diff -ru4NwbB libpng-1.5.5/Makefile.am libpng-1.5.6rc03/Makefile.am --- libpng-1.5.5/Makefile.am 2011-09-22 08:40:30.800561021 -0500 +++ libpng-1.5.6rc03/Makefile.am 2011-10-27 19:44:47.223253863 -0500 @@ -45,9 +45,9 @@ if HAVE_LD_VERSION_SCRIPT # Versioned symbols and restricted exports if HAVE_SOLARIS_LD - libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_LDFLAGS += -Wl,-M Wl,libpng.vers + libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_LDFLAGS += -Wl,-M -Wl,libpng.vers else libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@_la_LDFLAGS += -Wl,--version-script=libpng.vers endif diff -ru4NwbB libpng-1.5.5/contrib/gregbook/rpng2-win.c libpng-1.5.6rc03/contrib/gregbook/rpng2-win.c --- libpng-1.5.5/contrib/gregbook/rpng2-win.c 2011-09-22 08:40:23.924287999 -0500 +++ libpng-1.5.6rc03/contrib/gregbook/rpng2-win.c 2011-10-27 19:44:40.297792917 -0500 @@ -589,9 +589,9 @@ fprintf(stderr, PROGNAME ": end of file reached " "(unexpectedly) while reading PNG image file\n"); exit(3); } else /* if (error) */ { - // will print error message below + /* will print error message below */ } break; } diff -ru4NwbB libpng-1.5.5/contrib/gregbook/rpng2-x.c libpng-1.5.6rc03/contrib/gregbook/rpng2-x.c --- libpng-1.5.5/contrib/gregbook/rpng2-x.c 2011-09-22 08:40:23.941920572 -0500 +++ libpng-1.5.6rc03/contrib/gregbook/rpng2-x.c 2011-10-27 19:44:40.315090662 -0500 @@ -590,9 +590,9 @@ fprintf(stderr, PROGNAME ": end of file reached " "(unexpectedly) while reading PNG image file\n"); exit(3); } else /* if (error) */ { - // will print error message below + /* will print error message below */ } break; } diff -ru4NwbB libpng-1.5.5/contrib/pngminim/decoder/pngusr.h libpng-1.5.6rc03/contrib/pngminim/decoder/pngusr.h --- libpng-1.5.5/contrib/pngminim/decoder/pngusr.h 2011-09-22 08:40:24.400672849 -0500 +++ libpng-1.5.6rc03/contrib/pngminim/decoder/pngusr.h 2011-10-27 19:44:40.783351457 -0500 @@ -18,6 +18,7 @@ * affect the API (so are not recorded in pnglibconf.h) */ #define PNG_NO_WARNINGS +#define PNG_ALIGN_TYPE PNG_ALIGN_NONE #endif /* MINRDPNGCONF_H */ diff -ru4NwbB libpng-1.5.5/contrib/pngminim/encoder/pngusr.h libpng-1.5.6rc03/contrib/pngminim/encoder/pngusr.h --- libpng-1.5.5/contrib/pngminim/encoder/pngusr.h 2011-09-22 08:40:24.434896752 -0500 +++ libpng-1.5.6rc03/contrib/pngminim/encoder/pngusr.h 2011-10-27 19:44:40.817319137 -0500 @@ -18,6 +18,7 @@ * affect the API (so are not recorded in pnglibconf.h) */ #define PNG_NO_WARNINGS +#define PNG_ALIGN_TYPE PNG_ALIGN_NONE #endif /* MINWRPNGCONF_H */ diff -ru4NwbB libpng-1.5.5/contrib/pngminim/preader/pngusr.h libpng-1.5.6rc03/contrib/pngminim/preader/pngusr.h --- libpng-1.5.5/contrib/pngminim/preader/pngusr.h 2011-09-22 08:40:24.469878003 -0500 +++ libpng-1.5.6rc03/contrib/pngminim/preader/pngusr.h 2011-10-27 19:44:40.851430905 -0500 @@ -18,6 +18,7 @@ * affect the API (so are not recorded in pnglibconf.h) */ #define PNG_NO_WARNINGS +#define PNG_ALIGN_TYPE PNG_ALIGN_NONE #endif /* MINPRDPNGCONF_H */ diff -ru4NwbB libpng-1.5.5/example.c libpng-1.5.6rc03/example.c --- libpng-1.5.5/example.c 2011-09-22 08:40:23.574203730 -0500 +++ libpng-1.5.6rc03/example.c 2011-10-27 19:44:39.948309003 -0500 @@ -1,9 +1,9 @@ #if 0 /* in case someone actually tries to compile this */ /* example.c - an example of using libpng - * Last changed in libpng 1.5.4 [July 7, 2011] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * This file has been placed in the public domain by the authors. * Maintained 1998-2011 Glenn Randers-Pehrson * Maintained 1996, 1997 Andreas Dilger) * Written 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -340,13 +340,18 @@ /* Add filler (or alpha) byte (before/after each RGB triplet) */ png_set_filler(png_ptr, 0xff, PNG_FILLER_AFTER); +#ifdef PNG_READ_INTERLACING_SUPPORTED /* Turn on interlace handling. REQUIRED if you are not using * png_read_image(). To see how to handle interlacing passes, * see the png_read_row() method below: */ number_passes = png_set_interlace_handling(png_ptr); +#else + number_passes = 1; +#endif /* PNG_READ_INTERLACING_SUPPORTED */ + /* Optional call to gamma correct and add the background to the palette * and update info structure. REQUIRED if you are expecting libpng to * update the palette for you (ie you selected such a transform above). @@ -526,8 +531,9 @@ * PNG read buffer. */ png_bytep old_row = ((png_bytep *)our_data)[row_num]; +#ifdef PNG_READ_INTERLACING_SUPPORTED /* If both rows are allocated then copy the new row * data to the corresponding row data. */ if ((old_row != NULL) && (new_row != NULL)) @@ -554,8 +560,9 @@ * the first pass (and only for interlaced images), you will have * to pass the current row as new_row, and the function will combine * the old row and the new row. */ +#endif /* PNG_READ_INTERLACING_SUPPORTED */ } end_callback(png_structp png_ptr, png_infop info) { diff -ru4NwbB libpng-1.5.5/png.c libpng-1.5.6rc03/png.c --- libpng-1.5.5/png.c 2011-09-22 08:40:23.586373221 -0500 +++ libpng-1.5.6rc03/png.c 2011-10-27 19:44:39.960346221 -0500 @@ -1,8 +1,8 @@ /* png.c - location for general purpose libpng functions * - * Last changed in libpng 1.5.5 [(PENDING RELEASE)] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -120,9 +120,9 @@ png_calculate_crc(png_structp png_ptr, png_const_bytep ptr, png_size_t length) { int need_crc = 1; - if (png_ptr->chunk_name[0] & 0x20) /* ancillary */ + if (PNG_CHUNK_ANCILLIARY(png_ptr->chunk_name)) { if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) == (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN)) need_crc = 0; @@ -697,27 +697,45 @@ return PNG_HEADER_VERSION_STRING; #endif } -#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) # ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED int PNGAPI png_handle_as_unknown(png_structp png_ptr, png_const_bytep chunk_name) { /* Check chunk_name and return "keep" value if it's on the list, else 0 */ - int i; - png_bytep p; + png_const_bytep p, p_end; + if (png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list<=0) - return 0; + return PNG_HANDLE_CHUNK_AS_DEFAULT; + + p_end = png_ptr->chunk_list; + p = p_end + png_ptr->num_chunk_list*5; /* beyond end */ - p = png_ptr->chunk_list + png_ptr->num_chunk_list*5 - 5; - for (i = png_ptr->num_chunk_list; i; i--, p -= 5) + /* The code is the fifth byte after each four byte string. Historically this + * code was always searched from the end of the list, so it should continue + * to do so in case there are duplicated entries. + */ + do /* num_chunk_list > 0, so at least one */ + { + p -= 5; if (!png_memcmp(chunk_name, p, 4)) - return ((int)*(p + 4)); - return 0; + return p[4]; + } + while (p > p_end); + + return PNG_HANDLE_CHUNK_AS_DEFAULT; +} + +int /* PRIVATE */ +png_chunk_unknown_handling(png_structp png_ptr, png_uint_32 chunk_name) +{ + png_byte chunk_string[5]; + + PNG_CSTRING_FROM_CHUNK(chunk_string, chunk_name); + return png_handle_as_unknown(png_ptr, chunk_string); } # endif -#endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */ #ifdef PNG_READ_SUPPORTED /* This function, added to libpng-1.0.6g, is untested. */ int PNGAPI @@ -2644,8 +2662,62 @@ else for (i=0; i<256; ++i) table[i] = (png_byte)i; } +/* Used from png_read_destroy and below to release the memory used by the gamma + * tables. + */ +void /* PRIVATE */ +png_destroy_gamma_table(png_structp png_ptr) +{ + png_free(png_ptr, png_ptr->gamma_table); + png_ptr->gamma_table = NULL; + + if (png_ptr->gamma_16_table != NULL) + { + int i; + int istop = (1 << (8 - png_ptr->gamma_shift)); + for (i = 0; i < istop; i++) + { + png_free(png_ptr, png_ptr->gamma_16_table[i]); + } + png_free(png_ptr, png_ptr->gamma_16_table); + png_ptr->gamma_16_table = NULL; + } + +#if defined(PNG_READ_BACKGROUND_SUPPORTED) || \ + defined(PNG_READ_ALPHA_MODE_SUPPORTED) || \ + defined(PNG_READ_RGB_TO_GRAY_SUPPORTED) + png_free(png_ptr, png_ptr->gamma_from_1); + png_ptr->gamma_from_1 = NULL; + png_free(png_ptr, png_ptr->gamma_to_1); + png_ptr->gamma_to_1 = NULL; + + if (png_ptr->gamma_16_from_1 != NULL) + { + int i; + int istop = (1 << (8 - png_ptr->gamma_shift)); + for (i = 0; i < istop; i++) + { + png_free(png_ptr, png_ptr->gamma_16_from_1[i]); + } + png_free(png_ptr, png_ptr->gamma_16_from_1); + png_ptr->gamma_16_from_1 = NULL; + } + if (png_ptr->gamma_16_to_1 != NULL) + { + int i; + int istop = (1 << (8 - png_ptr->gamma_shift)); + for (i = 0; i < istop; i++) + { + png_free(png_ptr, png_ptr->gamma_16_to_1[i]); + } + png_free(png_ptr, png_ptr->gamma_16_to_1); + png_ptr->gamma_16_to_1 = NULL; + } +#endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */ +} + /* We build the 8- or 16-bit gamma tables here. Note that for 16-bit * tables, we don't make a full table if we are reducing to 8-bit in * the future. Note also how the gamma_16 tables are segmented so that * we don't need to allocate > 64K chunks for a full 16-bit table. @@ -2654,8 +2726,20 @@ png_build_gamma_table(png_structp png_ptr, int bit_depth) { png_debug(1, "in png_build_gamma_table"); + /* Remove any existing table; this copes with multiple calls to + * png_read_update_info. The warning is because building the gamma tables + * multiple times is a performance hit - it's harmless but the ability to call + * png_read_update_info() multiple times is new in 1.5.6 so it seems sensible + * to warn if the app introduces such a hit. + */ + if (png_ptr->gamma_table != NULL || png_ptr->gamma_16_table != NULL) + { + png_warning(png_ptr, "gamma table being rebuilt"); + png_destroy_gamma_table(png_ptr); + } + if (bit_depth <= 8) { png_build_8bit_table(png_ptr, &png_ptr->gamma_table, png_ptr->screen_gamma > 0 ? png_reciprocal2(png_ptr->gamma, diff -ru4NwbB libpng-1.5.5/png.h libpng-1.5.6rc03/png.h --- libpng-1.5.5/png.h 2011-09-22 08:40:23.533998570 -0500 +++ libpng-1.5.6rc03/png.h 2011-10-27 19:44:39.908862521 -0500 @@ -159,8 +159,10 @@ * 1.5.4 15 10504 15.so.15.4[.0] * 1.5.5beta01-08 15 10505 15.so.15.5[.0] * 1.5.5rc01 15 10505 15.so.15.5[.0] * 1.5.5 15 10505 15.so.15.5[.0] + * 1.5.6beta01-07 15 10506 15.so.15.6[.0] + * 1.5.6rc01-03 15 10506 15.so.15.6[.0] * * Henceforth the source version will match the shared-library major * and minor numbers; the shared-library major version number will be * used for changes in backward compatibility, as it is intended. The @@ -1829,15 +1831,17 @@ * following data to the next call to png_process_data. */ PNG_EXPORT(220, png_uint_32, png_process_data_skip, (png_structp)); +#ifdef PNG_READ_INTERLACING_SUPPORTED /* Function that combines rows. 'new_row' is a flag that should come from * the callback and be non-NULL if anything needs to be done; the library * stores its own version of the new data internally and ignores the passed * in value. */ PNG_EXPORT(93, void, png_progressive_combine_row, (png_structp png_ptr, png_bytep old_row, png_const_bytep new_row)); +#endif /* PNG_READ_INTERLACING_SUPPORTED */ #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */ PNG_EXPORTA(94, png_voidp, png_malloc, (png_structp png_ptr, png_alloc_size_t size), @@ -2304,17 +2308,23 @@ #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED /* Provide a list of chunks and how they are to be handled, if the built-in handling or default unknown chunk handling is not desired. Any chunks not listed will be handled in the default manner. The IHDR and IEND chunks - must not be listed. - keep = 0: follow default behavior - = 1: do not keep - = 2: keep only if safe-to-copy - = 3: keep even if unsafe-to-copy + must not be listed. Because this turns off the default handling for chunks + that would otherwise be recognized the behavior of libpng transformations may + well become incorrect! + keep = 0: PNG_HANDLE_CHUNK_AS_DEFAULT: follow default behavior + = 1: PNG_HANDLE_CHUNK_NEVER: do not keep + = 2: PNG_HANDLE_CHUNK_IF_SAFE: keep only if safe-to-copy + = 3: PNG_HANDLE_CHUNK_ALWAYS: keep even if unsafe-to-copy */ PNG_EXPORT(172, void, png_set_keep_unknown_chunks, (png_structp png_ptr, int keep, png_const_bytep chunk_list, int num_chunks)); + +/* The handling code is returned; the result is therefore true (non-zero) if + * special handling is required, false for the default handling. + */ PNG_EXPORT(173, int, png_handle_as_unknown, (png_structp png_ptr, png_const_bytep chunk_name)); #endif #ifdef PNG_UNKNOWN_CHUNKS_SUPPORTED @@ -2452,10 +2462,18 @@ /* Two macros to return the first row and first column of the original, * full, image which appears in a given pass. 'pass' is in the range 0 * to 6 and the result is in the range 0 to 7. */ -#define PNG_PASS_START_ROW(pass) (((1U&~(pass))<<(3-((pass)>>1)))&7) -#define PNG_PASS_START_COL(pass) (((1U& (pass))<<(3-(((pass)+1)>>1)))&7) +#define PNG_PASS_START_ROW(pass) (((1&~(pass))<<(3-((pass)>>1)))&7) +#define PNG_PASS_START_COL(pass) (((1& (pass))<<(3-(((pass)+1)>>1)))&7) + +/* A macro to return the offset between pixels in the output row for a pair of + * pixels in the input - effectively the inverse of the 'COL_SHIFT' macro that + * follows. Note that ROW_OFFSET is the offset from one row to the next whereas + * COL_OFFSET is from one column to the next, within a row. + */ +#define PNG_PASS_ROW_OFFSET(pass) ((pass)>2?(8>>(((pass)-1)>>1)):8) +#define PNG_PASS_COL_OFFSET(pass) (1<<((7-(pass))>>1)) /* Two macros to help evaluate the number of rows or columns in each * pass. This is expressed as a shift - effectively log2 of the number or * rows or columns in each 8x8 tile of the original image. @@ -2488,10 +2506,10 @@ * column version. The mask has the appropriate bit set for each column in * the tile. */ #define PNG_PASS_MASK(pass,off) ( \ - ((0x110145AFU>>(((7-(off))-(pass))<<2)) & 0xFU) | \ - ((0x01145AF0U>>(((7-(off))-(pass))<<2)) & 0xF0U)) + ((0x110145AF>>(((7-(off))-(pass))<<2)) & 0xF) | \ + ((0x01145AF0>>(((7-(off))-(pass))<<2)) & 0xF0)) #define PNG_ROW_IN_INTERLACE_PASS(y, pass) \ ((PNG_PASS_MASK(pass,0) >> ((y)&7)) & 1) #define PNG_COL_IN_INTERLACE_PASS(x, pass) \ diff -ru4NwbB libpng-1.5.5/pngerror.c libpng-1.5.6rc03/pngerror.c --- libpng-1.5.5/pngerror.c 2011-09-22 08:40:23.593144418 -0500 +++ libpng-1.5.6rc03/pngerror.c 2011-10-27 19:44:39.966823565 -0500 @@ -1,8 +1,8 @@ /* pngerror.c - stub functions for i/o and memory allocation * - * Last changed in libpng 1.5.4 [July 7, 2011] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -373,13 +373,16 @@ static void /* PRIVATE */ png_format_buffer(png_structp png_ptr, png_charp buffer, png_const_charp error_message) { - int iout = 0, iin = 0; + png_uint_32 chunk_name = png_ptr->chunk_name; + int iout = 0, ishift = 24; - while (iin < 4) + while (ishift >= 0) { - int c = png_ptr->chunk_name[iin++]; + int c = (int)(chunk_name >> ishift) & 0xff; + + ishift -= 8; if (isnonalpha(c)) { buffer[iout++] = PNG_LITERAL_LEFT_SQUARE_BRACKET; buffer[iout++] = png_digit[(c & 0xf0) >> 4]; @@ -388,21 +391,22 @@ } else { - buffer[iout++] = (png_byte)c; + buffer[iout++] = (char)c; } } if (error_message == NULL) buffer[iout] = '\0'; else { + int iin = 0; + buffer[iout++] = ':'; buffer[iout++] = ' '; - iin = 0; while (iin < PNG_MAX_ERROR_TEXT-1 && error_message[iin] != '\0') buffer[iout++] = error_message[iin++]; /* iin < PNG_MAX_ERROR_TEXT, so the following is safe: */ diff -ru4NwbB libpng-1.5.5/pngget.c libpng-1.5.6rc03/pngget.c --- libpng-1.5.5/pngget.c 2011-09-22 08:40:23.601095956 -0500 +++ libpng-1.5.6rc03/pngget.c 2011-10-27 19:44:39.974567658 -0500 @@ -1,8 +1,8 @@ /* pngget.c - retrieval of values from info struct * - * Last changed in libpng 1.5.5 [(PENDING RELEASE)] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -949,11 +949,10 @@ png_textp *text_ptr, int *num_text) { if (png_ptr != NULL && info_ptr != NULL && info_ptr->num_text > 0) { - png_debug1(1, "in %s retrieval function", - (png_ptr->chunk_name[0] == '\0' ? "text" : - (png_const_charp)png_ptr->chunk_name)); + png_debug1(1, "in 0x%lx retrieval function", + (unsigned long)png_ptr->chunk_name); if (text_ptr != NULL) *text_ptr = info_ptr->text; @@ -1110,18 +1108,16 @@ png_uint_32 PNGAPI png_get_io_chunk_type (png_const_structp png_ptr) { - return ((png_ptr->chunk_name[0] << 24) + - (png_ptr->chunk_name[1] << 16) + - (png_ptr->chunk_name[2] << 8) + - (png_ptr->chunk_name[3])); + return png_ptr->chunk_name; } png_const_bytep PNGAPI png_get_io_chunk_name (png_structp png_ptr) { - return png_ptr->chunk_name; + PNG_CSTRING_FROM_CHUNK(png_ptr->io_chunk_string, png_ptr->chunk_name); + return png_ptr->io_chunk_string; } #endif /* ?PNG_IO_STATE_SUPPORTED */ #endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */ diff -ru4NwbB libpng-1.5.5/pngpread.c libpng-1.5.6rc03/pngpread.c --- libpng-1.5.5/pngpread.c 2011-09-22 08:40:23.616672529 -0500 +++ libpng-1.5.6rc03/pngpread.c 2011-10-27 19:44:39.989947780 -0500 @@ -1,8 +1,8 @@ /* pngpread.c - read a png file in push mode * - * Last changed in libpng 1.5.2 [March 31, 2011] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -207,63 +207,9 @@ void /* PRIVATE */ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr) { - PNG_IHDR; - PNG_IDAT; - PNG_IEND; - PNG_PLTE; -#ifdef PNG_READ_bKGD_SUPPORTED - PNG_bKGD; -#endif -#ifdef PNG_READ_cHRM_SUPPORTED - PNG_cHRM; -#endif -#ifdef PNG_READ_gAMA_SUPPORTED - PNG_gAMA; -#endif -#ifdef PNG_READ_hIST_SUPPORTED - PNG_hIST; -#endif -#ifdef PNG_READ_iCCP_SUPPORTED - PNG_iCCP; -#endif -#ifdef PNG_READ_iTXt_SUPPORTED - PNG_iTXt; -#endif -#ifdef PNG_READ_oFFs_SUPPORTED - PNG_oFFs; -#endif -#ifdef PNG_READ_pCAL_SUPPORTED - PNG_pCAL; -#endif -#ifdef PNG_READ_pHYs_SUPPORTED - PNG_pHYs; -#endif -#ifdef PNG_READ_sBIT_SUPPORTED - PNG_sBIT; -#endif -#ifdef PNG_READ_sCAL_SUPPORTED - PNG_sCAL; -#endif -#ifdef PNG_READ_sRGB_SUPPORTED - PNG_sRGB; -#endif -#ifdef PNG_READ_sPLT_SUPPORTED - PNG_sPLT; -#endif -#ifdef PNG_READ_tEXt_SUPPORTED - PNG_tEXt; -#endif -#ifdef PNG_READ_tIME_SUPPORTED - PNG_tIME; -#endif -#ifdef PNG_READ_tRNS_SUPPORTED - PNG_tRNS; -#endif -#ifdef PNG_READ_zTXt_SUPPORTED - PNG_zTXt; -#endif + png_uint_32 chunk_name; /* First we make sure we have enough data for the 4 byte chunk name * and the 4 byte chunk length before proceeding with decoding the * chunk data. To fully decode each of these chunks, we also make @@ -272,8 +218,9 @@ */ if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER)) { png_byte chunk_length[4]; + png_byte chunk_tag[4]; if (png_ptr->buffer_size < 8) { png_push_save_buffer(png_ptr); @@ -282,18 +229,29 @@ png_push_fill_buffer(png_ptr, chunk_length, 4); png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); png_reset_crc(png_ptr); - png_crc_read(png_ptr, png_ptr->chunk_name, 4); + png_crc_read(png_ptr, chunk_tag, 4); + png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); png_check_chunk_name(png_ptr, png_ptr->chunk_name); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; } - if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) + chunk_name = png_ptr->chunk_name; + + if (chunk_name == png_IDAT) + { + /* This is here above the if/else case statement below because if the + * unknown handling marks 'IDAT' as unknown then the IDAT handling case is + * completely skipped. + * + * TODO: there must be a better way of doing this. + */ if (png_ptr->mode & PNG_AFTER_IDAT) png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT; + } - if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4)) + if (chunk_name == png_IHDR) { if (png_ptr->push_length != 13) png_error(png_ptr, "Invalid IHDR length"); @@ -305,9 +263,9 @@ png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length); } - else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4)) + else if (chunk_name == png_IEND) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -320,25 +278,25 @@ png_push_have_end(png_ptr, info_ptr); } #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED - else if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name)) + else if (png_chunk_unknown_handling(png_ptr, chunk_name)) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); return; } - if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) + if (chunk_name == png_IDAT) png_ptr->mode |= PNG_HAVE_IDAT; png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length); - if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4)) + if (chunk_name == png_PLTE) png_ptr->mode |= PNG_HAVE_PLTE; - else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) + else if (chunk_name == png_IDAT) { if (!(png_ptr->mode & PNG_HAVE_IHDR)) png_error(png_ptr, "Missing IHDR before IDAT"); @@ -348,9 +306,9 @@ } } #endif - else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4)) + else if (chunk_name == png_PLTE) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -358,9 +316,9 @@ } png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length); } - else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) + else if (chunk_name == png_IDAT) { /* If we reach an IDAT chunk, this means we have read all of the * header chunks, and we can start reading the image (or if this * is called after the image has been read - we have an error). @@ -394,9 +352,9 @@ return; } #ifdef PNG_READ_gAMA_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4)) + else if (png_ptr->chunk_name == png_gAMA) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -407,9 +365,9 @@ } #endif #ifdef PNG_READ_sBIT_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_sBIT, 4)) + else if (png_ptr->chunk_name == png_sBIT) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -420,9 +378,9 @@ } #endif #ifdef PNG_READ_cHRM_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_cHRM, 4)) + else if (png_ptr->chunk_name == png_cHRM) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -433,9 +391,9 @@ } #endif #ifdef PNG_READ_sRGB_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_sRGB, 4)) + else if (chunk_name == png_sRGB) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -446,9 +404,9 @@ } #endif #ifdef PNG_READ_iCCP_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_iCCP, 4)) + else if (png_ptr->chunk_name == png_iCCP) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -459,9 +417,9 @@ } #endif #ifdef PNG_READ_sPLT_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_sPLT, 4)) + else if (chunk_name == png_sPLT) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -472,9 +430,9 @@ } #endif #ifdef PNG_READ_tRNS_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_tRNS, 4)) + else if (chunk_name == png_tRNS) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -485,9 +443,9 @@ } #endif #ifdef PNG_READ_bKGD_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_bKGD, 4)) + else if (chunk_name == png_bKGD) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -498,9 +456,9 @@ } #endif #ifdef PNG_READ_hIST_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_hIST, 4)) + else if (chunk_name == png_hIST) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -511,9 +469,9 @@ } #endif #ifdef PNG_READ_pHYs_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_pHYs, 4)) + else if (chunk_name == png_pHYs) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -524,9 +482,9 @@ } #endif #ifdef PNG_READ_oFFs_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_oFFs, 4)) + else if (chunk_name == png_oFFs) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -537,9 +495,9 @@ } #endif #ifdef PNG_READ_pCAL_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_pCAL, 4)) + else if (chunk_name == png_pCAL) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -550,9 +508,9 @@ } #endif #ifdef PNG_READ_sCAL_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_sCAL, 4)) + else if (chunk_name == png_sCAL) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -563,9 +521,9 @@ } #endif #ifdef PNG_READ_tIME_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_tIME, 4)) + else if (chunk_name == png_tIME) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -576,9 +534,9 @@ } #endif #ifdef PNG_READ_tEXt_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_tEXt, 4)) + else if (chunk_name == png_tEXt) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -589,9 +547,9 @@ } #endif #ifdef PNG_READ_zTXt_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_zTXt, 4)) + else if (chunk_name == png_zTXt) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -602,9 +560,9 @@ } #endif #ifdef PNG_READ_iTXt_SUPPORTED - else if (!png_memcmp(png_ptr->chunk_name, png_iTXt, 4)) + else if (chunk_name == png_iTXt) { if (png_ptr->push_length + 4 > png_ptr->buffer_size) { png_push_save_buffer(png_ptr); @@ -808,13 +766,14 @@ void /* PRIVATE */ png_push_read_IDAT(png_structp png_ptr) { - PNG_IDAT; if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER)) { png_byte chunk_length[4]; + png_byte chunk_tag[4]; + /* TODO: this code can be commoned up with the same code in push_read */ if (png_ptr->buffer_size < 8) { png_push_save_buffer(png_ptr); return; @@ -822,12 +781,13 @@ png_push_fill_buffer(png_ptr, chunk_length, 4); png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length); png_reset_crc(png_ptr); - png_crc_read(png_ptr, png_ptr->chunk_name, 4); + png_crc_read(png_ptr, chunk_tag, 4); + png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(chunk_tag); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; - if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) + if (png_ptr->chunk_name != png_IDAT) { png_ptr->process_mode = PNG_READ_CHUNK_MODE; if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED)) @@ -1010,38 +971,58 @@ void /* PRIVATE */ png_push_process_row(png_structp png_ptr) { - png_ptr->row_info.color_type = png_ptr->color_type; - png_ptr->row_info.width = png_ptr->iwidth; - png_ptr->row_info.channels = png_ptr->channels; - png_ptr->row_info.bit_depth = png_ptr->bit_depth; - png_ptr->row_info.pixel_depth = png_ptr->pixel_depth; - - png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth, - png_ptr->row_info.width); - - png_read_filter_row(png_ptr, &(png_ptr->row_info), - png_ptr->row_buf + 1, png_ptr->prev_row + 1, - (int)(png_ptr->row_buf[0])); + /* 1.5.6: row_info moved out of png_struct to a local here. */ + png_row_info row_info; - png_memcpy(png_ptr->prev_row, png_ptr->row_buf, png_ptr->rowbytes + 1); + row_info.width = png_ptr->iwidth; /* NOTE: width of current interlaced row */ + row_info.color_type = png_ptr->color_type; + row_info.bit_depth = png_ptr->bit_depth; + row_info.channels = png_ptr->channels; + row_info.pixel_depth = png_ptr->pixel_depth; + row_info.rowbytes = PNG_ROWBYTES(row_info.pixel_depth, row_info.width); + + if (png_ptr->row_buf[0] > PNG_FILTER_VALUE_NONE) + { + if (png_ptr->row_buf[0] < PNG_FILTER_VALUE_LAST) + png_read_filter_row(&row_info, png_ptr->row_buf + 1, + png_ptr->prev_row + 1, png_ptr->row_buf[0]); + else + png_error(png_ptr, "bad adaptive filter value"); + } + + /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before + * 1.5.6, while the buffer really is this big in current versions of libpng + * it may not be in the future, so this was changed just to copy the + * interlaced row count: + */ + png_memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1); #ifdef PNG_READ_TRANSFORMS_SUPPORTED if (png_ptr->transformations) - png_do_read_transformations(png_ptr); + png_do_read_transformations(png_ptr, &row_info); #endif + /* The transformed pixel depth should match the depth now in row_info. */ + if (png_ptr->transformed_pixel_depth == 0) + { + png_ptr->transformed_pixel_depth = row_info.pixel_depth; + if (row_info.pixel_depth > png_ptr->maximum_pixel_depth) + png_error(png_ptr, "progressive row overflow"); + } + + else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth) + png_error(png_ptr, "internal progressive row size calculation error"); + + #ifdef PNG_READ_INTERLACING_SUPPORTED /* Blow up interlaced rows to full size */ if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE)) { if (png_ptr->pass < 6) -/* old interface (pre-1.0.9): - png_do_read_interlace(&(png_ptr->row_info), - png_ptr->row_buf + 1, png_ptr->pass, png_ptr->transformations); - */ - png_do_read_interlace(png_ptr); + png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass, + png_ptr->transformations); switch (png_ptr->pass) { case 0: @@ -1222,22 +1203,22 @@ { /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ /* Start of interlace block */ - PNG_CONST int FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0}; + static PNG_CONST png_byte FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0}; /* Offset to next interlace block */ - PNG_CONST int FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1}; + static PNG_CONST png_byte FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1}; /* Start of interlace block in the y direction */ - PNG_CONST int FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1}; + static PNG_CONST png_byte FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1}; /* Offset to next interlace block in the y direction */ - PNG_CONST int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2}; + static PNG_CONST png_byte FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2}; /* Height of interlace block. This is not currently used - if you need * it, uncomment it here and in png.h - PNG_CONST int FARDATA png_pass_height[] = {8, 8, 4, 4, 2, 2, 1}; + static PNG_CONST png_byte FARDATA png_pass_height[] = {8, 8, 4, 4, 2, 2, 1}; */ png_ptr->row_number++; if (png_ptr->row_number < png_ptr->num_rows) @@ -1713,13 +1694,14 @@ png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { png_uint_32 skip = 0; + png_uint_32 chunk_name = png_ptr->chunk_name; - if (!(png_ptr->chunk_name[0] & 0x20)) + if (PNG_CHUNK_CRITICAL(chunk_name)) { #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED - if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != + if (png_chunk_unknown_handling(png_ptr, chunk_name) != PNG_HANDLE_CHUNK_ALWAYS #ifdef PNG_READ_USER_CHUNKS_SUPPORTED && png_ptr->read_user_chunk_fn == NULL #endif @@ -1730,34 +1712,39 @@ PNG_UNUSED(info_ptr) /* To quiet some compiler warnings */ } #ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED + /* TODO: the code below is apparently just using the + * png_struct::unknown_chunk member as a temporarily variable, it should be + * possible to eliminate both it and the temporary buffer. + */ if (png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS) { #ifdef PNG_MAX_MALLOC_64K - if (length > (png_uint_32)65535L) + if (length > 65535) { png_warning(png_ptr, "unknown chunk too large to fit in memory"); - skip = length - (png_uint_32)65535L; - length = (png_uint_32)65535L; + skip = length - 65535; + length = 65535; } #endif - png_memcpy((png_charp)png_ptr->unknown_chunk.name, - (png_charp)png_ptr->chunk_name, - png_sizeof(png_ptr->unknown_chunk.name)); - png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name) - 1] - = '\0'; + /* This is just a record for the user; libpng doesn't use the character + * form of the name. + */ + PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name); + /* The following cast should be safe because of the check above. */ png_ptr->unknown_chunk.size = (png_size_t)length; if (length == 0) png_ptr->unknown_chunk.data = NULL; else { png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, - (png_size_t)length); - png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length); + png_ptr->unknown_chunk.size); + png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, + png_ptr->unknown_chunk.size); } #ifdef PNG_READ_USER_CHUNKS_SUPPORTED if (png_ptr->read_user_chunk_fn != NULL) @@ -1771,10 +1758,10 @@ png_chunk_error(png_ptr, "error in user chunk"); if (ret == 0) { - if (!(png_ptr->chunk_name[0] & 0x20)) - if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != + if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name)) + if (png_chunk_unknown_handling(png_ptr, chunk_name) != PNG_HANDLE_CHUNK_ALWAYS) png_chunk_error(png_ptr, "unknown critical chunk"); png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1); @@ -1815,21 +1802,24 @@ (*(png_ptr->row_fn))(png_ptr, row, png_ptr->row_number, (int)png_ptr->pass); } +#ifdef PNG_READ_INTERLACING_SUPPORTED void PNGAPI png_progressive_combine_row (png_structp png_ptr, png_bytep old_row, png_const_bytep new_row) { - PNG_CONST int FARDATA png_pass_dsp_mask[7] = - {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff}; - if (png_ptr == NULL) return; - if (new_row != NULL) /* new_row must == png_ptr->row_buf here. */ - png_combine_row(png_ptr, old_row, png_pass_dsp_mask[png_ptr->pass]); + /* new_row is a flag here - if it is NULL then the app callback was called + * from an empty row (see the calls to png_struct::row_fn below), otherwise + * it must be png_ptr->row_buf+1 + */ + if (new_row != NULL) + png_combine_row(png_ptr, old_row, 1/*display*/); } +#endif /* PNG_READ_INTERLACING_SUPPORTED */ void PNGAPI png_set_progressive_read_fn(png_structp png_ptr, png_voidp progressive_ptr, png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn, diff -ru4NwbB libpng-1.5.5/pngpriv.h libpng-1.5.6rc03/pngpriv.h --- libpng-1.5.5/pngpriv.h 2011-09-22 08:40:23.550017930 -0500 +++ libpng-1.5.6rc03/pngpriv.h 2011-10-27 19:44:39.924970903 -0500 @@ -5,9 +5,9 @@ * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * - * Last changed in libpng 1.5.5 [(PENDING RELEASE)] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * * This code is released under the libpng license. * For conditions of distribution and use, see the disclaimer * and license in png.h @@ -43,8 +43,11 @@ * error handler when all else fails. */ #include +/* This is used to find 'offsetof', used below for alignment tests. */ +#include + #define PNGLIB_BUILD /*libpng is being built, not used*/ #ifdef PNG_USER_CONFIG # include "pngusr.h" @@ -320,8 +323,54 @@ # define png_memcpy memcpy # define png_memset memset # endif #endif + +/* These macros may need to be architecture dependent. */ +#define PNG_ALIGN_NONE 0 /* do not use data alignment */ +#define PNG_ALIGN_ALWAYS 1 /* assume unaligned accesses are OK */ +#ifdef offsetof +# define PNG_ALIGN_OFFSET 2 /* use offsetof to determine alignment */ +#else +# define PNG_ALIGN_OFFSET -1 /* prevent the use of this */ +#endif +#define PNG_ALIGN_SIZE 3 /* use sizeof to determine alignment */ + +#ifndef PNG_ALIGN_TYPE + /* Default to using aligned access optimizations and requiring alignment to a + * multiple of the data type size. Override in a compiler specific fashion + * if necessary by inserting tests here: + */ +# define PNG_ALIGN_TYPE PNG_ALIGN_SIZE +#endif + +#if PNG_ALIGN_TYPE == PNG_ALIGN_SIZE + /* This is used because in some compiler implementations non-aligned + * structure members are supported, so the offsetof approach below fails. + * Set PNG_ALIGN_TO_SIZE=0 for compiler combinations where unaligned access + * is good for performance. Do not do this unless you have tested the result + * and understand it. + */ +# define png_alignof(type) (sizeof (type)) +#else +# if PNG_ALIGN_TYPE == PNG_ALIGN_OFFSET +# define png_alignof(type) offsetof(struct{char c; type t;}, t) +# else +# if PNG_ALIGN_TYPE == PNG_ALIGN_ALWAYS +# define png_alignof(type) (1) +# endif + /* Else leave png_alignof undefined to prevent use thereof */ +# endif +#endif + +/* This implicitly assumes alignment is always to a power of 2. */ +#ifdef png_alignof +# define png_isaligned(ptr, type)\ + ((((const char*)ptr-(const char*)0) & (png_alignof(type)-1)) == 0) +#else +# define png_isaligned(ptr, type) 0 +#endif + /* End of memory model/platform independent support */ /* End of 1.5.0beta36 move from pngconf.h */ /* CONSTANTS and UTILITY MACROS @@ -501,34 +550,72 @@ png_const_charp text)); #endif #endif -/* Constant strings for known chunk types. If you need to add a chunk, - * define the name here, and add an invocation of the macro wherever it's - * needed. - */ -#define PNG_IHDR PNG_CONST png_byte png_IHDR[5] = { 73, 72, 68, 82, '\0'} -#define PNG_IDAT PNG_CONST png_byte png_IDAT[5] = { 73, 68, 65, 84, '\0'} -#define PNG_IEND PNG_CONST png_byte png_IEND[5] = { 73, 69, 78, 68, '\0'} -#define PNG_PLTE PNG_CONST png_byte png_PLTE[5] = { 80, 76, 84, 69, '\0'} -#define PNG_bKGD PNG_CONST png_byte png_bKGD[5] = { 98, 75, 71, 68, '\0'} -#define PNG_cHRM PNG_CONST png_byte png_cHRM[5] = { 99, 72, 82, 77, '\0'} -#define PNG_gAMA PNG_CONST png_byte png_gAMA[5] = {103, 65, 77, 65, '\0'} -#define PNG_hIST PNG_CONST png_byte png_hIST[5] = {104, 73, 83, 84, '\0'} -#define PNG_iCCP PNG_CONST png_byte png_iCCP[5] = {105, 67, 67, 80, '\0'} -#define PNG_iTXt PNG_CONST png_byte png_iTXt[5] = {105, 84, 88, 116, '\0'} -#define PNG_oFFs PNG_CONST png_byte png_oFFs[5] = {111, 70, 70, 115, '\0'} -#define PNG_pCAL PNG_CONST png_byte png_pCAL[5] = {112, 67, 65, 76, '\0'} -#define PNG_sCAL PNG_CONST png_byte png_sCAL[5] = {115, 67, 65, 76, '\0'} -#define PNG_pHYs PNG_CONST png_byte png_pHYs[5] = {112, 72, 89, 115, '\0'} -#define PNG_sBIT PNG_CONST png_byte png_sBIT[5] = {115, 66, 73, 84, '\0'} -#define PNG_sPLT PNG_CONST png_byte png_sPLT[5] = {115, 80, 76, 84, '\0'} -#define PNG_sRGB PNG_CONST png_byte png_sRGB[5] = {115, 82, 71, 66, '\0'} -#define PNG_sTER PNG_CONST png_byte png_sTER[5] = {115, 84, 69, 82, '\0'} -#define PNG_tEXt PNG_CONST png_byte png_tEXt[5] = {116, 69, 88, 116, '\0'} -#define PNG_tIME PNG_CONST png_byte png_tIME[5] = {116, 73, 77, 69, '\0'} -#define PNG_tRNS PNG_CONST png_byte png_tRNS[5] = {116, 82, 78, 83, '\0'} -#define PNG_zTXt PNG_CONST png_byte png_zTXt[5] = {122, 84, 88, 116, '\0'} +/* Constants for known chunk types. If you need to add a chunk, define the name + * here. For historical reasons these constants have the form png_; i.e. + * the prefix is lower case. Please use decimal values as the parameters to + * match the ISO PNG specification and to avoid relying on the C locale + * interpretation of character values. + * + * Prior to 1.5.6 these constants were strings, as of 1.5.6 png_uint_32 values + * are computed and a new macro (PNG_STRING_FROM_CHUNK) added to allow a string + * to be generated if required. + * + * PNG_32b correctly produces a value shifted by up to 24 bits, even on + * architectures where (int) is only 16 bits. + */ +#define PNG_32b(b,s) ((png_uint_32)(b) << (s)) +#define PNG_CHUNK(b1,b2,b3,b4) \ + (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) + +#define png_IHDR PNG_CHUNK( 73, 72, 68, 82) +#define png_IDAT PNG_CHUNK( 73, 68, 65, 84) +#define png_IEND PNG_CHUNK( 73, 69, 78, 68) +#define png_PLTE PNG_CHUNK( 80, 76, 84, 69) +#define png_bKGD PNG_CHUNK( 98, 75, 71, 68) +#define png_cHRM PNG_CHUNK( 99, 72, 82, 77) +#define png_gAMA PNG_CHUNK(103, 65, 77, 65) +#define png_hIST PNG_CHUNK(104, 73, 83, 84) +#define png_iCCP PNG_CHUNK(105, 67, 67, 80) +#define png_iTXt PNG_CHUNK(105, 84, 88, 116) +#define png_oFFs PNG_CHUNK(111, 70, 70, 115) +#define png_pCAL PNG_CHUNK(112, 67, 65, 76) +#define png_sCAL PNG_CHUNK(115, 67, 65, 76) +#define png_pHYs PNG_CHUNK(112, 72, 89, 115) +#define png_sBIT PNG_CHUNK(115, 66, 73, 84) +#define png_sPLT PNG_CHUNK(115, 80, 76, 84) +#define png_sRGB PNG_CHUNK(115, 82, 71, 66) +#define png_sTER PNG_CHUNK(115, 84, 69, 82) +#define png_tEXt PNG_CHUNK(116, 69, 88, 116) +#define png_tIME PNG_CHUNK(116, 73, 77, 69) +#define png_tRNS PNG_CHUNK(116, 82, 78, 83) +#define png_zTXt PNG_CHUNK(122, 84, 88, 116) + +/* The following will work on (signed char*) strings, whereas the get_uint_32 + * macro will fail on top-bit-set values because of the sign extension. + */ +#define PNG_CHUNK_FROM_STRING(s)\ + PNG_CHUNK(0xff&(s)[0], 0xff&(s)[1], 0xff&(s)[2], 0xff&(s)[3]) + +/* This uses (char), not (png_byte) to avoid warnings on systems where (char) is + * signed and the argument is a (char[]) This macro will fail miserably on + * systems where (char) is more than 8 bits. + */ +#define PNG_STRING_FROM_CHUNK(s,c)\ + (void)(((char*)(s))[0]=(char)((c)>>24), ((char*)(s))[1]=(char)((c)>>16),\ + ((char*)(s))[2]=(char)((c)>>8), ((char*)(s))[3]=(char)((c))) + +/* Do the same but terminate with a null character. */ +#define PNG_CSTRING_FROM_CHUNK(s,c)\ + (void)(PNG_STRING_FROM_CHUNK(s,c), ((char*)(s))[4] = 0) + +/* Test on flag values as defined in the spec (section 5.4): */ +#define PNG_CHUNK_ANCILLIARY(c) (1 & ((c) >> 29)) +#define PNG_CHUNK_CRITICAL(c) (!PNG_CHUNK_ANCILLIARY(c)) +#define PNG_CHUNK_PRIVATE(c) (1 & ((c) >> 21)) +#define PNG_CHUNK_RESERVED(c) (1 & ((c) >> 13)) +#define PNG_CHUNK_SAFE_TO_COPY(c) (1 & ((c) >> 5)) /* Gamma values (new at libpng-1.5.4): */ #define PNG_GAMMA_MAC_OLD 151724 /* Assume '1.8' is really 2.2/1.45! */ #define PNG_GAMMA_MAC_INVERSE 65909 @@ -783,19 +870,46 @@ /* Internal use only. Called before first row of data */ PNG_EXTERN void png_write_start_row PNGARG((png_structp png_ptr)); -/* Combine a row of data, dealing with alpha, etc. if requested */ +/* Combine a row of data, dealing with alpha, etc. if requested. 