Apply the same class of robustness fix from the previous commit to
`png_set_text`, `png_set_sPLT` and `png_set_unknown_chunks`. These
append-style setters used `png_realloc_array` to grow the internal
array, then freed the old array before copying from the caller's
input. If the caller's pointer was obtained from the corresponding
getter, it aliased the freed array.
The fix defers the freeing of the old array until after the copy loop.
Also extend the pnggetset regression test to cover all three setters.
Apply a robustness fix for a caller-side API usage pattern involving
the getters and the setters for PLTE, tRNS, and hIST.
Passing a pointer returned by the PLTE, tRNS, or hIST getters back
into the corresponding setters used to cause the setters to read from
a stale pointer. The fix consists in snapshotting the caller's data
into a stack-local buffer before freeing the old internal storage.
Fixespnggroup/libpng#836
Reported-by: Iv4n <Iv4n550@noreply.github.com>
Guard the pointer advance with `y+1 < height` inside the function
`compare_two_images` to skip this advance on the last iteration.
With a negative stride, the unconditional `row += stride` in the
for-statement produced a pointer before the allocated object on
the final iteration. Standard C permits one-after-end but not
one-before-beginning; this is undefined behavior regardless of
whether the pointer is dereferenced or not.
Add the option --negative-stride to pngstest. When set, the row stride
is negated after buffer allocation but before calling the library, so
that `png_image_finish_read` and `png_image_write_to_file` exercise the
bottom-up (negative stride) code paths.
Add CI targets for the CMake build and for the configure build:
- pngstest-negative-stride:
Bottom-up layout with images covering colormapped, truecolor, alpha,
8-bit, 16-bit, and short-height paths.
- pngstest-negative-stride-extra:
Same with --stride-extra 7 for non-aligned padding with bottom-up
layout.
Note: the interlaced pngsuite images (`ibasn*.png`) are incompatible
with pngstest's format conversion comparison framework, so the
`png_image_read_direct_scaled` path (interlaced 16-to-8 conversion) is
not exercised by this test. A dedicated test for that path will require
interlaced images generated with the correct gamma properties for
pngstest's comparison logic, which is TODO.
Split compound declarations of pointer variables for improved clarity.
Rename local loop boundary variables, remove their sterile const
qualifiers, and reorder their declarations to improve local cohesion.
This is a cherry-pick of commit 1ebf432e85
from branch 'libpng18'.
Remove the top-level const qualifiers from local variables and from
function parameters passed by value. These qualifiers only constrain
the local object within the function body: they neither affect function
signatures, nor constrain callers, nor protect any shared state.
Throughout the libpng codebase we apply const only where it
meaningfully constrains objects beyond the immediate scope, such as
true constants and pointed-to objects.
This is a cherry-pick of commit e973362b8b
from branch 'libpng18'.
The type of the row stride (`display->row_bytes`) is ptrdiff_t. Casting
to png_uint_16 before division will truncate large strides, causing
incorrect pointer arithmetic for images exceeding 65535 bytes per row.
For bottom-up images (negative stride), the truncation also corrupts
the sign, advancing the row pointer forward instead of backward.
Remove the erroneous casts and let the compiler handle the pointer
arithmetic correctly. Also replace `sizeof (png_uint_16)` with 2.
Add regression test via `pngstest --stride-extra N` where N > 32767
triggers the affected code paths.
A NOTE ABOUT HISTORY:
The original code in libpng 1.5.6 (2011) had no such casts. They were
introduced in libpng 1.6.26 (2016), likely to silence compiler warnings
on 16-bit systems where the cast would be a no-op. On 32/64-bit systems
the cast truncates the strides above 65535 and corrupts the negative
strides.
Split compound declarations of pointer variables for improved clarity.
Rename local loop boundary variables, remove their sterile const
qualifiers, and reorder their declarations to improve local cohesion.
Remove the top-level const qualifiers from local variables and from
function parameters passed by value. These qualifiers only constrain
the local object within the function body: they neither affect function
signatures, nor constrain callers, nor protect any shared state.
Throughout the libpng codebase we apply const only where it
meaningfully constrains objects beyond the immediate scope, such as
true constants and pointed-to objects.
In the previous commits
- "refactor: Replace deprecated pointer typedefs (part 1)"
- "refactor: Replace deprecated pointer typedefs (part 2)"
the volatile qualifiers in the rewritten declarations were mistakenly
placed on the left side of declaration types, effectively making them
bottom-level. (Oopsie!)
Move these qualifiers to the right side, restoring their intended
top-level status.
Following up on commit 7c67f70da1:
Replace 22 deprecated pointer typedefs with their underlying types.
The typedefs replaced are:
1. Core structure types:
- png_structp, png_structrp, png_structpp and const variants
- png_infop, png_inforp, png_infopp and const variants
2. Utility structure types:
- png_row_infop, png_row_infopp
- png_imagep, png_imagepp
- png_controlp
3. Color structure types:
- png_colorp, png_colorpp and const variants
- png_color_8p, png_color_8pp and const variants
- png_color_16p, png_color_16pp and const variants
4. Text and time structure types:
- png_textp, png_textpp and const variants
- png_timep, png_timepp and const variants
5. Chunk structure types:
- png_unknown_chunkp, png_unknown_chunkpp and const variants
- png_sPLT_tp, png_sPLT_tpp and const variants
- png_sPLT_entryp, png_sPLT_entrypp and const variants
6. Internal types:
- png_compression_bufferp
- png_dsortp, png_dsortpp
Remove all remaining uses of spurious PNG_RESTRICT qualifiers.
