diff options
| -rw-r--r-- | ANNOUNCE | 67 | ||||
| -rw-r--r-- | CHANGES | 27 | ||||
| -rw-r--r-- | INSTALL | 29 | ||||
| -rw-r--r-- | KNOWNBUG | 2 | ||||
| -rw-r--r-- | LICENSE | 16 | ||||
| -rw-r--r-- | README | 2 | ||||
| -rw-r--r-- | Y2KINFO | 4 | ||||
| -rwxr-xr-x | configure | 4 | ||||
| -rw-r--r-- | contrib/visupng/VisualPng.dsw | 58 | ||||
| -rw-r--r-- | example.c | 3 | ||||
| -rw-r--r-- | libpng.3 | 41 | ||||
| -rw-r--r-- | libpng.txt | 20 | ||||
| -rw-r--r-- | libpngpf.3 | 12 | ||||
| -rw-r--r-- | png.5 | 2 | ||||
| -rw-r--r-- | png.c | 46 | ||||
| -rw-r--r-- | png.h | 64 | ||||
| -rw-r--r-- | pngasmrd.h | 2 | ||||
| -rw-r--r-- | pngconf.h | 17 | ||||
| -rw-r--r-- | pngerror.c | 4 | ||||
| -rw-r--r-- | pnggccrd.c | 14 | ||||
| -rw-r--r-- | pngget.c | 12 | ||||
| -rw-r--r-- | pngmem.c | 80 | ||||
| -rw-r--r-- | pngpread.c | 21 | ||||
| -rw-r--r-- | pngread.c | 63 | ||||
| -rw-r--r-- | pngrio.c | 2 | ||||
| -rw-r--r-- | pngrtran.c | 42 | ||||
| -rw-r--r-- | pngrutil.c | 59 | ||||
| -rw-r--r-- | pngset.c | 110 | ||||
| -rw-r--r-- | pngtest.c | 25 | ||||
| -rw-r--r-- | pngtrans.c | 2 | ||||
| -rw-r--r-- | pngvcrd.c | 2 | ||||
| -rw-r--r-- | pngwio.c | 2 | ||||
| -rw-r--r-- | pngwrite.c | 37 | ||||
| -rw-r--r-- | pngwtran.c | 2 | ||||
| -rw-r--r-- | pngwutil.c | 27 | ||||
| -rw-r--r-- | projects/netware.txt | 4 | ||||
| -rw-r--r-- | projects/wince.txt | 4 |
37 files changed, 621 insertions, 307 deletions
@@ -1,5 +1,5 @@ -Libpng 1.2.6beta3 - July 18, 2004 +Libpng 1.2.6beta4 - July 28, 2004 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -12,8 +12,73 @@ Changes since the last public release (1.2.5): Fixed memory overrun bug in png_do_read_filler() with 16-bit datastreams, introduced in version 1.0.2. Fixed potential overrun in pngerror.c by using strncpy instead of memcpy. + Revised makefile.macosx, makefile.dec, makefile.aix, and makefile.32sunu. + Changed the one instance of "ln -sf" to "ln -f -s" in each Sun makefile. + Fixed potential overrun in pngerror.c by using strncpy instead of memcpy. + Added "#!/bin/sh" at the top of configure, for recognition of the + 'x' flag under Cygwin (Cosmin). + Optimized vacuous tests that silence compiler warnings, in png.c (Cosmin). + Added support for PNG_USER_CONFIG, in pngconf.h (Cosmin). + Fixed the special memory handler for Borland C under DOS, in pngmem.c + (Cosmin). + Removed some spurious assignments in pngrutil.c (Cosmin). + Replaced 65536 with 65536L, and 0xffff with 0xffffL, to silence warnings + on 16-bit platforms (Cosmin). + Enclosed shift op expressions in parentheses, to silence warnings (Cosmin). + Used proper type png_fixed_point, to avoid problems on 16-bit platforms, + in png_handle_sRGB() (Cosmin). + Added compression_type to png_struct, and optimized the window size + inside the deflate stream (Cosmin). + Fixed definition of isnonalpha(), in pngerror.c and pngrutil.c (Cosmin). + Fixed handling of unknown chunks that come after IDAT (Cosmin). + Allowed png_error() and png_warning() to work even if png_ptr == NULL + (Cosmin). + Replaced row_info->rowbytes with row_bytes in png_write_find_filter() + (Cosmin). + Fixed definition of PNG_LIBPNG_VER_DLLNUM (Simon-Pierre). + Used PNG_LIBPNG_VER and PNG_LIBPNG_VER_STRING instead of the hardcoded + values in png.c (Simon-Pierre, Cosmin). + Initialized png_libpng_ver[] with PNG_LIBPNG_VER_STRING (Simon-Pierre). + Replaced PNG_LIBPNG_VER_MAJOR with PNG_LIBPNG_VER_DLLNUM in png.rc + (Simon-Pierre). + Moved the definition of PNG_HEADER_VERSION_STRING near the definitions + of the other PNG_LIBPNG_VER_... symbols in png.h (Cosmin). + Relocated #ifndef PNGAPI guards in pngconf.h (Simon-Pierre, Cosmin). + Updated scripts/makefile.vc(a)win32 (Cosmin). + Updated the MSVC project (Simon-Pierre, Cosmin). + Updated the Borland C++ Builder project (Cosmin). + Avoided access to asm_flags in pngvcrd.c, if PNG_1_0_X is defined (Cosmin). + Commented out warning about uninitialized mmx_support in pngvcrd.c (Cosmin). + Removed scripts/makefile.bd32 and scripts/pngdef.pas (Cosmin). + Added extra guard around inclusion of Turbo C memory headers, in pngconf.h + (Cosmin). + Renamed projects/msvc/ to projects/visualc6/, and projects/borland/ to + projects/cbuilder5/ (Cosmin). + Moved projects/visualc6/png32ms.def to scripts/pngw32.def, + and projects/visualc6/png.rc to scripts/pngw32.rc (Cosmin). + Added projects/visualc6/pngtest.dsp; removed contrib/msvctest/ (Cosmin). + Updated contrib/visupng/VisualPng.dsp (Cosmin). + Updated contrib/visupng/cexcept.h to version 2.0.0 (Cosmin). + Added a separate distribution with "configure" and supporting files (Junichi). + Added user ability to change png_size_t via a PNG_SIZE_T macro. + Added png_sizeof() and png_convert_size() functions. + Added PNG_SIZE_MAX (maximum value of a png_size_t variable. + Added check in png_malloc_default() for (size_t)size != (png_uint_32)size + which would indicate an overflow. + Changed sPLT failure action from png_error to png_warning and abandon chunk. + Changed sCAL and iCCP failures from png_error to png_warning and abandon. + Added png_get_uint_31(png_ptr, buf) function. + Added PNG_UINT_32_MAX macro. + Renamed PNG_MAX_UINT to PNG_UINT_31_MAX. + Made png_zalloc() issue a png_warning and return NULL on potential + overflow. + Turn on PNG_NO_ZALLOC_ZERO by default in version 1.2.x + Revised "clobber list" in pnggccrd.c so it will compile under gcc-3.4. + Revised Borland portion of png_malloc() to return NULL or issue + png_error() according to setting of PNG_FLAG_MALLOC_NULL_MEM_OK. Send comments/corrections/commendations to png-implement@ccrc.wustl.edu or to glennrp@users.sourceforge.net Glenn R-P + @@ -1214,7 +1214,7 @@ version 1.2.6beta3 [July 18, 2004] (Cosmin). Replaced row_info->rowbytes with row_bytes in png_write_find_filter() (Cosmin). -? Fixed definition of PNG_LIBPNG_VER_DLLNUM (Simon-Pierre). + Fixed definition of PNG_LIBPNG_VER_DLLNUM (Simon-Pierre). Used PNG_LIBPNG_VER and PNG_LIBPNG_VER_STRING instead of the hardcoded values in png.c (Simon-Pierre, Cosmin). Initialized png_libpng_ver[] with PNG_LIBPNG_VER_STRING (Simon-Pierre). @@ -1236,9 +1236,34 @@ version 1.2.6beta3 [July 18, 2004] Moved projects/visualc6/png32ms.def to scripts/pngw32.def, and projects/visualc6/png.rc to scripts/pngw32.rc (Cosmin). Added projects/visualc6/pngtest.dsp; removed contrib/msvctest/ (Cosmin). + Changed line endings to DOS style in cbuilder5 and visualc6 files, even + in the tar.* distributions (Cosmin). Updated contrib/visupng/VisualPng.dsp (Cosmin). Updated contrib/visupng/cexcept.h to version 2.0.0 (Cosmin). Added a separate distribution with "configure" and supporting files (Junichi). +version 1.2.6beta4 [July 28, 2004] + Added user ability to change png_size_t via a PNG_SIZE_T macro. + Added png_sizeof() and png_convert_size() functions. + Added PNG_SIZE_MAX (maximum value of a png_size_t variable. + Added check in png_malloc_default() for (size_t)size != (png_uint_32)size + which would indicate an overflow. + Changed sPLT failure action from png_error to png_warning and abandon chunk. + Changed sCAL and iCCP failures from png_error to png_warning and abandon. + Added png_get_uint_31(png_ptr, buf) function. + Added PNG_UINT_32_MAX macro. + Renamed PNG_MAX_UINT to PNG_UINT_31_MAX. + Made png_zalloc() issue a png_warning and return NULL on potential + overflow. + Turn on PNG_NO_ZALLOC_ZERO by default in version 1.2.x + Revised "clobber list" in pnggccrd.c so it will compile under gcc-3.4. + Revised Borland portion of png_malloc() to return NULL or issue + png_error() according to setting of PNG_FLAG_MALLOC_NULL_MEM_OK. + Added PNG_NO_SEQUENTIAL_READ_SUPPORTED macro to conditionally remove + sequential read support. + Added some "#if PNG_WRITE_SUPPORTED" blocks. + #ifdef'ed out some redundancy in png_malloc_default(). + Use png_malloc instead of png_zalloc to allocate the pallete. + Send comments/corrections/commendations to png-implement@ccrc.wustl.edu or to glennrp@users.sourceforge.net @@ -1,5 +1,5 @@ -Installing libpng version 1.2.6beta3 - July 18, 2004 +Installing libpng version 1.2.6beta4 - July 28, 2004 Before installing libpng, you must first install zlib. zlib can usually be found wherever you got libpng. zlib can be @@ -10,7 +10,7 @@ zlib.h and zconf.h include files that correspond to the version of zlib that's installed. You can rename the directories that you downloaded (they -might be called "libpng-1.2.6beta3" or "lpng109" and "zlib-1.1.3" +might be called "libpng-1.2.6beta4" or "lpng109" and "zlib-1.1.3" or "zlib113") so that you have directories called "zlib" and "libpng". Your directory structure should look like this: @@ -64,8 +64,8 @@ The files that are presently available in the scripts directory include makefile.std => Generic UNIX makefile (cc, creates static libpng.a) - makefile.linux => Linux/ELF makefile (gcc, creates libpng12.so.0.1.2.6beta3) - makefile.gcmmx => Linux/ELF makefile (gcc, creates libpng12.so.0.1.2.6beta3, + makefile.linux => Linux/ELF makefile (gcc, creates libpng12.so.0.1.2.6beta4) + makefile.gcmmx => Linux/ELF makefile (gcc, creates libpng12.so.0.1.2.6beta4, uses assembler code tuned for Intel MMX platform) makefile.gcc => Generic makefile (gcc, creates static libpng.a) makefile.knr => Archaic UNIX Makefile that converts files with @@ -86,10 +86,10 @@ include makefile.ne0bsd => NetBSD/cc makefile, uses PNGGCCRD, makes libpng0.so makefile.openbsd => OpenBSD makefile makefile.sgi => Silicon Graphics IRIX makefile (cc, creates static lib) - makefile.sggcc => Silicon Graphics (gcc, creates libpng12.so.0.1.2.6beta3) + makefile.sggcc => Silicon Graphics (gcc, creates libpng12.so.0.1.2.6beta4) makefile.sunos => Sun makefile - makefile.solaris => Solaris 2.X makefile (gcc, creates libpng12.so.0.1.2.6beta3) - makefile.so9 => Solaris 9 makefile (gcc, creates libpng12.so.0.1.2.6beta3) + makefile.solaris => Solaris 2.X makefile (gcc, creates libpng12.so.0.1.2.6beta4) + makefile.so9 => Solaris 9 makefile (gcc, creates libpng12.so.0.1.2.6beta4) makefile.32sunu => Sun Ultra 32-bit makefile makefile.64sunu => Sun Ultra 64-bit makefile makefile.sco => For SCO OSr5 ELF and Unixware 7 with Native cc @@ -145,6 +145,17 @@ do that, run "make install" in the zlib directory first if necessary). Some also allow you to run "make test-installed" after you have run "make install". +If you encounter a compiler error message complaining about the +lines + __png.h__ already includes setjmp.h; + __dont__ include it again.; +This means you have compiled another module that includes setjmp.h, +which is hazardous because the two modules might not include exactly +the same setjmp.h. If you are sure that you know what you are doing +and that they are exactly the same, then you can comment out or +delete the two lines. Better yet, use the cexcept interface +instead, as demonstrated in contrib/visupng of the libpng distribution. + Further information can be found in the README and libpng.txt -files, in the individual makefiles, in png.h, in the README files in -subdirectories of the LIB directory, and the manual pages libpng.3 and png.5. +files, in the individual makefiles, in png.h, and the manual pages +libpng.3 and png.5. @@ -1,5 +1,5 @@ -Known bugs in libpng version 1.2.6beta3 +Known bugs in libpng version 1.2.6beta4 1. April 22, 2001: pnggccrd.c has been reported to crash on NetBSD when reading interlaced PNG files, when assembler code is enabled but running @@ -8,9 +8,17 @@ COPYRIGHT NOTICE, DISCLAIMER, and LICENSE: If you modify libpng you may insert additional notices immediately following this sentence. -libpng versions 1.0.7, July 1, 2000, through 1.2.6beta3, July 18, 2004, are -Copyright (c) 2000-2004 Glenn Randers-Pehrson -and are distributed according to the same disclaimer and license as libpng-1.0.6 +libpng version 1.2.6, July 28, 2004, is +Copyright (c) 2004 Glenn Randers-Pehrson, and is +distributed according to the same disclaimer and license as libpng-1.2.5 +with the following individuals added to the list of Contributing Authors + + Cosmin Truta + - + +libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are +Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are +distributed according to the same disclaimer and license as libpng-1.0.6 with the following individuals added to the list of Contributing Authors Simon-Pierre Cadieux @@ -99,4 +107,4 @@ certification mark of the Open Source Initiative. Glenn Randers-Pehrson glennrp@users.sourceforge.net -July 18, 2004 +July 28, 2004 @@ -1,4 +1,4 @@ -README for libpng version 1.2.6beta3 - July 18, 2004 (shared library 12.0) +README for libpng version 1.2.6beta4 - July 28, 2004 (shared library 12.0) See the note about version numbers near the top of png.h See INSTALL for instructions on how to install libpng. @@ -1,13 +1,13 @@ Y2K compliance in libpng: ========================= - July 18, 2004 + July 28, 2004 Since the PNG Development group is an ad-hoc body, we can't make an official declaration. This is your unofficial assurance that libpng from version 0.71 and - upward through 1.2.6beta3 are Y2K compliant. It is my belief that earlier + upward through 1.2.6beta4 are Y2K compliant. It is my belief that earlier versions were also Y2K compliant. Libpng only has three year fields. One is a 2-byte unsigned integer @@ -1,13 +1,13 @@ #!/bin/sh echo " There is no \"configure\" script in this distribution of - libpng-1.2.6beta3. + libpng-1.2.6beta4. Instead, please copy the appropriate makefile for your system from the \"scripts\" directory. Read the INSTALL file for more details. Update, July 2004: you can get a "configure" based distribution from the libpng distribution sites. Download the file - libpng-1.2.6beta3-config.tar.gz + libpng-1.2.6beta4-config.tar.gz " diff --git a/contrib/visupng/VisualPng.dsw b/contrib/visupng/VisualPng.dsw index 17ad83ad3..a30e1cc1c 100644 --- a/contrib/visupng/VisualPng.dsw +++ b/contrib/visupng/VisualPng.dsw @@ -1,29 +1,29 @@ -Microsoft Developer Studio Workspace File, Format Version 6.00 -# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE! - -############################################################################### - -Project: "VisualPng"=.\VisualPng.dsp - Package Owner=<4> - -Package=<5> -{{{ -}}} - -Package=<4> -{{{ -}}} - -############################################################################### - -Global: - -Package=<5> -{{{ -}}} - -Package=<3> -{{{ -}}} - -############################################################################### - +Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "VisualPng"=.\VisualPng.dsp - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -631,7 +631,7 @@ void write_png(char *file_name /* , ... other image information ... */) /* set the palette if there is one. REQUIRED for indexed-color images */ palette = (png_colorp)png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH - * sizeof (png_color)); + * png_sizeof (png_color)); /* ... set palette colors ... */ png_set_PLTE(png_ptr, info_ptr, palette, PNG_MAX_PALETTE_LENGTH); /* You must not free palette here, because png_set_PLTE only makes a link to @@ -741,6 +741,7 @@ void write_png(char *file_name /* , ... other image information ... */) png_uint_32 k, height, width; png_byte image[height][width*bytes_per_pixel]; png_bytep row_pointers[height]; + for (k = 0; k < height; k++) row_pointers[k] = image + k*width*bytes_per_pixel; @@ -1,6 +1,6 @@ -.TH LIBPNG 3 "July 18, 2004" +.TH LIBPNG 3 "July 28, 2004" .SH NAME -libpng \- Portable Network Graphics (PNG) Reference Library 1.2.6beta3 +libpng \- Portable Network Graphics (PNG) Reference Library 1.2.6beta4 .SH SYNOPSIS \fI\fB @@ -761,7 +761,7 @@ Following is a copy of the libpng.txt file that accompanies libpng. .SH LIBPNG.TXT libpng.txt - A description on how to use and modify libpng - libpng version 1.2.6beta3 - July 18, 2004 + libpng version 1.2.6beta4 - July 28, 2004 Updated and distributed by Glenn Randers-Pehrson <glennrp@users.sourceforge.net> Copyright (c) 1998-2004 Glenn Randers-Pehrson @@ -1140,8 +1140,14 @@ where row_pointers is an array of pointers to the pixel data for each row: If you know your image size and pixel size ahead of time, you can allocate row_pointers prior to calling png_read_png() with + if (height > PNG_UINT_32_MAX/png_sizeof(png_byte)) + png_error (png_ptr, + "Image is too tall to process in memory"); + if (width > PNG_UINT_32_MAX/pixel_size) + png_error (png_ptr, + "Image is too wide to process in memory"); row_pointers = png_malloc(png_ptr, - height*sizeof(png_bytep)); + height*png_sizeof(png_bytep)); for (int i=0; i<height, i++) row_pointers[i]=png_malloc(png_ptr, width*pixel_size); @@ -3081,9 +3087,9 @@ Your replacement memory functions must have prototypes as follows: png_size_t size); void free_fn(png_structp png_ptr, png_voidp ptr); -Your malloc_fn() should return NULL in case of failure. The png_malloc() -function will call png_error() if it receives a NULL from the system -memory allocator or from your replacement malloc_fn(). +Your malloc_fn() must return NULL in case of failure. The png_malloc() +function will normally call png_error() if it receives a NULL from the +system memory allocator or from your replacement malloc_fn(). Input/Output in libpng is done through png_read() and png_write(), which currently just call fread() and fwrite(). The FILE * is stored in @@ -3609,13 +3615,13 @@ application: .SH VII. Y2K Compliance in libpng -July 18, 2004 +July 28, 2004 Since the PNG Development group is an ad-hoc body, we can't make an official declaration. This is your unofficial assurance that libpng from version 0.71 and -upward through 1.2.6beta3 are Y2K compliant. It is my belief that earlier +upward through 1.2.6beta4 are Y2K compliant. It is my belief that earlier versions were also Y2K compliant. Libpng only has three year fields. One is a 2-byte unsigned integer that @@ -3752,6 +3758,9 @@ the first widely used release: 1.2.4 13 10204 12.so.0.1.2.4 1.2.5beta1-2 13 10205 12.so.0.1.2.5beta1-2 1.0.15rc1 10 10015 10.so.0.1.0.15rc1 + 1.0.15 10 10015 10.so.0.1.0.15 + 1.2.5 13 10205 12.so.0.1.2.5 + 1.2.6beta1-4 13 10206 12.so.0.1.2.6beta1-4 Henceforth the source version will match the shared-library minor and patch numbers; the shared-library major version number will be @@ -3809,7 +3818,7 @@ possible without all of you. Thanks to Frank J. T. Wojcik for helping with the documentation. -Libpng version 1.2.6beta3 - July 18, 2004: +Libpng version 1.2.6beta4 - July 28, 2004: Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc. Currently maintained by Glenn Randers-Pehrson (glennrp@users.sourceforge.net). @@ -3826,7 +3835,15 @@ included in the libpng distribution, the latter shall prevail.) If you modify libpng you may insert additional notices immediately following this sentence. -libpng versions 1.0.7, July 1, 2000, through 1.2.6beta3, July 18, 2004, are +libpng version 1.2.6, July 28, 2004, is +Copyright (c) 2004 Glenn Randers-Pehrson, and is +distributed according to the same disclaimer and license as libpng-1.2.5 +with the following individuals added to the list of Contributing Authors + + Cosmin Truta + - + +libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are distributed according to the same disclaimer and license as libpng-1.0.6 with the following individuals added to the list of Contributing Authors @@ -3918,7 +3935,7 @@ certification mark of the Open Source Initiative. Glenn Randers-Pehrson glennrp@users.sourceforge.net -July 18, 2004 +July 28, 2004 .\" end of man page diff --git a/libpng.txt b/libpng.txt index 98d92c734..c9771074a 100644 --- a/libpng.txt +++ b/libpng.txt @@ -1,6 +1,6 @@ libpng.txt - A description on how to use and modify libpng - libpng version 1.2.6beta3 - July 18, 2004 + libpng version 1.2.6beta4 - July 28, 2004 Updated and distributed by Glenn Randers-Pehrson <glennrp@users.sourceforge.net> Copyright (c) 1998-2004 Glenn Randers-Pehrson @@ -379,8 +379,14 @@ where row_pointers is an array of pointers to the pixel data for each row: If you know your image size and pixel size ahead of time, you can allocate row_pointers prior to calling png_read_png() with + if (height > PNG_UINT_32_MAX/png_sizeof(png_byte)) + png_error (png_ptr, + "Image is too tall to process in memory"); + if (width > PNG_UINT_32_MAX/pixel_size) + png_error (png_ptr, + "Image is too wide to process in memory"); row_pointers = png_malloc(png_ptr, - height*sizeof(png_bytep)); + height*png_sizeof(png_bytep)); for (int i=0; i<height, i++) row_pointers[i]=png_malloc(png_ptr, width*pixel_size); @@ -2320,9 +2326,9 @@ Your replacement memory functions must have prototypes as follows: png_size_t size); void free_fn(png_structp png_ptr, png_voidp ptr); -Your malloc_fn() should return NULL in case of failure. The png_malloc() -function will call png_error() if it receives a NULL from the system -memory allocator or from your replacement malloc_fn(). +Your malloc_fn() must return NULL in case of failure. The png_malloc() +function will normally call png_error() if it receives a NULL from the +system memory allocator or from your replacement malloc_fn(). Input/Output in libpng is done through png_read() and png_write(), which currently just call fread() and fwrite(). The FILE * is stored in @@ -2848,13 +2854,13 @@ application: VII. Y2K Compliance in libpng -July 18, 2004 +July 28, 2004 Since the PNG Development group is an ad-hoc body, we can't make an official declaration. This is your unofficial assurance that libpng from version 0.71 and -upward through 1.2.6beta3 are Y2K compliant. It is my belief that earlier +upward through 1.2.6beta4 are Y2K compliant. It is my belief that earlier versions were also Y2K compliant. Libpng only has three year fields. One is a 2-byte unsigned integer that diff --git a/libpngpf.3 b/libpngpf.3 index 35d646a08..c82f99bd7 100644 --- a/libpngpf.3 +++ b/libpngpf.3 @@ -1,6 +1,6 @@ -.TH LIBPNGPF 3 "July 18, 2004" +.TH LIBPNGPF 3 "July 28, 2004" .SH NAME -libpng \- Portable Network Graphics (PNG) Reference Library 1.2.6beta3 +libpng \- Portable Network Graphics (PNG) Reference Library 1.2.6beta4 (private functions) .SH SYNOPSIS \fB\fB#include <png.h>\fP\fP @@ -371,6 +371,14 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.2.6beta3 \fI\fB +\fB\fBpng_uint_32 png_get_uint_31 (png_bytep \fI\fIbuf\fP\fB\fP\fB);\fP\fP + +\fI\fB + +\fI\fB\fI\fB + +\fI\fB + \fB\fBpng_uint_32 png_get_uint_32 (png_bytep \fI\fIbuf\fP\fB\fP\fB);\fP\fP \fI\fB @@ -1,4 +1,4 @@ -.TH PNG 5 "July 18, 2004" +.TH PNG 5 "July 28, 2004" .SH NAME png \- Portable Network Graphics (PNG) format .SH DESCRIPTION @@ -1,7 +1,7 @@ /* png.c - location for general purpose libpng functions * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -13,7 +13,7 @@ #include "png.h" /* Generate a compiler error if there is an old png.h in the search path. */ -typedef version_1_2_6beta3 Your_png_h_is_not_version_1_2_6beta3; +typedef version_1_2_6beta4 Your_png_h_is_not_version_1_2_6beta4; /* Version information for C files. This had better match the version * string defined in png.h. */ @@ -142,16 +142,23 @@ voidpf /* private */ #endif png_zalloc(voidpf png_ptr, uInt items, uInt size) { - png_uint_32 num_bytes = (png_uint_32)items * size; png_voidp ptr; png_structp p=png_ptr; png_uint_32 save_flags=p->flags; + png_uint_32 num_bytes; + + if (items > PNG_UINT_32_MAX/size) + { + png_warning (png_ptr, "Potential overflow in png_zalloc()"); + return (NULL); + } + num_bytes = (png_uint_32)items * size; p->flags|=PNG_FLAG_MALLOC_NULL_MEM_OK; ptr = (png_voidp)png_malloc((png_structp)png_ptr, num_bytes); p->flags=save_flags; -#ifndef PNG_NO_ZALLOC_ZERO +#if defined(PNG_1_0_X) && !defined(PNG_NO_ZALLOC_ZERO) if (ptr == NULL) return ((voidpf)ptr); @@ -217,7 +224,7 @@ png_calculate_crc(png_structp png_ptr, png_bytep ptr, png_size_t length) /* Allocate the memory for an info_struct for the application. We don't * really need the png_ptr, but it could potentially be useful in the - * future. This should be used in favour of malloc(sizeof(png_info)) + * future. This should be used in favour of malloc(png_sizeof(png_info)) * and png_info_init() so that applications that want to use a shared * libpng don't have to be recompiled if png_info changes size. */ @@ -235,7 +242,7 @@ png_create_info_struct(png_structp png_ptr) info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO); #endif if (info_ptr != NULL) - png_info_init_3(&info_ptr, sizeof(png_info)); + png_info_init_3(&info_ptr, png_sizeof(png_info)); return (info_ptr); } @@ -287,7 +294,7 @@ png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size) png_debug(1, "in png_info_init_3\n"); - if(sizeof(png_info) > png_info_struct_size) + if(png_sizeof(png_info) > png_info_struct_size) { png_destroy_struct(info_ptr); info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO); @@ -295,7 +302,7 @@ png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size) } /* set everything to 0 */ - png_memset(info_ptr, 0, sizeof (png_info)); + png_memset(info_ptr, 0, png_sizeof (png_info)); } #ifdef PNG_FREE_ME_SUPPORTED @@ -581,7 +588,7 @@ png_info_destroy(png_structp png_ptr, png_infop info_ptr) } #endif - png_info_init_3(&info_ptr, sizeof(png_info)); + png_info_init_3(&info_ptr, png_sizeof(png_info)); } /* This function returns a pointer to the io_ptr associated with the user @@ -623,7 +630,7 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime) if (png_ptr->time_buffer == NULL) { png_ptr->time_buffer = (png_charp)png_malloc(png_ptr, (png_uint_32)(29* - sizeof(char))); + png_sizeof(char))); } #if defined(_WIN32_WCE) @@ -645,7 +652,7 @@ png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime) ptime->year, ptime->hour % 24, ptime->minute % 60, ptime->second % 61); png_memcpy(png_ptr->time_buffer, near_time_buf, - 29*sizeof(char)); + 29*png_sizeof(char)); } #else sprintf(png_ptr->time_buffer, "%d %s %d %02d:%02d:%02d +0000", @@ -671,9 +678,8 @@ png_charp PNGAPI png_get_copyright(png_structp png_ptr) { if (&png_ptr != NULL) /* silence compiler warning about unused png_ptr */ - return ((png_charp) "\n libpng version 1.2.6beta3 - July 18, 2004\n\ - Copyright (c) 2003-2004 Cosmin Truta\n\ - Copyright (c) 1998-2002 Glenn Randers-Pehrson\n\ + return ((png_charp) "\n libpng version 1.2.6beta4 - July 28, 2004\n\ + Copyright (c) 1998-2004 Glenn Randers-Pehrson\n\ Copyright (c) 1996-1997 Andreas Dilger\n\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\n"); return ((png_charp) ""); @@ -806,3 +812,15 @@ png_mmx_support(void) } #endif #endif /* PNG_1_0_X */ + +#ifdef PNG_SIZE_T +/* Added at libpng version 1.2.6 */ + PNG_EXTERN png_size_t PNGAPI png_convert_size PNGARG((size_t size)); +png_size_t PNGAPI +png_convert_size(size_t size) +{ + if (size > (png_size_t)-1) + PNG_ABORT(); /* We haven't got access to png_ptr, so no png_error() */ + return ((png_size_t)size); +} +#endif /* PNG_SIZE_T */ @@ -1,6 +1,6 @@ /* png.h - header file for PNG reference library * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -8,7 +8,7 @@ * Authors and maintainers: * libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat * libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger - * libpng versions 0.97, January 1998, through 1.2.6beta3 - July 18, 2004: Glenn + * libpng versions 0.97, January 1998, through 1.2.6beta4 - July 28, 2004: Glenn * See also "Contributing Authors", below. * * Note about libpng version numbers: @@ -98,7 +98,7 @@ * 1.2.5rc1-3 13 10205 12.so.0.1.2.5rc1-3 * 1.0.15 10 10015 10.so.0.1.0.15 * 1.2.5 13 10205 12.so.0.1.2.5 - * 1.2.6beta4 13 10206 12.so.0.1.2.6beta4 + * 1.2.6beta1-4 13 10206 12.so.0.1.2.6beta1-4 * * Henceforth the source version will match the shared-library major * and minor numbers; the shared-library major version number will be @@ -128,8 +128,16 @@ * If you modify libpng you may insert additional notices immediately following * this sentence. * - * libpng versions 1.0.7, July 1, 2000, through 1.2.6beta3 - July 18, 2004, are - * Copyright (c) 2000-2004 Glenn Randers-Pehrson, and are + * libpng version 1.2.6, July 28, 2004, is + * Copyright (c) 2004 Glenn Randers-Pehrson, and is + * distributed according to the same disclaimer and license as libpng-1.2.5 + * with the following individuals added to the list of Contributing Authors + * + * Cosmin Truta + * - + * + * libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are + * Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are * distributed according to the same disclaimer and license as libpng-1.0.6 * with the following individuals added to the list of Contributing Authors * @@ -233,13 +241,13 @@ * Y2K compliance in libpng: * ========================= * - * July 18, 2004 + * July 28, 2004 * * Since the PNG Development group is an ad-hoc body, we can't make * an official declaration. * * This is your unofficial assurance that libpng from version 0.71 and - * upward through 1.2.6beta3 are Y2K compliant. It is my belief that earlier + * upward through 1.2.6beta4 are Y2K compliant. It is my belief that earlier * versions were also Y2K compliant. * * Libpng only has three year fields. One is a 2-byte unsigned integer @@ -295,9 +303,9 @@ */ /* Version information for png.h - this should match the version in png.c */ -#define PNG_LIBPNG_VER_STRING "1.2.6beta3" +#define PNG_LIBPNG_VER_STRING "1.2.6beta4" #define PNG_HEADER_VERSION_STRING \ - " libpng version 1.2.6beta3 - July 18, 2004 (header)\n" + " libpng version 1.2.6beta4 - July 28, 2004 (header)\n" #define PNG_LIBPNG_VER_SONUM 0 #define PNG_LIBPNG_VER_DLLNUM %DLLNUM% @@ -309,7 +317,7 @@ /* This should match the numeric part of the final component of * PNG_LIBPNG_VER_STRING, omitting any leading zero: */ -#define PNG_LIBPNG_VER_BUILD 3 +#define PNG_LIBPNG_VER_BUILD 4 #define PNG_LIBPNG_BUILD_ALPHA 1 #define PNG_LIBPNG_BUILD_BETA 2 @@ -836,7 +844,11 @@ typedef png_info FAR * png_infop; typedef png_info FAR * FAR * png_infopp; /* Maximum positive integer used in PNG is (2^31)-1 */ -#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) +#define PNG_UINT_32_MAX (~((png_uint_32)0)) +#define PNG_SIZE_MAX (~((png_size_t)0)) +/* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */ +#define PNG_MAX_UINT PNG_UINT_31_MAX /* These describe the color_type field in png_info. */ /* color type masks */ @@ -1291,7 +1303,7 @@ struct png_struct_def /* This triggers a compiler error in png.c, if png.c and png.h * do not agree upon the version number. */ -typedef png_structp version_1_2_6beta3; +typedef png_structp version_1_2_6beta4; typedef png_struct FAR * FAR * png_structpp; @@ -1333,11 +1345,15 @@ extern PNG_EXPORT(png_structp,png_create_write_struct) PNGARG((png_const_charp user_png_ver, png_voidp error_ptr, png_error_ptr error_fn, png_error_ptr warn_fn)); +#ifdef PNG_WRITE_SUPPORTED extern PNG_EXPORT(png_uint_32,png_get_compression_buffer_size) PNGARG((png_structp png_ptr)); +#endif +#ifdef PNG_WRITE_SUPPORTED extern PNG_EXPORT(void,png_set_compression_buffer_size) PNGARG((png_structp png_ptr, png_uint_32 size)); +#endif /* Reset the compression stream */ extern PNG_EXPORT(int,png_reset_zstream) PNGARG((png_structp png_ptr)); @@ -1376,7 +1392,8 @@ extern PNG_EXPORT(png_infop,png_create_info_struct) /* Initialize the info structure (old interface - DEPRECATED) */ extern PNG_EXPORT(void,png_info_init) PNGARG((png_infop info_ptr)); #undef png_info_init -#define png_info_init(info_ptr) png_info_init_3(&info_ptr, sizeof(png_info)); +#define png_info_init(info_ptr) png_info_init_3(&info_ptr,\ + png_sizeof(png_info)); extern PNG_EXPORT(void,png_info_init_3) PNGARG((png_infopp info_ptr, png_size_t png_info_struct_size)); @@ -1386,9 +1403,11 @@ extern PNG_EXPORT(void,png_write_info_before_PLTE) PNGARG((png_structp png_ptr, extern PNG_EXPORT(void,png_write_info) PNGARG((png_structp png_ptr, png_infop info_ptr)); +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* read the information before the actual image data. */ extern PNG_EXPORT(void,png_read_info) PNGARG((png_structp png_ptr, png_infop info_ptr)); +#endif #if defined(PNG_TIME_RFC1123_SUPPORTED) extern PNG_EXPORT(png_charp,png_convert_to_rfc1123) @@ -1551,18 +1570,24 @@ extern PNG_EXPORT(void,png_start_read_image) PNGARG((png_structp png_ptr)); extern PNG_EXPORT(void,png_read_update_info) PNGARG((png_structp png_ptr, png_infop info_ptr)); +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* read one or more rows of image data. */ extern PNG_EXPORT(void,png_read_rows) PNGARG((png_structp png_ptr, png_bytepp row, png_bytepp display_row, png_uint_32 num_rows)); +#endif +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* read a row of data. */ extern PNG_EXPORT(void,png_read_row) PNGARG((png_structp png_ptr, png_bytep row, png_bytep display_row)); +#endif +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* read the whole image into memory at once. */ extern PNG_EXPORT(void,png_read_image) PNGARG((png_structp png_ptr, png_bytepp image)); +#endif /* write a row of image data */ extern PNG_EXPORT(void,png_write_row) PNGARG((png_structp png_ptr, @@ -1580,9 +1605,11 @@ extern PNG_EXPORT(void,png_write_image) PNGARG((png_structp png_ptr, extern PNG_EXPORT(void,png_write_end) PNGARG((png_structp png_ptr, png_infop info_ptr)); +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* read the end of the PNG file. */ extern PNG_EXPORT(void,png_read_end) PNGARG((png_structp png_ptr, png_infop info_ptr)); +#endif /* free any memory associated with the png_info_struct */ extern PNG_EXPORT(void,png_destroy_info_struct) PNGARG((png_structp png_ptr, @@ -2657,6 +2684,8 @@ PNG_EXTERN png_int_32 png_get_int_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); #endif /* !PNG_READ_BIG_ENDIAN_SUPPORTED */ +PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr, + png_bytep buf)); /* Initialize png_ptr struct for reading, and allocate any other memory. * (old interface - DEPRECATED - use png_create_read_struct instead). @@ -2664,7 +2693,7 @@ PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); extern PNG_EXPORT(void,png_read_init) PNGARG((png_structp png_ptr)); #undef png_read_init #define png_read_init(png_ptr) png_read_init_3(&png_ptr, \ - PNG_LIBPNG_VER_STRING, sizeof(png_struct)); + PNG_LIBPNG_VER_STRING, png_sizeof(png_struct)); extern PNG_EXPORT(void,png_read_init_3) PNGARG((png_structpp ptr_ptr, png_const_charp user_png_ver, png_size_t png_struct_size)); extern PNG_EXPORT(void,png_read_init_2) PNGARG((png_structp png_ptr, @@ -2677,7 +2706,7 @@ extern PNG_EXPORT(void,png_read_init_2) PNGARG((png_structp png_ptr, extern PNG_EXPORT(void,png_write_init) PNGARG((png_structp png_ptr)); #undef png_write_init #define png_write_init(png_ptr) png_write_init_3(&png_ptr, \ - PNG_LIBPNG_VER_STRING, sizeof(png_struct)); + PNG_LIBPNG_VER_STRING, png_sizeof(png_struct)); extern PNG_EXPORT(void,png_write_init_3) PNGARG((png_structpp ptr_ptr, png_const_charp user_png_ver, png_size_t png_struct_size)); extern PNG_EXPORT(void,png_write_init_2) PNGARG((png_structp png_ptr, @@ -2706,6 +2735,11 @@ PNG_EXTERN voidpf png_zalloc PNGARG((voidpf png_ptr, uInt items, uInt size)); /* Function to free memory for zlib */ PNG_EXTERN void png_zfree PNGARG((voidpf png_ptr, voidpf ptr)); +#ifdef PNG_SIZE_T +/* Function to convert a sizeof an item to png_sizeof item */ + PNG_EXTERN png_size_t PNGAPI png_convert_size PNGARG((size_t size)); +#endif + /* Next four functions are used internally as callbacks. PNGAPI is required * but not PNG_EXPORT. PNGAPI added at libpng version 1.2.3. */ diff --git a/pngasmrd.h b/pngasmrd.h index ffa3a2fb7..49ec4e2bf 100644 --- a/pngasmrd.h +++ b/pngasmrd.h @@ -1,6 +1,6 @@ /* pngasmrd.h - assembler version of utilities to read a PNG file * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 2002-2004 Glenn Randers-Pehrson * @@ -1,7 +1,7 @@ /* pngconf.h - machine configurable file for libpng * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -257,8 +257,11 @@ # undef _BSD_SOURCE # endif # ifdef _SETJMP_H - __png.h__ already includes setjmp.h; - __dont__ include it again.; + /* If you encounter a compiler error here, see the explanation + * near the end of INSTALL. + */ + __png.h__ already includes setjmp.h; + __dont__ include it again.; # endif # endif /* __linux__ */ @@ -991,7 +994,13 @@ typedef unsigned char png_byte; /* This is usually size_t. It is typedef'ed just in case you need it to change (I'm not sure if you will or not, so I thought I'd be safe) */ -typedef size_t png_size_t; +#ifdef PNG_SIZE_T + typedef PNG_SIZE_T png_size_t; +# define png_sizeof(x) png_convert_size(sizeof (x)) +#else + typedef size_t png_size_t; +# define png_sizeof(x) sizeof (x) +#endif /* The following is needed for medium model support. It cannot be in the * PNG_INTERNAL section. Needs modification for other compilers besides diff --git a/pngerror.c b/pngerror.c index ca3e4efbc..2c50d4760 100644 --- a/pngerror.c +++ b/pngerror.c @@ -1,7 +1,7 @@ /* pngerror.c - stub functions for i/o and memory allocation * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -199,7 +199,7 @@ png_default_error(png_structp png_ptr, png_const_charp error_message) # ifdef USE_FAR_KEYWORD { jmp_buf jmpbuf; - png_memcpy(jmpbuf,png_ptr->jmpbuf,sizeof(jmp_buf)); + png_memcpy(jmpbuf,png_ptr->jmpbuf,png_sizeof(jmp_buf)); longjmp(jmpbuf, 1); } # else diff --git a/pnggccrd.c b/pnggccrd.c index d9f0424ac..df0bf22b2 100644 --- a/pnggccrd.c +++ b/pnggccrd.c @@ -6,7 +6,7 @@ * and http://www.intel.com/drg/pentiumII/appnotes/923/923.htm * for Intel's performance analysis of the MMX vs. non-MMX code. * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * Copyright (c) 1998, Intel Corporation @@ -223,6 +223,10 @@ * 20020304: * - eliminated incorrect use of width_mmx in pixel_bytes == 8 case * + * 20040724: + * - more tinkering with clobber list at lines 4529 and 5033, to get + * it to compile on gcc-3.4. + * * STILL TO DO: * - test png_do_read_interlace() 64-bit case (pixel_bytes == 8) * - write MMX code for 48-bit case (pixel_bytes == 6) @@ -4531,8 +4535,7 @@ png_read_filter_row_mmx_sub(png_row_infop row_info, png_bytep row) : "0" (bpp), // eax // input regs "1" (row) // edi - : "%ebx", "%ecx", "%edx" // clobber list - , "%esi" + : "%esi", "%ecx", "%edx" // clobber list #if 0 /* MMX regs (%mm0, etc.) not supported by gcc 2.7.2.3 or egcs 1.1 */ , "%mm0", "%mm1", "%mm2", "%mm3" @@ -5036,7 +5039,10 @@ png_read_filter_row_mmx_up(png_row_infop row_info, png_bytep row, "1" (prev_row), // esi "2" (row) // edi - : "%eax", "%ebx", "%ecx" // clobber list (no input regs!) + : "%eax", "%ecx" // clobber list (no input regs!) +#ifndef __PIC__ + , "%ebx" +#endif #if 0 /* MMX regs (%mm0, etc.) not supported by gcc 2.7.2.3 or egcs 1.1 */ , "%mm0", "%mm1", "%mm2", "%mm3" @@ -1,7 +1,7 @@ /* pngget.c - retrieval of values from info struct * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -570,11 +570,11 @@ png_get_IHDR(png_structp png_ptr, png_infop info_ptr, channels++; pixel_depth = *bit_depth * channels; rowbytes_per_pixel = (pixel_depth + 7) >> 3; - if (width == 0 || *width > PNG_MAX_UINT) + if (width == 0 || *width > PNG_UINT_31_MAX) png_error(png_ptr, "Invalid image width"); - if (height == 0 || *height > PNG_MAX_UINT) + if (height == 0 || *height > PNG_UINT_31_MAX) png_error(png_ptr, "Invalid image height"); - if (*width > PNG_MAX_UINT/rowbytes_per_pixel - 64) + if (*width > PNG_UINT_32_MAX/rowbytes_per_pixel - 64) { png_error(png_ptr, "Width too large for libpng to process image data."); @@ -827,13 +827,13 @@ png_get_user_chunk_ptr(png_structp png_ptr) } #endif - +#ifdef PNG_WRITE_SUPPORTED png_uint_32 PNGAPI png_get_compression_buffer_size(png_structp png_ptr) { return (png_uint_32)(png_ptr? png_ptr->zbuf_size : 0L); } - +#endif #ifndef PNG_1_0_X #ifdef PNG_ASSEMBLER_CODE_SUPPORTED @@ -1,7 +1,7 @@ /* pngmem.c - stub functions for memory allocation * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -39,9 +39,9 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr) png_voidp struct_ptr; if (type == PNG_STRUCT_INFO) - size = sizeof(png_info); + size = png_sizeof(png_info); else if (type == PNG_STRUCT_PNG) - size = sizeof(png_struct); + size = png_sizeof(png_struct); else return (png_get_copyright(NULL)); @@ -121,14 +121,12 @@ png_malloc(png_structp png_ptr, png_uint_32 size) #ifdef PNG_USER_MEM_SUPPORTED if(png_ptr->malloc_fn != NULL) - { ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size)); - if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) - png_error(png_ptr, "Out of memory!"); - return (ret); - } else - return png_malloc_default(png_ptr, size); + ret = (png_malloc_default(png_ptr, size)); + if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) + png_error(png_ptr, "Out of memory!"); + return (ret); } png_voidp PNGAPI @@ -139,10 +137,16 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) #ifdef PNG_MAX_MALLOC_64K if (size > (png_uint_32)65536L) - png_error(png_ptr, "Cannot Allocate > 64K"); + { + png_warning(png_ptr, "Cannot Allocate > 64K"); + ret = NULL; + } + else #endif - if (size == (png_uint_32)65536L) + if (size != (size_t)size) + ret = NULL; + else if (size == (png_uint_32)65536L) { if (png_ptr->offset_table == NULL) { @@ -177,34 +181,40 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) if (table == NULL) { +#ifndef PNG_USER_MEM_SUPPORTED if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out Of Memory."); /* Note "O" and "M" */ else png_warning(png_ptr, "Out Of Memory."); +#endif return (NULL); } if ((png_size_t)table & 0xfff0) { +#ifndef PNG_USER_MEM_SUPPORTED if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Farmalloc didn't return normalized pointer"); else png_warning(png_ptr, "Farmalloc didn't return normalized pointer"); +#endif return (NULL); } png_ptr->offset_table = table; png_ptr->offset_table_ptr = farmalloc(num_blocks * - sizeof (png_bytep)); + png_sizeof (png_bytep)); if (png_ptr->offset_table_ptr == NULL) { +#ifndef PNG_USER_MEM_SUPPORTED if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out Of memory."); /* Note "O" and "M" */ else png_warning(png_ptr, "Out Of memory."); +#endif return (NULL); } @@ -228,10 +238,12 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) if (png_ptr->offset_table_count >= png_ptr->offset_table_number) { +#ifndef PNG_USER_MEM_SUPPORTED if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out of Memory."); /* Note "o" and "M" */ else png_warning(png_ptr, "Out of Memory."); +#endif return (NULL); } @@ -240,6 +252,7 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) else ret = farmalloc(size); +#ifndef PNG_USER_MEM_SUPPORTED if (ret == NULL) { if ((png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) @@ -247,6 +260,7 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) else png_warning(png_ptr, "Out of memory."); /* Note "o" and "m" */ } +#endif return (ret); } @@ -325,9 +339,9 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr) png_voidp struct_ptr; if (type == PNG_STRUCT_INFO) - size = sizeof(png_info); + size = png_sizeof(png_info); else if (type == PNG_STRUCT_PNG) - size = sizeof(png_struct); + size = png_sizeof(png_struct); else return (NULL); @@ -345,17 +359,16 @@ png_create_struct_2(int type, png_malloc_ptr malloc_fn, png_voidp mem_ptr) #endif /* PNG_USER_MEM_SUPPORTED */ #if defined(__TURBOC__) && !defined(__FLAT__) - if ((struct_ptr = (png_voidp)farmalloc(size)) != NULL) + struct_ptr = (png_voidp)farmalloc(size); #else # if defined(_MSC_VER) && defined(MAXSEG_64K) - if ((struct_ptr = (png_voidp)halloc(size,1)) != NULL) + struct_ptr = (png_voidp)halloc(size,1); # else - if ((struct_ptr = (png_voidp)malloc(size)) != NULL) + struct_ptr = (png_voidp)malloc(size); # endif #endif - { + if (struct_ptr != NULL) png_memset(struct_ptr, 0, size); - } return (struct_ptr); } @@ -415,14 +428,12 @@ png_malloc(png_structp png_ptr, png_uint_32 size) #ifdef PNG_USER_MEM_SUPPORTED if(png_ptr->malloc_fn != NULL) - { ret = ((png_voidp)(*(png_ptr->malloc_fn))(png_ptr, (png_size_t)size)); - if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) - png_error(png_ptr, "Out of Memory!"); - return (ret); - } else - return (png_malloc_default(png_ptr, size)); + ret = (png_malloc_default(png_ptr, size)); + if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) + png_error(png_ptr, "Out of Memory!"); + return (ret); } png_voidp PNGAPI @@ -434,25 +445,39 @@ png_malloc_default(png_structp png_ptr, png_uint_32 size) #ifdef PNG_MAX_MALLOC_64K if (size > (png_uint_32)65536L) { +#ifndef PNG_USER_MEM_SUPPORTED if(png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Cannot Allocate > 64K"); else +#endif return NULL; } #endif + /* Check for overflow */ #if defined(__TURBOC__) && !defined(__FLAT__) + if (size != (unsigned long)size) + ret = NULL; + else ret = farmalloc(size); #else # if defined(_MSC_VER) && defined(MAXSEG_64K) + if (size != (unsigned long)size) + ret = NULL; + else ret = halloc(size, 1); # else + if (size != (size_t)size) + ret = NULL; + else ret = malloc((size_t)size); # endif #endif +#ifndef PNG_USER_MEM_SUPPORTED if (ret == NULL && (png_ptr->flags&PNG_FLAG_MALLOC_NULL_MEM_OK) == 0) png_error(png_ptr, "Out of Memory"); +#endif return (ret); } @@ -498,8 +523,9 @@ png_free_default(png_structp png_ptr, png_voidp ptr) # define png_malloc_warn png_malloc #else /* This function was added at libpng version 1.2.3. The png_malloc_warn() - * function will issue a png_warning and return NULL instead of issuing a - * png_error, if it fails to allocate the requested memory. + * function will set up png_malloc() to issue a png_warning and return NULL + * instead of issuing a png_error, if it fails to allocate the requested + * memory. */ png_voidp PNGAPI png_malloc_warn(png_structp png_ptr, png_uint_32 size) diff --git a/pngpread.c b/pngpread.c index 12b258b87..46d800a31 100644 --- a/pngpread.c +++ b/pngpread.c @@ -1,7 +1,7 @@ /* pngpread.c - read a png file in push mode * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -208,7 +208,7 @@ png_push_read_chunk(png_structp png_ptr, png_infop info_ptr) } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@ -591,6 +591,11 @@ png_push_save_buffer(png_structp png_ptr) png_size_t new_max; png_bytep old_buffer; + if (png_ptr->save_buffer_size > PNG_SIZE_MAX - + (png_ptr->current_buffer_size + 256)) + { + png_error(png_ptr, "Potential overflow of save_buffer"); + } new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, @@ -637,8 +642,7 @@ png_push_read_IDAT(png_structp png_ptr) } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); - + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@ -1094,7 +1098,8 @@ png_push_read_tEXt(png_structp png_ptr, png_infop info_ptr) if (text != key + png_ptr->current_text_size) text++; - text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc(png_ptr, + (png_uint_32)png_sizeof(png_text)); text_ptr->compression = PNG_TEXT_COMPRESSION_NONE; text_ptr->key = key; #ifdef PNG_iTXt_SUPPORTED @@ -1287,7 +1292,8 @@ png_push_read_zTXt(png_structp png_ptr, png_infop info_ptr) key = text; text += key_size; - text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc(png_ptr, + (png_uint_32)png_sizeof(png_text)); text_ptr->compression = PNG_TEXT_COMPRESSION_zTXt; text_ptr->key = key; #ifdef PNG_iTXt_SUPPORTED @@ -1399,7 +1405,8 @@ png_push_read_iTXt(png_structp png_ptr, png_infop info_ptr) if (text != key + png_ptr->current_text_size) text++; - text_ptr = (png_textp)png_malloc(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc(png_ptr, + (png_uint_32)png_sizeof(png_text)); text_ptr->compression = comp_flag + 2; text_ptr->key = key; text_ptr->lang = lang; @@ -1,7 +1,7 @@ /* pngread.c - read a PNG file * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -77,7 +77,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, return (NULL); } #ifdef USE_FAR_KEYWORD - png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf)); #endif #endif @@ -154,7 +154,7 @@ png_create_read_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, #ifdef USE_FAR_KEYWORD if (setjmp(jmpbuf)) PNG_ABORT(); - png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf)); #else if (setjmp(png_ptr->jmpbuf)) PNG_ABORT(); @@ -180,7 +180,8 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver, { /* We only come here via pre-1.0.12-compiled applications */ #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE) - if(sizeof(png_struct) > png_struct_size || sizeof(png_info) > png_info_size) + if(png_sizeof(png_struct) > png_struct_size || + png_sizeof(png_info) > png_info_size) { char msg[80]; png_ptr->warning_fn=NULL; @@ -195,7 +196,7 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver, png_warning(png_ptr, msg); } #endif - if(sizeof(png_struct) > png_struct_size) + if(png_sizeof(png_struct) > png_struct_size) { png_ptr->error_fn=NULL; #ifdef PNG_ERROR_NUMBERS_SUPPORTED @@ -204,7 +205,7 @@ png_read_init_2(png_structp png_ptr, png_const_charp user_png_ver, png_error(png_ptr, "The png struct allocated by the application for reading is too small."); } - if(sizeof(png_info) > png_info_size) + if(png_sizeof(png_info) > png_info_size) { png_ptr->error_fn=NULL; #ifdef PNG_ERROR_NUMBERS_SUPPORTED @@ -247,10 +248,10 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, #ifdef PNG_SETJMP_SUPPORTED /* save jump buffer and error functions */ - png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf)); + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf)); #endif - if(sizeof(png_struct) > png_struct_size) + if(png_sizeof(png_struct) > png_struct_size) { png_destroy_struct(png_ptr); *ptr_ptr = (png_structp)png_create_struct(PNG_STRUCT_PNG); @@ -258,11 +259,11 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, } /* reset all variables to 0 */ - png_memset(png_ptr, 0, sizeof (png_struct)); + png_memset(png_ptr, 0, png_sizeof (png_struct)); #ifdef PNG_SETJMP_SUPPORTED /* restore jump buffer */ - png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf)); + png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf)); #endif /* initialize zbuf - compression buffer */ @@ -288,6 +289,7 @@ png_read_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, png_set_read_fn(png_ptr, png_voidp_NULL, png_rw_ptr_NULL); } +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Read the information before the actual image data. This has been * changed in v0.90 to allow reading a file that already has the magic * bytes read from the stream. You can tell libpng how many bytes have @@ -384,7 +386,7 @@ png_read_info(png_structp png_ptr, png_infop info_ptr) png_uint_32 length; png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@ -392,9 +394,6 @@ png_read_info(png_structp png_ptr, png_infop info_ptr) png_debug2(0, "Reading %s chunk, length=%lu.\n", png_ptr->chunk_name, length); - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); - /* This should be a binary subdivision search or a hash for * matching the chunk name rather than a linear search. */ @@ -507,6 +506,7 @@ png_read_info(png_structp png_ptr, png_infop info_ptr) png_handle_unknown(png_ptr, info_ptr, length); } } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ /* optional call to update the users info_ptr structure */ void PNGAPI @@ -521,6 +521,7 @@ png_read_update_info(png_structp png_ptr, png_infop info_ptr) png_read_transform_info(png_ptr, info_ptr); } +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Initialize palette, background, etc, after transformations * are set, but before any reading takes place. This allows * the user to obtain a gamma-corrected palette, for example. @@ -533,7 +534,9 @@ png_start_read_image(png_structp png_ptr) if (!(png_ptr->flags & PNG_FLAG_ROW_INIT)) png_read_start_row(png_ptr); } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED void PNGAPI png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) { @@ -673,10 +676,7 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); - - if (png_ptr->idat_size > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); + png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@ -767,7 +767,9 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) if (png_ptr->read_row_fn != NULL) (*(png_ptr->read_row_fn))(png_ptr, png_ptr->row_number, png_ptr->pass); } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Read one or more rows of image data. If the image is interlaced, * and png_set_interlace_handling() has been called, the rows need to * contain the contents of the rows from the previous pass. If the @@ -789,7 +791,7 @@ png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row) * not called png_set_interlace_handling(), the display_row buffer will * be ignored, so pass NULL to it. * - * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.6beta3 + * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.6beta4 */ void PNGAPI @@ -826,7 +828,9 @@ png_read_rows(png_structp png_ptr, png_bytepp row, dp++; } } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Read the entire image. If the image has an alpha channel or a tRNS * chunk, and you have called png_handle_alpha()[*], you will need to * initialize the image to the current image that PNG will be overlaying. @@ -837,7 +841,7 @@ png_read_rows(png_structp png_ptr, png_bytepp row, * only call this function once. If you desire to have an image for * each pass of a interlaced image, use png_read_rows() instead. * - * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.6beta3 + * [*] png_handle_alpha() does not exist yet, as of libpng version 1.2.6beta4 */ void PNGAPI png_read_image(png_structp png_ptr, png_bytepp image) @@ -871,7 +875,9 @@ png_read_image(png_structp png_ptr, png_bytepp image) } } } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED /* Read the end of the PNG file. Will not read past the end of the * file, will verify the end is accurate, and will read any comments * or time information at the end of the file, if info is not NULL. @@ -946,16 +952,13 @@ png_read_end(png_structp png_ptr, png_infop info_ptr) #endif /* PNG_GLOBAL_ARRAYS */ png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name); - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); - if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4)) png_handle_IHDR(png_ptr, info_ptr, length); else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4)) @@ -1058,6 +1061,7 @@ png_read_end(png_structp png_ptr, png_infop info_ptr) png_handle_unknown(png_ptr, info_ptr, length); } while (!(png_ptr->mode & PNG_HAVE_IEND)); } +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ /* free all memory used by the read */ void PNGAPI @@ -1249,7 +1253,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr * being used again. */ #ifdef PNG_SETJMP_SUPPORTED - png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf)); + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf)); #endif error_fn = png_ptr->error_fn; @@ -1259,7 +1263,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr free_fn = png_ptr->free_fn; #endif - png_memset(png_ptr, 0, sizeof (png_struct)); + png_memset(png_ptr, 0, png_sizeof (png_struct)); png_ptr->error_fn = error_fn; png_ptr->warning_fn = warning_fn; @@ -1269,7 +1273,7 @@ png_read_destroy(png_structp png_ptr, png_infop info_ptr, png_infop end_info_ptr #endif #ifdef PNG_SETJMP_SUPPORTED - png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf)); + png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf)); #endif } @@ -1280,6 +1284,8 @@ png_set_read_status_fn(png_structp png_ptr, png_read_status_ptr read_row_fn) png_ptr->read_row_fn = read_row_fn; } + +#ifndef PNG_NO_SEQUENTIAL_READ_SUPPORTED #if defined(PNG_INFO_IMAGE_SUPPORTED) void PNGAPI png_read_png(png_structp png_ptr, png_infop info_ptr, @@ -1400,7 +1406,7 @@ png_read_png(png_structp png_ptr, png_infop info_ptr, if(info_ptr->row_pointers == NULL) { info_ptr->row_pointers = (png_bytepp)png_malloc(png_ptr, - info_ptr->height * sizeof(png_bytep)); + info_ptr->height * png_sizeof(png_bytep)); #ifdef PNG_FREE_ME_SUPPORTED info_ptr->free_me |= PNG_FREE_ROWS; #endif @@ -1422,3 +1428,4 @@ png_read_png(png_structp png_ptr, png_infop info_ptr, } #endif +#endif /* PNG_NO_SEQUENTIAL_READ_SUPPORTED */ @@ -1,7 +1,7 @@ /* pngrio.c - functions for data input * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) diff --git a/pngrtran.c b/pngrtran.c index 89f0e5592..778a06ced 100644 --- a/pngrtran.c +++ b/pngrtran.c @@ -1,7 +1,7 @@ /* pngrtran.c - transforms the data in a row for PNG readers * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -85,7 +85,8 @@ png_set_background(png_structp png_ptr, } png_ptr->transformations |= PNG_BACKGROUND; - png_memcpy(&(png_ptr->background), background_color, sizeof(png_color_16)); + png_memcpy(&(png_ptr->background), background_color, + png_sizeof(png_color_16)); png_ptr->background_gamma = (float)background_gamma; png_ptr->background_gamma_type = (png_byte)(background_gamma_code); png_ptr->transformations |= (need_expand ? PNG_BACKGROUND_EXPAND : 0); @@ -154,7 +155,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette, int i; png_ptr->dither_index = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * sizeof (png_byte))); + (png_uint_32)(num_palette * png_sizeof (png_byte))); for (i = 0; i < num_palette; i++) png_ptr->dither_index[i] = (png_byte)i; } @@ -170,7 +171,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette, /* initialize an array to sort colors */ png_ptr->dither_sort = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * sizeof (png_byte))); + (png_uint_32)(num_palette * png_sizeof (png_byte))); /* initialize the dither_sort array */ for (i = 0; i < num_palette; i++) @@ -299,9 +300,9 @@ png_set_dither(png_structp png_ptr, png_colorp palette, /* initialize palette index arrays */ png_ptr->index_to_palette = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * sizeof (png_byte))); + (png_uint_32)(num_palette * png_sizeof (png_byte))); png_ptr->palette_to_index = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(num_palette * sizeof (png_byte))); + (png_uint_32)(num_palette * png_sizeof (png_byte))); /* initialize the sort array */ for (i = 0; i < num_palette; i++) @@ -311,10 +312,10 @@ png_set_dither(png_structp png_ptr, png_colorp palette, } hash = (png_dsortpp)png_malloc(png_ptr, (png_uint_32)(769 * - sizeof (png_dsortp))); + png_sizeof (png_dsortp))); for (i = 0; i < 769; i++) hash[i] = NULL; -/* png_memset(hash, 0, 769 * sizeof (png_dsortp)); */ +/* png_memset(hash, 0, 769 * png_sizeof (png_dsortp)); */ num_new_palette = num_palette; @@ -344,7 +345,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette, { t = (png_dsortp)png_malloc_warn(png_ptr, - (png_uint_32)(sizeof(png_dsort))); + (png_uint_32)(png_sizeof(png_dsort))); if (t == NULL) break; t->next = hash[d]; @@ -462,14 +463,15 @@ png_set_dither(png_structp png_ptr, png_colorp palette, png_size_t num_entries = ((png_size_t)1 << total_bits); png_ptr->palette_lookup = (png_bytep )png_malloc(png_ptr, - (png_uint_32)(num_entries * sizeof (png_byte))); + (png_uint_32)(num_entries * png_sizeof (png_byte))); - png_memset(png_ptr->palette_lookup, 0, num_entries * sizeof (png_byte)); + png_memset(png_ptr->palette_lookup, 0, num_entries * + png_sizeof (png_byte)); distance = (png_bytep)png_malloc(png_ptr, (png_uint_32)(num_entries * - sizeof(png_byte))); + png_sizeof(png_byte))); - png_memset(distance, 0xff, num_entries * sizeof(png_byte)); + png_memset(distance, 0xff, num_entries * png_sizeof(png_byte)); for (i = 0; i < num_palette; i++) { @@ -4005,7 +4007,7 @@ png_build_gamma_table(png_structp png_ptr) g = 1.0; png_ptr->gamma_16_table = (png_uint_16pp)png_malloc(png_ptr, - (png_uint_32)(num * sizeof (png_uint_16p))); + (png_uint_32)(num * png_sizeof (png_uint_16p))); if (png_ptr->transformations & (PNG_16_TO_8 | PNG_BACKGROUND)) { @@ -4015,7 +4017,7 @@ png_build_gamma_table(png_structp png_ptr) for (i = 0; i < num; i++) { png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); } g = 1.0 / g; @@ -4045,7 +4047,7 @@ png_build_gamma_table(png_structp png_ptr) for (i = 0; i < num; i++) { png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); ig = (((png_uint_32)i * (png_uint_32)png_gamma_shift[shift]) >> 4); for (j = 0; j < 256; j++) @@ -4065,12 +4067,12 @@ png_build_gamma_table(png_structp png_ptr) g = 1.0 / (png_ptr->gamma); png_ptr->gamma_16_to_1 = (png_uint_16pp)png_malloc(png_ptr, - (png_uint_32)(num * sizeof (png_uint_16p ))); + (png_uint_32)(num * png_sizeof (png_uint_16p ))); for (i = 0; i < num; i++) { png_ptr->gamma_16_to_1[i] = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); ig = (((png_uint_32)i * (png_uint_32)png_gamma_shift[shift]) >> 4); @@ -4088,12 +4090,12 @@ png_build_gamma_table(png_structp png_ptr) g = png_ptr->gamma; /* probably doing rgb_to_gray */ png_ptr->gamma_16_from_1 = (png_uint_16pp)png_malloc(png_ptr, - (png_uint_32)(num * sizeof (png_uint_16p))); + (png_uint_32)(num * png_sizeof (png_uint_16p))); for (i = 0; i < num; i++) { png_ptr->gamma_16_from_1[i] = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); ig = (((png_uint_32)i * (png_uint_32)png_gamma_shift[shift]) >> 4); diff --git a/pngrutil.c b/pngrutil.c index f6ab5fd84..bfcbe236b 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -1,7 +1,6 @@ - /* pngrutil.c - utilities to read a PNG file * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -38,6 +37,14 @@ __inline double strtod(const char *nptr, char **endptr) # endif #endif +png_uint_32 /* PRIVATE */ +png_get_uint_31(png_structp png_ptr, png_bytep buf) +{ + png_uint_32 i = png_get_uint_32(buf); + if (i > PNG_UINT_31_MAX) + png_error(png_ptr, "PNG unsigned integer out of range.\n"); + return (i); +} #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ png_uint_32 /* PRIVATE */ @@ -199,7 +206,7 @@ png_decompress_chunk(png_structp png_ptr, int comp_type, if (text == NULL) { - text_size = prefix_size + sizeof(msg) + 1; + text_size = prefix_size + png_sizeof(msg) + 1; text = (png_charp)png_malloc_warn(png_ptr, text_size); if (text == NULL) { @@ -213,7 +220,8 @@ png_decompress_chunk(png_structp png_ptr, int comp_type, /* Copy what we can of the error message into the text chunk */ text_size = (png_size_t)(chunklength - (text - chunkdata) - 1); - text_size = sizeof(msg) > text_size ? text_size : sizeof(msg); + text_size = png_sizeof(msg) > text_size ? text_size : + png_sizeof(msg); png_memcpy(text + prefix_size, msg, text_size + 1); break; } @@ -346,15 +354,14 @@ png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_crc_read(png_ptr, buf, 13); png_crc_finish(png_ptr, 0); - width = png_get_uint_32(buf); - height = png_get_uint_32(buf + 4); + width = png_get_uint_31(png_ptr, buf); + height = png_get_uint_31(png_ptr, buf + 4); bit_depth = buf[8]; color_type = buf[9]; compression_type = buf[10]; filter_type = buf[11]; interlace_type = buf[12]; - /* set internal variables */ png_ptr->width = width; png_ptr->height = height; @@ -673,7 +680,7 @@ png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@ -1154,8 +1161,18 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) } new_palette.nentries = data_length / entry_size; - new_palette.entries = (png_sPLT_entryp)png_malloc( - png_ptr, new_palette.nentries * sizeof(png_sPLT_entry)); + if (new_palette.nentries > PNG_SIZE_MAX / png_sizeof(png_sPLT_entry)) + { + png_warning(png_ptr, "sPLT chunk too long"); + return; + } + new_palette.entries = (png_sPLT_entryp)png_malloc_warn( + png_ptr, new_palette.nentries * png_sizeof(png_sPLT_entry)); + if (new_palette.entries == NULL) + { + png_warning(png_ptr, "sPLT chunk requires too much memory"); + return; + } #ifndef PNG_NO_POINTER_INDEXING for (i = 0; i < new_palette.nentries; i++) @@ -1397,7 +1414,7 @@ png_handle_bKGD(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) void /* PRIVATE */ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { - int num, i; + unsigned int num, i; png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH]; png_debug(1, "in png_handle_hIST\n"); @@ -1423,8 +1440,8 @@ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) return; } - num = (int)length / 2 ; - if (num != png_ptr->num_palette) + num = length / 2 ; + if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect hIST chunk length"); png_crc_finish(png_ptr, length); @@ -1625,7 +1642,7 @@ png_handle_pCAL(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) png_debug(3, "Allocating pCAL parameters array\n"); params = (png_charpp)png_malloc_warn(png_ptr, (png_uint_32)(nparams - *sizeof(png_charp))) ; + *png_sizeof(png_charp))) ; if (params == NULL) { png_free(png_ptr, purpose); @@ -1883,7 +1900,8 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) if (text != key + slength) text++; - text_ptr = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc_warn(png_ptr, + (png_uint_32)png_sizeof(png_text)); if (text_ptr == NULL) { png_warning(png_ptr, "Not enough memory to process text chunk."); @@ -1979,7 +1997,8 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) chunkdata = (png_charp)png_decompress_chunk(png_ptr, comp_type, chunkdata, (png_size_t)length, prefix_len, &data_len); - text_ptr = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc_warn(png_ptr, + (png_uint_32)png_sizeof(png_text)); if (text_ptr == NULL) { png_warning(png_ptr,"Not enough memory to process zTXt chunk."); @@ -2088,7 +2107,8 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) (size_t)length, prefix_len, &data_len); else data_len=png_strlen(chunkdata + prefix_len); - text_ptr = (png_textp)png_malloc_warn(png_ptr, (png_uint_32)sizeof(png_text)); + text_ptr = (png_textp)png_malloc_warn(png_ptr, + (png_uint_32)png_sizeof(png_text)); if (text_ptr == NULL) { png_warning(png_ptr,"Not enough memory to process iTXt chunk."); @@ -2863,8 +2883,7 @@ png_read_finish_row(png_structp png_ptr) png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); - + png_ptr->idat_size = png_get_uint_31(png_ptr, chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4)) @@ -3085,6 +3104,8 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) if ((png_uint_32)png_ptr->rowbytes + 1 > (png_uint_32)65536L) png_error(png_ptr, "This image requires a row greater than 64KB"); #endif + if ((png_uint_32)png_ptr->rowbytes + 1 > PNG_SIZE_MAX) + png_error(png_ptr, "Row has too many bytes to allocate in memory."); png_ptr->prev_row = (png_bytep)png_malloc(png_ptr, (png_uint_32)( png_ptr->rowbytes + 1)); @@ -1,7 +1,7 @@ /* pngset.c - storage of image information into info struct * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -24,7 +24,7 @@ png_set_bKGD(png_structp png_ptr, png_infop info_ptr, png_color_16p background) if (png_ptr == NULL || info_ptr == NULL) return; - png_memcpy(&(info_ptr->background), background, sizeof(png_color_16)); + png_memcpy(&(info_ptr->background), background, png_sizeof(png_color_16)); info_ptr->valid |= PNG_INFO_bKGD; } #endif @@ -100,10 +100,14 @@ png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr, "Ignoring attempt to set negative chromaticity value"); return; } - if (white_x > (double) PNG_MAX_UINT || white_y > (double) PNG_MAX_UINT || - red_x > (double) PNG_MAX_UINT || red_y > (double) PNG_MAX_UINT || - green_x > (double) PNG_MAX_UINT || green_y > (double) PNG_MAX_UINT || - blue_x > (double) PNG_MAX_UINT || blue_y > (double) PNG_MAX_UINT) + if (white_x > (double) PNG_UINT_31_MAX || + white_y > (double) PNG_UINT_31_MAX || + red_x > (double) PNG_UINT_31_MAX || + red_y > (double) PNG_UINT_31_MAX || + green_x > (double) PNG_UINT_31_MAX || + green_y > (double) PNG_UINT_31_MAX || + blue_x > (double) PNG_UINT_31_MAX || + blue_y > (double) PNG_UINT_31_MAX) { png_warning(png_ptr, "Ignoring attempt to set chromaticity value exceeding 21474.83"); @@ -169,10 +173,10 @@ png_set_gAMA_fixed(png_structp png_ptr, png_infop info_ptr, png_fixed_point if (png_ptr == NULL || info_ptr == NULL) return; - if (int_gamma > (png_fixed_point) PNG_MAX_UINT) + if (int_gamma > (png_fixed_point) PNG_UINT_31_MAX) { png_warning(png_ptr, "Limiting gamma to 21474.83"); - gamma=PNG_MAX_UINT; + gamma=PNG_UINT_31_MAX; } else { @@ -217,7 +221,7 @@ png_set_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_16p hist) #endif /* Changed from info->num_palette to 256 in version 1.2.1 */ png_ptr->hist = (png_uint_16p)png_malloc_warn(png_ptr, - (png_uint_32)(256 * sizeof (png_uint_16))); + (png_uint_32)(256 * png_sizeof (png_uint_16))); if (png_ptr->hist == NULL) { png_warning(png_ptr, "Insufficient memory for hIST chunk data."); @@ -251,7 +255,7 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr, /* check for width and height valid values */ if (width == 0 || height == 0) png_error(png_ptr, "Image width or height is zero in IHDR"); - if (width > PNG_MAX_UINT || height > PNG_MAX_UINT) + if (width > PNG_UINT_31_MAX || height > PNG_UINT_31_MAX) png_error(png_ptr, "Invalid image size in IHDR"); /* check other values */ @@ -322,7 +326,7 @@ png_set_IHDR(png_structp png_ptr, png_infop info_ptr, /* check for overflow */ rowbytes_per_pixel = (info_ptr->pixel_depth + 7) >> 3; - if ( width > PNG_MAX_UINT/rowbytes_per_pixel - 64) + if ( width > PNG_UINT_32_MAX/rowbytes_per_pixel - 64) { png_warning(png_ptr, "Width too large to process image data; rowbytes will overflow."); @@ -388,7 +392,7 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr, png_memcpy(info_ptr->pcal_units, units, (png_size_t)length); info_ptr->pcal_params = (png_charpp)png_malloc_warn(png_ptr, - (png_uint_32)((nparams + 1) * sizeof(png_charp))); + (png_uint_32)((nparams + 1) * png_sizeof(png_charp))); if (info_ptr->pcal_params == NULL) { png_warning(png_ptr, "Insufficient memory for pCAL params."); @@ -449,12 +453,21 @@ png_set_sCAL_s(png_structp png_ptr, png_infop info_ptr, length = png_strlen(swidth) + 1; png_debug1(3, "allocating unit for info (%d bytes)\n", length); - info_ptr->scal_s_width = (png_charp)png_malloc(png_ptr, length); + info_ptr->scal_s_width = (png_charp)png_malloc_warn(png_ptr, length); + if (info_ptr->scal_s_width == NULL) + { + png_warning(png_ptr, "Memory allocation failed while processing sCAL."); + } png_memcpy(info_ptr->scal_s_width, swidth, (png_size_t)length); length = png_strlen(sheight) + 1; png_debug1(3, "allocating unit for info (%d bytes)\n", length); - info_ptr->scal_s_height = (png_charp)png_malloc(png_ptr, length); + info_ptr->scal_s_height = (png_charp)png_malloc_warn(png_ptr, length); + if (info_ptr->scal_s_height == NULL) + { + png_free (png_ptr, info_ptr->scal_s_width); + png_warning(png_ptr, "Memory allocation failed while processing sCAL."); + } png_memcpy(info_ptr->scal_s_height, sheight, (png_size_t)length); info_ptr->valid |= PNG_INFO_sCAL; @@ -499,13 +512,13 @@ png_set_PLTE(png_structp png_ptr, png_infop info_ptr, #ifdef PNG_FREE_ME_SUPPORTED png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0); #endif + /* Changed in libpng-1.2.1 to allocate 256 instead of num_palette entries, in case of an invalid PNG file that has too-large sample values. */ - png_ptr->palette = (png_colorp)png_zalloc(png_ptr, (uInt)256, - sizeof (png_color)); - if (png_ptr->palette == NULL) - png_error(png_ptr, "Unable to malloc palette"); - png_memcpy(png_ptr->palette, palette, num_palette * sizeof (png_color)); + png_ptr->palette = (png_colorp)png_malloc(png_ptr, + 256 * png_sizeof(png_color)); + png_memset(png_ptr->palette, 0, 256 * png_sizeof(png_color)); + png_memcpy(png_ptr->palette, palette, num_palette * png_sizeof (png_color)); info_ptr->palette = png_ptr->palette; info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette; @@ -527,7 +540,7 @@ png_set_sBIT(png_structp png_ptr, png_infop info_ptr, if (png_ptr == NULL || info_ptr == NULL) return; - png_memcpy(&(info_ptr->sig_bit), sig_bit, sizeof (png_color_8)); + png_memcpy(&(info_ptr->sig_bit), sig_bit, png_sizeof (png_color_8)); info_ptr->valid |= PNG_INFO_sBIT; } #endif @@ -628,9 +641,20 @@ png_set_iCCP(png_structp png_ptr, png_infop info_ptr, if (png_ptr == NULL || info_ptr == NULL || name == NULL || profile == NULL) return; - new_iccp_name = (png_charp)png_malloc(png_ptr, png_strlen(name)+1); + new_iccp_name = (png_charp)png_malloc_warn(png_ptr, png_strlen(name)+1); + if (new_iccp_name == NULL) + { + png_warning(png_ptr, "Insufficient memory to process iCCP chunk."); + return; + } png_strcpy(new_iccp_name, name); - new_iccp_profile = (png_charp)png_malloc(png_ptr, proflen); + new_iccp_profile = (png_charp)png_malloc_warn(png_ptr, proflen); + if (new_iccp_profile == NULL) + { + png_free (png_ptr, new_iccp_name); + png_warning(png_ptr, "Insufficient memory to process iCCP profile."); + return; + } png_memcpy(new_iccp_profile, profile, (png_size_t)proflen); png_free_data(png_ptr, info_ptr, PNG_FREE_ICCP, 0); @@ -685,14 +709,14 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr, info_ptr->max_text = info_ptr->num_text + num_text + 8; old_text = info_ptr->text; info_ptr->text = (png_textp)png_malloc_warn(png_ptr, - (png_uint_32)(info_ptr->max_text * sizeof (png_text))); + (png_uint_32)(info_ptr->max_text * png_sizeof (png_text))); if (info_ptr->text == NULL) { png_free(png_ptr, old_text); return(1); } png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max * - sizeof(png_text))); + png_sizeof(png_text))); png_free(png_ptr, old_text); } else @@ -700,7 +724,7 @@ png_set_text_2(png_structp png_ptr, png_infop info_ptr, png_textp text_ptr, info_ptr->max_text = num_text + 8; info_ptr->num_text = 0; info_ptr->text = (png_textp)png_malloc_warn(png_ptr, - (png_uint_32)(info_ptr->max_text * sizeof (png_text))); + (png_uint_32)(info_ptr->max_text * png_sizeof (png_text))); if (info_ptr->text == NULL) return(1); #ifdef PNG_FREE_ME_SUPPORTED @@ -829,7 +853,7 @@ png_set_tIME(png_structp png_ptr, png_infop info_ptr, png_timep mod_time) (png_ptr->mode & PNG_WROTE_tIME)) return; - png_memcpy(&(info_ptr->mod_time), mod_time, sizeof (png_time)); + png_memcpy(&(info_ptr->mod_time), mod_time, png_sizeof (png_time)); info_ptr->valid |= PNG_INFO_tIME; } #endif @@ -867,7 +891,7 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr, if (trans_values != NULL) { png_memcpy(&(info_ptr->trans_values), trans_values, - sizeof(png_color_16)); + png_sizeof(png_color_16)); if (num_trans == 0) num_trans = 1; } @@ -885,7 +909,7 @@ png_set_sPLT(png_structp png_ptr, int i; np = (png_sPLT_tp)png_malloc_warn(png_ptr, - (info_ptr->splt_palettes_num + nentries) * sizeof(png_sPLT_t)); + (info_ptr->splt_palettes_num + nentries) * png_sizeof(png_sPLT_t)); if (np == NULL) { png_warning(png_ptr, "No memory for sPLT palettes."); @@ -893,7 +917,7 @@ png_set_sPLT(png_structp png_ptr, } png_memcpy(np, info_ptr->splt_palettes, - info_ptr->splt_palettes_num * sizeof(png_sPLT_t)); + info_ptr->splt_palettes_num * png_sizeof(png_sPLT_t)); png_free(png_ptr, info_ptr->splt_palettes); info_ptr->splt_palettes=NULL; @@ -904,11 +928,13 @@ png_set_sPLT(png_structp png_ptr, to->name = (png_charp)png_malloc(png_ptr, png_strlen(from->name) + 1); + /* TODO: use png_malloc_warn */ png_strcpy(to->name, from->name); to->entries = (png_sPLT_entryp)png_malloc(png_ptr, - from->nentries * sizeof(png_sPLT_t)); + from->nentries * png_sizeof(png_sPLT_t)); + /* TODO: use png_malloc_warn */ png_memcpy(to->entries, from->entries, - from->nentries * sizeof(png_sPLT_t)); + from->nentries * png_sizeof(png_sPLT_t)); to->nentries = from->nentries; to->depth = from->depth; } @@ -935,7 +961,7 @@ png_set_unknown_chunks(png_structp png_ptr, np = (png_unknown_chunkp)png_malloc_warn(png_ptr, (info_ptr->unknown_chunks_num + num_unknowns) * - sizeof(png_unknown_chunk)); + png_sizeof(png_unknown_chunk)); if (np == NULL) { png_warning(png_ptr, "Out of memory while processing unknown chunk."); @@ -943,7 +969,7 @@ png_set_unknown_chunks(png_structp png_ptr, } png_memcpy(np, info_ptr->unknown_chunks, - info_ptr->unknown_chunks_num * sizeof(png_unknown_chunk)); + info_ptr->unknown_chunks_num * png_sizeof(png_unknown_chunk)); png_free(png_ptr, info_ptr->unknown_chunks); info_ptr->unknown_chunks=NULL; @@ -952,17 +978,19 @@ png_set_unknown_chunks(png_structp png_ptr, png_unknown_chunkp to = np + info_ptr->unknown_chunks_num + i; png_unknown_chunkp from = unknowns + i; - png_strcpy((png_charp)to->name, (png_charp)from->name); - to->data = (png_bytep)png_malloc(png_ptr, from->size); + png_strncpy((png_charp)to->name, (png_charp)from->name, 5); + to->data = (png_bytep)png_malloc_warn(png_ptr, from->size); if (to->data == NULL) - png_warning(png_ptr, "Out of memory while processing unknown chunk."); + { + png_warning(png_ptr, "Out of memory processing unknown chunk."); + } else { - png_memcpy(to->data, from->data, from->size); - to->size = from->size; + png_memcpy(to->data, from->data, from->size); + to->size = from->size; - /* note our location in the read or write sequence */ - to->location = (png_byte)(png_ptr->mode & 0xff); + /* note our location in the read or write sequence */ + to->location = (png_byte)(png_ptr->mode & 0xff); } } @@ -1083,6 +1111,7 @@ png_set_rows(png_structp png_ptr, png_infop info_ptr, png_bytepp row_pointers) } #endif +#ifdef PNG_WRITE_SUPPORTED void PNGAPI png_set_compression_buffer_size(png_structp png_ptr, png_uint_32 size) { @@ -1093,6 +1122,7 @@ png_set_compression_buffer_size(png_structp png_ptr, png_uint_32 size) png_ptr->zstream.next_out = png_ptr->zbuf; png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size; } +#endif void PNGAPI png_set_invalid(png_structp png_ptr, png_infop info_ptr, int mask) @@ -1,7 +1,7 @@ /* pngtest.c - a simple test program to test libpng * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -28,6 +28,8 @@ * of files at once by typing "pngtest -m file1.png file2.png ..." */ +#include "png.h" + #if defined(_WIN32_WCE) # if _WIN32_WCE < 211 __error__ (f|w)printf functions are not supported on old WindowsCE.; @@ -80,8 +82,6 @@ static float t_start, t_stop, t_decode, t_encode, t_misc; #include <time.h> #endif -#include "png.h" - /* Define png_jmpbuf() in case we are using a pre-1.0.6 version of libpng */ #ifndef png_jmpbuf # define png_jmpbuf(png_ptr) png_ptr->jmpbuf @@ -127,7 +127,7 @@ PNGAPI #endif read_row_callback(png_structp png_ptr, png_uint_32 row_number, int pass) { - if(png_ptr == NULL || row_number > PNG_MAX_UINT) return; + if(png_ptr == NULL || row_number > PNG_UINT_31_MAX) return; if(status_pass != pass) { fprintf(stdout,"\n Pass %d: ",pass); @@ -154,7 +154,7 @@ PNGAPI #endif write_row_callback(png_structp png_ptr, png_uint_32 row_number, int pass) { - if(png_ptr == NULL || row_number > PNG_MAX_UINT || pass > 7) return; + if(png_ptr == NULL || row_number > PNG_UINT_31_MAX || pass > 7) return; fprintf(stdout, "w"); } @@ -511,7 +511,7 @@ png_debug_malloc(png_structp png_ptr, png_uint_32 size) buffer and once to get a new free list entry. */ { memory_infop pinfo = (memory_infop)png_malloc_default(png_ptr, - (png_uint_32)sizeof *pinfo); + (png_uint_32)png_sizeof (*pinfo)); pinfo->size = size; current_allocation += size; total_allocation += size; @@ -699,7 +699,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname) return (1); } #ifdef USE_FAR_KEYWORD - png_memcpy(png_jmpbuf(read_ptr),jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_jmpbuf(read_ptr),jmpbuf,png_sizeof(jmp_buf)); #endif #ifdef PNG_WRITE_SUPPORTED @@ -721,7 +721,7 @@ test_one_file(PNG_CONST char *inname, PNG_CONST char *outname) return (1); } #ifdef USE_FAR_KEYWORD - png_memcpy(png_jmpbuf(write_ptr),jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_jmpbuf(write_ptr),jmpbuf,png_sizeof(jmp_buf)); #endif #endif #endif @@ -1306,8 +1306,11 @@ main(int argc, char *argv[]) /* Show the version of libpng used in building the application */ fprintf(STDERR," pngtest (%lu):%s", (unsigned long)PNG_LIBPNG_VER, PNG_HEADER_VERSION_STRING); - fprintf(STDERR," sizeof(png_struct)=%ld, sizeof(png_info)=%ld\n", - (long)sizeof(png_struct), (long)sizeof(png_info)); + fprintf(STDERR," png_sizeof(png_struct)=%ld, png_sizeof(png_info)=%ld\n", + (long)png_sizeof(png_struct), (long)png_sizeof(png_info)); + fprintf(STDERR," PNG_UINT_31_MAX=%lu, PNG_UINT_32_MAX=%lu\n", + PNG_UINT_31_MAX, PNG_UINT_32_MAX); + fprintf(STDERR," PNG_SIZE_MAX=%u\n",PNG_SIZE_MAX); /* Do some consistency checking on the memory allocation settings, I'm not sure this matters, but it is nice to know, the first of these @@ -1538,4 +1541,4 @@ main(int argc, char *argv[]) } /* Generate a compiler error if there is an old png.h in the search path. */ -typedef version_1_2_6beta3 your_png_h_is_not_version_1_2_6beta3; +typedef version_1_2_6beta4 your_png_h_is_not_version_1_2_6beta4; diff --git a/pngtrans.c b/pngtrans.c index 791d4c3cf..d4c2af526 100644 --- a/pngtrans.c +++ b/pngtrans.c @@ -1,7 +1,7 @@ /* pngtrans.c - transforms the data in a row (used by both readers and writers) * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -2,7 +2,7 @@ * * For Intel x86 CPU and Microsoft Visual C++ compiler * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * Copyright (c) 1998, Intel Corporation @@ -1,7 +1,7 @@ /* pngwio.c - functions for data output * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) diff --git a/pngwrite.c b/pngwrite.c index f292c6f82..85b2f1919 100644 --- a/pngwrite.c +++ b/pngwrite.c @@ -1,7 +1,7 @@ /* pngwrite.c - general routines to write a PNG file * - * libpng 1.2.6beta3 - July 18, 2004 + * libpng 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -471,7 +471,7 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, return (NULL); } #ifdef USE_FAR_KEYWORD - png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf)); #endif #endif @@ -538,7 +538,7 @@ png_create_write_struct_2(png_const_charp user_png_ver, png_voidp error_ptr, #ifdef USE_FAR_KEYWORD if (setjmp(jmpbuf)) PNG_ABORT(); - png_memcpy(png_ptr->jmpbuf,jmpbuf,sizeof(jmp_buf)); + png_memcpy(png_ptr->jmpbuf,jmpbuf,png_sizeof(jmp_buf)); #else if (setjmp(png_ptr->jmpbuf)) PNG_ABORT(); @@ -562,7 +562,8 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver, { /* We only come here via pre-1.0.12-compiled applications */ #if !defined(PNG_NO_STDIO) && !defined(_WIN32_WCE) - if(sizeof(png_struct) > png_struct_size || sizeof(png_info) > png_info_size) + if(png_sizeof(png_struct) > png_struct_size || + png_sizeof(png_info) > png_info_size) { char msg[80]; png_ptr->warning_fn=NULL; @@ -577,7 +578,7 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver, png_warning(png_ptr, msg); } #endif - if(sizeof(png_struct) > png_struct_size) + if(png_sizeof(png_struct) > png_struct_size) { png_ptr->error_fn=NULL; #ifdef PNG_ERROR_NUMBERS_SUPPORTED @@ -586,7 +587,7 @@ png_write_init_2(png_structp png_ptr, png_const_charp user_png_ver, png_error(png_ptr, "The png struct allocated by the application for writing is too small."); } - if(sizeof(png_info) > png_info_size) + if(png_sizeof(png_info) > png_info_size) { png_ptr->error_fn=NULL; #ifdef PNG_ERROR_NUMBERS_SUPPORTED @@ -627,10 +628,10 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, #ifdef PNG_SETJMP_SUPPORTED /* save jump buffer and error functions */ - png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf)); + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf)); #endif - if (sizeof(png_struct) > png_struct_size) + if (png_sizeof(png_struct) > png_struct_size) { png_destroy_struct(png_ptr); png_ptr = (png_structp)png_create_struct(PNG_STRUCT_PNG); @@ -638,7 +639,7 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, } /* reset all variables to 0 */ - png_memset(png_ptr, 0, sizeof (png_struct)); + png_memset(png_ptr, 0, png_sizeof (png_struct)); #if !defined(PNG_1_0_X) #ifdef PNG_ASSEMBLER_CODE_SUPPORTED @@ -648,7 +649,7 @@ png_write_init_3(png_structpp ptr_ptr, png_const_charp user_png_ver, #ifdef PNG_SETJMP_SUPPORTED /* restore jump buffer */ - png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf)); + png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf)); #endif png_set_write_fn(png_ptr, png_voidp_NULL, png_rw_ptr_NULL, @@ -1050,7 +1051,7 @@ png_write_destroy(png_structp png_ptr) #ifdef PNG_SETJMP_SUPPORTED /* reset structure */ - png_memcpy(tmp_jmp, png_ptr->jmpbuf, sizeof (jmp_buf)); + png_memcpy(tmp_jmp, png_ptr->jmpbuf, png_sizeof (jmp_buf)); #endif error_fn = png_ptr->error_fn; @@ -1060,7 +1061,7 @@ png_write_destroy(png_structp png_ptr) free_fn = png_ptr->free_fn; #endif - png_memset(png_ptr, 0, sizeof (png_struct)); + png_memset(png_ptr, 0, png_sizeof (png_struct)); png_ptr->error_fn = error_fn; png_ptr->warning_fn = warning_fn; @@ -1070,7 +1071,7 @@ png_write_destroy(png_structp png_ptr) #endif #ifdef PNG_SETJMP_SUPPORTED - png_memcpy(png_ptr->jmpbuf, tmp_jmp, sizeof (jmp_buf)); + png_memcpy(png_ptr->jmpbuf, tmp_jmp, png_sizeof (jmp_buf)); #endif } @@ -1212,7 +1213,7 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method, if (png_ptr->prev_filters == NULL) { png_ptr->prev_filters = (png_bytep)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_byte) * num_weights)); + (png_uint_32)(png_sizeof(png_byte) * num_weights)); /* To make sure that the weighting starts out fairly */ for (i = 0; i < num_weights; i++) @@ -1224,10 +1225,10 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method, if (png_ptr->filter_weights == NULL) { png_ptr->filter_weights = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_uint_16) * num_weights)); + (png_uint_32)(png_sizeof(png_uint_16) * num_weights)); png_ptr->inv_filter_weights = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_uint_16) * num_weights)); + (png_uint_32)(png_sizeof(png_uint_16) * num_weights)); for (i = 0; i < num_weights; i++) { png_ptr->inv_filter_weights[i] = @@ -1258,10 +1259,10 @@ png_set_filter_heuristics(png_structp png_ptr, int heuristic_method, if (png_ptr->filter_costs == NULL) { png_ptr->filter_costs = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST)); + (png_uint_32)(png_sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST)); png_ptr->inv_filter_costs = (png_uint_16p)png_malloc(png_ptr, - (png_uint_32)(sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST)); + (png_uint_32)(png_sizeof(png_uint_16) * PNG_FILTER_VALUE_LAST)); for (i = 0; i < PNG_FILTER_VALUE_LAST; i++) { diff --git a/pngwtran.c b/pngwtran.c index b091d8798..aa8864026 100644 --- a/pngwtran.c +++ b/pngwtran.c @@ -1,7 +1,7 @@ /* pngwtran.c - transforms the data in a row for PNG writers * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) diff --git a/pngwutil.c b/pngwutil.c index bbd3881ea..aa4f3a147 100644 --- a/pngwutil.c +++ b/pngwutil.c @@ -1,7 +1,7 @@ /* pngwutil.c - utilities to write a PNG file * - * libpng version 1.2.6beta3 - July 18, 2004 + * libpng version 1.2.6beta4 - July 28, 2004 * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2004 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -234,14 +234,16 @@ png_text_compress(png_structp png_ptr, old_ptr = comp->output_ptr; comp->output_ptr = (png_charpp)png_malloc(png_ptr, - (png_uint_32)(comp->max_output_ptr * sizeof (png_charpp))); + (png_uint_32)(comp->max_output_ptr * + png_sizeof (png_charpp))); png_memcpy(comp->output_ptr, old_ptr, old_max - * sizeof (png_charp)); + * png_sizeof (png_charp)); png_free(png_ptr, old_ptr); } else comp->output_ptr = (png_charpp)png_malloc(png_ptr, - (png_uint_32)(comp->max_output_ptr * sizeof (png_charp))); + (png_uint_32)(comp->max_output_ptr * + png_sizeof (png_charp))); } /* save the data */ @@ -283,14 +285,16 @@ png_text_compress(png_structp png_ptr, old_ptr = comp->output_ptr; /* This could be optimized to realloc() */ comp->output_ptr = (png_charpp)png_malloc(png_ptr, - (png_uint_32)(comp->max_output_ptr * sizeof (png_charpp))); + (png_uint_32)(comp->max_output_ptr * + png_sizeof (png_charpp))); png_memcpy(comp->output_ptr, old_ptr, - old_max * sizeof (png_charp)); + old_max * png_sizeof (png_charp)); png_free(png_ptr, old_ptr); } else comp->output_ptr = (png_charpp)png_malloc(png_ptr, - (png_uint_32)(comp->max_output_ptr * sizeof (png_charp))); + (png_uint_32)(comp->max_output_ptr * + png_sizeof (png_charp))); } /* save off the data */ @@ -1182,7 +1186,12 @@ png_check_keyword(png_structp png_ptr, png_charp key, png_charpp new_key) png_debug1(2, "Keyword to be checked is '%s'\n", key); - *new_key = (png_charp)png_malloc(png_ptr, (png_uint_32)(key_len + 2)); + *new_key = (png_charp)png_malloc_warn(png_ptr, (png_uint_32)(key_len + 2)); + if (*new_key == NULL) + { + png_warning(png_ptr, "Out of memory while procesing keyword"); + return ((png_size_t)0); + } /* Replace non-printing characters with a blank and print a warning */ for (kp = key, dp = *new_key; *kp != '\0'; kp++, dp++) @@ -1502,7 +1511,7 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0, total_len = purpose_len + units_len + 10; params_len = (png_uint_32p)png_malloc(png_ptr, (png_uint_32)(nparams - *sizeof(png_uint_32))); + *png_sizeof(png_uint_32))); /* Find the length of each parameter, making sure we don't count the null terminator for the last parameter. */ diff --git a/projects/netware.txt b/projects/netware.txt index d6b3cb5d5..a922d5016 100644 --- a/projects/netware.txt +++ b/projects/netware.txt @@ -1,6 +1,6 @@ A set of project files is available for Netware. Get -libpng-1.2.6beta3-project-netware.zip from a libpng distribution +libpng-1.2.6beta4-project-netware.zip from a libpng distribution site such as http://libpng.sourceforge.net Put the zip file in this directory (projects) and then run -"unzip -a libpng-1.2.6beta3-project-netware.zip" +"unzip -a libpng-1.2.6beta4-project-netware.zip" diff --git a/projects/wince.txt b/projects/wince.txt index 05cb71fb8..d014d01eb 100644 --- a/projects/wince.txt +++ b/projects/wince.txt @@ -1,6 +1,6 @@ A set of project files is available for WinCE. Get -libpng-1.2.6beta3-project-wince.zip from a libpng distribution +libpng-1.2.6beta4-project-wince.zip from a libpng distribution site such as http://libpng.sourceforge.net Put the zip file in this directory (projects) and then run -"unzip -a libpng-1.2.6beta3-project-wince.zip" +"unzip -a libpng-1.2.6beta4-project-wince.zip" |