pngwutil.c 78.5 KB
Newer Older
G
Guy Schalnat 已提交
1

A
Andreas Dilger 已提交
2
/* pngwutil.c - utilities to write a PNG file
3
 *
4
 * Last changed in libpng 1.6.26 [October 20, 2016]
5
 * Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson
6 7
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
8
 *
9
 * This code is released under the libpng license.
10
 * For conditions of distribution and use, see the disclaimer
11
 * and license in png.h
12
 */
A
Andreas Dilger 已提交
13

14
#include "pngpriv.h"
G
Guy Schalnat 已提交
15

16 17
#ifdef PNG_WRITE_SUPPORTED

18
#ifdef PNG_WRITE_INT_FUNCTIONS_SUPPORTED
A
Andreas Dilger 已提交
19 20 21 22
/* Place a 32-bit number into a buffer in PNG byte order.  We work
 * with unsigned numbers for convenience, although one supported
 * ancillary chunk uses signed (two's complement) numbers.
 */
23
void PNGAPI
G
Guy Schalnat 已提交
24
png_save_uint_32(png_bytep buf, png_uint_32 i)
G
Guy Schalnat 已提交
25
{
26 27 28 29
   buf[0] = (png_byte)((i >> 24) & 0xffU);
   buf[1] = (png_byte)((i >> 16) & 0xffU);
   buf[2] = (png_byte)((i >>  8) & 0xffU);
   buf[3] = (png_byte)( i        & 0xffU);
G
Guy Schalnat 已提交
30 31
}

32 33 34 35
/* Place a 16-bit number into a buffer in PNG byte order.
 * The parameter is declared unsigned int, not png_uint_16,
 * just to avoid potential problems on pre-ANSI C compilers.
 */
36
void PNGAPI
37
png_save_uint_16(png_bytep buf, unsigned int i)
G
Guy Schalnat 已提交
38
{
39 40
   buf[0] = (png_byte)((i >> 8) & 0xffU);
   buf[1] = (png_byte)( i       & 0xffU);
G
Guy Schalnat 已提交
41
}
42
#endif
G
Guy Schalnat 已提交
43

44 45 46 47 48 49
/* Simple function to write the signature.  If we have already written
 * the magic bytes of the signature, or more likely, the PNG stream is
 * being embedded into another stream and doesn't need its own signature,
 * we should call png_set_sig_bytes() to tell libpng how many of the
 * bytes have already been written.
 */
50
void PNGAPI
51
png_write_sig(png_structrp png_ptr)
52 53
{
   png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
54

55 56 57 58 59
#ifdef PNG_IO_STATE_SUPPORTED
   /* Inform the I/O callback that the signature is being written */
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_SIGNATURE;
#endif

60
   /* Write the rest of the 8 byte signature */
61
   png_write_data(png_ptr, &png_signature[png_ptr->sig_bytes],
62
       (png_size_t)(8 - png_ptr->sig_bytes));
63

64
   if (png_ptr->sig_bytes < 3)
65 66 67
      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
}

A
Andreas Dilger 已提交
68
/* Write the start of a PNG chunk.  The type is the chunk type.
69 70 71
 * The total_length is the sum of the lengths of all the data you will be
 * passing in png_write_chunk_data().
 */
72
static void
73
png_write_chunk_header(png_structrp png_ptr, png_uint_32 chunk_name,
74
    png_uint_32 length)
G
Guy Schalnat 已提交
75
{
76 77
   png_byte buf[8];

78
#if defined(PNG_DEBUG) && (PNG_DEBUG > 0)
79 80 81
   PNG_CSTRING_FROM_CHUNK(buf, chunk_name);
   png_debug2(0, "Writing %s chunk, length = %lu", buf, (unsigned long)length);
#endif
82 83 84 85

   if (png_ptr == NULL)
      return;

86 87 88 89 90 91 92
#ifdef PNG_IO_STATE_SUPPORTED
   /* Inform the I/O callback that the chunk header is being written.
    * PNG_IO_CHUNK_HDR requires a single I/O call.
    */
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_HDR;
#endif

93
   /* Write the length and the chunk name */
A
Andreas Dilger 已提交
94
   png_save_uint_32(buf, length);
95 96
   png_save_uint_32(buf + 4, chunk_name);
   png_write_data(png_ptr, buf, 8);
97

98
   /* Put the chunk name into png_ptr->chunk_name */
99
   png_ptr->chunk_name = chunk_name;
100

101
   /* Reset the crc and run it over the chunk name */
G
Guy Schalnat 已提交
102
   png_reset_crc(png_ptr);
103

104
   png_calculate_crc(png_ptr, buf + 4, 4);
105 106 107 108 109 110 111

#ifdef PNG_IO_STATE_SUPPORTED
   /* Inform the I/O callback that chunk data will (possibly) be written.
    * PNG_IO_CHUNK_DATA does NOT require a specific number of I/O calls.
    */
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_DATA;
#endif
G
Guy Schalnat 已提交
112 113
}

114
void PNGAPI
115
png_write_chunk_start(png_structrp png_ptr, png_const_bytep chunk_string,
116 117 118 119 120 121
    png_uint_32 length)
{
   png_write_chunk_header(png_ptr, PNG_CHUNK_FROM_STRING(chunk_string), length);
}

/* Write the data of a PNG chunk started with png_write_chunk_header().
122 123
 * Note that multiple calls to this function are allowed, and that the
 * sum of the lengths from these calls *must* add up to the total_length
124
 * given to png_write_chunk_header().
125
 */
126
void PNGAPI
127
png_write_chunk_data(png_structrp png_ptr, png_const_bytep data,
128
    png_size_t length)
G
Guy Schalnat 已提交
129
{
130 131 132
   /* Write the data, and run the CRC over it */
   if (png_ptr == NULL)
      return;
133

A
Andreas Dilger 已提交
134
   if (data != NULL && length > 0)
G
Guy Schalnat 已提交
135
   {
G
Guy Schalnat 已提交
136
      png_write_data(png_ptr, data, length);
137

138
      /* Update the CRC after writing the data,
139
       * in case the user I/O routine alters it.
140 141
       */
      png_calculate_crc(png_ptr, data, length);
G
Guy Schalnat 已提交
142 143 144
   }
}

145
/* Finish a chunk started with png_write_chunk_header(). */
146
void PNGAPI
147
png_write_chunk_end(png_structrp png_ptr)
G
Guy Schalnat 已提交
148
{
A
Andreas Dilger 已提交
149 150
   png_byte buf[4];

151 152
   if (png_ptr == NULL) return;

153 154 155 156 157 158 159
#ifdef PNG_IO_STATE_SUPPORTED
   /* Inform the I/O callback that the chunk CRC is being written.
    * PNG_IO_CHUNK_CRC requires a single I/O function call.
    */
   png_ptr->io_state = PNG_IO_WRITING | PNG_IO_CHUNK_CRC;
#endif

160
   /* Write the crc in a single operation */
A
Andreas Dilger 已提交
161 162
   png_save_uint_32(buf, png_ptr->crc);

163
   png_write_data(png_ptr, buf, (png_size_t)4);
G
Guy Schalnat 已提交
164 165
}

166 167 168 169 170 171 172 173 174 175
/* Write a PNG chunk all at once.  The type is an array of ASCII characters
 * representing the chunk name.  The array must be at least 4 bytes in
 * length, and does not need to be null terminated.  To be safe, pass the
 * pre-defined chunk names here, and if you need a new one, define it
 * where the others are defined.  The length is the length of the data.
 * All the data must be present.  If that is not possible, use the
 * png_write_chunk_start(), png_write_chunk_data(), and png_write_chunk_end()
 * functions instead.
 */
static void
176
png_write_complete_chunk(png_structrp png_ptr, png_uint_32 chunk_name,
177
    png_const_bytep data, png_size_t length)
178 179 180 181
{
   if (png_ptr == NULL)
      return;

182
   /* On 64-bit architectures 'length' may not fit in a png_uint_32. */
183
   if (length > PNG_UINT_31_MAX)
184
      png_error(png_ptr, "length exceeds PNG maximum");
185 186 187 188 189 190 191 192

   png_write_chunk_header(png_ptr, chunk_name, (png_uint_32)length);
   png_write_chunk_data(png_ptr, data, length);
   png_write_chunk_end(png_ptr);
}

/* This is the API that calls the internal function above. */
void PNGAPI
193
png_write_chunk(png_structrp png_ptr, png_const_bytep chunk_string,
194
    png_const_bytep data, png_size_t length)
195 196
{
   png_write_complete_chunk(png_ptr, PNG_CHUNK_FROM_STRING(chunk_string), data,
197
       length);
198 199
}

200 201 202 203 204 205
/* This is used below to find the size of an image to pass to png_deflate_claim,
 * so it only needs to be accurate if the size is less than 16384 bytes (the
 * point at which a lower LZ window size can be used.)
 */
static png_alloc_size_t
png_image_size(png_structrp png_ptr)
206
{
207
   /* Only return sizes up to the maximum of a png_uint_32; do this by limiting
208 209 210 211 212
    * the width and height used to 15 bits.
    */
   png_uint_32 h = png_ptr->height;

   if (png_ptr->rowbytes < 32768 && h < 32768)
213
   {
214
      if (png_ptr->interlaced != 0)
215
      {
216 217 218 219 220 221 222
         /* Interlacing makes the image larger because of the replication of
          * both the filter byte and the padding to a byte boundary.
          */
         png_uint_32 w = png_ptr->width;
         unsigned int pd = png_ptr->pixel_depth;
         png_alloc_size_t cb_base;
         int pass;
223

224
         for (cb_base=0, pass=0; pass<=6; ++pass)
225
         {
226
            png_uint_32 pw = PNG_PASS_COLS(w, pass);
227

228 229
            if (pw > 0)
               cb_base += (PNG_ROWBYTES(pd, pw)+1) * PNG_PASS_ROWS(h, pass);
230 231
         }

232 233
         return cb_base;
      }
234

235 236 237
      else
         return (png_ptr->rowbytes+1) * h;
   }
238

239
   else
240
      return 0xffffffffU;
241
}
242

243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
   /* This is the code to hack the first two bytes of the deflate stream (the
    * deflate header) to correct the windowBits value to match the actual data
    * size.  Note that the second argument is the *uncompressed* size but the
    * first argument is the *compressed* data (and it must be deflate
    * compressed.)
    */
static void
optimize_cmf(png_bytep data, png_alloc_size_t data_size)
{
   /* Optimize the CMF field in the zlib stream.  The resultant zlib stream is
    * still compliant to the stream specification.
    */
   if (data_size <= 16384) /* else windowBits must be 15 */
   {
      unsigned int z_cmf = data[0];  /* zlib compression method and flags */
259

260 261 262 263
      if ((z_cmf & 0x0f) == 8 && (z_cmf & 0xf0) <= 0x70)
      {
         unsigned int z_cinfo;
         unsigned int half_z_window_size;
264

265 266
         z_cinfo = z_cmf >> 4;
         half_z_window_size = 1U << (z_cinfo + 7);
267

268 269 270 271 272 273 274 275
         if (data_size <= half_z_window_size) /* else no change */
         {
            unsigned int tmp;

            do
            {
               half_z_window_size >>= 1;
               --z_cinfo;
276
            }
277
            while (z_cinfo > 0 && data_size <= half_z_window_size);
278

279 280
            z_cmf = (z_cmf & 0x0f) | (z_cinfo << 4);

281
            data[0] = (png_byte)z_cmf;
282 283
            tmp = data[1] & 0xe0;
            tmp += 0x1f - ((z_cmf << 8) + tmp) % 0x1f;
284
            data[1] = (png_byte)tmp;
285 286
         }
      }
287 288
   }
}
289
#endif /* WRITE_OPTIMIZE_CMF */
290

291 292 293
/* Initialize the compressor for the appropriate type of compression. */
static int
png_deflate_claim(png_structrp png_ptr, png_uint_32 owner,
294
    png_alloc_size_t data_size)
295
{
296
   if (png_ptr->zowner != 0)
297
   {
298
#if defined(PNG_WARNINGS_SUPPORTED) || defined(PNG_ERROR_TEXT_SUPPORTED)
299
      char msg[64];
300

301 302 303 304 305 306 307 308 309
      PNG_STRING_FROM_CHUNK(msg, owner);
      msg[4] = ':';
      msg[5] = ' ';
      PNG_STRING_FROM_CHUNK(msg+6, png_ptr->zowner);
      /* So the message that results is "<chunk> using zstream"; this is an
       * internal error, but is very useful for debugging.  i18n requirements
       * are minimal.
       */
      (void)png_safecat(msg, (sizeof msg), 10, " using zstream");
310
#endif
311
#if PNG_RELEASE_BUILD
312 313 314 315 316 317 318 319 320 321
         png_warning(png_ptr, msg);

         /* Attempt sane error recovery */
         if (png_ptr->zowner == png_IDAT) /* don't steal from IDAT */
         {
            png_ptr->zstream.msg = PNGZ_MSG_CAST("in use by IDAT");
            return Z_STREAM_ERROR;
         }

         png_ptr->zowner = 0;
322
#else
323
         png_error(png_ptr, msg);
324
#endif
325 326 327 328 329 330 331 332 333
   }

   {
      int level = png_ptr->zlib_level;
      int method = png_ptr->zlib_method;
      int windowBits = png_ptr->zlib_window_bits;
      int memLevel = png_ptr->zlib_mem_level;
      int strategy; /* set below */
      int ret; /* zlib return code */
334

335
      if (owner == png_IDAT)
336
      {
337
         if ((png_ptr->flags & PNG_FLAG_ZLIB_CUSTOM_STRATEGY) != 0)
338
            strategy = png_ptr->zlib_strategy;
339

340 341
         else if (png_ptr->do_filter != PNG_FILTER_NONE)
            strategy = PNG_Z_DEFAULT_STRATEGY;
342

343 344 345
         else
            strategy = PNG_Z_DEFAULT_NOFILTER_STRATEGY;
      }
346

347 348
      else
      {
349
#ifdef PNG_WRITE_CUSTOMIZE_ZTXT_COMPRESSION_SUPPORTED
350 351 352 353 354
            level = png_ptr->zlib_text_level;
            method = png_ptr->zlib_text_method;
            windowBits = png_ptr->zlib_text_window_bits;
            memLevel = png_ptr->zlib_text_mem_level;
            strategy = png_ptr->zlib_text_strategy;
355
#else
356 357 358 359 360 361
            /* If customization is not supported the values all come from the
             * IDAT values except for the strategy, which is fixed to the
             * default.  (This is the pre-1.6.0 behavior too, although it was
             * implemented in a very different way.)
             */
            strategy = Z_DEFAULT_STRATEGY;
362
#endif
363
      }
364

