1 /*

     2  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     3  *

     4  * This code is free software; you can redistribute it and/or modify it

     5  * under the terms of the GNU General Public License version 2 only, as

     6  * published by the Free Software Foundation.  Oracle designates this

     7  * particular file as subject to the "Classpath" exception as provided

     8  * by Oracle in the LICENSE file that accompanied this code.

     9  *

    10  * This code is distributed in the hope that it will be useful, but WITHOUT

    11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    13  * version 2 for more details (a copy is included in the LICENSE file that

    14  * accompanied this code).

    15  *

    16  * You should have received a copy of the GNU General Public License version

    17  * 2 along with this work; if not, write to the Free Software Foundation,

    18  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    19  *

    20  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    21  * or visit www.oracle.com if you need additional information or have any

    22  * questions.

    23  */

    24 

    25 /* pngtest.c - a simple test program to test libpng

    26  *

    27  * This file is available under and governed by the GNU General Public

    28  * License version 2 only, as published by the Free Software Foundation.

    29  * However, the following notice accompanied the original version of this

    30  * file and, per its terms, should not be removed:

    31  *

    32  * Last changed in libpng 1.5.25 [December 3, 2015]

    33  * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson

    34  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)

    35  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)

    36  *

    37  * This code is released under the libpng license.

    38  * For conditions of distribution and use, see the disclaimer

    39  * and license in png.h

    40  *

    41  * This program reads in a PNG image, writes it out again, and then

    42  * compares the two files.  If the files are identical, this shows that

    43  * the basic chunk handling, filtering, and (de)compression code is working

    44  * properly.  It does not currently test all of the transforms, although

    45  * it probably should.

    46  *

    47  * The program will report "FAIL" in certain legitimate cases:

    48  * 1) when the compression level or filter selection method is changed.

    49  * 2) when the maximum IDAT size (PNG_ZBUF_SIZE in pngconf.h) is not 8192.

    50  * 3) unknown unsafe-to-copy ancillary chunks or unknown critical chunks

    51  *    exist in the input file.

    52  * 4) others not listed here...

    53  * In these cases, it is best to check with another tool such as "pngcheck"

    54  * to see what the differences between the two files are.

    55  *

    56  * If a filename is given on the command-line, then this file is used

    57  * for the input, rather than the default "pngtest.png".  This allows

    58  * testing a wide variety of files easily.  You can also test a number

    59  * of files at once by typing "pngtest -m file1.png file2.png ..."

    60  */

    61 

    62 #define _POSIX_SOURCE 1

    63 

    64 #include <stdio.h>

    65 #include <stdlib.h>

    66 #include <string.h>

    67 

    68 /* Defined so I can write to a file on gui/windowing platforms */

    69 /*  #define STDERR stderr  */

    70 #define STDERR stdout   /* For DOS */

    71 

    72 #include "png.h"

    73 

    74 /* 1.6.1 added support for the configure test harness, which uses 77 to indicate

    75  * a skipped test, in earlier versions we need to succeed on a skipped test, so:

    76  */

    77 #if PNG_LIBPNG_VER >= 10601 && defined(HAVE_CONFIG_H)

    78 #  define SKIP 77

    79 #else

    80 #  define SKIP 0

    81 #endif

    82 

    83 /* Known chunks that exist in pngtest.png must be supported or pngtest will fail

    84  * simply as a result of re-ordering them.  This may be fixed in 1.7

    85  *

    86  * pngtest allocates a single row buffer for each row and overwrites it,

    87  * therefore if the write side doesn't support the writing of interlaced images

    88  * nothing can be done for an interlaced image (and the code below will fail

    89  * horribly trying to write extra data after writing garbage).

    90  */

    91 #if defined PNG_READ_SUPPORTED && /* else nothing can be done */\

    92    defined PNG_READ_bKGD_SUPPORTED &&\

    93    defined PNG_READ_cHRM_SUPPORTED &&\

    94    defined PNG_READ_gAMA_SUPPORTED &&\

    95    defined PNG_READ_oFFs_SUPPORTED &&\

    96    defined PNG_READ_pCAL_SUPPORTED &&\

    97    defined PNG_READ_pHYs_SUPPORTED &&\

    98    defined PNG_READ_sBIT_SUPPORTED &&\

    99    defined PNG_READ_sCAL_SUPPORTED &&\

   100    defined PNG_READ_sRGB_SUPPORTED &&\

   101    defined PNG_READ_sPLT_SUPPORTED &&\

   102    defined PNG_READ_tEXt_SUPPORTED &&\

   103    defined PNG_READ_tIME_SUPPORTED &&\

   104    defined PNG_READ_zTXt_SUPPORTED &&\

   105    (defined PNG_WRITE_INTERLACING_SUPPORTED || PNG_LIBPNG_VER >= 10700)

   106 

   107 #ifdef PNG_ZLIB_HEADER

   108 #  include PNG_ZLIB_HEADER /* defined by pnglibconf.h from 1.7 */

   109 #else

   110 #  include "zlib.h"

   111 #endif

   112 

   113 /* Copied from pngpriv.h but only used in error messages below. */

   114 #ifndef PNG_ZBUF_SIZE

   115 #  define PNG_ZBUF_SIZE 8192

   116 #endif

   117 #define FCLOSE(file) fclose(file)

   118 

   119 #ifndef PNG_STDIO_SUPPORTED

   120 typedef FILE                * png_FILE_p;

