pngset.c 45.7 KB
Newer Older
A
Andreas Dilger 已提交
1 2

/* pngset.c - storage of image information into info struct
3
 *
4
 * Last changed in libpng 1.6.11 [June 5, 2014]
5
 * Copyright (c) 1998-2014 Glenn Randers-Pehrson
6 7
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
8
 *
9
 * This code is released under the libpng license.
10
 * For conditions of distribution and use, see the disclaimer
11
 * and license in png.h
12
 *
13 14 15 16 17
 * The functions here are used during reads to store data from the file
 * into the info struct, and during writes to store application data
 * into the info struct for writing into the file.  This abstracts the
 * info struct and allows us to change the structure in the future.
 */
A
Andreas Dilger 已提交
18

19
#include "pngpriv.h"
20

21 22
#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

23
#ifdef PNG_bKGD_SUPPORTED
24
void PNGAPI
25
png_set_bKGD(png_const_structrp png_ptr, png_inforp info_ptr,
26
    png_const_color_16p background)
A
Andreas Dilger 已提交
27
{
28
   png_debug1(1, "in %s storage function", "bKGD");
29

30
   if (png_ptr == NULL || info_ptr == NULL || background == NULL)
A
Andreas Dilger 已提交
31 32
      return;

33
   info_ptr->background = *background;
A
Andreas Dilger 已提交
34 35 36 37
   info_ptr->valid |= PNG_INFO_bKGD;
}
#endif

38
#ifdef PNG_cHRM_SUPPORTED
G
[devel]  
Glenn Randers-Pehrson 已提交
39
void PNGFAPI
40
png_set_cHRM_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
41 42 43
    png_fixed_point white_x, png_fixed_point white_y, png_fixed_point red_x,
    png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y,
    png_fixed_point blue_x, png_fixed_point blue_y)
44
{
45 46
   png_xy xy;

47
   png_debug1(1, "in %s storage function", "cHRM fixed");
48

49 50
   if (png_ptr == NULL || info_ptr == NULL)
      return;
A
Andreas Dilger 已提交
51

52 53 54 55 56 57 58 59 60 61 62 63 64 65
   xy.redx = red_x;
   xy.redy = red_y;
   xy.greenx = green_x;
   xy.greeny = green_y;
   xy.bluex = blue_x;
   xy.bluey = blue_y;
   xy.whitex = white_x;
   xy.whitey = white_y;

   if (png_colorspace_set_chromaticities(png_ptr, &info_ptr->colorspace, &xy,
      2/* override with app values*/))
      info_ptr->colorspace.flags |= PNG_COLORSPACE_FROM_cHRM;

   png_colorspace_sync_info(png_ptr, info_ptr);
66 67
}

68
void PNGFAPI
69
png_set_cHRM_XYZ_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
70 71 72 73 74 75 76 77 78 79 80 81 82
    png_fixed_point int_red_X, png_fixed_point int_red_Y,
    png_fixed_point int_red_Z, png_fixed_point int_green_X,
    png_fixed_point int_green_Y, png_fixed_point int_green_Z,
    png_fixed_point int_blue_X, png_fixed_point int_blue_Y,
    png_fixed_point int_blue_Z)
{
   png_XYZ XYZ;

   png_debug1(1, "in %s storage function", "cHRM XYZ fixed");

   if (png_ptr == NULL || info_ptr == NULL)
      return;

83 84 85 86 87 88 89 90 91 92 93 94 95 96
   XYZ.red_X = int_red_X;
   XYZ.red_Y = int_red_Y;
   XYZ.red_Z = int_red_Z;
   XYZ.green_X = int_green_X;
   XYZ.green_Y = int_green_Y;
   XYZ.green_Z = int_green_Z;
   XYZ.blue_X = int_blue_X;
   XYZ.blue_Y = int_blue_Y;
   XYZ.blue_Z = int_blue_Z;

   if (png_colorspace_set_endpoints(png_ptr, &info_ptr->colorspace, &XYZ, 2))
      info_ptr->colorspace.flags |= PNG_COLORSPACE_FROM_cHRM;

   png_colorspace_sync_info(png_ptr, info_ptr);
97 98
}

99
#  ifdef PNG_FLOATING_POINT_SUPPORTED
100
void PNGAPI
101
png_set_cHRM(png_const_structrp png_ptr, png_inforp info_ptr,
G
[devel]  
Glenn Randers-Pehrson 已提交
102 103
    double white_x, double white_y, double red_x, double red_y,
    double green_x, double green_y, double blue_x, double blue_y)
A
Andreas Dilger 已提交
104
{
G
[devel]  
Glenn Randers-Pehrson 已提交
105 106 107 108 109 110 111 112 113 114
   png_set_cHRM_fixed(png_ptr, info_ptr,
      png_fixed(png_ptr, white_x, "cHRM White X"),
      png_fixed(png_ptr, white_y, "cHRM White Y"),
      png_fixed(png_ptr, red_x, "cHRM Red X"),
      png_fixed(png_ptr, red_y, "cHRM Red Y"),
      png_fixed(png_ptr, green_x, "cHRM Green X"),
      png_fixed(png_ptr, green_y, "cHRM Green Y"),
      png_fixed(png_ptr, blue_x, "cHRM Blue X"),
      png_fixed(png_ptr, blue_y, "cHRM Blue Y"));
}
115 116

void PNGAPI
117
png_set_cHRM_XYZ(png_const_structrp png_ptr, png_inforp info_ptr, double red_X,
118 119 120 121 122 123 124 125 126 127 128 129 130 131
    double red_Y, double red_Z, double green_X, double green_Y, double green_Z,
    double blue_X, double blue_Y, double blue_Z)
{
   png_set_cHRM_XYZ_fixed(png_ptr, info_ptr,
      png_fixed(png_ptr, red_X, "cHRM Red X"),
      png_fixed(png_ptr, red_Y, "cHRM Red Y"),
      png_fixed(png_ptr, red_Z, "cHRM Red Z"),
      png_fixed(png_ptr, green_X, "cHRM Red X"),
      png_fixed(png_ptr, green_Y, "cHRM Red Y"),
      png_fixed(png_ptr, green_Z, "cHRM Red Z"),
      png_fixed(png_ptr, blue_X, "cHRM Red X"),
      png_fixed(png_ptr, blue_Y, "cHRM Red Y"),
      png_fixed(png_ptr, blue_Z, "cHRM Red Z"));
}
132
#  endif /* PNG_FLOATING_POINT_SUPPORTED */
133

G
[devel]  
Glenn Randers-Pehrson 已提交
134
#endif /* PNG_cHRM_SUPPORTED */
135

G
[devel]  
Glenn Randers-Pehrson 已提交
136 137
#ifdef PNG_gAMA_SUPPORTED
void PNGFAPI
138 139
png_set_gAMA_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
    png_fixed_point file_gamma)
140
{
141
   png_debug1(1, "in %s storage function", "gAMA");
142

143 144 145
   if (png_ptr == NULL || info_ptr == NULL)
      return;

146 147
   png_colorspace_set_gamma(png_ptr, &info_ptr->colorspace, file_gamma);
   png_colorspace_sync_info(png_ptr, info_ptr);
G
[devel]  
Glenn Randers-Pehrson 已提交
148
}
149

150
#  ifdef PNG_FLOATING_POINT_SUPPORTED
G
[devel]  
Glenn Randers-Pehrson 已提交
151
void PNGAPI
152
png_set_gAMA(png_const_structrp png_ptr, png_inforp info_ptr, double file_gamma)
G
[devel]  
Glenn Randers-Pehrson 已提交
153 154
{
   png_set_gAMA_fixed(png_ptr, info_ptr, png_fixed(png_ptr, file_gamma,
155
       "png_set_gAMA"));
A
Andreas Dilger 已提交
156
}
157
#  endif
158
#endif
A
Andreas Dilger 已提交
159

160
#ifdef PNG_hIST_SUPPORTED
161
void PNGAPI
162 163
png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
    png_const_uint_16p hist)
A
Andreas Dilger 已提交
164
{
165
   int i;
166

167
   png_debug1(1, "in %s storage function", "hIST");
168

169
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
170
      return;
171

172
   if (info_ptr->num_palette == 0 || info_ptr->num_palette
173
       > PNG_MAX_PALETTE_LENGTH)
174
   {
175
      png_warning(png_ptr,
176
          "Invalid palette size, hIST allocation skipped");
177

178
      return;
179
   }
180 181

   png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
182

183 184 185
   /* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in
    * version 1.2.1
    */
186
   info_ptr->hist = png_voidcast(png_uint_16p, png_malloc_warn(png_ptr,
187
       PNG_MAX_PALETTE_LENGTH * (sizeof (png_uint_16))));
188

189
   if (info_ptr->hist == NULL)
190 191 192 193
   {
      png_warning(png_ptr, "Insufficient memory for hIST chunk data");
      return;
   }
A
Andreas Dilger 已提交
194

195 196
   info_ptr->free_me |= PNG_FREE_HIST;

197
   for (i = 0; i < info_ptr->num_palette; i++)
198
      info_ptr->hist[i] = hist[i];
199

A
Andreas Dilger 已提交
200 201 202 203
   info_ptr->valid |= PNG_INFO_hIST;
}
#endif

204
void PNGAPI
205
png_set_IHDR(png_const_structrp png_ptr, png_inforp info_ptr,
206 207 208
    png_uint_32 width, png_uint_32 height, int bit_depth,
    int color_type, int interlace_type, int compression_type,
    int filter_type)
A
Andreas Dilger 已提交
209
{
210
   png_debug1(1, "in %s storage function", "IHDR");
211

212
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
213 214 215 216 217
      return;

   info_ptr->width = width;
   info_ptr->height = height;
   info_ptr->bit_depth = (png_byte)bit_depth;
218
   info_ptr->color_type = (png_byte)color_type;
A
Andreas Dilger 已提交
219 220 221
   info_ptr->compression_type = (png_byte)compression_type;
   info_ptr->filter_type = (png_byte)filter_type;
   info_ptr->interlace_type = (png_byte)interlace_type;
222 223 224 225 226

   png_check_IHDR (png_ptr, info_ptr->width, info_ptr->height,
       info_ptr->bit_depth, info_ptr->color_type, info_ptr->interlace_type,
       info_ptr->compression_type, info_ptr->filter_type);

227 228
   if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
      info_ptr->channels = 1;
229

230
   else if (info_ptr->color_type & PNG_COLOR_MASK_COLOR)
A
Andreas Dilger 已提交
231
      info_ptr->channels = 3;
232

A
Andreas Dilger 已提交
233 234
   else
      info_ptr->channels = 1;
235

A
Andreas Dilger 已提交
236 237
   if (info_ptr->color_type & PNG_COLOR_MASK_ALPHA)
      info_ptr->channels++;
238

A
Andreas Dilger 已提交
239
   info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
240

241
   info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
A
Andreas Dilger 已提交
242 243
}

244
#ifdef PNG_oFFs_SUPPORTED
245
void PNGAPI
246
png_set_oFFs(png_const_structrp png_ptr, png_inforp info_ptr,
247
    png_int_32 offset_x, png_int_32 offset_y, int unit_type)
A
Andreas Dilger 已提交
248
{
249
   png_debug1(1, "in %s storage function", "oFFs");
250

251
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
252 253 254 255 256 257 258 259 260
      return;

   info_ptr->x_offset = offset_x;
   info_ptr->y_offset = offset_y;
   info_ptr->offset_unit_type = (png_byte)unit_type;
   info_ptr->valid |= PNG_INFO_oFFs;
}
#endif

261
#ifdef PNG_pCAL_SUPPORTED
262
void PNGAPI
263
png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
264 265
    png_const_charp purpose, png_int_32 X0, png_int_32 X1, int type,
    int nparams, png_const_charp units, png_charpp params)
A
Andreas Dilger 已提交
266
{
267
   png_size_t length;
268
   int i;
A
Andreas Dilger 已提交
269

270
   png_debug1(1, "in %s storage function", "pCAL");
271

272 273
   if (png_ptr == NULL || info_ptr == NULL || purpose == NULL || units == NULL
      || (nparams > 0 && params == NULL))
A
Andreas Dilger 已提交
274 275
      return;

276
   length = strlen(purpose) + 1;
277
   png_debug1(3, "allocating purpose for info (%lu bytes)",
278
       (unsigned long)length);
279

G
[devel]  
Glenn Randers-Pehrson 已提交
280 281 282 283 284 285
   /* TODO: validate format of calibration name and unit name */

   /* Check that the type matches the specification. */
   if (type < 0 || type > 3)
      png_error(png_ptr, "Invalid pCAL equation type");

286 287 288
   if (nparams < 0 || nparams > 255)
      png_error(png_ptr, "Invalid pCAL parameter count");

G
[devel]  
Glenn Randers-Pehrson 已提交
289 290
   /* Validate params[nparams] */
   for (i=0; i<nparams; ++i)
291
      if (params[i] == NULL ||
292
         !png_check_fp_string(params[i], strlen(params[i])))
G
[devel]  
Glenn Randers-Pehrson 已提交
293 294
         png_error(png_ptr, "Invalid format for pCAL parameter");

295 296
   info_ptr->pcal_purpose = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, length));
297

298
   if (info_ptr->pcal_purpose == NULL)
299
   {
300
      png_warning(png_ptr, "Insufficient memory for pCAL purpose");
301 302
      return;
   }
303

304
   memcpy(info_ptr->pcal_purpose, purpose, length);
A
Andreas Dilger 已提交
305

306
   png_debug(3, "storing X0, X1, type, and nparams in info");
A
Andreas Dilger 已提交
307 308 309 310 311
   info_ptr->pcal_X0 = X0;
   info_ptr->pcal_X1 = X1;
   info_ptr->pcal_type = (png_byte)type;
   info_ptr->pcal_nparams = (png_byte)nparams;

312
   length = strlen(units) + 1;
313
   png_debug1(3, "allocating units for info (%lu bytes)",
314
     (unsigned long)length);
315

316 317
   info_ptr->pcal_units = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, length));
318

319
   if (info_ptr->pcal_units == NULL)
320
   {
321
      png_warning(png_ptr, "Insufficient memory for pCAL units");
322 323
      return;
   }
324

325
   memcpy(info_ptr->pcal_units, units, length);
A
Andreas Dilger 已提交
326

327
   info_ptr->pcal_params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
328
       (png_size_t)((nparams + 1) * (sizeof (png_charp)))));
329

330
   if (info_ptr->pcal_params == NULL)
331
   {
332
      png_warning(png_ptr, "Insufficient memory for pCAL params");
333 334
      return;
   }
335

336
   memset(info_ptr->pcal_params, 0, (nparams + 1) * (sizeof (png_charp)));
A
Andreas Dilger 已提交
337 338 339

   for (i = 0; i < nparams; i++)
   {
340
      length = strlen(params[i]) + 1;
341
      png_debug2(3, "allocating parameter %d for info (%lu bytes)", i,
342
          (unsigned long)length);
343

344
      info_ptr->pcal_params[i] = (png_charp)png_malloc_warn(png_ptr, length);
345

346
      if (info_ptr->pcal_params[i] == NULL)
347
      {
348 349
         png_warning(png_ptr, "Insufficient memory for pCAL parameter");
         return;
350
      }
351

352
      memcpy(info_ptr->pcal_params[i], params[i], length);
A
Andreas Dilger 已提交
353 354 355
   }

   info_ptr->valid |= PNG_INFO_pCAL;
356
   info_ptr->free_me |= PNG_FREE_PCAL;
A
Andreas Dilger 已提交
357 358 359
}
#endif

