opencv

Форк
0
/
pngwutil.c 
2780 строк · 78.5 Кб
1

2
/* pngwutil.c - utilities to write a PNG file
3
 *
4
 * Copyright (c) 2018-2024 Cosmin Truta
5
 * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
6
 * Copyright (c) 1996-1997 Andreas Dilger
7
 * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
8
 *
9
 * This code is released under the libpng license.
10
 * For conditions of distribution and use, see the disclaimer
11
 * and license in png.h
12
 */
13

14
#include "pngpriv.h"
15

16
#ifdef PNG_WRITE_SUPPORTED
17

18
#ifdef PNG_WRITE_INT_FUNCTIONS_SUPPORTED
19
/* Place a 32-bit number into a buffer in PNG byte order.  We work
20
 * with unsigned numbers for convenience, although one supported
21
 * ancillary chunk uses signed (two's complement) numbers.
22
 */
23
void PNGAPI
24
png_save_uint_32(png_bytep buf, png_uint_32 i)
25
{
26
   buf[0] = (png_byte)((i >> 24) & 0xffU);
27
   buf[1] = (png_byte)((i >> 16) & 0xffU);
28
   buf[2] = (png_byte)((i >>  8) & 0xffU);
29
   buf[3] = (png_byte)( i        & 0xffU);
30
}
31

32
/* Place a 16-bit number into a buffer in PNG byte order.
33
 * The parameter is declared unsigned int, not png_uint_16,
34
 * just to avoid potential problems on pre-ANSI C compilers.
35
 */
36
void PNGAPI
37
png_save_uint_16(png_bytep buf, unsigned int i)
38
{
39
   buf[0] = (png_byte)((i >> 8) & 0xffU);
40
   buf[1] = (png_byte)( i       & 0xffU);
41
}
42
#endif
43

44
/* Simple function to write the signature.  If we have already written
45
 * the magic bytes of the signature, or more likely, the PNG stream is
46
 * being embedded into another stream and doesn't need its own signature,
47
 * we should call png_set_sig_bytes() to tell libpng how many of the
48
 * bytes have already been written.
49
 */
50
void PNGAPI
51
png_write_sig(png_structrp png_ptr)
52
{
53
   png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
54

55
#ifdef PNG_IO_STATE_SUPPORTED
56
   /* Inform the I/O callback that the signature is being written */
57
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_SIGNATURE;
58
#endif
59

60
   /* Write the rest of the 8 byte signature */
61
   png_write_data(png_ptr, &png_signature[png_ptr->sig_bytes],
62
       (size_t)(8 - png_ptr->sig_bytes));
63

64
   if (png_ptr->sig_bytes < 3)
65
      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
66
}
67

68
/* Write the start of a PNG chunk.  The type is the chunk type.
69
 * The total_length is the sum of the lengths of all the data you will be
70
 * passing in png_write_chunk_data().
71
 */
72
static void
73
png_write_chunk_header(png_structrp png_ptr, png_uint_32 chunk_name,
74
    png_uint_32 length)
75
{
76
   png_byte buf[8];
77

78
#if defined(PNG_DEBUG) && (PNG_DEBUG > 0)
79
   PNG_CSTRING_FROM_CHUNK(buf, chunk_name);
80
   png_debug2(0, "Writing %s chunk, length = %lu", buf, (unsigned long)length);
81
#endif
82

83
   if (png_ptr == NULL)
84
      return;
85

86
#ifdef PNG_IO_STATE_SUPPORTED
87
   /* Inform the I/O callback that the chunk header is being written.
88
    * PNG_IO_CHUNK_HDR requires a single I/O call.
89
    */
90
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_HDR;
91
#endif
92

93
   /* Write the length and the chunk name */
94
   png_save_uint_32(buf, length);
95
   png_save_uint_32(buf + 4, chunk_name);
96
   png_write_data(png_ptr, buf, 8);
97

98
   /* Put the chunk name into png_ptr->chunk_name */
99
   png_ptr->chunk_name = chunk_name;
100

101
   /* Reset the crc and run it over the chunk name */
102
   png_reset_crc(png_ptr);
103

104
   png_calculate_crc(png_ptr, buf + 4, 4);
105

106
#ifdef PNG_IO_STATE_SUPPORTED
107
   /* Inform the I/O callback that chunk data will (possibly) be written.
108
    * PNG_IO_CHUNK_DATA does NOT require a specific number of I/O calls.
109
    */
110
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_DATA;
111
#endif
112
}
113

114
void PNGAPI
115
png_write_chunk_start(png_structrp png_ptr, png_const_bytep chunk_string,
116
    png_uint_32 length)
117
{
118
   png_write_chunk_header(png_ptr, PNG_CHUNK_FROM_STRING(chunk_string), length);
119
}
120

121
/* Write the data of a PNG chunk started with png_write_chunk_header().
122
 * Note that multiple calls to this function are allowed, and that the
123
 * sum of the lengths from these calls *must* add up to the total_length
124
 * given to png_write_chunk_header().
125
 */
126
void PNGAPI
127
png_write_chunk_data(png_structrp png_ptr, png_const_bytep data, size_t length)
128
{
129
   /* Write the data, and run the CRC over it */
130
   if (png_ptr == NULL)
131
      return;
132

133
   if (data != NULL && length > 0)
134
   {
135
      png_write_data(png_ptr, data, length);
136

137
      /* Update the CRC after writing the data,
138
       * in case the user I/O routine alters it.
139
       */
140
      png_calculate_crc(png_ptr, data, length);
141
   }
142
}
143

144
/* Finish a chunk started with png_write_chunk_header(). */
145
void PNGAPI
146
png_write_chunk_end(png_structrp png_ptr)
147
{
148
   png_byte buf[4];
149

150
   if (png_ptr == NULL) return;
151

152
#ifdef PNG_IO_STATE_SUPPORTED
153
   /* Inform the I/O callback that the chunk CRC is being written.
154
    * PNG_IO_CHUNK_CRC requires a single I/O function call.
155
    */
156
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_CRC;
157
#endif
158

159
   /* Write the crc in a single operation */
160
   png_save_uint_32(buf, png_ptr->crc);
161

162
   png_write_data(png_ptr, buf, 4);
163
}
164

165
/* Write a PNG chunk all at once.  The type is an array of ASCII characters
166
 * representing the chunk name.  The array must be at least 4 bytes in
167
 * length, and does not need to be null terminated.  To be safe, pass the
168
 * pre-defined chunk names here, and if you need a new one, define it
169
 * where the others are defined.  The length is the length of the data.
170
 * All the data must be present.  If that is not possible, use the
171
 * png_write_chunk_start(), png_write_chunk_data(), and png_write_chunk_end()
172
 * functions instead.
173
 */
174
static void
175
png_write_complete_chunk(png_structrp png_ptr, png_uint_32 chunk_name,
176
    png_const_bytep data, size_t length)
177
{
178
   if (png_ptr == NULL)
179
      return;
180

181
   /* On 64-bit architectures 'length' may not fit in a png_uint_32. */
182
   if (length > PNG_UINT_31_MAX)
183
      png_error(png_ptr, "length exceeds PNG maximum");
184

185
   png_write_chunk_header(png_ptr, chunk_name, (png_uint_32)length);
186
   png_write_chunk_data(png_ptr, data, length);
187
   png_write_chunk_end(png_ptr);
188
}
189

190
/* This is the API that calls the internal function above. */
191
void PNGAPI
192
png_write_chunk(png_structrp png_ptr, png_const_bytep chunk_string,
193
    png_const_bytep data, size_t length)
194
{
195
   png_write_complete_chunk(png_ptr, PNG_CHUNK_FROM_STRING(chunk_string), data,
196
       length);
197
}
198

199
/* This is used below to find the size of an image to pass to png_deflate_claim,
200
 * so it only needs to be accurate if the size is less than 16384 bytes (the
201
 * point at which a lower LZ window size can be used.)
202
 */
203
static png_alloc_size_t
204
png_image_size(png_structrp png_ptr)
205
{
206
   /* Only return sizes up to the maximum of a png_uint_32; do this by limiting
207
    * the width and height used to 15 bits.
208
    */
209
   png_uint_32 h = png_ptr->height;
210

211
   if (png_ptr->rowbytes < 32768 && h < 32768)
212
   {
213
      if (png_ptr->interlaced != 0)
214
      {
215
         /* Interlacing makes the image larger because of the replication of
216
          * both the filter byte and the padding to a byte boundary.
217
          */
218
         png_uint_32 w = png_ptr->width;
219
         unsigned int pd = png_ptr->pixel_depth;
220
         png_alloc_size_t cb_base;
221
         int pass;
222

223
         for (cb_base=0, pass=0; pass<=6; ++pass)
224
         {
225
            png_uint_32 pw = PNG_PASS_COLS(w, pass);
226

227
            if (pw > 0)
228
               cb_base += (PNG_ROWBYTES(pd, pw)+1) * PNG_PASS_ROWS(h, pass);
229
         }
230

231
         return cb_base;
232
      }
233

234
      else
235
         return (png_ptr->rowbytes+1) * h;
236
   }
237

238
   else
239
      return 0xffffffffU;
240
}
241

242
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
243
   /* This is the code to hack the first two bytes of the deflate stream (the
244
    * deflate header) to correct the windowBits value to match the actual data
245
    * size.  Note that the second argument is the *uncompressed* size but the
246
    * first argument is the *compressed* data (and it must be deflate
247
    * compressed.)
248
    */
249
static void
250
optimize_cmf(png_bytep data, png_alloc_size_t data_size)
251
{
252
   /* Optimize the CMF field in the zlib stream.  The resultant zlib stream is
253
    * still compliant to the stream specification.
254
    */
255
   if (data_size <= 16384) /* else windowBits must be 15 */
256
   {
257
      unsigned int z_cmf = data[0];  /* zlib compression method and flags */
258

259
      if ((z_cmf & 0x0f) == 8 && (z_cmf & 0xf0) <= 0x70)
260
      {
261
         unsigned int z_cinfo;
262
         unsigned int half_z_window_size;
263

264
         z_cinfo = z_cmf >> 4;
265
         half_z_window_size = 1U << (z_cinfo + 7);
266

267
         if (data_size <= half_z_window_size) /* else no change */
268
         {
269
            unsigned int tmp;
270

271
            do
272
            {
273
               half_z_window_size >>= 1;
274
               --z_cinfo;
275
            }
276
            while (z_cinfo > 0 && data_size <= half_z_window_size);
277

278
            z_cmf = (z_cmf & 0x0f) | (z_cinfo << 4);
279

280
            data[0] = (png_byte)z_cmf;
281
            tmp = data[1] & 0xe0;
282
            tmp += 0x1f - ((z_cmf << 8) + tmp) % 0x1f;
283
            data[1] = (png_byte)tmp;
284
         }
285
      }
286
   }
287
}
288
#endif /* WRITE_OPTIMIZE_CMF */
289

290
/* Initialize the compressor for the appropriate type of compression. */
291
static int
292
png_deflate_claim(png_structrp png_ptr, png_uint_32 owner,
293
    png_alloc_size_t data_size)
294
{
295
   if (png_ptr->zowner != 0)
296
   {
297
#if defined(PNG_WARNINGS_SUPPORTED) || defined(PNG_ERROR_TEXT_SUPPORTED)
298
      char msg[64];
299

300
      PNG_STRING_FROM_CHUNK(msg, owner);
301
      msg[4] = ':';
302
      msg[5] = ' ';
303
      PNG_STRING_FROM_CHUNK(msg+6, png_ptr->zowner);
304
      /* So the message that results is "<chunk> using zstream"; this is an
305
       * internal error, but is very useful for debugging.  i18n requirements
306
       * are minimal.
307
       */
308
      (void)png_safecat(msg, (sizeof msg), 10, " using zstream");
309
#endif
310
#if PNG_RELEASE_BUILD
311
         png_warning(png_ptr, msg);
312

313
         /* Attempt sane error recovery */
314
         if (png_ptr->zowner == png_IDAT) /* don't steal from IDAT */
315
         {
316
            png_ptr->zstream.msg = PNGZ_MSG_CAST("in use by IDAT");
317
            return Z_STREAM_ERROR;
318
         }
319

320
         png_ptr->zowner = 0;
321
#else
322
         png_error(png_ptr, msg);
323
#endif
324
   }
325

326
   {
327
      int level = png_ptr->zlib_level;
328
      int method = png_ptr->zlib_method;
329
      int windowBits = png_ptr->zlib_window_bits;
330
      int memLevel = png_ptr->zlib_mem_level;
331
      int strategy; /* set below */
332
      int ret; /* zlib return code */
333

334
      if (owner == png_IDAT)
335
      {
336
         if ((png_ptr->flags & PNG_FLAG_ZLIB_CUSTOM_STRATEGY) != 0)
337
            strategy = png_ptr->zlib_strategy;
338

339
         else if (png_ptr->do_filter != PNG_FILTER_NONE)
340
            strategy = PNG_Z_DEFAULT_STRATEGY;
341

342
         else
343
            strategy = PNG_Z_DEFAULT_NOFILTER_STRATEGY;
344
      }
345

346
      else
347
      {
348
#ifdef PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED
349
            level = png_ptr->zlib_text_level;
350
            method = png_ptr->zlib_text_method;
351
            windowBits = png_ptr->zlib_text_window_bits;
352
            memLevel = png_ptr->zlib_text_mem_level;
353
            strategy = png_ptr->zlib_text_strategy;
354
#else
355
            /* If customization is not supported the values all come from the
356
             * IDAT values except for the strategy, which is fixed to the
357
             * default.  (This is the pre-1.6.0 behavior too, although it was
358
             * implemented in a very different way.)
359
             */
360
            strategy = Z_DEFAULT_STRATEGY;
361
#endif
362
      }
363

364
      /* Adjust 'windowBits' down if larger than 'data_size'; to stop this
365
       * happening just pass 32768 as the data_size parameter.  Notice that zlib
366
       * requires an extra 262 bytes in the window in addition to the data to be
367
       * able to see the whole of the data, so if data_size+262 takes us to the
368
       * next windowBits size we need to fix up the value later.  (Because even
369
       * though deflate needs the extra window, inflate does not!)
370
       */
371
      if (data_size <= 16384)
372
      {
373
         /* IMPLEMENTATION NOTE: this 'half_window_size' stuff is only here to
374
          * work round a Microsoft Visual C misbehavior which, contrary to C-90,
375
          * widens the result of the following shift to 64-bits if (and,
376
          * apparently, only if) it is used in a test.
377
          */
378
         unsigned int half_window_size = 1U << (windowBits-1);
379

380
         while (data_size + 262 <= half_window_size)
381
         {
382
            half_window_size >>= 1;
383
            --windowBits;
384
         }
385
      }
386

387
      /* Check against the previous initialized values, if any. */
388
      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0 &&
389
         (png_ptr->zlib_set_level != level ||
390
         png_ptr->zlib_set_method != method ||
391
         png_ptr->zlib_set_window_bits != windowBits ||
392
         png_ptr->zlib_set_mem_level != memLevel ||
393
         png_ptr->zlib_set_strategy != strategy))
394
      {
395
         if (deflateEnd(&png_ptr->zstream) != Z_OK)
396
            png_warning(png_ptr, "deflateEnd failed (ignored)");
397

398
         png_ptr->flags &= ~PNG_FLAG_ZSTREAM_INITIALIZED;
399
      }
400

401
      /* For safety clear out the input and output pointers (currently zlib
402
       * doesn't use them on Init, but it might in the future).
403
       */
404
      png_ptr->zstream.next_in = NULL;
405
      png_ptr->zstream.avail_in = 0;
406
      png_ptr->zstream.next_out = NULL;
407
      png_ptr->zstream.avail_out = 0;
408

409
      /* Now initialize if required, setting the new parameters, otherwise just
410
       * do a simple reset to the previous parameters.
411
       */
412
      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
413
         ret = deflateReset(&png_ptr->zstream);
414

415
      else
416
      {
417
         ret = deflateInit2(&png_ptr->zstream, level, method, windowBits,
418
             memLevel, strategy);
419

420
         if (ret == Z_OK)
421
            png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED;
422
      }
423

424
      /* The return code is from either deflateReset or deflateInit2; they have
425
       * pretty much the same set of error codes.
426
       */
427
      if (ret == Z_OK)
428
         png_ptr->zowner = owner;
429

430
      else
431
         png_zstream_error(png_ptr, ret);
432

433
      return ret;
434
   }
435
}
436

437
/* Clean up (or trim) a linked list of compression buffers. */
438
void /* PRIVATE */
439
png_free_buffer_list(png_structrp png_ptr, png_compression_bufferp *listp)
440
{
441
   png_compression_bufferp list = *listp;
442

443
   if (list != NULL)
444
   {
445
      *listp = NULL;
446

447
      do
448
      {
449
         png_compression_bufferp next = list->next;
450

451
         png_free(png_ptr, list);
452
         list = next;
453
      }
454
      while (list != NULL);
455
   }
456
}
457

458
#ifdef PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
459
/* This pair of functions encapsulates the operation of (a) compressing a
460
 * text string, and (b) issuing it later as a series of chunk data writes.
461
 * The compression_state structure is shared context for these functions
462
 * set up by the caller to allow access to the relevant local variables.
463
 *
464
 * compression_buffer (new in 1.6.0) is just a linked list of zbuffer_size
465
 * temporary buffers.  From 1.6.0 it is retained in png_struct so that it will
466
 * be correctly freed in the event of a write error (previous implementations
467
 * just leaked memory.)
468
 */
469
typedef struct
470
{
471
   png_const_bytep      input;        /* The uncompressed input data */
472
   png_alloc_size_t     input_len;    /* Its length */
473
   png_uint_32          output_len;   /* Final compressed length */
474
   png_byte             output[1024]; /* First block of output */
475
} compression_state;
476

477
static void
478
png_text_compress_init(compression_state *comp, png_const_bytep input,
479
    png_alloc_size_t input_len)
480
{
481
   comp->input = input;
482
   comp->input_len = input_len;
483
   comp->output_len = 0;
484
}
485

486
/* Compress the data in the compression state input */
487
static int
488
png_text_compress(png_structrp png_ptr, png_uint_32 chunk_name,
489
    compression_state *comp, png_uint_32 prefix_len)
490
{
491
   int ret;
492

493
   /* To find the length of the output it is necessary to first compress the
494
    * input. The result is buffered rather than using the two-pass algorithm
495
    * that is used on the inflate side; deflate is assumed to be slower and a
496
    * PNG writer is assumed to have more memory available than a PNG reader.
497
    *
498
    * IMPLEMENTATION NOTE: the zlib API deflateBound() can be used to find an
499
    * upper limit on the output size, but it is always bigger than the input
500
    * size so it is likely to be more efficient to use this linked-list
501
    * approach.
502
    */
503
   ret = png_deflate_claim(png_ptr, chunk_name, comp->input_len);
504

505
   if (ret != Z_OK)
506
      return ret;
507

508
   /* Set up the compression buffers, we need a loop here to avoid overflowing a
509
    * uInt.  Use ZLIB_IO_MAX to limit the input.  The output is always limited
510
    * by the output buffer size, so there is no need to check that.  Since this
511
    * is ANSI-C we know that an 'int', hence a uInt, is always at least 16 bits
512
    * in size.
513
    */
514
   {
515
      png_compression_bufferp *end = &png_ptr->zbuffer_list;
516
      png_alloc_size_t input_len = comp->input_len; /* may be zero! */
517
      png_uint_32 output_len;
518

519
      /* zlib updates these for us: */
520
      png_ptr->zstream.next_in = PNGZ_INPUT_CAST(comp->input);
521
      png_ptr->zstream.avail_in = 0; /* Set below */
522
      png_ptr->zstream.next_out = comp->output;
523
      png_ptr->zstream.avail_out = (sizeof comp->output);
524

525
      output_len = png_ptr->zstream.avail_out;
526

527
      do
528
      {
529
         uInt avail_in = ZLIB_IO_MAX;
530

531
         if (avail_in > input_len)
532
            avail_in = (uInt)input_len;
533

534
         input_len -= avail_in;
535

536
         png_ptr->zstream.avail_in = avail_in;
537

538
         if (png_ptr->zstream.avail_out == 0)
539
         {
540
            png_compression_buffer *next;
541

542
            /* Chunk data is limited to 2^31 bytes in length, so the prefix
543
             * length must be counted here.
544
             */
545
            if (output_len + prefix_len > PNG_UINT_31_MAX)
546
            {
547
               ret = Z_MEM_ERROR;
548
               break;
549
            }
550

551
            /* Need a new (malloc'ed) buffer, but there may be one present
552
             * already.
553
             */
554
            next = *end;
555
            if (next == NULL)
556
            {
557
               next = png_voidcast(png_compression_bufferp, png_malloc_base
558
                  (png_ptr, PNG_COMPRESSION_BUFFER_SIZE(png_ptr)));
559

560
               if (next == NULL)
561
               {
562
                  ret = Z_MEM_ERROR;
563
                  break;
564
               }
565

566
               /* Link in this buffer (so that it will be freed later) */
567
               next->next = NULL;
568
               *end = next;
569
            }
570

571
            png_ptr->zstream.next_out = next->output;
572
            png_ptr->zstream.avail_out = png_ptr->zbuffer_size;
573
            output_len += png_ptr->zstream.avail_out;
574

575
            /* Move 'end' to the next buffer pointer. */
576
            end = &next->next;
577
         }
578

579
         /* Compress the data */
580
         ret = deflate(&png_ptr->zstream,
581
             input_len > 0 ? Z_NO_FLUSH : Z_FINISH);
582

583
         /* Claw back input data that was not consumed (because avail_in is
584
          * reset above every time round the loop).
585
          */
586
         input_len += png_ptr->zstream.avail_in;
587
         png_ptr->zstream.avail_in = 0; /* safety */
588
      }
589
      while (ret == Z_OK);
590

591
      /* There may be some space left in the last output buffer. This needs to
592
       * be subtracted from output_len.
593
       */
594
      output_len -= png_ptr->zstream.avail_out;
595
      png_ptr->zstream.avail_out = 0; /* safety */
596
      comp->output_len = output_len;
597

598
      /* Now double check the output length, put in a custom message if it is
599
       * too long.  Otherwise ensure the z_stream::msg pointer is set to
600
       * something.
601
       */
602
      if (output_len + prefix_len >= PNG_UINT_31_MAX)
603
      {
604
         png_ptr->zstream.msg = PNGZ_MSG_CAST("compressed data too long");
605
         ret = Z_MEM_ERROR;
606
      }
607

608
      else
609
         png_zstream_error(png_ptr, ret);
610

611
      /* Reset zlib for another zTXt/iTXt or image data */
612
      png_ptr->zowner = 0;
613

614
      /* The only success case is Z_STREAM_END, input_len must be 0; if not this
615
       * is an internal error.
616
       */
617
      if (ret == Z_STREAM_END && input_len == 0)
618
      {
619
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
620
         /* Fix up the deflate header, if required */
621
         optimize_cmf(comp->output, comp->input_len);
622
#endif
623
         /* But Z_OK is returned, not Z_STREAM_END; this allows the claim
624
          * function above to return Z_STREAM_END on an error (though it never
625
          * does in the current versions of zlib.)
626
          */
627
         return Z_OK;
628
      }
629

630
      else
631
         return ret;
632
   }
633
}
634

635
/* Ship the compressed text out via chunk writes */
636
static void
637
png_write_compressed_data_out(png_structrp png_ptr, compression_state *comp)
638
{
639
   png_uint_32 output_len = comp->output_len;
640
   png_const_bytep output = comp->output;
641
   png_uint_32 avail = (sizeof comp->output);
642
   png_compression_buffer *next = png_ptr->zbuffer_list;
643

644
   for (;;)
645
   {
646
      if (avail > output_len)
647
         avail = output_len;
648

649
      png_write_chunk_data(png_ptr, output, avail);
650

651
      output_len -= avail;
652

653
      if (output_len == 0 || next == NULL)
654
         break;
655

656
      avail = png_ptr->zbuffer_size;
657
      output = next->output;
658
      next = next->next;
659
   }
660

661
   /* This is an internal error; 'next' must have been NULL! */
662
   if (output_len > 0)
663
      png_error(png_ptr, "error writing ancillary chunked compressed data");
664
}
665
#endif /* WRITE_COMPRESSED_TEXT */
666

667
/* Write the IHDR chunk, and update the png_struct with the necessary
668
 * information.  Note that the rest of this code depends upon this
669
 * information being correct.
670
 */
671
void /* PRIVATE */
672
png_write_IHDR(png_structrp png_ptr, png_uint_32 width, png_uint_32 height,
673
    int bit_depth, int color_type, int compression_type, int filter_type,
674
    int interlace_type)
675
{
676
   png_byte buf[13]; /* Buffer to store the IHDR info */
677
   int is_invalid_depth;
678

679
   png_debug(1, "in png_write_IHDR");
680

681
   /* Check that we have valid input data from the application info */
682
   switch (color_type)
683
   {
684
      case PNG_COLOR_TYPE_GRAY:
685
         switch (bit_depth)
686
         {
687
            case 1:
688
            case 2:
689
            case 4:
690
            case 8:
691
#ifdef PNG_WRITE_16BIT_SUPPORTED
692
            case 16:
693
#endif
694
               png_ptr->channels = 1; break;
695

696
            default:
697
               png_error(png_ptr,
698
                   "Invalid bit depth for grayscale image");
699
         }
700
         break;
701

702
      case PNG_COLOR_TYPE_RGB:
703
         is_invalid_depth = (bit_depth != 8);
704
#ifdef PNG_WRITE_16BIT_SUPPORTED
705
         is_invalid_depth = (is_invalid_depth && bit_depth != 16);
706
#endif
707
         if (is_invalid_depth)
708
            png_error(png_ptr, "Invalid bit depth for RGB image");
709

