Imported from pngcrush-1.5.9.tar

pngset.c

@@ -1,9 +1,9 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * libpng 1.2.1 - December 12, 2001
+ * libpng 1.2.4 - July 8, 2002
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2001 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2002 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -40,6 +40,25 @@ png_set_cHRM(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
+   if (white_x < 0.0 || white_y < 0.0 ||
+         red_x < 0.0 ||   red_y < 0.0 ||
+       green_x < 0.0 || green_y < 0.0 ||
+        blue_x < 0.0 ||  blue_y < 0.0)
+   {
+      png_warning(png_ptr,
+        "Ignoring attempt to set negative chromaticity value");
+      return;
+   }
+   if (white_x > 21474.83 || white_y > 21474.83 ||
+         red_x > 21474.83 ||   red_y > 21474.83 ||
+       green_x > 21474.83 || green_y > 21474.83 ||
+        blue_x > 21474.83 ||  blue_y > 21474.83)
+   {
+      png_warning(png_ptr,
+        "Ignoring attempt to set chromaticity value exceeding 21474.83");
+      return;
+   }
+
    info_ptr->x_white = (float)white_x;
    info_ptr->y_white = (float)white_y;
    info_ptr->x_red   = (float)red_x;
@@ -51,12 +70,12 @@ png_set_cHRM(png_structp png_ptr, png_infop info_ptr,
 #ifdef PNG_FIXED_POINT_SUPPORTED
    info_ptr->int_x_white = (png_fixed_point)(white_x*100000.+0.5);
    info_ptr->int_y_white = (png_fixed_point)(white_y*100000.+0.5);
-   info_ptr->int_x_red   = (png_fixed_point)(red_x*100000.+0.5);
-   info_ptr->int_y_red   = (png_fixed_point)(red_y*100000.+0.5);
+   info_ptr->int_x_red   = (png_fixed_point)(  red_x*100000.+0.5);
+   info_ptr->int_y_red   = (png_fixed_point)(  red_y*100000.+0.5);
    info_ptr->int_x_green = (png_fixed_point)(green_x*100000.+0.5);
    info_ptr->int_y_green = (png_fixed_point)(green_y*100000.+0.5);
-   info_ptr->int_x_blue  = (png_fixed_point)(blue_x*100000.+0.5);
-   info_ptr->int_y_blue  = (png_fixed_point)(blue_y*100000.+0.5);
+   info_ptr->int_x_blue  = (png_fixed_point)( blue_x*100000.+0.5);
+   info_ptr->int_y_blue  = (png_fixed_point)( blue_y*100000.+0.5);
 #endif
    info_ptr->valid |= PNG_INFO_cHRM;
 }
@@ -72,6 +91,24 @@ png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
+   if (white_x < 0 || white_y < 0 ||
+         red_x < 0 ||   red_y < 0 ||
+       green_x < 0 || green_y < 0 ||
+        blue_x < 0 ||  blue_y < 0)
+   {
+      png_warning(png_ptr,
+        "Ignoring attempt to set negative chromaticity value");
+      return;
+   }
+   if (white_x > (double) PNG_MAX_UINT || white_y > (double) PNG_MAX_UINT ||
+         red_x > (double) PNG_MAX_UINT ||   red_y > (double) PNG_MAX_UINT ||
+       green_x > (double) PNG_MAX_UINT || green_y > (double) PNG_MAX_UINT ||
+        blue_x > (double) PNG_MAX_UINT ||  blue_y > (double) PNG_MAX_UINT)
+   {
+      png_warning(png_ptr,
+        "Ignoring attempt to set chromaticity value exceeding 21474.83");
+      return;
+   }
    info_ptr->int_x_white = white_x;
    info_ptr->int_y_white = white_y;
    info_ptr->int_x_red   = red_x;
@@ -83,12 +120,12 @@ png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr,
 #ifdef PNG_FLOATING_POINT_SUPPORTED
    info_ptr->x_white = (float)(white_x/100000.);
    info_ptr->y_white = (float)(white_y/100000.);
-   info_ptr->x_red   = (float)(red_x/100000.);
-   info_ptr->y_red   = (float)(red_y/100000.);
+   info_ptr->x_red   = (float)(  red_x/100000.);
+   info_ptr->y_red   = (float)(  red_y/100000.);
    info_ptr->x_green = (float)(green_x/100000.);
    info_ptr->y_green = (float)(green_y/100000.);
-   info_ptr->x_blue  = (float)(blue_x/100000.);
-   info_ptr->y_blue  = (float)(blue_y/100000.);
+   info_ptr->x_blue  = (float)( blue_x/100000.);
+   info_ptr->y_blue  = (float)( blue_y/100000.);
 #endif
    info_ptr->valid |= PNG_INFO_cHRM;
 }
@@ -100,16 +137,25 @@ png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr,
 void PNGAPI
 png_set_gAMA(png_structp png_ptr, png_infop info_ptr, double file_gamma)
 {
+   double gamma;
    png_debug1(1, "in %s storage function\n", "gAMA");
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   info_ptr->gamma = (float)file_gamma;
+   /* Check for overflow */
+   if (file_gamma > 21474.83)
+   {
+      png_warning(png_ptr, "Limiting gamma to 21474.83");
+      gamma=21474.83;
+   }
+   else
+      gamma=file_gamma;
+   info_ptr->gamma = (float)gamma;
 #ifdef PNG_FIXED_POINT_SUPPORTED
-   info_ptr->int_gamma = (int)(file_gamma*100000.+.5);
+   info_ptr->int_gamma = (int)(gamma*100000.+.5);
 #endif
    info_ptr->valid |= PNG_INFO_gAMA;
-   if(file_gamma == 0.0)
+   if(gamma == 0.0)
       png_warning(png_ptr, "Setting gamma=0");
 }
 #endif
@@ -117,18 +163,35 @@ void PNGAPI
 png_set_gAMA_fixed(png_structp png_ptr, png_infop info_ptr, png_fixed_point
    int_gamma)
 {
+   png_fixed_point gamma;
+
    png_debug1(1, "in %s storage function\n", "gAMA");
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
+   if (int_gamma > (png_fixed_point) PNG_MAX_UINT)
+   {
+     png_warning(png_ptr, "Limiting gamma to 21474.83");
+     gamma=PNG_MAX_UINT;
+   }
+   else
+   {
+     if (int_gamma < 0)
+     {
+       png_warning(png_ptr, "Setting negative gamma to zero");
+       gamma=0;
+     }
+     else
+       gamma=int_gamma;
+   }
 #ifdef PNG_FLOATING_POINT_SUPPORTED
-   info_ptr->gamma = (float)(int_gamma/100000.);
+   info_ptr->gamma = (float)(gamma/100000.);
 #endif
 #ifdef PNG_FIXED_POINT_SUPPORTED
-   info_ptr->int_gamma = int_gamma;
+   info_ptr->int_gamma = gamma;
 #endif
    info_ptr->valid |= PNG_INFO_gAMA;
-   if(int_gamma == 0)
+   if(gamma == 0)
       png_warning(png_ptr, "Setting gamma=0");
 }
 #endif
@@ -137,7 +200,7 @@ png_set_gAMA_fixed(png_structp png_ptr, png_infop info_ptr, png_fixed_point
 void PNGAPI
 png_set_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_16p hist)
 {
-   int	i;
+   int i;
 
    png_debug1(1, "in %s storage function\n", "hIST");
    if (png_ptr == NULL || info_ptr == NULL)
@@ -153,8 +216,13 @@ png_set_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_16p hist)
    png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
 #endif
    /* Changed from info->num_palette to 256 in version 1.2.1 */
-   png_ptr->hist = (png_uint_16p)png_malloc(png_ptr,
+   png_ptr->hist = (png_uint_16p)png_malloc_warn(png_ptr,
       (png_uint_32)(256 * sizeof (png_uint_16)));
+   if (png_ptr->hist == NULL)
+     {
+       png_warning(png_ptr, "Insufficient memory for hIST chunk data.");
+       return;
+     }
 
    for (i = 0; i < info_ptr->num_palette; i++)
        png_ptr->hist[i] = hist[i];
@@ -254,7 +322,7 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr,
 
    /* check for overflow */
    rowbytes_per_pixel = (info_ptr->pixel_depth + 7) >> 3;
-   if (( width > PNG_MAX_UINT/rowbytes_per_pixel))
+   if ( width > PNG_MAX_UINT/rowbytes_per_pixel - 64)
    {
       png_warning(png_ptr,
          "Width too large to process image data; rowbytes will overflow.");
@@ -295,7 +363,12 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
 
    length = png_strlen(purpose) + 1;
    png_debug1(3, "allocating purpose for info (%lu bytes)\n", length);
-   info_ptr->pcal_purpose = (png_charp)png_malloc(png_ptr, length);
+   info_ptr->pcal_purpose = (png_charp)png_malloc_warn(png_ptr, length);
+   if (info_ptr->pcal_purpose == NULL)
+     {
+       png_warning(png_ptr, "Insufficient memory for pCAL purpose.");
+       return;
+     }
    png_memcpy(info_ptr->pcal_purpose, purpose, (png_size_t)length);
 
    png_debug(3, "storing X0, X1, type, and nparams in info\n");
@@ -306,11 +379,21 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
 
    length = png_strlen(units) + 1;
    png_debug1(3, "allocating units for info (%lu bytes)\n", length);
-   info_ptr->pcal_units = (png_charp)png_malloc(png_ptr, length);
+   info_ptr->pcal_units = (png_charp)png_malloc_warn(png_ptr, length);
+   if (info_ptr->pcal_units == NULL)
+     {
+       png_warning(png_ptr, "Insufficient memory for pCAL units.");
+       return;
+     }
    png_memcpy(info_ptr->pcal_units, units, (png_size_t)length);
 
-   info_ptr->pcal_params = (png_charpp)png_malloc(png_ptr,
+   info_ptr->pcal_params = (png_charpp)png_malloc_warn(png_ptr,
       (png_uint_32)((nparams + 1) * sizeof(png_charp)));
+   if (info_ptr->pcal_params == NULL)
+     {
+       png_warning(png_ptr, "Insufficient memory for pCAL params.");
+       return;
+     }
 
    info_ptr->pcal_params[nparams] = NULL;
 
@@ -318,7 +401,12 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
    {
       length = png_strlen(params[i]) + 1;
       png_debug2(3, "allocating parameter %d for info (%lu bytes)\n", i, length);
-      info_ptr->pcal_params[i] = (png_charp)png_malloc(png_ptr, length);
+      info_ptr->pcal_params[i] = (png_charp)png_malloc_warn(png_ptr, length);
+      if (info_ptr->pcal_params[i] == NULL)
+        {
+          png_warning(png_ptr, "Insufficient memory for pCAL parameter.");
+          return;
+        }
       png_memcpy(info_ptr->pcal_params[i], params[i], (png_size_t)length);
    }
 
@@ -415,6 +503,8 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr,
       in case of an invalid PNG file that has too-large sample values. */
    png_ptr->palette = (png_colorp)png_zalloc(png_ptr, (uInt)256,
       sizeof (png_color));
+   if (png_ptr->palette == NULL)
+      png_error(png_ptr, "Unable to malloc palette");
    png_memcpy(png_ptr->palette, palette, num_palette * sizeof (png_color));
    info_ptr->palette = png_ptr->palette;
    info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;
@@ -562,6 +652,16 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr,
 void PNGAPI
 png_set_text(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
    int num_text)
+{
+   int ret;
+   ret=png_set_text_2(png_ptr, info_ptr, text_ptr, num_text);
+   if (ret)
+     png_error(png_ptr, "Insufficient memory to store text");
+}
+
+int /* PRIVATE */
+png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
+   int num_text)
 {
    int i;
 
@@ -569,7 +669,7 @@ png_set_text(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
       "text" : (png_const_charp)png_ptr->chunk_name));
 
    if (png_ptr == NULL || info_ptr == NULL || num_text == 0)
-      return;
+      return(0);
 
    /* Make sure we have enough space in the "text" array in info_struct
     * to hold all of the incoming text_ptr objects.
@@ -584,8 +684,13 @@ png_set_text(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
          old_max = info_ptr->max_text;
          info_ptr->max_text = info_ptr->num_text + num_text + 8;
          old_text = info_ptr->text;
-         info_ptr->text = (png_textp)png_malloc(png_ptr,
+         info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_uint_32)(info_ptr->max_text * sizeof (png_text)));
+         if (info_ptr->text == NULL)
+           {
+             png_free(png_ptr, old_text);
+             return(1);
+           }
          png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max *
             sizeof(png_text)));
          png_free(png_ptr, old_text);
@@ -594,8 +699,10 @@ png_set_text(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
       {
          info_ptr->max_text = num_text + 8;
          info_ptr->num_text = 0;
-         info_ptr->text = (png_textp)png_malloc(png_ptr,
+         info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_uint_32)(info_ptr->max_text * sizeof (png_text)));
+         if (info_ptr->text == NULL)
+           return(1);
 #ifdef PNG_FREE_ME_SUPPORTED
          info_ptr->free_me |= PNG_FREE_TEXT;
 #endif
@@ -623,7 +730,7 @@ png_set_text(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
 #ifdef PNG_iTXt_SUPPORTED
       {
         /* set iTXt data */
-        if (text_ptr[i].key != NULL)
+        if (text_ptr[i].lang != NULL)
           lang_len = png_strlen(text_ptr[i].lang);
         else
           lang_len = 0;
@@ -655,8 +762,10 @@ png_set_text(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
          textp->compression = text_ptr[i].compression;
       }
 
-      textp->key = (png_charp)png_malloc(png_ptr,
+      textp->key = (png_charp)png_malloc_warn(png_ptr,
          (png_uint_32)(key_len + text_length + lang_len + lang_key_len + 4));
+      if (textp->key == NULL)
+        return(1);
       png_debug2(2, "Allocated %lu bytes at %x in png_set_text\n",
          (png_uint_32)(key_len + lang_len + lang_key_len + text_length + 4),
          (int)textp->key);
@@ -707,6 +816,7 @@ png_set_text(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr,
       info_ptr->num_text++;
       png_debug1(3, "transferred text chunk %d\n", info_ptr->num_text);
    }
+   return(0);
 }
 #endif
 
@@ -736,10 +846,10 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
    if (trans != NULL)
    {
        /*
-	* It may not actually be necessary to set png_ptr->trans here;
-	* we do it for backward compatibility with the way the png_handle_tRNS
-	* function used to do the allocation.
-	*/
+        * It may not actually be necessary to set png_ptr->trans here;
+        * we do it for backward compatibility with the way the png_handle_tRNS
+        * function used to do the allocation.
+        */
 #ifdef PNG_FREE_ME_SUPPORTED
        png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
 #endif
@@ -774,8 +884,13 @@ png_set_sPLT(png_structp png_ptr,
     png_sPLT_tp np;
     int i;
 
-    np = (png_sPLT_tp)png_malloc(png_ptr,
+    np = (png_sPLT_tp)png_malloc_warn(png_ptr,
         (info_ptr->splt_palettes_num + nentries) * sizeof(png_sPLT_t));
+    if (np == NULL)
+    {
+      png_warning(png_ptr, "No memory for sPLT palettes.");
+      return;
+    }
 
     png_memcpy(np, info_ptr->splt_palettes,
            info_ptr->splt_palettes_num * sizeof(png_sPLT_t));
@@ -818,9 +933,14 @@ png_set_unknown_chunks(png_structp png_ptr,
     if (png_ptr == NULL || info_ptr == NULL || num_unknowns == 0)
         return;
 
-    np = (png_unknown_chunkp)png_malloc(png_ptr,
+    np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
         (info_ptr->unknown_chunks_num + num_unknowns) *
         sizeof(png_unknown_chunk));
+    if (np == NULL)
+    {
+       png_warning(png_ptr, "Out of memory while processing unknown chunk.");
+       return;
+    }
 
     png_memcpy(np, info_ptr->unknown_chunks,
            info_ptr->unknown_chunks_num * sizeof(png_unknown_chunk));
@@ -834,11 +954,16 @@ png_set_unknown_chunks(png_structp png_ptr,
 
         png_strcpy((png_charp)to->name, (png_charp)from->name);
         to->data = (png_bytep)png_malloc(png_ptr, from->size);
-        png_memcpy(to->data, from->data, from->size);
-        to->size = from->size;
+        if (to->data == NULL)
+           png_warning(png_ptr, "Out of memory while processing unknown chunk.");
+        else
+        {
+          png_memcpy(to->data, from->data, from->size);
+          to->size = from->size;
 
-        /* note our location in the read or write sequence */
-        to->location = (png_byte)(png_ptr->mode & 0xff);
+          /* note our location in the read or write sequence */
+          to->location = (png_byte)(png_ptr->mode & 0xff);
+        }
     }
 
     info_ptr->unknown_chunks = np;
@@ -977,6 +1102,7 @@ png_set_invalid(png_structp png_ptr, png_infop info_ptr, int mask)
 }
 
 
+#ifndef PNG_1_0_X
 #ifdef PNG_ASSEMBLER_CODE_SUPPORTED
 /* this function was added to libpng 1.2.0 and should always exist by default */
 void PNGAPI
@@ -1015,8 +1141,8 @@ png_set_asm_flags (png_structp png_ptr, png_uint_32 asm_flags)
      * so first zero them out of the master copy, then logical-OR in the
      * allowed subset that was requested */
 
-    png_ptr->asm_flags &= ~settable_asm_flags;			/* zero them */
-    png_ptr->asm_flags |= (asm_flags & settable_asm_flags);	/* set them */
+    png_ptr->asm_flags &= ~settable_asm_flags;               /* zero them */
+    png_ptr->asm_flags |= (asm_flags & settable_asm_flags);  /* set them */
 }
 #endif /* ?PNG_ASSEMBLER_CODE_SUPPORTED */
 
@@ -1031,3 +1157,4 @@ png_set_mmx_thresholds (png_structp png_ptr,
     png_ptr->mmx_rowbytes_threshold = mmx_rowbytes_threshold;
 }
 #endif /* ?PNG_ASSEMBLER_CODE_SUPPORTED */
+#endif /* ?PNG_1_0_X */