Filter selection, palette index checks

Palette index checking: checking on read was erroneously skipped.  pngcp can now
turn off the palette index checking or fix the errors (mainly to allow
comparison with libpng 1.6, which defaulted to ignoring it).  The API now
documents how the 'enabled' parameter works.  On read the check is on by default
(it was apparently off in libpng 1.6) however now if explicitly turned on the
warning message is stopped, this provides better interaction with
get_palette_max at the cost of a small API change (may need to be reviewed.)

Palette size errors: invalid entries in the palette are now set to #beaded to
make the errors more obvious and allow easy detection in memory.

Read transform pipeline caching: changes to fix the palette index check (which
are erroneously cached), the pipeline can now contain multiple caches.  E.g.
caching of packing of palette indices can be combined with caching of palette
RGB transforms.

Read code now checks for callbacks to read 0 data (and faults them).  Fixed the
reading of PNGs with multiple 0 length IDATs that failed as a result plus the
handling of zero length unknown.  (Which occurs, validly; the spurious warning
has been removed).

filter selection: the 1.6 and earlier sum of absolute differences algorithm has
been reintroduced with an option to disfavor some filters over others where the
sums are close (not yet exposed).  The selection code also logs the last known
occurence of each possible byte code across multiple lines.  This allows
detection of PNG images with lower bit depth than the format implies and,
therefore, allows the filtering to be turned off in those cases as well.

The default write zlib settings are still lower than libpng16.  The selection
algorithm is being refined (the overall results are worse than not doing any
filtering).

Signed-off-by: John Bowler <jbowler@acm.org>

contrib/examples/pngcp.c

@@ -92,6 +92,8 @@ typedef enum
 #define SIZES           0x080 /* Report input and output sizes */
 #define SEARCH          0x100 /* Search IDAT compression options */
 #define NOWRITE         0x200 /* Do not write an output file */
+#define IGNORE_INDEX    0x400 /* Ignore out of range palette indices (BAD!) */
+#define FIX_INDEX       0x800 /* 'Fix' out of range palette indices (OK) */
 #define OPTION     0x80000000 /* Used for handling options */
 #define LIST       0x80000001 /* Used for handling options */
 
@@ -229,6 +231,8 @@ static const struct option
    S(sizes,    SIZES)
    S(search,   SEARCH)
    S(nowrite,  NOWRITE)
+   S(ignore-palette-index, IGNORE_INDEX)
+   S(fix-palette-index, FIX_INDEX)
 #  undef S
 
    /* OPTION settings, these and LIST settings are read on demand */
@@ -1558,7 +1562,7 @@ read_function(png_structp pp, png_bytep data, png_size_t size)
 {
    struct display *dp = get_dp(pp);
 
-   if (fread(data, size, 1U, dp->fp) == 1U)
+   if (size == 0U || fread(data, size, 1U, dp->fp) == 1U)
       dp->read_size += size;
 
    else
@@ -1584,6 +1588,12 @@ read_png(struct display *dp, const char *filename)
 
    png_set_benign_errors(dp->read_pp, 1/*allowed*/);
 
+   if ((dp->options & FIX_INDEX) != 0)
+      png_set_check_for_invalid_index(dp->read_pp, 1/*on, no warning*/);
+
+   else if ((dp->options & IGNORE_INDEX) != 0) /* DANGEROUS */
+      png_set_check_for_invalid_index(dp->read_pp, -1/*off completely*/);
+
    /* The png_read_png API requires us to make the info struct, but it does the
     * call to png_read_info.
     */
@@ -1621,6 +1631,37 @@ read_png(struct display *dp, const char *filename)
       dp->size = rb * dp->h + dp->h/*filter byte*/;
    }
 
+   if (dp->ct == PNG_COLOR_TYPE_PALETTE && (dp->options & FIX_INDEX) != 0)
+   {
+      int max = png_get_palette_max(dp->read_pp, dp->ip);
+      png_colorp palette = NULL;
+      int num = -1;
+
+      if (png_get_PLTE(dp->read_pp, dp->ip, &palette, &num) != PNG_INFO_PLTE
+          || max < 0 || num <= 0 || palette == NULL)
+         display_log(dp, LIBPNG_ERROR, "invalid png_get_PLTE result");
+
+      if (max != num-1)
+      {
+         /* 'Fix' the palette. */
+         int i;
+         png_color newpal[256];
+
+         for (i=0; i<num && i<=max; ++i)
+            newpal[i] = palette[i];
+
+         /* Fill in any remainder with a warning color: */
+         for (; i<=max; ++i)
+         {
+            newpal[i].red = 0xbe;
+            newpal[i].green = 0xad;
+            newpal[i].blue = 0xed;
+         }
+
+         png_set_PLTE(dp->read_pp, dp->ip, newpal, i);
+      }
+   }
+
    display_clean_read(dp);
    dp->operation = "none";
 }
@@ -1744,6 +1785,9 @@ write_png(struct display *dp, const char *destname)
    png_set_benign_errors(dp->write_pp, 1/*allowed*/);
    png_set_write_fn(dp->write_pp, dp, write_function, NULL/*flush*/);
 
+   if ((dp->options & IGNORE_INDEX) != 0) /* DANGEROUS */
+      png_set_check_for_invalid_index(dp->write_pp, -1/*off completely*/);
+
    /* Restore the text chunks when using libpng 1.6 or less; this is a macro
     * which expands to nothing in 1.7+  In earlier versions it tests
     * dp->text_stashed, which is only set (below) *after* the first write.