pngpread.c 31 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086
  1. /* pngpread.c - read a png file in push mode
  2. *
  3. * Last changed in libpng 1.6.18 [July 23, 2015]
  4. * Copyright (c) 1998-2015 Glenn Randers-Pehrson
  5. * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  6. * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  7. *
  8. * This code is released under the libpng license.
  9. * For conditions of distribution and use, see the disclaimer
  10. * and license in png.h
  11. */
  12. #include "pngpriv.h"
  13. #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
  14. /* Push model modes */
  15. #define PNG_READ_SIG_MODE 0
  16. #define PNG_READ_CHUNK_MODE 1
  17. #define PNG_READ_IDAT_MODE 2
  18. #define PNG_READ_tEXt_MODE 4
  19. #define PNG_READ_zTXt_MODE 5
  20. #define PNG_READ_DONE_MODE 6
  21. #define PNG_READ_iTXt_MODE 7
  22. #define PNG_ERROR_MODE 8
  23. #define PNG_PUSH_SAVE_BUFFER_IF_FULL \
  24. if (png_ptr->push_length + 4 > png_ptr->buffer_size) \
  25. { png_push_save_buffer(png_ptr); return; }
  26. #define PNG_PUSH_SAVE_BUFFER_IF_LT(N) \
  27. if (png_ptr->buffer_size < N) \
  28. { png_push_save_buffer(png_ptr); return; }
  29. void PNGAPI
  30. png_process_data(png_structrp png_ptr, png_inforp info_ptr,
  31. png_bytep buffer, png_size_t buffer_size)
  32. {
  33. if (png_ptr == NULL || info_ptr == NULL)
  34. return;
  35. png_push_restore_buffer(png_ptr, buffer, buffer_size);
  36. while (png_ptr->buffer_size)
  37. {
  38. png_process_some_data(png_ptr, info_ptr);
  39. }
  40. }
  41. png_size_t PNGAPI
  42. png_process_data_pause(png_structrp png_ptr, int save)
  43. {
  44. if (png_ptr != NULL)
  45. {
  46. /* It's easiest for the caller if we do the save; then the caller doesn't
  47. * have to supply the same data again:
  48. */
  49. if (save != 0)
  50. png_push_save_buffer(png_ptr);
  51. else
  52. {
  53. /* This includes any pending saved bytes: */
  54. png_size_t remaining = png_ptr->buffer_size;
  55. png_ptr->buffer_size = 0;
  56. /* So subtract the saved buffer size, unless all the data
  57. * is actually 'saved', in which case we just return 0
  58. */
  59. if (png_ptr->save_buffer_size < remaining)
  60. return remaining - png_ptr->save_buffer_size;
  61. }
  62. }
  63. return 0;
  64. }
  65. png_uint_32 PNGAPI
  66. png_process_data_skip(png_structrp png_ptr)
  67. {
  68. /* TODO: Deprecate and remove this API.
  69. * Somewhere the implementation of this seems to have been lost,
  70. * or abandoned. It was only to support some internal back-door access
  71. * to png_struct) in libpng-1.4.x.
  72. */
  73. png_app_warning(png_ptr,
  74. "png_process_data_skip is not implemented in any current version of libpng");
  75. return 0;
  76. }
  77. /* What we do with the incoming data depends on what we were previously
  78. * doing before we ran out of data...
  79. */
  80. void /* PRIVATE */
  81. png_process_some_data(png_structrp png_ptr, png_inforp info_ptr)
  82. {
  83. if (png_ptr == NULL)
  84. return;
  85. switch (png_ptr->process_mode)
  86. {
  87. case PNG_READ_SIG_MODE:
  88. {
  89. png_push_read_sig(png_ptr, info_ptr);
  90. break;
  91. }
  92. case PNG_READ_CHUNK_MODE:
  93. {
  94. png_push_read_chunk(png_ptr, info_ptr);
  95. break;
  96. }
  97. case PNG_READ_IDAT_MODE:
  98. {
  99. png_push_read_IDAT(png_ptr);
  100. break;
  101. }
  102. default:
  103. {
  104. png_ptr->buffer_size = 0;
  105. break;
  106. }
  107. }
  108. }
  109. /* Read any remaining signature bytes from the stream and compare them with
  110. * the correct PNG signature. It is possible that this routine is called
  111. * with bytes already read from the signature, either because they have been
  112. * checked by the calling application, or because of multiple calls to this
  113. * routine.
  114. */
  115. void /* PRIVATE */
  116. png_push_read_sig(png_structrp png_ptr, png_inforp info_ptr)
  117. {
  118. png_size_t num_checked = png_ptr->sig_bytes, /* SAFE, does not exceed 8 */
  119. num_to_check = 8 - num_checked;
  120. if (png_ptr->buffer_size < num_to_check)
  121. {
  122. num_to_check = png_ptr->buffer_size;
  123. }
  124. png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]),
  125. num_to_check);
  126. png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check);
  127. if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))
  128. {
  129. if (num_checked < 4 &&
  130. png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4))
  131. png_error(png_ptr, "Not a PNG file");
  132. else
  133. png_error(png_ptr, "PNG file corrupted by ASCII conversion");
  134. }
  135. else
  136. {
  137. if (png_ptr->sig_bytes >= 8)
  138. {
  139. png_ptr->process_mode = PNG_READ_CHUNK_MODE;
  140. }
  141. }
  142. }
  143. void /* PRIVATE */
  144. png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr)
  145. {
  146. png_uint_32 chunk_name;
  147. #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  148. int keep; /* unknown handling method */
  149. #endif
  150. /* First we make sure we have enough data for the 4-byte chunk name
  151. * and the 4-byte chunk length before proceeding with decoding the
  152. * chunk data. To fully decode each of these chunks, we also make
  153. * sure we have enough data in the buffer for the 4-byte CRC at the
  154. * end of every chunk (except IDAT, which is handled separately).
  155. */
  156. if ((png_ptr->mode & PNG_HAVE_CHUNK_HEADER) == 0)
  157. {
  158. png_byte chunk_length[4];
  159. png_byte chunk_tag[4];
  160. PNG_PUSH_SAVE_BUFFER_IF_LT(8)
  161. png_push_fill_buffer(png_ptr, chunk_length, 4);
  162. png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
  163. png_reset_crc(png_ptr);
  164. png_crc_read(png_ptr, chunk_tag, 4);
  165. png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag);
  166. png_check_chunk_name(png_ptr, png_ptr->chunk_name);
  167. png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
  168. }
  169. chunk_name = png_ptr->chunk_name;
  170. if (chunk_name == png_IDAT)
  171. {
  172. if ((png_ptr->mode & PNG_AFTER_IDAT) != 0)
  173. png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
  174. /* If we reach an IDAT chunk, this means we have read all of the
  175. * header chunks, and we can start reading the image (or if this
  176. * is called after the image has been read - we have an error).
  177. */
  178. if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
  179. png_error(png_ptr, "Missing IHDR before IDAT");
  180. else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
  181. (png_ptr->mode & PNG_HAVE_PLTE) == 0)
  182. png_error(png_ptr, "Missing PLTE before IDAT");
  183. png_ptr->mode |= PNG_HAVE_IDAT;
  184. png_ptr->process_mode = PNG_READ_IDAT_MODE;
  185. if ((png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT) == 0)
  186. if (png_ptr->push_length == 0)
  187. return;
  188. if ((png_ptr->mode & PNG_AFTER_IDAT) != 0)
  189. png_benign_error(png_ptr, "Too many IDATs found");
  190. }
  191. if (chunk_name == png_IHDR)
  192. {
  193. if (png_ptr->push_length != 13)
  194. png_error(png_ptr, "Invalid IHDR length");
  195. PNG_PUSH_SAVE_BUFFER_IF_FULL
  196. png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length);
  197. }
  198. else if (chunk_name == png_IEND)
  199. {
  200. PNG_PUSH_SAVE_BUFFER_IF_FULL
  201. png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length);
  202. png_ptr->process_mode = PNG_READ_DONE_MODE;
  203. png_push_have_end(png_ptr, info_ptr);
  204. }
  205. #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
  206. else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0)
  207. {
  208. PNG_PUSH_SAVE_BUFFER_IF_FULL
  209. png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length, keep);
  210. if (chunk_name == png_PLTE)
  211. png_ptr->mode |= PNG_HAVE_PLTE;
  212. }
  213. #endif
  214. else if (chunk_name == png_PLTE)
  215. {
  216. PNG_PUSH_SAVE_BUFFER_IF_FULL
  217. png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length);
  218. }
  219. else if (chunk_name == png_IDAT)
  220. {
  221. png_ptr->idat_size = png_ptr->push_length;
  222. png_ptr->process_mode = PNG_READ_IDAT_MODE;
  223. png_push_have_info(png_ptr, info_ptr);
  224. png_ptr->zstream.avail_out =
  225. (uInt) PNG_ROWBYTES(png_ptr->pixel_depth,
  226. png_ptr->iwidth) + 1;
  227. png_ptr->zstream.next_out = png_ptr->row_buf;
  228. return;
  229. }
  230. #ifdef PNG_READ_gAMA_SUPPORTED
  231. else if (png_ptr->chunk_name == png_gAMA)
  232. {
  233. PNG_PUSH_SAVE_BUFFER_IF_FULL
  234. png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length);
  235. }
  236. #endif
  237. #ifdef PNG_READ_sBIT_SUPPORTED
  238. else if (png_ptr->chunk_name == png_sBIT)
  239. {
  240. PNG_PUSH_SAVE_BUFFER_IF_FULL
  241. png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length);
  242. }
  243. #endif
  244. #ifdef PNG_READ_cHRM_SUPPORTED
  245. else if (png_ptr->chunk_name == png_cHRM)
  246. {
  247. PNG_PUSH_SAVE_BUFFER_IF_FULL
  248. png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length);
  249. }
  250. #endif
  251. #ifdef PNG_READ_sRGB_SUPPORTED
  252. else if (chunk_name == png_sRGB)
  253. {
  254. PNG_PUSH_SAVE_BUFFER_IF_FULL
  255. png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length);
  256. }
  257. #endif
  258. #ifdef PNG_READ_iCCP_SUPPORTED
  259. else if (png_ptr->chunk_name == png_iCCP)
  260. {
  261. PNG_PUSH_SAVE_BUFFER_IF_FULL
  262. png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length);
  263. }
  264. #endif
  265. #ifdef PNG_READ_sPLT_SUPPORTED
  266. else if (chunk_name == png_sPLT)
  267. {
  268. PNG_PUSH_SAVE_BUFFER_IF_FULL
  269. png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length);
  270. }
  271. #endif
  272. #ifdef PNG_READ_tRNS_SUPPORTED
  273. else if (chunk_name == png_tRNS)
  274. {
  275. PNG_PUSH_SAVE_BUFFER_IF_FULL
  276. png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length);
  277. }
  278. #endif
  279. #ifdef PNG_READ_bKGD_SUPPORTED
  280. else if (chunk_name == png_bKGD)
  281. {
  282. PNG_PUSH_SAVE_BUFFER_IF_FULL
  283. png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length);
  284. }
  285. #endif
  286. #ifdef PNG_READ_hIST_SUPPORTED
  287. else if (chunk_name == png_hIST)
  288. {
  289. PNG_PUSH_SAVE_BUFFER_IF_FULL
  290. png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length);
  291. }
  292. #endif
  293. #ifdef PNG_READ_pHYs_SUPPORTED
  294. else if (chunk_name == png_pHYs)
  295. {
  296. PNG_PUSH_SAVE_BUFFER_IF_FULL
  297. png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length);
  298. }
  299. #endif
  300. #ifdef PNG_READ_oFFs_SUPPORTED
  301. else if (chunk_name == png_oFFs)
  302. {
  303. PNG_PUSH_SAVE_BUFFER_IF_FULL
  304. png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length);
  305. }
  306. #endif
  307. #ifdef PNG_READ_pCAL_SUPPORTED
  308. else if (chunk_name == png_pCAL)
  309. {
  310. PNG_PUSH_SAVE_BUFFER_IF_FULL
  311. png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length);
  312. }
  313. #endif
  314. #ifdef PNG_READ_sCAL_SUPPORTED
  315. else if (chunk_name == png_sCAL)
  316. {
  317. PNG_PUSH_SAVE_BUFFER_IF_FULL
  318. png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length);
  319. }
  320. #endif
  321. #ifdef PNG_READ_tIME_SUPPORTED
  322. else if (chunk_name == png_tIME)
  323. {
  324. PNG_PUSH_SAVE_BUFFER_IF_FULL
  325. png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length);
  326. }
  327. #endif
  328. #ifdef PNG_READ_tEXt_SUPPORTED
  329. else if (chunk_name == png_tEXt)
  330. {
  331. PNG_PUSH_SAVE_BUFFER_IF_FULL
  332. png_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
  333. }
  334. #endif
  335. #ifdef PNG_READ_zTXt_SUPPORTED
  336. else if (chunk_name == png_zTXt)
  337. {
  338. PNG_PUSH_SAVE_BUFFER_IF_FULL
  339. png_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
  340. }
  341. #endif
  342. #ifdef PNG_READ_iTXt_SUPPORTED
  343. else if (chunk_name == png_iTXt)
  344. {
  345. PNG_PUSH_SAVE_BUFFER_IF_FULL
  346. png_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
  347. }
  348. #endif
  349. else
  350. {
  351. PNG_PUSH_SAVE_BUFFER_IF_FULL
  352. png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length,
  353. PNG_HANDLE_CHUNK_AS_DEFAULT);
  354. }
  355. png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
  356. }
  357. void PNGCBAPI
  358. png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
  359. {
  360. png_bytep ptr;
  361. if (png_ptr == NULL)
  362. return;
  363. ptr = buffer;
  364. if (png_ptr->save_buffer_size != 0)
  365. {
  366. png_size_t save_size;
  367. if (length < png_ptr->save_buffer_size)