Non-aliasing has already been guaranteed by the type-based aliasing
rules combined with the libpng usage pattern of a single pointer per
type.
Update the user manual accordingly.
This completes the systematic replacement of deprecated pointer
typedefs across the entire libpng codebase. The typedef declarations
remain in png.h for backward compatibility, marked as deprecated.
Reviewed-by: Chris Blume <ProgramMax@gmail.com>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
Following up on commit ddce3ff853:
1. Replace 28 deprecated pointer typedefs with their underlying types.
The typedefs replaced are:
- Basic: png_voidp, png_charp and const variants
- Byte: png_bytep, png_const_bytep, png_bytepp
- Numeric:
- Integer: 16/32-bit integer pointer variants
- Fixed-point: png_fixed_point_p and variants
- Floating-point: png_doublep and variants
2. Remove a spurious PNG_RESTRICT qualifier. Non-aliasing has already
been guaranteed by the type-based aliasing rules.
3. Update the user manual accordingly.
Reviewed-by: Chris Blume <ProgramMax@gmail.com>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
We should use `FILE *` instead of `FILE*` or `(FILE*)`, consistently,
as we should for all other pointer types. Moreover, when we refer to
standard stdio file objects in comments and in documentation, we should
use the term "FILE objects" consistently.
Lastly, we clarify in a comment in example.c that `PNG_STDIO_SUPPORTED`
is true only when the stdio support is both available in the system and
accessible in the user's libpng build.
This is a cherry-pick of commit c63c546390
from branch 'libpng18'.
Reviewed-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
The computer industry has spoken rather clearly: we shall have
8-bit bytes, powers-of-2- and multiples-of-8-bit ints and floats,
one-size-fits-all pointers, and C API calling conventions for
system-level interoperability between applications and libraries.
So we're going to have all that and we're going to like it. Which
we do. We use the opportunity to shed annotations and make libpng
less baroque, both in interface and in implementation.
Reviewed-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
We should use `FILE *` instead of `FILE*` or `(FILE*)`, consistently,
as we should for all other pointer types. Moreover, when we refer to
standard stdio file objects in comments and in documentation, we should
use the term "FILE objects" consistently.
Lastly, we clarify in a comment in example.c that `PNG_STDIO_SUPPORTED`
is true only when the stdio support is both available in the system and
accessible in the user's libpng build.
Reviewed-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
pngimage: The code simply exited with a return code of 99 in the event
of a user error including giving pngimage invalid PNG files and an
internal error. It now attempts to clean up the state before doing so,
matching the normal behaviour.
pngimage: Non-ISO use of setjmp(3) corrected.
pngerror.c: Failure to call png_image_free on a false result from a
png_safe_execute function call fixed. This was a regression caused by
the 'volatile' clean-up. Not normally detectable because png_image_free
will often be called by the application.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This adds APIs to get/set the two remaining new PNG-v3 colour space
chunks. The mDCV API matches that of cHRM. Both chunks support
floating point APIs (all values in the two chunks are real numbers).
Both chunks have a new encoded type, a four-digit-precision fixed-point
number, which cannot be represented in the existing `png_fixed_point`
type, so a `png_uint_32` is used.
Test examples for cICP, cLLI and mDCV are now in pngtest.png, and a
necessary change to the pngunknown.c test program has been made to
accomodate the additions.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
Embarcadero's compilers, old (Borland-based) and new (Clang-based),
do have full support for Standard C. The Clang-based compiler is
claiming, through the macro __STDC_VERSION__, to support C99 and C11,
whereas the Borland-based compiler supports ANSI C, as it has for
decades.
However, their run-time library is exposing global functions beyond
the scope of Standard C, for backwards compatibility with the older
Borland products. One of these functions is `randomize`, which clashes
with a function inside pngvalid.c that incidentally has the same name.
Building libpng in "Strict ANSI C" mode, in which all Borland-specific
globals are hidden (e.g. via `bcc32 -A`), would have been a workable
solution for the Borland-based ANSI C compiler, but no such solution
appears to exist for the Clang-based C90/C99/C11 compiler.
Fortunately, renaming a private function inside a test program is a
cost-free alternative fix.
This is a cherry-pick of commit 6184164aa7
from branch 'libpng18'.
Embarcadero's compilers, old (Borland-based) and new (Clang-based),
do have full support for Standard C. The Clang-based compiler is
claiming, through the macro __STDC_VERSION__, to support C99 and C11,
whereas the Borland-based compiler supports ANSI C, as it has for
decades.
However, their run-time library is exposing global functions beyond
the scope of Standard C, for backwards compatibility with the older
Borland products. One of these functions is `randomize`, which clashes
with a function inside pngvalid.c that incidentally has the same name.
