pngrutil.c source code [TIC-80/vendor/libpng/pngrutil.c]

1
2	/ pngrutil.c - utilities to read a PNG file*
3	*
4	* Copyright (c) 2018 Cosmin Truta
5	* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
6	* Copyright (c) 1996-1997 Andreas Dilger
7	* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
8	*
9	* This code is released under the libpng license.
10	* For conditions of distribution and use, see the disclaimer
11	* and license in png.h
12	*
13	* This file contains routines that are only called from within
14	* libpng itself during the course of reading an image.
15	*/
16
17	#include "pngpriv.h"
18
19	#ifdef PNG_READ_SUPPORTED
20
21	png_uint_32 PNGAPI
22	png_get_uint_31(png_const_structrp png_ptr, png_const_bytep buf)
23	{
24	png_uint_32 uval = png_get_uint_32(buf);
25
26	if (uval > PNG_UINT_31_MAX)
27	png_error(png_ptr, "PNG unsigned integer out of range");
28
29	return (uval);
30	}
31
32	#if defined(PNG_READ_gAMA_SUPPORTED) \|\| defined(PNG_READ_cHRM_SUPPORTED)
33	/ The following is a variation on the above for use with the fixed*
34	* point values used for gAMA and cHRM. Instead of png_error it
35	* issues a warning and returns (-1) - an invalid value because both
36	* gAMA and cHRM use unsigned integers for fixed point values.
37	*/
38	#define PNG_FIXED_ERROR (-1)
39
40	static png_fixed_point / PRIVATE /
41	png_get_fixed_point(png_structrp png_ptr, png_const_bytep buf)
42	{
43	png_uint_32 uval = png_get_uint_32(buf);
44
45	if (uval <= PNG_UINT_31_MAX)
46	return (png_fixed_point)uval; / known to be in range /
47
48	/ The caller can turn off the warning by passing NULL. /
49	if (png_ptr != NULL)
50	png_warning(png_ptr, "PNG fixed point integer out of range");
51
52	return PNG_FIXED_ERROR;
53	}
54	#endif
55
56	#ifdef PNG_READ_INT_FUNCTIONS_SUPPORTED
57	/ NOTE: the read macros will obscure these definitions, so that if*
58	* PNG_USE_READ_MACROS is set the library will not use them internally,
59	* but the APIs will still be available externally.
60	*
61	* The parentheses around "PNGAPI function_name" in the following three
62	* functions are necessary because they allow the macros to co-exist with
63	* these (unused but exported) functions.
64	*/
65
66	/ Grab an unsigned 32-bit integer from a buffer in big-endian format. /
67	png_uint_32 (PNGAPI
68	png_get_uint_32)(png_const_bytep buf)
69	{
70	png_uint_32 uval =
71	((png_uint_32)(*(buf )) << `24`) +
72	((png_uint_32)(*(buf + `1`)) << `16`) +
73	((png_uint_32)(*(buf + `2`)) << `8`) +
74	((png_uint_32)(*(buf + `3`)) ) ;
75
76	return uval;
77	}
78
79	/ Grab a signed 32-bit integer from a buffer in big-endian format. The*
80	* data is stored in the PNG file in two's complement format and there
81	* is no guarantee that a 'png_int_32' is exactly 32 bits, therefore
82	* the following code does a two's complement to native conversion.
83	*/
84	png_int_32 (PNGAPI
85	png_get_int_32)(png_const_bytep buf)
86	{
87	png_uint_32 uval = png_get_uint_32(buf);
88	if ((uval & `0x80000000`) == `0`) / non-negative /
89	return (png_int_32)uval;
90
91	uval = (uval ^ `0xffffffff`) + `1`; / 2's complement: -x = ~x+1 /
92	if ((uval & `0x80000000`) == `0`) / no overflow /
93	return -(png_int_32)uval;
94	/ The following has to be safe; this function only gets called on PNG data*
95	* and if we get here that data is invalid. 0 is the most safe value and
96	* if not then an attacker would surely just generate a PNG with 0 instead.
97	*/
98	return `0`;
99	}
100
101	/ Grab an unsigned 16-bit integer from a buffer in big-endian format. /
102	png_uint_16 (PNGAPI
103	png_get_uint_16)(png_const_bytep buf)
104	{
105	/ ANSI-C requires an int value to accommodate at least 16 bits so this*
106	* works and allows the compiler not to worry about possible narrowing
107	* on 32-bit systems. (Pre-ANSI systems did not make integers smaller
108	* than 16 bits either.)
109	*/
110	unsigned int val =
111	((unsigned int)(*buf) << `8`) +
112	((unsigned int)(*(buf + `1`)));
113
114	return (png_uint_16)val;
115	}
116
117	#endif /* READ_INT_FUNCTIONS */
118
119	/ Read and check the PNG file signature /
120	void / PRIVATE /
121	png_read_sig(png_structrp png_ptr, png_inforp info_ptr)
122	{
123	size_t num_checked, num_to_check;
124
125	/ Exit if the user application does not expect a signature. /
126	if (png_ptr->sig_bytes >= `8`)
127	return;
128
129	num_checked = png_ptr->sig_bytes;
130	num_to_check = `8` - num_checked;
131
132	#ifdef PNG_IO_STATE_SUPPORTED
133	png_ptr->io_state = PNG_IO_READING \| PNG_IO_SIGNATURE;
134	#endif
135
136	/ The signature must be serialized in a single I/O call. /
137	png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check);
138	png_ptr->sig_bytes = `8`;
139
140	if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check) != `0`)
141	{
142	if (num_checked < `4` &&
143	png_sig_cmp(info_ptr->signature, num_checked, num_to_check - `4`))
144	png_error(png_ptr, "Not a PNG file");
145	else
146	png_error(png_ptr, "PNG file corrupted by ASCII conversion");
147	}
148	if (num_checked < `3`)
149	png_ptr->mode \|= PNG_HAVE_PNG_SIGNATURE;
150	}
151
152	/ Read the chunk header (length + type name).*
153	* Put the type name into png_ptr->chunk_name, and return the length.
154	*/
155	png_uint_32 / PRIVATE /
156	png_read_chunk_header(png_structrp png_ptr)
157	{
158	png_byte buf[`8`];
159	png_uint_32 length;
160
161	#ifdef PNG_IO_STATE_SUPPORTED
162	png_ptr->io_state = PNG_IO_READING \| PNG_IO_CHUNK_HDR;
163	#endif
164
165	/ Read the length and the chunk name.*
166	* This must be performed in a single I/O call.
167	*/
168	png_read_data(png_ptr, buf, `8`);
169	length = png_get_uint_31(png_ptr, buf);
170
171	/ Put the chunk name into png_ptr->chunk_name. /
172	png_ptr->chunk_name = PNG_CHUNK_FROM_STRING(buf+`4`);
173
174	png_debug2(`0`, "Reading %lx chunk, length = %lu",
175	(unsigned long)png_ptr->chunk_name, (unsigned long)length);
176
177	/ Reset the crc and run it over the chunk name. /
178	png_reset_crc(png_ptr);
179	png_calculate_crc(png_ptr, buf + `4`, `4`);
180
181	/ Check to see if chunk name is valid. /
182	png_check_chunk_name(png_ptr, png_ptr->chunk_name);
183
184	/ Check for too-large chunk length /
185	png_check_chunk_length(png_ptr, length);
186
187	#ifdef PNG_IO_STATE_SUPPORTED
188	png_ptr->io_state = PNG_IO_READING \| PNG_IO_CHUNK_DATA;
189	#endif
190
191	return length;
192	}
193
194	/ Read data, and (optionally) run it through the CRC. /
195	void / PRIVATE /
196	png_crc_read(png_structrp png_ptr, png_bytep buf, png_uint_32 length)
197	{
198	if (png_ptr == NULL)
199	return;
200
201	png_read_data(png_ptr, buf, length);
202	png_calculate_crc(png_ptr, buf, length);
203	}
204
205	/ Optionally skip data and then check the CRC. Depending on whether we*
206	* are reading an ancillary or critical chunk, and how the program has set
207	* things up, we may calculate the CRC on the data and print a message.
208	* Returns '1' if there was a CRC error, '0' otherwise.
209	*/
210	int / PRIVATE /
211	png_crc_finish(png_structrp png_ptr, png_uint_32 skip)
212	{
213	/ The size of the local buffer for inflate is a good guess as to a*
214	* reasonable size to use for buffering reads from the application.
215	*/
216	while (skip > `0`)
217	{
218	png_uint_32 len;
219	png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
220
221	len = (sizeof tmpbuf);
222	if (len > skip)
223	len = skip;
224	skip -= len;
225
226	png_crc_read(png_ptr, tmpbuf, len);
227	}
228
229	if (png_crc_error(png_ptr) != `0`)
230	{
231	if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != `0` ?
232	(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == `0` :
233	(png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE) != `0`)
234	{
235	png_chunk_warning(png_ptr, "CRC error");
236	}
237
238	else
239	png_chunk_error(png_ptr, "CRC error");
240
241	return (`1`);
242	}
243
244	return (`0`);
245	}
246
247	/ Compare the CRC stored in the PNG file with that calculated by libpng from*
248	* the data it has read thus far.
249	*/
250	int / PRIVATE /
251	png_crc_error(png_structrp png_ptr)
252	{
253	png_byte crc_bytes[`4`];
254	png_uint_32 crc;
255	int need_crc = `1`;
256
257	if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != `0`)
258	{
259	if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
260	(PNG_FLAG_CRC_ANCILLARY_USE \| PNG_FLAG_CRC_ANCILLARY_NOWARN))
261	need_crc = `0`;
262	}
263
264	else / critical /
265	{
266	if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != `0`)
267	need_crc = `0`;
268	}
269
270	#ifdef PNG_IO_STATE_SUPPORTED
271	png_ptr->io_state = PNG_IO_READING \| PNG_IO_CHUNK_CRC;
272	#endif
273
274	/ The chunk CRC must be serialized in a single I/O call. /
275	png_read_data(png_ptr, crc_bytes, `4`);
276
277	if (need_crc != `0`)
278	{
279	crc = png_get_uint_32(crc_bytes);
280	return ((int)(crc != png_ptr->crc));
281	}
282
283	else
284	return (`0`);
285	}
286
287	#if defined(PNG_READ_iCCP_SUPPORTED) \|\| defined(PNG_READ_iTXt_SUPPORTED) \|\|\
288	defined(PNG_READ_pCAL_SUPPORTED) \|\| defined(PNG_READ_sCAL_SUPPORTED) \|\|\
289	defined(PNG_READ_sPLT_SUPPORTED) \|\| defined(PNG_READ_tEXt_SUPPORTED) \|\|\
290	defined(PNG_READ_zTXt_SUPPORTED) \|\| defined(PNG_SEQUENTIAL_READ_SUPPORTED)
291	/ Manage the read buffer; this simply reallocates the buffer if it is not small*
292	* enough (or if it is not allocated). The routine returns a pointer to the
293	* buffer; if an error occurs and 'warn' is set the routine returns NULL, else
294	* it will call png_error (via png_malloc) on failure. (warn == 2 means
295	* 'silent').
296	*/
297	static png_bytep
298	png_read_buffer(png_structrp png_ptr, png_alloc_size_t new_size, int warn)
299	{
300	png_bytep buffer = png_ptr->read_buffer;
301
302	if (buffer != NULL && new_size > png_ptr->read_buffer_size)
303	{
304	png_ptr->read_buffer = NULL;
305	png_ptr->read_buffer = NULL;
306	png_ptr->read_buffer_size = `0`;
307	png_free(png_ptr, buffer);
308	buffer = NULL;
309	}
310
311	if (buffer == NULL)
312	{
313	buffer = png_voidcast(png_bytep, png_malloc_base(png_ptr, new_size));
314
315	if (buffer != NULL)
316	{
317	memset(buffer, `0`, new_size); / just in case /
318	png_ptr->read_buffer = buffer;
319	png_ptr->read_buffer_size = new_size;
320	}
321
322	else if (warn < `2`) / else silent /
323	{
324	if (warn != `0`)
325	png_chunk_warning(png_ptr, "insufficient memory to read chunk");
326
327	else
328	png_chunk_error(png_ptr, "insufficient memory to read chunk");
329	}
330	}
331
332	return buffer;
333	}
334	#endif /* READ_iCCP\|iTXt\|pCAL\|sCAL\|sPLT\|tEXt\|zTXt\|SEQUENTIAL_READ */
335
336	/ png_inflate_claim: claim the zstream for some nefarious purpose that involves*
337	* decompression. Returns Z_OK on success, else a zlib error code. It checks
338	* the owner but, in final release builds, just issues a warning if some other
339	* chunk apparently owns the stream. Prior to release it does a png_error.
340	*/
341	static int
342	png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
343	{
344	if (png_ptr->zowner != `0`)
345	{
346	char msg[`64`];
347
348	PNG_STRING_FROM_CHUNK(msg, png_ptr->zowner);
349	/ So the message that results is "<chunk> using zstream"; this is an*
350	* internal error, but is very useful for debugging. i18n requirements
351	* are minimal.
352	*/
353	(void)png_safecat(msg, (sizeof msg), `4`, " using zstream");
354	#if PNG_RELEASE_BUILD
355	png_chunk_warning(png_ptr, msg);
356	png_ptr->zowner = `0`;
357	#else
358	png_chunk_error(png_ptr, msg);
359	#endif
360	}
361
362	/ Implementation note: unlike 'png_deflate_claim' this internal function*
363	* does not take the size of the data as an argument. Some efficiency could
364	* be gained by using this when it is known if the zlib stream itself does
365	* not record the number; however, this is an illusion: the original writer
366	* of the PNG may have selected a lower window size, and we really must
367	* follow that because, for systems with with limited capabilities, we
368	* would otherwise reject the application's attempts to use a smaller window
369	* size (zlib doesn't have an interface to say "this or lower"!).
370	*
371	* inflateReset2 was added to zlib 1.2.4; before this the window could not be
372	* reset, therefore it is necessary to always allocate the maximum window
373	* size with earlier zlibs just in case later compressed chunks need it.
374	*/
375	{
376	int ret; / zlib return code /
377	#if ZLIB_VERNUM >= 0x1240
378	int window_bits = `0`;
379
380	# if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW)
381	if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & `3`) ==
382	PNG_OPTION_ON)
383	{
384	window_bits = `15`;
385	png_ptr->zstream_start = `0`; / fixed window size /
386	}
387
388	else
389	{
390	png_ptr->zstream_start = `1`;
391	}
392	# endif
393
394	#endif /* ZLIB_VERNUM >= 0x1240 */
395
396	/ Set this for safety, just in case the previous owner left pointers to*
397	* memory allocations.
398	*/
399	png_ptr->zstream.next_in = NULL;
400	png_ptr->zstream.avail_in = `0`;
401	png_ptr->zstream.next_out = NULL;
402	png_ptr->zstream.avail_out = `0`;
403
404	if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != `0`)
405	{
406	#if ZLIB_VERNUM >= 0x1240
407	ret = inflateReset2(&png_ptr->zstream, window_bits);
408	#else
409	ret = inflateReset(&png_ptr->zstream);
410	#endif
411	}
412
413	else
414	{
415	#if ZLIB_VERNUM >= 0x1240
416	ret = inflateInit2(&png_ptr->zstream, window_bits);
417	#else
418	ret = inflateInit(&png_ptr->zstream);
419	#endif
420
421	if (ret == Z_OK)
422	png_ptr->flags \|= PNG_FLAG_ZSTREAM_INITIALIZED;
423	}
424
425	#if ZLIB_VERNUM >= 0x1290 && \
426	defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_IGNORE_ADLER32)
427	if (((png_ptr->options >> PNG_IGNORE_ADLER32) & `3`) == PNG_OPTION_ON)
428	/ Turn off validation of the ADLER32 checksum in IDAT chunks /
429	ret = inflateValidate(&png_ptr->zstream, `0`);
430	#endif
431
432	if (ret == Z_OK)
433	png_ptr->zowner = owner;
434
435	else
436	png_zstream_error(png_ptr, ret);
437
438	return ret;
439	}
440
441	#ifdef window_bits
442	# undef window_bits
443	#endif
444	}
445
446	#if ZLIB_VERNUM >= 0x1240
447	/ Handle the start of the inflate stream if we called inflateInit2(strm,0);*
448	* in this case some zlib versions skip validation of the CINFO field and, in
449	* certain circumstances, libpng may end up displaying an invalid image, in
450	* contrast to implementations that call zlib in the normal way (e.g. libpng
451	* 1.5).
452	*/
453	int / PRIVATE /
454	png_zlib_inflate(png_structrp png_ptr, int flush)
455	{
456	if (png_ptr->zstream_start && png_ptr->zstream.avail_in > `0`)
457	{
458	if ((*png_ptr->zstream.next_in >> `4`) > `7`)
459	{
460	png_ptr->zstream.msg = "invalid window size (libpng)";
461	return Z_DATA_ERROR;
462	}
463
464	png_ptr->zstream_start = `0`;
465	}
466
467	return inflate(&png_ptr->zstream, flush);
468	}
469	#endif /* Zlib >= 1.2.4 */
470
471	#ifdef PNG_READ_COMPRESSED_TEXT_SUPPORTED
472	#if defined(PNG_READ_zTXt_SUPPORTED) \|\| defined (PNG_READ_iTXt_SUPPORTED)
473	/ png_inflate now returns zlib error codes including Z_OK and Z_STREAM_END to*
474	* allow the caller to do multiple calls if required. If the 'finish' flag is
475	* set Z_FINISH will be passed to the final inflate() call and Z_STREAM_END must
476	* be returned or there has been a problem, otherwise Z_SYNC_FLUSH is used and
477	* Z_OK or Z_STREAM_END will be returned on success.
478	*
479	* The input and output sizes are updated to the actual amounts of data consumed
480	* or written, not the amount available (as in a z_stream). The data pointers
481	* are not changed, so the next input is (data+input_size) and the next
482	* available output is (output+output_size).
483	*/
484	static int
485	png_inflate(png_structrp png_ptr, png_uint_32 owner, int finish,
486	/ INPUT: / png_const_bytep input, png_uint_32p input_size_ptr,
487	/ OUTPUT: / png_bytep output, png_alloc_size_t *output_size_ptr)
488	{
489	if (png_ptr->zowner == owner) / Else not claimed /
490	{
491	int ret;
492	png_alloc_size_t avail_out = *output_size_ptr;
493	png_uint_32 avail_in = *input_size_ptr;
494
495	/ zlib can't necessarily handle more than 65535 bytes at once (i.e. it*
496	* can't even necessarily handle 65536 bytes) because the type uInt is
497	* "16 bits or more". Consequently it is necessary to chunk the input to
498	* zlib. This code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the
499	* maximum value that can be stored in a uInt.) It is possible to set
500	* ZLIB_IO_MAX to a lower value in pngpriv.h and this may sometimes have
501	* a performance advantage, because it reduces the amount of data accessed
502	* at each step and that may give the OS more time to page it in.
503	*/
504	png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input);
505	/ avail_in and avail_out are set below from 'size' /
506	png_ptr->zstream.avail_in = `0`;
507	png_ptr->zstream.avail_out = `0`;
508
509	/ Read directly into the output if it is available (this is set to*
510	* a local buffer below if output is NULL).
511	*/
512	if (output != NULL)
513	png_ptr->zstream.next_out = output;
514
515	do
516	{
517	uInt avail;
518	Byte local_buffer[PNG_INFLATE_BUF_SIZE];
519
520	/ zlib INPUT BUFFER /
521	/ The setting of 'avail_in' used to be outside the loop; by setting it*
522	* inside it is possible to chunk the input to zlib and simply rely on
523	* zlib to advance the 'next_in' pointer. This allows arbitrary
524	* amounts of data to be passed through zlib at the unavoidable cost of
525	* requiring a window save (memcpy of up to 32768 output bytes)
526	* every ZLIB_IO_MAX input bytes.
527	*/
528	avail_in += png_ptr->zstream.avail_in; / not consumed last time /
529
530	avail = ZLIB_IO_MAX;
531
532	if (avail_in < avail)
533	avail = (uInt)avail_in; / safe: < than ZLIB_IO_MAX /
534
535	avail_in -= avail;
536	png_ptr->zstream.avail_in = avail;
537
538	/ zlib OUTPUT BUFFER /
539	avail_out += png_ptr->zstream.avail_out; / not written last time /
540
541	avail = ZLIB_IO_MAX; / maximum zlib can process /
542
543	if (output == NULL)
544	{
545	/ Reset the output buffer each time round if output is NULL and*
546	* make available the full buffer, up to 'remaining_space'
547	*/
548	png_ptr->zstream.next_out = local_buffer;
549	if ((sizeof local_buffer) < avail)
550	avail = (sizeof local_buffer);
551	}
552
553	if (avail_out < avail)
554	avail = (uInt)avail_out; / safe: < ZLIB_IO_MAX /
555
556	png_ptr->zstream.avail_out = avail;
557	avail_out -= avail;
558
559	/ zlib inflate call /
560	/ In fact 'avail_out' may be 0 at this point, that happens at the end*
561	* of the read when the final LZ end code was not passed at the end of
562	* the previous chunk of input data. Tell zlib if we have reached the
563	* end of the output buffer.
564	*/
565	ret = PNG_INFLATE(png_ptr, avail_out > `0` ? Z_NO_FLUSH :
566	(finish ? Z_FINISH : Z_SYNC_FLUSH));
567	} while (ret == Z_OK);
568
569	/ For safety kill the local buffer pointer now /
570	if (output == NULL)
571	png_ptr->zstream.next_out = NULL;
572
573	/ Claw back the 'size' and 'remaining_space' byte counts. /
574	avail_in += png_ptr->zstream.avail_in;
575	avail_out += png_ptr->zstream.avail_out;
576
577	/ Update the input and output sizes; the updated values are the amount*
578	* consumed or written, effectively the inverse of what zlib uses.
579	*/
580	if (avail_out > `0`)
581	*output_size_ptr -= avail_out;
582
583	if (avail_in > `0`)
584	*input_size_ptr -= avail_in;
585
586	/ Ensure png_ptr->zstream.msg is set (even in the success case!) /
587	png_zstream_error(png_ptr, ret);
588	return ret;
589	}
590
591	else
592	{
593	/ This is a bad internal error. The recovery assigns to the zstream msg*
594	* pointer, which is not owned by the caller, but this is safe; it's only
595	* used on errors!
596	*/
597	png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
598	return Z_STREAM_ERROR;
599	}
600	}
601
602	/*
603	* Decompress trailing data in a chunk. The assumption is that read_buffer
604	* points at an allocated area holding the contents of a chunk with a
605	* trailing compressed part. What we get back is an allocated area
606	* holding the original prefix part and an uncompressed version of the
607	* trailing part (the malloc area passed in is freed).
608	*/
609	static int
610	png_decompress_chunk(png_structrp png_ptr,
611	png_uint_32 chunklength, png_uint_32 prefix_size,
612	png_alloc_size_t newlength /* must be initialized to the maximum! /,
613	int terminate /add a '\0' to the end of the uncompressed data/)
614	{
615	/ TODO: implement different limits for different types of chunk.*
616	*
617	* The caller supplies *newlength set to the maximum length of the
618	* uncompressed data, but this routine allocates space for the prefix and
619	* maybe a '\0' terminator too. We have to assume that 'prefix_size' is
620	* limited only by the maximum chunk size.
621	*/
622	png_alloc_size_t limit = PNG_SIZE_MAX;
623
624	# ifdef PNG_SET_USER_LIMITS_SUPPORTED
625	if (png_ptr->user_chunk_malloc_max > `0` &&
626	png_ptr->user_chunk_malloc_max < limit)
627	limit = png_ptr->user_chunk_malloc_max;
628	# elif PNG_USER_CHUNK_MALLOC_MAX > 0
629	if (PNG_USER_CHUNK_MALLOC_MAX < limit)
630	limit = PNG_USER_CHUNK_MALLOC_MAX;
631	# endif
632
633	if (limit >= prefix_size + (terminate != `0`))
634	{
635	int ret;
636
637	limit -= prefix_size + (terminate != `0`);
638
639	if (limit < *newlength)
640	*newlength = limit;
641
642	/ Now try to claim the stream. /
643	ret = png_inflate_claim(png_ptr, png_ptr->chunk_name);
644
645	if (ret == Z_OK)
646	{
647	png_uint_32 lzsize = chunklength - prefix_size;
648
649	ret = png_inflate(png_ptr, png_ptr->chunk_name, `1`/finish/,
650	/ input: / png_ptr->read_buffer + prefix_size, &lzsize,
651	/ output: / NULL, newlength);
652
653	if (ret == Z_STREAM_END)
654	{
655	/ Use 'inflateReset' here, not 'inflateReset2' because this*
656	* preserves the previously decided window size (otherwise it would
657	* be necessary to store the previous window size.) In practice
658	* this doesn't matter anyway, because png_inflate will call inflate
659	* with Z_FINISH in almost all cases, so the window will not be
660	* maintained.
661	*/
662	if (inflateReset(&png_ptr->zstream) == Z_OK)
663	{
664	/ Because of the limit checks above we know that the new,*
665	* expanded, size will fit in a size_t (let alone an
666	* png_alloc_size_t). Use png_malloc_base here to avoid an
667	* extra OOM message.
668	*/
669	png_alloc_size_t new_size = *newlength;
670	png_alloc_size_t buffer_size = prefix_size + new_size +
671	(terminate != `0`);
672	png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr,
673	buffer_size));
674
675	if (text != NULL)
676	{
677	memset(text, `0`, buffer_size);
678
679	ret = png_inflate(png_ptr, png_ptr->chunk_name, `1`/finish/,
680	png_ptr->read_buffer + prefix_size, &lzsize,
681	text + prefix_size, newlength);
682
683	if (ret == Z_STREAM_END)
684	{
685	if (new_size == *newlength)
686	{
687	if (terminate != `0`)
688	text[prefix_size + *newlength] = `0`;
689
690	if (prefix_size > `0`)
691	memcpy(text, png_ptr->read_buffer, prefix_size);
692
693	{
694	png_bytep old_ptr = png_ptr->read_buffer;
695
696	png_ptr->read_buffer = text;
697	png_ptr->read_buffer_size = buffer_size;
698	text = old_ptr; / freed below /
699	}
700	}
701
702	else
703	{
704	/ The size changed on the second read, there can be no*
705	* guarantee that anything is correct at this point.
706	* The 'msg' pointer has been set to "unexpected end of
707	* LZ stream", which is fine, but return an error code
708	* that the caller won't accept.
709	*/
710	ret = PNG_UNEXPECTED_ZLIB_RETURN;
711	}
712	}
713
714	else if (ret == Z_OK)
715	ret = PNG_UNEXPECTED_ZLIB_RETURN; / for safety /
716
717	/ Free the text pointer (this is the old read_buffer on*
718	* success)
719	*/
720	png_free(png_ptr, text);
721
722	/ This really is very benign, but it's still an error because*
723	* the extra space may otherwise be used as a Trojan Horse.
724	*/
725	if (ret == Z_STREAM_END &&
726	chunklength - prefix_size != lzsize)
727	png_chunk_benign_error(png_ptr, "extra compressed data");
728	}
729
730	else
731	{
732	/ Out of memory allocating the buffer /
733	ret = Z_MEM_ERROR;
734	png_zstream_error(png_ptr, Z_MEM_ERROR);
735	}
736	}
737
738	else
739	{
740	/ inflateReset failed, store the error message /
741	png_zstream_error(png_ptr, ret);
742	ret = PNG_UNEXPECTED_ZLIB_RETURN;
743	}
744	}
745
746	else if (ret == Z_OK)
747	ret = PNG_UNEXPECTED_ZLIB_RETURN;
748
749	/ Release the claimed stream /
750	png_ptr->zowner = `0`;
751	}
752
753	else / the claim failed / if (ret == Z_STREAM_END) / impossible! /
754	ret = PNG_UNEXPECTED_ZLIB_RETURN;
755
756	return ret;
757	}
758
759	else
760	{
761	/ Application/configuration limits exceeded /
762	png_zstream_error(png_ptr, Z_MEM_ERROR);
763	return Z_MEM_ERROR;
764	}
765	}
766	#endif /* READ_zTXt \|\| READ_iTXt */
767	#endif /* READ_COMPRESSED_TEXT */
768
769	#ifdef PNG_READ_iCCP_SUPPORTED
770	/ Perform a partial read and decompress, producing 'avail_out' bytes and*
771	* reading from the current chunk as required.
772	*/
773	static int
774	png_inflate_read(png_structrp png_ptr, png_bytep read_buffer, uInt read_size,
775	png_uint_32p chunk_bytes, png_bytep next_out, png_alloc_size_t *out_size,
776	int finish)
777	{
778	if (png_ptr->zowner == png_ptr->chunk_name)
779	{
780	int ret;
781
782	/ next_in and avail_in must have been initialized by the caller. /
783	png_ptr->zstream.next_out = next_out;
784	png_ptr->zstream.avail_out = `0`; / set in the loop /
785
786	do
787	{
788	if (png_ptr->zstream.avail_in == `0`)
789	{
790	if (read_size > *chunk_bytes)
791	read_size = (uInt)*chunk_bytes;
792	*chunk_bytes -= read_size;
793
794	if (read_size > `0`)
795	png_crc_read(png_ptr, read_buffer, read_size);
796
797	png_ptr->zstream.next_in = read_buffer;
798	png_ptr->zstream.avail_in = read_size;
799	}
800
801	if (png_ptr->zstream.avail_out == `0`)
802	{
803	uInt avail = ZLIB_IO_MAX;
804	if (avail > *out_size)
805	avail = (uInt)*out_size;
806	*out_size -= avail;
807
808	png_ptr->zstream.avail_out = avail;
809	}
810
811	/ Use Z_SYNC_FLUSH when there is no more chunk data to ensure that all*
812	* the available output is produced; this allows reading of truncated
813	* streams.
814	*/
815	ret = PNG_INFLATE(png_ptr, *chunk_bytes > `0` ?
816	Z_NO_FLUSH : (finish ? Z_FINISH : Z_SYNC_FLUSH));
817	}
818	while (ret == Z_OK && (*out_size > `0` \|\| png_ptr->zstream.avail_out > `0`));
819
820	*out_size += png_ptr->zstream.avail_out;
821	png_ptr->zstream.avail_out = `0`; / Should not be required, but is safe /
822
823	/ Ensure the error message pointer is always set: /
824	png_zstream_error(png_ptr, ret);
825	return ret;
826	}
827
828	else
829	{
830	png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed");
831	return Z_STREAM_ERROR;
832	}
833	}
834	#endif /* READ_iCCP */
835
836	/ Read and check the IDHR chunk /
837
838	void / PRIVATE /
839	png_handle_IHDR(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
840	{
841	png_byte buf[`13`];
842	png_uint_32 width, height;
843	int bit_depth, color_type, compression_type, filter_type;
844	int interlace_type;
845
846	png_debug(`1`, "in png_handle_IHDR");
847
848	if ((png_ptr->mode & PNG_HAVE_IHDR) != `0`)
849	png_chunk_error(png_ptr, "out of place");
850
851	/ Check the length /
852	if (length != `13`)
853	png_chunk_error(png_ptr, "invalid");
854
855	png_ptr->mode \|= PNG_HAVE_IHDR;
856
857	png_crc_read(png_ptr, buf, `13`);
858	png_crc_finish(png_ptr, `0`);
859
860	width = png_get_uint_31(png_ptr, buf);
861	height = png_get_uint_31(png_ptr, buf + `4`);
862	bit_depth = buf[`8`];
863	color_type = buf[`9`];
864	compression_type = buf[`10`];
865	filter_type = buf[`11`];
866	interlace_type = buf[`12`];
867
868	/ Set internal variables /
869	png_ptr->width = width;
870	png_ptr->height = height;
871	png_ptr->bit_depth = (png_byte)bit_depth;
872	png_ptr->interlaced = (png_byte)interlace_type;
873	png_ptr->color_type = (png_byte)color_type;
874	#ifdef PNG_MNG_FEATURES_SUPPORTED
875	png_ptr->filter_type = (png_byte)filter_type;
876	#endif
877	png_ptr->compression_type = (png_byte)compression_type;
878
879	/ Find number of channels /
880	switch (png_ptr->color_type)
881	{
882	default: / invalid, png_set_IHDR calls png_error /
883	case PNG_COLOR_TYPE_GRAY:
884	case PNG_COLOR_TYPE_PALETTE:
885	png_ptr->channels = `1`;
886	break;
887
888	case PNG_COLOR_TYPE_RGB:
889	png_ptr->channels = `3`;
890	break;
891
892	case PNG_COLOR_TYPE_GRAY_ALPHA:
893	png_ptr->channels = `2`;
894	break;
895
896	case PNG_COLOR_TYPE_RGB_ALPHA:
897	png_ptr->channels = `4`;
898	break;
899	}
900
901	/ Set up other useful info /
902	png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels);
903	png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);
904	png_debug1(`3`, "bit_depth = %d", png_ptr->bit_depth);
905	png_debug1(`3`, "channels = %d", png_ptr->channels);
906	png_debug1(`3`, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes);
907	png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
908	color_type, interlace_type, compression_type, filter_type);
909	}
910
911	/ Read and check the palette /
912	void / PRIVATE /
913	png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
914	{
915	png_color palette[PNG_MAX_PALETTE_LENGTH];
916	int max_palette_length, num, i;
917	#ifdef PNG_POINTER_INDEXING_SUPPORTED
918	png_colorp pal_ptr;
919	#endif
920
921	png_debug(`1`, "in png_handle_PLTE");
922
923	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
924	png_chunk_error(png_ptr, "missing IHDR");
925
926	/ Moved to before the 'after IDAT' check below because otherwise duplicate*
927	* PLTE chunks are potentially ignored (the spec says there shall not be more
928	* than one PLTE, the error is not treated as benign, so this check trumps
929	* the requirement that PLTE appears before IDAT.)
930	*/
931	else if ((png_ptr->mode & PNG_HAVE_PLTE) != `0`)
932	png_chunk_error(png_ptr, "duplicate");
933
934	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
935	{
936	/ This is benign because the non-benign error happened before, when an*
937	* IDAT was encountered in a color-mapped image with no PLTE.
938	*/
939	png_crc_finish(png_ptr, length);
940	png_chunk_benign_error(png_ptr, "out of place");
941	return;
942	}
943
944	png_ptr->mode \|= PNG_HAVE_PLTE;
945
946	if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == `0`)
947	{
948	png_crc_finish(png_ptr, length);
949	png_chunk_benign_error(png_ptr, "ignored in grayscale PNG");
950	return;
951	}
952
953	#ifndef PNG_READ_OPT_PLTE_SUPPORTED
954	if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
955	{
956	png_crc_finish(png_ptr, length);
957	return;
958	}
959	#endif
960
961	if (length > `3`*PNG_MAX_PALETTE_LENGTH \|\| length % `3`)
962	{
963	png_crc_finish(png_ptr, length);
964
965	if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
966	png_chunk_benign_error(png_ptr, "invalid");
967
968	else
969	png_chunk_error(png_ptr, "invalid");
970
971	return;
972	}
973
974	/ The cast is safe because 'length' is less than 3PNG_MAX_PALETTE_LENGTH /*
975	num = (int)length / `3`;
976
977	/ If the palette has 256 or fewer entries but is too large for the bit*
978	* depth, we don't issue an error, to preserve the behavior of previous
979	* libpng versions. We silently truncate the unused extra palette entries
980	* here.
981	*/
982	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
983	max_palette_length = (`1` << png_ptr->bit_depth);
984	else
985	max_palette_length = PNG_MAX_PALETTE_LENGTH;
986
987	if (num > max_palette_length)
988	num = max_palette_length;
989
990	#ifdef PNG_POINTER_INDEXING_SUPPORTED
991	for (i = `0`, pal_ptr = palette; i < num; i++, pal_ptr++)
992	{
993	png_byte buf[`3`];
994
995	png_crc_read(png_ptr, buf, `3`);
996	pal_ptr->red = buf[`0`];
997	pal_ptr->green = buf[`1`];
998	pal_ptr->blue = buf[`2`];
999	}
1000	#else
1001	for (i = `0`; i < num; i++)
1002	{
1003	png_byte buf[`3`];
1004
1005	png_crc_read(png_ptr, buf, `3`);
1006	/ Don't depend upon png_color being any order /
1007	palette[i].red = buf[`0`];
1008	palette[i].green = buf[`1`];
1009	palette[i].blue = buf[`2`];
1010	}
1011	#endif
1012
1013	/ If we actually need the PLTE chunk (ie for a paletted image), we do*
1014	* whatever the normal CRC configuration tells us. However, if we
1015	* have an RGB image, the PLTE can be considered ancillary, so
1016	* we will act as though it is.
1017	*/
1018	#ifndef PNG_READ_OPT_PLTE_SUPPORTED
1019	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1020	#endif
1021	{
1022	png_crc_finish(png_ptr, (png_uint_32) (length - (unsigned int)num * `3`));
1023	}
1024
1025	#ifndef PNG_READ_OPT_PLTE_SUPPORTED
1026	else if (png_crc_error(png_ptr) != `0`) / Only if we have a CRC error /
1027	{
1028	/ If we don't want to use the data from an ancillary chunk,*
1029	* we have two options: an error abort, or a warning and we
1030	* ignore the data in this chunk (which should be OK, since
1031	* it's considered ancillary for a RGB or RGBA image).
1032	*
1033	* IMPLEMENTATION NOTE: this is only here because png_crc_finish uses the
1034	* chunk type to determine whether to check the ancillary or the critical
1035	* flags.
1036	*/
1037	if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE) == `0`)
1038	{
1039	if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) != `0`)
1040	return;
1041
1042	else
1043	png_chunk_error(png_ptr, "CRC error");
1044	}
1045
1046	/ Otherwise, we (optionally) emit a warning and use the chunk. /
1047	else if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == `0`)
1048	png_chunk_warning(png_ptr, "CRC error");
1049	}
1050	#endif
1051
1052	/ TODO: png_set_PLTE has the side effect of setting png_ptr->palette to its*
1053	* own copy of the palette. This has the side effect that when png_start_row
1054	* is called (this happens after any call to png_read_update_info) the
1055	* info_ptr palette gets changed. This is extremely unexpected and
1056	* confusing.
1057	*
1058	* Fix this by not sharing the palette in this way.
1059	*/
1060	png_set_PLTE(png_ptr, info_ptr, palette, num);
1061
1062	/ The three chunks, bKGD, hIST and tRNS must appear after PLTE and before*
1063	* IDAT. Prior to 1.6.0 this was not checked; instead the code merely
1064	* checked the apparent validity of a tRNS chunk inserted before PLTE on a
1065	* palette PNG. 1.6.0 attempts to rigorously follow the standard and
1066	* therefore does a benign error if the erroneous condition is detected and
1067	* cancels the tRNS if the benign error returns. The alternative is to
1068	* amend the standard since it would be rather hypocritical of the standards
1069	* maintainers to ignore it.
1070	*/
1071	#ifdef PNG_READ_tRNS_SUPPORTED
1072	if (png_ptr->num_trans > `0` \|\|
1073	(info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != `0`))
1074	{
1075	/ Cancel this because otherwise it would be used if the transforms*
1076	* require it. Don't cancel the 'valid' flag because this would prevent
1077	* detection of duplicate chunks.
1078	*/
1079	png_ptr->num_trans = `0`;
1080
1081	if (info_ptr != NULL)
1082	info_ptr->num_trans = `0`;
1083
1084	png_chunk_benign_error(png_ptr, "tRNS must be after");
1085	}
1086	#endif
1087
1088	#ifdef PNG_READ_hIST_SUPPORTED
1089	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != `0`)
1090	png_chunk_benign_error(png_ptr, "hIST must be after");
1091	#endif
1092
1093	#ifdef PNG_READ_bKGD_SUPPORTED
1094	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != `0`)
1095	png_chunk_benign_error(png_ptr, "bKGD must be after");
1096	#endif
1097	}
1098
1099	void / PRIVATE /
1100	png_handle_IEND(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1101	{
1102	png_debug(`1`, "in png_handle_IEND");
1103
1104	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0` \|\|
1105	(png_ptr->mode & PNG_HAVE_IDAT) == `0`)
1106	png_chunk_error(png_ptr, "out of place");
1107
1108	png_ptr->mode \|= (PNG_AFTER_IDAT \| PNG_HAVE_IEND);
1109
1110	png_crc_finish(png_ptr, length);
1111
1112	if (length != `0`)
1113	png_chunk_benign_error(png_ptr, "invalid");
1114
1115	PNG_UNUSED(info_ptr)
1116	}
1117
1118	#ifdef PNG_READ_gAMA_SUPPORTED
1119	void / PRIVATE /
1120	png_handle_gAMA(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1121	{
1122	png_fixed_point igamma;
1123	png_byte buf[`4`];
1124
1125	png_debug(`1`, "in png_handle_gAMA");
1126
1127	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1128	png_chunk_error(png_ptr, "missing IHDR");
1129
1130	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1131	{
1132	png_crc_finish(png_ptr, length);
1133	png_chunk_benign_error(png_ptr, "out of place");
1134	return;
1135	}
1136
1137	if (length != `4`)
1138	{
1139	png_crc_finish(png_ptr, length);
1140	png_chunk_benign_error(png_ptr, "invalid");
1141	return;
1142	}
1143
1144	png_crc_read(png_ptr, buf, `4`);
1145
1146	if (png_crc_finish(png_ptr, `0`) != `0`)
1147	return;
1148
1149	igamma = png_get_fixed_point(NULL, buf);
1150
1151	png_colorspace_set_gamma(png_ptr, &png_ptr->colorspace, igamma);
1152	png_colorspace_sync(png_ptr, info_ptr);
1153	}
1154	#endif
1155
1156	#ifdef PNG_READ_sBIT_SUPPORTED
1157	void / PRIVATE /
1158	png_handle_sBIT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1159	{
1160	unsigned int truelen, i;
1161	png_byte sample_depth;
1162	png_byte buf[`4`];
1163
1164	png_debug(`1`, "in png_handle_sBIT");
1165
1166	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1167	png_chunk_error(png_ptr, "missing IHDR");
1168
1169	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1170	{
1171	png_crc_finish(png_ptr, length);
1172	png_chunk_benign_error(png_ptr, "out of place");
1173	return;
1174	}
1175
1176	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT) != `0`)
1177	{
1178	png_crc_finish(png_ptr, length);
1179	png_chunk_benign_error(png_ptr, "duplicate");
1180	return;
1181	}
1182
1183	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1184	{
1185	truelen = `3`;
1186	sample_depth = `8`;
1187	}
1188
1189	else
1190	{
1191	truelen = png_ptr->channels;
1192	sample_depth = png_ptr->bit_depth;
1193	}
1194
1195	if (length != truelen \|\| length > `4`)
1196	{
1197	png_chunk_benign_error(png_ptr, "invalid");
1198	png_crc_finish(png_ptr, length);
1199	return;
1200	}
1201
1202	buf[`0`] = buf[`1`] = buf[`2`] = buf[`3`] = sample_depth;
1203	png_crc_read(png_ptr, buf, truelen);
1204
1205	if (png_crc_finish(png_ptr, `0`) != `0`)
1206	return;
1207
1208	for (i=`0`; i<truelen; ++i)
1209	{
1210	if (buf[i] == `0` \|\| buf[i] > sample_depth)
1211	{
1212	png_chunk_benign_error(png_ptr, "invalid");
1213	return;
1214	}
1215	}
1216
1217	if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != `0`)
1218	{
1219	png_ptr->sig_bit.red = buf[`0`];
1220	png_ptr->sig_bit.green = buf[`1`];
1221	png_ptr->sig_bit.blue = buf[`2`];
1222	png_ptr->sig_bit.alpha = buf[`3`];
1223	}
1224
1225	else
1226	{
1227	png_ptr->sig_bit.gray = buf[`0`];
1228	png_ptr->sig_bit.red = buf[`0`];
1229	png_ptr->sig_bit.green = buf[`0`];
1230	png_ptr->sig_bit.blue = buf[`0`];
1231	png_ptr->sig_bit.alpha = buf[`1`];
1232	}
1233
1234	png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));
1235	}
1236	#endif
1237
1238	#ifdef PNG_READ_cHRM_SUPPORTED
1239	void / PRIVATE /
1240	png_handle_cHRM(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1241	{
1242	png_byte buf[`32`];
1243	png_xy xy;
1244
1245	png_debug(`1`, "in png_handle_cHRM");
1246
1247	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1248	png_chunk_error(png_ptr, "missing IHDR");
1249
1250	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1251	{
1252	png_crc_finish(png_ptr, length);
1253	png_chunk_benign_error(png_ptr, "out of place");
1254	return;
1255	}
1256
1257	if (length != `32`)
1258	{
1259	png_crc_finish(png_ptr, length);
1260	png_chunk_benign_error(png_ptr, "invalid");
1261	return;
1262	}
1263
1264	png_crc_read(png_ptr, buf, `32`);
1265
1266	if (png_crc_finish(png_ptr, `0`) != `0`)
1267	return;
1268
1269	xy.whitex = png_get_fixed_point(NULL, buf);
1270	xy.whitey = png_get_fixed_point(NULL, buf + `4`);
1271	xy.redx = png_get_fixed_point(NULL, buf + `8`);
1272	xy.redy = png_get_fixed_point(NULL, buf + `12`);
1273	xy.greenx = png_get_fixed_point(NULL, buf + `16`);
1274	xy.greeny = png_get_fixed_point(NULL, buf + `20`);
1275	xy.bluex = png_get_fixed_point(NULL, buf + `24`);
1276	xy.bluey = png_get_fixed_point(NULL, buf + `28`);
1277
1278	if (xy.whitex == PNG_FIXED_ERROR \|\|
1279	xy.whitey == PNG_FIXED_ERROR \|\|
1280	xy.redx == PNG_FIXED_ERROR \|\|
1281	xy.redy == PNG_FIXED_ERROR \|\|
1282	xy.greenx == PNG_FIXED_ERROR \|\|
1283	xy.greeny == PNG_FIXED_ERROR \|\|
1284	xy.bluex == PNG_FIXED_ERROR \|\|
1285	xy.bluey == PNG_FIXED_ERROR)
1286	{
1287	png_chunk_benign_error(png_ptr, "invalid values");
1288	return;
1289	}
1290
1291	/ If a colorspace error has already been output skip this chunk /
1292	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != `0`)
1293	return;
1294
1295	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_FROM_cHRM) != `0`)
1296	{
1297	png_ptr->colorspace.flags \|= PNG_COLORSPACE_INVALID;
1298	png_colorspace_sync(png_ptr, info_ptr);
1299	png_chunk_benign_error(png_ptr, "duplicate");
1300	return;
1301	}
1302
1303	png_ptr->colorspace.flags \|= PNG_COLORSPACE_FROM_cHRM;
1304	(void)png_colorspace_set_chromaticities(png_ptr, &png_ptr->colorspace, &xy,
1305	`1`/prefer cHRM values/);
1306	png_colorspace_sync(png_ptr, info_ptr);
1307	}
1308	#endif
1309
1310	#ifdef PNG_READ_sRGB_SUPPORTED
1311	void / PRIVATE /
1312	png_handle_sRGB(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1313	{
1314	png_byte intent;
1315
1316	png_debug(`1`, "in png_handle_sRGB");
1317
1318	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1319	png_chunk_error(png_ptr, "missing IHDR");
1320
1321	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1322	{
1323	png_crc_finish(png_ptr, length);
1324	png_chunk_benign_error(png_ptr, "out of place");
1325	return;
1326	}
1327
1328	if (length != `1`)
1329	{
1330	png_crc_finish(png_ptr, length);
1331	png_chunk_benign_error(png_ptr, "invalid");
1332	return;
1333	}
1334
1335	png_crc_read(png_ptr, &intent, `1`);
1336
1337	if (png_crc_finish(png_ptr, `0`) != `0`)
1338	return;
1339
1340	/ If a colorspace error has already been output skip this chunk /
1341	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != `0`)
1342	return;
1343
1344	/ Only one sRGB or iCCP chunk is allowed, use the HAVE_INTENT flag to detect*
1345	* this.
1346	*/
1347	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) != `0`)
1348	{
1349	png_ptr->colorspace.flags \|= PNG_COLORSPACE_INVALID;
1350	png_colorspace_sync(png_ptr, info_ptr);
1351	png_chunk_benign_error(png_ptr, "too many profiles");
1352	return;
1353	}
1354
1355	(void)png_colorspace_set_sRGB(png_ptr, &png_ptr->colorspace, intent);
1356	png_colorspace_sync(png_ptr, info_ptr);
1357	}
1358	#endif /* READ_sRGB */
1359
1360	#ifdef PNG_READ_iCCP_SUPPORTED
1361	void / PRIVATE /
1362	png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1363	/ Note: this does not properly handle profiles that are > 64K under DOS /
1364	{
1365	png_const_charp errmsg = NULL; / error message output, or no error /
1366	int finished = `0`; / crc checked /
1367
1368	png_debug(`1`, "in png_handle_iCCP");
1369
1370	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1371	png_chunk_error(png_ptr, "missing IHDR");
1372
1373	else if ((png_ptr->mode & (PNG_HAVE_IDAT\|PNG_HAVE_PLTE)) != `0`)
1374	{
1375	png_crc_finish(png_ptr, length);
1376	png_chunk_benign_error(png_ptr, "out of place");
1377	return;
1378	}
1379
1380	/* Consistent with all the above colorspace handling an obviously invalid
1381	* chunk is just ignored, so does not invalidate the color space. An
1382	* alternative is to set the 'invalid' flags at the start of this routine
1383	* and only clear them in they were not set before and all the tests pass.
1384	*/
1385
1386	/ The keyword must be at least one character and there is a*
1387	* terminator (0) byte and the compression method byte, and the
1388	* 'zlib' datastream is at least 11 bytes.
1389	*/
1390	if (length < `14`)
1391	{
1392	png_crc_finish(png_ptr, length);
1393	png_chunk_benign_error(png_ptr, "too short");
1394	return;
1395	}
1396
1397	/ If a colorspace error has already been output skip this chunk /
1398	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_INVALID) != `0`)
1399	{
1400	png_crc_finish(png_ptr, length);
1401	return;
1402	}
1403
1404	/ Only one sRGB or iCCP chunk is allowed, use the HAVE_INTENT flag to detect*
1405	* this.
1406	*/
1407	if ((png_ptr->colorspace.flags & PNG_COLORSPACE_HAVE_INTENT) == `0`)
1408	{
1409	uInt read_length, keyword_length;
1410	char keyword[`81`];
1411
1412	/ Find the keyword; the keyword plus separator and compression method*
1413	* bytes can be at most 81 characters long.
1414	*/
1415	read_length = `81`; / maximum /
1416	if (read_length > length)
1417	read_length = (uInt)length;
1418
1419	png_crc_read(png_ptr, (png_bytep)keyword, read_length);
1420	length -= read_length;
1421
1422	/ The minimum 'zlib' stream is assumed to be just the 2 byte header,*
1423	* 5 bytes minimum 'deflate' stream, and the 4 byte checksum.
1424	*/
1425	if (length < `11`)
1426	{
1427	png_crc_finish(png_ptr, length);
1428	png_chunk_benign_error(png_ptr, "too short");
1429	return;
1430	}
1431
1432	keyword_length = `0`;
1433	while (keyword_length < `80` && keyword_length < read_length &&
1434	keyword[keyword_length] != `0`)
1435	++keyword_length;
1436
1437	/ TODO: make the keyword checking common /
1438	if (keyword_length >= `1` && keyword_length <= `79`)
1439	{
1440	/ We only understand '0' compression - deflate - so if we get a*
1441	* different value we can't safely decode the chunk.
1442	*/
1443	if (keyword_length+`1` < read_length &&
1444	keyword[keyword_length+`1`] == PNG_COMPRESSION_TYPE_BASE)
1445	{
1446	read_length -= keyword_length+`2`;
1447
1448	if (png_inflate_claim(png_ptr, png_iCCP) == Z_OK)
1449	{
1450	Byte profile_header[`132`]={`0`};
1451	Byte local_buffer[PNG_INFLATE_BUF_SIZE];
1452	png_alloc_size_t size = (sizeof profile_header);
1453
1454	png_ptr->zstream.next_in = (Bytef*)keyword + (keyword_length+`2`);
1455	png_ptr->zstream.avail_in = read_length;
1456	(void)png_inflate_read(png_ptr, local_buffer,
1457	(sizeof local_buffer), &length, profile_header, &size,
1458	`0`/finish: don't, because the output is too small/);
1459
1460	if (size == `0`)
1461	{
1462	/ We have the ICC profile header; do the basic header checks.*
1463	*/
1464	png_uint_32 profile_length = png_get_uint_32(profile_header);
1465
1466	if (png_icc_check_length(png_ptr, &png_ptr->colorspace,
1467	keyword, profile_length) != `0`)
1468	{
1469	/ The length is apparently ok, so we can check the 132*
1470	* byte header.
1471	*/
1472	if (png_icc_check_header(png_ptr, &png_ptr->colorspace,
1473	keyword, profile_length, profile_header,
1474	png_ptr->color_type) != `0`)
1475	{
1476	/ Now read the tag table; a variable size buffer is*
1477	* needed at this point, allocate one for the whole
1478	* profile. The header check has already validated
1479	* that none of this stuff will overflow.
1480	*/
1481	png_uint_32 tag_count =
1482	png_get_uint_32(profile_header + `128`);
1483	png_bytep profile = png_read_buffer(png_ptr,
1484	profile_length, `2`/silent/);
1485
1486	if (profile != NULL)
1487	{
1488	memcpy(profile, profile_header,
1489	(sizeof profile_header));
1490
1491	size = `12` * tag_count;
1492
1493	(void)png_inflate_read(png_ptr, local_buffer,
1494	(sizeof local_buffer), &length,
1495	profile + (sizeof profile_header), &size, `0`);
1496
1497	/ Still expect a buffer error because we expect*
1498	* there to be some tag data!
1499	*/
1500	if (size == `0`)
1501	{
1502	if (png_icc_check_tag_table(png_ptr,
1503	&png_ptr->colorspace, keyword, profile_length,
1504	profile) != `0`)
1505	{
1506	/ The profile has been validated for basic*
1507	* security issues, so read the whole thing in.
1508	*/
1509	size = profile_length - (sizeof profile_header)
1510	- `12` * tag_count;
1511
1512	(void)png_inflate_read(png_ptr, local_buffer,
1513	(sizeof local_buffer), &length,
1514	profile + (sizeof profile_header) +
1515	`12` * tag_count, &size, `1`/finish/);
1516
1517	if (length > `0` && !(png_ptr->flags &
1518	PNG_FLAG_BENIGN_ERRORS_WARN))
1519	errmsg = "extra compressed data";
1520
1521	/ But otherwise allow extra data: /
1522	else if (size == `0`)
1523	{
1524	if (length > `0`)
1525	{
1526	/ This can be handled completely, so*
1527	* keep going.
1528	*/
1529	png_chunk_warning(png_ptr,
1530	"extra compressed data");
1531	}
1532
1533	png_crc_finish(png_ptr, length);
1534	finished = `1`;
1535
1536	# if defined(PNG_sRGB_SUPPORTED) && PNG_sRGB_PROFILE_CHECKS >= 0
1537	/ Check for a match against sRGB /
1538	png_icc_set_sRGB(png_ptr,
1539	&png_ptr->colorspace, profile,
1540	png_ptr->zstream.adler);
1541	# endif
1542
1543	/ Steal the profile for info_ptr. /
1544	if (info_ptr != NULL)
1545	{
1546	png_free_data(png_ptr, info_ptr,
1547	PNG_FREE_ICCP, `0`);
1548
1549	info_ptr->iccp_name = png_voidcast(char*,
1550	png_malloc_base(png_ptr,
1551	keyword_length+`1`));
1552	if (info_ptr->iccp_name != NULL)
1553	{
1554	memcpy(info_ptr->iccp_name, keyword,
1555	keyword_length+`1`);
1556	info_ptr->iccp_proflen =
1557	profile_length;
1558	info_ptr->iccp_profile = profile;
1559	png_ptr->read_buffer = NULL; /steal/
1560	info_ptr->free_me \|= PNG_FREE_ICCP;
1561	info_ptr->valid \|= PNG_INFO_iCCP;
1562	}
1563
1564	else
1565	{
1566	png_ptr->colorspace.flags \|=
1567	PNG_COLORSPACE_INVALID;
1568	errmsg = "out of memory";
1569	}
1570	}
1571
1572	/ else the profile remains in the read*
1573	* buffer which gets reused for subsequent
1574	* chunks.
1575	*/
1576
1577	if (info_ptr != NULL)
1578	png_colorspace_sync(png_ptr, info_ptr);
1579
1580	if (errmsg == NULL)
1581	{
1582	png_ptr->zowner = `0`;
1583	return;
1584	}
1585	}
1586	if (errmsg == NULL)
1587	errmsg = png_ptr->zstream.msg;
1588	}
1589	/ else png_icc_check_tag_table output an error /
1590	}
1591	else / profile truncated /
1592	errmsg = png_ptr->zstream.msg;
1593	}
1594
1595	else
1596	errmsg = "out of memory";
1597	}
1598
1599	/ else png_icc_check_header output an error /
1600	}
1601
1602	/ else png_icc_check_length output an error /
1603	}
1604
1605	else / profile truncated /
1606	errmsg = png_ptr->zstream.msg;
1607
1608	/ Release the stream /
1609	png_ptr->zowner = `0`;
1610	}
1611
1612	else / png_inflate_claim failed /
1613	errmsg = png_ptr->zstream.msg;
1614	}
1615
1616	else
1617	errmsg = "bad compression method"; / or missing /
1618	}
1619
1620	else
1621	errmsg = "bad keyword";
1622	}
1623
1624	else
1625	errmsg = "too many profiles";
1626
1627	/ Failure: the reason is in 'errmsg' /
1628	if (finished == `0`)
1629	png_crc_finish(png_ptr, length);
1630
1631	png_ptr->colorspace.flags \|= PNG_COLORSPACE_INVALID;
1632	png_colorspace_sync(png_ptr, info_ptr);
1633	if (errmsg != NULL) / else already output /
1634	png_chunk_benign_error(png_ptr, errmsg);
1635	}
1636	#endif /* READ_iCCP */
1637
1638	#ifdef PNG_READ_sPLT_SUPPORTED
1639	void / PRIVATE /
1640	png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1641	/ Note: this does not properly handle chunks that are > 64K under DOS /
1642	{
1643	png_bytep entry_start, buffer;
1644	png_sPLT_t new_palette;
1645	png_sPLT_entryp pp;
1646	png_uint_32 data_length;
1647	int entry_size, i;
1648	png_uint_32 skip = `0`;
1649	png_uint_32 dl;
1650	size_t max_dl;
1651
1652	png_debug(`1`, "in png_handle_sPLT");
1653
1654	#ifdef PNG_USER_LIMITS_SUPPORTED
1655	if (png_ptr->user_chunk_cache_max != `0`)
1656	{
1657	if (png_ptr->user_chunk_cache_max == `1`)
1658	{
1659	png_crc_finish(png_ptr, length);
1660	return;
1661	}
1662
1663	if (--png_ptr->user_chunk_cache_max == `1`)
1664	{
1665	png_warning(png_ptr, "No space in chunk cache for sPLT");
1666	png_crc_finish(png_ptr, length);
1667	return;
1668	}
1669	}
1670	#endif
1671
1672	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1673	png_chunk_error(png_ptr, "missing IHDR");
1674
1675	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
1676	{
1677	png_crc_finish(png_ptr, length);
1678	png_chunk_benign_error(png_ptr, "out of place");
1679	return;
1680	}
1681
1682	#ifdef PNG_MAX_MALLOC_64K
1683	if (length > `65535U`)
1684	{
1685	png_crc_finish(png_ptr, length);
1686	png_chunk_benign_error(png_ptr, "too large to fit in memory");
1687	return;
1688	}
1689	#endif
1690
1691	buffer = png_read_buffer(png_ptr, length+`1`, `2`/silent/);
1692	if (buffer == NULL)
1693	{
1694	png_crc_finish(png_ptr, length);
1695	png_chunk_benign_error(png_ptr, "out of memory");
1696	return;
1697	}
1698
1699
1700	/ WARNING: this may break if size_t is less than 32 bits; it is assumed*
1701	* that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a
1702	* potential breakage point if the types in pngconf.h aren't exactly right.
1703	*/
1704	png_crc_read(png_ptr, buffer, length);
1705
1706	if (png_crc_finish(png_ptr, skip) != `0`)
1707	return;
1708
1709	buffer[length] = `0`;
1710
1711	for (entry_start = buffer; *entry_start; entry_start++)
1712	/ Empty loop to find end of name / ;
1713
1714	++entry_start;
1715
1716	/ A sample depth should follow the separator, and we should be on it /
1717	if (length < `2U` \|\| entry_start > buffer + (length - `2U`))
1718	{
1719	png_warning(png_ptr, "malformed sPLT chunk");
1720	return;
1721	}
1722
1723	new_palette.depth = *entry_start++;
1724	entry_size = (new_palette.depth == `8` ? `6` : `10`);
1725	/ This must fit in a png_uint_32 because it is derived from the original*
1726	* chunk data length.
1727	*/
1728	data_length = length - (png_uint_32)(entry_start - buffer);
1729
1730	/ Integrity-check the data length /
1731	if ((data_length % (unsigned int)entry_size) != `0`)
1732	{
1733	png_warning(png_ptr, "sPLT chunk has bad length");
1734	return;
1735	}
1736
1737	dl = (png_uint_32)(data_length / (unsigned int)entry_size);
1738	max_dl = PNG_SIZE_MAX / (sizeof (png_sPLT_entry));
1739
1740	if (dl > max_dl)
1741	{
1742	png_warning(png_ptr, "sPLT chunk too long");
1743	return;
1744	}
1745
1746	new_palette.nentries = (png_int_32)(data_length / (unsigned int)entry_size);
1747
1748	new_palette.entries = (png_sPLT_entryp)png_malloc_warn(png_ptr,
1749	(png_alloc_size_t) new_palette.nentries * (sizeof (png_sPLT_entry)));
1750
1751	if (new_palette.entries == NULL)
1752	{
1753	png_warning(png_ptr, "sPLT chunk requires too much memory");
1754	return;
1755	}
1756
1757	#ifdef PNG_POINTER_INDEXING_SUPPORTED
1758	for (i = `0`; i < new_palette.nentries; i++)
1759	{
1760	pp = new_palette.entries + i;
1761
1762	if (new_palette.depth == `8`)
1763	{
1764	pp->red = *entry_start++;
1765	pp->green = *entry_start++;
1766	pp->blue = *entry_start++;
1767	pp->alpha = *entry_start++;
1768	}
1769
1770	else
1771	{
1772	pp->red = png_get_uint_16(entry_start); entry_start += `2`;
1773	pp->green = png_get_uint_16(entry_start); entry_start += `2`;
1774	pp->blue = png_get_uint_16(entry_start); entry_start += `2`;
1775	pp->alpha = png_get_uint_16(entry_start); entry_start += `2`;
1776	}
1777
1778	pp->frequency = png_get_uint_16(entry_start); entry_start += `2`;
1779	}
1780	#else
1781	pp = new_palette.entries;
1782
1783	for (i = `0`; i < new_palette.nentries; i++)
1784	{
1785
1786	if (new_palette.depth == `8`)
1787	{
1788	pp[i].red = *entry_start++;
1789	pp[i].green = *entry_start++;
1790	pp[i].blue = *entry_start++;
1791	pp[i].alpha = *entry_start++;
1792	}
1793
1794	else
1795	{
1796	pp[i].red = png_get_uint_16(entry_start); entry_start += `2`;
1797	pp[i].green = png_get_uint_16(entry_start); entry_start += `2`;
1798	pp[i].blue = png_get_uint_16(entry_start); entry_start += `2`;
1799	pp[i].alpha = png_get_uint_16(entry_start); entry_start += `2`;
1800	}
1801
1802	pp[i].frequency = png_get_uint_16(entry_start); entry_start += `2`;
1803	}
1804	#endif
1805
1806	/ Discard all chunk data except the name and stash that /
1807	new_palette.name = (png_charp)buffer;
1808
1809	png_set_sPLT(png_ptr, info_ptr, &new_palette, `1`);
1810
1811	png_free(png_ptr, new_palette.entries);
1812	}
1813	#endif /* READ_sPLT */
1814
1815	#ifdef PNG_READ_tRNS_SUPPORTED
1816	void / PRIVATE /
1817	png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1818	{
1819	png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
1820
1821	png_debug(`1`, "in png_handle_tRNS");
1822
1823	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1824	png_chunk_error(png_ptr, "missing IHDR");
1825
1826	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
1827	{
1828	png_crc_finish(png_ptr, length);
1829	png_chunk_benign_error(png_ptr, "out of place");
1830	return;
1831	}
1832
1833	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS) != `0`)
1834	{
1835	png_crc_finish(png_ptr, length);
1836	png_chunk_benign_error(png_ptr, "duplicate");
1837	return;
1838	}
1839
1840	if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
1841	{
1842	png_byte buf[`2`];
1843
1844	if (length != `2`)
1845	{
1846	png_crc_finish(png_ptr, length);
1847	png_chunk_benign_error(png_ptr, "invalid");
1848	return;
1849	}
1850
1851	png_crc_read(png_ptr, buf, `2`);
1852	png_ptr->num_trans = `1`;
1853	png_ptr->trans_color.gray = png_get_uint_16(buf);
1854	}
1855
1856	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
1857	{
1858	png_byte buf[`6`];
1859
1860	if (length != `6`)
1861	{
1862	png_crc_finish(png_ptr, length);
1863	png_chunk_benign_error(png_ptr, "invalid");
1864	return;
1865	}
1866
1867	png_crc_read(png_ptr, buf, length);
1868	png_ptr->num_trans = `1`;
1869	png_ptr->trans_color.red = png_get_uint_16(buf);
1870	png_ptr->trans_color.green = png_get_uint_16(buf + `2`);
1871	png_ptr->trans_color.blue = png_get_uint_16(buf + `4`);
1872	}
1873
1874	else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1875	{
1876	if ((png_ptr->mode & PNG_HAVE_PLTE) == `0`)
1877	{
1878	/ TODO: is this actually an error in the ISO spec? /
1879	png_crc_finish(png_ptr, length);
1880	png_chunk_benign_error(png_ptr, "out of place");
1881	return;
1882	}
1883
1884	if (length > (unsigned int) png_ptr->num_palette \|\|
1885	length > (unsigned int) PNG_MAX_PALETTE_LENGTH \|\|
1886	length == `0`)
1887	{
1888	png_crc_finish(png_ptr, length);
1889	png_chunk_benign_error(png_ptr, "invalid");
1890	return;
1891	}
1892
1893	png_crc_read(png_ptr, readbuf, length);
1894	png_ptr->num_trans = (png_uint_16)length;
1895	}
1896
1897	else
1898	{
1899	png_crc_finish(png_ptr, length);
1900	png_chunk_benign_error(png_ptr, "invalid with alpha channel");
1901	return;
1902	}
1903
1904	if (png_crc_finish(png_ptr, `0`) != `0`)
1905	{
1906	png_ptr->num_trans = `0`;
1907	return;
1908	}
1909
1910	/ TODO: this is a horrible side effect in the palette case because the*
1911	* png_struct ends up with a pointer to the tRNS buffer owned by the
1912	* png_info. Fix this.
1913	*/
1914	png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
1915	&(png_ptr->trans_color));
1916	}
1917	#endif
1918
1919	#ifdef PNG_READ_bKGD_SUPPORTED
1920	void / PRIVATE /
1921	png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
1922	{
1923	unsigned int truelen;
1924	png_byte buf[`6`];
1925	png_color_16 background;
1926
1927	png_debug(`1`, "in png_handle_bKGD");
1928
1929	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
1930	png_chunk_error(png_ptr, "missing IHDR");
1931
1932	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0` \|\|
1933	(png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
1934	(png_ptr->mode & PNG_HAVE_PLTE) == `0`))
1935	{
1936	png_crc_finish(png_ptr, length);
1937	png_chunk_benign_error(png_ptr, "out of place");
1938	return;
1939	}
1940
1941	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD) != `0`)
1942	{
1943	png_crc_finish(png_ptr, length);
1944	png_chunk_benign_error(png_ptr, "duplicate");
1945	return;
1946	}
1947
1948	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1949	truelen = `1`;
1950
1951	else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != `0`)
1952	truelen = `6`;
1953
1954	else
1955	truelen = `2`;
1956
1957	if (length != truelen)
1958	{
1959	png_crc_finish(png_ptr, length);
1960	png_chunk_benign_error(png_ptr, "invalid");
1961	return;
1962	}
1963
1964	png_crc_read(png_ptr, buf, truelen);
1965
1966	if (png_crc_finish(png_ptr, `0`) != `0`)
1967	return;
1968
1969	/ We convert the index value into RGB components so that we can allow*
1970	* arbitrary RGB values for background when we have transparency, and
1971	* so it is easy to determine the RGB values of the background color
1972	* from the info_ptr struct.
1973	*/
1974	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
1975	{
1976	background.index = buf[`0`];
1977
1978	if (info_ptr != NULL && info_ptr->num_palette != `0`)
1979	{
1980	if (buf[`0`] >= info_ptr->num_palette)
1981	{
1982	png_chunk_benign_error(png_ptr, "invalid index");
1983	return;
1984	}
1985
1986	background.red = (png_uint_16)png_ptr->palette[buf[`0`]].red;
1987	background.green = (png_uint_16)png_ptr->palette[buf[`0`]].green;
1988	background.blue = (png_uint_16)png_ptr->palette[buf[`0`]].blue;
1989	}
1990
1991	else
1992	background.red = background.green = background.blue = `0`;
1993
1994	background.gray = `0`;
1995	}
1996
1997	else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == `0`) / GRAY /
1998	{
1999	if (png_ptr->bit_depth <= `8`)
2000	{
2001	if (buf[`0`] != `0` \|\| buf[`1`] >= (unsigned int)(`1` << png_ptr->bit_depth))
2002	{
2003	png_chunk_benign_error(png_ptr, "invalid gray level");
2004	return;
2005	}
2006	}
2007
2008	background.index = `0`;
2009	background.red =
2010	background.green =
2011	background.blue =
2012	background.gray = png_get_uint_16(buf);
2013	}
2014
2015	else
2016	{
2017	if (png_ptr->bit_depth <= `8`)
2018	{
2019	if (buf[`0`] != `0` \|\| buf[`2`] != `0` \|\| buf[`4`] != `0`)
2020	{
2021	png_chunk_benign_error(png_ptr, "invalid color");
2022	return;
2023	}
2024	}
2025
2026	background.index = `0`;
2027	background.red = png_get_uint_16(buf);
2028	background.green = png_get_uint_16(buf + `2`);
2029	background.blue = png_get_uint_16(buf + `4`);
2030	background.gray = `0`;
2031	}
2032
2033	png_set_bKGD(png_ptr, info_ptr, &background);
2034	}
2035	#endif
2036
2037	#ifdef PNG_READ_eXIf_SUPPORTED
2038	void / PRIVATE /
2039	png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2040	{
2041	unsigned int i;
2042
2043	png_debug(`1`, "in png_handle_eXIf");
2044
2045	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2046	png_chunk_error(png_ptr, "missing IHDR");
2047
2048	if (length < `2`)
2049	{
2050	png_crc_finish(png_ptr, length);
2051	png_chunk_benign_error(png_ptr, "too short");
2052	return;
2053	}
2054
2055	else if (info_ptr == NULL \|\| (info_ptr->valid & PNG_INFO_eXIf) != `0`)
2056	{
2057	png_crc_finish(png_ptr, length);
2058	png_chunk_benign_error(png_ptr, "duplicate");
2059	return;
2060	}
2061
2062	info_ptr->free_me \|= PNG_FREE_EXIF;
2063
2064	info_ptr->eXIf_buf = png_voidcast(png_bytep,
2065	png_malloc_warn(png_ptr, length));
2066
2067	if (info_ptr->eXIf_buf == NULL)
2068	{
2069	png_crc_finish(png_ptr, length);
2070	png_chunk_benign_error(png_ptr, "out of memory");
2071	return;
2072	}
2073
2074	for (i = `0`; i < length; i++)
2075	{
2076	png_byte buf[`1`];
2077	png_crc_read(png_ptr, buf, `1`);
2078	info_ptr->eXIf_buf[i] = buf[`0`];
2079	if (i == `1` && buf[`0`] != `'M'` && buf[`0`] != `'I'`
2080	&& info_ptr->eXIf_buf[`0`] != buf[`0`])
2081	{
2082	png_crc_finish(png_ptr, length);
2083	png_chunk_benign_error(png_ptr, "incorrect byte-order specifier");
2084	png_free(png_ptr, info_ptr->eXIf_buf);
2085	info_ptr->eXIf_buf = NULL;
2086	return;
2087	}
2088	}
2089
2090	if (png_crc_finish(png_ptr, `0`) == `0`)
2091	png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
2092
2093	png_free(png_ptr, info_ptr->eXIf_buf);
2094	info_ptr->eXIf_buf = NULL;
2095	}
2096	#endif
2097
2098	#ifdef PNG_READ_hIST_SUPPORTED
2099	void / PRIVATE /
2100	png_handle_hIST(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2101	{
2102	unsigned int num, i;
2103	png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
2104
2105	png_debug(`1`, "in png_handle_hIST");
2106
2107	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2108	png_chunk_error(png_ptr, "missing IHDR");
2109
2110	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0` \|\|
2111	(png_ptr->mode & PNG_HAVE_PLTE) == `0`)
2112	{
2113	png_crc_finish(png_ptr, length);
2114	png_chunk_benign_error(png_ptr, "out of place");
2115	return;
2116	}
2117
2118	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST) != `0`)
2119	{
2120	png_crc_finish(png_ptr, length);
2121	png_chunk_benign_error(png_ptr, "duplicate");
2122	return;
2123	}
2124
2125	num = length / `2` ;
2126
2127	if (num != (unsigned int) png_ptr->num_palette \|\|
2128	num > (unsigned int) PNG_MAX_PALETTE_LENGTH)
2129	{
2130	png_crc_finish(png_ptr, length);
2131	png_chunk_benign_error(png_ptr, "invalid");
2132	return;
2133	}
2134
2135	for (i = `0`; i < num; i++)
2136	{
2137	png_byte buf[`2`];
2138
2139	png_crc_read(png_ptr, buf, `2`);
2140	readbuf[i] = png_get_uint_16(buf);
2141	}
2142
2143	if (png_crc_finish(png_ptr, `0`) != `0`)
2144	return;
2145
2146	png_set_hIST(png_ptr, info_ptr, readbuf);
2147	}
2148	#endif
2149
2150	#ifdef PNG_READ_pHYs_SUPPORTED
2151	void / PRIVATE /
2152	png_handle_pHYs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2153	{
2154	png_byte buf[`9`];
2155	png_uint_32 res_x, res_y;
2156	int unit_type;
2157
2158	png_debug(`1`, "in png_handle_pHYs");
2159
2160	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2161	png_chunk_error(png_ptr, "missing IHDR");
2162
2163	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2164	{
2165	png_crc_finish(png_ptr, length);
2166	png_chunk_benign_error(png_ptr, "out of place");
2167	return;
2168	}
2169
2170	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs) != `0`)
2171	{
2172	png_crc_finish(png_ptr, length);
2173	png_chunk_benign_error(png_ptr, "duplicate");
2174	return;
2175	}
2176
2177	if (length != `9`)
2178	{
2179	png_crc_finish(png_ptr, length);
2180	png_chunk_benign_error(png_ptr, "invalid");
2181	return;
2182	}
2183
2184	png_crc_read(png_ptr, buf, `9`);
2185
2186	if (png_crc_finish(png_ptr, `0`) != `0`)
2187	return;
2188
2189	res_x = png_get_uint_32(buf);
2190	res_y = png_get_uint_32(buf + `4`);
2191	unit_type = buf[`8`];
2192	png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type);
2193	}
2194	#endif
2195
2196	#ifdef PNG_READ_oFFs_SUPPORTED
2197	void / PRIVATE /
2198	png_handle_oFFs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2199	{
2200	png_byte buf[`9`];
2201	png_int_32 offset_x, offset_y;
2202	int unit_type;
2203
2204	png_debug(`1`, "in png_handle_oFFs");
2205
2206	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2207	png_chunk_error(png_ptr, "missing IHDR");
2208
2209	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2210	{
2211	png_crc_finish(png_ptr, length);
2212	png_chunk_benign_error(png_ptr, "out of place");
2213	return;
2214	}
2215
2216	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs) != `0`)
2217	{
2218	png_crc_finish(png_ptr, length);
2219	png_chunk_benign_error(png_ptr, "duplicate");
2220	return;
2221	}
2222
2223	if (length != `9`)
2224	{
2225	png_crc_finish(png_ptr, length);
2226	png_chunk_benign_error(png_ptr, "invalid");
2227	return;
2228	}
2229
2230	png_crc_read(png_ptr, buf, `9`);
2231
2232	if (png_crc_finish(png_ptr, `0`) != `0`)
2233	return;
2234
2235	offset_x = png_get_int_32(buf);
2236	offset_y = png_get_int_32(buf + `4`);
2237	unit_type = buf[`8`];
2238	png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type);
2239	}
2240	#endif
2241
2242	#ifdef PNG_READ_pCAL_SUPPORTED
2243	/ Read the pCAL chunk (described in the PNG Extensions document) /
2244	void / PRIVATE /
2245	png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2246	{
2247	png_int_32 X0, X1;
2248	png_byte type, nparams;
2249	png_bytep buffer, buf, units, endptr;
2250	png_charpp params;
2251	int i;
2252
2253	png_debug(`1`, "in png_handle_pCAL");
2254
2255	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2256	png_chunk_error(png_ptr, "missing IHDR");
2257
2258	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2259	{
2260	png_crc_finish(png_ptr, length);
2261	png_chunk_benign_error(png_ptr, "out of place");
2262	return;
2263	}
2264
2265	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL) != `0`)
2266	{
2267	png_crc_finish(png_ptr, length);
2268	png_chunk_benign_error(png_ptr, "duplicate");
2269	return;
2270	}
2271
2272	png_debug1(`2`, "Allocating and reading pCAL chunk data (%u bytes)",
2273	length + `1`);
2274
2275	buffer = png_read_buffer(png_ptr, length+`1`, `2`/silent/);
2276
2277	if (buffer == NULL)
2278	{
2279	png_crc_finish(png_ptr, length);
2280	png_chunk_benign_error(png_ptr, "out of memory");
2281	return;
2282	}
2283
2284	png_crc_read(png_ptr, buffer, length);
2285
2286	if (png_crc_finish(png_ptr, `0`) != `0`)
2287	return;
2288
2289	buffer[length] = `0`; / Null terminate the last string /
2290
2291	png_debug(`3`, "Finding end of pCAL purpose string");
2292	for (buf = buffer; *buf; buf++)
2293	/ Empty loop / ;
2294
2295	endptr = buffer + length;
2296
2297	/ We need to have at least 12 bytes after the purpose string*
2298	* in order to get the parameter information.
2299	*/
2300	if (endptr - buf <= `12`)
2301	{
2302	png_chunk_benign_error(png_ptr, "invalid");
2303	return;
2304	}
2305
2306	png_debug(`3`, "Reading pCAL X0, X1, type, nparams, and units");
2307	X0 = png_get_int_32((png_bytep)buf+`1`);
2308	X1 = png_get_int_32((png_bytep)buf+`5`);
2309	type = buf[`9`];
2310	nparams = buf[`10`];
2311	units = buf + `11`;
2312
2313	png_debug(`3`, "Checking pCAL equation type and number of parameters");
2314	/ Check that we have the right number of parameters for known*
2315	* equation types.
2316	*/
2317	if ((type == PNG_EQUATION_LINEAR && nparams != `2`) \|\|
2318	(type == PNG_EQUATION_BASE_E && nparams != `3`) \|\|
2319	(type == PNG_EQUATION_ARBITRARY && nparams != `3`) \|\|
2320	(type == PNG_EQUATION_HYPERBOLIC && nparams != `4`))
2321	{
2322	png_chunk_benign_error(png_ptr, "invalid parameter count");
2323	return;
2324	}
2325
2326	else if (type >= PNG_EQUATION_LAST)
2327	{
2328	png_chunk_benign_error(png_ptr, "unrecognized equation type");
2329	}
2330
2331	for (buf = units; *buf; buf++)
2332	/ Empty loop to move past the units string. / ;
2333
2334	png_debug(`3`, "Allocating pCAL parameters array");
2335
2336	params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
2337	nparams * (sizeof (png_charp))));
2338
2339	if (params == NULL)
2340	{
2341	png_chunk_benign_error(png_ptr, "out of memory");
2342	return;
2343	}
2344
2345	/ Get pointers to the start of each parameter string. /
2346	for (i = `0`; i < nparams; i++)
2347	{
2348	buf++; / Skip the null string terminator from previous parameter. /
2349
2350	png_debug1(`3`, "Reading pCAL parameter %d", i);
2351
2352	for (params[i] = (png_charp)buf; buf <= endptr && *buf != `0`; buf++)
2353	/ Empty loop to move past each parameter string / ;
2354
2355	/ Make sure we haven't run out of data yet /
2356	if (buf > endptr)
2357	{
2358	png_free(png_ptr, params);
2359	png_chunk_benign_error(png_ptr, "invalid data");
2360	return;
2361	}
2362	}
2363
2364	png_set_pCAL(png_ptr, info_ptr, (png_charp)buffer, X0, X1, type, nparams,
2365	(png_charp)units, params);
2366
2367	png_free(png_ptr, params);
2368	}
2369	#endif
2370
2371	#ifdef PNG_READ_sCAL_SUPPORTED
2372	/ Read the sCAL chunk /
2373	void / PRIVATE /
2374	png_handle_sCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2375	{
2376	png_bytep buffer;
2377	size_t i;
2378	int state;
2379
2380	png_debug(`1`, "in png_handle_sCAL");
2381
2382	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2383	png_chunk_error(png_ptr, "missing IHDR");
2384
2385	else if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2386	{
2387	png_crc_finish(png_ptr, length);
2388	png_chunk_benign_error(png_ptr, "out of place");
2389	return;
2390	}
2391
2392	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL) != `0`)
2393	{
2394	png_crc_finish(png_ptr, length);
2395	png_chunk_benign_error(png_ptr, "duplicate");
2396	return;
2397	}
2398
2399	/ Need unit type, width, \0, height: minimum 4 bytes /
2400	else if (length < `4`)
2401	{
2402	png_crc_finish(png_ptr, length);
2403	png_chunk_benign_error(png_ptr, "invalid");
2404	return;
2405	}
2406
2407	png_debug1(`2`, "Allocating and reading sCAL chunk data (%u bytes)",
2408	length + `1`);
2409
2410	buffer = png_read_buffer(png_ptr, length+`1`, `2`/silent/);
2411
2412	if (buffer == NULL)
2413	{
2414	png_chunk_benign_error(png_ptr, "out of memory");
2415	png_crc_finish(png_ptr, length);
2416	return;
2417	}
2418
2419	png_crc_read(png_ptr, buffer, length);
2420	buffer[length] = `0`; / Null terminate the last string /
2421
2422	if (png_crc_finish(png_ptr, `0`) != `0`)
2423	return;
2424
2425	/ Validate the unit. /
2426	if (buffer[`0`] != `1` && buffer[`0`] != `2`)
2427	{
2428	png_chunk_benign_error(png_ptr, "invalid unit");
2429	return;
2430	}
2431
2432	/ Validate the ASCII numbers, need two ASCII numbers separated by*
2433	* a '\0' and they need to fit exactly in the chunk data.
2434	*/
2435	i = `1`;
2436	state = `0`;
2437
2438	if (png_check_fp_number((png_const_charp)buffer, length, &state, &i) == `0` \|\|
2439	i >= length \|\| buffer[i++] != `0`)
2440	png_chunk_benign_error(png_ptr, "bad width format");
2441
2442	else if (PNG_FP_IS_POSITIVE(state) == `0`)
2443	png_chunk_benign_error(png_ptr, "non-positive width");
2444
2445	else
2446	{
2447	size_t heighti = i;
2448
2449	state = `0`;
2450	if (png_check_fp_number((png_const_charp)buffer, length,
2451	&state, &i) == `0` \|\| i != length)
2452	png_chunk_benign_error(png_ptr, "bad height format");
2453
2454	else if (PNG_FP_IS_POSITIVE(state) == `0`)
2455	png_chunk_benign_error(png_ptr, "non-positive height");
2456
2457	else
2458	/ This is the (only) success case. /
2459	png_set_sCAL_s(png_ptr, info_ptr, buffer[`0`],
2460	(png_charp)buffer+`1`, (png_charp)buffer+heighti);
2461	}
2462	}
2463	#endif
2464
2465	#ifdef PNG_READ_tIME_SUPPORTED
2466	void / PRIVATE /
2467	png_handle_tIME(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2468	{
2469	png_byte buf[`7`];
2470	png_time mod_time;
2471
2472	png_debug(`1`, "in png_handle_tIME");
2473
2474	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2475	png_chunk_error(png_ptr, "missing IHDR");
2476
2477	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME) != `0`)
2478	{
2479	png_crc_finish(png_ptr, length);
2480	png_chunk_benign_error(png_ptr, "duplicate");
2481	return;
2482	}
2483
2484	if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2485	png_ptr->mode \|= PNG_AFTER_IDAT;
2486
2487	if (length != `7`)
2488	{
2489	png_crc_finish(png_ptr, length);
2490	png_chunk_benign_error(png_ptr, "invalid");
2491	return;
2492	}
2493
2494	png_crc_read(png_ptr, buf, `7`);
2495
2496	if (png_crc_finish(png_ptr, `0`) != `0`)
2497	return;
2498
2499	mod_time.second = buf[`6`];
2500	mod_time.minute = buf[`5`];
2501	mod_time.hour = buf[`4`];
2502	mod_time.day = buf[`3`];
2503	mod_time.month = buf[`2`];
2504	mod_time.year = png_get_uint_16(buf);
2505
2506	png_set_tIME(png_ptr, info_ptr, &mod_time);
2507	}
2508	#endif
2509
2510	#ifdef PNG_READ_tEXt_SUPPORTED
2511	/ Note: this does not properly handle chunks that are > 64K under DOS /
2512	void / PRIVATE /
2513	png_handle_tEXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2514	{
2515	png_text text_info;
2516	png_bytep buffer;
2517	png_charp key;
2518	png_charp text;
2519	png_uint_32 skip = `0`;
2520
2521	png_debug(`1`, "in png_handle_tEXt");
2522
2523	#ifdef PNG_USER_LIMITS_SUPPORTED
2524	if (png_ptr->user_chunk_cache_max != `0`)
2525	{
2526	if (png_ptr->user_chunk_cache_max == `1`)
2527	{
2528	png_crc_finish(png_ptr, length);
2529	return;
2530	}
2531
2532	if (--png_ptr->user_chunk_cache_max == `1`)
2533	{
2534	png_crc_finish(png_ptr, length);
2535	png_chunk_benign_error(png_ptr, "no space in chunk cache");
2536	return;
2537	}
2538	}
2539	#endif
2540
2541	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2542	png_chunk_error(png_ptr, "missing IHDR");
2543
2544	if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2545	png_ptr->mode \|= PNG_AFTER_IDAT;
2546
2547	#ifdef PNG_MAX_MALLOC_64K
2548	if (length > `65535U`)
2549	{
2550	png_crc_finish(png_ptr, length);
2551	png_chunk_benign_error(png_ptr, "too large to fit in memory");
2552	return;
2553	}
2554	#endif
2555
2556	buffer = png_read_buffer(png_ptr, length+`1`, `1`/warn/);
2557
2558	if (buffer == NULL)
2559	{
2560	png_chunk_benign_error(png_ptr, "out of memory");
2561	return;
2562	}
2563
2564	png_crc_read(png_ptr, buffer, length);
2565
2566	if (png_crc_finish(png_ptr, skip) != `0`)
2567	return;
2568
2569	key = (png_charp)buffer;
2570	key[length] = `0`;
2571
2572	for (text = key; *text; text++)
2573	/ Empty loop to find end of key / ;
2574
2575	if (text != key + length)
2576	text++;
2577
2578	text_info.compression = PNG_TEXT_COMPRESSION_NONE;
2579	text_info.key = key;
2580	text_info.lang = NULL;
2581	text_info.lang_key = NULL;
2582	text_info.itxt_length = `0`;
2583	text_info.text = text;
2584	text_info.text_length = strlen(text);
2585
2586	if (png_set_text_2(png_ptr, info_ptr, &text_info, `1`) != `0`)
2587	png_warning(png_ptr, "Insufficient memory to process text chunk");
2588	}
2589	#endif
2590
2591	#ifdef PNG_READ_zTXt_SUPPORTED
2592	/ Note: this does not correctly handle chunks that are > 64K under DOS /
2593	void / PRIVATE /
2594	png_handle_zTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2595	{
2596	png_const_charp errmsg = NULL;
2597	png_bytep buffer;
2598	png_uint_32 keyword_length;
2599
2600	png_debug(`1`, "in png_handle_zTXt");
2601
2602	#ifdef PNG_USER_LIMITS_SUPPORTED
2603	if (png_ptr->user_chunk_cache_max != `0`)
2604	{
2605	if (png_ptr->user_chunk_cache_max == `1`)
2606	{
2607	png_crc_finish(png_ptr, length);
2608	return;
2609	}
2610
2611	if (--png_ptr->user_chunk_cache_max == `1`)
2612	{
2613	png_crc_finish(png_ptr, length);
2614	png_chunk_benign_error(png_ptr, "no space in chunk cache");
2615	return;
2616	}
2617	}
2618	#endif
2619
2620	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2621	png_chunk_error(png_ptr, "missing IHDR");
2622
2623	if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2624	png_ptr->mode \|= PNG_AFTER_IDAT;
2625
2626	/ Note, "length" is sufficient here; we won't be adding*
2627	* a null terminator later.
2628	*/
2629	buffer = png_read_buffer(png_ptr, length, `2`/silent/);
2630
2631	if (buffer == NULL)
2632	{
2633	png_crc_finish(png_ptr, length);
2634	png_chunk_benign_error(png_ptr, "out of memory");
2635	return;
2636	}
2637
2638	png_crc_read(png_ptr, buffer, length);
2639
2640	if (png_crc_finish(png_ptr, `0`) != `0`)
2641	return;
2642
2643	/ TODO: also check that the keyword contents match the spec! /
2644	for (keyword_length = `0`;
2645	keyword_length < length && buffer[keyword_length] != `0`;
2646	++keyword_length)
2647	/ Empty loop to find end of name / ;
2648
2649	if (keyword_length > `79` \|\| keyword_length < `1`)
2650	errmsg = "bad keyword";
2651
2652	/ zTXt must have some LZ data after the keyword, although it may expand to*
2653	* zero bytes; we need a '\0' at the end of the keyword, the compression type
2654	* then the LZ data:
2655	*/
2656	else if (keyword_length + `3` > length)
2657	errmsg = "truncated";
2658
2659	else if (buffer[keyword_length+`1`] != PNG_COMPRESSION_TYPE_BASE)
2660	errmsg = "unknown compression type";
2661
2662	else
2663	{
2664	png_alloc_size_t uncompressed_length = PNG_SIZE_MAX;
2665
2666	/ TODO: at present png_decompress_chunk imposes a single application*
2667	* level memory limit, this should be split to different values for iCCP
2668	* and text chunks.
2669	*/
2670	if (png_decompress_chunk(png_ptr, length, keyword_length+`2`,
2671	&uncompressed_length, `1`/terminate/) == Z_STREAM_END)
2672	{
2673	png_text text;
2674
2675	if (png_ptr->read_buffer == NULL)
2676	errmsg="Read failure in png_handle_zTXt";
2677	else
2678	{
2679	/ It worked; png_ptr->read_buffer now looks like a tEXt chunk*
2680	* except for the extra compression type byte and the fact that
2681	* it isn't necessarily '\0' terminated.
2682	*/
2683	buffer = png_ptr->read_buffer;
2684	buffer[uncompressed_length+(keyword_length+`2`)] = `0`;
2685
2686	text.compression = PNG_TEXT_COMPRESSION_zTXt;
2687	text.key = (png_charp)buffer;
2688	text.text = (png_charp)(buffer + keyword_length+`2`);
2689	text.text_length = uncompressed_length;
2690	text.itxt_length = `0`;
2691	text.lang = NULL;
2692	text.lang_key = NULL;
2693
2694	if (png_set_text_2(png_ptr, info_ptr, &text, `1`) != `0`)
2695	errmsg = "insufficient memory";
2696	}
2697	}
2698
2699	else
2700	errmsg = png_ptr->zstream.msg;
2701	}
2702
2703	if (errmsg != NULL)
2704	png_chunk_benign_error(png_ptr, errmsg);
2705	}
2706	#endif
2707
2708	#ifdef PNG_READ_iTXt_SUPPORTED
2709	/ Note: this does not correctly handle chunks that are > 64K under DOS /
2710	void / PRIVATE /
2711	png_handle_iTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
2712	{
2713	png_const_charp errmsg = NULL;
2714	png_bytep buffer;
2715	png_uint_32 prefix_length;
2716
2717	png_debug(`1`, "in png_handle_iTXt");
2718
2719	#ifdef PNG_USER_LIMITS_SUPPORTED
2720	if (png_ptr->user_chunk_cache_max != `0`)
2721	{
2722	if (png_ptr->user_chunk_cache_max == `1`)
2723	{
2724	png_crc_finish(png_ptr, length);
2725	return;
2726	}
2727
2728	if (--png_ptr->user_chunk_cache_max == `1`)
2729	{
2730	png_crc_finish(png_ptr, length);
2731	png_chunk_benign_error(png_ptr, "no space in chunk cache");
2732	return;
2733	}
2734	}
2735	#endif
2736
2737	if ((png_ptr->mode & PNG_HAVE_IHDR) == `0`)
2738	png_chunk_error(png_ptr, "missing IHDR");
2739
2740	if ((png_ptr->mode & PNG_HAVE_IDAT) != `0`)
2741	png_ptr->mode \|= PNG_AFTER_IDAT;
2742
2743	buffer = png_read_buffer(png_ptr, length+`1`, `1`/warn/);
2744
2745	if (buffer == NULL)
2746	{
2747	png_crc_finish(png_ptr, length);
2748	png_chunk_benign_error(png_ptr, "out of memory");
2749	return;
2750	}
2751
2752	png_crc_read(png_ptr, buffer, length);
2753
2754	if (png_crc_finish(png_ptr, `0`) != `0`)
2755	return;
2756
2757	/ First the keyword. /
2758	for (prefix_length=`0`;
2759	prefix_length < length && buffer[prefix_length] != `0`;
2760	++prefix_length)
2761	/ Empty loop / ;
2762
2763	/ Perform a basic check on the keyword length here. /
2764	if (prefix_length > `79` \|\| prefix_length < `1`)
2765	errmsg = "bad keyword";
2766
2767	/ Expect keyword, compression flag, compression type, language, translated*
2768	* keyword (both may be empty but are 0 terminated) then the text, which may
2769	* be empty.
2770	*/
2771	else if (prefix_length + `5` > length)
2772	errmsg = "truncated";
2773
2774	else if (buffer[prefix_length+`1`] == `0` \|\|
2775	(buffer[prefix_length+`1`] == `1` &&
2776	buffer[prefix_length+`2`] == PNG_COMPRESSION_TYPE_BASE))
2777	{
2778	int compressed = buffer[prefix_length+`1`] != `0`;
2779	png_uint_32 language_offset, translated_keyword_offset;
2780	png_alloc_size_t uncompressed_length = `0`;
2781
2782	/ Now the language tag /
2783	prefix_length += `3`;
2784	language_offset = prefix_length;
2785
2786	for (; prefix_length < length && buffer[prefix_length] != `0`;
2787	++prefix_length)
2788	/ Empty loop / ;
2789
2790	/ WARNING: the length may be invalid here, this is checked below. /
2791	translated_keyword_offset = ++prefix_length;
2792
2793	for (; prefix_length < length && buffer[prefix_length] != `0`;
2794	++prefix_length)
2795	/ Empty loop / ;
2796
2797	/ prefix_length should now be at the trailing '\0' of the translated*
2798	* keyword, but it may already be over the end. None of this arithmetic
2799	* can overflow because chunks are at most 2^31 bytes long, but on 16-bit
2800	* systems the available allocation may overflow.
2801	*/
2802	++prefix_length;
2803
2804	if (compressed == `0` && prefix_length <= length)
2805	uncompressed_length = length - prefix_length;
2806
2807	else if (compressed != `0` && prefix_length < length)
2808	{
2809	uncompressed_length = PNG_SIZE_MAX;
2810
2811	/ TODO: at present png_decompress_chunk imposes a single application*
2812	* level memory limit, this should be split to different values for
2813	* iCCP and text chunks.
2814	*/
2815	if (png_decompress_chunk(png_ptr, length, prefix_length,
2816	&uncompressed_length, `1`/terminate/) == Z_STREAM_END)
2817	buffer = png_ptr->read_buffer;
2818
2819	else
2820	errmsg = png_ptr->zstream.msg;
2821	}
2822
2823	else
2824	errmsg = "truncated";
2825
2826	if (errmsg == NULL)
2827	{
2828	png_text text;
2829
2830	buffer[uncompressed_length+prefix_length] = `0`;
2831
2832	if (compressed == `0`)
2833	text.compression = PNG_ITXT_COMPRESSION_NONE;
2834
2835	else
2836	text.compression = PNG_ITXT_COMPRESSION_zTXt;
2837
2838	text.key = (png_charp)buffer;
2839	text.lang = (png_charp)buffer + language_offset;
2840	text.lang_key = (png_charp)buffer + translated_keyword_offset;
2841	text.text = (png_charp)buffer + prefix_length;
2842	text.text_length = `0`;
2843	text.itxt_length = uncompressed_length;
2844
2845	if (png_set_text_2(png_ptr, info_ptr, &text, `1`) != `0`)
2846	errmsg = "insufficient memory";
2847	}
2848	}
2849
2850	else
2851	errmsg = "bad compression info";
2852
2853	if (errmsg != NULL)
2854	png_chunk_benign_error(png_ptr, errmsg);
2855	}
2856	#endif
2857
2858	#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
2859	/ Utility function for png_handle_unknown; set up png_ptr::unknown_chunk /
2860	static int
2861	png_cache_unknown_chunk(png_structrp png_ptr, png_uint_32 length)
2862	{
2863	png_alloc_size_t limit = PNG_SIZE_MAX;
2864
2865	if (png_ptr->unknown_chunk.data != NULL)
2866	{
2867	png_free(png_ptr, png_ptr->unknown_chunk.data);
2868	png_ptr->unknown_chunk.data = NULL;
2869	}
2870
2871	# ifdef PNG_SET_USER_LIMITS_SUPPORTED
2872	if (png_ptr->user_chunk_malloc_max > `0` &&
2873	png_ptr->user_chunk_malloc_max < limit)
2874	limit = png_ptr->user_chunk_malloc_max;
2875
2876	# elif PNG_USER_CHUNK_MALLOC_MAX > 0
2877	if (PNG_USER_CHUNK_MALLOC_MAX < limit)
2878	limit = PNG_USER_CHUNK_MALLOC_MAX;
2879	# endif
2880
2881	if (length <= limit)
2882	{
2883	PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
2884	/ The following is safe because of the PNG_SIZE_MAX init above /
2885	png_ptr->unknown_chunk.size = (size_t)length/SAFE/;
2886	/ 'mode' is a flag array, only the bottom four bits matter here /
2887	png_ptr->unknown_chunk.location = (png_byte)png_ptr->mode/SAFE/;
2888
2889	if (length == `0`)
2890	png_ptr->unknown_chunk.data = NULL;
2891
2892	else
2893	{
2894	/ Do a 'warn' here - it is handled below. /
2895	png_ptr->unknown_chunk.data = png_voidcast(png_bytep,
2896	png_malloc_warn(png_ptr, length));
2897	}
2898	}
2899
2900	if (png_ptr->unknown_chunk.data == NULL && length > `0`)
2901	{
2902	/ This is benign because we clean up correctly /
2903	png_crc_finish(png_ptr, length);
2904	png_chunk_benign_error(png_ptr, "unknown chunk exceeds memory limits");
2905	return `0`;
2906	}
2907
2908	else
2909	{
2910	if (length > `0`)
2911	png_crc_read(png_ptr, png_ptr->unknown_chunk.data, length);
2912	png_crc_finish(png_ptr, `0`);
2913	return `1`;
2914	}
2915	}
2916	#endif /* READ_UNKNOWN_CHUNKS */
2917
2918	/ Handle an unknown, or known but disabled, chunk /
2919	void / PRIVATE /
2920	png_handle_unknown(png_structrp png_ptr, png_inforp info_ptr,
2921	png_uint_32 length, int keep)
2922	{
2923	int handled = `0`; / the chunk was handled /
2924
2925	png_debug(`1`, "in png_handle_unknown");
2926
2927	#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
2928	/ NOTE: this code is based on the code in libpng-1.4.12 except for fixing*
2929	* the bug which meant that setting a non-default behavior for a specific
2930	* chunk would be ignored (the default was always used unless a user
2931	* callback was installed).
2932	*
2933	* 'keep' is the value from the png_chunk_unknown_handling, the setting for
2934	* this specific chunk_name, if PNG_HANDLE_AS_UNKNOWN_SUPPORTED, if not it
2935	* will always be PNG_HANDLE_CHUNK_AS_DEFAULT and it needs to be set here.
2936	* This is just an optimization to avoid multiple calls to the lookup
2937	* function.
2938	*/
2939	# ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
2940	# ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
2941	keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name);
2942	# endif
2943	# endif
2944
2945	/ One of the following methods will read the chunk or skip it (at least one*
2946	* of these is always defined because this is the only way to switch on
2947	* PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
2948	*/
2949	# ifdef PNG_READ_USER_CHUNKS_SUPPORTED
2950	/ The user callback takes precedence over the chunk keep value, but the*
2951	* keep value is still required to validate a save of a critical chunk.
2952	*/
2953	if (png_ptr->read_user_chunk_fn != NULL)
2954	{
2955	if (png_cache_unknown_chunk(png_ptr, length) != `0`)
2956	{
2957	/ Callback to user unknown chunk handler /
2958	int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr,
2959	&png_ptr->unknown_chunk);
2960
2961	/ ret is:*
2962	* negative: An error occurred; png_chunk_error will be called.
2963	* zero: The chunk was not handled, the chunk will be discarded
2964	* unless png_set_keep_unknown_chunks has been used to set
2965	* a 'keep' behavior for this particular chunk, in which
2966	* case that will be used. A critical chunk will cause an
2967	* error at this point unless it is to be saved.
2968	* positive: The chunk was handled, libpng will ignore/discard it.
2969	*/
2970	if (ret < `0`)
2971	png_chunk_error(png_ptr, "error in user chunk");
2972
2973	else if (ret == `0`)
2974	{
2975	/ If the keep value is 'default' or 'never' override it, but*
2976	* still error out on critical chunks unless the keep value is
2977	* 'always' While this is weird it is the behavior in 1.4.12.
2978	* A possible improvement would be to obey the value set for the
2979	* chunk, but this would be an API change that would probably
2980	* damage some applications.
2981	*
2982	* The png_app_warning below catches the case that matters, where
2983	* the application has not set specific save or ignore for this
2984	* chunk or global save or ignore.
