| OLD | NEW |
| 1 |
| 1 /* pngpread.c - read a png file in push mode | 2 /* pngpread.c - read a png file in push mode |
| 2 * | 3 * |
| 3 * Last changed in libpng 1.6.0 [February 14, 2013] | 4 * Last changed in libpng 1.6.18 [July 23, 2015] |
| 4 * Copyright (c) 1998-2013 Glenn Randers-Pehrson | 5 * Copyright (c) 1998-2015 Glenn Randers-Pehrson |
| 5 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) | 6 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) |
| 6 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) | 7 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) |
| 7 * | 8 * |
| 8 * This code is released under the libpng license. | 9 * This code is released under the libpng license. |
| 9 * For conditions of distribution and use, see the disclaimer | 10 * For conditions of distribution and use, see the disclaimer |
| 10 * and license in png.h | 11 * and license in png.h |
| 11 */ | 12 */ |
| 12 | 13 |
| 13 #include "pngpriv.h" | 14 #include "pngpriv.h" |
| 14 | 15 |
| 15 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED | 16 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED |
| 16 | 17 |
| 17 /* Push model modes */ | 18 /* Push model modes */ |
| 18 #define PNG_READ_SIG_MODE 0 | 19 #define PNG_READ_SIG_MODE 0 |
| 19 #define PNG_READ_CHUNK_MODE 1 | 20 #define PNG_READ_CHUNK_MODE 1 |
| 20 #define PNG_READ_IDAT_MODE 2 | 21 #define PNG_READ_IDAT_MODE 2 |
| 21 #define PNG_SKIP_MODE 3 | |
| 22 #define PNG_READ_tEXt_MODE 4 | 22 #define PNG_READ_tEXt_MODE 4 |
| 23 #define PNG_READ_zTXt_MODE 5 | 23 #define PNG_READ_zTXt_MODE 5 |
| 24 #define PNG_READ_DONE_MODE 6 | 24 #define PNG_READ_DONE_MODE 6 |
| 25 #define PNG_READ_iTXt_MODE 7 | 25 #define PNG_READ_iTXt_MODE 7 |
| 26 #define PNG_ERROR_MODE 8 | 26 #define PNG_ERROR_MODE 8 |
| 27 | 27 |
| 28 #define PNG_PUSH_SAVE_BUFFER_IF_FULL \ |
| 29 if (png_ptr->push_length + 4 > png_ptr->buffer_size) \ |
| 30 { png_push_save_buffer(png_ptr); return; } |
| 31 #define PNG_PUSH_SAVE_BUFFER_IF_LT(N) \ |
| 32 if (png_ptr->buffer_size < N) \ |
| 33 { png_push_save_buffer(png_ptr); return; } |
| 34 |
| 28 void PNGAPI | 35 void PNGAPI |
| 29 png_process_data(png_structrp png_ptr, png_inforp info_ptr, | 36 png_process_data(png_structrp png_ptr, png_inforp info_ptr, |
| 30 png_bytep buffer, png_size_t buffer_size) | 37 png_bytep buffer, png_size_t buffer_size) |
| 31 { | 38 { |
| 32 if (png_ptr == NULL || info_ptr == NULL) | 39 if (png_ptr == NULL || info_ptr == NULL) |
| 33 return; | 40 return; |
| 34 | 41 |
| 35 png_push_restore_buffer(png_ptr, buffer, buffer_size); | 42 png_push_restore_buffer(png_ptr, buffer, buffer_size); |
| 36 | 43 |
| 37 while (png_ptr->buffer_size) | 44 while (png_ptr->buffer_size) |
| 38 { | 45 { |
| 39 png_process_some_data(png_ptr, info_ptr); | 46 png_process_some_data(png_ptr, info_ptr); |
| 40 } | 47 } |
| 41 } | 48 } |
| 42 | 49 |
| 43 png_size_t PNGAPI | 50 png_size_t PNGAPI |
| 44 png_process_data_pause(png_structrp png_ptr, int save) | 51 png_process_data_pause(png_structrp png_ptr, int save) |
| 45 { | 52 { |
| 46 if (png_ptr != NULL) | 53 if (png_ptr != NULL) |
| 47 { | 54 { |
| 48 /* It's easiest for the caller if we do the save, then the caller doesn't | 55 /* It's easiest for the caller if we do the save; then the caller doesn't |
| 49 * have to supply the same data again: | 56 * have to supply the same data again: |
| 50 */ | 57 */ |
| 51 if (save) | 58 if (save != 0) |
| 52 png_push_save_buffer(png_ptr); | 59 png_push_save_buffer(png_ptr); |
| 53 else | 60 else |
| 54 { | 61 { |
| 55 /* This includes any pending saved bytes: */ | 62 /* This includes any pending saved bytes: */ |
| 56 png_size_t remaining = png_ptr->buffer_size; | 63 png_size_t remaining = png_ptr->buffer_size; |
| 57 png_ptr->buffer_size = 0; | 64 png_ptr->buffer_size = 0; |
| 58 | 65 |
| 59 /* So subtract the saved buffer size, unless all the data | 66 /* So subtract the saved buffer size, unless all the data |
| 60 * is actually 'saved', in which case we just return 0 | 67 * is actually 'saved', in which case we just return 0 |
| 61 */ | 68 */ |
| 62 if (png_ptr->save_buffer_size < remaining) | 69 if (png_ptr->save_buffer_size < remaining) |
| 63 return remaining - png_ptr->save_buffer_size; | 70 return remaining - png_ptr->save_buffer_size; |
| 64 } | 71 } |
| 65 } | 72 } |
| 66 | 73 |
| 67 return 0; | 74 return 0; |
| 68 } | 75 } |
| 69 | 76 |
| 70 png_uint_32 PNGAPI | 77 png_uint_32 PNGAPI |
| 71 png_process_data_skip(png_structrp png_ptr) | 78 png_process_data_skip(png_structrp png_ptr) |
| 72 { | 79 { |
| 73 png_uint_32 remaining = 0; | 80 /* TODO: Deprecate and remove this API. |
| 74 | 81 * Somewhere the implementation of this seems to have been lost, |
| 75 if (png_ptr != NULL && png_ptr->process_mode == PNG_SKIP_MODE && | 82 * or abandoned. It was only to support some internal back-door access |
| 76 png_ptr->skip_length > 0) | 83 * to png_struct) in libpng-1.4.x. |
| 77 { | 84 */ |
| 78 /* At the end of png_process_data the buffer size must be 0 (see the loop | 85 png_app_warning(png_ptr, |
| 79 * above) so we can detect a broken call here: | 86 "png_process_data_skip is not implemented in any current version of libpng"); |
| 80 */ | 87 return 0; |
| 81 if (png_ptr->buffer_size != 0) | |
| 82 png_error(png_ptr, | |
| 83 "png_process_data_skip called inside png_process_data"); | |
| 84 | |
| 85 /* If is impossible for there to be a saved buffer at this point - | |
| 86 * otherwise we could not be in SKIP mode. This will also happen if | |
| 87 * png_process_skip is called inside png_process_data (but only very | |
| 88 * rarely.) | |
| 89 */ | |
| 90 if (png_ptr->save_buffer_size != 0) | |
| 91 png_error(png_ptr, "png_process_data_skip called with saved data"); | |
| 92 | |
| 93 remaining = png_ptr->skip_length; | |
| 94 png_ptr->skip_length = 0; | |
| 95 png_ptr->process_mode = PNG_READ_CHUNK_MODE; | |
| 96 } | |
| 97 | |
| 98 return remaining; | |
| 99 } | 88 } |
| 100 | 89 |
| 101 /* What we do with the incoming data depends on what we were previously | 90 /* What we do with the incoming data depends on what we were previously |
| 102 * doing before we ran out of data... | 91 * doing before we ran out of data... |
| 103 */ | 92 */ |
| 104 void /* PRIVATE */ | 93 void /* PRIVATE */ |
| 105 png_process_some_data(png_structrp png_ptr, png_inforp info_ptr) | 94 png_process_some_data(png_structrp png_ptr, png_inforp info_ptr) |
| 106 { | 95 { |
| 107 if (png_ptr == NULL) | 96 if (png_ptr == NULL) |
| 108 return; | 97 return; |
| (...skipping 11 matching lines...) Expand all Loading... |
| 120 png_push_read_chunk(png_ptr, info_ptr); | 109 png_push_read_chunk(png_ptr, info_ptr); |
| 121 break; | 110 break; |
| 122 } | 111 } |
| 123 | 112 |
| 124 case PNG_READ_IDAT_MODE: | 113 case PNG_READ_IDAT_MODE: |
| 125 { | 114 { |
