modules/libimg/png/pngpread.c

   1
   2 /* pngpread.c - read a png file in push mode
   3  *
   4  * Last changed in libpng 1.2.30 [August 13, 2008]
   5  * For conditions of distribution and use, see copyright notice in png.h
   6  * Copyright (c) 1998-2008 Glenn Randers-Pehrson
   7  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
   8  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
   9  */
  10
  11 #define PNG_INTERNAL
  12 #include "png.h"
  13 #ifdef PNG_PROGRESSIVE_READ_SUPPORTED
  14
  15 /* push model modes */
  16 #define PNG_READ_SIG_MODE   0
  17 #define PNG_READ_CHUNK_MODE 1
  18 #define PNG_READ_IDAT_MODE  2
  19 #define PNG_SKIP_MODE       3
  20 #define PNG_READ_tEXt_MODE  4
  21 #define PNG_READ_zTXt_MODE  5
  22 #define PNG_READ_DONE_MODE  6
  23 #define PNG_READ_iTXt_MODE  7
  24 #define PNG_ERROR_MODE      8
  25
  26 void PNGAPI
  27 png_process_data(png_structp png_ptr, png_infop info_ptr,
  28    png_bytep buffer, png_size_t buffer_size)
  29 {
  30    if (png_ptr == NULL || info_ptr == NULL) return;
  31    png_push_restore_buffer(png_ptr, buffer, buffer_size);
  32
  33    while (png_ptr->buffer_size)
  34    {
  35       png_process_some_data(png_ptr, info_ptr);
  36    }
  37 }
  38
  39 /* What we do with the incoming data depends on what we were previously
  40  * doing before we ran out of data...
  41  */
  42 void /* PRIVATE */
  43 png_process_some_data(png_structp png_ptr, png_infop info_ptr)
  44 {
  45    if (png_ptr == NULL) return;
  46    switch (png_ptr->process_mode)
  47    {
  48       case PNG_READ_SIG_MODE:
  49       {
  50          png_push_read_sig(png_ptr, info_ptr);
  51          break;
  52       }
  53       case PNG_READ_CHUNK_MODE:
  54       {
  55          png_push_read_chunk(png_ptr, info_ptr);
  56          break;
  57       }
  58       case PNG_READ_IDAT_MODE:
  59       {
  60          png_push_read_IDAT(png_ptr);
  61          break;
  62       }
  63 #if defined(PNG_READ_tEXt_SUPPORTED)
  64       case PNG_READ_tEXt_MODE:
  65       {
  66          png_push_read_tEXt(png_ptr, info_ptr);
  67          break;
  68       }
  69 #endif
  70 #if defined(PNG_READ_zTXt_SUPPORTED)
  71       case PNG_READ_zTXt_MODE:
  72       {
  73          png_push_read_zTXt(png_ptr, info_ptr);
  74          break;
  75       }
  76 #endif
  77 #if defined(PNG_READ_iTXt_SUPPORTED)
  78       case PNG_READ_iTXt_MODE:
  79       {
  80          png_push_read_iTXt(png_ptr, info_ptr);
  81          break;
  82       }
  83 #endif
  84       case PNG_SKIP_MODE:
  85       {
  86          png_push_crc_finish(png_ptr);
  87          break;
  88       }
  89       default:
  90       {
  91          png_ptr->buffer_size = 0;
  92          break;
  93       }
  94    }
  95 }
  96
  97 /* Read any remaining signature bytes from the stream and compare them with
  98  * the correct PNG signature.  It is possible that this routine is called
  99  * with bytes already read from the signature, either because they have been
 100  * checked by the calling application, or because of multiple calls to this
 101  * routine.
 102  */
 103 void /* PRIVATE */
 104 png_push_read_sig(png_structp png_ptr, png_infop info_ptr)
 105 {
 106    png_size_t num_checked = png_ptr->sig_bytes,
 107              num_to_check = 8 - num_checked;
 108
 109    if (png_ptr->buffer_size < num_to_check)
 110    {
 111       num_to_check = png_ptr->buffer_size;
 112    }
 113
 114    png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]),
 115       num_to_check);
 116    png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check);
 117
 118    if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))
 119    {
 120       if (num_checked < 4 &&
 121           png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4))
 122          png_error(png_ptr, "Not a PNG file");
 123       else
 124          png_error(png_ptr, "PNG file corrupted by ASCII conversion");
 125    }
 126    else
 127    {
 128       if (png_ptr->sig_bytes >= 8)
 129       {
 130          png_ptr->process_mode = PNG_READ_CHUNK_MODE;
 131       }
 132    }
 133 }
 134
 135 void /* PRIVATE */
 136 png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
 137 {
 138 #ifdef PNG_USE_LOCAL_ARRAYS
 139       PNG_CONST PNG_IHDR;
 140       PNG_CONST PNG_IDAT;
 141       PNG_CONST PNG_IEND;
 142       PNG_CONST PNG_PLTE;
 143 #if defined(PNG_READ_bKGD_SUPPORTED)
 144       PNG_CONST PNG_bKGD;
 145 #endif
 146 #if defined(PNG_READ_cHRM_SUPPORTED)
 147       PNG_CONST PNG_cHRM;
 148 #endif
 149 #if defined(PNG_READ_gAMA_SUPPORTED)
 150       PNG_CONST PNG_gAMA;
 151 #endif
 152 #if defined(PNG_READ_hIST_SUPPORTED)
 153       PNG_CONST PNG_hIST;
 154 #endif
 155 #if defined(PNG_READ_iCCP_SUPPORTED)
 156       PNG_CONST PNG_iCCP;
 157 #endif
 158 #if defined(PNG_READ_iTXt_SUPPORTED)
 159       PNG_CONST PNG_iTXt;
 160 #endif
 161 #if defined(PNG_READ_oFFs_SUPPORTED)
 162       PNG_CONST PNG_oFFs;
 163 #endif
 164 #if defined(PNG_READ_pCAL_SUPPORTED)
 165       PNG_CONST PNG_pCAL;
 166 #endif
 167 #if defined(PNG_READ_pHYs_SUPPORTED)
 168       PNG_CONST PNG_pHYs;
 169 #endif
 170 #if defined(PNG_READ_sBIT_SUPPORTED)
 171       PNG_CONST PNG_sBIT;
 172 #endif
 173 #if defined(PNG_READ_sCAL_SUPPORTED)
 174       PNG_CONST PNG_sCAL;
 175 #endif
 176 #if defined(PNG_READ_sRGB_SUPPORTED)
 177       PNG_CONST PNG_sRGB;
 178 #endif
 179 #if defined(PNG_READ_sPLT_SUPPORTED)
 180       PNG_CONST PNG_sPLT;
 181 #endif
 182 #if defined(PNG_READ_tEXt_SUPPORTED)
 183       PNG_CONST PNG_tEXt;
 184 #endif
 185 #if defined(PNG_READ_tIME_SUPPORTED)
 186       PNG_CONST PNG_tIME;
 187 #endif
 188 #if defined(PNG_READ_tRNS_SUPPORTED)
 189       PNG_CONST PNG_tRNS;
 190 #endif
 191 #if defined(PNG_READ_zTXt_SUPPORTED)
 192       PNG_CONST PNG_zTXt;
 193 #endif
 194 #if defined(PNG_READ_APNG_SUPPORTED)
 195       PNG_CONST PNG_acTL;
 196       PNG_CONST PNG_fcTL;
 197       PNG_CONST PNG_fdAT;
 198 #endif
 199 #endif /* PNG_USE_LOCAL_ARRAYS */
 200    /* First we make sure we have enough data for the 4 byte chunk name
 201     * and the 4 byte chunk length before proceeding with decoding the
 202     * chunk data.  To fully decode each of these chunks, we also make
 203     * sure we have enough data in the buffer for the 4 byte CRC at the
 204     * end of every chunk (except IDAT, which is handled separately).
 205     */
 206    if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER))
 207    {
 208       png_byte chunk_length[4];
 209
 210       if (png_ptr->buffer_size < 8)
 211       {
 212          png_push_save_buffer(png_ptr);
 213          return;
 214       }
 215
 216       png_push_fill_buffer(png_ptr, chunk_length, 4);
 217       png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
 218       png_reset_crc(png_ptr);
 219       png_crc_read(png_ptr, png_ptr->chunk_name, 4);
 220       png_check_chunk_name(png_ptr, png_ptr->chunk_name);
 221       png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
 222    }
 223
 224 #if defined(PNG_READ_APNG_SUPPORTED)
 225    if (png_ptr->num_frames_read > 0 &&
 226        png_ptr->num_frames_read < info_ptr->num_frames)
 227    {
 228       if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
 229       {
 230          /* discard trailing IDATs for the first frame */
 231          if (png_ptr->mode & PNG_HAVE_fcTL || png_ptr->num_frames_read > 1)
 232             png_error(png_ptr, "out of place IDAT");
 233
 234          if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 235          {
 236             png_push_save_buffer(png_ptr);
 237             return;
 238          }
 239          png_push_crc_skip(png_ptr, png_ptr->push_length);
 240          png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
 241          return;
 242       }
 243       else if (!png_memcmp(png_ptr->chunk_name, png_fdAT, 4))
 244       {
 245          if (png_ptr->buffer_size < 4)
 246          {
 247             png_push_save_buffer(png_ptr);
 248             return;
 249          }
 250          png_ensure_sequence_number(png_ptr, 4);
 251
 252          if (!(png_ptr->mode & PNG_HAVE_fcTL))
 253          {
 254             /* discard trailing fdATs for frames other than the first */
 255             if (png_ptr->num_frames_read < 2)
 256                png_error(png_ptr, "out of place fdAT");
 257
 258             if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 259             {
 260                png_push_save_buffer(png_ptr);
 261                return;
 262             }
 263             png_push_crc_skip(png_ptr, png_ptr->push_length);
 264             png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
 265             return;
 266          }
 267          else
 268          {
 269             /* frame data follows */
 270             png_ptr->idat_size = png_ptr->push_length - 4;
 271             png_ptr->mode |= PNG_HAVE_IDAT;
 272             png_ptr->process_mode = PNG_READ_IDAT_MODE;
 273
 274             return;
 275          }
 276       }
 277       else if(!png_memcmp(png_ptr->chunk_name, png_fcTL, 4))
 278       {
 279          if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 280          {
 281             png_push_save_buffer(png_ptr);
 282             return;
 283          }
 284
 285          png_read_reset(png_ptr);
 286          png_ptr->mode &= ~PNG_HAVE_fcTL;
 287
 288          png_handle_fcTL(png_ptr, info_ptr, png_ptr->push_length);
 289
 290          if (!(png_ptr->mode & PNG_HAVE_fcTL))
 291             png_error(png_ptr, "missing required fcTL chunk");
 292
 293          png_read_reinit(png_ptr, info_ptr);
 294          png_progressive_read_reset(png_ptr);
 295
 296          if (png_ptr->frame_info_fn != NULL)
 297             (*(png_ptr->frame_info_fn))(png_ptr, png_ptr->num_frames_read);
 298
 299          png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
 300
 301          return;
 302       }
 303       else
 304       {
 305          if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 306          {
 307             png_push_save_buffer(png_ptr);
 308             return;
 309          }
 310          png_warning(png_ptr, "Skipped (ignored) a chunk "
 311                               "between APNG chunks");
 312          png_push_crc_skip(png_ptr, png_ptr->push_length);
 313          png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
 314          return;
 315       }
 316
 317       return;
 318    }
 319 #endif /* PNG_READ_APNG_SUPPORTED */
 320
 321    if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
 322      if (png_ptr->mode & PNG_AFTER_IDAT)
 323         png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
 324
 325    if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
 326    {
 327       if (png_ptr->push_length != 13)
 328          png_error(png_ptr, "Invalid IHDR length");
 329       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 330       {
 331          if (png_ptr->push_length != 13)
 332             png_error(png_ptr, "Invalid IHDR length");
 333          png_push_save_buffer(png_ptr);
 334          return;
 335       }
 336       png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length);
 337    }
 338    else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
 339    {
 340       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 341       {
 342          png_push_save_buffer(png_ptr);
 343          return;
 344       }
 345       png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length);
 346
 347       png_ptr->process_mode = PNG_READ_DONE_MODE;
 348       png_push_have_end(png_ptr, info_ptr);
 349    }
 350 #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
 351    else if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name))
 352    {
 353       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 354       {
 355          png_push_save_buffer(png_ptr);
 356          return;
 357       }
 358       if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
 359          png_ptr->mode |= PNG_HAVE_IDAT;
 360       png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
 361       if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
 362          png_ptr->mode |= PNG_HAVE_PLTE;
 363       else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
 364       {
 365          if (!(png_ptr->mode & PNG_HAVE_IHDR))
 366             png_error(png_ptr, "Missing IHDR before IDAT");
 367          else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
 368                   !(png_ptr->mode & PNG_HAVE_PLTE))
 369             png_error(png_ptr, "Missing PLTE before IDAT");
 370       }
 371    }
 372 #endif
 373    else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
 374    {
 375       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 376       {
 377          png_push_save_buffer(png_ptr);
 378          return;
 379       }
 380       png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length);
 381    }
 382    else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
 383    {
 384       /* If we reach an IDAT chunk, this means we have read all of the
 385        * header chunks, and we can start reading the image (or if this
 386        * is called after the image has been read - we have an error).
 387        */
 388      if (!(png_ptr->mode & PNG_HAVE_IHDR))
 389        png_error(png_ptr, "Missing IHDR before IDAT");
 390      else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
 391          !(png_ptr->mode & PNG_HAVE_PLTE))
 392        png_error(png_ptr, "Missing PLTE before IDAT");
 393
 394       if (png_ptr->mode & PNG_HAVE_IDAT)
 395       {
 396          if (!(png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT))
 397            if (png_ptr->push_length == 0)
 398               return;
 399
 400          if (png_ptr->mode & PNG_AFTER_IDAT)
 401             png_error(png_ptr, "Too many IDAT's found");
 402       }
 403
 404 #if defined(PNG_READ_APNG_SUPPORTED)
 405       png_have_info(png_ptr, info_ptr);
 406 #endif
 407       png_ptr->idat_size = png_ptr->push_length;
 408       png_ptr->mode |= PNG_HAVE_IDAT;
 409       png_ptr->process_mode = PNG_READ_IDAT_MODE;
 410       png_push_have_info(png_ptr, info_ptr);
 411       png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
 412       png_ptr->zstream.next_out = png_ptr->row_buf;
 413       return;
 414    }
 415 #if defined(PNG_READ_gAMA_SUPPORTED)
 416    else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4))
 417    {
 418       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 419       {
 420          png_push_save_buffer(png_ptr);
 421          return;
 422       }
 423       png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length);
 424    }
 425 #endif
 426 #if defined(PNG_READ_sBIT_SUPPORTED)
 427    else if (!png_memcmp(png_ptr->chunk_name, png_sBIT, 4))
 428    {
 429       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 430       {
 431          png_push_save_buffer(png_ptr);
 432          return;
 433       }
 434       png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length);
 435    }
 436 #endif
 437 #if defined(PNG_READ_cHRM_SUPPORTED)
 438    else if (!png_memcmp(png_ptr->chunk_name, png_cHRM, 4))
 439    {
 440       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 441       {
 442          png_push_save_buffer(png_ptr);
 443          return;
 444       }
 445       png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length);
 446    }
 447 #endif
 448 #if defined(PNG_READ_sRGB_SUPPORTED)
 449    else if (!png_memcmp(png_ptr->chunk_name, png_sRGB, 4))
 450    {
 451       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 452       {
 453          png_push_save_buffer(png_ptr);
 454          return;
 455       }
 456       png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length);
 457    }
 458 #endif
 459 #if defined(PNG_READ_iCCP_SUPPORTED)
 460    else if (!png_memcmp(png_ptr->chunk_name, png_iCCP, 4))
 461    {
 462       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 463       {
 464          png_push_save_buffer(png_ptr);
 465          return;
 466       }
 467       png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length);
 468    }
 469 #endif
 470 #if defined(PNG_READ_sPLT_SUPPORTED)
 471    else if (!png_memcmp(png_ptr->chunk_name, png_sPLT, 4))
 472    {
 473       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 474       {
 475          png_push_save_buffer(png_ptr);
 476          return;
 477       }
 478       png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length);
 479    }
 480 #endif
 481 #if defined(PNG_READ_tRNS_SUPPORTED)
 482    else if (!png_memcmp(png_ptr->chunk_name, png_tRNS, 4))
 483    {
 484       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 485       {
 486          png_push_save_buffer(png_ptr);
 487          return;
 488       }
 489       png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length);
 490    }
 491 #endif
 492 #if defined(PNG_READ_bKGD_SUPPORTED)
 493    else if (!png_memcmp(png_ptr->chunk_name, png_bKGD, 4))
 494    {
 495       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 496       {
 497          png_push_save_buffer(png_ptr);
 498          return;
 499       }
 500       png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length);
 501    }
 502 #endif
 503 #if defined(PNG_READ_hIST_SUPPORTED)
 504    else if (!png_memcmp(png_ptr->chunk_name, png_hIST, 4))
 505    {
 506       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 507       {
 508          png_push_save_buffer(png_ptr);
 509          return;
 510       }
 511       png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length);
 512    }
 513 #endif
 514 #if defined(PNG_READ_pHYs_SUPPORTED)
 515    else if (!png_memcmp(png_ptr->chunk_name, png_pHYs, 4))
 516    {
 517       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 518       {
 519          png_push_save_buffer(png_ptr);
 520          return;
 521       }
 522       png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length);
 523    }
 524 #endif
 525 #if defined(PNG_READ_oFFs_SUPPORTED)
 526    else if (!png_memcmp(png_ptr->chunk_name, png_oFFs, 4))
 527    {
 528       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 529       {
 530          png_push_save_buffer(png_ptr);
 531          return;
 532       }
 533       png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length);
 534    }
 535 #endif
 536 #if defined(PNG_READ_pCAL_SUPPORTED)
 537    else if (!png_memcmp(png_ptr->chunk_name, png_pCAL, 4))
 538    {
 539       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 540       {
 541          png_push_save_buffer(png_ptr);
 542          return;
 543       }
 544       png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length);
 545    }
 546 #endif
 547 #if defined(PNG_READ_sCAL_SUPPORTED)
 548    else if (!png_memcmp(png_ptr->chunk_name, png_sCAL, 4))
 549    {
 550       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 551       {
 552          png_push_save_buffer(png_ptr);
 553          return;
 554       }
 555       png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length);
 556    }
 557 #endif
 558 #if defined(PNG_READ_tIME_SUPPORTED)
 559    else if (!png_memcmp(png_ptr->chunk_name, png_tIME, 4))
 560    {
 561       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 562       {
 563          png_push_save_buffer(png_ptr);
 564          return;
 565       }
 566       png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length);
 567    }
 568 #endif
 569 #if defined(PNG_READ_tEXt_SUPPORTED)
 570    else if (!png_memcmp(png_ptr->chunk_name, png_tEXt, 4))
 571    {
 572       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 573       {
 574          png_push_save_buffer(png_ptr);
 575          return;
 576       }
 577       png_push_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
 578    }
 579 #endif
 580 #if defined(PNG_READ_zTXt_SUPPORTED)
 581    else if (!png_memcmp(png_ptr->chunk_name, png_zTXt, 4))
 582    {
 583       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 584       {
 585          png_push_save_buffer(png_ptr);
 586          return;
 587       }
 588       png_push_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
 589    }
 590 #endif
 591 #if defined(PNG_READ_iTXt_SUPPORTED)
 592    else if (!png_memcmp(png_ptr->chunk_name, png_iTXt, 4))
 593    {
 594       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 595       {
 596          png_push_save_buffer(png_ptr);
 597          return;
 598       }
 599       png_push_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
 600    }
 601 #endif
 602 #if defined(PNG_READ_APNG_SUPPORTED)
 603    else if (!png_memcmp(png_ptr->chunk_name, png_acTL, 4))
 604    {
 605       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 606       {
 607          png_push_save_buffer(png_ptr);
 608          return;
 609       }
 610       png_handle_acTL(png_ptr, info_ptr, png_ptr->push_length);
 611    }
 612    else if (!png_memcmp(png_ptr->chunk_name, png_fcTL, 4))
 613    {
 614       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 615       {
 616          png_push_save_buffer(png_ptr);
 617          return;
 618       }
 619       png_handle_fcTL(png_ptr, info_ptr, png_ptr->push_length);
 620    }
 621    else if (!png_memcmp(png_ptr->chunk_name, png_fdAT, 4))
 622    {
 623       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 624       {
 625          png_push_save_buffer(png_ptr);
 626          return;
 627       }
 628       png_handle_fdAT(png_ptr, info_ptr, png_ptr->push_length);
 629    }
 630 #endif /* PNG_READ_APNG_SUPPORTED */
 631    else
 632    {
 633       if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 634       {
 635          png_push_save_buffer(png_ptr);
 636          return;
 637       }
 638       png_push_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
 639    }
 640
 641    png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
 642 }
 643
 644 void /* PRIVATE */
 645 png_push_crc_skip(png_structp png_ptr, png_uint_32 skip)
 646 {
 647    png_ptr->process_mode = PNG_SKIP_MODE;
 648    png_ptr->skip_length = skip;
 649 }
 650
 651 void /* PRIVATE */
 652 png_push_crc_finish(png_structp png_ptr)
 653 {
 654    if (png_ptr->skip_length && png_ptr->save_buffer_size)
 655    {
 656       png_size_t save_size;
 657
 658       if (png_ptr->skip_length < (png_uint_32)png_ptr->save_buffer_size)
 659          save_size = (png_size_t)png_ptr->skip_length;
 660       else
 661          save_size = png_ptr->save_buffer_size;
 662
 663       png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
 664
 665       png_ptr->skip_length -= save_size;
 666       png_ptr->buffer_size -= save_size;
 667       png_ptr->save_buffer_size -= save_size;
 668       png_ptr->save_buffer_ptr += save_size;
 669    }
 670    if (png_ptr->skip_length && png_ptr->current_buffer_size)
 671    {
 672       png_size_t save_size;
 673
 674       if (png_ptr->skip_length < (png_uint_32)png_ptr->current_buffer_size)
 675          save_size = (png_size_t)png_ptr->skip_length;
 676       else
 677          save_size = png_ptr->current_buffer_size;
 678
 679       png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
 680
 681       png_ptr->skip_length -= save_size;
 682       png_ptr->buffer_size -= save_size;
 683       png_ptr->current_buffer_size -= save_size;
 684       png_ptr->current_buffer_ptr += save_size;
 685    }
 686    if (!png_ptr->skip_length)
 687    {
 688       if (png_ptr->buffer_size < 4)
 689       {
 690          png_push_save_buffer(png_ptr);
 691          return;
 692       }
 693
 694       png_crc_finish(png_ptr, 0);
 695       png_ptr->process_mode = PNG_READ_CHUNK_MODE;
 696    }
 697 }
 698
 699 void PNGAPI
 700 png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
 701 {
 702    png_bytep ptr;
 703
 704    if (png_ptr == NULL) return;
 705    ptr = buffer;
 706    if (png_ptr->save_buffer_size)
 707    {
 708       png_size_t save_size;
 709
 710       if (length < png_ptr->save_buffer_size)
 711          save_size = length;
 712       else
 713          save_size = png_ptr->save_buffer_size;
 714
 715       png_memcpy(ptr, png_ptr->save_buffer_ptr, save_size);
 716       length -= save_size;
 717       ptr += save_size;
 718       png_ptr->buffer_size -= save_size;
 719       png_ptr->save_buffer_size -= save_size;
 720       png_ptr->save_buffer_ptr += save_size;
 721    }
 722    if (length && png_ptr->current_buffer_size)
 723    {
 724       png_size_t save_size;
 725
 726       if (length < png_ptr->current_buffer_size)
 727          save_size = length;
 728       else
 729          save_size = png_ptr->current_buffer_size;
 730
 731       png_memcpy(ptr, png_ptr->current_buffer_ptr, save_size);
 732       png_ptr->buffer_size -= save_size;
 733       png_ptr->current_buffer_size -= save_size;
 734       png_ptr->current_buffer_ptr += save_size;
 735    }
 736 }
 737
 738 void /* PRIVATE */
 739 png_push_save_buffer(png_structp png_ptr)
 740 {
 741    if (png_ptr->save_buffer_size)
 742    {
 743       if (png_ptr->save_buffer_ptr != png_ptr->save_buffer)
 744       {
 745          png_size_t i, istop;
 746          png_bytep sp;
 747          png_bytep dp;
 748
 749          istop = png_ptr->save_buffer_size;
 750          for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer;
 751             i < istop; i++, sp++, dp++)
 752          {
 753             *dp = *sp;
 754          }
 755       }
 756    }
 757    if (png_ptr->save_buffer_size + png_ptr->current_buffer_size >
 758       png_ptr->save_buffer_max)
 759    {
 760       png_size_t new_max;
 761       png_bytep old_buffer;
 762
 763       if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
 764          (png_ptr->current_buffer_size + 256))
 765       {
 766         png_error(png_ptr, "Potential overflow of save_buffer");
 767       }
 768       new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
 769       old_buffer = png_ptr->save_buffer;
 770       png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr,
 771          (png_uint_32)new_max);
 772       png_memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
 773       png_free(png_ptr, old_buffer);
 774       png_ptr->save_buffer_max = new_max;
 775    }
 776    if (png_ptr->current_buffer_size)
 777    {
 778       png_memcpy(png_ptr->save_buffer + png_ptr->save_buffer_size,
 779          png_ptr->current_buffer_ptr, png_ptr->current_buffer_size);
 780       png_ptr->save_buffer_size += png_ptr->current_buffer_size;
 781       png_ptr->current_buffer_size = 0;
 782    }
 783    png_ptr->save_buffer_ptr = png_ptr->save_buffer;
 784    png_ptr->buffer_size = 0;
 785 }
 786
 787 void /* PRIVATE */
 788 png_push_restore_buffer(png_structp png_ptr, png_bytep buffer,
 789    png_size_t buffer_length)
 790 {
 791    png_ptr->current_buffer = buffer;
 792    png_ptr->current_buffer_size = buffer_length;
 793    png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size;
 794    png_ptr->current_buffer_ptr = png_ptr->current_buffer;
 795 }
 796
 797 void /* PRIVATE */
 798 png_push_read_IDAT(png_structp png_ptr)
 799 {
 800 #ifdef PNG_USE_LOCAL_ARRAYS
 801    PNG_IDAT;
 802 #if defined(PNG_READ_APNG_SUPPORTED)
 803    PNG_fdAT;
 804    PNG_IEND;
 805 #endif
 806 #endif
 807    if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER))
 808    {
 809       png_byte chunk_length[4];
 810
 811       if (png_ptr->buffer_size < 12)
 812       {
 813          png_push_save_buffer(png_ptr);
 814          return;
 815       }
 816
 817       png_push_fill_buffer(png_ptr, chunk_length, 4);
 818       png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
 819       png_reset_crc(png_ptr);
 820       png_crc_read(png_ptr, png_ptr->chunk_name, 4);
 821       png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
 822
 823 #if defined(PNG_READ_APNG_SUPPORTED)
 824       if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_fdAT, 4)
 825           && png_ptr->num_frames_read > 0)
 826       {
 827           if (png_ptr->flags & PNG_FLAG_ZLIB_FINISHED)
 828           {
 829               png_ptr->process_mode = PNG_READ_CHUNK_MODE;
 830               if (png_ptr->frame_end_fn != NULL)
 831                  (*(png_ptr->frame_end_fn))(png_ptr, png_ptr->num_frames_read);
 832               png_ptr->num_frames_read++;
 833               return;
 834           }
 835           else
 836           {
 837               if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
 838                   png_error(png_ptr, "Not enough image data");
 839               if (png_ptr->push_length + 4 > png_ptr->buffer_size)
 840               {
 841                  png_push_save_buffer(png_ptr);
 842                  return;
 843               }
 844               png_warning(png_ptr, "Skipping (ignoring) a chunk between "
 845                                    "APNG chunks");
 846               png_crc_finish(png_ptr, png_ptr->push_length);
 847               png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
 848               return;
 849           }
 850       }
 851       else
 852 #endif
 853       if ( png_memcmp(png_ptr->chunk_name, png_IDAT, 4)
 854                 && (png_ptr->num_frames_read == 0) )
 855       {
 856          png_ptr->process_mode = PNG_READ_CHUNK_MODE;
 857          if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
 858             png_error(png_ptr, "Not enough compressed data");
 859 #if defined(PNG_READ_APNG_SUPPORTED)
 860          if (png_ptr->frame_end_fn != NULL)
 861             (*(png_ptr->frame_end_fn))(png_ptr, png_ptr->num_frames_read);
 862          png_ptr->num_frames_read++;
 863 #endif
 864          return;
 865       }
 866
 867       png_ptr->idat_size = png_ptr->push_length;
 868
 869 #if defined(PNG_READ_APNG_SUPPORTED)
 870       if (png_ptr->num_frames_read > 0)
 871       {
 872          png_ensure_sequence_number(png_ptr, 4);
 873          png_ptr->idat_size -= 4;
 874       }
 875 #endif
 876    }
 877    if (png_ptr->idat_size && png_ptr->save_buffer_size)
 878    {
 879       png_size_t save_size;
 880
 881       if (png_ptr->idat_size < (png_uint_32)png_ptr->save_buffer_size)
 882       {
 883          save_size = (png_size_t)png_ptr->idat_size;
 884          /* check for overflow */
 885          if ((png_uint_32)save_size != png_ptr->idat_size)
 886             png_error(png_ptr, "save_size overflowed in pngpread");
 887       }
 888       else
 889          save_size = png_ptr->save_buffer_size;
 890
 891       png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
 892       if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
 893          png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size);
 894       png_ptr->idat_size -= save_size;
 895       png_ptr->buffer_size -= save_size;
 896       png_ptr->save_buffer_size -= save_size;
 897       png_ptr->save_buffer_ptr += save_size;
 898    }
 899    if (png_ptr->idat_size && png_ptr->current_buffer_size)
 900    {
 901       png_size_t save_size;
 902
 903       if (png_ptr->idat_size < (png_uint_32)png_ptr->current_buffer_size)
 904       {
 905          save_size = (png_size_t)png_ptr->idat_size;
 906          /* check for overflow */
 907          if ((png_uint_32)save_size != png_ptr->idat_size)
 908             png_error(png_ptr, "save_size overflowed in pngpread");
 909       }
 910       else
 911          save_size = png_ptr->current_buffer_size;
 912
 913       png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
 914       if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
 915         png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
 916
 917       png_ptr->idat_size -= save_size;
 918       png_ptr->buffer_size -= save_size;
 919       png_ptr->current_buffer_size -= save_size;
 920       png_ptr->current_buffer_ptr += save_size;
 921    }
 922    if (!png_ptr->idat_size)
 923    {
 924       if (png_ptr->buffer_size < 4)
 925       {
 926          png_push_save_buffer(png_ptr);
 927          return;
 928       }
 929
 930       png_crc_finish(png_ptr, 0);
 931       png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
 932       png_ptr->mode |= PNG_AFTER_IDAT;
 933    }
 934 }
 935
 936 void /* PRIVATE */
 937 png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
 938    png_size_t buffer_length)
 939 {
 940    int ret;
 941
 942    if ((png_ptr->flags & PNG_FLAG_ZLIB_FINISHED) && buffer_length)
 943       png_error(png_ptr, "Extra compression data");
 944
 945    png_ptr->zstream.next_in = buffer;
 946    png_ptr->zstream.avail_in = (uInt)buffer_length;
 947    for (;;)
 948    {
 949       ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
 950       if (ret != Z_OK)
 951       {
 952          if (ret == Z_STREAM_END)
 953          {
 954             if (png_ptr->zstream.avail_in)
 955                png_error(png_ptr, "Extra compressed data");
 956             if (!(png_ptr->zstream.avail_out))
 957             {
 958                png_push_process_row(png_ptr);
 959             }
 960
 961             png_ptr->mode |= PNG_AFTER_IDAT;
 962             png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
 963             break;
 964          }
 965          else if (ret == Z_BUF_ERROR)
 966             break;
 967          else
 968             png_error(png_ptr, "Decompression Error");
 969       }
 970       if (!(png_ptr->zstream.avail_out))
 971       {
 972          if ((
 973 #if defined(PNG_READ_INTERLACING_SUPPORTED)
 974              png_ptr->interlaced && png_ptr->pass > 6) ||
 975              (!png_ptr->interlaced &&
 976 #endif
 977              png_ptr->row_number == png_ptr->num_rows))
 978          {
 979            if (png_ptr->zstream.avail_in)
 980              png_warning(png_ptr, "Too much data in IDAT chunks");
 981            png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
 982            break;
 983          }
 984          png_push_process_row(png_ptr);
 985          png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
 986          png_ptr->zstream.next_out = png_ptr->row_buf;
 987       }
 988       else
 989          break;
 990    }
 991 }
 992
 993 void /* PRIVATE */
 994 png_push_process_row(png_structp png_ptr)
 995 {
 996    png_ptr->row_info.color_type = png_ptr->color_type;
 997    png_ptr->row_info.width = png_ptr->iwidth;
 998    png_ptr->row_info.channels = png_ptr->channels;
 999    png_ptr->row_info.bit_depth = png_ptr->bit_depth;
1000    png_ptr->row_info.pixel_depth = png_ptr->pixel_depth;
1001
1002    png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
1003        png_ptr->row_info.width);
1004
1005    png_read_filter_row(png_ptr, &(png_ptr->row_info),
1006       png_ptr->row_buf + 1, png_ptr->prev_row + 1,
1007       (int)(png_ptr->row_buf[0]));
1008
1009    png_memcpy_check(png_ptr, png_ptr->prev_row, png_ptr->row_buf,
1010       png_ptr->rowbytes + 1);
1011
1012    if (png_ptr->transformations || (png_ptr->flags&PNG_FLAG_STRIP_ALPHA))
1013       png_do_read_transformations(png_ptr);
1014
1015 #if defined(PNG_READ_INTERLACING_SUPPORTED)
1016    /* blow up interlaced rows to full size */
1017    if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE))
1018    {
1019       if (png_ptr->pass < 6)
1020 /*       old interface (pre-1.0.9):
1021          png_do_read_interlace(&(png_ptr->row_info),
1022             png_ptr->row_buf + 1, png_ptr->pass, png_ptr->transformations);
1023  */
1024          png_do_read_interlace(png_ptr);
1025
1026     switch (png_ptr->pass)
1027     {
1028          case 0:
1029          {
1030             int i;
1031             for (i = 0; i < 8 && png_ptr->pass == 0; i++)
1032             {
1033                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
1034                png_read_push_finish_row(png_ptr); /* updates png_ptr->pass */
1035             }
1036             if (png_ptr->pass == 2) /* pass 1 might be empty */
1037             {
1038                for (i = 0; i < 4 && png_ptr->pass == 2; i++)
1039                {
1040                   png_push_have_row(png_ptr, png_bytep_NULL);
1041                   png_read_push_finish_row(png_ptr);
1042                }
1043             }
1044             if (png_ptr->pass == 4 && png_ptr->height <= 4)
1045             {
1046                for (i = 0; i < 2 && png_ptr->pass == 4; i++)
1047                {
1048                   png_push_have_row(png_ptr, png_bytep_NULL);
1049                   png_read_push_finish_row(png_ptr);
1050                }
1051             }
1052             if (png_ptr->pass == 6 && png_ptr->height <= 4)
1053             {
1054                 png_push_have_row(png_ptr, png_bytep_NULL);
1055                 png_read_push_finish_row(png_ptr);
1056             }
1057             break;
1058          }
1059          case 1:
1060          {
1061             int i;
1062             for (i = 0; i < 8 && png_ptr->pass == 1; i++)
1063             {
1064                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
1065                png_read_push_finish_row(png_ptr);
1066             }
1067             if (png_ptr->pass == 2) /* skip top 4 generated rows */
1068             {
1069                for (i = 0; i < 4 && png_ptr->pass == 2; i++)
1070                {
1071                   png_push_have_row(png_ptr, png_bytep_NULL);
1072                   png_read_push_finish_row(png_ptr);
1073                }
1074             }
1075             break;
1076          }
1077          case 2:
1078          {
1079             int i;
1080             for (i = 0; i < 4 && png_ptr->pass == 2; i++)
1081             {
1082                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
1083                png_read_push_finish_row(png_ptr);
1084             }
1085             for (i = 0; i < 4 && png_ptr->pass == 2; i++)
1086             {
1087                png_push_have_row(png_ptr, png_bytep_NULL);
1088                png_read_push_finish_row(png_ptr);
1089             }
1090             if (png_ptr->pass == 4) /* pass 3 might be empty */
1091             {
1092                for (i = 0; i < 2 && png_ptr->pass == 4; i++)
1093                {
1094                   png_push_have_row(png_ptr, png_bytep_NULL);
1095                   png_read_push_finish_row(png_ptr);
1096                }
1097             }
1098             break;
1099          }
1100          case 3:
1101          {
1102             int i;
1103             for (i = 0; i < 4 && png_ptr->pass == 3; i++)
1104             {
1105                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
1106                png_read_push_finish_row(png_ptr);
1107             }
1108             if (png_ptr->pass == 4) /* skip top two generated rows */
1109             {
1110                for (i = 0; i < 2 && png_ptr->pass == 4; i++)
1111                {
1112                   png_push_have_row(png_ptr, png_bytep_NULL);
1113                   png_read_push_finish_row(png_ptr);
1114                }
1115             }
1116             break;
1117          }
1118          case 4:
1119          {
1120             int i;
1121             for (i = 0; i < 2 && png_ptr->pass == 4; i++)
1122             {
1123                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
1124                png_read_push_finish_row(png_ptr);
1125             }
1126             for (i = 0; i < 2 && png_ptr->pass == 4; i++)
1127             {
1128                png_push_have_row(png_ptr, png_bytep_NULL);
1129                png_read_push_finish_row(png_ptr);
1130             }
1131             if (png_ptr->pass == 6) /* pass 5 might be empty */
1132             {
1133                png_push_have_row(png_ptr, png_bytep_NULL);
1134                png_read_push_finish_row(png_ptr);
1135             }
1136             break;
1137          }
1138          case 5:
1139          {
1140             int i;
1141             for (i = 0; i < 2 && png_ptr->pass == 5; i++)
1142             {
1143                png_push_have_row(png_ptr, png_ptr->row_buf + 1);
1144                png_read_push_finish_row(png_ptr);
1145             }
1146             if (png_ptr->pass == 6) /* skip top generated row */
1147             {
1148                png_push_have_row(png_ptr, png_bytep_NULL);
1149                png_read_push_finish_row(png_ptr);
1150             }
1151             break;
1152          }
1153          case 6:
1154          {
1155             png_push_have_row(png_ptr, png_ptr->row_buf + 1);
1156             png_read_push_finish_row(png_ptr);
1157             if (png_ptr->pass != 6)
1158                break;
1159             png_push_have_row(png_ptr, png_bytep_NULL);
1160             png_read_push_finish_row(png_ptr);
1161          }
1162       }
1163    }
1164    else
1165 #endif
1166    {
1167       png_push_have_row(png_ptr, png_ptr->row_buf + 1);
1168       png_read_push_finish_row(png_ptr);
1169    }
1170 }
1171
1172 void /* PRIVATE */
1173 png_read_push_finish_row(png_structp png_ptr)
1174 {
1175 #ifdef PNG_USE_LOCAL_ARRAYS
1176    /* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
1177
1178    /* start of interlace block */
1179    PNG_CONST int FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0};
1180
1181    /* offset to next interlace block */
1182    PNG_CONST int FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1};
1183
1184    /* start of interlace block in the y direction */
1185    PNG_CONST int FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1};
1186
1187    /* offset to next interlace block in the y direction */
1188    PNG_CONST int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
1189
1190    /* Height of interlace block.  This is not currently used - if you need
1191     * it, uncomment it here and in png.h
1192    PNG_CONST int FARDATA png_pass_height[] = {8, 8, 4, 4, 2, 2, 1};
1193    */
1194 #endif
1195
1196    png_ptr->row_number++;
1197    if (png_ptr->row_number < png_ptr->num_rows)
1198       return;
1199
1200    if (png_ptr->interlaced)
1201    {
1202       png_ptr->row_number = 0;
1203       png_memset_check(png_ptr, png_ptr->prev_row, 0,
1204          png_ptr->rowbytes + 1);
1205       do
1206       {
1207          png_ptr->pass++;
1208          if ((png_ptr->pass == 1 && png_ptr->width < 5) ||
1209              (png_ptr->pass == 3 && png_ptr->width < 3) ||
1210              (png_ptr->pass == 5 && png_ptr->width < 2))
1211            png_ptr->pass++;
1212
1213          if (png_ptr->pass > 7)
1214             png_ptr->pass--;
1215          if (png_ptr->pass >= 7)
1216             break;
1217
1218          png_ptr->iwidth = (png_ptr->width +
1219             png_pass_inc[png_ptr->pass] - 1 -
1220             png_pass_start[png_ptr->pass]) /
1221             png_pass_inc[png_ptr->pass];
1222
1223          png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,
1224             png_ptr->iwidth) + 1;
1225
1226          if (png_ptr->transformations & PNG_INTERLACE)
1227             break;
1228
1229          png_ptr->num_rows = (png_ptr->height +
1230             png_pass_yinc[png_ptr->pass] - 1 -
1231             png_pass_ystart[png_ptr->pass]) /
1232             png_pass_yinc[png_ptr->pass];
1233
1234       } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0);
1235    }
1236 }
1237
1238 #if defined(PNG_READ_tEXt_SUPPORTED)
1239 void /* PRIVATE */
1240 png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
1241    length)
1242 {
1243    if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
1244       {
1245          png_error(png_ptr, "Out of place tEXt");
1246          info_ptr = info_ptr; /* to quiet some compiler warnings */
1247       }
1248
1249 #ifdef PNG_MAX_MALLOC_64K
1250    png_ptr->skip_length = 0;  /* This may not be necessary */
1251
1252    if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
1253    {
1254       png_warning(png_ptr, "tEXt chunk too large to fit in memory");
1255       png_ptr->skip_length = length - (png_uint_32)65535L;
1256       length = (png_uint_32)65535L;
1257    }
1258 #endif
1259
1260    png_ptr->current_text = (png_charp)png_malloc(png_ptr,
1261       (png_uint_32)(length + 1));
1262    png_ptr->current_text[length] = '\0';
1263    png_ptr->current_text_ptr = png_ptr->current_text;
1264    png_ptr->current_text_size = (png_size_t)length;
1265    png_ptr->current_text_left = (png_size_t)length;
1266    png_ptr->process_mode = PNG_READ_tEXt_MODE;
1267 }
1268
1269 void /* PRIVATE */
1270 png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
1271 {
1272    if (png_ptr->buffer_size && png_ptr->current_text_left)
1273    {
1274       png_size_t text_size;
1275
1276       if (png_ptr->buffer_size < png_ptr->current_text_left)
1277          text_size = png_ptr->buffer_size;
1278       else
1279          text_size = png_ptr->current_text_left;
1280       png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
1281       png_ptr->current_text_left -= text_size;
1282       png_ptr->current_text_ptr += text_size;
1283    }
1284    if (!(png_ptr->current_text_left))
1285    {
1286       png_textp text_ptr;
1287       png_charp text;
1288       png_charp key;
1289       int ret;
1290
1291       if (png_ptr->buffer_size < 4)
1292       {
1293          png_push_save_buffer(png_ptr);
1294          return;
1295       }
1296
1297       png_push_crc_finish(png_ptr);
1298
1299 #if defined(PNG_MAX_MALLOC_64K)
1300       if (png_ptr->skip_length)
1301          return;
1302 #endif
1303
1304       key = png_ptr->current_text;
1305
1306       for (text = key; *text; text++)
1307          /* empty loop */ ;
1308
1309       if (text < key + png_ptr->current_text_size)
1310          text++;
1311
1312       text_ptr = (png_textp)png_malloc(png_ptr,
1313          (png_uint_32)png_sizeof(png_text));
1314       text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
1315       text_ptr->key = key;
1316 #ifdef PNG_iTXt_SUPPORTED
1317       text_ptr->lang = NULL;
1318       text_ptr->lang_key = NULL;
1319 #endif
1320       text_ptr->text = text;
1321
1322       ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
1323
1324       png_free(png_ptr, key);
1325       png_free(png_ptr, text_ptr);
1326       png_ptr->current_text = NULL;
1327
1328       if (ret)
1329         png_warning(png_ptr, "Insufficient memory to store text chunk.");
1330    }
1331 }
1332 #endif
1333
1334 #if defined(PNG_READ_zTXt_SUPPORTED)
1335 void /* PRIVATE */
1336 png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
1337    length)
1338 {
1339    if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
1340       {
1341          png_error(png_ptr, "Out of place zTXt");
1342          info_ptr = info_ptr; /* to quiet some compiler warnings */
1343       }
1344
1345 #ifdef PNG_MAX_MALLOC_64K
1346    /* We can't handle zTXt chunks > 64K, since we don't have enough space
1347     * to be able to store the uncompressed data.  Actually, the threshold
1348     * is probably around 32K, but it isn't as definite as 64K is.
1349     */
1350    if (length > (png_uint_32)65535L)
1351    {
1352       png_warning(png_ptr, "zTXt chunk too large to fit in memory");
1353       png_push_crc_skip(png_ptr, length);
1354       return;
1355    }
1356 #endif
1357
1358    png_ptr->current_text = (png_charp)png_malloc(png_ptr,
1359       (png_uint_32)(length + 1));
1360    png_ptr->current_text[length] = '\0';
1361    png_ptr->current_text_ptr = png_ptr->current_text;
1362    png_ptr->current_text_size = (png_size_t)length;
1363    png_ptr->current_text_left = (png_size_t)length;
1364    png_ptr->process_mode = PNG_READ_zTXt_MODE;
1365 }
1366
1367 void /* PRIVATE */
1368 png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
1369 {
1370    if (png_ptr->buffer_size && png_ptr->current_text_left)
1371    {
1372       png_size_t text_size;
1373
1374       if (png_ptr->buffer_size < (png_uint_32)png_ptr->current_text_left)
1375          text_size = png_ptr->buffer_size;
1376       else
1377          text_size = png_ptr->current_text_left;
1378       png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
1379       png_ptr->current_text_left -= text_size;
1380       png_ptr->current_text_ptr += text_size;
1381    }
1382    if (!(png_ptr->current_text_left))
1383    {
1384       png_textp text_ptr;
1385       png_charp text;
1386       png_charp key;
1387       int ret;
1388       png_size_t text_size, key_size;
1389
1390       if (png_ptr->buffer_size < 4)
1391       {
1392          png_push_save_buffer(png_ptr);
1393          return;
1394       }
1395
1396       png_push_crc_finish(png_ptr);
1397
1398       key = png_ptr->current_text;
1399
1400       for (text = key; *text; text++)
1401          /* empty loop */ ;
1402
1403       /* zTXt can't have zero text */
1404       if (text >= key + png_ptr->current_text_size)
1405       {
1406          png_ptr->current_text = NULL;
1407          png_free(png_ptr, key);
1408          return;
1409       }
1410
1411       text++;
1412
1413       if (*text != PNG_TEXT_COMPRESSION_zTXt) /* check compression byte */
1414       {
1415          png_ptr->current_text = NULL;
1416          png_free(png_ptr, key);
1417          return;
1418       }
1419
1420       text++;
1421
1422       png_ptr->zstream.next_in = (png_bytep )text;
1423       png_ptr->zstream.avail_in = (uInt)(png_ptr->current_text_size -
1424          (text - key));
1425       png_ptr->zstream.next_out = png_ptr->zbuf;
1426       png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
1427
1428       key_size = text - key;
1429       text_size = 0;
1430       text = NULL;
1431       ret = Z_STREAM_END;
1432
1433       while (png_ptr->zstream.avail_in)
1434       {
1435          ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
1436          if (ret != Z_OK && ret != Z_STREAM_END)
1437          {
1438             inflateReset(&png_ptr->zstream);
1439             png_ptr->zstream.avail_in = 0;
1440             png_ptr->current_text = NULL;
1441             png_free(png_ptr, key);
1442             png_free(png_ptr, text);
1443             return;
1444          }
1445          if (!(png_ptr->zstream.avail_out) || ret == Z_STREAM_END)
1446          {
1447             if (text == NULL)
1448             {
1449                text = (png_charp)png_malloc(png_ptr,
1450                      (png_uint_32)(png_ptr->zbuf_size
1451                      - png_ptr->zstream.avail_out + key_size + 1));
1452                png_memcpy(text + key_size, png_ptr->zbuf,
1453                   png_ptr->zbuf_size - png_ptr->zstream.avail_out);
1454                png_memcpy(text, key, key_size);
1455                text_size = key_size + png_ptr->zbuf_size -
1456                   png_ptr->zstream.avail_out;
1457                *(text + text_size) = '\0';
1458             }
1459             else
1460             {
1461                png_charp tmp;
1462
1463                tmp = text;
1464                text = (png_charp)png_malloc(png_ptr, text_size +
1465                   (png_uint_32)(png_ptr->zbuf_size
1466                   - png_ptr->zstream.avail_out));
1467                png_memcpy(text, tmp, text_size);
1468                png_free(png_ptr, tmp);
1469                png_memcpy(text + text_size, png_ptr->zbuf,
1470                   png_ptr->zbuf_size - png_ptr->zstream.avail_out);
1471                text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
1472                *(text + text_size) = '\0';
1473             }
1474             if (ret != Z_STREAM_END)
1475             {
1476                png_ptr->zstream.next_out = png_ptr->zbuf;
1477                png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
1478             }
1479          }
1480          else
1481          {
1482             break;
1483          }
1484
1485          if (ret == Z_STREAM_END)
1486             break;
1487       }
1488
1489       inflateReset(&png_ptr->zstream);
1490       png_ptr->zstream.avail_in = 0;
1491
1492       if (ret != Z_STREAM_END)
1493       {
1494          png_ptr->current_text = NULL;
1495          png_free(png_ptr, key);
1496          png_free(png_ptr, text);
1497          return;
1498       }
1499
1500       png_ptr->current_text = NULL;
1501       png_free(png_ptr, key);
1502       key = text;
1503       text += key_size;
1504
1505       text_ptr = (png_textp)png_malloc(png_ptr,
1506           (png_uint_32)png_sizeof(png_text));
1507       text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
1508       text_ptr->key = key;
1509 #ifdef PNG_iTXt_SUPPORTED
1510       text_ptr->lang = NULL;
1511       text_ptr->lang_key = NULL;
1512 #endif
1513       text_ptr->text = text;
1514
1515       ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
1516
1517       png_free(png_ptr, key);
1518       png_free(png_ptr, text_ptr);
1519
1520       if (ret)
1521         png_warning(png_ptr, "Insufficient memory to store text chunk.");
1522    }
1523 }
1524 #endif
1525
1526 #if defined(PNG_READ_iTXt_SUPPORTED)
1527 void /* PRIVATE */
1528 png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
1529    length)
1530 {
1531    if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
1532       {
1533          png_error(png_ptr, "Out of place iTXt");
1534          info_ptr = info_ptr; /* to quiet some compiler warnings */
1535       }
1536
1537 #ifdef PNG_MAX_MALLOC_64K
1538    png_ptr->skip_length = 0;  /* This may not be necessary */
1539
1540    if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
1541    {
1542       png_warning(png_ptr, "iTXt chunk too large to fit in memory");
1543       png_ptr->skip_length = length - (png_uint_32)65535L;
1544       length = (png_uint_32)65535L;
1545    }
1546 #endif
1547
1548    png_ptr->current_text = (png_charp)png_malloc(png_ptr,
1549       (png_uint_32)(length + 1));
1550    png_ptr->current_text[length] = '\0';
1551    png_ptr->current_text_ptr = png_ptr->current_text;
1552    png_ptr->current_text_size = (png_size_t)length;
1553    png_ptr->current_text_left = (png_size_t)length;
1554    png_ptr->process_mode = PNG_READ_iTXt_MODE;
1555 }
1556
1557 void /* PRIVATE */
1558 png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
1559 {
1560
1561    if (png_ptr->buffer_size && png_ptr->current_text_left)
1562    {
1563       png_size_t text_size;
1564
1565       if (png_ptr->buffer_size < png_ptr->current_text_left)
1566          text_size = png_ptr->buffer_size;
1567       else
1568          text_size = png_ptr->current_text_left;
1569       png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
1570       png_ptr->current_text_left -= text_size;
1571       png_ptr->current_text_ptr += text_size;
1572    }
1573    if (!(png_ptr->current_text_left))
1574    {
1575       png_textp text_ptr;
1576       png_charp key;
1577       int comp_flag;
1578       png_charp lang;
1579       png_charp lang_key;
1580       png_charp text;
1581       int ret;
1582
1583       if (png_ptr->buffer_size < 4)
1584       {
1585          png_push_save_buffer(png_ptr);
1586          return;
1587       }
1588
1589       png_push_crc_finish(png_ptr);
1590
1591 #if defined(PNG_MAX_MALLOC_64K)
1592       if (png_ptr->skip_length)
1593          return;
1594 #endif
1595
1596       key = png_ptr->current_text;
1597
1598       for (lang = key; *lang; lang++)
1599          /* empty loop */ ;
1600
1601       if (lang < key + png_ptr->current_text_size - 3)
1602          lang++;
1603
1604       comp_flag = *lang++;
1605       lang++;     /* skip comp_type, always zero */
1606
1607       for (lang_key = lang; *lang_key; lang_key++)
1608          /* empty loop */ ;
1609       lang_key++;        /* skip NUL separator */
1610
1611       text=lang_key;
1612       if (lang_key < key + png_ptr->current_text_size - 1)
1613       {
1614         for (; *text; text++)
1615            /* empty loop */ ;
1616       }
1617
1618       if (text < key + png_ptr->current_text_size)
1619          text++;
1620
1621       text_ptr = (png_textp)png_malloc(png_ptr,
1622          (png_uint_32)png_sizeof(png_text));
1623       text_ptr->compression = comp_flag + 2;
1624       text_ptr->key = key;
1625       text_ptr->lang = lang;
1626       text_ptr->lang_key = lang_key;
1627       text_ptr->text = text;
1628       text_ptr->text_length = 0;
1629       text_ptr->itxt_length = png_strlen(text);
1630
1631       ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
1632
1633       png_ptr->current_text = NULL;
1634
1635       png_free(png_ptr, text_ptr);
1636       if (ret)
1637         png_warning(png_ptr, "Insufficient memory to store iTXt chunk.");
1638    }
1639 }
1640 #endif
1641
1642 /* This function is called when we haven't found a handler for this
1643  * chunk.  If there isn't a problem with the chunk itself (ie a bad chunk
1644  * name or a critical chunk), the chunk is (currently) silently ignored.
1645  */
1646 void /* PRIVATE */
1647 png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
1648    length)
1649 {
1650    png_uint_32 skip = 0;
1651
1652    if (!(png_ptr->chunk_name[0] & 0x20))
1653    {
1654 #if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
1655       if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
1656          PNG_HANDLE_CHUNK_ALWAYS
1657 #if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
1658          && png_ptr->read_user_chunk_fn == NULL
1659 #endif
1660          )
1661 #endif
1662          png_chunk_error(png_ptr, "unknown critical chunk");
1663
1664       info_ptr = info_ptr; /* to quiet some compiler warnings */
1665    }
1666
1667 #if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
1668    if (png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
1669    {
1670 #ifdef PNG_MAX_MALLOC_64K
1671       if (length > (png_uint_32)65535L)
1672       {
1673           png_warning(png_ptr, "unknown chunk too large to fit in memory");
1674           skip = length - (png_uint_32)65535L;
1675           length = (png_uint_32)65535L;
1676       }
1677 #endif
1678       png_memcpy((png_charp)png_ptr->unknown_chunk.name,
1679                  (png_charp)png_ptr->chunk_name,
1680                  png_sizeof(png_ptr->unknown_chunk.name));
1681       png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name) - 1]
1682         = '\0';
1683
1684       png_ptr->unknown_chunk.size = (png_size_t)length;
1685       if (length == 0)
1686          png_ptr->unknown_chunk.data = NULL;
1687       else
1688       {
1689          png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr,
1690        (png_uint_32)length);
1691          png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
1692       }
1693 #if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
1694       if (png_ptr->read_user_chunk_fn != NULL)
1695       {
1696          /* callback to user unknown chunk handler */
1697          int ret;
1698          ret = (*(png_ptr->read_user_chunk_fn))
1699            (png_ptr, &png_ptr->unknown_chunk);
1700          if (ret < 0)
1701             png_chunk_error(png_ptr, "error in user chunk");
1702          if (ret == 0)
1703          {
1704             if (!(png_ptr->chunk_name[0] & 0x20))
1705                if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
1706                     PNG_HANDLE_CHUNK_ALWAYS)
1707                   png_chunk_error(png_ptr, "unknown critical chunk");
1708             png_set_unknown_chunks(png_ptr, info_ptr,
1709                &png_ptr->unknown_chunk, 1);
1710          }
1711       }
1712       else
1713 #endif
1714         png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
1715       png_free(png_ptr, png_ptr->unknown_chunk.data);
1716       png_ptr->unknown_chunk.data = NULL;
1717    }
1718    else
1719 #endif
1720       skip=length;
1721    png_push_crc_skip(png_ptr, skip);
1722 }
1723
1724 void /* PRIVATE */
1725 png_push_have_info(png_structp png_ptr, png_infop info_ptr)
1726 {
1727    if (png_ptr->info_fn != NULL)
1728       (*(png_ptr->info_fn))(png_ptr, info_ptr);
1729 }
1730
1731 void /* PRIVATE */
1732 png_push_have_end(png_structp png_ptr, png_infop info_ptr)
1733 {
1734    if (png_ptr->end_fn != NULL)
1735       (*(png_ptr->end_fn))(png_ptr, info_ptr);
1736 }
1737
1738 void /* PRIVATE */
1739 png_push_have_row(png_structp png_ptr, png_bytep row)
1740 {
1741    if (png_ptr->row_fn != NULL)
1742       (*(png_ptr->row_fn))(png_ptr, row, png_ptr->row_number,
1743          (int)png_ptr->pass);
1744 }
1745
1746 void PNGAPI
1747 png_progressive_combine_row (png_structp png_ptr,
1748    png_bytep old_row, png_bytep new_row)
1749 {
1750 #ifdef PNG_USE_LOCAL_ARRAYS
1751    PNG_CONST int FARDATA png_pass_dsp_mask[7] =
1752       {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff};
1753 #endif
1754    if (png_ptr == NULL) return;
1755    if (new_row != NULL)    /* new_row must == png_ptr->row_buf here. */
1756       png_combine_row(png_ptr, old_row, png_pass_dsp_mask[png_ptr->pass]);
1757 }
1758
1759 void PNGAPI
1760 png_set_progressive_read_fn(png_structp png_ptr, png_voidp progressive_ptr,
1761    png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn,
1762    png_progressive_end_ptr end_fn)
1763 {
1764    if (png_ptr == NULL) return;
1765    png_ptr->info_fn = info_fn;
1766    png_ptr->row_fn = row_fn;
1767    png_ptr->end_fn = end_fn;
1768
1769    png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
1770 }
1771
1772 #if defined(PNG_READ_APNG_SUPPORTED)
1773 void PNGAPI
1774 png_set_progressive_frame_fn(png_structp png_ptr,
1775    png_progressive_frame_ptr frame_info_fn,
1776    png_progressive_frame_ptr frame_end_fn)
1777 {
1778    png_ptr->frame_info_fn = frame_info_fn;
1779    png_ptr->frame_end_fn = frame_end_fn;
1780 }
1781 #endif
1782
1783 png_voidp PNGAPI
1784 png_get_progressive_ptr(png_structp png_ptr)
1785 {
1786    if (png_ptr == NULL) return (NULL);
1787    return png_ptr->io_ptr;
1788 }
1789 #endif /* PNG_PROGRESSIVE_READ_SUPPORTED */