mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng16] Free the unknown_chunks structure even when it contains no data.

Browse Source
This commit is contained in:
Glenn Randers-Pehrson 2015-03-09 09:05:39 -05:00
parent 0448d90f01
commit c062330846
5 changed files with 970 additions and 1624 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

729
ANNOUNCE
View File

@ -1,5 +1,4 @@
Libpng 1.6.17rc02 - March 9, 2015
Libpng 1.7.0beta55 - March 9, 2015
This is not intended to be a public release. It will be replaced This is not intended to be a public release. It will be replaced
within a few weeks by a public version or by another test version. within a few weeks by a public version or by another test version.
@ -9,742 +8,70 @@ Files available for download:
Source files with LF line endings (for Unix/Linux) and with a Source files with LF line endings (for Unix/Linux) and with a
"configure" script "configure" script
1.7.0beta55.tar.xz (LZMA-compressed, recommended) 1.6.17rc02.tar.xz (LZMA-compressed, recommended)
1.7.0beta55.tar.gz 1.6.17rc02.tar.gz
Source files with CRLF line endings (for Windows), without the Source files with CRLF line endings (for Windows), without the
"configure" script "configure" script
lp170b55.7z (LZMA-compressed, recommended) lp1617r02.7z (LZMA-compressed, recommended)
lp170b55.zip lp1617r02.zip
Other information: Other information:
1.7.0beta55-README.txt 1.6.17rc02-README.txt
1.7.0beta55-LICENSE.txt 1.6.17rc02-LICENSE.txt
libpng-1.7.0beta55-*.asc (armored detached GPG signatures) libpng-1.6.17rc02-*.asc (armored detached GPG signatures)
Changes since the last public release (1.6.0): Changes since the last public release (1.6.16):
Version 1.7.0alpha01 [December 15, 2012] Version 1.6.17beta01 [January 29, 2015]
Started 1.7.0 branch from libpng-1.6.0beta33. Removed duplicate PNG_SAFE_LIMITS_SUPPORTED handling from pngconf.h
Made 8-bit compose and rgb_to_grayscale accuracy improvements. These
changes cause 16-bit arithmetic to be used for 8-bit data in the gamma
corrected compose and grayscale operations. The arithmetic errors have
three sources all of which are fixed in this commit:
1) 8-bit linear calculations produce massive errors for lower intensity
values.
2) The old 16-bit "16 to 8" gamma table code erroneously wrote the lowest
output value into a table entry which corresponded to multiple output
values (so where the value written should have been the closest to the
transformed input value.)
3) In a number of cases the code to access the 16-bit table did not round;
it did a simple shift, which was wrong and made the side effects of (2)
even worse.
The new gamma code does not have the 16-to-8 problem at the cost of slightly
more calculations and the algorithm used to minimize the number of
calculations has been extended to all the 16-bit tables; it has advantages
for any significant gamma correction.
Rearranged png_struct, remove unused members, change png_set_filter handling
png_struct members rearranged - partly to reorder to avoid packing, partly
to put frequently accessed members at the start and partly to make
the grouping more clear. png_set_filter code has been rewritten and the
code shared with png_write_start_row moved to a common function. Comments
in png.h have been made more clear. Minor fixes to
contrib/libtests/timepng.c and some of the png_*_tRNS logic, including
more error detection in png_set_tRNS.
Cleaned up USER_LIMITS feature, removing members from png_struct when not
required.
Rearranged ARM-NEON optimizations to isolate the machine specific code to
the hardware subdirectory, and add comments to pngrutil.c so that
implementors of other optimizations will know what to do.
Fixed cases of unquoted DESTDIR in Makefile.am.
Rebuilt Makefile.in, configure, etc., with autoconf-2.69 and automake-1.12.5.
Version 1.7.0alpha02 [December 17, 2012]
Removed functions that were deprecated in libpng-1.6.0:
png_reset_zstream(), png_info_init_3(), and png_data_freer() and its
associated flags.
Removed some duplicated lines from contrib/tools/scale.c and png.c.
Changed some instances of png_warning() to png_app_error().
Updated some left over "1.6.0beta32" in code sources.
Fixed a "png_structp" prototype (should be png_structrp) in arm_init.c
Updated the version-number hack in pngvalid.c
Version 1.7.0alpha03 [December 19, 2012]
Cleaned up and enhanced the configure option; libpng now correctly
links and tests against zlib with a prefix; tests have been clarified; and
irrelevant or obsolete things (as defined by the autotools man page) have
been removed.
Documented new PNG_ABORT behavior in the manual and commentary in pngerror.c
Cleaned up whitespace in the synopsis portion of the manpage "libpng.3"
Fixed previous support for Z_PREFIX in configure builds, corrected sCAL APIs;
some of these use floating point arithmetic so they need to be disabled if
floating point arithmetic is switched off. This is a quiet API change -
previously it appeared that the APIs were supported if fixed point
arithmetic was used internally, however they required certain APIs (floor,
modf, frexp, atof) that are part of C floating point support. Changed
png_fixed and the gamma code specific version of the same to avoid floor(),
which may be a library function (not an intrinsic). Removed unused #if 0
code.
Disassembled the version number in scripts/options.awk (necessary for
building on SunOs).
Version 1.7.0alpha04 [December 23, 2012]
Added scripts/makefile.msys contributed by Christopher M. Wheeler
Made default Zlib compression settings be configurable. This adds #defines to
pnglibconf.h to control the defaults.
Fixed Windows build issues, enabled ARM compilation. Various warnings issued
by earlier versions of GCC fixed for Cygwin and Min/GW (which both use old
GCCs.) ARM support is enabled by default in zlib.props (unsupported by
Microsoft) and ARM compilation is made possible by deleting the check for
x86. The test programs cannot be run because they are not signed.
Version 1.7.0alpha05 [December 24, 2012]
Discontinued distributing libpng-1.x.x.tar.bz2.
Discontinued distributing libpng-1.7.0-1.6.0-diff.txt and similar.
Version 1.7.0alpha06 [January 1, 2013]
Fixed 'make distcheck' on SUN OS - libpng.so was not being removed
Version 1.7.0alpha07 [January 10, 2013]
Fixed conceivable but difficult to repro overflow. Also added two test
programs to generate and test a PNG which should have the problem.
Version 1.7.0alpha08 [January 17, 2013]
Corrected previous attempt at overflow detection in png_set_unknown_chunks()
(CVE-2013-7353). Added overflow detection in png_set_sPLT() and
png_set_text_2() (CVE-2013-7354).
Version 1.7.0alpha09 [January 21, 2013]
Pulled changes to multi-chunk handling from libpng-1.6.0beta40.
Version 1.7.0alpha10 [February 5, 2013]
Make symbol prefixing work with the ARM neon optimizations. Also
allow pngpriv.h to be included for preprocessor definitions only, so
it can be used in non-C/C++ files.
Added png_get_palette_max() function.
Changed png_size_t to size_t throughout headers, make sRGB check numbers
consistent.
Fixed ARM support (Mans Rullgard).
Removed stray out-of-order #endif and #ifdef (Mans Rullgard).
Ported libpng 1.5 options.awk/dfn file handling to 1.7, fixed one bug.
Rebuilt Makefile.in, configure, etc., with autoconf-2.69 and automake-1.13.
Minor fixes to assembler changes, verified with a dummy .S file
Removed cc -E workround, corrected png_get_palette_max API. Tested on
SUN OS cc 5.9, which demonstrates the tokenization problem previously
avoided by using /lib/cpp. Since all .dfn output is now protected
in double quotes unless it is to be macro substituted the fix should work
everywhere.
Version 1.7.0beta01 [February 15, 2013]
Enable parallel tests and rearrange TESTS order to take advantage of
the massive speed improvements use a make capable of parallel builds
on a multi-CPU machine and pass the right arguments to make (-j10000
for GNU make) to get the build to run in parallel.
Fixed previous support for Z_PREFIX in configure builds, corrected
sCAL APIs; some of these use floating point arithmetic so need to be
disabled if floating point arithmetic is switched off. This is a quiet API
change - previously it appeared that the APIs were supported if fixed point
arithmetic was used internally, however they required certain APIs (floor,
modf, frexp, atof) that are part of C floating point support. Changed
png_fixed and the gamma code specific version of the same to avoid floor(),
which may be a library function (not an intrinsic). Removed unused #if 0
code.
Fixed make distcheck to skip over the test result files. They were
being included because the whole of the 'tests' directory is included,
fixed to just include the actual test files and tests/pngstest. Also
reverted the previous erroneous change to remove the ${srcdir} from the
front of contrib, scripts, projects and added an explanation of what is
going on to Makefile.am
Fixed missing dependency in --prefix builds. The intermediate
internal 'prefix.h' file can only be generated correctly after pnglibconf.h,
however the dependency was not in Makefile.am. The symptoms are
unpredictable depending on the order make chooses to build pngprefix.h and
pnglibconf.h, often the error goes unnoticed because there is a system
pnglibconf.h to use instead.
Accept "," as a separator in pnglibconf.dfa and allow for
continuation lines. This adds to the syntax of "option" and "chunk" lines,
allowing the elements to be separated by a "," at the end of an element and
interpreting a "," at end of line as a continuation - so the following line
is read. The new syntax is optional and solely provided for readability.
Enclosed the new png_get_palette_max in #ifdef PNG_GET_PALETTE_MAX_SUPPORTED
block, and revised pnglibconf.h and pnglibconf.h.prebuilt accordingly.
Version 1.7.0beta02 [February 18, 2013]
Fixed a race condition in the creation of the build 'scripts' directory
while building with a parallel make.
Use approved/supported Android method to check for NEON, use Linux/POSIX
1003.1 API to check /proc/self/auxv avoiding buffer allocation and other
library calls (ported from libpng15).
Use parentheses more consistently in "#if defined(MACRO)" tests.
Folded long lines.
Version 1.7.0beta03 [February 22, 2013]
Reenabled code to allow zero length PLTE chunks for MNG.
Fixed ALIGNED_MEMORY support.
Allow run-time ARM NEON checking to be disabled. A new configure option:
--enable-arm-neon=always will stop the run-time checks. New checks
within arm/arm_init.c will cause the code not to be compiled unless
__ARM_NEON__ is set. This should make it fail safe (if someone asks
for it on then the build will fail if it can't be done.)
Updated the INSTALL document.
Version 1.7.0beta04 [February 27, 2013]
Revised INSTALL to recommend using CPPFLAGS instead of INCLUDES.
Revised scripts/makefile.freebsd to respect ZLIBLIB and ZLIBINC.
Revised scripts/dfn.awk to work with the buggy MSYS awk that has trouble
with CRLF line endings.
Version 1.7.0beta05 [March 5, 2013]
Avoid a possible memory leak in contrib/gregbook/readpng.c
Changed user chunk callback API to respect global and per chunk defaults.
Previously a return of 0 from a user chunk callback would result in the
chunk being saved (if this was safe, even if the chunk was unsafe-to-copy);
this change respects the defaults set by the application, so unknown chunks
can be discarded by default and known-safe ones preserved.
Corrected Android builds and corrected libpng.vers with symbol
prefixing. This adds an API to set optimization options externally,
providing an alternative and general solution for the non-portable
run-time tests used by the ARM Neon code. It also makes those tests
compile and link on Android. The order of settings vs options in
pnglibconf.h is reversed to allow settings to depend on options and
options can now set (or override) the defaults for settings.
Version 1.7.0beta06 [March 13, 2013]
Corrected simplified API default gamma for color-mapped output, added
a flag to change default. In 1.6.0 when the simplified API was used
to produce color-mapped output from an input image with no gamma
information the gamma assumed for the input could be different from
that assumed for non-color-mapped output. In particular 16-bit depth
input files were assumed to be sRGB encoded, whereas in the 'direct'
case they were assumed to have linear data. This was an error. The
fix makes the simplified API treat all input files the same way and
adds a new flag to the png_image::flags member to allow the
application/user to specify that 16-bit files contain sRGB data
rather than the default linear.
Fixed bugs in the pngpixel and makepng test programs.
Fixed CMakelists.txt to allow building a single variant of the library
(Claudio Bley):
Introduced a PNG_LIB_TARGETS variable that lists all activated library
targets. It is an error if this variable ends up empty, ie. you have
to build at least one library variant.
Made the *_COPY targets only depend on library targets actually being build.
Use PNG_LIB_TARGETS to unify a code path.
Changed the CREATE_SYMLINK macro to expect the full path to a file as the
first argument. When symlinking the filename component of that path is
determined and used as the link target.
Use copy_if_different in the CREATE_SYMLINK macro.
Eliminated two warnings from the Intel C compiler. The warnings are
technically valid, although a reasonable treatment of division would
show it to be incorrect.
Version 1.7.0beta07 [April 14, 2013]
Updated documentation of 1.5.x to 1.6.x changes in iCCP chunk handling.
Fixed incorrect warning of excess deflate data. End condition - the
warning would be produced if the end of the deflate stream wasn't read
in the last row. The warning is harmless.
Corrected the test on user transform changes on read. It was in the
png_set of the transform function, but that doesn't matter unless the
transform function changes the rowbuf size, and that is only valid if
transform_info is called.
Corrected a misplaced closing bracket in contrib/libtests/pngvalid.c
(Flavio Medeiros).
Corrected length written to uncompressed iTXt chunks (Samuli Suominen).
Version 1.7.0beta08 [April 18, 2013]
Added contrib/tools/fixitxt.c, to repair the erroneous iTXt chunk length
written by libpng-1.6.0 and 1.6.1.
Disallow storing sRGB information when the sRGB is not supported.
Version 1.7.0beta09 [April 24, 2013]
Exposed PNG chunk types in png.h
Modified png_uint_32 macros/code to make as few assumptions as possible
Revised stack marking in arm/filter_neon.S and configure.ac
Ensure that NEON filter stuff is completely disabled when switched 'off'.
Previously the ARM NEON specific files were still built if the option
was switched 'off' as opposed to being explicitly disabled.
Version 1.7.0beta10 [April 24, 2013]
Attempt to fix the PNG_ARM_NEON configuration mess.
Version 1.7.0beta11 [April 26, 2013]
Test for 'arm*', not just 'arm' in the host_cpu configure variable.
Version 1.7.0beta12 [April 30, 2013]
Added png_app_warning for out-of-range unknown chunk index in
png_set_unknown_chunk_location().
Expanded manual paragraph about writing private chunks.
Avoid dereferencing NULL pointer possibly returned from
png_create_write_struct() (Andrew Church).
Version 1.7.0beta13 [May 12, 2013]
Revised contrib/pngminim/*/makefile to generate pnglibconf.h with the
right zlib header files.
Separated CPPFLAGS and CFLAGS in contrib/pngminim/*/makefile
Updated contrib/pngminus/pnm2png.c (Paul Stewart):
Check for EOF
Ignore "#" delimited comments in input file to pnm2png.c.
Fixed whitespace handling
Added a call to png_set_packing()
Initialize dimension values so if sscanf fails at least we have known
invalid values.
Calculate our own zlib windowBits when decoding rather than trusting the
CMF bytes in the PNG datastream.
Added an option to force maximum window size for inflating, which was
the behavior of libpng15 and earlier.
Added png-fix-itxt and png-fix-too-far-back to the built programs and
removed warnings from the source code and timepng that are revealed as
a result.
Detect wrong libpng versions linked to png-fix-too-far-back, which currently
only works with libpng versions that can be made to reliably fail when
the deflate data contains an out-of-window reference. This means only
1.6 and later.
Attempt to detect configuration issues with png-fix-too-far-back, which
requires both the correct libpng and the correct zlib to function
correctly.
Check ZLIB_VERNUM for mismatches, enclose #error in quotes
Added information in the documentation about problems with and fixes for
the bad CRC and bad iTXt chunk situations.
Version 1.7.0beta14 [June 8, 2013]
Removed a redundant test in png_set_IHDR().
Added set(CMAKE_CONFIGURATION_TYPES ...) to CMakeLists.txt (Andrew Hundt)
Deleted set(CMAKE_BUILD_TYPE) block from CMakeLists.txt
Enclose the prototypes for the simplified write API in #ifdef STDIO/#endif
Make ARM NEON support work at compile time (not just configure time).
This moves the test on __ARM_NEON__ into pngconf.h to avoid issues when
using a compiler that compiles for multiple architectures at one time.
Removed PNG_FILTER_OPTIMIZATIONS and PNG_ARM_NEON_SUPPORTED from
pnglibconf.h, allowing more of the decisions to be made internally
(pngpriv.h) during the compile. Without this, symbol prefixing is broken
under certain circumstances on ARM platforms. Now only the API parts of
the optimizations ('check' vs 'api') are exposed in the public header files
except that the new setting PNG_ARM_NEON_OPT documents how libpng makes the
decision about whether or not to use the optimizations.
Protect symbol prefixing against CC/CPPFLAGS/CFLAGS useage.
Previous iOS/Xcode fixes for the ARM NEON optimizations moved the test
on __ARM_NEON__ from configure time to compile time. This breaks symbol
prefixing because the definition of the special png_init_filter_functions
call was hidden at configure time if the relevant compiler arguments are
passed in CFLAGS as opposed to CC. This change attempts to avoid all
the confusion that would result by declaring the init function even when
it is not used, so that it will always get prefixed.
Version 1.7.0beta15 [June 18, 2013]
Revised libpng.3 so that "doclifter" can process it.
Version 1.7.0beta16 [July 5, 2013]
Revised example.c to illustrate use of PNG_DEFAULT_sRGB and PNG_GAMMA_MAC_18
as parameters for png_set_gamma(). These have been available since
libpng-1.5.4.
Renamed contrib/tools/png-fix-too-far-back.c to pngfix.c and revised it
to check all compressed chunks known to libpng.
Updated documentation to show default behavior of benign errors correctly.
Added perfect hash code generation for lists of PNG chunks. This is
a work in progress; checked in for use in pngfix.c
Ported ARM no-read patch from libpng16.
Ported pngfix.c patches from libpng16.
Version 1.7.0beta17 [August 21, 2013]
Revised manual about changes in iTXt chunk handling made in libpng-1.6.0.
Added "/* SAFE */" comments in pngrutil.c and pngrtran.c where warnings
may be erroneously issued by code-checking applications.
Added information about png_set_options() to the manual.
Delay calling png_init_filter_functions() until a row with nonzero filter
is found.
Version 1.7.0beta18 [September 16, 2013]
Fixed inconsistent conditional compilation of png_chunk_unknown_handling()
prototype, definition, and usage. Made it depend on
PNG_HANDLE_AS_UNKNOWN_SUPPORTED everywhere.
Version 1.7.0beta19 [September 30, 2013]
Reverted the change to unknown handling #defines; the change breaks 'NOREAD'
builds.
Fixed default behavior of ARM_NEON_API. If the ARM NEON API option is
compiled without the CHECK option it defaulted to on, not off.
Catch up with recent libpng16 changes; unknown handling and spelling
corrections
Avoid up-cast warnings in pngvalid.c. On ARM the alignment requirements of
png_modifier are greater than that of png_store and as a consequence
compilation of pngvalid.c results in a warning about increased alignment
requirements because of the bare cast to (png_modifier*). The code is
safe, because the pointer is known to point to a stack allocated
png_modifier, but this change avoids the warning.
Fixed some grammatical changes and updated the png chunks list.
Version 1.7.0beta20 [October 13, 2013]
Made changes for compatibility with automake 1.14:
1) Added the 'compile' program to the list of programs that must be cleaned
in autogen.sh
2) Added 'subdir-objects' which causes .c files in sub-directories to be
compiled such that the corresponding .o files are also in the
sub-directory. This is because automake 1.14 warns that the
current behavior of compiling to the top level directory may be removed
in the future.
3) Updated dependencies on pnglibconf.h to match the new .o locations and
added all the files in contrib/libtests and contrib/tools that depend
on pnglibconf.h
4) Added 'BUILD_SOURCES = pnglibconf.h'; this is the automake recommended
way of handling the dependencies of sources that are machine generated;
unfortunately it only works if the user does 'make all' or 'make check',
so the dependencies (3) are still required.
Cleaned up (char*) casts of zlib messages. The latest version of the Intel C
compiler complains about casting a string literal as (char*), so copied the
treatment of z_const from the library code into pngfix.c
Simplified error message code in pngunknown. The simplification has the
useful side effect of avoiding a bogus warning generated by the latest
version of the Intel C compiler (it objects to
condition ? string-literal : string-literal).
Make autogen.sh work with automake 1.13 as well as 1.14. Do this by always
removing the 1.14 'compile' script but never checking for it.
Version 1.7.0beta21 [November 2, 2013]
Added ARMv8 support (James Yu <james.yu at linaro.org>). Added file
arm/filter_neon_intrinsics.c; enable with -mfpu=neon.
Revised pngvalid to generate size images with as many filters as it can
manage, limited by the number of rows.
Cleaned up ARM NEON compilation handling. The tests are now in pngpriv.h
and detect the broken GCC compilers.
Allow clang derived from older GCC versions to use ARM intrinsics. This
causes all clang builds that use -mfpu=neon to use the intrinsics code,
not the assembler code. This has only been tested on iOS 7. It may be
necessary to exclude some earlier clang versions but this seems unlikely.
Changed NEON implementation selection mechanism. This allows assembler
or intrinsics to be turned on at compile time during the build by defining
PNG_ARM_NEON_IMPLEMENTATION to the correct value (2 or 1). This macro
is undefined by default and the build type is selected in pngpriv.h.
Version 1.7.0beta22 [November 7, 2013]
Fixed #include in filter_neon_intrinsics.c and ctype macros. The ctype char
checking macros take an unsigned char argument, not a signed char.
Version 1.7.0beta23 [November 24, 2013]
Changed #ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED in pngpread.c to
#ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED to be consistent with
what is in pngpriv.h.
Moved prototype for png_handle_unknown() in pngpriv.h outside of
the #ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED/#endif block.
Added "-Wall" to CFLAGS in contrib/pngminim/*/makefile
Conditionally compile some unused functions reported by -Wall in
pngminim.
Fixed 'minimal' builds. Various obviously useful minimal configurations
don't build because of missing contrib/libtests test programs and
overly complex dependencies in scripts/pnglibconf.dfa. This change
adds contrib/conftest/*.dfa files that can be used in automatic build
scripts to ensure that these configurations continue to build.
Enabled WRITE_INVERT and WRITE_PACK in contrib/pngminim/encoder.
Fixed pngvalid 'fail' function declaration on the Intel C Compiler.
This reverts to the previous 'static' implementation and works round
the 'unused static function' warning by using PNG_UNUSED().
Version 1.7.0beta24 [December 15, 2013]
Removed or marked PNG_UNUSED some harmless "dead assignments" reported
by clang scan-build.
Changed tabs to 3 spaces in png_debug macros and changed '"%s"m'
to '"%s" m' to improve portability among compilers.
Changed png_free_default() to free() in pngtest.c
Tidied up pngfix inits and fixed pngtest no-write builds.
Bookkeeping: Moved functions around (no changes). Moved transform
function definitions before the place where they are called so that
they can be made static. Move the intrapixel functions and the
grayscale palette builder out of the png?tran.c files. The latter
isn't a transform function and is no longer used internally, and the
former MNG specific functions are better placed in pngread/pngwrite.c
Made transform implementation functions static. This makes the internal
functions called by png_do_{read|write}_transformations static. On an
x86-64 DLL build (Gentoo Linux) this reduces the size of the text
segment of the DLL by 1208 bytes, about 0.6%. It also simplifies
maintenance by removing the declarations from pngpriv.h and allowing
easier changes to the internal interfaces.
Handle zero-length PLTE chunk or NULL palette with png_error()
instead of png_chunk_report(), which by default issues a warning
rather than an error, leading to later reading from a NULL pointer
(png_ptr->palette) in png_do_expand_palette(). This is CVE-2013-6954
and VU#650142. Libpng-1.6.1 through 1.6.7 and libpng-1.7.0beta03
through 1.7.0beta23 are vulnerable. Libpng-1.6.0 and earlier do not
have the bug.
Version 1.7.0beta25 [December 26, 2013]
Merged files with version 1.6.8 that have not changed since then.
Rebuilt configure scripts with automake-1.14.1 and autoconf-2.69
Version 1.7.0beta26 [January 1, 2014]
Added libpng 1.5 checks to pngvalid.c
Merged with 1.5 and 1.6 changes to create a single pngvalid.c
Added dSIG to chunk list in png.h
Removed #error macro from contrib/tools/pngfix.c (Thomas Klausner).
Merged pngrio.c, pngtrans.c, and pngwio.c with libpng-1.6.9
Fixed test programs for interlace options. Made pngvalid.c and
pngtest.c work correctly when READ_INTERLACING and/or WRITE_INTERLACING
are switched off.
Changed pngvalid.c to support libpng 1.5, which does not support
the PNG_MAXIMUM_INFLATE_WINDOW option, so #define it out when
appropriate in pngvalid.c
Allow unversioned links created on install to be disabled in configure.
In configure builds 'make install' changes/adds links like png.h
and libpng.a to point to the newly installed, versioned, files (e.g.
libpng17/png.h and libpng17.a). Three new configure options and some
rearrangement of Makefile.am allow creation of these links to be disabled.
Version 1.7.0beta27 [January 10, 2014]
Removed potentially misleading warning from png_check_IHDR().
Version 1.7.0beta28 [January 20, 2014]
Updated scripts/makefile.* to use CPPFLAGS (Cosmin).
Added clang attribute support (Cosmin).
Version 1.7.0beta29 [January 30, 2014]
Quiet an uninitialized memory warning from VS2013 in png_get_png().
Version 1.7.0beta30 [February 2, 2014]
Fixed a large number of instances where PNGCBAPI was omitted from
function definitions.
Added pngimage test program for png_read_png and png_write_png. This
is a work-in-progress; no tests are run automatically at present and
the program by virtue of exhaustively testing all the transforms is
very slow.
Version 1.7.0beta31 [February 6, 2014]
Make png_read_png() and png_write_png() prototypes in png.h depend
upon PNG_READ_SUPPORTED and PNG_WRITE_SUPPORTED.
Removed dependence on !PNG_READ_EXPAND_SUPPORTED for calling
png_set_packing() in png_read_png().
Completed full working pngimage test program and added two test scripts.
Fixed combination of ~alpha with shift. On read invert alpha, processing
occurred after shift processing, which causes the final values to be
outside the range that should be produced by the shift. Reversing the
order on read makes the two transforms work together correctly and mirrors
the order used on write.
Do not read invalid sBIT chunks. Previously libpng only checked sBIT
values on write, so a malicious PNG writer could therefore cause
the read code to return an invalid sBIT chunk, which might lead to
application errors or crashes. Such chunks are now skipped (with
chunk_benign_error).
Restored a line, "c = b;", that was inadvertently deleted from the
PAETH filtering code from libpng-1.7.0beta24/pngrutil.c. Deleted
the other instance of "c = b;" which is the one that triggered a
scan-build warning.
Support builds with unsupported PNG_TRANSFORM_* values. All of the
PNG_TRANSFORM_* values are always defined in png.h and, because they
are used for both read and write in some cases, it is not reliable
to #if out ones that are totally unsupported. This change adds error
detection in png_read_image() and png_write_image() to do a
png_app_error() if the app requests something that cannot be done
and it adds corresponding code to pngimage.c to handle such options
by not attempting to test them.
Version 1.7.0beta32 [February 26, 2014]
Moved redefines of png_error(), png_warning(), png_chunk_error(),
and png_chunk_warning() from pngpriv.h to png.h to make them visible
to libpng-calling applications.
Moved OS dependent code from arm/arm_init.c, to allow the included
implementation of the ARM NEON discovery function to be set at
build-time and provide sample implementations from the current code in the
contrib/arm-neon subdirectory. The __linux__ code has also been changed to
compile and link on Android by using /proc/cpuinfo, and the old linux code
is in contrib/arm-neon/linux-auxv.c. The new code avoids POSIX and Linux
dependencies apart from opening /proc/cpuinfo and is C90 compliant.
Check for info_ptr == NULL early in png_read_end() so we don't need to
run all the png_handle_*() and depend on them to return if info_ptr == NULL.
This improves the performance of png_read_end(png_ptr, NULL) and makes
it more robust against future programming errors.
Check for __has_extension before using it in pngconf.h, to
support older Clang versions (Jeremy Sequoia).
Use a user warning handler in contrib/gregbook/readpng2.c instead of default,
so warnings will be put on stderr even if libpng has CONSOLE_IO disabled.
Added png_ptr->process_mode = PNG_READ_IDAT_MODE in png_push_read_chunk
after recognizing the IDAT chunk, which avoids an infinite loop while
reading a datastream whose first IDAT chunk is of zero-length.
This fixes CERT VU#684412 and CVE-2014-0333.
Don't recognize known sRGB profiles as sRGB if they have been hacked,
but don't reject them and don't issue a copyright violation warning.
Minor editing of contrib/arm-neon/README and contrib/examples/*.c
Moved some documentation from png.h to libpng.3 and libpng-manual.txt
Version 1.7.0beta33 [February 27, 2014]
Fixed typos in the manual and in scripts/pnglibconf.dfa (CFLAGS -> CPPFLAGS
and PNG_USR_CONFIG -> PNG_USER_CONFIG).
Version 1.7.0beta34 [March 17, 2014]
Treat CRC error handling with png_set_crc_action(), instead of with
png_set_benign_errors(), which has been the case since libpng-1.6.0beta18.
Use "if (value != 0)" instead of "if (value)" consistently.
Changed ZlibSrcDir from 1.2.5 to 1.2.8 in projects/vstudio.
Moved configuration information from the manual to the INSTALL file.
Version 1.7.0beta35 [August 6, 2014]
Removed #if/#else/#endif from inside two pow() calls in pngvalid.c because
they were handled improperly by Portland Group's PGI-14.1 - PGI-14.3
when using its "__builtin_pow()" function.
Silence 'unused parameter' build warnings (Cosmin).
$(CP) is now used alongside $(RM_F). Also, use 'copy' instead
of 'cp' where applicable, and applied other minor makefile changes.
Don't warn about invalid dimensions exceeding user limits.
Allow an easy replacement of the default pre-built configuration
header with a custom header, via the make PNGLIBCONF_H_PREBUILT
macro.
Fixed a typo in pngrutil.c, introduced in libpng-1.5.6, that interferes
with "blocky" expansion of sub-8-bit interlaced PNG files (Eric Huss).
Removed scripts/makefile.elf. It has not worked since libpng-1.5.0beta14
due to elimination of the PNG_FUNCTION_EXPORT and PNG_DATA_EXPORT
definitions from pngconf.h.
Ensure that CMakeLists.txt makes the target "lib" directory before making
symbolic link into it (SourceForge bug report #226 by Rolf Timmermans).
Added opinion that the ECCN (Export Control Classification Number) for
libpng is EAR99 to the README file.
Version 1.7.0beta36 [September 27, 2014]
Updated scripts/makefiles from libpng-1.6.13beta04.
Minor updates to the manual from libpng-1.6.14beta04.
Fixed incorrect handling of the iTXt compression flag in pngrutil.c
(bug report by Shunsaku Hirata). Bug was introduced in libpng-1.6.0.
Version 1.7.0beta37 [September 28, 2014]
Merged scripts/*, pngvalid.c and pngfix.c with libpng-1.6.14beta04.
Version 1.7.0beta38 [October 17, 2014]
Added "option READ_iCCP enables READ_COMPRESSED_TEXT" to pnglibconf.dfa
Removed unused "text_len" parameter from private function png_write_zTXt().
Conditionally compile some code in png_deflate_claim(), when
PNG_WARNINGS_SUPPORTED and PNG_ERROR_TEXT_SUPPORTED are disabled.
Replaced repeated code in pngpread.c with PNG_PUSH_SAVE_BUFFER_IF_FULL.
Added "chunk iTXt enables TEXT" and "chunk zTXt enables TEXT"
to pnglibconf.dfa.
Removed "option READ_COMPRESSED_TEXT enables READ_TEXT" from pnglibconf.dfa,
to make it possible to configure a libpng that supports iCCP but not TEXT.
Removed "option WRITE_COMPRESSED_TEXT enables WRITE_TEXT" from pnglibconf.dfa
Only mark text chunks as written after successfully writing them.
Version 1.7.0beta39 [November 1, 2014]
Ported cosmetic changes from libpng-1.6.15beta02.
Version 1.7.0beta40 [November 6, 2014]
Made a one-line revision to configure.ac to support ARM on aarch64
(bug report by Marcin Juszkiewicz, fix by John Bowler).