710
         png_ptr->channels = 3;
711
         break;
712

713
      case PNG_COLOR_TYPE_PALETTE:
714
         switch (bit_depth)
715
         {
716
            case 1:
717
            case 2:
718
            case 4:
719
            case 8:
720
               png_ptr->channels = 1;
721
               break;
722

723
            default:
724
               png_error(png_ptr, "Invalid bit depth for paletted image");
725
         }
726
         break;
727

728
      case PNG_COLOR_TYPE_GRAY_ALPHA:
729
         is_invalid_depth = (bit_depth != 8);
730
#ifdef PNG_WRITE_16BIT_SUPPORTED
731
         is_invalid_depth = (is_invalid_depth && bit_depth != 16);
732
#endif
733
         if (is_invalid_depth)
734
            png_error(png_ptr, "Invalid bit depth for grayscale+alpha image");
735

736
         png_ptr->channels = 2;
737
         break;
738

739
      case PNG_COLOR_TYPE_RGB_ALPHA:
740
         is_invalid_depth = (bit_depth != 8);
741
#ifdef PNG_WRITE_16BIT_SUPPORTED
742
         is_invalid_depth = (is_invalid_depth && bit_depth != 16);
743
#endif
744
         if (is_invalid_depth)
745
            png_error(png_ptr, "Invalid bit depth for RGBA image");
746

747
         png_ptr->channels = 4;
748
         break;
749

750
      default:
751
         png_error(png_ptr, "Invalid image color type specified");
752
   }
753

754
   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
755
   {
756
      png_warning(png_ptr, "Invalid compression type specified");
757
      compression_type = PNG_COMPRESSION_TYPE_BASE;
758
   }
759

760
   /* Write filter_method 64 (intrapixel differencing) only if
761
    * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
762
    * 2. Libpng did not write a PNG signature (this filter_method is only
763
    *    used in PNG datastreams that are embedded in MNG datastreams) and
764
    * 3. The application called png_permit_mng_features with a mask that
765
    *    included PNG_FLAG_MNG_FILTER_64 and
766
    * 4. The filter_method is 64 and
767
    * 5. The color_type is RGB or RGBA
768
    */
769
   if (
770
#ifdef PNG_MNG_FEATURES_SUPPORTED
771
       !((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) != 0 &&
772
       ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) == 0) &&
773
       (color_type == PNG_COLOR_TYPE_RGB ||
774
        color_type == PNG_COLOR_TYPE_RGB_ALPHA) &&
775
       (filter_type == PNG_INTRAPIXEL_DIFFERENCING)) &&
776
#endif
777
       filter_type != PNG_FILTER_TYPE_BASE)
778
   {
779
      png_warning(png_ptr, "Invalid filter type specified");
780
      filter_type = PNG_FILTER_TYPE_BASE;
781
   }
782

783
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
784
   if (interlace_type != PNG_INTERLACE_NONE &&
785
       interlace_type != PNG_INTERLACE_ADAM7)
786
   {
787
      png_warning(png_ptr, "Invalid interlace type specified");
788
      interlace_type = PNG_INTERLACE_ADAM7;
789
   }
790
#else
791
   interlace_type=PNG_INTERLACE_NONE;
792
#endif
793

794
   /* Save the relevant information */
795
   png_ptr->bit_depth = (png_byte)bit_depth;
796
   png_ptr->color_type = (png_byte)color_type;
797
   png_ptr->interlaced = (png_byte)interlace_type;
798
#ifdef PNG_MNG_FEATURES_SUPPORTED
799
   png_ptr->filter_type = (png_byte)filter_type;
800
#endif
801
   png_ptr->compression_type = (png_byte)compression_type;
802
   png_ptr->width = width;
803
   png_ptr->height = height;
804

805
   png_ptr->pixel_depth = (png_byte)(bit_depth * png_ptr->channels);
806
   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, width);
807
   /* Set the usr info, so any transformations can modify it */
808
   png_ptr->usr_width = png_ptr->width;
809
   png_ptr->usr_bit_depth = png_ptr->bit_depth;
810
   png_ptr->usr_channels = png_ptr->channels;
811

812
   /* Pack the header information into the buffer */
813
   png_save_uint_32(buf, width);
814
   png_save_uint_32(buf + 4, height);
815
   buf[8] = (png_byte)bit_depth;
816
   buf[9] = (png_byte)color_type;
817
   buf[10] = (png_byte)compression_type;
818
   buf[11] = (png_byte)filter_type;
819
   buf[12] = (png_byte)interlace_type;
820

821
   /* Write the chunk */
822
   png_write_complete_chunk(png_ptr, png_IHDR, buf, 13);
823

824
   if ((png_ptr->do_filter) == PNG_NO_FILTERS)
825
   {
826
      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE ||
827
          png_ptr->bit_depth < 8)
828
         png_ptr->do_filter = PNG_FILTER_NONE;
829

830
      else
831
         png_ptr->do_filter = PNG_ALL_FILTERS;
832
   }
833

834
   png_ptr->mode = PNG_HAVE_IHDR; /* not READY_FOR_ZTXT */
835
}
836

837
/* Write the palette.  We are careful not to trust png_color to be in the
838
 * correct order for PNG, so people can redefine it to any convenient
839
 * structure.
840
 */
841
void /* PRIVATE */
842
png_write_PLTE(png_structrp png_ptr, png_const_colorp palette,
843
    png_uint_32 num_pal)
844
{
845
   png_uint_32 max_palette_length, i;
846
   png_const_colorp pal_ptr;
847
   png_byte buf[3];
848

849
   png_debug(1, "in png_write_PLTE");
850

851
   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
852
      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
853

854
   if ((
855
#ifdef PNG_MNG_FEATURES_SUPPORTED
856
       (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0 &&
857
#endif
858
       num_pal == 0) || num_pal > max_palette_length)
859
   {
860
      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
861
      {
862
         png_error(png_ptr, "Invalid number of colors in palette");
863
      }
864

865
      else
866
      {
867
         png_warning(png_ptr, "Invalid number of colors in palette");
868
         return;
869
      }
870
   }
871

872
   if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
873
   {
874
      png_warning(png_ptr,
875
          "Ignoring request to write a PLTE chunk in grayscale PNG");
876

877
      return;
878
   }
879

880
   png_ptr->num_palette = (png_uint_16)num_pal;
881
   png_debug1(3, "num_palette = %d", png_ptr->num_palette);
882

883
   png_write_chunk_header(png_ptr, png_PLTE, (png_uint_32)(num_pal * 3));
884
#ifdef PNG_POINTER_INDEXING_SUPPORTED
885

886
   for (i = 0, pal_ptr = palette; i < num_pal; i++, pal_ptr++)
887
   {
888
      buf[0] = pal_ptr->red;
889
      buf[1] = pal_ptr->green;
890
      buf[2] = pal_ptr->blue;
891
      png_write_chunk_data(png_ptr, buf, 3);
892
   }
893

894
#else
895
   /* This is a little slower but some buggy compilers need to do this
896
    * instead
897
    */
898
   pal_ptr=palette;
899

900
   for (i = 0; i < num_pal; i++)
901
   {
902
      buf[0] = pal_ptr[i].red;
903
      buf[1] = pal_ptr[i].green;
904
      buf[2] = pal_ptr[i].blue;
905
      png_write_chunk_data(png_ptr, buf, 3);
906
   }
907

908
#endif
909
   png_write_chunk_end(png_ptr);
910
   png_ptr->mode |= PNG_HAVE_PLTE;
911
}
912

913
/* This is similar to png_text_compress, above, except that it does not require
914
 * all of the data at once and, instead of buffering the compressed result,
915
 * writes it as IDAT chunks.  Unlike png_text_compress it *can* png_error out
916
 * because it calls the write interface.  As a result it does its own error
917
 * reporting and does not return an error code.  In the event of error it will
918
 * just call png_error.  The input data length may exceed 32-bits.  The 'flush'
919
 * parameter is exactly the same as that to deflate, with the following
920
 * meanings:
921
 *
922
 * Z_NO_FLUSH: normal incremental output of compressed data
923
 * Z_SYNC_FLUSH: do a SYNC_FLUSH, used by png_write_flush
924
 * Z_FINISH: this is the end of the input, do a Z_FINISH and clean up
925
 *
926
 * The routine manages the acquire and release of the png_ptr->zstream by
927
 * checking and (at the end) clearing png_ptr->zowner; it does some sanity
928
 * checks on the 'mode' flags while doing this.
929
 */
930
void /* PRIVATE */
931
png_compress_IDAT(png_structrp png_ptr, png_const_bytep input,
932
    png_alloc_size_t input_len, int flush)
933
{
934
   if (png_ptr->zowner != png_IDAT)
935
   {
936
      /* First time.   Ensure we have a temporary buffer for compression and
937
       * trim the buffer list if it has more than one entry to free memory.
938
       * If 'WRITE_COMPRESSED_TEXT' is not set the list will never have been
939
       * created at this point, but the check here is quick and safe.
940
       */
941
      if (png_ptr->zbuffer_list == NULL)
942
      {
943
         png_ptr->zbuffer_list = png_voidcast(png_compression_bufferp,
944
             png_malloc(png_ptr, PNG_COMPRESSION_BUFFER_SIZE(png_ptr)));
945
         png_ptr->zbuffer_list->next = NULL;
946
      }
947

948
      else
949
         png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list->next);
950

951
      /* It is a terminal error if we can't claim the zstream. */
952
      if (png_deflate_claim(png_ptr, png_IDAT, png_image_size(png_ptr)) != Z_OK)
953
         png_error(png_ptr, png_ptr->zstream.msg);
954

955
      /* The output state is maintained in png_ptr->zstream, so it must be
956
       * initialized here after the claim.
957
       */
958
      png_ptr->zstream.next_out = png_ptr->zbuffer_list->output;
959
      png_ptr->zstream.avail_out = png_ptr->zbuffer_size;
960
   }
961

962
   /* Now loop reading and writing until all the input is consumed or an error
963
    * terminates the operation.  The _out values are maintained across calls to
964
    * this function, but the input must be reset each time.
965
    */
966
   png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input);
967
   png_ptr->zstream.avail_in = 0; /* set below */
968
   for (;;)
969
   {
970
      int ret;
971

972
      /* INPUT: from the row data */
973
      uInt avail = ZLIB_IO_MAX;
974

975
      if (avail > input_len)
976
         avail = (uInt)input_len; /* safe because of the check */
977

978
      png_ptr->zstream.avail_in = avail;
979
      input_len -= avail;
980

981
      ret = deflate(&png_ptr->zstream, input_len > 0 ? Z_NO_FLUSH : flush);
982

983
      /* Include as-yet unconsumed input */
984
      input_len += png_ptr->zstream.avail_in;
985
      png_ptr->zstream.avail_in = 0;
986

987
      /* OUTPUT: write complete IDAT chunks when avail_out drops to zero. Note
988
       * that these two zstream fields are preserved across the calls, therefore
989
       * there is no need to set these up on entry to the loop.
990
       */
991
      if (png_ptr->zstream.avail_out == 0)
992
      {
993
         png_bytep data = png_ptr->zbuffer_list->output;
994
         uInt size = png_ptr->zbuffer_size;
995

996
         /* Write an IDAT containing the data then reset the buffer.  The
997
          * first IDAT may need deflate header optimization.
998
          */
999
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
1000
            if ((png_ptr->mode & PNG_HAVE_IDAT) == 0 &&
1001
                png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE)
1002
               optimize_cmf(data, png_image_size(png_ptr));
1003
#endif
1004

1005
         if (size > 0)
1006
            png_write_complete_chunk(png_ptr, png_IDAT, data, size);
1007
         png_ptr->mode |= PNG_HAVE_IDAT;
1008

1009
         png_ptr->zstream.next_out = data;
1010
         png_ptr->zstream.avail_out = size;
1011

1012
         /* For SYNC_FLUSH or FINISH it is essential to keep calling zlib with
1013
          * the same flush parameter until it has finished output, for NO_FLUSH
1014
          * it doesn't matter.
1015
          */
1016
         if (ret == Z_OK && flush != Z_NO_FLUSH)
1017
            continue;
1018
      }
1019

1020
      /* The order of these checks doesn't matter much; it just affects which
1021
       * possible error might be detected if multiple things go wrong at once.
1022
       */
1023
      if (ret == Z_OK) /* most likely return code! */
1024
      {
1025
         /* If all the input has been consumed then just return.  If Z_FINISH
1026
          * was used as the flush parameter something has gone wrong if we get
1027
          * here.
1028
          */
1029
         if (input_len == 0)
1030
         {
1031
            if (flush == Z_FINISH)
1032
               png_error(png_ptr, "Z_OK on Z_FINISH with output space");
1033

1034
            return;
1035
         }
1036
      }
1037

1038
      else if (ret == Z_STREAM_END && flush == Z_FINISH)
1039
      {
1040
         /* This is the end of the IDAT data; any pending output must be
1041
          * flushed.  For small PNG files we may still be at the beginning.
1042
          */
1043
         png_bytep data = png_ptr->zbuffer_list->output;
1044
         uInt size = png_ptr->zbuffer_size - png_ptr->zstream.avail_out;
1045

