For testing purposes (e.g. wanting to see if "make distclean" works
correctly with and without building), as well as development purposes
(e.g. wanting to inspect the artifacts produced in the configuration
stage), add `CI_NO_BUILD` to the family of contrarians.
pngimage: The code simply exited with a return code of 99 in the event
of a user error including giving pngimage invalid PNG files and an
internal error. It now attempts to clean up the state before doing so,
matching the normal behaviour.
pngimage: Non-ISO use of setjmp(3) corrected.
pngerror.c: Failure to call png_image_free on a false result from a
png_safe_execute function call fixed. This was a regression caused by
the 'volatile' clean-up. Not normally detectable because png_image_free
will often be called by the application.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
nocompile-limits.dfa: turns off all limits including run-time limits
nolimits.dfa: makes the compile time limits unlimited while leaving on
the run-time limits.
Fixes compiler warnings exposed by these tests. These are just warnings,
there were no bugs other than a failure to handle systems with a 16-bit
at the appropriate time which would result in a later failure on malloc.
png.c: png_icc_check_length: in-line code was still used in place of
png_chunk_max when checking the current chunk allocation limit. The
in-line code did not handle PNG_MAXSEG_64K and, anyway, issued
compiler warnings in the 'nocompile-limits' case. Changed to use
png_malloc_max.
pngrutil.c: eliminated an erroneous 'truncation' warning with GCC-14 by
using a safe cast.
pngtest.c: failed to check for PNG_USER_LIMITS_SUPPORTED around API
calls which don't exist without PNG_USER_LIMITS.
Signed-off-by: John Bowler <jbowler@acm.org>
This is a regression of commit a8242dd9473a8da4d851623cf0b514a8ee4bee34
"PNGv3 colourspace precedence rules conformance".
Previously, `png_write_iCCP` used the length from the first four bytes
of the profile set by `png_set_iCCP`, rather than the actual data length
recorded by `png_set_iCCP`.
If the profile data were less than 4 bytes long, it would have caused
a read-beyond-end-of-malloc error. This bug was in the libpng code even
before the changes introduced in the above-mentioned commit, but it was
inaccessible. It became accessible when we removed the pre-PNGv3 colour
space checks in `png_set_iCCP`.
Reported-by: Bob Friesenhahn <bobjfriesenhahn@gmail.com>
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This is a regression of commit 2519a03418af2108d3bd8c269ba01ab72ae240ef
"refactor: Clean up the checking of chunk lengths and allocation limits"
Compilation would break under the "right" non-default configuration.
(Oopsie!)
Also clean up comments in the surrounding code.
Reported-by: chris0e3 <chris0e3@gmail.com>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
Internal changes only.
Move chunk length checks to fewer places:
Change `png_struct::user_chunk_malloc_max` to always have a non-zero
value, in order to avoid the need to check for zero in multiple places.
Add `png_chunk_max(png_ptr)`, a function-like macro defined in pngpriv.h
which expresses all the previous checks on the various USER_LIMITS and
system limitations. Replace the code which implemented such checks with
`png_chunk_max`.
Move the malloc limit length check in `png_read_chunk_header` to
`png_handle_chunk` and make it conditional on the chunk type.
Progressive reader: call `png_read_chunk_header`.
Correct the handling of pHYs.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
The two new configuation tests, fixed.dfa and float-fixed.dfa verify
that the 'standard' configuration of libpng works without floating point
arithmetic.
Signed-off-by: John Bowler <jbowler@acm.org>
This is a major change required by the new PNGv3 colour chunk precedence
rules. It **does not** change the libpng API (png.h) however it changes
the following handling of PNG files:
IFF the PNG file contains colour space information it changes from the
libpng v3 behaviour to the now compulsory PNG v3 behaviour:
1) libpng no longer invalidates colour space chunks because they are
inconsistent.
2) libpng no longer responds to the "png_get_" APIs positively if they
are not present in the PNG but can be deduced from the colour space
chunks that are present.
Add various missing pieces to their right places:
* Update .editorconfig in order to let editorconfig-checker know that
aclocal.m4 (which is auto-generated) may contain trailing whitespace.
* Add ci/README.md.
* Update scripts/README.txt.
TODO:
Integrate editorconfig-checker into the linting workflow on GitHub.
(See .github/workflows/lint.yml)
Apply the following updates:
* Tidy up the compiler flag definitions.
* Update the Darwin, Linux and MSYS makefiles to match the compiler
flags used in scripts/makefile.clang and scripts/makefile.gcc.
* Add the `pngtest-static` target in the Darwin makefile, following
on the Linux makefile.
* Rewrite some of the implicit make rules to match one another more
consistently.
* Make corrections in the copyright years to match git log.
Add scripts/makefile.c89 and refactor scripts/makefile.emcc,
scripts/makefile.clang and scripts/makefile.gcc
Refactor variable definitions inside scripts/makefile.clang,
scripts/makefile.gcc and scripts/makefile.emcc, and start using
the option `-pedantic-errors` unconditionally. This option was
first implemented in GCC version 3.1, and it was available in
Clang and in other Clang-based compilers (e.g. Emscripten) from
the beginning.
Add scripts/makefile.c89, derived from the above makefiles, but
with `-pedantic-errors -std=c89`. We aren't enabling the C89 level
by default, to avoid any incompatibility, whether intentional or
accidental, with the compiler's default language level. However,
we are still continuing to support C89 in the 'libpng16' branch,
and this special makefile can be used for testing purposes.
In libpng version 1.6.45 we inadvertently used a declaration after
a statement, which works for compilers supporting C99 and newer,
but fails with C89 compilers, which we are still supporting in the
branch 'libpng16'.
Moreover, in commit 92e8581f12d4570b777eaabfbe1f4243b7b80c04, we used
the macro `PNG_FIXED_EXPORT` in a manner that introduced a spurious ';'
character, which broke the build for all standard-conforming compilers.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
A downgrade from 16-bit samples to 8-bit samples, or an expansion from
1- or 2-channel grayscale (or grayscale+alpha) to 3- or 4-channel
RGB (or RGB+alpha), etc., may be deemed generally useful. Such image
transforms could be made available to the user via command-line options.
On the other hand, keeping the decision to disable or enable these
transforms unconditionally at compile time (e.g. because they're needed
to work around a specific printer's limitations) is less than ideal.
Apart from the png.h change, these files are machine-generated.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This adds APIs to get/set the two remaining new PNG-v3 colour space
chunks. The mDCV API matches that of cHRM. Both chunks support
floating point APIs (all values in the two chunks are real numbers).
Both chunks have a new encoded type, a four-digit-precision fixed-point
number, which cannot be represented in the existing `png_fixed_point`
type, so a `png_uint_32` is used.
Test examples for cICP, cLLI and mDCV are now in pngtest.png, and a
necessary change to the pngunknown.c test program has been made to
accomodate the additions.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
In preparation for the upcoming changes in the build system, any parts
of the CMake file that are unlikely to be affected should be moved out
of the way. This should facilitate an easier resync between the branch
'libpng16' and its successor(s).
Specifically:
* Move the functions `generate_chk`, `generate_out`, `generate_source`
and `generate_copy` to scripts/cmake/PNGGenConfig.cmake.
* Move the function `png_add_test` to scripts/cmake/PNGTest.cmake.
* Leave the function `create_symlink` in place, but add a TODO note.
As we raised the minimum required CMake version to 3.14, we should
now be able to use CMake's built-in function instead.
cICP was written after PLTE, not before. The other chunks were output
in an order which does not match the new PNG-v3 "priority" order.
This change outputs all chunks in the "priority" order; highest
precedence first. This means that the PNGs so written conform to
PNG v3 (cICP), and allow a streaming app to handle chunks in order,
without buffering data which may later be overridden.
Note that PNG-v3 establishes the idea of dropping ancillary chunks
which are inconveniently ordered in the definition of how APNG chunks
are handled.
This is a cherry-pick of commit 945f2602a0ea05a7938b2f52df9ef16cf3440291
from branch 'libpng18'.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
For the sake of completeness:
* Add the cICP entry to the list of known chunks to ignore inside
`png_set_keep_unknown_chunks`.
* Handle cICP in `png_read_end`, alongside cHRM, gAMA, iCCP, sRGB.
* In pngtest.c, move the cICP test code near cHRM, gaMA, iCCP, sRGB.
This is a cherry-pick of commit 27c2ac722fd99b8622cead655034208ce96346ac
from branch 'libpng18'.
Reviewed-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
Update the main CMake file and the auxiliary test scripts accordingly.
This is a cherry-pick of commit fe277b7752990be35523832a546aec478437968a
from branch 'libpng18'.
Apply the following corrections and improvements:
* Add a validity check in `png_set_cICP`.
* Fix the ordering check in `png_handle_cICP`.
* Add a multiplicity check in `png_handle_cICP`.
* Optimize the implementation of `png_write_cICP`.
* Remove an unnecessary preprocessor guard from pngtest.c.
* Update the dependency declaration in pnglibconf.dfa.
* Fix the indentation where necessary.
This is a cherry-pick of commit c2a02691df1ecf51b7c97142752a7034350cb1f6
from branch 'libpng18'.
This chunk was added in the third edition of the PNG specification and
contains Coding Independent Code Points (related to color space
description). It is fairly simple as it only contains four fields of one
byte each: Colour Primaries, Transfer Function, Matrix Coefficients,
Video Full Range Flag.
The test file originally comes from the related WPT test case:
https://github.com/web-platform-tests/wpt/blob/master/png/support/cicp-display-p3.png
Note that I reencoded the file to make it match libpng's default
encoding parameters (it only modifies the IDAT chunk).
This is a cherry-pick of commit 65925ad4b2cbed934d5d850fe764dc46c4becbcb
from branch 'libpng18'.
Reviewed-by: John Bowler <jbowler@acm.org>
Reviewed-by: Chris Blume <ProgramMax@gmail.com>
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
Embarcadero's compilers, old (Borland-based) and new (Clang-based),
do have full support for Standard C. The Clang-based compiler is
claiming, through the macro __STDC_VERSION__, to support C99 and C11,
whereas the Borland-based compiler supports ANSI C, as it has for
decades.
However, their run-time library is exposing global functions beyond
the scope of Standard C, for backwards compatibility with the older
Borland products. One of these functions is `randomize`, which clashes
with a function inside pngvalid.c that incidentally has the same name.
Building libpng in "Strict ANSI C" mode, in which all Borland-specific
globals are hidden (e.g. via `bcc32 -A`), would have been a workable
solution for the Borland-based ANSI C compiler, but no such solution
appears to exist for the Clang-based C90/C99/C11 compiler.
Fortunately, renaming a private function inside a test program is a
cost-free alternative fix.
This is a cherry-pick of commit 6184164aa73ee764b1822f44d3db7619cf84f3fa
from branch 'libpng18'.
Move the definitions of interlace arrays to the top of their respective
translation units, to reduce their repeated copying in various places of
the codebase.
TODO:
As they still exist in three copies, in pngpread.c, in pngrutil.c, and
in pngwutil.c, they should all be further moved to a common place.
This is a cherry-pick of commit 620a2b73b22df66ed099e1faacac2d92f48252b7
from branch 'libpng18'.
Disable the check on `interlace_method` inside function `compare_read`
in pngimage.c, if WRITE_INTERLACING is not supported.
If interlaced encoding is disabled inside libpng, the encoded images
are non-interlaced silently and unconditionally. This commit updates
the image comparison to skip the interlace check in the resultant
image; other behavior is still checked.
This is a cherry-pick of commit d9f13d8d846e08b00f6530b7a5fe07039d48c78d
from branch 'libpng18'.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This is a cherry-picked of commit f45531cc141dc20dc7a4046bbe92270b1e799a5d
from branch 'libpng18'.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
Introduce CMake file linting, based on the cmakelang project by
Josh Bialkowski (@cheshirekow).
Fix various style issues in the CMake files:
* Add the missing copyright header to PNGConfig.cmake.
* Resolve a "missing docstring" warning raised by cmake-lint.
* Rewrite all docstrings in the style of CMake's own documentation.
* Fix whitespace inconsistencies.
References:
* https://pypi.org/project/cmakelang
* https://github.com/cheshirekow/cmake_format
This is a cherry-pick of commit c317fe31114d92d05d44bf98c9b559edf4656b9c
from branch 'libpng18'.
The leading blank lines are apparently an artefact of an older source
control system. They are not required and they look like accidents,
because starting a source file with a blank line is not a regular habit
of software developers nowadays.
This is a cherry-pick of commit 37cc20add8fb5b83bb5299a26cd3b41e0f776017
from branch 'libpng18'.
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
The code erroneously evaluated `addend0+addend1` in the case where
`addend1` is less than zero. The function is meant to subtract the
second argument from the first.
This is a cherry-pick of commit 79fd6d1edc8fe8c41ed58c6318bd57761d8f007e
from branch 'libpng18'.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
Allow ci_verify_configure.sh to pass regardless whether the configure
script and the associated configure control files are present.
This is necessary for the branches newer than 'libpng16', where these
artifacts are no longer auto-generated by default.
This is a cherry-pick of commit 09ec97edc099538d548a67253b990660c912af4f
from branch 'libpng18'.
Due to raising the minimum CMake version to 3.14, we can now run the
CMake build verification (ci_verify_cmake.sh) from the libpng source
dir, just as in the other scripts (ci_verify_*.sh). This is possible
thanks to the modern CMake command options `cmake -B` and `cmake -S`.
We can finally simplify the implementation of ci_verify_cmake.sh by
removing a code complication that was annoying, and yet, necessary in
peculiar Bash-on-Windows setups.
Fun fact:
CMake version 3.14 was released on 2019-03-14. Reportedly, on purpose!
This is a cherry-pick of commit 558dfbb7570cb74205f978f11504b217a2c03c2c
from branch 'libpng18'.
Start using the features guaranteed to be available in CMake 3.14.
Specifically, use the ability of `find_package(ZLIB)` to pick up zlib
from the ZLIB_ROOT variable (if given).
This is a cherry-pick of commit 00343a761e41e56acaeb0517aec5325d3b951837
from branch 'libpng18'.
This changes the arm/palette_neon_intrinsics.c code from using a bare
cast to using the portable macro `png_aligncastconst`. This removes
the `-Wcast-align` warning.
The cast is safe because the pointer was allocated by `malloc(1024)`,
and `malloc` is required to return a pointer with sufficient alignment
for anything the allocation can accomodate.
Nevertheless, this is a quick and dirty fix; the use of `png_bytep` in
the `png_struct` declaration of the pointer is machine-specific. Other
architectures may need different types and, consequently, the only type
which is portable to other companies' CPUs is `(void*)`.
This is a cherry-pick of commit a604b12c112162bfb45a0476e956777f6ed82d85
from branch 'libpng18'.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
The subtracts in PNG_XYZ_from_xy are producing integer overflow with
some valid but extreme xy values. This re-introduces the previous
checks, but with less limited bounds; sufficient to accomodate the
ACEScg end points (ACES AP1), but not for the ACES AP0 end points.
Those were not working anyway because libpng reads the cHRM parameters
as unsigned values, so they must always be at least 0.
A better solution requires recognizing reasonable negative values (ones
which violate the current spec) and allowing them too, at least on read.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
The MIPS MSA code contains // comments and the use of an "asm"
directive, neither of which are part of ISO-C90. This removes the //
comments and converts asm to __asm__, which GCC allows.
The code compiles but maintenance is required; it's not clear it will
work on anything other than one specific compiler/isa combination. It
should be rewritten using intrinsics, not assembler; as it stands it is
a security risk.
This is a cherry-pick of commit bd39ebbcfd64d785f907b5e8dd4055a97a34f2cf
from branch 'libpng18'.
Co-authored-by: Cosmin Truta <ctruta@gmail.com>
Reviewed-by: Chris Blume <ProgramMax@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
Ignore artifacts produced by IDEs such as Embarcadero RAD Studio,
JetBrains Fleet, Qt Creator, and possibly others.
Also update the list of artifacts produced by C/C++ workflows and
CMake workflows in Microsoft Visual Studio and Qt Creator.
This is a cherry-pick of commit 10c76f3a1a9096f9b7cf64dd7abf5035e379e47f
from branch 'libpng18'.
Add projects/vstudio/build.bat, a wrapper for `devenv [...] /build`.
This is a cherry-pick of commit f1c01b5c36fc4fdcd9238c5295cc5565a9caa43e
from branch 'libpng18'.