Use png_get_libpng_ver(NULL) instead of PNG_LIBPNG_VER_STRING in
example.c, pngtest.c, and applications in the contrib directory.
Avoid out-of-bounds memory access in png_user_version_check().
Simplified and future-proofed png_user_version_check().
Fixed GCC unsigned int->float warnings. Various versions of GCC
seem to generate warnings when an unsigned value is implicitly
converted to double. This is probably a GCC bug but this change
avoids the issue by explicitly converting to (int) where safe.
Free all allocated memory in pngimage. The file buffer cache was left
allocated at the end of the program, harmless but it causes memory
leak reports from clang.
Fixed array size calculations to avoid warnings. At various points
in the code the number of elements in an array is calculated using
sizeof. This generates a compile time constant of type (size_t) which
is then typically assigned to an (unsigned int) or (int). Some versions
of GCC on 64-bit systems warn about the apparent narrowing, even though
the same compiler does apparently generate the correct, in-range,
numeric constant. This adds appropriate, safe, casts to make the
warnings go away.
Version 1.7.0beta41 [November 7, 2014]
Added #ifdef PNG_16BIT_SUPPORTED/#endif around png_log16bit() and
png_do_swap().
Changed all "#endif /* PNG_FEATURE_SUPPORTED */" to "#endif /* FEATURE */"
Version 1.7.0beta42 [November 20, 2014]
The macros passed in the command line to Borland make were ignored if
similarly-named macros were already defined in makefiles. This behavior
is different from POSIX make and other make programs. Surround the
macro definitions with ifndef guards (Cosmin).
Added "-D_CRT_SECURE_NO_WARNINGS" to CFLAGS in scripts/makefile.vcwin32.
Removed the obsolete $ARCH variable from scripts/makefile.darwin.
Merged clang no-warning fix from libpng-1.6.13: png_digit was defined
but never used in pngerror.c.
Version 1.7.0beta43 [December 18, 2014]
Added ".align 2" to arm/filter_neon.S to support old GAS assemblers that
don't do alignment correctly.
Revised Makefile.am and scripts/*.dfn to work with MinGW/MSYS;
renamed scripts/*.dfn to scripts/*.c (Bob Friesenhahn and John Bowler).
Quiet a "comparison always true" warning in pngstest.c (John Bowler).
Version 1.7.0beta44 [December 23, 2014]
Restored a test on width that was removed from png.c at libpng-1.6.9
(Bug report by Alex Eubanks, CVE-2015-0973).
Fixed an overflow in png_combine_row() with very wide interlaced images
(Bug report and fix by John Bowler, CVE-2014-9495).
Corrected the width limit calculation in png_check_IHDR(). Corrected the width limit calculation in png_check_IHDR().
Removed extraneous handling of PNG_SAFE_LIMITS_SUPPORTED from pngconf.h
Version 1.7.0beta45 [December 28, 2014]
Eliminated the PNG_SAFE_LIMITS macro and restored the 1-million-column
and 1-million-row default limits in pnglibconf.dfa, that can be reset
by the user at build time or run time. This provides a more robust
defense against DOS and as-yet undiscovered overflows.
Removed user limits from pngfix. Also pass NULL pointers to Removed user limits from pngfix. Also pass NULL pointers to
png_read_row to skip the unnecessary row de-interlace stuff. png_read_row to skip the unnecessary row de-interlace stuff.
Added testing of png_set_packing() to pngvalid.c Added testing of png_set_packing() to pngvalid.c
Regenerated configure scripts in the *.tar distributions with libtool-2.4.4
Version 1.7.0beta46 [January 2, 2015]
Regenerated configure scripts in the tar distributions with libtool-2.4.4
Implement previously untested cases of libpng transforms in pngvalid.c Implement previously untested cases of libpng transforms in pngvalid.c
Fixed byte order in 2-byte filler, in png_do_read_filler(). Fixed byte order in 2-byte filler, in png_do_read_filler().
Allow user to call png_get_IHDR() with NULL arguments (Reuben Hawkins).
Version 1.7.0beta47 [January 29, 2015]
Made the check for out-of-range values in png_set_tRNS() detect Made the check for out-of-range values in png_set_tRNS() detect
values that are exactly 2^bit_depth, and work on 16-bit platforms. values that are exactly 2^bit_depth, and work on 16-bit platforms.
Added PNG_SKIP_sRGB_CHECK_PROFILE choice for png_set_option().
Report all IHDR errors before exiting png_check_IHDR().
Merged some parts of libpng-1.6.17beta01 and libpng-1.7.0beta47. Merged some parts of libpng-1.6.17beta01 and libpng-1.7.0beta47.
Added #ifndef __COVERITY__ where needed in png.c, pngrutil.c and Added #ifndef __COVERITY__ where needed in png.c, pngrutil.c and
pngset.c to avoid warnings about dead code. pngset.c to avoid warnings about dead code.
Version 1.7.0beta48 [February 7, 2015] Version 1.6.17beta02 [February 7, 2015]
Work around one more Coverity-scan dead-code warning. Work around one more Coverity-scan dead-code warning.
Do not build png_product2() when it is unused. Do not build png_product2() when it is unused.
Version 1.7.0beta49 [February 11, 2015] Version 1.6.17beta03 [February 17, 2015]
Combined sub_row, up_row, avg_row, and paeth_row buffers into a
single try_row buffer.
Added PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED macro, on by default.
Consolidated redundant code in pngwutil.c
Deal with integer overflow of sum in pngwutil.c
Version 1.7.0beta50 [February 15, 2015]
Combined sub_row, up_row, avg_row, and paeth_row buffers into a
single try_row buffer and in cases where two or more of those are
being tested, a second tst_row buffer. This improves CPU speed
over that achieved by libpng-1.7.0beta49.
Version 1.7.0beta51 [February 17, 2015]
Combined similar parts of png_write_find_filter() into a png_increase_lmins()
function.
Display user limits in the output from pngtest. Display user limits in the output from pngtest.
Replaced test for harmless integer overflow (wraparound) in pngwutil.c Eliminated the PNG_SAFE_LIMITS macro and restored the 1-million-column
with a method that prevents overflow and does not increase cpu usage and 1-million-row default limits in pnglibconf.dfa, that can be reset
significantly. by the user at build time or run time. This provides a more robust
defense against DOS and as-yet undiscovered overflows.
Version 1.7.0beta52 [February 21, 2015] Version 1.6.17beta04 [February 21, 2015]
Added information about setjmp/simplified API interaction in the Added PNG_WRITE_CUSTOMIZE_COMPRESSION_SUPPORTED macro, on by default.
manual page and INSTALL file. Added information about using Allow user to call png_get_IHDR() with NULL arguments (Reuben Hawkins).
row_pointers with a single height*width*bpp allocated block
Rebuilt configure scripts with automake-1.15 and libtool-2.4.6 Rebuilt configure scripts with automake-1.15 and libtool-2.4.6
Version 1.7.0beta53 [February 23, 2015] Version 1.6.17beta05 [February 25, 2015]
Restored compiling of png_reciprocal2 with PNG_NO_16BIT. Restored compiling of png_reciprocal2 with PNG_NO_16BIT.
Version 1.7.0beta54 [March 4, 2015] Version 1.6.17beta06 [February 27, 2015]
Moved png_set_filter() prototype into a PNG_WRITE_SUPPORTED block Moved png_set_filter() prototype into a PNG_WRITE_SUPPORTED block
of png.h. of png.h.
Conditionally compile a small amount of code in pngwutil.c
Avoid runtime checks when converting integer to png_byte with Avoid runtime checks when converting integer to png_byte with
Visual Studio (Sergey Kosarevsky) Visual Studio (Sergey Kosarevsky)
Merged pngwrite.c with libpng-1.6.17beta06/pngwrite.c
Version 1.7.0beta55 [March 9, 2015] Version 1.6.17rc01 [March 4, 2015]
No changes.
Version 1.6.17rc02 [March 9, 2015]
Removed some comments that the configure script did not handle Removed some comments that the configure script did not handle
properly from scripts/pnglibconf.dfa and pnglibconf.h.prebuilt. properly from scripts/pnglibconf.dfa and pnglibconf.h.prebuilt.
Spelling fixes ("then", "occured") reported by Lauri Nurmi. Free the unknown_chunks structure even when it contains no data.
Added more error reporting in png_default_read_data().
Merged png_free_data() with libpng-1.6.17rc02.
Send comments/corrections/commendations to png-mng-implement at lists.sf.net Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit (subscription required; visit

765
CHANGES
View File

File diff suppressed because it is too large Load Diff

152
libpng-manual.txt
View File

@ -1,6 +1,6 @@
libpng-manual.txt - A description on how to use and modify libpng libpng-manual.txt - A description on how to use and modify libpng
libpng version 1.7.0beta55 - March 9, 2015 libpng version 1.6.17rc02 - March 9, 2015
Updated and distributed by Glenn Randers-Pehrson Updated and distributed by Glenn Randers-Pehrson
<glennrp at users.sourceforge.net> <glennrp at users.sourceforge.net>
Copyright (c) 1998-2015 Glenn Randers-Pehrson Copyright (c) 1998-2015 Glenn Randers-Pehrson
@ -11,15 +11,15 @@ libpng-manual.txt - A description on how to use and modify libpng
Based on: Based on:
libpng versions 0.97, January 1998, through 1.7.0beta55 - March 9, 2015 libpng versions 0.97, January 1998, through 1.6.17rc02 - March 9, 2015
Updated and distributed by Glenn Randers-Pehrson Updated and distributed by Glenn Randers-Pehrson
Copyright (c) 1998-2015 Glenn Randers-Pehrson Copyright (c) 1998-2015 Glenn Randers-Pehrson
libpng 1.0 beta 6 version 0.96 May 28, 1997 libpng 1.0 beta 6 - version 0.96 - May 28, 1997
Updated and distributed by Andreas Dilger Updated and distributed by Andreas Dilger
Copyright (c) 1996, 1997 Andreas Dilger Copyright (c) 1996, 1997 Andreas Dilger
libpng 1.0 beta 2 - version 0.88 January 26, 1996 libpng 1.0 beta 2 - version 0.88 - January 26, 1996
For conditions of distribution and use, see copyright For conditions of distribution and use, see copyright
notice in png.h. Copyright (c) 1995, 1996 Guy Eric notice in png.h. Copyright (c) 1995, 1996 Guy Eric
Schalnat, Group 42, Inc. Schalnat, Group 42, Inc.
@ -42,11 +42,10 @@ libpng-manual.txt - A description on how to use and modify libpng
X. Changes to Libpng from version 1.0.x/1.2.x to 1.4.x X. Changes to Libpng from version 1.0.x/1.2.x to 1.4.x
XI. Changes to Libpng from version 1.4.x to 1.5.x XI. Changes to Libpng from version 1.4.x to 1.5.x
XII. Changes to Libpng from version 1.5.x to 1.6.x XII. Changes to Libpng from version 1.5.x to 1.6.x
XIII. Changes to Libpng from version 1.6.x to 1.7.x XIII. Detecting libpng
XIV. Detecting libpng XIV. Source code repository
XV. Source code repository XV. Coding style
XVI. Coding style XVI. Y2K Compliance in libpng
XVII. Y2K Compliance in libpng
I. Introduction I. Introduction
@ -345,22 +344,23 @@ then only check the bytes (if any) that your program didn't read.
to replace them with custom functions. See the discussion under to replace them with custom functions. See the discussion under
Customizing libpng. Customizing libpng.
FILE *fp = fopen(file_name, "rb"); FILE *fp = fopen(file_name, "rb");
if (!fp) if (!fp)
{ {
return (ERROR); return (ERROR);
} }
fread(header, 1, number, fp); if (fread(header, 1, number, fp) != number)
is_png = !png_sig_cmp(header, 0, number); {
return (ERROR);
}
is_png = !png_sig_cmp(header, 0, number);
if (!is_png) if (!is_png)
{ {
return (NOT_PNG); return (NOT_PNG);
} }
Next, png_struct and png_info need to be allocated and initialized. In Next, png_struct and png_info need to be allocated and initialized. In
order to ensure that the size of these structures is correct even with a order to ensure that the size of these structures is correct even with a
dynamically linked libpng, there are functions to initialize and dynamically linked libpng, there are functions to initialize and
@ -428,16 +428,12 @@ an end_info structure.
If you would rather avoid the complexity of setjmp/longjmp issues, If you would rather avoid the complexity of setjmp/longjmp issues,
you can compile libpng with PNG_NO_SETJMP, in which case you can compile libpng with PNG_NO_SETJMP, in which case
errors will result in a call to PNG_ABORT which defaults to abort(). errors will result in a call to PNG_ABORT() which defaults to abort().
You can #define PNG_ABORT to a function or other C code that does something You can #define PNG_ABORT() to a function that does something
more useful than abort(), as long as your function does not more useful than abort(), as long as your function does not
return. return.
If you do this, you cannot #define PNG_SIMPLIFIED_READ_SUPPORTED or
PNG_SIMPLIFIED_WRITE_SUPPORTED, because the simplified API requires
setjmp() support.
Now you need to set up the input code. The default for libpng is to Now you need to set up the input code. The default for libpng is to
use the C function fread(). If you use this, you will need to pass a use the C function fread(). If you use this, you will need to pass a
valid FILE * in the function png_init_io(). Be sure that the file is valid FILE * in the function png_init_io(). Be sure that the file is
@ -529,15 +525,15 @@ you can retrieve with
png_get_user_chunk_ptr(png_ptr); png_get_user_chunk_ptr(png_ptr);
If you call the png_set_read_user_chunk_fn() function, then all unknown chunks If you call the png_set_read_user_chunk_fn() function, then all unknown
will be passed to your callback when read. You can cause known chunks to be chunks which the callback does not handle will be saved when read. You can
passed in as well by using png_set_keep_unknown_chunks (see below) - this will cause them to be discarded by returning '1' ("handled") instead of '0'. This
prevent the normal libpng handling of those known chunks. behavior will change in libpng 1.7 and the default handling set by the
png_set_keep_unknown_chunks() function, described below, will be used when the
If your callback returns 0 the default unknown handling will be used (see callback returns 0. If you want the existing behavior you should set the global
below). This is new behavior in libpng 1.7, prior to 1.7 it was not possible to default to PNG_HANDLE_CHUNK_IF_SAFE now; this is compatible with all current
discard a chunk; PNG_HANDLE_CHUNK_IF_SAFE was forced. Libpng 1.6.0 issues a versions of libpng and with 1.7. Libpng 1.6 issues a warning if you keep the
warning when this was done. default, or PNG_HANDLE_CHUNK_NEVER, and the callback returns 0.
At this point, you can set up a callback function that will be At this point, you can set up a callback function that will be
called after each row has been read, which you can use to control called after each row has been read, which you can use to control
@ -636,8 +632,10 @@ callback function:
... ...
#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED) #if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
/* ignore all unknown chunks: */ /* ignore all unknown chunks
png_set_keep_unknown_chunks(read_ptr, 1, NULL, 0); * (use global setting "2" for libpng16 and earlier):
*/
png_set_keep_unknown_chunks(read_ptr, 2, NULL, 0);
/* except for vpAg: */ /* except for vpAg: */
png_set_keep_unknown_chunks(read_ptr, 2, vpAg, 1); png_set_keep_unknown_chunks(read_ptr, 2, vpAg, 1);
@ -651,15 +649,12 @@ User limits
The PNG specification allows the width and height of an image to be as The PNG specification allows the width and height of an image to be as
large as 2^31-1 (0x7fffffff), or about 2.147 billion rows and columns. large as 2^31-1 (0x7fffffff), or about 2.147 billion rows and columns.
Since very few applications really need to process such large images,
we have imposed an arbitrary 1,000,000 limit on rows and columns.
Larger images will be rejected immediately with a png_error() call. If Larger images will be rejected immediately with a png_error() call. If
you wish to change this limit, you can use you wish to change these limits, you can use
png_set_user_limits(png_ptr, width_max, height_max); png_set_user_limits(png_ptr, width_max, height_max);
to set your own limits, or use width_max = height_max = 0x7fffffffL to set your own limits (libpng may reject some very wide images
to allow all valid dimensions (libpng may reject some very large images
anyway because of potential buffer overflow conditions). anyway because of potential buffer overflow conditions).
You should put this statement after you create the PNG structure and You should put this statement after you create the PNG structure and
@ -1185,10 +1180,7 @@ row_pointers prior to calling png_read_png() with
png_set_rows(png_ptr, info_ptr, &row_pointers); png_set_rows(png_ptr, info_ptr, &row_pointers);
Alternatively you could allocate your image in one big block and define Alternatively you could allocate your image in one big block and define
row_pointers[i] to point into the proper places in your block. If row_pointers[i] to point into the proper places in your block.
you do this, be sure to call png_read_update_info() described below,
to update the "rowbytes" value to account for any transformations that
change the number of bytes per row before you use it to allocate your block.
If you use png_set_rows(), the application is responsible for freeing If you use png_set_rows(), the application is responsible for freeing
row_pointers (and row_pointers[i], if they were separately allocated). row_pointers (and row_pointers[i], if they were separately allocated).
@ -1277,13 +1269,12 @@ in until png_read_end() has read the chunk data following the image.
interlace_type, compression_type, or filter_method can interlace_type, compression_type, or filter_method can
be NULL if you are not interested in their values. be NULL if you are not interested in their values.
Note that png_get_IHDR() returns png_uint_32 data into Note that png_get_IHDR() returns 32-bit data into
the application's width and height variables. the application's width and height variables.
This is an unsafe situation if these are not png_uint_32 This is an unsafe situation if these are not png_uint_32
variables, or if they are 32-bit variables on a 64-bit variables. In such situations, the
platform. In such situations, the png_get_image_width() png_get_image_width() and png_get_image_height()
and png_get_image_height() functions described below are functions described below are safer.
safer.
width = png_get_image_width(png_ptr, width = png_get_image_width(png_ptr,
info_ptr); info_ptr);
@ -2746,10 +2737,11 @@ section below for more information on the libpng error handling.
If you would rather avoid the complexity of setjmp/longjmp issues, If you would rather avoid the complexity of setjmp/longjmp issues,
you can compile libpng with PNG_NO_SETJMP, in which case you can compile libpng with PNG_NO_SETJMP, in which case
errors will result in a call to PNG_ABORT which defaults to abort(). errors will result in a call to PNG_ABORT() which defaults to abort().
You can #define PNG_ABORT to a function or other C code that does something You can #define PNG_ABORT() to a function that does something
more useful than abort(), as long as your function does not return. more useful than abort(), as long as your function does not
return.
Checking for invalid palette index on write was added at libpng Checking for invalid palette index on write was added at libpng
1.5.10. If a pixel contains an invalid (out-of-range) index libpng issues 1.5.10. If a pixel contains an invalid (out-of-range) index libpng issues
@ -3267,7 +3259,7 @@ tEXt chunk use RFC 1123 format dates (e.g. "22 May 1997 18:07:10 GMT"),
although this isn't a requirement. Unlike the tIME chunk, the although this isn't a requirement. Unlike the tIME chunk, the
"Creation Time" tEXt chunk is not expected to be automatically changed "Creation Time" tEXt chunk is not expected to be automatically changed
by the software. To facilitate the use of RFC 1123 dates, a function by the software. To facilitate the use of RFC 1123 dates, a function
png_convert_to_rfc1123_buffer(png_ptr, buffer, png_timep) is provided to png_convert_to_rfc1123_buffer(buffer, png_timep) is provided to
convert from PNG time to an RFC 1123 format string. The caller must provide convert from PNG time to an RFC 1123 format string. The caller must provide
a writeable buffer of at least 29 bytes. a writeable buffer of at least 29 bytes.
@ -4167,7 +4159,7 @@ Error handling in libpng is done through png_error() and png_warning().
Errors handled through png_error() are fatal, meaning that png_error() Errors handled through png_error() are fatal, meaning that png_error()
should never return to its caller. Currently, this is handled via should never return to its caller. Currently, this is handled via
setjmp() and longjmp() (unless you have compiled libpng with setjmp() and longjmp() (unless you have compiled libpng with
PNG_NO_SETJMP, in which case it is handled via PNG_ABORT), PNG_NO_SETJMP, in which case it is handled via PNG_ABORT()),
but you could change this to do things like exit() if you should wish, but you could change this to do things like exit() if you should wish,
as long as your function does not return. as long as your function does not return.
@ -5069,7 +5061,6 @@ enforced. The sRGB chunk is allowed to appear in images with any color type
and is interpreted by libpng to convey a one-tracer-curve gray profile or a and is interpreted by libpng to convey a one-tracer-curve gray profile or a
three-tracer-curve RGB profile as appropriate. three-tracer-curve RGB profile as appropriate.
Prior to libpng-1.6.0 a warning would be issued if the iTXt chunk contained Prior to libpng-1.6.0 a warning would be issued if the iTXt chunk contained
an empty language field or an empty translated keyword. Both of these an empty language field or an empty translated keyword. Both of these
are allowed by the PNG specification, so these warnings are no longer issued. are allowed by the PNG specification, so these warnings are no longer issued.
@ -5118,55 +5109,7 @@ length, which resulted in PNG files that cannot be read beyond the bad iTXt
chunk. This error was fixed in libpng-1.6.3, and a tool (called chunk. This error was fixed in libpng-1.6.3, and a tool (called
contrib/tools/png-fix-itxt) has been added to the libpng distribution. contrib/tools/png-fix-itxt) has been added to the libpng distribution.
Starting with libpng-1.6.17, the PNG_SAFE_LIMITS macro was eliminated XIII. Detecting libpng
and safe limits are used by default (users who need larger limits
can still override them at compile time or run time, as described above).
The new limits are
default spec limit
png_user_width_max 1,000,000 2,147,483,647
png_user_height_max 1,000,000 2,147,483,647
png_user_chunk_cache_max 128 unlimited
png_user_chunk_malloc_max 8,000,000 unlimited
XIII. Changes to Libpng from version 1.6.x to 1.7.x
Some functions that were deprecated in libpng-1.6.0 were removed:
png_reset_zstream(),
png_info_init_3(),
png_data_freer() and its associated flags,
png_malloc_default(),
and png_free_default().
The PNG_ABORT() macro was changed to PNG_ABORT, and the default is now
"abort()" for all platforms (previously it was "ExitProcess(0)" on
Windows platforms). Starting with libpng-1.7.0 you have to define
PNG_ABORT instead of PNG_ABORT(), and you must include a terminating
semicolon in your definition, e.g.,
#if PNGCRUSH_LIBPNG_VER >= 10700
# ifdef _WINDOWS_
# define PNG_ABORT ExitProcess(0);
# else
# define PNG_ABORT abort();
# endif
#else
# ifdef _WINDOWS_
# define PNG_ABORT() ExitProcess(0)
# else
# define PNG_ABORT() abort()
# endif
#endif
The png_get_IHDR() function now allows users to supply NULL for any
argument in which they aren't interested. Previously, the width, height,
bit_depth, and color_type arguments were not allowed to be NULL.
The 8-bit compose and rgb_to_grayscale operations were made more accurate.
While these did not introduce API incompatibility, there may be differences
in unit test results.
XIV. Detecting libpng
The png_get_io_ptr() function has been present since libpng-0.88, has never The png_get_io_ptr() function has been present since libpng-0.88, has never
changed, and is unaffected by conditional compilation macros. It is the changed, and is unaffected by conditional compilation macros. It is the
@ -5199,7 +5142,7 @@ simple verbal discriptions of bug fixes, reported either to the
SourceForge bug tracker, to the png-mng-implement at lists.sf.net SourceForge bug tracker, to the png-mng-implement at lists.sf.net
mailing list, or directly to glennrp. mailing list, or directly to glennrp.
XVI. Coding style XV. Coding style
Our coding style is similar to the "Allman" style Our coding style is similar to the "Allman" style
(See http://en.wikipedia.org/wiki/Indent_style#Allman_style), with curly (See http://en.wikipedia.org/wiki/Indent_style#Allman_style), with curly
@ -5334,7 +5277,7 @@ Lines do not exceed 80 characters.
Other rules can be inferred by inspecting the libpng source. Other rules can be inferred by inspecting the libpng source.
XVII. Y2K Compliance in libpng XVI. Y2K Compliance in libpng
March 9, 2015 March 9, 2015
@ -5342,7 +5285,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
an official declaration. an official declaration.
This is your unofficial assurance that libpng from version 0.71 and This is your unofficial assurance that libpng from version 0.71 and
upward through 1.7.0beta55 are Y2K compliant. It is my belief that earlier upward through 1.6.17rc02 are Y2K compliant. It is my belief that earlier
versions were also Y2K compliant. versions were also Y2K compliant.
Libpng only has two year fields. One is a 2-byte unsigned integer Libpng only has two year fields. One is a 2-byte unsigned integer
@ -5358,8 +5301,9 @@ in libpng-1.6.x and will be removed from libpng-1.7.0.
There are seven time-related functions: There are seven time-related functions:
png_convert_to_rfc_1123() in png.c png_convert_to_rfc_1123_buffer() in png.c
(formerly png_convert_to_rfc_1152() in error) (formerly png_convert_to_rfc_1152() in error, and
also formerly png_convert_to_rfc_1123())
png_convert_from_struct_tm() in pngwrite.c, called png_convert_from_struct_tm() in pngwrite.c, called
in pngwrite.c in pngwrite.c
png_convert_from_time_t() in pngwrite.c png_convert_from_time_t() in pngwrite.c

180
libpng.3
View File

@ -1,6 +1,6 @@
.TH LIBPNG 3 "March 9, 2015" .TH LIBPNG 3 "March 9, 2015"
.SH NAME .SH NAME
libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta55 libpng \- Portable Network Graphics (PNG) Reference Library 1.6.17rc02
.SH SYNOPSIS .SH SYNOPSIS
\fB \fB
#include <png.h>\fP #include <png.h>\fP
@ -23,7 +23,7 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta55
\fBvoid png_convert_from_time_t (png_timep \fP\fIptime\fP\fB, time_t \fIttime\fP\fB);\fP \fBvoid png_convert_from_time_t (png_timep \fP\fIptime\fP\fB, time_t \fIttime\fP\fB);\fP
\fBpng_charp png_convert_to_rfc1123_buffer (png_structp \fP\fIpng_ptr\fP\fB, char \fP\fIout[29]\fP\fB, png_timep \fIptime\fP\fB);\fP \fBpng_charp png_convert_to_rfc1123 (png_structp \fP\fIpng_ptr\fP\fB, png_timep \fIptime\fP\fB);\fP
\fBpng_infop png_create_info_struct (png_structp \fIpng_ptr\fP\fB);\fP \fBpng_infop png_create_info_struct (png_structp \fIpng_ptr\fP\fB);\fP
@ -35,6 +35,8 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta55
\fBpng_structp png_create_write_struct_2 (png_const_charp \fP\fIuser_png_ver\fP\fB, png_voidp \fP\fIerror_ptr\fP\fB, png_error_ptr \fP\fIerror_fn\fP\fB, png_error_ptr \fP\fIwarn_fn\fP\fB, png_voidp \fP\fImem_ptr\fP\fB, png_malloc_ptr \fP\fImalloc_fn\fP\fB, png_free_ptr \fIfree_fn\fP\fB);\fP \fBpng_structp png_create_write_struct_2 (png_const_charp \fP\fIuser_png_ver\fP\fB, png_voidp \fP\fIerror_ptr\fP\fB, png_error_ptr \fP\fIerror_fn\fP\fB, png_error_ptr \fP\fIwarn_fn\fP\fB, png_voidp \fP\fImem_ptr\fP\fB, png_malloc_ptr \fP\fImalloc_fn\fP\fB, png_free_ptr \fIfree_fn\fP\fB);\fP
\fBvoid png_data_freer (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fP\fIfreer\fP\fB, png_uint_32 \fImask)\fP\fB);\fP
\fBvoid png_destroy_info_struct (png_structp \fP\fIpng_ptr\fP\fB, png_infopp \fIinfo_ptr_ptr\fP\fB);\fP \fBvoid png_destroy_info_struct (png_structp \fP\fIpng_ptr\fP\fB, png_infopp \fIinfo_ptr_ptr\fP\fB);\fP
\fBvoid png_destroy_read_struct (png_structpp \fP\fIpng_ptr_ptr\fP\fB, png_infopp \fP\fIinfo_ptr_ptr\fP\fB, png_infopp \fIend_info_ptr_ptr\fP\fB);\fP \fBvoid png_destroy_read_struct (png_structpp \fP\fIpng_ptr_ptr\fP\fB, png_infopp \fP\fIinfo_ptr_ptr\fP\fB, png_infopp \fIend_info_ptr_ptr\fP\fB);\fP
@ -49,6 +51,8 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta55
\fBvoid png_free_chunk_list (png_structp \fIpng_ptr\fP\fB);\fP \fBvoid png_free_chunk_list (png_structp \fIpng_ptr\fP\fB);\fP
\fBvoid png_free_default (png_structp \fP\fIpng_ptr\fP\fB, png_voidp \fIptr\fP\fB);\fP
\fBvoid png_free_data (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fInum\fP\fB);\fP \fBvoid png_free_data (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fP\fIinfo_ptr\fP\fB, int \fInum\fP\fB);\fP
\fBpng_byte png_get_bit_depth (png_const_structp \fP\fIpng_ptr\fP\fB, png_const_infop \fIinfo_ptr\fP\fB);\fP \fBpng_byte png_get_bit_depth (png_const_structp \fP\fIpng_ptr\fP\fB, png_const_infop \fIinfo_ptr\fP\fB);\fP
@ -225,12 +229,16 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta55
\fBint png_image_write_to_stdio (png_imagep \fP\fIimage\fP\fB, FILE \fP\fI*file\fP\fB, int \fP\fIconvert_to_8_bit\fP\fB, const void \fP\fI*buffer\fP\fB, png_int_32 \fP\fIrow_stride\fP\fB, void \fI*colormap)\fP\fB);\fP \fBint png_image_write_to_stdio (png_imagep \fP\fIimage\fP\fB, FILE \fP\fI*file\fP\fB, int \fP\fIconvert_to_8_bit\fP\fB, const void \fP\fI*buffer\fP\fB, png_int_32 \fP\fIrow_stride\fP\fB, void \fI*colormap)\fP\fB);\fP
\fBvoid png_info_init_3 (png_infopp \fP\fIinfo_ptr\fP\fB, png_size_t \fIpng_info_struct_size\fP\fB);\fP
\fBvoid png_init_io (png_structp \fP\fIpng_ptr\fP\fB, FILE \fI*fp\fP\fB);\fP \fBvoid png_init_io (png_structp \fP\fIpng_ptr\fP\fB, FILE \fI*fp\fP\fB);\fP
\fBvoid png_longjmp (png_structp \fP\fIpng_ptr\fP\fB, int \fIval\fP\fB);\fP \fBvoid png_longjmp (png_structp \fP\fIpng_ptr\fP\fB, int \fIval\fP\fB);\fP
\fBpng_voidp png_malloc (png_structp \fP\fIpng_ptr\fP\fB, png_alloc_size_t \fIsize\fP\fB);\fP \fBpng_voidp png_malloc (png_structp \fP\fIpng_ptr\fP\fB, png_alloc_size_t \fIsize\fP\fB);\fP
\fBpng_voidp png_malloc_default (png_structp \fP\fIpng_ptr\fP\fB, png_alloc_size_t \fIsize\fP\fB);\fP
\fBpng_voidp png_malloc_warn (png_structp \fP\fIpng_ptr\fP\fB, png_alloc_size_t \fIsize\fP\fB);\fP \fBpng_voidp png_malloc_warn (png_structp \fP\fIpng_ptr\fP\fB, png_alloc_size_t \fIsize\fP\fB);\fP
\fBpng_uint_32 png_permit_mng_features (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fImng_features_permitted\fP\fB);\fP \fBpng_uint_32 png_permit_mng_features (png_structp \fP\fIpng_ptr\fP\fB, png_uint_32 \fImng_features_permitted\fP\fB);\fP
@ -257,6 +265,8 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.7.0beta55
\fBvoid png_read_update_info (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP \fBvoid png_read_update_info (png_structp \fP\fIpng_ptr\fP\fB, png_infop \fIinfo_ptr\fP\fB);\fP
\fBint png_reset_zstream (png_structp \fIpng_ptr\fP\fB);\fP
\fBvoid png_save_int_32 (png_bytep \fP\fIbuf\fP\fB, png_int_32 \fIi\fP\fB);\fP \fBvoid png_save_int_32 (png_bytep \fP\fIbuf\fP\fB, png_int_32 \fIi\fP\fB);\fP
\fBvoid png_save_uint_16 (png_bytep \fP\fIbuf\fP\fB, unsigned int \fIi\fP\fB);\fP \fBvoid png_save_uint_16 (png_bytep \fP\fIbuf\fP\fB, unsigned int \fIi\fP\fB);\fP
@ -494,7 +504,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng.
.SH LIBPNG.TXT .SH LIBPNG.TXT
libpng-manual.txt - A description on how to use and modify libpng libpng-manual.txt - A description on how to use and modify libpng
libpng version 1.7.0beta55 - March 9, 2015 libpng version 1.6.17rc02 - March 9, 2015
Updated and distributed by Glenn Randers-Pehrson Updated and distributed by Glenn Randers-Pehrson
<glennrp at users.sourceforge.net> <glennrp at users.sourceforge.net>
Copyright (c) 1998-2015 Glenn Randers-Pehrson Copyright (c) 1998-2015 Glenn Randers-Pehrson
@ -505,15 +515,15 @@ libpng-manual.txt - A description on how to use and modify libpng
Based on: Based on:
libpng versions 0.97, January 1998, through 1.7.0beta55 - March 9, 2015 libpng versions 0.97, January 1998, through 1.6.17rc02 - March 9, 2015
Updated and distributed by Glenn Randers-Pehrson Updated and distributed by Glenn Randers-Pehrson
Copyright (c) 1998-2015 Glenn Randers-Pehrson Copyright (c) 1998-2015 Glenn Randers-Pehrson
libpng 1.0 beta 6 version 0.96 May 28, 1997 libpng 1.0 beta 6 - version 0.96 - May 28, 1997
Updated and distributed by Andreas Dilger Updated and distributed by Andreas Dilger
Copyright (c) 1996, 1997 Andreas Dilger Copyright (c) 1996, 1997 Andreas Dilger
libpng 1.0 beta 2 - version 0.88 January 26, 1996 libpng 1.0 beta 2 - version 0.88 - January 26, 1996
For conditions of distribution and use, see copyright For conditions of distribution and use, see copyright
notice in png.h. Copyright (c) 1995, 1996 Guy Eric notice in png.h. Copyright (c) 1995, 1996 Guy Eric
Schalnat, Group 42, Inc. Schalnat, Group 42, Inc.
@ -536,11 +546,10 @@ libpng-manual.txt - A description on how to use and modify libpng
X. Changes to Libpng from version 1.0.x/1.2.x to 1.4.x X. Changes to Libpng from version 1.0.x/1.2.x to 1.4.x
XI. Changes to Libpng from version 1.4.x to 1.5.x XI. Changes to Libpng from version 1.4.x to 1.5.x
XII. Changes to Libpng from version 1.5.x to 1.6.x XII. Changes to Libpng from version 1.5.x to 1.6.x
XIII. Changes to Libpng from version 1.6.x to 1.7.x XIII. Detecting libpng
XIV. Detecting libpng XIV. Source code repository
XV. Source code repository XV. Coding style
XVI. Coding style XVI. Y2K Compliance in libpng
XVII. Y2K Compliance in libpng
.SH I. Introduction .SH I. Introduction
@ -839,22 +848,23 @@ then only check the bytes (if any) that your program didn't read.
to replace them with custom functions. See the discussion under to replace them with custom functions. See the discussion under
Customizing libpng. Customizing libpng.
FILE *fp = fopen(file_name, "rb"); FILE *fp = fopen(file_name, "rb");
if (!fp) if (!fp)
{ {
return (ERROR); return (ERROR);
} }
fread(header, 1, number, fp); if (fread(header, 1, number, fp) != number)
is_png = !png_sig_cmp(header, 0, number); {
return (ERROR);
}
is_png = !png_sig_cmp(header, 0, number);
if (!is_png) if (!is_png)
{ {
return (NOT_PNG); return (NOT_PNG);
} }
Next, png_struct and png_info need to be allocated and initialized. In Next, png_struct and png_info need to be allocated and initialized. In
order to ensure that the size of these structures is correct even with a order to ensure that the size of these structures is correct even with a
dynamically linked libpng, there are functions to initialize and dynamically linked libpng, there are functions to initialize and
@ -922,16 +932,12 @@ an end_info structure.
If you would rather avoid the complexity of setjmp/longjmp issues, If you would rather avoid the complexity of setjmp/longjmp issues,
you can compile libpng with PNG_NO_SETJMP, in which case you can compile libpng with PNG_NO_SETJMP, in which case
errors will result in a call to PNG_ABORT which defaults to abort(). errors will result in a call to PNG_ABORT() which defaults to abort().
You can #define PNG_ABORT to a function or other C code that does something You can #define PNG_ABORT() to a function that does something
more useful than abort(), as long as your function does not more useful than abort(), as long as your function does not
return. return.
If you do this, you cannot #define PNG_SIMPLIFIED_READ_SUPPORTED or
PNG_SIMPLIFIED_WRITE_SUPPORTED, because the simplified API requires
setjmp() support.
Now you need to set up the input code. The default for libpng is to Now you need to set up the input code. The default for libpng is to
use the C function fread(). If you use this, you will need to pass a use the C function fread(). If you use this, you will need to pass a
valid FILE * in the function png_init_io(). Be sure that the file is valid FILE * in the function png_init_io(). Be sure that the file is
@ -1023,15 +1029,15 @@ you can retrieve with
png_get_user_chunk_ptr(png_ptr); png_get_user_chunk_ptr(png_ptr);
If you call the png_set_read_user_chunk_fn() function, then all unknown chunks If you call the png_set_read_user_chunk_fn() function, then all unknown
will be passed to your callback when read. You can cause known chunks to be chunks which the callback does not handle will be saved when read. You can
passed in as well by using png_set_keep_unknown_chunks (see below) - this will cause them to be discarded by returning '1' ("handled") instead of '0'. This
prevent the normal libpng handling of those known chunks. behavior will change in libpng 1.7 and the default handling set by the
png_set_keep_unknown_chunks() function, described below, will be used when the
If your callback returns 0 the default unknown handling will be used (see callback returns 0. If you want the existing behavior you should set the global
below). This is new behavior in libpng 1.7, prior to 1.7 it was not possible to default to PNG_HANDLE_CHUNK_IF_SAFE now; this is compatible with all current
discard a chunk; PNG_HANDLE_CHUNK_IF_SAFE was forced. Libpng 1.6.0 issues a versions of libpng and with 1.7. Libpng 1.6 issues a warning if you keep the
warning when this was done. default, or PNG_HANDLE_CHUNK_NEVER, and the callback returns 0.
At this point, you can set up a callback function that will be At this point, you can set up a callback function that will be
called after each row has been read, which you can use to control called after each row has been read, which you can use to control
@ -1130,8 +1136,10 @@ callback function:
... ...
#if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED) #if defined(PNG_UNKNOWN_CHUNKS_SUPPORTED)
/* ignore all unknown chunks: */ /* ignore all unknown chunks
png_set_keep_unknown_chunks(read_ptr, 1, NULL, 0); * (use global setting "2" for libpng16 and earlier):
*/
png_set_keep_unknown_chunks(read_ptr, 2, NULL, 0);
/* except for vpAg: */ /* except for vpAg: */
png_set_keep_unknown_chunks(read_ptr, 2, vpAg, 1); png_set_keep_unknown_chunks(read_ptr, 2, vpAg, 1);
@ -1145,15 +1153,12 @@ callback function:
The PNG specification allows the width and height of an image to be as The PNG specification allows the width and height of an image to be as
large as 2^(31\-1 (0x7fffffff), or about 2.147 billion rows and columns. large as 2^(31\-1 (0x7fffffff), or about 2.147 billion rows and columns.
Since very few applications really need to process such large images,
we have imposed an arbitrary 1,000,000 limit on rows and columns.
Larger images will be rejected immediately with a png_error() call. If Larger images will be rejected immediately with a png_error() call. If
you wish to change this limit, you can use you wish to change these limits, you can use
png_set_user_limits(png_ptr, width_max, height_max); png_set_user_limits(png_ptr, width_max, height_max);
to set your own limits, or use width_max = height_max = 0x7fffffffL to set your own limits (libpng may reject some very wide images
to allow all valid dimensions (libpng may reject some very large images
anyway because of potential buffer overflow conditions). anyway because of potential buffer overflow conditions).
You should put this statement after you create the PNG structure and You should put this statement after you create the PNG structure and
@ -1679,10 +1684,7 @@ row_pointers prior to calling png_read_png() with
png_set_rows(png_ptr, info_ptr, &row_pointers); png_set_rows(png_ptr, info_ptr, &row_pointers);
Alternatively you could allocate your image in one big block and define Alternatively you could allocate your image in one big block and define
row_pointers[i] to point into the proper places in your block. If row_pointers[i] to point into the proper places in your block.
you do this, be sure to call png_read_update_info() described below,
to update the "rowbytes" value to account for any transformations that
change the number of bytes per row before you use it to allocate your block.
If you use png_set_rows(), the application is responsible for freeing If you use png_set_rows(), the application is responsible for freeing
row_pointers (and row_pointers[i], if they were separately allocated). row_pointers (and row_pointers[i], if they were separately allocated).
@ -1771,13 +1773,12 @@ in until png_read_end() has read the chunk data following the image.
interlace_type, compression_type, or filter_method can interlace_type, compression_type, or filter_method can
be NULL if you are not interested in their values. be NULL if you are not interested in their values.
Note that png_get_IHDR() returns png_uint_32 data into Note that png_get_IHDR() returns 32-bit data into
the application's width and height variables. the application's width and height variables.
This is an unsafe situation if these are not png_uint_32 This is an unsafe situation if these are not png_uint_32
variables, or if they are 32-bit variables on a 64-bit variables. In such situations, the
platform. In such situations, the png_get_image_width() png_get_image_width() and png_get_image_height()
and png_get_image_height() functions described below are functions described below are safer.
safer.
width = png_get_image_width(png_ptr, width = png_get_image_width(png_ptr,
info_ptr); info_ptr);
@ -3240,10 +3241,11 @@ section below for more information on the libpng error handling.
If you would rather avoid the complexity of setjmp/longjmp issues, If you would rather avoid the complexity of setjmp/longjmp issues,
you can compile libpng with PNG_NO_SETJMP, in which case you can compile libpng with PNG_NO_SETJMP, in which case
errors will result in a call to PNG_ABORT which defaults to abort(). errors will result in a call to PNG_ABORT() which defaults to abort().
You can #define PNG_ABORT to a function or other C code that does something You can #define PNG_ABORT() to a function that does something
more useful than abort(), as long as your function does not return. more useful than abort(), as long as your function does not
return.
Checking for invalid palette index on write was added at libpng Checking for invalid palette index on write was added at libpng
1.5.10. If a pixel contains an invalid (out-of-range) index libpng issues 1.5.10. If a pixel contains an invalid (out-of-range) index libpng issues
@ -3761,7 +3763,7 @@ tEXt chunk use RFC 1123 format dates (e.g. "22 May 1997 18:07:10 GMT"),
although this isn't a requirement. Unlike the tIME chunk, the although this isn't a requirement. Unlike the tIME chunk, the
"Creation Time" tEXt chunk is not expected to be automatically changed "Creation Time" tEXt chunk is not expected to be automatically changed
by the software. To facilitate the use of RFC 1123 dates, a function by the software. To facilitate the use of RFC 1123 dates, a function
png_convert_to_rfc1123_buffer(png_ptr, buffer, png_timep) is provided to png_convert_to_rfc1123_buffer(buffer, png_timep) is provided to
convert from PNG time to an RFC 1123 format string. The caller must provide convert from PNG time to an RFC 1123 format string. The caller must provide
a writeable buffer of at least 29 bytes. a writeable buffer of at least 29 bytes.
@ -4661,7 +4663,7 @@ Error handling in libpng is done through png_error() and png_warning().
Errors handled through png_error() are fatal, meaning that png_error() Errors handled through png_error() are fatal, meaning that png_error()
should never return to its caller. Currently, this is handled via should never return to its caller. Currently, this is handled via
setjmp() and longjmp() (unless you have compiled libpng with setjmp() and longjmp() (unless you have compiled libpng with
PNG_NO_SETJMP, in which case it is handled via PNG_ABORT), PNG_NO_SETJMP, in which case it is handled via PNG_ABORT()),
but you could change this to do things like exit() if you should wish, but you could change this to do things like exit() if you should wish,
as long as your function does not return. as long as your function does not return.
@ -5563,7 +5565,6 @@ enforced. The sRGB chunk is allowed to appear in images with any color type
and is interpreted by libpng to convey a one-tracer-curve gray profile or a and is interpreted by libpng to convey a one-tracer-curve gray profile or a
three-tracer-curve RGB profile as appropriate. three-tracer-curve RGB profile as appropriate.
Prior to libpng-1.6.0 a warning would be issued if the iTXt chunk contained Prior to libpng-1.6.0 a warning would be issued if the iTXt chunk contained
an empty language field or an empty translated keyword. Both of these an empty language field or an empty translated keyword. Both of these
are allowed by the PNG specification, so these warnings are no longer issued. are allowed by the PNG specification, so these warnings are no longer issued.
@ -5612,55 +5613,7 @@ length, which resulted in PNG files that cannot be read beyond the bad iTXt
chunk. This error was fixed in libpng-1.6.3, and a tool (called chunk. This error was fixed in libpng-1.6.3, and a tool (called
contrib/tools/png-fix-itxt) has been added to the libpng distribution. contrib/tools/png-fix-itxt) has been added to the libpng distribution.
Starting with libpng-1.6.17, the PNG_SAFE_LIMITS macro was eliminated .SH XIII. Detecting libpng
and safe limits are used by default (users who need larger limits
can still override them at compile time or run time, as described above).
The new limits are
default spec limit
png_user_width_max 1,000,000 2,147,483,647
png_user_height_max 1,000,000 2,147,483,647
png_user_chunk_cache_max 128 unlimited
png_user_chunk_malloc_max 8,000,000 unlimited
.SH XIII. Changes to Libpng from version 1.6.x to 1.7.x
Some functions that were deprecated in libpng-1.6.0 were removed:
png_reset_zstream(),
png_info_init_3(),
png_data_freer() and its associated flags,
png_malloc_default(),
and png_free_default().
The PNG_ABORT() macro was changed to PNG_ABORT, and the default is now
"abort()" for all platforms (previously it was "ExitProcess(0)" on
Windows platforms). Starting with libpng-1.7.0 you have to define
PNG_ABORT instead of PNG_ABORT(), and you must include a terminating
semicolon in your definition, e.g.,
#if PNGCRUSH_LIBPNG_VER >= 10700
# ifdef _WINDOWS_
# define PNG_ABORT ExitProcess(0);
# else
# define PNG_ABORT abort();
# endif
#else
# ifdef _WINDOWS_
# define PNG_ABORT() ExitProcess(0)
# else
# define PNG_ABORT() abort()
# endif
#endif
The png_get_IHDR() function now allows users to supply NULL for any
argument in which they aren't interested. Previously, the width, height,
bit_depth, and color_type arguments were not allowed to be NULL.
The 8-bit compose and rgb_to_grayscale operations were made more accurate.
While these did not introduce API incompatibility, there may be differences
in unit test results.
.SH XIV. Detecting libpng
The png_get_io_ptr() function has been present since libpng-0.88, has never The png_get_io_ptr() function has been present since libpng-0.88, has never
changed, and is unaffected by conditional compilation macros. It is the changed, and is unaffected by conditional compilation macros. It is the
@ -5693,7 +5646,7 @@ simple verbal discriptions of bug fixes, reported either to the
SourceForge bug tracker, to the png-mng-implement at lists.sf.net SourceForge bug tracker, to the png-mng-implement at lists.sf.net
mailing list, or directly to glennrp. mailing list, or directly to glennrp.
.SH XVI. Coding style .SH XV. Coding style
Our coding style is similar to the "Allman" style Our coding style is similar to the "Allman" style
(See http://en.wikipedia.org/wiki/Indent_style#Allman_style), with curly (See http://en.wikipedia.org/wiki/Indent_style#Allman_style), with curly
@ -5828,7 +5781,7 @@ Lines do not exceed 80 characters.
Other rules can be inferred by inspecting the libpng source. Other rules can be inferred by inspecting the libpng source.
.SH XVII. Y2K Compliance in libpng .SH XVI. Y2K Compliance in libpng
March 9, 2015 March 9, 2015
@ -5836,7 +5789,7 @@ Since the PNG Development group is an ad-hoc body, we can't make
an official declaration. an official declaration.
This is your unofficial assurance that libpng from version 0.71 and This is your unofficial assurance that libpng from version 0.71 and
upward through 1.7.0beta55 are Y2K compliant. It is my belief that earlier upward through 1.6.17rc02 are Y2K compliant. It is my belief that earlier
versions were also Y2K compliant. versions were also Y2K compliant.
Libpng only has two year fields. One is a 2-byte unsigned integer Libpng only has two year fields. One is a 2-byte unsigned integer
@ -5852,8 +5805,9 @@ in libpng-1.6.x and will be removed from libpng-1.7.0.
There are seven time-related functions: There are seven time-related functions:
png_convert_to_rfc_1123() in png.c png_convert_to_rfc_1123_buffer() in png.c
(formerly png_convert_to_rfc_1152() in error) (formerly png_convert_to_rfc_1152() in error, and
also formerly png_convert_to_rfc_1123())
png_convert_from_struct_tm() in pngwrite.c, called png_convert_from_struct_tm() in pngwrite.c, called
in pngwrite.c in pngwrite.c
png_convert_from_time_t() in pngwrite.c png_convert_from_time_t() in pngwrite.c
@ -6059,7 +6013,7 @@ the first widely used release:
1.6.5 16 10605 16.so.16.5[.0] 1.6.5 16 10605 16.so.16.5[.0]
1.6.6 16 10606 16.so.16.6[.0] 1.6.6 16 10606 16.so.16.6[.0]
1.6.7beta01-04 16 10607 16.so.16.7[.0] 1.6.7beta01-04 16 10607 16.so.16.7[.0]
1.6.7rc01-03 16 10607 16.so.16.7[.0] 1.6.7rc01-02 16 10607 16.so.16.7[.0]
1.6.7 16 10607 16.so.16.7[.0] 1.6.7 16 10607 16.so.16.7[.0]
1.6.8beta01-02 16 10608 16.so.16.8[.0] 1.6.8beta01-02 16 10608 16.so.16.8[.0]
1.6.8rc01-02 16 10608 16.so.16.8[.0] 1.6.8rc01-02 16 10608 16.so.16.8[.0]
@ -6073,7 +6027,7 @@ the first widely used release:
1.6.11beta01-06 16 10611 16.so.16.11[.0] 1.6.11beta01-06 16 10611 16.so.16.11[.0]
1.6.11rc01-02 16 10611 16.so.16.11[.0] 1.6.11rc01-02 16 10611 16.so.16.11[.0]
1.6.11 16 10611 16.so.16.11[.0] 1.6.11 16 10611 16.so.16.11[.0]
1.6.12rc01-03 16 10612 16.so.16.12[.0] 1.6.12rc01 16 10612 16.so.16.12[.0]
1.6.12 16 10612 16.so.16.12[.0] 1.6.12 16 10612 16.so.16.12[.0]
1.6.13beta01-04 16 10613 16.so.16.13[.0] 1.6.13beta01-04 16 10613 16.so.16.13[.0]
1.6.13rc01-02 16 10613 16.so.16.13[.0] 1.6.13rc01-02 16 10613 16.so.16.13[.0]
@ -6088,9 +6042,7 @@ the first widely used release:
1.6.16rc01-02 16 10616 16.so.16.16[.0] 1.6.16rc01-02 16 10616 16.so.16.16[.0]
1.6.16 16 10616 16.so.16.16[.0] 1.6.16 16 10616 16.so.16.16[.0]
1.6.17beta01-06 16 10617 16.so.16.17[.0] 1.6.17beta01-06 16 10617 16.so.16.17[.0]
1.6.17rc01 16 10617 16.so.16.17[.0] 1.6.17rc01-02 16 10617 16.so.16.17[.0]
1.7.0alpha01-10 17 10700 17.so.17.0[.0]
1.7.0beta01-55 17 10700 17.so.17.0[.0]
Henceforth the source version will match the shared-library minor Henceforth the source version will match the shared-library minor
and patch numbers; the shared-library major version number will be and patch numbers; the shared-library major version number will be
@ -6147,7 +6099,7 @@ possible without all of you.
Thanks to Frank J. T. Wojcik for helping with the documentation. Thanks to Frank J. T. Wojcik for helping with the documentation.
Libpng version 1.7.0beta55 - March 9, 2015: Libpng version 1.6.17rc02 - March 9, 2015:
Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc. Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc.
Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net). Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net).
@ -6170,8 +6122,8 @@ this sentence.
This code is released under the libpng license. This code is released under the libpng license.
libpng versions 1.2.6, August 15, 2004, through 1.7.0beta55, March 9, 2015, are libpng versions 1.2.6, August 15, 2004, through 1.6.17rc02, March 9, 2015, are
Copyright (c) 2004,2006-2007 Glenn Randers-Pehrson, and are Copyright (c) 2004,2006-2014 Glenn Randers-Pehrson, and are
distributed according to the same disclaimer and license as libpng-1.2.5 distributed according to the same disclaimer and license as libpng-1.2.5
with the following individual added to the list of Contributing Authors with the following individual added to the list of Contributing Authors

768
png.c
View File

File diff suppressed because it is too large Load Diff