   121 #endif

   122 

   123 /* Makes pngtest verbose so we can find problems. */

   124 #ifndef PNG_DEBUG

   125 #  define PNG_DEBUG 0

   126 #endif

   127 

   128 #if PNG_DEBUG > 1

   129 #  define pngtest_debug(m)        ((void)fprintf(stderr, m "\n"))

   130 #  define pngtest_debug1(m,p1)    ((void)fprintf(stderr, m "\n", p1))

   131 #  define pngtest_debug2(m,p1,p2) ((void)fprintf(stderr, m "\n", p1, p2))

   132 #else

   133 #  define pngtest_debug(m)        ((void)0)

   134 #  define pngtest_debug1(m,p1)    ((void)0)

   135 #  define pngtest_debug2(m,p1,p2) ((void)0)

   136 #endif

   137 

   138 #if !PNG_DEBUG

   139 #  define SINGLE_ROWBUF_ALLOC  /* Makes buffer overruns easier to nail */

   140 #endif

   141 

   142 #ifndef PNG_UNUSED

   143 #  define PNG_UNUSED(param) (void)param;

   144 #endif

   145 

   146 /* Turn on CPU timing

   147 #define PNGTEST_TIMING

   148 */

   149 

   150 #ifndef PNG_FLOATING_POINT_SUPPORTED

   151 #undef PNGTEST_TIMING

   152 #endif

   153 

   154 #ifdef PNGTEST_TIMING

   155 static float t_start, t_stop, t_decode, t_encode, t_misc;

   156 #include <time.h>

   157 #endif

   158 

   159 #ifdef PNG_TIME_RFC1123_SUPPORTED

   160 #define PNG_tIME_STRING_LENGTH 29

   161 static int tIME_chunk_present = 0;

   162 static char tIME_string[PNG_tIME_STRING_LENGTH] = "tIME chunk is not present";

   163 

   164 #if PNG_LIBPNG_VER < 10619

   165 #define png_convert_to_rfc1123_buffer(ts, t) tIME_to_str(read_ptr, ts, t)

   166 

   167 static int

   168 tIME_to_str(png_structp png_ptr, png_charp ts, png_const_timep t)

   169 {

   170     png_const_charp str = png_convert_to_rfc1123(png_ptr, t);

   171 

   172     if (str == NULL)

   173         return 0;

   174 

   175     strcpy(ts, str);

   176     return 1;

   177 }

   178 #endif /* older libpng */

   179 #endif

   180 

   181 static int verbose = 0;

   182 static int strict = 0;

   183 static int relaxed = 0;

   184 static int unsupported_chunks = 0; /* chunk unsupported by libpng in input */

   185 static int error_count = 0; /* count calls to png_error */

   186 static int warning_count = 0; /* count calls to png_warning */

   187 

   188 /* Define png_jmpbuf() in case we are using a pre-1.0.6 version of libpng */

   189 #ifndef png_jmpbuf

   190 #  define png_jmpbuf(png_ptr) png_ptr->jmpbuf

   191 #endif

   192 

   193 /* Defines for unknown chunk handling if required. */

   194 #ifndef PNG_HANDLE_CHUNK_ALWAYS

   195 #  define PNG_HANDLE_CHUNK_ALWAYS       3

   196 #endif

   197 #ifndef PNG_HANDLE_CHUNK_IF_SAFE

   198 #  define PNG_HANDLE_CHUNK_IF_SAFE      2

   199 #endif

   200 

   201 /* Utility to save typing/errors, the argument must be a name */

   202 #define MEMZERO(var) ((void)memset(&var, 0, sizeof var))

   203 

   204 /* Example of using row callbacks to make a simple progress meter */

   205 static int status_pass = 1;

   206 static int status_dots_requested = 0;

   207 static int status_dots = 1;

   208 

   209 static void PNGCBAPI

   210 read_row_callback(png_structp png_ptr, png_uint_32 row_number, int pass)

   211 {

   212    if (png_ptr == NULL || row_number > PNG_UINT_31_MAX)

   213       return;

   214 

   215    if (status_pass != pass)

   216    {

   217       fprintf(stdout, "\n Pass %d: ", pass);

   218       status_pass = pass;

   219       status_dots = 31;

   220    }

   221 

   222    status_dots--;

   223 

   224    if (status_dots == 0)

   225    {

   226       fprintf(stdout, "\n         ");

   227       status_dots=30;

   228    }

   229 

   230    fprintf(stdout, "r");

   231 }

   232 

   233 #ifdef PNG_WRITE_SUPPORTED

   234 static void PNGCBAPI

   235 write_row_callback(png_structp png_ptr, png_uint_32 row_number, int pass)

   236 {

   237    if (png_ptr == NULL || row_number > PNG_UINT_31_MAX || pass > 7)

   238       return;

   239 

   240    fprintf(stdout, "w");

   241 }

   242 #endif

   243 

   244 

   245 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED

   246 /* Example of using a user transform callback (doesn't do anything at present).

   247  */

   248 static void PNGCBAPI

   249 read_user_callback(png_structp png_ptr, png_row_infop row_info, png_bytep data)

   250 {

   251    PNG_UNUSED(png_ptr)

   252    PNG_UNUSED(row_info)

   253    PNG_UNUSED(data)

   254 }

   255 #endif

   256 

   257 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED

   258 /* Example of using user transform callback (we don't transform anything,

   259  * but merely count the zero samples)

   260  */

   261 

   262 static png_uint_32 zero_samples;

   263 

   264 static void PNGCBAPI

   265 count_zero_samples(png_structp png_ptr, png_row_infop row_info, png_bytep data)

   266 {

   267    png_bytep dp = data;

   268    if (png_ptr == NULL)

   269       return;

   270 

   271    /* Contents of row_info:

   272     *  png_uint_32 width      width of row

   273     *  png_uint_32 rowbytes   number of bytes in row

   274     *  png_byte color_type    color type of pixels

   275     *  png_byte bit_depth     bit depth of samples

   276     *  png_byte channels      number of channels (1-4)

   277     *  png_byte pixel_depth   bits per pixel (depth*channels)

   278     */

   279 

   280     /* Counts the number of zero samples (or zero pixels if color_type is 3 */

   281 

   282     if (row_info->color_type == 0 || row_info->color_type == 3)

   283     {

   284        int pos = 0;

   285        png_uint_32 n, nstop;

   286 

   287        for (n = 0, nstop=row_info->width; n<nstop; n++)

   288        {

   289           if (row_info->bit_depth == 1)

   290           {

   291              if (((*dp << pos++ ) & 0x80) == 0)

   292                 zero_samples++;

   293 

   294              if (pos == 8)

   295              {

   296                 pos = 0;

   297                 dp++;

   298              }

   299           }

   300 

   301           if (row_info->bit_depth == 2)

   302           {

   303              if (((*dp << (pos+=2)) & 0xc0) == 0)

   304                 zero_samples++;

   305 

   306              if (pos == 8)

   307              {

   308                 pos = 0;

   309                 dp++;

   310              }

   311           }

   312 

   313           if (row_info->bit_depth == 4)

   314           {

   315              if (((*dp << (pos+=4)) & 0xf0) == 0)

   316                 zero_samples++;

   317 

   318              if (pos == 8)

   319              {

   320                 pos = 0;

   321                 dp++;

   322              }

   323           }

   324 

   325           if (row_info->bit_depth == 8)

   326              if (*dp++ == 0)

   327                 zero_samples++;

   328 

   329           if (row_info->bit_depth == 16)

   330           {

   331              if ((*dp | *(dp+1)) == 0)

   332                 zero_samples++;

   333              dp+=2;

   334           }

   335        }

   336     }

   337     else /* Other color types */

   338     {

   339        png_uint_32 n, nstop;

   340        int channel;

   341        int color_channels = row_info->channels;

   342        if (row_info->color_type > 3)

   343           color_channels--;

   344 

   345        for (n = 0, nstop=row_info->width; n<nstop; n++)

   346        {

   347           for (channel = 0; channel < color_channels; channel++)

   348           {

   349              if (row_info->bit_depth == 8)

   350                 if (*dp++ == 0)

   351                    zero_samples++;

   352 

   353              if (row_info->bit_depth == 16)

   354              {

   355                 if ((*dp | *(dp+1)) == 0)

   356                    zero_samples++;

   357 

   358                 dp+=2;

   359              }

   360           }

   361           if (row_info->color_type > 3)

   362           {

   363              dp++;

   364              if (row_info->bit_depth == 16)

   365                 dp++;

   366           }

   367        }

   368     }

   369 }

   370 #endif /* WRITE_USER_TRANSFORM */

   371 

   372 #ifndef PNG_STDIO_SUPPORTED

   373 /* START of code to validate stdio-free compilation */

   374 /* These copies of the default read/write functions come from pngrio.c and

   375  * pngwio.c.  They allow "don't include stdio" testing of the library.

   376  * This is the function that does the actual reading of data.  If you are

   377  * not reading from a standard C stream, you should create a replacement

   378  * read_data function and use it at run time with png_set_read_fn(), rather

   379  * than changing the library.

   380  */

   381 

   382 #ifdef PNG_IO_STATE_SUPPORTED

   383 void

   384 pngtest_check_io_state(png_structp png_ptr, png_size_t data_length,

   385    png_uint_32 io_op);

   386 void

   387 pngtest_check_io_state(png_structp png_ptr, png_size_t data_length,

   388    png_uint_32 io_op)

   389 {

   390    png_uint_32 io_state = png_get_io_state(png_ptr);

   391    int err = 0;

   392 

   393    /* Check if the current operation (reading / writing) is as expected. */

   394    if ((io_state & PNG_IO_MASK_OP) != io_op)

   395       png_error(png_ptr, "Incorrect operation in I/O state");

   396 

   397    /* Check if the buffer size specific to the current location

   398     * (file signature / header / data / crc) is as expected.

   399     */

   400    switch (io_state & PNG_IO_MASK_LOC)

   401    {

   402    case PNG_IO_SIGNATURE:

   403       if (data_length > 8)

   404          err = 1;

   405       break;

   406    case PNG_IO_CHUNK_HDR:

   407       if (data_length != 8)

   408          err = 1;

   409       break;

   410    case PNG_IO_CHUNK_DATA:

   411       break;  /* no restrictions here */

   412    case PNG_IO_CHUNK_CRC:

   413       if (data_length != 4)

   414          err = 1;

   415       break;

   416    default:

   417       err = 1;  /* uninitialized */

   418    }

   419    if (err != 0)

   420       png_error(png_ptr, "Bad I/O state or buffer size");

   421 }

   422 #endif

   423 

   424 static void PNGCBAPI

   425 pngtest_read_data(png_structp png_ptr, png_bytep data, png_size_t length)

   426 {

   427    png_size_t check = 0;

   428    png_voidp io_ptr;

   429 

   430    /* fread() returns 0 on error, so it is OK to store this in a png_size_t

   431     * instead of an int, which is what fread() actually returns.

   432     */

   433    io_ptr = png_get_io_ptr(png_ptr);

   434    if (io_ptr != NULL)

   435    {

   436       check = fread(data, 1, length, (png_FILE_p)io_ptr);

   437    }

   438 

   439    if (check != length)

   440    {

   441       png_error(png_ptr, "Read Error");

   442    }

   443 

   444 #ifdef PNG_IO_STATE_SUPPORTED

   445    pngtest_check_io_state(png_ptr, length, PNG_IO_READING);

   446 #endif

   447 }

   448 

   449 #ifdef PNG_WRITE_FLUSH_SUPPORTED

   450 static void PNGCBAPI

   451 pngtest_flush(png_structp png_ptr)

   452 {

   453    /* Do nothing; fflush() is said to be just a waste of energy. */

   454    PNG_UNUSED(png_ptr)   /* Stifle compiler warning */

   455 }

   456 #endif

   457 

   458 /* This is the function that does the actual writing of data.  If you are

   459  * not writing to a standard C stream, you should create a replacement

   460  * write_data function and use it at run time with png_set_write_fn(), rather

   461  * than changing the library.

   462  */

   463 static void PNGCBAPI

   464 pngtest_write_data(png_structp png_ptr, png_bytep data, png_size_t length)

   465 {

   466    png_size_t check;

   467 

   468    check = fwrite(data, 1, length, (png_FILE_p)png_get_io_ptr(png_ptr));

   469 

   470    if (check != length)

   471    {

   472       png_error(png_ptr, "Write Error");

   473    }

   474 

   475 #ifdef PNG_IO_STATE_SUPPORTED

   476    pngtest_check_io_state(png_ptr, length, PNG_IO_WRITING);

   477 #endif

   478 }

   479 #endif /* !STDIO */

   480 

   481 /* This function is called when there is a warning, but the library thinks

   482  * it can continue anyway.  Replacement functions don't have to do anything

   483  * here if you don't want to.  In the default configuration, png_ptr is

   484  * not used, but it is passed in case it may be useful.

   485  */

   486 typedef struct

   487 {

   488    PNG_CONST char *file_name;

   489 }  pngtest_error_parameters;

   490 

   491 static void PNGCBAPI

   492 pngtest_warning(png_structp png_ptr, png_const_charp message)

   493 {

   494    PNG_CONST char *name = "UNKNOWN (ERROR!)";

   495    pngtest_error_parameters *test =

   496       (pngtest_error_parameters*)png_get_error_ptr(png_ptr);

   497 

   498    ++warning_count;

   499 

   500    if (test != NULL && test->file_name != NULL)

   501       name = test->file_name;

   502 

   503    fprintf(STDERR, "%s: libpng warning: %s\n", name, message);

   504 }

   505 

   506 /* This is the default error handling function.  Note that replacements for

   507  * this function MUST NOT RETURN, or the program will likely crash.  This

   508  * function is used by default, or if the program supplies NULL for the

   509  * error function pointer in png_set_error_fn().

   510  */

   511 static void PNGCBAPI

   512 pngtest_error(png_structp png_ptr, png_const_charp message)

   513 {

   514    ++error_count;

   515 

   516    pngtest_warning(png_ptr, message);

   517    /* We can return because png_error calls the default handler, which is

   518     * actually OK in this case.

   519     */

   520 }

   521 

   522 /* END of code to validate stdio-free compilation */

   523 

   524 /* START of code to validate memory allocation and deallocation */

   525 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG

   526 

   527 /* Allocate memory.  For reasonable files, size should never exceed

   528  * 64K.  However, zlib may allocate more than 64K if you don't tell

   529  * it not to.  See zconf.h and png.h for more information.  zlib does

   530  * need to allocate exactly 64K, so whatever you call here must

   531  * have the ability to do that.

   532  *

   533  * This piece of code can be compiled to validate max 64K allocations

   534  * by setting MAXSEG_64K in zlib zconf.h *or* PNG_MAX_MALLOC_64K.

   535  */

   536 typedef struct memory_information

   537 {

   538    png_alloc_size_t          size;

   539    png_voidp                 pointer;

   540    struct memory_information *next;

   541 } memory_information;

   542 typedef memory_information *memory_infop;

   543 

   544 static memory_infop pinformation = NULL;

   545 static int current_allocation = 0;

   546 static int maximum_allocation = 0;

   547 static int total_allocation = 0;

   548 static int num_allocations = 0;

   549 

   550 png_voidp PNGCBAPI png_debug_malloc PNGARG((png_structp png_ptr,

   551     png_alloc_size_t size));

   552 void PNGCBAPI png_debug_free PNGARG((png_structp png_ptr, png_voidp ptr));

   553 

   554 png_voidp

   555 PNGCBAPI png_debug_malloc(png_structp png_ptr, png_alloc_size_t size)

   556 {

   557 

   558    /* png_malloc has already tested for NULL; png_create_struct calls

   559     * png_debug_malloc directly, with png_ptr == NULL which is OK

   560     */

   561 

   562    if (size == 0)

   563       return (NULL);

   564 

   565    /* This calls the library allocator twice, once to get the requested

   566       buffer and once to get a new free list entry. */

   567    {

   568       /* Disable malloc_fn and free_fn */

   569       memory_infop pinfo;

   570       png_set_mem_fn(png_ptr, NULL, NULL, NULL);

   571       pinfo = (memory_infop)png_malloc(png_ptr,

   572          (sizeof *pinfo));

   573       pinfo->size = size;

   574       current_allocation += size;

   575       total_allocation += size;

   576       num_allocations ++;

   577 

   578       if (current_allocation > maximum_allocation)

   579          maximum_allocation = current_allocation;

