image/decoders/nsPNGDecoder.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  *
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "ImageLogging.h"  // Must appear first
   8 #include "nsPNGDecoder.h"
   9
  10 #include <algorithm>
  11 #include <cstdint>
  12
  13 #include "gfxColor.h"
  14 #include "gfxPlatform.h"
  15 #include "imgFrame.h"
  16 #include "nsColor.h"
  17 #include "nsRect.h"
  18 #include "nspr.h"
  19 #include "png.h"
  20
  21 #include "RasterImage.h"
  22 #include "SurfaceCache.h"
  23 #include "SurfacePipeFactory.h"
  24 #include "mozilla/DebugOnly.h"
  25 #include "mozilla/Telemetry.h"
  26
  27 using namespace mozilla::gfx;
  28
  29 using std::min;
  30
  31 namespace mozilla {
  32 namespace image {
  33
  34 static LazyLogModule sPNGLog("PNGDecoder");
  35 static LazyLogModule sPNGDecoderAccountingLog("PNGDecoderAccounting");
  36
  37 // limit image dimensions (bug #251381, #591822, #967656, and #1283961)
  38 #ifndef MOZ_PNG_MAX_WIDTH
  39 #  define MOZ_PNG_MAX_WIDTH 0x7fffffff  // Unlimited
  40 #endif
  41 #ifndef MOZ_PNG_MAX_HEIGHT
  42 #  define MOZ_PNG_MAX_HEIGHT 0x7fffffff  // Unlimited
  43 #endif
  44
  45 /* Controls the maximum chunk size configuration for libpng. We set this to a
  46  * very large number, 256MB specifically. */
  47 static constexpr png_alloc_size_t kPngMaxChunkSize = 0x10000000;
  48
  49 nsPNGDecoder::AnimFrameInfo::AnimFrameInfo()
  50     : mDispose(DisposalMethod::KEEP), mBlend(BlendMethod::OVER), mTimeout(0) {}
  51
  52 #ifdef PNG_APNG_SUPPORTED
  53
  54 int32_t GetNextFrameDelay(png_structp aPNG, png_infop aInfo) {
  55   // Delay, in seconds, is delayNum / delayDen.
  56   png_uint_16 delayNum = png_get_next_frame_delay_num(aPNG, aInfo);
  57   png_uint_16 delayDen = png_get_next_frame_delay_den(aPNG, aInfo);
  58
  59   if (delayNum == 0) {
  60     return 0;  // SetFrameTimeout() will set to a minimum.
  61   }
  62
  63   if (delayDen == 0) {
  64     delayDen = 100;  // So says the APNG spec.
  65   }
  66
  67   // Need to cast delay_num to float to have a proper division and
  68   // the result to int to avoid a compiler warning.
  69   return static_cast<int32_t>(static_cast<double>(delayNum) * 1000 / delayDen);
  70 }
  71
  72 nsPNGDecoder::AnimFrameInfo::AnimFrameInfo(png_structp aPNG, png_infop aInfo)
  73     : mDispose(DisposalMethod::KEEP), mBlend(BlendMethod::OVER), mTimeout(0) {
  74   png_byte dispose_op = png_get_next_frame_dispose_op(aPNG, aInfo);
  75   png_byte blend_op = png_get_next_frame_blend_op(aPNG, aInfo);
  76
  77   if (dispose_op == PNG_DISPOSE_OP_PREVIOUS) {
  78     mDispose = DisposalMethod::RESTORE_PREVIOUS;
  79   } else if (dispose_op == PNG_DISPOSE_OP_BACKGROUND) {
  80     mDispose = DisposalMethod::CLEAR;
  81   } else {
  82     mDispose = DisposalMethod::KEEP;
  83   }
  84
  85   if (blend_op == PNG_BLEND_OP_SOURCE) {
  86     mBlend = BlendMethod::SOURCE;
  87   } else {
  88     mBlend = BlendMethod::OVER;
  89   }
  90
  91   mTimeout = GetNextFrameDelay(aPNG, aInfo);
  92 }
  93 #endif
  94
  95 // First 8 bytes of a PNG file
  96 const uint8_t nsPNGDecoder::pngSignatureBytes[] = {137, 80, 78, 71,
  97                                                    13,  10, 26, 10};
  98
  99 nsPNGDecoder::nsPNGDecoder(RasterImage* aImage)
 100     : Decoder(aImage),
 101       mLexer(Transition::ToUnbuffered(State::FINISHED_PNG_DATA, State::PNG_DATA,
 102                                       SIZE_MAX),
 103              Transition::TerminateSuccess()),
 104       mNextTransition(Transition::ContinueUnbuffered(State::PNG_DATA)),
 105       mLastChunkLength(0),
 106       mPNG(nullptr),
 107       mInfo(nullptr),
 108       mCMSLine(nullptr),
 109       interlacebuf(nullptr),
 110       mFormat(SurfaceFormat::UNKNOWN),
 111       mChannels(0),
 112       mPass(0),
 113       mFrameIsHidden(false),
 114       mDisablePremultipliedAlpha(false),
 115       mGotInfoCallback(false),
 116       mUsePipeTransform(false),
 117       mErrorIsRecoverable(false),
 118       mNumFrames(0) {}
 119
 120 nsPNGDecoder::~nsPNGDecoder() {
 121   if (mPNG) {
 122     png_destroy_read_struct(&mPNG, mInfo ? &mInfo : nullptr, nullptr);
 123   }
 124   if (mCMSLine) {
 125     free(mCMSLine);
 126   }
 127   if (interlacebuf) {
 128     free(interlacebuf);
 129   }
 130 }
 131
 132 nsPNGDecoder::TransparencyType nsPNGDecoder::GetTransparencyType(
 133     const OrientedIntRect& aFrameRect) {
 134   // Check if the image has a transparent color in its palette.
