blob: 36701f627e31380b84d46b5f10bced6be8e151b1 [file] [log] [blame]
lh9ed821d2023-04-07 01:36:19 -07001
2/* pngpread.c - read a png file in push mode
3 *
4 * libpng 1.2.5 - October 3, 2002
5 * For conditions of distribution and use, see copyright notice in png.h
6 * Copyright (c) 1998-2002 Glenn Randers-Pehrson
7 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
8 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
9 */
10
11#define PNG_INTERNAL
12#include "png.h"
13
14#ifdef PNG_PROGRESSIVE_READ_SUPPORTED
15
16/* push model modes */
17#define PNG_READ_SIG_MODE 0
18#define PNG_READ_CHUNK_MODE 1
19#define PNG_READ_IDAT_MODE 2
20#define PNG_SKIP_MODE 3
21#define PNG_READ_tEXt_MODE 4
22#define PNG_READ_zTXt_MODE 5
23#define PNG_READ_DONE_MODE 6
24#define PNG_READ_iTXt_MODE 7
25#define PNG_ERROR_MODE 8
26
27void PNGAPI
28png_process_data(png_structp png_ptr, png_infop info_ptr,
29 png_bytep buffer, png_size_t buffer_size)
30{
31 png_push_restore_buffer(png_ptr, buffer, buffer_size);
32
33 while (png_ptr->buffer_size)
34 {
35 png_process_some_data(png_ptr, info_ptr);
36 }
37}
38
39/* What we do with the incoming data depends on what we were previously
40 * doing before we ran out of data...
41 */
42void /* PRIVATE */
43png_process_some_data(png_structp png_ptr, png_infop info_ptr)
44{
45 switch (png_ptr->process_mode)
46 {
47 case PNG_READ_SIG_MODE:
48 {
49 png_push_read_sig(png_ptr, info_ptr);
50 break;
51 }
52 case PNG_READ_CHUNK_MODE:
53 {
54 png_push_read_chunk(png_ptr, info_ptr);
55 break;
56 }
57 case PNG_READ_IDAT_MODE:
58 {
59 png_push_read_IDAT(png_ptr);
60 break;
61 }
62#if defined(PNG_READ_tEXt_SUPPORTED)
63 case PNG_READ_tEXt_MODE:
64 {
65 png_push_read_tEXt(png_ptr, info_ptr);
66 break;
67 }
68#endif
69#if defined(PNG_READ_zTXt_SUPPORTED)
70 case PNG_READ_zTXt_MODE:
71 {
72 png_push_read_zTXt(png_ptr, info_ptr);
73 break;
74 }
75#endif
76#if defined(PNG_READ_iTXt_SUPPORTED)
77 case PNG_READ_iTXt_MODE:
78 {
79 png_push_read_iTXt(png_ptr, info_ptr);
80 break;
81 }
82#endif
83 case PNG_SKIP_MODE:
84 {
85 png_push_crc_finish(png_ptr);
86 break;
87 }
88 default:
89 {
90 png_ptr->buffer_size = 0;
91 break;
92 }
93 }
94}
95
96/* Read any remaining signature bytes from the stream and compare them with
97 * the correct PNG signature. It is possible that this routine is called
98 * with bytes already read from the signature, either because they have been
99 * checked by the calling application, or because of multiple calls to this
100 * routine.
101 */
102void /* PRIVATE */
103png_push_read_sig(png_structp png_ptr, png_infop info_ptr)
104{
105 png_size_t num_checked = png_ptr->sig_bytes,
106 num_to_check = 8 - num_checked;
107
108 if (png_ptr->buffer_size < num_to_check)
109 {
110 num_to_check = png_ptr->buffer_size;
111 }
112
113 png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]),
114 num_to_check);
115 png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes+num_to_check);
116
117 if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))
118 {
119 if (num_checked < 4 &&
120 png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4))
121 png_error(png_ptr, "Not a PNG file");
122 else
123 png_error(png_ptr, "PNG file corrupted by ASCII conversion");
124 }
125 else
126 {
127 if (png_ptr->sig_bytes >= 8)
128 {
129 png_ptr->process_mode = PNG_READ_CHUNK_MODE;
130 }
131 }
132}
133
134void /* PRIVATE */
135png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
136{
137#ifdef PNG_USE_LOCAL_ARRAYS
138 PNG_IHDR;
139 PNG_IDAT;
140 PNG_IEND;
141 PNG_PLTE;
142#if defined(PNG_READ_bKGD_SUPPORTED)
143 PNG_bKGD;
144#endif
145#if defined(PNG_READ_cHRM_SUPPORTED)
146 PNG_cHRM;
147#endif
148#if defined(PNG_READ_gAMA_SUPPORTED)
149 PNG_gAMA;
150#endif
151#if defined(PNG_READ_hIST_SUPPORTED)
152 PNG_hIST;
153#endif
154#if defined(PNG_READ_iCCP_SUPPORTED)
155 PNG_iCCP;
156#endif
157#if defined(PNG_READ_iTXt_SUPPORTED)
158 PNG_iTXt;
159#endif
160#if defined(PNG_READ_oFFs_SUPPORTED)
161 PNG_oFFs;
162#endif
163#if defined(PNG_READ_pCAL_SUPPORTED)
164 PNG_pCAL;
165#endif
166#if defined(PNG_READ_pHYs_SUPPORTED)
167 PNG_pHYs;
168#endif
169#if defined(PNG_READ_sBIT_SUPPORTED)
170 PNG_sBIT;
171#endif
172#if defined(PNG_READ_sCAL_SUPPORTED)
173 PNG_sCAL;
174#endif
175#if defined(PNG_READ_sRGB_SUPPORTED)
176 PNG_sRGB;
177#endif
178#if defined(PNG_READ_sPLT_SUPPORTED)
179 PNG_sPLT;
180#endif
181#if defined(PNG_READ_tEXt_SUPPORTED)
182 PNG_tEXt;
183#endif
184#if defined(PNG_READ_tIME_SUPPORTED)
185 PNG_tIME;
186#endif
187#if defined(PNG_READ_tRNS_SUPPORTED)
188 PNG_tRNS;
189#endif
190#if defined(PNG_READ_zTXt_SUPPORTED)
191 PNG_zTXt;
192#endif
193#endif /* PNG_USE_LOCAL_ARRAYS */
194 /* First we make sure we have enough data for the 4 byte chunk name
195 * and the 4 byte chunk length before proceeding with decoding the
196 * chunk data. To fully decode each of these chunks, we also make
197 * sure we have enough data in the buffer for the 4 byte CRC at the
198 * end of every chunk (except IDAT, which is handled separately).
199 */
200 if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER))
201 {
202 png_byte chunk_length[4];
203
204 if (png_ptr->buffer_size < 8)
205 {
206 png_push_save_buffer(png_ptr);
207 return;
208 }
209
210 png_push_fill_buffer(png_ptr, chunk_length, 4);
211 png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length);
212 png_reset_crc(png_ptr);
213 png_crc_read(png_ptr, png_ptr->chunk_name, 4);
214 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
215 }
216
217 if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
218 {
219 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
220 {
221 png_push_save_buffer(png_ptr);
222 return;
223 }
224 png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length);
225 }
226 else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
227 {
228 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
229 {
230 png_push_save_buffer(png_ptr);
231 return;
232 }
233 png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length);
234 }
235 else if (!png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))
236 {
237 /* If we reach an IDAT chunk, this means we have read all of the
238 * header chunks, and we can start reading the image (or if this
239 * is called after the image has been read - we have an error).
240 */
241 if (!(png_ptr->mode & PNG_HAVE_IHDR))
242 png_error(png_ptr, "Missing IHDR before IDAT");
243 else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
244 !(png_ptr->mode & PNG_HAVE_PLTE))
245 png_error(png_ptr, "Missing PLTE before IDAT");
246
247 if (png_ptr->mode & PNG_HAVE_IDAT)
248 {
249 if (png_ptr->push_length == 0)
250 return;
251
252 if (png_ptr->mode & PNG_AFTER_IDAT)
253 png_error(png_ptr, "Too many IDAT's found");
254 }
255
256 png_ptr->idat_size = png_ptr->push_length;
257 png_ptr->mode |= PNG_HAVE_IDAT;
258 png_ptr->process_mode = PNG_READ_IDAT_MODE;
259 png_push_have_info(png_ptr, info_ptr);
260 png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
261 png_ptr->zstream.next_out = png_ptr->row_buf;
262 return;
263 }
264 else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
265 {
266 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
267 {
268 png_push_save_buffer(png_ptr);
269 return;
270 }
271 png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length);
272
273 png_ptr->process_mode = PNG_READ_DONE_MODE;
274 png_push_have_end(png_ptr, info_ptr);
275 }
276#if defined(PNG_READ_gAMA_SUPPORTED)
277 else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4))
278 {
279 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
280 {
281 png_push_save_buffer(png_ptr);
282 return;
283 }
284 png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length);
285 }
286#endif
287#if defined(PNG_READ_sBIT_SUPPORTED)
288 else if (!png_memcmp(png_ptr->chunk_name, png_sBIT, 4))
289 {
290 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
291 {
292 png_push_save_buffer(png_ptr);
293 return;
294 }
295 png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length);
296 }
297#endif
298#if defined(PNG_READ_cHRM_SUPPORTED)
299 else if (!png_memcmp(png_ptr->chunk_name, png_cHRM, 4))
300 {
301 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
302 {
303 png_push_save_buffer(png_ptr);
304 return;
305 }
306 png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length);
307 }
308#endif
309#if defined(PNG_READ_sRGB_SUPPORTED)
310 else if (!png_memcmp(png_ptr->chunk_name, png_sRGB, 4))
311 {
312 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
313 {
314 png_push_save_buffer(png_ptr);
315 return;
316 }
317 png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length);
318 }
319#endif
320#if defined(PNG_READ_iCCP_SUPPORTED)
321 else if (!png_memcmp(png_ptr->chunk_name, png_iCCP, 4))
322 {
323 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
324 {
325 png_push_save_buffer(png_ptr);
326 return;
327 }
328 png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length);
329 }
330#endif
331#if defined(PNG_READ_sPLT_SUPPORTED)
332 else if (!png_memcmp(png_ptr->chunk_name, png_sPLT, 4))
333 {
334 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
335 {
336 png_push_save_buffer(png_ptr);
337 return;
338 }
339 png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length);
340 }
341#endif
342#if defined(PNG_READ_tRNS_SUPPORTED)
343 else if (!png_memcmp(png_ptr->chunk_name, png_tRNS, 4))
344 {
345 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
346 {
347 png_push_save_buffer(png_ptr);
348 return;
349 }
350 png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length);
351 }
352#endif
353#if defined(PNG_READ_bKGD_SUPPORTED)
354 else if (!png_memcmp(png_ptr->chunk_name, png_bKGD, 4))
355 {
356 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
357 {
358 png_push_save_buffer(png_ptr);
359 return;
360 }
361 png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length);
362 }
363#endif
364#if defined(PNG_READ_hIST_SUPPORTED)
365 else if (!png_memcmp(png_ptr->chunk_name, png_hIST, 4))
366 {
367 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
368 {
369 png_push_save_buffer(png_ptr);
370 return;
371 }
372 png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length);
373 }
374#endif
375#if defined(PNG_READ_pHYs_SUPPORTED)
376 else if (!png_memcmp(png_ptr->chunk_name, png_pHYs, 4))
377 {
378 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
379 {
380 png_push_save_buffer(png_ptr);
381 return;
382 }
383 png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length);
384 }
385#endif
386#if defined(PNG_READ_oFFs_SUPPORTED)
387 else if (!png_memcmp(png_ptr->chunk_name, png_oFFs, 4))
388 {
389 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
390 {
391 png_push_save_buffer(png_ptr);
392 return;
393 }
394 png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length);
395 }
396#endif
397#if defined(PNG_READ_pCAL_SUPPORTED)
398 else if (!png_memcmp(png_ptr->chunk_name, png_pCAL, 4))
399 {
400 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
401 {
402 png_push_save_buffer(png_ptr);
403 return;
404 }
405 png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length);
406 }
407#endif
408#if defined(PNG_READ_sCAL_SUPPORTED)
409 else if (!png_memcmp(png_ptr->chunk_name, png_sCAL, 4))
410 {
411 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
412 {
413 png_push_save_buffer(png_ptr);
414 return;
415 }
416 png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length);
417 }
418#endif
419#if defined(PNG_READ_tIME_SUPPORTED)
420 else if (!png_memcmp(png_ptr->chunk_name, png_tIME, 4))
421 {
422 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
423 {
424 png_push_save_buffer(png_ptr);
425 return;
426 }
427 png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length);
428 }
429#endif
430#if defined(PNG_READ_tEXt_SUPPORTED)
431 else if (!png_memcmp(png_ptr->chunk_name, png_tEXt, 4))
432 {
433 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
434 {
435 png_push_save_buffer(png_ptr);
436 return;
437 }
438 png_push_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
439 }
440#endif
441#if defined(PNG_READ_zTXt_SUPPORTED)
442 else if (!png_memcmp(png_ptr->chunk_name, png_zTXt, 4))
443 {
444 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
445 {
446 png_push_save_buffer(png_ptr);
447 return;
448 }
449 png_push_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
450 }
451#endif
452#if defined(PNG_READ_iTXt_SUPPORTED)
453 else if (!png_memcmp(png_ptr->chunk_name, png_iTXt, 4))
454 {
455 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
456 {
457 png_push_save_buffer(png_ptr);
458 return;
459 }
460 png_push_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
461 }
462#endif
463 else
464 {
465 if (png_ptr->push_length + 4 > png_ptr->buffer_size)
466 {
467 png_push_save_buffer(png_ptr);
468 return;
469 }
470 png_push_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
471 }
472
473 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
474}
475
476void /* PRIVATE */
477png_push_crc_skip(png_structp png_ptr, png_uint_32 skip)
478{
479 png_ptr->process_mode = PNG_SKIP_MODE;
480 png_ptr->skip_length = skip;
481}
482
483void /* PRIVATE */
484png_push_crc_finish(png_structp png_ptr)
485{
486 if (png_ptr->skip_length && png_ptr->save_buffer_size)
487 {
488 png_size_t save_size;
489
490 if (png_ptr->skip_length < (png_uint_32)png_ptr->save_buffer_size)
491 save_size = (png_size_t)png_ptr->skip_length;
492 else
493 save_size = png_ptr->save_buffer_size;
494
495 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
496
497 png_ptr->skip_length -= save_size;
498 png_ptr->buffer_size -= save_size;
499 png_ptr->save_buffer_size -= save_size;
500 png_ptr->save_buffer_ptr += save_size;
501 }
502 if (png_ptr->skip_length && png_ptr->current_buffer_size)
503 {
504 png_size_t save_size;
505
506 if (png_ptr->skip_length < (png_uint_32)png_ptr->current_buffer_size)
507 save_size = (png_size_t)png_ptr->skip_length;
508 else
509 save_size = png_ptr->current_buffer_size;
510
511 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
512
513 png_ptr->skip_length -= save_size;
514 png_ptr->buffer_size -= save_size;
515 png_ptr->current_buffer_size -= save_size;
516 png_ptr->current_buffer_ptr += save_size;
517 }
518 if (!png_ptr->skip_length)
519 {
520 if (png_ptr->buffer_size < 4)
521 {
522 png_push_save_buffer(png_ptr);
523 return;
524 }
525
526 png_crc_finish(png_ptr, 0);
527 png_ptr->process_mode = PNG_READ_CHUNK_MODE;
528 }
529}
530
531void PNGAPI
532png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
533{
534 png_bytep ptr;
535
536 ptr = buffer;
537 if (png_ptr->save_buffer_size)
538 {
539 png_size_t save_size;
540
541 if (length < png_ptr->save_buffer_size)
542 save_size = length;
543 else
544 save_size = png_ptr->save_buffer_size;
545
546 png_memcpy(ptr, png_ptr->save_buffer_ptr, save_size);
547 length -= save_size;
548 ptr += save_size;
549 png_ptr->buffer_size -= save_size;
550 png_ptr->save_buffer_size -= save_size;
551 png_ptr->save_buffer_ptr += save_size;
552 }
553 if (length && png_ptr->current_buffer_size)
554 {
555 png_size_t save_size;
556
557 if (length < png_ptr->current_buffer_size)
558 save_size = length;
559 else
560 save_size = png_ptr->current_buffer_size;
561
562 png_memcpy(ptr, png_ptr->current_buffer_ptr, save_size);
563 png_ptr->buffer_size -= save_size;
564 png_ptr->current_buffer_size -= save_size;
565 png_ptr->current_buffer_ptr += save_size;
566 }
567}
568
569void /* PRIVATE */
570png_push_save_buffer(png_structp png_ptr)
571{
572 if (png_ptr->save_buffer_size)
573 {
574 if (png_ptr->save_buffer_ptr != png_ptr->save_buffer)
575 {
576 png_size_t i,istop;
577 png_bytep sp;
578 png_bytep dp;
579
580 istop = png_ptr->save_buffer_size;
581 for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer;
582 i < istop; i++, sp++, dp++)
583 {
584 *dp = *sp;
585 }
586 }
587 }
588 if (png_ptr->save_buffer_size + png_ptr->current_buffer_size >
589 png_ptr->save_buffer_max)
590 {
591 png_size_t new_max;
592 png_bytep old_buffer;
593
594 if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
595 (png_ptr->current_buffer_size + 256))
596 {
597 png_error(png_ptr, "Potential overflow of save_buffer");
598 }
599 new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
600 old_buffer = png_ptr->save_buffer;
601 png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr,
602 (png_uint_32)new_max);
603 png_memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
604 png_free(png_ptr, old_buffer);
605 png_ptr->save_buffer_max = new_max;
606 }
607 if (png_ptr->current_buffer_size)
608 {
609 png_memcpy(png_ptr->save_buffer + png_ptr->save_buffer_size,
610 png_ptr->current_buffer_ptr, png_ptr->current_buffer_size);
611 png_ptr->save_buffer_size += png_ptr->current_buffer_size;
612 png_ptr->current_buffer_size = 0;
613 }
614 png_ptr->save_buffer_ptr = png_ptr->save_buffer;
615 png_ptr->buffer_size = 0;
616}
617
618void /* PRIVATE */
619png_push_restore_buffer(png_structp png_ptr, png_bytep buffer,
620 png_size_t buffer_length)
621{
622 png_ptr->current_buffer = buffer;
623 png_ptr->current_buffer_size = buffer_length;
624 png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size;
625 png_ptr->current_buffer_ptr = png_ptr->current_buffer;
626}
627
628void /* PRIVATE */
629png_push_read_IDAT(png_structp png_ptr)
630{
631#ifdef PNG_USE_LOCAL_ARRAYS
632 PNG_IDAT;
633#endif
634 if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER))
635 {
636 png_byte chunk_length[4];
637
638 if (png_ptr->buffer_size < 8)
639 {
640 png_push_save_buffer(png_ptr);
641 return;
642 }
643
644 png_push_fill_buffer(png_ptr, chunk_length, 4);
645 png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length);
646 png_reset_crc(png_ptr);
647 png_crc_read(png_ptr, png_ptr->chunk_name, 4);
648 png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
649
650 if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))
651 {
652 png_ptr->process_mode = PNG_READ_CHUNK_MODE;
653 if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
654 png_error(png_ptr, "Not enough compressed data");
655 return;
656 }
657
658 png_ptr->idat_size = png_ptr->push_length;
659 }
660 if (png_ptr->idat_size && png_ptr->save_buffer_size)
661 {
662 png_size_t save_size;
663
664 if (png_ptr->idat_size < (png_uint_32)png_ptr->save_buffer_size)
665 {
666 save_size = (png_size_t)png_ptr->idat_size;
667 /* check for overflow */
668 if((png_uint_32)save_size != png_ptr->idat_size)
669 png_error(png_ptr, "save_size overflowed in pngpread");
670 }
671 else
672 save_size = png_ptr->save_buffer_size;
673
674 png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
675 if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
676 png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size);
677 png_ptr->idat_size -= save_size;
678 png_ptr->buffer_size -= save_size;
679 png_ptr->save_buffer_size -= save_size;
680 png_ptr->save_buffer_ptr += save_size;
681 }
682 if (png_ptr->idat_size && png_ptr->current_buffer_size)
683 {
684 png_size_t save_size;
685
686 if (png_ptr->idat_size < (png_uint_32)png_ptr->current_buffer_size)
687 {
688 save_size = (png_size_t)png_ptr->idat_size;
689 /* check for overflow */
690 if((png_uint_32)save_size != png_ptr->idat_size)
691 png_error(png_ptr, "save_size overflowed in pngpread");
692 }
693 else
694 save_size = png_ptr->current_buffer_size;
695
696 png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
697 if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
698 png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
699
700 png_ptr->idat_size -= save_size;
701 png_ptr->buffer_size -= save_size;
702 png_ptr->current_buffer_size -= save_size;
703 png_ptr->current_buffer_ptr += save_size;
704 }
705 if (!png_ptr->idat_size)
706 {
707 if (png_ptr->buffer_size < 4)
708 {
709 png_push_save_buffer(png_ptr);
710 return;
711 }
712
713 png_crc_finish(png_ptr, 0);
714 png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
715 png_ptr->mode |= PNG_AFTER_IDAT;
716 }
717}
718
719void /* PRIVATE */
720png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
721 png_size_t buffer_length)
722{
723 int ret;
724
725 if ((png_ptr->flags & PNG_FLAG_ZLIB_FINISHED) && buffer_length)
726 png_error(png_ptr, "Extra compression data");
727
728 png_ptr->zstream.next_in = buffer;
729 png_ptr->zstream.avail_in = (uInt)buffer_length;
730 for(;;)
731 {
732 ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
733 if (ret != Z_OK)
734 {
735 if (ret == Z_STREAM_END)
736 {
737 if (png_ptr->zstream.avail_in)
738 png_error(png_ptr, "Extra compressed data");
739 if (!(png_ptr->zstream.avail_out))
740 {
741 png_push_process_row(png_ptr);
742 }
743
744 png_ptr->mode |= PNG_AFTER_IDAT;
745 png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
746 break;
747 }
748 else if (ret == Z_BUF_ERROR)
749 break;
750 else
751 png_error(png_ptr, "Decompression Error");
752 }
753 if (!(png_ptr->zstream.avail_out))
754 {
755 if ((
756#if defined(PNG_READ_INTERLACING_SUPPORTED)
757 png_ptr->interlaced && png_ptr->pass > 6) ||
758 (!png_ptr->interlaced &&
759#endif
760 png_ptr->row_number == png_ptr->num_rows-1))
761 {
762 if (png_ptr->zstream.avail_in)
763 png_warning(png_ptr, "Too much data in IDAT chunks");
764 png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
765 break;
766 }
767 png_push_process_row(png_ptr);
768 png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
769 png_ptr->zstream.next_out = png_ptr->row_buf;
770 }
771 else
772 break;
773 }
774}
775
776void /* PRIVATE */
777png_push_process_row(png_structp png_ptr)
778{
779 png_ptr->row_info.color_type = png_ptr->color_type;
780 png_ptr->row_info.width = png_ptr->iwidth;
781 png_ptr->row_info.channels = png_ptr->channels;
782 png_ptr->row_info.bit_depth = png_ptr->bit_depth;
783 png_ptr->row_info.pixel_depth = png_ptr->pixel_depth;
784
785 png_ptr->row_info.rowbytes = ((png_ptr->row_info.width *
786 (png_uint_32)png_ptr->row_info.pixel_depth + 7) >> 3);
787
788 png_read_filter_row(png_ptr, &(png_ptr->row_info),
789 png_ptr->row_buf + 1, png_ptr->prev_row + 1,
790 (int)(png_ptr->row_buf[0]));
791
792 png_memcpy_check(png_ptr, png_ptr->prev_row, png_ptr->row_buf,
793 png_ptr->rowbytes + 1);
794
795 if (png_ptr->transformations)
796 png_do_read_transformations(png_ptr);
797
798#if defined(PNG_READ_INTERLACING_SUPPORTED)
799 /* blow up interlaced rows to full size */
800 if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE))
801 {
802 if (png_ptr->pass < 6)
803/* old interface (pre-1.0.9):
804 png_do_read_interlace(&(png_ptr->row_info),
805 png_ptr->row_buf + 1, png_ptr->pass, png_ptr->transformations);
806 */
807 png_do_read_interlace(png_ptr);
808
809 switch (png_ptr->pass)
810 {
811 case 0:
812 {
813 int i;
814 for (i = 0; i < 8 && png_ptr->pass == 0; i++)
815 {
816 png_push_have_row(png_ptr, png_ptr->row_buf + 1);
817 png_read_push_finish_row(png_ptr); /* updates png_ptr->pass */
818 }
819 if (png_ptr->pass == 2) /* pass 1 might be empty */
820 {
821 for (i = 0; i < 4 && png_ptr->pass == 2; i++)
822 {
823 png_push_have_row(png_ptr, png_bytep_NULL);
824 png_read_push_finish_row(png_ptr);
825 }
826 }
827 if (png_ptr->pass == 4 && png_ptr->height <= 4)
828 {
829 for (i = 0; i < 2 && png_ptr->pass == 4; i++)
830 {
831 png_push_have_row(png_ptr, png_bytep_NULL);
832 png_read_push_finish_row(png_ptr);
833 }
834 }
835 if (png_ptr->pass == 6 && png_ptr->height <= 4)
836 {
837 png_push_have_row(png_ptr, png_bytep_NULL);
838 png_read_push_finish_row(png_ptr);
839 }
840 break;
841 }
842 case 1:
843 {
844 int i;
845 for (i = 0; i < 8 && png_ptr->pass == 1; i++)
846 {
847 png_push_have_row(png_ptr, png_ptr->row_buf + 1);
848 png_read_push_finish_row(png_ptr);
849 }
850 if (png_ptr->pass == 2) /* skip top 4 generated rows */
851 {
852 for (i = 0; i < 4 && png_ptr->pass == 2; i++)
853 {
854 png_push_have_row(png_ptr, png_bytep_NULL);
855 png_read_push_finish_row(png_ptr);
856 }
857 }
858 break;
859 }
860 case 2:
861 {
862 int i;
863 for (i = 0; i < 4 && png_ptr->pass == 2; i++)
864 {
865 png_push_have_row(png_ptr, png_ptr->row_buf + 1);
866 png_read_push_finish_row(png_ptr);
867 }
868 for (i = 0; i < 4 && png_ptr->pass == 2; i++)
869 {
870 png_push_have_row(png_ptr, png_bytep_NULL);
871 png_read_push_finish_row(png_ptr);
872 }
873 if (png_ptr->pass == 4) /* pass 3 might be empty */
874 {
875 for (i = 0; i < 2 && png_ptr->pass == 4; i++)
876 {
877 png_push_have_row(png_ptr, png_bytep_NULL);
878 png_read_push_finish_row(png_ptr);
879 }
880 }
881 break;
882 }
883 case 3:
884 {
885 int i;
886 for (i = 0; i < 4 && png_ptr->pass == 3; i++)
887 {
888 png_push_have_row(png_ptr, png_ptr->row_buf + 1);
889 png_read_push_finish_row(png_ptr);
890 }
891 if (png_ptr->pass == 4) /* skip top two generated rows */
892 {
893 for (i = 0; i < 2 && png_ptr->pass == 4; i++)
894 {
895 png_push_have_row(png_ptr, png_bytep_NULL);
896 png_read_push_finish_row(png_ptr);
897 }
898 }
899 break;
900 }
901 case 4:
902 {
903 int i;
904 for (i = 0; i < 2 && png_ptr->pass == 4; i++)
905 {
906 png_push_have_row(png_ptr, png_ptr->row_buf + 1);
907 png_read_push_finish_row(png_ptr);
908 }
909 for (i = 0; i < 2 && png_ptr->pass == 4; i++)
910 {
911 png_push_have_row(png_ptr, png_bytep_NULL);
912 png_read_push_finish_row(png_ptr);
913 }
914 if (png_ptr->pass == 6) /* pass 5 might be empty */
915 {
916 png_push_have_row(png_ptr, png_bytep_NULL);
917 png_read_push_finish_row(png_ptr);
918 }
919 break;
920 }
921 case 5:
922 {
923 int i;
924 for (i = 0; i < 2 && png_ptr->pass == 5; i++)
925 {
926 png_push_have_row(png_ptr, png_ptr->row_buf + 1);
927 png_read_push_finish_row(png_ptr);
928 }
929 if (png_ptr->pass == 6) /* skip top generated row */
930 {
931 png_push_have_row(png_ptr, png_bytep_NULL);
932 png_read_push_finish_row(png_ptr);
933 }
934 break;
935 }
936 case 6:
937 {
938 png_push_have_row(png_ptr, png_ptr->row_buf + 1);
939 png_read_push_finish_row(png_ptr);
940 if (png_ptr->pass != 6)
941 break;
942 png_push_have_row(png_ptr, png_bytep_NULL);
943 png_read_push_finish_row(png_ptr);
944 }
945 }
946 }
947 else
948#endif
949 {
950 png_push_have_row(png_ptr, png_ptr->row_buf + 1);
951 png_read_push_finish_row(png_ptr);
952 }
953}
954
955void /* PRIVATE */
956png_read_push_finish_row(png_structp png_ptr)
957{
958#ifdef PNG_USE_LOCAL_ARRAYS
959 /* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
960
961 /* start of interlace block */
962 const int FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0};
963
964 /* offset to next interlace block */
965 const int FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1};
966
967 /* start of interlace block in the y direction */
968 const int FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1};
969
970 /* offset to next interlace block in the y direction */
971 const int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
972
973 /* Width of interlace block. This is not currently used - if you need
974 * it, uncomment it here and in png.h
975 const int FARDATA png_pass_width[] = {8, 4, 4, 2, 2, 1, 1};
976 */
977
978 /* Height of interlace block. This is not currently used - if you need
979 * it, uncomment it here and in png.h
980 const int FARDATA png_pass_height[] = {8, 8, 4, 4, 2, 2, 1};
981 */
982#endif
983
984 png_ptr->row_number++;
985 if (png_ptr->row_number < png_ptr->num_rows)
986 return;
987
988 if (png_ptr->interlaced)
989 {
990 png_ptr->row_number = 0;
991 png_memset_check(png_ptr, png_ptr->prev_row, 0,
992 png_ptr->rowbytes + 1);
993 do
994 {
995 png_ptr->pass++;
996 if ((png_ptr->pass == 1 && png_ptr->width < 5) ||
997 (png_ptr->pass == 3 && png_ptr->width < 3) ||
998 (png_ptr->pass == 5 && png_ptr->width < 2))
999 png_ptr->pass++;
1000
1001 if (png_ptr->pass > 7)
1002 png_ptr->pass--;
1003 if (png_ptr->pass >= 7)
1004 break;
1005
1006 png_ptr->iwidth = (png_ptr->width +
1007 png_pass_inc[png_ptr->pass] - 1 -
1008 png_pass_start[png_ptr->pass]) /
1009 png_pass_inc[png_ptr->pass];
1010
1011 png_ptr->irowbytes = ((png_ptr->iwidth *
1012 png_ptr->pixel_depth + 7) >> 3) + 1;
1013
1014 if (png_ptr->transformations & PNG_INTERLACE)
1015 break;
1016
1017 png_ptr->num_rows = (png_ptr->height +
1018 png_pass_yinc[png_ptr->pass] - 1 -
1019 png_pass_ystart[png_ptr->pass]) /
1020 png_pass_yinc[png_ptr->pass];
1021
1022 } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0);
1023 }
1024}
1025
1026#if defined(PNG_READ_tEXt_SUPPORTED)
1027void /* PRIVATE */
1028png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
1029 length)
1030{
1031 if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
1032 {
1033 png_error(png_ptr, "Out of place tEXt");
1034 /* to quiet some compiler warnings */
1035 if(info_ptr == NULL) return;
1036 }
1037
1038#ifdef PNG_MAX_MALLOC_64K
1039 png_ptr->skip_length = 0; /* This may not be necessary */
1040
1041 if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
1042 {
1043 png_warning(png_ptr, "tEXt chunk too large to fit in memory");
1044 png_ptr->skip_length = length - (png_uint_32)65535L;
1045 length = (png_uint_32)65535L;
1046 }
1047#endif
1048
1049 png_ptr->current_text = (png_charp)png_malloc(png_ptr,
1050 (png_uint_32)(length+1));
1051 png_ptr->current_text[length] = '\0';
1052 png_ptr->current_text_ptr = png_ptr->current_text;
1053 png_ptr->current_text_size = (png_size_t)length;
1054 png_ptr->current_text_left = (png_size_t)length;
1055 png_ptr->process_mode = PNG_READ_tEXt_MODE;
1056}
1057
1058void /* PRIVATE */
1059png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
1060{
1061 if (png_ptr->buffer_size && png_ptr->current_text_left)
1062 {
1063 png_size_t text_size;
1064
1065 if (png_ptr->buffer_size < png_ptr->current_text_left)
1066 text_size = png_ptr->buffer_size;
1067 else
1068 text_size = png_ptr->current_text_left;
1069 png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
1070 png_ptr->current_text_left -= text_size;
1071 png_ptr->current_text_ptr += text_size;
1072 }
1073 if (!(png_ptr->current_text_left))
1074 {
1075 png_textp text_ptr;
1076 png_charp text;
1077 png_charp key;
1078 int ret;
1079
1080 if (png_ptr->buffer_size < 4)
1081 {
1082 png_push_save_buffer(png_ptr);
1083 return;
1084 }
1085
1086 png_push_crc_finish(png_ptr);
1087
1088#if defined(PNG_MAX_MALLOC_64K)
1089 if (png_ptr->skip_length)
1090 return;
1091#endif
1092
1093 key = png_ptr->current_text;
1094
1095 for (text = key; *text; text++)
1096 /* empty loop */ ;
1097
1098 if (text != key + png_ptr->current_text_size)
1099 text++;
1100
1101 text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
1102 text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
1103 text_ptr->key = key;
1104#ifdef PNG_iTXt_SUPPORTED
1105 text_ptr->lang = NULL;
1106 text_ptr->lang_key = NULL;
1107#endif
1108 text_ptr->text = text;
1109
1110 ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
1111
1112 png_free(png_ptr, key);
1113 png_free(png_ptr, text_ptr);
1114 png_ptr->current_text = NULL;
1115
1116 if (ret)
1117 png_warning(png_ptr, "Insufficient memory to store text chunk.");
1118 }
1119}
1120#endif
1121
1122#if defined(PNG_READ_zTXt_SUPPORTED)
1123void /* PRIVATE */
1124png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
1125 length)
1126{
1127 if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
1128 {
1129 png_error(png_ptr, "Out of place zTXt");
1130 /* to quiet some compiler warnings */
1131 if(info_ptr == NULL) return;
1132 }
1133
1134#ifdef PNG_MAX_MALLOC_64K
1135 /* We can't handle zTXt chunks > 64K, since we don't have enough space
1136 * to be able to store the uncompressed data. Actually, the threshold
1137 * is probably around 32K, but it isn't as definite as 64K is.
1138 */
1139 if (length > (png_uint_32)65535L)
1140 {
1141 png_warning(png_ptr, "zTXt chunk too large to fit in memory");
1142 png_push_crc_skip(png_ptr, length);
1143 return;
1144 }
1145#endif
1146
1147 png_ptr->current_text = (png_charp)png_malloc(png_ptr,
1148 (png_uint_32)(length+1));
1149 png_ptr->current_text[length] = '\0';
1150 png_ptr->current_text_ptr = png_ptr->current_text;
1151 png_ptr->current_text_size = (png_size_t)length;
1152 png_ptr->current_text_left = (png_size_t)length;
1153 png_ptr->process_mode = PNG_READ_zTXt_MODE;
1154}
1155
1156void /* PRIVATE */
1157png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
1158{
1159 if (png_ptr->buffer_size && png_ptr->current_text_left)
1160 {
1161 png_size_t text_size;
1162
1163 if (png_ptr->buffer_size < (png_uint_32)png_ptr->current_text_left)
1164 text_size = png_ptr->buffer_size;
1165 else
1166 text_size = png_ptr->current_text_left;
1167 png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
1168 png_ptr->current_text_left -= text_size;
1169 png_ptr->current_text_ptr += text_size;
1170 }
1171 if (!(png_ptr->current_text_left))
1172 {
1173 png_textp text_ptr;
1174 png_charp text;
1175 png_charp key;
1176 int ret;
1177 png_size_t text_size, key_size;
1178
1179 if (png_ptr->buffer_size < 4)
1180 {
1181 png_push_save_buffer(png_ptr);
1182 return;
1183 }
1184
1185 png_push_crc_finish(png_ptr);
1186
1187 key = png_ptr->current_text;
1188
1189 for (text = key; *text; text++)
1190 /* empty loop */ ;
1191
1192 /* zTXt can't have zero text */
1193 if (text == key + png_ptr->current_text_size)
1194 {
1195 png_ptr->current_text = NULL;
1196 png_free(png_ptr, key);
1197 return;
1198 }
1199
1200 text++;
1201
1202 if (*text != PNG_TEXT_COMPRESSION_zTXt) /* check compression byte */
1203 {
1204 png_ptr->current_text = NULL;
1205 png_free(png_ptr, key);
1206 return;
1207 }
1208
1209 text++;
1210
1211 png_ptr->zstream.next_in = (png_bytep )text;
1212 png_ptr->zstream.avail_in = (uInt)(png_ptr->current_text_size -
1213 (text - key));
1214 png_ptr->zstream.next_out = png_ptr->zbuf;
1215 png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
1216
1217 key_size = text - key;
1218 text_size = 0;
1219 text = NULL;
1220 ret = Z_STREAM_END;
1221
1222 while (png_ptr->zstream.avail_in)
1223 {
1224 ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
1225 if (ret != Z_OK && ret != Z_STREAM_END)
1226 {
1227 inflateReset(&png_ptr->zstream);
1228 png_ptr->zstream.avail_in = 0;
1229 png_ptr->current_text = NULL;
1230 png_free(png_ptr, key);
1231 png_free(png_ptr, text);
1232 return;
1233 }
1234 if (!(png_ptr->zstream.avail_out) || ret == Z_STREAM_END)
1235 {
1236 if (text == NULL)
1237 {
1238 text = (png_charp)png_malloc(png_ptr,
1239 (png_uint_32)(png_ptr->zbuf_size - png_ptr->zstream.avail_out
1240 + key_size + 1));
1241 png_memcpy(text + key_size, png_ptr->zbuf,
1242 png_ptr->zbuf_size - png_ptr->zstream.avail_out);
1243 png_memcpy(text, key, key_size);
1244 text_size = key_size + png_ptr->zbuf_size -
1245 png_ptr->zstream.avail_out;
1246 *(text + text_size) = '\0';
1247 }
1248 else
1249 {
1250 png_charp tmp;
1251
1252 tmp = text;
1253 text = (png_charp)png_malloc(png_ptr, text_size +
1254 (png_uint_32)(png_ptr->zbuf_size - png_ptr->zstream.avail_out
1255 + 1));
1256 png_memcpy(text, tmp, text_size);
1257 png_free(png_ptr, tmp);
1258 png_memcpy(text + text_size, png_ptr->zbuf,
1259 png_ptr->zbuf_size - png_ptr->zstream.avail_out);
1260 text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
1261 *(text + text_size) = '\0';
1262 }
1263 if (ret != Z_STREAM_END)
1264 {
1265 png_ptr->zstream.next_out = png_ptr->zbuf;
1266 png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
1267 }
1268 }
1269 else
1270 {
1271 break;
1272 }
1273
1274 if (ret == Z_STREAM_END)
1275 break;
1276 }
1277
1278 inflateReset(&png_ptr->zstream);
1279 png_ptr->zstream.avail_in = 0;
1280
1281 if (ret != Z_STREAM_END)
1282 {
1283 png_ptr->current_text = NULL;
1284 png_free(png_ptr, key);
1285 png_free(png_ptr, text);
1286 return;
1287 }
1288
1289 png_ptr->current_text = NULL;
1290 png_free(png_ptr, key);
1291 key = text;
1292 text += key_size;
1293
1294 text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
1295 text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
1296 text_ptr->key = key;
1297#ifdef PNG_iTXt_SUPPORTED
1298 text_ptr->lang = NULL;
1299 text_ptr->lang_key = NULL;
1300#endif
1301 text_ptr->text = text;
1302
1303 ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
1304
1305 png_free(png_ptr, key);
1306 png_free(png_ptr, text_ptr);
1307
1308 if (ret)
1309 png_warning(png_ptr, "Insufficient memory to store text chunk.");
1310 }
1311}
1312#endif
1313
1314#if defined(PNG_READ_iTXt_SUPPORTED)
1315void /* PRIVATE */
1316png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
1317 length)
1318{
1319 if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
1320 {
1321 png_error(png_ptr, "Out of place iTXt");
1322 /* to quiet some compiler warnings */
1323 if(info_ptr == NULL) return;
1324 }
1325
1326#ifdef PNG_MAX_MALLOC_64K
1327 png_ptr->skip_length = 0; /* This may not be necessary */
1328
1329 if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
1330 {
1331 png_warning(png_ptr, "iTXt chunk too large to fit in memory");
1332 png_ptr->skip_length = length - (png_uint_32)65535L;
1333 length = (png_uint_32)65535L;
1334 }
1335#endif
1336
1337 png_ptr->current_text = (png_charp)png_malloc(png_ptr,
1338 (png_uint_32)(length+1));
1339 png_ptr->current_text[length] = '\0';
1340 png_ptr->current_text_ptr = png_ptr->current_text;
1341 png_ptr->current_text_size = (png_size_t)length;
1342 png_ptr->current_text_left = (png_size_t)length;
1343 png_ptr->process_mode = PNG_READ_iTXt_MODE;
1344}
1345
1346void /* PRIVATE */
1347png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
1348{
1349
1350 if (png_ptr->buffer_size && png_ptr->current_text_left)
1351 {
1352 png_size_t text_size;
1353
1354 if (png_ptr->buffer_size < png_ptr->current_text_left)
1355 text_size = png_ptr->buffer_size;
1356 else
1357 text_size = png_ptr->current_text_left;
1358 png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
1359 png_ptr->current_text_left -= text_size;
1360 png_ptr->current_text_ptr += text_size;
1361 }
1362 if (!(png_ptr->current_text_left))
1363 {
1364 png_textp text_ptr;
1365 png_charp key;
1366 int comp_flag;
1367 png_charp lang;
1368 png_charp lang_key;
1369 png_charp text;
1370 int ret;
1371
1372 if (png_ptr->buffer_size < 4)
1373 {
1374 png_push_save_buffer(png_ptr);
1375 return;
1376 }
1377
1378 png_push_crc_finish(png_ptr);
1379
1380#if defined(PNG_MAX_MALLOC_64K)
1381 if (png_ptr->skip_length)
1382 return;
1383#endif
1384
1385 key = png_ptr->current_text;
1386
1387 for (lang = key; *lang; lang++)
1388 /* empty loop */ ;
1389
1390 if (lang != key + png_ptr->current_text_size)
1391 lang++;
1392
1393 comp_flag = *lang++;
1394 lang++; /* skip comp_type, always zero */
1395
1396 for (lang_key = lang; *lang_key; lang_key++)
1397 /* empty loop */ ;
1398 lang_key++; /* skip NUL separator */
1399
1400 for (text = lang_key; *text; text++)
1401 /* empty loop */ ;
1402
1403 if (text != key + png_ptr->current_text_size)
1404 text++;
1405
1406 text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text));
1407 text_ptr->compression = comp_flag + 2;
1408 text_ptr->key = key;
1409 text_ptr->lang = lang;
1410 text_ptr->lang_key = lang_key;
1411 text_ptr->text = text;
1412 text_ptr->text_length = 0;
1413 text_ptr->itxt_length = png_strlen(text);
1414
1415 ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
1416
1417 png_ptr->current_text = NULL;
1418
1419 png_free(png_ptr, text_ptr);
1420 if (ret)
1421 png_warning(png_ptr, "Insufficient memory to store iTXt chunk.");
1422 }
1423}
1424#endif
1425
1426/* This function is called when we haven't found a handler for this
1427 * chunk. If there isn't a problem with the chunk itself (ie a bad chunk
1428 * name or a critical chunk), the chunk is (currently) silently ignored.
1429 */
1430void /* PRIVATE */
1431png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
1432 length)
1433{
1434 png_uint_32 skip=0;
1435 png_check_chunk_name(png_ptr, png_ptr->chunk_name);
1436
1437 if (!(png_ptr->chunk_name[0] & 0x20))
1438 {
1439#if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
1440 if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
1441 HANDLE_CHUNK_ALWAYS
1442#if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
1443 && png_ptr->read_user_chunk_fn == NULL
1444#endif
1445 )
1446#endif
1447 png_chunk_error(png_ptr, "unknown critical chunk");
1448
1449 /* to quiet compiler warnings about unused info_ptr */
1450 if (info_ptr == NULL)
1451 return;
1452 }
1453
1454#if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
1455 if (png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
1456 {
1457 png_unknown_chunk chunk;
1458
1459#ifdef PNG_MAX_MALLOC_64K
1460 if (length > (png_uint_32)65535L)
1461 {
1462 png_warning(png_ptr, "unknown chunk too large to fit in memory");
1463 skip = length - (png_uint_32)65535L;
1464 length = (png_uint_32)65535L;
1465 }
1466#endif
1467
1468 png_strcpy((png_charp)chunk.name, (png_charp)png_ptr->chunk_name);
1469 chunk.data = (png_bytep)png_malloc(png_ptr, length);
1470 png_crc_read(png_ptr, chunk.data, length);
1471 chunk.size = length;
1472#if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
1473 if(png_ptr->read_user_chunk_fn != NULL)
1474 {
1475 /* callback to user unknown chunk handler */
1476 if ((*(png_ptr->read_user_chunk_fn)) (png_ptr, &chunk) <= 0)
1477 {
1478 if (!(png_ptr->chunk_name[0] & 0x20))
1479 if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
1480 HANDLE_CHUNK_ALWAYS)
1481 png_chunk_error(png_ptr, "unknown critical chunk");
1482 }
1483 png_set_unknown_chunks(png_ptr, info_ptr, &chunk, 1);
1484 }
1485 else
1486#endif
1487 png_set_unknown_chunks(png_ptr, info_ptr, &chunk, 1);
1488 png_free(png_ptr, chunk.data);
1489 }
1490 else
1491#endif
1492 skip=length;
1493 png_push_crc_skip(png_ptr, skip);
1494}
1495
1496void /* PRIVATE */
1497png_push_have_info(png_structp png_ptr, png_infop info_ptr)
1498{
1499 if (png_ptr->info_fn != NULL)
1500 (*(png_ptr->info_fn))(png_ptr, info_ptr);
1501}
1502
1503void /* PRIVATE */
1504png_push_have_end(png_structp png_ptr, png_infop info_ptr)
1505{
1506 if (png_ptr->end_fn != NULL)
1507 (*(png_ptr->end_fn))(png_ptr, info_ptr);
1508}
1509
1510void /* PRIVATE */
1511png_push_have_row(png_structp png_ptr, png_bytep row)
1512{
1513 if (png_ptr->row_fn != NULL)
1514 (*(png_ptr->row_fn))(png_ptr, row, png_ptr->row_number,
1515 (int)png_ptr->pass);
1516}
1517
1518void PNGAPI
1519png_progressive_combine_row (png_structp png_ptr,
1520 png_bytep old_row, png_bytep new_row)
1521{
1522#ifdef PNG_USE_LOCAL_ARRAYS
1523 const int FARDATA png_pass_dsp_mask[7] =
1524 {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff};
1525#endif
1526 if (new_row != NULL) /* new_row must == png_ptr->row_buf here. */
1527 png_combine_row(png_ptr, old_row, png_pass_dsp_mask[png_ptr->pass]);
1528}
1529
1530void PNGAPI
1531png_set_progressive_read_fn(png_structp png_ptr, png_voidp progressive_ptr,
1532 png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn,
1533 png_progressive_end_ptr end_fn)
1534{
1535 png_ptr->info_fn = info_fn;
1536 png_ptr->row_fn = row_fn;
1537 png_ptr->end_fn = end_fn;
1538
1539 png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
1540}
1541
1542png_voidp PNGAPI
1543png_get_progressive_ptr(png_structp png_ptr)
1544{
1545 return png_ptr->io_ptr;
1546}
1547#endif /* PNG_PROGRESSIVE_READ_SUPPORTED */