 3671346997U, 3627556511U, 3584073329U, 3540893168U, 3498011834U,
   3409    3455425220U, 3413129301U, 3371120137U, 3329393864U, 3287946700U, 3246774933U,
   3410    3205874930U, 3165243125U, 3124876025U, 3084770202U, 3044922296U, 3005329011U,
   3411    2965987113U, 2926893432U, 2888044853U, 2849438323U, 2811070844U, 2772939474U,
   3412    2735041326U, 2697373562U, 2659933400U, 2622718104U, 2585724991U, 2548951424U,
   3413    2512394810U, 2476052606U, 2439922311U, 2404001468U, 2368287663U, 2332778523U,
   3414    2297471715U, 2262364947U, 2227455964U, 2192742551U, 2158222529U, 2123893754U,
   3415    2089754119U, 2055801552U, 2022034013U, 1988449497U, 1955046031U, 1921821672U,
   3416    1888774511U, 1855902668U, 1823204291U, 1790677560U, 1758320682U, 1726131893U,
   3417    1694109454U, 1662251657U, 1630556815U, 1599023271U, 1567649391U, 1536433567U,
   3418    1505374214U, 1474469770U, 1443718700U, 1413119487U, 1382670639U, 1352370686U,
   3419    1322218179U, 1292211689U, 1262349810U, 1232631153U, 1203054352U, 1173618059U,
   3420    1144320946U, 1115161701U, 1086139034U, 1057251672U, 1028498358U, 999877854U,
   3421    971388940U, 943030410U, 914801076U, 886699767U, 858725327U, 830876614U,
   3422    803152505U, 775551890U, 748073672U, 720716771U, 693480120U, 666362667U,
   3423    639363374U, 612481215U, 585715177U, 559064263U, 532527486U, 506103872U,
   3424    479792461U, 453592303U, 427502463U, 401522014U, 375650043U, 349885648U,
   3425    324227938U, 298676034U, 273229066U, 247886176U, 222646516U, 197509248U,
   3426    172473545U, 147538590U, 122703574U, 97967701U, 73330182U, 48790236U,
   3427    24347096U, 0U
   3428 
   3429 #if 0
   3430    /* The following are the values for 16-bit tables - these work fine for the
   3431     * 8-bit conversions but produce very slightly larger errors in the 16-bit
   3432     * log (about 1.2 as opposed to 0.7 absolute error in the final value).  To
   3433     * use these all the shifts below must be adjusted appropriately.
   3434     */
   3435    65166, 64430, 63700, 62976, 62257, 61543, 60835, 60132, 59434, 58741, 58054,
   3436    57371, 56693, 56020, 55352, 54689, 54030, 53375, 52726, 52080, 51439, 50803,
   3437    50170, 49542, 48918, 48298, 47682, 47070, 46462, 45858, 45257, 44661, 44068,
   3438    43479, 42894, 42312, 41733, 41159, 40587, 40020, 39455, 38894, 38336, 37782,
   3439    37230, 36682, 36137, 35595, 35057, 34521, 33988, 33459, 32932, 32408, 31887,
   3440    31369, 30854, 30341, 29832, 29325, 28820, 28319, 27820, 27324, 26830, 26339,
   3441    25850, 25364, 24880, 24399, 23920, 23444, 22970, 22499, 22029, 21562, 21098,
   3442    20636, 20175, 19718, 19262, 18808, 18357, 17908, 17461, 17016, 16573, 16132,
   3443    15694, 15257, 14822, 14390, 13959, 13530, 13103, 12678, 12255, 11834, 11415,
   3444    10997, 10582, 10168, 9756, 9346, 8937, 8531, 8126, 7723, 7321, 6921, 6523,
   3445    6127, 5732, 5339, 4947, 4557, 4169, 3782, 3397, 3014, 2632, 2251, 1872, 1495,
   3446    1119, 744, 372
   3447 #endif
   3448 };
   3449 
   3450 static png_int_32
   3451 png_log8bit(unsigned int x)
   3452 {
   3453    unsigned int lg2 = 0;
   3454    /* Each time 'x' is multiplied by 2, 1 must be subtracted off the final log,
   3455     * because the log is actually negate that means adding 1.  The final
   3456     * returned value thus has the range 0 (for 255 input) to 7.994 (for 1
   3457     * input), return -1 for the overflow (log 0) case, - so the result is
   3458     * always at most 19 bits.
   3459     */
   3460    if ((x &= 0xff) == 0)
   3461       return -1;
   3462 
   3463    if ((x & 0xf0) == 0)
   3464       lg2  = 4, x <<= 4;
   3465 
   3466    if ((x & 0xc0) == 0)
   3467       lg2 += 2, x <<= 2;
   3468 
   3469    if ((x & 0x80) == 0)
   3470       lg2 += 1, x <<= 1;
   3471 
   3472    /* result is at most 19 bits, so this cast is safe: */
   3473    return (png_int_32)((lg2 << 16) + ((png_8bit_l2[x-128]+32768)>>16));
   3474 }
   3475 
   3476 /* The above gives exact (to 16 binary places) log2 values for 8-bit images,
   3477  * for 16-bit images we use the most significant 8 bits of the 16-bit value to
   3478  * get an approximation then multiply the approximation by a correction factor
   3479  * determined by the remaining up to 8 bits.  This requires an additional step
   3480  * in the 16-bit case.
   3481  *
   3482  * We want log2(value/65535), we have log2(v'/255), where:
   3483  *
   3484  *    value = v' * 256 + v''
   3485  *          = v' * f
   3486  *
   3487  * So f is value/v', which is equal to (256+v''/v') since v' is in the range 128
   3488  * to 255 and v'' is in the range 0 to 255 f will be in the range 256 to less
   3489  * than 258.  The final factor also needs to correct for the fact that our 8-bit
   3490  * value is scaled by 255, whereas the 16-bit values must be scaled by 65535.
