pngrutil.c source code [Skia/third_party/externals/libpng/pngrutil.c]

1
2	/ pngrutil.c - utilities to read a PNG file*
3	*
4	* Copyright (c) 2018 Cosmin Truta
5	* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
6	* Copyright (c) 1996-1997 Andreas Dilger
7	* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
8	*
9	* This code is released under the libpng license.
10	* For conditions of distribution and use, see the disclaimer
11	* and license in png.h
12	*
13	* This file contains routines that are only called from within
14	* libpng itself during the course of reading an image.
15	*/
16
17	#include "pngpriv.h"
18
19	#ifdef PNG_READ_SUPPORTED
20
21	png_uint_32 PNGAPI
22	png_get_uint_31(png_const_structrp png_ptr, png_const_bytep buf)
23	{
24	png_uint_32 uval = png_get_uint_32(buf);
25
26	if (uval > PNG_UINT_31_MAX)
27	png_error(png_ptr, "PNG unsigned integer out of range");
28
29	return (uval);
30	}
31
32	#if defined(PNG_READ_gAMA_SUPPORTED) \|\| defined(PNG_READ_cHRM_SUPPORTED)
33	/ The following is a variation on the above for use with the fixed*
34	* point values used for gAMA and cHRM. Instead of png_error it
35	* issues a warning and returns (-1) - an invalid value because both
36	* gAMA and cHRM use unsigned integers for fixed point values.
37	*/
38	#define PNG_FIXED_ERROR (-1)
39
40	static png_fixed_point / PRIVATE /
41	png_get_fixed_point(png_structrp png_ptr, png_const_bytep buf)
42	{
43	png_uint_32 uval = png_get_uint_32(buf);
44
45	if (uval <= PNG_UINT_31_MAX)
46	return (png_fixed_point)uval; / known to be in range /
47
48	/ The caller can turn off the warning by passing NULL. /
49	if (png_ptr != NULL)
50	png_warning(png_ptr, "PNG fixed point integer out of range");
51
52	return PNG_FIXED_ERROR;
53	}
54	#endif
55
56	#ifdef PNG_READ_INT_FUNCTIONS_SUPPORTED
57	/ NOTE: the read macros will obscure these definitions, so that if*
58	* PNG_USE_READ_MACROS is set the library will not use them internally,
59	* but the APIs will still be available externally.
60	*
61	* The parentheses around "PNGAPI function_name" in the following three
62	* functions are necessary because they allow the macros to co-exist with
63	* these (unused but exported) functions.
64	*/
65
66	/ Grab an unsigned 32-bit integer from a buffer in big-endian format. /
67	png_uint_32 (PNGAPI
68	png_get_uint_32)(png_const_bytep buf)
69	{
70	png_uint_32 uval =
71	((png_uint_32)(*(buf )) << `24`) +
72	((png_uint_32)(*(buf + `1`)) << `16`) +
73	((png_uint_32)(*(buf + `2`)) << `8`) +
74	((png_uint_32)(*(buf + `3`)) ) ;
75
76	return uval;
77	}
78
79	/ Grab a signed 32-bit integer from a buffer in big-endian format. The*
80	* data is stored in the PNG file in two's complement format and there
81	* is no guarantee that a 'png_int_32' is exactly 32 bits, therefore
82	* the following code does a two's complement to native conversion.
83	*/
84	png_int_32 (PNGAPI
85	png_get_int_32)(png_const_bytep buf)
86	{
87	png_uint_32 uval = png_get_uint_32(buf);
88	if ((uval & `0x80000000`) == `0`) / non-negative /
89	return (png_int_32)uval;
90
91	uval = (uval ^ `0xffffffff`) + `1`; / 2's complement: -x = ~x+1 /
92	if ((uval & `0x80000000`) == `0`) / no overflow /
93	return -(png_int_32)uval;
94	/ The following has to be safe; this function only gets called on PNG data*
95	* and if we get here that data is invalid. 0 is the most safe value and
96	* if not then an attacker would surely just generate a PNG with 0 instead.
97	*/
98	return `0`;
99	}
100
101	/ Grab an unsigned 16-bit integer from a buffer in big-endian format. /
102	png_uint_16 (PNGAPI
103	png_get_uint_16)(png_const_bytep buf)
104	{
105	/ ANSI-C requires an int value to accommodate at least 16 bits so this*
106	* works and allows the compiler not to worry about possible narrowing
107	* on 32-bit systems. (Pre-ANSI systems did not make integers smaller
108	* than 16 bits either.)
109	*/
110	unsigned int val =
111	((unsigned int)(*buf) << `8`) +
112	((unsigned int)(*(buf + `1`)));
113
114	return (png_uint_16)val;
115	}
116
117	#endif /* READ_INT_FUNCTIONS */
118
119	/ Read and check the PNG file signature /
120	void / PRIVATE /
121	png_read_sig(png_structrp png_ptr, png_inforp info_ptr)
122	{
123	size_t num_checked, num_to_check;
124
125	/ Exit if the user application does not expect a signature. /
126	if (png_ptr->sig_bytes >= `8`)
127	return;
128
129	num_checked = png_ptr->sig_bytes;
130	num_to_check = `8` - num_checked;
131
132	#ifdef PNG_IO_STATE_SUPPORTED
133	png_ptr->io_state = PNG_IO_READING \| PNG_IO_SIGNATURE;
134	#endif
135
136	/ The signature must be serialized in a single I/O call. /
137	png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check);
138	png_ptr->sig_bytes = `8`;
139
140	if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check) != `0`)
141	{
142	if (num_checked < `4` &&
143	png_sig_cmp(info_ptr->signature, num_checked, num_to_check - `4`))
144	png_error(png_ptr, "Not a PNG file");
145	else
146	png_error(png_ptr, "PNG file corrupted by ASCII conversion");
147	}
148	if (num_checked < `3`)
149	png_ptr->mode \|= PNG_HAVE_PNG_SIGNATURE;
150	}
151
152	/ Read the chunk header (length + type name).*
153	* Put the type name into png_ptr->chunk_name, and return the length.
154	*/
155	png_uint_32 / PRIVATE /
156	png_read_chunk_header(png_structrp png_ptr)
157	{
158	png_byte buf[`8`];
159	png_uint_32 length;
160
161	#ifdef PNG_IO_STATE_SUPPORTED
162	png_ptr->io_state = PNG_IO_READING \| PNG_IO_CHUNK_HDR;
163	#endif
164
165	/ Read the length and the chunk name.*
166	* This must be performed in a single I/O call.
167	*/
168	png_read_data(png_ptr, buf, `8`);
169	length = png_get_uint_31(png_ptr, buf);
170
171	/ Put the chunk name into png_ptr->chunk_name. /
172	png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(buf+`4`);
173
174	png_debug2(`0`, "Reading %lx chunk, length = %lu",
175	(unsigned long)png_ptr->chunk_name, (unsigned long)length);
176
177	/ Reset the crc and run it over the chunk name. /
178	png_reset_crc(png_ptr);
179	png_calculate_crc(png_ptr, buf + `4`, `4`);
180
181	/ Check to see if chunk name is valid. /
182	png_check_chunk_name(png_ptr, png_ptr->chunk_name);
183
184	/ Check for too-large chunk length /
185	png_check_chunk_length(png_ptr, length);
186
187	#ifdef PNG_IO_STATE_SUPPORTED
188	png_ptr->io_state = PNG_IO_READING \| PNG_IO_CHUNK_DATA;
189	#endif
190
191	return length;
192	}
193
194	/ Read data, and (optionally) run it through the CRC. /
195	void / PRIVATE /
196	png_crc_read(png_structrp png_ptr, png_bytep buf, png_uint_32 length)
197	{
198	if (png_ptr == NULL)
199	return;
200
201	png_read_data(png_ptr, buf, length);
202	png_calculate_crc(png_ptr, buf, length);
203	}
204
205	/ Optionally skip data and then check the CRC. Depending on whether we*
206	* are reading an ancillary or critical chunk, and how the program has set
207	* things up, we may calculate the CRC on the data and print a message.
208	* Returns '1' if there was a CRC error, '0' otherwise.
209	*/
210	int / PRIVATE /
211	png_crc_finish(png_structrp png_ptr, png_uint_32 skip)
212	{
213	/ The size of the local buffer for inflate is a good guess as to a*
214	* reasonable size to use for buffering reads from the application.
215	*/
216	while (skip > `0`)
217	{
218	png_uint_32 len;
219	png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
220
221	len = (sizeof tmpbuf);
222	if (len > skip)
223	len = skip;
224	skip -= len;
225
226	png_crc_read(png_ptr, tmpbuf, len);
227	}
228
229	if (png_crc_error(png_ptr) != `0`)
230	{
231	if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != `0` ?
232	(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == `0` :
233	(png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE) != `0`)
234	{
235	png_chunk_warning(png_ptr, "CRC error");
236	}
237
238	else
239	png_chunk_error(png_ptr, "CRC error");
240
241	return (`1`);
242	}
243
244	return (`0`);
245	}
246
247	/ Compare the CRC stored in the PNG file with that calculated by libpng from*
248	* the data it has read thus far.
249	*/
250	int / PRIVATE /
251	png_crc_error(png_structrp png_ptr)
252	{
253	png_byte crc_bytes[`4`];
254	png_uint_32 crc;
255	int need_crc = `1`;
256
257	if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != `0`)
258	{
259	if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
260	(PNG_FLAG_CRC_ANCILLARY_USE \| PNG_FLAG_CRC_ANCILLARY_NOWARN))
261	need_crc = `0`;
262	}
263
264	else / critical /
265	{
266	if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != `0`)
267	need_crc = `0`;
268	}
269
270	#ifdef PNG_IO_STATE_SUPPORTED
271	png_ptr->io_state = PNG_IO_READING \| PNG_IO_CHUNK_CRC;
272	#endif
273
274	/ The chunk CRC must be serialized in a single I/O call. /
275	png_read_data(png_ptr, crc_bytes, `4`);
276
277	if (need_crc != `0`)
278	{
279	crc = png_get_uint_32(crc_bytes);
280	return ((int)(crc != png_ptr->crc));
281	}
282
283	else
284	return (`0`);
285	}
286
287	#if defined(PNG_READ_iCCP_SUPPORTED) \|\| defined(PNG_READ_iTXt_SUPPORTED) \|\|\
288	defined(PNG_READ_pCAL_SUPPORTED) \|\| defined(PNG_READ_sCAL_SUPPORTED) \|\|\
289	defined(PNG_READ_sPLT_SUPPORTED) \|\| defined(PNG_READ_tEXt_SUPPORTED) \|\|\
290	defined(PNG_READ_zTXt_SUPPORTED) \|\| defined(PNG_SEQUENTIAL_READ_SUPPORTED)
291	/ Manage the read buffer; this simply reallocates the buffer if it is not small*
292	* enough (or if it is not allocated). The routine returns a pointer to the
293	* buffer; if an error occurs and 'warn' is set the routine returns NULL, else
294	* it will call png_error (via png_malloc) on failure. (warn == 2 means
295	* 'silent').
296	*/
297	static png_bytep
298	png_read_buffer(png_structrp png_ptr, png_alloc_size_t new_size, int warn)
299	{
300	png_bytep buffer = png_ptr->read_buffer;
301
302	if (buffer != NULL && new_size > png_ptr->read_buffer_size)
303	{
304	png_ptr->read_buffer = NULL;
305	png_ptr->read_buffer = NULL;
306	png_ptr->read_buffer_size = `0`;
307	png_free(png_ptr, buffer);
308	buffer = NULL;
309	}
310
311	if (buffer == NULL)
312	{
313	buffer = png_voidcast(png_bytep, png_malloc_base(png_ptr, new_size));
314
315	if (buffer != NULL)
316	{
317	memset(buffer, `0`, new_size); / just in case /
318	png_ptr->read_buffer = buffer;
319	png_ptr->read_buffer_size = new_size;
320	}
321
322	else if (warn < `2`) / else silent /
323	{
324	if (warn != `0`)
325	png_chunk_warning(png_ptr, "insufficient memory to read chunk");
326
327	else
328	png_chunk_error(png_ptr, "insufficient memory to read chunk");
329	}
330	}
331
332	return buffer;
333	}
334	#endif /* READ_iCCP\|iTXt\|pCAL\|sCAL\|sPLT\|tEXt\|zTXt\|SEQUENTIAL_READ */
335
336	/ png_inflate_claim: claim the zstream for some nefarious purpose that involves*
337	* decompression. Returns Z_OK on success, else a zlib error code. It checks
338	* the owner but, in final release builds, just issues a warning if some other
339	* chunk apparently owns the stream. Prior to release it does a png_error.
340	*/
341	static int
342	png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
343	{
344	if (png_ptr->zowner != `0`)
345	{
346	char msg[`64`];
347
348	PNG_STRING_FROM_CHUNK(msg, png_ptr->zowner);
349	/ So the message that results is "<chunk> using zstream"; this is an*
350	* internal error, but is very useful for debugging. i18n requirements
351	* are minimal.
352	*/
353	(void)png_safecat(msg, (sizeof msg), `4`, " using zstream");
354	#if PNG_RELEASE_BUILD
355	png_chunk_warning(png_ptr, msg);
356	png_ptr->zowner = `0`;
357	#else
358	png_chunk_error(png_ptr, msg);
359	#endif
360	}
361
362	/ Implementation note: unlike 'png_deflate_claim' this internal function*
363	* does not take the size of the data as an argument. Some efficiency could
364	* be gained by using this when it is known if the zlib stream itself does
365	* not record the number; however, this is an illusion: the original writer
366	* of the PNG may have selected a lower window size, and we really must
367	* follow that because, for systems with with limited capabilities, we
368	* would otherwise reject the application's attempts to use a smaller window
369	* size (zlib doesn't have an interface to say "this or lower"!).
370	*
371	* inflateReset2 was added to zlib 1.2.4; before this the window could not be
372	* reset, therefore it is necessary to always allocate the maximum window
373	* size with earlier zlibs just in case later compressed chunks need it.
374	*/
375	{
376	int ret; / zlib return code /
377	#if ZLIB_VERNUM >= 0x1240
378	int window_bits = `0`;
379
380	# if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW)
381	if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & `3`) ==
382	PNG_OPTION_ON)
383	{
384	window_bits = `15`;
385	png_ptr->zstream_start = `0`; / fixed window size /
386	}
387
388	else
389	{
390	png_ptr->zstream_start = `1`;
391	}
392	# endif
393
394	#endif /* ZLIB_VERNUM >= 0x1240 */
395
396	/ Set this for safety, just in case the previous owner left pointers to*
397	* memory allocations.
398	*/
399	png_ptr->zstream.next_in = NULL;
400	png_ptr->zstream.avail_in = `0`;
401	png_ptr->zstream.next_out = NULL;
402	png_ptr->zstream.avail_out = `0`;
403
404	if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != `0`)
405	{
406	#if ZLIB_VERNUM >= 0x1240
407	ret = inflateReset2(&png_ptr->zstream, window_bits);
408	#else
409	ret = inflateReset(&png_ptr->zstream);
410	#endif
411	}
412
413	else
414	{
415	#if ZLIB_VERNUM >= 0x1240
416	ret = inflateInit2(&png_ptr->zstream, window_bits);
417	#else
418	ret = inflateInit(&png_ptr->zstream);
419	#endif
420
421	if (ret == Z_OK)
422	png_ptr->flags \|= PNG_FLAG_ZSTREAM_INITIALIZED;
423	}
424
425	#if ZLIB_VERNUM >= 0x1290 && \
426	defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_IGNORE_ADLER32)
427	if (((png_ptr->options >> PNG_IGNORE_ADLER32) & `3`) == PNG_OPTION_ON)
428	/ Turn off validation of the ADLER32 checksum in IDAT chunks /
429	ret = inflateValidate(&png_ptr->zstream, `0`);
430	#endif
431
432	if (ret == Z_OK)
433	png_ptr->zowner = owner;
434
435	else
436	png_zstream_error(png_ptr, ret);
437
438	return ret;
439	}
440
441	#ifdef window_bits
442	# undef window_bits
443	#endif
444	}
445
446	#if ZLIB_VERNUM >= 0x1240
447	/ Handle the start of the inflate stream if we called inflateInit2(strm,0);*
448	* in this case some zlib versions skip validation of the CINFO field and, in
449	* certain circumstances, libpng may end up displaying an invalid image, in
450	* contrast to implementations that call zlib in the normal way (e.g. libpng
451	* 1.5).
452	*/
453	int / PRIVATE /
454	png_zlib_inflate(png_structrp png_ptr, int flush)
455	{
456	if (png_ptr->zstream_start && png_ptr->zstream.avail_in > `0`)
457	{
458	if ((*png_ptr->zstream.next_in >> `4`) > `7`)
459	{
460	png_ptr->zstream.msg = "invalid window size (libpng)";
461	return Z_DATA_ERROR;
462	}
463
464	png_ptr->zstream_start = `0`;
465	}
466
467	return inflate(&png_ptr->zstream, flush);
468	}
469	#endif /* Zlib >= 1.2.4 */
470
471	#ifdef PNG_READ_COMPRESSED_TEXT_SUPPORTED
472	#if defined(PNG_READ_zTXt_SUPPORTED) \|\| defined (PNG_READ_iTXt_SUPPORTED)
473	/ png_inflate now returns zlib error codes including Z_OK and Z_STREAM_END to*
474	* allow the caller to do multiple calls if required. If the 'finish' flag is
475	* set Z_FINISH will be passed to the final inflate() call and Z_STREAM_END must
476	* be returned or there has been a problem, otherwise Z_SYNC_FLUSH is used and
477	* Z_OK or Z_STREAM_END will be returned on success.
478	*
479	* The input and output sizes are updated to the actual amounts of data consumed
480	* or written, not the amount available (as in a z_stream). The data pointers
481	* are not changed, so the next input is (data+input_size) and the next
482	* available output is (output+output_size).
483	*/
484	static int
485	png_inflate(png_structrp png_ptr, png_uint_32 owner, int finish,
486	/ INPUT: / png_const_bytep input, png_uint_32p input_size_ptr,
487	/ OUTPUT: / png_bytep output, png_alloc_size_t *output_size_ptr)
488	{
489	if (png_ptr->zowner == owner) / Else not claimed /
490	{
491	int ret;
492	png_alloc_size_t avail_out = *output_size_ptr;
493	png_uint_32 avail_in = *input_size_ptr;
494
495	/ zlib can't necessarily handle more than 65535 bytes at once (i.e. it*
496	* can't even necessarily handle 65536 bytes) because the type uInt is
497	* "16 bits or more". Consequently it is necessary to chunk the input to
498	* zlib. This code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the
499	* maximum value that can be stored in a uInt.) It is possible to set
500	* ZLIB_IO_MAX to a lower value in pngpriv.h and this may sometimes have
501	* a performance advantage, because it reduces the amount of data accessed
502	* at each step and that may give the OS more time to page it in.
503	*/
504	png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input);
505	/ avail_in and avail_out are set below from 'size' /
506	png_ptr->zstream.avail_in = `0`;
507	png_ptr->zstream.avail_out = `0`;
508
509	/ Read directly into the output if it is available (this is set to*
510	* a local buffer below if output is NULL).
511	*/
512	if (output != NULL)
513	png_ptr->zstream.next_out = output;
514
515	do
516	{
517	uInt avail;
518	Byte local_buffer[PNG_INFLATE_BUF_SIZE];
519
520	/ zlib INPUT BUFFER /
521	/ The setting of 'avail_in' used to be outside the loop; by setting it*
522	* inside it is possible to chunk the input to zlib and simply rely on
523	* zlib to advance the 'next_in' pointer. This allows arbitrary
524	* amounts of data to be passed through zlib at the unavoidable cost of
525	* requiring a window save (memcpy of up to 32768 output bytes)
526	* every ZLIB_IO_MAX input bytes.
527	*/
528	avail_in += png_ptr->zstream.avail_in; / not consumed last time /
529
530	avail = ZLIB_IO_MAX;
531
532	if (avail_in < avail)
533	avail = (uInt)avail_in; / safe: < than ZLIB_IO_MAX /
534
535	avail_in -= avail;
536	png_ptr->zstream.avail_in = avail;
537
538	/ zlib OUTPUT BUFFER /
539	avail_out += png_ptr->zstream.avail_out; / not written last time /
540
541	avail = ZLIB_IO_MAX; / maximum zlib can process /
542
543	if (output == NULL)
544	{
545	/ Reset the output buffer each time round if output is NULL and*
546	* make available the full buffer, up to 'remaining_space'
547	*/
548	png_ptr->zstream.next_out = local_buffer;
549	if ((sizeof local_buffer) < avail)
550	avail = (sizeof local_buffer);
551	}
552
553	if (avail_out < avail)
554	avail = (uInt)avail_out; / safe: < ZLIB_IO_MAX /
555
556	png_ptr->zstream.avail_out = avail;
557	avail_out -= avail;
558
559	/ zlib inflate call /
560	/ In fact 'avail_out' may be 0 at this point, that happens at the end*
561	* of the read when the final LZ end code was not passed at the end of
562	* the previous chunk of input data. Tell zlib if we have reached the
563	* end of the output buffer.
