read a PNG, the result will be in the same color type as the PNG (hence "generic")*/
| 4514 | |
| 4515 | /*read a PNG, the result will be in the same color type as the PNG (hence "generic")*/ |
| 4516 | static void decodeGeneric(unsigned char** out, unsigned* w, unsigned* h, |
| 4517 | LodePNGState* state, |
| 4518 | const unsigned char* in, size_t insize) |
| 4519 | { |
| 4520 | unsigned char IEND = 0; |
| 4521 | const unsigned char* chunk; |
| 4522 | size_t i; |
| 4523 | ucvector idat; /*the data from idat chunks*/ |
| 4524 | ucvector scanlines; |
| 4525 | size_t predict; |
| 4526 | size_t numpixels; |
| 4527 | size_t outsize = 0; |
| 4528 | |
| 4529 | /*for unknown chunk order*/ |
| 4530 | unsigned unknown = 0; |
| 4531 | #ifdef LODEPNG_COMPILE_ANCILLARY_CHUNKS |
| 4532 | unsigned critical_pos = 1; /*1 = after IHDR, 2 = after PLTE, 3 = after IDAT*/ |
| 4533 | #endif /*LODEPNG_COMPILE_ANCILLARY_CHUNKS*/ |
| 4534 | |
| 4535 | /*provide some proper output values if error will happen*/ |
| 4536 | *out = 0; |
| 4537 | |
| 4538 | state->error = lodepng_inspect(w, h, state, in, insize); /*reads header and resets other parameters in state->info_png*/ |
| 4539 | if(state->error) return; |
| 4540 | |
| 4541 | numpixels = *w * *h; |
| 4542 | |
| 4543 | /*multiplication overflow*/ |
| 4544 | if(*h != 0 && numpixels / *h != *w) CERROR_RETURN(state->error, 92); |
| 4545 | /*multiplication overflow possible further below. Allows up to 2^31-1 pixel |
| 4546 | bytes with 16-bit RGBA, the rest is room for filter bytes.*/ |
| 4547 | if(numpixels > 268435455) CERROR_RETURN(state->error, 92); |
| 4548 | |
| 4549 | ucvector_init(&idat); |
| 4550 | chunk = &in[33]; /*first byte of the first chunk after the header*/ |
| 4551 | |
| 4552 | /*loop through the chunks, ignoring unknown chunks and stopping at IEND chunk. |
| 4553 | IDAT data is put at the start of the in buffer*/ |
| 4554 | while(!IEND && !state->error) |
| 4555 | { |
| 4556 | unsigned chunkLength; |
| 4557 | const unsigned char* data; /*the data in the chunk*/ |
| 4558 | |
| 4559 | /*error: size of the in buffer too small to contain next chunk*/ |
| 4560 | if((size_t)((chunk - in) + 12) > insize || chunk < in) CERROR_BREAK(state->error, 30); |
| 4561 | |
| 4562 | /*length of the data of the chunk, excluding the length bytes, chunk type and CRC bytes*/ |
| 4563 | chunkLength = lodepng_chunk_length(chunk); |
| 4564 | /*error: chunk length larger than the max PNG chunk size*/ |
| 4565 | if(chunkLength > 2147483647) CERROR_BREAK(state->error, 63); |
| 4566 | |
| 4567 | if((size_t)((chunk - in) + chunkLength + 12) > insize || (chunk + chunkLength + 12) < in) |
| 4568 | { |
| 4569 | CERROR_BREAK(state->error, 64); /*error: size of the in buffer too small to contain next chunk*/ |
| 4570 | } |
| 4571 | |
| 4572 | data = lodepng_chunk_data_const(chunk); |
| 4573 |
no test coverage detected