pngpread.c 45.7 KB
Newer Older
G
Guy Schalnat 已提交
1 2

/* pngpread.c - read a png file in push mode
3
 *
4
 * Last changed in libpng 1.5.0 [May 6, 2010]
5
 * Copyright (c) 1998-2010 Glenn Randers-Pehrson
6 7
 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
8
 *
9
 * This code is released under the libpng license.
10
 * For conditions of distribution and use, see the disclaimer
11
 * and license in png.h
12
 */
G
Guy Schalnat 已提交
13

14
#include "pngpriv.h"
G
Guy Schalnat 已提交
15

16 17
#ifdef PNG_PROGRESSIVE_READ_SUPPORTED

18
/* Push model modes */
19 20 21 22 23 24 25 26 27 28
#define PNG_READ_SIG_MODE   0
#define PNG_READ_CHUNK_MODE 1
#define PNG_READ_IDAT_MODE  2
#define PNG_SKIP_MODE       3
#define PNG_READ_tEXt_MODE  4
#define PNG_READ_zTXt_MODE  5
#define PNG_READ_DONE_MODE  6
#define PNG_READ_iTXt_MODE  7
#define PNG_ERROR_MODE      8

29
void PNGAPI
A
Andreas Dilger 已提交
30
png_process_data(png_structp png_ptr, png_infop info_ptr,
31
    png_bytep buffer, png_size_t buffer_size)
G
Guy Schalnat 已提交
32
{
33 34 35
   if (png_ptr == NULL || info_ptr == NULL)
      return;

G
Guy Schalnat 已提交
36
   png_push_restore_buffer(png_ptr, buffer, buffer_size);
G
Guy Schalnat 已提交
37

G
Guy Schalnat 已提交
38 39
   while (png_ptr->buffer_size)
   {
A
Andreas Dilger 已提交
40
      png_process_some_data(png_ptr, info_ptr);
G
Guy Schalnat 已提交
41
   }
G
Guy Schalnat 已提交
42 43
}

A
Andreas Dilger 已提交
44 45 46
/* What we do with the incoming data depends on what we were previously
 * doing before we ran out of data...
 */
47
void /* PRIVATE */
A
Andreas Dilger 已提交
48
png_process_some_data(png_structp png_ptr, png_infop info_ptr)
G
Guy Schalnat 已提交
49
{
50 51 52
   if (png_ptr == NULL)
      return;

G
Guy Schalnat 已提交
53 54 55 56
   switch (png_ptr->process_mode)
   {
      case PNG_READ_SIG_MODE:
      {
A
Andreas Dilger 已提交
57
         png_push_read_sig(png_ptr, info_ptr);
G
Guy Schalnat 已提交
58 59
         break;
      }
60

G
Guy Schalnat 已提交
61 62
      case PNG_READ_CHUNK_MODE:
      {
A
Andreas Dilger 已提交
63
         png_push_read_chunk(png_ptr, info_ptr);
G
Guy Schalnat 已提交
64 65
         break;
      }
66

G
Guy Schalnat 已提交
67 68
      case PNG_READ_IDAT_MODE:
      {
G
Guy Schalnat 已提交
69
         png_push_read_IDAT(png_ptr);
G
Guy Schalnat 已提交
70 71
         break;
      }
72

73
#ifdef PNG_READ_tEXt_SUPPORTED
G
Guy Schalnat 已提交
74 75
      case PNG_READ_tEXt_MODE:
      {
A
Andreas Dilger 已提交
76
         png_push_read_tEXt(png_ptr, info_ptr);
G
Guy Schalnat 已提交
77 78
         break;
      }
79

G
Guy Schalnat 已提交
80
#endif
81
#ifdef PNG_READ_zTXt_SUPPORTED
G
Guy Schalnat 已提交
82 83
      case PNG_READ_zTXt_MODE:
      {
A
Andreas Dilger 已提交
84
         png_push_read_zTXt(png_ptr, info_ptr);
G
Guy Schalnat 已提交
85 86
         break;
      }
87

88
#endif
89
#ifdef PNG_READ_iTXt_SUPPORTED
90 91 92 93 94
      case PNG_READ_iTXt_MODE:
      {
         png_push_read_iTXt(png_ptr, info_ptr);
         break;
      }
95

G
Guy Schalnat 已提交
96 97 98
#endif
      case PNG_SKIP_MODE:
      {
A
Andreas Dilger 已提交
99
         png_push_crc_finish(png_ptr);
G
Guy Schalnat 已提交
100 101
         break;
      }
102

G
Guy Schalnat 已提交
103 104 105 106 107 108
      default:
      {
         png_ptr->buffer_size = 0;
         break;
      }
   }
G
Guy Schalnat 已提交
109 110
}

A
Andreas Dilger 已提交
111 112
/* Read any remaining signature bytes from the stream and compare them with
 * the correct PNG signature.  It is possible that this routine is called
113 114 115
 * with bytes already read from the signature, either because they have been
 * checked by the calling application, or because of multiple calls to this
 * routine.
A
Andreas Dilger 已提交
116
 */
117
void /* PRIVATE */
A
Andreas Dilger 已提交
118
png_push_read_sig(png_structp png_ptr, png_infop info_ptr)
G
Guy Schalnat 已提交
119
{
A
Andreas Dilger 已提交
120 121
   png_size_t num_checked = png_ptr->sig_bytes,
             num_to_check = 8 - num_checked;
G
Guy Schalnat 已提交
122

A
Andreas Dilger 已提交
123
   if (png_ptr->buffer_size < num_to_check)
G
Guy Schalnat 已提交
124
   {
A
Andreas Dilger 已提交
125
      num_to_check = png_ptr->buffer_size;
G
Guy Schalnat 已提交
126 127
   }

128
   png_push_fill_buffer(png_ptr, &(info_ptr->signature[num_checked]),
129
       num_to_check);
130
   png_ptr->sig_bytes = (png_byte)(png_ptr->sig_bytes + num_to_check);
G
Guy Schalnat 已提交
131

A
Andreas Dilger 已提交
132
   if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check))
G
Guy Schalnat 已提交
133
   {
A
Andreas Dilger 已提交
134 135 136
      if (num_checked < 4 &&
          png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4))
         png_error(png_ptr, "Not a PNG file");
137

A
Andreas Dilger 已提交
138 139
      else
         png_error(png_ptr, "PNG file corrupted by ASCII conversion");
G
Guy Schalnat 已提交
140 141 142
   }
   else
   {
A
Andreas Dilger 已提交
143 144 145 146
      if (png_ptr->sig_bytes >= 8)
      {
         png_ptr->process_mode = PNG_READ_CHUNK_MODE;
      }
G
Guy Schalnat 已提交
147
   }
G
Guy Schalnat 已提交
148 149
}

150
void /* PRIVATE */
A
Andreas Dilger 已提交
151
png_push_read_chunk(png_structp png_ptr, png_infop info_ptr)
G
Guy Schalnat 已提交
152
{
153 154 155 156
      PNG_IHDR;
      PNG_IDAT;
      PNG_IEND;
      PNG_PLTE;
157
#ifdef PNG_READ_bKGD_SUPPORTED
158
      PNG_bKGD;
159
#endif
160
#ifdef PNG_READ_cHRM_SUPPORTED
161
      PNG_cHRM;
162
#endif
163
#ifdef PNG_READ_gAMA_SUPPORTED
164
      PNG_gAMA;
165
#endif
166
#ifdef PNG_READ_hIST_SUPPORTED
167
      PNG_hIST;
168
#endif
169
#ifdef PNG_READ_iCCP_SUPPORTED
170
      PNG_iCCP;
171
#endif
172
#ifdef PNG_READ_iTXt_SUPPORTED
173
      PNG_iTXt;
174
#endif
175
#ifdef PNG_READ_oFFs_SUPPORTED
176
      PNG_oFFs;
177
#endif
178
#ifdef PNG_READ_pCAL_SUPPORTED
179
      PNG_pCAL;
180
#endif
181
#ifdef PNG_READ_pHYs_SUPPORTED
182
      PNG_pHYs;
183
#endif
184
#ifdef PNG_READ_sBIT_SUPPORTED
185
      PNG_sBIT;
186
#endif
187
#ifdef PNG_READ_sCAL_SUPPORTED
188
      PNG_sCAL;
189
#endif
190
#ifdef PNG_READ_sRGB_SUPPORTED
191
      PNG_sRGB;
192
#endif
193
#ifdef PNG_READ_sPLT_SUPPORTED
194
      PNG_sPLT;
195
#endif
196
#ifdef PNG_READ_tEXt_SUPPORTED
197
      PNG_tEXt;
198
#endif
199
#ifdef PNG_READ_tIME_SUPPORTED
200
      PNG_tIME;
201
#endif
202
#ifdef PNG_READ_tRNS_SUPPORTED
203
      PNG_tRNS;
204
#endif
205
#ifdef PNG_READ_zTXt_SUPPORTED
206
      PNG_zTXt;
207
#endif
208

A
Andreas Dilger 已提交
209
   /* First we make sure we have enough data for the 4 byte chunk name
210 211 212 213 214
    * and the 4 byte chunk length before proceeding with decoding the
    * chunk data.  To fully decode each of these chunks, we also make
    * sure we have enough data in the buffer for the 4 byte CRC at the
    * end of every chunk (except IDAT, which is handled separately).
    */
215
   if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER))
G
Guy Schalnat 已提交
216
   {
A
Andreas Dilger 已提交
217
      png_byte chunk_length[4];
G
Guy Schalnat 已提交
218 219 220 221 222 223 224

      if (png_ptr->buffer_size < 8)
      {
         png_push_save_buffer(png_ptr);
         return;
      }

A
Andreas Dilger 已提交
225
      png_push_fill_buffer(png_ptr, chunk_length, 4);
226
      png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
G
Guy Schalnat 已提交
227
      png_reset_crc(png_ptr);
A
Andreas Dilger 已提交
228
      png_crc_read(png_ptr, png_ptr->chunk_name, 4);
229
      png_check_chunk_name(png_ptr, png_ptr->chunk_name);
230
      png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
G
Guy Schalnat 已提交
231 232
   }

233
   if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
234 235
      if (png_ptr->mode & PNG_AFTER_IDAT)
         png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT;
236

A
Andreas Dilger 已提交
237
   if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
G
Guy Schalnat 已提交
238
   {
239 240
      if (png_ptr->push_length != 13)
         png_error(png_ptr, "Invalid IHDR length");
241

242 243 244
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
G
Guy Schalnat 已提交
245
         return;
246
      }
247

A
Andreas Dilger 已提交
248
      png_handle_IHDR(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
249
   }
250

251 252
   else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
   {
253 254 255
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
256
         return;
257
      }
258

259 260 261 262 263
      png_handle_IEND(png_ptr, info_ptr, png_ptr->push_length);

      png_ptr->process_mode = PNG_READ_DONE_MODE;
      png_push_have_end(png_ptr, info_ptr);
   }
264

265 266 267
#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
   else if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name))
   {
268 269 270
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
271
         return;
272
      }
273

274 275
      if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
         png_ptr->mode |= PNG_HAVE_IDAT;
276

277
      png_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
278

279 280
      if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
         png_ptr->mode |= PNG_HAVE_PLTE;
281

282 283 284 285
      else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
      {
         if (!(png_ptr->mode & PNG_HAVE_IHDR))
            png_error(png_ptr, "Missing IHDR before IDAT");
286

287
         else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
288
             !(png_ptr->mode & PNG_HAVE_PLTE))
289 290 291
            png_error(png_ptr, "Missing PLTE before IDAT");
      }
   }
292

293
#endif
A
Andreas Dilger 已提交
294
   else if (!png_memcmp(png_ptr->chunk_name, png_PLTE, 4))
G
Guy Schalnat 已提交
295
   {
296 297 298
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
A
Andreas Dilger 已提交
299
         return;
300
      }
A
Andreas Dilger 已提交
301
      png_handle_PLTE(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
302
   }
303

304
   else if (!png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
G
Guy Schalnat 已提交
305
   {
A
Andreas Dilger 已提交
306
      /* If we reach an IDAT chunk, this means we have read all of the
307 308 309
       * header chunks, and we can start reading the image (or if this
       * is called after the image has been read - we have an error).
       */
310 311 312 313 314 315 316

      if (!(png_ptr->mode & PNG_HAVE_IHDR))
         png_error(png_ptr, "Missing IHDR before IDAT");

      else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
          !(png_ptr->mode & PNG_HAVE_PLTE))
         png_error(png_ptr, "Missing PLTE before IDAT");
317

A
Andreas Dilger 已提交
318 319
      if (png_ptr->mode & PNG_HAVE_IDAT)
      {
320
         if (!(png_ptr->mode & PNG_HAVE_CHUNK_AFTER_IDAT))
321 322
            if (png_ptr->push_length == 0)
               return;
A
Andreas Dilger 已提交
323 324

         if (png_ptr->mode & PNG_AFTER_IDAT)
325
            png_benign_error(png_ptr, "Too many IDATs found");
A
Andreas Dilger 已提交
326 327
      }

G
Guy Schalnat 已提交
328
      png_ptr->idat_size = png_ptr->push_length;
A
Andreas Dilger 已提交
329
      png_ptr->mode |= PNG_HAVE_IDAT;
G
Guy Schalnat 已提交
330
      png_ptr->process_mode = PNG_READ_IDAT_MODE;
A
Andreas Dilger 已提交
331
      png_push_have_info(png_ptr, info_ptr);
332 333 334
      png_ptr->zstream.avail_out =
          (uInt) PNG_ROWBYTES(png_ptr->pixel_depth,
          png_ptr->iwidth) + 1;
A
Andreas Dilger 已提交
335
      png_ptr->zstream.next_out = png_ptr->row_buf;
G
Guy Schalnat 已提交
336 337
      return;
   }
338

339
#ifdef PNG_READ_gAMA_SUPPORTED
A
Andreas Dilger 已提交
340
   else if (!png_memcmp(png_ptr->chunk_name, png_gAMA, 4))
G
Guy Schalnat 已提交
341
   {
342 343 344
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
G
Guy Schalnat 已提交
345
         return;
346
      }
347

A
Andreas Dilger 已提交
348
      png_handle_gAMA(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
349
   }
350

G
Guy Schalnat 已提交
351
#endif
352
#ifdef PNG_READ_sBIT_SUPPORTED
A
Andreas Dilger 已提交
353
   else if (!png_memcmp(png_ptr->chunk_name, png_sBIT, 4))
G
Guy Schalnat 已提交
354
   {
355 356 357
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
G
Guy Schalnat 已提交
358
         return;
359
      }
360

A
Andreas Dilger 已提交
361
      png_handle_sBIT(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
362
   }
363

G
Guy Schalnat 已提交
364
#endif
365
#ifdef PNG_READ_cHRM_SUPPORTED
A
Andreas Dilger 已提交
366
   else if (!png_memcmp(png_ptr->chunk_name, png_cHRM, 4))
G
Guy Schalnat 已提交
367
   {
368 369 370
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
G
Guy Schalnat 已提交
371
         return;
372
      }
373

A
Andreas Dilger 已提交
374
      png_handle_cHRM(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
375
   }
376

G
Guy Schalnat 已提交
377
#endif
378
#ifdef PNG_READ_sRGB_SUPPORTED
379 380
   else if (!png_memcmp(png_ptr->chunk_name, png_sRGB, 4))
   {
381 382 383
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
384
         return;
385
      }
386

387 388
      png_handle_sRGB(png_ptr, info_ptr, png_ptr->push_length);
   }
389

390
#endif
391
#ifdef PNG_READ_iCCP_SUPPORTED
392 393
   else if (!png_memcmp(png_ptr->chunk_name, png_iCCP, 4))
   {
394 395 396
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
397
         return;
398
      }
399

400 401
      png_handle_iCCP(png_ptr, info_ptr, png_ptr->push_length);
   }
402

403
#endif
404
#ifdef PNG_READ_sPLT_SUPPORTED
405 406
   else if (!png_memcmp(png_ptr->chunk_name, png_sPLT, 4))
   {
407 408 409
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
410
         return;
411
      }
412

413 414
      png_handle_sPLT(png_ptr, info_ptr, png_ptr->push_length);
   }
415

416
#endif
417
#ifdef PNG_READ_tRNS_SUPPORTED
A
Andreas Dilger 已提交
418
   else if (!png_memcmp(png_ptr->chunk_name, png_tRNS, 4))
G
Guy Schalnat 已提交
419
   {
420 421 422
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
G
Guy Schalnat 已提交
423
         return;
424
      }
425

A
Andreas Dilger 已提交
426
      png_handle_tRNS(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
427
   }
428

G
Guy Schalnat 已提交
429
#endif
430
#ifdef PNG_READ_bKGD_SUPPORTED
A
Andreas Dilger 已提交
431
   else if (!png_memcmp(png_ptr->chunk_name, png_bKGD, 4))
G
Guy Schalnat 已提交
432
   {
433 434 435
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
G
Guy Schalnat 已提交
436
         return;
437
      }
438

A
Andreas Dilger 已提交
439
      png_handle_bKGD(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
440
   }
441

G
Guy Schalnat 已提交
442
#endif
443
#ifdef PNG_READ_hIST_SUPPORTED
A
Andreas Dilger 已提交
444
   else if (!png_memcmp(png_ptr->chunk_name, png_hIST, 4))
G
Guy Schalnat 已提交
445
   {
446 447 448
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
G
Guy Schalnat 已提交
449
         return;
450
      }
451

A
Andreas Dilger 已提交
452
      png_handle_hIST(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
453
   }
454

G
Guy Schalnat 已提交
455
#endif
456
#ifdef PNG_READ_pHYs_SUPPORTED
A
Andreas Dilger 已提交
457
   else if (!png_memcmp(png_ptr->chunk_name, png_pHYs, 4))
G
Guy Schalnat 已提交
458 459 460 461 462 463
   {
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
         return;
      }
464

A
Andreas Dilger 已提交
465
      png_handle_pHYs(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
466
   }
467

G
Guy Schalnat 已提交
468
#endif
469
#ifdef PNG_READ_oFFs_SUPPORTED
A
Andreas Dilger 已提交
470
   else if (!png_memcmp(png_ptr->chunk_name, png_oFFs, 4))
G
Guy Schalnat 已提交
471
   {
472 473 474
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
G
Guy Schalnat 已提交
475
         return;
476
      }
477

A
Andreas Dilger 已提交
478
      png_handle_oFFs(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
479
   }
G
Guy Schalnat 已提交
480
#endif
481

482
#ifdef PNG_READ_pCAL_SUPPORTED
A
Andreas Dilger 已提交
483 484
   else if (!png_memcmp(png_ptr->chunk_name, png_pCAL, 4))
   {
485 486 487
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
A
Andreas Dilger 已提交
488
         return;
489
      }
490

A
Andreas Dilger 已提交
491 492
      png_handle_pCAL(png_ptr, info_ptr, png_ptr->push_length);
   }
493

A
Andreas Dilger 已提交
494
#endif
495
#ifdef PNG_READ_sCAL_SUPPORTED
496 497
   else if (!png_memcmp(png_ptr->chunk_name, png_sCAL, 4))
   {
498 499 500
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
501
         return;
502
      }
503

504 505
      png_handle_sCAL(png_ptr, info_ptr, png_ptr->push_length);
   }
506

507
#endif
508
#ifdef PNG_READ_tIME_SUPPORTED
A
Andreas Dilger 已提交
509
   else if (!png_memcmp(png_ptr->chunk_name, png_tIME, 4))
G
Guy Schalnat 已提交
510
   {
511 512 513
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
G
Guy Schalnat 已提交
514
         return;
515
      }
516

A
Andreas Dilger 已提交
517
      png_handle_tIME(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
518
   }
519

G
Guy Schalnat 已提交
520
#endif
521
#ifdef PNG_READ_tEXt_SUPPORTED
A
Andreas Dilger 已提交
522
   else if (!png_memcmp(png_ptr->chunk_name, png_tEXt, 4))
G
Guy Schalnat 已提交
523
   {
524 525 526
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
527
         return;
528
      }
529

A
Andreas Dilger 已提交
530
      png_push_handle_tEXt(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
531
   }
532

G
Guy Schalnat 已提交
533
#endif
534
#ifdef PNG_READ_zTXt_SUPPORTED
A
Andreas Dilger 已提交
535
   else if (!png_memcmp(png_ptr->chunk_name, png_zTXt, 4))
G
Guy Schalnat 已提交
536
   {
537 538 539
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
540
         return;
541
      }
542

A
Andreas Dilger 已提交
543
      png_push_handle_zTXt(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
544
   }
545

546
#endif
547
#ifdef PNG_READ_iTXt_SUPPORTED
548
   else if (!png_memcmp(png_ptr->chunk_name, png_iTXt, 4))
549
   {
550 551 552
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
553
         return;
554
      }
555

556 557
      png_push_handle_iTXt(png_ptr, info_ptr, png_ptr->push_length);
   }
558

G
Guy Schalnat 已提交
559
#endif
G
Guy Schalnat 已提交
560 561
   else
   {
562 563 564
      if (png_ptr->push_length + 4 > png_ptr->buffer_size)
      {
         png_push_save_buffer(png_ptr);
565
         return;
566
      }
A
Andreas Dilger 已提交
567
      png_push_handle_unknown(png_ptr, info_ptr, png_ptr->push_length);
G
Guy Schalnat 已提交
568
   }
G
Guy Schalnat 已提交
569

570
   png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
G
Guy Schalnat 已提交
571 572
}

573
void /* PRIVATE */
A
Andreas Dilger 已提交
574
png_push_crc_skip(png_structp png_ptr, png_uint_32 skip)
G
Guy Schalnat 已提交
575
{
G
Guy Schalnat 已提交
576
   png_ptr->process_mode = PNG_SKIP_MODE;
A
Andreas Dilger 已提交
577
   png_ptr->skip_length = skip;
G
Guy Schalnat 已提交
578 579
}

580
void /* PRIVATE */
A
Andreas Dilger 已提交
581
png_push_crc_finish(png_structp png_ptr)
G
Guy Schalnat 已提交
582
{
G
Guy Schalnat 已提交
583 584
   if (png_ptr->skip_length && png_ptr->save_buffer_size)
   {
A
Andreas Dilger 已提交
585
      png_size_t save_size;
G
Guy Schalnat 已提交
586

A
Andreas Dilger 已提交
587 588
      if (png_ptr->skip_length < (png_uint_32)png_ptr->save_buffer_size)
         save_size = (png_size_t)png_ptr->skip_length;
589

G
Guy Schalnat 已提交
590 591 592 593 594 595 596 597
      else
         save_size = png_ptr->save_buffer_size;

      png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);

      png_ptr->skip_length -= save_size;
      png_ptr->buffer_size -= save_size;
      png_ptr->save_buffer_size -= save_size;
A
Andreas Dilger 已提交
598
      png_ptr->save_buffer_ptr += save_size;
G
Guy Schalnat 已提交
599 600 601
   }
   if (png_ptr->skip_length && png_ptr->current_buffer_size)
   {
A
Andreas Dilger 已提交
602
      png_size_t save_size;
G
Guy Schalnat 已提交
603

A
Andreas Dilger 已提交
604 605
      if (png_ptr->skip_length < (png_uint_32)png_ptr->current_buffer_size)
         save_size = (png_size_t)png_ptr->skip_length;
606

G
Guy Schalnat 已提交
607 608 609 610 611 612 613 614
      else
         save_size = png_ptr->current_buffer_size;

      png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);

      png_ptr->skip_length -= save_size;
      png_ptr->buffer_size -= save_size;
      png_ptr->current_buffer_size -= save_size;
A
Andreas Dilger 已提交
615
      png_ptr->current_buffer_ptr += save_size;
G
Guy Schalnat 已提交
616 617 618 619 620 621 622 623
   }
   if (!png_ptr->skip_length)
   {
      if (png_ptr->buffer_size < 4)
      {
         png_push_save_buffer(png_ptr);
         return;
      }
A
Andreas Dilger 已提交
624 625

      png_crc_finish(png_ptr, 0);
A
Andreas Dilger 已提交
626
      png_ptr->process_mode = PNG_READ_CHUNK_MODE;
G
Guy Schalnat 已提交
627
   }
G
Guy Schalnat 已提交
628 629
}

630
void PNGCBAPI
A
Andreas Dilger 已提交
631
png_push_fill_buffer(png_structp png_ptr, png_bytep buffer, png_size_t length)
G
Guy Schalnat 已提交
632
{
G
Guy Schalnat 已提交
633 634
   png_bytep ptr;

635 636 637
   if (png_ptr == NULL)
      return;

G
Guy Schalnat 已提交
638 639 640
   ptr = buffer;
   if (png_ptr->save_buffer_size)
   {
A
Andreas Dilger 已提交
641
      png_size_t save_size;
G
Guy Schalnat 已提交
642 643 644

      if (length < png_ptr->save_buffer_size)
         save_size = length;
645

G
Guy Schalnat 已提交
646 647 648
      else
         save_size = png_ptr->save_buffer_size;

A
Andreas Dilger 已提交
649
      png_memcpy(ptr, png_ptr->save_buffer_ptr, save_size);
G
Guy Schalnat 已提交
650
      length -= save_size;
A
Andreas Dilger 已提交
651
      ptr += save_size;
G
Guy Schalnat 已提交
652 653
      png_ptr->buffer_size -= save_size;
      png_ptr->save_buffer_size -= save_size;
A
Andreas Dilger 已提交
654
      png_ptr->save_buffer_ptr += save_size;
G
Guy Schalnat 已提交
655 656 657
   }
   if (length && png_ptr->current_buffer_size)
   {
A
Andreas Dilger 已提交
658
      png_size_t save_size;
G
Guy Schalnat 已提交
659 660 661

      if (length < png_ptr->current_buffer_size)
         save_size = length;
662

G
Guy Schalnat 已提交
663 664 665
      else
         save_size = png_ptr->current_buffer_size;

A
Andreas Dilger 已提交
666
      png_memcpy(ptr, png_ptr->current_buffer_ptr, save_size);
G
Guy Schalnat 已提交
667 668
      png_ptr->buffer_size -= save_size;
      png_ptr->current_buffer_size -= save_size;
A
Andreas Dilger 已提交
669
      png_ptr->current_buffer_ptr += save_size;
G
Guy Schalnat 已提交
670
   }
G
Guy Schalnat 已提交
671 672
}

673
void /* PRIVATE */
G
Guy Schalnat 已提交
674 675
png_push_save_buffer(png_structp png_ptr)
{
G
Guy Schalnat 已提交
676 677 678 679
   if (png_ptr->save_buffer_size)
   {
      if (png_ptr->save_buffer_ptr != png_ptr->save_buffer)
      {
680
         png_size_t i, istop;
G
Guy Schalnat 已提交
681 682 683
         png_bytep sp;
         png_bytep dp;

684
         istop = png_ptr->save_buffer_size;
G
Guy Schalnat 已提交
685
         for (i = 0, sp = png_ptr->save_buffer_ptr, dp = png_ptr->save_buffer;
686
             i < istop; i++, sp++, dp++)
G
Guy Schalnat 已提交
687 688 689 690 691
         {
            *dp = *sp;
         }
      }
   }
692
   if (png_ptr->save_buffer_size + png_ptr->current_buffer_size >
693
       png_ptr->save_buffer_max)
G
Guy Schalnat 已提交
694
   {
A
Andreas Dilger 已提交
695
      png_size_t new_max;
G
Guy Schalnat 已提交
696 697
      png_bytep old_buffer;

698
      if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
699
          (png_ptr->current_buffer_size + 256))
700
      {
701
         png_error(png_ptr, "Potential overflow of save_buffer");
702
      }
703

704
      new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256;
G
Guy Schalnat 已提交
705
      old_buffer = png_ptr->save_buffer;
706
      png_ptr->save_buffer = (png_bytep)png_malloc_warn(png_ptr,
707
          (png_size_t)new_max);
708

709 710
      if (png_ptr->save_buffer == NULL)
      {
711 712
         png_free(png_ptr, old_buffer);
         png_error(png_ptr, "Insufficient memory for save_buffer");
713
      }
714

715 716 717
      png_memcpy(png_ptr->save_buffer, old_buffer, png_ptr->save_buffer_size);
      png_free(png_ptr, old_buffer);
      png_ptr->save_buffer_max = new_max;
G
Guy Schalnat 已提交
718 719 720
   }
   if (png_ptr->current_buffer_size)
   {
A
Andreas Dilger 已提交
721 722
      png_memcpy(png_ptr->save_buffer + png_ptr->save_buffer_size,
         png_ptr->current_buffer_ptr, png_ptr->current_buffer_size);
G
Guy Schalnat 已提交
723 724 725 726 727
      png_ptr->save_buffer_size += png_ptr->current_buffer_size;
      png_ptr->current_buffer_size = 0;
   }
   png_ptr->save_buffer_ptr = png_ptr->save_buffer;
   png_ptr->buffer_size = 0;
G
Guy Schalnat 已提交
728 729
}

730
void /* PRIVATE */
G
Guy Schalnat 已提交
731
png_push_restore_buffer(png_structp png_ptr, png_bytep buffer,
A
Andreas Dilger 已提交
732
   png_size_t buffer_length)
G
Guy Schalnat 已提交
733
{
G
Guy Schalnat 已提交
734 735 736 737
   png_ptr->current_buffer = buffer;
   png_ptr->current_buffer_size = buffer_length;
   png_ptr->buffer_size = buffer_length + png_ptr->save_buffer_size;
   png_ptr->current_buffer_ptr = png_ptr->current_buffer;
G
Guy Schalnat 已提交
738 739
}

740
void /* PRIVATE */
G
Guy Schalnat 已提交
741
png_push_read_IDAT(png_structp png_ptr)
G
Guy Schalnat 已提交
742
{
743
   PNG_IDAT;
744
   if (!(png_ptr->mode & PNG_HAVE_CHUNK_HEADER))
G
Guy Schalnat 已提交
745
   {
A
Andreas Dilger 已提交
746
      png_byte chunk_length[4];
G
Guy Schalnat 已提交
747 748 749 750 751 752 753

      if (png_ptr->buffer_size < 8)
      {
         png_push_save_buffer(png_ptr);
         return;
      }

A
Andreas Dilger 已提交
754
      png_push_fill_buffer(png_ptr, chunk_length, 4);
755
      png_ptr->push_length = png_get_uint_31(png_ptr, chunk_length);
G
Guy Schalnat 已提交
756
      png_reset_crc(png_ptr);
A
Andreas Dilger 已提交
757
      png_crc_read(png_ptr, png_ptr->chunk_name, 4);
758
      png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
A
Andreas Dilger 已提交
759

760
      if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4))
G
Guy Schalnat 已提交
761
      {
A
Andreas Dilger 已提交
762
         png_ptr->process_mode = PNG_READ_CHUNK_MODE;
763

G
Guy Schalnat 已提交
764
         if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
G
Guy Schalnat 已提交
765
            png_error(png_ptr, "Not enough compressed data");
766

G
Guy Schalnat 已提交
767 768 769 770 771 772 773
         return;
      }

      png_ptr->idat_size = png_ptr->push_length;
   }
   if (png_ptr->idat_size && png_ptr->save_buffer_size)
   {
A
Andreas Dilger 已提交
774
      png_size_t save_size;
G
Guy Schalnat 已提交
775

A
Andreas Dilger 已提交
776
      if (png_ptr->idat_size < (png_uint_32)png_ptr->save_buffer_size)
777 778
      {
         save_size = (png_size_t)png_ptr->idat_size;
779

780
         /* Check for overflow */
781
         if ((png_uint_32)save_size != png_ptr->idat_size)
782 783
            png_error(png_ptr, "save_size overflowed in pngpread");
      }
784

G
Guy Schalnat 已提交
785 786 787 788
      else
         save_size = png_ptr->save_buffer_size;

      png_calculate_crc(png_ptr, png_ptr->save_buffer_ptr, save_size);
789

790 791
      if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
         png_process_IDAT_data(png_ptr, png_ptr->save_buffer_ptr, save_size);
792

G
Guy Schalnat 已提交
793 794 795
      png_ptr->idat_size -= save_size;
      png_ptr->buffer_size -= save_size;
      png_ptr->save_buffer_size -= save_size;
A
Andreas Dilger 已提交
796
      png_ptr->save_buffer_ptr += save_size;
G
Guy Schalnat 已提交
797 798 799
   }
   if (png_ptr->idat_size && png_ptr->current_buffer_size)
   {
A
Andreas Dilger 已提交
800
      png_size_t save_size;
G
Guy Schalnat 已提交
801

A
Andreas Dilger 已提交
802
      if (png_ptr->idat_size < (png_uint_32)png_ptr->current_buffer_size)
803 804
      {
         save_size = (png_size_t)png_ptr->idat_size;
805

806
         /* Check for overflow */
807
         if ((png_uint_32)save_size != png_ptr->idat_size)
808 809
            png_error(png_ptr, "save_size overflowed in pngpread");
      }
G
Guy Schalnat 已提交
810 811 812 813
      else
         save_size = png_ptr->current_buffer_size;

      png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
814

815
      if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
816
         png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
G
Guy Schalnat 已提交
817 818 819 820

      png_ptr->idat_size -= save_size;
      png_ptr->buffer_size -= save_size;
      png_ptr->current_buffer_size -= save_size;
A
Andreas Dilger 已提交
821
      png_ptr->current_buffer_ptr += save_size;
G
Guy Schalnat 已提交
822 823 824 825 826 827 828 829 830
   }
   if (!png_ptr->idat_size)
   {
      if (png_ptr->buffer_size < 4)
      {
         png_push_save_buffer(png_ptr);
         return;
      }

A
Andreas Dilger 已提交
831
      png_crc_finish(png_ptr, 0);
832
      png_ptr->mode &= ~PNG_HAVE_CHUNK_HEADER;
833
      png_ptr->mode |= PNG_AFTER_IDAT;
G
Guy Schalnat 已提交
834
   }
G
Guy Schalnat 已提交
835 836
}

837
void /* PRIVATE */
G
Guy Schalnat 已提交
838
png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
A
Andreas Dilger 已提交
839
   png_size_t buffer_length)
G
Guy Schalnat 已提交
840
{
G
Guy Schalnat 已提交
841 842
   int ret;

G
Guy Schalnat 已提交
843
   if ((png_ptr->flags & PNG_FLAG_ZLIB_FINISHED) && buffer_length)
844
      png_benign_error(png_ptr, "Extra compression data");
G
Guy Schalnat 已提交
845

A
Andreas Dilger 已提交
846 847
   png_ptr->zstream.next_in = buffer;
   png_ptr->zstream.avail_in = (uInt)buffer_length;
848
   for (;;)
G
Guy Schalnat 已提交
849
   {
A
Andreas Dilger 已提交
850
      ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
851
      if (ret != Z_OK)
G
Guy Schalnat 已提交
852
      {
853
         if (ret == Z_STREAM_END)
G
Guy Schalnat 已提交
854
         {
855
            if (png_ptr->zstream.avail_in)
856
               png_benign_error(png_ptr, "Extra compressed data");
857

858 859 860 861 862 863 864 865
            if (!(png_ptr->zstream.avail_out))
            {
               png_push_process_row(png_ptr);
            }

            png_ptr->mode |= PNG_AFTER_IDAT;
            png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
            break;
G
Guy Schalnat 已提交
866
         }
867 868
         else if (ret == Z_BUF_ERROR)
            break;
869

870 871
         else
            png_error(png_ptr, "Decompression Error");
G
Guy Schalnat 已提交
872
      }
A
Andreas Dilger 已提交
873
      if (!(png_ptr->zstream.avail_out))
G
Guy Schalnat 已提交
874
      {
875
         if ((
876
#ifdef PNG_READ_INTERLACING_SUPPORTED
877 878 879
             png_ptr->interlaced && png_ptr->pass > 6) ||
             (!png_ptr->interlaced &&
#endif
880
             png_ptr->row_number == png_ptr->num_rows))
881
         {
882 883
            if (png_ptr->zstream.avail_in)
               png_warning(png_ptr, "Too much data in IDAT chunks");
884

885 886
            png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
            break;
887
         }
G
Guy Schalnat 已提交
888
         png_push_process_row(png_ptr);
889 890 891
         png_ptr->zstream.avail_out =
             (uInt) PNG_ROWBYTES(png_ptr->pixel_depth,
             png_ptr->iwidth) + 1;
A
Andreas Dilger 已提交
892
         png_ptr->zstream.next_out = png_ptr->row_buf;
G
Guy Schalnat 已提交
893
      }
894

A
Andreas Dilger 已提交
895 896 897
      else
         break;
   }
G
Guy Schalnat 已提交
898 899
}

900
void /* PRIVATE */
G
Guy Schalnat 已提交
901 902
png_push_process_row(png_structp png_ptr)
{
G
Guy Schalnat 已提交
903
   png_ptr->row_info.color_type = png_ptr->color_type;
G
Guy Schalnat 已提交
904 905 906 907
   png_ptr->row_info.width = png_ptr->iwidth;
   png_ptr->row_info.channels = png_ptr->channels;
   png_ptr->row_info.bit_depth = png_ptr->bit_depth;
   png_ptr->row_info.pixel_depth = png_ptr->pixel_depth;
908

909 910
   png_ptr->row_info.rowbytes = PNG_ROWBYTES(png_ptr->row_info.pixel_depth,
       png_ptr->row_info.width);
G
Guy Schalnat 已提交
911

G
Guy Schalnat 已提交
912
   png_read_filter_row(png_ptr, &(png_ptr->row_info),
913 914
       png_ptr->row_buf + 1, png_ptr->prev_row + 1,
       (int)(png_ptr->row_buf[0]));
G
Guy Schalnat 已提交
915

916
   png_memcpy(png_ptr->prev_row, png_ptr->row_buf, png_ptr->rowbytes + 1);
G
Guy Schalnat 已提交
917

918
   if (png_ptr->transformations || (png_ptr->flags&PNG_FLAG_STRIP_ALPHA))
G
Guy Schalnat 已提交
919 920
      png_do_read_transformations(png_ptr);

921
#ifdef PNG_READ_INTERLACING_SUPPORTED
922
   /* Blow up interlaced rows to full size */
A
Andreas Dilger 已提交
923
   if (png_ptr->interlaced && (png_ptr->transformations & PNG_INTERLACE))
G
Guy Schalnat 已提交
924 925
   {
      if (png_ptr->pass < 6)
926
/*       old interface (pre-1.0.9):
G
Guy Schalnat 已提交
927
         png_do_read_interlace(&(png_ptr->row_info),
928
             png_ptr->row_buf + 1, png_ptr->pass, png_ptr->transformations);
929 930
 */
         png_do_read_interlace(png_ptr);
G
Guy Schalnat 已提交
931

932 933
    switch (png_ptr->pass)
    {
G
Guy Schalnat 已提交
934 935 936 937 938 939
         case 0:
         {
            int i;
            for (i = 0; i < 8 && png_ptr->pass == 0; i++)
            {
               png_push_have_row(png_ptr, png_ptr->row_buf + 1);
940
               png_read_push_finish_row(png_ptr); /* Updates png_ptr->pass */
G
Guy Schalnat 已提交
941
            }
942

943
            if (png_ptr->pass == 2) /* Pass 1 might be empty */
944 945 946
            {
               for (i = 0; i < 4 && png_ptr->pass == 2; i++)
               {
947
                  png_push_have_row(png_ptr, NULL);
948 949 950
                  png_read_push_finish_row(png_ptr);
               }
            }
951

952 953 954 955
            if (png_ptr->pass == 4 && png_ptr->height <= 4)
            {
               for (i = 0; i < 2 && png_ptr->pass == 4; i++)
               {
956
                  png_push_have_row(png_ptr, NULL);
957 958
                  png_read_push_finish_row(png_ptr);
               }
959
            }
960

961 962
            if (png_ptr->pass == 6 && png_ptr->height <= 4)
            {
963
                png_push_have_row(png_ptr, NULL);
964 965
                png_read_push_finish_row(png_ptr);
            }
966

G
Guy Schalnat 已提交
967 968
            break;
         }
969

G
Guy Schalnat 已提交
970 971 972 973 974 975 976 977
         case 1:
         {
            int i;
            for (i = 0; i < 8 && png_ptr->pass == 1; i++)
            {
               png_push_have_row(png_ptr, png_ptr->row_buf + 1);
               png_read_push_finish_row(png_ptr);
            }
978

979
            if (png_ptr->pass == 2) /* Skip top 4 generated rows */
G
Guy Schalnat 已提交
980 981 982
            {
               for (i = 0; i < 4 && png_ptr->pass == 2; i++)
               {
983
                  png_push_have_row(png_ptr, NULL);
G
Guy Schalnat 已提交
984 985 986
                  png_read_push_finish_row(png_ptr);
               }
            }
987

G
Guy Schalnat 已提交
988 989
            break;
         }
990

G
Guy Schalnat 已提交
991 992 993
         case 2:
         {
            int i;
994

G
Guy Schalnat 已提交
995 996 997 998 999
            for (i = 0; i < 4 && png_ptr->pass == 2; i++)
            {
               png_push_have_row(png_ptr, png_ptr->row_buf + 1);
               png_read_push_finish_row(png_ptr);
            }
1000

G
Guy Schalnat 已提交
1001 1002
            for (i = 0; i < 4 && png_ptr->pass == 2; i++)
            {
1003
               png_push_have_row(png_ptr, NULL);
G
Guy Schalnat 已提交
1004 1005
               png_read_push_finish_row(png_ptr);
            }
1006

1007
            if (png_ptr->pass == 4) /* Pass 3 might be empty */
1008 1009 1010
            {
               for (i = 0; i < 2 && png_ptr->pass == 4; i++)
               {
1011
                  png_push_have_row(png_ptr, NULL);
1012 1013 1014
                  png_read_push_finish_row(png_ptr);
               }
            }
1015

G
Guy Schalnat 已提交
1016 1017
            break;
         }
1018

G
Guy Schalnat 已提交
1019 1020 1021
         case 3:
         {
            int i;
1022

G
Guy Schalnat 已提交
1023 1024 1025 1026 1027
            for (i = 0; i < 4 && png_ptr->pass == 3; i++)
            {
               png_push_have_row(png_ptr, png_ptr->row_buf + 1);
               png_read_push_finish_row(png_ptr);
            }
1028

1029
            if (png_ptr->pass == 4) /* Skip top two generated rows */
G
Guy Schalnat 已提交
1030 1031 1032
            {
               for (i = 0; i < 2 && png_ptr->pass == 4; i++)
               {
1033
                  png_push_have_row(png_ptr, NULL);
G
Guy Schalnat 已提交
1034 1035 1036
                  png_read_push_finish_row(png_ptr);
               }
            }
1037

G
Guy Schalnat 已提交
1038 1039
            break;
         }
1040

G
Guy Schalnat 已提交
1041 1042 1043
         case 4:
         {
            int i;
1044

G
Guy Schalnat 已提交
1045 1046 1047 1048 1049
            for (i = 0; i < 2 && png_ptr->pass == 4; i++)
            {
               png_push_have_row(png_ptr, png_ptr->row_buf + 1);
               png_read_push_finish_row(png_ptr);
            }
1050

G
Guy Schalnat 已提交
1051 1052
            for (i = 0; i < 2 && png_ptr->pass == 4; i++)
            {
1053
               png_push_have_row(png_ptr, NULL);
G
Guy Schalnat 已提交
1054 1055
               png_read_push_finish_row(png_ptr);
            }
1056

1057
            if (png_ptr->pass == 6) /* Pass 5 might be empty */
1058
            {
1059
               png_push_have_row(png_ptr, NULL);
1060 1061
               png_read_push_finish_row(png_ptr);
            }
1062

G
Guy Schalnat 已提交
1063 1064
            break;
         }
1065

G
Guy Schalnat 已提交
1066 1067 1068
         case 5:
         {
            int i;
1069

G
Guy Schalnat 已提交
1070 1071 1072 1073 1074
            for (i = 0; i < 2 && png_ptr->pass == 5; i++)
            {
               png_push_have_row(png_ptr, png_ptr->row_buf + 1);
               png_read_push_finish_row(png_ptr);
            }
1075

1076
            if (png_ptr->pass == 6) /* Skip top generated row */
G
Guy Schalnat 已提交
1077
            {
1078
               png_push_have_row(png_ptr, NULL);
G
Guy Schalnat 已提交
1079 1080
               png_read_push_finish_row(png_ptr);
            }
1081

G
Guy Schalnat 已提交
1082 1083 1084 1085 1086 1087
            break;
         }
         case 6:
         {
            png_push_have_row(png_ptr, png_ptr->row_buf + 1);
            png_read_push_finish_row(png_ptr);
1088

G
Guy Schalnat 已提交
1089 1090
            if (png_ptr->pass != 6)
               break;
1091

1092
            png_push_have_row(png_ptr, NULL);
G
Guy Schalnat 已提交
1093 1094 1095 1096 1097
            png_read_push_finish_row(png_ptr);
         }
      }
   }
   else
G
Guy Schalnat 已提交
1098
#endif
G
Guy Schalnat 已提交
1099 1100 1101 1102
   {
      png_push_have_row(png_ptr, png_ptr->row_buf + 1);
      png_read_push_finish_row(png_ptr);
   }
G
Guy Schalnat 已提交
1103 1104
}

1105
void /* PRIVATE */
G
Guy Schalnat 已提交
1106 1107
png_read_push_finish_row(png_structp png_ptr)
{
1108
   /* Arrays to facilitate easy interlacing - use pass (0 - 6) as index */
1109

1110
   /* Start of interlace block */
1111
   PNG_CONST int FARDATA png_pass_start[] = {0, 4, 0, 2, 0, 1, 0};
1112

1113
   /* Offset to next interlace block */
1114
   PNG_CONST int FARDATA png_pass_inc[] = {8, 8, 4, 4, 2, 2, 1};
1115

1116
   /* Start of interlace block in the y direction */
1117
   PNG_CONST int FARDATA png_pass_ystart[] = {0, 0, 4, 0, 2, 0, 1};
1118

1119
   /* Offset to next interlace block in the y direction */
1120
   PNG_CONST int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
1121

1122 1123
   /* Height of interlace block.  This is not currently used - if you need
    * it, uncomment it here and in png.h
1124
   PNG_CONST int FARDATA png_pass_height[] = {8, 8, 4, 4, 2, 2, 1};
1125
   */
1126

G
Guy Schalnat 已提交
1127 1128
   png_ptr->row_number++;
   if (png_ptr->row_number < png_ptr->num_rows)
G
Guy Schalnat 已提交
1129
      return;
G
Guy Schalnat 已提交
1130

1131
#ifdef PNG_READ_INTERLACING_SUPPORTED
G
Guy Schalnat 已提交
1132 1133 1134
   if (png_ptr->interlaced)
   {
      png_ptr->row_number = 0;
1135 1136
      png_memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1);

G
Guy Schalnat 已提交
1137 1138 1139
      do
      {
         png_ptr->pass++;
1140 1141 1142
         if ((png_ptr->pass == 1 && png_ptr->width < 5) ||
             (png_ptr->pass == 3 && png_ptr->width < 3) ||
             (png_ptr->pass == 5 && png_ptr->width < 2))
1143
            png_ptr->pass++;
1144

1145 1146
         if (png_ptr->pass > 7)
            png_ptr->pass--;
1147

G
Guy Schalnat 已提交
1148 1149
         if (png_ptr->pass >= 7)
            break;
1150

G
Guy Schalnat 已提交
1151
         png_ptr->iwidth = (png_ptr->width +
1152 1153 1154
             png_pass_inc[png_ptr->pass] - 1 -
             png_pass_start[png_ptr->pass]) /
             png_pass_inc[png_ptr->pass];
1155

G
Guy Schalnat 已提交
1156 1157
         if (png_ptr->transformations & PNG_INTERLACE)
            break;
1158 1159

         png_ptr->num_rows = (png_ptr->height +
1160 1161 1162
             png_pass_yinc[png_ptr->pass] - 1 -
             png_pass_ystart[png_ptr->pass]) /
             png_pass_yinc[png_ptr->pass];
1163 1164

      } while (png_ptr->iwidth == 0 || png_ptr->num_rows == 0);
G
Guy Schalnat 已提交
1165
   }
1166
#endif /* PNG_READ_INTERLACING_SUPPORTED */
G
Guy Schalnat 已提交
1167 1168
}

1169
#ifdef PNG_READ_tEXt_SUPPORTED
1170
void /* PRIVATE */
1171
png_push_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
1172
    length)
G
Guy Schalnat 已提交
1173
{
1174
   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
1175 1176
      {
         png_error(png_ptr, "Out of place tEXt");
1177
         info_ptr = info_ptr; /* To quiet some compiler warnings */
1178
      }
A
Andreas Dilger 已提交
1179

A
Andreas Dilger 已提交
1180 1181 1182
#ifdef PNG_MAX_MALLOC_64K
   png_ptr->skip_length = 0;  /* This may not be necessary */

1183
   if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
A
Andreas Dilger 已提交
1184 1185
   {
      png_warning(png_ptr, "tEXt chunk too large to fit in memory");
1186 1187
      png_ptr->skip_length = length - (png_uint_32)65535L;
      length = (png_uint_32)65535L;
A
Andreas Dilger 已提交
1188 1189 1190
   }
#endif

1191
   png_ptr->current_text = (png_charp)png_malloc(png_ptr,
1192
       (png_size_t)(length + 1));
A
Andreas Dilger 已提交
1193
   png_ptr->current_text[length] = '\0';
G
Guy Schalnat 已提交
1194
   png_ptr->current_text_ptr = png_ptr->current_text;
1195 1196
   png_ptr->current_text_size = (png_size_t)length;
   png_ptr->current_text_left = (png_size_t)length;
G
Guy Schalnat 已提交
1197
   png_ptr->process_mode = PNG_READ_tEXt_MODE;
G
Guy Schalnat 已提交
1198 1199
}

1200
void /* PRIVATE */
A
Andreas Dilger 已提交
1201
png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr)
G
Guy Schalnat 已提交
1202
{
G
Guy Schalnat 已提交
1203 1204
   if (png_ptr->buffer_size && png_ptr->current_text_left)
   {
A
Andreas Dilger 已提交
1205
      png_size_t text_size;
G
Guy Schalnat 已提交
1206 1207 1208

      if (png_ptr->buffer_size < png_ptr->current_text_left)
         text_size = png_ptr->buffer_size;
1209

G
Guy Schalnat 已提交
1210 1211
      else
         text_size = png_ptr->current_text_left;
1212

A
Andreas Dilger 已提交
1213
      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
G
Guy Schalnat 已提交
1214
      png_ptr->current_text_left -= text_size;
A
Andreas Dilger 已提交
1215
      png_ptr->current_text_ptr += text_size;
G
Guy Schalnat 已提交
1216 1217 1218
   }
   if (!(png_ptr->current_text_left))
   {
A
Andreas Dilger 已提交
1219
      png_textp text_ptr;
G
Guy Schalnat 已提交
1220 1221
      png_charp text;
      png_charp key;
1222
      int ret;
G
Guy Schalnat 已提交
1223 1224 1225 1226 1227 1228 1229

      if (png_ptr->buffer_size < 4)
      {
         png_push_save_buffer(png_ptr);
         return;
      }

A
Andreas Dilger 已提交
1230 1231
      png_push_crc_finish(png_ptr);

1232
#ifdef PNG_MAX_MALLOC_64K
A
Andreas Dilger 已提交
1233 1234 1235
      if (png_ptr->skip_length)
         return;
#endif
G
Guy Schalnat 已提交
1236 1237 1238 1239

      key = png_ptr->current_text;

      for (text = key; *text; text++)
1240
         /* Empty loop */ ;
G
Guy Schalnat 已提交
1241

1242
      if (text < key + png_ptr->current_text_size)
G
Guy Schalnat 已提交
1243 1244
         text++;

1245
      text_ptr = (png_textp)png_malloc(png_ptr, png_sizeof(png_text));
A
Andreas Dilger 已提交
1246 1247
      text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
      text_ptr->key = key;
1248
      text_ptr->itxt_length = 0;
1249 1250
      text_ptr->lang = NULL;
      text_ptr->lang_key = NULL;
A
Andreas Dilger 已提交
1251
      text_ptr->text = text;
G
Guy Schalnat 已提交
1252

1253
      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
A
Andreas Dilger 已提交
1254

1255
      png_free(png_ptr, key);
A
Andreas Dilger 已提交
1256
      png_free(png_ptr, text_ptr);
1257
      png_ptr->current_text = NULL;
1258 1259

      if (ret)
1260
         png_warning(png_ptr, "Insufficient memory to store text chunk");
G
Guy Schalnat 已提交
1261
   }
G
Guy Schalnat 已提交
1262 1263 1264
}
#endif

1265
#ifdef PNG_READ_zTXt_SUPPORTED
1266
void /* PRIVATE */
1267 1268
png_push_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
   length)
G
Guy Schalnat 已提交
1269
{
1270
   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
1271 1272 1273 1274
   {
      png_error(png_ptr, "Out of place zTXt");
      info_ptr = info_ptr; /* To quiet some compiler warnings */
   }
A
Andreas Dilger 已提交
1275

A
Andreas Dilger 已提交
1276 1277 1278 1279 1280
#ifdef PNG_MAX_MALLOC_64K
   /* We can't handle zTXt chunks > 64K, since we don't have enough space
    * to be able to store the uncompressed data.  Actually, the threshold
    * is probably around 32K, but it isn't as definite as 64K is.
    */
1281
   if (length > (png_uint_32)65535L)
A
Andreas Dilger 已提交
1282 1283 1284 1285 1286 1287 1288
   {
      png_warning(png_ptr, "zTXt chunk too large to fit in memory");
      png_push_crc_skip(png_ptr, length);
      return;
   }
#endif

1289
   png_ptr->current_text = (png_charp)png_malloc(png_ptr,
1290
       (png_size_t)(length + 1));
A
Andreas Dilger 已提交
1291
   png_ptr->current_text[length] = '\0';
G
Guy Schalnat 已提交
1292
   png_ptr->current_text_ptr = png_ptr->current_text;
1293 1294
   png_ptr->current_text_size = (png_size_t)length;
   png_ptr->current_text_left = (png_size_t)length;
G
Guy Schalnat 已提交
1295
   png_ptr->process_mode = PNG_READ_zTXt_MODE;
G
Guy Schalnat 已提交
1296 1297
}

1298
void /* PRIVATE */
A
Andreas Dilger 已提交
1299
png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr)
G
Guy Schalnat 已提交
1300
{
G
Guy Schalnat 已提交
1301 1302
   if (png_ptr->buffer_size && png_ptr->current_text_left)
   {
A
Andreas Dilger 已提交
1303
      png_size_t text_size;
G
Guy Schalnat 已提交
1304

A
Andreas Dilger 已提交
1305
      if (png_ptr->buffer_size < (png_uint_32)png_ptr->current_text_left)
G
Guy Schalnat 已提交
1306
         text_size = png_ptr->buffer_size;
1307

G
Guy Schalnat 已提交
1308 1309
      else
         text_size = png_ptr->current_text_left;
1310

A
Andreas Dilger 已提交
1311
      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
G
Guy Schalnat 已提交
1312
      png_ptr->current_text_left -= text_size;
A
Andreas Dilger 已提交
1313
      png_ptr->current_text_ptr += text_size;
G
Guy Schalnat 已提交
1314 1315 1316
   }
   if (!(png_ptr->current_text_left))
   {
A
Andreas Dilger 已提交
1317
      png_textp text_ptr;
G
Guy Schalnat 已提交
1318 1319 1320
      png_charp text;
      png_charp key;
      int ret;
A
Andreas Dilger 已提交
1321
      png_size_t text_size, key_size;
G
Guy Schalnat 已提交
1322 1323 1324 1325 1326 1327 1328

      if (png_ptr->buffer_size < 4)
      {
         png_push_save_buffer(png_ptr);
         return;
      }

A
Andreas Dilger 已提交
1329
      png_push_crc_finish(png_ptr);
G
Guy Schalnat 已提交
1330 1331 1332 1333

      key = png_ptr->current_text;

      for (text = key; *text; text++)
1334
         /* Empty loop */ ;
G
Guy Schalnat 已提交
1335 1336

      /* zTXt can't have zero text */
1337
      if (text >= key + png_ptr->current_text_size)
G
Guy Schalnat 已提交
1338
      {
1339
         png_ptr->current_text = NULL;
A
Andreas Dilger 已提交
1340
         png_free(png_ptr, key);
G
Guy Schalnat 已提交
1341 1342 1343 1344 1345
         return;
      }

      text++;

1346
      if (*text != PNG_TEXT_COMPRESSION_zTXt) /* Check compression byte */
G
Guy Schalnat 已提交
1347
      {
1348
         png_ptr->current_text = NULL;
A
Andreas Dilger 已提交
1349
         png_free(png_ptr, key);
G
Guy Schalnat 已提交
1350 1351 1352 1353 1354
         return;
      }

      text++;

A
Andreas Dilger 已提交
1355 1356
      png_ptr->zstream.next_in = (png_bytep )text;
      png_ptr->zstream.avail_in = (uInt)(png_ptr->current_text_size -
1357
          (text - key));
A
Andreas Dilger 已提交
1358
      png_ptr->zstream.next_out = png_ptr->zbuf;
1359
      png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
G
Guy Schalnat 已提交
1360 1361 1362 1363 1364 1365

      key_size = text - key;
      text_size = 0;
      text = NULL;
      ret = Z_STREAM_END;

A
Andreas Dilger 已提交
1366
      while (png_ptr->zstream.avail_in)
G
Guy Schalnat 已提交
1367
      {
A
Andreas Dilger 已提交
1368
         ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
G
Guy Schalnat 已提交
1369 1370
         if (ret != Z_OK && ret != Z_STREAM_END)
         {
A
Andreas Dilger 已提交
1371 1372
            inflateReset(&png_ptr->zstream);
            png_ptr->zstream.avail_in = 0;
1373
            png_ptr->current_text = NULL;
A
Andreas Dilger 已提交
1374 1375
            png_free(png_ptr, key);
            png_free(png_ptr, text);
G
Guy Schalnat 已提交
1376 1377
            return;
         }
1378

A
Andreas Dilger 已提交
1379
         if (!(png_ptr->zstream.avail_out) || ret == Z_STREAM_END)
G
Guy Schalnat 已提交
1380
         {
A
Andreas Dilger 已提交
1381
            if (text == NULL)
G
Guy Schalnat 已提交
1382
            {
A
Andreas Dilger 已提交
1383
               text = (png_charp)png_malloc(png_ptr,
1384 1385
                   (png_ptr->zbuf_size
                   - png_ptr->zstream.avail_out + key_size + 1));
1386

1387
               png_memcpy(text + key_size, png_ptr->zbuf,
1388
                   png_ptr->zbuf_size - png_ptr->zstream.avail_out);
1389

1390
               png_memcpy(text, key, key_size);
1391

1392
               text_size = key_size + png_ptr->zbuf_size -
1393
                   png_ptr->zstream.avail_out;
1394

1395
               *(text + text_size) = '\0';
G
Guy Schalnat 已提交
1396
            }
1397

G
Guy Schalnat 已提交
1398 1399 1400 1401 1402
            else
            {
               png_charp tmp;

               tmp = text;
1403
               text = (png_charp)png_malloc(png_ptr, text_size +
1404 1405
                   (png_ptr->zbuf_size 
                   - png_ptr->zstream.avail_out + 1));
1406

1407 1408
               png_memcpy(text, tmp, text_size);
               png_free(png_ptr, tmp);
1409

1410
               png_memcpy(text + text_size, png_ptr->zbuf,
1411
                   png_ptr->zbuf_size - png_ptr->zstream.avail_out);
1412

1413 1414
               text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
               *(text + text_size) = '\0';
G
Guy Schalnat 已提交
1415
            }
1416

G
Guy Schalnat 已提交
1417 1418
            if (ret != Z_STREAM_END)
            {
A
Andreas Dilger 已提交
1419 1420
               png_ptr->zstream.next_out = png_ptr->zbuf;
               png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
G
Guy Schalnat 已提交
1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431
            }
         }
         else
         {
            break;
         }

         if (ret == Z_STREAM_END)
            break;
      }

A
Andreas Dilger 已提交
1432 1433
      inflateReset(&png_ptr->zstream);
      png_ptr->zstream.avail_in = 0;
G
Guy Schalnat 已提交
1434 1435 1436

      if (ret != Z_STREAM_END)
      {
1437
         png_ptr->current_text = NULL;
A
Andreas Dilger 已提交
1438 1439
         png_free(png_ptr, key);
         png_free(png_ptr, text);
G
Guy Schalnat 已提交
1440 1441 1442
         return;
      }

1443
      png_ptr->current_text = NULL;
A
Andreas Dilger 已提交
1444
      png_free(png_ptr, key);
G
Guy Schalnat 已提交
1445
      key = text;
A
Andreas Dilger 已提交
1446
      text += key_size;
G
Guy Schalnat 已提交
1447

1448 1449
      text_ptr = (png_textp)png_malloc(png_ptr,
          png_sizeof(png_text));
1450 1451
      text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt;
      text_ptr->key = key;
1452
      text_ptr->itxt_length = 0;
1453 1454
      text_ptr->lang = NULL;
      text_ptr->lang_key = NULL;
1455
      text_ptr->text = text;
1456

1457
      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
1458

1459
      png_free(png_ptr, key);
1460
      png_free(png_ptr, text_ptr);
1461 1462

      if (ret)
1463
         png_warning(png_ptr, "Insufficient memory to store text chunk");
1464 1465 1466 1467
   }
}
#endif

1468
#ifdef PNG_READ_iTXt_SUPPORTED
1469
void /* PRIVATE */
1470
png_push_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32
1471
    length)
1472
{
1473
   if (!(png_ptr->mode & PNG_HAVE_IHDR) || (png_ptr->mode & PNG_HAVE_IEND))
1474 1475 1476 1477
   {
      png_error(png_ptr, "Out of place iTXt");
      info_ptr = info_ptr; /* To quiet some compiler warnings */
   }
1478 1479 1480 1481

#ifdef PNG_MAX_MALLOC_64K
   png_ptr->skip_length = 0;  /* This may not be necessary */

1482
   if (length > (png_uint_32)65535L) /* Can't hold entire string in memory */
1483 1484 1485 1486 1487 1488 1489 1490
   {
      png_warning(png_ptr, "iTXt chunk too large to fit in memory");
      png_ptr->skip_length = length - (png_uint_32)65535L;
      length = (png_uint_32)65535L;
   }
#endif

   png_ptr->current_text = (png_charp)png_malloc(png_ptr,
1491
       (png_size_t)(length + 1));
1492 1493 1494 1495 1496
   png_ptr->current_text[length] = '\0';
   png_ptr->current_text_ptr = png_ptr->current_text;
   png_ptr->current_text_size = (png_size_t)length;
   png_ptr->current_text_left = (png_size_t)length;
   png_ptr->process_mode = PNG_READ_iTXt_MODE;
1497 1498
}

1499
void /* PRIVATE */
1500 1501
png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr)
{
1502

1503 1504 1505 1506 1507 1508
   if (png_ptr->buffer_size && png_ptr->current_text_left)
   {
      png_size_t text_size;

      if (png_ptr->buffer_size < png_ptr->current_text_left)
         text_size = png_ptr->buffer_size;
1509

1510 1511
      else
         text_size = png_ptr->current_text_left;
1512

1513 1514 1515 1516
      png_crc_read(png_ptr, (png_bytep)png_ptr->current_text_ptr, text_size);
      png_ptr->current_text_left -= text_size;
      png_ptr->current_text_ptr += text_size;
   }
1517

1518 1519 1520 1521
   if (!(png_ptr->current_text_left))
   {
      png_textp text_ptr;
      png_charp key;
1522
      int comp_flag;
1523 1524 1525
      png_charp lang;
      png_charp lang_key;
      png_charp text;
1526
      int ret;
1527 1528 1529 1530 1531 1532 1533 1534 1535

      if (png_ptr->buffer_size < 4)
      {
         png_push_save_buffer(png_ptr);
         return;
      }

      png_push_crc_finish(png_ptr);

1536
#ifdef PNG_MAX_MALLOC_64K
1537 1538 1539 1540
      if (png_ptr->skip_length)
         return;
#endif

1541
      key = png_ptr->current_text;
1542

1543
      for (lang = key; *lang; lang++)
1544
         /* Empty loop */ ;
1545

1546
      if (lang < key + png_ptr->current_text_size - 3)
1547
         lang++;
1548

1549
      comp_flag = *lang++;
1550
      lang++;     /* Skip comp_type, always zero */
1551 1552

      for (lang_key = lang; *lang_key; lang_key++)
1553
         /* Empty loop */ ;
1554

1555
      lang_key++;        /* Skip NUL separator */
1556

1557
      text=lang_key;
1558

1559 1560
      if (lang_key < key + png_ptr->current_text_size - 1)
      {
1561 1562
         for (; *text; text++)
            /* Empty loop */ ;
1563
      }
1564

1565
      if (text < key + png_ptr->current_text_size)
1566 1567
         text++;

1568
      text_ptr = (png_textp)png_malloc(png_ptr,
1569
          png_sizeof(png_text));
1570

1571
      text_ptr->compression = comp_flag + 2;
A
Andreas Dilger 已提交
1572
      text_ptr->key = key;
1573 1574
      text_ptr->lang = lang;
      text_ptr->lang_key = lang_key;
A
Andreas Dilger 已提交
1575
      text_ptr->text = text;
1576 1577
      text_ptr->text_length = 0;
      text_ptr->itxt_length = png_strlen(text);
A
Andreas Dilger 已提交
1578

1579
      ret = png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
A
Andreas Dilger 已提交
1580

1581 1582
      png_ptr->current_text = NULL;

A
Andreas Dilger 已提交
1583
      png_free(png_ptr, text_ptr);
1584
      if (ret)
1585
         png_warning(png_ptr, "Insufficient memory to store iTXt chunk");
G
Guy Schalnat 已提交
1586
   }
G
Guy Schalnat 已提交
1587 1588 1589
}
#endif

A
Andreas Dilger 已提交
1590
/* This function is called when we haven't found a handler for this
1591 1592
 * chunk.  If there isn't a problem with the chunk itself (ie a bad chunk
 * name or a critical chunk), the chunk is (currently) silently ignored.
1593
 */
1594
void /* PRIVATE */
1595
png_push_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32
1596
    length)
A
Andreas Dilger 已提交
1597
{
1598
   png_uint_32 skip = 0;
A
Andreas Dilger 已提交
1599 1600 1601

   if (!(png_ptr->chunk_name[0] & 0x20))
   {
1602
#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
1603
      if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
1604
          PNG_HANDLE_CHUNK_ALWAYS
1605
#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
1606
          && png_ptr->read_user_chunk_fn == NULL
1607
#endif
1608
          )
1609
#endif
1610 1611
         png_chunk_error(png_ptr, "unknown critical chunk");

1612
      info_ptr = info_ptr; /* To quiet some compiler warnings */
A
Andreas Dilger 已提交
1613 1614
   }

1615
#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED
1616 1617 1618
   if (png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS)
   {
#ifdef PNG_MAX_MALLOC_64K
1619 1620
      if (length > (png_uint_32)65535L)
      {
1621 1622 1623
         png_warning(png_ptr, "unknown chunk too large to fit in memory");
         skip = length - (png_uint_32)65535L;
         length = (png_uint_32)65535L;
1624
      }
1625
#endif
1626
      png_memcpy((png_charp)png_ptr->unknown_chunk.name,
1627 1628
          (png_charp)png_ptr->chunk_name, 
          png_sizeof(png_ptr->unknown_chunk.name));
1629
      png_ptr->unknown_chunk.name[png_sizeof(png_ptr->unknown_chunk.name) - 1]
1630
          = '\0';
1631 1632

      png_ptr->unknown_chunk.size = (png_size_t)length;
1633

1634 1635
      if (length == 0)
         png_ptr->unknown_chunk.data = NULL;
1636

1637 1638 1639
      else
      {
         png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr,
1640
             (png_size_t)length);
1641 1642
         png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
      }
1643

1644
#ifdef PNG_READ_USER_CHUNKS_SUPPORTED
1645 1646
      if (png_ptr->read_user_chunk_fn != NULL)
      {
1647
         /* Callback to user unknown chunk handler */
1648 1649
         int ret;
         ret = (*(png_ptr->read_user_chunk_fn))
1650
             (png_ptr, &png_ptr->unknown_chunk);
1651

1652 1653
         if (ret < 0)
            png_chunk_error(png_ptr, "error in user chunk");
1654

1655 1656 1657 1658
         if (ret == 0)
         {
            if (!(png_ptr->chunk_name[0] & 0x20))
               if (png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
1659
                   PNG_HANDLE_CHUNK_ALWAYS)
1660 1661
                  png_chunk_error(png_ptr, "unknown critical chunk");
            png_set_unknown_chunks(png_ptr, info_ptr,
1662
                &png_ptr->unknown_chunk, 1);
1663 1664
         }
      }
1665

1666
      else
1667
#endif
1668
         png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
1669 1670
      png_free(png_ptr, png_ptr->unknown_chunk.data);
      png_ptr->unknown_chunk.data = NULL;
1671
   }
1672

1673 1674 1675 1676
   else
#endif
      skip=length;
   png_push_crc_skip(png_ptr, skip);
A
Andreas Dilger 已提交
1677 1678
}

1679
void /* PRIVATE */
A
Andreas Dilger 已提交
1680
png_push_have_info(png_structp png_ptr, png_infop info_ptr)
G
Guy Schalnat 已提交
1681
{
A
Andreas Dilger 已提交
1682
   if (png_ptr->info_fn != NULL)
A
Andreas Dilger 已提交
1683
      (*(png_ptr->info_fn))(png_ptr, info_ptr);
G
Guy Schalnat 已提交
1684 1685
}

1686
void /* PRIVATE */
A
Andreas Dilger 已提交
1687
png_push_have_end(png_structp png_ptr, png_infop info_ptr)
G
Guy Schalnat 已提交
1688
{
A
Andreas Dilger 已提交
1689
   if (png_ptr->end_fn != NULL)
A
Andreas Dilger 已提交
1690
      (*(png_ptr->end_fn))(png_ptr, info_ptr);
G
Guy Schalnat 已提交
1691 1692
}

1693
void /* PRIVATE */
G
Guy Schalnat 已提交
1694 1695
png_push_have_row(png_structp png_ptr, png_bytep row)
{
A
Andreas Dilger 已提交
1696
   if (png_ptr->row_fn != NULL)
G
Guy Schalnat 已提交
1697 1698
      (*(png_ptr->row_fn))(png_ptr, row, png_ptr->row_number,
         (int)png_ptr->pass);
G
Guy Schalnat 已提交
1699 1700
}

1701
void PNGAPI
A
Andreas Dilger 已提交
1702
png_progressive_combine_row (png_structp png_ptr,
1703
    png_bytep old_row, png_bytep new_row)
G
Guy Schalnat 已提交
1704
{
1705
   PNG_CONST int FARDATA png_pass_dsp_mask[7] =
1706
      {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff};
1707

1708 1709 1710
   if (png_ptr == NULL)
      return;

1711
   if (new_row != NULL)    /* new_row must == png_ptr->row_buf here. */
A
Andreas Dilger 已提交
1712
      png_combine_row(png_ptr, old_row, png_pass_dsp_mask[png_ptr->pass]);
G
Guy Schalnat 已提交
1713 1714
}

1715
void PNGAPI
G
Guy Schalnat 已提交
1716
png_set_progressive_read_fn(png_structp png_ptr, png_voidp progressive_ptr,
1717 1718
    png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn,
    png_progressive_end_ptr end_fn)
G
Guy Schalnat 已提交
1719
{
1720 1721 1722
   if (png_ptr == NULL)
      return;

G
Guy Schalnat 已提交
1723 1724
   png_ptr->info_fn = info_fn;
   png_ptr->row_fn = row_fn;
G
Guy Schalnat 已提交
1725
   png_ptr->end_fn = end_fn;
G
Guy Schalnat 已提交
1726

1727
   png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
G
Guy Schalnat 已提交
1728 1729
}

1730
png_voidp PNGAPI
A
Andreas Dilger 已提交
1731
png_get_progressive_ptr(png_structp png_ptr)
G
Guy Schalnat 已提交
1732
{
1733 1734 1735
   if (png_ptr == NULL)
      return (NULL);

A
Andreas Dilger 已提交
1736
   return png_ptr->io_ptr;
G
Guy Schalnat 已提交
1737
}
G
Guy Schalnat 已提交
1738
#endif /* PNG_PROGRESSIVE_READ_SUPPORTED */