/
githubmirror
/
ipxe
Обзор
Документация
Войти
/
githubmirror
/
ipxe
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
src/image/png.c
1 007 строк
26 KB
Michael Brown
[png] Check for overflow when constructing raw data buffer length
01 авг 2026, 21:14
01 авг 2026, 21:14
874cbd9
Код
Авторство
О чём код?
/* * Copyright (C) 2014 Michael Brown <mbrown@fensystems.co.uk>. * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation; either version 2 of the * License, or any later version. * * This program is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. * * You can also choose to distribute this program under the terms of * the Unmodified Binary Distribution Licence (as given in the file * COPYING.UBDL), provided that you have satisfied its requirements. */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); FILE_SECBOOT ( PERMITTED ); #include <stdint.h> #include <stdlib.h> #include <string.h> #include <errno.h> #include <byteswap.h> #include <ipxe/umalloc.h> #include <ipxe/pixbuf.h> #include <ipxe/deflate.h> #include <ipxe/png.h> /** @file * * Portable Network Graphics (PNG) format * * The PNG format is defined in RFC 2083. */ /** PNG context */ struct png_context { /** Offset within image */ size_t offset; /** Pixel buffer */ struct pixel_buffer *pixbuf; /** Bit depth */ unsigned int depth; /** Colour type */ unsigned int colour_type; /** Number of channels */ unsigned int channels; /** Number of interlace passes */ unsigned int passes; /** Palette, in iPXE's pixel buffer format */ uint32_t palette[PNG_PALETTE_COUNT]; /** Decompression buffer for raw PNG data */ struct deflate_chunk raw; /** Decompressor */ struct deflate deflate; }; /** A PNG interlace pass */ struct png_interlace { /** Pass number */ unsigned int pass; /** X starting indent */ unsigned int x_indent; /** Y starting indent */ unsigned int y_indent; /** X stride */ unsigned int x_stride; /** Y stride */ unsigned int y_stride; /** Width */ unsigned int width; /** Height */ unsigned int height; }; /** PNG file signature */ static struct png_signature png_signature = PNG_SIGNATURE; /** Number of interlacing passes */ static uint8_t png_interlace_passes[] = { [PNG_INTERLACE_NONE] = 1, [PNG_INTERLACE_ADAM7] = 7, }; /** * Transcribe PNG chunk type name (for debugging) * * @v type Chunk type * @ret name Chunk type name */ static const char * png_type_name ( uint32_t type ) { static union { uint32_t type; char name[ sizeof ( uint32_t ) + 1 /* NUL */ ]; } u; u.type = type; return u.name; } /** * Calculate PNG interlace pass parameters * * @v png PNG context * @v pass Pass number (0=first pass) * @v interlace Interlace pass to fill in */ static void png_interlace ( struct png_context *png, unsigned int pass, struct png_interlace *interlace ) { unsigned int grid_width_log2; unsigned int grid_height_log2; unsigned int x_indent; unsigned int y_indent; unsigned int x_stride_log2; unsigned int y_stride_log2; unsigned int x_stride; unsigned int y_stride; unsigned int width; unsigned int height; /* Sanity check */ assert ( png->passes > 0 ); /* Store pass number */ interlace->pass = pass; /* Calculate interlace grid dimensions */ grid_width_log2 = ( png->passes / 2 ); grid_height_log2 = ( ( png->passes - 1 ) / 2 ); /* Calculate starting indents */ interlace->x_indent = x_indent = ( ( pass & 1 ) ? ( 1 << ( grid_width_log2 - ( pass / 2 ) - 1 ) ) : 0 ); interlace->y_indent = y_indent = ( ( pass && ! ( pass & 1 ) ) ? ( 1 << ( grid_height_log2 - ( ( pass - 1 ) / 2 ) - 1 ) ) : 0); /* Calculate strides */ x_stride_log2 = ( grid_width_log2 - ( pass / 2 ) ); y_stride_log2 = ( grid_height_log2 - ( pass ? ( ( pass - 1 ) / 2 ) : 0 ) ); interlace->x_stride = x_stride = ( 1 << x_stride_log2 ); interlace->y_stride = y_stride = ( 1 << y_stride_log2 ); /* Calculate pass dimensions */ width = png->pixbuf->width; height = png->pixbuf->height; interlace->width = ( ( width - x_indent + x_stride - 1 ) >> x_stride_log2 ); interlace->height = ( ( height - y_indent + y_stride - 1 ) >> y_stride_log2 ); } /** * Calculate PNG pixel length * * @v png PNG context * @ret pixel_len Pixel length */ static unsigned int png_pixel_len ( struct png_context *png ) { return ( ( ( png->channels * png->depth ) + 7 ) / 8 ); } /** * Calculate PNG scanline length * * @v png PNG context * @v interlace Interlace pass * @ret scanline_len Scanline length (including filter byte), or 0 on error */ static size_t png_scanline_len ( struct png_context *png, struct png_interlace *interlace ) { size_t bits; /* Calculate bit count and check for overflow */ bits = ( interlace->width * png->channels * png->depth ); assert ( png->channels != 0 ); assert ( png->depth != 0 ); if ( ( ( bits / png->channels ) / png->depth ) != interlace->width ) return 0; /* Calculate byte length (cannot overflow) */ return ( 1 /* Filter byte */ + ( bits / 8 ) + ( !! ( bits & 7 ) ) ); } /** * Handle PNG image header chunk * * @v image PNG image * @v png PNG context * @v len Chunk length * @ret rc Return status code */ static int png_image_header ( struct image *image, struct png_context *png, size_t len ) { const struct png_image_header *ihdr; struct png_interlace interlace; size_t scanline_len; size_t pass_len; unsigned int pass; /* Sanity check */ if ( len != sizeof ( *ihdr ) ) { DBGC ( image, "PNG %s invalid IHDR length %zd\n", image->name, len ); return -EINVAL; } if ( png->pixbuf ) { DBGC ( image, "PNG %s duplicate IHDR\n", image->name ); return -EINVAL; } /* Extract image header */ ihdr = ( image->data + png->offset ); DBGC ( image, "PNG %s %dx%d depth %d type %d compression %d filter %d " "interlace %d\n", image->name, ntohl ( ihdr->width ), ntohl ( ihdr->height ), ihdr->depth, ihdr->colour_type, ihdr->compression, ihdr->filter, ihdr->interlace ); /* Sanity checks */ if ( ihdr->compression >= PNG_COMPRESSION_UNKNOWN ) { DBGC ( image, "PNG %s unknown compression method %d\n", image->name, ihdr->compression ); return -ENOTSUP; } if ( ihdr->filter >= PNG_FILTER_UNKNOWN ) { DBGC ( image, "PNG %s unknown filter method %d\n", image->name, ihdr->filter ); return -ENOTSUP; } if ( ihdr->interlace >= PNG_INTERLACE_UNKNOWN ) { DBGC ( image, "PNG %s unknown interlace method %d\n", image->name, ihdr->interlace ); return -ENOTSUP; } /* Allocate pixel buffer */ png->pixbuf = alloc_pixbuf ( ntohl ( ihdr->width ), ntohl ( ihdr->height ) ); if ( ! png->pixbuf ) { DBGC ( image, "PNG %s could not allocate pixel buffer\n", image->name ); return -ENOMEM; } /* Extract bit depth */ png->depth = ihdr->depth; if ( ( png->depth == 0 ) || ( ( png->depth & ( png->depth - 1 ) ) != 0 ) ) { DBGC ( image, "PNG %s invalid depth %d\n", image->name, png->depth ); return -EINVAL; } /* Calculate number of channels */ png->colour_type = ihdr->colour_type; png->channels = 1; if ( ! ( ihdr->colour_type & PNG_COLOUR_TYPE_PALETTE ) ) { if ( ihdr->colour_type & PNG_COLOUR_TYPE_RGB ) png->channels += 2; if ( ihdr->colour_type & PNG_COLOUR_TYPE_ALPHA ) png->channels += 1; } /* Calculate number of interlace passes */ png->passes = png_interlace_passes[ihdr->interlace]; /* Calculate length of raw data buffer */ for ( pass = 0 ; pass < png->passes ; pass++ ) { png_interlace ( png, pass, &interlace ); if ( interlace.width == 0 ) continue; scanline_len = png_scanline_len ( png, &interlace ); if ( ! scanline_len ) return -ERANGE; pass_len = ( interlace.height * scanline_len ); if ( ( pass_len / scanline_len ) != interlace.height ) return -ERANGE; png->raw.len += pass_len; if ( png->raw.len < pass_len ) return -ERANGE; } /* Allocate raw data buffer */ png->raw.data = umalloc ( png->raw.len ); if ( ! png->raw.data ) { DBGC ( image, "PNG %s could not allocate data buffer\n", image->name ); return -ENOMEM; } return 0; } /** * Handle PNG palette chunk * * @v image PNG image * @v png PNG context * @v len Chunk length * @ret rc Return status code */ static int png_palette ( struct image *image, struct png_context *png, size_t len ) { const struct png_palette_entry *palette; unsigned int i; /* Populate palette */ palette = ( image->data + png->offset ); for ( i = 0 ; i < ( sizeof ( png->palette ) / sizeof ( png->palette[0] ) ) ; i++ ) { /* Stop when we run out of palette data */ if ( len < sizeof ( *palette ) ) break; /* Extract palette entry */ png->palette[i] = ( ( palette->red << 16 ) | ( palette->green << 8 ) | ( palette->blue << 0 ) ); DBGC2 ( image, "PNG %s palette entry %d is %#06x\n", image->name, i, png->palette[i] ); /* Move to next entry */ palette++; len -= sizeof ( *palette ); } return 0; } /** * Handle PNG image data chunk * * @v image PNG image * @v png PNG context * @v len Chunk length * @ret rc Return status code */ static int png_image_data ( struct image *image, struct png_context *png, size_t len ) { int rc; /* Deflate this chunk */ if ( ( rc = deflate_inflate ( &png->deflate, ( image->data + png->offset ), len, &png->raw ) ) != 0 ) { DBGC ( image, "PNG %s could not decompress: %s\n", image->name, strerror ( rc ) ); return rc; } return 0; } /** * Unfilter byte using the "None" filter * * @v current Filtered current byte * @v left Unfiltered left byte * @v above Unfiltered above byte * @v above_left Unfiltered above-left byte * @ret current Unfiltered current byte */ static unsigned int png_unfilter_none ( unsigned int current, unsigned int left __unused, unsigned int above __unused, unsigned int above_left __unused ) { return current; } /** * Unfilter byte using the "Sub" filter * * @v current Filtered current byte * @v left Unfiltered left byte * @v above Unfiltered above byte * @v above_left Unfiltered above-left byte * @ret current Unfiltered current byte */ static unsigned int png_unfilter_sub ( unsigned int current, unsigned int left, unsigned int above __unused, unsigned int above_left __unused ) { return ( current + left ); } /** * Unfilter byte using the "Up" filter * * @v current Filtered current byte * @v left Unfiltered left byte * @v above Unfiltered above byte * @v above_left Unfiltered above-left byte * @ret current Unfiltered current byte */ static unsigned int png_unfilter_up ( unsigned int current, unsigned int left __unused, unsigned int above, unsigned int above_left __unused ) { return ( current + above ); } /** * Unfilter byte using the "Average" filter * * @v current Filtered current byte * @v left Unfiltered left byte * @v above Unfiltered above byte * @v above_left Unfiltered above-left byte * @ret current Unfiltered current byte */ static unsigned int png_unfilter_average ( unsigned int current, unsigned int left, unsigned int above, unsigned int above_left __unused ) { return ( current + ( ( above + left ) >> 1 ) ); } /** * Paeth predictor function (defined in RFC 2083) * * @v a Pixel A * @v b Pixel B * @v c Pixel C * @ret predictor Predictor pixel */ static unsigned int png_paeth_predictor ( unsigned int a, unsigned int b, unsigned int c ) { unsigned int p; unsigned int pa; unsigned int pb; unsigned int pc; /* Algorithm as defined in RFC 2083 section 6.6 */ p = ( a + b - c ); pa = abs ( p - a ); pb = abs ( p - b ); pc = abs ( p - c ); if ( ( pa <= pb ) && ( pa <= pc ) ) { return a; } else if ( pb <= pc ) { return b; } else { return c; } } /** * Unfilter byte using the "Paeth" filter * * @v current Filtered current byte * @v above_left Unfiltered above-left byte * @v above Unfiltered above byte * @v left Unfiltered left byte * @ret current Unfiltered current byte */ static unsigned int png_unfilter_paeth ( unsigned int current, unsigned int left, unsigned int above, unsigned int above_left ) { return ( current + png_paeth_predictor ( left, above, above_left ) ); } /** A PNG filter */ struct png_filter { /** * Unfilter byte * * @v current Filtered current byte * @v left Unfiltered left byte * @v above Unfiltered above byte * @v above_left Unfiltered above-left byte * @ret current Unfiltered current byte */ unsigned int ( * unfilter ) ( unsigned int current, unsigned int left, unsigned int above, unsigned int above_left ); }; /** PNG filter types */ static struct png_filter png_filters[] = { [PNG_FILTER_BASIC_NONE] = { png_unfilter_none }, [PNG_FILTER_BASIC_SUB] = { png_unfilter_sub }, [PNG_FILTER_BASIC_UP] = { png_unfilter_up }, [PNG_FILTER_BASIC_AVERAGE] = { png_unfilter_average }, [PNG_FILTER_BASIC_PAETH] = { png_unfilter_paeth }, }; /** * Unfilter one interlace pass of PNG raw data * * @v image PNG image * @v png PNG context * @v interlace Interlace pass * @ret rc Return status code * * This routine may assume that it is impossible to overrun the raw * data buffer, since the size is determined by the image dimensions. */ static int png_unfilter_pass ( struct image *image, struct png_context *png, struct png_interlace *interlace ) { size_t pixel_len = png_pixel_len ( png ); size_t scanline_len = png_scanline_len ( png, interlace ); uint8_t *data = ( png->raw.data + png->raw.offset ); struct png_filter *filter; unsigned int scanline; unsigned int byte; unsigned int filter_type; unsigned int left; unsigned int above; unsigned int above_left; /* On the first scanline of a pass, above bytes are assumed to * be zero. */ above = 0; /* Iterate over each scanline in turn */ for ( scanline = 0 ; scanline < interlace->height ; scanline++ ) { /* Extract filter byte and determine filter type */ filter_type = *(data++); if ( filter_type >= ( sizeof ( png_filters ) / sizeof ( png_filters[0] ) ) ) { DBGC ( image, "PNG %s unknown filter type %d\n", image->name, filter_type ); return -ENOTSUP; } filter = &png_filters[filter_type]; assert ( filter->unfilter != NULL ); DBGC2 ( image, "PNG %s pass %d scanline %d filter type %d\n", image->name, interlace->pass, scanline, filter_type ); /* At the start of a line, both above-left and left * bytes are taken to be zero. */ left = 0; above_left = 0; /* Iterate over each byte (not pixel) in turn */ for ( byte = 0 ; byte < ( scanline_len - 1 ) ; byte++ ) { /* Extract predictor bytes, if applicable */ if ( byte >= pixel_len ) left = *( data - pixel_len ); if ( scanline > 0 ) above = *( data - scanline_len ); if ( ( scanline > 0 ) && ( byte >= pixel_len ) ) { above_left = *( data - scanline_len - pixel_len ); } /* Unfilter current byte */ *data = filter->unfilter ( *data, left, above, above_left ); data++; } } /* Update offset */ png->raw.offset = ( ( ( void * ) data ) - png->raw.data ); return 0; } /** * Unfilter PNG raw data * * @v image PNG image * @v png PNG context * @ret rc Return status code * * This routine may assume that it is impossible to overrun the raw * data buffer, since the size is determined by the image dimensions. */ static int png_unfilter ( struct image *image, struct png_context *png ) { struct png_interlace interlace; unsigned int pass; int rc; /* Process each interlace pass */ png->raw.offset = 0; for ( pass = 0 ; pass < png->passes ; pass++ ) { /* Calculate interlace pass parameters */ png_interlace ( png, pass, &interlace ); /* Skip zero-width rows (which have no filter bytes) */ if ( interlace.width == 0 ) continue; /* Unfilter this pass */ if ( ( rc = png_unfilter_pass ( image, png, &interlace ) ) != 0 ) return rc; } assert ( png->raw.offset == png->raw.len ); return 0; } /** * Calculate PNG pixel component value * * @v raw Raw component value * @v alpha Alpha value * @v max Maximum raw/alpha value * @ret value Component value in range 0-255 */ static inline unsigned int png_pixel ( unsigned int raw, unsigned int alpha, unsigned int max ) { /* The basic calculation is 255*(raw/max)*(value/max). We use * fixed-point arithmetic (scaling up to the maximum range for * a 32-bit integer), in order to get the same results for * alpha blending as the test cases (produced using * ImageMagick). */ return ( ( ( ( ( 0xff00 * raw * alpha ) / max ) / max ) + 0x80 ) >> 8 ); } /** * Fill one interlace pass of PNG pixels * * @v image PNG image * @v png PNG context * @v interlace Interlace pass * * This routine may assume that it is impossible to overrun either the * raw data buffer or the pixel buffer, since the sizes of both are * determined by the image dimensions. */ static void png_pixels_pass ( struct image *image, struct png_context *png, struct png_interlace *interlace ) { uint8_t channel[png->channels]; int is_indexed = ( png->colour_type & PNG_COLOUR_TYPE_PALETTE ); int is_rgb = ( png->colour_type & PNG_COLOUR_TYPE_RGB ); int has_alpha = ( png->colour_type & PNG_COLOUR_TYPE_ALPHA ); const uint8_t *data = ( png->raw.data + png->raw.offset ); size_t data_stride; unsigned int pixbuf_y_index; unsigned int pixbuf_index; unsigned int pixbuf_x_stride; unsigned int pixbuf_y_stride; unsigned int y; unsigned int x; unsigned int c; unsigned int bits; unsigned int depth; unsigned int max; unsigned int alpha; unsigned int raw; unsigned int value; uint8_t current = 0; uint32_t pixel; /* We only ever use the top byte of 16-bit pixels. Model this * as a bit depth of 8 with a stride of more than one. */ depth = png->depth; data_stride = ( ( depth + 7 ) / 8 ); if ( depth > 8 ) depth = 8; max = ( ( 1 << depth ) - 1 ); /* Calculate pixel buffer offset and strides */ pixbuf_y_index = ( ( ( interlace->y_indent * png->pixbuf->width ) + interlace->x_indent ) ); pixbuf_x_stride = interlace->x_stride; pixbuf_y_stride = ( interlace->y_stride * png->pixbuf->width ); DBGC2 ( image, "PNG %s pass %d %dx%d at (%d,%d) stride (%d,%d)\n", image->name, interlace->pass, interlace->width, interlace->height, interlace->x_indent, interlace->y_indent, interlace->x_stride, interlace->y_stride ); /* Iterate over each scanline in turn */ for ( y = 0 ; y < interlace->height ; y++ ) { /* Skip filter byte */ data++; /* Iterate over each pixel in turn */ bits = depth; pixbuf_index = pixbuf_y_index; for ( x = 0 ; x < interlace->width ; x++ ) { /* Extract sample value */ for ( c = 0 ; c < png->channels ; c++ ) { /* Get sample value into high bits of current */ current <<= depth; bits -= depth; if ( ! bits ) { current = *data; data += data_stride; bits = 8; } /* Extract sample value */ channel[c] = ( current >> ( 8 - depth ) ); } /* Convert to native pixel format */ if ( is_indexed ) { /* Indexed */ pixel = png->palette[channel[0]]; } else { /* Determine alpha value */ alpha = ( has_alpha ? channel[ png->channels - 1 ] : max ); /* Convert to RGB value */ pixel = 0; for ( c = 0 ; c < 3 ; c++ ) { raw = channel[ is_rgb ? c : 0 ]; value = png_pixel ( raw, alpha, max ); assert ( value <= 255 ); pixel = ( ( pixel << 8 ) | value ); } } /* Store pixel */ png->pixbuf->data[pixbuf_index] = pixel; pixbuf_index += pixbuf_x_stride; } /* Move to next output row */ pixbuf_y_index += pixbuf_y_stride; } /* Update offset */ png->raw.offset = ( ( ( const void * ) data ) - png->raw.data ); } /** * Fill PNG pixels * * @v image PNG image * @v png PNG context * * This routine may assume that it is impossible to overrun either the * raw data buffer or the pixel buffer, since the sizes of both are * determined by the image dimensions. */ static void png_pixels ( struct image *image, struct png_context *png ) { struct png_interlace interlace; unsigned int pass; /* Process each interlace pass */ png->raw.offset = 0; for ( pass = 0 ; pass < png->passes ; pass++ ) { /* Calculate interlace pass parameters */ png_interlace ( png, pass, &interlace ); /* Skip zero-width rows (which have no filter bytes) */ if ( interlace.width == 0 ) continue; /* Unfilter this pass */ png_pixels_pass ( image, png, &interlace ); } assert ( png->raw.offset == png->raw.len ); } /** * Handle PNG image end chunk * * @v image PNG image * @v png PNG context * @v len Chunk length * @ret rc Return status code */ static int png_image_end ( struct image *image, struct png_context *png, size_t len ) { int rc; /* Sanity checks */ if ( len != 0 ) { DBGC ( image, "PNG %s invalid IEND length %zd\n", image->name, len ); return -EINVAL; } if ( ! png->pixbuf ) { DBGC ( image, "PNG %s missing pixel buffer (no IHDR?)\n", image->name ); return -EINVAL; } if ( ! deflate_finished ( &png->deflate ) ) { DBGC ( image, "PNG %s decompression not complete\n", image->name ); return -EINVAL; } if ( png->raw.offset != png->raw.len ) { DBGC ( image, "PNG %s incorrect decompressed length (expected " "%zd, got %zd)\n", image->name, png->raw.len, png->raw.offset ); return -EINVAL; } /* Unfilter raw data */ if ( ( rc = png_unfilter ( image, png ) ) != 0 ) return rc; /* Fill pixel buffer */ png_pixels ( image, png ); return 0; } /** A PNG chunk handler */ struct png_chunk_handler { /** Chunk type */ uint32_t type; /** * Handle chunk * * @v image PNG image * @v png PNG context * @v len Chunk length * @ret rc Return status code */ int ( * handle ) ( struct image *image, struct png_context *png, size_t len ); }; /** PNG chunk handlers */ static struct png_chunk_handler png_chunk_handlers[] = { { htonl ( PNG_TYPE_IHDR ), png_image_header }, { htonl ( PNG_TYPE_PLTE ), png_palette }, { htonl ( PNG_TYPE_IDAT ), png_image_data }, { htonl ( PNG_TYPE_IEND ), png_image_end }, }; /** * Handle PNG chunk * * @v image PNG image * @v png PNG context * @v type Chunk type * @v len Chunk length * @ret rc Return status code */ static int png_chunk ( struct image *image, struct png_context *png, uint32_t type, size_t len ) { struct png_chunk_handler *handler; unsigned int i; DBGC ( image, "PNG %s chunk type %s offset %zd length %zd\n", image->name, png_type_name ( type ), png->offset, len ); /* Handle according to chunk type */ for ( i = 0 ; i < ( sizeof ( png_chunk_handlers ) / sizeof ( png_chunk_handlers[0] ) ) ; i++ ) { handler = &png_chunk_handlers[i]; if ( handler->type == type ) return handler->handle ( image, png, len ); } /* Fail if unknown chunk type is critical */ if ( ! ( type & htonl ( PNG_CHUNK_ANCILLARY ) ) ) { DBGC ( image, "PNG %s unknown critical chunk type %s\n", image->name, png_type_name ( type ) ); return -ENOTSUP; } /* Ignore non-critical unknown chunk types */ return 0; } /** * Convert PNG image to pixel buffer * * @v image PNG image * @v pixbuf Pixel buffer to fill in * @ret rc Return status code */ static int png_pixbuf ( struct image *image, struct pixel_buffer **pixbuf ) { struct png_context *png; const struct png_chunk_header *header; const struct png_chunk_footer *footer; size_t remaining; size_t chunk_len; int rc; /* Allocate and initialise context */ png = zalloc ( sizeof ( *png ) ); if ( ! png ) { rc = -ENOMEM; goto err_alloc; } png->offset = sizeof ( struct png_signature ); deflate_init ( &png->deflate, DEFLATE_ZLIB ); /* Process chunks */ do { /* Extract chunk header */ remaining = ( image->len - png->offset ); if ( remaining < ( sizeof ( *header ) + sizeof ( *footer ) ) ){ DBGC ( image, "PNG %s truncated chunk header/footer " "at offset %zd\n", image->name, png->offset ); rc = -EINVAL; goto err_truncated; } header = ( image->data + png->offset ); png->offset += sizeof ( *header ); /* Validate chunk length */ chunk_len = ntohl ( header->len ); if ( chunk_len > ( remaining - sizeof ( *header ) - sizeof ( *footer ) ) ) { DBGC ( image, "PNG %s truncated chunk data at offset " "%zd\n", image->name, png->offset ); rc = -EINVAL; goto err_truncated; } /* Handle chunk */ if ( ( rc = png_chunk ( image, png, header->type, chunk_len ) ) != 0 ) goto err_chunk; /* Move to next chunk */ png->offset += ( chunk_len + sizeof ( *footer ) ); } while ( png->offset < image->len ); /* Check that we finished with an IEND chunk */ if ( header->type != htonl ( PNG_TYPE_IEND ) ) { DBGC ( image, "PNG %s did not finish with IEND\n", image->name ); rc = -EINVAL; goto err_iend; } /* Return pixel buffer */ *pixbuf = pixbuf_get ( png->pixbuf ); /* Success */ rc = 0; err_iend: err_chunk: err_truncated: pixbuf_put ( png->pixbuf ); ufree ( png->raw.data ); free ( png ); err_alloc: return rc; } /** * Probe PNG image * * @v image PNG image * @ret rc Return status code */ static int png_probe ( struct image *image ) { const struct png_signature *signature; /* Sanity check */ if ( image->len < sizeof ( *signature ) ) { DBGC ( image, "PNG %s is too short\n", image->name ); return -ENOEXEC; } /* Check signature */ signature = image->data; if ( memcmp ( signature, &png_signature, sizeof ( *signature ) ) != 0 ){ DBGC ( image, "PNG %s has invalid signature\n", image->name ); return -ENOEXEC; } return 0; } /** PNG image type */ struct image_type png_image_type __image_type ( PROBE_NORMAL ) = { .name = "PNG", .probe = png_probe, .pixbuf = png_pixbuf, };