1046
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
1047
         if ((png_ptr->mode & PNG_HAVE_IDAT) == 0 &&
1048
             png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE)
1049
            optimize_cmf(data, png_image_size(png_ptr));
1050
#endif
1051

1052
         if (size > 0)
1053
            png_write_complete_chunk(png_ptr, png_IDAT, data, size);
1054
         png_ptr->zstream.avail_out = 0;
1055
         png_ptr->zstream.next_out = NULL;
1056
         png_ptr->mode |= PNG_HAVE_IDAT | PNG_AFTER_IDAT;
1057

1058
         png_ptr->zowner = 0; /* Release the stream */
1059
         return;
1060
      }
1061

1062
      else
1063
      {
1064
         /* This is an error condition. */
1065
         png_zstream_error(png_ptr, ret);
1066
         png_error(png_ptr, png_ptr->zstream.msg);
1067
      }
1068
   }
1069
}
1070

1071
/* Write an IEND chunk */
1072
void /* PRIVATE */
1073
png_write_IEND(png_structrp png_ptr)
1074
{
1075
   png_debug(1, "in png_write_IEND");
1076

1077
   png_write_complete_chunk(png_ptr, png_IEND, NULL, 0);
1078
   png_ptr->mode |= PNG_HAVE_IEND;
1079
}
1080

1081
#ifdef PNG_WRITE_gAMA_SUPPORTED
1082
/* Write a gAMA chunk */
1083
void /* PRIVATE */
1084
png_write_gAMA_fixed(png_structrp png_ptr, png_fixed_point file_gamma)
1085
{
1086
   png_byte buf[4];
1087

1088
   png_debug(1, "in png_write_gAMA");
1089

1090
   /* file_gamma is saved in 1/100,000ths */
1091
   png_save_uint_32(buf, (png_uint_32)file_gamma);
1092
   png_write_complete_chunk(png_ptr, png_gAMA, buf, 4);
1093
}
1094
#endif
1095

1096
#ifdef PNG_WRITE_sRGB_SUPPORTED
1097
/* Write a sRGB chunk */
1098
void /* PRIVATE */
1099
png_write_sRGB(png_structrp png_ptr, int srgb_intent)
1100
{
1101
   png_byte buf[1];
1102

1103
   png_debug(1, "in png_write_sRGB");
1104

1105
   if (srgb_intent >= PNG_sRGB_INTENT_LAST)
1106
      png_warning(png_ptr,
1107
          "Invalid sRGB rendering intent specified");
1108

1109
   buf[0]=(png_byte)srgb_intent;
1110
   png_write_complete_chunk(png_ptr, png_sRGB, buf, 1);
1111
}
1112
#endif
1113

1114
#ifdef PNG_WRITE_iCCP_SUPPORTED
1115
/* Write an iCCP chunk */
1116
void /* PRIVATE */
1117
png_write_iCCP(png_structrp png_ptr, png_const_charp name,
1118
    png_const_bytep profile)
1119
{
1120
   png_uint_32 name_len;
1121
   png_uint_32 profile_len;
1122
   png_byte new_name[81]; /* 1 byte for the compression byte */
1123
   compression_state comp;
1124
   png_uint_32 temp;
1125

1126
   png_debug(1, "in png_write_iCCP");
1127

1128
   /* These are all internal problems: the profile should have been checked
1129
    * before when it was stored.
1130
    */
1131
   if (profile == NULL)
1132
      png_error(png_ptr, "No profile for iCCP chunk"); /* internal error */
1133

1134
   profile_len = png_get_uint_32(profile);
1135

1136
   if (profile_len < 132)
1137
      png_error(png_ptr, "ICC profile too short");
1138

1139
   temp = (png_uint_32) (*(profile+8));
1140
   if (temp > 3 && (profile_len & 0x03))
1141
      png_error(png_ptr, "ICC profile length invalid (not a multiple of 4)");
1142

1143
   {
1144
      png_uint_32 embedded_profile_len = png_get_uint_32(profile);
1145

1146
      if (profile_len != embedded_profile_len)
1147
         png_error(png_ptr, "Profile length does not match profile");
1148
   }
1149

1150
   name_len = png_check_keyword(png_ptr, name, new_name);
1151

1152
   if (name_len == 0)
1153
      png_error(png_ptr, "iCCP: invalid keyword");
1154

1155
   new_name[++name_len] = PNG_COMPRESSION_TYPE_BASE;
1156

1157
   /* Make sure we include the NULL after the name and the compression type */
1158
   ++name_len;
1159

1160
   png_text_compress_init(&comp, profile, profile_len);
1161

1162
   /* Allow for keyword terminator and compression byte */
1163
   if (png_text_compress(png_ptr, png_iCCP, &comp, name_len) != Z_OK)
1164
      png_error(png_ptr, png_ptr->zstream.msg);
1165

1166
   png_write_chunk_header(png_ptr, png_iCCP, name_len + comp.output_len);
1167

1168
   png_write_chunk_data(png_ptr, new_name, name_len);
1169

1170
   png_write_compressed_data_out(png_ptr, &comp);
1171

1172
   png_write_chunk_end(png_ptr);
1173
}
1174
#endif
1175

1176
#ifdef PNG_WRITE_sPLT_SUPPORTED
1177
/* Write a sPLT chunk */
1178
void /* PRIVATE */
1179
png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
1180
{
1181
   png_uint_32 name_len;
1182
   png_byte new_name[80];
1183
   png_byte entrybuf[10];
1184
   size_t entry_size = (spalette->depth == 8 ? 6 : 10);
1185
   size_t palette_size = entry_size * (size_t)spalette->nentries;
1186
   png_sPLT_entryp ep;
1187
#ifndef PNG_POINTER_INDEXING_SUPPORTED
1188
   int i;
1189
#endif
1190

1191
   png_debug(1, "in png_write_sPLT");
1192

1193
   name_len = png_check_keyword(png_ptr, spalette->name, new_name);
1194

1195
   if (name_len == 0)
1196
      png_error(png_ptr, "sPLT: invalid keyword");
1197

1198
   /* Make sure we include the NULL after the name */
1199
   png_write_chunk_header(png_ptr, png_sPLT,
1200
       (png_uint_32)(name_len + 2 + palette_size));
1201

1202
   png_write_chunk_data(png_ptr, (png_bytep)new_name, (size_t)(name_len + 1));
1203

1204
   png_write_chunk_data(png_ptr, &spalette->depth, 1);
1205

1206
   /* Loop through each palette entry, writing appropriately */
1207
#ifdef PNG_POINTER_INDEXING_SUPPORTED
1208
   for (ep = spalette->entries; ep<spalette->entries + spalette->nentries; ep++)
1209
   {
1210
      if (spalette->depth == 8)
1211
      {
1212
         entrybuf[0] = (png_byte)ep->red;
1213
         entrybuf[1] = (png_byte)ep->green;
1214
         entrybuf[2] = (png_byte)ep->blue;
1215
         entrybuf[3] = (png_byte)ep->alpha;
1216
         png_save_uint_16(entrybuf + 4, ep->frequency);
1217
      }
1218

1219
      else
1220
      {
1221
         png_save_uint_16(entrybuf + 0, ep->red);
1222
         png_save_uint_16(entrybuf + 2, ep->green);
1223
         png_save_uint_16(entrybuf + 4, ep->blue);
1224
         png_save_uint_16(entrybuf + 6, ep->alpha);
1225
         png_save_uint_16(entrybuf + 8, ep->frequency);
1226
      }
1227

1228
      png_write_chunk_data(png_ptr, entrybuf, entry_size);
1229
   }
1230
#else
1231
   ep=spalette->entries;
1232
   for (i = 0; i>spalette->nentries; i++)
1233
   {
1234
      if (spalette->depth == 8)
1235
      {
1236
         entrybuf[0] = (png_byte)ep[i].red;
1237
         entrybuf[1] = (png_byte)ep[i].green;
1238
         entrybuf[2] = (png_byte)ep[i].blue;
1239
         entrybuf[3] = (png_byte)ep[i].alpha;
1240
         png_save_uint_16(entrybuf + 4, ep[i].frequency);
1241
      }
1242

1243
      else
1244
      {
1245
         png_save_uint_16(entrybuf + 0, ep[i].red);
1246
         png_save_uint_16(entrybuf + 2, ep[i].green);
1247
         png_save_uint_16(entrybuf + 4, ep[i].blue);
1248
         png_save_uint_16(entrybuf + 6, ep[i].alpha);
1249
         png_save_uint_16(entrybuf + 8, ep[i].frequency);
1250
      }
1251

1252
      png_write_chunk_data(png_ptr, entrybuf, entry_size);
1253
   }
1254
#endif
1255

1256
   png_write_chunk_end(png_ptr);
1257
}
1258
#endif
1259

1260
#ifdef PNG_WRITE_sBIT_SUPPORTED
1261
/* Write the sBIT chunk */
1262
void /* PRIVATE */
1263
png_write_sBIT(png_structrp png_ptr, png_const_color_8p sbit, int color_type)
1264
{
1265
   png_byte buf[4];
1266
   size_t size;
1267

1268
   png_debug(1, "in png_write_sBIT");
1269

1270
   /* Make sure we don't depend upon the order of PNG_COLOR_8 */
1271
   if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
1272
   {
1273
      png_byte maxbits;
1274

1275
      maxbits = (png_byte)(color_type==PNG_COLOR_TYPE_PALETTE ? 8 :
1276
          png_ptr->usr_bit_depth);
1277

1278
      if (sbit->red == 0 || sbit->red > maxbits ||
1279
          sbit->green == 0 || sbit->green > maxbits ||
1280
          sbit->blue == 0 || sbit->blue > maxbits)
1281
      {
1282
         png_warning(png_ptr, "Invalid sBIT depth specified");
1283
         return;
1284
      }
1285

1286
      buf[0] = sbit->red;
1287
      buf[1] = sbit->green;
1288
      buf[2] = sbit->blue;
1289
      size = 3;
1290
   }
1291

1292
   else
1293
   {
1294
      if (sbit->gray == 0 || sbit->gray > png_ptr->usr_bit_depth)
1295
      {
1296
         png_warning(png_ptr, "Invalid sBIT depth specified");
1297
         return;
1298
      }
1299

1300
      buf[0] = sbit->gray;
1301
      size = 1;
1302
   }
1303

1304
   if ((color_type & PNG_COLOR_MASK_ALPHA) != 0)
1305
   {
1306
      if (sbit->alpha == 0 || sbit->alpha > png_ptr->usr_bit_depth)
1307
      {
1308
         png_warning(png_ptr, "Invalid sBIT depth specified");
1309
         return;
1310
      }
1311

1312
      buf[size++] = sbit->alpha;
1313
   }
1314

1315
   png_write_complete_chunk(png_ptr, png_sBIT, buf, size);
1316
}
1317
#endif
1318

1319
#ifdef PNG_WRITE_cHRM_SUPPORTED
1320
/* Write the cHRM chunk */
1321
void /* PRIVATE */
1322
png_write_cHRM_fixed(png_structrp png_ptr, const png_xy *xy)
1323
{
1324
   png_byte buf[32];
1325

1326
   png_debug(1, "in png_write_cHRM");
1327

1328
   /* Each value is saved in 1/100,000ths */
1329
   png_save_int_32(buf,      xy->whitex);
1330
   png_save_int_32(buf +  4, xy->whitey);
1331

1332
   png_save_int_32(buf +  8, xy->redx);
1333
   png_save_int_32(buf + 12, xy->redy);
1334

1335
   png_save_int_32(buf + 16, xy->greenx);
1336
   png_save_int_32(buf + 20, xy->greeny);
1337

1338
   png_save_int_32(buf + 24, xy->bluex);
1339
   png_save_int_32(buf + 28, xy->bluey);
1340

1341
   png_write_complete_chunk(png_ptr, png_cHRM, buf, 32);
1342
}
1343
#endif
1344

1345
#ifdef PNG_WRITE_tRNS_SUPPORTED
1346
/* Write the tRNS chunk */
1347
void /* PRIVATE */
1348
png_write_tRNS(png_structrp png_ptr, png_const_bytep trans_alpha,
1349
    png_const_color_16p tran, int num_trans, int color_type)
1350
{
1351
   png_byte buf[6];
1352

1353
   png_debug(1, "in png_write_tRNS");
1354

1355
   if (color_type == PNG_COLOR_TYPE_PALETTE)
1356
   {
1357
      if (num_trans <= 0 || num_trans > (int)png_ptr->num_palette)
1358
      {
1359
         png_app_warning(png_ptr,
1360
             "Invalid number of transparent colors specified");
1361
         return;
1362
      }
1363

1364
      /* Write the chunk out as it is */
1365
      png_write_complete_chunk(png_ptr, png_tRNS, trans_alpha,
1366
          (size_t)num_trans);
1367
   }
1368

