1 

     2 /* pngrutil.c - utilities to read a PNG file

     3  *

     4  * Last changed in libpng 1.2.38 [July 16, 2009]

     5  * Copyright (c) 1998-2009 Glenn Randers-Pehrson

     6  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)

     7  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)

     8  *

     9  * This code is released under the libpng license.

    10  * For conditions of distribution and use, see the disclaimer

    11  * and license in png.h

    12  *

    13  * This file contains routines that are only called from within

    14  * libpng itself during the course of reading an image.

    15  */

    16 

    17 #define PNG_INTERNAL

    18 #include "png.h"

    19 #if defined(PNG_READ_SUPPORTED)

    20 

    21 #if defined(_WIN32_WCE) && (_WIN32_WCE<0x500)

    22 #  define WIN32_WCE_OLD

    23 #endif

    24 

    25 #ifdef PNG_FLOATING_POINT_SUPPORTED

    26 #  if defined(WIN32_WCE_OLD)

    27 /* The strtod() function is not supported on WindowsCE */

    28 __inline double png_strtod(png_structp png_ptr, PNG_CONST char *nptr, char **endptr)

    29 {

    30    double result = 0;

    31    int len;

    32    wchar_t *str, *end;

    33 

    34    len = MultiByteToWideChar(CP_ACP, 0, nptr, -1, NULL, 0);

    35    str = (wchar_t *)png_malloc(png_ptr, len * png_sizeof(wchar_t));

    36    if ( NULL != str )

    37    {

    38       MultiByteToWideChar(CP_ACP, 0, nptr, -1, str, len);

    39       result = wcstod(str, &end);

    40       len = WideCharToMultiByte(CP_ACP, 0, end, -1, NULL, 0, NULL, NULL);

    41       *endptr = (char *)nptr + (png_strlen(nptr) - len + 1);

    42       png_free(png_ptr, str);

    43    }

    44    return result;

    45 }

    46 #  else

    47 #    define png_strtod(p,a,b) strtod(a,b)

    48 #  endif

    49 #endif

    50 

    51 png_uint_32 PNGAPI

    52 png_get_uint_31(png_structp png_ptr, png_bytep buf)

    53 {

    54 #ifdef PNG_READ_BIG_ENDIAN_SUPPORTED

    55    png_uint_32 i = png_get_uint_32(buf);

    56 #else

    57    /* Avoid an extra function call by inlining the result. */

    58    png_uint_32 i = ((png_uint_32)(*buf) << 24) +

    59       ((png_uint_32)(*(buf + 1)) << 16) +

    60       ((png_uint_32)(*(buf + 2)) << 8) +

    61       (png_uint_32)(*(buf + 3));

    62 #endif

    63    if (i > PNG_UINT_31_MAX)

    64      png_error(png_ptr, "PNG unsigned integer out of range.");

    65    return (i);

    66 }

    67 #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED

    68 /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */

    69 png_uint_32 PNGAPI

    70 png_get_uint_32(png_bytep buf)

    71 {

    72    png_uint_32 i = ((png_uint_32)(*buf) << 24) +

    73       ((png_uint_32)(*(buf + 1)) << 16) +

    74       ((png_uint_32)(*(buf + 2)) << 8) +

    75       (png_uint_32)(*(buf + 3));

    76 

    77    return (i);

    78 }

    79 

    80 /* Grab a signed 32-bit integer from a buffer in big-endian format.  The

    81  * data is stored in the PNG file in two's complement format, and it is

    82  * assumed that the machine format for signed integers is the same.

    83  */

    84 png_int_32 PNGAPI

    85 png_get_int_32(png_bytep buf)

    86 {

    87    png_int_32 i = ((png_int_32)(*buf) << 24) +

    88       ((png_int_32)(*(buf + 1)) << 16) +

    89       ((png_int_32)(*(buf + 2)) << 8) +

    90       (png_int_32)(*(buf + 3));

    91 

    92    return (i);

    93 }

    94 

    95 /* Grab an unsigned 16-bit integer from a buffer in big-endian format. */

    96 png_uint_16 PNGAPI

    97 png_get_uint_16(png_bytep buf)

    98 {

    99    png_uint_16 i = (png_uint_16)(((png_uint_16)(*buf) << 8) +

   100       (png_uint_16)(*(buf + 1)));

   101 

   102    return (i);

   103 }

   104 #endif /* PNG_READ_BIG_ENDIAN_SUPPORTED */

   105 

   106 /* Read the chunk header (length + type name).

   107  * Put the type name into png_ptr->chunk_name, and return the length.

   108  */

   109 png_uint_32 /* PRIVATE */

   110 png_read_chunk_header(png_structp png_ptr)

   111 {

   112    png_byte buf[8];

   113    png_uint_32 length;

   114 

   115    /* Read the length and the chunk name */

   116    png_read_data(png_ptr, buf, 8);

   117    length = png_get_uint_31(png_ptr, buf);

   118 

   119    /* Put the chunk name into png_ptr->chunk_name */

   120    png_memcpy(png_ptr->chunk_name, buf + 4, 4);

   121 

   122    png_debug2(0, "Reading %s chunk, length = %lu",

   123       png_ptr->chunk_name, length);

   124 

   125    /* Reset the crc and run it over the chunk name */

   126    png_reset_crc(png_ptr);

   127    png_calculate_crc(png_ptr, png_ptr->chunk_name, 4);

   128 

   129    /* Check to see if chunk name is valid */

   130    png_check_chunk_name(png_ptr, png_ptr->chunk_name);

   131 

   132    return length;

   133 }

   134 

   135 /* Read data, and (optionally) run it through the CRC. */

   136 void /* PRIVATE */

   137 png_crc_read(png_structp png_ptr, png_bytep buf, png_size_t length)

   138 {

   139    if (png_ptr == NULL)

   140       return;

   141    png_read_data(png_ptr, buf, length);

   142    png_calculate_crc(png_ptr, buf, length);

   143 }

   144 

   145 /* Optionally skip data and then check the CRC.  Depending on whether we

   146  * are reading a ancillary or critical chunk, and how the program has set

   147  * things up, we may calculate the CRC on the data and print a message.