 135   if (HasAlphaChannel()) {
 136     return TransparencyType::eAlpha;
 137   }
 138   if (!aFrameRect.IsEqualEdges(FullFrame())) {
 139     MOZ_ASSERT(HasAnimation());
 140     return TransparencyType::eFrameRect;
 141   }
 142
 143   return TransparencyType::eNone;
 144 }
 145
 146 void nsPNGDecoder::PostHasTransparencyIfNeeded(
 147     TransparencyType aTransparencyType) {
 148   switch (aTransparencyType) {
 149     case TransparencyType::eNone:
 150       return;
 151
 152     case TransparencyType::eAlpha:
 153       PostHasTransparency();
 154       return;
 155
 156     case TransparencyType::eFrameRect:
 157       // If the first frame of animated image doesn't draw into the whole image,
 158       // then record that it is transparent. For subsequent frames, this doesn't
 159       // affect transparency, because they're composited on top of all previous
 160       // frames.
 161       if (mNumFrames == 0) {
 162         PostHasTransparency();
 163       }
 164       return;
 165   }
 166 }
 167
 168 // CreateFrame() is used for both simple and animated images.
 169 nsresult nsPNGDecoder::CreateFrame(const FrameInfo& aFrameInfo) {
 170   MOZ_ASSERT(HasSize());
 171   MOZ_ASSERT(!IsMetadataDecode());
 172
 173   // Check if we have transparency, and send notifications if needed.
 174   auto transparency = GetTransparencyType(aFrameInfo.mFrameRect);
 175   PostHasTransparencyIfNeeded(transparency);
 176   mFormat = transparency == TransparencyType::eNone ? SurfaceFormat::OS_RGBX
 177                                                     : SurfaceFormat::OS_RGBA;
 178
 179   // Make sure there's no animation or padding if we're downscaling.
 180   MOZ_ASSERT_IF(Size() != OutputSize(), mNumFrames == 0);
 181   MOZ_ASSERT_IF(Size() != OutputSize(), !GetImageMetadata().HasAnimation());
 182   MOZ_ASSERT_IF(Size() != OutputSize(),
 183                 transparency != TransparencyType::eFrameRect);
 184
 185   Maybe<AnimationParams> animParams;
 186 #ifdef PNG_APNG_SUPPORTED
 187   if (!IsFirstFrameDecode() && png_get_valid(mPNG, mInfo, PNG_INFO_acTL)) {
 188     mAnimInfo = AnimFrameInfo(mPNG, mInfo);
 189
 190     if (mAnimInfo.mDispose == DisposalMethod::CLEAR) {
 191       // We may have to display the background under this image during
 192       // animation playback, so we regard it as transparent.
 193       PostHasTransparency();
 194     }
 195
 196     animParams.emplace(
 197         AnimationParams{aFrameInfo.mFrameRect.ToUnknownRect(),
 198                         FrameTimeout::FromRawMilliseconds(mAnimInfo.mTimeout),
 199                         mNumFrames, mAnimInfo.mBlend, mAnimInfo.mDispose});
 200   }
 201 #endif
 202
 203   // If this image is interlaced, we can display better quality intermediate
 204   // results to the user by post processing them with ADAM7InterpolatingFilter.
 205   SurfacePipeFlags pipeFlags = aFrameInfo.mIsInterlaced
 206                                    ? SurfacePipeFlags::ADAM7_INTERPOLATE
 207                                    : SurfacePipeFlags();
 208
 209   if (mNumFrames == 0) {
 210     // The first frame may be displayed progressively.
 211     pipeFlags |= SurfacePipeFlags::PROGRESSIVE_DISPLAY;
 212   }
 213
 214   SurfaceFormat inFormat;
 215   if (mTransform && !mUsePipeTransform) {
 216     // QCMS will output in the correct format.
 217     inFormat = mFormat;
 218   } else if (transparency == TransparencyType::eAlpha) {
 219     // We are outputting directly as RGBA, so we need to swap at this step.
 220     inFormat = SurfaceFormat::R8G8B8A8;
 221   } else {
 222     // We have no alpha channel, so we need to unpack from RGB to BGRA.
 223     inFormat = SurfaceFormat::R8G8B8;
 224   }
 225
 226   // Only apply premultiplication if the frame has true alpha. If we ever
 227   // support downscaling animated images, we will need to premultiply for frame
 228   // rect transparency when downscaling as well.
 229   if (transparency == TransparencyType::eAlpha && !mDisablePremultipliedAlpha) {
 230     pipeFlags |= SurfacePipeFlags::PREMULTIPLY_ALPHA;
 231   }
 232
 233   qcms_transform* pipeTransform = mUsePipeTransform ? mTransform : nullptr;
 234   Maybe<SurfacePipe> pipe = SurfacePipeFactory::CreateSurfacePipe(
 235       this, Size(), OutputSize(), aFrameInfo.mFrameRect, inFormat, mFormat,
 236       animParams, pipeTransform, pipeFlags);
 237
 238   if (!pipe) {
 239     mPipe = SurfacePipe();
 240     return NS_ERROR_FAILURE;
 241   }
 242
 243   mPipe = std::move(*pipe);
 244
 245   mFrameRect = aFrameInfo.mFrameRect;
 246   mPass = 0;
 247
 248   MOZ_LOG(sPNGDecoderAccountingLog, LogLevel::Debug,
 249           ("PNGDecoderAccounting: nsPNGDecoder::CreateFrame -- created "
 250            "image frame with %dx%d pixels for decoder %p",
 251            mFrameRect.Width(), mFrameRect.Height(), this));
 252
 253   return NS_OK;
 254 }
 255
 256 // set timeout and frame disposal method for the current frame
 257 void nsPNGDecoder::EndImageFrame() {
 258   if (mFrameIsHidden) {
 259     return;
 260   }
 261
 262   mNumFrames++;
 263
 264   Opacity opacity = mFormat == SurfaceFormat::OS_RGBX
 265                         ? Opacity::FULLY_OPAQUE
 266                         : Opacity::SOME_TRANSPARENCY;
 267
 268   PostFrameStop(opacity);
 269 }
 270
 271 nsresult nsPNGDecoder::InitInternal() {
 272   mDisablePremultipliedAlpha =
 273       bool(GetSurfaceFlags() & SurfaceFlags::NO_PREMULTIPLY_ALPHA);
 274
 275 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 276   static png_byte color_chunks[] = {99,  72, 82, 77, '\0',     // cHRM
 277                                     105, 67, 67, 80, '\0'};    // iCCP
 278   static png_byte unused_chunks[] = {98,  75, 71, 68,  '\0',   // bKGD
 279                                      101, 88, 73, 102, '\0',   // eXIf
 280                                      104, 73, 83, 84,  '\0',   // hIST
 281                                      105, 84, 88, 116, '\0',   // iTXt
 282                                      111, 70, 70, 115, '\0',   // oFFs
 283                                      112, 67, 65, 76,  '\0',   // pCAL
 284                                      115, 67, 65, 76,  '\0',   // sCAL
 285                                      112, 72, 89, 115, '\0',   // pHYs
 286                                      115, 66, 73, 84,  '\0',   // sBIT
 287                                      115, 80, 76, 84,  '\0',   // sPLT
 288                                      116, 69, 88, 116, '\0',   // tEXt
 289                                      116, 73, 77, 69,  '\0',   // tIME
 290                                      122, 84, 88, 116, '\0'};  // zTXt
 291 #endif
 292
 293   // Initialize the container's source image header
 294   // Always decode to 24 bit pixdepth
 295
 296   mPNG = png_create_read_struct(PNG_LIBPNG_VER_STRING, nullptr,
 297                                 nsPNGDecoder::error_callback,
 298                                 nsPNGDecoder::warning_callback);
 299   if (!mPNG) {
 300     return NS_ERROR_OUT_OF_MEMORY;
 301   }
 302
 303   mInfo = png_create_info_struct(mPNG);
 304   if (!mInfo) {
 305     png_destroy_read_struct(&mPNG, nullptr, nullptr);
 306     return NS_ERROR_OUT_OF_MEMORY;
 307   }
 308
 309 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 310   // Ignore unused chunks
 311   if (mCMSMode == CMSMode::Off || IsMetadataDecode()) {
 312     png_set_keep_unknown_chunks(mPNG, 1, color_chunks, 2);
 313   }
 314
 315   png_set_keep_unknown_chunks(mPNG, 1, unused_chunks,
 316                               (int)sizeof(unused_chunks) / 5);
 317 #endif
 318
 319 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
 320   png_set_user_limits(mPNG, MOZ_PNG_MAX_WIDTH, MOZ_PNG_MAX_HEIGHT);
 321   png_set_chunk_malloc_max(mPNG, kPngMaxChunkSize);
 322 #endif
 323
 324 #ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
 325   // Disallow palette-index checking, for speed; we would ignore the warning
 326   // anyhow.  This feature was added at libpng version 1.5.10 and is disabled
 327   // in the embedded libpng but enabled by default in the system libpng.  This
 328   // call also disables it in the system libpng, for decoding speed.
 329   // Bug #745202.
 330   png_set_check_for_invalid_index(mPNG, 0);
 331 #endif
 332
 333 #ifdef PNG_SET_OPTION_SUPPORTED
 334 #  if defined(PNG_sRGB_PROFILE_CHECKS) && PNG_sRGB_PROFILE_CHECKS >= 0
 335   // Skip checking of sRGB ICC profiles
 336   png_set_option(mPNG, PNG_SKIP_sRGB_CHECK_PROFILE, PNG_OPTION_ON);
 337 #  endif
 338
 339 #  ifdef PNG_MAXIMUM_INFLATE_WINDOW
 340   // Force a larger zlib inflate window as some images in the wild have
 341   // incorrectly set metadata (specifically CMF bits) which prevent us from
 342   // decoding them otherwise.
 343   png_set_option(mPNG, PNG_MAXIMUM_INFLATE_WINDOW, PNG_OPTION_ON);
 344 #  endif
 345 #endif
 346
 347   // use this as libpng "progressive pointer" (retrieve in callbacks)
 348   png_set_progressive_read_fn(
 349       mPNG, static_cast<png_voidp>(this), nsPNGDecoder::info_callback,
 350       nsPNGDecoder::row_callback, nsPNGDecoder::end_callback);
 351
 352   return NS_OK;
 353 }
 354
 355 LexerResult nsPNGDecoder::DoDecode(SourceBufferIterator& aIterator,
 356                                    IResumable* aOnResume) {
 357   MOZ_ASSERT(!HasError(), "Shouldn't call DoDecode after error!");
 358
 359   return mLexer.Lex(aIterator, aOnResume,
 360                     [=](State aState, const char* aData, size_t aLength) {
 361                       switch (aState) {
 362                         case State::PNG_DATA:
 363                           return ReadPNGData(aData, aLength);
 364                         case State::FINISHED_PNG_DATA:
 365                           return FinishedPNGData();
 366                       }
 367                       MOZ_CRASH("Unknown State");
 368                     });
 369 }
 370
 371 LexerTransition<nsPNGDecoder::State> nsPNGDecoder::ReadPNGData(
 372     const char* aData, size_t aLength) {
 373   // If we were waiting until after returning from a yield to call
 374   // CreateFrame(), call it now.
 375   if (mNextFrameInfo) {
 376     if (NS_FAILED(CreateFrame(*mNextFrameInfo))) {
 377       return Transition::TerminateFailure();
 378     }
 379
 380     MOZ_ASSERT(mImageData, "Should have a buffer now");
 381     mNextFrameInfo = Nothing();
 382   }
 383
 384   // libpng uses setjmp/longjmp for error handling.
 385   if (setjmp(png_jmpbuf(mPNG))) {
 386     return (GetFrameCount() > 0 && mErrorIsRecoverable)
 387                ? Transition::TerminateSuccess()
 388                : Transition::TerminateFailure();
 389   }
 390
 391   // Pass the data off to libpng.
 392   mLastChunkLength = aLength;
 393   mNextTransition = Transition::ContinueUnbuffered(State::PNG_DATA);
 394   png_process_data(mPNG, mInfo,
 395                    reinterpret_cast<unsigned char*>(const_cast<char*>((aData))),
 396                    aLength);
 397
 398   // Make sure that we've reached a terminal state if decoding is done.
 399   MOZ_ASSERT_IF(GetDecodeDone(), mNextTransition.NextStateIsTerminal());
 400   MOZ_ASSERT_IF(HasError(), mNextTransition.NextStateIsTerminal());
 401
 402   // Continue with whatever transition the callback code requested. We
 403   // initialized this to Transition::ContinueUnbuffered(State::PNG_DATA) above,
 404   // so by default we just continue the unbuffered read.
 405   return mNextTransition;
 406 }
 407
 408 LexerTransition<nsPNGDecoder::State> nsPNGDecoder::FinishedPNGData() {
 409   // Since we set up an unbuffered read for SIZE_MAX bytes, if we actually read
 410   // all that data something is really wrong.
 411   MOZ_ASSERT_UNREACHABLE("Read the entire address space?");
 412   return Transition::TerminateFailure();
 413 }
 414
 415 // Sets up gamma pre-correction in libpng before our callback gets called.
 416 // We need to do this if we don't end up with a CMS profile.
 417 static void PNGDoGammaCorrection(png_structp png_ptr, png_infop info_ptr) {
 418   double aGamma;
 419
 420   if (png_get_gAMA(png_ptr, info_ptr, &aGamma)) {
 421     if ((aGamma <= 0.0) || (aGamma > 21474.83)) {
 422       aGamma = 0.45455;
 423       png_set_gAMA(png_ptr, info_ptr, aGamma);
 424     }
 425     png_set_gamma(png_ptr, 2.2, aGamma);
 426   } else {
 427     png_set_gamma(png_ptr, 2.2, 0.45455);
 428   }
 429 }
 430
 431 // Adapted from http://www.littlecms.com/pngchrm.c example code
 432 uint32_t nsPNGDecoder::ReadColorProfile(png_structp png_ptr, png_infop info_ptr,
 433                                         int color_type, bool* sRGBTag) {
 434   // Check if cICP chunk is present
 435   if (png_get_valid(png_ptr, info_ptr, PNG_INFO_cICP)) {
 436     png_byte primaries;
 437     png_byte tc;
 438     png_byte matrix_coefficients;
 439     png_byte range;
 440     if (png_get_cICP(png_ptr, info_ptr, &primaries, &tc, &matrix_coefficients,
 441                      &range)) {
 442       if (matrix_coefficients == 0 && range <= 1) {
 443         if (range == 0) {
 444           MOZ_LOG(sPNGLog, LogLevel::Warning,
 445                   ("limited range specified in cicp chunk not properly "
 446                    "supported\n"));
 447         }
 448
 449         mInProfile = qcms_profile_create_cicp(primaries, tc);
 450         if (mInProfile) {
 451           return qcms_profile_get_rendering_intent(mInProfile);
 452         }
 453       }
 454     }
 455   }
 456
 457   // Check if iCCP chunk is present
 458   if (png_get_valid(png_ptr, info_ptr, PNG_INFO_iCCP)) {
 459     png_uint_32 profileLen;
 460     png_bytep profileData;
 461     png_charp profileName;
 462     int compression;
 463
 464     png_get_iCCP(png_ptr, info_ptr, &profileName, &compression, &profileData,
 465                  &profileLen);
 466
 467     mInProfile = qcms_profile_from_memory((char*)profileData, profileLen);
 468     if (mInProfile) {
 469       uint32_t profileSpace = qcms_profile_get_color_space(mInProfile);
 470
 471       bool mismatch = false;
 472       if (color_type & PNG_COLOR_MASK_COLOR) {
 473         if (profileSpace != icSigRgbData) {
 474           mismatch = true;
 475         }
 476       } else {
 477         if (profileSpace == icSigRgbData) {
 478           png_set_gray_to_rgb(png_ptr);
 479         } else if (profileSpace != icSigGrayData) {
 480           mismatch = true;
 481         }
 482       }
 483
 484       if (mismatch) {
 485         qcms_profile_release(mInProfile);
 486         mInProfile = nullptr;
 487       } else {
 488         return qcms_profile_get_rendering_intent(mInProfile);
 489       }
 490     }
 491   }
 492
 493   // Check sRGB chunk
 494   if (png_get_valid(png_ptr, info_ptr, PNG_INFO_sRGB)) {
 495     *sRGBTag = true;
 496
 497     int fileIntent;
 498     png_set_gray_to_rgb(png_ptr);
 499     png_get_sRGB(png_ptr, info_ptr, &fileIntent);
 500     uint32_t map[] = {QCMS_INTENT_PERCEPTUAL, QCMS_INTENT_RELATIVE_COLORIMETRIC,
 501                       QCMS_INTENT_SATURATION,
 502                       QCMS_INTENT_ABSOLUTE_COLORIMETRIC};
 503     return map[fileIntent];
 504   }
 505
 506   // Check gAMA/cHRM chunks
 507   if (png_get_valid(png_ptr, info_ptr, PNG_INFO_gAMA) &&
 508       png_get_valid(png_ptr, info_ptr, PNG_INFO_cHRM)) {
 509     qcms_CIE_xyYTRIPLE primaries;
 510     qcms_CIE_xyY whitePoint;
 511
 512     png_get_cHRM(png_ptr, info_ptr, &whitePoint.x, &whitePoint.y,
 513                  &primaries.red.x, &primaries.red.y, &primaries.green.x,
 514                  &primaries.green.y, &primaries.blue.x, &primaries.blue.y);
 515     whitePoint.Y = primaries.red.Y = primaries.green.Y = primaries.blue.Y = 1.0;
 516
 517     double gammaOfFile;
 518
 519     png_get_gAMA(png_ptr, info_ptr, &gammaOfFile);
 520
 521     mInProfile = qcms_profile_create_rgb_with_gamma(whitePoint, primaries,
 522                                                     1.0 / gammaOfFile);
 523
 524     if (mInProfile) {
 525       png_set_gray_to_rgb(png_ptr);
 526     }
 527   }
 528
 529   return QCMS_INTENT_PERCEPTUAL;  // Our default
 530 }
 531
 532 void nsPNGDecoder::info_callback(png_structp png_ptr, png_infop info_ptr) {
 533   png_uint_32 width, height;
 534   int bit_depth, color_type, interlace_type, compression_type, filter_type;
 535   unsigned int channels;
 536
 537   png_bytep trans = nullptr;
 538   int num_trans = 0;
 539
 540   nsPNGDecoder* decoder =
 541       static_cast<nsPNGDecoder*>(png_get_progressive_ptr(png_ptr));
 542
 543   if (decoder->mGotInfoCallback) {
 544     MOZ_LOG(sPNGLog, LogLevel::Warning,
 545             ("libpng called info_callback more than once\n"));
 546     return;
 547   }
 548
 549   decoder->mGotInfoCallback = true;
 550
 551   // Always decode to 24-bit RGB or 32-bit RGBA
 552   png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,
 553                &interlace_type, &compression_type, &filter_type);
 554
 555   const OrientedIntRect frameRect(0, 0, width, height);
 556
 557   // Post our size to the superclass
 558   decoder->PostSize(frameRect.Width(), frameRect.Height());
 559
 560   if (width > SurfaceCache::MaximumCapacity() / (bit_depth > 8 ? 16 : 8)) {
 561     // libpng needs space to allocate two row buffers
 562     png_error(decoder->mPNG, "Image is too wide");
 563   }
 564
 565   if (decoder->HasError()) {
 566     // Setting the size led to an error.