1369
   else if (color_type == PNG_COLOR_TYPE_GRAY)
1370
   {
1371
      /* One 16-bit value */
1372
      if (tran->gray >= (1 << png_ptr->bit_depth))
1373
      {
1374
         png_app_warning(png_ptr,
1375
             "Ignoring attempt to write tRNS chunk out-of-range for bit_depth");
1376

1377
         return;
1378
      }
1379

1380
      png_save_uint_16(buf, tran->gray);
1381
      png_write_complete_chunk(png_ptr, png_tRNS, buf, 2);
1382
   }
1383

1384
   else if (color_type == PNG_COLOR_TYPE_RGB)
1385
   {
1386
      /* Three 16-bit values */
1387
      png_save_uint_16(buf, tran->red);
1388
      png_save_uint_16(buf + 2, tran->green);
1389
      png_save_uint_16(buf + 4, tran->blue);
1390
#ifdef PNG_WRITE_16BIT_SUPPORTED
1391
      if (png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]) != 0)
1392
#else
1393
      if ((buf[0] | buf[2] | buf[4]) != 0)
1394
#endif
1395
      {
1396
         png_app_warning(png_ptr,
1397
             "Ignoring attempt to write 16-bit tRNS chunk when bit_depth is 8");
1398
         return;
1399
      }
1400

1401
      png_write_complete_chunk(png_ptr, png_tRNS, buf, 6);
1402
   }
1403

1404
   else
1405
   {
1406
      png_app_warning(png_ptr, "Can't write tRNS with an alpha channel");
1407
   }
1408
}
1409
#endif
1410

1411
#ifdef PNG_WRITE_bKGD_SUPPORTED
1412
/* Write the background chunk */
1413
void /* PRIVATE */
1414
png_write_bKGD(png_structrp png_ptr, png_const_color_16p back, int color_type)
1415
{
1416
   png_byte buf[6];
1417

1418
   png_debug(1, "in png_write_bKGD");
1419

1420
   if (color_type == PNG_COLOR_TYPE_PALETTE)
1421
   {
1422
      if (
1423
#ifdef PNG_MNG_FEATURES_SUPPORTED
1424
          (png_ptr->num_palette != 0 ||
1425
          (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0) &&
1426
#endif
1427
         back->index >= png_ptr->num_palette)
1428
      {
1429
         png_warning(png_ptr, "Invalid background palette index");
1430
         return;
1431
      }
1432

1433
      buf[0] = back->index;
1434
      png_write_complete_chunk(png_ptr, png_bKGD, buf, 1);
1435
   }
1436

1437
   else if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
1438
   {
1439
      png_save_uint_16(buf, back->red);
1440
      png_save_uint_16(buf + 2, back->green);
1441
      png_save_uint_16(buf + 4, back->blue);
1442
#ifdef PNG_WRITE_16BIT_SUPPORTED
1443
      if (png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]) != 0)
1444
#else
1445
      if ((buf[0] | buf[2] | buf[4]) != 0)
1446
#endif
1447
      {
1448
         png_warning(png_ptr,
1449
             "Ignoring attempt to write 16-bit bKGD chunk "
1450
             "when bit_depth is 8");
1451

1452
         return;
1453
      }
1454

1455
      png_write_complete_chunk(png_ptr, png_bKGD, buf, 6);
1456
   }
1457

1458
   else
1459
   {
1460
      if (back->gray >= (1 << png_ptr->bit_depth))
1461
      {
1462
         png_warning(png_ptr,
1463
             "Ignoring attempt to write bKGD chunk out-of-range for bit_depth");
1464

1465
         return;
1466
      }
1467

1468
      png_save_uint_16(buf, back->gray);
1469
      png_write_complete_chunk(png_ptr, png_bKGD, buf, 2);
1470
   }
1471
}
1472
#endif
1473

1474
#ifdef PNG_WRITE_eXIf_SUPPORTED
1475
/* Write the Exif data */
1476
void /* PRIVATE */
1477
png_write_eXIf(png_structrp png_ptr, png_bytep exif, int num_exif)
1478
{
1479
   int i;
1480
   png_byte buf[1];
1481

1482
   png_debug(1, "in png_write_eXIf");
1483

1484
   png_write_chunk_header(png_ptr, png_eXIf, (png_uint_32)(num_exif));
1485

1486
   for (i = 0; i < num_exif; i++)
1487
   {
1488
      buf[0] = exif[i];
1489
      png_write_chunk_data(png_ptr, buf, 1);
1490
   }
1491

1492
   png_write_chunk_end(png_ptr);
1493
}
1494
#endif
1495

1496
#ifdef PNG_WRITE_hIST_SUPPORTED
1497
/* Write the histogram */
1498
void /* PRIVATE */
1499
png_write_hIST(png_structrp png_ptr, png_const_uint_16p hist, int num_hist)
1500
{
1501
   int i;
1502
   png_byte buf[3];
1503

1504
   png_debug(1, "in png_write_hIST");
1505

1506
   if (num_hist > (int)png_ptr->num_palette)
1507
   {
1508
      png_debug2(3, "num_hist = %d, num_palette = %d", num_hist,
1509
          png_ptr->num_palette);
1510

1511
      png_warning(png_ptr, "Invalid number of histogram entries specified");
1512
      return;
1513
   }
1514

1515
   png_write_chunk_header(png_ptr, png_hIST, (png_uint_32)(num_hist * 2));
1516

1517
   for (i = 0; i < num_hist; i++)
1518
   {
1519
      png_save_uint_16(buf, hist[i]);
1520
      png_write_chunk_data(png_ptr, buf, 2);
1521
   }
1522

1523
   png_write_chunk_end(png_ptr);
1524
}
1525
#endif
1526

1527
#ifdef PNG_WRITE_tEXt_SUPPORTED
1528
/* Write a tEXt chunk */
1529
void /* PRIVATE */
1530
png_write_tEXt(png_structrp png_ptr, png_const_charp key, png_const_charp text,
1531
    size_t text_len)
1532
{
1533
   png_uint_32 key_len;
1534
   png_byte new_key[80];
1535

1536
   png_debug(1, "in png_write_tEXt");
1537

1538
   key_len = png_check_keyword(png_ptr, key, new_key);
1539

1540
   if (key_len == 0)
1541
      png_error(png_ptr, "tEXt: invalid keyword");
1542

1543
   if (text == NULL || *text == '\0')
1544
      text_len = 0;
1545

1546
   else
1547
      text_len = strlen(text);
1548

1549
   if (text_len > PNG_UINT_31_MAX - (key_len+1))
1550
      png_error(png_ptr, "tEXt: text too long");
1551

1552
   /* Make sure we include the 0 after the key */
1553
   png_write_chunk_header(png_ptr, png_tEXt,
1554
       (png_uint_32)/*checked above*/(key_len + text_len + 1));
1555
   /*
1556
    * We leave it to the application to meet PNG-1.0 requirements on the
1557
    * contents of the text.  PNG-1.0 through PNG-1.2 discourage the use of
1558
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG will forbid them.
1559
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
1560
    */
1561
   png_write_chunk_data(png_ptr, new_key, key_len + 1);
1562

1563
   if (text_len != 0)
1564
      png_write_chunk_data(png_ptr, (png_const_bytep)text, text_len);
1565

1566
   png_write_chunk_end(png_ptr);
1567
}
1568
#endif
1569

1570
#ifdef PNG_WRITE_zTXt_SUPPORTED
1571
/* Write a compressed text chunk */
1572
void /* PRIVATE */
1573
png_write_zTXt(png_structrp png_ptr, png_const_charp key, png_const_charp text,
1574
    int compression)
1575
{
1576
   png_uint_32 key_len;
1577
   png_byte new_key[81];
1578
   compression_state comp;
1579

1580
   png_debug(1, "in png_write_zTXt");
1581

1582
   if (compression == PNG_TEXT_COMPRESSION_NONE)
1583
   {
1584
      png_write_tEXt(png_ptr, key, text, 0);
1585
      return;
1586
   }
1587

1588
   if (compression != PNG_TEXT_COMPRESSION_zTXt)
1589
      png_error(png_ptr, "zTXt: invalid compression type");
1590

1591
   key_len = png_check_keyword(png_ptr, key, new_key);
1592

1593
   if (key_len == 0)
1594
      png_error(png_ptr, "zTXt: invalid keyword");
1595

1596
   /* Add the compression method and 1 for the keyword separator. */
1597
   new_key[++key_len] = PNG_COMPRESSION_TYPE_BASE;
1598
   ++key_len;
1599

1600
   /* Compute the compressed data; do it now for the length */
1601
   png_text_compress_init(&comp, (png_const_bytep)text,
1602
       text == NULL ? 0 : strlen(text));
1603

1604
   if (png_text_compress(png_ptr, png_zTXt, &comp, key_len) != Z_OK)
1605
      png_error(png_ptr, png_ptr->zstream.msg);
1606

1607
   /* Write start of chunk */
1608
   png_write_chunk_header(png_ptr, png_zTXt, key_len + comp.output_len);
1609

1610
   /* Write key */
1611
   png_write_chunk_data(png_ptr, new_key, key_len);
1612

1613
   /* Write the compressed data */
1614
   png_write_compressed_data_out(png_ptr, &comp);
1615

1616
   /* Close the chunk */
1617
   png_write_chunk_end(png_ptr);
1618
}
1619
#endif
1620

1621
#ifdef PNG_WRITE_iTXt_SUPPORTED
1622
/* Write an iTXt chunk */
1623
void /* PRIVATE */
1624
png_write_iTXt(png_structrp png_ptr, int compression, png_const_charp key,
1625
    png_const_charp lang, png_const_charp lang_key, png_const_charp text)
1626
{
1627
   png_uint_32 key_len, prefix_len;
1628
   size_t lang_len, lang_key_len;
1629
   png_byte new_key[82];
1630
   compression_state comp;
1631

1632
   png_debug(1, "in png_write_iTXt");
1633

1634
   key_len = png_check_keyword(png_ptr, key, new_key);
1635

1636
   if (key_len == 0)
1637
      png_error(png_ptr, "iTXt: invalid keyword");
1638

1639
   /* Set the compression flag */
1640
   switch (compression)
1641
   {
1642
      case PNG_ITXT_COMPRESSION_NONE:
1643
      case PNG_TEXT_COMPRESSION_NONE:
1644
         compression = new_key[++key_len] = 0; /* no compression */
1645
         break;
1646

1647
      case PNG_TEXT_COMPRESSION_zTXt:
1648
      case PNG_ITXT_COMPRESSION_zTXt:
1649
         compression = new_key[++key_len] = 1; /* compressed */
1650
         break;
1651

1652
      default:
1653
         png_error(png_ptr, "iTXt: invalid compression");
1654
   }
1655

1656
   new_key[++key_len] = PNG_COMPRESSION_TYPE_BASE;
1657
   ++key_len; /* for the keywod separator */
1658

1659
   /* We leave it to the application to meet PNG-1.0 requirements on the
1660
    * contents of the text.  PNG-1.0 through PNG-1.2 discourage the use of
1661
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG, however,
1662
    * specifies that the text is UTF-8 and this really doesn't require any
1663
    * checking.
1664
    *
1665
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
1666
    *
1667
    * TODO: validate the language tag correctly (see the spec.)
1668
    */
1669
   if (lang == NULL) lang = ""; /* empty language is valid */
1670
   lang_len = strlen(lang)+1;
1671
   if (lang_key == NULL) lang_key = ""; /* may be empty */
1672
   lang_key_len = strlen(lang_key)+1;
1673
   if (text == NULL) text = ""; /* may be empty */
1674

1675
   prefix_len = key_len;
1676
   if (lang_len > PNG_UINT_31_MAX-prefix_len)
1677
      prefix_len = PNG_UINT_31_MAX;
1678
   else
1679
      prefix_len = (png_uint_32)(prefix_len + lang_len);
1680

1681
   if (lang_key_len > PNG_UINT_31_MAX-prefix_len)
1682
      prefix_len = PNG_UINT_31_MAX;
1683
   else
1684
      prefix_len = (png_uint_32)(prefix_len + lang_key_len);
1685

1686
   png_text_compress_init(&comp, (png_const_bytep)text, strlen(text));
1687

1688
   if (compression != 0)
1689
   {
1690
      if (png_text_compress(png_ptr, png_iTXt, &comp, prefix_len) != Z_OK)
1691
         png_error(png_ptr, png_ptr->zstream.msg);
1692
   }
1693

1694
   else
1695
   {
1696
      if (comp.input_len > PNG_UINT_31_MAX-prefix_len)
1697
         png_error(png_ptr, "iTXt: uncompressed text too long");
1698

1699
      /* So the string will fit in a chunk: */
1700
      comp.output_len = (png_uint_32)/*SAFE*/comp.input_len;
1701
   }
1702

1703
   png_write_chunk_header(png_ptr, png_iTXt, comp.output_len + prefix_len);
1704

1705
   png_write_chunk_data(png_ptr, new_key, key_len);
1706

1707
   png_write_chunk_data(png_ptr, (png_const_bytep)lang, lang_len);
1708

1709
   png_write_chunk_data(png_ptr, (png_const_bytep)lang_key, lang_key_len);
1710

1711
   if (compression != 0)
1712
      png_write_compressed_data_out(png_ptr, &comp);
1713

1714
   else
1715
      png_write_chunk_data(png_ptr, (png_const_bytep)text, comp.output_len);
1716

1717
   png_write_chunk_end(png_ptr);
1718
}
1719
#endif
1720

1721
#ifdef PNG_WRITE_oFFs_SUPPORTED
1722
/* Write the oFFs chunk */
1723
void /* PRIVATE */
1724
png_write_oFFs(png_structrp png_ptr, png_int_32 x_offset, png_int_32 y_offset,
1725
    int unit_type)
1726
{
1727
   png_byte buf[9];
1728

1729
   png_debug(1, "in png_write_oFFs");
1730

1731
   if (unit_type >= PNG_OFFSET_LAST)
1732
      png_warning(png_ptr, "Unrecognized unit type for oFFs chunk");
1733

1734
   png_save_int_32(buf, x_offset);
1735
   png_save_int_32(buf + 4, y_offset);
1736
   buf[8] = (png_byte)unit_type;
1737

1738
   png_write_complete_chunk(png_ptr, png_oFFs, buf, 9);
1739
}
1740
#endif
1741
#ifdef PNG_WRITE_pCAL_SUPPORTED
1742
/* Write the pCAL chunk (described in the PNG extensions document) */
1743
void /* PRIVATE */
1744
png_write_pCAL(png_structrp png_ptr, png_charp purpose, png_int_32 X0,
1745
    png_int_32 X1, int type, int nparams, png_const_charp units,
1746
    png_charpp params)
1747
{
1748
   png_uint_32 purpose_len;
1749
   size_t units_len, total_len;
1750
   size_t *params_len;
1751
   png_byte buf[10];
1752
   png_byte new_purpose[80];
1753
   int i;
1754

1755
   png_debug1(1, "in png_write_pCAL (%d parameters)", nparams);
1756

1757
   if (type >= PNG_EQUATION_LAST)
1758
      png_error(png_ptr, "Unrecognized equation type for pCAL chunk");
1759

1760
   purpose_len = png_check_keyword(png_ptr, purpose, new_purpose);
1761

1762
   if (purpose_len == 0)
1763
      png_error(png_ptr, "pCAL: invalid keyword");
1764

1765
   ++purpose_len; /* terminator */
1766

1767
   png_debug1(3, "pCAL purpose length = %d", (int)purpose_len);
1768
   units_len = strlen(units) + (nparams == 0 ? 0 : 1);
1769
   png_debug1(3, "pCAL units length = %d", (int)units_len);
1770
   total_len = purpose_len + units_len + 10;
1771

1772
   params_len = (size_t *)png_malloc(png_ptr,
1773
       (png_alloc_size_t)((png_alloc_size_t)nparams * (sizeof (size_t))));
1774

1775
   /* Find the length of each parameter, making sure we don't count the
1776
    * null terminator for the last parameter.
1777
    */
1778
   for (i = 0; i < nparams; i++)
1779
   {
1780
      params_len[i] = strlen(params[i]) + (i == nparams - 1 ? 0 : 1);
1781
      png_debug2(3, "pCAL parameter %d length = %lu", i,
1782
          (unsigned long)params_len[i]);
1783
      total_len += params_len[i];
1784
   }
1785

1786
   png_debug1(3, "pCAL total length = %d", (int)total_len);
1787
   png_write_chunk_header(png_ptr, png_pCAL, (png_uint_32)total_len);
1788
   png_write_chunk_data(png_ptr, new_purpose, purpose_len);
1789
   png_save_int_32(buf, X0);
1790
   png_save_int_32(buf + 4, X1);
1791
   buf[8] = (png_byte)type;
1792
   buf[9] = (png_byte)nparams;
1793
   png_write_chunk_data(png_ptr, buf, 10);
1794
   png_write_chunk_data(png_ptr, (png_const_bytep)units, (size_t)units_len);
1795

1796
   for (i = 0; i < nparams; i++)
1797
   {
1798
      png_write_chunk_data(png_ptr, (png_const_bytep)params[i], params_len[i]);
1799
   }
1800

1801
   png_free(png_ptr, params_len);
1802
   png_write_chunk_end(png_ptr);
1803
}
1804
#endif
1805

1806
#ifdef PNG_WRITE_sCAL_SUPPORTED
1807
/* Write the sCAL chunk */
1808
void /* PRIVATE */
1809
png_write_sCAL_s(png_structrp png_ptr, int unit, png_const_charp width,
1810
    png_const_charp height)
1811
{
1812
   png_byte buf[64];
1813
   size_t wlen, hlen, total_len;
1814

1815
   png_debug(1, "in png_write_sCAL_s");
1816

1817
   wlen = strlen(width);
1818
   hlen = strlen(height);
1819
   total_len = wlen + hlen + 2;
1820

1821
   if (total_len > 64)
1822
   {
1823
      png_warning(png_ptr, "Can't write sCAL (buffer too small)");
1824
      return;
1825
   }
1826

1827
   buf[0] = (png_byte)unit;
1828
   memcpy(buf + 1, width, wlen + 1);      /* Append the '\0' here */
1829
   memcpy(buf + wlen + 2, height, hlen);  /* Do NOT append the '\0' here */
1830

1831
   png_debug1(3, "sCAL total length = %u", (unsigned int)total_len);
1832
   png_write_complete_chunk(png_ptr, png_sCAL, buf, total_len);
1833
}
1834
#endif
1835

1836
#ifdef PNG_WRITE_pHYs_SUPPORTED
1837
/* Write the pHYs chunk */
1838
void /* PRIVATE */
1839
png_write_pHYs(png_structrp png_ptr, png_uint_32 x_pixels_per_unit,
1840
    png_uint_32 y_pixels_per_unit,
1841
    int unit_type)
1842
{
1843
   png_byte buf[9];
1844

1845
   png_debug(1, "in png_write_pHYs");
1846

1847
   if (unit_type >= PNG_RESOLUTION_LAST)
1848
      png_warning(png_ptr, "Unrecognized unit type for pHYs chunk");
1849

1850
   png_save_uint_32(buf, x_pixels_per_unit);
1851
   png_save_uint_32(buf + 4, y_pixels_per_unit);
1852
   buf[8] = (png_byte)unit_type;
1853

1854
   png_write_complete_chunk(png_ptr, png_pHYs, buf, 9);
1855
}
1856
#endif
1857

1858
#ifdef PNG_WRITE_tIME_SUPPORTED
1859
/* Write the tIME chunk.  Use either png_convert_from_struct_tm()
1860
 * or png_convert_from_time_t(), or fill in the structure yourself.
1861
 */
1862
void /* PRIVATE */
1863
png_write_tIME(png_structrp png_ptr, png_const_timep mod_time)
1864
{
1865
   png_byte buf[7];
1866

1867
   png_debug(1, "in png_write_tIME");
1868

1869
   if (mod_time->month  > 12 || mod_time->month  < 1 ||
1870
       mod_time->day    > 31 || mod_time->day    < 1 ||
1871
       mod_time->hour   > 23 || mod_time->second > 60)
1872
   {
1873
      png_warning(png_ptr, "Invalid time specified for tIME chunk");
1874
      return;
1875
   }
1876

1877
   png_save_uint_16(buf, mod_time->year);
1878
   buf[2] = mod_time->month;
1879
   buf[3] = mod_time->day;
1880
   buf[4] = mod_time->hour;
1881
   buf[5] = mod_time->minute;
1882
   buf[6] = mod_time->second;
1883

1884
   png_write_complete_chunk(png_ptr, png_tIME, buf, 7);
1885
}
1886
#endif
1887

1888
/* Initializes the row writing capability of libpng */
1889
void /* PRIVATE */
1890
png_write_start_row(png_structrp png_ptr)
1891
{
1892
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
1893
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
1894

1895
   /* Start of interlace block */
1896
   static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
1897

1898
   /* Offset to next interlace block */
1899
   static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
1900

1901
   /* Start of interlace block in the y direction */
1902
   static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
1903

1904
   /* Offset to next interlace block in the y direction */
1905
   static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
1906
#endif
1907

1908
   png_alloc_size_t buf_size;
1909
   int usr_pixel_depth;
1910

1911
#ifdef PNG_WRITE_FILTER_SUPPORTED
1912
   png_byte filters;
1913
#endif
1914

1915
   png_debug(1, "in png_write_start_row");
1916

1917
   usr_pixel_depth = png_ptr->usr_channels * png_ptr->usr_bit_depth;
1918
   buf_size = PNG_ROWBYTES(usr_pixel_depth, png_ptr->width) + 1;
1919

1920
   /* 1.5.6: added to allow checking in the row write code. */
1921
   png_ptr->transformed_pixel_depth = png_ptr->pixel_depth;
1922
   png_ptr->maximum_pixel_depth = (png_byte)usr_pixel_depth;
1923

1924
   /* Set up row buffer */
1925
   png_ptr->row_buf = png_voidcast(png_bytep, png_malloc(png_ptr, buf_size));
1926

1927
   png_ptr->row_buf[0] = PNG_FILTER_VALUE_NONE;
1928

1929
#ifdef PNG_WRITE_FILTER_SUPPORTED
1930
   filters = png_ptr->do_filter;
1931

1932
   if (png_ptr->height == 1)
1933
      filters &= 0xff & ~(PNG_FILTER_UP|PNG_FILTER_AVG|PNG_FILTER_PAETH);
1934

1935
   if (png_ptr->width == 1)
1936
      filters &= 0xff & ~(PNG_FILTER_SUB|PNG_FILTER_AVG|PNG_FILTER_PAETH);
1937

1938
   if (filters == 0)
1939
      filters = PNG_FILTER_NONE;
1940

1941
   png_ptr->do_filter = filters;
1942

1943
   if (((filters & (PNG_FILTER_SUB | PNG_FILTER_UP | PNG_FILTER_AVG |
1944
       PNG_FILTER_PAETH)) != 0) && png_ptr->try_row == NULL)
1945
   {
1946
      int num_filters = 0;
1947

1948
      png_ptr->try_row = png_voidcast(png_bytep, png_malloc(png_ptr, buf_size));
1949

1950
      if (filters & PNG_FILTER_SUB)
1951
         num_filters++;
1952

1953
      if (filters & PNG_FILTER_UP)
1954
         num_filters++;
1955

1956
      if (filters & PNG_FILTER_AVG)
1957
         num_filters++;
1958

1959
      if (filters & PNG_FILTER_PAETH)
1960
         num_filters++;
1961

1962
      if (num_filters > 1)
1963
         png_ptr->tst_row = png_voidcast(png_bytep, png_malloc(png_ptr,
1964
             buf_size));
1965
   }
1966

1967
   /* We only need to keep the previous row if we are using one of the following
1968
    * filters.
1969
    */
1970
   if ((filters & (PNG_FILTER_AVG | PNG_FILTER_UP | PNG_FILTER_PAETH)) != 0)
1971
      png_ptr->prev_row = png_voidcast(png_bytep,
1972
          png_calloc(png_ptr, buf_size));
1973
#endif /* WRITE_FILTER */
1974

1975
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
1976
   /* If interlaced, we need to set up width and height of pass */
1977
   if (png_ptr->interlaced != 0)
1978
   {
1979
      if ((png_ptr->transformations & PNG_INTERLACE) == 0)
1980
      {
1981
         png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
1982
             png_pass_ystart[0]) / png_pass_yinc[0];
1983

1984
         png_ptr->usr_width = (png_ptr->width + png_pass_inc[0] - 1 -
1985
             png_pass_start[0]) / png_pass_inc[0];
1986
      }
1987

1988
      else
1989
      {
1990
         png_ptr->num_rows = png_ptr->height;
1991
         png_ptr->usr_width = png_ptr->width;
1992
      }
1993
   }
1994

1995
   else
1996
#endif
1997
   {
1998
      png_ptr->num_rows = png_ptr->height;
1999
      png_ptr->usr_width = png_ptr->width;
2000
   }
2001
}
2002

2003
/* Internal use only.  Called when finished processing a row of data. */
2004
void /* PRIVATE */
2005
png_write_finish_row(png_structrp png_ptr)
2006
{
2007
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
2008
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
2009

2010
   /* Start of interlace block */
2011
   static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
2012

2013
   /* Offset to next interlace block */
2014
   static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
2015

2016
   /* Start of interlace block in the y direction */
2017
   static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
2018

2019
   /* Offset to next interlace block in the y direction */
2020
   static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
2021
#endif
2022

2023
   png_debug(1, "in png_write_finish_row");
2024

2025
   /* Next row */
2026
   png_ptr->row_number++;
2027

2028
   /* See if we are done */
2029
   if (png_ptr->row_number < png_ptr->num_rows)
2030
      return;
2031

