pngset.c 48.8 KB
Newer Older
A
Andreas Dilger 已提交
1 2

/* pngset.c - storage of image information into info struct
3
 *
4
 * Last changed in libpng 1.6.23 [June 9, 2016]
5
 * Copyright (c) 1998-2016 Glenn Randers-Pehrson
6 7
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
8
 *
9
 * This code is released under the libpng license.
10
 * For conditions of distribution and use, see the disclaimer
11
 * and license in png.h
12
 *
13 14 15 16 17
 * The functions here are used during reads to store data from the file
 * into the info struct, and during writes to store application data
 * into the info struct for writing into the file.  This abstracts the
 * info struct and allows us to change the structure in the future.
 */
A
Andreas Dilger 已提交
18

19
#include "pngpriv.h"
20

21 22
#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

23
#ifdef PNG_bKGD_SUPPORTED
24
void PNGAPI
25
png_set_bKGD(png_const_structrp png_ptr, png_inforp info_ptr,
26
    png_const_color_16p background)
A
Andreas Dilger 已提交
27
{
28
   png_debug1(1, "in %s storage function", "bKGD");
29

30
   if (png_ptr == NULL || info_ptr == NULL || background == NULL)
A
Andreas Dilger 已提交
31 32
      return;

33
   info_ptr->background = *background;
A
Andreas Dilger 已提交
34 35 36 37
   info_ptr->valid |= PNG_INFO_bKGD;
}
#endif

38
#ifdef PNG_cHRM_SUPPORTED
G
[devel]  
Glenn Randers-Pehrson 已提交
39
void PNGFAPI
40
png_set_cHRM_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
41 42 43
    png_fixed_point white_x, png_fixed_point white_y, png_fixed_point red_x,
    png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y,
    png_fixed_point blue_x, png_fixed_point blue_y)
44
{
45 46
   png_xy xy;

47
   png_debug1(1, "in %s storage function", "cHRM fixed");
48

49 50
   if (png_ptr == NULL || info_ptr == NULL)
      return;
A
Andreas Dilger 已提交
51

52 53 54 55 56 57 58 59 60 61
   xy.redx = red_x;
   xy.redy = red_y;
   xy.greenx = green_x;
   xy.greeny = green_y;
   xy.bluex = blue_x;
   xy.bluey = blue_y;
   xy.whitex = white_x;
   xy.whitey = white_y;

   if (png_colorspace_set_chromaticities(png_ptr, &info_ptr->colorspace, &xy,
62
       2/* override with app values*/) != 0)
63 64 65
      info_ptr->colorspace.flags |= PNG_COLORSPACE_FROM_cHRM;

   png_colorspace_sync_info(png_ptr, info_ptr);
66 67
}

68
void PNGFAPI
69
png_set_cHRM_XYZ_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
70 71 72 73 74 75 76 77 78 79 80 81 82
    png_fixed_point int_red_X, png_fixed_point int_red_Y,
    png_fixed_point int_red_Z, png_fixed_point int_green_X,
    png_fixed_point int_green_Y, png_fixed_point int_green_Z,
    png_fixed_point int_blue_X, png_fixed_point int_blue_Y,
    png_fixed_point int_blue_Z)
{
   png_XYZ XYZ;

   png_debug1(1, "in %s storage function", "cHRM XYZ fixed");

   if (png_ptr == NULL || info_ptr == NULL)
      return;

83 84 85 86 87 88 89 90 91 92
   XYZ.red_X = int_red_X;
   XYZ.red_Y = int_red_Y;
   XYZ.red_Z = int_red_Z;
   XYZ.green_X = int_green_X;
   XYZ.green_Y = int_green_Y;
   XYZ.green_Z = int_green_Z;
   XYZ.blue_X = int_blue_X;
   XYZ.blue_Y = int_blue_Y;
   XYZ.blue_Z = int_blue_Z;

93 94
   if (png_colorspace_set_endpoints(png_ptr, &info_ptr->colorspace,
       &XYZ, 2) != 0)
95 96 97
      info_ptr->colorspace.flags |= PNG_COLORSPACE_FROM_cHRM;

   png_colorspace_sync_info(png_ptr, info_ptr);
98 99
}

100
#  ifdef PNG_FLOATING_POINT_SUPPORTED
101
void PNGAPI
102
png_set_cHRM(png_const_structrp png_ptr, png_inforp info_ptr,
G
[devel]  
Glenn Randers-Pehrson 已提交
103 104
    double white_x, double white_y, double red_x, double red_y,
    double green_x, double green_y, double blue_x, double blue_y)
A
Andreas Dilger 已提交
105
{
G
[devel]  
Glenn Randers-Pehrson 已提交
106 107 108 109 110 111 112 113 114 115
   png_set_cHRM_fixed(png_ptr, info_ptr,
      png_fixed(png_ptr, white_x, "cHRM White X"),
      png_fixed(png_ptr, white_y, "cHRM White Y"),
      png_fixed(png_ptr, red_x, "cHRM Red X"),
      png_fixed(png_ptr, red_y, "cHRM Red Y"),
      png_fixed(png_ptr, green_x, "cHRM Green X"),
      png_fixed(png_ptr, green_y, "cHRM Green Y"),
      png_fixed(png_ptr, blue_x, "cHRM Blue X"),
      png_fixed(png_ptr, blue_y, "cHRM Blue Y"));
}
116 117

void PNGAPI
118
png_set_cHRM_XYZ(png_const_structrp png_ptr, png_inforp info_ptr, double red_X,
119 120 121 122 123 124 125
    double red_Y, double red_Z, double green_X, double green_Y, double green_Z,
    double blue_X, double blue_Y, double blue_Z)
{
   png_set_cHRM_XYZ_fixed(png_ptr, info_ptr,
      png_fixed(png_ptr, red_X, "cHRM Red X"),
      png_fixed(png_ptr, red_Y, "cHRM Red Y"),
      png_fixed(png_ptr, red_Z, "cHRM Red Z"),
126 127 128 129 130 131
      png_fixed(png_ptr, green_X, "cHRM Green X"),
      png_fixed(png_ptr, green_Y, "cHRM Green Y"),
      png_fixed(png_ptr, green_Z, "cHRM Green Z"),
      png_fixed(png_ptr, blue_X, "cHRM Blue X"),
      png_fixed(png_ptr, blue_Y, "cHRM Blue Y"),
      png_fixed(png_ptr, blue_Z, "cHRM Blue Z"));
132
}
133
#  endif /* FLOATING_POINT */
134

135
#endif /* cHRM */
136

G
[devel]  
Glenn Randers-Pehrson 已提交
137 138
#ifdef PNG_gAMA_SUPPORTED
void PNGFAPI
139 140
png_set_gAMA_fixed(png_const_structrp png_ptr, png_inforp info_ptr,
    png_fixed_point file_gamma)
141
{
142
   png_debug1(1, "in %s storage function", "gAMA");
143

144 145 146
   if (png_ptr == NULL || info_ptr == NULL)
      return;

147 148
   png_colorspace_set_gamma(png_ptr, &info_ptr->colorspace, file_gamma);
   png_colorspace_sync_info(png_ptr, info_ptr);
G
[devel]  
Glenn Randers-Pehrson 已提交
149
}
150

151
#  ifdef PNG_FLOATING_POINT_SUPPORTED
G
[devel]  
Glenn Randers-Pehrson 已提交
152
void PNGAPI
153
png_set_gAMA(png_const_structrp png_ptr, png_inforp info_ptr, double file_gamma)
G
[devel]  
Glenn Randers-Pehrson 已提交
154 155
{
   png_set_gAMA_fixed(png_ptr, info_ptr, png_fixed(png_ptr, file_gamma,
156
       "png_set_gAMA"));
A
Andreas Dilger 已提交
157
}
158
#  endif
159
#endif
A
Andreas Dilger 已提交
160

161
#ifdef PNG_hIST_SUPPORTED
162
void PNGAPI
163 164
png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
    png_const_uint_16p hist)
A
Andreas Dilger 已提交
165
{
166
   int i;
167

168
   png_debug1(1, "in %s storage function", "hIST");
169

170
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
171
      return;
172

173
   if (info_ptr->num_palette == 0 || info_ptr->num_palette
174
       > PNG_MAX_PALETTE_LENGTH)
175
   {
176
      png_warning(png_ptr,
177
          "Invalid palette size, hIST allocation skipped");
178

179
      return;
180
   }
181 182

   png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
183

184 185 186
   /* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in
    * version 1.2.1
    */
187
   info_ptr->hist = png_voidcast(png_uint_16p, png_malloc_warn(png_ptr,
188
       PNG_MAX_PALETTE_LENGTH * (sizeof (png_uint_16))));
189

190
   if (info_ptr->hist == NULL)
191 192
   {
      png_warning(png_ptr, "Insufficient memory for hIST chunk data");
193

194 195
      return;
   }
A
Andreas Dilger 已提交
196

197 198
   info_ptr->free_me |= PNG_FREE_HIST;

199
   for (i = 0; i < info_ptr->num_palette; i++)
200
      info_ptr->hist[i] = hist[i];
201

A
Andreas Dilger 已提交
202 203 204 205
   info_ptr->valid |= PNG_INFO_hIST;
}
#endif

206
void PNGAPI
207
png_set_IHDR(png_const_structrp png_ptr, png_inforp info_ptr,
208 209 210
    png_uint_32 width, png_uint_32 height, int bit_depth,
    int color_type, int interlace_type, int compression_type,
    int filter_type)
A
Andreas Dilger 已提交
211
{
212
   png_debug1(1, "in %s storage function", "IHDR");
213

214
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
215 216 217 218 219
      return;

   info_ptr->width = width;
   info_ptr->height = height;
   info_ptr->bit_depth = (png_byte)bit_depth;
220
   info_ptr->color_type = (png_byte)color_type;
A
Andreas Dilger 已提交
221 222 223
   info_ptr->compression_type = (png_byte)compression_type;
   info_ptr->filter_type = (png_byte)filter_type;
   info_ptr->interlace_type = (png_byte)interlace_type;
224 225 226 227 228

   png_check_IHDR (png_ptr, info_ptr->width, info_ptr->height,
       info_ptr->bit_depth, info_ptr->color_type, info_ptr->interlace_type,
       info_ptr->compression_type, info_ptr->filter_type);

229 230
   if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
      info_ptr->channels = 1;
231

232
   else if ((info_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
A
Andreas Dilger 已提交
233
      info_ptr->channels = 3;
234

A
Andreas Dilger 已提交
235 236
   else
      info_ptr->channels = 1;
237

238
   if ((info_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)
A
Andreas Dilger 已提交
239
      info_ptr->channels++;
240

A
Andreas Dilger 已提交
241
   info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth);
242

243
   info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width);
A
Andreas Dilger 已提交
244 245
}

246
#ifdef PNG_oFFs_SUPPORTED
247
void PNGAPI
248
png_set_oFFs(png_const_structrp png_ptr, png_inforp info_ptr,
249
    png_int_32 offset_x, png_int_32 offset_y, int unit_type)
A
Andreas Dilger 已提交
250
{
251
   png_debug1(1, "in %s storage function", "oFFs");
252

253
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
254 255 256 257 258 259 260 261 262
      return;

   info_ptr->x_offset = offset_x;
   info_ptr->y_offset = offset_y;
   info_ptr->offset_unit_type = (png_byte)unit_type;
   info_ptr->valid |= PNG_INFO_oFFs;
}
#endif

263
#ifdef PNG_pCAL_SUPPORTED
264
void PNGAPI
265
png_set_pCAL(png_const_structrp png_ptr, png_inforp info_ptr,
266 267
    png_const_charp purpose, png_int_32 X0, png_int_32 X1, int type,
    int nparams, png_const_charp units, png_charpp params)
A
Andreas Dilger 已提交
268
{
269
   png_size_t length;
270
   int i;
A
Andreas Dilger 已提交
271

272
   png_debug1(1, "in %s storage function", "pCAL");
273

274
   if (png_ptr == NULL || info_ptr == NULL || purpose == NULL || units == NULL
275
       || (nparams > 0 && params == NULL))
A
Andreas Dilger 已提交
276 277
      return;

278
   length = strlen(purpose) + 1;
279
   png_debug1(3, "allocating purpose for info (%lu bytes)",
280
       (unsigned long)length);
281

G
[devel]  
Glenn Randers-Pehrson 已提交
282 283 284 285 286 287
   /* TODO: validate format of calibration name and unit name */

   /* Check that the type matches the specification. */
   if (type < 0 || type > 3)
      png_error(png_ptr, "Invalid pCAL equation type");

288 289 290
   if (nparams < 0 || nparams > 255)
      png_error(png_ptr, "Invalid pCAL parameter count");

G
[devel]  
Glenn Randers-Pehrson 已提交
291 292
   /* Validate params[nparams] */
   for (i=0; i<nparams; ++i)
293
   {
294
      if (params[i] == NULL ||
295
          !png_check_fp_string(params[i], strlen(params[i])))
G
[devel]  
Glenn Randers-Pehrson 已提交
296
         png_error(png_ptr, "Invalid format for pCAL parameter");
297
   }
G
[devel]  
Glenn Randers-Pehrson 已提交
298

299
   info_ptr->pcal_purpose = png_voidcast(png_charp,
300
       png_malloc_warn(png_ptr, length));
301

302
   if (info_ptr->pcal_purpose == NULL)
303
   {
304
      png_warning(png_ptr, "Insufficient memory for pCAL purpose");
305

306 307
      return;
   }
308

309
   memcpy(info_ptr->pcal_purpose, purpose, length);
A
Andreas Dilger 已提交
310

311
   png_debug(3, "storing X0, X1, type, and nparams in info");
A
Andreas Dilger 已提交
312 313 314 315 316
   info_ptr->pcal_X0 = X0;
   info_ptr->pcal_X1 = X1;
   info_ptr->pcal_type = (png_byte)type;
   info_ptr->pcal_nparams = (png_byte)nparams;

317
   length = strlen(units) + 1;
318
   png_debug1(3, "allocating units for info (%lu bytes)",
319
     (unsigned long)length);
320

321 322
   info_ptr->pcal_units = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, length));
323

324
   if (info_ptr->pcal_units == NULL)
325
   {
326
      png_warning(png_ptr, "Insufficient memory for pCAL units");
327

328 329
      return;
   }
330

331
   memcpy(info_ptr->pcal_units, units, length);
A
Andreas Dilger 已提交
332

333
   info_ptr->pcal_params = png_voidcast(png_charpp, png_malloc_warn(png_ptr,
334
       (png_size_t)((nparams + 1) * (sizeof (png_charp)))));
335

336
   if (info_ptr->pcal_params == NULL)
337
   {
338
      png_warning(png_ptr, "Insufficient memory for pCAL params");
339

340 341
      return;
   }
342

343
   memset(info_ptr->pcal_params, 0, (nparams + 1) * (sizeof (png_charp)));
A
Andreas Dilger 已提交
344 345 346

   for (i = 0; i < nparams; i++)
   {
347
      length = strlen(params[i]) + 1;
348
      png_debug2(3, "allocating parameter %d for info (%lu bytes)", i,
349
          (unsigned long)length);
350

351
      info_ptr->pcal_params[i] = (png_charp)png_malloc_warn(png_ptr, length);
352

353
      if (info_ptr->pcal_params[i] == NULL)
354
      {
355
         png_warning(png_ptr, "Insufficient memory for pCAL parameter");
356

357
         return;
358
      }
359

360
      memcpy(info_ptr->pcal_params[i], params[i], length);
A
Andreas Dilger 已提交
361 362 363
   }

   info_ptr->valid |= PNG_INFO_pCAL;
364
   info_ptr->free_me |= PNG_FREE_PCAL;
A
Andreas Dilger 已提交
365 366 367
}
#endif

368
#ifdef PNG_sCAL_SUPPORTED
369
void PNGAPI
370
png_set_sCAL_s(png_const_structrp png_ptr, png_inforp info_ptr,
371
    int unit, png_const_charp swidth, png_const_charp sheight)
372
{
373
   png_size_t lengthw = 0, lengthh = 0;
374

375
   png_debug1(1, "in %s storage function", "sCAL");
376

377 378 379
   if (png_ptr == NULL || info_ptr == NULL)
      return;

G
[devel]  
Glenn Randers-Pehrson 已提交
380 381 382 383 384 385
   /* Double check the unit (should never get here with an invalid
    * unit unless this is an API call.)
    */
   if (unit != 1 && unit != 2)
      png_error(png_ptr, "Invalid sCAL unit");

386
   if (swidth == NULL || (lengthw = strlen(swidth)) == 0 ||
387
       swidth[0] == 45 /* '-' */ || !png_check_fp_string(swidth, lengthw))
G
[devel]  
Glenn Randers-Pehrson 已提交
388 389
      png_error(png_ptr, "Invalid sCAL width");

390
   if (sheight == NULL || (lengthh = strlen(sheight)) == 0 ||
391
       sheight[0] == 45 /* '-' */ || !png_check_fp_string(sheight, lengthh))
G
[devel]  
Glenn Randers-Pehrson 已提交
392 393
      png_error(png_ptr, "Invalid sCAL height");

394
   info_ptr->scal_unit = (png_byte)unit;
395

G
[devel]  
Glenn Randers-Pehrson 已提交
396
   ++lengthw;
397

398
   png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthw);
399

400 401
   info_ptr->scal_s_width = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, lengthw));
402

403 404
   if (info_ptr->scal_s_width == NULL)
   {
G
[devel]  
Glenn Randers-Pehrson 已提交
405
      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
406

407
      return;
408
   }
409

410
   memcpy(info_ptr->scal_s_width, swidth, lengthw);
411

G
[devel]  
Glenn Randers-Pehrson 已提交
412
   ++lengthh;
413

414
   png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthh);
415

416 417
   info_ptr->scal_s_height = png_voidcast(png_charp,
      png_malloc_warn(png_ptr, lengthh));
418

419 420 421
   if (info_ptr->scal_s_height == NULL)
   {
      png_free (png_ptr, info_ptr->scal_s_width);
422
      info_ptr->scal_s_width = NULL;
423

G
[devel]  
Glenn Randers-Pehrson 已提交
424
      png_warning(png_ptr, "Memory allocation failed while processing sCAL");
425

426
      return;
427
   }
428

429
   memcpy(info_ptr->scal_s_height, sheight, lengthh);
G
[devel]  
Glenn Randers-Pehrson 已提交
430

431
   info_ptr->valid |= PNG_INFO_sCAL;
432
   info_ptr->free_me |= PNG_FREE_SCAL;
433
}
G
[devel]  
Glenn Randers-Pehrson 已提交
434

435
#  ifdef PNG_FLOATING_POINT_SUPPORTED
G
[devel]  
Glenn Randers-Pehrson 已提交
436
void PNGAPI
437 438
png_set_sCAL(png_const_structrp png_ptr, png_inforp info_ptr, int unit,
    double width, double height)
G
[devel]  
Glenn Randers-Pehrson 已提交
439 440 441 442 443 444
{
   png_debug1(1, "in %s storage function", "sCAL");

   /* Check the arguments. */
   if (width <= 0)
      png_warning(png_ptr, "Invalid sCAL width ignored");
445

G
[devel]  
Glenn Randers-Pehrson 已提交
446 447
   else if (height <= 0)
      png_warning(png_ptr, "Invalid sCAL height ignored");
448

G
[devel]  
Glenn Randers-Pehrson 已提交
449 450 451 452 453 454
   else
   {
      /* Convert 'width' and 'height' to ASCII. */
      char swidth[PNG_sCAL_MAX_DIGITS+1];
      char sheight[PNG_sCAL_MAX_DIGITS+1];

455
      png_ascii_from_fp(png_ptr, swidth, (sizeof swidth), width,
G
[devel]  
Glenn Randers-Pehrson 已提交
456
         PNG_sCAL_PRECISION);
457
      png_ascii_from_fp(png_ptr, sheight, (sizeof sheight), height,
G
[devel]  
Glenn Randers-Pehrson 已提交
458 459 460 461 462
         PNG_sCAL_PRECISION);

      png_set_sCAL_s(png_ptr, info_ptr, unit, swidth, sheight);
   }
}
463
#  endif
464

465
#  ifdef PNG_FIXED_POINT_SUPPORTED
466
void PNGAPI
467
png_set_sCAL_fixed(png_const_structrp png_ptr, png_inforp info_ptr, int unit,
468
    png_fixed_point width, png_fixed_point height)
469 470 471 472 473 474
{
   png_debug1(1, "in %s storage function", "sCAL");

   /* Check the arguments. */
   if (width <= 0)
      png_warning(png_ptr, "Invalid sCAL width ignored");
475

476 477
   else if (height <= 0)
      png_warning(png_ptr, "Invalid sCAL height ignored");
478

479 480 481 482 483 484
   else
   {
      /* Convert 'width' and 'height' to ASCII. */
      char swidth[PNG_sCAL_MAX_DIGITS+1];
      char sheight[PNG_sCAL_MAX_DIGITS+1];

485 486
      png_ascii_from_fixed(png_ptr, swidth, (sizeof swidth), width);
      png_ascii_from_fixed(png_ptr, sheight, (sizeof sheight), height);
487 488 489 490

      png_set_sCAL_s(png_ptr, info_ptr, unit, swidth, sheight);
   }
}
491
#  endif
492
#endif
493

494
#ifdef PNG_pHYs_SUPPORTED
495
void PNGAPI
496
png_set_pHYs(png_const_structrp png_ptr, png_inforp info_ptr,
497
    png_uint_32 res_x, png_uint_32 res_y, int unit_type)
A
Andreas Dilger 已提交
498
{
499
   png_debug1(1, "in %s storage function", "pHYs");
500

501
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
502 503 504 505 506 507 508 509 510
      return;

   info_ptr->x_pixels_per_unit = res_x;
   info_ptr->y_pixels_per_unit = res_y;
   info_ptr->phys_unit_type = (png_byte)unit_type;
   info_ptr->valid |= PNG_INFO_pHYs;
}
#endif

511
void PNGAPI
512
png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
513
    png_const_colorp palette, int num_palette)
A
Andreas Dilger 已提交
514
{
515

516 517
   png_uint_32 max_palette_length;

518
   png_debug1(1, "in %s storage function", "PLTE");
519

520
   if (png_ptr == NULL || info_ptr == NULL)
A
Andreas Dilger 已提交
521 522
      return;

523 524
   max_palette_length = (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
      (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
525

526
   if (num_palette < 0 || num_palette > (int) max_palette_length)
527 528
   {
      if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
529
         png_error(png_ptr, "Invalid palette length");
530

531 532
      else
      {
533
         png_warning(png_ptr, "Invalid palette length");
534

535
         return;
536 537
      }
   }
538

539 540 541 542 543 544 545
   if ((num_palette > 0 && palette == NULL) ||
      (num_palette == 0
#        ifdef PNG_MNG_FEATURES_SUPPORTED
            && (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0
#        endif
      ))
   {
546
      png_error(png_ptr, "Invalid palette");
547 548
   }

549
   /* It may not actually be necessary to set png_ptr->palette here;
550 551
    * we do it for backward compatibility with the way the png_handle_tRNS
    * function used to do the allocation.
552 553 554
    *
    * 1.6.0: the above statement appears to be incorrect; something has to set
    * the palette inside png_struct on read.
555 556
    */
   png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
557

558
   /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
559 560
    * of num_palette entries, in case of an invalid PNG file or incorrect
    * call to png_set_PLTE() with too-large sample values.
561
    */
562
   png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
563
       PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
564

565 566
   if (num_palette > 0)
      memcpy(png_ptr->palette, palette, num_palette * (sizeof (png_color)));
567 568 569 570
   info_ptr->palette = png_ptr->palette;
   info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;

   info_ptr->free_me |= PNG_FREE_PLTE;
571

572
   info_ptr->valid |= PNG_INFO_PLTE;
A
Andreas Dilger 已提交
573 574
}

575
#ifdef PNG_sBIT_SUPPORTED
576
void PNGAPI
577
png_set_sBIT(png_const_structrp png_ptr, png_inforp info_ptr,
578
    png_const_color_8p sig_bit)
A
Andreas Dilger 已提交
579
{
580
   png_debug1(1, "in %s storage function", "sBIT");
581

582
   if (png_ptr == NULL || info_ptr == NULL || sig_bit == NULL)
A
Andreas Dilger 已提交
583 584
      return;

585
   info_ptr->sig_bit = *sig_bit;
A
Andreas Dilger 已提交
586 587 588 589
   info_ptr->valid |= PNG_INFO_sBIT;
}
#endif

590
#ifdef PNG_sRGB_SUPPORTED
591
void PNGAPI
592
png_set_sRGB(png_const_structrp png_ptr, png_inforp info_ptr, int srgb_intent)
593
{
594
   png_debug1(1, "in %s storage function", "sRGB");
595

596
   if (png_ptr == NULL || info_ptr == NULL)
597 598
      return;

599 600
   (void)png_colorspace_set_sRGB(png_ptr, &info_ptr->colorspace, srgb_intent);
   png_colorspace_sync_info(png_ptr, info_ptr);
601
}
602

603
void PNGAPI
604
png_set_sRGB_gAMA_and_cHRM(png_const_structrp png_ptr, png_inforp info_ptr,
605
    int srgb_intent)
606
{
607
   png_debug1(1, "in %s storage function", "sRGB_gAMA_and_cHRM");
608

609
   if (png_ptr == NULL || info_ptr == NULL)
610 611
      return;

612 613
   if (png_colorspace_set_sRGB(png_ptr, &info_ptr->colorspace,
       srgb_intent) != 0)
614 615 616 617 618
   {
      /* This causes the gAMA and cHRM to be written too */
      info_ptr->colorspace.flags |=
         PNG_COLORSPACE_FROM_gAMA|PNG_COLORSPACE_FROM_cHRM;
   }
619

620
   png_colorspace_sync_info(png_ptr, info_ptr);
621
}
622
#endif /* sRGB */
623

624

625
#ifdef PNG_iCCP_SUPPORTED
626
void PNGAPI
627
png_set_iCCP(png_const_structrp png_ptr, png_inforp info_ptr,
628 629
    png_const_charp name, int compression_type,
    png_const_bytep profile, png_uint_32 proflen)
630
{
631
   png_charp new_iccp_name;
G
[devel]  
Glenn Randers-Pehrson 已提交
632
   png_bytep new_iccp_profile;
633
   png_size_t length;
634

635
   png_debug1(1, "in %s storage function", "iCCP");
636

637 638 639
   if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL)
      return;

640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655
   if (compression_type != PNG_COMPRESSION_TYPE_BASE)
      png_app_error(png_ptr, "Invalid iCCP compression method");

   /* Set the colorspace first because this validates the profile; do not
    * override previously set app cHRM or gAMA here (because likely as not the
    * application knows better than libpng what the correct values are.)  Pass
    * the info_ptr color_type field to png_colorspace_set_ICC because in the
    * write case it has not yet been stored in png_ptr.
    */
   {
      int result = png_colorspace_set_ICC(png_ptr, &info_ptr->colorspace, name,
         proflen, profile, info_ptr->color_type);

      png_colorspace_sync_info(png_ptr, info_ptr);

      /* Don't do any of the copying if the profile was bad, or inconsistent. */
656
      if (result == 0)
657 658 659 660 661 662 663 664
         return;

      /* But do write the gAMA and cHRM chunks from the profile. */
      info_ptr->colorspace.flags |=
         PNG_COLORSPACE_FROM_gAMA|PNG_COLORSPACE_FROM_cHRM;
   }

   length = strlen(name)+1;
665
   new_iccp_name = png_voidcast(png_charp, png_malloc_warn(png_ptr, length));
666

667 668
   if (new_iccp_name == NULL)
   {
669
      png_benign_error(png_ptr, "Insufficient memory to process iCCP chunk");
670

671 672
      return;
   }
673

674
   memcpy(new_iccp_name, name, length);
675 676
   new_iccp_profile = png_voidcast(png_bytep,
      png_malloc_warn(png_ptr, proflen));
677

678 679
   if (new_iccp_profile == NULL)
   {
680 681
      png_free(png_ptr, new_iccp_name);
      png_benign_error(png_ptr,
682
          "Insufficient memory to process iCCP profile");
683

684 685
      return;
   }
686

687
   memcpy(new_iccp_profile, profile, proflen);
688

689
   png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, 0);
690

691
   info_ptr->iccp_proflen = proflen;
692 693
   info_ptr->iccp_name = new_iccp_name;
   info_ptr->iccp_profile = new_iccp_profile;
694
   info_ptr->free_me |= PNG_FREE_ICCP;
695 696 697 698
   info_ptr->valid |= PNG_INFO_iCCP;
}
#endif

699
#ifdef PNG_TEXT_SUPPORTED
700
void PNGAPI
701 702
png_set_text(png_const_structrp png_ptr, png_inforp info_ptr,
    png_const_textp text_ptr, int num_text)
703 704
{
   int ret;
705
   ret = png_set_text_2(png_ptr, info_ptr, text_ptr, num_text);
706

707
   if (ret != 0)
708
      png_error(png_ptr, "Insufficient memory to store text");
709 710 711
}

int /* PRIVATE */
712
png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
713
    png_const_textp text_ptr, int num_text)
A
Andreas Dilger 已提交
714 715 716
{
   int i;

717
   png_debug1(1, "in %lx storage function", png_ptr == NULL ? 0xabadca11U :
718
      (unsigned long)png_ptr->chunk_name);
A
Andreas Dilger 已提交
719

720
   if (png_ptr == NULL || info_ptr == NULL || num_text <= 0 || text_ptr == NULL)
721
      return(0);
A
Andreas Dilger 已提交
722 723

   /* Make sure we have enough space in the "text" array in info_struct
724 725 726
    * to hold all of the incoming text_ptr objects.  This compare can't overflow
    * because max_text >= num_text (anyway, subtract of two positive integers
    * can't overflow in any case.)
A
Andreas Dilger 已提交
727
    */
728
   if (num_text > info_ptr->max_text - info_ptr->num_text)
A
Andreas Dilger 已提交
729
   {
730 731 732 733 734 735 736
      int old_num_text = info_ptr->num_text;
      int max_text;
      png_textp new_text = NULL;

      /* Calculate an appropriate max_text, checking for overflow. */
      max_text = old_num_text;
      if (num_text <= INT_MAX - max_text)
A
Andreas Dilger 已提交
737
      {
738
         max_text += num_text;
739

740 741 742
         /* Round up to a multiple of 8 */
         if (max_text < INT_MAX-8)
            max_text = (max_text + 8) & ~0x7;
743

744 745 746
         else
            max_text = INT_MAX;

747
         /* Now allocate a new array and copy the old members in; this does all
748 749 750 751 752
          * the overflow checks.
          */
         new_text = png_voidcast(png_textp,png_realloc_array(png_ptr,
            info_ptr->text, old_num_text, max_text-old_num_text,
            sizeof *new_text));
A
Andreas Dilger 已提交
753
      }
754

755
      if (new_text == NULL)
A
Andreas Dilger 已提交
756
      {
757 758
         png_chunk_report(png_ptr, "too many text chunks",
            PNG_CHUNK_WRITE_ERROR);
759

760
         return 1;
A
Andreas Dilger 已提交
761
      }
762

763 764 765 766 767 768 769 770
      png_free(png_ptr, info_ptr->text);

      info_ptr->text = new_text;
      info_ptr->free_me |= PNG_FREE_TEXT;
      info_ptr->max_text = max_text;
      /* num_text is adjusted below as the entries are copied in */

      png_debug1(3, "allocated %d entries for info_ptr->text", max_text);
A
Andreas Dilger 已提交
771
   }
772

A
Andreas Dilger 已提交
773 774
   for (i = 0; i < num_text; i++)
   {
775 776
      size_t text_length, key_len;
      size_t lang_len, lang_key_len;
A
Andreas Dilger 已提交
777 778
      png_textp textp = &(info_ptr->text[info_ptr->num_text]);

779
      if (text_ptr[i].key == NULL)
780 781
          continue;

782 783
      if (text_ptr[i].compression < PNG_TEXT_COMPRESSION_NONE ||
          text_ptr[i].compression >= PNG_TEXT_COMPRESSION_LAST)
784
      {
785 786
         png_chunk_report(png_ptr, "text compression mode is out of range",
            PNG_CHUNK_WRITE_ERROR);
787 788 789
         continue;
      }

790
      key_len = strlen(text_ptr[i].key);
791

792
      if (text_ptr[i].compression <= 0)
793
      {
794 795
         lang_len = 0;
         lang_key_len = 0;
796
      }
797

798
      else
799
#  ifdef PNG_iTXt_SUPPORTED
800
      {
801
         /* Set iTXt data */
802

803
         if (text_ptr[i].lang != NULL)
804
            lang_len = strlen(text_ptr[i].lang);
805

806 807
         else
            lang_len = 0;
808

809
         if (text_ptr[i].lang_key != NULL)
810
            lang_key_len = strlen(text_ptr[i].lang_key);
811

812 813
         else
            lang_key_len = 0;
814
      }
815
#  else /* iTXt */
816
      {
817 818
         png_chunk_report(png_ptr, "iTXt chunk not supported",
            PNG_CHUNK_WRITE_ERROR);
819
         continue;
820
      }
821
#  endif
A
Andreas Dilger 已提交
822

823
      if (text_ptr[i].text == NULL || text_ptr[i].text[0] == '\0')
A
Andreas Dilger 已提交
824
      {
825
         text_length = 0;
826
#  ifdef PNG_iTXt_SUPPORTED
827
         if (text_ptr[i].compression > 0)
828
            textp->compression = PNG_ITXT_COMPRESSION_NONE;
829

830
         else
831
#  endif
832
            textp->compression = PNG_TEXT_COMPRESSION_NONE;
A
Andreas Dilger 已提交
833
      }
834

A
Andreas Dilger 已提交
835 836
      else
      {
837
         text_length = strlen(text_ptr[i].text);
A
Andreas Dilger 已提交
838 839
         textp->compression = text_ptr[i].compression;
      }
840

841 842
      textp->key = png_voidcast(png_charp,png_malloc_base(png_ptr,
          key_len + text_length + lang_len + lang_key_len + 4));
843

844
      if (textp->key == NULL)
845 846 847
      {
         png_chunk_report(png_ptr, "text chunk: out of memory",
               PNG_CHUNK_WRITE_ERROR);
848

849 850
         return 1;
      }
851

852
      png_debug2(2, "Allocated %lu bytes at %p in png_set_text",
853 854
          (unsigned long)(png_uint_32)
          (key_len + lang_len + lang_key_len + text_length + 4),
855
          textp->key);
856

857
      memcpy(textp->key, text_ptr[i].key, key_len);
858
      *(textp->key + key_len) = '\0';
859

860 861
      if (text_ptr[i].compression > 0)
      {
862
         textp->lang = textp->key + key_len + 1;
863
         memcpy(textp->lang, text_ptr[i].lang, lang_len);
864
         *(textp->lang + lang_len) = '\0';
865
         textp->lang_key = textp->lang + lang_len + 1;
866
         memcpy(textp->lang_key, text_ptr[i].lang_key, lang_key_len);
867
         *(textp->lang_key + lang_key_len) = '\0';
868
         textp->text = textp->lang_key + lang_key_len + 1;
869
      }
870

871 872
      else
      {
873 874
         textp->lang=NULL;
         textp->lang_key=NULL;
875
         textp->text = textp->key + key_len + 1;
876
      }
877

878
      if (text_length != 0)
879
         memcpy(textp->text, text_ptr[i].text, text_length);
880

881
      *(textp->text + text_length) = '\0';
882

883
#  ifdef PNG_iTXt_SUPPORTED
884
      if (textp->compression > 0)
885 886 887 888
      {
         textp->text_length = 0;
         textp->itxt_length = text_length;
      }
889

890
      else
891
#  endif
892 893 894 895
      {
         textp->text_length = text_length;
         textp->itxt_length = 0;
      }
896

A
Andreas Dilger 已提交
897
      info_ptr->num_text++;
898
      png_debug1(3, "transferred text chunk %d", info_ptr->num_text);
A
Andreas Dilger 已提交
899
   }
900

901
   return(0);
A
Andreas Dilger 已提交
902 903 904
}
#endif

905
#ifdef PNG_tIME_SUPPORTED
906
void PNGAPI
907 908
png_set_tIME(png_const_structrp png_ptr, png_inforp info_ptr,
    png_const_timep mod_time)
A
Andreas Dilger 已提交
909
{
910
   png_debug1(1, "in %s storage function", "tIME");
911

912
   if (png_ptr == NULL || info_ptr == NULL || mod_time == NULL ||
913
       (png_ptr->mode & PNG_WROTE_tIME) != 0)
A
Andreas Dilger 已提交
914 915
      return;

916 917 918 919 920 921
   if (mod_time->month == 0   || mod_time->month > 12  ||
       mod_time->day   == 0   || mod_time->day   > 31  ||
       mod_time->hour  > 23   || mod_time->minute > 59 ||
       mod_time->second > 60)
   {
      png_warning(png_ptr, "Ignoring invalid time value");
922

923 924 925
      return;
   }

926
   info_ptr->mod_time = *mod_time;
A
Andreas Dilger 已提交
927 928 929 930
   info_ptr->valid |= PNG_INFO_tIME;
}
#endif

931
#ifdef PNG_tRNS_SUPPORTED
932
void PNGAPI
933
png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
934
    png_const_bytep trans_alpha, int num_trans, png_const_color_16p trans_color)
A
Andreas Dilger 已提交
935
{
936
   png_debug1(1, "in %s storage function", "tRNS");
937

938
   if (png_ptr == NULL || info_ptr == NULL)
939

A
Andreas Dilger 已提交
940 941
      return;

942
   if (trans_alpha != NULL)
943
   {
944
       /* It may not actually be necessary to set png_ptr->trans_alpha here;
945 946
        * we do it for backward compatibility with the way the png_handle_tRNS
        * function used to do the allocation.
947 948 949 950
        *
        * 1.6.0: The above statement is incorrect; png_handle_tRNS effectively
        * relies on png_set_tRNS storing the information in png_struct
        * (otherwise it won't be there for the code in pngrtran.c).
951
        */
952

953
       png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
954 955

       if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
956 957
       {
         /* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */
958
          info_ptr->trans_alpha = png_voidcast(png_bytep,
959
             png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
960
          memcpy(info_ptr->trans_alpha, trans_alpha, (png_size_t)num_trans);
961
       }
962
       png_ptr->trans_alpha = info_ptr->trans_alpha;
963
   }
A
Andreas Dilger 已提交
964

965
   if (trans_color != NULL)
A
Andreas Dilger 已提交
966
   {
967
#ifdef PNG_WARNINGS_SUPPORTED
968 969
      if (info_ptr->bit_depth < 16)
      {
970
         int sample_max = (1 << info_ptr->bit_depth) - 1;
971 972 973 974 975 976 977

         if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY &&
             trans_color->gray > sample_max) ||
             (info_ptr->color_type == PNG_COLOR_TYPE_RGB &&
             (trans_color->red > sample_max ||
             trans_color->green > sample_max ||
             trans_color->blue > sample_max)))
978 979
            png_warning(png_ptr,
               "tRNS chunk has out-of-range samples for bit_depth");
980
      }
981 982 983
#endif

      info_ptr->trans_color = *trans_color;
984

985
      if (num_trans == 0)
986
         num_trans = 1;
A
Andreas Dilger 已提交
987
   }
988

A
Andreas Dilger 已提交
989
   info_ptr->num_trans = (png_uint_16)num_trans;
990

991 992 993 994 995
   if (num_trans != 0)
   {
      info_ptr->valid |= PNG_INFO_tRNS;
      info_ptr->free_me |= PNG_FREE_TRNS;
   }
A
Andreas Dilger 已提交
996 997 998
}
#endif

999
#ifdef PNG_sPLT_SUPPORTED
1000
void PNGAPI
1001
png_set_sPLT(png_const_structrp png_ptr,
1002
    png_inforp info_ptr, png_const_sPLT_tp entries, int nentries)
1003 1004 1005 1006
/*
 *  entries        - array of png_sPLT_t structures
 *                   to be added to the list of palettes
 *                   in the info structure.
1007
 *
1008 1009 1010
 *  nentries       - number of palette structures to be
 *                   added.
 */
1011
{
1012
   png_sPLT_tp np;
1013

1014
   if (png_ptr == NULL || info_ptr == NULL || nentries <= 0 || entries == NULL)
1015
      return;
1016

1017 1018 1019 1020 1021 1022
   /* Use the internal realloc function, which checks for all the possible
    * overflows.  Notice that the parameters are (int) and (size_t)
    */
   np = png_voidcast(png_sPLT_tp,png_realloc_array(png_ptr,
      info_ptr->splt_palettes, info_ptr->splt_palettes_num, nentries,
      sizeof *np));
1023

1024 1025
   if (np == NULL)
   {
1026 1027
      /* Out of memory or too many chunks */
      png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR);
1028

1029
      return;
1030
   }
1031

1032
   png_free(png_ptr, info_ptr->splt_palettes);
1033 1034
   info_ptr->splt_palettes = np;
   info_ptr->free_me |= PNG_FREE_SPLT;
1035

1036 1037 1038
   np += info_ptr->splt_palettes_num;

   do
1039
   {
1040
      png_size_t length;
1041

1042 1043
      /* Skip invalid input entries */
      if (entries->name == NULL || entries->entries == NULL)
1044
      {
1045 1046 1047
         /* png_handle_sPLT doesn't do this, so this is an app error */
         png_app_error(png_ptr, "png_set_sPLT: invalid sPLT");
         /* Just skip the invalid entry */
1048
         continue;
1049
      }
1050

1051 1052
      np->depth = entries->depth;

1053 1054
      /* In the event of out-of-memory just return - there's no point keeping
       * on trying to add sPLT chunks.
1055 1056 1057 1058 1059 1060
       */
      length = strlen(entries->name) + 1;
      np->name = png_voidcast(png_charp, png_malloc_base(png_ptr, length));

      if (np->name == NULL)
         break;
1061

1062 1063 1064
      memcpy(np->name, entries->name, length);

      /* IMPORTANT: we have memory now that won't get freed if something else
1065 1066
       * goes wrong; this code must free it.  png_malloc_array produces no
       * warnings; use a png_chunk_report (below) if there is an error.
1067 1068 1069 1070 1071
       */
      np->entries = png_voidcast(png_sPLT_entryp, png_malloc_array(png_ptr,
          entries->nentries, sizeof (png_sPLT_entry)));

      if (np->entries == NULL)
1072
      {
1073
         png_free(png_ptr, np->name);
1074
         np->name = NULL;
1075
         break;
1076
      }
1077

1078 1079 1080 1081 1082 1083
      np->nentries = entries->nentries;
      /* This multiply can't overflow because png_malloc_array has already
       * checked it when doing the allocation.
       */
      memcpy(np->entries, entries->entries,
         entries->nentries * sizeof (png_sPLT_entry));
1084

1085 1086 1087 1088 1089 1090
      /* Note that 'continue' skips the advance of the out pointer and out
       * count, so an invalid entry is not added.
       */
      info_ptr->valid |= PNG_INFO_sPLT;
      ++(info_ptr->splt_palettes_num);
      ++np;
1091
   }
1092
   while (++entries, --nentries);
1093

1094 1095
   if (nentries > 0)
      png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
1096
}
1097
#endif /* sPLT */
1098

1099 1100 1101 1102 1103 1104 1105
#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
static png_byte
check_location(png_const_structrp png_ptr, int location)
{
   location &= (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT);

   /* New in 1.6.0; copy the location and check it.  This is an API
1106
    * change; previously the app had to use the
1107 1108
    * png_set_unknown_chunk_location API below for each chunk.
    */
1109
   if (location == 0 && (png_ptr->mode & PNG_IS_READ_STRUCT) == 0)
1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136
   {
      /* Write struct, so unknown chunks come from the app */
      png_app_warning(png_ptr,
         "png_set_unknown_chunks now expects a valid location");
      /* Use the old behavior */
      location = (png_byte)(png_ptr->mode &
         (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT));
   }

   /* This need not be an internal error - if the app calls
    * png_set_unknown_chunks on a read pointer it must get the location right.
    */
   if (location == 0)
      png_error(png_ptr, "invalid location in png_set_unknown_chunks");

   /* Now reduce the location to the top-most set bit by removing each least
    * significant bit in turn.
    */
   while (location != (location & -location))
      location &= ~(location & -location);

   /* The cast is safe because 'location' is a bit mask and only the low four
    * bits are significant.
    */
   return (png_byte)location;
}

1137
void PNGAPI
1138
png_set_unknown_chunks(png_const_structrp png_ptr,
1139
   png_inforp info_ptr, png_const_unknown_chunkp unknowns, int num_unknowns)
1140
{
1141 1142
   png_unknown_chunkp np;

1143
   if (png_ptr == NULL || info_ptr == NULL || num_unknowns <= 0 ||
1144
       unknowns == NULL)
1145
      return;
1146

1147 1148 1149 1150 1151 1152 1153 1154
   /* Check for the failure cases where support has been disabled at compile
    * time.  This code is hardly ever compiled - it's here because
    * STORE_UNKNOWN_CHUNKS is set by both read and write code (compiling in this
    * code) but may be meaningless if the read or write handling of unknown
    * chunks is not compiled in.
    */
#  if !defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED) && \
      defined(PNG_READ_SUPPORTED)
1155
      if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0)
1156 1157
      {
         png_app_error(png_ptr, "no unknown chunk support on read");
1158

1159 1160 1161 1162 1163
         return;
      }
#  endif
#  if !defined(PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED) && \
      defined(PNG_WRITE_SUPPORTED)
1164
      if ((png_ptr->mode & PNG_IS_READ_STRUCT) == 0)
1165 1166
      {
         png_app_error(png_ptr, "no unknown chunk support on write");
1167

1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179
         return;
      }
#  endif

   /* Prior to 1.6.0 this code used png_malloc_warn; however, this meant that
    * unknown critical chunks could be lost with just a warning resulting in
    * undefined behavior.  Now png_chunk_report is used to provide behavior
    * appropriate to read or write.
    */
   np = png_voidcast(png_unknown_chunkp, png_realloc_array(png_ptr,
         info_ptr->unknown_chunks, info_ptr->unknown_chunks_num, num_unknowns,
         sizeof *np));
1180 1181 1182

   if (np == NULL)
   {
1183 1184
      png_chunk_report(png_ptr, "too many unknown chunks",
         PNG_CHUNK_WRITE_ERROR);
1185

1186 1187 1188
      return;
   }

1189
   png_free(png_ptr, info_ptr->unknown_chunks);
1190 1191
   info_ptr->unknown_chunks = np; /* safe because it is initialized */
   info_ptr->free_me |= PNG_FREE_UNKN;
1192

1193
   np += info_ptr->unknown_chunks_num;
1194

1195 1196 1197 1198 1199 1200 1201 1202
   /* Increment unknown_chunks_num each time round the loop to protect the
    * just-allocated chunk data.
    */
   for (; num_unknowns > 0; --num_unknowns, ++unknowns)
   {
      memcpy(np->name, unknowns->name, (sizeof np->name));
      np->name[(sizeof np->name)-1] = '\0';
      np->location = check_location(png_ptr, unknowns->location);
1203

1204 1205 1206 1207 1208
      if (unknowns->size == 0)
      {
         np->data = NULL;
         np->size = 0;
      }
1209

1210 1211
      else
      {
1212 1213
         np->data = png_voidcast(png_bytep,
            png_malloc_base(png_ptr, unknowns->size));
1214

1215
         if (np->data == NULL)
1216
         {
1217 1218 1219 1220
            png_chunk_report(png_ptr, "unknown chunk: out of memory",
               PNG_CHUNK_WRITE_ERROR);
            /* But just skip storing the unknown chunk */
            continue;
1221 1222
         }

1223 1224
         memcpy(np->data, unknowns->data, unknowns->size);
         np->size = unknowns->size;
1225
      }
1226

1227 1228 1229 1230 1231 1232 1233
      /* These increments are skipped on out-of-memory for the data - the
       * unknown chunk entry gets overwritten if the png_chunk_report returns.
       * This is correct in the read case (the chunk is just dropped.)
       */
      ++np;
      ++(info_ptr->unknown_chunks_num);
   }
1234
}
1235

1236
void PNGAPI
1237
png_set_unknown_chunk_location(png_const_structrp png_ptr, png_inforp info_ptr,
1238
    int chunk, int location)
1239
{
1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251
   /* This API is pretty pointless in 1.6.0 because the location can be set
    * before the call to png_set_unknown_chunks.
    *
    * TODO: add a png_app_warning in 1.7
    */
   if (png_ptr != NULL && info_ptr != NULL && chunk >= 0 &&
      chunk < info_ptr->unknown_chunks_num)
   {
      if ((location & (PNG_HAVE_IHDR|PNG_HAVE_PLTE|PNG_AFTER_IDAT)) == 0)
      {
         png_app_error(png_ptr, "invalid unknown chunk location");
         /* Fake out the pre 1.6.0 behavior: */
1252
         if ((location & PNG_HAVE_IDAT) != 0) /* undocumented! */
1253 1254 1255 1256 1257 1258 1259 1260 1261
            location = PNG_AFTER_IDAT;

         else
            location = PNG_HAVE_IHDR; /* also undocumented */
      }

      info_ptr->unknown_chunks[chunk].location =
         check_location(png_ptr, location);
   }
1262
}
1263
#endif /* STORE_UNKNOWN_CHUNKS */
1264

1265
#ifdef PNG_MNG_FEATURES_SUPPORTED
1266
png_uint_32 PNGAPI
1267
png_permit_mng_features (png_structrp png_ptr, png_uint_32 mng_features)
1268
{
1269
   png_debug(1, "in png_permit_mng_features");
1270

1271
   if (png_ptr == NULL)
1272
      return 0;
1273

1274
   png_ptr->mng_features_permitted = mng_features & PNG_ALL_MNG_FEATURES;
1275

1276
   return png_ptr->mng_features_permitted;
1277 1278
}
#endif
1279

1280
#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
1281 1282 1283 1284 1285 1286 1287 1288
static unsigned int
add_one_chunk(png_bytep list, unsigned int count, png_const_bytep add, int keep)
{
   unsigned int i;

   /* Utility function: update the 'keep' state of a chunk if it is already in
    * the list, otherwise add it to the list.
    */
1289
   for (i=0; i<count; ++i, list += 5)
1290
   {
1291 1292 1293
      if (memcmp(list, add, 4) == 0)
      {
         list[4] = (png_byte)keep;
1294

1295 1296
         return count;
      }
1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308
   }

   if (keep != PNG_HANDLE_CHUNK_AS_DEFAULT)
   {
      ++count;
      memcpy(list, add, 4);
      list[4] = (png_byte)keep;
   }

   return count;
}

1309 1310
void PNGAPI
png_set_keep_unknown_chunks(png_structrp png_ptr, int keep,
1311
    png_const_bytep chunk_list, int num_chunks_in)
1312
{
1313 1314 1315
   png_bytep new_list;
   unsigned int num_chunks, old_num_chunks;

1316 1317
   if (png_ptr == NULL)
      return;
1318

1319
   if (keep < 0 || keep >= PNG_HANDLE_CHUNK_LAST)
1320
   {
1321
      png_app_error(png_ptr, "png_set_keep_unknown_chunks: invalid keep");
1322

1323 1324
      return;
   }
1325

1326 1327 1328
   if (num_chunks_in <= 0)
   {
      png_ptr->unknown_default = keep;
1329

1330 1331 1332 1333
      /* '0' means just set the flags, so stop here */
      if (num_chunks_in == 0)
        return;
   }
1334

1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360
   if (num_chunks_in < 0)
   {
      /* Ignore all unknown chunks and all chunks recognized by
       * libpng except for IHDR, PLTE, tRNS, IDAT, and IEND
       */
      static PNG_CONST png_byte chunks_to_ignore[] = {
         98,  75,  71,  68, '\0',  /* bKGD */
         99,  72,  82,  77, '\0',  /* cHRM */
        103,  65,  77,  65, '\0',  /* gAMA */
        104,  73,  83,  84, '\0',  /* hIST */
        105,  67,  67,  80, '\0',  /* iCCP */
        105,  84,  88, 116, '\0',  /* iTXt */
        111,  70,  70, 115, '\0',  /* oFFs */
        112,  67,  65,  76, '\0',  /* pCAL */
        112,  72,  89, 115, '\0',  /* pHYs */
        115,  66,  73,  84, '\0',  /* sBIT */
        115,  67,  65,  76, '\0',  /* sCAL */
        115,  80,  76,  84, '\0',  /* sPLT */
        115,  84,  69,  82, '\0',  /* sTER */
        115,  82,  71,  66, '\0',  /* sRGB */
        116,  69,  88, 116, '\0',  /* tEXt */
        116,  73,  77,  69, '\0',  /* tIME */
        122,  84,  88, 116, '\0'   /* zTXt */
      };

      chunk_list = chunks_to_ignore;
1361
      num_chunks = (unsigned int)/*SAFE*/(sizeof chunks_to_ignore)/5U;
1362
   }
1363

1364 1365 1366 1367 1368 1369 1370 1371
   else /* num_chunks_in > 0 */
   {
      if (chunk_list == NULL)
      {
         /* Prior to 1.6.0 this was silently ignored, now it is an app_error
          * which can be switched off.
          */
         png_app_error(png_ptr, "png_set_keep_unknown_chunks: no chunk list");
1372

1373 1374 1375 1376
         return;
      }

      num_chunks = num_chunks_in;
1377 1378
   }

1379 1380 1381 1382 1383 1384 1385 1386 1387
   old_num_chunks = png_ptr->num_chunk_list;
   if (png_ptr->chunk_list == NULL)
      old_num_chunks = 0;

   /* Since num_chunks is always restricted to UINT_MAX/5 this can't overflow.
    */
   if (num_chunks + old_num_chunks > UINT_MAX/5)
   {
      png_app_error(png_ptr, "png_set_keep_unknown_chunks: too many chunks");
1388

1389
      return;
1390
   }
1391

1392 1393 1394 1395
   /* If these chunks are being reset to the default then no more memory is
    * required because add_one_chunk above doesn't extend the list if the 'keep'
    * parameter is the default.
    */
1396
   if (keep != 0)
1397 1398 1399
   {
      new_list = png_voidcast(png_bytep, png_malloc(png_ptr,
          5 * (num_chunks + old_num_chunks)));
1400

1401 1402 1403 1404 1405 1406
      if (old_num_chunks > 0)
         memcpy(new_list, png_ptr->chunk_list, 5*old_num_chunks);
   }

   else if (old_num_chunks > 0)
      new_list = png_ptr->chunk_list;
1407

1408 1409 1410 1411 1412 1413 1414 1415 1416
   else
      new_list = NULL;

   /* Add the new chunks together with each one's handling code.  If the chunk
    * already exists the code is updated, otherwise the chunk is added to the
    * end.  (In libpng 1.6.0 order no longer matters because this code enforces
    * the earlier convention that the last setting is the one that is used.)
    */
   if (new_list != NULL)
1417
   {
1418 1419 1420 1421 1422
      png_const_bytep inlist;
      png_bytep outlist;
      unsigned int i;

      for (i=0; i<num_chunks; ++i)
1423
      {
1424 1425
         old_num_chunks = add_one_chunk(new_list, old_num_chunks,
            chunk_list+5*i, keep);
1426
      }
1427 1428 1429 1430

      /* Now remove any spurious 'default' entries. */
      num_chunks = 0;
      for (i=0, inlist=outlist=new_list; i<old_num_chunks; ++i, inlist += 5)
1431
      {
1432 1433 1434 1435 1436 1437 1438
         if (inlist[4])
         {
            if (outlist != inlist)
               memcpy(outlist, inlist, 5);
            outlist += 5;
            ++num_chunks;
         }
1439
      }
1440 1441 1442 1443 1444 1445 1446 1447 1448

      /* This means the application has removed all the specialized handling. */
      if (num_chunks == 0)
      {
         if (png_ptr->chunk_list != new_list)
            png_free(png_ptr, new_list);

         new_list = NULL;
      }
1449
   }
1450

1451 1452 1453 1454
   else
      num_chunks = 0;

   png_ptr->num_chunk_list = num_chunks;
1455

1456 1457 1458 1459
   if (png_ptr->chunk_list != new_list)
   {
      if (png_ptr->chunk_list != NULL)
         png_free(png_ptr, png_ptr->chunk_list);
1460

1461 1462
      png_ptr->chunk_list = new_list;
   }
1463 1464
}
#endif
1465

1466
#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
1467
void PNGAPI
1468
png_set_read_user_chunk_fn(png_structrp png_ptr, png_voidp user_chunk_ptr,
1469
    png_user_chunk_ptr read_user_chunk_fn)
1470
{
1471
   png_debug(1, "in png_set_read_user_chunk_fn");
1472

1473 1474
   if (png_ptr == NULL)
      return;
1475

1476 1477 1478 1479
   png_ptr->read_user_chunk_fn = read_user_chunk_fn;
   png_ptr->user_chunk_ptr = user_chunk_ptr;
}
#endif
1480

1481
#ifdef PNG_INFO_IMAGE_SUPPORTED
1482
void PNGAPI
1483 1484
png_set_rows(png_const_structrp png_ptr, png_inforp info_ptr,
    png_bytepp row_pointers)
1485
{
1486
   png_debug1(1, "in %s storage function", "rows");
1487

1488 1489 1490
   if (png_ptr == NULL || info_ptr == NULL)
      return;

1491 1492
   if (info_ptr->row_pointers != NULL &&
       (info_ptr->row_pointers != row_pointers))
1493
      png_free_data(png_ptr, info_ptr, PNG_FREE_ROWS, 0);
1494

1495
   info_ptr->row_pointers = row_pointers;
1496

1497
   if (row_pointers != NULL)
1498
      info_ptr->valid |= PNG_INFO_IDAT;
1499 1500 1501
}
#endif

1502
void PNGAPI
1503
png_set_compression_buffer_size(png_structrp png_ptr, png_size_t size)
1504
{
1505 1506
    if (png_ptr == NULL)
       return;
1507

1508 1509
    if (size == 0 || size > PNG_UINT_31_MAX)
       png_error(png_ptr, "invalid compression buffer size");
1510

1511
#  ifdef PNG_SEQUENTIAL_READ_SUPPORTED
1512
      if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0)
1513 1514 1515 1516 1517 1518 1519
      {
         png_ptr->IDAT_read_size = (png_uint_32)size; /* checked above */
         return;
      }
#  endif

#  ifdef PNG_WRITE_SUPPORTED
1520
      if ((png_ptr->mode & PNG_IS_READ_STRUCT) == 0)
1521 1522 1523 1524 1525
      {
         if (png_ptr->zowner != 0)
         {
            png_warning(png_ptr,
              "Compression buffer size cannot be changed because it is in use");
1526

1527 1528
            return;
         }
1529

1530
#ifndef __COVERITY__
1531 1532 1533
         /* Some compilers complain that this is always false.  However, it
          * can be true when integer overflow happens.
          */
1534 1535 1536 1537 1538 1539
         if (size > ZLIB_IO_MAX)
         {
            png_warning(png_ptr,
               "Compression buffer size limited to system maximum");
            size = ZLIB_IO_MAX; /* must fit */
         }
1540
#endif
1541

1542
         if (size < 6)
1543 1544 1545 1546 1547 1548
         {
            /* Deflate will potentially go into an infinite loop on a SYNC_FLUSH
             * if this is permitted.
             */
            png_warning(png_ptr,
               "Compression buffer size cannot be reduced below 6");
1549

1550 1551
            return;
         }
1552

1553 1554 1555 1556 1557 1558 1559
         if (png_ptr->zbuffer_size != size)
         {
            png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list);
            png_ptr->zbuffer_size = (uInt)size;
         }
      }
#  endif
1560
}
1561 1562

void PNGAPI
1563
png_set_invalid(png_const_structrp png_ptr, png_inforp info_ptr, int mask)
1564
{
1565
   if (png_ptr != NULL && info_ptr != NULL)
1566
      info_ptr->valid &= ~mask;
1567
}
1568

1569

1570
#ifdef PNG_SET_USER_LIMITS_SUPPORTED
1571
/* This function was added to libpng 1.2.6 */
1572
void PNGAPI
1573
png_set_user_limits (png_structrp png_ptr, png_uint_32 user_width_max,
1574 1575
    png_uint_32 user_height_max)
{
1576 1577
   /* Images with dimensions larger than these limits will be
    * rejected by png_set_IHDR().  To accept any PNG datastream
1578
    * regardless of dimensions, set both limits to 0x7fffffff.
1579 1580 1581
    */
   if (png_ptr == NULL)
      return;
1582

1583 1584
   png_ptr->user_width_max = user_width_max;
   png_ptr->user_height_max = user_height_max;
1585
}
1586

1587
/* This function was added to libpng 1.4.0 */
1588
void PNGAPI
1589
png_set_chunk_cache_max (png_structrp png_ptr, png_uint_32 user_chunk_cache_max)
1590
{
1591 1592
   if (png_ptr != NULL)
      png_ptr->user_chunk_cache_max = user_chunk_cache_max;
1593 1594 1595 1596
}

/* This function was added to libpng 1.4.1 */
void PNGAPI
1597
png_set_chunk_malloc_max (png_structrp png_ptr,
1598
    png_alloc_size_t user_chunk_malloc_max)
1599
{
1600
   if (png_ptr != NULL)
1601
      png_ptr->user_chunk_malloc_max = user_chunk_malloc_max;
1602
}
1603
#endif /* ?SET_USER_LIMITS */
1604

1605

1606
#ifdef PNG_BENIGN_ERRORS_SUPPORTED
1607
void PNGAPI
1608
png_set_benign_errors(png_structrp png_ptr, int allowed)
1609
{
1610
   png_debug(1, "in png_set_benign_errors");
1611

1612 1613 1614 1615 1616 1617
   /* If allowed is 1, png_benign_error() is treated as a warning.
    *
    * If allowed is 0, png_benign_error() is treated as an error (which
    * is the default behavior if png_set_benign_errors() is not called).
    */

1618
   if (allowed != 0)
1619 1620
      png_ptr->flags |= PNG_FLAG_BENIGN_ERRORS_WARN |
         PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN;
1621

1622
   else
1623 1624
      png_ptr->flags &= ~(PNG_FLAG_BENIGN_ERRORS_WARN |
         PNG_FLAG_APP_WARNINGS_WARN | PNG_FLAG_APP_ERRORS_WARN);
1625
}
1626
#endif /* BENIGN_ERRORS */
1627 1628 1629 1630 1631 1632

#ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
   /* Whether to report invalid palette index; added at libng-1.5.10.
    * It is possible for an indexed (color-type==3) PNG file to contain
    * pixels with invalid (out-of-range) indexes if the PLTE chunk has
    * fewer entries than the image's bit-depth would allow. We recover
1633
    * from this gracefully by filling any incomplete palette with zeros
1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648
    * (opaque black).  By default, when this occurs libpng will issue
    * a benign error.  This API can be used to override that behavior.
    */
void PNGAPI
png_set_check_for_invalid_index(png_structrp png_ptr, int allowed)
{
   png_debug(1, "in png_set_check_for_invalid_index");

   if (allowed > 0)
      png_ptr->num_palette_max = 0;

   else
      png_ptr->num_palette_max = -1;
}
#endif
1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732

#if defined(PNG_TEXT_SUPPORTED) || defined(PNG_pCAL_SUPPORTED) || \
    defined(PNG_iCCP_SUPPORTED) || defined(PNG_sPLT_SUPPORTED)
/* Check that the tEXt or zTXt keyword is valid per PNG 1.0 specification,
 * and if invalid, correct the keyword rather than discarding the entire
 * chunk.  The PNG 1.0 specification requires keywords 1-79 characters in
 * length, forbids leading or trailing whitespace, multiple internal spaces,
 * and the non-break space (0x80) from ISO 8859-1.  Returns keyword length.
 *
 * The 'new_key' buffer must be 80 characters in size (for the keyword plus a
 * trailing '\0').  If this routine returns 0 then there was no keyword, or a
 * valid one could not be generated, and the caller must png_error.
 */
png_uint_32 /* PRIVATE */
png_check_keyword(png_structrp png_ptr, png_const_charp key, png_bytep new_key)
{
   png_const_charp orig_key = key;
   png_uint_32 key_len = 0;
   int bad_character = 0;
   int space = 1;

   png_debug(1, "in png_check_keyword");

   if (key == NULL)
   {
      *new_key = 0;
      return 0;
   }

   while (*key && key_len < 79)
   {
      png_byte ch = (png_byte)*key++;

      if ((ch > 32 && ch <= 126) || (ch >= 161 /*&& ch <= 255*/))
         *new_key++ = ch, ++key_len, space = 0;

      else if (space == 0)
      {
         /* A space or an invalid character when one wasn't seen immediately
          * before; output just a space.
          */
         *new_key++ = 32, ++key_len, space = 1;

         /* If the character was not a space then it is invalid. */
         if (ch != 32)
            bad_character = ch;
      }

      else if (bad_character == 0)
         bad_character = ch; /* just skip it, record the first error */
   }

   if (key_len > 0 && space != 0) /* trailing space */
   {
      --key_len, --new_key;
      if (bad_character == 0)
         bad_character = 32;
   }

   /* Terminate the keyword */
   *new_key = 0;

   if (key_len == 0)
      return 0;

#ifdef PNG_WARNINGS_SUPPORTED
   /* Try to only output one warning per keyword: */
   if (*key != 0) /* keyword too long */
      png_warning(png_ptr, "keyword truncated");

   else if (bad_character != 0)
   {
      PNG_WARNING_PARAMETERS(p)

      png_warning_parameter(p, 1, orig_key);
      png_warning_parameter_signed(p, 2, PNG_NUMBER_FORMAT_02x, bad_character);

      png_formatted_warning(png_ptr, p, "keyword \"@1\": bad character '0x@2'");
   }
#endif /* WARNINGS */

   return key_len;
}
#endif /* TEXT || pCAL || iCCP || sPLT */
1733
#endif /* READ || WRITE */