3 * Copyright (c) 2014 John Cunningham Bowler
5 * Last changed in libpng 1.6.9 [(PENDING RELEASE)]
7 * This code is released under the libpng license.
8 * For conditions of distribution and use, see the disclaimer
11 * Tool to check and fix the zlib inflate 'too far back' problem, see the usage
12 * message for more information.
22 #define implies(x,y) assert(!(x) || (y))
25 /* This is used to fix the error:
28 * In function 'zlib_advance':
29 * pngfix.c:181:13: error: assuming signed overflow does not
30 * occur when simplifying conditional to constant [-Werror=strict-overflow]
32 # define FIX_GCC volatile
37 #define PROGRAM_NAME "pngfix"
39 /* Define the following to use this program against your installed libpng,
40 * rather than the one being built here:
42 #ifdef PNG_FREESTANDING_TESTS
45 # include "../../png.h"
48 #if PNG_LIBPNG_VER < 10603 /* 1.6.3 */
49 # error "pngfix will not work with libpng prior to 1.6.3"
52 #if defined(PNG_READ_SUPPORTED) && defined(PNG_EASY_ACCESS_SUPPORTED)
53 /* zlib.h defines the structure z_stream, an instance of which is included
54 * in this structure and is required for decompressing the LZ compressed
58 /* We must ensure that zlib uses 'const' in declarations. */
63 /* zlib.h sometimes #defines const to nothing, undo this. */
67 /* zlib.h has mediocre z_const use before 1.2.6, this stuff is for compatibility
70 #if ZLIB_VERNUM < 0x1260
71 # define PNGZ_MSG_CAST(s) png_constcast(char*,s)
72 # define PNGZ_INPUT_CAST(b) png_constcast(png_bytep,b)
74 # define PNGZ_MSG_CAST(s) (s)
75 # define PNGZ_INPUT_CAST(b) (b)
78 #ifndef PNG_MAXIMUM_INFLATE_WINDOW
79 # error "pngfix not supported in this libpng version"
82 #if PNG_ZLIB_VERNUM >= 0x1240
84 /* Copied from pngpriv.h */
86 # define png_voidcast(type, value) static_cast<type>(value)
87 # define png_constcast(type, value) const_cast<type>(value)
88 # define png_aligncast(type, value) \
89 static_cast<type>(static_cast<void*>(value))
90 # define png_aligncastconst(type, value) \
91 static_cast<type>(static_cast<const void*>(value))
93 # define png_voidcast(type, value) (value)
94 # define png_constcast(type, value) ((type)(value))
95 # define png_aligncast(type, value) ((void*)(value))
96 # define png_aligncastconst(type, value) ((const void*)(value))
97 #endif /* __cplusplus */
99 #if PNG_LIBPNG_VER < 10700
100 /* Chunk tags (copied from pngpriv.h) */
101 #define PNG_32b(b,s) ((png_uint_32)(b) << (s))
102 #define PNG_U32(b1,b2,b3,b4) \
103 (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0))
105 /* Constants for known chunk types. */
106 #define png_IDAT PNG_U32( 73, 68, 65, 84)
107 #define png_IEND PNG_U32( 73, 69, 78, 68)
108 #define png_IHDR PNG_U32( 73, 72, 68, 82)
109 #define png_PLTE PNG_U32( 80, 76, 84, 69)
110 #define png_bKGD PNG_U32( 98, 75, 71, 68)
111 #define png_cHRM PNG_U32( 99, 72, 82, 77)
112 #define png_fRAc PNG_U32(102, 82, 65, 99) /* registered, not defined */
113 #define png_gAMA PNG_U32(103, 65, 77, 65)
114 #define png_gIFg PNG_U32(103, 73, 70, 103)
115 #define png_gIFt PNG_U32(103, 73, 70, 116) /* deprecated */
116 #define png_gIFx PNG_U32(103, 73, 70, 120)
117 #define png_hIST PNG_U32(104, 73, 83, 84)
118 #define png_iCCP PNG_U32(105, 67, 67, 80)
119 #define png_iTXt PNG_U32(105, 84, 88, 116)
120 #define png_oFFs PNG_U32(111, 70, 70, 115)
121 #define png_pCAL PNG_U32(112, 67, 65, 76)
122 #define png_pHYs PNG_U32(112, 72, 89, 115)
123 #define png_sBIT PNG_U32(115, 66, 73, 84)
124 #define png_sCAL PNG_U32(115, 67, 65, 76)
125 #define png_sPLT PNG_U32(115, 80, 76, 84)
126 #define png_sRGB PNG_U32(115, 82, 71, 66)
127 #define png_sTER PNG_U32(115, 84, 69, 82)
128 #define png_tEXt PNG_U32(116, 69, 88, 116)
129 #define png_tIME PNG_U32(116, 73, 77, 69)
130 #define png_tRNS PNG_U32(116, 82, 78, 83)
131 #define png_zTXt PNG_U32(122, 84, 88, 116)
134 /* The 8 byte signature as a pair of 32 bit quantities */
135 #define sig1 PNG_U32(137, 80, 78, 71)
136 #define sig2 PNG_U32( 13, 10, 26, 10)
138 /* Is the chunk critical? */
139 #define CRITICAL(chunk) (((chunk) & PNG_U32(32,0,0,0)) == 0)
141 /* Is it safe to copy? */
142 #define SAFE_TO_COPY(chunk) (((chunk) & PNG_U32(0,0,0,32)) != 0)
144 /* Fix ups for builds with limited read support */
145 #ifndef PNG_ERROR_TEXT_SUPPORTED
146 # define png_error(a,b) png_err(a)
149 /********************************* UTILITIES **********************************/
150 /* UNREACHED is a value to cause an assert to fail. Because of the way the
151 * assert macro is written the string "UNREACHED" is produced in the error
156 /* 80-bit number handling - a PNG image can be up to (2^31-1)x(2^31-1) 8 byte
157 * (16-bit RGBA) pixels in size; that's less than 2^65 bytes or 2^68 bits, so
158 * arithmetic of 80-bit numbers is sufficient. This representation uses an
159 * arbitrary length array of png_uint_16 digits (0..65535). The representation
162 * The arithmetic functions take zero to two uarb values together with the
163 * number of digits in those values and write the result to the given uarb
164 * (always the first argument) returning the number of digits in the result.
165 * If the result is negative the return value is also negative (this would
166 * normally be an error).
168 typedef png_uint_16 udigit; /* A 'unum' is an array of these */
169 typedef png_uint_16p uarb;
170 typedef png_const_uint_16p uarbc;
172 #define UDIGITS(unum) ((sizeof unum)/(sizeof (udigit))
173 /* IMPORTANT: only apply this to an array, applied to a pointer the result
174 * will typically be '2', which is not useful.
178 uarb_set(uarb result, png_alloc_size_t val)
179 /* Set (initialize) 'result' to 'val'. The size required for 'result' must
180 * be determined by the caller from a knowledge of the maximum for 'val'.
187 result[ndigits++] = (png_uint_16)(val & 0xffff);
195 uarb_copy(uarb to, uarb from, int idigits)
196 /* Copy a uarb, may reduce the digit count */
200 for (d=odigits=0; d<idigits; ++d)
201 if ((to[d] = from[d]) != 0)
208 uarb_inc(uarb num, int in_digits, png_int_32 add)
209 /* This is a signed 32-bit add, except that to avoid overflow the value added
210 * or subtracted must be no more than 2^31-65536. A negative result
211 * indicates a negative number (which is an error below). The size of
212 * 'num' should be max(in_digits+1,2) for arbitrary 'add' but can be just
213 * in_digits+1 if add is known to be in the range -65535..65535.
216 FIX_GCC int out_digits = 0;
218 while (out_digits < in_digits)
220 add += num[out_digits];
221 num[out_digits++] = (png_uint_16)(add & 0xffff);
225 while (add != 0 && add != (-1))
227 num[out_digits++] = (png_uint_16)(add & 0xffff);
233 while (out_digits > 0 && num[out_digits-1] == 0)
235 return out_digits; /* may be 0 */
238 else /* negative result */
240 while (out_digits > 1 && num[out_digits-1] == 0xffff)
248 uarb_add32(uarb num, int in_digits, png_uint_32 add)
249 /* As above but this works with any 32-bit value and only does 'add' */
253 in_digits = uarb_inc(num, in_digits, add & 0xffff);
254 return uarb_inc(num+1, in_digits-1, add >> 16)+1;
257 return uarb_set(num, add);
261 uarb_mult_digit(uarb acc, int a_digits, uarb num, FIX_GCC int n_digits,
263 /* Primitive one-digit multiply - 'val' must be 0..65535. Note that this
264 * primitive is a multiply and accumulate - the result of *num * val is added
267 * This is a one-digit multiply, so the product may be up to one digit longer
268 * than 'num', however the add to 'acc' means that the caller must ensure
269 * that 'acc' is at least one digit longer than this *and* at least one digit
270 * longer than the current length of 'acc'. (Or the caller must otherwise
271 * ensure 'adigits' is adequate from knowledge of the values.)
274 /* The digits in *acc, *num and val are in the range 0..65535, so the
275 * result below is at most (65535*65535)+2*65635 = 65535*(65535+2), which is
276 * exactly 0xffffffff.
278 if (val > 0 && n_digits > 0) /* Else the product is 0 */
280 png_uint_32 carry = 0;
283 while (out_digits < n_digits || carry > 0)
285 if (out_digits < a_digits)
286 carry += acc[out_digits];
288 if (out_digits < n_digits)
289 carry += (png_uint_32)num[out_digits] * val;
291 acc[out_digits++] = (png_uint_16)(carry & 0xffff);
295 /* So carry is 0 and all the input digits have been consumed. This means
296 * that it is possible to skip any remaining digits in acc.
298 if (out_digits > a_digits)
306 uarb_mult32(uarb acc, int a_digits, uarb num, int n_digits, png_uint_32 val)
307 /* calculate acc += num * val, 'val' may be any 32-bit value, 'acc' and 'num'
308 * may be any value, returns the number of digits in 'acc'.
311 if (n_digits > 0 && val > 0)
313 a_digits = uarb_mult_digit(acc, a_digits, num, n_digits,
314 (png_uint_16)(val & 0xffff));
316 /* Because n_digits and val are >0 the following must be true: */
317 assert(a_digits > 0);
321 a_digits = uarb_mult_digit(acc+1, a_digits-1, num, n_digits,
322 (png_uint_16)val) + 1;
329 uarb_shift(uarb inout, int ndigits, unsigned int right_shift)
330 /* Shift inout right by right_shift bits, right_shift must be in the range
334 FIX_GCC int i = ndigits;
335 png_uint_16 carry = 0;
337 assert(right_shift >= 1 && right_shift <= 15);
341 png_uint_16 temp = (png_uint_16)(carry | (inout[i] >> right_shift));
343 /* Bottom bits to top bits of carry */
344 carry = (png_uint_16)((inout[i] << (16-right_shift)) & 0xffff);
348 /* The shift may reduce ndigits */
349 if (i == ndigits-1 && temp == 0)
357 uarb_cmp(uarb a, int adigits, uarb b, int bdigits)
358 /* Return -1/0/+1 according as a<b/a==b/a>b */
360 if (adigits < bdigits)
363 if (adigits > bdigits)
366 while (adigits-- > 0)
367 if (a[adigits] < b[adigits])
370 else if (a[adigits] > b[adigits])
378 uarb_eq32(uarb num, int digits, png_uint_32 val)
379 /* Return true if the uarb is equal to 'val' */
383 case 0: return val == 0;
384 case 1: return val == num[0];
385 case 2: return (val & 0xffff) == num[0] && (val >> 16) == num[1];
392 uarb_printx(uarb num, int digits, FILE *out)
393 /* Print 'num' as a hexadecimal number (easier than decimal!) */
396 if (num[--digits] > 0)
398 fprintf(out, "0x%x", num[digits]);
401 fprintf(out, "%.4x", num[--digits]);
404 else if (digits == 0) /* the number is 0 */
409 uarb_print(uarb num, int digits, FILE *out)
410 /* Prints 'num' as a decimal if it will fit in an unsigned long, else as a
411 * hexadecimal number. Notice that the results vary for images over 4GByte
412 * in a system dependent way, and the hexadecimal form doesn't work very well
413 * in awk script input.
416 * TODO: write uarb_div10
419 if (digits * sizeof (udigit) > sizeof (unsigned long))
420 uarb_printx(num, digits, out);
427 n = (n << 16) + num[--digits];
429 fprintf(out, "%lu", n);
433 /* Generate random bytes. This uses a boring repeatable algorithm and it
434 * is implemented here so that it gives the same set of numbers on every
435 * architecture. It's a linear congruential generator (Knuth or Sedgewick
436 * "Algorithms") but it comes from the 'feedback taps' table in Horowitz and
437 * Hill, "The Art of Electronics" (Pseudo-Random Bit Sequences and Noise
440 * (Copied from contrib/libtests/pngvalid.c)
443 make_random_bytes(png_uint_32* seed, void* pv, size_t size)
445 png_uint_32 u0 = seed[0], u1 = seed[1];
446 png_bytep bytes = png_voidcast(png_bytep, pv);
448 /* There are thirty-three bits; the next bit in the sequence is bit-33 XOR
449 * bit-20. The top 1 bit is in u1, the bottom 32 are in u0.
452 for (i=0; i<size; ++i)
454 /* First generate 8 new bits then shift them in at the end. */
455 png_uint_32 u = ((u0 >> (20-8)) ^ ((u1 << 7) | (u0 >> (32-7)))) & 0xff;
460 *bytes++ = (png_byte)u;
467 /* Clear an object to a random value. */
469 clear(void *pv, size_t size)
471 static png_uint_32 clear_seed[2] = { 0x12345678, 0x9abcdef0 };
472 make_random_bytes(clear_seed, pv, size);
475 #define CLEAR(object) clear(&(object), sizeof (object))
477 /* Copied from unreleased 1.7 code.
479 * CRC checking uses a local pre-built implementation of the Ethernet CRC32.
480 * This is to avoid a function call to the zlib DLL and to optimize the
483 static png_uint_32 crc_table[256] =
485 0x00000000, 0x77073096, 0xee0e612c, 0x990951ba, 0x076dc419,
486 0x706af48f, 0xe963a535, 0x9e6495a3, 0x0edb8832, 0x79dcb8a4,
487 0xe0d5e91e, 0x97d2d988, 0x09b64c2b, 0x7eb17cbd, 0xe7b82d07,
488 0x90bf1d91, 0x1db71064, 0x6ab020f2, 0xf3b97148, 0x84be41de,
489 0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7, 0x136c9856,
490 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec, 0x14015c4f, 0x63066cd9,
491 0xfa0f3d63, 0x8d080df5, 0x3b6e20c8, 0x4c69105e, 0xd56041e4,
492 0xa2677172, 0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b,
493 0x35b5a8fa, 0x42b2986c, 0xdbbbc9d6, 0xacbcf940, 0x32d86ce3,
494 0x45df5c75, 0xdcd60dcf, 0xabd13d59, 0x26d930ac, 0x51de003a,
495 0xc8d75180, 0xbfd06116, 0x21b4f4b5, 0x56b3c423, 0xcfba9599,
496 0xb8bda50f, 0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924,
497 0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d, 0x76dc4190,
498 0x01db7106, 0x98d220bc, 0xefd5102a, 0x71b18589, 0x06b6b51f,
499 0x9fbfe4a5, 0xe8b8d433, 0x7807c9a2, 0x0f00f934, 0x9609a88e,
500 0xe10e9818, 0x7f6a0dbb, 0x086d3d2d, 0x91646c97, 0xe6635c01,
501 0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e, 0x6c0695ed,
502 0x1b01a57b, 0x8208f4c1, 0xf50fc457, 0x65b0d9c6, 0x12b7e950,
503 0x8bbeb8ea, 0xfcb9887c, 0x62dd1ddf, 0x15da2d49, 0x8cd37cf3,
504 0xfbd44c65, 0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2,
505 0x4adfa541, 0x3dd895d7, 0xa4d1c46d, 0xd3d6f4fb, 0x4369e96a,
506 0x346ed9fc, 0xad678846, 0xda60b8d0, 0x44042d73, 0x33031de5,
507 0xaa0a4c5f, 0xdd0d7cc9, 0x5005713c, 0x270241aa, 0xbe0b1010,
508 0xc90c2086, 0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f,
509 0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4, 0x59b33d17,
510 0x2eb40d81, 0xb7bd5c3b, 0xc0ba6cad, 0xedb88320, 0x9abfb3b6,
511 0x03b6e20c, 0x74b1d29a, 0xead54739, 0x9dd277af, 0x04db2615,
512 0x73dc1683, 0xe3630b12, 0x94643b84, 0x0d6d6a3e, 0x7a6a5aa8,
513 0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1, 0xf00f9344,
514 0x8708a3d2, 0x1e01f268, 0x6906c2fe, 0xf762575d, 0x806567cb,
515 0x196c3671, 0x6e6b06e7, 0xfed41b76, 0x89d32be0, 0x10da7a5a,
516 0x67dd4acc, 0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5,
517 0xd6d6a3e8, 0xa1d1937e, 0x38d8c2c4, 0x4fdff252, 0xd1bb67f1,
518 0xa6bc5767, 0x3fb506dd, 0x48b2364b, 0xd80d2bda, 0xaf0a1b4c,
519 0x36034af6, 0x41047a60, 0xdf60efc3, 0xa867df55, 0x316e8eef,
520 0x4669be79, 0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236,
521 0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f, 0xc5ba3bbe,
522 0xb2bd0b28, 0x2bb45a92, 0x5cb36a04, 0xc2d7ffa7, 0xb5d0cf31,
523 0x2cd99e8b, 0x5bdeae1d, 0x9b64c2b0, 0xec63f226, 0x756aa39c,
524 0x026d930a, 0x9c0906a9, 0xeb0e363f, 0x72076785, 0x05005713,
525 0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38, 0x92d28e9b,
526 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21, 0x86d3d2d4, 0xf1d4e242,
527 0x68ddb3f8, 0x1fda836e, 0x81be16cd, 0xf6b9265b, 0x6fb077e1,
528 0x18b74777, 0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c,
529 0x8f659eff, 0xf862ae69, 0x616bffd3, 0x166ccf45, 0xa00ae278,
530 0xd70dd2ee, 0x4e048354, 0x3903b3c2, 0xa7672661, 0xd06016f7,
531 0x4969474d, 0x3e6e77db, 0xaed16a4a, 0xd9d65adc, 0x40df0b66,
532 0x37d83bf0, 0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9,
533 0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6, 0xbad03605,
534 0xcdd70693, 0x54de5729, 0x23d967bf, 0xb3667a2e, 0xc4614ab8,
535 0x5d681b02, 0x2a6f2b94, 0xb40bbe37, 0xc30c8ea1, 0x5a05df1b,
539 /* The CRC calculated here *IS* conditioned, the corresponding value used by
540 * zlib and the result value is obtained by XORing with CRC_INIT, which is also
541 * the first value that must be passed in (for the first byte) to crc_one_byte.
543 #define CRC_INIT 0xffffffff
546 crc_one_byte(png_uint_32 crc, int b)
548 return crc_table[(crc ^ b) & 0xff] ^ (crc >> 8);
552 crc_init_4(png_uint_32 value)
554 /* This is an alternative to the algorithm used in zlib, which requires four
555 * separate tables to parallelize the four byte operations, it only works for
556 * a CRC of the first four bytes of the stream, but this is what happens in
557 * the parser below where length+chunk-name is read and chunk-name used to
558 * initialize the CRC. Notice that the calculation here avoids repeated
559 * conditioning (xor with 0xffffffff) by storing the conditioned value.
561 png_uint_32 crc = crc_table[(~value >> 24)] ^ 0xffffff;
563 crc = crc_table[(crc ^ (value >> 16)) & 0xff] ^ (crc >> 8);
564 crc = crc_table[(crc ^ (value >> 8)) & 0xff] ^ (crc >> 8);
565 return crc_table[(crc ^ value) & 0xff] ^ (crc >> 8);
569 chunk_type_valid(png_uint_32 c)
570 /* Bit whacking approach to chunk name validation that is intended to avoid
571 * branches. The cost is that it uses a lot of 32-bit constants, which might
572 * be bad on some architectures.
577 /* Remove bit 5 from all but the reserved byte; this means every
578 * 8-bit unit must be in the range 65-90 to be valid. So bit 5
579 * must be zero, bit 6 must be set and bit 7 zero.
581 c &= ~PNG_U32(32,32,0,32);
582 t = (c & ~0x1f1f1f1f) ^ 0x40404040;
584 /* Subtract 65 for each 8 bit quantity, this must not overflow
585 * and each byte must then be in the range 0-25.
587 c -= PNG_U32(65,65,65,65);
590 /* Subtract 26, handling the overflow which should set the top
591 * three bits of each byte.
593 c -= PNG_U32(25,25,25,26);
596 return (t & 0xe0e0e0e0) == 0;
599 /**************************** CONTROL INFORMATION *****************************/
601 /* Information about a sequence of IDAT chunks, the chunks have been re-synced
602 * using sync_stream below and the new lengths are recorded here. Because the
603 * number of chunks is unlimited this is handled using a linked list of these
608 struct IDAT_list *next; /* Linked list */
609 unsigned int length; /* Actual length of the array below */
610 unsigned int count; /* Number of entries that are valid */
611 # define IDAT_INIT_LENGTH 16
612 png_uint_32 lengths[IDAT_INIT_LENGTH];
616 IDAT_list_init(struct IDAT_list *list)
621 list->length = IDAT_INIT_LENGTH;
625 IDAT_list_size(struct IDAT_list *list, unsigned int length)
626 /* Return the size in bytes of an IDAT_list of the given length. */
629 length = list->length;
631 return sizeof *list - sizeof list->lengths +
632 length * sizeof list->lengths[0];
636 IDAT_list_end(struct IDAT_list *IDAT_list)
638 struct IDAT_list *list = IDAT_list->next;
644 struct IDAT_list *next = list->next;
646 clear(list, IDAT_list_size(list, 0));
652 static struct IDAT_list *
653 IDAT_list_extend(struct IDAT_list *tail)
655 /* Use the previous cached value if available. */
656 struct IDAT_list *next = tail->next;
660 /* Insert a new, malloc'ed, block of IDAT information buffers, this
661 * one twice as large as the previous one:
663 unsigned int length = 2 * tail->length;
665 if (length < tail->length) /* arithmetic overflow */
666 length = tail->length;
668 next = png_voidcast(IDAT_list*, malloc(IDAT_list_size(NULL, length)));
671 /* The caller must handle this: */
676 next->length = length;
683 /* GLOBAL CONTROL STRUCTURE */
686 /* PUBLIC GLOBAL VARIABLES: OWNER INITIALIZE */
687 unsigned int errors :1; /* print file errors to stderr */
688 unsigned int warnings :1; /* print libpng warnings to stderr */
689 unsigned int optimize_zlib :1; /* Run optimization search */
690 unsigned int quiet :2; /* don't output summaries */
691 unsigned int verbose :3; /* various internal tracking */
692 unsigned int skip :3; /* Non-critical chunks to skip */
694 # define SKIP_BAD_CRC 1 /* Chunks with a bad CRC */
695 # define SKIP_UNSAFE 2 /* Chunks not safe to copy */
696 # define SKIP_UNUSED 3 /* Chunks not used by libpng */
697 # define SKIP_TRANSFORM 4 /* Chunks only used in transforms */
698 # define SKIP_COLOR 5 /* Everything but tRNS, sBIT, gAMA and sRGB */
699 # define SKIP_ALL 6 /* Everything but tRNS and sBIT */
701 png_uint_32 idat_max; /* 0 to perform no re-chunking */
703 int status_code; /* Accumulated status code */
704 # define TOO_FAR_BACK 0x01 /* found a too-far-back error */
705 # define CRC_ERROR 0x02 /* fixed an invalid CRC */
706 # define STREAM_ERROR 0x04 /* damaged PNG stream (may be fixable) */
707 # define TRUNCATED 0x08 /* truncated but still readable */
708 # define FILE_ERROR 0x10 /* could not read the file */
709 # define WRITE_ERROR 0x20 /* write error (this terminates the read) */
710 # define INTERNAL_ERROR 0x40 /* internal limits/errors encountered */
712 /* PUBLIC GLOBAL VARIABLES: USED INTERNALLY BY IDAT READ CODE */
713 struct IDAT_list idat_cache; /* Cache of file IDAT information buffers */
714 /* The structure is shared across all uses of this global control
715 * structure to avoid reallocation between IDAT streams.
720 global_end(struct global *global)
725 IDAT_list_end(&global->idat_cache);
726 rc = global->status_code;
732 global_init(struct global *global)
733 /* Call this once (and only once) to initialize the control */
739 global->warnings = 0;
742 global->idat_max = 0; /* no re-chunking of IDAT */
743 global->optimize_zlib = 0;
744 global->skip = SKIP_NONE;
745 global->status_code = 0;
747 IDAT_list_init(&global->idat_cache);
751 skip_chunk_type(const struct global *global, png_uint_32 type)
752 /* Return true if this chunk is to be skipped according to the --strip
753 * option. This code needs to recognize all known ancillary chunks in order
754 * to handle the --strip=unsafe option.
757 /* Never strip critical chunks: */
763 /* Chunks that are treated as, effectively, critical because they affect
764 * correct interpretation of the pixel values:
766 case png_tRNS: case png_sBIT:
769 /* Chunks that specify gamma encoding which should therefore only be
770 * removed the the user insists:
772 case png_gAMA: case png_sRGB:
773 if (global->skip >= SKIP_ALL)
777 /* Chunks that affect color interpretation - not used by libpng and rarely
778 * used by applications, but technically still required for correct
779 * interpretation of the image data:
781 case png_cHRM: case png_iCCP:
782 if (global->skip >= SKIP_COLOR)
786 /* Other chunks that are used by libpng in image transformations (as
787 * opposed to known chunks that have get/set APIs but are not otherwise
791 if (global->skip >= SKIP_TRANSFORM)
795 /* All other chunks that libpng knows about and affect neither image
796 * interpretation nor libpng transforms - chunks that are effectively
797 * unused by libpng even though libpng might recognize and store them.
799 case png_fRAc: case png_gIFg: case png_gIFt: case png_gIFx: case png_hIST:
800 case png_iTXt: case png_oFFs: case png_pCAL: case png_pHYs: case png_sCAL:
801 case png_sPLT: case png_sTER: case png_tEXt: case png_tIME: case png_zTXt:
802 if (global->skip >= SKIP_UNUSED)
806 /* Chunks that libpng does not know about (notice that this depends on the
807 * list above including all known chunks!) The decision here depends on
808 * whether the safe-to-copy bit is set in the chunk type.
811 if (SAFE_TO_COPY(type))
813 if (global->skip >= SKIP_UNUSED) /* as above */
817 else if (global->skip >= SKIP_UNSAFE)
824 /* PER-FILE CONTROL STRUCTURE */
830 struct global *global;
832 /* PUBLIC PER-FILE VARIABLES: CALLER INITIALIZE */
833 const char * file_name;
834 const char * out_name; /* Name of output file (if required) */
836 /* PUBLIC PER-FILE VARIABLES: SET BY PNG READ CODE */
837 /* File specific result codes */
838 int status_code; /* Set to a bit mask of the following: */
839 int read_errno; /* Records a read error errno */
840 int write_errno; /* Records a write error errno */
842 /* IHDR information */
847 png_byte compression_method;
848 png_byte filter_method;
849 png_byte interlace_method;
851 udigit image_bytes[5];
854 /* PROTECTED PER-FILE VARIABLES: USED BY THE READ CODE */
855 FILE * file; /* Original PNG file */
856 FILE * out; /* If a new one is being written */
857 jmp_buf jmpbuf; /* Set while reading a PNG */
859 /* PROTECTED CHUNK SPECIFIC VARIABLES: USED BY CHUNK CODE */
860 /* The following variables are used during reading to record the length, type
861 * and data position of the *next* chunk or, right at the start, the
862 * signature (in length,type).
864 * When a chunk control structure is instantiated these values are copied
865 * into the structure and can then be overritten with the data for the next
868 fpos_t data_pos; /* Position of first byte of chunk data */
869 png_uint_32 length; /* First word (length or signature start) */
870 png_uint_32 type; /* Second word (type or signature end) */
871 png_uint_32 crc; /* Running chunk CRC (used by read_chunk) */
873 /* These counts are maintained by the read and write routines below and are
874 * reset by the chunk handling code. They record the total number of bytes
875 * read or written for the chunk, including the header (length,type) bytes.
877 png_uint_32 read_count; /* Count of bytes read (in the chunk) */
878 png_uint_32 write_count; /* Count of bytes written (in the chunk) */
879 int state; /* As defined here: */
880 # define STATE_SIGNATURE 0 /* The signature is being written */
881 # define STATE_CHUNKS 1 /* Non-IDAT chunks are being written */
882 # define STATE_IDAT 2 /* An IDAT stream is being written */
884 /* Two pointers used to enable clean-up in the event of fatal errors and to
885 * hold state about the parser process (only one of each at present.)
887 struct chunk * chunk;
890 /* Interface to allocate a new chunk or IDAT control structure. The result
891 * is returned by setting one or other of the above variables. Note that the
892 * relevant initializer is called by the allocator function. The alloc_ptr
893 * is used only by the implementation of the allocate function.
896 void (*alloc)(struct file*,int idat);
897 /* idat: allocate IDAT not chunk */
900 /* Valid longjmp (stop) codes are: */
901 #define LIBPNG_WARNING_CODE 1 /* generic png_error */
902 #define LIBPNG_ERROR_CODE 2 /* generic png_error */
903 #define ZLIB_ERROR_CODE 3 /* generic zlib error */
904 #define INVALID_ERROR_CODE 4 /* detected an invalid PNG */
905 #define READ_ERROR_CODE 5 /* read failed */
906 #define WRITE_ERROR_CODE 6 /* error in write */
907 #define UNEXPECTED_ERROR_CODE 7 /* unexpected (internal?) error */
910 emit_string(const char *str, FILE *out)
911 /* Print a string with spaces replaced by '_' and non-printing characters by
916 if (isgraph(UCHAR_MAX & *str))
919 else if (isspace(UCHAR_MAX & *str))
923 fprintf(out, "\\%.3o", *str);
931 case LIBPNG_WARNING_CODE: return "warning";
932 case LIBPNG_ERROR_CODE: return "libpng";
933 case ZLIB_ERROR_CODE: return "zlib";
934 case INVALID_ERROR_CODE: return "invalid";
935 case READ_ERROR_CODE: return "read";
936 case WRITE_ERROR_CODE: return "write";
937 case UNEXPECTED_ERROR_CODE: return "unexpected";
938 default: return "INVALID";
943 emit_error(struct file *file, int code, const char *what)
944 /* Generic error message routine, takes a 'stop' code but can be used
945 * elsewhere. Always outputs a message.
953 case LIBPNG_WARNING_CODE: reason = "libpng warning:"; break;
954 case LIBPNG_ERROR_CODE: reason = "libpng error:"; break;
955 case ZLIB_ERROR_CODE: reason = "zlib error:"; break;
956 case INVALID_ERROR_CODE: reason = "invalid"; break;
957 case READ_ERROR_CODE: reason = "read failure:";
958 err = file->read_errno;
960 case WRITE_ERROR_CODE: reason = "write error";
961 err = file->write_errno;
963 case UNEXPECTED_ERROR_CODE: reason = "unexpected error:";
964 err = file->read_errno;
966 err = file->write_errno;
968 default: reason = "INVALID (internal error):"; break;
972 fprintf(stderr, "%s: %s %s [%s]\n", file->file_name, reason, what,
976 fprintf(stderr, "%s: %s %s\n", file->file_name, reason, what);
979 static void chunk_end(struct chunk **);
980 static void IDAT_end(struct IDAT **);
983 file_end(struct file *file)
987 /* If either of the chunk pointers are set end them here, the IDAT structure
988 * must be deallocated first as it may deallocate the chunk structure.
990 if (file->idat != NULL)
991 IDAT_end(&file->idat);
993 if (file->chunk != NULL)
994 chunk_end(&file->chunk);
996 rc = file->status_code;
998 if (file->file != NULL)
999 (void)fclose(file->file);
1001 if (file->out != NULL)
1003 /* NOTE: this is bitwise |, all the following functions must execute and
1006 if (ferror(file->out) | fflush(file->out) | fclose(file->out))
1008 perror(file->out_name);
1009 emit_error(file, READ_ERROR_CODE, "output write error");
1014 /* Accumulate the result codes */
1015 file->global->status_code |= rc;
1019 return rc; /* status code: non-zero on read or write error */
1023 file_init(struct file *file, struct global *global, const char *file_name,
1024 const char *out_name, void *alloc_ptr, void (*alloc)(struct file*,int))
1025 /* Initialize a file control structure. This will open the given files as
1026 * well. The status code returned is 0 on success, non zero (using the flags
1027 * above) on a file open error.
1031 file->global = global;
1033 file->file_name = file_name;
1034 file->out_name = out_name;
1035 file->status_code = 0;
1036 file->read_errno = 0;
1037 file->write_errno = 0;
1041 /* jmpbuf is garbage: must be set by read_png */
1043 file->read_count = 0;
1044 file->state = STATE_SIGNATURE;
1049 file->alloc_ptr = alloc_ptr;
1050 file->alloc = alloc;
1052 /* Open the files: */
1053 assert(file_name != NULL);
1054 file->file = fopen(file_name, "rb");
1056 if (file->file == NULL)
1058 file->read_errno = errno;
1059 file->status_code |= FILE_ERROR;
1060 /* Always output: please give a readable file! */
1065 if (out_name != NULL)
1067 file->out = fopen(out_name, "wb");
1069 if (file->out == NULL)
1071 file->write_errno = errno;
1072 file->status_code |= WRITE_ERROR;
1082 log_error(struct file *file, int code, const char *what)
1083 /* Like emit_error but checks the global 'errors' flag */
1085 if (file->global->errors)
1086 emit_error(file, code, what);
1090 type_char(png_uint_32 v)
1092 /* In fact because chunk::chunk_type is validated prior to any call to this
1093 * function it will always return a-zA-Z, but the extra codes are just there
1094 * to help in finding internal (programming) errors. Note that the code only
1095 * ever considers the low 7 bits of the value (so it is not necessary for the
1096 * type_name function to mask of the byte.)
1099 return "!abcdefghijklmnopqrstuvwxyz56789"[(v-96)&31];
1102 return "@ABCDEFGHIJKLMNOPQRSTUVWXYZ01234"[(v-64)&31];
1106 type_name(png_uint_32 type, FILE *out)
1108 putc(type_char(type >> 24), out);
1109 putc(type_char(type >> 16), out);
1110 putc(type_char(type >> 8), out);
1111 putc(type_char(type ), out);
1121 static png_uint_32 current_type(struct file *file, int code);
1123 PNG_NORETURN static void
1124 stop(struct file *file, int code, const char *what)
1125 /* Return control when a PNG file cannot be read. This outputs an 'ERR'
1129 log_error(file, code, what);
1131 /* The chunk being read is typically identified by file->chunk or, if this is
1132 * NULL, by file->type. This may be wrong if libpng reads ahead, but this
1133 * only happens with IDAT where libpng reads the header then jumps around
1134 * finding errors in the previous chunks. We know that is happening because
1135 * we are at the start of the IDAT (i.e. no IDAT data has yet been written.)
1137 * SUMMARY FORMAT (stop):
1139 * IDAT ERR status code read-errno write-errno message file
1141 * 'uncompressed' will be 0 if there was a problem in the IHDR. The errno
1142 * values are emit_string(strerror(errno)).
1144 if (file->global->quiet < 2) /* need two quiets to stop this. */
1148 if (file->chunk != NULL)
1149 type = current_type(file, code); /* Gropes in struct chunk and IDAT */
1155 type_name(type, stdout);
1157 else /* magic: an IDAT header, produces bogons for too many IDATs */
1158 fputs("HEAD", stdout); /* not a registered chunk! */
1160 printf(" ERR %.2x %s ", file->status_code, strcode(code));
1161 /* This only works one strerror at a time, because of the way strerror is
1164 emit_string(strerror(file->read_errno), stdout);
1166 emit_string(strerror(file->write_errno), stdout);
1168 emit_string(what, stdout);
1170 fputs(file->file_name, stdout);
1174 file->status_code |= FILE_ERROR;
1175 longjmp(file->jmpbuf, code);
1178 PNG_NORETURN static void
1179 stop_invalid(struct file *file, const char *what)
1181 stop(file, INVALID_ERROR_CODE, what);
1185 type_message(struct file *file, png_uint_32 type, const char *what)
1186 /* Error message for a chunk; the chunk name comes from 'type' */
1188 if (file->global->errors)
1190 fputs(file->file_name, stderr);
1192 type_name(type, stderr);
1194 fputs(what, stderr);
1199 /* Input file positioning - we jump around in the input file while reading
1200 * stuff, these wrappers deal with the error handling.
1203 file_getpos(struct file *file, fpos_t *pos)
1205 if (fgetpos(file->file, pos))
1207 /* This is unexpected, so perror it */
1208 perror(file->file_name);
1209 stop(file, READ_ERROR_CODE, "fgetpos");
1214 file_setpos(struct file *file, const fpos_t *pos)
1216 if (fsetpos(file->file, pos))
1218 perror(file->file_name);
1219 stop(file, READ_ERROR_CODE, "fsetpos");
1224 getpos(struct file *file)
1225 /* Get the current position and store it in 'data_pos'. The corresponding
1226 * setpos() function is chunk specific because it uses the copy of the
1227 * position for the specific chunk.
1230 file_getpos(file, &file->data_pos);
1234 /* Read utility - read a single byte, returns a value in the range 0..255 or EOF
1235 * on a read error. In the latter case status_code and read_errno are updated
1239 read_byte(struct file *file)
1241 int ch = getc(file->file);
1243 if (ch >= 0 && ch <= 255)
1245 ++(file->read_count);
1251 file->status_code |= INTERNAL_ERROR;
1252 file->read_errno = ERANGE; /* out of range character */
1254 /* This is very unexpected; an error message is always output: */
1255 emit_error(file, UNEXPECTED_ERROR_CODE, "file read");
1259 else if (errno == EINTR) /* Interrupted, try again */
1262 return read_byte(file);
1268 /* An error, it doesn't really matter what the error is but it gets
1271 if (ferror(file->file))
1272 file->read_errno = errno;
1274 else if (feof(file->file))
1275 file->read_errno = 0; /* I.e. a regular EOF, no error */
1277 else /* unexpected */
1278 file->read_errno = EDOM;
1281 /* 'TRUNCATED' is used for all cases of failure to read a byte, because of
1282 * the way libpng works a byte read is never attempted unless the byte is
1283 * expected to be there, so EOF should not occur.
1285 file->status_code |= TRUNCATED;
1290 reread_byte(struct file *file)
1291 /* Read a byte when an error is not expected to happen because the byte has
1292 * been read before without error.
1295 int ch = getc(file->file);
1298 file->read_errno = errno;
1300 if (ch < 0 || ch > 255)
1301 stop(file, UNEXPECTED_ERROR_CODE, "reread");
1303 return (png_byte)ch;
1307 reread_4(struct file *file)
1308 /* The same but for a four byte quantity */
1310 png_uint_32 result = 0;
1314 result = (result << 8) + reread_byte(file);
1320 skip_12(struct file *file)
1321 /* Skip exactly 12 bytes in the input stream - used to skip a CRC and chunk
1322 * header that has been read before.
1325 /* Since the chunks were read before this shouldn't fail: */
1326 if (fseek(file->file, 12, SEEK_CUR) != 0)
1329 file->read_errno = errno;
1331 stop(file, UNEXPECTED_ERROR_CODE, "reskip");
1336 write_byte(struct file *file, int b)
1337 /* Write one byte to the output - this causes a fatal error if the write
1338 * fails and the read of this PNG file immediately terminates. Just
1339 * increments the write count if there is no output file.
1342 if (file->out != NULL)
1344 if (putc(b, file->out) != b)
1346 file->write_errno = errno;
1347 file->status_code |= WRITE_ERROR;
1348 stop(file, WRITE_ERROR_CODE, "write byte");
1352 ++(file->write_count);
1355 /* Derivatives of the read/write functions. */
1357 read_4(struct file *file, png_uint_32 *pu)
1358 /* Read four bytes, returns the number of bytes read successfully and, if all
1359 * four bytes are read, assigns the result to *pu.
1363 png_uint_32 val = 0;
1367 int ch = read_byte(file);
1372 val = (val << 8) + ch;
1379 /* CRC handling - read but calculate the CRC while doing so. */
1381 crc_read_many(struct file *file, png_uint_32 length)
1382 /* Reads 'length' bytes and updates the CRC, returns true on success, false
1383 * if the input is truncated.
1388 png_uint_32 crc = file->crc;
1392 int ch = read_byte(file);
1395 return 0; /* Truncated */
1397 crc = crc_one_byte(crc, ch);
1399 while (--length > 0);
1408 calc_image_size(struct file *file)
1409 /* Fill in the image_bytes field given the IHDR information, calls stop on
1413 png_uint_16 pd = file->bit_depth;
1415 switch (file->color_type)
1418 stop_invalid(file, "IHDR: colour type");
1421 stop_invalid(file, "IHDR: bit depth");
1424 if (pd != 1 && pd != 2 && pd != 4 && pd != 8 && pd != 16)
1425 goto invalid_bit_depth;
1429 if (pd != 1 && pd != 2 && pd != 4 && pd != 8)
1430 goto invalid_bit_depth;
1434 if (pd != 8 && pd != 16)
1435 goto invalid_bit_depth;
1437 pd = (png_uint_16)(pd * 3);
1441 if (pd != 8 && pd != 16)
1442 goto invalid_bit_depth;
1444 pd = (png_uint_16)(pd * 2);
1448 if (pd != 8 && pd != 16)
1449 goto invalid_bit_depth;
1451 pd = (png_uint_16)(pd * 4);
1455 if (file->width < 1 || file->width > 0x7fffffff)
1456 stop_invalid(file, "IHDR: width");
1458 else if (file->height < 1 || file->height > 0x7fffffff)
1459 stop_invalid(file, "IHDR: height");
1461 else if (file->compression_method != 0)
1462 stop_invalid(file, "IHDR: compression method");
1464 else if (file->filter_method != 0)
1465 stop_invalid(file, "IHDR: filter method");
1467 else switch (file->interlace_method)
1469 case PNG_INTERLACE_ADAM7:
1470 /* Interlacing makes the image larger because of the replication of
1471 * both the filter byte and the padding to a byte boundary.
1475 int image_digits = 0;
1476 udigit row_width[2], row_bytes[3];
1478 for (pass=0; pass<=6; ++pass)
1480 png_uint_32 pw = PNG_PASS_COLS(file->width, pass);
1486 /* calculate 1+((pw*pd+7)>>3) in row_bytes */
1487 digits = uarb_mult_digit(row_bytes, uarb_set(row_bytes, 7),
1488 row_width, uarb_set(row_width, pw), pd);
1489 digits = uarb_shift(row_bytes, digits, 3);
1490 digits = uarb_inc(row_bytes, digits, 1);
1492 /* Add row_bytes * pass-height to the file image_bytes field
1494 image_digits = uarb_mult32(file->image_bytes, image_digits,
1496 PNG_PASS_ROWS(file->height, pass));
1500 file->image_digits = image_digits;
1504 case PNG_INTERLACE_NONE:
1507 udigit row_width[2], row_bytes[3];
1509 /* As above, but use image_width in place of the pass width: */
1510 digits = uarb_mult_digit(row_bytes, uarb_set(row_bytes, 7),
1511 row_width, uarb_set(row_width, file->width), pd);
1512 digits = uarb_shift(row_bytes, digits, 3);
1513 digits = uarb_inc(row_bytes, digits, 1);
1515 /* Set row_bytes * image-height to the file image_bytes field */
1516 file->image_digits = uarb_mult32(file->image_bytes, 0,
1517 row_bytes, digits, file->height);
1522 stop_invalid(file, "IHDR: interlace method");
1525 assert(file->image_digits >= 1 && file->image_digits <= 5);
1529 /* PER-CHUNK CONTROL STRUCTURE
1530 * This structure is instantiated for each chunk, except for the IDAT chunks
1531 * where one chunk control structure is used for the whole of a single stream of
1532 * IDAT chunks (see the IDAT control structure below).
1538 struct global * global;
1540 /* PUBLIC IDAT INFORMATION: SET BY THE ZLIB CODE */
1541 udigit uncompressed_bytes[5];
1542 int uncompressed_digits;
1543 udigit compressed_bytes[5];
1544 int compressed_digits;
1546 /* PUBLIC PER-CHUNK INFORMATION: USED BY CHUNK READ CODE */
1547 /* This information is filled in by chunk_init from the data in the file
1548 * control structure, but chunk_length may be changed later.
1550 fpos_t chunk_data_pos; /* Position of first byte of chunk data */
1551 png_uint_32 chunk_length; /* From header (or modified below) */
1552 png_uint_32 chunk_type; /* From header */
1554 /* PUBLIC PER-CHUNK INFORMATION: FOR THE CHUNK WRITE CODE */
1555 png_uint_32 write_crc; /* Output CRC (may differ from read_crc) */
1556 png_uint_32 rewrite_offset; /* Count of bytes before rewrite. */
1557 int rewrite_length; /* Number of bytes left to change */
1558 png_byte rewrite_buffer[2]; /* Buffer of new byte values */
1562 chunk_message(struct chunk *chunk, const char *message)
1564 type_message(chunk->file, chunk->chunk_type, message);
1568 chunk_end(struct chunk **chunk_var)
1570 struct chunk *chunk = *chunk_var;
1577 chunk_init(struct chunk * const chunk, struct file * const file)
1578 /* When a chunk is initialized the file length/type/pos are copied into the
1579 * corresponding chunk fields and the new chunk is registered in the file
1580 * structure. There can only be one chunk at a time.
1582 * NOTE: this routine must onely be called from the file alloc routine!
1585 assert(file->chunk == NULL);
1590 chunk->global = file->global;
1592 chunk->chunk_data_pos = file->data_pos;
1593 chunk->chunk_length = file->length;
1594 chunk->chunk_type = file->type;
1596 /* Compresssed/uncompressed size information (from the zlib control structure
1597 * that is used to check the compressed data in a chunk.)
1599 chunk->uncompressed_digits = 0;
1600 chunk->compressed_digits = 0;
1602 file->chunk = chunk;
1606 current_type(struct file *file, int code)
1607 /* Guess the actual chunk type that causes a stop() */
1609 /* This may return png_IDAT for errors detected (late) in the header; that
1610 * includes any inter-chunk consistency check that libpng performs. Assume
1611 * that if the chunk_type is png_IDAT and the file write count is 8 this is
1612 * what is happening.
1614 if (file->chunk != NULL)
1616 png_uint_32 type = file->chunk->chunk_type;
1618 /* This is probably wrong for the excess IDATs case, because then libpng
1619 * whines about too many of them (apparently in some cases erroneously)
1620 * when the header is read.
1622 if (code <= LIBPNG_ERROR_CODE && type == png_IDAT &&
1623 file->write_count == 8)
1624 type = 0; /* magic */
1634 setpos(struct chunk *chunk)
1635 /* Reset the position to 'chunk_data_pos' - the start of the data for this
1636 * chunk. As a side effect the read_count in the file is reset to 8, just
1637 * after the length/type header.
1640 chunk->file->read_count = 8;
1641 file_setpos(chunk->file, &chunk->chunk_data_pos);
1644 /* Specific chunk handling - called for each chunk header, all special chunk
1645 * processing is initiated in these functions.
1647 /* The next functions handle special processing for those chunks with LZ data,
1648 * the data is identified and checked for validity. If there are problems which
1649 * cannot be corrected the routines return false, otherwise true (although
1650 * modification to the zlib header may be required.)
1652 * The compressed data is in zlib format (RFC1950) and consequently has a
1653 * minimum length of 7 bytes.
1655 static int zlib_check(struct file *file, png_uint_32 offset);
1658 process_zTXt_iCCP(struct file *file)
1659 /* zTXt and iCCP have exactly the same form - keyword, null, compression
1660 * method then compressed data.
1663 struct chunk *chunk = file->chunk;
1665 png_uint_32 index = 0;
1667 assert(chunk != NULL && file->idat == NULL);
1668 length = chunk->chunk_length;
1675 if (reread_byte(file) == 0) /* keyword null terminator */
1679 (void)reread_byte(file); /* compression method */
1680 return zlib_check(file, index);
1684 chunk_message(chunk, "too short");
1685 return 0; /* skip */
1689 process_iTXt(struct file *file)
1691 /* Like zTXt but more fields. */
1692 struct chunk *chunk = file->chunk;
1694 png_uint_32 index = 0;
1696 assert(chunk != NULL && file->idat == NULL);
1697 length = chunk->chunk_length;
1704 if (reread_byte(file) == 0) /* keyword null terminator */
1708 if (reread_byte(file) == 0) /* uncompressed text */
1709 return 1; /* nothing to check */
1713 (void)reread_byte(file); /* compression method */
1715 /* Skip the language tag (null terminated). */
1720 if (reread_byte(file) == 0) /* terminator */
1722 /* Skip the translated keyword */
1727 if (reread_byte(file) == 0) /* terminator */
1728 return zlib_check(file, index);
1733 /* Ran out of bytes in the compressed case. */
1738 log_error(file, INVALID_ERROR_CODE, "iTXt chunk length");
1740 return 0; /* skip */
1743 /* IDAT READ/WRITE CONTROL STRUCTURE */
1748 struct global * global;
1750 /* PROTECTED IDAT INFORMATION: SET BY THE IDAT READ CODE */
1751 struct IDAT_list *idat_list_head; /* START of the list of IDAT information */
1752 struct IDAT_list *idat_list_tail; /* *END* of the list of IDAT information */
1754 /* PROTECTED IDAT INFORMATION: USED BY THE IDAT WRITE CODE */
1755 struct IDAT_list *idat_cur; /* Current list entry */
1756 unsigned int idat_count; /* And the *current* index into the list */
1757 png_uint_32 idat_index; /* Index of *next* input byte to write */
1758 png_uint_32 idat_length; /* Cache of current chunk length */
1761 /* NOTE: there is currently no IDAT_reset, so a stream cannot contain more than
1762 * one IDAT sequence (i.e. MNG is not supported).
1766 IDAT_end(struct IDAT **idat_var)
1768 struct IDAT *idat = *idat_var;
1769 struct file *file = idat->file;
1775 assert(file->chunk != NULL);
1776 chunk_end(&file->chunk);
1778 /* Regardless of why the IDAT was killed set the state back to CHUNKS (it may
1779 * already be CHUNKS because the state isn't changed until process_IDAT
1780 * returns; a stop will cause IDAT_end to be entered in state CHUNKS!)
1782 file->state = STATE_CHUNKS;
1786 IDAT_init(struct IDAT * const idat, struct file * const file)
1787 /* When the chunk is png_IDAT instantiate an IDAT control structure in place
1788 * of a chunk control structure. The IDAT will instantiate a chunk control
1789 * structure using the file alloc routine.
1791 * NOTE: this routine must only be called from the file alloc routine!
1794 assert(file->chunk == NULL);
1795 assert(file->idat == NULL);
1800 idat->global = file->global;
1802 /* Initialize the tail to the pre-allocated buffer and set the count to 0
1805 idat->global->idat_cache.count = 0;
1806 idat->idat_list_head = idat->idat_list_tail = &idat->global->idat_cache;
1808 /* Now the chunk. The allocator calls the initializer of the new chunk and
1809 * stores the result in file->chunk:
1811 file->alloc(file, 0/*chunk*/);
1812 assert(file->chunk != NULL);
1814 /* And store this for cleanup (and to check for double alloc or failure to
1821 rechunk_length(struct IDAT *idat)
1822 /* Return the length for the next IDAT chunk, taking into account
1826 png_uint_32 len = idat->global->idat_max;
1828 if (len == 0) /* use original chunk lengths */
1830 const struct IDAT_list *cur;
1833 if (idat->idat_index == 0) /* at the new chunk (first time) */
1834 return idat->idat_length; /* use the cache */
1836 /* Otherwise rechunk_length is called at the end of a chunk for the length
1839 cur = idat->idat_cur;
1840 count = idat->idat_count;
1842 assert(idat->idat_index == idat->idat_length &&
1843 idat->idat_length == cur->lengths[count]);
1845 /* Return length of the *next* chunk */
1846 if (++count < cur->count)
1847 return cur->lengths[count];
1849 /* End of this list */
1850 assert(cur != idat->idat_list_tail);
1852 assert(cur != NULL && cur->count > 0);
1853 return cur->lengths[0];
1856 else /* rechunking */
1858 /* The chunk size is the lesser of file->idat_max and the number
1859 * of remaining bytes.
1861 png_uint_32 have = idat->idat_length - idat->idat_index;
1865 struct IDAT_list *cur = idat->idat_cur;
1866 unsigned int j = idat->idat_count+1; /* the next IDAT in the list */
1870 /* Add up the remaining bytes. This can't overflow because the
1871 * individual lengths are always <= 0x7fffffff, so when we add two
1872 * of them overflow is not possible.
1874 assert(cur != NULL);
1878 /* NOTE: IDAT_list::count here, not IDAT_list::length */
1879 for (; j < cur->count; ++j)
1881 have += cur->lengths[j];
1886 /* If this was the end return the count of the available bytes */
1887 if (cur == idat->idat_list_tail)
1902 process_IDAT(struct file *file)
1903 /* Process the IDAT stream, this is the more complex than the preceding
1904 * cases because the compressed data is spread across multiple IDAT chunks
1905 * (typically). Rechunking of the data is not handled here; all this
1906 * function does is establish whether the zlib header needs to be modified.
1908 * Initially the function returns false, indicating that the chunk should not
1909 * be written. It does this until the last IDAT chunk is passed in, then it
1910 * checks the zlib data and returns true.
1912 * It does not return false on a fatal error; it calls stop instead.
1914 * The caller must have an instantiated (IDAT) control structure and it must
1915 * have extent over the whole read of the IDAT stream. For a PNG this means
1916 * the whole PNG read, for MNG it could have lesser extent.
1919 struct IDAT_list *list;
1921 assert(file->idat != NULL && file->chunk != NULL);
1923 /* We need to first check the entire sequence of IDAT chunks to ensure the
1924 * stream is in sync. Do this by building a list of all the chunks and
1925 * recording the length of each because the length may have been fixed up by
1926 * sync_stream below.
1928 * At the end of the list of chunks, where the type of the next chunk is not
1929 * png_IDAT, process the whole stream using the list data to check validity
1930 * then return control to the start and rewrite everything.
1932 list = file->idat->idat_list_tail;
1934 if (list->count == list->length)
1936 list = IDAT_list_extend(list);
1939 stop(file, READ_ERROR_CODE, "out of memory");
1941 /* Move to the next block */
1943 file->idat->idat_list_tail = list;
1946 /* And fill in the next IDAT information buffer. */
1947 list->lengths[(list->count)++] = file->chunk->chunk_length;
1949 /* The type of the next chunk was recorded in the file control structure by
1950 * the caller, if this is png_IDAT return 'skip' to the caller.
1952 if (file->type == png_IDAT)
1953 return 0; /* skip this for the moment */
1955 /* This is the final IDAT chunk, so run the tests to check for the too far
1956 * back error and possibly optimize the window bits. This means going back
1957 * to the start of the first chunk data, which is stored in the original
1960 setpos(file->chunk);
1962 if (zlib_check(file, 0))
1967 /* The IDAT stream was successfully uncompressed; see whether it
1968 * contained the correct number of bytes of image data.
1970 cmp = uarb_cmp(file->image_bytes, file->image_digits,
1971 file->chunk->uncompressed_bytes, file->chunk->uncompressed_digits);
1974 type_message(file, png_IDAT, "extra uncompressed data");
1977 stop(file, LIBPNG_ERROR_CODE, "IDAT: uncompressed data too small");
1979 /* Return the stream to the start of the first IDAT chunk; the length
1980 * is set in the write case below but the input chunk variables must be
1983 setpos(file->chunk);
1986 idat->idat_cur = idat->idat_list_head;
1987 idat->idat_length = idat->idat_cur->lengths[0];
1988 idat->idat_count = 0; /* Count of chunks read in current list */
1989 idat->idat_index = 0; /* Index into chunk data */
1991 /* Update the chunk length to the correct value for the IDAT chunk: */
1992 file->chunk->chunk_length = rechunk_length(idat);
1994 /* Change the state to writing IDAT chunks */
1995 file->state = STATE_IDAT;
2000 else /* Failure to decompress the IDAT stream; give up. */
2001 stop(file, ZLIB_ERROR_CODE, "could not uncompress IDAT");
2004 /* ZLIB CONTROL STRUCTURE */
2008 struct IDAT * idat; /* NOTE: May be NULL */
2009 struct chunk * chunk;
2011 struct global *global;
2013 /* GLOBAL ZLIB INFORMATION: SET BY THE CALLER */
2014 png_uint_32 rewrite_offset;
2016 /* GLOBAL ZLIB INFORMATION: SET BY THE ZLIB READ CODE */
2017 udigit compressed_bytes[5];
2018 int compressed_digits;
2019 udigit uncompressed_bytes[5];
2020 int uncompressed_digits;
2021 int file_bits; /* window bits from the file */
2022 int ok_bits; /* Set <16 on a successful read */
2023 int cksum; /* Set on a checksum error */
2025 /* PROTECTED ZLIB INFORMATION: USED BY THE ZLIB ROUTINES */
2027 png_uint_32 extra_bytes; /* Count of extra compressed bytes */
2029 int rc; /* Last return code */
2030 int window_bits; /* 0 if no change */
2035 zlib_flevel(struct zlib *zlib)
2037 switch (zlib->header[1] >> 6)
2039 case 0: return "supfast";
2040 case 1: return "stdfast";
2041 case 2: return "default";
2042 case 3: return "maximum";
2043 default: assert(UNREACHED);
2046 return "COMPILER BUG";
2050 zlib_rc(struct zlib *zlib)
2051 /* Return a string for the zlib return code */
2055 case Z_OK: return "Z_OK";
2056 case Z_STREAM_END: return "Z_STREAM_END";
2057 case Z_NEED_DICT: return "Z_NEED_DICT";
2058 case Z_ERRNO: return "Z_ERRNO";
2059 case Z_STREAM_ERROR: return "Z_STREAM_ERROR";
2060 case Z_DATA_ERROR: return "Z_DATA_ERROR";
2061 case Z_MEM_ERROR: return "Z_MEM_ERROR";
2062 case Z_BUF_ERROR: return "Z_BUF_ERROR";
2063 case Z_VERSION_ERROR: return "Z_VERSION_ERROR";
2064 default: return "Z_*INVALID_RC*";
2069 zlib_message(struct zlib *zlib, int unexpected)
2070 /* Output a message given a zlib rc */
2072 if (zlib->global->errors)
2074 const char *reason = zlib->z.msg;
2077 reason = "[no message]";
2079 fputs(zlib->file->file_name, stderr);
2081 type_name(zlib->chunk->chunk_type, stderr);
2082 fprintf(stderr, ": %szlib error: %d (%s) (%s)\n",
2083 unexpected ? "unexpected " : "", zlib->rc, zlib_rc(zlib), reason);
2088 zlib_end(struct zlib *zlib)
2090 /* Output the summary line now; this ensures a summary line always gets
2091 * output regardless of the manner of exit.
2093 if (!zlib->global->quiet)
2095 if (zlib->ok_bits < 16) /* stream was read ok */
2100 reason = "CHK"; /* checksum error */
2102 else if (zlib->ok_bits > zlib->file_bits)
2103 reason = "TFB"; /* fixing a too-far-back error */
2105 else if (zlib->ok_bits == zlib->file_bits)
2109 reason = "OPT"; /* optimizing window bits */
2111 /* SUMMARY FORMAT (for a successful zlib inflate):
2113 * IDAT reason flevel file-bits ok-bits compressed uncompressed file
2115 type_name(zlib->chunk->chunk_type, stdout);
2116 printf(" %s %s %d %d ", reason, zlib_flevel(zlib), zlib->file_bits,
2118 uarb_print(zlib->compressed_bytes, zlib->compressed_digits, stdout);
2120 uarb_print(zlib->uncompressed_bytes, zlib->uncompressed_digits,
2123 fputs(zlib->file->file_name, stdout);
2129 /* This is a zlib read error; the chunk will be skipped. For an IDAT
2130 * stream this will also cause a fatal read error (via stop()).
2134 * IDAT SKP flevel file-bits z-rc compressed message file
2136 * z-rc is the zlib failure code; message is the error message with
2137 * spaces replaced by '-'. The compressed byte count indicates where
2138 * in the zlib stream the error occured.
2140 type_name(zlib->chunk->chunk_type, stdout);
2141 printf(" SKP %s %d %s ", zlib_flevel(zlib), zlib->file_bits,
2143 uarb_print(zlib->compressed_bytes, zlib->compressed_digits, stdout);
2145 emit_string(zlib->z.msg ? zlib->z.msg : "[no_message]", stdout);
2147 fputs(zlib->file->file_name, stdout);
2152 if (zlib->state >= 0)
2154 zlib->rc = inflateEnd(&zlib->z);
2156 if (zlib->rc != Z_OK)
2157 zlib_message(zlib, 1/*unexpected*/);
2164 zlib_reset(struct zlib *zlib, int window_bits)
2165 /* Reinitializes a zlib with a different window_bits */
2167 assert(zlib->state >= 0); /* initialized by zlib_init */
2169 zlib->z.next_in = Z_NULL;
2170 zlib->z.avail_in = 0;
2171 zlib->z.next_out = Z_NULL;
2172 zlib->z.avail_out = 0;
2174 zlib->window_bits = window_bits;
2175 zlib->compressed_digits = 0;
2176 zlib->uncompressed_digits = 0;
2178 zlib->state = 0; /* initialized, once */
2179 zlib->rc = inflateReset2(&zlib->z, 0);
2180 if (zlib->rc != Z_OK)
2182 zlib_message(zlib, 1/*unexpected*/);
2190 zlib_init(struct zlib *zlib, struct IDAT *idat, struct chunk *chunk,
2191 int window_bits, png_uint_32 offset)
2192 /* Initialize a zlib_control; the result is true/false */
2197 zlib->chunk = chunk;
2198 zlib->file = chunk->file;
2199 zlib->global = chunk->global;
2200 zlib->rewrite_offset = offset; /* never changed for this zlib */
2202 /* *_out does not need to be set: */
2203 zlib->z.next_in = Z_NULL;
2204 zlib->z.avail_in = 0;
2205 zlib->z.zalloc = Z_NULL;
2206 zlib->z.zfree = Z_NULL;
2207 zlib->z.opaque = Z_NULL;
2210 zlib->window_bits = window_bits;
2212 zlib->compressed_digits = 0;
2213 zlib->uncompressed_digits = 0;
2215 /* These values are sticky across reset (in addition to the stuff in the
2216 * first block, which is actually constant.)
2218 zlib->file_bits = 16;
2219 zlib->ok_bits = 16; /* unset */
2220 zlib->cksum = 0; /* set when a checksum error is detected */
2222 /* '0' means use the header; inflateInit2 should always succeed because it
2223 * does nothing apart from allocating the internal zstate.
2225 zlib->rc = inflateInit2(&zlib->z, 0);
2226 if (zlib->rc != Z_OK)
2228 zlib_message(zlib, 1/*unexpected*/);
2234 zlib->state = 0; /* initialized */
2240 max_window_bits(uarbc size, int ndigits)
2241 /* Return the zlib stream window bits required for data of the given size. */
2250 if (cb > 16384) return 15;
2251 if (cb > 8192) return 14;
2252 if (cb > 4096) return 13;
2253 if (cb > 2048) return 12;
2254 if (cb > 1024) return 11;
2255 if (cb > 512) return 10;
2256 if (cb > 256) return 9;
2261 zlib_advance(struct zlib *zlib, png_uint_32 nbytes)
2262 /* Read nbytes compressed bytes; the stream will be initialized if required.
2263 * Bytes are always being reread and errors are fatal. The return code is as
2266 * -1: saw the "too far back" error
2268 * 1: saw Z_STREAM_END (zlib->extra_bytes indicates too much data)
2269 * 2: a zlib error that cannot be corrected (error message already
2270 * output if required.)
2272 # define ZLIB_TOO_FAR_BACK (-1)
2274 # define ZLIB_STREAM_END 1
2275 # define ZLIB_FATAL 2
2277 int state = zlib->state;
2278 int endrc = ZLIB_OK;
2279 png_uint_32 in_bytes = 0;
2280 struct file *file = zlib->file;
2284 while (in_bytes < nbytes && endrc == ZLIB_OK)
2286 png_uint_32 out_bytes;
2288 png_byte bIn = reread_byte(file);
2293 case 0: /* first header byte */
2295 int file_bits = 8+(bIn >> 4);
2296 int new_bits = zlib->window_bits;
2298 zlib->file_bits = file_bits;
2300 /* Check against the existing value - it may not need to be
2303 if (new_bits == 0) /* no change */
2304 zlib->window_bits = file_bits;
2306 else if (new_bits != file_bits) /* rewrite required */
2307 bIn = (png_byte)((bIn & 0xf) + ((new_bits-8) << 4));
2310 zlib->header[0] = bIn;
2311 zlib->state = state = 1;
2314 case 1: /* second header byte */
2316 int b2 = bIn & 0xe0; /* top 3 bits */
2318 /* The checksum calculation, on the first 11 bits: */
2319 b2 += 0x1f - ((zlib->header[0] << 8) + b2) % 0x1f;
2321 /* Update the checksum byte if required: */
2324 /* If the first byte wasn't changed this indicates an error in
2325 * the checksum calculation; signal this by setting file_bits
2326 * (not window_bits) to 0.
2328 if (zlib->file_bits == zlib->window_bits)
2335 zlib->header[1] = bIn;
2336 zlib->state = state = 2;
2339 default: /* After the header bytes */
2343 /* For some streams, perhaps only those compressed with 'superfast
2344 * compression' (which results in a lot of copying) Z_BUF_ERROR can happen
2345 * immediately after all output has been flushed on the next input byte.
2346 * This is handled below when Z_BUF_ERROR is detected by adding an output
2349 zlib->z.next_in = &bIn;
2350 zlib->z.avail_in = 1;
2351 zlib->z.next_out = &bOut;
2352 zlib->z.avail_out = 0; /* Initially */
2354 /* Initially use Z_NO_FLUSH in an attempt to persuade zlib to look at this
2355 * byte without confusing what is going on with output.
2360 /* NOTE: expression 3 is only evaluted on 'continue', because of the
2361 * 'break' at the end of this loop below.
2363 for (;endrc == ZLIB_OK;
2364 flush = Z_SYNC_FLUSH,
2365 zlib->z.next_out = &bOut,
2366 zlib->z.avail_out = 1,
2369 zlib->rc = inflate(&zlib->z, flush);
2370 out_bytes -= zlib->z.avail_out;
2375 if (zlib->z.avail_out == 0)
2376 continue; /* Try another output byte. */
2378 if (zlib->z.avail_in == 0)
2379 break; /* Try another input byte */
2381 /* Both avail_out and avail_in are 1 yet zlib returned a code
2382 * indicating no progress was possible. This is unexpected.
2384 zlib_message(zlib, 1/*unexpected*/);
2385 endrc = ZLIB_FATAL; /* stop processing */
2389 /* Zlib is supposed to have made progress: */
2390 assert(zlib->z.avail_out == 0 || zlib->z.avail_in == 0);
2394 /* This is the successful end. */
2395 zlib->state = 3; /* end of stream */
2396 endrc = ZLIB_STREAM_END;
2400 zlib_message(zlib, 0/*stream error*/);
2405 /* The too far back error can be corrected, others cannot: */
2406 if (zlib->z.msg != NULL &&
2407 strcmp(zlib->z.msg, "invalid distance too far back") == 0)
2409 endrc = ZLIB_TOO_FAR_BACK;
2415 zlib_message(zlib, 0/*stream error*/);
2418 } /* switch (inflate rc) */
2420 /* Control gets here when further output is not possible; endrc may
2421 * still be ZLIB_OK if more input is required.
2424 } /* for (output bytes) */
2426 /* Keep a running count of output byte produced: */
2427 zlib->uncompressed_digits = uarb_add32(zlib->uncompressed_bytes,
2428 zlib->uncompressed_digits, out_bytes);
2430 /* Keep going, the loop will terminate when endrc is no longer set to
2431 * ZLIB_OK or all the input bytes have been consumed; meanwhile keep
2432 * adding input bytes.
2434 assert(zlib->z.avail_in == 0 || endrc != ZLIB_OK);
2436 in_bytes += 1 - zlib->z.avail_in;
2437 } /* while (input bytes) */
2439 assert(in_bytes == nbytes || endrc != ZLIB_OK);
2441 /* Update the running total of input bytes consumed */
2442 zlib->compressed_digits = uarb_add32(zlib->compressed_bytes,
2443 zlib->compressed_digits, in_bytes - zlib->z.avail_in);
2445 /* At the end of the stream update the chunk with the accumulated
2446 * information if it is an improvement:
2448 if (endrc == ZLIB_STREAM_END && zlib->window_bits < zlib->ok_bits)
2450 struct chunk *chunk = zlib->chunk;
2452 chunk->uncompressed_digits = uarb_copy(chunk->uncompressed_bytes,
2453 zlib->uncompressed_bytes, zlib->uncompressed_digits);
2454 chunk->compressed_digits = uarb_copy(chunk->compressed_bytes,
2455 zlib->compressed_bytes, zlib->compressed_digits);
2456 chunk->rewrite_buffer[0] = zlib->header[0];
2457 chunk->rewrite_buffer[1] = zlib->header[1];
2459 if (zlib->window_bits != zlib->file_bits || zlib->cksum)
2461 /* A rewrite is required */
2462 chunk->rewrite_offset = zlib->rewrite_offset;
2463 chunk->rewrite_length = 2;
2468 chunk->rewrite_offset = 0;
2469 chunk->rewrite_length = 0;
2472 if (in_bytes < nbytes)
2473 chunk_message(chunk, "extra compressed data");
2475 zlib->extra_bytes = nbytes - in_bytes;
2476 zlib->ok_bits = zlib->window_bits;
2483 zlib_run(struct zlib *zlib)
2484 /* Like zlib_advance but also handles a stream of IDAT chunks. */
2486 /* The 'extra_bytes' field is set by zlib_advance if there is extra
2487 * compressed data in the chunk it handles (if it sees Z_STREAM_END before
2488 * all the input data has been used.) This function uses the value to update
2489 * the correct chunk length, so the problem should only ever be detected once
2490 * for each chunk. zlib_advance outputs the error message, though see the
2491 * IDAT specific check below.
2493 zlib->extra_bytes = 0;
2495 if (zlib->idat != NULL)
2497 struct IDAT_list *list = zlib->idat->idat_list_head;
2498 struct IDAT_list *last = zlib->idat->idat_list_tail;
2501 /* 'rewrite_offset' is the offset of the LZ data within the chunk, for
2502 * IDAT it should be 0:
2504 assert(zlib->rewrite_offset == 0);
2506 /* Process each IDAT_list in turn; the caller has left the stream
2507 * positioned at the start of the first IDAT chunk data.
2511 const unsigned int count = list->count;
2514 for (i = 0; i<count; ++i)
2518 if (skip > 0) /* Skip CRC and next IDAT header */
2519 skip_12(zlib->file);
2521 skip = 12; /* for the next time */
2523 rc = zlib_advance(zlib, list->lengths[i]);
2527 case ZLIB_OK: /* keep going */
2530 case ZLIB_STREAM_END: /* stop */
2531 /* There may be extra chunks; if there are and one of them is
2532 * not zero length output the 'extra data' message. Only do
2533 * this check if errors are being output.
2535 if (zlib->global->errors && zlib->extra_bytes == 0)
2537 struct IDAT_list *check = list;
2538 int j = i+1, jcount = count;
2542 for (; j<jcount; ++j)
2543 if (check->lengths[j] > 0)
2545 chunk_message(zlib->chunk,
2546 "extra compressed data");
2553 check = check->next;
2554 jcount = check->count;
2560 /* Terminate the list at the current position, reducing the
2561 * length of the last IDAT too if required.
2563 list->lengths[i] -= zlib->extra_bytes;
2565 zlib->idat->idat_list_tail = list;
2573 /* At the end of the compressed data and Z_STREAM_END was not seen. */
2583 struct chunk *chunk = zlib->chunk;
2586 assert(zlib->rewrite_offset < chunk->chunk_length);
2588 rc = zlib_advance(zlib, chunk->chunk_length - zlib->rewrite_offset);
2590 /* The extra bytes in the chunk are handled now by adjusting the chunk
2591 * length to exclude them; the zlib data is always stored at the end of
2592 * the PNG chunk (although clearly this is not necessary.) zlib_advance
2593 * has already output a warning message.
2595 chunk->chunk_length -= zlib->extra_bytes;
2600 static int /* global function; not a member function */
2601 zlib_check(struct file *file, png_uint_32 offset)
2602 /* Check the stream of zlib compressed data in either idat (if given) or (if
2603 * not) chunk. In fact it is zlib_run that handles the difference in reading
2604 * a single chunk and a list of IDAT chunks.
2606 * In either case the input file must be positioned at the first byte of zlib
2607 * compressed data (the first header byte).
2609 * The return value is true on success, including the case where the zlib
2610 * header may need to be rewritten, and false on an unrecoverable error.
2612 * In the case of IDAT chunks 'offset' should be 0.
2618 /* Record the start of the LZ data to allow a re-read. */
2619 file_getpos(file, &start_pos);
2621 /* First test the existing (file) window bits: */
2622 if (zlib_init(&zlib, file->idat, file->chunk, 0/*window bits*/, offset))
2624 int min_bits, max_bits, rc;
2626 /* The first run using the existing window bits. */
2627 rc = zlib_run(&zlib);
2631 case ZLIB_TOO_FAR_BACK:
2632 /* too far back error */
2633 file->status_code |= TOO_FAR_BACK;
2634 min_bits = zlib.window_bits + 1;
2638 case ZLIB_STREAM_END:
2639 if (!zlib.global->optimize_zlib &&
2640 zlib.window_bits == zlib.file_bits && !zlib.cksum)
2642 /* The trivial case where the stream is ok and optimization was
2649 max_bits = max_window_bits(zlib.uncompressed_bytes,
2650 zlib.uncompressed_digits);
2651 if (zlib.ok_bits < max_bits)
2652 max_bits = zlib.ok_bits;
2655 /* cksum is set if there is an error in the zlib header checksum
2656 * calculation in the original file (and this may be the only reason
2657 * a rewrite is required). We can't rely on the file window bits in
2658 * this case, so do the optimization anyway.
2661 chunk_message(zlib.chunk, "zlib checkum");
2666 /* Truncated stream; unrecoverable, gets converted to ZLIB_FATAL */
2667 zlib.z.msg = PNGZ_MSG_CAST("[truncated]");
2668 zlib_message(&zlib, 0/*expected*/);
2672 /* Unrecoverable error; skip the chunk; a zlib_message has already
2679 /* Optimize window bits or fix a too-far-back error. min_bits and
2680 * max_bits have been set appropriately, ok_bits records the bit value
2683 while (min_bits < max_bits || max_bits < zlib.ok_bits/*if 16*/)
2685 int test_bits = (min_bits + max_bits) >> 1;
2687 if (zlib_reset(&zlib, test_bits))
2689 file_setpos(file, &start_pos);
2690 rc = zlib_run(&zlib);
2694 case ZLIB_TOO_FAR_BACK:
2695 min_bits = test_bits+1;
2696 if (min_bits > max_bits)
2698 /* This happens when the stream really is damaged and it
2699 * contains a distance code that addresses bytes before
2700 * the start of the uncompressed data.
2702 assert(test_bits == 15);
2704 /* Output the error that wasn't output before: */
2705 if (zlib.z.msg == NULL)
2706 zlib.z.msg = PNGZ_MSG_CAST(
2707 "invalid distance too far back");
2708 zlib_message(&zlib, 0/*stream error*/);
2714 case ZLIB_STREAM_END: /* success */
2715 max_bits = test_bits;
2719 /* A fatal error; this happens if a too-far-back error was
2720 * hiding a more serious error, zlib_advance has already
2721 * output a zlib_message.
2728 else /* inflateReset2 failed */
2735 /* The loop guarantees this */
2736 assert(zlib.ok_bits == max_bits);
2741 else /* zlib initialization failed - skip the chunk */
2748 /***************************** LIBPNG CALLBACKS *******************************/
2749 /* The strategy here is to run a regular libpng PNG file read but examine the
2750 * input data (from the file) before passing it to libpng so as to be aware of
2751 * the state we expect libpng to be in. Warning and error callbacks are also
2752 * intercepted so that they can be quieted and interpreted. Interpretation
2753 * depends on a somewhat risky string match for known error messages; let us
2754 * hope that this can be fixed in the next version of libpng.
2756 * The control structure is pointed to by the libpng error pointer. It contains
2757 * that set of structures which must persist across multiple read callbacks,
2758 * which is pretty much everything except the 'zlib' control structure.
2760 * The file structure is instantiated in the caller of the per-file routine, but
2761 * the per-file routine contains the chunk and IDAT control structures.
2763 /* The three routines read_chunk, process_chunk and sync_stream can only be
2764 * called via a call to read_chunk and only exit at a return from process_chunk.
2765 * These routines could have been written as one confusing large routine,
2766 * instead this code relies on the compiler to do tail call elimination. The
2767 * possible calls are as follows:
2776 static void read_chunk(struct file *file);
2778 process_chunk(struct file *file, png_uint_32 file_crc, png_uint_32 next_length,
2779 png_uint_32 next_type)
2780 /* Called when the chunk data has been read, next_length and next_type
2781 * will be set for the next chunk (or 0 if this is IEND).
2783 * When this routine returns, chunk_length and chunk_type will be set for the
2784 * next chunk to write because if a chunk is skipped this return calls back
2788 const png_uint_32 type = file->type;
2790 if (file->global->verbose > 1)
2793 type_name(file->type, stderr);
2794 fprintf(stderr, " %lu 0x%.8x 0x%.8x\n", (unsigned long)file->length,
2795 file->crc ^ 0xffffffff, file_crc);
2798 /* The basic structure seems correct but the CRC may not match, in this
2799 * case assume that it is simply a bad CRC, either wrongly calculated or
2800 * because of damaged stream data.
2802 if ((file->crc ^ 0xffffffff) != file_crc)
2804 /* The behavior is set by the 'skip' setting; if it is anything other
2805 * than SKIP_BAD_CRC ignore the bad CRC and return the chunk, with a
2806 * corrected CRC and possibly processed, to libpng. Otherwise skip the
2807 * chunk, which will result in a fatal error if the chunk is critical.
2809 file->status_code |= CRC_ERROR;
2811 /* Ignore the bad CRC */
2812 if (file->global->skip != SKIP_BAD_CRC)
2813 type_message(file, type, "bad CRC");
2815 /* This will cause an IEND with a bad CRC to stop */
2816 else if (CRITICAL(type))
2817 stop(file, READ_ERROR_CODE, "bad CRC in critical chunk");
2821 type_message(file, type, "skipped: bad CRC");
2823 /* NOTE: this cannot be reached for IEND because it is critical. */
2828 /* Check for other 'skip' cases and handle these; these only apply to
2829 * ancillary chunks (and not tRNS, which should probably have been a critical
2832 if (skip_chunk_type(file->global, type))
2835 /* The chunk may still be skipped if problems are detected in the LZ data,
2836 * however the LZ data check requires a chunk. Handle this by instantiating
2837 * a chunk unless an IDAT is already instantiated (IDAT control structures
2838 * instantiate their own chunk.)
2840 if (type != png_IDAT)
2841 file->alloc(file, 0/*chunk*/);
2843 else if (file->idat == NULL)
2844 file->alloc(file, 1/*IDAT*/);
2848 /* The chunk length must be updated for process_IDAT */
2849 assert(file->chunk != NULL);
2850 assert(file->chunk->chunk_type == png_IDAT);
2851 file->chunk->chunk_length = file->length;
2854 /* Record the 'next' information too, now that the original values for
2855 * this chunk have been copied. Notice that the IDAT chunks only make a
2856 * copy of the position of the first chunk, this is fine - process_IDAT does
2857 * not need the position of this chunk.
2859 file->length = next_length;
2860 file->type = next_type;
2863 /* Do per-type processing, note that if this code does not return from the
2864 * function the chunk will be skipped. The rewrite is cancelled here so that
2865 * it can be set in the per-chunk processing.
2867 file->chunk->rewrite_length = 0;
2868 file->chunk->rewrite_offset = 0;
2875 /* Read this now and update the control structure with the information
2876 * it contains. The header is validated completely to ensure this is a
2880 struct chunk *chunk = file->chunk;
2882 if (chunk->chunk_length != 13)
2883 stop_invalid(file, "IHDR length");
2885 /* Read all the IHDR information and validate it. */
2887 file->width = reread_4(file);
2888 file->height = reread_4(file);
2889 file->bit_depth = reread_byte(file);
2890 file->color_type = reread_byte(file);
2891 file->compression_method = reread_byte(file);
2892 file->filter_method = reread_byte(file);
2893 file->interlace_method = reread_byte(file);
2895 /* This validates all the fields, and calls stop_invalid if
2896 * there is a problem.
2898 calc_image_size(file);
2902 /* Ancillary chunks that require further processing: */
2903 case png_zTXt: case png_iCCP:
2904 if (process_zTXt_iCCP(file))
2906 chunk_end(&file->chunk);
2907 file_setpos(file, &file->data_pos);
2911 if (process_iTXt(file))
2913 chunk_end(&file->chunk);
2914 file_setpos(file, &file->data_pos);
2918 if (process_IDAT(file))
2921 assert(next_type == png_IDAT);
2925 /* Control reaches this point if the chunk must be skipped. For chunks other
2926 * than IDAT this means that the zlib compressed data is fatally damanged and
2927 * the chunk will not be passed to libpng. For IDAT it means that the end of
2928 * the IDAT stream has not yet been reached and we must handle the next
2929 * (IDAT) chunk. If the LZ data in an IDAT stream cannot be read 'stop' must
2930 * be used to halt parsing of the PNG.
2935 /* This is the generic code to skip the current chunk; simply jump to the
2939 file->length = next_length;
2940 file->type = next_type;
2946 get32(png_bytep buffer, int offset)
2947 /* Read a 32-bit value from an 8-byte circular buffer (used only below).
2951 (buffer[ offset & 7] << 24) +
2952 (buffer[(offset+1) & 7] << 16) +
2953 (buffer[(offset+2) & 7] << 8) +
2954 (buffer[(offset+3) & 7] );
2958 sync_stream(struct file *file)
2959 /* The stream seems to be messed up, attempt to resync from the current chunk
2960 * header. Executes stop on a fatal error, otherwise calls process_chunk.
2963 png_uint_32 file_crc;
2965 file->status_code |= STREAM_ERROR;
2967 if (file->global->verbose)
2969 fputs(" SYNC ", stderr);
2970 type_name(file->type, stderr);
2974 /* Return to the start of the chunk data */
2975 file_setpos(file, &file->data_pos);
2976 file->read_count = 8;
2978 if (read_4(file, &file_crc) == 4) /* else completely truncated */
2980 /* Ignore the recorded chunk length, proceed through the data looking for
2981 * a leading sequence of bytes that match the CRC in the following four
2982 * bytes. Each time a match is found check the next 8 bytes for a valid
2983 * length, chunk-type pair.
2986 png_uint_32 type = file->type;
2987 png_uint_32 crc = crc_init_4(type);
2989 unsigned int nread = 0, nused = 0;
2991 for (length=0; length <= 0x7fffffff; ++length)
2995 if ((crc ^ 0xffffffff) == file_crc)
2997 /* A match on the CRC; for IEND this is sufficient, but for anything
2998 * else expect a following chunk header.
3000 if (type == png_IEND)
3002 file->length = length;
3003 process_chunk(file, file_crc, 0, 0);
3010 while (nread < 8+nused)
3012 ch = read_byte(file);
3015 buffer[(nread++) & 7] = (png_byte)ch;
3018 /* Prevent overflow */
3019 nread -= nused & ~7;
3020 nused -= nused & ~7; /* or, nused &= 7 ;-) */
3022 /* Examine the 8 bytes for a valid chunk header. */
3024 png_uint_32 next_length = get32(buffer, nused);
3026 if (next_length < 0x7fffffff)
3028 png_uint_32 next_type = get32(buffer, nused+4);
3030 if (chunk_type_valid(next_type))
3032 file->read_count -= 8;
3033 process_chunk(file, file_crc, next_length, next_type);
3038 /* Not valid, keep going. */
3043 /* This catches up with the circular buffer which gets filled above
3044 * while checking a chunk header. This code is slightly tricky - if
3045 * the chunk_type is IEND the buffer will never be used, if it is not
3046 * the code will always read ahead exactly 8 bytes and pass this on to
3047 * process_chunk. So the invariant that IEND leaves the file position
3048 * after the IEND CRC and other chunk leave it after the *next* chunk
3049 * header is not broken.
3053 ch = read_byte(file);
3060 ch = buffer[(++nused) & 7];
3062 crc = crc_one_byte(crc, file_crc >> 24);
3063 file_crc = (file_crc << 8) + ch;
3066 /* Control gets to here if when 0x7fffffff bytes (plus 8) have been read,
3067 * ok, treat this as a damaged stream too:
3072 stop(file, READ_ERROR_CODE, "damaged PNG stream");
3076 read_chunk(struct file *file)
3077 /* On entry file::data_pos must be set to the position of the first byte
3078 * of the chunk data *and* the input file must be at this position. This
3079 * routine (via process_chunk) instantiates a chunk or IDAT control structure
3080 * based on file::length and file::type and also resets these fields and
3081 * file::data_pos for the chunk after this one. For an IDAT chunk the whole
3082 * stream of IDATs will be read, until something other than an IDAT is
3083 * encountered, and the file fields will be set for the chunk after the end
3084 * of the stream of IDATs.
3086 * For IEND the file::type field will be set to 0, and nothing beyond the end
3087 * of the IEND chunk will have been read.
3090 png_uint_32 length = file->length;
3091 png_uint_32 type = file->type;
3093 /* After IEND file::type is set to 0, if libpng attempts to read
3094 * more data at this point this is a bug in libpng.
3097 stop(file, UNEXPECTED_ERROR_CODE, "read beyond IEND");
3099 if (file->global->verbose > 2)
3102 type_name(type, stderr);
3103 fprintf(stderr, " %lu\n", (unsigned long)length);
3106 /* Start the read_crc calculation with the chunk type, then read to the end
3107 * of the chunk data (without processing it in any way) to check that it is
3108 * all there and calculate the CRC.
3110 file->crc = crc_init_4(type);
3111 if (crc_read_many(file, length)) /* else it was truncated */
3113 png_uint_32 file_crc; /* CRC read from file */
3114 unsigned int nread = read_4(file, &file_crc);
3118 if (type != png_IEND) /* do not read beyond IEND */
3120 png_uint_32 next_length;
3122 nread += read_4(file, &next_length);
3123 if (nread == 8 && next_length <= 0x7fffffff)
3125 png_uint_32 next_type;
3127 nread += read_4(file, &next_type);
3129 if (nread == 12 && chunk_type_valid(next_type))
3131 /* Adjust the read count back to the correct value for this
3134 file->read_count -= 8;
3135 process_chunk(file, file_crc, next_length, next_type);
3143 process_chunk(file, file_crc, 0, 0);
3149 /* Control gets to here if the the stream seems invalid or damaged in some
3150 * way. Either there was a problem reading all the expected data (this
3151 * chunk's data, its CRC and the length and type of the next chunk) or the
3152 * next chunk length/type are invalid. Notice that the cases that end up
3153 * here all correspond to cases that would otherwise terminate the read of
3159 /* This returns a file* from a png_struct in an implementation specific way. */
3160 static struct file *get_control(png_const_structrp png_ptr);
3162 static void PNGCBAPI
3163 error_handler(png_structp png_ptr, png_const_charp message)
3165 stop(get_control(png_ptr), LIBPNG_ERROR_CODE, message);
3168 static void PNGCBAPI
3169 warning_handler(png_structp png_ptr, png_const_charp message)
3171 struct file *file = get_control(png_ptr);
3173 if (file->global->warnings)
3174 emit_error(file, LIBPNG_WARNING_CODE, message);
3177 /* Read callback - this is where the work gets done to check the stream before
3178 * passing it to libpng
3180 static void PNGCBAPI
3181 read_callback(png_structp png_ptr, png_bytep buffer, size_t count)
3182 /* Return 'count' bytes to libpng in 'buffer' */
3184 struct file *file = get_control(png_ptr);
3185 png_uint_32 type, length; /* For the chunk be *WRITTEN* */
3186 struct chunk *chunk;
3188 /* libpng should always ask for at least one byte */
3190 stop(file, UNEXPECTED_ERROR_CODE, "read callback for 0 bytes");
3192 /* The callback always reads ahead by 8 bytes - the signature or chunk header
3193 * - these bytes are stored in chunk_length and chunk_type. This block is
3194 * executed once for the signature and once for the first chunk right at the
3197 if (file->read_count < 8)
3199 assert(file->read_count == 0);
3200 assert((file->status_code & TRUNCATED) == 0);
3202 (void)read_4(file, &file->length);
3204 if (file->read_count == 4)
3205 (void)read_4(file, &file->type);
3207 if (file->read_count < 8)
3209 assert((file->status_code & TRUNCATED) != 0);
3210 stop(file, READ_ERROR_CODE, "not a PNG (too short)");
3213 if (file->state == STATE_SIGNATURE)
3215 if (file->length != sig1 || file->type != sig2)
3216 stop(file, LIBPNG_ERROR_CODE, "not a PNG (signature)");
3218 /* Else write it (this is the initialization of write_count, prior to
3219 * this it contains CLEAR garbage.)
3221 file->write_count = 0;
3226 assert(file->state == STATE_CHUNKS);
3228 /* The first chunk must be a well formed IHDR (this could be relaxed to
3229 * use the checks in process_chunk, but that seems unnecessary.)
3231 if (file->length != 13 || file->type != png_IHDR)
3232 stop(file, LIBPNG_ERROR_CODE, "not a PNG (IHDR)");
3234 /* The position of the data must be stored too */
3239 /* Retrieve previous state (because the read callbacks are made pretty much
3240 * byte-by-byte in the sequential reader prior to 1.7).
3242 chunk = file->chunk;
3246 length = chunk->chunk_length;
3247 type = chunk->chunk_type;
3252 /* This is the signature case; for IDAT and other chunks these values will
3253 * be overwritten when read_chunk is called below.
3255 length = file->length;
3263 /* Complete the read of a chunk; as a side effect this also instantiates
3264 * a chunk control structure and sets the file length/type/data_pos fields
3265 * for the *NEXT* chunk header.
3267 * NOTE: at an IDAT any following IDAT chunks will also be read and the
3268 * next_ fields will refer to the chunk after the last IDAT.
3270 * NOTE: read_chunk only returns when it has read a chunk that must now be
3273 if (file->state != STATE_SIGNATURE && chunk == NULL)
3275 assert(file->read_count == 8);
3276 assert(file->idat == NULL);
3278 chunk = file->chunk;
3279 assert(chunk != NULL);
3281 /* Do the initialization that was not done before. */
3282 length = chunk->chunk_length;
3283 type = chunk->chunk_type;
3285 /* And start writing the new chunk. */
3286 file->write_count = 0;
3289 /* The chunk_ fields describe a chunk that must be written, or hold the
3290 * signature. Write the header first. In the signature case this
3291 * rewrites the signature.
3293 switch (file->write_count)
3295 case 0: b = length >> 24; break;
3296 case 1: b = length >> 16; break;
3297 case 2: b = length >> 8; break;
3298 case 3: b = length ; break;
3300 case 4: b = type >> 24; break;
3301 case 5: b = type >> 16; break;
3302 case 6: b = type >> 8; break;
3303 case 7: b = type ; break;
3306 /* The header has been written. If this is really the signature
3307 * that's all that is required and we can go to normal chunk
3310 if (file->state == STATE_SIGNATURE)
3312 /* The signature has been written, the tail call to read_callback
3313 * below (it's just a goto to the start with a decent compiler)
3314 * will read the IHDR header ahead and validate it.
3316 assert(length == sig1 && type == sig2);
3317 file->read_count = 0; /* Forces a header read */
3318 file->state = STATE_CHUNKS; /* IHDR: checked above */
3319 read_callback(png_ptr, buffer, count);
3325 assert(chunk != NULL);
3327 /* Set up for write, notice that repositioning the input stream
3328 * is only necessary if something is to be read from it. Also
3329 * notice that for the IDAT stream this must only happen once -
3330 * on the first IDAT - to get back to the start of the list and
3331 * this is done inside process_IDAT:
3333 chunk->write_crc = crc_init_4(type);
3334 if (file->state != STATE_IDAT && length > 0)
3340 assert(chunk != NULL);
3342 /* NOTE: the arithmetic below overflows and gives a large positive
3343 * png_uint_32 value until the whole chunk data has been written.
3345 switch (file->write_count - length)
3347 /* Write the chunk data, normally this just comes from
3348 * the file. The only exception is for that part of a
3349 * chunk which is zlib data and which must be rewritten,
3350 * and IDAT chunks which can be completely
3354 if (file->state == STATE_IDAT)
3356 struct IDAT *idat = file->idat;
3358 assert(idat != NULL);
3360 /* Read an IDAT byte from the input stream of IDAT chunks.
3361 * Because the IDAT stream can be re-chunked this stream is
3362 * held in the struct IDAT members. The chunk members, in
3363 * particular chunk_length (and therefore the length local)
3364 * refer to the output chunk.
3366 while (idat->idat_index >= idat->idat_length)
3368 /* Advance one chunk */
3369 struct IDAT_list *cur = idat->idat_cur;
3371 assert(idat->idat_index == idat->idat_length);
3372 assert(cur != NULL && cur->count > 0);
3374 /* NOTE: IDAT_list::count here, not IDAT_list::length */
3375 if (++(idat->idat_count) >= cur->count)
3377 assert(idat->idat_count == cur->count);
3379 /* Move on to the next IDAT_list: */
3382 /* This is an internal error - read beyond the end of
3383 * the pre-calculated stream.
3385 if (cur == NULL || cur->count == 0)
3386 stop(file, UNEXPECTED_ERROR_CODE,
3387 "read beyond end of IDAT");
3389 idat->idat_count = 0;
3390 idat->idat_cur = cur;
3393 idat->idat_index = 0;
3394 /* Zero length IDAT chunks are permitted, so the length
3397 idat->idat_length = cur->lengths[idat->idat_count];
3399 /* And skip 12 bytes to the next chunk data */
3403 /* The index is always that of the next byte, the rest of
3404 * the information is always the current IDAT chunk and the
3407 ++(idat->idat_index);
3410 /* Read the byte from the stream. */
3411 b = reread_byte(file);
3413 /* If the byte must be rewritten handle that here */
3414 if (chunk->rewrite_length > 0)
3416 if (chunk->rewrite_offset > 0)
3417 --(chunk->rewrite_offset);
3421 b = chunk->rewrite_buffer[0];
3422 memmove(chunk->rewrite_buffer, chunk->rewrite_buffer+1,
3423 (sizeof chunk->rewrite_buffer)-
3424 (sizeof chunk->rewrite_buffer[0]));
3426 --(chunk->rewrite_length);
3430 chunk->write_crc = crc_one_byte(chunk->write_crc, b);
3433 /* The CRC is written at:
3435 * chunk_write == chunk_length+8..chunk_length+11
3437 * so 8 to 11. The CRC is not (yet) conditioned.
3439 case 8: b = chunk->write_crc >> 24; goto write_crc;
3440 case 9: b = chunk->write_crc >> 16; goto write_crc;
3441 case 10: b = chunk->write_crc >> 8; goto write_crc;
3443 /* This must happen before the chunk_end below: */
3444 b = chunk->write_crc;
3446 if (file->global->verbose > 2)
3449 type_name(type, stderr);
3450 fprintf(stderr, " %lu 0x%.8x\n", (unsigned long)length,
3451 chunk->write_crc ^ 0xffffffff);
3454 /* The IDAT stream is written without a call to read_chunk
3455 * until the end is reached. rechunk_length() calculates the
3456 * length of the output chunks. Control gets to this point at
3457 * the end of an *output* chunk - the length calculated by
3458 * rechunk_length. If this corresponds to the end of the
3459 * input stream stop writing IDAT chunks, otherwise continue.
3461 if (file->state == STATE_IDAT &&
3462 (file->idat->idat_index < file->idat->idat_length ||
3463 1+file->idat->idat_count < file->idat->idat_cur->count ||
3464 file->idat->idat_cur != file->idat->idat_list_tail))
3466 /* Write another IDAT chunk. Call rechunk_length to
3467 * calculate the length required.
3469 length = chunk->chunk_length = rechunk_length(file->idat);
3470 assert(type == png_IDAT);
3471 file->write_count = 0; /* for the new chunk */
3472 --(file->write_count); /* fake out the increment below */
3477 /* Entered at the end of a non-IDAT chunk and at the end of
3478 * the IDAT stream. The rewrite should have been cleared.
3480 if (chunk->rewrite_length > 0 || chunk->rewrite_offset > 0)
3481 stop(file, UNEXPECTED_ERROR_CODE, "pending rewrite");
3483 /* This is the last byte so reset chunk_read for the next
3484 * chunk and move the input file to the position after the
3485 * *next* chunk header if required.
3487 file->read_count = 8;
3488 file_setpos(file, &file->data_pos);
3490 if (file->idat == NULL)
3491 chunk_end(&file->chunk);
3494 IDAT_end(&file->idat);
3498 b ^= 0xff; /* conditioning */
3504 /* Write one byte */
3506 *buffer++ = (png_byte)b;
3508 write_byte(file, (png_byte)b); /* increments chunk_write */
3513 /* Bundle the file and an uninitialized chunk and IDAT control structure
3514 * together to allow implementation of the chunk/IDAT allocate routine.
3524 control_end(struct control *control)
3526 return file_end(&control->file);
3529 static struct file *
3530 get_control(png_const_structrp png_ptr)
3532 /* This just returns the (file*). The chunk and idat control structures
3533 * don't always exist.
3535 struct control *control = png_voidcast(struct control*,
3536 png_get_error_ptr(png_ptr));
3537 return &control->file;
3541 allocate(struct file *file, int allocate_idat)
3543 struct control *control = png_voidcast(struct control*, file->alloc_ptr);
3547 assert(file->idat == NULL);
3548 IDAT_init(&control->idat, file);
3553 assert(file->chunk == NULL);
3554 chunk_init(&control->chunk, file);
3559 control_init(struct control *control, struct global *global,
3560 const char *file_name, const char *out_name)
3561 /* This wraps file_init(&control::file) and simply returns the result from
3565 return file_init(&control->file, global, file_name, out_name, control,
3570 read_png(struct control *control)
3571 /* Read a PNG, return 0 on success else an error (status) code; a bit mask as
3572 * defined for file::status_code as above.
3575 png_structp png_ptr;
3576 png_infop info_ptr = NULL;
3577 volatile png_bytep row = NULL, display = NULL;
3580 png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, control,
3581 error_handler, warning_handler);
3583 if (png_ptr == NULL)
3585 /* This is not really expected. */
3586 log_error(&control->file, LIBPNG_ERROR_CODE, "OOM allocating png_struct");
3587 control->file.status_code |= INTERNAL_ERROR;
3588 return LIBPNG_ERROR_CODE;
3591 rc = setjmp(control->file.jmpbuf);
3594 png_set_read_fn(png_ptr, control, read_callback);
3596 info_ptr = png_create_info_struct(png_ptr);
3597 if (info_ptr == NULL)
3598 png_error(png_ptr, "OOM allocating info structure");
3600 if (control->file.global->verbose)
3601 fprintf(stderr, " INFO\n");
3603 png_read_info(png_ptr, info_ptr);
3606 png_size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr);
3608 row = png_voidcast(png_byte*, malloc(rowbytes));
3609 display = png_voidcast(png_byte*, malloc(rowbytes));
3611 if (row == NULL || display == NULL)
3612 png_error(png_ptr, "OOM allocating row buffers");
3615 png_uint_32 height = png_get_image_height(png_ptr, info_ptr);
3616 int passes = png_set_interlace_handling(png_ptr);
3619 png_start_read_image(png_ptr);
3621 for (pass = 0; pass < passes; ++pass)
3623 png_uint_32 y = height;
3625 /* NOTE: this trashes the row each time; interlace handling won't
3626 * work, but this avoids memory thrashing for speed testing.
3629 png_read_row(png_ptr, row, display);
3634 if (control->file.global->verbose)
3635 fprintf(stderr, " END\n");
3637 /* Make sure to read to the end of the file: */
3638 png_read_end(png_ptr, info_ptr);
3641 png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
3642 if (row != NULL) free(row);
3643 if (display != NULL) free(display);
3648 one_file(struct global *global, const char *file_name, const char *out_name)
3651 struct control control;
3653 if (global->verbose)
3654 fprintf(stderr, "FILE %s -> %s\n", file_name,
3655 out_name ? out_name : "<none>");
3657 /* Although control_init can return a failure code the structure is always
3658 * initialized, so control_end can be used to accumulate any status codes.
3660 rc = control_init(&control, global, file_name, out_name);
3663 rc = read_png(&control);
3665 rc |= control_end(&control);
3671 usage(const char *prog)
3673 /* ANSI C-90 limits strings to 509 characters, so use a string array: */
3675 static const char *usage_string[] = {
3676 " Tests, optimizes and optionally fixes the zlib header in PNG files.",
3677 " Optionally, when fixing, strips ancilliary chunks from the file.",
3681 " By default files are just checked for readability with a summary of the",
3682 " of zlib issues founds for each compressed chunk and the IDAT stream in",
3684 " --optimize (-o):",
3685 " Find the smallest deflate window size for the compressed data.",
3686 " --strip=[none|crc|unsafe|unused|transform|color|all]:",
3687 " none (default): Retain all chunks.",
3688 " crc: Remove chunks with a bad CRC.",
3689 " unsafe: Remove chunks that may be unsafe to retain if the image data",
3690 " is modified. This is set automatically if --max is given but",
3691 " may be cancelled by a later --strip=none.",
3692 " unused: Remove chunks not used by libpng when decoding an image.",
3693 " This retains any chunks that might be used by libpng image",
3694 " transformations.",
3695 " transform: unused+bKGD.",
3696 " color: transform+iCCP and cHRM.",
3697 " all: color+gAMA and sRGB.",
3698 " Only ancillary chunks are ever removed. In addition the tRNS and sBIT",
3699 " chunks are never removed as they affect exact interpretation of the",
3700 " image pixel values. The following known chunks are treated specially",
3701 " by the above options:",
3702 " gAMA, sRGB [all]: These specify the gamma encoding used for the pixel",
3704 " cHRM, iCCP [color]: These specify how colors are encoded. iCCP also",
3705 " specifies the exact encoding of a pixel value however in practice",
3706 " most programs will ignore it.",
3707 " bKGD [transform]: This is used by libpng transforms."
3709 " Use IDAT chunks sized <number>. If no number is given the the IDAT",
3710 " chunks will be the maximum size permitted; 2^31-1 bytes. If the option",
3711 " is omitted the original chunk sizes will not be changed. When the",
3712 " option is given --strip=unsafe is set automatically, this may be",
3713 " cancelled if you know that all unknown unsafe-to-copy chunks really are",
3714 " safe to copy across an IDAT size change. This is true of all chunks",
3715 " that have ever been formally proposed as PNG extensions.",
3717 " By default the program only outputs summaries for each file.",
3719 " Do not output the summaries except for files which cannot be read. With",
3720 " two --quiets these are not output either.",
3722 " Output errors from libpng and the program (except too-far-back).",
3723 " --warnings (-w):",
3724 " Output warnings from libpng.",
3726 " By default nothing is written.",
3728 " Write the optimized/corrected version of the next PNG to <file>. This",
3729 " overrides the following two options",
3730 " --suffix=<suffix>:",
3731 " Set --out=<name><suffix> for all following files unless overridden on",
3732 " a per-file basis by explicit --out.",
3733 " --prefix=<prefix>:",
3734 " Set --out=<prefix><name> for all the following files unless overridden",
3735 " on a per-file basis by explicit --out.",
3736 " These two options can be used together to produce a suffix and prefix.",
3737 " INTERNAL OPTIONS",
3739 #ifdef PNG_MAXIMUM_INFLATE_WINDOW
3741 " Test the PNG_MAXIMUM_INFLATE_WINDOW option. Setting this disables",
3742 " output as this would produce a broken file.",
3747 " *** SUBJECT TO CHANGE ***",
3748 " The program exit code is value in the range 0..127 holding a bit mask of",
3749 " the following codes. Notice that the results for each file are combined",
3750 " together - check one file at a time to get a meaningful error code!",
3751 " 0x01: The zlib too-far-back error existed in at least one chunk.",
3752 " 0x02: At least once chunk had a CRC error.",
3753 " 0x04: A chunk length was incorrect.",
3754 " 0x08: The file was truncated.",
3755 " Errors less than 16 are potentially recoverable, for a single file if the",
3756 " exit code is less than 16 the file could be read (with corrections if a",
3757 " non-zero code is returned).",
3758 " 0x10: The file could not be read, even with corrections.",
3759 " 0x20: The output file could not be written.",
3760 " 0x40: An unexpected, potentially internal, error occured.",
3761 " If the command line arguments are incorrect the program exits with exit",
3762 " 255. Some older operating systems only support 7-bit exit codes, on those",
3763 " systems it is suggested that this program is first tested by supplying",
3764 " invalid arguments.",
3767 " " PROGRAM_NAME ":",
3768 " checks each PNG file on the command line for errors. By default errors are",
3769 " not output and the program just returns an exit code and prints a summary.",
3770 " With the --quiet (-q) option the summaries are suppressed too and the",
3771 " program only outputs unexpected errors (internal errors and file open",
3773 " Various known problems in PNG files are fixed while the file is being read",
3774 " The exit code says what problems were fixed. In particular the zlib error:",
3776 " \"invalid distance too far back\"",
3778 " caused by an incorrect optimization of a zlib stream is fixed in any",
3779 " compressed chunk in which it is encountered. An integrity problem of the",
3780 " PNG stream caused by a bug in libpng which wrote an incorrect chunk length",
3781 " is also fixed. Chunk CRC errors are automatically fixed up.",
3783 " Setting one of the \"OUTPUT\" options causes the possibly modified file to",
3784 " be written to a new file.",
3786 " Notice that some PNG files with the zlib optimization problem can still be",
3787 " read by libpng under some circumstances. This program will still detect",
3788 " and, if requested, correct the error.",
3790 " The program will reliably process all files on the command line unless",
3791 " either an invalid argument causes the usage message (this message) to be",
3792 " produced or the program crashes.",
3794 " The summary lines describe issues encountered with the zlib compressed",
3795 " stream of a chunk. They have the following format, which is SUBJECT TO",
3796 " CHANGE in the future:",
3798 " chunk reason comp-level p1 p2 p3 p4 file",
3800 " p1 through p4 vary according to the 'reason'. There are always 8 space",
3801 " separated fields. Reasons specific formats are:",
3803 " chunk ERR status code read-errno write-errno message file",
3804 " chunk SKP comp-level file-bits zlib-rc compressed message file",
3805 " chunk ??? comp-level file-bits ok-bits compressed uncompress file",
3807 " The various fields are",
3809 "$1 chunk: The chunk type of a chunk in the file or 'HEAD' if a problem",
3810 " is reported by libpng at the start of the IDAT stream.",
3811 "$2 reason: One of:",
3812 " CHK: A zlib header checksum was detected and fixed.",
3813 " TFB: The zlib too far back error was detected and fixed.",
3814 " OK : No errors were detected in the zlib stream and optimization",
3815 " was not requested, or was not possible.",
3816 " OPT: The zlib stream window bits value could be improved (and was).",
3817 " SKP: The chunk was skipped because of a zlib issue (zlib-rc) with",
3818 " explanation 'message'",
3819 " ERR: The read of the file was aborted. The parameters explain why.",
3820 "$3 status: For 'ERR' the accumulate status code from 'EXIT CODES' above.",
3821 " This is printed as a 2 digit hexadecimal value",
3822 " comp-level: The recorded compression level (FLEVEL) of a zlib stream",
3823 " expressed as a string {supfast,stdfast,default,maximum}",
3824 "$4 code: The file exit code; where stop was called, as a fairly terse",
3825 " string {warning,libpng,zlib,invalid,read,write,unexpected}.",
3826 " file-bits: The zlib window bits recorded in the file.",
3827 "$5 read-errno: A system errno value from a read translated by strerror(3).",
3828 " zlib-rc: A zlib return code as a string (see zlib.h).",
3829 " ok-bits: The smallest zlib window bits value that works.",
3830 "$6 write-errno:A system errno value from a write translated by strerror(3).",
3831 " compressed: The count of compressed bytes in the zlib stream, when the",
3832 " reason is 'SKP'; this is a count of the bytes read from the",
3833 " stream when the fatal error was encountered.",
3834 "$7 message: An error message (spaces replaced by _, as in all parameters),",
3835 " uncompress: The count of bytes from uncompressing the zlib stream; this",
3836 " may not be the same as the number of bytes in the image.",
3837 "$8 file: The name of the file (this may contain spaces).",
3840 fprintf(stderr, "Usage: %s {[options] png-file}\n", prog);
3842 for (i=0; i < (sizeof usage_string)/(sizeof usage_string[0]); ++i)
3844 if (usage_string[i] != 0)
3845 fputs(usage_string[i], stderr);
3847 fputc('\n', stderr);
3854 main(int argc, const char **argv)
3856 const char * prog = *argv;
3857 const char * outfile = NULL;
3858 const char * suffix = NULL;
3859 const char * prefix = NULL;
3860 int done = 0; /* if at least one file is processed */
3861 struct global global;
3863 global_init(&global);
3869 if (strcmp(*argv, "--debug") == 0)
3871 /* To help debugging problems: */
3872 global.errors = global.warnings = 1;
3877 else if (strncmp(*argv, "--max=", 6) == 0)
3879 global.idat_max = (png_uint_32)atol(6+*argv);
3881 if (global.skip < SKIP_UNSAFE)
3882 global.skip = SKIP_UNSAFE;
3885 else if (strcmp(*argv, "--max") == 0)
3887 global.idat_max = 0x7fffffff;
3889 if (global.skip < SKIP_UNSAFE)
3890 global.skip = SKIP_UNSAFE;
3893 else if (strcmp(*argv, "--optimize") == 0 || strcmp(*argv, "-o") == 0)
3894 global.optimize_zlib = 1;
3896 else if (strncmp(*argv, "--out=", 6) == 0)
3899 else if (strncmp(*argv, "--suffix=", 9) == 0)
3902 else if (strncmp(*argv, "--prefix=", 9) == 0)
3905 else if (strcmp(*argv, "--strip=none") == 0)
3906 global.skip = SKIP_NONE;
3908 else if (strcmp(*argv, "--strip=crc") == 0)
3909 global.skip = SKIP_BAD_CRC;
3911 else if (strcmp(*argv, "--strip=unsafe") == 0)
3912 global.skip = SKIP_UNSAFE;
3914 else if (strcmp(*argv, "--strip=unused") == 0)
3915 global.skip = SKIP_UNUSED;
3917 else if (strcmp(*argv, "--strip=transform") == 0)
3918 global.skip = SKIP_TRANSFORM;
3920 else if (strcmp(*argv, "--strip=color") == 0)
3921 global.skip = SKIP_COLOR;
3923 else if (strcmp(*argv, "--strip=all") == 0)
3924 global.skip = SKIP_ALL;
3926 else if (strcmp(*argv, "--errors") == 0 || strcmp(*argv, "-e") == 0)
3929 else if (strcmp(*argv, "--warnings") == 0 || strcmp(*argv, "-w") == 0)
3930 global.warnings = 1;
3932 else if (strcmp(*argv, "--quiet") == 0 || strcmp(*argv, "-q") == 0)
3941 else if (strcmp(*argv, "--verbose") == 0 || strcmp(*argv, "-v") == 0)
3946 # ifdef PNG_MAXIMUM_INFLATE_WINDOW
3947 else if (strcmp(*argv, "--test") == 0)
3952 else if ((*argv)[0] == '-')
3957 size_t outlen = strlen(*argv);
3958 char temp_name[FILENAME_MAX+1];
3960 if (outfile == NULL) /* else this takes precedence */
3962 /* Consider the prefix/suffix options */
3965 size_t prefixlen = strlen(prefix);
3967 if (prefixlen+outlen > FILENAME_MAX)
3969 fprintf(stderr, "%s: output file name too long: %s%s%s\n",
3970 prog, prefix, *argv, suffix ? suffix : "");
3971 global.status_code |= WRITE_ERROR;
3975 memcpy(temp_name, prefix, prefixlen);
3976 memcpy(temp_name+prefixlen, *argv, outlen);
3977 outlen += prefixlen;
3978 outfile = temp_name;
3981 else if (suffix != NULL)
3982 memcpy(temp_name, *argv, outlen);
3984 temp_name[outlen] = 0;
3988 size_t suffixlen = strlen(suffix);
3990 if (outlen+suffixlen > FILENAME_MAX)
3992 fprintf(stderr, "%s: output file name too long: %s%s\n",
3993 prog, *argv, suffix);
3994 global.status_code |= WRITE_ERROR;
3998 memcpy(temp_name+outlen, suffix, suffixlen);
3999 outlen += suffixlen;
4000 temp_name[outlen] = 0;
4001 outfile = temp_name;
4005 (void)one_file(&global, *argv, outfile);
4014 return global_end(&global);
4017 #else /* PNG_ZLIB_VERNUM < 0x1240 */
4022 "pngfix needs libpng with a zlib >=1.2.4 (not 0x%x)\n",
4026 #endif /* PNG_ZLIB_VERNUM */
4028 #else /* No read support */
4033 fprintf(stderr, "pngfix does not work without read support\n");
4036 #endif /* PNG_READ_SUPPORTED && PNG_EASY_ACCESS_SUPPORTED */