[sql] Prevent nChildren overrun decoding interior pages in recover.c.
[chromium-blink-merge.git] / third_party / libpng / pngmem.c
bloba18719b81bbe2d4a0688eb0e92392295f1df66b7
2 /* pngmem.c - stub functions for memory allocation
4 * Last changed in libpng 1.2.41 [February 25, 2010]
5 * Copyright (c) 1998-2010 Glenn Randers-Pehrson
6 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
7 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
9 * This code is released under the libpng license.
10 * For conditions of distribution and use, see the disclaimer
11 * and license in png.h
13 * This file provides a location for all memory allocation. Users who
14 * need special memory handling are expected to supply replacement
15 * functions for png_malloc() and png_free(), and to use
16 * png_create_read_struct_2() and png_create_write_struct_2() to
17 * identify the replacement functions.
20 #define PNG_INTERNAL
21 #define PNG_NO_PEDANTIC_WARNINGS
22 #include "png.h"
23 #if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
25 /* Borland DOS special memory handler */
26 #if defined(__TURBOC__) && !defined(_Windows) && !defined(__FLAT__)
27 /* If you change this, be sure to change the one in png.h also */
29 /* Allocate memory for a png_struct. The malloc and memset can be replaced
30 by a single call to calloc() if this is thought to improve performance. */
31 png_voidp /* PRIVATE */
32 png_create_struct(int type)
34 #ifdef PNG_USER_MEM_SUPPORTED
35 return (png_create_struct_2(type, png_malloc_ptr_NULL, png_voidp_NULL));
38 /* Alternate version of png_create_struct, for use with user-defined malloc. */
39 png_voidp /* PRIVATE */
40 png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
42 #endif /* PNG_USER_MEM_SUPPORTED */
43 png_size_t size;
44 png_voidp struct_ptr;
46 if (type == PNG_STRUCT_INFO)
47 size = png_sizeof(png_info);
48 else if (type == PNG_STRUCT_PNG)
49 size = png_sizeof(png_struct);
50 else
51 return (png_get_copyright(NULL));
53 #ifdef PNG_USER_MEM_SUPPORTED
54 if (malloc_fn != NULL)
56 png_struct dummy_struct;
57 png_structp png_ptr = &dummy_struct;
58 png_ptr->mem_ptr=mem_ptr;
59 struct_ptr = (*(malloc_fn))(png_ptr, (png_uint_32)size);
61 else
62 #endif /* PNG_USER_MEM_SUPPORTED */
63 struct_ptr = (png_voidp)farmalloc(size);
64 if (struct_ptr != NULL)
65 png_memset(struct_ptr, 0, size);
66 return (struct_ptr);
69 /* Free memory allocated by a png_create_struct() call */
70 void /* PRIVATE */
71 png_destroy_struct(png_voidp struct_ptr)
73 #ifdef PNG_USER_MEM_SUPPORTED
74 png_destroy_struct_2(struct_ptr, png_free_ptr_NULL, png_voidp_NULL);
77 /* Free memory allocated by a png_create_struct() call */
78 void /* PRIVATE */
79 png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn,
80 png_voidp mem_ptr)
82 #endif
83 if (struct_ptr != NULL)
85 #ifdef PNG_USER_MEM_SUPPORTED
86 if (free_fn != NULL)
88 png_struct dummy_struct;
89 png_structp png_ptr = &dummy_struct;
90 png_ptr->mem_ptr=mem_ptr;
91 (*(free_fn))(png_ptr, struct_ptr);
92 return;
94 #endif /* PNG_USER_MEM_SUPPORTED */
95 farfree (struct_ptr);
99 /* Allocate memory. For reasonable files, size should never exceed
100 * 64K. However, zlib may allocate more then 64K if you don't tell
101 * it not to. See zconf.h and png.h for more information. zlib does
102 * need to allocate exactly 64K, so whatever you call here must
103 * have the ability to do that.
105 * Borland seems to have a problem in DOS mode for exactly 64K.