| 126 png_push_read_IDAT(png_ptr); | 115 png_push_read_IDAT(png_ptr); |
| 127 break; | 116 break; |
| 128 } | 117 } |
| 129 | 118 |
| 130 case PNG_SKIP_MODE: | |
| 131 { | |
| 132 png_push_crc_finish(png_ptr); | |
| 133 break; | |
| 134 } | |
| 135 | |
| 136 default: | 119 default: |
| 137 { | 120 { |
| 138 png_ptr->buffer_size = 0; | 121 png_ptr->buffer_size = 0; |
| 139 break; | 122 break; |
| 140 } | 123 } |
| 141 } | 124 } |
| 142 } | 125 } |
| 143 | 126 |
| 144 /* Read any remaining signature bytes from the stream and compare them with | 127 /* Read any remaining signature bytes from the stream and compare them with |
| 145 * the correct PNG signature. It is possible that this routine is called | 128 * the correct PNG signature. It is possible that this routine is called |
| 146 * with bytes already read from the signature, either because they have been | 129 * with bytes already read from the signature, either because they have been |
| 147 * checked by the calling application, or because of multiple calls to this | 130 * checked by the calling application, or because of multiple calls to this |
| 148 * routine. | 131 * routine. |
| 149 */ | 132 */ |
| 150 void /* PRIVATE */ | 133 void /* PRIVATE */ |
| 151 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr) | 134 png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr) |
| 152 { | 135 { |
| 153 png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ | 136 png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */ |
| 154 num_to_check = 8 - num_checked; | 137 num_to_check = 8 - num_checked; |
| 155 | 138 |
| 156 if (png_ptr->buffer_size < num_to_check) | 139 if (png_ptr->buffer_size < num_to_check) |
| 157 { | 140 { |
| 158 num_to_check = png_ptr->buffer_size; | 141 num_to_check = png_ptr->buffer_size; |
| 159 } | 142 } |
| 160 | 143 |
| 161 png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]), | 144 png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]), |
| 162 num_to_check); | 145 num_to_check); |
| 163 png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check); | 146 png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check); |
| 164 | 147 |
| (...skipping 16 matching lines...) Expand all Loading... |
| 181 } | 164 } |
| 182 | 165 |
| 183 void /* PRIVATE */ | 166 void /* PRIVATE */ |
| 184 png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr) | 167 png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr) |
| 185 { | 168 { |
| 186 png_uint_32 chunk_name; | 169 png_uint_32 chunk_name; |
| 187 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED | 170 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED |
| 188 int keep; /* unknown handling method */ | 171 int keep; /* unknown handling method */ |
| 189 #endif | 172 #endif |
| 190 | 173 |
| 191 /* First we make sure we have enough data for the 4 byte chunk name | 174 /* First we make sure we have enough data for the 4-byte chunk name |
| 192 * and the 4 byte chunk length before proceeding with decoding the | 175 * and the 4-byte chunk length before proceeding with decoding the |
| 193 * chunk data. To fully decode each of these chunks, we also make | 176 * chunk data. To fully decode each of these chunks, we also make |
| 194 * sure we have enough data in the buffer for the 4 byte CRC at the | 177 * sure we have enough data in the buffer for the 4-byte CRC at the |
| 195 * end of every chunk (except IDAT, which is handled separately). | 178 * end of every chunk (except IDAT, which is handled separately). |
| 196 */ | 179 */ |
| 197 if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER)) | 180 if ((png_ptr->mode & PNG_HAVE_CHUNK_HEADER) == 0) |
| 198 { | 181 { |
| 199 png_byte chunk_length[4]; | 182 png_byte chunk_length[4]; |
| 200 png_byte chunk_tag[4]; | 183 png_byte chunk_tag[4]; |
| 201 | 184 |
| 202 if (png_ptr->buffer_size < 8) | 185 PNG_PUSH_SAVE_BUFFER_IF_LT(8) |
| 203 { | |
| 204 png_push_save_buffer(png_ptr); | |
| 205 return; | |
| 206 } | |
| 207 | |
| 208 png_push_fill_buffer(png_ptr, chunk_length, 4); | 186 png_push_fill_buffer(png_ptr, chunk_length, 4); |
| 209 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); | 187 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); |
| 210 png_reset_crc(png_ptr); | 188 png_reset_crc(png_ptr); |
| 211 png_crc_read(png_ptr, chunk_tag, 4); | 189 png_crc_read(png_ptr, chunk_tag, 4); |
| 212 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); | 190 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); |
| 213 png_check_chunk_name(png_ptr, png_ptr->chunk_name); | 191 png_check_chunk_name(png_ptr, png_ptr->chunk_name); |
| 214 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; | 192 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; |
| 215 } | 193 } |
| 216 | 194 |
| 217 chunk_name = png_ptr->chunk_name; | 195 chunk_name = png_ptr->chunk_name; |
| 218 | 196 |
| 219 if (chunk_name == png_IDAT) | 197 if (chunk_name == png_IDAT) |
| 220 { | 198 { |
| 221 if (png_ptr->mode & PNG_AFTER_IDAT) | 199 if ((png_ptr->mode & PNG_AFTER_IDAT) != 0) |
| 222 png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT; | 200 png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT; |
| 223 | 201 |
| 224 /* If we reach an IDAT chunk, this means we have read all of the | 202 /* If we reach an IDAT chunk, this means we have read all of the |
| 225 * header chunks, and we can start reading the image (or if this | 203 * header chunks, and we can start reading the image (or if this |
| 226 * is called after the image has been read - we have an error). | 204 * is called after the image has been read - we have an error). |
| 227 */ | 205 */ |
| 228 if (!(png_ptr->mode & PNG_HAVE_IHDR)) | 206 if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) |
| 229 png_error(png_ptr, "Missing IHDR before IDAT"); | 207 png_error(png_ptr, "Missing IHDR before IDAT"); |
| 230 | 208 |
| 231 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE && | 209 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE && |
| 232 !(png_ptr->mode & PNG_HAVE_PLTE)) | 210 (png_ptr->mode & PNG_HAVE_PLTE) == 0) |
| 233 png_error(png_ptr, "Missing PLTE before IDAT"); | 211 png_error(png_ptr, "Missing PLTE before IDAT"); |
| 234 | 212 |
| 235 png_ptr->mode |= PNG_HAVE_IDAT; | 213 png_ptr->mode |= PNG_HAVE_IDAT; |
| 236 | 214 png_ptr->process_mode = PNG_READ_IDAT_MODE; |
| 237 if (!(png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT)) | 215 |
| 216 if ((png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) == 0) |
| 238 if (png_ptr->push_length == 0) | 217 if (png_ptr->push_length == 0) |
| 239 return; | 218 return; |
| 240 | 219 |
| 241 if (png_ptr->mode & PNG_AFTER_IDAT) | 220 if ((png_ptr->mode & PNG_AFTER_IDAT) != 0) |
| 242 png_benign_error(png_ptr, "Too many IDATs found"); | 221 png_benign_error(png_ptr, "Too many IDATs found"); |
| 243 } | 222 } |
| 244 | 223 |
| 245 if (chunk_name == png_IHDR) | 224 if (chunk_name == png_IHDR) |
| 246 { | 225 { |
| 247 if (png_ptr->push_length != 13) | 226 if (png_ptr->push_length != 13) |
| 248 png_error(png_ptr, "Invalid IHDR length"); | 227 png_error(png_ptr, "Invalid IHDR length"); |
| 249 | 228 |
| 250 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 229 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 251 { | |
| 252 png_push_save_buffer(png_ptr); | |
| 253 return; | |
| 254 } | |
| 255 | |
| 256 png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length); | 230 png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length); |
| 257 } | 231 } |
| 258 | 232 |
| 259 else if (chunk_name == png_IEND) | 233 else if (chunk_name == png_IEND) |
| 260 { | 234 { |
| 261 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 235 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 262 { | |
| 263 png_push_save_buffer(png_ptr); | |
| 264 return; | |
| 265 } | |
| 266 | |
| 267 png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length); | 236 png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length); |
| 268 | 237 |
| 269 png_ptr->process_mode = PNG_READ_DONE_MODE; | 238 png_ptr->process_mode = PNG_READ_DONE_MODE; |
| 270 png_push_have_end(png_ptr, info_ptr); | 239 png_push_have_end(png_ptr, info_ptr); |
| 271 } | 240 } |
| 272 | 241 |
| 273 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED | 242 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED |
| 274 else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0) | 243 else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0) |
| 275 { | 244 { |
| 276 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 245 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 277 { | |
| 278 png_push_save_buffer(png_ptr); | |
| 279 return; | |
| 280 } | |
| 281 | |
| 282 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, keep); | 246 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, keep); |
| 283 | 247 |
| 284 if (chunk_name == png_PLTE) | 248 if (chunk_name == png_PLTE) |
| 285 png_ptr->mode |= PNG_HAVE_PLTE; | 249 png_ptr->mode |= PNG_HAVE_PLTE; |
| 286 } | 250 } |
| 287 | 251 #endif |
| 288 #endif | 252 |
| 289 else if (chunk_name == png_PLTE) | 253 else if (chunk_name == png_PLTE) |
| 290 { | 254 { |
| 291 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 255 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 292 { | |
| 293 png_push_save_buffer(png_ptr); | |
| 294 return; | |
| 295 } | |
| 296 png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length); | 256 png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length); |
| 297 } | 257 } |
| 298 | 258 |
| 299 else if (chunk_name == png_IDAT) | 259 else if (chunk_name == png_IDAT) |
| 300 { | 260 { |
| 301 png_ptr->idat_size = png_ptr->push_length; | 261 png_ptr->idat_size = png_ptr->push_length; |
| 302 png_ptr->process_mode = PNG_READ_IDAT_MODE; | 262 png_ptr->process_mode = PNG_READ_IDAT_MODE; |
| 303 png_push_have_info(png_ptr, info_ptr); | 263 png_push_have_info(png_ptr, info_ptr); |
| 304 png_ptr->zstream.avail_out = | 264 png_ptr->zstream.avail_out = |
| 305 (uInt) PNG_ROWBYTES(png_ptr->pixel_depth, | 265 (uInt) PNG_ROWBYTES(png_ptr->pixel_depth, |
| 306 png_ptr->iwidth) + 1; | 266 png_ptr->iwidth) + 1; |
| 307 png_ptr->zstream.next_out = png_ptr->row_buf; | 267 png_ptr->zstream.next_out = png_ptr->row_buf; |
| 308 return; | 268 return; |
| 309 } | 269 } |
| 310 | 270 |
| 311 #ifdef PNG_READ_gAMA_SUPPORTED | 271 #ifdef PNG_READ_gAMA_SUPPORTED |
| 312 else if (png_ptr->chunk_name == png_gAMA) | 272 else if (png_ptr->chunk_name == png_gAMA) |
| 313 { | 273 { |
| 314 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 274 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 315 { | |
| 316 png_push_save_buffer(png_ptr); | |
| 317 return; | |
| 318 } | |
| 319 | |
| 320 png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length); | 275 png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length); |
| 321 } | 276 } |
| 322 | 277 |
| 323 #endif | 278 #endif |
| 324 #ifdef PNG_READ_sBIT_SUPPORTED | 279 #ifdef PNG_READ_sBIT_SUPPORTED |
| 325 else if (png_ptr->chunk_name == png_sBIT) | 280 else if (png_ptr->chunk_name == png_sBIT) |
| 326 { | 281 { |
| 327 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 282 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 328 { | |
| 329 png_push_save_buffer(png_ptr); | |
| 330 return; | |
| 331 } | |
| 332 | |
| 333 png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length); | 283 png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length); |
| 334 } | 284 } |
| 335 | 285 |
| 336 #endif | 286 #endif |
| 337 #ifdef PNG_READ_cHRM_SUPPORTED | 287 #ifdef PNG_READ_cHRM_SUPPORTED |
| 338 else if (png_ptr->chunk_name == png_cHRM) | 288 else if (png_ptr->chunk_name == png_cHRM) |
| 339 { | 289 { |
| 340 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 290 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 341 { | |
| 342 png_push_save_buffer(png_ptr); | |
| 343 return; | |
| 344 } | |
| 345 | |
| 346 png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length); | 291 png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length); |
| 347 } | 292 } |
| 348 | 293 |
| 349 #endif | 294 #endif |
| 350 #ifdef PNG_READ_sRGB_SUPPORTED | 295 #ifdef PNG_READ_sRGB_SUPPORTED |
| 351 else if (chunk_name == png_sRGB) | 296 else if (chunk_name == png_sRGB) |
| 352 { | 297 { |
| 353 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 298 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 354 { | |
| 355 png_push_save_buffer(png_ptr); | |
| 356 return; | |
| 357 } | |
| 358 | |
| 359 png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length); | 299 png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length); |
| 360 } | 300 } |
| 361 | 301 |
| 362 #endif | 302 #endif |
| 363 #ifdef PNG_READ_iCCP_SUPPORTED | 303 #ifdef PNG_READ_iCCP_SUPPORTED |
| 364 else if (png_ptr->chunk_name == png_iCCP) | 304 else if (png_ptr->chunk_name == png_iCCP) |
| 365 { | 305 { |
| 366 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 306 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 367 { | |
| 368 png_push_save_buffer(png_ptr); | |
| 369 return; | |
| 370 } | |
| 371 | |
| 372 png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length); | 307 png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length); |
| 373 } | 308 } |
| 374 | 309 |
| 375 #endif | 310 #endif |
| 376 #ifdef PNG_READ_sPLT_SUPPORTED | 311 #ifdef PNG_READ_sPLT_SUPPORTED |
| 377 else if (chunk_name == png_sPLT) | 312 else if (chunk_name == png_sPLT) |
| 378 { | 313 { |
| 379 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 314 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 380 { | |
| 381 png_push_save_buffer(png_ptr); | |
| 382 return; | |
| 383 } | |
| 384 | |
| 385 png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length); | 315 png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length); |
| 386 } | 316 } |
| 387 | 317 |
| 388 #endif | 318 #endif |
| 389 #ifdef PNG_READ_tRNS_SUPPORTED | 319 #ifdef PNG_READ_tRNS_SUPPORTED |
| 390 else if (chunk_name == png_tRNS) | 320 else if (chunk_name == png_tRNS) |
| 391 { | 321 { |
| 392 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 322 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 393 { | |
| 394 png_push_save_buffer(png_ptr); | |
| 395 return; | |
| 396 } | |
| 397 | |
| 398 png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length); | 323 png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length); |
| 399 } | 324 } |
| 400 | 325 |
| 401 #endif | 326 #endif |
| 402 #ifdef PNG_READ_bKGD_SUPPORTED | 327 #ifdef PNG_READ_bKGD_SUPPORTED |
| 403 else if (chunk_name == png_bKGD) | 328 else if (chunk_name == png_bKGD) |
| 404 { | 329 { |
| 405 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 330 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 406 { | |
| 407 png_push_save_buffer(png_ptr); | |
| 408 return; | |
| 409 } | |
| 410 | |
| 411 png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length); | 331 png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length); |
| 412 } | 332 } |
| 413 | 333 |
| 414 #endif | 334 #endif |
| 415 #ifdef PNG_READ_hIST_SUPPORTED | 335 #ifdef PNG_READ_hIST_SUPPORTED |
| 416 else if (chunk_name == png_hIST) | 336 else if (chunk_name == png_hIST) |
| 417 { | 337 { |
| 418 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 338 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 419 { | |
| 420 png_push_save_buffer(png_ptr); | |
| 421 return; | |
| 422 } | |
| 423 | |
| 424 png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length); | 339 png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length); |
| 425 } | 340 } |
| 426 | 341 |
| 427 #endif | 342 #endif |
| 428 #ifdef PNG_READ_pHYs_SUPPORTED | 343 #ifdef PNG_READ_pHYs_SUPPORTED |
| 429 else if (chunk_name == png_pHYs) | 344 else if (chunk_name == png_pHYs) |
| 430 { | 345 { |
| 431 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 346 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 432 { | |
| 433 png_push_save_buffer(png_ptr); | |
| 434 return; | |
| 435 } | |
| 436 | |
| 437 png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length); | 347 png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length); |
| 438 } | 348 } |
| 439 | 349 |
| 440 #endif | 350 #endif |
| 441 #ifdef PNG_READ_oFFs_SUPPORTED | 351 #ifdef PNG_READ_oFFs_SUPPORTED |
| 442 else if (chunk_name == png_oFFs) | 352 else if (chunk_name == png_oFFs) |
| 443 { | 353 { |
| 444 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 354 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 445 { | |
| 446 png_push_save_buffer(png_ptr); | |
| 447 return; | |
| 448 } | |
| 449 | |
| 450 png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length); | 355 png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length); |
| 451 } | 356 } |
| 452 #endif | 357 #endif |
| 453 | 358 |
| 454 #ifdef PNG_READ_pCAL_SUPPORTED | 359 #ifdef PNG_READ_pCAL_SUPPORTED |
| 455 else if (chunk_name == png_pCAL) | 360 else if (chunk_name == png_pCAL) |
| 456 { | 361 { |
| 457 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 362 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 458 { | |
| 459 png_push_save_buffer(png_ptr); | |
| 460 return; | |
| 461 } | |
| 462 | |
| 463 png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length); | 363 png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length); |
| 464 } | 364 } |
| 465 | 365 |
| 466 #endif | 366 #endif |
| 467 #ifdef PNG_READ_sCAL_SUPPORTED | 367 #ifdef PNG_READ_sCAL_SUPPORTED |
| 468 else if (chunk_name == png_sCAL) | 368 else if (chunk_name == png_sCAL) |
| 469 { | 369 { |
| 470 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 370 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 471 { | |
| 472 png_push_save_buffer(png_ptr); | |
| 473 return; | |
| 474 } | |
| 475 | |
| 476 png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length); | 371 png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length); |
| 477 } | 372 } |
| 478 | 373 |
| 479 #endif | 374 #endif |
| 480 #ifdef PNG_READ_tIME_SUPPORTED | 375 #ifdef PNG_READ_tIME_SUPPORTED |
| 481 else if (chunk_name == png_tIME) | 376 else if (chunk_name == png_tIME) |
| 482 { | 377 { |
| 483 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 378 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 484 { | |
| 485 png_push_save_buffer(png_ptr); | |
| 486 return; | |
| 487 } | |
| 488 | |
| 489 png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length); | 379 png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length); |
| 490 } | 380 } |
| 491 | 381 |
| 492 #endif | 382 #endif |
| 493 #ifdef PNG_READ_tEXt_SUPPORTED | 383 #ifdef PNG_READ_tEXt_SUPPORTED |
| 494 else if (chunk_name == png_tEXt) | 384 else if (chunk_name == png_tEXt) |
| 495 { | 385 { |
| 496 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 386 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 497 { | |
| 498 png_push_save_buffer(png_ptr); | |
| 499 return; | |
| 500 } | |
| 501 | |
| 502 png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length); | 387 png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length); |
| 503 } | 388 } |
| 504 | 389 |
| 505 #endif | 390 #endif |
| 506 #ifdef PNG_READ_zTXt_SUPPORTED | 391 #ifdef PNG_READ_zTXt_SUPPORTED |
| 507 else if (chunk_name == png_zTXt) | 392 else if (chunk_name == png_zTXt) |
| 508 { | 393 { |
| 509 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 394 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 510 { | |
| 511 png_push_save_buffer(png_ptr); | |
| 512 return; | |
| 513 } | |
| 514 | |
| 515 png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length); | 395 png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length); |
| 516 } | 396 } |
| 517 | 397 |
| 518 #endif | 398 #endif |
| 519 #ifdef PNG_READ_iTXt_SUPPORTED | 399 #ifdef PNG_READ_iTXt_SUPPORTED |
| 520 else if (chunk_name == png_iTXt) | 400 else if (chunk_name == png_iTXt) |
| 521 { | 401 { |
| 522 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 402 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 523 { | |
| 524 png_push_save_buffer(png_ptr); | |
| 525 return; | |
| 526 } | |
| 527 | |
| 528 png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length); | 403 png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length); |
| 529 } | 404 } |
| 530 | 405 #endif |
| 531 #endif | 406 |
| 532 else | 407 else |
| 533 { | 408 { |
| 534 if (png_ptr->push_length + 4 > png_ptr->buffer_size) | 409 PNG_PUSH_SAVE_BUFFER_IF_FULL |
| 535 { | |
| 536 png_push_save_buffer(png_ptr); | |
| 537 return; | |
| 538 } | |
| 539 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, | 410 png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, |
| 540 PNG_HANDLE_CHUNK_AS_DEFAULT); | 411 PNG_HANDLE_CHUNK_AS_DEFAULT); |
| 541 } | 412 } |
| 542 | 413 |
| 543 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; | 414 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; |
| 544 } | 415 } |
| 545 | 416 |
| 546 void /* PRIVATE */ | |
| 547 png_push_crc_skip(png_structrp png_ptr, png_uint_32 skip) | |
| 548 { | |
| 549 png_ptr->process_mode = PNG_SKIP_MODE; | |
| 550 png_ptr->skip_length = skip; | |
| 551 } | |
| 552 | |
| 553 void /* PRIVATE */ | |
| 554 png_push_crc_finish(png_structrp png_ptr) | |
| 555 { | |
| 556 if (png_ptr->skip_length && png_ptr->save_buffer_size) | |
| 557 { | |
| 558 png_size_t save_size = png_ptr->save_buffer_size; | |
| 559 png_uint_32 skip_length = png_ptr->skip_length; | |
| 560 | |
| 561 /* We want the smaller of 'skip_length' and 'save_buffer_size', but | |
| 562 * they are of different types and we don't know which variable has the | |
| 563 * fewest bits. Carefully select the smaller and cast it to the type of | |
| 564 * the larger - this cannot overflow. Do not cast in the following test | |
| 565 * - it will break on either 16 or 64 bit platforms. | |
| 566 */ | |
| 567 if (skip_length < save_size) | |
| 568 save_size = (png_size_t)skip_length; | |
| 569 | |
| 570 else | |
| 571 skip_length = (png_uint_32)save_size; | |
| 572 | |
| 573 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size); | |
| 574 | |
| 575 png_ptr->skip_length -= skip_length; | |
| 576 png_ptr->buffer_size -= save_size; | |
| 577 png_ptr->save_buffer_size -= save_size; | |
| 578 png_ptr->save_buffer_ptr += save_size; | |
| 579 } | |
| 580 if (png_ptr->skip_length && png_ptr->current_buffer_size) | |
| 581 { | |
| 582 png_size_t save_size = png_ptr->current_buffer_size; | |
| 583 png_uint_32 skip_length = png_ptr->skip_length; | |
| 584 | |
| 585 /* We want the smaller of 'skip_length' and 'current_buffer_size', here, | |
| 586 * the same problem exists as above and the same solution. | |
| 587 */ | |
| 588 if (skip_length < save_size) | |
| 589 save_size = (png_size_t)skip_length; | |
| 590 | |
| 591 else | |
| 592 skip_length = (png_uint_32)save_size; | |
| 593 | |
| 594 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size); | |
| 595 | |
| 596 png_ptr->skip_length -= skip_length; | |
| 597 png_ptr->buffer_size -= save_size; | |
| 598 png_ptr->current_buffer_size -= save_size; | |
| 599 png_ptr->current_buffer_ptr += save_size; | |
| 600 } | |
| 601 if (!png_ptr->skip_length) | |
| 602 { | |
| 603 if (png_ptr->buffer_size < 4) | |
| 604 { | |
| 605 png_push_save_buffer(png_ptr); | |
| 606 return; | |
| 607 } | |
| 608 | |
| 609 png_crc_finish(png_ptr, 0); | |
| 610 png_ptr->process_mode = PNG_READ_CHUNK_MODE; | |
| 611 } | |
| 612 } | |
| 613 | |
| 614 void PNGCBAPI | 417 void PNGCBAPI |
| 615 png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length) | 418 png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length) |
| 616 { | 419 { |
| 617 png_bytep ptr; | 420 png_bytep ptr; |
| 618 | 421 |
| 619 if (png_ptr == NULL) | 422 if (png_ptr == NULL) |
| 620 return; | 423 return; |
| 621 | 424 |
| 622 ptr = buffer; | 425 ptr = buffer; |
| 623 if (png_ptr->save_buffer_size) | 426 if (png_ptr->save_buffer_size != 0) |
| 624 { | 427 { |
| 625 png_size_t save_size; | 428 png_size_t save_size; |
| 626 | 429 |
| 627 if (length < png_ptr->save_buffer_size) | 430 if (length < png_ptr->save_buffer_size) |
| 628 save_size = length; | 431 save_size = length; |
| 629 | 432 |
| 630 else | 433 else |
| 631 save_size = png_ptr->save_buffer_size; | 434 save_size = png_ptr->save_buffer_size; |
| 632 | 435 |
| 633 memcpy(ptr, png_ptr->save_buffer_ptr, save_size); | 436 memcpy(ptr, png_ptr->save_buffer_ptr, save_size); |
| 634 length -= save_size; | 437 length -= save_size; |
| 635 ptr += save_size; | 438 ptr += save_size; |
| 636 png_ptr->buffer_size -= save_size; | 439 png_ptr->buffer_size -= save_size; |
| 637 png_ptr->save_buffer_size -= save_size; | 440 png_ptr->save_buffer_size -= save_size; |
| 638 png_ptr->save_buffer_ptr += save_size; | 441 png_ptr->save_buffer_ptr += save_size; |
| 639 } | 442 } |
| 640 if (length && png_ptr->current_buffer_size) | 443 if (length != 0 && png_ptr->current_buffer_size != 0) |
| 641 { | 444 { |
| 642 png_size_t save_size; | 445 png_size_t save_size; |
| 643 | 446 |
| 644 if (length < png_ptr->current_buffer_size) | 447 if (length < png_ptr->current_buffer_size) |
| 645 save_size = length; | 448 save_size = length; |
| 646 | 449 |
| 647 else | 450 else |
| 648 save_size = png_ptr->current_buffer_size; | 451 save_size = png_ptr->current_buffer_size; |
| 649 | 452 |
| 650 memcpy(ptr, png_ptr->current_buffer_ptr, save_size); | 453 memcpy(ptr, png_ptr->current_buffer_ptr, save_size); |
| 651 png_ptr->buffer_size -= save_size; | 454 png_ptr->buffer_size -= save_size; |
| 652 png_ptr->current_buffer_size -= save_size; | 455 png_ptr->current_buffer_size -= save_size; |
| 653 png_ptr->current_buffer_ptr += save_size; | 456 png_ptr->current_buffer_ptr += save_size; |
| 654 } | 457 } |
| 655 } | 458 } |
| 656 | 459 |
| 657 void /* PRIVATE */ | 460 void /* PRIVATE */ |
| 658 png_push_save_buffer(png_structrp png_ptr) | 461 png_push_save_buffer(png_structrp png_ptr) |
| 659 { | 462 { |
| 660 if (png_ptr->save_buffer_size) | 463 if (png_ptr->save_buffer_size != 0) |
| 661 { | 464 { |
| 662 if (png_ptr->save_buffer_ptr != png_ptr->save_buffer) | 465 if (png_ptr->save_buffer_ptr != png_ptr->save_buffer) |
| 663 { | 466 { |
| 664 png_size_t i, istop; | 467 png_size_t i, istop; |
| 665 png_bytep sp; | 468 png_bytep sp; |
| 666 png_bytep dp; | 469 png_bytep dp; |
| 667 | 470 |
| 668 istop = png_ptr->save_buffer_size; | 471 istop = png_ptr->save_buffer_size; |
| 669 for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer; | 472 for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer; |
| 670 i < istop; i++, sp++, dp++) | 473 i < istop; i++, sp++, dp++) |
| (...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 717 { | 520 { |
| 718 png_ptr->current_buffer = buffer; | 521 png_ptr->current_buffer = buffer; |
| 719 png_ptr->current_buffer_size = buffer_length; | 522 png_ptr->current_buffer_size = buffer_length; |
| 720 png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size; | 523 png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size; |
| 721 png_ptr->current_buffer_ptr = png_ptr->current_buffer; | 524 png_ptr->current_buffer_ptr = png_ptr->current_buffer; |
| 722 } | 525 } |
| 723 | 526 |
| 724 void /* PRIVATE */ | 527 void /* PRIVATE */ |
| 725 png_push_read_IDAT(png_structrp png_ptr) | 528 png_push_read_IDAT(png_structrp png_ptr) |
| 726 { | 529 { |
| 727 if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER)) | 530 if ((png_ptr->mode & PNG_HAVE_CHUNK_HEADER) == 0) |
| 728 { | 531 { |
| 729 png_byte chunk_length[4]; | 532 png_byte chunk_length[4]; |
| 730 png_byte chunk_tag[4]; | 533 png_byte chunk_tag[4]; |
| 731 | 534 |
| 732 /* TODO: this code can be commoned up with the same code in push_read */ | 535 /* TODO: this code can be commoned up with the same code in push_read */ |
| 733 if (png_ptr->buffer_size < 8) | 536 PNG_PUSH_SAVE_BUFFER_IF_LT(8) |
| 734 { | |
| 735 png_push_save_buffer(png_ptr); | |
| 736 return; | |
| 737 } | |
| 738 | |
| 739 png_push_fill_buffer(png_ptr, chunk_length, 4); | 537 png_push_fill_buffer(png_ptr, chunk_length, 4); |
| 740 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); | 538 png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); |
| 741 png_reset_crc(png_ptr); | 539 png_reset_crc(png_ptr); |
| 742 png_crc_read(png_ptr, chunk_tag, 4); | 540 png_crc_read(png_ptr, chunk_tag, 4); |
| 743 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); | 541 png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); |
| 744 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; | 542 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; |
| 745 | 543 |
| 746 if (png_ptr->chunk_name != png_IDAT) | 544 if (png_ptr->chunk_name != png_IDAT) |
| 747 { | 545 { |
| 748 png_ptr->process_mode = PNG_READ_CHUNK_MODE; | 546 png_ptr->process_mode = PNG_READ_CHUNK_MODE; |
| 749 | 547 |
| 750 if (!(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED)) | 548 if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0) |
| 751 png_error(png_ptr, "Not enough compressed data"); | 549 png_error(png_ptr, "Not enough compressed data"); |
| 752 | 550 |
| 753 return; | 551 return; |
| 754 } | 552 } |
| 755 | 553 |
| 756 png_ptr->idat_size = png_ptr->push_length; | 554 png_ptr->idat_size = png_ptr->push_length; |
| 757 } | 555 } |
| 758 | 556 |
| 759 if (png_ptr->idat_size && png_ptr->save_buffer_size) | 557 if (png_ptr->idat_size != 0 && png_ptr->save_buffer_size != 0) |
| 760 { | 558 { |
| 761 png_size_t save_size = png_ptr->save_buffer_size; | 559 png_size_t save_size = png_ptr->save_buffer_size; |
| 762 png_uint_32 idat_size = png_ptr->idat_size; | 560 png_uint_32 idat_size = png_ptr->idat_size; |
| 763 | 561 |
| 764 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they | 562 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they |
| 765 * are of different types and we don't know which variable has the fewest | 563 * are of different types and we don't know which variable has the fewest |
| 766 * bits. Carefully select the smaller and cast it to the type of the | 564 * bits. Carefully select the smaller and cast it to the type of the |
| 767 * larger - this cannot overflow. Do not cast in the following test - it | 565 * larger - this cannot overflow. Do not cast in the following test - it |
| 768 * will break on either 16 or 64 bit platforms. | 566 * will break on either 16-bit or 64-bit platforms. |
| 769 */ | 567 */ |
| 770 if (idat_size < save_size) | 568 if (idat_size < save_size) |
| 771 save_size = (png_size_t)idat_size; | 569 save_size = (png_size_t)idat_size; |
| 772 | 570 |
| 773 else | 571 else |
| 774 idat_size = (png_uint_32)save_size; | 572 idat_size = (png_uint_32)save_size; |
| 775 | 573 |
| 776 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size); | 574 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size); |
| 777 | 575 |
| 778 png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size); | 576 png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size); |
| 779 | 577 |
| 780 png_ptr->idat_size -= idat_size; | 578 png_ptr->idat_size -= idat_size; |
| 781 png_ptr->buffer_size -= save_size; | 579 png_ptr->buffer_size -= save_size; |
| 782 png_ptr->save_buffer_size -= save_size; | 580 png_ptr->save_buffer_size -= save_size; |
| 783 png_ptr->save_buffer_ptr += save_size; | 581 png_ptr->save_buffer_ptr += save_size; |
| 784 } | 582 } |
| 785 | 583 |
| 786 if (png_ptr->idat_size && png_ptr->current_buffer_size) | 584 if (png_ptr->idat_size != 0 && png_ptr->current_buffer_size != 0) |
| 787 { | 585 { |
| 788 png_size_t save_size = png_ptr->current_buffer_size; | 586 png_size_t save_size = png_ptr->current_buffer_size; |
| 789 png_uint_32 idat_size = png_ptr->idat_size; | 587 png_uint_32 idat_size = png_ptr->idat_size; |
| 790 | 588 |
| 791 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they | 589 /* We want the smaller of 'idat_size' and 'current_buffer_size', but they |
| 792 * are of different types and we don't know which variable has the fewest | 590 * are of different types and we don't know which variable has the fewest |
| 793 * bits. Carefully select the smaller and cast it to the type of the | 591 * bits. Carefully select the smaller and cast it to the type of the |
| 794 * larger - this cannot overflow. | 592 * larger - this cannot overflow. |
| 795 */ | 593 */ |
| 796 if (idat_size < save_size) | 594 if (idat_size < save_size) |
| 797 save_size = (png_size_t)idat_size; | 595 save_size = (png_size_t)idat_size; |
| 798 | 596 |
| 799 else | 597 else |
| 800 idat_size = (png_uint_32)save_size; | 598 idat_size = (png_uint_32)save_size; |
| 801 | 599 |
| 802 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size); | 600 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size); |
| 803 | 601 |
| 804 png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size); | 602 png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size); |
| 805 | 603 |
| 806 png_ptr->idat_size -= idat_size; | 604 png_ptr->idat_size -= idat_size; |
| 807 png_ptr->buffer_size -= save_size; | 605 png_ptr->buffer_size -= save_size; |
| 808 png_ptr->current_buffer_size -= save_size; | 606 png_ptr->current_buffer_size -= save_size; |
| 809 png_ptr->current_buffer_ptr += save_size; | 607 png_ptr->current_buffer_ptr += save_size; |
| 810 } | 608 } |
| 811 if (!png_ptr->idat_size) | 609 |
| 812 { | 610 if (png_ptr->idat_size == 0) |
| 813 if (png_ptr->buffer_size < 4) | 611 { |
| 814 { | 612 PNG_PUSH_SAVE_BUFFER_IF_LT(4) |
| 815 png_push_save_buffer(png_ptr); | |
| 816 return; | |
| 817 } | |
| 818 | |
| 819 png_crc_finish(png_ptr, 0); | 613 png_crc_finish(png_ptr, 0); |
| 820 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; | 614 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER; |
| 821 png_ptr->mode |= PNG_AFTER_IDAT; | 615 png_ptr->mode |= PNG_AFTER_IDAT; |
| 822 png_ptr->zowner = 0; | 616 png_ptr->zowner = 0; |
| 823 } | 617 } |
| 824 } | 618 } |
| 825 | 619 |
| 826 void /* PRIVATE */ | 620 void /* PRIVATE */ |
| 827 png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer, | 621 png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer, |
| 828 png_size_t buffer_length) | 622 png_size_t buffer_length) |
| 829 { | 623 { |
| 830 /* The caller checks for a non-zero buffer length. */ | 624 /* The caller checks for a non-zero buffer length. */ |
| 831 if (!(buffer_length > 0) || buffer == NULL) | 625 if (!(buffer_length > 0) || buffer == NULL) |
| 832 png_error(png_ptr, "No IDAT data (internal error)"); | 626 png_error(png_ptr, "No IDAT data (internal error)"); |
| 833 | 627 |
| 834 /* This routine must process all the data it has been given | 628 /* This routine must process all the data it has been given |
| 835 * before returning, calling the row callback as required to | 629 * before returning, calling the row callback as required to |
| 836 * handle the uncompressed results. | 630 * handle the uncompressed results. |
| 837 */ | 631 */ |
| 838 png_ptr->zstream.next_in = buffer; | 632 png_ptr->zstream.next_in = buffer; |
| 839 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ | 633 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ |
| 840 png_ptr->zstream.avail_in = (uInt)buffer_length; | 634 png_ptr->zstream.avail_in = (uInt)buffer_length; |
| 841 | 635 |
| 842 /* Keep going until the decompressed data is all processed | 636 /* Keep going until the decompressed data is all processed |
| 843 * or the stream marked as finished. | 637 * or the stream marked as finished. |
| 844 */ | 638 */ |
| 845 while (png_ptr->zstream.avail_in > 0 && | 639 while (png_ptr->zstream.avail_in > 0 && |
| 846 !(png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED)) | 640 (png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0) |
| 847 { | 641 { |
| 848 int ret; | 642 int ret; |
| 849 | 643 |
| 850 /* We have data for zlib, but we must check that zlib | 644 /* We have data for zlib, but we must check that zlib |
| 851 * has someplace to put the results. It doesn't matter | 645 * has someplace to put the results. It doesn't matter |
| 852 * if we don't expect any results -- it may be the input | 646 * if we don't expect any results -- it may be the input |
| 853 * data is just the LZ end code. | 647 * data is just the LZ end code. |
| 854 */ | 648 */ |
| 855 if (!(png_ptr->zstream.avail_out > 0)) | 649 if (!(png_ptr->zstream.avail_out > 0)) |
| 856 { | 650 { |
| 857 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ | 651 /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */ |
| 858 png_ptr->zstream.avail_out = (uInt)(PNG_ROWBYTES(png_ptr->pixel_depth, | 652 png_ptr->zstream.avail_out = (uInt)(PNG_ROWBYTES(png_ptr->pixel_depth, |
| 859 png_ptr->iwidth) + 1); | 653 png_ptr->iwidth) + 1); |
| 860 | 654 |
| 861 png_ptr->zstream.next_out = png_ptr->row_buf; | 655 png_ptr->zstream.next_out = png_ptr->row_buf; |
| 862 } | 656 } |
| 863 | 657 |
| 864 /* Using Z_SYNC_FLUSH here means that an unterminated | 658 /* Using Z_SYNC_FLUSH here means that an unterminated |
| 865 * LZ stream (a stream with a missing end code) can still | 659 * LZ stream (a stream with a missing end code) can still |
| 866 * be handled, otherwise (Z_NO_FLUSH) a future zlib | 660 * be handled, otherwise (Z_NO_FLUSH) a future zlib |
| 867 * implementation might defer output and therefore | 661 * implementation might defer output and therefore |
| 868 * change the current behavior (see comments in inflate.c | 662 * change the current behavior (see comments in inflate.c |
| 869 * for why this doesn't happen at present with zlib 1.2.5). | 663 * for why this doesn't happen at present with zlib 1.2.5). |
| 870 */ | 664 */ |
| 871 ret = inflate(&png_ptr->zstream, Z_SYNC_FLUSH); | 665 ret = PNG_INFLATE(png_ptr, Z_SYNC_FLUSH); |
| 872 | 666 |
| 873 /* Check for any failure before proceeding. */ | 667 /* Check for any failure before proceeding. */ |
| 874 if (ret != Z_OK && ret != Z_STREAM_END) | 668 if (ret != Z_OK && ret != Z_STREAM_END) |
| 875 { | 669 { |
| 876 /* Terminate the decompression. */ | 670 /* Terminate the decompression. */ |
| 877 png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED; | 671 png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED; |
| 878 png_ptr->zowner = 0; | 672 png_ptr->zowner = 0; |
| 879 | 673 |
| 880 /* This may be a truncated stream (missing or | 674 /* This may be a truncated stream (missing or |
| 881 * damaged end code). Treat that as a warning. | 675 * damaged end code). Treat that as a warning. |
| (...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 953 } | 747 } |
| 954 | 748 |
| 955 /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before | 749 /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before |
| 956 * 1.5.6, while the buffer really is this big in current versions of libpng | 750 * 1.5.6, while the buffer really is this big in current versions of libpng |
| 957 * it may not be in the future, so this was changed just to copy the | 751 * it may not be in the future, so this was changed just to copy the |
| 958 * interlaced row count: | 752 * interlaced row count: |
| 959 */ | 753 */ |
| 960 memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1); | 754 memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1); |
| 961 | 755 |
| 962 #ifdef PNG_READ_TRANSFORMS_SUPPORTED | 756 #ifdef PNG_READ_TRANSFORMS_SUPPORTED |
| 963 if (png_ptr->transformations) | 757 if (png_ptr->transformations != 0) |
| 964 png_do_read_transformations(png_ptr, &row_info); | 758 png_do_read_transformations(png_ptr, &row_info); |
| 965 #endif | 759 #endif |
| 966 | 760 |
| 967 /* The transformed pixel depth should match the depth now in row_info. */ | 761 /* The transformed pixel depth should match the depth now in row_info. */ |
| 968 if (png_ptr->transformed_pixel_depth == 0) | 762 if (png_ptr->transformed_pixel_depth == 0) |
| 969 { | 763 { |
| 970 png_ptr->transformed_pixel_depth = row_info.pixel_depth; | 764 png_ptr->transformed_pixel_depth = row_info.pixel_depth; |
| 971 if (row_info.pixel_depth > png_ptr->maximum_pixel_depth) | 765 if (row_info.pixel_depth > png_ptr->maximum_pixel_depth) |
| 972 png_error(png_ptr, "progressive row overflow"); | 766 png_error(png_ptr, "progressive row overflow"); |
| 973 } | 767 } |
| 974 | 768 |
| 975 else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth) | 769 else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth) |
| 976 png_error(png_ptr, "internal progressive row size calculation error"); | 770 png_error(png_ptr, "internal progressive row size calculation error"); |
| 977 | 771 |
| 978 | 772 |
| 979 #ifdef PNG_READ_INTERLACING_SUPPORTED | 773 #ifdef PNG_READ_INTERLACING_SUPPORTED |
| 980 /* Blow up interlaced rows to full size */ | 774 /* Expand interlaced rows to full size */ |
| 981 if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE)) | 775 if (png_ptr->interlaced != 0 && |
| 776 (png_ptr->transformations & PNG_INTERLACE) != 0) |
| 982 { | 777 { |
| 983 if (png_ptr->pass < 6) | 778 if (png_ptr->pass < 6) |
| 984 png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass, | 779 png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass, |
| 985 png_ptr->transformations); | 780 png_ptr->transformations); |
| 986 | 781 |
| 987 switch (png_ptr->pass) | 782 switch (png_ptr->pass) |
| 988 { | 783 { |
| 989 case 0: | 784 case 0: |
| 990 { | 785 { |
| 991 int i; | 786 int i; |
| 992 for (i = 0; i < 8 && png_ptr->pass == 0; i++) | 787 for (i = 0; i < 8 && png_ptr->pass == 0; i++) |
| 993 { | 788 { |
| 994 png_push_have_row(png_ptr, png_ptr->row_buf + 1); | 789 png_push_have_row(png_ptr, png_ptr->row_buf + 1); |
| 995 png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */ | 790 png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */ |
| 996 } | 791 } |
| 997 | 792 |
| 998 if (png_ptr->pass == 2) /* Pass 1 might be empty */ | 793 if (png_ptr->pass == 2) /* Pass 1 might be empty */ |
| (...skipping 182 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1181 * it, uncomment it here and in png.h | 976 * it, uncomment it here and in png.h |
| 1182 static PNG_CONST png_byte png_pass_height[] = {8, 8, 4, 4, 2, 2, 1}; | 977 static PNG_CONST png_byte png_pass_height[] = {8, 8, 4, 4, 2, 2, 1}; |
| 1183 */ | 978 */ |
| 1184 #endif | 979 #endif |
| 1185 | 980 |
| 1186 png_ptr->row_number++; | 981 png_ptr->row_number++; |
| 1187 if (png_ptr->row_number < png_ptr->num_rows) | 982 if (png_ptr->row_number < png_ptr->num_rows) |
| 1188 return; | 983 return; |
| 1189 | 984 |
| 1190 #ifdef PNG_READ_INTERLACING_SUPPORTED | 985 #ifdef PNG_READ_INTERLACING_SUPPORTED |
| 1191 if (png_ptr->interlaced) | 986 if (png_ptr->interlaced != 0) |
| 1192 { | 987 { |
| 1193 png_ptr->row_number = 0; | 988 png_ptr->row_number = 0; |
| 1194 memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); | 989 memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); |
| 1195 | 990 |
| 1196 do | 991 do |
| 1197 { | 992 { |
| 1198 png_ptr->pass++; | 993 png_ptr->pass++; |
| 1199 if ((png_ptr->pass == 1 && png_ptr->width < 5) || | 994 if ((png_ptr->pass == 1 && png_ptr->width < 5) || |
| 1200 (png_ptr->pass == 3 && png_ptr->width < 3) || | 995 (png_ptr->pass == 3 && png_ptr->width < 3) || |
| 1201 (png_ptr->pass == 5 && png_ptr->width < 2)) | 996 (png_ptr->pass == 5 && png_ptr->width < 2)) |
| 1202 png_ptr->pass++; | 997 png_ptr->pass++; |
| 1203 | 998 |
| 1204 if (png_ptr->pass > 7) | 999 if (png_ptr->pass > 7) |
| 1205 png_ptr->pass--; | 1000 png_ptr->pass--; |
| 1206 | 1001 |
| 1207 if (png_ptr->pass >= 7) | 1002 if (png_ptr->pass >= 7) |
| 1208 break; | 1003 break; |
| 1209 | 1004 |
| 1210 png_ptr->iwidth = (png_ptr->width + | 1005 png_ptr->iwidth = (png_ptr->width + |
| 1211 png_pass_inc[png_ptr->pass] - 1 - | 1006 png_pass_inc[png_ptr->pass] - 1 - |
| 1212 png_pass_start[png_ptr->pass]) / | 1007 png_pass_start[png_ptr->pass]) / |
| 1213 png_pass_inc[png_ptr->pass]; | 1008 png_pass_inc[png_ptr->pass]; |
| 1214 | 1009 |
| 1215 if (png_ptr->transformations & PNG_INTERLACE) | 1010 if ((png_ptr->transformations & PNG_INTERLACE) != 0) |
| 1216 break; | 1011 break; |
| 1217 | 1012 |
| 1218 png_ptr->num_rows = (png_ptr->height + | 1013 png_ptr->num_rows = (png_ptr->height + |
| 1219 png_pass_yinc[png_ptr->pass] - 1 - | 1014 png_pass_yinc[png_ptr->pass] - 1 - |
| 1220 png_pass_ystart[png_ptr->pass]) / | 1015 png_pass_ystart[png_ptr->pass]) / |
| 1221 png_pass_yinc[png_ptr->pass]; | 1016 png_pass_yinc[png_ptr->pass]; |
| 1222 | 1017 |
| 1223 } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0); | 1018 } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0); |
| 1224 } | 1019 } |
| 1225 #endif /* PNG_READ_INTERLACING_SUPPORTED */ | 1020 #endif /* READ_INTERLACING */ |
| 1226 } | 1021 } |
| 1227 | 1022 |
| 1228 void /* PRIVATE */ | 1023 void /* PRIVATE */ |
| 1229 png_push_have_info(png_structrp png_ptr, png_inforp info_ptr) | 1024 png_push_have_info(png_structrp png_ptr, png_inforp info_ptr) |
| 1230 { | 1025 { |
| 1231 if (png_ptr->info_fn != NULL) | 1026 if (png_ptr->info_fn != NULL) |
| 1232 (*(png_ptr->info_fn))(png_ptr, info_ptr); | 1027 (*(png_ptr->info_fn))(png_ptr, info_ptr); |
| 1233 } | 1028 } |
| 1234 | 1029 |
| 1235 void /* PRIVATE */ | 1030 void /* PRIVATE */ |
| (...skipping 17 matching lines...) Expand all Loading... |
| 1253 png_const_bytep new_row) | 1048 png_const_bytep new_row) |
| 1254 { | 1049 { |
| 1255 if (png_ptr == NULL) | 1050 if (png_ptr == NULL) |
| 1256 return; | 1051 return; |
| 1257 | 1052 |
| 1258 /* new_row is a flag here - if it is NULL then the app callback was called | 1053 /* new_row is a flag here - if it is NULL then the app callback was called |
| 1259 * from an empty row (see the calls to png_struct::row_fn below), otherwise | 1054 * from an empty row (see the calls to png_struct::row_fn below), otherwise |
| 1260 * it must be png_ptr->row_buf+1 | 1055 * it must be png_ptr->row_buf+1 |
| 1261 */ | 1056 */ |
| 1262 if (new_row != NULL) | 1057 if (new_row != NULL) |
| 1263 png_combine_row(png_ptr, old_row, 1/*display*/); | 1058 png_combine_row(png_ptr, old_row, 1/*blocky display*/); |
| 1264 } | 1059 } |
| 1265 #endif /* PNG_READ_INTERLACING_SUPPORTED */ | 1060 #endif /* READ_INTERLACING */ |
| 1266 | 1061 |
| 1267 void PNGAPI | 1062 void PNGAPI |
| 1268 png_set_progressive_read_fn(png_structrp png_ptr, png_voidp progressive_ptr, | 1063 png_set_progressive_read_fn(png_structrp png_ptr, png_voidp progressive_ptr, |
| 1269 png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn, | 1064 png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn, |
| 1270 png_progressive_end_ptr end_fn) | 1065 png_progressive_end_ptr end_fn) |
| 1271 { | 1066 { |
| 1272 if (png_ptr == NULL) | 1067 if (png_ptr == NULL) |
| 1273 return; | 1068 return; |
| 1274 | 1069 |
| 1275 png_ptr->info_fn = info_fn; | 1070 png_ptr->info_fn = info_fn; |
| 1276 png_ptr->row_fn = row_fn; | 1071 png_ptr->row_fn = row_fn; |
| 1277 png_ptr->end_fn = end_fn; | 1072 png_ptr->end_fn = end_fn; |
| 1278 | 1073 |
| 1279 png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer); | 1074 png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer); |
| 1280 } | 1075 } |
| 1281 | 1076 |
| 1282 png_voidp PNGAPI | 1077 png_voidp PNGAPI |
| 1283 png_get_progressive_ptr(png_const_structrp png_ptr) | 1078 png_get_progressive_ptr(png_const_structrp png_ptr) |
| 1284 { | 1079 { |
| 1285 if (png_ptr == NULL) | 1080 if (png_ptr == NULL) |
| 1286 return (NULL); | 1081 return (NULL); |
| 1287 | 1082 |
| 1288 return png_ptr->io_ptr; | 1083 return png_ptr->io_ptr; |
| 1289 } | 1084 } |
| 1290 #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */ | 1085 #endif /* PROGRESSIVE_READ */ |
| OLD | NEW |