aboutsummaryrefslogtreecommitdiff
path: root/pngrutil.c
diff options
context:
space:
mode:
Diffstat (limited to 'pngrutil.c')
-rw-r--r--pngrutil.c144
1 files changed, 82 insertions, 62 deletions
diff --git a/pngrutil.c b/pngrutil.c
index 8692933bd..068ab193a 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1,10 +1,10 @@
/* pngrutil.c - utilities to read a PNG file
*
- * Last changed in libpng 1.6.33 [September 28, 2017]
- * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson
- * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
- * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
+ * Copyright (c) 2018-2022 Cosmin Truta
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
+ * Copyright (c) 1996-1997 Andreas Dilger
+ * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
*
* This code is released under the libpng license.
* For conditions of distribution and use, see the disclaimer
@@ -102,7 +102,7 @@ png_get_int_32)(png_const_bytep buf)
png_uint_16 (PNGAPI
png_get_uint_16)(png_const_bytep buf)
{
- /* ANSI-C requires an int value to accomodate at least 16 bits so this
+ /* ANSI-C requires an int value to accommodate at least 16 bits so this
* works and allows the compiler not to worry about possible narrowing
* on 32-bit systems. (Pre-ANSI systems did not make integers smaller
* than 16 bits either.)
@@ -120,7 +120,7 @@ png_get_uint_16)(png_const_bytep buf)
void /* PRIVATE */
png_read_sig(png_structrp png_ptr, png_inforp info_ptr)
{
- png_size_t num_checked, num_to_check;
+ size_t num_checked, num_to_check;
/* Exit if the user application does not expect a signature. */
if (png_ptr->sig_bytes >= 8)
@@ -302,7 +302,6 @@ png_read_buffer(png_structrp png_ptr, png_alloc_size_t new_size, int warn)
if (buffer != NULL && new_size > png_ptr->read_buffer_size)
{
png_ptr->read_buffer = NULL;
- png_ptr->read_buffer = NULL;
png_ptr->read_buffer_size = 0;
png_free(png_ptr, buffer);
buffer = NULL;
@@ -1461,8 +1460,7 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
{
/* We have the ICC profile header; do the basic header checks.
*/
- const png_uint_32 profile_length =
- png_get_uint_32(profile_header);
+ png_uint_32 profile_length = png_get_uint_32(profile_header);
if (png_icc_check_length(png_ptr, &png_ptr->colorspace,
keyword, profile_length) != 0)
@@ -1479,8 +1477,8 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
* profile. The header check has already validated
* that none of this stuff will overflow.
*/
- const png_uint_32 tag_count = png_get_uint_32(
- profile_header+128);
+ png_uint_32 tag_count =
+ png_get_uint_32(profile_header + 128);
png_bytep profile = png_read_buffer(png_ptr,
profile_length, 2/*silent*/);
@@ -1648,7 +1646,7 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
int entry_size, i;
png_uint_32 skip = 0;
png_uint_32 dl;
- png_size_t max_dl;
+ size_t max_dl;
png_debug(1, "in png_handle_sPLT");
@@ -1997,6 +1995,15 @@ png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) /* GRAY */
{
+ if (png_ptr->bit_depth <= 8)
+ {
+ if (buf[0] != 0 || buf[1] >= (unsigned int)(1 << png_ptr->bit_depth))
+ {
+ png_chunk_benign_error(png_ptr, "invalid gray level");
+ return;
+ }
+ }
+
background.index = 0;
background.red =
background.green =
@@ -2006,6 +2013,15 @@ png_handle_bKGD(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
else
{
+ if (png_ptr->bit_depth <= 8)
+ {
+ if (buf[0] != 0 || buf[2] != 0 || buf[4] != 0)
+ {
+ png_chunk_benign_error(png_ptr, "invalid color");
+ return;
+ }
+ }
+
background.index = 0;
background.red = png_get_uint_16(buf);
background.green = png_get_uint_16(buf + 2);
@@ -2059,21 +2075,22 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
png_byte buf[1];
png_crc_read(png_ptr, buf, 1);
info_ptr->eXIf_buf[i] = buf[0];
- if (i == 1 && buf[0] != 'M' && buf[0] != 'I'
- && info_ptr->eXIf_buf[0] != buf[0])
+ if (i == 1)
{
- png_crc_finish(png_ptr, length);
- png_chunk_benign_error(png_ptr, "incorrect byte-order specifier");
- png_free(png_ptr, info_ptr->eXIf_buf);
- info_ptr->eXIf_buf = NULL;
- return;
+ if ((buf[0] != 'M' && buf[0] != 'I') ||
+ (info_ptr->eXIf_buf[0] != buf[0]))
+ {
+ png_crc_finish(png_ptr, length - 2);
+ png_chunk_benign_error(png_ptr, "incorrect byte-order specifier");
+ png_free(png_ptr, info_ptr->eXIf_buf);
+ info_ptr->eXIf_buf = NULL;
+ return;
+ }
}
}
- if (png_crc_finish(png_ptr, 0) != 0)
- return;
-
- png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
+ if (png_crc_finish(png_ptr, 0) == 0)
+ png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
png_free(png_ptr, info_ptr->eXIf_buf);
info_ptr->eXIf_buf = NULL;
@@ -2109,8 +2126,9 @@ png_handle_hIST(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
num = length / 2 ;
- if (num != (unsigned int) png_ptr->num_palette ||
- num > (unsigned int) PNG_MAX_PALETTE_LENGTH)
+ if (length != num * 2 ||
+ num != (unsigned int)png_ptr->num_palette ||
+ num > (unsigned int)PNG_MAX_PALETTE_LENGTH)
{
png_crc_finish(png_ptr, length);
png_chunk_benign_error(png_ptr, "invalid");
@@ -2359,7 +2377,7 @@ void /* PRIVATE */
png_handle_sCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
{
png_bytep buffer;
- png_size_t i;
+ size_t i;
int state;
png_debug(1, "in png_handle_sCAL");
@@ -2429,7 +2447,7 @@ png_handle_sCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
else
{
- png_size_t heighti = i;
+ size_t heighti = i;
state = 0;
if (png_check_fp_number((png_const_charp)buffer, length,
@@ -2867,7 +2885,7 @@ png_cache_unknown_chunk(png_structrp png_ptr, png_uint_32 length)
{
PNG_CSTRING_FROM_CHUNK(png_ptr->unknown_chunk.name, png_ptr->chunk_name);
/* The following is safe because of the PNG_SIZE_MAX init above */
- png_ptr->unknown_chunk.size = (png_size_t)length/*SAFE*/;
+ png_ptr->unknown_chunk.size = (size_t)length/*SAFE*/;
/* 'mode' is a flag array, only the bottom four bits matter here */
png_ptr->unknown_chunk.location = (png_byte)png_ptr->mode/*SAFE*/;
@@ -3114,7 +3132,7 @@ png_handle_unknown(png_structrp png_ptr, png_inforp info_ptr,
*/
void /* PRIVATE */
-png_check_chunk_name(png_const_structrp png_ptr, const png_uint_32 chunk_name)
+png_check_chunk_name(png_const_structrp png_ptr, png_uint_32 chunk_name)
{
int i;
png_uint_32 cn=chunk_name;
@@ -3133,7 +3151,7 @@ png_check_chunk_name(png_const_structrp png_ptr, const png_uint_32 chunk_name)
}
void /* PRIVATE */
-png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
+png_check_chunk_length(png_const_structrp png_ptr, png_uint_32 length)
{
png_alloc_size_t limit = PNG_UINT_31_MAX;
@@ -3149,10 +3167,13 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
{
png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
size_t row_factor =
- (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
- + 1 + (png_ptr->interlaced? 6: 0));
+ (size_t)png_ptr->width
+ * (size_t)png_ptr->channels
+ * (png_ptr->bit_depth > 8? 2: 1)
+ + 1
+ + (png_ptr->interlaced? 6: 0);
if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
- idat_limit=PNG_UINT_31_MAX;
+ idat_limit = PNG_UINT_31_MAX;
else
idat_limit = png_ptr->height * row_factor;
row_factor = row_factor > 32566? 32566 : row_factor;
@@ -3165,7 +3186,7 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
{
png_debug2(0," length = %lu, limit = %lu",
(unsigned long)length,(unsigned long)limit);
- png_chunk_error(png_ptr, "chunk data is too large");
+ png_benign_error(png_ptr, "chunk data is too large");
}
}
@@ -3342,7 +3363,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
/* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and
* then pass:
*/
- static PNG_CONST png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] =
+ static const png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] =
{
/* Little-endian byte masks for PACKSWAP */
{ S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) },
@@ -3353,7 +3374,7 @@ png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
/* display_mask has only three entries for the odd passes, so index by
* pass>>1.
*/
- static PNG_CONST png_uint_32 display_mask[2][3][3] =
+ static const png_uint_32 display_mask[2][3][3] =
{
/* Little-endian byte masks for PACKSWAP */
{ B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) },
@@ -3666,7 +3687,7 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
{
/* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
/* Offset to next interlace block */
- static PNG_CONST unsigned int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
+ static const unsigned int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
png_debug(1, "in png_do_read_interlace");
if (row != NULL && row_info != NULL)
@@ -3679,8 +3700,8 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
{
case 1:
{
- png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 3);
- png_bytep dp = row + (png_size_t)((final_width - 1) >> 3);
+ png_bytep sp = row + (size_t)((row_info->width - 1) >> 3);
+ png_bytep dp = row + (size_t)((final_width - 1) >> 3);
unsigned int sshift, dshift;
unsigned int s_start, s_end;
int s_inc;
@@ -3806,8 +3827,8 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
case 4:
{
- png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 1);
- png_bytep dp = row + (png_size_t)((final_width - 1) >> 1);
+ png_bytep sp = row + (size_t)((row_info->width - 1) >> 1);
+ png_bytep dp = row + (size_t)((final_width - 1) >> 1);
unsigned int sshift, dshift;
unsigned int s_start, s_end;
int s_inc;
@@ -3869,12 +3890,12 @@ png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
default:
{
- png_size_t pixel_bytes = (row_info->pixel_depth >> 3);
+ size_t pixel_bytes = (row_info->pixel_depth >> 3);
- png_bytep sp = row + (png_size_t)(row_info->width - 1)
+ png_bytep sp = row + (size_t)(row_info->width - 1)
* pixel_bytes;
- png_bytep dp = row + (png_size_t)(final_width - 1) * pixel_bytes;
+ png_bytep dp = row + (size_t)(final_width - 1) * pixel_bytes;
int jstop = (int)png_pass_inc[pass];
png_uint_32 i;
@@ -3911,8 +3932,8 @@ static void
png_read_filter_row_sub(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
- png_size_t i;
- png_size_t istop = row_info->rowbytes;
+ size_t i;
+ size_t istop = row_info->rowbytes;
unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
png_bytep rp = row + bpp;
@@ -3929,8 +3950,8 @@ static void
png_read_filter_row_up(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
- png_size_t i;
- png_size_t istop = row_info->rowbytes;
+ size_t i;
+ size_t istop = row_info->rowbytes;
png_bytep rp = row;
png_const_bytep pp = prev_row;
@@ -3945,11 +3966,11 @@ static void
png_read_filter_row_avg(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
- png_size_t i;
+ size_t i;
png_bytep rp = row;
png_const_bytep pp = prev_row;
unsigned int bpp = (row_info->pixel_depth + 7) >> 3;
- png_size_t istop = row_info->rowbytes - bpp;
+ size_t istop = row_info->rowbytes - bpp;
for (i = 0; i < bpp; i++)
{
@@ -4308,16 +4329,16 @@ png_read_finish_row(png_structrp png_ptr)
/* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
/* Start of interlace block */
- static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
+ static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
/* Offset to next interlace block */
- static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
+ static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
/* Start of interlace block in the y direction */
- static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
+ static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
/* Offset to next interlace block in the y direction */
- static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
+ static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
png_debug(1, "in png_read_finish_row");
png_ptr->row_number++;
@@ -4373,19 +4394,19 @@ png_read_start_row(png_structrp png_ptr)
/* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
/* Start of interlace block */
- static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
+ static const png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
/* Offset to next interlace block */
- static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
+ static const png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
/* Start of interlace block in the y direction */
- static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
+ static const png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
/* Offset to next interlace block in the y direction */
- static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
+ static const png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
unsigned int max_pixel_depth;
- png_size_t row_bytes;
+ size_t row_bytes;
png_debug(1, "in png_read_start_row");
@@ -4601,14 +4622,13 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
*/
{
png_bytep temp = png_ptr->big_row_buf + 32;
- int extra = (int)((temp - (png_bytep)0) & 0x0f);
+ size_t extra = (size_t)temp & 0x0f;
png_ptr->row_buf = temp - extra - 1/*filter byte*/;
temp = png_ptr->big_prev_row + 32;
- extra = (int)((temp - (png_bytep)0) & 0x0f);
+ extra = (size_t)temp & 0x0f;
png_ptr->prev_row = temp - extra - 1/*filter byte*/;
}
-
#else
/* Use 31 bytes of padding before and 17 bytes after row_buf. */
png_ptr->row_buf = png_ptr->big_row_buf + 31;
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-21 02:51:40 +0000