Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(58)

Side by Side Diff: third_party/libpng/pngpread.c

Issue 1591483003: XFA: Upgrade libpng to 1.6.20. (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@xfa
Patch Set: rebase Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « third_party/libpng/pngmem.c ('k') | third_party/libpng/pngpriv.h » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1
1 /* pngpread.c - read a png file in push mode 2 /* pngpread.c - read a png file in push mode
2 * 3 *
3 * Last changed in libpng 1.6.0 [February 14, 2013] 4 * Last changed in libpng 1.6.18 [July 23, 2015]
4 * Copyright (c) 1998-2013 Glenn Randers-Pehrson 5 * Copyright (c) 1998-2015 Glenn Randers-Pehrson
5 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) 6 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
6 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) 7 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
7 * 8 *
8 * This code is released under the libpng license. 9 * This code is released under the libpng license.
9 * For conditions of distribution and use, see the disclaimer 10 * For conditions of distribution and use, see the disclaimer
10 * and license in png.h 11 * and license in png.h
11 */ 12 */
12 13
13 #include "pngpriv.h" 14 #include "pngpriv.h"
14 15
15 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED 16 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
16 17
17 /* Push model modes */ 18 /* Push model modes */
18 #define PNG_READ_SIG_MODE 0 19 #define PNG_READ_SIG_MODE 0
19 #define PNG_READ_CHUNK_MODE 1 20 #define PNG_READ_CHUNK_MODE 1
20 #define PNG_READ_IDAT_MODE 2 21 #define PNG_READ_IDAT_MODE 2
21 #define PNG_SKIP_MODE 3
22 #define PNG_READ_tEXt_MODE 4 22 #define PNG_READ_tEXt_MODE 4
23 #define PNG_READ_zTXt_MODE 5 23 #define PNG_READ_zTXt_MODE 5
24 #define PNG_READ_DONE_MODE 6 24 #define PNG_READ_DONE_MODE 6
25 #define PNG_READ_iTXt_MODE 7 25 #define PNG_READ_iTXt_MODE 7
26 #define PNG_ERROR_MODE 8 26 #define PNG_ERROR_MODE 8
27 27
28 #define PNG_PUSH_SAVE_BUFFER_IF_FULL \
29 if (png_ptr->push_length + 4 > png_ptr->buffer_size) \
30 { png_push_save_buffer(png_ptr); return; }
31 #define PNG_PUSH_SAVE_BUFFER_IF_LT(N) \
32 if (png_ptr->buffer_size < N) \
33 { png_push_save_buffer(png_ptr); return; }
34
28 void PNGAPI 35 void PNGAPI
29 png_process_data(png_structrp png_ptr, png_inforp info_ptr, 36 png_process_data(png_structrp png_ptr, png_inforp info_ptr,
30 png_bytep buffer, png_size_t buffer_size) 37 png_bytep buffer, png_size_t buffer_size)
31 { 38 {
32 if (png_ptr == NULL || info_ptr == NULL) 39 if (png_ptr == NULL || info_ptr == NULL)
33 return; 40 return;
34 41
35 png_push_restore_buffer(png_ptr, buffer, buffer_size); 42 png_push_restore_buffer(png_ptr, buffer, buffer_size);
36 43
37 while (png_ptr->buffer_size) 44 while (png_ptr->buffer_size)
38 { 45 {
39 png_process_some_data(png_ptr, info_ptr); 46 png_process_some_data(png_ptr, info_ptr);
40 } 47 }
41 } 48 }
42 49
43 png_size_t PNGAPI 50 png_size_t PNGAPI
44 png_process_data_pause(png_structrp png_ptr, int save) 51 png_process_data_pause(png_structrp png_ptr, int save)
45 { 52 {
46 if (png_ptr != NULL) 53 if (png_ptr != NULL)
47 { 54 {
48 /* It's easiest for the caller if we do the save, then the caller doesn't 55 /* It's easiest for the caller if we do the save; then the caller doesn't
49 * have to supply the same data again: 56 * have to supply the same data again:
50 */ 57 */
51 if (save) 58 if (save != 0)
52 png_push_save_buffer(png_ptr); 59 png_push_save_buffer(png_ptr);
53 else 60 else
54 { 61 {
55 /* This includes any pending saved bytes: */ 62 /* This includes any pending saved bytes: */
56 png_size_t remaining = png_ptr->buffer_size; 63 png_size_t remaining = png_ptr->buffer_size;
57 png_ptr->buffer_size = 0; 64 png_ptr->buffer_size = 0;
58 65
59 /* So subtract the saved buffer size, unless all the data 66 /* So subtract the saved buffer size, unless all the data
60 * is actually 'saved', in which case we just return 0 67 * is actually 'saved', in which case we just return 0
61 */ 68 */
62 if (png_ptr->save_buffer_size < remaining) 69 if (png_ptr->save_buffer_size < remaining)
63 return remaining - png_ptr->save_buffer_size; 70 return remaining - png_ptr->save_buffer_size;
64 } 71 }
65 } 72 }
66 73
67 return 0; 74 return 0;
68 } 75 }
69 76
70 png_uint_32 PNGAPI 77 png_uint_32 PNGAPI
71 png_process_data_skip(png_structrp png_ptr) 78 png_process_data_skip(png_structrp png_ptr)
72 { 79 {
73 png_uint_32 remaining = 0; 80 /* TODO: Deprecate and remove this API.
74 81 * Somewhere the implementation of this seems to have been lost,
75 if (png_ptr != NULL && png_ptr->process_mode == PNG_SKIP_MODE && 82 * or abandoned. It was only to support some internal back-door access
76 png_ptr->skip_length > 0) 83 * to png_struct) in libpng-1.4.x.
77 { 84 */
78 /* At the end of png_process_data the buffer size must be 0 (see the loop 85 png_app_warning(png_ptr,
79 * above) so we can detect a broken call here: 86 "png_process_data_skip is not implemented in any current version of libpng");
80 */ 87 return 0;
81 if (png_ptr->buffer_size != 0)
82 png_error(png_ptr,
83 "png_process_data_skip called inside png_process_data");
84
85 /* If is impossible for there to be a saved buffer at this point -
86 * otherwise we could not be in SKIP mode. This will also happen if
87 * png_process_skip is called inside png_process_data (but only very
88 * rarely.)
89 */
90 if (png_ptr->save_buffer_size != 0)
91 png_error(png_ptr, "png_process_data_skip called with saved data");
92
93 remaining = png_ptr->skip_length;
94 png_ptr->skip_length = 0;
95 png_ptr->process_mode = PNG_READ_CHUNK_MODE;
96 }
97
98 return remaining;
99 } 88 }
100 89
101 /* What we do with the incoming data depends on what we were previously 90 /* What we do with the incoming data depends on what we were previously
102 * doing before we ran out of data... 91 * doing before we ran out of data...
103 */ 92 */
104 void /* PRIVATE */ 93 void /* PRIVATE */
105 png_process_some_data(png_structrp png_ptr, png_inforp info_ptr) 94 png_process_some_data(png_structrp png_ptr, png_inforp info_ptr)
106 { 95 {
107 if (png_ptr == NULL) 96 if (png_ptr == NULL)
108 return; 97 return;
(...skipping 11 matching lines...) Expand all
120 png_push_read_chunk(png_ptr, info_ptr); 109 png_push_read_chunk(png_ptr, info_ptr);
121 break; 110 break;
122 } 111 }
123 112
124 case PNG_READ_IDAT_MODE: 113 case PNG_READ_IDAT_MODE:
125 { 114 {
126 png_push_read_IDAT(png_ptr); 115 png_push_read_IDAT(png_ptr);
127 break; 116 break;
128 } 117 }
129 118
130 case PNG_SKIP_MODE:
131 {
132 png_push_crc_finish(png_ptr);
133 break;
134 }
135
136 default: 119 default:
137 { 120 {
138 png_ptr->buffer_size = 0; 121 png_ptr->buffer_size = 0;
139 break; 122 break;
140 } 123 }
141 } 124 }
142 } 125 }
143 126
144 /* Read any remaining signature bytes from the stream and compare them with 127 /* Read any remaining signature bytes from the stream and compare them with
145 * the correct PNG signature. It is possible that this routine is called 128 * the correct PNG signature. It is possible that this routine is called
146 * with bytes already read from the signature, either because they have been 129 * with bytes already read from the signature, either because they have been
147 * checked by the calling application, or because of multiple calls to this 130 * checked by the calling application, or because of multiple calls to this
148 * routine. 131 * routine.
149 */ 132 */
150 void /* PRIVATE */ 133 void /* PRIVATE */
151 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr) 134 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr)
152 { 135 {
153 png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ 136 png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */
154 num_to_check = 8 - num_checked; 137 num_to_check = 8 - num_checked;
155 138
156 if (png_ptr->buffer_size < num_to_check) 139 if (png_ptr->buffer_size < num_to_check)
157 { 140 {
158 num_to_check = png_ptr->buffer_size; 141 num_to_check = png_ptr->buffer_size;
159 } 142 }
160 143
161 png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]), 144 png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]),
162 num_to_check); 145 num_to_check);
163 png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check); 146 png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check);
164 147
(...skipping 16 matching lines...) Expand all
181 } 164 }
182 165
183 void /* PRIVATE */ 166 void /* PRIVATE */
184 png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr) 167 png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr)
185 { 168 {
186 png_uint_32 chunk_name; 169 png_uint_32 chunk_name;
187 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED 170 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
188 int keep; /* unknown handling method */ 171 int keep; /* unknown handling method */
189 #endif 172 #endif
190 173
191 /* First we make sure we have enough data for the 4 byte chunk name 174 /* First we make sure we have enough data for the 4-byte chunk name
192 * and the 4 byte chunk length before proceeding with decoding the 175 * and the 4-byte chunk length before proceeding with decoding the
193 * chunk data. To fully decode each of these chunks, we also make 176 * chunk data. To fully decode each of these chunks, we also make
194 * sure we have enough data in the buffer for the 4 byte CRC at the 177 * sure we have enough data in the buffer for the 4-byte CRC at the
195 * end of every chunk (except IDAT, which is handled separately). 178 * end of every chunk (except IDAT, which is handled separately).
196 */ 179 */
197 if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER)) 180 if ((png_ptr->mode & PNG_HAVE_CHUNK_HEADER) == 0)
198 { 181 {
199 png_byte chunk_length[4]; 182 png_byte chunk_length[4];
200 png_byte chunk_tag[4]; 183 png_byte chunk_tag[4];
201 184
202 if (png_ptr->buffer_size < 8) 185 PNG_PUSH_SAVE_BUFFER_IF_LT(8)
203 {
204 png_push_save_buffer(png_ptr);
205 return;
206 }
207
208 png_push_fill_buffer(png_ptr, chunk_length, 4); 186 png_push_fill_buffer(png_ptr, chunk_length, 4);
209 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); 187 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
210 png_reset_crc(png_ptr); 188 png_reset_crc(png_ptr);
211 png_crc_read(png_ptr, chunk_tag, 4); 189 png_crc_read(png_ptr, chunk_tag, 4);
212 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); 190 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag);
213 png_check_chunk_name(png_ptr, png_ptr->chunk_name); 191 png_check_chunk_name(png_ptr, png_ptr->chunk_name);
214 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; 192 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
215 } 193 }
216 194
217 chunk_name = png_ptr->chunk_name; 195 chunk_name = png_ptr->chunk_name;
218 196
219 if (chunk_name == png_IDAT) 197 if (chunk_name == png_IDAT)
220 { 198 {
221 if (png_ptr->mode & PNG_AFTER_IDAT) 199 if ((png_ptr->mode & PNG_AFTER_IDAT) != 0)
222 png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT; 200 png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
223 201
224 /* If we reach an IDAT chunk, this means we have read all of the 202 /* If we reach an IDAT chunk, this means we have read all of the
225 * header chunks, and we can start reading the image (or if this 203 * header chunks, and we can start reading the image (or if this
226 * is called after the image has been read - we have an error). 204 * is called after the image has been read - we have an error).
227 */ 205 */
228 if (!(png_ptr->mode & PNG_HAVE_IHDR)) 206 if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
229 png_error(png_ptr, "Missing IHDR before IDAT"); 207 png_error(png_ptr, "Missing IHDR before IDAT");
230 208
231 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE && 209 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
232 !(png_ptr->mode & PNG_HAVE_PLTE)) 210 (png_ptr->mode & PNG_HAVE_PLTE) == 0)
233 png_error(png_ptr, "Missing PLTE before IDAT"); 211 png_error(png_ptr, "Missing PLTE before IDAT");
234 212
235 png_ptr->mode |= PNG_HAVE_IDAT; 213 png_ptr->mode |= PNG_HAVE_IDAT;
236 214 png_ptr->process_mode = PNG_READ_IDAT_MODE;
237 if (!(png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT)) 215
216 if ((png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) == 0)
238 if (png_ptr->push_length == 0) 217 if (png_ptr->push_length == 0)
239 return; 218 return;
240 219
241 if (png_ptr->mode & PNG_AFTER_IDAT) 220 if ((png_ptr->mode & PNG_AFTER_IDAT) != 0)
242 png_benign_error(png_ptr, "Too many IDATs found"); 221 png_benign_error(png_ptr, "Too many IDATs found");
243 } 222 }
244 223
245 if (chunk_name == png_IHDR) 224 if (chunk_name == png_IHDR)
246 { 225 {
247 if (png_ptr->push_length != 13) 226 if (png_ptr->push_length != 13)
248 png_error(png_ptr, "Invalid IHDR length"); 227 png_error(png_ptr, "Invalid IHDR length");
249 228
250 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 229 PNG_PUSH_SAVE_BUFFER_IF_FULL
251 {
252 png_push_save_buffer(png_ptr);
253 return;
254 }
255
256 png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length); 230 png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length);
257 } 231 }
258 232
259 else if (chunk_name == png_IEND) 233 else if (chunk_name == png_IEND)
260 { 234 {
261 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 235 PNG_PUSH_SAVE_BUFFER_IF_FULL
262 {
263 png_push_save_buffer(png_ptr);
264 return;
265 }
266
267 png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length); 236 png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length);
268 237
269 png_ptr->process_mode = PNG_READ_DONE_MODE; 238 png_ptr->process_mode = PNG_READ_DONE_MODE;
270 png_push_have_end(png_ptr, info_ptr); 239 png_push_have_end(png_ptr, info_ptr);
271 } 240 }
272 241
273 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED 242 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
274 else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0) 243 else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0)
275 { 244 {
276 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 245 PNG_PUSH_SAVE_BUFFER_IF_FULL
277 {
278 png_push_save_buffer(png_ptr);
279 return;
280 }
281
282 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, keep); 246 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, keep);
283 247
284 if (chunk_name == png_PLTE) 248 if (chunk_name == png_PLTE)
285 png_ptr->mode |= PNG_HAVE_PLTE; 249 png_ptr->mode |= PNG_HAVE_PLTE;
286 } 250 }
287 251 #endif
288 #endif 252
289 else if (chunk_name == png_PLTE) 253 else if (chunk_name == png_PLTE)
290 { 254 {
291 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 255 PNG_PUSH_SAVE_BUFFER_IF_FULL
292 {
293 png_push_save_buffer(png_ptr);
294 return;
295 }
296 png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length); 256 png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length);
297 } 257 }
298 258
299 else if (chunk_name == png_IDAT) 259 else if (chunk_name == png_IDAT)
300 { 260 {
301 png_ptr->idat_size = png_ptr->push_length; 261 png_ptr->idat_size = png_ptr->push_length;
302 png_ptr->process_mode = PNG_READ_IDAT_MODE; 262 png_ptr->process_mode = PNG_READ_IDAT_MODE;
303 png_push_have_info(png_ptr, info_ptr); 263 png_push_have_info(png_ptr, info_ptr);
304 png_ptr->zstream.avail_out = 264 png_ptr->zstream.avail_out =
305 (uInt) PNG_ROWBYTES(png_ptr->pixel_depth, 265 (uInt) PNG_ROWBYTES(png_ptr->pixel_depth,
306 png_ptr->iwidth) + 1; 266 png_ptr->iwidth) + 1;
307 png_ptr->zstream.next_out = png_ptr->row_buf; 267 png_ptr->zstream.next_out = png_ptr->row_buf;
308 return; 268 return;
309 } 269 }
310 270
311 #ifdef PNG_READ_gAMA_SUPPORTED 271 #ifdef PNG_READ_gAMA_SUPPORTED
312 else if (png_ptr->chunk_name == png_gAMA) 272 else if (png_ptr->chunk_name == png_gAMA)
313 { 273 {
314 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 274 PNG_PUSH_SAVE_BUFFER_IF_FULL
315 {
316 png_push_save_buffer(png_ptr);
317 return;
318 }
319
320 png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length); 275 png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length);
321 } 276 }
322 277
323 #endif 278 #endif
324 #ifdef PNG_READ_sBIT_SUPPORTED 279 #ifdef PNG_READ_sBIT_SUPPORTED
325 else if (png_ptr->chunk_name == png_sBIT) 280 else if (png_ptr->chunk_name == png_sBIT)
326 { 281 {
327 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 282 PNG_PUSH_SAVE_BUFFER_IF_FULL
328 {
329 png_push_save_buffer(png_ptr);
330 return;
331 }
332
333 png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length); 283 png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length);
334 } 284 }
335 285
336 #endif 286 #endif
337 #ifdef PNG_READ_cHRM_SUPPORTED 287 #ifdef PNG_READ_cHRM_SUPPORTED
338 else if (png_ptr->chunk_name == png_cHRM) 288 else if (png_ptr->chunk_name == png_cHRM)
339 { 289 {
340 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 290 PNG_PUSH_SAVE_BUFFER_IF_FULL
341 {
342 png_push_save_buffer(png_ptr);
343 return;
344 }
345
346 png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length); 291 png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length);
347 } 292 }
348 293
349 #endif 294 #endif
350 #ifdef PNG_READ_sRGB_SUPPORTED 295 #ifdef PNG_READ_sRGB_SUPPORTED
351 else if (chunk_name == png_sRGB) 296 else if (chunk_name == png_sRGB)
352 { 297 {
353 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 298 PNG_PUSH_SAVE_BUFFER_IF_FULL
354 {
355 png_push_save_buffer(png_ptr);
356 return;
357 }
358
359 png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length); 299 png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length);
360 } 300 }
361 301
362 #endif 302 #endif
363 #ifdef PNG_READ_iCCP_SUPPORTED 303 #ifdef PNG_READ_iCCP_SUPPORTED
364 else if (png_ptr->chunk_name == png_iCCP) 304 else if (png_ptr->chunk_name == png_iCCP)
365 { 305 {
366 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 306 PNG_PUSH_SAVE_BUFFER_IF_FULL
367 {
368 png_push_save_buffer(png_ptr);
369 return;
370 }
371
372 png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length); 307 png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length);
373 } 308 }
374 309
375 #endif 310 #endif
376 #ifdef PNG_READ_sPLT_SUPPORTED 311 #ifdef PNG_READ_sPLT_SUPPORTED
377 else if (chunk_name == png_sPLT) 312 else if (chunk_name == png_sPLT)
378 { 313 {
379 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 314 PNG_PUSH_SAVE_BUFFER_IF_FULL
380 {