2985	*/
2986	if (keep < PNG_HANDLE_CHUNK_IF_SAFE)
2987	{
2988	# ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED
2989	if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE)
2990	{
2991	png_chunk_warning(png_ptr, "Saving unknown chunk:");
2992	png_app_warning(png_ptr,
2993	"forcing save of an unhandled chunk;"
2994	" please call png_set_keep_unknown_chunks");
2995	/ with keep = PNG_HANDLE_CHUNK_IF_SAFE /
2996	}
2997	# endif
2998	keep = PNG_HANDLE_CHUNK_IF_SAFE;
2999	}
3000	}
3001
3002	else / chunk was handled /
3003	{
3004	handled = `1`;
3005	/ Critical chunks can be safely discarded at this point. /
3006	keep = PNG_HANDLE_CHUNK_NEVER;
3007	}
3008	}
3009
3010	else
3011	keep = PNG_HANDLE_CHUNK_NEVER; / insufficient memory /
3012	}
3013
3014	else
3015	/ Use the SAVE_UNKNOWN_CHUNKS code or skip the chunk /
3016	# endif /* READ_USER_CHUNKS */
3017
3018	# ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED
3019	{
3020	/ keep is currently just the per-chunk setting, if there was no*
3021	* setting change it to the global default now (not that this may
3022	* still be AS_DEFAULT) then obtain the cache of the chunk if required,
3023	* if not simply skip the chunk.
3024	*/
3025	if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT)
3026	keep = png_ptr->unknown_default;
3027
3028	if (keep == PNG_HANDLE_CHUNK_ALWAYS \|\|
3029	(keep == PNG_HANDLE_CHUNK_IF_SAFE &&
3030	PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
3031	{
3032	if (png_cache_unknown_chunk(png_ptr, length) == `0`)
3033	keep = PNG_HANDLE_CHUNK_NEVER;
3034	}
3035
3036	else
3037	png_crc_finish(png_ptr, length);
3038	}
3039	# else
3040	# ifndef PNG_READ_USER_CHUNKS_SUPPORTED
3041	# error no method to support READ_UNKNOWN_CHUNKS
3042	# endif
3043
3044	{
3045	/ If here there is no read callback pointer set and no support is*
3046	* compiled in to just save the unknown chunks, so simply skip this
3047	* chunk. If 'keep' is something other than AS_DEFAULT or NEVER then
3048	* the app has erroneously asked for unknown chunk saving when there
3049	* is no support.
3050	*/
3051	if (keep > PNG_HANDLE_CHUNK_NEVER)
3052	png_app_error(png_ptr, "no unknown chunk support available");
3053
3054	png_crc_finish(png_ptr, length);
3055	}
3056	# endif
3057
3058	# ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
3059	/ Now store the chunk in the chunk list if appropriate, and if the limits*
3060	* permit it.
3061	*/
3062	if (keep == PNG_HANDLE_CHUNK_ALWAYS \|\|
3063	(keep == PNG_HANDLE_CHUNK_IF_SAFE &&
3064	PNG_CHUNK_ANCILLARY(png_ptr->chunk_name)))
3065	{
3066	# ifdef PNG_USER_LIMITS_SUPPORTED
3067	switch (png_ptr->user_chunk_cache_max)
3068	{
3069	case `2`:
3070	png_ptr->user_chunk_cache_max = `1`;
3071	png_chunk_benign_error(png_ptr, "no space in chunk cache");
3072	/ FALLTHROUGH /
3073	case `1`:
3074	/ NOTE: prior to 1.6.0 this case resulted in an unknown critical*
3075	* chunk being skipped, now there will be a hard error below.
3076	*/
3077	break;
3078
3079	default: / not at limit /
3080	--(png_ptr->user_chunk_cache_max);
3081	/ FALLTHROUGH /
3082	case `0`: / no limit /
3083	# endif /* USER_LIMITS */
3084	/ Here when the limit isn't reached or when limits are compiled*
3085	* out; store the chunk.
3086	*/
3087	png_set_unknown_chunks(png_ptr, info_ptr,
3088	&png_ptr->unknown_chunk, `1`);
3089	handled = `1`;
3090	# ifdef PNG_USER_LIMITS_SUPPORTED
3091	break;
3092	}
3093	# endif
3094	}
3095	# else /* no store support: the chunk must be handled by the user callback */
3096	PNG_UNUSED(info_ptr)
3097	# endif
3098
3099	/ Regardless of the error handling below the cached data (if any) can be*
3100	* freed now. Notice that the data is not freed if there is a png_error, but
3101	* it will be freed by destroy_read_struct.
3102	*/
3103	if (png_ptr->unknown_chunk.data != NULL)
3104	png_free(png_ptr, png_ptr->unknown_chunk.data);
3105	png_ptr->unknown_chunk.data = NULL;
3106
3107	#else /* !PNG_READ_UNKNOWN_CHUNKS_SUPPORTED */
3108	/ There is no support to read an unknown chunk, so just skip it. /
3109	png_crc_finish(png_ptr, length);
3110	PNG_UNUSED(info_ptr)
3111	PNG_UNUSED(keep)
3112	#endif /* !READ_UNKNOWN_CHUNKS */
3113
3114	/ Check for unhandled critical chunks /
3115	if (handled == `0` && PNG_CHUNK_CRITICAL(png_ptr->chunk_name))
3116	png_chunk_error(png_ptr, "unhandled critical chunk");
3117	}
3118
3119	/ This function is called to verify that a chunk name is valid.*
3120	* This function can't have the "critical chunk check" incorporated
3121	* into it, since in the future we will need to be able to call user
3122	* functions to handle unknown critical chunks after we check that
3123	* the chunk name itself is valid.
3124	*/
3125
3126	/ Bit hacking: the test for an invalid byte in the 4 byte chunk name is:*
3127	*
3128	* ((c) < 65 \|\| (c) > 122 \|\| ((c) > 90 && (c) < 97))
3129	*/
3130
3131	void / PRIVATE /
3132	png_check_chunk_name(png_const_structrp png_ptr, png_uint_32 chunk_name)
3133	{
3134	int i;
3135	png_uint_32 cn=chunk_name;
3136
3137	png_debug(`1`, "in png_check_chunk_name");
3138
3139	for (i=`1`; i<=`4`; ++i)
3140	{
3141	int c = cn & `0xff`;
3142
3143	if (c < `65` \|\| c > `122` \|\| (c > `90` && c < `97`))
3144	png_chunk_error(png_ptr, "invalid chunk type");
3145
3146	cn >>= `8`;
3147	}
3148	}
3149
3150	void / PRIVATE /
3151	png_check_chunk_length(png_const_structrp png_ptr, png_uint_32 length)
3152	{
3153	png_alloc_size_t limit = PNG_UINT_31_MAX;
3154
3155	# ifdef PNG_SET_USER_LIMITS_SUPPORTED
3156	if (png_ptr->user_chunk_malloc_max > `0` &&
3157	png_ptr->user_chunk_malloc_max < limit)
3158	limit = png_ptr->user_chunk_malloc_max;
3159	# elif PNG_USER_CHUNK_MALLOC_MAX > 0
3160	if (PNG_USER_CHUNK_MALLOC_MAX < limit)
3161	limit = PNG_USER_CHUNK_MALLOC_MAX;
3162	# endif
3163	if (png_ptr->chunk_name == png_IDAT)
3164	{
3165	png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
3166	size_t row_factor =
3167	(size_t)png_ptr->width
3168	* (size_t)png_ptr->channels
3169	* (png_ptr->bit_depth > `8`? `2`: `1`)
3170	+ `1`
3171	+ (png_ptr->interlaced? `6`: `0`);
3172	if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
3173	idat_limit = PNG_UINT_31_MAX;
3174	else
3175	idat_limit = png_ptr->height * row_factor;
3176	row_factor = row_factor > `32566`? `32566` : row_factor;
3177	idat_limit += `6` + `5`(idat_limit/row_factor+`1`); /* zlib+deflate overhead /
3178	idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX;
3179	limit = limit < idat_limit? idat_limit : limit;
3180	}
3181
3182	if (length > limit)
3183	{
3184	png_debug2(`0`," length = %lu, limit = %lu",
3185	(unsigned long)length,(unsigned long)limit);
3186	png_chunk_error(png_ptr, "chunk data is too large");
3187	}
3188	}
3189
3190	/ Combines the row recently read in with the existing pixels in the row. This*
3191	* routine takes care of alpha and transparency if requested. This routine also
3192	* handles the two methods of progressive display of interlaced images,
3193	* depending on the 'display' value; if 'display' is true then the whole row
3194	* (dp) is filled from the start by replicating the available pixels. If
3195	* 'display' is false only those pixels present in the pass are filled in.
3196	*/
3197	void / PRIVATE /
3198	png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
3199	{
3200	unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
3201	png_const_bytep sp = png_ptr->row_buf + `1`;
3202	png_alloc_size_t row_width = png_ptr->width;
3203	unsigned int pass = png_ptr->pass;
3204	png_bytep end_ptr = `0`;
3205	png_byte end_byte = `0`;
3206	unsigned int end_mask;
3207
3208	png_debug(`1`, "in png_combine_row");
3209
3210	/ Added in 1.5.6: it should not be possible to enter this routine until at*
3211	* least one row has been read from the PNG data and transformed.
3212	*/
3213	if (pixel_depth == `0`)
3214	png_error(png_ptr, "internal row logic error");
3215
3216	/ Added in 1.5.4: the pixel depth should match the information returned by*
3217	* any call to png_read_update_info at this point. Do not continue if we got
3218	* this wrong.
3219	*/
3220	if (png_ptr->info_rowbytes != `0` && png_ptr->info_rowbytes !=
3221	PNG_ROWBYTES(pixel_depth, row_width))
3222	png_error(png_ptr, "internal row size calculation error");
3223
3224	/ Don't expect this to ever happen: /
3225	if (row_width == `0`)
3226	png_error(png_ptr, "internal row width error");
3227
3228	/ Preserve the last byte in cases where only part of it will be overwritten,*
3229	* the multiply below may overflow, we don't care because ANSI-C guarantees
3230	* we get the low bits.
3231	*/
3232	end_mask = (pixel_depth * row_width) & `7`;
3233	if (end_mask != `0`)
3234	{
3235	/ end_ptr == NULL is a flag to say do nothing /
3236	end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - `1`;
3237	end_byte = *end_ptr;
3238	# ifdef PNG_READ_PACKSWAP_SUPPORTED
3239	if ((png_ptr->transformations & PNG_PACKSWAP) != `0`)
3240	/ little-endian byte /
3241	end_mask = (unsigned int)(`0xff` << end_mask);
3242
3243	else / big-endian byte /
3244	# endif
3245	end_mask = `0xff` >> end_mask;
3246	/ end_mask is now the bits to keep from the destination row /
3247	}
3248
3249	/ For non-interlaced images this reduces to a memcpy(). A memcpy()*
3250	* will also happen if interlacing isn't supported or if the application
3251	* does not call png_set_interlace_handling(). In the latter cases the
3252	* caller just gets a sequence of the unexpanded rows from each interlace
3253	* pass.
3254	*/
3255	#ifdef PNG_READ_INTERLACING_SUPPORTED
3256	if (png_ptr->interlaced != `0` &&
3257	(png_ptr->transformations & PNG_INTERLACE) != `0` &&
3258	pass < `6` && (display == `0` \|\|
3259	/ The following copies everything for 'display' on passes 0, 2 and 4. /
3260	(display == `1` && (pass & `1`) != `0`)))
3261	{
3262	/ Narrow images may have no bits in a pass; the caller should handle*
3263	* this, but this test is cheap:
3264	*/
3265	if (row_width <= PNG_PASS_START_COL(pass))
3266	return;
3267
3268	if (pixel_depth < `8`)
3269	{
3270	/ For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit*
3271	* into 32 bits, then a single loop over the bytes using the four byte
3272	* values in the 32-bit mask can be used. For the 'display' option the
3273	* expanded mask may also not require any masking within a byte. To
3274	* make this work the PACKSWAP option must be taken into account - it
3275	* simply requires the pixels to be reversed in each byte.
3276	*
3277	* The 'regular' case requires a mask for each of the first 6 passes,
3278	* the 'display' case does a copy for the even passes in the range
3279	* 0..6. This has already been handled in the test above.
3280	*
3281	* The masks are arranged as four bytes with the first byte to use in
3282	* the lowest bits (little-endian) regardless of the order (PACKSWAP or
3283	* not) of the pixels in each byte.
3284	*
3285	* NOTE: the whole of this logic depends on the caller of this function
3286	* only calling it on rows appropriate to the pass. This function only
3287	* understands the 'x' logic; the 'y' logic is handled by the caller.
3288	*
3289	* The following defines allow generation of compile time constant bit
3290	* masks for each pixel depth and each possibility of swapped or not
3291	* swapped bytes. Pass 'p' is in the range 0..6; 'x', a pixel index,
3292	* is in the range 0..7; and the result is 1 if the pixel is to be
3293	* copied in the pass, 0 if not. 'S' is for the sparkle method, 'B'
3294	* for the block method.
3295	*
3296	* With some compilers a compile time expression of the general form:
3297	*
3298	* (shift >= 32) ? (a >> (shift-32)) : (b >> shift)
3299	*
3300	* Produces warnings with values of 'shift' in the range 33 to 63
3301	* because the right hand side of the ?: expression is evaluated by
3302	* the compiler even though it isn't used. Microsoft Visual C (various
3303	* versions) and the Intel C compiler are known to do this. To avoid
3304	* this the following macros are used in 1.5.6. This is a temporary
3305	* solution to avoid destabilizing the code during the release process.
3306	*/
3307	# if PNG_USE_COMPILE_TIME_MASKS
3308	# define PNG_LSR(x,s) ((x)>>((s) & 0x1f))
3309	# define PNG_LSL(x,s) ((x)<<((s) & 0x1f))
3310	# else
3311	# define PNG_LSR(x,s) ((x)>>(s))
3312	# define PNG_LSL(x,s) ((x)<<(s))
3313	# endif
3314	# define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\
3315	PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1)
3316	# define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\
3317	PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1)
3318
3319	/ Return a mask for pass 'p' pixel 'x' at depth 'd'. The mask is*
3320	* little endian - the first pixel is at bit 0 - however the extra
3321	* parameter 's' can be set to cause the mask position to be swapped
3322	* within each byte, to match the PNG format. This is done by XOR of
3323	* the shift with 7, 6 or 4 for bit depths 1, 2 and 4.
3324	*/
3325	# define PIXEL_MASK(p,x,d,s) \
3326	(PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0))))
3327
3328	/ Hence generate the appropriate 'block' or 'sparkle' pixel copy mask.*
3329	*/
3330	# define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
3331	# define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0)
3332
3333	/ Combine 8 of these to get the full mask. For the 1-bpp and 2-bpp*
3334	* cases the result needs replicating, for the 4-bpp case the above
3335	* generates a full 32 bits.
3336	*/
3337	# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1)))
3338
3339	# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\
3340	S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\
3341	S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d)
3342
3343	# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\
3344	B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\
3345	B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d)
3346
3347	#if PNG_USE_COMPILE_TIME_MASKS
3348	/ Utility macros to construct all the masks for a depth/swap*
3349	* combination. The 's' parameter says whether the format is PNG
3350	* (big endian bytes) or not. Only the three odd-numbered passes are
3351	* required for the display/block algorithm.
3352	*/
3353	# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\
3354	S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) }
3355
3356	# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) }
3357
3358	# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2))
3359
3360	/ Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and*
3361	* then pass:
3362	*/
3363	static const png_uint_32 row_mask[`2`/PACKSWAP/][`3`/depth/][`6`] =
3364	{
3365	/ Little-endian byte masks for PACKSWAP /
3366	{ S_MASKS(`1`,`0`), S_MASKS(`2`,`0`), S_MASKS(`4`,`0`) },
3367	/ Normal (big-endian byte) masks - PNG format /
3368	{ S_MASKS(`1`,`1`), S_MASKS(`2`,`1`), S_MASKS(`4`,`1`) }
3369	};
3370
3371	/ display_mask has only three entries for the odd passes, so index by*
3372	* pass>>1.
3373	*/
3374	static const png_uint_32 display_mask[`2`][`3`][`3`] =
3375	{
3376	/ Little-endian byte masks for PACKSWAP /
3377	{ B_MASKS(`1`,`0`), B_MASKS(`2`,`0`), B_MASKS(`4`,`0`) },
3378	/ Normal (big-endian byte) masks - PNG format /
3379	{ B_MASKS(`1`,`1`), B_MASKS(`2`,`1`), B_MASKS(`4`,`1`) }
3380	};
3381
3382	# define MASK(pass,depth,display,png)\
3383	((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\
3384	row_mask[png][DEPTH_INDEX(depth)][pass])
3385
3386	#else /* !PNG_USE_COMPILE_TIME_MASKS */
3387	/ This is the runtime alternative: it seems unlikely that this will*
3388	* ever be either smaller or faster than the compile time approach.
3389	*/
3390	# define MASK(pass,depth,display,png)\
3391	((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png))
3392	#endif /* !USE_COMPILE_TIME_MASKS */
3393
3394	/ Use the appropriate mask to copy the required bits. In some cases*
3395	* the byte mask will be 0 or 0xff; optimize these cases. row_width is
3396	* the number of pixels, but the code copies bytes, so it is necessary
3397	* to special case the end.
3398	*/
3399	png_uint_32 pixels_per_byte = `8` / pixel_depth;
3400	png_uint_32 mask;
3401
3402	# ifdef PNG_READ_PACKSWAP_SUPPORTED
3403	if ((png_ptr->transformations & PNG_PACKSWAP) != `0`)
3404	mask = MASK(pass, pixel_depth, display, `0`);
3405
3406	else
3407	# endif
3408	mask = MASK(pass, pixel_depth, display, `1`);
3409
3410	for (;;)
3411	{
3412	png_uint_32 m;
3413
3414	/ It doesn't matter in the following if png_uint_32 has more than*
3415	* 32 bits because the high bits always match those in m<<24; it is,
3416	* however, essential to use OR here, not +, because of this.
3417	*/
3418	m = mask;
3419	mask = (m >> `8`) \| (m << `24`); / rotate right to good compilers /
3420	m &= `0xff`;
3421
3422	if (m != `0`) / something to copy /
3423	{
3424	if (m != `0xff`)
3425	dp = (png_byte)((dp & ~m) \| (*sp & m));
3426	else
3427	dp = sp;
3428	}
3429
3430	/ NOTE: this may overwrite the last byte with garbage if the image*
3431	* is not an exact number of bytes wide; libpng has always done
3432	* this.
3433	*/
3434	if (row_width <= pixels_per_byte)
3435	break; / May need to restore part of the last byte /
3436
3437	row_width -= pixels_per_byte;
3438	++dp;
3439	++sp;
3440	}
3441	}
3442
3443	else / pixel_depth >= 8 /
3444	{
3445	unsigned int bytes_to_copy, bytes_to_jump;
3446
3447	/ Validate the depth - it must be a multiple of 8 /
3448	if (pixel_depth & `7`)
3449	png_error(png_ptr, "invalid user transform pixel depth");
3450
3451	pixel_depth >>= `3`; / now in bytes /
3452	row_width *= pixel_depth;
3453
3454	/ Regardless of pass number the Adam 7 interlace always results in a*
3455	* fixed number of pixels to copy then to skip. There may be a
3456	* different number of pixels to skip at the start though.
3457	*/
3458	{
3459	unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth;
3460
3461	row_width -= offset;
3462	dp += offset;
3463	sp += offset;
3464	}
3465
3466	/ Work out the bytes to copy. /
3467	if (display != `0`)
3468	{
3469	/ When doing the 'block' algorithm the pixel in the pass gets*
3470	* replicated to adjacent pixels. This is why the even (0,2,4,6)
3471	* passes are skipped above - the entire expanded row is copied.
3472	*/
3473	bytes_to_copy = (`1`<<((`6`-pass)>>`1`)) * pixel_depth;
3474
3475	/ But don't allow this number to exceed the actual row width. /
3476	if (bytes_to_copy > row_width)
3477	bytes_to_copy = (unsigned int)/SAFE/row_width;
3478	}
3479
3480	else / normal row; Adam7 only ever gives us one pixel to copy. /
3481	bytes_to_copy = pixel_depth;
3482
3483	/ In Adam7 there is a constant offset between where the pixels go. /
3484	bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;
3485
3486	/ And simply copy these bytes. Some optimization is possible here,*
3487	* depending on the value of 'bytes_to_copy'. Special case the low
3488	* byte counts, which we know to be frequent.
3489	*
3490	* Notice that these cases all 'return' rather than 'break' - this
3491	* avoids an unnecessary test on whether to restore the last byte
3492	* below.
3493	*/
3494	switch (bytes_to_copy)
3495	{
3496	case `1`:
3497	for (;;)
3498	{
3499	dp = sp;
3500
3501	if (row_width <= bytes_to_jump)
3502	return;
3503
3504	dp += bytes_to_jump;
3505	sp += bytes_to_jump;
3506	row_width -= bytes_to_jump;
3507	}
3508
3509	case `2`:
3510	/ There is a possibility of a partial copy at the end here; this*
3511	* slows the code down somewhat.
3512	*/
3513	do
3514	{
3515	dp[`0`] = sp[`0`]; dp[`1`] = sp[`1`];
3516
3517	if (row_width <= bytes_to_jump)
3518	return;
3519
3520	sp += bytes_to_jump;
3521	dp += bytes_to_jump;
3522	row_width -= bytes_to_jump;
3523	}
3524	while (row_width > `1`);
3525
3526	/ And there can only be one byte left at this point: /
3527	dp = sp;
3528	return;
3529
3530	case `3`:
3531	/ This can only be the RGB case, so each copy is exactly one*
3532	* pixel and it is not necessary to check for a partial copy.
3533	*/
3534	for (;;)
3535	{
3536	dp[`0`] = sp[`0`]; dp[`1`] = sp[`1`]; dp[`2`] = sp[`2`];
3537
3538	if (row_width <= bytes_to_jump)
3539	return;
3540
3541	sp += bytes_to_jump;
3542	dp += bytes_to_jump;
3543	row_width -= bytes_to_jump;
3544	}
3545
3546	default:
3547	#if PNG_ALIGN_TYPE != PNG_ALIGN_NONE
3548	/ Check for double byte alignment and, if possible, use a*
3549	* 16-bit copy. Don't attempt this for narrow images - ones that
3550	* are less than an interlace panel wide. Don't attempt it for
3551	* wide bytes_to_copy either - use the memcpy there.
3552	*/
3553	if (bytes_to_copy < `16` /else use memcpy/ &&
3554	png_isaligned(dp, png_uint_16) &&
3555	png_isaligned(sp, png_uint_16) &&
3556	bytes_to_copy % (sizeof (png_uint_16)) == `0` &&
3557	bytes_to_jump % (sizeof (png_uint_16)) == `0`)
3558	{
3559	/ Everything is aligned for png_uint_16 copies, but try for*
3560	* png_uint_32 first.
3561	*/
3562	if (png_isaligned(dp, png_uint_32) &&
3563	png_isaligned(sp, png_uint_32) &&
3564	bytes_to_copy % (sizeof (png_uint_32)) == `0` &&
3565	bytes_to_jump % (sizeof (png_uint_32)) == `0`)
3566	{
3567	png_uint_32p dp32 = png_aligncast(png_uint_32p,dp);
3568	png_const_uint_32p sp32 = png_aligncastconst(
3569	png_const_uint_32p, sp);
3570	size_t skip = (bytes_to_jump-bytes_to_copy) /
3571	(sizeof (png_uint_32));
3572
3573	do
3574	{
3575	size_t c = bytes_to_copy;
3576	do
3577	{
3578	dp32++ = sp32++;
3579	c -= (sizeof (png_uint_32));
3580	}
3581	while (c > `0`);
3582
3583	if (row_width <= bytes_to_jump)
3584	return;
3585
3586	dp32 += skip;
3587	sp32 += skip;
3588	row_width -= bytes_to_jump;
3589	}
3590	while (bytes_to_copy <= row_width);
3591
3592	/ Get to here when the row_width truncates the final copy.*
3593	* There will be 1-3 bytes left to copy, so don't try the
3594	* 16-bit loop below.
3595	*/
3596	dp = (png_bytep)dp32;
3597	sp = (png_const_bytep)sp32;
3598	do
3599	dp++ = sp++;
3600	while (--row_width > `0`);
3601	return;
3602	}
3603
3604	/ Else do it in 16-bit quantities, but only if the size is*
3605	* not too large.
3606	*/
3607	else
3608	{
3609	png_uint_16p dp16 = png_aligncast(png_uint_16p, dp);
3610	png_const_uint_16p sp16 = png_aligncastconst(
3611	png_const_uint_16p, sp);
3612	size_t skip = (bytes_to_jump-bytes_to_copy) /
3613	(sizeof (png_uint_16));
3614
3615	do
3616	{
3617	size_t c = bytes_to_copy;
3618	do
3619	{
3620	dp16++ = sp16++;
3621	c -= (sizeof (png_uint_16));
3622	}
3623	while (c > `0`);
3624
3625	if (row_width <= bytes_to_jump)
3626	return;
3627
3628	dp16 += skip;
3629	sp16 += skip;
3630	row_width -= bytes_to_jump;
3631	}
3632	while (bytes_to_copy <= row_width);
3633
3634	/ End of row - 1 byte left, bytes_to_copy > row_width: /
3635	dp = (png_bytep)dp16;
3636	sp = (png_const_bytep)sp16;
3637	do
3638	dp++ = sp++;
3639	while (--row_width > `0`);
3640	return;
3641	}
3642	}
3643	#endif /* ALIGN_TYPE code */
3644
3645	/ The true default - use a memcpy: /
3646	for (;;)
3647	{
3648	memcpy(dp, sp, bytes_to_copy);
3649
3650	if (row_width <= bytes_to_jump)
3651	return;
3652
3653	sp += bytes_to_jump;
3654	dp += bytes_to_jump;
3655	row_width -= bytes_to_jump;
3656	if (bytes_to_copy > row_width)
3657	bytes_to_copy = (unsigned int)/SAFE/row_width;
3658	}
3659	}
3660
3661	/ NOT REACHED/
3662	} / pixel_depth >= 8 /
3663
3664	/ Here if pixel_depth < 8 to check 'end_ptr' below. /
3665	}
3666	else
3667	#endif /* READ_INTERLACING */
3668
3669	/ If here then the switch above wasn't used so just memcpy the whole row*
3670	* from the temporary row buffer (notice that this overwrites the end of the
3671	* destination row if it is a partial byte.)
3672	*/
3673	memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width));
3674
3675	/ Restore the overwritten bits from the last byte if necessary. /
3676	if (end_ptr != NULL)
3677	end_ptr = (png_byte)((end_byte & end_mask) \| (end_ptr & ~end_mask));
3678	}
3679
3680	#ifdef PNG_READ_INTERLACING_SUPPORTED
3681	void / PRIVATE /
3682	png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
3683	png_uint_32 transformations / Because these may affect the byte layout /)
3684	{
3685	/ Arrays to facilitate easy interlacing - use pass (0 - 6) as index /
3686	/ Offset to next interlace block /
3687	static const unsigned int png_pass_inc[`7`] = {`8`, `8`, `4`, `4`, `2`, `2`, `1`};
3688
3689	png_debug(`1`, "in png_do_read_interlace");
3690	if (row != NULL && row_info != NULL)
3691	{
3692	png_uint_32 final_width;
3693
3694	final_width = row_info->width * png_pass_inc[pass];
3695
3696	switch (row_info->pixel_depth)
3697	{
3698	case `1`:
3699	{
3700	png_bytep sp = row + (size_t)((row_info->width - `1`) >> `3`);
3701	png_bytep dp = row + (size_t)((final_width - `1`) >> `3`);
3702	unsigned int sshift, dshift;
3703	unsigned int s_start, s_end;
3704	int s_inc;
3705	int jstop = (int)png_pass_inc[pass];
3706	png_byte v;
3707	png_uint_32 i;
3708	int j;
3709
3710	#ifdef PNG_READ_PACKSWAP_SUPPORTED
3711	if ((transformations & PNG_PACKSWAP) != `0`)
3712	{
3713	sshift = ((row_info->width + `7`) & `0x07`);
3714	dshift = ((final_width + `7`) & `0x07`);
3715	s_start = `7`;
3716	s_end = `0`;
3717	s_inc = -`1`;
3718	}
3719
3720	else
3721	#endif
3722	{
3723	sshift = `7` - ((row_info->width + `7`) & `0x07`);
3724	dshift = `7` - ((final_width + `7`) & `0x07`);
3725	s_start = `0`;
3726	s_end = `7`;
3727	s_inc = `1`;
3728	}
3729
3730	for (i = `0`; i < row_info->width; i++)
3731	{
3732	v = (png_byte)((*sp >> sshift) & `0x01`);
3733	for (j = `0`; j < jstop; j++)
3734	{
3735	unsigned int tmp = *dp & (`0x7f7f` >> (`7` - dshift));
3736	tmp \|= (unsigned int)(v << dshift);
3737	*dp = (png_byte)(tmp & `0xff`);
3738
3739	if (dshift == s_end)
3740	{
3741	dshift = s_start;
3742	dp--;
3743	}
3744
3745	else
3746	dshift = (unsigned int)((int)dshift + s_inc);
3747	}
3748
3749	if (sshift == s_end)
3750	{
3751	sshift = s_start;
3752	sp--;
3753	}
3754
3755	else
3756	sshift = (unsigned int)((int)sshift + s_inc);
3757	}
3758	break;
3759	}
3760
3761	case `2`:
3762	{
3763	png_bytep sp = row + (png_uint_32)((row_info->width - `1`) >> `2`);
3764	png_bytep dp = row + (png_uint_32)((final_width - `1`) >> `2`);
3765	unsigned int sshift, dshift;
3766	unsigned int s_start, s_end;
3767	int s_inc;
3768	int jstop = (int)png_pass_inc[pass];
3769	png_uint_32 i;
3770
3771	#ifdef PNG_READ_PACKSWAP_SUPPORTED
3772	if ((transformations & PNG_PACKSWAP) != `0`)
3773	{
3774	sshift = (((row_info->width + `3`) & `0x03`) << `1`);
3775	dshift = (((final_width + `3`) & `0x03`) << `1`);
3776	s_start = `6`;
3777	s_end = `0`;
3778	s_inc = -`2`;
3779	}
3780
3781	else
3782	#endif
3783	{
3784	sshift = ((`3` - ((row_info->width + `3`) & `0x03`)) << `1`);
3785	dshift = ((`3` - ((final_width + `3`) & `0x03`)) << `1`);
3786	s_start = `0`;
3787	s_end = `6`;
3788	s_inc = `2`;
3789	}
3790
3791	for (i = `0`; i < row_info->width; i++)
3792	{
3793	png_byte v;
3794	int j;
3795
3796	v = (png_byte)((*sp >> sshift) & `0x03`);
3797	for (j = `0`; j < jstop; j++)
3798	{
3799	unsigned int tmp = *dp & (`0x3f3f` >> (`6` - dshift));
3800	tmp \|= (unsigned int)(v << dshift);
3801	*dp = (png_byte)(tmp & `0xff`);
3802
3803	if (dshift == s_end)
3804	{
3805	dshift = s_start;
3806	dp--;
3807	}
3808
3809	else
3810	dshift = (unsigned int)((int)dshift + s_inc);
3811	}
3812
3813	if (sshift == s_end)
3814	{
3815	sshift = s_start;
3816	sp--;
3817	}
3818
3819	else
3820	sshift = (unsigned int)((int)sshift + s_inc);
3821	}
3822	break;
3823	}
3824
3825	case `4`:
3826	{
3827	png_bytep sp = row + (size_t)((row_info->width - `1`) >> `1`);
3828	png_bytep dp = row + (size_t)((final_width - `1`) >> `1`);
3829	unsigned int sshift, dshift;
3830	unsigned int s_start, s_end;
3831	int s_inc;
3832	png_uint_32 i;
3833	int jstop = (int)png_pass_inc[pass];
3834
3835	#ifdef PNG_READ_PACKSWAP_SUPPORTED
3836	if ((transformations & PNG_PACKSWAP) != `0`)
3837	{
3838	sshift = (((row_info->width + `1`) & `0x01`) << `2`);
3839	dshift = (((final_width + `1`) & `0x01`) << `2`);
3840	s_start = `4`;
3841	s_end = `0`;
3842	s_inc = -`4`;
3843	}
3844
3845	else
3846	#endif
3847	{
3848	sshift = ((`1` - ((row_info->width + `1`) & `0x01`)) << `2`);
3849	dshift = ((`1` - ((final_width + `1`) & `0x01`)) << `2`);
3850	s_start = `0`;
3851	s_end = `4`;
3852	s_inc = `4`;
3853	}
3854
3855	for (i = `0`; i < row_info->width; i++)
3856	{
3857	png_byte v = (png_byte)((*sp >> sshift) & `0x0f`);
3858	int j;
3859
3860	for (j = `0`; j < jstop; j++)
3861	{
3862	unsigned int tmp = *dp & (`0xf0f` >> (`4` - dshift));
3863	tmp \|= (unsigned int)(v << dshift);
3864	*dp = (png_byte)(tmp & `0xff`);
3865
3866	if (dshift == s_end)
3867	{
3868	dshift = s_start;
3869	dp--;
3870	}
3871
3872	else
3873	dshift = (unsigned int)((int)dshift + s_inc);
3874	}
3875
3876	if (sshift == s_end)
3877	{
3878	sshift = s_start;
3879	sp--;
3880	}
3881
3882	else
3883	sshift = (unsigned int)((int)sshift + s_inc);
3884	}
3885	break;
3886	}
3887
3888	default:
3889	{
3890	size_t pixel_bytes = (row_info->pixel_depth >> `3`);
3891
3892	png_bytep sp = row + (size_t)(row_info->width - `1`)
3893	* pixel_bytes;
3894
3895	png_bytep dp = row + (size_t)(final_width - `1`) * pixel_bytes;
3896
3897	int jstop = (int)png_pass_inc[pass];
3898	png_uint_32 i;
3899
3900	for (i = `0`; i < row_info->width; i++)
3901	{
3902	png_byte v[`8`]; / SAFE; pixel_depth does not exceed 64 /
3903	int j;
3904
3905	memcpy(v, sp, pixel_bytes);
3906
3907	for (j = `0`; j < jstop; j++)
3908	{
3909	memcpy(dp, v, pixel_bytes);
3910	dp -= pixel_bytes;
3911	}
3912
3913	sp -= pixel_bytes;
3914	}
3915	break;
3916	}
3917	}
3918
3919	row_info->width = final_width;
3920	row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, final_width);
3921	}
3922	#ifndef PNG_READ_PACKSWAP_SUPPORTED
3923	PNG_UNUSED(transformations) / Silence compiler warning /
3924	#endif
3925	}
3926	#endif /* READ_INTERLACING */
3927
3928	static void
3929	png_read_filter_row_sub(png_row_infop row_info, png_bytep row,
3930	png_const_bytep prev_row)
3931	{
3932	size_t i;
3933	size_t istop = row_info->rowbytes;
3934	unsigned int bpp = (row_info->pixel_depth + `7`) >> `3`;
3935	png_bytep rp = row + bpp;
3936
3937	PNG_UNUSED(prev_row)
3938
3939	for (i = bpp; i < istop; i++)
3940	{
3941	rp = (png_byte)(((int)(rp) + (int)(*(rp-bpp))) & `0xff`);
3942	rp++;
3943	}
3944	}
3945
3946	static void
3947	png_read_filter_row_up(png_row_infop row_info, png_bytep row,
3948	png_const_bytep prev_row)
3949	{
3950	size_t i;
3951	size_t istop = row_info->rowbytes;
3952	png_bytep rp = row;
3953	png_const_bytep pp = prev_row;
3954
3955	for (i = `0`; i < istop; i++)
3956	{
3957	rp = (png_byte)(((int)(rp) + (int)(*pp++)) & `0xff`);
3958	rp++;
3959	}
3960	}
3961
3962	static void
3963	png_read_filter_row_avg(png_row_infop row_info, png_bytep row,
3964	png_const_bytep prev_row)
3965	{
3966	size_t i;
3967	png_bytep rp = row;
3968	png_const_bytep pp = prev_row;
3969	unsigned int bpp = (row_info->pixel_depth + `7`) >> `3`;
3970	size_t istop = row_info->rowbytes - bpp;
3971
3972	for (i = `0`; i < bpp; i++)
3973	{
3974	rp = (png_byte)(((int)(rp) +
3975	((int)(*pp++) / `2` )) & `0xff`);
3976
3977	rp++;
3978	}
3979
3980	for (i = `0`; i < istop; i++)
3981	{
3982	rp = (png_byte)(((int)(rp) +
3983	(int)(pp++ + (rp-bpp)) / `2` ) & `0xff`);
3984
3985	rp++;
3986	}
3987	}
3988
3989	static void
3990	png_read_filter_row_paeth_1byte_pixel(png_row_infop row_info, png_bytep row,
3991	png_const_bytep prev_row)
3992	{
3993	png_bytep rp_end = row + row_info->rowbytes;
3994	int a, c;
3995
3996	/ First pixel/byte /
3997	c = *prev_row++;
3998	a = *row + c;
3999	*row++ = (png_byte)a;
4000
4001	/ Remainder /
4002	while (row < rp_end)
4003	{
4004	int b, pa, pb, pc, p;
4005
4006	a &= `0xff`; / From previous iteration or start /
4007	b = *prev_row++;
4008
4009	p = b - c;
4010	pc = a - c;
4011
4012	#ifdef PNG_USE_ABS
4013	pa = abs(p);
4014	pb = abs(pc);
4015	pc = abs(p + pc);
4016	#else
4017	pa = p < `0` ? -p : p;
4018	pb = pc < `0` ? -pc : pc;
4019	pc = (p + pc) < `0` ? -(p + pc) : p + pc;
4020	#endif
4021
4022	/ Find the best predictor, the least of pa, pb, pc favoring the earlier*
4023	* ones in the case of a tie.
4024	*/
4025	if (pb < pa)
4026	{
4027	pa = pb; a = b;
4028	}
4029	if (pc < pa) a = c;
4030
4031	/ Calculate the current pixel in a, and move the previous row pixel to c*
4032	* for the next time round the loop
4033	*/
4034	c = b;
4035	a += *row;
4036	*row++ = (png_byte)a;
4037	}
4038	}
4039
4040	static void
4041	png_read_filter_row_paeth_multibyte_pixel(png_row_infop row_info, png_bytep row,
4042	png_const_bytep prev_row)
4043	{
4044	unsigned int bpp = (row_info->pixel_depth + `7`) >> `3`;
4045	png_bytep rp_end = row + bpp;
4046
4047	/ Process the first pixel in the row completely (this is the same as 'up'*
4048	* because there is only one candidate predictor for the first row).
4049	*/
4050	while (row < rp_end)
4051	{
4052	int a = row + prev_row++;
4053	*row++ = (png_byte)a;
4054	}
4055
4056	/ Remainder /
4057	rp_end = rp_end + (row_info->rowbytes - bpp);
4058
4059	while (row < rp_end)
4060	{
4061	int a, b, c, pa, pb, pc, p;
4062
4063	c = *(prev_row - bpp);
4064	a = *(row - bpp);
4065	b = *prev_row++;
4066
4067	p = b - c;
4068	pc = a - c;
4069
4070	#ifdef PNG_USE_ABS
4071	pa = abs(p);
4072	pb = abs(pc);
4073	pc = abs(p + pc);
4074	#else
4075	pa = p < `0` ? -p : p;
4076	pb = pc < `0` ? -pc : pc;
4077	pc = (p + pc) < `0` ? -(p + pc) : p + pc;
4078	#endif
4079
4080	if (pb < pa)
4081	{
4082	pa = pb; a = b;
4083	}
4084	if (pc < pa) a = c;
4085
4086	a += *row;
4087	*row++ = (png_byte)a;
4088	}
4089	}
4090
4091	static void
4092	png_init_filter_functions(png_structrp pp)
4093	/ This function is called once for every PNG image (except for PNG images*
4094	* that only use PNG_FILTER_VALUE_NONE for all rows) to set the
4095	* implementations required to reverse the filtering of PNG rows. Reversing
4096	* the filter is the first transformation performed on the row data. It is
4097	* performed in place, therefore an implementation can be selected based on
4098	* the image pixel format. If the implementation depends on image width then
4099	* take care to ensure that it works correctly if the image is interlaced -
4100	* interlacing causes the actual row width to vary.
4101	*/
4102	{
4103	unsigned int bpp = (pp->pixel_depth + `7`) >> `3`;
4104
4105	pp->read_filter[PNG_FILTER_VALUE_SUB-`1`] = png_read_filter_row_sub;
4106	pp->read_filter[PNG_FILTER_VALUE_UP-`1`] = png_read_filter_row_up;
4107	pp->read_filter[PNG_FILTER_VALUE_AVG-`1`] = png_read_filter_row_avg;
4108	if (bpp == `1`)
4109	pp->read_filter[PNG_FILTER_VALUE_PAETH-`1`] =
4110	png_read_filter_row_paeth_1byte_pixel;
4111	else
4112	pp->read_filter[PNG_FILTER_VALUE_PAETH-`1`] =
4113	png_read_filter_row_paeth_multibyte_pixel;
4114
4115	#ifdef PNG_FILTER_OPTIMIZATIONS
4116	/ To use this define PNG_FILTER_OPTIMIZATIONS as the name of a function to*
4117	* call to install hardware optimizations for the above functions; simply
4118	* replace whatever elements of the pp->read_filter[] array with a hardware
4119	* specific (or, for that matter, generic) optimization.
4120	*
4121	* To see an example of this examine what configure.ac does when
4122	* --enable-arm-neon is specified on the command line.
4123	*/
4124	PNG_FILTER_OPTIMIZATIONS(pp, bpp);
4125	#endif
4126	}
4127
4128	void / PRIVATE /
4129	png_read_filter_row(png_structrp pp, png_row_infop row_info, png_bytep row,
4130	png_const_bytep prev_row, int filter)
4131	{
4132	/ OPTIMIZATION: DO NOT MODIFY THIS FUNCTION, instead #define*
4133	* PNG_FILTER_OPTIMIZATIONS to a function that overrides the generic
4134	* implementations. See png_init_filter_functions above.
4135	*/
4136	if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST)
4137	{
4138	if (pp->read_filter[`0`] == NULL)
4139	png_init_filter_functions(pp);
4140
4141	pp->read_filter[filter-`1`](row_info, row, prev_row);
4142	}
4143	}
4144
4145	#ifdef PNG_SEQUENTIAL_READ_SUPPORTED
4146	void / PRIVATE /
4147	png_read_IDAT_data(png_structrp png_ptr, png_bytep output,
4148	png_alloc_size_t avail_out)
4149	{
4150	/ Loop reading IDATs and decompressing the result into output[avail_out] /
4151	png_ptr->zstream.next_out = output;
4152	png_ptr->zstream.avail_out = `0`; / safety: set below /
4153
4154	if (output == NULL)
4155	avail_out = `0`;
4156
4157	do
4158	{
4159	int ret;
4160	png_byte tmpbuf[PNG_INFLATE_BUF_SIZE];
4161
4162	if (png_ptr->zstream.avail_in == `0`)
4163	{
4164	uInt avail_in;
4165	png_bytep buffer;
4166
4167	while (png_ptr->idat_size == `0`)
4168	{
4169	png_crc_finish(png_ptr, `0`);
4170
4171	png_ptr->idat_size = png_read_chunk_header(png_ptr);
4172	/ This is an error even in the 'check' case because the code just*
4173	* consumed a non-IDAT header.
4174	*/
4175	if (png_ptr->chunk_name != png_IDAT)
4176	png_error(png_ptr, "Not enough image data");
4177	}
4178
4179	avail_in = png_ptr->IDAT_read_size;
4180
4181	if (avail_in > png_ptr->idat_size)
4182	avail_in = (uInt)png_ptr->idat_size;
4183
4184	/ A PNG with a gradually increasing IDAT size will defeat this attempt*
4185	* to minimize memory usage by causing lots of re-allocs, but
4186	* realistically doing IDAT_read_size re-allocs is not likely to be a
4187	* big problem.
4188	*/
4189	buffer = png_read_buffer(png_ptr, avail_in, `0`/error/);
4190
4191	png_crc_read(png_ptr, buffer, avail_in);
4192	png_ptr->idat_size -= avail_in;
4193
4194	png_ptr->zstream.next_in = buffer;
4195	png_ptr->zstream.avail_in = avail_in;
4196	}
4197
4198	/ And set up the output side. /
4199	if (output != NULL) / standard read /
4200	{
4201	uInt out = ZLIB_IO_MAX;
4202
4203	if (out > avail_out)
4204	out = (uInt)avail_out;
4205
4206	avail_out -= out;
4207	png_ptr->zstream.avail_out = out;
4208	}
4209
4210	else / after last row, checking for end /
4211	{
4212	png_ptr->zstream.next_out = tmpbuf;
4213	png_ptr->zstream.avail_out = (sizeof tmpbuf);
4214	}
4215
4216	/ Use NO_FLUSH; this gives zlib the maximum opportunity to optimize the*
4217	* process. If the LZ stream is truncated the sequential reader will
4218	* terminally damage the stream, above, by reading the chunk header of the
4219	* following chunk (it then exits with png_error).
4220	*
4221	* TODO: deal more elegantly with truncated IDAT lists.
4222	*/
4223	ret = PNG_INFLATE(png_ptr, Z_NO_FLUSH);
4224
4225	/ Take the unconsumed output back. /
4226	if (output != NULL)
4227	avail_out += png_ptr->zstream.avail_out;
4228
4229	else / avail_out counts the extra bytes /
4230	avail_out += (sizeof tmpbuf) - png_ptr->zstream.avail_out;
4231
4232	png_ptr->zstream.avail_out = `0`;
4233
4234	if (ret == Z_STREAM_END)
4235	{
4236	/ Do this for safety; we won't read any more into this row. /
4237	png_ptr->zstream.next_out = NULL;
4238
4239	png_ptr->mode \|= PNG_AFTER_IDAT;
4240	png_ptr->flags \|= PNG_FLAG_ZSTREAM_ENDED;
4241
4242	if (png_ptr->zstream.avail_in > `0` \|\| png_ptr->idat_size > `0`)
4243	png_chunk_benign_error(png_ptr, "Extra compressed data");
4244	break;
4245	}
4246
4247	if (ret != Z_OK)
4248	{
4249	png_zstream_error(png_ptr, ret);
4250
4251	if (output != NULL)
4252	png_chunk_error(png_ptr, png_ptr->zstream.msg);
4253
4254	else / checking /
4255	{
4256	png_chunk_benign_error(png_ptr, png_ptr->zstream.msg);
4257	return;
4258	}
4259	}
4260	} while (avail_out > `0`);
4261
4262	if (avail_out > `0`)
4263	{
4264	/ The stream ended before the image; this is the same as too few IDATs so*
4265	* should be handled the same way.
4266	*/
4267	if (output != NULL)
4268	png_error(png_ptr, "Not enough image data");
4269
4270	else / the deflate stream contained extra data /
4271	png_chunk_benign_error(png_ptr, "Too much image data");
4272	}
4273	}
4274
4275	void / PRIVATE /
4276	png_read_finish_IDAT(png_structrp png_ptr)
4277	{
4278	/ We don't need any more data and the stream should have ended, however the*
4279	* LZ end code may actually not have been processed. In this case we must
4280	* read it otherwise stray unread IDAT data or, more likely, an IDAT chunk
4281	* may still remain to be consumed.
4282	*/
4283	if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == `0`)
4284	{
4285	/ The NULL causes png_read_IDAT_data to swallow any remaining bytes in*
4286	* the compressed stream, but the stream may be damaged too, so even after
4287	* this call we may need to terminate the zstream ownership.
4288	*/
4289	png_read_IDAT_data(png_ptr, NULL, `0`);
4290	png_ptr->zstream.next_out = NULL; / safety /
4291
4292	/ Now clear everything out for safety; the following may not have been*
4293	* done.
4294	*/
4295	if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == `0`)
4296	{
4297	png_ptr->mode \|= PNG_AFTER_IDAT;
4298	png_ptr->flags \|= PNG_FLAG_ZSTREAM_ENDED;
4299	}
4300	}
4301
4302	/ If the zstream has not been released do it now and terminate the reading*
4303	* of the final IDAT chunk.
4304	*/
4305	if (png_ptr->zowner == png_IDAT)
4306	{
4307	/ Always do this; the pointers otherwise point into the read buffer. /
4308	png_ptr->zstream.next_in = NULL;
4309	png_ptr->zstream.avail_in = `0`;
4310
4311	/ Now we no longer own the zstream. /
4312	png_ptr->zowner = `0`;
4313
4314	/ The slightly weird semantics of the sequential IDAT reading is that we*
4315	* are always in or at the end of an IDAT chunk, so we always need to do a
4316	* crc_finish here. If idat_size is non-zero we also need to read the
4317	* spurious bytes at the end of the chunk now.
4318	*/
4319	(void)png_crc_finish(png_ptr, png_ptr->idat_size);
4320	}
4321	}
4322
4323	void / PRIVATE /
4324	png_read_finish_row(png_structrp png_ptr)
4325	{
4326	/ Arrays to facilitate easy interlacing - use pass (0 - 6) as index /
4327
4328	/ Start of interlace block /
4329	static const png_byte png_pass_start[`7`] = {`0`, `4`, `0`, `2`, `0`, `1`, `0`};
4330
4331	/ Offset to next interlace block /
4332	static const png_byte png_pass_inc[`7`] = {`8`, `8`, `4`, `4`, `2`, `2`, `1`};
4333
4334	/ Start of interlace block in the y direction /
4335	static const png_byte png_pass_ystart[`7`] = {`0`, `0`, `4`, `0`, `2`, `0`, `1`};
4336
4337	/ Offset to next interlace block in the y direction /
4338	static const png_byte png_pass_yinc[`7`] = {`8`, `8`, `8`, `4`, `4`, `2`, `2`};
4339
4340	png_debug(`1`, "in png_read_finish_row");
4341	png_ptr->row_number++;
4342	if (png_ptr->row_number < png_ptr->num_rows)
4343	return;
4344
4345	if (png_ptr->interlaced != `0`)
4346	{
4347	png_ptr->row_number = `0`;
4348
4349	/ TO DO: don't do this if prev_row isn't needed (requires*
4350	* read-ahead of the next row's filter byte.
4351	*/
4352	memset(png_ptr->prev_row, `0`, png_ptr->rowbytes + `1`);
4353
4354	do
4355	{
4356	png_ptr->pass++;
4357
4358	if (png_ptr->pass >= `7`)
4359	break;
4360
4361	png_ptr->iwidth = (png_ptr->width +
4362	png_pass_inc[png_ptr->pass] - `1` -
4363	png_pass_start[png_ptr->pass]) /
4364	png_pass_inc[png_ptr->pass];
4365
4366	if ((png_ptr->transformations & PNG_INTERLACE) == `0`)
4367	{
4368	png_ptr->num_rows = (png_ptr->height +
4369	png_pass_yinc[png_ptr->pass] - `1` -
4370	png_pass_ystart[png_ptr->pass]) /
4371	png_pass_yinc[png_ptr->pass];
4372	}
4373
4374	else / if (png_ptr->transformations & PNG_INTERLACE) /
4375	break; / libpng deinterlacing sees every row /
4376
4377	} while (png_ptr->num_rows == `0` \|\| png_ptr->iwidth == `0`);
4378
4379	if (png_ptr->pass < `7`)
4380	return;
4381	}
4382
4383	/ Here after at the end of the last row of the last pass. /
4384	png_read_finish_IDAT(png_ptr);
4385	}
4386	#endif /* SEQUENTIAL_READ */
4387
4388	void / PRIVATE /
4389	png_read_start_row(png_structrp png_ptr)
4390	{
4391	/ Arrays to facilitate easy interlacing - use pass (0 - 6) as index /
4392
4393	/ Start of interlace block /
4394	static const png_byte png_pass_start[`7`] = {`0`, `4`, `0`, `2`, `0`, `1`, `0`};
4395
4396	/ Offset to next interlace block /
4397	static const png_byte png_pass_inc[`7`] = {`8`, `8`, `4`, `4`, `2`, `2`, `1`};
4398
4399	/ Start of interlace block in the y direction /
4400	static const png_byte png_pass_ystart[`7`] = {`0`, `0`, `4`, `0`, `2`, `0`, `1`};
4401
4402	/ Offset to next interlace block in the y direction /
4403	static const png_byte png_pass_yinc[`7`] = {`8`, `8`, `8`, `4`, `4`, `2`, `2`};
4404
4405	unsigned int max_pixel_depth;
4406	size_t row_bytes;
4407
4408	png_debug(`1`, "in png_read_start_row");
4409
4410	#ifdef PNG_READ_TRANSFORMS_SUPPORTED
4411	png_init_read_transformations(png_ptr);
4412	#endif
4413	if (png_ptr->interlaced != `0`)
4414	{
4415	if ((png_ptr->transformations & PNG_INTERLACE) == `0`)
4416	png_ptr->num_rows = (png_ptr->height + png_pass_yinc[`0`] - `1` -
4417	png_pass_ystart[`0`]) / png_pass_yinc[`0`];
4418
4419	else
4420	png_ptr->num_rows = png_ptr->height;
4421
4422	png_ptr->iwidth = (png_ptr->width +
4423	png_pass_inc[png_ptr->pass] - `1` -
4424	png_pass_start[png_ptr->pass]) /
4425	png_pass_inc[png_ptr->pass];
4426	}
4427
4428	else
4429	{
4430	png_ptr->num_rows = png_ptr->height;
4431	png_ptr->iwidth = png_ptr->width;
4432	}
4433
4434	max_pixel_depth = (unsigned int)png_ptr->pixel_depth;
4435
4436	/ WARNING: * png_read_transform_info (pngrtran.c) performs a simpler set of*
4437	* calculations to calculate the final pixel depth, then
4438	* png_do_read_transforms actually does the transforms. This means that the
4439	* code which effectively calculates this value is actually repeated in three
4440	* separate places. They must all match. Innocent changes to the order of
4441	* transformations can and will break libpng in a way that causes memory
4442	* overwrites.
4443	*
4444	* TODO: fix this.
4445	*/
4446	#ifdef PNG_READ_PACK_SUPPORTED
4447	if ((png_ptr->transformations & PNG_PACK) != `0` && png_ptr->bit_depth < `8`)
4448	max_pixel_depth = `8`;
4449	#endif
4450
4451	#ifdef PNG_READ_EXPAND_SUPPORTED
4452	if ((png_ptr->transformations & PNG_EXPAND) != `0`)
4453	{
4454	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
4455	{
4456	if (png_ptr->num_trans != `0`)
4457	max_pixel_depth = `32`;
4458
4459	else
4460	max_pixel_depth = `24`;
4461	}
4462
4463	else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
4464	{
4465	if (max_pixel_depth < `8`)
4466	max_pixel_depth = `8`;
4467
4468	if (png_ptr->num_trans != `0`)
4469	max_pixel_depth *= `2`;
4470	}
4471
4472	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
4473	{
4474	if (png_ptr->num_trans != `0`)
4475	{
4476	max_pixel_depth *= `4`;
4477	max_pixel_depth /= `3`;
4478	}
4479	}
4480	}
4481	#endif
4482
4483	#ifdef PNG_READ_EXPAND_16_SUPPORTED
4484	if ((png_ptr->transformations & PNG_EXPAND_16) != `0`)
4485	{
4486	# ifdef PNG_READ_EXPAND_SUPPORTED
4487	/ In fact it is an error if it isn't supported, but checking is*
4488	* the safe way.
4489	*/
4490	if ((png_ptr->transformations & PNG_EXPAND) != `0`)
4491	{
4492	if (png_ptr->bit_depth < `16`)
4493	max_pixel_depth *= `2`;
4494	}
4495	else
4496	# endif
4497	png_ptr->transformations &= ~PNG_EXPAND_16;
4498	}
4499	#endif
4500
4501	#ifdef PNG_READ_FILLER_SUPPORTED
4502	if ((png_ptr->transformations & (PNG_FILLER)) != `0`)
4503	{
4504	if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
4505	{
4506	if (max_pixel_depth <= `8`)
4507	max_pixel_depth = `16`;
4508
4509	else
4510	max_pixel_depth = `32`;
4511	}
4512
4513	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB \|\|
4514	png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
4515	{
4516	if (max_pixel_depth <= `32`)
4517	max_pixel_depth = `32`;
4518
4519	else
4520	max_pixel_depth = `64`;
4521	}
4522	}
4523	#endif
4524
4525	#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED
4526	if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != `0`)
4527	{
4528	if (
4529	#ifdef PNG_READ_EXPAND_SUPPORTED
4530	(png_ptr->num_trans != `0` &&
4531	(png_ptr->transformations & PNG_EXPAND) != `0`) \|\|
4532	#endif
4533	#ifdef PNG_READ_FILLER_SUPPORTED
4534	(png_ptr->transformations & (PNG_FILLER)) != `0` \|\|
4535	#endif
4536	png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
4537	{
4538	if (max_pixel_depth <= `16`)
4539	max_pixel_depth = `32`;
4540
4541	else
4542	max_pixel_depth = `64`;
4543	}
4544
4545	else
4546	{
4547	if (max_pixel_depth <= `8`)
4548	{
4549	if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4550	max_pixel_depth = `32`;
4551
4552	else
4553	max_pixel_depth = `24`;
4554	}
4555
4556	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
4557	max_pixel_depth = `64`;
4558
4559	else
4560	max_pixel_depth = `48`;
4561	}
4562	}
4563	#endif
4564
4565	#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
4566	defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
4567	if ((png_ptr->transformations & PNG_USER_TRANSFORM) != `0`)
4568	{
4569	unsigned int user_pixel_depth = png_ptr->user_transform_depth *
4570	png_ptr->user_transform_channels;
4571
4572	if (user_pixel_depth > max_pixel_depth)
4573	max_pixel_depth = user_pixel_depth;
4574	}
4575	#endif
4576
4577	/ This value is stored in png_struct and double checked in the row read*
4578	* code.
4579	*/
4580	png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth;
4581	png_ptr->transformed_pixel_depth = `0`; / calculated on demand /
4582
4583	/ Align the width on the next larger 8 pixels. Mainly used*
4584	* for interlacing
4585	*/
4586	row_bytes = ((png_ptr->width + `7`) & ~((png_uint_32)`7`));
4587	/ Calculate the maximum bytes needed, adding a byte and a pixel*
4588	* for safety's sake
4589	*/
4590	row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) +
4591	`1` + ((max_pixel_depth + `7`) >> `3U`);
4592
4593	#ifdef PNG_MAX_MALLOC_64K
4594	if (row_bytes > (png_uint_32)`65536L`)
4595	png_error(png_ptr, "This image requires a row greater than 64KB");
4596	#endif
4597
4598	if (row_bytes + `48` > png_ptr->old_big_row_buf_size)
4599	{
4600	png_free(png_ptr, png_ptr->big_row_buf);
4601	png_free(png_ptr, png_ptr->big_prev_row);
4602
4603	if (png_ptr->interlaced != `0`)
4604	png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr,
4605	row_bytes + `48`);
4606
4607	else
4608	png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + `48`);
4609
4610	png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + `48`);
4611
4612	#ifdef PNG_ALIGNED_MEMORY_SUPPORTED
4613	/ Use 16-byte aligned memory for row_buf with at least 16 bytes*
4614	* of padding before and after row_buf; treat prev_row similarly.
4615	* NOTE: the alignment is to the start of the pixels, one beyond the start
4616	* of the buffer, because of the filter byte. Prior to libpng 1.5.6 this
4617	* was incorrect; the filter byte was aligned, which had the exact
4618	* opposite effect of that intended.
4619	*/
4620	{
4621	png_bytep temp = png_ptr->big_row_buf + `32`;
4622	int extra = (int)((temp - (png_bytep)`0`) & `0x0f`);
4623	png_ptr->row_buf = temp - extra - `1`/filter byte/;
4624
4625	temp = png_ptr->big_prev_row + `32`;
4626	extra = (int)((temp - (png_bytep)`0`) & `0x0f`);
4627	png_ptr->prev_row = temp - extra - `1`/filter byte/;
4628	}
4629
4630	#else
4631	/ Use 31 bytes of padding before and 17 bytes after row_buf. /
4632	png_ptr->row_buf = png_ptr->big_row_buf + `31`;
4633	png_ptr->prev_row = png_ptr->big_prev_row + `31`;
4634	#endif
4635	png_ptr->old_big_row_buf_size = row_bytes + `48`;
4636	}
4637
4638	#ifdef PNG_MAX_MALLOC_64K
4639	if (png_ptr->rowbytes > `65535`)
4640	png_error(png_ptr, "This image requires a row greater than 64KB");
4641
4642	#endif
4643	if (png_ptr->rowbytes > (PNG_SIZE_MAX - `1`))
4644	png_error(png_ptr, "Row has too many bytes to allocate in memory");
4645
4646	memset(png_ptr->prev_row, `0`, png_ptr->rowbytes + `1`);
4647
4648	png_debug1(`3`, "width = %u,", png_ptr->width);
4649	png_debug1(`3`, "height = %u,", png_ptr->height);
4650	png_debug1(`3`, "iwidth = %u,", png_ptr->iwidth);
4651	png_debug1(`3`, "num_rows = %u,", png_ptr->num_rows);
4652	png_debug1(`3`, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes);
4653	png_debug1(`3`, "irowbytes = %lu",
4654	(unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + `1`);
4655
4656	/ The sequential reader needs a buffer for IDAT, but the progressive reader*
4657	* does not, so free the read buffer now regardless; the sequential reader
4658	* reallocates it on demand.
4659	*/
4660	if (png_ptr->read_buffer != NULL)
4661	{
4662	png_bytep buffer = png_ptr->read_buffer;
4663
4664	png_ptr->read_buffer_size = `0`;
4665	png_ptr->read_buffer = NULL;
4666	png_free(png_ptr, buffer);
4667	}
4668
4669	/ Finally claim the zstream for the inflate of the IDAT data, use the bits*
4670	* value from the stream (note that this will result in a fatal error if the
4671	* IDAT stream has a bogus deflate header window_bits value, but this should
4672	* not be happening any longer!)
4673	*/
4674	if (png_inflate_claim(png_ptr, png_IDAT) != Z_OK)
4675	png_error(png_ptr, png_ptr->zstream.msg);
4676
4677	png_ptr->flags \|= PNG_FLAG_ROW_INIT;
4678	}
4679	#endif /* READ */
4680

Browse the source code of TIC-80/vendor/libpng/pngrutil.c