106 * It gives you a segment with an offset of 8 (perhaps to store its
107 * memory stuff). zlib doesn't like this at all, so we have to
108 * detect and deal with it. This code should not be needed in
109 * Windows or OS/2 modes, and only in 16 bit mode. This code has
110 * been updated by Alexander Lehmann for version 0.89 to waste less
111 * memory.
113 * Note that we can't use png_size_t for the "size" declaration,
114 * since on some systems a png_size_t is a 16-bit quantity, and as a
115 * result, we would be truncating potentially larger memory requests
116 * (which should cause a fatal error) and introducing major problems.
118 png_voidp /* PRIVATE */
119 png_calloc(png_structp png_ptr, png_uint_32 size)
121 png_voidp ret;
123 ret = (png_malloc(png_ptr, size));
124 if (ret != NULL)
125 png_memset(ret,0,(png_size_t)size);
126 return (ret);
129 png_voidp PNGAPI
130 png_malloc(png_structp png_ptr, png_uint_32 size)
132 png_voidp ret;
134 if (png_ptr == NULL || size == 0)
135 return (NULL);
137 #ifdef PNG_USER_MEM_SUPPORTED
138 if (png_ptr->malloc_fn != NULL)
139 ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
140 else
141 ret = (png_malloc_default(png_ptr, size));
142 if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
143 png_error(png_ptr, "Out of memory!");
144 return (ret);
147 png_voidp PNGAPI
148 png_malloc_default(png_structp png_ptr, png_uint_32 size)
150 png_voidp ret;
151 #endif /* PNG_USER_MEM_SUPPORTED */
153 if (png_ptr == NULL || size == 0)
154 return (NULL);
156 #ifdef PNG_MAX_MALLOC_64K
157 if (size > (png_uint_32)65536L)
159 png_warning(png_ptr, "Cannot Allocate > 64K");
160 ret = NULL;
162 else
163 #endif
165 if (size != (size_t)size)
166 ret = NULL;
167 else if (size == (png_uint_32)65536L)
169 if (png_ptr->offset_table == NULL)
171 /* Try to see if we need to do any of this fancy stuff */
172 ret = farmalloc(size);
173 if (ret == NULL || ((png_size_t)ret & 0xffff))
175 int num_blocks;
176 png_uint_32 total_size;
177 png_bytep table;
178 int i;
179 png_byte huge * hptr;
181 if (ret != NULL)
183 farfree(ret);
184 ret = NULL;
187 if (png_ptr->zlib_window_bits > 14)
188 num_blocks = (int)(1 << (png_ptr->zlib_window_bits - 14));
189 else
190 num_blocks = 1;
191 if (png_ptr->zlib_mem_level >= 7)
192 num_blocks += (int)(1 << (png_ptr->zlib_mem_level - 7));
193 else
194 num_blocks++;
196 total_size = ((png_uint_32)65536L) * (png_uint_32)num_blocks+16;
198 table = farmalloc(total_size);
200 if (table == NULL)
202 #ifndef PNG_USER_MEM_SUPPORTED
203 if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
204 png_error(png_ptr, "Out Of Memory."); /* Note "O", "M" */
205 else
206 png_warning(png_ptr, "Out Of Memory.");
207 #endif
208 return (NULL);
211 if ((png_size_t)table & 0xfff0)
213 #ifndef PNG_USER_MEM_SUPPORTED
214 if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
215 png_error(png_ptr,
216 "Farmalloc didn't return normalized pointer");
217 else
218 png_warning(png_ptr,
219 "Farmalloc didn't return normalized pointer");
220 #endif
221 return (NULL);
224 png_ptr->offset_table = table;
225 png_ptr->offset_table_ptr = farmalloc(num_blocks *
226 png_sizeof(png_bytep));
228 if (png_ptr->offset_table_ptr == NULL)
230 #ifndef PNG_USER_MEM_SUPPORTED
231 if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
232 png_error(png_ptr, "Out Of memory."); /* Note "O", "m" */
233 else
234 png_warning(png_ptr, "Out Of memory.");
235 #endif
236 return (NULL);
239 hptr = (png_byte huge *)table;
240 if ((png_size_t)hptr & 0xf)
242 hptr = (png_byte huge *)((long)(hptr) & 0xfffffff0L);
243 hptr = hptr + 16L; /* "hptr += 16L" fails on Turbo C++ 3.0 */
245 for (i = 0; i < num_blocks; i++)
247 png_ptr->offset_table_ptr[i] = (png_bytep)hptr;
248 hptr = hptr + (png_uint_32)65536L; /* "+=" fails on TC++3.0 */
251 png_ptr->offset_table_number = num_blocks;
252 png_ptr->offset_table_count = 0;
253 png_ptr->offset_table_count_free = 0;
257 if (png_ptr->offset_table_count >= png_ptr->offset_table_number)
259 #ifndef PNG_USER_MEM_SUPPORTED
260 if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
261 png_error(png_ptr, "Out of Memory."); /* Note "o" and "M" */
262 else
263 png_warning(png_ptr, "Out of Memory.");
264 #endif
265 return (NULL);
268 ret = png_ptr->offset_table_ptr[png_ptr->offset_table_count++];
270 else
271 ret = farmalloc(size);
273 #ifndef PNG_USER_MEM_SUPPORTED
274 if (ret == NULL)
276 if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
277 png_error(png_ptr, "Out of memory."); /* Note "o" and "m" */
278 else
279 png_warning(png_ptr, "Out of memory."); /* Note "o" and "m" */
281 #endif
283 return (ret);
286 /* Free a pointer allocated by png_malloc(). In the default
287 * configuration, png_ptr is not used, but is passed in case it
288 * is needed. If ptr is NULL, return without taking any action.
290 void PNGAPI
291 png_free(png_structp png_ptr, png_voidp ptr)
293 if (png_ptr == NULL || ptr == NULL)
294 return;
296 #ifdef PNG_USER_MEM_SUPPORTED
297 if (png_ptr->free_fn != NULL)
299 (*(png_ptr->free_fn))(png_ptr, ptr);
300 return;
302 else
303 png_free_default(png_ptr, ptr);
306 void PNGAPI
307 png_free_default(png_structp png_ptr, png_voidp ptr)
309 #endif /* PNG_USER_MEM_SUPPORTED */
311 if (png_ptr == NULL || ptr == NULL)
312 return;
314 if (png_ptr->offset_table != NULL)
316 int i;
318 for (i = 0; i < png_ptr->offset_table_count; i++)
320 if (ptr == png_ptr->offset_table_ptr[i])
322 ptr = NULL;
323 png_ptr->offset_table_count_free++;
324 break;
327 if (png_ptr->offset_table_count_free == png_ptr->offset_table_count)
329 farfree(png_ptr->offset_table);
330 farfree(png_ptr->offset_table_ptr);
331 png_ptr->offset_table = NULL;
332 png_ptr->offset_table_ptr = NULL;
336 if (ptr != NULL)
338 farfree(ptr);
342 #else /* Not the Borland DOS special memory handler */
344 /* Allocate memory for a png_struct or a png_info. The malloc and
345 memset can be replaced by a single call to calloc() if this is thought
346 to improve performance noticably. */
347 png_voidp /* PRIVATE */
348 png_create_struct(int type)
350 #ifdef PNG_USER_MEM_SUPPORTED
351 return (png_create_struct_2(type, png_malloc_ptr_NULL, png_voidp_NULL));
354 /* Allocate memory for a png_struct or a png_info. The malloc and
355 memset can be replaced by a single call to calloc() if this is thought
356 to improve performance noticably. */
357 png_voidp /* PRIVATE */
358 png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr)
360 #endif /* PNG_USER_MEM_SUPPORTED */
361 png_size_t size;
362 png_voidp struct_ptr;
364 if (type == PNG_STRUCT_INFO)
365 size = png_sizeof(png_info);
366 else if (type == PNG_STRUCT_PNG)
367 size = png_sizeof(png_struct);
368 else
369 return (NULL);
371 #ifdef PNG_USER_MEM_SUPPORTED
372 if (malloc_fn != NULL)
374 png_struct dummy_struct;
375 png_structp png_ptr = &dummy_struct;
376 png_ptr->mem_ptr=mem_ptr;
377 struct_ptr = (*(malloc_fn))(png_ptr, size);
378 if (struct_ptr != NULL)
379 png_memset(struct_ptr, 0, size);
380 return (struct_ptr);
382 #endif /* PNG_USER_MEM_SUPPORTED */
384 #if defined(__TURBOC__) && !defined(__FLAT__)
385 struct_ptr = (png_voidp)farmalloc(size);
386 #else
387 # if defined(_MSC_VER) && defined(MAXSEG_64K)
388 struct_ptr = (png_voidp)halloc(size, 1);
389 # else
390 struct_ptr = (png_voidp)malloc(size);
391 # endif
392 #endif
393 if (struct_ptr != NULL)
394 png_memset(struct_ptr, 0, size);
396 return (struct_ptr);
400 /* Free memory allocated by a png_create_struct() call */
401 void /* PRIVATE */
402 png_destroy_struct(png_voidp struct_ptr)
404 #ifdef PNG_USER_MEM_SUPPORTED
405 png_destroy_struct_2(struct_ptr, png_free_ptr_NULL, png_voidp_NULL);
408 /* Free memory allocated by a png_create_struct() call */
409 void /* PRIVATE */
410 png_destroy_struct_2(png_voidp struct_ptr, png_free_ptr free_fn,
411 png_voidp mem_ptr)
413 #endif /* PNG_USER_MEM_SUPPORTED */
414 if (struct_ptr != NULL)
416 #ifdef PNG_USER_MEM_SUPPORTED
417 if (free_fn != NULL)
419 png_struct dummy_struct;
420 png_structp png_ptr = &dummy_struct;
421 png_ptr->mem_ptr=mem_ptr;
422 (*(free_fn))(png_ptr, struct_ptr);
423 return;
425 #endif /* PNG_USER_MEM_SUPPORTED */
426 #if defined(__TURBOC__) && !defined(__FLAT__)
427 farfree(struct_ptr);
428 #else
429 # if defined(_MSC_VER) && defined(MAXSEG_64K)
430 hfree(struct_ptr);
431 # else
432 free(struct_ptr);
433 # endif
434 #endif
438 /* Allocate memory. For reasonable files, size should never exceed
439 * 64K. However, zlib may allocate more then 64K if you don't tell
440 * it not to. See zconf.h and png.h for more information. zlib does
441 * need to allocate exactly 64K, so whatever you call here must
442 * have the ability to do that.
445 png_voidp /* PRIVATE */
446 png_calloc(png_structp png_ptr, png_uint_32 size)
448 png_voidp ret;
450 ret = (png_malloc(png_ptr, size));
451 if (ret != NULL)
452 png_memset(ret,0,(png_size_t)size);
453 return (ret);
456 png_voidp PNGAPI
457 png_malloc(png_structp png_ptr, png_uint_32 size)
459 png_voidp ret;
461 #ifdef PNG_USER_MEM_SUPPORTED
462 if (png_ptr == NULL || size == 0)
463 return (NULL);
465 if (png_ptr->malloc_fn != NULL)
466 ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size));
467 else
468 ret = (png_malloc_default(png_ptr, size));
469 if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
470 png_error(png_ptr, "Out of Memory!");
471 return (ret);
474 png_voidp PNGAPI
475 png_malloc_default(png_structp png_ptr, png_uint_32 size)
477 png_voidp ret;
478 #endif /* PNG_USER_MEM_SUPPORTED */
480 if (png_ptr == NULL || size == 0)
481 return (NULL);
483 #ifdef PNG_MAX_MALLOC_64K
484 if (size > (png_uint_32)65536L)
486 #ifndef PNG_USER_MEM_SUPPORTED
487 if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
488 png_error(png_ptr, "Cannot Allocate > 64K");
489 else
490 #endif
491 return NULL;
493 #endif
495 /* Check for overflow */
496 #if defined(__TURBOC__) && !defined(__FLAT__)
497 if (size != (unsigned long)size)
498 ret = NULL;
499 else
500 ret = farmalloc(size);
501 #else
502 # if defined(_MSC_VER) && defined(MAXSEG_64K)
503 if (size != (unsigned long)size)
504 ret = NULL;
505 else
506 ret = halloc(size, 1);
507 # else
508 if (size != (size_t)size)
509 ret = NULL;
510 else
511 ret = malloc((size_t)size);
512 # endif
513 #endif
515 #ifndef PNG_USER_MEM_SUPPORTED
516 if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0)
517 png_error(png_ptr, "Out of Memory");
518 #endif
520 return (ret);
523 /* Free a pointer allocated by png_malloc(). If ptr is NULL, return
524 * without taking any action.
