1
0
mirror of https://github.com/opencv/opencv.git synced 2026-07-21 19:33:03 +04:00

Merge pull request #29051 from klatism:libpng-upgrade-1.6.57

libpng upgrade to 1.6.57 #29051

### Pull Request Readiness Checklist

See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request

- [x] I agree to contribute to the project under Apache 2 License.
- [x] To the best of my knowledge, the proposed patch is not based on a code under GPL or another license that is incompatible with OpenCV
- [ ] The PR is proposed to the proper branch
- [ ] There is a reference to the original bug report and related work
- [ ] There is accuracy test, performance test and test data in opencv_extra repository, if applicable
      Patch to opencv_extra has the same branch name.
- [ ] The feature is well documented and sample code can be built with the project CMake
This commit is contained in:
Michael Klatis
2026-05-18 07:14:24 -07:00
committed by GitHub
parent b29ea17666
commit cd4d732442
27 changed files with 1802 additions and 1276 deletions
+60 -2
View File
@@ -5988,7 +5988,7 @@ Version 1.6.32rc01 [August 18, 2017]
Version 1.6.32rc02 [August 22, 2017]
Added contrib/oss-fuzz directory which contains files used by the oss-fuzz
project (https://github.com/google/oss-fuzz/tree/master/projects/libpng).
project <https://github.com/google/oss-fuzz/tree/master/projects/libpng>.
Version 1.6.32 [August 24, 2017]
No changes.
@@ -6321,7 +6321,65 @@ Version 1.6.53 [December 5, 2025]
Fixed a build failure with CMake 4.1 or newer, on Windows, when using
Visual C++ without MASM installed.
Version 1.6.54 [January 12, 2026]
Fixed CVE-2026-22695 (medium severity):
Heap buffer over-read in `png_image_read_direct_scaled`.
(Reported and fixed by Petr Simecek.)
Fixed CVE-2026-22801 (medium severity):
Integer truncation causing heap buffer over-read in `png_image_write_*`.
Implemented various improvements in oss-fuzz.
(Contributed by Philippe Antoine.)
Version 1.6.55 [February 9, 2026]
Fixed CVE-2026-25646 (high severity):
Heap buffer overflow in `png_set_quantize`.
(Reported and fixed by Joshua Inscoe.)
Resolved an oss-fuzz build issue involving nalloc.
(Contributed by Philippe Antoine.)
Version 1.6.56 [March 25, 2026]
Fixed CVE-2026-33416 (high severity):
Use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`.
(Reported by Halil Oktay and Ryo Shimada;
fixed by Halil Oktay and Cosmin Truta.)
Fixed CVE-2026-33636 (high severity):
Out-of-bounds read/write in the palette expansion on ARM Neon.
(Reported by Taegu Ha; fixed by Taegu Ha and Cosmin Truta.)
Fixed uninitialized reads beyond `num_trans` in `trans_alpha` buffers.
(Contributed by Halil Oktay.)
Fixed stale `info_ptr->palette` after in-place gamma and background
transforms.
Fixed wrong channel indices in `png_image_read_and_map` RGB_ALPHA path.
(Contributed by Yuelin Wang.)
Fixed wrong background color in colormap read.
(Contributed by Yuelin Wang.)
Fixed dead loop in sPLT write.
(Contributed by Yuelin Wang.)
Added missing null pointer checks in four public API functions.
(Contributed by Yuelin Wang.)
Validated shift bit depths in `png_set_shift` to prevent infinite loop.
(Contributed by Yuelin Wang.)
Avoided undefined behavior in library and tests.
Deprecated the hardly-ever-tested POINTER_INDEXING config option.
Added negative-stride test coverage for the simplified API.
Fixed memory leaks and API misuse in oss-fuzz.
(Contributed by Owen Sanzas.)
Implemented various fixes and improvements in oss-fuzz.
(Contributed by Bob Friesenhahn and Philippe Antoine.)
Performed various refactorings and cleanups.
Version 1.6.57 [April 8, 2026]
Fixed CVE-2026-34757 (medium severity):
Use-after-free in `png_set_PLTE`, `png_set_tRNS` and `png_set_hIST`
leading to corrupted chunk data and potential heap information disclosure.
Also hardened the append-style setters (`png_set_text`, `png_set_sPLT`,
`png_set_unknown_chunks`) against a theoretical variant of the same
aliasing pattern.
(Reported by Iv4n <Iv4n550@users.noreply.github.com>.)
Fixed integer overflow in rowbytes computation in read transforms.
(Contributed by Mohammad Seet.)
Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
Subscription is required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-implement
<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
to subscribe.
+2 -2
View File
@@ -4,8 +4,8 @@ COPYRIGHT NOTICE, DISCLAIMER, and LICENSE
PNG Reference Library License version 2
---------------------------------------
* Copyright (c) 1995-2025 The PNG Reference Library Authors.
* Copyright (c) 2018-2025 Cosmin Truta.
* Copyright (c) 1995-2026 The PNG Reference Library Authors.
* Copyright (c) 2018-2026 Cosmin Truta.
* Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson.
* Copyright (c) 1996-1997 Andreas Dilger.
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
+7 -7
View File
@@ -1,4 +1,4 @@
README for libpng version 1.6.53
README for libpng version 1.6.57
================================
See the note about version numbers near the top of `png.h`.
@@ -24,14 +24,14 @@ for more things than just PNG files. You can use zlib as a drop-in
replacement for `fread()` and `fwrite()`, if you are so inclined.
zlib should be available at the same place that libpng is, or at
https://zlib.net .
<https://zlib.net>.
You may also want a copy of the PNG specification. It is available
as an RFC, a W3C Recommendation, and an ISO/IEC Standard. You can find
these at http://www.libpng.org/pub/png/pngdocs.html .
these at <http://www.libpng.org/pub/png/pngdocs.html>.
This code is currently being archived at https://libpng.sourceforge.io
in the download area, and at http://libpng.download/src .
This code is currently being archived at <https://libpng.sourceforge.io>
in the download area, and at <http://libpng.download/src>.
This release, based in a large way on Glenn's, Guy's and Andreas'
earlier work, was created and will be supported by myself and the PNG
@@ -39,12 +39,12 @@ development group.
Send comments, corrections and commendations to `png-mng-implement`
at `lists.sourceforge.net`. (Subscription is required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-implement
<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
to subscribe.)
Send general questions about the PNG specification to `png-mng-misc`
at `lists.sourceforge.net`. (Subscription is required; visit
https://lists.sourceforge.net/lists/listinfo/png-mng-misc
<https://lists.sourceforge.net/lists/listinfo/png-mng-misc>
to subscribe.)
Historical notes
+7 -7
View File
@@ -48,7 +48,7 @@
void
png_read_filter_row_up_neon(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
png_const_bytep prev_row)
{
png_bytep rp = row;
png_bytep rp_stop = row + row_info->rowbytes;
@@ -69,7 +69,7 @@ png_read_filter_row_up_neon(png_row_infop row_info, png_bytep row,
void
png_read_filter_row_sub3_neon(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
png_const_bytep prev_row)
{
png_bytep rp = row;
png_bytep rp_stop = row + row_info->rowbytes;
@@ -116,7 +116,7 @@ png_read_filter_row_sub3_neon(png_row_infop row_info, png_bytep row,
void
png_read_filter_row_sub4_neon(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
png_const_bytep prev_row)
{
png_bytep rp = row;
png_bytep rp_stop = row + row_info->rowbytes;
@@ -148,7 +148,7 @@ png_read_filter_row_sub4_neon(png_row_infop row_info, png_bytep row,
void
png_read_filter_row_avg3_neon(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
png_const_bytep prev_row)
{
png_bytep rp = row;
png_const_bytep pp = prev_row;
@@ -216,7 +216,7 @@ png_read_filter_row_avg3_neon(png_row_infop row_info, png_bytep row,
void
png_read_filter_row_avg4_neon(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
png_const_bytep prev_row)
{
png_bytep rp = row;
png_bytep rp_stop = row + row_info->rowbytes;
@@ -285,7 +285,7 @@ paeth(uint8x8_t a, uint8x8_t b, uint8x8_t c)
void
png_read_filter_row_paeth3_neon(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
png_const_bytep prev_row)
{
png_bytep rp = row;
png_const_bytep pp = prev_row;
@@ -353,7 +353,7 @@ png_read_filter_row_paeth3_neon(png_row_infop row_info, png_bytep row,
void
png_read_filter_row_paeth4_neon(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
png_const_bytep prev_row)
{
png_bytep rp = row;
png_bytep rp_stop = row + row_info->rowbytes;
+29 -32
View File
@@ -1,6 +1,6 @@
/* palette_neon_intrinsics.c - NEON optimised palette expansion functions
*
* Copyright (c) 2018-2019 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 2017-2018 Arm Holdings. All rights reserved.
* Written by Richard Townsend <Richard.Townsend@arm.com>, February 2017.
*
@@ -48,12 +48,12 @@ png_riffle_palette_neon(png_structrp png_ptr)
w.val[0] = v.val[0];
w.val[1] = v.val[1];
w.val[2] = v.val[2];
vst4q_u8(riffled_palette + (i << 2), w);
vst4q_u8(riffled_palette + i * 4, w);
}
/* Fix up the missing transparency values. */
for (i = 0; i < num_trans; i++)
riffled_palette[(i << 2) + 3] = trans_alpha[i];
riffled_palette[i * 4 + 3] = trans_alpha[i];
}
/* Expands a palettized row into RGBA8. */
@@ -77,27 +77,26 @@ png_do_expand_palette_rgba8_neon(png_structrp png_ptr, png_row_infop row_info,
* The NEON part writes forward from a given position, so we have
* to seek this back by 4 pixels x 4 bytes.
*/
*ddp = *ddp - ((pixels_per_chunk * sizeof(png_uint_32)) - 1);
*ddp = *ddp - (pixels_per_chunk * 4 - 1);
for (i = 0; i < row_width; i += pixels_per_chunk)
for (i = 0; i + pixels_per_chunk <= row_width; i += pixels_per_chunk)
{
uint32x4_t cur;
png_bytep sp = *ssp - i, dp = *ddp - (i << 2);
png_bytep sp = *ssp - i, dp = *ddp - i * 4;
cur = vld1q_dup_u32 (riffled_palette + *(sp - 3));
cur = vld1q_lane_u32(riffled_palette + *(sp - 2), cur, 1);
cur = vld1q_lane_u32(riffled_palette + *(sp - 1), cur, 2);
cur = vld1q_lane_u32(riffled_palette + *(sp - 0), cur, 3);
vst1q_u32((void *)dp, cur);
}
if (i != row_width)
{
/* Remove the amount that wasn't processed. */
i -= pixels_per_chunk;
}
/* Decrement output pointers. */
/* Undo the pre-adjustment of *ddp before the pointer handoff,
* so the scalar fallback in pngrtran.c receives a dp that points
* to the correct position.
*/
*ddp = *ddp + (pixels_per_chunk * 4 - 1);
*ssp = *ssp - i;
*ddp = *ddp - (i << 2);
*ddp = *ddp - i * 4;
return i;
}
@@ -118,32 +117,30 @@ png_do_expand_palette_rgb8_neon(png_structrp png_ptr, png_row_infop row_info,
return 0;
/* Seeking this back by 8 pixels x 3 bytes. */
*ddp = *ddp - ((pixels_per_chunk * sizeof(png_color)) - 1);
*ddp = *ddp - (pixels_per_chunk * 3 - 1);
for (i = 0; i < row_width; i += pixels_per_chunk)
for (i = 0; i + pixels_per_chunk <= row_width; i += pixels_per_chunk)
{
uint8x8x3_t cur;
png_bytep sp = *ssp - i, dp = *ddp - ((i << 1) + i);
cur = vld3_dup_u8(palette + sizeof(png_color) * (*(sp - 7)));
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 6)), cur, 1);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 5)), cur, 2);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 4)), cur, 3);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 3)), cur, 4);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 2)), cur, 5);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 1)), cur, 6);
cur = vld3_lane_u8(palette + sizeof(png_color) * (*(sp - 0)), cur, 7);
png_bytep sp = *ssp - i, dp = *ddp - i * 3;
cur = vld3_dup_u8(palette + *(sp - 7) * 3);
cur = vld3_lane_u8(palette + *(sp - 6) * 3, cur, 1);
cur = vld3_lane_u8(palette + *(sp - 5) * 3, cur, 2);
cur = vld3_lane_u8(palette + *(sp - 4) * 3, cur, 3);
cur = vld3_lane_u8(palette + *(sp - 3) * 3, cur, 4);
cur = vld3_lane_u8(palette + *(sp - 2) * 3, cur, 5);
cur = vld3_lane_u8(palette + *(sp - 1) * 3, cur, 6);
cur = vld3_lane_u8(palette + *(sp - 0) * 3, cur, 7);
vst3_u8((void *)dp, cur);
}
if (i != row_width)
{
/* Remove the amount that wasn't processed. */
i -= pixels_per_chunk;
}
/* Decrement output pointers. */
/* Undo the pre-adjustment of *ddp before the pointer handoff,
* so the scalar fallback in pngrtran.c receives a dp that points
* to the correct position.
*/
*ddp = *ddp + (pixels_per_chunk * 3 - 1);
*ssp = *ssp - i;
*ddp = *ddp - ((i << 1) + i);
*ddp = *ddp - i * 3;
return i;
}
+38 -20
View File
@@ -26,30 +26,39 @@
* whichever of a, b, or c is closest to p=a+b-c.
*/
static __m128i load4(const void* p) {
static __m128i
load4(const void *p)
{
int tmp;
memcpy(&tmp, p, sizeof(tmp));
return _mm_cvtsi32_si128(tmp);
}
static void store4(void* p, __m128i v) {
static void
store4(void *p, __m128i v)
{
int tmp = _mm_cvtsi128_si32(v);
memcpy(p, &tmp, sizeof(int));
}
static __m128i load3(const void* p) {
static __m128i
load3(const void *p)
{
png_uint_32 tmp = 0;
memcpy(&tmp, p, 3);
return _mm_cvtsi32_si128(tmp);
}
static void store3(void* p, __m128i v) {
static void
store3(void *p, __m128i v)
{
int tmp = _mm_cvtsi128_si32(v);
memcpy(p, &tmp, 3);
}
void png_read_filter_row_sub3_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
void
png_read_filter_row_sub3_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
{
/* The Sub filter predicts each pixel as the previous pixel, a.
* There is no pixel to the left of the first pixel. It's encoded directly.
@@ -81,8 +90,9 @@ void png_read_filter_row_sub3_sse2(png_row_infop row_info, png_bytep row,
PNG_UNUSED(prev)
}
void png_read_filter_row_sub4_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
void
png_read_filter_row_sub4_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
{
/* The Sub filter predicts each pixel as the previous pixel, a.
* There is no pixel to the left of the first pixel. It's encoded directly.
@@ -106,8 +116,9 @@ void png_read_filter_row_sub4_sse2(png_row_infop row_info, png_bytep row,
PNG_UNUSED(prev)
}
void png_read_filter_row_avg3_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
void
png_read_filter_row_avg3_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
{
/* The Avg filter predicts each pixel as the (truncated) average of a and b.
* There's no pixel to the left of the first pixel. Luckily, it's
@@ -119,7 +130,7 @@ void png_read_filter_row_avg3_sse2(png_row_infop row_info, png_bytep row,
const __m128i zero = _mm_setzero_si128();
__m128i b;
__m128i b;
__m128i a, d = zero;
png_debug(1, "in png_read_filter_row_avg3_sse2");
@@ -161,8 +172,9 @@ void png_read_filter_row_avg3_sse2(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_avg4_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
void
png_read_filter_row_avg4_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
{
/* The Avg filter predicts each pixel as the (truncated) average of a and b.
* There's no pixel to the left of the first pixel. Luckily, it's
@@ -171,7 +183,7 @@ void png_read_filter_row_avg4_sse2(png_row_infop row_info, png_bytep row,
*/
size_t rb;
const __m128i zero = _mm_setzero_si128();
__m128i b;
__m128i b;
__m128i a, d = zero;
png_debug(1, "in png_read_filter_row_avg4_sse2");
@@ -198,7 +210,9 @@ void png_read_filter_row_avg4_sse2(png_row_infop row_info, png_bytep row,
}
/* Returns |x| for 16-bit lanes. */
static __m128i abs_i16(__m128i x) {
static __m128i
abs_i16(__m128i x)
{
#if PNG_INTEL_SSE_IMPLEMENTATION >= 2
return _mm_abs_epi16(x);
#else
@@ -217,7 +231,9 @@ static __m128i abs_i16(__m128i x) {
}
/* Bytewise c ? t : e. */
static __m128i if_then_else(__m128i c, __m128i t, __m128i e) {
static __m128i
if_then_else(__m128i c, __m128i t, __m128i e)
{
#if PNG_INTEL_SSE_IMPLEMENTATION >= 3
return _mm_blendv_epi8(e,t,c);
#else
@@ -225,8 +241,9 @@ static __m128i if_then_else(__m128i c, __m128i t, __m128i e) {
#endif
}
void png_read_filter_row_paeth3_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
void
png_read_filter_row_paeth3_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
{
/* Paeth tries to predict pixel d using the pixel to the left of it, a,
* and two pixels from the previous row, b and c:
@@ -324,8 +341,9 @@ void png_read_filter_row_paeth3_sse2(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_paeth4_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
void
png_read_filter_row_paeth4_sse2(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
{
/* Paeth tries to predict pixel d using the pixel to the left of it, a,
* and two pixels from the previous row, b and c:
+21 -16
View File
@@ -102,8 +102,9 @@
out0 = __lsx_vadd_b(out0, _in3); \
}
void png_read_filter_row_up_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_up_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t n = row_info->rowbytes;
png_bytep rp = row;
@@ -165,8 +166,9 @@ void png_read_filter_row_up_lsx(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_sub3_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_sub3_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t n = row_info->rowbytes;
png_uint_32 tmp;
@@ -199,8 +201,9 @@ void png_read_filter_row_sub3_lsx(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_sub4_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_sub4_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t n = row_info->rowbytes;
__m128i vec_0, vec_1;
@@ -222,8 +225,9 @@ void png_read_filter_row_sub4_lsx(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_avg3_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_avg3_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t n = row_info->rowbytes;
png_bytep nxt = row;
@@ -275,8 +279,9 @@ void png_read_filter_row_avg3_lsx(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_avg4_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_avg4_lsx(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t n = row_info->rowbytes;
__m128i vec_0, vec_1, vec_2;
@@ -306,9 +311,9 @@ void png_read_filter_row_avg4_lsx(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_paeth3_lsx(png_row_infop row_info,
png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_paeth3_lsx(png_row_infop row_info,
png_bytep row, png_const_bytep prev_row)
{
size_t n = row_info->rowbytes;
png_bytep nxt = row;
@@ -371,9 +376,9 @@ void png_read_filter_row_paeth3_lsx(png_row_infop row_info,
}
}
void png_read_filter_row_paeth4_lsx(png_row_infop row_info,
png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_paeth4_lsx(png_row_infop row_info,
png_bytep row, png_const_bytep prev_row)
{
size_t n = row_info->rowbytes;
__m128i vec_a, vec_b, vec_c, vec_d;
+2 -1
View File
@@ -17,7 +17,8 @@
#include <sys/auxv.h>
#define LA_HWCAP_LSX (1<<4)
static int png_has_lsx(void)
static int
png_has_lsx(void)
{
int flags = 0;
int flag = (int)getauxval(AT_HWCAP);
+7 -7
View File
@@ -23,7 +23,7 @@
*/
void png_read_filter_row_up_mmi(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
png_const_bytep prev_row)
{
int istop = row_info->rowbytes;
double rp,pp;
@@ -46,7 +46,7 @@ void png_read_filter_row_up_mmi(png_row_infop row_info, png_bytep row,
}
void png_read_filter_row_sub3_mmi(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
png_const_bytep prev)
{
int istop = row_info->rowbytes;
double rp, pp, dest;
@@ -105,7 +105,7 @@ void png_read_filter_row_sub3_mmi(png_row_infop row_info, png_bytep row,
}
void png_read_filter_row_sub4_mmi(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
png_const_bytep prev)
{
/* The Sub filter predicts each pixel as the previous pixel, a.
* There is no pixel to the left of the first pixel. It's encoded directly.
@@ -133,7 +133,7 @@ void png_read_filter_row_sub4_mmi(png_row_infop row_info, png_bytep row,
}
void png_read_filter_row_avg3_mmi(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
png_const_bytep prev)
{
int istop = row_info->rowbytes;
double rp, pp, rp1, pp1;
@@ -225,7 +225,7 @@ void png_read_filter_row_avg3_mmi(png_row_infop row_info, png_bytep row,
}
void png_read_filter_row_avg4_mmi(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
png_const_bytep prev)
{
int istop = row_info->rowbytes;
double rp,pp;
@@ -261,7 +261,7 @@ void png_read_filter_row_avg4_mmi(png_row_infop row_info, png_bytep row,
}
void png_read_filter_row_paeth3_mmi(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
png_const_bytep prev)
{
/* Paeth tries to predict pixel d using the pixel to the left of it, a,
* and two pixels from the previous row, b and c:
@@ -449,7 +449,7 @@ void png_read_filter_row_paeth3_mmi(png_row_infop row_info, png_bytep row,
}
void png_read_filter_row_paeth4_mmi(png_row_infop row_info, png_bytep row,
png_const_bytep prev)
png_const_bytep prev)
{
/* Paeth tries to predict pixel d using the pixel to the left of it, a,
* and two pixels from the previous row, b and c:
+21 -16
View File
@@ -363,8 +363,9 @@
out0 += inp4; \
}
void png_read_filter_row_up_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_up_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t i, cnt, cnt16, cnt32;
size_t istop = row_info->rowbytes;
@@ -454,8 +455,9 @@ void png_read_filter_row_up_msa(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_sub4_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_sub4_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t count;
size_t istop = row_info->rowbytes;
@@ -493,8 +495,9 @@ void png_read_filter_row_sub4_msa(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_sub3_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_sub3_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t count;
size_t istop = row_info->rowbytes;
@@ -538,8 +541,9 @@ void png_read_filter_row_sub3_msa(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_avg4_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_avg4_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t i;
png_bytep src = row;
@@ -589,8 +593,9 @@ void png_read_filter_row_avg4_msa(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_avg3_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_avg3_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
size_t i;
png_bytep src = row;
@@ -650,9 +655,9 @@ void png_read_filter_row_avg3_msa(png_row_infop row_info, png_bytep row,
}
}
void png_read_filter_row_paeth4_msa(png_row_infop row_info,
png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_paeth4_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
int32_t count, rp_end;
png_bytep nxt;
@@ -721,9 +726,9 @@ void png_read_filter_row_paeth4_msa(png_row_infop row_info,
}
}
void png_read_filter_row_paeth3_msa(png_row_infop row_info,
png_bytep row,
png_const_bytep prev_row)
void
png_read_filter_row_paeth3_msa(png_row_infop row_info, png_bytep row,
png_const_bytep prev_row)
{
int32_t count, rp_end;
png_bytep nxt;
-13
View File
@@ -1,13 +0,0 @@
diff --git a/3rdparty/libpng/riscv/filter_rvv_intrinsics.c b/3rdparty/libpng/riscv/filter_rvv_intrinsics.c
index 8d277d14cd..7e61fb89fb 100644
--- a/3rdparty/libpng/riscv/filter_rvv_intrinsics.c
+++ b/3rdparty/libpng/riscv/filter_rvv_intrinsics.c
@@ -142,7 +142,7 @@ png_read_filter_row_avg_rvv(size_t len, size_t bpp, unsigned char* row,
x = __riscv_vle8_v_u8m1(row, vl);
/* a = (a + b) / 2, round to zero with vxrm = 2 */
- a = __riscv_vaaddu_wx_u8m1(a, b, 2, vl);
+ a = __riscv_vaaddu_vv_u8m1(a, b, 2, vl);
/* a += x */
a = __riscv_vadd_vv_u8m1(a, x, vl);
+18 -15
View File
@@ -1,6 +1,6 @@
/* png.c - location for general purpose libpng functions
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -13,7 +13,7 @@
#include "pngpriv.h"
/* Generate a compiler error if there is an old png.h in the search path. */
typedef png_libpng_version_1_6_53 Your_png_h_is_not_version_1_6_53;
typedef png_libpng_version_1_6_57 Your_png_h_is_not_version_1_6_57;
/* Sanity check the chunks definitions - PNG_KNOWN_CHUNKS from pngpriv.h and the
* corresponding macro definitions. This causes a compile time failure if
@@ -101,7 +101,8 @@ png_sig_cmp(png_const_bytep sig, size_t start, size_t num_to_check)
#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
/* Function to allocate memory for zlib */
PNG_FUNCTION(voidpf /* PRIVATE */,
png_zalloc,(voidpf png_ptr, uInt items, uInt size),PNG_ALLOCATED)
png_zalloc,(voidpf png_ptr, uInt items, uInt size),
PNG_ALLOCATED)
{
png_alloc_size_t num_bytes = size;
@@ -257,7 +258,8 @@ png_user_version_check(png_structrp png_ptr, png_const_charp user_png_ver)
PNG_FUNCTION(png_structp /* PRIVATE */,
png_create_png_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
png_error_ptr error_fn, png_error_ptr warn_fn, png_voidp mem_ptr,
png_malloc_ptr malloc_fn, png_free_ptr free_fn),PNG_ALLOCATED)
png_malloc_ptr malloc_fn, png_free_ptr free_fn),
PNG_ALLOCATED)
{
png_struct create_struct;
# ifdef PNG_SETJMP_SUPPORTED
@@ -361,7 +363,8 @@ png_create_png_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
/* Allocate the memory for an info_struct for the application. */
PNG_FUNCTION(png_infop,PNGAPI
png_create_info_struct,(png_const_structrp png_ptr),PNG_ALLOCATED)
png_create_info_struct,(png_const_structrp png_ptr),
PNG_ALLOCATED)
{
png_inforp info_ptr;
@@ -817,8 +820,8 @@ png_get_copyright(png_const_structrp png_ptr)
return PNG_STRING_COPYRIGHT
#else
return PNG_STRING_NEWLINE \
"libpng version 1.6.53" PNG_STRING_NEWLINE \
"Copyright (c) 2018-2025 Cosmin Truta" PNG_STRING_NEWLINE \
"libpng version 1.6.57" PNG_STRING_NEWLINE \
"Copyright (c) 2018-2026 Cosmin Truta" PNG_STRING_NEWLINE \
"Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson" \
PNG_STRING_NEWLINE \
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
@@ -1167,7 +1170,7 @@ png_xy_from_XYZ(png_xy *xy, const png_XYZ *XYZ)
return 1;
/* The reference white is simply the sum of the end-point (X,Y,Z) vectors so
* the fillowing calculates (X+Y+Z) of the reference white (media white,
* the following calculates (X+Y+Z) of the reference white (media white,
* encoding white) itself:
*/
d = dblue;
@@ -1212,9 +1215,9 @@ png_XYZ_from_xy(png_XYZ *XYZ, const png_xy *xy)
* (-0.0770) because the PNG spec itself requires the xy values to be
* unsigned. whitey is also required to be 5 or more to avoid overflow.
*
* Instead the upper limits have been relaxed to accomodate ACES AP1 where
* Instead the upper limits have been relaxed to accommodate ACES AP1 where
* redz ends up as -600 (-0.006). ProPhotoRGB was already "in range."
* The new limit accomodates the AP0 and AP1 ranges for z but not AP0 redy.
* The new limit accommodates the AP0 and AP1 ranges for z but not AP0 redy.
*/
const png_fixed_point fpLimit = PNG_FP_1+(PNG_FP_1/10);
if (xy->redx < 0 || xy->redx > fpLimit) return 1;
@@ -1325,7 +1328,7 @@ png_XYZ_from_xy(png_XYZ *XYZ, const png_xy *xy)
* red-scale + green-scale + blue-scale = 1/white-y = white-scale
*
* So now we have a Cramer's rule solution where the determinants are just
* 3x3 - far more tractible. Unfortunately 3x3 determinants still involve
* 3x3 - far more tractable. Unfortunately 3x3 determinants still involve
* multiplication of three coefficients so we can't guarantee to avoid
* overflow in the libpng fixed point representation. Using Cramer's rule in
* floating point is probably a good choice here, but it's not an option for
@@ -1694,7 +1697,7 @@ png_icc_check_header(png_const_structrp png_ptr, png_const_charp name,
* into R, G and B channels.
*
* Previously it was suggested that an RGB profile on grayscale data could be
* handled. However it it is clear that using an RGB profile in this context
* handled. However it is clear that using an RGB profile in this context
* must be an error - there is no specification of what it means. Thus it is
* almost certainly more correct to ignore the profile.
*/
@@ -2257,8 +2260,8 @@ PNG_FP_End:
int
png_check_fp_string(png_const_charp string, size_t size)
{
int state=0;
size_t char_index=0;
int state = 0;
size_t char_index = 0;
if (png_check_fp_number(string, size, &state, &char_index) != 0 &&
(char_index == size || string[char_index] == 0))
@@ -2912,7 +2915,7 @@ png_gamma_significant(png_fixed_point gamma_val)
*
* 2.2/(2+51/256) == 1.00035524
*
* I.e. vanishly small (<4E-4) but still detectable in 16-bit linear (+/-
* I.e. vanishingly small (<4E-4) but still detectable in 16-bit linear (+/-
* 23). Note that the Adobe choice seems to be something intended to give an
* exact number with 8 binary fractional digits - it is the closest to 2.2
* that is possible a base 2 .8p representation.
+636 -487
View File
File diff suppressed because it is too large Load Diff
+2 -2
View File
@@ -1,8 +1,8 @@
/* pngconf.h - machine-configurable file for libpng
*
* libpng version 1.6.53
* libpng version 1.6.57
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2016,2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
+10 -7
View File
@@ -49,7 +49,8 @@ png_error,(png_const_structrp png_ptr, png_const_charp error_message),
}
#else
PNG_FUNCTION(void,PNGAPI
png_err,(png_const_structrp png_ptr),PNG_NORETURN)
png_err,(png_const_structrp png_ptr),
PNG_NORETURN)
{
/* Prior to 1.5.2 the error_fn received a NULL pointer, expressed
* erroneously as '\0', instead of the empty string "". This was
@@ -376,8 +377,8 @@ static const char png_digit[16] = {
};
static void /* PRIVATE */
png_format_buffer(png_const_structrp png_ptr, png_charp buffer, png_const_charp
error_message)
png_format_buffer(png_const_structrp png_ptr, png_charp buffer,
png_const_charp error_message)
{
png_uint_32 chunk_name = png_ptr->chunk_name;
int iout = 0, ishift = 24;
@@ -456,8 +457,8 @@ png_chunk_warning(png_const_structrp png_ptr, png_const_charp warning_message)
#ifdef PNG_READ_SUPPORTED
#ifdef PNG_BENIGN_ERRORS_SUPPORTED
void PNGAPI
png_chunk_benign_error(png_const_structrp png_ptr, png_const_charp
error_message)
png_chunk_benign_error(png_const_structrp png_ptr,
png_const_charp error_message)
{
if ((png_ptr->flags & PNG_FLAG_BENIGN_ERRORS_WARN) != 0)
png_chunk_warning(png_ptr, error_message);
@@ -514,7 +515,8 @@ png_chunk_report(png_const_structrp png_ptr, png_const_charp message, int error)
#ifdef PNG_ERROR_TEXT_SUPPORTED
#ifdef PNG_FLOATING_POINT_SUPPORTED
PNG_FUNCTION(void,
png_fixed_error,(png_const_structrp png_ptr, png_const_charp name),PNG_NORETURN)
png_fixed_error,(png_const_structrp png_ptr, png_const_charp name),
PNG_NORETURN)
{
# define fixed_message "fixed point overflow in "
# define fixed_message_ln ((sizeof fixed_message)-1)
@@ -667,7 +669,8 @@ png_default_error,(png_const_structrp png_ptr, png_const_charp error_message),
}
PNG_FUNCTION(void,PNGAPI
png_longjmp,(png_const_structrp png_ptr, int val),PNG_NORETURN)
png_longjmp,(png_const_structrp png_ptr, int val),
PNG_NORETURN)
{
#ifdef PNG_SETJMP_SUPPORTED
if (png_ptr != NULL && png_ptr->longjmp_fn != NULL &&
+6 -7
View File
@@ -122,8 +122,8 @@ png_get_compression_type(png_const_structrp png_ptr, png_const_inforp info_ptr)
}
png_uint_32 PNGAPI
png_get_x_pixels_per_meter(png_const_structrp png_ptr, png_const_inforp
info_ptr)
png_get_x_pixels_per_meter(png_const_structrp png_ptr,
png_const_inforp info_ptr)
{
#ifdef PNG_pHYs_SUPPORTED
png_debug(1, "in png_get_x_pixels_per_meter");
@@ -143,8 +143,8 @@ png_get_x_pixels_per_meter(png_const_structrp png_ptr, png_const_inforp
}
png_uint_32 PNGAPI
png_get_y_pixels_per_meter(png_const_structrp png_ptr, png_const_inforp
info_ptr)
png_get_y_pixels_per_meter(png_const_structrp png_ptr,
png_const_inforp info_ptr)
{
#ifdef PNG_pHYs_SUPPORTED
png_debug(1, "in png_get_y_pixels_per_meter");
@@ -186,8 +186,8 @@ png_get_pixels_per_meter(png_const_structrp png_ptr, png_const_inforp info_ptr)
#ifdef PNG_FLOATING_POINT_SUPPORTED
float PNGAPI
png_get_pixel_aspect_ratio(png_const_structrp png_ptr, png_const_inforp
info_ptr)
png_get_pixel_aspect_ratio(png_const_structrp png_ptr,
png_const_inforp info_ptr)
{
#ifdef PNG_READ_pHYs_SUPPORTED
png_debug(1, "in png_get_pixel_aspect_ratio");
@@ -737,7 +737,6 @@ png_get_iCCP(png_const_structrp png_ptr, png_inforp info_ptr,
}
return 0;
}
#endif
+12 -7
View File
@@ -46,7 +46,8 @@ png_destroy_png_struct(png_structrp png_ptr)
* have the ability to do that.
*/
PNG_FUNCTION(png_voidp,PNGAPI
png_calloc,(png_const_structrp png_ptr, png_alloc_size_t size),PNG_ALLOCATED)
png_calloc,(png_const_structrp png_ptr, png_alloc_size_t size),
PNG_ALLOCATED)
{
png_voidp ret;
@@ -118,7 +119,8 @@ png_malloc_array_checked(png_const_structrp png_ptr, int nelements,
PNG_FUNCTION(png_voidp /* PRIVATE */,
png_malloc_array,(png_const_structrp png_ptr, int nelements,
size_t element_size),PNG_ALLOCATED)
size_t element_size),
PNG_ALLOCATED)
{
if (nelements <= 0 || element_size == 0)
png_error(png_ptr, "internal error: array alloc");
@@ -128,7 +130,8 @@ png_malloc_array,(png_const_structrp png_ptr, int nelements,
PNG_FUNCTION(png_voidp /* PRIVATE */,
png_realloc_array,(png_const_structrp png_ptr, png_const_voidp old_array,
int old_elements, int add_elements, size_t element_size),PNG_ALLOCATED)
int old_elements, int add_elements, size_t element_size),
PNG_ALLOCATED)
{
/* These are internal errors: */
if (add_elements <= 0 || element_size == 0 || old_elements < 0 ||
@@ -167,7 +170,8 @@ png_realloc_array,(png_const_structrp png_ptr, png_const_voidp old_array,
* function png_malloc_default is also provided.
*/
PNG_FUNCTION(png_voidp,PNGAPI
png_malloc,(png_const_structrp png_ptr, png_alloc_size_t size),PNG_ALLOCATED)
png_malloc,(png_const_structrp png_ptr, png_alloc_size_t size),
PNG_ALLOCATED)
{
png_voidp ret;
@@ -241,7 +245,8 @@ png_free(png_const_structrp png_ptr, png_voidp ptr)
}
PNG_FUNCTION(void,PNGAPI
png_free_default,(png_const_structrp png_ptr, png_voidp ptr),PNG_DEPRECATED)
png_free_default,(png_const_structrp png_ptr, png_voidp ptr),
PNG_DEPRECATED)
{
if (png_ptr == NULL || ptr == NULL)
return;
@@ -255,8 +260,8 @@ png_free_default,(png_const_structrp png_ptr, png_voidp ptr),PNG_DEPRECATED)
* of allocating and freeing memory.
*/
void PNGAPI
png_set_mem_fn(png_structrp png_ptr, png_voidp mem_ptr, png_malloc_ptr
malloc_fn, png_free_ptr free_fn)
png_set_mem_fn(png_structrp png_ptr, png_voidp mem_ptr,
png_malloc_ptr malloc_fn, png_free_ptr free_fn)
{
if (png_ptr != NULL)
{
+568 -357
View File
File diff suppressed because it is too large Load Diff
+106 -99
View File
@@ -1,6 +1,6 @@
/* pngread.c - read a PNG file
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -23,7 +23,8 @@
/* Create a PNG structure for reading, and allocate any memory needed. */
PNG_FUNCTION(png_structp,PNGAPI
png_create_read_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
png_error_ptr error_fn, png_error_ptr warn_fn),PNG_ALLOCATED)
png_error_ptr error_fn, png_error_ptr warn_fn),
PNG_ALLOCATED)
{
#ifndef PNG_USER_MEM_SUPPORTED
png_structp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
@@ -39,7 +40,8 @@ png_create_read_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
PNG_FUNCTION(png_structp,PNGAPI
png_create_read_struct_2,(png_const_charp user_png_ver, png_voidp error_ptr,
png_error_ptr error_fn, png_error_ptr warn_fn, png_voidp mem_ptr,
png_malloc_ptr malloc_fn, png_free_ptr free_fn),PNG_ALLOCATED)
png_malloc_ptr malloc_fn, png_free_ptr free_fn),
PNG_ALLOCATED)
{
png_structp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
error_fn, warn_fn, mem_ptr, malloc_fn, free_fn);
@@ -519,7 +521,6 @@ png_read_row(png_structrp png_ptr, png_bytep row, png_bytep dsp_row)
if (png_ptr->read_row_fn != NULL)
(*(png_ptr->read_row_fn))(png_ptr, png_ptr->row_number, png_ptr->pass);
}
#endif /* SEQUENTIAL_READ */
@@ -690,7 +691,7 @@ png_read_end(png_structrp png_ptr, png_inforp info_ptr)
png_read_finish_IDAT(png_ptr);
#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED
/* Report invalid palette index; added at libng-1.5.10 */
/* Report invalid palette index; added at libpng-1.5.10 */
if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
png_ptr->num_palette_max >= png_ptr->num_palette)
png_benign_error(png_ptr, "Read palette index exceeding num_palette");
@@ -778,21 +779,19 @@ png_read_destroy(png_structrp png_ptr)
png_ptr->quantize_index = NULL;
#endif
if ((png_ptr->free_me & PNG_FREE_PLTE) != 0)
{
png_zfree(png_ptr, png_ptr->palette);
png_ptr->palette = NULL;
}
png_ptr->free_me &= ~PNG_FREE_PLTE;
/* png_ptr->palette is always independently allocated (not aliased
* with info_ptr->palette), so free it unconditionally.
*/
png_free(png_ptr, png_ptr->palette);
png_ptr->palette = NULL;
#if defined(PNG_tRNS_SUPPORTED) || \
defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED)
if ((png_ptr->free_me & PNG_FREE_TRNS) != 0)
{
png_free(png_ptr, png_ptr->trans_alpha);
png_ptr->trans_alpha = NULL;
}
png_ptr->free_me &= ~PNG_FREE_TRNS;
/* png_ptr->trans_alpha is always independently allocated (not aliased
* with info_ptr->trans_alpha), so free it unconditionally.
*/
png_free(png_ptr, png_ptr->trans_alpha);
png_ptr->trans_alpha = NULL;
#endif
inflateEnd(&png_ptr->zstream);
@@ -867,7 +866,7 @@ png_set_read_status_fn(png_structrp png_ptr, png_read_status_ptr read_row_fn)
#ifdef PNG_INFO_IMAGE_SUPPORTED
void PNGAPI
png_read_png(png_structrp png_ptr, png_inforp info_ptr,
int transforms, voidp params)
int transforms, png_voidp params)
{
png_debug(1, "in png_read_png");
@@ -1104,19 +1103,20 @@ png_read_png(png_structrp png_ptr, png_inforp info_ptr,
typedef struct
{
/* Arguments: */
/* Arguments */
png_imagep image;
png_voidp buffer;
png_voidp buffer;
png_int_32 row_stride;
png_voidp colormap;
png_voidp colormap;
png_const_colorp background;
/* Local variables: */
png_voidp local_row;
png_voidp first_row;
ptrdiff_t row_bytes; /* step between rows */
int file_encoding; /* E_ values above */
png_fixed_point gamma_to_linear; /* For P_FILE, reciprocal of gamma */
int colormap_processing; /* PNG_CMAP_ values above */
/* Instance variables */
png_voidp local_row;
png_voidp first_row;
ptrdiff_t row_step; /* step between rows */
int file_encoding; /* E_ values above */
png_fixed_point gamma_to_linear; /* For P_FILE, reciprocal of gamma */
int colormap_processing; /* PNG_CMAP_ values above */
} png_image_read_control;
/* Do all the *safe* initialization - 'safe' means that png_error won't be
@@ -1254,7 +1254,7 @@ png_image_is_not_sRGB(png_const_structrp png_ptr)
* png_struct::chromaticities always exists since the simplified API
* requires rgb-to-gray. The mDCV, cICP and cHRM chunks may all set it to
* a non-sRGB value, so it needs to be checked but **only** if one of
* those chunks occured in the file.
* those chunks occurred in the file.
*/
/* Highest priority: check to be safe. */
if (png_has_chunk(png_ptr, cICP) || png_has_chunk(png_ptr, mDCV))
@@ -2594,7 +2594,7 @@ png_image_read_colormap(png_voidp argument)
{
r = back_r;
g = back_g;
b = back_g;
b = back_b;
}
/* Compare the newly-created color-map entry with the one the
@@ -2837,17 +2837,17 @@ png_image_read_and_map(png_voidp argument)
}
{
png_uint_32 height = image->height;
png_uint_32 width = image->width;
int proc = display->colormap_processing;
png_bytep first_row = png_voidcast(png_bytep, display->first_row);
ptrdiff_t step_row = display->row_bytes;
png_uint_32 height = image->height;
png_uint_32 width = image->width;
int proc = display->colormap_processing;
png_bytep first_row = png_voidcast(png_bytep, display->first_row);
ptrdiff_t row_step = display->row_step;
int pass;
for (pass = 0; pass < passes; ++pass)
{
unsigned int startx, stepx, stepy;
png_uint_32 y;
unsigned int startx, stepx, stepy;
png_uint_32 y;
if (png_ptr->interlaced == PNG_INTERLACE_ADAM7)
{
@@ -2871,10 +2871,10 @@ png_image_read_and_map(png_voidp argument)
for (; y<height; y += stepy)
{
png_bytep inrow = png_voidcast(png_bytep, display->local_row);
png_bytep outrow = first_row + y * step_row;
png_const_bytep end_row = outrow + width;
png_bytep outrow = first_row + y * row_step;
png_const_bytep row_end = outrow + width;
/* Read read the libpng data into the temporary buffer. */
/* Read the libpng data into the temporary buffer. */
png_read_row(png_ptr, inrow, NULL);
/* Now process the row according to the processing option, note
@@ -2885,7 +2885,7 @@ png_image_read_and_map(png_voidp argument)
switch (proc)
{
case PNG_CMAP_GA:
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
/* The data is always in the PNG order */
unsigned int gray = *inrow++;
@@ -2914,7 +2914,7 @@ png_image_read_and_map(png_voidp argument)
break;
case PNG_CMAP_TRANS:
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_byte gray = *inrow++;
png_byte alpha = *inrow++;
@@ -2931,7 +2931,7 @@ png_image_read_and_map(png_voidp argument)
break;
case PNG_CMAP_RGB:
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
*outrow = PNG_RGB_INDEX(inrow[0], inrow[1], inrow[2]);
inrow += 3;
@@ -2939,7 +2939,7 @@ png_image_read_and_map(png_voidp argument)
break;
case PNG_CMAP_RGB_ALPHA:
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
unsigned int alpha = inrow[3];
@@ -2976,10 +2976,10 @@ png_image_read_and_map(png_voidp argument)
*/
if (inrow[0] & 0x80) back_i += 9; /* red */
if (inrow[0] & 0x40) back_i += 9;
if (inrow[0] & 0x80) back_i += 3; /* green */
if (inrow[0] & 0x40) back_i += 3;
if (inrow[0] & 0x80) back_i += 1; /* blue */
if (inrow[0] & 0x40) back_i += 1;
if (inrow[1] & 0x80) back_i += 3; /* green */
if (inrow[1] & 0x40) back_i += 3;
if (inrow[2] & 0x80) back_i += 1; /* blue */
if (inrow[2] & 0x40) back_i += 1;
*outrow = (png_byte)back_i;
}
@@ -3080,20 +3080,20 @@ png_image_read_colormapped(png_voidp argument)
*/
{
png_voidp first_row = display->buffer;
ptrdiff_t row_bytes = display->row_stride;
ptrdiff_t row_step = display->row_stride;
/* The following expression is designed to work correctly whether it gives
* a signed or an unsigned result.
/* The following adjustment is to ensure that calculations are correct,
* regardless whether row_step is positive or negative.
*/
if (row_bytes < 0)
if (row_step < 0)
{
char *ptr = png_voidcast(char*, first_row);
ptr += (image->height-1) * (-row_bytes);
ptr += (image->height-1) * (-row_step);
first_row = png_voidcast(png_voidp, ptr);
}
display->first_row = first_row;
display->row_bytes = row_bytes;
display->row_step = row_step;
}
if (passes == 0)
@@ -3111,17 +3111,17 @@ png_image_read_colormapped(png_voidp argument)
else
{
png_alloc_size_t row_bytes = (png_alloc_size_t)display->row_bytes;
ptrdiff_t row_step = display->row_step;
while (--passes >= 0)
{
png_uint_32 y = image->height;
png_bytep row = png_voidcast(png_bytep, display->first_row);
png_uint_32 y = image->height;
png_bytep row = png_voidcast(png_bytep, display->first_row);
for (; y > 0; --y)
{
png_read_row(png_ptr, row, NULL);
row += row_bytes;
row += row_step;
}
}
@@ -3137,9 +3137,11 @@ png_image_read_direct_scaled(png_voidp argument)
argument);
png_imagep image = display->image;
png_structrp png_ptr = image->opaque->png_ptr;
png_inforp info_ptr = image->opaque->info_ptr;
png_bytep local_row = png_voidcast(png_bytep, display->local_row);
png_bytep first_row = png_voidcast(png_bytep, display->first_row);
ptrdiff_t row_bytes = display->row_bytes;
ptrdiff_t row_step = display->row_step;
size_t row_bytes = png_get_rowbytes(png_ptr, info_ptr);
int passes;
/* Handle interlacing. */
@@ -3168,9 +3170,14 @@ png_image_read_direct_scaled(png_voidp argument)
/* Read into local_row (gets transformed 8-bit data). */
png_read_row(png_ptr, local_row, NULL);
/* Copy from local_row to user buffer. */
memcpy(output_row, local_row, (size_t)row_bytes);
output_row += row_bytes;
/* Copy from local_row to user buffer.
* Use row_bytes (i.e. the actual size in bytes of the row data) for
* copying into output_row. Use row_step for advancing output_row,
* to respect the caller's stride for padding or negative (bottom-up)
* layouts.
*/
memcpy(output_row, local_row, row_bytes);
output_row += row_step;
}
}
@@ -3202,9 +3209,9 @@ png_image_read_composite(png_voidp argument)
}
{
png_uint_32 height = image->height;
png_uint_32 width = image->width;
ptrdiff_t step_row = display->row_bytes;
png_uint_32 height = image->height;
png_uint_32 width = image->width;
ptrdiff_t row_step = display->row_step;
unsigned int channels =
(image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
int optimize_alpha = (png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0;
@@ -3212,8 +3219,8 @@ png_image_read_composite(png_voidp argument)
for (pass = 0; pass < passes; ++pass)
{
unsigned int startx, stepx, stepy;
png_uint_32 y;
unsigned int startx, stepx, stepy;
png_uint_32 y;
if (png_ptr->interlaced == PNG_INTERLACE_ADAM7)
{
@@ -3239,18 +3246,18 @@ png_image_read_composite(png_voidp argument)
{
png_bytep inrow = png_voidcast(png_bytep, display->local_row);
png_bytep outrow;
png_const_bytep end_row;
png_const_bytep row_end;
/* Read the row, which is packed: */
png_read_row(png_ptr, inrow, NULL);
outrow = png_voidcast(png_bytep, display->first_row);
outrow += y * step_row;
end_row = outrow + width * channels;
outrow += y * row_step;
row_end = outrow + width * channels;
/* Now do the composition on each pixel in this row. */
outrow += startx;
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_byte alpha = inrow[channels];
@@ -3390,12 +3397,12 @@ png_image_read_background(png_voidp argument)
*/
{
png_bytep first_row = png_voidcast(png_bytep, display->first_row);
ptrdiff_t step_row = display->row_bytes;
ptrdiff_t row_step = display->row_step;
for (pass = 0; pass < passes; ++pass)
{
unsigned int startx, stepx, stepy;
png_uint_32 y;
unsigned int startx, stepx, stepy;
png_uint_32 y;
if (png_ptr->interlaced == PNG_INTERLACE_ADAM7)
{
@@ -3422,15 +3429,15 @@ png_image_read_background(png_voidp argument)
{
png_bytep inrow = png_voidcast(png_bytep,
display->local_row);
png_bytep outrow = first_row + y * step_row;
png_const_bytep end_row = outrow + width;
png_bytep outrow = first_row + y * row_step;
png_const_bytep row_end = outrow + width;
/* Read the row, which is packed: */
png_read_row(png_ptr, inrow, NULL);
/* Now do the composition on each pixel in this row. */
outrow += startx;
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_byte alpha = inrow[1];
@@ -3467,15 +3474,15 @@ png_image_read_background(png_voidp argument)
{
png_bytep inrow = png_voidcast(png_bytep,
display->local_row);
png_bytep outrow = first_row + y * step_row;
png_const_bytep end_row = outrow + width;
png_bytep outrow = first_row + y * row_step;
png_const_bytep row_end = outrow + width;
/* Read the row, which is packed: */
png_read_row(png_ptr, inrow, NULL);
/* Now do the composition on each pixel in this row. */
outrow += startx;
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_byte alpha = inrow[1];
@@ -3513,9 +3520,9 @@ png_image_read_background(png_voidp argument)
png_uint_16p first_row = png_voidcast(png_uint_16p,
display->first_row);
/* The division by two is safe because the caller passed in a
* stride which was multiplied by 2 (below) to get row_bytes.
* stride which was multiplied by 2 (below) to get row_step.
*/
ptrdiff_t step_row = display->row_bytes / 2;
ptrdiff_t row_step = display->row_step / 2;
unsigned int preserve_alpha = (image->format &
PNG_FORMAT_FLAG_ALPHA) != 0;
unsigned int outchannels = 1U+preserve_alpha;
@@ -3529,8 +3536,8 @@ png_image_read_background(png_voidp argument)
for (pass = 0; pass < passes; ++pass)
{
unsigned int startx, stepx, stepy;
png_uint_32 y;
unsigned int startx, stepx, stepy;
png_uint_32 y;
/* The 'x' start and step are adjusted to output components here.
*/
@@ -3557,8 +3564,8 @@ png_image_read_background(png_voidp argument)
for (; y<height; y += stepy)
{
png_const_uint_16p inrow;
png_uint_16p outrow = first_row + y*step_row;
png_uint_16p end_row = outrow + width * outchannels;
png_uint_16p outrow = first_row + y * row_step;
png_uint_16p row_end = outrow + width * outchannels;
/* Read the row, which is packed: */
png_read_row(png_ptr, png_voidcast(png_bytep,
@@ -3568,7 +3575,7 @@ png_image_read_background(png_voidp argument)
/* Now do the pre-multiplication on each pixel in this row.
*/
outrow += startx;
for (; outrow < end_row; outrow += stepx)
for (; outrow < row_end; outrow += stepx)
{
png_uint_32 component = inrow[0];
png_uint_16 alpha = inrow[1];
@@ -3994,23 +4001,23 @@ png_image_read_direct(png_voidp argument)
*/
{
png_voidp first_row = display->buffer;
ptrdiff_t row_bytes = display->row_stride;
ptrdiff_t row_step = display->row_stride;
if (linear != 0)
row_bytes *= 2;
row_step *= 2;
/* The following expression is designed to work correctly whether it gives
* a signed or an unsigned result.
/* The following adjustment is to ensure that calculations are correct,
* regardless whether row_step is positive or negative.
*/
if (row_bytes < 0)
if (row_step < 0)
{
char *ptr = png_voidcast(char*, first_row);
ptr += (image->height-1) * (-row_bytes);
ptr += (image->height - 1) * (-row_step);
first_row = png_voidcast(png_voidp, ptr);
}
display->first_row = first_row;
display->row_bytes = row_bytes;
display->row_step = row_step;
}
if (do_local_compose != 0)
@@ -4059,17 +4066,17 @@ png_image_read_direct(png_voidp argument)
else
{
png_alloc_size_t row_bytes = (png_alloc_size_t)display->row_bytes;
ptrdiff_t row_step = display->row_step;
while (--passes >= 0)
{
png_uint_32 y = image->height;
png_bytep row = png_voidcast(png_bytep, display->first_row);
png_uint_32 y = image->height;
png_bytep row = png_voidcast(png_bytep, display->first_row);
for (; y > 0; --y)
{
png_read_row(png_ptr, row, NULL);
row += row_bytes;
row += row_step;
}
}
@@ -4104,7 +4111,7 @@ png_image_finish_read(png_imagep image, png_const_colorp background,
row_stride = (png_int_32)/*SAFE*/png_row_stride;
if (row_stride < 0)
check = (png_uint_32)(-row_stride);
check = -(png_uint_32)row_stride;
else
check = (png_uint_32)row_stride;
+46 -22
View File
@@ -1,6 +1,6 @@
/* pngrtran.c - transforms the data in a row for PNG readers
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -230,7 +230,7 @@ png_set_strip_alpha(png_structrp png_ptr)
*
* Terminology (assuming power law, "gamma", encodings):
* "screen" gamma: a power law imposed by the output device when digital
* samples are converted to visible light output. The EOTF - volage to
* samples are converted to visible light output. The EOTF - voltage to
* luminance on output.
*
* "file" gamma: a power law used to encode luminance levels from the input
@@ -495,6 +495,9 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,
if (png_rtran_ok(png_ptr, 0) == 0)
return;
if (palette == NULL)
return;
png_ptr->transformations |= PNG_QUANTIZE;
if (full_quantize == 0)
@@ -708,8 +711,8 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,
break;
t->next = hash[d];
t->left = (png_byte)i;
t->right = (png_byte)j;
t->left = png_ptr->palette_to_index[i];
t->right = png_ptr->palette_to_index[j];
hash[d] = t;
}
}
@@ -811,7 +814,13 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,
}
if (png_ptr->palette == NULL)
{
png_ptr->palette = palette;
/* Allocate an owned copy rather than aliasing the caller's pointer,
* so that png_read_destroy can free png_ptr->palette unconditionally.
*/
png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
memcpy(png_ptr->palette, palette, (unsigned int)num_palette *
(sizeof (png_color)));
}
png_ptr->num_palette = (png_uint_16)num_palette;
@@ -1120,8 +1129,8 @@ png_set_rgb_to_gray(png_structrp png_ptr, int error_action, double red,
#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
void PNGAPI
png_set_read_user_transform_fn(png_structrp png_ptr, png_user_transform_ptr
read_user_transform_fn)
png_set_read_user_transform_fn(png_structrp png_ptr,
png_user_transform_ptr read_user_transform_fn)
{
png_debug(1, "in png_set_read_user_transform_fn");
@@ -1364,7 +1373,7 @@ png_resolve_file_gamma(png_const_structrp png_ptr)
if (file_gamma != 0)
return file_gamma;
/* If png_reciprocal oveflows it returns 0 which indicates to the caller that
/* If png_reciprocal overflows, it returns 0, indicating to the caller that
* there is no usable file gamma. (The checks added to png_set_gamma and
* png_set_alpha_mode should prevent a screen_gamma which would overflow.)
*/
@@ -2061,6 +2070,21 @@ png_read_transform_info(png_structrp png_ptr, png_inforp info_ptr)
{
png_debug(1, "in png_read_transform_info");
if (png_ptr->transformations != 0)
{
if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE &&
info_ptr->palette != NULL && png_ptr->palette != NULL)
{
/* Sync info_ptr->palette with png_ptr->palette.
* The function png_init_read_transformations may have modified
* png_ptr->palette in place (e.g. for gamma correction or for
* background compositing).
*/
memcpy(info_ptr->palette, png_ptr->palette,
PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)));
}
}
#ifdef PNG_READ_EXPAND_SUPPORTED
if ((png_ptr->transformations & PNG_EXPAND) != 0)
{
@@ -2355,7 +2379,7 @@ png_do_unpack(png_row_infop row_info, png_bytep row)
}
row_info->bit_depth = 8;
row_info->pixel_depth = (png_byte)(8 * row_info->channels);
row_info->rowbytes = row_width * row_info->channels;
row_info->rowbytes = (size_t)row_width * row_info->channels;
}
}
#endif
@@ -2557,7 +2581,7 @@ png_do_scale_16_to_8(png_row_infop row_info, png_bytep row)
row_info->bit_depth = 8;
row_info->pixel_depth = (png_byte)(8 * row_info->channels);
row_info->rowbytes = row_info->width * row_info->channels;
row_info->rowbytes = (size_t)row_info->width * row_info->channels;
}
}
#endif
@@ -2585,7 +2609,7 @@ png_do_chop(png_row_infop row_info, png_bytep row)
row_info->bit_depth = 8;
row_info->pixel_depth = (png_byte)(8 * row_info->channels);
row_info->rowbytes = row_info->width * row_info->channels;
row_info->rowbytes = (size_t)row_info->width * row_info->channels;
}
}
#endif
@@ -2821,7 +2845,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
*(--dp) = lo_filler;
row_info->channels = 2;
row_info->pixel_depth = 16;
row_info->rowbytes = row_width * 2;
row_info->rowbytes = (size_t)row_width * 2;
}
else
@@ -2836,7 +2860,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
}
row_info->channels = 2;
row_info->pixel_depth = 16;
row_info->rowbytes = row_width * 2;
row_info->rowbytes = (size_t)row_width * 2;
}
}
@@ -2859,7 +2883,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
*(--dp) = hi_filler;
row_info->channels = 2;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
}
else
@@ -2876,7 +2900,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
}
row_info->channels = 2;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
}
}
#endif
@@ -2900,7 +2924,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
*(--dp) = lo_filler;
row_info->channels = 4;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
}
else
@@ -2917,7 +2941,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
}
row_info->channels = 4;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
}
}
@@ -2944,7 +2968,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
*(--dp) = hi_filler;
row_info->channels = 4;
row_info->pixel_depth = 64;
row_info->rowbytes = row_width * 8;
row_info->rowbytes = (size_t)row_width * 8;
}
else
@@ -2966,7 +2990,7 @@ png_do_read_filler(png_row_infop row_info, png_bytep row,
row_info->channels = 4;
row_info->pixel_depth = 64;
row_info->rowbytes = row_width * 8;
row_info->rowbytes = (size_t)row_width * 8;
}
}
#endif
@@ -4460,7 +4484,7 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop row_info,
}
row_info->bit_depth = 8;
row_info->pixel_depth = 32;
row_info->rowbytes = row_width * 4;
row_info->rowbytes = (size_t)row_width * 4;
row_info->color_type = 6;
row_info->channels = 4;
}
@@ -4468,7 +4492,7 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop row_info,
else
{
sp = row + (size_t)row_width - 1;
dp = row + (size_t)(row_width * 3) - 1;
dp = row + (size_t)row_width * 3 - 1;
i = 0;
#ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE
i = png_do_expand_palette_rgb8_neon(png_ptr, row_info, row,
@@ -4487,7 +4511,7 @@ png_do_expand_palette(png_structrp png_ptr, png_row_infop row_info,
row_info->bit_depth = 8;
row_info->pixel_depth = 24;
row_info->rowbytes = row_width * 3;
row_info->rowbytes = (size_t)row_width * 3;
row_info->color_type = 2;
row_info->channels = 3;
}
+18 -30
View File
@@ -436,7 +436,7 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
* be gained by using this when it is known *if* the zlib stream itself does
* not record the number; however, this is an illusion: the original writer
* of the PNG may have selected a lower window size, and we really must
* follow that because, for systems with with limited capabilities, we
* follow that because, for systems with limited capabilities, we
* would otherwise reject the application's attempts to use a smaller window
* size (zlib doesn't have an interface to say "this or lower"!).
*
@@ -1006,7 +1006,7 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
* in the case of an 8-bit display with a decoder which controls the palette.
*
* The alternative here is to ignore the error and store the palette anyway;
* destroying the tRNS will definately cause problems.
* destroying the tRNS will definitely cause problems.
*
* NOTE: the case of PNG_COLOR_TYPE_PALETTE need not be considered because
* the png_handle_ routines for the three 'after PLTE' chunks tRNS, bKGD and
@@ -1053,19 +1053,6 @@ png_handle_PLTE(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
/* A valid PLTE chunk has been read */
png_ptr->mode |= PNG_HAVE_PLTE;
/* TODO: png_set_PLTE has the side effect of setting png_ptr->palette to
* its own copy of the palette. This has the side effect that when
* png_start_row is called (this happens after any call to
* png_read_update_info) the info_ptr palette gets changed. This is
* extremely unexpected and confusing.
*
* REVIEW: there have been consistent bugs in the past about gamma and
* similar transforms to colour mapped images being useless because the
* modified palette cannot be accessed because of the above.
*
* CONSIDER: Fix this by not sharing the palette in this way. But does
* this completely fix the problem?
*/
png_set_PLTE(png_ptr, info_ptr, palette, num);
return handled_ok;
}
@@ -1267,7 +1254,7 @@ png_handle_cHRM(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
/* png_set_cHRM may complain about some of the values but this doesn't matter
* because it was a cHRM and it did have vaguely (if, perhaps, ridiculous)
* values. Ridiculousity will be checked if the values are used later.
* values. Ridiculosity will be checked if the values are used later.
*/
png_set_cHRM_fixed(png_ptr, info_ptr, xy.whitex, xy.whitey, xy.redx, xy.redy,
xy.greenx, xy.greeny, xy.bluex, xy.bluey);
@@ -1564,7 +1551,8 @@ static png_handle_result_code /* PRIVATE */
png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
/* Note: this does not properly handle chunks that are > 64K under DOS */
{
png_bytep entry_start, buffer;
png_bytep buffer;
png_bytep entry_start;
png_sPLT_t new_palette;
png_sPLT_entryp pp;
png_uint_32 data_length;
@@ -1771,10 +1759,6 @@ png_handle_tRNS(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
return handled_error;
}
/* TODO: this is a horrible side effect in the palette case because the
* png_struct ends up with a pointer to the tRNS buffer owned by the
* png_info. Fix this.
*/
png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans,
&(png_ptr->trans_color));
return handled_ok;
@@ -2033,7 +2017,7 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
return handled_error;
/* PNGv3: the code used to check the byte order mark at the start for MM or
* II, however PNGv3 states that the the first 4 bytes should be checked.
* II, however PNGv3 states that the first 4 bytes should be checked.
* The caller ensures that there are four bytes available.
*/
{
@@ -2155,9 +2139,13 @@ png_handle_oFFs(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
static png_handle_result_code /* PRIVATE */
png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
{
png_bytep buffer;
png_bytep buf;
png_bytep endptr;
png_int_32 X0, X1;
png_byte type, nparams;
png_bytep buffer, buf, units, endptr;
png_byte type;
png_byte nparams;
png_byte *units;
png_charpp params;
int i;
@@ -2386,7 +2374,7 @@ png_handle_tIME(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
static png_handle_result_code /* PRIVATE */
png_handle_tEXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
{
png_text text_info;
png_text text_info;
png_bytep buffer;
png_charp key;
png_charp text;
@@ -2459,8 +2447,8 @@ static png_handle_result_code /* PRIVATE */
png_handle_zTXt(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
{
png_const_charp errmsg = NULL;
png_bytep buffer;
png_uint_32 keyword_length;
png_bytep buffer;
png_uint_32 keyword_length;
png_debug(1, "in png_handle_zTXt");
@@ -3011,7 +2999,7 @@ static const struct
png_uint_32 max_length :12; /* Length min, max in bytes */
png_uint_32 min_length :8;
/* Length errors on critical chunks have special handling to preserve the
* existing behaviour in libpng 1.6. Anciallary chunks are checked below
* existing behaviour in libpng 1.6. Ancillary chunks are checked below
* and produce a 'benign' error.
*/
png_uint_32 pos_before :4; /* PNG_HAVE_ values chunk must precede */
@@ -3019,7 +3007,7 @@ static const struct
/* NOTE: PLTE, tRNS and bKGD require special handling which depends on
* the colour type of the base image.
*/
png_uint_32 multiple :1; /* Multiple occurences permitted */
png_uint_32 multiple :1; /* Multiple occurrences permitted */
/* This is enabled for PLTE because PLTE may, in practice, be optional */
}
read_chunks[PNG_INDEX_unknown] =
@@ -3053,7 +3041,7 @@ read_chunks[PNG_INDEX_unknown] =
# define CDIHDR 13U, 13U, hIHDR, 0, 0
# define CDPLTE NoCheck, 0U, 0, hIHDR, 1
/* PLTE errors are only critical for colour-map images, consequently the
* hander does all the checks.
* handler does all the checks.
*/
# define CDIDAT NoCheck, 0U, aIDAT, hIHDR, 1
# define CDIEND NoCheck, 0U, 0, aIDAT, 0
+95 -26
View File
@@ -1,6 +1,6 @@
/* pngset.c - storage of image information into info struct
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -333,7 +333,8 @@ png_set_eXIf_1(png_const_structrp png_ptr, png_inforp info_ptr,
png_debug1(1, "in %s storage function", "eXIf");
if (png_ptr == NULL || info_ptr == NULL ||
(png_ptr->mode & PNG_WROTE_eXIf) != 0)
(png_ptr->mode & PNG_WROTE_eXIf) != 0 ||
exif == NULL)
return;
new_exif = png_voidcast(png_bytep, png_malloc_warn(png_ptr, num_exif));
@@ -384,11 +385,12 @@ void PNGAPI
png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
png_const_uint_16p hist)
{
png_uint_16 safe_hist[PNG_MAX_PALETTE_LENGTH];
int i;
png_debug1(1, "in %s storage function", "hIST");
if (png_ptr == NULL || info_ptr == NULL)
if (png_ptr == NULL || info_ptr == NULL || hist == NULL)
return;
if (info_ptr->num_palette == 0 || info_ptr->num_palette
@@ -400,6 +402,13 @@ png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
return;
}
/* Snapshot the caller's hist before freeing, in case it points to
* info_ptr->hist (getter-to-setter aliasing).
*/
memcpy(safe_hist, hist, (unsigned int)info_ptr->num_palette *
(sizeof (png_uint_16)));
hist = safe_hist;
png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
/* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in
@@ -741,7 +750,7 @@ void PNGAPI
png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
png_const_colorp palette, int num_palette)
{
png_color safe_palette[PNG_MAX_PALETTE_LENGTH];
png_uint_32 max_palette_length;
png_debug1(1, "in %s storage function", "PLTE");
@@ -775,28 +784,47 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
png_error(png_ptr, "Invalid palette");
}
/* It may not actually be necessary to set png_ptr->palette here;
* we do it for backward compatibility with the way the png_handle_tRNS
* function used to do the allocation.
*
* 1.6.0: the above statement appears to be incorrect; something has to set
* the palette inside png_struct on read.
/* Snapshot the caller's palette before freeing, in case it points to
* info_ptr->palette (getter-to-setter aliasing).
*/
if (num_palette > 0)
memcpy(safe_palette, palette, (unsigned int)num_palette *
(sizeof (png_color)));
palette = safe_palette;
png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
/* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
* of num_palette entries, in case of an invalid PNG file or incorrect
* call to png_set_PLTE() with too-large sample values.
*
* Allocate independent buffers for info_ptr and png_ptr so that the
* lifetime of png_ptr->palette is decoupled from the lifetime of
* info_ptr->palette. Previously, these two pointers were aliased,
* which caused a use-after-free vulnerability if png_free_data freed
* info_ptr->palette while png_ptr->palette was still in use by the
* row transform functions (e.g. png_do_expand_palette).
*
* Both buffers are allocated with png_calloc to zero-fill, because
* the ARM NEON palette riffle reads all 256 entries unconditionally,
* regardless of num_palette.
*/
png_free(png_ptr, png_ptr->palette);
png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
info_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr,
PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))));
png_ptr->num_palette = info_ptr->num_palette = (png_uint_16)num_palette;
if (num_palette > 0)
{
memcpy(info_ptr->palette, palette, (unsigned int)num_palette *
(sizeof (png_color)));
memcpy(png_ptr->palette, palette, (unsigned int)num_palette *
(sizeof (png_color)));
}
info_ptr->palette = png_ptr->palette;
info_ptr->num_palette = png_ptr->num_palette = (png_uint_16)num_palette;
info_ptr->free_me |= PNG_FREE_PLTE;
info_ptr->valid |= PNG_INFO_PLTE;
}
@@ -926,6 +954,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
png_const_textp text_ptr, int num_text)
{
int i;
png_textp old_text = NULL;
png_debug1(1, "in text storage function, chunk typeid = 0x%lx",
png_ptr == NULL ? 0xabadca11UL : (unsigned long)png_ptr->chunk_name);
@@ -973,7 +1002,10 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
return 1;
}
png_free(png_ptr, info_ptr->text);
/* Defer freeing the old array until after the copy loop below,
* in case text_ptr aliases info_ptr->text (getter-to-setter).
*/
old_text = info_ptr->text;
info_ptr->text = new_text;
info_ptr->free_me |= PNG_FREE_TEXT;
@@ -1058,6 +1090,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
{
png_chunk_report(png_ptr, "text chunk: out of memory",
PNG_CHUNK_WRITE_ERROR);
png_free(png_ptr, old_text);
return 1;
}
@@ -1111,6 +1144,8 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
png_debug1(3, "transferred text chunk %d", info_ptr->num_text);
}
png_free(png_ptr, old_text);
return 0;
}
#endif
@@ -1154,28 +1189,50 @@ png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
if (trans_alpha != NULL)
{
/* It may not actually be necessary to set png_ptr->trans_alpha here;
* we do it for backward compatibility with the way the png_handle_tRNS
* function used to do the allocation.
*
* 1.6.0: The above statement is incorrect; png_handle_tRNS effectively
* relies on png_set_tRNS storing the information in png_struct
* (otherwise it won't be there for the code in pngrtran.c).
/* Snapshot the caller's trans_alpha before freeing, in case it
* points to info_ptr->trans_alpha (getter-to-setter aliasing).
*/
png_byte safe_trans[PNG_MAX_PALETTE_LENGTH];
if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
memcpy(safe_trans, trans_alpha, (size_t)num_trans);
trans_alpha = safe_trans;
png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
{
/* Changed from num_trans to PNG_MAX_PALETTE_LENGTH in version 1.2.1 */
/* Allocate info_ptr's copy of the transparency data.
* Initialize all entries to fully opaque (0xff), then overwrite
* the first num_trans entries with the actual values.
*/
info_ptr->trans_alpha = png_voidcast(png_bytep,
png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
memset(info_ptr->trans_alpha, 0xff, PNG_MAX_PALETTE_LENGTH);
memcpy(info_ptr->trans_alpha, trans_alpha, (size_t)num_trans);
info_ptr->free_me |= PNG_FREE_TRNS;
info_ptr->valid |= PNG_INFO_tRNS;
/* Allocate an independent copy for png_struct, so that the
* lifetime of png_ptr->trans_alpha is decoupled from the
* lifetime of info_ptr->trans_alpha. Previously these two
* pointers were aliased, which caused a use-after-free if
* png_free_data freed info_ptr->trans_alpha while
* png_ptr->trans_alpha was still in use by the row transform
* functions (e.g. png_do_expand_palette).
*/
png_free(png_ptr, png_ptr->trans_alpha);
png_ptr->trans_alpha = png_voidcast(png_bytep,
png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
memset(png_ptr->trans_alpha, 0xff, PNG_MAX_PALETTE_LENGTH);
memcpy(png_ptr->trans_alpha, trans_alpha, (size_t)num_trans);
}
else
{
png_free(png_ptr, png_ptr->trans_alpha);
png_ptr->trans_alpha = NULL;
}
png_ptr->trans_alpha = info_ptr->trans_alpha;
}
if (trans_color != NULL)
@@ -1226,6 +1283,7 @@ png_set_sPLT(png_const_structrp png_ptr,
*/
{
png_sPLT_tp np;
png_sPLT_tp old_spalettes;
png_debug1(1, "in %s storage function", "sPLT");
@@ -1246,7 +1304,10 @@ png_set_sPLT(png_const_structrp png_ptr,
return;
}
png_free(png_ptr, info_ptr->splt_palettes);
/* Defer freeing the old array until after the copy loop below,
* in case entries aliases info_ptr->splt_palettes (getter-to-setter).
*/
old_spalettes = info_ptr->splt_palettes;
info_ptr->splt_palettes = np;
info_ptr->free_me |= PNG_FREE_SPLT;
@@ -1310,6 +1371,8 @@ png_set_sPLT(png_const_structrp png_ptr,
}
while (--nentries);
png_free(png_ptr, old_spalettes);
if (nentries > 0)
png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
}
@@ -1358,6 +1421,7 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
png_inforp info_ptr, png_const_unknown_chunkp unknowns, int num_unknowns)
{
png_unknown_chunkp np;
png_unknown_chunkp old_unknowns;
if (png_ptr == NULL || info_ptr == NULL || num_unknowns <= 0 ||
unknowns == NULL)
@@ -1404,7 +1468,10 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
return;
}
png_free(png_ptr, info_ptr->unknown_chunks);
/* Defer freeing the old array until after the copy loop below,
* in case unknowns aliases info_ptr->unknown_chunks (getter-to-setter).
*/
old_unknowns = info_ptr->unknown_chunks;
info_ptr->unknown_chunks = np; /* safe because it is initialized */
info_ptr->free_me |= PNG_FREE_UNKN;
@@ -1450,6 +1517,8 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
++np;
++(info_ptr->unknown_chunks_num);
}
png_free(png_ptr, old_unknowns);
}
void PNGAPI
@@ -1873,7 +1942,7 @@ png_set_benign_errors(png_structrp png_ptr, int allowed)
#endif /* BENIGN_ERRORS */
#ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED
/* Whether to report invalid palette index; added at libng-1.5.10.
/* Whether to report invalid palette index; added at libpng-1.5.10.
* It is possible for an indexed (color-type==3) PNG file to contain
* pixels with invalid (out-of-range) indexes if the PLTE chunk has
* fewer entries than the image's bit-depth would allow. We recover
+3 -3
View File
@@ -1,6 +1,6 @@
/* pngstruct.h - internal structures for libpng
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -106,7 +106,7 @@ typedef enum
* TODO: C23: convert these macros to C23 inlines (which are static).
*/
#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i)))
/* The flag coresponding to the given png_index enum value. This is defined
/* The flag corresponding to the given png_index enum value. This is defined
* for png_unknown as well (until it reaches the value 32) but this should
* not be relied on.
*/
@@ -115,7 +115,7 @@ typedef enum
(((png_ptr)->chunks & png_chunk_flag_from_index(i)) != 0)
/* The chunk has been recorded in png_struct */
#define png_file_add_chunk(pnt_ptr, i)\
#define png_file_add_chunk(png_ptr, i)\
((void)((png_ptr)->chunks |= png_chunk_flag_from_index(i)))
/* Record the chunk in the png_struct */
+36 -8
View File
@@ -1,6 +1,6 @@
/* pngtrans.c - transforms the data in a row (used by both readers and writers)
*
* Copyright (c) 2018-2024 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -84,9 +84,38 @@ png_set_shift(png_structrp png_ptr, png_const_color_8p true_bits)
{
png_debug(1, "in png_set_shift");
if (png_ptr == NULL)
if (png_ptr == NULL || true_bits == NULL)
return;
/* Check the shift values before passing them on to png_do_shift. */
{
png_byte bit_depth = png_ptr->bit_depth;
int invalid = 0;
if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0)
{
if (true_bits->red == 0 || true_bits->red > bit_depth ||
true_bits->green == 0 || true_bits->green > bit_depth ||
true_bits->blue == 0 || true_bits->blue > bit_depth)
invalid = 1;
}
else
{
if (true_bits->gray == 0 || true_bits->gray > bit_depth)
invalid = 1;
}
if ((png_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0 &&
(true_bits->alpha == 0 || true_bits->alpha > bit_depth))
invalid = 1;
if (invalid)
{
png_app_error(png_ptr, "png_set_shift: invalid shift values");
return;
}
}
png_ptr->transformations |= PNG_SHIFT;
png_ptr->shift = *true_bits;
}
@@ -457,10 +486,9 @@ png_do_packswap(png_row_infop row_info, png_bytep row)
if (row_info->bit_depth < 8)
{
png_const_bytep table;
png_bytep rp;
png_const_bytep end, table;
end = row + row_info->rowbytes;
png_bytep row_end = row + row_info->rowbytes;
if (row_info->bit_depth == 1)
table = onebppswaptable;
@@ -474,7 +502,7 @@ png_do_packswap(png_row_infop row_info, png_bytep row)
else
return;
for (rp = row; rp < end; rp++)
for (rp = row; rp < row_end; rp++)
*rp = table[*rp];
}
}
@@ -802,8 +830,8 @@ png_do_check_palette_indexes(png_structrp png_ptr, png_row_infop row_info)
defined(PNG_WRITE_USER_TRANSFORM_SUPPORTED)
#ifdef PNG_USER_TRANSFORM_PTR_SUPPORTED
void PNGAPI
png_set_user_transform_info(png_structrp png_ptr, png_voidp
user_transform_ptr, int user_transform_depth, int user_transform_channels)
png_set_user_transform_info(png_structrp png_ptr, png_voidp user_transform_ptr,
int user_transform_depth, int user_transform_channels)
{
png_debug(1, "in png_set_user_transform_info");
+41 -27
View File
@@ -1,6 +1,6 @@
/* pngwrite.c - general routines to write a PNG file
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -159,7 +159,7 @@ png_write_info_before_PLTE(png_structrp png_ptr, png_const_inforp info_ptr)
* them.
*
* PNG v3: Chunks mDCV and cLLI provide ancillary information for the
* interpretation of the colourspace chunkgs but do not require support for
* interpretation of the colourspace chunks but do not require support for
* those chunks so are outside the "COLORSPACE" check but before the write of
* the colourspace chunks themselves.
*/
@@ -542,7 +542,8 @@ png_convert_from_time_t(png_timep ptime, time_t ttime)
/* Initialize png_ptr structure, and allocate any memory needed */
PNG_FUNCTION(png_structp,PNGAPI
png_create_write_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
png_error_ptr error_fn, png_error_ptr warn_fn),PNG_ALLOCATED)
png_error_ptr error_fn, png_error_ptr warn_fn),
PNG_ALLOCATED)
{
#ifndef PNG_USER_MEM_SUPPORTED
png_structrp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
@@ -556,7 +557,8 @@ png_create_write_struct,(png_const_charp user_png_ver, png_voidp error_ptr,
PNG_FUNCTION(png_structp,PNGAPI
png_create_write_struct_2,(png_const_charp user_png_ver, png_voidp error_ptr,
png_error_ptr error_fn, png_error_ptr warn_fn, png_voidp mem_ptr,
png_malloc_ptr malloc_fn, png_free_ptr free_fn),PNG_ALLOCATED)
png_malloc_ptr malloc_fn, png_free_ptr free_fn),
PNG_ALLOCATED)
{
png_structrp png_ptr = png_create_png_struct(user_png_ver, error_ptr,
error_fn, warn_fn, mem_ptr, malloc_fn, free_fn);
@@ -1008,6 +1010,16 @@ png_write_destroy(png_structrp png_ptr)
png_ptr->chunk_list = NULL;
#endif
#if defined(PNG_tRNS_SUPPORTED)
/* Free the independent copy of trans_alpha owned by png_struct. */
png_free(png_ptr, png_ptr->trans_alpha);
png_ptr->trans_alpha = NULL;
#endif
/* Free the independent copy of the palette owned by png_struct. */
png_free(png_ptr, png_ptr->palette);
png_ptr->palette = NULL;
/* The error handling and memory handling information is left intact at this
* point: the jmp_buf may still have to be freed. See png_destroy_png_struct
* for how this happens.
@@ -1376,8 +1388,8 @@ png_set_write_status_fn(png_structrp png_ptr, png_write_status_ptr write_row_fn)
#ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED
void PNGAPI
png_set_write_user_transform_fn(png_structrp png_ptr, png_user_transform_ptr
write_user_transform_fn)
png_set_write_user_transform_fn(png_structrp png_ptr,
png_user_transform_ptr write_user_transform_fn)
{
png_debug(1, "in png_set_write_user_transform_fn");
@@ -1393,7 +1405,7 @@ png_set_write_user_transform_fn(png_structrp png_ptr, png_user_transform_ptr
#ifdef PNG_INFO_IMAGE_SUPPORTED
void PNGAPI
png_write_png(png_structrp png_ptr, png_inforp info_ptr,
int transforms, voidp params)
int transforms, png_voidp params)
{
png_debug(1, "in png_write_png");
@@ -1558,18 +1570,20 @@ png_image_write_init(png_imagep image)
/* Arguments to png_image_write_main: */
typedef struct
{
/* Arguments: */
png_imagep image;
/* Arguments */
png_imagep image;
png_const_voidp buffer;
png_int_32 row_stride;
png_int_32 row_stride;
png_const_voidp colormap;
int convert_to_8bit;
/* Local variables: */
int convert_to_8bit;
/* Instance variables */
png_const_voidp first_row;
ptrdiff_t row_bytes;
png_voidp local_row;
png_voidp local_row;
ptrdiff_t row_step;
/* Byte count for memory writing */
png_bytep memory;
png_bytep memory;
png_alloc_size_t memory_bytes; /* not used for STDIO */
png_alloc_size_t output_bytes; /* running total */
} png_image_write_control;
@@ -1676,7 +1690,7 @@ png_write_image_16bit(png_voidp argument)
}
png_write_row(png_ptr, png_voidcast(png_const_bytep, display->local_row));
input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
input_row += display->row_step / 2;
}
return 1;
@@ -1802,7 +1816,7 @@ png_write_image_8bit(png_voidp argument)
png_write_row(png_ptr, png_voidcast(png_const_bytep,
display->local_row));
input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
input_row += display->row_step / 2;
} /* while y */
}
@@ -1827,7 +1841,7 @@ png_write_image_8bit(png_voidp argument)
}
png_write_row(png_ptr, output_row);
input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
input_row += display->row_step / 2;
}
}
@@ -2016,7 +2030,7 @@ png_image_write_main(png_voidp argument)
display->row_stride = (png_int_32)/*SAFE*/png_row_stride;
if (display->row_stride < 0)
check = (png_uint_32)(-display->row_stride);
check = -(png_uint_32)display->row_stride;
else
check = (png_uint_32)display->row_stride;
@@ -2143,16 +2157,16 @@ png_image_write_main(png_voidp argument)
{
png_const_bytep row = png_voidcast(png_const_bytep, display->buffer);
ptrdiff_t row_bytes = display->row_stride;
ptrdiff_t row_step = display->row_stride;
if (linear != 0)
row_bytes *= (sizeof (png_uint_16));
row_step *= 2;
if (row_bytes < 0)
row += (image->height-1) * (-row_bytes);
if (row_step < 0)
row += (image->height-1) * (-row_step);
display->first_row = row;
display->row_bytes = row_bytes;
display->row_step = row_step;
}
/* Apply 'fast' options if the flag is set. */
@@ -2199,13 +2213,13 @@ png_image_write_main(png_voidp argument)
else
{
png_const_bytep row = png_voidcast(png_const_bytep, display->first_row);
ptrdiff_t row_bytes = display->row_bytes;
ptrdiff_t row_step = display->row_step;
png_uint_32 y = image->height;
for (; y > 0; --y)
{
png_write_row(png_ptr, row);
row += row_bytes;
row += row_step;
}
}
@@ -2215,7 +2229,7 @@ png_image_write_main(png_voidp argument)
static void (PNGCBAPI
image_memory_write)(png_structp png_ptr, png_bytep/*const*/ data, size_t size)
image_memory_write)(png_structp png_ptr, png_bytep data, size_t size)
{
png_image_write_control *display = png_voidcast(png_image_write_control*,
png_ptr->io_ptr/*backdoor: png_get_io_ptr(png_ptr)*/);
+6 -51
View File
@@ -1,6 +1,6 @@
/* pngwutil.c - utilities to write a PNG file
*
* Copyright (c) 2018-2025 Cosmin Truta
* Copyright (c) 2018-2026 Cosmin Truta
* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
* Copyright (c) 1996-1997 Andreas Dilger
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
@@ -485,10 +485,10 @@ png_free_buffer_list(png_structrp png_ptr, png_compression_bufferp *listp)
*/
typedef struct
{
png_const_bytep input; /* The uncompressed input data */
png_alloc_size_t input_len; /* Its length */
png_uint_32 output_len; /* Final compressed length */
png_byte output[1024]; /* First block of output */
png_const_bytep input; /* The uncompressed input data */
png_alloc_size_t input_len; /* Its length */
png_uint_32 output_len; /* Final compressed length */
png_byte output[1024]; /* First block of output */
} compression_state;
static void
@@ -898,7 +898,6 @@ png_write_PLTE(png_structrp png_ptr, png_const_colorp palette,
png_debug1(3, "num_palette = %d", png_ptr->num_palette);
png_write_chunk_header(png_ptr, png_PLTE, (png_uint_32)(num_pal * 3));
#ifdef PNG_POINTER_INDEXING_SUPPORTED
for (i = 0, pal_ptr = palette; i < num_pal; i++, pal_ptr++)
{
@@ -908,21 +907,6 @@ png_write_PLTE(png_structrp png_ptr, png_const_colorp palette,
png_write_chunk_data(png_ptr, buf, 3);
}
#else
/* This is a little slower but some buggy compilers need to do this
* instead
*/
pal_ptr=palette;
for (i = 0; i < num_pal; i++)
{
buf[0] = pal_ptr[i].red;
buf[1] = pal_ptr[i].green;
buf[2] = pal_ptr[i].blue;
png_write_chunk_data(png_ptr, buf, 3);
}
#endif
png_write_chunk_end(png_ptr);
png_ptr->mode |= PNG_HAVE_PLTE;
}
@@ -1201,9 +1185,6 @@ png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
size_t entry_size = (spalette->depth == 8 ? 6 : 10);
size_t palette_size = entry_size * (size_t)spalette->nentries;
png_sPLT_entryp ep;
#ifndef PNG_POINTER_INDEXING_SUPPORTED
int i;
#endif
png_debug(1, "in png_write_sPLT");
@@ -1221,7 +1202,6 @@ png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
png_write_chunk_data(png_ptr, &spalette->depth, 1);
/* Loop through each palette entry, writing appropriately */
#ifdef PNG_POINTER_INDEXING_SUPPORTED
for (ep = spalette->entries; ep<spalette->entries + spalette->nentries; ep++)
{
if (spalette->depth == 8)
@@ -1244,31 +1224,6 @@ png_write_sPLT(png_structrp png_ptr, png_const_sPLT_tp spalette)
png_write_chunk_data(png_ptr, entrybuf, entry_size);
}
#else
ep=spalette->entries;
for (i = 0; i>spalette->nentries; i++)
{
if (spalette->depth == 8)
{
entrybuf[0] = (png_byte)ep[i].red;
entrybuf[1] = (png_byte)ep[i].green;
entrybuf[2] = (png_byte)ep[i].blue;
entrybuf[3] = (png_byte)ep[i].alpha;
png_save_uint_16(entrybuf + 4, ep[i].frequency);
}
else
{
png_save_uint_16(entrybuf + 0, ep[i].red);
png_save_uint_16(entrybuf + 2, ep[i].green);
png_save_uint_16(entrybuf + 4, ep[i].blue);
png_save_uint_16(entrybuf + 6, ep[i].alpha);
png_save_uint_16(entrybuf + 8, ep[i].frequency);
}
png_write_chunk_data(png_ptr, entrybuf, entry_size);
}
#endif
png_write_chunk_end(png_ptr);
}
@@ -1738,7 +1693,7 @@ png_write_iTXt(png_structrp png_ptr, int compression, png_const_charp key,
}
new_key[++key_len] = PNG_COMPRESSION_TYPE_BASE;
++key_len; /* for the keywod separator */
++key_len; /* for the keyword separator */
/* We leave it to the application to meet PNG-1.0 requirements on the
* contents of the text. PNG-1.0 through PNG-1.2 discourage the use of
+5 -5
View File
@@ -41,7 +41,7 @@ png_read_filter_row_up_rvv(png_row_infop row_info, png_bytep row,
}
static inline void
png_read_filter_row_sub_rvv(size_t len, size_t bpp, unsigned char* row)
png_read_filter_row_sub_rvv(size_t len, size_t bpp, unsigned char *row)
{
png_bytep rp_end = row + len;
@@ -97,8 +97,8 @@ png_read_filter_row_sub4_rvv(png_row_infop row_info, png_bytep row,
}
static inline void
png_read_filter_row_avg_rvv(size_t len, size_t bpp, unsigned char* row,
const unsigned char* prev_row)
png_read_filter_row_avg_rvv(size_t len, size_t bpp, unsigned char *row,
const unsigned char *prev_row)
{
png_bytep rp_end = row + len;
@@ -178,8 +178,8 @@ png_read_filter_row_avg4_rvv(png_row_infop row_info, png_bytep row,
}
static inline void
png_read_filter_row_paeth_rvv(size_t len, size_t bpp, unsigned char* row,
const unsigned char* prev)
png_read_filter_row_paeth_rvv(size_t len, size_t bpp, unsigned char *row,
const unsigned char *prev)
{
png_bytep rp_end = row + len;