[devel] Complete rewrite of png_decompress_chunk() by John Bowler

This commit is contained in:
Glenn Randers-Pehrson 2010-02-12 20:12:56 -06:00
parent 389c1f20ad
commit 9d51afcacb
2 changed files with 148 additions and 361 deletions

View File

@ -1,7 +1,7 @@
/* pngpriv.h - private declarations for use inside libpng
*
* libpng version 1.5.0beta05 - February 9, 2010
* libpng version 1.4.1beta11 - February 13, 2010
* For conditions of distribution and use, see copyright notice in png.h
* Copyright (c) 1998-2010 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@ -306,8 +306,6 @@ PNG_EXTERN void png_crc_read PNGARG((png_structp png_ptr, png_bytep buf,
/* Decompress data in a chunk that uses compression */
#if defined(PNG_zTXt_SUPPORTED) || defined(PNG_iTXt_SUPPORTED) || \
defined(PNG_iCCP_SUPPORTED) || defined(PNG_sPLT_SUPPORTED)
PNG_EXTERN png_size_t png_measure_decompressed_chunk PNGARG((png_structp
png_ptr, int comp_type, png_size_t chunklength, png_size_t prefix_length));
PNG_EXTERN void png_decompress_chunk PNGARG((png_structp png_ptr,
int comp_type, png_size_t chunklength, png_size_t prefix_length,
png_size_t *data_length));

View File

@ -1,7 +1,7 @@
/* pngrutil.c - utilities to read a PNG file
*
* Last changed in libpng 1.4.1 [February 12, 2010]
* Last changed in libpng 1.4.1 [February 13, 2010]
* Copyright (c) 1998-2010 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@ -201,72 +201,93 @@ png_crc_error(png_structp png_ptr)
#if defined(PNG_READ_zTXt_SUPPORTED) || defined(PNG_READ_iTXt_SUPPORTED) || \
defined(PNG_READ_iCCP_SUPPORTED)
png_size_t
png_measure_decompressed_chunk(png_structp png_ptr, int comp_type,
png_size_t chunklength, png_size_t prefix_size)
static png_size_t
png_inflate(png_structp png_ptr, const png_byte *data, png_size_t size,
png_bytep output, png_size_t output_size)
{
png_charp text;
png_charp test = "X";
png_size_t text_size = 0;
png_size_t count = 0;
if (comp_type == PNG_COMPRESSION_TYPE_BASE)
png_ptr->zstream.next_in = (png_bytep)data; /* const_cast: VALID */
png_ptr->zstream.avail_in = size;
while (1)
{
int ret = Z_OK;
int ret, avail;
png_ptr->zstream.next_in = (png_bytep)(png_ptr->chunkdata + prefix_size);
png_ptr->zstream.avail_in = (uInt)(chunklength - prefix_size);
/* Reset the output buffer each time round - we empty it
* after every inflate call.
*/
png_ptr->zstream.next_out = png_ptr->zbuf;
png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
png_ptr->zstream.avail_out = png_ptr->zbuf_size;
text = NULL;
ret = inflate(&png_ptr->zstream, Z_NO_FLUSH);
avail = png_ptr->zbuf_size - png_ptr->zstream.avail_out;
while (png_ptr->zstream.avail_in)
/* First copy/count any new output - but only if we didn't
* get an error code.
*/
if ((ret == Z_OK || ret == Z_STREAM_END) && avail > 0)
{
ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
if (ret != Z_OK && ret != Z_STREAM_END)
break;
if (output != 0 && output_size > count)
{
int copy = output_size - count;
if (avail < copy) copy = avail;
png_memcpy(output + count, png_ptr->zbuf, copy);
}
count += avail;
}
if (!png_ptr->zstream.avail_out || ret == Z_STREAM_END)
{
if (text == NULL) /* Initialize the decompression buffer */
{
text_size = prefix_size +
png_ptr->zbuf_size - png_ptr->zstream.avail_out;
if (ret == Z_OK)
continue;
/* Termination conditions - always reset the zstream, it
* must be left in inflateInit state.
*/
png_ptr->zstream.avail_in = 0;
inflateReset(&png_ptr->zstream);
text=test;
}
else /* Enlarge the decompression buffer */
{
text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
#ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
if (png_ptr->user_chunk_malloc_max &&
(text_size >= png_ptr->user_chunk_malloc_max - 1))
#else
if ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
text_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)
#endif
{
png_warning(png_ptr,
"Exceeded malloc limit while expanding chunk");
text_size = 0;
break;
}
}
}
if (ret == Z_STREAM_END)
break;
return count; /* NOTE: may be zero. */
/* Now handle the error codes - the API always returns 0
* and the error message is dumped into the uncompressed
* buffer if available.
*/
{
char *msg, umsg[52];
if (png_ptr->zstream.msg != 0)
msg = png_ptr->zstream.msg;
else
{
png_ptr->zstream.next_out = png_ptr->zbuf;
png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
}
#ifdef PNG_STDIO_SUPPORTED
switch (ret)
{
case Z_BUF_ERROR:
msg = "Buffer error in compressed datastream in %s chunk";
break;
case Z_DATA_ERROR:
msg = "Data error in compressed datastream in %s chunk";
break;
default:
msg = "Incomplete compressed datastream in %s chunk";
break;
}
inflateReset(&png_ptr->zstream);
png_ptr->zstream.avail_in = 0;
png_snprintf(umsg, sizeof umsg, msg, png_ptr->chunk_name);
msg = umsg;
#else
msg = "Damaged compressed datastream in chunk other than IDAT";
#endif
}
png_warning(png_ptr, msg);
}
/* 0 means an error - notice that this code simple ignores
* zero length compressed chunks as a result.
*/
return 0;
}
return text_size;
}
/*
@ -281,338 +302,106 @@ png_decompress_chunk(png_structp png_ptr, int comp_type,
png_size_t chunklength,
png_size_t prefix_size, png_size_t *newlength)
{
static PNG_CONST char msg[] = "Error decoding compressed chunk";
png_charp text;
png_size_t text_size;
png_size_t expanded_size;
expanded_size = png_measure_decompressed_chunk(png_ptr, comp_type,
chunklength, prefix_size);
if (expanded_size == 0)
/* The caller should guarantee this */
if (prefix_size > chunklength)
{
*newlength=0;
return;
/* The recovery is to delete the chunk. */
png_warning(png_ptr, "invalid chunklength");
prefix_size = 0; /* To delete everything */
}
else if (comp_type == PNG_COMPRESSION_TYPE_BASE)
{
png_size_t expanded_size = png_inflate(png_ptr,
png_ptr->chunkdata + prefix_size,
chunklength - prefix_size,
0/*output*/, 0/*output size*/);
if (comp_type == PNG_COMPRESSION_TYPE_BASE)
{
int ret = Z_OK;
png_ptr->zstream.next_in = (png_bytep)(png_ptr->chunkdata + prefix_size);
png_ptr->zstream.avail_in = (uInt)(chunklength - prefix_size);
png_ptr->zstream.next_out = png_ptr->zbuf;
png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
text_size = 0;
text = NULL;
while (png_ptr->zstream.avail_in)
{
ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
if (ret != Z_OK && ret != Z_STREAM_END)
{
if (png_ptr->zstream.msg != NULL)
png_warning(png_ptr, png_ptr->zstream.msg);
else
png_warning(png_ptr, msg);
inflateReset(&png_ptr->zstream);
png_ptr->zstream.avail_in = 0;
if (text == NULL)
{
text_size = prefix_size + png_sizeof(msg) + 1;
text = (png_charp)png_malloc_warn(png_ptr, text_size);
if (text == NULL)
{
png_free(png_ptr, png_ptr->chunkdata);
png_ptr->chunkdata = NULL;
png_error(png_ptr, "Not enough memory to decompress chunk");
}
png_memcpy(text, png_ptr->chunkdata, prefix_size);
}
text[text_size - 1] = 0x00;
/* Copy what we can of the error message into the text chunk */
text_size = (png_size_t)(chunklength -
(text - png_ptr->chunkdata) - 1);
if (text_size > png_sizeof(msg))
text_size = png_sizeof(msg);
png_memcpy(text + prefix_size, msg, text_size);
break;
}
if (!png_ptr->zstream.avail_out || ret == Z_STREAM_END)
{
if (text == NULL)
{
text_size = prefix_size +
png_ptr->zbuf_size - png_ptr->zstream.avail_out;
text = (png_charp)png_malloc_warn(png_ptr, text_size + 1);
if (text == NULL)
{
png_free(png_ptr, png_ptr->chunkdata);
png_ptr->chunkdata = NULL;
png_error(png_ptr,
"Not enough memory to decompress chunk");
}
png_memcpy(text + prefix_size, png_ptr->zbuf,
text_size - prefix_size);
png_memcpy(text, png_ptr->chunkdata, prefix_size);
*(text + text_size) = 0x00;
}
else
{
png_charp tmp;
tmp = text;
text = (png_charp)png_malloc_warn(png_ptr,
(png_size_t)(text_size +
png_ptr->zbuf_size - png_ptr->zstream.avail_out + 1));
if (text == NULL)
{
png_free(png_ptr, tmp);
png_free(png_ptr, png_ptr->chunkdata);
png_ptr->chunkdata = NULL;
png_error(png_ptr,
"Not enough memory to decompress chunk");
}
png_memcpy(text, tmp, text_size);
png_free(png_ptr, tmp);
png_memcpy(text + text_size, png_ptr->zbuf,
(png_ptr->zbuf_size - png_ptr->zstream.avail_out));
text_size += png_ptr->zbuf_size - png_ptr->zstream.avail_out;
*(text + text_size) = 0x00;
}
if (ret == Z_STREAM_END)
break;
else
{
png_ptr->zstream.next_out = png_ptr->zbuf;
png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
}
}
}
if (ret != Z_STREAM_END)
{
#ifdef PNG_STDIO_SUPPORTED
char umsg[52];
if (ret == Z_BUF_ERROR)
png_snprintf(umsg, 52,
"Buffer error in compressed datastream in %s chunk",
png_ptr->chunk_name);
else if (ret == Z_DATA_ERROR)
png_snprintf(umsg, 52,
"Data error in compressed datastream in %s chunk",
png_ptr->chunk_name);
else
png_snprintf(umsg, 52,
"Incomplete compressed datastream in %s chunk",
png_ptr->chunk_name);
png_warning(png_ptr, umsg);
/* Now check the limits on this chunk - if the limit fails the
* compressed data will be removed, the prefix will remain.
*/
#ifdef PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED
if (png_ptr->user_chunk_malloc_max &&
(prefix_size + expanded_size >= png_ptr->user_chunk_malloc_max - 1))
#else
png_warning(png_ptr,
"Incomplete compressed datastream in chunk other than IDAT");
if ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&
prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)
#endif
text_size = prefix_size;
if (text == NULL)
png_warning(png_ptr, "Exceeded size limit while expanding chunk");
/* If the size is zero either there was an error and a message
* has already been output (warning) or the size really is zero
* and we have nothing to do - the code will exit through the
* error case below.
*/
else if (expanded_size > 0)
{
text = (png_charp)png_malloc_warn(png_ptr, text_size+1);
if (text == NULL)
/* Success (maybe) - really uncompress the chunk. */
png_size_t new_size = 0;
png_charp text = png_malloc_warn(png_ptr,
prefix_size + expanded_size + 1);
if (text != NULL)
{
png_free(png_ptr, png_ptr->chunkdata);
png_ptr->chunkdata = NULL;
png_error(png_ptr, "Not enough memory for text");
}
png_memcpy(text, png_ptr->chunkdata, prefix_size);
}
*(text + text_size) = 0x00;
}
inflateReset(&png_ptr->zstream);
png_ptr->zstream.avail_in = 0;
new_size = png_inflate(png_ptr,
png_ptr->chunkdata + prefix_size,
chunklength - prefix_size,
text + prefix_size, expanded_size);
text[prefix_size + expanded_size] = 0; /* just in case */
if (new_size == expanded_size)
{
png_free(png_ptr, png_ptr->chunkdata);
png_ptr->chunkdata = text;
*newlength=text_size;
*newlength = prefix_size + expanded_size;
return; /* The success return! */
}
png_warning(png_ptr, "png_inflate logic error");
png_free(png_ptr, text);
}
else
png_warning(png_ptr, "Not enough memory to decompress chunk");
}
}
else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */
{
#ifdef PNG_STDIO_SUPPORTED
char umsg[50];
png_snprintf(umsg, 50, "Unknown zTXt compression type %d", comp_type);
#ifdef PNG_STDIO_SUPPORTED
png_snprintf(umsg, sizeof umsg, "Unknown zTXt compression type %d", comp_type);
png_warning(png_ptr, umsg);
#else
png_warning(png_ptr, "Unknown zTXt compression type");
#endif
*(png_ptr->chunkdata + prefix_size) = 0x00;
*newlength = prefix_size;
}
}
#if 0 /* doesn't work */
{
static PNG_CONST char msg[] = "Error decoding compressed chunk";
png_charp text;
png_size_t text_size;
png_size_t expanded_size;
expanded_size = png_measure_decompressed_chunk(png_ptr, comp_type,
chunklength, prefix_size);
if (expanded_size == 0)
{
*newlength=0;
return;
/* The recovery is to simply drop the data. */
}
if (comp_type == PNG_COMPRESSION_TYPE_BASE)
/* Generic error return - leave the prefix, delete the compressed
* data, reallocate the chunkdata to remove the potentially large
* amount of compressed data.
*/
{
int ret = Z_OK;
png_ptr->zstream.next_in = (png_bytep)(png_ptr->chunkdata + prefix_size);
png_ptr->zstream.avail_in = (uInt)(chunklength - prefix_size);
png_ptr->zstream.next_out = png_ptr->zbuf;
png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
text_size = 0;
text = NULL;
while (png_ptr->zstream.avail_in)
png_charp text = png_malloc_warn(png_ptr, prefix_size + 1);
if (text != NULL)
{
ret = inflate(&png_ptr->zstream, Z_PARTIAL_FLUSH);
if (ret != Z_OK && ret != Z_STREAM_END)
{
if (png_ptr->zstream.msg != NULL)
png_warning(png_ptr, png_ptr->zstream.msg);
else
png_warning(png_ptr, msg);
inflateReset(&png_ptr->zstream);
png_ptr->zstream.avail_in = 0;
if (text == NULL)
{
text_size = prefix_size + png_sizeof(msg) + 1;
text = (png_charp)png_malloc_warn(png_ptr, text_size);
if (text == NULL)
{
png_error(png_ptr,
"Not enough memory to decompress chunk");
text_size = 0;
break;
}
if (prefix_size > 0)
png_memcpy(text, png_ptr->chunkdata, prefix_size);
}
text[text_size - 1] = 0x00;
/* Copy what we can of the error message into the text chunk */
text_size = (png_size_t)(chunklength -
(text - png_ptr->chunkdata) - 1);
if (text_size > png_sizeof(msg))
text_size = png_sizeof(msg);
png_memcpy(text + prefix_size, msg, text_size);
break;
}
if (!png_ptr->zstream.avail_out || ret == Z_STREAM_END)
{
if (text == NULL) /* Initialize the decompression buffer */
{
text_size = expanded_size;
text = (png_charp)png_malloc_warn(png_ptr, text_size + 1);
if (text == NULL)
{
png_error(png_ptr,
"Not enough memory to decompress chunk");
text_size = 0;
break;
}
png_memcpy(text + prefix_size, png_ptr->zbuf,
text_size - prefix_size);
png_memcpy(text, png_ptr->chunkdata, prefix_size);
*(text + text_size) = 0x00;
}
if (ret == Z_STREAM_END)
break;
else
{
png_ptr->zstream.next_out = png_ptr->zbuf;
png_ptr->zstream.avail_out = (uInt)png_ptr->zbuf_size;
}
}
}
if (ret != Z_STREAM_END)
{
#ifdef PNG_STDIO_SUPPORTED
char umsg[52];
if (ret == Z_BUF_ERROR)
png_snprintf(umsg, 52,
"Buffer error in compressed datastream in %s chunk",
png_ptr->chunk_name);
else if (ret == Z_DATA_ERROR)
png_snprintf(umsg, 52,
"Data error in compressed datastream in %s chunk",
png_ptr->chunk_name);
else
png_snprintf(umsg, 52,
"Incomplete compressed datastream in %s chunk",
png_ptr->chunk_name);
png_warning(png_ptr, umsg);
#else
png_warning(png_ptr,
"Incomplete compressed datastream in chunk other than IDAT");
#endif
text_size = prefix_size;
if (text == NULL)
{
text = (png_charp)png_malloc_warn(png_ptr, text_size+1);
if (text == NULL)
{
png_free(png_ptr, png_ptr->chunkdata);
png_ptr->chunkdata = NULL;
png_error(png_ptr, "Not enough memory for text");
}
png_memcpy(text, png_ptr->chunkdata, prefix_size);
}
*(text + text_size) = 0x00;
}
inflateReset(&png_ptr->zstream);
png_ptr->zstream.avail_in = 0;
png_free(png_ptr, png_ptr->chunkdata);
png_ptr->chunkdata = text;
*newlength=text_size;
}
else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */
{
#ifdef PNG_STDIO_SUPPORTED
char umsg[50];
png_snprintf(umsg, 50, "Unknown zTXt compression type %d", comp_type);
png_warning(png_ptr, umsg);
#else
png_warning(png_ptr, "Unknown zTXt compression type");
#endif
/* This is an extra zero in the 'uncompressed' part. */
*(png_ptr->chunkdata + prefix_size) = 0x00;
*newlength = prefix_size;
}
/* Ignore a malloc error here - it is safe. */
}
*newlength = prefix_size;
}
#endif
#endif
/* Read and check the IDHR chunk */
void /* PRIVATE */