2032
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
2033
   /* If interlaced, go to next pass */
2034
   if (png_ptr->interlaced != 0)
2035
   {
2036
      png_ptr->row_number = 0;
2037
      if ((png_ptr->transformations & PNG_INTERLACE) != 0)
2038
      {
2039
         png_ptr->pass++;
2040
      }
2041

2042
      else
2043
      {
2044
         /* Loop until we find a non-zero width or height pass */
2045
         do
2046
         {
2047
            png_ptr->pass++;
2048

2049
            if (png_ptr->pass >= 7)
2050
               break;
2051

2052
            png_ptr->usr_width = (png_ptr->width +
2053
                png_pass_inc[png_ptr->pass] - 1 -
2054
                png_pass_start[png_ptr->pass]) /
2055
                png_pass_inc[png_ptr->pass];
2056

2057
            png_ptr->num_rows = (png_ptr->height +
2058
                png_pass_yinc[png_ptr->pass] - 1 -
2059
                png_pass_ystart[png_ptr->pass]) /
2060
                png_pass_yinc[png_ptr->pass];
2061

2062
            if ((png_ptr->transformations & PNG_INTERLACE) != 0)
2063
               break;
2064

2065
         } while (png_ptr->usr_width == 0 || png_ptr->num_rows == 0);
2066

2067
      }
2068

2069
      /* Reset the row above the image for the next pass */
2070
      if (png_ptr->pass < 7)
2071
      {
2072
         if (png_ptr->prev_row != NULL)
2073
            memset(png_ptr->prev_row, 0,
2074
                PNG_ROWBYTES(png_ptr->usr_channels *
2075
                png_ptr->usr_bit_depth, png_ptr->width) + 1);
2076

2077
         return;
2078
      }
2079
   }
2080
#endif
2081

2082
   /* If we get here, we've just written the last row, so we need
2083
      to flush the compressor */
2084
   png_compress_IDAT(png_ptr, NULL, 0, Z_FINISH);
2085
}
2086

2087
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
2088
/* Pick out the correct pixels for the interlace pass.
2089
 * The basic idea here is to go through the row with a source
2090
 * pointer and a destination pointer (sp and dp), and copy the
2091
 * correct pixels for the pass.  As the row gets compacted,
2092
 * sp will always be >= dp, so we should never overwrite anything.
2093
 * See the default: case for the easiest code to understand.
2094
 */
2095
void /* PRIVATE */
2096
png_do_write_interlace(png_row_infop row_info, png_bytep row, int pass)
2097
{
2098
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
2099

2100
   /* Start of interlace block */
2101
   static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
2102

2103
   /* Offset to next interlace block */
2104
   static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
2105

2106
   png_debug(1, "in png_do_write_interlace");
2107

2108
   /* We don't have to do anything on the last pass (6) */
2109
   if (pass < 6)
2110
   {
2111
      /* Each pixel depth is handled separately */
2112
      switch (row_info->pixel_depth)
2113
      {
2114
         case 1:
2115
         {
2116
            png_bytep sp;
2117
            png_bytep dp;
2118
            unsigned int shift;
2119
            int d;
2120
            int value;
2121
            png_uint_32 i;
2122
            png_uint_32 row_width = row_info->width;
2123

2124
            dp = row;
2125
            d = 0;
2126
            shift = 7;
2127

2128
            for (i = png_pass_start[pass]; i < row_width;
2129
               i += png_pass_inc[pass])
2130
            {
2131
               sp = row + (size_t)(i >> 3);
2132
               value = (int)(*sp >> (7 - (int)(i & 0x07))) & 0x01;
2133
               d |= (value << shift);
2134

2135
               if (shift == 0)
2136
               {
2137
                  shift = 7;
2138
                  *dp++ = (png_byte)d;
2139
                  d = 0;
2140
               }
2141

2142
               else
2143
                  shift--;
2144

2145
            }
2146
            if (shift != 7)
2147
               *dp = (png_byte)d;
2148

2149
            break;
2150
         }
2151

2152
         case 2:
2153
         {
2154
            png_bytep sp;
2155
            png_bytep dp;
2156
            unsigned int shift;
2157
            int d;
2158
            int value;
2159
            png_uint_32 i;
2160
            png_uint_32 row_width = row_info->width;
2161

2162
            dp = row;
2163
            shift = 6;
2164
            d = 0;
2165

2166
            for (i = png_pass_start[pass]; i < row_width;
2167
               i += png_pass_inc[pass])
2168
            {
2169
               sp = row + (size_t)(i >> 2);
2170
               value = (*sp >> ((3 - (int)(i & 0x03)) << 1)) & 0x03;
2171
               d |= (value << shift);
2172

2173
               if (shift == 0)
2174
               {
2175
                  shift = 6;
2176
                  *dp++ = (png_byte)d;
2177
                  d = 0;
2178
               }
2179

2180
               else
2181
                  shift -= 2;
2182
            }
2183
            if (shift != 6)
2184
               *dp = (png_byte)d;
2185

2186
            break;
2187
         }
2188

2189
         case 4:
2190
         {
2191
            png_bytep sp;
2192
            png_bytep dp;
2193
            unsigned int shift;
2194
            int d;
2195
            int value;
2196
            png_uint_32 i;
2197
            png_uint_32 row_width = row_info->width;
2198

2199
            dp = row;
2200
            shift = 4;
2201
            d = 0;
2202
            for (i = png_pass_start[pass]; i < row_width;
2203
                i += png_pass_inc[pass])
2204
            {
2205
               sp = row + (size_t)(i >> 1);
2206
               value = (*sp >> ((1 - (int)(i & 0x01)) << 2)) & 0x0f;
2207
               d |= (value << shift);
2208

2209
               if (shift == 0)
2210
               {
2211
                  shift = 4;
2212
                  *dp++ = (png_byte)d;
2213
                  d = 0;
2214
               }
2215

2216
               else
2217
                  shift -= 4;
2218
            }
2219
            if (shift != 4)
2220
               *dp = (png_byte)d;
2221

2222
            break;
2223
         }
2224

2225
         default:
2226
         {
2227
            png_bytep sp;
2228
            png_bytep dp;
2229
            png_uint_32 i;
2230
            png_uint_32 row_width = row_info->width;
2231
            size_t pixel_bytes;
2232

2233
            /* Start at the beginning */
2234
            dp = row;
2235

2236
            /* Find out how many bytes each pixel takes up */
2237
            pixel_bytes = (row_info->pixel_depth >> 3);
2238

2239
            /* Loop through the row, only looking at the pixels that matter */
2240
            for (i = png_pass_start[pass]; i < row_width;
2241
               i += png_pass_inc[pass])
2242
            {
2243
               /* Find out where the original pixel is */
2244
               sp = row + (size_t)i * pixel_bytes;
2245

2246
               /* Move the pixel */
2247
               if (dp != sp)
2248
                  memcpy(dp, sp, pixel_bytes);
2249

2250
               /* Next pixel */
2251
               dp += pixel_bytes;
2252
            }
2253
            break;
2254
         }
2255
      }
2256
      /* Set new row width */
2257
      row_info->width = (row_info->width +
2258
          png_pass_inc[pass] - 1 -
2259
          png_pass_start[pass]) /
2260
          png_pass_inc[pass];
2261

2262
      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
2263
          row_info->width);
2264
   }
2265
}
2266
#endif
2267

2268

2269
/* This filters the row, chooses which filter to use, if it has not already
2270
 * been specified by the application, and then writes the row out with the
2271
 * chosen filter.
2272
 */
2273
static void /* PRIVATE */
2274
png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
2275
    size_t row_bytes);
2276

2277
#ifdef PNG_WRITE_FILTER_SUPPORTED
2278
static size_t /* PRIVATE */
2279
png_setup_sub_row(png_structrp png_ptr, png_uint_32 bpp,
2280
    size_t row_bytes, size_t lmins)
2281
{
2282
   png_bytep rp, dp, lp;
2283
   size_t i;
2284
   size_t sum = 0;
2285
   unsigned int v;
2286

2287
   png_ptr->try_row[0] = PNG_FILTER_VALUE_SUB;
2288

2289
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1; i < bpp;
2290
        i++, rp++, dp++)
2291
   {
2292
      v = *dp = *rp;
2293
#ifdef PNG_USE_ABS
2294
      sum += 128 - abs((int)v - 128);
2295
#else
2296
      sum += (v < 128) ? v : 256 - v;
2297
#endif
2298
   }
2299

2300
   for (lp = png_ptr->row_buf + 1; i < row_bytes;
2301
      i++, rp++, lp++, dp++)
2302
   {
2303
      v = *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);
2304
#ifdef PNG_USE_ABS
2305
      sum += 128 - abs((int)v - 128);
2306
#else
2307
      sum += (v < 128) ? v : 256 - v;
2308
#endif
2309

2310
      if (sum > lmins)  /* We are already worse, don't continue. */
2311
        break;
2312
   }
2313

2314
   return sum;
2315
}
2316

2317
static void /* PRIVATE */
2318
png_setup_sub_row_only(png_structrp png_ptr, png_uint_32 bpp,
2319
    size_t row_bytes)
2320
{
2321
   png_bytep rp, dp, lp;
2322
   size_t i;
2323

2324
   png_ptr->try_row[0] = PNG_FILTER_VALUE_SUB;
2325

2326
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1; i < bpp;
2327
        i++, rp++, dp++)
2328
   {
2329
      *dp = *rp;
2330
   }
2331

2332
   for (lp = png_ptr->row_buf + 1; i < row_bytes;
2333
      i++, rp++, lp++, dp++)
2334
   {
2335
      *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);
2336
   }
2337
}
2338

2339
static size_t /* PRIVATE */
2340
png_setup_up_row(png_structrp png_ptr, size_t row_bytes, size_t lmins)
2341
{
2342
   png_bytep rp, dp, pp;
2343
   size_t i;
2344
   size_t sum = 0;
2345
   unsigned int v;
2346

2347
   png_ptr->try_row[0] = PNG_FILTER_VALUE_UP;
2348

2349
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2350
       pp = png_ptr->prev_row + 1; i < row_bytes;
2351
       i++, rp++, pp++, dp++)
2352
   {
2353
      v = *dp = (png_byte)(((int)*rp - (int)*pp) & 0xff);
2354
#ifdef PNG_USE_ABS
2355
      sum += 128 - abs((int)v - 128);
2356
#else
2357
      sum += (v < 128) ? v : 256 - v;
2358
#endif
2359

2360
      if (sum > lmins)  /* We are already worse, don't continue. */
2361
        break;
2362
   }
2363

2364
   return sum;
2365
}
2366
static void /* PRIVATE */
2367
png_setup_up_row_only(png_structrp png_ptr, size_t row_bytes)
2368
{
2369
   png_bytep rp, dp, pp;
2370
   size_t i;
2371

2372
   png_ptr->try_row[0] = PNG_FILTER_VALUE_UP;
2373

2374
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2375
       pp = png_ptr->prev_row + 1; i < row_bytes;
2376
       i++, rp++, pp++, dp++)
2377
   {
2378
      *dp = (png_byte)(((int)*rp - (int)*pp) & 0xff);
2379
   }
2380
}
2381

2382
static size_t /* PRIVATE */
2383
png_setup_avg_row(png_structrp png_ptr, png_uint_32 bpp,
2384
    size_t row_bytes, size_t lmins)
2385
{
2386
   png_bytep rp, dp, pp, lp;
2387
   png_uint_32 i;
2388
   size_t sum = 0;
2389
   unsigned int v;
2390

2391
   png_ptr->try_row[0] = PNG_FILTER_VALUE_AVG;
2392

2393
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2394
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2395
   {
2396
      v = *dp++ = (png_byte)(((int)*rp++ - ((int)*pp++ / 2)) & 0xff);
2397

2398
#ifdef PNG_USE_ABS
2399
      sum += 128 - abs((int)v - 128);
2400
#else
2401
      sum += (v < 128) ? v : 256 - v;
2402
#endif
2403
   }
2404

2405
   for (lp = png_ptr->row_buf + 1; i < row_bytes; i++)
2406
   {
2407
      v = *dp++ = (png_byte)(((int)*rp++ - (((int)*pp++ + (int)*lp++) / 2))
2408
          & 0xff);
2409

2410
#ifdef PNG_USE_ABS
2411
      sum += 128 - abs((int)v - 128);
2412
#else
2413
      sum += (v < 128) ? v : 256 - v;
2414
#endif
2415

2416
      if (sum > lmins)  /* We are already worse, don't continue. */
2417
        break;
2418
   }
2419

2420
   return sum;
2421
}
2422
static void /* PRIVATE */
2423
png_setup_avg_row_only(png_structrp png_ptr, png_uint_32 bpp,
2424
    size_t row_bytes)
2425
{
2426
   png_bytep rp, dp, pp, lp;
2427
   png_uint_32 i;
2428

2429
   png_ptr->try_row[0] = PNG_FILTER_VALUE_AVG;
2430

2431
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2432
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2433
   {
2434
      *dp++ = (png_byte)(((int)*rp++ - ((int)*pp++ / 2)) & 0xff);
2435
   }
2436