381 png_push_save_buffer(png_ptr);
382 return;
383 }
384
385 png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length); 315 png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length);
386 } 316 }
387 317
388 #endif 318 #endif
389 #ifdef PNG_READ_tRNS_SUPPORTED 319 #ifdef PNG_READ_tRNS_SUPPORTED
390 else if (chunk_name == png_tRNS) 320 else if (chunk_name == png_tRNS)
391 { 321 {
392 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 322 PNG_PUSH_SAVE_BUFFER_IF_FULL
393 {
394 png_push_save_buffer(png_ptr);
395 return;
396 }
397
398 png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length); 323 png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length);
399 } 324 }
400 325
401 #endif 326 #endif
402 #ifdef PNG_READ_bKGD_SUPPORTED 327 #ifdef PNG_READ_bKGD_SUPPORTED
403 else if (chunk_name == png_bKGD) 328 else if (chunk_name == png_bKGD)
404 { 329 {
405 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 330 PNG_PUSH_SAVE_BUFFER_IF_FULL
406 {
407 png_push_save_buffer(png_ptr);
408 return;
409 }
410
411 png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length); 331 png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length);
412 } 332 }
413 333
414 #endif 334 #endif
415 #ifdef PNG_READ_hIST_SUPPORTED 335 #ifdef PNG_READ_hIST_SUPPORTED
416 else if (chunk_name == png_hIST) 336 else if (chunk_name == png_hIST)
417 { 337 {
418 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 338 PNG_PUSH_SAVE_BUFFER_IF_FULL
419 {
420 png_push_save_buffer(png_ptr);
421 return;
422 }
423
424 png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length); 339 png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length);
425 } 340 }
426 341
427 #endif 342 #endif
428 #ifdef PNG_READ_pHYs_SUPPORTED 343 #ifdef PNG_READ_pHYs_SUPPORTED
429 else if (chunk_name == png_pHYs) 344 else if (chunk_name == png_pHYs)
430 { 345 {
431 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 346 PNG_PUSH_SAVE_BUFFER_IF_FULL
432 {
433 png_push_save_buffer(png_ptr);
434 return;
435 }
436
437 png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length); 347 png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length);
438 } 348 }
439 349
440 #endif 350 #endif
441 #ifdef PNG_READ_oFFs_SUPPORTED 351 #ifdef PNG_READ_oFFs_SUPPORTED
442 else if (chunk_name == png_oFFs) 352 else if (chunk_name == png_oFFs)
443 { 353 {
444 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 354 PNG_PUSH_SAVE_BUFFER_IF_FULL
445 {
446 png_push_save_buffer(png_ptr);
447 return;
448 }
449
450 png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length); 355 png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length);
451 } 356 }
452 #endif 357 #endif
453 358
454 #ifdef PNG_READ_pCAL_SUPPORTED 359 #ifdef PNG_READ_pCAL_SUPPORTED
455 else if (chunk_name == png_pCAL) 360 else if (chunk_name == png_pCAL)
456 { 361 {
457 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 362 PNG_PUSH_SAVE_BUFFER_IF_FULL
458 {
459 png_push_save_buffer(png_ptr);
460 return;
461 }
462
463 png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length); 363 png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length);
464 } 364 }
465 365
466 #endif 366 #endif
467 #ifdef PNG_READ_sCAL_SUPPORTED 367 #ifdef PNG_READ_sCAL_SUPPORTED
468 else if (chunk_name == png_sCAL) 368 else if (chunk_name == png_sCAL)
469 { 369 {
470 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 370 PNG_PUSH_SAVE_BUFFER_IF_FULL
471 {
472 png_push_save_buffer(png_ptr);
473 return;
474 }
475
476 png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length); 371 png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length);
477 } 372 }
478 373
479 #endif 374 #endif
480 #ifdef PNG_READ_tIME_SUPPORTED 375 #ifdef PNG_READ_tIME_SUPPORTED
481 else if (chunk_name == png_tIME) 376 else if (chunk_name == png_tIME)
482 { 377 {
483 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 378 PNG_PUSH_SAVE_BUFFER_IF_FULL
484 {
485 png_push_save_buffer(png_ptr);
486 return;
487 }
488
489 png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length); 379 png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length);
490 } 380 }
491 381
492 #endif 382 #endif
493 #ifdef PNG_READ_tEXt_SUPPORTED 383 #ifdef PNG_READ_tEXt_SUPPORTED
494 else if (chunk_name == png_tEXt) 384 else if (chunk_name == png_tEXt)
495 { 385 {
496 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 386 PNG_PUSH_SAVE_BUFFER_IF_FULL
497 {
498 png_push_save_buffer(png_ptr);
499 return;
500 }
501
502 png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length); 387 png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
503 } 388 }
504 389
505 #endif 390 #endif
506 #ifdef PNG_READ_zTXt_SUPPORTED 391 #ifdef PNG_READ_zTXt_SUPPORTED
507 else if (chunk_name == png_zTXt) 392 else if (chunk_name == png_zTXt)
508 { 393 {
509 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 394 PNG_PUSH_SAVE_BUFFER_IF_FULL
510 {
511 png_push_save_buffer(png_ptr);
512 return;
513 }
514
515 png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length); 395 png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
516 } 396 }
517 397
518 #endif 398 #endif
519 #ifdef PNG_READ_iTXt_SUPPORTED 399 #ifdef PNG_READ_iTXt_SUPPORTED
520 else if (chunk_name == png_iTXt) 400 else if (chunk_name == png_iTXt)
521 { 401 {
522 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 402 PNG_PUSH_SAVE_BUFFER_IF_FULL
523 {
524 png_push_save_buffer(png_ptr);
525 return;
526 }
527
528 png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length); 403 png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
529 } 404 }
530 405 #endif
531 #endif 406
532 else 407 else
533 { 408 {
534 if (png_ptr->push_length + 4 > png_ptr->buffer_size) 409 PNG_PUSH_SAVE_BUFFER_IF_FULL
535 {
536 png_push_save_buffer(png_ptr);
537 return;
538 }
539 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, 410 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length,
540 PNG_HANDLE_CHUNK_AS_DEFAULT); 411 PNG_HANDLE_CHUNK_AS_DEFAULT);
541 } 412 }
542 413
543 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; 414 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
544 } 415 }
545 416
546 void /* PRIVATE */
547 png_push_crc_skip(png_structrp png_ptr, png_uint_32 skip)
548 {
549 png_ptr->process_mode = PNG_SKIP_MODE;
550 png_ptr->skip_length = skip;
551 }
552
553 void /* PRIVATE */
554 png_push_crc_finish(png_structrp png_ptr)
555 {
556 if (png_ptr->skip_length && png_ptr->save_buffer_size)
557 {
558 png_size_t save_size = png_ptr->save_buffer_size;
559 png_uint_32 skip_length = png_ptr->skip_length;
560
561 /* We want the smaller of 'skip_length' and 'save_buffer_size', but
562 * they are of different types and we don't know which variable has the
563 * fewest bits. Carefully select the smaller and cast it to the type of
564 * the larger - this cannot overflow. Do not cast in the following test
565 * - it will break on either 16 or 64 bit platforms.
566 */
567 if (skip_length < save_size)
568 save_size = (png_size_t)skip_length;
569
570 else
571 skip_length = (png_uint_32)save_size;
572
573 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
574
575 png_ptr->skip_length -= skip_length;
576 png_ptr->buffer_size -= save_size;
577 png_ptr->save_buffer_size -= save_size;
578 png_ptr->save_buffer_ptr += save_size;
579 }
580 if (png_ptr->skip_length && png_ptr->current_buffer_size)
581 {
582 png_size_t save_size = png_ptr->current_buffer_size;
583 png_uint_32 skip_length = png_ptr->skip_length;
584
585 /* We want the smaller of 'skip_length' and 'current_buffer_size', here,
586 * the same problem exists as above and the same solution.
587 */
588 if (skip_length < save_size)
589 save_size = (png_size_t)skip_length;
590
591 else
592 skip_length = (png_uint_32)save_size;
593
594 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
595
596 png_ptr->skip_length -= skip_length;
597 png_ptr->buffer_size -= save_size;
598 png_ptr->current_buffer_size -= save_size;
599 png_ptr->current_buffer_ptr += save_size;
600 }
601 if (!png_ptr->skip_length)
602 {
603 if (png_ptr->buffer_size < 4)
604 {
605 png_push_save_buffer(png_ptr);
606 return;
607 }
608
609 png_crc_finish(png_ptr, 0);
610 png_ptr->process_mode = PNG_READ_CHUNK_MODE;
611 }
612 }
613
614 void PNGCBAPI 417 void PNGCBAPI
615 png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length) 418 png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
616 { 419 {
617 png_bytep ptr; 420 png_bytep ptr;
618 421
619 if (png_ptr == NULL) 422 if (png_ptr == NULL)
620 return; 423 return;
621 424
622 ptr = buffer; 425 ptr = buffer;
623 if (png_ptr->save_buffer_size) 426 if (png_ptr->save_buffer_size != 0)
624 { 427 {
625 png_size_t save_size; 428 png_size_t save_size;
626 429
627 if (length < png_ptr->save_buffer_size) 430 if (length < png_ptr->save_buffer_size)
628 save_size = length; 431 save_size = length;
629 432
630 else 433 else
631 save_size = png_ptr->save_buffer_size; 434 save_size = png_ptr->save_buffer_size;
632 435
633 memcpy(ptr, png_ptr->save_buffer_ptr, save_size); 436 memcpy(ptr, png_ptr->save_buffer_ptr, save_size);
634 length -= save_size; 437 length -= save_size;
635 ptr += save_size; 438 ptr += save_size;
636 png_ptr->buffer_size -= save_size; 439 png_ptr->buffer_size -= save_size;
637 png_ptr->save_buffer_size -= save_size; 440 png_ptr->save_buffer_size -= save_size;
638 png_ptr->save_buffer_ptr += save_size; 441 png_ptr->save_buffer_ptr += save_size;
639 } 442 }
640 if (length && png_ptr->current_buffer_size) 443 if (length != 0 && png_ptr->current_buffer_size != 0)
641 { 444 {
642 png_size_t save_size; 445 png_size_t save_size;
643 446
644 if (length < png_ptr->current_buffer_size) 447 if (length < png_ptr->current_buffer_size)
645 save_size = length; 448 save_size = length;
646 449
647 else 450 else
648 save_size = png_ptr->current_buffer_size; 451 save_size = png_ptr->current_buffer_size;
649 452
650 memcpy(ptr, png_ptr->current_buffer_ptr, save_size); 453 memcpy(ptr, png_ptr->current_buffer_ptr, save_size);
651 png_ptr->buffer_size -= save_size; 454 png_ptr->buffer_size -= save_size;
652 png_ptr->current_buffer_size -= save_size; 455 png_ptr->current_buffer_size -= save_size;
653 png_ptr->current_buffer_ptr += save_size; 456 png_ptr->current_buffer_ptr += save_size;
654 } 457 }
655 } 458 }
656 459
657 void /* PRIVATE */ 460 void /* PRIVATE */
658 png_push_save_buffer(png_structrp png_ptr) 461 png_push_save_buffer(png_structrp png_ptr)
659 { 462 {
660 if (png_ptr->save_buffer_size) 463 if (png_ptr->save_buffer_size != 0)
661 { 464 {
662 if (png_ptr->save_buffer_ptr != png_ptr->save_buffer) 465 if (png_ptr->save_buffer_ptr != png_ptr->save_buffer)
663 { 466 {
664 png_size_t i, istop; 467 png_size_t i, istop;
665 png_bytep sp; 468 png_bytep sp;
666 png_bytep dp; 469 png_bytep dp;
667 470
668 istop = png_ptr->save_buffer_size; 471 istop = png_ptr->save_buffer_size;
669 for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer; 472 for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer;
670 i < istop; i++, sp++, dp++) 473 i < istop; i++, sp++, dp++)
(...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after
717 { 520 {
718 png_ptr->current_buffer = buffer; 521 png_ptr->current_buffer = buffer;
719 png_ptr->current_buffer_size = buffer_length; 522 png_ptr->current_buffer_size = buffer_length;
720 png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size; 523 png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size;
721 png_ptr->current_buffer_ptr = png_ptr->current_buffer; 524 png_ptr->current_buffer_ptr = png_ptr->current_buffer;
722 } 525 }
723 526
724 void /* PRIVATE */ 527 void /* PRIVATE */
725 png_push_read_IDAT(png_structrp png_ptr) 528 png_push_read_IDAT(png_structrp png_ptr)
726 { 529 {
727 if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER)) 530 if ((png_ptr->mode & PNG_HAVE_CHUNK_HEADER) == 0)
728 { 531 {
729 png_byte chunk_length[4]; 532 png_byte chunk_length[4];
730 png_byte chunk_tag[4]; 533 png_byte chunk_tag[4];
731 534
732 /* TODO: this code can be commoned up with the same code in push_read */ 535 /* TODO: this code can be commoned up with the same code in push_read */
733 if (png_ptr->buffer_size < 8) 536 PNG_PUSH_SAVE_BUFFER_IF_LT(8)
734 {
735 png_push_save_buffer(png_ptr);
736 return;
737 }
738
739 png_push_fill_buffer(png_ptr, chunk_length, 4); 537 png_push_fill_buffer(png_ptr, chunk_length, 4);
740 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); 538 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
741 png_reset_crc(png_ptr); 539 png_reset_crc(png_ptr);
742 png_crc_read(png_ptr, chunk_tag, 4); 540 png_crc_read(png_ptr, chunk_tag, 4);
743 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); 541 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag);
744 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; 542 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
745 543
746 if (png_ptr->chunk_name != png_IDAT) 544 if (png_ptr->chunk_name != png_IDAT)
747 { 545 {
748 png_ptr->process_mode = PNG_READ_CHUNK_MODE; 546 png_ptr->process_mode = PNG_READ_CHUNK_MODE;
749 547
750 if (!(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED)) 548 if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
751 png_error(png_ptr, "Not enough compressed data"); 549 png_error(png_ptr, "Not enough compressed data");
752 550
753 return; 551 return;
754 } 552 }
755 553
756 png_ptr->idat_size = png_ptr->push_length; 554 png_ptr->idat_size = png_ptr->push_length;
757 } 555 }
758 556
759 if (png_ptr->idat_size && png_ptr->save_buffer_size) 557 if (png_ptr->idat_size != 0 && png_ptr->save_buffer_size != 0)
760 { 558 {
761 png_size_t save_size = png_ptr->save_buffer_size; 559 png_size_t save_size = png_ptr->save_buffer_size;
762 png_uint_32 idat_size = png_ptr->idat_size; 560 png_uint_32 idat_size = png_ptr->idat_size;
763 561
764 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they 562 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they
765 * are of different types and we don't know which variable has the fewest 563 * are of different types and we don't know which variable has the fewest
766 * bits. Carefully select the smaller and cast it to the type of the 564 * bits. Carefully select the smaller and cast it to the type of the
767 * larger - this cannot overflow. Do not cast in the following test - it 565 * larger - this cannot overflow. Do not cast in the following test - it
768 * will break on either 16 or 64 bit platforms. 566 * will break on either 16-bit or 64-bit platforms.
769 */ 567 */
770 if (idat_size < save_size) 568 if (idat_size < save_size)
771 save_size = (png_size_t)idat_size; 569 save_size = (png_size_t)idat_size;
772 570
773 else 571 else
774 idat_size = (png_uint_32)save_size; 572 idat_size = (png_uint_32)save_size;
775 573
776 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size); 574 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
777 575
778 png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size); 576 png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size);
779 577
780 png_ptr->idat_size -= idat_size; 578 png_ptr->idat_size -= idat_size;
781 png_ptr->buffer_size -= save_size; 579 png_ptr->buffer_size -= save_size;
782 png_ptr->save_buffer_size -= save_size; 580 png_ptr->save_buffer_size -= save_size;
783 png_ptr->save_buffer_ptr += save_size; 581 png_ptr->save_buffer_ptr += save_size;
784 } 582 }
785 583
786 if (png_ptr->idat_size && png_ptr->current_buffer_size) 584 if (png_ptr->idat_size != 0 && png_ptr->current_buffer_size != 0)
787 { 585 {
788 png_size_t save_size = png_ptr->current_buffer_size; 586 png_size_t save_size = png_ptr->current_buffer_size;
789 png_uint_32 idat_size = png_ptr->idat_size; 587 png_uint_32 idat_size = png_ptr->idat_size;
790 588
791 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they 589 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they
792 * are of different types and we don't know which variable has the fewest 590 * are of different types and we don't know which variable has the fewest
793 * bits. Carefully select the smaller and cast it to the type of the 591 * bits. Carefully select the smaller and cast it to the type of the
794 * larger - this cannot overflow. 592 * larger - this cannot overflow.
795 */ 593 */
796 if (idat_size < save_size) 594 if (idat_size < save_size)
797 save_size = (png_size_t)idat_size; 595 save_size = (png_size_t)idat_size;
798 596
799 else 597 else
800 idat_size = (png_uint_32)save_size; 598 idat_size = (png_uint_32)save_size;
801 599
802 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size); 600 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
803 601
804 png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size); 602 png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
805 603
806 png_ptr->idat_size -= idat_size; 604 png_ptr->idat_size -= idat_size;
807 png_ptr->buffer_size -= save_size; 605 png_ptr->buffer_size -= save_size;
808 png_ptr->current_buffer_size -= save_size; 606 png_ptr->current_buffer_size -= save_size;
809 png_ptr->current_buffer_ptr += save_size; 607 png_ptr->current_buffer_ptr += save_size;
810 } 608 }
811 if (!png_ptr->idat_size) 609
812 { 610 if (png_ptr->idat_size == 0)
813 if (png_ptr->buffer_size < 4) 611 {
814 { 612 PNG_PUSH_SAVE_BUFFER_IF_LT(4)
815 png_push_save_buffer(png_ptr);
816 return;
817 }
818
819 png_crc_finish(png_ptr, 0); 613 png_crc_finish(png_ptr, 0);
820 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; 614 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
821 png_ptr->mode |= PNG_AFTER_IDAT; 615 png_ptr->mode |= PNG_AFTER_IDAT;
822 png_ptr->zowner = 0; 616 png_ptr->zowner = 0;
823 } 617 }
824 } 618 }
825 619
826 void /* PRIVATE */ 620 void /* PRIVATE */
827 png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer, 621 png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer,
828 png_size_t buffer_length) 622 png_size_t buffer_length)
829 { 623 {
830 /* The caller checks for a non-zero buffer length. */ 624 /* The caller checks for a non-zero buffer length. */
831 if (!(buffer_length > 0) || buffer == NULL) 625 if (!(buffer_length > 0) || buffer == NULL)
832 png_error(png_ptr, "No IDAT data (internal error)"); 626 png_error(png_ptr, "No IDAT data (internal error)");
833 627
834 /* This routine must process all the data it has been given 628 /* This routine must process all the data it has been given
835 * before returning, calling the row callback as required to 629 * before returning, calling the row callback as required to
836 * handle the uncompressed results. 630 * handle the uncompressed results.
837 */ 631 */
838 png_ptr->zstream.next_in = buffer; 632 png_ptr->zstream.next_in = buffer;
839 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ 633 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */
840 png_ptr->zstream.avail_in = (uInt)buffer_length; 634 png_ptr->zstream.avail_in = (uInt)buffer_length;
841 635
842 /* Keep going until the decompressed data is all processed 636 /* Keep going until the decompressed data is all processed
843 * or the stream marked as finished. 637 * or the stream marked as finished.
844 */ 638 */
845 while (png_ptr->zstream.avail_in > 0 && 639 while (png_ptr->zstream.avail_in > 0 &&
846 !(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED)) 640 (png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
847 { 641 {
848 int ret; 642 int ret;
849 643
850 /* We have data for zlib, but we must check that zlib 644 /* We have data for zlib, but we must check that zlib
851 * has someplace to put the results. It doesn't matter 645 * has someplace to put the results. It doesn't matter
852 * if we don't expect any results -- it may be the input 646 * if we don't expect any results -- it may be the input
853 * data is just the LZ end code. 647 * data is just the LZ end code.
854 */ 648 */
855 if (!(png_ptr->zstream.avail_out > 0)) 649 if (!(png_ptr->zstream.avail_out > 0))
856 { 650 {
857 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ 651 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */
858 png_ptr->zstream.avail_out = (uInt)(PNG_ROWBYTES(png_ptr->pixel_depth, 652 png_ptr->zstream.avail_out = (uInt)(PNG_ROWBYTES(png_ptr->pixel_depth,
859 png_ptr->iwidth) + 1); 653 png_ptr->iwidth) + 1);
860 654
861 png_ptr->zstream.next_out = png_ptr->row_buf; 655 png_ptr->zstream.next_out = png_ptr->row_buf;
862 } 656 }
863 657
864 /* Using Z_SYNC_FLUSH here means that an unterminated 658 /* Using Z_SYNC_FLUSH here means that an unterminated
865 * LZ stream (a stream with a missing end code) can still 659 * LZ stream (a stream with a missing end code) can still
866 * be handled, otherwise (Z_NO_FLUSH) a future zlib 660 * be handled, otherwise (Z_NO_FLUSH) a future zlib
867 * implementation might defer output and therefore 661 * implementation might defer output and therefore
868 * change the current behavior (see comments in inflate.c 662 * change the current behavior (see comments in inflate.c
869 * for why this doesn't happen at present with zlib 1.2.5). 663 * for why this doesn't happen at present with zlib 1.2.5).
870 */ 664 */
871 ret = inflate(&png_ptr->zstream, Z_SYNC_FLUSH); 665 ret = PNG_INFLATE(png_ptr, Z_SYNC_FLUSH);
872 666
873 /* Check for any failure before proceeding. */ 667 /* Check for any failure before proceeding. */
874 if (ret != Z_OK && ret != Z_STREAM_END) 668 if (ret != Z_OK && ret != Z_STREAM_END)
875 { 669 {
876 /* Terminate the decompression. */ 670 /* Terminate the decompression. */
877 png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED; 671 png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
878 png_ptr->zowner = 0; 672 png_ptr->zowner = 0;
879 673
880 /* This may be a truncated stream (missing or 674 /* This may be a truncated stream (missing or
881 * damaged end code). Treat that as a warning. 675 * damaged end code). Treat that as a warning.
(...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after
953 } 747 }
954 748
955 /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before 749 /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before
956 * 1.5.6, while the buffer really is this big in current versions of libpng 750 * 1.5.6, while the buffer really is this big in current versions of libpng
957 * it may not be in the future, so this was changed just to copy the 751 * it may not be in the future, so this was changed just to copy the
958 * interlaced row count: 752 * interlaced row count:
959 */ 753 */
960 memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1); 754 memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1);
961 755
962 #ifdef PNG_READ_TRANSFORMS_SUPPORTED 756 #ifdef PNG_READ_TRANSFORMS_SUPPORTED
963 if (png_ptr->transformations) 757 if (png_ptr->transformations != 0)
964 png_do_read_transformations(png_ptr, &row_info); 758 png_do_read_transformations(png_ptr, &row_info);
965 #endif 759 #endif
966 760
967 /* The transformed pixel depth should match the depth now in row_info. */ 761 /* The transformed pixel depth should match the depth now in row_info. */
968 if (png_ptr->transformed_pixel_depth == 0) 762 if (png_ptr->transformed_pixel_depth == 0)
969 { 763 {
970 png_ptr->transformed_pixel_depth = row_info.pixel_depth; 764 png_ptr->transformed_pixel_depth = row_info.pixel_depth;
971 if (row_info.pixel_depth > png_ptr->maximum_pixel_depth) 765 if (row_info.pixel_depth > png_ptr->maximum_pixel_depth)
972 png_error(png_ptr, "progressive row overflow"); 766 png_error(png_ptr, "progressive row overflow");
973 } 767 }
974 768
975 else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth) 769 else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth)
976 png_error(png_ptr, "internal progressive row size calculation error"); 770 png_error(png_ptr, "internal progressive row size calculation error");
977 771
978 772
979 #ifdef PNG_READ_INTERLACING_SUPPORTED 773 #ifdef PNG_READ_INTERLACING_SUPPORTED
980 /* Blow up interlaced rows to full size */ 774 /* Expand interlaced rows to full size */
981 if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE)) 775 if (png_ptr->interlaced != 0 &&
776 (png_ptr->transformations & PNG_INTERLACE) != 0)
982 { 777 {
983 if (png_ptr->pass < 6) 778 if (png_ptr->pass < 6)
984 png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass, 779 png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass,
985 png_ptr->transformations); 780 png_ptr->transformations);
986 781
987 switch (png_ptr->pass) 782 switch (png_ptr->pass)
988 { 783 {
989 case 0: 784 case 0:
990 { 785 {
991 int i; 786 int i;
992 for (i = 0; i < 8 && png_ptr->pass == 0; i++) 787 for (i = 0; i < 8 && png_ptr->pass == 0; i++)
993 { 788 {
994 png_push_have_row(png_ptr, png_ptr->row_buf + 1); 789 png_push_have_row(png_ptr, png_ptr->row_buf + 1);
995 png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */ 790 png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */
996 } 791 }
997 792
998 if (png_ptr->pass == 2) /* Pass 1 might be empty */ 793 if (png_ptr->pass == 2) /* Pass 1 might be empty */
(...skipping 182 matching lines...) Expand 10 before | Expand all | Expand 10 after
1181 * it, uncomment it here and in png.h 976 * it, uncomment it here and in png.h
1182 static PNG_CONST png_byte png_pass_height[] = {8, 8, 4, 4, 2, 2, 1}; 977 static PNG_CONST png_byte png_pass_height[] = {8, 8, 4, 4, 2, 2, 1};
1183 */ 978 */
1184 #endif 979 #endif
1185 980
1186 png_ptr->row_number++; 981 png_ptr->row_number++;
1187 if (png_ptr->row_number < png_ptr->num_rows) 982 if (png_ptr->row_number < png_ptr->num_rows)
1188 return; 983 return;
1189 984
1190 #ifdef PNG_READ_INTERLACING_SUPPORTED 985 #ifdef PNG_READ_INTERLACING_SUPPORTED
1191 if (png_ptr->interlaced) 986 if (png_ptr->interlaced != 0)
1192 { 987 {
1193 png_ptr->row_number = 0; 988 png_ptr->row_number = 0;
1194 memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); 989 memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
1195 990
1196 do 991 do
1197 { 992 {
1198 png_ptr->pass++; 993 png_ptr->pass++;
1199 if ((png_ptr->pass == 1 && png_ptr->width < 5) || 994 if ((png_ptr->pass == 1 && png_ptr->width < 5) ||
1200 (png_ptr->pass == 3 && png_ptr->width < 3) || 995 (png_ptr->pass == 3 && png_ptr->width < 3) ||
1201 (png_ptr->pass == 5 && png_ptr->width < 2)) 996 (png_ptr->pass == 5 && png_ptr->width < 2))
1202 png_ptr->pass++; 997 png_ptr->pass++;
1203 998
1204 if (png_ptr->pass > 7) 999 if (png_ptr->pass > 7)
1205 png_ptr->pass--; 1000 png_ptr->pass--;
1206 1001
1207 if (png_ptr->pass >= 7) 1002 if (png_ptr->pass >= 7)
1208 break; 1003 break;
1209 1004
1210 png_ptr->iwidth = (png_ptr->width + 1005 png_ptr->iwidth = (png_ptr->width +
1211 png_pass_inc[png_ptr->pass] - 1 - 1006 png_pass_inc[png_ptr->pass] - 1 -
1212 png_pass_start[png_ptr->pass]) / 1007 png_pass_start[png_ptr->pass]) /
1213 png_pass_inc[png_ptr->pass]; 1008 png_pass_inc[png_ptr->pass];
1214 1009
1215 if (png_ptr->transformations & PNG_INTERLACE) 1010 if ((png_ptr->transformations & PNG_INTERLACE) != 0)
1216 break; 1011 break;
1217 1012
1218 png_ptr->num_rows = (png_ptr->height + 1013 png_ptr->num_rows = (png_ptr->height +
1219 png_pass_yinc[png_ptr->pass] - 1 - 1014 png_pass_yinc[png_ptr->pass] - 1 -
1220 png_pass_ystart[png_ptr->pass]) / 1015 png_pass_ystart[png_ptr->pass]) /
1221 png_pass_yinc[png_ptr->pass]; 1016 png_pass_yinc[png_ptr->pass];
1222 1017
1223 } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0); 1018 } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0);
1224 } 1019 }
1225 #endif /* PNG_READ_INTERLACING_SUPPORTED */ 1020 #endif /* READ_INTERLACING */
1226 } 1021 }
1227 1022
1228 void /* PRIVATE */ 1023 void /* PRIVATE */
1229 png_push_have_info(png_structrp png_ptr, png_inforp info_ptr) 1024 png_push_have_info(png_structrp png_ptr, png_inforp info_ptr)
1230 { 1025 {
1231 if (png_ptr->info_fn != NULL) 1026 if (png_ptr->info_fn != NULL)
1232 (*(png_ptr->info_fn))(png_ptr, info_ptr); 1027 (*(png_ptr->info_fn))(png_ptr, info_ptr);
1233 } 1028 }
1234 1029
1235 void /* PRIVATE */ 1030 void /* PRIVATE */
(...skipping 17 matching lines...) Expand all
1253 png_const_bytep new_row) 1048 png_const_bytep new_row)
1254 { 1049 {
1255 if (png_ptr == NULL) 1050 if (png_ptr == NULL)
1256 return; 1051 return;
1257 1052
1258 /* new_row is a flag here - if it is NULL then the app callback was called 1053 /* new_row is a flag here - if it is NULL then the app callback was called
1259 * from an empty row (see the calls to png_struct::row_fn below), otherwise 1054 * from an empty row (see the calls to png_struct::row_fn below), otherwise
1260 * it must be png_ptr->row_buf+1 1055 * it must be png_ptr->row_buf+1
1261 */ 1056 */
1262 if (new_row != NULL) 1057 if (new_row != NULL)
1263 png_combine_row(png_ptr, old_row, 1/*display*/); 1058 png_combine_row(png_ptr, old_row, 1/*blocky display*/);
1264 } 1059 }
1265 #endif /* PNG_READ_INTERLACING_SUPPORTED */ 1060 #endif /* READ_INTERLACING */
1266 1061
1267 void PNGAPI 1062 void PNGAPI
1268 png_set_progressive_read_fn(png_structrp png_ptr, png_voidp progressive_ptr, 1063 png_set_progressive_read_fn(png_structrp png_ptr, png_voidp progressive_ptr,
1269 png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn, 1064 png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn,
1270 png_progressive_end_ptr end_fn) 1065 png_progressive_end_ptr end_fn)
1271 { 1066 {
1272 if (png_ptr == NULL) 1067 if (png_ptr == NULL)
1273 return; 1068 return;
1274 1069
1275 png_ptr->info_fn = info_fn; 1070 png_ptr->info_fn = info_fn;
1276 png_ptr->row_fn = row_fn; 1071 png_ptr->row_fn = row_fn;
1277 png_ptr->end_fn = end_fn; 1072 png_ptr->end_fn = end_fn;
1278 1073
1279 png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer); 1074 png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
1280 } 1075 }
1281 1076
1282 png_voidp PNGAPI 1077 png_voidp PNGAPI
1283 png_get_progressive_ptr(png_const_structrp png_ptr) 1078 png_get_progressive_ptr(png_const_structrp png_ptr)
1284 { 1079 {
1285 if (png_ptr == NULL) 1080 if (png_ptr == NULL)
1286 return (NULL); 1081 return (NULL);
1287 1082
1288 return png_ptr->io_ptr; 1083 return png_ptr->io_ptr;
1289 } 1084 }
1290 #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */ 1085 #endif /* PROGRESSIVE_READ */
OLDNEW
« no previous file with comments | « third_party/libpng/pngmem.c ('k') | third_party/libpng/pngpriv.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698