360
#ifdef PNG_sCAL_SUPPORTED
361
void PNGAPI
362
png_set_sCAL_s(png_const_structrp png_ptr, png_inforp info_ptr,
363
    int unit, png_const_charp swidth, png_const_charp sheight)
364
{
365
   png_size_t lengthw = 0, lengthh = 0;
366

367
   png_debug1(1, "in %s storage function", "sCAL");
368

369 370 371
   if (png_ptr == NULL || info_ptr == NULL)
      return;

G
[devel]  
Glenn Randers-Pehrson 已提交
372 373 374 375 376 377
   /* Double check the unit (should never get here with an invalid
    * unit unless this is an API call.)
    */
   if (unit != 1 && unit != 2)
      png_error(png_ptr, "Invalid sCAL unit");

378
   if (swidth == NULL || (lengthw = strlen(swidth)) == 0 ||
379
       swidth[0] == 45 /* '-' */ || !png_check_fp_string(swidth, lengthw))
G
[devel]  
Glenn Randers-Pehrson 已提交
380 381
      png_error(png_ptr, "Invalid sCAL width");

382
   if (sheight == NULL || (lengthh = strlen(sheight)) == 0 ||
383
       sheight[0] == 45 /* '-' */ || !png_check_fp_string(sheight, lengthh))
G
[devel]  
Glenn Randers-Pehrson 已提交
384 385
      png_error(png_ptr, "Invalid sCAL height");

386
   info_ptr->scal_unit = (png_byte)unit;
387

G
[devel]  
Glenn Randers-Pehrson 已提交
388
   ++lengthw;
389

390
   png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthw);
391

392 393
   info_ptr->scal_s_width = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, lengthw));
394

395 396
   if (info_ptr->scal_s_width == NULL)
   {
G
[devel]  
Glenn Randers-Pehrson 已提交
397
      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
398
      return;
399
   }
400

401
   memcpy(info_ptr->scal_s_width, swidth, lengthw);
402

G
[devel]  
Glenn Randers-Pehrson 已提交
403
   ++lengthh;
404

405
   png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthh);
406

407 408
   info_ptr->scal_s_height = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, lengthh));
409

410 411 412
   if (info_ptr->scal_s_height == NULL)
   {
      png_free (png_ptr, info_ptr->scal_s_width);
413
      info_ptr->scal_s_width = NULL;
414

G
[devel]  
Glenn Randers-Pehrson 已提交
415
      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
416
      return;
417
   }
418

419
   memcpy(info_ptr->scal_s_height, sheight, lengthh);
G
[devel]  
Glenn Randers-Pehrson 已提交
420

421
   info_ptr->valid |= PNG_INFO_sCAL;
422
   info_ptr->free_me |= PNG_FREE_SCAL;
423
}
G
[devel]  
Glenn Randers-Pehrson 已提交
424

425
#  ifdef PNG_FLOATING_POINT_SUPPORTED
G
[devel]  
Glenn Randers-Pehrson 已提交
426
void PNGAPI
427 428
png_set_sCAL(png_const_structrp png_ptr, png_inforp info_ptr, int unit,
    double width, double height)
G
[devel]  
Glenn Randers-Pehrson 已提交
429 430 431 432 433 434
{
   png_debug1(1, "in %s storage function", "sCAL");

   /* Check the arguments. */
   if (width <= 0)
      png_warning(png_ptr, "Invalid sCAL width ignored");
435

G
[devel]  
Glenn Randers-Pehrson 已提交
436 437
   else if (height <= 0)
      png_warning(png_ptr, "Invalid sCAL height ignored");
438

G
[devel]  
Glenn Randers-Pehrson 已提交
439 440 441 442 443 444
   else
   {
      /* Convert 'width' and 'height' to ASCII. */
      char swidth[PNG_sCAL_MAX_DIGITS+1];
      char sheight[PNG_sCAL_MAX_DIGITS+1];

445
      png_ascii_from_fp(png_ptr, swidth, (sizeof swidth), width,
G
[devel]  
Glenn Randers-Pehrson 已提交
446
         PNG_sCAL_PRECISION);
447
      png_ascii_from_fp(png_ptr, sheight, (sizeof sheight), height,
G
[devel]  
Glenn Randers-Pehrson 已提交
448 449 450 451 452
         PNG_sCAL_PRECISION);

      png_set_sCAL_s(png_ptr, info_ptr, unit, swidth, sheight);
   }
}
453
#  endif
454

455
#  ifdef PNG_FIXED_POINT_SUPPORTED
456
void PNGAPI
457
png_set_sCAL_fixed(png_const_structrp png_ptr, png_inforp info_ptr, int unit,
458
    png_fixed_point width, png_fixed_point height)
459 460 461 462 463 464
{
   png_debug1(1, "in %s storage function", "sCAL");

   /* Check the arguments. */
   if (width <= 0)
      png_warning(png_ptr, "Invalid sCAL width ignored");
465

466 467
   else if (height <= 0)
      png_warning(png_ptr, "Invalid sCAL height ignored");
468

469 470 471 472 473 474
   else
   {
      /* Convert 'width' and 'height' to ASCII. */
      char swidth[PNG_sCAL_MAX_DIGITS+1];
      char sheight[PNG_sCAL_MAX_DIGITS+1];

475 476
      png_ascii_from_fixed(png_ptr, swidth, (sizeof swidth), width);
      png_ascii_from_fixed(png_ptr, sheight, (sizeof sheight), height);
477 478 479 480

      png_set_sCAL_s(png_ptr, info_ptr, unit, swidth, sheight);
   }
}
481
#  endif
482
#endif
483

484
#ifdef PNG_pHYs_SUPPORTED
485
void PNGAPI
486
png_set_pHYs(png_const_structrp png_ptr, png_inforp info_ptr,
487
    png_uint_32 res_x, png_uint_32 res_y, int unit_type)
A
Andreas Dilger 已提交
488
{
489
   png_debug1(1, "in %s storage function", "pHYs");
490

491
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
492 493 494 495 496 497 498 499 500
      return;

   info_ptr->x_pixels_per_unit = res_x;
   info_ptr->y_pixels_per_unit = res_y;
   info_ptr->phys_unit_type = (png_byte)unit_type;
   info_ptr->valid |= PNG_INFO_pHYs;
}
#endif

501
void PNGAPI
502
png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
503
    png_const_colorp palette, int num_palette)
A
Andreas Dilger 已提交
504
{
505

506
   png_debug1(1, "in %s storage function", "PLTE");
507

508
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
509 510
      return;

511
   if (num_palette < 0 || num_palette > PNG_MAX_PALETTE_LENGTH)
512 513
   {
      if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
514
         png_error(png_ptr, "Invalid palette length");
515

516 517
      else
      {
518 519
         png_warning(png_ptr, "Invalid palette length");
         return;
520 521
      }
   }
522

523 524 525 526 527 528 529
   if ((num_palette > 0 && palette == NULL) ||
      (num_palette == 0
#        ifdef PNG_MNG_FEATURES_SUPPORTED
            && (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0
#        endif
      ))
   {
530
      png_error(png_ptr, "Invalid palette");
531 532 533
      return;
   }

534
   /* It may not actually be necessary to set png_ptr->palette here;
535 536
    * we do it for backward compatibility with the way the png_handle_tRNS
    * function used to do the allocation.
537 538 539
    *
    * 1.6.0: the above statement appears to be incorrect; something has to set
    * the palette inside png_struct on read.
540 541
    */
   png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
542

543
   /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
544 545 546
    * of num_palette entries, in case of an invalid PNG file that has
    * too-large sample values.
    */
547
   png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
548
       PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
549

550 551
   if (num_palette > 0)
      memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color)));
552 553 554 555
   info_ptr->palette = png_ptr->palette;
   info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;

   info_ptr->free_me |= PNG_FREE_PLTE;
556

557
   info_ptr->valid |= PNG_INFO_PLTE;
A
Andreas Dilger 已提交
558 559
}

560
#ifdef PNG_sBIT_SUPPORTED
561
void PNGAPI
562
png_set_sBIT(png_const_structrp png_ptr, png_inforp info_ptr,
563
    png_const_color_8p sig_bit)
A
Andreas Dilger 已提交
564
{
565
   png_debug1(1, "in %s storage function", "sBIT");
566

567
   if (png_ptr == NULL || info_ptr == NULL || sig_bit == NULL)
A
Andreas Dilger 已提交
568 569
      return;

570
   info_ptr->sig_bit = *sig_bit;
A
Andreas Dilger 已提交
571 572 573 574
   info_ptr->valid |= PNG_INFO_sBIT;
}
#endif

575
#ifdef PNG_sRGB_SUPPORTED
576
void PNGAPI
577
png_set_sRGB(png_const_structrp png_ptr, png_inforp info_ptr, int srgb_intent)
578
{
579
   png_debug1(1, "in %s storage function", "sRGB");
580

581
   if (png_ptr == NULL || info_ptr == NULL)
582 583
      return;

584 585
   (void)png_colorspace_set_sRGB(png_ptr, &info_ptr->colorspace, srgb_intent);
   png_colorspace_sync_info(png_ptr, info_ptr);
586
}
587

588
void PNGAPI
589
png_set_sRGB_gAMA_and_cHRM(png_const_structrp png_ptr, png_inforp info_ptr,
590
    int srgb_intent)
591
{
592
   png_debug1(1, "in %s storage function", "sRGB_gAMA_and_cHRM");
593

594
   if (png_ptr == NULL || info_ptr == NULL)
595 596
      return;

597 598 599 600 601 602
   if (png_colorspace_set_sRGB(png_ptr, &info_ptr->colorspace, srgb_intent))
   {
      /* This causes the gAMA and cHRM to be written too */
      info_ptr->colorspace.flags |=
         PNG_COLORSPACE_FROM_gAMA|PNG_COLORSPACE_FROM_cHRM;
   }
603

604
   png_colorspace_sync_info(png_ptr, info_ptr);
605
}
606
#endif /* sRGB */
607

608

609
#ifdef PNG_iCCP_SUPPORTED
610
void PNGAPI
611
png_set_iCCP(png_const_structrp png_ptr, png_inforp info_ptr,
612 613
    png_const_charp name, int compression_type,
    png_const_bytep profile, png_uint_32 proflen)
614
{
615
   png_charp new_iccp_name;
G
[devel]  
Glenn Randers-Pehrson 已提交
616
   png_bytep new_iccp_profile;
617
   png_size_t length;
618

619
   png_debug1(1, "in %s storage function", "iCCP");
620

621 622 623
   if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL)
      return;

624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639
   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
      png_app_error(png_ptr, "Invalid iCCP compression method");

   /* Set the colorspace first because this validates the profile; do not
    * override previously set app cHRM or gAMA here (because likely as not the
    * application knows better than libpng what the correct values are.)  Pass
    * the info_ptr color_type field to png_colorspace_set_ICC because in the
    * write case it has not yet been stored in png_ptr.
    */
   {
      int result = png_colorspace_set_ICC(png_ptr, &info_ptr->colorspace, name,
         proflen, profile, info_ptr->color_type);

      png_colorspace_sync_info(png_ptr, info_ptr);

      /* Don't do any of the copying if the profile was bad, or inconsistent. */
640
      if (result == 0)
641 642 643 644 645 646 647 648
         return;

      /* But do write the gAMA and cHRM chunks from the profile. */
      info_ptr->colorspace.flags |=
         PNG_COLORSPACE_FROM_gAMA|PNG_COLORSPACE_FROM_cHRM;
   }

   length = strlen(name)+1;
649
   new_iccp_name = png_voidcast(png_charp, png_malloc_warn(png_ptr, length));
650

651 652
   if (new_iccp_name == NULL)
   {
653
      png_benign_error(png_ptr, "Insufficient memory to process iCCP chunk");
654 655
      return;
   }
656

657
   memcpy(new_iccp_name, name, length);
658 659
   new_iccp_profile = png_voidcast(png_bytep,
      png_malloc_warn(png_ptr, proflen));
660

661 662
   if (new_iccp_profile == NULL)
   {
663 664
      png_free(png_ptr, new_iccp_name);
      png_benign_error(png_ptr,
665
          "Insufficient memory to process iCCP profile");
666 667
      return;
   }
668

669
   memcpy(new_iccp_profile, profile, proflen);
670

671
   png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, 0);
672

673
   info_ptr->iccp_proflen = proflen;
674 675
   info_ptr->iccp_name = new_iccp_name;
   info_ptr->iccp_profile = new_iccp_profile;
676
   info_ptr->free_me |= PNG_FREE_ICCP;
677 678 679 680
   info_ptr->valid |= PNG_INFO_iCCP;
}
#endif

681
#ifdef PNG_TEXT_SUPPORTED
682
void PNGAPI
683 684
png_set_text(png_const_structrp png_ptr, png_inforp info_ptr,
    png_const_textp text_ptr, int num_text)
685 686
{
   int ret;
687
   ret = png_set_text_2(png_ptr, info_ptr, text_ptr, num_text);
688

689
   if (ret != 0)
690
      png_error(png_ptr, "Insufficient memory to store text");
691 692 693
}

int /* PRIVATE */
694
png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
695
    png_const_textp text_ptr, int num_text)
A
Andreas Dilger 已提交
696 697 698
{
   int i;

699 700
   png_debug1(1, "in %lx storage function", png_ptr == NULL ? "unexpected" :
      (unsigned long)png_ptr->chunk_name);
A
Andreas Dilger 已提交
701

702
   if (png_ptr == NULL || info_ptr == NULL || num_text <= 0 || text_ptr == NULL)
703
      return(0);
A
Andreas Dilger 已提交
704 705

   /* Make sure we have enough space in the "text" array in info_struct
706 707 708
    * to hold all of the incoming text_ptr objects.  This compare can't overflow
    * because max_text >= num_text (anyway, subtract of two positive integers
    * can't overflow in any case.)
A
Andreas Dilger 已提交
709
    */
710
   if (num_text > info_ptr->max_text - info_ptr->num_text)
A
Andreas Dilger 已提交
711
   {
712 713 714 715 716 717 718
      int old_num_text = info_ptr->num_text;
      int max_text;
      png_textp new_text = NULL;

      /* Calculate an appropriate max_text, checking for overflow. */
      max_text = old_num_text;
      if (num_text <= INT_MAX - max_text)
A
Andreas Dilger 已提交
719
      {
720
         max_text += num_text;
721

722 723 724
         /* Round up to a multiple of 8 */
         if (max_text < INT_MAX-8)
            max_text = (max_text + 8) & ~0x7;
725

726 727 728
         else
            max_text = INT_MAX;

729
         /* Now allocate a new array and copy the old members in; this does all
730 731 732 733 734
          * the overflow checks.
          */
         new_text = png_voidcast(png_textp,png_realloc_array(png_ptr,
            info_ptr->text, old_num_text, max_text-old_num_text,
            sizeof *new_text));
A
Andreas Dilger 已提交
735
      }
736

737
      if (new_text == NULL)
A
Andreas Dilger 已提交
738
      {
739 740 741
         png_chunk_report(png_ptr, "too many text chunks",
            PNG_CHUNK_WRITE_ERROR);
         return 1;
A
Andreas Dilger 已提交
742
      }
743

744 745 746 747 748 749 750 751
      png_free(png_ptr, info_ptr->text);

      info_ptr->text = new_text;
      info_ptr->free_me |= PNG_FREE_TEXT;
      info_ptr->max_text = max_text;
      /* num_text is adjusted below as the entries are copied in */

      png_debug1(3, "allocated %d entries for info_ptr->text", max_text);
A
Andreas Dilger 已提交
752
   }
753

A
Andreas Dilger 已提交
754 755
   for (i = 0; i < num_text; i++)
   {
756 757
      size_t text_length, key_len;
      size_t lang_len, lang_key_len;
A
Andreas Dilger 已提交
758 759
      png_textp textp = &(info_ptr->text[info_ptr->num_text]);

760
      if (text_ptr[i].key == NULL)
761 762
          continue;

763 764
      if (text_ptr[i].compression < PNG_TEXT_COMPRESSION_NONE ||
          text_ptr[i].compression >= PNG_TEXT_COMPRESSION_LAST)
765
      {
766 767
         png_chunk_report(png_ptr, "text compression mode is out of range",
            PNG_CHUNK_WRITE_ERROR);
768 769 770
         continue;
      }

771
      key_len = strlen(text_ptr[i].key);
772

773
      if (text_ptr[i].compression <= 0)
774
      {
775 776
         lang_len = 0;
         lang_key_len = 0;
777
      }
778

779
      else
780
#  ifdef PNG_iTXt_SUPPORTED
781
      {
782
         /* Set iTXt data */
783

784
         if (text_ptr[i].lang != NULL)
785
            lang_len = strlen(text_ptr[i].lang);
786

787 788
         else
            lang_len = 0;
789

790
         if (text_ptr[i].lang_key != NULL)
791
            lang_key_len = strlen(text_ptr[i].lang_key);
792

793 794
         else
            lang_key_len = 0;
795
      }
796
#  else /* PNG_iTXt_SUPPORTED */
797
      {
798 799
         png_chunk_report(png_ptr, "iTXt chunk not supported",
            PNG_CHUNK_WRITE_ERROR);
800
         continue;
801
      }
802
#  endif
A
Andreas Dilger 已提交
803

804
      if (text_ptr[i].text == NULL || text_ptr[i].text[0] == '\0')
A
Andreas Dilger 已提交
805
      {
806
         text_length = 0;
807
#  ifdef PNG_iTXt_SUPPORTED
808
         if (text_ptr[i].compression > 0)
809
            textp->compression = PNG_ITXT_COMPRESSION_NONE;
810

811
         else
812
#  endif
813
            textp->compression = PNG_TEXT_COMPRESSION_NONE;
A
Andreas Dilger 已提交
814
      }
815

A
Andreas Dilger 已提交
816 817
      else
      {
818
         text_length = strlen(text_ptr[i].text);
A
Andreas Dilger 已提交
819 820
         textp->compression = text_ptr[i].compression;
      }
821

822 823
      textp->key = png_voidcast(png_charp,png_malloc_base(png_ptr,
          key_len + text_length + lang_len + lang_key_len + 4));
824

825
      if (textp->key == NULL)
826 827 828 829 830
      {
         png_chunk_report(png_ptr, "text chunk: out of memory",
               PNG_CHUNK_WRITE_ERROR);
         return 1;
      }
831

832
      png_debug2(2, "Allocated %lu bytes at %p in png_set_text",
833 834
          (unsigned long)(png_uint_32)
          (key_len + lang_len + lang_key_len + text_length + 4),
835
          textp->key);
836

837
      memcpy(textp->key, text_ptr[i].key, key_len);
838
      *(textp->key + key_len) = '\0';
839

840 841
      if (text_ptr[i].compression > 0)
      {
842
         textp->lang = textp->key + key_len + 1;
843
         memcpy(textp->lang, text_ptr[i].lang, lang_len);
844
         *(textp->lang + lang_len) = '\0';
845
         textp->lang_key = textp->lang + lang_len + 1;
846
         memcpy(textp->lang_key, text_ptr[i].lang_key, lang_key_len);
847
         *(textp->lang_key + lang_key_len) = '\0';
848
         textp->text = textp->lang_key + lang_key_len + 1;
849
      }
850

851 852
      else
      {
853 854
         textp->lang=NULL;
         textp->lang_key=NULL;
855
         textp->text = textp->key + key_len + 1;
856
      }
857

858
      if (text_length != 0)
859
         memcpy(textp->text, text_ptr[i].text, text_length);
860

861
      *(textp->text + text_length) = '\0';
862

863
#  ifdef PNG_iTXt_SUPPORTED
864
      if (textp->compression > 0)
865 866 867 868
      {
         textp->text_length = 0;
         textp->itxt_length = text_length;
      }
869

870
      else
871
#  endif
872 873 874 875
      {
         textp->text_length = text_length;
         textp->itxt_length = 0;
      }
876

A
Andreas Dilger 已提交
877
      info_ptr->num_text++;
878
      png_debug1(3, "transferred text chunk %d", info_ptr->num_text);
A
Andreas Dilger 已提交
879
   }
880

881
   return(0);
A
Andreas Dilger 已提交
882 883 884
}
#endif

885
#ifdef PNG_tIME_SUPPORTED
886
void PNGAPI
887 888
png_set_tIME(png_const_structrp png_ptr, png_inforp info_ptr,
    png_const_timep mod_time)
A
Andreas Dilger 已提交
889
{
890
   png_debug1(1, "in %s storage function", "tIME");
891

892
   if (png_ptr == NULL || info_ptr == NULL || mod_time == NULL ||
893
       (png_ptr->mode & PNG_WROTE_tIME))
A
Andreas Dilger 已提交
894 895
      return;

896 897 898 899 900 901 902 903 904
   if (mod_time->month == 0   || mod_time->month > 12  ||
       mod_time->day   == 0   || mod_time->day   > 31  ||
       mod_time->hour  > 23   || mod_time->minute > 59 ||
       mod_time->second > 60)
   {
      png_warning(png_ptr, "Ignoring invalid time value");
      return;
   }

905
   info_ptr->mod_time = *mod_time;
A
Andreas Dilger 已提交
906 907 908 909
   info_ptr->valid |= PNG_INFO_tIME;
}
#endif

910
#ifdef PNG_tRNS_SUPPORTED
911
void PNGAPI
912
png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
913
    png_const_bytep trans_alpha, int num_trans, png_const_color_16p trans_color)
A
Andreas Dilger 已提交
914
{
915
   png_debug1(1, "in %s storage function", "tRNS");
916

917
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
918 919
      return;

920
   if (trans_alpha != NULL)
921
   {
922
       /* It may not actually be necessary to set png_ptr->trans_alpha here;
923 924
        * we do it for backward compatibility with the way the png_handle_tRNS
        * function used to do the allocation.
925 926 927 928
        *
        * 1.6.0: The above statement is incorrect; png_handle_tRNS effectively
        * relies on png_set_tRNS storing the information in png_struct
        * (otherwise it won't be there for the code in pngrtran.c).
929
        */
930

931
       png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
932

933
       /* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */
934 935
       png_ptr->trans_alpha = info_ptr->trans_alpha = png_voidcast(png_bytep,
         png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
936

937
       if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
938
          memcpy(info_ptr->trans_alpha, trans_alpha, (png_size_t)num_trans);
939
   }
A
Andreas Dilger 已提交
940

941
   if (trans_color != NULL)
A
Andreas Dilger 已提交
942
   {
943
      int sample_max = (1 << info_ptr->bit_depth);
944

945
      if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY &&
946
          trans_color->gray > sample_max) ||
947
          (info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
948 949 950
          (trans_color->red > sample_max ||
          trans_color->green > sample_max ||
          trans_color->blue > sample_max)))
951 952
         png_warning(png_ptr,
            "tRNS chunk has out-of-range samples for bit_depth");
953

954
      info_ptr->trans_color = *trans_color;
955

956
      if (num_trans == 0)
957
         num_trans = 1;
A
Andreas Dilger 已提交
958
   }
959

A
Andreas Dilger 已提交
960
   info_ptr->num_trans = (png_uint_16)num_trans;
961

962 963 964 965 966
   if (num_trans != 0)
   {
      info_ptr->valid |= PNG_INFO_tRNS;
      info_ptr->free_me |= PNG_FREE_TRNS;
   }
A
Andreas Dilger 已提交
967 968 969
}
#endif

970
#ifdef PNG_sPLT_SUPPORTED
971
void PNGAPI
972
png_set_sPLT(png_const_structrp png_ptr,
973
    png_inforp info_ptr, png_const_sPLT_tp entries, int nentries)
974 975 976 977
/*
 *  entries        - array of png_sPLT_t structures
 *                   to be added to the list of palettes
 *                   in the info structure.
978
 *
979 980 981
 *  nentries       - number of palette structures to be
 *                   added.
 */
982
{
983
   png_sPLT_tp np;
984

985
   if (png_ptr == NULL || info_ptr == NULL || nentries <= 0 || entries == NULL)
986
      return;
987

988 989 990 991 992 993
   /* Use the internal realloc function, which checks for all the possible
    * overflows.  Notice that the parameters are (int) and (size_t)
    */
   np = png_voidcast(png_sPLT_tp,png_realloc_array(png_ptr,
      info_ptr->splt_palettes, info_ptr->splt_palettes_num, nentries,
      sizeof *np));
994

995 996
   if (np == NULL)
   {
997 998
      /* Out of memory or too many chunks */
      png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR);
999
      return;
1000
   }
1001

1002
   png_free(png_ptr, info_ptr->splt_palettes);
1003 1004
   info_ptr->splt_palettes = np;
   info_ptr->free_me |= PNG_FREE_SPLT;
1005

1006 1007 1008
   np += info_ptr->splt_palettes_num;

   do
1009
   {
1010
      png_size_t length;
1011

1012 1013
      /* Skip invalid input entries */
      if (entries->name == NULL || entries->entries == NULL)
1014
      {
1015 1016 1017
         /* png_handle_sPLT doesn't do this, so this is an app error */
         png_app_error(png_ptr, "png_set_sPLT: invalid sPLT");
         /* Just skip the invalid entry */
1018
         continue;
1019
      }
1020

1021 1022
      np->depth = entries->depth;

1023 1024
      /* In the event of out-of-memory just return - there's no point keeping
       * on trying to add sPLT chunks.
1025 1026 1027 1028 1029 1030
       */
      length = strlen(entries->name) + 1;
      np->name = png_voidcast(png_charp, png_malloc_base(png_ptr, length));

      if (np->name == NULL)
         break;
1031

1032 1033 1034
      memcpy(np->name, entries->name, length);

      /* IMPORTANT: we have memory now that won't get freed if something else
1035 1036
       * goes wrong; this code must free it.  png_malloc_array produces no
       * warnings; use a png_chunk_report (below) if there is an error.
1037 1038 1039 1040 1041
       */
      np->entries = png_voidcast(png_sPLT_entryp, png_malloc_array(png_ptr,
          entries->nentries, sizeof (png_sPLT_entry)));

      if (np->entries == NULL)
1042
      {
1043 1044
         png_free(png_ptr, np->name);
         break;
1045
      }
1046

1047 1048 1049 1050 1051 1052
      np->nentries = entries->nentries;
      /* This multiply can't overflow because png_malloc_array has already
       * checked it when doing the allocation.
       */
      memcpy(np->entries, entries->entries,
         entries->nentries * sizeof (png_sPLT_entry));
1053

1054 1055 1056 1057 1058 1059
      /* Note that 'continue' skips the advance of the out pointer and out
       * count, so an invalid entry is not added.
       */
      info_ptr->valid |= PNG_INFO_sPLT;
      ++(info_ptr->splt_palettes_num);
      ++np;
1060
   }
1061
   while (++entries, --nentries);
1062

1063 1064
   if (nentries > 0)
      png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
1065
}
1066
#endif /* PNG_sPLT_SUPPORTED */
1067

1068 1069 1070 1071 1072 1073 1074
#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
static png_byte
check_location(png_const_structrp png_ptr, int location)
{
   location &= (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT);

   /* New in 1.6.0; copy the location and check it.  This is an API
1075
    * change; previously the app had to use the
1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105
    * png_set_unknown_chunk_location API below for each chunk.
    */
   if (location == 0 && !(png_ptr->mode & PNG_IS_READ_STRUCT))
   {
      /* Write struct, so unknown chunks come from the app */
      png_app_warning(png_ptr,
         "png_set_unknown_chunks now expects a valid location");
      /* Use the old behavior */
      location = (png_byte)(png_ptr->mode &
         (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT));
   }

   /* This need not be an internal error - if the app calls
    * png_set_unknown_chunks on a read pointer it must get the location right.
    */
   if (location == 0)
      png_error(png_ptr, "invalid location in png_set_unknown_chunks");

   /* Now reduce the location to the top-most set bit by removing each least
    * significant bit in turn.
    */
   while (location != (location & -location))
      location &= ~(location & -location);

   /* The cast is safe because 'location' is a bit mask and only the low four
    * bits are significant.
    */
   return (png_byte)location;
}

1106
void PNGAPI
1107
png_set_unknown_chunks(png_const_structrp png_ptr,
1108
   png_inforp info_ptr, png_const_unknown_chunkp unknowns, int num_unknowns)
1109
{
1110 1111
   png_unknown_chunkp np;

1112 1113
   if (png_ptr == NULL || info_ptr == NULL || num_unknowns <= 0 ||
      unknowns == NULL)
1114
      return;
1115

1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146
   /* Check for the failure cases where support has been disabled at compile
    * time.  This code is hardly ever compiled - it's here because
    * STORE_UNKNOWN_CHUNKS is set by both read and write code (compiling in this
    * code) but may be meaningless if the read or write handling of unknown
    * chunks is not compiled in.
    */
#  if !defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED) && \
      defined(PNG_READ_SUPPORTED)
      if (png_ptr->mode & PNG_IS_READ_STRUCT)
      {
         png_app_error(png_ptr, "no unknown chunk support on read");
         return;
      }
#  endif
#  if !defined(PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED) && \
      defined(PNG_WRITE_SUPPORTED)
      if (!(png_ptr->mode & PNG_IS_READ_STRUCT))
      {
         png_app_error(png_ptr, "no unknown chunk support on write");
         return;
      }
#  endif

   /* Prior to 1.6.0 this code used png_malloc_warn; however, this meant that
    * unknown critical chunks could be lost with just a warning resulting in
    * undefined behavior.  Now png_chunk_report is used to provide behavior
    * appropriate to read or write.
    */
   np = png_voidcast(png_unknown_chunkp, png_realloc_array(png_ptr,
         info_ptr->unknown_chunks, info_ptr->unknown_chunks_num, num_unknowns,
         sizeof *np));
1147 1148 1149

   if (np == NULL)
   {
1150 1151
      png_chunk_report(png_ptr, "too many unknown chunks",
         PNG_CHUNK_WRITE_ERROR);
1152 1153 1154
      return;
   }

1155
   png_free(png_ptr, info_ptr->unknown_chunks);
1156 1157
   info_ptr->unknown_chunks = np; /* safe because it is initialized */
   info_ptr->free_me |= PNG_FREE_UNKN;
1158

1159
   np += info_ptr->unknown_chunks_num;
1160

1161 1162 1163 1164 1165 1166 1167 1168
   /* Increment unknown_chunks_num each time round the loop to protect the
    * just-allocated chunk data.
    */
   for (; num_unknowns > 0; --num_unknowns, ++unknowns)
   {
      memcpy(np->name, unknowns->name, (sizeof np->name));
      np->name[(sizeof np->name)-1] = '\0';
      np->location = check_location(png_ptr, unknowns->location);
1169

