From 26abf74673a6239ea3b84471f3b56eb665fc3aec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= Date: Tue, 18 Oct 2005 08:08:24 +0000 Subject: [PATCH] update third party lib : libpng-1.2.8 git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@14408 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/libs/png/LICENSE | 17 ++- src/libs/png/png.c | 87 ++++++++------ src/libs/png/png.h | 208 ++++++++++++++++++++++++++++------ src/libs/png/pngconf.h | 203 +++++++++++++++++++++++---------- src/libs/png/pngerror.c | 46 ++++---- src/libs/png/pnggccrd.c | 37 +++--- src/libs/png/pngget.c | 53 +++++---- src/libs/png/pngmem.c | 101 +++++++++++------ src/libs/png/pngpread.c | 86 +++++++++----- src/libs/png/pngread.c | 128 +++++++++++++-------- src/libs/png/pngrio.c | 4 +- src/libs/png/pngrtran.c | 134 +++++++++++----------- src/libs/png/pngrutil.c | 243 ++++++++++++++++++++++------------------ src/libs/png/pngset.c | 161 +++++++++++++++++--------- src/libs/png/pngtrans.c | 40 ++++--- src/libs/png/pngvcrd.c | 70 +++++++++++- src/libs/png/pngwio.c | 4 +- src/libs/png/pngwrite.c | 70 +++++++----- src/libs/png/pngwtran.c | 26 ++--- src/libs/png/pngwutil.c | 109 +++++++++++++----- 20 files changed, 1208 insertions(+), 619 deletions(-) diff --git a/src/libs/png/LICENSE b/src/libs/png/LICENSE index 28b3b6620d..fe3ac4b96f 100644 --- a/src/libs/png/LICENSE +++ b/src/libs/png/LICENSE @@ -8,9 +8,16 @@ COPYRIGHT NOTICE, DISCLAIMER, and LICENSE: If you modify libpng you may insert additional notices immediately following this sentence. -libpng versions 1.0.7, July 1, 2000, through 1.2.5, October 3, 2002, are -Copyright (c) 2000-2002 Glenn Randers-Pehrson -and are distributed according to the same disclaimer and license as libpng-1.0.6 +libpng version 1.2.6, December 3, 2004, is +Copyright (c) 2004 Glenn Randers-Pehrson, and is +distributed according to the same disclaimer and license as libpng-1.2.5 +with the following individual added to the list of Contributing Authors + + Cosmin Truta + +libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are +Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are +distributed according to the same disclaimer and license as libpng-1.0.6 with the following individuals added to the list of Contributing Authors Simon-Pierre Cadieux @@ -98,5 +105,5 @@ Libpng is OSI Certified Open Source Software. OSI Certified Open Source is a certification mark of the Open Source Initiative. Glenn Randers-Pehrson -randeg@alum.rpi.edu -October 3, 2002 +glennrp at users.sourceforge.net +December 3, 2004 diff --git a/src/libs/png/png.c b/src/libs/png/png.c index 2a55ccb798..608ea2ce7c 100644 --- a/src/libs/png/png.c +++ b/src/libs/png/png.c @@ -1,11 +1,11 @@ /* png.c - location for general purpose libpng functions * - * libpng version 1.2.5 - October 3, 2002 - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * libpng version 1.2.8 - December 3, 2004 + * For conditions of distribution and use, see copyright notice in png.h + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) - * */ #define PNG_INTERNAL @@ -13,14 +13,14 @@ #include "png.h" /* Generate a compiler error if there is an old png.h in the search path. */ -typedef version_1_2_5 Your_png_h_is_not_version_1_2_5; +typedef version_1_2_8 Your_png_h_is_not_version_1_2_8; /* Version information for C files. This had better match the version * string defined in png.h. */ #ifdef PNG_USE_GLOBAL_ARRAYS /* png_libpng_ver was changed to a function in version 1.0.5c */ -const char png_libpng_ver[18] = "1.2.5"; +const char png_libpng_ver[18] = PNG_LIBPNG_VER_STRING; /* png_sig was changed to a function in version 1.0.5c */ /* Place to hold the signature string for a PNG file. */ @@ -80,7 +80,7 @@ const int FARDATA png_pass_mask[] = {0x80, 0x08, 0x88, 0x22, 0xaa, 0x55, 0xff}; const int FARDATA png_pass_dsp_mask[] = {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff}; -#endif +#endif /* PNG_USE_GLOBAL_ARRAYS */ /* Tells libpng that we have already handled the first "num_bytes" bytes * of the PNG file signature. If the PNG data is embedded into another @@ -142,16 +142,23 @@ voidpf /* private */ #endif png_zalloc(voidpf png_ptr, uInt items, uInt size) { - png_uint_32 num_bytes = (png_uint_32)items * size; png_voidp ptr; png_structp p=png_ptr; png_uint_32 save_flags=p->flags; + png_uint_32 num_bytes; + + if (items > PNG_UINT_32_MAX/size) + { + png_warning (png_ptr, "Potential overflow in png_zalloc()"); + return (NULL); + } + num_bytes = (png_uint_32)items * size; p->flags|=PNG_FLAG_MALLOC_NULL_MEM_OK; ptr = (png_voidp)png_malloc((png_structp)png_ptr, num_bytes); p->flags=save_flags; -#ifndef PNG_NO_ZALLOC_ZERO +#if defined(PNG_1_0_X) && !defined(PNG_NO_ZALLOC_ZERO) if (ptr == NULL) return ((voidpf)ptr); @@ -217,7 +224,7 @@ png_calculate_crc(png_structp png_ptr, png_bytep ptr, png_size_t length) /* Allocate the memory for an info_struct for the application. We don't * really need the png_ptr, but it could potentially be useful in the - * future. This should be used in favour of malloc(sizeof(png_info)) + * future. This should be used in favour of malloc(png_sizeof(png_info)) * and png_info_init() so that applications that want to use a shared * libpng don't have to be recompiled if png_info changes size. */ @@ -235,7 +242,7 @@ png_create_info_struct(png_structp png_ptr) info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO); #endif if (info_ptr != NULL) - png_info_init_3(&info_ptr, sizeof(png_info)); + png_info_init_3(&info_ptr, png_sizeof(png_info)); return (info_ptr); } @@ -272,6 +279,7 @@ png_destroy_info_struct(png_structp png_ptr, png_infopp info_ptr_ptr) * and applications using it are urged to use png_create_info_struct() * instead. */ +#if defined(PNG_1_0_X) || defined (PNG_1_2_X) #undef png_info_init void PNGAPI png_info_init(png_infop info_ptr) @@ -279,6 +287,7 @@ png_info_init(png_infop info_ptr) /* We only come here via pre-1.0.12-compiled applications */ png_info_init_3(&info_ptr, 0); } +#endif void PNGAPI png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size) @@ -287,7 +296,7 @@ png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size) png_debug(1, "in png_info_init_3\n"); - if(sizeof(png_info) > png_info_struct_size) + if(png_sizeof(png_info) > png_info_struct_size) { png_destroy_struct(info_ptr); info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO); @@ -295,7 +304,7 @@ png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size) } /* set everything to 0 */ - png_memset(info_ptr, 0, sizeof (png_info)); + png_memset(info_ptr, 0, png_sizeof (png_info)); } #ifdef PNG_FREE_ME_SUPPORTED @@ -581,7 +590,7 @@ png_info_destroy(png_structp png_ptr, png_infop info_ptr) } #endif - png_info_init_3(&info_ptr, sizeof(png_info)); + png_info_init_3(&info_ptr, png_sizeof(png_info)); } /* This function returns a pointer to the io_ptr associated with the user @@ -623,7 +632,7 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime) if (png_ptr->time_buffer == NULL) { png_ptr->time_buffer = (png_charp)png_malloc(png_ptr, (png_uint_32)(29* - sizeof(char))); + png_sizeof(char))); } #if defined(_WIN32_WCE) @@ -645,7 +654,7 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime) ptime->year, ptime->hour % 24, ptime->minute % 60, ptime->second % 61); png_memcpy(png_ptr->time_buffer, near_time_buf, - 29*sizeof(char)); + 29*png_sizeof(char)); } #else sprintf(png_ptr->time_buffer, "%d %s %d %02d:%02d:%02d +0000", @@ -670,45 +679,47 @@ png_sig_bytes(void) png_charp PNGAPI png_get_copyright(png_structp png_ptr) { - if (png_ptr != NULL || png_ptr == NULL) /* silence compiler warning */ - return ((png_charp) "\n libpng version 1.2.5 - October 3, 2002\n\ - Copyright (c) 1998-2002 Glenn Randers-Pehrson\n\ + if (&png_ptr != NULL) /* silence compiler warning about unused png_ptr */ + return ((png_charp) "\n libpng version 1.2.8 - December 3, 2004\n\ + Copyright (c) 1998-2004 Glenn Randers-Pehrson\n\ Copyright (c) 1996-1997 Andreas Dilger\n\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\n"); return ((png_charp) ""); } /* The following return the library version as a short string in the - * format 1.0.0 through 99.99.99zz. To get the version of *.h files used - * with your application, print out PNG_LIBPNG_VER_STRING, which is defined - * in png.h. + * format 1.0.0 through 99.99.99zz. To get the version of *.h files + * used with your application, print out PNG_LIBPNG_VER_STRING, which + * is defined in png.h. + * Note: now there is no difference between png_get_libpng_ver() and + * png_get_header_ver(). Due to the version_nn_nn_nn typedef guard, + * it is guaranteed that png.c uses the correct version of png.h. */ - png_charp PNGAPI png_get_libpng_ver(png_structp png_ptr) { /* Version of *.c files used when building libpng */ - if(png_ptr != NULL) /* silence compiler warning about unused png_ptr */ - return((png_charp) "1.2.5"); - return((png_charp) "1.2.5"); + if (&png_ptr != NULL) /* silence compiler warning about unused png_ptr */ + return ((png_charp) PNG_LIBPNG_VER_STRING); + return ((png_charp) ""); } png_charp PNGAPI png_get_header_ver(png_structp png_ptr) { /* Version of *.h files used when building libpng */ - if(png_ptr != NULL) /* silence compiler warning about unused png_ptr */ - return((png_charp) PNG_LIBPNG_VER_STRING); - return((png_charp) PNG_LIBPNG_VER_STRING); + if (&png_ptr != NULL) /* silence compiler warning about unused png_ptr */ + return ((png_charp) PNG_LIBPNG_VER_STRING); + return ((png_charp) ""); } png_charp PNGAPI png_get_header_version(png_structp png_ptr) { /* Returns longer string containing both version and date */ - if(png_ptr != NULL) /* silence compiler warning about unused png_ptr */ - return((png_charp) PNG_HEADER_VERSION_STRING); - return((png_charp) PNG_HEADER_VERSION_STRING); + if (&png_ptr != NULL) /* silence compiler warning about unused png_ptr */ + return ((png_charp) PNG_HEADER_VERSION_STRING); + return ((png_charp) ""); } #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED @@ -740,7 +751,7 @@ png_uint_32 PNGAPI png_access_version_number(void) { /* Version of *.c files used when building libpng */ - return((png_uint_32) 10205L); + return((png_uint_32) PNG_LIBPNG_VER); } @@ -803,3 +814,15 @@ png_mmx_support(void) } #endif #endif /* PNG_1_0_X */ + +#ifdef PNG_SIZE_T +/* Added at libpng version 1.2.6 */ + PNG_EXTERN png_size_t PNGAPI png_convert_size PNGARG((size_t size)); +png_size_t PNGAPI +png_convert_size(size_t size) +{ + if (size > (png_size_t)-1) + PNG_ABORT(); /* We haven't got access to png_ptr, so no png_error() */ + return ((png_size_t)size); +} +#endif /* PNG_SIZE_T */ diff --git a/src/libs/png/png.h b/src/libs/png/png.h index f059910e62..e87a3011cd 100644 --- a/src/libs/png/png.h +++ b/src/libs/png/png.h @@ -1,14 +1,14 @@ /* png.h - header file for PNG reference library * - * libpng version 1.2.5 - October 3, 2002 - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * libpng version 1.2.8 - December 3, 2004 + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * * Authors and maintainers: * libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat * libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger - * libpng versions 0.97, January 1998, through 1.2.5 - October 3, 2002: Glenn + * libpng versions 0.97, January 1998, through 1.2.8 - December 3, 2004: Glenn * See also "Contributing Authors", below. * * Note about libpng version numbers: @@ -98,6 +98,19 @@ * 1.2.5rc1-3 13 10205 12.so.0.1.2.5rc1-3 * 1.0.15 10 10015 10.so.0.1.0.15 * 1.2.5 13 10205 12.so.0.1.2.5 + * 1.2.6beta1-4 13 10206 12.so.0.1.2.6beta1-4 + * 1.0.16 10 10016 10.so.0.1.0.16 + * 1.2.6 13 10206 12.so.0.1.2.6 + * 1.2.7beta1-2 13 10207 12.so.0.1.2.7beta1-2 + * 1.0.17rc1 10 10017 12.so.0.1.0.17rc1 + * 1.2.7rc1 13 10207 12.so.0.1.2.7rc1 + * 1.0.17 10 10017 12.so.0.1.0.17 + * 1.2.7 13 10207 12.so.0.1.2.7 + * 1.2.8beta1-5 13 10208 12.so.0.1.2.8beta1-5 + * 1.0.18rc1-5 10 10018 12.so.0.1.0.18rc1-5 + * 1.2.8rc1-5 13 10208 12.so.0.1.2.8rc1-5 + * 1.0.18 10 10018 12.so.0.1.0.18 + * 1.2.8 13 10208 12.so.0.1.2.8 * * Henceforth the source version will match the shared-library major * and minor numbers; the shared-library major version number will be @@ -117,8 +130,8 @@ * in binary compatibility (e.g., when a new feature is added). * * See libpng.txt or libpng.3 for more information. The PNG specification - * is available as RFC 2083 - * and as a W3C Recommendation + * is available as a W3C Recommendation and as an ISO Specification, + * = 8 ? \ + ((width) * (((png_uint_32)(pixel_bits)) >> 3)) : \ + (( ((width) * ((png_uint_32)(pixel_bits))) + 7) >> 3) ) + +/* PNG_OUT_OF_RANGE returns true if value is outside the range + ideal-delta..ideal+delta. Each argument is evaluated twice. + "ideal" and "delta" should be constants, normally simple + integers, "value" a variable. Added to libpng-1.2.6 JB */ +#define PNG_OUT_OF_RANGE(value, ideal, delta) \ + ( (value) < (ideal)-(delta) || (value) > (ideal)+(delta) ) + /* variables declared in png.c - only it needs to define PNG_NO_EXTERN */ #if !defined(PNG_NO_EXTERN) || defined(PNG_ALWAYS_EXTERN) /* place to hold the signature string for a PNG file. */ @@ -2655,6 +2784,8 @@ PNG_EXTERN png_int_32 png_get_int_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); #endif /* !PNG_READ_BIG_ENDIAN_SUPPORTED */ +PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr, + png_bytep buf)); /* Initialize png_ptr struct for reading, and allocate any other memory. * (old interface - DEPRECATED - use png_create_read_struct instead). @@ -2662,7 +2793,7 @@ PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); extern PNG_EXPORT(void,png_read_init) PNGARG((png_structp png_ptr)); #undef png_read_init #define png_read_init(png_ptr) png_read_init_3(&png_ptr, \ - PNG_LIBPNG_VER_STRING, sizeof(png_struct)); + PNG_LIBPNG_VER_STRING, png_sizeof(png_struct)); extern PNG_EXPORT(void,png_read_init_3) PNGARG((png_structpp ptr_ptr, png_const_charp user_png_ver, png_size_t png_struct_size)); extern PNG_EXPORT(void,png_read_init_2) PNGARG((png_structp png_ptr, @@ -2675,7 +2806,7 @@ extern PNG_EXPORT(void,png_read_init_2) PNGARG((png_structp png_ptr, extern PNG_EXPORT(void,png_write_init) PNGARG((png_structp png_ptr)); #undef png_write_init #define png_write_init(png_ptr) png_write_init_3(&png_ptr, \ - PNG_LIBPNG_VER_STRING, sizeof(png_struct)); + PNG_LIBPNG_VER_STRING, png_sizeof(png_struct)); extern PNG_EXPORT(void,png_write_init_3) PNGARG((png_structpp ptr_ptr, png_const_charp user_png_ver, png_size_t png_struct_size)); extern PNG_EXPORT(void,png_write_init_2) PNGARG((png_structp png_ptr, @@ -2704,6 +2835,11 @@ PNG_EXTERN voidpf png_zalloc PNGARG((voidpf png_ptr, uInt items, uInt size)); /* Function to free memory for zlib */ PNG_EXTERN void png_zfree PNGARG((voidpf png_ptr, voidpf ptr)); +#ifdef PNG_SIZE_T +/* Function to convert a sizeof an item to png_sizeof item */ + PNG_EXTERN png_size_t PNGAPI png_convert_size PNGARG((size_t size)); +#endif + /* Next four functions are used internally as callbacks. PNGAPI is required * but not PNG_EXPORT. PNGAPI added at libpng version 1.2.3. */ diff --git a/src/libs/png/pngconf.h b/src/libs/png/pngconf.h index 4a425dd1aa..ba50838454 100644 --- a/src/libs/png/pngconf.h +++ b/src/libs/png/pngconf.h @@ -1,8 +1,9 @@ + /* pngconf.h - machine configurable file for libpng * - * libpng 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) */ @@ -16,6 +17,54 @@ #ifndef PNGCONF_H #define PNGCONF_H +#define PNG_1_2_X + +/* + * PNG_USER_CONFIG has to be defined on the compiler command line. This + * includes the resource compiler for Windows DLL configurations. + */ +#ifdef PNG_USER_CONFIG +#include "pngusr.h" +#endif + +/* + * Added at libpng-1.2.8 + * + * If you create a private DLL you need to define in "pngusr.h" the followings: + * #define PNG_USER_PRIVATEBUILD + * e.g. #define PNG_USER_PRIVATEBUILD "Build by MyCompany for xyz reasons." + * #define PNG_USER_DLLFNAME_POSTFIX + * e.g. // private DLL "libpng13gx.dll" + * #define PNG_USER_DLLFNAME_POSTFIX "gx" + * + * The following macros are also at your disposal if you want to complete the + * DLL VERSIONINFO structure. + * - PNG_USER_VERSIONINFO_COMMENTS + * - PNG_USER_VERSIONINFO_COMPANYNAME + * - PNG_USER_VERSIONINFO_LEGALTRADEMARKS + */ + +#ifdef __STDC__ +#ifdef SPECIALBUILD +# pragma message("PNG_LIBPNG_SPECIALBUILD (and deprecated SPECIALBUILD)\ + are now LIBPNG reserved macros. Use PNG_USER_PRIVATEBUILD instead.") +#endif + +#ifdef PRIVATEBUILD +# pragma message("PRIVATEBUILD is deprecated. Use\ + PNG_USER_PRIVATEBUILD instead.") +# define PNG_USER_PRIVATEBUILD PRIVATEBUILD +#endif +#endif /* __STDC__ */ + +#ifndef PNG_VERSION_INFO_ONLY + +/* End of material added to libpng-1.2.8 */ + /* This is the size of the compression buffer, and thus the size of * an IDAT chunk. Make this whatever size you feel is best for your * machine. One of these will be allocated per png_struct. When this @@ -252,8 +301,11 @@ # undef _BSD_SOURCE # endif # ifdef _SETJMP_H - __png.h__ already includes setjmp.h; - __dont__ include it again.; + /* If you encounter a compiler error here, see the explanation + * near the end of INSTALL. + */ + __png.h__ already includes setjmp.h; + __dont__ include it again.; # endif # endif /* __linux__ */ @@ -317,15 +369,13 @@ # define PNG_ALWAYS_EXTERN #endif -/* For some reason, Borland C++ defines memcmp, etc. in mem.h, not - * stdlib.h like it should (I think). Or perhaps this is a C++ - * "feature"? - */ -#ifdef __TURBOC__ +/* This provides the non-ANSI (far) memory allocation routines. */ +#if defined(__TURBOC__) && defined(__MSDOS__) # include -# include "alloc.h" +# include #endif +/* I have no idea why is this necessary... */ #if defined(_MSC_VER) && (defined(WIN32) || defined(_Windows) || \ defined(_WINDOWS) || defined(_WIN32) || defined(__WIN32__)) # include @@ -583,13 +633,6 @@ # endif #endif /* PNG_WRITE_TRANSFORMS_SUPPORTED */ -#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \ - defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED) -# ifndef PNG_NO_USER_TRANSFORM_PTR -# define PNG_USER_TRANSFORM_PTR_SUPPORTED -# endif -#endif - #define PNG_WRITE_INTERLACING_SUPPORTED /* not required for PNG-compliant encoders, but can cause trouble if left undefined */ @@ -599,12 +642,6 @@ # define PNG_WRITE_WEIGHTED_FILTER_SUPPORTED #endif -#ifndef PNG_1_0_X -#ifndef PNG_NO_ERROR_NUMBERS -#define PNG_ERROR_NUMBERS_SUPPORTED -#endif -#endif /* PNG_1_0_X */ - #ifndef PNG_NO_WRITE_FLUSH # define PNG_WRITE_FLUSH_SUPPORTED #endif @@ -616,6 +653,19 @@ #endif /* PNG_WRITE_SUPPORTED */ +#ifndef PNG_1_0_X +# ifndef PNG_NO_ERROR_NUMBERS +# define PNG_ERROR_NUMBERS_SUPPORTED +# endif +#endif /* PNG_1_0_X */ + +#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \ + defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED) +# ifndef PNG_NO_USER_TRANSFORM_PTR +# define PNG_USER_TRANSFORM_PTR_SUPPORTED +# endif +#endif + #ifndef PNG_NO_STDIO # define PNG_TIME_RFC1123_SUPPORTED #endif @@ -663,6 +713,25 @@ #endif #endif /* PNG_1_0_X */ +/* Added at libpng-1.2.6 */ +#if !defined(PNG_1_0_X) +#ifndef PNG_SET_USER_LIMITS_SUPPORTED +#if !defined(PNG_NO_SET_USER_LIMITS) && !defined(PNG_SET_USER_LIMITS_SUPPORTED) +# define PNG_SET_USER_LIMITS_SUPPORTED +#endif +#endif +#endif /* PNG_1_0_X */ + +/* Added at libpng-1.0.16 and 1.2.6. To accept all valid PNGS no matter + * how large, set these limits to 0x7fffffffL + */ +#ifndef PNG_USER_WIDTH_MAX +# define PNG_USER_WIDTH_MAX 1000000L +#endif +#ifndef PNG_USER_HEIGHT_MAX +# define PNG_USER_HEIGHT_MAX 1000000L +#endif + /* These are currently experimental features, define them if you want */ /* very little testing */ @@ -677,10 +746,8 @@ /* This is only for PowerPC big-endian and 680x0 systems */ /* some testing */ /* -#ifdef PNG_READ_SUPPORTED -# ifndef PNG_PNG_READ_BIG_ENDIAN_SUPPORTED -# define PNG_READ_BIG_ENDIAN_SUPPORTED -# endif +#ifndef PNG_READ_BIG_ENDIAN_SUPPORTED +# define PNG_READ_BIG_ENDIAN_SUPPORTED #endif */ @@ -988,7 +1055,13 @@ typedef unsigned char png_byte; /* This is usually size_t. It is typedef'ed just in case you need it to change (I'm not sure if you will or not, so I thought I'd be safe) */ -typedef size_t png_size_t; +#ifdef PNG_SIZE_T + typedef PNG_SIZE_T png_size_t; +# define png_sizeof(x) png_convert_size(sizeof (x)) +#else + typedef size_t png_size_t; +# define png_sizeof(x) sizeof (x) +#endif /* The following is needed for medium model support. It cannot be in the * PNG_INTERNAL section. Needs modification for other compilers besides @@ -1092,6 +1165,9 @@ typedef double FAR * FAR * png_doublepp; /* Pointers to pointers to pointers; i.e., pointer to array */ typedef char FAR * FAR * FAR * png_charppp; +#if defined(PNG_1_0_X) || defined(PNG_1_2_X) +/* SPC - Is this stuff deprecated? */ +/* It'll be removed as of libpng-1.3.0 - GR-P */ /* libpng typedefs for types in zlib. If zlib changes * or another compression library is used, then change these. * Eliminates need to change all the source files. @@ -1099,6 +1175,7 @@ typedef char FAR * FAR * FAR * png_charppp; typedef charf * png_zcharp; typedef charf * FAR * png_zcharpp; typedef z_stream FAR * png_zstreamp; +#endif /* (PNG_1_0_X) || defined(PNG_1_2_X) */ /* * Define PNG_BUILD_DLL if the module being built is a Windows @@ -1171,8 +1248,6 @@ typedef z_stream FAR * png_zstreamp; * zlib and your applications the same way you build libpng. */ -#ifndef PNGAPI - #if defined(__MINGW32__) && !defined(PNG_MODULEDEF) # ifndef PNG_NO_MODULEDEF # define PNG_NO_MODULEDEF @@ -1187,10 +1262,12 @@ typedef z_stream FAR * png_zstreamp; (( defined(_Windows) || defined(_WINDOWS) || \ defined(WIN32) || defined(_WIN32) || defined(__WIN32__) )) -# if defined(__GNUC__) || (defined (_MSC_VER) && (_MSC_VER >= 800)) -# define PNGAPI __cdecl -# else -# define PNGAPI _cdecl +# ifndef PNGAPI +# if defined(__GNUC__) || (defined (_MSC_VER) && (_MSC_VER >= 800)) +# define PNGAPI __cdecl +# else +# define PNGAPI _cdecl +# endif # endif # if !defined(PNG_IMPEXP) && (!defined(PNG_DLL) || \ @@ -1228,17 +1305,14 @@ typedef z_stream FAR * png_zstreamp; # endif # endif /* PNG_IMPEXP */ #else /* !(DLL || non-cygwin WINDOWS) */ -# if (defined(__IBMC__) || defined(IBMCPP__)) && defined(__OS2__) -# define PNGAPI _System -# define PNG_IMPEXP -# else -# if 0 /* ... other platforms, with other meanings */ -# else -# define PNGAPI -# define PNG_IMPEXP +# if (defined(__IBMC__) || defined(__IBMCPP__)) && defined(__OS2__) +# ifndef PNGAPI +# define PNGAPI _System # endif -# endif -#endif +# else +# if 0 /* ... other platforms, with other meanings */ +# endif +# endif #endif #ifndef PNGAPI @@ -1248,6 +1322,17 @@ typedef z_stream FAR * png_zstreamp; # define PNG_IMPEXP #endif +#ifdef PNG_BUILDSYMS +# ifndef PNG_EXPORT +# define PNG_EXPORT(type,symbol) PNG_FUNCTION_EXPORT symbol END +# endif +# ifdef PNG_USE_GLOBAL_ARRAYS +# ifndef PNG_EXPORT_VAR +# define PNG_EXPORT_VAR(type) PNG_DATA_EXPORT +# endif +# endif +#endif + #ifndef PNG_EXPORT # define PNG_EXPORT(type,symbol) PNG_IMPEXP type PNGAPI symbol #endif @@ -1279,28 +1364,30 @@ typedef z_stream FAR * png_zstreamp; # define NOCHECK 0 # define CVT_PTR(ptr) (png_far_to_near(png_ptr,ptr,CHECK)) # define CVT_PTR_NOCHECK(ptr) (png_far_to_near(png_ptr,ptr,NOCHECK)) -# define png_strcpy _fstrcpy -# define png_strlen _fstrlen -# define png_memcmp _fmemcmp /* SJT: added */ -# define png_memcpy _fmemcpy -# define png_memset _fmemset +# define png_strcpy _fstrcpy +# define png_strncpy _fstrncpy /* Added to v 1.2.6 */ +# define png_strlen _fstrlen +# define png_memcmp _fmemcmp /* SJT: added */ +# define png_memcpy _fmemcpy +# define png_memset _fmemset #else /* use the usual functions */ # define CVT_PTR(ptr) (ptr) # define CVT_PTR_NOCHECK(ptr) (ptr) -# define png_strcpy strcpy -# define png_strlen strlen -# define png_memcmp memcmp /* SJT: added */ -# define png_memcpy memcpy -# define png_memset memset +# define png_strcpy strcpy +# define png_strncpy strncpy /* Added to v 1.2.6 */ +# define png_strlen strlen +# define png_memcmp memcmp /* SJT: added */ +# define png_memcpy memcpy +# define png_memset memset #endif /* End of memory model independent support */ /* Just a little check that someone hasn't tried to define something * contradictory. */ -#if (PNG_ZBUF_SIZE > 65536) && defined(PNG_MAX_MALLOC_64K) +#if (PNG_ZBUF_SIZE > 65536L) && defined(PNG_MAX_MALLOC_64K) # undef PNG_ZBUF_SIZE -# define PNG_ZBUF_SIZE 65536 +# define PNG_ZBUF_SIZE 65536L #endif #ifdef PNG_READ_SUPPORTED @@ -1344,5 +1431,7 @@ typedef z_stream FAR * png_zstreamp; #endif /* PNG_INTERNAL */ #endif /* PNG_READ_SUPPORTED */ -#endif /* PNGCONF_H */ +/* Added at libpng-1.2.8 */ +#endif /* PNG_VERSION_INFO_ONLY */ +#endif /* PNGCONF_H */ diff --git a/src/libs/png/pngerror.c b/src/libs/png/pngerror.c index fc3c304779..6fa4012378 100644 --- a/src/libs/png/pngerror.c +++ b/src/libs/png/pngerror.c @@ -1,9 +1,9 @@ /* pngerror.c - stub functions for i/o and memory allocation * - * libpng 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -35,9 +35,9 @@ png_error(png_structp png_ptr, png_const_charp error_message) char msg[16]; if (png_ptr->flags&(PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT)) { - int offset = 0; if (*error_message == '#') { + int offset; for (offset=1; offset<15; offset++) if (*(error_message+offset) == ' ') break; @@ -63,11 +63,11 @@ png_error(png_structp png_ptr, png_const_charp error_message) } } #endif - if (png_ptr->error_fn != NULL) + if (png_ptr != NULL && png_ptr->error_fn != NULL) (*(png_ptr->error_fn))(png_ptr, error_message); - /* if the following returns or doesn't exist, use the default function, - which will not return */ + /* If the custom handler doesn't exist, or if it returns, + use the default handler, which will not return. */ png_default_error(png_ptr, error_message); } @@ -79,7 +79,7 @@ png_error(png_structp png_ptr, png_const_charp error_message) void PNGAPI png_warning(png_structp png_ptr, png_const_charp warning_message) { - int offset = 0; + int offset = 0; #ifdef PNG_ERROR_NUMBERS_SUPPORTED if (png_ptr->flags&(PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT)) #endif @@ -91,11 +91,10 @@ png_warning(png_structp png_ptr, png_const_charp warning_message) break; } } - if (png_ptr->warning_fn != NULL) - (*(png_ptr->warning_fn))(png_ptr, - (png_const_charp)(warning_message+offset)); + if (png_ptr != NULL && png_ptr->warning_fn != NULL) + (*(png_ptr->warning_fn))(png_ptr, warning_message+offset); else - png_default_warning(png_ptr, (png_const_charp)(warning_message+offset)); + png_default_warning(png_ptr, warning_message+offset); } /* These utilities are used internally to build an error message that relates @@ -104,10 +103,11 @@ png_warning(png_structp png_ptr, png_const_charp warning_message) * to 63 bytes, the name characters are output as hex digits wrapped in [] * if the character is invalid. */ -#define isnonalpha(c) ((c) < 41 || (c) > 122 || ((c) > 90 && (c) < 97)) +#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97)) static PNG_CONST char png_digit[16] = { - '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', - 'F' }; + '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', + 'A', 'B', 'C', 'D', 'E', 'F' +}; static void /* PRIVATE */ png_format_buffer(png_structp png_ptr, png_charp buffer, png_const_charp @@ -137,7 +137,7 @@ png_format_buffer(png_structp png_ptr, png_charp buffer, png_const_charp { buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, error_message, 64); + png_strncpy(buffer+iout, error_message, 63); buffer[iout+63] = 0; } } @@ -190,26 +190,28 @@ png_default_error(png_structp png_ptr, png_const_charp error_message) else #endif fprintf(stderr, "libpng error: %s\n", error_message); -#else - if (error_message) - /* make compiler happy */ ; #endif #ifdef PNG_SETJMP_SUPPORTED # ifdef USE_FAR_KEYWORD { jmp_buf jmpbuf; - png_memcpy(jmpbuf,png_ptr->jmpbuf,sizeof(jmp_buf)); + png_memcpy(jmpbuf,png_ptr->jmpbuf,png_sizeof(jmp_buf)); longjmp(jmpbuf, 1); } # else longjmp(png_ptr->jmpbuf, 1); # endif #else + /* make compiler happy */ ; if (png_ptr) - /* make compiler happy */ ; PNG_ABORT(); #endif +#ifdef PNG_NO_CONSOLE_IO + /* make compiler happy */ ; + if (&error_message != NULL) + return; +#endif } /* This function is called when there is a warning, but the library thinks @@ -245,9 +247,11 @@ png_default_warning(png_structp png_ptr, png_const_charp warning_message) # endif fprintf(stderr, "libpng warning: %s\n", warning_message); #else + /* make compiler happy */ ; if (warning_message) - /* appease compiler */ ; + return; #endif + /* make compiler happy */ ; if (png_ptr) return; } diff --git a/src/libs/png/pnggccrd.c b/src/libs/png/pnggccrd.c index 8d81c31471..248e1b3bb4 100644 --- a/src/libs/png/pnggccrd.c +++ b/src/libs/png/pnggccrd.c @@ -6,9 +6,9 @@ * and http://www.intel.com/drg/pentiumII/appnotes/923/923.htm * for Intel's performance analysis of the MMX vs. non-MMX code. * - * libpng version 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * Copyright (c) 1998, Intel Corporation * * Based on MSVC code contributed by Nirav Chhatrapati, Intel Corp., 1998. @@ -223,6 +223,10 @@ * 20020304: * - eliminated incorrect use of width_mmx in pixel_bytes == 8 case * + * 20040724: + * - more tinkering with clobber list at lines 4529 and 5033, to get + * it to compile on gcc-3.4. + * * STILL TO DO: * - test png_do_read_interlace() 64-bit case (pixel_bytes == 8) * - write MMX code for 48-bit case (pixel_bytes == 6) @@ -412,8 +416,10 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask) #if defined(PNG_ASSEMBLER_CODE_SUPPORTED) if (_mmx_supported == 2) { +#if !defined(PNG_1_0_X) /* this should have happened in png_init_mmx_flags() already */ png_warning(png_ptr, "asm_flags may not have been initialized"); +#endif png_mmx_support(); } #endif @@ -422,7 +428,7 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask) { png_debug(2,"mask == 0xff: doing single png_memcpy()\n"); png_memcpy(row, png_ptr->row_buf + 1, - (png_size_t)((png_ptr->width * png_ptr->row_info.pixel_depth + 7) >> 3)); + (png_size_t)PNG_ROWBYTES(png_ptr->row_info.pixel_depth,png_ptr->width)); } else /* (png_combine_row() is never called with mask == 0) */ { @@ -1767,8 +1773,8 @@ png_do_read_interlace(png_structp png_ptr) : "1" (sptr), // esi // input regs "2" (dp), // edi - "0" (width) // ecx -// doesn't work "i" (0x0000000000FFFFFFLL) // %1 (a.k.a. _const4) + "0" (width), // ecx + "rim" (_const4) // %1(?) (0x0000000000FFFFFFLL) #if 0 /* %mm0, ..., %mm4 not supported by gcc 2.7.2.3 or egcs 1.1 */ : "%mm0", "%mm1", "%mm2" // clobber list @@ -1811,7 +1817,8 @@ png_do_read_interlace(png_structp png_ptr) : "1" (sptr), // esi // input regs "2" (dp), // edi - "0" (width) // ecx + "0" (width), // ecx + "rim" (_const4) // (0x0000000000FFFFFFLL) #if 0 /* %mm0, ..., %mm2 not supported by gcc 2.7.2.3 or egcs 1.1 */ : "%mm0", "%mm1", "%mm2" // clobber list @@ -1865,7 +1872,9 @@ png_do_read_interlace(png_structp png_ptr) : "1" (sptr), // esi // input regs "2" (dp), // edi - "0" (width_mmx) // ecx + "0" (width_mmx), // ecx + "rim" (_const4), // 0x0000000000FFFFFFLL + "rim" (_const6) // 0x00000000000000FFLL #if 0 /* %mm0, ..., %mm3 not supported by gcc 2.7.2.3 or egcs 1.1 */ : "%mm0", "%mm1" // clobber list @@ -2727,8 +2736,8 @@ png_do_read_interlace(png_structp png_ptr) } /* end switch (row_info->pixel_depth) */ row_info->width = final_width; - row_info->rowbytes = ((final_width * - (png_uint_32)row_info->pixel_depth + 7) >> 3); + + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,final_width); } } /* end png_do_read_interlace() */ @@ -4529,8 +4538,7 @@ png_read_filter_row_mmx_sub(png_row_infop row_info, png_bytep row) : "0" (bpp), // eax // input regs "1" (row) // edi - : "%ebx", "%ecx", "%edx" // clobber list - , "%esi" + : "%esi", "%ecx", "%edx" // clobber list #if 0 /* MMX regs (%mm0, etc.) not supported by gcc 2.7.2.3 or egcs 1.1 */ , "%mm0", "%mm1", "%mm2", "%mm3" @@ -4990,7 +4998,7 @@ png_read_filter_row_mmx_up(png_row_infop row_info, png_bytep row, "jz up_end \n\t" "cmpl $8, %%edx \n\t" // test for less than 8 bytes - "jb up_lt8 \n\t" // [added by lcreeve@netins.net] + "jb up_lt8 \n\t" // [added by lcreeve at netins.net] "addl %%edx, %%ecx \n\t" "andl $0x00000007, %%edx \n\t" // calc bytes over mult of 8 @@ -5034,7 +5042,10 @@ png_read_filter_row_mmx_up(png_row_infop row_info, png_bytep row, "1" (prev_row), // esi "2" (row) // edi - : "%eax", "%ebx", "%ecx" // clobber list (no input regs!) + : "%eax", "%ecx" // clobber list (no input regs!) +#ifndef __PIC__ + , "%ebx" +#endif #if 0 /* MMX regs (%mm0, etc.) not supported by gcc 2.7.2.3 or egcs 1.1 */ , "%mm0", "%mm1", "%mm2", "%mm3" diff --git a/src/libs/png/pngget.c b/src/libs/png/pngget.c index f7f5c6702b..8eefa7779e 100644 --- a/src/libs/png/pngget.c +++ b/src/libs/png/pngget.c @@ -1,9 +1,9 @@ /* pngget.c - retrieval of values from info struct * - * libpng 1.2.5 - October 3, 2002 + * libpng 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) */ @@ -540,9 +540,6 @@ png_get_IHDR(png_structp png_ptr, png_infop info_ptr, if (png_ptr != NULL && info_ptr != NULL && width != NULL && height != NULL && bit_depth != NULL && color_type != NULL) { - int pixel_depth, channels; - png_uint_32 rowbytes_per_pixel; - png_debug1(1, "in %s retrieval function\n", "IHDR"); *width = info_ptr->width; *height = info_ptr->height; @@ -560,23 +557,18 @@ png_get_IHDR(png_structp png_ptr, png_infop info_ptr, *interlace_type = info_ptr->interlace_type; /* check for potential overflow of rowbytes */ - if (*color_type == PNG_COLOR_TYPE_PALETTE) - channels = 1; - else if (*color_type & PNG_COLOR_MASK_COLOR) - channels = 3; - else - channels = 1; - if (*color_type & PNG_COLOR_MASK_ALPHA) - channels++; - pixel_depth = *bit_depth * channels; - rowbytes_per_pixel = (pixel_depth + 7) >> 3; - if (width == 0 || *width > PNG_MAX_UINT) + if (*width == 0 || *width > PNG_UINT_31_MAX) png_error(png_ptr, "Invalid image width"); - if (height == 0 || *height > PNG_MAX_UINT) + if (*height == 0 || *height > PNG_UINT_31_MAX) png_error(png_ptr, "Invalid image height"); - if (*width > PNG_MAX_UINT/rowbytes_per_pixel - 64) + if (info_ptr->width > (PNG_UINT_32_MAX + >> 3) /* 8-byte RGBA pixels */ + - 64 /* bigrowbuf hack */ + - 1 /* filter byte */ + - 7*8 /* rounding of width to multiple of 8 pixels */ + - 8) /* extra max_pixel_depth pad */ { - png_error(png_ptr, + png_warning(png_ptr, "Width too large for libpng to process image data."); } return (1); @@ -827,13 +819,13 @@ png_get_user_chunk_ptr(png_structp png_ptr) } #endif - +#ifdef PNG_WRITE_SUPPORTED png_uint_32 PNGAPI png_get_compression_buffer_size(png_structp png_ptr) { return (png_uint_32)(png_ptr? png_ptr->zbuf_size : 0L); } - +#endif #ifndef PNG_1_0_X #ifdef PNG_ASSEMBLER_CODE_SUPPORTED @@ -923,5 +915,20 @@ png_get_mmx_rowbytes_threshold (png_structp png_ptr) { return (png_uint_32)(png_ptr? png_ptr->mmx_rowbytes_threshold : 0L); } -#endif /* PNG_ASSEMBLER_CODE_SUPPORTED */ -#endif /* PNG_1_0_X */ +#endif /* ?PNG_ASSEMBLER_CODE_SUPPORTED */ + +#ifdef PNG_SET_USER_LIMITS_SUPPORTED +/* these functions were added to libpng 1.2.6 */ +png_uint_32 PNGAPI +png_get_user_width_max (png_structp png_ptr) +{ + return (png_ptr? png_ptr->user_width_max : 0); +} +png_uint_32 PNGAPI +png_get_user_height_max (png_structp png_ptr) +{ + return (png_ptr? png_ptr->user_height_max : 0); +} +#endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */ + +#endif /* ?PNG_1_0_X */ diff --git a/src/libs/png/pngmem.c b/src/libs/png/pngmem.c index 66eec0b09f..f1cb69395e 100644 --- a/src/libs/png/pngmem.c +++ b/src/libs/png/pngmem.c @@ -1,9 +1,9 @@ /* pngmem.c - stub functions for memory allocation * - * libpng 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -39,11 +39,11 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr) png_voidp struct_ptr; if (type == PNG_STRUCT_INFO) - size = sizeof(png_info); + size = png_sizeof(png_info); else if (type == PNG_STRUCT_PNG) - size = sizeof(png_struct); + size = png_sizeof(png_struct); else - return (png_get_copyright()); + return (png_get_copyright(NULL)); #ifdef PNG_USER_MEM_SUPPORTED if(malloc_fn != NULL) @@ -55,7 +55,7 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr) } else #endif /* PNG_USER_MEM_SUPPORTED */ - struct_ptr = (png_voidp)farmalloc(size)); + struct_ptr = (png_voidp)farmalloc(size); if (struct_ptr != NULL) png_memset(struct_ptr, 0, size); return (struct_ptr); @@ -121,14 +121,12 @@ png_malloc(png_structp png_ptr, png_uint_32 size) #ifdef PNG_USER_MEM_SUPPORTED if(png_ptr->malloc_fn != NULL) - { ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size)); - if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) - png_error(png_ptr, "Out of memory!"); - return (ret); - } else - return png_malloc_default(png_ptr, size); + ret = (png_malloc_default(png_ptr, size)); + if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) + png_error(png_ptr, "Out of memory!"); + return (ret); } png_voidp PNGAPI @@ -139,10 +137,16 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) #ifdef PNG_MAX_MALLOC_64K if (size > (png_uint_32)65536L) - png_error(png_ptr, "Cannot Allocate > 64K"); + { + png_warning(png_ptr, "Cannot Allocate > 64K"); + ret = NULL; + } + else #endif - if (size == (png_uint_32)65536L) + if (size != (size_t)size) + ret = NULL; + else if (size == (png_uint_32)65536L) { if (png_ptr->offset_table == NULL) { @@ -177,34 +181,40 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) if (table == NULL) { - if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) +#ifndef PNG_USER_MEM_SUPPORTED + if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out Of Memory."); /* Note "O" and "M" */ else png_warning(png_ptr, "Out Of Memory."); +#endif return (NULL); } if ((png_size_t)table & 0xfff0) { - if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) +#ifndef PNG_USER_MEM_SUPPORTED + if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Farmalloc didn't return normalized pointer"); else png_warning(png_ptr, "Farmalloc didn't return normalized pointer"); +#endif return (NULL); } png_ptr->offset_table = table; png_ptr->offset_table_ptr = farmalloc(num_blocks * - sizeof (png_bytep)); + png_sizeof (png_bytep)); if (png_ptr->offset_table_ptr == NULL) { - if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) +#ifndef PNG_USER_MEM_SUPPORTED + if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out Of memory."); /* Note "O" and "M" */ else png_warning(png_ptr, "Out Of memory."); +#endif return (NULL); } @@ -228,10 +238,12 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) if (png_ptr->offset_table_count >= png_ptr->offset_table_number) { - if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) +#ifndef PNG_USER_MEM_SUPPORTED + if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out of Memory."); /* Note "o" and "M" */ else png_warning(png_ptr, "Out of Memory."); +#endif return (NULL); } @@ -240,13 +252,15 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) else ret = farmalloc(size); +#ifndef PNG_USER_MEM_SUPPORTED if (ret == NULL) { - if (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) + if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out of memory."); /* Note "o" and "m" */ else png_warning(png_ptr, "Out of memory."); /* Note "o" and "m" */ } +#endif return (ret); } @@ -325,9 +339,9 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr) png_voidp struct_ptr; if (type == PNG_STRUCT_INFO) - size = sizeof(png_info); + size = png_sizeof(png_info); else if (type == PNG_STRUCT_PNG) - size = sizeof(png_struct); + size = png_sizeof(png_struct); else return (NULL); @@ -345,17 +359,16 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr) #endif /* PNG_USER_MEM_SUPPORTED */ #if defined(__TURBOC__) && !defined(__FLAT__) - if ((struct_ptr = (png_voidp)farmalloc(size)) != NULL) + struct_ptr = (png_voidp)farmalloc(size); #else # if defined(_MSC_VER) && defined(MAXSEG_64K) - if ((struct_ptr = (png_voidp)halloc(size,1)) != NULL) + struct_ptr = (png_voidp)halloc(size,1); # else - if ((struct_ptr = (png_voidp)malloc(size)) != NULL) + struct_ptr = (png_voidp)malloc(size); # endif #endif - { + if (struct_ptr != NULL) png_memset(struct_ptr, 0, size); - } return (struct_ptr); } @@ -410,19 +423,17 @@ png_malloc(png_structp png_ptr, png_uint_32 size) { png_voidp ret; +#ifdef PNG_USER_MEM_SUPPORTED if (png_ptr == NULL || size == 0) return (NULL); -#ifdef PNG_USER_MEM_SUPPORTED if(png_ptr->malloc_fn != NULL) - { ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size)); - if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) - png_error(png_ptr, "Out of Memory!"); - return (ret); - } else - return (png_malloc_default(png_ptr, size)); + ret = (png_malloc_default(png_ptr, size)); + if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) + png_error(png_ptr, "Out of Memory!"); + return (ret); } png_voidp PNGAPI @@ -431,28 +442,45 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) png_voidp ret; #endif /* PNG_USER_MEM_SUPPORTED */ + if (png_ptr == NULL || size == 0) + return (NULL); + #ifdef PNG_MAX_MALLOC_64K if (size > (png_uint_32)65536L) { +#ifndef PNG_USER_MEM_SUPPORTED if(png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Cannot Allocate > 64K"); else +#endif return NULL; } #endif + /* Check for overflow */ #if defined(__TURBOC__) && !defined(__FLAT__) + if (size != (unsigned long)size) + ret = NULL; + else ret = farmalloc(size); #else # if defined(_MSC_VER) && defined(MAXSEG_64K) + if (size != (unsigned long)size) + ret = NULL; + else ret = halloc(size, 1); # else + if (size != (size_t)size) + ret = NULL; + else ret = malloc((size_t)size); # endif #endif +#ifndef PNG_USER_MEM_SUPPORTED if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out of Memory"); +#endif return (ret); } @@ -498,8 +526,9 @@ png_free_default(png_structp png_ptr, png_voidp ptr) # define png_malloc_warn png_malloc #else /* This function was added at libpng version 1.2.3. The png_malloc_warn() - * function will issue a png_warning and return NULL instead of issuing a - * png_error, if it fails to allocate the requested memory. + * function will set up png_malloc() to issue a png_warning and return NULL + * instead of issuing a png_error, if it fails to allocate the requested + * memory. */ png_voidp PNGAPI png_malloc_warn(png_structp png_ptr, png_uint_32 size) diff --git a/src/libs/png/pngpread.c b/src/libs/png/pngpread.c index 9f924c34cc..8c35faae44 100644 --- a/src/libs/png/pngpread.c +++ b/src/libs/png/pngpread.c @@ -1,9 +1,9 @@ /* pngpread.c - read a png file in push mode * - * libpng 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) */ @@ -208,7 +208,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr) } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@ -223,6 +223,41 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr) } png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length); } + else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4)) + { + if (png_ptr->push_length + 4 > png_ptr->buffer_size) + { + png_push_save_buffer(png_ptr); + return; + } + png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length); + + png_ptr->process_mode = PNG_READ_DONE_MODE; + png_push_have_end(png_ptr, info_ptr); + } +#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED + else if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name)) + { + if (png_ptr->push_length + 4 > png_ptr->buffer_size) + { + png_push_save_buffer(png_ptr); + return; + } + if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) + png_ptr->mode |= PNG_HAVE_IDAT; + png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length); + if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4)) + png_ptr->mode |= PNG_HAVE_PLTE; + else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) + { + if (!(png_ptr->mode & PNG_HAVE_IHDR)) + png_error(png_ptr, "Missing IHDR before IDAT"); + else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE && + !(png_ptr->mode & PNG_HAVE_PLTE)) + png_error(png_ptr, "Missing PLTE before IDAT"); + } + } +#endif else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4)) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) @@ -261,18 +296,6 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr) png_ptr->zstream.next_out = png_ptr->row_buf; return; } - else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4)) - { - if (png_ptr->push_length + 4 > png_ptr->buffer_size) - { - png_push_save_buffer(png_ptr); - return; - } - png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length); - - png_ptr->process_mode = PNG_READ_DONE_MODE; - png_push_have_end(png_ptr, info_ptr); - } #if defined(PNG_READ_gAMA_SUPPORTED) else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4)) { @@ -591,6 +614,11 @@ png_push_save_buffer(png_structp png_ptr) png_size_t new_max; png_bytep old_buffer; + if (png_ptr->save_buffer_size > PNG_SIZE_MAX - + (png_ptr->current_buffer_size + 256)) + { + png_error(png_ptr, "Potential overflow of save_buffer"); + } new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, @@ -637,8 +665,7 @@ png_push_read_IDAT(png_structp png_ptr) } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); - + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@ -753,7 +780,7 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer, png_ptr->interlaced && png_ptr->pass > 6) || (!png_ptr->interlaced && #endif - png_ptr->row_number == png_ptr->num_rows-1)) + png_ptr->row_number == png_ptr->num_rows)) { if (png_ptr->zstream.avail_in) png_warning(png_ptr, "Too much data in IDAT chunks"); @@ -778,8 +805,8 @@ png_push_process_row(png_structp png_ptr) png_ptr->row_info.bit_depth = png_ptr->bit_depth; png_ptr->row_info.pixel_depth = png_ptr->pixel_depth; - png_ptr->row_info.rowbytes = ((png_ptr->row_info.width * - (png_uint_32)png_ptr->row_info.pixel_depth + 7) >> 3); + png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth, + png_ptr->row_info.width); png_read_filter_row(png_ptr, &(png_ptr->row_info), png_ptr->row_buf + 1, png_ptr->prev_row + 1, @@ -788,7 +815,7 @@ png_push_process_row(png_structp png_ptr) png_memcpy_check(png_ptr, png_ptr->prev_row, png_ptr->row_buf, png_ptr->rowbytes + 1); - if (png_ptr->transformations) + if (png_ptr->transformations || (png_ptr->flags&PNG_FLAG_STRIP_ALPHA)) png_do_read_transformations(png_ptr); #if defined(PNG_READ_INTERLACING_SUPPORTED) @@ -1004,8 +1031,8 @@ png_read_push_finish_row(png_structp png_ptr) png_pass_start[png_ptr->pass]) / png_pass_inc[png_ptr->pass]; - png_ptr->irowbytes = ((png_ptr->iwidth * - png_ptr->pixel_depth + 7) >> 3) + 1; + png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, + png_ptr->iwidth) + 1; if (png_ptr->transformations & PNG_INTERLACE) break; @@ -1094,7 +1121,8 @@ png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr) if (text != key + png_ptr->current_text_size) text++; - text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc(png_ptr, + (png_uint_32)png_sizeof(png_text)); text_ptr->compression = PNG_TEXT_COMPRESSION_NONE; text_ptr->key = key; #ifdef PNG_iTXt_SUPPORTED @@ -1287,7 +1315,8 @@ png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr) key = text; text += key_size; - text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc(png_ptr, + (png_uint_32)png_sizeof(png_text)); text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt; text_ptr->key = key; #ifdef PNG_iTXt_SUPPORTED @@ -1399,7 +1428,8 @@ png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr) if (text != key + png_ptr->current_text_size) text++; - text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc(png_ptr, + (png_uint_32)png_sizeof(png_text)); text_ptr->compression = comp_flag + 2; text_ptr->key = key; text_ptr->lang = lang; @@ -1434,7 +1464,7 @@ png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 { #if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED) if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != - HANDLE_CHUNK_ALWAYS + PNG_HANDLE_CHUNK_ALWAYS #if defined(PNG_READ_USER_CHUNKS_SUPPORTED) && png_ptr->read_user_chunk_fn == NULL #endif @@ -1473,7 +1503,7 @@ png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 { if (!(png_ptr->chunk_name[0] & 0x20)) if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != - HANDLE_CHUNK_ALWAYS) + PNG_HANDLE_CHUNK_ALWAYS) png_chunk_error(png_ptr, "unknown critical chunk"); } png_set_unknown_chunks(png_ptr, info_ptr, &chunk, 1); diff --git a/src/libs/png/pngread.c b/src/libs/png/pngread.c index e91d3e89ca..5924333df3 100644 --- a/src/libs/png/pngread.c +++ b/src/libs/png/pngread.c @@ -1,9 +1,9 @@ /* pngread.c - read a PNG file * - * libpng 1.2.5 - October 3, 2002 + * libpng 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -59,6 +59,12 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, #endif #endif /* PNG_1_0_X */ + /* added at libpng-1.2.6 */ +#ifdef PNG_SET_USER_LIMITS_SUPPORTED + png_ptr->user_width_max=PNG_USER_WIDTH_MAX; + png_ptr->user_height_max=PNG_USER_HEIGHT_MAX; +#endif + #ifdef PNG_SETJMP_SUPPORTED #ifdef USE_FAR_KEYWORD if (setjmp(jmpbuf)) @@ -77,7 +83,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, return (NULL); } #ifdef USE_FAR_KEYWORD - png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf)); #endif #endif @@ -154,7 +160,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, #ifdef USE_FAR_KEYWORD if (setjmp(jmpbuf)) PNG_ABORT(); - png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf)); #else if (setjmp(png_ptr->jmpbuf)) PNG_ABORT(); @@ -166,6 +172,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, /* Initialize PNG structure for reading, and allocate any memory needed. This interface is deprecated in favour of the png_create_read_struct(), and it will eventually disappear. */ +#if defined(PNG_1_0_X) || defined (PNG_1_2_X) #undef png_read_init void PNGAPI png_read_init(png_structp png_ptr) @@ -173,6 +180,7 @@ png_read_init(png_structp png_ptr) /* We only come here via pre-1.0.7-compiled applications */ png_read_init_2(png_ptr, "1.0.6 or earlier", 0, 0); } +#endif void PNGAPI png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver, @@ -180,7 +188,8 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver, { /* We only come here via pre-1.0.12-compiled applications */ #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE) - if(sizeof(png_struct) > png_struct_size || sizeof(png_info) > png_info_size) + if(png_sizeof(png_struct) > png_struct_size || + png_sizeof(png_info) > png_info_size) { char msg[80]; png_ptr->warning_fn=NULL; @@ -195,7 +204,7 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver, png_warning(png_ptr, msg); } #endif - if(sizeof(png_struct) > png_struct_size) + if(png_sizeof(png_struct) > png_struct_size) { png_ptr->error_fn=NULL; #ifdef PNG_ERROR_NUMBERS_SUPPORTED @@ -204,7 +213,7 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver, png_error(png_ptr, "The png struct allocated by the application for reading is too small."); } - if(sizeof(png_info) > png_info_size) + if(png_sizeof(png_info) > png_info_size) { png_ptr->error_fn=NULL; #ifdef PNG_ERROR_NUMBERS_SUPPORTED @@ -247,10 +256,10 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, #ifdef PNG_SETJMP_SUPPORTED /* save jump buffer and error functions */ - png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf)); + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf)); #endif - if(sizeof(png_struct) > png_struct_size) + if(png_sizeof(png_struct) > png_struct_size) { png_destroy_struct(png_ptr); *ptr_ptr = (png_structp)png_create_struct(PNG_STRUCT_PNG); @@ -258,11 +267,17 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, } /* reset all variables to 0 */ - png_memset(png_ptr, 0, sizeof (png_struct)); + png_memset(png_ptr, 0, png_sizeof (png_struct)); #ifdef PNG_SETJMP_SUPPORTED /* restore jump buffer */ - png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf)); + png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf)); +#endif + + /* added at libpng-1.2.6 */ +#ifdef PNG_SET_USER_LIMITS_SUPPORTED + png_ptr->user_width_max=PNG_USER_WIDTH_MAX; + png_ptr->user_height_max=PNG_USER_HEIGHT_MAX; #endif /* initialize zbuf - compression buffer */ @@ -288,6 +303,7 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, png_set_read_fn(png_ptr, png_voidp_NULL, png_rw_ptr_NULL); } +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Read the information before the actual image data. This has been * changed in v0.90 to allow reading a file that already has the magic * bytes read from the stream. You can tell libpng how many bytes have @@ -379,12 +395,12 @@ png_read_info(png_structp png_ptr, png_infop info_ptr) #if defined(PNG_READ_zTXt_SUPPORTED) PNG_zTXt; #endif -#endif /* PNG_GLOBAL_ARRAYS */ +#endif /* PNG_USE_LOCAL_ARRAYS */ png_byte chunk_length[4]; png_uint_32 length; png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@ -392,9 +408,6 @@ png_read_info(png_structp png_ptr, png_infop info_ptr) png_debug2(0, "Reading %s chunk, length=%lu.\n", png_ptr->chunk_name, length); - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); - /* This should be a binary subdivision search or a hash for * matching the chunk name rather than a linear search. */ @@ -507,6 +520,7 @@ png_read_info(png_structp png_ptr, png_infop info_ptr) png_handle_unknown(png_ptr, info_ptr, length); } } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ /* optional call to update the users info_ptr structure */ void PNGAPI @@ -521,6 +535,7 @@ png_read_update_info(png_structp png_ptr, png_infop info_ptr) png_read_transform_info(png_ptr, info_ptr); } +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Initialize palette, background, etc, after transformations * are set, but before any reading takes place. This allows * the user to obtain a gamma-corrected palette, for example. @@ -533,7 +548,9 @@ png_start_read_image(png_structp png_ptr) if (!(png_ptr->flags & PNG_FLAG_ROW_INIT)) png_read_start_row(png_ptr); } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED void PNGAPI png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) { @@ -673,10 +690,7 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); - - if (png_ptr->idat_size > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); + png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@ -712,8 +726,8 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) png_ptr->row_info.channels = png_ptr->channels; png_ptr->row_info.bit_depth = png_ptr->bit_depth; png_ptr->row_info.pixel_depth = png_ptr->pixel_depth; - png_ptr->row_info.rowbytes = ((png_ptr->row_info.width * - (png_uint_32)png_ptr->row_info.pixel_depth + 7) >> 3); + png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth, + png_ptr->row_info.width); if(png_ptr->row_buf[0]) png_read_filter_row(png_ptr, &(png_ptr->row_info), @@ -732,7 +746,8 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) } #endif - if (png_ptr->transformations) + + if (png_ptr->transformations || (png_ptr->flags&PNG_FLAG_STRIP_ALPHA)) png_do_read_transformations(png_ptr); #if defined(PNG_READ_INTERLACING_SUPPORTED) @@ -767,7 +782,9 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) if (png_ptr->read_row_fn != NULL) (*(png_ptr->read_row_fn))(png_ptr, png_ptr->row_number, png_ptr->pass); } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Read one or more rows of image data. If the image is interlaced, * and png_set_interlace_handling() has been called, the rows need to * contain the contents of the rows from the previous pass. If the @@ -789,7 +806,7 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) * not called png_set_interlace_handling(), the display_row buffer will * be ignored, so pass NULL to it. * - * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.5 + * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.8 */ void PNGAPI @@ -826,7 +843,9 @@ png_read_rows(png_structp png_ptr, png_bytepp row, dp++; } } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Read the entire image. If the image has an alpha channel or a tRNS * chunk, and you have called png_handle_alpha()[*], you will need to * initialize the image to the current image that PNG will be overlaying. @@ -837,7 +856,7 @@ png_read_rows(png_structp png_ptr, png_bytepp row, * only call this function once. If you desire to have an image for * each pass of a interlaced image, use png_read_rows() instead. * - * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.5 + * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.8 */ void PNGAPI png_read_image(png_structp png_ptr, png_bytepp image) @@ -871,7 +890,9 @@ png_read_image(png_structp png_ptr, png_bytepp image) } } } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Read the end of the PNG file. Will not read past the end of the * file, will verify the end is accurate, and will read any comments * or time information at the end of the file, if info is not NULL. @@ -943,19 +964,16 @@ png_read_end(png_structp png_ptr, png_infop info_ptr) #if defined(PNG_READ_zTXt_SUPPORTED) PNG_zTXt; #endif -#endif /* PNG_GLOBAL_ARRAYS */ +#endif /* PNG_USE_LOCAL_ARRAYS */ png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name); - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); - if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4)) png_handle_IHDR(png_ptr, info_ptr, length); else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4)) @@ -1058,6 +1076,7 @@ png_read_end(png_structp png_ptr, png_infop info_ptr) png_handle_unknown(png_ptr, info_ptr, length); } while (!(png_ptr->mode & PNG_HAVE_IEND)); } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ /* free all memory used by the read */ void PNGAPI @@ -1067,8 +1086,8 @@ png_destroy_read_struct(png_structpp png_ptr_ptr, png_infopp info_ptr_ptr, png_structp png_ptr = NULL; png_infop info_ptr = NULL, end_info_ptr = NULL; #ifdef PNG_USER_MEM_SUPPORTED - png_free_ptr free_fn = NULL; - png_voidp mem_ptr = NULL; + png_free_ptr free_fn; + png_voidp mem_ptr; #endif png_debug(1, "in png_destroy_read_struct\n"); @@ -1249,7 +1268,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr * being used again. */ #ifdef PNG_SETJMP_SUPPORTED - png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf)); + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf)); #endif error_fn = png_ptr->error_fn; @@ -1259,7 +1278,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr free_fn = png_ptr->free_fn; #endif - png_memset(png_ptr, 0, sizeof (png_struct)); + png_memset(png_ptr, 0, png_sizeof (png_struct)); png_ptr->error_fn = error_fn; png_ptr->warning_fn = warning_fn; @@ -1269,7 +1288,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr #endif #ifdef PNG_SETJMP_SUPPORTED - png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf)); + png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf)); #endif } @@ -1280,6 +1299,8 @@ png_set_read_status_fn(png_structp png_ptr, png_read_status_ptr read_row_fn) png_ptr->read_row_fn = read_row_fn; } + +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED #if defined(PNG_INFO_IMAGE_SUPPORTED) void PNGAPI png_read_png(png_structp png_ptr, png_infop info_ptr, @@ -1289,34 +1310,38 @@ png_read_png(png_structp png_ptr, png_infop info_ptr, int row; #if defined(PNG_READ_INVERT_ALPHA_SUPPORTED) - /* invert the alpha channel from opacity to transparency */ + /* invert the alpha channel from opacity to transparency + */ if (transforms & PNG_TRANSFORM_INVERT_ALPHA) png_set_invert_alpha(png_ptr); #endif - /* The call to png_read_info() gives us all of the information from the + /* png_read_info() gives us all of the information from the * PNG file before the first IDAT (image data chunk). */ png_read_info(png_ptr, info_ptr); + if (info_ptr->height > PNG_UINT_32_MAX/png_sizeof(png_bytep)) + png_error(png_ptr,"Image is too high to process with png_read_png()"); /* -------------- image transformations start here ------------------- */ #if defined(PNG_READ_16_TO_8_SUPPORTED) - /* tell libpng to strip 16 bit/color files down to 8 bits/color */ + /* tell libpng to strip 16 bit/color files down to 8 bits per color + */ if (transforms & PNG_TRANSFORM_STRIP_16) png_set_strip_16(png_ptr); #endif #if defined(PNG_READ_STRIP_ALPHA_SUPPORTED) - /* Strip alpha bytes from the input data without combining with the - * background (not recommended). + /* Strip alpha bytes from the input data without combining with + * the background (not recommended). */ if (transforms & PNG_TRANSFORM_STRIP_ALPHA) png_set_strip_alpha(png_ptr); #endif #if defined(PNG_READ_PACK_SUPPORTED) && !defined(PNG_READ_EXPAND_SUPPORTED) - /* Extract multiple pixels with bit depths of 1, 2, and 4 from a single + /* Extract multiple pixels with bit depths of 1, 2, or 4 from a single * byte into separate bytes (useful for paletted and grayscale images). */ if (transforms & PNG_TRANSFORM_PACKING) @@ -1325,7 +1350,8 @@ png_read_png(png_structp png_ptr, png_infop info_ptr, #if defined(PNG_READ_PACKSWAP_SUPPORTED) /* Change the order of packed pixels to least significant bit first - * (not useful if you are using png_set_packing). */ + * (not useful if you are using png_set_packing). + */ if (transforms & PNG_TRANSFORM_PACKSWAP) png_set_packswap(png_ptr); #endif @@ -1343,10 +1369,12 @@ png_read_png(png_structp png_ptr, png_infop info_ptr, png_set_expand(png_ptr); #endif - /* We don't handle background color or gamma transformation or dithering. */ + /* We don't handle background color or gamma transformation or dithering. + */ #if defined(PNG_READ_INVERT_SUPPORTED) - /* invert monochrome files to have 0 as white and 1 as black */ + /* invert monochrome files to have 0 as white and 1 as black + */ if (transforms & PNG_TRANSFORM_INVERT_MONO) png_set_invert_mono(png_ptr); #endif @@ -1367,19 +1395,22 @@ png_read_png(png_structp png_ptr, png_infop info_ptr, #endif #if defined(PNG_READ_BGR_SUPPORTED) - /* flip the RGB pixels to BGR (or RGBA to BGRA) */ + /* flip the RGB pixels to BGR (or RGBA to BGRA) + */ if (transforms & PNG_TRANSFORM_BGR) png_set_bgr(png_ptr); #endif #if defined(PNG_READ_SWAP_ALPHA_SUPPORTED) - /* swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR) */ + /* swap the RGBA or GA data to ARGB or AG (or BGRA to ABGR) + */ if (transforms & PNG_TRANSFORM_SWAP_ALPHA) png_set_swap_alpha(png_ptr); #endif #if defined(PNG_READ_SWAP_SUPPORTED) - /* swap bytes of 16 bit files to least significant byte first */ + /* swap bytes of 16 bit files to least significant byte first + */ if (transforms & PNG_TRANSFORM_SWAP_ENDIAN) png_set_swap(png_ptr); #endif @@ -1400,7 +1431,7 @@ png_read_png(png_structp png_ptr, png_infop info_ptr, if(info_ptr->row_pointers == NULL) { info_ptr->row_pointers = (png_bytepp)png_malloc(png_ptr, - info_ptr->height * sizeof(png_bytep)); + info_ptr->height * png_sizeof(png_bytep)); #ifdef PNG_FREE_ME_SUPPORTED info_ptr->free_me |= PNG_FREE_ROWS; #endif @@ -1422,3 +1453,4 @@ png_read_png(png_structp png_ptr, png_infop info_ptr, } #endif +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ diff --git a/src/libs/png/pngrio.c b/src/libs/png/pngrio.c index c33b1cdce3..cae501a5ca 100644 --- a/src/libs/png/pngrio.c +++ b/src/libs/png/pngrio.c @@ -1,9 +1,9 @@ /* pngrio.c - functions for data input * - * libpng 1.2.5 - October 3, 2002 + * libpng 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * diff --git a/src/libs/png/pngrtran.c b/src/libs/png/pngrtran.c index 3de91202c1..e1d6e3ce39 100644 --- a/src/libs/png/pngrtran.c +++ b/src/libs/png/pngrtran.c @@ -1,9 +1,9 @@ /* pngrtran.c - transforms the data in a row for PNG readers * - * libpng 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -85,7 +85,8 @@ png_set_background(png_structp png_ptr, } png_ptr->transformations |= PNG_BACKGROUND; - png_memcpy(&(png_ptr->background), background_color, sizeof(png_color_16)); + png_memcpy(&(png_ptr->background), background_color, + png_sizeof(png_color_16)); png_ptr->background_gamma = (float)background_gamma; png_ptr->background_gamma_type = (png_byte)(background_gamma_code); png_ptr->transformations |= (need_expand ? PNG_BACKGROUND_EXPAND : 0); @@ -118,7 +119,7 @@ void PNGAPI png_set_strip_alpha(png_structp png_ptr) { png_debug(1, "in png_set_strip_alpha\n"); - png_ptr->transformations |= PNG_STRIP_ALPHA; + png_ptr->flags |= PNG_FLAG_STRIP_ALPHA; } #endif @@ -154,7 +155,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette, int i; png_ptr->dither_index = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * sizeof (png_byte))); + (png_uint_32)(num_palette * png_sizeof (png_byte))); for (i = 0; i < num_palette; i++) png_ptr->dither_index[i] = (png_byte)i; } @@ -170,7 +171,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette, /* initialize an array to sort colors */ png_ptr->dither_sort = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * sizeof (png_byte))); + (png_uint_32)(num_palette * png_sizeof (png_byte))); /* initialize the dither_sort array */ for (i = 0; i < num_palette; i++) @@ -299,9 +300,9 @@ png_set_dither(png_structp png_ptr, png_colorp palette, /* initialize palette index arrays */ png_ptr->index_to_palette = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * sizeof (png_byte))); + (png_uint_32)(num_palette * png_sizeof (png_byte))); png_ptr->palette_to_index = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * sizeof (png_byte))); + (png_uint_32)(num_palette * png_sizeof (png_byte))); /* initialize the sort array */ for (i = 0; i < num_palette; i++) @@ -311,10 +312,10 @@ png_set_dither(png_structp png_ptr, png_colorp palette, } hash = (png_dsortpp)png_malloc(png_ptr, (png_uint_32)(769 * - sizeof (png_dsortp))); + png_sizeof (png_dsortp))); for (i = 0; i < 769; i++) hash[i] = NULL; -/* png_memset(hash, 0, 769 * sizeof (png_dsortp)); */ +/* png_memset(hash, 0, 769 * png_sizeof (png_dsortp)); */ num_new_palette = num_palette; @@ -344,7 +345,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette, { t = (png_dsortp)png_malloc_warn(png_ptr, - (png_uint_32)(sizeof(png_dsort))); + (png_uint_32)(png_sizeof(png_dsort))); if (t == NULL) break; t->next = hash[d]; @@ -462,14 +463,15 @@ png_set_dither(png_structp png_ptr, png_colorp palette, png_size_t num_entries = ((png_size_t)1 << total_bits); png_ptr->palette_lookup = (png_bytep )png_malloc(png_ptr, - (png_uint_32)(num_entries * sizeof (png_byte))); + (png_uint_32)(num_entries * png_sizeof (png_byte))); - png_memset(png_ptr->palette_lookup, 0, num_entries * sizeof (png_byte)); + png_memset(png_ptr->palette_lookup, 0, num_entries * + png_sizeof (png_byte)); distance = (png_bytep)png_malloc(png_ptr, (png_uint_32)(num_entries * - sizeof(png_byte))); + png_sizeof(png_byte))); - png_memset(distance, 0xff, num_entries * sizeof(png_byte)); + png_memset(distance, 0xff, num_entries * png_sizeof(png_byte)); for (i = 0; i < num_palette; i++) { @@ -480,12 +482,14 @@ png_set_dither(png_structp png_ptr, png_colorp palette, for (ir = 0; ir < num_red; ir++) { - int dr = abs(ir - r); + /* int dr = abs(ir - r); */ + int dr = ((ir > r) ? ir - r : r - ir); int index_r = (ir << (PNG_DITHER_BLUE_BITS + PNG_DITHER_GREEN_BITS)); for (ig = 0; ig < num_green; ig++) { - int dg = abs(ig - g); + /* int dg = abs(ig - g); */ + int dg = ((ig > g) ? ig - g : g - ig); int dt = dr + dg; int dm = ((dr > dg) ? dr : dg); int index_g = index_r | (ig << PNG_DITHER_BLUE_BITS); @@ -493,7 +497,8 @@ png_set_dither(png_structp png_ptr, png_colorp palette, for (ib = 0; ib < num_blue; ib++) { int d_index = index_g | ib; - int db = abs(ib - b); + /* int db = abs(ib - b); */ + int db = ((ib > b) ? ib - b : b - ib); int dmax = ((dm > db) ? dm : db); int d = dmax + dt + db; @@ -1116,7 +1121,7 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr) info_ptr->channels = 1; #if defined(PNG_READ_STRIP_ALPHA_SUPPORTED) - if (png_ptr->transformations & PNG_STRIP_ALPHA) + if (png_ptr->flags & PNG_FLAG_STRIP_ALPHA) info_ptr->color_type &= ~PNG_COLOR_MASK_ALPHA; #endif @@ -1130,8 +1135,10 @@ png_read_transform_info(png_structp png_ptr, png_infop info_ptr) (info_ptr->color_type == PNG_COLOR_TYPE_GRAY))) { info_ptr->channels++; -#if 0 /* if adding a true alpha channel not just filler */ - info_ptr->color_type |= PNG_COLOR_MASK_ALPHA; + /* if adding a true alpha channel not just filler */ +#if !defined(PNG_1_0_X) + if (png_ptr->transformations & PNG_ADD_ALPHA) + info_ptr->color_type |= PNG_COLOR_MASK_ALPHA; #endif } #endif @@ -1149,7 +1156,8 @@ defined(PNG_READ_USER_TRANSFORM_SUPPORTED) info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth); - info_ptr->rowbytes = ((info_ptr->width * info_ptr->pixel_depth + 7) >> 3); + + info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth,info_ptr->width); #if !defined(PNG_READ_EXPAND_SUPPORTED) if(png_ptr) @@ -1201,9 +1209,9 @@ png_do_read_transformations(png_structp png_ptr) #endif #if defined(PNG_READ_STRIP_ALPHA_SUPPORTED) - if (png_ptr->transformations & PNG_STRIP_ALPHA) + if (png_ptr->flags & PNG_FLAG_STRIP_ALPHA) png_do_strip_filler(&(png_ptr->row_info), png_ptr->row_buf + 1, - PNG_FLAG_FILLER_AFTER); + PNG_FLAG_FILLER_AFTER | (png_ptr->flags & PNG_FLAG_STRIP_ALPHA)); #endif #if defined(PNG_READ_RGB_TO_GRAY_SUPPORTED) @@ -1380,8 +1388,8 @@ From Andreas Dilger e-mail to png-implement, 26 March 1998: #endif png_ptr->row_info.pixel_depth = (png_byte)(png_ptr->row_info.bit_depth * png_ptr->row_info.channels); - png_ptr->row_info.rowbytes = (png_ptr->row_info.width * - png_ptr->row_info.pixel_depth+7)>>3; + png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth, + png_ptr->row_info.width); } #endif @@ -1889,8 +1897,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row, /* This changes the data from GG to GGXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@ -1907,8 +1915,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row, /* This changes the data from GG to XXGG */ else { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); @@ -1965,8 +1973,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row, /* This changes the data from RRGGBB to RRGGBBXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@ -1987,8 +1995,8 @@ png_do_read_filler(png_row_infop row_info, png_bytep row, /* This changes the data from RRGGBB to XXRRGGBB */ else { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); @@ -2087,8 +2095,7 @@ png_do_gray_to_rgb(png_row_infop row_info, png_bytep row) row_info->color_type |= PNG_COLOR_MASK_COLOR; row_info->pixel_depth = (png_byte)(row_info->channels * row_info->bit_depth); - row_info->rowbytes = ((row_width * - row_info->pixel_depth + 7) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width); } } #endif @@ -2097,7 +2104,7 @@ png_do_gray_to_rgb(png_row_infop row_info, png_bytep row) /* reduce RGB files to grayscale, with or without alpha * using the equation given in Poynton's ColorFAQ at * - * Copyright (c) 1998-01-04 Charles Poynton poynton@inforamp.net + * Copyright (c) 1998-01-04 Charles Poynton poynton at inforamp.net * * Y = 0.212671 * R + 0.715160 * G + 0.072169 * B * @@ -2271,7 +2278,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row) png_byte blue = *(sp++); if(red != green || red != blue) rgb_error |= 1; - *(dp++) = (png_byte)((gc*red + gc*green + bc*blue)>>8); + *(dp++) = (png_byte)((rc*red + gc*green + bc*blue)>>15); *(dp++) = *(sp++); /* alpha */ } } @@ -2341,8 +2348,7 @@ png_do_rgb_to_gray(png_structp png_ptr, png_row_infop row_info, png_bytep row) row_info->color_type &= ~PNG_COLOR_MASK_COLOR; row_info->pixel_depth = (png_byte)(row_info->channels * row_info->bit_depth); - row_info->rowbytes = ((row_width * - row_info->pixel_depth + 7) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width); } return rgb_error; } @@ -3260,8 +3266,7 @@ png_do_background(png_row_infop row_info, png_bytep row, row_info->channels--; row_info->pixel_depth = (png_byte)(row_info->channels * row_info->bit_depth); - row_info->rowbytes = ((row_width * - row_info->pixel_depth + 7) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width); } } } @@ -3735,8 +3740,8 @@ png_do_expand(png_row_infop row_info, png_bytep row, row_info->color_type = PNG_COLOR_TYPE_GRAY_ALPHA; row_info->channels = 2; row_info->pixel_depth = (png_byte)(row_info->bit_depth << 1); - row_info->rowbytes = - ((row_width * row_info->pixel_depth) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, + row_width); } } else if (row_info->color_type == PNG_COLOR_TYPE_RGB && trans_value) @@ -3790,8 +3795,7 @@ png_do_expand(png_row_infop row_info, png_bytep row, row_info->color_type = PNG_COLOR_TYPE_RGB_ALPHA; row_info->channels = 4; row_info->pixel_depth = (png_byte)(row_info->bit_depth << 2); - row_info->rowbytes = - ((row_width * row_info->pixel_depth) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width); } } } @@ -3844,8 +3848,7 @@ png_do_dither(png_row_infop row_info, png_bytep row, row_info->color_type = PNG_COLOR_TYPE_PALETTE; row_info->channels = 1; row_info->pixel_depth = row_info->bit_depth; - row_info->rowbytes = - ((row_width * row_info->pixel_depth + 7) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width); } else if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA && palette_lookup != NULL && row_info->bit_depth == 8) @@ -3874,8 +3877,7 @@ png_do_dither(png_row_infop row_info, png_bytep row, row_info->color_type = PNG_COLOR_TYPE_PALETTE; row_info->channels = 1; row_info->pixel_depth = row_info->bit_depth; - row_info->rowbytes = - ((row_width * row_info->pixel_depth + 7) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,row_width); } else if (row_info->color_type == PNG_COLOR_TYPE_PALETTE && dither_lookup && row_info->bit_depth == 8) @@ -4005,7 +4007,7 @@ png_build_gamma_table(png_structp png_ptr) g = 1.0; png_ptr->gamma_16_table = (png_uint_16pp)png_malloc(png_ptr, - (png_uint_32)(num * sizeof (png_uint_16p))); + (png_uint_32)(num * png_sizeof (png_uint_16p))); if (png_ptr->transformations & (PNG_16_TO_8 | PNG_BACKGROUND)) { @@ -4015,7 +4017,7 @@ png_build_gamma_table(png_structp png_ptr) for (i = 0; i < num; i++) { png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); } g = 1.0 / g; @@ -4045,7 +4047,7 @@ png_build_gamma_table(png_structp png_ptr) for (i = 0; i < num; i++) { png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); ig = (((png_uint_32)i * (png_uint_32)png_gamma_shift[shift]) >> 4); for (j = 0; j < 256; j++) @@ -4065,12 +4067,12 @@ png_build_gamma_table(png_structp png_ptr) g = 1.0 / (png_ptr->gamma); png_ptr->gamma_16_to_1 = (png_uint_16pp)png_malloc(png_ptr, - (png_uint_32)(num * sizeof (png_uint_16p ))); + (png_uint_32)(num * png_sizeof (png_uint_16p ))); for (i = 0; i < num; i++) { png_ptr->gamma_16_to_1[i] = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); ig = (((png_uint_32)i * (png_uint_32)png_gamma_shift[shift]) >> 4); @@ -4088,12 +4090,12 @@ png_build_gamma_table(png_structp png_ptr) g = png_ptr->gamma; /* probably doing rgb_to_gray */ png_ptr->gamma_16_from_1 = (png_uint_16pp)png_malloc(png_ptr, - (png_uint_32)(num * sizeof (png_uint_16p))); + (png_uint_32)(num * png_sizeof (png_uint_16p))); for (i = 0; i < num; i++) { png_ptr->gamma_16_from_1[i] = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); ig = (((png_uint_32)i * (png_uint_32)png_gamma_shift[shift]) >> 4); @@ -4159,15 +4161,15 @@ png_do_read_intrapixel(png_row_infop row_info, png_bytep row) for (i = 0, rp = row; i < row_width; i++, rp += bytes_per_pixel) { - png_uint_32 s0=*(rp )<<8 | *(rp+1); - png_uint_32 s1=*(rp+2)<<8 | *(rp+3); - png_uint_32 s2=*(rp+4)<<8 | *(rp+5); - png_uint_32 red=(65536+s0+s1)&0xffff; - png_uint_32 blue=(65536+s2+s1)&0xffff; - *(rp ) = (png_byte)((red>>8)&0xff); - *(rp+1) = (png_byte)(red&0xff); - *(rp+4) = (png_byte)((blue>>8)&0xff); - *(rp+5) = (png_byte)(blue&0xff); + png_uint_32 s0 = (*(rp ) << 8) | *(rp+1); + png_uint_32 s1 = (*(rp+2) << 8) | *(rp+3); + png_uint_32 s2 = (*(rp+4) << 8) | *(rp+5); + png_uint_32 red = (png_uint_32)((s0+s1+65536L) & 0xffffL); + png_uint_32 blue = (png_uint_32)((s2+s1+65536L) & 0xffffL); + *(rp ) = (png_byte)((red >> 8) & 0xff); + *(rp+1) = (png_byte)(red & 0xff); + *(rp+4) = (png_byte)((blue >> 8) & 0xff); + *(rp+5) = (png_byte)(blue & 0xff); } } } diff --git a/src/libs/png/pngrutil.c b/src/libs/png/pngrutil.c index 9cbfed65f0..99e466f18e 100644 --- a/src/libs/png/pngrutil.c +++ b/src/libs/png/pngrutil.c @@ -1,9 +1,8 @@ - /* pngrutil.c - utilities to read a PNG file * - * libpng 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -38,6 +37,14 @@ __inline double strtod(const char *nptr, char **endptr) # endif #endif +png_uint_32 /* PRIVATE */ +png_get_uint_31(png_structp png_ptr, png_bytep buf) +{ + png_uint_32 i = png_get_uint_32(buf); + if (i > PNG_UINT_31_MAX) + png_error(png_ptr, "PNG unsigned integer out of range.\n"); + return (i); +} #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ png_uint_32 /* PRIVATE */ @@ -171,7 +178,7 @@ png_decompress_chunk(png_structp png_ptr, int comp_type, png_size_t prefix_size, png_size_t *newlength) { static char msg[] = "Error decoding compressed text"; - png_charp text = NULL; + png_charp text; png_size_t text_size; if (comp_type == PNG_COMPRESSION_TYPE_BASE) @@ -199,7 +206,7 @@ png_decompress_chunk(png_structp png_ptr, int comp_type, if (text == NULL) { - text_size = prefix_size + sizeof(msg) + 1; + text_size = prefix_size + png_sizeof(msg) + 1; text = (png_charp)png_malloc_warn(png_ptr, text_size); if (text == NULL) { @@ -213,7 +220,8 @@ png_decompress_chunk(png_structp png_ptr, int comp_type, /* Copy what we can of the error message into the text chunk */ text_size = (png_size_t)(chunklength - (text - chunkdata) - 1); - text_size = sizeof(msg) > text_size ? text_size : sizeof(msg); + text_size = png_sizeof(msg) > text_size ? text_size : + png_sizeof(msg); png_memcpy(text + prefix_size, msg, text_size + 1); break; } @@ -346,15 +354,14 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_crc_read(png_ptr, buf, 13); png_crc_finish(png_ptr, 0); - width = png_get_uint_32(buf); - height = png_get_uint_32(buf + 4); + width = png_get_uint_31(png_ptr, buf); + height = png_get_uint_31(png_ptr, buf + 4); bit_depth = buf[8]; color_type = buf[9]; compression_type = buf[10]; filter_type = buf[11]; interlace_type = buf[12]; - /* set internal variables */ png_ptr->width = width; png_ptr->height = height; @@ -364,6 +371,7 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) #if defined(PNG_MNG_FEATURES_SUPPORTED) png_ptr->filter_type = (png_byte)filter_type; #endif + png_ptr->compression_type = (png_byte)compression_type; /* find number of channels */ switch (png_ptr->color_type) @@ -386,8 +394,7 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) /* set up other useful info */ png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels); - png_ptr->rowbytes = ((png_ptr->width * - (png_uint_32)png_ptr->pixel_depth + 7) >> 3); + png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->width); png_debug1(3,"bit_depth = %d\n", png_ptr->bit_depth); png_debug1(3,"channels = %d\n", png_ptr->channels); png_debug1(3,"rowbytes = %lu\n", png_ptr->rowbytes); @@ -542,8 +549,6 @@ png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) if (!(png_ptr->mode & PNG_HAVE_IHDR) || !(png_ptr->mode & PNG_HAVE_IDAT)) { png_error(png_ptr, "No image in file"); - - info_ptr = info_ptr; /* quiet compiler warnings about unused info_ptr */ } png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND); @@ -553,6 +558,9 @@ png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_warning(png_ptr, "Incorrect IEND chunk length"); } png_crc_finish(png_ptr, length); + + if (&info_ptr == NULL) /* quiet compiler warnings about unused info_ptr */ + return; } #if defined(PNG_READ_gAMA_SUPPORTED) @@ -579,7 +587,7 @@ png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place gAMA chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@ -612,7 +620,7 @@ png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) #if defined(PNG_READ_sRGB_SUPPORTED) if (info_ptr->valid & PNG_INFO_sRGB) - if(igamma < 45000L || igamma > 46000L) + if (PNG_OUT_OF_RANGE(igamma, 45500L, 500)) { png_warning(png_ptr, "Ignoring incorrect gAMA value when sRGB is also present"); @@ -660,7 +668,7 @@ png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sBIT chunk"); } - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) { png_warning(png_ptr, "Duplicate sBIT chunk"); png_crc_finish(png_ptr, length); @@ -672,7 +680,7 @@ png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@ -729,7 +737,7 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before cHRM"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@ -825,14 +833,14 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) #if defined(PNG_READ_sRGB_SUPPORTED) if (info_ptr->valid & PNG_INFO_sRGB) { - if (abs(int_x_white - 31270L) > 1000 || - abs(int_y_white - 32900L) > 1000 || - abs(int_x_red - 64000L) > 1000 || - abs(int_y_red - 33000L) > 1000 || - abs(int_x_green - 30000L) > 1000 || - abs(int_y_green - 60000L) > 1000 || - abs(int_x_blue - 15000L) > 1000 || - abs(int_y_blue - 6000L) > 1000) + if (PNG_OUT_OF_RANGE(int_x_white, 31270, 1000) || + PNG_OUT_OF_RANGE(int_y_white, 32900, 1000) || + PNG_OUT_OF_RANGE(int_x_red, 64000L, 1000) || + PNG_OUT_OF_RANGE(int_y_red, 33000, 1000) || + PNG_OUT_OF_RANGE(int_x_green, 30000, 1000) || + PNG_OUT_OF_RANGE(int_y_green, 60000L, 1000) || + PNG_OUT_OF_RANGE(int_x_blue, 15000, 1000) || + PNG_OUT_OF_RANGE(int_y_blue, 6000, 1000)) { png_warning(png_ptr, @@ -891,7 +899,7 @@ png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sRGB chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) { png_warning(png_ptr, "Duplicate sRGB chunk"); png_crc_finish(png_ptr, length); @@ -920,15 +928,15 @@ png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) #if defined(PNG_READ_gAMA_SUPPORTED) && defined(PNG_READ_GAMMA_SUPPORTED) if ((info_ptr->valid & PNG_INFO_gAMA)) { - int igamma; + png_fixed_point igamma; #ifdef PNG_FIXED_POINT_SUPPORTED - igamma=(int)info_ptr->int_gamma; + igamma=info_ptr->int_gamma; #else # ifdef PNG_FLOATING_POINT_SUPPORTED - igamma=(int)(info_ptr->gamma * 100000.); + igamma=(png_fixed_point)(info_ptr->gamma * 100000.); # endif #endif - if(igamma < 45000L || igamma > 46000L) + if (PNG_OUT_OF_RANGE(igamma, 45500L, 500)) { png_warning(png_ptr, "Ignoring incorrect gAMA value when sRGB is also present"); @@ -948,14 +956,14 @@ png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) #ifdef PNG_READ_cHRM_SUPPORTED #ifdef PNG_FIXED_POINT_SUPPORTED if (info_ptr->valid & PNG_INFO_cHRM) - if (abs(info_ptr->int_x_white - 31270L) > 1000 || - abs(info_ptr->int_y_white - 32900L) > 1000 || - abs(info_ptr->int_x_red - 64000L) > 1000 || - abs(info_ptr->int_y_red - 33000L) > 1000 || - abs(info_ptr->int_x_green - 30000L) > 1000 || - abs(info_ptr->int_y_green - 60000L) > 1000 || - abs(info_ptr->int_x_blue - 15000L) > 1000 || - abs(info_ptr->int_y_blue - 6000L) > 1000) + if (PNG_OUT_OF_RANGE(info_ptr->int_x_white, 31270, 1000) || + PNG_OUT_OF_RANGE(info_ptr->int_y_white, 32900, 1000) || + PNG_OUT_OF_RANGE(info_ptr->int_x_red, 64000L, 1000) || + PNG_OUT_OF_RANGE(info_ptr->int_y_red, 33000, 1000) || + PNG_OUT_OF_RANGE(info_ptr->int_x_green, 30000, 1000) || + PNG_OUT_OF_RANGE(info_ptr->int_y_green, 60000L, 1000) || + PNG_OUT_OF_RANGE(info_ptr->int_x_blue, 15000, 1000) || + PNG_OUT_OF_RANGE(info_ptr->int_y_blue, 6000, 1000)) { png_warning(png_ptr, "Ignoring incorrect cHRM value when sRGB is also present"); @@ -977,8 +985,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_bytep pC; png_charp profile; png_uint_32 skip = 0; - png_uint_32 profile_size = 0; - png_uint_32 profile_length = 0; + png_uint_32 profile_size, profile_length; png_size_t slength, prefix_length, data_length; png_debug(1, "in png_handle_iCCP\n"); @@ -995,7 +1002,7 @@ png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place iCCP chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) { png_warning(png_ptr, "Duplicate iCCP chunk"); png_crc_finish(png_ptr, length); @@ -1153,9 +1160,20 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) return; } - new_palette.nentries = data_length / entry_size; - new_palette.entries = (png_sPLT_entryp)png_malloc( - png_ptr, new_palette.nentries * sizeof(png_sPLT_entry)); + new_palette.nentries = (png_uint_32) (data_length / entry_size); + if ((png_uint_32) new_palette.nentries > (png_uint_32) (PNG_SIZE_MAX / + png_sizeof(png_sPLT_entry))) + { + png_warning(png_ptr, "sPLT chunk too long"); + return; + } + new_palette.entries = (png_sPLT_entryp)png_malloc_warn( + png_ptr, new_palette.nentries * png_sizeof(png_sPLT_entry)); + if (new_palette.entries == NULL) + { + png_warning(png_ptr, "sPLT chunk requires too much memory"); + return; + } #ifndef PNG_NO_POINTER_INDEXING for (i = 0; i < new_palette.nentries; i++) @@ -1234,49 +1252,9 @@ png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) return; } - if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) + if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) { - if (!(png_ptr->mode & PNG_HAVE_PLTE)) - { - /* Should be an error, but we can cope with it */ - png_warning(png_ptr, "Missing PLTE before tRNS"); - } - else if (length > (png_uint_32)png_ptr->num_palette) - { - png_warning(png_ptr, "Incorrect tRNS chunk length"); - png_crc_finish(png_ptr, length); - return; - } - if (length == 0) - { - png_warning(png_ptr, "Zero length tRNS chunk"); - png_crc_finish(png_ptr, length); - return; - } - - png_crc_read(png_ptr, readbuf, (png_size_t)length); - png_ptr->num_trans = (png_uint_16)length; - } - else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) - { - png_byte buf[6]; - - if (length != 6) - { - png_warning(png_ptr, "Incorrect tRNS chunk length"); - png_crc_finish(png_ptr, length); - return; - } - - png_crc_read(png_ptr, buf, (png_size_t)length); - png_ptr->num_trans = 1; - png_ptr->trans_values.red = png_get_uint_16(buf); - png_ptr->trans_values.green = png_get_uint_16(buf + 2); - png_ptr->trans_values.blue = png_get_uint_16(buf + 4); - } - else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) - { - png_byte buf[6]; + png_byte buf[2]; if (length != 2) { @@ -1289,6 +1267,45 @@ png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_ptr->num_trans = 1; png_ptr->trans_values.gray = png_get_uint_16(buf); } + else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) + { + png_byte buf[6]; + + if (length != 6) + { + png_warning(png_ptr, "Incorrect tRNS chunk length"); + png_crc_finish(png_ptr, length); + return; + } + png_crc_read(png_ptr, buf, (png_size_t)length); + png_ptr->num_trans = 1; + png_ptr->trans_values.red = png_get_uint_16(buf); + png_ptr->trans_values.green = png_get_uint_16(buf + 2); + png_ptr->trans_values.blue = png_get_uint_16(buf + 4); + } + else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) + { + if (!(png_ptr->mode & PNG_HAVE_PLTE)) + { + /* Should be an error, but we can cope with it. */ + png_warning(png_ptr, "Missing PLTE before tRNS"); + } + if (length > (png_uint_32)png_ptr->num_palette || + length > PNG_MAX_PALETTE_LENGTH) + { + png_warning(png_ptr, "Incorrect tRNS chunk length"); + png_crc_finish(png_ptr, length); + return; + } + if (length == 0) + { + png_warning(png_ptr, "Zero length tRNS chunk"); + png_crc_finish(png_ptr, length); + return; + } + png_crc_read(png_ptr, readbuf, (png_size_t)length); + png_ptr->num_trans = (png_uint_16)length; + } else { png_warning(png_ptr, "tRNS chunk not allowed with alpha channel"); @@ -1397,7 +1414,7 @@ png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) void /* PRIVATE */ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { - int num, i; + unsigned int num, i; png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH]; png_debug(1, "in png_handle_hIST\n"); @@ -1423,8 +1440,9 @@ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) return; } - num = (int)length / 2 ; - if (num != png_ptr->num_palette) + num = length / 2 ; + if (num != (unsigned int) png_ptr->num_palette || num > + (unsigned int) PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect hIST chunk length"); png_crc_finish(png_ptr, length); @@ -1625,7 +1643,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_debug(3, "Allocating pCAL parameters array\n"); params = (png_charpp)png_malloc_warn(png_ptr, (png_uint_32)(nparams - *sizeof(png_charp))) ; + *png_sizeof(png_charp))) ; if (params == NULL) { png_free(png_ptr, purpose); @@ -1883,7 +1901,8 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) if (text != key + slength) text++; - text_ptr = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc_warn(png_ptr, + (png_uint_32)png_sizeof(png_text)); if (text_ptr == NULL) { png_warning(png_ptr, "Not enough memory to process text chunk."); @@ -1979,7 +1998,8 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) chunkdata = (png_charp)png_decompress_chunk(png_ptr, comp_type, chunkdata, (png_size_t)length, prefix_len, &data_len); - text_ptr = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc_warn(png_ptr, + (png_uint_32)png_sizeof(png_text)); if (text_ptr == NULL) { png_warning(png_ptr,"Not enough memory to process zTXt chunk."); @@ -2088,7 +2108,8 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) (size_t)length, prefix_len, &data_len); else data_len=png_strlen(chunkdata + prefix_len); - text_ptr = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc_warn(png_ptr, + (png_uint_32)png_sizeof(png_text)); if (text_ptr == NULL) { png_warning(png_ptr,"Not enough memory to process iTXt chunk."); @@ -2139,7 +2160,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { #if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED) if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != - HANDLE_CHUNK_ALWAYS + PNG_HANDLE_CHUNK_ALWAYS #if defined(PNG_READ_USER_CHUNKS_SUPPORTED) && png_ptr->read_user_chunk_fn == NULL #endif @@ -2173,7 +2194,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { if (!(png_ptr->chunk_name[0] & 0x20)) if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != - HANDLE_CHUNK_ALWAYS) + PNG_HANDLE_CHUNK_ALWAYS) { png_free(png_ptr, chunk.data); png_chunk_error(png_ptr, "unknown critical chunk"); @@ -2193,7 +2214,8 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_crc_finish(png_ptr, skip); #if !defined(PNG_READ_USER_CHUNKS_SUPPORTED) - info_ptr = info_ptr; /* quiet compiler warnings about unused info_ptr */ + if (&info_ptr == NULL) /* quiet compiler warnings about unused info_ptr */ + return; #endif } @@ -2203,7 +2225,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) functions to handle unknown critical chunks after we check that the chunk name itself is valid. */ -#define isnonalpha(c) ((c) < 41 || (c) > 122 || ((c) > 90 && (c) < 97)) +#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97)) void /* PRIVATE */ png_check_chunk_name(png_structp png_ptr, png_bytep chunk_name) @@ -2234,8 +2256,7 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask) if (mask == 0xff) { png_memcpy(row, png_ptr->row_buf + 1, - (png_size_t)((png_ptr->width * - png_ptr->row_info.pixel_depth + 7) >> 3)); + PNG_ROWBYTES(png_ptr->row_info.pixel_depth, png_ptr->width)); } else { @@ -2650,11 +2671,11 @@ png_do_read_interlace(png_structp png_ptr) } } row_info->width = final_width; - row_info->rowbytes = ((final_width * - (png_uint_32)row_info->pixel_depth + 7) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,final_width); } #if !defined(PNG_READ_PACKSWAP_SUPPORTED) - transformations = transformations; /* silence compiler warning */ + if (&transformations == NULL) /* silence compiler warning */ + return; #endif } #endif /* !PNG_HAVE_ASSEMBLER_READ_INTERLACE */ @@ -2822,8 +2843,9 @@ png_read_finish_row(png_structp png_ptr) png_pass_inc[png_ptr->pass] - 1 - png_pass_start[png_ptr->pass]) / png_pass_inc[png_ptr->pass]; - png_ptr->irowbytes = ((png_ptr->iwidth * - (png_uint_32)png_ptr->pixel_depth + 7) >> 3) +1; + + png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, + png_ptr->iwidth) + 1; if (!(png_ptr->transformations & PNG_INTERLACE)) { @@ -2863,8 +2885,7 @@ png_read_finish_row(png_structp png_ptr) png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); - + png_ptr->idat_size = png_get_uint_31(png_ptr, chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4)) @@ -2950,8 +2971,8 @@ png_read_start_row(png_structp png_ptr) png_pass_start[png_ptr->pass]) / png_pass_inc[png_ptr->pass]; - row_bytes = ((png_ptr->iwidth * - (png_uint_32)png_ptr->pixel_depth + 7) >> 3) +1; + row_bytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->iwidth) + 1; + png_ptr->irowbytes = (png_size_t)row_bytes; if((png_uint_32)png_ptr->irowbytes != row_bytes) png_error(png_ptr, "Rowbytes overflow in png_read_start_row"); @@ -3069,7 +3090,7 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7)); /* calculate the maximum bytes needed, adding a byte and a pixel for safety's sake */ - row_bytes = ((row_bytes * (png_uint_32)max_pixel_depth + 7) >> 3) + + row_bytes = PNG_ROWBYTES(max_pixel_depth,row_bytes) + 1 + ((max_pixel_depth + 7) >> 3); #ifdef PNG_MAX_MALLOC_64K if (row_bytes > (png_uint_32)65536L) @@ -3085,6 +3106,8 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) if ((png_uint_32)png_ptr->rowbytes + 1 > (png_uint_32)65536L) png_error(png_ptr, "This image requires a row greater than 64KB"); #endif + if ((png_uint_32)png_ptr->rowbytes > PNG_SIZE_MAX - 1) + png_error(png_ptr, "Row has too many bytes to allocate in memory."); png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)( png_ptr->rowbytes + 1)); diff --git a/src/libs/png/pngset.c b/src/libs/png/pngset.c index 8e4e6197c9..5922cad0c5 100644 --- a/src/libs/png/pngset.c +++ b/src/libs/png/pngset.c @@ -1,9 +1,9 @@ /* pngset.c - storage of image information into info struct * - * libpng 1.2.5 - October 3, 2002 + * libpng 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -24,7 +24,7 @@ png_set_bKGD(png_structp png_ptr, png_infop info_ptr, png_color_16p background) if (png_ptr == NULL || info_ptr == NULL) return; - png_memcpy(&(info_ptr->background), background, sizeof(png_color_16)); + png_memcpy(&(info_ptr->background), background, png_sizeof(png_color_16)); info_ptr->valid |= PNG_INFO_bKGD; } #endif @@ -100,10 +100,14 @@ png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr, "Ignoring attempt to set negative chromaticity value"); return; } - if (white_x > (double) PNG_MAX_UINT || white_y > (double) PNG_MAX_UINT || - red_x > (double) PNG_MAX_UINT || red_y > (double) PNG_MAX_UINT || - green_x > (double) PNG_MAX_UINT || green_y > (double) PNG_MAX_UINT || - blue_x > (double) PNG_MAX_UINT || blue_y > (double) PNG_MAX_UINT) + if (white_x > (double) PNG_UINT_31_MAX || + white_y > (double) PNG_UINT_31_MAX || + red_x > (double) PNG_UINT_31_MAX || + red_y > (double) PNG_UINT_31_MAX || + green_x > (double) PNG_UINT_31_MAX || + green_y > (double) PNG_UINT_31_MAX || + blue_x > (double) PNG_UINT_31_MAX || + blue_y > (double) PNG_UINT_31_MAX) { png_warning(png_ptr, "Ignoring attempt to set chromaticity value exceeding 21474.83"); @@ -169,10 +173,10 @@ png_set_gAMA_fixed(png_structp png_ptr, png_infop info_ptr, png_fixed_point if (png_ptr == NULL || info_ptr == NULL) return; - if (int_gamma > (png_fixed_point) PNG_MAX_UINT) + if (int_gamma > (png_fixed_point) PNG_UINT_31_MAX) { png_warning(png_ptr, "Limiting gamma to 21474.83"); - gamma=PNG_MAX_UINT; + gamma=PNG_UINT_31_MAX; } else { @@ -217,7 +221,7 @@ png_set_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_16p hist) #endif /* Changed from info->num_palette to 256 in version 1.2.1 */ png_ptr->hist = (png_uint_16p)png_malloc_warn(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); if (png_ptr->hist == NULL) { png_warning(png_ptr, "Insufficient memory for hIST chunk data."); @@ -243,7 +247,6 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr, int color_type, int interlace_type, int compression_type, int filter_type) { - int rowbytes_per_pixel; png_debug1(1, "in %s storage function\n", "IHDR"); if (png_ptr == NULL || info_ptr == NULL) return; @@ -251,8 +254,22 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr, /* check for width and height valid values */ if (width == 0 || height == 0) png_error(png_ptr, "Image width or height is zero in IHDR"); - if (width > PNG_MAX_UINT || height > PNG_MAX_UINT) +#ifdef PNG_SET_USER_LIMITS_SUPPORTED + if (width > png_ptr->user_width_max || height > png_ptr->user_height_max) + png_error(png_ptr, "image size exceeds user limits in IHDR"); +#else + if (width > PNG_USER_WIDTH_MAX || height > PNG_USER_HEIGHT_MAX) + png_error(png_ptr, "image size exceeds user limits in IHDR"); +#endif + if (width > PNG_UINT_31_MAX || height > PNG_UINT_31_MAX) png_error(png_ptr, "Invalid image size in IHDR"); + if ( width > (PNG_UINT_32_MAX + >> 3) /* 8-byte RGBA pixels */ + - 64 /* bigrowbuf hack */ + - 1 /* filter byte */ + - 7*8 /* rounding of width to multiple of 8 pixels */ + - 8) /* extra max_pixel_depth pad */ + png_warning(png_ptr, "Width is too large for libpng to process pixels"); /* check other values */ if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 && @@ -320,16 +337,16 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr, info_ptr->channels++; info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth); - /* check for overflow */ - rowbytes_per_pixel = (info_ptr->pixel_depth + 7) >> 3; - if ( width > PNG_MAX_UINT/rowbytes_per_pixel - 64) - { - png_warning(png_ptr, - "Width too large to process image data; rowbytes will overflow."); + /* check for potential overflow */ + if ( width > (PNG_UINT_32_MAX + >> 3) /* 8-byte RGBA pixels */ + - 64 /* bigrowbuf hack */ + - 1 /* filter byte */ + - 7*8 /* rounding of width to multiple of 8 pixels */ + - 8) /* extra max_pixel_depth pad */ info_ptr->rowbytes = (png_size_t)0; - } else - info_ptr->rowbytes = (info_ptr->width * info_ptr->pixel_depth + 7) >> 3; + info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth,width); } #if defined(PNG_oFFs_SUPPORTED) @@ -388,7 +405,7 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr, png_memcpy(info_ptr->pcal_units, units, (png_size_t)length); info_ptr->pcal_params = (png_charpp)png_malloc_warn(png_ptr, - (png_uint_32)((nparams + 1) * sizeof(png_charp))); + (png_uint_32)((nparams + 1) * png_sizeof(png_charp))); if (info_ptr->pcal_params == NULL) { png_warning(png_ptr, "Insufficient memory for pCAL params."); @@ -449,12 +466,21 @@ png_set_sCAL_s(png_structp png_ptr, png_infop info_ptr, length = png_strlen(swidth) + 1; png_debug1(3, "allocating unit for info (%d bytes)\n", length); - info_ptr->scal_s_width = (png_charp)png_malloc(png_ptr, length); + info_ptr->scal_s_width = (png_charp)png_malloc_warn(png_ptr, length); + if (info_ptr->scal_s_width == NULL) + { + png_warning(png_ptr, "Memory allocation failed while processing sCAL."); + } png_memcpy(info_ptr->scal_s_width, swidth, (png_size_t)length); length = png_strlen(sheight) + 1; png_debug1(3, "allocating unit for info (%d bytes)\n", length); - info_ptr->scal_s_height = (png_charp)png_malloc(png_ptr, length); + info_ptr->scal_s_height = (png_charp)png_malloc_warn(png_ptr, length); + if (info_ptr->scal_s_height == NULL) + { + png_free (png_ptr, info_ptr->scal_s_width); + png_warning(png_ptr, "Memory allocation failed while processing sCAL."); + } png_memcpy(info_ptr->scal_s_height, sheight, (png_size_t)length); info_ptr->valid |= PNG_INFO_sCAL; @@ -499,13 +525,13 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr, #ifdef PNG_FREE_ME_SUPPORTED png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0); #endif + /* Changed in libpng-1.2.1 to allocate 256 instead of num_palette entries, in case of an invalid PNG file that has too-large sample values. */ - png_ptr->palette = (png_colorp)png_zalloc(png_ptr, (uInt)256, - sizeof (png_color)); - if (png_ptr->palette == NULL) - png_error(png_ptr, "Unable to malloc palette"); - png_memcpy(png_ptr->palette, palette, num_palette * sizeof (png_color)); + png_ptr->palette = (png_colorp)png_malloc(png_ptr, + 256 * png_sizeof(png_color)); + png_memset(png_ptr->palette, 0, 256 * png_sizeof(png_color)); + png_memcpy(png_ptr->palette, palette, num_palette * png_sizeof (png_color)); info_ptr->palette = png_ptr->palette; info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette; @@ -527,7 +553,7 @@ png_set_sBIT(png_structp png_ptr, png_infop info_ptr, if (png_ptr == NULL || info_ptr == NULL) return; - png_memcpy(&(info_ptr->sig_bit), sig_bit, sizeof (png_color_8)); + png_memcpy(&(info_ptr->sig_bit), sig_bit, png_sizeof (png_color_8)); info_ptr->valid |= PNG_INFO_sBIT; } #endif @@ -628,9 +654,20 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr, if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL) return; - new_iccp_name = (png_charp)png_malloc(png_ptr, png_strlen(name)+1); + new_iccp_name = (png_charp)png_malloc_warn(png_ptr, png_strlen(name)+1); + if (new_iccp_name == NULL) + { + png_warning(png_ptr, "Insufficient memory to process iCCP chunk."); + return; + } png_strcpy(new_iccp_name, name); - new_iccp_profile = (png_charp)png_malloc(png_ptr, proflen); + new_iccp_profile = (png_charp)png_malloc_warn(png_ptr, proflen); + if (new_iccp_profile == NULL) + { + png_free (png_ptr, new_iccp_name); + png_warning(png_ptr, "Insufficient memory to process iCCP profile."); + return; + } png_memcpy(new_iccp_profile, profile, (png_size_t)proflen); png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, 0); @@ -685,14 +722,14 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr, info_ptr->max_text = info_ptr->num_text + num_text + 8; old_text = info_ptr->text; info_ptr->text = (png_textp)png_malloc_warn(png_ptr, - (png_uint_32)(info_ptr->max_text * sizeof (png_text))); + (png_uint_32)(info_ptr->max_text * png_sizeof (png_text))); if (info_ptr->text == NULL) { png_free(png_ptr, old_text); return(1); } png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max * - sizeof(png_text))); + png_sizeof(png_text))); png_free(png_ptr, old_text); } else @@ -700,7 +737,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr, info_ptr->max_text = num_text + 8; info_ptr->num_text = 0; info_ptr->text = (png_textp)png_malloc_warn(png_ptr, - (png_uint_32)(info_ptr->max_text * sizeof (png_text))); + (png_uint_32)(info_ptr->max_text * png_sizeof (png_text))); if (info_ptr->text == NULL) return(1); #ifdef PNG_FREE_ME_SUPPORTED @@ -829,7 +866,7 @@ png_set_tIME(png_structp png_ptr, png_infop info_ptr, png_timep mod_time) (png_ptr->mode & PNG_WROTE_tIME)) return; - png_memcpy(&(info_ptr->mod_time), mod_time, sizeof (png_time)); + png_memcpy(&(info_ptr->mod_time), mod_time, png_sizeof (png_time)); info_ptr->valid |= PNG_INFO_tIME; } #endif @@ -867,7 +904,7 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr, if (trans_values != NULL) { png_memcpy(&(info_ptr->trans_values), trans_values, - sizeof(png_color_16)); + png_sizeof(png_color_16)); if (num_trans == 0) num_trans = 1; } @@ -885,7 +922,7 @@ png_set_sPLT(png_structp png_ptr, int i; np = (png_sPLT_tp)png_malloc_warn(png_ptr, - (info_ptr->splt_palettes_num + nentries) * sizeof(png_sPLT_t)); + (info_ptr->splt_palettes_num + nentries) * png_sizeof(png_sPLT_t)); if (np == NULL) { png_warning(png_ptr, "No memory for sPLT palettes."); @@ -893,7 +930,7 @@ png_set_sPLT(png_structp png_ptr, } png_memcpy(np, info_ptr->splt_palettes, - info_ptr->splt_palettes_num * sizeof(png_sPLT_t)); + info_ptr->splt_palettes_num * png_sizeof(png_sPLT_t)); png_free(png_ptr, info_ptr->splt_palettes); info_ptr->splt_palettes=NULL; @@ -904,11 +941,13 @@ png_set_sPLT(png_structp png_ptr, to->name = (png_charp)png_malloc(png_ptr, png_strlen(from->name) + 1); + /* TODO: use png_malloc_warn */ png_strcpy(to->name, from->name); to->entries = (png_sPLT_entryp)png_malloc(png_ptr, - from->nentries * sizeof(png_sPLT_t)); + from->nentries * png_sizeof(png_sPLT_t)); + /* TODO: use png_malloc_warn */ png_memcpy(to->entries, from->entries, - from->nentries * sizeof(png_sPLT_t)); + from->nentries * png_sizeof(png_sPLT_t)); to->nentries = from->nentries; to->depth = from->depth; } @@ -935,7 +974,7 @@ png_set_unknown_chunks(png_structp png_ptr, np = (png_unknown_chunkp)png_malloc_warn(png_ptr, (info_ptr->unknown_chunks_num + num_unknowns) * - sizeof(png_unknown_chunk)); + png_sizeof(png_unknown_chunk)); if (np == NULL) { png_warning(png_ptr, "Out of memory while processing unknown chunk."); @@ -943,7 +982,7 @@ png_set_unknown_chunks(png_structp png_ptr, } png_memcpy(np, info_ptr->unknown_chunks, - info_ptr->unknown_chunks_num * sizeof(png_unknown_chunk)); + info_ptr->unknown_chunks_num * png_sizeof(png_unknown_chunk)); png_free(png_ptr, info_ptr->unknown_chunks); info_ptr->unknown_chunks=NULL; @@ -952,17 +991,19 @@ png_set_unknown_chunks(png_structp png_ptr, png_unknown_chunkp to = np + info_ptr->unknown_chunks_num + i; png_unknown_chunkp from = unknowns + i; - png_strcpy((png_charp)to->name, (png_charp)from->name); - to->data = (png_bytep)png_malloc(png_ptr, from->size); + png_strncpy((png_charp)to->name, (png_charp)from->name, 5); + to->data = (png_bytep)png_malloc_warn(png_ptr, from->size); if (to->data == NULL) - png_warning(png_ptr, "Out of memory while processing unknown chunk."); + { + png_warning(png_ptr, "Out of memory processing unknown chunk."); + } else { - png_memcpy(to->data, from->data, from->size); - to->size = from->size; + png_memcpy(to->data, from->data, from->size); + to->size = from->size; - /* note our location in the read or write sequence */ - to->location = (png_byte)(png_ptr->mode & 0xff); + /* note our location in the read or write sequence */ + to->location = (png_byte)(png_ptr->mode & 0xff); } } @@ -1020,12 +1061,12 @@ png_set_keep_unknown_chunks(png_structp png_ptr, int keep, png_bytep int i, old_num_chunks; if (num_chunks == 0) { - if(keep == HANDLE_CHUNK_ALWAYS || keep == HANDLE_CHUNK_IF_SAFE) + if(keep == PNG_HANDLE_CHUNK_ALWAYS || keep == PNG_HANDLE_CHUNK_IF_SAFE) png_ptr->flags |= PNG_FLAG_KEEP_UNKNOWN_CHUNKS; else png_ptr->flags &= ~PNG_FLAG_KEEP_UNKNOWN_CHUNKS; - if(keep == HANDLE_CHUNK_ALWAYS) + if(keep == PNG_HANDLE_CHUNK_ALWAYS) png_ptr->flags |= PNG_FLAG_KEEP_UNSAFE_CHUNKS; else png_ptr->flags &= ~PNG_FLAG_KEEP_UNSAFE_CHUNKS; @@ -1083,6 +1124,7 @@ png_set_rows(png_structp png_ptr, png_infop info_ptr, png_bytepp row_pointers) } #endif +#ifdef PNG_WRITE_SUPPORTED void PNGAPI png_set_compression_buffer_size(png_structp png_ptr, png_uint_32 size) { @@ -1093,6 +1135,7 @@ png_set_compression_buffer_size(png_structp png_ptr, png_uint_32 size) png_ptr->zstream.next_out = png_ptr->zbuf; png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size; } +#endif void PNGAPI png_set_invalid(png_structp png_ptr, png_infop info_ptr, int mask) @@ -1157,4 +1200,20 @@ png_set_mmx_thresholds (png_structp png_ptr, png_ptr->mmx_rowbytes_threshold = mmx_rowbytes_threshold; } #endif /* ?PNG_ASSEMBLER_CODE_SUPPORTED */ + +#ifdef PNG_SET_USER_LIMITS_SUPPORTED +/* this function was added to libpng 1.2.6 */ +void PNGAPI +png_set_user_limits (png_structp png_ptr, png_uint_32 user_width_max, + png_uint_32 user_height_max) +{ + /* Images with dimensions larger than these limits will be + * rejected by png_set_IHDR(). To accept any PNG datastream + * regardless of dimensions, set both limits to 0x7ffffffL. + */ + png_ptr->user_width_max = user_width_max; + png_ptr->user_height_max = user_height_max; +} +#endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */ + #endif /* ?PNG_1_0_X */ diff --git a/src/libs/png/pngtrans.c b/src/libs/png/pngtrans.c index f08fb4ecfe..9003a2109b 100644 --- a/src/libs/png/pngtrans.c +++ b/src/libs/png/pngtrans.c @@ -1,9 +1,9 @@ /* pngtrans.c - transforms the data in a row (used by both readers and writers) * - * libpng 1.2.5 - October 3, 2002 + * libpng 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) */ @@ -100,7 +100,7 @@ png_set_filler(png_structp png_ptr, png_uint_32 filler, int filler_loc) else png_ptr->flags &= ~PNG_FLAG_FILLER_AFTER; - /* This should probably go in the "do_filler" routine. + /* This should probably go in the "do_read_filler" routine. * I attempted to do that in libpng-1.0.1a but that caused problems * so I restored it in libpng-1.0.2a */ @@ -118,6 +118,18 @@ png_set_filler(png_structp png_ptr, png_uint_32 filler, int filler_loc) png_ptr->usr_channels = 2; } } + +#if !defined(PNG_1_0_X) +/* Added to libpng-1.2.7 */ +void PNGAPI +png_set_add_alpha(png_structp png_ptr, png_uint_32 filler, int filler_loc) +{ + png_debug(1, "in png_set_add_alpha\n"); + png_set_filler(png_ptr, filler, filler_loc); + png_ptr->transformations |= PNG_ADD_ALPHA; +} +#endif + #endif #if defined(PNG_READ_SWAP_ALPHA_SUPPORTED) || \ @@ -375,16 +387,15 @@ png_do_strip_filler(png_row_infop row_info, png_bytep row, png_uint_32 flags) if (row != NULL && row_info != NULL) #endif { -/* - if (row_info->color_type == PNG_COLOR_TYPE_RGB || - row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA) -*/ png_bytep sp=row; png_bytep dp=row; png_uint_32 row_width=row_info->width; png_uint_32 i; - if (row_info->channels == 4) + if ((row_info->color_type == PNG_COLOR_TYPE_RGB || + (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA && + (flags & PNG_FLAG_STRIP_ALPHA))) && + row_info->channels == 4) { if (row_info->bit_depth == 8) { @@ -461,13 +472,11 @@ png_do_strip_filler(png_row_infop row_info, png_bytep row, png_uint_32 flags) row_info->rowbytes = row_width * 6; } row_info->channels = 3; - row_info->color_type &= ~PNG_COLOR_MASK_ALPHA; } -/* - else if (row_info->color_type == PNG_COLOR_TYPE_GRAY || - row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) -*/ - else if (row_info->channels == 2) + else if ((row_info->color_type == PNG_COLOR_TYPE_GRAY || + (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA && + (flags & PNG_FLAG_STRIP_ALPHA))) && + row_info->channels == 2) { if (row_info->bit_depth == 8) { @@ -519,8 +528,9 @@ png_do_strip_filler(png_row_infop row_info, png_bytep row, png_uint_32 flags) row_info->rowbytes = row_width * 2; } row_info->channels = 1; - row_info->color_type &= ~PNG_COLOR_MASK_ALPHA; } + if (flags & PNG_FLAG_STRIP_ALPHA) + row_info->color_type &= ~PNG_COLOR_MASK_ALPHA; } } #endif diff --git a/src/libs/png/pngvcrd.c b/src/libs/png/pngvcrd.c index 4f513eb4d9..940a7fc0f4 100644 --- a/src/libs/png/pngvcrd.c +++ b/src/libs/png/pngvcrd.c @@ -2,9 +2,9 @@ * * For Intel x86 CPU and Microsoft Visual C++ compiler * - * libpng version 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * Copyright (c) 1998, Intel Corporation * * Contributed by Nirav Chhatrapati, Intel Corporation, 1998 @@ -115,15 +115,18 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask) png_debug(1,"in png_combine_row_asm\n"); if (mmx_supported == 2) { +#if !defined(PNG_1_0_X) /* this should have happened in png_init_mmx_flags() already */ png_warning(png_ptr, "asm_flags may not have been initialized"); +#endif png_mmx_support(); } if (mask == 0xff) { png_memcpy(row, png_ptr->row_buf + 1, - (png_size_t)((png_ptr->width * png_ptr->row_info.pixel_depth + 7) >> 3)); + (png_size_t)PNG_ROWBYTES(png_ptr->row_info.pixel_depth, + png_ptr->width)); } /* GRR: add "else if (mask == 0)" case? * or does png_combine_row() not even get called in that case? */ @@ -307,8 +310,12 @@ png_combine_row(png_structp png_ptr, png_bytep row, int mask) __int64 mask0=0x0102040810204080; +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW) /* && mmx_supported */ ) +#else + if (mmx_supported) +#endif { srcptr = png_ptr->row_buf + 1; dstptr = row; @@ -408,8 +415,12 @@ end8: __int64 mask1=0x0101020204040808, mask0=0x1010202040408080; +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW) /* && mmx_supported */ ) +#else + if (mmx_supported) +#endif { srcptr = png_ptr->row_buf + 1; dstptr = row; @@ -529,8 +540,12 @@ end16: len = (png_ptr->width)&~7; diff = (png_ptr->width)&7; +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW) /* && mmx_supported */ ) +#else + if (mmx_supported) +#endif { _asm { @@ -661,8 +676,12 @@ end24: len = (png_ptr->width)&~7; diff = (png_ptr->width)&7; +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW) /* && mmx_supported */ ) +#else + if (mmx_supported) +#endif { _asm { @@ -796,8 +815,12 @@ end32: mask1=0x2020202040404040, mask0=0x4040808080808080; +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_COMBINE_ROW) /* && mmx_supported */ ) +#else + if (mmx_supported) +#endif { srcptr = png_ptr->row_buf + 1; dstptr = row; @@ -987,8 +1010,10 @@ png_do_read_interlace(png_structp png_ptr) png_debug(1,"in png_do_read_interlace\n"); if (mmx_supported == 2) { +#if !defined(PNG_1_0_X) /* this should have happened in png_init_mmx_flags() already */ png_warning(png_ptr, "asm_flags may not have been initialized"); +#endif png_mmx_support(); } @@ -1189,8 +1214,12 @@ png_do_read_interlace(png_structp png_ptr) // NOTE: there is NO MMX code for 48-bit and 64-bit images // use MMX routine if machine supports it +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_INTERLACE) /* && mmx_supported */ ) +#else + if (mmx_supported) +#endif { if (pixel_bytes == 3) { @@ -1874,8 +1903,8 @@ loop4_pass4: } /* end switch (row_info->pixel_depth) */ row_info->width = final_width; - row_info->rowbytes = ((final_width * - (png_uint_32)row_info->pixel_depth + 7) >> 3); + + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,final_width); } } @@ -3603,7 +3632,7 @@ duploop: jz dupend - // 2 lines added by lcreeve@netins.net + // 2 lines added by lcreeve at netins.net // (mail 11 Jul 98 in png-implement list) cmp edx, 8 //test for less than 8 bytes jb duplt8 @@ -3652,8 +3681,10 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep #endif if (mmx_supported == 2) { +#if !defined(PNG_1_0_X) /* this should have happened in png_init_mmx_flags() already */ png_warning(png_ptr, "asm_flags may not have been initialized"); +#endif png_mmx_support(); } @@ -3663,6 +3694,7 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep { case 0: sprintf(filnm, "none"); break; +#if !defined(PNG_1_0_X) case 1: sprintf(filnm, "sub-%s", (png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_SUB)? "MMX" : "x86"); break; @@ -3675,6 +3707,16 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep case 4: sprintf(filnm, "Paeth-%s", (png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_PAETH)? "MMX":"x86"); break; +#else + case 1: sprintf(filnm, "sub"); + break; + case 2: sprintf(filnm, "up"); + break; + case 3: sprintf(filnm, "avg"); + break; + case 4: sprintf(filnm, "Paeth"); + break; +#endif default: sprintf(filnm, "unknw"); break; } @@ -3691,9 +3733,13 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep case PNG_FILTER_VALUE_SUB: { +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_SUB) && (row_info->pixel_depth >= png_ptr->mmx_bitdepth_threshold) && (row_info->rowbytes >= png_ptr->mmx_rowbytes_threshold)) +#else + if (mmx_supported) +#endif { png_read_filter_row_mmx_sub(row_info, row); } @@ -3716,9 +3762,13 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep case PNG_FILTER_VALUE_UP: { +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_UP) && (row_info->pixel_depth >= png_ptr->mmx_bitdepth_threshold) && (row_info->rowbytes >= png_ptr->mmx_rowbytes_threshold)) +#else + if (mmx_supported) +#endif { png_read_filter_row_mmx_up(row_info, row, prev_row); } @@ -3740,9 +3790,13 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep case PNG_FILTER_VALUE_AVG: { +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_AVG) && (row_info->pixel_depth >= png_ptr->mmx_bitdepth_threshold) && (row_info->rowbytes >= png_ptr->mmx_rowbytes_threshold)) +#else + if (mmx_supported) +#endif { png_read_filter_row_mmx_avg(row_info, row, prev_row); } @@ -3774,9 +3828,13 @@ png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep case PNG_FILTER_VALUE_PAETH: { +#if !defined(PNG_1_0_X) if ((png_ptr->asm_flags & PNG_ASM_FLAG_MMX_READ_FILTER_PAETH) && (row_info->pixel_depth >= png_ptr->mmx_bitdepth_threshold) && (row_info->rowbytes >= png_ptr->mmx_rowbytes_threshold)) +#else + if (mmx_supported) +#endif { png_read_filter_row_mmx_paeth(row_info, row, prev_row); } diff --git a/src/libs/png/pngwio.c b/src/libs/png/pngwio.c index b39b4145f0..d5d61f49e0 100644 --- a/src/libs/png/pngwio.c +++ b/src/libs/png/pngwio.c @@ -1,9 +1,9 @@ /* pngwio.c - functions for data output * - * libpng 1.2.5 - October 3, 2002 + * libpng 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * diff --git a/src/libs/png/pngwrite.c b/src/libs/png/pngwrite.c index 10c9ea4068..3246fdaafc 100644 --- a/src/libs/png/pngwrite.c +++ b/src/libs/png/pngwrite.c @@ -1,9 +1,9 @@ /* pngwrite.c - general routines to write a PNG file * - * libpng 1.2.5 - October 3, 2002 + * libpng 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) */ @@ -104,9 +104,10 @@ png_write_info_before_PLTE(png_structp png_ptr, png_infop info_ptr) up++) { int keep=png_handle_as_unknown(png_ptr, up->name); - if (keep != HANDLE_CHUNK_NEVER && - up->location && (!(up->location & PNG_HAVE_PLTE)) && - ((up->name[3] & 0x20) || keep == HANDLE_CHUNK_ALWAYS || + if (keep != PNG_HANDLE_CHUNK_NEVER && + up->location && !(up->location & PNG_HAVE_PLTE) && + !(up->location & PNG_HAVE_IDAT) && + ((up->name[3] & 0x20) || keep == PNG_HANDLE_CHUNK_ALWAYS || (png_ptr->flags & PNG_FLAG_KEEP_UNSAFE_CHUNKS))) { png_write_chunk(png_ptr, up->name, up->data, up->size); @@ -267,10 +268,10 @@ png_write_info(png_structp png_ptr, png_infop info_ptr) up++) { int keep=png_handle_as_unknown(png_ptr, up->name); - if (keep != HANDLE_CHUNK_NEVER && + if (keep != PNG_HANDLE_CHUNK_NEVER && up->location && (up->location & PNG_HAVE_PLTE) && !(up->location & PNG_HAVE_IDAT) && - ((up->name[3] & 0x20) || keep == HANDLE_CHUNK_ALWAYS || + ((up->name[3] & 0x20) || keep == PNG_HANDLE_CHUNK_ALWAYS || (png_ptr->flags & PNG_FLAG_KEEP_UNSAFE_CHUNKS))) { png_write_chunk(png_ptr, up->name, up->data, up->size); @@ -367,9 +368,9 @@ png_write_end(png_structp png_ptr, png_infop info_ptr) up++) { int keep=png_handle_as_unknown(png_ptr, up->name); - if (keep != HANDLE_CHUNK_NEVER && + if (keep != PNG_HANDLE_CHUNK_NEVER && up->location && (up->location & PNG_AFTER_IDAT) && - ((up->name[3] & 0x20) || keep == HANDLE_CHUNK_ALWAYS || + ((up->name[3] & 0x20) || keep == PNG_HANDLE_CHUNK_ALWAYS || (png_ptr->flags & PNG_FLAG_KEEP_UNSAFE_CHUNKS))) { png_write_chunk(png_ptr, up->name, up->data, up->size); @@ -457,6 +458,12 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, #endif #endif /* PNG_1_0_X */ + /* added at libpng-1.2.6 */ +#ifdef PNG_SET_USER_LIMITS_SUPPORTED + png_ptr->user_width_max=PNG_USER_WIDTH_MAX; + png_ptr->user_height_max=PNG_USER_HEIGHT_MAX; +#endif + #ifdef PNG_SETJMP_SUPPORTED #ifdef USE_FAR_KEYWORD if (setjmp(jmpbuf)) @@ -470,7 +477,7 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, return (NULL); } #ifdef USE_FAR_KEYWORD - png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf)); #endif #endif @@ -537,7 +544,7 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, #ifdef USE_FAR_KEYWORD if (setjmp(jmpbuf)) PNG_ABORT(); - png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf)); #else if (setjmp(png_ptr->jmpbuf)) PNG_ABORT(); @@ -561,7 +568,8 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver, { /* We only come here via pre-1.0.12-compiled applications */ #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE) - if(sizeof(png_struct) > png_struct_size || sizeof(png_info) > png_info_size) + if(png_sizeof(png_struct) > png_struct_size || + png_sizeof(png_info) > png_info_size) { char msg[80]; png_ptr->warning_fn=NULL; @@ -576,7 +584,7 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver, png_warning(png_ptr, msg); } #endif - if(sizeof(png_struct) > png_struct_size) + if(png_sizeof(png_struct) > png_struct_size) { png_ptr->error_fn=NULL; #ifdef PNG_ERROR_NUMBERS_SUPPORTED @@ -585,7 +593,7 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver, png_error(png_ptr, "The png struct allocated by the application for writing is too small."); } - if(sizeof(png_info) > png_info_size) + if(png_sizeof(png_info) > png_info_size) { png_ptr->error_fn=NULL; #ifdef PNG_ERROR_NUMBERS_SUPPORTED @@ -626,10 +634,10 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, #ifdef PNG_SETJMP_SUPPORTED /* save jump buffer and error functions */ - png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf)); + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf)); #endif - if (sizeof(png_struct) > png_struct_size) + if (png_sizeof(png_struct) > png_struct_size) { png_destroy_struct(png_ptr); png_ptr = (png_structp)png_create_struct(PNG_STRUCT_PNG); @@ -637,7 +645,13 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, } /* reset all variables to 0 */ - png_memset(png_ptr, 0, sizeof (png_struct)); + png_memset(png_ptr, 0, png_sizeof (png_struct)); + + /* added at libpng-1.2.6 */ +#ifdef PNG_SET_USER_LIMITS_SUPPORTED + png_ptr->user_width_max=PNG_USER_WIDTH_MAX; + png_ptr->user_height_max=PNG_USER_HEIGHT_MAX; +#endif #if !defined(PNG_1_0_X) #ifdef PNG_ASSEMBLER_CODE_SUPPORTED @@ -647,7 +661,7 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, #ifdef PNG_SETJMP_SUPPORTED /* restore jump buffer */ - png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf)); + png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf)); #endif png_set_write_fn(png_ptr, png_voidp_NULL, png_rw_ptr_NULL, @@ -827,8 +841,8 @@ png_write_row(png_structp png_ptr, png_bytep row) png_ptr->row_info.pixel_depth = (png_byte)(png_ptr->row_info.bit_depth * png_ptr->row_info.channels); - png_ptr->row_info.rowbytes = ((png_ptr->row_info.width * - (png_uint_32)png_ptr->row_info.pixel_depth + 7) >> 3); + png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth, + png_ptr->row_info.width); png_debug1(3, "row_info->color_type = %d\n", png_ptr->row_info.color_type); png_debug1(3, "row_info->width = %lu\n", png_ptr->row_info.width); @@ -1049,7 +1063,7 @@ png_write_destroy(png_structp png_ptr) #ifdef PNG_SETJMP_SUPPORTED /* reset structure */ - png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf)); + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf)); #endif error_fn = png_ptr->error_fn; @@ -1059,7 +1073,7 @@ png_write_destroy(png_structp png_ptr) free_fn = png_ptr->free_fn; #endif - png_memset(png_ptr, 0, sizeof (png_struct)); + png_memset(png_ptr, 0, png_sizeof (png_struct)); png_ptr->error_fn = error_fn; png_ptr->warning_fn = warning_fn; @@ -1069,7 +1083,7 @@ png_write_destroy(png_structp png_ptr) #endif #ifdef PNG_SETJMP_SUPPORTED - png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf)); + png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf)); #endif } @@ -1211,7 +1225,7 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method, if (png_ptr->prev_filters == NULL) { png_ptr->prev_filters = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_byte) * num_weights)); + (png_uint_32)(png_sizeof(png_byte) * num_weights)); /* To make sure that the weighting starts out fairly */ for (i = 0; i < num_weights; i++) @@ -1223,10 +1237,10 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method, if (png_ptr->filter_weights == NULL) { png_ptr->filter_weights = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_uint_16) * num_weights)); + (png_uint_32)(png_sizeof(png_uint_16) * num_weights)); png_ptr->inv_filter_weights = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_uint_16) * num_weights)); + (png_uint_32)(png_sizeof(png_uint_16) * num_weights)); for (i = 0; i < num_weights; i++) { png_ptr->inv_filter_weights[i] = @@ -1257,10 +1271,10 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method, if (png_ptr->filter_costs == NULL) { png_ptr->filter_costs = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST)); + (png_uint_32)(png_sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST)); png_ptr->inv_filter_costs = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST)); + (png_uint_32)(png_sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST)); for (i = 0; i < PNG_FILTER_VALUE_LAST; i++) { diff --git a/src/libs/png/pngwtran.c b/src/libs/png/pngwtran.c index c28da116b7..f1c8b3e62a 100644 --- a/src/libs/png/pngwtran.c +++ b/src/libs/png/pngwtran.c @@ -1,9 +1,9 @@ /* pngwtran.c - transforms the data in a row for PNG writers * - * libpng 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) */ @@ -195,8 +195,8 @@ png_do_pack(png_row_infop row_info, png_bytep row, png_uint_32 bit_depth) } row_info->bit_depth = (png_byte)bit_depth; row_info->pixel_depth = (png_byte)(bit_depth * row_info->channels); - row_info->rowbytes = - ((row_info->width * row_info->pixel_depth + 7) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, + row_info->width); } } #endif @@ -546,15 +546,15 @@ png_do_write_intrapixel(png_row_infop row_info, png_bytep row) for (i = 0, rp = row; i < row_width; i++, rp += bytes_per_pixel) { - png_uint_32 s0=*(rp )<<8 | *(rp+1); - png_uint_32 s1=*(rp+2)<<8 | *(rp+3); - png_uint_32 s2=*(rp+4)<<8 | *(rp+5); - png_uint_32 red=(s0-s1)&0xffff; - png_uint_32 blue=(s2-s1)&0xffff; - *(rp ) = (png_byte)((red>>8)&0xff); - *(rp+1) = (png_byte)(red&0xff); - *(rp+4) = (png_byte)((blue>>8)&0xff); - *(rp+5) = (png_byte)(blue&0xff); + png_uint_32 s0 = (*(rp ) << 8) | *(rp+1); + png_uint_32 s1 = (*(rp+2) << 8) | *(rp+3); + png_uint_32 s2 = (*(rp+4) << 8) | *(rp+5); + png_uint_32 red = (png_uint_32)((s0-s1) & 0xffffL); + png_uint_32 blue = (png_uint_32)((s2-s1) & 0xffffL); + *(rp ) = (png_byte)((red >> 8) & 0xff); + *(rp+1) = (png_byte)(red & 0xff); + *(rp+4) = (png_byte)((blue >> 8) & 0xff); + *(rp+5) = (png_byte)(blue & 0xff); } } } diff --git a/src/libs/png/pngwutil.c b/src/libs/png/pngwutil.c index 4b5ab6c87e..dd7b150b75 100644 --- a/src/libs/png/pngwutil.c +++ b/src/libs/png/pngwutil.c @@ -1,9 +1,9 @@ /* pngwutil.c - utilities to write a PNG file * - * libpng 1.2.5 - October 3, 2002 + * libpng version 1.2.8 - December 3, 2004 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2002 Glenn Randers-Pehrson + * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) */ @@ -219,7 +219,7 @@ png_text_compress(png_structp png_ptr, png_error(png_ptr, "zlib error"); } /* check to see if we need more room */ - if (!png_ptr->zstream.avail_out && png_ptr->zstream.avail_in) + if (!(png_ptr->zstream.avail_out)) { /* make sure the output array has room */ if (comp->num_output_ptr >= comp->max_output_ptr) @@ -234,14 +234,16 @@ png_text_compress(png_structp png_ptr, old_ptr = comp->output_ptr; comp->output_ptr = (png_charpp)png_malloc(png_ptr, - (png_uint_32)(comp->max_output_ptr * sizeof (png_charpp))); + (png_uint_32)(comp->max_output_ptr * + png_sizeof (png_charpp))); png_memcpy(comp->output_ptr, old_ptr, old_max - * sizeof (png_charp)); + * png_sizeof (png_charp)); png_free(png_ptr, old_ptr); } else comp->output_ptr = (png_charpp)png_malloc(png_ptr, - (png_uint_32)(comp->max_output_ptr * sizeof (png_charp))); + (png_uint_32)(comp->max_output_ptr * + png_sizeof (png_charp))); } /* save the data */ @@ -283,14 +285,16 @@ png_text_compress(png_structp png_ptr, old_ptr = comp->output_ptr; /* This could be optimized to realloc() */ comp->output_ptr = (png_charpp)png_malloc(png_ptr, - (png_uint_32)(comp->max_output_ptr * sizeof (png_charpp))); + (png_uint_32)(comp->max_output_ptr * + png_sizeof (png_charpp))); png_memcpy(comp->output_ptr, old_ptr, - old_max * sizeof (png_charp)); + old_max * png_sizeof (png_charp)); png_free(png_ptr, old_ptr); } else comp->output_ptr = (png_charpp)png_malloc(png_ptr, - (png_uint_32)(comp->max_output_ptr * sizeof (png_charp))); + (png_uint_32)(comp->max_output_ptr * + png_sizeof (png_charp))); } /* save off the data */ @@ -353,9 +357,9 @@ png_write_compressed_data_out(png_structp png_ptr, compression_state *comp) png_write_chunk_data(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size - png_ptr->zstream.avail_out); - /* reset zlib for another zTXt/iTXt or the image data */ + /* reset zlib for another zTXt/iTXt or image data */ deflateReset(&png_ptr->zstream); - + png_ptr->zstream.data_type = Z_BINARY; } #endif @@ -464,11 +468,12 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height, #if defined(PNG_MNG_FEATURES_SUPPORTED) png_ptr->filter_type = (png_byte)filter_type; #endif + png_ptr->compression_type = (png_byte)compression_type; png_ptr->width = width; png_ptr->height = height; png_ptr->pixel_depth = (png_byte)(bit_depth * png_ptr->channels); - png_ptr->rowbytes = ((width * (png_size_t)png_ptr->pixel_depth + 7) >> 3); + png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, width); /* set the usr info, so any transformations can modify it */ png_ptr->usr_width = png_ptr->width; png_ptr->usr_bit_depth = png_ptr->bit_depth; @@ -518,6 +523,9 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height, png_ptr->zlib_mem_level, png_ptr->zlib_strategy); png_ptr->zstream.next_out = png_ptr->zbuf; png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size; + /* libpng is not interested in zstream.data_type */ + /* set it to a predefined value, to avoid its evaluation inside zlib */ + png_ptr->zstream.data_type = Z_BINARY; png_ptr->mode = PNG_HAVE_IHDR; } @@ -596,6 +604,46 @@ png_write_IDAT(png_structp png_ptr, png_bytep data, png_size_t length) PNG_IDAT; #endif png_debug(1, "in png_write_IDAT\n"); + + /* Optimize the CMF field in the zlib stream. */ + /* This hack of the zlib stream is compliant to the stream specification. */ + if (!(png_ptr->mode & PNG_HAVE_IDAT) && + png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE) + { + unsigned int z_cmf = data[0]; /* zlib compression method and flags */ + if ((z_cmf & 0x0f) == 8 && (z_cmf & 0xf0) <= 0x70) + { + /* Avoid memory underflows and multiplication overflows. */ + /* The conditions below are practically always satisfied; + however, they still must be checked. */ + if (length >= 2 && + png_ptr->height < 16384 && png_ptr->width < 16384) + { + png_uint_32 uncompressed_idat_size = png_ptr->height * + ((png_ptr->width * + png_ptr->channels * png_ptr->bit_depth + 15) >> 3); + unsigned int z_cinfo = z_cmf >> 4; + unsigned int half_z_window_size = 1 << (z_cinfo + 7); + while (uncompressed_idat_size <= half_z_window_size && + half_z_window_size >= 256) + { + z_cinfo--; + half_z_window_size >>= 1; + } + z_cmf = (z_cmf & 0x0f) | (z_cinfo << 4); + if (data[0] != (png_byte)z_cmf) + { + data[0] = (png_byte)z_cmf; + data[1] &= 0xe0; + data[1] += (png_byte)(0x1f - ((z_cmf << 8) + data[1]) % 0x1f); + } + } + } + else + png_error(png_ptr, + "Invalid zlib compression method or flags in IDAT"); + } + png_write_chunk(png_ptr, (png_bytep)png_IDAT, data, length); png_ptr->mode |= PNG_HAVE_IDAT; } @@ -1141,7 +1189,12 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key) png_debug1(2, "Keyword to be checked is '%s'\n", key); - *new_key = (png_charp)png_malloc(png_ptr, (png_uint_32)(key_len + 2)); + *new_key = (png_charp)png_malloc_warn(png_ptr, (png_uint_32)(key_len + 2)); + if (*new_key == NULL) + { + png_warning(png_ptr, "Out of memory while procesing keyword"); + return ((png_size_t)0); + } /* Replace non-printing characters with a blank and print a warning */ for (kp = key, dp = *new_key; *kp != '\0'; kp++, dp++) @@ -1353,7 +1406,7 @@ png_write_iTXt(png_structp png_ptr, int compression, png_charp key, { png_warning(png_ptr, "Empty language field in iTXt chunk"); new_lang = NULL; - lang_len = 0; + lang_len = 0; } if (lang_key == NULL) @@ -1461,7 +1514,7 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0, total_len = purpose_len + units_len + 10; params_len = (png_uint_32p)png_malloc(png_ptr, (png_uint_32)(nparams - *sizeof(png_uint_32))); + *png_sizeof(png_uint_32))); /* Find the length of each parameter, making sure we don't count the null terminator for the last parameter. */ @@ -1506,6 +1559,7 @@ png_write_sCAL(png_structp png_ptr, int unit, double width,double height) #endif png_size_t total_len; char wbuf[32], hbuf[32]; + png_byte bunit = unit; png_debug(1, "in png_write_sCAL\n"); @@ -1526,7 +1580,7 @@ png_write_sCAL(png_structp png_ptr, int unit, double width,double height) png_debug1(3, "sCAL total length = %d\n", (int)total_len); png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len); - png_write_chunk_data(png_ptr, (png_bytep)&unit, 1); + png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1); png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1); png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf)); @@ -1543,6 +1597,7 @@ png_write_sCAL_s(png_structp png_ptr, int unit, png_charp width, #endif png_size_t total_len; char wbuf[32], hbuf[32]; + png_byte bunit = unit; png_debug(1, "in png_write_sCAL_s\n"); @@ -1552,7 +1607,7 @@ png_write_sCAL_s(png_structp png_ptr, int unit, png_charp width, png_debug1(3, "sCAL total length = %d\n", total_len); png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len); - png_write_chunk_data(png_ptr, (png_bytep)&unit, 1); + png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1); png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1); png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf)); @@ -1641,8 +1696,8 @@ png_write_start_row(png_structp png_ptr) png_size_t buf_size; png_debug(1, "in png_write_start_row\n"); - buf_size = (png_size_t)(((png_ptr->width * png_ptr->usr_channels * - png_ptr->usr_bit_depth + 7) >> 3) + 1); + buf_size = (png_size_t)(PNG_ROWBYTES( + png_ptr->usr_channels*png_ptr->usr_bit_depth,png_ptr->width)+1); /* set up row buffer */ png_ptr->row_buf = (png_bytep)png_malloc(png_ptr, (png_uint_32)buf_size); @@ -1778,9 +1833,8 @@ png_write_finish_row(png_structp png_ptr) { if (png_ptr->prev_row != NULL) png_memset(png_ptr->prev_row, 0, - (png_size_t) (((png_uint_32)png_ptr->usr_channels * - (png_uint_32)png_ptr->usr_bit_depth * - png_ptr->width + 7) >> 3) + 1); + (png_size_t)(PNG_ROWBYTES(png_ptr->usr_channels* + png_ptr->usr_bit_depth,png_ptr->width))+1); return; } } @@ -1820,6 +1874,7 @@ png_write_finish_row(png_structp png_ptr) } deflateReset(&png_ptr->zstream); + png_ptr->zstream.data_type = Z_BINARY; } #if defined(PNG_WRITE_INTERLACING_SUPPORTED) @@ -1987,8 +2042,8 @@ png_do_write_interlace(png_row_infop row_info, png_bytep row, int pass) png_pass_inc[pass] - 1 - png_pass_start[pass]) / png_pass_inc[pass]; - row_info->rowbytes = ((row_info->width * - row_info->pixel_depth + 7) >> 3); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, + row_info->width); } } #endif @@ -1997,7 +2052,7 @@ png_do_write_interlace(png_row_infop row_info, png_bytep row, int pass) * been specified by the application, and then writes the row out with the * chosen filter. */ -#define PNG_MAXSUM (~((png_uint_32)0) >> 1) +#define PNG_MAXSUM (((png_uint_32)(-1)) >> 1) #define PNG_HISHIFT 10 #define PNG_LOMASK ((png_uint_32)0xffffL) #define PNG_HIMASK ((png_uint_32)(~PNG_LOMASK >> PNG_HISHIFT)) @@ -2014,7 +2069,7 @@ png_write_find_filter(png_structp png_ptr, png_row_infop row_info) png_debug(1, "in png_write_find_filter\n"); /* find out how many bytes offset each pixel is */ - bpp = (row_info->pixel_depth + 7) / 8; + bpp = (row_info->pixel_depth + 7) >> 3; prev_row = png_ptr->prev_row; best_row = row_buf = png_ptr->row_buf; @@ -2165,7 +2220,7 @@ png_write_find_filter(png_structp png_ptr, png_row_infop row_info) sum += (v < 128) ? v : 256 - v; } - for (lp = row_buf + 1; i < row_info->rowbytes; + for (lp = row_buf + 1; i < row_bytes; i++, rp++, lp++, dp++) { v = *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);