   3491  *
   3492  * This gives a final formula using a calculated value 'x' which is value/v' and
   3493  * scaling by 65536 to match the above table:
   3494  *
   3495  *   log2(x/257) * 65536
   3496  *
   3497  * Since these numbers are so close to '1' we can use simple linear
   3498  * interpolation between the two end values 256/257 (result -368.61) and 258/257
   3499  * (result 367.179).  The values used below are scaled by a further 64 to give
   3500  * 16-bit precision in the interpolation:
   3501  *
   3502  * Start (256): -23591
   3503  * Zero  (257):      0
   3504  * End   (258):  23499
   3505  */
   3506 static png_int_32
   3507 png_log16bit(png_uint_32 x)
   3508 {
   3509    unsigned int lg2 = 0;
   3510 
   3511    /* As above, but now the input has 16 bits. */
   3512    if ((x &= 0xffff) == 0)
   3513       return -1;
   3514 
   3515    if ((x & 0xff00) == 0)
   3516       lg2  = 8, x <<= 8;
   3517 
   3518    if ((x & 0xf000) == 0)
   3519       lg2 += 4, x <<= 4;
   3520 
   3521    if ((x & 0xc000) == 0)
   3522       lg2 += 2, x <<= 2;
   3523 
   3524    if ((x & 0x8000) == 0)
   3525       lg2 += 1, x <<= 1;
   3526 
   3527    /* Calculate the base logarithm from the top 8 bits as a 28-bit fractional
   3528     * value.
   3529     */
   3530    lg2 <<= 28;
   3531    lg2 += (png_8bit_l2[(x>>8)-128]+8) >> 4;
   3532 
   3533    /* Now we need to interpolate the factor, this requires a division by the top
   3534     * 8 bits.  Do this with maximum precision.
   3535     */
   3536    x = ((x << 16) + (x >> 9)) / (x >> 8);
   3537 
   3538    /* Since we divided by the top 8 bits of 'x' there will be a '1' at 1<<24,
   3539     * the value at 1<<16 (ignoring this) will be 0 or 1; this gives us exactly
   3540     * 16 bits to interpolate to get the low bits of the result.  Round the
   3541     * answer.  Note that the end point values are scaled by 64 to retain overall
   3542     * precision and that 'lg2' is current scaled by an extra 12 bits, so adjust
   3543     * the overall scaling by 6-12.  Round at every step.
   3544     */
   3545    x -= 1U << 24;
   3546 
   3547    if (x <= 65536U) /* <= '257' */
   3548       lg2 += ((23591U * (65536U-x)) + (1U << (16+6-12-1))) >> (16+6-12);
   3549 
   3550    else
   3551       lg2 -= ((23499U * (x-65536U)) + (1U << (16+6-12-1))) >> (16+6-12);
   3552 
   3553    /* Safe, because the result can't have more than 20 bits: */
   3554    return (png_int_32)((lg2 + 2048) >> 12);
   3555 }
   3556 
   3557 /* The 'exp()' case must invert the above, taking a 20-bit fixed point
   3558  * logarithmic value and returning a 16 or 8-bit number as appropriate.  In
   3559  * each case only the low 16 bits are relevant - the fraction - since the
   3560  * integer bits (the top 4) simply determine a shift.
   3561  *
   3562  * The worst case is the 16-bit distinction between 65535 and 65534, this
   3563  * requires perhaps spurious accuracty in the decoding of the logarithm to
   3564  * distinguish log2(65535/65534.5) - 10^-5 or 17 bits.  There is little chance
   3565  * of getting this accuracy in practice.
   3566  *
   3567  * To deal with this the following exp() function works out the exponent of the
   3568  * frational part of the logarithm by using an accurate 32-bit value from the
   3569  * top four fractional bits then multiplying in the remaining bits.
   3570  */
   3571 static const png_uint_32
   3572 png_32bit_exp[16] =
   3573 {
   3574    /* NOTE: the first entry is deliberately set to the maximum 32-bit value. */
   3575    4294967295U, 4112874773U, 3938502376U, 3771522796U, 3611622603U, 3458501653U,
   3576    3311872529U, 3171459999U, 3037000500U, 2908241642U, 2784941738U, 2666869345U,
   3577    2553802834U, 2445529972U, 2341847524U, 2242560872U
   3578 };
   3579 
   3580 /* Adjustment table; provided to explain the numbers in the code below. */
   3581 #if 0
   3582 for (i=11;i>=0;--i){ print i, " ", (1 - e(-(2^i)/65536*l(2))) * 2^(32-i), "\n"}
   3583    11 44937.64284865548751208448
   3584    10 45180.98734845585101160448
   3585     9 45303.31936980687359311872
   3586     8 45364.65110595323018870784
   3587     7 45395.35850361789624614912
   3588     6 45410.72259715102037508096
   3589     5 45418.40724413220722311168
   3590     4 45422.25021786898173001728
   3591     3 45424.17186732298419044352
   3592     2 45425.13273269940811464704
   3593     1 45425.61317555035558641664
   3594     0 45425.85339951654943850496
   3595 #endif
   3596 
   3597 static png_uint_32
   3598 png_exp(png_fixed_point x)
   3599 {
   3600    if (x > 0 && x <= 0xfffff) /* Else overflow or zero (underflow) */
   3601    {
   3602       /* Obtain a 4-bit approximation */
   3603       png_uint_32 e = png_32bit_exp[(x >> 12) & 0xf];
   3604 
   3605       /* Incorporate the low 12 bits - these decrease the returned value by
   3606        * multiplying by a number less than 1 if the bit is set.  The multiplier
   3607        * is determined by the above table and the shift. Notice that the values
   3608        * converge on 45426 and this is used to allow linear interpolation of the
   3609        * low bits.