   148  * Returns '1' if there was a CRC error, '0' otherwise.

   149  */

   150 int /* PRIVATE */

   151 png_crc_finish(png_structp png_ptr, png_uint_32 skip)

   152 {

   153    png_size_t i;

   154    png_size_t istop = png_ptr->zbuf_size;

   155 

   156    for (i = (png_size_t)skip; i > istop; i -= istop)

   157    {

   158       png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size);

   159    }

   160    if (i)

   161    {

   162       png_crc_read(png_ptr, png_ptr->zbuf, i);

   163    }

   164 

   165    if (png_crc_error(png_ptr))

   166    {

   167       if (((png_ptr->chunk_name[0] & 0x20) &&                /* Ancillary */

   168           !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)) ||

   169           (!(png_ptr->chunk_name[0] & 0x20) &&             /* Critical  */

   170           (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE)))

   171       {

   172          png_chunk_warning(png_ptr, "CRC error");

   173       }

   174       else

   175       {

   176          png_chunk_error(png_ptr, "CRC error");

   177       }

   178       return (1);

   179    }

   180 

   181    return (0);

   182 }

   183 

   184 /* Compare the CRC stored in the PNG file with that calculated by libpng from

   185  * the data it has read thus far.

   186  */

   187 int /* PRIVATE */

   188 png_crc_error(png_structp png_ptr)

   189 {

   190    png_byte crc_bytes[4];

   191    png_uint_32 crc;

   192    int need_crc = 1;

   193 

   194    if (png_ptr->chunk_name[0] & 0x20)                     /* ancillary */

   195    {

   196       if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==

   197           (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))

   198          need_crc = 0;

   199    }

   200    else                                                    /* critical */

   201    {

   202       if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE)

   203          need_crc = 0;

   204    }

   205 

   206    png_read_data(png_ptr, crc_bytes, 4);

   207 

   208    if (need_crc)

   209    {

   210       crc = png_get_uint_32(crc_bytes);

   211       return ((int)(crc != png_ptr->crc));

   212    }

   213    else

   214       return (0);

   215 }

   216 

   217 #if defined(PNG_READ_zTXt_SUPPORTED) || defined(PNG_READ_iTXt_SUPPORTED) || \

   218     defined(PNG_READ_iCCP_SUPPORTED)

   219 /*

   220  * Decompress trailing data in a chunk.  The assumption is that chunkdata

   221  * points at an allocated area holding the contents of a chunk with a

   222  * trailing compressed part.  What we get back is an allocated area

   223  * holding the original prefix part and an uncompressed version of the

   224  * trailing part (the malloc area passed in is freed).

   225  */

   226 void /* PRIVATE */

   227 png_decompress_chunk(png_structp png_ptr, int comp_type,

   228                               png_size_t chunklength,

   229                               png_size_t prefix_size, png_size_t *newlength)

   230 {

   231    static PNG_CONST char msg[] = "Error decoding compressed text";

   232    png_charp text;

   233    png_size_t text_size;

   234 

   235    if (comp_type == PNG_COMPRESSION_TYPE_BASE)

   236    {

   237       int ret = Z_OK;

   238       png_ptr->zstream.next_in = (png_bytep)(png_ptr->chunkdata + prefix_size);

   239       png_ptr->zstream.avail_in = (uInt)(chunklength - prefix_size);

   240       png_ptr->zstream.next_out = png_ptr->zbuf;

   241       png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;

   242 

   243       text_size = 0;

   244       text = NULL;

   245 

   246       while (png_ptr->zstream.avail_in)

   247       {

   248          ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);

   249          if (ret != Z_OK && ret != Z_STREAM_END)

   250          {

   251             if (png_ptr->zstream.msg != NULL)

   252                png_warning(png_ptr, png_ptr->zstream.msg);

   253             else

   254                png_warning(png_ptr, msg);

   255             inflateReset(&png_ptr->zstream);

   256             png_ptr->zstream.avail_in = 0;

   257 

   258             if (text ==  NULL)

   259             {

   260                text_size = prefix_size + png_sizeof(msg) + 1;

   261                text = (png_charp)png_malloc_warn(png_ptr, text_size);

   262                if (text ==  NULL)

   263                  {

   264                     png_free(png_ptr, png_ptr->chunkdata);

   265                     png_ptr->chunkdata = NULL;

   266                     png_error(png_ptr, "Not enough memory to decompress chunk");

   267                  }

   268                png_memcpy(text, png_ptr->chunkdata, prefix_size);

   269             }

   270 

   271             text[text_size - 1] = 0x00;

   272 

   273             /* Copy what we can of the error message into the text chunk */

   274             text_size = (png_size_t)(chunklength -

   275               (text - png_ptr->chunkdata) - 1);

   276             if (text_size > png_sizeof(msg))

   277                text_size = png_sizeof(msg);

   278             png_memcpy(text + prefix_size, msg, text_size);

   279             break;

   280          }

   281          if (!png_ptr->zstream.avail_out || ret == Z_STREAM_END)

   282          {

   283             if (text == NULL)

   284             {

   285                text_size = prefix_size +

   286                    png_ptr->zbuf_size - png_ptr->zstream.avail_out;