564	*/
565	ret = PNG_INFLATE(png_ptr, avail_out > `0` ? Z_NO_FLUSH :
566	(finish ? Z_FINISH : Z_SYNC_FLUSH));
567	} while (ret == Z_OK);
568
569	/ For safety kill the local buffer pointer now /
570	if (output == NULL)
571	png_ptr->zstream.next_out = NULL;
572
573	/ Claw back the 'size' and 'remaining_space' byte counts. /
574	avail_in += png_ptr->zstream.avail_in;
575	avail_out += png_ptr->zstream.avail_out;
576
577	/ Update the input and output sizes; the updated values are the amount*
578	* consumed or written, effectively the inverse of what zlib uses.
579	*/
580	if (avail_out > `0`)
581	*output_size_ptr -= avail_out;
582
583	if (avail_in > `0`)
584	*input_size_ptr -= avail_in;
585
586	/ Ensure png_ptr->zstream.msg is set (even in the success case!) /
587	png_zstream_error(png_ptr, ret);
588	return ret;
589	}
590
591	else
592	{
593	/ This is a bad internal error. The recovery assigns to the zstream msg*
594	* pointer, which is not owned by the caller, but this is safe; it's only
595	* used on errors!
596	*/
597	png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
598	return Z_STREAM_ERROR;
599	}
600	}
601
602	/*
603	* Decompress trailing data in a chunk. The assumption is that read_buffer
604	* points at an allocated area holding the contents of a chunk with a
605	* trailing compressed part. What we get back is an allocated area
606	* holding the original prefix part and an uncompressed version of the
607	* trailing part (the malloc area passed in is freed).
608	*/
609	static int
610	png_decompress_chunk(png_structrp png_ptr,
611	png_uint_32 chunklength, png_uint_32 prefix_size,
612	png_alloc_size_t newlength /* must be initialized to the maximum! /,
613	int terminate /add a '\0' to the end of the uncompressed data/)
614	{
615	/ TODO: implement different limits for different types of chunk.*
616	*
617	* The caller supplies *newlength set to the maximum length of the
618	* uncompressed data, but this routine allocates space for the prefix and
619	* maybe a '\0' terminator too. We have to assume that 'prefix_size' is
620	* limited only by the maximum chunk size.
621	*/
622	png_alloc_size_t limit = PNG_SIZE_MAX;
623
624	# ifdef PNG_SET_USER_LIMITS_SUPPORTED
625	if (png_ptr->user_chunk_malloc_max > `0` &&
626	png_ptr->user_chunk_malloc_max < limit)
627	limit = png_ptr->user_chunk_malloc_max;
628	# elif PNG_USER_CHUNK_MALLOC_MAX > 0
629	if (PNG_USER_CHUNK_MALLOC_MAX < limit)
630	limit = PNG_USER_CHUNK_MALLOC_MAX;
631	# endif
632
633	if (limit >= prefix_size + (terminate != `0`))
634	{
635	int ret;
636
637	limit -= prefix_size + (terminate != `0`);
638
639	if (limit < *newlength)
640	*newlength = limit;
641
642	/ Now try to claim the stream. /
643	ret = png_inflate_claim(png_ptr, png_ptr->chunk_name);
644
645	if (ret == Z_OK)
646	{
647	png_uint_32 lzsize = chunklength - prefix_size;
648
649	ret = png_inflate(png_ptr, png_ptr->chunk_name, `1`/finish/,
650	/ input: / png_ptr->read_buffer + prefix_size, &lzsize,
651	/ output: / NULL, newlength);
652
653	if (ret == Z_STREAM_END)
654	{
655	/ Use 'inflateReset' here, not 'inflateReset2' because this*
656	* preserves the previously decided window size (otherwise it would
657	* be necessary to store the previous window size.) In practice
658	* this doesn't matter anyway, because png_inflate will call inflate
659	* with Z_FINISH in almost all cases, so the window will not be
660	* maintained.
661	*/
662	if (inflateReset(&png_ptr->zstream) == Z_OK)
663	{
664	/ Because of the limit checks above we know that the new,*
665	* expanded, size will fit in a size_t (let alone an
666	* png_alloc_size_t). Use png_malloc_base here to avoid an
667	* extra OOM message.
668	*/
669	png_alloc_size_t new_size = *newlength;
670	png_alloc_size_t buffer_size = prefix_size + new_size +
671	(terminate != `0`);
672	png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr,
673	buffer_size));
674
675	if (text != NULL)
676	{
677	memset(text, `0`, buffer_size);
678
679	ret = png_inflate(png_ptr, png_ptr->chunk_name, `1`/finish/,
680	png_ptr->read_buffer + prefix_size, &lzsize,
681	text + prefix_size, newlength);
682
683	if (ret == Z_STREAM_END)
684	{
685	if (new_size == *newlength)
686	{
687	if (terminate != `0`)
688	text[prefix_size + *newlength] = `0`;
689
690	if (prefix_size > `0`)
691	memcpy(text, png_ptr->read_buffer, prefix_size);
692
693	{
694	png_bytep old_ptr = png_ptr->read_buffer;
695
696	png_ptr->read_buffer = text;
697	png_ptr->read_buffer_size = buffer_size;
698	text = old_ptr; / freed below /
699	}
700	}
701
702	else
703	{
704	/ The size changed on the second read, there can be no*
705	* guarantee that anything is correct at this point.
706	* The 'msg' pointer has been set to "unexpected end of
707	* LZ stream", which is fine, but return an error code
708	* that the caller won't accept.
709	*/
710	ret = PNG_UNEXPECTED_ZLIB_RETURN;
711	}
712	}
713
714	else if (ret == Z_OK)
715	ret = PNG_UNEXPECTED_ZLIB_RETURN; / for safety /
716
717	/ Free the text pointer (this is the old read_buffer on*
718	* success)
719	*/
720	png_free(png_ptr, text);
721
722	/ This really is very benign, but it's still an error because*
723	* the extra space may otherwise be used as a Trojan Horse.
724	*/
725	if (ret == Z_STREAM_END &&
726	chunklength - prefix_size != lzsize)
727	png_chunk_benign_error(png_ptr, "extra compressed data");
728	}
729
730	else
731	{
732	/ Out of memory allocating the buffer /
733	ret = Z_MEM_ERROR;
734	png_zstream_error(png_ptr, Z_MEM_ERROR);
735	}
736	}
737
738	else
739	{
740	/ inflateReset failed, store the error message /
741	png_zstream_error(png_ptr, ret);
742	ret = PNG_UNEXPECTED_ZLIB_RETURN;
743	}
744	}
745
746	else if (ret == Z_OK)
747	ret = PNG_UNEXPECTED_ZLIB_RETURN;
748
749	/ Release the claimed stream /
750	png_ptr->zowner = `0`;
751	}
752
753	else / the claim failed / if (ret == Z_STREAM_END) / impossible! /
754	ret = PNG_UNEXPECTED_ZLIB_RETURN;
755
756	return ret;
757	}
758
759	else
760	{
761	/ Application/configuration limits exceeded /
762	png_zstream_error(png_ptr, Z_MEM_ERROR);
763	return Z_MEM_ERROR;
764	}
765	}
766	#endif /* READ_zTXt \|\| READ_iTXt */
767	#endif /* READ_COMPRESSED_TEXT */
768
769	#ifdef PNG_READ_iCCP_SUPPORTED
770	/ Perform a partial read and decompress, producing 'avail_out' bytes and*
771	* reading from the current chunk as required.
772	*/
773	static int
774	png_inflate_read(png_structrp png_ptr, png_bytep read_buffer, uInt read_size,
775	png_uint_32p chunk_bytes, png_bytep next_out, png_alloc_size_t *out_size,
776	int finish)
777	{
778	if (png_ptr->zowner == png_ptr->chunk_name)
779	{
780	int ret;
781
782	/ next_in and avail_in must have been initialized by the caller. /
783	png_ptr->zstream.next_out = next_out;
784	png_ptr->zstream.avail_out = `0`; / set in the loop /
785
786	do
787	{
788	if (png_ptr->zstream.avail_in == `0`)
789	{
790	if (read_size > *chunk_bytes)
791	read_size = (uInt)*chunk_bytes;
792	*chunk_bytes -= read_size;
793
794	if (read_size > `0`)
795	png_crc_read(png_ptr, read_buffer, read_size);
796
797	png_ptr->zstream.next_in = read_buffer;
798	png_ptr->zstream.avail_in = read_size;
799	}
800
801	if (png_ptr->zstream.avail_out == `0`)
802	{
803	uInt avail = ZLIB_IO_MAX;
804	if (avail > *out_size)
805	avail = (uInt)*out_size;
806	*out_size -= avail;
807
808	png_ptr->zstream.avail_out = avail;
809	}
810
811	/ Use Z_SYNC_FLUSH when there is no more chunk data to ensure that all*
812	* the available output is produced; this allows reading of truncated
813	* streams.
814	*/
815	ret = PNG_INFLATE(png_ptr, *chunk_bytes > `0` ?
816	Z_NO_FLUSH : (finish ? Z_FINISH : Z_SYNC_FLUSH));
817	}
818	while (ret == Z_OK && (*out_size > `0` \|\| png_ptr->zstream.avail_out > `0`));
819
820	*out_size += png_ptr->zstream.avail_out;
821	png_ptr->zstream.avail_out = `0`; / Should not be required, but is safe /
822
823	/ Ensure the error message pointer is always set: /
824	png_zstream_error(png_ptr, ret);
825	return ret;
826	}
827
828	else
829	{
830	png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
831	return Z_STREAM_ERROR;
832	}
833	}
834	#endif /* READ_iCCP */
835
836	/ Read and check the IDHR chunk /
837
838	void / PRIVATE /
839	png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
840	{
841	png_byte buf[`13`];
842	png_uint_32 width, height;
843	int bit_depth, color_type, compression_type, filter_type;
844	int interlace_type;
845
846	png_debug(`1`, "in png_handle_IHDR");
847
848	if ((png_ptr->mode & PNG_HAVE_IHDR) != `0`)
849	png_chunk_error(png_ptr, "out of place");
850
851	/ Check the length /
852	if (length != `13`)
853	png_chunk_error(png_ptr, "invalid");
854
855	png_ptr->mode \|= PNG_HAVE_IHDR;
856
857	png_crc_read(png_ptr, buf, `13`);
858	png_crc_finish(png_ptr, `0`);
859
860	width = png_get_uint_31(png_ptr, buf);
861	height = png_get_uint_31(png_ptr, buf + `4`);
862	bit_depth = buf[`8`];
863	color_type = buf[`9`];
864	compression_type = buf[`10`];
865	filter_type = buf[`11`];
866	interlace_type = buf[`12`];
867
868	/ Set internal variables /
869	png_ptr->width = width;
870	png_ptr->height = height;
871	png_ptr->bit_depth = (png_byte)bit_depth;
872	png_ptr->interlaced = (png_byte)interlace_type;
873	png_ptr->color_type = (png_byte)color_type;
874	#ifdef PNG_MNG_FEATURES_SUPPORTED
875	png_ptr->filter_type = (png_byte)filter_type;
876	#endif
877	png_ptr->compression_type = (png_byte)compression_type;
878
879	/ Find number of channels /
880	switch (png_ptr->color_type)
881	{
882	default: / invalid, png_set_IHDR calls png_error /
883	case PNG_COLOR_TYPE_GRAY:
884	case PNG_COLOR_TYPE_PALETTE:
885	png_ptr->channels = `1`;
886	break;
887
888	case PNG_COLOR_TYPE_RGB:
889	png_ptr->channels = `3`;
890	break;
891
892	case PNG_COLOR_TYPE_GRAY_ALPHA:
893	png_ptr->channels = `2`;
894	break;
895
896	case PNG_COLOR_TYPE_RGB_ALPHA:
897	png_ptr->channels = `4`;
898	break;
899	}
900
901	/ Set up other useful info /
902	png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels);
903	png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
904	png_debug1(`3`, "bit_depth = %d", png_ptr->bit_depth);
905	png_debug1(`3`, "channels = %d", png_ptr->channels);
906	png_debug1(`3`, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes);
907	png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
908	color_type, interlace_type, compression_type, filter_type);
909	}
910
911	/ Read and check the palette /
912	void / PRIVATE /
913	png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
914	{
915	png_color palette[PNG_MAX_PALETTE_LENGTH];
916	int max_palette_length, num, i;
917	#ifdef PNG_POINTER_INDEXING_SUPPORTED
918	png_colorp pal_ptr;
919	#endif
920
921	png_debug(`1`, "in png_handle_PLTE");
922
923	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
924	png_chunk_error(png_ptr, "missing IHDR");
925
926	/ Moved to before the 'after IDAT' check below because otherwise duplicate*
927	* PLTE chunks are potentially ignored (the spec says there shall not be more
928	* than one PLTE, the error is not treated as benign, so this check trumps
929	* the requirement that PLTE appears before IDAT.)
930	*/
931	else if ((png_ptr->mode & PNG_HAVE_PLTE) != `0`)
932	png_chunk_error(png_ptr, "duplicate");
933
934	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
935	{
936	/ This is benign because the non-benign error happened before, when an*
937	* IDAT was encountered in a color-mapped image with no PLTE.
938	*/
939	png_crc_finish(png_ptr, length);
940	png_chunk_benign_error(png_ptr, "out of place");
941	return;
942	}
943
944	png_ptr->mode \|= PNG_HAVE_PLTE;
945
946	if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == `0`)
947	{
948	png_crc_finish(png_ptr, length);
949	png_chunk_benign_error(png_ptr, "ignored in grayscale PNG");
950	return;
951	}
952
953	#ifndef PNG_READ_OPT_PLTE_SUPPORTED
954	if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
955	{
956	png_crc_finish(png_ptr, length);
957	return;
958	}
959	#endif
960
961	if (length > `3`*PNG_MAX_PALETTE_LENGTH \|\| length % `3`)
962	{
963	png_crc_finish(png_ptr, length);
964
965	if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
966	png_chunk_benign_error(png_ptr, "invalid");
967
968	else
969	png_chunk_error(png_ptr, "invalid");
970
971	return;
972	}
973
974	/ The cast is safe because 'length' is less than 3PNG_MAX_PALETTE_LENGTH /*
975	num = (int)length / `3`;
976
977	/ If the palette has 256 or fewer entries but is too large for the bit*
978	* depth, we don't issue an error, to preserve the behavior of previous
979	* libpng versions. We silently truncate the unused extra palette entries
980	* here.
981	*/
982	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
983	max_palette_length = (`1` << png_ptr->bit_depth);
984	else
985	max_palette_length = PNG_MAX_PALETTE_LENGTH;
986
987	if (num > max_palette_length)
988	num = max_palette_length;
989
990	#ifdef PNG_POINTER_INDEXING_SUPPORTED
991	for (i = `0`, pal_ptr = palette; i < num; i++, pal_ptr++)
992	{
993	png_byte buf[`3`];
994
995	png_crc_read(png_ptr, buf, `3`);
996	pal_ptr->red = buf[`0`];
997	pal_ptr->green = buf[`1`];
998	pal_ptr->blue = buf[`2`];
999	}
1000	#else
1001	for (i = `0`; i < num; i++)
1002	{
1003	png_byte buf[`3`];
1004
1005	png_crc_read(png_ptr, buf, `3`);
1006	/ Don't depend upon png_color being any order /
1007	palette[i].red = buf[`0`];
1008	palette[i].green = buf[`1`];
1009	palette[i].blue = buf[`2`];
1010	}
1011	#endif
1012
1013	/ If we actually need the PLTE chunk (ie for a paletted image), we do*
1014	* whatever the normal CRC configuration tells us. However, if we
1015	* have an RGB image, the PLTE can be considered ancillary, so
1016	* we will act as though it is.
1017	*/
1018	#ifndef PNG_READ_OPT_PLTE_SUPPORTED
1019	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1020	#endif
1021	{
1022	png_crc_finish(png_ptr, (png_uint_32) (length - (unsigned int)num * `3`));
1023	}
1024
1025	#ifndef PNG_READ_OPT_PLTE_SUPPORTED
1026	else if (png_crc_error(png_ptr) != `0`) / Only if we have a CRC error /
1027	{
1028	/ If we don't want to use the data from an ancillary chunk,*
1029	* we have two options: an error abort, or a warning and we
1030	* ignore the data in this chunk (which should be OK, since
1031	* it's considered ancillary for a RGB or RGBA image).
1032	*
1033	* IMPLEMENTATION NOTE: this is only here because png_crc_finish uses the
1034	* chunk type to determine whether to check the ancillary or the critical
1035	* flags.
1036	*/
1037	if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE) == `0`)
1038	{
1039	if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) != `0`)
1040	return;
1041
1042	else
1043	png_chunk_error(png_ptr, "CRC error");
1044	}
1045
1046	/ Otherwise, we (optionally) emit a warning and use the chunk. /
1047	else if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == `0`)
1048	png_chunk_warning(png_ptr, "CRC error");
1049	}
1050	#endif
1051
1052	/ TODO: png_set_PLTE has the side effect of setting png_ptr->palette to its*
1053	* own copy of the palette. This has the side effect that when png_start_row
1054	* is called (this happens after any call to png_read_update_info) the
1055	* info_ptr palette gets changed. This is extremely unexpected and
1056	* confusing.
1057	*
1058	* Fix this by not sharing the palette in this way.
1059	*/
1060	png_set_PLTE(png_ptr, info_ptr, palette, num);
1061
1062	/ The three chunks, bKGD, hIST and tRNS must appear after PLTE and before*
1063	* IDAT. Prior to 1.6.0 this was not checked; instead the code merely
1064	* checked the apparent validity of a tRNS chunk inserted before PLTE on a
1065	* palette PNG. 1.6.0 attempts to rigorously follow the standard and
1066	* therefore does a benign error if the erroneous condition is detected and
1067	* cancels the tRNS if the benign error returns. The alternative is to
1068	* amend the standard since it would be rather hypocritical of the standards
1069	* maintainers to ignore it.
1070	*/
1071	#ifdef PNG_READ_tRNS_SUPPORTED
1072	if (png_ptr->num_trans > `0` \|\|
1073	(info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != `0`))
1074	{
1075	/ Cancel this because otherwise it would be used if the transforms*
1076	* require it. Don't cancel the 'valid' flag because this would prevent
1077	* detection of duplicate chunks.
1078	*/
1079	png_ptr->num_trans = `0`;
1080
1081	if (info_ptr != NULL)
1082	info_ptr->num_trans = `0`;
1083
1084	png_chunk_benign_error(png_ptr, "tRNS must be after");
1085	}
1086	#endif
1087
1088	#ifdef PNG_READ_hIST_SUPPORTED
1089	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != `0`)
1090	png_chunk_benign_error(png_ptr, "hIST must be after");
1091	#endif
1092
1093	#ifdef PNG_READ_bKGD_SUPPORTED
1094	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != `0`)
1095	png_chunk_benign_error(png_ptr, "bKGD must be after");
1096	#endif
1097	}
1098
1099	void / PRIVATE /
1100	png_handle_IEND(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1101	{
1102	png_debug(`1`, "in png_handle_IEND");
1103
1104	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0` \|\|
1105	(png_ptr->mode & PNG_HAVE_IDAT) == `0`)
1106	png_chunk_error(png_ptr, "out of place");
1107
1108	png_ptr->mode \|= (PNG_AFTER_IDAT \| PNG_HAVE_IEND);
1109
1110	png_crc_finish(png_ptr, length);
1111
1112	if (length != `0`)
1113	png_chunk_benign_error(png_ptr, "invalid");
1114
1115	PNG_UNUSED(info_ptr)
1116	}
1117
1118	#ifdef PNG_READ_gAMA_SUPPORTED
1119	void / PRIVATE /
1120	png_handle_gAMA(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1121	{
1122	png_fixed_point igamma;
1123	png_byte buf[`4`];
1124
1125	png_debug(`1`, "in png_handle_gAMA");
1126
1127	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1128	png_chunk_error(png_ptr, "missing IHDR");
1129
1130	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1131	{
1132	png_crc_finish(png_ptr, length);
1133	png_chunk_benign_error(png_ptr, "out of place");
1134	return;
1135	}
1136
1137	if (length != `4`)
1138	{
1139	png_crc_finish(png_ptr, length);
1140	png_chunk_benign_error(png_ptr, "invalid");
1141	return;
1142	}
1143
1144	png_crc_read(png_ptr, buf, `4`);
1145
1146	if (png_crc_finish(png_ptr, `0`) != `0`)
1147	return;
1148
1149	igamma = png_get_fixed_point(NULL, buf);
1150
1151	png_colorspace_set_gamma(png_ptr, &png_ptr->colorspace, igamma);
1152	png_colorspace_sync(png_ptr, info_ptr);
1153	}
1154	#endif
1155
1156	#ifdef PNG_READ_sBIT_SUPPORTED
1157	void / PRIVATE /
1158	png_handle_sBIT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1159	{
1160	unsigned int truelen, i;
1161	png_byte sample_depth;
1162	png_byte buf[`4`];
1163
1164	png_debug(`1`, "in png_handle_sBIT");
1165
1166	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1167	png_chunk_error(png_ptr, "missing IHDR");
1168
1169	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1170	{
1171	png_crc_finish(png_ptr, length);
1172	png_chunk_benign_error(png_ptr, "out of place");
1173	return;
1174	}
1175
1176	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT) != `0`)
1177	{
1178	png_crc_finish(png_ptr, length);
1179	png_chunk_benign_error(png_ptr, "duplicate");
1180	return;
1181	}
1182
1183	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1184	{
1185	truelen = `3`;
1186	sample_depth = `8`;
1187	}
1188
1189	else
1190	{
1191	truelen = png_ptr->channels;
1192	sample_depth = png_ptr->bit_depth;
1193	}
1194
1195	if (length != truelen \|\| length > `4`)
1196	{
1197	png_chunk_benign_error(png_ptr, "invalid");
1198	png_crc_finish(png_ptr, length);
1199	return;
1200	}
1201
1202	buf[`0`] = buf[`1`] = buf[`2`] = buf[`3`] = sample_depth;
1203	png_crc_read(png_ptr, buf, truelen);
1204
1205	if (png_crc_finish(png_ptr, `0`) != `0`)
1206	return;
1207
1208	for (i=`0`; i<truelen; ++i)
1209	{
1210	if (buf[i] == `0` \|\| buf[i] > sample_depth)
1211	{
1212	png_chunk_benign_error(png_ptr, "invalid");
1213	return;
1214	}
1215	}
1216
1217	if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != `0`)
1218	{
1219	png_ptr->sig_bit.red = buf[`0`];
1220	png_ptr->sig_bit.green = buf[`1`];
1221	png_ptr->sig_bit.blue = buf[`2`];
1222	png_ptr->sig_bit.alpha = buf[`3`];
1223	}
1224
1225	else
1226	{
1227	png_ptr->sig_bit.gray = buf[`0`];
1228	png_ptr->sig_bit.red = buf[`0`];
1229	png_ptr->sig_bit.green = buf[`0`];
1230	png_ptr->sig_bit.blue = buf[`0`];
1231	png_ptr->sig_bit.alpha = buf[`1`];
1232	}
1233
1234	png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));
1235	}
1236	#endif
1237
1238	#ifdef PNG_READ_cHRM_SUPPORTED
1239	void / PRIVATE /
1240	png_handle_cHRM(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1241	{
1242	png_byte buf[`32`];
1243	png_xy xy;
1244
1245	png_debug(`1`, "in png_handle_cHRM");
1246
1247	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1248	png_chunk_error(png_ptr, "missing IHDR");
1249
1250	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1251	{
1252	png_crc_finish(png_ptr, length);
1253	png_chunk_benign_error(png_ptr, "out of place");
1254	return;
1255	}
1256
1257	if (length != `32`)
1258	{
1259	png_crc_finish(png_ptr, length);
1260	png_chunk_benign_error(png_ptr, "invalid");
1261	return;
1262	}
1263
1264	png_crc_read(png_ptr, buf, `32`);
1265
1266	if (png_crc_finish(png_ptr, `0`) != `0`)
1267	return;
1268
1269	xy.whitex = png_get_fixed_point(NULL, buf);
1270	xy.whitey = png_get_fixed_point(NULL, buf + `4`);
1271	xy.redx = png_get_fixed_point(NULL, buf + `8`);
1272	xy.redy = png_get_fixed_point(NULL, buf + `12`);
1273	xy.greenx = png_get_fixed_point(NULL, buf + `16`);
1274	xy.greeny = png_get_fixed_point(NULL, buf + `20`);
1275	xy.bluex = png_get_fixed_point(NULL, buf + `24`);
1276	xy.bluey = png_get_fixed_point(NULL, buf + `28`);
1277
1278	if (xy.whitex == PNG_FIXED_ERROR \|\|
1279	xy.whitey == PNG_FIXED_ERROR \|\|
1280	xy.redx == PNG_FIXED_ERROR \|\|
1281	xy.redy == PNG_FIXED_ERROR \|\|
1282	xy.greenx == PNG_FIXED_ERROR \|\|
1283	xy.greeny == PNG_FIXED_ERROR \|\|
1284	xy.bluex == PNG_FIXED_ERROR \|\|
1285	xy.bluey == PNG_FIXED_ERROR)
1286	{
1287	png_chunk_benign_error(png_ptr, "invalid values");
1288	return;
1289	}
1290
1291	/ If a colorspace error has already been output skip this chunk /
1292	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != `0`)
1293	return;
1294
1295	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_FROM_cHRM) != `0`)
1296	{
1297	png_ptr->colorspace.flags \|= PNG_COLORSPACE_INVALID;
1298	png_colorspace_sync(png_ptr, info_ptr);
1299	png_chunk_benign_error(png_ptr, "duplicate");
1300	return;
1301	}
1302
1303	png_ptr->colorspace.flags \|= PNG_COLORSPACE_FROM_cHRM;
1304	(void)png_colorspace_set_chromaticities(png_ptr, &png_ptr->colorspace, &xy,
1305	`1`/prefer cHRM values/);
1306	png_colorspace_sync(png_ptr, info_ptr);
1307	}
1308	#endif
1309
1310	#ifdef PNG_READ_sRGB_SUPPORTED
1311	void / PRIVATE /
1312	png_handle_sRGB(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1313	{
1314	png_byte intent;
1315
1316	png_debug(`1`, "in png_handle_sRGB");
1317
1318	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1319	png_chunk_error(png_ptr, "missing IHDR");
1320
1321	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1322	{
1323	png_crc_finish(png_ptr, length);
1324	png_chunk_benign_error(png_ptr, "out of place");
1325	return;
1326	}
1327
1328	if (length != `1`)
1329	{
1330	png_crc_finish(png_ptr, length);
1331	png_chunk_benign_error(png_ptr, "invalid");
1332	return;
1333	}
1334
1335	png_crc_read(png_ptr, &intent, `1`);
1336
1337	if (png_crc_finish(png_ptr, `0`) != `0`)
1338	return;
1339
1340	/ If a colorspace error has already been output skip this chunk /
1341	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != `0`)
1342	return;
1343
1344	/ Only one sRGB or iCCP chunk is allowed, use the HAVE_INTENT flag to detect*
1345	* this.
1346	*/
1347	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) != `0`)
1348	{
1349	png_ptr->colorspace.flags \|= PNG_COLORSPACE_INVALID;
1350	png_colorspace_sync(png_ptr, info_ptr);
1351	png_chunk_benign_error(png_ptr, "too many profiles");
1352	return;
1353	}
1354
1355	(void)png_colorspace_set_sRGB(png_ptr, &png_ptr->colorspace, intent);
1356	png_colorspace_sync(png_ptr, info_ptr);
1357	}
1358	#endif /* READ_sRGB */
1359
1360	#ifdef PNG_READ_iCCP_SUPPORTED
1361	void / PRIVATE /
1362	png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1363	/ Note: this does not properly handle profiles that are > 64K under DOS /
1364	{
1365	png_const_charp errmsg = NULL; / error message output, or no error /
1366	int finished = `0`; / crc checked /
1367
1368	png_debug(`1`, "in png_handle_iCCP");
1369
1370	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1371	png_chunk_error(png_ptr, "missing IHDR");
1372
1373	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1374	{
1375	png_crc_finish(png_ptr, length);
1376	png_chunk_benign_error(png_ptr, "out of place");
1377	return;
1378	}
1379
1380	/* Consistent with all the above colorspace handling an obviously invalid
1381	* chunk is just ignored, so does not invalidate the color space. An
1382	* alternative is to set the 'invalid' flags at the start of this routine
1383	* and only clear them in they were not set before and all the tests pass.
1384	*/
1385
1386	/ The keyword must be at least one character and there is a*
1387	* terminator (0) byte and the compression method byte, and the
1388	* 'zlib' datastream is at least 11 bytes.
1389	*/
1390	if (length < `14`)
1391	{
1392	png_crc_finish(png_ptr, length);
1393	png_chunk_benign_error(png_ptr, "too short");
1394	return;
1395	}
1396
1397	/ If a colorspace error has already been output skip this chunk /
1398	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != `0`)
1399	{
1400	png_crc_finish(png_ptr, length);
1401	return;
1402	}
1403
1404	/ Only one sRGB or iCCP chunk is allowed, use the HAVE_INTENT flag to detect*
1405	* this.
1406	*/
1407	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) == `0`)
1408	{
1409	uInt read_length, keyword_length;
1410	char keyword[`81`];
1411
1412	/ Find the keyword; the keyword plus separator and compression method*
1413	* bytes can be at most 81 characters long.
1414	*/
1415	read_length = `81`; / maximum /
1416	if (read_length > length)
1417	read_length = (uInt)length;
1418
1419	png_crc_read(png_ptr, (png_bytep)keyword, read_length);
1420	length -= read_length;
1421
1422	/ The minimum 'zlib' stream is assumed to be just the 2 byte header,*
1423	* 5 bytes minimum 'deflate' stream, and the 4 byte checksum.
1424	*/
1425	if (length < `11`)
1426	{
1427	png_crc_finish(png_ptr, length);
1428	png_chunk_benign_error(png_ptr, "too short");
1429	return;
1430	}
1431
1432	keyword_length = `0`;
1433	while (keyword_length < `80` && keyword_length < read_length &&
1434	keyword[keyword_length] != `0`)
1435	++keyword_length;
1436
1437	/ TODO: make the keyword checking common /
1438	if (keyword_length >= `1` && keyword_length <= `79`)
1439	{
1440	/ We only understand '0' compression - deflate - so if we get a*
1441	* different value we can't safely decode the chunk.
1442	*/
1443	if (keyword_length+`1` < read_length &&
1444	keyword[keyword_length+`1`] == PNG_COMPRESSION_TYPE_BASE)
1445	{
1446	read_length -= keyword_length+`2`;
1447
1448	if (png_inflate_claim(png_ptr, png_iCCP) == Z_OK)
1449	{
1450	Byte profile_header[`132`]={`0`};
1451	Byte local_buffer[PNG_INFLATE_BUF_SIZE];
1452	png_alloc_size_t size = (sizeof profile_header);
1453
1454	png_ptr->zstream.next_in = (Bytef*)keyword + (keyword_length+`2`);
1455	png_ptr->zstream.avail_in = read_length;
1456	(void)png_inflate_read(png_ptr, local_buffer,
1457	(sizeof local_buffer), &length, profile_header, &size,
1458	`0`/finish: don't, because the output is too small/);
1459
1460	if (size == `0`)
1461	{
1462	/ We have the ICC profile header; do the basic header checks.*
1463	*/
1464	png_uint_32 profile_length = png_get_uint_32(profile_header);
1465
1466	if (png_icc_check_length(png_ptr, &png_ptr->colorspace,
1467	keyword, profile_length) != `0`)
1468	{
1469	/ The length is apparently ok, so we can check the 132*
1470	* byte header.
1471	*/
1472	if (png_icc_check_header(png_ptr, &png_ptr->colorspace,
1473	keyword, profile_length, profile_header,
1474	png_ptr->color_type) != `0`)
1475	{
1476	/ Now read the tag table; a variable size buffer is*
1477	* needed at this point, allocate one for the whole
1478	* profile. The header check has already validated
1479	* that none of this stuff will overflow.
1480	*/
1481	png_uint_32 tag_count =
1482	png_get_uint_32(profile_header + `128`);
1483	png_bytep profile = png_read_buffer(png_ptr,
1484	profile_length, `2`/silent/);
1485
1486	if (profile != NULL)
1487	{
1488	memcpy(profile, profile_header,
1489	(sizeof profile_header));
1490
1491	size = `12` * tag_count;
1492
1493	(void)png_inflate_read(png_ptr, local_buffer,
1494	(sizeof local_buffer), &length,
1495	profile + (sizeof profile_header), &size, `0`);
1496
1497	/ Still expect a buffer error because we expect*
1498	* there to be some tag data!
1499	*/
1500	if (size == `0`)
1501	{
1502	if (png_icc_check_tag_table(png_ptr,
1503	&png_ptr->colorspace, keyword, profile_length,
1504	profile) != `0`)
1505	{
1506	/ The profile has been validated for basic*
1507	* security issues, so read the whole thing in.
1508	*/
1509	size = profile_length - (sizeof profile_header)
1510	- `12` * tag_count;
1511
1512	(void)png_inflate_read(png_ptr, local_buffer,
1513	(sizeof local_buffer), &length,
1514	profile + (sizeof profile_header) +
1515	`12` * tag_count, &size, `1`/finish/);
1516
1517	if (length > `0` && !(png_ptr->flags &
1518	PNG_FLAG_BENIGN_ERRORS_WARN))
1519	errmsg = "extra compressed data";
1520
1521	/ But otherwise allow extra data: /
1522	else if (size == `0`)
1523	{
1524	if (length > `0`)
1525	{
1526	/ This can be handled completely, so*
1527	* keep going.
1528	*/
1529	png_chunk_warning(png_ptr,
1530	"extra compressed data");
1531	}
1532
1533	png_crc_finish(png_ptr, length);
1534	finished = `1`;
1535
1536	# if defined(PNG_sRGB_SUPPORTED) && PNG_sRGB_PROFILE_CHECKS >= 0
1537	/ Check for a match against sRGB /
1538	png_icc_set_sRGB(png_ptr,
1539	&png_ptr->colorspace, profile,
1540	png_ptr->zstream.adler);
1541	# endif
1542
1543	/ Steal the profile for info_ptr. /
1544	if (info_ptr != NULL)
1545	{
1546	png_free_data(png_ptr, info_ptr,
1547	PNG_FREE_ICCP, `0`);
1548
1549	info_ptr->iccp_name = png_voidcast(char*,
1550	png_malloc_base(png_ptr,
1551	keyword_length+`1`));
1552	if (info_ptr->iccp_name != NULL)
1553	{
1554	memcpy(info_ptr->iccp_name, keyword,
1555	keyword_length+`1`);
1556	info_ptr->iccp_proflen =
1557	profile_length;
1558	info_ptr->iccp_profile = profile;
1559	png_ptr->read_buffer = NULL; /steal/
1560	info_ptr->free_me \|= PNG_FREE_ICCP;
1561	info_ptr->valid \|= PNG_INFO_iCCP;
1562	}
1563
1564	else
1565	{
1566	png_ptr->colorspace.flags \|=
1567	PNG_COLORSPACE_INVALID;
1568	errmsg = "out of memory";
1569	}
1570	}
1571
1572	/ else the profile remains in the read*
1573	* buffer which gets reused for subsequent
1574	* chunks.
1575	*/
1576
1577	if (info_ptr != NULL)
1578	png_colorspace_sync(png_ptr, info_ptr);
1579
1580	if (errmsg == NULL)
1581	{
1582	png_ptr->zowner = `0`;
1583	return;
1584	}
1585	}
1586	if (errmsg == NULL)
1587	errmsg = png_ptr->zstream.msg;
1588	}
1589	/ else png_icc_check_tag_table output an error /
1590	}
1591	else / profile truncated /
1592	errmsg = png_ptr->zstream.msg;
1593	}
1594
1595	else
1596	errmsg = "out of memory";
1597	}
1598
1599	/ else png_icc_check_header output an error /
1600	}
1601
1602	/ else png_icc_check_length output an error /
1603	}
1604
1605	else / profile truncated /
1606	errmsg = png_ptr->zstream.msg;
1607
1608	/ Release the stream /
1609	png_ptr->zowner = `0`;
1610	}
1611
1612	else / png_inflate_claim failed /
1613	errmsg = png_ptr->zstream.msg;
1614	}
1615
1616	else
1617	errmsg = "bad compression method"; / or missing /
1618	}
1619
1620	else
1621	errmsg = "bad keyword";
1622	}
1623
1624	else
1625	errmsg = "too many profiles";
1626
1627	/ Failure: the reason is in 'errmsg' /
1628	if (finished == `0`)
1629	png_crc_finish(png_ptr, length);
1630
1631	png_ptr->colorspace.flags \|= PNG_COLORSPACE_INVALID;
1632	png_colorspace_sync(png_ptr, info_ptr);
1633	if (errmsg != NULL) / else already output /
1634	png_chunk_benign_error(png_ptr, errmsg);
1635	}
1636	#endif /* READ_iCCP */
1637
1638	#ifdef PNG_READ_sPLT_SUPPORTED
1639	void / PRIVATE /
1640	png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1641	/ Note: this does not properly handle chunks that are > 64K under DOS /
1642	{
1643	png_bytep entry_start, buffer;
1644	png_sPLT_t new_palette;
1645	png_sPLT_entryp pp;
1646	png_uint_32 data_length;
1647	int entry_size, i;
1648	png_uint_32 skip = `0`;
1649	png_uint_32 dl;
1650	size_t max_dl;
1651
1652	png_debug(`1`, "in png_handle_sPLT");
1653
1654	#ifdef PNG_USER_LIMITS_SUPPORTED
1655	if (png_ptr->user_chunk_cache_max != `0`)
1656	{
1657	if (png_ptr->user_chunk_cache_max == `1`)
1658	{
1659	png_crc_finish(png_ptr, length);
1660	return;
1661	}
1662
1663	if (--png_ptr->user_chunk_cache_max == `1`)
1664	{
1665	png_warning(png_ptr, "No space in chunk cache for sPLT");
1666	png_crc_finish(png_ptr, length);
1667	return;
1668	}
1669	}
1670	#endif
1671
1672	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1673	png_chunk_error(png_ptr, "missing IHDR");
1674
1675	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
1676	{
1677	png_crc_finish(png_ptr, length);
1678	png_chunk_benign_error(png_ptr, "out of place");
1679	return;
1680	}
1681
1682	#ifdef PNG_MAX_MALLOC_64K
1683	if (length > `65535U`)
1684	{
1685	png_crc_finish(png_ptr, length);
1686	png_chunk_benign_error(png_ptr, "too large to fit in memory");
1687	return;
1688	}
1689	#endif
1690
1691	buffer = png_read_buffer(png_ptr, length+`1`, `2`/silent/);
1692	if (buffer == NULL)
1693	{
1694	png_crc_finish(png_ptr, length);
1695	png_chunk_benign_error(png_ptr, "out of memory");
1696	return;
1697	}
1698
1699
1700	/ WARNING: this may break if size_t is less than 32 bits; it is assumed*
1701	* that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a
1702	* potential breakage point if the types in pngconf.h aren't exactly right.
1703	*/
1704	png_crc_read(png_ptr, buffer, length);
1705
1706	if (png_crc_finish(png_ptr, skip) != `0`)
1707	return;
1708
1709	buffer[length] = `0`;
1710
1711	for (entry_start = buffer; *entry_start; entry_start++)
1712	/ Empty loop to find end of name / ;
1713
1714	++entry_start;
1715
1716	/ A sample depth should follow the separator, and we should be on it /
1717	if (length < `2U` \|\| entry_start > buffer + (length - `2U`))
1718	{
1719	png_warning(png_ptr, "malformed sPLT chunk");
1720	return;
1721	}
1722
1723	new_palette.depth = *entry_start++;
1724	entry_size = (new_palette.depth == `8` ? `6` : `10`);
1725	/ This must fit in a png_uint_32 because it is derived from the original*
1726	* chunk data length.
1727	*/
1728	data_length = length - (png_uint_32)(entry_start - buffer);
1729
1730	/ Integrity-check the data length /
1731	if ((data_length % (unsigned int)entry_size) != `0`)
1732	{
1733	png_warning(png_ptr, "sPLT chunk has bad length");
1734	return;
1735	}
1736
1737	dl = (png_uint_32)(data_length / (unsigned int)entry_size);
1738	max_dl = PNG_SIZE_MAX / (sizeof (png_sPLT_entry));
1739
1740	if (dl > max_dl)
1741	{
1742	png_warning(png_ptr, "sPLT chunk too long");
1743	return;
1744	}
1745
1746	new_palette.nentries = (png_int_32)(data_length / (unsigned int)entry_size);
1747
1748	new_palette.entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
1749	(png_alloc_size_t) new_palette.nentries * (sizeof (png_sPLT_entry)));
1750
1751	if (new_palette.entries == NULL)
1752	{
1753	png_warning(png_ptr, "sPLT chunk requires too much memory");
1754	return;
1755	}
1756
1757	#ifdef PNG_POINTER_INDEXING_SUPPORTED
1758	for (i = `0`; i < new_palette.nentries; i++)
1759	{
1760	pp = new_palette.entries + i;
1761
1762	if (new_palette.depth == `8`)
1763	{
1764	pp->red = *entry_start++;
1765	pp->green = *entry_start++;
1766	pp->blue = *entry_start++;
1767	pp->alpha = *entry_start++;
1768	}
1769
1770	else
1771	{
1772	pp->red = png_get_uint_16(entry_start); entry_start += `2`;
1773	pp->green = png_get_uint_16(entry_start); entry_start += `2`;
1774	pp->blue = png_get_uint_16(entry_start); entry_start += `2`;
1775	pp->alpha = png_get_uint_16(entry_start); entry_start += `2`;
1776	}
1777
1778	pp->frequency = png_get_uint_16(entry_start); entry_start += `2`;
1779	}
1780	#else
1781	pp = new_palette.entries;
1782
1783	for (i = `0`; i < new_palette.nentries; i++)
1784	{
1785
1786	if (new_palette.depth == `8`)
1787	{
1788	pp[i].red = *entry_start++;
1789	pp[i].green = *entry_start++;
1790	pp[i].blue = *entry_start++;
1791	pp[i].alpha = *entry_start++;
1792	}
1793
1794	else
1795	{
1796	pp[i].red = png_get_uint_16(entry_start); entry_start += `2`;
1797	pp[i].green = png_get_uint_16(entry_start); entry_start += `2`;
1798	pp[i].blue = png_get_uint_16(entry_start); entry_start += `2`;
1799	pp[i].alpha = png_get_uint_16(entry_start); entry_start += `2`;
1800	}
1801
1802	pp[i].frequency = png_get_uint_16(entry_start); entry_start += `2`;
1803	}
1804	#endif
1805
1806	/ Discard all chunk data except the name and stash that /
1807	new_palette.name = (png_charp)buffer;
1808
1809	png_set_sPLT(png_ptr, info_ptr, &new_palette, `1`);
1810
1811	png_free(png_ptr, new_palette.entries);
1812	}
1813	#endif /* READ_sPLT */
1814
1815	#ifdef PNG_READ_tRNS_SUPPORTED
1816	void / PRIVATE /
1817	png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1818	{
1819	png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
1820
1821	png_debug(`1`, "in png_handle_tRNS");
1822
1823	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1824	png_chunk_error(png_ptr, "missing IHDR");
1825
1826	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
1827	{
1828	png_crc_finish(png_ptr, length);
1829	png_chunk_benign_error(png_ptr, "out of place");
1830	return;
1831	}
1832
1833	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != `0`)
1834	{
1835	png_crc_finish(png_ptr, length);
1836	png_chunk_benign_error(png_ptr, "duplicate");
1837	return;
1838	}
1839
1840	if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
1841	{
1842	png_byte buf[`2`];
1843
1844	if (length != `2`)
1845	{
1846	png_crc_finish(png_ptr, length);
1847	png_chunk_benign_error(png_ptr, "invalid");
1848	return;
1849	}
1850
1851	png_crc_read(png_ptr, buf, `2`);
1852	png_ptr->num_trans = `1`;
1853	png_ptr->trans_color.gray = png_get_uint_16(buf);
1854	}
1855
1856	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
1857	{
1858	png_byte buf[`6`];
1859
1860	if (length != `6`)
1861	{
1862	png_crc_finish(png_ptr, length);
1863	png_chunk_benign_error(png_ptr, "invalid");
1864	return;
1865	}
1866
1867	png_crc_read(png_ptr, buf, length);
1868	png_ptr->num_trans = `1`;
1869	png_ptr->trans_color.red = png_get_uint_16(buf);
1870	png_ptr->trans_color.green = png_get_uint_16(buf + `2`);
1871	png_ptr->trans_color.blue = png_get_uint_16(buf + `4`);
1872	}
1873
1874	else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1875	{
1876	if ((png_ptr->mode & PNG_HAVE_PLTE) == `0`)
1877	{
1878	/ TODO: is this actually an error in the ISO spec? /
1879	png_crc_finish(png_ptr, length);
1880	png_chunk_benign_error(png_ptr, "out of place");
1881	return;
1882	}
1883
1884	if (length > (unsigned int) png_ptr->num_palette \|\|
1885	length > (unsigned int) PNG_MAX_PALETTE_LENGTH \|\|
1886	length == `0`)
1887	{
1888	png_crc_finish(png_ptr, length);
1889	png_chunk_benign_error(png_ptr, "invalid");
1890	return;
1891	}
1892
1893	png_crc_read(png_ptr, readbuf, length);
1894	png_ptr->num_trans = (png_uint_16)length;
1895	}
1896
1897	else
1898	{
1899	png_crc_finish(png_ptr, length);
1900	png_chunk_benign_error(png_ptr, "invalid with alpha channel");
1901	return;
1902	}
1903
1904	if (png_crc_finish(png_ptr, `0`) != `0`)
1905	{
1906	png_ptr->num_trans = `0`;
1907	return;
1908	}
1909
1910	/ TODO: this is a horrible side effect in the palette case because the*
1911	* png_struct ends up with a pointer to the tRNS buffer owned by the
1912	* png_info. Fix this.
1913	*/
1914	png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
1915	&(png_ptr->trans_color));
1916	}
1917	#endif
1918
1919	#ifdef PNG_READ_bKGD_SUPPORTED
1920	void / PRIVATE /
1921	png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1922	{
1923	unsigned int truelen;
1924	png_byte buf[`6`];
1925	png_color_16 background;
1926
1927	png_debug(`1`, "in png_handle_bKGD");
1928
1929	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1930	png_chunk_error(png_ptr, "missing IHDR");
1931
1932	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0` \|\|
1933	(png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
1934	(png_ptr->mode & PNG_HAVE_PLTE) == `0`))
1935	{
1936	png_crc_finish(png_ptr, length);
1937	png_chunk_benign_error(png_ptr, "out of place");
1938	return;
1939	}
1940
1941	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != `0`)
1942	{
1943	png_crc_finish(png_ptr, length);
1944	png_chunk_benign_error(png_ptr, "duplicate");
1945	return;
1946	}
1947
1948	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1949	truelen = `1`;
1950
1951	else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != `0`)
1952	truelen = `6`;
1953
1954	else
1955	truelen = `2`;
1956
1957	if (length != truelen)
1958	{
1959	png_crc_finish(png_ptr, length);
1960	png_chunk_benign_error(png_ptr, "invalid");
1961	return;
1962	}
1963
1964	png_crc_read(png_ptr, buf, truelen);
1965
1966	if (png_crc_finish(png_ptr, `0`) != `0`)
1967	return;
1968
1969	/ We convert the index value into RGB components so that we can allow*
1970	* arbitrary RGB values for background when we have transparency, and
1971	* so it is easy to determine the RGB values of the background color
1972	* from the info_ptr struct.
1973	*/
1974	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1975	{
1976	background.index = buf[`0`];
1977
1978	if (info_ptr != NULL && info_ptr->num_palette != `0`)
1979	{
1980	if (buf[`0`] >= info_ptr->num_palette)
1981	{
1982	png_chunk_benign_error(png_ptr, "invalid index");
1983	return;
1984	}
1985
1986	background.red = (png_uint_16)png_ptr->palette[buf[`0`]].red;
1987	background.green = (png_uint_16)png_ptr->palette[buf[`0`]].green;
1988	background.blue = (png_uint_16)png_ptr->palette[buf[`0`]].blue;
1989	}
1990
1991	else
1992	background.red = background.green = background.blue = `0`;
1993
1994	background.gray = `0`;
1995	}
1996
1997	else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == `0`) / GRAY /
1998	{
1999	if (png_ptr->bit_depth <= `8`)
2000	{
2001	if (buf[`0`] != `0` \|\| buf[`1`] >= (unsigned int)(`1` << png_ptr->bit_depth))
2002	{
2003	png_chunk_benign_error(png_ptr, "invalid gray level");
2004	return;
2005	}
2006	}
2007
2008	background.index = `0`;
2009	background.red =
2010	background.green =
2011	background.blue =
2012	background.gray = png_get_uint_16(buf);
2013	}
2014
2015	else
2016	{
2017	if (png_ptr->bit_depth <= `8`)
2018	{
2019	if (buf[`0`] != `0` \|\| buf[`2`] != `0` \|\| buf[`4`] != `0`)
2020	{
2021	png_chunk_benign_error(png_ptr, "invalid color");
2022	return;
2023	}
2024	}
2025
2026	background.index = `0`;
2027	background.red = png_get_uint_16(buf);
2028	background.green = png_get_uint_16(buf + `2`);
2029	background.blue = png_get_uint_16(buf + `4`);
2030	background.gray = `0`;
2031	}
2032
2033	png_set_bKGD(png_ptr, info_ptr, &background);
2034	}
2035	#endif
2036
2037	#ifdef PNG_READ_eXIf_SUPPORTED
2038	void / PRIVATE /
2039	png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2040	{
2041	unsigned int i;
2042
2043	png_debug(`1`, "in png_handle_eXIf");
2044
2045	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2046	png_chunk_error(png_ptr, "missing IHDR");
2047
2048	if (length < `2`)
2049	{
2050	png_crc_finish(png_ptr, length);
2051	png_chunk_benign_error(png_ptr, "too short");
2052	return;
2053	}
2054
2055	else if (info_ptr == NULL \|\| (info_ptr->valid & PNG_INFO_eXIf) != `0`)
2056	{
2057	png_crc_finish(png_ptr, length);
2058	png_chunk_benign_error(png_ptr, "duplicate");
2059	return;
2060	}
2061
2062	info_ptr->free_me \|= PNG_FREE_EXIF;
2063
2064	info_ptr->eXIf_buf = png_voidcast(png_bytep,
2065	png_malloc_warn(png_ptr, length));
2066
2067	if (info_ptr->eXIf_buf == NULL)
2068	{
2069	png_crc_finish(png_ptr, length);
2070	png_chunk_benign_error(png_ptr, "out of memory");
2071	return;
2072	}
2073
2074	for (i = `0`; i < length; i++)
2075	{
2076	png_byte buf[`1`];
2077	png_crc_read(png_ptr, buf, `1`);
2078	info_ptr->eXIf_buf[i] = buf[`0`];
2079	if (i == `1` && buf[`0`] != `'M'` && buf[`0`] != `'I'`
2080	&& info_ptr->eXIf_buf[`0`] != buf[`0`])
2081	{
2082	png_crc_finish(png_ptr, length);
2083	png_chunk_benign_error(png_ptr, "incorrect byte-order specifier");
2084	png_free(png_ptr, info_ptr->eXIf_buf);
2085	info_ptr->eXIf_buf = NULL;
2086	return;
2087	}
2088	}
2089
2090	if (png_crc_finish(png_ptr, `0`) != `0`)
2091	return;
2092
2093	png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
2094
2095	png_free(png_ptr, info_ptr->eXIf_buf);
2096	info_ptr->eXIf_buf = NULL;
2097	}
2098	#endif
2099
2100	#ifdef PNG_READ_hIST_SUPPORTED
2101	void / PRIVATE /
2102	png_handle_hIST(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2103	{
2104	unsigned int num, i;
2105	png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
2106
2107	png_debug(`1`, "in png_handle_hIST");
2108
2109	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2110	png_chunk_error(png_ptr, "missing IHDR");
2111
2112	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0` \|\|
2113	(png_ptr->mode & PNG_HAVE_PLTE) == `0`)
2114	{
2115	png_crc_finish(png_ptr, length);
2116	png_chunk_benign_error(png_ptr, "out of place");
2117	return;
2118	}
2119
2120	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != `0`)
2121	{
2122	png_crc_finish(png_ptr, length);
2123	png_chunk_benign_error(png_ptr, "duplicate");
2124	return;
2125	}
2126
2127	num = length / `2` ;
2128
2129	if (num != (unsigned int) png_ptr->num_palette \|\|
2130	num > (unsigned int) PNG_MAX_PALETTE_LENGTH)
2131	{
2132	png_crc_finish(png_ptr, length);
2133	png_chunk_benign_error(png_ptr, "invalid");
2134	return;
2135	}
2136
2137	for (i = `0`; i < num; i++)
2138	{
2139	png_byte buf[`2`];
2140
2141	png_crc_read(png_ptr, buf, `2`);
2142	readbuf[i] = png_get_uint_16(buf);
2143	}
2144
2145	if (png_crc_finish(png_ptr, `0`) != `0`)
2146	return;
2147
2148	png_set_hIST(png_ptr, info_ptr, readbuf);
2149	}
2150	#endif
2151
2152	#ifdef PNG_READ_pHYs_SUPPORTED
2153	void / PRIVATE /
2154	png_handle_pHYs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2155	{
2156	png_byte buf[`9`];
2157	png_uint_32 res_x, res_y;
2158	int unit_type;
2159
2160	png_debug(`1`, "in png_handle_pHYs");
2161
2162	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2163	png_chunk_error(png_ptr, "missing IHDR");
2164
2165	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2166	{
2167	png_crc_finish(png_ptr, length);
2168	png_chunk_benign_error(png_ptr, "out of place");
2169	return;
2170	}
2171
2172	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs) != `0`)
2173	{
2174	png_crc_finish(png_ptr, length);
2175	png_chunk_benign_error(png_ptr, "duplicate");
2176	return;
2177	}
2178
2179	if (length != `9`)
2180	{
2181	png_crc_finish(png_ptr, length);
2182	png_chunk_benign_error(png_ptr, "invalid");
2183	return;
2184	}
2185
2186	png_crc_read(png_ptr, buf, `9`);
2187
2188	if (png_crc_finish(png_ptr, `0`) != `0`)
2189	return;
2190
2191	res_x = png_get_uint_32(buf);
2192	res_y = png_get_uint_32(buf + `4`);
2193	unit_type = buf[`8`];
2194	png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type);
2195	}
2196	#endif
2197
2198	#ifdef PNG_READ_oFFs_SUPPORTED
2199	void / PRIVATE /
2200	png_handle_oFFs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2201	{
2202	png_byte buf[`9`];
2203	png_int_32 offset_x, offset_y;
2204	int unit_type;
2205
2206	png_debug(`1`, "in png_handle_oFFs");
2207
2208	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2209	png_chunk_error(png_ptr, "missing IHDR");
2210
2211	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2212	{
2213	png_crc_finish(png_ptr, length);
2214	png_chunk_benign_error(png_ptr, "out of place");
2215	return;
2216	}
2217
2218	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs) != `0`)
2219	{
2220	png_crc_finish(png_ptr, length);
2221	png_chunk_benign_error(png_ptr, "duplicate");
2222	return;
2223	}
2224
2225	if (length != `9`)
2226	{
2227	png_crc_finish(png_ptr, length);
2228	png_chunk_benign_error(png_ptr, "invalid");
2229	return;
2230	}
2231
2232	png_crc_read(png_ptr, buf, `9`);
2233
2234	if (png_crc_finish(png_ptr, `0`) != `0`)
2235	return;
2236
2237	offset_x = png_get_int_32(buf);
2238	offset_y = png_get_int_32(buf + `4`);
2239	unit_type = buf[`8`];
2240	png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type);
2241	}
2242	#endif
2243
2244	#ifdef PNG_READ_pCAL_SUPPORTED
2245	/ Read the pCAL chunk (described in the PNG Extensions document) /
2246	void / PRIVATE /
2247	png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2248	{
2249	png_int_32 X0, X1;
2250	png_byte type, nparams;
2251	png_bytep buffer, buf, units, endptr;
2252	png_charpp params;
2253	int i;
2254
2255	png_debug(`1`, "in png_handle_pCAL");
2256
2257	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2258	png_chunk_error(png_ptr, "missing IHDR");
2259
2260	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2261	{
2262	png_crc_finish(png_ptr, length);
2263	png_chunk_benign_error(png_ptr, "out of place");
2264	return;
2265	}
2266
2267	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL) != `0`)
2268	{
2269	png_crc_finish(png_ptr, length);
2270	png_chunk_benign_error(png_ptr, "duplicate");
2271	return;
2272	}
2273
2274	png_debug1(`2`, "Allocating and reading pCAL chunk data (%u bytes)",
2275	length + `1`);
2276
2277	buffer = png_read_buffer(png_ptr, length+`1`, `2`/silent/);
2278
2279	if (buffer == NULL)
2280	{
2281	png_crc_finish(png_ptr, length);
2282	png_chunk_benign_error(png_ptr, "out of memory");
2283	return;
2284	}
2285
2286	png_crc_read(png_ptr, buffer, length);
2287
2288	if (png_crc_finish(png_ptr, `0`) != `0`)
2289	return;
2290
2291	buffer[length] = `0`; / Null terminate the last string /
2292
2293	png_debug(`3`, "Finding end of pCAL purpose string");
2294	for (buf = buffer; *buf; buf++)
2295	/ Empty loop / ;
2296
2297	endptr = buffer + length;
2298
2299	/ We need to have at least 12 bytes after the purpose string*
2300	* in order to get the parameter information.
2301	*/
2302	if (endptr - buf <= `12`)
2303	{
2304	png_chunk_benign_error(png_ptr, "invalid");
2305	return;
2306	}
2307
2308	png_debug(`3`, "Reading pCAL X0, X1, type, nparams, and units");
2309	X0 = png_get_int_32((png_bytep)buf+`1`);
2310	X1 = png_get_int_32((png_bytep)buf+`5`);
2311	type = buf[`9`];
2312	nparams = buf[`10`];
2313	units = buf + `11`;
2314
2315	png_debug(`3`, "Checking pCAL equation type and number of parameters");
2316	/ Check that we have the right number of parameters for known*
2317	* equation types.
2318	*/
2319	if ((type == PNG_EQUATION_LINEAR && nparams != `2`) \|\|
2320	(type == PNG_EQUATION_BASE_E && nparams != `3`) \|\|
2321	(type == PNG_EQUATION_ARBITRARY && nparams != `3`) \|\|
2322	(type == PNG_EQUATION_HYPERBOLIC && nparams != `4`))
2323	{
2324	png_chunk_benign_error(png_ptr, "invalid parameter count");
2325	return;
2326	}
2327
2328	else if (type >= PNG_EQUATION_LAST)
2329	{
2330	png_chunk_benign_error(png_ptr, "unrecognized equation type");
2331	}
2332
2333	for (buf = units; *buf; buf++)
2334	/ Empty loop to move past the units string. / ;
2335
2336	png_debug(`3`, "Allocating pCAL parameters array");
2337
2338	params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
2339	nparams * (sizeof (png_charp))));
2340
2341	if (params == NULL)
2342	{
2343	png_chunk_benign_error(png_ptr, "out of memory");
2344	return;
2345	}
2346
2347	/ Get pointers to the start of each parameter string. /
2348	for (i = `0`; i < nparams; i++)
2349	{
2350	buf++; / Skip the null string terminator from previous parameter. /
2351
2352	png_debug1(`3`, "Reading pCAL parameter %d", i);
2353
2354	for (params[i] = (png_charp)buf; buf <= endptr && *buf != `0`; buf++)
2355	/ Empty loop to move past each parameter string / ;
2356
2357	/ Make sure we haven't run out of data yet /
2358	if (buf > endptr)
2359	{
2360	png_free(png_ptr, params);
2361	png_chunk_benign_error(png_ptr, "invalid data");
2362	return;
2363	}
2364	}
2365
2366	png_set_pCAL(png_ptr, info_ptr, (png_charp)buffer, X0, X1, type, nparams,
2367	(png_charp)units, params);
2368
2369	png_free(png_ptr, params);
2370	}
2371	#endif
2372
2373	#ifdef PNG_READ_sCAL_SUPPORTED
2374	/ Read the sCAL chunk /
2375	void / PRIVATE /
2376	png_handle_sCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2377	{
2378	png_bytep buffer;
2379	size_t i;
2380	int state;
2381
2382	png_debug(`1`, "in png_handle_sCAL");
2383
2384	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2385	png_chunk_error(png_ptr, "missing IHDR");
2386
2387	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2388	{
2389	png_crc_finish(png_ptr, length);
2390	png_chunk_benign_error(png_ptr, "out of place");
2391	return;
2392	}
2393
2394	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL) != `0`)
2395	{
2396	png_crc_finish(png_ptr, length);
2397	png_chunk_benign_error(png_ptr, "duplicate");
2398	return;
2399	}
2400
2401	/ Need unit type, width, \0, height: minimum 4 bytes /
2402	else if (length < `4`)
2403	{
2404	png_crc_finish(png_ptr, length);
2405	png_chunk_benign_error(png_ptr, "invalid");
2406	return;
2407	}
2408
2409	png_debug1(`2`, "Allocating and reading sCAL chunk data (%u bytes)",
2410	length + `1`);
2411
2412	buffer = png_read_buffer(png_ptr, length+`1`, `2`/silent/);
2413
2414	if (buffer == NULL)
2415	{
2416	png_chunk_benign_error(png_ptr, "out of memory");
2417	png_crc_finish(png_ptr, length);
2418	return;
2419	}
2420
2421	png_crc_read(png_ptr, buffer, length);
2422	buffer[length] = `0`; / Null terminate the last string /
2423
2424	if (png_crc_finish(png_ptr, `0`) != `0`)
2425	return;
2426
2427	/ Validate the unit. /
2428	if (buffer[`0`] != `1` && buffer[`0`] != `2`)
2429	{
2430	png_chunk_benign_error(png_ptr, "invalid unit");
2431	return;
2432	}
2433
2434	/ Validate the ASCII numbers, need two ASCII numbers separated by*
2435	* a '\0' and they need to fit exactly in the chunk data.
2436	*/
2437	i = `1`;
2438	state = `0`;
2439
2440	if (png_check_fp_number((png_const_charp)buffer, length, &state, &i) == `0` \|\|
2441	i >= length \|\| buffer[i++] != `0`)
2442	png_chunk_benign_error(png_ptr, "bad width format");
2443
2444	else if (PNG_FP_IS_POSITIVE(state) == `0`)
2445	png_chunk_benign_error(png_ptr, "non-positive width");
2446
2447	else
2448	{
2449	size_t heighti = i;
2450
2451	state = `0`;
2452	if (png_check_fp_number((png_const_charp)buffer, length,
2453	&state, &i) == `0` \|\| i != length)
2454	png_chunk_benign_error(png_ptr, "bad height format");
2455
2456	else if (PNG_FP_IS_POSITIVE(state) == `0`)
2457	png_chunk_benign_error(png_ptr, "non-positive height");
2458
2459	else
2460	/ This is the (only) success case. /
2461	png_set_sCAL_s(png_ptr, info_ptr, buffer[`0`],
2462	(png_charp)buffer+`1`, (png_charp)buffer+heighti);
2463	}
2464	}
2465	#endif
2466
2467	#ifdef PNG_READ_tIME_SUPPORTED
2468	void / PRIVATE /
2469	png_handle_tIME(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2470	{
2471	png_byte buf[`7`];
2472	png_time mod_time;
2473
2474	png_debug(`1`, "in png_handle_tIME");
2475
2476	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2477	png_chunk_error(png_ptr, "missing IHDR");
2478
2479	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME) != `0`)
2480	{
2481	png_crc_finish(png_ptr, length);
2482	png_chunk_benign_error(png_ptr, "duplicate");
2483	return;
2484	}
2485
2486	if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2487	png_ptr->mode \|= PNG_AFTER_IDAT;
2488
2489	if (length != `7`)
2490	{
2491	png_crc_finish(png_ptr, length);
2492	png_chunk_benign_error(png_ptr, "invalid");
2493	return;
2494	}
2495
2496	png_crc_read(png_ptr, buf, `7`);
2497
2498	if (png_crc_finish(png_ptr, `0`) != `0`)
2499	return;
2500
2501	mod_time.second = buf[`6`];
2502	mod_time.minute = buf[`5`];
2503	mod_time.hour = buf[`4`];
2504	mod_time.day = buf[`3`];
2505	mod_time.month = buf[`2`];
2506	mod_time.year = png_get_uint_16(buf);
2507
2508	png_set_tIME(png_ptr, info_ptr, &mod_time);
2509	}
2510	#endif
2511
2512	#ifdef PNG_READ_tEXt_SUPPORTED
2513	/ Note: this does not properly handle chunks that are > 64K under DOS /
2514	void / PRIVATE /
2515	png_handle_tEXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2516	{
2517	png_text text_info;
2518	png_bytep buffer;
2519	png_charp key;
2520	png_charp text;
2521	png_uint_32 skip = `0`;
2522
2523	png_debug(`1`, "in png_handle_tEXt");
2524
2525	#ifdef PNG_USER_LIMITS_SUPPORTED
2526	if (png_ptr->user_chunk_cache_max != `0`)
2527	{
2528	if (png_ptr->user_chunk_cache_max == `1`)
2529	{
2530	png_crc_finish(png_ptr, length);
2531	return;
2532	}
2533
2534	if (--png_ptr->user_chunk_cache_max == `1`)
2535	{
2536	png_crc_finish(png_ptr, length);
2537	png_chunk_benign_error(png_ptr, "no space in chunk cache");
2538	return;
2539	}
2540	}
2541	#endif
2542
2543	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2544	png_chunk_error(png_ptr, "missing IHDR");
2545
2546	if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2547	png_ptr->mode \|= PNG_AFTER_IDAT;
2548
2549	#ifdef PNG_MAX_MALLOC_64K
2550	if (length > `65535U`)
2551	{
2552	png_crc_finish(png_ptr, length);
2553	png_chunk_benign_error(png_ptr, "too large to fit in memory");
2554	return;
2555	}
2556	#endif
2557
2558	buffer = png_read_buffer(png_ptr, length+`1`, `1`/warn/);
2559
2560	if (buffer == NULL)
2561	{
2562	png_chunk_benign_error(png_ptr, "out of memory");
2563	return;
2564	}
2565
2566	png_crc_read(png_ptr, buffer, length);
2567
2568	if (png_crc_finish(png_ptr, skip) != `0`)
2569	return;
2570
2571	key = (png_charp)buffer;
2572	key[length] = `0`;
2573
2574	for (text = key; *text; text++)
2575	/ Empty loop to find end of key / ;
2576
2577	if (text != key + length)
2578	text++;
2579
2580	text_info.compression = PNG_TEXT_COMPRESSION_NONE;
2581	text_info.key = key;
2582	text_info.lang = NULL;
2583	text_info.lang_key = NULL;
2584	text_info.itxt_length = `0`;
2585	text_info.text = text;
2586	text_info.text_length = strlen(text);
2587
2588	if (png_set_text_2(png_ptr, info_ptr, &text_info, `1`) != `0`)
2589	png_warning(png_ptr, "Insufficient memory to process text chunk");
2590	}
2591	#endif
2592
2593	#ifdef PNG_READ_zTXt_SUPPORTED
2594	/ Note: this does not correctly handle chunks that are > 64K under DOS /
2595	void / PRIVATE /
2596	png_handle_zTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2597	{
2598	png_const_charp errmsg = NULL;
2599	png_bytep buffer;
2600	png_uint_32 keyword_length;
2601
2602	png_debug(`1`, "in png_handle_zTXt");
2603
2604	#ifdef PNG_USER_LIMITS_SUPPORTED
2605	if (png_ptr->user_chunk_cache_max != `0`)
2606	{
2607	if (png_ptr->user_chunk_cache_max == `1`)
2608	{
2609	png_crc_finish(png_ptr, length);
2610	return;
2611	}
2612
2613	if (--png_ptr->user_chunk_cache_max == `1`)
2614	{
2615	png_crc_finish(png_ptr, length);
2616	png_chunk_benign_error(png_ptr, "no space in chunk cache");
2617	return;
2618	}
2619	}
2620	#endif
2621
2622	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2623	png_chunk_error(png_ptr, "missing IHDR");
2624
2625	if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2626	png_ptr->mode \|= PNG_AFTER_IDAT;
2627
2628	/ Note, "length" is sufficient here; we won't be adding*
2629	* a null terminator later.
2630	*/
2631	buffer = png_read_buffer(png_ptr, length, `2`/silent/);
2632
2633	if (buffer == NULL)
2634	{
2635	png_crc_finish(png_ptr, length);
2636	png_chunk_benign_error(png_ptr, "out of memory");
2637	return;
2638	}
2639
2640	png_crc_read(png_ptr, buffer, length);
2641
2642	if (png_crc_finish(png_ptr, `0`) != `0`)
2643	return;
2644
2645	/ TODO: also check that the keyword contents match the spec! /
2646	for (keyword_length = `0`;
2647	keyword_length < length && buffer[keyword_length] != `0`;
2648	++keyword_length)
2649	/ Empty loop to find end of name / ;
2650
2651	if (keyword_length > `79` \|\| keyword_length < `1`)
2652	errmsg = "bad keyword";
2653
2654	/ zTXt must have some LZ data after the keyword, although it may expand to*
2655	* zero bytes; we need a '\0' at the end of the keyword, the compression type
2656	* then the LZ data:
2657	*/
2658	else if (keyword_length + `3` > length)
2659	errmsg = "truncated";
2660
2661	else if (buffer[keyword_length+`1`] != PNG_COMPRESSION_TYPE_BASE)
2662	errmsg = "unknown compression type";
2663
2664	else
2665	{
2666	png_alloc_size_t uncompressed_length = PNG_SIZE_MAX;
2667
2668	/ TODO: at present png_decompress_chunk imposes a single application*
2669	* level memory limit, this should be split to different values for iCCP
2670	* and text chunks.
2671	*/
2672	if (png_decompress_chunk(png_ptr, length, keyword_length+`2`,
2673	&uncompressed_length, `1`/terminate/) == Z_STREAM_END)
2674	{
2675	png_text text;
2676
2677	if (png_ptr->read_buffer == NULL)
2678	errmsg="Read failure in png_handle_zTXt";
2679	else
2680	{
2681	/ It worked; png_ptr->read_buffer now looks like a tEXt chunk*
2682	* except for the extra compression type byte and the fact that
2683	* it isn't necessarily '\0' terminated.
2684	*/
2685	buffer = png_ptr->read_buffer;
2686	buffer[uncompressed_length+(keyword_length+`2`)] = `0`;
2687
2688	text.compression = PNG_TEXT_COMPRESSION_zTXt;
2689	text.key = (png_charp)buffer;
2690	text.text = (png_charp)(buffer + keyword_length+`2`);
2691	text.text_length = uncompressed_length;
2692	text.itxt_length = `0`;
2693	text.lang = NULL;
2694	text.lang_key = NULL;
2695
2696	if (png_set_text_2(png_ptr, info_ptr, &text, `1`) != `0`)
2697	errmsg = "insufficient memory";
2698	}
2699	}
2700
2701	else
2702	errmsg = png_ptr->zstream.msg;
2703	}
2704
2705	if (errmsg != NULL)
2706	png_chunk_benign_error(png_ptr, errmsg);
2707	}
2708	#endif
2709
2710	#ifdef PNG_READ_iTXt_SUPPORTED
2711	/ Note: this does not correctly handle chunks that are > 64K under DOS /
2712	void / PRIVATE /
2713	png_handle_iTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2714	{
2715	png_const_charp errmsg = NULL;
2716	png_bytep buffer;
2717	png_uint_32 prefix_length;
2718
2719	png_debug(`1`, "in png_handle_iTXt");
2720
2721	#ifdef PNG_USER_LIMITS_SUPPORTED
2722	if (png_ptr->user_chunk_cache_max != `0`)
2723	{
2724	if (png_ptr->user_chunk_cache_max == `1`)
2725	{
2726	png_crc_finish(png_ptr, length);
2727	return;
2728	}
2729
2730	if (--png_ptr->user_chunk_cache_max == `1`)
2731	{
2732	png_crc_finish(png_ptr, length);
2733	png_chunk_benign_error(png_ptr, "no space in chunk cache");
2734	return;
2735	}
2736	}
2737	#endif
2738
2739	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2740	png_chunk_error(png_ptr, "missing IHDR");
2741
2742	if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2743	png_ptr->mode \|= PNG_AFTER_IDAT;
2744
2745	buffer = png_read_buffer(png_ptr, length+`1`, `1`/warn/);
2746
2747	if (buffer == NULL)
2748	{
2749	png_crc_finish(png_ptr, length);
2750	png_chunk_benign_error(png_ptr, "out of memory");
2751	return;
2752	}
2753
2754	png_crc_read(png_ptr, buffer, length);
2755
2756	if (png_crc_finish(png_ptr, `0`) != `0`)
2757	return;
2758
2759	/ First the keyword. /
2760	for (prefix_length=`0`;
2761	prefix_length < length && buffer[prefix_length] != `0`;
2762	++prefix_length)
2763	/ Empty loop / ;
2764
2765	/ Perform a basic check on the keyword length here. /
2766	if (prefix_length > `79` \|\| prefix_length < `1`)
2767	errmsg = "bad keyword";
2768
2769	/ Expect keyword, compression flag, compression type, language, translated*
2770	* keyword (both may be empty but are 0 terminated) then the text, which may
2771	* be empty.
2772	*/
2773	else if (prefix_length + `5` > length)
2774	errmsg = "truncated";
2775
2776	else if (buffer[prefix_length+`1`] == `0` \|\|
2777	(buffer[prefix_length+`1`] == `1` &&
2778	buffer[prefix_length+`2`] == PNG_COMPRESSION_TYPE_BASE))
2779	{
2780	int compressed = buffer[prefix_length+`1`] != `0`;
2781	png_uint_32 language_offset, translated_keyword_offset;
2782	png_alloc_size_t uncompressed_length = `0`;
2783
2784	/ Now the language tag /
2785	prefix_length += `3`;
2786	language_offset = prefix_length;
2787
2788	for (; prefix_length < length && buffer[prefix_length] != `0`;
2789	++prefix_length)
2790	/ Empty loop / ;
2791
2792	/ WARNING: the length may be invalid here, this is checked below. /
2793	translated_keyword_offset = ++prefix_length;
2794
2795	for (; prefix_length < length && buffer[prefix_length] != `0`;
2796	++prefix_length)
2797	/ Empty loop / ;
2798
2799	/ prefix_length should now be at the trailing '\0' of the translated*
2800	* keyword, but it may already be over the end. None of this arithmetic
2801	* can overflow because chunks are at most 2^31 bytes long, but on 16-bit
2802	* systems the available allocation may overflow.
2803	*/
2804	++prefix_length;
2805
2806	if (compressed == `0` && prefix_length <= length)
2807	uncompressed_length = length - prefix_length;
2808
2809	else if (compressed != `0` && prefix_length < length)
2810	{
2811	uncompressed_length = PNG_SIZE_MAX;
2812
2813	/ TODO: at present png_decompress_chunk imposes a single application*
2814	* level memory limit, this should be split to different values for
2815	* iCCP and text chunks.
2816	*/
2817	if (png_decompress_chunk(png_ptr, length, prefix_length,
2818	&uncompressed_length, `1`/terminate/) == Z_STREAM_END)
2819	buffer = png_ptr->read_buffer;
2820
2821	else
2822	errmsg = png_ptr->zstream.msg;
2823	}
2824
2825	else
2826	errmsg = "truncated";
2827
2828	if (errmsg == NULL)
2829	{
2830	png_text text;
2831
2832	buffer[uncompressed_length+prefix_length] = `0`;
2833
2834	if (compressed == `0`)
2835	text.compression = PNG_ITXT_COMPRESSION_NONE;
2836
2837	else
2838	text.compression = PNG_ITXT_COMPRESSION_zTXt;
2839
2840	text.key = (png_charp)buffer;
2841	text.lang = (png_charp)buffer + language_offset;
2842	text.lang_key = (png_charp)buffer + translated_keyword_offset;
2843	text.text = (png_charp)buffer + prefix_length;
2844	text.text_length = `0`;
2845	text.itxt_length = uncompressed_length;
2846
2847	if (png_set_text_2(png_ptr, info_ptr, &text, `1`) != `0`)
2848	errmsg = "insufficient memory";
2849	}
2850	}
2851
2852	else
2853	errmsg = "bad compression info";
2854
2855	if (errmsg != NULL)
2856	png_chunk_benign_error(png_ptr, errmsg);
2857	}
2858	#endif
2859
2860	#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
2861	/ Utility function for png_handle_unknown; set up png_ptr::unknown_chunk /
2862	static int
2863	png_cache_unknown_chunk(png_structrp png_ptr, png_uint_32 length)
2864	{
2865	png_alloc_size_t limit = PNG_SIZE_MAX;
2866
2867	if (png_ptr->unknown_chunk.data != NULL)
2868	{
2869	png_free(png_ptr, png_ptr->unknown_chunk.data);
2870	png_ptr->unknown_chunk.data = NULL;
2871	}
2872
2873	# ifdef PNG_SET_USER_LIMITS_SUPPORTED
2874	if (png_ptr->user_chunk_malloc_max > `0` &&
2875	png_ptr->user_chunk_malloc_max < limit)
2876	limit = png_ptr->user_chunk_malloc_max;
2877
2878	# elif PNG_USER_CHUNK_MALLOC_MAX > 0
2879	if (PNG_USER_CHUNK_MALLOC_MAX < limit)
2880	limit = PNG_USER_CHUNK_MALLOC_MAX;
2881	# endif
2882
2883	if (length <= limit)
2884	{
2885	PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
2886	/ The following is safe because of the PNG_SIZE_MAX init above /
2887	png_ptr->unknown_chunk.size = (size_t)length/SAFE/;
2888	/ 'mode' is a flag array, only the bottom four bits matter here /
2889	png_ptr->unknown_chunk.location = (png_byte)png_ptr->mode/SAFE/;
2890
2891	if (length == `0`)
2892	png_ptr->unknown_chunk.data = NULL;
2893
2894	else
2895	{
2896	/ Do a 'warn' here - it is handled below. /
2897	png_ptr->unknown_chunk.data = png_voidcast(png_bytep,
2898	png_malloc_warn(png_ptr, length));
2899	}
2900	}
2901
2902	if (png_ptr->unknown_chunk.data == NULL && length > `0`)
2903	{
2904	/ This is benign because we clean up correctly /
2905	png_crc_finish(png_ptr, length);
2906	png_chunk_benign_error(png_ptr, "unknown chunk exceeds memory limits");
2907	return `0`;
2908	}
2909
2910	else
2911	{
2912	if (length > `0`)
2913	png_crc_read(png_ptr, png_ptr->unknown_chunk.data, length);
2914	png_crc_finish(png_ptr, `0`);
2915	return `1`;
2916	}
2917	}
2918	#endif /* READ_UNKNOWN_CHUNKS */
2919
2920	/ Handle an unknown, or known but disabled, chunk /
2921	void / PRIVATE /
2922	png_handle_unknown(png_structrp png_ptr, png_inforp info_ptr,
2923	png_uint_32 length, int keep)
2924	{
2925	int handled = `0`; / the chunk was handled /
2926
2927	png_debug(`1`, "in png_handle_unknown");
2928
2929	#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
2930	/ NOTE: this code is based on the code in libpng-1.4.12 except for fixing*
2931	* the bug which meant that setting a non-default behavior for a specific
2932	* chunk would be ignored (the default was always used unless a user
2933	* callback was installed).
2934	*
2935	* 'keep' is the value from the png_chunk_unknown_handling, the setting for
2936	* this specific chunk_name, if PNG_HANDLE_AS_UNKNOWN_SUPPORTED, if not it
2937	* will always be PNG_HANDLE_CHUNK_AS_DEFAULT and it needs to be set here.
2938	* This is just an optimization to avoid multiple calls to the lookup
2939	* function.
2940	*/
2941	# ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
2942	# ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
2943	keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name);
2944	# endif
2945	# endif
2946
2947	/ One of the following methods will read the chunk or skip it (at least one*
2948	* of these is always defined because this is the only way to switch on
2949	* PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
2950	*/
2951	# ifdef PNG_READ_USER_CHUNKS_SUPPORTED
2952	/ The user callback takes precedence over the chunk keep value, but the*
2953	* keep value is still required to validate a save of a critical chunk.
2954	*/
2955	if (png_ptr->read_user_chunk_fn != NULL)
2956	{
2957	if (png_cache_unknown_chunk(png_ptr, length) != `0`)
2958	{
2959	/ Callback to user unknown chunk handler /
2960	int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr,
2961	&png_ptr->unknown_chunk);
2962
2963	/ ret is:*
2964	* negative: An error occurred; png_chunk_error will be called.
2965	* zero: The chunk was not handled, the chunk will be discarded
2966	* unless png_set_keep_unknown_chunks has been used to set
2967	* a 'keep' behavior for this particular chunk, in which
2968	* case that will be used. A critical chunk will cause an
2969	* error at this point unless it is to be saved.
2970	* positive: The chunk was handled, libpng will ignore/discard it.
2971	*/
2972	if (ret < `0`)
2973	png_chunk_error(png_ptr, "error in user chunk");
2974
2975	else if (ret == `0`)
2976	{
2977	/ If the keep value is 'default' or 'never' override it, but*
2978	* still error out on critical chunks unless the keep value is
2979	* 'always' While this is weird it is the behavior in 1.4.12.
2980	* A possible improvement would be to obey the value set for the
2981	* chunk, but this would be an API change that would probably
2982	* damage some applications.
2983	*
2984	* The png_app_warning below catches the case that matters, where
2985	* the application has not set specific save or ignore for this
2986	* chunk or global save or ignore.
2987	*/
2988	if (keep < PNG_HANDLE_CHUNK_IF_SAFE)
2989	{
2990	# ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
2991	if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE)
2992	{
2993	png_chunk_warning(png_ptr, "Saving unknown chunk:");
2994	png_app_warning(png_ptr,
2995	"forcing save of an unhandled chunk;"
2996	" please call png_set_keep_unknown_chunks");
2997	/ with keep = PNG_HANDLE_CHUNK_IF_SAFE /
2998	}
2999	# endif
3000	keep = PNG_HANDLE_CHUNK_IF_SAFE;
3001	}
3002	}
3003
3004	else / chunk was handled /
3005	{
3006	handled = `1`;
3007	/ Critical chunks can be safely discarded at this point. /
3008	keep = PNG_HANDLE_CHUNK_NEVER;
3009	}
3010	}
3011
3012	else
3013	keep = PNG_HANDLE_CHUNK_NEVER; / insufficient memory /
3014	}
3015
3016	else
3017	/ Use the SAVE_UNKNOWN_CHUNKS code or skip the chunk /
3018	# endif /* READ_USER_CHUNKS */
3019
3020	# ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED
3021	{
3022	/ keep is currently just the per-chunk setting, if there was no*
3023	* setting change it to the global default now (not that this may
3024	* still be AS_DEFAULT) then obtain the cache of the chunk if required,
3025	* if not simply skip the chunk.
3026	*/
3027	if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT)
3028	keep = png_ptr->unknown_default;
3029
3030	if (keep == PNG_HANDLE_CHUNK_ALWAYS \|\|
3031	(keep == PNG_HANDLE_CHUNK_IF_SAFE &&
3032	PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
3033	{
3034	if (png_cache_unknown_chunk(png_ptr, length) == `0`)
3035	keep = PNG_HANDLE_CHUNK_NEVER;
3036	}
3037
3038	else
3039	png_crc_finish(png_ptr, length);
3040	}
3041	# else
3042	# ifndef PNG_READ_USER_CHUNKS_SUPPORTED
3043	# error no method to support READ_UNKNOWN_CHUNKS
3044	# endif
3045
3046	{
3047	/ If here there is no read callback pointer set and no support is*
3048	* compiled in to just save the unknown chunks, so simply skip this
3049	* chunk. If 'keep' is something other than AS_DEFAULT or NEVER then
3050	* the app has erroneously asked for unknown chunk saving when there
3051	* is no support.
3052	*/
3053	if (keep > PNG_HANDLE_CHUNK_NEVER)
3054	png_app_error(png_ptr, "no unknown chunk support available");
3055
3056	png_crc_finish(png_ptr, length);
3057	}
3058	# endif
3059
3060	# ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
3061	/ Now store the chunk in the chunk list if appropriate, and if the limits*
3062	* permit it.
3063	*/
3064	if (keep == PNG_HANDLE_CHUNK_ALWAYS \|\|
3065	(keep == PNG_HANDLE_CHUNK_IF_SAFE &&
3066	PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
3067	{
3068	# ifdef PNG_USER_LIMITS_SUPPORTED
3069	switch (png_ptr->user_chunk_cache_max)
3070	{
3071	case `2`:
3072	png_ptr->user_chunk_cache_max = `1`;
3073	png_chunk_benign_error(png_ptr, "no space in chunk cache");
3074	/ FALLTHROUGH /
3075	case `1`:
3076	/ NOTE: prior to 1.6.0 this case resulted in an unknown critical*
3077	* chunk being skipped, now there will be a hard error below.
3078	*/
3079	break;
3080
3081	default: / not at limit /
3082	--(png_ptr->user_chunk_cache_max);
3083	/ FALLTHROUGH /
3084	case `0`: / no limit /
3085	# endif /* USER_LIMITS */
3086	/ Here when the limit isn't reached or when limits are compiled*
3087	* out; store the chunk.
3088	*/
3089	png_set_unknown_chunks(png_ptr, info_ptr,
3090	&png_ptr->unknown_chunk, `1`);
3091	handled = `1`;
3092	# ifdef PNG_USER_LIMITS_SUPPORTED
3093	break;
3094	}
3095	# endif
3096	}
3097	# else /* no store support: the chunk must be handled by the user callback */
3098	PNG_UNUSED(info_ptr)
3099	# endif
3100
3101	/ Regardless of the error handling below the cached data (if any) can be*
3102	* freed now. Notice that the data is not freed if there is a png_error, but
3103	* it will be freed by destroy_read_struct.
3104	*/
3105	if (png_ptr->unknown_chunk.data != NULL)
3106	png_free(png_ptr, png_ptr->unknown_chunk.data);
3107	png_ptr->unknown_chunk.data = NULL;
3108
3109	#else /* !PNG_READ_UNKNOWN_CHUNKS_SUPPORTED */
3110	/ There is no support to read an unknown chunk, so just skip it. /
3111	png_crc_finish(png_ptr, length);
3112	PNG_UNUSED(info_ptr)
3113	PNG_UNUSED(keep)
3114	#endif /* !READ_UNKNOWN_CHUNKS */
3115
3116	/ Check for unhandled critical chunks /
3117	if (handled == `0` && PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
3118	png_chunk_error(png_ptr, "unhandled critical chunk");
3119	}
3120
3121	/ This function is called to verify that a chunk name is valid.*
3122	* This function can't have the "critical chunk check" incorporated
3123	* into it, since in the future we will need to be able to call user
3124	* functions to handle unknown critical chunks after we check that
3125	* the chunk name itself is valid.
3126	*/
3127
3128	/ Bit hacking: the test for an invalid byte in the 4 byte chunk name is:*
3129	*
3130	* ((c) < 65 \|\| (c) > 122 \|\| ((c) > 90 && (c) < 97))
3131	*/
3132
3133	void / PRIVATE /
3134	png_check_chunk_name(png_const_structrp png_ptr, png_uint_32 chunk_name)
3135	{
3136	int i;
3137	png_uint_32 cn=chunk_name;
3138
3139	png_debug(`1`, "in png_check_chunk_name");
3140
3141	for (i=`1`; i<=`4`; ++i)
3142	{
3143	int c = cn & `0xff`;
3144
3145	if (c < `65` \|\| c > `122` \|\| (c > `90` && c < `97`))
3146	png_chunk_error(png_ptr, "invalid chunk type");
3147
3148	cn >>= `8`;
3149	}
3150	}
3151
3152	void / PRIVATE /
3153	png_check_chunk_length(png_const_structrp png_ptr, png_uint_32 length)
3154	{
3155	png_alloc_size_t limit = PNG_UINT_31_MAX;
3156
3157	# ifdef PNG_SET_USER_LIMITS_SUPPORTED
3158	if (png_ptr->user_chunk_malloc_max > `0` &&
3159	png_ptr->user_chunk_malloc_max < limit)
3160	limit = png_ptr->user_chunk_malloc_max;
3161	# elif PNG_USER_CHUNK_MALLOC_MAX > 0
3162	if (PNG_USER_CHUNK_MALLOC_MAX < limit)
3163	limit = PNG_USER_CHUNK_MALLOC_MAX;
3164	# endif
3165	if (png_ptr->chunk_name == png_IDAT)
3166	{
3167	png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
3168	size_t row_factor =
3169	(size_t)png_ptr->width
3170	* (size_t)png_ptr->channels
3171	* (png_ptr->bit_depth > `8`? `2`: `1`)
3172	+ `1`
3173	+ (png_ptr->interlaced? `6`: `0`);
3174	if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
3175	idat_limit = PNG_UINT_31_MAX;
3176	else
3177	idat_limit = png_ptr->height * row_factor;
3178	row_factor = row_factor > `32566`? `32566` : row_factor;
3179	idat_limit += `6` + `5`(idat_limit/row_factor+`1`); /* zlib+deflate overhead /
3180	idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX;
3181	limit = limit < idat_limit? idat_limit : limit;
3182	}
3183
3184	if (length > limit)
3185	{
3186	png_debug2(`0`," length = %lu, limit = %lu",
3187	(unsigned long)length,(unsigned long)limit);
3188	png_chunk_error(png_ptr, "chunk data is too large");
3189	}
3190	}
3191
3192	/ Combines the row recently read in with the existing pixels in the row. This*
3193	* routine takes care of alpha and transparency if requested. This routine also
3194	* handles the two methods of progressive display of interlaced images,
3195	* depending on the 'display' value; if 'display' is true then the whole row
3196	* (dp) is filled from the start by replicating the available pixels. If
3197	* 'display' is false only those pixels present in the pass are filled in.
3198	*/
3199	void / PRIVATE /
3200	png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
3201	{
3202	unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
3203	png_const_bytep sp = png_ptr->row_buf + `1`;
3204	png_alloc_size_t row_width = png_ptr->width;
3205	unsigned int pass = png_ptr->pass;
3206	png_bytep end_ptr = `0`;
3207	png_byte end_byte = `0`;
3208	unsigned int end_mask;
3209
3210	png_debug(`1`, "in png_combine_row");
3211
3212	/ Added in 1.5.6: it should not be possible to enter this routine until at*
3213	* least one row has been read from the PNG data and transformed.
3214	*/
3215	if (pixel_depth == `0`)
3216	png_error(png_ptr, "internal row logic error");
3217
3218	/ Added in 1.5.4: the pixel depth should match the information returned by*
3219	* any call to png_read_update_info at this point. Do not continue if we got
3220	* this wrong.
3221	*/
3222	if (png_ptr->info_rowbytes != `0` && png_ptr->info_rowbytes !=
3223	PNG_ROWBYTES(pixel_depth, row_width))
3224	png_error(png_ptr, "internal row size calculation error");
3225
3226	/ Don't expect this to ever happen: /
3227	if (row_width == `0`)
3228	png_error(png_ptr, "internal row width error");
3229
3230	/ Preserve the last byte in cases where only part of it will be overwritten,*
3231	* the multiply below may overflow, we don't care because ANSI-C guarantees
3232	* we get the low bits.
3233	*/
3234	end_mask = (pixel_depth * row_width) & `7`;
3235	if (end_mask != `0`)
3236	{
3237	/ end_ptr == NULL is a flag to say do nothing /
3238	end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - `1`;
3239	end_byte = *end_ptr;
3240	# ifdef PNG_READ_PACKSWAP_SUPPORTED
3241	if ((png_ptr->transformations & PNG_PACKSWAP) != `0`)
3242	/ little-endian byte /
3243	end_mask = (unsigned int)(`0xff` << end_mask);
3244
3245	else / big-endian byte /
3246	# endif
3247	end_mask = `0xff` >> end_mask;
3248	/ end_mask is now the bits to keep from the destination row /
3249	}
3250
3251	/ For non-interlaced images this reduces to a memcpy(). A memcpy()*
3252	* will also happen if interlacing isn't supported or if the application
3253	* does not call png_set_interlace_handling(). In the latter cases the
3254	* caller just gets a sequence of the unexpanded rows from each interlace
3255	* pass.
3256	*/
3257	#ifdef PNG_READ_INTERLACING_SUPPORTED
3258	if (png_ptr->interlaced != `0` &&
3259	(png_ptr->transformations & PNG_INTERLACE) != `0` &&
3260	pass < `6` && (display == `0` \|\|
3261	/ The following copies everything for 'display' on passes 0, 2 and 4. /
3262	(display == `1` && (pass & `1`) != `0`)))
3263	{
3264	/ Narrow images may have no bits in a pass; the caller should handle*
3265	* this, but this test is cheap:
3266	*/
3267	if (row_width <= PNG_PASS_START_COL(pass))
3268	return;
3269
3270	if (pixel_depth < `8`)
3271	{
3272	/ For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit*
3273	* into 32 bits, then a single loop over the bytes using the four byte
3274	* values in the 32-bit mask can be used. For the 'display' option the
3275	* expanded mask may also not require any masking within a byte. To
3276	* make this work the PACKSWAP option must be taken into account - it
3277	* simply requires the pixels to be reversed in each byte.
3278	*
3279	* The 'regular' case requires a mask for each of the first 6 passes,
3280	* the 'display' case does a copy for the even passes in the range
3281	* 0..6. This has already been handled in the test above.
3282	*
3283	* The masks are arranged as four bytes with the first byte to use in
3284	* the lowest bits (little-endian) regardless of the order (PACKSWAP or
3285	* not) of the pixels in each byte.
3286	*
3287	* NOTE: the whole of this logic depends on the caller of this function
3288	* only calling it on rows appropriate to the pass. This function only
3289	* understands the 'x' logic; the 'y' logic is handled by the caller.
3290	*
3291	* The following defines allow generation of compile time constant bit
3292	* masks for each pixel depth and each possibility of swapped or not
3293	* swapped bytes. Pass 'p' is in the range 0..6; 'x', a pixel index,
3294	* is in the range 0..7; and the result is 1 if the pixel is to be
3295	* copied in the pass, 0 if not. 'S' is for the sparkle method, 'B'
3296	* for the block method.
3297	*
3298	* With some compilers a compile time expression of the general form:
3299	*
3300	* (shift >= 32) ? (a >> (shift-32)) : (b >> shift)
3301	*
3302	* Produces warnings with values of 'shift' in the range 33 to 63
3303	* because the right hand side of the ?: expression is evaluated by
3304	* the compiler even though it isn't used. Microsoft Visual C (various
3305	* versions) and the Intel C compiler are known to do this. To avoid
3306	* this the following macros are used in 1.5.6. This is a temporary
3307	* solution to avoid destabilizing the code during the release process.
3308	*/
3309	# if PNG_USE_COMPILE_TIME_MASKS
3310	# define PNG_LSR(x,s) ((x)>>((s) & 0x1f))
3311	# define PNG_LSL(x,s) ((x)<<((s) & 0x1f))
3312	# else
3313	# define PNG_LSR(x,s) ((x)>>(s))
3314	# define PNG_LSL(x,s) ((x)<<(s))
3315	# endif
3316	# define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\
3317	PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1)
3318	# define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\
3319	PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1)
3320
3321	/ Return a mask for pass 'p' pixel 'x' at depth 'd'. The mask is*
3322	* little endian - the first pixel is at bit 0 - however the extra
3323	* parameter 's' can be set to cause the mask position to be swapped
3324	* within each byte, to match the PNG format. This is done by XOR of
3325	* the shift with 7, 6 or 4 for bit depths 1, 2 and 4.
3326	*/
3327	# define PIXEL_MASK(p,x,d,s) \
3328	(PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0))))
3329
3330	/ Hence generate the appropriate 'block' or 'sparkle' pixel copy mask.*
3331	*/
3332	# define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
3333	# define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
3334
3335	/ Combine 8 of these to get the full mask. For the 1-bpp and 2-bpp*
3336	* cases the result needs replicating, for the 4-bpp case the above
3337	* generates a full 32 bits.
3338	*/
3339	# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
3340
3341	# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
3342	S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
3343	S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
3344
3345	# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
3346	B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
3347	B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
3348
3349	#if PNG_USE_COMPILE_TIME_MASKS
3350	/ Utility macros to construct all the masks for a depth/swap*
3351	* combination. The 's' parameter says whether the format is PNG
3352	* (big endian bytes) or not. Only the three odd-numbered passes are
3353	* required for the display/block algorithm.
3354	*/
3355	# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
3356	S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
3357
3358	# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
3359
3360	# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
3361
3362	/ Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and*
3363	* then pass:
3364	*/
3365	static const png_uint_32 row_mask[`2`/PACKSWAP/][`3`/depth/][`6`] =
3366	{
3367	/ Little-endian byte masks for PACKSWAP /
3368	{ S_MASKS(`1`,`0`), S_MASKS(`2`,`0`), S_MASKS(`4`,`0`) },
3369	/ Normal (big-endian byte) masks - PNG format /
3370	{ S_MASKS(`1`,`1`), S_MASKS(`2`,`1`), S_MASKS(`4`,`1`) }
3371	};
3372
3373	/ display_mask has only three entries for the odd passes, so index by*
3374	* pass>>1.
3375	*/
3376	static const png_uint_32 display_mask[`2`][`3`][`3`] =
3377	{
3378	/ Little-endian byte masks for PACKSWAP /
3379	{ B_MASKS(`1`,`0`), B_MASKS(`2`,`0`), B_MASKS(`4`,`0`) },
3380	/ Normal (big-endian byte) masks - PNG format /
3381	{ B_MASKS(`1`,`1`), B_MASKS(`2`,`1`), B_MASKS(`4`,`1`) }
3382	};
3383
3384	# define MASK(pass,depth,display,png)\
3385	((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
3386	row_mask[png][DEPTH_INDEX(depth)][pass])
3387
3388	#else /* !PNG_USE_COMPILE_TIME_MASKS */
3389	/ This is the runtime alternative: it seems unlikely that this will*
3390	* ever be either smaller or faster than the compile time approach.
3391	*/
3392	# define MASK(pass,depth,display,png)\
3393	((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png))
3394	#endif /* !USE_COMPILE_TIME_MASKS */
3395
3396	/ Use the appropriate mask to copy the required bits. In some cases*
3397	* the byte mask will be 0 or 0xff; optimize these cases. row_width is
3398	* the number of pixels, but the code copies bytes, so it is necessary
3399	* to special case the end.
3400	*/
3401	png_uint_32 pixels_per_byte = `8` / pixel_depth;
3402	png_uint_32 mask;
3403
3404	# ifdef PNG_READ_PACKSWAP_SUPPORTED
3405	if ((png_ptr->transformations & PNG_PACKSWAP) != `0`)
3406	mask = MASK(pass, pixel_depth, display, `0`);
3407
3408	else
3409	# endif
3410	mask = MASK(pass, pixel_depth, display, `1`);
3411
3412	for (;;)
3413	{
3414	png_uint_32 m;
3415
3416	/ It doesn't matter in the following if png_uint_32 has more than*
3417	* 32 bits because the high bits always match those in m<<24; it is,
3418	* however, essential to use OR here, not +, because of this.
3419	*/
3420	m = mask;
3421	mask = (m >> `8`) \| (m << `24`); / rotate right to good compilers /
3422	m &= `0xff`;
3423
3424	if (m != `0`) / something to copy /
3425	{
3426	if (m != `0xff`)
3427	dp = (png_byte)((dp & ~m) \| (*sp & m));
3428	else
3429	dp = sp;
3430	}
3431
3432	/ NOTE: this may overwrite the last byte with garbage if the image*
3433	* is not an exact number of bytes wide; libpng has always done
3434	* this.
3435	*/
3436	if (row_width <= pixels_per_byte)
3437	break; / May need to restore part of the last byte /
3438
3439	row_width -= pixels_per_byte;
3440	++dp;
3441	++sp;
3442	}
3443	}
3444
3445	else / pixel_depth >= 8 /
3446	{
3447	unsigned int bytes_to_copy, bytes_to_jump;
3448
3449	/ Validate the depth - it must be a multiple of 8 /
3450	if (pixel_depth & `7`)
3451	png_error(png_ptr, "invalid user transform pixel depth");
3452
3453	pixel_depth >>= `3`; / now in bytes /
3454	row_width *= pixel_depth;
3455
3456	/ Regardless of pass number the Adam 7 interlace always results in a*
3457	* fixed number of pixels to copy then to skip. There may be a
3458	* different number of pixels to skip at the start though.
3459	*/
3460	{
3461	unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth;
3462
3463	row_width -= offset;
3464	dp += offset;
3465	sp += offset;
3466	}
3467
3468	/ Work out the bytes to copy. /
3469	if (display != `0`)
3470	{
3471	/ When doing the 'block' algorithm the pixel in the pass gets*
3472	* replicated to adjacent pixels. This is why the even (0,2,4,6)
3473	* passes are skipped above - the entire expanded row is copied.
3474	*/
3475	bytes_to_copy = (`1`<<((`6`-pass)>>`1`)) * pixel_depth;
3476
3477	/ But don't allow this number to exceed the actual row width. /
3478	if (bytes_to_copy > row_width)
3479	bytes_to_copy = (unsigned int)/SAFE/row_width;
3480	}
3481
3482	else / normal row; Adam7 only ever gives us one pixel to copy. /
3483	bytes_to_copy = pixel_depth;
3484
3485	/ In Adam7 there is a constant offset between where the pixels go. /
3486	bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;
3487
3488	/ And simply copy these bytes. Some optimization is possible here,*
3489	* depending on the value of 'bytes_to_copy'. Special case the low
3490	* byte counts, which we know to be frequent.
3491	*
3492	* Notice that these cases all 'return' rather than 'break' - this
3493	* avoids an unnecessary test on whether to restore the last byte
3494	* below.
3495	*/
3496	switch (bytes_to_copy)
3497	{
3498	case `1`:
3499	for (;;)
3500	{
3501	dp = sp;
3502
3503	if (row_width <= bytes_to_jump)
3504	return;
3505
3506	dp += bytes_to_jump;
3507	sp += bytes_to_jump;
3508	row_width -= bytes_to_jump;
3509	}
3510
3511	case `2`:
3512	/ There is a possibility of a partial copy at the end here; this*
3513	* slows the code down somewhat.
3514	*/
3515	do
3516	{
3517	dp[`0`] = sp[`0`]; dp[`1`] = sp[`1`];
3518
3519	if (row_width <= bytes_to_jump)
3520	return;
3521
3522	sp += bytes_to_jump;
3523	dp += bytes_to_jump;
3524	row_width -= bytes_to_jump;
3525	}
3526	while (row_width > `1`);
3527
3528	/ And there can only be one byte left at this point: /
3529	dp = sp;
3530	return;
3531
3532	case `3`:
3533	/ This can only be the RGB case, so each copy is exactly one*
3534	* pixel and it is not necessary to check for a partial copy.
3535	*/
3536	for (;;)
3537	{
3538	dp[`0`] = sp[`0`]; dp[`1`] = sp[`1`]; dp[`2`] = sp[`2`];
3539
3540	if (row_width <= bytes_to_jump)
3541	return;
3542
3543	sp += bytes_to_jump;
3544	dp += bytes_to_jump;
3545	row_width -= bytes_to_jump;
3546	}
3547
3548	default:
3549	#if PNG_ALIGN_TYPE != PNG_ALIGN_NONE
3550	/ Check for double byte alignment and, if possible, use a*
3551	* 16-bit copy. Don't attempt this for narrow images - ones that
3552	* are less than an interlace panel wide. Don't attempt it for
3553	* wide bytes_to_copy either - use the memcpy there.
3554	*/
3555	if (bytes_to_copy < `16` /else use memcpy/ &&
3556	png_isaligned(dp, png_uint_16) &&
3557	png_isaligned(sp, png_uint_16) &&
3558	bytes_to_copy % (sizeof (png_uint_16)) == `0` &&
3559	bytes_to_jump % (sizeof (png_uint_16)) == `0`)
3560	{
3561	/ Everything is aligned for png_uint_16 copies, but try for*
3562	* png_uint_32 first.
3563	*/
3564	if (png_isaligned(dp, png_uint_32) &&
3565	png_isaligned(sp, png_uint_32) &&
3566	bytes_to_copy % (sizeof (png_uint_32)) == `0` &&
3567	bytes_to_jump % (sizeof (png_uint_32)) == `0`)
3568	{
3569	png_uint_32p dp32 = png_aligncast(png_uint_32p,dp);
3570	png_const_uint_32p sp32 = png_aligncastconst(
3571	png_const_uint_32p, sp);
3572	size_t skip = (bytes_to_jump-bytes_to_copy) /
3573	(sizeof (png_uint_32));
3574
3575	do
3576	{
3577	size_t c = bytes_to_copy;
3578	do
3579	{
3580	dp32++ = sp32++;
3581	c -= (sizeof (png_uint_32));
3582	}
3583	while (c > `0`);
3584
3585	if (row_width <= bytes_to_jump)
3586	return;
3587
3588	dp32 += skip;
3589	sp32 += skip;
3590	row_width -= bytes_to_jump;
3591	}
3592	while (bytes_to_copy <= row_width);
3593
3594	/ Get to here when the row_width truncates the final copy.*
3595	* There will be 1-3 bytes left to copy, so don't try the
3596	* 16-bit loop below.
3597	*/
3598	dp = (png_bytep)dp32;
3599	sp = (png_const_bytep)sp32;
3600	do
3601	dp++ = sp++;
3602	while (--row_width > `0`);
3603	return;
3604	}
3605
3606	/ Else do it in 16-bit quantities, but only if the size is*
3607	* not too large.
3608	*/
3609	else
3610	{
3611	png_uint_16p dp16 = png_aligncast(png_uint_16p, dp);
3612	png_const_uint_16p sp16 = png_aligncastconst(
3613	png_const_uint_16p, sp);
3614	size_t skip = (bytes_to_jump-bytes_to_copy) /
3615	(sizeof (png_uint_16));
3616
3617	do
3618	{
3619	size_t c = bytes_to_copy;
3620	do
3621	{
3622	dp16++ = sp16++;
3623	c -= (sizeof (png_uint_16));
3624	}
3625	while (c > `0`);
3626
3627	if (row_width <= bytes_to_jump)
3628	return;
3629
3630	dp16 += skip;
3631	sp16 += skip;
3632	row_width -= bytes_to_jump;
3633	}
3634	while (bytes_to_copy <= row_width);
3635
3636	/ End of row - 1 byte left, bytes_to_copy > row_width: /
3637	dp = (png_bytep)dp16;
3638	sp = (png_const_bytep)sp16;
3639	do
3640	dp++ = sp++;
3641	while (--row_width > `0`);
3642	return;
3643	}
3644	}
3645	#endif /* ALIGN_TYPE code */
3646
3647	/ The true default - use a memcpy: /
3648	for (;;)
3649	{
3650	memcpy(dp, sp, bytes_to_copy);
3651
3652	if (row_width <= bytes_to_jump)
3653	return;
3654
3655	sp += bytes_to_jump;
3656	dp += bytes_to_jump;
3657	row_width -= bytes_to_jump;
3658	if (bytes_to_copy > row_width)
3659	bytes_to_copy = (unsigned int)/SAFE/row_width;
3660	}
3661	}
3662
3663	/ NOT REACHED/
3664	} / pixel_depth >= 8 /
3665
3666	/ Here if pixel_depth < 8 to check 'end_ptr' below. /
3667	}
3668	else
3669	#endif /* READ_INTERLACING */
3670
3671	/ If here then the switch above wasn't used so just memcpy the whole row*
3672	* from the temporary row buffer (notice that this overwrites the end of the
3673	* destination row if it is a partial byte.)
3674	*/
3675	memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width));
3676
3677	/ Restore the overwritten bits from the last byte if necessary. /
3678	if (end_ptr != NULL)
3679	end_ptr = (png_byte)((end_byte & end_mask) \| (end_ptr & ~end_mask));
3680	}
3681
3682	#ifdef PNG_READ_INTERLACING_SUPPORTED
3683	void / PRIVATE /
3684	png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
3685	png_uint_32 transformations / Because these may affect the byte layout /)
3686	{
3687	/ Arrays to facilitate easy interlacing - use pass (0 - 6) as index /
3688	/ Offset to next interlace block /
3689	static const unsigned int png_pass_inc[`7`] = {`8`, `8`, `4`, `4`, `2`, `2`, `1`};
3690
3691	png_debug(`1`, "in png_do_read_interlace");
3692	if (row != NULL && row_info != NULL)
3693	{
3694	png_uint_32 final_width;
3695
3696	final_width = row_info->width * png_pass_inc[pass];
3697
3698	switch (row_info->pixel_depth)
3699	{
3700	case `1`:
3701	{
3702	png_bytep sp = row + (size_t)((row_info->width - `1`) >> `3`);
3703	png_bytep dp = row + (size_t)((final_width - `1`) >> `3`);
3704	unsigned int sshift, dshift;
3705	unsigned int s_start, s_end;
3706	int s_inc;
3707	int jstop = (int)png_pass_inc[pass];
3708	png_byte v;
3709	png_uint_32 i;
3710	int j;
3711
3712	#ifdef PNG_READ_PACKSWAP_SUPPORTED
3713	if ((transformations & PNG_PACKSWAP) != `0`)
3714	{
3715	sshift = ((row_info->width + `7`) & `0x07`);
3716	dshift = ((final_width + `7`) & `0x07`);
3717	s_start = `7`;
3718	s_end = `0`;
3719	s_inc = -`1`;
3720	}
3721
3722	else
3723	#endif
3724	{
3725	sshift = `7` - ((row_info->width + `7`) & `0x07`);
3726	dshift = `7` - ((final_width + `7`) & `0x07`);
3727	s_start = `0`;
3728	s_end = `7`;
3729	s_inc = `1`;
3730	}
3731
3732	for (i = `0`; i < row_info->width; i++)
3733	{
3734	v = (png_byte)((*sp >> sshift) & `0x01`);
3735	for (j = `0`; j < jstop; j++)
3736	{
3737	unsigned int tmp = *dp & (`0x7f7f` >> (`7` - dshift));
3738	tmp \|= (unsigned int)(v << dshift);
3739	*dp = (png_byte)(tmp & `0xff`);
3740
3741	if (dshift == s_end)
3742	{
3743	dshift = s_start;
3744	dp--;
3745	}
3746
3747	else
3748	dshift = (unsigned int)((int)dshift + s_inc);
3749	}
3750
3751	if (sshift == s_end)
3752	{
3753	sshift = s_start;
3754	sp--;
3755	}
3756
3757	else
3758	sshift = (unsigned int)((int)sshift + s_inc);
3759	}
3760	break;
3761	}
3762
3763	case `2`:
3764	{
3765	png_bytep sp = row + (png_uint_32)((row_info->width - `1`) >> `2`);
3766	png_bytep dp = row + (png_uint_32)((final_width - `1`) >> `2`);
3767	unsigned int sshift, dshift;
3768	unsigned int s_start, s_end;
3769	int s_inc;
3770	int jstop = (int)png_pass_inc[pass];
3771	png_uint_32 i;
3772
3773	#ifdef PNG_READ_PACKSWAP_SUPPORTED
3774	if ((transformations & PNG_PACKSWAP) != `0`)
3775	{
3776	sshift = (((row_info->width + `3`) & `0x03`) << `1`);
3777	dshift = (((final_width + `3`) & `0x03`) << `1`);
3778	s_start = `6`;
3779	s_end = `0`;
3780	s_inc = -`2`;
3781	}
3782
3783	else
3784	#endif
3785	{
3786	sshift = ((`3` - ((row_info->width + `3`) & `0x03`)) << `1`);
3787	dshift = ((`3` - ((final_width + `3`) & `0x03`)) << `1`);
3788	s_start = `0`;
3789	s_end = `6`;
3790	s_inc = `2`;
3791	}
3792
3793	for (i = `0`; i < row_info->width; i++)
3794	{
3795	png_byte v;
3796	int j;
3797
3798	v = (png_byte)((*sp >> sshift) & `0x03`);
3799	for (j = `0`; j < jstop; j++)
3800	{
3801	unsigned int tmp = *dp & (`0x3f3f` >> (`6` - dshift));
3802	tmp \|= (unsigned int)(v << dshift);
3803	*dp = (png_byte)(tmp & `0xff`);
3804
3805	if (dshift == s_end)
3806	{
3807	dshift = s_start;
3808	dp--;
3809	}
3810
3811	else
3812	dshift = (unsigned int)((int)dshift + s_inc);
3813	}
3814
3815	if (sshift == s_end)
3816	{
3817	sshift = s_start;
3818	sp--;
3819	}
3820
3821	else
3822	sshift = (unsigned int)((int)sshift + s_inc);
3823	}
3824	break;
3825	}
3826
3827	case `4`:
3828	{
3829	png_bytep sp = row + (size_t)((row_info->width - `1`) >> `1`);
3830	png_bytep dp = row + (size_t)((final_width - `1`) >> `1`);
3831	unsigned int sshift, dshift;
3832	unsigned int s_start, s_end;
3833	int s_inc;
3834	png_uint_32 i;
3835	int jstop = (int)png_pass_inc[pass];
3836
3837	#ifdef PNG_READ_PACKSWAP_SUPPORTED
3838	if ((transformations & PNG_PACKSWAP) != `0`)
3839	{
3840	sshift = (((row_info->width + `1`) & `0x01`) << `2`);
3841	dshift = (((final_width + `1`) & `0x01`) << `2`);
3842	s_start = `4`;
3843	s_end = `0`;
3844	s_inc = -`4`;
3845	}
3846
3847	else
3848	#endif
3849	{
3850	sshift = ((`1` - ((row_info->width + `1`) & `0x01`)) << `2`);
3851	dshift = ((`1` - ((final_width + `1`) & `0x01`)) << `2`);
3852	s_start = `0`;
3853	s_end = `4`;
3854	s_inc = `4`;
3855	}
3856
3857	for (i = `0`; i < row_info->width; i++)
3858	{
3859	png_byte v = (png_byte)((*sp >> sshift) & `0x0f`);
3860	int j;
3861
3862	for (j = `0`; j < jstop; j++)
3863	{
3864	unsigned int tmp = *dp & (`0xf0f` >> (`4` - dshift));
3865	tmp \|= (unsigned int)(v << dshift);
3866	*dp = (png_byte)(tmp & `0xff`);
3867
3868	if (dshift == s_end)
3869	{
3870	dshift = s_start;
3871	dp--;
3872	}
3873
3874	else
3875	dshift = (unsigned int)((int)dshift + s_inc);
3876	}
3877
3878	if (sshift == s_end)
3879	{
3880	sshift = s_start;
3881	sp--;
3882	}
3883
3884	else
3885	sshift = (unsigned int)((int)sshift + s_inc);
3886	}
3887	break;
3888	}
3889
3890	default:
3891	{
3892	size_t pixel_bytes = (row_info->pixel_depth >> `3`);
3893
3894	png_bytep sp = row + (size_t)(row_info->width - `1`)
3895	* pixel_bytes;
3896
3897	png_bytep dp = row + (size_t)(final_width - `1`) * pixel_bytes;
3898
3899	int jstop = (int)png_pass_inc[pass];
3900	png_uint_32 i;
3901
3902	for (i = `0`; i < row_info->width; i++)
3903	{
3904	png_byte v[`8`]; / SAFE; pixel_depth does not exceed 64 /
3905	int j;
3906
3907	memcpy(v, sp, pixel_bytes);
3908
3909	for (j = `0`; j < jstop; j++)
3910	{
3911	memcpy(dp, v, pixel_bytes);
3912	dp -= pixel_bytes;
3913	}
3914
3915	sp -= pixel_bytes;
3916	}
3917	break;
3918	}
3919	}
3920
3921	row_info->width = final_width;
3922	row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);
3923	}
3924	#ifndef PNG_READ_PACKSWAP_SUPPORTED
3925	PNG_UNUSED(transformations) / Silence compiler warning /
3926	#endif
3927	}
3928	#endif /* READ_INTERLACING */
3929
3930	static void
3931	png_read_filter_row_sub(png_row_infop row_info, png_bytep row,
3932	png_const_bytep prev_row)
3933	{
3934	size_t i;
3935	size_t istop = row_info->rowbytes;
3936	unsigned int bpp = (row_info->pixel_depth + `7`) >> `3`;
3937	png_bytep rp = row + bpp;
3938
3939	PNG_UNUSED(prev_row)
3940
3941	for (i = bpp; i < istop; i++)
3942	{
3943	rp = (png_byte)(((int)(rp) + (int)(*(rp-bpp))) & `0xff`);
3944	rp++;
3945	}
3946	}
3947
3948	static void
3949	png_read_filter_row_up(png_row_infop row_info, png_bytep row,
3950	png_const_bytep prev_row)
3951	{
3952	size_t i;
3953	size_t istop = row_info->rowbytes;
3954	png_bytep rp = row;
3955	png_const_bytep pp = prev_row;
3956
3957	for (i = `0`; i < istop; i++)
3958	{
3959	rp = (png_byte)(((int)(rp) + (int)(*pp++)) & `0xff`);
3960	rp++;
3961	}
3962	}
3963
3964	static void
3965	png_read_filter_row_avg(png_row_infop row_info, png_bytep row,
3966	png_const_bytep prev_row)
3967	{
3968	size_t i;
3969	png_bytep rp = row;
3970	png_const_bytep pp = prev_row;
3971	unsigned int bpp = (row_info->pixel_depth + `7`) >> `3`;
3972	size_t istop = row_info->rowbytes - bpp;
3973
3974	for (i = `0`; i < bpp; i++)
3975	{
3976	rp = (png_byte)(((int)(rp) +
3977	((int)(*pp++) / `2` )) & `0xff`);
3978
3979	rp++;
3980	}
3981
3982	for (i = `0`; i < istop; i++)
3983	{
3984	rp = (png_byte)(((int)(rp) +
3985	(int)(pp++ + (rp-bpp)) / `2` ) & `0xff`);
3986
3987	rp++;
3988	}
3989	}
3990
3991	static void
3992	png_read_filter_row_paeth_1byte_pixel(png_row_infop row_info, png_bytep row,
3993	png_const_bytep prev_row)
3994	{
3995	png_bytep rp_end = row + row_info->rowbytes;
3996	int a, c;
3997
3998	/ First pixel/byte /
3999	c = *prev_row++;
4000	a = *row + c;
4001	*row++ = (png_byte)a;
4002
4003	/ Remainder /
4004	while (row < rp_end)
4005	{
4006	int b, pa, pb, pc, p;
4007
4008	a &= `0xff`; / From previous iteration or start /
4009	b = *prev_row++;
4010
4011	p = b - c;
4012	pc = a - c;
4013
4014	#ifdef PNG_USE_ABS
4015	pa = abs(p);
4016	pb = abs(pc);
4017	pc = abs(p + pc);
4018	#else
4019	pa = p < `0` ? -p : p;
4020	pb = pc < `0` ? -pc : pc;
4021	pc = (p + pc) < `0` ? -(p + pc) : p + pc;
4022	#endif
4023
4024	/ Find the best predictor, the least of pa, pb, pc favoring the earlier*
4025	* ones in the case of a tie.
4026	*/
4027	if (pb < pa)
4028	{
4029	pa = pb; a = b;
4030	}
4031	if (pc < pa) a = c;
4032
4033	/ Calculate the current pixel in a, and move the previous row pixel to c*
4034	* for the next time round the loop
4035	*/
4036	c = b;
4037	a += *row;
4038	*row++ = (png_byte)a;
4039	}
4040	}
4041
4042	static void
4043	png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
4044	png_const_bytep prev_row)
4045	{
4046	unsigned int bpp = (row_info->pixel_depth + `7`) >> `3`;
4047	png_bytep rp_end = row + bpp;
4048
4049	/ Process the first pixel in the row completely (this is the same as 'up'*
4050	* because there is only one candidate predictor for the first row).
4051	*/
4052	while (row < rp_end)
4053	{
4054	int a = row + prev_row++;
4055	*row++ = (png_byte)a;
4056	}
4057
4058	/ Remainder /
4059	rp_end = rp_end + (row_info->rowbytes - bpp);
4060
4061	while (row < rp_end)
4062	{
4063	int a, b, c, pa, pb, pc, p;
4064
4065	c = *(prev_row - bpp);
4066	a = *(row - bpp);
4067	b = *prev_row++;
4068
4069	p = b - c;
4070	pc = a - c;
4071
4072	#ifdef PNG_USE_ABS
4073	pa = abs(p);
4074	pb = abs(pc);
4075	pc = abs(p + pc);
4076	#else
4077	pa = p < `0` ? -p : p;
4078	pb = pc < `0` ? -pc : pc;
4079	pc = (p + pc) < `0` ? -(p + pc) : p + pc;
4080	#endif
4081
4082	if (pb < pa)
4083	{
4084	pa = pb; a = b;
4085	}
4086	if (pc < pa) a = c;
4087
4088	a += *row;
4089	*row++ = (png_byte)a;
4090	}
4091	}
4092
4093	static void
4094	png_init_filter_functions(png_structrp pp)
4095	/ This function is called once for every PNG image (except for PNG images*
4096	* that only use PNG_FILTER_VALUE_NONE for all rows) to set the
4097	* implementations required to reverse the filtering of PNG rows. Reversing
4098	* the filter is the first transformation performed on the row data. It is
4099	* performed in place, therefore an implementation can be selected based on
4100	* the image pixel format. If the implementation depends on image width then
4101	* take care to ensure that it works correctly if the image is interlaced -
4102	* interlacing causes the actual row width to vary.
4103	*/
4104	{
4105	unsigned int bpp = (pp->pixel_depth + `7`) >> `3`;
4106
4107	pp->read_filter[PNG_FILTER_VALUE_SUB-`1`] = png_read_filter_row_sub;
4108	pp->read_filter[PNG_FILTER_VALUE_UP-`1`] = png_read_filter_row_up;
4109	pp->read_filter[PNG_FILTER_VALUE_AVG-`1`] = png_read_filter_row_avg;
4110	if (bpp == `1`)
4111	pp->read_filter[PNG_FILTER_VALUE_PAETH-`1`] =
4112	png_read_filter_row_paeth_1byte_pixel;
4113	else
4114	pp->read_filter[PNG_FILTER_VALUE_PAETH-`1`] =
4115	png_read_filter_row_paeth_multibyte_pixel;
4116
4117	#ifdef PNG_FILTER_OPTIMIZATIONS
4118	/ To use this define PNG_FILTER_OPTIMIZATIONS as the name of a function to*
4119	* call to install hardware optimizations for the above functions; simply
4120	* replace whatever elements of the pp->read_filter[] array with a hardware
4121	* specific (or, for that matter, generic) optimization.
4122	*
4123	* To see an example of this examine what configure.ac does when
4124	* --enable-arm-neon is specified on the command line.
4125	*/
4126	PNG_FILTER_OPTIMIZATIONS(pp, bpp);
4127	#endif
4128	}
4129
4130	void / PRIVATE /
4131	png_read_filter_row(png_structrp pp, png_row_infop row_info, png_bytep row,
4132	png_const_bytep prev_row, int filter)
4133	{
4134	/ OPTIMIZATION: DO NOT MODIFY THIS FUNCTION, instead #define*
4135	* PNG_FILTER_OPTIMIZATIONS to a function that overrides the generic
4136	* implementations. See png_init_filter_functions above.
4137	*/
4138	if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
4139	{
4140	if (pp->read_filter[`0`] == NULL)
4141	png_init_filter_functions(pp);
4142
4143	pp->read_filter[filter-`1`](row_info, row, prev_row);
4144	}
4145	}
4146
4147	#ifdef PNG_SEQUENTIAL_READ_SUPPORTED
4148	void / PRIVATE /
4149	png_read_IDAT_data(png_structrp png_ptr, png_bytep output,
4150	png_alloc_size_t avail_out)
4151	{
4152	/ Loop reading IDATs and decompressing the result into output[avail_out] /
4153	png_ptr->zstream.next_out = output;
4154	png_ptr->zstream.avail_out = `0`; / safety: set below /
4155
4156	if (output == NULL)
4157	avail_out = `0`;
4158
4159	do
4160	{
4161	int ret;
4162	png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
4163
4164	if (png_ptr->zstream.avail_in == `0`)
4165	{
4166	uInt avail_in;
4167	png_bytep buffer;
4168
4169	while (png_ptr->idat_size == `0`)
4170	{
4171	png_crc_finish(png_ptr, `0`);
4172
4173	png_ptr->idat_size = png_read_chunk_header(png_ptr);
4174	/ This is an error even in the 'check' case because the code just*
4175	* consumed a non-IDAT header.
4176	*/
4177	if (png_ptr->chunk_name != png_IDAT)
4178	png_error(png_ptr, "Not enough image data");
4179	}
4180
4181	avail_in = png_ptr->IDAT_read_size;
4182
4183	if (avail_in > png_ptr->idat_size)
4184	avail_in = (uInt)png_ptr->idat_size;
4185
4186	/ A PNG with a gradually increasing IDAT size will defeat this attempt*
4187	* to minimize memory usage by causing lots of re-allocs, but
4188	* realistically doing IDAT_read_size re-allocs is not likely to be a
4189	* big problem.
4190	*/
4191	buffer = png_read_buffer(png_ptr, avail_in, `0`/error/);
4192
4193	png_crc_read(png_ptr, buffer, avail_in);
4194	png_ptr->idat_size -= avail_in;
4195
4196	png_ptr->zstream.next_in = buffer;
4197	png_ptr->zstream.avail_in = avail_in;
4198	}
4199
4200	/ And set up the output side. /
4201	if (output != NULL) / standard read /
4202	{
4203	uInt out = ZLIB_IO_MAX;
4204
4205	if (out > avail_out)
4206	out = (uInt)avail_out;
4207
4208	avail_out -= out;
4209	png_ptr->zstream.avail_out = out;
4210	}
4211
4212	else / after last row, checking for end /
4213	{
4214	png_ptr->zstream.next_out = tmpbuf;
4215	png_ptr->zstream.avail_out = (sizeof tmpbuf);
4216	}
4217
4218	/ Use NO_FLUSH; this gives zlib the maximum opportunity to optimize the*
4219	* process. If the LZ stream is truncated the sequential reader will
4220	* terminally damage the stream, above, by reading the chunk header of the
4221	* following chunk (it then exits with png_error).
4222	*
4223	* TODO: deal more elegantly with truncated IDAT lists.
4224	*/
4225	ret = PNG_INFLATE(png_ptr, Z_NO_FLUSH);
4226
4227	/ Take the unconsumed output back. /
4228	if (output != NULL)
4229	avail_out += png_ptr->zstream.avail_out;
4230
4231	else / avail_out counts the extra bytes /
4232	avail_out += (sizeof tmpbuf) - png_ptr->zstream.avail_out;
4233
4234	png_ptr->zstream.avail_out = `0`;
4235
4236	if (ret == Z_STREAM_END)
4237	{
4238	/ Do this for safety; we won't read any more into this row. /
4239	png_ptr->zstream.next_out = NULL;
4240
4241	png_ptr->mode \|= PNG_AFTER_IDAT;
4242	png_ptr->flags \|= PNG_FLAG_ZSTREAM_ENDED;
4243
4244	if (png_ptr->zstream.avail_in > `0` \|\| png_ptr->idat_size > `0`)
4245	png_chunk_benign_error(png_ptr, "Extra compressed data");
4246	break;
4247	}
4248
4249	if (ret != Z_OK)
4250	{
4251	png_zstream_error(png_ptr, ret);
4252
4253	if (output != NULL)
4254	png_chunk_error(png_ptr, png_ptr->zstream.msg);
4255
4256	else / checking /
4257	{
4258	png_chunk_benign_error(png_ptr, png_ptr->zstream.msg);
4259	return;
4260	}
4261	}
4262	} while (avail_out > `0`);
4263
4264	if (avail_out > `0`)
4265	{
4266	/ The stream ended before the image; this is the same as too few IDATs so*
4267	* should be handled the same way.
4268	*/
4269	if (output != NULL)
4270	png_error(png_ptr, "Not enough image data");
4271
4272	else / the deflate stream contained extra data /
4273	png_chunk_benign_error(png_ptr, "Too much image data");
4274	}
4275	}
4276
4277	void / PRIVATE /
4278	png_read_finish_IDAT(png_structrp png_ptr)
4279	{
4280	/ We don't need any more data and the stream should have ended, however the*
4281	* LZ end code may actually not have been processed. In this case we must
4282	* read it otherwise stray unread IDAT data or, more likely, an IDAT chunk
4283	* may still remain to be consumed.
4284	*/
4285	if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == `0`)
4286	{
4287	/ The NULL causes png_read_IDAT_data to swallow any remaining bytes in*
4288	* the compressed stream, but the stream may be damaged too, so even after
4289	* this call we may need to terminate the zstream ownership.
4290	*/
4291	png_read_IDAT_data(png_ptr, NULL, `0`);
4292	png_ptr->zstream.next_out = NULL; / safety /
4293
4294	/ Now clear everything out for safety; the following may not have been*
4295	* done.
4296	*/
4297	if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == `0`)
4298	{
4299	png_ptr->mode \|= PNG_AFTER_IDAT;
4300	png_ptr->flags \|= PNG_FLAG_ZSTREAM_ENDED;
4301	}
4302	}
4303
4304	/ If the zstream has not been released do it now and terminate the reading*
4305	* of the final IDAT chunk.
4306	*/
4307	if (png_ptr->zowner == png_IDAT)
4308	{
4309	/ Always do this; the pointers otherwise point into the read buffer. /
4310	png_ptr->zstream.next_in = NULL;
4311	png_ptr->zstream.avail_in = `0`;
4312
4313	/ Now we no longer own the zstream. /
4314	png_ptr->zowner = `0`;
4315
4316	/ The slightly weird semantics of the sequential IDAT reading is that we*
4317	* are always in or at the end of an IDAT chunk, so we always need to do a
4318	* crc_finish here. If idat_size is non-zero we also need to read the
4319	* spurious bytes at the end of the chunk now.
4320	*/
4321	(void)png_crc_finish(png_ptr, png_ptr->idat_size);
4322	}
4323	}
4324
4325	void / PRIVATE /
4326	png_read_finish_row(png_structrp png_ptr)
4327	{
4328	/ Arrays to facilitate easy interlacing - use pass (0 - 6) as index /
4329
4330	/ Start of interlace block /
4331	static const png_byte png_pass_start[`7`] = {`0`, `4`, `0`, `2`, `0`, `1`, `0`};
4332
4333	/ Offset to next interlace block /
4334	static const png_byte png_pass_inc[`7`] = {`8`, `8`, `4`, `4`, `2`, `2`, `1`};
4335
4336	/ Start of interlace block in the y direction /
4337	static const png_byte png_pass_ystart[`7`] = {`0`, `0`, `4`, `0`, `2`, `0`, `1`};
4338
4339	/ Offset to next interlace block in the y direction /
4340	static const png_byte png_pass_yinc[`7`] = {`8`, `8`, `8`, `4`, `4`, `2`, `2`};
4341
4342	png_debug(`1`, "in png_read_finish_row");
4343	png_ptr->row_number++;
4344	if (png_ptr->row_number < png_ptr->num_rows)
4345	return;
4346
4347	if (png_ptr->interlaced != `0`)
4348	{
4349	png_ptr->row_number = `0`;
4350
4351	/ TO DO: don't do this if prev_row isn't needed (requires*
4352	* read-ahead of the next row's filter byte.
4353	*/
4354	memset(png_ptr->prev_row, `0`, png_ptr->rowbytes + `1`);
4355
4356	do
4357	{
4358	png_ptr->pass++;
4359
4360	if (png_ptr->pass >= `7`)
4361	break;
4362
4363	png_ptr->iwidth = (png_ptr->width +
4364	png_pass_inc[png_ptr->pass] - `1` -
4365	png_pass_start[png_ptr->pass]) /
4366	png_pass_inc[png_ptr->pass];
4367
4368	if ((png_ptr->transformations & PNG_INTERLACE) == `0`)
4369	{
4370	png_ptr->num_rows = (png_ptr->height +
4371	png_pass_yinc[png_ptr->pass] - `1` -
4372	png_pass_ystart[png_ptr->pass]) /
4373	png_pass_yinc[png_ptr->pass];
4374	}
4375
4376	else / if (png_ptr->transformations & PNG_INTERLACE) /
4377	break; / libpng deinterlacing sees every row /
4378
4379	} while (png_ptr->num_rows == `0` \|\| png_ptr->iwidth == `0`);
4380
4381	if (png_ptr->pass < `7`)
4382	return;
4383	}
4384
4385	/ Here after at the end of the last row of the last pass. /
4386	png_read_finish_IDAT(png_ptr);
4387	}
4388	#endif /* SEQUENTIAL_READ */
4389
4390	void / PRIVATE /
4391	png_read_start_row(png_structrp png_ptr)
4392	{
4393	/ Arrays to facilitate easy interlacing - use pass (0 - 6) as index /
4394
4395	/ Start of interlace block /
4396	static const png_byte png_pass_start[`7`] = {`0`, `4`, `0`, `2`, `0`, `1`, `0`};
4397
4398	/ Offset to next interlace block /
4399	static const png_byte png_pass_inc[`7`] = {`8`, `8`, `4`, `4`, `2`, `2`, `1`};
4400
4401	/ Start of interlace block in the y direction /
4402	static const png_byte png_pass_ystart[`7`] = {`0`, `0`, `4`, `0`, `2`, `0`, `1`};
4403
4404	/ Offset to next interlace block in the y direction /
4405	static const png_byte png_pass_yinc[`7`] = {`8`, `8`, `8`, `4`, `4`, `2`, `2`};
4406
4407	unsigned int max_pixel_depth;
4408	size_t row_bytes;
4409
4410	png_debug(`1`, "in png_read_start_row");
4411
4412	#ifdef PNG_READ_TRANSFORMS_SUPPORTED
4413	png_init_read_transformations(png_ptr);
4414	#endif
4415	if (png_ptr->interlaced != `0`)
4416	{
4417	if ((png_ptr->transformations & PNG_INTERLACE) == `0`)
4418	png_ptr->num_rows = (png_ptr->height + png_pass_yinc[`0`] - `1` -
4419	png_pass_ystart[`0`]) / png_pass_yinc[`0`];
4420
4421	else
4422	png_ptr->num_rows = png_ptr->height;
4423
4424	png_ptr->iwidth = (png_ptr->width +
4425	png_pass_inc[png_ptr->pass] - `1` -
4426	png_pass_start[png_ptr->pass]) /
4427	png_pass_inc[png_ptr->pass];
4428	}
4429
4430	else
4431	{
4432	png_ptr->num_rows = png_ptr->height;
4433	png_ptr->iwidth = png_ptr->width;
4434	}
4435
4436	max_pixel_depth = (unsigned int)png_ptr->pixel_depth;
4437
4438	/ WARNING: * png_read_transform_info (pngrtran.c) performs a simpler set of*
4439	* calculations to calculate the final pixel depth, then
4440	* png_do_read_transforms actually does the transforms. This means that the
4441	* code which effectively calculates this value is actually repeated in three
4442	* separate places. They must all match. Innocent changes to the order of
4443	* transformations can and will break libpng in a way that causes memory
4444	* overwrites.
4445	*
4446	* TODO: fix this.
4447	*/
4448	#ifdef PNG_READ_PACK_SUPPORTED
4449	if ((png_ptr->transformations & PNG_PACK) != `0` && png_ptr->bit_depth < `8`)
4450	max_pixel_depth = `8`;
4451	#endif
4452
4453	#ifdef PNG_READ_EXPAND_SUPPORTED
4454	if ((png_ptr->transformations & PNG_EXPAND) != `0`)
4455	{
4456	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
4457	{
4458	if (png_ptr->num_trans != `0`)
4459	max_pixel_depth = `32`;
4460
4461	else
4462	max_pixel_depth = `24`;
4463	}
4464
4465	else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
4466	{
4467	if (max_pixel_depth < `8`)
4468	max_pixel_depth = `8`;
4469
4470	if (png_ptr->num_trans != `0`)
4471	max_pixel_depth *= `2`;
4472	}
4473
4474	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
4475	{
4476	if (png_ptr->num_trans != `0`)
4477	{
4478	max_pixel_depth *= `4`;
4479	max_pixel_depth /= `3`;
4480	}
4481	}
4482	}
4483	#endif
4484
4485	#ifdef PNG_READ_EXPAND_16_SUPPORTED
4486	if ((png_ptr->transformations & PNG_EXPAND_16) != `0`)
4487	{
4488	# ifdef PNG_READ_EXPAND_SUPPORTED
4489	/ In fact it is an error if it isn't supported, but checking is*
4490	* the safe way.
4491	*/
4492	if ((png_ptr->transformations & PNG_EXPAND) != `0`)
4493	{
4494	if (png_ptr->bit_depth < `16`)
4495	max_pixel_depth *= `2`;
4496	}
4497	else
4498	# endif
4499	png_ptr->transformations &= ~PNG_EXPAND_16;
4500	}
4501	#endif
4502
4503	#ifdef PNG_READ_FILLER_SUPPORTED
4504	if ((png_ptr->transformations & (PNG_FILLER)) != `0`)
4505	{
4506	if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
4507	{
4508	if (max_pixel_depth <= `8`)
4509	max_pixel_depth = `16`;
4510
4511	else
4512	max_pixel_depth = `32`;
4513	}
4514
4515	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB \|\|
4516	png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
4517	{
4518	if (max_pixel_depth <= `32`)
4519	max_pixel_depth = `32`;
4520
4521	else
4522	max_pixel_depth = `64`;
4523	}
4524	}
4525	#endif
4526
4527	#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
4528	if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != `0`)
4529	{
4530	if (
4531	#ifdef PNG_READ_EXPAND_SUPPORTED
4532	(png_ptr->num_trans != `0` &&
4533	(png_ptr->transformations & PNG_EXPAND) != `0`) \|\|
4534	#endif
4535	#ifdef PNG_READ_FILLER_SUPPORTED
4536	(png_ptr->transformations & (PNG_FILLER)) != `0` \|\|
4537	#endif
4538	png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
4539	{
4540	if (max_pixel_depth <= `16`)
4541	max_pixel_depth = `32`;
4542
4543	else
4544	max_pixel_depth = `64`;
4545	}
4546
4547	else
4548	{
4549	if (max_pixel_depth <= `8`)
4550	{
4551	if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4552	max_pixel_depth = `32`;
4553
4554	else
4555	max_pixel_depth = `24`;
4556	}
4557
4558	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4559	max_pixel_depth = `64`;
4560
4561	else
4562	max_pixel_depth = `48`;
4563	}
4564	}
4565	#endif
4566
4567	#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
4568	defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
4569	if ((png_ptr->transformations & PNG_USER_TRANSFORM) != `0`)
4570	{
4571	unsigned int user_pixel_depth = png_ptr->user_transform_depth *
4572	png_ptr->user_transform_channels;
4573
4574	if (user_pixel_depth > max_pixel_depth)
4575	max_pixel_depth = user_pixel_depth;
4576	}
4577	#endif
4578
4579	/ This value is stored in png_struct and double checked in the row read*
4580	* code.
4581	*/
4582	png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;
4583	png_ptr->transformed_pixel_depth = `0`; / calculated on demand /
4584
4585	/ Align the width on the next larger 8 pixels. Mainly used*
4586	* for interlacing
4587	*/
4588	row_bytes = ((png_ptr->width + `7`) & ~((png_uint_32)`7`));
4589	/ Calculate the maximum bytes needed, adding a byte and a pixel*
4590	* for safety's sake
4591	*/
4592	row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
4593	`1` + ((max_pixel_depth + `7`) >> `3U`);
4594
4595	#ifdef PNG_MAX_MALLOC_64K
4596	if (row_bytes > (png_uint_32)`65536L`)
4597	png_error(png_ptr, "This image requires a row greater than 64KB");
4598	#endif
4599
4600	if (row_bytes + `48` > png_ptr->old_big_row_buf_size)
4601	{
4602	png_free(png_ptr, png_ptr->big_row_buf);
4603	png_free(png_ptr, png_ptr->big_prev_row);
4604
4605	if (png_ptr->interlaced != `0`)
4606	png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr,
4607	row_bytes + `48`);
4608
4609	else
4610	png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + `48`);
4611
4612	png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + `48`);
4613
4614	#ifdef PNG_ALIGNED_MEMORY_SUPPORTED
4615	/ Use 16-byte aligned memory for row_buf with at least 16 bytes*
4616	* of padding before and after row_buf; treat prev_row similarly.
4617	* NOTE: the alignment is to the start of the pixels, one beyond the start
4618	* of the buffer, because of the filter byte. Prior to libpng 1.5.6 this
4619	* was incorrect; the filter byte was aligned, which had the exact
4620	* opposite effect of that intended.
4621	*/
4622	{
4623	png_bytep temp = png_ptr->big_row_buf + `32`;
4624	int extra = (int)((temp - (png_bytep)`0`) & `0x0f`);
4625	png_ptr->row_buf = temp - extra - `1`/filter byte/;
4626
4627	temp = png_ptr->big_prev_row + `32`;
4628	extra = (int)((temp - (png_bytep)`0`) & `0x0f`);
4629	png_ptr->prev_row = temp - extra - `1`/filter byte/;
4630	}
4631
4632	#else
4633	/ Use 31 bytes of padding before and 17 bytes after row_buf. /
4634	png_ptr->row_buf = png_ptr->big_row_buf + `31`;
4635	png_ptr->prev_row = png_ptr->big_prev_row + `31`;
4636	#endif
4637	png_ptr->old_big_row_buf_size = row_bytes + `48`;
4638	}
4639
4640	#ifdef PNG_MAX_MALLOC_64K
4641	if (png_ptr->rowbytes > `65535`)
4642	png_error(png_ptr, "This image requires a row greater than 64KB");
4643
4644	#endif
4645	if (png_ptr->rowbytes > (PNG_SIZE_MAX - `1`))
4646	png_error(png_ptr, "Row has too many bytes to allocate in memory");
4647
4648	memset(png_ptr->prev_row, `0`, png_ptr->rowbytes + `1`);
4649
4650	png_debug1(`3`, "width = %u,", png_ptr->width);
4651	png_debug1(`3`, "height = %u,", png_ptr->height);
4652	png_debug1(`3`, "iwidth = %u,", png_ptr->iwidth);
4653	png_debug1(`3`, "num_rows = %u,", png_ptr->num_rows);
4654	png_debug1(`3`, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes);
4655	png_debug1(`3`, "irowbytes = %lu",
4656	(unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + `1`);
4657
4658	/ The sequential reader needs a buffer for IDAT, but the progressive reader*
4659	* does not, so free the read buffer now regardless; the sequential reader
4660	* reallocates it on demand.
4661	*/
4662	if (png_ptr->read_buffer != NULL)
4663	{
4664	png_bytep buffer = png_ptr->read_buffer;
4665
4666	png_ptr->read_buffer_size = `0`;
4667	png_ptr->read_buffer = NULL;
4668	png_free(png_ptr, buffer);
4669	}
4670
4671	/ Finally claim the zstream for the inflate of the IDAT data, use the bits*
4672	* value from the stream (note that this will result in a fatal error if the
4673	* IDAT stream has a bogus deflate header window_bits value, but this should
4674	* not be happening any longer!)
4675	*/
4676	if (png_inflate_claim(png_ptr, png_IDAT) != Z_OK)
4677	png_error(png_ptr, png_ptr->zstream.msg);
4678
4679	png_ptr->flags \|= PNG_FLAG_ROW_INIT;
4680	}
4681	#endif /* READ */
4682

Browse the source code of Skia/third_party/externals/libpng/pngrutil.c