/*

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

/* png.c - location for general purpose libpng functions

 *

 * This file is available under and governed by the GNU General Public

 * License version 2 only, as published by the Free Software Foundation.

 * However, the following notice accompanied the original version of this

 * file and, per its terms, should not be removed:

 *

 * Copyright (c) 2018-2019 Cosmin Truta

 * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson

 * Copyright (c) 1996-1997 Andreas Dilger

 * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.

 *

 * This code is released under the libpng license.

 * For conditions of distribution and use, see the disclaimer

 * and license in png.h

 */

#include "pngpriv.h"

/* Generate a compiler error if there is an old png.h in the search path. */

typedef png_libpng_version_1_6_37 Your_png_h_is_not_version_1_6_37;

#ifdef __GNUC__

/* The version tests may need to be added to, but the problem warning has

 * consistently been fixed in GCC versions which obtain wide-spread release.

 * The problem is that many versions of GCC rearrange comparison expressions in

 * the optimizer in such a way that the results of the comparison will change

 * if signed integer overflow occurs.  Such comparisons are not permitted in

 * ANSI C90, however GCC isn't clever enough to work out that that do not occur

 * below in png_ascii_from_fp and png_muldiv, so it produces a warning with

 * -Wextra.  Unfortunately this is highly dependent on the optimizer and the

 * machine architecture so the warning comes and goes unpredictably and is

 * impossible to "fix", even were that a good idea.

 */

#if __GNUC__ == 7 && __GNUC_MINOR__ == 1

#define GCC_STRICT_OVERFLOW 1

#endif /* GNU 7.1.x */

#endif /* GNU */

#ifndef GCC_STRICT_OVERFLOW

#define GCC_STRICT_OVERFLOW 0

#endif

/* Tells libpng that we have already handled the first "num_bytes" bytes

 * of the PNG file signature.  If the PNG data is embedded into another

 * stream we can set num_bytes = 8 so that libpng will not attempt to read

 * or write any of the magic bytes before it starts on the IHDR.

 */

#ifdef PNG_READ_SUPPORTED

void PNGAPI

png_set_sig_bytes(png_structrp png_ptr, int num_bytes)

{

   unsigned int nb = (unsigned int)num_bytes;

   png_debug(1, "in png_set_sig_bytes");

   if (png_ptr == NULL)

      return;

   if (num_bytes < 0)

      nb = 0;

   if (nb > 8)

      png_error(png_ptr, "Too many bytes for PNG signature");

   png_ptr->sig_bytes = (png_byte)nb;

}

/* Checks whether the supplied bytes match the PNG signature.  We allow

 * checking less than the full 8-byte signature so that those apps that

 * already read the first few bytes of a file to determine the file type

 * can simply check the remaining bytes for extra assurance.  Returns

 * an integer less than, equal to, or greater than zero if sig is found,

 * respectively, to be less than, to match, or be greater than the correct

 * PNG signature (this is the same behavior as strcmp, memcmp, etc).

 */

int PNGAPI

png_sig_cmp(png_const_bytep sig, size_t start, size_t num_to_check)

{

   png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};

   if (num_to_check > 8)

      num_to_check = 8;

   else if (num_to_check < 1)

      return (-1);

   if (start > 7)

      return (-1);

   if (start + num_to_check > 8)

      num_to_check = 8 - start;

   return ((int)(memcmp(&sig[start], &png_signature[start], num_to_check)));

}

#endif /* READ */

#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)

/* Function to allocate memory for zlib */

PNG_FUNCTION(voidpf /* PRIVATE */,

png_zalloc,(voidpf png_ptr, uInt items, uInt size),PNG_ALLOCATED)

{

   png_alloc_size_t num_bytes = size;

   if (png_ptr == NULL)

      return NULL;

   if (items >= (~(png_alloc_size_t)0)/size)

   {

      png_warning (png_voidcast(png_structrp, png_ptr),

          "Potential overflow in png_zalloc()");

      return NULL;

   }

   num_bytes *= items;

   return png_malloc_warn(png_voidcast(png_structrp, png_ptr), num_bytes);

}

/* Function to free memory for zlib */

void /* PRIVATE */

png_zfree(voidpf png_ptr, voidpf ptr)

{

   png_free(png_voidcast(png_const_structrp,png_ptr), ptr);

}

/* Reset the CRC variable to 32 bits of 1's.  Care must be taken

 * in case CRC is > 32 bits to leave the top bits 0.

 */

void /* PRIVATE */

png_reset_crc(png_structrp png_ptr)

{

   /* The cast is safe because the crc is a 32-bit value. */

   png_ptr->crc = (png_uint_32)crc32(0, Z_NULL, 0);

}

/* Calculate the CRC over a section of data.  We can only pass as

 * much data to this routine as the largest single buffer size.  We

 * also check that this data will actually be used before going to the

 * trouble of calculating it.

 */

void /* PRIVATE */

png_calculate_crc(png_structrp png_ptr, png_const_bytep ptr, size_t length)

{

   int need_crc = 1;

   if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0)

   {

      if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==

          (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))

         need_crc = 0;

   }

   else /* critical */

   {

      if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0)

         need_crc = 0;

   }

   /* 'uLong' is defined in zlib.h as unsigned long; this means that on some

    * systems it is a 64-bit value.  crc32, however, returns 32 bits so the

    * following cast is safe.  'uInt' may be no more than 16 bits, so it is

    * necessary to perform a loop here.

    */

   if (need_crc != 0 && length > 0)

   {

      uLong crc = png_ptr->crc; /* Should never issue a warning */

      do

      {

         uInt safe_length = (uInt)length;

#ifndef __COVERITY__

         if (safe_length == 0)

            safe_length = (uInt)-1; /* evil, but safe */

#endif

         crc = crc32(crc, ptr, safe_length);

         /* The following should never issue compiler warnings; if they do the

          * target system has characteristics that will probably violate other

          * assumptions within the libpng code.

          */

         ptr += safe_length;

         length -= safe_length;

      }

      while (length > 0);

      /* And the following is always safe because the crc is only 32 bits. */

      png_ptr->crc = (png_uint_32)crc;

   }

}

/* Check a user supplied version number, called from both read and write

 * functions that create a png_struct.

 */

int

png_user_version_check(png_structrp png_ptr, png_const_charp user_png_ver)

{

   /* Libpng versions 1.0.0 and later are binary compatible if the version

    * string matches through the second '.'; we must recompile any

    * applications that use any older library version.

    */

   if (user_png_ver != NULL)

   {

      int i = -1;

      int found_dots = 0;

      do

      {

         i++;

         if (user_png_ver[i] != PNG_LIBPNG_VER_STRING[i])

            png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;

         if (user_png_ver[i] == '.')

            found_dots++;

      } while (found_dots < 2 && user_png_ver[i] != 0 &&

            PNG_LIBPNG_VER_STRING[i] != 0);

   }

   else

      png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH;

   if ((png_ptr->flags & PNG_FLAG_LIBRARY_MISMATCH) != 0)

   {

#ifdef PNG_WARNINGS_SUPPORTED

      size_t pos = 0;

      char m[128];

      pos = png_safecat(m, (sizeof m), pos,

          "Application built with libpng-");

      pos = png_safecat(m, (sizeof m), pos, user_png_ver);

      pos = png_safecat(m, (sizeof m), pos, " but running with ");

      pos = png_safecat(m, (sizeof m), pos, PNG_LIBPNG_VER_STRING);

      PNG_UNUSED(pos)

      png_warning(png_ptr, m);

#endif

#ifdef PNG_ERROR_NUMBERS_SUPPORTED

      png_ptr->flags = 0;

#endif

      return 0;

   }

   /* Success return. */

   return 1;

}

/* Generic function to create a png_struct for either read or write - this

 * contains the common initialization.

 */

PNG_FUNCTION(png_structp /* PRIVATE */,

png_create_png_struct,(png_const_charp user_png_ver, png_voidp error_ptr,

    png_error_ptr error_fn, png_error_ptr warn_fn, png_voidp mem_ptr,

    png_malloc_ptr malloc_fn, png_free_ptr free_fn),PNG_ALLOCATED)

{

   png_struct create_struct;

#  ifdef PNG_SETJMP_SUPPORTED

      jmp_buf create_jmp_buf;

#  endif

   /* This temporary stack-allocated structure is used to provide a place to

    * build enough context to allow the user provided memory allocator (if any)

    * to be called.

    */

   memset(&create_struct, 0, (sizeof create_struct));

   /* Added at libpng-1.2.6 */

#  ifdef PNG_USER_LIMITS_SUPPORTED

      create_struct.user_width_max = PNG_USER_WIDTH_MAX;

      create_struct.user_height_max = PNG_USER_HEIGHT_MAX;

#     ifdef PNG_USER_CHUNK_CACHE_MAX

      /* Added at libpng-1.2.43 and 1.4.0 */

      create_struct.user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX;

#     endif

#     ifdef PNG_USER_CHUNK_MALLOC_MAX

      /* Added at libpng-1.2.43 and 1.4.1, required only for read but exists

       * in png_struct regardless.

       */

      create_struct.user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX;

#     endif

#  endif

   /* The following two API calls simply set fields in png_struct, so it is safe

    * to do them now even though error handling is not yet set up.

    */

#  ifdef PNG_USER_MEM_SUPPORTED

      png_set_mem_fn(&create_struct, mem_ptr, malloc_fn, free_fn);

#  else

      PNG_UNUSED(mem_ptr)

      PNG_UNUSED(malloc_fn)

      PNG_UNUSED(free_fn)

#  endif

   /* (*error_fn) can return control to the caller after the error_ptr is set,

    * this will result in a memory leak unless the error_fn does something

    * extremely sophisticated.  The design lacks merit but is implicit in the

    * API.

    */

   png_set_error_fn(&create_struct, error_ptr, error_fn, warn_fn);

#  ifdef PNG_SETJMP_SUPPORTED

      if (!setjmp(create_jmp_buf))

#  endif

      {

#  ifdef PNG_SETJMP_SUPPORTED

         /* Temporarily fake out the longjmp information until we have

          * successfully completed this function.  This only works if we have

          * setjmp() support compiled in, but it is safe - this stuff should

          * never happen.

          */

         create_struct.jmp_buf_ptr = &create_jmp_buf;

         create_struct.jmp_buf_size = 0; /*stack allocation*/

         create_struct.longjmp_fn = longjmp;

#  endif

         /* Call the general version checker (shared with read and write code):

          */

         if (png_user_version_check(&create_struct, user_png_ver) != 0)

         {

            png_structrp png_ptr = png_voidcast(png_structrp,

                png_malloc_warn(&create_struct, (sizeof *png_ptr)));

            if (png_ptr != NULL)

            {

               /* png_ptr->zstream holds a back-pointer to the png_struct, so

                * this can only be done now:

                */

               create_struct.zstream.zalloc = png_zalloc;

               create_struct.zstream.zfree = png_zfree;

               create_struct.zstream.opaque = png_ptr;

#              ifdef PNG_SETJMP_SUPPORTED

               /* Eliminate the local error handling: */

               create_struct.jmp_buf_ptr = NULL;

               create_struct.jmp_buf_size = 0;

               create_struct.longjmp_fn = 0;

#              endif

               *png_ptr = create_struct;

               /* This is the successful return point */

               return png_ptr;

            }

         }

      }

   /* A longjmp because of a bug in the application storage allocator or a

    * simple failure to allocate the png_struct.

    */

   return NULL;

}

/* Allocate the memory for an info_struct for the application. */

PNG_FUNCTION(png_infop,PNGAPI

png_create_info_struct,(png_const_structrp png_ptr),PNG_ALLOCATED)

{

   png_inforp info_ptr;

   png_debug(1, "in png_create_info_struct");

   if (png_ptr == NULL)

      return NULL;

   /* Use the internal API that does not (or at least should not) error out, so

    * that this call always returns ok.  The application typically sets up the

    * error handling *after* creating the info_struct because this is the way it

    * has always been done in 'example.c'.

    */

   info_ptr = png_voidcast(png_inforp, png_malloc_base(png_ptr,

       (sizeof *info_ptr)));

   if (info_ptr != NULL)

      memset(info_ptr, 0, (sizeof *info_ptr));

   return info_ptr;

}

/* This function frees the memory associated with a single info struct.

 * Normally, one would use either png_destroy_read_struct() or

 * png_destroy_write_struct() to free an info struct, but this may be

 * useful for some applications.  From libpng 1.6.0 this function is also used

 * internally to implement the png_info release part of the 'struct' destroy

 * APIs.  This ensures that all possible approaches free the same data (all of

 * it).

 */

void PNGAPI

png_destroy_info_struct(png_const_structrp png_ptr, png_infopp info_ptr_ptr)

{

   png_inforp info_ptr = NULL;

   png_debug(1, "in png_destroy_info_struct");

   if (png_ptr == NULL)

      return;

   if (info_ptr_ptr != NULL)

      info_ptr = *info_ptr_ptr;

   if (info_ptr != NULL)

   {

      /* Do this first in case of an error below; if the app implements its own

       * memory management this can lead to png_free calling png_error, which

       * will abort this routine and return control to the app error handler.

       * An infinite loop may result if it then tries to free the same info

       * ptr.

       */

      *info_ptr_ptr = NULL;

      png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);

      memset(info_ptr, 0, (sizeof *info_ptr));

      png_free(png_ptr, info_ptr);

   }

}

/* Initialize the info structure.  This is now an internal function (0.89)

 * and applications using it are urged to use png_create_info_struct()

 * instead.  Use deprecated in 1.6.0, internal use removed (used internally it

 * is just a memset).

 *

 * NOTE: it is almost inconceivable that this API is used because it bypasses

 * the user-memory mechanism and the user error handling/warning mechanisms in

 * those cases where it does anything other than a memset.

 */

PNG_FUNCTION(void,PNGAPI

png_info_init_3,(png_infopp ptr_ptr, size_t png_info_struct_size),

    PNG_DEPRECATED)

{

   png_inforp info_ptr = *ptr_ptr;

   png_debug(1, "in png_info_init_3");

   if (info_ptr == NULL)

      return;

   if ((sizeof (png_info)) > png_info_struct_size)

   {

      *ptr_ptr = NULL;

      /* The following line is why this API should not be used: */

      free(info_ptr);

      info_ptr = png_voidcast(png_inforp, png_malloc_base(NULL,

          (sizeof *info_ptr)));

      if (info_ptr == NULL)

         return;

      *ptr_ptr = info_ptr;

   }

   /* Set everything to 0 */

   memset(info_ptr, 0, (sizeof *info_ptr));

}

/* The following API is not called internally */

void PNGAPI

png_data_freer(png_const_structrp png_ptr, png_inforp info_ptr,

    int freer, png_uint_32 mask)

{

   png_debug(1, "in png_data_freer");

   if (png_ptr == NULL || info_ptr == NULL)

      return;

   if (freer == PNG_DESTROY_WILL_FREE_DATA)

      info_ptr->free_me |= mask;

   else if (freer == PNG_USER_WILL_FREE_DATA)

      info_ptr->free_me &= ~mask;