   3610        */
   3611       if (x & 0x800)
   3612          e -= (((e >> 16) * 44938U) +  16U) >> 5;
   3613 
   3614       if (x & 0x400)
   3615          e -= (((e >> 16) * 45181U) +  32U) >> 6;
   3616 
   3617       if (x & 0x200)
   3618          e -= (((e >> 16) * 45303U) +  64U) >> 7;
   3619 
   3620       if (x & 0x100)
   3621          e -= (((e >> 16) * 45365U) + 128U) >> 8;
   3622 
   3623       if (x & 0x080)
   3624          e -= (((e >> 16) * 45395U) + 256U) >> 9;
   3625 
   3626       if (x & 0x040)
   3627          e -= (((e >> 16) * 45410U) + 512U) >> 10;
   3628 
   3629       /* And handle the low 6 bits in a single block. */
   3630       e -= (((e >> 16) * 355U * (x & 0x3fU)) + 256U) >> 9;
   3631 
   3632       /* Handle the upper bits of x. */
   3633       e >>= x >> 16;
   3634       return e;
   3635    }
   3636 
   3637    /* Check for overflow */
   3638    if (x <= 0)
   3639       return png_32bit_exp[0];
   3640 
   3641    /* Else underflow */
   3642    return 0;
   3643 }
   3644 
   3645 static png_byte
   3646 png_exp8bit(png_fixed_point lg2)
   3647 {
   3648    /* Get a 32-bit value: */
   3649    png_uint_32 x = png_exp(lg2);
   3650 
   3651    /* Convert the 32-bit value to 0..255 by multiplying by 256-1, note that the
   3652     * second, rounding, step can't overflow because of the first, subtraction,
   3653     * step.
   3654     */
   3655    x -= x >> 8;
   3656    return (png_byte)((x + 0x7fffffU) >> 24);
   3657 }
   3658 
   3659 #ifdef PNG_16BIT_SUPPORTED
   3660 static png_uint_16
   3661 png_exp16bit(png_fixed_point lg2)
   3662 {
   3663    /* Get a 32-bit value: */
   3664    png_uint_32 x = png_exp(lg2);
   3665 
   3666    /* Convert the 32-bit value to 0..65535 by multiplying by 65536-1: */
   3667    x -= x >> 16;
   3668    return (png_uint_16)((x + 32767U) >> 16);
   3669 }
   3670 #endif /* 16BIT */
   3671 #endif /* FLOATING_ARITHMETIC */
   3672 
   3673 png_byte
   3674 png_gamma_8bit_correct(unsigned int value, png_fixed_point gamma_val)
   3675 {
   3676    if (value > 0 && value < 255)
   3677    {
   3678 #     ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
   3679          double r = floor(255*pow(value/255.,gamma_val*.00001)+.5);
   3680          return (png_byte)r;
   3681 #     else
   3682          png_int_32 lg2 = png_log8bit(value);
   3683          png_fixed_point res;
   3684 
   3685          if (png_muldiv(&res, gamma_val, lg2, PNG_FP_1))
   3686             return png_exp8bit(res);
   3687 
   3688          /* Overflow. */
   3689          value = 0;
   3690 #     endif
   3691    }
   3692 
   3693    return (png_byte)value;
   3694 }
   3695 
   3696 #ifdef PNG_16BIT_SUPPORTED
   3697 png_uint_16
   3698 png_gamma_16bit_correct(unsigned int value, png_fixed_point gamma_val)
   3699 {
   3700    if (value > 0 && value < 65535)
   3701    {
   3702 #     ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
   3703          double r = floor(65535*pow(value/65535.,gamma_val*.00001)+.5);
   3704          return (png_uint_16)r;
   3705 #     else
   3706          png_int_32 lg2 = png_log16bit(value);
   3707          png_fixed_point res;
   3708 
   3709          if (png_muldiv(&res, gamma_val, lg2, PNG_FP_1))
   3710             return png_exp16bit(res);
   3711 
   3712          /* Overflow. */
   3713          value = 0;
   3714 #     endif
   3715    }
   3716 
   3717    return (png_uint_16)value;
   3718 }
   3719 #endif /* 16BIT */
   3720 
   3721 /* This does the right thing based on the bit_depth field of the
   3722  * png_struct, interpreting values as 8-bit or 16-bit.  While the result
   3723  * is nominally a 16-bit value if bit depth is 8 then the result is
   3724  * 8-bit (as are the arguments.)
   3725  */
   3726 png_uint_16 /* PRIVATE */
   3727 png_gamma_correct(png_structrp png_ptr, unsigned int value,
   3728     png_fixed_point gamma_val)
   3729 {
   3730    if (png_ptr->bit_depth == 8)
   3731       return png_gamma_8bit_correct(value, gamma_val);
   3732 
   3733 #ifdef PNG_16BIT_SUPPORTED
   3734    else
   3735       return png_gamma_16bit_correct(value, gamma_val);
   3736 #else
   3737       /* should not reach this */
   3738       return 0;
   3739 #endif /* 16BIT */
   3740 }
   3741 
   3742 #ifdef PNG_16BIT_SUPPORTED
   3743 /* Internal function to build a single 16-bit table - the table consists of
   3744  * 'num' 256 entry subtables, where 'num' is determined by 'shift' - the amount
   3745  * to shift the input values right (or 16-number_of_signifiant_bits).
   3746  *
   3747  * The caller is responsible for ensuring that the table gets cleaned up on
   3748  * png_error (i.e. if one of the mallocs below fails) - i.e. the *table argument
   3749  * should be somewhere that will be cleaned.
   3750  */
   3751 static void
   3752 png_build_16bit_table(png_structrp png_ptr, png_uint_16pp *ptable,
   3753    PNG_CONST unsigned int shift, PNG_CONST png_fixed_point gamma_val)
   3754 {
   3755    /* Various values derived from 'shift': */
   3756    PNG_CONST unsigned int num = 1U << (8U - shift);
   3757    PNG_CONST unsigned int max = (1U << (16U - shift))-1U;
   3758    PNG_CONST unsigned int max_by_2 = 1U << (15U-shift);
   3759    unsigned int i;
   3760 
   3761    png_uint_16pp table = *ptable =
   3762        (png_uint_16pp)png_calloc(png_ptr, num * (sizeof (png_uint_16p)));
   3763 
   3764    for (i = 0; i < num; i++)
   3765    {
   3766       png_uint_16p sub_table = table[i] =
   3767           (png_uint_16p)png_malloc(png_ptr, 256 * (sizeof (png_uint_16)));
   3768 
   3769       /* The 'threshold' test is repeated here because it can arise for one of
   3770        * the 16-bit tables even if the others don't hit it.
   3771        */
   3772       if (png_gamma_significant(gamma_val))
   3773       {
   3774          /* The old code would overflow at the end and this would cause the
   3775           * 'pow' function to return a result >1, resulting in an
   3776           * arithmetic error.  This code follows the spec exactly; ig is
   3777           * the recovered input sample, it always has 8-16 bits.
   3778           *
   3779           * We want input * 65535/max, rounded, the arithmetic fits in 32
   3780           * bits (unsigned) so long as max <= 32767.
   3781           */
   3782          unsigned int j;
   3783          for (j = 0; j < 256; j++)
   3784          {
   3785             png_uint_32 ig = (j << (8-shift)) + i;
   3786 #           ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED
   3787                /* Inline the 'max' scaling operation: */
   3788                double d = floor(65535*pow(ig/(double)max, gamma_val*.00001)+.5);
   3789                sub_table[j] = (png_uint_16)d;
   3790 #           else
   3791                if (shift)
   3792                   ig = (ig * 65535U + max_by_2)/max;
   3793 
   3794                sub_table[j] = png_gamma_16bit_correct(ig, gamma_val);
   3795 #           endif
   3796          }
   3797       }
   3798       else
   3799       {
   3800          /* We must still build a table, but do it the fast way. */
   3801          unsigned int j;
   3802 
   3803          for (j = 0; j < 256; j++)
   3804          {
   3805             png_uint_32 ig = (j << (8-shift)) + i;
   3806 
   3807             if (shift)
   3808                ig = (ig * 65535U + max_by_2)/max;
   3809 
   3810             sub_table[j] = (png_uint_16)ig;
   3811          }
   3812       }
   3813    }
   3814 }
   3815 
   3816 /* NOTE: this function expects the *inverse* of the overall gamma transformation
   3817  * required.
   3818  */
   3819 static void
   3820 png_build_16to8_table(png_structrp png_ptr, png_uint_16pp *ptable,
   3821    PNG_CONST unsigned int shift, PNG_CONST png_fixed_point gamma_val)
   3822 {
   3823    PNG_CONST unsigned int num = 1U << (8U - shift);
   3824    PNG_CONST unsigned int max = (1U << (16U - shift))-1U;
   3825    unsigned int i;
   3826    png_uint_32 last;
   3827 
   3828    png_uint_16pp table = *ptable =
   3829        (png_uint_16pp)png_calloc(png_ptr, num * (sizeof (png_uint_16p)));
   3830 
   3831    /* 'num' is the number of tables and also the number of low bits of low
   3832     * bits of the input 16-bit value used to select a table.  Each table is
   3833     * itself index by the high 8 bits of the value.
   3834     */
   3835    for (i = 0; i < num; i++)
   3836       table[i] = (png_uint_16p)png_malloc(png_ptr,
   3837           256 * (sizeof (png_uint_16)));
   3838 
   3839    /* 'gamma_val' is set to the reciprocal of the value calculated above, so
   3840     * pow(out,g) is an *input* value.  'last' is the last input value set.
   3841     *
   3842     * In the loop 'i' is used to find output values.  Since the output is
   3843     * 8-bit there are only 256 possible values.  The tables are set up to
   3844     * select the closest possible output value for each input by finding
   3845     * the input value at the boundary between each pair of output values
   3846     * and filling the table up to that boundary with the lower output
   3847     * value.
   3848     *
   3849     * The boundary values are 0.5,1.5..253.5,254.5.  Since these are 9-bit
   3850     * values the code below uses a 16-bit value in i; the values start at
   3851     * 128.5 (for 0.5) and step by 257, for a total of 254 values (the last
   3852     * entries are filled with 255).  Start i at 128 and fill all 'last'
   3853     * table entries <= 'max'
   3854     */
   3855    last = 0;
   3856    for (i = 0; i < 255; ++i) /* 8-bit output value */
   3857    {
   3858       /* Find the corresponding maximum input value */
   3859       png_uint_16 out = (png_uint_16)(i * 257U); /* 16-bit output value */
   3860 
   3861       /* Find the boundary value in 16 bits: */
   3862       png_uint_32 bound = png_gamma_16bit_correct(out+128U, gamma_val);
   3863 
   3864       /* Adjust (round) to (16-shift) bits: */
   3865       bound = (bound * max + 32768U)/65535U + 1U;
   3866 
   3867       while (last < bound)
   3868       {
   3869          table[last & (0xffU >> shift)][last >> (8U - shift)] = out;
   3870          last++;
   3871       }
   3872    }
   3873 
   3874    /* And fill in the final entries. */
   3875    while (last < (num << 8))
   3876    {
   3877       table[last & (0xff >> shift)][last >> (8U - shift)] = 65535U;
   3878       last++;
   3879    }
   3880 }
   3881 #endif /* 16BIT */
   3882 
   3883 /* Build a single 8-bit table: same as the 16-bit case but much simpler (and
   3884  * typically much faster).  Note that libpng currently does no sBIT processing
   3885  * (apparently contrary to the spec) so a 256 entry table is always generated.
   3886  */
   3887 static void
   3888 png_build_8bit_table(png_structrp png_ptr, png_bytepp ptable,
   3889    PNG_CONST png_fixed_point gamma_val)
   3890 {
   3891    unsigned int i;
   3892    png_bytep table = *ptable = (png_bytep)png_malloc(png_ptr, 256);
   3893 
   3894    if (png_gamma_significant(gamma_val)) for (i=0; i<256; i++)
   3895       table[i] = png_gamma_8bit_correct(i, gamma_val);
   3896 
   3897    else for (i=0; i<256; ++i)
   3898       table[i] = (png_byte)i;
   3899 }
   3900 
   3901 /* Used from png_read_destroy and below to release the memory used by the gamma
   3902  * tables.
   3903  */
   3904 void /* PRIVATE */
   3905 png_destroy_gamma_table(png_structrp png_ptr)
   3906 {
   3907    png_free(png_ptr, png_ptr->gamma_table);
   3908    png_ptr->gamma_table = NULL;
   3909 
   3910 #ifdef PNG_16BIT_SUPPORTED
   3911    if (png_ptr->gamma_16_table != NULL)
   3912    {
   3913       int i;
   3914       int istop = (1 << (8 - png_ptr->gamma_shift));
   3915       for (i = 0; i < istop; i++)
   3916       {
   3917          png_free(png_ptr, png_ptr->gamma_16_table[i]);
   3918       }
   3919    png_free(png_ptr, png_ptr->gamma_16_table);
   3920    png_ptr->gamma_16_table = NULL;
   3921    }
   3922 #endif /* 16BIT */
   3923 
   3924 #if defined(PNG_READ_BACKGROUND_SUPPORTED) || \
   3925    defined(PNG_READ_ALPHA_MODE_SUPPORTED) || \
   3926    defined(PNG_READ_RGB_TO_GRAY_SUPPORTED)
   3927    png_free(png_ptr, png_ptr->gamma_from_1);
   3928    png_ptr->gamma_from_1 = NULL;
   3929    png_free(png_ptr, png_ptr->gamma_to_1);
   3930    png_ptr->gamma_to_1 = NULL;
   3931 
   3932 #ifdef PNG_16BIT_SUPPORTED
   3933    if (png_ptr->gamma_16_from_1 != NULL)
   3934    {
   3935       int i;
   3936       int istop = (1 << (8 - png_ptr->gamma_shift));
   3937       for (i = 0; i < istop; i++)
   3938       {
   3939          png_free(png_ptr, png_ptr->gamma_16_from_1[i]);
   3940       }
   3941    png_free(png_ptr, png_ptr->gamma_16_from_1);
   3942    png_ptr->gamma_16_from_1 = NULL;
   3943    }
   3944    if (png_ptr->gamma_16_to_1 != NULL)
   3945    {
   3946       int i;
   3947       int istop = (1 << (8 - png_ptr->gamma_shift));
   3948       for (i = 0; i < istop; i++)
   3949       {
   3950          png_free(png_ptr, png_ptr->gamma_16_to_1[i]);
   3951       }
   3952    png_free(png_ptr, png_ptr->gamma_16_to_1);
   3953    png_ptr->gamma_16_to_1 = NULL;
   3954    }
   3955 #endif /* 16BIT */
   3956 #endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */
   3957 }
   3958 
   3959 /* We build the 8- or 16-bit gamma tables here.  Note that for 16-bit
   3960  * tables, we don't make a full table if we are reducing to 8-bit in
   3961  * the future.  Note also how the gamma_16 tables are segmented so that
   3962  * we don't need to allocate > 64K chunks for a full 16-bit table.
   3963  */
   3964 void /* PRIVATE */
   3965 png_build_gamma_table(png_structrp png_ptr, int bit_depth)
   3966 {
   3967   png_debug(1, "in png_build_gamma_table");
   3968 
   3969   /* Remove any existing table; this copes with multiple calls to
   3970    * png_read_update_info.  The warning is because building the gamma tables
   3971    * multiple times is a performance hit - it's harmless but the ability to call
   3972    * png_read_update_info() multiple times is new in 1.5.6 so it seems sensible
   3973    * to warn if the app introduces such a hit.
   3974    */
   3975   if (png_ptr->gamma_table != NULL || png_ptr->gamma_16_table != NULL)
   3976   {
   3977     png_warning(png_ptr, "gamma table being rebuilt");
   3978     png_destroy_gamma_table(png_ptr);
   3979   }
   3980 
   3981   if (bit_depth <= 8)
   3982   {
   3983      png_build_8bit_table(png_ptr, &png_ptr->gamma_table,
   3984          png_ptr->screen_gamma > 0 ?  png_reciprocal2(png_ptr->colorspace.gamma,
   3985          png_ptr->screen_gamma) : PNG_FP_1);
   3986 
   3987 #if defined(PNG_READ_BACKGROUND_SUPPORTED) || \
   3988    defined(PNG_READ_ALPHA_MODE_SUPPORTED) || \
   3989    defined(PNG_READ_RGB_TO_GRAY_SUPPORTED)
   3990      if (png_ptr->transformations & (PNG_COMPOSE | PNG_RGB_TO_GRAY))
   3991      {
   3992         png_build_8bit_table(png_ptr, &png_ptr->gamma_to_1,
   3993             png_reciprocal(png_ptr->colorspace.gamma));
   3994 
   3995         png_build_8bit_table(png_ptr, &png_ptr->gamma_from_1,
   3996             png_ptr->screen_gamma > 0 ?  png_reciprocal(png_ptr->screen_gamma) :
   3997             png_ptr->colorspace.gamma/* Probably doing rgb_to_gray */);
   3998      }
   3999 #endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */
   4000   }
   4001 #ifdef PNG_16BIT_SUPPORTED
   4002   else
   4003   {
   4004      png_byte shift, sig_bit;
   4005 
   4006      if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)
   4007      {
   4008         sig_bit = png_ptr->sig_bit.red;
   4009 
   4010         if (png_ptr->sig_bit.green > sig_bit)
   4011            sig_bit = png_ptr->sig_bit.green;
   4012 
   4013         if (png_ptr->sig_bit.blue > sig_bit)
   4014            sig_bit = png_ptr->sig_bit.blue;
   4015      }
   4016      else
   4017         sig_bit = png_ptr->sig_bit.gray;
   4018 
   4019      /* 16-bit gamma code uses this equation:
   4020       *
   4021       *   ov = table[(iv & 0xff) >> gamma_shift][iv >> 8]
   4022       *
   4023       * Where 'iv' is the input color value and 'ov' is the output value -
   4024       * pow(iv, gamma).