   580 

   581       pinfo->pointer = png_malloc(png_ptr, size);

   582       /* Restore malloc_fn and free_fn */

   583 

   584       png_set_mem_fn(png_ptr,

   585           NULL, png_debug_malloc, png_debug_free);

   586 

   587       if (size != 0 && pinfo->pointer == NULL)

   588       {

   589          current_allocation -= size;

   590          total_allocation -= size;

   591          png_error(png_ptr,

   592            "out of memory in pngtest->png_debug_malloc");

   593       }

   594 

   595       pinfo->next = pinformation;

   596       pinformation = pinfo;

   597       /* Make sure the caller isn't assuming zeroed memory. */

   598       memset(pinfo->pointer, 0xdd, pinfo->size);

   599 

   600       if (verbose != 0)

   601          printf("png_malloc %lu bytes at %p\n", (unsigned long)size,

   602             pinfo->pointer);

   603 

   604       return (png_voidp)(pinfo->pointer);

   605    }

   606 }

   607 

   608 /* Free a pointer.  It is removed from the list at the same time. */

   609 void PNGCBAPI

   610 png_debug_free(png_structp png_ptr, png_voidp ptr)

   611 {

   612    if (png_ptr == NULL)

   613       fprintf(STDERR, "NULL pointer to png_debug_free.\n");

   614 

   615    if (ptr == 0)

   616    {

   617 #if 0 /* This happens all the time. */

   618       fprintf(STDERR, "WARNING: freeing NULL pointer\n");

   619 #endif

   620       return;

   621    }

   622 

   623    /* Unlink the element from the list. */

   624    if (pinformation != NULL)

   625    {

   626       memory_infop *ppinfo = &pinformation;

   627 

   628       for (;;)

   629       {

   630          memory_infop pinfo = *ppinfo;

   631 

   632          if (pinfo->pointer == ptr)

   633          {

   634             *ppinfo = pinfo->next;

   635             current_allocation -= pinfo->size;

   636             if (current_allocation < 0)

   637                fprintf(STDERR, "Duplicate free of memory\n");

   638             /* We must free the list element too, but first kill

   639                the memory that is to be freed. */

   640             memset(ptr, 0x55, pinfo->size);

   641             free(pinfo);

   642             pinfo = NULL;

   643             break;

   644          }

   645 

   646          if (pinfo->next == NULL)

   647          {

   648             fprintf(STDERR, "Pointer %p not found\n", ptr);

   649             break;

   650          }

   651 

   652          ppinfo = &pinfo->next;

   653       }

   654    }

   655 

   656    /* Finally free the data. */

   657    if (verbose != 0)

   658       printf("Freeing %p\n", ptr);

   659 

   660    if (ptr != NULL)

   661       free(ptr);

   662    ptr = NULL;

   663 }

   664 #endif /* USER_MEM && DEBUG */

   665 /* END of code to test memory allocation/deallocation */

   666 

   667 

   668 #ifdef PNG_READ_USER_CHUNKS_SUPPORTED

   669 /* Demonstration of user chunk support of the sTER and vpAg chunks */

   670 

   671 /* (sTER is a public chunk not yet known by libpng.  vpAg is a private

   672 chunk used in ImageMagick to store "virtual page" size).  */

   673 

   674 static struct user_chunk_data

   675 {

   676    png_const_infop info_ptr;

   677    png_uint_32     vpAg_width, vpAg_height;

   678    png_byte        vpAg_units;

   679    png_byte        sTER_mode;

   680    int             location[2];

   681 }

   682 user_chunk_data;

   683 

   684 /* Used for location and order; zero means nothing. */

   685 #define have_sTER   0x01

   686 #define have_vpAg   0x02

   687 #define before_PLTE 0x10

   688 #define before_IDAT 0x20

   689 #define after_IDAT  0x40

   690 

   691 static void

   692 init_callback_info(png_const_infop info_ptr)

   693 {

   694    MEMZERO(user_chunk_data);

   695    user_chunk_data.info_ptr = info_ptr;

   696 }

   697 

   698 static int

   699 set_location(png_structp png_ptr, struct user_chunk_data *data, int what)

   700 {

   701    int location;

   702 

   703    if ((data->location[0] & what) != 0 || (data->location[1] & what) != 0)

   704       return 0; /* already have one of these */

   705 

   706    /* Find where we are (the code below zeroes info_ptr to indicate that the

   707     * chunks before the first IDAT have been read.)

   708     */

   709    if (data->info_ptr == NULL) /* after IDAT */

   710       location = what | after_IDAT;

   711 

   712    else if (png_get_valid(png_ptr, data->info_ptr, PNG_INFO_PLTE) != 0)

   713       location = what | before_IDAT;

   714 

   715    else

   716       location = what | before_PLTE;

   717 

   718    if (data->location[0] == 0)

   719       data->location[0] = location;

   720 

   721    else

   722       data->location[1] = location;

   723 

   724    return 1; /* handled */

   725 }

   726 

   727 static int PNGCBAPI

   728 read_user_chunk_callback(png_struct *png_ptr, png_unknown_chunkp chunk)

   729 {

   730    struct user_chunk_data *my_user_chunk_data =

   731       (struct user_chunk_data*)png_get_user_chunk_ptr(png_ptr);

   732 

   733    if (my_user_chunk_data == NULL)

   734       png_error(png_ptr, "lost user chunk pointer");

   735 

   736    /* Return one of the following:

   737     *    return (-n);  chunk had an error

   738     *    return (0);  did not recognize

   739     *    return (n);  success

   740     *

   741     * The unknown chunk structure contains the chunk data:

   742     * png_byte name[5];

   743     * png_byte *data;

   744     * png_size_t size;

   745     *

   746     * Note that libpng has already taken care of the CRC handling.

   747     */

   748 

   749    if (chunk->name[0] == 115 && chunk->name[1] ==  84 &&     /* s  T */

   750        chunk->name[2] ==  69 && chunk->name[3] ==  82)       /* E  R */

   751       {

   752          /* Found sTER chunk */

   753          if (chunk->size != 1)

   754             return (-1); /* Error return */

   755 

   756          if (chunk->data[0] != 0 && chunk->data[0] != 1)

   757             return (-1);  /* Invalid mode */

   758 

   759          if (set_location(png_ptr, my_user_chunk_data, have_sTER) != 0)

   760          {

   761             my_user_chunk_data->sTER_mode=chunk->data[0];

   762             return (1);

   763          }

   764 

   765          else

   766             return (0); /* duplicate sTER - give it to libpng */

   767       }

   768 

   769    if (chunk->name[0] != 118 || chunk->name[1] != 112 ||    /* v  p */

   770        chunk->name[2] !=  65 || chunk->name[3] != 103)      /* A  g */

   771       return (0); /* Did not recognize */

   772 

   773    /* Found ImageMagick vpAg chunk */

   774 

   775    if (chunk->size != 9)

   776       return (-1); /* Error return */

   777 

   778    if (set_location(png_ptr, my_user_chunk_data, have_vpAg) == 0)

   779       return (0);  /* duplicate vpAg */

   780 

   781    my_user_chunk_data->vpAg_width = png_get_uint_31(png_ptr, chunk->data);

   782    my_user_chunk_data->vpAg_height = png_get_uint_31(png_ptr, chunk->data + 4);

   783    my_user_chunk_data->vpAg_units = chunk->data[8];

   784 

   785    return (1);

   786 }

   787 

   788 #ifdef PNG_WRITE_SUPPORTED

   789 static void

   790 write_sTER_chunk(png_structp write_ptr)

   791 {

   792    png_byte sTER[5] = {115,  84,  69,  82, '\0'};

   793 

   794    if (verbose != 0)

   795       fprintf(STDERR, "\n stereo mode = %d\n", user_chunk_data.sTER_mode);

   796 

   797    png_write_chunk(write_ptr, sTER, &user_chunk_data.sTER_mode, 1);

   798 }

   799 

   800 static void

   801 write_vpAg_chunk(png_structp write_ptr)

   802 {

   803    png_byte vpAg[5] = {118, 112,  65, 103, '\0'};

   804 

   805    png_byte vpag_chunk_data[9];

   806 

   807    if (verbose != 0)

   808       fprintf(STDERR, " vpAg = %lu x %lu, units = %d\n",

   809         (unsigned long)user_chunk_data.vpAg_width,

   810         (unsigned long)user_chunk_data.vpAg_height,

   811         user_chunk_data.vpAg_units);

   812 

   813    png_save_uint_32(vpag_chunk_data, user_chunk_data.vpAg_width);

   814    png_save_uint_32(vpag_chunk_data + 4, user_chunk_data.vpAg_height);

   815    vpag_chunk_data[8] = user_chunk_data.vpAg_units;

   816    png_write_chunk(write_ptr, vpAg, vpag_chunk_data, 9);

   817 }

   818 

   819 static void

   820 write_chunks(png_structp write_ptr, int location)

   821 {

   822    int i;

   823 

   824    /* Notice that this preserves the original chunk order, however chunks

   825     * intercepted by the callback will be written *after* chunks passed to

   826     * libpng.  This will actually reverse a pair of sTER chunks or a pair of

   827     * vpAg chunks, resulting in an error later.  This is not worth worrying

   828     * about - the chunks should not be duplicated!

   829     */

   830    for (i=0; i<2; ++i)

   831    {

   832       if (user_chunk_data.location[i] == (location | have_sTER))

   833          write_sTER_chunk(write_ptr);

   834 

   835       else if (user_chunk_data.location[i] == (location | have_vpAg))

   836          write_vpAg_chunk(write_ptr);

   837    }

   838 }

   839 #endif /* WRITE */

   840 #else /* !READ_USER_CHUNKS */

   841 #  define write_chunks(pp,loc) ((void)0)

   842 #endif

   843 /* END of code to demonstrate user chunk support */

   844 

   845 /* START of code to check that libpng has the required text support; this only

   846  * checks for the write support because if read support is missing the chunk

   847  * will simply not be reported back to pngtest.

   848  */

   849 #ifdef PNG_TEXT_SUPPORTED

   850 static void

   851 pngtest_check_text_support(png_structp png_ptr, png_textp text_ptr,

   852    int num_text)

   853 {

   854    while (num_text > 0)

   855    {

   856       switch (text_ptr[--num_text].compression)

   857       {

   858          case PNG_TEXT_COMPRESSION_NONE:

   859             break;

   860 

   861          case PNG_TEXT_COMPRESSION_zTXt:

   862 #           ifndef PNG_WRITE_zTXt_SUPPORTED

   863                ++unsupported_chunks;

   864                /* In libpng 1.7 this now does an app-error, so stop it: */

   865                text_ptr[num_text].compression = PNG_TEXT_COMPRESSION_NONE;

   866 #           endif

   867             break;

   868 

   869          case PNG_ITXT_COMPRESSION_NONE:

   870          case PNG_ITXT_COMPRESSION_zTXt:

   871 #           ifndef PNG_WRITE_iTXt_SUPPORTED

   872                ++unsupported_chunks;

   873                text_ptr[num_text].compression = PNG_TEXT_COMPRESSION_NONE;

   874 #           endif

   875             break;

   876 

   877          default:

   878             /* This is an error */

   879             png_error(png_ptr, "invalid text chunk compression field");

   880             break;

   881       }

   882    }

   883 }

   884 #endif

   885 /* END of code to check that libpng has the required text support */

   886 

   887 /* Test one file */

   888 static int

   889 test_one_file(PNG_CONST char *inname, PNG_CONST char *outname)

   890 {

   891    static png_FILE_p fpin;

   892    static png_FILE_p fpout;  /* "static" prevents setjmp corruption */

   893    pngtest_error_parameters error_parameters;

   894    png_structp read_ptr;

   895    png_infop read_info_ptr, end_info_ptr;

   896 #ifdef PNG_WRITE_SUPPORTED

   897    png_structp write_ptr;

   898    png_infop write_info_ptr;

   899    png_infop write_end_info_ptr;

   900 #ifdef PNG_WRITE_FILTER_SUPPORTED

   901    int interlace_preserved = 1;

   902 #endif /* WRITE_FILTER */

   903 #else /* !WRITE */

   904    png_structp write_ptr = NULL;

   905    png_infop write_info_ptr = NULL;

   906    png_infop write_end_info_ptr = NULL;

   907 #endif /* !WRITE */

   908    png_bytep row_buf;

   909    png_uint_32 y;

   910    png_uint_32 width, height;

   911    volatile int num_passes;

   912    int pass;

   913    int bit_depth, color_type;

   914 

   915    row_buf = NULL;

   916    error_parameters.file_name = inname;

   917 

   918    if ((fpin = fopen(inname, "rb")) == NULL)

   919    {

   920       fprintf(STDERR, "Could not find input file %s\n", inname);

   921       return (1);

   922    }

   923 

   924    if ((fpout = fopen(outname, "wb")) == NULL)

   925    {

   926       fprintf(STDERR, "Could not open output file %s\n", outname);

   927       FCLOSE(fpin);

   928       return (1);

   929    }

   930 

   931    pngtest_debug("Allocating read and write structures");

   932 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG

   933    read_ptr =

   934       png_create_read_struct_2(PNG_LIBPNG_VER_STRING, NULL,

   935       NULL, NULL, NULL, png_debug_malloc, png_debug_free);

   936 #else

   937    read_ptr =

   938       png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);

   939 #endif

   940    png_set_error_fn(read_ptr, &error_parameters, pngtest_error,

   941       pngtest_warning);

   942 

   943 #ifdef PNG_WRITE_SUPPORTED

   944 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG

   945    write_ptr =

   946       png_create_write_struct_2(PNG_LIBPNG_VER_STRING, NULL,

   947       NULL, NULL, NULL, png_debug_malloc, png_debug_free);

   948 #else

   949    write_ptr =

   950       png_create_write_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);

   951 #endif

   952    png_set_error_fn(write_ptr, &error_parameters, pngtest_error,

   953       pngtest_warning);

   954 #endif

   955    pngtest_debug("Allocating read_info, write_info and end_info structures");

   956    read_info_ptr = png_create_info_struct(read_ptr);

   957    end_info_ptr = png_create_info_struct(read_ptr);

   958 #ifdef PNG_WRITE_SUPPORTED

   959    write_info_ptr = png_create_info_struct(write_ptr);

   960    write_end_info_ptr = png_create_info_struct(write_ptr);

   961 #endif

   962 

   963 #ifdef PNG_READ_USER_CHUNKS_SUPPORTED

   964    init_callback_info(read_info_ptr);

   965    png_set_read_user_chunk_fn(read_ptr, &user_chunk_data,

   966      read_user_chunk_callback);

   967 #endif

   968 

   969 #ifdef PNG_SETJMP_SUPPORTED

   970    pngtest_debug("Setting jmpbuf for read struct");

   971    if (setjmp(png_jmpbuf(read_ptr)))

   972    {

   973       fprintf(STDERR, "%s -> %s: libpng read error\n", inname, outname);

   974       png_free(read_ptr, row_buf);

   975       row_buf = NULL;

   976       png_destroy_read_struct(&read_ptr, &read_info_ptr, &end_info_ptr);

   977 #ifdef PNG_WRITE_SUPPORTED

   978       png_destroy_info_struct(write_ptr, &write_end_info_ptr);

   979       png_destroy_write_struct(&write_ptr, &write_info_ptr);

   980 #endif

   981       FCLOSE(fpin);

   982       FCLOSE(fpout);

   983       return (1);

   984    }

   985 

   986 #ifdef PNG_WRITE_SUPPORTED

   987    pngtest_debug("Setting jmpbuf for write struct");

   988 

   989    if (setjmp(png_jmpbuf(write_ptr)))

   990    {

   991       fprintf(STDERR, "%s -> %s: libpng write error\n", inname, outname);

   992       png_destroy_read_struct(&read_ptr, &read_info_ptr, &end_info_ptr);

   993       png_destroy_info_struct(write_ptr, &write_end_info_ptr);

   994 #ifdef PNG_WRITE_SUPPORTED

   995       png_destroy_write_struct(&write_ptr, &write_info_ptr);

   996 #endif

   997       FCLOSE(fpin);

   998       FCLOSE(fpout);

   999       return (1);

  1000    }

  1001 #endif

  1002 #endif

  1003 

  1004    if (strict != 0)

  1005    {

  1006       /* Treat png_benign_error() as errors on read */

  1007       png_set_benign_errors(read_ptr, 0);

  1008 

  1009 #ifdef PNG_WRITE_SUPPORTED

  1010       /* Treat them as errors on write */

  1011       png_set_benign_errors(write_ptr, 0);

  1012 #endif

  1013 

  1014       /* if strict is not set, then app warnings and errors are treated as

  1015        * warnings in release builds, but not in unstable builds; this can be

  1016        * changed with '--relaxed'.

  1017        */

  1018    }

  1019 

  1020    else if (relaxed != 0)

  1021    {

  1022       /* Allow application (pngtest) errors and warnings to pass */

  1023       png_set_benign_errors(read_ptr, 1);

  1024 

  1025 #ifdef PNG_WRITE_SUPPORTED

  1026       png_set_benign_errors(write_ptr, 1);

  1027 #endif

  1028    }

  1029 

  1030    pngtest_debug("Initializing input and output streams");

  1031 #ifdef PNG_STDIO_SUPPORTED

  1032    png_init_io(read_ptr, fpin);

  1033 #  ifdef PNG_WRITE_SUPPORTED

  1034    png_init_io(write_ptr, fpout);

  1035 #  endif

  1036 #else

  1037    png_set_read_fn(read_ptr, (png_voidp)fpin, pngtest_read_data);

  1038 #  ifdef PNG_WRITE_SUPPORTED

  1039    png_set_write_fn(write_ptr, (png_voidp)fpout,  pngtest_write_data,

  1040 #    ifdef PNG_WRITE_FLUSH_SUPPORTED

  1041       pngtest_flush);

  1042 #    else

  1043       NULL);

  1044 #    endif

  1045 #  endif

  1046 #endif

  1047 

  1048    if (status_dots_requested == 1)

  1049    {

  1050 #ifdef PNG_WRITE_SUPPORTED

  1051       png_set_write_status_fn(write_ptr, write_row_callback);

  1052 #endif

  1053       png_set_read_status_fn(read_ptr, read_row_callback);

  1054    }

  1055 

  1056    else

  1057    {

  1058 #ifdef PNG_WRITE_SUPPORTED

  1059       png_set_write_status_fn(write_ptr, NULL);

  1060 #endif

  1061       png_set_read_status_fn(read_ptr, NULL);

  1062    }

  1063 

  1064 #ifdef PNG_READ_USER_TRANSFORM_SUPPORTED

  1065    png_set_read_user_transform_fn(read_ptr, read_user_callback);

  1066 #endif

  1067 #ifdef PNG_WRITE_USER_TRANSFORM_SUPPORTED

  1068    zero_samples = 0;

  1069    png_set_write_user_transform_fn(write_ptr, count_zero_samples);

  1070 #endif

  1071 

  1072 #ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED

  1073    /* Preserve all the unknown chunks, if possible.  If this is disabled then,

  1074     * even if the png_{get,set}_unknown_chunks stuff is enabled, we can't use

  1075     * libpng to *save* the unknown chunks on read (because we can't switch the

  1076     * save option on!)

  1077     *

  1078     * Notice that if SET_UNKNOWN_CHUNKS is *not* supported read will discard all

  1079     * unknown chunks and write will write them all.

  1080     */

  1081 #ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED

  1082    png_set_keep_unknown_chunks(read_ptr, PNG_HANDLE_CHUNK_ALWAYS,

  1083       NULL, 0);

  1084 #endif

  1085 #ifdef PNG_WRITE_UNKNOWN_CHUNKS_SUPPORTED

  1086    png_set_keep_unknown_chunks(write_ptr, PNG_HANDLE_CHUNK_ALWAYS,

  1087       NULL, 0);

  1088 #endif

  1089 #endif

  1090 

  1091    pngtest_debug("Reading info struct");

  1092    png_read_info(read_ptr, read_info_ptr);

  1093 

  1094 #ifdef PNG_READ_USER_CHUNKS_SUPPORTED

  1095    /* This is a bit of a hack; there is no obvious way in the callback function

  1096     * to determine that the chunks before the first IDAT have been read, so

  1097     * remove the info_ptr (which is only used to determine position relative to

  1098     * PLTE) here to indicate that we are after the IDAT.

  1099     */

  1100    user_chunk_data.info_ptr = NULL;

  1101 #endif

  1102 

  1103    pngtest_debug("Transferring info struct");

  1104    {

  1105       int interlace_type, compression_type, filter_type;

  1106 

  1107       if (png_get_IHDR(read_ptr, read_info_ptr, &width, &height, &bit_depth,

  1108           &color_type, &interlace_type, &compression_type, &filter_type) != 0)

  1109       {

  1110          png_set_IHDR(write_ptr, write_info_ptr, width, height, bit_depth,

  1111             color_type, interlace_type, compression_type, filter_type);

  1112          /* num_passes may not be available below if interlace support is not

  1113           * provided by libpng for both read and write.

  1114           */

  1115          switch (interlace_type)

  1116          {

  1117             case PNG_INTERLACE_NONE:

  1118                num_passes = 1;

  1119                break;

  1120 

  1121             case PNG_INTERLACE_ADAM7:

  1122                num_passes = 7;

  1123                break;

  1124 

  1125             default:

  1126                png_error(read_ptr, "invalid interlace type");

  1127                /*NOT REACHED*/

  1128          }

  1129       }

  1130 

  1131       else

  1132          png_error(read_ptr, "png_get_IHDR failed");

  1133    }

  1134 #ifdef PNG_FIXED_POINT_SUPPORTED