2437
   for (lp = png_ptr->row_buf + 1; i < row_bytes; i++)
2438
   {
2439
      *dp++ = (png_byte)(((int)*rp++ - (((int)*pp++ + (int)*lp++) / 2))
2440
          & 0xff);
2441
   }
2442
}
2443

2444
static size_t /* PRIVATE */
2445
png_setup_paeth_row(png_structrp png_ptr, png_uint_32 bpp,
2446
    size_t row_bytes, size_t lmins)
2447
{
2448
   png_bytep rp, dp, pp, cp, lp;
2449
   size_t i;
2450
   size_t sum = 0;
2451
   unsigned int v;
2452

2453
   png_ptr->try_row[0] = PNG_FILTER_VALUE_PAETH;
2454

2455
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2456
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2457
   {
2458
      v = *dp++ = (png_byte)(((int)*rp++ - (int)*pp++) & 0xff);
2459

2460
#ifdef PNG_USE_ABS
2461
      sum += 128 - abs((int)v - 128);
2462
#else
2463
      sum += (v < 128) ? v : 256 - v;
2464
#endif
2465
   }
2466

2467
   for (lp = png_ptr->row_buf + 1, cp = png_ptr->prev_row + 1; i < row_bytes;
2468
        i++)
2469
   {
2470
      int a, b, c, pa, pb, pc, p;
2471

2472
      b = *pp++;
2473
      c = *cp++;
2474
      a = *lp++;
2475

2476
      p = b - c;
2477
      pc = a - c;
2478

2479
#ifdef PNG_USE_ABS
2480
      pa = abs(p);
2481
      pb = abs(pc);
2482
      pc = abs(p + pc);
2483
#else
2484
      pa = p < 0 ? -p : p;
2485
      pb = pc < 0 ? -pc : pc;
2486
      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
2487
#endif
2488

2489
      p = (pa <= pb && pa <=pc) ? a : (pb <= pc) ? b : c;
2490

2491
      v = *dp++ = (png_byte)(((int)*rp++ - p) & 0xff);
2492

2493
#ifdef PNG_USE_ABS
2494
      sum += 128 - abs((int)v - 128);
2495
#else
2496
      sum += (v < 128) ? v : 256 - v;
2497
#endif
2498

2499
      if (sum > lmins)  /* We are already worse, don't continue. */
2500
        break;
2501
   }
2502

2503
   return sum;
2504
}
2505
static void /* PRIVATE */
2506
png_setup_paeth_row_only(png_structrp png_ptr, png_uint_32 bpp,
2507
    size_t row_bytes)
2508
{
2509
   png_bytep rp, dp, pp, cp, lp;
2510
   size_t i;
2511

2512
   png_ptr->try_row[0] = PNG_FILTER_VALUE_PAETH;
2513

2514
   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2515
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2516
   {
2517
      *dp++ = (png_byte)(((int)*rp++ - (int)*pp++) & 0xff);
2518
   }
2519

2520
   for (lp = png_ptr->row_buf + 1, cp = png_ptr->prev_row + 1; i < row_bytes;
2521
        i++)
2522
   {
2523
      int a, b, c, pa, pb, pc, p;
2524

2525
      b = *pp++;
2526
      c = *cp++;
2527
      a = *lp++;
2528

2529
      p = b - c;
2530
      pc = a - c;
2531

2532
#ifdef PNG_USE_ABS
2533
      pa = abs(p);
2534
      pb = abs(pc);
2535
      pc = abs(p + pc);
2536
#else
2537
      pa = p < 0 ? -p : p;
2538
      pb = pc < 0 ? -pc : pc;
2539
      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
2540
#endif
2541

2542
      p = (pa <= pb && pa <=pc) ? a : (pb <= pc) ? b : c;
2543

2544
      *dp++ = (png_byte)(((int)*rp++ - p) & 0xff);
2545
   }
2546
}
2547
#endif /* WRITE_FILTER */
2548

2549
void /* PRIVATE */
2550
png_write_find_filter(png_structrp png_ptr, png_row_infop row_info)
2551
{
2552
#ifndef PNG_WRITE_FILTER_SUPPORTED
2553
   png_write_filtered_row(png_ptr, png_ptr->row_buf, row_info->rowbytes+1);
2554
#else
2555
   unsigned int filter_to_do = png_ptr->do_filter;
2556
   png_bytep row_buf;
2557
   png_bytep best_row;
2558
   png_uint_32 bpp;
2559
   size_t mins;
2560
   size_t row_bytes = row_info->rowbytes;
2561

2562
   png_debug(1, "in png_write_find_filter");
2563

2564
   /* Find out how many bytes offset each pixel is */
2565
   bpp = (row_info->pixel_depth + 7) >> 3;
2566

2567
   row_buf = png_ptr->row_buf;
2568
   mins = PNG_SIZE_MAX - 256/* so we can detect potential overflow of the
2569
                               running sum */;
2570

2571
   /* The prediction method we use is to find which method provides the
2572
    * smallest value when summing the absolute values of the distances
2573
    * from zero, using anything >= 128 as negative numbers.  This is known
2574
    * as the "minimum sum of absolute differences" heuristic.  Other
2575
    * heuristics are the "weighted minimum sum of absolute differences"
2576
    * (experimental and can in theory improve compression), and the "zlib
2577
    * predictive" method (not implemented yet), which does test compressions
2578
    * of lines using different filter methods, and then chooses the
2579
    * (series of) filter(s) that give minimum compressed data size (VERY
2580
    * computationally expensive).
2581
    *
2582
    * GRR 980525:  consider also
2583
    *
2584
    *   (1) minimum sum of absolute differences from running average (i.e.,
2585
    *       keep running sum of non-absolute differences & count of bytes)
2586
    *       [track dispersion, too?  restart average if dispersion too large?]
2587
    *
2588
    *  (1b) minimum sum of absolute differences from sliding average, probably
2589
    *       with window size <= deflate window (usually 32K)
2590
    *
2591
    *   (2) minimum sum of squared differences from zero or running average
2592
    *       (i.e., ~ root-mean-square approach)
2593
    */
2594

2595

2596
   /* We don't need to test the 'no filter' case if this is the only filter
2597
    * that has been chosen, as it doesn't actually do anything to the data.
2598
    */
2599
   best_row = png_ptr->row_buf;
2600

2601
   if (PNG_SIZE_MAX/128 <= row_bytes)
2602
   {
2603
      /* Overflow can occur in the calculation, just select the lowest set
2604
       * filter.
2605
       */
2606
      filter_to_do &= 0U-filter_to_do;
2607
   }
2608
   else if ((filter_to_do & PNG_FILTER_NONE) != 0 &&
2609
         filter_to_do != PNG_FILTER_NONE)
2610
   {
2611
      /* Overflow not possible and multiple filters in the list, including the
2612
       * 'none' filter.
2613
       */
2614
      png_bytep rp;
2615
      size_t sum = 0;
2616
      size_t i;
2617
      unsigned int v;
2618

2619
      {
2620
         for (i = 0, rp = row_buf + 1; i < row_bytes; i++, rp++)
2621
         {
2622
            v = *rp;
2623
#ifdef PNG_USE_ABS
2624
            sum += 128 - abs((int)v - 128);
2625
#else
2626
            sum += (v < 128) ? v : 256 - v;
2627
#endif
2628
         }
2629
      }
2630

2631
      mins = sum;
2632
   }
2633

2634
   /* Sub filter */
2635
   if (filter_to_do == PNG_FILTER_SUB)
2636
   /* It's the only filter so no testing is needed */
2637
   {
2638
      png_setup_sub_row_only(png_ptr, bpp, row_bytes);
2639
      best_row = png_ptr->try_row;
2640
   }
2641

2642
   else if ((filter_to_do & PNG_FILTER_SUB) != 0)
2643
   {
2644
      size_t sum;
2645
      size_t lmins = mins;
2646

2647
      sum = png_setup_sub_row(png_ptr, bpp, row_bytes, lmins);
2648

2649
      if (sum < mins)
2650
      {
2651
         mins = sum;
2652
         best_row = png_ptr->try_row;
2653
         if (png_ptr->tst_row != NULL)
2654
         {
2655
            png_ptr->try_row = png_ptr->tst_row;
2656
            png_ptr->tst_row = best_row;
2657
         }
2658
      }
2659
   }
2660

2661
   /* Up filter */
2662
   if (filter_to_do == PNG_FILTER_UP)
2663
   {
2664
      png_setup_up_row_only(png_ptr, row_bytes);
2665
      best_row = png_ptr->try_row;
2666
   }
2667

2668
   else if ((filter_to_do & PNG_FILTER_UP) != 0)
2669
   {
2670
      size_t sum;
2671
      size_t lmins = mins;
2672

2673
      sum = png_setup_up_row(png_ptr, row_bytes, lmins);
2674

2675
      if (sum < mins)
2676
      {
2677
         mins = sum;
2678
         best_row = png_ptr->try_row;
2679
         if (png_ptr->tst_row != NULL)
2680
         {
2681
            png_ptr->try_row = png_ptr->tst_row;
2682
            png_ptr->tst_row = best_row;
2683
         }
2684
      }
2685
   }
2686

2687
   /* Avg filter */
2688
   if (filter_to_do == PNG_FILTER_AVG)
2689
   {
2690
      png_setup_avg_row_only(png_ptr, bpp, row_bytes);
2691
      best_row = png_ptr->try_row;
2692
   }
2693

2694
   else if ((filter_to_do & PNG_FILTER_AVG) != 0)
2695
   {
2696
      size_t sum;
2697
      size_t lmins = mins;
2698

2699
      sum= png_setup_avg_row(png_ptr, bpp, row_bytes, lmins);
2700

2701
      if (sum < mins)
2702
      {
2703
         mins = sum;
2704
         best_row = png_ptr->try_row;
2705
         if (png_ptr->tst_row != NULL)
2706
         {
2707
            png_ptr->try_row = png_ptr->tst_row;
2708
            png_ptr->tst_row = best_row;
2709
         }
2710
      }
2711
   }
2712

2713
   /* Paeth filter */
2714
   if (filter_to_do == PNG_FILTER_PAETH)
2715
   {
2716
      png_setup_paeth_row_only(png_ptr, bpp, row_bytes);
2717
      best_row = png_ptr->try_row;
2718
   }
2719

2720
   else if ((filter_to_do & PNG_FILTER_PAETH) != 0)
2721
   {
2722
      size_t sum;
2723
      size_t lmins = mins;
2724

2725
      sum = png_setup_paeth_row(png_ptr, bpp, row_bytes, lmins);
2726

2727
      if (sum < mins)
2728
      {
2729
         best_row = png_ptr->try_row;
2730
         if (png_ptr->tst_row != NULL)
2731
         {
2732
            png_ptr->try_row = png_ptr->tst_row;
2733
            png_ptr->tst_row = best_row;
2734
         }
2735
      }
2736
   }
2737

2738
   /* Do the actual writing of the filtered row data from the chosen filter. */
2739
   png_write_filtered_row(png_ptr, best_row, row_info->rowbytes+1);
2740

2741
#endif /* WRITE_FILTER */
2742
}
2743

2744

2745
/* Do the actual writing of a previously filtered row. */
2746
static void
2747
png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
2748
    size_t full_row_length/*includes filter byte*/)
2749
{
2750
   png_debug(1, "in png_write_filtered_row");
2751

2752
   png_debug1(2, "filter = %d", filtered_row[0]);
2753

2754
   png_compress_IDAT(png_ptr, filtered_row, full_row_length, Z_NO_FLUSH);
2755

2756
#ifdef PNG_WRITE_FILTER_SUPPORTED
2757
   /* Swap the current and previous rows */
2758
   if (png_ptr->prev_row != NULL)
2759
   {
2760
      png_bytep tptr;
2761

2762
      tptr = png_ptr->prev_row;
2763
      png_ptr->prev_row = png_ptr->row_buf;
2764
      png_ptr->row_buf = tptr;
2765
   }
2766
#endif /* WRITE_FILTER */
2767

2768
   /* Finish row - updates counters and flushes zlib if last row */
2769
   png_write_finish_row(png_ptr);
2770

2771
#ifdef PNG_WRITE_FLUSH_SUPPORTED
2772
   png_ptr->flush_rows++;
2773

2774
   if (png_ptr->flush_dist > 0 &&
2775
       png_ptr->flush_rows >= png_ptr->flush_dist)
2776
   {
2777
      png_write_flush(png_ptr);
2778
   }
2779
#endif /* WRITE_FLUSH */
2780
}
2781
#endif /* WRITE */
2782

Использование cookies

Мы используем файлы cookie в соответствии с Политикой конфиденциальности и Политикой использования cookies.

Нажимая кнопку «Принимаю», Вы даете АО «СберТех» согласие на обработку Ваших персональных данных в целях совершенствования нашего веб-сайта и Сервиса GitVerse, а также повышения удобства их использования.

Запретить использование cookies Вы можете самостоятельно в настройках Вашего браузера.