 567     png_error(decoder->mPNG, "Sizing error");
 568   }
 569
 570   if (color_type == PNG_COLOR_TYPE_PALETTE) {
 571     png_set_expand(png_ptr);
 572   }
 573
 574   if (color_type == PNG_COLOR_TYPE_GRAY && bit_depth < 8) {
 575     png_set_expand(png_ptr);
 576   }
 577
 578   if (png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)) {
 579     png_color_16p trans_values;
 580     png_get_tRNS(png_ptr, info_ptr, &trans, &num_trans, &trans_values);
 581     // libpng doesn't reject a tRNS chunk with out-of-range samples
 582     // so we check it here to avoid setting up a useless opacity
 583     // channel or producing unexpected transparent pixels (bug #428045)
 584     if (bit_depth < 16) {
 585       png_uint_16 sample_max = (1 << bit_depth) - 1;
 586       if ((color_type == PNG_COLOR_TYPE_GRAY &&
 587            trans_values->gray > sample_max) ||
 588           (color_type == PNG_COLOR_TYPE_RGB &&
 589            (trans_values->red > sample_max ||
 590             trans_values->green > sample_max ||
 591             trans_values->blue > sample_max))) {
 592         // clear the tRNS valid flag and release tRNS memory
 593         png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
 594         num_trans = 0;
 595       }
 596     }
 597     if (num_trans != 0) {
 598       png_set_expand(png_ptr);
 599     }
 600   }
 601
 602   if (bit_depth == 16) {
 603     png_set_scale_16(png_ptr);
 604   }
 605
 606   // We only need to extract the color profile for non-metadata decodes. It is
 607   // fairly expensive to read the profile and create the transform so we should
 608   // avoid it if not necessary.
 609   uint32_t intent = -1;
 610   bool sRGBTag = false;
 611   if (!decoder->IsMetadataDecode()) {
 612     if (decoder->mCMSMode != CMSMode::Off) {
 613       intent = gfxPlatform::GetRenderingIntent();
 614       uint32_t pIntent =
 615           decoder->ReadColorProfile(png_ptr, info_ptr, color_type, &sRGBTag);
 616       // If we're not mandating an intent, use the one from the image.
 617       if (intent == uint32_t(-1)) {
 618         intent = pIntent;
 619       }
 620     }
 621     const bool hasColorInfo = decoder->mInProfile || sRGBTag;
 622     if (!hasColorInfo || !decoder->GetCMSOutputProfile()) {
 623       png_set_gray_to_rgb(png_ptr);
 624
 625       // only do gamma correction if CMS isn't entirely disabled
 626       if (decoder->mCMSMode != CMSMode::Off) {
 627         PNGDoGammaCorrection(png_ptr, info_ptr);
 628       }
 629     }
 630   }
 631
 632   // Let libpng expand interlaced images.
 633   const bool isInterlaced = interlace_type == PNG_INTERLACE_ADAM7;
 634   if (isInterlaced) {
 635     png_set_interlace_handling(png_ptr);
 636   }
 637
 638   // now all of those things we set above are used to update various struct
 639   // members and whatnot, after which we can get channels, rowbytes, etc.
 640   png_read_update_info(png_ptr, info_ptr);
 641   decoder->mChannels = channels = png_get_channels(png_ptr, info_ptr);
 642
 643   //---------------------------------------------------------------//
 644   // copy PNG info into imagelib structs (formerly png_set_dims()) //
 645   //---------------------------------------------------------------//
 646
 647   if (channels < 1 || channels > 4) {
 648     png_error(decoder->mPNG, "Invalid number of channels");
 649   }
 650
 651 #ifdef PNG_APNG_SUPPORTED
 652   bool isAnimated = png_get_valid(png_ptr, info_ptr, PNG_INFO_acTL);
 653   if (isAnimated) {
 654     int32_t rawTimeout = GetNextFrameDelay(png_ptr, info_ptr);
 655     decoder->PostIsAnimated(FrameTimeout::FromRawMilliseconds(rawTimeout));
 656
 657     if (decoder->Size() != decoder->OutputSize() &&
 658         !decoder->IsFirstFrameDecode()) {
 659       MOZ_ASSERT_UNREACHABLE(
 660           "Doing downscale-during-decode "
 661           "for an animated image?");
 662       png_error(decoder->mPNG, "Invalid downscale attempt");  // Abort decode.
 663     }
 664   }
 665 #endif
 666
 667   auto transparency = decoder->GetTransparencyType(frameRect);
 668   if (decoder->IsMetadataDecode()) {
 669     // If we are animated then the first frame rect is either:
 670     // 1) the whole image if the IDAT chunk is part of the animation
 671     // 2) the frame rect of the first fDAT chunk otherwise.
 672     // If we are not animated then we want to make sure to call
 673     // PostHasTransparency in the metadata decode if we need to. So it's
 674     // okay to pass IntRect(0, 0, width, height) here for animated images;
 675     // they will call with the proper first frame rect in the full decode.
 676     decoder->PostHasTransparencyIfNeeded(transparency);
 677
 678     // We have the metadata we're looking for, so stop here, before we allocate
 679     // buffers below.
 680     return decoder->DoTerminate(png_ptr, TerminalState::SUCCESS);
 681   }
 682
 683   if (decoder->mInProfile && decoder->GetCMSOutputProfile()) {
 684     qcms_data_type inType;
 685     qcms_data_type outType;
 686
 687     uint32_t profileSpace = qcms_profile_get_color_space(decoder->mInProfile);
 688     decoder->mUsePipeTransform = profileSpace != icSigGrayData;
 689     if (decoder->mUsePipeTransform) {
 690       // libpng outputs data in RGBA order and we want our final output to be
 691       // BGRA order. SurfacePipe takes care of this for us but unfortunately the
 692       // swizzle to change the order can happen before or after color management
 693       // depending on if we have alpha. If we have alpha then the order will be
 694       // color management then swizzle. If we do not have alpha then the order
 695       // will be swizzle then color management. See CreateSurfacePipe
 696       // https://searchfox.org/mozilla-central/rev/7d6651d29c5c1620bc059f879a3e9bbfb53f271f/image/SurfacePipeFactory.h#133-145
 697       if (transparency == TransparencyType::eAlpha) {
 698         inType = QCMS_DATA_RGBA_8;
 699         outType = QCMS_DATA_RGBA_8;
 700       } else {
 701         inType = gfxPlatform::GetCMSOSRGBAType();
 702         outType = inType;
 703       }
 704     } else {
 705       // qcms operates on the data before we hand it to SurfacePipe.
 706       if (color_type & PNG_COLOR_MASK_ALPHA) {
 707         inType = QCMS_DATA_GRAYA_8;
 708         outType = gfxPlatform::GetCMSOSRGBAType();
 709       } else {
 710         inType = QCMS_DATA_GRAY_8;
 711         outType = gfxPlatform::GetCMSOSRGBAType();
 712       }
 713     }
 714
 715     decoder->mTransform = qcms_transform_create(decoder->mInProfile, inType,
 716                                                 decoder->GetCMSOutputProfile(),
 717                                                 outType, (qcms_intent)intent);
 718   } else if ((sRGBTag && decoder->mCMSMode == CMSMode::TaggedOnly) ||
 719              decoder->mCMSMode == CMSMode::All) {
 720     // See comment above about SurfacePipe, color management and ordering.
 721     decoder->mUsePipeTransform = true;
 722     if (transparency == TransparencyType::eAlpha) {
 723       decoder->mTransform =
 724           decoder->GetCMSsRGBTransform(SurfaceFormat::R8G8B8A8);
 725     } else {
 726       decoder->mTransform =
 727           decoder->GetCMSsRGBTransform(SurfaceFormat::OS_RGBA);
 728     }
 729   }
 730
 731 #ifdef PNG_APNG_SUPPORTED
 732   if (isAnimated) {
 733     png_set_progressive_frame_fn(png_ptr, nsPNGDecoder::frame_info_callback,
 734                                  nullptr);
 735   }
 736
 737   if (png_get_first_frame_is_hidden(png_ptr, info_ptr)) {
 738     decoder->mFrameIsHidden = true;
 739   } else {
 740 #endif
 741     nsresult rv = decoder->CreateFrame(FrameInfo{frameRect, isInterlaced});
 742     if (NS_FAILED(rv)) {
 743       png_error(decoder->mPNG, "CreateFrame failed");
 744     }
 745     MOZ_ASSERT(decoder->mImageData, "Should have a buffer now");
 746 #ifdef PNG_APNG_SUPPORTED
 747   }
 748 #endif
 749
 750   if (decoder->mTransform && !decoder->mUsePipeTransform) {
 751     decoder->mCMSLine =
 752         static_cast<uint8_t*>(malloc(sizeof(uint32_t) * frameRect.Width()));
 753     if (!decoder->mCMSLine) {
 754       png_error(decoder->mPNG, "malloc of mCMSLine failed");
 755     }
 756   }
 757
 758   if (interlace_type == PNG_INTERLACE_ADAM7) {
 759     if (frameRect.Height() <
 760         INT32_MAX / (frameRect.Width() * int32_t(channels))) {
 761       const size_t bufferSize =
 762           channels * frameRect.Width() * frameRect.Height();
 763
 764       if (bufferSize > SurfaceCache::MaximumCapacity()) {
 765         png_error(decoder->mPNG, "Insufficient memory to deinterlace image");
 766       }
 767
 768       decoder->interlacebuf = static_cast<uint8_t*>(malloc(bufferSize));
 769     }
 770     if (!decoder->interlacebuf) {
 771       png_error(decoder->mPNG, "malloc of interlacebuf failed");
 772     }
 773   }
 774 }
 775
 776 void nsPNGDecoder::PostInvalidationIfNeeded() {
 777   Maybe<SurfaceInvalidRect> invalidRect = mPipe.TakeInvalidRect();
 778   if (!invalidRect) {
 779     return;
 780   }
 781
 782   PostInvalidation(invalidRect->mInputSpaceRect,
 783                    Some(invalidRect->mOutputSpaceRect));
 784 }
 785
 786 void nsPNGDecoder::row_callback(png_structp png_ptr, png_bytep new_row,
 787                                 png_uint_32 row_num, int pass) {
 788   /* libpng comments:
 789    *
 790    * This function is called for every row in the image.  If the
 791    * image is interlacing, and you turned on the interlace handler,
 792    * this function will be called for every row in every pass.
 793    * Some of these rows will not be changed from the previous pass.
 794    * When the row is not changed, the new_row variable will be
 795    * nullptr. The rows and passes are called in order, so you don't
 796    * really need the row_num and pass, but I'm supplying them
 797    * because it may make your life easier.
 798    *
 799    * For the non-nullptr rows of interlaced images, you must call
 800    * png_progressive_combine_row() passing in the row and the
 801    * old row.  You can call this function for nullptr rows (it will
 802    * just return) and for non-interlaced images (it just does the
 803    * memcpy for you) if it will make the code easier.  Thus, you
 804    * can just do this for all cases:
 805    *
 806    *    png_progressive_combine_row(png_ptr, old_row, new_row);
 807    *
 808    * where old_row is what was displayed for previous rows.  Note
 809    * that the first pass (pass == 0 really) will completely cover
 810    * the old row, so the rows do not have to be initialized.  After
 811    * the first pass (and only for interlaced images), you will have
 812    * to pass the current row, and the function will combine the
 813    * old row and the new row.
 814    */
 815   nsPNGDecoder* decoder =
 816       static_cast<nsPNGDecoder*>(png_get_progressive_ptr(png_ptr));
 817
 818   if (decoder->mFrameIsHidden) {
 819     return;  // Skip this frame.
 820   }
 821
 822   MOZ_ASSERT_IF(decoder->IsFirstFrameDecode(), decoder->mNumFrames == 0);
 823
 824   while (pass > decoder->mPass) {
 825     // Advance to the next pass. We may have to do this multiple times because
 826     // libpng will skip passes if the image is so small that no pixels have
 827     // changed on a given pass, but ADAM7InterpolatingFilter needs to be reset
 828     // once for every pass to perform interpolation properly.
 829     decoder->mPipe.ResetToFirstRow();
 830     decoder->mPass++;
 831   }
 832
 833   const png_uint_32 height =
 834       static_cast<png_uint_32>(decoder->mFrameRect.Height());
 835
 836   if (row_num >= height) {
 837     // Bail if we receive extra rows. This is especially important because if we
 838     // didn't, we might overflow the deinterlacing buffer.
 839     MOZ_ASSERT_UNREACHABLE("libpng producing extra rows?");
 840     return;
 841   }
 842
 843   // Note that |new_row| may be null here, indicating that this is an interlaced
 844   // image and |row_callback| is being called for a row that hasn't changed.
 845   MOZ_ASSERT_IF(!new_row, decoder->interlacebuf);
 846
 847   if (decoder->interlacebuf) {
 848     uint32_t width = uint32_t(decoder->mFrameRect.Width());
 849
 850     // We'll output the deinterlaced version of the row.
 851     uint8_t* rowToWrite =
 852         decoder->interlacebuf + (row_num * decoder->mChannels * width);
 853
 854     // Update the deinterlaced version of this row with the new data.
 855     png_progressive_combine_row(png_ptr, rowToWrite, new_row);
 856
 857     decoder->WriteRow(rowToWrite);
 858   } else {
 859     decoder->WriteRow(new_row);
 860   }
 861 }
 862
 863 void nsPNGDecoder::WriteRow(uint8_t* aRow) {
 864   MOZ_ASSERT(aRow);
 865
 866   uint8_t* rowToWrite = aRow;
 867   uint32_t width = uint32_t(mFrameRect.Width());
 868
 869   // Apply color management to the row, if necessary, before writing it out.
 870   // This is only needed for grayscale images.
 871   if (mTransform && !mUsePipeTransform) {
 872     MOZ_ASSERT(mCMSLine);
 873     qcms_transform_data(mTransform, rowToWrite, mCMSLine, width);
 874     rowToWrite = mCMSLine;
 875   }
 876
 877   // Write this row to the SurfacePipe.
 878   DebugOnly<WriteState> result =
 879       mPipe.WriteBuffer(reinterpret_cast<uint32_t*>(rowToWrite));
 880   MOZ_ASSERT(WriteState(result) != WriteState::FAILURE);
 881
 882   PostInvalidationIfNeeded();
 883 }
 884
 885 void nsPNGDecoder::DoTerminate(png_structp aPNGStruct, TerminalState aState) {
 886   // Stop processing data. Note that we intentionally ignore the return value of
 887   // png_process_data_pause(), which tells us how many bytes of the data that
 888   // was passed to png_process_data() have not been consumed yet, because now
 889   // that we've reached a terminal state, we won't do any more decoding or call
 890   // back into libpng anymore.
 891   png_process_data_pause(aPNGStruct, /* save = */ false);
 892
 893   mNextTransition = aState == TerminalState::SUCCESS
 894                         ? Transition::TerminateSuccess()
 895                         : Transition::TerminateFailure();
 896 }
 897
 898 void nsPNGDecoder::DoYield(png_structp aPNGStruct) {
 899   // Pause data processing. png_process_data_pause() returns how many bytes of
 900   // the data that was passed to png_process_data() have not been consumed yet.
 901   // We use this information to tell StreamingLexer where to place us in the
 902   // input stream when we come back from the yield.
 903   png_size_t pendingBytes = png_process_data_pause(aPNGStruct,
 904                                                    /* save = */ false);
 905
 906   MOZ_ASSERT(pendingBytes < mLastChunkLength);
 907   size_t consumedBytes = mLastChunkLength - min(pendingBytes, mLastChunkLength);
 908
 909   mNextTransition =
 910       Transition::ContinueUnbufferedAfterYield(State::PNG_DATA, consumedBytes);
 911 }
 912
 913 nsresult nsPNGDecoder::FinishInternal() {
 914   // We shouldn't be called in error cases.
 915   MOZ_ASSERT(!HasError(), "Can't call FinishInternal on error!");
 916
 917   int32_t loop_count = 0;
 918   uint32_t frame_count = 1;
 919 #ifdef PNG_APNG_SUPPORTED
 920   uint32_t num_plays = 0;
 921   if (png_get_acTL(mPNG, mInfo, &frame_count, &num_plays)) {
 922     loop_count = int32_t(num_plays) - 1;
 923   } else {
 924     frame_count = 1;
 925   }
 926 #endif
 927
 928   PostLoopCount(loop_count);
 929
 930   if (WantsFrameCount()) {
 931     PostFrameCount(frame_count);
 932   }
 933
 934   if (IsMetadataDecode()) {
 935     return NS_OK;
 936   }
 937
 938   if (InFrame()) {
 939     EndImageFrame();
 940   }
 941   PostDecodeDone();
 942
 943   return NS_OK;
 944 }
 945
 946 #ifdef PNG_APNG_SUPPORTED
 947 // got the header of a new frame that's coming
 948 void nsPNGDecoder::frame_info_callback(png_structp png_ptr,
 949                                        png_uint_32 frame_num) {
 950   nsPNGDecoder* decoder =
 951       static_cast<nsPNGDecoder*>(png_get_progressive_ptr(png_ptr));
 952
 953   // old frame is done
 954   decoder->EndImageFrame();
 955
 956   const bool previousFrameWasHidden = decoder->mFrameIsHidden;
 957
 958   if (!previousFrameWasHidden && decoder->IsFirstFrameDecode()) {
 959     // We're about to get a second non-hidden frame, but we only want the first.
 960     // Stop decoding now. (And avoid allocating the unnecessary buffers below.)
 961     return decoder->DoTerminate(png_ptr, TerminalState::SUCCESS);
 962   }
 963
 964   // Only the first frame can be hidden, so unhide unconditionally here.
 965   decoder->mFrameIsHidden = false;
 966
 967   // Save the information necessary to create the frame; we'll actually create
 968   // it when we return from the yield.
 969   const OrientedIntRect frameRect(
 970       png_get_next_frame_x_offset(png_ptr, decoder->mInfo),
 971       png_get_next_frame_y_offset(png_ptr, decoder->mInfo),
 972       png_get_next_frame_width(png_ptr, decoder->mInfo),
 973       png_get_next_frame_height(png_ptr, decoder->mInfo));
 974   const bool isInterlaced = bool(decoder->interlacebuf);
 975
 976 #  ifndef MOZ_EMBEDDED_LIBPNG
 977   // if using system library, check frame_width and height against 0
 978   if (frameRect.width == 0) {
 979     png_error(png_ptr, "Frame width must not be 0");
 980   }
 981   if (frameRect.height == 0) {
 982     png_error(png_ptr, "Frame height must not be 0");
 983   }
 984 #  endif
 985
 986   const FrameInfo info{frameRect, isInterlaced};
 987
 988   // If the previous frame was hidden, skip the yield (which will mislead the
 989   // caller, who will think the previous frame was real) and just allocate the
 990   // new frame here.
 991   if (previousFrameWasHidden) {
 992     if (NS_FAILED(decoder->CreateFrame(info))) {
 993       return decoder->DoTerminate(png_ptr, TerminalState::FAILURE);
 994     }
 995
 996     MOZ_ASSERT(decoder->mImageData, "Should have a buffer now");
 997     return;  // No yield, so we'll just keep decoding.
 998   }
 999
1000   // Yield to the caller to notify them that the previous frame is now complete.
1001   decoder->mNextFrameInfo = Some(info);
1002   return decoder->DoYield(png_ptr);
1003 }
1004 #endif
1005
1006 void nsPNGDecoder::end_callback(png_structp png_ptr, png_infop info_ptr) {
1007   /* libpng comments:
1008    *
1009    * this function is called when the whole image has been read,
1010    * including any chunks after the image (up to and including
1011    * the IEND).  You will usually have the same info chunk as you
1012    * had in the header, although some data may have been added
1013    * to the comments and time fields.
1014    *
1015    * Most people won't do much here, perhaps setting a flag that
1016    * marks the image as finished.
1017    */
1018
1019   nsPNGDecoder* decoder =
1020       static_cast<nsPNGDecoder*>(png_get_progressive_ptr(png_ptr));
1021
1022   // We shouldn't get here if we've hit an error
1023   MOZ_ASSERT(!decoder->HasError(), "Finishing up PNG but hit error!");
1024
1025   return decoder->DoTerminate(png_ptr, TerminalState::SUCCESS);
1026 }
1027
1028 void nsPNGDecoder::error_callback(png_structp png_ptr,
1029                                   png_const_charp error_msg) {
1030   MOZ_LOG(sPNGLog, LogLevel::Error, ("libpng error: %s\n", error_msg));
1031
1032   nsPNGDecoder* decoder =
1033       static_cast<nsPNGDecoder*>(png_get_progressive_ptr(png_ptr));
1034
1035   if (strstr(error_msg, "invalid chunk type")) {
1036     decoder->mErrorIsRecoverable = true;
1037   } else {
1038     decoder->mErrorIsRecoverable = false;
1039   }
1040
1041   png_longjmp(png_ptr, 1);
1042 }
1043
1044 void nsPNGDecoder::warning_callback(png_structp png_ptr,
1045                                     png_const_charp warning_msg) {
1046   MOZ_LOG(sPNGLog, LogLevel::Warning, ("libpng warning: %s\n", warning_msg));
1047 }
1048
1049 Maybe<Telemetry::HistogramID> nsPNGDecoder::SpeedHistogram() const {
1050   return Some(Telemetry::IMAGE_DECODE_SPEED_PNG);
1051 }
1052
1053 bool nsPNGDecoder::IsValidICOResource() const {
1054   // Only 32-bit RGBA PNGs are valid ICO resources; see here:
1055   //   http://blogs.msdn.com/b/oldnewthing/archive/2010/10/22/10079192.aspx
1056
1057   // If there are errors in the call to png_get_IHDR, the error_callback in
1058   // nsPNGDecoder.cpp is called.  In this error callback we do a longjmp, so
1059   // we need to save the jump buffer here. Otherwise we'll end up without a
1060   // proper callstack.
1061   if (setjmp(png_jmpbuf(mPNG))) {
1062     // We got here from a longjmp call indirectly from png_get_IHDR via
1063     // error_callback. Ignore mErrorIsRecoverable: if we got an invalid chunk
1064     // error before even reading the IHDR we can't recover from that.
1065     return false;
1066   }
1067
1068   png_uint_32 png_width,  // Unused
1069       png_height;         // Unused
1070
1071   int png_bit_depth, png_color_type;
1072
1073   if (png_get_IHDR(mPNG, mInfo, &png_width, &png_height, &png_bit_depth,
1074                    &png_color_type, nullptr, nullptr, nullptr)) {
1075     return ((png_color_type == PNG_COLOR_TYPE_RGB_ALPHA ||
1076              png_color_type == PNG_COLOR_TYPE_RGB) &&
1077             png_bit_depth == 8);
1078   } else {
1079     return false;
1080   }
1081 }
1082
1083 }  // namespace image
1084 }  // namespace mozilla