OLD | NEW |
| 1 |
1 /* pngpread.c - read a png file in push mode | 2 /* pngpread.c - read a png file in push mode |
2 * | 3 * |
3 * Last changed in libpng 1.6.0 [February 14, 2013] | 4 * Last changed in libpng 1.6.18 [July 23, 2015] |
4 * Copyright (c) 1998-2013 Glenn Randers-Pehrson | 5 * Copyright (c) 1998-2015 Glenn Randers-Pehrson |
5 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) | 6 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) |
6 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) | 7 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) |
7 * | 8 * |
8 * This code is released under the libpng license. | 9 * This code is released under the libpng license. |
9 * For conditions of distribution and use, see the disclaimer | 10 * For conditions of distribution and use, see the disclaimer |
10 * and license in png.h | 11 * and license in png.h |
11 */ | 12 */ |
12 | 13 |
13 #include "pngpriv.h" | 14 #include "pngpriv.h" |
14 | 15 |
15 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED | 16 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED |
16 | 17 |
17 /* Push model modes */ | 18 /* Push model modes */ |
18 #define PNG_READ_SIG_MODE 0 | 19 #define PNG_READ_SIG_MODE 0 |
19 #define PNG_READ_CHUNK_MODE 1 | 20 #define PNG_READ_CHUNK_MODE 1 |
20 #define PNG_READ_IDAT_MODE 2 | 21 #define PNG_READ_IDAT_MODE 2 |
21 #define PNG_SKIP_MODE 3 | |
22 #define PNG_READ_tEXt_MODE 4 | 22 #define PNG_READ_tEXt_MODE 4 |
23 #define PNG_READ_zTXt_MODE 5 | 23 #define PNG_READ_zTXt_MODE 5 |
24 #define PNG_READ_DONE_MODE 6 | 24 #define PNG_READ_DONE_MODE 6 |
25 #define PNG_READ_iTXt_MODE 7 | 25 #define PNG_READ_iTXt_MODE 7 |
26 #define PNG_ERROR_MODE 8 | 26 #define PNG_ERROR_MODE 8 |
27 | 27 |
| 28 #define PNG_PUSH_SAVE_BUFFER_IF_FULL \ |
| 29 if (png_ptr->push_length + 4 > png_ptr->buffer_size) \ |
| 30 { png_push_save_buffer(png_ptr); return; } |
| 31 #define PNG_PUSH_SAVE_BUFFER_IF_LT(N) \ |
| 32 if (png_ptr->buffer_size < N) \ |
| 33 { png_push_save_buffer(png_ptr); return; } |
| 34 |
28 void PNGAPI | 35 void PNGAPI |
29 png_process_data(png_structrp png_ptr, png_inforp info_ptr, | 36 png_process_data(png_structrp png_ptr, png_inforp info_ptr, |
30 png_bytep buffer, png_size_t buffer_size) | 37 png_bytep buffer, png_size_t buffer_size) |
31 { | 38 { |
32 if (png_ptr == NULL || info_ptr == NULL) | 39 if (png_ptr == NULL || info_ptr == NULL) |
33 return; | 40 return; |
34 | 41 |
35 png_push_restore_buffer(png_ptr, buffer, buffer_size); | 42 png_push_restore_buffer(png_ptr, buffer, buffer_size); |
36 | 43 |
37 while (png_ptr->buffer_size) | 44 while (png_ptr->buffer_size) |
38 { | 45 { |
39 png_process_some_data(png_ptr, info_ptr); | 46 png_process_some_data(png_ptr, info_ptr); |
40 } | 47 } |
41 } | 48 } |
42 | 49 |
43 png_size_t PNGAPI | 50 png_size_t PNGAPI |
44 png_process_data_pause(png_structrp png_ptr, int save) | 51 png_process_data_pause(png_structrp png_ptr, int save) |
45 { | 52 { |
46 if (png_ptr != NULL) | 53 if (png_ptr != NULL) |
47 { | 54 { |
48 /* It's easiest for the caller if we do the save, then the caller doesn't | 55 /* It's easiest for the caller if we do the save; then the caller doesn't |
49 * have to supply the same data again: | 56 * have to supply the same data again: |
50 */ | 57 */ |
51 if (save) | 58 if (save != 0) |
52 png_push_save_buffer(png_ptr); | 59 png_push_save_buffer(png_ptr); |
53 else | 60 else |
54 { | 61 { |
55 /* This includes any pending saved bytes: */ | 62 /* This includes any pending saved bytes: */ |
56 png_size_t remaining = png_ptr->buffer_size; | 63 png_size_t remaining = png_ptr->buffer_size; |
57 png_ptr->buffer_size = 0; | 64 png_ptr->buffer_size = 0; |
58 | 65 |
59 /* So subtract the saved buffer size, unless all the data | 66 /* So subtract the saved buffer size, unless all the data |
60 * is actually 'saved', in which case we just return 0 | 67 * is actually 'saved', in which case we just return 0 |
61 */ | 68 */ |
62 if (png_ptr->save_buffer_size < remaining) | 69 if (png_ptr->save_buffer_size < remaining) |
63 return remaining - png_ptr->save_buffer_size; | 70 return remaining - png_ptr->save_buffer_size; |
64 } | 71 } |
65 } | 72 } |
66 | 73 |
67 return 0; | 74 return 0; |
68 } | 75 } |
69 | 76 |
70 png_uint_32 PNGAPI | 77 png_uint_32 PNGAPI |
71 png_process_data_skip(png_structrp png_ptr) | 78 png_process_data_skip(png_structrp png_ptr) |
72 { | 79 { |
73 png_uint_32 remaining = 0; | 80 /* TODO: Deprecate and remove this API. |
74 | 81 * Somewhere the implementation of this seems to have been lost, |
75 if (png_ptr != NULL && png_ptr->process_mode == PNG_SKIP_MODE && | 82 * or abandoned. It was only to support some internal back-door access |
76 png_ptr->skip_length > 0) | 83 * to png_struct) in libpng-1.4.x. |
77 { | 84 */ |
78 /* At the end of png_process_data the buffer size must be 0 (see the loop | 85 png_app_warning(png_ptr, |
79 * above) so we can detect a broken call here: | 86 "png_process_data_skip is not implemented in any current version of libpng"); |
80 */ | 87 return 0; |
81 if (png_ptr->buffer_size != 0) | |
82 png_error(png_ptr, | |
83 "png_process_data_skip called inside png_process_data"); | |
84 | |
85 /* If is impossible for there to be a saved buffer at this point - | |
86 * otherwise we could not be in SKIP mode. This will also happen if | |
87 * png_process_skip is called inside png_process_data (but only very | |
88 * rarely.) | |
89 */ | |
90 if (png_ptr->save_buffer_size != 0) | |
91 png_error(png_ptr, "png_process_data_skip called with saved data"); | |
92 | |
93 remaining = png_ptr->skip_length; | |
94 png_ptr->skip_length = 0; | |
95 png_ptr->process_mode = PNG_READ_CHUNK_MODE; | |
96 } | |
97 | |
98 return remaining; | |
99 } | 88 } |
100 | 89 |
101 /* What we do with the incoming data depends on what we were previously | 90 /* What we do with the incoming data depends on what we were previously |
102 * doing before we ran out of data... | 91 * doing before we ran out of data... |
103 */ | 92 */ |
104 void /* PRIVATE */ | 93 void /* PRIVATE */ |
105 png_process_some_data(png_structrp png_ptr, png_inforp info_ptr) | 94 png_process_some_data(png_structrp png_ptr, png_inforp info_ptr) |
106 { | 95 { |
107 if (png_ptr == NULL) | 96 if (png_ptr == NULL) |
108 return; | 97 return; |
(...skipping 11 matching lines...) Expand all Loading... |
120 png_push_read_chunk(png_ptr, info_ptr); | 109 png_push_read_chunk(png_ptr, info_ptr); |
121 break; | 110 break; |
122 } | 111 } |
123 | 112 |
124 case PNG_READ_IDAT_MODE: | 113 case PNG_READ_IDAT_MODE: |
125 { | 114 { |
126 png_push_read_IDAT(png_ptr); | 115 png_push_read_IDAT(png_ptr); |
127 break; | 116 break; |
128 } | 117 } |
129 | 118 |
130 case PNG_SKIP_MODE: | |
131 { | |
132 png_push_crc_finish(png_ptr); | |
133 break; | |
134 } | |
135 | |
136 default: | 119 default: |
137 { | 120 { |
138 png_ptr->buffer_size = 0; | 121 png_ptr->buffer_size = 0; |
139 break; | 122 break; |
140 } | 123 } |
141 } | 124 } |
142 } | 125 } |
143 | 126 |
144 /* Read any remaining signature bytes from the stream and compare them with | 127 /* Read any remaining signature bytes from the stream and compare them with |
145 * the correct PNG signature. It is possible that this routine is called | 128 * the correct PNG signature. It is possible that this routine is called |
146 * with bytes already read from the signature, either because they have been | 129 * with bytes already read from the signature, either because they have been |
147 * checked by the calling application, or because of multiple calls to this | 130 * checked by the calling application, or because of multiple calls to this |
148 * routine. | 131 * routine. |
149 */ | 132 */ |
150 void /* PRIVATE */ | 133 void /* PRIVATE */ |
151 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr) | 134 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr) |
152 { | 135 { |
153 png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ | 136 png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ |
154 num_to_check = 8 - num_checked; | 137 num_to_check = 8 - num_checked; |
155 | 138 |
156 if (png_ptr->buffer_size < num_to_check) | 139 if (png_ptr->buffer_size < num_to_check) |
157 { | 140 { |
158 num_to_check = png_ptr->buffer_size; | 141 num_to_check = png_ptr->buffer_size; |
159 } | 142 } |
160 | 143 |
161 png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]), | 144 png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]), |
162 num_to_check); | 145 num_to_check); |
163 png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check); | 146 png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check); |
164 | 147 |
(...skipping 16 matching lines...) Expand all Loading... |
181 } | 164 } |
182 | 165 |
183 void /* PRIVATE */ | 166 void /* PRIVATE */ |
184 png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr) | 167 png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr) |
185 { | 168 { |
186 png_uint_32 chunk_name; | 169 png_uint_32 chunk_name; |
187 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED | 170 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED |
188 int keep; /* unknown handling method */ | 171 int keep; /* unknown handling method */ |
189 #endif | 172 #endif |
190 | 173 |
191 /* First we make sure we have enough data for the 4 byte chunk name | 174 /* First we make sure we have enough data for the 4-byte chunk name |
192 * and the 4 byte chunk length before proceeding with decoding the | 175 * and the 4-byte chunk length before proceeding with decoding the |
193 * chunk data. To fully decode each of these chunks, we also make | 176 * chunk data. To fully decode each of these chunks, we also make |
194 * sure we have enough data in the buffer for the 4 byte CRC at the | 177 * sure we have enough data in the buffer for the 4-byte CRC at the |
195 * end of every chunk (except IDAT, which is handled separately). | 178 * end of every chunk (except IDAT, which is handled separately). |
196 */ | 179 */ |
197 if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER)) | 180 if ((png_ptr->mode & PNG_HAVE_CHUNK_HEADER) == 0) |
198 { | 181 { |
199 png_byte chunk_length[4]; | 182 png_byte chunk_length[4]; |
200 png_byte chunk_tag[4]; | 183 png_byte chunk_tag[4]; |
201 | 184 |
202 if (png_ptr->buffer_size < 8) | 185 PNG_PUSH_SAVE_BUFFER_IF_LT(8) |
203 { | |
204 png_push_save_buffer(png_ptr); | |
205 return; | |
206 } | |
207 | |
208 png_push_fill_buffer(png_ptr, chunk_length, 4); | 186 png_push_fill_buffer(png_ptr, chunk_length, 4); |
209 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); | 187 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); |
210 png_reset_crc(png_ptr); | 188 png_reset_crc(png_ptr); |
211 png_crc_read(png_ptr, chunk_tag, 4); | 189 png_crc_read(png_ptr, chunk_tag, 4); |
212 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); | 190 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); |
213 png_check_chunk_name(png_ptr, png_ptr->chunk_name); | 191 png_check_chunk_name(png_ptr, png_ptr->chunk_name); |
214 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; | 192 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; |
215 } | 193 } |
216 | 194 |
217 chunk_name = png_ptr->chunk_name; | 195 chunk_name = png_ptr->chunk_name; |
218 | 196 |
219 if (chunk_name == png_IDAT) | 197 if (chunk_name == png_IDAT) |
220 { | 198 { |
221 if (png_ptr->mode & PNG_AFTER_IDAT) | 199 if ((png_ptr->mode & PNG_AFTER_IDAT) != 0) |
222 png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT; | 200 png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT; |
223 | 201 |
224 /* If we reach an IDAT chunk, this means we have read all of the | 202 /* If we reach an IDAT chunk, this means we have read all of the |
225 * header chunks, and we can start reading the image (or if this | 203 * header chunks, and we can start reading the image (or if this |
226 * is called after the image has been read - we have an error). | 204 * is called after the image has been read - we have an error). |
227 */ | 205 */ |
228 if (!(png_ptr->mode & PNG_HAVE_IHDR)) | 206 if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
229 png_error(png_ptr, "Missing IHDR before IDAT"); | 207 png_error(png_ptr, "Missing IHDR before IDAT"); |
230 | 208 |
231 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE && | 209 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE && |
232 !(png_ptr->mode & PNG_HAVE_PLTE)) | 210 (png_ptr->mode & PNG_HAVE_PLTE) == 0) |
233 png_error(png_ptr, "Missing PLTE before IDAT"); | 211 png_error(png_ptr, "Missing PLTE before IDAT"); |
234 | 212 |
235 png_ptr->mode |= PNG_HAVE_IDAT; | 213 png_ptr->mode |= PNG_HAVE_IDAT; |
236 | 214 png_ptr->process_mode = PNG_READ_IDAT_MODE; |
237 if (!(png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT)) | 215 |
| 216 if ((png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) == 0) |
238 if (png_ptr->push_length == 0) | 217 if (png_ptr->push_length == 0) |
239 return; | 218 return; |
240 | 219 |
241 if (png_ptr->mode & PNG_AFTER_IDAT) | 220 if ((png_ptr->mode & PNG_AFTER_IDAT) != 0) |
242 png_benign_error(png_ptr, "Too many IDATs found"); | 221 png_benign_error(png_ptr, "Too many IDATs found"); |
243 } | 222 } |
244 | 223 |
245 if (chunk_name == png_IHDR) | 224 if (chunk_name == png_IHDR) |
246 { | 225 { |
247 if (png_ptr->push_length != 13) | 226 if (png_ptr->push_length != 13) |
248 png_error(png_ptr, "Invalid IHDR length"); | 227 png_error(png_ptr, "Invalid IHDR length"); |
249 | 228 |
250 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 229 PNG_PUSH_SAVE_BUFFER_IF_FULL |
251 { | |
252 png_push_save_buffer(png_ptr); | |
253 return; | |
254 } | |
255 | |
256 png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length); | 230 png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length); |
257 } | 231 } |
258 | 232 |
259 else if (chunk_name == png_IEND) | 233 else if (chunk_name == png_IEND) |
260 { | 234 { |
261 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 235 PNG_PUSH_SAVE_BUFFER_IF_FULL |
262 { | |
263 png_push_save_buffer(png_ptr); | |
264 return; | |
265 } | |
266 | |
267 png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length); | 236 png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length); |
268 | 237 |
269 png_ptr->process_mode = PNG_READ_DONE_MODE; | 238 png_ptr->process_mode = PNG_READ_DONE_MODE; |
270 png_push_have_end(png_ptr, info_ptr); | 239 png_push_have_end(png_ptr, info_ptr); |
271 } | 240 } |
272 | 241 |
273 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED | 242 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED |
274 else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0) | 243 else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0) |
275 { | 244 { |
276 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 245 PNG_PUSH_SAVE_BUFFER_IF_FULL |
277 { | |
278 png_push_save_buffer(png_ptr); | |
279 return; | |
280 } | |
281 | |
282 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, keep); | 246 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, keep); |
283 | 247 |
284 if (chunk_name == png_PLTE) | 248 if (chunk_name == png_PLTE) |
285 png_ptr->mode |= PNG_HAVE_PLTE; | 249 png_ptr->mode |= PNG_HAVE_PLTE; |
286 } | 250 } |
287 | 251 #endif |
288 #endif | 252 |
289 else if (chunk_name == png_PLTE) | 253 else if (chunk_name == png_PLTE) |
290 { | 254 { |
291 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 255 PNG_PUSH_SAVE_BUFFER_IF_FULL |
292 { | |
293 png_push_save_buffer(png_ptr); | |
294 return; | |
295 } | |
296 png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length); | 256 png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length); |
297 } | 257 } |
298 | 258 |
299 else if (chunk_name == png_IDAT) | 259 else if (chunk_name == png_IDAT) |
300 { | 260 { |
301 png_ptr->idat_size = png_ptr->push_length; | 261 png_ptr->idat_size = png_ptr->push_length; |
302 png_ptr->process_mode = PNG_READ_IDAT_MODE; | 262 png_ptr->process_mode = PNG_READ_IDAT_MODE; |
303 png_push_have_info(png_ptr, info_ptr); | 263 png_push_have_info(png_ptr, info_ptr); |
304 png_ptr->zstream.avail_out = | 264 png_ptr->zstream.avail_out = |
305 (uInt) PNG_ROWBYTES(png_ptr->pixel_depth, | 265 (uInt) PNG_ROWBYTES(png_ptr->pixel_depth, |
306 png_ptr->iwidth) + 1; | 266 png_ptr->iwidth) + 1; |
307 png_ptr->zstream.next_out = png_ptr->row_buf; | 267 png_ptr->zstream.next_out = png_ptr->row_buf; |
308 return; | 268 return; |
309 } | 269 } |
310 | 270 |
311 #ifdef PNG_READ_gAMA_SUPPORTED | 271 #ifdef PNG_READ_gAMA_SUPPORTED |
312 else if (png_ptr->chunk_name == png_gAMA) | 272 else if (png_ptr->chunk_name == png_gAMA) |
313 { | 273 { |
314 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 274 PNG_PUSH_SAVE_BUFFER_IF_FULL |
315 { | |
316 png_push_save_buffer(png_ptr); | |
317 return; | |
318 } | |
319 | |
320 png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length); | 275 png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length); |
321 } | 276 } |
322 | 277 |
323 #endif | 278 #endif |
324 #ifdef PNG_READ_sBIT_SUPPORTED | 279 #ifdef PNG_READ_sBIT_SUPPORTED |
325 else if (png_ptr->chunk_name == png_sBIT) | 280 else if (png_ptr->chunk_name == png_sBIT) |
326 { | 281 { |
327 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 282 PNG_PUSH_SAVE_BUFFER_IF_FULL |
328 { | |
329 png_push_save_buffer(png_ptr); | |
330 return; | |
331 } | |
332 | |
333 png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length); | 283 png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length); |
334 } | 284 } |
335 | 285 |
336 #endif | 286 #endif |
337 #ifdef PNG_READ_cHRM_SUPPORTED | 287 #ifdef PNG_READ_cHRM_SUPPORTED |
338 else if (png_ptr->chunk_name == png_cHRM) | 288 else if (png_ptr->chunk_name == png_cHRM) |
339 { | 289 { |
340 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 290 PNG_PUSH_SAVE_BUFFER_IF_FULL |
341 { | |
342 png_push_save_buffer(png_ptr); | |
343 return; | |
344 } | |
345 | |
346 png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length); | 291 png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length); |
347 } | 292 } |
348 | 293 |
349 #endif | 294 #endif |
350 #ifdef PNG_READ_sRGB_SUPPORTED | 295 #ifdef PNG_READ_sRGB_SUPPORTED |
351 else if (chunk_name == png_sRGB) | 296 else if (chunk_name == png_sRGB) |
352 { | 297 { |
353 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 298 PNG_PUSH_SAVE_BUFFER_IF_FULL |
354 { | |
355 png_push_save_buffer(png_ptr); | |
356 return; | |
357 } | |
358 | |
359 png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length); | 299 png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length); |
360 } | 300 } |
361 | 301 |
362 #endif | 302 #endif |
363 #ifdef PNG_READ_iCCP_SUPPORTED | 303 #ifdef PNG_READ_iCCP_SUPPORTED |
364 else if (png_ptr->chunk_name == png_iCCP) | 304 else if (png_ptr->chunk_name == png_iCCP) |
365 { | 305 { |
366 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 306 PNG_PUSH_SAVE_BUFFER_IF_FULL |
367 { | |
368 png_push_save_buffer(png_ptr); | |
369 return; | |
370 } | |
371 | |
372 png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length); | 307 png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length); |
373 } | 308 } |
374 | 309 |
375 #endif | 310 #endif |
376 #ifdef PNG_READ_sPLT_SUPPORTED | 311 #ifdef PNG_READ_sPLT_SUPPORTED |
377 else if (chunk_name == png_sPLT) | 312 else if (chunk_name == png_sPLT) |
378 { | 313 { |
379 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 314 PNG_PUSH_SAVE_BUFFER_IF_FULL |
380 { | |
381 png_push_save_buffer(png_ptr); | |
382 return; | |
383 } | |
384 | |
385 png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length); | 315 png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length); |
386 } | 316 } |
387 | 317 |
388 #endif | 318 #endif |
389 #ifdef PNG_READ_tRNS_SUPPORTED | 319 #ifdef PNG_READ_tRNS_SUPPORTED |
390 else if (chunk_name == png_tRNS) | 320 else if (chunk_name == png_tRNS) |
391 { | 321 { |
392 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 322 PNG_PUSH_SAVE_BUFFER_IF_FULL |
393 { | |
394 png_push_save_buffer(png_ptr); | |
395 return; | |
396 } | |
397 | |
398 png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length); | 323 png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length); |
399 } | 324 } |
400 | 325 |
401 #endif | 326 #endif |
402 #ifdef PNG_READ_bKGD_SUPPORTED | 327 #ifdef PNG_READ_bKGD_SUPPORTED |
403 else if (chunk_name == png_bKGD) | 328 else if (chunk_name == png_bKGD) |
404 { | 329 { |
405 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 330 PNG_PUSH_SAVE_BUFFER_IF_FULL |
406 { | |
407 png_push_save_buffer(png_ptr); | |
408 return; | |
409 } | |
410 | |
411 png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length); | 331 png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length); |
412 } | 332 } |
413 | 333 |
414 #endif | 334 #endif |
415 #ifdef PNG_READ_hIST_SUPPORTED | 335 #ifdef PNG_READ_hIST_SUPPORTED |
416 else if (chunk_name == png_hIST) | 336 else if (chunk_name == png_hIST) |
417 { | 337 { |
418 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 338 PNG_PUSH_SAVE_BUFFER_IF_FULL |
419 { | |
420 png_push_save_buffer(png_ptr); | |
421 return; | |
422 } | |
423 | |
424 png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length); | 339 png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length); |
425 } | 340 } |
426 | 341 |
427 #endif | 342 #endif |
428 #ifdef PNG_READ_pHYs_SUPPORTED | 343 #ifdef PNG_READ_pHYs_SUPPORTED |
429 else if (chunk_name == png_pHYs) | 344 else if (chunk_name == png_pHYs) |
430 { | 345 { |
431 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 346 PNG_PUSH_SAVE_BUFFER_IF_FULL |
432 { | |
433 png_push_save_buffer(png_ptr); | |
434 return; | |
435 } | |
436 | |
437 png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length); | 347 png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length); |
438 } | 348 } |
439 | 349 |
440 #endif | 350 #endif |
441 #ifdef PNG_READ_oFFs_SUPPORTED | 351 #ifdef PNG_READ_oFFs_SUPPORTED |
442 else if (chunk_name == png_oFFs) | 352 else if (chunk_name == png_oFFs) |
443 { | 353 { |
444 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 354 PNG_PUSH_SAVE_BUFFER_IF_FULL |
445 { | |
446 png_push_save_buffer(png_ptr); | |
447 return; | |
448 } | |
449 | |
450 png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length); | 355 png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length); |
451 } | 356 } |
452 #endif | 357 #endif |
453 | 358 |
454 #ifdef PNG_READ_pCAL_SUPPORTED | 359 #ifdef PNG_READ_pCAL_SUPPORTED |
455 else if (chunk_name == png_pCAL) | 360 else if (chunk_name == png_pCAL) |
456 { | 361 { |
457 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 362 PNG_PUSH_SAVE_BUFFER_IF_FULL |
458 { | |
459 png_push_save_buffer(png_ptr); | |
460 return; | |
461 } | |
462 | |
463 png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length); | 363 png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length); |
464 } | 364 } |
465 | 365 |
466 #endif | 366 #endif |
467 #ifdef PNG_READ_sCAL_SUPPORTED | 367 #ifdef PNG_READ_sCAL_SUPPORTED |
468 else if (chunk_name == png_sCAL) | 368 else if (chunk_name == png_sCAL) |
469 { | 369 { |
470 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 370 PNG_PUSH_SAVE_BUFFER_IF_FULL |
471 { | |
472 png_push_save_buffer(png_ptr); | |
473 return; | |
474 } | |
475 | |
476 png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length); | 371 png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length); |
477 } | 372 } |
478 | 373 |
479 #endif | 374 #endif |
480 #ifdef PNG_READ_tIME_SUPPORTED | 375 #ifdef PNG_READ_tIME_SUPPORTED |
481 else if (chunk_name == png_tIME) | 376 else if (chunk_name == png_tIME) |
482 { | 377 { |
483 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 378 PNG_PUSH_SAVE_BUFFER_IF_FULL |
484 { | |
485 png_push_save_buffer(png_ptr); | |
486 return; | |
487 } | |
488 | |
489 png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length); | 379 png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length); |
490 } | 380 } |
491 | 381 |
492 #endif | 382 #endif |
493 #ifdef PNG_READ_tEXt_SUPPORTED | 383 #ifdef PNG_READ_tEXt_SUPPORTED |
494 else if (chunk_name == png_tEXt) | 384 else if (chunk_name == png_tEXt) |
495 { | 385 { |
496 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 386 PNG_PUSH_SAVE_BUFFER_IF_FULL |
497 { | |
498 png_push_save_buffer(png_ptr); | |
499 return; | |
500 } | |
501 | |
502 png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length); | 387 png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length); |
503 } | 388 } |
504 | 389 |
505 #endif | 390 #endif |
506 #ifdef PNG_READ_zTXt_SUPPORTED | 391 #ifdef PNG_READ_zTXt_SUPPORTED |
507 else if (chunk_name == png_zTXt) | 392 else if (chunk_name == png_zTXt) |
508 { | 393 { |
509 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 394 PNG_PUSH_SAVE_BUFFER_IF_FULL |
510 { | |
511 png_push_save_buffer(png_ptr); | |
512 return; | |
513 } | |
514 | |
515 png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length); | 395 png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length); |
516 } | 396 } |
517 | 397 |
518 #endif | 398 #endif |
519 #ifdef PNG_READ_iTXt_SUPPORTED | 399 #ifdef PNG_READ_iTXt_SUPPORTED |
520 else if (chunk_name == png_iTXt) | 400 else if (chunk_name == png_iTXt) |
521 { | 401 { |
522 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 402 PNG_PUSH_SAVE_BUFFER_IF_FULL |
523 { | |
524 png_push_save_buffer(png_ptr); | |
525 return; | |
526 } | |
527 | |
528 png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length); | 403 png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length); |
529 } | 404 } |
530 | 405 #endif |
531 #endif | 406 |
532 else | 407 else |
533 { | 408 { |
534 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 409 PNG_PUSH_SAVE_BUFFER_IF_FULL |
535 { | |
536 png_push_save_buffer(png_ptr); | |
537 return; | |
538 } | |
539 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, | 410 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, |
540 PNG_HANDLE_CHUNK_AS_DEFAULT); | 411 PNG_HANDLE_CHUNK_AS_DEFAULT); |
541 } | 412 } |
542 | 413 |
543 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; | 414 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; |
544 } | 415 } |
545 | 416 |
546 void /* PRIVATE */ | |
547 png_push_crc_skip(png_structrp png_ptr, png_uint_32 skip) | |
548 { | |
549 png_ptr->process_mode = PNG_SKIP_MODE; | |
550 png_ptr->skip_length = skip; | |
551 } | |
552 | |
553 void /* PRIVATE */ | |
554 png_push_crc_finish(png_structrp png_ptr) | |
555 { | |
556 if (png_ptr->skip_length && png_ptr->save_buffer_size) | |
557 { | |
558 png_size_t save_size = png_ptr->save_buffer_size; | |
559 png_uint_32 skip_length = png_ptr->skip_length; | |
560 | |
561 /* We want the smaller of 'skip_length' and 'save_buffer_size', but | |
562 * they are of different types and we don't know which variable has the | |
563 * fewest bits. Carefully select the smaller and cast it to the type of | |
564 * the larger - this cannot overflow. Do not cast in the following test | |
565 * - it will break on either 16 or 64 bit platforms. | |
566 */ | |
567 if (skip_length < save_size) | |
568 save_size = (png_size_t)skip_length; | |
569 | |
570 else | |
571 skip_length = (png_uint_32)save_size; | |
572 | |
573 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size); | |
574 | |
575 png_ptr->skip_length -= skip_length; | |
576 png_ptr->buffer_size -= save_size; | |
577 png_ptr->save_buffer_size -= save_size; | |
578 png_ptr->save_buffer_ptr += save_size; | |
579 } | |
580 if (png_ptr->skip_length && png_ptr->current_buffer_size) | |
581 { | |
582 png_size_t save_size = png_ptr->current_buffer_size; | |
583 png_uint_32 skip_length = png_ptr->skip_length; | |
584 | |
585 /* We want the smaller of 'skip_length' and 'current_buffer_size', here, | |
586 * the same problem exists as above and the same solution. | |
587 */ | |
588 if (skip_length < save_size) | |
589 save_size = (png_size_t)skip_length; | |
590 | |
591 else | |
592 skip_length = (png_uint_32)save_size; | |
593 | |
594 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size); | |
595 | |
596 png_ptr->skip_length -= skip_length; | |
597 png_ptr->buffer_size -= save_size; | |
598 png_ptr->current_buffer_size -= save_size; | |
599 png_ptr->current_buffer_ptr += save_size; | |
600 } | |
601 if (!png_ptr->skip_length) | |
602 { | |
603 if (png_ptr->buffer_size < 4) | |
604 { | |
605 png_push_save_buffer(png_ptr); | |
606 return; | |
607 } | |
608 | |
609 png_crc_finish(png_ptr, 0); | |
610 png_ptr->process_mode = PNG_READ_CHUNK_MODE; | |
611 } | |
612 } | |
613 | |
614 void PNGCBAPI | 417 void PNGCBAPI |
615 png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length) | 418 png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length) |
616 { | 419 { |
617 png_bytep ptr; | 420 png_bytep ptr; |
618 | 421 |
619 if (png_ptr == NULL) | 422 if (png_ptr == NULL) |
620 return; | 423 return; |
621 | 424 |
622 ptr = buffer; | 425 ptr = buffer; |
623 if (png_ptr->save_buffer_size) | 426 if (png_ptr->save_buffer_size != 0) |
624 { | 427 { |
625 png_size_t save_size; | 428 png_size_t save_size; |
626 | 429 |
627 if (length < png_ptr->save_buffer_size) | 430 if (length < png_ptr->save_buffer_size) |
628 save_size = length; | 431 save_size = length; |
629 | 432 |
630 else | 433 else |
631 save_size = png_ptr->save_buffer_size; | 434 save_size = png_ptr->save_buffer_size; |
632 | 435 |
633 memcpy(ptr, png_ptr->save_buffer_ptr, save_size); | 436 memcpy(ptr, png_ptr->save_buffer_ptr, save_size); |
634 length -= save_size; | 437 length -= save_size; |
635 ptr += save_size; | 438 ptr += save_size; |
636 png_ptr->buffer_size -= save_size; | 439 png_ptr->buffer_size -= save_size; |
637 png_ptr->save_buffer_size -= save_size; | 440 png_ptr->save_buffer_size -= save_size; |
638 png_ptr->save_buffer_ptr += save_size; | 441 png_ptr->save_buffer_ptr += save_size; |
639 } | 442 } |
640 if (length && png_ptr->current_buffer_size) | 443 if (length != 0 && png_ptr->current_buffer_size != 0) |
641 { | 444 { |
642 png_size_t save_size; | 445 png_size_t save_size; |
643 | 446 |
644 if (length < png_ptr->current_buffer_size) | 447 if (length < png_ptr->current_buffer_size) |
645 save_size = length; | 448 save_size = length; |
646 | 449 |
647 else | 450 else |
648 save_size = png_ptr->current_buffer_size; | 451 save_size = png_ptr->current_buffer_size; |
649 | 452 |
650 memcpy(ptr, png_ptr->current_buffer_ptr, save_size); | 453 memcpy(ptr, png_ptr->current_buffer_ptr, save_size); |
651 png_ptr->buffer_size -= save_size; | 454 png_ptr->buffer_size -= save_size; |
652 png_ptr->current_buffer_size -= save_size; | 455 png_ptr->current_buffer_size -= save_size; |
653 png_ptr->current_buffer_ptr += save_size; | 456 png_ptr->current_buffer_ptr += save_size; |
654 } | 457 } |
655 } | 458 } |
656 | 459 |
657 void /* PRIVATE */ | 460 void /* PRIVATE */ |
658 png_push_save_buffer(png_structrp png_ptr) | 461 png_push_save_buffer(png_structrp png_ptr) |
659 { | 462 { |
660 if (png_ptr->save_buffer_size) | 463 if (png_ptr->save_buffer_size != 0) |
661 { | 464 { |
662 if (png_ptr->save_buffer_ptr != png_ptr->save_buffer) | 465 if (png_ptr->save_buffer_ptr != png_ptr->save_buffer) |
663 { | 466 { |
664 png_size_t i, istop; | 467 png_size_t i, istop; |
665 png_bytep sp; | 468 png_bytep sp; |
666 png_bytep dp; | 469 png_bytep dp; |
667 | 470 |
668 istop = png_ptr->save_buffer_size; | 471 istop = png_ptr->save_buffer_size; |
669 for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer; | 472 for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer; |
670 i < istop; i++, sp++, dp++) | 473 i < istop; i++, sp++, dp++) |
(...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
717 { | 520 { |
718 png_ptr->current_buffer = buffer; | 521 png_ptr->current_buffer = buffer; |
719 png_ptr->current_buffer_size = buffer_length; | 522 png_ptr->current_buffer_size = buffer_length; |
720 png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size; | 523 png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size; |
721 png_ptr->current_buffer_ptr = png_ptr->current_buffer; | 524 png_ptr->current_buffer_ptr = png_ptr->current_buffer; |
722 } | 525 } |
723 | 526 |
724 void /* PRIVATE */ | 527 void /* PRIVATE */ |
725 png_push_read_IDAT(png_structrp png_ptr) | 528 png_push_read_IDAT(png_structrp png_ptr) |
726 { | 529 { |
727 if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER)) | 530 if ((png_ptr->mode & PNG_HAVE_CHUNK_HEADER) == 0) |
728 { | 531 { |
729 png_byte chunk_length[4]; | 532 png_byte chunk_length[4]; |
730 png_byte chunk_tag[4]; | 533 png_byte chunk_tag[4]; |
731 | 534 |
732 /* TODO: this code can be commoned up with the same code in push_read */ | 535 /* TODO: this code can be commoned up with the same code in push_read */ |
733 if (png_ptr->buffer_size < 8) | 536 PNG_PUSH_SAVE_BUFFER_IF_LT(8) |
734 { | |
735 png_push_save_buffer(png_ptr); | |
736 return; | |
737 } | |
738 | |
739 png_push_fill_buffer(png_ptr, chunk_length, 4); | 537 png_push_fill_buffer(png_ptr, chunk_length, 4); |
740 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); | 538 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); |
741 png_reset_crc(png_ptr); | 539 png_reset_crc(png_ptr); |
742 png_crc_read(png_ptr, chunk_tag, 4); | 540 png_crc_read(png_ptr, chunk_tag, 4); |
743 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); | 541 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); |
744 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; | 542 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; |
745 | 543 |
746 if (png_ptr->chunk_name != png_IDAT) | 544 if (png_ptr->chunk_name != png_IDAT) |
747 { | 545 { |
748 png_ptr->process_mode = PNG_READ_CHUNK_MODE; | 546 png_ptr->process_mode = PNG_READ_CHUNK_MODE; |
749 | 547 |
750 if (!(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED)) | 548 if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0) |
751 png_error(png_ptr, "Not enough compressed data"); | 549 png_error(png_ptr, "Not enough compressed data"); |
752 | 550 |
753 return; | 551 return; |
754 } | 552 } |
755 | 553 |
756 png_ptr->idat_size = png_ptr->push_length; | 554 png_ptr->idat_size = png_ptr->push_length; |
757 } | 555 } |
758 | 556 |
759 if (png_ptr->idat_size && png_ptr->save_buffer_size) | 557 if (png_ptr->idat_size != 0 && png_ptr->save_buffer_size != 0) |
760 { | 558 { |
761 png_size_t save_size = png_ptr->save_buffer_size; | 559 png_size_t save_size = png_ptr->save_buffer_size; |
762 png_uint_32 idat_size = png_ptr->idat_size; | 560 png_uint_32 idat_size = png_ptr->idat_size; |
763 | 561 |
764 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they | 562 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they |
765 * are of different types and we don't know which variable has the fewest | 563 * are of different types and we don't know which variable has the fewest |
766 * bits. Carefully select the smaller and cast it to the type of the | 564 * bits. Carefully select the smaller and cast it to the type of the |
767 * larger - this cannot overflow. Do not cast in the following test - it | 565 * larger - this cannot overflow. Do not cast in the following test - it |
768 * will break on either 16 or 64 bit platforms. | 566 * will break on either 16-bit or 64-bit platforms. |
769 */ | 567 */ |
770 if (idat_size < save_size) | 568 if (idat_size < save_size) |
771 save_size = (png_size_t)idat_size; | 569 save_size = (png_size_t)idat_size; |
772 | 570 |
773 else | 571 else |
774 idat_size = (png_uint_32)save_size; | 572 idat_size = (png_uint_32)save_size; |
775 | 573 |
776 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size); | 574 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size); |
777 | 575 |
778 png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size); | 576 png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size); |
779 | 577 |
780 png_ptr->idat_size -= idat_size; | 578 png_ptr->idat_size -= idat_size; |
781 png_ptr->buffer_size -= save_size; | 579 png_ptr->buffer_size -= save_size; |
782 png_ptr->save_buffer_size -= save_size; | 580 png_ptr->save_buffer_size -= save_size; |
783 png_ptr->save_buffer_ptr += save_size; | 581 png_ptr->save_buffer_ptr += save_size; |
784 } | 582 } |
785 | 583 |
786 if (png_ptr->idat_size && png_ptr->current_buffer_size) | 584 if (png_ptr->idat_size != 0 && png_ptr->current_buffer_size != 0) |
787 { | 585 { |
788 png_size_t save_size = png_ptr->current_buffer_size; | 586 png_size_t save_size = png_ptr->current_buffer_size; |
789 png_uint_32 idat_size = png_ptr->idat_size; | 587 png_uint_32 idat_size = png_ptr->idat_size; |
790 | 588 |
791 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they | 589 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they |
792 * are of different types and we don't know which variable has the fewest | 590 * are of different types and we don't know which variable has the fewest |
793 * bits. Carefully select the smaller and cast it to the type of the | 591 * bits. Carefully select the smaller and cast it to the type of the |
794 * larger - this cannot overflow. | 592 * larger - this cannot overflow. |
795 */ | 593 */ |
796 if (idat_size < save_size) | 594 if (idat_size < save_size) |
797 save_size = (png_size_t)idat_size; | 595 save_size = (png_size_t)idat_size; |
798 | 596 |
799 else | 597 else |
800 idat_size = (png_uint_32)save_size; | 598 idat_size = (png_uint_32)save_size; |
801 | 599 |
802 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size); | 600 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size); |
803 | 601 |
804 png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size); | 602 png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size); |
805 | 603 |
806 png_ptr->idat_size -= idat_size; | 604 png_ptr->idat_size -= idat_size; |
807 png_ptr->buffer_size -= save_size; | 605 png_ptr->buffer_size -= save_size; |
808 png_ptr->current_buffer_size -= save_size; | 606 png_ptr->current_buffer_size -= save_size; |
809 png_ptr->current_buffer_ptr += save_size; | 607 png_ptr->current_buffer_ptr += save_size; |
810 } | 608 } |
811 if (!png_ptr->idat_size) | 609 |
812 { | 610 if (png_ptr->idat_size == 0) |
813 if (png_ptr->buffer_size < 4) | 611 { |
814 { | 612 PNG_PUSH_SAVE_BUFFER_IF_LT(4) |
815 png_push_save_buffer(png_ptr); | |
816 return; | |
817 } | |
818 | |
819 png_crc_finish(png_ptr, 0); | 613 png_crc_finish(png_ptr, 0); |
820 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; | 614 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; |
821 png_ptr->mode |= PNG_AFTER_IDAT; | 615 png_ptr->mode |= PNG_AFTER_IDAT; |
822 png_ptr->zowner = 0; | 616 png_ptr->zowner = 0; |
823 } | 617 } |
824 } | 618 } |
825 | 619 |
826 void /* PRIVATE */ | 620 void /* PRIVATE */ |
827 png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer, | 621 png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer, |
828 png_size_t buffer_length) | 622 png_size_t buffer_length) |
829 { | 623 { |
830 /* The caller checks for a non-zero buffer length. */ | 624 /* The caller checks for a non-zero buffer length. */ |
831 if (!(buffer_length > 0) || buffer == NULL) | 625 if (!(buffer_length > 0) || buffer == NULL) |
832 png_error(png_ptr, "No IDAT data (internal error)"); | 626 png_error(png_ptr, "No IDAT data (internal error)"); |
833 | 627 |
834 /* This routine must process all the data it has been given | 628 /* This routine must process all the data it has been given |
835 * before returning, calling the row callback as required to | 629 * before returning, calling the row callback as required to |
836 * handle the uncompressed results. | 630 * handle the uncompressed results. |
837 */ | 631 */ |
838 png_ptr->zstream.next_in = buffer; | 632 png_ptr->zstream.next_in = buffer; |
839 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ | 633 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ |
840 png_ptr->zstream.avail_in = (uInt)buffer_length; | 634 png_ptr->zstream.avail_in = (uInt)buffer_length; |
841 | 635 |
842 /* Keep going until the decompressed data is all processed | 636 /* Keep going until the decompressed data is all processed |
843 * or the stream marked as finished. | 637 * or the stream marked as finished. |
844 */ | 638 */ |
845 while (png_ptr->zstream.avail_in > 0 && | 639 while (png_ptr->zstream.avail_in > 0 && |
846 !(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED)) | 640 (png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0) |
847 { | 641 { |
848 int ret; | 642 int ret; |
849 | 643 |
850 /* We have data for zlib, but we must check that zlib | 644 /* We have data for zlib, but we must check that zlib |
851 * has someplace to put the results. It doesn't matter | 645 * has someplace to put the results. It doesn't matter |
852 * if we don't expect any results -- it may be the input | 646 * if we don't expect any results -- it may be the input |
853 * data is just the LZ end code. | 647 * data is just the LZ end code. |
854 */ | 648 */ |
855 if (!(png_ptr->zstream.avail_out > 0)) | 649 if (!(png_ptr->zstream.avail_out > 0)) |
856 { | 650 { |
857 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ | 651 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ |
858 png_ptr->zstream.avail_out = (uInt)(PNG_ROWBYTES(png_ptr->pixel_depth, | 652 png_ptr->zstream.avail_out = (uInt)(PNG_ROWBYTES(png_ptr->pixel_depth, |
859 png_ptr->iwidth) + 1); | 653 png_ptr->iwidth) + 1); |
860 | 654 |
861 png_ptr->zstream.next_out = png_ptr->row_buf; | 655 png_ptr->zstream.next_out = png_ptr->row_buf; |
862 } | 656 } |
863 | 657 |
864 /* Using Z_SYNC_FLUSH here means that an unterminated | 658 /* Using Z_SYNC_FLUSH here means that an unterminated |
865 * LZ stream (a stream with a missing end code) can still | 659 * LZ stream (a stream with a missing end code) can still |
866 * be handled, otherwise (Z_NO_FLUSH) a future zlib | 660 * be handled, otherwise (Z_NO_FLUSH) a future zlib |
867 * implementation might defer output and therefore | 661 * implementation might defer output and therefore |
868 * change the current behavior (see comments in inflate.c | 662 * change the current behavior (see comments in inflate.c |
869 * for why this doesn't happen at present with zlib 1.2.5). | 663 * for why this doesn't happen at present with zlib 1.2.5). |
870 */ | 664 */ |
871 ret = inflate(&png_ptr->zstream, Z_SYNC_FLUSH); | 665 ret = PNG_INFLATE(png_ptr, Z_SYNC_FLUSH); |
872 | 666 |
873 /* Check for any failure before proceeding. */ | 667 /* Check for any failure before proceeding. */ |
874 if (ret != Z_OK && ret != Z_STREAM_END) | 668 if (ret != Z_OK && ret != Z_STREAM_END) |
875 { | 669 { |
876 /* Terminate the decompression. */ | 670 /* Terminate the decompression. */ |
877 png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED; | 671 png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED; |
878 png_ptr->zowner = 0; | 672 png_ptr->zowner = 0; |
879 | 673 |
880 /* This may be a truncated stream (missing or | 674 /* This may be a truncated stream (missing or |
881 * damaged end code). Treat that as a warning. | 675 * damaged end code). Treat that as a warning. |
(...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
953 } | 747 } |
954 | 748 |
955 /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before | 749 /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before |
956 * 1.5.6, while the buffer really is this big in current versions of libpng | 750 * 1.5.6, while the buffer really is this big in current versions of libpng |
957 * it may not be in the future, so this was changed just to copy the | 751 * it may not be in the future, so this was changed just to copy the |
958 * interlaced row count: | 752 * interlaced row count: |
959 */ | 753 */ |
960 memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1); | 754 memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1); |
961 | 755 |
962 #ifdef PNG_READ_TRANSFORMS_SUPPORTED | 756 #ifdef PNG_READ_TRANSFORMS_SUPPORTED |
963 if (png_ptr->transformations) | 757 if (png_ptr->transformations != 0) |
964 png_do_read_transformations(png_ptr, &row_info); | 758 png_do_read_transformations(png_ptr, &row_info); |
965 #endif | 759 #endif |
966 | 760 |
967 /* The transformed pixel depth should match the depth now in row_info. */ | 761 /* The transformed pixel depth should match the depth now in row_info. */ |
968 if (png_ptr->transformed_pixel_depth == 0) | 762 if (png_ptr->transformed_pixel_depth == 0) |
969 { | 763 { |
970 png_ptr->transformed_pixel_depth = row_info.pixel_depth; | 764 png_ptr->transformed_pixel_depth = row_info.pixel_depth; |
971 if (row_info.pixel_depth > png_ptr->maximum_pixel_depth) | 765 if (row_info.pixel_depth > png_ptr->maximum_pixel_depth) |
972 png_error(png_ptr, "progressive row overflow"); | 766 png_error(png_ptr, "progressive row overflow"); |
973 } | 767 } |
974 | 768 |
975 else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth) | 769 else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth) |
976 png_error(png_ptr, "internal progressive row size calculation error"); | 770 png_error(png_ptr, "internal progressive row size calculation error"); |
977 | 771 |
978 | 772 |
979 #ifdef PNG_READ_INTERLACING_SUPPORTED | 773 #ifdef PNG_READ_INTERLACING_SUPPORTED |
980 /* Blow up interlaced rows to full size */ | 774 /* Expand interlaced rows to full size */ |
981 if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE)) | 775 if (png_ptr->interlaced != 0 && |
| 776 (png_ptr->transformations & PNG_INTERLACE) != 0) |
982 { | 777 { |
983 if (png_ptr->pass < 6) | 778 if (png_ptr->pass < 6) |
984 png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass, | 779 png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass, |
985 png_ptr->transformations); | 780 png_ptr->transformations); |
986 | 781 |
987 switch (png_ptr->pass) | 782 switch (png_ptr->pass) |
988 { | 783 { |
989 case 0: | 784 case 0: |
990 { | 785 { |
991 int i; | 786 int i; |
992 for (i = 0; i < 8 && png_ptr->pass == 0; i++) | 787 for (i = 0; i < 8 && png_ptr->pass == 0; i++) |
993 { | 788 { |
994 png_push_have_row(png_ptr, png_ptr->row_buf + 1); | 789 png_push_have_row(png_ptr, png_ptr->row_buf + 1); |
995 png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */ | 790 png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */ |
996 } | 791 } |
997 | 792 |
998 if (png_ptr->pass == 2) /* Pass 1 might be empty */ | 793 if (png_ptr->pass == 2) /* Pass 1 might be empty */ |
(...skipping 182 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1181 * it, uncomment it here and in png.h | 976 * it, uncomment it here and in png.h |
1182 static PNG_CONST png_byte png_pass_height[] = {8, 8, 4, 4, 2, 2, 1}; | 977 static PNG_CONST png_byte png_pass_height[] = {8, 8, 4, 4, 2, 2, 1}; |
1183 */ | 978 */ |
1184 #endif | 979 #endif |
1185 | 980 |
1186 png_ptr->row_number++; | 981 png_ptr->row_number++; |
1187 if (png_ptr->row_number < png_ptr->num_rows) | 982 if (png_ptr->row_number < png_ptr->num_rows) |
1188 return; | 983 return; |
1189 | 984 |
1190 #ifdef PNG_READ_INTERLACING_SUPPORTED | 985 #ifdef PNG_READ_INTERLACING_SUPPORTED |
1191 if (png_ptr->interlaced) | 986 if (png_ptr->interlaced != 0) |
1192 { | 987 { |
1193 png_ptr->row_number = 0; | 988 png_ptr->row_number = 0; |
1194 memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); | 989 memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); |
1195 | 990 |
1196 do | 991 do |
1197 { | 992 { |
1198 png_ptr->pass++; | 993 png_ptr->pass++; |
1199 if ((png_ptr->pass == 1 && png_ptr->width < 5) || | 994 if ((png_ptr->pass == 1 && png_ptr->width < 5) || |
1200 (png_ptr->pass == 3 && png_ptr->width < 3) || | 995 (png_ptr->pass == 3 && png_ptr->width < 3) || |
1201 (png_ptr->pass == 5 && png_ptr->width < 2)) | 996 (png_ptr->pass == 5 && png_ptr->width < 2)) |
1202 png_ptr->pass++; | 997 png_ptr->pass++; |
1203 | 998 |
1204 if (png_ptr->pass > 7) | 999 if (png_ptr->pass > 7) |
1205 png_ptr->pass--; | 1000 png_ptr->pass--; |
1206 | 1001 |
1207 if (png_ptr->pass >= 7) | 1002 if (png_ptr->pass >= 7) |
1208 break; | 1003 break; |
1209 | 1004 |
1210 png_ptr->iwidth = (png_ptr->width + | 1005 png_ptr->iwidth = (png_ptr->width + |
1211 png_pass_inc[png_ptr->pass] - 1 - | 1006 png_pass_inc[png_ptr->pass] - 1 - |
1212 png_pass_start[png_ptr->pass]) / | 1007 png_pass_start[png_ptr->pass]) / |
1213 png_pass_inc[png_ptr->pass]; | 1008 png_pass_inc[png_ptr->pass]; |
1214 | 1009 |
1215 if (png_ptr->transformations & PNG_INTERLACE) | 1010 if ((png_ptr->transformations & PNG_INTERLACE) != 0) |
1216 break; | 1011 break; |
1217 | 1012 |
1218 png_ptr->num_rows = (png_ptr->height + | 1013 png_ptr->num_rows = (png_ptr->height + |
1219 png_pass_yinc[png_ptr->pass] - 1 - | 1014 png_pass_yinc[png_ptr->pass] - 1 - |
1220 png_pass_ystart[png_ptr->pass]) / | 1015 png_pass_ystart[png_ptr->pass]) / |
1221 png_pass_yinc[png_ptr->pass]; | 1016 png_pass_yinc[png_ptr->pass]; |
1222 | 1017 |
1223 } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0); | 1018 } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0); |
1224 } | 1019 } |
1225 #endif /* PNG_READ_INTERLACING_SUPPORTED */ | 1020 #endif /* READ_INTERLACING */ |
1226 } | 1021 } |
1227 | 1022 |
1228 void /* PRIVATE */ | 1023 void /* PRIVATE */ |
1229 png_push_have_info(png_structrp png_ptr, png_inforp info_ptr) | 1024 png_push_have_info(png_structrp png_ptr, png_inforp info_ptr) |
1230 { | 1025 { |
1231 if (png_ptr->info_fn != NULL) | 1026 if (png_ptr->info_fn != NULL) |
1232 (*(png_ptr->info_fn))(png_ptr, info_ptr); | 1027 (*(png_ptr->info_fn))(png_ptr, info_ptr); |
1233 } | 1028 } |
1234 | 1029 |
1235 void /* PRIVATE */ | 1030 void /* PRIVATE */ |
(...skipping 17 matching lines...) Expand all Loading... |
1253 png_const_bytep new_row) | 1048 png_const_bytep new_row) |
1254 { | 1049 { |
1255 if (png_ptr == NULL) | 1050 if (png_ptr == NULL) |
1256 return; | 1051 return; |
1257 | 1052 |
1258 /* new_row is a flag here - if it is NULL then the app callback was called | 1053 /* new_row is a flag here - if it is NULL then the app callback was called |
1259 * from an empty row (see the calls to png_struct::row_fn below), otherwise | 1054 * from an empty row (see the calls to png_struct::row_fn below), otherwise |
1260 * it must be png_ptr->row_buf+1 | 1055 * it must be png_ptr->row_buf+1 |
1261 */ | 1056 */ |
1262 if (new_row != NULL) | 1057 if (new_row != NULL) |
1263 png_combine_row(png_ptr, old_row, 1/*display*/); | 1058 png_combine_row(png_ptr, old_row, 1/*blocky display*/); |
1264 } | 1059 } |
1265 #endif /* PNG_READ_INTERLACING_SUPPORTED */ | 1060 #endif /* READ_INTERLACING */ |
1266 | 1061 |
1267 void PNGAPI | 1062 void PNGAPI |
1268 png_set_progressive_read_fn(png_structrp png_ptr, png_voidp progressive_ptr, | 1063 png_set_progressive_read_fn(png_structrp png_ptr, png_voidp progressive_ptr, |
1269 png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn, | 1064 png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn, |
1270 png_progressive_end_ptr end_fn) | 1065 png_progressive_end_ptr end_fn) |
1271 { | 1066 { |
1272 if (png_ptr == NULL) | 1067 if (png_ptr == NULL) |
1273 return; | 1068 return; |
1274 | 1069 |
1275 png_ptr->info_fn = info_fn; | 1070 png_ptr->info_fn = info_fn; |
1276 png_ptr->row_fn = row_fn; | 1071 png_ptr->row_fn = row_fn; |
1277 png_ptr->end_fn = end_fn; | 1072 png_ptr->end_fn = end_fn; |
1278 | 1073 |
1279 png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer); | 1074 png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer); |
1280 } | 1075 } |
1281 | 1076 |
1282 png_voidp PNGAPI | 1077 png_voidp PNGAPI |
1283 png_get_progressive_ptr(png_const_structrp png_ptr) | 1078 png_get_progressive_ptr(png_const_structrp png_ptr) |
1284 { | 1079 { |
1285 if (png_ptr == NULL) | 1080 if (png_ptr == NULL) |
1286 return (NULL); | 1081 return (NULL); |
1287 | 1082 |
1288 return png_ptr->io_ptr; | 1083 return png_ptr->io_ptr; |
1289 } | 1084 } |
1290 #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */ | 1085 #endif /* PROGRESSIVE_READ */ |
OLD | NEW |