   287                text = (png_charp)png_malloc_warn(png_ptr, text_size + 1);

   288                if (text ==  NULL)

   289                {

   290                   png_free(png_ptr, png_ptr->chunkdata);

   291                   png_ptr->chunkdata = NULL;

   292                   png_error(png_ptr,

   293                     "Not enough memory to decompress chunk.");

   294                }

   295                png_memcpy(text + prefix_size, png_ptr->zbuf,

   296                     text_size - prefix_size);

   297                png_memcpy(text, png_ptr->chunkdata, prefix_size);

   298                *(text + text_size) = 0x00;

   299             }

   300             else

   301             {

   302                png_charp tmp;

   303 

   304                tmp = text;

   305                text = (png_charp)png_malloc_warn(png_ptr,

   306                   (png_uint_32)(text_size +

   307                   png_ptr->zbuf_size - png_ptr->zstream.avail_out + 1));

   308                if (text == NULL)

   309                {

   310                   png_free(png_ptr, tmp);

   311                   png_free(png_ptr, png_ptr->chunkdata);

   312                   png_ptr->chunkdata = NULL;

   313                   png_error(png_ptr,

   314                     "Not enough memory to decompress chunk..");

   315                }

   316                png_memcpy(text, tmp, text_size);

   317                png_free(png_ptr, tmp);

   318                png_memcpy(text + text_size, png_ptr->zbuf,

   319                   (png_ptr->zbuf_size - png_ptr->zstream.avail_out));

   320                text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;

   321                *(text + text_size) = 0x00;

   322             }

   323             if (ret == Z_STREAM_END)

   324                break;

   325             else

   326             {

   327                png_ptr->zstream.next_out = png_ptr->zbuf;

   328                png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;

   329             }

   330          }

   331       }

   332       if (ret != Z_STREAM_END)

   333       {

   334 #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)

   335          char umsg[52];

   336 

   337          if (ret == Z_BUF_ERROR)

   338             png_snprintf(umsg, 52,

   339                 "Buffer error in compressed datastream in %s chunk",

   340                 png_ptr->chunk_name);

   341 

   342          else if (ret == Z_DATA_ERROR)

   343             png_snprintf(umsg, 52,

   344                 "Data error in compressed datastream in %s chunk",

   345                 png_ptr->chunk_name);

   346 

   347          else

   348             png_snprintf(umsg, 52,

   349                 "Incomplete compressed datastream in %s chunk",

   350                 png_ptr->chunk_name);

   351 

   352          png_warning(png_ptr, umsg);

   353 #else

   354          png_warning(png_ptr,

   355             "Incomplete compressed datastream in chunk other than IDAT");

   356 #endif

   357          text_size = prefix_size;

   358          if (text ==  NULL)

   359          {

   360             text = (png_charp)png_malloc_warn(png_ptr, text_size+1);

   361             if (text == NULL)

   362               {

   363                 png_free(png_ptr, png_ptr->chunkdata);

   364                 png_ptr->chunkdata = NULL;

   365                 png_error(png_ptr, "Not enough memory for text.");

   366               }

   367             png_memcpy(text, png_ptr->chunkdata, prefix_size);

   368          }

   369          *(text + text_size) = 0x00;

   370       }

   371 

   372       inflateReset(&png_ptr->zstream);

   373       png_ptr->zstream.avail_in = 0;

   374 

   375       png_free(png_ptr, png_ptr->chunkdata);

   376       png_ptr->chunkdata = text;

   377       *newlength=text_size;

   378    }

   379    else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */

   380    {

   381 #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)

   382       char umsg[50];

   383 

   384       png_snprintf(umsg, 50, "Unknown zTXt compression type %d", comp_type);

   385       png_warning(png_ptr, umsg);

   386 #else

   387       png_warning(png_ptr, "Unknown zTXt compression type");

   388 #endif

   389 

   390       *(png_ptr->chunkdata + prefix_size) = 0x00;

   391       *newlength = prefix_size;

   392    }

   393 }

   394 #endif

   395 

   396 /* Read and check the IDHR chunk */

   397 void /* PRIVATE */

   398 png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

   399 {

   400    png_byte buf[13];

   401    png_uint_32 width, height;

   402    int bit_depth, color_type, compression_type, filter_type;

   403    int interlace_type;

   404 

   405    png_debug(1, "in png_handle_IHDR");

   406 

   407    if (png_ptr->mode & PNG_HAVE_IHDR)

   408       png_error(png_ptr, "Out of place IHDR");

   409 

   410    /* Check the length */

   411    if (length != 13)

   412       png_error(png_ptr, "Invalid IHDR chunk");

   413 

   414    png_ptr->mode |= PNG_HAVE_IHDR;

   415 

   416    png_crc_read(png_ptr, buf, 13);

   417    png_crc_finish(png_ptr, 0);

   418 

   419    width = png_get_uint_31(png_ptr, buf);

   420    height = png_get_uint_31(png_ptr, buf + 4);

   421    bit_depth = buf[8];

   422    color_type = buf[9];

   423    compression_type = buf[10];

   424    filter_type = buf[11];

   425    interlace_type = buf[12];

   426 

   427    /* Set internal variables */

   428    png_ptr->width = width;

   429    png_ptr->height = height;

   430    png_ptr->bit_depth = (png_byte)bit_depth;

   431    png_ptr->interlaced = (png_byte)interlace_type;

   432    png_ptr->color_type = (png_byte)color_type;

   433 #if defined(PNG_MNG_FEATURES_SUPPORTED)

   434    png_ptr->filter_type = (png_byte)filter_type;

   435 #endif

   436    png_ptr->compression_type = (png_byte)compression_type;

   437 

   438    /* Find number of channels */

   439    switch (png_ptr->color_type)

   440    {

   441       case PNG_COLOR_TYPE_GRAY:

   442       case PNG_COLOR_TYPE_PALETTE:

   443          png_ptr->channels = 1;

   444          break;

   445 

   446       case PNG_COLOR_TYPE_RGB:

   447          png_ptr->channels = 3;

   448          break;

   449 

   450       case PNG_COLOR_TYPE_GRAY_ALPHA:

   451          png_ptr->channels = 2;

   452          break;

   453 

   454       case PNG_COLOR_TYPE_RGB_ALPHA:

   455          png_ptr->channels = 4;

   456          break;

   457    }

   458 

   459    /* Set up other useful info */

   460    png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *

   461    png_ptr->channels);

   462    png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);

   463    png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);

   464    png_debug1(3, "channels = %d", png_ptr->channels);

   465    png_debug1(3, "rowbytes = %lu", png_ptr->rowbytes);

   466    png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,

   467       color_type, interlace_type, compression_type, filter_type);

   468 }

   469 

   470 /* Read and check the palette */

   471 void /* PRIVATE */

   472 png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

   473 {

   474    png_color palette[PNG_MAX_PALETTE_LENGTH];

   475    int num, i;

   476 #ifndef PNG_NO_POINTER_INDEXING

   477    png_colorp pal_ptr;

   478 #endif

   479 

   480    png_debug(1, "in png_handle_PLTE");

   481 

   482    if (!(png_ptr->mode & PNG_HAVE_IHDR))

   483       png_error(png_ptr, "Missing IHDR before PLTE");

   484 

   485    else if (png_ptr->mode & PNG_HAVE_IDAT)

   486    {

   487       png_warning(png_ptr, "Invalid PLTE after IDAT");

   488       png_crc_finish(png_ptr, length);

   489       return;

   490    }

   491 

   492    else if (png_ptr->mode & PNG_HAVE_PLTE)

   493       png_error(png_ptr, "Duplicate PLTE chunk");

   494 

   495    png_ptr->mode |= PNG_HAVE_PLTE;

   496 

   497    if (!(png_ptr->color_type&PNG_COLOR_MASK_COLOR))

   498    {

   499       png_warning(png_ptr,

   500         "Ignoring PLTE chunk in grayscale PNG");

   501       png_crc_finish(png_ptr, length);

   502       return;

   503    }

   504 #if !defined(PNG_READ_OPT_PLTE_SUPPORTED)

   505    if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)

   506    {

   507       png_crc_finish(png_ptr, length);

   508       return;

   509    }

   510 #endif

   511 

   512    if (length > 3*PNG_MAX_PALETTE_LENGTH || length % 3)

   513    {

   514       if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)

   515       {

   516          png_warning(png_ptr, "Invalid palette chunk");

   517          png_crc_finish(png_ptr, length);

   518          return;

   519       }

   520 

   521       else

   522       {

   523          png_error(png_ptr, "Invalid palette chunk");

   524       }

   525    }

   526 

   527    num = (int)length / 3;

   528 

   529 #ifndef PNG_NO_POINTER_INDEXING

   530    for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)

   531    {

   532       png_byte buf[3];

   533 

   534       png_crc_read(png_ptr, buf, 3);

   535       pal_ptr->red = buf[0];

   536       pal_ptr->green = buf[1];

   537       pal_ptr->blue = buf[2];

   538    }

   539 #else

   540    for (i = 0; i < num; i++)

   541    {

   542       png_byte buf[3];

   543 

   544       png_crc_read(png_ptr, buf, 3);

   545       /* Don't depend upon png_color being any order */

   546       palette[i].red = buf[0];

   547       palette[i].green = buf[1];

   548       palette[i].blue = buf[2];

   549    }

   550 #endif

   551 

   552    /* If we actually NEED the PLTE chunk (ie for a paletted image), we do

   553     * whatever the normal CRC configuration tells us.  However, if we

   554     * have an RGB image, the PLTE can be considered ancillary, so

   555     * we will act as though it is.

   556     */

   557 #if !defined(PNG_READ_OPT_PLTE_SUPPORTED)

   558    if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

   559 #endif

   560    {

   561       png_crc_finish(png_ptr, 0);

   562    }

   563 #if !defined(PNG_READ_OPT_PLTE_SUPPORTED)

   564    else if (png_crc_error(png_ptr))  /* Only if we have a CRC error */

   565    {

   566       /* If we don't want to use the data from an ancillary chunk,

   567          we have two options: an error abort, or a warning and we

   568          ignore the data in this chunk (which should be OK, since

   569          it's considered ancillary for a RGB or RGBA image). */

   570       if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE))

   571       {

   572          if (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)

   573          {

   574             png_chunk_error(png_ptr, "CRC error");

   575          }

   576          else

   577          {

   578             png_chunk_warning(png_ptr, "CRC error");

   579             return;

   580          }

   581       }

   582       /* Otherwise, we (optionally) emit a warning and use the chunk. */

   583       else if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN))

   584       {

   585          png_chunk_warning(png_ptr, "CRC error");

   586       }

   587    }

   588 #endif

   589 

   590    png_set_PLTE(png_ptr, info_ptr, palette, num);

   591 

   592 #if defined(PNG_READ_tRNS_SUPPORTED)

   593    if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

   594    {

   595       if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))

   596       {

   597          if (png_ptr->num_trans > (png_uint_16)num)

   598          {

   599             png_warning(png_ptr, "Truncating incorrect tRNS chunk length");

   600             png_ptr->num_trans = (png_uint_16)num;

   601          }

   602          if (info_ptr->num_trans > (png_uint_16)num)

   603          {

   604             png_warning(png_ptr, "Truncating incorrect info tRNS chunk length");

   605             info_ptr->num_trans = (png_uint_16)num;

   606          }

   607       }

   608    }

   609 #endif

   610 

   611 }

   612 

   613 void /* PRIVATE */

   614 png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

   615 {

   616    png_debug(1, "in png_handle_IEND");

   617 

   618    if (!(png_ptr->mode & PNG_HAVE_IHDR) || !(png_ptr->mode & PNG_HAVE_IDAT))

   619    {

   620       png_error(png_ptr, "No image in file");

   621    }

   622 

   623    png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);

   624 

   625    if (length != 0)

   626    {

   627       png_warning(png_ptr, "Incorrect IEND chunk length");

   628    }

   629    png_crc_finish(png_ptr, length);

   630 

   631    info_ptr = info_ptr; /* Quiet compiler warnings about unused info_ptr */

   632 }

   633 

   634 #if defined(PNG_READ_gAMA_SUPPORTED)

   635 void /* PRIVATE */

   636 png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

   637 {

   638    png_fixed_point igamma;

   639 #ifdef PNG_FLOATING_POINT_SUPPORTED

   640    float file_gamma;

   641 #endif

   642    png_byte buf[4];

   643 

   644    png_debug(1, "in png_handle_gAMA");

   645 

   646    if (!(png_ptr->mode & PNG_HAVE_IHDR))

   647       png_error(png_ptr, "Missing IHDR before gAMA");

   648    else if (png_ptr->mode & PNG_HAVE_IDAT)

   649    {

   650       png_warning(png_ptr, "Invalid gAMA after IDAT");

   651       png_crc_finish(png_ptr, length);

   652       return;

   653    }

   654    else if (png_ptr->mode & PNG_HAVE_PLTE)

   655       /* Should be an error, but we can cope with it */

   656       png_warning(png_ptr, "Out of place gAMA chunk");

   657 

   658    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)

   659 #if defined(PNG_READ_sRGB_SUPPORTED)

   660       && !(info_ptr->valid & PNG_INFO_sRGB)

   661 #endif

   662       )

   663    {

   664       png_warning(png_ptr, "Duplicate gAMA chunk");

   665       png_crc_finish(png_ptr, length);

   666       return;

   667    }

   668 

   669    if (length != 4)

   670    {

   671       png_warning(png_ptr, "Incorrect gAMA chunk length");

   672       png_crc_finish(png_ptr, length);

   673       return;

   674    }

   675 

   676    png_crc_read(png_ptr, buf, 4);

   677    if (png_crc_finish(png_ptr, 0))

   678       return;

   679 

   680    igamma = (png_fixed_point)png_get_uint_32(buf);

   681    /* Check for zero gamma */

   682    if (igamma == 0)

   683       {

   684          png_warning(png_ptr,

   685            "Ignoring gAMA chunk with gamma=0");

   686          return;

   687       }

   688 

   689 #if defined(PNG_READ_sRGB_SUPPORTED)

   690    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))

   691       if (PNG_OUT_OF_RANGE(igamma, 45500L, 500))

   692       {

   693          png_warning(png_ptr,

   694            "Ignoring incorrect gAMA value when sRGB is also present");

   695 #ifndef PNG_NO_CONSOLE_IO

   696          fprintf(stderr, "gamma = (%d/100000)", (int)igamma);

   697 #endif

   698          return;

   699       }

   700 #endif /* PNG_READ_sRGB_SUPPORTED */

   701 

   702 #ifdef PNG_FLOATING_POINT_SUPPORTED

   703    file_gamma = (float)igamma / (float)100000.0;

   704 #  ifdef PNG_READ_GAMMA_SUPPORTED

   705      png_ptr->gamma = file_gamma;

   706 #  endif

   707      png_set_gAMA(png_ptr, info_ptr, file_gamma);

   708 #endif

   709 #ifdef PNG_FIXED_POINT_SUPPORTED

   710    png_set_gAMA_fixed(png_ptr, info_ptr, igamma);

   711 #endif

   712 }

   713 #endif

   714 

   715 #if defined(PNG_READ_sBIT_SUPPORTED)

   716 void /* PRIVATE */

   717 png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

   718 {

   719    png_size_t truelen;

   720    png_byte buf[4];

   721 

   722    png_debug(1, "in png_handle_sBIT");

   723 

   724    buf[0] = buf[1] = buf[2] = buf[3] = 0;

   725 

   726    if (!(png_ptr->mode & PNG_HAVE_IHDR))

   727       png_error(png_ptr, "Missing IHDR before sBIT");

   728    else if (png_ptr->mode & PNG_HAVE_IDAT)

   729    {

   730       png_warning(png_ptr, "Invalid sBIT after IDAT");

   731       png_crc_finish(png_ptr, length);

   732       return;

   733    }

   734    else if (png_ptr->mode & PNG_HAVE_PLTE)

   735    {

   736       /* Should be an error, but we can cope with it */

   737       png_warning(png_ptr, "Out of place sBIT chunk");

   738    }

   739    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT))

   740    {

   741       png_warning(png_ptr, "Duplicate sBIT chunk");

   742       png_crc_finish(png_ptr, length);

   743       return;

   744    }

   745 

   746    if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

   747       truelen = 3;

   748    else

   749       truelen = (png_size_t)png_ptr->channels;

   750 

   751    if (length != truelen || length > 4)

   752    {

   753       png_warning(png_ptr, "Incorrect sBIT chunk length");

   754       png_crc_finish(png_ptr, length);

   755       return;

   756    }

   757 

   758    png_crc_read(png_ptr, buf, truelen);

   759    if (png_crc_finish(png_ptr, 0))

   760       return;

   761 

   762    if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)

   763    {

   764       png_ptr->sig_bit.red = buf[0];

   765       png_ptr->sig_bit.green = buf[1];

   766       png_ptr->sig_bit.blue = buf[2];

   767       png_ptr->sig_bit.alpha = buf[3];

   768    }

   769    else

   770    {

   771       png_ptr->sig_bit.gray = buf[0];

   772       png_ptr->sig_bit.red = buf[0];

   773       png_ptr->sig_bit.green = buf[0];

   774       png_ptr->sig_bit.blue = buf[0];

   775       png_ptr->sig_bit.alpha = buf[1];

   776    }

   777    png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));

   778 }

   779 #endif

   780 

   781 #if defined(PNG_READ_cHRM_SUPPORTED)

   782 void /* PRIVATE */

   783 png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

   784 {

   785    png_byte buf[32];

   786 #ifdef PNG_FLOATING_POINT_SUPPORTED

   787    float white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y;

   788 #endif

   789    png_fixed_point int_x_white, int_y_white, int_x_red, int_y_red, int_x_green,

   790       int_y_green, int_x_blue, int_y_blue;

   791 

   792    png_uint_32 uint_x, uint_y;

   793 

   794    png_debug(1, "in png_handle_cHRM");

   795 

   796    if (!(png_ptr->mode & PNG_HAVE_IHDR))

   797       png_error(png_ptr, "Missing IHDR before cHRM");

   798    else if (png_ptr->mode & PNG_HAVE_IDAT)

   799    {

   800       png_warning(png_ptr, "Invalid cHRM after IDAT");

   801       png_crc_finish(png_ptr, length);

   802       return;

   803    }

   804    else if (png_ptr->mode & PNG_HAVE_PLTE)

   805       /* Should be an error, but we can cope with it */

   806       png_warning(png_ptr, "Missing PLTE before cHRM");

   807 

   808    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM)

   809 #if defined(PNG_READ_sRGB_SUPPORTED)

   810       && !(info_ptr->valid & PNG_INFO_sRGB)

   811 #endif

   812       )

   813    {

   814       png_warning(png_ptr, "Duplicate cHRM chunk");

   815       png_crc_finish(png_ptr, length);

   816       return;

   817    }

   818 

   819    if (length != 32)

   820    {

   821       png_warning(png_ptr, "Incorrect cHRM chunk length");

   822       png_crc_finish(png_ptr, length);

   823       return;

   824    }

   825 

   826    png_crc_read(png_ptr, buf, 32);

   827    if (png_crc_finish(png_ptr, 0))

   828       return;

   829 

   830    uint_x = png_get_uint_32(buf);

   831    uint_y = png_get_uint_32(buf + 4);

   832    int_x_white = (png_fixed_point)uint_x;

   833    int_y_white = (png_fixed_point)uint_y;

   834 

   835    uint_x = png_get_uint_32(buf + 8);

   836    uint_y = png_get_uint_32(buf + 12);

   837    int_x_red = (png_fixed_point)uint_x;

   838    int_y_red = (png_fixed_point)uint_y;

   839 

   840    uint_x = png_get_uint_32(buf + 16);

   841    uint_y = png_get_uint_32(buf + 20);

   842    int_x_green = (png_fixed_point)uint_x;

   843    int_y_green = (png_fixed_point)uint_y;

   844 

   845    uint_x = png_get_uint_32(buf + 24);

   846    uint_y = png_get_uint_32(buf + 28);

   847    int_x_blue = (png_fixed_point)uint_x;

   848    int_y_blue = (png_fixed_point)uint_y;

   849 

   850 #ifdef PNG_FLOATING_POINT_SUPPORTED

   851    white_x = (float)int_x_white / (float)100000.0;

   852    white_y = (float)int_y_white / (float)100000.0;

   853    red_x   = (float)int_x_red   / (float)100000.0;

   854    red_y   = (float)int_y_red   / (float)100000.0;

   855    green_x = (float)int_x_green / (float)100000.0;

   856    green_y = (float)int_y_green / (float)100000.0;

   857    blue_x  = (float)int_x_blue  / (float)100000.0;

   858    blue_y  = (float)int_y_blue  / (float)100000.0;

   859 #endif

   860 

   861 #if defined(PNG_READ_sRGB_SUPPORTED)

   862    if ((info_ptr != NULL) && (info_ptr->valid & PNG_INFO_sRGB))

   863       {

   864       if (PNG_OUT_OF_RANGE(int_x_white, 31270,  1000) ||

   865           PNG_OUT_OF_RANGE(int_y_white, 32900,  1000) ||

   866           PNG_OUT_OF_RANGE(int_x_red,   64000L, 1000) ||

   867           PNG_OUT_OF_RANGE(int_y_red,   33000,  1000) ||

   868           PNG_OUT_OF_RANGE(int_x_green, 30000,  1000) ||

   869           PNG_OUT_OF_RANGE(int_y_green, 60000L, 1000) ||

   870           PNG_OUT_OF_RANGE(int_x_blue,  15000,  1000) ||

   871           PNG_OUT_OF_RANGE(int_y_blue,   6000,  1000))

   872          {

   873             png_warning(png_ptr,

   874               "Ignoring incorrect cHRM value when sRGB is also present");

   875 #ifndef PNG_NO_CONSOLE_IO

   876 #ifdef PNG_FLOATING_POINT_SUPPORTED

   877             fprintf(stderr, "wx=%f, wy=%f, rx=%f, ry=%f\n",

   878                white_x, white_y, red_x, red_y);

   879             fprintf(stderr, "gx=%f, gy=%f, bx=%f, by=%f\n",

   880                green_x, green_y, blue_x, blue_y);

   881 #else

   882             fprintf(stderr, "wx=%ld, wy=%ld, rx=%ld, ry=%ld\n",

   883                int_x_white, int_y_white, int_x_red, int_y_red);

   884             fprintf(stderr, "gx=%ld, gy=%ld, bx=%ld, by=%ld\n",

   885                int_x_green, int_y_green, int_x_blue, int_y_blue);

   886 #endif

   887 #endif /* PNG_NO_CONSOLE_IO */

   888          }

   889          return;

   890       }

   891 #endif /* PNG_READ_sRGB_SUPPORTED */

   892 

   893 #ifdef PNG_FLOATING_POINT_SUPPORTED

   894    png_set_cHRM(png_ptr, info_ptr,

   895       white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y);

   896 #endif

   897 #ifdef PNG_FIXED_POINT_SUPPORTED

   898    png_set_cHRM_fixed(png_ptr, info_ptr,

   899       int_x_white, int_y_white, int_x_red, int_y_red, int_x_green,

   900       int_y_green, int_x_blue, int_y_blue);

   901 #endif

   902 }

   903 #endif

   904 

   905 #if defined(PNG_READ_sRGB_SUPPORTED)

   906 void /* PRIVATE */

   907 png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

   908 {

   909    int intent;

   910    png_byte buf[1];

   911 

   912    png_debug(1, "in png_handle_sRGB");

   913 

   914    if (!(png_ptr->mode & PNG_HAVE_IHDR))

   915       png_error(png_ptr, "Missing IHDR before sRGB");

   916    else if (png_ptr->mode & PNG_HAVE_IDAT)

   917    {

   918       png_warning(png_ptr, "Invalid sRGB after IDAT");

   919       png_crc_finish(png_ptr, length);

   920       return;

   921    }

   922    else if (png_ptr->mode & PNG_HAVE_PLTE)

   923       /* Should be an error, but we can cope with it */

   924       png_warning(png_ptr, "Out of place sRGB chunk");

   925 

   926    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))

   927    {

   928       png_warning(png_ptr, "Duplicate sRGB chunk");

   929       png_crc_finish(png_ptr, length);

   930       return;

   931    }

   932 

   933    if (length != 1)

   934    {

   935       png_warning(png_ptr, "Incorrect sRGB chunk length");

   936       png_crc_finish(png_ptr, length);

   937       return;

   938    }

   939 

   940    png_crc_read(png_ptr, buf, 1);

   941    if (png_crc_finish(png_ptr, 0))

   942       return;

   943 

   944    intent = buf[0];

   945    /* Check for bad intent */

   946    if (intent >= PNG_sRGB_INTENT_LAST)

   947    {

   948       png_warning(png_ptr, "Unknown sRGB intent");

   949       return;

   950    }

   951 

   952 #if defined(PNG_READ_gAMA_SUPPORTED) && defined(PNG_READ_GAMMA_SUPPORTED)

   953    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA))

   954    {

   955    png_fixed_point igamma;

   956 #ifdef PNG_FIXED_POINT_SUPPORTED

   957       igamma=info_ptr->int_gamma;

   958 #else

   959 #  ifdef PNG_FLOATING_POINT_SUPPORTED

   960       igamma=(png_fixed_point)(info_ptr->gamma * 100000.);

   961 #  endif

   962 #endif

   963       if (PNG_OUT_OF_RANGE(igamma, 45500L, 500))

   964       {

   965          png_warning(png_ptr,

   966            "Ignoring incorrect gAMA value when sRGB is also present");

   967 #ifndef PNG_NO_CONSOLE_IO

   968 #  ifdef PNG_FIXED_POINT_SUPPORTED

   969          fprintf(stderr, "incorrect gamma=(%d/100000)\n",

   970             (int)png_ptr->int_gamma);

   971 #  else

   972 #    ifdef PNG_FLOATING_POINT_SUPPORTED

   973          fprintf(stderr, "incorrect gamma=%f\n", png_ptr->gamma);

   974 #    endif

   975 #  endif

   976 #endif

   977       }

   978    }

   979 #endif /* PNG_READ_gAMA_SUPPORTED */

   980 

   981 #ifdef PNG_READ_cHRM_SUPPORTED

   982 #ifdef PNG_FIXED_POINT_SUPPORTED

   983    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM))

   984       if (PNG_OUT_OF_RANGE(info_ptr->int_x_white, 31270,  1000) ||

   985           PNG_OUT_OF_RANGE(info_ptr->int_y_white, 32900,  1000) ||

   986           PNG_OUT_OF_RANGE(info_ptr->int_x_red,   64000L, 1000) ||

   987           PNG_OUT_OF_RANGE(info_ptr->int_y_red,   33000,  1000) ||

   988           PNG_OUT_OF_RANGE(info_ptr->int_x_green, 30000,  1000) ||

   989           PNG_OUT_OF_RANGE(info_ptr->int_y_green, 60000L, 1000) ||

   990           PNG_OUT_OF_RANGE(info_ptr->int_x_blue,  15000,  1000) ||

   991           PNG_OUT_OF_RANGE(info_ptr->int_y_blue,   6000,  1000))

   992          {

   993             png_warning(png_ptr,

   994               "Ignoring incorrect cHRM value when sRGB is also present");

   995          }

   996 #endif /* PNG_FIXED_POINT_SUPPORTED */

   997 #endif /* PNG_READ_cHRM_SUPPORTED */

   998 

   999    png_set_sRGB_gAMA_and_cHRM(png_ptr, info_ptr, intent);

  1000 }

  1001 #endif /* PNG_READ_sRGB_SUPPORTED */

  1002 

  1003 #if defined(PNG_READ_iCCP_SUPPORTED)

  1004 void /* PRIVATE */

  1005 png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

  1006 /* Note: this does not properly handle chunks that are > 64K under DOS */

  1007 {

  1008    png_byte compression_type;

  1009    png_bytep pC;

  1010    png_charp profile;

  1011    png_uint_32 skip = 0;

  1012    png_uint_32 profile_size, profile_length;

  1013    png_size_t slength, prefix_length, data_length;

  1014 

  1015    png_debug(1, "in png_handle_iCCP");

  1016 

  1017    if (!(png_ptr->mode & PNG_HAVE_IHDR))

  1018       png_error(png_ptr, "Missing IHDR before iCCP");

  1019    else if (png_ptr->mode & PNG_HAVE_IDAT)

  1020    {

  1021       png_warning(png_ptr, "Invalid iCCP after IDAT");

  1022       png_crc_finish(png_ptr, length);

  1023       return;

  1024    }

  1025    else if (png_ptr->mode & PNG_HAVE_PLTE)

  1026       /* Should be an error, but we can cope with it */

  1027       png_warning(png_ptr, "Out of place iCCP chunk");

  1028 

  1029    if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP))

  1030    {

  1031       png_warning(png_ptr, "Duplicate iCCP chunk");

  1032       png_crc_finish(png_ptr, length);

  1033       return;

  1034    }

  1035 

  1036 #ifdef PNG_MAX_MALLOC_64K

  1037    if (length > (png_uint_32)65535L)

  1038    {

  1039       png_warning(png_ptr, "iCCP chunk too large to fit in memory");

  1040       skip = length - (png_uint_32)65535L;

  1041       length = (png_uint_32)65535L;

  1042    }

  1043 #endif

  1044 

  1045    png_free(png_ptr, png_ptr->chunkdata);

  1046    png_ptr->chunkdata = (png_charp)png_malloc(png_ptr, length + 1);

  1047    slength = (png_size_t)length;

  1048    png_crc_read(png_ptr, (png_bytep)png_ptr->chunkdata, slength);

  1049 

  1050    if (png_crc_finish(png_ptr, skip))

  1051    {

  1052       png_free(png_ptr, png_ptr->chunkdata);

  1053       png_ptr->chunkdata = NULL;

  1054       return;

  1055    }

  1056 

  1057    png_ptr->chunkdata[slength] = 0x00;

  1058 

  1059    for (profile = png_ptr->chunkdata; *profile; profile++)

  1060       /* Empty loop to find end of name */ ;

  1061 

  1062    ++profile;

  1063 

  1064    /* There should be at least one zero (the compression type byte)

  1065     * following the separator, and we should be on it

  1066     */

  1067    if ( profile >= png_ptr->chunkdata + slength - 1)

  1068    {

  1069       png_free(png_ptr, png_ptr->chunkdata);

  1070       png_ptr->chunkdata = NULL;

  1071       png_warning(png_ptr, "Malformed iCCP chunk");

  1072       return;

  1073    }

  1074 

  1075    /* Compression_type should always be zero */

  1076    compression_type = *profile++;

  1077    if (compression_type)

  1078    {

  1079       png_warning(png_ptr, "Ignoring nonzero compression type in iCCP chunk");

  1080       compression_type = 0x00;  /* Reset it to zero (libpng-1.0.6 through 1.0.8

  1081                                  wrote nonzero) */

  1082    }

  1083 

  1084    prefix_length = profile - png_ptr->chunkdata;

  1085    png_decompress_chunk(png_ptr, compression_type,

  1086      slength, prefix_length, &data_length);

  1087 

  1088    profile_length = data_length - prefix_length;

  1089 

  1090    if ( prefix_length > data_length || profile_length < 4)

  1091    {

  1092       png_free(png_ptr, png_ptr->chunkdata);

  1093       png_ptr->chunkdata = NULL;

  1094       png_warning(png_ptr, "Profile size field missing from iCCP chunk");

  1095       return;

  1096    }

  1097 

  1098    /* Check the profile_size recorded in the first 32 bits of the ICC profile */

  1099    pC = (png_bytep)(png_ptr->chunkdata + prefix_length);

  1100    profile_size = ((*(pC    ))<<24) |

  1101                   ((*(pC + 1))<<16) |

  1102                   ((*(pC + 2))<< 8) |

  1103                   ((*(pC + 3))    );

  1104 

  1105    if (profile_size < profile_length)

  1106       profile_length = profile_size;

  1107 

  1108    if (profile_size > profile_length)

  1109    {

  1110       png_free(png_ptr, png_ptr->chunkdata);

  1111       png_ptr->chunkdata = NULL;

  1112       png_warning(png_ptr, "Ignoring truncated iCCP profile.");

  1113       return;

  1114    }

  1115 

  1116    png_set_iCCP(png_ptr, info_ptr, png_ptr->chunkdata,

  1117      compression_type, png_ptr->chunkdata + prefix_length, profile_length);

  1118    png_free(png_ptr, png_ptr->chunkdata);

  1119    png_ptr->chunkdata = NULL;

  1120 }

  1121 #endif /* PNG_READ_iCCP_SUPPORTED */

  1122 

  1123 #if defined(PNG_READ_sPLT_SUPPORTED)

  1124 void /* PRIVATE */

  1125 png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

  1126 /* Note: this does not properly handle chunks that are > 64K under DOS */

  1127 {

  1128    png_bytep entry_start;

  1129    png_sPLT_t new_palette;

  1130 #ifdef PNG_NO_POINTER_INDEXING

  1131    png_sPLT_entryp pp;

  1132 #endif

  1133    int data_length, entry_size, i;

  1134    png_uint_32 skip = 0;

  1135    png_size_t slength;