/*

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

/* pngerror.c - stub functions for i/o and memory allocation

 *

 * This file is available under and governed by the GNU General Public

 * License version 2 only, as published by the Free Software Foundation.

 * However, the following notice accompanied the original version of this

 * file and, per its terms, should not be removed:

 *

 * Copyright (c) 1998-2002,2004,2006-2017 Glenn Randers-Pehrson

 *

 * This code is released under the libpng license.

 * For conditions of distribution and use, see the disclaimer

 * and license in png.h

 *

 * This file provides a location for all error handling.  Users who

 * need special error handling are expected to write replacement functions

 * and use png_set_error_fn() to use those functions.  See the instructions

 * at each function.

 */

#include "pngpriv.h"

#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

static PNG_FUNCTION(void, png_default_error,PNGARG((png_const_structrp png_ptr,

    png_const_charp error_message)),PNG_NORETURN);

#ifdef PNG_WARNINGS_SUPPORTED

static void /* PRIVATE */

png_default_warning PNGARG((png_const_structrp png_ptr,

    png_const_charp warning_message));

#endif /* WARNINGS */

/* This function is called whenever there is a fatal error.  This function

 * should not be changed.  If there is a need to handle errors differently,

 * you should supply a replacement error function and use png_set_error_fn()

 * to replace the error function at run-time.

 */

#ifdef PNG_ERROR_TEXT_SUPPORTED

PNG_FUNCTION(void,PNGAPI

png_error,(png_const_structrp png_ptr, png_const_charp error_message),

    PNG_NORETURN)

{

#ifdef PNG_ERROR_NUMBERS_SUPPORTED

   char msg[16];

   if (png_ptr != NULL)

   {

      if ((png_ptr->flags &

         (PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT)) != 0)

      {

         if (*error_message == PNG_LITERAL_SHARP)

         {

            /* Strip "#nnnn " from beginning of error message. */

            int offset;

            for (offset = 1; offset<15; offset++)

               if (error_message[offset] == ' ')

                  break;

            if ((png_ptr->flags & PNG_FLAG_STRIP_ERROR_TEXT) != 0)

            {

               int i;

               for (i = 0; i < offset - 1; i++)

                  msg[i] = error_message[i + 1];

               msg[i - 1] = '\0';

               error_message = msg;

            }

            else

               error_message += offset;

         }

         else

         {

            if ((png_ptr->flags & PNG_FLAG_STRIP_ERROR_TEXT) != 0)

            {

               msg[0] = '0';

               msg[1] = '\0';

               error_message = msg;

            }

         }

      }

   }

#endif

   if (png_ptr != NULL && png_ptr->error_fn != NULL)

      (*(png_ptr->error_fn))(png_constcast(png_structrp,png_ptr),

          error_message);

   /* If the custom handler doesn't exist, or if it returns,

      use the default handler, which will not return. */

   png_default_error(png_ptr, error_message);

}

#else

PNG_FUNCTION(void,PNGAPI

png_err,(png_const_structrp png_ptr),PNG_NORETURN)

{

   /* Prior to 1.5.2 the error_fn received a NULL pointer, expressed

    * erroneously as '\0', instead of the empty string "".  This was

    * apparently an error, introduced in libpng-1.2.20, and png_default_error

    * will crash in this case.

    */

   if (png_ptr != NULL && png_ptr->error_fn != NULL)

      (*(png_ptr->error_fn))(png_constcast(png_structrp,png_ptr), "");

   /* If the custom handler doesn't exist, or if it returns,

      use the default handler, which will not return. */

   png_default_error(png_ptr, "");

}

#endif /* ERROR_TEXT */

/* Utility to safely appends strings to a buffer.  This never errors out so

 * error checking is not required in the caller.

 */

size_t

png_safecat(png_charp buffer, size_t bufsize, size_t pos,

    png_const_charp string)

{

   if (buffer != NULL && pos < bufsize)

   {

      if (string != NULL)

         while (*string != '\0' && pos < bufsize-1)

           buffer[pos++] = *string++;

      buffer[pos] = '\0';

   }

   return pos;

}

#if defined(PNG_WARNINGS_SUPPORTED) || defined(PNG_TIME_RFC1123_SUPPORTED)

/* Utility to dump an unsigned value into a buffer, given a start pointer and

 * and end pointer (which should point just *beyond* the end of the buffer!)

 * Returns the pointer to the start of the formatted string.

 */

png_charp

png_format_number(png_const_charp start, png_charp end, int format,

    png_alloc_size_t number)

{

   int count = 0;    /* number of digits output */

   int mincount = 1; /* minimum number required */

   int output = 0;   /* digit output (for the fixed point format) */

   *--end = '\0';

   /* This is written so that the loop always runs at least once, even with

    * number zero.

    */

   while (end > start && (number != 0 || count < mincount))

   {

      static const char digits[] = "0123456789ABCDEF";

      switch (format)

      {

         case PNG_NUMBER_FORMAT_fixed:

            /* Needs five digits (the fraction) */

            mincount = 5;

            if (output != 0 || number % 10 != 0)

            {

               *--end = digits[number % 10];

               output = 1;

            }

            number /= 10;

            break;

         case PNG_NUMBER_FORMAT_02u:

            /* Expects at least 2 digits. */

            mincount = 2;

            /* FALLTHROUGH */

         case PNG_NUMBER_FORMAT_u:

            *--end = digits[number % 10];

            number /= 10;

            break;

         case PNG_NUMBER_FORMAT_02x:

            /* This format expects at least two digits */

            mincount = 2;

            /* FALLTHROUGH */

         case PNG_NUMBER_FORMAT_x:

            *--end = digits[number & 0xf];

            number >>= 4;

            break;

         default: /* an error */

            number = 0;

            break;

      }

      /* Keep track of the number of digits added */

      ++count;

      /* Float a fixed number here: */

      if ((format == PNG_NUMBER_FORMAT_fixed) && (count == 5) && (end > start))

      {

         /* End of the fraction, but maybe nothing was output?  In that case

          * drop the decimal point.  If the number is a true zero handle that

          * here.

          */

         if (output != 0)

            *--end = '.';

         else if (number == 0) /* and !output */

            *--end = '0';

      }

   }

   return end;

}

#endif

#ifdef PNG_WARNINGS_SUPPORTED

/* This function is called whenever there is a non-fatal error.  This function

 * should not be changed.  If there is a need to handle warnings differently,

 * you should supply a replacement warning function and use

 * png_set_error_fn() to replace the warning function at run-time.

 */

void PNGAPI

png_warning(png_const_structrp png_ptr, png_const_charp warning_message)

{

   int offset = 0;

   if (png_ptr != NULL)

   {

#ifdef PNG_ERROR_NUMBERS_SUPPORTED

   if ((png_ptr->flags &

       (PNG_FLAG_STRIP_ERROR_NUMBERS|PNG_FLAG_STRIP_ERROR_TEXT)) != 0)

#endif

      {

         if (*warning_message == PNG_LITERAL_SHARP)

         {

            for (offset = 1; offset < 15; offset++)

               if (warning_message[offset] == ' ')

                  break;

         }

      }

   }

   if (png_ptr != NULL && png_ptr->warning_fn != NULL)

      (*(png_ptr->warning_fn))(png_constcast(png_structrp,png_ptr),

          warning_message + offset);

   else

      png_default_warning(png_ptr, warning_message + offset);

}

/* These functions support 'formatted' warning messages with up to

 * PNG_WARNING_PARAMETER_COUNT parameters.  In the format string the parameter

 * is introduced by @<number>, where 'number' starts at 1.  This follows the

 * standard established by X/Open for internationalizable error messages.

 */

void

png_warning_parameter(png_warning_parameters p, int number,

    png_const_charp string)

{

   if (number > 0 && number <= PNG_WARNING_PARAMETER_COUNT)

      (void)png_safecat(p[number-1], (sizeof p[number-1]), 0, string);

}

void

png_warning_parameter_unsigned(png_warning_parameters p, int number, int format,

    png_alloc_size_t value)

{

   char buffer[PNG_NUMBER_BUFFER_SIZE];

   png_warning_parameter(p, number, PNG_FORMAT_NUMBER(buffer, format, value));

}

void

png_warning_parameter_signed(png_warning_parameters p, int number, int format,

    png_int_32 value)

{

   png_alloc_size_t u;

   png_charp str;

   char buffer[PNG_NUMBER_BUFFER_SIZE];

   /* Avoid overflow by doing the negate in a png_alloc_size_t: */

   u = (png_alloc_size_t)value;

   if (value < 0)

      u = ~u + 1;

   str = PNG_FORMAT_NUMBER(buffer, format, u);

   if (value < 0 && str > buffer)

      *--str = '-';

   png_warning_parameter(p, number, str);

}

void

png_formatted_warning(png_const_structrp png_ptr, png_warning_parameters p,

    png_const_charp message)

{

   /* The internal buffer is just 192 bytes - enough for all our messages,

    * overflow doesn't happen because this code checks!  If someone figures

    * out how to send us a message longer than 192 bytes, all that will

    * happen is that the message will be truncated appropriately.

    */

   size_t i = 0; /* Index in the msg[] buffer: */

   char msg[192];

   /* Each iteration through the following loop writes at most one character

    * to msg[i++] then returns here to validate that there is still space for

    * the trailing '\0'.  It may (in the case of a parameter) read more than

    * one character from message[]; it must check for '\0' and continue to the

    * test if it finds the end of string.

    */

   while (i<(sizeof msg)-1 && *message != '\0')

   {

      /* '@' at end of string is now just printed (previously it was skipped);

       * it is an error in the calling code to terminate the string with @.

       */

      if (p != NULL && *message == '@' && message[1] != '\0')

      {

         int parameter_char = *++message; /* Consume the '@' */

         static const char valid_parameters[] = "123456789";

         int parameter = 0;

         /* Search for the parameter digit, the index in the string is the

          * parameter to use.

          */

         while (valid_parameters[parameter] != parameter_char &&

            valid_parameters[parameter] != '\0')

            ++parameter;

         /* If the parameter digit is out of range it will just get printed. */

         if (parameter < PNG_WARNING_PARAMETER_COUNT)

         {

            /* Append this parameter */

            png_const_charp parm = p[parameter];

            png_const_charp pend = p[parameter] + (sizeof p[parameter]);

            /* No need to copy the trailing '\0' here, but there is no guarantee

             * that parm[] has been initialized, so there is no guarantee of a

             * trailing '\0':

             */

            while (i<(sizeof msg)-1 && *parm != '\0' && parm < pend)

               msg[i++] = *parm++;

            /* Consume the parameter digit too: */

            ++message;

            continue;

         }

         /* else not a parameter and there is a character after the @ sign; just

          * copy that.  This is known not to be '\0' because of the test above.

          */

      }

      /* At this point *message can't be '\0', even in the bad parameter case

       * above where there is a lone '@' at the end of the message string.

       */

      msg[i++] = *message++;

   }

   /* i is always less than (sizeof msg), so: */

   msg[i] = '\0';

   /* And this is the formatted message. It may be larger than

    * PNG_MAX_ERROR_TEXT, but that is only used for 'chunk' errors and these

    * are not (currently) formatted.

    */

   png_warning(png_ptr, msg);

}

#endif /* WARNINGS */

#ifdef PNG_BENIGN_ERRORS_SUPPORTED

void PNGAPI

png_benign_error(png_const_structrp png_ptr, png_const_charp error_message)

{

   if ((png_ptr->flags & PNG_FLAG_BENIGN_ERRORS_WARN) != 0)

   {

#     ifdef PNG_READ_SUPPORTED

         if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&

            png_ptr->chunk_name != 0)

            png_chunk_warning(png_ptr, error_message);

         else

#     endif

      png_warning(png_ptr, error_message);

   }

   else

   {

#     ifdef PNG_READ_SUPPORTED

         if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0 &&

            png_ptr->chunk_name != 0)

            png_chunk_error(png_ptr, error_message);

         else

#     endif

      png_error(png_ptr, error_message);

   }

#  ifndef PNG_ERROR_TEXT_SUPPORTED

      PNG_UNUSED(error_message)

#  endif

}

void /* PRIVATE */

png_app_warning(png_const_structrp png_ptr, png_const_charp error_message)

{

   if ((png_ptr->flags & PNG_FLAG_APP_WARNINGS_WARN) != 0)

      png_warning(png_ptr, error_message);

   else

      png_error(png_ptr, error_message);

#  ifndef PNG_ERROR_TEXT_SUPPORTED

      PNG_UNUSED(error_message)

#  endif

}

void /* PRIVATE */

png_app_error(png_const_structrp png_ptr, png_const_charp error_message)

{

   if ((png_ptr->flags & PNG_FLAG_APP_ERRORS_WARN) != 0)

      png_warning(png_ptr, error_message);

   else

      png_error(png_ptr, error_message);

#  ifndef PNG_ERROR_TEXT_SUPPORTED

      PNG_UNUSED(error_message)

#  endif

}

#endif /* BENIGN_ERRORS */

#define PNG_MAX_ERROR_TEXT 196 /* Currently limited by profile_error in png.c */

#if defined(PNG_WARNINGS_SUPPORTED) || \

   (defined(PNG_READ_SUPPORTED) && defined(PNG_ERROR_TEXT_SUPPORTED))

/* These utilities are used internally to build an error message that relates

 * to the current chunk.  The chunk name comes from png_ptr->chunk_name,

 * which is used to prefix the message.  The message is limited in length

 * to 63 bytes. The name characters are output as hex digits wrapped in []

 * if the character is invalid.

 */

#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97))

   '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',

   'A', 'B', 'C', 'D', 'E', 'F'

};

static void /* PRIVATE */

png_format_buffer(png_const_structrp png_ptr, png_charp buffer, png_const_charp

    error_message)

{

   png_uint_32 chunk_name = png_ptr->chunk_name;

   int iout = 0, ishift = 24;

   while (ishift >= 0)

   {

      int c = (int)(chunk_name >> ishift) & 0xff;

      ishift -= 8;

      if (isnonalpha(c) != 0)

      {

         buffer[iout++] = PNG_LITERAL_LEFT_SQUARE_BRACKET;

         buffer[iout++] = png_digit[(c & 0xf0) >> 4];

         buffer[iout++] = png_digit[c & 0x0f];

         buffer[iout++] = PNG_LITERAL_RIGHT_SQUARE_BRACKET;

      }

      else

      {

         buffer[iout++] = (char)c;

      }

   }

   if (error_message == NULL)

      buffer[iout] = '\0';

   else

   {

      int iin = 0;