diff options
Diffstat (limited to 'Build/source/libs/libpng/pngwutil.c')
-rw-r--r-- | Build/source/libs/libpng/pngwutil.c | 132 |
1 files changed, 88 insertions, 44 deletions
diff --git a/Build/source/libs/libpng/pngwutil.c b/Build/source/libs/libpng/pngwutil.c index dd7b150b75f..f7e72e36f4a 100644 --- a/Build/source/libs/libpng/pngwutil.c +++ b/Build/source/libs/libpng/pngwutil.c @@ -1,9 +1,9 @@ /* pngwutil.c - utilities to write a PNG file * - * libpng version 1.2.8 - December 3, 2004 + * Last changed in libpng 1.2.13 November 13, 2006 * For conditions of distribution and use, see copyright notice in png.h - * Copyright (c) 1998-2004 Glenn Randers-Pehrson + * Copyright (c) 1998-2006 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) */ @@ -16,7 +16,7 @@ * with unsigned numbers for convenience, although one supported * ancillary chunk uses signed (two's complement) numbers. */ -void /* PRIVATE */ +void PNGAPI png_save_uint_32(png_bytep buf, png_uint_32 i) { buf[0] = (png_byte)((i >> 24) & 0xff); @@ -25,12 +25,11 @@ png_save_uint_32(png_bytep buf, png_uint_32 i) buf[3] = (png_byte)(i & 0xff); } -#if defined(PNG_WRITE_pCAL_SUPPORTED) || defined(PNG_WRITE_oFFs_SUPPORTED) /* The png_save_int_32 function assumes integers are stored in two's * complement format. If this isn't the case, then this routine needs to * be modified to write data in two's complement format. */ -void /* PRIVATE */ +void PNGAPI png_save_int_32(png_bytep buf, png_int_32 i) { buf[0] = (png_byte)((i >> 24) & 0xff); @@ -38,13 +37,12 @@ png_save_int_32(png_bytep buf, png_int_32 i) buf[2] = (png_byte)((i >> 8) & 0xff); buf[3] = (png_byte)(i & 0xff); } -#endif /* Place a 16-bit number into a buffer in PNG byte order. * The parameter is declared unsigned int, not png_uint_16, * just to avoid potential problems on pre-ANSI C compilers. */ -void /* PRIVATE */ +void PNGAPI png_save_uint_16(png_bytep buf, unsigned int i) { buf[0] = (png_byte)((i >> 8) & 0xff); @@ -64,6 +62,7 @@ void PNGAPI png_write_chunk(png_structp png_ptr, png_bytep chunk_name, png_bytep data, png_size_t length) { + if(png_ptr == NULL) return; png_write_chunk_start(png_ptr, chunk_name, (png_uint_32)length); png_write_chunk_data(png_ptr, data, length); png_write_chunk_end(png_ptr); @@ -79,6 +78,7 @@ png_write_chunk_start(png_structp png_ptr, png_bytep chunk_name, { png_byte buf[4]; png_debug2(0, "Writing %s chunk (%lu bytes)\n", chunk_name, length); + if(png_ptr == NULL) return; /* write the length */ png_save_uint_32(buf, length); @@ -100,6 +100,7 @@ void PNGAPI png_write_chunk_data(png_structp png_ptr, png_bytep data, png_size_t length) { /* write the data, and run the CRC over it */ + if(png_ptr == NULL) return; if (data != NULL && length > 0) { png_calculate_crc(png_ptr, data, length); @@ -113,6 +114,8 @@ png_write_chunk_end(png_structp png_ptr) { png_byte buf[4]; + if(png_ptr == NULL) return; + /* write the crc */ png_save_uint_32(buf, png_ptr->crc); @@ -161,9 +164,11 @@ png_text_compress(png_structp png_ptr, { int ret; - comp->num_output_ptr = comp->max_output_ptr = 0; + comp->num_output_ptr = 0; + comp->max_output_ptr = 0; comp->output_ptr = NULL; comp->input = NULL; + comp->input_len = 0; /* we may just want to pass the text right through */ if (compression == PNG_TEXT_COMPRESSION_NONE) @@ -728,8 +733,16 @@ png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type, png_size_t name_len; png_charp new_name; compression_state comp; + int embedded_profile_len = 0; png_debug(1, "in png_write_iCCP\n"); + + comp.num_output_ptr = 0; + comp.max_output_ptr = 0; + comp.output_ptr = NULL; + comp.input = NULL; + comp.input_len = 0; + if (name == NULL || (name_len = png_check_keyword(png_ptr, name, &new_name)) == 0) { @@ -743,6 +756,24 @@ png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type, if (profile == NULL) profile_len = 0; + if (profile_len > 3) + embedded_profile_len = ((*(profile ))<<24) | ((*(profile+1))<<16) | + ((*(profile+2))<< 8) | ((*(profile+3)) ); + + if (profile_len < embedded_profile_len) + { + png_warning(png_ptr, + "Embedded profile length too large in iCCP chunk"); + return; + } + + if (profile_len > embedded_profile_len) + { + png_warning(png_ptr, + "Truncating profile to actual length in iCCP chunk"); + profile_len = embedded_profile_len; + } + if (profile_len) profile_len = png_text_compress(png_ptr, profile, (png_size_t)profile_len, PNG_COMPRESSION_TYPE_BASE, &comp); @@ -930,8 +961,7 @@ png_write_cHRM(png_structp png_ptr, double white_x, double white_y, itemp = (png_uint_32)(white_y * 100000.0 + 0.5); png_save_uint_32(buf + 4, itemp); - if (red_x < 0 || red_x > 0.8 || red_y < 0 || red_y > 0.8 || - red_x + red_y > 1.0) + if (red_x < 0 || red_y < 0 || red_x + red_y > 1.0) { png_warning(png_ptr, "Invalid cHRM red point specified"); return; @@ -941,8 +971,7 @@ png_write_cHRM(png_structp png_ptr, double white_x, double white_y, itemp = (png_uint_32)(red_y * 100000.0 + 0.5); png_save_uint_32(buf + 12, itemp); - if (green_x < 0 || green_x > 0.8 || green_y < 0 || green_y > 0.8 || - green_x + green_y > 1.0) + if (green_x < 0 || green_y < 0 || green_x + green_y > 1.0) { png_warning(png_ptr, "Invalid cHRM green point specified"); return; @@ -952,8 +981,7 @@ png_write_cHRM(png_structp png_ptr, double white_x, double white_y, itemp = (png_uint_32)(green_y * 100000.0 + 0.5); png_save_uint_32(buf + 20, itemp); - if (blue_x < 0 || blue_x > 0.8 || blue_y < 0 || blue_y > 0.8 || - blue_x + blue_y > 1.0) + if (blue_x < 0 || blue_y < 0 || blue_x + blue_y > 1.0) { png_warning(png_ptr, "Invalid cHRM blue point specified"); return; @@ -991,7 +1019,7 @@ png_write_cHRM_fixed(png_structp png_ptr, png_fixed_point white_x, png_save_uint_32(buf, (png_uint_32)white_x); png_save_uint_32(buf + 4, (png_uint_32)white_y); - if (red_x > 80000L || red_y > 80000L || red_x + red_y > 100000L) + if (red_x + red_y > 100000L) { png_warning(png_ptr, "Invalid cHRM fixed red point specified"); return; @@ -999,7 +1027,7 @@ png_write_cHRM_fixed(png_structp png_ptr, png_fixed_point white_x, png_save_uint_32(buf + 8, (png_uint_32)red_x); png_save_uint_32(buf + 12, (png_uint_32)red_y); - if (green_x > 80000L || green_y > 80000L || green_x + green_y > 100000L) + if (green_x + green_y > 100000L) { png_warning(png_ptr, "Invalid fixed cHRM green point specified"); return; @@ -1007,7 +1035,7 @@ png_write_cHRM_fixed(png_structp png_ptr, png_fixed_point white_x, png_save_uint_32(buf + 16, (png_uint_32)green_x); png_save_uint_32(buf + 20, (png_uint_32)green_y); - if (blue_x > 80000L || blue_y > 80000L || blue_x + blue_y > 100000L) + if (blue_x + blue_y > 100000L) { png_warning(png_ptr, "Invalid fixed cHRM blue point specified"); return; @@ -1344,6 +1372,12 @@ png_write_zTXt(png_structp png_ptr, png_charp key, png_charp text, png_debug(1, "in png_write_zTXt\n"); + comp.num_output_ptr = 0; + comp.max_output_ptr = 0; + comp.output_ptr = NULL; + comp.input = NULL; + comp.input_len = 0; + if (key == NULL || (key_len = png_check_keyword(png_ptr, key, &new_key))==0) { png_warning(png_ptr, "Empty keyword in zTXt chunk"); @@ -1397,6 +1431,11 @@ png_write_iTXt(png_structp png_ptr, int compression, png_charp key, png_debug(1, "in png_write_iTXt\n"); + comp.num_output_ptr = 0; + comp.max_output_ptr = 0; + comp.output_ptr = NULL; + comp.input = NULL; + if (key == NULL || (key_len = png_check_keyword(png_ptr, key, &new_key))==0) { png_warning(png_ptr, "Empty keyword in iTXt chunk"); @@ -1552,39 +1591,41 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0, /* write the sCAL chunk */ #if defined(PNG_FLOATING_POINT_SUPPORTED) && !defined(PNG_NO_STDIO) void /* PRIVATE */ -png_write_sCAL(png_structp png_ptr, int unit, double width,double height) +png_write_sCAL(png_structp png_ptr, int unit, double width, double height) { #ifdef PNG_USE_LOCAL_ARRAYS PNG_sCAL; #endif + char buf[64]; png_size_t total_len; - char wbuf[32], hbuf[32]; - png_byte bunit = unit; png_debug(1, "in png_write_sCAL\n"); + buf[0] = (char)unit; #if defined(_WIN32_WCE) /* sprintf() function is not supported on WindowsCE */ { wchar_t wc_buf[32]; + size_t wc_len; swprintf(wc_buf, TEXT("%12.12e"), width); - WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, wbuf, 32, NULL, NULL); + wc_len = wcslen(wc_buf); + WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, buf + 1, wc_len, NULL, NULL); + total_len = wc_len + 2; swprintf(wc_buf, TEXT("%12.12e"), height); - WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, hbuf, 32, NULL, NULL); + wc_len = wcslen(wc_buf); + WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, buf + total_len, wc_len, + NULL, NULL); + total_len += wc_len; } #else - sprintf(wbuf, "%12.12e", width); - sprintf(hbuf, "%12.12e", height); + sprintf(buf + 1, "%12.12e", width); + total_len = 1 + png_strlen(buf + 1) + 1; + sprintf(buf + total_len, "%12.12e", height); + total_len += png_strlen(buf + total_len); #endif - total_len = 1 + png_strlen(wbuf)+1 + png_strlen(hbuf); - - png_debug1(3, "sCAL total length = %d\n", (int)total_len); - png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len); - png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1); - png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1); - png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf)); - png_write_chunk_end(png_ptr); + png_debug1(3, "sCAL total length = %u\n", (unsigned int)total_len); + png_write_chunk(png_ptr, (png_bytep)png_sCAL, (png_bytep)buf, total_len); } #else #ifdef PNG_FIXED_POINT_SUPPORTED @@ -1595,23 +1636,26 @@ png_write_sCAL_s(png_structp png_ptr, int unit, png_charp width, #ifdef PNG_USE_LOCAL_ARRAYS PNG_sCAL; #endif - png_size_t total_len; - char wbuf[32], hbuf[32]; - png_byte bunit = unit; + png_byte buf[64]; + png_size_t wlen, hlen, total_len; png_debug(1, "in png_write_sCAL_s\n"); - png_strcpy(wbuf,(const char *)width); - png_strcpy(hbuf,(const char *)height); - total_len = 1 + png_strlen(wbuf)+1 + png_strlen(hbuf); + wlen = png_strlen(width); + hlen = png_strlen(height); + total_len = wlen + hlen + 2; + if (total_len > 64) + { + png_warning(png_ptr, "Can't write sCAL (buffer too small)"); + return; + } - png_debug1(3, "sCAL total length = %d\n", total_len); - png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len); - png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1); - png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1); - png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf)); + buf[0] = (png_byte)unit; + png_memcpy(buf + 1, width, wlen + 1); /* append the '\0' here */ + png_memcpy(buf + wlen + 2, height, hlen); /* do NOT append the '\0' here */ - png_write_chunk_end(png_ptr); + png_debug1(3, "sCAL total length = %u\n", (unsigned int)total_len); + png_write_chunk(png_ptr, (png_bytep)png_sCAL, buf, total_len); } #endif #endif |