Building libpng in "Strict ANSI C" mode, in which all Borland-specific
globals are hidden (e.g. via `bcc32 -A`), would have been a workable
solution for the Borland-based ANSI C compiler, but no such solution
appears to exist for the Clang-based C90/C99/C11 compiler.
Fortunately, renaming a private function inside a test program is a
cost-free alternative fix.
Disable the check on `interlace_method` inside function `compare_read`
in pngimage.c, if WRITE_INTERLACING is not supported.
If interlaced encoding is disabled inside libpng, the encoded images
are non-interlaced silently and unconditionally. This commit updates
the image comparison to skip the interlace check in the resultant
image; other behavior is still checked.
This is a cherry-pick of commit d9f13d8d84
from branch 'libpng18'.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
Disable the check on `interlace_method` inside function `compare_read`
in pngimage.c, if WRITE_INTERLACING is not supported.
If interlaced encoding is disabled inside libpng, the encoded images
are non-interlaced silently and unconditionally. This commit updates
the image comparison to skip the interlace check in the resultant
image; other behavior is still checked.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
The leading blank lines are apparently an artefact of an older source
control system. They are not required and they look like accidents,
because starting a source file with a blank line is not a regular habit
of software developers nowadays.
This is a cherry-pick of commit 37cc20add8
from branch 'libpng18'.
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
The leading blank lines are apparently an artefact of an older source
control system. They are not required and they look like accidents,
because starting a source file with a blank line is not a regular habit
of software developers nowadays.
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This removes some of the 10700 checks that can safely be removed as
they depend on the major require in libpng-1.7 which is not happening
in libpng-1.8.
The checks in pngvalid.c remain, because it may (should) be possible to
fix (or partially fix) the underlying libpng bugs in 1.8. The checks
document what those bugs are. Ideally, the 10700 branch of the #if's
can be used after a fix.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
In commit 96bc902169 we forked the new
branch for libpng-1.8, but we left some of the preprocessor conditions
targeted at libpng-1.7 unresolved. Some of those were resolved in the
subsequent commits.
In this commit we are cleaning up the remaining ones.
The function `png_convert_to_rfc1123` was deprecated in libpng-1.6 and
and removed from libpng-1.7. We are also removing it from libpng-1.8.
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This corrects the checks to that libpng 10800 does not turn on the
enhanced transform checks in either pngvalid or pngstest. The correct
fix is to change the 10700 code for comments which explain what aspect
or aspects of the transforms are broken (ideally) or at least state that
the transforms are broken.
This is a cherry-pick of commit aec888ab80
from branch 'libpng18'.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This corrects the checks to that libpng 10800 does not turn on the
enhanced transform checks in either pngvalid or pngstest. The correct
fix is to change the 10700 code for comments which explain what aspect
or aspects of the transforms are broken (ideally) or at least state that
the transforms are broken.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This adds a new configuration file, 'contrib/conftest/basic.dfa' which
disables unused APIs on a test Linux-based system. So support the
configuration several fixes were necessary in the test programs so that
the tests are skipped correctly when APIs are not available.
The configuration has been tested on a range of common Linux apps
including web browser code (qtwebengine), image processing code (e.g.
ImageMagick) and general display code (X11, Qt5 and Qt6, KDE). Overall
this first step reduces libpng linked code and data size to about 2/3 of
the full configuration.
To use the new test simply copy basic.dfa to 'pngusr.dfa' in the root of
the source directory and build.
Signed-off-by: John Bowler <jbowler@acm.org>
pngimage.c:
Initialize sig_bits on a NOTREACHED path to avoid warnings about using
uninitialized variables.
pngstest.c:
Enlarge buffers and fix signedness to avoid legitimate warnings about
potential buffer overflows.
pngunknown.c:
pngvalid.c:
Use NULL instead of 0 for pointers and apply other style fixes.
makepng.c:
tarith.c:
Apply various style fixes.
Also remove the "last changed" version info from source comments.
The version control system maintains this information automatically.
I got a warning while compiling under Ubuntu 18.04 and gcc 7.4:
"__BSD_SOURCE and _SVID_SOURCE are deprecated, use _DEFAULT_SOURCE"
Quote from the Linux Programmer's Manual:
"To allow code that requires _BSD_SOURCE in glibc 2.19 and earlier and
_DEFAULT_SOURCE in glibc 2.20 and later to compile without warnings,
define both _BSD_SOURCE and _DEFAULT_SOURCE."
As per the const correctness rules, top-level const-ness of data
in automatic scopes does not propagate outside of these scopes
(unlike const-ness at lower levels, such as pointers to const data).
Previously, const was used liberally, but inconsistently across the
libpng codebase. Using const wherever applicable is not incorrect.
However, _consistent_ use of const is difficult to maintain in such
conditions.
In conclusion, we shall continue to use const only where doing so is
strictly necessary:
1. If a function guarantees that it will not modify an argument
passed by pointer, the corresponding function parameter should be
a pointer-to-const (const T *).
2. Static data should not be modified, therefore it should be const.
Reference:
Google C++ Style Guide
https://google.github.io/styleguide/cppguide.html#Use_of_const
