1 2 /* pngrutil.c - utilities to read a PNG file 3 * 4 * Last changed in libpng 1.2.44 [June 26, 2010] 5 * Copyright (c) 1998-2010 Glenn Randers-Pehrson 6 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) 7 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) 8 * 9 * This code is released under the libpng license. 10 * For conditions of distribution and use, see the disclaimer 11 * and license in png.h 12 * 13 * This file contains routines that are only called from within 14 * libpng itself during the course of reading an image. 15 */ 16 17 #define PNG_INTERNAL 18 #define PNG_NO_PEDANTIC_WARNINGS 19 #include "png.h" 20 #ifdef PNG_READ_SUPPORTED 21 22 #if defined(_WIN32_WCE) && (_WIN32_WCE<0x500) 23 # define WIN32_WCE_OLD 24 #endif 25 26 #ifdef PNG_FLOATING_POINT_SUPPORTED 27 # ifdef WIN32_WCE_OLD 28 /* The strtod() function is not supported on WindowsCE */ 29 __inline double png_strtod(png_structp png_ptr, PNG_CONST char *nptr, 30 char **endptr) 31 { 32 double result = 0; 33 int len; 34 wchar_t *str, *end; 35 36 len = MultiByteToWideChar(CP_ACP, 0, nptr, -1, NULL, 0); 37 str = (wchar_t *)png_malloc(png_ptr, len * png_sizeof(wchar_t)); 38 if ( NULL != str ) 39 { 40 MultiByteToWideChar(CP_ACP, 0, nptr, -1, str, len); 41 result = wcstod(str, &end); 42 len = WideCharToMultiByte(CP_ACP, 0, end, -1, NULL, 0, NULL, NULL); 43 *endptr = (char *)nptr + (png_strlen(nptr) - len + 1); 44 png_free(png_ptr, str); 45 } 46 return result; 47 } 48 # else 49 # define png_strtod(p,a,b) strtod(a,b) 50 # endif 51 #endif 52 53 png_uint_32 PNGAPI 54 png_get_uint_31(png_structp png_ptr, png_bytep buf) 55 { 56 #ifdef PNG_READ_BIG_ENDIAN_SUPPORTED 57 png_uint_32 i = png_get_uint_32(buf); 58 #else 59 /* Avoid an extra function call by inlining the result. */ 60 png_uint_32 i = ((png_uint_32)(*buf) << 24) + 61 ((png_uint_32)(*(buf + 1)) << 16) + 62 ((png_uint_32)(*(buf + 2)) << 8) + 63 (png_uint_32)(*(buf + 3)); 64 #endif 65 if (i > PNG_UINT_31_MAX) 66 png_error(png_ptr, "PNG unsigned integer out of range."); 67 return (i); 68 } 69 #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED 70 /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ 71 png_uint_32 PNGAPI 72 png_get_uint_32(png_bytep buf) 73 { 74 png_uint_32 i = ((png_uint_32)(*buf) << 24) + 75 ((png_uint_32)(*(buf + 1)) << 16) + 76 ((png_uint_32)(*(buf + 2)) << 8) + 77 (png_uint_32)(*(buf + 3)); 78 79 return (i); 80 } 81 82 /* Grab a signed 32-bit integer from a buffer in big-endian format. The 83 * data is stored in the PNG file in two's complement format, and it is 84 * assumed that the machine format for signed integers is the same. 85 */ 86 png_int_32 PNGAPI 87 png_get_int_32(png_bytep buf) 88 { 89 png_int_32 i = ((png_int_32)(*buf) << 24) + 90 ((png_int_32)(*(buf + 1)) << 16) + 91 ((png_int_32)(*(buf + 2)) << 8) + 92 (png_int_32)(*(buf + 3)); 93 94 return (i); 95 } 96 97 /* Grab an unsigned 16-bit integer from a buffer in big-endian format. */ 98 png_uint_16 PNGAPI 99 png_get_uint_16(png_bytep buf) 100 { 101 png_uint_16 i = (png_uint_16)(((png_uint_16)(*buf) << 8) + 102 (png_uint_16)(*(buf + 1))); 103 104 return (i); 105 } 106 #endif /* PNG_READ_BIG_ENDIAN_SUPPORTED */ 107 108 /* Read the chunk header (length + type name). 109 * Put the type name into png_ptr->chunk_name, and return the length. 110 */ 111 png_uint_32 /* PRIVATE */ 112 png_read_chunk_header(png_structp png_ptr) 113 { 114 png_byte buf[8]; 115 png_uint_32 length; 116 117 /* Read the length and the chunk name */ 118 png_read_data(png_ptr, buf, 8); 119 length = png_get_uint_31(png_ptr, buf); 120 121 /* Put the chunk name into png_ptr->chunk_name */ 122 png_memcpy(png_ptr->chunk_name, buf + 4, 4); 123 124 png_debug2(0, "Reading %s chunk, length = %lu", 125 png_ptr->chunk_name, length); 126 127 /* Reset the crc and run it over the chunk name */ 128 png_reset_crc(png_ptr); 129 png_calculate_crc(png_ptr, png_ptr->chunk_name, 4); 130 131 /* Check to see if chunk name is valid */ 132 png_check_chunk_name(png_ptr, png_ptr->chunk_name); 133 134 return length; 135 } 136 137 /* Read data, and (optionally) run it through the CRC. */ 138 void /* PRIVATE */ 139 png_crc_read(png_structp png_ptr, png_bytep buf, png_size_t length) 140 { 141 if (png_ptr == NULL) 142 return; 143 png_read_data(png_ptr, buf, length); 144 png_calculate_crc(png_ptr, buf, length); 145 } 146 147 /* Optionally skip data and then check the CRC. Depending on whether we 148 * are reading a ancillary or critical chunk, and how the program has set 149 * things up, we may calculate the CRC on the data and print a message. 150 * Returns '1' if there was a CRC error, '0' otherwise. 151 */ 152 int /* PRIVATE */ 153 png_crc_finish(png_structp png_ptr, png_uint_32 skip) 154 { 155 png_size_t i; 156 png_size_t istop = png_ptr->zbuf_size; 157 158 for (i = (png_size_t)skip; i > istop; i -= istop) 159 { 160 png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size); 161 } 162 if (i) 163 { 164 png_crc_read(png_ptr, png_ptr->zbuf, i); 165 } 166 167 if (png_crc_error(png_ptr)) 168 { 169 if (((png_ptr->chunk_name[0] & 0x20) && /* Ancillary */ 170 !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)) || 171 (!(png_ptr->chunk_name[0] & 0x20) && /* Critical */ 172 (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE))) 173 { 174 png_chunk_warning(png_ptr, "CRC error"); 175 } 176 else 177 { 178 png_chunk_error(png_ptr, "CRC error"); 179 } 180 return (1); 181 } 182 183 return (0); 184 } 185 186 /* Compare the CRC stored in the PNG file with that calculated by libpng from 187 * the data it has read thus far. 188 */ 189 int /* PRIVATE */ 190 png_crc_error(png_structp png_ptr) 191 { 192 png_byte crc_bytes[4]; 193 png_uint_32 crc; 194 int need_crc = 1; 195 196 if (png_ptr->chunk_name[0] & 0x20) /* ancillary */ 197 { 198 if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) == 199 (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN)) 200 need_crc = 0; 201 } 202 else /* critical */ 203 { 204 if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) 205 need_crc = 0; 206 } 207 208 png_read_data(png_ptr, crc_bytes, 4); 209 210 if (need_crc) 211 { 212 crc = png_get_uint_32(crc_bytes); 213 return ((int)(crc != png_ptr->crc)); 214 } 215 else 216 return (0); 217 } 218 219 #if defined(PNG_READ_zTXt_SUPPORTED) || defined(PNG_READ_iTXt_SUPPORTED) || \ 220 defined(PNG_READ_iCCP_SUPPORTED) 221 static png_size_t 222 png_inflate(png_structp png_ptr, const png_byte *data, png_size_t size, 223 png_bytep output, png_size_t output_size) 224 { 225 png_size_t count = 0; 226 227 png_ptr->zstream.next_in = (png_bytep)data; /* const_cast: VALID */ 228 png_ptr->zstream.avail_in = size; 229 230 while (1) 231 { 232 int ret, avail; 233 234 /* Reset the output buffer each time round - we empty it 235 * after every inflate call. 236 */ 237 png_ptr->zstream.next_out = png_ptr->zbuf; 238 png_ptr->zstream.avail_out = png_ptr->zbuf_size; 239 240 ret = inflate(&png_ptr->zstream, Z_NO_FLUSH); 241 avail = png_ptr->zbuf_size - png_ptr->zstream.avail_out; 242 243 /* First copy/count any new output - but only if we didn't 244 * get an error code. 245 */ 246 if ((ret == Z_OK || ret == Z_STREAM_END) && avail > 0) 247 { 248 if (output != 0 && output_size > count) 249 { 250 int copy = output_size - count; 251 if (avail < copy) copy = avail; 252 png_memcpy(output + count, png_ptr->zbuf, copy); 253 } 254 count += avail; 255 } 256 257 if (ret == Z_OK) 258 continue; 259 260 /* Termination conditions - always reset the zstream, it 261 * must be left in inflateInit state. 262 */ 263 png_ptr->zstream.avail_in = 0; 264 inflateReset(&png_ptr->zstream); 265 266 if (ret == Z_STREAM_END) 267 return count; /* NOTE: may be zero. */ 268 269 /* Now handle the error codes - the API always returns 0 270 * and the error message is dumped into the uncompressed 271 * buffer if available. 272 */ 273 { 274 PNG_CONST char *msg; 275 if (png_ptr->zstream.msg != 0) 276 msg = png_ptr->zstream.msg; 277 else 278 { 279 #if defined(PNG_STDIO_SUPPORTED) && !defined(_WIN32_WCE) 280 char umsg[52]; 281 282 switch (ret) 283 { 284 case Z_BUF_ERROR: 285 msg = "Buffer error in compressed datastream in %s chunk"; 286 break; 287 case Z_DATA_ERROR: 288 msg = "Data error in compressed datastream in %s chunk"; 289 break; 290 default: 291 msg = "Incomplete compressed datastream in %s chunk"; 292 break; 293 } 294 295 png_snprintf(umsg, sizeof umsg, msg, png_ptr->chunk_name); 296 msg = umsg; 297 #else 298 msg = "Damaged compressed datastream in chunk other than IDAT"; 299 #endif 300 } 301 302 png_warning(png_ptr, msg); 303 } 304 305 /* 0 means an error - notice that this code simple ignores 306 * zero length compressed chunks as a result. 307 */ 308 return 0; 309 } 310 } 311 312 /* 313 * Decompress trailing data in a chunk. The assumption is that chunkdata 314 * points at an allocated area holding the contents of a chunk with a 315 * trailing compressed part. What we get back is an allocated area 316 * holding the original prefix part and an uncompressed version of the 317 * trailing part (the malloc area passed in is freed). 318 */ 319 void /* PRIVATE */ 320 png_decompress_chunk(png_structp png_ptr, int comp_type, 321 png_size_t chunklength, 322 png_size_t prefix_size, png_size_t *newlength) 323 { 324 /* The caller should guarantee this */ 325 if (prefix_size > chunklength) 326 { 327 /* The recovery is to delete the chunk. */ 328 png_warning(png_ptr, "invalid chunklength"); 329 prefix_size = 0; /* To delete everything */ 330 } 331 332 else if (comp_type == PNG_COMPRESSION_TYPE_BASE) 333 { 334 png_size_t expanded_size = png_inflate(png_ptr, 335 (png_bytep)(png_ptr->chunkdata + prefix_size), 336 chunklength - prefix_size, 337 0/*output*/, 0/*output size*/); 338 339 /* Now check the limits on this chunk - if the limit fails the 340 * compressed data will be removed, the prefix will remain. 341 */ 342 #ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED 343 if (png_ptr->user_chunk_malloc_max && 344 (prefix_size + expanded_size >= png_ptr->user_chunk_malloc_max - 1)) 345 #else 346 # ifdef PNG_USER_CHUNK_MALLOC_MAX 347 if ((PNG_USER_CHUNK_MALLOC_MAX > 0) && 348 prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1) 349 # endif 350 #endif 351 png_warning(png_ptr, "Exceeded size limit while expanding chunk"); 352 353 /* If the size is zero either there was an error and a message 354 * has already been output (warning) or the size really is zero 355 * and we have nothing to do - the code will exit through the 356 * error case below. 357 */ 358 #if defined(PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED) || \ 359 defined(PNG_USER_CHUNK_MALLOC_MAX) 360 else 361 #endif 362 if (expanded_size > 0) 363 { 364 /* Success (maybe) - really uncompress the chunk. */ 365 png_size_t new_size = 0; 366 png_charp text = png_malloc_warn(png_ptr, 367 prefix_size + expanded_size + 1); 368 369 if (text != NULL) 370 { 371 png_memcpy(text, png_ptr->chunkdata, prefix_size); 372 new_size = png_inflate(png_ptr, 373 (png_bytep)(png_ptr->chunkdata + prefix_size), 374 chunklength - prefix_size, 375 (png_bytep)(text + prefix_size), expanded_size); 376 text[prefix_size + expanded_size] = 0; /* just in case */ 377 378 if (new_size == expanded_size) 379 { 380 png_free(png_ptr, png_ptr->chunkdata); 381 png_ptr->chunkdata = text; 382 *newlength = prefix_size + expanded_size; 383 return; /* The success return! */ 384 } 385 386 png_warning(png_ptr, "png_inflate logic error"); 387 png_free(png_ptr, text); 388 } 389 else 390 png_warning(png_ptr, "Not enough memory to decompress chunk."); 391 } 392 } 393 394 else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */ 395 { 396 #if defined(PNG_STDIO_SUPPORTED) && !defined(_WIN32_WCE) 397 char umsg[50]; 398 399 png_snprintf(umsg, sizeof umsg, "Unknown zTXt compression type %d", 400 comp_type); 401 png_warning(png_ptr, umsg); 402 #else 403 png_warning(png_ptr, "Unknown zTXt compression type"); 404 #endif 405 406 /* The recovery is to simply drop the data. */ 407 } 408 409 /* Generic error return - leave the prefix, delete the compressed 410 * data, reallocate the chunkdata to remove the potentially large 411 * amount of compressed data. 412 */ 413 { 414 png_charp text = png_malloc_warn(png_ptr, prefix_size + 1); 415 if (text != NULL) 416 { 417 if (prefix_size > 0) 418 png_memcpy(text, png_ptr->chunkdata, prefix_size); 419 png_free(png_ptr, png_ptr->chunkdata); 420 png_ptr->chunkdata = text; 421 422 /* This is an extra zero in the 'uncompressed' part. */ 423 *(png_ptr->chunkdata + prefix_size) = 0x00; 424 } 425 /* Ignore a malloc error here - it is safe. */ 426 } 427 428 *newlength = prefix_size; 429 } 430 #endif 431 432 /* Read and check the IDHR chunk */ 433 void /* PRIVATE */ 434 png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 435 { 436 png_byte buf[13]; 437 png_uint_32 width, height; 438 int bit_depth, color_type, compression_type, filter_type; 439 int interlace_type; 440 441 png_debug(1, "in png_handle_IHDR"); 442 443 if (png_ptr->mode & PNG_HAVE_IHDR) 444 png_error(png_ptr, "Out of place IHDR"); 445 446 /* Check the length */ 447 if (length != 13) 448 png_error(png_ptr, "Invalid IHDR chunk"); 449 450 png_ptr->mode |= PNG_HAVE_IHDR; 451 452 png_crc_read(png_ptr, buf, 13); 453 png_crc_finish(png_ptr, 0); 454 455 width = png_get_uint_31(png_ptr, buf); 456 height = png_get_uint_31(png_ptr, buf + 4); 457 bit_depth = buf[8]; 458 color_type = buf[9]; 459 compression_type = buf[10]; 460 filter_type = buf[11]; 461 interlace_type = buf[12]; 462 463 /* Set internal variables */ 464 png_ptr->width = width; 465 png_ptr->height = height; 466 png_ptr->bit_depth = (png_byte)bit_depth; 467 png_ptr->interlaced = (png_byte)interlace_type; 468 png_ptr->color_type = (png_byte)color_type; 469 #ifdef PNG_MNG_FEATURES_SUPPORTED 470 png_ptr->filter_type = (png_byte)filter_type; 471 #endif 472 png_ptr->compression_type = (png_byte)compression_type; 473 474 /* Find number of channels */ 475 switch (png_ptr->color_type) 476 { 477 case PNG_COLOR_TYPE_GRAY: 478 case PNG_COLOR_TYPE_PALETTE: 479 png_ptr->channels = 1; 480 break; 481 482 case PNG_COLOR_TYPE_RGB: 483 png_ptr->channels = 3; 484 break; 485 486 case PNG_COLOR_TYPE_GRAY_ALPHA: 487 png_ptr->channels = 2; 488 break; 489 490 case PNG_COLOR_TYPE_RGB_ALPHA: 491 png_ptr->channels = 4; 492 break; 493 } 494 495 /* Set up other useful info */ 496 png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * 497 png_ptr->channels); 498 png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width); 499 png_debug1(3, "bit_depth = %d", png_ptr->bit_depth); 500 png_debug1(3, "channels = %d", png_ptr->channels); 501 png_debug1(3, "rowbytes = %lu", png_ptr->rowbytes); 502 png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth, 503 color_type, interlace_type, compression_type, filter_type); 504 } 505 506 /* Read and check the palette */ 507 void /* PRIVATE */ 508 png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 509 { 510 png_color palette[PNG_MAX_PALETTE_LENGTH]; 511 int num, i; 512 #ifdef PNG_POINTER_INDEXING_SUPPORTED 513 png_colorp pal_ptr; 514 #endif 515 516 png_debug(1, "in png_handle_PLTE"); 517 518 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 519 png_error(png_ptr, "Missing IHDR before PLTE"); 520 521 else if (png_ptr->mode & PNG_HAVE_IDAT) 522 { 523 png_warning(png_ptr, "Invalid PLTE after IDAT"); 524 png_crc_finish(png_ptr, length); 525 return; 526 } 527 528 else if (png_ptr->mode & PNG_HAVE_PLTE) 529 png_error(png_ptr, "Duplicate PLTE chunk"); 530 531 png_ptr->mode |= PNG_HAVE_PLTE; 532 533 if (!(png_ptr->color_type&PNG_COLOR_MASK_COLOR)) 534 { 535 png_warning(png_ptr, 536 "Ignoring PLTE chunk in grayscale PNG"); 537 png_crc_finish(png_ptr, length); 538 return; 539 } 540 #ifndef PNG_READ_OPT_PLTE_SUPPORTED 541 if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE) 542 { 543 png_crc_finish(png_ptr, length); 544 return; 545 } 546 #endif 547 548 if (length > 3*PNG_MAX_PALETTE_LENGTH || length % 3) 549 { 550 if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE) 551 { 552 png_warning(png_ptr, "Invalid palette chunk"); 553 png_crc_finish(png_ptr, length); 554 return; 555 } 556 557 else 558 { 559 png_error(png_ptr, "Invalid palette chunk"); 560 } 561 } 562 563 num = (int)length / 3; 564 565 #ifdef PNG_POINTER_INDEXING_SUPPORTED 566 for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++) 567 { 568 png_byte buf[3]; 569 570 png_crc_read(png_ptr, buf, 3); 571 pal_ptr->red = buf[0]; 572 pal_ptr->green = buf[1]; 573 pal_ptr->blue = buf[2]; 574 } 575 #else 576 for (i = 0; i < num; i++) 577 { 578 png_byte buf[3]; 579 580 png_crc_read(png_ptr, buf, 3); 581 /* Don't depend upon png_color being any order */ 582 palette[i].red = buf[0]; 583 palette[i].green = buf[1]; 584 palette[i].blue = buf[2]; 585 } 586 #endif 587 588 /* If we actually NEED the PLTE chunk (ie for a paletted image), we do 589 * whatever the normal CRC configuration tells us. However, if we 590 * have an RGB image, the PLTE can be considered ancillary, so 591 * we will act as though it is. 592 */ 593 #ifndef PNG_READ_OPT_PLTE_SUPPORTED 594 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) 595 #endif 596 { 597 png_crc_finish(png_ptr, 0); 598 } 599 #ifndef PNG_READ_OPT_PLTE_SUPPORTED 600 else if (png_crc_error(png_ptr)) /* Only if we have a CRC error */ 601 { 602 /* If we don't want to use the data from an ancillary chunk, 603 we have two options: an error abort, or a warning and we 604 ignore the data in this chunk (which should be OK, since 605 it's considered ancillary for a RGB or RGBA image). */ 606 if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE)) 607 { 608 if (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) 609 { 610 png_chunk_error(png_ptr, "CRC error"); 611 } 612 else 613 { 614 png_chunk_warning(png_ptr, "CRC error"); 615 return; 616 } 617 } 618 /* Otherwise, we (optionally) emit a warning and use the chunk. */ 619 else if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)) 620 { 621 png_chunk_warning(png_ptr, "CRC error"); 622 } 623 } 624 #endif 625 626 png_set_PLTE(png_ptr, info_ptr, palette, num); 627 628 #ifdef PNG_READ_tRNS_SUPPORTED 629 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) 630 { 631 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS)) 632 { 633 if (png_ptr->num_trans > (png_uint_16)num) 634 { 635 png_warning(png_ptr, "Truncating incorrect tRNS chunk length"); 636 png_ptr->num_trans = (png_uint_16)num; 637 } 638 if (info_ptr->num_trans > (png_uint_16)num) 639 { 640 png_warning(png_ptr, "Truncating incorrect info tRNS chunk length"); 641 info_ptr->num_trans = (png_uint_16)num; 642 } 643 } 644 } 645 #endif 646 647 } 648 649 void /* PRIVATE */ 650 png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 651 { 652 png_debug(1, "in png_handle_IEND"); 653 654 if (!(png_ptr->mode & PNG_HAVE_IHDR) || !(png_ptr->mode & PNG_HAVE_IDAT)) 655 { 656 png_error(png_ptr, "No image in file"); 657 } 658 659 png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND); 660 661 if (length != 0) 662 { 663 png_warning(png_ptr, "Incorrect IEND chunk length"); 664 } 665 png_crc_finish(png_ptr, length); 666 667 info_ptr = info_ptr; /* Quiet compiler warnings about unused info_ptr */ 668 } 669 670 #ifdef PNG_READ_gAMA_SUPPORTED 671 void /* PRIVATE */ 672 png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 673 { 674 png_fixed_point igamma; 675 #ifdef PNG_FLOATING_POINT_SUPPORTED 676 float file_gamma; 677 #endif 678 png_byte buf[4]; 679 680 png_debug(1, "in png_handle_gAMA"); 681 682 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 683 png_error(png_ptr, "Missing IHDR before gAMA"); 684 else if (png_ptr->mode & PNG_HAVE_IDAT) 685 { 686 png_warning(png_ptr, "Invalid gAMA after IDAT"); 687 png_crc_finish(png_ptr, length); 688 return; 689 } 690 else if (png_ptr->mode & PNG_HAVE_PLTE) 691 /* Should be an error, but we can cope with it */ 692 png_warning(png_ptr, "Out of place gAMA chunk"); 693 694 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) 695 #ifdef PNG_READ_sRGB_SUPPORTED 696 && !(info_ptr->valid & PNG_INFO_sRGB) 697 #endif 698 ) 699 { 700 png_warning(png_ptr, "Duplicate gAMA chunk"); 701 png_crc_finish(png_ptr, length); 702 return; 703 } 704 705 if (length != 4) 706 { 707 png_warning(png_ptr, "Incorrect gAMA chunk length"); 708 png_crc_finish(png_ptr, length); 709 return; 710 } 711 712 png_crc_read(png_ptr, buf, 4); 713 if (png_crc_finish(png_ptr, 0)) 714 return; 715 716 igamma = (png_fixed_point)png_get_uint_32(buf); 717 /* Check for zero gamma */ 718 if (igamma == 0) 719 { 720 png_warning(png_ptr, 721 "Ignoring gAMA chunk with gamma=0"); 722 return; 723 } 724 725 #ifdef PNG_READ_sRGB_SUPPORTED 726 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) 727 if (PNG_OUT_OF_RANGE(igamma, 45500L, 500)) 728 { 729 png_warning(png_ptr, 730 "Ignoring incorrect gAMA value when sRGB is also present"); 731 #ifdef PNG_CONSOLE_IO_SUPPORTED 732 fprintf(stderr, "gamma = (%d/100000)", (int)igamma); 733 #endif 734 return; 735 } 736 #endif /* PNG_READ_sRGB_SUPPORTED */ 737 738 #ifdef PNG_FLOATING_POINT_SUPPORTED 739 file_gamma = (float)igamma / (float)100000.0; 740 # ifdef PNG_READ_GAMMA_SUPPORTED 741 png_ptr->gamma = file_gamma; 742 # endif 743 png_set_gAMA(png_ptr, info_ptr, file_gamma); 744 #endif 745 #ifdef PNG_FIXED_POINT_SUPPORTED 746 png_set_gAMA_fixed(png_ptr, info_ptr, igamma); 747 #endif 748 } 749 #endif 750 751 #ifdef PNG_READ_sBIT_SUPPORTED 752 void /* PRIVATE */ 753 png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 754 { 755 png_size_t truelen; 756 png_byte buf[4]; 757 758 png_debug(1, "in png_handle_sBIT"); 759 760 buf[0] = buf[1] = buf[2] = buf[3] = 0; 761 762 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 763 png_error(png_ptr, "Missing IHDR before sBIT"); 764 else if (png_ptr->mode & PNG_HAVE_IDAT) 765 { 766 png_warning(png_ptr, "Invalid sBIT after IDAT"); 767 png_crc_finish(png_ptr, length); 768 return; 769 } 770 else if (png_ptr->mode & PNG_HAVE_PLTE) 771 { 772 /* Should be an error, but we can cope with it */ 773 png_warning(png_ptr, "Out of place sBIT chunk"); 774 } 775 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) 776 { 777 png_warning(png_ptr, "Duplicate sBIT chunk"); 778 png_crc_finish(png_ptr, length); 779 return; 780 } 781 782 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) 783 truelen = 3; 784 else 785 truelen = (png_size_t)png_ptr->channels; 786 787 if (length != truelen || length > 4) 788 { 789 png_warning(png_ptr, "Incorrect sBIT chunk length"); 790 png_crc_finish(png_ptr, length); 791 return; 792 } 793 794 png_crc_read(png_ptr, buf, truelen); 795 if (png_crc_finish(png_ptr, 0)) 796 return; 797 798 if (png_ptr->color_type & PNG_COLOR_MASK_COLOR) 799 { 800 png_ptr->sig_bit.red = buf[0]; 801 png_ptr->sig_bit.green = buf[1]; 802 png_ptr->sig_bit.blue = buf[2]; 803 png_ptr->sig_bit.alpha = buf[3]; 804 } 805 else 806 { 807 png_ptr->sig_bit.gray = buf[0]; 808 png_ptr->sig_bit.red = buf[0]; 809 png_ptr->sig_bit.green = buf[0]; 810 png_ptr->sig_bit.blue = buf[0]; 811 png_ptr->sig_bit.alpha = buf[1]; 812 } 813 png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit)); 814 } 815 #endif 816 817 #ifdef PNG_READ_cHRM_SUPPORTED 818 void /* PRIVATE */ 819 png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 820 { 821 png_byte buf[32]; 822 #ifdef PNG_FLOATING_POINT_SUPPORTED 823 float white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y; 824 #endif 825 png_fixed_point int_x_white, int_y_white, int_x_red, int_y_red, int_x_green, 826 int_y_green, int_x_blue, int_y_blue; 827 828 png_uint_32 uint_x, uint_y; 829 830 png_debug(1, "in png_handle_cHRM"); 831 832 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 833 png_error(png_ptr, "Missing IHDR before cHRM"); 834 else if (png_ptr->mode & PNG_HAVE_IDAT) 835 { 836 png_warning(png_ptr, "Invalid cHRM after IDAT"); 837 png_crc_finish(png_ptr, length); 838 return; 839 } 840 else if (png_ptr->mode & PNG_HAVE_PLTE) 841 /* Should be an error, but we can cope with it */ 842 png_warning(png_ptr, "Missing PLTE before cHRM"); 843 844 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) 845 #ifdef PNG_READ_sRGB_SUPPORTED 846 && !(info_ptr->valid & PNG_INFO_sRGB) 847 #endif 848 ) 849 { 850 png_warning(png_ptr, "Duplicate cHRM chunk"); 851 png_crc_finish(png_ptr, length); 852 return; 853 } 854 855 if (length != 32) 856 { 857 png_warning(png_ptr, "Incorrect cHRM chunk length"); 858 png_crc_finish(png_ptr, length); 859 return; 860 } 861 862 png_crc_read(png_ptr, buf, 32); 863 if (png_crc_finish(png_ptr, 0)) 864 return; 865 866 uint_x = png_get_uint_32(buf); 867 uint_y = png_get_uint_32(buf + 4); 868 int_x_white = (png_fixed_point)uint_x; 869 int_y_white = (png_fixed_point)uint_y; 870 871 uint_x = png_get_uint_32(buf + 8); 872 uint_y = png_get_uint_32(buf + 12); 873 int_x_red = (png_fixed_point)uint_x; 874 int_y_red = (png_fixed_point)uint_y; 875 876 uint_x = png_get_uint_32(buf + 16); 877 uint_y = png_get_uint_32(buf + 20); 878 int_x_green = (png_fixed_point)uint_x; 879 int_y_green = (png_fixed_point)uint_y; 880 881 uint_x = png_get_uint_32(buf + 24); 882 uint_y = png_get_uint_32(buf + 28); 883 int_x_blue = (png_fixed_point)uint_x; 884 int_y_blue = (png_fixed_point)uint_y; 885 886 #ifdef PNG_FLOATING_POINT_SUPPORTED 887 white_x = (float)int_x_white / (float)100000.0; 888 white_y = (float)int_y_white / (float)100000.0; 889 red_x = (float)int_x_red / (float)100000.0; 890 red_y = (float)int_y_red / (float)100000.0; 891 green_x = (float)int_x_green / (float)100000.0; 892 green_y = (float)int_y_green / (float)100000.0; 893 blue_x = (float)int_x_blue / (float)100000.0; 894 blue_y = (float)int_y_blue / (float)100000.0; 895 #endif 896 897 #ifdef PNG_READ_sRGB_SUPPORTED 898 if ((info_ptr != NULL) && (info_ptr->valid & PNG_INFO_sRGB)) 899 { 900 if (PNG_OUT_OF_RANGE(int_x_white, 31270, 1000) || 901 PNG_OUT_OF_RANGE(int_y_white, 32900, 1000) || 902 PNG_OUT_OF_RANGE(int_x_red, 64000L, 1000) || 903 PNG_OUT_OF_RANGE(int_y_red, 33000, 1000) || 904 PNG_OUT_OF_RANGE(int_x_green, 30000, 1000) || 905 PNG_OUT_OF_RANGE(int_y_green, 60000L, 1000) || 906 PNG_OUT_OF_RANGE(int_x_blue, 15000, 1000) || 907 PNG_OUT_OF_RANGE(int_y_blue, 6000, 1000)) 908 { 909 png_warning(png_ptr, 910 "Ignoring incorrect cHRM value when sRGB is also present"); 911 #ifdef PNG_CONSOLE_IO_SUPPORTED 912 #ifdef PNG_FLOATING_POINT_SUPPORTED 913 fprintf(stderr, "wx=%f, wy=%f, rx=%f, ry=%f\n", 914 white_x, white_y, red_x, red_y); 915 fprintf(stderr, "gx=%f, gy=%f, bx=%f, by=%f\n", 916 green_x, green_y, blue_x, blue_y); 917 #else 918 fprintf(stderr, "wx=%ld, wy=%ld, rx=%ld, ry=%ld\n", 919 (long)int_x_white, (long)int_y_white, 920 (long)int_x_red, (long)int_y_red); 921 fprintf(stderr, "gx=%ld, gy=%ld, bx=%ld, by=%ld\n", 922 (long)int_x_green, (long)int_y_green, 923 (long)int_x_blue, (long)int_y_blue); 924 #endif 925 #endif /* PNG_CONSOLE_IO_SUPPORTED */ 926 } 927 return; 928 } 929 #endif /* PNG_READ_sRGB_SUPPORTED */ 930 931 #ifdef PNG_FLOATING_POINT_SUPPORTED 932 png_set_cHRM(png_ptr, info_ptr, 933 white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y); 934 #endif 935 #ifdef PNG_FIXED_POINT_SUPPORTED 936 png_set_cHRM_fixed(png_ptr, info_ptr, 937 int_x_white, int_y_white, int_x_red, int_y_red, int_x_green, 938 int_y_green, int_x_blue, int_y_blue); 939 #endif 940 } 941 #endif 942 943 #ifdef PNG_READ_sRGB_SUPPORTED 944 void /* PRIVATE */ 945 png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 946 { 947 int intent; 948 png_byte buf[1]; 949 950 png_debug(1, "in png_handle_sRGB"); 951 952 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 953 png_error(png_ptr, "Missing IHDR before sRGB"); 954 else if (png_ptr->mode & PNG_HAVE_IDAT) 955 { 956 png_warning(png_ptr, "Invalid sRGB after IDAT"); 957 png_crc_finish(png_ptr, length); 958 return; 959 } 960 else if (png_ptr->mode & PNG_HAVE_PLTE) 961 /* Should be an error, but we can cope with it */ 962 png_warning(png_ptr, "Out of place sRGB chunk"); 963 964 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) 965 { 966 png_warning(png_ptr, "Duplicate sRGB chunk"); 967 png_crc_finish(png_ptr, length); 968 return; 969 } 970 971 if (length != 1) 972 { 973 png_warning(png_ptr, "Incorrect sRGB chunk length"); 974 png_crc_finish(png_ptr, length); 975 return; 976 } 977 978 png_crc_read(png_ptr, buf, 1); 979 if (png_crc_finish(png_ptr, 0)) 980 return; 981 982 intent = buf[0]; 983 /* Check for bad intent */ 984 if (intent >= PNG_sRGB_INTENT_LAST) 985 { 986 png_warning(png_ptr, "Unknown sRGB intent"); 987 return; 988 } 989 990 #if defined(PNG_READ_gAMA_SUPPORTED) && defined(PNG_READ_GAMMA_SUPPORTED) 991 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)) 992 { 993 png_fixed_point igamma; 994 #ifdef PNG_FIXED_POINT_SUPPORTED 995 igamma=info_ptr->int_gamma; 996 #else 997 # ifdef PNG_FLOATING_POINT_SUPPORTED 998 igamma=(png_fixed_point)(info_ptr->gamma * 100000.); 999 # endif 1000 #endif 1001 if (PNG_OUT_OF_RANGE(igamma, 45500L, 500)) 1002 { 1003 png_warning(png_ptr, 1004 "Ignoring incorrect gAMA value when sRGB is also present"); 1005 #ifdef PNG_CONSOLE_IO_SUPPORTED 1006 # ifdef PNG_FIXED_POINT_SUPPORTED 1007 fprintf(stderr, "incorrect gamma=(%d/100000)\n", 1008 (int)png_ptr->int_gamma); 1009 # else 1010 # ifdef PNG_FLOATING_POINT_SUPPORTED 1011 fprintf(stderr, "incorrect gamma=%f\n", png_ptr->gamma); 1012 # endif 1013 # endif 1014 #endif 1015 } 1016 } 1017 #endif /* PNG_READ_gAMA_SUPPORTED */ 1018 1019 #ifdef PNG_READ_cHRM_SUPPORTED 1020 #ifdef PNG_FIXED_POINT_SUPPORTED 1021 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM)) 1022 if (PNG_OUT_OF_RANGE(info_ptr->int_x_white, 31270, 1000) || 1023 PNG_OUT_OF_RANGE(info_ptr->int_y_white, 32900, 1000) || 1024 PNG_OUT_OF_RANGE(info_ptr->int_x_red, 64000L, 1000) || 1025 PNG_OUT_OF_RANGE(info_ptr->int_y_red, 33000, 1000) || 1026 PNG_OUT_OF_RANGE(info_ptr->int_x_green, 30000, 1000) || 1027 PNG_OUT_OF_RANGE(info_ptr->int_y_green, 60000L, 1000) || 1028 PNG_OUT_OF_RANGE(info_ptr->int_x_blue, 15000, 1000) || 1029 PNG_OUT_OF_RANGE(info_ptr->int_y_blue, 6000, 1000)) 1030 { 1031 png_warning(png_ptr, 1032 "Ignoring incorrect cHRM value when sRGB is also present"); 1033 } 1034 #endif /* PNG_FIXED_POINT_SUPPORTED */ 1035 #endif /* PNG_READ_cHRM_SUPPORTED */ 1036 1037 png_set_sRGB_gAMA_and_cHRM(png_ptr, info_ptr, intent); 1038 } 1039 #endif /* PNG_READ_sRGB_SUPPORTED */ 1040 1041 #ifdef PNG_READ_iCCP_SUPPORTED 1042 void /* PRIVATE */ 1043 png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1044 /* Note: this does not properly handle chunks that are > 64K under DOS */ 1045 { 1046 png_byte compression_type; 1047 png_bytep pC; 1048 png_charp profile; 1049 png_uint_32 skip = 0; 1050 png_uint_32 profile_size, profile_length; 1051 png_size_t slength, prefix_length, data_length; 1052 1053 png_debug(1, "in png_handle_iCCP"); 1054 1055 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1056 png_error(png_ptr, "Missing IHDR before iCCP"); 1057 else if (png_ptr->mode & PNG_HAVE_IDAT) 1058 { 1059 png_warning(png_ptr, "Invalid iCCP after IDAT"); 1060 png_crc_finish(png_ptr, length); 1061 return; 1062 } 1063 else if (png_ptr->mode & PNG_HAVE_PLTE) 1064 /* Should be an error, but we can cope with it */ 1065 png_warning(png_ptr, "Out of place iCCP chunk"); 1066 1067 if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) 1068 { 1069 png_warning(png_ptr, "Duplicate iCCP chunk"); 1070 png_crc_finish(png_ptr, length); 1071 return; 1072 } 1073 1074 #ifdef PNG_MAX_MALLOC_64K 1075 if (length > (png_uint_32)65535L) 1076 { 1077 png_warning(png_ptr, "iCCP chunk too large to fit in memory"); 1078 skip = length - (png_uint_32)65535L; 1079 length = (png_uint_32)65535L; 1080 } 1081 #endif 1082 1083 png_free(png_ptr, png_ptr->chunkdata); 1084 png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1); 1085 slength = (png_size_t)length; 1086 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength); 1087 1088 if (png_crc_finish(png_ptr, skip)) 1089 { 1090 png_free(png_ptr, png_ptr->chunkdata); 1091 png_ptr->chunkdata = NULL; 1092 return; 1093 } 1094 1095 png_ptr->chunkdata[slength] = 0x00; 1096 1097 for (profile = png_ptr->chunkdata; *profile; profile++) 1098 /* Empty loop to find end of name */ ; 1099 1100 ++profile; 1101 1102 /* There should be at least one zero (the compression type byte) 1103 * following the separator, and we should be on it 1104 */ 1105 if ( profile >= png_ptr->chunkdata + slength - 1) 1106 { 1107 png_free(png_ptr, png_ptr->chunkdata); 1108 png_ptr->chunkdata = NULL; 1109 png_warning(png_ptr, "Malformed iCCP chunk"); 1110 return; 1111 } 1112 1113 /* Compression_type should always be zero */ 1114 compression_type = *profile++; 1115 if (compression_type) 1116 { 1117 png_warning(png_ptr, "Ignoring nonzero compression type in iCCP chunk"); 1118 compression_type = 0x00; /* Reset it to zero (libpng-1.0.6 through 1.0.8 1119 wrote nonzero) */ 1120 } 1121 1122 prefix_length = profile - png_ptr->chunkdata; 1123 png_decompress_chunk(png_ptr, compression_type, 1124 slength, prefix_length, &data_length); 1125 1126 profile_length = data_length - prefix_length; 1127 1128 if ( prefix_length > data_length || profile_length < 4) 1129 { 1130 png_free(png_ptr, png_ptr->chunkdata); 1131 png_ptr->chunkdata = NULL; 1132 png_warning(png_ptr, "Profile size field missing from iCCP chunk"); 1133 return; 1134 } 1135 1136 /* Check the profile_size recorded in the first 32 bits of the ICC profile */ 1137 pC = (png_bytep)(png_ptr->chunkdata + prefix_length); 1138 profile_size = ((*(pC ))<<24) | 1139 ((*(pC + 1))<<16) | 1140 ((*(pC + 2))<< 8) | 1141 ((*(pC + 3)) ); 1142 1143 if (profile_size < profile_length) 1144 profile_length = profile_size; 1145 1146 if (profile_size > profile_length) 1147 { 1148 png_free(png_ptr, png_ptr->chunkdata); 1149 png_ptr->chunkdata = NULL; 1150 png_warning(png_ptr, "Ignoring truncated iCCP profile."); 1151 return; 1152 } 1153 1154 png_set_iCCP(png_ptr, info_ptr, png_ptr->chunkdata, 1155 compression_type, png_ptr->chunkdata + prefix_length, profile_length); 1156 png_free(png_ptr, png_ptr->chunkdata); 1157 png_ptr->chunkdata = NULL; 1158 } 1159 #endif /* PNG_READ_iCCP_SUPPORTED */ 1160 1161 #ifdef PNG_READ_sPLT_SUPPORTED 1162 void /* PRIVATE */ 1163 png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1164 /* Note: this does not properly handle chunks that are > 64K under DOS */ 1165 { 1166 png_bytep entry_start; 1167 png_sPLT_t new_palette; 1168 #ifdef PNG_POINTER_INDEXING_SUPPORTED 1169 png_sPLT_entryp pp; 1170 #endif 1171 int data_length, entry_size, i; 1172 png_uint_32 skip = 0; 1173 png_size_t slength; 1174 1175 png_debug(1, "in png_handle_sPLT"); 1176 1177 #ifdef PNG_USER_LIMITS_SUPPORTED 1178 1179 if (png_ptr->user_chunk_cache_max != 0) 1180 { 1181 if (png_ptr->user_chunk_cache_max == 1) 1182 { 1183 png_crc_finish(png_ptr, length); 1184 return; 1185 } 1186 if (--png_ptr->user_chunk_cache_max == 1) 1187 { 1188 png_warning(png_ptr, "No space in chunk cache for sPLT"); 1189 png_crc_finish(png_ptr, length); 1190 return; 1191 } 1192 } 1193 #endif 1194 1195 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1196 png_error(png_ptr, "Missing IHDR before sPLT"); 1197 else if (png_ptr->mode & PNG_HAVE_IDAT) 1198 { 1199 png_warning(png_ptr, "Invalid sPLT after IDAT"); 1200 png_crc_finish(png_ptr, length); 1201 return; 1202 } 1203 1204 #ifdef PNG_MAX_MALLOC_64K 1205 if (length > (png_uint_32)65535L) 1206 { 1207 png_warning(png_ptr, "sPLT chunk too large to fit in memory"); 1208 skip = length - (png_uint_32)65535L; 1209 length = (png_uint_32)65535L; 1210 } 1211 #endif 1212 1213 png_free(png_ptr, png_ptr->chunkdata); 1214 png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1); 1215 slength = (png_size_t)length; 1216 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength); 1217 1218 if (png_crc_finish(png_ptr, skip)) 1219 { 1220 png_free(png_ptr, png_ptr->chunkdata); 1221 png_ptr->chunkdata = NULL; 1222 return; 1223 } 1224 1225 png_ptr->chunkdata[slength] = 0x00; 1226 1227 for (entry_start = (png_bytep)png_ptr->chunkdata; *entry_start; 1228 entry_start++) 1229 /* Empty loop to find end of name */ ; 1230 ++entry_start; 1231 1232 /* A sample depth should follow the separator, and we should be on it */ 1233 if (entry_start > (png_bytep)png_ptr->chunkdata + slength - 2) 1234 { 1235 png_free(png_ptr, png_ptr->chunkdata); 1236 png_ptr->chunkdata = NULL; 1237 png_warning(png_ptr, "malformed sPLT chunk"); 1238 return; 1239 } 1240 1241 new_palette.depth = *entry_start++; 1242 entry_size = (new_palette.depth == 8 ? 6 : 10); 1243 data_length = (slength - (entry_start - (png_bytep)png_ptr->chunkdata)); 1244 1245 /* Integrity-check the data length */ 1246 if (data_length % entry_size) 1247 { 1248 png_free(png_ptr, png_ptr->chunkdata); 1249 png_ptr->chunkdata = NULL; 1250 png_warning(png_ptr, "sPLT chunk has bad length"); 1251 return; 1252 } 1253 1254 new_palette.nentries = (png_int_32) ( data_length / entry_size); 1255 if ((png_uint_32) new_palette.nentries > 1256 (png_uint_32) (PNG_SIZE_MAX / png_sizeof(png_sPLT_entry))) 1257 { 1258 png_warning(png_ptr, "sPLT chunk too long"); 1259 return; 1260 } 1261 new_palette.entries = (png_sPLT_entryp)png_malloc_warn( 1262 png_ptr, new_palette.nentries * png_sizeof(png_sPLT_entry)); 1263 if (new_palette.entries == NULL) 1264 { 1265 png_warning(png_ptr, "sPLT chunk requires too much memory"); 1266 return; 1267 } 1268 1269 #ifdef PNG_POINTER_INDEXING_SUPPORTED 1270 for (i = 0; i < new_palette.nentries; i++) 1271 { 1272 pp = new_palette.entries + i; 1273 1274 if (new_palette.depth == 8) 1275 { 1276 pp->red = *entry_start++; 1277 pp->green = *entry_start++; 1278 pp->blue = *entry_start++; 1279 pp->alpha = *entry_start++; 1280 } 1281 else 1282 { 1283 pp->red = png_get_uint_16(entry_start); entry_start += 2; 1284 pp->green = png_get_uint_16(entry_start); entry_start += 2; 1285 pp->blue = png_get_uint_16(entry_start); entry_start += 2; 1286 pp->alpha = png_get_uint_16(entry_start); entry_start += 2; 1287 } 1288 pp->frequency = png_get_uint_16(entry_start); entry_start += 2; 1289 } 1290 #else 1291 pp = new_palette.entries; 1292 for (i = 0; i < new_palette.nentries; i++) 1293 { 1294 1295 if (new_palette.depth == 8) 1296 { 1297 pp[i].red = *entry_start++; 1298 pp[i].green = *entry_start++; 1299 pp[i].blue = *entry_start++; 1300 pp[i].alpha = *entry_start++; 1301 } 1302 else 1303 { 1304 pp[i].red = png_get_uint_16(entry_start); entry_start += 2; 1305 pp[i].green = png_get_uint_16(entry_start); entry_start += 2; 1306 pp[i].blue = png_get_uint_16(entry_start); entry_start += 2; 1307 pp[i].alpha = png_get_uint_16(entry_start); entry_start += 2; 1308 } 1309 pp->frequency = png_get_uint_16(entry_start); entry_start += 2; 1310 } 1311 #endif 1312 1313 /* Discard all chunk data except the name and stash that */ 1314 new_palette.name = png_ptr->chunkdata; 1315 1316 png_set_sPLT(png_ptr, info_ptr, &new_palette, 1); 1317 1318 png_free(png_ptr, png_ptr->chunkdata); 1319 png_ptr->chunkdata = NULL; 1320 png_free(png_ptr, new_palette.entries); 1321 } 1322 #endif /* PNG_READ_sPLT_SUPPORTED */ 1323 1324 #ifdef PNG_READ_tRNS_SUPPORTED 1325 void /* PRIVATE */ 1326 png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1327 { 1328 png_byte readbuf[PNG_MAX_PALETTE_LENGTH]; 1329 1330 png_debug(1, "in png_handle_tRNS"); 1331 1332 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1333 png_error(png_ptr, "Missing IHDR before tRNS"); 1334 else if (png_ptr->mode & PNG_HAVE_IDAT) 1335 { 1336 png_warning(png_ptr, "Invalid tRNS after IDAT"); 1337 png_crc_finish(png_ptr, length); 1338 return; 1339 } 1340 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS)) 1341 { 1342 png_warning(png_ptr, "Duplicate tRNS chunk"); 1343 png_crc_finish(png_ptr, length); 1344 return; 1345 } 1346 1347 if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) 1348 { 1349 png_byte buf[2]; 1350 1351 if (length != 2) 1352 { 1353 png_warning(png_ptr, "Incorrect tRNS chunk length"); 1354 png_crc_finish(png_ptr, length); 1355 return; 1356 } 1357 1358 png_crc_read(png_ptr, buf, 2); 1359 png_ptr->num_trans = 1; 1360 png_ptr->trans_values.gray = png_get_uint_16(buf); 1361 } 1362 else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) 1363 { 1364 png_byte buf[6]; 1365 1366 if (length != 6) 1367 { 1368 png_warning(png_ptr, "Incorrect tRNS chunk length"); 1369 png_crc_finish(png_ptr, length); 1370 return; 1371 } 1372 png_crc_read(png_ptr, buf, (png_size_t)length); 1373 png_ptr->num_trans = 1; 1374 png_ptr->trans_values.red = png_get_uint_16(buf); 1375 png_ptr->trans_values.green = png_get_uint_16(buf + 2); 1376 png_ptr->trans_values.blue = png_get_uint_16(buf + 4); 1377 } 1378 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) 1379 { 1380 if (!(png_ptr->mode & PNG_HAVE_PLTE)) 1381 { 1382 /* Should be an error, but we can cope with it. */ 1383 png_warning(png_ptr, "Missing PLTE before tRNS"); 1384 } 1385 if (length > (png_uint_32)png_ptr->num_palette || 1386 length > PNG_MAX_PALETTE_LENGTH) 1387 { 1388 png_warning(png_ptr, "Incorrect tRNS chunk length"); 1389 png_crc_finish(png_ptr, length); 1390 return; 1391 } 1392 if (length == 0) 1393 { 1394 png_warning(png_ptr, "Zero length tRNS chunk"); 1395 png_crc_finish(png_ptr, length); 1396 return; 1397 } 1398 png_crc_read(png_ptr, readbuf, (png_size_t)length); 1399 png_ptr->num_trans = (png_uint_16)length; 1400 } 1401 else 1402 { 1403 png_warning(png_ptr, "tRNS chunk not allowed with alpha channel"); 1404 png_crc_finish(png_ptr, length); 1405 return; 1406 } 1407 1408 if (png_crc_finish(png_ptr, 0)) 1409 { 1410 png_ptr->num_trans = 0; 1411 return; 1412 } 1413 1414 png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans, 1415 &(png_ptr->trans_values)); 1416 } 1417 #endif 1418 1419 #ifdef PNG_READ_bKGD_SUPPORTED 1420 void /* PRIVATE */ 1421 png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1422 { 1423 png_size_t truelen; 1424 png_byte buf[6]; 1425 1426 png_debug(1, "in png_handle_bKGD"); 1427 1428 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1429 png_error(png_ptr, "Missing IHDR before bKGD"); 1430 else if (png_ptr->mode & PNG_HAVE_IDAT) 1431 { 1432 png_warning(png_ptr, "Invalid bKGD after IDAT"); 1433 png_crc_finish(png_ptr, length); 1434 return; 1435 } 1436 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE && 1437 !(png_ptr->mode & PNG_HAVE_PLTE)) 1438 { 1439 png_warning(png_ptr, "Missing PLTE before bKGD"); 1440 png_crc_finish(png_ptr, length); 1441 return; 1442 } 1443 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD)) 1444 { 1445 png_warning(png_ptr, "Duplicate bKGD chunk"); 1446 png_crc_finish(png_ptr, length); 1447 return; 1448 } 1449 1450 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) 1451 truelen = 1; 1452 else if (png_ptr->color_type & PNG_COLOR_MASK_COLOR) 1453 truelen = 6; 1454 else 1455 truelen = 2; 1456 1457 if (length != truelen) 1458 { 1459 png_warning(png_ptr, "Incorrect bKGD chunk length"); 1460 png_crc_finish(png_ptr, length); 1461 return; 1462 } 1463 1464 png_crc_read(png_ptr, buf, truelen); 1465 if (png_crc_finish(png_ptr, 0)) 1466 return; 1467 1468 /* We convert the index value into RGB components so that we can allow 1469 * arbitrary RGB values for background when we have transparency, and 1470 * so it is easy to determine the RGB values of the background color 1471 * from the info_ptr struct. */ 1472 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) 1473 { 1474 png_ptr->background.index = buf[0]; 1475 if (info_ptr && info_ptr->num_palette) 1476 { 1477 if (buf[0] >= info_ptr->num_palette) 1478 { 1479 png_warning(png_ptr, "Incorrect bKGD chunk index value"); 1480 return; 1481 } 1482 png_ptr->background.red = 1483 (png_uint_16)png_ptr->palette[buf[0]].red; 1484 png_ptr->background.green = 1485 (png_uint_16)png_ptr->palette[buf[0]].green; 1486 png_ptr->background.blue = 1487 (png_uint_16)png_ptr->palette[buf[0]].blue; 1488 } 1489 } 1490 else if (!(png_ptr->color_type & PNG_COLOR_MASK_COLOR)) /* GRAY */ 1491 { 1492 png_ptr->background.red = 1493 png_ptr->background.green = 1494 png_ptr->background.blue = 1495 png_ptr->background.gray = png_get_uint_16(buf); 1496 } 1497 else 1498 { 1499 png_ptr->background.red = png_get_uint_16(buf); 1500 png_ptr->background.green = png_get_uint_16(buf + 2); 1501 png_ptr->background.blue = png_get_uint_16(buf + 4); 1502 } 1503 1504 png_set_bKGD(png_ptr, info_ptr, &(png_ptr->background)); 1505 } 1506 #endif 1507 1508 #ifdef PNG_READ_hIST_SUPPORTED 1509 void /* PRIVATE */ 1510 png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1511 { 1512 unsigned int num, i; 1513 png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH]; 1514 1515 png_debug(1, "in png_handle_hIST"); 1516 1517 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1518 png_error(png_ptr, "Missing IHDR before hIST"); 1519 else if (png_ptr->mode & PNG_HAVE_IDAT) 1520 { 1521 png_warning(png_ptr, "Invalid hIST after IDAT"); 1522 png_crc_finish(png_ptr, length); 1523 return; 1524 } 1525 else if (!(png_ptr->mode & PNG_HAVE_PLTE)) 1526 { 1527 png_warning(png_ptr, "Missing PLTE before hIST"); 1528 png_crc_finish(png_ptr, length); 1529 return; 1530 } 1531 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST)) 1532 { 1533 png_warning(png_ptr, "Duplicate hIST chunk"); 1534 png_crc_finish(png_ptr, length); 1535 return; 1536 } 1537 1538 num = length / 2 ; 1539 if (num != (unsigned int) png_ptr->num_palette || num > 1540 (unsigned int) PNG_MAX_PALETTE_LENGTH) 1541 { 1542 png_warning(png_ptr, "Incorrect hIST chunk length"); 1543 png_crc_finish(png_ptr, length); 1544 return; 1545 } 1546 1547 for (i = 0; i < num; i++) 1548 { 1549 png_byte buf[2]; 1550 1551 png_crc_read(png_ptr, buf, 2); 1552 readbuf[i] = png_get_uint_16(buf); 1553 } 1554 1555 if (png_crc_finish(png_ptr, 0)) 1556 return; 1557 1558 png_set_hIST(png_ptr, info_ptr, readbuf); 1559 } 1560 #endif 1561 1562 #ifdef PNG_READ_pHYs_SUPPORTED 1563 void /* PRIVATE */ 1564 png_handle_pHYs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1565 { 1566 png_byte buf[9]; 1567 png_uint_32 res_x, res_y; 1568 int unit_type; 1569 1570 png_debug(1, "in png_handle_pHYs"); 1571 1572 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1573 png_error(png_ptr, "Missing IHDR before pHYs"); 1574 else if (png_ptr->mode & PNG_HAVE_IDAT) 1575 { 1576 png_warning(png_ptr, "Invalid pHYs after IDAT"); 1577 png_crc_finish(png_ptr, length); 1578 return; 1579 } 1580 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs)) 1581 { 1582 png_warning(png_ptr, "Duplicate pHYs chunk"); 1583 png_crc_finish(png_ptr, length); 1584 return; 1585 } 1586 1587 if (length != 9) 1588 { 1589 png_warning(png_ptr, "Incorrect pHYs chunk length"); 1590 png_crc_finish(png_ptr, length); 1591 return; 1592 } 1593 1594 png_crc_read(png_ptr, buf, 9); 1595 if (png_crc_finish(png_ptr, 0)) 1596 return; 1597 1598 res_x = png_get_uint_32(buf); 1599 res_y = png_get_uint_32(buf + 4); 1600 unit_type = buf[8]; 1601 png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type); 1602 } 1603 #endif 1604 1605 #ifdef PNG_READ_oFFs_SUPPORTED 1606 void /* PRIVATE */ 1607 png_handle_oFFs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1608 { 1609 png_byte buf[9]; 1610 png_int_32 offset_x, offset_y; 1611 int unit_type; 1612 1613 png_debug(1, "in png_handle_oFFs"); 1614 1615 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1616 png_error(png_ptr, "Missing IHDR before oFFs"); 1617 else if (png_ptr->mode & PNG_HAVE_IDAT) 1618 { 1619 png_warning(png_ptr, "Invalid oFFs after IDAT"); 1620 png_crc_finish(png_ptr, length); 1621 return; 1622 } 1623 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs)) 1624 { 1625 png_warning(png_ptr, "Duplicate oFFs chunk"); 1626 png_crc_finish(png_ptr, length); 1627 return; 1628 } 1629 1630 if (length != 9) 1631 { 1632 png_warning(png_ptr, "Incorrect oFFs chunk length"); 1633 png_crc_finish(png_ptr, length); 1634 return; 1635 } 1636 1637 png_crc_read(png_ptr, buf, 9); 1638 if (png_crc_finish(png_ptr, 0)) 1639 return; 1640 1641 offset_x = png_get_int_32(buf); 1642 offset_y = png_get_int_32(buf + 4); 1643 unit_type = buf[8]; 1644 png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type); 1645 } 1646 #endif 1647 1648 #ifdef PNG_READ_pCAL_SUPPORTED 1649 /* Read the pCAL chunk (described in the PNG Extensions document) */ 1650 void /* PRIVATE */ 1651 png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1652 { 1653 png_int_32 X0, X1; 1654 png_byte type, nparams; 1655 png_charp buf, units, endptr; 1656 png_charpp params; 1657 png_size_t slength; 1658 int i; 1659 1660 png_debug(1, "in png_handle_pCAL"); 1661 1662 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1663 png_error(png_ptr, "Missing IHDR before pCAL"); 1664 else if (png_ptr->mode & PNG_HAVE_IDAT) 1665 { 1666 png_warning(png_ptr, "Invalid pCAL after IDAT"); 1667 png_crc_finish(png_ptr, length); 1668 return; 1669 } 1670 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL)) 1671 { 1672 png_warning(png_ptr, "Duplicate pCAL chunk"); 1673 png_crc_finish(png_ptr, length); 1674 return; 1675 } 1676 1677 png_debug1(2, "Allocating and reading pCAL chunk data (%lu bytes)", 1678 length + 1); 1679 png_free(png_ptr, png_ptr->chunkdata); 1680 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1); 1681 if (png_ptr->chunkdata == NULL) 1682 { 1683 png_warning(png_ptr, "No memory for pCAL purpose."); 1684 return; 1685 } 1686 slength = (png_size_t)length; 1687 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength); 1688 1689 if (png_crc_finish(png_ptr, 0)) 1690 { 1691 png_free(png_ptr, png_ptr->chunkdata); 1692 png_ptr->chunkdata = NULL; 1693 return; 1694 } 1695 1696 png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */ 1697 1698 png_debug(3, "Finding end of pCAL purpose string"); 1699 for (buf = png_ptr->chunkdata; *buf; buf++) 1700 /* Empty loop */ ; 1701 1702 endptr = png_ptr->chunkdata + slength; 1703 1704 /* We need to have at least 12 bytes after the purpose string 1705 in order to get the parameter information. */ 1706 if (endptr <= buf + 12) 1707 { 1708 png_warning(png_ptr, "Invalid pCAL data"); 1709 png_free(png_ptr, png_ptr->chunkdata); 1710 png_ptr->chunkdata = NULL; 1711 return; 1712 } 1713 1714 png_debug(3, "Reading pCAL X0, X1, type, nparams, and units"); 1715 X0 = png_get_int_32((png_bytep)buf+1); 1716 X1 = png_get_int_32((png_bytep)buf+5); 1717 type = buf[9]; 1718 nparams = buf[10]; 1719 units = buf + 11; 1720 1721 png_debug(3, "Checking pCAL equation type and number of parameters"); 1722 /* Check that we have the right number of parameters for known 1723 equation types. */ 1724 if ((type == PNG_EQUATION_LINEAR && nparams != 2) || 1725 (type == PNG_EQUATION_BASE_E && nparams != 3) || 1726 (type == PNG_EQUATION_ARBITRARY && nparams != 3) || 1727 (type == PNG_EQUATION_HYPERBOLIC && nparams != 4)) 1728 { 1729 png_warning(png_ptr, "Invalid pCAL parameters for equation type"); 1730 png_free(png_ptr, png_ptr->chunkdata); 1731 png_ptr->chunkdata = NULL; 1732 return; 1733 } 1734 else if (type >= PNG_EQUATION_LAST) 1735 { 1736 png_warning(png_ptr, "Unrecognized equation type for pCAL chunk"); 1737 } 1738 1739 for (buf = units; *buf; buf++) 1740 /* Empty loop to move past the units string. */ ; 1741 1742 png_debug(3, "Allocating pCAL parameters array"); 1743 params = (png_charpp)png_malloc_warn(png_ptr, 1744 (png_uint_32)(nparams * png_sizeof(png_charp))) ; 1745 if (params == NULL) 1746 { 1747 png_free(png_ptr, png_ptr->chunkdata); 1748 png_ptr->chunkdata = NULL; 1749 png_warning(png_ptr, "No memory for pCAL params."); 1750 return; 1751 } 1752 1753 /* Get pointers to the start of each parameter string. */ 1754 for (i = 0; i < (int)nparams; i++) 1755 { 1756 buf++; /* Skip the null string terminator from previous parameter. */ 1757 1758 png_debug1(3, "Reading pCAL parameter %d", i); 1759 for (params[i] = buf; buf <= endptr && *buf != 0x00; buf++) 1760 /* Empty loop to move past each parameter string */ ; 1761 1762 /* Make sure we haven't run out of data yet */ 1763 if (buf > endptr) 1764 { 1765 png_warning(png_ptr, "Invalid pCAL data"); 1766 png_free(png_ptr, png_ptr->chunkdata); 1767 png_ptr->chunkdata = NULL; 1768 png_free(png_ptr, params); 1769 return; 1770 } 1771 } 1772 1773 png_set_pCAL(png_ptr, info_ptr, png_ptr->chunkdata, X0, X1, type, nparams, 1774 units, params); 1775 1776 png_free(png_ptr, png_ptr->chunkdata); 1777 png_ptr->chunkdata = NULL; 1778 png_free(png_ptr, params); 1779 } 1780 #endif 1781 1782 #ifdef PNG_READ_sCAL_SUPPORTED 1783 /* Read the sCAL chunk */ 1784 void /* PRIVATE */ 1785 png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1786 { 1787 png_charp ep; 1788 #ifdef PNG_FLOATING_POINT_SUPPORTED 1789 double width, height; 1790 png_charp vp; 1791 #else 1792 #ifdef PNG_FIXED_POINT_SUPPORTED 1793 png_charp swidth, sheight; 1794 #endif 1795 #endif 1796 png_size_t slength; 1797 1798 png_debug(1, "in png_handle_sCAL"); 1799 1800 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1801 png_error(png_ptr, "Missing IHDR before sCAL"); 1802 else if (png_ptr->mode & PNG_HAVE_IDAT) 1803 { 1804 png_warning(png_ptr, "Invalid sCAL after IDAT"); 1805 png_crc_finish(png_ptr, length); 1806 return; 1807 } 1808 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL)) 1809 { 1810 png_warning(png_ptr, "Duplicate sCAL chunk"); 1811 png_crc_finish(png_ptr, length); 1812 return; 1813 } 1814 1815 png_debug1(2, "Allocating and reading sCAL chunk data (%lu bytes)", 1816 length + 1); 1817 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1); 1818 if (png_ptr->chunkdata == NULL) 1819 { 1820 png_warning(png_ptr, "Out of memory while processing sCAL chunk"); 1821 png_crc_finish(png_ptr, length); 1822 return; 1823 } 1824 slength = (png_size_t)length; 1825 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength); 1826 1827 if (png_crc_finish(png_ptr, 0)) 1828 { 1829 png_free(png_ptr, png_ptr->chunkdata); 1830 png_ptr->chunkdata = NULL; 1831 return; 1832 } 1833 1834 png_ptr->chunkdata[slength] = 0x00; /* Null terminate the last string */ 1835 1836 ep = png_ptr->chunkdata + 1; /* Skip unit byte */ 1837 1838 #ifdef PNG_FLOATING_POINT_SUPPORTED 1839 width = png_strtod(png_ptr, ep, &vp); 1840 if (*vp) 1841 { 1842 png_warning(png_ptr, "malformed width string in sCAL chunk"); 1843 png_free(png_ptr, png_ptr->chunkdata); 1844 png_ptr->chunkdata = NULL; 1845 return; 1846 } 1847 #else 1848 #ifdef PNG_FIXED_POINT_SUPPORTED 1849 swidth = (png_charp)png_malloc_warn(png_ptr, png_strlen(ep) + 1); 1850 if (swidth == NULL) 1851 { 1852 png_warning(png_ptr, "Out of memory while processing sCAL chunk width"); 1853 png_free(png_ptr, png_ptr->chunkdata); 1854 png_ptr->chunkdata = NULL; 1855 return; 1856 } 1857 png_memcpy(swidth, ep, (png_size_t)png_strlen(ep)); 1858 #endif 1859 #endif 1860 1861 for (ep = png_ptr->chunkdata; *ep; ep++) 1862 /* Empty loop */ ; 1863 ep++; 1864 1865 if (png_ptr->chunkdata + slength < ep) 1866 { 1867 png_warning(png_ptr, "Truncated sCAL chunk"); 1868 #if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED) 1869 png_free(png_ptr, swidth); 1870 #endif 1871 png_free(png_ptr, png_ptr->chunkdata); 1872 png_ptr->chunkdata = NULL; 1873 return; 1874 } 1875 1876 #ifdef PNG_FLOATING_POINT_SUPPORTED 1877 height = png_strtod(png_ptr, ep, &vp); 1878 if (*vp) 1879 { 1880 png_warning(png_ptr, "malformed height string in sCAL chunk"); 1881 png_free(png_ptr, png_ptr->chunkdata); 1882 png_ptr->chunkdata = NULL; 1883 #if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED) 1884 png_free(png_ptr, swidth); 1885 #endif 1886 return; 1887 } 1888 #else 1889 #ifdef PNG_FIXED_POINT_SUPPORTED 1890 sheight = (png_charp)png_malloc_warn(png_ptr, png_strlen(ep) + 1); 1891 if (sheight == NULL) 1892 { 1893 png_warning(png_ptr, "Out of memory while processing sCAL chunk height"); 1894 png_free(png_ptr, png_ptr->chunkdata); 1895 png_ptr->chunkdata = NULL; 1896 #if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED) 1897 png_free(png_ptr, swidth); 1898 #endif 1899 return; 1900 } 1901 png_memcpy(sheight, ep, (png_size_t)png_strlen(ep)); 1902 #endif 1903 #endif 1904 1905 if (png_ptr->chunkdata + slength < ep 1906 #ifdef PNG_FLOATING_POINT_SUPPORTED 1907 || width <= 0. || height <= 0. 1908 #endif 1909 ) 1910 { 1911 png_warning(png_ptr, "Invalid sCAL data"); 1912 png_free(png_ptr, png_ptr->chunkdata); 1913 png_ptr->chunkdata = NULL; 1914 #if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED) 1915 png_free(png_ptr, swidth); 1916 png_free(png_ptr, sheight); 1917 #endif 1918 return; 1919 } 1920 1921 1922 #ifdef PNG_FLOATING_POINT_SUPPORTED 1923 png_set_sCAL(png_ptr, info_ptr, png_ptr->chunkdata[0], width, height); 1924 #else 1925 #ifdef PNG_FIXED_POINT_SUPPORTED 1926 png_set_sCAL_s(png_ptr, info_ptr, png_ptr->chunkdata[0], swidth, sheight); 1927 #endif 1928 #endif 1929 1930 png_free(png_ptr, png_ptr->chunkdata); 1931 png_ptr->chunkdata = NULL; 1932 #if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED) 1933 png_free(png_ptr, swidth); 1934 png_free(png_ptr, sheight); 1935 #endif 1936 } 1937 #endif 1938 1939 #ifdef PNG_READ_tIME_SUPPORTED 1940 void /* PRIVATE */ 1941 png_handle_tIME(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1942 { 1943 png_byte buf[7]; 1944 png_time mod_time; 1945 1946 png_debug(1, "in png_handle_tIME"); 1947 1948 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 1949 png_error(png_ptr, "Out of place tIME chunk"); 1950 else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME)) 1951 { 1952 png_warning(png_ptr, "Duplicate tIME chunk"); 1953 png_crc_finish(png_ptr, length); 1954 return; 1955 } 1956 1957 if (png_ptr->mode & PNG_HAVE_IDAT) 1958 png_ptr->mode |= PNG_AFTER_IDAT; 1959 1960 if (length != 7) 1961 { 1962 png_warning(png_ptr, "Incorrect tIME chunk length"); 1963 png_crc_finish(png_ptr, length); 1964 return; 1965 } 1966 1967 png_crc_read(png_ptr, buf, 7); 1968 if (png_crc_finish(png_ptr, 0)) 1969 return; 1970 1971 mod_time.second = buf[6]; 1972 mod_time.minute = buf[5]; 1973 mod_time.hour = buf[4]; 1974 mod_time.day = buf[3]; 1975 mod_time.month = buf[2]; 1976 mod_time.year = png_get_uint_16(buf); 1977 1978 png_set_tIME(png_ptr, info_ptr, &mod_time); 1979 } 1980 #endif 1981 1982 #ifdef PNG_READ_tEXt_SUPPORTED 1983 /* Note: this does not properly handle chunks that are > 64K under DOS */ 1984 void /* PRIVATE */ 1985 png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 1986 { 1987 png_textp text_ptr; 1988 png_charp key; 1989 png_charp text; 1990 png_uint_32 skip = 0; 1991 png_size_t slength; 1992 int ret; 1993 1994 png_debug(1, "in png_handle_tEXt"); 1995 1996 #ifdef PNG_USER_LIMITS_SUPPORTED 1997 if (png_ptr->user_chunk_cache_max != 0) 1998 { 1999 if (png_ptr->user_chunk_cache_max == 1) 2000 { 2001 png_crc_finish(png_ptr, length); 2002 return; 2003 } 2004 if (--png_ptr->user_chunk_cache_max == 1) 2005 { 2006 png_warning(png_ptr, "No space in chunk cache for tEXt"); 2007 png_crc_finish(png_ptr, length); 2008 return; 2009 } 2010 } 2011 #endif 2012 2013 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 2014 png_error(png_ptr, "Missing IHDR before tEXt"); 2015 2016 if (png_ptr->mode & PNG_HAVE_IDAT) 2017 png_ptr->mode |= PNG_AFTER_IDAT; 2018 2019 #ifdef PNG_MAX_MALLOC_64K 2020 if (length > (png_uint_32)65535L) 2021 { 2022 png_warning(png_ptr, "tEXt chunk too large to fit in memory"); 2023 skip = length - (png_uint_32)65535L; 2024 length = (png_uint_32)65535L; 2025 } 2026 #endif 2027 2028 png_free(png_ptr, png_ptr->chunkdata); 2029 2030 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1); 2031 if (png_ptr->chunkdata == NULL) 2032 { 2033 png_warning(png_ptr, "No memory to process text chunk."); 2034 return; 2035 } 2036 slength = (png_size_t)length; 2037 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength); 2038 2039 if (png_crc_finish(png_ptr, skip)) 2040 { 2041 png_free(png_ptr, png_ptr->chunkdata); 2042 png_ptr->chunkdata = NULL; 2043 return; 2044 } 2045 2046 key = png_ptr->chunkdata; 2047 2048 key[slength] = 0x00; 2049 2050 for (text = key; *text; text++) 2051 /* Empty loop to find end of key */ ; 2052 2053 if (text != key + slength) 2054 text++; 2055 2056 text_ptr = (png_textp)png_malloc_warn(png_ptr, 2057 (png_uint_32)png_sizeof(png_text)); 2058 if (text_ptr == NULL) 2059 { 2060 png_warning(png_ptr, "Not enough memory to process text chunk."); 2061 png_free(png_ptr, png_ptr->chunkdata); 2062 png_ptr->chunkdata = NULL; 2063 return; 2064 } 2065 text_ptr->compression = PNG_TEXT_COMPRESSION_NONE; 2066 text_ptr->key = key; 2067 #ifdef PNG_iTXt_SUPPORTED 2068 text_ptr->lang = NULL; 2069 text_ptr->lang_key = NULL; 2070 text_ptr->itxt_length = 0; 2071 #endif 2072 text_ptr->text = text; 2073 text_ptr->text_length = png_strlen(text); 2074 2075 ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1); 2076 2077 png_free(png_ptr, png_ptr->chunkdata); 2078 png_ptr->chunkdata = NULL; 2079 png_free(png_ptr, text_ptr); 2080 if (ret) 2081 png_warning(png_ptr, "Insufficient memory to process text chunk."); 2082 } 2083 #endif 2084 2085 #ifdef PNG_READ_zTXt_SUPPORTED 2086 /* Note: this does not correctly handle chunks that are > 64K under DOS */ 2087 void /* PRIVATE */ 2088 png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 2089 { 2090 png_textp text_ptr; 2091 png_charp text; 2092 int comp_type; 2093 int ret; 2094 png_size_t slength, prefix_len, data_len; 2095 2096 png_debug(1, "in png_handle_zTXt"); 2097 2098 #ifdef PNG_USER_LIMITS_SUPPORTED 2099 if (png_ptr->user_chunk_cache_max != 0) 2100 { 2101 if (png_ptr->user_chunk_cache_max == 1) 2102 { 2103 png_crc_finish(png_ptr, length); 2104 return; 2105 } 2106 if (--png_ptr->user_chunk_cache_max == 1) 2107 { 2108 png_warning(png_ptr, "No space in chunk cache for zTXt"); 2109 png_crc_finish(png_ptr, length); 2110 return; 2111 } 2112 } 2113 #endif 2114 2115 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 2116 png_error(png_ptr, "Missing IHDR before zTXt"); 2117 2118 if (png_ptr->mode & PNG_HAVE_IDAT) 2119 png_ptr->mode |= PNG_AFTER_IDAT; 2120 2121 #ifdef PNG_MAX_MALLOC_64K 2122 /* We will no doubt have problems with chunks even half this size, but 2123 there is no hard and fast rule to tell us where to stop. */ 2124 if (length > (png_uint_32)65535L) 2125 { 2126 png_warning(png_ptr, "zTXt chunk too large to fit in memory"); 2127 png_crc_finish(png_ptr, length); 2128 return; 2129 } 2130 #endif 2131 2132 png_free(png_ptr, png_ptr->chunkdata); 2133 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1); 2134 if (png_ptr->chunkdata == NULL) 2135 { 2136 png_warning(png_ptr, "Out of memory processing zTXt chunk."); 2137 return; 2138 } 2139 slength = (png_size_t)length; 2140 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength); 2141 if (png_crc_finish(png_ptr, 0)) 2142 { 2143 png_free(png_ptr, png_ptr->chunkdata); 2144 png_ptr->chunkdata = NULL; 2145 return; 2146 } 2147 2148 png_ptr->chunkdata[slength] = 0x00; 2149 2150 for (text = png_ptr->chunkdata; *text; text++) 2151 /* Empty loop */ ; 2152 2153 /* zTXt must have some text after the chunkdataword */ 2154 if (text >= png_ptr->chunkdata + slength - 2) 2155 { 2156 png_warning(png_ptr, "Truncated zTXt chunk"); 2157 png_free(png_ptr, png_ptr->chunkdata); 2158 png_ptr->chunkdata = NULL; 2159 return; 2160 } 2161 else 2162 { 2163 comp_type = *(++text); 2164 if (comp_type != PNG_TEXT_COMPRESSION_zTXt) 2165 { 2166 png_warning(png_ptr, "Unknown compression type in zTXt chunk"); 2167 comp_type = PNG_TEXT_COMPRESSION_zTXt; 2168 } 2169 text++; /* Skip the compression_method byte */ 2170 } 2171 prefix_len = text - png_ptr->chunkdata; 2172 2173 png_decompress_chunk(png_ptr, comp_type, 2174 (png_size_t)length, prefix_len, &data_len); 2175 2176 text_ptr = (png_textp)png_malloc_warn(png_ptr, 2177 (png_uint_32)png_sizeof(png_text)); 2178 if (text_ptr == NULL) 2179 { 2180 png_warning(png_ptr, "Not enough memory to process zTXt chunk."); 2181 png_free(png_ptr, png_ptr->chunkdata); 2182 png_ptr->chunkdata = NULL; 2183 return; 2184 } 2185 text_ptr->compression = comp_type; 2186 text_ptr->key = png_ptr->chunkdata; 2187 #ifdef PNG_iTXt_SUPPORTED 2188 text_ptr->lang = NULL; 2189 text_ptr->lang_key = NULL; 2190 text_ptr->itxt_length = 0; 2191 #endif 2192 text_ptr->text = png_ptr->chunkdata + prefix_len; 2193 text_ptr->text_length = data_len; 2194 2195 ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1); 2196 2197 png_free(png_ptr, text_ptr); 2198 png_free(png_ptr, png_ptr->chunkdata); 2199 png_ptr->chunkdata = NULL; 2200 if (ret) 2201 png_error(png_ptr, "Insufficient memory to store zTXt chunk."); 2202 } 2203 #endif 2204 2205 #ifdef PNG_READ_iTXt_SUPPORTED 2206 /* Note: this does not correctly handle chunks that are > 64K under DOS */ 2207 void /* PRIVATE */ 2208 png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 2209 { 2210 png_textp text_ptr; 2211 png_charp key, lang, text, lang_key; 2212 int comp_flag; 2213 int comp_type = 0; 2214 int ret; 2215 png_size_t slength, prefix_len, data_len; 2216 2217 png_debug(1, "in png_handle_iTXt"); 2218 2219 #ifdef PNG_USER_LIMITS_SUPPORTED 2220 if (png_ptr->user_chunk_cache_max != 0) 2221 { 2222 if (png_ptr->user_chunk_cache_max == 1) 2223 { 2224 png_crc_finish(png_ptr, length); 2225 return; 2226 } 2227 if (--png_ptr->user_chunk_cache_max == 1) 2228 { 2229 png_warning(png_ptr, "No space in chunk cache for iTXt"); 2230 png_crc_finish(png_ptr, length); 2231 return; 2232 } 2233 } 2234 #endif 2235 2236 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 2237 png_error(png_ptr, "Missing IHDR before iTXt"); 2238 2239 if (png_ptr->mode & PNG_HAVE_IDAT) 2240 png_ptr->mode |= PNG_AFTER_IDAT; 2241 2242 #ifdef PNG_MAX_MALLOC_64K 2243 /* We will no doubt have problems with chunks even half this size, but 2244 there is no hard and fast rule to tell us where to stop. */ 2245 if (length > (png_uint_32)65535L) 2246 { 2247 png_warning(png_ptr, "iTXt chunk too large to fit in memory"); 2248 png_crc_finish(png_ptr, length); 2249 return; 2250 } 2251 #endif 2252 2253 png_free(png_ptr, png_ptr->chunkdata); 2254 png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1); 2255 if (png_ptr->chunkdata == NULL) 2256 { 2257 png_warning(png_ptr, "No memory to process iTXt chunk."); 2258 return; 2259 } 2260 slength = (png_size_t)length; 2261 png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength); 2262 if (png_crc_finish(png_ptr, 0)) 2263 { 2264 png_free(png_ptr, png_ptr->chunkdata); 2265 png_ptr->chunkdata = NULL; 2266 return; 2267 } 2268 2269 png_ptr->chunkdata[slength] = 0x00; 2270 2271 for (lang = png_ptr->chunkdata; *lang; lang++) 2272 /* Empty loop */ ; 2273 lang++; /* Skip NUL separator */ 2274 2275 /* iTXt must have a language tag (possibly empty), two compression bytes, 2276 * translated keyword (possibly empty), and possibly some text after the 2277 * keyword 2278 */ 2279 2280 if (lang >= png_ptr->chunkdata + slength - 3) 2281 { 2282 png_warning(png_ptr, "Truncated iTXt chunk"); 2283 png_free(png_ptr, png_ptr->chunkdata); 2284 png_ptr->chunkdata = NULL; 2285 return; 2286 } 2287 else 2288 { 2289 comp_flag = *lang++; 2290 comp_type = *lang++; 2291 } 2292 2293 for (lang_key = lang; *lang_key; lang_key++) 2294 /* Empty loop */ ; 2295 lang_key++; /* Skip NUL separator */ 2296 2297 if (lang_key >= png_ptr->chunkdata + slength) 2298 { 2299 png_warning(png_ptr, "Truncated iTXt chunk"); 2300 png_free(png_ptr, png_ptr->chunkdata); 2301 png_ptr->chunkdata = NULL; 2302 return; 2303 } 2304 2305 for (text = lang_key; *text; text++) 2306 /* Empty loop */ ; 2307 text++; /* Skip NUL separator */ 2308 if (text >= png_ptr->chunkdata + slength) 2309 { 2310 png_warning(png_ptr, "Malformed iTXt chunk"); 2311 png_free(png_ptr, png_ptr->chunkdata); 2312 png_ptr->chunkdata = NULL; 2313 return; 2314 } 2315 2316 prefix_len = text - png_ptr->chunkdata; 2317 2318 key=png_ptr->chunkdata; 2319 if (comp_flag) 2320 png_decompress_chunk(png_ptr, comp_type, 2321 (size_t)length, prefix_len, &data_len); 2322 else 2323 data_len = png_strlen(png_ptr->chunkdata + prefix_len); 2324 text_ptr = (png_textp)png_malloc_warn(png_ptr, 2325 (png_uint_32)png_sizeof(png_text)); 2326 if (text_ptr == NULL) 2327 { 2328 png_warning(png_ptr, "Not enough memory to process iTXt chunk."); 2329 png_free(png_ptr, png_ptr->chunkdata); 2330 png_ptr->chunkdata = NULL; 2331 return; 2332 } 2333 text_ptr->compression = (int)comp_flag + 1; 2334 text_ptr->lang_key = png_ptr->chunkdata + (lang_key - key); 2335 text_ptr->lang = png_ptr->chunkdata + (lang - key); 2336 text_ptr->itxt_length = data_len; 2337 text_ptr->text_length = 0; 2338 text_ptr->key = png_ptr->chunkdata; 2339 text_ptr->text = png_ptr->chunkdata + prefix_len; 2340 2341 ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1); 2342 2343 png_free(png_ptr, text_ptr); 2344 png_free(png_ptr, png_ptr->chunkdata); 2345 png_ptr->chunkdata = NULL; 2346 if (ret) 2347 png_error(png_ptr, "Insufficient memory to store iTXt chunk."); 2348 } 2349 #endif 2350 2351 /* This function is called when we haven't found a handler for a 2352 chunk. If there isn't a problem with the chunk itself (ie bad 2353 chunk name, CRC, or a critical chunk), the chunk is silently ignored 2354 -- unless the PNG_FLAG_UNKNOWN_CHUNKS_SUPPORTED flag is on in which 2355 case it will be saved away to be written out later. */ 2356 void /* PRIVATE */ 2357 png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) 2358 { 2359 png_uint_32 skip = 0; 2360 2361 png_debug(1, "in png_handle_unknown"); 2362 2363 #ifdef PNG_USER_LIMITS_SUPPORTED 2364 if (png_ptr->user_chunk_cache_max != 0) 2365 { 2366 if (png_ptr->user_chunk_cache_max == 1) 2367 { 2368 png_crc_finish(png_ptr, length); 2369 return; 2370 } 2371 if (--png_ptr->user_chunk_cache_max == 1) 2372 { 2373 png_warning(png_ptr, "No space in chunk cache for unknown chunk"); 2374 png_crc_finish(png_ptr, length); 2375 return; 2376 } 2377 } 2378 #endif 2379 2380 if (png_ptr->mode & PNG_HAVE_IDAT) 2381 { 2382 #ifdef PNG_USE_LOCAL_ARRAYS 2383 PNG_CONST PNG_IDAT; 2384 #endif 2385 if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) /* Not an IDAT */ 2386 png_ptr->mode |= PNG_AFTER_IDAT; 2387 } 2388 2389 if (!(png_ptr->chunk_name[0] & 0x20)) 2390 { 2391 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED 2392 if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != 2393 PNG_HANDLE_CHUNK_ALWAYS 2394 #ifdef PNG_READ_USER_CHUNKS_SUPPORTED 2395 && png_ptr->read_user_chunk_fn == NULL 2396 #endif 2397 ) 2398 #endif 2399 png_chunk_error(png_ptr, "unknown critical chunk"); 2400 } 2401 2402 #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED 2403 if ((png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS) 2404 #ifdef PNG_READ_USER_CHUNKS_SUPPORTED 2405 || (png_ptr->read_user_chunk_fn != NULL) 2406 #endif 2407 ) 2408 { 2409 #ifdef PNG_MAX_MALLOC_64K 2410 if (length > (png_uint_32)65535L) 2411 { 2412 png_warning(png_ptr, "unknown chunk too large to fit in memory"); 2413 skip = length - (png_uint_32)65535L; 2414 length = (png_uint_32)65535L; 2415 } 2416 #endif 2417 png_memcpy((png_charp)png_ptr->unknown_chunk.name, 2418 (png_charp)png_ptr->chunk_name, 2419 png_sizeof(png_ptr->unknown_chunk.name)); 2420 png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name)-1] 2421 = '\0'; 2422 png_ptr->unknown_chunk.size = (png_size_t)length; 2423 if (length == 0) 2424 png_ptr->unknown_chunk.data = NULL; 2425 else 2426 { 2427 png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length); 2428 png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length); 2429 } 2430 #ifdef PNG_READ_USER_CHUNKS_SUPPORTED 2431 if (png_ptr->read_user_chunk_fn != NULL) 2432 { 2433 /* Callback to user unknown chunk handler */ 2434 int ret; 2435 ret = (*(png_ptr->read_user_chunk_fn)) 2436 (png_ptr, &png_ptr->unknown_chunk); 2437 if (ret < 0) 2438 png_chunk_error(png_ptr, "error in user chunk"); 2439 if (ret == 0) 2440 { 2441 if (!(png_ptr->chunk_name[0] & 0x20)) 2442 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED 2443 if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != 2444 PNG_HANDLE_CHUNK_ALWAYS) 2445 #endif 2446 png_chunk_error(png_ptr, "unknown critical chunk"); 2447 png_set_unknown_chunks(png_ptr, info_ptr, 2448 &png_ptr->unknown_chunk, 1); 2449 } 2450 } 2451 else 2452 #endif 2453 png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1); 2454 png_free(png_ptr, png_ptr->unknown_chunk.data); 2455 png_ptr->unknown_chunk.data = NULL; 2456 } 2457 else 2458 #endif 2459 skip = length; 2460 2461 png_crc_finish(png_ptr, skip); 2462 2463 #ifndef PNG_READ_USER_CHUNKS_SUPPORTED 2464 info_ptr = info_ptr; /* Quiet compiler warnings about unused info_ptr */ 2465 #endif 2466 } 2467 2468 /* This function is called to verify that a chunk name is valid. 2469 This function can't have the "critical chunk check" incorporated 2470 into it, since in the future we will need to be able to call user 2471 functions to handle unknown critical chunks after we check that 2472 the chunk name itself is valid. */ 2473 2474 #define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97)) 2475 2476 void /* PRIVATE */ 2477 png_check_chunk_name(png_structp png_ptr, png_bytep chunk_name) 2478 { 2479 png_debug(1, "in png_check_chunk_name"); 2480 if (isnonalpha(chunk_name[0]) || isnonalpha(chunk_name[1]) || 2481 isnonalpha(chunk_name[2]) || isnonalpha(chunk_name[3])) 2482 { 2483 png_chunk_error(png_ptr, "invalid chunk type"); 2484 } 2485 } 2486 2487 /* Combines the row recently read in with the existing pixels in the 2488 row. This routine takes care of alpha and transparency if requested. 2489 This routine also handles the two methods of progressive display 2490 of interlaced images, depending on the mask value. 2491 The mask value describes which pixels are to be combined with 2492 the row. The pattern always repeats every 8 pixels, so just 8 2493 bits are needed. A one indicates the pixel is to be combined, 2494 a zero indicates the pixel is to be skipped. This is in addition 2495 to any alpha or transparency value associated with the pixel. If 2496 you want all pixels to be combined, pass 0xff (255) in mask. */ 2497 2498 void /* PRIVATE */ 2499 png_combine_row(png_structp png_ptr, png_bytep row, int mask) 2500 { 2501 png_debug(1, "in png_combine_row"); 2502 if (mask == 0xff) 2503 { 2504 png_memcpy(row, png_ptr->row_buf + 1, 2505 PNG_ROWBYTES(png_ptr->row_info.pixel_depth, png_ptr->width)); 2506 } 2507 else 2508 { 2509 switch (png_ptr->row_info.pixel_depth) 2510 { 2511 case 1: 2512 { 2513 png_bytep sp = png_ptr->row_buf + 1; 2514 png_bytep dp = row; 2515 int s_inc, s_start, s_end; 2516 int m = 0x80; 2517 int shift; 2518 png_uint_32 i; 2519 png_uint_32 row_width = png_ptr->width; 2520 2521 #ifdef PNG_READ_PACKSWAP_SUPPORTED 2522 if (png_ptr->transformations & PNG_PACKSWAP) 2523 { 2524 s_start = 0; 2525 s_end = 7; 2526 s_inc = 1; 2527 } 2528 else 2529 #endif 2530 { 2531 s_start = 7; 2532 s_end = 0; 2533 s_inc = -1; 2534 } 2535 2536 shift = s_start; 2537 2538 for (i = 0; i < row_width; i++) 2539 { 2540 if (m & mask) 2541 { 2542 int value; 2543 2544 value = (*sp >> shift) & 0x01; 2545 *dp &= (png_byte)((0x7f7f >> (7 - shift)) & 0xff); 2546 *dp |= (png_byte)(value << shift); 2547 } 2548 2549 if (shift == s_end) 2550 { 2551 shift = s_start; 2552 sp++; 2553 dp++; 2554 } 2555 else 2556 shift += s_inc; 2557 2558 if (m == 1) 2559 m = 0x80; 2560 else 2561 m >>= 1; 2562 } 2563 break; 2564 } 2565 case 2: 2566 { 2567 png_bytep sp = png_ptr->row_buf + 1; 2568 png_bytep dp = row; 2569 int s_start, s_end, s_inc; 2570 int m = 0x80; 2571 int shift; 2572 png_uint_32 i; 2573 png_uint_32 row_width = png_ptr->width; 2574 int value; 2575 2576 #ifdef PNG_READ_PACKSWAP_SUPPORTED 2577 if (png_ptr->transformations & PNG_PACKSWAP) 2578 { 2579 s_start = 0; 2580 s_end = 6; 2581 s_inc = 2; 2582 } 2583 else 2584 #endif 2585 { 2586 s_start = 6; 2587 s_end = 0; 2588 s_inc = -2; 2589 } 2590 2591 shift = s_start; 2592 2593 for (i = 0; i < row_width; i++) 2594 { 2595 if (m & mask) 2596 { 2597 value = (*sp >> shift) & 0x03; 2598 *dp &= (png_byte)((0x3f3f >> (6 - shift)) & 0xff); 2599 *dp |= (png_byte)(value << shift); 2600 } 2601 2602 if (shift == s_end) 2603 { 2604 shift = s_start; 2605 sp++; 2606 dp++; 2607 } 2608 else 2609 shift += s_inc; 2610 if (m == 1) 2611 m = 0x80; 2612 else 2613 m >>= 1; 2614 } 2615 break; 2616 } 2617 case 4: 2618 { 2619 png_bytep sp = png_ptr->row_buf + 1; 2620 png_bytep dp = row; 2621 int s_start, s_end, s_inc; 2622 int m = 0x80; 2623 int shift; 2624 png_uint_32 i; 2625 png_uint_32 row_width = png_ptr->width; 2626 int value; 2627 2628 #ifdef PNG_READ_PACKSWAP_SUPPORTED 2629 if (png_ptr->transformations & PNG_PACKSWAP) 2630 { 2631 s_start = 0; 2632 s_end = 4; 2633 s_inc = 4; 2634 } 2635 else 2636 #endif 2637 { 2638 s_start = 4; 2639 s_end = 0; 2640 s_inc = -4; 2641 } 2642 shift = s_start; 2643 2644 for (i = 0; i < row_width; i++) 2645 { 2646 if (m & mask) 2647 { 2648 value = (*sp >> shift) & 0xf; 2649 *dp &= (png_byte)((0xf0f >> (4 - shift)) & 0xff); 2650 *dp |= (png_byte)(value << shift); 2651 } 2652 2653 if (shift == s_end) 2654 { 2655 shift = s_start; 2656 sp++; 2657 dp++; 2658 } 2659 else 2660 shift += s_inc; 2661 if (m == 1) 2662 m = 0x80; 2663 else 2664 m >>= 1; 2665 } 2666 break; 2667 } 2668 default: 2669 { 2670 png_bytep sp = png_ptr->row_buf + 1; 2671 png_bytep dp = row; 2672 png_size_t pixel_bytes = (png_ptr->row_info.pixel_depth >> 3); 2673 png_uint_32 i; 2674 png_uint_32 row_width = png_ptr->width; 2675 png_byte m = 0x80; 2676 2677 2678 for (i = 0; i < row_width; i++) 2679 { 2680 if (m & mask) 2681 { 2682 png_memcpy(dp, sp, pixel_bytes); 2683 } 2684 2685 sp += pixel_bytes; 2686 dp += pixel_bytes; 2687 2688 if (m == 1) 2689 m = 0x80; 2690 else 2691 m >>= 1; 2692 } 2693 break; 2694 } 2695 } 2696 } 2697 } 2698 2699 #ifdef PNG_READ_INTERLACING_SUPPORTED 2700 /* OLD pre-1.0.9 interface: 2701 void png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass, 2702 png_uint_32 transformations) 2703 */ 2704 void /* PRIVATE */ 2705 png_do_read_interlace(png_structp png_ptr) 2706 { 2707 png_row_infop row_info = &(png_ptr->row_info); 2708 png_bytep row = png_ptr->row_buf + 1; 2709 int pass = png_ptr->pass; 2710 png_uint_32 transformations = png_ptr->transformations; 2711 /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ 2712 /* Offset to next interlace block */ 2713 PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; 2714 2715 png_debug(1, "in png_do_read_interlace"); 2716 if (row != NULL && row_info != NULL) 2717 { 2718 png_uint_32 final_width; 2719 2720 final_width = row_info->width * png_pass_inc[pass]; 2721 2722 switch (row_info->pixel_depth) 2723 { 2724 case 1: 2725 { 2726 png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 3); 2727 png_bytep dp = row + (png_size_t)((final_width - 1) >> 3); 2728 int sshift, dshift; 2729 int s_start, s_end, s_inc; 2730 int jstop = png_pass_inc[pass]; 2731 png_byte v; 2732 png_uint_32 i; 2733 int j; 2734 2735 #ifdef PNG_READ_PACKSWAP_SUPPORTED 2736 if (transformations & PNG_PACKSWAP) 2737 { 2738 sshift = (int)((row_info->width + 7) & 0x07); 2739 dshift = (int)((final_width + 7) & 0x07); 2740 s_start = 7; 2741 s_end = 0; 2742 s_inc = -1; 2743 } 2744 else 2745 #endif 2746 { 2747 sshift = 7 - (int)((row_info->width + 7) & 0x07); 2748 dshift = 7 - (int)((final_width + 7) & 0x07); 2749 s_start = 0; 2750 s_end = 7; 2751 s_inc = 1; 2752 } 2753 2754 for (i = 0; i < row_info->width; i++) 2755 { 2756 v = (png_byte)((*sp >> sshift) & 0x01); 2757 for (j = 0; j < jstop; j++) 2758 { 2759 *dp &= (png_byte)((0x7f7f >> (7 - dshift)) & 0xff); 2760 *dp |= (png_byte)(v << dshift); 2761 if (dshift == s_end) 2762 { 2763 dshift = s_start; 2764 dp--; 2765 } 2766 else 2767 dshift += s_inc; 2768 } 2769 if (sshift == s_end) 2770 { 2771 sshift = s_start; 2772 sp--; 2773 } 2774 else 2775 sshift += s_inc; 2776 } 2777 break; 2778 } 2779 case 2: 2780 { 2781 png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2); 2782 png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2); 2783 int sshift, dshift; 2784 int s_start, s_end, s_inc; 2785 int jstop = png_pass_inc[pass]; 2786 png_uint_32 i; 2787 2788 #ifdef PNG_READ_PACKSWAP_SUPPORTED 2789 if (transformations & PNG_PACKSWAP) 2790 { 2791 sshift = (int)(((row_info->width + 3) & 0x03) << 1); 2792 dshift = (int)(((final_width + 3) & 0x03) << 1); 2793 s_start = 6; 2794 s_end = 0; 2795 s_inc = -2; 2796 } 2797 else 2798 #endif 2799 { 2800 sshift = (int)((3 - ((row_info->width + 3) & 0x03)) << 1); 2801 dshift = (int)((3 - ((final_width + 3) & 0x03)) << 1); 2802 s_start = 0; 2803 s_end = 6; 2804 s_inc = 2; 2805 } 2806 2807 for (i = 0; i < row_info->width; i++) 2808 { 2809 png_byte v; 2810 int j; 2811 2812 v = (png_byte)((*sp >> sshift) & 0x03); 2813 for (j = 0; j < jstop; j++) 2814 { 2815 *dp &= (png_byte)((0x3f3f >> (6 - dshift)) & 0xff); 2816 *dp |= (png_byte)(v << dshift); 2817 if (dshift == s_end) 2818 { 2819 dshift = s_start; 2820 dp--; 2821 } 2822 else 2823 dshift += s_inc; 2824 } 2825 if (sshift == s_end) 2826 { 2827 sshift = s_start; 2828 sp--; 2829 } 2830 else 2831 sshift += s_inc; 2832 } 2833 break; 2834 } 2835 case 4: 2836 { 2837 png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 1); 2838 png_bytep dp = row + (png_size_t)((final_width - 1) >> 1); 2839 int sshift, dshift; 2840 int s_start, s_end, s_inc; 2841 png_uint_32 i; 2842 int jstop = png_pass_inc[pass]; 2843 2844 #ifdef PNG_READ_PACKSWAP_SUPPORTED 2845 if (transformations & PNG_PACKSWAP) 2846 { 2847 sshift = (int)(((row_info->width + 1) & 0x01) << 2); 2848 dshift = (int)(((final_width + 1) & 0x01) << 2); 2849 s_start = 4; 2850 s_end = 0; 2851 s_inc = -4; 2852 } 2853 else 2854 #endif 2855 { 2856 sshift = (int)((1 - ((row_info->width + 1) & 0x01)) << 2); 2857 dshift = (int)((1 - ((final_width + 1) & 0x01)) << 2); 2858 s_start = 0; 2859 s_end = 4; 2860 s_inc = 4; 2861 } 2862 2863 for (i = 0; i < row_info->width; i++) 2864 { 2865 png_byte v = (png_byte)((*sp >> sshift) & 0xf); 2866 int j; 2867 2868 for (j = 0; j < jstop; j++) 2869 { 2870 *dp &= (png_byte)((0xf0f >> (4 - dshift)) & 0xff); 2871 *dp |= (png_byte)(v << dshift); 2872 if (dshift == s_end) 2873 { 2874 dshift = s_start; 2875 dp--; 2876 } 2877 else 2878 dshift += s_inc; 2879 } 2880 if (sshift == s_end) 2881 { 2882 sshift = s_start; 2883 sp--; 2884 } 2885 else 2886 sshift += s_inc; 2887 } 2888 break; 2889 } 2890 default: 2891 { 2892 png_size_t pixel_bytes = (row_info->pixel_depth >> 3); 2893 png_bytep sp = row + (png_size_t)(row_info->width - 1) 2894 * pixel_bytes; 2895 png_bytep dp = row + (png_size_t)(final_width - 1) * pixel_bytes; 2896 2897 int jstop = png_pass_inc[pass]; 2898 png_uint_32 i; 2899 2900 for (i = 0; i < row_info->width; i++) 2901 { 2902 png_byte v[8]; 2903 int j; 2904 2905 png_memcpy(v, sp, pixel_bytes); 2906 for (j = 0; j < jstop; j++) 2907 { 2908 png_memcpy(dp, v, pixel_bytes); 2909 dp -= pixel_bytes; 2910 } 2911 sp -= pixel_bytes; 2912 } 2913 break; 2914 } 2915 } 2916 row_info->width = final_width; 2917 row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width); 2918 } 2919 #ifndef PNG_READ_PACKSWAP_SUPPORTED 2920 transformations = transformations; /* Silence compiler warning */ 2921 #endif 2922 } 2923 #endif /* PNG_READ_INTERLACING_SUPPORTED */ 2924 2925 void /* PRIVATE */ 2926 png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep row, 2927 png_bytep prev_row, int filter) 2928 { 2929 png_debug(1, "in png_read_filter_row"); 2930 png_debug2(2, "row = %lu, filter = %d", png_ptr->row_number, filter); 2931 switch (filter) 2932 { 2933 case PNG_FILTER_VALUE_NONE: 2934 break; 2935 case PNG_FILTER_VALUE_SUB: 2936 { 2937 png_uint_32 i; 2938 png_uint_32 istop = row_info->rowbytes; 2939 png_uint_32 bpp = (row_info->pixel_depth + 7) >> 3; 2940 png_bytep rp = row + bpp; 2941 png_bytep lp = row; 2942 2943 for (i = bpp; i < istop; i++) 2944 { 2945 *rp = (png_byte)(((int)(*rp) + (int)(*lp++)) & 0xff); 2946 rp++; 2947 } 2948 break; 2949 } 2950 case PNG_FILTER_VALUE_UP: 2951 { 2952 png_uint_32 i; 2953 png_uint_32 istop = row_info->rowbytes; 2954 png_bytep rp = row; 2955 png_bytep pp = prev_row; 2956 2957 for (i = 0; i < istop; i++) 2958 { 2959 *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff); 2960 rp++; 2961 } 2962 break; 2963 } 2964 case PNG_FILTER_VALUE_AVG: 2965 { 2966 png_uint_32 i; 2967 png_bytep rp = row; 2968 png_bytep pp = prev_row; 2969 png_bytep lp = row; 2970 png_uint_32 bpp = (row_info->pixel_depth + 7) >> 3; 2971 png_uint_32 istop = row_info->rowbytes - bpp; 2972 2973 for (i = 0; i < bpp; i++) 2974 { 2975 *rp = (png_byte)(((int)(*rp) + 2976 ((int)(*pp++) / 2 )) & 0xff); 2977 rp++; 2978 } 2979 2980 for (i = 0; i < istop; i++) 2981 { 2982 *rp = (png_byte)(((int)(*rp) + 2983 (int)(*pp++ + *lp++) / 2 ) & 0xff); 2984 rp++; 2985 } 2986 break; 2987 } 2988 case PNG_FILTER_VALUE_PAETH: 2989 { 2990 png_uint_32 i; 2991 png_bytep rp = row; 2992 png_bytep pp = prev_row; 2993 png_bytep lp = row; 2994 png_bytep cp = prev_row; 2995 png_uint_32 bpp = (row_info->pixel_depth + 7) >> 3; 2996 png_uint_32 istop=row_info->rowbytes - bpp; 2997 2998 for (i = 0; i < bpp; i++) 2999 { 3000 *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff); 3001 rp++; 3002 } 3003 3004 for (i = 0; i < istop; i++) /* Use leftover rp,pp */ 3005 { 3006 int a, b, c, pa, pb, pc, p; 3007 3008 a = *lp++; 3009 b = *pp++; 3010 c = *cp++; 3011 3012 p = b - c; 3013 pc = a - c; 3014 3015 #ifdef PNG_USE_ABS 3016 pa = abs(p); 3017 pb = abs(pc); 3018 pc = abs(p + pc); 3019 #else 3020 pa = p < 0 ? -p : p; 3021 pb = pc < 0 ? -pc : pc; 3022 pc = (p + pc) < 0 ? -(p + pc) : p + pc; 3023 #endif 3024 3025 /* 3026 if (pa <= pb && pa <= pc) 3027 p = a; 3028 else if (pb <= pc) 3029 p = b; 3030 else 3031 p = c; 3032 */ 3033 3034 p = (pa <= pb && pa <= pc) ? a : (pb <= pc) ? b : c; 3035 3036 *rp = (png_byte)(((int)(*rp) + p) & 0xff); 3037 rp++; 3038 } 3039 break; 3040 } 3041 default: 3042 png_warning(png_ptr, "Ignoring bad adaptive filter type"); 3043 *row = 0; 3044 break; 3045 } 3046 } 3047 3048 #ifdef PNG_SEQUENTIAL_READ_SUPPORTED 3049 void /* PRIVATE */ 3050 png_read_finish_row(png_structp png_ptr) 3051 { 3052 #ifdef PNG_READ_INTERLACING_SUPPORTED 3053 /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ 3054 3055 /* Start of interlace block */ 3056 PNG_CONST int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; 3057 3058 /* Offset to next interlace block */ 3059 PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; 3060 3061 /* Start of interlace block in the y direction */ 3062 PNG_CONST int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; 3063 3064 /* Offset to next interlace block in the y direction */ 3065 PNG_CONST int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; 3066 #endif /* PNG_READ_INTERLACING_SUPPORTED */ 3067 3068 png_debug(1, "in png_read_finish_row"); 3069 png_ptr->row_number++; 3070 if (png_ptr->row_number < png_ptr->num_rows) 3071 return; 3072 3073 #ifdef PNG_READ_INTERLACING_SUPPORTED 3074 if (png_ptr->interlaced) 3075 { 3076 png_ptr->row_number = 0; 3077 png_memset_check(png_ptr, png_ptr->prev_row, 0, 3078 png_ptr->rowbytes + 1); 3079 do 3080 { 3081 png_ptr->pass++; 3082 if (png_ptr->pass >= 7) 3083 break; 3084 png_ptr->iwidth = (png_ptr->width + 3085 png_pass_inc[png_ptr->pass] - 1 - 3086 png_pass_start[png_ptr->pass]) / 3087 png_pass_inc[png_ptr->pass]; 3088 3089 if (!(png_ptr->transformations & PNG_INTERLACE)) 3090 { 3091 png_ptr->num_rows = (png_ptr->height + 3092 png_pass_yinc[png_ptr->pass] - 1 - 3093 png_pass_ystart[png_ptr->pass]) / 3094 png_pass_yinc[png_ptr->pass]; 3095 if (!(png_ptr->num_rows)) 3096 continue; 3097 } 3098 else /* if (png_ptr->transformations & PNG_INTERLACE) */ 3099 break; 3100 } while (png_ptr->iwidth == 0); 3101 3102 if (png_ptr->pass < 7) 3103 return; 3104 } 3105 #endif /* PNG_READ_INTERLACING_SUPPORTED */ 3106 3107 if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED)) 3108 { 3109 #ifdef PNG_USE_LOCAL_ARRAYS 3110 PNG_CONST PNG_IDAT; 3111 #endif 3112 char extra; 3113 int ret; 3114 3115 png_ptr->zstream.next_out = (Byte *)&extra; 3116 png_ptr->zstream.avail_out = (uInt)1; 3117 for (;;) 3118 { 3119 if (!(png_ptr->zstream.avail_in)) 3120 { 3121 while (!png_ptr->idat_size) 3122 { 3123 png_byte chunk_length[4]; 3124 3125 png_crc_finish(png_ptr, 0); 3126 3127 png_read_data(png_ptr, chunk_length, 4); 3128 png_ptr->idat_size = png_get_uint_31(png_ptr, chunk_length); 3129 png_reset_crc(png_ptr); 3130 png_crc_read(png_ptr, png_ptr->chunk_name, 4); 3131 if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) 3132 png_error(png_ptr, "Not enough image data"); 3133 3134 } 3135 png_ptr->zstream.avail_in = (uInt)png_ptr->zbuf_size; 3136 png_ptr->zstream.next_in = png_ptr->zbuf; 3137 if (png_ptr->zbuf_size > png_ptr->idat_size) 3138 png_ptr->zstream.avail_in = (uInt)png_ptr->idat_size; 3139 png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zstream.avail_in); 3140 png_ptr->idat_size -= png_ptr->zstream.avail_in; 3141 } 3142 ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH); 3143 if (ret == Z_STREAM_END) 3144 { 3145 if (!(png_ptr->zstream.avail_out) || png_ptr->zstream.avail_in || 3146 png_ptr->idat_size) 3147 png_warning(png_ptr, "Extra compressed data."); 3148 png_ptr->mode |= PNG_AFTER_IDAT; 3149 png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED; 3150 break; 3151 } 3152 if (ret != Z_OK) 3153 png_error(png_ptr, png_ptr->zstream.msg ? png_ptr->zstream.msg : 3154 "Decompression Error"); 3155 3156 if (!(png_ptr->zstream.avail_out)) 3157 { 3158 png_warning(png_ptr, "Extra compressed data."); 3159 png_ptr->mode |= PNG_AFTER_IDAT; 3160 png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED; 3161 break; 3162 } 3163 3164 } 3165 png_ptr->zstream.avail_out = 0; 3166 } 3167 3168 if (png_ptr->idat_size || png_ptr->zstream.avail_in) 3169 png_warning(png_ptr, "Extra compression data."); 3170 3171 inflateReset(&png_ptr->zstream); 3172 3173 png_ptr->mode |= PNG_AFTER_IDAT; 3174 } 3175 #endif /* PNG_SEQUENTIAL_READ_SUPPORTED */ 3176 3177 void /* PRIVATE */ 3178 png_read_start_row(png_structp png_ptr) 3179 { 3180 #ifdef PNG_READ_INTERLACING_SUPPORTED 3181 /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ 3182 3183 /* Start of interlace block */ 3184 PNG_CONST int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; 3185 3186 /* Offset to next interlace block */ 3187 PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; 3188 3189 /* Start of interlace block in the y direction */ 3190 PNG_CONST int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; 3191 3192 /* Offset to next interlace block in the y direction */ 3193 PNG_CONST int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; 3194 #endif 3195 3196 int max_pixel_depth; 3197 png_size_t row_bytes; 3198 3199 png_debug(1, "in png_read_start_row"); 3200 png_ptr->zstream.avail_in = 0; 3201 png_init_read_transformations(png_ptr); 3202 #ifdef PNG_READ_INTERLACING_SUPPORTED 3203 if (png_ptr->interlaced) 3204 { 3205 if (!(png_ptr->transformations & PNG_INTERLACE)) 3206 png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 - 3207 png_pass_ystart[0]) / png_pass_yinc[0]; 3208 else 3209 png_ptr->num_rows = png_ptr->height; 3210 3211 png_ptr->iwidth = (png_ptr->width + 3212 png_pass_inc[png_ptr->pass] - 1 - 3213 png_pass_start[png_ptr->pass]) / 3214 png_pass_inc[png_ptr->pass]; 3215 } 3216 else 3217 #endif /* PNG_READ_INTERLACING_SUPPORTED */ 3218 { 3219 png_ptr->num_rows = png_ptr->height; 3220 png_ptr->iwidth = png_ptr->width; 3221 } 3222 max_pixel_depth = png_ptr->pixel_depth; 3223 3224 #ifdef PNG_READ_PACK_SUPPORTED 3225 if ((png_ptr->transformations & PNG_PACK) && png_ptr->bit_depth < 8) 3226 max_pixel_depth = 8; 3227 #endif 3228 3229 #ifdef PNG_READ_EXPAND_SUPPORTED 3230 if (png_ptr->transformations & PNG_EXPAND) 3231 { 3232 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) 3233 { 3234 if (png_ptr->num_trans) 3235 max_pixel_depth = 32; 3236 else 3237 max_pixel_depth = 24; 3238 } 3239 else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) 3240 { 3241 if (max_pixel_depth < 8) 3242 max_pixel_depth = 8; 3243 if (png_ptr->num_trans) 3244 max_pixel_depth *= 2; 3245 } 3246 else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) 3247 { 3248 if (png_ptr->num_trans) 3249 { 3250 max_pixel_depth *= 4; 3251 max_pixel_depth /= 3; 3252 } 3253 } 3254 } 3255 #endif 3256 3257 #ifdef PNG_READ_FILLER_SUPPORTED 3258 if (png_ptr->transformations & (PNG_FILLER)) 3259 { 3260 if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) 3261 max_pixel_depth = 32; 3262 else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) 3263 { 3264 if (max_pixel_depth <= 8) 3265 max_pixel_depth = 16; 3266 else 3267 max_pixel_depth = 32; 3268 } 3269 else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) 3270 { 3271 if (max_pixel_depth <= 32) 3272 max_pixel_depth = 32; 3273 else 3274 max_pixel_depth = 64; 3275 } 3276 } 3277 #endif 3278 3279 #ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED 3280 if (png_ptr->transformations & PNG_GRAY_TO_RGB) 3281 { 3282 if ( 3283 #ifdef PNG_READ_EXPAND_SUPPORTED 3284 (png_ptr->num_trans && (png_ptr->transformations & PNG_EXPAND)) || 3285 #endif 3286 #ifdef PNG_READ_FILLER_SUPPORTED 3287 (png_ptr->transformations & (PNG_FILLER)) || 3288 #endif 3289 png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) 3290 { 3291 if (max_pixel_depth <= 16) 3292 max_pixel_depth = 32; 3293 else 3294 max_pixel_depth = 64; 3295 } 3296 else 3297 { 3298 if (max_pixel_depth <= 8) 3299 { 3300 if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA) 3301 max_pixel_depth = 32; 3302 else 3303 max_pixel_depth = 24; 3304 } 3305 else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA) 3306 max_pixel_depth = 64; 3307 else 3308 max_pixel_depth = 48; 3309 } 3310 } 3311 #endif 3312 3313 #if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \ 3314 defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) 3315 if (png_ptr->transformations & PNG_USER_TRANSFORM) 3316 { 3317 int user_pixel_depth = png_ptr->user_transform_depth* 3318 png_ptr->user_transform_channels; 3319 if (user_pixel_depth > max_pixel_depth) 3320 max_pixel_depth=user_pixel_depth; 3321 } 3322 #endif 3323 3324 /* Align the width on the next larger 8 pixels. Mainly used 3325 * for interlacing 3326 */ 3327 row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7)); 3328 /* Calculate the maximum bytes needed, adding a byte and a pixel 3329 * for safety's sake 3330 */ 3331 row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) + 3332 1 + ((max_pixel_depth + 7) >> 3); 3333 #ifdef PNG_MAX_MALLOC_64K 3334 if (row_bytes > (png_uint_32)65536L) 3335 png_error(png_ptr, "This image requires a row greater than 64KB"); 3336 #endif 3337 3338 if (row_bytes + 64 > png_ptr->old_big_row_buf_size) 3339 { 3340 png_free(png_ptr, png_ptr->big_row_buf); 3341 if (png_ptr->interlaced) 3342 png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr, 3343 row_bytes + 64); 3344 else 3345 png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, 3346 row_bytes + 64); 3347 png_ptr->old_big_row_buf_size = row_bytes + 64; 3348 3349 /* Use 32 bytes of padding before and after row_buf. */ 3350 png_ptr->row_buf = png_ptr->big_row_buf + 32; 3351 png_ptr->old_big_row_buf_size = row_bytes + 64; 3352 } 3353 3354 #ifdef PNG_MAX_MALLOC_64K 3355 if ((png_uint_32)row_bytes + 1 > (png_uint_32)65536L) 3356 png_error(png_ptr, "This image requires a row greater than 64KB"); 3357 #endif 3358 if ((png_uint_32)row_bytes > (png_uint_32)(PNG_SIZE_MAX - 1)) 3359 png_error(png_ptr, "Row has too many bytes to allocate in memory."); 3360 3361 if (row_bytes + 1 > png_ptr->old_prev_row_size) 3362 { 3363 png_free(png_ptr, png_ptr->prev_row); 3364 png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)( 3365 row_bytes + 1)); 3366 png_memset_check(png_ptr, png_ptr->prev_row, 0, row_bytes + 1); 3367 png_ptr->old_prev_row_size = row_bytes + 1; 3368 } 3369 3370 png_ptr->rowbytes = row_bytes; 3371 3372 png_debug1(3, "width = %lu,", png_ptr->width); 3373 png_debug1(3, "height = %lu,", png_ptr->height); 3374 png_debug1(3, "iwidth = %lu,", png_ptr->iwidth); 3375 png_debug1(3, "num_rows = %lu,", png_ptr->num_rows); 3376 png_debug1(3, "rowbytes = %lu,", png_ptr->rowbytes); 3377 png_debug1(3, "irowbytes = %lu", 3378 PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1); 3379 3380 png_ptr->flags |= PNG_FLAG_ROW_INIT; 3381 } 3382 #endif /* PNG_READ_SUPPORTED */ 3383
