diff -ru4NwbB libpng-1.2.33/png.c libpng-1.2.34beta01/png.c --- libpng-1.2.33/png.c 2008-10-31 08:42:01.879516574 -0500 +++ libpng-1.2.34beta01/png.c 2008-11-27 06:44:07.378099953 -0600 @@ -795,5 +795,117 @@ PNG_ABORT(); /* We haven't got access to png_ptr, so no png_error() */ return ((png_size_t)size); } #endif /* PNG_SIZE_T */ + +/* Added at libpng version 1.2.34 and 1.4.0 (moved from pngset.c) */ +#if defined(PNG_cHRM_SUPPORTED) +#if !defined(PNG_NO_CHECK_cHRM) +/* + Multiply two 32-bit numbers, V1 and V2, using 32-bit + arithmetic, to produce a 64 bit result in the HI/LO words. + + A B + x C D + ------ + AD || BD +AC || CB || 0 + + where A and B are the high and low 16-bit words of V1, + C and D are the 16-bit words of V2, AD is the product of + A and D, and X || Y is (X << 16) + Y. +*/ + +void png_64bit_product (long v1, long v2, unsigned long *hi_product, + unsigned long *lo_product) +{ + int a, b, c, d; + long lo, hi, x, y; + + a = (v1 >> 16) & 0xffff; + b = v1 & 0xffff; + c = (v2 >> 16) & 0xffff; + d = v2 & 0xffff; + + lo = b * d; /* BD */ + x = a * d + c * b; /* AD + CB */ + y = ((lo >> 16) & 0xffff) + x; + + lo = (lo & 0xffff) | ((y & 0xffff) << 16); + hi = (y >> 16) & 0xffff; + + hi += a * c; /* AC */ + + *hi_product = (unsigned long)hi; + *lo_product = (unsigned long)lo; +} +int /* private */ +png_check_cHRM_fixed(png_structp png_ptr, + png_fixed_point white_x, png_fixed_point white_y, png_fixed_point red_x, + png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y, + png_fixed_point blue_x, png_fixed_point blue_y) +{ + int ret = 1; + unsigned long xy_hi,xy_lo,yx_hi,yx_lo; + + png_debug(1, "in function png_check_cHRM_fixed"); + if (png_ptr == NULL) + return 0; + + if (white_x < 0 || white_y <= 0 || + red_x < 0 || red_y < 0 || + green_x < 0 || green_y < 0 || + blue_x < 0 || blue_y < 0) + { + png_warning(png_ptr, + "Ignoring attempt to set negative chromaticity value"); + ret = 0; + } + if (white_x > (png_fixed_point) PNG_UINT_31_MAX || + white_y > (png_fixed_point) PNG_UINT_31_MAX || + red_x > (png_fixed_point) PNG_UINT_31_MAX || + red_y > (png_fixed_point) PNG_UINT_31_MAX || + green_x > (png_fixed_point) PNG_UINT_31_MAX || + green_y > (png_fixed_point) PNG_UINT_31_MAX || + blue_x > (png_fixed_point) PNG_UINT_31_MAX || + blue_y > (png_fixed_point) PNG_UINT_31_MAX ) + { + png_warning(png_ptr, + "Ignoring attempt to set chromaticity value exceeding 21474.83"); + ret = 0; + } + if (white_x > 100000L - white_y) + { + png_warning(png_ptr, "Invalid cHRM white point"); + ret = 0; + } + if (red_x > 100000L - red_y) + { + png_warning(png_ptr, "Invalid cHRM red point"); + ret = 0; + } + if (green_x > 100000L - green_y) + { + png_warning(png_ptr, "Invalid cHRM green point"); + ret = 0; + } + if (blue_x > 100000L - blue_y) + { + png_warning(png_ptr, "Invalid cHRM blue point"); + ret = 0; + } + + png_64bit_product(green_x - red_x, blue_y - red_y, &xy_hi, &xy_lo); + png_64bit_product(green_y - red_y, blue_x - red_x, &yx_hi, &yx_lo); + + if (xy_hi == yx_hi && xy_lo == yx_lo) + { + png_warning(png_ptr, + "Ignoring attempt to set cHRM RGB triangle with zero area"); + ret = 0; + } + + return ret; +} +#endif /* NO_PNG_CHECK_cHRM */ +#endif /* PNG_cHRM_SUPPORTED */ #endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */ diff -ru4NwbB libpng-1.2.33/png.h libpng-1.2.34beta01/png.h --- libpng-1.2.33/png.h 2008-10-31 08:42:01.856878980 -0500 +++ libpng-1.2.34beta01/png.h 2008-11-27 06:44:07.355164055 -0600 @@ -211,8 +211,9 @@ * 1.2.33rc01-02 13 10233 12.so.0.33[.0] * 1.0.41rc01 10 10041 10.so.0.41[.0] * 1.2.33 13 10233 12.so.0.33[.0] * 1.0.41 10 10041 10.so.0.41[.0] + * 1.2.34beta01 13 10234 12.so.0.34[.0] * * Henceforth the source version will match the shared-library major * and minor numbers; the shared-library major version number will be * used for changes in backward compatibility, as it is intended. The @@ -3583,8 +3584,17 @@ /* Read the chunk header (length + type name) */ PNG_EXTERN png_uint_32 png_read_chunk_header PNGARG((png_structp png_ptr)); +/* Added at libpng version 1.2.34 */ +#if defined(PNG_cHRM_SUPPORTED) +PNG_EXTERN int png_check_cHRM_fixed PNGARG((png_structp png_ptr, + png_fixed_point int_white_x, png_fixed_point int_white_y, + png_fixed_point int_red_x, png_fixed_point int_red_y, png_fixed_point + int_green_x, png_fixed_point int_green_y, png_fixed_point int_blue_x, + png_fixed_point int_blue_y)); +#endif + /* Maintainer: Put new private prototypes here ^ and in libpngpf.3 */ #endif /* PNG_INTERNAL */ diff -ru4NwbB libpng-1.2.33/pngerror.c libpng-1.2.34beta01/pngerror.c --- libpng-1.2.33/pngerror.c 2008-10-31 08:42:01.884871838 -0500 +++ libpng-1.2.34beta01/pngerror.c 2008-11-27 06:44:07.383356979 -0600 @@ -1,8 +1,8 @@ /* pngerror.c - stub functions for i/o and memory allocation * - * Last changed in libpng 1.2.30 [August 15, 2008] + * Last changed in libpng 1.2.34 [November 27, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -115,11 +115,11 @@ if (warning_message[offset] == ' ') break; } } + } if (png_ptr != NULL && png_ptr->warning_fn != NULL) (*(png_ptr->warning_fn))(png_ptr, warning_message + offset); - } else png_default_warning(png_ptr, warning_message + offset); } #endif /* PNG_NO_WARNINGS */ diff -ru4NwbB libpng-1.2.33/pngrutil.c libpng-1.2.34beta01/pngrutil.c --- libpng-1.2.33/pngrutil.c 2008-10-31 08:42:01.948395150 -0500 +++ libpng-1.2.34beta01/pngrutil.c 2008-11-27 06:44:07.446897376 -0600 @@ -1,8 +1,8 @@ /* pngrutil.c - utilities to read a PNG file * - * Last changed in libpng 1.2.33 [November 27, 2008] + * Last changed in libpng 1.2.34 [November 27, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -811,44 +811,23 @@ return; uint_x = png_get_uint_32(buf); uint_y = png_get_uint_32(buf + 4); - if (uint_x > 80000L || uint_y > 80000L || - uint_x + uint_y > 100000L) - { - png_warning(png_ptr, "Invalid cHRM white point"); - return; - } int_x_white = (png_fixed_point)uint_x; int_y_white = (png_fixed_point)uint_y; uint_x = png_get_uint_32(buf + 8); uint_y = png_get_uint_32(buf + 12); - if (uint_x + uint_y > 100000L) - { - png_warning(png_ptr, "Invalid cHRM red point"); - return; - } int_x_red = (png_fixed_point)uint_x; int_y_red = (png_fixed_point)uint_y; uint_x = png_get_uint_32(buf + 16); uint_y = png_get_uint_32(buf + 20); - if (uint_x + uint_y > 100000L) - { - png_warning(png_ptr, "Invalid cHRM green point"); - return; - } int_x_green = (png_fixed_point)uint_x; int_y_green = (png_fixed_point)uint_y; uint_x = png_get_uint_32(buf + 24); uint_y = png_get_uint_32(buf + 28); - if (uint_x + uint_y > 100000L) - { - png_warning(png_ptr, "Invalid cHRM blue point"); - return; - } int_x_blue = (png_fixed_point)uint_x; int_y_blue = (png_fixed_point)uint_y; #ifdef PNG_FLOATING_POINT_SUPPORTED diff -ru4NwbB libpng-1.2.33/pngset.c libpng-1.2.34beta01/pngset.c --- libpng-1.2.33/pngset.c 2008-10-31 08:42:01.956197102 -0500 +++ libpng-1.2.34beta01/pngset.c 2008-11-27 06:44:07.454562806 -0600 @@ -1,8 +1,8 @@ /* pngset.c - storage of image information into info struct * - * Last changed in libpng 1.2.30 [August 15, 2008] + * Last changed in libpng 1.2.34 [November 27, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -39,33 +39,8 @@ { png_debug1(1, "in %s storage function\n", "cHRM"); if (png_ptr == NULL || info_ptr == NULL) return; - if (!(white_x || white_y || red_x || red_y || green_x || green_y || - blue_x || blue_y)) - { - png_warning(png_ptr, - "Ignoring attempt to set all-zero chromaticity values"); - return; - } - if (white_x < 0.0 || white_y < 0.0 || - red_x < 0.0 || red_y < 0.0 || - green_x < 0.0 || green_y < 0.0 || - blue_x < 0.0 || blue_y < 0.0) - { - png_warning(png_ptr, - "Ignoring attempt to set negative chromaticity value"); - return; - } - if (white_x > 21474.83 || white_y > 21474.83 || - red_x > 21474.83 || red_y > 21474.83 || - green_x > 21474.83 || green_y > 21474.83 || - blue_x > 21474.83 || blue_y > 21474.83) - { - png_warning(png_ptr, - "Ignoring attempt to set chromaticity value exceeding 21474.83"); - return; - } info_ptr->x_white = (float)white_x; info_ptr->y_white = (float)white_y; info_ptr->x_red = (float)red_x; @@ -93,41 +68,17 @@ png_fixed_point white_x, png_fixed_point white_y, png_fixed_point red_x, png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y, png_fixed_point blue_x, png_fixed_point blue_y) { - png_debug1(1, "in %s storage function\n", "cHRM"); + png_debug1(1, "in %s storage function\n", "cHRM fixed"); if (png_ptr == NULL || info_ptr == NULL) return; - if (!(white_x || white_y || red_x || red_y || green_x || green_y || - blue_x || blue_y)) - { - png_warning(png_ptr, - "Ignoring attempt to set all-zero chromaticity values"); - return; - } - if (white_x < 0 || white_y < 0 || - red_x < 0 || red_y < 0 || - green_x < 0 || green_y < 0 || - blue_x < 0 || blue_y < 0) - { - png_warning(png_ptr, - "Ignoring attempt to set negative chromaticity value"); - return; - } - if (white_x > (png_fixed_point) PNG_UINT_31_MAX || - white_y > (png_fixed_point) PNG_UINT_31_MAX || - red_x > (png_fixed_point) PNG_UINT_31_MAX || - red_y > (png_fixed_point) PNG_UINT_31_MAX || - green_x > (png_fixed_point) PNG_UINT_31_MAX || - green_y > (png_fixed_point) PNG_UINT_31_MAX || - blue_x > (png_fixed_point) PNG_UINT_31_MAX || - blue_y > (png_fixed_point) PNG_UINT_31_MAX ) +#if !defined(PNG_NO_CHECK_cHRM) + if (png_check_cHRM_fixed(png_ptr, + white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y)) +#endif { - png_warning(png_ptr, - "Ignoring attempt to set chromaticity value exceeding 21474.83"); - return; - } info_ptr->int_x_white = white_x; info_ptr->int_y_white = white_y; info_ptr->int_x_red = red_x; info_ptr->int_y_red = red_y; @@ -146,10 +97,11 @@ info_ptr->y_blue = (float)( blue_y/100000.); #endif info_ptr->valid |= PNG_INFO_cHRM; } -#endif -#endif +} +#endif /* PNG_FIXED_POINT_SUPPORTED */ +#endif /* PNG_cHRM_SUPPORTED */ #if defined(PNG_gAMA_SUPPORTED) #ifdef PNG_FLOATING_POINT_SUPPORTED void PNGAPI @@ -623,14 +575,12 @@ #if defined(PNG_cHRM_SUPPORTED) #ifdef PNG_FLOATING_POINT_SUPPORTED float white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y; #endif -#ifdef PNG_FIXED_POINT_SUPPORTED png_fixed_point int_white_x, int_white_y, int_red_x, int_red_y, int_green_x, int_green_y, int_blue_x, int_blue_y; #endif -#endif - png_debug1(1, "in %s storage function\n", "sRGB_gAMA_and_cHRM"); + png_debug1(1, "in %s storage function", "sRGB_gAMA_and_cHRM\n"); if (png_ptr == NULL || info_ptr == NULL) return; png_set_sRGB(png_ptr, info_ptr, intent); @@ -646,9 +596,8 @@ #endif #endif #if defined(PNG_cHRM_SUPPORTED) -#ifdef PNG_FIXED_POINT_SUPPORTED int_white_x = 31270L; int_white_y = 32900L; int_red_x = 64000L; int_red_y = 33000L; @@ -656,12 +605,8 @@ int_green_y = 60000L; int_blue_x = 15000L; int_blue_y = 6000L; - png_set_cHRM_fixed(png_ptr, info_ptr, - int_white_x, int_white_y, int_red_x, int_red_y, int_green_x, int_green_y, - int_blue_x, int_blue_y); -#endif #ifdef PNG_FLOATING_POINT_SUPPORTED white_x = (float).3127; white_y = (float).3290; red_x = (float).64; @@ -669,13 +614,27 @@ green_x = (float).30; green_y = (float).60; blue_x = (float).15; blue_y = (float).06; +#endif +#if !defined(PNG_NO_CHECK_cHRM) + if (png_check_cHRM_fixed(png_ptr, + int_white_x, int_white_y, int_red_x, int_red_y, int_green_x, + int_green_y, int_blue_x, int_blue_y)) +#endif + { +#ifdef PNG_FIXED_POINT_SUPPORTED + png_set_cHRM_fixed(png_ptr, info_ptr, + int_white_x, int_white_y, int_red_x, int_red_y, int_green_x, + int_green_y, int_blue_x, int_blue_y); +#endif +#ifdef PNG_FLOATING_POINT_SUPPORTED png_set_cHRM(png_ptr, info_ptr, white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y); #endif -#endif + } +#endif /* cHRM */ } #endif diff -ru4NwbB libpng-1.2.33/pngwutil.c libpng-1.2.34beta01/pngwutil.c --- libpng-1.2.33/pngwutil.c 2008-10-31 08:42:02.004997503 -0500 +++ libpng-1.2.34beta01/pngwutil.c 2008-11-27 06:44:07.503177938 -0600 @@ -1,8 +1,8 @@ /* pngwutil.c - utilities to write a PNG file * - * Last changed in libpng 1.2.30 [August 15, 2008] + * Last changed in libpng 1.2.34 [November 27, 2008] * For conditions of distribution and use, see copyright notice in png.h * Copyright (c) 1998-2008 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.) @@ -968,58 +968,45 @@ #ifdef PNG_USE_LOCAL_ARRAYS PNG_cHRM; #endif png_byte buf[32]; - png_uint_32 itemp; - png_debug(1, "in png_write_cHRM\n"); - /* each value is saved in 1/100,000ths */ - if (white_x < 0 || white_x > 0.8 || white_y < 0 || white_y > 0.8 || - white_x + white_y > 1.0) - { - png_warning(png_ptr, "Invalid cHRM white point specified"); -#if !defined(PNG_NO_CONSOLE_IO) - fprintf(stderr, "white_x=%f, white_y=%f\n", white_x, white_y); -#endif - return; - } - itemp = (png_uint_32)(white_x * 100000.0 + 0.5); - png_save_uint_32(buf, itemp); - itemp = (png_uint_32)(white_y * 100000.0 + 0.5); - png_save_uint_32(buf + 4, itemp); + png_fixed_point int_white_x, int_white_y, int_red_x, int_red_y, + int_green_x, int_green_y, int_blue_x, int_blue_y; - if (red_x < 0 || red_y < 0 || red_x + red_y > 1.0) - { - png_warning(png_ptr, "Invalid cHRM red point specified"); - return; - } - itemp = (png_uint_32)(red_x * 100000.0 + 0.5); - png_save_uint_32(buf + 8, itemp); - itemp = (png_uint_32)(red_y * 100000.0 + 0.5); - png_save_uint_32(buf + 12, itemp); + png_debug(1, "in png_write_cHRM"); - if (green_x < 0 || green_y < 0 || green_x + green_y > 1.0) + int_white_x = (png_uint_32)(white_x * 100000.0 + 0.5); + int_white_y = (png_uint_32)(white_y * 100000.0 + 0.5); + int_red_x = (png_uint_32)(red_x * 100000.0 + 0.5); + int_red_y = (png_uint_32)(red_y * 100000.0 + 0.5); + int_green_x = (png_uint_32)(green_x * 100000.0 + 0.5); + int_green_y = (png_uint_32)(green_y * 100000.0 + 0.5); + int_blue_x = (png_uint_32)(blue_x * 100000.0 + 0.5); + int_blue_y = (png_uint_32)(blue_y * 100000.0 + 0.5); + +#if !defined(PNG_NO_CHECK_cHRM) + if (png_check_cHRM_fixed(png_ptr, int_white_x, int_white_y, + int_red_x, int_red_y, int_green_x, int_green_y, int_blue_x, int_blue_y)) +#endif { - png_warning(png_ptr, "Invalid cHRM green point specified"); - return; - } - itemp = (png_uint_32)(green_x * 100000.0 + 0.5); - png_save_uint_32(buf + 16, itemp); - itemp = (png_uint_32)(green_y * 100000.0 + 0.5); - png_save_uint_32(buf + 20, itemp); + /* each value is saved in 1/100,000ths */ - if (blue_x < 0 || blue_y < 0 || blue_x + blue_y > 1.0) - { - png_warning(png_ptr, "Invalid cHRM blue point specified"); - return; - } - itemp = (png_uint_32)(blue_x * 100000.0 + 0.5); - png_save_uint_32(buf + 24, itemp); - itemp = (png_uint_32)(blue_y * 100000.0 + 0.5); - png_save_uint_32(buf + 28, itemp); + png_save_uint_32(buf, int_white_x); + png_save_uint_32(buf + 4, int_white_y); + + png_save_uint_32(buf + 8, int_red_x); + png_save_uint_32(buf + 12, int_red_y); + + png_save_uint_32(buf + 16, int_green_x); + png_save_uint_32(buf + 20, int_green_y); + + png_save_uint_32(buf + 24, int_blue_x); + png_save_uint_32(buf + 28, int_blue_y); png_write_chunk(png_ptr, (png_bytep)png_cHRM, buf, (png_size_t)32); } +} #endif #ifdef PNG_FIXED_POINT_SUPPORTED void /* PRIVATE */ png_write_cHRM_fixed(png_structp png_ptr, png_fixed_point white_x, @@ -1033,46 +1020,28 @@ png_byte buf[32]; png_debug(1, "in png_write_cHRM\n"); /* each value is saved in 1/100,000ths */ - if (white_x > 80000L || white_y > 80000L || white_x + white_y > 100000L) - { - png_warning(png_ptr, "Invalid fixed cHRM white point specified"); -#if !defined(PNG_NO_CONSOLE_IO) - fprintf(stderr, "white_x=%ld, white_y=%ld\n", (unsigned long)white_x, - (unsigned long)white_y); +#if !defined(PNG_NO_CHECK_cHRM) + if (png_check_cHRM_fixed(png_ptr, white_x, white_y, red_x, red_y, + green_x, green_y, blue_x, blue_y)) #endif - return; - } + { png_save_uint_32(buf, (png_uint_32)white_x); png_save_uint_32(buf + 4, (png_uint_32)white_y); - if (red_x + red_y > 100000L) - { - png_warning(png_ptr, "Invalid cHRM fixed red point specified"); - return; - } png_save_uint_32(buf + 8, (png_uint_32)red_x); png_save_uint_32(buf + 12, (png_uint_32)red_y); - if (green_x + green_y > 100000L) - { - png_warning(png_ptr, "Invalid fixed cHRM green point specified"); - return; - } png_save_uint_32(buf + 16, (png_uint_32)green_x); png_save_uint_32(buf + 20, (png_uint_32)green_y); - if (blue_x + blue_y > 100000L) - { - png_warning(png_ptr, "Invalid fixed cHRM blue point specified"); - return; - } png_save_uint_32(buf + 24, (png_uint_32)blue_x); png_save_uint_32(buf + 28, (png_uint_32)blue_y); png_write_chunk(png_ptr, (png_bytep)png_cHRM, buf, (png_size_t)32); } +} #endif #endif #if defined(PNG_WRITE_tRNS_SUPPORTED) @@ -1337,9 +1306,9 @@ if (key_len > 79) { png_warning(png_ptr, "keyword length must be 1 - 79 characters"); - new_key[79] = '\0'; + (*new_key)[79] = '\0'; key_len = 79; } return (key_len);