   4025       *
   4026       * Thus the gamma table consists of up to 256 256 entry tables.  The table
   4027       * is selected by the (8-gamma_shift) most significant of the low 8 bits of
   4028       * the color value then indexed by the upper 8 bits:
   4029       *
   4030       *   table[low bits][high 8 bits]
   4031       *
   4032       * So the table 'n' corresponds to all those 'iv' of:
   4033       *
   4034       *   <all high 8-bit values><n << gamma_shift>..<(n+1 << gamma_shift)-1>
   4035       *
   4036       */
   4037      if (sig_bit > 0 && sig_bit < 16U)
   4038         shift = (png_byte)(16U - sig_bit); /* shift == insignificant bits */
   4039 
   4040      else
   4041         shift = 0; /* keep all 16 bits */
   4042 
   4043      if (png_ptr->transformations & (PNG_16_TO_8 | PNG_SCALE_16_TO_8))
   4044      {
   4045         /* PNG_MAX_GAMMA_8 is the number of bits to keep - effectively
   4046          * the significant bits in the *input* when the output will
   4047          * eventually be 8 bits.  By default it is 11.
   4048          */
   4049         if (shift < (16U - PNG_MAX_GAMMA_8))
   4050            shift = (16U - PNG_MAX_GAMMA_8);
   4051      }
   4052 
   4053      if (shift > 8U)
   4054         shift = 8U; /* Guarantees at least one table! */
   4055 
   4056      png_ptr->gamma_shift = shift;
   4057 
   4058      /* NOTE: prior to 1.5.4 this test used to include PNG_BACKGROUND (now
   4059       * PNG_COMPOSE).  This effectively smashed the background calculation for
   4060       * 16-bit output because the 8-bit table assumes the result will be reduced
   4061       * to 8 bits.
   4062       */
   4063      if (png_ptr->transformations & (PNG_16_TO_8 | PNG_SCALE_16_TO_8))
   4064          png_build_16to8_table(png_ptr, &png_ptr->gamma_16_table, shift,
   4065          png_ptr->screen_gamma > 0 ? png_product2(png_ptr->colorspace.gamma,
   4066          png_ptr->screen_gamma) : PNG_FP_1);
   4067 
   4068      else
   4069          png_build_16bit_table(png_ptr, &png_ptr->gamma_16_table, shift,
   4070          png_ptr->screen_gamma > 0 ? png_reciprocal2(png_ptr->colorspace.gamma,
   4071          png_ptr->screen_gamma) : PNG_FP_1);
   4072 
   4073 #if defined(PNG_READ_BACKGROUND_SUPPORTED) || \
   4074    defined(PNG_READ_ALPHA_MODE_SUPPORTED) || \
   4075    defined(PNG_READ_RGB_TO_GRAY_SUPPORTED)
   4076      if (png_ptr->transformations & (PNG_COMPOSE | PNG_RGB_TO_GRAY))
   4077      {
   4078         png_build_16bit_table(png_ptr, &png_ptr->gamma_16_to_1, shift,
   4079             png_reciprocal(png_ptr->colorspace.gamma));
   4080 
   4081         /* Notice that the '16 from 1' table should be full precision, however
   4082          * the lookup on this table still uses gamma_shift, so it can't be.
   4083          * TODO: fix this.
   4084          */
   4085         png_build_16bit_table(png_ptr, &png_ptr->gamma_16_from_1, shift,
   4086             png_ptr->screen_gamma > 0 ? png_reciprocal(png_ptr->screen_gamma) :
   4087             png_ptr->colorspace.gamma/* Probably doing rgb_to_gray */);
   4088      }
   4089 #endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */
   4090   }
   4091 #endif /* 16BIT */
   4092 }
   4093 #endif /* READ_GAMMA */
   4094 
   4095 /* HARDWARE OPTION SUPPORT */
   4096 #ifdef PNG_SET_OPTION_SUPPORTED
   4097 int PNGAPI
   4098 png_set_option(png_structrp png_ptr, int option, int onoff)
   4099 {
   4100    if (png_ptr != NULL && option >= 0 && option < PNG_OPTION_NEXT &&
   4101       (option & 1) == 0)
   4102    {
   4103       int mask = 3 << option;
   4104       int setting = (2 + (onoff != 0)) << option;
   4105       int current = png_ptr->options;
   4106 
   4107       png_ptr->options = (png_byte)((current & ~mask) | setting);
   4108 
   4109       return (current & mask) >> option;
   4110    }
   4111 
   4112    return PNG_OPTION_INVALID;
   4113 }
   4114 #endif
   4115 
   4116 /* sRGB support */
   4117 #if defined(PNG_SIMPLIFIED_READ_SUPPORTED) ||\
   4118    defined(PNG_SIMPLIFIED_WRITE_SUPPORTED)
   4119 /* sRGB conversion tables; these are machine generated with the code in
   4120  * contrib/tools/makesRGB.c.  The actual sRGB transfer curve defined in the
   4121  * specification (see the article at http://en.wikipedia.org/wiki/SRGB)
   4122  * is used, not the gamma=1/2.2 approximation use elsewhere in libpng.
   4123  * The sRGB to linear table is exact (to the nearest 16 bit linear fraction).
   4124  * The inverse (linear to sRGB) table has accuracies as follows:
   4125  *
   4126  * For all possible (255*65535+1) input values:
   4127  *
   4128  *    error: -0.515566 - 0.625971, 79441 (0.475369%) of readings inexact
   4129  *
   4130  * For the input values corresponding to the 65536 16-bit values:
   4131  *
   4132  *    error: -0.513727 - 0.607759, 308 (0.469978%) of readings inexact
   4133  *
   4134  * In all cases the inexact readings are off by one.
   4135  */
   4136 
   4137 #ifdef PNG_SIMPLIFIED_READ_SUPPORTED
   4138 /* The convert-to-sRGB table is only currently required for read. */
   4139 const png_uint_16 png_sRGB_table[256] =
   4140 {
   4141    0,20,40,60,80,99,119,139,
   4142    159,179,199,219,241,264,288,313,
   4143    340,367,396,427,458,491,526,562,
   4144    599,637,677,718,761,805,851,898,
   4145    947,997,1048,1101,1156,1212,1270,1330,
   4146    1391,1453,1517,1583,1651,1720,1790,1863,
   4147    1937,2013,2090,2170,2250,2333,2418,2504,
   4148    2592,2681,2773,2866,2961,3058,3157,3258,
   4149    3360,3464,3570,3678,3788,3900,4014,4129,
   4150    4247,4366,4488,4611,4736,4864,4993,5124,
   4151    5257,5392,5530,5669,5810,5953,6099,6246,
   4152    6395,6547,6700,6856,7014,7174,7335,7500,
   4153    7666,7834,8004,8177,8352,8528,8708,8889,
   4154    9072,9258,9445,9635,9828,10022,10219,10417,
   4155    10619,10822,11028,11235,11446,11658,11873,12090,
   4156    12309,12530,12754,12980,13209,13440,13673,13909,
   4157    14146,14387,14629,14874,15122,15371,15623,15878,
   4158    16135,16394,16656,16920,17187,17456,17727,18001,
   4159    18277,18556,18837,19121,19407,19696,19987,20281,
   4160    20577,20876,21177,21481,21787,22096,22407,22721,
   4161    23038,23357,23678,24002,24329,24658,24990,25325,
   4162    25662,26001,26344,26688,27036,27386,27739,28094,
   4163    28452,28813,29176,29542,29911,30282,30656,31033,
   4164    31412,31794,32179,32567,32957,33350,33745,34143,
   4165    34544,34948,35355,35764,36176,36591,37008,37429,
   4166    37852,38278,38706,39138,39572,40009,40449,40891,
   4167    41337,41785,42236,42690,43147,43606,44069,44534,
   4168    45002,45473,45947,46423,46903,47385,47871,48359,
   4169    48850,49344,49841,50341,50844,51349,51858,52369,
   4170    52884,53401,53921,54445,54971,55500,56032,56567,
   4171    57105,57646,58190,58737,59287,59840,60396,60955,
   4172    61517,62082,62650,63221,63795,64372,64952,65535
   4173 };
   4174 
   4175 #endif /* simplified read only */
   4176 
   4177 /* The base/delta tables are required for both read and write (but currently
   4178  * only the simplified versions.)
   4179  */
   4180 const png_uint_16 png_sRGB_base[512] =
   4181 {
   4182    128,1782,3383,4644,5675,6564,7357,8074,
   4183    8732,9346,9921,10463,10977,11466,11935,12384,
   4184    12816,13233,13634,14024,14402,14769,15125,15473,
   4185    15812,16142,16466,16781,17090,17393,17690,17981,
   4186    18266,18546,18822,19093,19359,19621,19879,20133,
   4187    20383,20630,20873,21113,21349,21583,21813,22041,
   4188    22265,22487,22707,22923,23138,23350,23559,23767,
   4189    23972,24175,24376,24575,24772,24967,25160,25352,
   4190    25542,25730,25916,26101,26284,26465,26645,26823,
   4191    27000,27176,27350,27523,27695,27865,28034,28201,
   4192    28368,28533,28697,28860,29021,29182,29341,29500,
   4193    29657,29813,29969,30123,30276,30429,30580,30730,
   4194    30880,31028,31176,31323,31469,31614,31758,31902,
   4195    32045,32186,32327,32468,32607,32746,32884,33021,
   4196    33158,33294,33429,33564,33697,33831,33963,34095,
   4197    34226,34357,34486,34616,34744,34873,35000,35127,
   4198    35253,35379,35504,35629,35753,35876,35999,36122,
   4199    36244,36365,36486,36606,36726,36845,36964,37083,
   4200    37201,37318,37435,37551,37668,37783,37898,38013,
   4201    38127,38241,38354,38467,38580,38692,38803,38915,
   4202    39026,39136,39246,39356,39465,39574,39682,39790,
   4203    39898,40005,40112,40219,40325,40431,40537,40642,
   4204    40747,40851,40955,41059,41163,41266,41369,41471,
   4205    41573,41675,41777,41878,41979,42079,42179,42279,
   4206    42379,42478,42577,42676,42775,42873,42971,43068,
   4207    43165,43262,43359,43456,43552,43648,43743,43839,
   4208    43934,44028,44123,44217,44311,44405,44499,44592,
   4209    44685,44778,44870,44962,45054,45146,45238,45329,
   4210    45420,45511,45601,45692,45782,45872,45961,46051,
   4211    46140,46229,46318,46406,46494,46583,46670,46758,
   4212    46846,46933,47020,47107,47193,47280,47366,47452,
   4213    47538,47623,47709,47794,47879,47964,48048,48133,
   4214    48217,48301,48385,48468,48552,48635,48718,48801,
   4215    48884,48966,49048,49131,49213,49294,49376,49458,
   4216    49539,49620,49701,49782,49862,49943,50023,50103,
   4217    50183,50263,50342,50422,50501,50580,50659,50738,
   4218    50816,50895,50973,51051,51129,51207,51285,51362,
   4219    51439,51517,51594,51671,51747,51824,51900,51977,
   4220    52053,52129,52205,52280,52356,52432,52507,52582,
   4221    52657,52732,52807,52881,52956,53030,53104,53178,
   4222    53252,53326,53400,53473,53546,53620,53693,53766,
   4223    53839,53911,53984,54056,54129,54201,54273,54345,
   4224    54417,54489,54560,54632,54703,54774,54845,54916,
   4225    54987,55058,55129,55199,55269,55340,55410,55480,
   4226    55550,55620,55689,55759,55828,55898,55967,56036,
   4227    56105,56174,56243,56311,56380,56448,56517,56585,
   4228    56653,56721,56789,56857,56924,56992,57059,57127,
   4229    57194,57261,57328,57395,57462,57529,57595,57662,
   4230    57728,57795,57861,57927,57993,58059,58125,58191,
   4231    58256,58322,58387,58453,58518,58583,58648,58713,
   4232    58778,58843,58908,58972,59037,59101,59165,59230,
   4233    59294,59358,59422,59486,59549,59613,59677,59740,
   4234    59804,59867,59930,59993,60056,60119,60182,60245,
   4235    60308,60370,60433,60495,60558,60620,60682,60744,
   4236    60806,60868,60930,60992,61054,61115,61177,61238,
   4237    61300,61361,61422,61483,61544,61605,61666,61727,
   4238    61788,61848,61909,61969,62030,62090,62150,62211,
   4239    62271,62331,62391,62450,62510,62570,62630,62689,
   4240    62749,62808,62867,62927,62986,63045,63104,63163,
   4241    63222,63281,63340,63398,63457,63515,63574,63632,
   4242    63691,63749,63807,63865,63923,63981,64039,64097,
   4243    64155,64212,64270,64328,64385,64443,64500,64557,
   4244    64614,64672,64729,64786,64843,64900,64956,65013,
   4245    65070,65126,65183,65239,65296,65352,65409,65465
   4246 };
   4247 
   4248 const png_byte png_sRGB_delta[512] =
   4249 {
   4250    207,201,158,129,113,100,90,82,77,72,68,64,61,59,56,54,
   4251    52,50,49,47,46,45,43,42,41,40,39,39,38,37,36,36,
   4252    35,34,34,33,33,32,32,31,31,30,30,30,29,29,28,28,
   4253    28,27,27,27,27,26,26,26,25,25,25,25,24,24,24,24,
   4254    23,23,23,23,23,22,22,22,22,22,22,21,21,21,21,21,
   4255    21,20,20,20,20,20,20,20,20,19,19,19,19,19,19,19,
   4256    19,18,18,18,18,18,18,18,18,18,18,17,17,17,17,17,
   4257    17,17,17,17,17,17,16,16,16,16,16,16,16,16,16,16,
   4258    16,16,16,16,15,15,15,15,15,15,15,15,15,15,15,15,
   4259    15,15,15,15,14,14,14,14,14,14,14,14,14,14,14,14,
   4260    14,14,14,14,14,14,14,13,13,13,13,13,13,13,13,13,
   4261    13,13,13,13,13,13,13,13,13,13,13,13,13,13,12,12,
   4262    12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,
   4263    12,12,12,12,12,12,12,12,12,12,12,12,11,11,11,11,
   4264    11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,
   4265    11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,
   4266    11,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,
   4267    10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,
   4268    10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,
   4269    10,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,
   4270    9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,
   4271    9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,
   4272    9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,
   4273    9,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,
   4274    8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,
   4275    8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,
   4276    8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,
   4277    8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,
   4278    8,8,8,8,8,8,8,8,8,7,7,7,7,7,7,7,
   4279    7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,
   4280    7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,
   4281    7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
   4282 };
   4283 #endif /* SIMPLIFIED READ/WRITE sRGB support */
   4284 
   4285 /* SIMPLIFIED READ/WRITE SUPPORT */
   4286 #if defined(PNG_SIMPLIFIED_READ_SUPPORTED) ||\
   4287    defined(PNG_SIMPLIFIED_WRITE_SUPPORTED)
   4288 static int
   4289 png_image_free_function(png_voidp argument)
   4290 {
   4291    png_imagep image = png_voidcast(png_imagep, argument);
   4292    png_controlp cp = image->opaque;
   4293    png_control c;
   4294 
   4295    /* Double check that we have a png_ptr - it should be impossible to get here
   4296     * without one.
   4297     */
   4298    if (cp->png_ptr == NULL)
   4299       return 0;
   4300 
   4301    /* First free any data held in the control structure. */
   4302 #  ifdef PNG_STDIO_SUPPORTED
   4303       if (cp->owned_file)
   4304       {
   4305          FILE *fp = png_voidcast(FILE*, cp->png_ptr->io_ptr);
   4306          cp->owned_file = 0;
   4307 
   4308          /* Ignore errors here. */
   4309          if (fp != NULL)
   4310          {
   4311             cp->png_ptr->io_ptr = NULL;
   4312             (void)fclose(fp);
   4313          }
   4314       }
   4315 #  endif
   4316 
   4317    /* Copy the control structure so that the original, allocated, version can be
   4318     * safely freed.  Notice that a png_error here stops the remainder of the
   4319     * cleanup, but this is probably fine because that would indicate bad memory
   4320     * problems anyway.
   4321     */
   4322    c = *cp;
   4323    image->opaque = &c;
   4324    png_free(c.png_ptr, cp);
   4325 
   4326    /* Then the structures, calling the correct API. */
   4327    if (c.for_write)
   4328    {
   4329 #     ifdef PNG_SIMPLIFIED_WRITE_SUPPORTED
   4330          png_destroy_write_struct(&c.png_ptr, &c.info_ptr);
   4331 #     else
   4332          png_error(c.png_ptr, "simplified write not supported");
   4333 #     endif
   4334    }
   4335    else
   4336    {
   4337 #     ifdef PNG_SIMPLIFIED_READ_SUPPORTED
   4338          png_destroy_read_struct(&c.png_ptr, &c.info_ptr, NULL);
   4339 #     else
   4340          png_error(c.png_ptr, "simplified read not supported");
   4341 #     endif
   4342    }
   4343 
   4344    /* Success. */
   4345    return 1;
   4346 }
   4347 
   4348 void PNGAPI
   4349 png_image_free(png_imagep image)
   4350 {
   4351    /* Safely call the real function, but only if doing so is safe at this point
   4352     * (if not inside an error handling context).  Otherwise assume
   4353     * png_safe_execute will call this API after the return.
   4354     */
   4355    if (image != NULL && image->opaque != NULL &&
   4356       image->opaque->error_buf == NULL)
   4357    {
   4358       /* Ignore errors here: */
   4359       (void)png_safe_execute(image, png_image_free_function, image);
   4360       image->opaque = NULL;
   4361    }
   4362 }
   4363 
   4364 int /* PRIVATE */
   4365 png_image_error(png_imagep image, png_const_charp error_message)
   4366 {
   4367    /* Utility to log an error. */
   4368    png_safecat(image->message, (sizeof image->message), 0, error_message);
   4369    image->warning_or_error |= PNG_IMAGE_ERROR;
   4370    png_image_free(image);
   4371    return 0;
   4372 }
   4373 
   4374 #endif /* SIMPLIFIED READ/WRITE */
   4375 #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
   4376