526 void PNGAPI
527 png_free(png_structp png_ptr, png_voidp ptr)
529 if (png_ptr == NULL || ptr == NULL)
530 return;
532 #ifdef PNG_USER_MEM_SUPPORTED
533 if (png_ptr->free_fn != NULL)
535 (*(png_ptr->free_fn))(png_ptr, ptr);
536 return;
538 else
539 png_free_default(png_ptr, ptr);
541 void PNGAPI
542 png_free_default(png_structp png_ptr, png_voidp ptr)
544 if (png_ptr == NULL || ptr == NULL)
545 return;
547 #endif /* PNG_USER_MEM_SUPPORTED */
549 #if defined(__TURBOC__) && !defined(__FLAT__)
550 farfree(ptr);
551 #else
552 # if defined(_MSC_VER) && defined(MAXSEG_64K)
553 hfree(ptr);
554 # else
555 free(ptr);
556 # endif
557 #endif
560 #endif /* Not Borland DOS special memory handler */
562 #ifdef PNG_1_0_X
563 # define png_malloc_warn png_malloc
564 #else
565 /* This function was added at libpng version 1.2.3. The png_malloc_warn()
566 * function will set up png_malloc() to issue a png_warning and return NULL
567 * instead of issuing a png_error, if it fails to allocate the requested
568 * memory.
570 png_voidp PNGAPI
571 png_malloc_warn(png_structp png_ptr, png_uint_32 size)
573 png_voidp ptr;
574 png_uint_32 save_flags;
575 if (png_ptr == NULL)
576 return (NULL);
578 save_flags = png_ptr->flags;
579 png_ptr->flags|=PNG_FLAG_MALLOC_NULL_MEM_OK;
580 ptr = (png_voidp)png_malloc((png_structp)png_ptr, size);
581 png_ptr->flags=save_flags;
582 return(ptr);
584 #endif
586 png_voidp PNGAPI
587 png_memcpy_check (png_structp png_ptr, png_voidp s1, png_voidp s2,
588 png_uint_32 length)
590 png_size_t size;
592 size = (png_size_t)length;
593 if ((png_uint_32)size != length)
594 png_error(png_ptr, "Overflow in png_memcpy_check.");
596 return(png_memcpy (s1, s2, size));
599 png_voidp PNGAPI
600 png_memset_check (png_structp png_ptr, png_voidp s1, int value,
601 png_uint_32 length)
603 png_size_t size;
605 size = (png_size_t)length;
606 if ((png_uint_32)size != length)
607 png_error(png_ptr, "Overflow in png_memset_check.");
609 return (png_memset (s1, value, size));
613 #ifdef PNG_USER_MEM_SUPPORTED
614 /* This function is called when the application wants to use another method
615 * of allocating and freeing memory.
617 void PNGAPI
618 png_set_mem_fn(png_structp png_ptr, png_voidp mem_ptr, png_malloc_ptr
619 malloc_fn, png_free_ptr free_fn)
621 if (png_ptr != NULL)
623 png_ptr->mem_ptr = mem_ptr;
624 png_ptr->malloc_fn = malloc_fn;
625 png_ptr->free_fn = free_fn;
629 /* This function returns a pointer to the mem_ptr associated with the user
630 * functions. The application should free any memory associated with this
631 * pointer before png_write_destroy and png_read_destroy are called.
633 png_voidp PNGAPI
634 png_get_mem_ptr(png_structp png_ptr)
636 if (png_ptr == NULL)
637 return (NULL);
638 return ((png_voidp)png_ptr->mem_ptr);
640 #endif /* PNG_USER_MEM_SUPPORTED */
641 #endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */