Context Navigation

← Previous Revision
Latest Revision
Next Revision →
Normal
Revision Log

close Warning: Can't use blame annotator:
No changeset 422 in the repository

pngrutil.c@ 422

Last change on this file since 422 was 95, checked in by Rick van der Zwet, 15 years ago
Bad boy, improper move of directory
File size: 92.3 KB

Rev	Line
	1
	2	/* pngrutil.c - utilities to read a PNG file
	3	*
	4	* Last changed in libpng 1.2.17 May 15, 2007
	5	* For conditions of distribution and use, see copyright notice in png.h
	6	* Copyright (c) 1998-2007 Glenn Randers-Pehrson
	7	* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
	8	* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
	9	*
	10	* This file contains routines that are only called from within
	11	* libpng itself during the course of reading an image.
	12	*/
	13
	14	#define PNG_INTERNAL
	15	#include "png.h"
	16
	17	#if defined(PNG_READ_SUPPORTED)
	18
	19	#ifdef PNG_FLOATING_POINT_SUPPORTED
	20	# if defined(_WIN32_WCE)
	21	/* strtod() function is not supported on WindowsCE */
	22	__inline double png_strtod(png_structp png_ptr, const char nptr, char *endptr)
	23	{
	24	double result = 0;
	25	int len;
	26	wchar_t str, end;
	27
	28	len = MultiByteToWideChar(CP_ACP, 0, nptr, -1, NULL, 0);
	29	str = (wchar_t )png_malloc(png_ptr, len sizeof(wchar_t));
	30	if ( NULL != str )
	31	{
	32	MultiByteToWideChar(CP_ACP, 0, nptr, -1, str, len);
	33	result = wcstod(str, &end);
	34	len = WideCharToMultiByte(CP_ACP, 0, end, -1, NULL, 0, NULL, NULL);
	35	endptr = (char )nptr + (png_strlen(nptr) - len + 1);
	36	png_free(str);
	37	}
	38	return result;
	39	}
	40	# else
	41	# define png_strtod(p,a,b) strtod(a,b)
	42	# endif
	43	#endif
	44
	45	png_uint_32 PNGAPI
	46	png_get_uint_31(png_structp png_ptr, png_bytep buf)
	47	{
	48	png_uint_32 i = png_get_uint_32(buf);
	49	if (i > PNG_UINT_31_MAX)
	50	png_error(png_ptr, "PNG unsigned integer out of range.");
	51	return (i);
	52	}
	53	#ifndef PNG_READ_BIG_ENDIAN_SUPPORTED
	54	/* Grab an unsigned 32-bit integer from a buffer in big-endian format. */
	55	png_uint_32 PNGAPI
	56	png_get_uint_32(png_bytep buf)
	57	{
	58	png_uint_32 i = ((png_uint_32)(*buf) << 24) +
	59	((png_uint_32)(*(buf + 1)) << 16) +
	60	((png_uint_32)(*(buf + 2)) << 8) +
	61	(png_uint_32)(*(buf + 3));
	62
	63	return (i);
	64	}
	65
	66	/* Grab a signed 32-bit integer from a buffer in big-endian format. The
	67	* data is stored in the PNG file in two's complement format, and it is
	68	* assumed that the machine format for signed integers is the same. */
	69	png_int_32 PNGAPI
	70	png_get_int_32(png_bytep buf)
	71	{
	72	png_int_32 i = ((png_int_32)(*buf) << 24) +
	73	((png_int_32)(*(buf + 1)) << 16) +
	74	((png_int_32)(*(buf + 2)) << 8) +
	75	(png_int_32)(*(buf + 3));
	76
	77	return (i);
	78	}
	79
	80	/* Grab an unsigned 16-bit integer from a buffer in big-endian format. */
	81	png_uint_16 PNGAPI
	82	png_get_uint_16(png_bytep buf)
	83	{
	84	png_uint_16 i = (png_uint_16)(((png_uint_16)(*buf) << 8) +
	85	(png_uint_16)(*(buf + 1)));
	86
	87	return (i);
	88	}
	89	#endif /* PNG_READ_BIG_ENDIAN_SUPPORTED */
	90
	91	/* Read data, and (optionally) run it through the CRC. */
	92	void /* PRIVATE */
	93	png_crc_read(png_structp png_ptr, png_bytep buf, png_size_t length)
	94	{
	95	if(png_ptr == NULL) return;
	96	png_read_data(png_ptr, buf, length);
	97	png_calculate_crc(png_ptr, buf, length);
	98	}
	99
	100	/* Optionally skip data and then check the CRC. Depending on whether we
	101	are reading a ancillary or critical chunk, and how the program has set
	102	things up, we may calculate the CRC on the data and print a message.
	103	Returns '1' if there was a CRC error, '0' otherwise. */
	104	int /* PRIVATE */
	105	png_crc_finish(png_structp png_ptr, png_uint_32 skip)
	106	{
	107	png_size_t i;
	108	png_size_t istop = png_ptr->zbuf_size;
	109
	110	for (i = (png_size_t)skip; i > istop; i -= istop)
	111	{
	112	png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size);
	113	}
	114	if (i)
	115	{
	116	png_crc_read(png_ptr, png_ptr->zbuf, i);
	117	}
	118
	119	if (png_crc_error(png_ptr))
	120	{
	121	if (((png_ptr->chunk_name[0] & 0x20) && /* Ancillary */
	122	!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)) \|\|
	123	(!(png_ptr->chunk_name[0] & 0x20) && /* Critical */
	124	(png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE)))
	125	{
	126	png_chunk_warning(png_ptr, "CRC error");
	127	}
	128	else
	129	{
	130	png_chunk_error(png_ptr, "CRC error");
	131	}
	132	return (1);
	133	}
	134
	135	return (0);
	136	}
	137
	138	/* Compare the CRC stored in the PNG file with that calculated by libpng from
	139	the data it has read thus far. */
	140	int /* PRIVATE */
	141	png_crc_error(png_structp png_ptr)
	142	{
	143	png_byte crc_bytes[4];
	144	png_uint_32 crc;
	145	int need_crc = 1;
	146
	147	if (png_ptr->chunk_name[0] & 0x20) /* ancillary */
	148	{
	149	if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
	150	(PNG_FLAG_CRC_ANCILLARY_USE \| PNG_FLAG_CRC_ANCILLARY_NOWARN))
	151	need_crc = 0;
	152	}
	153	else /* critical */
	154	{
	155	if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE)
	156	need_crc = 0;
	157	}
	158
	159	png_read_data(png_ptr, crc_bytes, 4);
	160
	161	if (need_crc)
	162	{
	163	crc = png_get_uint_32(crc_bytes);
	164	return ((int)(crc != png_ptr->crc));
	165	}
	166	else
	167	return (0);
	168	}
	169
	170	#if defined(PNG_READ_zTXt_SUPPORTED) \|\| defined(PNG_READ_iTXt_SUPPORTED) \|\| \
	171	defined(PNG_READ_iCCP_SUPPORTED)
	172	/*
	173	* Decompress trailing data in a chunk. The assumption is that chunkdata
	174	* points at an allocated area holding the contents of a chunk with a
	175	* trailing compressed part. What we get back is an allocated area
	176	* holding the original prefix part and an uncompressed version of the
	177	* trailing part (the malloc area passed in is freed).
	178	*/
	179	png_charp /* PRIVATE */
	180	png_decompress_chunk(png_structp png_ptr, int comp_type,
	181	png_charp chunkdata, png_size_t chunklength,
	182	png_size_t prefix_size, png_size_t *newlength)
	183	{
	184	const static char msg[] = "Error decoding compressed text";
	185	png_charp text;
	186	png_size_t text_size;
	187
	188	if (comp_type == PNG_COMPRESSION_TYPE_BASE)
	189	{
	190	int ret = Z_OK;
	191	png_ptr->zstream.next_in = (png_bytep)(chunkdata + prefix_size);
	192	png_ptr->zstream.avail_in = (uInt)(chunklength - prefix_size);
	193	png_ptr->zstream.next_out = png_ptr->zbuf;
	194	png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
	195
	196	text_size = 0;
	197	text = NULL;
	198
	199	while (png_ptr->zstream.avail_in)
	200	{
	201	ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
	202	if (ret != Z_OK && ret != Z_STREAM_END)
	203	{
	204	if (png_ptr->zstream.msg != NULL)
	205	png_warning(png_ptr, png_ptr->zstream.msg);
	206	else
	207	png_warning(png_ptr, msg);
	208	inflateReset(&png_ptr->zstream);
	209	png_ptr->zstream.avail_in = 0;
	210
	211	if (text == NULL)
	212	{
	213	text_size = prefix_size + png_sizeof(msg) + 1;
	214	text = (png_charp)png_malloc_warn(png_ptr, text_size);
	215	if (text == NULL)
	216	{
	217	png_free(png_ptr,chunkdata);
	218	png_error(png_ptr,"Not enough memory to decompress chunk");
	219	}
	220	png_memcpy(text, chunkdata, prefix_size);
	221	}
	222
	223	text[text_size - 1] = 0x00;
	224
	225	/* Copy what we can of the error message into the text chunk */
	226	text_size = (png_size_t)(chunklength - (text - chunkdata) - 1);
	227	text_size = png_sizeof(msg) > text_size ? text_size :
	228	png_sizeof(msg);
	229	png_memcpy(text + prefix_size, msg, text_size + 1);
	230	break;
	231	}
	232	if (!png_ptr->zstream.avail_out \|\| ret == Z_STREAM_END)
	233	{
	234	if (text == NULL)
	235	{
	236	text_size = prefix_size +
	237	png_ptr->zbuf_size - png_ptr->zstream.avail_out;
	238	text = (png_charp)png_malloc_warn(png_ptr, text_size + 1);
	239	if (text == NULL)
	240	{
	241	png_free(png_ptr,chunkdata);
	242	png_error(png_ptr,"Not enough memory to decompress chunk.");
	243	}
	244	png_memcpy(text + prefix_size, png_ptr->zbuf,
	245	text_size - prefix_size);
	246	png_memcpy(text, chunkdata, prefix_size);
	247	*(text + text_size) = 0x00;
	248	}
	249	else
	250	{
	251	png_charp tmp;
	252
	253	tmp = text;
	254	text = (png_charp)png_malloc_warn(png_ptr,
	255	(png_uint_32)(text_size +
	256	png_ptr->zbuf_size - png_ptr->zstream.avail_out + 1));
	257	if (text == NULL)
	258	{
	259	png_free(png_ptr, tmp);
	260	png_free(png_ptr, chunkdata);
	261	png_error(png_ptr,"Not enough memory to decompress chunk..");
	262	}
	263	png_memcpy(text, tmp, text_size);
	264	png_free(png_ptr, tmp);
	265	png_memcpy(text + text_size, png_ptr->zbuf,
	266	(png_ptr->zbuf_size - png_ptr->zstream.avail_out));
	267	text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
	268	*(text + text_size) = 0x00;
	269	}
	270	if (ret == Z_STREAM_END)
	271	break;
	272	else
	273	{
	274	png_ptr->zstream.next_out = png_ptr->zbuf;
	275	png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
	276	}
	277	}
	278	}
	279	if (ret != Z_STREAM_END)
	280	{
	281	#if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)
	282	char umsg[52];
	283
	284	if (ret == Z_BUF_ERROR)
	285	sprintf(umsg,"Buffer error in compressed datastream in %s chunk",
	286	png_ptr->chunk_name);
	287	else if (ret == Z_DATA_ERROR)
	288	sprintf(umsg,"Data error in compressed datastream in %s chunk",
	289	png_ptr->chunk_name);
	290	else
	291	sprintf(umsg,"Incomplete compressed datastream in %s chunk",
	292	png_ptr->chunk_name);
	293	png_warning(png_ptr, umsg);
	294	#else
	295	png_warning(png_ptr,
	296	"Incomplete compressed datastream in chunk other than IDAT");
	297	#endif
	298	text_size=prefix_size;
	299	if (text == NULL)
	300	{
	301	text = (png_charp)png_malloc_warn(png_ptr, text_size+1);
	302	if (text == NULL)
	303	{
	304	png_free(png_ptr, chunkdata);
	305	png_error(png_ptr,"Not enough memory for text.");
	306	}
	307	png_memcpy(text, chunkdata, prefix_size);
	308	}
	309	*(text + text_size) = 0x00;
	310	}
	311
	312	inflateReset(&png_ptr->zstream);
	313	png_ptr->zstream.avail_in = 0;
	314
	315	png_free(png_ptr, chunkdata);
	316	chunkdata = text;
	317	*newlength=text_size;
	318	}
	319	else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */
	320	{
	321	#if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE)
	322	char umsg[50];
	323
	324	sprintf(umsg, "Unknown zTXt compression type %d", comp_type);
	325	png_warning(png_ptr, umsg);
	326	#else
	327	png_warning(png_ptr, "Unknown zTXt compression type");
	328	#endif
	329
	330	*(chunkdata + prefix_size) = 0x00;
	331	*newlength=prefix_size;
	332	}
	333
	334	return chunkdata;
	335	}
	336	#endif
	337
	338	/* read and check the IDHR chunk */
	339	void /* PRIVATE */
	340	png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	341	{
	342	png_byte buf[13];
	343	png_uint_32 width, height;
	344	int bit_depth, color_type, compression_type, filter_type;
	345	int interlace_type;
	346
	347	png_debug(1, "in png_handle_IHDR\n");
	348
	349	if (png_ptr->mode & PNG_HAVE_IHDR)
	350	png_error(png_ptr, "Out of place IHDR");
	351
	352	/* check the length */
	353	if (length != 13)
	354	png_error(png_ptr, "Invalid IHDR chunk");
	355
	356	png_ptr->mode \|= PNG_HAVE_IHDR;
	357
	358	png_crc_read(png_ptr, buf, 13);
	359	png_crc_finish(png_ptr, 0);
	360
	361	width = png_get_uint_31(png_ptr, buf);
	362	height = png_get_uint_31(png_ptr, buf + 4);
	363	bit_depth = buf[8];
	364	color_type = buf[9];
	365	compression_type = buf[10];
	366	filter_type = buf[11];
	367	interlace_type = buf[12];
	368
	369	/* set internal variables */
	370	png_ptr->width = width;
	371	png_ptr->height = height;
	372	png_ptr->bit_depth = (png_byte)bit_depth;
	373	png_ptr->interlaced = (png_byte)interlace_type;
	374	png_ptr->color_type = (png_byte)color_type;
	375	#if defined(PNG_MNG_FEATURES_SUPPORTED)
	376	png_ptr->filter_type = (png_byte)filter_type;
	377	#endif
	378	png_ptr->compression_type = (png_byte)compression_type;
	379
	380	/* find number of channels */
	381	switch (png_ptr->color_type)
	382	{
	383	case PNG_COLOR_TYPE_GRAY:
	384	case PNG_COLOR_TYPE_PALETTE:
	385	png_ptr->channels = 1;
	386	break;
	387	case PNG_COLOR_TYPE_RGB:
	388	png_ptr->channels = 3;
	389	break;
	390	case PNG_COLOR_TYPE_GRAY_ALPHA:
	391	png_ptr->channels = 2;
	392	break;
	393	case PNG_COLOR_TYPE_RGB_ALPHA:
	394	png_ptr->channels = 4;
	395	break;
	396	}
	397
	398	/* set up other useful info */
	399	png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *
	400	png_ptr->channels);
	401	png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->width);
	402	png_debug1(3,"bit_depth = %d\n", png_ptr->bit_depth);
	403	png_debug1(3,"channels = %d\n", png_ptr->channels);
	404	png_debug1(3,"rowbytes = %lu\n", png_ptr->rowbytes);
	405	png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,
	406	color_type, interlace_type, compression_type, filter_type);
	407	}
	408
	409	/* read and check the palette */
	410	void /* PRIVATE */
	411	png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	412	{
	413	png_color palette[PNG_MAX_PALETTE_LENGTH];
	414	int num, i;
	415	#ifndef PNG_NO_POINTER_INDEXING
	416	png_colorp pal_ptr;
	417	#endif
	418
	419	png_debug(1, "in png_handle_PLTE\n");
	420
	421	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	422	png_error(png_ptr, "Missing IHDR before PLTE");
	423	else if (png_ptr->mode & PNG_HAVE_IDAT)
	424	{
	425	png_warning(png_ptr, "Invalid PLTE after IDAT");
	426	png_crc_finish(png_ptr, length);
	427	return;
	428	}
	429	else if (png_ptr->mode & PNG_HAVE_PLTE)
	430	png_error(png_ptr, "Duplicate PLTE chunk");
	431
	432	png_ptr->mode \|= PNG_HAVE_PLTE;
	433
	434	if (!(png_ptr->color_type&PNG_COLOR_MASK_COLOR))
	435	{
	436	png_warning(png_ptr,
	437	"Ignoring PLTE chunk in grayscale PNG");
	438	png_crc_finish(png_ptr, length);
	439	return;
	440	}
	441	#if !defined(PNG_READ_OPT_PLTE_SUPPORTED)
	442	if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
	443	{
	444	png_crc_finish(png_ptr, length);
	445	return;
	446	}
	447	#endif
	448
	449	if (length > 3*PNG_MAX_PALETTE_LENGTH \|\| length % 3)
	450	{
	451	if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)
	452	{
	453	png_warning(png_ptr, "Invalid palette chunk");
	454	png_crc_finish(png_ptr, length);
	455	return;
	456	}
	457	else
	458	{
	459	png_error(png_ptr, "Invalid palette chunk");
	460	}
	461	}
	462
	463	num = (int)length / 3;
	464
	465	#ifndef PNG_NO_POINTER_INDEXING
	466	for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)
	467	{
	468	png_byte buf[3];
	469
	470	png_crc_read(png_ptr, buf, 3);
	471	pal_ptr->red = buf[0];
	472	pal_ptr->green = buf[1];
	473	pal_ptr->blue = buf[2];
	474	}
	475	#else
	476	for (i = 0; i < num; i++)
	477	{
	478	png_byte buf[3];
	479
	480	png_crc_read(png_ptr, buf, 3);
	481	/* don't depend upon png_color being any order */
	482	palette[i].red = buf[0];
	483	palette[i].green = buf[1];
	484	palette[i].blue = buf[2];
	485	}
	486	#endif
	487
	488	/* If we actually NEED the PLTE chunk (ie for a paletted image), we do
	489	whatever the normal CRC configuration tells us. However, if we
	490	have an RGB image, the PLTE can be considered ancillary, so
	491	we will act as though it is. */
	492	#if !defined(PNG_READ_OPT_PLTE_SUPPORTED)
	493	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
	494	#endif
	495	{
	496	png_crc_finish(png_ptr, 0);
	497	}
	498	#if !defined(PNG_READ_OPT_PLTE_SUPPORTED)
	499	else if (png_crc_error(png_ptr)) /* Only if we have a CRC error */
	500	{
	501	/* If we don't want to use the data from an ancillary chunk,
	502	we have two options: an error abort, or a warning and we
	503	ignore the data in this chunk (which should be OK, since
	504	it's considered ancillary for a RGB or RGBA image). */
	505	if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE))
	506	{
	507	if (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)
	508	{
	509	png_chunk_error(png_ptr, "CRC error");
	510	}
	511	else
	512	{
	513	png_chunk_warning(png_ptr, "CRC error");
	514	return;
	515	}
	516	}
	517	/* Otherwise, we (optionally) emit a warning and use the chunk. */
	518	else if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN))
	519	{
	520	png_chunk_warning(png_ptr, "CRC error");
	521	}
	522	}
	523	#endif
	524
	525	png_set_PLTE(png_ptr, info_ptr, palette, num);
	526
	527	#if defined(PNG_READ_tRNS_SUPPORTED)
	528	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
	529	{
	530	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))
	531	{
	532	if (png_ptr->num_trans > (png_uint_16)num)
	533	{
	534	png_warning(png_ptr, "Truncating incorrect tRNS chunk length");
	535	png_ptr->num_trans = (png_uint_16)num;
	536	}
	537	if (info_ptr->num_trans > (png_uint_16)num)
	538	{
	539	png_warning(png_ptr, "Truncating incorrect info tRNS chunk length");
	540	info_ptr->num_trans = (png_uint_16)num;
	541	}
	542	}
	543	}
	544	#endif
	545
	546	}
	547
	548	void /* PRIVATE */
	549	png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	550	{
	551	png_debug(1, "in png_handle_IEND\n");
	552
	553	if (!(png_ptr->mode & PNG_HAVE_IHDR) \|\| !(png_ptr->mode & PNG_HAVE_IDAT))
	554	{
	555	png_error(png_ptr, "No image in file");
	556	}
	557
	558	png_ptr->mode \|= (PNG_AFTER_IDAT \| PNG_HAVE_IEND);
	559
	560	if (length != 0)
	561	{
	562	png_warning(png_ptr, "Incorrect IEND chunk length");
	563	}
	564	png_crc_finish(png_ptr, length);
	565
	566	if (&info_ptr == NULL) /* quiet compiler warnings about unused info_ptr */
	567	return;
	568	}
	569
	570	#if defined(PNG_READ_gAMA_SUPPORTED)
	571	void /* PRIVATE */
	572	png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	573	{
	574	png_fixed_point igamma;
	575	#ifdef PNG_FLOATING_POINT_SUPPORTED
	576	float file_gamma;
	577	#endif
	578	png_byte buf[4];
	579
	580	png_debug(1, "in png_handle_gAMA\n");
	581
	582	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	583	png_error(png_ptr, "Missing IHDR before gAMA");
	584	else if (png_ptr->mode & PNG_HAVE_IDAT)
	585	{
	586	png_warning(png_ptr, "Invalid gAMA after IDAT");
	587	png_crc_finish(png_ptr, length);
	588	return;
	589	}
	590	else if (png_ptr->mode & PNG_HAVE_PLTE)
	591	/* Should be an error, but we can cope with it */
	592	png_warning(png_ptr, "Out of place gAMA chunk");
	593
	594	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)
	595	#if defined(PNG_READ_sRGB_SUPPORTED)
	596	&& !(info_ptr->valid & PNG_INFO_sRGB)
	597	#endif
	598	)
	599	{
	600	png_warning(png_ptr, "Duplicate gAMA chunk");
	601	png_crc_finish(png_ptr, length);
	602	return;
	603	}
	604
	605	if (length != 4)
	606	{
	607	png_warning(png_ptr, "Incorrect gAMA chunk length");
	608	png_crc_finish(png_ptr, length);
	609	return;
	610	}
	611
	612	png_crc_read(png_ptr, buf, 4);
	613	if (png_crc_finish(png_ptr, 0))
	614	return;
	615
	616	igamma = (png_fixed_point)png_get_uint_32(buf);
	617	/* check for zero gamma */
	618	if (igamma == 0)
	619	{
	620	png_warning(png_ptr,
	621	"Ignoring gAMA chunk with gamma=0");
	622	return;
	623	}
	624
	625	#if defined(PNG_READ_sRGB_SUPPORTED)
	626	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))
	627	if (PNG_OUT_OF_RANGE(igamma, 45500L, 500))
	628	{
	629	png_warning(png_ptr,
	630	"Ignoring incorrect gAMA value when sRGB is also present");
	631	#ifndef PNG_NO_CONSOLE_IO
	632	fprintf(stderr, "gamma = (%d/100000)\n", (int)igamma);
	633	#endif
	634	return;
	635	}
	636	#endif /* PNG_READ_sRGB_SUPPORTED */
	637
	638	#ifdef PNG_FLOATING_POINT_SUPPORTED
	639	file_gamma = (float)igamma / (float)100000.0;
	640	# ifdef PNG_READ_GAMMA_SUPPORTED
	641	png_ptr->gamma = file_gamma;
	642	# endif
	643	png_set_gAMA(png_ptr, info_ptr, file_gamma);
	644	#endif
	645	#ifdef PNG_FIXED_POINT_SUPPORTED
	646	png_set_gAMA_fixed(png_ptr, info_ptr, igamma);
	647	#endif
	648	}
	649	#endif
	650
	651	#if defined(PNG_READ_sBIT_SUPPORTED)
	652	void /* PRIVATE */
	653	png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	654	{
	655	png_size_t truelen;
	656	png_byte buf[4];
	657
	658	png_debug(1, "in png_handle_sBIT\n");
	659
	660	buf[0] = buf[1] = buf[2] = buf[3] = 0;
	661
	662	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	663	png_error(png_ptr, "Missing IHDR before sBIT");
	664	else if (png_ptr->mode & PNG_HAVE_IDAT)
	665	{
	666	png_warning(png_ptr, "Invalid sBIT after IDAT");
	667	png_crc_finish(png_ptr, length);
	668	return;
	669	}
	670	else if (png_ptr->mode & PNG_HAVE_PLTE)
	671	{
	672	/* Should be an error, but we can cope with it */
	673	png_warning(png_ptr, "Out of place sBIT chunk");
	674	}
	675	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT))
	676	{
	677	png_warning(png_ptr, "Duplicate sBIT chunk");
	678	png_crc_finish(png_ptr, length);
	679	return;
	680	}
	681
	682	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
	683	truelen = 3;
	684	else
	685	truelen = (png_size_t)png_ptr->channels;
	686
	687	if (length != truelen \|\| length > 4)
	688	{
	689	png_warning(png_ptr, "Incorrect sBIT chunk length");
	690	png_crc_finish(png_ptr, length);
	691	return;
	692	}
	693
	694	png_crc_read(png_ptr, buf, truelen);
	695	if (png_crc_finish(png_ptr, 0))
	696	return;
	697
	698	if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)
	699	{
	700	png_ptr->sig_bit.red = buf[0];
	701	png_ptr->sig_bit.green = buf[1];
	702	png_ptr->sig_bit.blue = buf[2];
	703	png_ptr->sig_bit.alpha = buf[3];
	704	}
	705	else
	706	{
	707	png_ptr->sig_bit.gray = buf[0];
	708	png_ptr->sig_bit.red = buf[0];
	709	png_ptr->sig_bit.green = buf[0];
	710	png_ptr->sig_bit.blue = buf[0];
	711	png_ptr->sig_bit.alpha = buf[1];
	712	}
	713	png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));
	714	}
	715	#endif
	716
	717	#if defined(PNG_READ_cHRM_SUPPORTED)
	718	void /* PRIVATE */
	719	png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	720	{
	721	png_byte buf[4];
	722	#ifdef PNG_FLOATING_POINT_SUPPORTED
	723	float white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y;
	724	#endif
	725	png_fixed_point int_x_white, int_y_white, int_x_red, int_y_red, int_x_green,
	726	int_y_green, int_x_blue, int_y_blue;
	727
	728	png_uint_32 uint_x, uint_y;
	729
	730	png_debug(1, "in png_handle_cHRM\n");
	731
	732	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	733	png_error(png_ptr, "Missing IHDR before cHRM");
	734	else if (png_ptr->mode & PNG_HAVE_IDAT)
	735	{
	736	png_warning(png_ptr, "Invalid cHRM after IDAT");
	737	png_crc_finish(png_ptr, length);
	738	return;
	739	}
	740	else if (png_ptr->mode & PNG_HAVE_PLTE)
	741	/* Should be an error, but we can cope with it */
	742	png_warning(png_ptr, "Missing PLTE before cHRM");
	743
	744	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM)
	745	#if defined(PNG_READ_sRGB_SUPPORTED)
	746	&& !(info_ptr->valid & PNG_INFO_sRGB)
	747	#endif
	748	)
	749	{
	750	png_warning(png_ptr, "Duplicate cHRM chunk");
	751	png_crc_finish(png_ptr, length);
	752	return;
	753	}
	754
	755	if (length != 32)
	756	{
	757	png_warning(png_ptr, "Incorrect cHRM chunk length");
	758	png_crc_finish(png_ptr, length);
	759	return;
	760	}
	761
	762	png_crc_read(png_ptr, buf, 4);
	763	uint_x = png_get_uint_32(buf);
	764
	765	png_crc_read(png_ptr, buf, 4);
	766	uint_y = png_get_uint_32(buf);
	767
	768	if (uint_x > 80000L \|\| uint_y > 80000L \|\|
	769	uint_x + uint_y > 100000L)
	770	{
	771	png_warning(png_ptr, "Invalid cHRM white point");
	772	png_crc_finish(png_ptr, 24);
	773	return;
	774	}
	775	int_x_white = (png_fixed_point)uint_x;
	776	int_y_white = (png_fixed_point)uint_y;
	777
	778	png_crc_read(png_ptr, buf, 4);
	779	uint_x = png_get_uint_32(buf);
	780
	781	png_crc_read(png_ptr, buf, 4);
	782	uint_y = png_get_uint_32(buf);
	783
	784	if (uint_x + uint_y > 100000L)
	785	{
	786	png_warning(png_ptr, "Invalid cHRM red point");
	787	png_crc_finish(png_ptr, 16);
	788	return;
	789	}
	790	int_x_red = (png_fixed_point)uint_x;
	791	int_y_red = (png_fixed_point)uint_y;
	792
	793	png_crc_read(png_ptr, buf, 4);
	794	uint_x = png_get_uint_32(buf);
	795
	796	png_crc_read(png_ptr, buf, 4);
	797	uint_y = png_get_uint_32(buf);
	798
	799	if (uint_x + uint_y > 100000L)
	800	{
	801	png_warning(png_ptr, "Invalid cHRM green point");
	802	png_crc_finish(png_ptr, 8);
	803	return;
	804	}
	805	int_x_green = (png_fixed_point)uint_x;
	806	int_y_green = (png_fixed_point)uint_y;
	807
	808	png_crc_read(png_ptr, buf, 4);
	809	uint_x = png_get_uint_32(buf);
	810
	811	png_crc_read(png_ptr, buf, 4);
	812	uint_y = png_get_uint_32(buf);
	813
	814	if (uint_x + uint_y > 100000L)
	815	{
	816	png_warning(png_ptr, "Invalid cHRM blue point");
	817	png_crc_finish(png_ptr, 0);
	818	return;
	819	}
	820	int_x_blue = (png_fixed_point)uint_x;
	821	int_y_blue = (png_fixed_point)uint_y;
	822
	823	#ifdef PNG_FLOATING_POINT_SUPPORTED
	824	white_x = (float)int_x_white / (float)100000.0;
	825	white_y = (float)int_y_white / (float)100000.0;
	826	red_x = (float)int_x_red / (float)100000.0;
	827	red_y = (float)int_y_red / (float)100000.0;
	828	green_x = (float)int_x_green / (float)100000.0;
	829	green_y = (float)int_y_green / (float)100000.0;
	830	blue_x = (float)int_x_blue / (float)100000.0;
	831	blue_y = (float)int_y_blue / (float)100000.0;
	832	#endif
	833
	834	#if defined(PNG_READ_sRGB_SUPPORTED)
	835	if ((info_ptr != NULL) && (info_ptr->valid & PNG_INFO_sRGB))
	836	{
	837	if (PNG_OUT_OF_RANGE(int_x_white, 31270, 1000) \|\|
	838	PNG_OUT_OF_RANGE(int_y_white, 32900, 1000) \|\|
	839	PNG_OUT_OF_RANGE(int_x_red, 64000L, 1000) \|\|
	840	PNG_OUT_OF_RANGE(int_y_red, 33000, 1000) \|\|
	841	PNG_OUT_OF_RANGE(int_x_green, 30000, 1000) \|\|
	842	PNG_OUT_OF_RANGE(int_y_green, 60000L, 1000) \|\|
	843	PNG_OUT_OF_RANGE(int_x_blue, 15000, 1000) \|\|
	844	PNG_OUT_OF_RANGE(int_y_blue, 6000, 1000))
	845	{
	846	png_warning(png_ptr,
	847	"Ignoring incorrect cHRM value when sRGB is also present");
	848	#ifndef PNG_NO_CONSOLE_IO
	849	#ifdef PNG_FLOATING_POINT_SUPPORTED
	850	fprintf(stderr,"wx=%f, wy=%f, rx=%f, ry=%f\n",
	851	white_x, white_y, red_x, red_y);
	852	fprintf(stderr,"gx=%f, gy=%f, bx=%f, by=%f\n",
	853	green_x, green_y, blue_x, blue_y);
	854	#else
	855	fprintf(stderr,"wx=%ld, wy=%ld, rx=%ld, ry=%ld\n",
	856	int_x_white, int_y_white, int_x_red, int_y_red);
	857	fprintf(stderr,"gx=%ld, gy=%ld, bx=%ld, by=%ld\n",
	858	int_x_green, int_y_green, int_x_blue, int_y_blue);
	859	#endif
	860	#endif /* PNG_NO_CONSOLE_IO */
	861	}
	862	png_crc_finish(png_ptr, 0);
	863	return;
	864	}
	865	#endif /* PNG_READ_sRGB_SUPPORTED */
	866
	867	#ifdef PNG_FLOATING_POINT_SUPPORTED
	868	png_set_cHRM(png_ptr, info_ptr,
	869	white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y);
	870	#endif
	871	#ifdef PNG_FIXED_POINT_SUPPORTED
	872	png_set_cHRM_fixed(png_ptr, info_ptr,
	873	int_x_white, int_y_white, int_x_red, int_y_red, int_x_green,
	874	int_y_green, int_x_blue, int_y_blue);
	875	#endif
	876	if (png_crc_finish(png_ptr, 0))
	877	return;
	878	}
	879	#endif
	880
	881	#if defined(PNG_READ_sRGB_SUPPORTED)
	882	void /* PRIVATE */
	883	png_handle_sRGB(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	884	{
	885	int intent;
	886	png_byte buf[1];
	887
	888	png_debug(1, "in png_handle_sRGB\n");
	889
	890	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	891	png_error(png_ptr, "Missing IHDR before sRGB");
	892	else if (png_ptr->mode & PNG_HAVE_IDAT)
	893	{
	894	png_warning(png_ptr, "Invalid sRGB after IDAT");
	895	png_crc_finish(png_ptr, length);
	896	return;
	897	}
	898	else if (png_ptr->mode & PNG_HAVE_PLTE)
	899	/* Should be an error, but we can cope with it */
	900	png_warning(png_ptr, "Out of place sRGB chunk");
	901
	902	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))
	903	{
	904	png_warning(png_ptr, "Duplicate sRGB chunk");
	905	png_crc_finish(png_ptr, length);
	906	return;
	907	}
	908
	909	if (length != 1)
	910	{
	911	png_warning(png_ptr, "Incorrect sRGB chunk length");
	912	png_crc_finish(png_ptr, length);
	913	return;
	914	}
	915
	916	png_crc_read(png_ptr, buf, 1);
	917	if (png_crc_finish(png_ptr, 0))
	918	return;
	919
	920	intent = buf[0];
	921	/* check for bad intent */
	922	if (intent >= PNG_sRGB_INTENT_LAST)
	923	{
	924	png_warning(png_ptr, "Unknown sRGB intent");
	925	return;
	926	}
	927
	928	#if defined(PNG_READ_gAMA_SUPPORTED) && defined(PNG_READ_GAMMA_SUPPORTED)
	929	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA))
	930	{
	931	png_fixed_point igamma;
	932	#ifdef PNG_FIXED_POINT_SUPPORTED
	933	igamma=info_ptr->int_gamma;
	934	#else
	935	# ifdef PNG_FLOATING_POINT_SUPPORTED
	936	igamma=(png_fixed_point)(info_ptr->gamma * 100000.);
	937	# endif
	938	#endif
	939	if (PNG_OUT_OF_RANGE(igamma, 45500L, 500))
	940	{
	941	png_warning(png_ptr,
	942	"Ignoring incorrect gAMA value when sRGB is also present");
	943	#ifndef PNG_NO_CONSOLE_IO
	944	# ifdef PNG_FIXED_POINT_SUPPORTED
	945	fprintf(stderr,"incorrect gamma=(%d/100000)\n",(int)png_ptr->int_gamma);
	946	# else
	947	# ifdef PNG_FLOATING_POINT_SUPPORTED
	948	fprintf(stderr,"incorrect gamma=%f\n",png_ptr->gamma);
	949	# endif
	950	# endif
	951	#endif
	952	}
	953	}
	954	#endif /* PNG_READ_gAMA_SUPPORTED */
	955
	956	#ifdef PNG_READ_cHRM_SUPPORTED
	957	#ifdef PNG_FIXED_POINT_SUPPORTED
	958	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM))
	959	if (PNG_OUT_OF_RANGE(info_ptr->int_x_white, 31270, 1000) \|\|
	960	PNG_OUT_OF_RANGE(info_ptr->int_y_white, 32900, 1000) \|\|
	961	PNG_OUT_OF_RANGE(info_ptr->int_x_red, 64000L, 1000) \|\|
	962	PNG_OUT_OF_RANGE(info_ptr->int_y_red, 33000, 1000) \|\|
	963	PNG_OUT_OF_RANGE(info_ptr->int_x_green, 30000, 1000) \|\|
	964	PNG_OUT_OF_RANGE(info_ptr->int_y_green, 60000L, 1000) \|\|
	965	PNG_OUT_OF_RANGE(info_ptr->int_x_blue, 15000, 1000) \|\|
	966	PNG_OUT_OF_RANGE(info_ptr->int_y_blue, 6000, 1000))
	967	{
	968	png_warning(png_ptr,
	969	"Ignoring incorrect cHRM value when sRGB is also present");
	970	}
	971	#endif /* PNG_FIXED_POINT_SUPPORTED */
	972	#endif /* PNG_READ_cHRM_SUPPORTED */
	973
	974	png_set_sRGB_gAMA_and_cHRM(png_ptr, info_ptr, intent);
	975	}
	976	#endif /* PNG_READ_sRGB_SUPPORTED */
	977
	978	#if defined(PNG_READ_iCCP_SUPPORTED)
	979	void /* PRIVATE */
	980	png_handle_iCCP(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	981	/* Note: this does not properly handle chunks that are > 64K under DOS */
	982	{
	983	png_charp chunkdata;
	984	png_byte compression_type;
	985	png_bytep pC;
	986	png_charp profile;
	987	png_uint_32 skip = 0;
	988	png_uint_32 profile_size, profile_length;
	989	png_size_t slength, prefix_length, data_length;
	990
	991	png_debug(1, "in png_handle_iCCP\n");
	992
	993	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	994	png_error(png_ptr, "Missing IHDR before iCCP");
	995	else if (png_ptr->mode & PNG_HAVE_IDAT)
	996	{
	997	png_warning(png_ptr, "Invalid iCCP after IDAT");
	998	png_crc_finish(png_ptr, length);
	999	return;
	1000	}
	1001	else if (png_ptr->mode & PNG_HAVE_PLTE)
	1002	/* Should be an error, but we can cope with it */
	1003	png_warning(png_ptr, "Out of place iCCP chunk");
	1004
	1005	if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP))
	1006	{
	1007	png_warning(png_ptr, "Duplicate iCCP chunk");
	1008	png_crc_finish(png_ptr, length);
	1009	return;
	1010	}
	1011
	1012	#ifdef PNG_MAX_MALLOC_64K
	1013	if (length > (png_uint_32)65535L)
	1014	{
	1015	png_warning(png_ptr, "iCCP chunk too large to fit in memory");
	1016	skip = length - (png_uint_32)65535L;
	1017	length = (png_uint_32)65535L;
	1018	}
	1019	#endif
	1020
	1021	chunkdata = (png_charp)png_malloc(png_ptr, length + 1);
	1022	slength = (png_size_t)length;
	1023	png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
	1024
	1025	if (png_crc_finish(png_ptr, skip))
	1026	{
	1027	png_free(png_ptr, chunkdata);
	1028	return;
	1029	}
	1030
	1031	chunkdata[slength] = 0x00;
	1032
	1033	for (profile = chunkdata; *profile; profile++)
	1034	/* empty loop to find end of name */ ;
	1035
	1036	++profile;
	1037
	1038	/* there should be at least one zero (the compression type byte)
	1039	following the separator, and we should be on it */
	1040	if ( profile >= chunkdata + slength)
	1041	{
	1042	png_free(png_ptr, chunkdata);
	1043	png_warning(png_ptr, "Malformed iCCP chunk");
	1044	return;
	1045	}
	1046
	1047	/* compression_type should always be zero */
	1048	compression_type = *profile++;
	1049	if (compression_type)
	1050	{
	1051	png_warning(png_ptr, "Ignoring nonzero compression type in iCCP chunk");
	1052	compression_type=0x00; /* Reset it to zero (libpng-1.0.6 through 1.0.8
	1053	wrote nonzero) */
	1054	}
	1055
	1056	prefix_length = profile - chunkdata;
	1057	chunkdata = png_decompress_chunk(png_ptr, compression_type, chunkdata,
	1058	slength, prefix_length, &data_length);
	1059
	1060	profile_length = data_length - prefix_length;
	1061
	1062	if ( prefix_length > data_length \|\| profile_length < 4)
	1063	{
	1064	png_free(png_ptr, chunkdata);
	1065	png_warning(png_ptr, "Profile size field missing from iCCP chunk");
	1066	return;
	1067	}
	1068
	1069	/* Check the profile_size recorded in the first 32 bits of the ICC profile */
	1070	pC = (png_bytep)(chunkdata+prefix_length);
	1071	profile_size = ((*(pC ))<<24) \|
	1072	((*(pC+1))<<16) \|
	1073	((*(pC+2))<< 8) \|
	1074	((*(pC+3)) );
	1075
	1076	if(profile_size < profile_length)
	1077	profile_length = profile_size;
	1078
	1079	if(profile_size > profile_length)
	1080	{
	1081	png_free(png_ptr, chunkdata);
	1082	png_warning(png_ptr, "Ignoring truncated iCCP profile.");
	1083	return;
	1084	}
	1085
	1086	png_set_iCCP(png_ptr, info_ptr, chunkdata, compression_type,
	1087	chunkdata + prefix_length, profile_length);
	1088	png_free(png_ptr, chunkdata);
	1089	}
	1090	#endif /* PNG_READ_iCCP_SUPPORTED */
	1091
	1092	#if defined(PNG_READ_sPLT_SUPPORTED)
	1093	void /* PRIVATE */
	1094	png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1095	/* Note: this does not properly handle chunks that are > 64K under DOS */
	1096	{
	1097	png_bytep chunkdata;
	1098	png_bytep entry_start;
	1099	png_sPLT_t new_palette;
	1100	#ifdef PNG_NO_POINTER_INDEXING
	1101	png_sPLT_entryp pp;
	1102	#endif
	1103	int data_length, entry_size, i;
	1104	png_uint_32 skip = 0;
	1105	png_size_t slength;
	1106
	1107	png_debug(1, "in png_handle_sPLT\n");
	1108
	1109	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1110	png_error(png_ptr, "Missing IHDR before sPLT");
	1111	else if (png_ptr->mode & PNG_HAVE_IDAT)
	1112	{
	1113	png_warning(png_ptr, "Invalid sPLT after IDAT");
	1114	png_crc_finish(png_ptr, length);
	1115	return;
	1116	}
	1117
	1118	#ifdef PNG_MAX_MALLOC_64K
	1119	if (length > (png_uint_32)65535L)
	1120	{
	1121	png_warning(png_ptr, "sPLT chunk too large to fit in memory");
	1122	skip = length - (png_uint_32)65535L;
	1123	length = (png_uint_32)65535L;
	1124	}
	1125	#endif
	1126
	1127	chunkdata = (png_bytep)png_malloc(png_ptr, length + 1);
	1128	slength = (png_size_t)length;
	1129	png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
	1130
	1131	if (png_crc_finish(png_ptr, skip))
	1132	{
	1133	png_free(png_ptr, chunkdata);
	1134	return;
	1135	}
	1136
	1137	chunkdata[slength] = 0x00;
	1138
	1139	for (entry_start = chunkdata; *entry_start; entry_start++)
	1140	/* empty loop to find end of name */ ;
	1141	++entry_start;
	1142
	1143	/* a sample depth should follow the separator, and we should be on it */
	1144	if (entry_start > chunkdata + slength)
	1145	{
	1146	png_free(png_ptr, chunkdata);
	1147	png_warning(png_ptr, "malformed sPLT chunk");
	1148	return;
	1149	}
	1150
	1151	new_palette.depth = *entry_start++;
	1152	entry_size = (new_palette.depth == 8 ? 6 : 10);
	1153	data_length = (slength - (entry_start - chunkdata));
	1154
	1155	/* integrity-check the data length */
	1156	if (data_length % entry_size)
	1157	{
	1158	png_free(png_ptr, chunkdata);
	1159	png_warning(png_ptr, "sPLT chunk has bad length");
	1160	return;
	1161	}
	1162
	1163	new_palette.nentries = (png_int_32) ( data_length / entry_size);
	1164	if ((png_uint_32) new_palette.nentries > (png_uint_32) (PNG_SIZE_MAX /
	1165	png_sizeof(png_sPLT_entry)))
	1166	{
	1167	png_warning(png_ptr, "sPLT chunk too long");
	1168	return;
	1169	}
	1170	new_palette.entries = (png_sPLT_entryp)png_malloc_warn(
	1171	png_ptr, new_palette.nentries * png_sizeof(png_sPLT_entry));
	1172	if (new_palette.entries == NULL)
	1173	{
	1174	png_warning(png_ptr, "sPLT chunk requires too much memory");
	1175	return;
	1176	}
	1177
	1178	#ifndef PNG_NO_POINTER_INDEXING
	1179	for (i = 0; i < new_palette.nentries; i++)
	1180	{
	1181	png_sPLT_entryp pp = new_palette.entries + i;
	1182
	1183	if (new_palette.depth == 8)
	1184	{
	1185	pp->red = *entry_start++;
	1186	pp->green = *entry_start++;
	1187	pp->blue = *entry_start++;
	1188	pp->alpha = *entry_start++;
	1189	}
	1190	else
	1191	{
	1192	pp->red = png_get_uint_16(entry_start); entry_start += 2;
	1193	pp->green = png_get_uint_16(entry_start); entry_start += 2;
	1194	pp->blue = png_get_uint_16(entry_start); entry_start += 2;
	1195	pp->alpha = png_get_uint_16(entry_start); entry_start += 2;
	1196	}
	1197	pp->frequency = png_get_uint_16(entry_start); entry_start += 2;
	1198	}
	1199	#else
	1200	pp = new_palette.entries;
	1201	for (i = 0; i < new_palette.nentries; i++)
	1202	{
	1203
	1204	if (new_palette.depth == 8)
	1205	{
	1206	pp[i].red = *entry_start++;
	1207	pp[i].green = *entry_start++;
	1208	pp[i].blue = *entry_start++;
	1209	pp[i].alpha = *entry_start++;
	1210	}
	1211	else
	1212	{
	1213	pp[i].red = png_get_uint_16(entry_start); entry_start += 2;
	1214	pp[i].green = png_get_uint_16(entry_start); entry_start += 2;
	1215	pp[i].blue = png_get_uint_16(entry_start); entry_start += 2;
	1216	pp[i].alpha = png_get_uint_16(entry_start); entry_start += 2;
	1217	}
	1218	pp->frequency = png_get_uint_16(entry_start); entry_start += 2;
	1219	}
	1220	#endif
	1221
	1222	/* discard all chunk data except the name and stash that */
	1223	new_palette.name = (png_charp)chunkdata;
	1224
	1225	png_set_sPLT(png_ptr, info_ptr, &new_palette, 1);
	1226
	1227	png_free(png_ptr, chunkdata);
	1228	png_free(png_ptr, new_palette.entries);
	1229	}
	1230	#endif /* PNG_READ_sPLT_SUPPORTED */
	1231
	1232	#if defined(PNG_READ_tRNS_SUPPORTED)
	1233	void /* PRIVATE */
	1234	png_handle_tRNS(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1235	{
	1236	png_byte readbuf[PNG_MAX_PALETTE_LENGTH];
	1237
	1238	png_debug(1, "in png_handle_tRNS\n");
	1239
	1240	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1241	png_error(png_ptr, "Missing IHDR before tRNS");
	1242	else if (png_ptr->mode & PNG_HAVE_IDAT)
	1243	{
	1244	png_warning(png_ptr, "Invalid tRNS after IDAT");
	1245	png_crc_finish(png_ptr, length);
	1246	return;
	1247	}
	1248	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))
	1249	{
	1250	png_warning(png_ptr, "Duplicate tRNS chunk");
	1251	png_crc_finish(png_ptr, length);
	1252	return;
	1253	}
	1254
	1255	if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
	1256	{
	1257	png_byte buf[2];
	1258
	1259	if (length != 2)
	1260	{
	1261	png_warning(png_ptr, "Incorrect tRNS chunk length");
	1262	png_crc_finish(png_ptr, length);
	1263	return;
	1264	}
	1265
	1266	png_crc_read(png_ptr, buf, 2);
	1267	png_ptr->num_trans = 1;
	1268	png_ptr->trans_values.gray = png_get_uint_16(buf);
	1269	}
	1270	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
	1271	{
	1272	png_byte buf[6];
	1273
	1274	if (length != 6)
	1275	{
	1276	png_warning(png_ptr, "Incorrect tRNS chunk length");
	1277	png_crc_finish(png_ptr, length);
	1278	return;
	1279	}
	1280	png_crc_read(png_ptr, buf, (png_size_t)length);
	1281	png_ptr->num_trans = 1;
	1282	png_ptr->trans_values.red = png_get_uint_16(buf);
	1283	png_ptr->trans_values.green = png_get_uint_16(buf + 2);
	1284	png_ptr->trans_values.blue = png_get_uint_16(buf + 4);
	1285	}
	1286	else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
	1287	{
	1288	if (!(png_ptr->mode & PNG_HAVE_PLTE))
	1289	{
	1290	/* Should be an error, but we can cope with it. */
	1291	png_warning(png_ptr, "Missing PLTE before tRNS");
	1292	}
	1293	if (length > (png_uint_32)png_ptr->num_palette \|\|
	1294	length > PNG_MAX_PALETTE_LENGTH)
	1295	{
	1296	png_warning(png_ptr, "Incorrect tRNS chunk length");
	1297	png_crc_finish(png_ptr, length);
	1298	return;
	1299	}
	1300	if (length == 0)
	1301	{
	1302	png_warning(png_ptr, "Zero length tRNS chunk");
	1303	png_crc_finish(png_ptr, length);
	1304	return;
	1305	}
	1306	png_crc_read(png_ptr, readbuf, (png_size_t)length);
	1307	png_ptr->num_trans = (png_uint_16)length;
	1308	}
	1309	else
	1310	{
	1311	png_warning(png_ptr, "tRNS chunk not allowed with alpha channel");
	1312	png_crc_finish(png_ptr, length);
	1313	return;
	1314	}
	1315
	1316	if (png_crc_finish(png_ptr, 0))
	1317	{
	1318	png_ptr->num_trans = 0;
	1319	return;
	1320	}
	1321
	1322	png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
	1323	&(png_ptr->trans_values));
	1324	}
	1325	#endif
	1326
	1327	#if defined(PNG_READ_bKGD_SUPPORTED)
	1328	void /* PRIVATE */
	1329	png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1330	{
	1331	png_size_t truelen;
	1332	png_byte buf[6];
	1333
	1334	png_debug(1, "in png_handle_bKGD\n");
	1335
	1336	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1337	png_error(png_ptr, "Missing IHDR before bKGD");
	1338	else if (png_ptr->mode & PNG_HAVE_IDAT)
	1339	{
	1340	png_warning(png_ptr, "Invalid bKGD after IDAT");
	1341	png_crc_finish(png_ptr, length);
	1342	return;
	1343	}
	1344	else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
	1345	!(png_ptr->mode & PNG_HAVE_PLTE))
	1346	{
	1347	png_warning(png_ptr, "Missing PLTE before bKGD");
	1348	png_crc_finish(png_ptr, length);
	1349	return;
	1350	}
	1351	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_bKGD))
	1352	{
	1353	png_warning(png_ptr, "Duplicate bKGD chunk");
	1354	png_crc_finish(png_ptr, length);
	1355	return;
	1356	}
	1357
	1358	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
	1359	truelen = 1;
	1360	else if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)
	1361	truelen = 6;
	1362	else
	1363	truelen = 2;
	1364
	1365	if (length != truelen)
	1366	{
	1367	png_warning(png_ptr, "Incorrect bKGD chunk length");
	1368	png_crc_finish(png_ptr, length);
	1369	return;
	1370	}
	1371
	1372	png_crc_read(png_ptr, buf, truelen);
	1373	if (png_crc_finish(png_ptr, 0))
	1374	return;
	1375
	1376	/* We convert the index value into RGB components so that we can allow
	1377	* arbitrary RGB values for background when we have transparency, and
	1378	* so it is easy to determine the RGB values of the background color
	1379	* from the info_ptr struct. */
	1380	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
	1381	{
	1382	png_ptr->background.index = buf[0];
	1383	if(info_ptr->num_palette)
	1384	{
	1385	if(buf[0] > info_ptr->num_palette)
	1386	{
	1387	png_warning(png_ptr, "Incorrect bKGD chunk index value");
	1388	return;
	1389	}
	1390	png_ptr->background.red =
	1391	(png_uint_16)png_ptr->palette[buf[0]].red;
	1392	png_ptr->background.green =
	1393	(png_uint_16)png_ptr->palette[buf[0]].green;
	1394	png_ptr->background.blue =
	1395	(png_uint_16)png_ptr->palette[buf[0]].blue;
	1396	}
	1397	}
	1398	else if (!(png_ptr->color_type & PNG_COLOR_MASK_COLOR)) /* GRAY */
	1399	{
	1400	png_ptr->background.red =
	1401	png_ptr->background.green =
	1402	png_ptr->background.blue =
	1403	png_ptr->background.gray = png_get_uint_16(buf);
	1404	}
	1405	else
	1406	{
	1407	png_ptr->background.red = png_get_uint_16(buf);
	1408	png_ptr->background.green = png_get_uint_16(buf + 2);
	1409	png_ptr->background.blue = png_get_uint_16(buf + 4);
	1410	}
	1411
	1412	png_set_bKGD(png_ptr, info_ptr, &(png_ptr->background));
	1413	}
	1414	#endif
	1415
	1416	#if defined(PNG_READ_hIST_SUPPORTED)
	1417	void /* PRIVATE */
	1418	png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1419	{
	1420	unsigned int num, i;
	1421	png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
	1422
	1423	png_debug(1, "in png_handle_hIST\n");
	1424
	1425	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1426	png_error(png_ptr, "Missing IHDR before hIST");
	1427	else if (png_ptr->mode & PNG_HAVE_IDAT)
	1428	{
	1429	png_warning(png_ptr, "Invalid hIST after IDAT");
	1430	png_crc_finish(png_ptr, length);
	1431	return;
	1432	}
	1433	else if (!(png_ptr->mode & PNG_HAVE_PLTE))
	1434	{
	1435	png_warning(png_ptr, "Missing PLTE before hIST");
	1436	png_crc_finish(png_ptr, length);
	1437	return;
	1438	}
	1439	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_hIST))
	1440	{
	1441	png_warning(png_ptr, "Duplicate hIST chunk");
	1442	png_crc_finish(png_ptr, length);
	1443	return;
	1444	}
	1445
	1446	num = length / 2 ;
	1447	if (num != (unsigned int) png_ptr->num_palette \|\| num >
	1448	(unsigned int) PNG_MAX_PALETTE_LENGTH)
	1449	{
	1450	png_warning(png_ptr, "Incorrect hIST chunk length");
	1451	png_crc_finish(png_ptr, length);
	1452	return;
	1453	}
	1454
	1455	for (i = 0; i < num; i++)
	1456	{
	1457	png_byte buf[2];
	1458
	1459	png_crc_read(png_ptr, buf, 2);
	1460	readbuf[i] = png_get_uint_16(buf);
	1461	}
	1462
	1463	if (png_crc_finish(png_ptr, 0))
	1464	return;
	1465
	1466	png_set_hIST(png_ptr, info_ptr, readbuf);
	1467	}
	1468	#endif
	1469
	1470	#if defined(PNG_READ_pHYs_SUPPORTED)
	1471	void /* PRIVATE */
	1472	png_handle_pHYs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1473	{
	1474	png_byte buf[9];
	1475	png_uint_32 res_x, res_y;
	1476	int unit_type;
	1477
	1478	png_debug(1, "in png_handle_pHYs\n");
	1479
	1480	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1481	png_error(png_ptr, "Missing IHDR before pHYs");
	1482	else if (png_ptr->mode & PNG_HAVE_IDAT)
	1483	{
	1484	png_warning(png_ptr, "Invalid pHYs after IDAT");
	1485	png_crc_finish(png_ptr, length);
	1486	return;
	1487	}
	1488	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pHYs))
	1489	{
	1490	png_warning(png_ptr, "Duplicate pHYs chunk");
	1491	png_crc_finish(png_ptr, length);
	1492	return;
	1493	}
	1494
	1495	if (length != 9)
	1496	{
	1497	png_warning(png_ptr, "Incorrect pHYs chunk length");
	1498	png_crc_finish(png_ptr, length);
	1499	return;
	1500	}
	1501
	1502	png_crc_read(png_ptr, buf, 9);
	1503	if (png_crc_finish(png_ptr, 0))
	1504	return;
	1505
	1506	res_x = png_get_uint_32(buf);
	1507	res_y = png_get_uint_32(buf + 4);
	1508	unit_type = buf[8];
	1509	png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type);
	1510	}
	1511	#endif
	1512
	1513	#if defined(PNG_READ_oFFs_SUPPORTED)
	1514	void /* PRIVATE */
	1515	png_handle_oFFs(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1516	{
	1517	png_byte buf[9];
	1518	png_int_32 offset_x, offset_y;
	1519	int unit_type;
	1520
	1521	png_debug(1, "in png_handle_oFFs\n");
	1522
	1523	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1524	png_error(png_ptr, "Missing IHDR before oFFs");
	1525	else if (png_ptr->mode & PNG_HAVE_IDAT)
	1526	{
	1527	png_warning(png_ptr, "Invalid oFFs after IDAT");
	1528	png_crc_finish(png_ptr, length);
	1529	return;
	1530	}
	1531	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_oFFs))
	1532	{
	1533	png_warning(png_ptr, "Duplicate oFFs chunk");
	1534	png_crc_finish(png_ptr, length);
	1535	return;
	1536	}
	1537
	1538	if (length != 9)
	1539	{
	1540	png_warning(png_ptr, "Incorrect oFFs chunk length");
	1541	png_crc_finish(png_ptr, length);
	1542	return;
	1543	}
	1544
	1545	png_crc_read(png_ptr, buf, 9);
	1546	if (png_crc_finish(png_ptr, 0))
	1547	return;
	1548
	1549	offset_x = png_get_int_32(buf);
	1550	offset_y = png_get_int_32(buf + 4);
	1551	unit_type = buf[8];
	1552	png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type);
	1553	}
	1554	#endif
	1555
	1556	#if defined(PNG_READ_pCAL_SUPPORTED)
	1557	/* read the pCAL chunk (described in the PNG Extensions document) */
	1558	void /* PRIVATE */
	1559	png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1560	{
	1561	png_charp purpose;
	1562	png_int_32 X0, X1;
	1563	png_byte type, nparams;
	1564	png_charp buf, units, endptr;
	1565	png_charpp params;
	1566	png_size_t slength;
	1567	int i;
	1568
	1569	png_debug(1, "in png_handle_pCAL\n");
	1570
	1571	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1572	png_error(png_ptr, "Missing IHDR before pCAL");
	1573	else if (png_ptr->mode & PNG_HAVE_IDAT)
	1574	{
	1575	png_warning(png_ptr, "Invalid pCAL after IDAT");
	1576	png_crc_finish(png_ptr, length);
	1577	return;
	1578	}
	1579	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_pCAL))
	1580	{
	1581	png_warning(png_ptr, "Duplicate pCAL chunk");
	1582	png_crc_finish(png_ptr, length);
	1583	return;
	1584	}
	1585
	1586	png_debug1(2, "Allocating and reading pCAL chunk data (%lu bytes)\n",
	1587	length + 1);
	1588	purpose = (png_charp)png_malloc_warn(png_ptr, length + 1);
	1589	if (purpose == NULL)
	1590	{
	1591	png_warning(png_ptr, "No memory for pCAL purpose.");
	1592	return;
	1593	}
	1594	slength = (png_size_t)length;
	1595	png_crc_read(png_ptr, (png_bytep)purpose, slength);
	1596
	1597	if (png_crc_finish(png_ptr, 0))
	1598	{
	1599	png_free(png_ptr, purpose);
	1600	return;
	1601	}
	1602
	1603	purpose[slength] = 0x00; /* null terminate the last string */
	1604
	1605	png_debug(3, "Finding end of pCAL purpose string\n");
	1606	for (buf = purpose; *buf; buf++)
	1607	/* empty loop */ ;
	1608
	1609	endptr = purpose + slength;
	1610
	1611	/* We need to have at least 12 bytes after the purpose string
	1612	in order to get the parameter information. */
	1613	if (endptr <= buf + 12)
	1614	{
	1615	png_warning(png_ptr, "Invalid pCAL data");
	1616	png_free(png_ptr, purpose);
	1617	return;
	1618	}
	1619
	1620	png_debug(3, "Reading pCAL X0, X1, type, nparams, and units\n");
	1621	X0 = png_get_int_32((png_bytep)buf+1);
	1622	X1 = png_get_int_32((png_bytep)buf+5);
	1623	type = buf[9];
	1624	nparams = buf[10];
	1625	units = buf + 11;
	1626
	1627	png_debug(3, "Checking pCAL equation type and number of parameters\n");
	1628	/* Check that we have the right number of parameters for known
	1629	equation types. */
	1630	if ((type == PNG_EQUATION_LINEAR && nparams != 2) \|\|
	1631	(type == PNG_EQUATION_BASE_E && nparams != 3) \|\|
	1632	(type == PNG_EQUATION_ARBITRARY && nparams != 3) \|\|
	1633	(type == PNG_EQUATION_HYPERBOLIC && nparams != 4))
	1634	{
	1635	png_warning(png_ptr, "Invalid pCAL parameters for equation type");
	1636	png_free(png_ptr, purpose);
	1637	return;
	1638	}
	1639	else if (type >= PNG_EQUATION_LAST)
	1640	{
	1641	png_warning(png_ptr, "Unrecognized equation type for pCAL chunk");
	1642	}
	1643
	1644	for (buf = units; *buf; buf++)
	1645	/* Empty loop to move past the units string. */ ;
	1646
	1647	png_debug(3, "Allocating pCAL parameters array\n");
	1648	params = (png_charpp)png_malloc_warn(png_ptr, (png_uint_32)(nparams
	1649	*png_sizeof(png_charp))) ;
	1650	if (params == NULL)
	1651	{
	1652	png_free(png_ptr, purpose);
	1653	png_warning(png_ptr, "No memory for pCAL params.");
	1654	return;
	1655	}
	1656
	1657	/* Get pointers to the start of each parameter string. */
	1658	for (i = 0; i < (int)nparams; i++)
	1659	{
	1660	buf++; /* Skip the null string terminator from previous parameter. */
	1661
	1662	png_debug1(3, "Reading pCAL parameter %d\n", i);
	1663	for (params[i] = buf; *buf != 0x00 && buf <= endptr; buf++)
	1664	/* Empty loop to move past each parameter string */ ;
	1665
	1666	/* Make sure we haven't run out of data yet */
	1667	if (buf > endptr)
	1668	{
	1669	png_warning(png_ptr, "Invalid pCAL data");
	1670	png_free(png_ptr, purpose);
	1671	png_free(png_ptr, params);
	1672	return;
	1673	}
	1674	}
	1675
	1676	png_set_pCAL(png_ptr, info_ptr, purpose, X0, X1, type, nparams,
	1677	units, params);
	1678
	1679	png_free(png_ptr, purpose);
	1680	png_free(png_ptr, params);
	1681	}
	1682	#endif
	1683
	1684	#if defined(PNG_READ_sCAL_SUPPORTED)
	1685	/* read the sCAL chunk */
	1686	void /* PRIVATE */
	1687	png_handle_sCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1688	{
	1689	png_charp buffer, ep;
	1690	#ifdef PNG_FLOATING_POINT_SUPPORTED
	1691	double width, height;
	1692	png_charp vp;
	1693	#else
	1694	#ifdef PNG_FIXED_POINT_SUPPORTED
	1695	png_charp swidth, sheight;
	1696	#endif
	1697	#endif
	1698	png_size_t slength;
	1699
	1700	png_debug(1, "in png_handle_sCAL\n");
	1701
	1702	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1703	png_error(png_ptr, "Missing IHDR before sCAL");
	1704	else if (png_ptr->mode & PNG_HAVE_IDAT)
	1705	{
	1706	png_warning(png_ptr, "Invalid sCAL after IDAT");
	1707	png_crc_finish(png_ptr, length);
	1708	return;
	1709	}
	1710	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sCAL))
	1711	{
	1712	png_warning(png_ptr, "Duplicate sCAL chunk");
	1713	png_crc_finish(png_ptr, length);
	1714	return;
	1715	}
	1716
	1717	png_debug1(2, "Allocating and reading sCAL chunk data (%lu bytes)\n",
	1718	length + 1);
	1719	buffer = (png_charp)png_malloc_warn(png_ptr, length + 1);
	1720	if (buffer == NULL)
	1721	{
	1722	png_warning(png_ptr, "Out of memory while processing sCAL chunk");
	1723	return;
	1724	}
	1725	slength = (png_size_t)length;
	1726	png_crc_read(png_ptr, (png_bytep)buffer, slength);
	1727
	1728	if (png_crc_finish(png_ptr, 0))
	1729	{
	1730	png_free(png_ptr, buffer);
	1731	return;
	1732	}
	1733
	1734	buffer[slength] = 0x00; /* null terminate the last string */
	1735
	1736	ep = buffer + 1; /* skip unit byte */
	1737
	1738	#ifdef PNG_FLOATING_POINT_SUPPORTED
	1739	width = png_strtod(png_ptr, ep, &vp);
	1740	if (*vp)
	1741	{
	1742	png_warning(png_ptr, "malformed width string in sCAL chunk");
	1743	return;
	1744	}
	1745	#else
	1746	#ifdef PNG_FIXED_POINT_SUPPORTED
	1747	swidth = (png_charp)png_malloc_warn(png_ptr, png_strlen(ep) + 1);
	1748	if (swidth == NULL)
	1749	{
	1750	png_warning(png_ptr, "Out of memory while processing sCAL chunk width");
	1751	return;
	1752	}
	1753	png_memcpy(swidth, ep, (png_size_t)png_strlen(ep));
	1754	#endif
	1755	#endif
	1756
	1757	for (ep = buffer; *ep; ep++)
	1758	/* empty loop */ ;
	1759	ep++;
	1760
	1761	#ifdef PNG_FLOATING_POINT_SUPPORTED
	1762	height = png_strtod(png_ptr, ep, &vp);
	1763	if (*vp)
	1764	{
	1765	png_warning(png_ptr, "malformed height string in sCAL chunk");
	1766	return;
	1767	}
	1768	#else
	1769	#ifdef PNG_FIXED_POINT_SUPPORTED
	1770	sheight = (png_charp)png_malloc_warn(png_ptr, png_strlen(ep) + 1);
	1771	if (swidth == NULL)
	1772	{
	1773	png_warning(png_ptr, "Out of memory while processing sCAL chunk height");
	1774	return;
	1775	}
	1776	png_memcpy(sheight, ep, (png_size_t)png_strlen(ep));
	1777	#endif
	1778	#endif
	1779
	1780	if (buffer + slength < ep
	1781	#ifdef PNG_FLOATING_POINT_SUPPORTED
	1782	\|\| width <= 0. \|\| height <= 0.
	1783	#endif
	1784	)
	1785	{
	1786	png_warning(png_ptr, "Invalid sCAL data");
	1787	png_free(png_ptr, buffer);
	1788	#if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
	1789	png_free(png_ptr, swidth);
	1790	png_free(png_ptr, sheight);
	1791	#endif
	1792	return;
	1793	}
	1794
	1795
	1796	#ifdef PNG_FLOATING_POINT_SUPPORTED
	1797	png_set_sCAL(png_ptr, info_ptr, buffer[0], width, height);
	1798	#else
	1799	#ifdef PNG_FIXED_POINT_SUPPORTED
	1800	png_set_sCAL_s(png_ptr, info_ptr, buffer[0], swidth, sheight);
	1801	#endif
	1802	#endif
	1803
	1804	png_free(png_ptr, buffer);
	1805	#if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
	1806	png_free(png_ptr, swidth);
	1807	png_free(png_ptr, sheight);
	1808	#endif
	1809	}
	1810	#endif
	1811
	1812	#if defined(PNG_READ_tIME_SUPPORTED)
	1813	void /* PRIVATE */
	1814	png_handle_tIME(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1815	{
	1816	png_byte buf[7];
	1817	png_time mod_time;
	1818
	1819	png_debug(1, "in png_handle_tIME\n");
	1820
	1821	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1822	png_error(png_ptr, "Out of place tIME chunk");
	1823	else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tIME))
	1824	{
	1825	png_warning(png_ptr, "Duplicate tIME chunk");
	1826	png_crc_finish(png_ptr, length);
	1827	return;
	1828	}
	1829
	1830	if (png_ptr->mode & PNG_HAVE_IDAT)
	1831	png_ptr->mode \|= PNG_AFTER_IDAT;
	1832
	1833	if (length != 7)
	1834	{
	1835	png_warning(png_ptr, "Incorrect tIME chunk length");
	1836	png_crc_finish(png_ptr, length);
	1837	return;
	1838	}
	1839
	1840	png_crc_read(png_ptr, buf, 7);
	1841	if (png_crc_finish(png_ptr, 0))
	1842	return;
	1843
	1844	mod_time.second = buf[6];
	1845	mod_time.minute = buf[5];
	1846	mod_time.hour = buf[4];
	1847	mod_time.day = buf[3];
	1848	mod_time.month = buf[2];
	1849	mod_time.year = png_get_uint_16(buf);
	1850
	1851	png_set_tIME(png_ptr, info_ptr, &mod_time);
	1852	}
	1853	#endif
	1854
	1855	#if defined(PNG_READ_tEXt_SUPPORTED)
	1856	/* Note: this does not properly handle chunks that are > 64K under DOS */
	1857	void /* PRIVATE */
	1858	png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1859	{
	1860	png_textp text_ptr;
	1861	png_charp key;
	1862	png_charp text;
	1863	png_uint_32 skip = 0;
	1864	png_size_t slength;
	1865	int ret;
	1866
	1867	png_debug(1, "in png_handle_tEXt\n");
	1868
	1869	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1870	png_error(png_ptr, "Missing IHDR before tEXt");
	1871
	1872	if (png_ptr->mode & PNG_HAVE_IDAT)
	1873	png_ptr->mode \|= PNG_AFTER_IDAT;
	1874
	1875	#ifdef PNG_MAX_MALLOC_64K
	1876	if (length > (png_uint_32)65535L)
	1877	{
	1878	png_warning(png_ptr, "tEXt chunk too large to fit in memory");
	1879	skip = length - (png_uint_32)65535L;
	1880	length = (png_uint_32)65535L;
	1881	}
	1882	#endif
	1883
	1884	key = (png_charp)png_malloc_warn(png_ptr, length + 1);
	1885	if (key == NULL)
	1886	{
	1887	png_warning(png_ptr, "No memory to process text chunk.");
	1888	return;
	1889	}
	1890	slength = (png_size_t)length;
	1891	png_crc_read(png_ptr, (png_bytep)key, slength);
	1892
	1893	if (png_crc_finish(png_ptr, skip))
	1894	{
	1895	png_free(png_ptr, key);
	1896	return;
	1897	}
	1898
	1899	key[slength] = 0x00;
	1900
	1901	for (text = key; *text; text++)
	1902	/* empty loop to find end of key */ ;
	1903
	1904	if (text != key + slength)
	1905	text++;
	1906
	1907	text_ptr = (png_textp)png_malloc_warn(png_ptr,
	1908	(png_uint_32)png_sizeof(png_text));
	1909	if (text_ptr == NULL)
	1910	{
	1911	png_warning(png_ptr, "Not enough memory to process text chunk.");
	1912	png_free(png_ptr, key);
	1913	return;
	1914	}
	1915	text_ptr->compression = PNG_TEXT_COMPRESSION_NONE;
	1916	text_ptr->key = key;
	1917	#ifdef PNG_iTXt_SUPPORTED
	1918	text_ptr->lang = NULL;
	1919	text_ptr->lang_key = NULL;
	1920	text_ptr->itxt_length = 0;
	1921	#endif
	1922	text_ptr->text = text;
	1923	text_ptr->text_length = png_strlen(text);
	1924
	1925	ret=png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
	1926
	1927	png_free(png_ptr, key);
	1928	png_free(png_ptr, text_ptr);
	1929	if (ret)
	1930	png_warning(png_ptr, "Insufficient memory to process text chunk.");
	1931	}
	1932	#endif
	1933
	1934	#if defined(PNG_READ_zTXt_SUPPORTED)
	1935	/* note: this does not correctly handle chunks that are > 64K under DOS */
	1936	void /* PRIVATE */
	1937	png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	1938	{
	1939	png_textp text_ptr;
	1940	png_charp chunkdata;
	1941	png_charp text;
	1942	int comp_type;
	1943	int ret;
	1944	png_size_t slength, prefix_len, data_len;
	1945
	1946	png_debug(1, "in png_handle_zTXt\n");
	1947	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	1948	png_error(png_ptr, "Missing IHDR before zTXt");
	1949
	1950	if (png_ptr->mode & PNG_HAVE_IDAT)
	1951	png_ptr->mode \|= PNG_AFTER_IDAT;
	1952
	1953	#ifdef PNG_MAX_MALLOC_64K
	1954	/* We will no doubt have problems with chunks even half this size, but
	1955	there is no hard and fast rule to tell us where to stop. */
	1956	if (length > (png_uint_32)65535L)
	1957	{
	1958	png_warning(png_ptr,"zTXt chunk too large to fit in memory");
	1959	png_crc_finish(png_ptr, length);
	1960	return;
	1961	}
	1962	#endif
	1963
	1964	chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
	1965	if (chunkdata == NULL)
	1966	{
	1967	png_warning(png_ptr,"Out of memory processing zTXt chunk.");
	1968	return;
	1969	}
	1970	slength = (png_size_t)length;
	1971	png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
	1972	if (png_crc_finish(png_ptr, 0))
	1973	{
	1974	png_free(png_ptr, chunkdata);
	1975	return;
	1976	}
	1977
	1978	chunkdata[slength] = 0x00;
	1979
	1980	for (text = chunkdata; *text; text++)
	1981	/* empty loop */ ;
	1982
	1983	/* zTXt must have some text after the chunkdataword */
	1984	if (text == chunkdata + slength)
	1985	{
	1986	comp_type = PNG_TEXT_COMPRESSION_NONE;
	1987	png_warning(png_ptr, "Zero length zTXt chunk");
	1988	}
	1989	else
	1990	{
	1991	comp_type = *(++text);
	1992	if (comp_type != PNG_TEXT_COMPRESSION_zTXt)
	1993	{
	1994	png_warning(png_ptr, "Unknown compression type in zTXt chunk");
	1995	comp_type = PNG_TEXT_COMPRESSION_zTXt;
	1996	}
	1997	text++; /* skip the compression_method byte */
	1998	}
	1999	prefix_len = text - chunkdata;
	2000
	2001	chunkdata = (png_charp)png_decompress_chunk(png_ptr, comp_type, chunkdata,
	2002	(png_size_t)length, prefix_len, &data_len);
	2003
	2004	text_ptr = (png_textp)png_malloc_warn(png_ptr,
	2005	(png_uint_32)png_sizeof(png_text));
	2006	if (text_ptr == NULL)
	2007	{
	2008	png_warning(png_ptr,"Not enough memory to process zTXt chunk.");
	2009	png_free(png_ptr, chunkdata);
	2010	return;
	2011	}
	2012	text_ptr->compression = comp_type;
	2013	text_ptr->key = chunkdata;
	2014	#ifdef PNG_iTXt_SUPPORTED
	2015	text_ptr->lang = NULL;
	2016	text_ptr->lang_key = NULL;
	2017	text_ptr->itxt_length = 0;
	2018	#endif
	2019	text_ptr->text = chunkdata + prefix_len;
	2020	text_ptr->text_length = data_len;
	2021
	2022	ret=png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
	2023
	2024	png_free(png_ptr, text_ptr);
	2025	png_free(png_ptr, chunkdata);
	2026	if (ret)
	2027	png_error(png_ptr, "Insufficient memory to store zTXt chunk.");
	2028	}
	2029	#endif
	2030
	2031	#if defined(PNG_READ_iTXt_SUPPORTED)
	2032	/* note: this does not correctly handle chunks that are > 64K under DOS */
	2033	void /* PRIVATE */
	2034	png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	2035	{
	2036	png_textp text_ptr;
	2037	png_charp chunkdata;
	2038	png_charp key, lang, text, lang_key;
	2039	int comp_flag;
	2040	int comp_type = 0;
	2041	int ret;
	2042	png_size_t slength, prefix_len, data_len;
	2043
	2044	png_debug(1, "in png_handle_iTXt\n");
	2045
	2046	if (!(png_ptr->mode & PNG_HAVE_IHDR))
	2047	png_error(png_ptr, "Missing IHDR before iTXt");
	2048
	2049	if (png_ptr->mode & PNG_HAVE_IDAT)
	2050	png_ptr->mode \|= PNG_AFTER_IDAT;
	2051
	2052	#ifdef PNG_MAX_MALLOC_64K
	2053	/* We will no doubt have problems with chunks even half this size, but
	2054	there is no hard and fast rule to tell us where to stop. */
	2055	if (length > (png_uint_32)65535L)
	2056	{
	2057	png_warning(png_ptr,"iTXt chunk too large to fit in memory");
	2058	png_crc_finish(png_ptr, length);
	2059	return;
	2060	}
	2061	#endif
	2062
	2063	chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
	2064	if (chunkdata == NULL)
	2065	{
	2066	png_warning(png_ptr, "No memory to process iTXt chunk.");
	2067	return;
	2068	}
	2069	slength = (png_size_t)length;
	2070	png_crc_read(png_ptr, (png_bytep)chunkdata, slength);
	2071	if (png_crc_finish(png_ptr, 0))
	2072	{
	2073	png_free(png_ptr, chunkdata);
	2074	return;
	2075	}
	2076
	2077	chunkdata[slength] = 0x00;
	2078
	2079	for (lang = chunkdata; *lang; lang++)
	2080	/* empty loop */ ;
	2081	lang++; /* skip NUL separator */
	2082
	2083	/* iTXt must have a language tag (possibly empty), two compression bytes,
	2084	translated keyword (possibly empty), and possibly some text after the
	2085	keyword */
	2086
	2087	if (lang >= chunkdata + slength)
	2088	{
	2089	comp_flag = PNG_TEXT_COMPRESSION_NONE;
	2090	png_warning(png_ptr, "Zero length iTXt chunk");
	2091	}
	2092	else
	2093	{
	2094	comp_flag = *lang++;
	2095	comp_type = *lang++;
	2096	}
	2097
	2098	for (lang_key = lang; *lang_key; lang_key++)
	2099	/* empty loop */ ;
	2100	lang_key++; /* skip NUL separator */
	2101
	2102	for (text = lang_key; *text; text++)
	2103	/* empty loop */ ;
	2104	text++; /* skip NUL separator */
	2105
	2106	prefix_len = text - chunkdata;
	2107
	2108	key=chunkdata;
	2109	if (comp_flag)
	2110	chunkdata = png_decompress_chunk(png_ptr, comp_type, chunkdata,
	2111	(size_t)length, prefix_len, &data_len);
	2112	else
	2113	data_len=png_strlen(chunkdata + prefix_len);
	2114	text_ptr = (png_textp)png_malloc_warn(png_ptr,
	2115	(png_uint_32)png_sizeof(png_text));
	2116	if (text_ptr == NULL)
	2117	{
	2118	png_warning(png_ptr,"Not enough memory to process iTXt chunk.");
	2119	png_free(png_ptr, chunkdata);
	2120	return;
	2121	}
	2122	text_ptr->compression = (int)comp_flag + 1;
	2123	text_ptr->lang_key = chunkdata+(lang_key-key);
	2124	text_ptr->lang = chunkdata+(lang-key);
	2125	text_ptr->itxt_length = data_len;
	2126	text_ptr->text_length = 0;
	2127	text_ptr->key = chunkdata;
	2128	text_ptr->text = chunkdata + prefix_len;
	2129
	2130	ret=png_set_text_2(png_ptr, info_ptr, text_ptr, 1);
	2131
	2132	png_free(png_ptr, text_ptr);
	2133	png_free(png_ptr, chunkdata);
	2134	if (ret)
	2135	png_error(png_ptr, "Insufficient memory to store iTXt chunk.");
	2136	}
	2137	#endif
	2138
	2139	/* This function is called when we haven't found a handler for a
	2140	chunk. If there isn't a problem with the chunk itself (ie bad
	2141	chunk name, CRC, or a critical chunk), the chunk is silently ignored
	2142	-- unless the PNG_FLAG_UNKNOWN_CHUNKS_SUPPORTED flag is on in which
	2143	case it will be saved away to be written out later. */
	2144	void /* PRIVATE */
	2145	png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
	2146	{
	2147	png_uint_32 skip = 0;
	2148
	2149	png_debug(1, "in png_handle_unknown\n");
	2150
	2151	if (png_ptr->mode & PNG_HAVE_IDAT)
	2152	{
	2153	#ifdef PNG_USE_LOCAL_ARRAYS
	2154	PNG_IDAT;
	2155	#endif
	2156	if (png_memcmp(png_ptr->chunk_name, png_IDAT, 4)) /* not an IDAT */
	2157	png_ptr->mode \|= PNG_AFTER_IDAT;
	2158	}
	2159
	2160	png_check_chunk_name(png_ptr, png_ptr->chunk_name);
	2161
	2162	if (!(png_ptr->chunk_name[0] & 0x20))
	2163	{
	2164	#if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
	2165	if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
	2166	PNG_HANDLE_CHUNK_ALWAYS
	2167	#if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
	2168	&& png_ptr->read_user_chunk_fn == NULL
	2169	#endif
	2170	)
	2171	#endif
	2172	png_chunk_error(png_ptr, "unknown critical chunk");
	2173	}
	2174
	2175	#if defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED)
	2176	if ((png_ptr->flags & PNG_FLAG_KEEP_UNKNOWN_CHUNKS) \|\|
	2177	(png_ptr->read_user_chunk_fn != NULL))
	2178	{
	2179	#ifdef PNG_MAX_MALLOC_64K
	2180	if (length > (png_uint_32)65535L)
	2181	{
	2182	png_warning(png_ptr, "unknown chunk too large to fit in memory");
	2183	skip = length - (png_uint_32)65535L;
	2184	length = (png_uint_32)65535L;
	2185	}
	2186	#endif
	2187	png_strcpy((png_charp)png_ptr->unknown_chunk.name,
	2188	(png_charp)png_ptr->chunk_name);
	2189	png_ptr->unknown_chunk.data = (png_bytep)png_malloc(png_ptr, length);
	2190	png_ptr->unknown_chunk.size = (png_size_t)length;
	2191	png_crc_read(png_ptr, (png_bytep)png_ptr->unknown_chunk.data, length);
	2192	#if defined(PNG_READ_USER_CHUNKS_SUPPORTED)
	2193	if(png_ptr->read_user_chunk_fn != NULL)
	2194	{
	2195	/* callback to user unknown chunk handler */
	2196	int ret;
	2197	ret = (*(png_ptr->read_user_chunk_fn))
	2198	(png_ptr, &png_ptr->unknown_chunk);
	2199	if (ret < 0)
	2200	png_chunk_error(png_ptr, "error in user chunk");
	2201	if (ret == 0)
	2202	{
	2203	if (!(png_ptr->chunk_name[0] & 0x20))
	2204	if(png_handle_as_unknown(png_ptr, png_ptr->chunk_name) !=
	2205	PNG_HANDLE_CHUNK_ALWAYS)
	2206	png_chunk_error(png_ptr, "unknown critical chunk");
	2207	png_set_unknown_chunks(png_ptr, info_ptr,
	2208	&png_ptr->unknown_chunk, 1);
	2209	}
	2210	}
	2211	#else
	2212	png_set_unknown_chunks(png_ptr, info_ptr, &png_ptr->unknown_chunk, 1);
	2213	#endif
	2214	png_free(png_ptr, png_ptr->unknown_chunk.data);
	2215	png_ptr->unknown_chunk.data = NULL;
	2216	}
	2217	else
	2218	#endif
	2219	skip = length;
	2220
	2221	png_crc_finish(png_ptr, skip);
	2222
	2223	#if !defined(PNG_READ_USER_CHUNKS_SUPPORTED)
	2224	if (&info_ptr == NULL) /* quiet compiler warnings about unused info_ptr */
	2225	return;
	2226	#endif
	2227	}
	2228
	2229	/* This function is called to verify that a chunk name is valid.
	2230	This function can't have the "critical chunk check" incorporated
	2231	into it, since in the future we will need to be able to call user
	2232	functions to handle unknown critical chunks after we check that
	2233	the chunk name itself is valid. */
	2234
	2235	#define isnonalpha(c) ((c) < 65 \|\| (c) > 122 \|\| ((c) > 90 && (c) < 97))
	2236
	2237	void /* PRIVATE */
	2238	png_check_chunk_name(png_structp png_ptr, png_bytep chunk_name)
	2239	{
	2240	png_debug(1, "in png_check_chunk_name\n");
	2241	if (isnonalpha(chunk_name[0]) \|\| isnonalpha(chunk_name[1]) \|\|
	2242	isnonalpha(chunk_name[2]) \|\| isnonalpha(chunk_name[3]))
	2243	{
	2244	png_chunk_error(png_ptr, "invalid chunk type");
	2245	}
	2246	}
	2247
	2248	/* Combines the row recently read in with the existing pixels in the
	2249	row. This routine takes care of alpha and transparency if requested.
	2250	This routine also handles the two methods of progressive display
	2251	of interlaced images, depending on the mask value.
	2252	The mask value describes which pixels are to be combined with
	2253	the row. The pattern always repeats every 8 pixels, so just 8
	2254	bits are needed. A one indicates the pixel is to be combined,
	2255	a zero indicates the pixel is to be skipped. This is in addition
	2256	to any alpha or transparency value associated with the pixel. If
	2257	you want all pixels to be combined, pass 0xff (255) in mask. */
	2258	#ifndef PNG_HAVE_MMX_COMBINE_ROW
	2259	void /* PRIVATE */
	2260	png_combine_row(png_structp png_ptr, png_bytep row, int mask)
	2261	{
	2262	png_debug(1,"in png_combine_row\n");
	2263	if (mask == 0xff)
	2264	{
	2265	png_memcpy(row, png_ptr->row_buf + 1,
	2266	PNG_ROWBYTES(png_ptr->row_info.pixel_depth, png_ptr->width));
	2267	}
	2268	else
	2269	{
	2270	switch (png_ptr->row_info.pixel_depth)
	2271	{
	2272	case 1:
	2273	{
	2274	png_bytep sp = png_ptr->row_buf + 1;
	2275	png_bytep dp = row;
	2276	int s_inc, s_start, s_end;
	2277	int m = 0x80;
	2278	int shift;
	2279	png_uint_32 i;
	2280	png_uint_32 row_width = png_ptr->width;
	2281
	2282	#if defined(PNG_READ_PACKSWAP_SUPPORTED)
	2283	if (png_ptr->transformations & PNG_PACKSWAP)
	2284	{
	2285	s_start = 0;
	2286	s_end = 7;
	2287	s_inc = 1;
	2288	}
	2289	else
	2290	#endif
	2291	{
	2292	s_start = 7;
	2293	s_end = 0;
	2294	s_inc = -1;
	2295	}
	2296
	2297	shift = s_start;
	2298
	2299	for (i = 0; i < row_width; i++)
	2300	{
	2301	if (m & mask)
	2302	{
	2303	int value;
	2304
	2305	value = (*sp >> shift) & 0x01;
	2306	*dp &= (png_byte)((0x7f7f >> (7 - shift)) & 0xff);
	2307	*dp \|= (png_byte)(value << shift);
	2308	}
	2309
	2310	if (shift == s_end)
	2311	{
	2312	shift = s_start;
	2313	sp++;
	2314	dp++;
	2315	}
	2316	else
	2317	shift += s_inc;
	2318
	2319	if (m == 1)
	2320	m = 0x80;
	2321	else
	2322	m >>= 1;
	2323	}
	2324	break;
	2325	}
	2326	case 2:
	2327	{
	2328	png_bytep sp = png_ptr->row_buf + 1;
	2329	png_bytep dp = row;
	2330	int s_start, s_end, s_inc;
	2331	int m = 0x80;
	2332	int shift;
	2333	png_uint_32 i;
	2334	png_uint_32 row_width = png_ptr->width;
	2335	int value;
	2336
	2337	#if defined(PNG_READ_PACKSWAP_SUPPORTED)
	2338	if (png_ptr->transformations & PNG_PACKSWAP)
	2339	{
	2340	s_start = 0;
	2341	s_end = 6;
	2342	s_inc = 2;
	2343	}
	2344	else
	2345	#endif
	2346	{
	2347	s_start = 6;
	2348	s_end = 0;
	2349	s_inc = -2;
	2350	}
	2351
	2352	shift = s_start;
	2353
	2354	for (i = 0; i < row_width; i++)
	2355	{
	2356	if (m & mask)
	2357	{
	2358	value = (*sp >> shift) & 0x03;
	2359	*dp &= (png_byte)((0x3f3f >> (6 - shift)) & 0xff);
	2360	*dp \|= (png_byte)(value << shift);
	2361	}
	2362
	2363	if (shift == s_end)
	2364	{
	2365	shift = s_start;
	2366	sp++;
	2367	dp++;
	2368	}
	2369	else
	2370	shift += s_inc;
	2371	if (m == 1)
	2372	m = 0x80;
	2373	else
	2374	m >>= 1;
	2375	}
	2376	break;
	2377	}
	2378	case 4:
	2379	{
	2380	png_bytep sp = png_ptr->row_buf + 1;
	2381	png_bytep dp = row;
	2382	int s_start, s_end, s_inc;
	2383	int m = 0x80;
	2384	int shift;
	2385	png_uint_32 i;
	2386	png_uint_32 row_width = png_ptr->width;
	2387	int value;
	2388
	2389	#if defined(PNG_READ_PACKSWAP_SUPPORTED)
	2390	if (png_ptr->transformations & PNG_PACKSWAP)
	2391	{
	2392	s_start = 0;
	2393	s_end = 4;
	2394	s_inc = 4;
	2395	}
	2396	else
	2397	#endif
	2398	{
	2399	s_start = 4;
	2400	s_end = 0;
	2401	s_inc = -4;
	2402	}
	2403	shift = s_start;
	2404
	2405	for (i = 0; i < row_width; i++)
	2406	{
	2407	if (m & mask)
	2408	{
	2409	value = (*sp >> shift) & 0xf;
	2410	*dp &= (png_byte)((0xf0f >> (4 - shift)) & 0xff);
	2411	*dp \|= (png_byte)(value << shift);
	2412	}
	2413
	2414	if (shift == s_end)
	2415	{
	2416	shift = s_start;
	2417	sp++;
	2418	dp++;
	2419	}
	2420	else
	2421	shift += s_inc;
	2422	if (m == 1)
	2423	m = 0x80;
	2424	else
	2425	m >>= 1;
	2426	}
	2427	break;
	2428	}
	2429	default:
	2430	{
	2431	png_bytep sp = png_ptr->row_buf + 1;
	2432	png_bytep dp = row;
	2433	png_size_t pixel_bytes = (png_ptr->row_info.pixel_depth >> 3);
	2434	png_uint_32 i;
	2435	png_uint_32 row_width = png_ptr->width;
	2436	png_byte m = 0x80;
	2437
	2438
	2439	for (i = 0; i < row_width; i++)
	2440	{
	2441	if (m & mask)
	2442	{
	2443	png_memcpy(dp, sp, pixel_bytes);
	2444	}
	2445
	2446	sp += pixel_bytes;
	2447	dp += pixel_bytes;
	2448
	2449	if (m == 1)
	2450	m = 0x80;
	2451	else
	2452	m >>= 1;
	2453	}
	2454	break;
	2455	}
	2456	}
	2457	}
	2458	}
	2459	#endif /* !PNG_HAVE_MMX_COMBINE_ROW */
	2460
	2461	#ifdef PNG_READ_INTERLACING_SUPPORTED
	2462	#ifndef PNG_HAVE_MMX_READ_INTERLACE /* else in pngvcrd.c, pnggccrd.c */
	2463	/* OLD pre-1.0.9 interface:
	2464	void png_do_read_interlace(png_row_infop row_info, png_bytep row, int pass,
	2465	png_uint_32 transformations)
	2466	*/
	2467	void /* PRIVATE */
	2468	png_do_read_interlace(png_structp png_ptr)
	2469	{
	2470	png_row_infop row_info = &(png_ptr->row_info);
	2471	png_bytep row = png_ptr->row_buf + 1;
	2472	int pass = png_ptr->pass;
	2473	png_uint_32 transformations = png_ptr->transformations;
	2474	#ifdef PNG_USE_LOCAL_ARRAYS
	2475	/* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
	2476	/* offset to next interlace block */
	2477	const int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
	2478	#endif
	2479
	2480	png_debug(1,"in png_do_read_interlace (stock C version)\n");
	2481	if (row != NULL && row_info != NULL)
	2482	{
	2483	png_uint_32 final_width;
	2484
	2485	final_width = row_info->width * png_pass_inc[pass];
	2486
	2487	switch (row_info->pixel_depth)
	2488	{
	2489	case 1:
	2490	{
	2491	png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 3);
	2492	png_bytep dp = row + (png_size_t)((final_width - 1) >> 3);
	2493	int sshift, dshift;
	2494	int s_start, s_end, s_inc;
	2495	int jstop = png_pass_inc[pass];
	2496	png_byte v;
	2497	png_uint_32 i;
	2498	int j;
	2499
	2500	#if defined(PNG_READ_PACKSWAP_SUPPORTED)
	2501	if (transformations & PNG_PACKSWAP)
	2502	{
	2503	sshift = (int)((row_info->width + 7) & 0x07);
	2504	dshift = (int)((final_width + 7) & 0x07);
	2505	s_start = 7;
	2506	s_end = 0;
	2507	s_inc = -1;
	2508	}
	2509	else
	2510	#endif
	2511	{
	2512	sshift = 7 - (int)((row_info->width + 7) & 0x07);
	2513	dshift = 7 - (int)((final_width + 7) & 0x07);
	2514	s_start = 0;
	2515	s_end = 7;
	2516	s_inc = 1;
	2517	}
	2518
	2519	for (i = 0; i < row_info->width; i++)
	2520	{
	2521	v = (png_byte)((*sp >> sshift) & 0x01);
	2522	for (j = 0; j < jstop; j++)
	2523	{
	2524	*dp &= (png_byte)((0x7f7f >> (7 - dshift)) & 0xff);
	2525	*dp \|= (png_byte)(v << dshift);
	2526	if (dshift == s_end)
	2527	{
	2528	dshift = s_start;
	2529	dp--;
	2530	}
	2531	else
	2532	dshift += s_inc;
	2533	}
	2534	if (sshift == s_end)
	2535	{
	2536	sshift = s_start;
	2537	sp--;
	2538	}
	2539	else
	2540	sshift += s_inc;
	2541	}
	2542	break;
	2543	}
	2544	case 2:
	2545	{
	2546	png_bytep sp = row + (png_uint_32)((row_info->width - 1) >> 2);
	2547	png_bytep dp = row + (png_uint_32)((final_width - 1) >> 2);
	2548	int sshift, dshift;
	2549	int s_start, s_end, s_inc;
	2550	int jstop = png_pass_inc[pass];
	2551	png_uint_32 i;
	2552
	2553	#if defined(PNG_READ_PACKSWAP_SUPPORTED)
	2554	if (transformations & PNG_PACKSWAP)
	2555	{
	2556	sshift = (int)(((row_info->width + 3) & 0x03) << 1);
	2557	dshift = (int)(((final_width + 3) & 0x03) << 1);
	2558	s_start = 6;
	2559	s_end = 0;
	2560	s_inc = -2;
	2561	}
	2562	else
	2563	#endif
	2564	{
	2565	sshift = (int)((3 - ((row_info->width + 3) & 0x03)) << 1);
	2566	dshift = (int)((3 - ((final_width + 3) & 0x03)) << 1);
	2567	s_start = 0;
	2568	s_end = 6;
	2569	s_inc = 2;
	2570	}
	2571
	2572	for (i = 0; i < row_info->width; i++)
	2573	{
	2574	png_byte v;
	2575	int j;
	2576
	2577	v = (png_byte)((*sp >> sshift) & 0x03);
	2578	for (j = 0; j < jstop; j++)
	2579	{
	2580	*dp &= (png_byte)((0x3f3f >> (6 - dshift)) & 0xff);
	2581	*dp \|= (png_byte)(v << dshift);
	2582	if (dshift == s_end)
	2583	{
	2584	dshift = s_start;
	2585	dp--;
	2586	}
	2587	else
	2588	dshift += s_inc;
	2589	}
	2590	if (sshift == s_end)
	2591	{
	2592	sshift = s_start;
	2593	sp--;
	2594	}
	2595	else
	2596	sshift += s_inc;
	2597	}
	2598	break;
	2599	}
	2600	case 4:
	2601	{
	2602	png_bytep sp = row + (png_size_t)((row_info->width - 1) >> 1);
	2603	png_bytep dp = row + (png_size_t)((final_width - 1) >> 1);
	2604	int sshift, dshift;
	2605	int s_start, s_end, s_inc;
	2606	png_uint_32 i;
	2607	int jstop = png_pass_inc[pass];
	2608
	2609	#if defined(PNG_READ_PACKSWAP_SUPPORTED)
	2610	if (transformations & PNG_PACKSWAP)
	2611	{
	2612	sshift = (int)(((row_info->width + 1) & 0x01) << 2);
	2613	dshift = (int)(((final_width + 1) & 0x01) << 2);
	2614	s_start = 4;
	2615	s_end = 0;
	2616	s_inc = -4;
	2617	}
	2618	else
	2619	#endif
	2620	{
	2621	sshift = (int)((1 - ((row_info->width + 1) & 0x01)) << 2);
	2622	dshift = (int)((1 - ((final_width + 1) & 0x01)) << 2);
	2623	s_start = 0;
	2624	s_end = 4;
	2625	s_inc = 4;
	2626	}
	2627
	2628	for (i = 0; i < row_info->width; i++)
	2629	{
	2630	png_byte v = (png_byte)((*sp >> sshift) & 0xf);
	2631	int j;
	2632
	2633	for (j = 0; j < jstop; j++)
	2634	{
	2635	*dp &= (png_byte)((0xf0f >> (4 - dshift)) & 0xff);
	2636	*dp \|= (png_byte)(v << dshift);
	2637	if (dshift == s_end)
	2638	{
	2639	dshift = s_start;
	2640	dp--;
	2641	}
	2642	else
	2643	dshift += s_inc;
	2644	}
	2645	if (sshift == s_end)
	2646	{
	2647	sshift = s_start;
	2648	sp--;
	2649	}
	2650	else
	2651	sshift += s_inc;
	2652	}
	2653	break;
	2654	}
	2655	default:
	2656	{
	2657	png_size_t pixel_bytes = (row_info->pixel_depth >> 3);
	2658	png_bytep sp = row + (png_size_t)(row_info->width - 1) * pixel_bytes;
	2659	png_bytep dp = row + (png_size_t)(final_width - 1) * pixel_bytes;
	2660
	2661	int jstop = png_pass_inc[pass];
	2662	png_uint_32 i;
	2663
	2664	for (i = 0; i < row_info->width; i++)
	2665	{
	2666	png_byte v[8];
	2667	int j;
	2668
	2669	png_memcpy(v, sp, pixel_bytes);
	2670	for (j = 0; j < jstop; j++)
	2671	{
	2672	png_memcpy(dp, v, pixel_bytes);
	2673	dp -= pixel_bytes;
	2674	}
	2675	sp -= pixel_bytes;
	2676	}
	2677	break;
	2678	}
	2679	}
	2680	row_info->width = final_width;
	2681	row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth,final_width);
	2682	}
	2683	#if !defined(PNG_READ_PACKSWAP_SUPPORTED)
	2684	if (&transformations == NULL) /* silence compiler warning */
	2685	return;
	2686	#endif
	2687	}
	2688	#endif /* !PNG_HAVE_MMX_READ_INTERLACE */
	2689	#endif /* PNG_READ_INTERLACING_SUPPORTED */
	2690
	2691	#ifndef PNG_HAVE_MMX_READ_FILTER_ROW
	2692	void /* PRIVATE */
	2693	png_read_filter_row(png_structp png_ptr, png_row_infop row_info, png_bytep row,
	2694	png_bytep prev_row, int filter)
	2695	{
	2696	png_debug(1, "in png_read_filter_row\n");
	2697	png_debug2(2,"row = %lu, filter = %d\n", png_ptr->row_number, filter);
	2698	switch (filter)
	2699	{
	2700	case PNG_FILTER_VALUE_NONE:
	2701	break;
	2702	case PNG_FILTER_VALUE_SUB:
	2703	{
	2704	png_uint_32 i;
	2705	png_uint_32 istop = row_info->rowbytes;
	2706	png_uint_32 bpp = (row_info->pixel_depth + 7) >> 3;
	2707	png_bytep rp = row + bpp;
	2708	png_bytep lp = row;
	2709
	2710	for (i = bpp; i < istop; i++)
	2711	{
	2712	rp = (png_byte)(((int)(rp) + (int)(*lp++)) & 0xff);
	2713	rp++;
	2714	}
	2715	break;
	2716	}
	2717	case PNG_FILTER_VALUE_UP:
	2718	{
	2719	png_uint_32 i;
	2720	png_uint_32 istop = row_info->rowbytes;
	2721	png_bytep rp = row;
	2722	png_bytep pp = prev_row;
	2723
	2724	for (i = 0; i < istop; i++)
	2725	{
	2726	rp = (png_byte)(((int)(rp) + (int)(*pp++)) & 0xff);
	2727	rp++;
	2728	}
	2729	break;
	2730	}
	2731	case PNG_FILTER_VALUE_AVG:
	2732	{
	2733	png_uint_32 i;
	2734	png_bytep rp = row;
	2735	png_bytep pp = prev_row;
	2736	png_bytep lp = row;
	2737	png_uint_32 bpp = (row_info->pixel_depth + 7) >> 3;
	2738	png_uint_32 istop = row_info->rowbytes - bpp;
	2739
	2740	for (i = 0; i < bpp; i++)
	2741	{
	2742	rp = (png_byte)(((int)(rp) +
	2743	((int)(*pp++) / 2 )) & 0xff);
	2744	rp++;
	2745	}
	2746
	2747	for (i = 0; i < istop; i++)
	2748	{
	2749	rp = (png_byte)(((int)(rp) +
	2750	(int)(pp++ + lp++) / 2 ) & 0xff);
	2751	rp++;
	2752	}
	2753	break;
	2754	}
	2755	case PNG_FILTER_VALUE_PAETH:
	2756	{
	2757	png_uint_32 i;
	2758	png_bytep rp = row;
	2759	png_bytep pp = prev_row;
	2760	png_bytep lp = row;
	2761	png_bytep cp = prev_row;
	2762	png_uint_32 bpp = (row_info->pixel_depth + 7) >> 3;
	2763	png_uint_32 istop=row_info->rowbytes - bpp;
	2764
	2765	for (i = 0; i < bpp; i++)
	2766	{
	2767	rp = (png_byte)(((int)(rp) + (int)(*pp++)) & 0xff);
	2768	rp++;
	2769	}
	2770
	2771	for (i = 0; i < istop; i++) /* use leftover rp,pp */
	2772	{
	2773	int a, b, c, pa, pb, pc, p;
	2774
	2775	a = *lp++;
	2776	b = *pp++;
	2777	c = *cp++;
	2778
	2779	p = b - c;
	2780	pc = a - c;
	2781
	2782	#ifdef PNG_USE_ABS
	2783	pa = abs(p);
	2784	pb = abs(pc);
	2785	pc = abs(p + pc);
	2786	#else
	2787	pa = p < 0 ? -p : p;
	2788	pb = pc < 0 ? -pc : pc;
	2789	pc = (p + pc) < 0 ? -(p + pc) : p + pc;
	2790	#endif
	2791
	2792	/*
	2793	if (pa <= pb && pa <= pc)
	2794	p = a;
	2795	else if (pb <= pc)
	2796	p = b;
	2797	else
	2798	p = c;
	2799	*/
	2800
	2801	p = (pa <= pb && pa <=pc) ? a : (pb <= pc) ? b : c;
	2802
	2803	rp = (png_byte)(((int)(rp) + p) & 0xff);
	2804	rp++;
	2805	}
	2806	break;
	2807	}
	2808	default:
	2809	png_warning(png_ptr, "Ignoring bad adaptive filter type");
	2810	*row=0;
	2811	break;
	2812	}
	2813	}
	2814	#endif /* !PNG_HAVE_MMX_READ_FILTER_ROW */
	2815
	2816	void /* PRIVATE */
	2817	png_read_finish_row(png_structp png_ptr)
	2818	{
	2819	#ifdef PNG_USE_LOCAL_ARRAYS
	2820	/* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
	2821
	2822	/* start of interlace block */
	2823	const int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
	2824
	2825	/* offset to next interlace block */
	2826	const int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
	2827
	2828	/* start of interlace block in the y direction */
	2829	const int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
	2830
	2831	/* offset to next interlace block in the y direction */
	2832	const int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
	2833	#endif
	2834
	2835	png_debug(1, "in png_read_finish_row\n");
	2836	png_ptr->row_number++;
	2837	if (png_ptr->row_number < png_ptr->num_rows)
	2838	return;
	2839
	2840	if (png_ptr->interlaced)
	2841	{
	2842	png_ptr->row_number = 0;
	2843	png_memset_check(png_ptr, png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
	2844	do
	2845	{
	2846	png_ptr->pass++;
	2847	if (png_ptr->pass >= 7)
	2848	break;
	2849	png_ptr->iwidth = (png_ptr->width +
	2850	png_pass_inc[png_ptr->pass] - 1 -
	2851	png_pass_start[png_ptr->pass]) /
	2852	png_pass_inc[png_ptr->pass];
	2853
	2854	png_ptr->irowbytes = PNG_ROWBYTES(png_ptr->pixel_depth,
	2855	png_ptr->iwidth) + 1;
	2856
	2857	if (!(png_ptr->transformations & PNG_INTERLACE))
	2858	{
	2859	png_ptr->num_rows = (png_ptr->height +
	2860	png_pass_yinc[png_ptr->pass] - 1 -
	2861	png_pass_ystart[png_ptr->pass]) /
	2862	png_pass_yinc[png_ptr->pass];
	2863	if (!(png_ptr->num_rows))
	2864	continue;
	2865	}
	2866	else /* if (png_ptr->transformations & PNG_INTERLACE) */
	2867	break;
	2868	} while (png_ptr->iwidth == 0);
	2869
	2870	if (png_ptr->pass < 7)
	2871	return;
	2872	}
	2873
	2874	if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
	2875	{
	2876	#ifdef PNG_USE_LOCAL_ARRAYS
	2877	PNG_IDAT;
	2878	#endif
	2879	char extra;
	2880	int ret;
	2881
	2882	png_ptr->zstream.next_out = (Byte *)&extra;
	2883	png_ptr->zstream.avail_out = (uInt)1;
	2884	for(;;)
	2885	{
	2886	if (!(png_ptr->zstream.avail_in))
	2887	{
	2888	while (!png_ptr->idat_size)
	2889	{
	2890	png_byte chunk_length[4];
	2891
	2892	png_crc_finish(png_ptr, 0);
	2893
	2894	png_read_data(png_ptr, chunk_length, 4);
	2895	png_ptr->idat_size = png_get_uint_31(png_ptr, chunk_length);
	2896	png_reset_crc(png_ptr);
	2897	png_crc_read(png_ptr, png_ptr->chunk_name, 4);
	2898	if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))
	2899	png_error(png_ptr, "Not enough image data");
	2900
	2901	}
	2902	png_ptr->zstream.avail_in = (uInt)png_ptr->zbuf_size;
	2903	png_ptr->zstream.next_in = png_ptr->zbuf;
	2904	if (png_ptr->zbuf_size > png_ptr->idat_size)
	2905	png_ptr->zstream.avail_in = (uInt)png_ptr->idat_size;
	2906	png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zstream.avail_in);
	2907	png_ptr->idat_size -= png_ptr->zstream.avail_in;
	2908	}
	2909	ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
	2910	if (ret == Z_STREAM_END)
	2911	{
	2912	if (!(png_ptr->zstream.avail_out) \|\| png_ptr->zstream.avail_in \|\|
	2913	png_ptr->idat_size)
	2914	png_warning(png_ptr, "Extra compressed data");
	2915	png_ptr->mode \|= PNG_AFTER_IDAT;
	2916	png_ptr->flags \|= PNG_FLAG_ZLIB_FINISHED;
	2917	break;
	2918	}
	2919	if (ret != Z_OK)
	2920	png_error(png_ptr, png_ptr->zstream.msg ? png_ptr->zstream.msg :
	2921	"Decompression Error");
	2922
	2923	if (!(png_ptr->zstream.avail_out))
	2924	{
	2925	png_warning(png_ptr, "Extra compressed data.");
	2926	png_ptr->mode \|= PNG_AFTER_IDAT;
	2927	png_ptr->flags \|= PNG_FLAG_ZLIB_FINISHED;
	2928	break;
	2929	}
	2930
	2931	}
	2932	png_ptr->zstream.avail_out = 0;
	2933	}
	2934
	2935	if (png_ptr->idat_size \|\| png_ptr->zstream.avail_in)
	2936	png_warning(png_ptr, "Extra compression data");
	2937
	2938	inflateReset(&png_ptr->zstream);
	2939
	2940	png_ptr->mode \|= PNG_AFTER_IDAT;
	2941	}
	2942
	2943	void /* PRIVATE */
	2944	png_read_start_row(png_structp png_ptr)
	2945	{
	2946	#ifdef PNG_USE_LOCAL_ARRAYS
	2947	/* arrays to facilitate easy interlacing - use pass (0 - 6) as index */
	2948
	2949	/* start of interlace block */
	2950	const int png_pass_start[7] = {0, 4, 0, 2, 0, 1, 0};
	2951
	2952	/* offset to next interlace block */
	2953	const int png_pass_inc[7] = {8, 8, 4, 4, 2, 2, 1};
	2954
	2955	/* start of interlace block in the y direction */
	2956	const int png_pass_ystart[7] = {0, 0, 4, 0, 2, 0, 1};
	2957
	2958	/* offset to next interlace block in the y direction */
	2959	const int png_pass_yinc[7] = {8, 8, 8, 4, 4, 2, 2};
	2960	#endif
	2961
	2962	int max_pixel_depth;
	2963	png_uint_32 row_bytes;
	2964
	2965	png_debug(1, "in png_read_start_row\n");
	2966	png_ptr->zstream.avail_in = 0;
	2967	png_init_read_transformations(png_ptr);
	2968	if (png_ptr->interlaced)
	2969	{
	2970	if (!(png_ptr->transformations & PNG_INTERLACE))
	2971	png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 -
	2972	png_pass_ystart[0]) / png_pass_yinc[0];
	2973	else
	2974	png_ptr->num_rows = png_ptr->height;
	2975
	2976	png_ptr->iwidth = (png_ptr->width +
	2977	png_pass_inc[png_ptr->pass] - 1 -
	2978	png_pass_start[png_ptr->pass]) /
	2979	png_pass_inc[png_ptr->pass];
	2980
	2981	row_bytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->iwidth) + 1;
	2982
	2983	png_ptr->irowbytes = (png_size_t)row_bytes;
	2984	if((png_uint_32)png_ptr->irowbytes != row_bytes)
	2985	png_error(png_ptr, "Rowbytes overflow in png_read_start_row");
	2986	}
	2987	else
	2988	{
	2989	png_ptr->num_rows = png_ptr->height;
	2990	png_ptr->iwidth = png_ptr->width;
	2991	png_ptr->irowbytes = png_ptr->rowbytes + 1;
	2992	}
	2993	max_pixel_depth = png_ptr->pixel_depth;
	2994
	2995	#if defined(PNG_READ_PACK_SUPPORTED)
	2996	if ((png_ptr->transformations & PNG_PACK) && png_ptr->bit_depth < 8)
	2997	max_pixel_depth = 8;
	2998	#endif
	2999
	3000	#if defined(PNG_READ_EXPAND_SUPPORTED)
	3001	if (png_ptr->transformations & PNG_EXPAND)
	3002	{
	3003	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
	3004	{
	3005	if (png_ptr->num_trans)
	3006	max_pixel_depth = 32;
	3007	else
	3008	max_pixel_depth = 24;
	3009	}
	3010	else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
	3011	{
	3012	if (max_pixel_depth < 8)
	3013	max_pixel_depth = 8;
	3014	if (png_ptr->num_trans)
	3015	max_pixel_depth *= 2;
	3016	}
	3017	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
	3018	{
	3019	if (png_ptr->num_trans)
	3020	{
	3021	max_pixel_depth *= 4;
	3022	max_pixel_depth /= 3;
	3023	}
	3024	}
	3025	}
	3026	#endif
	3027
	3028	#if defined(PNG_READ_FILLER_SUPPORTED)
	3029	if (png_ptr->transformations & (PNG_FILLER))
	3030	{
	3031	if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
	3032	max_pixel_depth = 32;
	3033	else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY)
	3034	{
	3035	if (max_pixel_depth <= 8)
	3036	max_pixel_depth = 16;
	3037	else
	3038	max_pixel_depth = 32;
	3039	}
	3040	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB)
	3041	{
	3042	if (max_pixel_depth <= 32)
	3043	max_pixel_depth = 32;
	3044	else
	3045	max_pixel_depth = 64;
	3046	}
	3047	}
	3048	#endif
	3049
	3050	#if defined(PNG_READ_GRAY_TO_RGB_SUPPORTED)
	3051	if (png_ptr->transformations & PNG_GRAY_TO_RGB)
	3052	{
	3053	if (
	3054	#if defined(PNG_READ_EXPAND_SUPPORTED)
	3055	(png_ptr->num_trans && (png_ptr->transformations & PNG_EXPAND)) \|\|
	3056	#endif
	3057	#if defined(PNG_READ_FILLER_SUPPORTED)
	3058	(png_ptr->transformations & (PNG_FILLER)) \|\|
	3059	#endif
	3060	png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
	3061	{
	3062	if (max_pixel_depth <= 16)
	3063	max_pixel_depth = 32;
	3064	else
	3065	max_pixel_depth = 64;
	3066	}
	3067	else
	3068	{
	3069	if (max_pixel_depth <= 8)
	3070	{
	3071	if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
	3072	max_pixel_depth = 32;
	3073	else
	3074	max_pixel_depth = 24;
	3075	}
	3076	else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
	3077	max_pixel_depth = 64;
	3078	else
	3079	max_pixel_depth = 48;
	3080	}
	3081	}
	3082	#endif
	3083
	3084	#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \
	3085	defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
	3086	if(png_ptr->transformations & PNG_USER_TRANSFORM)
	3087	{
	3088	int user_pixel_depth=png_ptr->user_transform_depth*
	3089	png_ptr->user_transform_channels;
	3090	if(user_pixel_depth > max_pixel_depth)
	3091	max_pixel_depth=user_pixel_depth;
	3092	}
	3093	#endif
	3094
	3095	/* align the width on the next larger 8 pixels. Mainly used
	3096	for interlacing */
	3097	row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7));
	3098	/* calculate the maximum bytes needed, adding a byte and a pixel
	3099	for safety's sake */
	3100	row_bytes = PNG_ROWBYTES(max_pixel_depth,row_bytes) +
	3101	1 + ((max_pixel_depth + 7) >> 3);
	3102	#ifdef PNG_MAX_MALLOC_64K
	3103	if (row_bytes > (png_uint_32)65536L)
	3104	png_error(png_ptr, "This image requires a row greater than 64KB");
	3105	#endif
	3106	png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes+64);
	3107	png_ptr->row_buf = png_ptr->big_row_buf+32;
	3108	#if defined(PNG_DEBUG) && defined(PNG_USE_PNGGCCRD)
	3109	png_ptr->row_buf_size = row_bytes;
	3110	#endif
	3111
	3112	#ifdef PNG_MAX_MALLOC_64K
	3113	if ((png_uint_32)png_ptr->rowbytes + 1 > (png_uint_32)65536L)
	3114	png_error(png_ptr, "This image requires a row greater than 64KB");
	3115	#endif
	3116	if ((png_uint_32)png_ptr->rowbytes > (png_uint_32)(PNG_SIZE_MAX - 1))
	3117	png_error(png_ptr, "Row has too many bytes to allocate in memory.");
	3118	png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)(
	3119	png_ptr->rowbytes + 1));
	3120
	3121	png_memset_check(png_ptr, png_ptr->prev_row, 0, png_ptr->rowbytes + 1);
	3122
	3123	png_debug1(3, "width = %lu,\n", png_ptr->width);
	3124	png_debug1(3, "height = %lu,\n", png_ptr->height);
	3125	png_debug1(3, "iwidth = %lu,\n", png_ptr->iwidth);
	3126	png_debug1(3, "num_rows = %lu\n", png_ptr->num_rows);
	3127	png_debug1(3, "rowbytes = %lu,\n", png_ptr->rowbytes);
	3128	png_debug1(3, "irowbytes = %lu,\n", png_ptr->irowbytes);
	3129
	3130	png_ptr->flags \|= PNG_FLAG_ROW_INIT;
	3131	}
	3132	#endif /* PNG_READ_SUPPORTED */

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: liacs/MIR2010/SourceCode/cximage/png/pngrutil.c@ 422

Download in other formats: