1 #include <sys/cdefs.h>
2 __RCSID("$MirOS: src/lib/libpng/png.c,v 1.12 2013/08/06 18:49:27 tg Exp $");
3 
4 /* png.c - location for general purpose libpng functions
5  *
6  * Last changed in libpng 1.2.46 [February 25, 2011]
7  * Copyright (c) 1998-2011 Glenn Randers-Pehrson
8  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
9  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
10  *
11  * This code is released under the libpng license.
12  * For conditions of distribution and use, see the disclaimer
13  * and license in png.h
14  */
15 
16 #define PNG_INTERNAL
17 #define PNG_NO_EXTERN
18 #define PNG_NO_PEDANTIC_WARNINGS
19 #include "png.h"
20 
21 /* Generate a compiler error if there is an old png.h in the search path. */
22 typedef version_1_2_50 Your_png_h_is_not_version_1_2_50;
23 
24 /* Version information for C files.  This had better match the version
25  * string defined in png.h.
26  */
27 
28 #ifdef PNG_USE_GLOBAL_ARRAYS
29 /* png_libpng_ver was changed to a function in version 1.0.5c */
30 PNG_CONST char png_libpng_ver[18] = PNG_LIBPNG_VER_STRING;
31 
32 #ifdef PNG_READ_SUPPORTED
33 
34 /* png_sig was changed to a function in version 1.0.5c */
35 /* Place to hold the signature string for a PNG file. */
36 PNG_CONST png_byte FARDATA png_sig[8] = {137, 80, 78, 71, 13, 10, 26, 10};
37 #endif /* PNG_READ_SUPPORTED */
38 
39 /* Invoke global declarations for constant strings for known chunk types */
40 PNG_IHDR;
41 PNG_IDAT;
42 PNG_IEND;
43 PNG_PLTE;
44 PNG_bKGD;
45 PNG_cHRM;
46 PNG_gAMA;
47 PNG_hIST;
48 PNG_iCCP;
49 PNG_iTXt;
50 PNG_oFFs;
51 PNG_pCAL;
52 PNG_sCAL;
53 PNG_pHYs;
54 PNG_sBIT;
55 PNG_sPLT;
56 PNG_sRGB;
57 PNG_tEXt;
58 PNG_tIME;
59 PNG_tRNS;
60 PNG_zTXt;
61 
62 #ifdef PNG_READ_SUPPORTED
63 /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
64 
65 /* Start of interlace block */
66 PNG_CONST int FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0};
67 
68 /* Offset to next interlace block */
69 PNG_CONST int FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1};
70 
71 /* Start of interlace block in the y direction */
72 PNG_CONST int FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1};
73 
74 /* Offset to next interlace block in the y direction */
75 PNG_CONST int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
76 
77 /* Height of interlace block.  This is not currently used - if you need
78  * it, uncomment it here and in png.h
79 PNG_CONST int FARDATA png_pass_height[] = {8, 8, 4, 4, 2, 2, 1};
80 */
81 
82 /* Mask to determine which pixels are valid in a pass */
83 PNG_CONST int FARDATA png_pass_mask[] =
84     {0x80, 0x08, 0x88, 0x22, 0xaa, 0x55, 0xff};
85 
86 /* Mask to determine which pixels to overwrite while displaying */
87 PNG_CONST int FARDATA png_pass_dsp_mask[]
88    = {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff};
89 
90 #endif /* PNG_READ_SUPPORTED */
91 #endif /* PNG_USE_GLOBAL_ARRAYS */
92 
93 /* Tells libpng that we have already handled the first "num_bytes" bytes
94  * of the PNG file signature.  If the PNG data is embedded into another
95  * stream we can set num_bytes = 8 so that libpng will not attempt to read
96  * or write any of the magic bytes before it starts on the IHDR.
97  */
98 
99 #ifdef PNG_READ_SUPPORTED
100 void PNGAPI
png_set_sig_bytes(png_structp png_ptr,int num_bytes)101 png_set_sig_bytes(png_structp png_ptr, int num_bytes)
102 {
103    png_debug(1, "in png_set_sig_bytes");
104 
105    if (png_ptr == NULL)
106       return;
107 
108    if (num_bytes > 8)
109       png_error(png_ptr, "Too many bytes for PNG signature.");
110 
111    png_ptr->sig_bytes = (png_byte)(num_bytes < 0 ? 0 : num_bytes);
112 }
113 
114 /* Checks whether the supplied bytes match the PNG signature.  We allow
115  * checking less than the full 8-byte signature so that those apps that
116  * already read the first few bytes of a file to determine the file type
117  * can simply check the remaining bytes for extra assurance.  Returns
118  * an integer less than, equal to, or greater than zero if sig is found,
119  * respectively, to be less than, to match, or be greater than the correct
120  * PNG signature (this is the same behaviour as strcmp, memcmp, etc).
121  */
122 int PNGAPI
png_sig_cmp(png_bytep sig,png_size_t start,png_size_t num_to_check)123 png_sig_cmp(png_bytep sig, png_size_t start, png_size_t num_to_check)
124 {
125    png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
126    if (num_to_check > 8)
127       num_to_check = 8;
128    else if (num_to_check < 1)
129       return (-1);
130 
131    if (start > 7)
132       return (-1);
133 
134    if (start + num_to_check > 8)
135       num_to_check = 8 - start;
136 
137    return ((int)(png_memcmp(&sig[start], &png_signature[start], num_to_check)));
138 }
139 
140 #if defined(PNG_1_0_X) || defined(PNG_1_2_X)
141 /* (Obsolete) function to check signature bytes.  It does not allow one
142  * to check a partial signature.  This function might be removed in the
143  * future - use png_sig_cmp().  Returns true (nonzero) if the file is PNG.
144  */
145 int PNGAPI
png_check_sig(png_bytep sig,int num)146 png_check_sig(png_bytep sig, int num)
147 {
148   return ((int)!png_sig_cmp(sig, (png_size_t)0, (png_size_t)num));
149 }
150 #endif
151 #endif /* PNG_READ_SUPPORTED */
152 
153 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
154 /* Function to allocate memory for zlib and clear it to 0. */
155 #ifdef PNG_1_0_X
156 voidpf PNGAPI
157 #else
158 voidpf /* PRIVATE */
159 #endif
png_zalloc(voidpf png_ptr,uInt items,uInt size)160 png_zalloc(voidpf png_ptr, uInt items, uInt size)
161 {
162    png_voidp ptr;
163    png_structp p=(png_structp)png_ptr;
164    png_uint_32 save_flags=p->flags;
165    png_uint_32 num_bytes;
166 
167    if (png_ptr == NULL)
168       return (NULL);
169    if (items > PNG_UINT_32_MAX/size)
170    {
171      png_warning (p, "Potential overflow in png_zalloc()");
172      return (NULL);
173    }
174    num_bytes = (png_uint_32)items * size;
175 
176    p->flags|=PNG_FLAG_MALLOC_NULL_MEM_OK;
177    ptr = (png_voidp)png_malloc((png_structp)png_ptr, num_bytes);
178    p->flags=save_flags;
179 
180 #if defined(PNG_1_0_X) && !defined(PNG_NO_ZALLOC_ZERO)
181    if (ptr == NULL)
182        return ((voidpf)ptr);
183 
184    if (num_bytes > (png_uint_32)0x8000L)
185    {
186       png_memset(ptr, 0, (png_size_t)0x8000L);
187       png_memset((png_bytep)ptr + (png_size_t)0x8000L, 0,
188          (png_size_t)(num_bytes - (png_uint_32)0x8000L));
189    }
190    else
191    {
192       png_memset(ptr, 0, (png_size_t)num_bytes);
193    }
194 #endif
195    return ((voidpf)ptr);
196 }
197 
198 /* Function to free memory for zlib */
199 #ifdef PNG_1_0_X
200 void PNGAPI
201 #else
202 void /* PRIVATE */
203 #endif
png_zfree(voidpf png_ptr,voidpf ptr)204 png_zfree(voidpf png_ptr, voidpf ptr)
205 {
206    png_free((png_structp)png_ptr, (png_voidp)ptr);
207 }
208 
209 /* Reset the CRC variable to 32 bits of 1's.  Care must be taken
210  * in case CRC is > 32 bits to leave the top bits 0.
211  */
212 void /* PRIVATE */
png_reset_crc(png_structp png_ptr)213 png_reset_crc(png_structp png_ptr)
214 {
215    png_ptr->crc = crc32(0, Z_NULL, 0);
216 }
217 
218 /* Calculate the CRC over a section of data.  We can only pass as
219  * much data to this routine as the largest single buffer size.  We
220  * also check that this data will actually be used before going to the
221  * trouble of calculating it.
222  */
223 void /* PRIVATE */
png_calculate_crc(png_structp png_ptr,png_bytep ptr,png_size_t length)224 png_calculate_crc(png_structp png_ptr, png_bytep ptr, png_size_t length)
225 {
226    int need_crc = 1;
227 
228    if (png_ptr->chunk_name[0] & 0x20)                     /* ancillary */
229    {
230       if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
231           (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
232          need_crc = 0;
233    }
234    else                                                    /* critical */
235    {
236       if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE)
237          need_crc = 0;
238    }
239 
240    if (need_crc)
241       png_ptr->crc = crc32(png_ptr->crc, ptr, (uInt)length);
242 }
243 
244 /* Allocate the memory for an info_struct for the application.  We don't
245  * really need the png_ptr, but it could potentially be useful in the
246  * future.  This should be used in favour of malloc(png_sizeof(png_info))
247  * and png_info_init() so that applications that want to use a shared
248  * libpng don't have to be recompiled if png_info changes size.
249  */
250 png_infop PNGAPI
png_create_info_struct(png_structp png_ptr)251 png_create_info_struct(png_structp png_ptr)
252 {
253    png_infop info_ptr;
254 
255    png_debug(1, "in png_create_info_struct");
256 
257    if (png_ptr == NULL)
258       return (NULL);
259 
260 #ifdef PNG_USER_MEM_SUPPORTED
261    info_ptr = (png_infop)png_create_struct_2(PNG_STRUCT_INFO,
262       png_ptr->malloc_fn, png_ptr->mem_ptr);
263 #else
264    info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO);
265 #endif
266    if (info_ptr != NULL)
267       png_info_init_3(&info_ptr, png_sizeof(png_info));
268 
269    return (info_ptr);
270 }
271 
272 /* This function frees the memory associated with a single info struct.
273  * Normally, one would use either png_destroy_read_struct() or
274  * png_destroy_write_struct() to free an info struct, but this may be
275  * useful for some applications.
276  */
277 void PNGAPI
png_destroy_info_struct(png_structp png_ptr,png_infopp info_ptr_ptr)278 png_destroy_info_struct(png_structp png_ptr, png_infopp info_ptr_ptr)
279 {
280    png_infop info_ptr = NULL;
281 
282    png_debug(1, "in png_destroy_info_struct");
283 
284    if (png_ptr == NULL)
285       return;
286 
287    if (info_ptr_ptr != NULL)
288       info_ptr = *info_ptr_ptr;
289 
290    if (info_ptr != NULL)
291    {
292       png_info_destroy(png_ptr, info_ptr);
293 
294 #ifdef PNG_USER_MEM_SUPPORTED
295       png_destroy_struct_2((png_voidp)info_ptr, png_ptr->free_fn,
296           png_ptr->mem_ptr);
297 #else
298       png_destroy_struct((png_voidp)info_ptr);
299 #endif
300       *info_ptr_ptr = NULL;
301    }
302 }
303 
304 /* Initialize the info structure.  This is now an internal function (0.89)
305  * and applications using it are urged to use png_create_info_struct()
306  * instead.
307  */
308 #if defined(PNG_1_0_X) || defined(PNG_1_2_X)
309 #undef png_info_init
310 void PNGAPI
png_info_init(png_infop info_ptr)311 png_info_init(png_infop info_ptr)
312 {
313    /* We only come here via pre-1.0.12-compiled applications */
314    png_info_init_3(&info_ptr, 0);
315 }
316 #endif
317 
318 void PNGAPI
png_info_init_3(png_infopp ptr_ptr,png_size_t png_info_struct_size)319 png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size)
320 {
321    png_infop info_ptr = *ptr_ptr;
322 
323    png_debug(1, "in png_info_init_3");
324 
325    if (info_ptr == NULL)
326       return;
327 
328    if (png_sizeof(png_info) > png_info_struct_size)
329    {
330       png_destroy_struct(info_ptr);
331       info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO);
332       *ptr_ptr = info_ptr;
333    }
334 
335    /* Set everything to 0 */
336    png_memset(info_ptr, 0, png_sizeof(png_info));
337 }
338 
339 #ifdef PNG_FREE_ME_SUPPORTED
340 void PNGAPI
png_data_freer(png_structp png_ptr,png_infop info_ptr,int freer,png_uint_32 mask)341 png_data_freer(png_structp png_ptr, png_infop info_ptr,
342    int freer, png_uint_32 mask)
343 {
344    png_debug(1, "in png_data_freer");
345 
346    if (png_ptr == NULL || info_ptr == NULL)
347       return;
348 
349    if (freer == PNG_DESTROY_WILL_FREE_DATA)
350       info_ptr->free_me |= mask;
351    else if (freer == PNG_USER_WILL_FREE_DATA)
352       info_ptr->free_me &= ~mask;
353    else
354       png_warning(png_ptr,
355          "Unknown freer parameter in png_data_freer.");
356 }
357 #endif
358 
359 void PNGAPI
png_free_data(png_structp png_ptr,png_infop info_ptr,png_uint_32 mask,int num)360 png_free_data(png_structp png_ptr, png_infop info_ptr, png_uint_32 mask,
361    int num)
362 {
363    png_debug(1, "in png_free_data");
364 
365    if (png_ptr == NULL || info_ptr == NULL)
366       return;
367 
368 #ifdef PNG_TEXT_SUPPORTED
369    /* Free text item num or (if num == -1) all text items */
370 #ifdef PNG_FREE_ME_SUPPORTED
371    if ((mask & PNG_FREE_TEXT) & info_ptr->free_me)
372 #else
373    if (mask & PNG_FREE_TEXT)
374 #endif
375    {
376       if (num != -1)
377       {
378          if (info_ptr->text && info_ptr->text[num].key)
379          {
380             png_free(png_ptr, info_ptr->text[num].key);
381             info_ptr->text[num].key = NULL;
382          }
383       }
384       else
385       {
386          int i;
387          for (i = 0; i < info_ptr->num_text; i++)
388              png_free_data(png_ptr, info_ptr, PNG_FREE_TEXT, i);
389          png_free(png_ptr, info_ptr->text);
390          info_ptr->text = NULL;
391          info_ptr->num_text=0;
392       }
393    }
394 #endif
395 
396 #ifdef PNG_tRNS_SUPPORTED
397    /* Free any tRNS entry */
398 #ifdef PNG_FREE_ME_SUPPORTED
399    if ((mask & PNG_FREE_TRNS) & info_ptr->free_me)
400 #else
401    if ((mask & PNG_FREE_TRNS) && (png_ptr->flags & PNG_FLAG_FREE_TRNS))
402 #endif
403    {
404       png_free(png_ptr, info_ptr->trans);
405       info_ptr->trans = NULL;
406       info_ptr->valid &= ~PNG_INFO_tRNS;
407 #ifndef PNG_FREE_ME_SUPPORTED
408       png_ptr->flags &= ~PNG_FLAG_FREE_TRNS;
409 #endif
410    }
411 #endif
412 
413 #ifdef PNG_sCAL_SUPPORTED
414    /* Free any sCAL entry */
415 #ifdef PNG_FREE_ME_SUPPORTED
416    if ((mask & PNG_FREE_SCAL) & info_ptr->free_me)
417 #else
418    if (mask & PNG_FREE_SCAL)
419 #endif
420    {
421 #if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
422       png_free(png_ptr, info_ptr->scal_s_width);
423       png_free(png_ptr, info_ptr->scal_s_height);
424       info_ptr->scal_s_width = NULL;
425       info_ptr->scal_s_height = NULL;
426 #endif
427       info_ptr->valid &= ~PNG_INFO_sCAL;
428    }
429 #endif
430 
431 #ifdef PNG_pCAL_SUPPORTED
432    /* Free any pCAL entry */
433 #ifdef PNG_FREE_ME_SUPPORTED
434    if ((mask & PNG_FREE_PCAL) & info_ptr->free_me)
435 #else
436    if (mask & PNG_FREE_PCAL)
437 #endif
438    {
439       png_free(png_ptr, info_ptr->pcal_purpose);
440       png_free(png_ptr, info_ptr->pcal_units);
441       info_ptr->pcal_purpose = NULL;
442       info_ptr->pcal_units = NULL;
443       if (info_ptr->pcal_params != NULL)
444          {
445             int i;
446             for (i = 0; i < (int)info_ptr->pcal_nparams; i++)
447             {
448                png_free(png_ptr, info_ptr->pcal_params[i]);
449                info_ptr->pcal_params[i] = NULL;
450             }
451             png_free(png_ptr, info_ptr->pcal_params);
452             info_ptr->pcal_params = NULL;
453          }
454       info_ptr->valid &= ~PNG_INFO_pCAL;
455    }
456 #endif
457 
458 #ifdef PNG_iCCP_SUPPORTED
459    /* Free any iCCP entry */
460 #ifdef PNG_FREE_ME_SUPPORTED
461    if ((mask & PNG_FREE_ICCP) & info_ptr->free_me)
462 #else
463    if (mask & PNG_FREE_ICCP)
464 #endif
465    {
466       png_free(png_ptr, info_ptr->iccp_name);
467       png_free(png_ptr, info_ptr->iccp_profile);
468       info_ptr->iccp_name = NULL;
469       info_ptr->iccp_profile = NULL;
470       info_ptr->valid &= ~PNG_INFO_iCCP;
471    }
472 #endif
473 
474 #ifdef PNG_sPLT_SUPPORTED
475    /* Free a given sPLT entry, or (if num == -1) all sPLT entries */
476 #ifdef PNG_FREE_ME_SUPPORTED
477    if ((mask & PNG_FREE_SPLT) & info_ptr->free_me)
478 #else
479    if (mask & PNG_FREE_SPLT)
480 #endif
481    {
482       if (num != -1)
483       {
484          if (info_ptr->splt_palettes)
485          {
486             png_free(png_ptr, info_ptr->splt_palettes[num].name);
487             png_free(png_ptr, info_ptr->splt_palettes[num].entries);
488             info_ptr->splt_palettes[num].name = NULL;
489             info_ptr->splt_palettes[num].entries = NULL;
490          }
491       }
492       else
493       {
494          if (info_ptr->splt_palettes_num)
495          {
496             int i;
497             for (i = 0; i < (int)info_ptr->splt_palettes_num; i++)
498                png_free_data(png_ptr, info_ptr, PNG_FREE_SPLT, i);
499 
500             png_free(png_ptr, info_ptr->splt_palettes);
501             info_ptr->splt_palettes = NULL;
502             info_ptr->splt_palettes_num = 0;
503          }
504          info_ptr->valid &= ~PNG_INFO_sPLT;
505       }
506    }
507 #endif
508 
509 #ifdef PNG_UNKNOWN_CHUNKS_SUPPORTED
510    if (png_ptr->unknown_chunk.data)
511    {
512       png_free(png_ptr, png_ptr->unknown_chunk.data);
513       png_ptr->unknown_chunk.data = NULL;
514    }
515 
516 #ifdef PNG_FREE_ME_SUPPORTED
517    if ((mask & PNG_FREE_UNKN) & info_ptr->free_me)
518 #else
519    if (mask & PNG_FREE_UNKN)
520 #endif
521    {
522       if (num != -1)
523       {
524           if (info_ptr->unknown_chunks)
525           {
526              png_free(png_ptr, info_ptr->unknown_chunks[num].data);
527              info_ptr->unknown_chunks[num].data = NULL;
528           }
529       }
530       else
531       {
532          int i;
533 
534          if (info_ptr->unknown_chunks_num)
535          {
536             for (i = 0; i < (int)info_ptr->unknown_chunks_num; i++)
537                png_free_data(png_ptr, info_ptr, PNG_FREE_UNKN, i);
538 
539             png_free(png_ptr, info_ptr->unknown_chunks);
540             info_ptr->unknown_chunks = NULL;
541             info_ptr->unknown_chunks_num = 0;
542          }
543       }
544    }
545 #endif
546 
547 #ifdef PNG_hIST_SUPPORTED
548    /* Free any hIST entry */
549 #ifdef PNG_FREE_ME_SUPPORTED
550    if ((mask & PNG_FREE_HIST)  & info_ptr->free_me)
551 #else
552    if ((mask & PNG_FREE_HIST) && (png_ptr->flags & PNG_FLAG_FREE_HIST))
553 #endif
554    {
555       png_free(png_ptr, info_ptr->hist);
556       info_ptr->hist = NULL;
557       info_ptr->valid &= ~PNG_INFO_hIST;
558 #ifndef PNG_FREE_ME_SUPPORTED
559       png_ptr->flags &= ~PNG_FLAG_FREE_HIST;
560 #endif
561    }
562 #endif
563 
564    /* Free any PLTE entry that was internally allocated */
565 #ifdef PNG_FREE_ME_SUPPORTED
566    if ((mask & PNG_FREE_PLTE) & info_ptr->free_me)
567 #else
568    if ((mask & PNG_FREE_PLTE) && (png_ptr->flags & PNG_FLAG_FREE_PLTE))
569 #endif
570    {
571       png_zfree(png_ptr, info_ptr->palette);
572       info_ptr->palette = NULL;
573       info_ptr->valid &= ~PNG_INFO_PLTE;
574 #ifndef PNG_FREE_ME_SUPPORTED
575       png_ptr->flags &= ~PNG_FLAG_FREE_PLTE;
576 #endif
577       info_ptr->num_palette = 0;
578    }
579 
580 #ifdef PNG_INFO_IMAGE_SUPPORTED
581    /* Free any image bits attached to the info structure */
582 #ifdef PNG_FREE_ME_SUPPORTED
583    if ((mask & PNG_FREE_ROWS) & info_ptr->free_me)
584 #else
585    if (mask & PNG_FREE_ROWS)
586 #endif
587    {
588       if (info_ptr->row_pointers)
589       {
590          int row;
591          for (row = 0; row < (int)info_ptr->height; row++)
592          {
593             png_free(png_ptr, info_ptr->row_pointers[row]);
594             info_ptr->row_pointers[row] = NULL;
595          }
596          png_free(png_ptr, info_ptr->row_pointers);
597          info_ptr->row_pointers = NULL;
598       }
599       info_ptr->valid &= ~PNG_INFO_IDAT;
600    }
601 #endif
602 
603 #ifdef PNG_FREE_ME_SUPPORTED
604    if (num == -1)
605       info_ptr->free_me &= ~mask;
606    else
607       info_ptr->free_me &= ~(mask & ~PNG_FREE_MUL);
608 #endif
609 }
610 
611 /* This is an internal routine to free any memory that the info struct is
612  * pointing to before re-using it or freeing the struct itself.  Recall
613  * that png_free() checks for NULL pointers for us.
614  */
615 void /* PRIVATE */
png_info_destroy(png_structp png_ptr,png_infop info_ptr)616 png_info_destroy(png_structp png_ptr, png_infop info_ptr)
617 {
618    png_debug(1, "in png_info_destroy");
619 
620    png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);
621 
622 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
623    if (png_ptr->num_chunk_list)
624    {
625       png_free(png_ptr, png_ptr->chunk_list);
626       png_ptr->chunk_list = NULL;
627       png_ptr->num_chunk_list = 0;
628    }
629 #endif
630 
631    png_info_init_3(&info_ptr, png_sizeof(png_info));
632 }
633 #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
634 
635 /* This function returns a pointer to the io_ptr associated with the user
636  * functions.  The application should free any memory associated with this
637  * pointer before png_write_destroy() or png_read_destroy() are called.
638  */
639 png_voidp PNGAPI
png_get_io_ptr(png_structp png_ptr)640 png_get_io_ptr(png_structp png_ptr)
641 {
642    if (png_ptr == NULL)
643       return (NULL);
644    return (png_ptr->io_ptr);
645 }
646 
647 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
648 #ifdef PNG_STDIO_SUPPORTED
649 /* Initialize the default input/output functions for the PNG file.  If you
650  * use your own read or write routines, you can call either png_set_read_fn()
651  * or png_set_write_fn() instead of png_init_io().  If you have defined
652  * PNG_NO_STDIO, you must use a function of your own because "FILE *" isn't
653  * necessarily available.
654  */
655 void PNGAPI
png_init_io(png_structp png_ptr,png_FILE_p fp)656 png_init_io(png_structp png_ptr, png_FILE_p fp)
657 {
658    png_debug(1, "in png_init_io");
659 
660    if (png_ptr == NULL)
661       return;
662 
663    png_ptr->io_ptr = (png_voidp)fp;
664 }
665 #endif
666 
667 #ifdef PNG_TIME_RFC1123_SUPPORTED
668 /* Convert the supplied time into an RFC 1123 string suitable for use in
669  * a "Creation Time" or other text-based time string.
670  */
671 png_charp PNGAPI
png_convert_to_rfc1123(png_structp png_ptr,png_timep ptime)672 png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime)
673 {
674    static PNG_CONST char short_months[12][4] =
675         {"Jan", "Feb", "Mar", "Apr", "May", "Jun",
676          "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
677 
678    if (png_ptr == NULL)
679       return (NULL);
680    if (png_ptr->time_buffer == NULL)
681    {
682       png_ptr->time_buffer = (png_charp)png_malloc(png_ptr, (png_uint_32)(29*
683          png_sizeof(char)));
684    }
685 
686 #ifdef _WIN32_WCE
687    {
688       wchar_t time_buf[29];
689       wsprintf(time_buf, TEXT("%d %S %d %02d:%02d:%02d +0000"),
690           ptime->day % 32, short_months[(ptime->month - 1) % 12],
691         ptime->year, ptime->hour % 24, ptime->minute % 60,
692           ptime->second % 61);
693       WideCharToMultiByte(CP_ACP, 0, time_buf, -1, png_ptr->time_buffer,
694           29, NULL, NULL);
695    }
696 #else
697 #ifdef USE_FAR_KEYWORD
698    {
699       char near_time_buf[29];
700       png_snprintf6(near_time_buf, 29, "%d %s %d %02d:%02d:%02d +0000",
701           ptime->day % 32, short_months[(ptime->month - 1) % 12],
702           ptime->year, ptime->hour % 24, ptime->minute % 60,
703           ptime->second % 61);
704       png_memcpy(png_ptr->time_buffer, near_time_buf,
705           29*png_sizeof(char));
706    }
707 #else
708    png_snprintf6(png_ptr->time_buffer, 29, "%d %s %d %02d:%02d:%02d +0000",
709        ptime->day % 32, short_months[(ptime->month - 1) % 12],
710        ptime->year, ptime->hour % 24, ptime->minute % 60,
711        ptime->second % 61);
712 #endif
713 #endif /* _WIN32_WCE */
714    return ((png_charp)png_ptr->time_buffer);
715 }
716 #endif /* PNG_TIME_RFC1123_SUPPORTED */
717 
718 #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
719 
720 png_charp PNGAPI
png_get_copyright(png_structp png_ptr)721 png_get_copyright(png_structp png_ptr)
722 {
723    static char png_get_copyright_[] = PNG_STRING_NEWLINE \
724      "libpng version 1.2.50-MirOS - July 10, 2012" PNG_STRING_NEWLINE \
725      "Copyright (c) 2004-2013 The MirOS Project - http://mirbsd.de/" PNG_STRING_NEWLINE \
726      "Copyright (c) 1998-2011 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
727      "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
728      "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
729      PNG_STRING_NEWLINE;
730 
731    png_ptr = png_ptr;  /* Silence compiler warning about unused png_ptr */
732 
733    return ((png_charp)png_get_copyright_);
734 }
735 
736 /* The following return the library version as a short string in the
737  * format 1.0.0 through 99.99.99zz.  To get the version of *.h files
738  * used with your application, print out PNG_LIBPNG_VER_STRING, which
739  * is defined in png.h.
740  * Note: now there is no difference between png_get_libpng_ver() and
741  * png_get_header_ver().  Due to the version_nn_nn_nn typedef guard,
742  * it is guaranteed that png.c uses the correct version of png.h.
743  */
744 png_charp PNGAPI
png_get_libpng_ver(png_structp png_ptr)745 png_get_libpng_ver(png_structp png_ptr)
746 {
747    static char PNG_LIBPNG_VER_STRING_[] = PNG_LIBPNG_VER_STRING;
748 
749    /* Version of *.c files used when building libpng */
750    png_ptr = png_ptr;  /* Silence compiler warning about unused png_ptr */
751    return ((png_charp) PNG_LIBPNG_VER_STRING_);
752 }
753 
754 png_charp PNGAPI
png_get_header_ver(png_structp png_ptr)755 png_get_header_ver(png_structp png_ptr)
756 {
757    static char PNG_LIBPNG_VER_STRING_[] = PNG_LIBPNG_VER_STRING;
758 
759    /* Version of *.h files used when building libpng */
760    png_ptr = png_ptr;  /* Silence compiler warning about unused png_ptr */
761    return ((png_charp) PNG_LIBPNG_VER_STRING_);
762 }
763 
764 png_charp PNGAPI
png_get_header_version(png_structp png_ptr)765 png_get_header_version(png_structp png_ptr)
766 {
767    static char PNG_HEADER_VERSION_STRING_[] = PNG_HEADER_VERSION_STRING
768 #ifndef PNG_READ_SUPPORTED
769    "     (NO READ SUPPORT)"
770 #endif
771    PNG_STRING_NEWLINE;
772 
773    /* Returns longer string containing both version and date */
774    png_ptr = png_ptr;  /* Silence compiler warning about unused png_ptr */
775    return ((png_charp) PNG_HEADER_VERSION_STRING_);
776 }
777 
778 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
779 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
780 int PNGAPI
png_handle_as_unknown(png_structp png_ptr,png_bytep chunk_name)781 png_handle_as_unknown(png_structp png_ptr, png_bytep chunk_name)
782 {
783    /* Check chunk_name and return "keep" value if it's on the list, else 0 */
784    int i;
785    png_bytep p;
786    if (png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list<=0)
787       return 0;
788    p = png_ptr->chunk_list + png_ptr->num_chunk_list*5 - 5;
789    for (i = png_ptr->num_chunk_list; i; i--, p -= 5)
790       if (!png_memcmp(chunk_name, p, 4))
791         return ((int)*(p + 4));
792    return 0;
793 }
794 #endif
795 
796 /* This function, added to libpng-1.0.6g, is untested. */
797 int PNGAPI
png_reset_zstream(png_structp png_ptr)798 png_reset_zstream(png_structp png_ptr)
799 {
800    if (png_ptr == NULL)
801       return Z_STREAM_ERROR;
802    return (inflateReset(&png_ptr->zstream));
803 }
804 #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
805 
806 /* This function was added to libpng-1.0.7 */
807 png_uint_32 PNGAPI
png_access_version_number(void)808 png_access_version_number(void)
809 {
810    /* Version of *.c files used when building libpng */
811    return((png_uint_32) PNG_LIBPNG_VER);
812 }
813 
814 
815 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
816 #ifdef PNG_SIZE_T
817 /* Added at libpng version 1.2.6 */
818    PNG_EXTERN png_size_t PNGAPI png_convert_size PNGARG((size_t size));
819 png_size_t PNGAPI
png_convert_size(size_t size)820 png_convert_size(size_t size)
821 {
822    if (size > (png_size_t)-1)
823       PNG_ABORT();  /* We haven't got access to png_ptr, so no png_error() */
824    return ((png_size_t)size);
825 }
826 #endif /* PNG_SIZE_T */
827 
828 /* Added at libpng version 1.2.34 and 1.4.0 (moved from pngset.c) */
829 #ifdef PNG_cHRM_SUPPORTED
830 #ifdef PNG_CHECK_cHRM_SUPPORTED
831 
832 /*
833  *    Multiply two 32-bit numbers, V1 and V2, using 32-bit
834  *    arithmetic, to produce a 64 bit result in the HI/LO words.
835  *
836  *                  A B
837  *                x C D
838  *               ------
839  *              AD || BD
840  *        AC || CB || 0
841  *
842  *    where A and B are the high and low 16-bit words of V1,
843  *    C and D are the 16-bit words of V2, AD is the product of
844  *    A and D, and X || Y is (X << 16) + Y.
845 */
846 
847 void /* PRIVATE */
png_64bit_product(long v1,long v2,unsigned long * hi_product,unsigned long * lo_product)848 png_64bit_product (long v1, long v2, unsigned long *hi_product,
849    unsigned long *lo_product)
850 {
851    int a, b, c, d;
852    long lo, hi, x, y;
853 
854    a = (v1 >> 16) & 0xffff;
855    b = v1 & 0xffff;
856    c = (v2 >> 16) & 0xffff;
857    d = v2 & 0xffff;
858 
859    lo = b * d;                   /* BD */
860    x = a * d + c * b;            /* AD + CB */
861    y = ((lo >> 16) & 0xffff) + x;
862 
863    lo = (lo & 0xffff) | ((y & 0xffff) << 16);
864    hi = (y >> 16) & 0xffff;
865 
866    hi += a * c;                  /* AC */
867 
868    *hi_product = (unsigned long)hi;
869    *lo_product = (unsigned long)lo;
870 }
871 
872 int /* PRIVATE */
png_check_cHRM_fixed(png_structp png_ptr,png_fixed_point white_x,png_fixed_point white_y,png_fixed_point red_x,png_fixed_point red_y,png_fixed_point green_x,png_fixed_point green_y,png_fixed_point blue_x,png_fixed_point blue_y)873 png_check_cHRM_fixed(png_structp png_ptr,
874    png_fixed_point white_x, png_fixed_point white_y, png_fixed_point red_x,
875    png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y,
876    png_fixed_point blue_x, png_fixed_point blue_y)
877 {
878    int ret = 1;
879    unsigned long xy_hi,xy_lo,yx_hi,yx_lo;
880 
881    png_debug(1, "in function png_check_cHRM_fixed");
882 
883    if (png_ptr == NULL)
884       return 0;
885 
886    if (white_x < 0 || white_y <= 0 ||
887          red_x < 0 ||   red_y <  0 ||
888        green_x < 0 || green_y <  0 ||
889         blue_x < 0 ||  blue_y <  0)
890    {
891       png_warning(png_ptr,
892         "Ignoring attempt to set negative chromaticity value");
893       ret = 0;
894    }
895    if (white_x > (png_fixed_point) PNG_UINT_31_MAX ||
896        white_y > (png_fixed_point) PNG_UINT_31_MAX ||
897          red_x > (png_fixed_point) PNG_UINT_31_MAX ||
898          red_y > (png_fixed_point) PNG_UINT_31_MAX ||
899        green_x > (png_fixed_point) PNG_UINT_31_MAX ||
900        green_y > (png_fixed_point) PNG_UINT_31_MAX ||
901         blue_x > (png_fixed_point) PNG_UINT_31_MAX ||
902         blue_y > (png_fixed_point) PNG_UINT_31_MAX )
903    {
904       png_warning(png_ptr,
905         "Ignoring attempt to set chromaticity value exceeding 21474.83");
906       ret = 0;
907    }
908    if (white_x > 100000L - white_y)
909    {
910       png_warning(png_ptr, "Invalid cHRM white point");
911       ret = 0;
912    }
913    if (red_x > 100000L - red_y)
914    {
915       png_warning(png_ptr, "Invalid cHRM red point");
916       ret = 0;
917    }
918    if (green_x > 100000L - green_y)
919    {
920       png_warning(png_ptr, "Invalid cHRM green point");
921       ret = 0;
922    }
923    if (blue_x > 100000L - blue_y)
924    {
925       png_warning(png_ptr, "Invalid cHRM blue point");
926       ret = 0;
927    }
928 
929    png_64bit_product(green_x - red_x, blue_y - red_y, &xy_hi, &xy_lo);
930    png_64bit_product(green_y - red_y, blue_x - red_x, &yx_hi, &yx_lo);
931 
932    if (xy_hi == yx_hi && xy_lo == yx_lo)
933    {
934       png_warning(png_ptr,
935          "Ignoring attempt to set cHRM RGB triangle with zero area");
936       ret = 0;
937    }
938 
939    return ret;
940 }
941 #endif /* PNG_CHECK_cHRM_SUPPORTED */
942 #endif /* PNG_cHRM_SUPPORTED */
943 
944 void /* PRIVATE */
png_check_IHDR(png_structp png_ptr,png_uint_32 width,png_uint_32 height,int bit_depth,int color_type,int interlace_type,int compression_type,int filter_type)945 png_check_IHDR(png_structp png_ptr,
946    png_uint_32 width, png_uint_32 height, int bit_depth,
947    int color_type, int interlace_type, int compression_type,
948    int filter_type)
949 {
950    int error = 0;
951 
952    /* Check for width and height valid values */
953    if (width == 0)
954    {
955       png_warning(png_ptr, "Image width is zero in IHDR");
956       error = 1;
957    }
958 
959    if (height == 0)
960    {
961       png_warning(png_ptr, "Image height is zero in IHDR");
962       error = 1;
963    }
964 
965 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
966    if (width > png_ptr->user_width_max || width > PNG_USER_WIDTH_MAX)
967 #else
968    if (width > PNG_USER_WIDTH_MAX)
969 #endif
970    {
971       png_warning(png_ptr, "Image width exceeds user limit in IHDR");
972       error = 1;
973    }
974 
975 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
976    if (height > png_ptr->user_height_max || height > PNG_USER_HEIGHT_MAX)
977 #else
978    if (height > PNG_USER_HEIGHT_MAX)
979 #endif
980    {
981       png_warning(png_ptr, "Image height exceeds user limit in IHDR");
982       error = 1;
983    }
984 
985    if (width > PNG_UINT_31_MAX)
986    {
987       png_warning(png_ptr, "Invalid image width in IHDR");
988       error = 1;
989    }
990 
991    if ( height > PNG_UINT_31_MAX)
992    {
993       png_warning(png_ptr, "Invalid image height in IHDR");
994       error = 1;
995    }
996 
997    if ( width > (PNG_UINT_32_MAX
998                  >> 3)      /* 8-byte RGBA pixels */
999                  - 64       /* bigrowbuf hack */
1000                  - 1        /* filter byte */
1001                  - 7*8      /* rounding of width to multiple of 8 pixels */
1002                  - 8)       /* extra max_pixel_depth pad */
1003       png_warning(png_ptr, "Width is too large for libpng to process pixels");
1004 
1005    /* Check other values */
1006    if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 &&
1007        bit_depth != 8 && bit_depth != 16)
1008    {
1009       png_warning(png_ptr, "Invalid bit depth in IHDR");
1010       error = 1;
1011    }
1012 
1013    if (color_type < 0 || color_type == 1 ||
1014        color_type == 5 || color_type > 6)
1015    {
1016       png_warning(png_ptr, "Invalid color type in IHDR");
1017       error = 1;
1018    }
1019 
1020    if (((color_type == PNG_COLOR_TYPE_PALETTE) && bit_depth > 8) ||
1021        ((color_type == PNG_COLOR_TYPE_RGB ||
1022          color_type == PNG_COLOR_TYPE_GRAY_ALPHA ||
1023          color_type == PNG_COLOR_TYPE_RGB_ALPHA) && bit_depth < 8))
1024    {
1025       png_warning(png_ptr, "Invalid color type/bit depth combination in IHDR");
1026       error = 1;
1027    }
1028 
1029    if (interlace_type >= PNG_INTERLACE_LAST)
1030    {
1031       png_warning(png_ptr, "Unknown interlace method in IHDR");
1032       error = 1;
1033    }
1034 
1035    if (compression_type != PNG_COMPRESSION_TYPE_BASE)
1036    {
1037       png_warning(png_ptr, "Unknown compression method in IHDR");
1038       error = 1;
1039    }
1040 
1041 #ifdef PNG_MNG_FEATURES_SUPPORTED
1042    /* Accept filter_method 64 (intrapixel differencing) only if
1043     * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
1044     * 2. Libpng did not read a PNG signature (this filter_method is only
1045     *    used in PNG datastreams that are embedded in MNG datastreams) and
1046     * 3. The application called png_permit_mng_features with a mask that
1047     *    included PNG_FLAG_MNG_FILTER_64 and
1048     * 4. The filter_method is 64 and
1049     * 5. The color_type is RGB or RGBA
1050     */
1051    if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) &&
1052        png_ptr->mng_features_permitted)
1053       png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
1054 
1055    if (filter_type != PNG_FILTER_TYPE_BASE)
1056    {
1057       if (!((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
1058          (filter_type == PNG_INTRAPIXEL_DIFFERENCING) &&
1059          ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) == 0) &&
1060          (color_type == PNG_COLOR_TYPE_RGB ||
1061          color_type == PNG_COLOR_TYPE_RGB_ALPHA)))
1062       {
1063          png_warning(png_ptr, "Unknown filter method in IHDR");
1064          error = 1;
1065       }
1066 
1067       if (png_ptr->mode & PNG_HAVE_PNG_SIGNATURE)
1068       {
1069          png_warning(png_ptr, "Invalid filter method in IHDR");
1070          error = 1;
1071       }
1072    }
1073 
1074 #else
1075    if (filter_type != PNG_FILTER_TYPE_BASE)
1076    {
1077       png_warning(png_ptr, "Unknown filter method in IHDR");
1078       error = 1;
1079    }
1080 #endif
1081 
1082    if (error == 1)
1083       png_error(png_ptr, "Invalid IHDR data");
1084 }
1085 #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
1086