Apply a robustness fix for a caller-side API usage pattern involving
the getters and the setters for PLTE, tRNS, and hIST.
Passing a pointer returned by the PLTE, tRNS, or hIST getters back
into the corresponding setters used to cause the setters to read from
a stale pointer. The fix consists in snapshotting the caller's data
into a stack-local buffer before freeing the old internal storage.
Fixespnggroup/libpng#836
Reported-by: Iv4n <Iv4n550@noreply.github.com>
Add the option --negative-stride to pngstest. When set, the row stride
is negated after buffer allocation but before calling the library, so
that `png_image_finish_read` and `png_image_write_to_file` exercise the
bottom-up (negative stride) code paths.
Add CI targets for the CMake build and for the configure build:
- pngstest-negative-stride:
Bottom-up layout with images covering colormapped, truecolor, alpha,
8-bit, 16-bit, and short-height paths.
- pngstest-negative-stride-extra:
Same with --stride-extra 7 for non-aligned padding with bottom-up
layout.
Note: the interlaced pngsuite images (`ibasn*.png`) are incompatible
with pngstest's format conversion comparison framework, so the
`png_image_read_direct_scaled` path (interlaced 16-to-8 conversion) is
not exercised by this test. A dedicated test for that path will require
interlaced images generated with the correct gamma properties for
pngstest's comparison logic, which is TODO.
The type of the row stride (`display->row_bytes`) is ptrdiff_t. Casting
to png_uint_16 before division will truncate large strides, causing
incorrect pointer arithmetic for images exceeding 65535 bytes per row.
For bottom-up images (negative stride), the truncation also corrupts
the sign, advancing the row pointer forward instead of backward.
Remove the erroneous casts and let the compiler handle the pointer
arithmetic correctly. Also replace `sizeof (png_uint_16)` with 2.
Add regression test via `pngstest --stride-extra N` where N > 32767
triggers the affected code paths.
A NOTE ABOUT HISTORY:
The original code in libpng 1.5.6 (2011) had no such casts. They were
introduced in libpng 1.6.26 (2016), likely to silence compiler warnings
on 16-bit systems where the cast would be a no-op. On 32/64-bit systems
the cast truncates the strides above 65535 and corrupts the negative
strides.
contrib/conftest/read-full.dfa failed on the bad palette tests in
tests/pngtest-all because the error message for writing a PNG with a
bad palette index was not output.
pngtest-all now checks for PNG_WRITE_SUPPORTED and, if not set, skips
the check for the write error message.
This is a cherry-pick of commit f276c3383f
from branch 'develop'.
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: John Bowler <jbowler@acm.org>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
This adds a new configuration file, 'contrib/conftest/basic.dfa' which
disables unused APIs on a test Linux-based system. So support the
configuration several fixes were necessary in the test programs so that
the tests are skipped correctly when APIs are not available.
The configuration has been tested on a range of common Linux apps
including web browser code (qtwebengine), image processing code (e.g.
ImageMagick) and general display code (X11, Qt5 and Qt6, KDE). Overall
this first step reduces libpng linked code and data size to about 2/3 of
the full configuration.
To use the new test simply copy basic.dfa to 'pngusr.dfa' in the root of
the source directory and build.
Signed-off-by: John Bowler <jbowler@acm.org>
Previously the 'make check' test pngtest-all looked for given messages
at EOL. The match failed with Windows/MSYS2 because of the Windows
<cr><lf> line endings output by pngtest. This changes the test to look
for the message anywhere in a line; this might give false matches but
the specific messages being searched for are not likely to cause this
problem.
Signed-off-by: John Bowler <jbowler@acm.org>
The test always failed on systems with no support for zlib
inflateValidate and on systems where the png_set_option setting was
disabled, however pngtest-all succeeded because the failure was ignored.
The latter is now fixed so the badadler.png check needs to use --xfail,
not --relaxed.
Signed-off-by: John Bowler <jbowler@acm.org>
This change is only verifiable in configure builds; cmake only executes
the basic test.
The previous version of tests/pngtest-all only returned the status code
of the final test. Apparently it could never fail. This adds checking
of all return status codes.
The change also adds a basic approach for regression testing with PNGs
that should fail a test; --strict ensures that PNGs which are valid do
not start to be reported as erroneous, this is the inverse.
At present the code (minimal traditional Bourne shell) only tests the
palette index checking code, a potentially important check if apps rely
on it.
The changes have been tested using the configure build both with a
regression which causes the libpng checking to cease to work and with a
corrected (reverted regression). The regression test verifies that the
intended check works as expected.
Signed-off-by: John Bowler <jbowler@acm.org>
It is unreliable to run pngtest in parallel, due to competing writes
to the same intermediate/output file ("pngout.png").
Customization of this output file name should be possible, but it is
currently broken.
Moved testing of bad pngs into a separate tests/pngtest-badpngs script
Added the --xfail (expected FAIL) option to pngtest.c. It writes XFAIL
in the output but PASS for the libpng test.
Remove the '--strict' in 1.6 because of the double-gamma-correction warning,
update pngstest-errors.h for the errors detected with the new contrib/testspngs
PNG test files.
Signed-off-by: John Bowler <jbowler@acm.org>
tests/pngstest-* are changed so that the new test files are divided into 8
groups by gamma and alpha channel. This makes each test take just under 5
seconds on a moderately up-to-date x86_64 system using libpng16 (test times are
somewhat variable under libpng17 at present because of the lack of optimization
in some gamma processing paths.)
These tests have considerably better code and pixel-value coverage than
contrib/pngsuite however coverage is still incomplete.
Signed-off-by: John Bowler <jbowler@acm.org>
This updates libpng16 with all the test changes from libpng17,
including changes to pngvalid.c to ensure that the original,
distributed, version of contrib/visupng/cexcept.h can be used.
pngvalid contains the correction to the use of SAVE/STORE_
UNKNOWN_CHUNKS; a bug revealed by changes in libpng 1.7. More
tests contain the --strict option to detect warnings and the
pngvalid-standard test has been corrected so that it does not
turn on progresive-read (there is a separate test which does
that.)
Some signed/unsigned fixes have been made.
Signed-off-by: John Bowler <jbowler@acm.org>