365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384
      /* Adjust 'windowBits' down if larger than 'data_size'; to stop this
       * happening just pass 32768 as the data_size parameter.  Notice that zlib
       * requires an extra 262 bytes in the window in addition to the data to be
       * able to see the whole of the data, so if data_size+262 takes us to the
       * next windowBits size we need to fix up the value later.  (Because even
       * though deflate needs the extra window, inflate does not!)
       */
      if (data_size <= 16384)
      {
         /* IMPLEMENTATION NOTE: this 'half_window_size' stuff is only here to
          * work round a Microsoft Visual C misbehavior which, contrary to C-90,
          * widens the result of the following shift to 64-bits if (and,
          * apparently, only if) it is used in a test.
          */
         unsigned int half_window_size = 1U << (windowBits-1);

         while (data_size + 262 <= half_window_size)
         {
            half_window_size >>= 1;
            --windowBits;
385
         }
386
      }
387

388
      /* Check against the previous initialized values, if any. */
389
      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0 &&
390 391 392 393 394 395 396 397
         (png_ptr->zlib_set_level != level ||
         png_ptr->zlib_set_method != method ||
         png_ptr->zlib_set_window_bits != windowBits ||
         png_ptr->zlib_set_mem_level != memLevel ||
         png_ptr->zlib_set_strategy != strategy))
      {
         if (deflateEnd(&png_ptr->zstream) != Z_OK)
            png_warning(png_ptr, "deflateEnd failed (ignored)");
398

399 400
         png_ptr->flags &= ~PNG_FLAG_ZSTREAM_INITIALIZED;
      }
401

402 403 404 405 406 407 408
      /* For safety clear out the input and output pointers (currently zlib
       * doesn't use them on Init, but it might in the future).
       */
      png_ptr->zstream.next_in = NULL;
      png_ptr->zstream.avail_in = 0;
      png_ptr->zstream.next_out = NULL;
      png_ptr->zstream.avail_out = 0;
409

410
      /* Now initialize if required, setting the new parameters, otherwise just
411
       * do a simple reset to the previous parameters.
412
       */
413
      if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
414 415 416 417 418
         ret = deflateReset(&png_ptr->zstream);

      else
      {
         ret = deflateInit2(&png_ptr->zstream, level, method, windowBits,
419
             memLevel, strategy);
420 421 422

         if (ret == Z_OK)
            png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED;
423
      }
424 425 426 427 428 429 430 431 432 433 434

      /* The return code is from either deflateReset or deflateInit2; they have
       * pretty much the same set of error codes.
       */
      if (ret == Z_OK)
         png_ptr->zowner = owner;

      else
         png_zstream_error(png_ptr, ret);

      return ret;
435
   }
436
}
437

438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456
/* Clean up (or trim) a linked list of compression buffers. */
void /* PRIVATE */
png_free_buffer_list(png_structrp png_ptr, png_compression_bufferp *listp)
{
   png_compression_bufferp list = *listp;

   if (list != NULL)
   {
      *listp = NULL;

      do
      {
         png_compression_bufferp next = list->next;

         png_free(png_ptr, list);
         list = next;
      }
      while (list != NULL);
   }
457 458
}

459
#ifdef PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
460
/* This pair of functions encapsulates the operation of (a) compressing a
461 462
 * text string, and (b) issuing it later as a series of chunk data writes.
 * The compression_state structure is shared context for these functions
463 464 465 466 467 468
 * set up by the caller to allow access to the relevant local variables.
 *
 * compression_buffer (new in 1.6.0) is just a linked list of zbuffer_size
 * temporary buffers.  From 1.6.0 it is retained in png_struct so that it will
 * be correctly freed in the event of a write error (previous implementations
 * just leaked memory.)
469 470 471
 */
typedef struct
{
472 473 474 475
   png_const_bytep      input;        /* The uncompressed input data */
   png_alloc_size_t     input_len;    /* Its length */
   png_uint_32          output_len;   /* Final compressed length */
   png_byte             output[1024]; /* First block of output */
476 477
} compression_state;

478 479
static void
png_text_compress_init(compression_state *comp, png_const_bytep input,
480
    png_alloc_size_t input_len)
481
{
482 483 484 485
   comp->input = input;
   comp->input_len = input_len;
   comp->output_len = 0;
}
486

487 488 489
/* Compress the data in the compression state input */
static int
png_text_compress(png_structrp png_ptr, png_uint_32 chunk_name,
490
    compression_state *comp, png_uint_32 prefix_len)
491 492
{
   int ret;
493

494
   /* To find the length of the output it is necessary to first compress the
495
    * input. The result is buffered rather than using the two-pass algorithm
496 497
    * that is used on the inflate side; deflate is assumed to be slower and a
    * PNG writer is assumed to have more memory available than a PNG reader.
498
    *
499 500 501 502
    * IMPLEMENTATION NOTE: the zlib API deflateBound() can be used to find an
    * upper limit on the output size, but it is always bigger than the input
    * size so it is likely to be more efficient to use this linked-list
    * approach.
503
    */
504
   ret = png_deflate_claim(png_ptr, chunk_name, comp->input_len);
505

506 507
   if (ret != Z_OK)
      return ret;
508

509 510 511 512 513 514
   /* Set up the compression buffers, we need a loop here to avoid overflowing a
    * uInt.  Use ZLIB_IO_MAX to limit the input.  The output is always limited
    * by the output buffer size, so there is no need to check that.  Since this
    * is ANSI-C we know that an 'int', hence a uInt, is always at least 16 bits
    * in size.
    */
515
   {
516 517 518
      png_compression_bufferp *end = &png_ptr->zbuffer_list;
      png_alloc_size_t input_len = comp->input_len; /* may be zero! */
      png_uint_32 output_len;
519

520 521 522 523 524
      /* zlib updates these for us: */
      png_ptr->zstream.next_in = PNGZ_INPUT_CAST(comp->input);
      png_ptr->zstream.avail_in = 0; /* Set below */
      png_ptr->zstream.next_out = comp->output;
      png_ptr->zstream.avail_out = (sizeof comp->output);
525

526
      output_len = png_ptr->zstream.avail_out;
527

528
      do
529
      {
530
         uInt avail_in = ZLIB_IO_MAX;
531

532 533
         if (avail_in > input_len)
            avail_in = (uInt)input_len;
534

535
         input_len -= avail_in;
536

537
         png_ptr->zstream.avail_in = avail_in;
538

539 540 541
         if (png_ptr->zstream.avail_out == 0)
         {
            png_compression_buffer *next;
542

543 544 545 546 547 548 549
            /* Chunk data is limited to 2^31 bytes in length, so the prefix
             * length must be counted here.
             */
            if (output_len + prefix_len > PNG_UINT_31_MAX)
            {
               ret = Z_MEM_ERROR;
               break;
550 551
            }

552 553 554 555 556
            /* Need a new (malloc'ed) buffer, but there may be one present
             * already.
             */
            next = *end;
            if (next == NULL)
557
            {
558 559
               next = png_voidcast(png_compression_bufferp, png_malloc_base
                  (png_ptr, PNG_COMPRESSION_BUFFER_SIZE(png_ptr)));
560

561
               if (next == NULL)
562
               {
563 564
                  ret = Z_MEM_ERROR;
                  break;
565 566
               }

567 568 569
               /* Link in this buffer (so that it will be freed later) */
               next->next = NULL;
               *end = next;
570 571
            }

572 573 574
            png_ptr->zstream.next_out = next->output;
            png_ptr->zstream.avail_out = png_ptr->zbuffer_size;
            output_len += png_ptr->zstream.avail_out;
575

576 577 578
            /* Move 'end' to the next buffer pointer. */
            end = &next->next;
         }
579

580 581
         /* Compress the data */
         ret = deflate(&png_ptr->zstream,
582
             input_len > 0 ? Z_NO_FLUSH : Z_FINISH);
583

584 585 586 587 588
         /* Claw back input data that was not consumed (because avail_in is
          * reset above every time round the loop).
          */
         input_len += png_ptr->zstream.avail_in;
         png_ptr->zstream.avail_in = 0; /* safety */
589
      }
590
      while (ret == Z_OK);
591

592
      /* There may be some space left in the last output buffer. This needs to
593 594 595 596 597 598 599 600 601 602 603 604 605 606
       * be subtracted from output_len.
       */
      output_len -= png_ptr->zstream.avail_out;
      png_ptr->zstream.avail_out = 0; /* safety */
      comp->output_len = output_len;

      /* Now double check the output length, put in a custom message if it is
       * too long.  Otherwise ensure the z_stream::msg pointer is set to
       * something.
       */
      if (output_len + prefix_len >= PNG_UINT_31_MAX)
      {
         png_ptr->zstream.msg = PNGZ_MSG_CAST("compressed data too long");
         ret = Z_MEM_ERROR;
607 608
      }

609 610
      else
         png_zstream_error(png_ptr, ret);
611

612 613
      /* Reset zlib for another zTXt/iTXt or image data */
      png_ptr->zowner = 0;
614

615
      /* The only success case is Z_STREAM_END, input_len must be 0; if not this
616 617 618 619
       * is an internal error.
       */
      if (ret == Z_STREAM_END && input_len == 0)
      {
620
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
621 622
         /* Fix up the deflate header, if required */
         optimize_cmf(comp->output, comp->input_len);
623
#endif
624 625 626 627 628 629 630 631 632 633
         /* But Z_OK is returned, not Z_STREAM_END; this allows the claim
          * function above to return Z_STREAM_END on an error (though it never
          * does in the current versions of zlib.)
          */
         return Z_OK;
      }

      else
         return ret;
   }
634 635
}

636
/* Ship the compressed text out via chunk writes */
637
static void
638
png_write_compressed_data_out(png_structrp png_ptr, compression_state *comp)
639
{
640 641 642 643
   png_uint_32 output_len = comp->output_len;
   png_const_bytep output = comp->output;
   png_uint_32 avail = (sizeof comp->output);
   png_compression_buffer *next = png_ptr->zbuffer_list;
644

645
   for (;;)
646
   {
647 648
      if (avail > output_len)
         avail = output_len;
649

650
      png_write_chunk_data(png_ptr, output, avail);
651

652
      output_len -= avail;
653

654 655
      if (output_len == 0 || next == NULL)
         break;
656

657 658 659 660
      avail = png_ptr->zbuffer_size;
      output = next->output;
      next = next->next;
   }
661

662 663 664 665
   /* This is an internal error; 'next' must have been NULL! */
   if (output_len > 0)
      png_error(png_ptr, "error writing ancillary chunked compressed data");
}
666
#endif /* WRITE_COMPRESSED_TEXT */
667

G
Guy Schalnat 已提交
668
/* Write the IHDR chunk, and update the png_struct with the necessary
669 670 671
 * information.  Note that the rest of this code depends upon this
 * information being correct.
 */
672
void /* PRIVATE */
673
png_write_IHDR(png_structrp png_ptr, png_uint_32 width, png_uint_32 height,
674 675
    int bit_depth, int color_type, int compression_type, int filter_type,
    int interlace_type)
G
Guy Schalnat 已提交
676
{
677
   png_byte buf[13]; /* Buffer to store the IHDR info */
G
Guy Schalnat 已提交
678

679
   png_debug(1, "in png_write_IHDR");
680 681
   
   int is_invalid_depth;
682

G
Guy Schalnat 已提交
683
   /* Check that we have valid input data from the application info */
G
Guy Schalnat 已提交
684 685
   switch (color_type)
   {
A
Andreas Dilger 已提交
686
      case PNG_COLOR_TYPE_GRAY:
G
Guy Schalnat 已提交
687 688 689 690 691 692
         switch (bit_depth)
         {
            case 1:
            case 2:
            case 4:
            case 8:
693
#ifdef PNG_WRITE_16BIT_SUPPORTED
694
            case 16:
695
#endif
696
               png_ptr->channels = 1; break;
697

698 699 700
            default:
               png_error(png_ptr,
                   "Invalid bit depth for grayscale image");
G
Guy Schalnat 已提交
701
         }
G
Guy Schalnat 已提交
702
         break;
703

A
Andreas Dilger 已提交
704
      case PNG_COLOR_TYPE_RGB:
705
         is_invalid_depth = (bit_depth != 8);
706
#ifdef PNG_WRITE_16BIT_SUPPORTED
707
         is_invalid_depth = (is_invalid_depth && bit_depth != 16);
708
#endif
709
         if (is_invalid_depth)
G
Guy Schalnat 已提交
710
            png_error(png_ptr, "Invalid bit depth for RGB image");
711

G
Guy Schalnat 已提交
712 713
         png_ptr->channels = 3;
         break;
714

A
Andreas Dilger 已提交
715
      case PNG_COLOR_TYPE_PALETTE:
G
Guy Schalnat 已提交
716 717 718 719 720
         switch (bit_depth)
         {
            case 1:
            case 2:
            case 4:
721 722 723
            case 8:
               png_ptr->channels = 1;
               break;
724

725 726
            default:
               png_error(png_ptr, "Invalid bit depth for paletted image");
G
Guy Schalnat 已提交
727 728
         }
         break;
729

A
Andreas Dilger 已提交
730
      case PNG_COLOR_TYPE_GRAY_ALPHA:
G
Guy Schalnat 已提交
731 732
         if (bit_depth != 8 && bit_depth != 16)
            png_error(png_ptr, "Invalid bit depth for grayscale+alpha image");
733

G
Guy Schalnat 已提交
734 735
         png_ptr->channels = 2;
         break;
736

A
Andreas Dilger 已提交
737
      case PNG_COLOR_TYPE_RGB_ALPHA:
738
#ifdef PNG_WRITE_16BIT_SUPPORTED
G
Guy Schalnat 已提交
739
         if (bit_depth != 8 && bit_depth != 16)
740 741 742
#else
         if (bit_depth != 8)
#endif
G
Guy Schalnat 已提交
743
            png_error(png_ptr, "Invalid bit depth for RGBA image");
744

G
Guy Schalnat 已提交
745 746
         png_ptr->channels = 4;
         break;
747

G
Guy Schalnat 已提交
748 749 750 751
      default:
         png_error(png_ptr, "Invalid image color type specified");
   }

A
Andreas Dilger 已提交
752
   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
G
Guy Schalnat 已提交
753 754
   {
      png_warning(png_ptr, "Invalid compression type specified");
A
Andreas Dilger 已提交
755
      compression_type = PNG_COMPRESSION_TYPE_BASE;
G
Guy Schalnat 已提交
756 757
   }

758 759 760 761 762 763 764 765 766
   /* Write filter_method 64 (intrapixel differencing) only if
    * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
    * 2. Libpng did not write a PNG signature (this filter_method is only
    *    used in PNG datastreams that are embedded in MNG datastreams) and
    * 3. The application called png_permit_mng_features with a mask that
    *    included PNG_FLAG_MNG_FILTER_64 and
    * 4. The filter_method is 64 and
    * 5. The color_type is RGB or RGBA
    */
767
   if (
768
#ifdef PNG_MNG_FEATURES_SUPPORTED
769 770
       !((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) != 0 &&
       ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) == 0) &&
771 772 773
       (color_type == PNG_COLOR_TYPE_RGB ||
        color_type == PNG_COLOR_TYPE_RGB_ALPHA) &&
       (filter_type == PNG_INTRAPIXEL_DIFFERENCING)) &&
774
#endif
775
       filter_type != PNG_FILTER_TYPE_BASE)
G
Guy Schalnat 已提交
776 777
   {
      png_warning(png_ptr, "Invalid filter type specified");
A
Andreas Dilger 已提交
778
      filter_type = PNG_FILTER_TYPE_BASE;
G
Guy Schalnat 已提交
779 780
   }

781
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
A
Andreas Dilger 已提交
782
   if (interlace_type != PNG_INTERLACE_NONE &&
783
       interlace_type != PNG_INTERLACE_ADAM7)
G
Guy Schalnat 已提交
784 785
   {
      png_warning(png_ptr, "Invalid interlace type specified");
A
Andreas Dilger 已提交
786
      interlace_type = PNG_INTERLACE_ADAM7;
G
Guy Schalnat 已提交
787
   }
788 789 790
#else
   interlace_type=PNG_INTERLACE_NONE;
#endif
G
Guy Schalnat 已提交
791

792
   /* Save the relevant information */
793 794 795
   png_ptr->bit_depth = (png_byte)bit_depth;
   png_ptr->color_type = (png_byte)color_type;
   png_ptr->interlaced = (png_byte)interlace_type;
796
#ifdef PNG_MNG_FEATURES_SUPPORTED
797
   png_ptr->filter_type = (png_byte)filter_type;
798
#endif
799
   png_ptr->compression_type = (png_byte)compression_type;
G
Guy Schalnat 已提交
800 801 802
   png_ptr->width = width;
   png_ptr->height = height;

803
   png_ptr->pixel_depth = (png_byte)(bit_depth * png_ptr->channels);
804
   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, width);
805
   /* Set the usr info, so any transformations can modify it */
G
Guy Schalnat 已提交
806 807
   png_ptr->usr_width = png_ptr->width;
   png_ptr->usr_bit_depth = png_ptr->bit_depth;
G
Guy Schalnat 已提交
808 809
   png_ptr->usr_channels = png_ptr->channels;

810
   /* Pack the header information into the buffer */
G
Guy Schalnat 已提交
811 812
   png_save_uint_32(buf, width);
   png_save_uint_32(buf + 4, height);
813 814 815 816 817
   buf[8] = (png_byte)bit_depth;
   buf[9] = (png_byte)color_type;
   buf[10] = (png_byte)compression_type;
   buf[11] = (png_byte)filter_type;
   buf[12] = (png_byte)interlace_type;
G
Guy Schalnat 已提交
818

819
   /* Write the chunk */
820
   png_write_complete_chunk(png_ptr, png_IHDR, buf, (png_size_t)13);
G
Guy Schalnat 已提交
821

822
   if ((png_ptr->do_filter) == PNG_NO_FILTERS)
G
Guy Schalnat 已提交
823
   {
A
Andreas Dilger 已提交
824
      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE ||
825
          png_ptr->bit_depth < 8)
G
Guy Schalnat 已提交
826
         png_ptr->do_filter = PNG_FILTER_NONE;
827

G
Guy Schalnat 已提交
828
      else
G
Guy Schalnat 已提交
829
         png_ptr->do_filter = PNG_ALL_FILTERS;
G
Guy Schalnat 已提交
830
   }
831

832
   png_ptr->mode = PNG_HAVE_IHDR; /* not READY_FOR_ZTXT */
G
Guy Schalnat 已提交
833 834
}

835
/* Write the palette.  We are careful not to trust png_color to be in the
836
 * correct order for PNG, so people can redefine it to any convenient
837 838
 * structure.
 */
839
void /* PRIVATE */
840
png_write_PLTE(png_structrp png_ptr, png_const_colorp palette,
841
    png_uint_32 num_pal)
G
Guy Schalnat 已提交
842
{
843
   png_uint_32 max_palette_length, i;
844
   png_const_colorp pal_ptr;
G
Guy Schalnat 已提交
845 846
   png_byte buf[3];

847
   png_debug(1, "in png_write_PLTE");
848

849
   max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
850 851
      (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;

852
   if ((
853
#ifdef PNG_MNG_FEATURES_SUPPORTED
854
       (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0 &&
855
#endif
856
       num_pal == 0) || num_pal > max_palette_length)
857
   {
858 859 860 861
      if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
      {
         png_error(png_ptr, "Invalid number of colors in palette");
      }
862

863 864 865 866 867
      else
      {
         png_warning(png_ptr, "Invalid number of colors in palette");
         return;
      }
868 869
   }

870
   if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0)
871 872
   {
      png_warning(png_ptr,
873
          "Ignoring request to write a PLTE chunk in grayscale PNG");
874

875
      return;
G
Guy Schalnat 已提交
876 877
   }

A
Andreas Dilger 已提交
878
   png_ptr->num_palette = (png_uint_16)num_pal;
879
   png_debug1(3, "num_palette = %d", png_ptr->num_palette);
G
Guy Schalnat 已提交
880

881
   png_write_chunk_header(png_ptr, png_PLTE, (png_uint_32)(num_pal * 3));
882
#ifdef PNG_POINTER_INDEXING_SUPPORTED
883

A
Andreas Dilger 已提交
884
   for (i = 0, pal_ptr = palette; i < num_pal; i++, pal_ptr++)
G
Guy Schalnat 已提交
885 886 887 888
   {
      buf[0] = pal_ptr->red;
      buf[1] = pal_ptr->green;
      buf[2] = pal_ptr->blue;
889
      png_write_chunk_data(png_ptr, buf, (png_size_t)3);
G
Guy Schalnat 已提交
890
   }
891

892
#else
893 894 895
   /* This is a little slower but some buggy compilers need to do this
    * instead
    */
896
   pal_ptr=palette;
897

898 899 900 901 902
   for (i = 0; i < num_pal; i++)
   {
      buf[0] = pal_ptr[i].red;
      buf[1] = pal_ptr[i].green;
      buf[2] = pal_ptr[i].blue;
903
      png_write_chunk_data(png_ptr, buf, (png_size_t)3);
904
   }
905

906
#endif
G
Guy Schalnat 已提交
907
   png_write_chunk_end(png_ptr);
G
Guy Schalnat 已提交
908
   png_ptr->mode |= PNG_HAVE_PLTE;
G
Guy Schalnat 已提交
909 910
}

911 912 913 914 915 916 917 918 919 920 921 922 923 924
/* This is similar to png_text_compress, above, except that it does not require
 * all of the data at once and, instead of buffering the compressed result,
 * writes it as IDAT chunks.  Unlike png_text_compress it *can* png_error out
 * because it calls the write interface.  As a result it does its own error
 * reporting and does not return an error code.  In the event of error it will
 * just call png_error.  The input data length may exceed 32-bits.  The 'flush'
 * parameter is exactly the same as that to deflate, with the following
 * meanings:
 *
 * Z_NO_FLUSH: normal incremental output of compressed data
 * Z_SYNC_FLUSH: do a SYNC_FLUSH, used by png_write_flush
 * Z_FINISH: this is the end of the input, do a Z_FINISH and clean up
 *
 * The routine manages the acquire and release of the png_ptr->zstream by
925
 * checking and (at the end) clearing png_ptr->zowner; it does some sanity
926 927
 * checks on the 'mode' flags while doing this.
 */
928
void /* PRIVATE */
929
png_compress_IDAT(png_structrp png_ptr, png_const_bytep input,
930
    png_alloc_size_t input_len, int flush)
G
Guy Schalnat 已提交
931
{
932 933 934 935 936 937 938 939 940 941
   if (png_ptr->zowner != png_IDAT)
   {
      /* First time.   Ensure we have a temporary buffer for compression and
       * trim the buffer list if it has more than one entry to free memory.
       * If 'WRITE_COMPRESSED_TEXT' is not set the list will never have been
       * created at this point, but the check here is quick and safe.
       */
      if (png_ptr->zbuffer_list == NULL)
      {
         png_ptr->zbuffer_list = png_voidcast(png_compression_bufferp,
942
             png_malloc(png_ptr, PNG_COMPRESSION_BUFFER_SIZE(png_ptr)));
943 944
         png_ptr->zbuffer_list->next = NULL;
      }
945

946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966
      else
         png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list->next);

      /* It is a terminal error if we can't claim the zstream. */
      if (png_deflate_claim(png_ptr, png_IDAT, png_image_size(png_ptr)) != Z_OK)
         png_error(png_ptr, png_ptr->zstream.msg);

      /* The output state is maintained in png_ptr->zstream, so it must be
       * initialized here after the claim.
       */
      png_ptr->zstream.next_out = png_ptr->zbuffer_list->output;
      png_ptr->zstream.avail_out = png_ptr->zbuffer_size;
   }

   /* Now loop reading and writing until all the input is consumed or an error
    * terminates the operation.  The _out values are maintained across calls to
    * this function, but the input must be reset each time.
    */
   png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input);
   png_ptr->zstream.avail_in = 0; /* set below */
   for (;;)
967
   {
968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984
      int ret;

      /* INPUT: from the row data */
      uInt avail = ZLIB_IO_MAX;

      if (avail > input_len)
         avail = (uInt)input_len; /* safe because of the check */

      png_ptr->zstream.avail_in = avail;
      input_len -= avail;

      ret = deflate(&png_ptr->zstream, input_len > 0 ? Z_NO_FLUSH : flush);

      /* Include as-yet unconsumed input */
      input_len += png_ptr->zstream.avail_in;
      png_ptr->zstream.avail_in = 0;

985
      /* OUTPUT: write complete IDAT chunks when avail_out drops to zero. Note
986 987
       * that these two zstream fields are preserved across the calls, therefore
       * there is no need to set these up on entry to the loop.
988
       */
989 990 991 992
      if (png_ptr->zstream.avail_out == 0)
      {
         png_bytep data = png_ptr->zbuffer_list->output;
         uInt size = png_ptr->zbuffer_size;
993

994 995 996
         /* Write an IDAT containing the data then reset the buffer.  The
          * first IDAT may need deflate header optimization.
          */
997 998 999
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
            if ((png_ptr->mode & PNG_HAVE_IDAT) == 0 &&
                png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE)
1000
               optimize_cmf(data, png_image_size(png_ptr));
1001
#endif
1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016

         png_write_complete_chunk(png_ptr, png_IDAT, data, size);
         png_ptr->mode |= PNG_HAVE_IDAT;

         png_ptr->zstream.next_out = data;
         png_ptr->zstream.avail_out = size;

         /* For SYNC_FLUSH or FINISH it is essential to keep calling zlib with
          * the same flush parameter until it has finished output, for NO_FLUSH
          * it doesn't matter.
          */
         if (ret == Z_OK && flush != Z_NO_FLUSH)
            continue;
      }

1017
      /* The order of these checks doesn't matter much; it just affects which
1018 1019 1020
       * possible error might be detected if multiple things go wrong at once.
       */
      if (ret == Z_OK) /* most likely return code! */
1021
      {
1022 1023 1024
         /* If all the input has been consumed then just return.  If Z_FINISH
          * was used as the flush parameter something has gone wrong if we get
          * here.
1025
          */
1026
         if (input_len == 0)
1027
         {
1028 1029
            if (flush == Z_FINISH)
               png_error(png_ptr, "Z_OK on Z_FINISH with output space");
1030

1031 1032 1033
            return;
         }
      }
1034

1035 1036 1037 1038 1039 1040 1041
      else if (ret == Z_STREAM_END && flush == Z_FINISH)
      {
         /* This is the end of the IDAT data; any pending output must be
          * flushed.  For small PNG files we may still be at the beginning.
          */
         png_bytep data = png_ptr->zbuffer_list->output;
         uInt size = png_ptr->zbuffer_size - png_ptr->zstream.avail_out;
1042

1043 1044 1045 1046 1047
#ifdef PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
         if ((png_ptr->mode & PNG_HAVE_IDAT) == 0 &&
             png_ptr->compression_type == PNG_COMPRESSION_TYPE_BASE)
            optimize_cmf(data, png_image_size(png_ptr));
#endif
1048

1049 1050 1051 1052
         png_write_complete_chunk(png_ptr, png_IDAT, data, size);
         png_ptr->zstream.avail_out = 0;
         png_ptr->zstream.next_out = NULL;
         png_ptr->mode |= PNG_HAVE_IDAT | PNG_AFTER_IDAT;
1053

1054 1055
         png_ptr->zowner = 0; /* Release the stream */
         return;
1056
      }
1057

1058
      else
1059 1060 1061 1062 1063
      {
         /* This is an error condition. */
         png_zstream_error(png_ptr, ret);
         png_error(png_ptr, png_ptr->zstream.msg);
      }
1064
   }
G
Guy Schalnat 已提交
1065 1066
}

1067
/* Write an IEND chunk */
1068
void /* PRIVATE */
1069
png_write_IEND(png_structrp png_ptr)
G
Guy Schalnat 已提交
1070
{
1071
   png_debug(1, "in png_write_IEND");
1072

1073
   png_write_complete_chunk(png_ptr, png_IEND, NULL, (png_size_t)0);
A
Andreas Dilger 已提交
1074
   png_ptr->mode |= PNG_HAVE_IEND;
G
Guy Schalnat 已提交
1075 1076
}

1077
#ifdef PNG_WRITE_gAMA_SUPPORTED
1078
/* Write a gAMA chunk */
1079
void /* PRIVATE */
1080
png_write_gAMA_fixed(png_structrp png_ptr, png_fixed_point file_gamma)
1081 1082 1083
{
   png_byte buf[4];

1084
   png_debug(1, "in png_write_gAMA");
1085

1086
   /* file_gamma is saved in 1/100,000ths */
1087
   png_save_uint_32(buf, (png_uint_32)file_gamma);
1088
   png_write_complete_chunk(png_ptr, png_gAMA, buf, (png_size_t)4);
1089 1090
}
#endif
G
Guy Schalnat 已提交
1091

1092
#ifdef PNG_WRITE_sRGB_SUPPORTED
1093
/* Write a sRGB chunk */
1094
void /* PRIVATE */
1095
png_write_sRGB(png_structrp png_ptr, int srgb_intent)
1096 1097 1098
{
   png_byte buf[1];

1099
   png_debug(1, "in png_write_sRGB");
1100

1101
   if (srgb_intent >= PNG_sRGB_INTENT_LAST)
1102 1103
      png_warning(png_ptr,
          "Invalid sRGB rendering intent specified");
1104

1105
   buf[0]=(png_byte)srgb_intent;
1106
   png_write_complete_chunk(png_ptr, png_sRGB, buf, (png_size_t)1);
1107 1108 1109
}
#endif

1110
#ifdef PNG_WRITE_iCCP_SUPPORTED
1111
/* Write an iCCP chunk */
1112
void /* PRIVATE */
1113 1114
png_write_iCCP(png_structrp png_ptr, png_const_charp name,
    png_const_bytep profile)
1115
{
1116 1117 1118
   png_uint_32 name_len;
   png_uint_32 profile_len;
   png_byte new_name[81]; /* 1 byte for the compression byte */
1119
   compression_state comp;
1120
   png_uint_32 temp;
1121

1122
   png_debug(1, "in png_write_iCCP");
1123

1124 1125 1126
   /* These are all internal problems: the profile should have been checked
    * before when it was stored.
    */
1127
   if (profile == NULL)
1128
      png_error(png_ptr, "No profile for iCCP chunk"); /* internal error */
1129

1130
   profile_len = png_get_uint_32(profile);
1131

1132 1133
   if (profile_len < 132)
      png_error(png_ptr, "ICC profile too short");
1134

1135 1136
   temp = (png_uint_32) (*(profile+8));
   if (temp > 3 && (profile_len & 0x03))
1137
      png_error(png_ptr, "ICC profile length invalid (not a multiple of 4)");
1138

1139
   {
1140
      png_uint_32 embedded_profile_len = png_get_uint_32(profile);
1141

1142 1143
      if (profile_len != embedded_profile_len)
         png_error(png_ptr, "Profile length does not match profile");
1144
   }
1145

1146
   name_len = png_check_keyword(png_ptr, name, new_name);
1147

1148 1149
   if (name_len == 0)
      png_error(png_ptr, "iCCP: invalid keyword");
1150

1151
   new_name[++name_len] = PNG_COMPRESSION_TYPE_BASE;
1152

1153
   /* Make sure we include the NULL after the name and the compression type */
1154
   ++name_len;
1155

1156
   png_text_compress_init(&comp, profile, profile_len);
1157

1158 1159 1160
   /* Allow for keyword terminator and compression byte */
   if (png_text_compress(png_ptr, png_iCCP, &comp, name_len) != Z_OK)
      png_error(png_ptr, png_ptr->zstream.msg);
1161

1162 1163 1164 1165 1166
   png_write_chunk_header(png_ptr, png_iCCP, name_len + comp.output_len);

   png_write_chunk_data(png_ptr, new_name, name_len);

   png_write_compressed_data_out(png_ptr, &comp);
1167 1168 1169 1170 1171

   png_write_chunk_end(png_ptr);
}
#endif

1172
#ifdef PNG_WRITE_sPLT_SUPPORTED
1173
/* Write a sPLT chunk */
1174
void /* PRIVATE */
1175
png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
1176
{
1177 1178
   png_uint_32 name_len;
   png_byte new_name[80];
1179
   png_byte entrybuf[10];
1180
   png_size_t entry_size = (spalette->depth == 8 ? 6 : 10);
1181
   png_size_t palette_size = entry_size * (png_size_t)spalette->nentries;
1182
   png_sPLT_entryp ep;
1183
#ifndef PNG_POINTER_INDEXING_SUPPORTED
1184 1185
   int i;
#endif
1186

1187
   png_debug(1, "in png_write_sPLT");
1188

1189 1190 1191 1192
   name_len = png_check_keyword(png_ptr, spalette->name, new_name);

   if (name_len == 0)
      png_error(png_ptr, "sPLT: invalid keyword");
1193

1194
   /* Make sure we include the NULL after the name */
1195
   png_write_chunk_header(png_ptr, png_sPLT,
1196
       (png_uint_32)(name_len + 2 + palette_size));
1197

1198
   png_write_chunk_data(png_ptr, (png_bytep)new_name,
1199
       (png_size_t)(name_len + 1));
1200

1201
   png_write_chunk_data(png_ptr, &spalette->depth, (png_size_t)1);
1202

1203
   /* Loop through each palette entry, writing appropriately */
1204
#ifdef PNG_POINTER_INDEXING_SUPPORTED
1205
   for (ep = spalette->entries; ep<spalette->entries + spalette->nentries; ep++)
1206
   {
1207 1208
      if (spalette->depth == 8)
      {
1209 1210 1211 1212
         entrybuf[0] = (png_byte)ep->red;
         entrybuf[1] = (png_byte)ep->green;
         entrybuf[2] = (png_byte)ep->blue;
         entrybuf[3] = (png_byte)ep->alpha;
1213
         png_save_uint_16(entrybuf + 4, ep->frequency);
1214
      }
1215

1216 1217
      else
      {
1218 1219 1220 1221 1222
         png_save_uint_16(entrybuf + 0, ep->red);
         png_save_uint_16(entrybuf + 2, ep->green);
         png_save_uint_16(entrybuf + 4, ep->blue);
         png_save_uint_16(entrybuf + 6, ep->alpha);
         png_save_uint_16(entrybuf + 8, ep->frequency);
1223
      }
1224

1225
      png_write_chunk_data(png_ptr, entrybuf, entry_size);
1226
   }
1227 1228
#else
   ep=spalette->entries;
1229
   for (i = 0; i>spalette->nentries; i++)
1230
   {
1231 1232
      if (spalette->depth == 8)
      {
1233 1234 1235 1236
         entrybuf[0] = (png_byte)ep[i].red;
         entrybuf[1] = (png_byte)ep[i].green;
         entrybuf[2] = (png_byte)ep[i].blue;
         entrybuf[3] = (png_byte)ep[i].alpha;
1237
         png_save_uint_16(entrybuf + 4, ep[i].frequency);
1238
      }
1239

1240 1241
      else
      {
1242 1243 1244 1245 1246
         png_save_uint_16(entrybuf + 0, ep[i].red);
         png_save_uint_16(entrybuf + 2, ep[i].green);
         png_save_uint_16(entrybuf + 4, ep[i].blue);
         png_save_uint_16(entrybuf + 6, ep[i].alpha);
         png_save_uint_16(entrybuf + 8, ep[i].frequency);
1247
      }
1248

1249
      png_write_chunk_data(png_ptr, entrybuf, entry_size);
1250 1251
   }
#endif
1252 1253 1254 1255 1256

   png_write_chunk_end(png_ptr);
}
#endif

1257
#ifdef PNG_WRITE_sBIT_SUPPORTED
1258
/* Write the sBIT chunk */
1259
void /* PRIVATE */
1260
png_write_sBIT(png_structrp png_ptr, png_const_color_8p sbit, int color_type)
G
Guy Schalnat 已提交
1261 1262
{
   png_byte buf[4];
A
Andreas Dilger 已提交
1263
   png_size_t size;
G
Guy Schalnat 已提交
1264

1265
   png_debug(1, "in png_write_sBIT");
1266

1267
   /* Make sure we don't depend upon the order of PNG_COLOR_8 */
1268
   if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
G
Guy Schalnat 已提交
1269
   {
1270
      png_byte maxbits;
G
Guy Schalnat 已提交
1271

1272 1273
      maxbits = (png_byte)(color_type==PNG_COLOR_TYPE_PALETTE ? 8 :
          png_ptr->usr_bit_depth);
1274

1275 1276
      if (sbit->red == 0 || sbit->red > maxbits ||
          sbit->green == 0 || sbit->green > maxbits ||
G
Guy Schalnat 已提交
1277 1278 1279 1280 1281
          sbit->blue == 0 || sbit->blue > maxbits)
      {
         png_warning(png_ptr, "Invalid sBIT depth specified");
         return;
      }
1282

G
Guy Schalnat 已提交
1283 1284 1285 1286 1287
      buf[0] = sbit->red;
      buf[1] = sbit->green;
      buf[2] = sbit->blue;
      size = 3;
   }
1288

G
Guy Schalnat 已提交
1289 1290
   else
   {
G
Guy Schalnat 已提交
1291 1292 1293 1294 1295
      if (sbit->gray == 0 || sbit->gray > png_ptr->usr_bit_depth)
      {
         png_warning(png_ptr, "Invalid sBIT depth specified");
         return;
      }
1296

G
Guy Schalnat 已提交
1297 1298 1299 1300
      buf[0] = sbit->gray;
      size = 1;
   }

1301
   if ((color_type & PNG_COLOR_MASK_ALPHA) != 0)
G
Guy Schalnat 已提交
1302
   {
G
Guy Schalnat 已提交
1303 1304 1305 1306 1307
      if (sbit->alpha == 0 || sbit->alpha > png_ptr->usr_bit_depth)
      {
         png_warning(png_ptr, "Invalid sBIT depth specified");
         return;
      }
1308

G
Guy Schalnat 已提交
1309 1310 1311
      buf[size++] = sbit->alpha;
   }

1312
   png_write_complete_chunk(png_ptr, png_sBIT, buf, size);
G
Guy Schalnat 已提交
1313
}
G
Guy Schalnat 已提交
1314
#endif
G
Guy Schalnat 已提交
1315

1316
#ifdef PNG_WRITE_cHRM_SUPPORTED
1317
/* Write the cHRM chunk */
1318
void /* PRIVATE */
1319
png_write_cHRM_fixed(png_structrp png_ptr, const png_xy *xy)
1320 1321 1322
{
   png_byte buf[32];

1323
   png_debug(1, "in png_write_cHRM");
1324

1325
   /* Each value is saved in 1/100,000ths */
1326 1327
   png_save_int_32(buf,      xy->whitex);
   png_save_int_32(buf +  4, xy->whitey);
1328

1329 1330
   png_save_int_32(buf +  8, xy->redx);
   png_save_int_32(buf + 12, xy->redy);
1331

1332 1333
   png_save_int_32(buf + 16, xy->greenx);
   png_save_int_32(buf + 20, xy->greeny);
1334

1335 1336
   png_save_int_32(buf + 24, xy->bluex);
   png_save_int_32(buf + 28, xy->bluey);
1337

1338
   png_write_complete_chunk(png_ptr, png_cHRM, buf, 32);
1339 1340
}
#endif
G
Guy Schalnat 已提交
1341

1342
#ifdef PNG_WRITE_tRNS_SUPPORTED
1343
/* Write the tRNS chunk */
1344
void /* PRIVATE */
1345
png_write_tRNS(png_structrp png_ptr, png_const_bytep trans_alpha,
1346
    png_const_color_16p tran, int num_trans, int color_type)
G
Guy Schalnat 已提交
1347 1348 1349
{
   png_byte buf[6];

1350
   png_debug(1, "in png_write_tRNS");
1351

G
Guy Schalnat 已提交
1352 1353
   if (color_type == PNG_COLOR_TYPE_PALETTE)
   {
1354
      if (num_trans <= 0 || num_trans > (int)png_ptr->num_palette)
G
Guy Schalnat 已提交
1355
      {
1356 1357
         png_app_warning(png_ptr,
             "Invalid number of transparent colors specified");
G
Guy Schalnat 已提交
1358 1359
         return;
      }
1360

1361
      /* Write the chunk out as it is */
1362
      png_write_complete_chunk(png_ptr, png_tRNS, trans_alpha,
1363
          (png_size_t)num_trans);
G
Guy Schalnat 已提交
1364
   }
1365

G
Guy Schalnat 已提交
1366 1367
   else if (color_type == PNG_COLOR_TYPE_GRAY)
   {
1368
      /* One 16-bit value */
1369
      if (tran->gray >= (1 << png_ptr->bit_depth))
1370
      {
1371
         png_app_warning(png_ptr,
1372
             "Ignoring attempt to write tRNS chunk out-of-range for bit_depth");
1373

1374 1375
         return;
      }
1376

G
Guy Schalnat 已提交
1377
      png_save_uint_16(buf, tran->gray);
1378
      png_write_complete_chunk(png_ptr, png_tRNS, buf, (png_size_t)2);
G
Guy Schalnat 已提交
1379
   }
1380

G
Guy Schalnat 已提交
1381 1382
   else if (color_type == PNG_COLOR_TYPE_RGB)
   {
1383
      /* Three 16-bit values */
G
Guy Schalnat 已提交
1384 1385 1386
      png_save_uint_16(buf, tran->red);
      png_save_uint_16(buf + 2, tran->green);
      png_save_uint_16(buf + 4, tran->blue);
1387
#ifdef PNG_WRITE_16BIT_SUPPORTED
1388
      if (png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]) != 0)
1389
#else
1390
      if ((buf[0] | buf[2] | buf[4]) != 0)
1391
#endif
1392
      {
1393
         png_app_warning(png_ptr,
1394
             "Ignoring attempt to write 16-bit tRNS chunk when bit_depth is 8");
1395 1396
         return;
      }
1397

1398
      png_write_complete_chunk(png_ptr, png_tRNS, buf, (png_size_t)6);
G
Guy Schalnat 已提交
1399
   }
1400

G
Guy Schalnat 已提交
1401 1402
   else
   {
1403
      png_app_warning(png_ptr, "Can't write tRNS with an alpha channel");
G
Guy Schalnat 已提交
1404
   }
G
Guy Schalnat 已提交
1405
}
G
Guy Schalnat 已提交
1406
#endif
G
Guy Schalnat 已提交
1407

1408
#ifdef PNG_WRITE_bKGD_SUPPORTED
1409
/* Write the background chunk */
1410
void /* PRIVATE */
1411
png_write_bKGD(png_structrp png_ptr, png_const_color_16p back, int color_type)
G
Guy Schalnat 已提交
1412 1413 1414
{
   png_byte buf[6];

