19
#ifdef PNG_READ_SUPPORTED
22
png_get_uint_31(png_const_structrp png_ptr, png_const_bytep buf)
24
png_uint_32 uval = png_get_uint_32(buf);
26
if (uval > PNG_UINT_31_MAX)
27
png_error(png_ptr, "PNG unsigned integer out of range");
32
#if defined(PNG_READ_gAMA_SUPPORTED) || defined(PNG_READ_cHRM_SUPPORTED)
38
#define PNG_FIXED_ERROR (-1)
41
png_get_fixed_point(png_structrp png_ptr, png_const_bytep buf)
43
png_uint_32 uval = png_get_uint_32(buf);
45
if (uval <= PNG_UINT_31_MAX)
46
return (png_fixed_point)uval;
50
png_warning(png_ptr, "PNG fixed point integer out of range");
52
return PNG_FIXED_ERROR;
56
#ifdef PNG_READ_INT_FUNCTIONS_SUPPORTED
68
png_get_uint_32)(png_const_bytep buf)
71
((png_uint_32)(*(buf )) << 24) +
72
((png_uint_32)(*(buf + 1)) << 16) +
73
((png_uint_32)(*(buf + 2)) << 8) +
74
((png_uint_32)(*(buf + 3)) ) ;
85
png_get_int_32)(png_const_bytep buf)
87
png_uint_32 uval = png_get_uint_32(buf);
88
if ((uval & 0x80000000) == 0)
89
return (png_int_32)uval;
91
uval = (uval ^ 0xffffffff) + 1;
92
if ((uval & 0x80000000) == 0)
93
return -(png_int_32)uval;
103
png_get_uint_16)(png_const_bytep buf)
111
((unsigned int)(*buf) << 8) +
112
((unsigned int)(*(buf + 1)));
114
return (png_uint_16)val;
121
png_read_sig(png_structrp png_ptr, png_inforp info_ptr)
123
size_t num_checked, num_to_check;
126
if (png_ptr->sig_bytes >= 8)
129
num_checked = png_ptr->sig_bytes;
130
num_to_check = 8 - num_checked;
132
#ifdef PNG_IO_STATE_SUPPORTED
133
png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE;
137
png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check);
138
png_ptr->sig_bytes = 8;
140
if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check) != 0)
142
if (num_checked < 4 &&
143
png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4) != 0)
144
png_error(png_ptr, "Not a PNG file");
146
png_error(png_ptr, "PNG file corrupted by ASCII conversion");
149
png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
156
png_read_chunk_header(png_structrp png_ptr)
161
#ifdef PNG_IO_STATE_SUPPORTED
162
png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR;
168
png_read_data(png_ptr, buf, 8);
169
length = png_get_uint_31(png_ptr, buf);
172
png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(buf+4);
174
png_debug2(0, "Reading chunk typeid = 0x%lx, length = %lu",
175
(unsigned long)png_ptr->chunk_name, (unsigned long)length);
178
png_reset_crc(png_ptr);
179
png_calculate_crc(png_ptr, buf + 4, 4);
182
png_check_chunk_name(png_ptr, png_ptr->chunk_name);
185
png_check_chunk_length(png_ptr, length);
187
#ifdef PNG_IO_STATE_SUPPORTED
188
png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;
196
png_crc_read(png_structrp png_ptr, png_bytep buf, png_uint_32 length)
201
png_read_data(png_ptr, buf, length);
202
png_calculate_crc(png_ptr, buf, length);
211
png_crc_finish(png_structrp png_ptr, png_uint_32 skip)
219
png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
221
len = (sizeof tmpbuf);
226
png_crc_read(png_ptr, tmpbuf, len);
229
if (png_crc_error(png_ptr) != 0)
231
if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0 ?
232
(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == 0 :
233
(png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE) != 0)
235
png_chunk_warning(png_ptr, "CRC error");
239
png_chunk_error(png_ptr, "CRC error");
251
png_crc_error(png_structrp png_ptr)
253
png_byte crc_bytes[4];
257
if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0)
259
if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
260
(PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
266
if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)
270
#ifdef PNG_IO_STATE_SUPPORTED
271
png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC;
275
png_read_data(png_ptr, crc_bytes, 4);
279
crc = png_get_uint_32(crc_bytes);
280
return crc != png_ptr->crc;
287
#if defined(PNG_READ_iCCP_SUPPORTED) || defined(PNG_READ_iTXt_SUPPORTED) ||\
288
defined(PNG_READ_pCAL_SUPPORTED) || defined(PNG_READ_sCAL_SUPPORTED) ||\
289
defined(PNG_READ_sPLT_SUPPORTED) || defined(PNG_READ_tEXt_SUPPORTED) ||\
290
defined(PNG_READ_zTXt_SUPPORTED) || defined(PNG_SEQUENTIAL_READ_SUPPORTED)
298
png_read_buffer(png_structrp png_ptr, png_alloc_size_t new_size, int warn)
300
png_bytep buffer = png_ptr->read_buffer;
302
if (buffer != NULL && new_size > png_ptr->read_buffer_size)
304
png_ptr->read_buffer = NULL;
305
png_ptr->read_buffer_size = 0;
306
png_free(png_ptr, buffer);
312
buffer = png_voidcast(png_bytep, png_malloc_base(png_ptr, new_size));
316
memset(buffer, 0, new_size);
317
png_ptr->read_buffer = buffer;
318
png_ptr->read_buffer_size = new_size;
324
png_chunk_warning(png_ptr, "insufficient memory to read chunk");
327
png_chunk_error(png_ptr, "insufficient memory to read chunk");
341
png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
343
if (png_ptr->zowner != 0)
347
PNG_STRING_FROM_CHUNK(msg, png_ptr->zowner);
352
(void)png_safecat(msg, (sizeof msg), 4, " using zstream");
354
png_chunk_warning(png_ptr, msg);
357
png_chunk_error(png_ptr, msg);
376
#if ZLIB_VERNUM >= 0x1240
379
# if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW)
380
if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & 3) ==
384
png_ptr->zstream_start = 0;
389
png_ptr->zstream_start = 1;
398
png_ptr->zstream.next_in = NULL;
399
png_ptr->zstream.avail_in = 0;
400
png_ptr->zstream.next_out = NULL;
401
png_ptr->zstream.avail_out = 0;
403
if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
405
#if ZLIB_VERNUM >= 0x1240
406
ret = inflateReset2(&png_ptr->zstream, window_bits);
408
ret = inflateReset(&png_ptr->zstream);
414
#if ZLIB_VERNUM >= 0x1240
415
ret = inflateInit2(&png_ptr->zstream, window_bits);
417
ret = inflateInit(&png_ptr->zstream);
421
png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED;
424
#ifdef PNG_DISABLE_ADLER32_CHECK_SUPPORTED
425
if (((png_ptr->options >> PNG_IGNORE_ADLER32) & 3) == PNG_OPTION_ON)
427
ret = inflateValidate(&png_ptr->zstream, 0);
431
png_ptr->zowner = owner;
434
png_zstream_error(png_ptr, ret);
444
#if ZLIB_VERNUM >= 0x1240
452
png_zlib_inflate(png_structrp png_ptr, int flush)
454
if (png_ptr->zstream_start && png_ptr->zstream.avail_in > 0)
456
if ((*png_ptr->zstream.next_in >> 4) > 7)
458
png_ptr->zstream.msg = "invalid window size (libpng)";
462
png_ptr->zstream_start = 0;
465
return inflate(&png_ptr->zstream, flush);
469
#ifdef PNG_READ_COMPRESSED_TEXT_SUPPORTED
470
#if defined(PNG_READ_zTXt_SUPPORTED) || defined (PNG_READ_iTXt_SUPPORTED)
483
png_inflate(png_structrp png_ptr, png_uint_32 owner, int finish,
484
png_const_bytep input, png_uint_32p input_size_ptr,
485
png_bytep output, png_alloc_size_t *output_size_ptr)
487
if (png_ptr->zowner == owner)
490
png_alloc_size_t avail_out = *output_size_ptr;
491
png_uint_32 avail_in = *input_size_ptr;
502
png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input);
504
png_ptr->zstream.avail_in = 0;
505
png_ptr->zstream.avail_out = 0;
511
png_ptr->zstream.next_out = output;
516
Byte local_buffer[PNG_INFLATE_BUF_SIZE];
526
avail_in += png_ptr->zstream.avail_in;
530
if (avail_in < avail)
531
avail = (uInt)avail_in;
534
png_ptr->zstream.avail_in = avail;
537
avail_out += png_ptr->zstream.avail_out;
546
png_ptr->zstream.next_out = local_buffer;
547
if ((sizeof local_buffer) < avail)
548
avail = (sizeof local_buffer);
551
if (avail_out < avail)
552
avail = (uInt)avail_out;
554
png_ptr->zstream.avail_out = avail;
563
ret = PNG_INFLATE(png_ptr, avail_out > 0 ? Z_NO_FLUSH :
564
(finish ? Z_FINISH : Z_SYNC_FLUSH));
565
} while (ret == Z_OK);
569
png_ptr->zstream.next_out = NULL;
572
avail_in += png_ptr->zstream.avail_in;
573
avail_out += png_ptr->zstream.avail_out;
579
*output_size_ptr -= avail_out;
582
*input_size_ptr -= avail_in;
585
png_zstream_error(png_ptr, ret);
595
png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
596
return Z_STREAM_ERROR;
608
png_decompress_chunk(png_structrp png_ptr,
609
png_uint_32 chunklength, png_uint_32 prefix_size,
610
png_alloc_size_t *newlength ,
620
png_alloc_size_t limit = PNG_SIZE_MAX;
622
# ifdef PNG_SET_USER_LIMITS_SUPPORTED
623
if (png_ptr->user_chunk_malloc_max > 0 &&
624
png_ptr->user_chunk_malloc_max < limit)
625
limit = png_ptr->user_chunk_malloc_max;
626
# elif PNG_USER_CHUNK_MALLOC_MAX > 0
627
if (PNG_USER_CHUNK_MALLOC_MAX < limit)
628
limit = PNG_USER_CHUNK_MALLOC_MAX;
631
if (limit >= prefix_size + (terminate != 0))
635
limit -= prefix_size + (terminate != 0);
637
if (limit < *newlength)
641
ret = png_inflate_claim(png_ptr, png_ptr->chunk_name);
645
png_uint_32 lzsize = chunklength - prefix_size;
647
ret = png_inflate(png_ptr, png_ptr->chunk_name, 1,
648
png_ptr->read_buffer + prefix_size, &lzsize,
651
if (ret == Z_STREAM_END)
660
if (inflateReset(&png_ptr->zstream) == Z_OK)
667
png_alloc_size_t new_size = *newlength;
668
png_alloc_size_t buffer_size = prefix_size + new_size +
670
png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr,
675
memset(text, 0, buffer_size);
677
ret = png_inflate(png_ptr, png_ptr->chunk_name, 1,
678
png_ptr->read_buffer + prefix_size, &lzsize,
679
text + prefix_size, newlength);
681
if (ret == Z_STREAM_END)
683
if (new_size == *newlength)
686
text[prefix_size + *newlength] = 0;
689
memcpy(text, png_ptr->read_buffer, prefix_size);
692
png_bytep old_ptr = png_ptr->read_buffer;
694
png_ptr->read_buffer = text;
695
png_ptr->read_buffer_size = buffer_size;
708
ret = PNG_UNEXPECTED_ZLIB_RETURN;
712
else if (ret == Z_OK)
713
ret = PNG_UNEXPECTED_ZLIB_RETURN;
718
png_free(png_ptr, text);
723
if (ret == Z_STREAM_END &&
724
chunklength - prefix_size != lzsize)
725
png_chunk_benign_error(png_ptr, "extra compressed data");
732
png_zstream_error(png_ptr, Z_MEM_ERROR);
739
png_zstream_error(png_ptr, ret);
740
ret = PNG_UNEXPECTED_ZLIB_RETURN;
744
else if (ret == Z_OK)
745
ret = PNG_UNEXPECTED_ZLIB_RETURN;
751
else if (ret == Z_STREAM_END)
752
ret = PNG_UNEXPECTED_ZLIB_RETURN;
760
png_zstream_error(png_ptr, Z_MEM_ERROR);
767
#ifdef PNG_READ_iCCP_SUPPORTED
772
png_inflate_read(png_structrp png_ptr, png_bytep read_buffer, uInt read_size,
773
png_uint_32p chunk_bytes, png_bytep next_out, png_alloc_size_t *out_size,
776
if (png_ptr->zowner == png_ptr->chunk_name)
781
png_ptr->zstream.next_out = next_out;
782
png_ptr->zstream.avail_out = 0;
786
if (png_ptr->zstream.avail_in == 0)
788
if (read_size > *chunk_bytes)
789
read_size = (uInt)*chunk_bytes;
790
*chunk_bytes -= read_size;
793
png_crc_read(png_ptr, read_buffer, read_size);
795
png_ptr->zstream.next_in = read_buffer;
796
png_ptr->zstream.avail_in = read_size;
799
if (png_ptr->zstream.avail_out == 0)
801
uInt avail = ZLIB_IO_MAX;
802
if (avail > *out_size)
803
avail = (uInt)*out_size;
806
png_ptr->zstream.avail_out = avail;
813
ret = PNG_INFLATE(png_ptr, *chunk_bytes > 0 ?
814
Z_NO_FLUSH : (finish ? Z_FINISH : Z_SYNC_FLUSH));
816
while (ret == Z_OK && (*out_size > 0 || png_ptr->zstream.avail_out > 0));
818
*out_size += png_ptr->zstream.avail_out;
819
png_ptr->zstream.avail_out = 0;
822
png_zstream_error(png_ptr, ret);
828
png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
829
return Z_STREAM_ERROR;
837
png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
840
png_uint_32 width, height;
841
int bit_depth, color_type, compression_type, filter_type;
844
png_debug(1, "in png_handle_IHDR");
846
if ((png_ptr->mode & PNG_HAVE_IHDR) != 0)
847
png_chunk_error(png_ptr, "out of place");
851
png_chunk_error(png_ptr, "invalid");
853
png_ptr->mode |= PNG_HAVE_IHDR;
855
png_crc_read(png_ptr, buf, 13);
856
png_crc_finish(png_ptr, 0);
858
width = png_get_uint_31(png_ptr, buf);
859
height = png_get_uint_31(png_ptr, buf + 4);
862
compression_type = buf[10];
863
filter_type = buf[11];
864
interlace_type = buf[12];
867
png_ptr->width = width;
868
png_ptr->height = height;
869
png_ptr->bit_depth = (png_byte)bit_depth;
870
png_ptr->interlaced = (png_byte)interlace_type;
871
png_ptr->color_type = (png_byte)color_type;
872
#ifdef PNG_MNG_FEATURES_SUPPORTED
873
png_ptr->filter_type = (png_byte)filter_type;
875
png_ptr->compression_type = (png_byte)compression_type;
878
switch (png_ptr->color_type)
881
case PNG_COLOR_TYPE_GRAY:
882
case PNG_COLOR_TYPE_PALETTE:
883
png_ptr->channels = 1;
886
case PNG_COLOR_TYPE_RGB:
887
png_ptr->channels = 3;
890
case PNG_COLOR_TYPE_GRAY_ALPHA:
891
png_ptr->channels = 2;
894
case PNG_COLOR_TYPE_RGB_ALPHA:
895
png_ptr->channels = 4;
900
png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels);
901
png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
902
png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);
903
png_debug1(3, "channels = %d", png_ptr->channels);
904
png_debug1(3, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes);
905
png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
906
color_type, interlace_type, compression_type, filter_type);
911
png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
913
png_color palette[PNG_MAX_PALETTE_LENGTH];
914
int max_palette_length, num, i;
915
#ifdef PNG_POINTER_INDEXING_SUPPORTED
919
png_debug(1, "in png_handle_PLTE");
921
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
922
png_chunk_error(png_ptr, "missing IHDR");
929
else if ((png_ptr->mode & PNG_HAVE_PLTE) != 0)
930
png_chunk_error(png_ptr, "duplicate");
932
else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
937
png_crc_finish(png_ptr, length);
938
png_chunk_benign_error(png_ptr, "out of place");
942
png_ptr->mode |= PNG_HAVE_PLTE;
944
if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
946
png_crc_finish(png_ptr, length);
947
png_chunk_benign_error(png_ptr, "ignored in grayscale PNG");
951
#ifndef PNG_READ_OPT_PLTE_SUPPORTED
952
if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
954
png_crc_finish(png_ptr, length);
959
if (length > 3*PNG_MAX_PALETTE_LENGTH || length % 3)
961
png_crc_finish(png_ptr, length);
963
if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
964
png_chunk_benign_error(png_ptr, "invalid");
967
png_chunk_error(png_ptr, "invalid");
973
num = (int)length / 3;
980
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
981
max_palette_length = (1 << png_ptr->bit_depth);
983
max_palette_length = PNG_MAX_PALETTE_LENGTH;
985
if (num > max_palette_length)
986
num = max_palette_length;
988
#ifdef PNG_POINTER_INDEXING_SUPPORTED
989
for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
993
png_crc_read(png_ptr, buf, 3);
994
pal_ptr->red = buf[0];
995
pal_ptr->green = buf[1];
996
pal_ptr->blue = buf[2];
999
for (i = 0; i < num; i++)
1003
png_crc_read(png_ptr, buf, 3);
1005
palette[i].red = buf[0];
1006
palette[i].green = buf[1];
1007
palette[i].blue = buf[2];
1016
#ifndef PNG_READ_OPT_PLTE_SUPPORTED
1017
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1020
png_crc_finish(png_ptr, (png_uint_32) (length - (unsigned int)num * 3));
1023
#ifndef PNG_READ_OPT_PLTE_SUPPORTED
1024
else if (png_crc_error(png_ptr) != 0)
1035
if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE) == 0)
1037
if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) != 0)
1041
png_chunk_error(png_ptr, "CRC error");
1045
else if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == 0)
1046
png_chunk_warning(png_ptr, "CRC error");
1058
png_set_PLTE(png_ptr, info_ptr, palette, num);
1069
#ifdef PNG_READ_tRNS_SUPPORTED
1070
if (png_ptr->num_trans > 0 ||
1071
(info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != 0))
1077
png_ptr->num_trans = 0;
1079
if (info_ptr != NULL)
1080
info_ptr->num_trans = 0;
1082
png_chunk_benign_error(png_ptr, "tRNS must be after");
1086
#ifdef PNG_READ_hIST_SUPPORTED
1087
if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != 0)
1088
png_chunk_benign_error(png_ptr, "hIST must be after");
1091
#ifdef PNG_READ_bKGD_SUPPORTED
1092
if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != 0)
1093
png_chunk_benign_error(png_ptr, "bKGD must be after");
1098
png_handle_IEND(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1100
png_debug(1, "in png_handle_IEND");
1102
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0 ||
1103
(png_ptr->mode & PNG_HAVE_IDAT) == 0)
1104
png_chunk_error(png_ptr, "out of place");
1106
png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);
1108
png_crc_finish(png_ptr, length);
1111
png_chunk_benign_error(png_ptr, "invalid");
1113
PNG_UNUSED(info_ptr)
1116
#ifdef PNG_READ_gAMA_SUPPORTED
1118
png_handle_gAMA(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1120
png_fixed_point igamma;
1123
png_debug(1, "in png_handle_gAMA");
1125
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
1126
png_chunk_error(png_ptr, "missing IHDR");
1128
else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
1130
png_crc_finish(png_ptr, length);
1131
png_chunk_benign_error(png_ptr, "out of place");
1137
png_crc_finish(png_ptr, length);
1138
png_chunk_benign_error(png_ptr, "invalid");
1142
png_crc_read(png_ptr, buf, 4);
1144
if (png_crc_finish(png_ptr, 0) != 0)
1147
igamma = png_get_fixed_point(NULL, buf);
1149
png_colorspace_set_gamma(png_ptr, &png_ptr->colorspace, igamma);
1150
png_colorspace_sync(png_ptr, info_ptr);
1154
#ifdef PNG_READ_sBIT_SUPPORTED
1156
png_handle_sBIT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1158
unsigned int truelen, i;
1159
png_byte sample_depth;
1162
png_debug(1, "in png_handle_sBIT");
1164
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
1165
png_chunk_error(png_ptr, "missing IHDR");
1167
else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
1169
png_crc_finish(png_ptr, length);
1170
png_chunk_benign_error(png_ptr, "out of place");
1174
if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT) != 0)
1176
png_crc_finish(png_ptr, length);
1177
png_chunk_benign_error(png_ptr, "duplicate");
1181
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1189
truelen = png_ptr->channels;
1190
sample_depth = png_ptr->bit_depth;
1193
if (length != truelen || length > 4)
1195
png_chunk_benign_error(png_ptr, "invalid");
1196
png_crc_finish(png_ptr, length);
1200
buf[0] = buf[1] = buf[2] = buf[3] = sample_depth;
1201
png_crc_read(png_ptr, buf, truelen);
1203
if (png_crc_finish(png_ptr, 0) != 0)
1206
for (i=0; i<truelen; ++i)
1208
if (buf[i] == 0 || buf[i] > sample_depth)
1210
png_chunk_benign_error(png_ptr, "invalid");
1215
if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
1217
png_ptr->sig_bit.red = buf[0];
1218
png_ptr->sig_bit.green = buf[1];
1219
png_ptr->sig_bit.blue = buf[2];
1220
png_ptr->sig_bit.alpha = buf[3];
1225
png_ptr->sig_bit.gray = buf[0];
1226
png_ptr->sig_bit.red = buf[0];
1227
png_ptr->sig_bit.green = buf[0];
1228
png_ptr->sig_bit.blue = buf[0];
1229
png_ptr->sig_bit.alpha = buf[1];
1232
png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));
1236
#ifdef PNG_READ_cHRM_SUPPORTED
1238
png_handle_cHRM(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1243
png_debug(1, "in png_handle_cHRM");
1245
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
1246
png_chunk_error(png_ptr, "missing IHDR");
1248
else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
1250
png_crc_finish(png_ptr, length);
1251
png_chunk_benign_error(png_ptr, "out of place");
1257
png_crc_finish(png_ptr, length);
1258
png_chunk_benign_error(png_ptr, "invalid");
1262
png_crc_read(png_ptr, buf, 32);
1264
if (png_crc_finish(png_ptr, 0) != 0)
1267
xy.whitex = png_get_fixed_point(NULL, buf);
1268
xy.whitey = png_get_fixed_point(NULL, buf + 4);
1269
xy.redx = png_get_fixed_point(NULL, buf + 8);
1270
xy.redy = png_get_fixed_point(NULL, buf + 12);
1271
xy.greenx = png_get_fixed_point(NULL, buf + 16);
1272
xy.greeny = png_get_fixed_point(NULL, buf + 20);
1273
xy.bluex = png_get_fixed_point(NULL, buf + 24);
1274
xy.bluey = png_get_fixed_point(NULL, buf + 28);
1276
if (xy.whitex == PNG_FIXED_ERROR ||
1277
xy.whitey == PNG_FIXED_ERROR ||
1278
xy.redx == PNG_FIXED_ERROR ||
1279
xy.redy == PNG_FIXED_ERROR ||
1280
xy.greenx == PNG_FIXED_ERROR ||
1281
xy.greeny == PNG_FIXED_ERROR ||
1282
xy.bluex == PNG_FIXED_ERROR ||
1283
xy.bluey == PNG_FIXED_ERROR)
1285
png_chunk_benign_error(png_ptr, "invalid values");
1290
if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0)
1293
if ((png_ptr->colorspace.flags & PNG_COLORSPACE_FROM_cHRM) != 0)
1295
png_ptr->colorspace.flags |= PNG_COLORSPACE_INVALID;
1296
png_colorspace_sync(png_ptr, info_ptr);
1297
png_chunk_benign_error(png_ptr, "duplicate");
1301
png_ptr->colorspace.flags |= PNG_COLORSPACE_FROM_cHRM;
1302
(void)png_colorspace_set_chromaticities(png_ptr, &png_ptr->colorspace, &xy,
1304
png_colorspace_sync(png_ptr, info_ptr);
1308
#ifdef PNG_READ_sRGB_SUPPORTED
1310
png_handle_sRGB(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1314
png_debug(1, "in png_handle_sRGB");
1316
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
1317
png_chunk_error(png_ptr, "missing IHDR");
1319
else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
1321
png_crc_finish(png_ptr, length);
1322
png_chunk_benign_error(png_ptr, "out of place");
1328
png_crc_finish(png_ptr, length);
1329
png_chunk_benign_error(png_ptr, "invalid");
1333
png_crc_read(png_ptr, &intent, 1);
1335
if (png_crc_finish(png_ptr, 0) != 0)
1339
if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0)
1345
if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) != 0)
1347
png_ptr->colorspace.flags |= PNG_COLORSPACE_INVALID;
1348
png_colorspace_sync(png_ptr, info_ptr);
1349
png_chunk_benign_error(png_ptr, "too many profiles");
1353
(void)png_colorspace_set_sRGB(png_ptr, &png_ptr->colorspace, intent);
1354
png_colorspace_sync(png_ptr, info_ptr);
1358
#ifdef PNG_READ_iCCP_SUPPORTED
1360
png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1363
png_const_charp errmsg = NULL;
1366
png_debug(1, "in png_handle_iCCP");
1368
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
1369
png_chunk_error(png_ptr, "missing IHDR");
1371
else if ((png_ptr->mode & (PNG_HAVE_IDAT|PNG_HAVE_PLTE)) != 0)
1373
png_crc_finish(png_ptr, length);
1374
png_chunk_benign_error(png_ptr, "out of place");
1390
png_crc_finish(png_ptr, length);
1391
png_chunk_benign_error(png_ptr, "too short");
1396
if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != 0)
1398
png_crc_finish(png_ptr, length);
1405
if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) == 0)
1407
uInt read_length, keyword_length;
1414
if (read_length > length)
1415
read_length = (uInt)length;
1417
png_crc_read(png_ptr, (png_bytep)keyword, read_length);
1418
length -= read_length;
1425
png_crc_finish(png_ptr, length);
1426
png_chunk_benign_error(png_ptr, "too short");
1431
while (keyword_length < 80 && keyword_length < read_length &&
1432
keyword[keyword_length] != 0)
1436
if (keyword_length >= 1 && keyword_length <= 79)
1441
if (keyword_length+1 < read_length &&
1442
keyword[keyword_length+1] == PNG_COMPRESSION_TYPE_BASE)
1444
read_length -= keyword_length+2;
1446
if (png_inflate_claim(png_ptr, png_iCCP) == Z_OK)
1448
Byte profile_header[132]={0};
1449
Byte local_buffer[PNG_INFLATE_BUF_SIZE];
1450
png_alloc_size_t size = (sizeof profile_header);
1452
png_ptr->zstream.next_in = (Bytef*)keyword + (keyword_length+2);
1453
png_ptr->zstream.avail_in = read_length;
1454
(void)png_inflate_read(png_ptr, local_buffer,
1455
(sizeof local_buffer), &length, profile_header, &size,
1462
png_uint_32 profile_length = png_get_uint_32(profile_header);
1464
if (png_icc_check_length(png_ptr, &png_ptr->colorspace,
1465
keyword, profile_length) != 0)
1470
if (png_icc_check_header(png_ptr, &png_ptr->colorspace,
1471
keyword, profile_length, profile_header,
1472
png_ptr->color_type) != 0)
1479
png_uint_32 tag_count =
1480
png_get_uint_32(profile_header + 128);
1481
png_bytep profile = png_read_buffer(png_ptr,
1484
if (profile != NULL)
1486
memcpy(profile, profile_header,
1487
(sizeof profile_header));
1489
size = 12 * tag_count;
1491
(void)png_inflate_read(png_ptr, local_buffer,
1492
(sizeof local_buffer), &length,
1493
profile + (sizeof profile_header), &size, 0);
1500
if (png_icc_check_tag_table(png_ptr,
1501
&png_ptr->colorspace, keyword, profile_length,
1507
size = profile_length - (sizeof profile_header)
1510
(void)png_inflate_read(png_ptr, local_buffer,
1511
(sizeof local_buffer), &length,
1512
profile + (sizeof profile_header) +
1513
12 * tag_count, &size, 1);
1515
if (length > 0 && !(png_ptr->flags &
1516
PNG_FLAG_BENIGN_ERRORS_WARN))
1517
errmsg = "extra compressed data";
1527
png_chunk_warning(png_ptr,
1528
"extra compressed data");
1531
png_crc_finish(png_ptr, length);
1534
# if defined(PNG_sRGB_SUPPORTED) && PNG_sRGB_PROFILE_CHECKS >= 0
1536
png_icc_set_sRGB(png_ptr,
1537
&png_ptr->colorspace, profile,
1538
png_ptr->zstream.adler);
1542
if (info_ptr != NULL)
1544
png_free_data(png_ptr, info_ptr,
1547
info_ptr->iccp_name = png_voidcast(char*,
1548
png_malloc_base(png_ptr,
1550
if (info_ptr->iccp_name != NULL)
1552
memcpy(info_ptr->iccp_name, keyword,
1554
info_ptr->iccp_proflen =
1556
info_ptr->iccp_profile = profile;
1557
png_ptr->read_buffer = NULL;
1558
info_ptr->free_me |= PNG_FREE_ICCP;
1559
info_ptr->valid |= PNG_INFO_iCCP;
1564
png_ptr->colorspace.flags |=
1565
PNG_COLORSPACE_INVALID;
1566
errmsg = "out of memory";
1575
if (info_ptr != NULL)
1576
png_colorspace_sync(png_ptr, info_ptr);
1580
png_ptr->zowner = 0;
1585
errmsg = png_ptr->zstream.msg;
1590
errmsg = png_ptr->zstream.msg;
1594
errmsg = "out of memory";
1604
errmsg = png_ptr->zstream.msg;
1607
png_ptr->zowner = 0;
1611
errmsg = png_ptr->zstream.msg;
1615
errmsg = "bad compression method";
1619
errmsg = "bad keyword";
1623
errmsg = "too many profiles";
1627
png_crc_finish(png_ptr, length);
1629
png_ptr->colorspace.flags |= PNG_COLORSPACE_INVALID;
1630
png_colorspace_sync(png_ptr, info_ptr);
1632
png_chunk_benign_error(png_ptr, errmsg);
1636
#ifdef PNG_READ_sPLT_SUPPORTED
1638
png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1641
png_bytep entry_start, buffer;
1642
png_sPLT_t new_palette;
1644
png_uint_32 data_length;
1646
png_uint_32 skip = 0;
1650
png_debug(1, "in png_handle_sPLT");
1652
#ifdef PNG_USER_LIMITS_SUPPORTED
1653
if (png_ptr->user_chunk_cache_max != 0)
1655
if (png_ptr->user_chunk_cache_max == 1)
1657
png_crc_finish(png_ptr, length);
1661
if (--png_ptr->user_chunk_cache_max == 1)
1663
png_warning(png_ptr, "No space in chunk cache for sPLT");
1664
png_crc_finish(png_ptr, length);
1670
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
1671
png_chunk_error(png_ptr, "missing IHDR");
1673
else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
1675
png_crc_finish(png_ptr, length);
1676
png_chunk_benign_error(png_ptr, "out of place");
1680
#ifdef PNG_MAX_MALLOC_64K
1681
if (length > 65535U)
1683
png_crc_finish(png_ptr, length);
1684
png_chunk_benign_error(png_ptr, "too large to fit in memory");
1689
buffer = png_read_buffer(png_ptr, length+1, 2);
1692
png_crc_finish(png_ptr, length);
1693
png_chunk_benign_error(png_ptr, "out of memory");
1702
png_crc_read(png_ptr, buffer, length);
1704
if (png_crc_finish(png_ptr, skip) != 0)
1709
for (entry_start = buffer; *entry_start; entry_start++)
1715
if (length < 2U || entry_start > buffer + (length - 2U))
1717
png_warning(png_ptr, "malformed sPLT chunk");
1721
new_palette.depth = *entry_start++;
1722
entry_size = (new_palette.depth == 8 ? 6 : 10);
1726
data_length = length - (png_uint_32)(entry_start - buffer);
1729
if ((data_length % (unsigned int)entry_size) != 0)
1731
png_warning(png_ptr, "sPLT chunk has bad length");
1735
dl = (png_uint_32)(data_length / (unsigned int)entry_size);
1736
max_dl = PNG_SIZE_MAX / (sizeof (png_sPLT_entry));
1740
png_warning(png_ptr, "sPLT chunk too long");
1744
new_palette.nentries = (png_int_32)(data_length / (unsigned int)entry_size);
1746
new_palette.entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
1747
(png_alloc_size_t) new_palette.nentries * (sizeof (png_sPLT_entry)));
1749
if (new_palette.entries == NULL)
1751
png_warning(png_ptr, "sPLT chunk requires too much memory");
1755
#ifdef PNG_POINTER_INDEXING_SUPPORTED
1756
for (i = 0; i < new_palette.nentries; i++)
1758
pp = new_palette.entries + i;
1760
if (new_palette.depth == 8)
1762
pp->red = *entry_start++;
1763
pp->green = *entry_start++;
1764
pp->blue = *entry_start++;
1765
pp->alpha = *entry_start++;
1770
pp->red = png_get_uint_16(entry_start); entry_start += 2;
1771
pp->green = png_get_uint_16(entry_start); entry_start += 2;
1772
pp->blue = png_get_uint_16(entry_start); entry_start += 2;
1773
pp->alpha = png_get_uint_16(entry_start); entry_start += 2;
1776
pp->frequency = png_get_uint_16(entry_start); entry_start += 2;
1779
pp = new_palette.entries;
1781
for (i = 0; i < new_palette.nentries; i++)
1784
if (new_palette.depth == 8)
1786
pp[i].red = *entry_start++;
1787
pp[i].green = *entry_start++;
1788
pp[i].blue = *entry_start++;
1789
pp[i].alpha = *entry_start++;
1794
pp[i].red = png_get_uint_16(entry_start); entry_start += 2;
1795
pp[i].green = png_get_uint_16(entry_start); entry_start += 2;
1796
pp[i].blue = png_get_uint_16(entry_start); entry_start += 2;
1797
pp[i].alpha = png_get_uint_16(entry_start); entry_start += 2;
1800
pp[i].frequency = png_get_uint_16(entry_start); entry_start += 2;
1805
new_palette.name = (png_charp)buffer;
1807
png_set_sPLT(png_ptr, info_ptr, &new_palette, 1);
1809
png_free(png_ptr, new_palette.entries);
1813
#ifdef PNG_READ_tRNS_SUPPORTED
1815
png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1817
png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
1819
png_debug(1, "in png_handle_tRNS");
1821
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
1822
png_chunk_error(png_ptr, "missing IHDR");
1824
else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
1826
png_crc_finish(png_ptr, length);
1827
png_chunk_benign_error(png_ptr, "out of place");
1831
else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != 0)
1833
png_crc_finish(png_ptr, length);
1834
png_chunk_benign_error(png_ptr, "duplicate");
1838
if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
1844
png_crc_finish(png_ptr, length);
1845
png_chunk_benign_error(png_ptr, "invalid");
1849
png_crc_read(png_ptr, buf, 2);
1850
png_ptr->num_trans = 1;
1851
png_ptr->trans_color.gray = png_get_uint_16(buf);
1854
else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
1860
png_crc_finish(png_ptr, length);
1861
png_chunk_benign_error(png_ptr, "invalid");
1865
png_crc_read(png_ptr, buf, length);
1866
png_ptr->num_trans = 1;
1867
png_ptr->trans_color.red = png_get_uint_16(buf);
1868
png_ptr->trans_color.green = png_get_uint_16(buf + 2);
1869
png_ptr->trans_color.blue = png_get_uint_16(buf + 4);
1872
else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1874
if ((png_ptr->mode & PNG_HAVE_PLTE) == 0)
1877
png_crc_finish(png_ptr, length);
1878
png_chunk_benign_error(png_ptr, "out of place");
1882
if (length > (unsigned int) png_ptr->num_palette ||
1883
length > (unsigned int) PNG_MAX_PALETTE_LENGTH ||
1886
png_crc_finish(png_ptr, length);
1887
png_chunk_benign_error(png_ptr, "invalid");
1891
png_crc_read(png_ptr, readbuf, length);
1892
png_ptr->num_trans = (png_uint_16)length;
1897
png_crc_finish(png_ptr, length);
1898
png_chunk_benign_error(png_ptr, "invalid with alpha channel");
1902
if (png_crc_finish(png_ptr, 0) != 0)
1904
png_ptr->num_trans = 0;
1912
png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
1913
&(png_ptr->trans_color));
1917
#ifdef PNG_READ_bKGD_SUPPORTED
1919
png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1921
unsigned int truelen;
1923
png_color_16 background;
1925
png_debug(1, "in png_handle_bKGD");
1927
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
1928
png_chunk_error(png_ptr, "missing IHDR");
1930
else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0 ||
1931
(png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
1932
(png_ptr->mode & PNG_HAVE_PLTE) == 0))
1934
png_crc_finish(png_ptr, length);
1935
png_chunk_benign_error(png_ptr, "out of place");
1939
else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != 0)
1941
png_crc_finish(png_ptr, length);
1942
png_chunk_benign_error(png_ptr, "duplicate");
1946
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1949
else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
1955
if (length != truelen)
1957
png_crc_finish(png_ptr, length);
1958
png_chunk_benign_error(png_ptr, "invalid");
1962
png_crc_read(png_ptr, buf, truelen);
1964
if (png_crc_finish(png_ptr, 0) != 0)
1972
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1974
background.index = buf[0];
1976
if (info_ptr != NULL && info_ptr->num_palette != 0)
1978
if (buf[0] >= info_ptr->num_palette)
1980
png_chunk_benign_error(png_ptr, "invalid index");
1984
background.red = (png_uint_16)png_ptr->palette[buf[0]].red;
1985
background.green = (png_uint_16)png_ptr->palette[buf[0]].green;
1986
background.blue = (png_uint_16)png_ptr->palette[buf[0]].blue;
1990
background.red = background.green = background.blue = 0;
1992
background.gray = 0;
1995
else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
1997
if (png_ptr->bit_depth <= 8)
1999
if (buf[0] != 0 || buf[1] >= (unsigned int)(1 << png_ptr->bit_depth))
2001
png_chunk_benign_error(png_ptr, "invalid gray level");
2006
background.index = 0;
2010
background.gray = png_get_uint_16(buf);
2015
if (png_ptr->bit_depth <= 8)
2017
if (buf[0] != 0 || buf[2] != 0 || buf[4] != 0)
2019
png_chunk_benign_error(png_ptr, "invalid color");
2024
background.index = 0;
2025
background.red = png_get_uint_16(buf);
2026
background.green = png_get_uint_16(buf + 2);
2027
background.blue = png_get_uint_16(buf + 4);
2028
background.gray = 0;
2031
png_set_bKGD(png_ptr, info_ptr, &background);
2035
#ifdef PNG_READ_eXIf_SUPPORTED
2037
png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2041
png_debug(1, "in png_handle_eXIf");
2043
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2044
png_chunk_error(png_ptr, "missing IHDR");
2048
png_crc_finish(png_ptr, length);
2049
png_chunk_benign_error(png_ptr, "too short");
2053
else if (info_ptr == NULL || (info_ptr->valid & PNG_INFO_eXIf) != 0)
2055
png_crc_finish(png_ptr, length);
2056
png_chunk_benign_error(png_ptr, "duplicate");
2060
info_ptr->free_me |= PNG_FREE_EXIF;
2062
info_ptr->eXIf_buf = png_voidcast(png_bytep,
2063
png_malloc_warn(png_ptr, length));
2065
if (info_ptr->eXIf_buf == NULL)
2067
png_crc_finish(png_ptr, length);
2068
png_chunk_benign_error(png_ptr, "out of memory");
2072
for (i = 0; i < length; i++)
2075
png_crc_read(png_ptr, buf, 1);
2076
info_ptr->eXIf_buf[i] = buf[0];
2079
if ((buf[0] != 'M' && buf[0] != 'I') ||
2080
(info_ptr->eXIf_buf[0] != buf[0]))
2082
png_crc_finish(png_ptr, length - 2);
2083
png_chunk_benign_error(png_ptr, "incorrect byte-order specifier");
2084
png_free(png_ptr, info_ptr->eXIf_buf);
2085
info_ptr->eXIf_buf = NULL;
2091
if (png_crc_finish(png_ptr, 0) == 0)
2092
png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
2094
png_free(png_ptr, info_ptr->eXIf_buf);
2095
info_ptr->eXIf_buf = NULL;
2099
#ifdef PNG_READ_hIST_SUPPORTED
2101
png_handle_hIST(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2103
unsigned int num, i;
2104
png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
2106
png_debug(1, "in png_handle_hIST");
2108
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2109
png_chunk_error(png_ptr, "missing IHDR");
2111
else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0 ||
2112
(png_ptr->mode & PNG_HAVE_PLTE) == 0)
2114
png_crc_finish(png_ptr, length);
2115
png_chunk_benign_error(png_ptr, "out of place");
2119
else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != 0)
2121
png_crc_finish(png_ptr, length);
2122
png_chunk_benign_error(png_ptr, "duplicate");
2128
if (length != num * 2 ||
2129
num != (unsigned int)png_ptr->num_palette ||
2130
num > (unsigned int)PNG_MAX_PALETTE_LENGTH)
2132
png_crc_finish(png_ptr, length);
2133
png_chunk_benign_error(png_ptr, "invalid");
2137
for (i = 0; i < num; i++)
2141
png_crc_read(png_ptr, buf, 2);
2142
readbuf[i] = png_get_uint_16(buf);
2145
if (png_crc_finish(png_ptr, 0) != 0)
2148
png_set_hIST(png_ptr, info_ptr, readbuf);
2152
#ifdef PNG_READ_pHYs_SUPPORTED
2154
png_handle_pHYs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2157
png_uint_32 res_x, res_y;
2160
png_debug(1, "in png_handle_pHYs");
2162
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2163
png_chunk_error(png_ptr, "missing IHDR");
2165
else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2167
png_crc_finish(png_ptr, length);
2168
png_chunk_benign_error(png_ptr, "out of place");
2172
else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs) != 0)
2174
png_crc_finish(png_ptr, length);
2175
png_chunk_benign_error(png_ptr, "duplicate");
2181
png_crc_finish(png_ptr, length);
2182
png_chunk_benign_error(png_ptr, "invalid");
2186
png_crc_read(png_ptr, buf, 9);
2188
if (png_crc_finish(png_ptr, 0) != 0)
2191
res_x = png_get_uint_32(buf);
2192
res_y = png_get_uint_32(buf + 4);
2194
png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type);
2198
#ifdef PNG_READ_oFFs_SUPPORTED
2200
png_handle_oFFs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2203
png_int_32 offset_x, offset_y;
2206
png_debug(1, "in png_handle_oFFs");
2208
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2209
png_chunk_error(png_ptr, "missing IHDR");
2211
else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2213
png_crc_finish(png_ptr, length);
2214
png_chunk_benign_error(png_ptr, "out of place");
2218
else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs) != 0)
2220
png_crc_finish(png_ptr, length);
2221
png_chunk_benign_error(png_ptr, "duplicate");
2227
png_crc_finish(png_ptr, length);
2228
png_chunk_benign_error(png_ptr, "invalid");
2232
png_crc_read(png_ptr, buf, 9);
2234
if (png_crc_finish(png_ptr, 0) != 0)
2237
offset_x = png_get_int_32(buf);
2238
offset_y = png_get_int_32(buf + 4);
2240
png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type);
2244
#ifdef PNG_READ_pCAL_SUPPORTED
2247
png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2250
png_byte type, nparams;
2251
png_bytep buffer, buf, units, endptr;
2255
png_debug(1, "in png_handle_pCAL");
2257
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2258
png_chunk_error(png_ptr, "missing IHDR");
2260
else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2262
png_crc_finish(png_ptr, length);
2263
png_chunk_benign_error(png_ptr, "out of place");
2267
else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL) != 0)
2269
png_crc_finish(png_ptr, length);
2270
png_chunk_benign_error(png_ptr, "duplicate");
2274
png_debug1(2, "Allocating and reading pCAL chunk data (%u bytes)",
2277
buffer = png_read_buffer(png_ptr, length+1, 2);
2281
png_crc_finish(png_ptr, length);
2282
png_chunk_benign_error(png_ptr, "out of memory");
2286
png_crc_read(png_ptr, buffer, length);
2288
if (png_crc_finish(png_ptr, 0) != 0)
2293
png_debug(3, "Finding end of pCAL purpose string");
2294
for (buf = buffer; *buf; buf++)
2297
endptr = buffer + length;
2302
if (endptr - buf <= 12)
2304
png_chunk_benign_error(png_ptr, "invalid");
2308
png_debug(3, "Reading pCAL X0, X1, type, nparams, and units");
2309
X0 = png_get_int_32((png_bytep)buf+1);
2310
X1 = png_get_int_32((png_bytep)buf+5);
2315
png_debug(3, "Checking pCAL equation type and number of parameters");
2319
if ((type == PNG_EQUATION_LINEAR && nparams != 2) ||
2320
(type == PNG_EQUATION_BASE_E && nparams != 3) ||
2321
(type == PNG_EQUATION_ARBITRARY && nparams != 3) ||
2322
(type == PNG_EQUATION_HYPERBOLIC && nparams != 4))
2324
png_chunk_benign_error(png_ptr, "invalid parameter count");
2328
else if (type >= PNG_EQUATION_LAST)
2330
png_chunk_benign_error(png_ptr, "unrecognized equation type");
2333
for (buf = units; *buf; buf++)
2336
png_debug(3, "Allocating pCAL parameters array");
2338
params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
2339
nparams * (sizeof (png_charp))));
2343
png_chunk_benign_error(png_ptr, "out of memory");
2348
for (i = 0; i < nparams; i++)
2352
png_debug1(3, "Reading pCAL parameter %d", i);
2354
for (params[i] = (png_charp)buf; buf <= endptr && *buf != 0; buf++)
2360
png_free(png_ptr, params);
2361
png_chunk_benign_error(png_ptr, "invalid data");
2366
png_set_pCAL(png_ptr, info_ptr, (png_charp)buffer, X0, X1, type, nparams,
2367
(png_charp)units, params);
2369
png_free(png_ptr, params);
2373
#ifdef PNG_READ_sCAL_SUPPORTED
2376
png_handle_sCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2382
png_debug(1, "in png_handle_sCAL");
2384
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2385
png_chunk_error(png_ptr, "missing IHDR");
2387
else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2389
png_crc_finish(png_ptr, length);
2390
png_chunk_benign_error(png_ptr, "out of place");
2394
else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL) != 0)
2396
png_crc_finish(png_ptr, length);
2397
png_chunk_benign_error(png_ptr, "duplicate");
2402
else if (length < 4)
2404
png_crc_finish(png_ptr, length);
2405
png_chunk_benign_error(png_ptr, "invalid");
2409
png_debug1(2, "Allocating and reading sCAL chunk data (%u bytes)",
2412
buffer = png_read_buffer(png_ptr, length+1, 2);
2416
png_chunk_benign_error(png_ptr, "out of memory");
2417
png_crc_finish(png_ptr, length);
2421
png_crc_read(png_ptr, buffer, length);
2424
if (png_crc_finish(png_ptr, 0) != 0)
2428
if (buffer[0] != 1 && buffer[0] != 2)
2430
png_chunk_benign_error(png_ptr, "invalid unit");
2440
if (png_check_fp_number((png_const_charp)buffer, length, &state, &i) == 0 ||
2441
i >= length || buffer[i++] != 0)
2442
png_chunk_benign_error(png_ptr, "bad width format");
2444
else if (PNG_FP_IS_POSITIVE(state) == 0)
2445
png_chunk_benign_error(png_ptr, "non-positive width");
2452
if (png_check_fp_number((png_const_charp)buffer, length,
2453
&state, &i) == 0 || i != length)
2454
png_chunk_benign_error(png_ptr, "bad height format");
2456
else if (PNG_FP_IS_POSITIVE(state) == 0)
2457
png_chunk_benign_error(png_ptr, "non-positive height");
2461
png_set_sCAL_s(png_ptr, info_ptr, buffer[0],
2462
(png_charp)buffer+1, (png_charp)buffer+heighti);
2467
#ifdef PNG_READ_tIME_SUPPORTED
2469
png_handle_tIME(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2474
png_debug(1, "in png_handle_tIME");
2476
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2477
png_chunk_error(png_ptr, "missing IHDR");
2479
else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME) != 0)
2481
png_crc_finish(png_ptr, length);
2482
png_chunk_benign_error(png_ptr, "duplicate");
2486
if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2487
png_ptr->mode |= PNG_AFTER_IDAT;
2491
png_crc_finish(png_ptr, length);
2492
png_chunk_benign_error(png_ptr, "invalid");
2496
png_crc_read(png_ptr, buf, 7);
2498
if (png_crc_finish(png_ptr, 0) != 0)
2501
mod_time.second = buf[6];
2502
mod_time.minute = buf[5];
2503
mod_time.hour = buf[4];
2504
mod_time.day = buf[3];
2505
mod_time.month = buf[2];
2506
mod_time.year = png_get_uint_16(buf);
2508
png_set_tIME(png_ptr, info_ptr, &mod_time);
2512
#ifdef PNG_READ_tEXt_SUPPORTED
2515
png_handle_tEXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2521
png_uint_32 skip = 0;
2523
png_debug(1, "in png_handle_tEXt");
2525
#ifdef PNG_USER_LIMITS_SUPPORTED
2526
if (png_ptr->user_chunk_cache_max != 0)
2528
if (png_ptr->user_chunk_cache_max == 1)
2530
png_crc_finish(png_ptr, length);
2534
if (--png_ptr->user_chunk_cache_max == 1)
2536
png_crc_finish(png_ptr, length);
2537
png_chunk_benign_error(png_ptr, "no space in chunk cache");
2543
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2544
png_chunk_error(png_ptr, "missing IHDR");
2546
if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2547
png_ptr->mode |= PNG_AFTER_IDAT;
2549
#ifdef PNG_MAX_MALLOC_64K
2550
if (length > 65535U)
2552
png_crc_finish(png_ptr, length);
2553
png_chunk_benign_error(png_ptr, "too large to fit in memory");
2558
buffer = png_read_buffer(png_ptr, length+1, 1);
2562
png_chunk_benign_error(png_ptr, "out of memory");
2566
png_crc_read(png_ptr, buffer, length);
2568
if (png_crc_finish(png_ptr, skip) != 0)
2571
key = (png_charp)buffer;
2574
for (text = key; *text; text++)
2577
if (text != key + length)
2580
text_info.compression = PNG_TEXT_COMPRESSION_NONE;
2581
text_info.key = key;
2582
text_info.lang = NULL;
2583
text_info.lang_key = NULL;
2584
text_info.itxt_length = 0;
2585
text_info.text = text;
2586
text_info.text_length = strlen(text);
2588
if (png_set_text_2(png_ptr, info_ptr, &text_info, 1) != 0)
2589
png_warning(png_ptr, "Insufficient memory to process text chunk");
2593
#ifdef PNG_READ_zTXt_SUPPORTED
2596
png_handle_zTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2598
png_const_charp errmsg = NULL;
2600
png_uint_32 keyword_length;
2602
png_debug(1, "in png_handle_zTXt");
2604
#ifdef PNG_USER_LIMITS_SUPPORTED
2605
if (png_ptr->user_chunk_cache_max != 0)
2607
if (png_ptr->user_chunk_cache_max == 1)
2609
png_crc_finish(png_ptr, length);
2613
if (--png_ptr->user_chunk_cache_max == 1)
2615
png_crc_finish(png_ptr, length);
2616
png_chunk_benign_error(png_ptr, "no space in chunk cache");
2622
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2623
png_chunk_error(png_ptr, "missing IHDR");
2625
if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2626
png_ptr->mode |= PNG_AFTER_IDAT;
2631
buffer = png_read_buffer(png_ptr, length, 2);
2635
png_crc_finish(png_ptr, length);
2636
png_chunk_benign_error(png_ptr, "out of memory");
2640
png_crc_read(png_ptr, buffer, length);
2642
if (png_crc_finish(png_ptr, 0) != 0)
2646
for (keyword_length = 0;
2647
keyword_length < length && buffer[keyword_length] != 0;
2651
if (keyword_length > 79 || keyword_length < 1)
2652
errmsg = "bad keyword";
2658
else if (keyword_length + 3 > length)
2659
errmsg = "truncated";
2661
else if (buffer[keyword_length+1] != PNG_COMPRESSION_TYPE_BASE)
2662
errmsg = "unknown compression type";
2666
png_alloc_size_t uncompressed_length = PNG_SIZE_MAX;
2672
if (png_decompress_chunk(png_ptr, length, keyword_length+2,
2673
&uncompressed_length, 1) == Z_STREAM_END)
2677
if (png_ptr->read_buffer == NULL)
2678
errmsg="Read failure in png_handle_zTXt";
2685
buffer = png_ptr->read_buffer;
2686
buffer[uncompressed_length+(keyword_length+2)] = 0;
2688
text.compression = PNG_TEXT_COMPRESSION_zTXt;
2689
text.key = (png_charp)buffer;
2690
text.text = (png_charp)(buffer + keyword_length+2);
2691
text.text_length = uncompressed_length;
2692
text.itxt_length = 0;
2694
text.lang_key = NULL;
2696
if (png_set_text_2(png_ptr, info_ptr, &text, 1) != 0)
2697
errmsg = "insufficient memory";
2702
errmsg = png_ptr->zstream.msg;
2706
png_chunk_benign_error(png_ptr, errmsg);
2710
#ifdef PNG_READ_iTXt_SUPPORTED
2713
png_handle_iTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2715
png_const_charp errmsg = NULL;
2717
png_uint_32 prefix_length;
2719
png_debug(1, "in png_handle_iTXt");
2721
#ifdef PNG_USER_LIMITS_SUPPORTED
2722
if (png_ptr->user_chunk_cache_max != 0)
2724
if (png_ptr->user_chunk_cache_max == 1)
2726
png_crc_finish(png_ptr, length);
2730
if (--png_ptr->user_chunk_cache_max == 1)
2732
png_crc_finish(png_ptr, length);
2733
png_chunk_benign_error(png_ptr, "no space in chunk cache");
2739
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
2740
png_chunk_error(png_ptr, "missing IHDR");
2742
if ((png_ptr->mode & PNG_HAVE_IDAT) != 0)
2743
png_ptr->mode |= PNG_AFTER_IDAT;
2745
buffer = png_read_buffer(png_ptr, length+1, 1);
2749
png_crc_finish(png_ptr, length);
2750
png_chunk_benign_error(png_ptr, "out of memory");
2754
png_crc_read(png_ptr, buffer, length);
2756
if (png_crc_finish(png_ptr, 0) != 0)
2760
for (prefix_length=0;
2761
prefix_length < length && buffer[prefix_length] != 0;
2766
if (prefix_length > 79 || prefix_length < 1)
2767
errmsg = "bad keyword";
2773
else if (prefix_length + 5 > length)
2774
errmsg = "truncated";
2776
else if (buffer[prefix_length+1] == 0 ||
2777
(buffer[prefix_length+1] == 1 &&
2778
buffer[prefix_length+2] == PNG_COMPRESSION_TYPE_BASE))
2780
int compressed = buffer[prefix_length+1] != 0;
2781
png_uint_32 language_offset, translated_keyword_offset;
2782
png_alloc_size_t uncompressed_length = 0;
2786
language_offset = prefix_length;
2788
for (; prefix_length < length && buffer[prefix_length] != 0;
2793
translated_keyword_offset = ++prefix_length;
2795
for (; prefix_length < length && buffer[prefix_length] != 0;
2806
if (compressed == 0 && prefix_length <= length)
2807
uncompressed_length = length - prefix_length;
2809
else if (compressed != 0 && prefix_length < length)
2811
uncompressed_length = PNG_SIZE_MAX;
2817
if (png_decompress_chunk(png_ptr, length, prefix_length,
2818
&uncompressed_length, 1) == Z_STREAM_END)
2819
buffer = png_ptr->read_buffer;
2822
errmsg = png_ptr->zstream.msg;
2826
errmsg = "truncated";
2832
buffer[uncompressed_length+prefix_length] = 0;
2834
if (compressed == 0)
2835
text.compression = PNG_ITXT_COMPRESSION_NONE;
2838
text.compression = PNG_ITXT_COMPRESSION_zTXt;
2840
text.key = (png_charp)buffer;
2841
text.lang = (png_charp)buffer + language_offset;
2842
text.lang_key = (png_charp)buffer + translated_keyword_offset;
2843
text.text = (png_charp)buffer + prefix_length;
2844
text.text_length = 0;
2845
text.itxt_length = uncompressed_length;
2847
if (png_set_text_2(png_ptr, info_ptr, &text, 1) != 0)
2848
errmsg = "insufficient memory";
2853
errmsg = "bad compression info";
2856
png_chunk_benign_error(png_ptr, errmsg);
2860
#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
2863
png_cache_unknown_chunk(png_structrp png_ptr, png_uint_32 length)
2865
png_alloc_size_t limit = PNG_SIZE_MAX;
2867
if (png_ptr->unknown_chunk.data != NULL)
2869
png_free(png_ptr, png_ptr->unknown_chunk.data);
2870
png_ptr->unknown_chunk.data = NULL;
2873
# ifdef PNG_SET_USER_LIMITS_SUPPORTED
2874
if (png_ptr->user_chunk_malloc_max > 0 &&
2875
png_ptr->user_chunk_malloc_max < limit)
2876
limit = png_ptr->user_chunk_malloc_max;
2878
# elif PNG_USER_CHUNK_MALLOC_MAX > 0
2879
if (PNG_USER_CHUNK_MALLOC_MAX < limit)
2880
limit = PNG_USER_CHUNK_MALLOC_MAX;
2883
if (length <= limit)
2885
PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
2887
png_ptr->unknown_chunk.size = (size_t)length;
2889
png_ptr->unknown_chunk.location = (png_byte)png_ptr->mode;
2892
png_ptr->unknown_chunk.data = NULL;
2897
png_ptr->unknown_chunk.data = png_voidcast(png_bytep,
2898
png_malloc_warn(png_ptr, length));
2902
if (png_ptr->unknown_chunk.data == NULL && length > 0)
2905
png_crc_finish(png_ptr, length);
2906
png_chunk_benign_error(png_ptr, "unknown chunk exceeds memory limits");
2913
png_crc_read(png_ptr, png_ptr->unknown_chunk.data, length);
2914
png_crc_finish(png_ptr, 0);
2922
png_handle_unknown(png_structrp png_ptr, png_inforp info_ptr,
2923
png_uint_32 length, int keep)
2927
png_debug(1, "in png_handle_unknown");
2929
#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
2941
# ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
2942
# ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
2943
keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name);
2951
# ifdef PNG_READ_USER_CHUNKS_SUPPORTED
2955
if (png_ptr->read_user_chunk_fn != NULL)
2957
if (png_cache_unknown_chunk(png_ptr, length) != 0)
2960
int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr,
2961
&png_ptr->unknown_chunk);
2973
png_chunk_error(png_ptr, "error in user chunk");
2988
if (keep < PNG_HANDLE_CHUNK_IF_SAFE)
2990
# ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
2991
if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE)
2993
png_chunk_warning(png_ptr, "Saving unknown chunk:");
2994
png_app_warning(png_ptr,
2995
"forcing save of an unhandled chunk;"
2996
" please call png_set_keep_unknown_chunks");
3000
keep = PNG_HANDLE_CHUNK_IF_SAFE;
3008
keep = PNG_HANDLE_CHUNK_NEVER;
3013
keep = PNG_HANDLE_CHUNK_NEVER;
3020
# ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED
3027
if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT)
3028
keep = png_ptr->unknown_default;
3030
if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
3031
(keep == PNG_HANDLE_CHUNK_IF_SAFE &&
3032
PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
3034
if (png_cache_unknown_chunk(png_ptr, length) == 0)
3035
keep = PNG_HANDLE_CHUNK_NEVER;
3039
png_crc_finish(png_ptr, length);
3042
# ifndef PNG_READ_USER_CHUNKS_SUPPORTED
3043
# error no method to support READ_UNKNOWN_CHUNKS
3053
if (keep > PNG_HANDLE_CHUNK_NEVER)
3054
png_app_error(png_ptr, "no unknown chunk support available");
3056
png_crc_finish(png_ptr, length);
3060
# ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
3064
if (keep == PNG_HANDLE_CHUNK_ALWAYS ||
3065
(keep == PNG_HANDLE_CHUNK_IF_SAFE &&
3066
PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
3068
# ifdef PNG_USER_LIMITS_SUPPORTED
3069
switch (png_ptr->user_chunk_cache_max)
3072
png_ptr->user_chunk_cache_max = 1;
3073
png_chunk_benign_error(png_ptr, "no space in chunk cache");
3082
--(png_ptr->user_chunk_cache_max);
3089
png_set_unknown_chunks(png_ptr, info_ptr,
3090
&png_ptr->unknown_chunk, 1);
3092
# ifdef PNG_USER_LIMITS_SUPPORTED
3098
PNG_UNUSED(info_ptr)
3105
if (png_ptr->unknown_chunk.data != NULL)
3106
png_free(png_ptr, png_ptr->unknown_chunk.data);
3107
png_ptr->unknown_chunk.data = NULL;
3111
png_crc_finish(png_ptr, length);
3112
PNG_UNUSED(info_ptr)
3117
if (handled == 0 && PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
3118
png_chunk_error(png_ptr, "unhandled critical chunk");
3134
png_check_chunk_name(png_const_structrp png_ptr, png_uint_32 chunk_name)
3137
png_uint_32 cn=chunk_name;
3139
png_debug(1, "in png_check_chunk_name");
3141
for (i=1; i<=4; ++i)
3145
if (c < 65 || c > 122 || (c > 90 && c < 97))
3146
png_chunk_error(png_ptr, "invalid chunk type");
3153
png_check_chunk_length(png_const_structrp png_ptr, png_uint_32 length)
3155
png_alloc_size_t limit = PNG_UINT_31_MAX;
3157
# ifdef PNG_SET_USER_LIMITS_SUPPORTED
3158
if (png_ptr->user_chunk_malloc_max > 0 &&
3159
png_ptr->user_chunk_malloc_max < limit)
3160
limit = png_ptr->user_chunk_malloc_max;
3161
# elif PNG_USER_CHUNK_MALLOC_MAX > 0
3162
if (PNG_USER_CHUNK_MALLOC_MAX < limit)
3163
limit = PNG_USER_CHUNK_MALLOC_MAX;
3165
if (png_ptr->chunk_name == png_IDAT)
3167
png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
3169
(size_t)png_ptr->width
3170
* (size_t)png_ptr->channels
3171
* (png_ptr->bit_depth > 8? 2: 1)
3173
+ (png_ptr->interlaced? 6: 0);
3174
if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
3175
idat_limit = PNG_UINT_31_MAX;
3177
idat_limit = png_ptr->height * row_factor;
3178
row_factor = row_factor > 32566? 32566 : row_factor;
3179
idat_limit += 6 + 5*(idat_limit/row_factor+1);
3180
idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX;
3181
limit = limit < idat_limit? idat_limit : limit;
3186
png_debug2(0," length = %lu, limit = %lu",
3187
(unsigned long)length,(unsigned long)limit);
3188
png_benign_error(png_ptr, "chunk data is too large");
3200
png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
3202
unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
3203
png_const_bytep sp = png_ptr->row_buf + 1;
3204
png_alloc_size_t row_width = png_ptr->width;
3205
unsigned int pass = png_ptr->pass;
3206
png_bytep end_ptr = 0;
3207
png_byte end_byte = 0;
3208
unsigned int end_mask;
3210
png_debug(1, "in png_combine_row");
3215
if (pixel_depth == 0)
3216
png_error(png_ptr, "internal row logic error");
3222
if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes !=
3223
PNG_ROWBYTES(pixel_depth, row_width))
3224
png_error(png_ptr, "internal row size calculation error");
3228
png_error(png_ptr, "internal row width error");
3234
end_mask = (pixel_depth * row_width) & 7;
3238
end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1;
3239
end_byte = *end_ptr;
3240
# ifdef PNG_READ_PACKSWAP_SUPPORTED
3241
if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
3243
end_mask = (unsigned int)(0xff << end_mask);
3247
end_mask = 0xff >> end_mask;
3257
#ifdef PNG_READ_INTERLACING_SUPPORTED
3258
if (png_ptr->interlaced != 0 &&
3259
(png_ptr->transformations & PNG_INTERLACE) != 0 &&
3260
pass < 6 && (display == 0 ||
3262
(display == 1 && (pass & 1) != 0)))
3267
if (row_width <= PNG_PASS_START_COL(pass))
3270
if (pixel_depth < 8)
3309
# if PNG_USE_COMPILE_TIME_MASKS
3310
# define PNG_LSR(x,s) ((x)>>((s) & 0x1f))
3311
# define PNG_LSL(x,s) ((x)<<((s) & 0x1f))
3313
# define PNG_LSR(x,s) ((x)>>(s))
3314
# define PNG_LSL(x,s) ((x)<<(s))
3316
# define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\
3317
PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1)
3318
# define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\
3319
PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1)
3327
# define PIXEL_MASK(p,x,d,s) \
3328
(PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0))))
3332
# define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
3333
# define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
3339
# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
3341
# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
3342
S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
3343
S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
3345
# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
3346
B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
3347
B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
3349
#if PNG_USE_COMPILE_TIME_MASKS
3355
# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
3356
S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
3358
# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
3360
# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
3365
static const png_uint_32 row_mask[2][3][6] =
3368
{ S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
3370
{ S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) }
3376
static const png_uint_32 display_mask[2][3][3] =
3379
{ B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
3381
{ B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) }
3384
# define MASK(pass,depth,display,png)\
3385
((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
3386
row_mask[png][DEPTH_INDEX(depth)][pass])
3392
# define MASK(pass,depth,display,png)\
3393
((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png))
3401
png_uint_32 pixels_per_byte = 8 / pixel_depth;
3404
# ifdef PNG_READ_PACKSWAP_SUPPORTED
3405
if ((png_ptr->transformations & PNG_PACKSWAP) != 0)
3406
mask = MASK(pass, pixel_depth, display, 0);
3410
mask = MASK(pass, pixel_depth, display, 1);
3421
mask = (m >> 8) | (m << 24);
3427
*dp = (png_byte)((*dp & ~m) | (*sp & m));
3436
if (row_width <= pixels_per_byte)
3439
row_width -= pixels_per_byte;
3447
unsigned int bytes_to_copy, bytes_to_jump;
3450
if (pixel_depth & 7)
3451
png_error(png_ptr, "invalid user transform pixel depth");
3454
row_width *= pixel_depth;
3461
unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth;
3463
row_width -= offset;
3475
bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth;
3478
if (bytes_to_copy > row_width)
3479
bytes_to_copy = (unsigned int)row_width;
3483
bytes_to_copy = pixel_depth;
3486
bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;
3496
switch (bytes_to_copy)
3503
if (row_width <= bytes_to_jump)
3506
dp += bytes_to_jump;
3507
sp += bytes_to_jump;
3508
row_width -= bytes_to_jump;
3517
dp[0] = sp[0]; dp[1] = sp[1];
3519
if (row_width <= bytes_to_jump)
3522
sp += bytes_to_jump;
3523
dp += bytes_to_jump;
3524
row_width -= bytes_to_jump;
3526
while (row_width > 1);
3538
dp[0] = sp[0]; dp[1] = sp[1]; dp[2] = sp[2];
3540
if (row_width <= bytes_to_jump)
3543
sp += bytes_to_jump;
3544
dp += bytes_to_jump;
3545
row_width -= bytes_to_jump;
3549
#if PNG_ALIGN_TYPE != PNG_ALIGN_NONE
3555
if (bytes_to_copy < 16 &&
3556
png_isaligned(dp, png_uint_16) &&
3557
png_isaligned(sp, png_uint_16) &&
3558
bytes_to_copy % (sizeof (png_uint_16)) == 0 &&
3559
bytes_to_jump % (sizeof (png_uint_16)) == 0)
3564
if (png_isaligned(dp, png_uint_32) &&
3565
png_isaligned(sp, png_uint_32) &&
3566
bytes_to_copy % (sizeof (png_uint_32)) == 0 &&
3567
bytes_to_jump % (sizeof (png_uint_32)) == 0)
3569
png_uint_32p dp32 = png_aligncast(png_uint_32p,dp);
3570
png_const_uint_32p sp32 = png_aligncastconst(
3571
png_const_uint_32p, sp);
3572
size_t skip = (bytes_to_jump-bytes_to_copy) /
3573
(sizeof (png_uint_32));
3577
size_t c = bytes_to_copy;
3581
c -= (sizeof (png_uint_32));
3585
if (row_width <= bytes_to_jump)
3590
row_width -= bytes_to_jump;
3592
while (bytes_to_copy <= row_width);
3598
dp = (png_bytep)dp32;
3599
sp = (png_const_bytep)sp32;
3602
while (--row_width > 0);
3611
png_uint_16p dp16 = png_aligncast(png_uint_16p, dp);
3612
png_const_uint_16p sp16 = png_aligncastconst(
3613
png_const_uint_16p, sp);
3614
size_t skip = (bytes_to_jump-bytes_to_copy) /
3615
(sizeof (png_uint_16));
3619
size_t c = bytes_to_copy;
3623
c -= (sizeof (png_uint_16));
3627
if (row_width <= bytes_to_jump)
3632
row_width -= bytes_to_jump;
3634
while (bytes_to_copy <= row_width);
3637
dp = (png_bytep)dp16;
3638
sp = (png_const_bytep)sp16;
3641
while (--row_width > 0);
3650
memcpy(dp, sp, bytes_to_copy);
3652
if (row_width <= bytes_to_jump)
3655
sp += bytes_to_jump;
3656
dp += bytes_to_jump;
3657
row_width -= bytes_to_jump;
3658
if (bytes_to_copy > row_width)
3659
bytes_to_copy = (unsigned int)row_width;
3675
memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width));
3678
if (end_ptr != NULL)
3679
*end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask));
3682
#ifdef PNG_READ_INTERLACING_SUPPORTED
3684
png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
3685
png_uint_32 transformations )
3689
static const unsigned int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
3691
png_debug(1, "in png_do_read_interlace");
3692
if (row != NULL && row_info != NULL)
3694
png_uint_32 final_width;
3696
final_width = row_info->width * png_pass_inc[pass];
3698
switch (row_info->pixel_depth)
3702
png_bytep sp = row + (size_t)((row_info->width - 1) >> 3);
3703
png_bytep dp = row + (size_t)((final_width - 1) >> 3);
3704
unsigned int sshift, dshift;
3705
unsigned int s_start, s_end;
3707
int jstop = (int)png_pass_inc[pass];
3712
#ifdef PNG_READ_PACKSWAP_SUPPORTED
3713
if ((transformations & PNG_PACKSWAP) != 0)
3715
sshift = ((row_info->width + 7) & 0x07);
3716
dshift = ((final_width + 7) & 0x07);
3725
sshift = 7 - ((row_info->width + 7) & 0x07);
3726
dshift = 7 - ((final_width + 7) & 0x07);
3732
for (i = 0; i < row_info->width; i++)
3734
v = (png_byte)((*sp >> sshift) & 0x01);
3735
for (j = 0; j < jstop; j++)
3737
unsigned int tmp = *dp & (0x7f7f >> (7 - dshift));
3738
tmp |= (unsigned int)(v << dshift);
3739
*dp = (png_byte)(tmp & 0xff);
3741
if (dshift == s_end)
3748
dshift = (unsigned int)((int)dshift + s_inc);
3751
if (sshift == s_end)
3758
sshift = (unsigned int)((int)sshift + s_inc);
3765
png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2);
3766
png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2);
3767
unsigned int sshift, dshift;
3768
unsigned int s_start, s_end;
3770
int jstop = (int)png_pass_inc[pass];
3773
#ifdef PNG_READ_PACKSWAP_SUPPORTED
3774
if ((transformations & PNG_PACKSWAP) != 0)
3776
sshift = (((row_info->width + 3) & 0x03) << 1);
3777
dshift = (((final_width + 3) & 0x03) << 1);
3786
sshift = ((3 - ((row_info->width + 3) & 0x03)) << 1);
3787
dshift = ((3 - ((final_width + 3) & 0x03)) << 1);
3793
for (i = 0; i < row_info->width; i++)
3798
v = (png_byte)((*sp >> sshift) & 0x03);
3799
for (j = 0; j < jstop; j++)
3801
unsigned int tmp = *dp & (0x3f3f >> (6 - dshift));
3802
tmp |= (unsigned int)(v << dshift);
3803
*dp = (png_byte)(tmp & 0xff);
3805
if (dshift == s_end)
3812
dshift = (unsigned int)((int)dshift + s_inc);
3815
if (sshift == s_end)
3822
sshift = (unsigned int)((int)sshift + s_inc);
3829
png_bytep sp = row + (size_t)((row_info->width - 1) >> 1);
3830
png_bytep dp = row + (size_t)((final_width - 1) >> 1);
3831
unsigned int sshift, dshift;
3832
unsigned int s_start, s_end;
3835
int jstop = (int)png_pass_inc[pass];
3837
#ifdef PNG_READ_PACKSWAP_SUPPORTED
3838
if ((transformations & PNG_PACKSWAP) != 0)
3840
sshift = (((row_info->width + 1) & 0x01) << 2);
3841
dshift = (((final_width + 1) & 0x01) << 2);
3850
sshift = ((1 - ((row_info->width + 1) & 0x01)) << 2);
3851
dshift = ((1 - ((final_width + 1) & 0x01)) << 2);
3857
for (i = 0; i < row_info->width; i++)
3859
png_byte v = (png_byte)((*sp >> sshift) & 0x0f);
3862
for (j = 0; j < jstop; j++)
3864
unsigned int tmp = *dp & (0xf0f >> (4 - dshift));
3865
tmp |= (unsigned int)(v << dshift);
3866
*dp = (png_byte)(tmp & 0xff);
3868
if (dshift == s_end)
3875
dshift = (unsigned int)((int)dshift + s_inc);
3878
if (sshift == s_end)
3885
sshift = (unsigned int)((int)sshift + s_inc);
3892
size_t pixel_bytes = (row_info->pixel_depth >> 3);
3894
png_bytep sp = row + (size_t)(row_info->width - 1)
3897
png_bytep dp = row + (size_t)(final_width - 1) * pixel_bytes;
3899
int jstop = (int)png_pass_inc[pass];
3902
for (i = 0; i < row_info->width; i++)
3907
memcpy(v, sp, pixel_bytes);
3909
for (j = 0; j < jstop; j++)
3911
memcpy(dp, v, pixel_bytes);
3921
row_info->width = final_width;
3922
row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);
3924
#ifndef PNG_READ_PACKSWAP_SUPPORTED
3925
PNG_UNUSED(transformations)
3931
png_read_filter_row_sub(png_row_infop row_info, png_bytep row,
3932
png_const_bytep prev_row)
3935
size_t istop = row_info->rowbytes;
3936
unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
3937
png_bytep rp = row + bpp;
3939
PNG_UNUSED(prev_row)
3941
for (i = bpp; i < istop; i++)
3943
*rp = (png_byte)(((int)(*rp) + (int)(*(rp-bpp))) & 0xff);
3949
png_read_filter_row_up(png_row_infop row_info, png_bytep row,
3950
png_const_bytep prev_row)
3953
size_t istop = row_info->rowbytes;
3955
png_const_bytep pp = prev_row;
3957
for (i = 0; i < istop; i++)
3959
*rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff);
3965
png_read_filter_row_avg(png_row_infop row_info, png_bytep row,
3966
png_const_bytep prev_row)
3970
png_const_bytep pp = prev_row;
3971
unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
3972
size_t istop = row_info->rowbytes - bpp;
3974
for (i = 0; i < bpp; i++)
3976
*rp = (png_byte)(((int)(*rp) +
3977
((int)(*pp++) / 2 )) & 0xff);
3982
for (i = 0; i < istop; i++)
3984
*rp = (png_byte)(((int)(*rp) +
3985
(int)(*pp++ + *(rp-bpp)) / 2 ) & 0xff);
3992
png_read_filter_row_paeth_1byte_pixel(png_row_infop row_info, png_bytep row,
3993
png_const_bytep prev_row)
3995
png_bytep rp_end = row + row_info->rowbytes;
4001
*row++ = (png_byte)a;
4004
while (row < rp_end)
4006
int b, pa, pb, pc, p;
4019
pa = p < 0 ? -p : p;
4020
pb = pc < 0 ? -pc : pc;
4021
pc = (p + pc) < 0 ? -(p + pc) : p + pc;
4038
*row++ = (png_byte)a;
4043
png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
4044
png_const_bytep prev_row)
4046
unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
4047
png_bytep rp_end = row + bpp;
4052
while (row < rp_end)
4054
int a = *row + *prev_row++;
4055
*row++ = (png_byte)a;
4059
rp_end = rp_end + (row_info->rowbytes - bpp);
4061
while (row < rp_end)
4063
int a, b, c, pa, pb, pc, p;
4065
c = *(prev_row - bpp);
4077
pa = p < 0 ? -p : p;
4078
pb = pc < 0 ? -pc : pc;
4079
pc = (p + pc) < 0 ? -(p + pc) : p + pc;
4089
*row++ = (png_byte)a;
4094
png_init_filter_functions(png_structrp pp)
4105
unsigned int bpp = (pp->pixel_depth + 7) >> 3;
4107
pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub;
4108
pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up;
4109
pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg;
4111
pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
4112
png_read_filter_row_paeth_1byte_pixel;
4114
pp->read_filter[PNG_FILTER_VALUE_PAETH-1] =
4115
png_read_filter_row_paeth_multibyte_pixel;
4117
#ifdef PNG_FILTER_OPTIMIZATIONS
4126
PNG_FILTER_OPTIMIZATIONS(pp, bpp);
4131
png_read_filter_row(png_structrp pp, png_row_infop row_info, png_bytep row,
4132
png_const_bytep prev_row, int filter)
4138
if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
4140
if (pp->read_filter[0] == NULL)
4141
png_init_filter_functions(pp);
4143
pp->read_filter[filter-1](row_info, row, prev_row);
4147
#ifdef PNG_SEQUENTIAL_READ_SUPPORTED
4149
png_read_IDAT_data(png_structrp png_ptr, png_bytep output,
4150
png_alloc_size_t avail_out)
4153
png_ptr->zstream.next_out = output;
4154
png_ptr->zstream.avail_out = 0;
4162
png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
4164
if (png_ptr->zstream.avail_in == 0)
4169
while (png_ptr->idat_size == 0)
4171
png_crc_finish(png_ptr, 0);
4173
png_ptr->idat_size = png_read_chunk_header(png_ptr);
4177
if (png_ptr->chunk_name != png_IDAT)
4178
png_error(png_ptr, "Not enough image data");
4181
avail_in = png_ptr->IDAT_read_size;
4183
if (avail_in > png_ptr->idat_size)
4184
avail_in = (uInt)png_ptr->idat_size;
4191
buffer = png_read_buffer(png_ptr, avail_in, 0);
4193
png_crc_read(png_ptr, buffer, avail_in);
4194
png_ptr->idat_size -= avail_in;
4196
png_ptr->zstream.next_in = buffer;
4197
png_ptr->zstream.avail_in = avail_in;
4203
uInt out = ZLIB_IO_MAX;
4205
if (out > avail_out)
4206
out = (uInt)avail_out;
4209
png_ptr->zstream.avail_out = out;
4214
png_ptr->zstream.next_out = tmpbuf;
4215
png_ptr->zstream.avail_out = (sizeof tmpbuf);
4225
ret = PNG_INFLATE(png_ptr, Z_NO_FLUSH);
4229
avail_out += png_ptr->zstream.avail_out;
4232
avail_out += (sizeof tmpbuf) - png_ptr->zstream.avail_out;
4234
png_ptr->zstream.avail_out = 0;
4236
if (ret == Z_STREAM_END)
4239
png_ptr->zstream.next_out = NULL;
4241
png_ptr->mode |= PNG_AFTER_IDAT;
4242
png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
4244
if (png_ptr->zstream.avail_in > 0 || png_ptr->idat_size > 0)
4245
png_chunk_benign_error(png_ptr, "Extra compressed data");
4251
png_zstream_error(png_ptr, ret);
4254
png_chunk_error(png_ptr, png_ptr->zstream.msg);
4258
png_chunk_benign_error(png_ptr, png_ptr->zstream.msg);
4262
} while (avail_out > 0);
4270
png_error(png_ptr, "Not enough image data");
4273
png_chunk_benign_error(png_ptr, "Too much image data");
4278
png_read_finish_IDAT(png_structrp png_ptr)
4285
if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
4291
png_read_IDAT_data(png_ptr, NULL, 0);
4292
png_ptr->zstream.next_out = NULL;
4297
if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
4299
png_ptr->mode |= PNG_AFTER_IDAT;
4300
png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
4307
if (png_ptr->zowner == png_IDAT)
4310
png_ptr->zstream.next_in = NULL;
4311
png_ptr->zstream.avail_in = 0;
4314
png_ptr->zowner = 0;
4321
(void)png_crc_finish(png_ptr, png_ptr->idat_size);
4326
png_read_finish_row(png_structrp png_ptr)
4331
static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
4334
static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
4337
static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
4340
static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
4342
png_debug(1, "in png_read_finish_row");
4343
png_ptr->row_number++;
4344
if (png_ptr->row_number < png_ptr->num_rows)
4347
if (png_ptr->interlaced != 0)
4349
png_ptr->row_number = 0;
4354
memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
4360
if (png_ptr->pass >= 7)
4363
png_ptr->iwidth = (png_ptr->width +
4364
png_pass_inc[png_ptr->pass] - 1 -
4365
png_pass_start[png_ptr->pass]) /
4366
png_pass_inc[png_ptr->pass];
4368
if ((png_ptr->transformations & PNG_INTERLACE) == 0)
4370
png_ptr->num_rows = (png_ptr->height +
4371
png_pass_yinc[png_ptr->pass] - 1 -
4372
png_pass_ystart[png_ptr->pass]) /
4373
png_pass_yinc[png_ptr->pass];
4379
} while (png_ptr->num_rows == 0 || png_ptr->iwidth == 0);
4381
if (png_ptr->pass < 7)
4386
png_read_finish_IDAT(png_ptr);
4391
png_read_start_row(png_structrp png_ptr)
4396
static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
4399
static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
4402
static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
4405
static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
4407
unsigned int max_pixel_depth;
4410
png_debug(1, "in png_read_start_row");
4412
#ifdef PNG_READ_TRANSFORMS_SUPPORTED
4413
png_init_read_transformations(png_ptr);
4415
if (png_ptr->interlaced != 0)
4417
if ((png_ptr->transformations & PNG_INTERLACE) == 0)
4418
png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
4419
png_pass_ystart[0]) / png_pass_yinc[0];
4422
png_ptr->num_rows = png_ptr->height;
4424
png_ptr->iwidth = (png_ptr->width +
4425
png_pass_inc[png_ptr->pass] - 1 -
4426
png_pass_start[png_ptr->pass]) /
4427
png_pass_inc[png_ptr->pass];
4432
png_ptr->num_rows = png_ptr->height;
4433
png_ptr->iwidth = png_ptr->width;
4436
max_pixel_depth = (unsigned int)png_ptr->pixel_depth;
4448
#ifdef PNG_READ_PACK_SUPPORTED
4449
if ((png_ptr->transformations & PNG_PACK) != 0 && png_ptr->bit_depth < 8)
4450
max_pixel_depth = 8;
4453
#ifdef PNG_READ_EXPAND_SUPPORTED
4454
if ((png_ptr->transformations & PNG_EXPAND) != 0)
4456
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
4458
if (png_ptr->num_trans != 0)
4459
max_pixel_depth = 32;
4462
max_pixel_depth = 24;
4465
else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
4467
if (max_pixel_depth < 8)
4468
max_pixel_depth = 8;
4470
if (png_ptr->num_trans != 0)
4471
max_pixel_depth *= 2;
4474
else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
4476
if (png_ptr->num_trans != 0)
4478
max_pixel_depth *= 4;
4479
max_pixel_depth /= 3;
4485
#ifdef PNG_READ_EXPAND_16_SUPPORTED
4486
if ((png_ptr->transformations & PNG_EXPAND_16) != 0)
4488
# ifdef PNG_READ_EXPAND_SUPPORTED
4492
if ((png_ptr->transformations & PNG_EXPAND) != 0)
4494
if (png_ptr->bit_depth < 16)
4495
max_pixel_depth *= 2;
4499
png_ptr->transformations &= ~PNG_EXPAND_16;
4503
#ifdef PNG_READ_FILLER_SUPPORTED
4504
if ((png_ptr->transformations & (PNG_FILLER)) != 0)
4506
if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
4508
if (max_pixel_depth <= 8)
4509
max_pixel_depth = 16;
4512
max_pixel_depth = 32;
4515
else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB ||
4516
png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
4518
if (max_pixel_depth <= 32)
4519
max_pixel_depth = 32;
4522
max_pixel_depth = 64;
4527
#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
4528
if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0)
4531
#ifdef PNG_READ_EXPAND_SUPPORTED
4532
(png_ptr->num_trans != 0 &&
4533
(png_ptr->transformations & PNG_EXPAND) != 0) ||
4535
#ifdef PNG_READ_FILLER_SUPPORTED
4536
(png_ptr->transformations & (PNG_FILLER)) != 0 ||
4538
png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
4540
if (max_pixel_depth <= 16)
4541
max_pixel_depth = 32;
4544
max_pixel_depth = 64;
4549
if (max_pixel_depth <= 8)
4551
if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4552
max_pixel_depth = 32;
4555
max_pixel_depth = 24;
4558
else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4559
max_pixel_depth = 64;
4562
max_pixel_depth = 48;
4567
#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
4568
defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
4569
if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0)
4571
unsigned int user_pixel_depth = png_ptr->user_transform_depth *
4572
png_ptr->user_transform_channels;
4574
if (user_pixel_depth > max_pixel_depth)
4575
max_pixel_depth = user_pixel_depth;
4582
png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;
4583
png_ptr->transformed_pixel_depth = 0;
4588
row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));
4592
row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
4593
1 + ((max_pixel_depth + 7) >> 3U);
4595
#ifdef PNG_MAX_MALLOC_64K
4596
if (row_bytes > (png_uint_32)65536L)
4597
png_error(png_ptr, "This image requires a row greater than 64KB");
4600
if (row_bytes + 48 > png_ptr->old_big_row_buf_size)
4602
png_free(png_ptr, png_ptr->big_row_buf);
4603
png_free(png_ptr, png_ptr->big_prev_row);
4605
if (png_ptr->interlaced != 0)
4606
png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr,
4610
png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
4612
png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48);
4614
#ifdef PNG_ALIGNED_MEMORY_SUPPORTED
4623
png_bytep temp = png_ptr->big_row_buf + 32;
4624
size_t extra = (size_t)temp & 0x0f;
4625
png_ptr->row_buf = temp - extra - 1;
4627
temp = png_ptr->big_prev_row + 32;
4628
extra = (size_t)temp & 0x0f;
4629
png_ptr->prev_row = temp - extra - 1;
4633
png_ptr->row_buf = png_ptr->big_row_buf + 31;
4634
png_ptr->prev_row = png_ptr->big_prev_row + 31;
4636
png_ptr->old_big_row_buf_size = row_bytes + 48;
4639
#ifdef PNG_MAX_MALLOC_64K
4640
if (png_ptr->rowbytes > 65535)
4641
png_error(png_ptr, "This image requires a row greater than 64KB");
4644
if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1))
4645
png_error(png_ptr, "Row has too many bytes to allocate in memory");
4647
memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
4649
png_debug1(3, "width = %u,", png_ptr->width);
4650
png_debug1(3, "height = %u,", png_ptr->height);
4651
png_debug1(3, "iwidth = %u,", png_ptr->iwidth);
4652
png_debug1(3, "num_rows = %u,", png_ptr->num_rows);
4653
png_debug1(3, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes);
4654
png_debug1(3, "irowbytes = %lu",
4655
(unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1);
4661
if (png_ptr->read_buffer != NULL)
4663
png_bytep buffer = png_ptr->read_buffer;
4665
png_ptr->read_buffer_size = 0;
4666
png_ptr->read_buffer = NULL;
4667
png_free(png_ptr, buffer);
4675
if (png_inflate_claim(png_ptr, png_IDAT) != Z_OK)
4676
png_error(png_ptr, png_ptr->zstream.msg);
4678
png_ptr->flags |= PNG_FLAG_ROW_INIT;