1170 1171 1172 1173 1174
      if (unknowns->size == 0)
      {
         np->data = NULL;
         np->size = 0;
      }
1175

1176 1177
      else
      {
1178 1179
         np->data = png_voidcast(png_bytep,
            png_malloc_base(png_ptr, unknowns->size));
1180

1181
         if (np->data == NULL)
1182
         {
1183 1184 1185 1186
            png_chunk_report(png_ptr, "unknown chunk: out of memory",
               PNG_CHUNK_WRITE_ERROR);
            /* But just skip storing the unknown chunk */
            continue;
1187 1188
         }

1189 1190
         memcpy(np->data, unknowns->data, unknowns->size);
         np->size = unknowns->size;
1191
      }
1192

1193 1194 1195 1196 1197 1198 1199
      /* These increments are skipped on out-of-memory for the data - the
       * unknown chunk entry gets overwritten if the png_chunk_report returns.
       * This is correct in the read case (the chunk is just dropped.)
       */
      ++np;
      ++(info_ptr->unknown_chunks_num);
   }
1200
}
1201

1202
void PNGAPI
1203
png_set_unknown_chunk_location(png_const_structrp png_ptr, png_inforp info_ptr,
1204
    int chunk, int location)
1205
{
1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227
   /* This API is pretty pointless in 1.6.0 because the location can be set
    * before the call to png_set_unknown_chunks.
    *
    * TODO: add a png_app_warning in 1.7
    */
   if (png_ptr != NULL && info_ptr != NULL && chunk >= 0 &&
      chunk < info_ptr->unknown_chunks_num)
   {
      if ((location & (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT)) == 0)
      {
         png_app_error(png_ptr, "invalid unknown chunk location");
         /* Fake out the pre 1.6.0 behavior: */
         if ((location & PNG_HAVE_IDAT)) /* undocumented! */
            location = PNG_AFTER_IDAT;

         else
            location = PNG_HAVE_IHDR; /* also undocumented */
      }

      info_ptr->unknown_chunks[chunk].location =
         check_location(png_ptr, location);
   }
1228
}
1229 1230
#endif

1231

1232
#ifdef PNG_MNG_FEATURES_SUPPORTED
1233
png_uint_32 PNGAPI
1234
png_permit_mng_features (png_structrp png_ptr, png_uint_32 mng_features)
1235
{
1236
   png_debug(1, "in png_permit_mng_features");
1237

1238
   if (png_ptr == NULL)
1239
      return 0;
1240

1241
   png_ptr->mng_features_permitted = mng_features & PNG_ALL_MNG_FEATURES;
1242

1243
   return png_ptr->mng_features_permitted;
1244 1245
}
#endif
1246

1247
#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271
static unsigned int
add_one_chunk(png_bytep list, unsigned int count, png_const_bytep add, int keep)
{
   unsigned int i;

   /* Utility function: update the 'keep' state of a chunk if it is already in
    * the list, otherwise add it to the list.
    */
   for (i=0; i<count; ++i, list += 5) if (memcmp(list, add, 4) == 0)
   {
      list[4] = (png_byte)keep;
      return count;
   }

   if (keep != PNG_HANDLE_CHUNK_AS_DEFAULT)
   {
      ++count;
      memcpy(list, add, 4);
      list[4] = (png_byte)keep;
   }

   return count;
}

1272 1273
void PNGAPI
png_set_keep_unknown_chunks(png_structrp png_ptr, int keep,
1274
    png_const_bytep chunk_list, int num_chunks_in)
1275
{
1276 1277 1278
   png_bytep new_list;
   unsigned int num_chunks, old_num_chunks;

1279 1280
   if (png_ptr == NULL)
      return;
1281

1282
   if (keep < 0 || keep >= PNG_HANDLE_CHUNK_LAST)
1283
   {
1284 1285 1286
      png_app_error(png_ptr, "png_set_keep_unknown_chunks: invalid keep");
      return;
   }
1287

1288 1289 1290
   if (num_chunks_in <= 0)
   {
      png_ptr->unknown_default = keep;
1291

1292 1293 1294 1295
      /* '0' means just set the flags, so stop here */
      if (num_chunks_in == 0)
        return;
   }
1296

1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324
   if (num_chunks_in < 0)
   {
      /* Ignore all unknown chunks and all chunks recognized by
       * libpng except for IHDR, PLTE, tRNS, IDAT, and IEND
       */
      static PNG_CONST png_byte chunks_to_ignore[] = {
         98,  75,  71,  68, '\0',  /* bKGD */
         99,  72,  82,  77, '\0',  /* cHRM */
        103,  65,  77,  65, '\0',  /* gAMA */
        104,  73,  83,  84, '\0',  /* hIST */
        105,  67,  67,  80, '\0',  /* iCCP */
        105,  84,  88, 116, '\0',  /* iTXt */
        111,  70,  70, 115, '\0',  /* oFFs */
        112,  67,  65,  76, '\0',  /* pCAL */
        112,  72,  89, 115, '\0',  /* pHYs */
        115,  66,  73,  84, '\0',  /* sBIT */
        115,  67,  65,  76, '\0',  /* sCAL */
        115,  80,  76,  84, '\0',  /* sPLT */
        115,  84,  69,  82, '\0',  /* sTER */
        115,  82,  71,  66, '\0',  /* sRGB */
        116,  69,  88, 116, '\0',  /* tEXt */
        116,  73,  77,  69, '\0',  /* tIME */
        122,  84,  88, 116, '\0'   /* zTXt */
      };

      chunk_list = chunks_to_ignore;
      num_chunks = (sizeof chunks_to_ignore)/5;
   }
1325

1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337
   else /* num_chunks_in > 0 */
   {
      if (chunk_list == NULL)
      {
         /* Prior to 1.6.0 this was silently ignored, now it is an app_error
          * which can be switched off.
          */
         png_app_error(png_ptr, "png_set_keep_unknown_chunks: no chunk list");
         return;
      }

      num_chunks = num_chunks_in;
1338 1339
   }

1340 1341 1342 1343 1344 1345 1346 1347 1348
   old_num_chunks = png_ptr->num_chunk_list;
   if (png_ptr->chunk_list == NULL)
      old_num_chunks = 0;

   /* Since num_chunks is always restricted to UINT_MAX/5 this can't overflow.
    */
   if (num_chunks + old_num_chunks > UINT_MAX/5)
   {
      png_app_error(png_ptr, "png_set_keep_unknown_chunks: too many chunks");
1349
      return;
1350
   }
1351

1352 1353 1354 1355
   /* If these chunks are being reset to the default then no more memory is
    * required because add_one_chunk above doesn't extend the list if the 'keep'
    * parameter is the default.
    */
1356
   if (keep != 0)
1357 1358 1359
   {
      new_list = png_voidcast(png_bytep, png_malloc(png_ptr,
          5 * (num_chunks + old_num_chunks)));
1360

1361 1362 1363 1364 1365 1366
      if (old_num_chunks > 0)
         memcpy(new_list, png_ptr->chunk_list, 5*old_num_chunks);
   }

   else if (old_num_chunks > 0)
      new_list = png_ptr->chunk_list;
1367

1368 1369 1370 1371 1372 1373 1374 1375 1376
   else
      new_list = NULL;

   /* Add the new chunks together with each one's handling code.  If the chunk
    * already exists the code is updated, otherwise the chunk is added to the
    * end.  (In libpng 1.6.0 order no longer matters because this code enforces
    * the earlier convention that the last setting is the one that is used.)
    */
   if (new_list != NULL)
1377
   {
1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404
      png_const_bytep inlist;
      png_bytep outlist;
      unsigned int i;

      for (i=0; i<num_chunks; ++i)
         old_num_chunks = add_one_chunk(new_list, old_num_chunks,
            chunk_list+5*i, keep);

      /* Now remove any spurious 'default' entries. */
      num_chunks = 0;
      for (i=0, inlist=outlist=new_list; i<old_num_chunks; ++i, inlist += 5)
         if (inlist[4])
         {
            if (outlist != inlist)
               memcpy(outlist, inlist, 5);
            outlist += 5;
            ++num_chunks;
         }

      /* This means the application has removed all the specialized handling. */
      if (num_chunks == 0)
      {
         if (png_ptr->chunk_list != new_list)
            png_free(png_ptr, new_list);

         new_list = NULL;
      }
1405
   }
1406

1407 1408 1409 1410
   else
      num_chunks = 0;

   png_ptr->num_chunk_list = num_chunks;
1411

1412 1413 1414 1415
   if (png_ptr->chunk_list != new_list)
   {
      if (png_ptr->chunk_list != NULL)
         png_free(png_ptr, png_ptr->chunk_list);
1416

1417 1418
      png_ptr->chunk_list = new_list;
   }
1419 1420
}
#endif
1421

1422
#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
1423
void PNGAPI
1424
png_set_read_user_chunk_fn(png_structrp png_ptr, png_voidp user_chunk_ptr,
1425
    png_user_chunk_ptr read_user_chunk_fn)
1426
{
1427
   png_debug(1, "in png_set_read_user_chunk_fn");
1428

1429 1430
   if (png_ptr == NULL)
      return;
1431

1432 1433 1434 1435
   png_ptr->read_user_chunk_fn = read_user_chunk_fn;
   png_ptr->user_chunk_ptr = user_chunk_ptr;
}
#endif
1436

1437
#ifdef PNG_INFO_IMAGE_SUPPORTED
1438
void PNGAPI
1439 1440
png_set_rows(png_const_structrp png_ptr, png_inforp info_ptr,
    png_bytepp row_pointers)
1441
{
1442
   png_debug1(1, "in %s storage function", "rows");
1443

1444 1445 1446
   if (png_ptr == NULL || info_ptr == NULL)
      return;

1447
   if (info_ptr->row_pointers && (info_ptr->row_pointers != row_pointers))
1448
      png_free_data(png_ptr, info_ptr, PNG_FREE_ROWS, 0);
1449

1450
   info_ptr->row_pointers = row_pointers;
1451

1452
   if (row_pointers != NULL)
1453
      info_ptr->valid |= PNG_INFO_IDAT;
1454 1455 1456
}
#endif

1457
void PNGAPI
1458
png_set_compression_buffer_size(png_structrp png_ptr, png_size_t size)
1459
{
1460 1461
    if (png_ptr == NULL)
       return;
1462

1463 1464
    if (size == 0 || size > PNG_UINT_31_MAX)
       png_error(png_ptr, "invalid compression buffer size");
1465

1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482
#  ifdef PNG_SEQUENTIAL_READ_SUPPORTED
      if (png_ptr->mode & PNG_IS_READ_STRUCT)
      {
         png_ptr->IDAT_read_size = (png_uint_32)size; /* checked above */
         return;
      }
#  endif

#  ifdef PNG_WRITE_SUPPORTED
      if (!(png_ptr->mode & PNG_IS_READ_STRUCT))
      {
         if (png_ptr->zowner != 0)
         {
            png_warning(png_ptr,
              "Compression buffer size cannot be changed because it is in use");
            return;
         }
1483

1484 1485 1486 1487 1488 1489
         if (size > ZLIB_IO_MAX)
         {
            png_warning(png_ptr,
               "Compression buffer size limited to system maximum");
            size = ZLIB_IO_MAX; /* must fit */
         }
1490

1491 1492 1493 1494 1495 1496 1497 1498 1499
         else if (size < 6)
         {
            /* Deflate will potentially go into an infinite loop on a SYNC_FLUSH
             * if this is permitted.
             */
            png_warning(png_ptr,
               "Compression buffer size cannot be reduced below 6");
            return;
         }
1500

1501 1502 1503 1504 1505 1506 1507
         if (png_ptr->zbuffer_size != size)
         {
            png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list);
            png_ptr->zbuffer_size = (uInt)size;
         }
      }
#  endif
1508
}
1509 1510

void PNGAPI
1511
png_set_invalid(png_const_structrp png_ptr, png_inforp info_ptr, int mask)
1512 1513
{
   if (png_ptr && info_ptr)
1514
      info_ptr->valid &= ~mask;
1515
}
1516

1517

1518
#ifdef PNG_SET_USER_LIMITS_SUPPORTED
1519
/* This function was added to libpng 1.2.6 */
1520
void PNGAPI
1521
png_set_user_limits (png_structrp png_ptr, png_uint_32 user_width_max,
1522 1523
    png_uint_32 user_height_max)
{
1524 1525 1526 1527 1528 1529
   /* Images with dimensions larger than these limits will be
    * rejected by png_set_IHDR().  To accept any PNG datastream
    * regardless of dimensions, set both limits to 0x7ffffffL.
    */
   if (png_ptr == NULL)
      return;
1530

1531 1532
   png_ptr->user_width_max = user_width_max;
   png_ptr->user_height_max = user_height_max;
1533
}
1534

1535
/* This function was added to libpng 1.4.0 */
1536
void PNGAPI
1537
png_set_chunk_cache_max (png_structrp png_ptr, png_uint_32 user_chunk_cache_max)
1538
{
1539
    if (png_ptr != NULL)
1540
       png_ptr->user_chunk_cache_max = user_chunk_cache_max;
1541 1542 1543 1544
}

/* This function was added to libpng 1.4.1 */
void PNGAPI
1545
png_set_chunk_malloc_max (png_structrp png_ptr,
1546
    png_alloc_size_t user_chunk_malloc_max)
1547
{
1548
   if (png_ptr != NULL)
1549
      png_ptr->user_chunk_malloc_max = user_chunk_malloc_max;
1550
}
1551 1552
#endif /* ?PNG_SET_USER_LIMITS_SUPPORTED */

1553

1554
#ifdef PNG_BENIGN_ERRORS_SUPPORTED
1555
void PNGAPI
1556
png_set_benign_errors(png_structrp png_ptr, int allowed)
1557
{
1558
   png_debug(1, "in png_set_benign_errors");
1559

1560 1561 1562 1563 1564 1565
   /* If allowed is 1, png_benign_error() is treated as a warning.
    *
    * If allowed is 0, png_benign_error() is treated as an error (which
    * is the default behavior if png_set_benign_errors() is not called).
    */

1566
   if (allowed != 0)
1567 1568
      png_ptr->flags |= PNG_FLAG_BENIGN_ERRORS_WARN |
         PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN;
1569

1570
   else
1571 1572
      png_ptr->flags &= ~(PNG_FLAG_BENIGN_ERRORS_WARN |
         PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN);
1573 1574
}
#endif /* PNG_BENIGN_ERRORS_SUPPORTED */
1575 1576 1577 1578 1579 1580

#ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
   /* Whether to report invalid palette index; added at libng-1.5.10.
    * It is possible for an indexed (color-type==3) PNG file to contain
    * pixels with invalid (out-of-range) indexes if the PLTE chunk has
    * fewer entries than the image's bit-depth would allow. We recover
1581
    * from this gracefully by filling any incomplete palette with zeros
1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596
    * (opaque black).  By default, when this occurs libpng will issue
    * a benign error.  This API can be used to override that behavior.
    */
void PNGAPI
png_set_check_for_invalid_index(png_structrp png_ptr, int allowed)
{
   png_debug(1, "in png_set_check_for_invalid_index");

   if (allowed > 0)
      png_ptr->num_palette_max = 0;

   else
      png_ptr->num_palette_max = -1;
}
#endif
1597
#endif /* PNG_READ_SUPPORTED || PNG_WRITE_SUPPORTED */