1415
   png_debug(1, "in png_write_bKGD");
1416

G
Guy Schalnat 已提交
1417 1418
   if (color_type == PNG_COLOR_TYPE_PALETTE)
   {
1419
      if (
1420
#ifdef PNG_MNG_FEATURES_SUPPORTED
1421 1422
          (png_ptr->num_palette != 0 ||
          (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0) &&
1423
#endif
1424
         back->index >= png_ptr->num_palette)
G
Guy Schalnat 已提交
1425 1426 1427 1428
      {
         png_warning(png_ptr, "Invalid background palette index");
         return;
      }
1429

G
Guy Schalnat 已提交
1430
      buf[0] = back->index;
1431
      png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)1);
G
Guy Schalnat 已提交
1432
   }
1433

1434
   else if ((color_type & PNG_COLOR_MASK_COLOR) != 0)
G
Guy Schalnat 已提交
1435 1436 1437 1438
   {
      png_save_uint_16(buf, back->red);
      png_save_uint_16(buf + 2, back->green);
      png_save_uint_16(buf + 4, back->blue);
1439
#ifdef PNG_WRITE_16BIT_SUPPORTED
1440
      if (png_ptr->bit_depth == 8 && (buf[0] | buf[2] | buf[4]) != 0)
1441
#else
1442
      if ((buf[0] | buf[2] | buf[4]) != 0)
1443
#endif
1444 1445
      {
         png_warning(png_ptr,
1446 1447
             "Ignoring attempt to write 16-bit bKGD chunk "
             "when bit_depth is 8");
1448

1449 1450
         return;
      }
1451

1452
      png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)6);
G
Guy Schalnat 已提交
1453
   }
1454

G
Guy Schalnat 已提交
1455
   else
G
Guy Schalnat 已提交
1456
   {
1457
      if (back->gray >= (1 << png_ptr->bit_depth))
1458 1459
      {
         png_warning(png_ptr,
1460
             "Ignoring attempt to write bKGD chunk out-of-range for bit_depth");
1461

1462 1463
         return;
      }
1464

G
Guy Schalnat 已提交
1465
      png_save_uint_16(buf, back->gray);
1466
      png_write_complete_chunk(png_ptr, png_bKGD, buf, (png_size_t)2);
G
Guy Schalnat 已提交
1467 1468
   }
}
G
Guy Schalnat 已提交
1469
#endif
G
Guy Schalnat 已提交
1470

1471
#ifdef PNG_WRITE_hIST_SUPPORTED
1472
/* Write the histogram */
1473
void /* PRIVATE */
1474
png_write_hIST(png_structrp png_ptr, png_const_uint_16p hist, int num_hist)
G
Guy Schalnat 已提交
1475
{
1476
   int i;
G
Guy Schalnat 已提交
1477 1478
   png_byte buf[3];

1479
   png_debug(1, "in png_write_hIST");
1480

1481
   if (num_hist > (int)png_ptr->num_palette)
G
Guy Schalnat 已提交
1482
   {
1483
      png_debug2(3, "num_hist = %d, num_palette = %d", num_hist,
1484
          png_ptr->num_palette);
1485

G
Guy Schalnat 已提交
1486 1487 1488 1489
      png_warning(png_ptr, "Invalid number of histogram entries specified");
      return;
   }

1490
   png_write_chunk_header(png_ptr, png_hIST, (png_uint_32)(num_hist * 2));
1491

A
Andreas Dilger 已提交
1492
   for (i = 0; i < num_hist; i++)
G
Guy Schalnat 已提交
1493
   {
G
Guy Schalnat 已提交
1494
      png_save_uint_16(buf, hist[i]);
1495
      png_write_chunk_data(png_ptr, buf, (png_size_t)2);
G
Guy Schalnat 已提交
1496
   }
1497

G
Guy Schalnat 已提交
1498 1499
   png_write_chunk_end(png_ptr);
}
G
Guy Schalnat 已提交
1500
#endif
G
Guy Schalnat 已提交
1501

1502
#ifdef PNG_WRITE_tEXt_SUPPORTED
1503
/* Write a tEXt chunk */
1504
void /* PRIVATE */
1505
png_write_tEXt(png_structrp png_ptr, png_const_charp key, png_const_charp text,
1506
    png_size_t text_len)
G
Guy Schalnat 已提交
1507
{
1508 1509
   png_uint_32 key_len;
   png_byte new_key[80];
A
Andreas Dilger 已提交
1510

1511
   png_debug(1, "in png_write_tEXt");
1512

1513 1514 1515 1516
   key_len = png_check_keyword(png_ptr, key, new_key);

   if (key_len == 0)
      png_error(png_ptr, "tEXt: invalid keyword");
G
Guy Schalnat 已提交
1517

A
Andreas Dilger 已提交
1518
   if (text == NULL || *text == '\0')
A
Andreas Dilger 已提交
1519
      text_len = 0;
1520

1521
   else
1522 1523 1524 1525
      text_len = strlen(text);

   if (text_len > PNG_UINT_31_MAX - (key_len+1))
      png_error(png_ptr, "tEXt: text too long");
1526

1527
   /* Make sure we include the 0 after the key */
1528
   png_write_chunk_header(png_ptr, png_tEXt,
1529
       (png_uint_32)/*checked above*/(key_len + text_len + 1));
1530 1531 1532 1533
   /*
    * We leave it to the application to meet PNG-1.0 requirements on the
    * contents of the text.  PNG-1.0 through PNG-1.2 discourage the use of
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG will forbid them.
1534
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
1535
    */
1536
   png_write_chunk_data(png_ptr, new_key, key_len + 1);
1537

1538
   if (text_len != 0)
1539
      png_write_chunk_data(png_ptr, (png_const_bytep)text, text_len);
A
Andreas Dilger 已提交
1540

G
Guy Schalnat 已提交
1541 1542
   png_write_chunk_end(png_ptr);
}
G
Guy Schalnat 已提交
1543
#endif
G
Guy Schalnat 已提交
1544

1545
#ifdef PNG_WRITE_zTXt_SUPPORTED
1546
/* Write a compressed text chunk */
1547
void /* PRIVATE */
1548
png_write_zTXt(png_structrp png_ptr, png_const_charp key, png_const_charp text,
1549
    int compression)
G
Guy Schalnat 已提交
1550
{
1551 1552
   png_uint_32 key_len;
   png_byte new_key[81];
1553
   compression_state comp;
G
Guy Schalnat 已提交
1554

1555
   png_debug(1, "in png_write_zTXt");
A
Andreas Dilger 已提交
1556

1557
   if (compression == PNG_TEXT_COMPRESSION_NONE)
A
Andreas Dilger 已提交
1558
   {
1559
      png_write_tEXt(png_ptr, key, text, 0);
G
Guy Schalnat 已提交
1560
      return;
A
Andreas Dilger 已提交
1561
   }
A
Andreas Dilger 已提交
1562

1563 1564
   if (compression != PNG_TEXT_COMPRESSION_zTXt)
      png_error(png_ptr, "zTXt: invalid compression type");
G
Guy Schalnat 已提交
1565

1566
   key_len = png_check_keyword(png_ptr, key, new_key);
1567

1568 1569
   if (key_len == 0)
      png_error(png_ptr, "zTXt: invalid keyword");
1570

1571 1572 1573
   /* Add the compression method and 1 for the keyword separator. */
   new_key[++key_len] = PNG_COMPRESSION_TYPE_BASE;
   ++key_len;
1574

1575 1576
   /* Compute the compressed data; do it now for the length */
   png_text_compress_init(&comp, (png_const_bytep)text,
1577
       text == NULL ? 0 : strlen(text));
1578

1579 1580
   if (png_text_compress(png_ptr, png_zTXt, &comp, key_len) != Z_OK)
      png_error(png_ptr, png_ptr->zstream.msg);
1581

1582 1583
   /* Write start of chunk */
   png_write_chunk_header(png_ptr, png_zTXt, key_len + comp.output_len);
1584

1585 1586
   /* Write key */
   png_write_chunk_data(png_ptr, new_key, key_len);
1587

1588
   /* Write the compressed data */
1589
   png_write_compressed_data_out(png_ptr, &comp);
G
Guy Schalnat 已提交
1590

1591
   /* Close the chunk */
1592 1593 1594
   png_write_chunk_end(png_ptr);
}
#endif
G
Guy Schalnat 已提交
1595

1596
#ifdef PNG_WRITE_iTXt_SUPPORTED
1597
/* Write an iTXt chunk */
1598
void /* PRIVATE */
1599
png_write_iTXt(png_structrp png_ptr, int compression, png_const_charp key,
1600
    png_const_charp lang, png_const_charp lang_key, png_const_charp text)
1601
{
1602 1603 1604
   png_uint_32 key_len, prefix_len;
   png_size_t lang_len, lang_key_len;
   png_byte new_key[82];
1605
   compression_state comp;
G
Guy Schalnat 已提交
1606

1607
   png_debug(1, "in png_write_iTXt");
G
Guy Schalnat 已提交
1608

1609
   key_len = png_check_keyword(png_ptr, key, new_key);
1610

1611 1612
   if (key_len == 0)
      png_error(png_ptr, "iTXt: invalid keyword");
1613

1614 1615
   /* Set the compression flag */
   switch (compression)
1616
   {
1617 1618 1619 1620
      case PNG_ITXT_COMPRESSION_NONE:
      case PNG_TEXT_COMPRESSION_NONE:
         compression = new_key[++key_len] = 0; /* no compression */
         break;
1621

1622 1623 1624 1625
      case PNG_TEXT_COMPRESSION_zTXt:
      case PNG_ITXT_COMPRESSION_zTXt:
         compression = new_key[++key_len] = 1; /* compressed */
         break;
1626

1627 1628 1629
      default:
         png_error(png_ptr, "iTXt: invalid compression");
   }
1630

1631 1632
   new_key[++key_len] = PNG_COMPRESSION_TYPE_BASE;
   ++key_len; /* for the keywod separator */
1633

1634 1635
   /* We leave it to the application to meet PNG-1.0 requirements on the
    * contents of the text.  PNG-1.0 through PNG-1.2 discourage the use of
1636 1637 1638 1639
    * any non-Latin-1 characters except for NEWLINE.  ISO PNG, however,
    * specifies that the text is UTF-8 and this really doesn't require any
    * checking.
    *
1640
    * The NUL character is forbidden by PNG-1.0 through PNG-1.2 and ISO PNG.
1641 1642
    *
    * TODO: validate the language tag correctly (see the spec.)
1643
    */
1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654
   if (lang == NULL) lang = ""; /* empty language is valid */
   lang_len = strlen(lang)+1;
   if (lang_key == NULL) lang_key = ""; /* may be empty */
   lang_key_len = strlen(lang_key)+1;
   if (text == NULL) text = ""; /* may be empty */

   prefix_len = key_len;
   if (lang_len > PNG_UINT_31_MAX-prefix_len)
      prefix_len = PNG_UINT_31_MAX;
   else
      prefix_len = (png_uint_32)(prefix_len + lang_len);
1655

1656 1657 1658 1659
   if (lang_key_len > PNG_UINT_31_MAX-prefix_len)
      prefix_len = PNG_UINT_31_MAX;
   else
      prefix_len = (png_uint_32)(prefix_len + lang_key_len);
G
Guy Schalnat 已提交
1660

1661
   png_text_compress_init(&comp, (png_const_bytep)text, strlen(text));
1662

1663
   if (compression != 0)
1664 1665 1666 1667
   {
      if (png_text_compress(png_ptr, png_iTXt, &comp, prefix_len) != Z_OK)
         png_error(png_ptr, png_ptr->zstream.msg);
   }
1668

1669 1670 1671 1672
   else
   {
      if (comp.input_len > PNG_UINT_31_MAX-prefix_len)
         png_error(png_ptr, "iTXt: uncompressed text too long");
1673 1674 1675

      /* So the string will fit in a chunk: */
      comp.output_len = (png_uint_32)/*SAFE*/comp.input_len;
1676
   }
1677

1678 1679
   png_write_chunk_header(png_ptr, png_iTXt, comp.output_len + prefix_len);

1680
   png_write_chunk_data(png_ptr, new_key, key_len);
1681

1682
   png_write_chunk_data(png_ptr, (png_const_bytep)lang, lang_len);
1683

1684
   png_write_chunk_data(png_ptr, (png_const_bytep)lang_key, lang_key_len);
1685

1686
   if (compression != 0)
1687 1688 1689
      png_write_compressed_data_out(png_ptr, &comp);

   else
1690
      png_write_chunk_data(png_ptr, (png_const_bytep)text, comp.output_len);
1691 1692

   png_write_chunk_end(png_ptr);
G
Guy Schalnat 已提交
1693
}
G
Guy Schalnat 已提交
1694
#endif
G
Guy Schalnat 已提交
1695

1696
#ifdef PNG_WRITE_oFFs_SUPPORTED
1697
/* Write the oFFs chunk */
1698
void /* PRIVATE */
1699
png_write_oFFs(png_structrp png_ptr, png_int_32 x_offset, png_int_32 y_offset,
1700
    int unit_type)
G
Guy Schalnat 已提交
1701 1702 1703
{
   png_byte buf[9];

1704
   png_debug(1, "in png_write_oFFs");
1705

A
Andreas Dilger 已提交
1706 1707
   if (unit_type >= PNG_OFFSET_LAST)
      png_warning(png_ptr, "Unrecognized unit type for oFFs chunk");
G
Guy Schalnat 已提交
1708

1709 1710
   png_save_int_32(buf, x_offset);
   png_save_int_32(buf + 4, y_offset);
1711
   buf[8] = (png_byte)unit_type;
G
Guy Schalnat 已提交
1712

1713
   png_write_complete_chunk(png_ptr, png_oFFs, buf, (png_size_t)9);
G
Guy Schalnat 已提交
1714
}
G
Guy Schalnat 已提交
1715
#endif
1716
#ifdef PNG_WRITE_pCAL_SUPPORTED
1717
/* Write the pCAL chunk (described in the PNG extensions document) */
1718
void /* PRIVATE */
1719
png_write_pCAL(png_structrp png_ptr, png_charp purpose, png_int_32 X0,
1720 1721
    png_int_32 X1, int type, int nparams, png_const_charp units,
    png_charpp params)
A
Andreas Dilger 已提交
1722
{
1723 1724
   png_uint_32 purpose_len;
   png_size_t units_len, total_len;
1725
   png_size_tp params_len;
A
Andreas Dilger 已提交
1726
   png_byte buf[10];
1727
   png_byte new_purpose[80];
A
Andreas Dilger 已提交
1728 1729
   int i;

1730
   png_debug1(1, "in png_write_pCAL (%d parameters)", nparams);
1731

A
Andreas Dilger 已提交
1732
   if (type >= PNG_EQUATION_LAST)
1733 1734 1735 1736 1737 1738 1739 1740
      png_error(png_ptr, "Unrecognized equation type for pCAL chunk");

   purpose_len = png_check_keyword(png_ptr, purpose, new_purpose);

   if (purpose_len == 0)
      png_error(png_ptr, "pCAL: invalid keyword");

   ++purpose_len; /* terminator */
A
Andreas Dilger 已提交
1741

1742
   png_debug1(3, "pCAL purpose length = %d", (int)purpose_len);
1743
   units_len = strlen(units) + (nparams == 0 ? 0 : 1);
1744
   png_debug1(3, "pCAL units length = %d", (int)units_len);
A
Andreas Dilger 已提交
1745 1746
   total_len = purpose_len + units_len + 10;

1747
   params_len = (png_size_tp)png_malloc(png_ptr,
1748
       (png_alloc_size_t)((png_alloc_size_t)nparams * (sizeof (png_size_t))));
A
Andreas Dilger 已提交
1749 1750

   /* Find the length of each parameter, making sure we don't count the
1751 1752
    * null terminator for the last parameter.
    */
A
Andreas Dilger 已提交
1753 1754
   for (i = 0; i < nparams; i++)
   {
1755
      params_len[i] = strlen(params[i]) + (i == nparams - 1 ? 0 : 1);
1756
      png_debug2(3, "pCAL parameter %d length = %lu", i,
1757
          (unsigned long)params_len[i]);
1758
      total_len += params_len[i];
A
Andreas Dilger 已提交
1759 1760
   }

1761
   png_debug1(3, "pCAL total length = %d", (int)total_len);
1762
   png_write_chunk_header(png_ptr, png_pCAL, (png_uint_32)total_len);
1763
   png_write_chunk_data(png_ptr, new_purpose, purpose_len);
A
Andreas Dilger 已提交
1764 1765
   png_save_int_32(buf, X0);
   png_save_int_32(buf + 4, X1);
1766 1767
   buf[8] = (png_byte)type;
   buf[9] = (png_byte)nparams;
1768
   png_write_chunk_data(png_ptr, buf, (png_size_t)10);
1769
   png_write_chunk_data(png_ptr, (png_const_bytep)units, (png_size_t)units_len);
A
Andreas Dilger 已提交
1770 1771 1772

   for (i = 0; i < nparams; i++)
   {
1773
      png_write_chunk_data(png_ptr, (png_const_bytep)params[i], params_len[i]);
A
Andreas Dilger 已提交
1774 1775
   }

1776
   png_free(png_ptr, params_len);
A
Andreas Dilger 已提交
1777 1778 1779 1780
   png_write_chunk_end(png_ptr);
}
#endif

1781
#ifdef PNG_WRITE_sCAL_SUPPORTED
1782
/* Write the sCAL chunk */
1783
void /* PRIVATE */
1784
png_write_sCAL_s(png_structrp png_ptr, int unit, png_const_charp width,
1785
    png_const_charp height)
1786
{
1787 1788
   png_byte buf[64];
   png_size_t wlen, hlen, total_len;
1789

1790
   png_debug(1, "in png_write_sCAL_s");
1791

1792 1793
   wlen = strlen(width);
   hlen = strlen(height);
1794
   total_len = wlen + hlen + 2;
1795

1796 1797 1798 1799 1800
   if (total_len > 64)
   {
      png_warning(png_ptr, "Can't write sCAL (buffer too small)");
      return;
   }
1801

1802
   buf[0] = (png_byte)unit;
1803 1804
   memcpy(buf + 1, width, wlen + 1);      /* Append the '\0' here */
   memcpy(buf + wlen + 2, height, hlen);  /* Do NOT append the '\0' here */
1805

1806
   png_debug1(3, "sCAL total length = %u", (unsigned int)total_len);
1807
   png_write_complete_chunk(png_ptr, png_sCAL, buf, total_len);
1808 1809 1810
}
#endif

1811
#ifdef PNG_WRITE_pHYs_SUPPORTED
1812
/* Write the pHYs chunk */
1813
void /* PRIVATE */
1814
png_write_pHYs(png_structrp png_ptr, png_uint_32 x_pixels_per_unit,
1815 1816
    png_uint_32 y_pixels_per_unit,
    int unit_type)
G
Guy Schalnat 已提交
1817 1818 1819
{
   png_byte buf[9];

1820
   png_debug(1, "in png_write_pHYs");
1821

A
Andreas Dilger 已提交
1822 1823
   if (unit_type >= PNG_RESOLUTION_LAST)
      png_warning(png_ptr, "Unrecognized unit type for pHYs chunk");
G
Guy Schalnat 已提交
1824

A
Andreas Dilger 已提交
1825 1826
   png_save_uint_32(buf, x_pixels_per_unit);
   png_save_uint_32(buf + 4, y_pixels_per_unit);
1827
   buf[8] = (png_byte)unit_type;
G
Guy Schalnat 已提交
1828

1829
   png_write_complete_chunk(png_ptr, png_pHYs, buf, (png_size_t)9);
G
Guy Schalnat 已提交
1830
}
G
Guy Schalnat 已提交
1831
#endif
G
Guy Schalnat 已提交
1832

1833
#ifdef PNG_WRITE_tIME_SUPPORTED
1834 1835 1836
/* Write the tIME chunk.  Use either png_convert_from_struct_tm()
 * or png_convert_from_time_t(), or fill in the structure yourself.
 */
1837
void /* PRIVATE */
1838
png_write_tIME(png_structrp png_ptr, png_const_timep mod_time)
G
Guy Schalnat 已提交
1839 1840 1841
{
   png_byte buf[7];

1842
   png_debug(1, "in png_write_tIME");
1843

G
Guy Schalnat 已提交
1844 1845 1846 1847 1848 1849 1850 1851
   if (mod_time->month  > 12 || mod_time->month  < 1 ||
       mod_time->day    > 31 || mod_time->day    < 1 ||
       mod_time->hour   > 23 || mod_time->second > 60)
   {
      png_warning(png_ptr, "Invalid time specified for tIME chunk");
      return;
   }

G
Guy Schalnat 已提交
1852 1853 1854 1855 1856 1857 1858
   png_save_uint_16(buf, mod_time->year);
   buf[2] = mod_time->month;
   buf[3] = mod_time->day;
   buf[4] = mod_time->hour;
   buf[5] = mod_time->minute;
   buf[6] = mod_time->second;

1859
   png_write_complete_chunk(png_ptr, png_tIME, buf, (png_size_t)7);
G
Guy Schalnat 已提交
1860
}
G
Guy Schalnat 已提交
1861
#endif
G
Guy Schalnat 已提交
1862

1863
/* Initializes the row writing capability of libpng */
1864
void /* PRIVATE */
1865
png_write_start_row(png_structrp png_ptr)
G
Guy Schalnat 已提交
1866
{
1867
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
1868
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
1869

1870
   /* Start of interlace block */
1871
   static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
1872

1873
   /* Offset to next interlace block */
1874
   static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
1875

1876
   /* Start of interlace block in the y direction */
1877
   static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
1878

1879
   /* Offset to next interlace block in the y direction */
1880
   static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
1881
#endif
1882

1883 1884
   png_alloc_size_t buf_size;
   int usr_pixel_depth;
A
Andreas Dilger 已提交
1885

1886
#ifdef PNG_WRITE_FILTER_SUPPORTED
1887
   png_byte filters;
1888 1889
#endif

1890
   png_debug(1, "in png_write_start_row");
1891

1892 1893 1894 1895 1896
   usr_pixel_depth = png_ptr->usr_channels * png_ptr->usr_bit_depth;
   buf_size = PNG_ROWBYTES(usr_pixel_depth, png_ptr->width) + 1;

   /* 1.5.6: added to allow checking in the row write code. */
   png_ptr->transformed_pixel_depth = png_ptr->pixel_depth;
1897
   png_ptr->maximum_pixel_depth = (png_byte)usr_pixel_depth;
A
Andreas Dilger 已提交
1898

1899
   /* Set up row buffer */
1900
   png_ptr->row_buf = png_voidcast(png_bytep, png_malloc(png_ptr, buf_size));
1901

A
Andreas Dilger 已提交
1902
   png_ptr->row_buf[0] = PNG_FILTER_VALUE_NONE;
G
Guy Schalnat 已提交
1903

1904
#ifdef PNG_WRITE_FILTER_SUPPORTED
1905
   filters = png_ptr->do_filter;
1906

1907
   if (png_ptr->height == 1)
1908
      filters &= 0xff & ~(PNG_FILTER_UP|PNG_FILTER_AVG|PNG_FILTER_PAETH);
G
Guy Schalnat 已提交
1909

1910
   if (png_ptr->width == 1)
1911
      filters &= 0xff & ~(PNG_FILTER_SUB|PNG_FILTER_AVG|PNG_FILTER_PAETH);
1912 1913 1914 1915 1916 1917 1918 1919

   if (filters == 0)
      filters = PNG_FILTER_NONE;

   png_ptr->do_filter = filters;

   if (((filters & (PNG_FILTER_SUB | PNG_FILTER_UP | PNG_FILTER_AVG |
       PNG_FILTER_PAETH)) != 0) && png_ptr->try_row == NULL)
G
Guy Schalnat 已提交
1920
   {
1921
      int num_filters = 0;
G
Guy Schalnat 已提交
1922

1923
      png_ptr->try_row = png_voidcast(png_bytep, png_malloc(png_ptr, buf_size));
1924

1925 1926
      if (filters & PNG_FILTER_SUB)
         num_filters++;
G
Guy Schalnat 已提交
1927

1928 1929
      if (filters & PNG_FILTER_UP)
         num_filters++;
1930

1931 1932
      if (filters & PNG_FILTER_AVG)
         num_filters++;
G
Guy Schalnat 已提交
1933

1934 1935
      if (filters & PNG_FILTER_PAETH)
         num_filters++;
1936

1937 1938 1939
      if (num_filters > 1)
         png_ptr->tst_row = png_voidcast(png_bytep, png_malloc(png_ptr,
             buf_size));
G
Guy Schalnat 已提交
1940
   }
1941 1942 1943 1944 1945

   /* We only need to keep the previous row if we are using one of the following
    * filters.
    */
   if ((filters & (PNG_FILTER_AVG | PNG_FILTER_UP | PNG_FILTER_PAETH)) != 0)
J
John Bowler 已提交
1946
      png_ptr->prev_row = png_voidcast(png_bytep,
1947
          png_calloc(png_ptr, buf_size));
1948
#endif /* WRITE_FILTER */
G
Guy Schalnat 已提交
1949

1950
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
1951
   /* If interlaced, we need to set up width and height of pass */
1952
   if (png_ptr->interlaced != 0)
G
Guy Schalnat 已提交
1953
   {
1954
      if ((png_ptr->transformations & PNG_INTERLACE) == 0)
G
Guy Schalnat 已提交
1955 1956
      {
         png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
1957
             png_pass_ystart[0]) / png_pass_yinc[0];
1958

A
Andreas Dilger 已提交
1959
         png_ptr->usr_width = (png_ptr->width + png_pass_inc[0] - 1 -
1960
             png_pass_start[0]) / png_pass_inc[0];
G
Guy Schalnat 已提交
1961
      }
1962

G
Guy Schalnat 已提交
1963 1964 1965 1966 1967 1968
      else
      {
         png_ptr->num_rows = png_ptr->height;
         png_ptr->usr_width = png_ptr->width;
      }
   }
1969

G
Guy Schalnat 已提交
1970
   else
1971
#endif
G
Guy Schalnat 已提交
1972
   {
G
Guy Schalnat 已提交
1973 1974 1975 1976 1977
      png_ptr->num_rows = png_ptr->height;
      png_ptr->usr_width = png_ptr->width;
   }
}

A
Andreas Dilger 已提交
1978
/* Internal use only.  Called when finished processing a row of data. */
1979
void /* PRIVATE */
1980
png_write_finish_row(png_structrp png_ptr)
G
Guy Schalnat 已提交
1981
{
1982
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
1983
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
1984

1985
   /* Start of interlace block */
1986
   static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
1987

1988
   /* Offset to next interlace block */
1989
   static PNG_CONST png_byte png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
1990

1991
   /* Start of interlace block in the y direction */
1992
   static PNG_CONST png_byte png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
1993

1994
   /* Offset to next interlace block in the y direction */
1995
   static PNG_CONST png_byte png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
1996
#endif
1997

1998
   png_debug(1, "in png_write_finish_row");
1999

2000
   /* Next row */
G
Guy Schalnat 已提交
2001
   png_ptr->row_number++;
G
Guy Schalnat 已提交
2002

2003
   /* See if we are done */
G
Guy Schalnat 已提交
2004
   if (png_ptr->row_number < png_ptr->num_rows)
G
Guy Schalnat 已提交
2005
      return;
G
Guy Schalnat 已提交
2006

2007
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
2008
   /* If interlaced, go to next pass */
2009
   if (png_ptr->interlaced != 0)
G
Guy Schalnat 已提交
2010 2011
   {
      png_ptr->row_number = 0;
2012
      if ((png_ptr->transformations & PNG_INTERLACE) != 0)
G
Guy Schalnat 已提交
2013 2014 2015
      {
         png_ptr->pass++;
      }
2016

G
Guy Schalnat 已提交
2017 2018
      else
      {
2019
         /* Loop until we find a non-zero width or height pass */
G
Guy Schalnat 已提交
2020 2021 2022
         do
         {
            png_ptr->pass++;
2023

G
Guy Schalnat 已提交
2024 2025
            if (png_ptr->pass >= 7)
               break;
2026

G
Guy Schalnat 已提交
2027
            png_ptr->usr_width = (png_ptr->width +
2028 2029 2030
                png_pass_inc[png_ptr->pass] - 1 -
                png_pass_start[png_ptr->pass]) /
                png_pass_inc[png_ptr->pass];
2031

G
Guy Schalnat 已提交
2032
            png_ptr->num_rows = (png_ptr->height +
2033 2034 2035
                png_pass_yinc[png_ptr->pass] - 1 -
                png_pass_ystart[png_ptr->pass]) /
                png_pass_yinc[png_ptr->pass];
2036

2037
            if ((png_ptr->transformations & PNG_INTERLACE) != 0)
G
Guy Schalnat 已提交
2038
               break;
2039

G
Guy Schalnat 已提交
2040 2041 2042 2043
         } while (png_ptr->usr_width == 0 || png_ptr->num_rows == 0);

      }

2044
      /* Reset the row above the image for the next pass */
G
Guy Schalnat 已提交
2045
      if (png_ptr->pass < 7)
G
Guy Schalnat 已提交
2046
      {
A
Andreas Dilger 已提交
2047
         if (png_ptr->prev_row != NULL)
2048
            memset(png_ptr->prev_row, 0,
2049 2050
                (png_size_t)(PNG_ROWBYTES(png_ptr->usr_channels*
                png_ptr->usr_bit_depth, png_ptr->width)) + 1);
2051

G
Guy Schalnat 已提交
2052
         return;
G
Guy Schalnat 已提交
2053
      }
G
Guy Schalnat 已提交
2054
   }
2055
#endif
G
Guy Schalnat 已提交
2056

2057
   /* If we get here, we've just written the last row, so we need
G
Guy Schalnat 已提交
2058
      to flush the compressor */
2059
   png_compress_IDAT(png_ptr, NULL, 0, Z_FINISH);
G
Guy Schalnat 已提交
2060 2061
}

2062
#ifdef PNG_WRITE_INTERLACING_SUPPORTED
2063 2064 2065 2066 2067 2068 2069
/* Pick out the correct pixels for the interlace pass.
 * The basic idea here is to go through the row with a source
 * pointer and a destination pointer (sp and dp), and copy the
 * correct pixels for the pass.  As the row gets compacted,
 * sp will always be >= dp, so we should never overwrite anything.
 * See the default: case for the easiest code to understand.
 */
2070
void /* PRIVATE */
G
Guy Schalnat 已提交
2071
png_do_write_interlace(png_row_infop row_info, png_bytep row, int pass)
G
Guy Schalnat 已提交
2072
{
2073
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
2074

2075
   /* Start of interlace block */
2076
   static PNG_CONST png_byte png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
2077

2078
   /* Offset to next interlace block */
2079
   static PNG_CONST png_byte  png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
2080

2081
   png_debug(1, "in png_do_write_interlace");
2082

2083
   /* We don't have to do anything on the last pass (6) */
A
Andreas Dilger 已提交
2084
   if (pass < 6)
G
Guy Schalnat 已提交
2085
   {
2086
      /* Each pixel depth is handled separately */
G
Guy Schalnat 已提交
2087
      switch (row_info->pixel_depth)
G
Guy Schalnat 已提交
2088
      {
G
Guy Schalnat 已提交
2089 2090
         case 1:
         {
G
Guy Schalnat 已提交
2091 2092
            png_bytep sp;
            png_bytep dp;
2093
            unsigned int shift;
G
Guy Schalnat 已提交
2094 2095
            int d;
            int value;
2096 2097
            png_uint_32 i;
            png_uint_32 row_width = row_info->width;
G
Guy Schalnat 已提交
2098 2099 2100 2101

            dp = row;
            d = 0;
            shift = 7;
2102

2103
            for (i = png_pass_start[pass]; i < row_width;
G
Guy Schalnat 已提交
2104 2105 2106
               i += png_pass_inc[pass])
            {
               sp = row + (png_size_t)(i >> 3);
2107
               value = (int)(*sp >> (7 - (int)(i & 0x07))) & 0x01;
G
Guy Schalnat 已提交
2108 2109 2110 2111 2112
               d |= (value << shift);

               if (shift == 0)
               {
                  shift = 7;
2113
                  *dp++ = (png_byte)d;
G
Guy Schalnat 已提交
2114 2115
                  d = 0;
               }
2116

G
Guy Schalnat 已提交
2117 2118 2119 2120 2121
               else
                  shift--;

            }
            if (shift != 7)
2122
               *dp = (png_byte)d;
2123

G
Guy Schalnat 已提交
2124 2125
            break;
         }
2126

G
Guy Schalnat 已提交
2127
         case 2:
G
Guy Schalnat 已提交
2128
         {
G
Guy Schalnat 已提交
2129 2130
            png_bytep sp;
            png_bytep dp;
2131
            unsigned int shift;
G
Guy Schalnat 已提交
2132 2133
            int d;
            int value;
2134 2135
            png_uint_32 i;
            png_uint_32 row_width = row_info->width;
G
Guy Schalnat 已提交
2136 2137 2138 2139

            dp = row;
            shift = 6;
            d = 0;
2140

2141
            for (i = png_pass_start[pass]; i < row_width;
G
Guy Schalnat 已提交
2142 2143 2144
               i += png_pass_inc[pass])
            {
               sp = row + (png_size_t)(i >> 2);
2145
               value = (*sp >> ((3 - (int)(i & 0x03)) << 1)) & 0x03;
G
Guy Schalnat 已提交
2146 2147 2148 2149 2150
               d |= (value << shift);

               if (shift == 0)
               {
                  shift = 6;
2151
                  *dp++ = (png_byte)d;
G
Guy Schalnat 已提交
2152 2153
                  d = 0;
               }
2154

G
Guy Schalnat 已提交
2155 2156 2157 2158
               else
                  shift -= 2;
            }
            if (shift != 6)
2159
               *dp = (png_byte)d;
2160

G
Guy Schalnat 已提交
2161 2162
            break;
         }
2163

G
Guy Schalnat 已提交
2164 2165
         case 4:
         {
G
Guy Schalnat 已提交
2166 2167
            png_bytep sp;
            png_bytep dp;
2168
            unsigned int shift;
G
Guy Schalnat 已提交
2169 2170
            int d;
            int value;
2171 2172
            png_uint_32 i;
            png_uint_32 row_width = row_info->width;
G
Guy Schalnat 已提交
2173 2174 2175 2176

            dp = row;
            shift = 4;
            d = 0;
2177
            for (i = png_pass_start[pass]; i < row_width;
2178
                i += png_pass_inc[pass])
G
Guy Schalnat 已提交
2179 2180
            {
               sp = row + (png_size_t)(i >> 1);
2181
               value = (*sp >> ((1 - (int)(i & 0x01)) << 2)) & 0x0f;
G
Guy Schalnat 已提交
2182 2183 2184 2185
               d |= (value << shift);

               if (shift == 0)
               {
G
Guy Schalnat 已提交
2186
                  shift = 4;
2187
                  *dp++ = (png_byte)d;
G
Guy Schalnat 已提交
2188 2189
                  d = 0;
               }
2190

G
Guy Schalnat 已提交
2191 2192 2193 2194
               else
                  shift -= 4;
            }
            if (shift != 4)
2195
               *dp = (png_byte)d;
2196

G
Guy Schalnat 已提交
2197 2198
            break;
         }
2199

G
Guy Schalnat 已提交
2200 2201
         default:
         {
G
Guy Schalnat 已提交
2202 2203
            png_bytep sp;
            png_bytep dp;
2204 2205
            png_uint_32 i;
            png_uint_32 row_width = row_info->width;
A
Andreas Dilger 已提交
2206
            png_size_t pixel_bytes;
G
Guy Schalnat 已提交
2207

2208
            /* Start at the beginning */
G
Guy Schalnat 已提交
2209
            dp = row;
2210

2211
            /* Find out how many bytes each pixel takes up */
G
Guy Schalnat 已提交
2212
            pixel_bytes = (row_info->pixel_depth >> 3);
2213 2214

            /* Loop through the row, only looking at the pixels that matter */
2215
            for (i = png_pass_start[pass]; i < row_width;
G
Guy Schalnat 已提交
2216 2217
               i += png_pass_inc[pass])
            {
2218
               /* Find out where the original pixel is */
2219
               sp = row + (png_size_t)i * pixel_bytes;
2220

2221
               /* Move the pixel */
G
Guy Schalnat 已提交
2222
               if (dp != sp)
2223
                  memcpy(dp, sp, pixel_bytes);
2224

2225
               /* Next pixel */
G
Guy Schalnat 已提交
2226 2227
               dp += pixel_bytes;
            }
G
Guy Schalnat 已提交
2228
            break;
G
Guy Schalnat 已提交
2229 2230
         }
      }
2231
      /* Set new row width */
G
Guy Schalnat 已提交
2232
      row_info->width = (row_info->width +
2233 2234 2235
          png_pass_inc[pass] - 1 -
          png_pass_start[pass]) /
          png_pass_inc[pass];
2236

2237 2238
      row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,
          row_info->width);
G
Guy Schalnat 已提交
2239 2240
   }
}
G
Guy Schalnat 已提交
2241
#endif
G
Guy Schalnat 已提交
2242

2243

A
Andreas Dilger 已提交
2244 2245
/* This filters the row, chooses which filter to use, if it has not already
 * been specified by the application, and then writes the row out with the
2246 2247
 * chosen filter.
 */
2248
static void /* PRIVATE */
2249
png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
2250
    png_size_t row_bytes);
2251

2252 2253 2254 2255 2256 2257 2258 2259
#ifdef PNG_WRITE_FILTER_SUPPORTED
static png_size_t /* PRIVATE */
png_setup_sub_row(png_structrp png_ptr, const png_uint_32 bpp,
    const png_size_t row_bytes, const png_size_t lmins)
{
   png_bytep rp, dp, lp;
   png_size_t i;
   png_size_t sum = 0;
2260
   unsigned int v;
2261 2262 2263 2264 2265 2266 2267

   png_ptr->try_row[0] = PNG_FILTER_VALUE_SUB;

   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1; i < bpp;
        i++, rp++, dp++)
   {
      v = *dp = *rp;
2268
#ifdef PNG_USE_ABS
2269
      sum += 128 - abs((int)v - 128);
2270
#else
2271
      sum += (v < 128) ? v : 256 - v;
2272
#endif
2273 2274 2275 2276 2277 2278
   }

   for (lp = png_ptr->row_buf + 1; i < row_bytes;
      i++, rp++, lp++, dp++)
   {
      v = *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);
2279
#ifdef PNG_USE_ABS
2280
      sum += 128 - abs((int)v - 128);
2281
#else
2282
      sum += (v < 128) ? v : 256 - v;
2283
#endif
2284 2285 2286 2287 2288 2289 2290 2291

      if (sum > lmins)  /* We are already worse, don't continue. */
        break;
   }

   return (sum);
}

2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313
static void /* PRIVATE */
png_setup_sub_row_only(png_structrp png_ptr, const png_uint_32 bpp,
    const png_size_t row_bytes)
{
   png_bytep rp, dp, lp;
   png_size_t i;

   png_ptr->try_row[0] = PNG_FILTER_VALUE_SUB;

   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1; i < bpp;
        i++, rp++, dp++)
   {
      *dp = *rp;
   }

   for (lp = png_ptr->row_buf + 1; i < row_bytes;
      i++, rp++, lp++, dp++)
   {
      *dp = (png_byte)(((int)*rp - (int)*lp) & 0xff);
   }
}

2314 2315 2316 2317 2318 2319 2320
static png_size_t /* PRIVATE */
png_setup_up_row(png_structrp png_ptr, const png_size_t row_bytes,
    const png_size_t lmins)
{
   png_bytep rp, dp, pp;
   png_size_t i;
   png_size_t sum = 0;
2321
   unsigned int v;
2322 2323 2324 2325 2326 2327 2328 2329

   png_ptr->try_row[0] = PNG_FILTER_VALUE_UP;

   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
       pp = png_ptr->prev_row + 1; i < row_bytes;
       i++, rp++, pp++, dp++)
   {
      v = *dp = (png_byte)(((int)*rp - (int)*pp) & 0xff);
2330
#ifdef PNG_USE_ABS
2331
      sum += 128 - abs((int)v - 128);
2332
#else
2333
      sum += (v < 128) ? v : 256 - v;
2334
#endif
2335 2336 2337 2338 2339 2340 2341

      if (sum > lmins)  /* We are already worse, don't continue. */
        break;
   }

   return (sum);
}
2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356
static void /* PRIVATE */
png_setup_up_row_only(png_structrp png_ptr, const png_size_t row_bytes)
{
   png_bytep rp, dp, pp;
   png_size_t i;

   png_ptr->try_row[0] = PNG_FILTER_VALUE_UP;

   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
       pp = png_ptr->prev_row + 1; i < row_bytes;
       i++, rp++, pp++, dp++)
   {
      *dp = (png_byte)(((int)*rp - (int)*pp) & 0xff);
   }
}
2357 2358 2359

static png_size_t /* PRIVATE */
png_setup_avg_row(png_structrp png_ptr, const png_uint_32 bpp,
2360
    const png_size_t row_bytes, const png_size_t lmins)
2361 2362 2363 2364
{
   png_bytep rp, dp, pp, lp;
   png_uint_32 i;
   png_size_t sum = 0;
2365
   unsigned int v;
2366 2367 2368 2369

   png_ptr->try_row[0] = PNG_FILTER_VALUE_AVG;

   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2370
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2371 2372 2373
   {
      v = *dp++ = (png_byte)(((int)*rp++ - ((int)*pp++ / 2)) & 0xff);

2374
#ifdef PNG_USE_ABS
2375
      sum += 128 - abs((int)v - 128);
2376
#else
2377
      sum += (v < 128) ? v : 256 - v;
2378
#endif
2379 2380 2381 2382 2383 2384 2385
   }

   for (lp = png_ptr->row_buf + 1; i < row_bytes; i++)
   {
      v = *dp++ = (png_byte)(((int)*rp++ - (((int)*pp++ + (int)*lp++) / 2))
          & 0xff);

2386
#ifdef PNG_USE_ABS
2387
      sum += 128 - abs((int)v - 128);
2388
#else
2389
      sum += (v < 128) ? v : 256 - v;
2390
#endif
2391 2392 2393 2394 2395 2396 2397

      if (sum > lmins)  /* We are already worse, don't continue. */
        break;
   }

   return (sum);
}
2398 2399
static void /* PRIVATE */
png_setup_avg_row_only(png_structrp png_ptr, const png_uint_32 bpp,
2400
    const png_size_t row_bytes)
2401 2402 2403 2404 2405 2406 2407
{
   png_bytep rp, dp, pp, lp;
   png_uint_32 i;

   png_ptr->try_row[0] = PNG_FILTER_VALUE_AVG;

   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
2408
       pp = png_ptr->prev_row + 1; i < bpp; i++)
2409 2410 2411 2412 2413 2414 2415 2416 2417 2418
   {
      *dp++ = (png_byte)(((int)*rp++ - ((int)*pp++ / 2)) & 0xff);
   }

   for (lp = png_ptr->row_buf + 1; i < row_bytes; i++)
   {
      *dp++ = (png_byte)(((int)*rp++ - (((int)*pp++ + (int)*lp++) / 2))
          & 0xff);
   }
}
2419 2420 2421 2422 2423 2424 2425 2426

static png_size_t /* PRIVATE */
png_setup_paeth_row(png_structrp png_ptr, const png_uint_32 bpp,
    const png_size_t row_bytes, const png_size_t lmins)
{
   png_bytep rp, dp, pp, cp, lp;
   png_size_t i;
   png_size_t sum = 0;
2427
   unsigned int v;
2428 2429 2430 2431 2432 2433 2434 2435

   png_ptr->try_row[0] = PNG_FILTER_VALUE_PAETH;

   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
       pp = png_ptr->prev_row + 1; i < bpp; i++)
   {
      v = *dp++ = (png_byte)(((int)*rp++ - (int)*pp++) & 0xff);

2436
#ifdef PNG_USE_ABS
2437
      sum += 128 - abs((int)v - 128);
2438
#else
2439
      sum += (v < 128) ? v : 256 - v;
2440
#endif
2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468
   }

   for (lp = png_ptr->row_buf + 1, cp = png_ptr->prev_row + 1; i < row_bytes;
        i++)
   {
      int a, b, c, pa, pb, pc, p;

      b = *pp++;
      c = *cp++;
      a = *lp++;

      p = b - c;
      pc = a - c;

#ifdef PNG_USE_ABS
      pa = abs(p);
      pb = abs(pc);
      pc = abs(p + pc);
#else
      pa = p < 0 ? -p : p;
      pb = pc < 0 ? -pc : pc;
      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
#endif

      p = (pa <= pb && pa <=pc) ? a : (pb <= pc) ? b : c;

      v = *dp++ = (png_byte)(((int)*rp++ - p) & 0xff);

2469
#ifdef PNG_USE_ABS
2470
      sum += 128 - abs((int)v - 128);
2471
#else
2472
      sum += (v < 128) ? v : 256 - v;
2473
#endif
2474 2475 2476 2477 2478 2479 2480

      if (sum > lmins)  /* We are already worse, don't continue. */
        break;
   }

   return (sum);
}
2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522
static void /* PRIVATE */
png_setup_paeth_row_only(png_structrp png_ptr, const png_uint_32 bpp,
    const png_size_t row_bytes)
{
   png_bytep rp, dp, pp, cp, lp;
   png_size_t i;

   png_ptr->try_row[0] = PNG_FILTER_VALUE_PAETH;

   for (i = 0, rp = png_ptr->row_buf + 1, dp = png_ptr->try_row + 1,
       pp = png_ptr->prev_row + 1; i < bpp; i++)
   {
      *dp++ = (png_byte)(((int)*rp++ - (int)*pp++) & 0xff);
   }

   for (lp = png_ptr->row_buf + 1, cp = png_ptr->prev_row + 1; i < row_bytes;
        i++)
   {
      int a, b, c, pa, pb, pc, p;

      b = *pp++;
      c = *cp++;
      a = *lp++;

      p = b - c;
      pc = a - c;

#ifdef PNG_USE_ABS
      pa = abs(p);
      pb = abs(pc);
      pc = abs(p + pc);
#else
      pa = p < 0 ? -p : p;
      pb = pc < 0 ? -pc : pc;
      pc = (p + pc) < 0 ? -(p + pc) : p + pc;
#endif

      p = (pa <= pb && pa <=pc) ? a : (pb <= pc) ? b : c;

      *dp++ = (png_byte)(((int)*rp++ - p) & 0xff);
   }
}
2523 2524
#endif /* WRITE_FILTER */

2525
void /* PRIVATE */
2526
png_write_find_filter(png_structrp png_ptr, png_row_infop row_info)
G
Guy Schalnat 已提交
2527
{
2528 2529 2530
#ifndef PNG_WRITE_FILTER_SUPPORTED
   png_write_filtered_row(png_ptr, png_ptr->row_buf, row_info->rowbytes+1);
#else
2531
   unsigned int filter_to_do = png_ptr->do_filter;
2532 2533 2534 2535 2536
   png_bytep row_buf;
   png_bytep best_row;
   png_uint_32 bpp;
   png_size_t mins;
   png_size_t row_bytes = row_info->rowbytes;
2537 2538 2539

   png_debug(1, "in png_write_find_filter");

2540
   /* Find out how many bytes offset each pixel is */
2541
   bpp = (row_info->pixel_depth + 7) >> 3;
G
Guy Schalnat 已提交
2542

2543 2544 2545
   row_buf = png_ptr->row_buf;
   mins = PNG_SIZE_MAX - 256/* so we can detect potential overflow of the
                               running sum */;
A
Andreas Dilger 已提交
2546 2547 2548

   /* The prediction method we use is to find which method provides the
    * smallest value when summing the absolute values of the distances
2549
    * from zero, using anything >= 128 as negative numbers.  This is known
A
Andreas Dilger 已提交
2550
    * as the "minimum sum of absolute differences" heuristic.  Other
2551
    * heuristics are the "weighted minimum sum of absolute differences"
A
Andreas Dilger 已提交
2552
    * (experimental and can in theory improve compression), and the "zlib
2553 2554 2555
    * predictive" method (not implemented yet), which does test compressions
    * of lines using different filter methods, and then chooses the
    * (series of) filter(s) that give minimum compressed data size (VERY
A
Andreas Dilger 已提交
2556
    * computationally expensive).
2557 2558
    *
    * GRR 980525:  consider also
2559
    *
2560 2561 2562
    *   (1) minimum sum of absolute differences from running average (i.e.,
    *       keep running sum of non-absolute differences & count of bytes)
    *       [track dispersion, too?  restart average if dispersion too large?]
2563
    *
2564 2565
    *  (1b) minimum sum of absolute differences from sliding average, probably
    *       with window size <= deflate window (usually 32K)
2566
    *
2567 2568
    *   (2) minimum sum of squared differences from zero or running average
    *       (i.e., ~ root-mean-square approach)
A
Andreas Dilger 已提交
2569
    */
G
Guy Schalnat 已提交
2570

2571

G
Guy Schalnat 已提交
2572
   /* We don't need to test the 'no filter' case if this is the only filter
A
Andreas Dilger 已提交
2573 2574
    * that has been chosen, as it doesn't actually do anything to the data.
    */
2575 2576
   best_row = png_ptr->row_buf;

2577 2578 2579 2580 2581
   if (PNG_SIZE_MAX/128 <= row_bytes)
   {
      /* Overflow can occur in the calculation, just select the lowest set
       * filter.
       */
2582
      filter_to_do &= 0U-filter_to_do;
2583 2584 2585
   }
   else if ((filter_to_do & PNG_FILTER_NONE) != 0 &&
         filter_to_do != PNG_FILTER_NONE)
G
Guy Schalnat 已提交
2586
   {
2587 2588 2589
      /* Overflow not possible and multiple filters in the list, including the
       * 'none' filter.
       */
G
Guy Schalnat 已提交
2590
      png_bytep rp;
2591
      png_size_t sum = 0;
2592
      png_size_t i;
2593
      unsigned int v;
G
Guy Schalnat 已提交
2594

2595 2596 2597 2598
      {
         for (i = 0, rp = row_buf + 1; i < row_bytes; i++, rp++)
         {
            v = *rp;
2599
#ifdef PNG_USE_ABS
2600
            sum += 128 - abs((int)v - 128);
2601
#else
2602
            sum += (v < 128) ? v : 256 - v;
2603
#endif
2604 2605 2606
         }
      }

G
Guy Schalnat 已提交
2607 2608
      mins = sum;
   }
G
Guy Schalnat 已提交
2609

2610
   /* Sub filter */
2611
   if (filter_to_do == PNG_FILTER_SUB)
2612
   /* It's the only filter so no testing is needed */
2613
   {
2614
      png_setup_sub_row_only(png_ptr, bpp, row_bytes);
2615
      best_row = png_ptr->try_row;
2616 2617
   }

2618
   else if ((filter_to_do & PNG_FILTER_SUB) != 0)
G
Guy Schalnat 已提交
2619
   {
2620 2621
      png_size_t sum;
      png_size_t lmins = mins;
G
Guy Schalnat 已提交
2622

2623
      sum = png_setup_sub_row(png_ptr, bpp, row_bytes, lmins);
A
Andreas Dilger 已提交
2624

G
Guy Schalnat 已提交
2625 2626 2627
      if (sum < mins)
      {
         mins = sum;
2628 2629 2630 2631 2632 2633
         best_row = png_ptr->try_row;
         if (png_ptr->tst_row != NULL)
         {
            png_ptr->try_row = png_ptr->tst_row;
            png_ptr->tst_row = best_row;
         }
G
Guy Schalnat 已提交
2634
      }
G
Guy Schalnat 已提交
2635 2636
   }

2637
   /* Up filter */
2638 2639
   if (filter_to_do == PNG_FILTER_UP)
   {
2640
      png_setup_up_row_only(png_ptr, row_bytes);
2641
      best_row = png_ptr->try_row;
2642 2643
   }

2644
   else if ((filter_to_do & PNG_FILTER_UP) != 0)
G
Guy Schalnat 已提交
2645
   {
2646 2647
      png_size_t sum;
      png_size_t lmins = mins;
G
Guy Schalnat 已提交
2648

2649
      sum = png_setup_up_row(png_ptr, row_bytes, lmins);
A
Andreas Dilger 已提交
2650

G
Guy Schalnat 已提交
2651 2652 2653
      if (sum < mins)
      {
         mins = sum;
2654 2655 2656 2657 2658 2659
         best_row = png_ptr->try_row;
         if (png_ptr->tst_row != NULL)
         {
            png_ptr->try_row = png_ptr->tst_row;
            png_ptr->tst_row = best_row;
         }
G
Guy Schalnat 已提交
2660 2661 2662
      }
   }

2663
   /* Avg filter */
2664 2665
   if (filter_to_do == PNG_FILTER_AVG)
   {
2666
      png_setup_avg_row_only(png_ptr, bpp, row_bytes);
2667
      best_row = png_ptr->try_row;
2668 2669
   }

2670
   else if ((filter_to_do & PNG_FILTER_AVG) != 0)
G
Guy Schalnat 已提交
2671
   {
2672 2673
      png_size_t sum;
      png_size_t lmins = mins;
G
Guy Schalnat 已提交
2674

2675
      sum= png_setup_avg_row(png_ptr, bpp, row_bytes, lmins);
A
Andreas Dilger 已提交
2676

G
Guy Schalnat 已提交
2677 2678 2679
      if (sum < mins)
      {
         mins = sum;
2680 2681 2682 2683 2684 2685
         best_row = png_ptr->try_row;
         if (png_ptr->tst_row != NULL)
         {
            png_ptr->try_row = png_ptr->tst_row;
            png_ptr->tst_row = best_row;
         }
G
Guy Schalnat 已提交
2686 2687
      }
   }
G
Guy Schalnat 已提交
2688

A
Andreas Dilger 已提交
2689
   /* Paeth filter */
2690
   if (filter_to_do == PNG_FILTER_PAETH)
2691
   {
2692
      png_setup_paeth_row_only(png_ptr, bpp, row_bytes);
2693
      best_row = png_ptr->try_row;
2694 2695
   }

2696
   else if ((filter_to_do & PNG_FILTER_PAETH) != 0)
G
Guy Schalnat 已提交
2697
   {
2698 2699
      png_size_t sum;
      png_size_t lmins = mins;
G
Guy Schalnat 已提交
2700

2701
      sum = png_setup_paeth_row(png_ptr, bpp, row_bytes, lmins);
A
Andreas Dilger 已提交
2702

G
Guy Schalnat 已提交
2703 2704
      if (sum < mins)
      {
2705 2706 2707 2708 2709 2710
         best_row = png_ptr->try_row;
         if (png_ptr->tst_row != NULL)
         {
            png_ptr->try_row = png_ptr->tst_row;
            png_ptr->tst_row = best_row;
         }
G
Guy Schalnat 已提交
2711
      }
G
Guy Schalnat 已提交
2712
   }
2713

2714 2715
   /* Do the actual writing of the filtered row data from the chosen filter. */
   png_write_filtered_row(png_ptr, best_row, row_info->rowbytes+1);
A
Andreas Dilger 已提交
2716

2717
#endif /* WRITE_FILTER */
G
Guy Schalnat 已提交
2718
}
G
Guy Schalnat 已提交
2719

G
Guy Schalnat 已提交
2720

A
Andreas Dilger 已提交
2721
/* Do the actual writing of a previously filtered row. */
2722
static void
2723
png_write_filtered_row(png_structrp png_ptr, png_bytep filtered_row,
2724
    png_size_t full_row_length/*includes filter byte*/)
G
Guy Schalnat 已提交
2725
{
2726
   png_debug(1, "in png_write_filtered_row");
2727

2728
   png_debug1(2, "filter = %d", filtered_row[0]);
2729

2730
   png_compress_IDAT(png_ptr, filtered_row, full_row_length, Z_NO_FLUSH);
G
Guy Schalnat 已提交
2731

2732
#ifdef PNG_WRITE_FILTER_SUPPORTED
2733
   /* Swap the current and previous rows */
A
Andreas Dilger 已提交
2734
   if (png_ptr->prev_row != NULL)
G
Guy Schalnat 已提交
2735 2736 2737 2738 2739 2740 2741
   {
      png_bytep tptr;

      tptr = png_ptr->prev_row;
      png_ptr->prev_row = png_ptr->row_buf;
      png_ptr->row_buf = tptr;
   }
2742
#endif /* WRITE_FILTER */
G
Guy Schalnat 已提交
2743

2744
   /* Finish row - updates counters and flushes zlib if last row */
G
Guy Schalnat 已提交
2745
   png_write_finish_row(png_ptr);
G
Guy Schalnat 已提交
2746

2747
#ifdef PNG_WRITE_FLUSH_SUPPORTED
G
Guy Schalnat 已提交
2748 2749 2750 2751 2752 2753
   png_ptr->flush_rows++;

   if (png_ptr->flush_dist > 0 &&
       png_ptr->flush_rows >= png_ptr->flush_dist)
   {
      png_write_flush(png_ptr);
G
Guy Schalnat 已提交
2754
   }
2755
#endif /* WRITE_FLUSH */
G
Guy Schalnat 已提交
2756
}
2757
#endif /* WRITE */