summaryrefslogtreecommitdiff
path: root/Build/source/libs/libpng/pngwutil.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/libpng/pngwutil.c')
-rw-r--r--Build/source/libs/libpng/pngwutil.c132
1 files changed, 88 insertions, 44 deletions
diff --git a/Build/source/libs/libpng/pngwutil.c b/Build/source/libs/libpng/pngwutil.c
index dd7b150b75f..f7e72e36f4a 100644
--- a/Build/source/libs/libpng/pngwutil.c
+++ b/Build/source/libs/libpng/pngwutil.c
@@ -1,9 +1,9 @@
/* pngwutil.c - utilities to write a PNG file
*
- * libpng version 1.2.8 - December 3, 2004
+ * Last changed in libpng 1.2.13 November 13, 2006
* For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2004 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2006 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*/
@@ -16,7 +16,7 @@
* with unsigned numbers for convenience, although one supported
* ancillary chunk uses signed (two's complement) numbers.
*/
-void /* PRIVATE */
+void PNGAPI
png_save_uint_32(png_bytep buf, png_uint_32 i)
{
buf[0] = (png_byte)((i >> 24) & 0xff);
@@ -25,12 +25,11 @@ png_save_uint_32(png_bytep buf, png_uint_32 i)
buf[3] = (png_byte)(i & 0xff);
}
-#if defined(PNG_WRITE_pCAL_SUPPORTED) || defined(PNG_WRITE_oFFs_SUPPORTED)
/* The png_save_int_32 function assumes integers are stored in two's
* complement format. If this isn't the case, then this routine needs to
* be modified to write data in two's complement format.
*/
-void /* PRIVATE */
+void PNGAPI
png_save_int_32(png_bytep buf, png_int_32 i)
{
buf[0] = (png_byte)((i >> 24) & 0xff);
@@ -38,13 +37,12 @@ png_save_int_32(png_bytep buf, png_int_32 i)
buf[2] = (png_byte)((i >> 8) & 0xff);
buf[3] = (png_byte)(i & 0xff);
}
-#endif
/* Place a 16-bit number into a buffer in PNG byte order.
* The parameter is declared unsigned int, not png_uint_16,
* just to avoid potential problems on pre-ANSI C compilers.
*/
-void /* PRIVATE */
+void PNGAPI
png_save_uint_16(png_bytep buf, unsigned int i)
{
buf[0] = (png_byte)((i >> 8) & 0xff);
@@ -64,6 +62,7 @@ void PNGAPI
png_write_chunk(png_structp png_ptr, png_bytep chunk_name,
png_bytep data, png_size_t length)
{
+ if(png_ptr == NULL) return;
png_write_chunk_start(png_ptr, chunk_name, (png_uint_32)length);
png_write_chunk_data(png_ptr, data, length);
png_write_chunk_end(png_ptr);
@@ -79,6 +78,7 @@ png_write_chunk_start(png_structp png_ptr, png_bytep chunk_name,
{
png_byte buf[4];
png_debug2(0, "Writing %s chunk (%lu bytes)\n", chunk_name, length);
+ if(png_ptr == NULL) return;
/* write the length */
png_save_uint_32(buf, length);
@@ -100,6 +100,7 @@ void PNGAPI
png_write_chunk_data(png_structp png_ptr, png_bytep data, png_size_t length)
{
/* write the data, and run the CRC over it */
+ if(png_ptr == NULL) return;
if (data != NULL && length > 0)
{
png_calculate_crc(png_ptr, data, length);
@@ -113,6 +114,8 @@ png_write_chunk_end(png_structp png_ptr)
{
png_byte buf[4];
+ if(png_ptr == NULL) return;
+
/* write the crc */
png_save_uint_32(buf, png_ptr->crc);
@@ -161,9 +164,11 @@ png_text_compress(png_structp png_ptr,
{
int ret;
- comp->num_output_ptr = comp->max_output_ptr = 0;
+ comp->num_output_ptr = 0;
+ comp->max_output_ptr = 0;
comp->output_ptr = NULL;
comp->input = NULL;
+ comp->input_len = 0;
/* we may just want to pass the text right through */
if (compression == PNG_TEXT_COMPRESSION_NONE)
@@ -728,8 +733,16 @@ png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type,
png_size_t name_len;
png_charp new_name;
compression_state comp;
+ int embedded_profile_len = 0;
png_debug(1, "in png_write_iCCP\n");
+
+ comp.num_output_ptr = 0;
+ comp.max_output_ptr = 0;
+ comp.output_ptr = NULL;
+ comp.input = NULL;
+ comp.input_len = 0;
+
if (name == NULL || (name_len = png_check_keyword(png_ptr, name,
&new_name)) == 0)
{
@@ -743,6 +756,24 @@ png_write_iCCP(png_structp png_ptr, png_charp name, int compression_type,
if (profile == NULL)
profile_len = 0;
+ if (profile_len > 3)
+ embedded_profile_len = ((*(profile ))<<24) | ((*(profile+1))<<16) |
+ ((*(profile+2))<< 8) | ((*(profile+3)) );
+
+ if (profile_len < embedded_profile_len)
+ {
+ png_warning(png_ptr,
+ "Embedded profile length too large in iCCP chunk");
+ return;
+ }
+
+ if (profile_len > embedded_profile_len)
+ {
+ png_warning(png_ptr,
+ "Truncating profile to actual length in iCCP chunk");
+ profile_len = embedded_profile_len;
+ }
+
if (profile_len)
profile_len = png_text_compress(png_ptr, profile, (png_size_t)profile_len,
PNG_COMPRESSION_TYPE_BASE, &comp);
@@ -930,8 +961,7 @@ png_write_cHRM(png_structp png_ptr, double white_x, double white_y,
itemp = (png_uint_32)(white_y * 100000.0 + 0.5);
png_save_uint_32(buf + 4, itemp);
- if (red_x < 0 || red_x > 0.8 || red_y < 0 || red_y > 0.8 ||
- red_x + red_y > 1.0)
+ if (red_x < 0 || red_y < 0 || red_x + red_y > 1.0)
{
png_warning(png_ptr, "Invalid cHRM red point specified");
return;
@@ -941,8 +971,7 @@ png_write_cHRM(png_structp png_ptr, double white_x, double white_y,
itemp = (png_uint_32)(red_y * 100000.0 + 0.5);
png_save_uint_32(buf + 12, itemp);
- if (green_x < 0 || green_x > 0.8 || green_y < 0 || green_y > 0.8 ||
- green_x + green_y > 1.0)
+ if (green_x < 0 || green_y < 0 || green_x + green_y > 1.0)
{
png_warning(png_ptr, "Invalid cHRM green point specified");
return;
@@ -952,8 +981,7 @@ png_write_cHRM(png_structp png_ptr, double white_x, double white_y,
itemp = (png_uint_32)(green_y * 100000.0 + 0.5);
png_save_uint_32(buf + 20, itemp);
- if (blue_x < 0 || blue_x > 0.8 || blue_y < 0 || blue_y > 0.8 ||
- blue_x + blue_y > 1.0)
+ if (blue_x < 0 || blue_y < 0 || blue_x + blue_y > 1.0)
{
png_warning(png_ptr, "Invalid cHRM blue point specified");
return;
@@ -991,7 +1019,7 @@ png_write_cHRM_fixed(png_structp png_ptr, png_fixed_point white_x,
png_save_uint_32(buf, (png_uint_32)white_x);
png_save_uint_32(buf + 4, (png_uint_32)white_y);
- if (red_x > 80000L || red_y > 80000L || red_x + red_y > 100000L)
+ if (red_x + red_y > 100000L)
{
png_warning(png_ptr, "Invalid cHRM fixed red point specified");
return;
@@ -999,7 +1027,7 @@ png_write_cHRM_fixed(png_structp png_ptr, png_fixed_point white_x,
png_save_uint_32(buf + 8, (png_uint_32)red_x);
png_save_uint_32(buf + 12, (png_uint_32)red_y);
- if (green_x > 80000L || green_y > 80000L || green_x + green_y > 100000L)
+ if (green_x + green_y > 100000L)
{
png_warning(png_ptr, "Invalid fixed cHRM green point specified");
return;
@@ -1007,7 +1035,7 @@ png_write_cHRM_fixed(png_structp png_ptr, png_fixed_point white_x,
png_save_uint_32(buf + 16, (png_uint_32)green_x);
png_save_uint_32(buf + 20, (png_uint_32)green_y);
- if (blue_x > 80000L || blue_y > 80000L || blue_x + blue_y > 100000L)
+ if (blue_x + blue_y > 100000L)
{
png_warning(png_ptr, "Invalid fixed cHRM blue point specified");
return;
@@ -1344,6 +1372,12 @@ png_write_zTXt(png_structp png_ptr, png_charp key, png_charp text,
png_debug(1, "in png_write_zTXt\n");
+ comp.num_output_ptr = 0;
+ comp.max_output_ptr = 0;
+ comp.output_ptr = NULL;
+ comp.input = NULL;
+ comp.input_len = 0;
+
if (key == NULL || (key_len = png_check_keyword(png_ptr, key, &new_key))==0)
{
png_warning(png_ptr, "Empty keyword in zTXt chunk");
@@ -1397,6 +1431,11 @@ png_write_iTXt(png_structp png_ptr, int compression, png_charp key,
png_debug(1, "in png_write_iTXt\n");
+ comp.num_output_ptr = 0;
+ comp.max_output_ptr = 0;
+ comp.output_ptr = NULL;
+ comp.input = NULL;
+
if (key == NULL || (key_len = png_check_keyword(png_ptr, key, &new_key))==0)
{
png_warning(png_ptr, "Empty keyword in iTXt chunk");
@@ -1552,39 +1591,41 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
/* write the sCAL chunk */
#if defined(PNG_FLOATING_POINT_SUPPORTED) && !defined(PNG_NO_STDIO)
void /* PRIVATE */
-png_write_sCAL(png_structp png_ptr, int unit, double width,double height)
+png_write_sCAL(png_structp png_ptr, int unit, double width, double height)
{
#ifdef PNG_USE_LOCAL_ARRAYS
PNG_sCAL;
#endif
+ char buf[64];
png_size_t total_len;
- char wbuf[32], hbuf[32];
- png_byte bunit = unit;
png_debug(1, "in png_write_sCAL\n");
+ buf[0] = (char)unit;
#if defined(_WIN32_WCE)
/* sprintf() function is not supported on WindowsCE */
{
wchar_t wc_buf[32];
+ size_t wc_len;
swprintf(wc_buf, TEXT("%12.12e"), width);
- WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, wbuf, 32, NULL, NULL);
+ wc_len = wcslen(wc_buf);
+ WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, buf + 1, wc_len, NULL, NULL);
+ total_len = wc_len + 2;
swprintf(wc_buf, TEXT("%12.12e"), height);
- WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, hbuf, 32, NULL, NULL);
+ wc_len = wcslen(wc_buf);
+ WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, buf + total_len, wc_len,
+ NULL, NULL);
+ total_len += wc_len;
}
#else
- sprintf(wbuf, "%12.12e", width);
- sprintf(hbuf, "%12.12e", height);
+ sprintf(buf + 1, "%12.12e", width);
+ total_len = 1 + png_strlen(buf + 1) + 1;
+ sprintf(buf + total_len, "%12.12e", height);
+ total_len += png_strlen(buf + total_len);
#endif
- total_len = 1 + png_strlen(wbuf)+1 + png_strlen(hbuf);
-
- png_debug1(3, "sCAL total length = %d\n", (int)total_len);
- png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len);
- png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1);
- png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1);
- png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf));
- png_write_chunk_end(png_ptr);
+ png_debug1(3, "sCAL total length = %u\n", (unsigned int)total_len);
+ png_write_chunk(png_ptr, (png_bytep)png_sCAL, (png_bytep)buf, total_len);
}
#else
#ifdef PNG_FIXED_POINT_SUPPORTED
@@ -1595,23 +1636,26 @@ png_write_sCAL_s(png_structp png_ptr, int unit, png_charp width,
#ifdef PNG_USE_LOCAL_ARRAYS
PNG_sCAL;
#endif
- png_size_t total_len;
- char wbuf[32], hbuf[32];
- png_byte bunit = unit;
+ png_byte buf[64];
+ png_size_t wlen, hlen, total_len;
png_debug(1, "in png_write_sCAL_s\n");
- png_strcpy(wbuf,(const char *)width);
- png_strcpy(hbuf,(const char *)height);
- total_len = 1 + png_strlen(wbuf)+1 + png_strlen(hbuf);
+ wlen = png_strlen(width);
+ hlen = png_strlen(height);
+ total_len = wlen + hlen + 2;
+ if (total_len > 64)
+ {
+ png_warning(png_ptr, "Can't write sCAL (buffer too small)");
+ return;
+ }
- png_debug1(3, "sCAL total length = %d\n", total_len);
- png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len);
- png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1);
- png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1);
- png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf));
+ buf[0] = (png_byte)unit;
+ png_memcpy(buf + 1, width, wlen + 1); /* append the '\0' here */
+ png_memcpy(buf + wlen + 2, height, hlen); /* do NOT append the '\0' here */
- png_write_chunk_end(png_ptr);
+ png_debug1(3, "sCAL total length = %u\n", (unsigned int)total_len);
+ png_write_chunk(png_ptr, (png_bytep)png_sCAL, buf, total_len);
}
#endif
#endif