Counter Strike : Global Offensive Source Code
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1854 lines
50 KiB

  1. /* pngpread.c - read a png file in push mode
  2. *
  3. * Last changed in libpng 1.5.2 [March 31, 2011]
  4. * Copyright (c) 1998-2011 Glenn Randers-Pehrson
  5. * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  6. * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  7. *
  8. * This code is released under the libpng license.
  9. * For conditions of distribution and use, see the disclaimer
  10. * and license in png.h
  11. */
  12. #include "pngpriv.h"
  13. #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
  14. /* Push model modes */
  15. #define PNG_READ_SIG_MODE 0
  16. #define PNG_READ_CHUNK_MODE 1
  17. #define PNG_READ_IDAT_MODE 2
  18. #define PNG_SKIP_MODE 3
  19. #define PNG_READ_tEXt_MODE 4
  20. #define PNG_READ_zTXt_MODE 5
  21. #define PNG_READ_DONE_MODE 6
  22. #define PNG_READ_iTXt_MODE 7
  23. #define PNG_ERROR_MODE 8
  24. void PNGAPI
  25. png_process_data(png_structp png_ptr, png_infop info_ptr,
  26. png_bytep buffer, png_size_t buffer_size)
  27. {
  28. if (png_ptr == NULL || info_ptr == NULL)
  29. return;
  30. png_push_restore_buffer(png_ptr, buffer, buffer_size);
  31. while (png_ptr->buffer_size)
  32. {
  33. png_process_some_data(png_ptr, info_ptr);
  34. }
  35. }
  36. png_size_t PNGAPI
  37. png_process_data_pause(png_structp png_ptr, int save)
  38. {
  39. if (png_ptr != NULL)
  40. {
  41. /* It's easiest for the caller if we do the save, then the caller doesn't
  42. * have to supply the same data again:
  43. */
  44. if (save)
  45. png_push_save_buffer(png_ptr);
  46. else
  47. {
  48. /* This includes any pending saved bytes: */
  49. png_size_t remaining = png_ptr->buffer_size;
  50. png_ptr->buffer_size = 0;
  51. /* So subtract the saved buffer size, unless all the data
  52. * is actually 'saved', in which case we just return 0
  53. */
  54. if (png_ptr->save_buffer_size < remaining)
  55. return remaining - png_ptr->save_buffer_size;
  56. }
  57. }
  58. return 0;
  59. }
  60. png_uint_32 PNGAPI
  61. png_process_data_skip(png_structp png_ptr)
  62. {
  63. png_uint_32 remaining = 0;
  64. if (png_ptr != NULL && png_ptr->process_mode == PNG_SKIP_MODE &&
  65. png_ptr->skip_length > 0)
  66. {
  67. /* At the end of png_process_data the buffer size must be 0 (see the loop
  68. * above) so we can detect a broken call here:
  69. */
  70. if (png_ptr->buffer_size != 0)
  71. png_error(png_ptr,
  72. "png_process_data_skip called inside png_process_data");
  73. /* If is impossible for there to be a saved buffer at this point -
  74. * otherwise we could not be in SKIP mode. This will also happen if
  75. * png_process_skip is called inside png_process_data (but only very
  76. * rarely.)
  77. */
  78. if (png_ptr->save_buffer_size != 0)
  79. png_error(png_ptr, "png_process_data_skip called with saved data");
  80. remaining = png_ptr->skip_length;
  81. png_ptr->skip_length = 0;
  82. png_ptr->process_mode = PNG_READ_CHUNK_MODE;
  83. }
  84. return remaining;
  85. }
  86. /* What we do with the incoming data depends on what we were previously
  87. * doing before we ran out of data...
  88. */
  89. void /* PRIVATE */
  90. png_process_some_data(png_structp png_ptr, png_infop info_ptr)
  91. {
  92. if (png_ptr == NULL)
  93. return;
  94. switch (png_ptr->process_mode)
  95. {
  96. case PNG_READ_SIG_MODE:
  97. {
  98. png_push_read_sig(png_ptr, info_ptr);
  99. break;
  100. }
  101. case PNG_READ_CHUNK_MODE:
  102. {
  103. png_push_read_chunk(png_ptr, info_ptr);
  104. break;
  105. }
  106. case PNG_READ_IDAT_MODE:
  107. {
  108. png_push_read_IDAT(png_ptr);
  109. break;
  110. }
  111. #ifdef PNG_READ_tEXt_SUPPORTED
  112. case PNG_READ_tEXt_MODE:
  113. {
  114. png_push_read_tEXt(png_ptr, info_ptr);
  115. break;
  116. }
  117. #endif
  118. #ifdef PNG_READ_zTXt_SUPPORTED
  119. case PNG_READ_zTXt_MODE:
  120. {
  121. png_push_read_zTXt(png_ptr, info_ptr);
  122. break;
  123. }
  124. #endif
  125. #ifdef PNG_READ_iTXt_SUPPORTED
  126. case PNG_READ_iTXt_MODE:
  127. {
  128. png_push_read_iTXt(png_ptr, info_ptr);
  129. break;
  130. }
  131. #endif
  132. case PNG_SKIP_MODE:
  133. {
  134. png_push_crc_finish(png_ptr);
  135. break;
  136. }
  137. default:
  138. {
  139. png_ptr->buffer_size = 0;
  140. break;
  141. }
  142. }
  143. }
  144. /* Read any remaining signature bytes from the stream and compare them with
  145. * the correct PNG signature. It is possible that this routine is called
  146. * with bytes already read from the signature, either because they have been
  147. * checked by the calling application, or because of multiple calls to this
  148. * routine.
  149. */
  150. void /* PRIVATE */
  151. png_push_read_sig(png_structp png_ptr, png_infop info_ptr)
  152. {
  153. png_size_t num_checked = png_ptr->sig_bytes,
  154. num_to_check = 8 - num_checked;
  155. if (png_ptr->buffer_size < num_to_check)
  156. {
  157. num_to_check = png_ptr->buffer_size;
  158. }
  159. png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]),
  160. num_to_check);
  161. png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check);
  162. if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))
  163. {
  164. if (num_checked < 4 &&
  165. png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4))
  166. png_error(png_ptr, "Not a PNG file");
  167. else
  168. png_error(png_ptr, "PNG file corrupted by ASCII conversion");
  169. }
  170. else
  171. {
  172. if (png_ptr->sig_bytes >= 8)
  173. {
  174. png_ptr->process_mode = PNG_READ_CHUNK_MODE;
  175. }
  176. }
  177. }
  178. void /* PRIVATE */
  179. png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
  180. {
  181. PNG_IHDR;
  182. PNG_IDAT;
  183. PNG_IEND;
  184. PNG_PLTE;
  185. #ifdef PNG_READ_bKGD_SUPPORTED
  186. PNG_bKGD;
  187. #endif
  188. #ifdef PNG_READ_cHRM_SUPPORTED
  189. PNG_cHRM;
  190. #endif
  191. #ifdef PNG_READ_gAMA_SUPPORTED
  192. PNG_gAMA;
  193. #endif
  194. #ifdef PNG_READ_hIST_SUPPORTED
  195. PNG_hIST;
  196. #endif
  197. #ifdef PNG_READ_iCCP_SUPPORTED
  198. PNG_iCCP;
  199. #endif
  200. #ifdef PNG_READ_iTXt_SUPPORTED
  201. PNG_iTXt;
  202. #endif
  203. #ifdef PNG_READ_oFFs_SUPPORTED
  204. PNG_oFFs;
  205. #endif
  206. #ifdef PNG_READ_pCAL_SUPPORTED
  207. PNG_pCAL;
  208. #endif
  209. #ifdef PNG_READ_pHYs_SUPPORTED
  210. PNG_pHYs;
  211. #endif
  212. #ifdef PNG_READ_sBIT_SUPPORTED
  213. PNG_sBIT;
  214. #endif
  215. #ifdef PNG_READ_sCAL_SUPPORTED
  216. PNG_sCAL;
  217. #endif
  218. #ifdef PNG_READ_sRGB_SUPPORTED
  219. PNG_sRGB;
  220. #endif
  221. #ifdef PNG_READ_sPLT_SUPPORTED
  222. PNG_sPLT;
  223. #endif
  224. #ifdef PNG_READ_tEXt_SUPPORTED
  225. PNG_tEXt;
  226. #endif
  227. #ifdef PNG_READ_tIME_SUPPORTED
  228. PNG_tIME;
  229. #endif
  230. #ifdef PNG_READ_tRNS_SUPPORTED
  231. PNG_tRNS;
  232. #endif
  233. #ifdef PNG_READ_zTXt_SUPPORTED
  234. PNG_zTXt;
  235. #endif
  236. /* First we make sure we have enough data for the 4 byte chunk name
  237. * and the 4 byte chunk length before proceeding with decoding the
  238. * chunk data. To fully decode each of these chunks, we also make
  239. * sure we have enough data in the buffer for the 4 byte CRC at the
  240. * end of every chunk (except IDAT, which is handled separately).
  241. */
  242. if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER))
  243. {
  244. png_byte chunk_length[4];
  245. if (png_ptr->buffer_size < 8)
  246. {
  247. png_push_save_buffer(png_ptr);
  248. return;
  249. }
  250. png_push_fill_buffer(png_ptr, chunk_length, 4);
  251. png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
  252. png_reset_crc(png_ptr);
  253. png_crc_read(png_ptr, png_ptr->chunk_name, 4);
  254. png_check_chunk_name(png_ptr, png_ptr->chunk_name);
  255. png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
  256. }
  257. if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
  258. if (png_ptr->mode & PNG_AFTER_IDAT)
  259. png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
  260. if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
  261. {
  262. if (png_ptr->push_length != 13)
  263. png_error(png_ptr, "Invalid IHDR length");
  264. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  265. {
  266. png_push_save_buffer(png_ptr);
  267. return;
  268. }
  269. png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length);
  270. }
  271. else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
  272. {
  273. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  274. {
  275. png_push_save_buffer(png_ptr);
  276. return;
  277. }
  278. png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length);
  279. png_ptr->process_mode = PNG_READ_DONE_MODE;
  280. png_push_have_end(png_ptr, info_ptr);
  281. }
  282. #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  283. else if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name))
  284. {
  285. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  286. {
  287. png_push_save_buffer(png_ptr);
  288. return;
  289. }
  290. if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
  291. png_ptr->mode |= PNG_HAVE_IDAT;
  292. png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
  293. if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
  294. png_ptr->mode |= PNG_HAVE_PLTE;
  295. else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
  296. {
  297. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  298. png_error(png_ptr, "Missing IHDR before IDAT");
  299. else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  300. !(png_ptr->mode & PNG_HAVE_PLTE))
  301. png_error(png_ptr, "Missing PLTE before IDAT");
  302. }
  303. }
  304. #endif
  305. else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
  306. {
  307. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  308. {
  309. png_push_save_buffer(png_ptr);
  310. return;
  311. }
  312. png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length);
  313. }
  314. else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
  315. {
  316. /* If we reach an IDAT chunk, this means we have read all of the
  317. * header chunks, and we can start reading the image (or if this
  318. * is called after the image has been read - we have an error).
  319. */
  320. if (!(png_ptr->mode & PNG_HAVE_IHDR))
  321. png_error(png_ptr, "Missing IHDR before IDAT");
  322. else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  323. !(png_ptr->mode & PNG_HAVE_PLTE))
  324. png_error(png_ptr, "Missing PLTE before IDAT");
  325. if (png_ptr->mode & PNG_HAVE_IDAT)
  326. {
  327. if (!(png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT))
  328. if (png_ptr->push_length == 0)
  329. return;
  330. if (png_ptr->mode & PNG_AFTER_IDAT)
  331. png_benign_error(png_ptr, "Too many IDATs found");
  332. }
  333. png_ptr->idat_size = png_ptr->push_length;
  334. png_ptr->mode |= PNG_HAVE_IDAT;
  335. png_ptr->process_mode = PNG_READ_IDAT_MODE;
  336. png_push_have_info(png_ptr, info_ptr);
  337. png_ptr->zstream.avail_out =
  338. (uInt) PNG_ROWBYTES(png_ptr->pixel_depth,
  339. png_ptr->iwidth) + 1;
  340. png_ptr->zstream.next_out = png_ptr->row_buf;
  341. return;
  342. }
  343. #ifdef PNG_READ_gAMA_SUPPORTED
  344. else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4))
  345. {
  346. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  347. {
  348. png_push_save_buffer(png_ptr);
  349. return;
  350. }
  351. png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length);
  352. }
  353. #endif
  354. #ifdef PNG_READ_sBIT_SUPPORTED
  355. else if (!png_memcmp(png_ptr->chunk_name, png_sBIT, 4))
  356. {
  357. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  358. {
  359. png_push_save_buffer(png_ptr);
  360. return;
  361. }
  362. png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length);
  363. }
  364. #endif
  365. #ifdef PNG_READ_cHRM_SUPPORTED
  366. else if (!png_memcmp(png_ptr->chunk_name, png_cHRM, 4))
  367. {
  368. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  369. {
  370. png_push_save_buffer(png_ptr);
  371. return;
  372. }
  373. png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length);
  374. }
  375. #endif
  376. #ifdef PNG_READ_sRGB_SUPPORTED
  377. else if (!png_memcmp(png_ptr->chunk_name, png_sRGB, 4))
  378. {
  379. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  380. {
  381. png_push_save_buffer(png_ptr);
  382. return;
  383. }
  384. png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length);
  385. }
  386. #endif
  387. #ifdef PNG_READ_iCCP_SUPPORTED
  388. else if (!png_memcmp(png_ptr->chunk_name, png_iCCP, 4))
  389. {
  390. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  391. {
  392. png_push_save_buffer(png_ptr);
  393. return;
  394. }
  395. png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length);
  396. }
  397. #endif
  398. #ifdef PNG_READ_sPLT_SUPPORTED
  399. else if (!png_memcmp(png_ptr->chunk_name, png_sPLT, 4))
  400. {
  401. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  402. {
  403. png_push_save_buffer(png_ptr);
  404. return;
  405. }
  406. png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length);
  407. }
  408. #endif
  409. #ifdef PNG_READ_tRNS_SUPPORTED
  410. else if (!png_memcmp(png_ptr->chunk_name, png_tRNS, 4))
  411. {
  412. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  413. {
  414. png_push_save_buffer(png_ptr);
  415. return;
  416. }
  417. png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length);
  418. }
  419. #endif
  420. #ifdef PNG_READ_bKGD_SUPPORTED
  421. else if (!png_memcmp(png_ptr->chunk_name, png_bKGD, 4))
  422. {
  423. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  424. {
  425. png_push_save_buffer(png_ptr);
  426. return;
  427. }
  428. png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length);
  429. }
  430. #endif
  431. #ifdef PNG_READ_hIST_SUPPORTED
  432. else if (!png_memcmp(png_ptr->chunk_name, png_hIST, 4))
  433. {
  434. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  435. {
  436. png_push_save_buffer(png_ptr);
  437. return;
  438. }
  439. png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length);
  440. }
  441. #endif
  442. #ifdef PNG_READ_pHYs_SUPPORTED
  443. else if (!png_memcmp(png_ptr->chunk_name, png_pHYs, 4))
  444. {
  445. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  446. {
  447. png_push_save_buffer(png_ptr);
  448. return;
  449. }
  450. png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length);
  451. }
  452. #endif
  453. #ifdef PNG_READ_oFFs_SUPPORTED
  454. else if (!png_memcmp(png_ptr->chunk_name, png_oFFs, 4))
  455. {
  456. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  457. {
  458. png_push_save_buffer(png_ptr);
  459. return;
  460. }
  461. png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length);
  462. }
  463. #endif
  464. #ifdef PNG_READ_pCAL_SUPPORTED
  465. else if (!png_memcmp(png_ptr->chunk_name, png_pCAL, 4))
  466. {
  467. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  468. {
  469. png_push_save_buffer(png_ptr);
  470. return;
  471. }
  472. png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length);
  473. }
  474. #endif
  475. #ifdef PNG_READ_sCAL_SUPPORTED
  476. else if (!png_memcmp(png_ptr->chunk_name, png_sCAL, 4))
  477. {
  478. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  479. {
  480. png_push_save_buffer(png_ptr);
  481. return;
  482. }
  483. png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length);
  484. }
  485. #endif
  486. #ifdef PNG_READ_tIME_SUPPORTED
  487. else if (!png_memcmp(png_ptr->chunk_name, png_tIME, 4))
  488. {
  489. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  490. {
  491. png_push_save_buffer(png_ptr);
  492. return;
  493. }
  494. png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length);
  495. }
  496. #endif
  497. #ifdef PNG_READ_tEXt_SUPPORTED
  498. else if (!png_memcmp(png_ptr->chunk_name, png_tEXt, 4))
  499. {
  500. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  501. {
  502. png_push_save_buffer(png_ptr);
  503. return;
  504. }
  505. png_push_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
  506. }
  507. #endif
  508. #ifdef PNG_READ_zTXt_SUPPORTED
  509. else if (!png_memcmp(png_ptr->chunk_name, png_zTXt, 4))
  510. {
  511. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  512. {
  513. png_push_save_buffer(png_ptr);
  514. return;
  515. }
  516. png_push_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
  517. }
  518. #endif
  519. #ifdef PNG_READ_iTXt_SUPPORTED
  520. else if (!png_memcmp(png_ptr->chunk_name, png_iTXt, 4))
  521. {
  522. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  523. {
  524. png_push_save_buffer(png_ptr);
  525. return;
  526. }
  527. png_push_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
  528. }
  529. #endif
  530. else
  531. {
  532. if (png_ptr->push_length + 4 > png_ptr->buffer_size)
  533. {
  534. png_push_save_buffer(png_ptr);
  535. return;
  536. }
  537. png_push_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
  538. }
  539. png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
  540. }
  541. void /* PRIVATE */
  542. png_push_crc_skip(png_structp png_ptr, png_uint_32 skip)
  543. {
  544. png_ptr->process_mode = PNG_SKIP_MODE;
  545. png_ptr->skip_length = skip;
  546. }
  547. void /* PRIVATE */
  548. png_push_crc_finish(png_structp png_ptr)
  549. {
  550. if (png_ptr->skip_length && png_ptr->save_buffer_size)
  551. {
  552. png_size_t save_size = png_ptr->save_buffer_size;
  553. png_uint_32 skip_length = png_ptr->skip_length;
  554. /* We want the smaller of 'skip_length' and 'save_buffer_size', but
  555. * they are of different types and we don't know which variable has the
  556. * fewest bits. Carefully select the smaller and cast it to the type of
  557. * the larger - this cannot overflow. Do not cast in the following test
  558. * - it will break on either 16 or 64 bit platforms.
  559. */
  560. if (skip_length < save_size)
  561. save_size = (png_size_t)skip_length;
  562. else
  563. skip_length = (png_uint_32)save_size;
  564. png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
  565. png_ptr->skip_length -= skip_length;
  566. png_ptr->buffer_size -= save_size;
  567. png_ptr->save_buffer_size -= save_size;
  568. png_ptr->save_buffer_ptr += save_size;
  569. }
  570. if (png_ptr->skip_length && png_ptr->current_buffer_size)
  571. {
  572. png_size_t save_size = png_ptr->current_buffer_size;
  573. png_uint_32 skip_length = png_ptr->skip_length;
  574. /* We want the smaller of 'skip_length' and 'current_buffer_size', here,
  575. * the same problem exists as above and the same solution.
  576. */
  577. if (skip_length < save_size)
  578. save_size = (png_size_t)skip_length;
  579. else
  580. skip_length = (png_uint_32)save_size;
  581. png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
  582. png_ptr->skip_length -= skip_length;
  583. png_ptr->buffer_size -= save_size;
  584. png_ptr->current_buffer_size -= save_size;
  585. png_ptr->current_buffer_ptr += save_size;
  586. }
  587. if (!png_ptr->skip_length)
  588. {
  589. if (png_ptr->buffer_size < 4)
  590. {
  591. png_push_save_buffer(png_ptr);
  592. return;
  593. }
  594. png_crc_finish(png_ptr, 0);
  595. png_ptr->process_mode = PNG_READ_CHUNK_MODE;
  596. }
  597. }
  598. void PNGCBAPI
  599. png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
  600. {
  601. png_bytep ptr;
  602. if (png_ptr == NULL)
  603. return;
  604. ptr = buffer;
  605. if (png_ptr->save_buffer_size)
  606. {
  607. png_size_t save_size;
  608. if (length < png_ptr->save_buffer_size)
  609. save_size = length;
  610. else
  611. save_size = png_ptr->save_buffer_size;
  612. png_memcpy(ptr, png_ptr->save_buffer_ptr, save_size);
  613. length -= save_size;
  614. ptr += save_size;
  615. png_ptr->buffer_size -= save_size;
  616. png_ptr->save_buffer_size -= save_size;
  617. png_ptr->save_buffer_ptr += save_size;
  618. }
  619. if (length && png_ptr->current_buffer_size)
  620. {
  621. png_size_t save_size;
  622. if (length < png_ptr->current_buffer_size)
  623. save_size = length;
  624. else
  625. save_size = png_ptr->current_buffer_size;
  626. png_memcpy(ptr, png_ptr->current_buffer_ptr, save_size);
  627. png_ptr->buffer_size -= save_size;
  628. png_ptr->current_buffer_size -= save_size;
  629. png_ptr->current_buffer_ptr += save_size;
  630. }
  631. }
  632. void /* PRIVATE */
  633. png_push_save_buffer(png_structp png_ptr)
  634. {
  635. if (png_ptr->save_buffer_size)
  636. {
  637. if (png_ptr->save_buffer_ptr != png_ptr->save_buffer)
  638. {
  639. png_size_t i, istop;
  640. png_bytep sp;
  641. png_bytep dp;
  642. istop = png_ptr->save_buffer_size;
  643. for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer;
  644. i < istop; i++, sp++, dp++)
  645. {
  646. *dp = *sp;
  647. }
  648. }
  649. }
  650. if (png_ptr->save_buffer_size + png_ptr->current_buffer_size >
  651. png_ptr->save_buffer_max)
  652. {
  653. png_size_t new_max;
  654. png_bytep old_buffer;
  655. if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
  656. (png_ptr->current_buffer_size + 256))
  657. {
  658. png_error(png_ptr, "Potential overflow of save_buffer");
  659. }
  660. new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
  661. old_buffer = png_ptr->save_buffer;
  662. png_ptr->save_buffer = (png_bytep)png_malloc_warn(png_ptr,
  663. (png_size_t)new_max);
  664. if (png_ptr->save_buffer == NULL)
  665. {
  666. png_free(png_ptr, old_buffer);
  667. png_error(png_ptr, "Insufficient memory for save_buffer");
  668. }
  669. png_memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
  670. png_free(png_ptr, old_buffer);
  671. png_ptr->save_buffer_max = new_max;
  672. }
  673. if (png_ptr->current_buffer_size)
  674. {
  675. png_memcpy(png_ptr->save_buffer + png_ptr->save_buffer_size,
  676. png_ptr->current_buffer_ptr, png_ptr->current_buffer_size);
  677. png_ptr->save_buffer_size += png_ptr->current_buffer_size;
  678. png_ptr->current_buffer_size = 0;
  679. }
  680. png_ptr->save_buffer_ptr = png_ptr->save_buffer;
  681. png_ptr->buffer_size = 0;
  682. }
  683. void /* PRIVATE */
  684. png_push_restore_buffer(png_structp png_ptr, png_bytep buffer,
  685. png_size_t buffer_length)
  686. {
  687. png_ptr->current_buffer = buffer;
  688. png_ptr->current_buffer_size = buffer_length;
  689. png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size;
  690. png_ptr->current_buffer_ptr = png_ptr->current_buffer;
  691. }
  692. void /* PRIVATE */
  693. png_push_read_IDAT(png_structp png_ptr)
  694. {
  695. PNG_IDAT;
  696. if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER))
  697. {
  698. png_byte chunk_length[4];
  699. if (png_ptr->buffer_size < 8)
  700. {
  701. png_push_save_buffer(png_ptr);
  702. return;
  703. }
  704. png_push_fill_buffer(png_ptr, chunk_length, 4);
  705. png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
  706. png_reset_crc(png_ptr);
  707. png_crc_read(png_ptr, png_ptr->chunk_name, 4);
  708. png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
  709. if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
  710. {
  711. png_ptr->process_mode = PNG_READ_CHUNK_MODE;
  712. if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
  713. png_error(png_ptr, "Not enough compressed data");
  714. return;
  715. }
  716. png_ptr->idat_size = png_ptr->push_length;
  717. }
  718. if (png_ptr->idat_size && png_ptr->save_buffer_size)
  719. {
  720. png_size_t save_size = png_ptr->save_buffer_size;
  721. png_uint_32 idat_size = png_ptr->idat_size;
  722. /* We want the smaller of 'idat_size' and 'current_buffer_size', but they
  723. * are of different types and we don't know which variable has the fewest
  724. * bits. Carefully select the smaller and cast it to the type of the
  725. * larger - this cannot overflow. Do not cast in the following test - it
  726. * will break on either 16 or 64 bit platforms.
  727. */
  728. if (idat_size < save_size)
  729. save_size = (png_size_t)idat_size;
  730. else
  731. idat_size = (png_uint_32)save_size;
  732. png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
  733. png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size);
  734. png_ptr->idat_size -= idat_size;
  735. png_ptr->buffer_size -= save_size;
  736. png_ptr->save_buffer_size -= save_size;
  737. png_ptr->save_buffer_ptr += save_size;
  738. }
  739. if (png_ptr->idat_size && png_ptr->current_buffer_size)
  740. {
  741. png_size_t save_size = png_ptr->current_buffer_size;
  742. png_uint_32 idat_size = png_ptr->idat_size;
  743. /* We want the smaller of 'idat_size' and 'current_buffer_size', but they
  744. * are of different types and we don't know which variable has the fewest
  745. * bits. Carefully select the smaller and cast it to the type of the
  746. * larger - this cannot overflow.
  747. */
  748. if (idat_size < save_size)
  749. save_size = (png_size_t)idat_size;
  750. else
  751. idat_size = (png_uint_32)save_size;
  752. png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
  753. png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
  754. png_ptr->idat_size -= idat_size;
  755. png_ptr->buffer_size -= save_size;
  756. png_ptr->current_buffer_size -= save_size;
  757. png_ptr->current_buffer_ptr += save_size;
  758. }
  759. if (!png_ptr->idat_size)
  760. {
  761. if (png_ptr->buffer_size < 4)
  762. {
  763. png_push_save_buffer(png_ptr);
  764. return;
  765. }
  766. png_crc_finish(png_ptr, 0);
  767. png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
  768. png_ptr->mode |= PNG_AFTER_IDAT;
  769. }
  770. }
  771. void /* PRIVATE */
  772. png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
  773. png_size_t buffer_length)
  774. {
  775. /* The caller checks for a non-zero buffer length. */
  776. if (!(buffer_length > 0) || buffer == NULL)
  777. png_error(png_ptr, "No IDAT data (internal error)");
  778. /* This routine must process all the data it has been given
  779. * before returning, calling the row callback as required to
  780. * handle the uncompressed results.
  781. */
  782. png_ptr->zstream.next_in = buffer;
  783. png_ptr->zstream.avail_in = (uInt)buffer_length;
  784. /* Keep going until the decompressed data is all processed
  785. * or the stream marked as finished.
  786. */
  787. while (png_ptr->zstream.avail_in > 0 &&
  788. !(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
  789. {
  790. int ret;
  791. /* We have data for zlib, but we must check that zlib
  792. * has someplace to put the results. It doesn't matter
  793. * if we don't expect any results -- it may be the input
  794. * data is just the LZ end code.
  795. */
  796. if (!(png_ptr->zstream.avail_out > 0))
  797. {
  798. png_ptr->zstream.avail_out =
  799. (uInt) PNG_ROWBYTES(png_ptr->pixel_depth,
  800. png_ptr->iwidth) + 1;
  801. png_ptr->zstream.next_out = png_ptr->row_buf;
  802. }
  803. /* Using Z_SYNC_FLUSH here means that an unterminated
  804. * LZ stream (a stream with a missing end code) can still
  805. * be handled, otherwise (Z_NO_FLUSH) a future zlib
  806. * implementation might defer output and therefore
  807. * change the current behavior (see comments in inflate.c
  808. * for why this doesn't happen at present with zlib 1.2.5).
  809. */
  810. ret = inflate(&png_ptr->zstream, Z_SYNC_FLUSH);
  811. /* Check for any failure before proceeding. */
  812. if (ret != Z_OK && ret != Z_STREAM_END)
  813. {
  814. /* Terminate the decompression. */
  815. png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
  816. /* This may be a truncated stream (missing or
  817. * damaged end code). Treat that as a warning.
  818. */
  819. if (png_ptr->row_number >= png_ptr->num_rows ||
  820. png_ptr->pass > 6)
  821. png_warning(png_ptr, "Truncated compressed data in IDAT");
  822. else
  823. png_error(png_ptr, "Decompression error in IDAT");
  824. /* Skip the check on unprocessed input */
  825. return;
  826. }
  827. /* Did inflate output any data? */
  828. if (png_ptr->zstream.next_out != png_ptr->row_buf)
  829. {
  830. /* Is this unexpected data after the last row?
  831. * If it is, artificially terminate the LZ output
  832. * here.
  833. */
  834. if (png_ptr->row_number >= png_ptr->num_rows ||
  835. png_ptr->pass > 6)
  836. {
  837. /* Extra data. */
  838. png_warning(png_ptr, "Extra compressed data in IDAT");
  839. png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
  840. /* Do no more processing; skip the unprocessed
  841. * input check below.
  842. */
  843. return;
  844. }
  845. /* Do we have a complete row? */
  846. if (png_ptr->zstream.avail_out == 0)
  847. png_push_process_row(png_ptr);
  848. }
  849. /* And check for the end of the stream. */
  850. if (ret == Z_STREAM_END)
  851. png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
  852. }
  853. /* All the data should have been processed, if anything
  854. * is left at this point we have bytes of IDAT data
  855. * after the zlib end code.
  856. */
  857. if (png_ptr->zstream.avail_in > 0)
  858. png_warning(png_ptr, "Extra compression data in IDAT");
  859. }
  860. void /* PRIVATE */
  861. png_push_process_row(png_structp png_ptr)
  862. {
  863. png_ptr->row_info.color_type = png_ptr->color_type;
  864. png_ptr->row_info.width = png_ptr->iwidth;
  865. png_ptr->row_info.channels = png_ptr->channels;
  866. png_ptr->row_info.bit_depth = png_ptr->bit_depth;
  867. png_ptr->row_info.pixel_depth = png_ptr->pixel_depth;
  868. png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
  869. png_ptr->row_info.width);
  870. png_read_filter_row(png_ptr, &(png_ptr->row_info),
  871. png_ptr->row_buf + 1, png_ptr->prev_row + 1,
  872. (int)(png_ptr->row_buf[0]));
  873. png_memcpy(png_ptr->prev_row, png_ptr->row_buf, png_ptr->rowbytes + 1);
  874. if (png_ptr->transformations)
  875. png_do_read_transformations(png_ptr);
  876. #ifdef PNG_READ_INTERLACING_SUPPORTED
  877. /* Blow up interlaced rows to full size */
  878. if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE))
  879. {
  880. if (png_ptr->pass < 6)
  881. /* old interface (pre-1.0.9):
  882. png_do_read_interlace(&(png_ptr->row_info),
  883. png_ptr->row_buf + 1, png_ptr->pass, png_ptr->transformations);
  884. */
  885. png_do_read_interlace(png_ptr);
  886. switch (png_ptr->pass)
  887. {
  888. case 0:
  889. {
  890. int i;
  891. for (i = 0; i < 8 && png_ptr->pass == 0; i++)
  892. {
  893. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  894. png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */
  895. }
  896. if (png_ptr->pass == 2) /* Pass 1 might be empty */
  897. {
  898. for (i = 0; i < 4 && png_ptr->pass == 2; i++)
  899. {
  900. png_push_have_row(png_ptr, NULL);
  901. png_read_push_finish_row(png_ptr);
  902. }
  903. }
  904. if (png_ptr->pass == 4 && png_ptr->height <= 4)
  905. {
  906. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  907. {
  908. png_push_have_row(png_ptr, NULL);
  909. png_read_push_finish_row(png_ptr);
  910. }
  911. }
  912. if (png_ptr->pass == 6 && png_ptr->height <= 4)
  913. {
  914. png_push_have_row(png_ptr, NULL);
  915. png_read_push_finish_row(png_ptr);
  916. }
  917. break;
  918. }
  919. case 1:
  920. {
  921. int i;
  922. for (i = 0; i < 8 && png_ptr->pass == 1; i++)
  923. {
  924. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  925. png_read_push_finish_row(png_ptr);
  926. }
  927. if (png_ptr->pass == 2) /* Skip top 4 generated rows */
  928. {
  929. for (i = 0; i < 4 && png_ptr->pass == 2; i++)
  930. {
  931. png_push_have_row(png_ptr, NULL);
  932. png_read_push_finish_row(png_ptr);
  933. }
  934. }
  935. break;
  936. }
  937. case 2:
  938. {
  939. int i;
  940. for (i = 0; i < 4 && png_ptr->pass == 2; i++)
  941. {
  942. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  943. png_read_push_finish_row(png_ptr);
  944. }
  945. for (i = 0; i < 4 && png_ptr->pass == 2; i++)
  946. {
  947. png_push_have_row(png_ptr, NULL);
  948. png_read_push_finish_row(png_ptr);
  949. }
  950. if (png_ptr->pass == 4) /* Pass 3 might be empty */
  951. {
  952. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  953. {
  954. png_push_have_row(png_ptr, NULL);
  955. png_read_push_finish_row(png_ptr);
  956. }
  957. }
  958. break;
  959. }
  960. case 3:
  961. {
  962. int i;
  963. for (i = 0; i < 4 && png_ptr->pass == 3; i++)
  964. {
  965. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  966. png_read_push_finish_row(png_ptr);
  967. }
  968. if (png_ptr->pass == 4) /* Skip top two generated rows */
  969. {
  970. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  971. {
  972. png_push_have_row(png_ptr, NULL);
  973. png_read_push_finish_row(png_ptr);
  974. }
  975. }
  976. break;
  977. }
  978. case 4:
  979. {
  980. int i;
  981. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  982. {
  983. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  984. png_read_push_finish_row(png_ptr);
  985. }
  986. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  987. {
  988. png_push_have_row(png_ptr, NULL);
  989. png_read_push_finish_row(png_ptr);
  990. }
  991. if (png_ptr->pass == 6) /* Pass 5 might be empty */
  992. {
  993. png_push_have_row(png_ptr, NULL);
  994. png_read_push_finish_row(png_ptr);
  995. }
  996. break;
  997. }
  998. case 5:
  999. {
  1000. int i;
  1001. for (i = 0; i < 2 && png_ptr->pass == 5; i++)
  1002. {
  1003. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  1004. png_read_push_finish_row(png_ptr);
  1005. }
  1006. if (png_ptr->pass == 6) /* Skip top generated row */
  1007. {
  1008. png_push_have_row(png_ptr, NULL);
  1009. png_read_push_finish_row(png_ptr);
  1010. }
  1011. break;
  1012. }
  1013. default:
  1014. case 6:
  1015. {
  1016. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  1017. png_read_push_finish_row(png_ptr);
  1018. if (png_ptr->pass != 6)
  1019. break;
  1020. png_push_have_row(png_ptr, NULL);
  1021. png_read_push_finish_row(png_ptr);
  1022. }
  1023. }
  1024. }
  1025. else
  1026. #endif
  1027. {
  1028. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  1029. png_read_push_finish_row(png_ptr);
  1030. }
  1031. }
  1032. void /* PRIVATE */
  1033. png_read_push_finish_row(png_structp png_ptr)
  1034. {
  1035. /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
  1036. /* Start of interlace block */
  1037. PNG_CONST int FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0};
  1038. /* Offset to next interlace block */
  1039. PNG_CONST int FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1};
  1040. /* Start of interlace block in the y direction */
  1041. PNG_CONST int FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1};
  1042. /* Offset to next interlace block in the y direction */
  1043. PNG_CONST int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
  1044. /* Height of interlace block. This is not currently used - if you need
  1045. * it, uncomment it here and in png.h
  1046. PNG_CONST int FARDATA png_pass_height[] = {8, 8, 4, 4, 2, 2, 1};
  1047. */
  1048. png_ptr->row_number++;
  1049. if (png_ptr->row_number < png_ptr->num_rows)
  1050. return;
  1051. #ifdef PNG_READ_INTERLACING_SUPPORTED
  1052. if (png_ptr->interlaced)
  1053. {
  1054. png_ptr->row_number = 0;
  1055. png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
  1056. do
  1057. {
  1058. png_ptr->pass++;
  1059. if ((png_ptr->pass == 1 && png_ptr->width < 5) ||
  1060. (png_ptr->pass == 3 && png_ptr->width < 3) ||
  1061. (png_ptr->pass == 5 && png_ptr->width < 2))
  1062. png_ptr->pass++;
  1063. if (png_ptr->pass > 7)
  1064. png_ptr->pass--;
  1065. if (png_ptr->pass >= 7)
  1066. break;
  1067. png_ptr->iwidth = (png_ptr->width +
  1068. png_pass_inc[png_ptr->pass] - 1 -
  1069. png_pass_start[png_ptr->pass]) /
  1070. png_pass_inc[png_ptr->pass];
  1071. if (png_ptr->transformations & PNG_INTERLACE)
  1072. break;
  1073. png_ptr->num_rows = (png_ptr->height +
  1074. png_pass_yinc[png_ptr->pass] - 1 -
  1075. png_pass_ystart[png_ptr->pass]) /
  1076. png_pass_yinc[png_ptr->pass];
  1077. } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0);
  1078. }
  1079. #endif /* PNG_READ_INTERLACING_SUPPORTED */
  1080. }
  1081. #ifdef PNG_READ_tEXt_SUPPORTED
  1082. void /* PRIVATE */
  1083. png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
  1084. length)
  1085. {
  1086. if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
  1087. {
  1088. PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
  1089. png_error(png_ptr, "Out of place tEXt");
  1090. /*NOT REACHED*/
  1091. }
  1092. #ifdef PNG_MAX_MALLOC_64K
  1093. png_ptr->skip_length = 0; /* This may not be necessary */
  1094. if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
  1095. {
  1096. png_warning(png_ptr, "tEXt chunk too large to fit in memory");
  1097. png_ptr->skip_length = length - (png_uint_32)65535L;
  1098. length = (png_uint_32)65535L;
  1099. }
  1100. #endif
  1101. png_ptr->current_text = (png_charp)png_malloc(png_ptr,
  1102. (png_size_t)(length + 1));
  1103. png_ptr->current_text[length] = '\0';
  1104. png_ptr->current_text_ptr = png_ptr->current_text;
  1105. png_ptr->current_text_size = (png_size_t)length;
  1106. png_ptr->current_text_left = (png_size_t)length;
  1107. png_ptr->process_mode = PNG_READ_tEXt_MODE;
  1108. }
  1109. void /* PRIVATE */
  1110. png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
  1111. {
  1112. if (png_ptr->buffer_size && png_ptr->current_text_left)
  1113. {
  1114. png_size_t text_size;
  1115. if (png_ptr->buffer_size < png_ptr->current_text_left)
  1116. text_size = png_ptr->buffer_size;
  1117. else
  1118. text_size = png_ptr->current_text_left;
  1119. png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
  1120. png_ptr->current_text_left -= text_size;
  1121. png_ptr->current_text_ptr += text_size;
  1122. }
  1123. if (!(png_ptr->current_text_left))
  1124. {
  1125. png_textp text_ptr;
  1126. png_charp text;
  1127. png_charp key;
  1128. int ret;
  1129. if (png_ptr->buffer_size < 4)
  1130. {
  1131. png_push_save_buffer(png_ptr);
  1132. return;
  1133. }
  1134. png_push_crc_finish(png_ptr);
  1135. #ifdef PNG_MAX_MALLOC_64K
  1136. if (png_ptr->skip_length)
  1137. return;
  1138. #endif
  1139. key = png_ptr->current_text;
  1140. for (text = key; *text; text++)
  1141. /* Empty loop */ ;
  1142. if (text < key + png_ptr->current_text_size)
  1143. text++;
  1144. text_ptr = (png_textp)png_malloc(png_ptr, png_sizeof(png_text));
  1145. text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
  1146. text_ptr->key = key;
  1147. text_ptr->itxt_length = 0;
  1148. text_ptr->lang = NULL;
  1149. text_ptr->lang_key = NULL;
  1150. text_ptr->text = text;
  1151. ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
  1152. png_free(png_ptr, key);
  1153. png_free(png_ptr, text_ptr);
  1154. png_ptr->current_text = NULL;
  1155. if (ret)
  1156. png_warning(png_ptr, "Insufficient memory to store text chunk");
  1157. }
  1158. }
  1159. #endif
  1160. #ifdef PNG_READ_zTXt_SUPPORTED
  1161. void /* PRIVATE */
  1162. png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
  1163. length)
  1164. {
  1165. if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
  1166. {
  1167. PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
  1168. png_error(png_ptr, "Out of place zTXt");
  1169. /*NOT REACHED*/
  1170. }
  1171. #ifdef PNG_MAX_MALLOC_64K
  1172. /* We can't handle zTXt chunks > 64K, since we don't have enough space
  1173. * to be able to store the uncompressed data. Actually, the threshold
  1174. * is probably around 32K, but it isn't as definite as 64K is.
  1175. */
  1176. if (length > (png_uint_32)65535L)
  1177. {
  1178. png_warning(png_ptr, "zTXt chunk too large to fit in memory");
  1179. png_push_crc_skip(png_ptr, length);
  1180. return;
  1181. }
  1182. #endif
  1183. png_ptr->current_text = (png_charp)png_malloc(png_ptr,
  1184. (png_size_t)(length + 1));
  1185. png_ptr->current_text[length] = '\0';
  1186. png_ptr->current_text_ptr = png_ptr->current_text;
  1187. png_ptr->current_text_size = (png_size_t)length;
  1188. png_ptr->current_text_left = (png_size_t)length;
  1189. png_ptr->process_mode = PNG_READ_zTXt_MODE;
  1190. }
  1191. void /* PRIVATE */
  1192. png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
  1193. {
  1194. if (png_ptr->buffer_size && png_ptr->current_text_left)
  1195. {
  1196. png_size_t text_size;
  1197. if (png_ptr->buffer_size < (png_uint_32)png_ptr->current_text_left)
  1198. text_size = png_ptr->buffer_size;
  1199. else
  1200. text_size = png_ptr->current_text_left;
  1201. png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
  1202. png_ptr->current_text_left -= text_size;
  1203. png_ptr->current_text_ptr += text_size;
  1204. }
  1205. if (!(png_ptr->current_text_left))
  1206. {
  1207. png_textp text_ptr;
  1208. png_charp text;
  1209. png_charp key;
  1210. int ret;
  1211. png_size_t text_size, key_size;
  1212. if (png_ptr->buffer_size < 4)
  1213. {
  1214. png_push_save_buffer(png_ptr);
  1215. return;
  1216. }
  1217. png_push_crc_finish(png_ptr);
  1218. key = png_ptr->current_text;
  1219. for (text = key; *text; text++)
  1220. /* Empty loop */ ;
  1221. /* zTXt can't have zero text */
  1222. if (text >= key + png_ptr->current_text_size)
  1223. {
  1224. png_ptr->current_text = NULL;
  1225. png_free(png_ptr, key);
  1226. return;
  1227. }
  1228. text++;
  1229. if (*text != PNG_TEXT_COMPRESSION_zTXt) /* Check compression byte */
  1230. {
  1231. png_ptr->current_text = NULL;
  1232. png_free(png_ptr, key);
  1233. return;
  1234. }
  1235. text++;
  1236. png_ptr->zstream.next_in = (png_bytep)text;
  1237. png_ptr->zstream.avail_in = (uInt)(png_ptr->current_text_size -
  1238. (text - key));
  1239. png_ptr->zstream.next_out = png_ptr->zbuf;
  1240. png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
  1241. key_size = text - key;
  1242. text_size = 0;
  1243. text = NULL;
  1244. ret = Z_STREAM_END;
  1245. while (png_ptr->zstream.avail_in)
  1246. {
  1247. ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
  1248. if (ret != Z_OK && ret != Z_STREAM_END)
  1249. {
  1250. inflateReset(&png_ptr->zstream);
  1251. png_ptr->zstream.avail_in = 0;
  1252. png_ptr->current_text = NULL;
  1253. png_free(png_ptr, key);
  1254. png_free(png_ptr, text);
  1255. return;
  1256. }
  1257. if (!(png_ptr->zstream.avail_out) || ret == Z_STREAM_END)
  1258. {
  1259. if (text == NULL)
  1260. {
  1261. text = (png_charp)png_malloc(png_ptr,
  1262. (png_ptr->zbuf_size
  1263. - png_ptr->zstream.avail_out + key_size + 1));
  1264. png_memcpy(text + key_size, png_ptr->zbuf,
  1265. png_ptr->zbuf_size - png_ptr->zstream.avail_out);
  1266. png_memcpy(text, key, key_size);
  1267. text_size = key_size + png_ptr->zbuf_size -
  1268. png_ptr->zstream.avail_out;
  1269. *(text + text_size) = '\0';
  1270. }
  1271. else
  1272. {
  1273. png_charp tmp;
  1274. tmp = text;
  1275. text = (png_charp)png_malloc(png_ptr, text_size +
  1276. (png_ptr->zbuf_size
  1277. - png_ptr->zstream.avail_out + 1));
  1278. png_memcpy(text, tmp, text_size);
  1279. png_free(png_ptr, tmp);
  1280. png_memcpy(text + text_size, png_ptr->zbuf,
  1281. png_ptr->zbuf_size - png_ptr->zstream.avail_out);
  1282. text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
  1283. *(text + text_size) = '\0';
  1284. }
  1285. if (ret != Z_STREAM_END)
  1286. {
  1287. png_ptr->zstream.next_out = png_ptr->zbuf;
  1288. png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
  1289. }
  1290. }
  1291. else
  1292. {
  1293. break;
  1294. }
  1295. if (ret == Z_STREAM_END)
  1296. break;
  1297. }
  1298. inflateReset(&png_ptr->zstream);
  1299. png_ptr->zstream.avail_in = 0;
  1300. if (ret != Z_STREAM_END)
  1301. {
  1302. png_ptr->current_text = NULL;
  1303. png_free(png_ptr, key);
  1304. png_free(png_ptr, text);
  1305. return;
  1306. }
  1307. png_ptr->current_text = NULL;
  1308. png_free(png_ptr, key);
  1309. key = text;
  1310. text += key_size;
  1311. text_ptr = (png_textp)png_malloc(png_ptr,
  1312. png_sizeof(png_text));
  1313. text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
  1314. text_ptr->key = key;
  1315. text_ptr->itxt_length = 0;
  1316. text_ptr->lang = NULL;
  1317. text_ptr->lang_key = NULL;
  1318. text_ptr->text = text;
  1319. ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
  1320. png_free(png_ptr, key);
  1321. png_free(png_ptr, text_ptr);
  1322. if (ret)
  1323. png_warning(png_ptr, "Insufficient memory to store text chunk");
  1324. }
  1325. }
  1326. #endif
  1327. #ifdef PNG_READ_iTXt_SUPPORTED
  1328. void /* PRIVATE */
  1329. png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
  1330. length)
  1331. {
  1332. if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
  1333. {
  1334. PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
  1335. png_error(png_ptr, "Out of place iTXt");
  1336. /*NOT REACHED*/
  1337. }
  1338. #ifdef PNG_MAX_MALLOC_64K
  1339. png_ptr->skip_length = 0; /* This may not be necessary */
  1340. if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
  1341. {
  1342. png_warning(png_ptr, "iTXt chunk too large to fit in memory");
  1343. png_ptr->skip_length = length - (png_uint_32)65535L;
  1344. length = (png_uint_32)65535L;
  1345. }
  1346. #endif
  1347. png_ptr->current_text = (png_charp)png_malloc(png_ptr,
  1348. (png_size_t)(length + 1));
  1349. png_ptr->current_text[length] = '\0';
  1350. png_ptr->current_text_ptr = png_ptr->current_text;
  1351. png_ptr->current_text_size = (png_size_t)length;
  1352. png_ptr->current_text_left = (png_size_t)length;
  1353. png_ptr->process_mode = PNG_READ_iTXt_MODE;
  1354. }
  1355. void /* PRIVATE */
  1356. png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
  1357. {
  1358. if (png_ptr->buffer_size && png_ptr->current_text_left)
  1359. {
  1360. png_size_t text_size;
  1361. if (png_ptr->buffer_size < png_ptr->current_text_left)
  1362. text_size = png_ptr->buffer_size;
  1363. else
  1364. text_size = png_ptr->current_text_left;
  1365. png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
  1366. png_ptr->current_text_left -= text_size;
  1367. png_ptr->current_text_ptr += text_size;
  1368. }
  1369. if (!(png_ptr->current_text_left))
  1370. {
  1371. png_textp text_ptr;
  1372. png_charp key;
  1373. int comp_flag;
  1374. png_charp lang;
  1375. png_charp lang_key;
  1376. png_charp text;
  1377. int ret;
  1378. if (png_ptr->buffer_size < 4)
  1379. {
  1380. png_push_save_buffer(png_ptr);
  1381. return;
  1382. }
  1383. png_push_crc_finish(png_ptr);
  1384. #ifdef PNG_MAX_MALLOC_64K
  1385. if (png_ptr->skip_length)
  1386. return;
  1387. #endif
  1388. key = png_ptr->current_text;
  1389. for (lang = key; *lang; lang++)
  1390. /* Empty loop */ ;
  1391. if (lang < key + png_ptr->current_text_size - 3)
  1392. lang++;
  1393. comp_flag = *lang++;
  1394. lang++; /* Skip comp_type, always zero */
  1395. for (lang_key = lang; *lang_key; lang_key++)
  1396. /* Empty loop */ ;
  1397. lang_key++; /* Skip NUL separator */
  1398. text=lang_key;
  1399. if (lang_key < key + png_ptr->current_text_size - 1)
  1400. {
  1401. for (; *text; text++)
  1402. /* Empty loop */ ;
  1403. }
  1404. if (text < key + png_ptr->current_text_size)
  1405. text++;
  1406. text_ptr = (png_textp)png_malloc(png_ptr,
  1407. png_sizeof(png_text));
  1408. text_ptr->compression = comp_flag + 2;
  1409. text_ptr->key = key;
  1410. text_ptr->lang = lang;
  1411. text_ptr->lang_key = lang_key;
  1412. text_ptr->text = text;
  1413. text_ptr->text_length = 0;
  1414. text_ptr->itxt_length = png_strlen(text);
  1415. ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
  1416. png_ptr->current_text = NULL;
  1417. png_free(png_ptr, text_ptr);
  1418. if (ret)
  1419. png_warning(png_ptr, "Insufficient memory to store iTXt chunk");
  1420. }
  1421. }
  1422. #endif
  1423. /* This function is called when we haven't found a handler for this
  1424. * chunk. If there isn't a problem with the chunk itself (ie a bad chunk
  1425. * name or a critical chunk), the chunk is (currently) silently ignored.
  1426. */
  1427. void /* PRIVATE */
  1428. png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
  1429. length)
  1430. {
  1431. png_uint_32 skip = 0;
  1432. if (!(png_ptr->chunk_name[0] & 0x20))
  1433. {
  1434. #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
  1435. if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
  1436. PNG_HANDLE_CHUNK_ALWAYS
  1437. #ifdef PNG_READ_USER_CHUNKS_SUPPORTED
  1438. && png_ptr->read_user_chunk_fn == NULL
  1439. #endif
  1440. )
  1441. #endif
  1442. png_chunk_error(png_ptr, "unknown critical chunk");
  1443. PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */
  1444. }
  1445. #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
  1446. if (png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
  1447. {
  1448. #ifdef PNG_MAX_MALLOC_64K
  1449. if (length > (png_uint_32)65535L)
  1450. {
  1451. png_warning(png_ptr, "unknown chunk too large to fit in memory");
  1452. skip = length - (png_uint_32)65535L;
  1453. length = (png_uint_32)65535L;
  1454. }
  1455. #endif
  1456. png_memcpy((png_charp)png_ptr->unknown_chunk.name,
  1457. (png_charp)png_ptr->chunk_name,
  1458. png_sizeof(png_ptr->unknown_chunk.name));
  1459. png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name) - 1]
  1460. = '\0';
  1461. png_ptr->unknown_chunk.size = (png_size_t)length;
  1462. if (length == 0)
  1463. png_ptr->unknown_chunk.data = NULL;
  1464. else
  1465. {
  1466. png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr,
  1467. (png_size_t)length);
  1468. png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
  1469. }
  1470. #ifdef PNG_READ_USER_CHUNKS_SUPPORTED
  1471. if (png_ptr->read_user_chunk_fn != NULL)
  1472. {
  1473. /* Callback to user unknown chunk handler */
  1474. int ret;
  1475. ret = (*(png_ptr->read_user_chunk_fn))
  1476. (png_ptr, &png_ptr->unknown_chunk);
  1477. if (ret < 0)
  1478. png_chunk_error(png_ptr, "error in user chunk");
  1479. if (ret == 0)
  1480. {
  1481. if (!(png_ptr->chunk_name[0] & 0x20))
  1482. if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
  1483. PNG_HANDLE_CHUNK_ALWAYS)
  1484. png_chunk_error(png_ptr, "unknown critical chunk");
  1485. png_set_unknown_chunks(png_ptr, info_ptr,
  1486. &png_ptr->unknown_chunk, 1);
  1487. }
  1488. }
  1489. else
  1490. #endif
  1491. png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
  1492. png_free(png_ptr, png_ptr->unknown_chunk.data);
  1493. png_ptr->unknown_chunk.data = NULL;
  1494. }
  1495. else
  1496. #endif
  1497. skip=length;
  1498. png_push_crc_skip(png_ptr, skip);
  1499. }
  1500. void /* PRIVATE */
  1501. png_push_have_info(png_structp png_ptr, png_infop info_ptr)
  1502. {
  1503. if (png_ptr->info_fn != NULL)
  1504. (*(png_ptr->info_fn))(png_ptr, info_ptr);
  1505. }
  1506. void /* PRIVATE */
  1507. png_push_have_end(png_structp png_ptr, png_infop info_ptr)
  1508. {
  1509. if (png_ptr->end_fn != NULL)
  1510. (*(png_ptr->end_fn))(png_ptr, info_ptr);
  1511. }
  1512. void /* PRIVATE */
  1513. png_push_have_row(png_structp png_ptr, png_bytep row)
  1514. {
  1515. if (png_ptr->row_fn != NULL)
  1516. (*(png_ptr->row_fn))(png_ptr, row, png_ptr->row_number,
  1517. (int)png_ptr->pass);
  1518. }
  1519. void PNGAPI
  1520. png_progressive_combine_row (png_structp png_ptr, png_bytep old_row,
  1521. png_const_bytep new_row)
  1522. {
  1523. PNG_CONST int FARDATA png_pass_dsp_mask[7] =
  1524. {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff};
  1525. if (png_ptr == NULL)
  1526. return;
  1527. if (new_row != NULL) /* new_row must == png_ptr->row_buf here. */
  1528. png_combine_row(png_ptr, old_row, png_pass_dsp_mask[png_ptr->pass]);
  1529. }
  1530. void PNGAPI
  1531. png_set_progressive_read_fn(png_structp png_ptr, png_voidp progressive_ptr,
  1532. png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn,
  1533. png_progressive_end_ptr end_fn)
  1534. {
  1535. if (png_ptr == NULL)
  1536. return;
  1537. png_ptr->info_fn = info_fn;
  1538. png_ptr->row_fn = row_fn;
  1539. png_ptr->end_fn = end_fn;
  1540. png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
  1541. }
  1542. png_voidp PNGAPI
  1543. png_get_progressive_ptr(png_const_structp png_ptr)
  1544. {
  1545. if (png_ptr == NULL)
  1546. return (NULL);
  1547. return png_ptr->io_ptr;
  1548. }
  1549. #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */