pngset.c 46.0 KB
Newer Older
A
Andreas Dilger 已提交
1 2

/* pngset.c - storage of image information into info struct
3
 *
4 5
 * Last changed in libpng 1.6.1 [(PENDING RELEASE)]
 * Copyright (c) 1998-2013 Glenn Randers-Pehrson
6 7
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
8
 *
9
 * This code is released under the libpng license.
10
 * For conditions of distribution and use, see the disclaimer
11
 * and license in png.h
12
 *
13 14 15 16 17
 * The functions here are used during reads to store data from the file
 * into the info struct, and during writes to store application data
 * into the info struct for writing into the file.  This abstracts the
 * info struct and allows us to change the structure in the future.
 */
A
Andreas Dilger 已提交
18

19
#include "pngpriv.h"
20

21 22
#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

23
#ifdef PNG_bKGD_SUPPORTED
24
void PNGAPI
25
png_set_bKGD(png_const_structrp png_ptr, png_inforp info_ptr,
26
    png_const_color_16p background)
A
Andreas Dilger 已提交
27
{
28
   png_debug1(1, "in %s storage function", "bKGD");
29

30
   if (png_ptr == NULL || info_ptr == NULL || background == NULL)
A
Andreas Dilger 已提交
31 32
      return;

33
   info_ptr->background = *background;
A
Andreas Dilger 已提交
34 35 36 37
   info_ptr->valid |= PNG_INFO_bKGD;
}
#endif

38
#ifdef PNG_cHRM_SUPPORTED
G
[devel]  
Glenn Randers-Pehrson 已提交
39
void PNGFAPI
40
png_set_cHRM_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
41 42 43
    png_fixed_point white_x, png_fixed_point white_y, png_fixed_point red_x,
    png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y,
    png_fixed_point blue_x, png_fixed_point blue_y)
44
{
45 46
   png_xy xy;

47
   png_debug1(1, "in %s storage function", "cHRM fixed");
48

49 50
   if (png_ptr == NULL || info_ptr == NULL)
      return;
A
Andreas Dilger 已提交
51

52 53 54 55 56 57 58 59 60 61 62 63 64 65
   xy.redx = red_x;
   xy.redy = red_y;
   xy.greenx = green_x;
   xy.greeny = green_y;
   xy.bluex = blue_x;
   xy.bluey = blue_y;
   xy.whitex = white_x;
   xy.whitey = white_y;

   if (png_colorspace_set_chromaticities(png_ptr, &info_ptr->colorspace, &xy,
      2/* override with app values*/))
      info_ptr->colorspace.flags |= PNG_COLORSPACE_FROM_cHRM;

   png_colorspace_sync_info(png_ptr, info_ptr);
66 67
}

68
void PNGFAPI
69
png_set_cHRM_XYZ_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
70 71 72 73 74 75 76 77 78 79 80 81 82
    png_fixed_point int_red_X, png_fixed_point int_red_Y,
    png_fixed_point int_red_Z, png_fixed_point int_green_X,
    png_fixed_point int_green_Y, png_fixed_point int_green_Z,
    png_fixed_point int_blue_X, png_fixed_point int_blue_Y,
    png_fixed_point int_blue_Z)
{
   png_XYZ XYZ;

   png_debug1(1, "in %s storage function", "cHRM XYZ fixed");

   if (png_ptr == NULL || info_ptr == NULL)
      return;

83 84 85 86 87 88 89 90 91 92 93 94 95 96
   XYZ.red_X = int_red_X;
   XYZ.red_Y = int_red_Y;
   XYZ.red_Z = int_red_Z;
   XYZ.green_X = int_green_X;
   XYZ.green_Y = int_green_Y;
   XYZ.green_Z = int_green_Z;
   XYZ.blue_X = int_blue_X;
   XYZ.blue_Y = int_blue_Y;
   XYZ.blue_Z = int_blue_Z;

   if (png_colorspace_set_endpoints(png_ptr, &info_ptr->colorspace, &XYZ, 2))
      info_ptr->colorspace.flags |= PNG_COLORSPACE_FROM_cHRM;

   png_colorspace_sync_info(png_ptr, info_ptr);
97 98
}

99
#  ifdef PNG_FLOATING_POINT_SUPPORTED
100
void PNGAPI
101
png_set_cHRM(png_const_structrp png_ptr, png_inforp info_ptr,
G
[devel]  
Glenn Randers-Pehrson 已提交
102 103
    double white_x, double white_y, double red_x, double red_y,
    double green_x, double green_y, double blue_x, double blue_y)
A
Andreas Dilger 已提交
104
{
G
[devel]  
Glenn Randers-Pehrson 已提交
105 106 107 108 109 110 111 112 113 114
   png_set_cHRM_fixed(png_ptr, info_ptr,
      png_fixed(png_ptr, white_x, "cHRM White X"),
      png_fixed(png_ptr, white_y, "cHRM White Y"),
      png_fixed(png_ptr, red_x, "cHRM Red X"),
      png_fixed(png_ptr, red_y, "cHRM Red Y"),
      png_fixed(png_ptr, green_x, "cHRM Green X"),
      png_fixed(png_ptr, green_y, "cHRM Green Y"),
      png_fixed(png_ptr, blue_x, "cHRM Blue X"),
      png_fixed(png_ptr, blue_y, "cHRM Blue Y"));
}
115 116

void PNGAPI
117
png_set_cHRM_XYZ(png_const_structrp png_ptr, png_inforp info_ptr, double red_X,
118 119 120 121 122 123 124 125 126 127 128 129 130 131
    double red_Y, double red_Z, double green_X, double green_Y, double green_Z,
    double blue_X, double blue_Y, double blue_Z)
{
   png_set_cHRM_XYZ_fixed(png_ptr, info_ptr,
      png_fixed(png_ptr, red_X, "cHRM Red X"),
      png_fixed(png_ptr, red_Y, "cHRM Red Y"),
      png_fixed(png_ptr, red_Z, "cHRM Red Z"),
      png_fixed(png_ptr, green_X, "cHRM Red X"),
      png_fixed(png_ptr, green_Y, "cHRM Red Y"),
      png_fixed(png_ptr, green_Z, "cHRM Red Z"),
      png_fixed(png_ptr, blue_X, "cHRM Red X"),
      png_fixed(png_ptr, blue_Y, "cHRM Red Y"),
      png_fixed(png_ptr, blue_Z, "cHRM Red Z"));
}
132
#  endif /* PNG_FLOATING_POINT_SUPPORTED */
133

G
[devel]  
Glenn Randers-Pehrson 已提交
134
#endif /* PNG_cHRM_SUPPORTED */
135

G
[devel]  
Glenn Randers-Pehrson 已提交
136 137
#ifdef PNG_gAMA_SUPPORTED
void PNGFAPI
138 139
png_set_gAMA_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
    png_fixed_point file_gamma)
140
{
141
   png_debug1(1, "in %s storage function", "gAMA");
142

143 144 145
   if (png_ptr == NULL || info_ptr == NULL)
      return;

146 147
   png_colorspace_set_gamma(png_ptr, &info_ptr->colorspace, file_gamma);
   png_colorspace_sync_info(png_ptr, info_ptr);
G
[devel]  
Glenn Randers-Pehrson 已提交
148
}
149

150
#  ifdef PNG_FLOATING_POINT_SUPPORTED
G
[devel]  
Glenn Randers-Pehrson 已提交
151
void PNGAPI
152
png_set_gAMA(png_const_structrp png_ptr, png_inforp info_ptr, double file_gamma)
G
[devel]  
Glenn Randers-Pehrson 已提交
153 154
{
   png_set_gAMA_fixed(png_ptr, info_ptr, png_fixed(png_ptr, file_gamma,
155
       "png_set_gAMA"));
A
Andreas Dilger 已提交
156
}
157
#  endif
158
#endif
A
Andreas Dilger 已提交
159

160
#ifdef PNG_hIST_SUPPORTED
161
void PNGAPI
162 163
png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
    png_const_uint_16p hist)
A
Andreas Dilger 已提交
164
{
165
   int i;
166

167
   png_debug1(1, "in %s storage function", "hIST");
168

169
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
170
      return;
171

172
   if (info_ptr->num_palette == 0 || info_ptr->num_palette
173
       > PNG_MAX_PALETTE_LENGTH)
174
   {
175
      png_warning(png_ptr,
176
          "Invalid palette size, hIST allocation skipped");
177

178
      return;
179
   }
180 181

   png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
182

183 184 185
   /* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in
    * version 1.2.1
    */
186
   info_ptr->hist = png_voidcast(png_uint_16p, png_malloc_warn(png_ptr,
187
       PNG_MAX_PALETTE_LENGTH * (sizeof (png_uint_16))));
188

189
   if (info_ptr->hist == NULL)
190 191 192 193
   {
      png_warning(png_ptr, "Insufficient memory for hIST chunk data");
      return;
   }
A
Andreas Dilger 已提交
194

195 196
   info_ptr->free_me |= PNG_FREE_HIST;

197
   for (i = 0; i < info_ptr->num_palette; i++)
198
      info_ptr->hist[i] = hist[i];
199

A
Andreas Dilger 已提交
200 201 202 203
   info_ptr->valid |= PNG_INFO_hIST;
}
#endif

204
void PNGAPI
205
png_set_IHDR(png_const_structrp png_ptr, png_inforp info_ptr,
206 207 208
    png_uint_32 width, png_uint_32 height, int bit_depth,
    int color_type, int interlace_type, int compression_type,
    int filter_type)
A
Andreas Dilger 已提交
209
{
210
   png_debug1(1, "in %s storage function", "IHDR");
211

212
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
213 214 215 216 217
      return;

   info_ptr->width = width;
   info_ptr->height = height;
   info_ptr->bit_depth = (png_byte)bit_depth;
218
   info_ptr->color_type = (png_byte)color_type;
A
Andreas Dilger 已提交
219 220 221
   info_ptr->compression_type = (png_byte)compression_type;
   info_ptr->filter_type = (png_byte)filter_type;
   info_ptr->interlace_type = (png_byte)interlace_type;
222 223 224 225 226

   png_check_IHDR (png_ptr, info_ptr->width, info_ptr->height,
       info_ptr->bit_depth, info_ptr->color_type, info_ptr->interlace_type,
       info_ptr->compression_type, info_ptr->filter_type);

227 228
   if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
      info_ptr->channels = 1;
229

230
   else if (info_ptr->color_type & PNG_COLOR_MASK_COLOR)
A
Andreas Dilger 已提交
231
      info_ptr->channels = 3;
232

A
Andreas Dilger 已提交
233 234
   else
      info_ptr->channels = 1;
235

A
Andreas Dilger 已提交
236 237
   if (info_ptr->color_type & PNG_COLOR_MASK_ALPHA)
      info_ptr->channels++;
238

A
Andreas Dilger 已提交
239
   info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
240

241
   /* Check for potential overflow */
242 243 244 245 246 247
   if (width >
       (PNG_UINT_32_MAX >> 3)      /* 8-byte RRGGBBAA pixels */
       - 48       /* bigrowbuf hack */
       - 1        /* filter byte */
       - 7*8      /* rounding of width to multiple of 8 pixels */
       - 8)       /* extra max_pixel_depth pad */
248
      info_ptr->rowbytes = 0;
249
   else
250
      info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
A
Andreas Dilger 已提交
251 252
}

253
#ifdef PNG_oFFs_SUPPORTED
254
void PNGAPI
255
png_set_oFFs(png_const_structrp png_ptr, png_inforp info_ptr,
256
    png_int_32 offset_x, png_int_32 offset_y, int unit_type)
A
Andreas Dilger 已提交
257
{
258
   png_debug1(1, "in %s storage function", "oFFs");
259

260
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
261 262 263 264 265 266 267 268 269
      return;

   info_ptr->x_offset = offset_x;
   info_ptr->y_offset = offset_y;
   info_ptr->offset_unit_type = (png_byte)unit_type;
   info_ptr->valid |= PNG_INFO_oFFs;
}
#endif

270
#ifdef PNG_pCAL_SUPPORTED
271
void PNGAPI
272
png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
273 274
    png_const_charp purpose, png_int_32 X0, png_int_32 X1, int type,
    int nparams, png_const_charp units, png_charpp params)
A
Andreas Dilger 已提交
275
{
276
   png_size_t length;
277
   int i;
A
Andreas Dilger 已提交
278

279
   png_debug1(1, "in %s storage function", "pCAL");
280

281 282
   if (png_ptr == NULL || info_ptr == NULL || purpose == NULL || units == NULL
      || (nparams > 0 && params == NULL))
A
Andreas Dilger 已提交
283 284
      return;

285
   length = strlen(purpose) + 1;
286
   png_debug1(3, "allocating purpose for info (%lu bytes)",
287
       (unsigned long)length);
288

G
[devel]  
Glenn Randers-Pehrson 已提交
289 290 291 292 293 294
   /* TODO: validate format of calibration name and unit name */

   /* Check that the type matches the specification. */
   if (type < 0 || type > 3)
      png_error(png_ptr, "Invalid pCAL equation type");

295 296 297
   if (nparams < 0 || nparams > 255)
      png_error(png_ptr, "Invalid pCAL parameter count");

G
[devel]  
Glenn Randers-Pehrson 已提交
298 299
   /* Validate params[nparams] */
   for (i=0; i<nparams; ++i)
300
      if (params[i] == NULL ||
301
         !png_check_fp_string(params[i], strlen(params[i])))
G
[devel]  
Glenn Randers-Pehrson 已提交
302 303
         png_error(png_ptr, "Invalid format for pCAL parameter");

304 305
   info_ptr->pcal_purpose = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, length));
306

307
   if (info_ptr->pcal_purpose == NULL)
308
   {
309
      png_warning(png_ptr, "Insufficient memory for pCAL purpose");
310 311
      return;
   }
312

313
   memcpy(info_ptr->pcal_purpose, purpose, length);
A
Andreas Dilger 已提交
314

315
   png_debug(3, "storing X0, X1, type, and nparams in info");
A
Andreas Dilger 已提交
316 317 318 319 320
   info_ptr->pcal_X0 = X0;
   info_ptr->pcal_X1 = X1;
   info_ptr->pcal_type = (png_byte)type;
   info_ptr->pcal_nparams = (png_byte)nparams;

321
   length = strlen(units) + 1;
322
   png_debug1(3, "allocating units for info (%lu bytes)",
323
     (unsigned long)length);
324

325 326
   info_ptr->pcal_units = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, length));
327

328
   if (info_ptr->pcal_units == NULL)
329
   {
330
      png_warning(png_ptr, "Insufficient memory for pCAL units");
331 332
      return;
   }
333

334
   memcpy(info_ptr->pcal_units, units, length);
A
Andreas Dilger 已提交
335

336
   info_ptr->pcal_params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
337
       (png_size_t)((nparams + 1) * (sizeof (png_charp)))));
338

339
   if (info_ptr->pcal_params == NULL)
340
   {
341
      png_warning(png_ptr, "Insufficient memory for pCAL params");
342 343
      return;
   }
344

345
   memset(info_ptr->pcal_params, 0, (nparams + 1) * (sizeof (png_charp)));
A
Andreas Dilger 已提交
346 347 348

   for (i = 0; i < nparams; i++)
   {
349
      length = strlen(params[i]) + 1;
350
      png_debug2(3, "allocating parameter %d for info (%lu bytes)", i,
351
          (unsigned long)length);
352

353
      info_ptr->pcal_params[i] = (png_charp)png_malloc_warn(png_ptr, length);
354

355
      if (info_ptr->pcal_params[i] == NULL)
356
      {
357 358
         png_warning(png_ptr, "Insufficient memory for pCAL parameter");
         return;
359
      }
360

361
      memcpy(info_ptr->pcal_params[i], params[i], length);
A
Andreas Dilger 已提交
362 363 364
   }

   info_ptr->valid |= PNG_INFO_pCAL;
365
   info_ptr->free_me |= PNG_FREE_PCAL;
A
Andreas Dilger 已提交
366 367 368
}
#endif

369
#ifdef PNG_sCAL_SUPPORTED
370
void PNGAPI
371
png_set_sCAL_s(png_const_structrp png_ptr, png_inforp info_ptr,
372
    int unit, png_const_charp swidth, png_const_charp sheight)
373
{
374
   png_size_t lengthw = 0, lengthh = 0;
375

376
   png_debug1(1, "in %s storage function", "sCAL");
377

378 379 380
   if (png_ptr == NULL || info_ptr == NULL)
      return;

G
[devel]  
Glenn Randers-Pehrson 已提交
381 382 383 384 385 386
   /* Double check the unit (should never get here with an invalid
    * unit unless this is an API call.)
    */
   if (unit != 1 && unit != 2)
      png_error(png_ptr, "Invalid sCAL unit");

387
   if (swidth == NULL || (lengthw = strlen(swidth)) == 0 ||
388
       swidth[0] == 45 /* '-' */ || !png_check_fp_string(swidth, lengthw))
G
[devel]  
Glenn Randers-Pehrson 已提交
389 390
      png_error(png_ptr, "Invalid sCAL width");

391
   if (sheight == NULL || (lengthh = strlen(sheight)) == 0 ||
392
       sheight[0] == 45 /* '-' */ || !png_check_fp_string(sheight, lengthh))
G
[devel]  
Glenn Randers-Pehrson 已提交
393 394
      png_error(png_ptr, "Invalid sCAL height");

395
   info_ptr->scal_unit = (png_byte)unit;
396

G
[devel]  
Glenn Randers-Pehrson 已提交
397
   ++lengthw;
398

399
   png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthw);
400

401 402
   info_ptr->scal_s_width = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, lengthw));
403

404 405
   if (info_ptr->scal_s_width == NULL)
   {
G
[devel]  
Glenn Randers-Pehrson 已提交
406
      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
407
      return;
408
   }
409

410
   memcpy(info_ptr->scal_s_width, swidth, lengthw);
411

G
[devel]  
Glenn Randers-Pehrson 已提交
412
   ++lengthh;
413

414
   png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthh);
415

416 417
   info_ptr->scal_s_height = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, lengthh));
418

419 420 421
   if (info_ptr->scal_s_height == NULL)
   {
      png_free (png_ptr, info_ptr->scal_s_width);
422
      info_ptr->scal_s_width = NULL;
423

G
[devel]  
Glenn Randers-Pehrson 已提交
424
      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
425
      return;
426
   }
427

428
   memcpy(info_ptr->scal_s_height, sheight, lengthh);
G
[devel]  
Glenn Randers-Pehrson 已提交
429

430
   info_ptr->valid |= PNG_INFO_sCAL;
431
   info_ptr->free_me |= PNG_FREE_SCAL;
432
}
G
[devel]  
Glenn Randers-Pehrson 已提交
433

434
#  ifdef PNG_FLOATING_POINT_SUPPORTED
G
[devel]  
Glenn Randers-Pehrson 已提交
435
void PNGAPI
436 437
png_set_sCAL(png_const_structrp png_ptr, png_inforp info_ptr, int unit,
    double width, double height)
G
[devel]  
Glenn Randers-Pehrson 已提交
438 439 440 441 442 443
{
   png_debug1(1, "in %s storage function", "sCAL");

   /* Check the arguments. */
   if (width <= 0)
      png_warning(png_ptr, "Invalid sCAL width ignored");
444

G
[devel]  
Glenn Randers-Pehrson 已提交
445 446
   else if (height <= 0)
      png_warning(png_ptr, "Invalid sCAL height ignored");
447

G
[devel]  
Glenn Randers-Pehrson 已提交
448 449 450 451 452 453
   else
   {
      /* Convert 'width' and 'height' to ASCII. */
      char swidth[PNG_sCAL_MAX_DIGITS+1];
      char sheight[PNG_sCAL_MAX_DIGITS+1];

454
      png_ascii_from_fp(png_ptr, swidth, (sizeof swidth), width,
G
[devel]  
Glenn Randers-Pehrson 已提交
455
         PNG_sCAL_PRECISION);
456
      png_ascii_from_fp(png_ptr, sheight, (sizeof sheight), height,
G
[devel]  
Glenn Randers-Pehrson 已提交
457 458 459 460 461
         PNG_sCAL_PRECISION);

      png_set_sCAL_s(png_ptr, info_ptr, unit, swidth, sheight);
   }
}
462
#  endif
463

464
#  ifdef PNG_FIXED_POINT_SUPPORTED
465
void PNGAPI
466
png_set_sCAL_fixed(png_const_structrp png_ptr, png_inforp info_ptr, int unit,
467
    png_fixed_point width, png_fixed_point height)
468 469 470 471 472 473
{
   png_debug1(1, "in %s storage function", "sCAL");

   /* Check the arguments. */
   if (width <= 0)
      png_warning(png_ptr, "Invalid sCAL width ignored");
474

475 476
   else if (height <= 0)
      png_warning(png_ptr, "Invalid sCAL height ignored");
477

478 479 480 481 482 483
   else
   {
      /* Convert 'width' and 'height' to ASCII. */
      char swidth[PNG_sCAL_MAX_DIGITS+1];
      char sheight[PNG_sCAL_MAX_DIGITS+1];

484 485
      png_ascii_from_fixed(png_ptr, swidth, (sizeof swidth), width);
      png_ascii_from_fixed(png_ptr, sheight, (sizeof sheight), height);
486 487 488 489

      png_set_sCAL_s(png_ptr, info_ptr, unit, swidth, sheight);
   }
}
490
#  endif
491
#endif
492

493
#ifdef PNG_pHYs_SUPPORTED
494
void PNGAPI
495
png_set_pHYs(png_const_structrp png_ptr, png_inforp info_ptr,
496
    png_uint_32 res_x, png_uint_32 res_y, int unit_type)
A
Andreas Dilger 已提交
497
{
498
   png_debug1(1, "in %s storage function", "pHYs");
499

500
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
501 502 503 504 505 506 507 508 509
      return;

   info_ptr->x_pixels_per_unit = res_x;
   info_ptr->y_pixels_per_unit = res_y;
   info_ptr->phys_unit_type = (png_byte)unit_type;
   info_ptr->valid |= PNG_INFO_pHYs;
}
#endif

510
void PNGAPI
511
png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
512
    png_const_colorp palette, int num_palette)
A
Andreas Dilger 已提交
513
{
514

515
   png_debug1(1, "in %s storage function", "PLTE");
516

517
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
518 519
      return;

520
   if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH)
521 522
   {
      if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
523
         png_error(png_ptr, "Invalid palette length");
524

525 526
      else
      {
527 528
         png_warning(png_ptr, "Invalid palette length");
         return;
529 530
      }
   }
531

532 533 534 535 536 537 538 539 540 541 542
   if ((num_palette > 0 && palette == NULL) ||
      (num_palette == 0
#        ifdef PNG_MNG_FEATURES_SUPPORTED
            && (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0
#        endif
      ))
   {
      png_chunk_report(png_ptr, "Invalid palette", PNG_CHUNK_ERROR);
      return;
   }

543
   /* It may not actually be necessary to set png_ptr->palette here;
544 545
    * we do it for backward compatibility with the way the png_handle_tRNS
    * function used to do the allocation.
546 547 548
    *
    * 1.6.0: the above statement appears to be incorrect; something has to set
    * the palette inside png_struct on read.
549 550
    */
   png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
551

552
   /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
553 554 555
    * of num_palette entries, in case of an invalid PNG file that has
    * too-large sample values.
    */
556
   png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
557
       PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
558

559 560
   if (num_palette > 0)
      memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color)));
561 562 563 564
   info_ptr->palette = png_ptr->palette;
   info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;

   info_ptr->free_me |= PNG_FREE_PLTE;
565

566
   info_ptr->valid |= PNG_INFO_PLTE;
A
Andreas Dilger 已提交
567 568
}

569
#ifdef PNG_sBIT_SUPPORTED
570
void PNGAPI
571
png_set_sBIT(png_const_structrp png_ptr, png_inforp info_ptr,
572
    png_const_color_8p sig_bit)
A
Andreas Dilger 已提交
573
{
574
   png_debug1(1, "in %s storage function", "sBIT");
575

576
   if (png_ptr == NULL || info_ptr == NULL || sig_bit == NULL)
A
Andreas Dilger 已提交
577 578
      return;

579
   info_ptr->sig_bit = *sig_bit;
A
Andreas Dilger 已提交
580 581 582 583
   info_ptr->valid |= PNG_INFO_sBIT;
}
#endif

584
#ifdef PNG_sRGB_SUPPORTED
585
void PNGAPI
586
png_set_sRGB(png_const_structrp png_ptr, png_inforp info_ptr, int srgb_intent)
587
{
588
   png_debug1(1, "in %s storage function", "sRGB");
589

590
   if (png_ptr == NULL || info_ptr == NULL)
591 592
      return;

593 594
   (void)png_colorspace_set_sRGB(png_ptr, &info_ptr->colorspace, srgb_intent);
   png_colorspace_sync_info(png_ptr, info_ptr);
595
}
596

597
void PNGAPI
598
png_set_sRGB_gAMA_and_cHRM(png_const_structrp png_ptr, png_inforp info_ptr,
599
    int srgb_intent)
600
{
601
   png_debug1(1, "in %s storage function", "sRGB_gAMA_and_cHRM");
602

603
   if (png_ptr == NULL || info_ptr == NULL)
604 605
      return;

606 607 608 609 610 611
   if (png_colorspace_set_sRGB(png_ptr, &info_ptr->colorspace, srgb_intent))
   {
      /* This causes the gAMA and cHRM to be written too */
      info_ptr->colorspace.flags |=
         PNG_COLORSPACE_FROM_gAMA|PNG_COLORSPACE_FROM_cHRM;
   }
612

613
   png_colorspace_sync_info(png_ptr, info_ptr);
614
}
615
#endif /* sRGB */
616

617

618
#ifdef PNG_iCCP_SUPPORTED
619
void PNGAPI
620
png_set_iCCP(png_const_structrp png_ptr, png_inforp info_ptr,
621 622
    png_const_charp name, int compression_type,
    png_const_bytep profile, png_uint_32 proflen)
623
{
624
   png_charp new_iccp_name;
G
[devel]  
Glenn Randers-Pehrson 已提交
625
   png_bytep new_iccp_profile;
626
   png_size_t length;
627

628
   png_debug1(1, "in %s storage function", "iCCP");
629

630 631 632
   if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL)
      return;

633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657
   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
      png_app_error(png_ptr, "Invalid iCCP compression method");

   /* Set the colorspace first because this validates the profile; do not
    * override previously set app cHRM or gAMA here (because likely as not the
    * application knows better than libpng what the correct values are.)  Pass
    * the info_ptr color_type field to png_colorspace_set_ICC because in the
    * write case it has not yet been stored in png_ptr.
    */
   {
      int result = png_colorspace_set_ICC(png_ptr, &info_ptr->colorspace, name,
         proflen, profile, info_ptr->color_type);

      png_colorspace_sync_info(png_ptr, info_ptr);

      /* Don't do any of the copying if the profile was bad, or inconsistent. */
      if (!result)
         return;

      /* But do write the gAMA and cHRM chunks from the profile. */
      info_ptr->colorspace.flags |=
         PNG_COLORSPACE_FROM_gAMA|PNG_COLORSPACE_FROM_cHRM;
   }

   length = strlen(name)+1;
658
   new_iccp_name = png_voidcast(png_charp, png_malloc_warn(png_ptr, length));
659

660 661
   if (new_iccp_name == NULL)
   {
662
      png_benign_error(png_ptr, "Insufficient memory to process iCCP chunk");
663 664
      return;
   }
665

666
   memcpy(new_iccp_name, name, length);
667 668
   new_iccp_profile = png_voidcast(png_bytep,
      png_malloc_warn(png_ptr, proflen));
669

670 671
   if (new_iccp_profile == NULL)
   {
672 673
      png_free(png_ptr, new_iccp_name);
      png_benign_error(png_ptr,
674
          "Insufficient memory to process iCCP profile");
675 676
      return;
   }
677

678
   memcpy(new_iccp_profile, profile, proflen);
679

680
   png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, 0);
681

682
   info_ptr->iccp_proflen = proflen;
683 684
   info_ptr->iccp_name = new_iccp_name;
   info_ptr->iccp_profile = new_iccp_profile;
685
   info_ptr->free_me |= PNG_FREE_ICCP;
686 687 688 689
   info_ptr->valid |= PNG_INFO_iCCP;
}
#endif

690
#ifdef PNG_TEXT_SUPPORTED
691
void PNGAPI
692 693
png_set_text(png_const_structrp png_ptr, png_inforp info_ptr,
    png_const_textp text_ptr, int num_text)
694 695
{
   int ret;
696
   ret = png_set_text_2(png_ptr, info_ptr, text_ptr, num_text);
697

698
   if (ret)
699
      png_error(png_ptr, "Insufficient memory to store text");
700 701 702
}

int /* PRIVATE */
703
png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
704
    png_const_textp text_ptr, int num_text)
A
Andreas Dilger 已提交
705 706 707
{
   int i;

708 709
   png_debug1(1, "in %lx storage function", png_ptr == NULL ? "unexpected" :
      (unsigned long)png_ptr->chunk_name);
A
Andreas Dilger 已提交
710

711
   if (png_ptr == NULL || info_ptr == NULL || num_text <= 0 || text_ptr == NULL)
712
      return(0);
A
Andreas Dilger 已提交
713 714

   /* Make sure we have enough space in the "text" array in info_struct
715 716 717
    * to hold all of the incoming text_ptr objects.  This compare can't overflow
    * because max_text >= num_text (anyway, subtract of two positive integers
    * can't overflow in any case.)
A
Andreas Dilger 已提交
718
    */
719
   if (num_text > info_ptr->max_text - info_ptr->num_text)
A
Andreas Dilger 已提交
720
   {
721 722 723 724 725 726 727
      int old_num_text = info_ptr->num_text;
      int max_text;
      png_textp new_text = NULL;

      /* Calculate an appropriate max_text, checking for overflow. */
      max_text = old_num_text;
      if (num_text <= INT_MAX - max_text)
A
Andreas Dilger 已提交
728
      {
729
         max_text += num_text;
730

731 732 733
         /* Round up to a multiple of 8 */
         if (max_text < INT_MAX-8)
            max_text = (max_text + 8) & ~0x7;
734

735 736 737 738 739 740 741 742 743
         else
            max_text = INT_MAX;

         /* Now allocate a new array and copy the old members in, this does all
          * the overflow checks.
          */
         new_text = png_voidcast(png_textp,png_realloc_array(png_ptr,
            info_ptr->text, old_num_text, max_text-old_num_text,
            sizeof *new_text));
A
Andreas Dilger 已提交
744
      }
745

746
      if (new_text == NULL)
A
Andreas Dilger 已提交
747
      {
748 749 750
         png_chunk_report(png_ptr, "too many text chunks",
            PNG_CHUNK_WRITE_ERROR);
         return 1;
A
Andreas Dilger 已提交
751
      }
752

753 754 755 756 757 758 759 760
      png_free(png_ptr, info_ptr->text);

      info_ptr->text = new_text;
      info_ptr->free_me |= PNG_FREE_TEXT;
      info_ptr->max_text = max_text;
      /* num_text is adjusted below as the entries are copied in */

      png_debug1(3, "allocated %d entries for info_ptr->text", max_text);
A
Andreas Dilger 已提交
761
   }
762

A
Andreas Dilger 已提交
763 764
   for (i = 0; i < num_text; i++)
   {
765 766
      size_t text_length, key_len;
      size_t lang_len, lang_key_len;
A
Andreas Dilger 已提交
767 768
      png_textp textp = &(info_ptr->text[info_ptr->num_text]);

769
      if (text_ptr[i].key == NULL)
770 771
          continue;

772 773
      if (text_ptr[i].compression < PNG_TEXT_COMPRESSION_NONE ||
          text_ptr[i].compression >= PNG_TEXT_COMPRESSION_LAST)
774
      {
775 776
         png_chunk_report(png_ptr, "text compression mode is out of range",
            PNG_CHUNK_WRITE_ERROR);
777 778 779
         continue;
      }

780
      key_len = strlen(text_ptr[i].key);
781

782
      if (text_ptr[i].compression <= 0)
783
      {
784 785
         lang_len = 0;
         lang_key_len = 0;
786
      }
787

788
      else
789
#  ifdef PNG_iTXt_SUPPORTED
790
      {
791
         /* Set iTXt data */
792

793
         if (text_ptr[i].lang != NULL)
794
            lang_len = strlen(text_ptr[i].lang);
795

796 797
         else
            lang_len = 0;
798

799
         if (text_ptr[i].lang_key != NULL)
800
            lang_key_len = strlen(text_ptr[i].lang_key);
801

802 803
         else
            lang_key_len = 0;
804
      }
805
#  else /* PNG_iTXt_SUPPORTED */
806
      {
807 808
         png_chunk_report(png_ptr, "iTXt chunk not supported",
            PNG_CHUNK_WRITE_ERROR);
809
         continue;
810
      }
811
#  endif
A
Andreas Dilger 已提交
812

813
      if (text_ptr[i].text == NULL || text_ptr[i].text[0] == '\0')
A
Andreas Dilger 已提交
814
      {
815
         text_length = 0;
816
#  ifdef PNG_iTXt_SUPPORTED
817
         if (text_ptr[i].compression > 0)
818
            textp->compression = PNG_ITXT_COMPRESSION_NONE;
819

820
         else
821
#  endif
822
            textp->compression = PNG_TEXT_COMPRESSION_NONE;
A
Andreas Dilger 已提交
823
      }
824

A
Andreas Dilger 已提交
825 826
      else
      {
827
         text_length = strlen(text_ptr[i].text);
A
Andreas Dilger 已提交
828 829
         textp->compression = text_ptr[i].compression;
      }
830

831 832
      textp->key = png_voidcast(png_charp,png_malloc_base(png_ptr,
          key_len + text_length + lang_len + lang_key_len + 4));
833

834
      if (textp->key == NULL)
835 836 837 838 839
      {
         png_chunk_report(png_ptr, "text chunk: out of memory",
               PNG_CHUNK_WRITE_ERROR);
         return 1;
      }
840

841
      png_debug2(2, "Allocated %lu bytes at %p in png_set_text",
842 843
          (unsigned long)(png_uint_32)
          (key_len + lang_len + lang_key_len + text_length + 4),
844
          textp->key);
845

846
      memcpy(textp->key, text_ptr[i].key, key_len);
847
      *(textp->key + key_len) = '\0';
848

849 850
      if (text_ptr[i].compression > 0)
      {
851
         textp->lang = textp->key + key_len + 1;
852
         memcpy(textp->lang, text_ptr[i].lang, lang_len);
853
         *(textp->lang + lang_len) = '\0';
854
         textp->lang_key = textp->lang + lang_len + 1;
855
         memcpy(textp->lang_key, text_ptr[i].lang_key, lang_key_len);
856
         *(textp->lang_key + lang_key_len) = '\0';
857
         textp->text = textp->lang_key + lang_key_len + 1;
858
      }
859

860 861
      else
      {
862 863
         textp->lang=NULL;
         textp->lang_key=NULL;
864
         textp->text = textp->key + key_len + 1;
865
      }
866

867
      if (text_length)
868
         memcpy(textp->text, text_ptr[i].text, text_length);
869

870
      *(textp->text + text_length) = '\0';
871

872
#  ifdef PNG_iTXt_SUPPORTED
873
      if (textp->compression > 0)
874 875 876 877
      {
         textp->text_length = 0;
         textp->itxt_length = text_length;
      }
878

879
      else
880
#  endif
881 882 883 884
      {
         textp->text_length = text_length;
         textp->itxt_length = 0;
      }
885

A
Andreas Dilger 已提交
886
      info_ptr->num_text++;
887
      png_debug1(3, "transferred text chunk %d", info_ptr->num_text);
A
Andreas Dilger 已提交
888
   }
889

890
   return(0);
A
Andreas Dilger 已提交
891 892 893
}
#endif

894
#ifdef PNG_tIME_SUPPORTED
895
void PNGAPI
896 897
png_set_tIME(png_const_structrp png_ptr, png_inforp info_ptr,
    png_const_timep mod_time)
A
Andreas Dilger 已提交
898
{
899
   png_debug1(1, "in %s storage function", "tIME");
900

901
   if (png_ptr == NULL || info_ptr == NULL || mod_time == NULL ||
902
       (png_ptr->mode & PNG_WROTE_tIME))
A
Andreas Dilger 已提交
903 904
      return;

905 906 907 908 909 910 911 912 913
   if (mod_time->month == 0   || mod_time->month > 12  ||
       mod_time->day   == 0   || mod_time->day   > 31  ||
       mod_time->hour  > 23   || mod_time->minute > 59 ||
       mod_time->second > 60)
   {
      png_warning(png_ptr, "Ignoring invalid time value");
      return;
   }

914
   info_ptr->mod_time = *mod_time;
A
Andreas Dilger 已提交
915 916 917 918
   info_ptr->valid |= PNG_INFO_tIME;
}
#endif

919
#ifdef PNG_tRNS_SUPPORTED
920
void PNGAPI
921
png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
922
    png_const_bytep trans_alpha, int num_trans, png_const_color_16p trans_color)
A
Andreas Dilger 已提交
923
{
924
   png_debug1(1, "in %s storage function", "tRNS");
925

926
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
927 928
      return;

929
   if (trans_alpha != NULL)
930
   {
931
       /* It may not actually be necessary to set png_ptr->trans_alpha here;
932 933
        * we do it for backward compatibility with the way the png_handle_tRNS
        * function used to do the allocation.
934 935 936 937
        *
        * 1.6.0: The above statement is incorrect; png_handle_tRNS effectively
        * relies on png_set_tRNS storing the information in png_struct
        * (otherwise it won't be there for the code in pngrtran.c).
938
        */
939

940
       png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
941

942
       /* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */
943 944
       png_ptr->trans_alpha = info_ptr->trans_alpha = png_voidcast(png_bytep,
         png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
945

946
       if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
947
          memcpy(info_ptr->trans_alpha, trans_alpha, (png_size_t)num_trans);
948
   }
A
Andreas Dilger 已提交
949

950
   if (trans_color != NULL)
A
Andreas Dilger 已提交
951
   {
952
      int sample_max = (1 << info_ptr->bit_depth);
953

954
      if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY &&
955
          trans_color->gray > sample_max) ||
956
          (info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
957 958 959
          (trans_color->red > sample_max ||
          trans_color->green > sample_max ||
          trans_color->blue > sample_max)))
960 961
         png_warning(png_ptr,
            "tRNS chunk has out-of-range samples for bit_depth");
962

963
      info_ptr->trans_color = *trans_color;
964

965
      if (num_trans == 0)
966
         num_trans = 1;
A
Andreas Dilger 已提交
967
   }
968

A
Andreas Dilger 已提交
969
   info_ptr->num_trans = (png_uint_16)num_trans;
970

971 972 973 974 975
   if (num_trans != 0)
   {
      info_ptr->valid |= PNG_INFO_tRNS;
      info_ptr->free_me |= PNG_FREE_TRNS;
   }
A
Andreas Dilger 已提交
976 977 978
}
#endif

979
#ifdef PNG_sPLT_SUPPORTED
980
void PNGAPI
981
png_set_sPLT(png_const_structrp png_ptr,
982
    png_inforp info_ptr, png_const_sPLT_tp entries, int nentries)
983 984 985 986
/*
 *  entries        - array of png_sPLT_t structures
 *                   to be added to the list of palettes
 *                   in the info structure.
987
 *
988 989 990
 *  nentries       - number of palette structures to be
 *                   added.
 */
991
{
992
   png_sPLT_tp np;
993

994
   if (png_ptr == NULL || info_ptr == NULL || nentries <= 0 || entries == NULL)
995
      return;
996

997 998 999 1000 1001 1002
   /* Use the internal realloc function, which checks for all the possible
    * overflows.  Notice that the parameters are (int) and (size_t)
    */
   np = png_voidcast(png_sPLT_tp,png_realloc_array(png_ptr,
      info_ptr->splt_palettes, info_ptr->splt_palettes_num, nentries,
      sizeof *np));
1003

1004 1005
   if (np == NULL)
   {
1006 1007
      /* Out of memory or too many chunks */
      png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR);
1008
      return;
1009
   }
1010

1011
   png_free(png_ptr, info_ptr->splt_palettes);
1012 1013
   info_ptr->splt_palettes = np;
   info_ptr->free_me |= PNG_FREE_SPLT;
1014

1015 1016 1017
   np += info_ptr->splt_palettes_num;

   do
1018
   {
1019
      png_size_t length;
1020

1021 1022
      /* Skip invalid input entries */
      if (entries->name == NULL || entries->entries == NULL)
1023
      {
1024 1025 1026
         /* png_handle_sPLT doesn't do this, so this is an app error */
         png_app_error(png_ptr, "png_set_sPLT: invalid sPLT");
         /* Just skip the invalid entry */
1027
         continue;
1028
      }
1029

1030 1031 1032 1033 1034 1035 1036 1037 1038 1039
      np->depth = entries->depth;

      /* In the even of out-of-memory just return - there's no point keeping on
       * trying to add sPLT chunks.
       */
      length = strlen(entries->name) + 1;
      np->name = png_voidcast(png_charp, png_malloc_base(png_ptr, length));

      if (np->name == NULL)
         break;
1040

1041 1042 1043 1044 1045 1046 1047 1048 1049 1050
      memcpy(np->name, entries->name, length);

      /* IMPORTANT: we have memory now that won't get freed if something else
       * goes wrong, this code must free it.  png_malloc_array produces no
       * warnings, use a png_chunk_report (below) if there is an error.
       */
      np->entries = png_voidcast(png_sPLT_entryp, png_malloc_array(png_ptr,
          entries->nentries, sizeof (png_sPLT_entry)));

      if (np->entries == NULL)
1051
      {
1052 1053
         png_free(png_ptr, np->name);
         break;
1054
      }
1055

1056 1057 1058 1059 1060 1061
      np->nentries = entries->nentries;
      /* This multiply can't overflow because png_malloc_array has already
       * checked it when doing the allocation.
       */
      memcpy(np->entries, entries->entries,
         entries->nentries * sizeof (png_sPLT_entry));
1062

1063 1064 1065 1066 1067 1068
      /* Note that 'continue' skips the advance of the out pointer and out
       * count, so an invalid entry is not added.
       */
      info_ptr->valid |= PNG_INFO_sPLT;
      ++(info_ptr->splt_palettes_num);
      ++np;
1069
   }
1070
   while (++entries, --nentries);
1071

1072 1073
   if (nentries > 0)
      png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
1074
}
1075
#endif /* PNG_sPLT_SUPPORTED */
1076

1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114
#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
static png_byte
check_location(png_const_structrp png_ptr, int location)
{
   location &= (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT);

   /* New in 1.6.0; copy the location and check it.  This is an API
    * change, previously the app had to use the
    * png_set_unknown_chunk_location API below for each chunk.
    */
   if (location == 0 && !(png_ptr->mode & PNG_IS_READ_STRUCT))
   {
      /* Write struct, so unknown chunks come from the app */
      png_app_warning(png_ptr,
         "png_set_unknown_chunks now expects a valid location");
      /* Use the old behavior */
      location = (png_byte)(png_ptr->mode &
         (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT));
   }

   /* This need not be an internal error - if the app calls
    * png_set_unknown_chunks on a read pointer it must get the location right.
    */
   if (location == 0)
      png_error(png_ptr, "invalid location in png_set_unknown_chunks");

   /* Now reduce the location to the top-most set bit by removing each least
    * significant bit in turn.
    */
   while (location != (location & -location))
      location &= ~(location & -location);

   /* The cast is safe because 'location' is a bit mask and only the low four
    * bits are significant.
    */
   return (png_byte)location;
}

1115
void PNGAPI
1116
png_set_unknown_chunks(png_const_structrp png_ptr,
1117
   png_inforp info_ptr, png_const_unknown_chunkp unknowns, int num_unknowns)
1118
{
1119 1120
   png_unknown_chunkp np;

1121 1122
   if (png_ptr == NULL || info_ptr == NULL || num_unknowns <= 0 ||
      unknowns == NULL)
1123
      return;
1124

1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155
   /* Check for the failure cases where support has been disabled at compile
    * time.  This code is hardly ever compiled - it's here because
    * STORE_UNKNOWN_CHUNKS is set by both read and write code (compiling in this
    * code) but may be meaningless if the read or write handling of unknown
    * chunks is not compiled in.
    */
#  if !defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED) && \
      defined(PNG_READ_SUPPORTED)
      if (png_ptr->mode & PNG_IS_READ_STRUCT)
      {
         png_app_error(png_ptr, "no unknown chunk support on read");
         return;
      }
#  endif
#  if !defined(PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED) && \
      defined(PNG_WRITE_SUPPORTED)
      if (!(png_ptr->mode & PNG_IS_READ_STRUCT))
      {
         png_app_error(png_ptr, "no unknown chunk support on write");
         return;
      }
#  endif

   /* Prior to 1.6.0 this code used png_malloc_warn; however, this meant that
    * unknown critical chunks could be lost with just a warning resulting in
    * undefined behavior.  Now png_chunk_report is used to provide behavior
    * appropriate to read or write.
    */
   np = png_voidcast(png_unknown_chunkp, png_realloc_array(png_ptr,
         info_ptr->unknown_chunks, info_ptr->unknown_chunks_num, num_unknowns,
         sizeof *np));
1156 1157 1158

   if (np == NULL)
   {
1159 1160
      png_chunk_report(png_ptr, "too many unknown chunks",
         PNG_CHUNK_WRITE_ERROR);
1161 1162 1163
      return;
   }

1164
   png_free(png_ptr, info_ptr->unknown_chunks);
1165 1166
   info_ptr->unknown_chunks = np; /* safe because it is initialized */
   info_ptr->free_me |= PNG_FREE_UNKN;
1167

1168
   np += info_ptr->unknown_chunks_num;
1169

1170 1171 1172 1173 1174 1175 1176 1177
   /* Increment unknown_chunks_num each time round the loop to protect the
    * just-allocated chunk data.
    */
   for (; num_unknowns > 0; --num_unknowns, ++unknowns)
   {
      memcpy(np->name, unknowns->name, (sizeof np->name));
      np->name[(sizeof np->name)-1] = '\0';
      np->location = check_location(png_ptr, unknowns->location);
1178

1179 1180 1181 1182 1183
      if (unknowns->size == 0)
      {
         np->data = NULL;
         np->size = 0;
      }
1184

1185 1186
      else
      {
1187 1188
         np->data = png_voidcast(png_bytep,
            png_malloc_base(png_ptr, unknowns->size));
1189

1190
         if (np->data == NULL)
1191
         {
1192 1193 1194 1195
            png_chunk_report(png_ptr, "unknown chunk: out of memory",
               PNG_CHUNK_WRITE_ERROR);
            /* But just skip storing the unknown chunk */
            continue;
1196 1197
         }

1198 1199
         memcpy(np->data, unknowns->data, unknowns->size);
         np->size = unknowns->size;
1200
      }
1201

1202 1203 1204 1205 1206 1207 1208
      /* These increments are skipped on out-of-memory for the data - the
       * unknown chunk entry gets overwritten if the png_chunk_report returns.
       * This is correct in the read case (the chunk is just dropped.)
       */
      ++np;
      ++(info_ptr->unknown_chunks_num);
   }
1209
}
1210

1211
void PNGAPI
1212
png_set_unknown_chunk_location(png_const_structrp png_ptr, png_inforp info_ptr,
1213
    int chunk, int location)
1214
{
1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236
   /* This API is pretty pointless in 1.6.0 because the location can be set
    * before the call to png_set_unknown_chunks.
    *
    * TODO: add a png_app_warning in 1.7
    */
   if (png_ptr != NULL && info_ptr != NULL && chunk >= 0 &&
      chunk < info_ptr->unknown_chunks_num)
   {
      if ((location & (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT)) == 0)
      {
         png_app_error(png_ptr, "invalid unknown chunk location");
         /* Fake out the pre 1.6.0 behavior: */
         if ((location & PNG_HAVE_IDAT)) /* undocumented! */
            location = PNG_AFTER_IDAT;

         else
            location = PNG_HAVE_IHDR; /* also undocumented */
      }

      info_ptr->unknown_chunks[chunk].location =
         check_location(png_ptr, location);
   }
1237
}
1238 1239
#endif

1240

1241
#ifdef PNG_MNG_FEATURES_SUPPORTED
1242
png_uint_32 PNGAPI
1243
png_permit_mng_features (png_structrp png_ptr, png_uint_32 mng_features)
1244
{
1245
   png_debug(1, "in png_permit_mng_features");
1246

1247
   if (png_ptr == NULL)
1248
      return 0;
1249

1250
   png_ptr->mng_features_permitted = mng_features & PNG_ALL_MNG_FEATURES;
1251

1252
   return png_ptr->mng_features_permitted;
1253 1254
}
#endif
1255

1256
#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280
static unsigned int
add_one_chunk(png_bytep list, unsigned int count, png_const_bytep add, int keep)
{
   unsigned int i;

   /* Utility function: update the 'keep' state of a chunk if it is already in
    * the list, otherwise add it to the list.
    */
   for (i=0; i<count; ++i, list += 5) if (memcmp(list, add, 4) == 0)
   {
      list[4] = (png_byte)keep;
      return count;
   }

   if (keep != PNG_HANDLE_CHUNK_AS_DEFAULT)
   {
      ++count;
      memcpy(list, add, 4);
      list[4] = (png_byte)keep;
   }

   return count;
}

1281 1282
void PNGAPI
png_set_keep_unknown_chunks(png_structrp png_ptr, int keep,
1283
    png_const_bytep chunk_list, int num_chunks_in)
1284
{
1285 1286 1287
   png_bytep new_list;
   unsigned int num_chunks, old_num_chunks;

1288 1289
   if (png_ptr == NULL)
      return;
1290

1291
   if (keep < 0 || keep >= PNG_HANDLE_CHUNK_LAST)
1292
   {
1293 1294 1295
      png_app_error(png_ptr, "png_set_keep_unknown_chunks: invalid keep");
      return;
   }
1296

1297 1298 1299
   if (num_chunks_in <= 0)
   {
      png_ptr->unknown_default = keep;
1300

1301 1302 1303 1304
      /* '0' means just set the flags, so stop here */
      if (num_chunks_in == 0)
        return;
   }
1305

1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333
   if (num_chunks_in < 0)
   {
      /* Ignore all unknown chunks and all chunks recognized by
       * libpng except for IHDR, PLTE, tRNS, IDAT, and IEND
       */
      static PNG_CONST png_byte chunks_to_ignore[] = {
         98,  75,  71,  68, '\0',  /* bKGD */
         99,  72,  82,  77, '\0',  /* cHRM */
        103,  65,  77,  65, '\0',  /* gAMA */
        104,  73,  83,  84, '\0',  /* hIST */
        105,  67,  67,  80, '\0',  /* iCCP */
        105,  84,  88, 116, '\0',  /* iTXt */
        111,  70,  70, 115, '\0',  /* oFFs */
        112,  67,  65,  76, '\0',  /* pCAL */
        112,  72,  89, 115, '\0',  /* pHYs */
        115,  66,  73,  84, '\0',  /* sBIT */
        115,  67,  65,  76, '\0',  /* sCAL */
        115,  80,  76,  84, '\0',  /* sPLT */
        115,  84,  69,  82, '\0',  /* sTER */
        115,  82,  71,  66, '\0',  /* sRGB */
        116,  69,  88, 116, '\0',  /* tEXt */
        116,  73,  77,  69, '\0',  /* tIME */
        122,  84,  88, 116, '\0'   /* zTXt */
      };

      chunk_list = chunks_to_ignore;
      num_chunks = (sizeof chunks_to_ignore)/5;
   }
1334

1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346
   else /* num_chunks_in > 0 */
   {
      if (chunk_list == NULL)
      {
         /* Prior to 1.6.0 this was silently ignored, now it is an app_error
          * which can be switched off.
          */
         png_app_error(png_ptr, "png_set_keep_unknown_chunks: no chunk list");
         return;
      }

      num_chunks = num_chunks_in;
1347 1348
   }

1349 1350 1351 1352 1353 1354 1355 1356 1357
   old_num_chunks = png_ptr->num_chunk_list;
   if (png_ptr->chunk_list == NULL)
      old_num_chunks = 0;

   /* Since num_chunks is always restricted to UINT_MAX/5 this can't overflow.
    */
   if (num_chunks + old_num_chunks > UINT_MAX/5)
   {
      png_app_error(png_ptr, "png_set_keep_unknown_chunks: too many chunks");
1358
      return;
1359
   }
1360

1361 1362 1363 1364 1365 1366 1367 1368
   /* If these chunks are being reset to the default then no more memory is
    * required because add_one_chunk above doesn't extend the list if the 'keep'
    * parameter is the default.
    */
   if (keep)
   {
      new_list = png_voidcast(png_bytep, png_malloc(png_ptr,
          5 * (num_chunks + old_num_chunks)));
1369

1370 1371 1372 1373 1374 1375
      if (old_num_chunks > 0)
         memcpy(new_list, png_ptr->chunk_list, 5*old_num_chunks);
   }

   else if (old_num_chunks > 0)
      new_list = png_ptr->chunk_list;
1376

1377 1378 1379 1380 1381 1382 1383 1384 1385
   else
      new_list = NULL;

   /* Add the new chunks together with each one's handling code.  If the chunk
    * already exists the code is updated, otherwise the chunk is added to the
    * end.  (In libpng 1.6.0 order no longer matters because this code enforces
    * the earlier convention that the last setting is the one that is used.)
    */
   if (new_list != NULL)
1386
   {
1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413
      png_const_bytep inlist;
      png_bytep outlist;
      unsigned int i;

      for (i=0; i<num_chunks; ++i)
         old_num_chunks = add_one_chunk(new_list, old_num_chunks,
            chunk_list+5*i, keep);

      /* Now remove any spurious 'default' entries. */
      num_chunks = 0;
      for (i=0, inlist=outlist=new_list; i<old_num_chunks; ++i, inlist += 5)
         if (inlist[4])
         {
            if (outlist != inlist)
               memcpy(outlist, inlist, 5);
            outlist += 5;
            ++num_chunks;
         }

      /* This means the application has removed all the specialized handling. */
      if (num_chunks == 0)
      {
         if (png_ptr->chunk_list != new_list)
            png_free(png_ptr, new_list);

         new_list = NULL;
      }
1414
   }
1415

1416 1417 1418 1419
   else
      num_chunks = 0;

   png_ptr->num_chunk_list = num_chunks;
1420

1421 1422 1423 1424
   if (png_ptr->chunk_list != new_list)
   {
      if (png_ptr->chunk_list != NULL)
         png_free(png_ptr, png_ptr->chunk_list);
1425

1426 1427
      png_ptr->chunk_list = new_list;
   }
1428 1429
}
#endif
1430

1431
#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
1432
void PNGAPI
1433
png_set_read_user_chunk_fn(png_structrp png_ptr, png_voidp user_chunk_ptr,
1434
    png_user_chunk_ptr read_user_chunk_fn)
1435
{
1436
   png_debug(1, "in png_set_read_user_chunk_fn");
1437

1438 1439
   if (png_ptr == NULL)
      return;
1440

1441 1442 1443 1444
   png_ptr->read_user_chunk_fn = read_user_chunk_fn;
   png_ptr->user_chunk_ptr = user_chunk_ptr;
}
#endif
1445

1446
#ifdef PNG_INFO_IMAGE_SUPPORTED
1447
void PNGAPI
1448 1449
png_set_rows(png_const_structrp png_ptr, png_inforp info_ptr,
    png_bytepp row_pointers)
1450
{
1451
   png_debug1(1, "in %s storage function", "rows");
1452

1453 1454 1455
   if (png_ptr == NULL || info_ptr == NULL)
      return;

1456
   if (info_ptr->row_pointers && (info_ptr->row_pointers != row_pointers))
1457
      png_free_data(png_ptr, info_ptr, PNG_FREE_ROWS, 0);
1458

1459
   info_ptr->row_pointers = row_pointers;
1460

1461
   if (row_pointers)
1462
      info_ptr->valid |= PNG_INFO_IDAT;
1463 1464 1465
}
#endif

1466
void PNGAPI
1467
png_set_compression_buffer_size(png_structrp png_ptr, png_size_t size)
1468
{
1469 1470
    if (png_ptr == NULL)
       return;
1471

1472 1473
    if (size == 0 || size > PNG_UINT_31_MAX)
       png_error(png_ptr, "invalid compression buffer size");
1474

1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491
#  ifdef PNG_SEQUENTIAL_READ_SUPPORTED
      if (png_ptr->mode & PNG_IS_READ_STRUCT)
      {
         png_ptr->IDAT_read_size = (png_uint_32)size; /* checked above */
         return;
      }
#  endif

#  ifdef PNG_WRITE_SUPPORTED
      if (!(png_ptr->mode & PNG_IS_READ_STRUCT))
      {
         if (png_ptr->zowner != 0)
         {
            png_warning(png_ptr,
              "Compression buffer size cannot be changed because it is in use");
            return;
         }
1492

1493 1494 1495 1496 1497 1498
         if (size > ZLIB_IO_MAX)
         {
            png_warning(png_ptr,
               "Compression buffer size limited to system maximum");
            size = ZLIB_IO_MAX; /* must fit */
         }
1499

1500 1501 1502 1503 1504 1505 1506 1507 1508
         else if (size < 6)
         {
            /* Deflate will potentially go into an infinite loop on a SYNC_FLUSH
             * if this is permitted.
             */
            png_warning(png_ptr,
               "Compression buffer size cannot be reduced below 6");
            return;
         }
1509

1510 1511 1512 1513 1514 1515 1516
         if (png_ptr->zbuffer_size != size)
         {
            png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list);
            png_ptr->zbuffer_size = (uInt)size;
         }
      }
#  endif
1517
}
1518 1519

void PNGAPI
1520
png_set_invalid(png_const_structrp png_ptr, png_inforp info_ptr, int mask)
1521 1522
{
   if (png_ptr && info_ptr)
1523
      info_ptr->valid &= ~mask;
1524
}
1525

1526

1527
#ifdef PNG_SET_USER_LIMITS_SUPPORTED
1528
/* This function was added to libpng 1.2.6 */
1529
void PNGAPI
1530
png_set_user_limits (png_structrp png_ptr, png_uint_32 user_width_max,
1531 1532
    png_uint_32 user_height_max)
{
1533 1534 1535 1536 1537 1538
   /* Images with dimensions larger than these limits will be
    * rejected by png_set_IHDR().  To accept any PNG datastream
    * regardless of dimensions, set both limits to 0x7ffffffL.
    */
   if (png_ptr == NULL)
      return;
1539

1540 1541
   png_ptr->user_width_max = user_width_max;
   png_ptr->user_height_max = user_height_max;
1542
}
1543

1544
/* This function was added to libpng 1.4.0 */
1545
void PNGAPI
1546
png_set_chunk_cache_max (png_structrp png_ptr, png_uint_32 user_chunk_cache_max)
1547
{
1548
    if (png_ptr)
1549
       png_ptr->user_chunk_cache_max = user_chunk_cache_max;
1550 1551 1552 1553
}

/* This function was added to libpng 1.4.1 */
void PNGAPI
1554
png_set_chunk_malloc_max (png_structrp png_ptr,
1555
    png_alloc_size_t user_chunk_malloc_max)
1556
{
1557 1558
   if (png_ptr)
      png_ptr->user_chunk_malloc_max = user_chunk_malloc_max;
1559
}
1560 1561
#endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */

1562

1563
#ifdef PNG_BENIGN_ERRORS_SUPPORTED
1564
void PNGAPI
1565
png_set_benign_errors(png_structrp png_ptr, int allowed)
1566
{
1567
   png_debug(1, "in png_set_benign_errors");
1568

1569 1570 1571 1572 1573 1574
   /* If allowed is 1, png_benign_error() is treated as a warning.
    *
    * If allowed is 0, png_benign_error() is treated as an error (which
    * is the default behavior if png_set_benign_errors() is not called).
    */

1575
   if (allowed)
1576 1577
      png_ptr->flags |= PNG_FLAG_BENIGN_ERRORS_WARN |
         PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN;
1578

1579
   else
1580 1581
      png_ptr->flags &= ~(PNG_FLAG_BENIGN_ERRORS_WARN |
         PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN);
1582 1583
}
#endif /* PNG_BENIGN_ERRORS_SUPPORTED */
1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605

#ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
   /* Whether to report invalid palette index; added at libng-1.5.10.
    * It is possible for an indexed (color-type==3) PNG file to contain
    * pixels with invalid (out-of-range) indexes if the PLTE chunk has
    * fewer entries than the image's bit-depth would allow. We recover
    * from this gracefully by filling any incomplete palette with zeroes
    * (opaque black).  By default, when this occurs libpng will issue
    * a benign error.  This API can be used to override that behavior.
    */
void PNGAPI
png_set_check_for_invalid_index(png_structrp png_ptr, int allowed)
{
   png_debug(1, "in png_set_check_for_invalid_index");

   if (allowed > 0)
      png_ptr->num_palette_max = 0;

   else
      png_ptr->num_palette_max = -1;
}
#endif
1606
#endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */