Imported from libpng-1.2.11beta2cos.tar

CHANGES

@@ -1576,10 +1576,14 @@ version 1.2.11beta2 [June 2, 2006]
     buffer overflow.
   Fixed bug in example.c (png_set_palette_rgb -> png_set_palette_to_rgb))
 
-Send comments/corrections/commendations to png-mng-implement at lists.sf.net
+version 1.2.11beta2-cos [June 4, 2006]
-(subscription required; visit
+  Prepended "#! /bin/sh" to ltmail.sh and contrib/pngminus/*.sh (Cosmin).
-https://lists.sourceforge.net/lists/listinfo/png-mng-implement
+  Removed the accidental leftover Makefile.in~ (Cosmin).
-to subscribe)
+  Removed the include directories and libraries from CFLAGS and LDFLAGS
-or to glennrp at users.sourceforge.net
+    in scripts/makefile.gcc (Nelson A. de Oliveira, Cosmin).
-
+  Exported png_write_sig (Cosmin).
-Glenn R-P
+  Optimized buffer in png_handle_cHRM() (Cosmin).
+  Avoided potential buffer overflow and optimized buffer in
+    png_write_sCAL(), png_write_sCAL_s() (Cosmin).
+  Set pHYs = 2835 x 2835 pixels per meter, and added
+    sCAL = 0.352778e-3 x 0.352778e-3 meters, in pngtest.png (Cosmin).

contrib/pngminus/png2pnm.sh

@@ -1,3 +1,4 @@
+#!/bin/sh
 # -- grayscale
 ./png2pnm -noraw ../pngsuite/basn0g01.png basn0g01.pgm
 ./png2pnm -noraw ../pngsuite/basn0g02.png basn0g02.pgm

contrib/pngminus/pngminus.sh

@@ -1,3 +1,4 @@
+#!/bin/sh
 make -f makefile.std
 sh png2pnm.sh
 sh pnm2png.sh

contrib/pngminus/pnm2png.sh

@@ -1,3 +1,4 @@
+#!/bin/sh
 # -- grayscale
 ./pnm2png basn0g01.pgm basn0g01.png
 ./pnm2png basn0g02.pgm basn0g02.png

libpng.3

@@ -802,6 +802,10 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.2.11beta2
 
 \fI\fB
 
+\fBvoid png_write_sig (png_structp \fIpng_ptr\fP\fB);\fP
+
+\fI\fB
+
 \fBvoidpf png_zalloc (voidpf \fP\fIpng_ptr\fP\fB, uInt \fP\fIitems\fP\fB, uInt \fIsize\fP\fB);\fP
 
 \fI\fB

libpngpf.3

@@ -711,12 +711,6 @@ libpng \- Portable Network Graphics (PNG) Reference Library 1.2.11beta2
 
 \fI\fB
 
-\fBvoid png_write_sig (png_structp \fIpng_ptr\fP\fB);\fP
-
-\fI\fB
-
-\fI\fB
-
 \fBvoid png_write_sRGB (png_structp \fP\fIpng_ptr\fP\fB, int \fIintent\fP\fB);\fP
 
 \fI\fB

ltmain.sh

@@ -1,3 +1,4 @@
+#! /bin/sh
 # ltmain.sh - Provide generalized library-building support services.
 # NOTE: Changing this file will not affect anything until you rerun configure.
 #

png.h

@@ -1434,6 +1434,9 @@ extern PNG_EXPORT(png_structp,png_create_write_struct_2)
    png_malloc_ptr malloc_fn, png_free_ptr free_fn));
 #endif
 
+/* Write the PNG file signature. */
+extern PNG_EXPORT(void,png_write_sig) PNGARG((png_structp png_ptr));
+
 /* Write a PNG chunk - size, type, (optional) data, CRC. */
 extern PNG_EXPORT(void,png_write_chunk) PNGARG((png_structp png_ptr,
    png_bytep chunk_name, png_bytep data, png_size_t length));
@@ -2955,9 +2958,6 @@ PNG_EXTERN void png_calculate_crc PNGARG((png_structp png_ptr, png_bytep ptr,
 PNG_EXTERN void png_flush PNGARG((png_structp png_ptr));
 #endif
 
-/* simple function to write the signature */
-PNG_EXTERN void png_write_sig PNGARG((png_structp png_ptr));
-
 /* write various chunks */
 
 /* Write the IHDR chunk, and update the png_struct with the necessary

pngrutil.c

@@ -715,7 +715,7 @@ png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 void /* PRIVATE */
 png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
-   png_byte buf[4];
+   png_byte buf[32];
 #ifdef PNG_FLOATING_POINT_SUPPORTED
    float white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y;
 #endif
@@ -756,62 +756,46 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       return;
    }
 
-   png_crc_read(png_ptr, buf, 4);
+   png_crc_read(png_ptr, buf, 32);
+   if (png_crc_finish(png_ptr, 0))
+      return;
+
    uint_x = png_get_uint_32(buf);
-
+   uint_y = png_get_uint_32(buf + 4);
-   png_crc_read(png_ptr, buf, 4);
-   uint_y = png_get_uint_32(buf);
-
    if (uint_x > 80000L || uint_y > 80000L ||
       uint_x + uint_y > 100000L)
    {
       png_warning(png_ptr, "Invalid cHRM white point");
-      png_crc_finish(png_ptr, 24);
       return;
    }
    int_x_white = (png_fixed_point)uint_x;
    int_y_white = (png_fixed_point)uint_y;
 
-   png_crc_read(png_ptr, buf, 4);
+   uint_x = png_get_uint_32(buf + 8);
-   uint_x = png_get_uint_32(buf);
+   uint_y = png_get_uint_32(buf + 12);
-
-   png_crc_read(png_ptr, buf, 4);
-   uint_y = png_get_uint_32(buf);
-
    if (uint_x + uint_y > 100000L)
    {
       png_warning(png_ptr, "Invalid cHRM red point");
-      png_crc_finish(png_ptr, 16);
       return;
    }
    int_x_red = (png_fixed_point)uint_x;
    int_y_red = (png_fixed_point)uint_y;
 
-   png_crc_read(png_ptr, buf, 4);
+   uint_x = png_get_uint_32(buf + 16);
-   uint_x = png_get_uint_32(buf);
+   uint_y = png_get_uint_32(buf + 20);
-
-   png_crc_read(png_ptr, buf, 4);
-   uint_y = png_get_uint_32(buf);
-
    if (uint_x + uint_y > 100000L)
    {
       png_warning(png_ptr, "Invalid cHRM green point");
-      png_crc_finish(png_ptr, 8);
       return;
    }
    int_x_green = (png_fixed_point)uint_x;
    int_y_green = (png_fixed_point)uint_y;
 
-   png_crc_read(png_ptr, buf, 4);
+   uint_x = png_get_uint_32(buf + 24);
-   uint_x = png_get_uint_32(buf);
+   uint_y = png_get_uint_32(buf + 28);
-
-   png_crc_read(png_ptr, buf, 4);
-   uint_y = png_get_uint_32(buf);
-
    if (uint_x + uint_y > 100000L)
    {
       png_warning(png_ptr, "Invalid cHRM blue point");
-      png_crc_finish(png_ptr, 0);
       return;
    }
    int_x_blue = (png_fixed_point)uint_x;
@@ -829,7 +813,7 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
 
 #if defined(PNG_READ_sRGB_SUPPORTED)
-   if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))
+   if ((info_ptr != NULL) && (info_ptr->valid & PNG_INFO_sRGB))
       {
       if (PNG_OUT_OF_RANGE(int_x_white, 31270,  1000) ||
           PNG_OUT_OF_RANGE(int_y_white, 32900,  1000) ||
@@ -840,7 +824,6 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
           PNG_OUT_OF_RANGE(int_x_blue,  15000,  1000) ||
           PNG_OUT_OF_RANGE(int_y_blue,   6000,  1000))
          {
-
             png_warning(png_ptr,
               "Ignoring incorrect cHRM value when sRGB is also present");
 #ifndef PNG_NO_CONSOLE_IO
@@ -857,7 +840,6 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
 #endif /* PNG_NO_CONSOLE_IO */
          }
-         png_crc_finish(png_ptr, 0);
          return;
       }
 #endif /* PNG_READ_sRGB_SUPPORTED */
@@ -871,8 +853,6 @@ png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
       int_x_white, int_y_white, int_x_red, int_y_red, int_x_green,
       int_y_green, int_x_blue, int_y_blue);
 #endif
-   if (png_crc_finish(png_ptr, 0))
-      return;
 }
 #endif
 

pngwutil.c

@@ -49,6 +49,23 @@ png_save_uint_16(png_bytep buf, unsigned int i)
    buf[1] = (png_byte)(i & 0xff);
 }
 
+/* Simple function to write the signature.  If we have already written
+ * the magic bytes of the signature, or more likely, the PNG stream is
+ * being embedded into another stream and doesn't need its own signature,
+ * we should call png_set_sig_bytes() to tell libpng how many of the
+ * bytes have already been written.
+ */
+void PNGAPI
+png_write_sig(png_structp png_ptr)
+{
+   png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
+   /* write the rest of the 8 byte signature */
+   png_write_data(png_ptr, &png_signature[png_ptr->sig_bytes],
+      (png_size_t)8 - png_ptr->sig_bytes);
+   if(png_ptr->sig_bytes < 3)
+      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
+}
+
 /* Write a PNG chunk all at once.  The type is an array of ASCII characters
  * representing the chunk name.  The array must be at least 4 bytes in
  * length, and does not need to be null terminated.  To be safe, pass the
@@ -117,23 +134,6 @@ png_write_chunk_end(png_structp png_ptr)
    png_write_data(png_ptr, buf, (png_size_t)4);
 }
 
-/* Simple function to write the signature.  If we have already written
- * the magic bytes of the signature, or more likely, the PNG stream is
- * being embedded into another stream and doesn't need its own signature,
- * we should call png_set_sig_bytes() to tell libpng how many of the
- * bytes have already been written.
- */
-void /* PRIVATE */
-png_write_sig(png_structp png_ptr)
-{
-   png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
-   /* write the rest of the 8 byte signature */
-   png_write_data(png_ptr, &png_signature[png_ptr->sig_bytes],
-      (png_size_t)8 - png_ptr->sig_bytes);
-   if(png_ptr->sig_bytes < 3)
-      png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE;
-}
-
 #if defined(PNG_WRITE_TEXT_SUPPORTED) || defined(PNG_WRITE_iCCP_SUPPORTED)
 /*
  * This pair of functions encapsulates the operation of (a) compressing a
@@ -1567,39 +1567,41 @@ png_write_pCAL(png_structp png_ptr, png_charp purpose, png_int_32 X0,
 /* write the sCAL chunk */
 #if defined(PNG_FLOATING_POINT_SUPPORTED) && !defined(PNG_NO_STDIO)
 void /* PRIVATE */
-png_write_sCAL(png_structp png_ptr, int unit, double width,double height)
+png_write_sCAL(png_structp png_ptr, int unit, double width, double height)
 {
 #ifdef PNG_USE_LOCAL_ARRAYS
    PNG_sCAL;
 #endif
+   char buf[64];
    png_size_t total_len;
-   char wbuf[32], hbuf[32];
-   png_byte bunit = (png_byte)unit;
 
    png_debug(1, "in png_write_sCAL\n");
 
+   buf[0] = (char)unit;
 #if defined(_WIN32_WCE)
 /* sprintf() function is not supported on WindowsCE */
    {
       wchar_t wc_buf[32];
+      size_t wc_len;
       swprintf(wc_buf, TEXT("%12.12e"), width);
-      WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, wbuf, 32, NULL, NULL);
+      wc_len = wcslen(wc_buf);
+      WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, buf + 1, wc_len, NULL, NULL);
+      total_len = wc_len + 2;
       swprintf(wc_buf, TEXT("%12.12e"), height);
-      WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, hbuf, 32, NULL, NULL);
+      wc_len = wcslen(wc_buf);
+      WideCharToMultiByte(CP_ACP, 0, wc_buf, -1, buf + total_len, wc_len,
+         NULL, NULL);
+      total_len += wc_len;
    }
 #else
-   sprintf(wbuf, "%12.12e", width);
+   sprintf(buf + 1, "%12.12e", width);
-   sprintf(hbuf, "%12.12e", height);
+   total_len = 1 + png_strlen(buf + 1) + 1;
+   sprintf(buf + total_len, "%12.12e", height);
+   total_len += png_strlen(buf + total_len);
 #endif
-   total_len = 1 + png_strlen(wbuf)+1 + png_strlen(hbuf);
 
-   png_debug1(3, "sCAL total length = %d\n", (int)total_len);
+   png_debug1(3, "sCAL total length = %u\n", (unsigned int)total_len);
-   png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len);
+   png_write_chunk(png_ptr, (png_bytep)png_sCAL, (png_bytep)buf, total_len);
-   png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1);
-   png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1);
-   png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf));
-
-   png_write_chunk_end(png_ptr);
 }
 #else
 #ifdef PNG_FIXED_POINT_SUPPORTED
@@ -1610,23 +1612,26 @@ png_write_sCAL_s(png_structp png_ptr, int unit, png_charp width,
 #ifdef PNG_USE_LOCAL_ARRAYS
    PNG_sCAL;
 #endif
-   png_size_t total_len;
+   png_byte buf[64];
-   char wbuf[32], hbuf[32];
+   png_size_t wlen, hlen, total_len;
-   png_byte bunit = unit;
 
    png_debug(1, "in png_write_sCAL_s\n");
 
-   png_strcpy(wbuf,(const char *)width);
+   wlen = png_strlen(width);
-   png_strcpy(hbuf,(const char *)height);
+   hlen = png_strlen(height);
-   total_len = 1 + png_strlen(wbuf)+1 + png_strlen(hbuf);
+   total_len = wlen + hlen + 2;
+   if (total_len > 64)
+   {
+      png_warning(png_ptr, "Can't write sCAL (buffer too small)");
+      return;
+   }
 
-   png_debug1(3, "sCAL total length = %d\n", total_len);
+   buf[0] = (png_byte)unit;
-   png_write_chunk_start(png_ptr, (png_bytep)png_sCAL, (png_uint_32)total_len);
+   png_memcpy(buf + 1, width, wlen + 1);      /* append the '\0' here */
-   png_write_chunk_data(png_ptr, (png_bytep)&bunit, 1);
+   png_memcpy(buf + wlen + 2, height, hlen);  /* do NOT append the '\0' here */
-   png_write_chunk_data(png_ptr, (png_bytep)wbuf, png_strlen(wbuf)+1);
-   png_write_chunk_data(png_ptr, (png_bytep)hbuf, png_strlen(hbuf));
 
-   png_write_chunk_end(png_ptr);
+   png_debug1(3, "sCAL total length = %u\n", (unsigned int)total_len);
+   png_write_chunk(png_ptr, (png_bytep)png_sCAL, buf, total_len);
 }
 #endif
 #endif

scripts/makefile.gcc

@@ -18,13 +18,16 @@ CDEBUG = -g -DPNG_DEBUG=5
 LDDEBUG =
 CRELEASE = -O2
 LDRELEASE = -s
-CFLAGS = -I$(ZLIBINC) -Wall $(CRELEASE)
+#CFLAGS = -Wall $(CDEBUG)
-LDFLAGS = -L. -L$(ZLIBLIB) -lpng -lz -lm $(LDRELEASE)
+CFLAGS = -Wall $(CRELEASE)
+#LDFLAGS = $(LDDEBUG)
+LDFLAGS = $(LDRELEASE)
+LIBS = -lz -lm
 
 # File extensions
 O=.o
 A=.a
-E=
+EXE=
 
 # Variables
 OBJS = png$(O) pngerror$(O) pngget$(O) pngmem$(O) pngpread$(O) \
@@ -32,20 +35,30 @@ OBJS = png$(O) pngerror$(O) pngget$(O) pngmem$(O) pngpread$(O) \
        pngtrans$(O) pngwio$(O) pngwrite$(O) pngwtran$(O) pngwutil$(O)
 
 # Targets
-all: libpng$(A) pngtest$(E)
+all: static
+
+.c$(O):
+	$(CC) -c $(CFLAGS) -I$(ZLIBINC) $<
+
+static: libpng$(A) pngtest$(EXE)
+
+shared:
+	@echo This is a generic makefile that cannot create shared libraries.
+	@echo Please use a configuration that is specific to your platform.
+	@false
 
 libpng$(A): $(OBJS)
 	$(AR_RC) $@ $(OBJS)
 	$(RANLIB) $@
 
-test: pngtest$(E)
+test: pngtest$(EXE)
-	./pngtest$(E)
+	./pngtest$(EXE)
 
-pngtest$(E): pngtest$(O) libpng$(A)
+pngtest$(EXE): pngtest$(O) libpng$(A)
-	$(LD) -o $@ pngtest$(O) $(LDFLAGS)
+	$(LD) $(LDFLAGS) -L$(ZLIBLIB) -o $@ pngtest$(O) libpng$(A) $(LIBS)
 
 clean:
-	$(RM_F) *$(O) libpng$(A) pngtest$(E) pngout.png
+	$(RM_F) *$(O) libpng$(A) pngtest$(EXE) pngout.png
 
 png$(O): png.h pngconf.h
 pngerror$(O): png.h pngconf.h

scripts/pngos2.def

@@ -223,6 +223,9 @@ EXPORTS
   png_get_uint_31
   png_set_expand_gray_1_2_4_to_8
 
+; Added at version 1.2.11
+  png_write_sig
+
 ; These are not present when libpng is compiled with PNG_NO_GLOBAL_ARRAYS
   png_libpng_ver
   png_pass_start

scripts/pngw32.def

@@ -234,3 +234,5 @@ EXPORTS
   png_save_int_32 @205
   png_get_uint_31 @206
   png_set_expand_gray_1_2_4_to_8  @207
+; Added at version 1.2.11
+  png_write_sig @208