diff --git a/src/libs/png/LICENSE b/src/libs/png/LICENSE
index 28b3b6620d..fe3ac4b96f 100644
--- a/src/libs/png/LICENSE
+++ b/src/libs/png/LICENSE
@@ -8,9 +8,16 @@ COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
If you modify libpng you may insert additional notices immediately following
this sentence.
-libpng versions 1.0.7, July 1, 2000, through 1.2.5, October 3, 2002, are
-Copyright (c) 2000-2002 Glenn Randers-Pehrson
-and are distributed according to the same disclaimer and license as libpng-1.0.6
+libpng version 1.2.6, December 3, 2004, is
+Copyright (c) 2004 Glenn Randers-Pehrson, and is
+distributed according to the same disclaimer and license as libpng-1.2.5
+with the following individual added to the list of Contributing Authors
+
+ Cosmin Truta
+
+libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are
+Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are
+distributed according to the same disclaimer and license as libpng-1.0.6
with the following individuals added to the list of Contributing Authors
Simon-Pierre Cadieux
@@ -98,5 +105,5 @@ Libpng is OSI Certified Open Source Software. OSI Certified Open Source is a
certification mark of the Open Source Initiative.
Glenn Randers-Pehrson
-randeg@alum.rpi.edu
-October 3, 2002
+glennrp at users.sourceforge.net
+December 3, 2004
diff --git a/src/libs/png/png.c b/src/libs/png/png.c
index 2a55ccb798..608ea2ce7c 100644
--- a/src/libs/png/png.c
+++ b/src/libs/png/png.c
@@ -1,11 +1,11 @@
/* png.c - location for general purpose libpng functions
*
- * libpng version 1.2.5 - October 3, 2002
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * libpng version 1.2.8 - December 3, 2004
+ * For conditions of distribution and use, see copyright notice in png.h
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
- *
*/
#define PNG_INTERNAL
@@ -13,14 +13,14 @@
#include "png.h"
/* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_2_5 Your_png_h_is_not_version_1_2_5;
+typedef version_1_2_8 Your_png_h_is_not_version_1_2_8;
/* Version information for C files. This had better match the version
* string defined in png.h. */
#ifdef PNG_USE_GLOBAL_ARRAYS
/* png_libpng_ver was changed to a function in version 1.0.5c */
-const char png_libpng_ver[18] = "1.2.5";
+const char png_libpng_ver[18] = PNG_LIBPNG_VER_STRING;
/* png_sig was changed to a function in version 1.0.5c */
/* Place to hold the signature string for a PNG file. */
@@ -80,7 +80,7 @@ const int FARDATA png_pass_mask[] = {0x80, 0x08, 0x88, 0x22, 0xaa, 0x55, 0xff};
const int FARDATA png_pass_dsp_mask[]
= {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff};
-#endif
+#endif /* PNG_USE_GLOBAL_ARRAYS */
/* Tells libpng that we have already handled the first "num_bytes" bytes
* of the PNG file signature. If the PNG data is embedded into another
@@ -142,16 +142,23 @@ voidpf /* private */
#endif
png_zalloc(voidpf png_ptr, uInt items, uInt size)
{
- png_uint_32 num_bytes = (png_uint_32)items * size;
png_voidp ptr;
png_structp p=png_ptr;
png_uint_32 save_flags=p->flags;
+ png_uint_32 num_bytes;
+
+ if (items > PNG_UINT_32_MAX/size)
+ {
+ png_warning (png_ptr, "Potential overflow in png_zalloc()");
+ return (NULL);
+ }
+ num_bytes = (png_uint_32)items * size;
p->flags|=PNG_FLAG_MALLOC_NULL_MEM_OK;
ptr = (png_voidp)png_malloc((png_structp)png_ptr, num_bytes);
p->flags=save_flags;
-#ifndef PNG_NO_ZALLOC_ZERO
+#if defined(PNG_1_0_X) && !defined(PNG_NO_ZALLOC_ZERO)
if (ptr == NULL)
return ((voidpf)ptr);
@@ -217,7 +224,7 @@ png_calculate_crc(png_structp png_ptr, png_bytep ptr, png_size_t length)
/* Allocate the memory for an info_struct for the application. We don't
* really need the png_ptr, but it could potentially be useful in the
- * future. This should be used in favour of malloc(sizeof(png_info))
+ * future. This should be used in favour of malloc(png_sizeof(png_info))
* and png_info_init() so that applications that want to use a shared
* libpng don't have to be recompiled if png_info changes size.
*/
@@ -235,7 +242,7 @@ png_create_info_struct(png_structp png_ptr)
info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO);
#endif
if (info_ptr != NULL)
- png_info_init_3(&info_ptr, sizeof(png_info));
+ png_info_init_3(&info_ptr, png_sizeof(png_info));
return (info_ptr);
}
@@ -272,6 +279,7 @@ png_destroy_info_struct(png_structp png_ptr, png_infopp info_ptr_ptr)
* and applications using it are urged to use png_create_info_struct()
* instead.
*/
+#if defined(PNG_1_0_X) || defined (PNG_1_2_X)
#undef png_info_init
void PNGAPI
png_info_init(png_infop info_ptr)
@@ -279,6 +287,7 @@ png_info_init(png_infop info_ptr)
/* We only come here via pre-1.0.12-compiled applications */
png_info_init_3(&info_ptr, 0);
}
+#endif
void PNGAPI
png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size)
@@ -287,7 +296,7 @@ png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size)
png_debug(1, "in png_info_init_3\n");
- if(sizeof(png_info) > png_info_struct_size)
+ if(png_sizeof(png_info) > png_info_struct_size)
{
png_destroy_struct(info_ptr);
info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO);
@@ -295,7 +304,7 @@ png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size)
}
/* set everything to 0 */
- png_memset(info_ptr, 0, sizeof (png_info));
+ png_memset(info_ptr, 0, png_sizeof (png_info));
}
#ifdef PNG_FREE_ME_SUPPORTED
@@ -581,7 +590,7 @@ png_info_destroy(png_structp png_ptr, png_infop info_ptr)
}
#endif
- png_info_init_3(&info_ptr, sizeof(png_info));
+ png_info_init_3(&info_ptr, png_sizeof(png_info));
}
/* This function returns a pointer to the io_ptr associated with the user
@@ -623,7 +632,7 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime)
if (png_ptr->time_buffer == NULL)
{
png_ptr->time_buffer = (png_charp)png_malloc(png_ptr, (png_uint_32)(29*
- sizeof(char)));
+ png_sizeof(char)));
}
#if defined(_WIN32_WCE)
@@ -645,7 +654,7 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime)
ptime->year, ptime->hour % 24, ptime->minute % 60,
ptime->second % 61);
png_memcpy(png_ptr->time_buffer, near_time_buf,
- 29*sizeof(char));
+ 29*png_sizeof(char));
}
#else
sprintf(png_ptr->time_buffer, "%d %s %d %02d:%02d:%02d +0000",
@@ -670,45 +679,47 @@ png_sig_bytes(void)
png_charp PNGAPI
png_get_copyright(png_structp png_ptr)
{
- if (png_ptr != NULL || png_ptr == NULL) /* silence compiler warning */
- return ((png_charp) "\n libpng version 1.2.5 - October 3, 2002\n\
- Copyright (c) 1998-2002 Glenn Randers-Pehrson\n\
+ if (&png_ptr != NULL) /* silence compiler warning about unused png_ptr */
+ return ((png_charp) "\n libpng version 1.2.8 - December 3, 2004\n\
+ Copyright (c) 1998-2004 Glenn Randers-Pehrson\n\
Copyright (c) 1996-1997 Andreas Dilger\n\
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\n");
return ((png_charp) "");
}
/* The following return the library version as a short string in the
- * format 1.0.0 through 99.99.99zz. To get the version of *.h files used
- * with your application, print out PNG_LIBPNG_VER_STRING, which is defined
- * in png.h.
+ * format 1.0.0 through 99.99.99zz. To get the version of *.h files
+ * used with your application, print out PNG_LIBPNG_VER_STRING, which
+ * is defined in png.h.
+ * Note: now there is no difference between png_get_libpng_ver() and
+ * png_get_header_ver(). Due to the version_nn_nn_nn typedef guard,
+ * it is guaranteed that png.c uses the correct version of png.h.
*/
-
png_charp PNGAPI
png_get_libpng_ver(png_structp png_ptr)
{
/* Version of *.c files used when building libpng */
- if(png_ptr != NULL) /* silence compiler warning about unused png_ptr */
- return((png_charp) "1.2.5");
- return((png_charp) "1.2.5");
+ if (&png_ptr != NULL) /* silence compiler warning about unused png_ptr */
+ return ((png_charp) PNG_LIBPNG_VER_STRING);
+ return ((png_charp) "");
}
png_charp PNGAPI
png_get_header_ver(png_structp png_ptr)
{
/* Version of *.h files used when building libpng */
- if(png_ptr != NULL) /* silence compiler warning about unused png_ptr */
- return((png_charp) PNG_LIBPNG_VER_STRING);
- return((png_charp) PNG_LIBPNG_VER_STRING);
+ if (&png_ptr != NULL) /* silence compiler warning about unused png_ptr */
+ return ((png_charp) PNG_LIBPNG_VER_STRING);
+ return ((png_charp) "");
}
png_charp PNGAPI
png_get_header_version(png_structp png_ptr)
{
/* Returns longer string containing both version and date */
- if(png_ptr != NULL) /* silence compiler warning about unused png_ptr */
- return((png_charp) PNG_HEADER_VERSION_STRING);
- return((png_charp) PNG_HEADER_VERSION_STRING);
+ if (&png_ptr != NULL) /* silence compiler warning about unused png_ptr */
+ return ((png_charp) PNG_HEADER_VERSION_STRING);
+ return ((png_charp) "");
}
#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
@@ -740,7 +751,7 @@ png_uint_32 PNGAPI
png_access_version_number(void)
{
/* Version of *.c files used when building libpng */
- return((png_uint_32) 10205L);
+ return((png_uint_32) PNG_LIBPNG_VER);
}
@@ -803,3 +814,15 @@ png_mmx_support(void)
}
#endif
#endif /* PNG_1_0_X */
+
+#ifdef PNG_SIZE_T
+/* Added at libpng version 1.2.6 */
+ PNG_EXTERN png_size_t PNGAPI png_convert_size PNGARG((size_t size));
+png_size_t PNGAPI
+png_convert_size(size_t size)
+{
+ if (size > (png_size_t)-1)
+ PNG_ABORT(); /* We haven't got access to png_ptr, so no png_error() */
+ return ((png_size_t)size);
+}
+#endif /* PNG_SIZE_T */
diff --git a/src/libs/png/png.h b/src/libs/png/png.h
index f059910e62..e87a3011cd 100644
--- a/src/libs/png/png.h
+++ b/src/libs/png/png.h
@@ -1,14 +1,14 @@
/* png.h - header file for PNG reference library
*
- * libpng version 1.2.5 - October 3, 2002
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * libpng version 1.2.8 - December 3, 2004
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
* Authors and maintainers:
* libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
* libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- * libpng versions 0.97, January 1998, through 1.2.5 - October 3, 2002: Glenn
+ * libpng versions 0.97, January 1998, through 1.2.8 - December 3, 2004: Glenn
* See also "Contributing Authors", below.
*
* Note about libpng version numbers:
@@ -98,6 +98,19 @@
* 1.2.5rc1-3 13 10205 12.so.0.1.2.5rc1-3
* 1.0.15 10 10015 10.so.0.1.0.15
* 1.2.5 13 10205 12.so.0.1.2.5
+ * 1.2.6beta1-4 13 10206 12.so.0.1.2.6beta1-4
+ * 1.0.16 10 10016 10.so.0.1.0.16
+ * 1.2.6 13 10206 12.so.0.1.2.6
+ * 1.2.7beta1-2 13 10207 12.so.0.1.2.7beta1-2
+ * 1.0.17rc1 10 10017 12.so.0.1.0.17rc1
+ * 1.2.7rc1 13 10207 12.so.0.1.2.7rc1
+ * 1.0.17 10 10017 12.so.0.1.0.17
+ * 1.2.7 13 10207 12.so.0.1.2.7
+ * 1.2.8beta1-5 13 10208 12.so.0.1.2.8beta1-5
+ * 1.0.18rc1-5 10 10018 12.so.0.1.0.18rc1-5
+ * 1.2.8rc1-5 13 10208 12.so.0.1.2.8rc1-5
+ * 1.0.18 10 10018 12.so.0.1.0.18
+ * 1.2.8 13 10208 12.so.0.1.2.8
*
* Henceforth the source version will match the shared-library major
* and minor numbers; the shared-library major version number will be
@@ -117,8 +130,8 @@
* in binary compatibility (e.g., when a new feature is added).
*
* See libpng.txt or libpng.3 for more information. The PNG specification
- * is available as RFC 2083
- * and as a W3C Recommendation
+ * is available as a W3C Recommendation and as an ISO Specification,
+ * = 8 ? \
+ ((width) * (((png_uint_32)(pixel_bits)) >> 3)) : \
+ (( ((width) * ((png_uint_32)(pixel_bits))) + 7) >> 3) )
+
+/* PNG_OUT_OF_RANGE returns true if value is outside the range
+ ideal-delta..ideal+delta. Each argument is evaluated twice.
+ "ideal" and "delta" should be constants, normally simple
+ integers, "value" a variable. Added to libpng-1.2.6 JB */
+#define PNG_OUT_OF_RANGE(value, ideal, delta) \
+ ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) )
+
/* variables declared in png.c - only it needs to define PNG_NO_EXTERN */
#if !defined(PNG_NO_EXTERN) || defined(PNG_ALWAYS_EXTERN)
/* place to hold the signature string for a PNG file. */
@@ -2655,6 +2784,8 @@ PNG_EXTERN png_int_32 png_get_int_32 PNGARG((png_bytep buf));
PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf));
PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf));
#endif /* !PNG_READ_BIG_ENDIAN_SUPPORTED */
+PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr,
+ png_bytep buf));
/* Initialize png_ptr struct for reading, and allocate any other memory.
* (old interface - DEPRECATED - use png_create_read_struct instead).
@@ -2662,7 +2793,7 @@ PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf));
extern PNG_EXPORT(void,png_read_init) PNGARG((png_structp png_ptr));
#undef png_read_init
#define png_read_init(png_ptr) png_read_init_3(&png_ptr, \
- PNG_LIBPNG_VER_STRING, sizeof(png_struct));
+ PNG_LIBPNG_VER_STRING, png_sizeof(png_struct));
extern PNG_EXPORT(void,png_read_init_3) PNGARG((png_structpp ptr_ptr,
png_const_charp user_png_ver, png_size_t png_struct_size));
extern PNG_EXPORT(void,png_read_init_2) PNGARG((png_structp png_ptr,
@@ -2675,7 +2806,7 @@ extern PNG_EXPORT(void,png_read_init_2) PNGARG((png_structp png_ptr,
extern PNG_EXPORT(void,png_write_init) PNGARG((png_structp png_ptr));
#undef png_write_init
#define png_write_init(png_ptr) png_write_init_3(&png_ptr, \
- PNG_LIBPNG_VER_STRING, sizeof(png_struct));
+ PNG_LIBPNG_VER_STRING, png_sizeof(png_struct));
extern PNG_EXPORT(void,png_write_init_3) PNGARG((png_structpp ptr_ptr,
png_const_charp user_png_ver, png_size_t png_struct_size));
extern PNG_EXPORT(void,png_write_init_2) PNGARG((png_structp png_ptr,
@@ -2704,6 +2835,11 @@ PNG_EXTERN voidpf png_zalloc PNGARG((voidpf png_ptr, uInt items, uInt size));
/* Function to free memory for zlib */
PNG_EXTERN void png_zfree PNGARG((voidpf png_ptr, voidpf ptr));
+#ifdef PNG_SIZE_T
+/* Function to convert a sizeof an item to png_sizeof item */
+ PNG_EXTERN png_size_t PNGAPI png_convert_size PNGARG((size_t size));
+#endif
+
/* Next four functions are used internally as callbacks. PNGAPI is required
* but not PNG_EXPORT. PNGAPI added at libpng version 1.2.3. */
diff --git a/src/libs/png/pngconf.h b/src/libs/png/pngconf.h
index 4a425dd1aa..ba50838454 100644
--- a/src/libs/png/pngconf.h
+++ b/src/libs/png/pngconf.h
@@ -1,8 +1,9 @@
+
/* pngconf.h - machine configurable file for libpng
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*/
@@ -16,6 +17,54 @@
#ifndef PNGCONF_H
#define PNGCONF_H
+#define PNG_1_2_X
+
+/*
+ * PNG_USER_CONFIG has to be defined on the compiler command line. This
+ * includes the resource compiler for Windows DLL configurations.
+ */
+#ifdef PNG_USER_CONFIG
+#include "pngusr.h"
+#endif
+
+/*
+ * Added at libpng-1.2.8
+ *
+ * If you create a private DLL you need to define in "pngusr.h" the followings:
+ * #define PNG_USER_PRIVATEBUILD
+ * e.g. #define PNG_USER_PRIVATEBUILD "Build by MyCompany for xyz reasons."
+ * #define PNG_USER_DLLFNAME_POSTFIX
+ * e.g. // private DLL "libpng13gx.dll"
+ * #define PNG_USER_DLLFNAME_POSTFIX "gx"
+ *
+ * The following macros are also at your disposal if you want to complete the
+ * DLL VERSIONINFO structure.
+ * - PNG_USER_VERSIONINFO_COMMENTS
+ * - PNG_USER_VERSIONINFO_COMPANYNAME
+ * - PNG_USER_VERSIONINFO_LEGALTRADEMARKS
+ */
+
+#ifdef __STDC__
+#ifdef SPECIALBUILD
+# pragma message("PNG_LIBPNG_SPECIALBUILD (and deprecated SPECIALBUILD)\
+ are now LIBPNG reserved macros. Use PNG_USER_PRIVATEBUILD instead.")
+#endif
+
+#ifdef PRIVATEBUILD
+# pragma message("PRIVATEBUILD is deprecated. Use\
+ PNG_USER_PRIVATEBUILD instead.")
+# define PNG_USER_PRIVATEBUILD PRIVATEBUILD
+#endif
+#endif /* __STDC__ */
+
+#ifndef PNG_VERSION_INFO_ONLY
+
+/* End of material added to libpng-1.2.8 */
+
/* This is the size of the compression buffer, and thus the size of
* an IDAT chunk. Make this whatever size you feel is best for your
* machine. One of these will be allocated per png_struct. When this
@@ -252,8 +301,11 @@
# undef _BSD_SOURCE
# endif
# ifdef _SETJMP_H
- __png.h__ already includes setjmp.h;
- __dont__ include it again.;
+ /* If you encounter a compiler error here, see the explanation
+ * near the end of INSTALL.
+ */
+ __png.h__ already includes setjmp.h;
+ __dont__ include it again.;
# endif
# endif /* __linux__ */
@@ -317,15 +369,13 @@
# define PNG_ALWAYS_EXTERN
#endif
-/* For some reason, Borland C++ defines memcmp, etc. in mem.h, not
- * stdlib.h like it should (I think). Or perhaps this is a C++
- * "feature"?
- */
-#ifdef __TURBOC__
+/* This provides the non-ANSI (far) memory allocation routines. */
+#if defined(__TURBOC__) && defined(__MSDOS__)
# include
-# include "alloc.h"
+# include
#endif
+/* I have no idea why is this necessary... */
#if defined(_MSC_VER) && (defined(WIN32) || defined(_Windows) || \
defined(_WINDOWS) || defined(_WIN32) || defined(__WIN32__))
# include
@@ -583,13 +633,6 @@
# endif
#endif /* PNG_WRITE_TRANSFORMS_SUPPORTED */
-#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
- defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
-# ifndef PNG_NO_USER_TRANSFORM_PTR
-# define PNG_USER_TRANSFORM_PTR_SUPPORTED
-# endif
-#endif
-
#define PNG_WRITE_INTERLACING_SUPPORTED /* not required for PNG-compliant
encoders, but can cause trouble
if left undefined */
@@ -599,12 +642,6 @@
# define PNG_WRITE_WEIGHTED_FILTER_SUPPORTED
#endif
-#ifndef PNG_1_0_X
-#ifndef PNG_NO_ERROR_NUMBERS
-#define PNG_ERROR_NUMBERS_SUPPORTED
-#endif
-#endif /* PNG_1_0_X */
-
#ifndef PNG_NO_WRITE_FLUSH
# define PNG_WRITE_FLUSH_SUPPORTED
#endif
@@ -616,6 +653,19 @@
#endif /* PNG_WRITE_SUPPORTED */
+#ifndef PNG_1_0_X
+# ifndef PNG_NO_ERROR_NUMBERS
+# define PNG_ERROR_NUMBERS_SUPPORTED
+# endif
+#endif /* PNG_1_0_X */
+
+#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
+ defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
+# ifndef PNG_NO_USER_TRANSFORM_PTR
+# define PNG_USER_TRANSFORM_PTR_SUPPORTED
+# endif
+#endif
+
#ifndef PNG_NO_STDIO
# define PNG_TIME_RFC1123_SUPPORTED
#endif
@@ -663,6 +713,25 @@
#endif
#endif /* PNG_1_0_X */
+/* Added at libpng-1.2.6 */
+#if !defined(PNG_1_0_X)
+#ifndef PNG_SET_USER_LIMITS_SUPPORTED
+#if !defined(PNG_NO_SET_USER_LIMITS) && !defined(PNG_SET_USER_LIMITS_SUPPORTED)
+# define PNG_SET_USER_LIMITS_SUPPORTED
+#endif
+#endif
+#endif /* PNG_1_0_X */
+
+/* Added at libpng-1.0.16 and 1.2.6. To accept all valid PNGS no matter
+ * how large, set these limits to 0x7fffffffL
+ */
+#ifndef PNG_USER_WIDTH_MAX
+# define PNG_USER_WIDTH_MAX 1000000L
+#endif
+#ifndef PNG_USER_HEIGHT_MAX
+# define PNG_USER_HEIGHT_MAX 1000000L
+#endif
+
/* These are currently experimental features, define them if you want */
/* very little testing */
@@ -677,10 +746,8 @@
/* This is only for PowerPC big-endian and 680x0 systems */
/* some testing */
/*
-#ifdef PNG_READ_SUPPORTED
-# ifndef PNG_PNG_READ_BIG_ENDIAN_SUPPORTED
-# define PNG_READ_BIG_ENDIAN_SUPPORTED
-# endif
+#ifndef PNG_READ_BIG_ENDIAN_SUPPORTED
+# define PNG_READ_BIG_ENDIAN_SUPPORTED
#endif
*/
@@ -988,7 +1055,13 @@ typedef unsigned char png_byte;
/* This is usually size_t. It is typedef'ed just in case you need it to
change (I'm not sure if you will or not, so I thought I'd be safe) */
-typedef size_t png_size_t;
+#ifdef PNG_SIZE_T
+ typedef PNG_SIZE_T png_size_t;
+# define png_sizeof(x) png_convert_size(sizeof (x))
+#else
+ typedef size_t png_size_t;
+# define png_sizeof(x) sizeof (x)
+#endif
/* The following is needed for medium model support. It cannot be in the
* PNG_INTERNAL section. Needs modification for other compilers besides
@@ -1092,6 +1165,9 @@ typedef double FAR * FAR * png_doublepp;
/* Pointers to pointers to pointers; i.e., pointer to array */
typedef char FAR * FAR * FAR * png_charppp;
+#if defined(PNG_1_0_X) || defined(PNG_1_2_X)
+/* SPC - Is this stuff deprecated? */
+/* It'll be removed as of libpng-1.3.0 - GR-P */
/* libpng typedefs for types in zlib. If zlib changes
* or another compression library is used, then change these.
* Eliminates need to change all the source files.
@@ -1099,6 +1175,7 @@ typedef char FAR * FAR * FAR * png_charppp;
typedef charf * png_zcharp;
typedef charf * FAR * png_zcharpp;
typedef z_stream FAR * png_zstreamp;
+#endif /* (PNG_1_0_X) || defined(PNG_1_2_X) */
/*
* Define PNG_BUILD_DLL if the module being built is a Windows
@@ -1171,8 +1248,6 @@ typedef z_stream FAR * png_zstreamp;
* zlib and your applications the same way you build libpng.
*/
-#ifndef PNGAPI
-
#if defined(__MINGW32__) && !defined(PNG_MODULEDEF)
# ifndef PNG_NO_MODULEDEF
# define PNG_NO_MODULEDEF
@@ -1187,10 +1262,12 @@ typedef z_stream FAR * png_zstreamp;
(( defined(_Windows) || defined(_WINDOWS) || \
defined(WIN32) || defined(_WIN32) || defined(__WIN32__) ))
-# if defined(__GNUC__) || (defined (_MSC_VER) && (_MSC_VER >= 800))
-# define PNGAPI __cdecl
-# else
-# define PNGAPI _cdecl
+# ifndef PNGAPI
+# if defined(__GNUC__) || (defined (_MSC_VER) && (_MSC_VER >= 800))
+# define PNGAPI __cdecl
+# else
+# define PNGAPI _cdecl
+# endif
# endif
# if !defined(PNG_IMPEXP) && (!defined(PNG_DLL) || \
@@ -1228,17 +1305,14 @@ typedef z_stream FAR * png_zstreamp;
# endif
# endif /* PNG_IMPEXP */
#else /* !(DLL || non-cygwin WINDOWS) */
-# if (defined(__IBMC__) || defined(IBMCPP__)) && defined(__OS2__)
-# define PNGAPI _System
-# define PNG_IMPEXP
-# else
-# if 0 /* ... other platforms, with other meanings */
-# else
-# define PNGAPI
-# define PNG_IMPEXP
+# if (defined(__IBMC__) || defined(__IBMCPP__)) && defined(__OS2__)
+# ifndef PNGAPI
+# define PNGAPI _System
# endif
-# endif
-#endif
+# else
+# if 0 /* ... other platforms, with other meanings */
+# endif
+# endif
#endif
#ifndef PNGAPI
@@ -1248,6 +1322,17 @@ typedef z_stream FAR * png_zstreamp;
# define PNG_IMPEXP
#endif
+#ifdef PNG_BUILDSYMS
+# ifndef PNG_EXPORT
+# define PNG_EXPORT(type,symbol) PNG_FUNCTION_EXPORT symbol END
+# endif
+# ifdef PNG_USE_GLOBAL_ARRAYS
+# ifndef PNG_EXPORT_VAR
+# define PNG_EXPORT_VAR(type) PNG_DATA_EXPORT
+# endif
+# endif
+#endif
+
#ifndef PNG_EXPORT
# define PNG_EXPORT(type,symbol) PNG_IMPEXP type PNGAPI symbol
#endif
@@ -1279,28 +1364,30 @@ typedef z_stream FAR * png_zstreamp;
# define NOCHECK 0
# define CVT_PTR(ptr) (png_far_to_near(png_ptr,ptr,CHECK))
# define CVT_PTR_NOCHECK(ptr) (png_far_to_near(png_ptr,ptr,NOCHECK))
-# define png_strcpy _fstrcpy
-# define png_strlen _fstrlen
-# define png_memcmp _fmemcmp /* SJT: added */
-# define png_memcpy _fmemcpy
-# define png_memset _fmemset
+# define png_strcpy _fstrcpy
+# define png_strncpy _fstrncpy /* Added to v 1.2.6 */
+# define png_strlen _fstrlen
+# define png_memcmp _fmemcmp /* SJT: added */
+# define png_memcpy _fmemcpy
+# define png_memset _fmemset
#else /* use the usual functions */
# define CVT_PTR(ptr) (ptr)
# define CVT_PTR_NOCHECK(ptr) (ptr)
-# define png_strcpy strcpy
-# define png_strlen strlen
-# define png_memcmp memcmp /* SJT: added */
-# define png_memcpy memcpy
-# define png_memset memset
+# define png_strcpy strcpy
+# define png_strncpy strncpy /* Added to v 1.2.6 */
+# define png_strlen strlen
+# define png_memcmp memcmp /* SJT: added */
+# define png_memcpy memcpy
+# define png_memset memset
#endif
/* End of memory model independent support */
/* Just a little check that someone hasn't tried to define something
* contradictory.
*/
-#if (PNG_ZBUF_SIZE > 65536) && defined(PNG_MAX_MALLOC_64K)
+#if (PNG_ZBUF_SIZE > 65536L) && defined(PNG_MAX_MALLOC_64K)
# undef PNG_ZBUF_SIZE
-# define PNG_ZBUF_SIZE 65536
+# define PNG_ZBUF_SIZE 65536L
#endif
#ifdef PNG_READ_SUPPORTED
@@ -1344,5 +1431,7 @@ typedef z_stream FAR * png_zstreamp;
#endif /* PNG_INTERNAL */
#endif /* PNG_READ_SUPPORTED */
-#endif /* PNGCONF_H */
+/* Added at libpng-1.2.8 */
+#endif /* PNG_VERSION_INFO_ONLY */
+#endif /* PNGCONF_H */
diff --git a/src/libs/png/pngerror.c b/src/libs/png/pngerror.c
index fc3c304779..6fa4012378 100644
--- a/src/libs/png/pngerror.c
+++ b/src/libs/png/pngerror.c
@@ -1,9 +1,9 @@
/* pngerror.c - stub functions for i/o and memory allocation
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
@@ -35,9 +35,9 @@ png_error(png_structp png_ptr, png_const_charp error_message)
char msg[16];
if (png_ptr->flags&(PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT))
{
- int offset = 0;
if (*error_message == '#')
{
+ int offset;
for (offset=1; offset<15; offset++)
if (*(error_message+offset) == ' ')
break;
@@ -63,11 +63,11 @@ png_error(png_structp png_ptr, png_const_charp error_message)
}
}
#endif
- if (png_ptr->error_fn != NULL)
+ if (png_ptr != NULL && png_ptr->error_fn != NULL)
(*(png_ptr->error_fn))(png_ptr, error_message);
- /* if the following returns or doesn't exist, use the default function,
- which will not return */
+ /* If the custom handler doesn't exist, or if it returns,
+ use the default handler, which will not return. */
png_default_error(png_ptr, error_message);
}
@@ -79,7 +79,7 @@ png_error(png_structp png_ptr, png_const_charp error_message)
void PNGAPI
png_warning(png_structp png_ptr, png_const_charp warning_message)
{
- int offset = 0;
+ int offset = 0;
#ifdef PNG_ERROR_NUMBERS_SUPPORTED
if (png_ptr->flags&(PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT))
#endif
@@ -91,11 +91,10 @@ png_warning(png_structp png_ptr, png_const_charp warning_message)
break;
}
}
- if (png_ptr->warning_fn != NULL)
- (*(png_ptr->warning_fn))(png_ptr,
- (png_const_charp)(warning_message+offset));
+ if (png_ptr != NULL && png_ptr->warning_fn != NULL)
+ (*(png_ptr->warning_fn))(png_ptr, warning_message+offset);
else
- png_default_warning(png_ptr, (png_const_charp)(warning_message+offset));
+ png_default_warning(png_ptr, warning_message+offset);
}
/* These utilities are used internally to build an error message that relates
@@ -104,10 +103,11 @@ png_warning(png_structp png_ptr, png_const_charp warning_message)
* to 63 bytes, the name characters are output as hex digits wrapped in []
* if the character is invalid.
*/
-#define isnonalpha(c) ((c) < 41 || (c) > 122 || ((c) > 90 && (c) < 97))
+#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))
static PNG_CONST char png_digit[16] = {
- '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E',
- 'F' };
+ '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
+ 'A', 'B', 'C', 'D', 'E', 'F'
+};
static void /* PRIVATE */
png_format_buffer(png_structp png_ptr, png_charp buffer, png_const_charp
@@ -137,7 +137,7 @@ png_format_buffer(png_structp png_ptr, png_charp buffer, png_const_charp
{
buffer[iout++] = ':';
buffer[iout++] = ' ';
- png_memcpy(buffer+iout, error_message, 64);
+ png_strncpy(buffer+iout, error_message, 63);
buffer[iout+63] = 0;
}
}
@@ -190,26 +190,28 @@ png_default_error(png_structp png_ptr, png_const_charp error_message)
else
#endif
fprintf(stderr, "libpng error: %s\n", error_message);
-#else
- if (error_message)
- /* make compiler happy */ ;
#endif
#ifdef PNG_SETJMP_SUPPORTED
# ifdef USE_FAR_KEYWORD
{
jmp_buf jmpbuf;
- png_memcpy(jmpbuf,png_ptr->jmpbuf,sizeof(jmp_buf));
+ png_memcpy(jmpbuf,png_ptr->jmpbuf,png_sizeof(jmp_buf));
longjmp(jmpbuf, 1);
}
# else
longjmp(png_ptr->jmpbuf, 1);
# endif
#else
+ /* make compiler happy */ ;
if (png_ptr)
- /* make compiler happy */ ;
PNG_ABORT();
#endif
+#ifdef PNG_NO_CONSOLE_IO
+ /* make compiler happy */ ;
+ if (&error_message != NULL)
+ return;
+#endif
}
/* This function is called when there is a warning, but the library thinks
@@ -245,9 +247,11 @@ png_default_warning(png_structp png_ptr, png_const_charp warning_message)
# endif
fprintf(stderr, "libpng warning: %s\n", warning_message);
#else
+ /* make compiler happy */ ;
if (warning_message)
- /* appease compiler */ ;
+ return;
#endif
+ /* make compiler happy */ ;
if (png_ptr)
return;
}
diff --git a/src/libs/png/pnggccrd.c b/src/libs/png/pnggccrd.c
index 8d81c31471..248e1b3bb4 100644
--- a/src/libs/png/pnggccrd.c
+++ b/src/libs/png/pnggccrd.c
@@ -6,9 +6,9 @@
* and http://www.intel.com/drg/pentiumII/appnotes/923/923.htm
* for Intel's performance analysis of the MMX vs. non-MMX code.
*
- * libpng version 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* Copyright (c) 1998, Intel Corporation
*
* Based on MSVC code contributed by Nirav Chhatrapati, Intel Corp., 1998.
@@ -223,6 +223,10 @@
* 20020304:
* - eliminated incorrect use of width_mmx in pixel_bytes == 8 case
*
+ * 20040724:
+ * - more tinkering with clobber list at lines 4529 and 5033, to get
+ * it to compile on gcc-3.4.
+ *
* STILL TO DO:
* - test png_do_read_interlace() 64-bit case (pixel_bytes == 8)
* - write MMX code for 48-bit case (pixel_bytes == 6)
@@ -412,8 +416,10 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask)
#if defined(PNG_ASSEMBLER_CODE_SUPPORTED)
if (_mmx_supported == 2) {
+#if !defined(PNG_1_0_X)
/* this should have happened in png_init_mmx_flags() already */
png_warning(png_ptr, "asm_flags may not have been initialized");
+#endif
png_mmx_support();
}
#endif
@@ -422,7 +428,7 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask)
{
png_debug(2,"mask == 0xff: doing single png_memcpy()\n");
png_memcpy(row, png_ptr->row_buf + 1,
- (png_size_t)((png_ptr->width * png_ptr->row_info.pixel_depth + 7) >> 3));
+ (png_size_t)PNG_ROWBYTES(png_ptr->row_info.pixel_depth,png_ptr->width));
}
else /* (png_combine_row() is never called with mask == 0) */
{
@@ -1767,8 +1773,8 @@ png_do_read_interlace(png_structp png_ptr)
: "1" (sptr), // esi // input regs
"2" (dp), // edi
- "0" (width) // ecx
-// doesn't work "i" (0x0000000000FFFFFFLL) // %1 (a.k.a. _const4)
+ "0" (width), // ecx
+ "rim" (_const4) // %1(?) (0x0000000000FFFFFFLL)
#if 0 /* %mm0, ..., %mm4 not supported by gcc 2.7.2.3 or egcs 1.1 */
: "%mm0", "%mm1", "%mm2" // clobber list
@@ -1811,7 +1817,8 @@ png_do_read_interlace(png_structp png_ptr)
: "1" (sptr), // esi // input regs
"2" (dp), // edi
- "0" (width) // ecx
+ "0" (width), // ecx
+ "rim" (_const4) // (0x0000000000FFFFFFLL)
#if 0 /* %mm0, ..., %mm2 not supported by gcc 2.7.2.3 or egcs 1.1 */
: "%mm0", "%mm1", "%mm2" // clobber list
@@ -1865,7 +1872,9 @@ png_do_read_interlace(png_structp png_ptr)
: "1" (sptr), // esi // input regs
"2" (dp), // edi
- "0" (width_mmx) // ecx
+ "0" (width_mmx), // ecx
+ "rim" (_const4), // 0x0000000000FFFFFFLL
+ "rim" (_const6) // 0x00000000000000FFLL
#if 0 /* %mm0, ..., %mm3 not supported by gcc 2.7.2.3 or egcs 1.1 */
: "%mm0", "%mm1" // clobber list
@@ -2727,8 +2736,8 @@ png_do_read_interlace(png_structp png_ptr)
} /* end switch (row_info->pixel_depth) */
row_info->width = final_width;
- row_info->rowbytes = ((final_width *
- (png_uint_32)row_info->pixel_depth + 7) >> 3);
+
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,final_width);
}
} /* end png_do_read_interlace() */
@@ -4529,8 +4538,7 @@ png_read_filter_row_mmx_sub(png_row_infop row_info, png_bytep row)
: "0" (bpp), // eax // input regs
"1" (row) // edi
- : "%ebx", "%ecx", "%edx" // clobber list
- , "%esi"
+ : "%esi", "%ecx", "%edx" // clobber list
#if 0 /* MMX regs (%mm0, etc.) not supported by gcc 2.7.2.3 or egcs 1.1 */
, "%mm0", "%mm1", "%mm2", "%mm3"
@@ -4990,7 +4998,7 @@ png_read_filter_row_mmx_up(png_row_infop row_info, png_bytep row,
"jz up_end \n\t"
"cmpl $8, %%edx \n\t" // test for less than 8 bytes
- "jb up_lt8 \n\t" // [added by lcreeve@netins.net]
+ "jb up_lt8 \n\t" // [added by lcreeve at netins.net]
"addl %%edx, %%ecx \n\t"
"andl $0x00000007, %%edx \n\t" // calc bytes over mult of 8
@@ -5034,7 +5042,10 @@ png_read_filter_row_mmx_up(png_row_infop row_info, png_bytep row,
"1" (prev_row), // esi
"2" (row) // edi
- : "%eax", "%ebx", "%ecx" // clobber list (no input regs!)
+ : "%eax", "%ecx" // clobber list (no input regs!)
+#ifndef __PIC__
+ , "%ebx"
+#endif
#if 0 /* MMX regs (%mm0, etc.) not supported by gcc 2.7.2.3 or egcs 1.1 */
, "%mm0", "%mm1", "%mm2", "%mm3"
diff --git a/src/libs/png/pngget.c b/src/libs/png/pngget.c
index f7f5c6702b..8eefa7779e 100644
--- a/src/libs/png/pngget.c
+++ b/src/libs/png/pngget.c
@@ -1,9 +1,9 @@
/* pngget.c - retrieval of values from info struct
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*/
@@ -540,9 +540,6 @@ png_get_IHDR(png_structp png_ptr, png_infop info_ptr,
if (png_ptr != NULL && info_ptr != NULL && width != NULL && height != NULL &&
bit_depth != NULL && color_type != NULL)
{
- int pixel_depth, channels;
- png_uint_32 rowbytes_per_pixel;
-
png_debug1(1, "in %s retrieval function\n", "IHDR");
*width = info_ptr->width;
*height = info_ptr->height;
@@ -560,23 +557,18 @@ png_get_IHDR(png_structp png_ptr, png_infop info_ptr,
*interlace_type = info_ptr->interlace_type;
/* check for potential overflow of rowbytes */
- if (*color_type == PNG_COLOR_TYPE_PALETTE)
- channels = 1;
- else if (*color_type & PNG_COLOR_MASK_COLOR)
- channels = 3;
- else
- channels = 1;
- if (*color_type & PNG_COLOR_MASK_ALPHA)
- channels++;
- pixel_depth = *bit_depth * channels;
- rowbytes_per_pixel = (pixel_depth + 7) >> 3;
- if (width == 0 || *width > PNG_MAX_UINT)
+ if (*width == 0 || *width > PNG_UINT_31_MAX)
png_error(png_ptr, "Invalid image width");
- if (height == 0 || *height > PNG_MAX_UINT)
+ if (*height == 0 || *height > PNG_UINT_31_MAX)
png_error(png_ptr, "Invalid image height");
- if (*width > PNG_MAX_UINT/rowbytes_per_pixel - 64)
+ if (info_ptr->width > (PNG_UINT_32_MAX
+ >> 3) /* 8-byte RGBA pixels */
+ - 64 /* bigrowbuf hack */
+ - 1 /* filter byte */
+ - 7*8 /* rounding of width to multiple of 8 pixels */
+ - 8) /* extra max_pixel_depth pad */
{
- png_error(png_ptr,
+ png_warning(png_ptr,
"Width too large for libpng to process image data.");
}
return (1);
@@ -827,13 +819,13 @@ png_get_user_chunk_ptr(png_structp png_ptr)
}
#endif
-
+#ifdef PNG_WRITE_SUPPORTED
png_uint_32 PNGAPI
png_get_compression_buffer_size(png_structp png_ptr)
{
return (png_uint_32)(png_ptr? png_ptr->zbuf_size : 0L);
}
-
+#endif
#ifndef PNG_1_0_X
#ifdef PNG_ASSEMBLER_CODE_SUPPORTED
@@ -923,5 +915,20 @@ png_get_mmx_rowbytes_threshold (png_structp png_ptr)
{
return (png_uint_32)(png_ptr? png_ptr->mmx_rowbytes_threshold : 0L);
}
-#endif /* PNG_ASSEMBLER_CODE_SUPPORTED */
-#endif /* PNG_1_0_X */
+#endif /* ?PNG_ASSEMBLER_CODE_SUPPORTED */
+
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+/* these functions were added to libpng 1.2.6 */
+png_uint_32 PNGAPI
+png_get_user_width_max (png_structp png_ptr)
+{
+ return (png_ptr? png_ptr->user_width_max : 0);
+}
+png_uint_32 PNGAPI
+png_get_user_height_max (png_structp png_ptr)
+{
+ return (png_ptr? png_ptr->user_height_max : 0);
+}
+#endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */
+
+#endif /* ?PNG_1_0_X */
diff --git a/src/libs/png/pngmem.c b/src/libs/png/pngmem.c
index 66eec0b09f..f1cb69395e 100644
--- a/src/libs/png/pngmem.c
+++ b/src/libs/png/pngmem.c
@@ -1,9 +1,9 @@
/* pngmem.c - stub functions for memory allocation
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
@@ -39,11 +39,11 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
png_voidp struct_ptr;
if (type == PNG_STRUCT_INFO)
- size = sizeof(png_info);
+ size = png_sizeof(png_info);
else if (type == PNG_STRUCT_PNG)
- size = sizeof(png_struct);
+ size = png_sizeof(png_struct);
else
- return (png_get_copyright());
+ return (png_get_copyright(NULL));
#ifdef PNG_USER_MEM_SUPPORTED
if(malloc_fn != NULL)
@@ -55,7 +55,7 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
}
else
#endif /* PNG_USER_MEM_SUPPORTED */
- struct_ptr = (png_voidp)farmalloc(size));
+ struct_ptr = (png_voidp)farmalloc(size);
if (struct_ptr != NULL)
png_memset(struct_ptr, 0, size);
return (struct_ptr);
@@ -121,14 +121,12 @@ png_malloc(png_structp png_ptr, png_uint_32 size)
#ifdef PNG_USER_MEM_SUPPORTED
if(png_ptr->malloc_fn != NULL)
- {
ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
- if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
- png_error(png_ptr, "Out of memory!");
- return (ret);
- }
else
- return png_malloc_default(png_ptr, size);
+ ret = (png_malloc_default(png_ptr, size));
+ if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+ png_error(png_ptr, "Out of memory!");
+ return (ret);
}
png_voidp PNGAPI
@@ -139,10 +137,16 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
#ifdef PNG_MAX_MALLOC_64K
if (size > (png_uint_32)65536L)
- png_error(png_ptr, "Cannot Allocate > 64K");
+ {
+ png_warning(png_ptr, "Cannot Allocate > 64K");
+ ret = NULL;
+ }
+ else
#endif
- if (size == (png_uint_32)65536L)
+ if (size != (size_t)size)
+ ret = NULL;
+ else if (size == (png_uint_32)65536L)
{
if (png_ptr->offset_table == NULL)
{
@@ -177,34 +181,40 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
if (table == NULL)
{
- if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+#ifndef PNG_USER_MEM_SUPPORTED
+ if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
png_error(png_ptr, "Out Of Memory."); /* Note "O" and "M" */
else
png_warning(png_ptr, "Out Of Memory.");
+#endif
return (NULL);
}
if ((png_size_t)table & 0xfff0)
{
- if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+#ifndef PNG_USER_MEM_SUPPORTED
+ if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
png_error(png_ptr,
"Farmalloc didn't return normalized pointer");
else
png_warning(png_ptr,
"Farmalloc didn't return normalized pointer");
+#endif
return (NULL);
}
png_ptr->offset_table = table;
png_ptr->offset_table_ptr = farmalloc(num_blocks *
- sizeof (png_bytep));
+ png_sizeof (png_bytep));
if (png_ptr->offset_table_ptr == NULL)
{
- if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+#ifndef PNG_USER_MEM_SUPPORTED
+ if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
png_error(png_ptr, "Out Of memory."); /* Note "O" and "M" */
else
png_warning(png_ptr, "Out Of memory.");
+#endif
return (NULL);
}
@@ -228,10 +238,12 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
if (png_ptr->offset_table_count >= png_ptr->offset_table_number)
{
- if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+#ifndef PNG_USER_MEM_SUPPORTED
+ if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
png_error(png_ptr, "Out of Memory."); /* Note "o" and "M" */
else
png_warning(png_ptr, "Out of Memory.");
+#endif
return (NULL);
}
@@ -240,13 +252,15 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
else
ret = farmalloc(size);
+#ifndef PNG_USER_MEM_SUPPORTED
if (ret == NULL)
{
- if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+ if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
png_error(png_ptr, "Out of memory."); /* Note "o" and "m" */
else
png_warning(png_ptr, "Out of memory."); /* Note "o" and "m" */
}
+#endif
return (ret);
}
@@ -325,9 +339,9 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
png_voidp struct_ptr;
if (type == PNG_STRUCT_INFO)
- size = sizeof(png_info);
+ size = png_sizeof(png_info);
else if (type == PNG_STRUCT_PNG)
- size = sizeof(png_struct);
+ size = png_sizeof(png_struct);
else
return (NULL);
@@ -345,17 +359,16 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
#endif /* PNG_USER_MEM_SUPPORTED */
#if defined(__TURBOC__) && !defined(__FLAT__)
- if ((struct_ptr = (png_voidp)farmalloc(size)) != NULL)
+ struct_ptr = (png_voidp)farmalloc(size);
#else
# if defined(_MSC_VER) && defined(MAXSEG_64K)
- if ((struct_ptr = (png_voidp)halloc(size,1)) != NULL)
+ struct_ptr = (png_voidp)halloc(size,1);
# else
- if ((struct_ptr = (png_voidp)malloc(size)) != NULL)
+ struct_ptr = (png_voidp)malloc(size);
# endif
#endif
- {
+ if (struct_ptr != NULL)
png_memset(struct_ptr, 0, size);
- }
return (struct_ptr);
}
@@ -410,19 +423,17 @@ png_malloc(png_structp png_ptr, png_uint_32 size)
{
png_voidp ret;
+#ifdef PNG_USER_MEM_SUPPORTED
if (png_ptr == NULL || size == 0)
return (NULL);
-#ifdef PNG_USER_MEM_SUPPORTED
if(png_ptr->malloc_fn != NULL)
- {
ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
- if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
- png_error(png_ptr, "Out of Memory!");
- return (ret);
- }
else
- return (png_malloc_default(png_ptr, size));
+ ret = (png_malloc_default(png_ptr, size));
+ if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
+ png_error(png_ptr, "Out of Memory!");
+ return (ret);
}
png_voidp PNGAPI
@@ -431,28 +442,45 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size)
png_voidp ret;
#endif /* PNG_USER_MEM_SUPPORTED */
+ if (png_ptr == NULL || size == 0)
+ return (NULL);
+
#ifdef PNG_MAX_MALLOC_64K
if (size > (png_uint_32)65536L)
{
+#ifndef PNG_USER_MEM_SUPPORTED
if(png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
png_error(png_ptr, "Cannot Allocate > 64K");
else
+#endif
return NULL;
}
#endif
+ /* Check for overflow */
#if defined(__TURBOC__) && !defined(__FLAT__)
+ if (size != (unsigned long)size)
+ ret = NULL;
+ else
ret = farmalloc(size);
#else
# if defined(_MSC_VER) && defined(MAXSEG_64K)
+ if (size != (unsigned long)size)
+ ret = NULL;
+ else
ret = halloc(size, 1);
# else
+ if (size != (size_t)size)
+ ret = NULL;
+ else
ret = malloc((size_t)size);
# endif
#endif
+#ifndef PNG_USER_MEM_SUPPORTED
if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
png_error(png_ptr, "Out of Memory");
+#endif
return (ret);
}
@@ -498,8 +526,9 @@ png_free_default(png_structp png_ptr, png_voidp ptr)
# define png_malloc_warn png_malloc
#else
/* This function was added at libpng version 1.2.3. The png_malloc_warn()
- * function will issue a png_warning and return NULL instead of issuing a
- * png_error, if it fails to allocate the requested memory.
+ * function will set up png_malloc() to issue a png_warning and return NULL
+ * instead of issuing a png_error, if it fails to allocate the requested
+ * memory.
*/
png_voidp PNGAPI
png_malloc_warn(png_structp png_ptr, png_uint_32 size)
diff --git a/src/libs/png/pngpread.c b/src/libs/png/pngpread.c
index 9f924c34cc..8c35faae44 100644
--- a/src/libs/png/pngpread.c
+++ b/src/libs/png/pngpread.c
@@ -1,9 +1,9 @@
/* pngpread.c - read a png file in push mode
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*/
@@ -208,7 +208,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
}
png_push_fill_buffer(png_ptr, chunk_length, 4);
- png_ptr->push_length = png_get_uint_32(chunk_length);
+ png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length);
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
@@ -223,6 +223,41 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
}
png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length);
}
+ else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
+ {
+ if (png_ptr->push_length + 4 > png_ptr->buffer_size)
+ {
+ png_push_save_buffer(png_ptr);
+ return;
+ }
+ png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length);
+
+ png_ptr->process_mode = PNG_READ_DONE_MODE;
+ png_push_have_end(png_ptr, info_ptr);
+ }
+#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
+ else if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name))
+ {
+ if (png_ptr->push_length + 4 > png_ptr->buffer_size)
+ {
+ png_push_save_buffer(png_ptr);
+ return;
+ }
+ if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
+ png_ptr->mode |= PNG_HAVE_IDAT;
+ png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
+ if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
+ png_ptr->mode |= PNG_HAVE_PLTE;
+ else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
+ {
+ if (!(png_ptr->mode & PNG_HAVE_IHDR))
+ png_error(png_ptr, "Missing IHDR before IDAT");
+ else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
+ !(png_ptr->mode & PNG_HAVE_PLTE))
+ png_error(png_ptr, "Missing PLTE before IDAT");
+ }
+ }
+#endif
else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
{
if (png_ptr->push_length + 4 > png_ptr->buffer_size)
@@ -261,18 +296,6 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
png_ptr->zstream.next_out = png_ptr->row_buf;
return;
}
- else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
- {
- if (png_ptr->push_length + 4 > png_ptr->buffer_size)
- {
- png_push_save_buffer(png_ptr);
- return;
- }
- png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length);
-
- png_ptr->process_mode = PNG_READ_DONE_MODE;
- png_push_have_end(png_ptr, info_ptr);
- }
#if defined(PNG_READ_gAMA_SUPPORTED)
else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4))
{
@@ -591,6 +614,11 @@ png_push_save_buffer(png_structp png_ptr)
png_size_t new_max;
png_bytep old_buffer;
+ if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
+ (png_ptr->current_buffer_size + 256))
+ {
+ png_error(png_ptr, "Potential overflow of save_buffer");
+ }
new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
old_buffer = png_ptr->save_buffer;
png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr,
@@ -637,8 +665,7 @@ png_push_read_IDAT(png_structp png_ptr)
}
png_push_fill_buffer(png_ptr, chunk_length, 4);
- png_ptr->push_length = png_get_uint_32(chunk_length);
-
+ png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length);
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
@@ -753,7 +780,7 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
png_ptr->interlaced && png_ptr->pass > 6) ||
(!png_ptr->interlaced &&
#endif
- png_ptr->row_number == png_ptr->num_rows-1))
+ png_ptr->row_number == png_ptr->num_rows))
{
if (png_ptr->zstream.avail_in)
png_warning(png_ptr, "Too much data in IDAT chunks");
@@ -778,8 +805,8 @@ png_push_process_row(png_structp png_ptr)
png_ptr->row_info.bit_depth = png_ptr->bit_depth;
png_ptr->row_info.pixel_depth = png_ptr->pixel_depth;
- png_ptr->row_info.rowbytes = ((png_ptr->row_info.width *
- (png_uint_32)png_ptr->row_info.pixel_depth + 7) >> 3);
+ png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
+ png_ptr->row_info.width);
png_read_filter_row(png_ptr, &(png_ptr->row_info),
png_ptr->row_buf + 1, png_ptr->prev_row + 1,
@@ -788,7 +815,7 @@ png_push_process_row(png_structp png_ptr)
png_memcpy_check(png_ptr, png_ptr->prev_row, png_ptr->row_buf,
png_ptr->rowbytes + 1);
- if (png_ptr->transformations)
+ if (png_ptr->transformations || (png_ptr->flags&PNG_FLAG_STRIP_ALPHA))
png_do_read_transformations(png_ptr);
#if defined(PNG_READ_INTERLACING_SUPPORTED)
@@ -1004,8 +1031,8 @@ png_read_push_finish_row(png_structp png_ptr)
png_pass_start[png_ptr->pass]) /
png_pass_inc[png_ptr->pass];
- png_ptr->irowbytes = ((png_ptr->iwidth *
- png_ptr->pixel_depth + 7) >> 3) + 1;
+ png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,
+ png_ptr->iwidth) + 1;
if (png_ptr->transformations & PNG_INTERLACE)
break;
@@ -1094,7 +1121,8 @@ png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
if (text != key + png_ptr->current_text_size)
text++;
- text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
+ text_ptr = (png_textp)png_malloc(png_ptr,
+ (png_uint_32)png_sizeof(png_text));
text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
text_ptr->key = key;
#ifdef PNG_iTXt_SUPPORTED
@@ -1287,7 +1315,8 @@ png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
key = text;
text += key_size;
- text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
+ text_ptr = (png_textp)png_malloc(png_ptr,
+ (png_uint_32)png_sizeof(png_text));
text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
text_ptr->key = key;
#ifdef PNG_iTXt_SUPPORTED
@@ -1399,7 +1428,8 @@ png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
if (text != key + png_ptr->current_text_size)
text++;
- text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
+ text_ptr = (png_textp)png_malloc(png_ptr,
+ (png_uint_32)png_sizeof(png_text));
text_ptr->compression = comp_flag + 2;
text_ptr->key = key;
text_ptr->lang = lang;
@@ -1434,7 +1464,7 @@ png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
{
#if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
- HANDLE_CHUNK_ALWAYS
+ PNG_HANDLE_CHUNK_ALWAYS
#if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
&& png_ptr->read_user_chunk_fn == NULL
#endif
@@ -1473,7 +1503,7 @@ png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
{
if (!(png_ptr->chunk_name[0] & 0x20))
if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
- HANDLE_CHUNK_ALWAYS)
+ PNG_HANDLE_CHUNK_ALWAYS)
png_chunk_error(png_ptr, "unknown critical chunk");
}
png_set_unknown_chunks(png_ptr, info_ptr, &chunk, 1);
diff --git a/src/libs/png/pngread.c b/src/libs/png/pngread.c
index e91d3e89ca..5924333df3 100644
--- a/src/libs/png/pngread.c
+++ b/src/libs/png/pngread.c
@@ -1,9 +1,9 @@
/* pngread.c - read a PNG file
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
@@ -59,6 +59,12 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
#endif
#endif /* PNG_1_0_X */
+ /* added at libpng-1.2.6 */
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+ png_ptr->user_width_max=PNG_USER_WIDTH_MAX;
+ png_ptr->user_height_max=PNG_USER_HEIGHT_MAX;
+#endif
+
#ifdef PNG_SETJMP_SUPPORTED
#ifdef USE_FAR_KEYWORD
if (setjmp(jmpbuf))
@@ -77,7 +83,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
return (NULL);
}
#ifdef USE_FAR_KEYWORD
- png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf));
+ png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf));
#endif
#endif
@@ -154,7 +160,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
#ifdef USE_FAR_KEYWORD
if (setjmp(jmpbuf))
PNG_ABORT();
- png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf));
+ png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf));
#else
if (setjmp(png_ptr->jmpbuf))
PNG_ABORT();
@@ -166,6 +172,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
/* Initialize PNG structure for reading, and allocate any memory needed.
This interface is deprecated in favour of the png_create_read_struct(),
and it will eventually disappear. */
+#if defined(PNG_1_0_X) || defined (PNG_1_2_X)
#undef png_read_init
void PNGAPI
png_read_init(png_structp png_ptr)
@@ -173,6 +180,7 @@ png_read_init(png_structp png_ptr)
/* We only come here via pre-1.0.7-compiled applications */
png_read_init_2(png_ptr, "1.0.6 or earlier", 0, 0);
}
+#endif
void PNGAPI
png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver,
@@ -180,7 +188,8 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver,
{
/* We only come here via pre-1.0.12-compiled applications */
#if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)
- if(sizeof(png_struct) > png_struct_size || sizeof(png_info) > png_info_size)
+ if(png_sizeof(png_struct) > png_struct_size ||
+ png_sizeof(png_info) > png_info_size)
{
char msg[80];
png_ptr->warning_fn=NULL;
@@ -195,7 +204,7 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver,
png_warning(png_ptr, msg);
}
#endif
- if(sizeof(png_struct) > png_struct_size)
+ if(png_sizeof(png_struct) > png_struct_size)
{
png_ptr->error_fn=NULL;
#ifdef PNG_ERROR_NUMBERS_SUPPORTED
@@ -204,7 +213,7 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver,
png_error(png_ptr,
"The png struct allocated by the application for reading is too small.");
}
- if(sizeof(png_info) > png_info_size)
+ if(png_sizeof(png_info) > png_info_size)
{
png_ptr->error_fn=NULL;
#ifdef PNG_ERROR_NUMBERS_SUPPORTED
@@ -247,10 +256,10 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
#ifdef PNG_SETJMP_SUPPORTED
/* save jump buffer and error functions */
- png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf));
+ png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf));
#endif
- if(sizeof(png_struct) > png_struct_size)
+ if(png_sizeof(png_struct) > png_struct_size)
{
png_destroy_struct(png_ptr);
*ptr_ptr = (png_structp)png_create_struct(PNG_STRUCT_PNG);
@@ -258,11 +267,17 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
}
/* reset all variables to 0 */
- png_memset(png_ptr, 0, sizeof (png_struct));
+ png_memset(png_ptr, 0, png_sizeof (png_struct));
#ifdef PNG_SETJMP_SUPPORTED
/* restore jump buffer */
- png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf));
+ png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf));
+#endif
+
+ /* added at libpng-1.2.6 */
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+ png_ptr->user_width_max=PNG_USER_WIDTH_MAX;
+ png_ptr->user_height_max=PNG_USER_HEIGHT_MAX;
#endif
/* initialize zbuf - compression buffer */
@@ -288,6 +303,7 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
png_set_read_fn(png_ptr, png_voidp_NULL, png_rw_ptr_NULL);
}
+#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
/* Read the information before the actual image data. This has been
* changed in v0.90 to allow reading a file that already has the magic
* bytes read from the stream. You can tell libpng how many bytes have
@@ -379,12 +395,12 @@ png_read_info(png_structp png_ptr, png_infop info_ptr)
#if defined(PNG_READ_zTXt_SUPPORTED)
PNG_zTXt;
#endif
-#endif /* PNG_GLOBAL_ARRAYS */
+#endif /* PNG_USE_LOCAL_ARRAYS */
png_byte chunk_length[4];
png_uint_32 length;
png_read_data(png_ptr, chunk_length, 4);
- length = png_get_uint_32(chunk_length);
+ length = png_get_uint_31(png_ptr,chunk_length);
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
@@ -392,9 +408,6 @@ png_read_info(png_structp png_ptr, png_infop info_ptr)
png_debug2(0, "Reading %s chunk, length=%lu.\n", png_ptr->chunk_name,
length);
- if (length > PNG_MAX_UINT)
- png_error(png_ptr, "Invalid chunk length.");
-
/* This should be a binary subdivision search or a hash for
* matching the chunk name rather than a linear search.
*/
@@ -507,6 +520,7 @@ png_read_info(png_structp png_ptr, png_infop info_ptr)
png_handle_unknown(png_ptr, info_ptr, length);
}
}
+#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
/* optional call to update the users info_ptr structure */
void PNGAPI
@@ -521,6 +535,7 @@ png_read_update_info(png_structp png_ptr, png_infop info_ptr)
png_read_transform_info(png_ptr, info_ptr);
}
+#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
/* Initialize palette, background, etc, after transformations
* are set, but before any reading takes place. This allows
* the user to obtain a gamma-corrected palette, for example.
@@ -533,7 +548,9 @@ png_start_read_image(png_structp png_ptr)
if (!(png_ptr->flags & PNG_FLAG_ROW_INIT))
png_read_start_row(png_ptr);
}
+#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
+#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
void PNGAPI
png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
{
@@ -673,10 +690,7 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
png_crc_finish(png_ptr, 0);
png_read_data(png_ptr, chunk_length, 4);
- png_ptr->idat_size = png_get_uint_32(chunk_length);
-
- if (png_ptr->idat_size > PNG_MAX_UINT)
- png_error(png_ptr, "Invalid chunk length.");
+ png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length);
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
@@ -712,8 +726,8 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
png_ptr->row_info.channels = png_ptr->channels;
png_ptr->row_info.bit_depth = png_ptr->bit_depth;
png_ptr->row_info.pixel_depth = png_ptr->pixel_depth;
- png_ptr->row_info.rowbytes = ((png_ptr->row_info.width *
- (png_uint_32)png_ptr->row_info.pixel_depth + 7) >> 3);
+ png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
+ png_ptr->row_info.width);
if(png_ptr->row_buf[0])
png_read_filter_row(png_ptr, &(png_ptr->row_info),
@@ -732,7 +746,8 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
}
#endif
- if (png_ptr->transformations)
+
+ if (png_ptr->transformations || (png_ptr->flags&PNG_FLAG_STRIP_ALPHA))
png_do_read_transformations(png_ptr);
#if defined(PNG_READ_INTERLACING_SUPPORTED)
@@ -767,7 +782,9 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
if (png_ptr->read_row_fn != NULL)
(*(png_ptr->read_row_fn))(png_ptr, png_ptr->row_number, png_ptr->pass);
}
+#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
+#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
/* Read one or more rows of image data. If the image is interlaced,
* and png_set_interlace_handling() has been called, the rows need to
* contain the contents of the rows from the previous pass. If the
@@ -789,7 +806,7 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
* not called png_set_interlace_handling(), the display_row buffer will
* be ignored, so pass NULL to it.
*
- * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.5
+ * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.8
*/
void PNGAPI
@@ -826,7 +843,9 @@ png_read_rows(png_structp png_ptr, png_bytepp row,
dp++;
}
}
+#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
+#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
/* Read the entire image. If the image has an alpha channel or a tRNS
* chunk, and you have called png_handle_alpha()[*], you will need to
* initialize the image to the current image that PNG will be overlaying.
@@ -837,7 +856,7 @@ png_read_rows(png_structp png_ptr, png_bytepp row,
* only call this function once. If you desire to have an image for
* each pass of a interlaced image, use png_read_rows() instead.
*
- * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.5
+ * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.8
*/
void PNGAPI
png_read_image(png_structp png_ptr, png_bytepp image)
@@ -871,7 +890,9 @@ png_read_image(png_structp png_ptr, png_bytepp image)
}
}
}
+#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
+#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
/* Read the end of the PNG file. Will not read past the end of the
* file, will verify the end is accurate, and will read any comments
* or time information at the end of the file, if info is not NULL.
@@ -943,19 +964,16 @@ png_read_end(png_structp png_ptr, png_infop info_ptr)
#if defined(PNG_READ_zTXt_SUPPORTED)
PNG_zTXt;
#endif
-#endif /* PNG_GLOBAL_ARRAYS */
+#endif /* PNG_USE_LOCAL_ARRAYS */
png_read_data(png_ptr, chunk_length, 4);
- length = png_get_uint_32(chunk_length);
+ length = png_get_uint_31(png_ptr,chunk_length);
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name);
- if (length > PNG_MAX_UINT)
- png_error(png_ptr, "Invalid chunk length.");
-
if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
png_handle_IHDR(png_ptr, info_ptr, length);
else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
@@ -1058,6 +1076,7 @@ png_read_end(png_structp png_ptr, png_infop info_ptr)
png_handle_unknown(png_ptr, info_ptr, length);
} while (!(png_ptr->mode & PNG_HAVE_IEND));
}
+#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
/* free all memory used by the read */
void PNGAPI
@@ -1067,8 +1086,8 @@ png_destroy_read_struct(png_structpp png_ptr_ptr, png_infopp info_ptr_ptr,
png_structp png_ptr = NULL;
png_infop info_ptr = NULL, end_info_ptr = NULL;
#ifdef PNG_USER_MEM_SUPPORTED
- png_free_ptr free_fn = NULL;
- png_voidp mem_ptr = NULL;
+ png_free_ptr free_fn;
+ png_voidp mem_ptr;
#endif
png_debug(1, "in png_destroy_read_struct\n");
@@ -1249,7 +1268,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr
* being used again.
*/
#ifdef PNG_SETJMP_SUPPORTED
- png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf));
+ png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf));
#endif
error_fn = png_ptr->error_fn;
@@ -1259,7 +1278,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr
free_fn = png_ptr->free_fn;
#endif
- png_memset(png_ptr, 0, sizeof (png_struct));
+ png_memset(png_ptr, 0, png_sizeof (png_struct));
png_ptr->error_fn = error_fn;
png_ptr->warning_fn = warning_fn;
@@ -1269,7 +1288,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr
#endif
#ifdef PNG_SETJMP_SUPPORTED
- png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf));
+ png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf));
#endif
}
@@ -1280,6 +1299,8 @@ png_set_read_status_fn(png_structp png_ptr, png_read_status_ptr read_row_fn)
png_ptr->read_row_fn = read_row_fn;
}
+
+#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED
#if defined(PNG_INFO_IMAGE_SUPPORTED)
void PNGAPI
png_read_png(png_structp png_ptr, png_infop info_ptr,
@@ -1289,34 +1310,38 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
int row;
#if defined(PNG_READ_INVERT_ALPHA_SUPPORTED)
- /* invert the alpha channel from opacity to transparency */
+ /* invert the alpha channel from opacity to transparency
+ */
if (transforms & PNG_TRANSFORM_INVERT_ALPHA)
png_set_invert_alpha(png_ptr);
#endif
- /* The call to png_read_info() gives us all of the information from the
+ /* png_read_info() gives us all of the information from the
* PNG file before the first IDAT (image data chunk).
*/
png_read_info(png_ptr, info_ptr);
+ if (info_ptr->height > PNG_UINT_32_MAX/png_sizeof(png_bytep))
+ png_error(png_ptr,"Image is too high to process with png_read_png()");
/* -------------- image transformations start here ------------------- */
#if defined(PNG_READ_16_TO_8_SUPPORTED)
- /* tell libpng to strip 16 bit/color files down to 8 bits/color */
+ /* tell libpng to strip 16 bit/color files down to 8 bits per color
+ */
if (transforms & PNG_TRANSFORM_STRIP_16)
png_set_strip_16(png_ptr);
#endif
#if defined(PNG_READ_STRIP_ALPHA_SUPPORTED)
- /* Strip alpha bytes from the input data without combining with the
- * background (not recommended).
+ /* Strip alpha bytes from the input data without combining with
+ * the background (not recommended).
*/
if (transforms & PNG_TRANSFORM_STRIP_ALPHA)
png_set_strip_alpha(png_ptr);
#endif
#if defined(PNG_READ_PACK_SUPPORTED) && !defined(PNG_READ_EXPAND_SUPPORTED)
- /* Extract multiple pixels with bit depths of 1, 2, and 4 from a single
+ /* Extract multiple pixels with bit depths of 1, 2, or 4 from a single
* byte into separate bytes (useful for paletted and grayscale images).
*/
if (transforms & PNG_TRANSFORM_PACKING)
@@ -1325,7 +1350,8 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
#if defined(PNG_READ_PACKSWAP_SUPPORTED)
/* Change the order of packed pixels to least significant bit first
- * (not useful if you are using png_set_packing). */
+ * (not useful if you are using png_set_packing).
+ */
if (transforms & PNG_TRANSFORM_PACKSWAP)
png_set_packswap(png_ptr);
#endif
@@ -1343,10 +1369,12 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
png_set_expand(png_ptr);
#endif
- /* We don't handle background color or gamma transformation or dithering. */
+ /* We don't handle background color or gamma transformation or dithering.
+ */
#if defined(PNG_READ_INVERT_SUPPORTED)
- /* invert monochrome files to have 0 as white and 1 as black */
+ /* invert monochrome files to have 0 as white and 1 as black
+ */
if (transforms & PNG_TRANSFORM_INVERT_MONO)
png_set_invert_mono(png_ptr);
#endif
@@ -1367,19 +1395,22 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
#endif
#if defined(PNG_READ_BGR_SUPPORTED)
- /* flip the RGB pixels to BGR (or RGBA to BGRA) */
+ /* flip the RGB pixels to BGR (or RGBA to BGRA)
+ */
if (transforms & PNG_TRANSFORM_BGR)
png_set_bgr(png_ptr);
#endif
#if defined(PNG_READ_SWAP_ALPHA_SUPPORTED)
- /* swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR) */
+ /* swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR)
+ */
if (transforms & PNG_TRANSFORM_SWAP_ALPHA)
png_set_swap_alpha(png_ptr);
#endif
#if defined(PNG_READ_SWAP_SUPPORTED)
- /* swap bytes of 16 bit files to least significant byte first */
+ /* swap bytes of 16 bit files to least significant byte first
+ */
if (transforms & PNG_TRANSFORM_SWAP_ENDIAN)
png_set_swap(png_ptr);
#endif
@@ -1400,7 +1431,7 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
if(info_ptr->row_pointers == NULL)
{
info_ptr->row_pointers = (png_bytepp)png_malloc(png_ptr,
- info_ptr->height * sizeof(png_bytep));
+ info_ptr->height * png_sizeof(png_bytep));
#ifdef PNG_FREE_ME_SUPPORTED
info_ptr->free_me |= PNG_FREE_ROWS;
#endif
@@ -1422,3 +1453,4 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
}
#endif
+#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */
diff --git a/src/libs/png/pngrio.c b/src/libs/png/pngrio.c
index c33b1cdce3..cae501a5ca 100644
--- a/src/libs/png/pngrio.c
+++ b/src/libs/png/pngrio.c
@@ -1,9 +1,9 @@
/* pngrio.c - functions for data input
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
diff --git a/src/libs/png/pngrtran.c b/src/libs/png/pngrtran.c
index 3de91202c1..e1d6e3ce39 100644
--- a/src/libs/png/pngrtran.c
+++ b/src/libs/png/pngrtran.c
@@ -1,9 +1,9 @@
/* pngrtran.c - transforms the data in a row for PNG readers
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
@@ -85,7 +85,8 @@ png_set_background(png_structp png_ptr,
}
png_ptr->transformations |= PNG_BACKGROUND;
- png_memcpy(&(png_ptr->background), background_color, sizeof(png_color_16));
+ png_memcpy(&(png_ptr->background), background_color,
+ png_sizeof(png_color_16));
png_ptr->background_gamma = (float)background_gamma;
png_ptr->background_gamma_type = (png_byte)(background_gamma_code);
png_ptr->transformations |= (need_expand ? PNG_BACKGROUND_EXPAND : 0);
@@ -118,7 +119,7 @@ void PNGAPI
png_set_strip_alpha(png_structp png_ptr)
{
png_debug(1, "in png_set_strip_alpha\n");
- png_ptr->transformations |= PNG_STRIP_ALPHA;
+ png_ptr->flags |= PNG_FLAG_STRIP_ALPHA;
}
#endif
@@ -154,7 +155,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
int i;
png_ptr->dither_index = (png_bytep)png_malloc(png_ptr,
- (png_uint_32)(num_palette * sizeof (png_byte)));
+ (png_uint_32)(num_palette * png_sizeof (png_byte)));
for (i = 0; i < num_palette; i++)
png_ptr->dither_index[i] = (png_byte)i;
}
@@ -170,7 +171,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
/* initialize an array to sort colors */
png_ptr->dither_sort = (png_bytep)png_malloc(png_ptr,
- (png_uint_32)(num_palette * sizeof (png_byte)));
+ (png_uint_32)(num_palette * png_sizeof (png_byte)));
/* initialize the dither_sort array */
for (i = 0; i < num_palette; i++)
@@ -299,9 +300,9 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
/* initialize palette index arrays */
png_ptr->index_to_palette = (png_bytep)png_malloc(png_ptr,
- (png_uint_32)(num_palette * sizeof (png_byte)));
+ (png_uint_32)(num_palette * png_sizeof (png_byte)));
png_ptr->palette_to_index = (png_bytep)png_malloc(png_ptr,
- (png_uint_32)(num_palette * sizeof (png_byte)));
+ (png_uint_32)(num_palette * png_sizeof (png_byte)));
/* initialize the sort array */
for (i = 0; i < num_palette; i++)
@@ -311,10 +312,10 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
}
hash = (png_dsortpp)png_malloc(png_ptr, (png_uint_32)(769 *
- sizeof (png_dsortp)));
+ png_sizeof (png_dsortp)));
for (i = 0; i < 769; i++)
hash[i] = NULL;
-/* png_memset(hash, 0, 769 * sizeof (png_dsortp)); */
+/* png_memset(hash, 0, 769 * png_sizeof (png_dsortp)); */
num_new_palette = num_palette;
@@ -344,7 +345,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
{
t = (png_dsortp)png_malloc_warn(png_ptr,
- (png_uint_32)(sizeof(png_dsort)));
+ (png_uint_32)(png_sizeof(png_dsort)));
if (t == NULL)
break;
t->next = hash[d];
@@ -462,14 +463,15 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
png_size_t num_entries = ((png_size_t)1 << total_bits);
png_ptr->palette_lookup = (png_bytep )png_malloc(png_ptr,
- (png_uint_32)(num_entries * sizeof (png_byte)));
+ (png_uint_32)(num_entries * png_sizeof (png_byte)));
- png_memset(png_ptr->palette_lookup, 0, num_entries * sizeof (png_byte));
+ png_memset(png_ptr->palette_lookup, 0, num_entries *
+ png_sizeof (png_byte));
distance = (png_bytep)png_malloc(png_ptr, (png_uint_32)(num_entries *
- sizeof(png_byte)));
+ png_sizeof(png_byte)));
- png_memset(distance, 0xff, num_entries * sizeof(png_byte));
+ png_memset(distance, 0xff, num_entries * png_sizeof(png_byte));
for (i = 0; i < num_palette; i++)
{
@@ -480,12 +482,14 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
for (ir = 0; ir < num_red; ir++)
{
- int dr = abs(ir - r);
+ /* int dr = abs(ir - r); */
+ int dr = ((ir > r) ? ir - r : r - ir);
int index_r = (ir << (PNG_DITHER_BLUE_BITS + PNG_DITHER_GREEN_BITS));
for (ig = 0; ig < num_green; ig++)
{
- int dg = abs(ig - g);
+ /* int dg = abs(ig - g); */
+ int dg = ((ig > g) ? ig - g : g - ig);
int dt = dr + dg;
int dm = ((dr > dg) ? dr : dg);
int index_g = index_r | (ig << PNG_DITHER_BLUE_BITS);
@@ -493,7 +497,8 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
for (ib = 0; ib < num_blue; ib++)
{
int d_index = index_g | ib;
- int db = abs(ib - b);
+ /* int db = abs(ib - b); */
+ int db = ((ib > b) ? ib - b : b - ib);
int dmax = ((dm > db) ? dm : db);
int d = dmax + dt + db;
@@ -1116,7 +1121,7 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr)
info_ptr->channels = 1;
#if defined(PNG_READ_STRIP_ALPHA_SUPPORTED)
- if (png_ptr->transformations & PNG_STRIP_ALPHA)
+ if (png_ptr->flags & PNG_FLAG_STRIP_ALPHA)
info_ptr->color_type &= ~PNG_COLOR_MASK_ALPHA;
#endif
@@ -1130,8 +1135,10 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr)
(info_ptr->color_type == PNG_COLOR_TYPE_GRAY)))
{
info_ptr->channels++;
-#if 0 /* if adding a true alpha channel not just filler */
- info_ptr->color_type |= PNG_COLOR_MASK_ALPHA;
+ /* if adding a true alpha channel not just filler */
+#if !defined(PNG_1_0_X)
+ if (png_ptr->transformations & PNG_ADD_ALPHA)
+ info_ptr->color_type |= PNG_COLOR_MASK_ALPHA;
#endif
}
#endif
@@ -1149,7 +1156,8 @@ defined(PNG_READ_USER_TRANSFORM_SUPPORTED)
info_ptr->pixel_depth = (png_byte)(info_ptr->channels *
info_ptr->bit_depth);
- info_ptr->rowbytes = ((info_ptr->width * info_ptr->pixel_depth + 7) >> 3);
+
+ info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth,info_ptr->width);
#if !defined(PNG_READ_EXPAND_SUPPORTED)
if(png_ptr)
@@ -1201,9 +1209,9 @@ png_do_read_transformations(png_structp png_ptr)
#endif
#if defined(PNG_READ_STRIP_ALPHA_SUPPORTED)
- if (png_ptr->transformations & PNG_STRIP_ALPHA)
+ if (png_ptr->flags & PNG_FLAG_STRIP_ALPHA)
png_do_strip_filler(&(png_ptr->row_info), png_ptr->row_buf + 1,
- PNG_FLAG_FILLER_AFTER);
+ PNG_FLAG_FILLER_AFTER | (png_ptr->flags & PNG_FLAG_STRIP_ALPHA));
#endif
#if defined(PNG_READ_RGB_TO_GRAY_SUPPORTED)
@@ -1380,8 +1388,8 @@ From Andreas Dilger e-mail to png-implement, 26 March 1998:
#endif
png_ptr->row_info.pixel_depth = (png_byte)(png_ptr->row_info.bit_depth *
png_ptr->row_info.channels);
- png_ptr->row_info.rowbytes = (png_ptr->row_info.width *
- png_ptr->row_info.pixel_depth+7)>>3;
+ png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
+ png_ptr->row_info.width);
}
#endif
@@ -1889,8 +1897,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
/* This changes the data from GG to GGXX */
if (flags & PNG_FLAG_FILLER_AFTER)
{
- png_bytep sp = row + (png_size_t)row_width;
- png_bytep dp = sp + (png_size_t)row_width;
+ png_bytep sp = row + (png_size_t)row_width * 2;
+ png_bytep dp = sp + (png_size_t)row_width * 2;
for (i = 1; i < row_width; i++)
{
*(--dp) = hi_filler;
@@ -1907,8 +1915,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
/* This changes the data from GG to XXGG */
else
{
- png_bytep sp = row + (png_size_t)row_width;
- png_bytep dp = sp + (png_size_t)row_width;
+ png_bytep sp = row + (png_size_t)row_width * 2;
+ png_bytep dp = sp + (png_size_t)row_width * 2;
for (i = 0; i < row_width; i++)
{
*(--dp) = *(--sp);
@@ -1965,8 +1973,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
/* This changes the data from RRGGBB to RRGGBBXX */
if (flags & PNG_FLAG_FILLER_AFTER)
{
- png_bytep sp = row + (png_size_t)row_width * 3;
- png_bytep dp = sp + (png_size_t)row_width;
+ png_bytep sp = row + (png_size_t)row_width * 6;
+ png_bytep dp = sp + (png_size_t)row_width * 2;
for (i = 1; i < row_width; i++)
{
*(--dp) = hi_filler;
@@ -1987,8 +1995,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
/* This changes the data from RRGGBB to XXRRGGBB */
else
{
- png_bytep sp = row + (png_size_t)row_width * 3;
- png_bytep dp = sp + (png_size_t)row_width;
+ png_bytep sp = row + (png_size_t)row_width * 6;
+ png_bytep dp = sp + (png_size_t)row_width * 2;
for (i = 0; i < row_width; i++)
{
*(--dp) = *(--sp);
@@ -2087,8 +2095,7 @@ png_do_gray_to_rgb(png_row_infop row_info, png_bytep row)
row_info->color_type |= PNG_COLOR_MASK_COLOR;
row_info->pixel_depth = (png_byte)(row_info->channels *
row_info->bit_depth);
- row_info->rowbytes = ((row_width *
- row_info->pixel_depth + 7) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
}
}
#endif
@@ -2097,7 +2104,7 @@ png_do_gray_to_rgb(png_row_infop row_info, png_bytep row)
/* reduce RGB files to grayscale, with or without alpha
* using the equation given in Poynton's ColorFAQ at
*
- * Copyright (c) 1998-01-04 Charles Poynton poynton@inforamp.net
+ * Copyright (c) 1998-01-04 Charles Poynton poynton at inforamp.net
*
* Y = 0.212671 * R + 0.715160 * G + 0.072169 * B
*
@@ -2271,7 +2278,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
png_byte blue = *(sp++);
if(red != green || red != blue)
rgb_error |= 1;
- *(dp++) = (png_byte)((gc*red + gc*green + bc*blue)>>8);
+ *(dp++) = (png_byte)((rc*red + gc*green + bc*blue)>>15);
*(dp++) = *(sp++); /* alpha */
}
}
@@ -2341,8 +2348,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row)
row_info->color_type &= ~PNG_COLOR_MASK_COLOR;
row_info->pixel_depth = (png_byte)(row_info->channels *
row_info->bit_depth);
- row_info->rowbytes = ((row_width *
- row_info->pixel_depth + 7) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
}
return rgb_error;
}
@@ -3260,8 +3266,7 @@ png_do_background(png_row_infop row_info, png_bytep row,
row_info->channels--;
row_info->pixel_depth = (png_byte)(row_info->channels *
row_info->bit_depth);
- row_info->rowbytes = ((row_width *
- row_info->pixel_depth + 7) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
}
}
}
@@ -3735,8 +3740,8 @@ png_do_expand(png_row_infop row_info, png_bytep row,
row_info->color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
row_info->channels = 2;
row_info->pixel_depth = (png_byte)(row_info->bit_depth << 1);
- row_info->rowbytes =
- ((row_width * row_info->pixel_depth) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
+ row_width);
}
}
else if (row_info->color_type == PNG_COLOR_TYPE_RGB && trans_value)
@@ -3790,8 +3795,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
row_info->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
row_info->channels = 4;
row_info->pixel_depth = (png_byte)(row_info->bit_depth << 2);
- row_info->rowbytes =
- ((row_width * row_info->pixel_depth) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
}
}
}
@@ -3844,8 +3848,7 @@ png_do_dither(png_row_infop row_info, png_bytep row,
row_info->color_type = PNG_COLOR_TYPE_PALETTE;
row_info->channels = 1;
row_info->pixel_depth = row_info->bit_depth;
- row_info->rowbytes =
- ((row_width * row_info->pixel_depth + 7) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
}
else if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA &&
palette_lookup != NULL && row_info->bit_depth == 8)
@@ -3874,8 +3877,7 @@ png_do_dither(png_row_infop row_info, png_bytep row,
row_info->color_type = PNG_COLOR_TYPE_PALETTE;
row_info->channels = 1;
row_info->pixel_depth = row_info->bit_depth;
- row_info->rowbytes =
- ((row_width * row_info->pixel_depth + 7) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width);
}
else if (row_info->color_type == PNG_COLOR_TYPE_PALETTE &&
dither_lookup && row_info->bit_depth == 8)
@@ -4005,7 +4007,7 @@ png_build_gamma_table(png_structp png_ptr)
g = 1.0;
png_ptr->gamma_16_table = (png_uint_16pp)png_malloc(png_ptr,
- (png_uint_32)(num * sizeof (png_uint_16p)));
+ (png_uint_32)(num * png_sizeof (png_uint_16p)));
if (png_ptr->transformations & (PNG_16_TO_8 | PNG_BACKGROUND))
{
@@ -4015,7 +4017,7 @@ png_build_gamma_table(png_structp png_ptr)
for (i = 0; i < num; i++)
{
png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr,
- (png_uint_32)(256 * sizeof (png_uint_16)));
+ (png_uint_32)(256 * png_sizeof (png_uint_16)));
}
g = 1.0 / g;
@@ -4045,7 +4047,7 @@ png_build_gamma_table(png_structp png_ptr)
for (i = 0; i < num; i++)
{
png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr,
- (png_uint_32)(256 * sizeof (png_uint_16)));
+ (png_uint_32)(256 * png_sizeof (png_uint_16)));
ig = (((png_uint_32)i * (png_uint_32)png_gamma_shift[shift]) >> 4);
for (j = 0; j < 256; j++)
@@ -4065,12 +4067,12 @@ png_build_gamma_table(png_structp png_ptr)
g = 1.0 / (png_ptr->gamma);
png_ptr->gamma_16_to_1 = (png_uint_16pp)png_malloc(png_ptr,
- (png_uint_32)(num * sizeof (png_uint_16p )));
+ (png_uint_32)(num * png_sizeof (png_uint_16p )));
for (i = 0; i < num; i++)
{
png_ptr->gamma_16_to_1[i] = (png_uint_16p)png_malloc(png_ptr,
- (png_uint_32)(256 * sizeof (png_uint_16)));
+ (png_uint_32)(256 * png_sizeof (png_uint_16)));
ig = (((png_uint_32)i *
(png_uint_32)png_gamma_shift[shift]) >> 4);
@@ -4088,12 +4090,12 @@ png_build_gamma_table(png_structp png_ptr)
g = png_ptr->gamma; /* probably doing rgb_to_gray */
png_ptr->gamma_16_from_1 = (png_uint_16pp)png_malloc(png_ptr,
- (png_uint_32)(num * sizeof (png_uint_16p)));
+ (png_uint_32)(num * png_sizeof (png_uint_16p)));
for (i = 0; i < num; i++)
{
png_ptr->gamma_16_from_1[i] = (png_uint_16p)png_malloc(png_ptr,
- (png_uint_32)(256 * sizeof (png_uint_16)));
+ (png_uint_32)(256 * png_sizeof (png_uint_16)));
ig = (((png_uint_32)i *
(png_uint_32)png_gamma_shift[shift]) >> 4);
@@ -4159,15 +4161,15 @@ png_do_read_intrapixel(png_row_infop row_info, png_bytep row)
for (i = 0, rp = row; i < row_width; i++, rp += bytes_per_pixel)
{
- png_uint_32 s0=*(rp )<<8 | *(rp+1);
- png_uint_32 s1=*(rp+2)<<8 | *(rp+3);
- png_uint_32 s2=*(rp+4)<<8 | *(rp+5);
- png_uint_32 red=(65536+s0+s1)&0xffff;
- png_uint_32 blue=(65536+s2+s1)&0xffff;
- *(rp ) = (png_byte)((red>>8)&0xff);
- *(rp+1) = (png_byte)(red&0xff);
- *(rp+4) = (png_byte)((blue>>8)&0xff);
- *(rp+5) = (png_byte)(blue&0xff);
+ png_uint_32 s0 = (*(rp ) << 8) | *(rp+1);
+ png_uint_32 s1 = (*(rp+2) << 8) | *(rp+3);
+ png_uint_32 s2 = (*(rp+4) << 8) | *(rp+5);
+ png_uint_32 red = (png_uint_32)((s0+s1+65536L) & 0xffffL);
+ png_uint_32 blue = (png_uint_32)((s2+s1+65536L) & 0xffffL);
+ *(rp ) = (png_byte)((red >> 8) & 0xff);
+ *(rp+1) = (png_byte)(red & 0xff);
+ *(rp+4) = (png_byte)((blue >> 8) & 0xff);
+ *(rp+5) = (png_byte)(blue & 0xff);
}
}
}
diff --git a/src/libs/png/pngrutil.c b/src/libs/png/pngrutil.c
index 9cbfed65f0..99e466f18e 100644
--- a/src/libs/png/pngrutil.c
+++ b/src/libs/png/pngrutil.c
@@ -1,9 +1,8 @@
-
/* pngrutil.c - utilities to read a PNG file
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
@@ -38,6 +37,14 @@ __inline double strtod(const char *nptr, char **endptr)
# endif
#endif
+png_uint_32 /* PRIVATE */
+png_get_uint_31(png_structp png_ptr, png_bytep buf)
+{
+ png_uint_32 i = png_get_uint_32(buf);
+ if (i > PNG_UINT_31_MAX)
+ png_error(png_ptr, "PNG unsigned integer out of range.\n");
+ return (i);
+}
#ifndef PNG_READ_BIG_ENDIAN_SUPPORTED
/* Grab an unsigned 32-bit integer from a buffer in big-endian format. */
png_uint_32 /* PRIVATE */
@@ -171,7 +178,7 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
png_size_t prefix_size, png_size_t *newlength)
{
static char msg[] = "Error decoding compressed text";
- png_charp text = NULL;
+ png_charp text;
png_size_t text_size;
if (comp_type == PNG_COMPRESSION_TYPE_BASE)
@@ -199,7 +206,7 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
if (text == NULL)
{
- text_size = prefix_size + sizeof(msg) + 1;
+ text_size = prefix_size + png_sizeof(msg) + 1;
text = (png_charp)png_malloc_warn(png_ptr, text_size);
if (text == NULL)
{
@@ -213,7 +220,8 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
/* Copy what we can of the error message into the text chunk */
text_size = (png_size_t)(chunklength - (text - chunkdata) - 1);
- text_size = sizeof(msg) > text_size ? text_size : sizeof(msg);
+ text_size = png_sizeof(msg) > text_size ? text_size :
+ png_sizeof(msg);
png_memcpy(text + prefix_size, msg, text_size + 1);
break;
}
@@ -346,15 +354,14 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
png_crc_read(png_ptr, buf, 13);
png_crc_finish(png_ptr, 0);
- width = png_get_uint_32(buf);
- height = png_get_uint_32(buf + 4);
+ width = png_get_uint_31(png_ptr, buf);
+ height = png_get_uint_31(png_ptr, buf + 4);
bit_depth = buf[8];
color_type = buf[9];
compression_type = buf[10];
filter_type = buf[11];
interlace_type = buf[12];
-
/* set internal variables */
png_ptr->width = width;
png_ptr->height = height;
@@ -364,6 +371,7 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
#if defined(PNG_MNG_FEATURES_SUPPORTED)
png_ptr->filter_type = (png_byte)filter_type;
#endif
+ png_ptr->compression_type = (png_byte)compression_type;
/* find number of channels */
switch (png_ptr->color_type)
@@ -386,8 +394,7 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* set up other useful info */
png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *
png_ptr->channels);
- png_ptr->rowbytes = ((png_ptr->width *
- (png_uint_32)png_ptr->pixel_depth + 7) >> 3);
+ png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->width);
png_debug1(3,"bit_depth = %d\n", png_ptr->bit_depth);
png_debug1(3,"channels = %d\n", png_ptr->channels);
png_debug1(3,"rowbytes = %lu\n", png_ptr->rowbytes);
@@ -542,8 +549,6 @@ png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
if (!(png_ptr->mode & PNG_HAVE_IHDR) || !(png_ptr->mode & PNG_HAVE_IDAT))
{
png_error(png_ptr, "No image in file");
-
- info_ptr = info_ptr; /* quiet compiler warnings about unused info_ptr */
}
png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);
@@ -553,6 +558,9 @@ png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
png_warning(png_ptr, "Incorrect IEND chunk length");
}
png_crc_finish(png_ptr, length);
+
+ if (&info_ptr == NULL) /* quiet compiler warnings about unused info_ptr */
+ return;
}
#if defined(PNG_READ_gAMA_SUPPORTED)
@@ -579,7 +587,7 @@ png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* Should be an error, but we can cope with it */
png_warning(png_ptr, "Out of place gAMA chunk");
- else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)
+ if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)
#if defined(PNG_READ_sRGB_SUPPORTED)
&& !(info_ptr->valid & PNG_INFO_sRGB)
#endif
@@ -612,7 +620,7 @@ png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
#if defined(PNG_READ_sRGB_SUPPORTED)
if (info_ptr->valid & PNG_INFO_sRGB)
- if(igamma < 45000L || igamma > 46000L)
+ if (PNG_OUT_OF_RANGE(igamma, 45500L, 500))
{
png_warning(png_ptr,
"Ignoring incorrect gAMA value when sRGB is also present");
@@ -660,7 +668,7 @@ png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* Should be an error, but we can cope with it */
png_warning(png_ptr, "Out of place sBIT chunk");
}
- else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT))
+ if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT))
{
png_warning(png_ptr, "Duplicate sBIT chunk");
png_crc_finish(png_ptr, length);
@@ -672,7 +680,7 @@ png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
else
truelen = (png_size_t)png_ptr->channels;
- if (length != truelen)
+ if (length != truelen || length > 4)
{
png_warning(png_ptr, "Incorrect sBIT chunk length");
png_crc_finish(png_ptr, length);
@@ -729,7 +737,7 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* Should be an error, but we can cope with it */
png_warning(png_ptr, "Missing PLTE before cHRM");
- else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM)
+ if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM)
#if defined(PNG_READ_sRGB_SUPPORTED)
&& !(info_ptr->valid & PNG_INFO_sRGB)
#endif
@@ -825,14 +833,14 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
#if defined(PNG_READ_sRGB_SUPPORTED)
if (info_ptr->valid & PNG_INFO_sRGB)
{
- if (abs(int_x_white - 31270L) > 1000 ||
- abs(int_y_white - 32900L) > 1000 ||
- abs(int_x_red - 64000L) > 1000 ||
- abs(int_y_red - 33000L) > 1000 ||
- abs(int_x_green - 30000L) > 1000 ||
- abs(int_y_green - 60000L) > 1000 ||
- abs(int_x_blue - 15000L) > 1000 ||
- abs(int_y_blue - 6000L) > 1000)
+ if (PNG_OUT_OF_RANGE(int_x_white, 31270, 1000) ||
+ PNG_OUT_OF_RANGE(int_y_white, 32900, 1000) ||
+ PNG_OUT_OF_RANGE(int_x_red, 64000L, 1000) ||
+ PNG_OUT_OF_RANGE(int_y_red, 33000, 1000) ||
+ PNG_OUT_OF_RANGE(int_x_green, 30000, 1000) ||
+ PNG_OUT_OF_RANGE(int_y_green, 60000L, 1000) ||
+ PNG_OUT_OF_RANGE(int_x_blue, 15000, 1000) ||
+ PNG_OUT_OF_RANGE(int_y_blue, 6000, 1000))
{
png_warning(png_ptr,
@@ -891,7 +899,7 @@ png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* Should be an error, but we can cope with it */
png_warning(png_ptr, "Out of place sRGB chunk");
- else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))
+ if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))
{
png_warning(png_ptr, "Duplicate sRGB chunk");
png_crc_finish(png_ptr, length);
@@ -920,15 +928,15 @@ png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
#if defined(PNG_READ_gAMA_SUPPORTED) && defined(PNG_READ_GAMMA_SUPPORTED)
if ((info_ptr->valid & PNG_INFO_gAMA))
{
- int igamma;
+ png_fixed_point igamma;
#ifdef PNG_FIXED_POINT_SUPPORTED
- igamma=(int)info_ptr->int_gamma;
+ igamma=info_ptr->int_gamma;
#else
# ifdef PNG_FLOATING_POINT_SUPPORTED
- igamma=(int)(info_ptr->gamma * 100000.);
+ igamma=(png_fixed_point)(info_ptr->gamma * 100000.);
# endif
#endif
- if(igamma < 45000L || igamma > 46000L)
+ if (PNG_OUT_OF_RANGE(igamma, 45500L, 500))
{
png_warning(png_ptr,
"Ignoring incorrect gAMA value when sRGB is also present");
@@ -948,14 +956,14 @@ png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
#ifdef PNG_READ_cHRM_SUPPORTED
#ifdef PNG_FIXED_POINT_SUPPORTED
if (info_ptr->valid & PNG_INFO_cHRM)
- if (abs(info_ptr->int_x_white - 31270L) > 1000 ||
- abs(info_ptr->int_y_white - 32900L) > 1000 ||
- abs(info_ptr->int_x_red - 64000L) > 1000 ||
- abs(info_ptr->int_y_red - 33000L) > 1000 ||
- abs(info_ptr->int_x_green - 30000L) > 1000 ||
- abs(info_ptr->int_y_green - 60000L) > 1000 ||
- abs(info_ptr->int_x_blue - 15000L) > 1000 ||
- abs(info_ptr->int_y_blue - 6000L) > 1000)
+ if (PNG_OUT_OF_RANGE(info_ptr->int_x_white, 31270, 1000) ||
+ PNG_OUT_OF_RANGE(info_ptr->int_y_white, 32900, 1000) ||
+ PNG_OUT_OF_RANGE(info_ptr->int_x_red, 64000L, 1000) ||
+ PNG_OUT_OF_RANGE(info_ptr->int_y_red, 33000, 1000) ||
+ PNG_OUT_OF_RANGE(info_ptr->int_x_green, 30000, 1000) ||
+ PNG_OUT_OF_RANGE(info_ptr->int_y_green, 60000L, 1000) ||
+ PNG_OUT_OF_RANGE(info_ptr->int_x_blue, 15000, 1000) ||
+ PNG_OUT_OF_RANGE(info_ptr->int_y_blue, 6000, 1000))
{
png_warning(png_ptr,
"Ignoring incorrect cHRM value when sRGB is also present");
@@ -977,8 +985,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
png_bytep pC;
png_charp profile;
png_uint_32 skip = 0;
- png_uint_32 profile_size = 0;
- png_uint_32 profile_length = 0;
+ png_uint_32 profile_size, profile_length;
png_size_t slength, prefix_length, data_length;
png_debug(1, "in png_handle_iCCP\n");
@@ -995,7 +1002,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
/* Should be an error, but we can cope with it */
png_warning(png_ptr, "Out of place iCCP chunk");
- else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP))
+ if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP))
{
png_warning(png_ptr, "Duplicate iCCP chunk");
png_crc_finish(png_ptr, length);
@@ -1153,9 +1160,20 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
return;
}
- new_palette.nentries = data_length / entry_size;
- new_palette.entries = (png_sPLT_entryp)png_malloc(
- png_ptr, new_palette.nentries * sizeof(png_sPLT_entry));
+ new_palette.nentries = (png_uint_32) (data_length / entry_size);
+ if ((png_uint_32) new_palette.nentries > (png_uint_32) (PNG_SIZE_MAX /
+ png_sizeof(png_sPLT_entry)))
+ {
+ png_warning(png_ptr, "sPLT chunk too long");
+ return;
+ }
+ new_palette.entries = (png_sPLT_entryp)png_malloc_warn(
+ png_ptr, new_palette.nentries * png_sizeof(png_sPLT_entry));
+ if (new_palette.entries == NULL)
+ {
+ png_warning(png_ptr, "sPLT chunk requires too much memory");
+ return;
+ }
#ifndef PNG_NO_POINTER_INDEXING
for (i = 0; i < new_palette.nentries; i++)
@@ -1234,49 +1252,9 @@ png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
return;
}
- if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
+ if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
{
- if (!(png_ptr->mode & PNG_HAVE_PLTE))
- {
- /* Should be an error, but we can cope with it */
- png_warning(png_ptr, "Missing PLTE before tRNS");
- }
- else if (length > (png_uint_32)png_ptr->num_palette)
- {
- png_warning(png_ptr, "Incorrect tRNS chunk length");
- png_crc_finish(png_ptr, length);
- return;
- }
- if (length == 0)
- {
- png_warning(png_ptr, "Zero length tRNS chunk");
- png_crc_finish(png_ptr, length);
- return;
- }
-
- png_crc_read(png_ptr, readbuf, (png_size_t)length);
- png_ptr->num_trans = (png_uint_16)length;
- }
- else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
- {
- png_byte buf[6];
-
- if (length != 6)
- {
- png_warning(png_ptr, "Incorrect tRNS chunk length");
- png_crc_finish(png_ptr, length);
- return;
- }
-
- png_crc_read(png_ptr, buf, (png_size_t)length);
- png_ptr->num_trans = 1;
- png_ptr->trans_values.red = png_get_uint_16(buf);
- png_ptr->trans_values.green = png_get_uint_16(buf + 2);
- png_ptr->trans_values.blue = png_get_uint_16(buf + 4);
- }
- else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
- {
- png_byte buf[6];
+ png_byte buf[2];
if (length != 2)
{
@@ -1289,6 +1267,45 @@ png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
png_ptr->num_trans = 1;
png_ptr->trans_values.gray = png_get_uint_16(buf);
}
+ else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
+ {
+ png_byte buf[6];
+
+ if (length != 6)
+ {
+ png_warning(png_ptr, "Incorrect tRNS chunk length");
+ png_crc_finish(png_ptr, length);
+ return;
+ }
+ png_crc_read(png_ptr, buf, (png_size_t)length);
+ png_ptr->num_trans = 1;
+ png_ptr->trans_values.red = png_get_uint_16(buf);
+ png_ptr->trans_values.green = png_get_uint_16(buf + 2);
+ png_ptr->trans_values.blue = png_get_uint_16(buf + 4);
+ }
+ else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
+ {
+ if (!(png_ptr->mode & PNG_HAVE_PLTE))
+ {
+ /* Should be an error, but we can cope with it. */
+ png_warning(png_ptr, "Missing PLTE before tRNS");
+ }
+ if (length > (png_uint_32)png_ptr->num_palette ||
+ length > PNG_MAX_PALETTE_LENGTH)
+ {
+ png_warning(png_ptr, "Incorrect tRNS chunk length");
+ png_crc_finish(png_ptr, length);
+ return;
+ }
+ if (length == 0)
+ {
+ png_warning(png_ptr, "Zero length tRNS chunk");
+ png_crc_finish(png_ptr, length);
+ return;
+ }
+ png_crc_read(png_ptr, readbuf, (png_size_t)length);
+ png_ptr->num_trans = (png_uint_16)length;
+ }
else
{
png_warning(png_ptr, "tRNS chunk not allowed with alpha channel");
@@ -1397,7 +1414,7 @@ png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
void /* PRIVATE */
png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
{
- int num, i;
+ unsigned int num, i;
png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
png_debug(1, "in png_handle_hIST\n");
@@ -1423,8 +1440,9 @@ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
return;
}
- num = (int)length / 2 ;
- if (num != png_ptr->num_palette)
+ num = length / 2 ;
+ if (num != (unsigned int) png_ptr->num_palette || num >
+ (unsigned int) PNG_MAX_PALETTE_LENGTH)
{
png_warning(png_ptr, "Incorrect hIST chunk length");
png_crc_finish(png_ptr, length);
@@ -1625,7 +1643,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
png_debug(3, "Allocating pCAL parameters array\n");
params = (png_charpp)png_malloc_warn(png_ptr, (png_uint_32)(nparams
- *sizeof(png_charp))) ;
+ *png_sizeof(png_charp))) ;
if (params == NULL)
{
png_free(png_ptr, purpose);
@@ -1883,7 +1901,8 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
if (text != key + slength)
text++;
- text_ptr = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)sizeof(png_text));
+ text_ptr = (png_textp)png_malloc_warn(png_ptr,
+ (png_uint_32)png_sizeof(png_text));
if (text_ptr == NULL)
{
png_warning(png_ptr, "Not enough memory to process text chunk.");
@@ -1979,7 +1998,8 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
chunkdata = (png_charp)png_decompress_chunk(png_ptr, comp_type, chunkdata,
(png_size_t)length, prefix_len, &data_len);
- text_ptr = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)sizeof(png_text));
+ text_ptr = (png_textp)png_malloc_warn(png_ptr,
+ (png_uint_32)png_sizeof(png_text));
if (text_ptr == NULL)
{
png_warning(png_ptr,"Not enough memory to process zTXt chunk.");
@@ -2088,7 +2108,8 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
(size_t)length, prefix_len, &data_len);
else
data_len=png_strlen(chunkdata + prefix_len);
- text_ptr = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)sizeof(png_text));
+ text_ptr = (png_textp)png_malloc_warn(png_ptr,
+ (png_uint_32)png_sizeof(png_text));
if (text_ptr == NULL)
{
png_warning(png_ptr,"Not enough memory to process iTXt chunk.");
@@ -2139,7 +2160,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
{
#if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
- HANDLE_CHUNK_ALWAYS
+ PNG_HANDLE_CHUNK_ALWAYS
#if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
&& png_ptr->read_user_chunk_fn == NULL
#endif
@@ -2173,7 +2194,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
{
if (!(png_ptr->chunk_name[0] & 0x20))
if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
- HANDLE_CHUNK_ALWAYS)
+ PNG_HANDLE_CHUNK_ALWAYS)
{
png_free(png_ptr, chunk.data);
png_chunk_error(png_ptr, "unknown critical chunk");
@@ -2193,7 +2214,8 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
png_crc_finish(png_ptr, skip);
#if !defined(PNG_READ_USER_CHUNKS_SUPPORTED)
- info_ptr = info_ptr; /* quiet compiler warnings about unused info_ptr */
+ if (&info_ptr == NULL) /* quiet compiler warnings about unused info_ptr */
+ return;
#endif
}
@@ -2203,7 +2225,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
functions to handle unknown critical chunks after we check that
the chunk name itself is valid. */
-#define isnonalpha(c) ((c) < 41 || (c) > 122 || ((c) > 90 && (c) < 97))
+#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))
void /* PRIVATE */
png_check_chunk_name(png_structp png_ptr, png_bytep chunk_name)
@@ -2234,8 +2256,7 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask)
if (mask == 0xff)
{
png_memcpy(row, png_ptr->row_buf + 1,
- (png_size_t)((png_ptr->width *
- png_ptr->row_info.pixel_depth + 7) >> 3));
+ PNG_ROWBYTES(png_ptr->row_info.pixel_depth, png_ptr->width));
}
else
{
@@ -2650,11 +2671,11 @@ png_do_read_interlace(png_structp png_ptr)
}
}
row_info->width = final_width;
- row_info->rowbytes = ((final_width *
- (png_uint_32)row_info->pixel_depth + 7) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,final_width);
}
#if !defined(PNG_READ_PACKSWAP_SUPPORTED)
- transformations = transformations; /* silence compiler warning */
+ if (&transformations == NULL) /* silence compiler warning */
+ return;
#endif
}
#endif /* !PNG_HAVE_ASSEMBLER_READ_INTERLACE */
@@ -2822,8 +2843,9 @@ png_read_finish_row(png_structp png_ptr)
png_pass_inc[png_ptr->pass] - 1 -
png_pass_start[png_ptr->pass]) /
png_pass_inc[png_ptr->pass];
- png_ptr->irowbytes = ((png_ptr->iwidth *
- (png_uint_32)png_ptr->pixel_depth + 7) >> 3) +1;
+
+ png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,
+ png_ptr->iwidth) + 1;
if (!(png_ptr->transformations & PNG_INTERLACE))
{
@@ -2863,8 +2885,7 @@ png_read_finish_row(png_structp png_ptr)
png_crc_finish(png_ptr, 0);
png_read_data(png_ptr, chunk_length, 4);
- png_ptr->idat_size = png_get_uint_32(chunk_length);
-
+ png_ptr->idat_size = png_get_uint_31(png_ptr, chunk_length);
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))
@@ -2950,8 +2971,8 @@ png_read_start_row(png_structp png_ptr)
png_pass_start[png_ptr->pass]) /
png_pass_inc[png_ptr->pass];
- row_bytes = ((png_ptr->iwidth *
- (png_uint_32)png_ptr->pixel_depth + 7) >> 3) +1;
+ row_bytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->iwidth) + 1;
+
png_ptr->irowbytes = (png_size_t)row_bytes;
if((png_uint_32)png_ptr->irowbytes != row_bytes)
png_error(png_ptr, "Rowbytes overflow in png_read_start_row");
@@ -3069,7 +3090,7 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));
/* calculate the maximum bytes needed, adding a byte and a pixel
for safety's sake */
- row_bytes = ((row_bytes * (png_uint_32)max_pixel_depth + 7) >> 3) +
+ row_bytes = PNG_ROWBYTES(max_pixel_depth,row_bytes) +
1 + ((max_pixel_depth + 7) >> 3);
#ifdef PNG_MAX_MALLOC_64K
if (row_bytes > (png_uint_32)65536L)
@@ -3085,6 +3106,8 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
if ((png_uint_32)png_ptr->rowbytes + 1 > (png_uint_32)65536L)
png_error(png_ptr, "This image requires a row greater than 64KB");
#endif
+ if ((png_uint_32)png_ptr->rowbytes > PNG_SIZE_MAX - 1)
+ png_error(png_ptr, "Row has too many bytes to allocate in memory.");
png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)(
png_ptr->rowbytes + 1));
diff --git a/src/libs/png/pngset.c b/src/libs/png/pngset.c
index 8e4e6197c9..5922cad0c5 100644
--- a/src/libs/png/pngset.c
+++ b/src/libs/png/pngset.c
@@ -1,9 +1,9 @@
/* pngset.c - storage of image information into info struct
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
@@ -24,7 +24,7 @@ png_set_bKGD(png_structp png_ptr, png_infop info_ptr, png_color_16p background)
if (png_ptr == NULL || info_ptr == NULL)
return;
- png_memcpy(&(info_ptr->background), background, sizeof(png_color_16));
+ png_memcpy(&(info_ptr->background), background, png_sizeof(png_color_16));
info_ptr->valid |= PNG_INFO_bKGD;
}
#endif
@@ -100,10 +100,14 @@ png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr,
"Ignoring attempt to set negative chromaticity value");
return;
}
- if (white_x > (double) PNG_MAX_UINT || white_y > (double) PNG_MAX_UINT ||
- red_x > (double) PNG_MAX_UINT || red_y > (double) PNG_MAX_UINT ||
- green_x > (double) PNG_MAX_UINT || green_y > (double) PNG_MAX_UINT ||
- blue_x > (double) PNG_MAX_UINT || blue_y > (double) PNG_MAX_UINT)
+ if (white_x > (double) PNG_UINT_31_MAX ||
+ white_y > (double) PNG_UINT_31_MAX ||
+ red_x > (double) PNG_UINT_31_MAX ||
+ red_y > (double) PNG_UINT_31_MAX ||
+ green_x > (double) PNG_UINT_31_MAX ||
+ green_y > (double) PNG_UINT_31_MAX ||
+ blue_x > (double) PNG_UINT_31_MAX ||
+ blue_y > (double) PNG_UINT_31_MAX)
{
png_warning(png_ptr,
"Ignoring attempt to set chromaticity value exceeding 21474.83");
@@ -169,10 +173,10 @@ png_set_gAMA_fixed(png_structp png_ptr, png_infop info_ptr, png_fixed_point
if (png_ptr == NULL || info_ptr == NULL)
return;
- if (int_gamma > (png_fixed_point) PNG_MAX_UINT)
+ if (int_gamma > (png_fixed_point) PNG_UINT_31_MAX)
{
png_warning(png_ptr, "Limiting gamma to 21474.83");
- gamma=PNG_MAX_UINT;
+ gamma=PNG_UINT_31_MAX;
}
else
{
@@ -217,7 +221,7 @@ png_set_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_16p hist)
#endif
/* Changed from info->num_palette to 256 in version 1.2.1 */
png_ptr->hist = (png_uint_16p)png_malloc_warn(png_ptr,
- (png_uint_32)(256 * sizeof (png_uint_16)));
+ (png_uint_32)(256 * png_sizeof (png_uint_16)));
if (png_ptr->hist == NULL)
{
png_warning(png_ptr, "Insufficient memory for hIST chunk data.");
@@ -243,7 +247,6 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
int color_type, int interlace_type, int compression_type,
int filter_type)
{
- int rowbytes_per_pixel;
png_debug1(1, "in %s storage function\n", "IHDR");
if (png_ptr == NULL || info_ptr == NULL)
return;
@@ -251,8 +254,22 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
/* check for width and height valid values */
if (width == 0 || height == 0)
png_error(png_ptr, "Image width or height is zero in IHDR");
- if (width > PNG_MAX_UINT || height > PNG_MAX_UINT)
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+ if (width > png_ptr->user_width_max || height > png_ptr->user_height_max)
+ png_error(png_ptr, "image size exceeds user limits in IHDR");
+#else
+ if (width > PNG_USER_WIDTH_MAX || height > PNG_USER_HEIGHT_MAX)
+ png_error(png_ptr, "image size exceeds user limits in IHDR");
+#endif
+ if (width > PNG_UINT_31_MAX || height > PNG_UINT_31_MAX)
png_error(png_ptr, "Invalid image size in IHDR");
+ if ( width > (PNG_UINT_32_MAX
+ >> 3) /* 8-byte RGBA pixels */
+ - 64 /* bigrowbuf hack */
+ - 1 /* filter byte */
+ - 7*8 /* rounding of width to multiple of 8 pixels */
+ - 8) /* extra max_pixel_depth pad */
+ png_warning(png_ptr, "Width is too large for libpng to process pixels");
/* check other values */
if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 &&
@@ -320,16 +337,16 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
info_ptr->channels++;
info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
- /* check for overflow */
- rowbytes_per_pixel = (info_ptr->pixel_depth + 7) >> 3;
- if ( width > PNG_MAX_UINT/rowbytes_per_pixel - 64)
- {
- png_warning(png_ptr,
- "Width too large to process image data; rowbytes will overflow.");
+ /* check for potential overflow */
+ if ( width > (PNG_UINT_32_MAX
+ >> 3) /* 8-byte RGBA pixels */
+ - 64 /* bigrowbuf hack */
+ - 1 /* filter byte */
+ - 7*8 /* rounding of width to multiple of 8 pixels */
+ - 8) /* extra max_pixel_depth pad */
info_ptr->rowbytes = (png_size_t)0;
- }
else
- info_ptr->rowbytes = (info_ptr->width * info_ptr->pixel_depth + 7) >> 3;
+ info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth,width);
}
#if defined(PNG_oFFs_SUPPORTED)
@@ -388,7 +405,7 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
png_memcpy(info_ptr->pcal_units, units, (png_size_t)length);
info_ptr->pcal_params = (png_charpp)png_malloc_warn(png_ptr,
- (png_uint_32)((nparams + 1) * sizeof(png_charp)));
+ (png_uint_32)((nparams + 1) * png_sizeof(png_charp)));
if (info_ptr->pcal_params == NULL)
{
png_warning(png_ptr, "Insufficient memory for pCAL params.");
@@ -449,12 +466,21 @@ png_set_sCAL_s(png_structp png_ptr, png_infop info_ptr,
length = png_strlen(swidth) + 1;
png_debug1(3, "allocating unit for info (%d bytes)\n", length);
- info_ptr->scal_s_width = (png_charp)png_malloc(png_ptr, length);
+ info_ptr->scal_s_width = (png_charp)png_malloc_warn(png_ptr, length);
+ if (info_ptr->scal_s_width == NULL)
+ {
+ png_warning(png_ptr, "Memory allocation failed while processing sCAL.");
+ }
png_memcpy(info_ptr->scal_s_width, swidth, (png_size_t)length);
length = png_strlen(sheight) + 1;
png_debug1(3, "allocating unit for info (%d bytes)\n", length);
- info_ptr->scal_s_height = (png_charp)png_malloc(png_ptr, length);
+ info_ptr->scal_s_height = (png_charp)png_malloc_warn(png_ptr, length);
+ if (info_ptr->scal_s_height == NULL)
+ {
+ png_free (png_ptr, info_ptr->scal_s_width);
+ png_warning(png_ptr, "Memory allocation failed while processing sCAL.");
+ }
png_memcpy(info_ptr->scal_s_height, sheight, (png_size_t)length);
info_ptr->valid |= PNG_INFO_sCAL;
@@ -499,13 +525,13 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
#ifdef PNG_FREE_ME_SUPPORTED
png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
#endif
+
/* Changed in libpng-1.2.1 to allocate 256 instead of num_palette entries,
in case of an invalid PNG file that has too-large sample values. */
- png_ptr->palette = (png_colorp)png_zalloc(png_ptr, (uInt)256,
- sizeof (png_color));
- if (png_ptr->palette == NULL)
- png_error(png_ptr, "Unable to malloc palette");
- png_memcpy(png_ptr->palette, palette, num_palette * sizeof (png_color));
+ png_ptr->palette = (png_colorp)png_malloc(png_ptr,
+ 256 * png_sizeof(png_color));
+ png_memset(png_ptr->palette, 0, 256 * png_sizeof(png_color));
+ png_memcpy(png_ptr->palette, palette, num_palette * png_sizeof (png_color));
info_ptr->palette = png_ptr->palette;
info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;
@@ -527,7 +553,7 @@ png_set_sBIT(png_structp png_ptr, png_infop info_ptr,
if (png_ptr == NULL || info_ptr == NULL)
return;
- png_memcpy(&(info_ptr->sig_bit), sig_bit, sizeof (png_color_8));
+ png_memcpy(&(info_ptr->sig_bit), sig_bit, png_sizeof (png_color_8));
info_ptr->valid |= PNG_INFO_sBIT;
}
#endif
@@ -628,9 +654,20 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL)
return;
- new_iccp_name = (png_charp)png_malloc(png_ptr, png_strlen(name)+1);
+ new_iccp_name = (png_charp)png_malloc_warn(png_ptr, png_strlen(name)+1);
+ if (new_iccp_name == NULL)
+ {
+ png_warning(png_ptr, "Insufficient memory to process iCCP chunk.");
+ return;
+ }
png_strcpy(new_iccp_name, name);
- new_iccp_profile = (png_charp)png_malloc(png_ptr, proflen);
+ new_iccp_profile = (png_charp)png_malloc_warn(png_ptr, proflen);
+ if (new_iccp_profile == NULL)
+ {
+ png_free (png_ptr, new_iccp_name);
+ png_warning(png_ptr, "Insufficient memory to process iCCP profile.");
+ return;
+ }
png_memcpy(new_iccp_profile, profile, (png_size_t)proflen);
png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, 0);
@@ -685,14 +722,14 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
info_ptr->max_text = info_ptr->num_text + num_text + 8;
old_text = info_ptr->text;
info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
- (png_uint_32)(info_ptr->max_text * sizeof (png_text)));
+ (png_uint_32)(info_ptr->max_text * png_sizeof (png_text)));
if (info_ptr->text == NULL)
{
png_free(png_ptr, old_text);
return(1);
}
png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max *
- sizeof(png_text)));
+ png_sizeof(png_text)));
png_free(png_ptr, old_text);
}
else
@@ -700,7 +737,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
info_ptr->max_text = num_text + 8;
info_ptr->num_text = 0;
info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
- (png_uint_32)(info_ptr->max_text * sizeof (png_text)));
+ (png_uint_32)(info_ptr->max_text * png_sizeof (png_text)));
if (info_ptr->text == NULL)
return(1);
#ifdef PNG_FREE_ME_SUPPORTED
@@ -829,7 +866,7 @@ png_set_tIME(png_structp png_ptr, png_infop info_ptr, png_timep mod_time)
(png_ptr->mode & PNG_WROTE_tIME))
return;
- png_memcpy(&(info_ptr->mod_time), mod_time, sizeof (png_time));
+ png_memcpy(&(info_ptr->mod_time), mod_time, png_sizeof (png_time));
info_ptr->valid |= PNG_INFO_tIME;
}
#endif
@@ -867,7 +904,7 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
if (trans_values != NULL)
{
png_memcpy(&(info_ptr->trans_values), trans_values,
- sizeof(png_color_16));
+ png_sizeof(png_color_16));
if (num_trans == 0)
num_trans = 1;
}
@@ -885,7 +922,7 @@ png_set_sPLT(png_structp png_ptr,
int i;
np = (png_sPLT_tp)png_malloc_warn(png_ptr,
- (info_ptr->splt_palettes_num + nentries) * sizeof(png_sPLT_t));
+ (info_ptr->splt_palettes_num + nentries) * png_sizeof(png_sPLT_t));
if (np == NULL)
{
png_warning(png_ptr, "No memory for sPLT palettes.");
@@ -893,7 +930,7 @@ png_set_sPLT(png_structp png_ptr,
}
png_memcpy(np, info_ptr->splt_palettes,
- info_ptr->splt_palettes_num * sizeof(png_sPLT_t));
+ info_ptr->splt_palettes_num * png_sizeof(png_sPLT_t));
png_free(png_ptr, info_ptr->splt_palettes);
info_ptr->splt_palettes=NULL;
@@ -904,11 +941,13 @@ png_set_sPLT(png_structp png_ptr,
to->name = (png_charp)png_malloc(png_ptr,
png_strlen(from->name) + 1);
+ /* TODO: use png_malloc_warn */
png_strcpy(to->name, from->name);
to->entries = (png_sPLT_entryp)png_malloc(png_ptr,
- from->nentries * sizeof(png_sPLT_t));
+ from->nentries * png_sizeof(png_sPLT_t));
+ /* TODO: use png_malloc_warn */
png_memcpy(to->entries, from->entries,
- from->nentries * sizeof(png_sPLT_t));
+ from->nentries * png_sizeof(png_sPLT_t));
to->nentries = from->nentries;
to->depth = from->depth;
}
@@ -935,7 +974,7 @@ png_set_unknown_chunks(png_structp png_ptr,
np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
(info_ptr->unknown_chunks_num + num_unknowns) *
- sizeof(png_unknown_chunk));
+ png_sizeof(png_unknown_chunk));
if (np == NULL)
{
png_warning(png_ptr, "Out of memory while processing unknown chunk.");
@@ -943,7 +982,7 @@ png_set_unknown_chunks(png_structp png_ptr,
}
png_memcpy(np, info_ptr->unknown_chunks,
- info_ptr->unknown_chunks_num * sizeof(png_unknown_chunk));
+ info_ptr->unknown_chunks_num * png_sizeof(png_unknown_chunk));
png_free(png_ptr, info_ptr->unknown_chunks);
info_ptr->unknown_chunks=NULL;
@@ -952,17 +991,19 @@ png_set_unknown_chunks(png_structp png_ptr,
png_unknown_chunkp to = np + info_ptr->unknown_chunks_num + i;
png_unknown_chunkp from = unknowns + i;
- png_strcpy((png_charp)to->name, (png_charp)from->name);
- to->data = (png_bytep)png_malloc(png_ptr, from->size);
+ png_strncpy((png_charp)to->name, (png_charp)from->name, 5);
+ to->data = (png_bytep)png_malloc_warn(png_ptr, from->size);
if (to->data == NULL)
- png_warning(png_ptr, "Out of memory while processing unknown chunk.");
+ {
+ png_warning(png_ptr, "Out of memory processing unknown chunk.");
+ }
else
{
- png_memcpy(to->data, from->data, from->size);
- to->size = from->size;
+ png_memcpy(to->data, from->data, from->size);
+ to->size = from->size;
- /* note our location in the read or write sequence */
- to->location = (png_byte)(png_ptr->mode & 0xff);
+ /* note our location in the read or write sequence */
+ to->location = (png_byte)(png_ptr->mode & 0xff);
}
}
@@ -1020,12 +1061,12 @@ png_set_keep_unknown_chunks(png_structp png_ptr, int keep, png_bytep
int i, old_num_chunks;
if (num_chunks == 0)
{
- if(keep == HANDLE_CHUNK_ALWAYS || keep == HANDLE_CHUNK_IF_SAFE)
+ if(keep == PNG_HANDLE_CHUNK_ALWAYS || keep == PNG_HANDLE_CHUNK_IF_SAFE)
png_ptr->flags |= PNG_FLAG_KEEP_UNKNOWN_CHUNKS;
else
png_ptr->flags &= ~PNG_FLAG_KEEP_UNKNOWN_CHUNKS;
- if(keep == HANDLE_CHUNK_ALWAYS)
+ if(keep == PNG_HANDLE_CHUNK_ALWAYS)
png_ptr->flags |= PNG_FLAG_KEEP_UNSAFE_CHUNKS;
else
png_ptr->flags &= ~PNG_FLAG_KEEP_UNSAFE_CHUNKS;
@@ -1083,6 +1124,7 @@ png_set_rows(png_structp png_ptr, png_infop info_ptr, png_bytepp row_pointers)
}
#endif
+#ifdef PNG_WRITE_SUPPORTED
void PNGAPI
png_set_compression_buffer_size(png_structp png_ptr, png_uint_32 size)
{
@@ -1093,6 +1135,7 @@ png_set_compression_buffer_size(png_structp png_ptr, png_uint_32 size)
png_ptr->zstream.next_out = png_ptr->zbuf;
png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
}
+#endif
void PNGAPI
png_set_invalid(png_structp png_ptr, png_infop info_ptr, int mask)
@@ -1157,4 +1200,20 @@ png_set_mmx_thresholds (png_structp png_ptr,
png_ptr->mmx_rowbytes_threshold = mmx_rowbytes_threshold;
}
#endif /* ?PNG_ASSEMBLER_CODE_SUPPORTED */
+
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+/* this function was added to libpng 1.2.6 */
+void PNGAPI
+png_set_user_limits (png_structp png_ptr, png_uint_32 user_width_max,
+ png_uint_32 user_height_max)
+{
+ /* Images with dimensions larger than these limits will be
+ * rejected by png_set_IHDR(). To accept any PNG datastream
+ * regardless of dimensions, set both limits to 0x7ffffffL.
+ */
+ png_ptr->user_width_max = user_width_max;
+ png_ptr->user_height_max = user_height_max;
+}
+#endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */
+
#endif /* ?PNG_1_0_X */
diff --git a/src/libs/png/pngtrans.c b/src/libs/png/pngtrans.c
index f08fb4ecfe..9003a2109b 100644
--- a/src/libs/png/pngtrans.c
+++ b/src/libs/png/pngtrans.c
@@ -1,9 +1,9 @@
/* pngtrans.c - transforms the data in a row (used by both readers and writers)
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*/
@@ -100,7 +100,7 @@ png_set_filler(png_structp png_ptr, png_uint_32 filler, int filler_loc)
else
png_ptr->flags &= ~PNG_FLAG_FILLER_AFTER;
- /* This should probably go in the "do_filler" routine.
+ /* This should probably go in the "do_read_filler" routine.
* I attempted to do that in libpng-1.0.1a but that caused problems
* so I restored it in libpng-1.0.2a
*/
@@ -118,6 +118,18 @@ png_set_filler(png_structp png_ptr, png_uint_32 filler, int filler_loc)
png_ptr->usr_channels = 2;
}
}
+
+#if !defined(PNG_1_0_X)
+/* Added to libpng-1.2.7 */
+void PNGAPI
+png_set_add_alpha(png_structp png_ptr, png_uint_32 filler, int filler_loc)
+{
+ png_debug(1, "in png_set_add_alpha\n");
+ png_set_filler(png_ptr, filler, filler_loc);
+ png_ptr->transformations |= PNG_ADD_ALPHA;
+}
+#endif
+
#endif
#if defined(PNG_READ_SWAP_ALPHA_SUPPORTED) || \
@@ -375,16 +387,15 @@ png_do_strip_filler(png_row_infop row_info, png_bytep row, png_uint_32 flags)
if (row != NULL && row_info != NULL)
#endif
{
-/*
- if (row_info->color_type == PNG_COLOR_TYPE_RGB ||
- row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
-*/
png_bytep sp=row;
png_bytep dp=row;
png_uint_32 row_width=row_info->width;
png_uint_32 i;
- if (row_info->channels == 4)
+ if ((row_info->color_type == PNG_COLOR_TYPE_RGB ||
+ (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA &&
+ (flags & PNG_FLAG_STRIP_ALPHA))) &&
+ row_info->channels == 4)
{
if (row_info->bit_depth == 8)
{
@@ -461,13 +472,11 @@ png_do_strip_filler(png_row_infop row_info, png_bytep row, png_uint_32 flags)
row_info->rowbytes = row_width * 6;
}
row_info->channels = 3;
- row_info->color_type &= ~PNG_COLOR_MASK_ALPHA;
}
-/*
- else if (row_info->color_type == PNG_COLOR_TYPE_GRAY ||
- row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
-*/
- else if (row_info->channels == 2)
+ else if ((row_info->color_type == PNG_COLOR_TYPE_GRAY ||
+ (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA &&
+ (flags & PNG_FLAG_STRIP_ALPHA))) &&
+ row_info->channels == 2)
{
if (row_info->bit_depth == 8)
{
@@ -519,8 +528,9 @@ png_do_strip_filler(png_row_infop row_info, png_bytep row, png_uint_32 flags)
row_info->rowbytes = row_width * 2;
}
row_info->channels = 1;
- row_info->color_type &= ~PNG_COLOR_MASK_ALPHA;
}
+ if (flags & PNG_FLAG_STRIP_ALPHA)
+ row_info->color_type &= ~PNG_COLOR_MASK_ALPHA;
}
}
#endif
diff --git a/src/libs/png/pngvcrd.c b/src/libs/png/pngvcrd.c
index 4f513eb4d9..940a7fc0f4 100644
--- a/src/libs/png/pngvcrd.c
+++ b/src/libs/png/pngvcrd.c
@@ -2,9 +2,9 @@
*
* For Intel x86 CPU and Microsoft Visual C++ compiler
*
- * libpng version 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* Copyright (c) 1998, Intel Corporation
*
* Contributed by Nirav Chhatrapati, Intel Corporation, 1998
@@ -115,15 +115,18 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask)
png_debug(1,"in png_combine_row_asm\n");
if (mmx_supported == 2) {
+#if !defined(PNG_1_0_X)
/* this should have happened in png_init_mmx_flags() already */
png_warning(png_ptr, "asm_flags may not have been initialized");
+#endif
png_mmx_support();
}
if (mask == 0xff)
{
png_memcpy(row, png_ptr->row_buf + 1,
- (png_size_t)((png_ptr->width * png_ptr->row_info.pixel_depth + 7) >> 3));
+ (png_size_t)PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
+ png_ptr->width));
}
/* GRR: add "else if (mask == 0)" case?
* or does png_combine_row() not even get called in that case? */
@@ -307,8 +310,12 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask)
__int64 mask0=0x0102040810204080;
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW)
/* && mmx_supported */ )
+#else
+ if (mmx_supported)
+#endif
{
srcptr = png_ptr->row_buf + 1;
dstptr = row;
@@ -408,8 +415,12 @@ end8:
__int64 mask1=0x0101020204040808,
mask0=0x1010202040408080;
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW)
/* && mmx_supported */ )
+#else
+ if (mmx_supported)
+#endif
{
srcptr = png_ptr->row_buf + 1;
dstptr = row;
@@ -529,8 +540,12 @@ end16:
len = (png_ptr->width)&~7;
diff = (png_ptr->width)&7;
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW)
/* && mmx_supported */ )
+#else
+ if (mmx_supported)
+#endif
{
_asm
{
@@ -661,8 +676,12 @@ end24:
len = (png_ptr->width)&~7;
diff = (png_ptr->width)&7;
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW)
/* && mmx_supported */ )
+#else
+ if (mmx_supported)
+#endif
{
_asm
{
@@ -796,8 +815,12 @@ end32:
mask1=0x2020202040404040,
mask0=0x4040808080808080;
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW)
/* && mmx_supported */ )
+#else
+ if (mmx_supported)
+#endif
{
srcptr = png_ptr->row_buf + 1;
dstptr = row;
@@ -987,8 +1010,10 @@ png_do_read_interlace(png_structp png_ptr)
png_debug(1,"in png_do_read_interlace\n");
if (mmx_supported == 2) {
+#if !defined(PNG_1_0_X)
/* this should have happened in png_init_mmx_flags() already */
png_warning(png_ptr, "asm_flags may not have been initialized");
+#endif
png_mmx_support();
}
@@ -1189,8 +1214,12 @@ png_do_read_interlace(png_structp png_ptr)
// NOTE: there is NO MMX code for 48-bit and 64-bit images
// use MMX routine if machine supports it
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_INTERLACE)
/* && mmx_supported */ )
+#else
+ if (mmx_supported)
+#endif
{
if (pixel_bytes == 3)
{
@@ -1874,8 +1903,8 @@ loop4_pass4:
} /* end switch (row_info->pixel_depth) */
row_info->width = final_width;
- row_info->rowbytes = ((final_width *
- (png_uint_32)row_info->pixel_depth + 7) >> 3);
+
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,final_width);
}
}
@@ -3603,7 +3632,7 @@ duploop:
jz dupend
- // 2 lines added by lcreeve@netins.net
+ // 2 lines added by lcreeve at netins.net
// (mail 11 Jul 98 in png-implement list)
cmp edx, 8 //test for less than 8 bytes
jb duplt8
@@ -3652,8 +3681,10 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep
#endif
if (mmx_supported == 2) {
+#if !defined(PNG_1_0_X)
/* this should have happened in png_init_mmx_flags() already */
png_warning(png_ptr, "asm_flags may not have been initialized");
+#endif
png_mmx_support();
}
@@ -3663,6 +3694,7 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep
{
case 0: sprintf(filnm, "none");
break;
+#if !defined(PNG_1_0_X)
case 1: sprintf(filnm, "sub-%s",
(png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_SUB)? "MMX" : "x86");
break;
@@ -3675,6 +3707,16 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep
case 4: sprintf(filnm, "Paeth-%s",
(png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_PAETH)? "MMX":"x86");
break;
+#else
+ case 1: sprintf(filnm, "sub");
+ break;
+ case 2: sprintf(filnm, "up");
+ break;
+ case 3: sprintf(filnm, "avg");
+ break;
+ case 4: sprintf(filnm, "Paeth");
+ break;
+#endif
default: sprintf(filnm, "unknw");
break;
}
@@ -3691,9 +3733,13 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep
case PNG_FILTER_VALUE_SUB:
{
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_SUB) &&
(row_info->pixel_depth >= png_ptr->mmx_bitdepth_threshold) &&
(row_info->rowbytes >= png_ptr->mmx_rowbytes_threshold))
+#else
+ if (mmx_supported)
+#endif
{
png_read_filter_row_mmx_sub(row_info, row);
}
@@ -3716,9 +3762,13 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep
case PNG_FILTER_VALUE_UP:
{
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_UP) &&
(row_info->pixel_depth >= png_ptr->mmx_bitdepth_threshold) &&
(row_info->rowbytes >= png_ptr->mmx_rowbytes_threshold))
+#else
+ if (mmx_supported)
+#endif
{
png_read_filter_row_mmx_up(row_info, row, prev_row);
}
@@ -3740,9 +3790,13 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep
case PNG_FILTER_VALUE_AVG:
{
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_AVG) &&
(row_info->pixel_depth >= png_ptr->mmx_bitdepth_threshold) &&
(row_info->rowbytes >= png_ptr->mmx_rowbytes_threshold))
+#else
+ if (mmx_supported)
+#endif
{
png_read_filter_row_mmx_avg(row_info, row, prev_row);
}
@@ -3774,9 +3828,13 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep
case PNG_FILTER_VALUE_PAETH:
{
+#if !defined(PNG_1_0_X)
if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_PAETH) &&
(row_info->pixel_depth >= png_ptr->mmx_bitdepth_threshold) &&
(row_info->rowbytes >= png_ptr->mmx_rowbytes_threshold))
+#else
+ if (mmx_supported)
+#endif
{
png_read_filter_row_mmx_paeth(row_info, row, prev_row);
}
diff --git a/src/libs/png/pngwio.c b/src/libs/png/pngwio.c
index b39b4145f0..d5d61f49e0 100644
--- a/src/libs/png/pngwio.c
+++ b/src/libs/png/pngwio.c
@@ -1,9 +1,9 @@
/* pngwio.c - functions for data output
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
diff --git a/src/libs/png/pngwrite.c b/src/libs/png/pngwrite.c
index 10c9ea4068..3246fdaafc 100644
--- a/src/libs/png/pngwrite.c
+++ b/src/libs/png/pngwrite.c
@@ -1,9 +1,9 @@
/* pngwrite.c - general routines to write a PNG file
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*/
@@ -104,9 +104,10 @@ png_write_info_before_PLTE(png_structp png_ptr, png_infop info_ptr)
up++)
{
int keep=png_handle_as_unknown(png_ptr, up->name);
- if (keep != HANDLE_CHUNK_NEVER &&
- up->location && (!(up->location & PNG_HAVE_PLTE)) &&
- ((up->name[3] & 0x20) || keep == HANDLE_CHUNK_ALWAYS ||
+ if (keep != PNG_HANDLE_CHUNK_NEVER &&
+ up->location && !(up->location & PNG_HAVE_PLTE) &&
+ !(up->location & PNG_HAVE_IDAT) &&
+ ((up->name[3] & 0x20) || keep == PNG_HANDLE_CHUNK_ALWAYS ||
(png_ptr->flags & PNG_FLAG_KEEP_UNSAFE_CHUNKS)))
{
png_write_chunk(png_ptr, up->name, up->data, up->size);
@@ -267,10 +268,10 @@ png_write_info(png_structp png_ptr, png_infop info_ptr)
up++)
{
int keep=png_handle_as_unknown(png_ptr, up->name);
- if (keep != HANDLE_CHUNK_NEVER &&
+ if (keep != PNG_HANDLE_CHUNK_NEVER &&
up->location && (up->location & PNG_HAVE_PLTE) &&
!(up->location & PNG_HAVE_IDAT) &&
- ((up->name[3] & 0x20) || keep == HANDLE_CHUNK_ALWAYS ||
+ ((up->name[3] & 0x20) || keep == PNG_HANDLE_CHUNK_ALWAYS ||
(png_ptr->flags & PNG_FLAG_KEEP_UNSAFE_CHUNKS)))
{
png_write_chunk(png_ptr, up->name, up->data, up->size);
@@ -367,9 +368,9 @@ png_write_end(png_structp png_ptr, png_infop info_ptr)
up++)
{
int keep=png_handle_as_unknown(png_ptr, up->name);
- if (keep != HANDLE_CHUNK_NEVER &&
+ if (keep != PNG_HANDLE_CHUNK_NEVER &&
up->location && (up->location & PNG_AFTER_IDAT) &&
- ((up->name[3] & 0x20) || keep == HANDLE_CHUNK_ALWAYS ||
+ ((up->name[3] & 0x20) || keep == PNG_HANDLE_CHUNK_ALWAYS ||
(png_ptr->flags & PNG_FLAG_KEEP_UNSAFE_CHUNKS)))
{
png_write_chunk(png_ptr, up->name, up->data, up->size);
@@ -457,6 +458,12 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
#endif
#endif /* PNG_1_0_X */
+ /* added at libpng-1.2.6 */
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+ png_ptr->user_width_max=PNG_USER_WIDTH_MAX;
+ png_ptr->user_height_max=PNG_USER_HEIGHT_MAX;
+#endif
+
#ifdef PNG_SETJMP_SUPPORTED
#ifdef USE_FAR_KEYWORD
if (setjmp(jmpbuf))
@@ -470,7 +477,7 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
return (NULL);
}
#ifdef USE_FAR_KEYWORD
- png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf));
+ png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf));
#endif
#endif
@@ -537,7 +544,7 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr,
#ifdef USE_FAR_KEYWORD
if (setjmp(jmpbuf))
PNG_ABORT();
- png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf));
+ png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf));
#else
if (setjmp(png_ptr->jmpbuf))
PNG_ABORT();
@@ -561,7 +568,8 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver,
{
/* We only come here via pre-1.0.12-compiled applications */
#if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)
- if(sizeof(png_struct) > png_struct_size || sizeof(png_info) > png_info_size)
+ if(png_sizeof(png_struct) > png_struct_size ||
+ png_sizeof(png_info) > png_info_size)
{
char msg[80];
png_ptr->warning_fn=NULL;
@@ -576,7 +584,7 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver,
png_warning(png_ptr, msg);
}
#endif
- if(sizeof(png_struct) > png_struct_size)
+ if(png_sizeof(png_struct) > png_struct_size)
{
png_ptr->error_fn=NULL;
#ifdef PNG_ERROR_NUMBERS_SUPPORTED
@@ -585,7 +593,7 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver,
png_error(png_ptr,
"The png struct allocated by the application for writing is too small.");
}
- if(sizeof(png_info) > png_info_size)
+ if(png_sizeof(png_info) > png_info_size)
{
png_ptr->error_fn=NULL;
#ifdef PNG_ERROR_NUMBERS_SUPPORTED
@@ -626,10 +634,10 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
#ifdef PNG_SETJMP_SUPPORTED
/* save jump buffer and error functions */
- png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf));
+ png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf));
#endif
- if (sizeof(png_struct) > png_struct_size)
+ if (png_sizeof(png_struct) > png_struct_size)
{
png_destroy_struct(png_ptr);
png_ptr = (png_structp)png_create_struct(PNG_STRUCT_PNG);
@@ -637,7 +645,13 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
}
/* reset all variables to 0 */
- png_memset(png_ptr, 0, sizeof (png_struct));
+ png_memset(png_ptr, 0, png_sizeof (png_struct));
+
+ /* added at libpng-1.2.6 */
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+ png_ptr->user_width_max=PNG_USER_WIDTH_MAX;
+ png_ptr->user_height_max=PNG_USER_HEIGHT_MAX;
+#endif
#if !defined(PNG_1_0_X)
#ifdef PNG_ASSEMBLER_CODE_SUPPORTED
@@ -647,7 +661,7 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver,
#ifdef PNG_SETJMP_SUPPORTED
/* restore jump buffer */
- png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf));
+ png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf));
#endif
png_set_write_fn(png_ptr, png_voidp_NULL, png_rw_ptr_NULL,
@@ -827,8 +841,8 @@ png_write_row(png_structp png_ptr, png_bytep row)
png_ptr->row_info.pixel_depth = (png_byte)(png_ptr->row_info.bit_depth *
png_ptr->row_info.channels);
- png_ptr->row_info.rowbytes = ((png_ptr->row_info.width *
- (png_uint_32)png_ptr->row_info.pixel_depth + 7) >> 3);
+ png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
+ png_ptr->row_info.width);
png_debug1(3, "row_info->color_type = %d\n", png_ptr->row_info.color_type);
png_debug1(3, "row_info->width = %lu\n", png_ptr->row_info.width);
@@ -1049,7 +1063,7 @@ png_write_destroy(png_structp png_ptr)
#ifdef PNG_SETJMP_SUPPORTED
/* reset structure */
- png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf));
+ png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf));
#endif
error_fn = png_ptr->error_fn;
@@ -1059,7 +1073,7 @@ png_write_destroy(png_structp png_ptr)
free_fn = png_ptr->free_fn;
#endif
- png_memset(png_ptr, 0, sizeof (png_struct));
+ png_memset(png_ptr, 0, png_sizeof (png_struct));
png_ptr->error_fn = error_fn;
png_ptr->warning_fn = warning_fn;
@@ -1069,7 +1083,7 @@ png_write_destroy(png_structp png_ptr)
#endif
#ifdef PNG_SETJMP_SUPPORTED
- png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf));
+ png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf));
#endif
}
@@ -1211,7 +1225,7 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method,
if (png_ptr->prev_filters == NULL)
{
png_ptr->prev_filters = (png_bytep)png_malloc(png_ptr,
- (png_uint_32)(sizeof(png_byte) * num_weights));
+ (png_uint_32)(png_sizeof(png_byte) * num_weights));
/* To make sure that the weighting starts out fairly */
for (i = 0; i < num_weights; i++)
@@ -1223,10 +1237,10 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method,
if (png_ptr->filter_weights == NULL)
{
png_ptr->filter_weights = (png_uint_16p)png_malloc(png_ptr,
- (png_uint_32)(sizeof(png_uint_16) * num_weights));
+ (png_uint_32)(png_sizeof(png_uint_16) * num_weights));
png_ptr->inv_filter_weights = (png_uint_16p)png_malloc(png_ptr,
- (png_uint_32)(sizeof(png_uint_16) * num_weights));
+ (png_uint_32)(png_sizeof(png_uint_16) * num_weights));
for (i = 0; i < num_weights; i++)
{
png_ptr->inv_filter_weights[i] =
@@ -1257,10 +1271,10 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method,
if (png_ptr->filter_costs == NULL)
{
png_ptr->filter_costs = (png_uint_16p)png_malloc(png_ptr,
- (png_uint_32)(sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST));
+ (png_uint_32)(png_sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST));
png_ptr->inv_filter_costs = (png_uint_16p)png_malloc(png_ptr,
- (png_uint_32)(sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST));
+ (png_uint_32)(png_sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST));
for (i = 0; i < PNG_FILTER_VALUE_LAST; i++)
{
diff --git a/src/libs/png/pngwtran.c b/src/libs/png/pngwtran.c
index c28da116b7..f1c8b3e62a 100644
--- a/src/libs/png/pngwtran.c
+++ b/src/libs/png/pngwtran.c
@@ -1,9 +1,9 @@
/* pngwtran.c - transforms the data in a row for PNG writers
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*/
@@ -195,8 +195,8 @@ png_do_pack(png_row_infop row_info, png_bytep row, png_uint_32 bit_depth)
}
row_info->bit_depth = (png_byte)bit_depth;
row_info->pixel_depth = (png_byte)(bit_depth * row_info->channels);
- row_info->rowbytes =
- ((row_info->width * row_info->pixel_depth + 7) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
+ row_info->width);
}
}
#endif
@@ -546,15 +546,15 @@ png_do_write_intrapixel(png_row_infop row_info, png_bytep row)
for (i = 0, rp = row; i < row_width; i++, rp += bytes_per_pixel)
{
- png_uint_32 s0=*(rp )<<8 | *(rp+1);
- png_uint_32 s1=*(rp+2)<<8 | *(rp+3);
- png_uint_32 s2=*(rp+4)<<8 | *(rp+5);
- png_uint_32 red=(s0-s1)&0xffff;
- png_uint_32 blue=(s2-s1)&0xffff;
- *(rp ) = (png_byte)((red>>8)&0xff);
- *(rp+1) = (png_byte)(red&0xff);
- *(rp+4) = (png_byte)((blue>>8)&0xff);
- *(rp+5) = (png_byte)(blue&0xff);
+ png_uint_32 s0 = (*(rp ) << 8) | *(rp+1);
+ png_uint_32 s1 = (*(rp+2) << 8) | *(rp+3);
+ png_uint_32 s2 = (*(rp+4) << 8) | *(rp+5);
+ png_uint_32 red = (png_uint_32)((s0-s1) & 0xffffL);
+ png_uint_32 blue = (png_uint_32)((s2-s1) & 0xffffL);
+ *(rp ) = (png_byte)((red >> 8) & 0xff);
+ *(rp+1) = (png_byte)(red & 0xff);
+ *(rp+4) = (png_byte)((blue >> 8) & 0xff);
+ *(rp+5) = (png_byte)(blue & 0xff);
}
}
}
diff --git a/src/libs/png/pngwutil.c b/src/libs/png/pngwutil.c
index 4b5ab6c87e..dd7b150b75 100644
--- a/src/libs/png/pngwutil.c
+++ b/src/libs/png/pngwutil.c
@@ -1,9 +1,9 @@
/* pngwutil.c - utilities to write a PNG file
*
- * libpng 1.2.5 - October 3, 2002
+ * libpng version 1.2.8 - December 3, 2004
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2002 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2004 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*/
@@ -219,7 +219,7 @@ png_text_compress(png_structp png_ptr,
png_error(png_ptr, "zlib error");
}
/* check to see if we need more room */
- if (!png_ptr->zstream.avail_out && png_ptr->zstream.avail_in)
+ if (!(png_ptr->zstream.avail_out))
{
/* make sure the output array has room */
if (comp->num_output_ptr >= comp->max_output_ptr)
@@ -234,14 +234,16 @@ png_text_compress(png_structp png_ptr,
old_ptr = comp->output_ptr;
comp->output_ptr = (png_charpp)png_malloc(png_ptr,
- (png_uint_32)(comp->max_output_ptr * sizeof (png_charpp)));
+ (png_uint_32)(comp->max_output_ptr *
+ png_sizeof (png_charpp)));
png_memcpy(comp->output_ptr, old_ptr, old_max
- * sizeof (png_charp));
+ * png_sizeof (png_charp));
png_free(png_ptr, old_ptr);
}
else
comp->output_ptr = (png_charpp)png_malloc(png_ptr,
- (png_uint_32)(comp->max_output_ptr * sizeof (png_charp)));
+ (png_uint_32)(comp->max_output_ptr *
+ png_sizeof (png_charp)));
}
/* save the data */
@@ -283,14 +285,16 @@ png_text_compress(png_structp png_ptr,
old_ptr = comp->output_ptr;
/* This could be optimized to realloc() */
comp->output_ptr = (png_charpp)png_malloc(png_ptr,
- (png_uint_32)(comp->max_output_ptr * sizeof (png_charpp)));
+ (png_uint_32)(comp->max_output_ptr *
+ png_sizeof (png_charpp)));
png_memcpy(comp->output_ptr, old_ptr,
- old_max * sizeof (png_charp));
+ old_max * png_sizeof (png_charp));
png_free(png_ptr, old_ptr);
}
else
comp->output_ptr = (png_charpp)png_malloc(png_ptr,
- (png_uint_32)(comp->max_output_ptr * sizeof (png_charp)));
+ (png_uint_32)(comp->max_output_ptr *
+ png_sizeof (png_charp)));
}
/* save off the data */
@@ -353,9 +357,9 @@ png_write_compressed_data_out(png_structp png_ptr, compression_state *comp)
png_write_chunk_data(png_ptr, png_ptr->zbuf,
png_ptr->zbuf_size - png_ptr->zstream.avail_out);
- /* reset zlib for another zTXt/iTXt or the image data */
+ /* reset zlib for another zTXt/iTXt or image data */
deflateReset(&png_ptr->zstream);
-
+ png_ptr->zstream.data_type = Z_BINARY;
}
#endif
@@ -464,11 +468,12 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height,
#if defined(PNG_MNG_FEATURES_SUPPORTED)
png_ptr->filter_type = (png_byte)filter_type;
#endif
+ png_ptr->compression_type = (png_byte)compression_type;
png_ptr->width = width;
png_ptr->height = height;
png_ptr->pixel_depth = (png_byte)(bit_depth * png_ptr->channels);
- png_ptr->rowbytes = ((width * (png_size_t)png_ptr->pixel_depth + 7) >> 3);
+ png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, width);
/* set the usr info, so any transformations can modify it */
png_ptr->usr_width = png_ptr->width;
png_ptr->usr_bit_depth = png_ptr->bit_depth;
@@ -518,6 +523,9 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height,
png_ptr->zlib_mem_level, png_ptr->zlib_strategy);
png_ptr->zstream.next_out = png_ptr->zbuf;
png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
+ /* libpng is not interested in zstream.data_type */
+ /* set it to a predefined value, to avoid its evaluation inside zlib */
+ png_ptr->zstream.data_type = Z_BINARY;
png_ptr->mode = PNG_HAVE_IHDR;
}
@@ -596,6 +604,46 @@ png_write_IDAT(png_structp png_ptr, png_bytep data, png_size_t length)
PNG_IDAT;
#endif
png_debug(1, "in png_write_IDAT\n");
+
+ /* Optimize the CMF field in the zlib stream. */
+ /* This hack of the zlib stream is compliant to the stream specification. */
+ if (!(png_ptr->mode & PNG_HAVE_IDAT) &&
+ png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE)
+ {
+ unsigned int z_cmf = data[0]; /* zlib compression method and flags */
+ if ((z_cmf & 0x0f) == 8 && (z_cmf & 0xf0) <= 0x70)
+ {
+ /* Avoid memory underflows and multiplication overflows. */
+ /* The conditions below are practically always satisfied;
+ however, they still must be checked. */
+ if (length >= 2 &&
+ png_ptr->height < 16384 && png_ptr->width < 16384)
+ {
+ png_uint_32 uncompressed_idat_size = png_ptr->height *
+ ((png_ptr->width *
+ png_ptr->channels * png_ptr->bit_depth + 15) >> 3);
+ unsigned int z_cinfo = z_cmf >> 4;
+ unsigned int half_z_window_size = 1 << (z_cinfo + 7);
+ while (uncompressed_idat_size <= half_z_window_size &&
+ half_z_window_size >= 256)
+ {
+ z_cinfo--;
+ half_z_window_size >>= 1;
+ }
+ z_cmf = (z_cmf & 0x0f) | (z_cinfo << 4);
+ if (data[0] != (png_byte)z_cmf)
+ {
+ data[0] = (png_byte)z_cmf;
+ data[1] &= 0xe0;
+ data[1] += (png_byte)(0x1f - ((z_cmf << 8) + data[1]) % 0x1f);
+ }
+ }
+ }
+ else
+ png_error(png_ptr,
+ "Invalid zlib compression method or flags in IDAT");
+ }
+
png_write_chunk(png_ptr, (png_bytep)png_IDAT, data, length);
png_ptr->mode |= PNG_HAVE_IDAT;
}
@@ -1141,7 +1189,12 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key)
png_debug1(2, "Keyword to be checked is '%s'\n", key);
- *new_key = (png_charp)png_malloc(png_ptr, (png_uint_32)(key_len + 2));
+ *new_key = (png_charp)png_malloc_warn(png_ptr, (png_uint_32)(key_len + 2));
+ if (*new_key == NULL)
+ {
+ png_warning(png_ptr, "Out of memory while procesing keyword");
+ return ((png_size_t)0);
+ }
/* Replace non-printing characters with a blank and print a warning */
for (kp = key, dp = *new_key; *kp != '\0'; kp++, dp++)
@@ -1353,7 +1406,7 @@ png_write_iTXt(png_structp png_ptr, int compression, png_charp key,
{
png_warning(png_ptr, "Empty language field in iTXt chunk");
new_lang = NULL;
- lang_len = 0;
+ lang_len = 0;
}
if (lang_key == NULL)
@@ -1461,7 +1514,7 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
total_len = purpose_len + units_len + 10;
params_len = (png_uint_32p)png_malloc(png_ptr, (png_uint_32)(nparams
- *sizeof(png_uint_32)));
+ *png_sizeof(png_uint_32)));
/* Find the length of each parameter, making sure we don't count the
null terminator for the last parameter. */
@@ -1506,6 +1559,7 @@ png_write_sCAL(png_structp png_ptr, int unit, double width,double height)
#endif
png_size_t total_len;
char wbuf[32], hbuf[32];
+ png_byte bunit = unit;
png_debug(1, "in png_write_sCAL\n");
@@ -1526,7 +1580,7 @@ png_write_sCAL(png_structp png_ptr, int unit, double width,double height)
png_debug1(3, "sCAL total length = %d\n", (int)total_len);
png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len);
- png_write_chunk_data(png_ptr, (png_bytep)&unit, 1);
+ png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1);
png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1);
png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf));
@@ -1543,6 +1597,7 @@ png_write_sCAL_s(png_structp png_ptr, int unit, png_charp width,
#endif
png_size_t total_len;
char wbuf[32], hbuf[32];
+ png_byte bunit = unit;
png_debug(1, "in png_write_sCAL_s\n");
@@ -1552,7 +1607,7 @@ png_write_sCAL_s(png_structp png_ptr, int unit, png_charp width,
png_debug1(3, "sCAL total length = %d\n", total_len);
png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len);
- png_write_chunk_data(png_ptr, (png_bytep)&unit, 1);
+ png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1);
png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1);
png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf));
@@ -1641,8 +1696,8 @@ png_write_start_row(png_structp png_ptr)
png_size_t buf_size;
png_debug(1, "in png_write_start_row\n");
- buf_size = (png_size_t)(((png_ptr->width * png_ptr->usr_channels *
- png_ptr->usr_bit_depth + 7) >> 3) + 1);
+ buf_size = (png_size_t)(PNG_ROWBYTES(
+ png_ptr->usr_channels*png_ptr->usr_bit_depth,png_ptr->width)+1);
/* set up row buffer */
png_ptr->row_buf = (png_bytep)png_malloc(png_ptr, (png_uint_32)buf_size);
@@ -1778,9 +1833,8 @@ png_write_finish_row(png_structp png_ptr)
{
if (png_ptr->prev_row != NULL)
png_memset(png_ptr->prev_row, 0,
- (png_size_t) (((png_uint_32)png_ptr->usr_channels *
- (png_uint_32)png_ptr->usr_bit_depth *
- png_ptr->width + 7) >> 3) + 1);
+ (png_size_t)(PNG_ROWBYTES(png_ptr->usr_channels*
+ png_ptr->usr_bit_depth,png_ptr->width))+1);
return;
}
}
@@ -1820,6 +1874,7 @@ png_write_finish_row(png_structp png_ptr)
}
deflateReset(&png_ptr->zstream);
+ png_ptr->zstream.data_type = Z_BINARY;
}
#if defined(PNG_WRITE_INTERLACING_SUPPORTED)
@@ -1987,8 +2042,8 @@ png_do_write_interlace(png_row_infop row_info, png_bytep row, int pass)
png_pass_inc[pass] - 1 -
png_pass_start[pass]) /
png_pass_inc[pass];
- row_info->rowbytes = ((row_info->width *
- row_info->pixel_depth + 7) >> 3);
+ row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
+ row_info->width);
}
}
#endif
@@ -1997,7 +2052,7 @@ png_do_write_interlace(png_row_infop row_info, png_bytep row, int pass)
* been specified by the application, and then writes the row out with the
* chosen filter.
*/
-#define PNG_MAXSUM (~((png_uint_32)0) >> 1)
+#define PNG_MAXSUM (((png_uint_32)(-1)) >> 1)
#define PNG_HISHIFT 10
#define PNG_LOMASK ((png_uint_32)0xffffL)
#define PNG_HIMASK ((png_uint_32)(~PNG_LOMASK >> PNG_HISHIFT))
@@ -2014,7 +2069,7 @@ png_write_find_filter(png_structp png_ptr, png_row_infop row_info)
png_debug(1, "in png_write_find_filter\n");
/* find out how many bytes offset each pixel is */
- bpp = (row_info->pixel_depth + 7) / 8;
+ bpp = (row_info->pixel_depth + 7) >> 3;
prev_row = png_ptr->prev_row;
best_row = row_buf = png_ptr->row_buf;
@@ -2165,7 +2220,7 @@ png_write_find_filter(png_structp png_ptr, png_row_infop row_info)
sum += (v < 128) ? v : 256 - v;
}
- for (lp = row_buf + 1; i < row_info->rowbytes;
+ for (lp = row_buf + 1; i < row_bytes;
i++, rp++, lp++, dp++)
{
v = *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);