  368. save_size = length;
  369. else
  370. save_size = png_ptr->save_buffer_size;
  371. memcpy(ptr, png_ptr->save_buffer_ptr, save_size);
  372. length -= save_size;
  373. ptr += save_size;
  374. png_ptr->buffer_size -= save_size;
  375. png_ptr->save_buffer_size -= save_size;
  376. png_ptr->save_buffer_ptr += save_size;
  377. }
  378. if (length != 0 && png_ptr->current_buffer_size != 0)
  379. {
  380. png_size_t save_size;
  381. if (length < png_ptr->current_buffer_size)
  382. save_size = length;
  383. else
  384. save_size = png_ptr->current_buffer_size;
  385. memcpy(ptr, png_ptr->current_buffer_ptr, save_size);
  386. png_ptr->buffer_size -= save_size;
  387. png_ptr->current_buffer_size -= save_size;
  388. png_ptr->current_buffer_ptr += save_size;
  389. }
  390. }
  391. void /* PRIVATE */
  392. png_push_save_buffer(png_structrp png_ptr)
  393. {
  394. if (png_ptr->save_buffer_size != 0)
  395. {
  396. if (png_ptr->save_buffer_ptr != png_ptr->save_buffer)
  397. {
  398. png_size_t i, istop;
  399. png_bytep sp;
  400. png_bytep dp;
  401. istop = png_ptr->save_buffer_size;
  402. for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer;
  403. i < istop; i++, sp++, dp++)
  404. {
  405. *dp = *sp;
  406. }
  407. }
  408. }
  409. if (png_ptr->save_buffer_size + png_ptr->current_buffer_size >
  410. png_ptr->save_buffer_max)
  411. {
  412. png_size_t new_max;
  413. png_bytep old_buffer;
  414. if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
  415. (png_ptr->current_buffer_size + 256))
  416. {
  417. png_error(png_ptr, "Potential overflow of save_buffer");
  418. }
  419. new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
  420. old_buffer = png_ptr->save_buffer;
  421. png_ptr->save_buffer = (png_bytep)png_malloc_warn(png_ptr,
  422. (png_size_t)new_max);
  423. if (png_ptr->save_buffer == NULL)
  424. {
  425. png_free(png_ptr, old_buffer);
  426. png_error(png_ptr, "Insufficient memory for save_buffer");
  427. }
  428. memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
  429. png_free(png_ptr, old_buffer);
  430. png_ptr->save_buffer_max = new_max;
  431. }
  432. if (png_ptr->current_buffer_size)
  433. {
  434. memcpy(png_ptr->save_buffer + png_ptr->save_buffer_size,
  435. png_ptr->current_buffer_ptr, png_ptr->current_buffer_size);
  436. png_ptr->save_buffer_size += png_ptr->current_buffer_size;
  437. png_ptr->current_buffer_size = 0;
  438. }
  439. png_ptr->save_buffer_ptr = png_ptr->save_buffer;
  440. png_ptr->buffer_size = 0;
  441. }
  442. void /* PRIVATE */
  443. png_push_restore_buffer(png_structrp png_ptr, png_bytep buffer,
  444. png_size_t buffer_length)
  445. {
  446. png_ptr->current_buffer = buffer;
  447. png_ptr->current_buffer_size = buffer_length;
  448. png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size;
  449. png_ptr->current_buffer_ptr = png_ptr->current_buffer;
  450. }
  451. void /* PRIVATE */
  452. png_push_read_IDAT(png_structrp png_ptr)
  453. {
  454. if ((png_ptr->mode & PNG_HAVE_CHUNK_HEADER) == 0)
  455. {
  456. png_byte chunk_length[4];
  457. png_byte chunk_tag[4];
  458. /* TODO: this code can be commoned up with the same code in push_read */
  459. PNG_PUSH_SAVE_BUFFER_IF_LT(8)
  460. png_push_fill_buffer(png_ptr, chunk_length, 4);
  461. png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
  462. png_reset_crc(png_ptr);
  463. png_crc_read(png_ptr, chunk_tag, 4);
  464. png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag);
  465. png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
  466. if (png_ptr->chunk_name != png_IDAT)
  467. {
  468. png_ptr->process_mode = PNG_READ_CHUNK_MODE;
  469. if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
  470. png_error(png_ptr, "Not enough compressed data");
  471. return;
  472. }
  473. png_ptr->idat_size = png_ptr->push_length;
  474. }
  475. if (png_ptr->idat_size != 0 && png_ptr->save_buffer_size != 0)
  476. {
  477. png_size_t save_size = png_ptr->save_buffer_size;
  478. png_uint_32 idat_size = png_ptr->idat_size;
  479. /* We want the smaller of 'idat_size' and 'current_buffer_size', but they
  480. * are of different types and we don't know which variable has the fewest
  481. * bits. Carefully select the smaller and cast it to the type of the
  482. * larger - this cannot overflow. Do not cast in the following test - it
  483. * will break on either 16-bit or 64-bit platforms.
  484. */
  485. if (idat_size < save_size)
  486. save_size = (png_size_t)idat_size;
  487. else
  488. idat_size = (png_uint_32)save_size;
  489. png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
  490. png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size);
  491. png_ptr->idat_size -= idat_size;
  492. png_ptr->buffer_size -= save_size;
  493. png_ptr->save_buffer_size -= save_size;
  494. png_ptr->save_buffer_ptr += save_size;
  495. }
  496. if (png_ptr->idat_size != 0 && png_ptr->current_buffer_size != 0)
  497. {
  498. png_size_t save_size = png_ptr->current_buffer_size;
  499. png_uint_32 idat_size = png_ptr->idat_size;
  500. /* We want the smaller of 'idat_size' and 'current_buffer_size', but they
  501. * are of different types and we don't know which variable has the fewest
  502. * bits. Carefully select the smaller and cast it to the type of the
  503. * larger - this cannot overflow.
  504. */
  505. if (idat_size < save_size)
  506. save_size = (png_size_t)idat_size;
  507. else
  508. idat_size = (png_uint_32)save_size;
  509. png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
  510. png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
  511. png_ptr->idat_size -= idat_size;
  512. png_ptr->buffer_size -= save_size;
  513. png_ptr->current_buffer_size -= save_size;
  514. png_ptr->current_buffer_ptr += save_size;
  515. }
  516. if (png_ptr->idat_size == 0)
  517. {
  518. PNG_PUSH_SAVE_BUFFER_IF_LT(4)
  519. png_crc_finish(png_ptr, 0);
  520. png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
  521. png_ptr->mode |= PNG_AFTER_IDAT;
  522. png_ptr->zowner = 0;
  523. }
  524. }
  525. void /* PRIVATE */
  526. png_process_IDAT_data(png_structrp png_ptr, png_bytep buffer,
  527. png_size_t buffer_length)
  528. {
  529. /* The caller checks for a non-zero buffer length. */
  530. if (!(buffer_length > 0) || buffer == NULL)
  531. png_error(png_ptr, "No IDAT data (internal error)");
  532. /* This routine must process all the data it has been given
  533. * before returning, calling the row callback as required to
  534. * handle the uncompressed results.
  535. */
  536. png_ptr->zstream.next_in = buffer;
  537. /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */
  538. png_ptr->zstream.avail_in = (uInt)buffer_length;
  539. /* Keep going until the decompressed data is all processed
  540. * or the stream marked as finished.
  541. */
  542. while (png_ptr->zstream.avail_in > 0 &&
  543. (png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0)
  544. {
  545. int ret;
  546. /* We have data for zlib, but we must check that zlib
  547. * has someplace to put the results. It doesn't matter
  548. * if we don't expect any results -- it may be the input
  549. * data is just the LZ end code.
  550. */
  551. if (!(png_ptr->zstream.avail_out > 0))
  552. {
  553. /* TODO: WARNING: TRUNCATION ERROR: DANGER WILL ROBINSON: */
  554. png_ptr->zstream.avail_out = (uInt)(PNG_ROWBYTES(png_ptr->pixel_depth,
  555. png_ptr->iwidth) + 1);
  556. png_ptr->zstream.next_out = png_ptr->row_buf;
  557. }
  558. /* Using Z_SYNC_FLUSH here means that an unterminated
  559. * LZ stream (a stream with a missing end code) can still
  560. * be handled, otherwise (Z_NO_FLUSH) a future zlib
  561. * implementation might defer output and therefore
  562. * change the current behavior (see comments in inflate.c
  563. * for why this doesn't happen at present with zlib 1.2.5).
  564. */
  565. ret = PNG_INFLATE(png_ptr, Z_SYNC_FLUSH);
  566. /* Check for any failure before proceeding. */
  567. if (ret != Z_OK && ret != Z_STREAM_END)
  568. {
  569. /* Terminate the decompression. */
  570. png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
  571. png_ptr->zowner = 0;
  572. /* This may be a truncated stream (missing or
  573. * damaged end code). Treat that as a warning.
  574. */
  575. if (png_ptr->row_number >= png_ptr->num_rows ||
  576. png_ptr->pass > 6)
  577. png_warning(png_ptr, "Truncated compressed data in IDAT");
  578. else
  579. png_error(png_ptr, "Decompression error in IDAT");
  580. /* Skip the check on unprocessed input */
  581. return;
  582. }
  583. /* Did inflate output any data? */
  584. if (png_ptr->zstream.next_out != png_ptr->row_buf)
  585. {
  586. /* Is this unexpected data after the last row?
  587. * If it is, artificially terminate the LZ output
  588. * here.
  589. */
  590. if (png_ptr->row_number >= png_ptr->num_rows ||
  591. png_ptr->pass > 6)
  592. {
  593. /* Extra data. */
  594. png_warning(png_ptr, "Extra compressed data in IDAT");
  595. png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
  596. png_ptr->zowner = 0;
  597. /* Do no more processing; skip the unprocessed
  598. * input check below.
  599. */
  600. return;
  601. }
  602. /* Do we have a complete row? */
  603. if (png_ptr->zstream.avail_out == 0)
  604. png_push_process_row(png_ptr);
  605. }
  606. /* And check for the end of the stream. */
  607. if (ret == Z_STREAM_END)
  608. png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED;
  609. }
  610. /* All the data should have been processed, if anything
  611. * is left at this point we have bytes of IDAT data
  612. * after the zlib end code.
  613. */
  614. if (png_ptr->zstream.avail_in > 0)
  615. png_warning(png_ptr, "Extra compression data in IDAT");
  616. }
  617. void /* PRIVATE */
  618. png_push_process_row(png_structrp png_ptr)
  619. {
  620. /* 1.5.6: row_info moved out of png_struct to a local here. */
  621. png_row_info row_info;
  622. row_info.width = png_ptr->iwidth; /* NOTE: width of current interlaced row */
  623. row_info.color_type = png_ptr->color_type;
  624. row_info.bit_depth = png_ptr->bit_depth;
  625. row_info.channels = png_ptr->channels;
  626. row_info.pixel_depth = png_ptr->pixel_depth;
  627. row_info.rowbytes = PNG_ROWBYTES(row_info.pixel_depth, row_info.width);
  628. if (png_ptr->row_buf[0] > PNG_FILTER_VALUE_NONE)
  629. {
  630. if (png_ptr->row_buf[0] < PNG_FILTER_VALUE_LAST)
  631. png_read_filter_row(png_ptr, &row_info, png_ptr->row_buf + 1,
  632. png_ptr->prev_row + 1, png_ptr->row_buf[0]);
  633. else
  634. png_error(png_ptr, "bad adaptive filter value");
  635. }
  636. /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before
  637. * 1.5.6, while the buffer really is this big in current versions of libpng
  638. * it may not be in the future, so this was changed just to copy the
  639. * interlaced row count:
  640. */
  641. memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1);
  642. #ifdef PNG_READ_TRANSFORMS_SUPPORTED
  643. if (png_ptr->transformations != 0)
  644. png_do_read_transformations(png_ptr, &row_info);
  645. #endif
  646. /* The transformed pixel depth should match the depth now in row_info. */
  647. if (png_ptr->transformed_pixel_depth == 0)
  648. {
  649. png_ptr->transformed_pixel_depth = row_info.pixel_depth;
  650. if (row_info.pixel_depth > png_ptr->maximum_pixel_depth)
  651. png_error(png_ptr, "progressive row overflow");
  652. }
  653. else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth)
  654. png_error(png_ptr, "internal progressive row size calculation error");
  655. #ifdef PNG_READ_INTERLACING_SUPPORTED
  656. /* Expand interlaced rows to full size */
  657. if (png_ptr->interlaced != 0 &&
  658. (png_ptr->transformations & PNG_INTERLACE) != 0)
  659. {
  660. if (png_ptr->pass < 6)
  661. png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass,
  662. png_ptr->transformations);
  663. switch (png_ptr->pass)
  664. {
  665. case 0:
  666. {
  667. int i;
  668. for (i = 0; i < 8 && png_ptr->pass == 0; i++)
  669. {
  670. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  671. png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */
  672. }
  673. if (png_ptr->pass == 2) /* Pass 1 might be empty */
  674. {
  675. for (i = 0; i < 4 && png_ptr->pass == 2; i++)
  676. {
  677. png_push_have_row(png_ptr, NULL);
  678. png_read_push_finish_row(png_ptr);
  679. }
  680. }
  681. if (png_ptr->pass == 4 && png_ptr->height <= 4)
  682. {
  683. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  684. {
  685. png_push_have_row(png_ptr, NULL);
  686. png_read_push_finish_row(png_ptr);
  687. }
  688. }
  689. if (png_ptr->pass == 6 && png_ptr->height <= 4)
  690. {
  691. png_push_have_row(png_ptr, NULL);
  692. png_read_push_finish_row(png_ptr);
  693. }
  694. break;
  695. }
  696. case 1:
  697. {
  698. int i;
  699. for (i = 0; i < 8 && png_ptr->pass == 1; i++)
  700. {
  701. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  702. png_read_push_finish_row(png_ptr);
  703. }
  704. if (png_ptr->pass == 2) /* Skip top 4 generated rows */
  705. {
  706. for (i = 0; i < 4 && png_ptr->pass == 2; i++)
  707. {
  708. png_push_have_row(png_ptr, NULL);
  709. png_read_push_finish_row(png_ptr);
  710. }
  711. }
  712. break;
  713. }
  714. case 2:
  715. {
  716. int i;
  717. for (i = 0; i < 4 && png_ptr->pass == 2; i++)
  718. {
  719. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  720. png_read_push_finish_row(png_ptr);
  721. }
  722. for (i = 0; i < 4 && png_ptr->pass == 2; i++)
  723. {
  724. png_push_have_row(png_ptr, NULL);
  725. png_read_push_finish_row(png_ptr);
  726. }
  727. if (png_ptr->pass == 4) /* Pass 3 might be empty */
  728. {
  729. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  730. {
  731. png_push_have_row(png_ptr, NULL);
  732. png_read_push_finish_row(png_ptr);
  733. }
  734. }
  735. break;
  736. }
  737. case 3:
  738. {
  739. int i;
  740. for (i = 0; i < 4 && png_ptr->pass == 3; i++)
  741. {
  742. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  743. png_read_push_finish_row(png_ptr);
  744. }
  745. if (png_ptr->pass == 4) /* Skip top two generated rows */
  746. {
  747. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  748. {
  749. png_push_have_row(png_ptr, NULL);
  750. png_read_push_finish_row(png_ptr);
  751. }
  752. }
  753. break;
  754. }
  755. case 4:
  756. {
  757. int i;
  758. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  759. {
  760. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  761. png_read_push_finish_row(png_ptr);
  762. }
  763. for (i = 0; i < 2 && png_ptr->pass == 4; i++)
  764. {
  765. png_push_have_row(png_ptr, NULL);
  766. png_read_push_finish_row(png_ptr);
  767. }
  768. if (png_ptr->pass == 6) /* Pass 5 might be empty */
  769. {
  770. png_push_have_row(png_ptr, NULL);
  771. png_read_push_finish_row(png_ptr);
  772. }
  773. break;
  774. }
  775. case 5:
  776. {
  777. int i;
  778. for (i = 0; i < 2 && png_ptr->pass == 5; i++)
  779. {
  780. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  781. png_read_push_finish_row(png_ptr);
  782. }
  783. if (png_ptr->pass == 6) /* Skip top generated row */
  784. {
  785. png_push_have_row(png_ptr, NULL);
  786. png_read_push_finish_row(png_ptr);
  787. }
  788. break;
  789. }
  790. default:
  791. case 6:
  792. {
  793. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  794. png_read_push_finish_row(png_ptr);
  795. if (png_ptr->pass != 6)
  796. break;
  797. png_push_have_row(png_ptr, NULL);
  798. png_read_push_finish_row(png_ptr);
  799. }
  800. }
  801. }
  802. else
  803. #endif
  804. {
  805. png_push_have_row(png_ptr, png_ptr->row_buf + 1);
  806. png_read_push_finish_row(png_ptr);
  807. }
  808. }
  809. void /* PRIVATE */
  810. png_read_push_finish_row(png_structrp png_ptr)
  811. {
  812. #ifdef PNG_READ_INTERLACING_SUPPORTED
  813. /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
  814. /* Start of interlace block */
  815. static PNG_CONST png_byte png_pass_start[] = {0, 4, 0, 2, 0, 1, 0};
  816. /* Offset to next interlace block */
  817. static PNG_CONST png_byte png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1};
  818. /* Start of interlace block in the y direction */
  819. static PNG_CONST png_byte png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1};
  820. /* Offset to next interlace block in the y direction */
  821. static PNG_CONST png_byte png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
  822. /* Height of interlace block. This is not currently used - if you need
  823. * it, uncomment it here and in png.h
  824. static PNG_CONST png_byte png_pass_height[] = {8, 8, 4, 4, 2, 2, 1};
  825. */
  826. #endif
  827. png_ptr->row_number++;
  828. if (png_ptr->row_number < png_ptr->num_rows)
  829. return;
  830. #ifdef PNG_READ_INTERLACING_SUPPORTED
  831. if (png_ptr->interlaced != 0)
  832. {
  833. png_ptr->row_number = 0;
  834. memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
  835. do
  836. {
  837. png_ptr->pass++;
  838. if ((png_ptr->pass == 1 && png_ptr->width < 5) ||
  839. (png_ptr->pass == 3 && png_ptr->width < 3) ||
  840. (png_ptr->pass == 5 && png_ptr->width < 2))
  841. png_ptr->pass++;
  842. if (png_ptr->pass > 7)
  843. png_ptr->pass--;
  844. if (png_ptr->pass >= 7)
  845. break;
  846. png_ptr->iwidth = (png_ptr->width +
  847. png_pass_inc[png_ptr->pass] - 1 -
  848. png_pass_start[png_ptr->pass]) /
  849. png_pass_inc[png_ptr->pass];
  850. if ((png_ptr->transformations & PNG_INTERLACE) != 0)
  851. break;
  852. png_ptr->num_rows = (png_ptr->height +
  853. png_pass_yinc[png_ptr->pass] - 1 -
  854. png_pass_ystart[png_ptr->pass]) /
  855. png_pass_yinc[png_ptr->pass];
  856. } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0);
  857. }
  858. #endif /* READ_INTERLACING */
  859. }
  860. void /* PRIVATE */
  861. png_push_have_info(png_structrp png_ptr, png_inforp info_ptr)
  862. {
  863. if (png_ptr->info_fn != NULL)
  864. (*(png_ptr->info_fn))(png_ptr, info_ptr);
  865. }
  866. void /* PRIVATE */
  867. png_push_have_end(png_structrp png_ptr, png_inforp info_ptr)
  868. {
  869. if (png_ptr->end_fn != NULL)
  870. (*(png_ptr->end_fn))(png_ptr, info_ptr);
  871. }
  872. void /* PRIVATE */
  873. png_push_have_row(png_structrp png_ptr, png_bytep row)
  874. {
  875. if (png_ptr->row_fn != NULL)
  876. (*(png_ptr->row_fn))(png_ptr, row, png_ptr->row_number,
  877. (int)png_ptr->pass);
  878. }
  879. #ifdef PNG_READ_INTERLACING_SUPPORTED
  880. void PNGAPI
  881. png_progressive_combine_row(png_const_structrp png_ptr, png_bytep old_row,
  882. png_const_bytep new_row)
  883. {
  884. if (png_ptr == NULL)
  885. return;
  886. /* new_row is a flag here - if it is NULL then the app callback was called
  887. * from an empty row (see the calls to png_struct::row_fn below), otherwise
  888. * it must be png_ptr->row_buf+1
  889. */
  890. if (new_row != NULL)
  891. png_combine_row(png_ptr, old_row, 1/*blocky display*/);
  892. }
  893. #endif /* READ_INTERLACING */
  894. void PNGAPI
  895. png_set_progressive_read_fn(png_structrp png_ptr, png_voidp progressive_ptr,
  896. png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn,
  897. png_progressive_end_ptr end_fn)
  898. {
  899. if (png_ptr == NULL)
  900. return;
  901. png_ptr->info_fn = info_fn;
  902. png_ptr->row_fn = row_fn;
  903. png_ptr->end_fn = end_fn;
  904. png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
  905. }
  906. png_voidp PNGAPI
  907. png_get_progressive_ptr(png_const_structrp png_ptr)
  908. {
  909. if (png_ptr == NULL)
  910. return (NULL);
  911. return png_ptr->io_ptr;
  912. }
  913. #endif /* PROGRESSIVE_READ */