'row' is an + * array of png_ptr->width pixels. If the image is not interlaced or this + * is the final pass this just does a png_memcpy, otherwise the "display" flag + * is used to determine whether to copy pixels that are not in the current pass. + * + * Because 'png_do_read_interlace' (below) replicates pixels this allows this + * function to achieve the documented 'blocky' appearance during interlaced read + * if display is 1 and the 'sparkle' appearance, where existing pixels in 'row' + * are not changed if they are not in the current pass, when display is 0. + * + * 'display' must be 0 or 1, otherwise the memcpy will be done regardless. + * + * The API always reads from the png_struct row buffer and always assumes that + * it is full width (png_do_read_interlace has already been called.) + * + * This function is only ever used to write to row buffers provided by the + * caller of the relevant libpng API and the row must have already been + * transformed by the read transformations. + * + * The PNG_USE_COMPILE_TIME_MASKS option causes generation of pre-computed + * bitmasks for use within the code, otherwise runtime generated masks are used. + * The default is compile time masks. + */ +#ifndef PNG_USE_COMPILE_TIME_MASKS +# define PNG_USE_COMPILE_TIME_MASKS 1 +#endif PNG_EXTERN void png_combine_row PNGARG((png_structp png_ptr, png_bytep row, - int mask)); + int display)); #ifdef PNG_READ_INTERLACING_SUPPORTED -/* Expand an interlaced row */ -/* OLD pre-1.0.9 interface: +/* Expand an interlaced row: the 'row_info' describes the pass data that has + * been read in and must correspond to the pixels in 'row', the pixels are + * expanded (moved apart) in 'row' to match the final layout, when doing this + * the pixels are *replicated* to the intervening space. This is essential for + * the correct operation of png_combine_row, above. + */ PNG_EXTERN void png_do_read_interlace PNGARG((png_row_infop row_info, png_bytep row, int pass, png_uint_32 transformations)); - */ -PNG_EXTERN void png_do_read_interlace PNGARG((png_structp png_ptr)); #endif /* GRR TO DO (2.0 or whenever): simplify other internal calling interfaces */ @@ -804,12 +918,13 @@ PNG_EXTERN void png_do_write_interlace PNGARG((png_row_infop row_info, png_bytep row, int pass)); #endif -/* Unfilter a row */ -PNG_EXTERN void png_read_filter_row PNGARG((png_structp png_ptr, - png_row_infop row_info, png_bytep row, png_const_bytep prev_row, - int filter)); +/* Unfilter a row: check the filter value before calling this, there is no point + * calling it for PNG_FILTER_VALUE_NONE. + */ +PNG_EXTERN void png_read_filter_row PNGARG((png_row_infop row_info, + png_bytep row, png_const_bytep prev_row, int filter)); /* Choose the best filter to use and filter the row data */ PNG_EXTERN void png_write_find_filter PNGARG((png_structp png_ptr, png_row_infop row_info)); @@ -1057,20 +1172,32 @@ PNG_EXTERN void png_handle_zTXt PNGARG((png_structp png_ptr, png_infop info_ptr, png_uint_32 length)); #endif +#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED PNG_EXTERN void png_handle_unknown PNGARG((png_structp png_ptr, png_infop info_ptr, png_uint_32 length)); +#endif PNG_EXTERN void png_check_chunk_name PNGARG((png_structp png_ptr, - png_const_bytep chunk_name)); + png_uint_32 chunk_name)); + +#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED +/* Exactly as png_handle_as_unknown() except that the argument is a 32-bit chunk + * name, not a string. + */ +PNG_EXTERN int png_chunk_unknown_handling PNGARG((png_structp png_ptr, + png_uint_32 chunk_name)); +#endif /* Handle the transformations for reading and writing */ #ifdef PNG_READ_TRANSFORMS_SUPPORTED -PNG_EXTERN void png_do_read_transformations PNGARG((png_structp png_ptr)); +PNG_EXTERN void png_do_read_transformations PNGARG((png_structp png_ptr, + png_row_infop row_info)); #endif #ifdef PNG_WRITE_TRANSFORMS_SUPPORTED -PNG_EXTERN void png_do_write_transformations PNGARG((png_structp png_ptr)); +PNG_EXTERN void png_do_write_transformations PNGARG((png_structp png_ptr, + png_row_infop row_info)); #endif #ifdef PNG_READ_TRANSFORMS_SUPPORTED PNG_EXTERN void png_init_read_transformations PNGARG((png_structp png_ptr)); @@ -1440,8 +1567,9 @@ PNG_EXTERN png_uint_16 png_gamma_16bit_correct PNGARG((unsigned int value, png_fixed_point gamma_value)); PNG_EXTERN png_byte png_gamma_8bit_correct PNGARG((unsigned int value, png_fixed_point gamma_value)); +PNG_EXTERN void png_destroy_gamma_table(png_structp png_ptr); PNG_EXTERN void png_build_gamma_table PNGARG((png_structp png_ptr, int bit_depth)); #endif diff -ru4NwbB libpng-1.5.5/pngread.c libpng-1.5.6rc03/pngread.c --- libpng-1.5.5/pngread.c 2011-09-22 08:40:23.624833813 -0500 +++ libpng-1.5.6rc03/pngread.c 2011-10-27 19:44:39.997959364 -0500 @@ -1,8 +1,8 @@ /* pngread.c - read a PNG file * - * Last changed in libpng 1.5.4 [July 7, 2011] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -189,91 +189,37 @@ png_read_sig(png_ptr, info_ptr); for (;;) { - PNG_IHDR; - PNG_IDAT; - PNG_IEND; - PNG_PLTE; -#ifdef PNG_READ_bKGD_SUPPORTED - PNG_bKGD; -#endif -#ifdef PNG_READ_cHRM_SUPPORTED - PNG_cHRM; -#endif -#ifdef PNG_READ_gAMA_SUPPORTED - PNG_gAMA; -#endif -#ifdef PNG_READ_hIST_SUPPORTED - PNG_hIST; -#endif -#ifdef PNG_READ_iCCP_SUPPORTED - PNG_iCCP; -#endif -#ifdef PNG_READ_iTXt_SUPPORTED - PNG_iTXt; -#endif -#ifdef PNG_READ_oFFs_SUPPORTED - PNG_oFFs; -#endif -#ifdef PNG_READ_pCAL_SUPPORTED - PNG_pCAL; -#endif -#ifdef PNG_READ_pHYs_SUPPORTED - PNG_pHYs; -#endif -#ifdef PNG_READ_sBIT_SUPPORTED - PNG_sBIT; -#endif -#ifdef PNG_READ_sCAL_SUPPORTED - PNG_sCAL; -#endif -#ifdef PNG_READ_sPLT_SUPPORTED - PNG_sPLT; -#endif -#ifdef PNG_READ_sRGB_SUPPORTED - PNG_sRGB; -#endif -#ifdef PNG_READ_tEXt_SUPPORTED - PNG_tEXt; -#endif -#ifdef PNG_READ_tIME_SUPPORTED - PNG_tIME; -#endif -#ifdef PNG_READ_tRNS_SUPPORTED - PNG_tRNS; -#endif -#ifdef PNG_READ_zTXt_SUPPORTED - PNG_zTXt; -#endif png_uint_32 length = png_read_chunk_header(png_ptr); - PNG_CONST png_bytep chunk_name = png_ptr->chunk_name; + png_uint_32 chunk_name = png_ptr->chunk_name; /* This should be a binary subdivision search or a hash for * matching the chunk name rather than a linear search. */ - if (!png_memcmp(chunk_name, png_IDAT, 4)) + if (chunk_name == png_IDAT) if (png_ptr->mode & PNG_AFTER_IDAT) png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT; - if (!png_memcmp(chunk_name, png_IHDR, 4)) + if (chunk_name == png_IHDR) png_handle_IHDR(png_ptr, info_ptr, length); - else if (!png_memcmp(chunk_name, png_IEND, 4)) + else if (chunk_name == png_IEND) png_handle_IEND(png_ptr, info_ptr, length); #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED - else if (png_handle_as_unknown(png_ptr, chunk_name)) + else if (png_chunk_unknown_handling(png_ptr, chunk_name) != + PNG_HANDLE_CHUNK_AS_DEFAULT) { - if (!png_memcmp(chunk_name, png_IDAT, 4)) + if (chunk_name == png_IDAT) png_ptr->mode |= PNG_HAVE_IDAT; png_handle_unknown(png_ptr, info_ptr, length); - if (!png_memcmp(chunk_name, png_PLTE, 4)) + if (chunk_name == png_PLTE) png_ptr->mode |= PNG_HAVE_PLTE; - else if (!png_memcmp(chunk_name, png_IDAT, 4)) + else if (chunk_name == png_IDAT) { if (!(png_ptr->mode & PNG_HAVE_IHDR)) png_error(png_ptr, "Missing IHDR before IDAT"); @@ -284,12 +230,12 @@ break; } } #endif - else if (!png_memcmp(chunk_name, png_PLTE, 4)) + else if (chunk_name == png_PLTE) png_handle_PLTE(png_ptr, info_ptr, length); - else if (!png_memcmp(chunk_name, png_IDAT, 4)) + else if (chunk_name == png_IDAT) { if (!(png_ptr->mode & PNG_HAVE_IHDR)) png_error(png_ptr, "Missing IHDR before IDAT"); @@ -302,89 +248,89 @@ break; } #ifdef PNG_READ_bKGD_SUPPORTED - else if (!png_memcmp(chunk_name, png_bKGD, 4)) + else if (chunk_name == png_bKGD) png_handle_bKGD(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_cHRM_SUPPORTED - else if (!png_memcmp(chunk_name, png_cHRM, 4)) + else if (chunk_name == png_cHRM) png_handle_cHRM(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_gAMA_SUPPORTED - else if (!png_memcmp(chunk_name, png_gAMA, 4)) + else if (chunk_name == png_gAMA) png_handle_gAMA(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_hIST_SUPPORTED - else if (!png_memcmp(chunk_name, png_hIST, 4)) + else if (chunk_name == png_hIST) png_handle_hIST(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_oFFs_SUPPORTED - else if (!png_memcmp(chunk_name, png_oFFs, 4)) + else if (chunk_name == png_oFFs) png_handle_oFFs(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_pCAL_SUPPORTED - else if (!png_memcmp(chunk_name, png_pCAL, 4)) + else if (chunk_name == png_pCAL) png_handle_pCAL(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_sCAL_SUPPORTED - else if (!png_memcmp(chunk_name, png_sCAL, 4)) + else if (chunk_name == png_sCAL) png_handle_sCAL(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_pHYs_SUPPORTED - else if (!png_memcmp(chunk_name, png_pHYs, 4)) + else if (chunk_name == png_pHYs) png_handle_pHYs(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_sBIT_SUPPORTED - else if (!png_memcmp(chunk_name, png_sBIT, 4)) + else if (chunk_name == png_sBIT) png_handle_sBIT(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_sRGB_SUPPORTED - else if (!png_memcmp(chunk_name, png_sRGB, 4)) + else if (chunk_name == png_sRGB) png_handle_sRGB(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_iCCP_SUPPORTED - else if (!png_memcmp(chunk_name, png_iCCP, 4)) + else if (chunk_name == png_iCCP) png_handle_iCCP(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_sPLT_SUPPORTED - else if (!png_memcmp(chunk_name, png_sPLT, 4)) + else if (chunk_name == png_sPLT) png_handle_sPLT(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_tEXt_SUPPORTED - else if (!png_memcmp(chunk_name, png_tEXt, 4)) + else if (chunk_name == png_tEXt) png_handle_tEXt(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_tIME_SUPPORTED - else if (!png_memcmp(chunk_name, png_tIME, 4)) + else if (chunk_name == png_tIME) png_handle_tIME(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_tRNS_SUPPORTED - else if (!png_memcmp(chunk_name, png_tRNS, 4)) + else if (chunk_name == png_tRNS) png_handle_tRNS(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_zTXt_SUPPORTED - else if (!png_memcmp(chunk_name, png_zTXt, 4)) + else if (chunk_name == png_zTXt) png_handle_zTXt(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_iTXt_SUPPORTED - else if (!png_memcmp(chunk_name, png_iTXt, 4)) + else if (chunk_name == png_iTXt) png_handle_iTXt(png_ptr, info_ptr, length); #endif else @@ -401,16 +347,10 @@ if (png_ptr == NULL) return; - if (!(png_ptr->flags & PNG_FLAG_ROW_INIT)) png_read_start_row(png_ptr); - else - png_warning(png_ptr, - "Ignoring extra png_read_update_info() call;" - " row buffer not reallocated"); - #ifdef PNG_READ_TRANSFORMS_SUPPORTED png_read_transform_info(png_ptr, info_ptr); #else PNG_UNUSED(info_ptr) @@ -427,41 +367,41 @@ png_start_read_image(png_structp png_ptr) { png_debug(1, "in png_start_read_image"); - if (png_ptr == NULL) - return; - - if (!(png_ptr->flags & PNG_FLAG_ROW_INIT)) + if (png_ptr != NULL) png_read_start_row(png_ptr); - else - png_warning(png_ptr, - "Ignoring extra png_start_read_image() call;" - " row buffer not reallocated"); } #endif /* PNG_SEQUENTIAL_READ_SUPPORTED */ #ifdef PNG_SEQUENTIAL_READ_SUPPORTED void PNGAPI png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) { - PNG_IDAT; -#ifdef PNG_READ_INTERLACING_SUPPORTED - PNG_CONST int png_pass_dsp_mask[7] = {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, - 0xff}; - PNG_CONST int png_pass_mask[7] = {0x80, 0x08, 0x88, 0x22, 0xaa, 0x55, 0xff}; -#endif int ret; + png_row_info row_info; + if (png_ptr == NULL) return; png_debug2(1, "in png_read_row (row %lu, pass %d)", (unsigned long)png_ptr->row_number, png_ptr->pass); + /* png_read_start_row sets the information (in particular iwidth) for this + * interlace pass. + */ if (!(png_ptr->flags & PNG_FLAG_ROW_INIT)) png_read_start_row(png_ptr); + /* 1.5.6: row_info moved out of png_struct to a local here. */ + row_info.width = png_ptr->iwidth; /* NOTE: width of current interlaced row */ + row_info.color_type = png_ptr->color_type; + row_info.bit_depth = png_ptr->bit_depth; + row_info.channels = png_ptr->channels; + row_info.pixel_depth = png_ptr->pixel_depth; + row_info.rowbytes = PNG_ROWBYTES(row_info.pixel_depth, row_info.width); + if (png_ptr->row_number == 0 && png_ptr->pass == 0) { /* Check for transforms that have been set but were defined out */ #if defined(PNG_WRITE_INVERT_SUPPORTED) && !defined(PNG_READ_INVERT_SUPPORTED) @@ -501,19 +441,23 @@ #endif } #ifdef PNG_READ_INTERLACING_SUPPORTED - /* If interlaced and we do not need a new row, combine row and return */ + /* If interlaced and we do not need a new row, combine row and return. + * Notice that the pixels we have from previous rows have been transformed + * already; we can only combine like with like (transformed or + * untransformed) and, because of the libpng API for interlaced images, this + * means we must transform before de-interlacing. + */ if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE)) { switch (png_ptr->pass) { case 0: if (png_ptr->row_number & 0x07) { if (dsp_row != NULL) - png_combine_row(png_ptr, dsp_row, - png_pass_dsp_mask[png_ptr->pass]); + png_combine_row(png_ptr, dsp_row, 1/*display*/); png_read_finish_row(png_ptr); return; } break; @@ -521,10 +465,9 @@ case 1: if ((png_ptr->row_number & 0x07) || png_ptr->width < 5) { if (dsp_row != NULL) - png_combine_row(png_ptr, dsp_row, - png_pass_dsp_mask[png_ptr->pass]); + png_combine_row(png_ptr, dsp_row, 1/*display*/); png_read_finish_row(png_ptr); return; } @@ -533,10 +476,9 @@ case 2: if ((png_ptr->row_number & 0x07) != 4) { if (dsp_row != NULL && (png_ptr->row_number & 4)) - png_combine_row(png_ptr, dsp_row, - png_pass_dsp_mask[png_ptr->pass]); + png_combine_row(png_ptr, dsp_row, 1/*display*/); png_read_finish_row(png_ptr); return; } @@ -545,10 +487,9 @@ case 3: if ((png_ptr->row_number & 3) || png_ptr->width < 3) { if (dsp_row != NULL) - png_combine_row(png_ptr, dsp_row, - png_pass_dsp_mask[png_ptr->pass]); + png_combine_row(png_ptr, dsp_row, 1/*display*/); png_read_finish_row(png_ptr); return; } @@ -557,10 +498,9 @@ case 4: if ((png_ptr->row_number & 3) != 2) { if (dsp_row != NULL && (png_ptr->row_number & 2)) - png_combine_row(png_ptr, dsp_row, - png_pass_dsp_mask[png_ptr->pass]); + png_combine_row(png_ptr, dsp_row, 1/*display*/); png_read_finish_row(png_ptr); return; } @@ -568,10 +508,9 @@ case 5: if ((png_ptr->row_number & 1) || png_ptr->width < 2) { if (dsp_row != NULL) - png_combine_row(png_ptr, dsp_row, - png_pass_dsp_mask[png_ptr->pass]); + png_combine_row(png_ptr, dsp_row, 1/*display*/); png_read_finish_row(png_ptr); return; } @@ -605,9 +544,9 @@ { png_crc_finish(png_ptr, 0); png_ptr->idat_size = png_read_chunk_header(png_ptr); - if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) + if (png_ptr->chunk_name != png_IDAT) png_error(png_ptr, "Not enough image data"); } png_ptr->zstream.avail_in = (uInt)png_ptr->zbuf_size; png_ptr->zstream.next_in = png_ptr->zbuf; @@ -635,65 +574,74 @@ "Decompression error"); } while (png_ptr->zstream.avail_out); - png_ptr->row_info.color_type = png_ptr->color_type; - png_ptr->row_info.width = png_ptr->iwidth; - png_ptr->row_info.channels = png_ptr->channels; - png_ptr->row_info.bit_depth = png_ptr->bit_depth; - png_ptr->row_info.pixel_depth = png_ptr->pixel_depth; - png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth, - png_ptr->row_info.width); - - if (png_ptr->row_buf[0]) - png_read_filter_row(png_ptr, &(png_ptr->row_info), - png_ptr->row_buf + 1, png_ptr->prev_row + 1, - (int)(png_ptr->row_buf[0])); + if (png_ptr->row_buf[0] > PNG_FILTER_VALUE_NONE) + { + if (png_ptr->row_buf[0] < PNG_FILTER_VALUE_LAST) + png_read_filter_row(&row_info, png_ptr->row_buf + 1, + png_ptr->prev_row + 1, png_ptr->row_buf[0]); + else + png_error(png_ptr, "bad adaptive filter value"); + } - png_memcpy(png_ptr->prev_row, png_ptr->row_buf, png_ptr->rowbytes + 1); + /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before + * 1.5.6, while the buffer really is this big in current versions of libpng + * it may not be in the future, so this was changed just to copy the + * interlaced count: + */ + png_memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1); #ifdef PNG_MNG_FEATURES_SUPPORTED if ((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) && (png_ptr->filter_type == PNG_INTRAPIXEL_DIFFERENCING)) { /* Intrapixel differencing */ - png_do_read_intrapixel(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_read_intrapixel(&row_info, png_ptr->row_buf + 1); } #endif #ifdef PNG_READ_TRANSFORMS_SUPPORTED if (png_ptr->transformations) - png_do_read_transformations(png_ptr); + png_do_read_transformations(png_ptr, &row_info); #endif + /* The transformed pixel depth should match the depth now in row_info. */ + if (png_ptr->transformed_pixel_depth == 0) + { + png_ptr->transformed_pixel_depth = row_info.pixel_depth; + if (row_info.pixel_depth > png_ptr->maximum_pixel_depth) + png_error(png_ptr, "sequential row overflow"); + } + + else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth) + png_error(png_ptr, "internal sequential row size calculation error"); + #ifdef PNG_READ_INTERLACING_SUPPORTED /* Blow up interlaced rows to full size */ if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE)) { if (png_ptr->pass < 6) - /* Old interface (pre-1.0.9): - * png_do_read_interlace(&(png_ptr->row_info), - * png_ptr->row_buf + 1, png_ptr->pass, png_ptr->transformations); - */ - png_do_read_interlace(png_ptr); + png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass, + png_ptr->transformations); if (dsp_row != NULL) - png_combine_row(png_ptr, dsp_row, png_pass_dsp_mask[png_ptr->pass]); + png_combine_row(png_ptr, dsp_row, 1/*display*/); if (row != NULL) - png_combine_row(png_ptr, row, png_pass_mask[png_ptr->pass]); + png_combine_row(png_ptr, row, 0/*row*/); } else #endif { if (row != NULL) - png_combine_row(png_ptr, row, 0xff); + png_combine_row(png_ptr, row, -1/*ignored*/); if (dsp_row != NULL) - png_combine_row(png_ptr, dsp_row, 0xff); + png_combine_row(png_ptr, dsp_row, -1/*ignored*/); } png_read_finish_row(png_ptr); if (png_ptr->read_row_fn != NULL) @@ -857,87 +805,33 @@ png_crc_finish(png_ptr, 0); /* Finish off CRC from last IDAT chunk */ do { - PNG_IHDR; - PNG_IDAT; - PNG_IEND; - PNG_PLTE; -#ifdef PNG_READ_bKGD_SUPPORTED - PNG_bKGD; -#endif -#ifdef PNG_READ_cHRM_SUPPORTED - PNG_cHRM; -#endif -#ifdef PNG_READ_gAMA_SUPPORTED - PNG_gAMA; -#endif -#ifdef PNG_READ_hIST_SUPPORTED - PNG_hIST; -#endif -#ifdef PNG_READ_iCCP_SUPPORTED - PNG_iCCP; -#endif -#ifdef PNG_READ_iTXt_SUPPORTED - PNG_iTXt; -#endif -#ifdef PNG_READ_oFFs_SUPPORTED - PNG_oFFs; -#endif -#ifdef PNG_READ_pCAL_SUPPORTED - PNG_pCAL; -#endif -#ifdef PNG_READ_pHYs_SUPPORTED - PNG_pHYs; -#endif -#ifdef PNG_READ_sBIT_SUPPORTED - PNG_sBIT; -#endif -#ifdef PNG_READ_sCAL_SUPPORTED - PNG_sCAL; -#endif -#ifdef PNG_READ_sPLT_SUPPORTED - PNG_sPLT; -#endif -#ifdef PNG_READ_sRGB_SUPPORTED - PNG_sRGB; -#endif -#ifdef PNG_READ_tEXt_SUPPORTED - PNG_tEXt; -#endif -#ifdef PNG_READ_tIME_SUPPORTED - PNG_tIME; -#endif -#ifdef PNG_READ_tRNS_SUPPORTED - PNG_tRNS; -#endif -#ifdef PNG_READ_zTXt_SUPPORTED - PNG_zTXt; -#endif png_uint_32 length = png_read_chunk_header(png_ptr); - PNG_CONST png_bytep chunk_name = png_ptr->chunk_name; + png_uint_32 chunk_name = png_ptr->chunk_name; - if (!png_memcmp(chunk_name, png_IHDR, 4)) + if (chunk_name == png_IHDR) png_handle_IHDR(png_ptr, info_ptr, length); - else if (!png_memcmp(chunk_name, png_IEND, 4)) + else if (chunk_name == png_IEND) png_handle_IEND(png_ptr, info_ptr, length); #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED - else if (png_handle_as_unknown(png_ptr, chunk_name)) + else if (png_chunk_unknown_handling(png_ptr, chunk_name) != + PNG_HANDLE_CHUNK_AS_DEFAULT) { - if (!png_memcmp(chunk_name, png_IDAT, 4)) + if (chunk_name == png_IDAT) { if ((length > 0) || (png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT)) png_benign_error(png_ptr, "Too many IDATs found"); } png_handle_unknown(png_ptr, info_ptr, length); - if (!png_memcmp(chunk_name, png_PLTE, 4)) + if (chunk_name == png_PLTE) png_ptr->mode |= PNG_HAVE_PLTE; } #endif - else if (!png_memcmp(chunk_name, png_IDAT, 4)) + else if (chunk_name == png_IDAT) { /* Zero length IDATs are legal after the last IDAT has been * read, but not after other chunks have been read. */ @@ -945,93 +839,93 @@ png_benign_error(png_ptr, "Too many IDATs found"); png_crc_finish(png_ptr, length); } - else if (!png_memcmp(chunk_name, png_PLTE, 4)) + else if (chunk_name == png_PLTE) png_handle_PLTE(png_ptr, info_ptr, length); #ifdef PNG_READ_bKGD_SUPPORTED - else if (!png_memcmp(chunk_name, png_bKGD, 4)) + else if (chunk_name == png_bKGD) png_handle_bKGD(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_cHRM_SUPPORTED - else if (!png_memcmp(chunk_name, png_cHRM, 4)) + else if (chunk_name == png_cHRM) png_handle_cHRM(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_gAMA_SUPPORTED - else if (!png_memcmp(chunk_name, png_gAMA, 4)) + else if (chunk_name == png_gAMA) png_handle_gAMA(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_hIST_SUPPORTED - else if (!png_memcmp(chunk_name, png_hIST, 4)) + else if (chunk_name == png_hIST) png_handle_hIST(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_oFFs_SUPPORTED - else if (!png_memcmp(chunk_name, png_oFFs, 4)) + else if (chunk_name == png_oFFs) png_handle_oFFs(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_pCAL_SUPPORTED - else if (!png_memcmp(chunk_name, png_pCAL, 4)) + else if (chunk_name == png_pCAL) png_handle_pCAL(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_sCAL_SUPPORTED - else if (!png_memcmp(chunk_name, png_sCAL, 4)) + else if (chunk_name == png_sCAL) png_handle_sCAL(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_pHYs_SUPPORTED - else if (!png_memcmp(chunk_name, png_pHYs, 4)) + else if (chunk_name == png_pHYs) png_handle_pHYs(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_sBIT_SUPPORTED - else if (!png_memcmp(chunk_name, png_sBIT, 4)) + else if (chunk_name == png_sBIT) png_handle_sBIT(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_sRGB_SUPPORTED - else if (!png_memcmp(chunk_name, png_sRGB, 4)) + else if (chunk_name == png_sRGB) png_handle_sRGB(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_iCCP_SUPPORTED - else if (!png_memcmp(chunk_name, png_iCCP, 4)) + else if (chunk_name == png_iCCP) png_handle_iCCP(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_sPLT_SUPPORTED - else if (!png_memcmp(chunk_name, png_sPLT, 4)) + else if (chunk_name == png_sPLT) png_handle_sPLT(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_tEXt_SUPPORTED - else if (!png_memcmp(chunk_name, png_tEXt, 4)) + else if (chunk_name == png_tEXt) png_handle_tEXt(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_tIME_SUPPORTED - else if (!png_memcmp(chunk_name, png_tIME, 4)) + else if (chunk_name == png_tIME) png_handle_tIME(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_tRNS_SUPPORTED - else if (!png_memcmp(chunk_name, png_tRNS, 4)) + else if (chunk_name == png_tRNS) png_handle_tRNS(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_zTXt_SUPPORTED - else if (!png_memcmp(chunk_name, png_zTXt, 4)) + else if (chunk_name == png_zTXt) png_handle_zTXt(png_ptr, info_ptr, length); #endif #ifdef PNG_READ_iTXt_SUPPORTED - else if (!png_memcmp(chunk_name, png_iTXt, 4)) + else if (chunk_name == png_iTXt) png_handle_iTXt(png_ptr, info_ptr, length); #endif else @@ -1137,27 +1031,22 @@ if (end_info_ptr != NULL) png_info_destroy(png_ptr, end_info_ptr); +#ifdef PNG_READ_GAMMA_SUPPORTED + png_destroy_gamma_table(png_ptr); +#endif + png_free(png_ptr, png_ptr->zbuf); png_free(png_ptr, png_ptr->big_row_buf); - png_free(png_ptr, png_ptr->prev_row); + png_free(png_ptr, png_ptr->big_prev_row); png_free(png_ptr, png_ptr->chunkdata); #ifdef PNG_READ_QUANTIZE_SUPPORTED png_free(png_ptr, png_ptr->palette_lookup); png_free(png_ptr, png_ptr->quantize_index); #endif -#ifdef PNG_READ_GAMMA_SUPPORTED - png_free(png_ptr, png_ptr->gamma_table); -#endif - -#ifdef PNG_READ_BACKGROUND_SUPPORTED - png_free(png_ptr, png_ptr->gamma_from_1); - png_free(png_ptr, png_ptr->gamma_to_1); -#endif - if (png_ptr->free_me & PNG_FREE_PLTE) png_zfree(png_ptr, png_ptr->palette); png_ptr->free_me &= ~PNG_FREE_PLTE; @@ -1173,44 +1062,8 @@ png_free(png_ptr, png_ptr->hist); png_ptr->free_me &= ~PNG_FREE_HIST; #endif -#ifdef PNG_READ_GAMMA_SUPPORTED - if (png_ptr->gamma_16_table != NULL) - { - int i; - int istop = (1 << (8 - png_ptr->gamma_shift)); - for (i = 0; i < istop; i++) - { - png_free(png_ptr, png_ptr->gamma_16_table[i]); - } - png_free(png_ptr, png_ptr->gamma_16_table); - } - -#ifdef PNG_READ_BACKGROUND_SUPPORTED - if (png_ptr->gamma_16_from_1 != NULL) - { - int i; - int istop = (1 << (8 - png_ptr->gamma_shift)); - for (i = 0; i < istop; i++) - { - png_free(png_ptr, png_ptr->gamma_16_from_1[i]); - } - png_free(png_ptr, png_ptr->gamma_16_from_1); - } - if (png_ptr->gamma_16_to_1 != NULL) - { - int i; - int istop = (1 << (8 - png_ptr->gamma_shift)); - for (i = 0; i < istop; i++) - { - png_free(png_ptr, png_ptr->gamma_16_to_1[i]); - } - png_free(png_ptr, png_ptr->gamma_16_to_1); - } -#endif -#endif - inflateEnd(&png_ptr->zstream); #ifdef PNG_PROGRESSIVE_READ_SUPPORTED png_free(png_ptr, png_ptr->save_buffer); diff -ru4NwbB libpng-1.5.5/pngrtran.c libpng-1.5.6rc03/pngrtran.c --- libpng-1.5.5/pngrtran.c 2011-09-22 08:40:23.647611176 -0500 +++ libpng-1.5.6rc03/pngrtran.c 2011-10-27 19:44:40.020551048 -0500 @@ -1,8 +1,8 @@ /* pngrtran.c - transforms the data in a row for PNG readers * - * Last changed in libpng 1.5.5 [(PENDING RELEASE)] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -1197,55 +1197,46 @@ /* i.e., GRAY or GRAY_ALPHA */ { { /* Expand background and tRNS chunks */ + int gray = png_ptr->background.gray; + int trans_gray = png_ptr->trans_color.gray; + switch (png_ptr->bit_depth) { case 1: - png_ptr->background.gray *= (png_uint_16)0xff; - png_ptr->background.red = png_ptr->background.green - = png_ptr->background.blue = png_ptr->background.gray; - if (!(png_ptr->transformations & PNG_EXPAND_tRNS)) - { - png_ptr->trans_color.gray *= (png_uint_16)0xff; - png_ptr->trans_color.red = png_ptr->trans_color.green - = png_ptr->trans_color.blue = png_ptr->trans_color.gray; - } + gray *= 0xff; + trans_gray *= 0xff; break; case 2: - png_ptr->background.gray *= (png_uint_16)0x55; - png_ptr->background.red = png_ptr->background.green - = png_ptr->background.blue = png_ptr->background.gray; - if (!(png_ptr->transformations & PNG_EXPAND_tRNS)) - { - png_ptr->trans_color.gray *= (png_uint_16)0x55; - png_ptr->trans_color.red = png_ptr->trans_color.green - = png_ptr->trans_color.blue = png_ptr->trans_color.gray; - } + gray *= 0x55; + trans_gray *= 0x55; break; case 4: - png_ptr->background.gray *= (png_uint_16)0x11; - png_ptr->background.red = png_ptr->background.green - = png_ptr->background.blue = png_ptr->background.gray; - if (!(png_ptr->transformations & PNG_EXPAND_tRNS)) - { - png_ptr->trans_color.gray *= (png_uint_16)0x11; - png_ptr->trans_color.red = png_ptr->trans_color.green - = png_ptr->trans_color.blue = png_ptr->trans_color.gray; - } + gray *= 0x11; + trans_gray *= 0x11; break; default: case 8: + /* Already 8 bits, fall through */ case 16: - png_ptr->background.red = png_ptr->background.green - = png_ptr->background.blue = png_ptr->background.gray; + /* Already a full 16 bits */ break; } + + png_ptr->background.red = png_ptr->background.green = + png_ptr->background.blue = (png_uint_16)gray; + + if (!(png_ptr->transformations & PNG_EXPAND_tRNS)) + { + png_ptr->trans_color.red = png_ptr->trans_color.green = + png_ptr->trans_color.blue = (png_uint_16)trans_gray; + } } } /* background expand and (therefore) no alpha association. */ #endif /* PNG_READ_EXPAND_SUPPORTED && PNG_READ_BACKGROUND_SUPPORTED */ } @@ -1649,10 +1640,11 @@ /* if (png_ptr->background_gamma_type!=PNG_BACKGROUND_GAMMA_UNKNOWN) */ else /* color_type != PNG_COLOR_TYPE_PALETTE */ { - png_fixed_point g = PNG_FP_1; - png_fixed_point gs = PNG_FP_1; + int gs_sig, g_sig; + png_fixed_point g = PNG_FP_1; /* Correction to linear */ + png_fixed_point gs = PNG_FP_1; /* Correction to screen */ switch (png_ptr->background_gamma_type) { case PNG_BACKGROUND_GAMMA_SCREEN: @@ -1674,28 +1666,38 @@ default: png_error(png_ptr, "invalid background gamma type"); } + g_sig = png_gamma_significant(g); + gs_sig = png_gamma_significant(gs); + + if (g_sig) png_ptr->background_1.gray = png_gamma_correct(png_ptr, png_ptr->background.gray, g); + if (gs_sig) png_ptr->background.gray = png_gamma_correct(png_ptr, png_ptr->background.gray, gs); if ((png_ptr->background.red != png_ptr->background.green) || (png_ptr->background.red != png_ptr->background.blue) || (png_ptr->background.red != png_ptr->background.gray)) { /* RGB or RGBA with color background */ + if (g_sig) + { png_ptr->background_1.red = png_gamma_correct(png_ptr, png_ptr->background.red, g); png_ptr->background_1.green = png_gamma_correct(png_ptr, png_ptr->background.green, g); png_ptr->background_1.blue = png_gamma_correct(png_ptr, png_ptr->background.blue, g); + } + if (gs_sig) + { png_ptr->background.red = png_gamma_correct(png_ptr, png_ptr->background.red, gs); png_ptr->background.green = png_gamma_correct(png_ptr, @@ -1703,8 +1705,9 @@ png_ptr->background.blue = png_gamma_correct(png_ptr, png_ptr->background.blue, gs); } + } else { /* GRAY, GRAY ALPHA, RGB, or RGBA with gray background */ @@ -1713,8 +1716,11 @@ png_ptr->background.red = png_ptr->background.green = png_ptr->background.blue = png_ptr->background.gray; } + + /* The background is now in screen gamma: */ + png_ptr->background_gamma_type = PNG_BACKGROUND_GAMMA_SCREEN; } /* color_type != PNG_COLOR_TYPE_PALETTE */ }/* png_ptr->transformations & PNG_BACKGROUND */ else @@ -1787,28 +1793,40 @@ #ifdef PNG_READ_SHIFT_SUPPORTED if ((png_ptr->transformations & PNG_SHIFT) && (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)) { - png_uint_16 i; - png_uint_16 istop = png_ptr->num_palette; - int sr = 8 - png_ptr->sig_bit.red; - int sg = 8 - png_ptr->sig_bit.green; - int sb = 8 - png_ptr->sig_bit.blue; + int i; + int istop = png_ptr->num_palette; + int shift = 8 - png_ptr->sig_bit.red; + + /* significant bits can be in the range 1 to 7 for a meaninful result, if + * the number of significant bits is 0 then no shift is done (this is an + * error condition which is silently ignored.) + */ + if (shift > 0 && shift < 8) for (i=0; ipalette[i].red; - if (sr < 0 || sr > 8) - sr = 0; + component >>= shift; + png_ptr->palette[i].red = (png_byte)component; + } - if (sg < 0 || sg > 8) - sg = 0; + shift = 8 - png_ptr->sig_bit.green; + if (shift > 0 && shift < 8) for (i=0; ipalette[i].green; - if (sb < 0 || sb > 8) - sb = 0; + component >>= shift; + png_ptr->palette[i].green = (png_byte)component; + } - for (i = 0; i < istop; i++) + shift = 8 - png_ptr->sig_bit.blue; + if (shift > 0 && shift < 8) for (i=0; ipalette[i].red >>= sr; - png_ptr->palette[i].green >>= sg; - png_ptr->palette[i].blue >>= sb; + int component = png_ptr->palette[i].blue; + + component >>= shift; + png_ptr->palette[i].blue = (png_byte)component; } } #endif /* PNG_READ_SHIFT_SUPPORTED */ } @@ -1912,14 +1930,16 @@ } #ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED if (png_ptr->transformations & PNG_GRAY_TO_RGB) - info_ptr->color_type |= PNG_COLOR_MASK_COLOR; + info_ptr->color_type = (png_byte)(info_ptr->color_type | + PNG_COLOR_MASK_COLOR); #endif #ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED if (png_ptr->transformations & PNG_RGB_TO_GRAY) - info_ptr->color_type &= ~PNG_COLOR_MASK_COLOR; + info_ptr->color_type = (png_byte)(info_ptr->color_type & + ~PNG_COLOR_MASK_COLOR); #endif #ifdef PNG_READ_QUANTIZE_SUPPORTED if (png_ptr->transformations & PNG_QUANTIZE) @@ -1957,9 +1977,10 @@ #ifdef PNG_READ_STRIP_ALPHA_SUPPORTED if (png_ptr->transformations & PNG_STRIP_ALPHA) { - info_ptr->color_type &= ~PNG_COLOR_MASK_ALPHA; + info_ptr->color_type = (png_byte)(info_ptr->color_type & + ~PNG_COLOR_MASK_ALPHA); info_ptr->num_trans = 0; } #endif @@ -2014,9 +2035,9 @@ * and is very touchy. If you add a transformation, take care to * decide how it fits in with the other transformations here. */ void /* PRIVATE */ -png_do_read_transformations(png_structp png_ptr) +png_do_read_transformations(png_structp png_ptr, png_row_infop row_info) { png_debug(1, "in png_do_read_transformations"); if (png_ptr->row_buf == NULL) @@ -2045,42 +2066,42 @@ #ifdef PNG_READ_EXPAND_SUPPORTED if (png_ptr->transformations & PNG_EXPAND) { - if (png_ptr->row_info.color_type == PNG_COLOR_TYPE_PALETTE) + if (row_info->color_type == PNG_COLOR_TYPE_PALETTE) { - png_do_expand_palette(&(png_ptr->row_info), png_ptr->row_buf + 1, + png_do_expand_palette(row_info, png_ptr->row_buf + 1, png_ptr->palette, png_ptr->trans_alpha, png_ptr->num_trans); } else { if (png_ptr->num_trans && (png_ptr->transformations & PNG_EXPAND_tRNS)) - png_do_expand(&(png_ptr->row_info), png_ptr->row_buf + 1, + png_do_expand(row_info, png_ptr->row_buf + 1, &(png_ptr->trans_color)); else - png_do_expand(&(png_ptr->row_info), png_ptr->row_buf + 1, + png_do_expand(row_info, png_ptr->row_buf + 1, NULL); } } #endif #ifdef PNG_READ_STRIP_ALPHA_SUPPORTED if ((png_ptr->transformations & PNG_STRIP_ALPHA) && !(png_ptr->transformations & PNG_COMPOSE) && - (png_ptr->row_info.color_type == PNG_COLOR_TYPE_RGB_ALPHA || - png_ptr->row_info.color_type == PNG_COLOR_TYPE_GRAY_ALPHA)) - png_do_strip_channel(&(png_ptr->row_info), png_ptr->row_buf + 1, + (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA || + row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)) + png_do_strip_channel(row_info, png_ptr->row_buf + 1, 0 /* at_start == false, because SWAP_ALPHA happens later */); #endif #ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED if (png_ptr->transformations & PNG_RGB_TO_GRAY) { int rgb_error = - png_do_rgb_to_gray(png_ptr, &(png_ptr->row_info), + png_do_rgb_to_gray(png_ptr, row_info, png_ptr->row_buf + 1); if (rgb_error) { @@ -2132,15 +2153,15 @@ * for performance reasons */ if ((png_ptr->transformations & PNG_GRAY_TO_RGB) && !(png_ptr->mode & PNG_BACKGROUND_IS_GRAY)) - png_do_gray_to_rgb(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_gray_to_rgb(row_info, png_ptr->row_buf + 1); #endif #if (defined PNG_READ_BACKGROUND_SUPPORTED) ||\ (defined PNG_READ_ALPHA_MODE_SUPPORTED) if (png_ptr->transformations & PNG_COMPOSE) - png_do_compose(&(png_ptr->row_info), png_ptr->row_buf + 1, png_ptr); + png_do_compose(row_info, png_ptr->row_buf + 1, png_ptr); #endif #ifdef PNG_READ_GAMMA_SUPPORTED if ((png_ptr->transformations & PNG_GAMMA) && @@ -2150,47 +2171,47 @@ ((png_ptr->num_trans != 0) || (png_ptr->color_type & PNG_COLOR_MASK_ALPHA))) && #endif (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)) - png_do_gamma(&(png_ptr->row_info), png_ptr->row_buf + 1, png_ptr); + png_do_gamma(row_info, png_ptr->row_buf + 1, png_ptr); #endif #ifdef PNG_READ_STRIP_ALPHA_SUPPORTED if ((png_ptr->transformations & PNG_STRIP_ALPHA) && (png_ptr->transformations & PNG_COMPOSE) && - (png_ptr->row_info.color_type == PNG_COLOR_TYPE_RGB_ALPHA || - png_ptr->row_info.color_type == PNG_COLOR_TYPE_GRAY_ALPHA)) - png_do_strip_channel(&(png_ptr->row_info), png_ptr->row_buf + 1, + (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA || + row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)) + png_do_strip_channel(row_info, png_ptr->row_buf + 1, 0 /* at_start == false, because SWAP_ALPHA happens later */); #endif #ifdef PNG_READ_ALPHA_MODE_SUPPORTED if ((png_ptr->transformations & PNG_ENCODE_ALPHA) && - (png_ptr->row_info.color_type & PNG_COLOR_MASK_ALPHA)) - png_do_encode_alpha(&(png_ptr->row_info), png_ptr->row_buf + 1, png_ptr); + (row_info->color_type & PNG_COLOR_MASK_ALPHA)) + png_do_encode_alpha(row_info, png_ptr->row_buf + 1, png_ptr); #endif #ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED if (png_ptr->transformations & PNG_SCALE_16_TO_8) - png_do_scale_16_to_8(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_scale_16_to_8(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED /* There is no harm in doing both of these because only one has any effect, * by putting the 'scale' option first if the app asks for scale (either by * calling the API or in a TRANSFORM flag) this is what happens. */ if (png_ptr->transformations & PNG_16_TO_8) - png_do_chop(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_chop(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_QUANTIZE_SUPPORTED if (png_ptr->transformations & PNG_QUANTIZE) { - png_do_quantize(&(png_ptr->row_info), png_ptr->row_buf + 1, + png_do_quantize(row_info, png_ptr->row_buf + 1, png_ptr->palette_lookup, png_ptr->quantize_index); - if (png_ptr->row_info.rowbytes == 0) + if (row_info->rowbytes == 0) png_error(png_ptr, "png_do_quantize returned rowbytes=0"); } #endif /* PNG_READ_QUANTIZE_SUPPORTED */ @@ -2200,64 +2221,64 @@ * is efficient (particularly true in the case of gamma correction, where * better accuracy results faster!) */ if (png_ptr->transformations & PNG_EXPAND_16) - png_do_expand_16(&png_ptr->row_info, png_ptr->row_buf + 1); + png_do_expand_16(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED /*NOTE: moved here in 1.5.4 (from much later in this list.) */ if ((png_ptr->transformations & PNG_GRAY_TO_RGB) && (png_ptr->mode & PNG_BACKGROUND_IS_GRAY)) - png_do_gray_to_rgb(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_gray_to_rgb(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_INVERT_SUPPORTED if (png_ptr->transformations & PNG_INVERT_MONO) - png_do_invert(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_invert(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_SHIFT_SUPPORTED if (png_ptr->transformations & PNG_SHIFT) - png_do_unshift(&(png_ptr->row_info), png_ptr->row_buf + 1, + png_do_unshift(row_info, png_ptr->row_buf + 1, &(png_ptr->shift)); #endif #ifdef PNG_READ_PACK_SUPPORTED if (png_ptr->transformations & PNG_PACK) - png_do_unpack(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_unpack(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_BGR_SUPPORTED if (png_ptr->transformations & PNG_BGR) - png_do_bgr(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_bgr(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_PACKSWAP_SUPPORTED if (png_ptr->transformations & PNG_PACKSWAP) - png_do_packswap(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_packswap(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_FILLER_SUPPORTED if (png_ptr->transformations & PNG_FILLER) - png_do_read_filler(&(png_ptr->row_info), png_ptr->row_buf + 1, + png_do_read_filler(row_info, png_ptr->row_buf + 1, (png_uint_32)png_ptr->filler, png_ptr->flags); #endif #ifdef PNG_READ_INVERT_ALPHA_SUPPORTED if (png_ptr->transformations & PNG_INVERT_ALPHA) - png_do_read_invert_alpha(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_read_invert_alpha(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_SWAP_ALPHA_SUPPORTED if (png_ptr->transformations & PNG_SWAP_ALPHA) - png_do_read_swap_alpha(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_read_swap_alpha(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_READ_16BIT_SUPPORTED #ifdef PNG_READ_SWAP_SUPPORTED if (png_ptr->transformations & PNG_SWAP_BYTES) - png_do_swap(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_swap(row_info, png_ptr->row_buf + 1); #endif #endif #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED @@ -2265,9 +2286,9 @@ { if (png_ptr->read_user_transform_fn != NULL) (*(png_ptr->read_user_transform_fn)) /* User read transform function */ (png_ptr, /* png_ptr */ - &(png_ptr->row_info), /* row_info: */ + row_info, /* row_info: */ /* png_uint_32 width; width of row */ /* png_size_t rowbytes; number of bytes in row */ /* png_byte color_type; color type of pixels */ /* png_byte bit_depth; bit depth of samples */ @@ -2275,18 +2296,17 @@ /* png_byte pixel_depth; bits per pixel (depth*channels) */ png_ptr->row_buf + 1); /* start of pixel data for row */ #ifdef PNG_USER_TRANSFORM_PTR_SUPPORTED if (png_ptr->user_transform_depth) - png_ptr->row_info.bit_depth = png_ptr->user_transform_depth; + row_info->bit_depth = png_ptr->user_transform_depth; if (png_ptr->user_transform_channels) - png_ptr->row_info.channels = png_ptr->user_transform_channels; + row_info->channels = png_ptr->user_transform_channels; #endif - png_ptr->row_info.pixel_depth = (png_byte)(png_ptr->row_info.bit_depth * - png_ptr->row_info.channels); + row_info->pixel_depth = (png_byte)(row_info->bit_depth * + row_info->channels); - png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth, - png_ptr->row_info.width); + row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_info->width); } #endif } @@ -2398,107 +2418,130 @@ void /* PRIVATE */ png_do_unshift(png_row_infop row_info, png_bytep row, png_const_color_8p sig_bits) { + int color_type; + png_debug(1, "in png_do_unshift"); - if ( - row_info->color_type != PNG_COLOR_TYPE_PALETTE) + /* The palette case has already been handled in the _init routine. */ + color_type = row_info->color_type; + + if (color_type != PNG_COLOR_TYPE_PALETTE) { int shift[4]; int channels = 0; - int c; - png_uint_16 value = 0; - png_uint_32 row_width = row_info->width; + int bit_depth = row_info->bit_depth; - if (row_info->color_type & PNG_COLOR_MASK_COLOR) + if (color_type & PNG_COLOR_MASK_COLOR) { - shift[channels++] = row_info->bit_depth - sig_bits->red; - shift[channels++] = row_info->bit_depth - sig_bits->green; - shift[channels++] = row_info->bit_depth - sig_bits->blue; + shift[channels++] = bit_depth - sig_bits->red; + shift[channels++] = bit_depth - sig_bits->green; + shift[channels++] = bit_depth - sig_bits->blue; } else { - shift[channels++] = row_info->bit_depth - sig_bits->gray; + shift[channels++] = bit_depth - sig_bits->gray; } - if (row_info->color_type & PNG_COLOR_MASK_ALPHA) + if (color_type & PNG_COLOR_MASK_ALPHA) { - shift[channels++] = row_info->bit_depth - sig_bits->alpha; + shift[channels++] = bit_depth - sig_bits->alpha; } - for (c = 0; c < channels; c++) { - if (shift[c] <= 0) + int c, have_shift; + + for (c = have_shift = 0; c < channels; ++c) + { + /* A shift of more than the bit depth is an error condition but it + * gets ignored here. + */ + if (shift[c] <= 0 || shift[c] >= bit_depth) shift[c] = 0; else - value = 1; + have_shift = 1; } - if (!value) + if (!have_shift) return; + } - switch (row_info->bit_depth) + switch (bit_depth) { default: + /* Must be 1bpp gray: should not be here! */ + /* NOTREACHED */ break; case 2: + /* Must be 2bpp gray */ + /* assert(channels == 1 && shift[0] == 1) */ { - png_bytep bp; - png_size_t i; - png_size_t istop = row_info->rowbytes; + png_bytep bp = row; + png_bytep bp_end = bp + row_info->rowbytes; - for (bp = row, i = 0; i < istop; i++) + while (bp < bp_end) { - *bp >>= 1; - *bp++ &= 0x55; + int b = (*bp >> 1) & 0x55; + *bp++ = (png_byte)b; } break; } case 4: + /* Must be 4bpp gray */ + /* assert(channels == 1) */ { png_bytep bp = row; - png_size_t i; - png_size_t istop = row_info->rowbytes; - png_byte mask = (png_byte)((((int)0xf0 >> shift[0]) & (int)0xf0) | - (png_byte)((int)0xf >> shift[0])); + png_bytep bp_end = bp + row_info->rowbytes; + int gray_shift = shift[0]; + int mask = 0xf >> gray_shift; - for (i = 0; i < istop; i++) + mask |= mask << 4; + + while (bp < bp_end) { - *bp >>= shift[0]; - *bp++ &= mask; + int b = (*bp >> gray_shift) & mask; + *bp++ = (png_byte)b; } break; } case 8: + /* Single byte components, G, GA, RGB, RGBA */ { png_bytep bp = row; - png_uint_32 i; - png_uint_32 istop = row_width * channels; + png_bytep bp_end = bp + row_info->rowbytes; + int channel = 0; - for (i = 0; i < istop; i++) + while (bp < bp_end) { - *bp++ >>= shift[i%channels]; + int b = *bp >> shift[channel]; + if (++channel >= channels) + channel = 0; + *bp++ = (png_byte)b; } break; } #ifdef PNG_READ_16BIT_SUPPORTED case 16: + /* Double byte components, G, GA, RGB, RGBA */ { png_bytep bp = row; - png_uint_32 i; - png_uint_32 istop = channels * row_width; + png_bytep bp_end = bp + row_info->rowbytes; + int channel = 0; - for (i = 0; i < istop; i++) + while (bp < bp_end) { - value = (png_uint_16)((*bp << 8) + *(bp + 1)); - value >>= shift[i%channels]; + int value = (bp[0] << 8) + bp[1]; + + value >>= shift[channel]; + if (++channel >= channels) + channel = 0; *bp++ = (png_byte)(value >> 8); *bp++ = (png_byte)(value & 0xff); } break; @@ -3059,9 +3102,9 @@ *(dp--) = *(sp--); } } } - row_info->channels += (png_byte)2; + row_info->channels = (png_byte)(row_info->channels + 2); row_info->color_type |= PNG_COLOR_MASK_COLOR; row_info->pixel_depth = (png_byte)(row_info->channels * row_info->bit_depth); row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width); @@ -3305,9 +3348,9 @@ } } } - row_info->channels -= 2; + row_info->channels = (png_byte)(row_info->channels - 2); row_info->color_type = (png_byte)(row_info->color_type & ~PNG_COLOR_MASK_COLOR); row_info->pixel_depth = (png_byte)(row_info->channels * row_info->bit_depth); @@ -3375,9 +3418,10 @@ #endif #ifdef PNG_READ_TRANSFORMS_SUPPORTED -#ifdef PNG_READ_BACKGROUND_SUPPORTED +#if (defined PNG_READ_BACKGROUND_SUPPORTED) ||\ + (defined PNG_READ_ALPHA_MODE_SUPPORTED) /* Replace any alpha or transparency with the supplied background color. * "background" is already in the screen gamma, while "background_1" is * at a gamma of 1.0. Paletted files have already been taken care of. */ @@ -4083,9 +4127,9 @@ break; } } } -#endif +#endif /* PNG_READ_BACKGROUND_SUPPORTED || PNG_READ_ALPHA_MODE_SUPPORTED */ #ifdef PNG_READ_GAMMA_SUPPORTED /* Gamma correct the image, avoiding the alpha channel. Make sure * you do this after you deal with the transparency issue on grayscale diff -ru4NwbB libpng-1.5.5/pngrutil.c libpng-1.5.6rc03/pngrutil.c --- libpng-1.5.5/pngrutil.c 2011-09-22 08:40:23.662008903 -0500 +++ libpng-1.5.6rc03/pngrutil.c 2011-10-27 19:44:40.035997958 -0500 @@ -1,8 +1,8 @@ /* pngrutil.c - utilities to read a PNG file * - * Last changed in libpng 1.5.5 [(PENDING RELEASE)] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -164,16 +164,16 @@ png_read_data(png_ptr, buf, 8); length = png_get_uint_31(png_ptr, buf); /* Put the chunk name into png_ptr->chunk_name. */ - png_memcpy(png_ptr->chunk_name, buf + 4, 4); + png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(buf+4); - png_debug2(0, "Reading %s chunk, length = %u", - png_ptr->chunk_name, length); + png_debug2(0, "Reading %lx chunk, length = %lu", + (unsigned long)png_ptr->chunk_name, (unsigned long)length); /* Reset the crc and run it over the chunk name. */ png_reset_crc(png_ptr); - png_calculate_crc(png_ptr, png_ptr->chunk_name, 4); + png_calculate_crc(png_ptr, buf + 4, 4); /* Check to see if chunk name is valid. */ png_check_chunk_name(png_ptr, png_ptr->chunk_name); @@ -217,12 +217,11 @@ } if (png_crc_error(png_ptr)) { - if (((png_ptr->chunk_name[0] & 0x20) && /* Ancillary */ - !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)) || - (!(png_ptr->chunk_name[0] & 0x20) && /* Critical */ - (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE))) + if (PNG_CHUNK_ANCILLIARY(png_ptr->chunk_name) ? + !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) : + (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE)) { png_chunk_warning(png_ptr, "CRC error"); } @@ -247,9 +246,9 @@ png_byte crc_bytes[4]; png_uint_32 crc; int need_crc = 1; - if (png_ptr->chunk_name[0] & 0x20) /* ancillary */ + if (PNG_CHUNK_ANCILLIARY(png_ptr->chunk_name)) { if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) == (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN)) need_crc = 0; @@ -301,9 +300,9 @@ while (1) { int ret, avail; - /* The setting of 'avail_in' used to be outside the loop, by setting it + /* The setting of 'avail_in' used to be outside the loop; by setting it * inside it is possible to chunk the input to zlib and simply rely on * zlib to advance the 'next_in' pointer. This allows arbitrary amounts o * data to be passed through zlib at the unavoidable cost of requiring a * window save (memcpy of up to 32768 output bytes) every ZLIB_IO_MAX @@ -941,9 +940,9 @@ } else if (png_ptr->mode & PNG_HAVE_PLTE) /* Should be an error, but we can cope with it */ - png_warning(png_ptr, "Missing PLTE before cHRM"); + png_warning(png_ptr, "Out of place cHRM chunk"); if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) # ifdef PNG_READ_sRGB_SUPPORTED && !(info_ptr->valid & PNG_INFO_sRGB) @@ -2640,18 +2639,16 @@ #endif if (png_ptr->mode & PNG_HAVE_IDAT) { - PNG_IDAT; - - if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) /* Not an IDAT */ + if (png_ptr->chunk_name != png_IDAT) png_ptr->mode |= PNG_AFTER_IDAT; } - if (!(png_ptr->chunk_name[0] & 0x20)) + if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name)) { #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED - if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != + if (png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name) != PNG_HANDLE_CHUNK_ALWAYS #ifdef PNG_READ_USER_CHUNKS_SUPPORTED && png_ptr->read_user_chunk_fn == NULL #endif @@ -2667,32 +2664,31 @@ #endif ) { #ifdef PNG_MAX_MALLOC_64K - if (length > (png_uint_32)65535L) + if (length > 65535) { png_warning(png_ptr, "unknown chunk too large to fit in memory"); - skip = length - (png_uint_32)65535L; - length = (png_uint_32)65535L; + skip = length - 65535; + length = 65535; } #endif - png_memcpy((png_charp)png_ptr->unknown_chunk.name, - (png_charp)png_ptr->chunk_name, - png_sizeof(png_ptr->unknown_chunk.name)); - - png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name)-1] - = '\0'; - + /* TODO: this code is very close to the unknown handling in pngpread.c, + * maybe it can be put into a common utility routine? + * png_struct::unknown_chunk is just used as a temporary variable, along + * with the data into which the chunk is read. These can be eliminated. + */ + PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name); png_ptr->unknown_chunk.size = (png_size_t)length; if (length == 0) png_ptr->unknown_chunk.data = NULL; else { png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length); - png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length); + png_crc_read(png_ptr, png_ptr->unknown_chunk.data, length); } #ifdef PNG_READ_USER_CHUNKS_SUPPORTED if (png_ptr->read_user_chunk_fn != NULL) @@ -2707,12 +2703,12 @@ png_chunk_error(png_ptr, "error in user chunk"); if (ret == 0) { - if (!(png_ptr->chunk_name[0] & 0x20)) + if (PNG_CHUNK_CRITICAL(png_ptr->chunk_name)) { #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED - if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) != + if (png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name) != PNG_HANDLE_CHUNK_ALWAYS) #endif png_chunk_error(png_ptr, "unknown critical chunk"); } @@ -2747,18 +2743,28 @@ * functions to handle unknown critical chunks after we check that * the chunk name itself is valid. */ -#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97)) +/* Bit hacking: the test for an invalid byte in the 4 byte chunk name is: + * + * ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97)) + */ void /* PRIVATE */ -png_check_chunk_name(png_structp png_ptr, png_const_bytep chunk_name) +png_check_chunk_name(png_structp png_ptr, png_uint_32 chunk_name) { + int i; + png_debug(1, "in png_check_chunk_name"); - if (isnonalpha(chunk_name[0]) || isnonalpha(chunk_name[1]) || - isnonalpha(chunk_name[2]) || isnonalpha(chunk_name[3])) + + for (i=1; i<=4; ++i) { + int c = chunk_name & 0xff; + + if (c < 65 || c > 122 || (c > 90 && c < 97)) png_chunk_error(png_ptr, "invalid chunk type"); + + chunk_name >>= 8; } } /* Combines the row recently read in with the existing pixels in the @@ -2773,243 +2779,492 @@ * you want all pixels to be combined, pass 0xff (255) in mask. */ void /* PRIVATE */ -png_combine_row(png_structp png_ptr, png_bytep row, int mask) +png_combine_row(png_structp png_ptr, png_bytep dp, int display) { + unsigned int pixel_depth = png_ptr->transformed_pixel_depth; + png_const_bytep sp = png_ptr->row_buf + 1; + png_uint_32 row_width = png_ptr->width; + unsigned int pass = png_ptr->pass; + png_bytep end_ptr = 0; + png_byte end_byte = 0; + unsigned int end_mask; + png_debug(1, "in png_combine_row"); - /* Added in 1.5.4: the row_info should match the information returned by any - * call to png_read_update_info at this point. Do not continue if we got + /* Added in 1.5.6: it should not be possible to enter this routine until at + * least one row has been read from the PNG data and transformed. + */ + if (pixel_depth == 0) + png_error(png_ptr, "internal row logic error"); + + /* Added in 1.5.4: the pixel depth should match the information returned by + * any call to png_read_update_info at this point. Do not continue if we got * this wrong. */ if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes != - PNG_ROWBYTES(png_ptr->row_info.pixel_depth, png_ptr->width)) + PNG_ROWBYTES(pixel_depth, row_width)) png_error(png_ptr, "internal row size calculation error"); - if (mask == 0xff) - { - png_memcpy(row, png_ptr->row_buf + 1, - PNG_ROWBYTES(png_ptr->row_info.pixel_depth, png_ptr->width)); + /* Don't expect this to ever happen: */ + if (row_width == 0) + png_error(png_ptr, "internal row width error"); + + /* Preserve the last byte in cases where only part of it will be overwritten, + * the multiply below may overflow, we don't care because ANSI-C guarantees + * we get the low bits. + */ + end_mask = (pixel_depth * row_width) & 7; + if (end_mask != 0) + { + /* end_ptr == NULL is a flag to say do nothing */ + end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1; + end_byte = *end_ptr; +# ifdef PNG_READ_PACKSWAP_SUPPORTED + if (png_ptr->transformations & PNG_PACKSWAP) /* little-endian byte */ + end_mask = 0xff << end_mask; + + else /* big-endian byte */ +# endif + end_mask = 0xff >> end_mask; + /* end_mask is now the bits to *keep* from the destination row */ } - else - { - switch (png_ptr->row_info.pixel_depth) + /* For non-interlaced images this reduces to a png_memcpy(). A png_memcpy() + * will also happen if interlacing isn't supported or if the application + * does not call png_set_interlace_handling(). In the latter cases the + * caller just gets a sequence of the unexpanded rows from each interlace + * pass. + */ +#ifdef PNG_READ_INTERLACING_SUPPORTED + if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE) && + pass < 6 && (display == 0 || + /* The following copies everything for 'display' on passes 0, 2 and 4. */ + (display == 1 && (pass & 1) != 0))) { - case 1: + /* Narrow images may have no bits in a pass; the caller should handle + * this, but this test is cheap: + */ + if (row_width <= PNG_PASS_START_COL(pass)) + return; + + if (pixel_depth < 8) { - png_bytep sp = png_ptr->row_buf + 1; - png_bytep dp = row; - int s_inc, s_start, s_end; - int m = 0x80; - int shift; - png_uint_32 i; - png_uint_32 row_width = png_ptr->width; + /* For pixel depths up to 4-bpp the 8-pixel mask can be expanded to fit + * into 32 bits, then a single loop over the bytes using the four byte + * values in the 32-bit mask can be used. For the 'display' option the + * expanded mask may also not require any masking within a byte. To + * make this work the PACKSWAP option must be taken into account - it + * simply requires the pixels to be reversed in each byte. + * + * The 'regular' case requires a mask for each of the first 6 passes, + * the 'display' case does a copy for the even passes in the range + * 0..6. This has already been handled in the tst above. + * + * The masks are arranged as four bytes with the first byte to use in + * the lowest bits (little-endian) regardless of the order (PACKSWAP or + * not) of the pixels in each byte. + * + * NOTE: the whole of this logic depends on the caller of this function + * only calling it on rows appropriate to the pass. This function only + * understands the 'x' logic, the 'y' logic is handled by the caller. + * + * The following defines allow generation of compile time constant bit + * masks for each pixel depth and each possibility of swapped or not + * swapped bytes. Pass 'p' is in the range 0..6; 'x', a pixel index, + * is in the range 0..7; and the result is 1 if the pixel is to be + * copied in the pass, 0 if not. 'S' is for the sparkle method, 'B' + * for the block method. + * + * With some compilers a compile time expression of the general form: + * + * (shift >= 32) ? (a >> (shift-32)) : (b >> shift) + * + * Produces warnings with values of 'shift' in the range 33 to 63 + * because the right hand side of the ?: expression is evalulated by + * the compiler even though it isn't used. Microsoft Visual C (various + * versions) and the Intel C compiler are known to do this. To avoid + * this the following macros are used in 1.5.6. This is a temporary + * solution to avoid destablizing the code during the release process. + */ +# if PNG_USE_COMPILE_TIME_MASKS +# define PNG_LSR(x,s) ((x)>>((s) & 0x1f)) +# define PNG_LSL(x,s) ((x)<<((s) & 0x1f)) +# else +# define PNG_LSR(x,s) ((x)>>(s)) +# define PNG_LSL(x,s) ((x)<<(s)) +# endif +# define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\ + PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1) +# define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\ + PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1) + + /* Return a mask for pass 'p' pixel 'x' at depth 'd'. The mask is + * little endian - the first pixel is at bit 0 - however the extra + * parameter 's' can be set to cause the mask position to be swapped + * within each byte, to match the PNG format. This is done by XOR of + * the shift with 7, 6 or 4 for bit depths 1, 2 and 4. + */ +# define PIXEL_MASK(p,x,d,s) \ + (PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0)))) + + /* Hence generate the appropriate 'block' or 'sparkle' pixel copy mask. + */ +# define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0) +# define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0) + + /* Combine 8 of these to get the full mask. For the 1-bpp and 2-bpp + * cases the result needs replicating, for the 4-bpp case the above + * generates a full 32 bits. + */ +# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) + +# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ + S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ + S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) + +# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ + B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ + B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) + +#if PNG_USE_COMPILE_TIME_MASKS + /* Utility macros to construct all the masks for a depth/swap + * combination. The 's' parameter says whether the format is PNG + * (big endian bytes) or not. Only the three odd numbered passes are + * required for the display/block algorithm. + */ +# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ + S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } + +# define B_MASKS(d,s) { B_MASK(1,d,s), S_MASK(3,d,s), S_MASK(5,d,s) } + +# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2)) + + /* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and + * then pass: + */ + static PNG_CONST png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] = { + /* Little-endian byte masks for PACKSWAP */ + { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) }, + /* Normal (big-endian byte) masks - PNG format */ + { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) } + }; + + /* display_mask has only three entries for the odd passes, so index by + * pass>>1. + */ + static PNG_CONST png_uint_32 display_mask[2][3][3] = { + /* Little-endian byte masks for PACKSWAP */ + { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) }, + /* Normal (big-endian byte) masks - PNG format */ + { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) } + }; + +# define MASK(pass,depth,display,png)\ + ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\ + row_mask[png][DEPTH_INDEX(depth)][pass]) + +#else /* !PNG_USE_COMPILE_TIME_MASKS */ + /* This is the runtime alternative: it seems unlikely that this will + * ever be either smaller or faster than the compile time approach. + */ +# define MASK(pass,depth,display,png)\ + ((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png)) +#endif /* !PNG_USE_COMPILE_TIME_MASKS */ + + /* Use the appropriate mask to copy the required bits. In some cases + * the byte mask will be 0 or 0xff, optimize these cases. row_width is + * the number of pixels, but the code copies bytes, so it is necessary + * to special case the end. + */ + png_uint_32 pixels_per_byte = 8 / pixel_depth; + png_uint_32 mask; #ifdef PNG_READ_PACKSWAP_SUPPORTED if (png_ptr->transformations & PNG_PACKSWAP) - { - s_start = 0; - s_end = 7; - s_inc = 1; - } + mask = MASK(pass, pixel_depth, display, 0); else #endif - { - s_start = 7; - s_end = 0; - s_inc = -1; - } + mask = MASK(pass, pixel_depth, display, 1); - shift = s_start; - - for (i = 0; i < row_width; i++) - { - if (m & mask) + for (;;) { - int value; + png_uint_32 m; - value = (*sp >> shift) & 0x01; - *dp &= (png_byte)((0x7f7f >> (7 - shift)) & 0xff); - *dp |= (png_byte)(value << shift); - } + /* It doesn't matter in the following if png_uint_32 has more than + * 32 bits because the high bits always match those in m<<24; it is, + * however, essential to use OR here, not +, because of this. + */ + m = mask; + mask = (m >> 8) | (m << 24); /* rotate right to good compilers */ + m &= 0xff; - if (shift == s_end) + if (m != 0) /* something to copy */ { - shift = s_start; - sp++; - dp++; - } - + if (m != 0xff) + *dp = (png_byte)((*dp & ~m) | (*sp & m)); else - shift += s_inc; + *dp = *sp; + } - if (m == 1) - m = 0x80; + /* NOTE: this may overwrite the last byte with garbage if the image + * is not an exact number of bytes wide; libpng has always done + * this. + */ + if (row_width <= pixels_per_byte) + break; /* May need to restore part of the last byte */ - else - m >>= 1; + row_width -= pixels_per_byte; + ++dp; + ++sp; } - break; } - case 2: + else /* pixel_depth >= 8 */ { - png_bytep sp = png_ptr->row_buf + 1; - png_bytep dp = row; - int s_start, s_end, s_inc; - int m = 0x80; - int shift; - png_uint_32 i; - png_uint_32 row_width = png_ptr->width; - int value; + unsigned int bytes_to_copy, bytes_to_jump; -#ifdef PNG_READ_PACKSWAP_SUPPORTED - if (png_ptr->transformations & PNG_PACKSWAP) + /* Validate the depth - it must be a multiple of 8 */ + if (pixel_depth & 7) + png_error(png_ptr, "invalid user transform pixel depth"); + + pixel_depth >>= 3; /* now in bytes */ + row_width *= pixel_depth; + + /* Regardless of pass number the Adam 7 interlace always results in a + * fixed number of pixels to copy then to skip. There may be a + * different number of pixels to skip at the start though. + */ { - s_start = 0; - s_end = 6; - s_inc = 2; + unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth; + + row_width -= offset; + dp += offset; + sp += offset; } - else -#endif + /* Work out the bytes to copy. */ + if (display) { - s_start = 6; - s_end = 0; - s_inc = -2; + /* When doing the 'block' algorithm the pixel in the pass gets + * replicated to adjacent pixels. This is why the even (0,2,4,6) + * passes are skipped above - the entire expanded row is copied. + */ + bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth; + + /* But don't allow this number to exceed the actual row width. */ + if (bytes_to_copy > row_width) + bytes_to_copy = row_width; } - shift = s_start; + else /* normal row; Adam7 only ever gives us one pixel to copy. */ + bytes_to_copy = pixel_depth; + + /* In Adam7 there is a constant offset between where the pixels go. */ + bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth; - for (i = 0; i < row_width; i++) + /* And simply copy these bytes. Some optimization is possible here, + * depending on the value of 'bytes_to_copy'. Special case the low + * byte counts, which we know to be frequent. + * + * Notice that these cases all 'return' rather than 'break' - this + * avoids an unnecessary test on whether to restore the last byte + * below. + */ + switch (bytes_to_copy) { - if (m & mask) + case 1: + for (;;) { - value = (*sp >> shift) & 0x03; - *dp &= (png_byte)((0x3f3f >> (6 - shift)) & 0xff); - *dp |= (png_byte)(value << shift); - } + *dp = *sp; - if (shift == s_end) - { - shift = s_start; - sp++; - dp++; + if (row_width <= bytes_to_jump) + return; + + dp += bytes_to_jump; + sp += bytes_to_jump; + row_width -= bytes_to_jump; } - else - shift += s_inc; + case 2: + /* There is a possibility of a partial copy at the end here; this + * slows the code down somewhat. + */ + do + { + dp[0] = sp[0], dp[1] = sp[1]; - if (m == 1) - m = 0x80; + if (row_width <= bytes_to_jump) + return; - else - m >>= 1; - } - break; + sp += bytes_to_jump; + dp += bytes_to_jump; + row_width -= bytes_to_jump; } + while (row_width > 1); - case 4: - { - png_bytep sp = png_ptr->row_buf + 1; - png_bytep dp = row; - int s_start, s_end, s_inc; - int m = 0x80; - int shift; - png_uint_32 i; - png_uint_32 row_width = png_ptr->width; - int value; + /* And there can only be one byte left at this point: */ + *dp = *sp; + return; -#ifdef PNG_READ_PACKSWAP_SUPPORTED - if (png_ptr->transformations & PNG_PACKSWAP) + case 3: + /* This can only be the RGB case, so each copy is exactly one + * pixel and it is not necessary to check for a partial copy. + */ + for(;;) { - s_start = 0; - s_end = 4; - s_inc = 4; - } + dp[0] = sp[0], dp[1] = sp[1], dp[2] = sp[2]; - else -#endif - { - s_start = 4; - s_end = 0; - s_inc = -4; - } - shift = s_start; + if (row_width <= bytes_to_jump) + return; - for (i = 0; i < row_width; i++) - { - if (m & mask) - { - value = (*sp >> shift) & 0xf; - *dp &= (png_byte)((0xf0f >> (4 - shift)) & 0xff); - *dp |= (png_byte)(value << shift); + sp += bytes_to_jump; + dp += bytes_to_jump; + row_width -= bytes_to_jump; } - if (shift == s_end) + default: +#if PNG_ALIGN_TYPE != PNG_ALIGN_NONE + /* Check for double byte alignment and, if possible, use a + * 16-bit copy. Don't attempt this for narrow images - ones that + * are less than an interlace panel wide. Don't attempt it for + * wide bytes-to-copy either - use the png_memcpy there. + */ + if (bytes_to_copy < 16 /*else use png_memcpy*/ && + png_isaligned(dp, png_uint_16) && + png_isaligned(sp, png_uint_16) && + bytes_to_copy % sizeof (png_uint_16) == 0 && + bytes_to_jump % sizeof (png_uint_16) == 0) + { + /* Everything is aligned for png_uint_16 copies, but try for + * png_uint_32 first. + */ + if (png_isaligned(dp, png_uint_32) && + png_isaligned(sp, png_uint_32) && + bytes_to_copy % sizeof (png_uint_32) == 0 && + bytes_to_jump % sizeof (png_uint_32) == 0) + { + png_uint_32p dp32 = (png_uint_32p)dp; + png_const_uint_32p sp32 = (png_const_uint_32p)sp; + unsigned int skip = (bytes_to_jump-bytes_to_copy) / + sizeof (png_uint_32); + + do + { + size_t c = bytes_to_copy; + do { - shift = s_start; - sp++; - dp++; + *dp32++ = *sp32++; + c -= sizeof (png_uint_32); } + while (c > 0); - else - shift += s_inc; - - if (m == 1) - m = 0x80; + if (row_width <= bytes_to_jump) + return; - else - m >>= 1; + dp32 += skip; + sp32 += skip; + row_width -= bytes_to_jump; } - break; + while (bytes_to_copy <= row_width); + + /* Get to here when the row_width truncates the final copy. + * There will be 1-3 bytes left to copy, so don't try the + * 16-bit loop below. + */ + dp = (png_bytep)dp32; + sp = (png_const_bytep)sp32; + do + *dp++ = *sp++; + while (--row_width > 0); + return; } - default: + /* Else do it in 16-bit quantities, but only if the size is + * not too large. + */ + else { - png_bytep sp = png_ptr->row_buf + 1; - png_bytep dp = row; - png_size_t pixel_bytes = (png_ptr->row_info.pixel_depth >> 3); - png_uint_32 i; - png_uint_32 row_width = png_ptr->width; - png_byte m = 0x80; + png_uint_16p dp16 = (png_uint_16p)dp; + png_const_uint_16p sp16 = (png_const_uint_16p)sp; + unsigned int skip = (bytes_to_jump-bytes_to_copy) / + sizeof (png_uint_16); - for (i = 0; i < row_width; i++) + do { - if (m & mask) + size_t c = bytes_to_copy; + do { - png_memcpy(dp, sp, pixel_bytes); + *dp16++ = *sp16++; + c -= sizeof (png_uint_16); } + while (c > 0); - sp += pixel_bytes; - dp += pixel_bytes; + if (row_width <= bytes_to_jump) + return; - if (m == 1) - m = 0x80; + dp16 += skip; + sp16 += skip; + row_width -= bytes_to_jump; + } + while (bytes_to_copy <= row_width); - else - m >>= 1; + /* End of row - 1 byte left, bytes_to_copy > row_width: */ + dp = (png_bytep)dp16; + sp = (png_const_bytep)sp16; + do + *dp++ = *sp++; + while (--row_width > 0); + return; } - break; } +#endif /* PNG_ALIGN_ code */ + + /* The true default - use a png_memcpy: */ + for (;;) + { + png_memcpy(dp, sp, bytes_to_copy); + + if (row_width <= bytes_to_jump) + return; + + sp += bytes_to_jump; + dp += bytes_to_jump; + row_width -= bytes_to_jump; + if (bytes_to_copy > row_width) + bytes_to_copy = row_width; } } + + /* NOT REACHED*/ + } /* pixel_depth >= 8 */ + + /* Here if pixel_depth < 8 to check 'end_ptr' below. */ + } + else +#endif + + /* If here then the switch above wasn't used so just png_memcpy the whole row + * from the temporary row buffer (notice that this overwrites the end of the + * destination row if it is a partial byte.) + */ + png_memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width)); + + /* Restore the overwritten bits from the last byte if necessary. */ + if (end_ptr != NULL) + *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask)); } #ifdef PNG_READ_INTERLACING_SUPPORTED void /* PRIVATE */ -png_do_read_interlace(png_structp png_ptr) +png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass, + png_uint_32 transformations /* Because these may affect the byte layout */) { - png_row_infop row_info = &(png_ptr->row_info); - png_bytep row = png_ptr->row_buf + 1; - int pass = png_ptr->pass; - png_uint_32 transformations = png_ptr->transformations; /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ /* Offset to next interlace block */ - PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; + static PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; png_debug(1, "in png_do_read_interlace"); if (row != NULL && row_info != NULL) { @@ -3172,9 +3427,9 @@ } for (i = 0; i < row_info->width; i++) { - png_byte v = (png_byte)((*sp >> sshift) & 0xf); + png_byte v = (png_byte)((*sp >> sshift) & 0x0f); int j; for (j = 0; j < jstop; j++) { @@ -3240,14 +3497,15 @@ #endif } #endif /* PNG_READ_INTERLACING_SUPPORTED */ +/* 1.5.6: Changed to just take a png_row_info (not png_ptr) and to ignore bad + * adaptive filter bytes. + */ void /* PRIVATE */ -png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep row, +png_read_filter_row(png_row_infop row_info, png_bytep row, png_const_bytep prev_row, int filter) { - png_debug(1, "in png_read_filter_row"); - png_debug2(2, "row = %u, filter = %d", png_ptr->row_number, filter); switch (filter) { case PNG_FILTER_VALUE_NONE: break; @@ -3362,9 +3620,8 @@ } break; } default: - png_error(png_ptr, "Ignoring bad adaptive filter type"); /*NOT REACHED */ break; } } @@ -3376,18 +3633,18 @@ #ifdef PNG_READ_INTERLACING_SUPPORTED /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ /* Start of interlace block */ - PNG_CONST int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; + static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; /* Offset to next interlace block */ - PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; + static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; /* Start of interlace block in the y direction */ - PNG_CONST int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; + static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; /* Offset to next interlace block in the y direction */ - PNG_CONST int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; + static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; #endif /* PNG_READ_INTERLACING_SUPPORTED */ png_debug(1, "in png_read_finish_row"); png_ptr->row_number++; @@ -3398,8 +3655,11 @@ if (png_ptr->interlaced) { png_ptr->row_number = 0; + /* TO DO: don't do this if prev_row isn't needed (requires + * read-ahead of the next row's filter byte. + */ png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); do { @@ -3432,9 +3692,8 @@ #endif /* PNG_READ_INTERLACING_SUPPORTED */ if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED)) { - PNG_IDAT; char extra; int ret; png_ptr->zstream.next_out = (Byte *)&extra; @@ -3447,9 +3706,9 @@ while (!png_ptr->idat_size) { png_crc_finish(png_ptr, 0); png_ptr->idat_size = png_read_chunk_header(png_ptr); - if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) + if (png_ptr->chunk_name != png_IDAT) png_error(png_ptr, "Not enough image data"); } png_ptr->zstream.avail_in = (uInt)png_ptr->zbuf_size; @@ -3506,18 +3765,18 @@ #ifdef PNG_READ_INTERLACING_SUPPORTED /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ /* Start of interlace block */ - PNG_CONST int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; + static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; /* Offset to next interlace block */ - PNG_CONST int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; + static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; /* Start of interlace block in the y direction */ - PNG_CONST int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; + static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; /* Offset to next interlace block in the y direction */ - PNG_CONST int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; + static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; #endif int max_pixel_depth; png_size_t row_bytes; @@ -3683,8 +3942,14 @@ max_pixel_depth=user_pixel_depth; } #endif + /* This value is stored in png_struct and double checked in the row read + * code. + */ + png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth; + png_ptr->transformed_pixel_depth = 0; /* calculated on demand */ + /* Align the width on the next larger 8 pixels. Mainly used * for interlacing */ row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7)); @@ -3701,30 +3966,41 @@ if (row_bytes + 48 > png_ptr->old_big_row_buf_size) { png_free(png_ptr, png_ptr->big_row_buf); + png_free(png_ptr, png_ptr->big_prev_row); if (png_ptr->interlaced) png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr, row_bytes + 48); else - png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, - row_bytes + 48); + png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48); - png_ptr->old_big_row_buf_size = row_bytes + 48; + png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48); #ifdef PNG_ALIGNED_MEMORY_SUPPORTED /* Use 16-byte aligned memory for row_buf with at least 16 bytes - * of padding before and after row_buf. + * of padding before and after row_buf; treat prev_row similarly. + * NOTE: the alignment is to the start of the pixels, one beyond the start + * of the buffer, because of the filter byte. Prior to libpng 1.5.6 this + * was incorrect; the filter byte was aligned, which had the exact + * opposite effect of that intended. */ - png_ptr->row_buf = png_ptr->big_row_buf + 32 - - (((png_alloc_size_t)png_ptr->big_row_buf + 15) & 0x0F); + { + png_bytep temp = png_ptr->big_row_buf + 32; + int extra = (int)((temp - (png_bytep)0) & 0x0f); + png_ptr->row_buf = temp - extra - 1/*filter byte*/; + + temp = png_ptr->big_prev_row + 32; + extra = (int)((temp - (png_bytep)0) & 0x0f); + png_ptr->prev_row = temp - extra - 1/*filter byte*/; + } - png_ptr->old_big_row_buf_size = row_bytes + 48; #else - /* Use 32 bytes of padding before and 16 bytes after row_buf. */ - png_ptr->row_buf = png_ptr->big_row_buf + 32; + /* Use 31 bytes of padding before and 17 bytes after row_buf. */ + png_ptr->row_buf = png_ptr->big_row_buf + 31; + png_ptr->prev_row = png_ptr->big_prev_row + 31; #endif png_ptr->old_big_row_buf_size = row_bytes + 48; } @@ -3735,17 +4011,8 @@ #endif if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1)) png_error(png_ptr, "Row has too many bytes to allocate in memory"); - if (png_ptr->rowbytes + 1 > png_ptr->old_prev_row_size) - { - png_free(png_ptr, png_ptr->prev_row); - - png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, png_ptr->rowbytes + 1); - - png_ptr->old_prev_row_size = png_ptr->rowbytes + 1; - } - png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); png_debug1(3, "width = %u,", png_ptr->width); png_debug1(3, "height = %u,", png_ptr->height); diff -ru4NwbB libpng-1.5.5/pngset.c libpng-1.5.6rc03/pngset.c --- libpng-1.5.5/pngset.c 2011-09-22 08:40:23.670146262 -0500 +++ libpng-1.5.6rc03/pngset.c 2011-10-27 19:44:40.044337930 -0500 @@ -1,8 +1,8 @@ /* pngset.c - storage of image information into info struct * - * Last changed in libpng 1.5.5 [(PENDING RELEASE)] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -680,11 +680,10 @@ png_const_textp text_ptr, int num_text) { int i; - png_debug1(1, "in %s storage function", ((png_ptr == NULL || - png_ptr->chunk_name[0] == '\0') ? - "text" : (png_const_charp)png_ptr->chunk_name)); + png_debug1(1, "in %lx storage function", png_ptr == NULL ? "unexpected" : + (unsigned long)png_ptr->chunk_name); if (png_ptr == NULL || info_ptr == NULL || num_text == 0) return(0); diff -ru4NwbB libpng-1.5.5/pngstruct.h libpng-1.5.6rc03/pngstruct.h --- libpng-1.5.5/pngstruct.h 2011-09-22 08:40:23.555984280 -0500 +++ libpng-1.5.6rc03/pngstruct.h 2011-10-27 19:44:39.930937484 -0500 @@ -4,9 +4,9 @@ * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * - * Last changed in libpng 1.5.5 [(PENDING RELEASE)] + * Last changed in libpng 1.5.5 [September 22, 2011] * * This code is released under the libpng license. * For conditions of distribution and use, see the disclaimer * and license in png.h @@ -103,35 +103,44 @@ png_uint_32 usr_width; /* width of row at start of write */ png_size_t rowbytes; /* size of row in bytes */ png_uint_32 iwidth; /* width of current interlaced row in pixels */ png_uint_32 row_number; /* current row in interlace pass */ - png_bytep prev_row; /* buffer to save previous (unfiltered) row */ - png_bytep row_buf; /* buffer to save current (unfiltered) row */ + png_uint_32 chunk_name; /* PNG_CHUNK() id of current chunk */ + png_bytep prev_row; /* buffer to save previous (unfiltered) row. + * This is a pointer into big_prev_row + */ + png_bytep row_buf; /* buffer to save current (unfiltered) row. + * This is a pointer into big_row_buf + */ png_bytep sub_row; /* buffer to save "sub" row when filtering */ png_bytep up_row; /* buffer to save "up" row when filtering */ png_bytep avg_row; /* buffer to save "avg" row when filtering */ png_bytep paeth_row; /* buffer to save "Paeth" row when filtering */ - png_row_info row_info; /* used for transformation routines */ png_size_t info_rowbytes; /* Added in 1.5.4: cache of updated row bytes */ png_uint_32 idat_size; /* current IDAT size for read */ png_uint_32 crc; /* current chunk CRC value */ png_colorp palette; /* palette from the input file */ png_uint_16 num_palette; /* number of color entries in palette */ png_uint_16 num_trans; /* number of transparency values */ - png_byte chunk_name[5]; /* null-terminated name of current chunk */ png_byte compression; /* file compression type (always 0) */ png_byte filter; /* file filter type (always 0) */ png_byte interlaced; /* PNG_INTERLACE_NONE, PNG_INTERLACE_ADAM7 */ png_byte pass; /* current interlace pass (0 - 6) */ png_byte do_filter; /* row filter flags (see PNG_FILTER_ below ) */ png_byte color_type; /* color type of file */ png_byte bit_depth; /* bit depth of file */ - png_byte usr_bit_depth; /* bit depth of users row */ + png_byte usr_bit_depth; /* bit depth of users row: write only */ png_byte pixel_depth; /* number of bits per pixel */ png_byte channels; /* number of channels in file */ - png_byte usr_channels; /* channels at start of write */ + png_byte usr_channels; /* channels at start of write: write only */ png_byte sig_bytes; /* magic bytes read/written from start of file */ + png_byte maximum_pixel_depth; + /* pixel depth used for the row buffers */ + png_byte transformed_pixel_depth; + /* pixel depth after read/write transforms */ + png_byte io_chunk_string[5]; + /* string name of chunk */ #if defined(PNG_READ_FILLER_SUPPORTED) || defined(PNG_WRITE_FILLER_SUPPORTED) png_uint_16 filler; /* filler bytes for pixel expansion */ #endif @@ -151,21 +160,23 @@ png_uint_32 flush_dist; /* how many rows apart to flush, 0 - no flush */ png_uint_32 flush_rows; /* number of rows written since last flush */ #endif -#if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED) +#ifdef PNG_READ_GAMMA_SUPPORTED int gamma_shift; /* number of "insignificant" bits in 16-bit gamma */ png_fixed_point gamma; /* file gamma value */ png_fixed_point screen_gamma; /* screen gamma value (display_exponent) */ -#endif -#if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED) png_bytep gamma_table; /* gamma table for 8-bit depth files */ + png_uint_16pp gamma_16_table; /* gamma table for 16-bit depth files */ +#if defined(PNG_READ_BACKGROUND_SUPPORTED) || \ + defined(PNG_READ_ALPHA_MODE_SUPPORTED) || \ + defined(PNG_READ_RGB_TO_GRAY_SUPPORTED) png_bytep gamma_from_1; /* converts from 1.0 to screen */ png_bytep gamma_to_1; /* converts from file to 1.0 */ - png_uint_16pp gamma_16_table; /* gamma table for 16-bit depth files */ png_uint_16pp gamma_16_from_1; /* converts from 1.0 to screen */ png_uint_16pp gamma_16_to_1; /* converts from file to 1.0 */ +#endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */ #endif #if defined(PNG_READ_GAMMA_SUPPORTED) || defined(PNG_sBIT_SUPPORTED) png_color_8 sig_bit; /* significant bits in each available channel */ @@ -328,17 +339,19 @@ /* Storage for unknown chunk that the library doesn't recognize. */ png_unknown_chunk unknown_chunk; #endif -/* New members added in libpng-1.2.26 */ +/* New member added in libpng-1.2.26 */ png_size_t old_big_row_buf_size; - png_size_t old_prev_row_size; /* New member added in libpng-1.2.30 */ png_charp chunkdata; /* buffer for reading chunk data */ #ifdef PNG_IO_STATE_SUPPORTED /* New member added in libpng-1.4.0 */ png_uint_32 io_state; #endif + +/* New member added in libpng-1.5.6 */ + png_bytep big_prev_row; }; #endif /* PNGSTRUCT_H */ diff -ru4NwbB libpng-1.5.5/pngtest.c libpng-1.5.6rc03/pngtest.c --- libpng-1.5.5/pngtest.c 2011-09-22 08:40:23.679566006 -0500 +++ libpng-1.5.6rc03/pngtest.c 2011-10-27 19:44:40.053543904 -0500 @@ -1,8 +1,8 @@ /* pngtest.c - a simple test program to test libpng * - * Last changed in libpng 1.5.4 [July 7, 2011] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -97,8 +97,9 @@ static char tIME_string[PNG_tIME_STRING_LENGTH] = "tIME chunk is not present"; #endif static int verbose = 0; +static int strict = 0; int test_one_file PNGARG((PNG_CONST char *inname, PNG_CONST char *outname)); #ifdef __TURBOC__ @@ -1478,8 +1479,13 @@ } FCLOSE(fpin); FCLOSE(fpout); + + if (strict != 0) + return (1); + + else return (0); } if (!num_in) @@ -1503,8 +1509,13 @@ } FCLOSE(fpin); FCLOSE(fpout); + + if (strict != 0) + return (1); + + else return (0); } } @@ -1585,8 +1596,16 @@ status_dots_requested = 1; inname = argv[2]; } + else if (strcmp(argv[1], "--strict") == 0) + { + status_dots_requested = 0; + verbose = 1; + inname = argv[2]; + strict++; + } + else { inname = argv[1]; status_dots_requested = 0; diff -ru4NwbB libpng-1.5.5/pngvalid.c libpng-1.5.6rc03/pngvalid.c --- libpng-1.5.5/pngvalid.c 2011-09-22 08:40:23.715031257 -0500 +++ libpng-1.5.6rc03/pngvalid.c 2011-10-27 19:44:40.088655200 -0500 @@ -1,8 +1,8 @@ /* pngvalid.c - validate libpng by constructing then reading png files. * - * Last changed in libpng 1.5.5 [(PENDING RELEASE)] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 2011 Glenn Randers-Pehrson * Written by John Cunningham Bowler * * This code is released under the libpng license. @@ -432,14 +432,37 @@ else /* One or more bytes */ memmove(toBuffer+(toIndex>>3), fromBuffer+(fromIndex>>3), pixelSize>>3); } +/* Copy a complete row of pixels, taking into account potential partial + * bytes at the end. + */ +static void +row_copy(png_bytep toBuffer, png_const_bytep fromBuffer, unsigned int bitWidth) +{ + memcpy(toBuffer, fromBuffer, bitWidth >> 3); + + if ((bitWidth & 7) != 0) + { + unsigned int mask; + + toBuffer += bitWidth >> 3; + fromBuffer += bitWidth >> 3; + /* The remaining bits are in the top of the byte, the mask is the bits to + * retain. + */ + mask = 0xff >> (bitWidth & 7); + *toBuffer = (png_byte)((*toBuffer & mask) | (*fromBuffer & ~mask)); + } +} + /* Compare pixels - they are assumed to start at the first byte in the * given buffers. */ static int pixel_cmp(png_const_bytep pa, png_const_bytep pb, png_uint_32 bit_width) { +#if PNG_LIBPNG_VER < 10506 if (memcmp(pa, pb, bit_width>>3) == 0) { png_uint_32 p; @@ -458,10 +481,23 @@ p >>= 8-bit_width; if (p == 0) return 0; } +#else + /* From libpng-1.5.6 the overwrite should be fixed, so compare the trailing + * bits too: + */ + if (memcmp(pa, pb, (bit_width+7)>>3) == 0) + return 0; +#endif + + /* Return the index of the changed byte. */ + { + png_uint_32 where = 0; - return 1; /* Different */ + while (pa[where] == pb[where]) ++where; + return 1+where; + } } /*************************** BASIC PNG FILE WRITING ***************************/ /* A png_store takes data from the sequential writer or provides data @@ -901,13 +937,15 @@ */ ps->cb_row = cbRow; ps->image_h = cRows; - /* For error checking, the whole buffer is set to '1' - this matches what - * happens with the 'size' test images on write and also matches the unused - * bits in the test rows. + /* For error checking, the whole buffer is set to 10110010 (0xb2 - 178). + * This deliberately doesn't match the bits in the size test image which are + * outside the image; these are set to 0xff (all 1). To make the row + * comparison work in the 'size' test case the size rows are pre-initialized + * to the same value prior to calling 'standard_row'. */ - memset(ps->image, 0xff, cb); + memset(ps->image, 178, cb); /* Then put in the marks. */ while (--nImages >= 0) { @@ -1708,8 +1746,13 @@ double error_color_16; double error_indexed; /* Flags: */ + /* Whether to call png_read_update_info, not png_read_start_image, and how + * many times to call it. + */ + int use_update_info; + /* Whether or not to interlace. */ int interlace_type :9; /* int, but must store '1' */ /* Run the standard tests? */ @@ -1791,8 +1834,9 @@ pm->log8 = pm->log16 = 0; /* Means 'off' */ pm->error_gray_2 = pm->error_gray_4 = pm->error_gray_8 = 0; pm->error_gray_16 = pm->error_color_8 = pm->error_color_16 = 0; pm->error_indexed = 0; + pm->use_update_info = 0; pm->interlace_type = PNG_INTERLACE_NONE; pm->test_standard = 0; pm->test_size = 0; pm->test_transform = 0; @@ -3877,8 +3921,9 @@ size_t cbRow; /* Bytes in a row of the output image */ int do_interlace; /* Do interlacing internally */ int is_transparent; /* Transparency information was present. */ int speed; /* Doing a speed test */ + int use_update_info;/* Call update_info, not start_image */ struct { png_uint_16 red; png_uint_16 green; @@ -3890,9 +3935,9 @@ } standard_display; static void standard_display_init(standard_display *dp, png_store* ps, png_uint_32 id, - int do_interlace) + int do_interlace, int use_update_info) { memset(dp, 0, sizeof *dp); dp->ps = ps; @@ -3914,8 +3959,9 @@ dp->cbRow = 0; dp->do_interlace = do_interlace; dp->is_transparent = 0; dp->speed = ps->speed; + dp->use_update_info = use_update_info; dp->npalette = 0; /* Preset the transparent color to black: */ memset(&dp->transparent, 0, sizeof dp->transparent); /* Preset the palette to full intensity/opaque througout: */ @@ -4271,8 +4317,17 @@ /* And the info callback has to call this (or png_read_update_info - see * below in the png_modifier code for that variant. */ + if (dp->use_update_info) + { + /* For debugging the effect of multiple calls: */ + int i = dp->use_update_info; + while (i-- > 0) + png_read_update_info(pp, pi); + } + + else png_start_read_image(pp); /* Validate the height, width and rowbytes plus ensure that sufficient buffer * exists for decoding the image. @@ -4329,22 +4384,24 @@ png_error(pp, "invalid y to progressive row callback"); row = store_image_row(dp->ps, pp, 0, y); +#ifdef PNG_READ_INTERLACING_SUPPORTED /* Combine the new row into the old: */ if (dp->do_interlace) { if (dp->interlace_type == PNG_INTERLACE_ADAM7) deinterlace_row(row, new_row, dp->pixel_size, dp->w, pass); else - memcpy(row, new_row, dp->cbRow); + row_copy(row, new_row, dp->pixel_size * dp->w); } else png_progressive_combine_row(pp, row, new_row); } else if (dp->interlace_type == PNG_INTERLACE_ADAM7 && PNG_ROW_IN_INTERLACE_PASS(y, pass) && PNG_PASS_COLS(dp->w, pass) > 0) png_error(pp, "missing row in progressive de-interlacing"); +#endif /* PNG_READ_INTERLACING_SUPPORTED */ } static void sequential_row(standard_display *dp, png_structp pp, png_infop pi, @@ -4378,12 +4435,14 @@ png_byte row[STANDARD_ROWMAX], display[STANDARD_ROWMAX]; /* The following aids (to some extent) error detection - we can * see where png_read_row wrote. Use opposite values in row and - * display to make this easier. + * display to make this easier. Don't use 0xff (which is used in + * the image write code to fill unused bits) or 0 (which is a + * likely value to overwrite unused bits with). */ - memset(row, 0xff, sizeof row); - memset(display, 0, sizeof display); + memset(row, 0xc5, sizeof row); + memset(display, 0x5c, sizeof display); png_read_row(pp, row, display); if (iImage >= 0) @@ -4411,41 +4470,56 @@ static void standard_row_validate(standard_display *dp, png_structp pp, int iImage, int iDisplay, png_uint_32 y) { + int where; png_byte std[STANDARD_ROWMAX]; - memset(std, 0xff, sizeof std); + /* The row must be pre-initialized to the magic number here for the size + * tests to pass: + */ + memset(std, 178, sizeof std); standard_row(pp, std, dp->id, y); /* At the end both the 'row' and 'display' arrays should end up identical. * In earlier passes 'row' will be partially filled in, with only the pixels * that have been read so far, but 'display' will have those pixels * replicated to fill the unread pixels while reading an interlaced image. +#if PNG_LIBPNG_VER < 10506 * The side effect inside the libpng sequential reader is that the 'row' * array retains the correct values for unwritten pixels within the row * bytes, while the 'display' array gets bits off the end of the image (in * the last byte) trashed. Unfortunately in the progressive reader the * row bytes are always trashed, so we always do a pixel_cmp here even though * a memcmp of all cbRow bytes will succeed for the sequential reader. +#endif */ - if (iImage >= 0 && pixel_cmp(std, store_image_row(dp->ps, pp, iImage, y), - dp->bit_width) != 0) + if (iImage >= 0 && + (where = pixel_cmp(std, store_image_row(dp->ps, pp, iImage, y), + dp->bit_width)) != 0) { char msg[64]; - sprintf(msg, "PNG image row %d changed", y); + sprintf(msg, "PNG image row[%d][%d] changed from %.2x to %.2x", y, + where-1, std[where-1], + store_image_row(dp->ps, pp, iImage, y)[where-1]); png_error(pp, msg); } +#if PNG_LIBPNG_VER < 10506 /* In this case use pixel_cmp because we need to compare a partial * byte at the end of the row if the row is not an exact multiple - * of 8 bits wide. + * of 8 bits wide. (This is fixed in libpng-1.5.6 and pixel_cmp is + * changed to match!) */ - if (iDisplay >= 0 && pixel_cmp(std, store_image_row(dp->ps, pp, iDisplay, y), - dp->bit_width) != 0) +#endif + if (iDisplay >= 0 && + (where = pixel_cmp(std, store_image_row(dp->ps, pp, iDisplay, y), + dp->bit_width)) != 0) { char msg[64]; - sprintf(msg, "display row %d changed", y); + sprintf(msg, "display row[%d][%d] changed from %.2x to %.2x", y, + where-1, std[where-1], + store_image_row(dp->ps, pp, iDisplay, y)[where-1]); png_error(pp, msg); } } @@ -4484,17 +4558,17 @@ /* A single test run checking the standard image to ensure it is not damaged. */ static void standard_test(png_store* PNG_CONST psIn, png_uint_32 PNG_CONST id, - int do_interlace) + int do_interlace, int use_update_info) { standard_display d; context(psIn, fault); /* Set up the display (stack frame) variables from the arguments to the * function and initialize the locals that are filled in later. */ - standard_display_init(&d, psIn, id, do_interlace); + standard_display_init(&d, psIn, id, do_interlace, use_update_info); /* Everything is protected by a Try/Catch. The functions called also * typically have local Try/Catch blocks. */ @@ -4548,8 +4622,10 @@ * image is correct. */ if (!d.speed) standard_image_validate(&d, pp, 0, 1); + else + d.ps->validated = 1; } } /* Check for validation. */ @@ -4577,9 +4653,9 @@ for (interlace_type = PNG_INTERLACE_NONE; interlace_type < PNG_INTERLACE_LAST; ++interlace_type) { standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/, - interlace_type, 0, 0, 0), 0/*do_interlace*/); + interlace_type, 0, 0, 0), 0/*do_interlace*/, pm->use_update_info); if (fail(pm)) return 0; } @@ -4636,27 +4712,31 @@ * validates the write side of libpng. There are four possibilities * to validate. */ standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/, - PNG_INTERLACE_NONE, w, h, 0), 0/*do_interlace*/); + PNG_INTERLACE_NONE, w, h, 0), 0/*do_interlace*/, + pm->use_update_info); if (fail(pm)) return 0; standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/, - PNG_INTERLACE_NONE, w, h, 1), 0/*do_interlace*/); + PNG_INTERLACE_NONE, w, h, 1), 0/*do_interlace*/, + pm->use_update_info); if (fail(pm)) return 0; standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/, - PNG_INTERLACE_ADAM7, w, h, 0), 0/*do_interlace*/); + PNG_INTERLACE_ADAM7, w, h, 0), 0/*do_interlace*/, + pm->use_update_info); if (fail(pm)) return 0; standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/, - PNG_INTERLACE_ADAM7, w, h, 1), 0/*do_interlace*/); + PNG_INTERLACE_ADAM7, w, h, 1), 0/*do_interlace*/, + pm->use_update_info); if (fail(pm)) return 0; @@ -4664,15 +4744,17 @@ * in the progressive case this does actually make a difference * to the code used in the non-interlaced case too. */ standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/, - PNG_INTERLACE_NONE, w, h, 0), 1/*do_interlace*/); + PNG_INTERLACE_NONE, w, h, 0), 1/*do_interlace*/, + pm->use_update_info); if (fail(pm)) return 0; standard_test(&pm->this, FILEID(colour_type, DEPTH(bdlo), 0/*palette*/, - PNG_INTERLACE_ADAM7, w, h, 0), 1/*do_interlace*/); + PNG_INTERLACE_ADAM7, w, h, 0), 1/*do_interlace*/, + pm->use_update_info); if (fail(pm)) return 0; } @@ -5145,9 +5227,10 @@ { memset(dp, 0, sizeof dp); /* Standard fields */ - standard_display_init(&dp->this, &pm->this, id, 0/*do_interlace*/); + standard_display_init(&dp->this, &pm->this, id, 0/*do_interlace*/, + pm->use_update_info); /* Parameter fields */ dp->pm = pm; dp->transform_list = transform_list; @@ -5166,9 +5249,15 @@ /* Now set the list of transforms. */ dp->transform_list->set(dp->transform_list, dp, pp, pi); /* Update the info structure for these transforms: */ + { + int i = dp->this.use_update_info; + /* Always do one call, even if use_update_info is 0. */ + do png_read_update_info(pp, pi); + while (--i > 0); + } /* And get the output information into the standard_display */ standard_info_part2(&dp->this, pp, pi, 1/*images*/); @@ -5487,9 +5576,12 @@ { transform_display *dp = voidcast(transform_display*, png_get_progressive_ptr(pp)); + if (!dp->this.speed) transform_image_validate(dp, pp, pi); + else + dp->this.ps->validated = 1; } /* A single test run. */ static void @@ -5560,8 +5652,10 @@ sequential_row(&d.this, pp, pi, -1, 0); if (!d.this.speed) transform_image_validate(&d, pp, pi); + else + d.this.ps->validated = 1; } modifier_reset(d.pm); } @@ -6993,9 +7087,10 @@ int do_background, PNG_CONST png_color_16 *pointer_to_the_background_color, double background_gamma) { /* Standard fields */ - standard_display_init(&dp->this, &pm->this, id, 0/*do_interlace*/); + standard_display_init(&dp->this, &pm->this, id, 0/*do_interlace*/, + pm->use_update_info); /* Parameter fields */ dp->pm = pm; dp->file_gamma = file_gamma; @@ -7122,9 +7217,15 @@ # endif } } + { + int i = dp->this.use_update_info; + /* Always do one call, even if use_update_info is 0. */ + do png_read_update_info(pp, pi); + while (--i > 0); + } /* Now we may get a different cbRow: */ standard_info_part2(&dp->this, pp, pi, 1 /*images*/); } @@ -7729,9 +7830,9 @@ case ALPHA_MODE_OFFSET + PNG_ALPHA_STANDARD: case ALPHA_MODE_OFFSET + PNG_ALPHA_BROKEN: case ALPHA_MODE_OFFSET + PNG_ALPHA_OPTIMIZED: # endif /* ALPHA_MODE_SUPPORTED */ - do_compose = (alpha >= 0 && alpha < 1); + do_compose = (alpha > 0 && alpha < 1); use_input = (alpha != 0); break; default: @@ -8079,8 +8180,10 @@ gamma_display *dp = voidcast(gamma_display*, png_get_progressive_ptr(pp)); if (!dp->this.speed) gamma_image_validate(dp, pp, pi); + else + dp->this.ps->validated = 1; } /* A single test run checking a gamma transformation. * @@ -8160,8 +8263,10 @@ sequential_row(&d.this, pp, pi, -1, 0); if (!d.this.speed) gamma_image_validate(&d, pp, pi); + else + d.this.ps->validated = 1; } modifier_reset(d.pm); @@ -9349,8 +9454,11 @@ else if (strcmp(*argv, "--progressive-read") == 0) pm.this.progressive = 1; + else if (strcmp(*argv, "--use-update-info") == 0) + ++pm.use_update_info; /* Can call multiple times */ + else if (strcmp(*argv, "--interlace") == 0) pm.interlace_type = PNG_INTERLACE_ADAM7; else if (strcmp(*argv, "--use-input-precision") == 0) diff -ru4NwbB libpng-1.5.5/pngwrite.c libpng-1.5.6rc03/pngwrite.c --- libpng-1.5.5/pngwrite.c 2011-09-22 08:40:23.729807592 -0500 +++ libpng-1.5.6rc03/pngwrite.c 2011-10-27 19:44:40.103267789 -0500 @@ -1,8 +1,8 @@ /* pngwrite.c - general routines to write a PNG file * - * Last changed in libpng 1.5.4 [July 7, 2011] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -607,8 +607,11 @@ /* Called by user to write a row of image data */ void PNGAPI png_write_row(png_structp png_ptr, png_const_bytep row) { + /* 1.5.6: moved from png_struct to be a local structure: */ + png_row_info row_info; + if (png_ptr == NULL) return; png_debug2(1, "in png_write_row (row %u, pass %d)", @@ -730,38 +733,33 @@ } #endif /* Set up row info for transformations */ - png_ptr->row_info.color_type = png_ptr->color_type; - png_ptr->row_info.width = png_ptr->usr_width; - png_ptr->row_info.channels = png_ptr->usr_channels; - png_ptr->row_info.bit_depth = png_ptr->usr_bit_depth; - png_ptr->row_info.pixel_depth = (png_byte)(png_ptr->row_info.bit_depth * - png_ptr->row_info.channels); - - png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth, - png_ptr->row_info.width); - - png_debug1(3, "row_info->color_type = %d", png_ptr->row_info.color_type); - png_debug1(3, "row_info->width = %u", png_ptr->row_info.width); - png_debug1(3, "row_info->channels = %d", png_ptr->row_info.channels); - png_debug1(3, "row_info->bit_depth = %d", png_ptr->row_info.bit_depth); - png_debug1(3, "row_info->pixel_depth = %d", png_ptr->row_info.pixel_depth); - png_debug1(3, "row_info->rowbytes = %lu", - (unsigned long)png_ptr->row_info.rowbytes); + row_info.color_type = png_ptr->color_type; + row_info.width = png_ptr->usr_width; + row_info.channels = png_ptr->usr_channels; + row_info.bit_depth = png_ptr->usr_bit_depth; + row_info.pixel_depth = (png_byte)(row_info.bit_depth * row_info.channels); + row_info.rowbytes = PNG_ROWBYTES(row_info.pixel_depth, row_info.width); + + png_debug1(3, "row_info->color_type = %d", row_info.color_type); + png_debug1(3, "row_info->width = %u", row_info.width); + png_debug1(3, "row_info->channels = %d", row_info.channels); + png_debug1(3, "row_info->bit_depth = %d", row_info.bit_depth); + png_debug1(3, "row_info->pixel_depth = %d", row_info.pixel_depth); + png_debug1(3, "row_info->rowbytes = %lu", (unsigned long)row_info.rowbytes); /* Copy user's row into buffer, leaving room for filter byte. */ - png_memcpy(png_ptr->row_buf + 1, row, png_ptr->row_info.rowbytes); + png_memcpy(png_ptr->row_buf + 1, row, row_info.rowbytes); #ifdef PNG_WRITE_INTERLACING_SUPPORTED /* Handle interlacing */ if (png_ptr->interlaced && png_ptr->pass < 6 && (png_ptr->transformations & PNG_INTERLACE)) { - png_do_write_interlace(&(png_ptr->row_info), - png_ptr->row_buf + 1, png_ptr->pass); + png_do_write_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass); /* This should always get caught above, but still ... */ - if (!(png_ptr->row_info.width)) + if (!(row_info.width)) { png_write_finish_row(png_ptr); return; } @@ -770,11 +768,18 @@ #ifdef PNG_WRITE_TRANSFORMS_SUPPORTED /* Handle other transformations */ if (png_ptr->transformations) - png_do_write_transformations(png_ptr); + png_do_write_transformations(png_ptr, &row_info); #endif + /* At this point the row_info pixel depth must match the 'transformed' depth, + * which is also the output depth. + */ + if (row_info.pixel_depth != png_ptr->pixel_depth || + row_info.pixel_depth != png_ptr->transformed_pixel_depth) + png_error(png_ptr, "internal write transform logic error"); + #ifdef PNG_MNG_FEATURES_SUPPORTED /* Write filter_method 64 (intrapixel differencing) only if * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and * 2. Libpng did not write a PNG signature (this filter_method is only @@ -787,14 +792,14 @@ if ((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) && (png_ptr->filter_type == PNG_INTRAPIXEL_DIFFERENCING)) { /* Intrapixel differencing */ - png_do_write_intrapixel(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_write_intrapixel(&row_info, png_ptr->row_buf + 1); } #endif /* Find a filter if necessary, filter the row and write it out. */ - png_write_find_filter(png_ptr, &(png_ptr->row_info)); + png_write_find_filter(png_ptr, &row_info); if (png_ptr->write_row_fn != NULL) (*(png_ptr->write_row_fn))(png_ptr, png_ptr->row_number, png_ptr->pass); } @@ -878,15 +883,9 @@ png_debug(1, "in png_destroy_write_struct"); if (png_ptr_ptr != NULL) - { png_ptr = *png_ptr_ptr; -#ifdef PNG_USER_MEM_SUPPORTED - free_fn = png_ptr->free_fn; - mem_ptr = png_ptr->mem_ptr; -#endif - } #ifdef PNG_USER_MEM_SUPPORTED if (png_ptr != NULL) { diff -ru4NwbB libpng-1.5.5/pngwtran.c libpng-1.5.6rc03/pngwtran.c --- libpng-1.5.5/pngwtran.c 2011-09-22 08:40:23.736162236 -0500 +++ libpng-1.5.6rc03/pngwtran.c 2011-10-27 19:44:40.109702975 -0500 @@ -1,8 +1,8 @@ /* pngwtran.c - transforms the data in a row for PNG writers * - * Last changed in libpng 1.5.4 [July 7, 2011] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -19,9 +19,9 @@ /* Transform the data according to the user's wishes. The order of * transformations is significant. */ void /* PRIVATE */ -png_do_write_transformations(png_structp png_ptr) +png_do_write_transformations(png_structp png_ptr, png_row_infop row_info) { png_debug(1, "in png_do_write_transformations"); if (png_ptr == NULL) @@ -32,9 +32,9 @@ if (png_ptr->write_user_transform_fn != NULL) (*(png_ptr->write_user_transform_fn)) /* User write transform function */ (png_ptr, /* png_ptr */ - &(png_ptr->row_info), /* row_info: */ + row_info, /* row_info: */ /* png_uint_32 width; width of row */ /* png_size_t rowbytes; number of bytes in row */ /* png_byte color_type; color type of pixels */ /* png_byte bit_depth; bit depth of samples */ @@ -44,52 +44,52 @@ #endif #ifdef PNG_WRITE_FILLER_SUPPORTED if (png_ptr->transformations & PNG_FILLER) - png_do_strip_channel(&(png_ptr->row_info), png_ptr->row_buf + 1, + png_do_strip_channel(row_info, png_ptr->row_buf + 1, !(png_ptr->flags & PNG_FLAG_FILLER_AFTER)); #endif #ifdef PNG_WRITE_PACKSWAP_SUPPORTED if (png_ptr->transformations & PNG_PACKSWAP) - png_do_packswap(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_packswap(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_WRITE_PACK_SUPPORTED if (png_ptr->transformations & PNG_PACK) - png_do_pack(&(png_ptr->row_info), png_ptr->row_buf + 1, + png_do_pack(row_info, png_ptr->row_buf + 1, (png_uint_32)png_ptr->bit_depth); #endif #ifdef PNG_WRITE_SWAP_SUPPORTED if (png_ptr->transformations & PNG_SWAP_BYTES) - png_do_swap(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_swap(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_WRITE_SHIFT_SUPPORTED if (png_ptr->transformations & PNG_SHIFT) - png_do_shift(&(png_ptr->row_info), png_ptr->row_buf + 1, + png_do_shift(row_info, png_ptr->row_buf + 1, &(png_ptr->shift)); #endif #ifdef PNG_WRITE_SWAP_ALPHA_SUPPORTED if (png_ptr->transformations & PNG_SWAP_ALPHA) - png_do_write_swap_alpha(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_write_swap_alpha(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_WRITE_INVERT_ALPHA_SUPPORTED if (png_ptr->transformations & PNG_INVERT_ALPHA) - png_do_write_invert_alpha(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_write_invert_alpha(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_WRITE_BGR_SUPPORTED if (png_ptr->transformations & PNG_BGR) - png_do_bgr(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_bgr(row_info, png_ptr->row_buf + 1); #endif #ifdef PNG_WRITE_INVERT_SUPPORTED if (png_ptr->transformations & PNG_INVERT_MONO) - png_do_invert(&(png_ptr->row_info), png_ptr->row_buf + 1); + png_do_invert(row_info, png_ptr->row_buf + 1); #endif } #ifdef PNG_WRITE_PACK_SUPPORTED diff -ru4NwbB libpng-1.5.5/pngwutil.c libpng-1.5.6rc03/pngwutil.c --- libpng-1.5.5/pngwutil.c 2011-09-22 08:40:23.748868598 -0500 +++ libpng-1.5.6rc03/pngwutil.c 2011-10-27 19:44:40.122527674 -0500 @@ -1,8 +1,8 @@ /* pngwutil.c - utilities to write a PNG file * - * Last changed in libpng 1.5.5 [(PENDING RELEASE)] + * Last changed in libpng 1.5.6 [(PENDING RELEASE)] * Copyright (c) 1998-2011 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) * @@ -81,41 +81,22 @@ if (png_ptr->sig_bytes < 3) png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE; } -/* Write a PNG chunk all at once. The type is an array of ASCII characters - * representing the chunk name. The array must be at least 4 bytes in - * length, and does not need to be null terminated. To be safe, pass the - * pre-defined chunk names here, and if you need a new one, define it - * where the others are defined. The length is the length of the data. - * All the data must be present. If that is not possible, use the - * png_write_chunk_start(), png_write_chunk_data(), and png_write_chunk_end() - * functions instead. - */ -void PNGAPI -png_write_chunk(png_structp png_ptr, png_const_bytep chunk_name, - png_const_bytep data, png_size_t length) -{ - if (png_ptr == NULL) - return; - - png_write_chunk_start(png_ptr, chunk_name, (png_uint_32)length); - png_write_chunk_data(png_ptr, data, (png_size_t)length); - png_write_chunk_end(png_ptr); -} - /* Write the start of a PNG chunk. The type is the chunk type. * The total_length is the sum of the lengths of all the data you will be * passing in png_write_chunk_data(). */ -void PNGAPI -png_write_chunk_start(png_structp png_ptr, png_const_bytep chunk_name, +static void +png_write_chunk_header(png_structp png_ptr, png_uint_32 chunk_name, png_uint_32 length) { png_byte buf[8]; - png_debug2(0, "Writing %s chunk, length = %lu", chunk_name, - (unsigned long)length); +#if defined(PNG_DEBUG) && (PNG_DEBUG > 0) + PNG_CSTRING_FROM_CHUNK(buf, chunk_name); + png_debug2(0, "Writing %s chunk, length = %lu", buf, (unsigned long)length); +#endif if (png_ptr == NULL) return; @@ -127,18 +108,18 @@ #endif /* Write the length and the chunk name */ png_save_uint_32(buf, length); - png_memcpy(buf + 4, chunk_name, 4); - png_write_data(png_ptr, buf, (png_size_t)8); + png_save_uint_32(buf + 4, chunk_name); + png_write_data(png_ptr, buf, 8); /* Put the chunk name into png_ptr->chunk_name */ - png_memcpy(png_ptr->chunk_name, chunk_name, 4); + png_ptr->chunk_name = chunk_name; /* Reset the crc and run it over the chunk name */ png_reset_crc(png_ptr); - png_calculate_crc(png_ptr, chunk_name, 4); + png_calculate_crc(png_ptr, buf + 4, 4); #ifdef PNG_IO_STATE_SUPPORTED /* Inform the I/O callback that chunk data will (possibly) be written. * PNG_IO_CHUNK_DATA does NOT require a specific number of I/O calls. @@ -146,12 +127,19 @@ png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_DATA; #endif } -/* Write the data of a PNG chunk started with png_write_chunk_start(). +void PNGAPI +png_write_chunk_start(png_structp png_ptr, png_const_bytep chunk_string, + png_uint_32 length) +{ + png_write_chunk_header(png_ptr, PNG_CHUNK_FROM_STRING(chunk_string), length); +} + +/* Write the data of a PNG chunk started with png_write_chunk_header(). * Note that multiple calls to this function are allowed, and that the * sum of the lengths from these calls *must* add up to the total_length - * given to png_write_chunk_start(). + * given to png_write_chunk_header(). */ void PNGAPI png_write_chunk_data(png_structp png_ptr, png_const_bytep data, png_size_t length) @@ -170,9 +158,9 @@ png_calculate_crc(png_ptr, data, length); } } -/* Finish a chunk started with png_write_chunk_start(). */ +/* Finish a chunk started with png_write_chunk_header(). */ void PNGAPI png_write_chunk_end(png_structp png_ptr) { png_byte buf[4]; @@ -191,8 +179,42 @@ png_write_data(png_ptr, buf, (png_size_t)4); } +/* Write a PNG chunk all at once. The type is an array of ASCII characters + * representing the chunk name. The array must be at least 4 bytes in + * length, and does not need to be null terminated. To be safe, pass the + * pre-defined chunk names here, and if you need a new one, define it + * where the others are defined. The length is the length of the data. + * All the data must be present. If that is not possible, use the + * png_write_chunk_start(), png_write_chunk_data(), and png_write_chunk_end() + * functions instead. + */ +static void +png_write_complete_chunk(png_structp png_ptr, png_uint_32 chunk_name, + png_const_bytep data, png_size_t length) +{ + if (png_ptr == NULL) + return; + + /* On 64 bit architectures 'length' may not fit in a png_uint_32. */ + if (length > PNG_UINT_32_MAX) + png_error(png_ptr, "length exceeds PNG maxima"); + + png_write_chunk_header(png_ptr, chunk_name, (png_uint_32)length); + png_write_chunk_data(png_ptr, data, length); + png_write_chunk_end(png_ptr); +} + +/* This is the API that calls the internal function above. */ +void PNGAPI +png_write_chunk(png_structp png_ptr, png_const_bytep chunk_string, + png_const_bytep data, png_size_t length) +{ + png_write_complete_chunk(png_ptr, PNG_CHUNK_FROM_STRING(chunk_string), data, + length); +} + /* Initialize the compressor for the appropriate type of compression. */ static void png_zlib_claim(png_structp png_ptr, png_uint_32 state) { @@ -559,9 +581,12 @@ return; } #ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED - if (comp->input_len >= 2 && comp->input_len < 16384) + /* The zbuf_size test is because the code below doesn't work if zbuf_size is + * '1'; simply skip it to avoid memory overwrite. + */ + if (comp->input_len >= 2 && comp->input_len < 16384 && png_ptr->zbuf_size > 1) { unsigned int z_cmf; /* zlib compression method and flags */ /* Optimize the CMF field in the zlib stream. This hack of the zlib @@ -651,10 +676,8 @@ png_write_IHDR(png_structp png_ptr, png_uint_32 width, png_uint_32 height, int bit_depth, int color_type, int compression_type, int filter_type, int interlace_type) { - PNG_IHDR; - png_byte buf[13]; /* Buffer to store the IHDR info */ png_debug(1, "in png_write_IHDR"); @@ -794,9 +817,9 @@ buf[11] = (png_byte)filter_type; buf[12] = (png_byte)interlace_type; /* Write the chunk */ - png_write_chunk(png_ptr, png_IHDR, buf, (png_size_t)13); + png_write_complete_chunk(png_ptr, png_IHDR, buf, (png_size_t)13); /* Initialize zlib with PNG info */ png_ptr->zstream.zalloc = png_zalloc; png_ptr->zstream.zfree = png_zfree; @@ -871,9 +894,8 @@ void /* PRIVATE */ png_write_PLTE(png_structp png_ptr, png_const_colorp palette, png_uint_32 num_pal) { - PNG_PLTE; png_uint_32 i; png_const_colorp pal_ptr; png_byte buf[3]; @@ -907,9 +929,9 @@ png_ptr->num_palette = (png_uint_16)num_pal; png_debug1(3, "num_palette = %d", png_ptr->num_palette); - png_write_chunk_start(png_ptr, png_PLTE, (png_uint_32)(num_pal * 3)); + png_write_chunk_header(png_ptr, png_PLTE, (png_uint_32)(num_pal * 3)); #ifdef PNG_POINTER_INDEXING_SUPPORTED for (i = 0, pal_ptr = palette; i < num_pal; i++, pal_ptr++) { @@ -941,10 +963,8 @@ /* Write an IDAT chunk */ void /* PRIVATE */ png_write_IDAT(png_structp png_ptr, png_bytep data, png_size_t length) { - PNG_IDAT; - png_debug(1, "in png_write_IDAT"); #ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED if (!(png_ptr->mode & PNG_HAVE_IDAT) && @@ -1013,9 +1033,9 @@ "Invalid zlib compression method or flags in IDAT"); } #endif /* PNG_WRITE_OPTIMIZE_CMF_SUPPORTED */ - png_write_chunk(png_ptr, png_IDAT, data, length); + png_write_complete_chunk(png_ptr, png_IDAT, data, length); png_ptr->mode |= PNG_HAVE_IDAT; /* Prior to 1.5.4 this code was replicated in every caller (except at the * end, where it isn't technically necessary). Since this function has @@ -1028,38 +1048,34 @@ /* Write an IEND chunk */ void /* PRIVATE */ png_write_IEND(png_structp png_ptr) { - PNG_IEND; - png_debug(1, "in png_write_IEND"); - png_write_chunk(png_ptr, png_IEND, NULL, (png_size_t)0); + png_write_complete_chunk(png_ptr, png_IEND, NULL, (png_size_t)0); png_ptr->mode |= PNG_HAVE_IEND; } #ifdef PNG_WRITE_gAMA_SUPPORTED /* Write a gAMA chunk */ void /* PRIVATE */ png_write_gAMA_fixed(png_structp png_ptr, png_fixed_point file_gamma) { - PNG_gAMA; png_byte buf[4]; png_debug(1, "in png_write_gAMA"); /* file_gamma is saved in 1/100,000ths */ png_save_uint_32(buf, (png_uint_32)file_gamma); - png_write_chunk(png_ptr, png_gAMA, buf, (png_size_t)4); + png_write_complete_chunk(png_ptr, png_gAMA, buf, (png_size_t)4); } #endif #ifdef PNG_WRITE_sRGB_SUPPORTED /* Write a sRGB chunk */ void /* PRIVATE */ png_write_sRGB(png_structp png_ptr, int srgb_intent) { - PNG_sRGB; png_byte buf[1]; png_debug(1, "in png_write_sRGB"); @@ -1067,9 +1083,9 @@ png_warning(png_ptr, "Invalid sRGB rendering intent specified"); buf[0]=(png_byte)srgb_intent; - png_write_chunk(png_ptr, png_sRGB, buf, (png_size_t)1); + png_write_complete_chunk(png_ptr, png_sRGB, buf, (png_size_t)1); } #endif #ifdef PNG_WRITE_iCCP_SUPPORTED @@ -1077,9 +1093,8 @@ void /* PRIVATE */ png_write_iCCP(png_structp png_ptr, png_const_charp name, int compression_type, png_const_charp profile, int profile_len) { - PNG_iCCP; png_size_t name_len; png_charp new_name; compression_state comp; int embedded_profile_len = 0; @@ -1138,9 +1153,9 @@ profile_len = png_text_compress(png_ptr, profile, (png_size_t)profile_len, PNG_COMPRESSION_TYPE_BASE, &comp); /* Make sure we include the NULL after the name and the compression type */ - png_write_chunk_start(png_ptr, png_iCCP, + png_write_chunk_header(png_ptr, png_iCCP, (png_uint_32)(name_len + profile_len + 2)); new_name[name_len + 1] = 0x00; @@ -1162,9 +1177,8 @@ /* Write a sPLT chunk */ void /* PRIVATE */ png_write_sPLT(png_structp png_ptr, png_const_sPLT_tp spalette) { - PNG_sPLT; png_size_t name_len; png_charp new_name; png_byte entrybuf[10]; png_size_t entry_size = (spalette->depth == 8 ? 6 : 10); @@ -1179,9 +1193,9 @@ if ((name_len = png_check_keyword(png_ptr,spalette->name, &new_name))==0) return; /* Make sure we include the NULL after the name */ - png_write_chunk_start(png_ptr, png_sPLT, + png_write_chunk_header(png_ptr, png_sPLT, (png_uint_32)(name_len + 2 + palette_size)); png_write_chunk_data(png_ptr, (png_bytep)new_name, (png_size_t)(name_len + 1)); @@ -1247,9 +1261,8 @@ /* Write the sBIT chunk */ void /* PRIVATE */ png_write_sBIT(png_structp png_ptr, png_const_color_8p sbit, int color_type) { - PNG_sBIT; png_byte buf[4]; png_size_t size; png_debug(1, "in png_write_sBIT"); @@ -1298,9 +1311,9 @@ buf[size++] = sbit->alpha; } - png_write_chunk(png_ptr, png_sBIT, buf, size); + png_write_complete_chunk(png_ptr, png_sBIT, buf, size); } #endif #ifdef PNG_WRITE_cHRM_SUPPORTED @@ -1310,9 +1323,8 @@ png_fixed_point white_y, png_fixed_point red_x, png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y, png_fixed_point blue_x, png_fixed_point blue_y) { - PNG_cHRM; png_byte buf[32]; png_debug(1, "in png_write_cHRM"); @@ -1333,9 +1345,9 @@ png_save_uint_32(buf + 24, (png_uint_32)blue_x); png_save_uint_32(buf + 28, (png_uint_32)blue_y); - png_write_chunk(png_ptr, png_cHRM, buf, (png_size_t)32); + png_write_complete_chunk(png_ptr, png_cHRM, buf, (png_size_t)32); } } #endif @@ -1344,9 +1356,8 @@ void /* PRIVATE */ png_write_tRNS(png_structp png_ptr, png_const_bytep trans_alpha, png_const_color_16p tran, int num_trans, int color_type) { - PNG_tRNS; png_byte buf[6]; png_debug(1, "in png_write_tRNS"); @@ -1358,9 +1369,9 @@ return; } /* Write the chunk out as it is */ - png_write_chunk(png_ptr, png_tRNS, trans_alpha, (png_size_t)num_trans); + png_write_complete_chunk(png_ptr, png_tRNS, trans_alpha, (png_size_t)num_trans); } else if (color_type == PNG_COLOR_TYPE_GRAY) { @@ -1373,9 +1384,9 @@ return; } png_save_uint_16(buf, tran->gray); - png_write_chunk(png_ptr, png_tRNS, buf, (png_size_t)2); + png_write_complete_chunk(png_ptr, png_tRNS, buf, (png_size_t)2); } else if (color_type == PNG_COLOR_TYPE_RGB) { @@ -1393,9 +1404,9 @@ "Ignoring attempt to write 16-bit tRNS chunk when bit_depth is 8"); return; } - png_write_chunk(png_ptr, png_tRNS, buf, (png_size_t)6); + png_write_complete_chunk(png_ptr, png_tRNS, buf, (png_size_t)6); } else { @@ -1408,9 +1419,8 @@ /* Write the background chunk */ void /* PRIVATE */ png_write_bKGD(png_structp png_ptr, png_const_color_16p back, int color_type) { - PNG_bKGD; png_byte buf[6]; png_debug(1, "in png_write_bKGD"); @@ -1427,9 +1437,9 @@ return; } buf[0] = back->index; - png_write_chunk(png_ptr, png_bKGD, buf, (png_size_t)1); + png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)1); } else if (color_type & PNG_COLOR_MASK_COLOR) { @@ -1447,9 +1457,9 @@ return; } - png_write_chunk(png_ptr, png_bKGD, buf, (png_size_t)6); + png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)6); } else { @@ -1461,9 +1471,9 @@ return; } png_save_uint_16(buf, back->gray); - png_write_chunk(png_ptr, png_bKGD, buf, (png_size_t)2); + png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)2); } } #endif @@ -1471,9 +1481,8 @@ /* Write the histogram */ void /* PRIVATE */ png_write_hIST(png_structp png_ptr, png_const_uint_16p hist, int num_hist) { - PNG_hIST; int i; png_byte buf[3]; png_debug(1, "in png_write_hIST"); @@ -1486,9 +1495,9 @@ png_warning(png_ptr, "Invalid number of histogram entries specified"); return; } - png_write_chunk_start(png_ptr, png_hIST, (png_uint_32)(num_hist * 2)); + png_write_chunk_header(png_ptr, png_hIST, (png_uint_32)(num_hist * 2)); for (i = 0; i < num_hist; i++) { png_save_uint_16(buf, hist[i]); @@ -1636,9 +1645,8 @@ void /* PRIVATE */ png_write_tEXt(png_structp png_ptr, png_const_charp key, png_const_charp text, png_size_t text_len) { - PNG_tEXt; png_size_t key_len; png_charp new_key; png_debug(1, "in png_write_tEXt"); @@ -1652,9 +1660,9 @@ else text_len = png_strlen(text); /* Make sure we include the 0 after the key */ - png_write_chunk_start(png_ptr, png_tEXt, + png_write_chunk_header(png_ptr, png_tEXt, (png_uint_32)(key_len + text_len + 1)); /* * We leave it to the application to meet PNG-1.0 requirements on the * contents of the text. PNG-1.0 through PNG-1.2 discourage the use of @@ -1678,9 +1686,8 @@ void /* PRIVATE */ png_write_zTXt(png_structp png_ptr, png_const_charp key, png_const_charp text, png_size_t text_len, int compression) { - PNG_zTXt; png_size_t key_len; png_byte buf; png_charp new_key; compression_state comp; @@ -1712,9 +1719,9 @@ text_len = png_text_compress(png_ptr, text, text_len, compression, &comp); /* Write start of chunk */ - png_write_chunk_start(png_ptr, png_zTXt, + png_write_chunk_header(png_ptr, png_zTXt, (png_uint_32)(key_len+text_len + 2)); /* Write key */ png_write_chunk_data(png_ptr, (png_bytep)new_key, @@ -1741,9 +1748,8 @@ void /* PRIVATE */ png_write_iTXt(png_structp png_ptr, int compression, png_const_charp key, png_const_charp lang, png_const_charp lang_key, png_const_charp text) { - PNG_iTXt; png_size_t lang_len, key_len, lang_key_len, text_len; png_charp new_lang; png_charp new_key = NULL; png_byte cbuf[2]; @@ -1786,9 +1792,9 @@ /* Make sure we include the compression flag, the compression byte, * and the NULs after the key, lang, and lang_key parts */ - png_write_chunk_start(png_ptr, png_iTXt, (png_uint_32)( + png_write_chunk_header(png_ptr, png_iTXt, (png_uint_32)( 5 /* comp byte, comp flag, terminators for key, lang and lang_key */ + key_len + lang_len + lang_key_len @@ -1835,9 +1841,8 @@ void /* PRIVATE */ png_write_oFFs(png_structp png_ptr, png_int_32 x_offset, png_int_32 y_offset, int unit_type) { - PNG_oFFs; png_byte buf[9]; png_debug(1, "in png_write_oFFs"); @@ -1847,9 +1852,9 @@ png_save_int_32(buf, x_offset); png_save_int_32(buf + 4, y_offset); buf[8] = (png_byte)unit_type; - png_write_chunk(png_ptr, png_oFFs, buf, (png_size_t)9); + png_write_complete_chunk(png_ptr, png_oFFs, buf, (png_size_t)9); } #endif #ifdef PNG_WRITE_pCAL_SUPPORTED /* Write the pCAL chunk (described in the PNG extensions document) */ @@ -1857,9 +1862,8 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0, png_int_32 X1, int type, int nparams, png_const_charp units, png_charpp params) { - PNG_pCAL; png_size_t purpose_len, units_len, total_len; png_size_tp params_len; png_byte buf[10]; png_charp new_purpose; @@ -1890,9 +1894,9 @@ total_len += params_len[i]; } png_debug1(3, "pCAL total length = %d", (int)total_len); - png_write_chunk_start(png_ptr, png_pCAL, (png_uint_32)total_len); + png_write_chunk_header(png_ptr, png_pCAL, (png_uint_32)total_len); png_write_chunk_data(png_ptr, (png_const_bytep)new_purpose, purpose_len); png_save_int_32(buf, X0); png_save_int_32(buf + 4, X1); buf[8] = (png_byte)type; @@ -1917,9 +1921,8 @@ void /* PRIVATE */ png_write_sCAL_s(png_structp png_ptr, int unit, png_const_charp width, png_const_charp height) { - PNG_sCAL; png_byte buf[64]; png_size_t wlen, hlen, total_len; png_debug(1, "in png_write_sCAL_s"); @@ -1938,9 +1941,9 @@ png_memcpy(buf + 1, width, wlen + 1); /* Append the '\0' here */ png_memcpy(buf + wlen + 2, height, hlen); /* Do NOT append the '\0' here */ png_debug1(3, "sCAL total length = %u", (unsigned int)total_len); - png_write_chunk(png_ptr, png_sCAL, buf, total_len); + png_write_complete_chunk(png_ptr, png_sCAL, buf, total_len); } #endif #ifdef PNG_WRITE_pHYs_SUPPORTED @@ -1949,9 +1952,8 @@ png_write_pHYs(png_structp png_ptr, png_uint_32 x_pixels_per_unit, png_uint_32 y_pixels_per_unit, int unit_type) { - PNG_pHYs; png_byte buf[9]; png_debug(1, "in png_write_pHYs"); @@ -1961,9 +1963,9 @@ png_save_uint_32(buf, x_pixels_per_unit); png_save_uint_32(buf + 4, y_pixels_per_unit); buf[8] = (png_byte)unit_type; - png_write_chunk(png_ptr, png_pHYs, buf, (png_size_t)9); + png_write_complete_chunk(png_ptr, png_pHYs, buf, (png_size_t)9); } #endif #ifdef PNG_WRITE_tIME_SUPPORTED @@ -1972,9 +1974,8 @@ */ void /* PRIVATE */ png_write_tIME(png_structp png_ptr, png_const_timep mod_time) { - PNG_tIME; png_byte buf[7]; png_debug(1, "in png_write_tIME"); @@ -1992,9 +1993,9 @@ buf[4] = mod_time->hour; buf[5] = mod_time->minute; buf[6] = mod_time->second; - png_write_chunk(png_ptr, png_tIME, buf, (png_size_t)7); + png_write_complete_chunk(png_ptr, png_tIME, buf, (png_size_t)7); } #endif /* Initializes the row writing capability of libpng */ @@ -2004,30 +2005,34 @@ #ifdef PNG_WRITE_INTERLACING_SUPPORTED /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ /* Start of interlace block */ - int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; + static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; /* Offset to next interlace block */ - int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; + static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; /* Start of interlace block in the y direction */ - int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; + static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; /* Offset to next interlace block in the y direction */ - int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; + static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; #endif - png_size_t buf_size; + png_alloc_size_t buf_size; + int usr_pixel_depth; png_debug(1, "in png_write_start_row"); - buf_size = (png_size_t)(PNG_ROWBYTES( - png_ptr->usr_channels*png_ptr->usr_bit_depth, png_ptr->width) + 1); + usr_pixel_depth = png_ptr->usr_channels * png_ptr->usr_bit_depth; + buf_size = PNG_ROWBYTES(usr_pixel_depth, png_ptr->width) + 1; + + /* 1.5.6: added to allow checking in the row write code. */ + png_ptr->transformed_pixel_depth = png_ptr->pixel_depth; + png_ptr->maximum_pixel_depth = (png_byte)usr_pixel_depth; /* Set up row buffer */ - png_ptr->row_buf = (png_bytep)png_malloc(png_ptr, - (png_alloc_size_t)buf_size); + png_ptr->row_buf = (png_bytep)png_malloc(png_ptr, buf_size); png_ptr->row_buf[0] = PNG_FILTER_VALUE_NONE; #ifdef PNG_WRITE_FILTER_SUPPORTED @@ -2042,10 +2047,9 @@ /* We only need to keep the previous row if we are using one of these. */ if (png_ptr->do_filter & (PNG_FILTER_AVG | PNG_FILTER_UP | PNG_FILTER_PAETH)) { /* Set up previous row buffer */ - png_ptr->prev_row = (png_bytep)png_calloc(png_ptr, - (png_alloc_size_t)buf_size); + png_ptr->prev_row = (png_bytep)png_calloc(png_ptr, buf_size); if (png_ptr->do_filter & PNG_FILTER_UP) { png_ptr->up_row = (png_bytep)png_malloc(png_ptr, @@ -2111,18 +2115,18 @@ #ifdef PNG_WRITE_INTERLACING_SUPPORTED /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ /* Start of interlace block */ - int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; + static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; /* Offset to next interlace block */ - int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; + static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; /* Start of interlace block in the y direction */ - int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; + static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1}; /* Offset to next interlace block in the y direction */ - int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; + static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2}; #endif int ret; @@ -2238,12 +2242,12 @@ { /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */ /* Start of interlace block */ - int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; + static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0}; /* Offset to next interlace block */ - int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; + static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1}; png_debug(1, "in png_do_write_interlace"); /* We don't have to do anything on the last pass (6) */ @@ -2409,9 +2413,10 @@ /* This filters the row, chooses which filter to use, if it has not already * been specified by the application, and then writes the row out with the * chosen filter. */ -static void png_write_filtered_row(png_structp png_ptr, png_bytep filtered_row); +static void png_write_filtered_row(png_structp png_ptr, png_bytep filtered_row, + png_size_t row_bytes); #define PNG_MAXSUM (((png_uint_32)(-1)) >> 1) #define PNG_HISHIFT 10 #define PNG_LOMASK ((png_uint_32)0xffffL) @@ -2425,9 +2430,9 @@ png_uint_32 mins, bpp; png_byte filter_to_do = png_ptr->do_filter; png_size_t row_bytes = row_info->rowbytes; #ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED - int num_p_filters = (int)png_ptr->num_prev_filters; + int num_p_filters = png_ptr->num_prev_filters; #endif png_debug(1, "in png_write_find_filter"); @@ -3062,11 +3067,11 @@ best_row = png_ptr->paeth_row; } } #endif /* PNG_WRITE_FILTER_SUPPORTED */ - /* Do the actual writing of the filtered row data from the chosen filter. */ - png_write_filtered_row(png_ptr, best_row); + /* Do the actual writing of the filtered row data from the chosen filter. */ + png_write_filtered_row(png_ptr, best_row, row_info->rowbytes+1); #ifdef PNG_WRITE_FILTER_SUPPORTED #ifdef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED /* Save the type of filter we picked this time for future calculations */ @@ -3087,20 +3092,18 @@ /* Do the actual writing of a previously filtered row. */ static void -png_write_filtered_row(png_structp png_ptr, png_bytep filtered_row) +png_write_filtered_row(png_structp png_ptr, png_bytep filtered_row, + png_size_t avail/*includes filter byte*/) { - png_size_t avail; - png_debug(1, "in png_write_filtered_row"); png_debug1(2, "filter = %d", filtered_row[0]); /* Set up the zlib input buffer */ png_ptr->zstream.next_in = filtered_row; png_ptr->zstream.avail_in = 0; - avail = png_ptr->row_info.rowbytes + 1; /* Repeat until we have compressed all the data */ do { int ret; /* Return of zlib */